docs(coverage): reconcile the API matrix against shipped code

[Adron]

Summary

The 2026-07-31 re-baseline added its new endpoint rows at Implemented ☐ / Tested ☐ and they were never rescored, so the matrix badly understated the app: 56 of the 83 scoreable rows had already shipped (G1 DMs, G2 Moderation, G3 Sharing, G5 Search, G4 GitHub, G11a LinkedIn, G12 templates, G14 limits, D2 public profile, native OAuth link).

This walks every row against the Kit builders, DTOs and Domain service call paths and applies the existing maintenance rule literally — no box checked speculatively. Implemented ☑ requires builder + DTO + a service call path, so GET /api/linkedin/targets stays ☐ (the builder exists; nothing calls it). Tested ☑ only where the endpoint has its own decode/encode test and its group supplies failure + empty coverage; ◐ where only the group-wide builder-shape test reaches it. Footnote 14 records the rule so it can be overridden.

Changes

• 50 rows flipped ☐/☐ → Implemented ☑ with Tested ☑ or ◐.
• Eight endpoint paths corrected — they were transcribed from OpenAPI rather than from the live-verified client. Six Moderation rows: the app sends POST|DELETE /api/users/{username}/block and /mute, POST /api/users/{username}/report, POST /api/messages/{id}/report — not the /api/user/blocks and /api/reports/* forms documented. Two GitHub rows: the client sends PATCH /api/github/repos/{repo}/issues/{number} and its /comments sibling. Both GitHub routes remain unconfirmed live (P1-H2) — ☑ records that the client path is built and tested, not that the route answers.
• Six shipped /invites endpoints added (lists + documents) that were absent from the matrix entirely, though built in SharingEndpoint.swift and driven by SharingService. G3 goes 17 → 23 rows.
• Totals recomputed from the rows. The previous "53 new / 151 total" was an arithmetic slip — 53 is the running total through the sixth of sixteen sections. The matrix is 89 new + 98 original = 187 rows: 154 ☑ / 27 ☐ / 6 — implemented, 104 ☑ / 44 ◐ / 33 ☐ / 6 — tested.
• G6 List Folders rescored — (feature removed in PR refactor(lists): remove the List Folders feature, keep parent/child list nesting #19), joining the out-of-scope G8 Stripe rows. The routes still exist server-side; the client will not implement them.
• Rows verified still ☐: POST /api/dm/images/upload, GET /api/dm/{id}, GET /api/lists/watching, GET /api/lists/shared/{token}/data, GET /api/linkedin/targets, GET /api/documents/tree, and the two block/mute status reads.
• work-consolidation.md: a Provenance note recording the pass and flagging the stale "~151-endpoint API surface" figure. The G14 tail edits collided with d8778d4 from a concurrent session — same finding, independently reached — and were resolved in dev's favour, since its wording additionally documents uploadVideo's videoMaxBytes path and the test coverage.

No original-98 row was touched. Docs-only diff; the historical 2026-07-31 update-history entry is annotated rather than rewritten.

Verification

Run on the merged tree (a91f91f), after merging origin/dev:

• xcodebuild -scheme InterlinedList -destination 'platform=macOS' build → ** BUILD SUCCEEDED **
• xcodebuild … CODE_SIGNING_ALLOWED=NO test → ** TEST SUCCEEDED ** — Executed 622 tests, with 0 failures
• swift test — InterlinedKit 314, InterlinedDomain 619, InterlinedPersistence 135; 0 failures
• Decision-0003 guard → 0 real import InterlinedKit hits in App/Features|Navigation|MenuCommands
• Matrix self-check: 0 malformed table rows, 0 broken anchors, every prose total recomputed from the rows and asserted against them

🤖 Generated with Claude Code