docs(roadmap): reconcile carryovers and verified increments

docs/direct-roadmap/ROADMAP_TODO.md

@@ -33,7 +33,8 @@ Updated 10 November 2026. This is the cross-phase work list. The source prompts,
 - [ ] **Career, CV, letter and documents**. Finish connected overview-to-document reuse and create/import-to-edit/preview/export evidence. Preserve revisions, null-as-inherit, canonical profile ownership, frozen packages, import review and RD21.
 - [ ] **Correspondence**. Improve inbox, mailbox state, relevant job context and review. Scope explicit consent, provider permissions, multi-mailbox storage and retention separately. Preserve conflict, attachment and confirmed-send flows.
 - [ ] **Admin Users**. Alignment and read-only 2FA shipped. Compact actions and creation/role/reset/deletion dialogue, error and keyboard coverage remain. **Gated** MFA recovery design approval and authorisation for factor changes.
-- [ ] **Audit and privacy**. Mail-subject redaction shipped. Add approved filters and safe record expansion, minimise exposed fields and verify isolation across remaining delivery paths. **Gated** private support access proposal, consent, expiry and revocation.
+- [x] **Audit recent search**. Search the existing admin response by user, type, application ID/title or company. The limit and no-match state are explicit. Published `49e79875` with 10 selected tests and 72 browser states.
+- [ ] **Audit and privacy**. Mail-subject redaction shipped. Add structured filters and safe record expansion, minimise exposed fields and verify isolation across remaining delivery paths. **Gated** private support access proposal, consent, expiry and revocation.
 - [ ] **System Status**. Last successful browser refresh shipped. Qualify actual worker/queue/task/provider/mail/enrichment/error/timing signals with honest stale/unavailable states. Design exists for isolated allowlisted diagnostics. **Gated** execution, audit and isolation approval. Retain CV benchmark evidence.
 - [ ] **Settings and automation**. Qualify individual rules and explanatory states, remaining recovery cases and per-user Ghosted pause contract. Keep model/provider execution and real mutations separately authorised.
 - [ ] **Bookmarklet and terminology**. Finish EN/NB terminology and display review. Retain bookmarklet until device parity for URL paste, extension and PWA sharing, then seek retirement approval.
@@ -108,7 +109,7 @@ Bounded offline fixes and root security policy exist. Formal integrated scope, t
 
 ## RELEASE-READINESS-01 · Qualification and production decision
 
-- [ ] **Stage 1** Close discovery, inventory, prior blockers and baseline scope. Backup parser RR-11 published with 31 offline tests. RR-12 rollback and RR-13 recovery remain open.
+- [ ] **Stage 1** Close discovery, prior blockers and baseline scope. Endpoint/environment census published at `47c6834c`. Backup parser RR-11 published with 31 offline tests. RR-12 rollback and RR-13 recovery remain open.
 - [ ] **Stage 2** Freeze exact candidate, environment, image/digest, migration/config/dependency identities, CI and evidence provenance.
 - [ ] **Stage 3 · Functional** Accounts/auth, jobs/tracking, dashboard, career/CV/documents, AI, correspondence, integrations, notifications, admin, billing and exports. Qualify real browser, sidecar and MariaDB lanes separately.
 - [ ] **Stage 3 · UX** Responsive/visual and keyboard/AT/accessibility, EN/NB and launched locales, reflow/contrast, physical devices and representative workflows.
@@ -122,8 +123,13 @@ Bounded offline fixes and root security policy exist. Formal integrated scope, t
 
 ## Separately gated or excluded
 
+- [ ] Optional P7-06F follow-mode composer: retain deferral pending action/fallback decision. P7-12 completed conditionally. Preserve its native/provider/release limits.
+- [ ] Carry forward Phase 8 dashboard and Phase 9 qualification gaps: real device/AT, performance, hosted runner isolation/lifecycle and provider/physical-print review. Reuse qualified Linux/Windows PDF fidelity and scoped RD21 evidence. Refresh Python/advisory evidence at the applicable security baseline.
+- [ ] Legacy Job/JobApplication data cutover and migration/startup ownership: verify compatibility, backup/restore and observation release before removal of duplicate columns or legacy bootstraps.
+- [ ] Stripe activation and account deletion: verify commercial configuration, portal/webhooks and supported operations. Obtain approval and rehearse retention, legal hold, deletion tombstones, provider cleanup and restore handling.
+- [ ] Operational debt: qualify proxy/client-IP/firewall and mail/AI durability. Gate multi-replica work on worker leasing and containment. Assess log aggregation, tag/attachment storage and checklist-read separation only when justified.
 - [ ] SQLite retirement: qualified MariaDB parity, migration, rollback, restore and retention before any removal.
 - [ ] Live model, provider, mail, market claims, native/device, hosted CI, staging and production decisions stay separate.
 - [ ] Deferred CV-import engine overhaul and personal portfolio are outside this execution.
 
-Source index: Phase 10 and Product Review prompts 5–6, Global Jobs prompt 7 and `docs/planning/global-jobs-prompts/`, complete `I18N/` and `jobjakt-security/` packs, homepage prompt 10, release readiness prompt 11, the approved A3 implementation/visual requirements and `additional/# Jobjakt — A3 refinement+EUJOBS.txt`. The [status register](ROADMAP_STATUS.md) and [latest checkpoint](LATEST_CHECKPOINT.md) identify current evidence and branches.
+Source index: Phase 10 and Product Review prompts 5–6, Global Jobs prompt 7 and `docs/planning/global-jobs-prompts/`, complete `I18N/` and `jobjakt-security/` packs, homepage prompt 10, release readiness prompt 11, the approved A3 implementation/visual requirements and `additional/# Jobjakt — A3 refinement+EUJOBS.txt`. Earlier items come from the [historical TODO](../roadmap/todo.md), [known issues](../roadmap/known-issues.md) and [technical debt](../roadmap/technical-debt.md). The [status register](ROADMAP_STATUS.md) and [latest checkpoint](LATEST_CHECKPOINT.md) identify current evidence and branches.