cleanup phases 3

dev/post-phase/manual-testing-plan.md

@@ -1,5 +1,12 @@
 # Balinyaar — Manual Testing Plan
 
+> **SUPERSEDED (2026-08-02) by [`docs/flows/`](../../docs/flows/index.md).** This file was written on
+> 2026-07-26 and parts of it no longer work: it tells you to set crypto keys with `dotnet user-secrets`
+> (removed in `5885280`), calls the API `https://localhost:5002` (it is plain HTTP), and promises the OTP
+> code appears in the server console (it never does). The verified replacements are
+> [`docs/flows/testing-setup.md`](../../docs/flows/testing-setup.md) for bring-up and
+> [`docs/flows/index.md`](../../docs/flows/index.md) for the per-flow walkthroughs. Kept as a record.
+
 The flow-by-flow walkthrough for testing the whole product against the **seeded lifecycle demo world**.
 Written after the UI/backend/refinement phase chains completed (2026-07-26). Companion docs:
 

dev/post-phase/refinement/RUNBOOK.md

@@ -1,5 +1,12 @@
 # Run the whole app locally — Balinyaar bring-up runbook
 
+> **SUPERSEDED (2026-08-02) by [`docs/flows/testing-setup.md`](../../../docs/flows/testing-setup.md)**,
+> which was executed rather than transcribed. This file is right about `user-secrets` but wrong about six
+> other things — the API scheme (`http`, not `https`), the dev cert step, `.env.development`'s value, the
+> committed `Seams:Sms:Provider` (it is `telegram`, so `request_otp` 500s on a fresh clone), the console
+> OTP line (the code is never printed), and "only `auth` is real" (15 of 22 client domains are real).
+> Kept as a record.
+
 The one copy-pasteable procedure for standing up **both** projects on one machine and watching a real,
 authenticated request cross the wire. Established by **Refinement Phase 0**
 ([refinement-phase-0-bring-up.md](refinement-phase-0-bring-up.md)).