S16-S24: Remaining-Work plan, thesaurus occurrences, deploy docs

VARIABLES.md, MODULE writer, catalog review covers subjects.json,
deploy rsyncs system HTML/PDF and SM docs.

Remaining-Work.MD

@@ -0,0 +1,102 @@
+# Remaining-Work — complete plan (S16+)
+
+**Instruction:** Execute this file without operator interruption until every
+checkbox is done, revalidated, and deployed to ns1 when tests pass. Do not
+ask the operator questions. Record guesses in `TODO-With-User.MD`.
+
+This is **not** a HIPAA / SOC 2 / ISO certificate.
+
+S00–S15 are closed (see `TODO.md`). This round is **S16–S24**: per-repo
+module docs, real NATS success/failure/logging, UI screenshots +
+walkthroughs, thesaurus with code/doc occurrences, HTML+LaTeX for the
+system and each module, CI/CD green, Go processes running on ns1.
+
+## Scope (in) vs out
+
+**In (code + docs + tests + CI + ns1):**
+
+| Repo | Why |
+|---|---|
+| system-git-sync | Hub, gate, thesaurus, remaining-work, deploy |
+| nats-service-endpoints | Canonical from/to/filter/timeout catalog |
+| secure-messaging | Python spec + Go sm-leaf routes |
+| peergos-for-compliance | subjects.json, lib, tests |
+| peergos-for-compliance-admin | Console UI + signed config |
+| peergos-for-compliance-ipfs | pin HTTP/NATS |
+| peergos-for-compliance-replication | Python repl (lab); live is Go |
+| peergos-compliance-go | pfc-repl, configd, leaf |
+| peergos-compliance-docs | System HTML/PDF + screenshots |
+| peergos-compliance-architecture | Architecture notes |
+| peergos-compliance-config | Config TUI + SPA |
+
+**Out (inventory only, do not rewrite):** `websites` org, `verae` org
+(empty), AdamsMotor / research trees unrelated to NATS, 70 marketing sites.
+
+## Per-repo then system-wide
+
+1. Fix **each repo** in isolation: LICENSE, README (who calls it, messages
+   in/out, filters, errors, timeouts, variables), tests, CI.
+2. Then **system pass**: catalog = subjects.json, thesaurus occurrences,
+   Sphinx HTML+LaTeX, UI walkthrough screenshots, NATS live smoke on ns1,
+   `cicd/run-review.sh`, promote, `deploy-ns1.sh`.
+
+## Checkboxes
+
+- [x] **S16** Document this plan in Historical-Information + TODO.md
+- [x] **S17** `secure-messaging` router: success path, reject path, dead
+      letter, Network Error Bundle, `verae.sm.log.summary` (no ciphertext
+      in logs). Tests for correct and incorrect targeted messages.
+- [x] **S18** Go `sm-leaf` implements the same reject/accept policy; Go
+      tests; linux rebuild; process running on ns1.
+- [x] **S19** Expand `nats-service-endpoints` to every `subjects.json`
+      name with from/to/in/out/encryption/reject/dead/timeout.
+- [x] **S20** MODULE.md (callers, data store, walkthrough links) + LICENSE
+      on every in-scope repo; README vocabulary matches thesaurus.
+- [x] **S21** Thesaurus rebuilt with **file:line occurrences** in docs and
+      code. Certify no banned phrases in in-scope trees.
+- [x] **S22** UI: Playwright screenshots of login, TOTP, cubes, catalog,
+      users, inspect, audit, catalog-card dialog, config SPA. Walkthrough
+      RST with capabilities / steps / why / outcomes / storage.
+- [x] **S23** Rebuild HTML + LaTeX PDF for system docs, nats catalog,
+      secure-messaging, hub. Rsync to docs.pfc.
+- [x] **S24** CI (`run-review.sh` + Forgejo workflows) includes route tests
+      + catalog completeness. Promote SHA. Deploy. Live NATS smoke on ns1.
+      Revalidate health, signed config, docs, screenshots published.
+
+## Variables (must be named and set or explicitly defaulted)
+
+See `docs/VARIABLES.md`. Live ns1 lab:
+
+- `crypto.mode=lab-xor` (signed wrapper)
+- `routing.mode=passthrough`
+- `logging.mode=summary`
+- `PFC_REQUIRE_NPE` unset
+- `PFC_REQUIRE_AUTH=1`
+- `NATS_URL=nats://10.10.10.21:4222`
+- `SM_LEAF_HUB=nats://10.10.10.21:7422`
+- `SM_HTTP=127.0.0.1:18783`
+- `PFC_REPL_URL=http://127.0.0.1:18784`
+- `PFC_SIGNED_CONFIG` / `PFC_CONFIG_KEY_PEM` on host only
+
+## NATS route test matrix (must all pass)
+
+| Case | Subject | Expect |
+|---|---|---|
+| Good passthrough | `verae.sm.send` with `to` + `ct` | `accepted=true`, `lookup_id` |
+| Missing dest | `verae.sm.send` no `to` | `accepted=false`, `SM-MISSING-TO`, dead + error + summary |
+| Empty ciphertext | `alg=lab-xor` `ct=""` | `SM-EMPTY-CT`, failure path |
+| Summary never has `ct` | `verae.sm.log.summary` | header codes only |
+| Health | `GET /health` sm-leaf and pfc-repl | 200 |
+
+## UI screens to capture
+
+login, totp-enroll, cubes, catalog, users, inspect, audit, catalog-card
+dialog, config SPA (`config.pfc` or local `web/index.html`).
+
+## Do not
+
+- Enable `PFC_REQUIRE_NPE=1` on live pfc
+- Replace `pfc-py-admin` with Go `pfc-admin`
+- Commit private keys
+- Rewrite website org
+- Claim HIPAA/SOC2/ISO certified