Bring the standards register's gold row up to what the tree holds

docs/09-standards-register.md

@@ -56,7 +56,7 @@ document, a PROOF.md line) or `none`; the status; who decides the status. Status
 |---|---|---|---|---|
 | Recognised open-source security baseline | The OpenSSF Best Practices criteria at the passing level: basics, change control, reporting, quality, security and analysis | https://www.bestpractices.dev/projects/14772 | **passing, self-certified 2026-09-23.** Three suggested criteria are recorded unmet rather than stretched: `version_semver`, `dynamic_analysis`, `dynamic_analysis_enable_assertions` | maintainer |
 | Recognised open-source security baseline, second tier | The same criteria at the **silver** level: documented governance and roles, continuity of access, a published roadmap, a written test policy, 80% statement coverage, and an assurance case carrying a threat model, trust boundaries, a secure-design argument and an implementation-weakness argument | https://www.bestpractices.dev/projects/14772 | **silver, self-certified 2026-09-23** (all 44 MUST criteria met or not applicable; `signed_releases` is not applicable only while no release is published, and becomes required at the first one). Recorded unmet with reasons: `bus_factor` and `accessibility_best_practices` (both SHOULD), `version_tags_signed` (SUGGESTED) | maintainer |
-| Recognised open-source security baseline, third tier | The same criteria at the **gold** level | https://www.bestpractices.dev/projects/14772 | **30% as of 2026-09-23, not held.** Met so far: `require_2FA` (the organisation enforces two-factor authentication for write access), and the gold-level criteria inherited from the tiers below. `copyright_per_file` and `license_per_file` are met in the tree as of this row and held by `test/spdx_headers_test.exs`. Outstanding and not glossed: `bus_factor` and `contributors_unassociated` and `two_person_review` all need people other than the author in the history; `test_statement_coverage90` needs 90% against the current 80.31%; `build_reproducible` is measured and not met (docs/packaging.md); `security_review`, `code_review_standards`, `small_tasks` and `dynamic_analysis` are open work | maintainer |
+| Recognised open-source security baseline, third tier | The same criteria at the **gold** level | https://www.bestpractices.dev/projects/14772 | **Not held; 30% when this row was first written, before the tree work below landed.** Met in the tree: `require_2FA` (the organisation enforces two-factor authentication for write access); `copyright_per_file` and `license_per_file`, held by `test/spdx_headers_test.exs`; `code_review_standards`, the *Code review* section of docs/03-conventions.md; `small_tasks`, the *Good first tasks* section of CONTRIBUTING.md; `security_review`, docs/11-security-review.md dated 2026-09-23 with five resolved findings and four open; `build_reproducible`, **met for the release** and re-runnable with `./scripts/check_reproducible.sh` (all 243 modules this project compiles are byte-identical across two builds from a clean tree; three dependency modules and the per-release secret cookie are not, and are named). **Not applicable:** `test_branch_coverage80`, because the criterion is conditional on a FLOSS tool existing for the language and `cover:analyse/3` raises `function_clause` for `branch`, which is what every Elixir coverage tool wraps. **Outstanding, not glossed:** `bus_factor`, `contributors_unassociated` and `two_person_review` all need people other than the author in the git history and cannot be bought with code; `test_statement_coverage90` needs 90% against the current 80.31%; `dynamic_analysis` and `dynamic_analysis_enable_assertions` need a tool the project does not run; `secure_2FA` depends on which second factor the maintainers use | maintainer |
 | Linux Foundation Incubation prerequisite | The same badge; LF Incubation requires it at passing, alongside documented technical governance and a README per repository | https://www.bestpractices.dev/projects/14772, `GOVERNANCE.md`, `MAINTAINERS.md` | badge held; neutral asset hosting is not yet in place and is a foundation-side step | owner |
 
 **Time-bound answers in that self-certification.** Three of the answers were true on the date given