docs(delivery-audit): mark off-hardware solo work complete (35/43)

Records the pass that closed P4-5/6/7/8, P5-3/4, P2-9/10/11 and documents
why the remaining 8 are not solo-doable (data-model decisions: P1-9,
P3-2b; on-hardware safety-timing validation: P2-6/7/8).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019Xmn8KZWqiQUguEMRtn6rW

docs/delivery-audit.md

@@ -247,6 +247,19 @@ misconfig/degradation fail LOUD.
 
 (updated as each item lands — newest first)
 
+- **2026-07-17 — off-hardware solo work COMPLETE (35/43).** Landed this pass, each test-locked:
+  P4-8 (login CSRF), P4-6 (zone 400-not-500), P4-5 (cursor pagination), P4-7 (snapshot atomicity
+  + orphan cleanup), P5-3 (HEF in the offline bundle + fixed the broken build), P5-4 (pin + hash +
+  SBOM + install-time verify), P2-9/10/11 (keypoint confidence gating + MoveNet single-person
+  warning). phpunit 90, pytest 157 — all green.
+  REMAINING 8, none solo-doable:
+  · P1-9, P3-2b — need a DATA-MODEL decision (event dedup key + schema column; site↔device model).
+  · P2-6, P2-7, P2-8 — safety-timing / tracking-match logic that must be validated ON HARDWARE.
+    Changing them blind could make fall detection MISS events (worse than today's over-alarm,
+    which is fail-safe), so they are deliberately deferred to on-device commissioning.
+  · (P2 threshold notes: motion_thr and the sustained-prone/staleness windows are commissioning
+    knobs — tune with real camera footage on the Pi.)
+
 - **2026-07-17 — P4-6 + P4-8 landed (cloud error/auth hardening).** ZoneConfig ownership-mismatch
   now 400 not 500 (P4-6); login CSRF token now verified — closes login-CSRF/session-fixation
   (P4-8). phpunit 88 green (4 skipped: PDO). Remaining solo: P4-5 (pagination), P4-7 (atomic