cleanup phases 0 done

docs/_plan/phase-0-inventory-and-scaffold.md

@@ -144,5 +144,78 @@ without re-reading the file.
 
 ## Handoff
 
-_(filled in by the agent that runs this phase — file counts, surprises, anything that changes a later
-phase's scope)_
+**Run 2026-07-29 against commit `c99e3f4`. All six outputs delivered; all six verification boxes pass.**
+
+### Counts
+
+| | Planned | Actual |
+| --- | --- | --- |
+| Markdown files surveyed | ~260 | **275** (273 tracked + 2 gitignored `graphify-out/GRAPH_REPORT.md`) |
+| `dev/` | 199 | 199 ✓ |
+| `dev/shared-working-context/reports/` | 50 | **53** reports + `README.md` + `mocks-registry.md` |
+| `dev/phases/backend|frontend` prompts | 32 | 32 ✓ |
+| REQs in `for-backend.md` | 67 | 67 ✓ |
+| Hardening items | 18 open | 18 of 18 unticked ✓ |
+| `product/` | 48 | 48 ✓ |
+
+The extra 15 over "~260" are the 9 files of `docs/_plan/` itself, the 2 gitignored graph reports, and 3
+more reports than the plan counted.
+
+Disposition split: **172 archive · 59 keep-as-is · 24 distill · 17 move · 2 merge-into · 1 delete**.
+**209 of 275 carry live facts.** Owner phases: **4 → 149 files**, 7 → 31, 2 → 23, 1 → 17, 6 → 17, 3 → 2,
+0 → 1, none → 35.
+
+### Four things that change a later phase's scope
+
+1. **Phase 2 is smaller than budgeted at the OpenAPI layer.** The 16-day-stale snapshot differs from the
+   live server by **one endpoint** (`POST /api/v1/webhooks/payouts/{provider}`) and **one schema**
+   (`GeneratePayoutBatchCommand`). Zero removals, zero method changes, identical schema count (339).
+   Spend the budget on the 17 hand-written `domains/*.md` instead — that is where drift can hide, and
+   nothing has ever checked them mechanically.
+
+2. **Phase 3 fixes one stale bring-up doc, not two.** The plan says `manual-testing-plan.md` *and*
+   `RUNBOOK.md` are both stale on secrets. `RUNBOOK.md` was updated in `5885280` and is correct — it even
+   has a troubleshooting row for the error you now get. Only `manual-testing-plan.md` (last commit
+   `bd06ef0`, the day before) still instructs `dotnet user-secrets`. But Phase 3 inherits a **bigger**
+   bring-up problem the plan did not list: contradictions **C-3/C-4/C-5** — the API is `http://`, not
+   `https://`, in ~18 places; the `dev-certs` step is therefore dead; and `RUNBOOK.md` builds a *local*
+   Docker SQL Server while the committed dev config uses a *remote, already-seeded* one. Those are two
+   different worlds and Phase 3 must pick one and walk it.
+
+3. **Phase 7's premise is wrong in one direction and right in another.** The frontend-designer skill does
+   **not** predate the UI overhaul — it was rewritten at `baa3cc6` (manual improvement 1) and already
+   covers `AppFrame`, `BottomBar`, `APP_FRAME_MAX_WIDTH` and the Lucide-only registry. It is stale by
+   exactly **one iteration**: `client/CLAUDE.md` was updated at `e6a8f93` (manual improvement 2), which
+   changed **44 files, +3419/−2449** under `client/src`. Diff against iteration 2, not against the whole
+   overhaul.
+
+4. **Phase 4 is the heavy phase, not Phase 3.** 149 of 275 files land on it. Two structural findings make
+   it tractable: every `dev/phases/*` prompt shares a fixed layout where **§5 "Critical rules you must not
+   get wrong"** is exactly the not-in-the-code decision set (verified in all 32), and **all 53 reports**
+   carry a "Follow-ups for later phases" section (verified). Both are mechanically extractable.
+
+### Smaller notes
+
+- **`temp/swagger.json` was never committed** — `.gitignore:1` ignores `temp`. Deleting it removed local
+  clutter, not repo content. The `_plan/README.md` diagnosis calls it a "second stale copy" in the repo;
+  it is not in the repo.
+- **`dev/contracts/domains/messaging.md`** (851 B) is a headerless fragment that silently amends
+  `messaging-notifications-admin.md`. Phase 2 should **merge**, not move both (C-8).
+- **`SET_VIA_USER_SECRETS_OR_ENV`** is still the placeholder string in `appsettings.json` and is enforced
+  by `StartupSecretsGuard` and the pre-commit hook. Behaviour is correct; the *name* instructs a reader to
+  use a store that no longer exists (C-2).
+- **The `graphify-out/` reports are gitignored generated output**, so the plan's "decide keep or delete"
+  is moot — they are not repo content and were left alone.
+- **Leaf directories are not pre-created.** `docs/rules/{shared,client,server}/` and
+  `docs/integration/domains/` are named in their index stubs but not made on disk: git does not track
+  empty directories, so an empty scaffold would silently vanish. Each phase creates its own with its
+  first file.
+- **Server boot gotchas worth reusing** (recorded in `docs/integration/openapi/README.md`): it binds
+  **HTTP**, first boot takes ~40 s because Development migrates and seeds against the *remote* DB, and
+  `curl` to localhost returns **502** unless you pass `--noproxy '*'`.
+
+### Contradictions
+
+14 logged in [open-contradictions.md](open-contradictions.md), including a
+[corrections section](open-contradictions.md#corrections-to-the-seeded-list) covering the three seeded
+claims that did not reproduce as stated. Phase 0 resolved none, by design.