[Phase 16] S15 — Documentation: claims bound to code #901

Roadmap · Phase 16, step S15 · size XL · 10 unit(s) · planned in docs/roadmap/phase-16-trust-surface-hardening.md:746-795

Summary

Published claims the code does not back, plus the guards that would have caught them. Regulation (EU) 2026/1744 moves Annex III high-risk obligations to 2 December 2027 and Annex I to 2 August 2028, while current surfaces still tie "full enforcement" to 2 August 2026. The auto-revert "rollback" claim survives in eight places across nine files under four wordings — _revert_model deletes and restores nothing. EN, TR and all six site locales change in the same commit. (DOCS-06 is a residual wording fix only; its main claim was refuted.)

Units

Decisions this step executes

• GTM — AI Act moat framing after Regulation (EU) 2026/1744: retarget to 2 December 2027, framing preserved.

Plan

• Commit 1: legal dates + a freshness guard. Commit 2: the auto-revert semantics sweep + a semantic guard. Commit 3: site runtime claims across six locales, static fallbacks, privacy / localStorage, a11y and assets. Commit 4: exit-code prose, ghost config keys, the staging path and guard extensions.
• docs/roadmap/risks-and-decisions.md's append-only Decision Log is not a target; its live risk rows are.
• Extend check_cli_exit_code_prose.py non-strict first, triage the baseline, then flip.

Exit criteria

• No current surface ties high-risk obligations to August 2026, and a guard fails on reintroduction.
• No locale claims an unconditional exit 3 or a generated conformity declaration, verified in a rendered-DOM-equivalent test for EN plus at least one other locale.
• A grep for restore claims over current surfaces returns zero (the canonical auto-revert.md page is exempt because it quotes the wrong claim to refute it).
• A localStorage snapshot after every wizard step contains no credential-class value.
• Every current surface states verify-audit as 0/1/2/6 with the "1 = unverified, 6 = compared and failed" distinction, and a meta-test scans the canonical exit-code statements in all four rulebooks against _PUBLIC_EXIT_CODES.
• An inline-code config key in prose that does not resolve against ForgeConfig fails the guard.
• aria-expanded tracks drawer state across all four flows, and every asset referenced from site/*.html resolves in the deploy source tree.

How to deliver

• One root-cause family, committed on its own; then an Opus review round and a Sonnet review round, each with verified findings fixed and committed before the next step begins.
• A reproducer that is red before the fix and green after; the full gauntlet from CLAUDE.md passes under ./.venv/bin/python.
• Every English documentation edit ships with its Turkish mirror in the same commit; a new or renamed audit event gets its EN and TR catalog rows in the same PR.
• A step that grows a deferred module carries its budget_history justification in the same diff; a widened guard rolls out non-strict first, then flips.
• Commit bodies cite Absorbs F-W20260729-…; the CHANGELOG [Unreleased] section gets an entry only for a change a user or library consumer can observe (decision C-20).

_{Planned in docs/roadmap/phase-16-trust-surface-hardening.md (read at f94595f). Unit IDs (F-W20260729-…) come from the 2026-07-29/30 full-project review; the issue numbers next to them are the October 2026 review's records of the same defects.}