docs(plans): amend security plan trackers; close A-2026-07-15

- security-hardening-remediation.md: status header now records that only
  W2-4 and W3-3 remain open (verified by the 2026-07-23 deletion audit),
  with a staleness note scoping the deleted store/-and-Postgres
  references as historical. Closes audit finding A-2026-07-15.
- security-scan-2026-07-22-remediation.md: F6 recorded as committed
  (ef58c04); resume checklist trimmed — F3 (voice E2EE identity TOFU)
  is the only remaining finding.
- audit-2026-07-19.md: A-2026-07-15 closure row flipped to RESOLVED.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/audit-2026-07-19.md

@@ -28,7 +28,7 @@ accepted-risk note before the beta gate. MEDIUMs are folded into the backlog
 | A-2026-07-12 | MEDIUM | Abandoned SolidJS beachhead still in-tree; `docs/client-architecture.md` describes the abandoned architecture | CLOSED 2026-07-19 — beachhead, adapters, build plugin, and Solid deps removed; client-architecture.md retired in favor of architecture/client.md |
 | A-2026-07-13 | LOW | Dead schema: `sounds` table survives soundboard removal (correction 2026-07-19: `audit_log_v6` is only a transient rename inside migration 003, not a coexisting table) | OPEN |
 | A-2026-07-14 | LOW | Scattered client constants (`#5865F2` ×18, `localhost:8443` ×3); 64 timer call sites with manual lifecycle | OPEN |
-| A-2026-07-15 | LOW | `docs/plans/security-hardening-remediation.md` partly stale (references deleted `store/postgres.go`) | OPEN |
+| A-2026-07-15 | LOW | `docs/plans/security-hardening-remediation.md` partly stale (references deleted `store/postgres.go`) | RESOLVED 2026-07-23 — staleness note added scoping the dead `store/`/Postgres references as historical; status header now records that only W2-4 and W3-3 remain open, with the doc as their tracker of record |
 | A-2026-07-16 | HIGH | Server-wide permission rule hand-rolled at 2 sites (`RequirePermission` raw any-of bit test; `ModerationService`); channel-level `deny` silently dropped — and cached for 30s — when the override fetch errors, at 2 of 5 sites | RESOLVED 2026-07-23 (D13) — `permissions.HasServerPerm` now owns the server-scoped rule (both sites collapse onto it; multi-bit masks are all-of); both override-fetch sites fail closed (`getOrPopulate` skips the fetch for admins, denies and caches nothing on error; `ListVisibleChannels` returns `ErrInternal`); the fifth D9 site (`GetAccessibleChannelIDs`) routes through `VisibleChannelIDs`. Locked by failing-first tests. See [plans/permission-middleware-consolidation.md](plans/permission-middleware-consolidation.md) |
 
 ---

docs/plans/security-hardening-remediation.md

@@ -1,10 +1,19 @@
 # Plan: Remediate security-hardening review regressions
 
-**Status:** design only, not implemented
+**Status:** mostly landed — verified 2026-07-23 (deletion audit): every item
+except **W2-4** and **W3-3** has been implemented or superseded. This doc is
+the tracker of record for those two; close it when they land.
 **Owner:** TBD
 **Tracks:** code review of branch `fix/security-hardening-review` (2026-07-17)
 **Estimated effort:** 2–4 focused days
 
+> **Staleness note (2026-07-23, closes audit A-2026-07-15):** item bodies below
+> predate two structural changes — the Postgres backend was deleted outright
+> (P1, 2026-07-20) and the `Server/store/` seam was removed in favor of direct
+> narrow interfaces on `db` (D3, 2026-07-19). Read `Server/store/postgres.go`
+> / `sqlite.go` references as historical; the Postgres halves of W1-3 are moot,
+> and its atomic-link half is what W2-4 still needs.
+
 ## Why
 
 The `fix/security-hardening-review` branch lands a broad, well-intentioned

docs/plans/security-scan-2026-07-22-remediation.md

@@ -15,7 +15,7 @@ This is a continuation/handoff doc: what is done, what remains, and how to resum
 | F3 | MED | Voice E2EE trusts server-relayed ECDH keys (server MITM) | ⏳ **TODO — designed, not started** |
 | F4 | MED | HTTP TOFU proxy accepts any cert on first use (credential exposure) | ✅ done, committed `f22985a` |
 | F5 | LOW | Voice perms use stale connect-time role snapshot | ✅ done, committed `260d038` |
-| F6 | LOW | Lost cache invalidation in `PermissionService.getOrPopulate` | ✅ done, **uncommitted** (see note) |
+| F6 | LOW | Lost cache invalidation in `PermissionService.getOrPopulate` | ✅ done, committed `e6a0d87` |
 | F7 | LOW | ReDoS regex on link-preview HTML | ✅ done, committed `6952202` |
 | F8 | LOW | WS TOFU verifier accepts any cert on first use | ✅ done, committed `f22985a` (with F4) |
 
@@ -26,12 +26,11 @@ This is a continuation/handoff doc: what is done, what remains, and how to resum
    `cd Client/tauri-client/src-tauri && cargo clippy -- -D warnings` (or push and
    let CI do it). Pure `tofu` logic has `#[cfg(test)]` unit tests; the frontend is
    covered by the 3311-green unit suite.
-2. **F6 commit:** F6 lives in `Server/service/permission.go`, entangled with the
+2. **Then F3** — the only remaining finding (below). (F6 landed 2026-07-23 as
-   uncommitted permission-consolidation edits. It rides with that work (per
+   `e6a0d87`, split out from the D13 permission-consolidation commits that
-   decision) — commit it when the consolidation branch lands, or cherry-pick.
+   followed it on this branch.)
-3. **Then F3** — the only remaining finding (below).
 
-## F6 detail (done, pending commit)
+## F6 detail (done, committed `e6a0d87`)
 
 `getOrPopulate` read the DB then cached the snapshot with no version guard, so a
 concurrent `InvalidateUser` racing the populate was silently overwritten (stale