diff --git a/docs/AUDIT-2026-08.md b/docs/AUDIT-2026-08.md
index 5f541b2..2440662 100644
--- a/docs/AUDIT-2026-08.md
+++ b/docs/AUDIT-2026-08.md
@@ -260,7 +260,24 @@ Nothing is committed yet beyond this document. **No pushes to `main` without you
   atomic append (an RPC/migration) that can't be applied to the live DB from here. Low severity
   (duplicate step-completions only). Follow-up: add a `jsonb` append RPC or a unique constraint.
 
+### CI ✅
+- Added `.github/workflows/ci.yml` — a checks-only workflow (typecheck + lint + unit tests) on every PR
+  and on `main`, fully separate from `deploy.yml`. Follow-up: a DB-backed integration run that fails on
+  0 executed tests.
+
+### Phase C — refactor (low-risk slices) ✅ 0–2 done; 3–9 paused
+- **Slice 0**: `types/database.ts` marked GENERATED (banner + regen command).
+- **Slice 1**: `lib/validations.ts` (1141 lines, 143 exports) → `lib/validations/<feature>.ts` +
+  `primitives.ts` + `index.ts` barrel. All 143 exports preserved verbatim (symbol-diff verified); the
+  40 importers untouched.
+- **Slice 2**: `lib/types.ts` → `types/domain/{index,governance,reexports}.ts`; `lib/types.ts` is now a
+  re-export shim (11 importers untouched). The generated/hand-written seam is now explicit.
+- **PAUSED** (awaiting go-ahead): slices 3–5 (split the 800–890-line action files `classes`/`door`/
+  `forms` into folders behind the `lib/actions` barrel), slices 6–8 (decompose the 663–956-line
+  `*-client.tsx` components into `panels/`+`components/`; slice 6 also swaps the ops-client direct
+  browser writes for the existing server actions — a behavior change), slice 9 (delete shims/dead exports).
+
 ### Still open
-- **CI runs no tests** (HIGH test-gap): add a GitHub Actions job running typecheck+lint+test (+ a
-  DB-backed integration run that fails on 0 executed tests). Not yet done — touches the deploy workflow.
-- **Phase C** (refactor slices 0–9) and **Phase D** (`ARCHITECTURE.md`) — not started.
+- **Phase C slices 3–9** (above) and **Phase D** (`ARCHITECTURE.md`).
+- Follow-ups: regenerate `types/database.ts` (drops the `// TODO(types)` casts + de-dups governance
+  types into `Tables<>`/`Enums<>`); deferred **L3** onboarding-race RPC; DB-backed CI integration run.