Audit of the principles in CLAUDE.md and docs/architecture/ against the
actual code. Principles with a working automated check (poison-tolerant
locking, Android source sync, one-directional playback state, graceful
backend init, reachability-from-traffic) all held up. The two that drifted
are exactly the two whose checks were broken or too narrow:
- traceability-gate-repair: CI divided by hardcoded denominators
(UR/39, IR/24, DR/48, JA/3, total 114) while requirements.md had grown
to 211, reporting 158% coverage — the 50% threshold was unreachable and
the job could not fail.
- req-coverage-script-removal: check-req-coverage.sh reports
"1 requirement" and prints "all requirements have implementations".
- scoped-search-boundary-implementation: the founding boundary incident
was specced but never built; the leak is still live.
- boundary-tripwire-hardening: check:boundary passes on that same leak —
the pattern is anchored to the query site, so a named const evades it.
- player-facade-enforcement: 52 direct commands.player* call sites
outside the facade, and no automated check at all.
Each spec follows SPEC-TEMPLATE.md with a filled-in Layer assignment
table and is checked against SPEC-REVIEW-CHECKLIST.md.
