docs+chore: fold in the parity re-measure, reconcile the coverage matrix, prune worktrees

[Adron]

Summary

Housekeeping that came out of the 2026-09-07 parity sweep. Individually trivial, collectively worth one PR.

---

1. Fold the parity re-measure into work-consolidation.md

docs/parity-refresh-2026-09 carries one unmerged commit (cc57a46) that:

• corrects the AI provisioning model (no user API key — the single most important correction in that revision)
• reconciles the doc with what actually merged (§1c verb defects and G15–G20 were still listed as open)
• records the real test baseline
• adds §1e for the 2026-09-06 account-cluster sweep

Until it merges, the master planning doc contradicts the code on dev. Merge it, then update it again with the findings from this sweep (see item 2).

⚠️ work-consolidation.md is edited by several concurrent sessions. Merge it on its own, not bundled into a feature PR.

2. Record the 2026-09-07 findings in the master doc

New facts this sweep established that are not yet written down anywhere:

• The live spec is now 228 paths / 296 operations (was 226/294 on 2026-09-05); the client builds ~180 request builders covering ~150 distinct operations.
• accountStatus exists on the User schema and is unmodelled by the client — filed as its own issue.
• 45 operations are x-auth-type: session and reject Bearer. The ones that matter: invite/share claim, send-verification-email, user/engagement, dashboard-layout, front-wall-layout, and every widgets/* route. This makes the dashboard work backend-blocked, not merely undecided.
• List folders are still a live, documented web feature (/api/folders, 4 ops) despite being removed from macOS in PR refactor(lists): remove the List Folders feature, keep parent/child list nesting #19.
• The message permalink shape in MessagePermalink is wrong — /messages/{id} redirects to /login; the public form is /user/{username}/status/{id}.
• GET /api/github/orgs returns a bare array, not the usual {message?, <resource>} envelope.

3. Reconcile docs/api-coverage.md

The matrix was last audited 2026-09-05 at 187 rows. Since then PR #24, #25, #30, #31, #32, #33, #34 landed. Re-score it, and add rows for anything this sweep surfaced that it does not carry (/api/folders, /api/users/{username}/documents, /api/auth/github/status, /api/github/orgs, accountStatus).

Record x-auth-type per row while you are in there — "the client cannot reach this under Bearer" is coverage information the matrix currently has no column for, and it is the difference between "not built" and "not buildable".

4. Prune stale worktrees

Ten worktrees exist under .claude/worktrees/; most are for branches already merged:

appsettings-fix       fix/app-settings-first-run-404       (merged, PR #30)
composer-visibility   feat/reply-repost-default-visibility
crash-report          feat/crash-reporting                 (merged, PR #33)
link-meta             feat/link-metadata-g21
msg-actions           feat/message-actions-parity          (merged, PR #32)
parity-refresh        docs/parity-refresh-2026-09          (unmerged — item 1)
pr32-merge            (detached HEAD)
thread2-ai            feat/ai-and-materialize              (merged, PR #31)
toolbar-leak          fix/lists-new-folder-toolbar-leak
verb-defects          fix/live-verb-defects-v1-v7          (merged, PR #24)

Remove the ones whose branches are merged. ⚠️ Check git status in each first — a concurrent session may be working in one, and removing a worktree with uncommitted changes loses them. Leave parity-refresh alone until item 1 is done.

5. Local dev is behind origin/dev

The local dev branch sits at 562ed8e; origin/dev is at 42a63ff with PRs #32, #33, #34 merged. Fast-forward before starting any work, or a new branch will be cut from a stale base.

6. Issues #27, #28, #29 were closed on 2026-09-07 — one caveat

• Message Features Need Implemented #27 "Message Features Need Implemented" — shipped as PR feat(timeline): web-parity message actions — Reply, I Dig!, Link, Push, Push & Comment #32 (Reply, I Dig!, Link, Push, Push & Comment). ⚠️ The Link action shipped with a URL that redirects anonymous visitors to /login, and "Get embed code" was never built; both are now tracked in their own issue. Closing Message Features Need Implemented #27 was right — just make sure the remainder is not assumed shipped along with it.
• "New Folder" Still shows up in Lists #28 "New Folder Still shows up in Lists" — closed as stale (the reporter's binary predated PR refactor(lists): remove the List Folders feature, keep parent/child list nesting #19). Separately, whether list folders should come back is now its own decision issue.
• Create a Crash Report #29 "Create a Crash Report" — shipped as PR feat(crash-reporting): capture crashes and offer a prefilled GitHub issue #33.

No action needed here; recorded so the next sweep does not re-derive it.

---

Acceptance criteria

• The planning doc matches the code on origin/dev.
• docs/api-coverage.md reflects every merged PR and carries auth-type information.
• No worktree remains for a merged branch.

Notes

Docs work has its own gate: .claude/skills/doc-engineer/assets/docs-quality-checklist.md.