chore(autoresearch): log iter 18

.auto/results.tsv

@@ -16,3 +16,4 @@ iteration	commit	metric	delta	status	guard	description
 15	2c41563	79	0.0	keep	pass	PERF: CORS origin check no longer hits DB per request (5s cached read); proven - loader count 0 vs 1 on revert
 16	976f9b1	79	0.0	keep	pass	PERF: contract-level batch user lookup replaces N+1 in access-log enrichment (test proves 1 query vs 3)
 17	1b1c452	79	0.0	keep	pass	BUGFIX: orphan cron message_gateway:cleanup_pairing_codes now has a handler; invariant test added (proven by stash-revert)
+18	8c4955c	79	0.0	keep	pass	BUGFIX: removed phantom user:daily_audit cron (dispatched to unregistered task); cross-plugin invariant test added

docs/superpowers/plans/2026-08-29-cordis-config-extension.md

@@ -2145,11 +2145,38 @@ import (
 	"time"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/spf13/viper"
 
 	"Wavelet/core/extpoints"
-	"Wavelet/plugins/infra/config"
 )
 
+// yamlSource is a test-local core.ConfigSource over the repository config file.
+// It deliberately does not import plugins/infra/config: backend/pkg must not depend on
+// upper layers even in tests, and the adapter has its own coverage in its package tests.
+type yamlSource struct {
+	v *viper.Viper
+}
+
+func newYAMLSource(t *testing.T, path string) *yamlSource {
+	t.Helper()
+
+	v := viper.New()
+	v.SetConfigFile(path)
+	require.NoError(t, v.ReadInConfig())
+	return &yamlSource{v: v}
+}
+
+func (s *yamlSource) Lookup(path string) (any, bool) {
+	if !s.v.IsSet(path) {
+		return nil, false
+	}
+	return s.v.Get(path), true
+}
+
+func (s *yamlSource) LookupEnv(name string) (string, bool) { return os.LookupEnv(name) }
+
+func (s *yamlSource) Describe() string { return s.v.ConfigFileUsed() }
+
 // engineAppConfig mirrors appConfig with engine tags.
 type engineAppConfig struct {
 	AppName                 string `config:"app_name" env:"APP_NAME"`