docs(grpc): record the Playwright result and root-cause both failures

Phase 0's gate doc now carries the full suite picture, not just the rig checks.

Playwright: 170 pass / 2 fail / 1 skip of 173. Both failures were run down to
root cause and both are pre-existing on main, unrelated to this branch (which
touches no EF, CentralUI, Transport or ManagementService file):

- TransportImportTests is a REAL production bug: BundleImporter.cs:1298 opens a
  user-initiated transaction while the central context has EnableRetryOnFailure,
  so SqlServerRetryingExecutionStrategy refuses the split query inside it and
  bundle import fails against real MS SQL. The unit/integration suite cannot see
  it -- the in-memory EF provider has no retrying strategy and BeginTransaction
  is a no-op there.

- SmsNotificationE2ETests is a stale fixture: SID 'ACtest123' (2026-06-19) vs the
  ^AC[0-9a-fA-F]{32}$ guard added 2026-07-10 (40088a21). Failing since then, which
  has also silenced everything after the toast assertion -- including the
  secret-non-leak check on the Auth Token.

Also records that the earlier 44-failure run is void: a concurrent deploy.sh was
recreating the cluster underneath it.

Neither is fixed here; both are out of scope for a PSK-auth branch.

docs/plans/2026-07-22-clusterclient-to-grpc-live-gate.md

@@ -89,6 +89,51 @@ registers exactly as `Program.cs` does (by type, not in DI); and a reflection as
 a DI-activated component must mirror the production registration shape or it proves less than
 it appears to.
 
+### Test suite alongside the gate
+
+Non-Playwright: **29 suites, 6,872 tests, 0 failures**.
+
+Playwright (against this rig): **170 passed, 2 failed, 1 skipped** of 173. Both failures were
+run down to root cause and **both are pre-existing on `main`, unrelated to Phase 0** — this
+branch touches no EF, CentralUI, Transport or ManagementService file (`git diff --stat
+main...HEAD -- src/` is 15 files, all Communication/Host/AuditLog gRPC plumbing).
+
+An earlier run of this suite reported 44 failures. That run is **void**: a `docker/deploy.sh`
+was recreating the cluster underneath it, so the fast `LoginTests`/`NavigationTests` failures
+were "app unreachable", not defects.
+
+**1. `TransportImportTests.ImportSyntheticBundle_AppliesAndShowsAuditDrillIn` — a real
+production bug, not a test defect.** Central's log during the failure:
+
+```
+[ERR] An exception occurred while iterating over the results of a query ...
+System.InvalidOperationException: The configured execution strategy
+'SqlServerRetryingExecutionStrategy' does not support user-initiated transactions.
+  at Microsoft.EntityFrameworkCore.Query.Internal.SplitQueryingEnumerable`1.AsyncEnumerator.MoveNextAsync()
+```
+
+`BundleImporter.cs:1298` opens a user-initiated transaction; the central context is configured
+with `EnableRetryOnFailure` (`ConfigurationDatabase/ServiceCollectionExtensions.cs:33`). SQL
+Server's retrying strategy refuses to run a split query inside a caller's transaction, so
+**bundle import fails against real MS SQL**. The fix is the one the exception names: wrap the
+transaction in `Database.CreateExecutionStrategy().ExecuteAsync(...)`.
+
+Why the whole unit/integration suite is green on it: those tests use the in-memory EF provider,
+which has no retrying execution strategy — and `BeginTransactionAsync` is a no-op there. The
+comment directly above line 1298 documents that divergence without drawing the conclusion. Only
+a rig-backed test can see this.
+
+**2. `SmsNotificationE2ETests.SmsConfigPage_CreateOrRender_NeverLeaksAuthToken` — a stale test
+fixture.** No server-side error at all: the page renders 200, and no `INSERT INTO
+SmsConfigurations` is ever issued. The test's fixture SID is `ACtest123` (`d6ead8ae`,
+2026-06-19). `SmsConfiguration.razor:231` rejects anything not matching `^AC[0-9a-fA-F]{32}$`,
+added by `40088a21` (2026-07-10) to close an un-escaped URI-interpolation hole. `Save()` sets
+`_formError` and returns — no toast, exactly as observed. The fixture was never updated.
+
+This has been failing since 2026-07-10, and it matters more than a red line: everything after
+the toast assertion — including **the secret-non-leak assertion that the Auth Token value never
+reaches the page HTML** — has not executed since. Fix is a valid 32-hex SID in the fixture.
+
 ### Not covered by this gate
 
 - Streaming subscriptions were exercised in-process (TestServer), not over the rig. The

docs/plans/2026-07-22-clusterclient-to-grpc-plan.md.tasks.json

@@ -81,7 +81,7 @@
         "T0.3",
         "T0.4"
       ],
-      "notes": "Live gate PASS 2026-07-22 (docs/plans/2026-07-22-clusterclient-to-grpc-live-gate.md). Suite: 29 non-Playwright suites / 6872 tests / 0 failures; Host.Tests 366. Playwright re-run against the stable rig was still in flight at compaction \u2014 the earlier 44 failures were contaminated by a concurrent rig rebuild and are VOID. REMAINING: confirm Playwright, then PR + merge (held for the user per the plan's stop-at-DoD rule)."
+      "notes": "Live gate PASS 2026-07-22 (all 7 checks, docs/plans/2026-07-22-clusterclient-to-grpc-live-gate.md). Suite: 29 non-Playwright suites / 6872 tests / 0 failures. Playwright 170 pass / 2 fail / 1 skip of 173 - BOTH failures root-caused and PRE-EXISTING on main, unrelated to Phase 0 (branch touches no EF/CentralUI/Transport/ManagementService file): (1) TransportImportTests - REAL production bug, BundleImporter.cs:1298 user-initiated transaction + EnableRetryOnFailure => import broken on real MS SQL, hidden by the in-memory EF provider; (2) SmsNotificationE2ETests - stale fixture SID 'ACtest123' vs the ^AC[0-9a-fA-F]{32}$ guard added 2026-07-10 (40088a21); failing since then, which also silences its secret-non-leak assertion. The earlier 44-failure run is VOID (concurrent rig rebuild). REMAINING: PR + merge, HELD for the user per the plan's stop-at-DoD rule."
     },
     {
       "id": "T1A.1",
@@ -238,4 +238,4 @@
       ]
     }
   ]
-}
+}