tools(specs): audit prose across the full corpus

[nedtwigg]

Stack

Depends on #489. Review that PR first; this PR contains only the systematic follow-up audit.

Summary

• add a dependency-free pnpm audit:prose inventory that resolves each spec's referenced files, supports changed-base and JSON/full output, and reports advisory prose/comment candidates
• document the KEEP / CUT / POINTER / RATIONALE / MATRIX / CANONICAL review workflow and audit all 25 specs plus their resolved code references
• remove duplicate code maps, exact type/config shapes, test inventories, examples, and broad module-header restatements while retaining local race, lifecycle, ordering, and security constraints
• move durable Windows updater and Node-subsystem evidence into keyed rationale sections
• correct a detached terminal Registry entry from Mounted to glossary-canonical Orphaned
• lower the affected word-budget ratchets

The touched spec/rationale files shrink by 4,131 words. This PR changes 80 files (667 insertions, 1,650 deletions); the full #489 + #490 stack changes 85 files (949 insertions, 2,530 deletions). Executable source changes outside the new audit command are comment-only.

Validation

• pnpm test (all spec/security lints and self-tests, plus every workspace package test)
• node scripts/prose-audit.mjs --changed=spec-compress-further
• git diff --check

[dormouse-bot]

Read the whole diff and spot-checked the compressed invariants against the specs and code they defer to. The dedup work holds up: the MAX_AWAIT_TIMEOUT_MS reject-not-clamp rule, the per-flow challenge issuers, the WS_CLOSE_HOST_REPLACED terminal close, the MAX_PARKED_SURFACES same-commit trim, the layout() rejection contract, and the workspace-union display-only rule all survive at their new homes (alert.md 123, server.md 217, remote-host.ts #onClose, tiling-engine.md 124/133, alert.md 295). The dropped alert.md await table is genuinely covered by alert.md 96–99 and the "Resolution consumes only the ring it resolved on" paragraph. Mounted → Orphaned is the right fix — unmountElement calls element.remove(), which is glossary Orphaned by definition. All six lints pass locally, and every new pointer heading (server.md → "Host side", remote-api.md → "The provider seam", tutorial.md → "Fake shell behavior", etc.) resolves.

Three things worth a fix, inline. The first is the one that matters: a compressed comment asserts a permanence the code does not have and the spec explicitly denies.

Minor: the description's "Across the stack: 80 files changed, 667 insertions, 1,652 deletions" is this PR's own diff, not the stack — #489 adds another 20 files / 190 / 890 on top.

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	a8df30f
Status:	✅  Deploy successful!
Preview URL:	https://9895cbfb.mouseterm.pages.dev
Branch Preview URL:	https://spec-prose-audit.mouseterm.pages.dev

View logs