docs: align release and recovery guidance

docs/TEST_MATRIX.md

@@ -1,8 +1,33 @@
 # Test matrix
 
-## Automated in v0.4.0
+## Automated baseline (0.10.x)
 
-The suite contains 59 passing tests.
+The quality chain contains 159 automated tests. The latest Windows run completed
+with 158 passing tests, no failures and one Bash-dependent skip. `npm run
+coverage` enforces 55% lines/statements/functions and 45% branches; the measured
+baseline is 68.06% statements/lines, 67.75% functions and 50.27% branches.
+
+`npm run quality` is the local equivalent of `.gitea/workflows/quality.yml` and
+runs source verification, ESLint, the complete suite and coverage on Node 22 LTS.
+Production dependencies are separately checked with `npm audit --omit=dev
+--audit-level=high`.
+
+### Server safety and reconciliation
+
+- inventory discovery is read-only and byte-stable for configuration;
+- reconciliation requires a content-addressed preview plan and recovery snapshot;
+- automatic linking requires unique exact provenance/runtime identity;
+- server-pull verification checks Gitea branch, read-only deploy-key ID, pinned
+  host/key fingerprints, remote/live SHA, Compose evidence, runtime and health;
+- a fresh access verification is mandatory immediately before server-pull deploy;
+- writable or missing deploy keys fail closed.
+
+### Renderer regression matrix
+
+The dark demo was verified at 1120×720, 1440×900 and 1920×1080. Automated DOM
+checks cover literal invalid values, unnamed buttons, unlinked field labels,
+horizontal overflow and modal/palette viewport overflow. Motion-safe illustration
+contracts and reduced-motion CSS are source-tested.
 
 ### Git and repository behavior