Fill in the change log hash for the audit determinism work

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: claude

docs/changelog.md

@@ -346,7 +346,7 @@ zero across these commits; several were pre-existing bugs the old markup had bee
 | `2d8e35593` | **A ratchet on the audit seam, so the copies can only decrease.** `targets.js` exists so no other audit needs to know what framework the app is, and **15 still carry their own `signIn`** — the earlier figure of 16 counted `targets.js`, which legitimately owns it. Migrating them touches every audit and wants its own commit; `bin/design/seam-check.rb` is the cheap thing that can be done first. It fails when the count goes **up**, and — the half that is easy to leave out — when it goes **down** without `BASELINE` being lowered, so a migration cannot be done and then quietly undone. No browser or server, so CI runs it before everything else. **The second control found a bug in the check**: `/async function signIn/` has no word boundary, so `signIn_MIGRATED` still matched and the control that migrates one by renaming it passed in silence — a ratchet that cannot see the direction it protects. Fixed and both directions re-proven. Why the copies matter, from faults this project actually had: one did not sign out first, so a second role silently audited the first's pages; one waited on `networkidle`, which never settles on three form pages here; one used a bare `button[type=submit]`, which matches the sign-out button in the closed account menu and waits 30 seconds for it. Each was fixed once in the seam, and a copy is a place for it to come back. |
 | `dca252687` | **All 15 private `signIn` copies migrated onto the seam, verified against captured output.** The ratchet went in first, then the job it was ratcheting: **15 → 0**, audits importing `targets.js` **7 → 21**. **The mitigation was the point and it earned itself.** Every audit's output was captured *before* any edit; afterwards **13 came back byte-identical**, and the fourteenth — `responsive-audit` — reported a new finding at 320px on `/items/inventory`. Rather than assume either way, it was run three times on identical code: **9, 9, 8**. The audit is non-deterministic and the migration had nothing to do with it; the baseline had simply caught the minority outcome. Without the before-and-after that would have been recorded as "the migration changed a result" and either reverted or waved through, and both would have been wrong. **The six shapes the copies had drifted into**: three did not sign out first, three waited on `networkidle` (which the seam's own comment says never settles on three form pages here), five used a bare `button[type=submit]` that matches the sign-out button inside a closed account menu, and two hardcoded the password. Tested before migrating whether the missing sign-out was corrupting results — it was not, because Devise here re-authenticates over an existing session, which is worth knowing and was not assumed. `audit-selftest` passes 11 controls over 5 checks; `BASELINE` is 0 and the ratchet now guards a clean sheet. |
 | `621cf6bee` | **The route reads join the seam too: 13 → 0, and four of them were broken.** With `signIn` done, the other half — every audit reading the target list its own way. **Four read `/tmp/targets.json` with no regeneration**, so `icon-audit` and `tooltip-audit` **crash with `ENOENT`** on a machine that has never run another audit (proven by deleting the file), and use a silently stale list on one that has. **A fifth was worse**: `wcag-manual` fell back to an *empty* list when the file was missing, narrowing its cheap per-page checks from 155 screens to **zero** while printing a summary that read like a pass — the fallback for a missing input was to check nothing and report success. The remaining eight spawned Rails on every run and skipped the cache whose staleness rule is the entire point. All 13 now call `targets()`; **21 audits import the seam and none read the generator directly**. **Verified the same way, and it found two more things.** Eleven came back byte-identical. `layout-shift-audit` named a different worst page — four runs gave **three different answers** (`/admin/questions/1/edit` 0.011, `/admin/questions/new` 0.011, `/partners/children/1/edit` 0.007 twice), so it is non-deterministic: CLS measures shifts *during* load. And `row-actions-audit` moved a column width 129 → 125 → 129px, which is sub-pixel rendering variance, recorded so nobody chases it. Neither was the migration. `audit-selftest` 11 controls over 5 checks, 0 wrong. |
-| `PENDING` | **One of the two non-deterministic audits fixed; the other narrowed and left, after three failed attempts.** **`layout-shift-audit` is fixed.** Every screen measures 0.007–0.011 against Chrome's 0.1 "good" threshold — an order of magnitude inside it — so ranking them was sorting noise: four runs named **three different** worst pages. Its `score > 0.01` display cutoff had the same fault a level down, listing a page at 0.0105 and dropping the same page at 0.0099. It now reports against a **0.02 noise floor set from measurement**, names no page below it, and does not print the varying number at all — because printing it invites a diff between two runs to look like a change. Verdict identical across runs. **`responsive-audit` is not fixed**, and three attempts are recorded rather than a fourth guess: the fixed `waitForTimeout(350)` became a condition, then a three-reading stability check on the measured count itself; it still alternates 8/9. Ruled out by measurement: the page probed directly at 320px gives **52 under-24 targets at 0, 150, 350, 700, 1200, 2000 and 3000ms** — the number does not move with time on a fresh page — and it is never skipped. Narrowed to `/items/inventory` at **320px only**, the first width measured after the largest resize. **Two real bugs found on the way and fixed**: the audit silently dropped any page that redirected or timed out — **9 screens**, including `/` and `/kits/143`, absent from every figure with nothing printed — and it now reports what it could not reach, while correctly *not* reporting redirects whose landing page another target already visits. |
+| `bd4bed6cf` | **One of the two non-deterministic audits fixed; the other narrowed and left, after three failed attempts.** **`layout-shift-audit` is fixed.** Every screen measures 0.007–0.011 against Chrome's 0.1 "good" threshold — an order of magnitude inside it — so ranking them was sorting noise: four runs named **three different** worst pages. Its `score > 0.01` display cutoff had the same fault a level down, listing a page at 0.0105 and dropping the same page at 0.0099. It now reports against a **0.02 noise floor set from measurement**, names no page below it, and does not print the varying number at all — because printing it invites a diff between two runs to look like a change. Verdict identical across runs. **`responsive-audit` is not fixed**, and three attempts are recorded rather than a fourth guess: the fixed `waitForTimeout(350)` became a condition, then a three-reading stability check on the measured count itself; it still alternates 8/9. Ruled out by measurement: the page probed directly at 320px gives **52 under-24 targets at 0, 150, 350, 700, 1200, 2000 and 3000ms** — the number does not move with time on a fresh page — and it is never skipped. Narrowed to `/items/inventory` at **320px only**, the first width measured after the largest resize. **Two real bugs found on the way and fixed**: the audit silently dropped any page that redirected or timed out — **9 screens**, including `/` and `/kits/143`, absent from every figure with nothing printed — and it now reports what it could not reach, while correctly *not* reporting redirects whose landing page another target already visits. |