docs(audit): Q.DEFER.003 FULLY CLOSED 13.05.2026 — sub-B+C done, real coverage numbers documented

5 atomic commits 4c6d593..f2627e4 + ~23 new tests:
- Task 1: ChangePasswordCard 3 specs (placeholder coverage)
- Task 2: RecoveryCodesCard 6 specs (dialog flow)
- Task 3: TwoFactorCard 9 specs (setup wizard + disable)
- Task 4: router.spec 5 integration tests (guard branches + /admin + /reset)

Real coverage (Vitest --coverage Task 5):
- RecoveryCodesCard Stmts 28% -> 59.37%
- TwoFactorCard Stmts 28% -> 71.42%
- router/index.ts Stmts 33% -> 46.15%, Branches -> 100%, Funcs 7% -> 22.22%
  (24+ lazy-import factories inflate Funcs denominator)

Honest note: Tasks 2/3/4 commit headlines (70%+, 80%+, 85% Funcs) were
overstated против actual; meaningful Stmts gains remain. Sub-A (api/* 43 tests)
closed earlier 12.05.2026 night commit 95f5f94.

docs/superpowers/audits/2026-05-12-portal-full-audit-blocked.md

@@ -114,7 +114,28 @@ C. Vuetify v-tooltip eager-mount artifact (aria-tooltip-name): role="tooltip" ov
 - 16 auth-required views (/dashboard, /deals, /kanban, /projects, /reports, /billing, /settings, /reminders + 8 admin) **не verified** — Pa11y standalone не auth'ится без cookie injection. Q.DEFER.002 закрыт по диагностированным findings, но auth-coverage gap остаётся.
 - **Что нужно от заказчика:** (A) расширить `pa11y.config.json` или добавить CI job с auth-flow / (B) ручной audit-pass следующей сессии.
 
-### Q.DEFER.003 — Coverage debt: api/* layer + security cards (Phase 13 extra)
+### Q.DEFER.003 — ✅ FULLY CLOSED 2026-05-13 — sub-A (api/* 43 tests, 12.05.2026 night) + sub-B (security cards 18 specs) + sub-C (router 5 integration tests) all done
+
+**Closure summary (13.05.2026 day, commits `4c6d593..f2627e4` + Task 6 docs):** 5 atomic commits + ~23 new tests across security cards (Change/Recovery/TwoFactor) and router integration scenarios. Vitest baseline 660 → 683 (+23). vue-tsc 0 errors.
+
+**Real coverage (post-Task-5 Vitest --coverage verification, transparent reporting):**
+
+- `ChangePasswordCard.vue`: 0% → ~100% (17-line static placeholder, single button + heading)
+- `RecoveryCodesCard.vue`: Stmts 28% → **59.37%**, Branches → 28.12%, Funcs → 27.77%. Uncovered: lines 55-73/75-85 (dialog template render-functions — VDialog stubbed in unit-tests so template branches don't execute).
+- `TwoFactorCard.vue`: Stmts 28% → **71.42%**, Branches → 37.14%, Funcs → 30.3%. Uncovered: lines 149-199 (setup wizard dialog templates).
+- `router/index.ts`: Stmts 33% → **46.15%**, Branches → **100%** (all guard branches), Funcs → 22.22%. Funcs denominator inflated by 24+ lazy-import factories `() => import('...')` not executed in jsdom (tests stop at guard layer без mount view-components).
+
+**Honest assessment:** Commit messages of Tasks 2/3/4 claimed «70%+ / 80%+ / 85% Funcs» — overstated. Real headline должно было быть «Stmts +31/+43/+13 pp; Branches reached 100% (router); guard logic exercised end-to-end across 4 new paths». Coverage gain meaningful but smaller than projected. Sub-A (api/* 43 tests via vi.mock client → Task 2 prior session) — covered separately в commit `95f5f94` 12.05.2026 night.
+
+**Total Vitest baseline post-closure:** 88 files / 683 passed / 3 skipped / 0 failed. Coverage all files: Stmts 78.67% / Branches 76.21% / Funcs 70.56% / Lines 80.89%.
+
+**Future polishing (not in scope here):**
+
+- Factory extraction `tests/Frontend/helpers/auth-factory.ts` to dedupe AuthUser literal across 3 specs (Tasks 2-3 + router test).
+- Test order pin (`describe.sequential`) or refactor to be order-independent for router tests (current code relies on `authInitialized` flag persistence + `beforeEach createPinia` reset coordinated).
+- Dialog content integration tests via `stubs: { VDialog: false }` + Vuetify portal teleport handling → would push RecoveryCodes/TwoFactor coverage closer to 90%.
+
+---
 
 **✅ CLOSED 12.05.2026 ночь (post-audit continuation) — sub-A api/* tests:**User chose (A) api/* unit tests first (highest ROI). Created 5 new spec files (43 new tests):