docs: record the SoC pass + browser smoke test; update known limitations

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ARCHITECTURE.md

@@ -123,9 +123,12 @@ A correct feature touches **one file per layer** and imports cross-feature code
   explicit active-space selector before that changes.
 - **Regenerate `types/database.ts`** to drop the hand-added RPC entries and the `// TODO(types)` join
   casts, and to de-duplicate the governance row types in `types/domain/governance.ts` into `Tables<>`.
-- **Ops area-lead writes** still go directly to the DB from the browser (RLS-protected). They can't reuse
-  `upsertAreaLead` (a different `area_code`-keyed interface), so migrating them needs a small dedicated
-  server-action trio reconciled with that interface.
 - **`markOnboardingStepDone`** read-modify-writes a JSON column; a concurrent double-submit can drop a
   step. A DB-side atomic append (RPC / jsonb operator) is the fix.
-- Integration + e2e suites need a DB service wired into CI.
+- Integration + e2e suites need a DB service wired into CI (only unit tests + typecheck + lint run today).
+- **Full authenticated UI testing** hasn't run in this environment (no local Docker/Supabase). The public
+  surface + routing were browser-smoke-tested; the authed screens are verified by `next build` + tsc + tests.
+
+All client-component DB writes now go through server actions (the ops area-lead and comms message writes
+were the last direct-browser-write holdouts). The only browser-client usage that remains is auth
+(login/signup) and the comms realtime read, which the postgres_changes subscription requires.

docs/AUDIT-2026-08.md

@@ -286,11 +286,29 @@ Nothing is committed yet beyond this document. **No pushes to `main` without you
 - `ARCHITECTURE.md` at repo root: layers, the server-action contract + space-scope invariant, the
   feature-folder conventions, and a step-by-step add-a-feature guide.
 
-### Follow-ups (documented in ARCHITECTURE.md "Known limitations")
+### Re-audit + separation-of-concerns pass ✅ (post-refactor)
+A fresh 8-agent re-audit (SoC + refactor-regression + security/correctness) found **zero refactor
+regressions** (every authz gate + `space_id` scope + handler independently verified across the split
+action files and decomposed components). It surfaced the remaining SoC gaps + a few correctness misses,
+all now fixed with tests:
+- **SoC — direct browser writes eliminated**: the ops **area-lead** roster (create/update/delete) and the
+  **comms** message send now go through server actions (admin/member gate, validation, space-scoping,
+  audit). The comms send also **derives identity server-side** (was trusting client `user_id`/
+  `display_name`/`handle` — impersonation). **No client component writes to the DB directly anymore.**
+- **Payments IDOR**: `logCashPayment`/`linkPaymentToMember` now verify the `member_id` is in the caller's
+  space (same class as L1).
+- **Stale revalidate**: the invites/onboarding/areas/roles/tiers actions revalidated `/settings` after
+  their panels moved to `/customize` — corrected.
+- **Invite CAS**: `claimInviteUse` now distinguishes contention (retry) from a real cap (reject).
+
+### Browser smoke test (this environment)
+No local Docker → no Supabase, so authenticated screens couldn't be driven with data. Verified on the
+real dev server: landing + login render with no console/runtime errors; the decomposed authed routes
+(`/ops`, `/settings`, `/members`) correctly redirect to `/login` (middleware + server compile OK). All
+routes compile via `next build`.
+
+### Remaining follow-ups
 - Regenerate `types/database.ts` (drops the `// TODO(types)` join casts + hand-added RPCs; lets the
   governance rows in `types/domain/governance.ts` become `Tables<>`/`Enums<>`).
-- Migrate the ops **area-lead** browser writes to server actions (needs reconciling with
-  `upsertAreaLead`'s `area_code` interface). RLS-protected today.
 - Deferred **L3** onboarding-race RPC; DB-backed CI integration run.
-- **UI smoke-test** the decomposed ops/settings/members screens before merging (structural refactor,
-  verified by tsc + build + tests, but not by an automated UI test).
+- **Manual UI smoke-test** the decomposed ops/settings/members screens against a real backend before merge.