Consolidate Phase 8 documentation

Mark web administration complete, centralize current contracts and
acceptance evidence, and remove superseded slice records. Update
roadmap,
architecture notes, and test references without changing firmware
sources.

tests/web_admin_transport/README.md

@@ -17,15 +17,15 @@ transport functions are not copied or reimplemented. Temporary output is removed
 production entry points and inspects private state for lifecycle/wipe assertions.
 No firmware build, network access or device operation is performed.
 
-## Latest reported results — 8D.7 second certificate slice
+## Historical reported results — 8D.7 second certificate slice
 
 Implementer reports `run.py --tickets` PASS **25 transport / 12 ticket groups**, including certificate owner routing, currentness rejection and commit → stop → start short-circuit/error behavior. The owner's `dispatcher_actions` mask selects the existing 12 KiB dispatcher, not the 4 KiB control task. `tests/admin_console_boundary/run.py` (including `certificate.c`) separately covers typed deferred handoff/pending gate/executing reservation; `lifecycle.py` covers canonical handlers and unchanged SSH/UART0 behavior. Policy, server lifecycle **11**, cookie `--admin` and store `--serial` also pass as reported. Independent review has no actionable findings; sanitizer validation is unavailable due to missing libasan/libubsan. No hardware validation is claimed or performed by this documentation update.
 
-Current WEB policy allows exact parsed `web status`, `web stop`, `web certificate rotate --force`, and `reboot`/self-close; other web forms, account mutations, network mutations and restricted SSH lifecycle/key mutations remain blocked. Certificate drain/acknowledgement bounds do not bound queued execution or prove browser receipt. See `docs/phase8d7_implementation.md` for final parent build/resources, trust/relogin/failure checklist and authorized next bounded slice; M2 acceptance remains pending.
+Current [browser-shell policy](../../docs/web_administration.md#browser-shell-policy) permits selected other-account mutations as well as exact parsed `web status`, `web stop`, `web certificate rotate --force`, and `reboot`/self-close; network mutations and restricted SSH lifecycle/key mutations remain blocked in the shell. Typed Settings permissions are separate. Certificate drain/acknowledgement bounds do not bound queued execution or prove browser receipt. [Acceptance evidence](../../docs/web_administration_acceptance.md) records M2 and the later 8D.22 signoff; earlier pending gates below are historical, not current acceptance blockers.
 
 ## Earlier results recorded 2026-09-06
 
-8D.7 first slice: `run.py --tickets` passes **23 transport / 12 ticket groups**. Adds WEB stop/reboot owner routing, stale/revoked action rejection and stop-error propagation, pending-input discard before poll and cancellation-during-receive with/without an occupied RX buffer. `python3 tests/admin_console_boundary/lifecycle.py` separately checks the production canonical handlers and unchanged SSH/UART0 behavior. Dependencies remain doubled; no target stop/reboot is executed. See `docs/phase8d7_implementation.md` for scope and pending validation.
+8D.7 first slice: `run.py --tickets` passes **23 transport / 12 ticket groups**. Adds WEB stop/reboot owner routing, stale/revoked action rejection and stop-error propagation, pending-input discard before poll and cancellation-during-receive with/without an occupied RX buffer. `python3 tests/admin_console_boundary/lifecycle.py` separately checks the production canonical handlers and unchanged SSH/UART0 behavior. Dependencies remain doubled; no target stop/reboot is executed. See [browser-shell contracts](../../docs/web_administration.md#browser-shell-policy) and [regression procedures](../../docs/user_administration_tests.md#integrated-web-administration-regression-procedure), not additional execution claims.
 
 Final continuation: `run.py --tickets` passes **19 transport / 12 ticket groups**,
 including the HTTPD-owned shutdown retry/reuse regression. `server_lifecycle.py`
@@ -38,7 +38,7 @@ below. Final admin closure uses direct HTTPD-owned `shutdown`, not queued IDF
 session-close work. Parent reports the sequential final firmware build after this
 fix passed in **23.55 s**, at **95,580 B RAM / 1,637,273 B flash**, and the final
 independent security integration review found no actionable findings. See
-`docs/phase8d5_implementation.md` for build history and the pending target procedure.
+[terminal ownership](../../docs/web_administration.md#terminal-and-console-ownership) and [acceptance evidence](../../docs/web_administration_acceptance.md) for current contracts and signoff limits.
 
 After the production empty-frame, input-deadline and timer-generation fixes:
 

tests/web_cookie_auth/README.md

@@ -12,9 +12,9 @@ The runner compiles production `web_cookie_auth`, `web_session_store`, `web_auth
 
 Coverage includes challenge reuse/consumption/expiry, capacities without eviction, global throttle, fragmented login bodies, secure cookie attributes and two simultaneous Set-Cookie fields, session-specific logout, duplicate fields/cookies, Origin/CSRF/method/Fetch Metadata rejection, Basic denial, currentness, stop/login and failure paths, six-header login budget, upgrade-state installation, and request cleanup preserving all 0–128 pending lengths through partial reads.
 
-This is **not** the full IDF parser/dispatcher, real handshake/TLS/socket, browser, multicore task or hardware test. The private struct doubles do not prove binary layout; firmware compilation uses the actual pinned headers, and the version guard requires a new audit on SDK changes. Handshake sending and transport revocation are doubled. Actual on-wire pre-101 rejection, frame routing, pipelining/early bytes, cookie/CSP/browser recovery and loaded expiry latency remain M1 target gates. No sanitizer or runtime memory-reserve result is implied.
+This is **not** the full IDF parser/dispatcher, real handshake/TLS/socket, browser, multicore task or hardware test. The private struct doubles do not prove binary layout; firmware compilation uses the actual pinned headers, and the version guard requires a new audit on SDK changes. Handshake sending and transport revocation are doubled. Actual on-wire pre-101 rejection, frame routing, pipelining/early bytes, cookie/CSP/browser recovery and loaded expiry latency require real-target evidence beyond this harness; M1 and the retained Phase 8D scope have since been accepted. No sanitizer or runtime memory-reserve result is implied.
 
-See `docs/phase8d3_implementation.md` for source verification, other suite commands, build accounting and the target checklist.
+See [authentication contracts](../../docs/web_administration.md#authentication-and-admission), [acceptance evidence and limits](../../docs/web_administration_acceptance.md), and [regression procedures](../../docs/user_administration_tests.md#integrated-web-administration-regression-procedure).
 
 ## Accounts (8D.10)
 
@@ -32,19 +32,17 @@ authorization/currentness/no-mutation/cleanup, timer creation/start failure,
 queued expiry/replacement/executing fences, self success revocation and protected
 failure, pending/result isolation, stale IDs, submission/execution failure,
 target-only notifications, session invalidation and missed revocation/DB failure.
-Parent reports PASS for these nine groups plus shared regressions. Direct-handler
+Historical 8D.10 reports recorded PASS for these nine groups plus shared regressions; the following counts and build sizes describe that slice, not current totals. Direct-handler
 tests do not prove route registration; the missing registration is now fixed as
 an independent optional endpoint (23 handlers), and the route agent reports 15
 lifecycle groups passing for registration, failure isolation and restart.
 Implementation is host-tested/build-verified (parent `pio run` PASS, 25.61 s,
-95,908 B RAM / 1,694,237 B flash), not target accepted. New timer runtime costs
-remain unmeasured. No sanitizer validation or device/asset/commit/8D.11 action.
+95,908 B RAM / 1,694,237 B flash); target acceptance was pending at that time and is superseded by the 8D.22 signoff. Timer runtime costs remain unmeasured; no sanitizer result is implied.
 The second command separately exercises production conditional database mutation
 and zero-wait list bodies with NVS/RTOS doubles, including last-admin protection,
 target generation/recreation checks and commit-failure cleanup. It retains the
 canonical CLI account tests. These are not end-to-end RTOS/flash/TLS tests.
-See `docs/phase8d10_implementation.md` for current contracts, historical slice 1
-evidence and pending target checks. Timer doubles do not prove hard cleanup latency.
+See [Accounts contracts](../../docs/web_administration.md#accounts-and-authorized-keys) and [acceptance evidence](../../docs/web_administration_acceptance.md). Timer doubles do not prove hard cleanup latency.
 
 ## Read-only Serial Settings
 
@@ -64,5 +62,4 @@ registration. No SDK files are modified. Lifecycle registration/optional failure
 orchestration is separately tested by `tests/web_admin_transport/server_lifecycle.py`.
 
 This does not run the full serial task/UART driver, TLS/network dispatcher or a real
-browser. Target comparison with UART0 and runtime memory/stack validation remain
-pending in `docs/phase8d8_implementation.md`; prior M2 signoff remains accepted.
+browser. See [typed Settings contracts](../../docs/web_administration.md#typed-settings-api-and-operation-lifetime) and [Serial semantics](../../docs/web_administration.md#serial-and-display). [Acceptance evidence](../../docs/web_administration_acceptance.md) records the 8D.22 signoff without inferring individual target comparisons or runtime memory/stack margins.

tests/web_diagnostics/README.md

@@ -33,5 +33,4 @@ timeouts and all 16 existing failure/restart groups. Canonical CLI routing and
 SSH/browser policy have separate tests. No target heap, stack margin, admission
 reliability or secrecy of external SDK logging is proven by these tests.
 
-Usage, exact SDK cleanup audit, resource accounting, and target checklist:
-`docs/phase8d11_implementation.md`, “Authorized admission diagnostic slice”.
+See [admission diagnostic usage and interpretation](../../docs/web_admission_diagnostics.md#usage-and-interpretation), the [SDK cleanup audit and blind spots](../../docs/web_admission_diagnostics.md#sdk-audit-and-explicit-blind-spots), and [regression entry points and limits](../../docs/web_admission_diagnostics.md#regression-entry-points-and-limits).

tests/web_security/README.md

@@ -64,7 +64,7 @@ survives until its owner releases it after service stop/start.
 `python3 tests/web_admin_transport/server_lifecycle.py` additionally links real
 production security and mbedTLS to the production HTTPS owner, with NVS/HTTPD doubles,
 for unchanged identity/storage before commit and no rollback after stop/start failure.
-See [8D.21 contracts and evidence limits](../../docs/phase8d21_implementation.md).
+See [HTTPS identity contracts](../../docs/web_administration.md#service-lifecycle-and-identity-rotation) and [acceptance evidence and limits](../../docs/web_administration_acceptance.md).
 
 Removed: two credential functions (`show_credentials`, `rotate_credentials`),
 one credential struct type, three username/password capacity/length constants,

tests/web_ui_session/README.md

@@ -15,9 +15,9 @@ doubles. It reuses the HTTPD stub text from `tests/web_login_ui/run.py`, without
 importing/executing that runner. Node executes the actual C-rendered application
 and inline asset-failure script, not a separately maintained implementation.
 
-Current 8D.17 run: **126 behavior groups**, plus production renderer/HTML/CSP checks. Seven new quick groups cover mouse/focus/touch activation, single DOM ownership, focused-editor hover stability, Escape/outside dismissal, late reads/expiry, terminal input/drain isolation, full-page draft/promotion preservation, explicit Apply/Save and pending non-replay, Network secret exclusion/strict schema/401. `Element` focus/containment/hover and events are doubles, not browser event-dispatch proof.
+Historical 8D.17 run: **126 behavior groups**, plus production renderer/HTML/CSP checks. Seven new quick groups cover mouse/focus/touch activation, single DOM ownership, focused-editor hover stability, Escape/outside dismissal, late reads/expiry, terminal input/drain isolation, full-page draft/promotion preservation, explicit Apply/Save and pending non-replay, Network secret exclusion/strict schema/401. `Element` focus/containment/hover and events are doubles, not browser event-dispatch proof.
 
-Optional geometry: `WEB_UI_CHROMIUM=/usr/bin/chromium-browser python3 tests/web_ui_session/run.py`. The fixture covers 18 cases (four full views plus Serial/Wi-Fi quick panels at320/600/1200px, quick height360), including viewport bounds/scrolling and secret-control exclusion. The 8D.17 attempt was **blocked before measurement** by sandbox socket/Crash Reports restrictions; no geometry pass claimed. Full evidence/limits and target checklist: `docs/phase8d17_implementation.md`.
+Optional geometry: `WEB_UI_CHROMIUM=/usr/bin/chromium-browser python3 tests/web_ui_session/run.py`. The fixture covers 18 cases (four full views plus Serial/Wi-Fi quick panels at320/600/1200px, quick height360), including viewport bounds/scrolling and secret-control exclusion. The 8D.17 attempt was **blocked before measurement** by sandbox socket/Crash Reports restrictions; no geometry pass claimed. See [contextual-control contracts](../../docs/web_administration.md#broker-and-contextual-controls), [acceptance evidence and limits](../../docs/web_administration_acceptance.md), and [regression procedures](../../docs/user_administration_tests.md#integrated-web-administration-regression-procedure).
 
 Coverage:
 
@@ -134,13 +134,10 @@ These tests model DOM, timers, fetch cancellation and WebSocket events. They do
 not prove real-browser CSP enforcement, script-loading errors, TLS/HTTPD behavior,
 actual bfcache policy, cookie expiry, server revocation, or hardware serial byte
 integrity, actual xterm escape parsing, hidden prompts, or desktop/mobile layout.
-Prior 8D.6 signoff stands; current slice 2 contracts and pending target checklist are in
-`docs/phase8d10_implementation.md`. Implementation is complete, host-tested/build-verified,
-not target accepted: parent build PASS 25.61 s, 95,908 B RAM / 1,694,237 B flash.
+See [Accounts contracts](../../docs/web_administration.md#accounts-and-authorized-keys) and [acceptance evidence](../../docs/web_administration_acceptance.md). The following are historical 8D.10 slice 2 reports, not current totals: parent build PASS 25.61 s, 95,908 B RAM / 1,694,237 B flash.
 The generated endpoint is independently optionally registered (23 handlers), with
 route-agent lifecycle 15 PASS for failure isolation/restart. UI 57/CSP and lifecycle
 15 results are agent-attributed, not claims of the parent's additional reruns.
-Target/signoff and new timer runtime measurements remain open; no sanitizer,
-device/assets/commit/8D.11 action or target resource reserve is claimed. Browser secret
+The former pending target-signoff gate is superseded by the 8D.22 acceptance; timer runtime measurements remain unreported. No new sanitizer/device execution or target resource reserve is claimed. Browser secret
 references are dropped and never persisted/logged, but JavaScript cannot securely
 wipe engine-managed strings.