[tmttodd]

What

Develops the harness's "green does not prove" section into an actionable backlog:
docs/DEV-GAP-BACKLOG.md — ten entries (GB-1…GB-10), each with the capability and phase it
blocks, instrumented evidence, a runnable acceptance check, and its dependencies. Plus the
sequence, the first increment, and an explicit unverified list.

Also corrects one claim in docs/DEV-READINESS-REVIEW.md that is stale as of be0ba58.

Two things this found by executing, not reading

1. The P1 conformance gate is no longer missing — my own review said it was.

The review was written against 2191155, where ci-v2.yaml had no mutation or conformance
step. PR #51 then added the phase-gates job and I merged the review unchanged, so the merged
doc claimed a gap that the same PR had closed. The backlog re-ran it:

$ gh run view 40059341183 --json jobs --jq '.jobs[]|select(.name=="phase-gates")|.conclusion'
success
$ ... --log | grep -E 'all_mutants_caught|"passed"'
  "all_mutants_caught": true,        # 4/4 mutants caught
  "passed": 2, "failed": 0          # conformance

The review now says the gate is wired and its evidence is thin (the corpus is two checks),
which is the true statement.

2. POST /ops/changes returns 500 for every caller that omits created_by.

ChangeIn.created_by defaults to None, and model_dump() always emits the field, so None
reaches core.open_change, where change.get("created_by", default) never fires — the key
exists. The NOT NULL insert then raises, and only ValueError is caught. Reproduced here:

$ # create_app() on ASGI transport
created_by omitted -> 500 Internal Server Error
created_by null    -> 500 Internal Server Error

The route only works if the caller supplies created_by explicitly. It is not live (the CCB
has no deployment), which is why nothing caught it — and it is the first red test of the
recommended first increment.

The first increment this recommends

A pytest suite for corvus-v2/corvus/app.py on an ephemeral port. It is the smallest change
that turns the largest untested surface (six routes, 0% coverage) into a gate, and the fixture
two other entries need. It would also have caught the 500.

Honest limits

§4 lists seven things not verified, including: actual row loss on pod replacement (inferred
from emptyDir + Recreate, not observed), live-engine behaviour at be0ba58 (the deployed
image is still 2191155), and make mutation on the worktree (deliberately not run — it
rewrites the tree while other agents share it).