The audit anchors had drifted from the implementation. Corrected against
the live source as of commit ea0ba33:
- PRD invariant #1: mode registry is now 24 handlers in _VALID_MODES,
not "only extract". Added invariant #2: unknown modes fail with HTTP
400 + valid_modes (was 200-with-error-body). Added SECURE to the
session-cookie invariant.
- PRD known-gaps + change-axis: marked the mode-registration and
unknown-mode items RESOLVED; flagged the live codereview-vs-code_review
naming mismatch that still 400s lakehouse observer escalations.
- SCRUM_FIX_WAVE items 1-2 struck through as DONE; recorded the cookie +
nginx security fixes under "Recently landed".
Machine-generated .memory/ state left untouched (regenerated by the
scrum pipeline, not hand-edited).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
