docs(04-07): closure markers — REQUIREMENTS + ROADMAP + STATE + PROJECT for Phase 4 v1 close-prep

Task 2 of Plan 04-07 — 4 marker file flips landing Phase 4 closure-prep
(NOT formal Phase 4 closure; that happens at the ceremony AFTER the
independent gsd-verifier audit per Phase 1-3 precedent).

ROADMAP.md:
- Plan 04-07 row flipped [ ] → [x] with full closure annotation (04-VERIFICATION.md
  citation + Phase 4 cumulative totals + D-P4-05 backfill verification + closure-
  ceremony deferral note)
- Phase 4 progress table cell updated 7/8 → 8/8 with full closure-prep narrative
- Phase 4 row [ ] LEFT UNFLIPPED — verifier audit + closure ceremony flips it

STATE.md:
- progress.completed_plans: 29 → 30 + progress.percent: 93 → 97
- progress.completed_phases: 3 (UNCHANGED) + status: executing (UNCHANGED)
- stopped_at + last_updated + last_activity updated for Plan 04-07 closure
- Current Position block updated to reflect Plan 04-07 completion + pending
  closure ceremony
- Plan 04-07 closure section added at top of body
- Performance metrics row added for Phase 04 P07
- Session Continuity entry prepended for Plan 04-07
- 2 Phase 04-07 decisions appended to Decisions list

REQUIREMENTS.md:
- 4 Phase 4 closure notes appended to existing REQ blocks (no existing REQ-*
  lines modified):
  - REQ-video-ring-buffer: ROADMAP SC #1 via Plan 04-08 (methodology reframe)
  - REQ-rrweb-dom-buffer: A29 cs-injection-world + UAT 33→36 GREEN summary
  - REQ-user-event-log: ROADMAP SC #2 via Plan 04-05 + audit P1 #11/#14/#15
    via Plan 04-01
  - REQ-install-clean: ROADMAP SC #3/SC #4/Plan 04-02 build hygiene + Plan
    04-08 Tier-2 leak gate
- Trailing footer line updated with 2026-05-26 Phase 4 closure citation

PROJECT.md:
- NEW Validated in Phase 4 section added (7 bullets covering all closures)
- Active section evolved from Phase 4 backlog → Phase 4 closure-ceremony
  workstream + Deferred-to-v1.1/v2 maintenance milestone items
- Trailing footer line updated with 2026-05-26 Phase 4 closure citation

Acceptance criteria gates (all PASS per Plan 04-07 Task 2):
- ROADMAP.md 04-07 row [x] = 1
- ROADMAP.md Phase 4 row [x] = 0 (correctly LEFT unflipped)
- STATE.md completed_phases: 3 = 2 (frontmatter + body — UNCHANGED per spec)
- STATE.md completed_plans: 30 = 1 (incremented by 1)
- STATE.md status: executing = 1 (UNCHANGED per spec)
- REQUIREMENTS.md "Phase 4 closure note" mentions = 4 (>= 3)
- PROJECT.md "Validated in Phase 4" section = 1
- git diff --stat HEAD~1 HEAD shows only .planning/ files dirty (T-04-07-02
  threat mitigation gate honored — docs-only commit; no source/test changes)

Phase 4 row + completed_phases bump + status:completed flip explicitly
DEFERRED to closure ceremony after the independent gsd-verifier audit
per Phase 1-3 precedent (executor creates VERIFICATION.md; verifier
independently re-validates with goal-backward audit; orchestrator flips
markers post-verifier-audit).

.planning/REQUIREMENTS.md

@@ -49,6 +49,18 @@ Requirements for the Phase 1 SPEC. Each maps to one phase in ROADMAP.md.
     `.planning/debug/d13-multi-ebml-concat-unplayable.md` for the
     byte-level root-cause evidence.
 
+  Phase 4 closure note (2026-05-26): ROADMAP SC #1 (SW state persistence — after
+  >5min idle + export, archive still contains non-empty video buffer)
+  empirically verified via Plan 04-08 A33 harness assertion. Spike re-run at
+  tests/uat/spike-a33-sw-persistence.ts produces videoSize=1,797,178 bytes
+  (1.8 MB) vs 8505-byte baseline; offscreen RAM-only `segments: Blob[]` at
+  src/offscreen/recorder.ts:91 architecturally sound (segments survive SW kill
+  structurally — POST-KILL probe count=3); previous Plan 04-04 SPIKE FAILED
+  outcome was test-methodology issue (canvas.captureStream invisible-source
+  throttling per Chrome bug 653548), not architectural. See
+  .planning/phases/04-harden-clean-up-optional/04-VERIFICATION.md
+  Per-Requirement Scorecard SC #1 row.
+
 ### DOM Capture
 
 - [x] **REQ-rrweb-dom-buffer**: The extension records DOM events via rrweb
@@ -69,6 +81,19 @@ Requirements for the Phase 1 SPEC. Each maps to one phase in ROADMAP.md.
   canonical for SPEC §10 #4; operator UAT retired by explicit delegation).
   VERIFICATION at .planning/phases/03-spec-10-smoke-verification-dom-event-log-verification/03-VERIFICATION.md.
 
+  Phase 4 closure note (2026-05-26): A29 cs-injection-world rewrite + strict-
+  sentinel filter (Plan 04-03 commits 73eb9b6 + b341a71) — flake closed 5/5
+  PASS across consecutive UAT runs (was ~2/3 historical baseline per Plan
+  03-03 SUMMARY); iana.org-leftover flake CLOSED. driveA29 host-side strict-
+  sentinel filter requires IncrementalSource.Mutation + adds[*].node.textContent
+  containing 'a29-mutation-sentinel' (only our injection can produce). A29.2
+  strict-sentinel = PRIMARY check; A29.3 (Meta) + A29.4 (FullSnapshot) preserved
+  as defense-in-depth. UAT harness 33 → 36 GREEN end-of-Phase-4 (+A33 SW state
+  persistence via Plan 04-08; +A34 fetch+XHR network_error via Plan 04-05;
+  +A35 live-DOM inline-SVG via Plan 04-06 with 5 sub-checks incl. A35.5 light+
+  dark equality decouple-proof). See 04-VERIFICATION.md Cross-Cutting Hardening
+  Items row H2.
+
 ### Event Logging
 
 - [x] **REQ-user-event-log**: The extension logs user and runtime events over
@@ -95,6 +120,24 @@ Requirements for the Phase 1 SPEC. Each maps to one phase in ROADMAP.md.
   charter — REQ-password-confidentiality remains Out of Scope v1).
   VERIFICATION at .planning/phases/03-spec-10-smoke-verification-dom-event-log-verification/03-VERIFICATION.md.
 
+  Phase 4 closure note (2026-05-26): ROADMAP SC #2 (fetch + XHR network_error
+  empirical capture) CLOSED via Plan 04-05 (A34 commits a20372a + 0712c24) —
+  cs-injection-world fires fetch(404) + XMLHttpRequest(404) from a probe tab
+  on https://example.com; driveA34 host-side JSZip-parses logs/events.json
+  and confirms 2 network_error entries with meta.status === 404 (skip-mode
+  UAT 35/35 GREEN; A34 real ~25s; all 6 sub-checks PASS — A34.1 SAVE ack +
+  A34.0a events.json present + A34.2 fetch entry + A34.3 XHR entry + A34.4
+  fetch meta.status===404 + A34.5 XHR meta.status===404).
+  Plan 04-01 P1 #11 fetch URL extraction fix validated end-to-end via A34.4 —
+  the fetch network_error entry's target carries the real URL
+  (`https://example.com/404-fetch-a34-<stamp>`) NOT the literal `[object Request]`
+  that the pre-fix `args[0]?.toString()` implicit coercion produced. Plan 04-01
+  P1 #14 navigation URL tracking (module-level `let previousUrl` at
+  src/content/index.ts:29) + P1 #15 rrweb timestamp normalization (Date.now()
+  at emit time at line 315) are unit-tested at tests/content/ (9 tests across
+  3 files in NEW tests/content/ directory). See 04-VERIFICATION.md
+  Per-Requirement Scorecard SC #2 row + Audit P1 Polish #11/#14/#15 rows.
+
 ### Export
 
 - [x] **REQ-screenshot-on-export**: On "Save archive" click, the extension
@@ -209,6 +252,23 @@ Requirements for the Phase 1 SPEC. Each maps to one phase in ROADMAP.md.
   "all good" on the empirical load.
   - SPEC §10 acceptance criteria: #1.
 
+  Phase 4 closure note (2026-05-26): ROADMAP SC #3 (generate-icons ESM/CJS
+  compatibility under package.json type:module) + SC #4 (dead-code grep —
+  permissions.request absence) both CLOSED via Plan 04-02 (commit f251297).
+  SC #3 closure: `git mv generate-icons.js generate-icons.cjs` (Node 14+
+  treats .cjs as CJS regardless of package.json type:module per
+  nodejs.org/api/packages.html#determining-module-system); `node
+  generate-icons.cjs` exits 0; `npm run build` exits 0. SC #4 closure:
+  tests/build/dead-code-grep.test.ts regression-pins `permissions.request`
+  absence in src/. ALSO: Plan 04-02 4-mechanism layered CSP-hardening
+  mitigation flipped SW chunk `new Function` polarity 1 → 0 (closes Plan
+  01-12 Wave 7 setimmediate polyfill deferred-items entry end-to-end);
+  pre-checkpoint bundle gates 6/6 PASS at every Phase 4 checkpoint boundary;
+  NEW Tier-2 production-bundle filename-leak gate added by Plan 04-08
+  (verifies 0 hits of `synthetic-display-source` in dist/). See
+  04-VERIFICATION.md Per-Requirement Scorecard SC #3 + SC #4 rows + Cross-
+  Cutting Hardening Items rows H1/H3/H4.
+
 ### Performance & Security
 
 - [x] **REQ-archive-export-latency**: From the moment the user clicks the
@@ -319,7 +379,8 @@ RAM-ceiling check.
 
 ---
 *Requirements defined: 2026-05-15*
-*Updated 2026-05-20 — Phase 3 closed (REQ-rrweb-dom-buffer + REQ-user-event-log marked Complete via gsd-verifier Phase 3 aggregator; §10 #8 PARTIAL per D-P3-02 + A31 GREEN existing-minimum verification; §10 #9 awaits operator chrome://memory-internals per D-P3-04 + A32 informational scaffolding shipped; UAT harness 29 → 33 GREEN; T5 overrides applied for §10 #4/#5/#8 PARTIAL per saved memory feedback-trust-harness-over-manual-uat.md). VERIFICATION.md at .planning/phases/03-spec-10-smoke-verification-dom-event-log-verification/03-VERIFICATION.md.*
+*Updated 2026-05-26 — Phase 4 closure (executor-created aggregator at .planning/phases/04-harden-clean-up-optional/04-VERIFICATION.md; pending independent gsd-verifier audit + Phase 4 row + completed_phases marker flips). Phase 4 introduced NO new REQs but added verification status notes to REQ-video-ring-buffer (ROADMAP SC #1 via Plan 04-08), REQ-rrweb-dom-buffer (A29 cs-injection-world rewrite via Plan 04-03), REQ-user-event-log (ROADMAP SC #2 + audit P1 #11/#14/#15 via Plan 04-05 + Plan 04-01), REQ-install-clean (ROADMAP SC #3 + SC #4 + Plan 04-02 build hygiene + Plan 04-08 Tier-2 leak gate). UAT harness 33 → 36 GREEN (+A33 + A34 + A35); vitest 171 → 188 GREEN (+17); pre-checkpoint bundle gates 6/6 PASS (Gate 2 polarity flipped 1 → 0); Tier-1 FORBIDDEN_HOOK_STRINGS unchanged at 12; NEW Tier-2 production-bundle filename-leak gate; 3 /gsd-debug sessions documented; operator-empirical ack 2026-05-26 "Confirmed fixed — close Plan 04-06".*
+*Earlier update: 2026-05-20 — Phase 3 closed (REQ-rrweb-dom-buffer + REQ-user-event-log marked Complete via gsd-verifier Phase 3 aggregator; §10 #8 PARTIAL per D-P3-02 + A31 GREEN existing-minimum verification; §10 #9 awaits operator chrome://memory-internals per D-P3-04 + A32 informational scaffolding shipped; UAT harness 29 → 33 GREEN; T5 overrides applied for §10 #4/#5/#8 PARTIAL per saved memory feedback-trust-harness-over-manual-uat.md). VERIFICATION.md at .planning/phases/03-spec-10-smoke-verification-dom-event-log-verification/03-VERIFICATION.md.*
 *Earlier update: 2026-05-20 — REQ-meta-json-schema amended for Plan 02-03 (D-P2-02 + D-P2-03 8-field cutover: `url: string` → `urls: string[]`; new `schemaVersion: "2"` field; F2 empty-array permission). Traceability table entry flipped to "Pending (implementation landed via Plan 02-03; harness validation deferred to Plan 02-04)".*
 *Earlier update: 2026-05-20 — Plan 01-10 closure (welcome tab; first-install activation; canonical mark + canonical tokens + canonical chrome.i18n welcomeHero; 24/24 UAT GREEN; operator cycle-2 ack "All good"). Plan 01-10 introduced no new functional REQs; it consumed REQ-video-ring-buffer (already Complete via Plan 01-07) by adding the first-install operator-facing activation surface that complements the always-on capture pipeline. Phase 1 final functional plan delivered; final-closure marker flip pending (REQUIREMENTS / ROADMAP / STATE markers + optional /gsd-verify-work 1).*
 *Earlier update: 2026-05-20 — REQ-install-clean + REQ-manifest-permissions marked Complete on Plan 01-12 closure (design integration + manifest i18n + operator brand-fit ack)*