docs: the success path is verifiable too — pkexec's exit status is the oracle

CLAUDE.md said everything except a successful authentication could be verified
against a live prompt. That undersold it: a successful authentication is the
easiest check of the lot, it just needs a finger on the reader, and it was
performed this session against a real request.

The point worth writing down is what to measure. `pkexec true` exiting 0 means
/usr/bin/true actually ran as root — polkitd accepted the agent's Ok(()) and
granted the action. The agent's own logs cannot establish that; they only show
what it sent. Paired with the journal's "ACTIVE_REQUEST was already taken
(success/done)", which proves the success path consumed the request rather than
letting the main loop report a spurious Cancelled over a granted authorization,
that covers the branch end to end. It costs nothing and never touches faillock.

Every branch in this crate has now been exercised against a live polkit request:
success, failure with the retry bound holding, cancellation from both a dying
client and a queued cookie.

Co-Authored-By: Claude Fable 5 <[email protected]>

 CLAUDE.md | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 830cbeb..4f2f21e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -91,7 +91,17 @@ and stranded dialogs. The crate's one test locks those orderings in.
 - **A real prompt is cheap and safe to raise: `pkexec true`.** Kill that client and
   polkitd sends `CancelAuthentication`, which is how the cancel path gets exercised
   end to end. `grim -g "<x>,<y> <w>x<h>"` (geometry from `ccectl windows`) captures
-  the dialog. Everything except a *successful* authentication can be verified this way.
+  the dialog.
+- **The success path is verifiable too, and `true` is the whole point of the command.**
+  Raise `pkexec true`, touch the reader, and let it through: **`pkexec`'s exit status is
+  the oracle** — 0 means `/usr/bin/true` actually ran as root, i.e. polkitd accepted the
+  agent's `Ok(())` and granted the action, which no amount of reading the agent's own
+  logs can establish. The journal should show `Sending Ok to tx_result` → `ExitWindow`
+  → `ACTIVE_REQUEST was already taken (success/done)`; that last line is the one worth
+  reading, because it proves the success path consumed the request and the main loop did
+  not then report a spurious `Cancelled` over the top of a granted authorization. This
+  costs nothing and never touches faillock — the only ingredient it needs is a human
+  finger (or password), which is why it is the one check that cannot be scripted.
 - **Do not test a failed attempt by typing a wrong password**, and never run
   `polkit-agent-helper-1` by hand. Both drive real PAM: `deny=3` / `unlock_time=600`
   in `faillock.conf` means three wrong answers lock the account for ten minutes, and