docs: record HTTP deadline follow-up

docs/superpowers/plans/2026-08-01-http-worker-adapter-remediation.md

@@ -33,11 +33,15 @@
 - Modify: `tests/features/reference-feature/reference-contract.test.ts`
 - Modify: `tests/runtime-schema/http-schema.test.ts`
 - Modify: `tests/integration/http-execution-contract.test.ts`
+- Modify: `tests/unit/http-execution-v3.test.ts`
 
 - [ ] Add parity tests showing method/path/validators/retry/effect/deadline/byte bounds come from one contribution; `createdAt` accepts omitted or RFC3339 datetime and rejects arbitrary strings.
 - [ ] Run focused tests and confirm RED on duplicated descriptors and permissive date schema.
 - [ ] Make the installed contribution authoritative; generate temporary legacy views from it and migrate all production callers before deleting the legacy registries/codecs.
 - [ ] Apply `REQUEST_TIMEOUT_MS` as `min(runtimeCeiling, descriptorDeadline)` without replacing shorter descriptor deadlines.
+- [ ] Keep the deadline authoritative through response admission and body reads: a deadline-owned abort after headers must still return `TRANSPORT_FAILURE / TIMEOUT`, perform one attempt, and never enter retry sleep instead of being masked as `RESPONSE_STREAM_FAILURE`.
+- [ ] Treat credential resolution as a credential-only patch boundary: reject attempts to inject or overwrite `Idempotency-Key` (including case variants) or transport/query authority, and cover hostile patches in the executor regression table.
+- [ ] Prove diagnostic privacy against the full runtime seam with non-empty identity references; assertions over an empty diagnostic projection do not count as evidence that intent/key/query identity is absent.
 - [ ] Re-run focused tests, prove `rg` has zero production callers of removed registries, and commit with `git commit -m "refactor: consolidate installed HTTP contracts"`.
 
 ### Task 2: Provider-neutral typed operation outcomes