docs: weekly TODOs re-verification and MODULE_AUDIT refresh (August 2, 2026)

[cursor]

The weekly todo-triage pass. INBOX.md was empty, so this is steps 2–5: re-verify the open backlog against current source, review the week's landings, rewrite the audit from what the backlog now says, and fix the docs the week invalidated.

The heaviest week the repo has had — 359 → 501 source files, 14 → 19 library targets, three new modules (Flyover, Inspector's boot runtime, LifecycleKitUI), demo mode reshaping composition around WhereScope, and spans pushed through every expensive path in the app.

What moved in the backlog

Every open item in all 11 TODOs.md files was read against current source. Most citations moved and are corrected; the verdicts that changed:

Closed: WherePreferences.init(store:) lost its parameter default (#150), IntentSnippets' preview literal is localized, the LocationsView/YearView empty-state snapshot cases exist, and SnapshotCase now rebuilds content per configuration.

Corrected rather than carried:

• The "one remaining isCapturingSnapshot read that isn't a stand-in" claim was wrong — LaunchSplashView reads it twice more. Both are sanctioned carve-outs (a wall-clock timer and a motion end-state), which is the distinction the old wording lost. CalendarContentView's scroll skip is still the real exception.
• Periscope's "no eager store handle" item described a WhereModel that no longer exists; Add demo mode, and open nothing until the user picks a world #150 replaced the bare Optional<PeriscopeStore> with a typed LogStoreState. The consumer side is honest now; the async make() that forces the state machine is what's still open.
• The SnapshotKit shared-content item is half fixed — SnapshotCase is no longer the culprit, one runner call site is.
• The where.gregorian_calendar P0 said "seven production sites"; it's four shipped sites plus preview fixtures, and there are now zero explicit Calendar.current spellings left, so the rule's match set is provably empty.

Three new findings:

1. WhereTests double-links LifecycleKit beside WhereUI, and never imports it (Project.swift:311-315) — exactly what the "Never double-link a product WhereUI already carries" rule forbids. It slipped past because the rule's prose scopes itself to the unitTests helper's extraPackageProducts and WhereTests is hand-rolled, and because the guard test lives in WhereUITests. WhereTests is in Stuff-iOS-Tests, which is where the failure reproduces.
2. A store opened without a resolvable URL silently loses remote-change observation in release (SwiftDataStore.swift:222-229) — the else branch is a bare assertionFailure, so a debug build traps and a release build returns a store that never sees a share-extension add or a CloudKit sync.
3. Flyover shipped 50 sources against 10 namesake test files — the largest untested surface in the repo. Opened Shared/Flyover/TODOs.md for it.

What the audit now says

Rewritten from the refreshed backlog. Two things worth flagging in the report itself rather than only in the diff:

• The July 26 pass listed the LifecycleKit terminal-phase race as an open high against a tree where Typed LifecycleKit: compile-checked launch plans, engine/UI split, Where migration #116 had already fixed it that same day. The new report says so instead of quietly dropping it.
• The severity-count tables are gone. They mixed filed items with findings folded into module summaries, so they couldn't be reconciled against the backlog — which is the only place a finding lives. A top-findings table of pointers replaces them.

It also records what verified clean, which a backlog has no room for — including Inspector's twelve data-deletion safety invariants, each checked against code individually rather than sampled, and all twelve enforced.

Docs

• Where/AGENTS.md documented Inspector's boot runtime but not Flyover, which landed the same week.
• WhereUI/AGENTS.md claimed views don't branch on \.isCapturingSnapshot. Three do; the rule is now stated as the carve-out it actually is, with the one real exception named so it doesn't read as precedent.
• SnapshotKitTesting/AGENTS.md quoted settle-cost percentages measured over 260 references; it's 273 now. Dated the measurement and added a tripwire rather than restating stale numbers as current.
• Root AGENTS.md listed the image suites that don't link WhereUI; Flyover's is a third.

Regenerated the CLAUDE.md mirrors with ./sync-agents.

Verification

This pass ran on Linux, so it is static analysis only — no test, build, or bumper lint run backs any runtime claim, and the audit's Limitations section says so. What did execute: ./swiftformat --lint (clean, 0/818) and ./attribution --check (clean, 7 credits). CI on main was read via gh and is green through 0cce6578, which is what lets the "the Gregorian rule finds nothing" conclusion stand.

Every claim published here was spot-checked against source by hand after the verification fan-out, not taken from it directly.

Markdown only — no code changes.