docs: record production readiness evidence

docs/TEST_MATRIX.md

@@ -2,10 +2,12 @@
 
 ## Automated baseline (0.10.x)
 
-The quality chain contains 159 automated tests. The latest Windows run completed
-with 158 passing tests, no failures and one Bash-dependent skip. `npm run
-coverage` enforces 55% lines/statements/functions and 45% branches; the measured
-baseline is 68.06% statements/lines, 67.75% functions and 50.27% branches.
+The quality chain contains more than 230 Node and browser acceptance cases. The
+latest Windows source run completed without failures and retains one explicitly
+Bash-dependent skip. `npm run coverage` enforces 75% lines/statements/functions
+and 60% branches; the measured hardening baseline is 78.75% statements/lines,
+79.68% functions and 59.25% branches before the final ConfigStore additions.
+See `COVERAGE_POLICY.md` for the non-gamed branch policy.
 
 `npm run quality` is the local equivalent of `.gitea/workflows/quality.yml` and
 runs source verification, ESLint, the complete suite and coverage on Node 22 LTS.
@@ -24,10 +26,12 @@ Production dependencies are separately checked with `npm audit --omit=dev
 
 ### Renderer regression matrix
 
-The dark demo was verified at 1120×720, 1440×900 and 1920×1080. Automated DOM
-checks cover literal invalid values, unnamed buttons, unlinked field labels,
-horizontal overflow and modal/palette viewport overflow. Motion-safe illustration
-contracts and reduced-motion CSS are source-tested.
+Playwright runs 36 cases across 1120×720, 1440×900 and 1920×1080, dark and
+light themes, reduced motion, and simulated 100%, 125% and 150% Windows scaling.
+It checks console/page errors, accessible names, labels, heading structure,
+horizontal overflow, viewport containment, dialogs, keyboard focus, updater and
+deployment failure evidence. CI retains screenshots, video, trace, console JSON,
+DOM HTML and fixture context on failure.
 
 ### Git and repository behavior
 
@@ -101,7 +105,8 @@ contracts and reduced-motion CSS are source-tested.
 - status endpoint through the real reverse proxy;
 - deployment lock, failed healthcheck and rollback;
 - diagnostic ZIP inspection after a deliberately failed deployment;
-- unsigned installer and portable build on Windows;
+- locally test-signed installer, portable, helper and uninstaller fixtures with
+  RFC 3161 timestamp plus wrong-publisher, missing-timestamp and tamper rejection;
 - keyboard-only and screen-reader smoke test.
 
 ## Renderer smoke target