Describe the code the docs actually ship with (B-68)

CLAUDE.md and README still asserted a state the code had moved past:

- JWT "no revocation (B-34)" — token_version implements exactly that
  revocation, and the tv-claim behaviour (including why the deploy did not
  log everyone out) is worth stating instead of denying;
- /report-bug "a placeholder" — it shipped fully implemented and
  translated, with an admin triage section, a reporter-side status view and
  its own audit event; only /guida is still a stub, and /admin has six
  sections now, not five;
- three stale test counts (CLAUDE.md twice, README once);
- a code map missing app/auth/rate_limit.py, app/api/client_ip.py and
  app/api/routes/bug_reports.py;
- README linking flowchart.mmd (the diagrams live in flowchart/), the
  anchor CLAUDE.md#tech-stack-mvp (gone), and describing
  docs/running-the-server.md as "local venv vs. Docker" after B-44 made
  Docker the only supported way to run the server.

The rate-limiting bullet the audit also flagged already reads correctly.

tests/unit/test_docs_current.py pins all of it: the documented counts must
equal what the suite actually collects, the retired claims must stay
retired, the code map must name those modules, and every relative README
link and CLAUDE.md anchor must resolve. None of this is catchable by
reading the code, which is how it drifted in the first place.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

BUGS.md

@@ -40,24 +40,6 @@ remains the last prerequisite for running unattended.
 
 ## Low — documentation and consistency drift
 
-### B-68 — CLAUDE.md and README describe a state the code has moved past
-
-- CLAUDE.md's tech-stack line still says JWT has **no revocation (B-34)**; `token_version`
-  implements exactly that revocation (`app/db/models.py:29`, `app/auth/dependencies.py:26`).
-- "Known gaps" still says **no rate limiting anywhere (B-33)**; login and registration
-  are throttled (`app/auth/rate_limit.py`). What is genuinely still unthrottled is
-  bets, withdrawals and the admin endpoints — that is the claim worth keeping.
-- "Known gaps" still says **`/report-bug` is a placeholder**; it is fully implemented
-  and translated, with admin triage. Only `/guida` is still a stub.
-- Test counts are stale in three places: 264 actual, CLAUDE.md says 253 twice,
-  README says 232.
-- The code map omits `app/auth/rate_limit.py`, `app/api/client_ip.py` and
-  `app/api/routes/bug_reports.py`.
-- README links `flowchart.mmd`, which does not exist (the diagrams live in
-  `flowchart/`), describes `docs/running-the-server.md` as covering "local venv vs.
-  Docker" (that workflow was removed in B-44), and links the anchor
-  `CLAUDE.md#tech-stack-mvp`, which no longer exists.
-
 ### B-69 — stale in-code comments
 
 - `app/tx/reconcile.py:206` calls the payout retry "a future payout-retry routine —