backlog: archive #324, file #1025-#1027, and stop a PHI-route enumeration being a closed count

[wshallwshall]

Ledger pass plus the two documents it exposed. Docs-only, which makes this the first real exercise of the doc-guard steps #202 landed — if that step is broken it reds this PR, which is the fail-closed behaviour I claimed for it.

Three items filed, each re-verified before its body was written

Item	V/D	What it is
#1026	6/3	The ASVS 12.1.1 TLS-floor probe's gate requires four conditions while the comment above names three. The fourth is public_origin, whose refusal is itself gated on serve_ui — so with the console off, a PHI instance behind a declared terminator under enforce starts with the probe silently inert.
#1025	5/2	Three require_ui_step_up routes emit PHI with no phi=, so the allow_phi_read throttle never runs. A missing rate limit, not a missing authorization check.
#1027	5/3	testpaths = ["tests"] means the command CLAUDE.md:333 documents as the gate never collects the webconsole package. A failing test sat on main all day unseen.

#1026's sharpest detail: the same block return 2s when the probe's mechanism is unavailable, explicitly because a no-op "reports success forever afterwards." It refuses a silent no-op one level down and performs one, silently, one level up.

⚠️ #1026's originating report had the mechanism wrong, and the body says so. It claimed the console "auto-degrades" so public_origin stays unset. public_origin is an independent optional setting and serve_web_console maps to api.serve_ui — neither derives the other. The conclusion held; the mechanism did not. This is why it was held back from the previous ledger pass rather than filed on an unverified chain.

#1027 verified as NOT a CI gap rather than assumed: ci.yml:250 installs -e ".[dev,harness,fhir,dicom,x12,xml,webauthn]" plus the webconsole package and runs it as a separate required step, so PRs merged on real coverage. The gap is local only — which is precisely why nothing red ever reached anyone.

The enumeration is no longer a closed count

docs/SECURITY.md said "nine more" PHI routes and omitted POST /ui/messages/{id}/edit-resend, whose _reject arm re-renders both the pristine core.get_message detail and the operator's raw_value.

Per CLAUDE.md §11 a completeness claim is a liability, so it is reworded to "at least ten more" with the derivation rule stated — the code is the authority, a route emits PHI if it renders a message body, and the ones charging the budget are those passing phi=True — rather than corrected to "ten", which the next PHI route would falsify again.

A citation that was right until it wasn't

docs/testing/master-test-plan/11-web-console.md:67 said 243 tests / 5389 lines. Measured now 247 / 5501. That was exactly right before #203 and #203 made it false — the useful distinction being that a citation nobody has broken yet and a citation nobody has noticed is broken look identical in a grep, and only the change that breaks it can tell them apart.

Ledger verification

• 108 open, 108 rows, ranks 1-108 contiguous, no duplicates
• bijection empty both directions
• all four census lines sum to 108, computed from the final table, never delta-adjusted
• backlog_status_check.py: OK, 303 items across both files (108 + 195), each declaring exactly one status
• frozen 2026-07-10 snapshot asserted byte-identical
• 72 doc-guard tests pass locally

NB the --min-items floor stays at 300 against 303 — three items of slack, versus the 23 found yesterday. Raising it every pass would make every ledger commit touch ci.yml, since the floor is pinned in two places. That is an argument for deriving it, not for raising it more often; left for #1018.