Consolidates all three rounds of the test-quality audit into one
file: \`docs/rfcs/test-quality-audit.md\` (906 lines, +334 from
Round 2's 572-line baseline).

## Round 3 scope (subagent-driven)

Files audited (21 total):

**Host-agent (all 19 inline test modules)**: error.rs, audit.rs,
metrics.rs, rate_limit.rs, perm_warn.rs, config.rs, auth/{adapter,
identity}.rs, adapters/{exec,systemd,registry,pct,git,zfs}.rs,
zfs/mod.rs, approval/{signal,identity_plugin,token,mod}.rs.

**Zeroclawed priority files**: config.rs (18 tests), context.rs
(19 tests).

**Files NOT audited (in-scope but past the 25-min time cap)**:
\`commands.rs\` (44 tests, 2158 LOC), \`install/ssh.rs\`,
\`install/cli.rs\`, \`install/executor.rs\`, \`adapters/cli.rs\`.
Documented in the round's scope-coverage summary so the next pass
can pick up cleanly.

## Top findings worth escalating

1. **Real-looking 64-hex API token in \`config.rs\` SAMPLE_CONFIG**
   (lines 807, 923) — \`zc_4f5c220eec86…\`. Round 2 sanitized the
   Telegram IDs in this file but missed the token. **Filed as
   separate fix in security/sanitize-config-rs-secrets branch (PR
   #36).**
2. **\`adapters/exec.rs\` has zero tests on the privileged
   validate/execute decision tree** — the largest single coverage
   gap in host-agent. Stdlib-tautology tests only.
3. **\`auth/adapter.rs\` tests fictional types** that contradict
   production policy (test-local says "Full autonomy never requires
   approval"; production at \`config.rs:447\` says "Full autonomy
   CANNOT bypass \`always_ask\`"). Tests are passing while
   describing wrong behavior.
4. **\`approval/mod.rs\` has only the negative path tested** — the
   full create→Signal-confirm→consume happy path, token-replay
   rejection, expiration, target-mismatch, and not-yet-approved
   branches are all uncovered. Largest authorization-flow gap in
   the crate.
5. **\`approval/identity_plugin.rs:203\`
   \`test_relative_path_rejected\`** tests \`str::starts_with\`,
   not the actual guard. Comment admits it.
6. **\`error.rs\` IntoResponse mapping** is unfenced — both tests
   are \`let _ = err.into_response()\` non-panic checks.
7. **\`context.rs\` is a positive example** — 19 uniformly
   behavioral, multi-assertion, edge-case tests. Recommended as
   the reference pattern for the codebase's other test modules.

## Why a separate branch

Lands the docs separately from any code changes so the audit
findings ship without waiting on the consolidation refactor (PR #17)
or the ongoing FnoxClient/MCP work to merge. PR #17's commit
\`b2614c9a\` introduces the file with Rounds 1+2 — when both branches
land, the merge is straightforward (this branch's content
strictly extends).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>