Each row of docs/THREATS.md names the test or gate that enforces it, and a test fails on a row that names none #11874

Every protection in docs/THREATS.md now ends in an Enforced by: line in place of the old Test: line. In the internal-calls table, the last column holds the enforcer. An enforcer is one of three things:

• a test file under test/
• a gate under scripts/
• none yet, with an optional (#N) for the open issue that owns the gap

No enforcer was added or changed: every row keeps the test file it already cited.

What moved where

• src/core/threats.ts: parseThreats reads Enforced by:. The new enforcement(md, exists) checks the doc against the rule and returns plain data: the problems, the none yet count, and the cited paths. Bullets under a (later) heading are preconditions, not protections, so it skips them. The Protection.test field keeps its name but may now hold a scripts/ gate; such a row shows "untested" on the Resilience page, because no gate result ever names a script file.
• test/threats-doc.test.ts → test/threats-enforced.test.ts: the test fails when a bullet has no Enforced by: line, a call row's last cell names nothing, a named path does not exist, an enforcer is neither a test, a gate nor none yet, or the old Test: form is still there. Each of these cases has its own fixture. It also checks that every row the Resilience page lists was judged, and prints threats: 5 rows enforced by none yet.
• test/resilience.test.ts and test/checks-resilience.test.ts: these two tests changed. Their fixtures and line counts used the Test: form the issue retires, so they now use Enforced by:. Nothing else in them changed.
• scripts/gate.ts picks up every test/*.test.ts by itself, so nothing needed adding there.

Follow-ups: the none yet rows (none filed by this pull)

1. TLS at the edge: certificates are issued only for names the forge vouches for (the on_demand_tls ask).
2. Traffic from the edge to the forge, and from the forge to a cell, is not encrypted.
3. Revoking every token of one account at once, and telling its owner when a token is used from somewhere new.
4. Reviewing lockfile (bun.lock) changes before they reach an app's cell.
5. Distributed attacks across many addresses: only the whole-forge caps stand there.

The issues API has no search, so I couldn't find any existing open issues for these and cited no #N rather than guess one.

Checks run here

• Passed: bun scripts/gate.ts, bun x tsc --noEmit, and bun test on test/threats-enforced.test.ts, test/resilience.test.ts, test/checks-resilience.test.ts, test/resilience-fit.test.ts and test/tui-screens.test.ts.
• Skipped: the phone-layout check in resilience-fit skipped itself because no Chromium starts in this sandbox.
• Not run: bun scripts/fast.ts named 1641 test files, because threats.ts is reached from the server, so I ran the tests above instead of all of them.

🤖 Generated with Claude Code

Closes #11865

Every protection in docs/THREATS.md now ends in an Enforced by: line in place of the old Test: line. In the internal-calls table, the last column holds the enforcer. An enforcer is one of three things:

• a test file under test/
• a gate under scripts/
• none yet, with an optional (#N) for the open issue that owns the gap

No enforcer was added or changed: every row keeps the test file it already cited.

What moved where

• src/core/threats.ts: parseThreats reads Enforced by:. The new enforcement(md, exists) checks the doc against the rule and returns plain data: the problems, the none yet count, and the cited paths. Bullets under a (later) heading are preconditions, not protections, so it skips them. The Protection.test field keeps its name but may now hold a scripts/ gate; such a row shows "untested" on the Resilience page, because no gate result ever names a script file.
• test/threats-doc.test.ts → test/threats-enforced.test.ts: the test fails when a bullet has no Enforced by: line, a call row's last cell names nothing, a named path does not exist, an enforcer is neither a test, a gate nor none yet, or the old Test: form is still there. Each of these cases has its own fixture. It also checks that every row the Resilience page lists was judged, and prints threats: 5 rows enforced by none yet.
• test/resilience.test.ts and test/checks-resilience.test.ts: these two tests changed. Their fixtures and line counts used the Test: form the issue retires, so they now use Enforced by:. Nothing else in them changed.
• scripts/gate.ts picks up every test/*.test.ts by itself, so nothing needed adding there.

Follow-ups: the none yet rows (none filed by this pull)

1. TLS at the edge: certificates are issued only for names the forge vouches for (the on_demand_tls ask).
2. Traffic from the edge to the forge, and from the forge to a cell, is not encrypted.
3. Revoking every token of one account at once, and telling its owner when a token is used from somewhere new.
4. Reviewing lockfile (bun.lock) changes before they reach an app's cell.
5. Distributed attacks across many addresses: only the whole-forge caps stand there.

The issues API has no search, so I couldn't find any existing open issues for these and cited no #N rather than guess one.

Checks run here

• Passed: bun scripts/gate.ts, bun x tsc --noEmit, and bun test on test/threats-enforced.test.ts, test/resilience.test.ts, test/checks-resilience.test.ts, test/resilience-fit.test.ts and test/tui-screens.test.ts.
• Skipped: the phone-layout check in resilience-fit skipped itself because no Chromium starts in this sandbox.
• Not run: bun scripts/fast.ts named 1641 test files, because threats.ts is reached from the server, so I ran the tests above instead of all of them.

🤖 Generated with Claude Code

Left #11865 open: 1 unticked item remain (Each threat in docs/THREATS.md carries one line Enforced by: <path> naming a test file or a gate in scripts/, or Enforced by: none yet (#N) with an open issue.).