Witness/MSS surface not covered by the remediation audit

A broad audit of the witness and multi-server work was run as part of the remediation tracked in #141. It covered roughly half the surface and found no defects beyond those already known. This issue records what it did not reach, so the gap survives the campaign rather than being implied away by a coverage percentage.

## Fully read

`rs/cyphr-server/tests/witness_mode.rs`, `tests/registration.rs`, `tests/cross_witness.rs`, `tests/common/multi.rs`, and the sources `fanout.rs`, `lib.rs`, `routes.rs`.

## Sampled only

`tests/attestation_source.rs`, `tests/rate_limits.rs`, `tests/admission.rs`, `tests/invariants.rs`, `tests/login.rs`, and the sources `registration.rs`, `consistency.rs`, `sync.rs`, `config.rs`.

Sampling means representative sections were read, not the whole file. These should not be treated as audited.

## Never opened

Tests: `tests/common/mod.rs`, `tests/keyless_matrix.rs`, `tests/naked_revoke.rs`, `tests/pow_admission.rs`.

Sources: `src/admission.rs`, `src/auth/login.rs`, `src/error.rs`, `src/rate_limit.rs`, `rs/cyphr-storage/src/engine/mod.rs`.

## What the audit was looking for

One defect shape, repeated across the original work: a test whose name asserts a broad invariant while its body exercises only the narrow input shape the implementation happens to handle. The sharpest instances are assertions that are structurally incapable of failing — one indexes a JSON field that does not exist on the response type, so it reduces to comparing null against a string and passes under every possible implementation.

Anyone continuing this should hunt that shape, plus its relatives: a test that verifies a local copy of the logic rather than the function under test, a test whose expected value is produced by the same code path it checks, and a claim exercised only at the degenerate case — a pairwise scan tested with two elements, where one pair is all that exists.

## Worth knowing before continuing

`tests/common/multi.rs` was fully read and its isolation and socket-binding guarantees hold. That matters because every other test's credibility rests on it; a defect there would silently weaken results across the whole suite. It is not a defect source, so effort is better spent elsewhere.

## Also unresolved: fanout delivery is unverified by execution

Push-on-mutation fanout appears to fail by construction. Fanout POSTs to a registered witness, witness-mode middleware refuses every POST before consulting the fanout headers, so delivery returns 403 and the delivered branch is unreachable — meaning delivery status reports universal failure by design, and an operator cannot distinguish a genuinely unreachable witness from one behaving correctly.

This was established by reading the code path, not by running it, and should be confirmed empirically before anyone designs against it. The remedy is out of scope here: push delivery is the intended model, so the fix is an authenticated exemption to witness write-refusal, which is entangled with the gossip section under revision.

Related: #141, #139, #140.

Start with the never-opened tests and sources listed in the issue, then compare their test names, assertions, and inputs with the stated broad invariants. Run the relevant witness and fanout paths, including delivery behavior, and audit the sampled files fully; done means recording concrete coverage or test-validity findings and confirming whether fanout delivery is reachable.

Written by the indexing model from the issue text.