Document architectural debt and test coverage gaps in ISSUES.md

Added 6 architectural/cleanup items (A1-A6):
- Legacy MizanProvider not yet removed
- Allauth pending extraction to own package
- Forms codegen not adapted to kernel
- Vue/Svelte adapters not validated end-to-end
- ROADMAP.md and CLAUDE.md likely stale

Added 12 test coverage gaps (T1-T12):
- No tests for C6 kernel state machine
- No tests for generated Vue/Svelte output
- No tests verifying recent fixes (C3/C4/C5/C7/H3/H10/H11/H13)
- No end-to-end integration test

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ISSUES.md

@@ -98,3 +98,76 @@ Should import from `'../index'` consistently.
 
 ### M17. Side effects in React state updater
 Context listeners called inside `setContextStore()` updater.
+
+## Architectural / Cleanup Debt
+
+### A1. Legacy MizanProvider not yet removed
+**File:** `mizan-react/src/context.tsx` (~750 lines)
+Superseded by the kernel (`mizan-runtime`) + generated React adapter (`useSyncExternalStore`). Still exported as `MizanProvider`, `useMizan`, `useMizanContext`, etc. Must be deleted or replaced with thin shims that call `configure()` + delegate to the new generated hooks.
+
+### A2. Allauth pending extraction
+**File:** `legacy/allauth/` (44 files)
+Sitting in `legacy/` since the cleanup pass. Should become its own `mizan-django-allauth` package consuming Mizan's public API. Unblocks v1 mizan-react publishing.
+
+### A3. Forms codegen not adapted to kernel
+**File:** `mizan-react/src/forms.ts` (~1163 lines)
+Still uses `useMizan().call()` from the legacy MizanProvider. Needs rewrite to use `mizanCall` from the kernel. Currently the only consumer of MizanProvider — blocks A1.
+
+### A4. Codegen for Vue/Svelte not validated end-to-end
+The Stage 2 templates produce code that compiles, but no example app exercises Vue or Svelte rendering against a live backend. React is the only adapter with full integration verification.
+
+### A5. ROADMAP.md is stale
+**File:** `ROADMAP.md`
+Lists SSR Bridge, Edge Manifest, Codegen Rewrite, etc. as "Next" — all are done. Doesn't reflect:
+- Two-stage codegen with Vue/Svelte adapters
+- C6 kernel-owned state (`ContextState<T>`)
+- mizan-ts cross-language adapter
+- Cleanup of djarea/Django-specific naming
+
+### A6. CLAUDE.md may also be stale
+**File:** `CLAUDE.md`
+Written before the kernel rewrite. References to MizanProvider responsibilities and the old codegen pattern are likely outdated. Needs audit.
+
+## Test Coverage Gaps
+
+### T1. No tests for C6 kernel state machine
+**File:** `mizan-runtime/` has no `tests/` directory at all
+The state-owning kernel has zero unit tests. No coverage of:
+- `registerContext` returning `getState/subscribe/refetch/unregister`
+- Status transitions: idle → loading → success/error
+- Subscriber notifications on state change
+- Refetch reusing the same entry on Strict Mode re-mount
+- `unregister` clearing listeners
+
+### T2. No tests for generated Vue adapter output
+The `vue.mjs` template produces code, but no test verifies it generates valid Vue 3 composables, that `onServerPrefetch` is wired correctly, or that the kernel subscription bridges to Vue reactivity.
+
+### T3. No tests for generated Svelte adapter output
+Same as T2. Readable store factory pattern is unverified against actual Svelte components.
+
+### T4. No tests for view-path cache purge (C7 fix unverified)
+The fix added `_purge_cache_for_invalidation()` to the view-path branch, but no test asserts that an `HttpResponse`-returning mutation actually purges the origin cache.
+
+### T5. No tests for SSR thread safety (C4 fix unverified)
+The `_write_lock` was added but no concurrent-render test exists to prove it prevents JSON interleaving.
+
+### T6. No tests for SSR atexit cleanup (C5 fix unverified)
+`atexit.register(self.shutdown)` was added but not exercised — no test that asserts the Bun process is reaped on Python exit.
+
+### T7. No tests for SSR hydration injection (C3 fix unverified)
+The `<script>window.__MIZAN_SSR_DATA__=...</script>` was added to template output but no test asserts it appears in rendered HTML or that the JSON is valid/safe.
+
+### T8. No cross-language HMAC pin test for booleans/None (H11 fix unverified)
+Python now normalizes True→"true", but there's no test comparing Python's `derive_cache_key(secret, ctx, {flag: True})` against TypeScript's equivalent to prove they produce identical hex output.
+
+### T9. No tests for retry logic (H3)
+`fetchWithRetry` retries 5xx/network errors with backoff. No test for: 5xx triggers retry, 4xx does not, mutation calls bypass retry, max retries respected.
+
+### T10. No end-to-end integration test
+Nothing exercises the full pipeline: Django function defined → schema exported → codegen runs → generated React mounts → mutation fires → server response includes invalidate → kernel refetches → DOM updates. Each layer is tested in isolation.
+
+### T11. No tests for `isValid` requiring all required fields touched (H13 fix unverified)
+The forms fix checks `field.required && !touched` but no test exercises a form with untouched required fields to confirm `isValid === false`.
+
+### T12. No tests for `_meta` fresh-dict isolation (H10 fix unverified)
+The shared-dict fix replaced `{**FunctionWrapper._meta, **meta}` with `{**meta}`. No test confirms that mutating one function's `_meta` doesn't leak into others.