docs: session-9 cont. — silent-fallback audit + Tier-1 strict-raise shipped

Record the 4-agent audit, the shipped Tier-1 fuel-code strict-raise (7878a969),
and the un-actioned Tier 2/3 candidates (glazing codes 4-12, window orientation,
age-band swallows) for a future robustness slice.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/HANDOVER_API_PROFILING.md

@@ -414,6 +414,29 @@ heat:low 206 / hw:low 173 / hw:high 125 / balanced 94 — i.e. the residual is a
 fabric+HW tail, not one lever. The clean systematic wins (sheltered walls, MEV, fuel collisions)
 are harvested; remaining headway is per-cert worksheet grind or the 100-cert schema big-ticket.
 
+### SESSION-9 (cont.) — silent-fallback audit + Tier-1 strict-raise SHIPPED, `7878a969`
+User pivoted from accuracy-chasing to a robustness audit: "where do we map codes but NOT raise
+on an unmapped code (silent fallback)?" Four parallel Explore agents swept the API mapper,
+`cert_to_inputs`, the U-value/table lookups, and the worksheet dispatch. Findings triaged into
+tiers (full list in the session report I wrote inline). **Tier 1 (shipped):** the fuel-type
+helpers fed Table 12/32 cost/CO2/PE via a silent `API_FUEL_TO_TABLE_12.get(fuel, fuel)`
+passthrough at 5 sites → an unmapped/colliding fuel hit the **mains-gas default** in
+`unit_price_p_per_kwh`/`co2_factor`/`primary_energy_factor` (the cert-8536 −17-SAP class). New
+`_table_12_factor_fuel_code` is byte-identical to `.get(fuel,fuel)` for every recognised input
+and raises `UnmappedSapCode("table_12_factor_fuel", …)` only when the resolved code is in NO
+table. **Verified 0/909 corpus raises; eval unchanged 54.9%/909/0** — pure future-proofing.
+2 AAA tests, goldens + gate green, pyright net-zero (44=44).
+**Tiers NOT actioned (user chose Tier-1 only — candidates for a future robustness slice):**
+- Tier 2: `_api_glazing_transmission` ([mapper.py:2925]) maps only glazing codes [1,2,3,13,14];
+  4–12/15+ silently default U≈2.5 (the `reference_unmapped_api_code` "pending" gap). Window
+  orientation drop ([solar_gains.py:391]) silently drops a window from solar gains on an unmapped
+  orientation. Both would make currently-computed certs RAISE → need the codes MAPPED first, not
+  just a guard added (coverage tradeoff).
+- Tier 3 (low impact, bands are schema-bounded A–M): `.get(band, DEFAULT)` swallows a non-None
+  unrecognised age band in `u_door` (→3.0), `u_basement_wall` (→0.7), `u_basement_floor` (→0.50),
+  `u_roof` (→0.4). The `age_band is None` branches above each are justified absent-data defaults;
+  only a typo/unknown band silently passing is the gap.
+
 ## THE 100 unsupported_schema CERTS (deferred — bigger ticket)
 SAP-Schema-19.1.0 (and other pre-21). The user is planning a separate big piece: map old schemas
 → new + **predict missing fields from similar-looking properties** (needs an EPC-prediction