docs(plans): correct the S32 Step 9 entry and record three Status rows

Corrections to the S32 plan. A step branch may not edit the plan file, so they land here.

Step 9 contradicts itself on the handshake-failure return shape

The Scope paragraph asks for a positional marker that probeErrorIsPositional admits, which needs a non-nil Go error. The Acceptance and Tests bullets ask for a remote.ProbeError outcome with a nil Go error. The implementation follows Scope.

The nil-error shape cannot work. decisionForProbe books the position failed and leaves the data-error mark unset, and only the positional arm sets that mark. A sibling's ProbeMiss would then answer the client a 404, against the fail-open the Scope paragraph exists to give.

The two bullets now state the non-nil shape, and record why, so a later reader does not restore the nil one. Two Tests bullets drew their contrast on nil versus non-nil; that contrast is now marked versus unmarked.

Step 9's Scope states the criterion the step falsifies

The Scope paragraph drew the data-error mark on a handshake that "never consulted the upstream". The step's own challenge-discovery leg issues a HEAD per request, and a container Probe that meets a 401 on a cached token re-exchanges once, so a refusal there fails a position it already contacted. The implementer reads Scope before the Files list, so this is the sentence the step's comments get written from. It now reads that the failed handshake establishes no absence.

Step 9's Files entry omits twenty paths

Re-derived with git diff --name-only origin/main...HEAD against the step branch, rather than written from the plan. The entry names 27 of the branch's 35 paths, against 7 on main, so twenty are newly named. The remaining eight are test files the entry covers by their siblings rather than by name. Two of the twenty are internal/remote/health.go and internal/remote/health.md, which the step branch reached in a later review round. Measured at the step branch 3a021f0f4.

Two of the nineteen decide a boundary: Step 9 books probe on oci_remote_upstream_responses_total and widens internal/metrics/cardinality.go, which the plan assigned to Step 17. The plan follows the code here — the Probe this step introduces is the emitter, and a booking site with no label value does not compile. Step 17 keeps the oci_remote_proxy half, which this step does not touch.

The rest are the configuration surface the budget's move reaches, the catalog rows, the maven and npm sidecars, and the S32 sentence this step falsifies.

Three entries also described edits the step does not make. All three credential markers are on main already, so neither sidecar gains one; the credential doc keeps its cause enumeration and gains the authorization leg. Two were short: resolve_budget.md takes three passages, and resolve_errors.md gains a section and a doc-block count.

Step 9's npm-sidecar bullet scopes the edit too narrowly

The entry names the sidecar's deadline paragraph and says the paragraph beside it is untouched. The step also edits the refused-credential section. Its marker list gains the third credential marker, and its "never asked its upstream" claim goes false for the reason above.

The S13 citations name the condition, not the tense

Three places asserted S13's corrected wording as though it had landed, at a time when main still carried the old criterion. Those sentences now name the condition and its event, so they read correctly on either side of !2724 (merged), which has since merged. ## Dependencies carries that amendment as a Step 9 gate with the reason it bound.

The Research Finding quoted S13's scope rule verbatim, and !2724 (merged) rewords that sentence. The quote becomes a statement of the rule instead, which the rewording does not falsify.

**No S13 spec amendment precedes this step.** read as covering the criterion as well as the probe budget. Its own body argues only the budget, so the headline is narrowed to it.

Step 9's second amendment gate is missing

## Dependencies recorded one amendment gate on Step 9, the S13 credential-failure criterion. Step 9 also books probe on oci_remote_upstream_responses_total and widens internal/metrics/cardinality.go's closed set, which needs S16's operation domain to declare the value — the gate !2738 (merged) closed. A reviewer counting Step 9's gates from this section found one.

Both amendments have now merged, so both bullets state that rather than the window they used to describe. The S16 bullet also says what does not gate here: the oci_remote_proxy half of the value is Step 17's, and Step 9 does not touch remote_wideevent.go.

Step 9's Files: entry pointed at the section rather than the MR, so a reader following it landed on the Metrics bullet marked "gating no step". It names !2738 (merged) now.

The worst-case probe ruling rests on a false premise

### The worst-case probe is 20s, not 30s, and merged S13 says 30s rules that no probe can pay a cold-token exchange and a 401 retry, because Reauthorize refuses a prior that is not a cache hit and RemoteTokenHit means no exchange ran.

Authorize bounds a whole acquisition, not the exchange alone, and acquire's UpstreamAuthUnknown arm runs challenge discovery inside that bound before any exchange. exchange hands the token cache's own outcome straight back, so a probe that paid a discovery leg still reports RemoteTokenHit and still earns the retry. The worst case is two acquisitions and two HEADs: 30s a probe, 60s a sweep.

Merged S13 and main's own TestVirtualRepositories_ResolveTimeoutClearsTheContainerProbeSweep already derived 60s. So the plan was the outlier, not the spec. The subsection, its heading, and the five passages citing it move together. No default and no ruling moves, since 90s clears 60s; the headroom it is stated against drops from 50s to 30s.

cardinality.go has three writers, and the plan named two

Step 9 takes the operation closed set, which Step 17's Files: entry still claimed, and two seam sentences called Step 17 the file's only other writer. Whoever implements Step 17 would be told Step 4 is the one other writer and never learn Step 9 had added the value.

Step 17's entry now keeps the oci_remote_proxy half alone, both seam sentences name Step 9, and Step 9's own entry states that it merges first.

The eligibility pass has five data-error writers

The sentence said six. Five sit in excludePosition; the sixth is in runPhase1, which this package places after the eligibility pass rather than in it.

Step 9's Files entry omits the S13 edit

The step edits docs/specs/S13-virtual-remote-foundation.md, and two sentences told the reviewer there was no S13 change to look for. S13 gains its own Files: bullet naming the three figures that move, and both sentences now say that no amendment precedes the step while the step does edit S13 — what moves is arithmetic, not a rule.

The guardrail-17 count is dropped

The resolve.go entry counted "four other comments". This MR adds three Files entries and a second correction scope, so the figure was already wrong and would break again on the next entry. It states no number now.

Status rows

Steps 2, 3 and 9 gain their MRs: !2277 (merged), !2682 (merged), !2744 (merged). Step 8's !2685 row is already on main and shows in the diff only as context. Step 3's MR was open when its row was recorded; the table records a row at MR-open time.

Related to #291 (closed)