docs(DOC-004): record the September 2026 tech-debt audit

[DoRmAmMu1997]

Appends a dated section to the audit register covering a tech-debt sweep of main @ 2833bcf.

Verdict

The codebase is in good shape. Zero TODO/FIXME/HACK markers in application code, no coverage omit list hiding anything from the 89% floor, three skipped tests (two of them UPDATE_GOLDEN guards), no xfail/skipif anywhere, 28 modern dependency pins with nothing a major version behind, consistent 3.11 targeting across Dockerfile / ruff / mypy / CI, and 44,968 lines of application code against 37,754 lines of tests.

The register itself is working: it steered this pass away from three dead ends.

What the section records

• Fixed in this pass — DEPLOY-005 (fix(DEPLOY-005): resolve pinned universe sources from the repo, not DATA_DIR #116) and QUAL-008 (fix(QUAL-008): pin the pre-commit ruff hook to the version CI installs #117), with the DEPLOY-005 defect written up in full including the honest caveat that Docker is unavailable locally, so container-level verification was not performed.
• Twelve open findings, ranked by the (Impact + Risk) x (6 - Effort) model, each with file:line evidence. Top of the list: silent universe erosion, app.py sitting outside the coverage gate, pytest shipping in the production image, and the score-resolution guard asymmetry between comparison.py and repository.py.
• Local environment drift — the dev machine runs Python 3.13.13 / numpy 2.5.2 against pinned 3.11–3.12 / numpy 2.4.6, which currently breaks python -m mypy and pre-commit run --all-files. Both were reproduced on untouched main, so they are recorded as environment facts, not repo debt.
• One finding verified FALSE — the "deferred scan_results(symbol, signal_date) composite index" was actually shipped by VALID-001 (models.py:274, the VALID-001 migration, and the drift guard at test_scan_storage_migrations.py:147). The "deferred to VALID-*" lines in the design docs are historical notes, not open work.

On not re-flagging settled decisions

Every finding was checked against the June and July sections before being written down. Two entries say so explicitly, because they sit next to prior decisions:

• The IPO SDK-runner gap is recorded as new information about a runner added after the boilerplate-dedup ADR — measurably, its _default_run has 0 of the is_error / CLINotFoundError / ProcessError / usage-limit handling its three siblings carry — and not as a re-proposal of the refactor that ADR rejected.
• The backend/ipo/repository.py naming smell is recorded together with the check confirming it is not an AGENTS.md §4 violation.

Verification

Docs-only change. pytest -q --cov=... --cov-fail-under=89 — 2034 passed, 1 skipped, 89.97%; ruff check clean; origin/main merged in and gates re-run after PRs #112/#114 landed.

🤖 Generated with Claude Code