docs: record Phase A + Phase B progress in the audit log

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/AUDIT-2026-08.md

@@ -228,3 +228,39 @@ barrels** (full add-a-feature guide goes in `ARCHITECTURE.md`).
 - **Phase D — `ARCHITECTURE.md`** documenting the resulting structure + add-a-feature guide.
 
 Nothing is committed yet beyond this document. **No pushes to `main` without your explicit approval.**
+
+---
+
+## Progress log
+
+### Phase A — tooling & type safety ✅ (branch `audit/cleanup-architecture`)
+- `tsc --noEmit`: **586 → 0**. `next.config` `ignoreBuildErrors` **removed** — builds/deploys now type-check.
+- Root cause fixed by annotating the Supabase client factories (`server`/`client`/`proxy`) as
+  `SupabaseClient<Database>`; `parseInput` rewritten to infer via `z.infer`; `flexibleDateTime` typed;
+  tsconfig target → ES2020; missing RPCs added to the generated types. A 40-agent behavior-preserving
+  sweep cleared the long tail (joins bridged with `as unknown as` + `// TODO(types)` to regenerate).
+- **ESLint 9 flat config** added (`eslint.config.mjs`) — `pnpm run lint` now passes (0 errors). Added
+  `typecheck` script. `next build` green.
+
+### Phase B — confirmed fixes ✅ (one commit per fix, each with a regression test)
+- **H1** invite `max_uses` TOCTOU → atomic compare-and-swap claim (`lib/invite-claim.ts`).
+- **M1** board re-arming an admin invite → privilege guard on any re-arming field.
+- **M2** `appealIncident` → restricted to admin/board; asserts the link UPDATE, rolls back orphan proposal.
+- **M3** SSRF filter → blocks hex IPv4-mapped IPv6.
+- **M4/M5** payment `last_paid_at` → advance-only (`resolveDuesAdvance`).
+- **M6 / L6** members-list & payment-picker null derefs → guarded.
+- **member-directory visibility gate** → repaired (was comparing against non-existent enum values).
+- **L1** `reserveEquipment` → verifies target member is in the caller's space.
+- **L2** unverified members → blocked from proposals/votes (per decision).
+- **L5** `parseHeatSyncLog` → stale time-of-day + token-reuse fixed.
+- **L7** CSV import → guards unparseable dates, never wedges the button.
+- **Tests**: tautological `actions.test` replaced with real authz/IDOR tests; authz primitives covered.
+  626 tests green.
+- **Deferred — L3** (`markOnboardingStepDone` read-modify-write race): a correct fix needs a DB-side
+  atomic append (an RPC/migration) that can't be applied to the live DB from here. Low severity
+  (duplicate step-completions only). Follow-up: add a `jsonb` append RPC or a unique constraint.
+
+### Still open
+- **CI runs no tests** (HIGH test-gap): add a GitHub Actions job running typecheck+lint+test (+ a
+  DB-backed integration run that fails on 0 executed tests). Not yet done — touches the deploy workflow.
+- **Phase C** (refactor slices 0–9) and **Phase D** (`ARCHITECTURE.md`) — not started.