docs(release): F-L11 closed as verified non-finding (no screenshot replacement)

Deferred F-L11 from Phase G re-evaluated against the live container
2026-05-18 after F-L6/F-L7 demo CSV curation landed.

Re-evaluation:

  (a) docs/screenshots/02-inline-editing.png shows the
      DR130_priv_escalation editing view. DR130 was NOT in F-L6
      scope (F-L6 curated DR310/DR71_users/DR520/DR630; F-L7
      curated DR20/DR102/DR88). The displayed synthetic usernames
      (ahernandez_dev, admin_asmith, svc_splunk5 etc.) against AD
      groups and ServiceNow-style ticket IDs are unchanged.

  (b) docs/screenshots/03-audit-trail.png shows audit events for
      DR45_suspicious_login, DR610_vpn_anomaly,
      DR640_service_account_logon. None of these are in F-L6/F-L7
      scope; the visible 'user_row_4: r.thomas' references a
      historical audit event, immutable by design.

  (c) Re-capture against the live 2026-05-18 container produced
      visually-WORSE output. The dev-license trial entered its
      warning state in the 12 days since the originals were taken,
      adding a prominent orange highlighted banner with the D15
      publisher email at the top of every screenshot. The email
      itself is the intentional public-facing identity per D15,
      but the highlighted presentation is noisier than the
      originals' subtle grey state.

Action: keep the originals. F-L11 closed with verified-non-finding
status. Updated the deferred-list entry in Phase G closeout section
to reflect the inspection finding.

Net audit V2 final status: 14 of 15 closed (was 13 of 15 before this
re-evaluation). One remaining explicit deferral: F-M4 (releaseDate
update, Phase 3.2 rc1 cut task).

Author: RelativisticJet

docs/PRE_PUBLIC_AUDIT.md

@@ -1059,7 +1059,7 @@ User picked **option 2 (fix-everything)** with `.planning/` untrack, `git tag -d
 **Deferred (explicit, not failure):**
 
 - **F-M4** (`app.manifest` releaseDate) — release-time task; updates at Phase 3.2 rc1 cut alongside `build` + `version` bumps.
-- **F-L11** (re-capture screenshots `02-inline-editing.png` + `03-audit-trail.png`) — requires a live Splunk container running the curated demo CSVs. Will run after Phase 3.4 flip / before Phase 3.2 rc1 cut.
+- **F-L11** (re-capture screenshots `02-inline-editing.png` + `03-audit-trail.png`) — **re-evaluated 2026-05-18 against live container, no replacement needed.** The deferred finding was a defensive coupling note: "if F-L6/F-L7 curation runs, screenshots displaying those rows must be re-taken." On inspection: (a) screenshot `02-inline-editing.png` shows the `DR130_priv_escalation` editing view — `DR130` was NOT in F-L6 scope (F-L6 curated `DR310`/`DR71_users`/`DR520`/`DR630`; F-L7 curated `DR20`/`DR102`/`DR88`). The content shown in 02 (synthetic usernames like `ahernandez_dev`, `admin_asmith`, `svc_splunk5` against AD groups and ServiceNow-style ticket IDs) is unchanged. (b) Screenshot `03-audit-trail.png` shows audit events for `DR45_suspicious_login`, `DR610_vpn_anomaly`, `DR640_service_account_logon` — none in F-L6/F-L7 scope; the visible row value `user_row_4: r.thomas` references a now-removed-from-host-but-historically-emitted audit event, which is correct historical behavior (audit log is immutable record of past actions). (c) Re-capture against the current 2026-05-18 container produced visually-worse output (the dev-license trial entered its warning-banner state in the 12 days since the originals, adding a prominent orange `DEVLICENSE:COMMUNICATE.OLEH@GMAIL.COM` banner that wasn't in the originals; the email is the intentional D15 publisher identity but the highlighted presentation is noisier). Action: keep originals; do NOT publish replacements. F-L11 closed with verified-non-finding status.
 
 **Scope note for F-M6 (raised by 2026-05-18 QA second-pass review):**
 the `.planning/` directory is now `.gitignore`'d (so 152 tracked files