diff --git a/CLAUDE.md b/CLAUDE.md
index eea1d11..9162d56 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -69,7 +69,7 @@ Dispatch enforces a **registration gate**: only CAP/PASS/NICK/USER/QUIT/PONG run
 
 ## Testing
 
-Tests use Google Test but also feed every result into **PostMan** (`vendor/PostMan.cpp`), a styled Unicode-table reporter — `tests/test_main.cpp` bridges the two via a custom `TestEventListener`. `tests/Makefile` builds all of `src/` *except* `main.cpp` (linking `tier_full.cpp` as the one `registerExtensions` definition). Protocol-level suites share `tests/TestHarness.hpp` (TCP `TestClient` + `IrcServerTest` fixture; subclass and override `portBase()` per suite, `onServerReady()` to inject probe extensions). Test files: `test_message`, `test_client`, `test_channel`, `test_bot`, `test_integration`, `test_robustness`, `test_security`, `test_filetransfer`, `test_extensions`, `test_libcpp98`. ~149 tests (see PostMan table); PostMan's leak counter is atomic and `assertNoLeaks` takes `const char*` (a `std::string` argument would count itself as a leak — keep it that way).
+Tests use Google Test but also feed every result into **PostMan** (`vendor/PostMan.cpp`), a styled Unicode-table reporter — `tests/test_main.cpp` bridges the two via a custom `TestEventListener`. `tests/Makefile` builds all of `src/` *except* `main.cpp` (linking `tier_full.cpp` as the one `registerExtensions` definition). Protocol-level suites share `tests/TestHarness.hpp` (TCP `TestClient` + `IrcServerTest` fixture; subclass and override `portBase()` per suite, `onServerReady()` to inject probe extensions). Test files: `test_message`, `test_client`, `test_channel`, `test_bot`, `test_integration`, `test_robustness`, `test_security`, `test_filetransfer`, `test_extensions`, `test_libcpp98`. ~155 product tests (reported as 456 PostMan assertions — 301 of those are PostManTruncationRegression's own self-checks, not IRC coverage); PostMan's leak counter is atomic and `assertNoLeaks` takes `const char*` (a `std::string` argument would count itself as a leak — keep it that way).
 
 ## Known traps
 
@@ -199,4 +199,5 @@ Tests use Google Test but also feed every result into **PostMan** (`vendor/PostM
   there's no unconditional-rearm path to regress. The only external check
   would be a CPU-usage assertion: flaky, threshold-arbitrary, rejected. Don't
   add one; if you think idle-spin regressed, the bug would be in the
-  `_epollMask` sweep logic, testable directly — not via CPU sampling.
\ No newline at end of file
+  `_epollMask` sweep logic, testable directly — not via CPU sampling.
+- **Known conformance gaps (audited, not fixed)**: the 005 CHANMODES token classifies +l in the wrong group (it takes a param on set, so it belongs in group C, not D), and 004 RPL_MYINFO advertises 'o' as a user mode. Both are cosmetic — HexChat parses neither strictly — and were left as-is (see the A1 conformance audit). Don't "fix" them without checking the audit's rationale.
diff --git a/tests/COVERAGE.md b/tests/COVERAGE.md
index b9d149e..2861767 100644
--- a/tests/COVERAGE.md
+++ b/tests/COVERAGE.md
@@ -94,9 +94,7 @@ FancyLogSink, shrinking the surface an evaluator can question.
    (T3): the flush was removed, closing the last literal exception to
    "poll before every send" in the kernel. Accepted regression: 464 /
    welcome-burst no longer reach a client disconnected in the same tick
-   they were queued (see `CLAUDE.md` "Known traps"). Deferred-teardown
-   recovery (Option C) is tracked as future work (T4), out of this plan's
-   scope.
+   they were queued (see `CLAUDE.md` "Known traps"). Deferred-teardown recovery (Option C) — DONE (T4, merged): the 464 now reaches the client before close; "Server full" remains out of scope.
 
 **P1 — scored / high-value robustness:**
 3. ✅**Non-operator denial tests** (E) — the operator score is 0–5 and the sheet