audit-hygiene: confirm whether IMPORTANT #6 (TS↔Python literal drift) was a phantom finding

[aksOps]

Summary

PR #41 credits closing IMPORTANT #6 — TS↔Python literal drift (Codex audit finding). The code-reviewer's independent verification found that web/src/api/types.ts and src/runtime/state.py literals already matched before this PR:

• `Session.status`: `duplicate` was in both files; `matched` was in neither
• `ToolCall.status`: `auto_rejected` was in neither

If accurate, this means:

1. Codex's original audit may have been wrong (false positive)
2. OR a pre-PR commit fixed it without crediting the audit

Either way the parity test (`tests/test_type_literal_parity.py`) is still useful as a forward-looking ratchet — it will catch future drift.

Action

1. Open `web/src/api/types.ts` and `src/runtime/state.py` at `v2.0.0-rc2` (commit `2efde89`), confirm whether literals diverged at that point.
2. If they did NOT diverge — note in the rc3 commit log or docs/REACT_UI_PARITY.md that I#6 was a phantom finding; the parity test stays as a safety rail.
3. If they DID diverge — discover which earlier commit fixed it, update the audit log with the corrected provenance.

Why this matters

A phantom finding in an audit reduces signal quality of future audit runs. Worth confirming so the next rescue pass doesn't repeat the same mistake. Pure documentation work — no code changes needed.

References

• PR feat: v2.0.0-rc3 — fix audit findings (finalizer, state_overrides, idempotency + 6 important) #41 review (independent code-reviewer agent verification)
• rc3 tag: v2.0.0-rc3 @ 8be7ea2