Delete the measured-redundant tests (test audit TA4, #1731)

.github/ISSUE_SPECS/1290-replace-the-running-browser-session-in-the-rust-host.md

@@ -366,7 +366,7 @@ now only through the test-support switch `structural_command_for_test` (the refu
 
 **Gates -> tests** (`cargo test --locked -p host-web --features host-web/test-support`):
 - gate 1: `tests::structural_apply::a_rebuild_swaps_without_a_gap`
-- gate 2: `a_live_edit_is_part_of_the_base_the_successor_is_prepared_from` (the ramp is in flight
+- gate 2: `a_live_edit_is_part_of_the_base_the_successor_is_prepared_from` (deleted by TA4) (the ramp is in flight
   at the adoption block)
 - gate 3: `a_malformed_transaction_is_refused_and_changes_nothing`,
   `a_rate_or_quantum_change_is_refused_as_a_required_reprepare`,

.github/ISSUE_SPECS/1350-tighten-the-seek-entry-points-source-id-invalid-a-typed-held-preparation-timed-r.md

@@ -36,7 +36,7 @@ Four seek-path defects found in the #1275 review are closed:
 - **Untimed reads.** `begin_block` (`:1103`) and `read_block` (`:1077`) use `SeekClock::Now`, which
   applies an anchored seek at once and ignores its anchor. Production renders through
   `begin_block_at` (`:1721`). The untimed paths are called only by the crate's own tests and by
-  `crates/source/tests/randomized.rs:454` and `crates/source/tests/seek_schedule_model.rs:486`.
+  `crates/source/tests/randomized.rs:454` and `crates/source/tests/seek_schedule_model.rs:486` (deleted by TA4).
 
 ## Decisions frozen for this slice
 
@@ -69,7 +69,7 @@ Four seek-path defects found in the #1275 review are closed:
 
 - `crates/capi/src/ffi.rs`, `crates/capi/src/runtime/error.rs` (or the #1309 successor file)
 - `crates/source/src/lib.rs`, `crates/source/tests/randomized.rs`,
-  `crates/source/tests/seek_schedule_model.rs`
+  `crates/source/tests/seek_schedule_model.rs` (deleted by TA4)
 
 ## Non-goals
 

.github/ISSUE_SPECS/1406-grow-the-default-source-ring-by-the-warm-prime-headroom.md

@@ -160,7 +160,7 @@ engine, the published ABI layout, the SDK and the browser host derive the same r
   `hosts/host-web/web/miso-engine-v1-audio-worklet-host.d.ts` and
   `sdk/src/browser/shipped-host.d.ts` (the ring comments only), `scripts/test-web-audioworklet.mjs`
   (gate 4's case at `:1103-1128` only)
-- `hosts/host-web/src/tests.rs` (`default_ring_covers_stall_tolerance` and the doc comment of
+- `hosts/host-web/src/tests.rs` (`default_ring_covers_stall_tolerance` (deleted by TA4) and the doc comment of
   `ring_prefill_survives_stall` only), `hosts/host-web/MUTATIONS.md` (rows 7 and 8 only)
 - `hosts/host-web/src/lib.rs` (the doc comment of the ring override field only),
   `hosts/host-web/DEPLOYMENT.md` (the ring sentence only),

.github/ISSUE_SPECS/1654-render-stored-send-gain-mute-and-matrix-automation.md

@@ -729,7 +729,7 @@ Gates (all green), with red-without-the-feature evidence (once each):
 - Gate 4: capi `a_hand_send_mute_ors_with_its_curve_on_the_c_abi`; host-web
   `a_hand_send_mute_ors_with_its_curve_on_both_hosts`. Red with the curve replacing the static mute
   (not ORed): "the hand mute shuts the send while the curve is open".
-- Gate 5: capi `an_output_route_entry_is_refused_on_the_c_abi`; host-web
+- Gate 5: capi `an_output_route_entry_is_refused_on_the_c_abi` (deleted by TA4); host-web
   `an_output_route_entry_is_refused_alike_on_both_hosts` (one diagnostic,
   `control.automation.target`).
 - Gate 6: zero render allocations in host-core gates 1, 2 and 7 (`bench_support::alloc` thread

.github/ISSUE_SPECS/1696-charge-the-monitor-overlays-and-edit-ramps-in-the-capi-row.md

@@ -65,7 +65,7 @@ hosts charge the same, because the row is computed once, in the core.
   (`assert_capi_retained_bytes_are_complete`, `:867`; driver `:995`). It observes the compile of
   one session; it never populates a solo, a master or a pending candidate, so a term that the
   commit path adds later is outside it. The browser's ceilings are
-  `hosts/host-web/tests/retained_ceilings.rs` and `tests/browser-v1/expected.json`
+  `hosts/host-web/tests/retained_ceilings.rs` (deleted by TA4) and `tests/browser-v1/expected.json`
   (`resourceCeilings`, `:69`).
 
 ## Decisions to take (the implementer proposes, the coordinator rules)
@@ -104,7 +104,7 @@ hosts charge the same, because the row is computed once, in the core.
    admissions.
 3. Re-pins of every moved row, each measured on the final tree with its reason: the capi
    `maximum_capi_retained_bytes` fixtures that sit at a measured floor, the browser
-   `resourceCeilings` in `expected.json` and the `retained_ceilings.rs` budgets
+   `resourceCeilings` in `expected.json` and the `retained_ceilings.rs` budgets (deleted by TA4)
    (`scripts/check-browser-expected-resources.py` measures the browser), and the SDK or fixture
    files that carry a figure. Owner decision 4 applies: budgets stay ceilings, not exact counts,
    except the `capi_retained_bytes` equality, which stays exact.
@@ -117,7 +117,7 @@ hosts charge the same, because the row is computed once, in the core.
 - `crates/controls/src/effective.rs` (a reserve or a capacity accessor on `MonitorOverlay`) and
   `crates/session/src/edit_ramp.rs` (a ceiling function over the row counts), with their tests.
 - `crates/capi/tests/resource_lifecycle.rs`, `crates/capi/src/runtime/live_tests.rs` and
-  `live_peak_tests.rs` where a floor moves; `hosts/host-web/tests/retained_ceilings.rs`,
+  `live_peak_tests.rs` where a floor moves; `hosts/host-web/tests/retained_ceilings.rs` (deleted by TA4),
   `hosts/host-web/tests/browser-v1/expected.json`.
 - This spec file's decision record.
 
@@ -141,8 +141,8 @@ hosts charge the same, because the row is computed once, in the core.
 2. The existing exact equality `capi_retained_bytes == observed terms` still holds on every
    fixture, with the new term added to the right-hand side as an observed value.
 3. The same session on the browser: `WebResourceReport` reads the same core charge; the
-   `retained_ceilings.rs` budgets and `check-browser-expected-resources.py` pass with the moved
-   rows re-pinned from measurement, each with its reason.
+   `check-browser-expected-resources.py` ceilings pass with the moved rows re-pinned from
+   measurement, each with its reason. (`retained_ceilings.rs` was deleted by TA4: the shipped wasm32 artifact's ceilings stay in `expected.json` (checked by `check-browser-expected-resources.py`); the deleted file ceilinged only the native 8- and 4-lane builds, which do not ship.)
 4. A control plane at the exact `maximum_control_retained_bytes` that the session needs without
    the overlay is refused when the overlay is populated, on both hosts, with the typed resource
    code, and accepted with the limit raised by the charge.

.github/ISSUE_SPECS/1722-delete-digest-type-size-and-unrun-tests.md

@@ -177,7 +177,7 @@ owner rules (ASK 1):
 - Product code: `tools/audit` `builtins.rs` and `builtins_graph.rs` fixture identities are checks
   in the tool itself, not test assertions.
 - Ceilings: `graph` `runtime.rs` executor-table bound, `bypass_resources.rs`, allocation trackers.
-- `track_delay.rs` `the_estimate_charges_each_lane_its_own_ring`: four bytes per `f32` sample is the
+- `track_delay.rs` `the_estimate_charges_each_lane_its_own_ring` (deleted by TA4; KEEP catcher graph-compiler `track_delay::a_ring_is_a_named_allocation`): four bytes per `f32` sample is the
   product's accounting rule, not a struct total.
 
 ### Docs updated

.github/ISSUE_SPECS/1728-give-the-workspace-debug-test-job-a-real-time-margin.md

@@ -0,0 +1,12 @@
+# Give the workspace debug test job a real time margin
+
+The required `qualification` job "workspace debug tests (minus DSP crates and evidence tools)" has `timeout-minutes: 15` (`.github/workflows/qualification.yml:609`). On recent runs it took 14.5 to 14.7 minutes (PR #1725: 14:41; batch 20, PR #1721: 14:36), and on PR #1727 it hit the timeout twice while its tests were still passing. One rerun of the failed job then passed in 10.5 minutes. The job runs too close to its limit, so a cold cache or a slow runner turns a green PR red.
+
+## Decision to make
+
+- Cut the job's time (the 2026-10 test audit removes redundant tests; the 5 `tools/audit` `fixture_builtins` tests use about 14% of all test-binary time and are in this job's scope only if not excluded), or
+- raise the timeout to a measured margin (for example 1.5 times the slowest recent green run), or both.
+
+## Gate
+
+Ten consecutive green runs of the job with at least 25% margin under its timeout.

.github/ISSUE_SPECS/1729-test-the-fp-environment-refusal.md

@@ -0,0 +1,21 @@
+# Test that the fp-environment attestation refuses a bad readback
+
+Found by the TA4 survivor audit: the mutant `lane::fpenv::attest_fp_environment -> Ok(())` survives every test.
+
+## Problem
+
+`attest_fp_environment` (`crates/lane/src/fpenv.rs`) refuses a render thread when the canonical control word does not read back after it is installed (`CanonicalWordRefused`), or when the caller's word is not restored (`RestoreRefused`). On conforming x86-64 and AArch64 hardware both writes always take, so no test can reach either refusal: every test calls the function on a thread where it passes. A change that makes the function always return `Ok(())` stays green, and `host-core`'s mapping of the refusal (`crates/host-core/src/render_session.rs`) is never exercised.
+
+## Smallest closable slice
+
+Split the decision out of the hardware access: a pure function that takes the three observed words (`observed`, `readback`, `restored`) and returns the same `Result`. `attest_fp_environment` reads the words and calls it. No behaviour change on any target.
+
+## Gates
+
+1. A unit test in `crates/lane` calls the pure function with a readback whose control bits differ from the canonical word and gets `CanonicalWordRefused`; with a `restored` word that differs from `observed` it gets `RestoreRefused`; with matching words it gets `Ok`.
+2. The mutant `attest_fp_environment -> Ok(())` is red, measured once (PR evidence, not a committed test).
+3. No rendered bit moves; `cargo test -p lane -p host-core` is green.
+
+## Related: the browser side of the hostile-FP live gate
+
+TA4 deleted host-web `tests::canonical_live::a_live_fader_and_vca_move_under_a_hostile_caller_word_render_the_canonical_bits` (#1709 D2, browser); the capi test of the same name stays (`crates/capi/src/runtime/live_tests.rs:8158`), so only the C ABI side of that check remains. If the owner wants the browser side back, restore it from `b9135008d` (`hosts/host-web/src/tests.rs`) with the `lane` test-support dev-dependency.

.github/ISSUE_SPECS/1730-remove-test-only-public-functions.md

@@ -0,0 +1,22 @@
+# Remove or use the public functions that only tests call
+
+Found by the TA4 survivor audit: mutants in these functions survive because no product path calls them.
+
+## Problem
+
+This public function has no caller outside tests (checked at `b9135008d` with a workspace grep):
+
+- `source::PcmSourceConsumer::read_block` and its `validate_output_shape` (`crates/source/src/lib.rs`): only `crates/source`'s unit tests and `tests/` call them; the render path reads a source through `begin_block_at` and its played planes (`crates/graph/src/runtime.rs`, `crates/host-core/src/source.rs`).
+
+TA4 (`1731-delete-the-measured-redundant-tests.md`, item 4) already deleted the other items the survivor audit found: `conformance::PlanarBlock` and `compare_f32_to_f64` (survivors m9108, m9109, m9111, m9118) and the `effect_contract` `map_stepped_normalized` family (m16329, m16330). What is left is the source item above (m42034).
+
+Dead public code carries tests and review cost and hides real gaps from mutation testing.
+
+## Smallest closable slice
+
+Either delete it with the tests that only test it, or name the product caller that should use it and open an issue for that. Delete nothing a fuzz target, an ABI pin or a wire format uses.
+
+## Gates
+
+1. A workspace grep shows that `read_block` and `validate_output_shape` are gone, or the issue names the product caller that keeps them.
+2. `cargo test --workspace --all-features` and `scripts/check-workspace-policy.sh` are green.