Merge main into feature/vulnerability-visibility

Keeps both ADR index rows (0026 from #3 and 0027 from this branch).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/00-vision-and-scope.md

@@ -110,8 +110,7 @@ mandatory; `SHOULD` is strongly preferred and requires an ADR to deviate.
 ### TLS & certificates — `R-TLS-*`
 - **R-TLS-01** — Every externally reachable service MUST present TLS from a **credible, trusted,
   non-self-signed** authority.
-- **R-TLS-02** — Certificates MUST be automatically **issued, renewed, and revoked** without manual
-  steps.
+- **R-TLS-02** — Certificates MUST be automatically **issued and renewed** without manual steps.
 - **R-TLS-03** — Certificate issuance MUST work for internal-only services (no requirement to expose
   a service publicly just to validate a certificate).
 
@@ -206,7 +205,9 @@ mandatory; `SHOULD` is strongly preferred and requires an ADR to deviate.
   any conforming cluster, producing machine-readable, requirement-tagged results.
 - **R-TEST-03** — A **conformance suite** MUST gate delivery: merges are blocked unless the tests
   for the touched requirements pass, and phase exits are blocked unless the phase's full suite
-  passes. "Demonstrated" means "the automated test passes," never a manual one-off.
+  passes. "Demonstrated" means "the automated test passes," never a manual one-off. Fault-injection
+  tests (R-TEST-05) are not automated: the operator runs them deliberately and records the result,
+  and they do not gate individual merges (ADR-0026).
 - **R-TEST-04** — Tests MUST be **traceable**: each test declares the requirement ID(s) it verifies,
   and a coverage report maps every `R-*` requirement to its verifying test(s). Uncovered
   requirements are a gap to close, not an acceptable state.