docs: correct three claims the audit checked against the code

PressKey has 9 keys, not 8: escape was missing. Scroll has no durationMillis on
the authored side; the runtime entry supplies one. And decisions.md described a
marshal.go move that never happened as settled, and a runs.go split that is
done as pending.

docs/development/action-space.md

@@ -11,8 +11,8 @@ Inventory of user interaction primitives Sanderling currently supports, compared
 | `LongPress` | `on` (selector or element) | Press and hold; resolves to coordinates |
 | `InputText` | `into`, `text` | Type into focused field |
 | `Swipe` | `from`, `to`, `durationMillis?` | Point-to-point or element-to-element |
-| `Scroll` | `direction`, `in?`, `durationMillis?` | Scroll a container up, down, left, or right |
-| `PressKey` | `key` | back, home, enter, tab, up, down, left, right |
+| `Scroll` | `direction`, `in?` | Scroll a container up, down, left, or right |
+| `PressKey` | `key` | back, home, enter, tab, escape, up, down, left, right |
 | `Wait` | `durationMillis` | Sleep for N ms |
 
 ## Gaps vs Native Driver

docs/development/decisions.md

@@ -22,9 +22,9 @@ Go's `internal/` directory restriction prevents any code outside this module fro
 
 The `driver.go` file defines the `DeviceDriver` interface. Concrete implementations live in subdirectories: `sidecar/` (gRPC to the native sidecar), `chrome/` (CDP), `mock/` (tests). This pattern keeps the runner and verifier decoupled from any specific platform.
 
-### `internal/verifier/marshal.go` moves to `internal/replay/`
+### `internal/verifier/marshal.go` stays in `internal/verifier/`
 
-`marshal.go` serializes LTL formulas to JSON for the replay UI. That is a replay concern, not a verifier concern. Verifier should not know replay exists.
+This was recorded as a move to `internal/replay/` on the grounds that serializing LTL formulas for the replay UI is a replay concern. The move never happened, and the reason it should not is that `marshal.go` is now the single decoder both hosts read the action wire through, which is a verifier concern: splitting it would put the wire contract and the evaluator that depends on it in different packages.
 
 ### `internal/verifier/bindings.go` splits into `types.go` + `bindings.go`
 
@@ -46,7 +46,7 @@ Driver setup, agent connection, verifier init, trace setup, and runner orchestra
 
 ### `internal/replay/runs.go` splits into multiple files
 
-429 LOC with mixed concerns (cache, file I/O, JSON decoding, summary types) splits into at least `runs_cache.go` and `runs_decode.go` within the same package.
+Done. The mixed concerns (cache, file I/O, JSON decoding, summary types) now sit in `runs_cache.go` and `runs_decode.go` beside `runs.go`.
 
 ### `cmd/internal-tools/` stays in `cmd/`