Inbound signature verification was removed on next (#279), so the
Future Step proposing a Stripe HMAC scheme "landed with inbound
verification" proposed extending a subsystem that no longer exists, and
the Status section still counted #67 among the deployability gaps it
had closed. Both are gone.
Status now states the milestone honestly: open, 64 closed and 7 open,
with the tag held on #256 and a fix in review. The enumeration of open
follow-ups is dropped -- the tracker is the authoritative TODO and one
of the four listed issues had already closed.
Completed Steps gains the nine units that landed since the file was
last touched (#250, #254, #261, #221, #211, #262, #269, #253, #279) and
the 2026-08-20 units that were only ever summarised in Status prose or
missing entirely (#201, #200, #205, #206, #207, #234, #202, #203, #209,
#210, #208, #204, #233, #127).
#226 is closed on the tracker but is deliberately NOT recorded as
landed: no commit on next addresses it, and cleanShutdown still reads
s.httpServer and s.sentryEnabled unguarded.
sneak