docs(qa): FOLLOW-UPS records the subpath repair that landed, not a pending choice (#16909)

`docs/qa/platform-checklist/FOLLOW-UPS.md` § 7a stated in the present tense that
`PHASE2_IMPLEMENTATION.md` sections 4 and 5 "still tell readers to `import … from
'@objectstack/core/security'`", and that the choice between the two available repairs
was "Deliberately left ... not a lane's call".

Measured on `origin/main`: that specifier occurs 0 times in
`packages/core/PHASE2_IMPLEMENTATION.md` (firing control in the same run:
`@objectstack/core` occurs 7 times in the same file), and both section 4 and section 5
now import from the root barrel. PR #16205 (commit e270ebb) repointed them.

So both halves were stale: the residue is gone, and the choice was made — the repair
taken is the one that does NOT widen the published contract, which is the fact a
tracking ledger owes its next reader. `packages/core/package.json` still declares
exactly `.` and `./logger`, re-measured here. The "filed separately" half stays and now
names its filing, #15931.


Claude-Session: https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-musk

docs/qa/platform-checklist/FOLLOW-UPS.md

@@ -194,12 +194,16 @@ director summon #14, decision batch #42): the class, its barrel export, its
 advertised it are gone, and that section now states plainly that plugin security scanning
 is not a platform capability. Repair was refused by name. Do not re-derive it.
 
-**What SURVIVES that removal, in the same document.** `PHASE2_IMPLEMENTATION.md` sections
-4 and 5 still tell readers to `import … from '@objectstack/core/security'` — a subpath
-`packages/core/package.json` declares in no `exports` entry, so it resolves for no
-consumer of the published package. Deliberately left: the two repairs (declare the
-subpath, or repoint both sections at the root barrel) differ in whether they widen the
-published contract, which is not a lane's call. Filed separately.
+**What SURVIVED that removal in the same document, and how it was closed.**
+`PHASE2_IMPLEMENTATION.md` sections 4 and 5 used to tell readers to `import … from
+'@objectstack/core/security'` — a subpath `packages/core/package.json` declares in no
+`exports` entry, so it resolved for no consumer of the published package. Filed
+separately as #15931 and repaired in **PR #16205**: both lines now name
+`@objectstack/core`, the root barrel that already carried both classes outward through
+`export * from './security/index.js'`. Of the two repairs this row had left open —
+declare the subpath, or repoint both sections at the root barrel — the one that does
+**not** widen the published contract was taken, so `packages/core/package.json` still
+declares exactly `.` and `./logger`. Do not re-derive the subpath.
 
 ### 7b. Docs drift (PD#10 class — file as docs fixes, not checklist items)