docs: add ARCHITECTURE.md; mark Phase C+D complete in the audit log (Phase D)

ARCHITECTURE.md documents the layered structure, the server-action contract +
space-scope invariant, feature-folder conventions, and an add-a-feature guide.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/AUDIT-2026-08.md

@@ -265,19 +265,32 @@ Nothing is committed yet beyond this document. **No pushes to `main` without you
   and on `main`, fully separate from `deploy.yml`. Follow-up: a DB-backed integration run that fails on
   0 executed tests.
 
-### Phase C — refactor (low-risk slices) ✅ 0–2 done; 3–9 paused
-- **Slice 0**: `types/database.ts` marked GENERATED (banner + regen command).
-- **Slice 1**: `lib/validations.ts` (1141 lines, 143 exports) → `lib/validations/<feature>.ts` +
-  `primitives.ts` + `index.ts` barrel. All 143 exports preserved verbatim (symbol-diff verified); the
-  40 importers untouched.
-- **Slice 2**: `lib/types.ts` → `types/domain/{index,governance,reexports}.ts`; `lib/types.ts` is now a
-  re-export shim (11 importers untouched). The generated/hand-written seam is now explicit.
-- **PAUSED** (awaiting go-ahead): slices 3–5 (split the 800–890-line action files `classes`/`door`/
-  `forms` into folders behind the `lib/actions` barrel), slices 6–8 (decompose the 663–956-line
-  `*-client.tsx` components into `panels/`+`components/`; slice 6 also swaps the ops-client direct
-  browser writes for the existing server actions — a behavior change), slice 9 (delete shims/dead exports).
+### Phase C — refactor ✅ (all 10 slices)
+- **Slice 0**: `types/database.ts` marked GENERATED.
+- **Slice 1**: `lib/validations.ts` (143 exports) → `lib/validations/*` barrel'd folder (symbol-diff
+  verified, 40 importers untouched).
+- **Slice 2**: `lib/types.ts` → `types/domain/*`.
+- **Slices 3–5**: `lib/actions/{classes,door,forms}.ts` (800–908 lines) → per-capability folders with
+  `_guard`/`_helpers` (plain modules) + `'use server'` sub-files + `index.ts` barrel. Export parity
+  verified (14/14/15); no helper leaked into the public surface.
+- **Slices 6–8**: `ops`/`settings`/`members` client components decomposed into thin orchestrators
+  (956→230, 663→79, 663→255) + `panels/`+`components/`+`types.ts`. Slice 8 also fixed the
+  `MemberFormFields`-in-render focus footgun.
+- **Slice 6b (security)**: the ops "Add Secret" modal wrote the value **plaintext** from the browser
+  despite its "encrypted at rest" label — routed through `createSecret` (AES-GCM + authz + audit).
+- **Slice 9**: deleted orphaned files/exports + the 6 dead validation schemas + `cleanupRateLimits`;
+  migrated `@/lib/types` → `@/types/domain` and dropped the shim.
+- Each slice: its own commit; gated on tsc 0 + tests + (for UI) `next build`.
 
-### Still open
-- **Phase C slices 3–9** (above) and **Phase D** (`ARCHITECTURE.md`).
-- Follow-ups: regenerate `types/database.ts` (drops the `// TODO(types)` casts + de-dups governance
-  types into `Tables<>`/`Enums<>`); deferred **L3** onboarding-race RPC; DB-backed CI integration run.
+### Phase D — ARCHITECTURE.md ✅
+- `ARCHITECTURE.md` at repo root: layers, the server-action contract + space-scope invariant, the
+  feature-folder conventions, and a step-by-step add-a-feature guide.
+
+### Follow-ups (documented in ARCHITECTURE.md "Known limitations")
+- Regenerate `types/database.ts` (drops the `// TODO(types)` join casts + hand-added RPCs; lets the
+  governance rows in `types/domain/governance.ts` become `Tables<>`/`Enums<>`).
+- Migrate the ops **area-lead** browser writes to server actions (needs reconciling with
+  `upsertAreaLead`'s `area_code` interface). RLS-protected today.
+- Deferred **L3** onboarding-race RPC; DB-backed CI integration run.
+- **UI smoke-test** the decomposed ops/settings/members screens before merging (structural refactor,
+  verified by tsc + build + tests, but not by an automated UI test).