docs: publish Phase 9 requalification decisions and evidence

2026-10-24 18:32:24 +02:00
parent 7092697cb3
commit 3727a723e8
22 changed files with 53642 additions and 42 deletions
@@ -0,0 +1,119 @@
+# P9-REQUAL-01 — Phase9 requalification, 24 October 2026
+
+**Final: RD21 RESOLVED in tested scope; hosted MariaDB BLOCKED; Phase9 NO-GO; Phase10 NO-GO; production NO-GO.** Historical acceptance records remain unchanged.
+
+## Verified source and repairs
+
+The dedicated branch is `fix/p9-ci-and-requalification`, descended from approved development
+baseline `549b2cba5a791862ba3f854312ea819a86dc42a0` and RD21 repair
+`0d16a691e0249fe1264bf960de5e59eaa9b87fed`. It does not start from production main.
+Application repair checkpoint: `2b26953d6f3c3fdacdffefa2c0a696c9084f1afd`.
+Hardened qualification checkpoint: `5ac11549b2caa27469aa9fb2b5b9ed402471a453`.
+Both normal pushes and direct remote equality were verified. Local/remote main remains
+`5f835e54a9b74e6b71418422e28431b2af06453f`.
+
+The compatible Pkcs/Next/Zod security pins are recorded in [SECURITY.md](SECURITY.md).
+The real MariaDB Documents UNION defect was reproduced by three cases, fixed only in read-only
+name projections, and verified in the full35-case provider suite; see [provider repair](DOCUMENTS_PROVIDER_REPAIR.md).
+No application API, migration, stored collation, database version or document-rendering contract changed.
+Qualification cleanup/startup/serialization corrections and every superseded runtime attempt are
+retained in [attempts and repairs](ATTEMPTS_AND_REPAIRS.md). [Independent source review](SOURCE_REVIEW.md)
+records its actual findings and limits. No manual or release approval is inferred from that review.
+
+## Fresh regression checkpoint
+
+All results below are separate lanes. Focused RED/GREEN runs and earlier full-suite passes are
+not added to successor totals. Accepted runtime results require native case membership, process
+success, zero retries/skips and unchanged frozen inputs. Discovery-only empty results are not skips.
+
+| Lane | Current actual result |
+| --- | --- |
+| Backend |1123 passed, zero failures/skips |
+| Frontend |934 passed in105 suites, zero failures/pending/todo |
+| MariaDB integration |35 passed, zero failures/skips, exact12.2.2, generated schemas and teardown |
+| Ordinary browser |PASS:362 cases, exact discovery membership; shards98/87/88/89 |
+| Six separate browser contracts |PASS:23 cases across six separate lanes |
+| RD21 companions / corrected diagnostics |PASS:6 /18 cases |
+| Volume / RD21 volume |PASS:3 /3 cases |
+| MariaDB browser / HTTP durability |PASS:1 native recovery /2 HTTP cases; creation case is characterization only |
+| AI sidecar |56 passed, model loading disabled; no model/inference qualification |
+| Type checks / lint / static production build |PASS; Next16.4.1; local build, no deployment |
+| Existing security helpers / secret scan / SBOM |PASS within stated scope; NuGet/npm report zero vulnerabilities |
+| Locked Python advisory review |FINDINGS;49 pins,109 published alias groups across8 packages; coverage INCOMPLETE |
+| Windows PDF oracles |PASS:16 fixtures/36 pages plus8 fixtures/24 pages; unchanged oracle, no input drift |
+| Exclusive15-minute MariaDB workload |PASS:900006ms,3382 reads/zero failures,20 navigations, selected exact-state invariants; archived failed setup attempts excluded |
+| Linux renderer producers |PASS:5 cases; owned API/network/schema teardown confirmed |
+| Linux PDF oracles |FAIL:9/16 fidelity plus4/8 settings;65 exported versus60 expected pages |
+| Affected Windows settings successor |PASS:4 cases; replaces affected fixture evidence, not added to362 |
+
+Final native case indexes, process outcomes, source/report identities and detailed measurements
+belong to [validation.json](validation.json). Large raw reports, traces, PDFs and screenshots are
+retained locally under `.artifacts/p9-requal-01/`; separately archived attempts preserve failures.
+
+## Hosted infrastructure and provider limits
+
+Hosted run843 had no Docker CLI and executed no database tests. Read-only investigation found
+Gitea1.26.0/act_runner0.4.1, runner5 `Live-Runner`, `ubuntu-latest` mapped to `node:20-bookworm`,
+host networking and an existing merged host Docker-socket bind. That label does not prove a VM
+or private isolation. The first-step guard prevents repository/test commands; runner preparation
+still occurs before it. Inspected runs847 and849 confirm **BLOCKED**, with no MariaDB service/test
+execution. A guard failure is not a hosted database-test failure or pass.
+
+The [operator handoff](CI_OPERATOR_HANDOFF.md) requires a dedicated isolated nonproduction runner,
+verified private job/service network, no job daemon socket/privilege/public DB port/persistent data,
+and success/failure/cancel cleanup evidence before enabling native services and the restricted
+CI-service transport. No runner or live deployment infrastructure was changed.
+
+Local MariaDB uses official Linux/amd64
+`mariadb:12.2.2@sha256:42a27baaba3e8f3f0159d16381d5a7156661aa91dcc65f663cabb6a6f9503c00`.
+The actual server is12.2.2; this proves tested version parity, not equality with the owner's running
+production image ID/configuration. That image ID is not a registry manifest digest. Local schemas
+are disposable and credentials/volumes are separate from production. Existing SQLite fixtures
+remain explicitly transitional and are never counted as MariaDB execution.
+
+## Acceptance findings and human requirements
+
+[FINDINGS.md](FINDINGS.md) and [findings.json](findings.json) register59 findings independently
+against Phase9, Phase10, production and debt. All57 preservation groups and33 routes remain;
+56 groups are PARTIAL and C11 DEFERRED. No source presence or passing tagged fixture promotes an
+entire capability to PASS. Canonical/variant boundaries, null-as-inherit overrides and frozen
+documents retain their specific contracts; no legacy alias or metadata was removed.
+
+[M09-01–10 owner-test cards](MANUAL_ACCEPTANCE.md) specify prerequisites, exact actions, expected
+results and required recordings. Genuine reader/keyboard/contrast/zoom, physical-device, natural
+Bokmål, printing and provider checks remain NOT TESTED where the required human/environment is
+absent. Automated axe and finite image inspection do not establish full accessibility compliance.
+The original REQUEST§6 explicitly carries unfinished genuine human checks into release gates;
+production-only storage/backup requirements do not independently veto isolated functional QA.
+
+The open Python gate is different: published critical/high records affect dependencies with actual
+upload-parser/model-loading call sites. Existing child/time/resource controls do not establish
+advisory closure. Per-advisory reachability and compatible major parser/ML transition remain
+unproven. REQUEST§§9/13/14 call for an individual risk disposition; they do not mechanically mandate
+NO-GO for every advisory. This report's acceptance-risk judgment withholds closure for this
+unassessed critical/high uncertainty pending validated remediation or an explicitly approved risk
+disposition. C11/P5-13 remains withheld.
+Duplicate reminder reads remain low documented debt; creation-intent idempotency remains a separate
+open contract. No optimization, duplicate-create protocol or Phase10 cleanup was introduced.
+
+## Final decisions and next action
+
+| Gate | Decision | Reason |
+| --- | --- | --- |
+| RD21 |RESOLVED |Original six save/concurrency clauses satisfied within tested scope; separate creation debt retained |
+| Hosted MariaDB CI |BLOCKED |Private service isolation/lifecycle unavailable; no hosted database tests ran |
+| Phase9 |NO-GO |Confirmed Linux PDF output failure and unclosed critical/high Python advisory risk disposition |
+| Phase10 readiness |NO-GO |Unwaived affected functionality/testpass failures; unused-code/route/inventory prerequisites unproven |
+| Production |NO-GO |Task restrictions and independent release/security/recovery/manual gates remain |
+
+The final collector deliberately exits1: `linux-pdf:FAIL`, `python-advisories:FINDINGS`; `automationComplete:false`. These are retained acceptance failures, not substituted passes. [Linux findings](LINUX_PDF.md) identify11 failed fixtures and observed font/browser differences without claiming a proven sole cause.
+
+MariaDB local development configuration is READY within previously verified isolated persistent-startup scope; its persistent service/data are preserved and currently stopped. Local disposable integration testing is READY (35 real-provider cases plus isolated browser/workload lanes). Hosted CI is BLOCKED. Historical revision fixture repairs remain verified (18/18 and3/3 baseline evidence, fresh complete backend successor); assertions were not weakened. SQLite retirement is STAGED, not performed. MariaDB12.3 LTS migration readiness is PLAN ONLY, not qualified/executed. Production floating `latest` remains a pinning risk; use a separately approved exact version/registry digest with backup/restore/rollback evidence, never the running image ID as a manifest reference.
+
+Source lineage is explicit: complete362 ordinary cases ran at5ac1154; the sole subsequent runtime-input change is the CV sibling preservation fixture at7092697. It takes an independent successful durable GET as its pre-action baseline and retains full strict after-body equality. Four affected Windows cases and five Linux producers passed afterward; no application/static/DLL source changed. [Source lineage](source-lineage.json) and both frozen input manifests record this distinction.
+
+The next specific development action is a bounded Phase9 Linux document-rendering parity investigation using the retained failing corpus, alongside separately scoped Python parser/ML advisory assessment and validated remediation. An operator must provide the isolated runner described in CI_OPERATOR_HANDOFF.md before hosted execution can be enabled. Owners can complete prioritized M09 cards in parallel. These actions do not begin Phase10 cleanup.
+Production remains NO-GO under the task restrictions. Live storage, independently verified off-disk
+backup/restore/rollback, ingress/deployed identity, provider/model integrity and applicable human
+release gates remain unverified. There was no merge, deployment, production database access,
+SQLite retirement or MariaDB12.3 upgrade. The existing staged retirement/LTS plans remain plans.
@@ -1,7 +1,8 @@
 # Retained attempts and qualification-harness repairs

-Application source and rebuilt artifacts remain at the security-pin checkpoint `780b9bc`.
-The subsequent repairs below affect qualification tooling only. Historical acceptance reports
+Application source initially used security-pin checkpoint `780b9bc`; the subsequently reproduced
+document-index provider defect is repaired in `2b26953` with its own fresh full regression.
+The fixture repairs below affect qualification tooling only. Historical acceptance reports
 are unchanged. Successor counts exclude earlier attempts; no failed startup or short run becomes
 a passing database, workload or PDF qualification.

@@ -13,6 +14,7 @@ a passing database, workload or PDF qualification.
 | Schema ownership before diagnostic write | Independent review identified successful CREATE followed by a failing log write could leave cleanup ownership false | Record successful CREATE ownership before writing its log. Exact old-checkpoint source replay fails the injected-error regression; corrected source passes both that case and failed-CREATE/no-DROP authority. This is offline harness proof, not an executed data-loss event. |
 | Initial sustained workload setup |250 synthetic applications were created; stored canonical Career JSON omits null object properties while API DTOs include them. Exact cross-format comparison failed before preflight/timer; zero timed reads/navigations; schema cleanup succeeded | The fixture compares canonical JSON using the existing `StructuredCvProfileJson.SerializePersisted` null-property omission. Full API profile assertions and exact SQL before/after equality stay unchanged; SQL/API revision equality is added. CV override null-as-inherit behavior is untouched. Failed evidence and predecessor manifests remain under `attempts/performance-canonical-wire-failure/`. No15-minute result is inferred from it. |
 | Linux runner error paths, before service execution | Review found post-browser SQL failure could retain evidence exit0, and failed log capture could suppress container removal | Browser and overall exits are separate; any post-check/cleanup error fails the runner; removal is independent of diagnostic capture; unconfirmed API removal prevents schema DROP. Two offline injected-error tests pass. No earlier Linux runtime PASS is claimed. |
+| MariaDB workload preflight after serializer correction | `/api/documents` returned500: illegal mix of collations in UNION; zero timed requests/navigations; schema cleanup succeeded | [Actual provider repair](DOCUMENTS_PROVIDER_REPAIR.md), three real RED/GREEN cases, then a new full35-case MariaDB/backend/frontend/browser checkpoint. Entire previous regression and failed preflight retained under `attempts/pre-documents-provider-fix/`; none is added to successor totals. |

 The schema-ownership regression itself was debugged with offline fixture corrections for the
 temporary evidence root and Docker inspect's list envelope. The retained old-source replay then
@@ -23,10 +25,15 @@ Initial and successor input manifests are retained. The first successor changes
 performance web-server config among the1042 frozen runtime inputs, plus its affected wrappers;
 the next changes only the two performance fixture sources. No API, UI source, built export,
 Release assembly, original PDF oracle or historical test assertion changes during these repairs.
-Each affected lane is rerun against a fresh generated schema. Final accepted results and hashes
+Each affected MariaDB lane is rerun against a fresh generated schema; the subsequent application
+provider repair also triggers a complete fresh regression and rebuild. Final accepted results and hashes
 belong to [validation.json](validation.json); this history does not waive a failing final gate.

 Hosted843/844 retain their original missing-Docker failures. Hosted847 and849 retain expected
 first-step isolation failures, with no MariaDB test execution. [Local Desktop socket recovery](LOCAL_DOCKER_RECOVERY.md)
 is a separate workstation event. Neither its successful startup nor a list-only browser discovery
 report establishes application acceptance.
+
+## Final Linux attempts and fixture successor
+
+`attempts/linux-timestamp-baseline/` retains the original1/5 Linux producer result, source/helper manifests and predecessor Windows settings evidence. Four cases differed solely because POST timestamp precision exceeded durable MariaDB datetime(6). At7092697 the fixture reads the complete durable sibling before actions, then retains strict complete-body equality afterward. Windows4/4 and Linux5/5 successors pass; they are never added to whole-suite362. The unchanged Linux output oracle then genuinely fails11/24 fixtures (65 versus60 pages). See LINUX_PDF.md; no tolerance, baseline, API or rendering contract was changed to obtain a pass.
@@ -1,6 +1,6 @@
 # P9-REQUAL-01 findings and independent gate register

-Source review dated 24 October 2026 on `fix/p9-ci-and-requalification`, baseline `549b2cba5a791862ba3f854312ea819a86dc42a0`. This register covers RD01–RD28, every retained P9 finding, and M09-01–10. [Machine-readable register](findings.json) contains source, evidence, impact, dependency, owner, status and required closure for each entry. Fresh execution is pending the root-owned validation ledger; every result referenced below is historical unless explicitly updated there.
+Source review dated 24 October 2026 on `fix/p9-ci-and-requalification`, baseline `549b2cba5a791862ba3f854312ea819a86dc42a0`. This register covers RD01–RD28, every retained P9 finding, and M09-01–10. [Machine-readable register](findings.json) contains source, evidence, impact, dependency, owner, status and required closure for each entry. Final fresh results are in validation.json and the dated addendum. Historical rows below retain their original observations; the final disposition table supersedes pending execution wording without rewriting historical reports.

 The original [REQUEST §§6,13,18](../REQUEST.md) distinguishes completed assessment from acceptance and explicitly says “Carry uncompleted checks into the release gates.” It permits transparent human-check carry-forward; it does not invent human PASS results. Production-only storage/backup/deployment conditions do not automatically veto isolated functional QA. Each unmet functional criterion still needs a specific disposition. The [master cleanup criterion](../../IMPLEMENTATION_PLAN.md#phase-10--cleanup) requires proof that no route still uses removed code, tests pass and the functionality inventory is satisfied. Neither conditional Phase9 acceptance nor an open manual checklist satisfies these deletion criteria by itself. No Phase10 implementation is authorized.

@@ -94,3 +94,24 @@ No current final verdict is locked by this source register. Root must reconcile
 ## Additional verified provider defect

 P9-REQUAL-DB01: actual MariaDB Documents UNION failed on mixed startup name collations. [Repair and real RED/GREEN evidence](DOCUMENTS_PROVIDER_REPAIR.md) records the narrow read-only fix, three new cases and full35/35 MariaDB plus1123/1123 backend successors. Broad final-source qualification remains separate. The register now contains58 unique findings.
+
+## Final source-bound dispositions
+
+This section and findings.json supersede provisional/pending wording above. There are59 unique findings. Complete automation is **not passing**: Linux PDF fidelity fails and Python advisory disposition remains open.
+
+| Finding | Final bounded disposition |
+| --- | --- |
+| RD03 | Fresh MariaDB12.2.2:35 integration cases,1 native recovery,2 HTTP cases and15-minute workload PASS; broader deployed parity remains PARTIAL. |
+| RD05 | Hosted MariaDB BLOCKED: inspected847/849 fail first isolation gate; no database tests. Existing host network/socket binding is not safe service isolation. |
+| RD10 | Windows24 fixtures/60 pages PASS; Linux13/24 fixtures PASS,65 exported versus60 expected pages: P9-REQUAL-PDF01 OPEN; physical printing NOT TESTED. |
+| RD17 | Finite exclusive MariaDB workload PASS:250 applications,2 readers,900006ms,3382 reads,20 navigations,zero failures and selected exact-state checks; no capacity SLA. |
+| RD21 | RESOLVED within original six save/concurrency clauses and tested scope; fresh source-bound provider/browser/regression evidence. Creation-intent idempotency remains separate OPEN debt. |
+| P9-SEC-01 | Compatible NuGet/npm repairs and fresh regression PASS; Python P9-REQUAL-SEC04 OPEN, coverage INCOMPLETE. No blanket security PASS. |
+| P9-PUB-01 | Normal checkpoint pushes verified through7092697; final publication follows ledger and direct remote receipt. No force-push or main change. |
+| P9-REQUAL-DB01 | LOCALLY REPAIRED at2b26953; three real RED/GREEN cases, full35 MariaDB/1123 backend and complete successor browser/workload PASS. |
+| P9-REQUAL-SEC01 | LOCALLY REMEDIATED; post-pin audits zero and complete affected frozen-source successors PASS; production NOT DEPLOYED. |
+| P9-REQUAL-SEC02 | LOCALLY REMEDIATED; post-pin audits zero and complete affected frozen-source successors PASS; production NOT DEPLOYED. |
+| P9-REQUAL-SEC03 | LOCALLY REMEDIATED; post-pin audits zero and complete affected frozen-source successors PASS; production NOT DEPLOYED. |
+| P9-REQUAL-PDF01 | OPEN: Linux producer5/5 PASS but fidelity9/16 and settings4/8 PASS;65 exported versus60 expected pages. Root cause not yet isolated. |
+
+P9-T01/L01/V01/V02/T02/T03 have passing mapped fresh automated successors; no human row is promoted. The authoritative five decisions are in [the final addendum](ACCEPTANCE_ADDENDUM_2026-10-24.md). Hosted infrastructure, Linux output and Python risk require distinct owners and closure evidence.
@@ -0,0 +1,20 @@
+# Linux PDF qualification — 24 October 2026
+
+**FAIL: P9-REQUAL-PDF01.** Real Linux rendering completed; the unchanged output oracle found geometry and pagination differences. This is a measured functional blocker, separate from physical printing.
+
+| Lane | Actual result |
+| --- | --- |
+| Linux browser producers |5/5 passed, zero retries/skips |
+| Fidelity corpus |9/16 passed;37 PDF pages versus36 expected/preview |
+| Settings corpus |4/8 passed;28 PDF pages versus24 expected/preview |
+| Windows unchanged corpora |16/16 plus8/8 passed;60 total pages |
+
+Seven failing fidelity fixtures: `long-en-minimal`, `long-nb-code`, `compact-8mm-letter`, `roomy-28mm-nb`, `grid-and-bubbles`, `long-sidebar-nb`, `unbreakable-and-boundary`. The roomy fixture grows from5 to6 pages. All four settings `*-after` fixtures grow from3 to4 pages. Measured positions exceed the unchanged tolerances, with multiple fidelity shifts around5–20mm. No baseline or tolerance was weakened.
+
+The actual local image ID is `sha256:5a1c1e8d08007083ce8ca65f9ded9d7c56c4c84c9f4259cd97df8135b510d0e0`, .NET9.0.21, Debian12 Chromium156.0.8078.47. Windows preview Chromium is151.0.7922.34. Linux PDFs embed DejaVuSans/DejaVuSerif/DejaVuSansMono; Windows fonts include SegoeUI/Arial/Georgia. These differences are observed; a solely font-caused explanation is **not established**.
+
+The owned Linux API ran actual startup migrations against isolated MariaDB12.2.2 (51 migrations before/after). API container, private network and generated schema cleanup all succeeded. Source/process identities and all24 oracle results are indexed by validation.json; raw outputs are in `.artifacts/p9-requal-01/linux/` and `linux-pdf-oracle/`.
+
+An earlier four-case settings failure was a fixture baseline problem: POST returned100ns timestamp precision while durable MariaDB datetime(6) readback truncated it. The fixture now captures a successful independent GET before actions and still compares the entire sibling body strictly afterward. All four affected Windows successors and all five Linux producers passed. That correction does not change documents, API, timestamp handling, migrations or the oracle; it does not close the output failures above.
+
+Next bounded work: isolate browser/font/layout causes with these retained failing inputs, review approved font redistribution and document contracts, then repair the narrow rendering/configuration owner and rerun both unchanged corpora plus affected regression. Do not silently substitute typography or approve a new baseline. Physical-device printing remains NOT TESTED; owner card M09-09 remains separate.
@@ -1,6 +1,6 @@
 # P9-REQUAL-01 performance protocol

-Status: **source prepared; real workload not executed by fixture author**. Historical P9-05 and RD21 sustained fixtures remain unchanged. Their short SQLite observations are not evidence for this lane. Actual runner results must be added below after the exclusive run.
+Status: **PASS on real MariaDB12.2.2 after the documented fixture/provider repairs**. Historical P9-05 and RD21 sustained fixtures remain unchanged. Their short SQLite observations are not evidence for this lane. Actual runner results must be added below after the exclusive run.

 The only new executable source is in `performance/`. It extends `job-tracker-ui/playwright.mariadb.config.ts`, preserving the canonical disposable-schema guard, MariaDB provider/version and `reuseExistingServer: false` on both servers. The additional guard requires port `33308` and a prebuilt production static frontend. No production code, dependencies, SQLite database, mock database or mocked API response is introduced.

@@ -51,4 +51,18 @@ The dependency-free self-check exercises empty percentiles, exact percentile bou

 ## Actual results

-Pending root runner execution and evidence reconciliation. No measured duration, latency, throughput, preservation or capacity outcome is claimed yet.
+Actual exclusive workload: **2026-10-24 13:10:23.274–13:25:23.280UTC**, monotonic duration **900006.3119ms** (required900000). Both readers completed1691 attempts: **3382 total, zero failures**. All20 navigations passed; maximum observed readiness1686.51ms. Preflight passed and is excluded from workload counts.
+
+| Endpoint | Attempts | p50ms | p95ms | p99ms | Maxms |
+| --- | ---: | ---: | ---: | ---: | ---: |
+| All readers |3382|23.84|33.24|41.67|162.16|
+| Application stats |846|22.43|27.80|34.03|57.79|
+| Board |846|23.20|32.73|37.26|67.44|
+| Career Profile |846|28.56|38.70|46.45|50.73|
+| Documents |844|23.09|31.26|39.36|162.16|
+
+The20 workload telemetry samples observed minimum host free memory13024960512bytes (12.13GiB) and maximum sampled load-generator NodeRSS478834688bytes (456.65MiB). These are sampled host/load-generator measures, not server CPU attribution or proof of the true between-sample peak. Windows load averages are unsupported zeros. Chrome CDP/DOM/heap and full per-request measurements remain in the attachment. No capacity/SLA claim is made.
+
+Independent SQL snapshots matched exactly for the250 unique application IDs, owned/deleted/global-tenant counts, complete canonical profile JSON/revision, Identity projection JSON and history count. Full API profile and Board membership checks also passed. This is equality of the stated selected invariants, not a whole-database byte comparison or power-loss test. Cleanup verified the generated schema absent.
+
+Accepted evidence: .artifacts/p9-requal-01/performance/result.json, performance.json, performance-exit.json and retained trace/attachment. The wrapper explicitly sets the root performance.json reporter path. Earlier setup/preflight failures remain separately archived and contribute zero successful timed runs. The canonical API-vs-storage setup comparison follows StructuredCvProfileJson.SerializePersisted null-property omission; exact SQL before/after equality, full API comparison and CV null-as-inherit contracts remain intact.
@@ -29,3 +29,9 @@ Production-only gates do not automatically veto Phase9. Conditional Phase10 requ
 - Task2: complete safe workflow checkpoint `75cd04c`; fresh hosted847 explicitly BLOCKED at first isolation gate. Merged host socket/network are unknown infrastructure, not permission to execute Docker.
 - Ruling: live audits reproduced vulnerable Pkcs/Next/Zod locks; apply compatible narrow pins and refresh locked graphs, then supersede affected pre-pin results. No application flow/API/schema change or policy bypass.
 - Post-pin checkpoint: NuGet/npm audits clear, backend1123, frontend934/105suites, MariaDB32, types/lint/static build pass. Frozen1042 runtime inputs recorded before full browser lanes. Independent review found missing P9-V02 register row; repaired, with56 unique findings including3 new security items.
+- Source checkpoint `1a1b7c8`: register/manual/harness package published; later Python advisory review adds its independent open security gate. Hosted849 confirms the isolation blocker at this source checkpoint.
+- Harness findings: record schema ownership before diagnostic writes; make nested config server working directories explicit; compare canonical Career storage using its actual null-property omission, keeping exact before/after SQL equality. All failures and predecessor manifests retained; independent review confirms the narrow fixes.
+- Actual provider defect: sustained preflight `/documents` fails with mixed-collation UNION on MariaDB. Three real RED cases reproduce it; provider-only name-projection repair `2b26953` passes those cases and the full35-case provider suite. Backend1123 also passes; no schema or table-collation migration.
+- Hardened harness checkpoint `5ac1154` published. Fresh frontend934/105, backend1123, MariaDB35, sidecar56, types/lint/build and existing security helpers pass. Fresh static/API artifacts plus1043 runtime inputs and14 qualification-helper inputs are frozen before a new complete serial browser regression. Register now58 findings; all57 preservation groups/33 routes retained. Performance/Linux/final publication remain pending their actual results.
+
+- Final checkpoint: all runtime lanes completed; ordinary362, real MariaDB35 plus browser1/HTTP2/workload PASS. Linux producers5 PASS but unchanged PDF oracles13/24 PASS; Python advisory gate OPEN. Register59; Phase9/Phase10/production NO-GO, hosted BLOCKED, bounded RD21 RESOLVED. Final deliverables and publication receipt are indexed in README.md. No Phase10 work.
@@ -107,3 +107,7 @@ Source: [App.tsx](../../../../job-tracker-ui/src/App.tsx) lines420–524. Public
 | `/cv/:slug` | PublicCvPage | Present in current source census; retain route/identity/query/hash/section semantics. Fresh connected workflow result pending root ledger; applicable manual/provider criteria remain. |

 No cleanup candidate has been proven unused by this census. Any future candidate needs its own import/caller/route/alias census, affected preservation criteria, rollback path and passing regression. Historical evidence is preserved unchanged.
+
+## Fresh requalification
+
+The complete362-case browser suite and18 corrected diagnostics retain33-route coverage; source-lineage.json records the sole fixture successor separately. Windows PDF24/24 passes; Linux13/24 passes and P9-REQUAL-PDF01 is OPEN. These finite results do not promote any of the57 groups:56 remain PARTIAL and C11 DEFERRED. See validation.json for native case identities and the final addendum for independent gate decisions.
@@ -1,6 +1,6 @@
 # RD21 closure map and remaining limits

-This map evaluates the unchanged [six original closure clauses](../p9-04/RD21_CONCURRENCY_ISSUE.md#required-closure-evidence), rather than inventing a broader fix. Historical baseline: `549b2cba5a791862ba3f854312ea819a86dc42a0`. Source/test inspection only in this register; fresh execution must be bound to the root-owned result ledger before final acceptance.
+This map evaluates the unchanged [six original closure clauses](../p9-04/RD21_CONCURRENCY_ISSUE.md#required-closure-evidence), rather than inventing a broader fix. Historical baseline: `549b2cba5a791862ba3f854312ea819a86dc42a0`. Fresh execution is now bound to validation.json and source-lineage.json; original reports remain historical.

 The [SQLite remediation addendum](../rd21-remediation/ACCEPTANCE_ADDENDUM_2026-10-23.md) recorded a repaired implementation but withheld RD21 because MariaDB had not run. The later [MariaDB acceptance](../../../database/mariadb-standardisation/ACCEPTANCE.md) explicitly resolves the bounded MariaDB12.2.2 save/concurrency scope using32 real-provider cases and1 native browser journey. [Historical raw case index](../../../database/mariadb-standardisation/validation.json) retains actual reports/failures. These are historical results, not fresh P9-REQUAL-01 passes. Neither old report is edited.

@@ -13,8 +13,14 @@ The [SQLite remediation addendum](../rd21-remediation/ACCEPTANCE_ADDENDUM_2026-1
 | Imports, history restores, generic job updates, lifecycle/bulk and old callers follow agreed compatibility contract | Career `Replacement_restore_parse_and_import_fail_closed_without_valid_revision`, `Import_acceptance_requires_the_revision_shown_in_its_diff`, `Reviewed_import_commits_or_rolls_back_canonical_projection_and_application_metadata`, `Parsing_commits_or_rolls_back_its_entire_import_application`; job missing/stale snapshot and related-text/tailored tests above. [SAVE_CONTRACT](../rd21-remediation/SAVE_CONTRACT.md) inventories endpoints/statuses; [related review](../rd21-remediation/RELATED_REVIEW.md) inventories narrow lifecycle/background writers, extension/create consumers and already-guarded Dashboard/CV/email owners. [MariaDB fixture delta](../../../database/mariadb-standardisation/fixture-delta.json) retains old unversioned failure and explicit3 fixture repairs with original assertions. | Source/caller review plus contract tests, not certification of every independent editor or mixed old/new deployment. Career missing precondition400; valid stale409; job missing/invalid/stale409. Old unversioned writers intentionally fail closed. Extension/bookmarklet is a create consumer. No compatibility alias removal. |
 | Complete affected regression, frozen bytes and no unrelated Identity replay | Historical addendum reports1109 backend,934 frontend/105 suites,362 ordinary,23 separate,56 sidecar and6 remediation cases, separate conforming volume3; explicit obsolete historical diagnostic failures retained. Later MariaDB acceptance reports1123 backend,32 provider,1 provider-browser, corrected diagnostics18 andvolume3. Frozen contracts and canonical/variant/null-as-inherit ownership remain independently mapped in [preservation](PRESERVATION.md); original PDF oracle16/36 pages plus8/24 pages unchanged. Career transaction/Identity failure and read-only coherent snapshot tests cover projection boundary; identity-only endpoint keeps ownership. | These are separate historical lanes, not added totals or fresh full regression. Root must obtain complete fresh successors and frozen-byte/PDF proof on final source. Do not treat database conflict pass as frozen-byte proof, print acceptance or release acceptance. |

-Creation-intent idempotency is explicitly a **separate retained RD21 concern**, not one of the stale-replacement repairs. No new duplicate-create reproduction or idempotency implementation is claimed. Record owner/domain follow-up with interrupted-create/replay semantics and a separate acceptance contract before changing it. Canonical first-save uniqueness is not create-intent idempotency.
+Creation-intent idempotency is explicitly a **separate retained RD21 concern**, not one of the stale-replacement repairs. Fresh HTTP characterization confirms two identical POST bodies can create two distinct durable records; no idempotency implementation or guarantee is claimed. Record owner/domain follow-up with interrupted-create/replay semantics and a separate acceptance contract before changing it. Canonical first-save uniqueness is not create-intent idempotency.

 Historical acknowledged edits lost before repair are not proven recoverable; no live records were inspected. Extraction discard/accept lifecycle concurrency was considered but not reproduced. Independent settings/company/contact records were source-reviewed without a newly reproduced shared RD21 defect; full multi-session acceptance of them is not implied. [RELATED_REVIEW](../rd21-remediation/RELATED_REVIEW.md) preserves these boundaries.

 Current recommendation is therefore conditional on the exact decision: retain **bounded save/concurrency closure from historical MariaDB evidence**, require fresh source-bound successors for this requalification, retain separate idempotency and release limits, and let the root acceptance addendum issue the final RD21/Phase9/Phase10/production decisions. Do not reopen repaired stale loss merely because creation debt remains, and do not close creation debt merely because stale loss is repaired.
+
+## Final fresh decision
+
+**RD21 RESOLVED within its original six repair clauses and tested scope.** Fresh1123 backend,35 actual MariaDB provider cases (32 original plus3 Documents cases),1 native MariaDB recovery journey,2 HTTP durability/characterization cases,6 RD21 browser companions and complete affected frontend/browser regression are recorded in validation.json. Provider tests establish real transaction rollback, revision rejection, held-writer recovery, competing saves, tenant predicates and independent persisted reads; the native journey retains drafts and reviewed retries. No mocked/SQLite case is counted as MariaDB evidence.
+
+The exclusive15-minute MariaDB workload also retains selected exact SQL/API invariants. The whole browser suite ran at5ac1154; four affected settings cases have strict durable-baseline successors at7092697, with no application/binary change. Original frozen-document coverage is Windows PASS, Linux FAIL; that is a separate document-output blocker, not an acknowledged-save loss. Hosted isolation is separately BLOCKED. Creation-intent idempotency, historical lost data, physical/human testing, power-loss durability and production recovery remain outside this bounded resolution. The earlier pending recommendations above are superseded by this final source-bound decision.
@@ -0,0 +1,31 @@
+# P9-REQUAL-01 evidence package
+
+Implementation and requalification from baseline `549b2cba5a791862ba3f854312ea819a86dc42a0`
+on `fix/p9-ci-and-requalification`. Historical reports remain intact. The final dated acceptance
+addendum and [validation ledger](validation.json) are authoritative only after all required
+runtime lanes have been reconciled; a partial collection is not acceptance.
+
+| Record | Purpose |
+| --- | --- |
+| [Plan](PLAN.md) | Approved scope, checkpoints and restrictions |
+| [Finding register](FINDINGS.md) / [JSON](findings.json) |59 independently classified findings, with criteria, evidence, owners and closure requirements |
+| [RD21 closure map](RD21_CLOSURE.md) | Six original repair clauses and bounded save/concurrency evidence |
+| [Hosted CI](CI_FINDINGS.md) / [operator handoff](CI_OPERATOR_HANDOFF.md) | Actual runner isolation blocker and safe recovery prerequisites |
+| [Provider repair](DOCUMENTS_PROVIDER_REPAIR.md) | Reproduced MariaDB Documents UNION defect, narrow fix and real RED/GREEN proof |
+| [Security](SECURITY.md) / [Python gate](PYTHON_SECURITY.md) | Bounded package repairs and retained open advisory requirements |
+| [Preservation](PRESERVATION.md) / [JSON](preservation.json) | All57 groups and33 routes; residual qualifications remain explicit |
+| [Owner-test cards](MANUAL_ACCEPTANCE.md) | M09-01–10, all requiring actual owner/human evidence |
+| [Performance protocol](PERFORMANCE.md) | Exclusive15-minute MariaDB workload, exact-state checks and measurement limits |
+| [Commands](COMMANDS.md) | Reproducible isolated execution and cleanup procedures |
+| [Attempts and repairs](ATTEMPTS_AND_REPAIRS.md) | Retained failures, harness corrections and successor accounting |
+| [Local Docker recovery](LOCAL_DOCKER_RECOVERY.md) | Socket-only preservation; no data reset |
+
+Large raw logs, TRX/Playwright reports, traces, PDFs and screenshots remain under the local ignored
+`.artifacts/p9-requal-01/` directory. Published machine-readable ledgers retain native case identities,
+outcomes and SHA-256 references. Superseded runs are separately archived and never added to final totals.
+
+No main merge, production operation, SQLite retirement, database-version change, Phase10 work or
+C11/P5-13 activation is part of this package. Passing automated checks cannot establish human,
+physical-device, live-provider or production acceptance.
+
+Final: [dated acceptance](ACCEPTANCE_ADDENDUM_2026-10-24.md), [machine decisions](acceptance.json), [source lineage](source-lineage.json), [Linux PDF failure](LINUX_PDF.md), [publication ledger](publication.json), [evidence manifest](evidence-manifest.json). The collector intentionally fails the combined gate for Linux PDF/Python findings; automationComplete is false.
@@ -0,0 +1,144 @@
+# P9-REQUAL-01 independent source review
+
+Date: 2026-10-24. Reviewer: independent AI code-review agent.
+
+Current checkpoint supplied by the qualification owner: `5ac11549b2caa27469aa9fb2b5b9ed402471a453`.
+Application-fix checkpoint supplied by the owner: `2b26953d6f3c3fdacdffefa2c0a696c9084f1afd`.
+These identify the review handoff; this report does not independently verify Git or deployed identity.
+
+This is an AI source review, not manual acceptance, a completed runtime qualification, or final release approval.
+The reviewer made no application changes and ran no tests, builds, browsers, services, or database commands.
+Existing test reports were read as evidence, without rerunning their producers.
+
+## Scope and method
+
+Read the qualification helpers `mariadb-lane.py`, `linux-run.py`, `pdf-proof.py`, and `reconcile.py`;
+the observations, performance, and Linux Playwright configurations and relevant test source;
+and connected browser/database guards and PDF-oracle source.
+Review focused on false PASS results, data scope, cleanup, and preservation assertions.
+Follow-up reviews read the actual fixes and regression source described below.
+
+The application review covered `JobTrackerApi/Services/DocumentsIndexService.cs`, its controller validation,
+the existing MariaDB startup fixture, and `JobTrackerApi.MariaDb.Tests/DocumentsIndexTests.cs`.
+No broad whole-branch acceptance or final addendum review is claimed.
+
+## Finding and resolution
+
+**P2 — successful CREATE could lose cleanup ownership after a diagnostic write failure.**
+In `mariadb-lane.py`, the command executor originally wrote its operation log before returning.
+If `CREATE DATABASE` succeeded but the log write failed, the caller never set `created = True`;
+the final cleanup consequently skipped the generated schema.
+
+The reviewed fix records successful CREATE ownership immediately after the native command returns zero,
+before the log write (`mariadb-lane.py:152`). Failed CREATE does not authorize DROP.
+`test-mariadb-lane.py:17` injects the command outcome and log-write failure; its assertions verify
+a failing invocation, DROP and confirmed schema absence after successful CREATE, and no DROP after failed CREATE.
+The reviewer inspected this regression source. The owner reported two passing offline tests and a retained
+old-source replay with one expected failure; the reviewer did not execute or independently inspect that replay.
+**Disposition: source finding resolved.**
+
+## Follow-up reviews
+
+### Nested Playwright configuration working directories
+
+Reviewed explicit UI working directories in `observations/playwright.config.ts:5`,
+`performance/playwright.config.ts:11`, and `linux/playwright.config.ts:15`.
+These address the owner's observed setup failure caused by inherited server commands resolving against
+the nested configuration directory. They preserve the inherited server settings and isolation behavior.
+No new actionable finding in the fix. Runtime successor results remain the qualification owner's responsibility.
+
+### Persisted Career Profile comparison
+
+Confirmed `JobTrackerApi/Models/StructuredCvProfileJson.cs:9` configures null-property omission and
+`SerializePersisted` at line 79 uses those options; `CareerProfileService.cs:114` uses that serializer for persistence.
+The performance helper at `performance/metrics.mjs:8` applies that representation only to the initial
+comparison between the already-normalized API profile and independently read persisted JSON.
+The synthetic fixture's null object properties are omitted; null array elements and non-null falsy values remain.
+Regression source checks those cases, input immutability, and detection of a non-null content change.
+
+The sole workload call is `performance/sustained.spec.ts:70`. Full API profile equality during and after
+the workload remains, and exact SQL snapshot equality remains at line 172.
+The initial SQL/API revision equality at line 69 adds an assertion. CV settings overrides do not use this helper.
+**No actionable assertion-weakening finding for this fixture and call site.**
+
+### MariaDB documents-index Name projection
+
+Reviewed `DocumentsIndexService.cs:62`: MariaDB converts each of the seven UNION Name expressions to
+`utf8mb4` with `utf8mb4_bin` collation. SQLite retains its original expressions.
+The inserted SQL expressions are compile-time strings; owner, search, filter, and pagination values remain parameters.
+Tenant joins, metadata selection, and read-only query behavior are unchanged by the diff.
+
+Reviewed all three tests in `JobTrackerApi.MariaDb.Tests/DocumentsIndexTests.cs`:
+
+- Line 17: actual startup mixed collations, all seven document sources, counts, pagination, metadata, and unchanged snapshots.
+- Line 57: Unicode/accent search, literal wildcard characters, and deterministic name ties.
+- Line 79: foreign documents and damaged associations, owner-scoped history, filters, and unchanged snapshots.
+
+Read `.artifacts/p9-requal-01/documents-provider-red/mariadb.trx`: all three cases failed with
+`Illegal mix of collations for operation 'UNION'`; counters were 3 executed, 0 passed, 3 failed.
+Read `.artifacts/p9-requal-01/documents-provider-green/mariadb.trx`: the same three test identities passed;
+counters were 3 executed, 3 passed, 0 failed, and 0 not executed.
+These are focused retained reports, not additional full-suite executions.
+**No actionable finding in the provider fix or three regression tests.**
+
+### Strict CV sibling durable baseline at 7092697
+
+Reviewed the sole fixture change in `job-tracker-ui/e2e/cv-settings-presentation.spec.ts:101` at the
+owner-supplied checkpoint `7092697cb3e20a5f22e173648fd544de3de6c553`.
+The initial Linux report and `linux/playwright.log` showed four settings failures whose full-body
+differences were only `updatedAtUtc`: seven fractional digits in POST responses versus at most six
+in durable GET responses. `JobTrackerApi/Migrations/20260830128000_AdoptCvVariantSchema.cs:32`
+and line 33 define the timestamps as `datetime(6)`.
+
+The fixture now checks POST success, obtains the created ID, checks an independent GET succeeds,
+and snapshots its full body before UI actions. The later full-body `toEqual(sibling)` assertion
+remains at line 177, including timestamp, version and settings. No tolerance, normalizer or field
+omission was introduced. This verifies preservation of durable pre-action state; it does not assert
+POST-response timestamp precision survives persistence. **No actionable assertion-weakening finding.**
+
+## Final evidence and acceptance-document review
+
+Read the final `ACCEPTANCE_ADDENDUM_2026-10-24.md`, `acceptance.json`, `findings.json`, the final
+dispositions section of `FINDINGS.md`, `source-lineage.json`, `LINUX_PDF.md`, and selected underlying
+native records. This was a read-only evidence review, not execution of qualification commands.
+
+- `validation.json` records `automationComplete: false`, no runtime drift, Linux PDF FAIL and Python
+  advisory FINDINGS. Other recorded automated lanes have PASS status; their case counts are kept separate.
+- The raw Linux oracle reports contain 9/16 passing fidelity fixtures and 4/8 passing settings fixtures:
+  13/24 pass, 11 fail. Their page totals are 37 and 28, or 65 versus 60 expected. The failed fixture
+  names and extra-page cases agree with `LINUX_PDF.md`. The staging record reports no input drift.
+- `linux/process.json` records browser/process exit zero, 51 migrations before and after, and successful
+  API removal, database disconnection, network removal and generated-schema removal. Producer success
+  is correctly separated from failed PDF output qualification.
+- The retained performance result records 900006.3119 ms, 3382 reads, zero read failures, 20 navigations,
+  zero navigation failures, equal selected before/after snapshots, and successful schema cleanup.
+  This is finite synthetic workload evidence, not a capacity or production guarantee.
+- Comparing the two retained frozen input maps found 1043 entries in each and one changed input:
+  `job-tracker-ui/e2e/cv-settings-presentation.spec.ts`. This agrees with `source-lineage.json`.
+  The four affected Windows successors replace affected evidence; they are not added to the ordinary 362.
+- The findings register has 59 entries with 59 distinct IDs. The final Markdown dispositions retain
+  the Python and Linux output failures, bounded RD21 closure and separate production/manual conditions.
+
+The five decisions are consistent with the evidence reviewed: RD21 RESOLVED within its original six
+save/concurrency clauses and tested scope; hosted MariaDB BLOCKED; Phase9 NO-GO; Phase10 NO-GO;
+production NO-GO. REQUEST section 6 permits unfinished genuine human checks to carry into release gates;
+production-only infrastructure limitations do not independently veto isolated functional QA.
+The confirmed Linux output failure and unclosed critical/high Python risk disposition support the
+Phase9 decision. The Python decision is an explicit acceptance-risk judgment, not a claim that REQUEST
+mechanically rejects every advisory. The Phase10 cleanup prerequisites at
+`docs/redesign/IMPLEMENTATION_PLAN.md:164` independently require unused-route, passing-test and satisfied
+functionality-inventory proof; no cleanup or Phase10 implementation is authorized.
+
+One documentation consistency issue was sent to the owner: the SEC04 JSON evidence still described
+tracked Python summary packaging as pending although the tracked summaries exist. This does not change
+the OPEN/FINDINGS status or any verdict; the owner owns that register correction.
+
+## Review limits
+
+No tests, builds, browser sessions, service actions, database commands or production actions were run
+by this reviewer. Source lineage was compared through retained manifest contents; this review did not
+independently verify Git/remote/deployed identities or recompute every runtime artifact hash.
+Recorded automation and reviewed source do not establish human, physical-device, provider/model or
+production acceptance. No final release approval is granted by this AI review.
+
+Qualification-owner disposition: the SEC04 packaging note was corrected before publication; findings.json now links the completed python-advisories.json and PYTHON_SECURITY.md. OPEN/FINDINGS and coverage INCOMPLETE remain unchanged.
@@ -0,0 +1,25 @@
+{
+  "schemaVersion": 1,
+  "date": "2026-10-24",
+  "branch": "fix/p9-ci-and-requalification",
+  "decisions": {
+    "rd21": "RESOLVED",
+    "hostedMariaDbCi": "BLOCKED",
+    "phase9": "NO-GO",
+    "phase10": "NO-GO",
+    "production": "NO-GO"
+  },
+  "rd21Scope": "Original six save/concurrency requirements; tested local MariaDB12.2.2, not historical lost-data recovery or creation-intent idempotency.",
+  "phase9Blockers": [
+    "P9-REQUAL-PDF01",
+    "P9-REQUAL-SEC04"
+  ],
+  "automationComplete": false,
+  "manual": "M09-01–10 NOT TESTED; no fabricated human/provider/device results",
+  "productionAccess": false,
+  "phase10Implementation": false,
+  "sqliteRetired": false,
+  "mariaDbVersionChanged": false,
+  "sourceLineage": "source-lineage.json",
+  "results": "validation.json"
+}
@@ -0,0 +1,18 @@
+{
+  "observedUtc": "2026-10-24T16:31:37.351654+00:00",
+  "composeProject": "jobtracker-it-p9-requal",
+  "removedContainer": "jobtracker-it-p9-requal-mariadb-test-1",
+  "command": "docker compose -f docker-compose.database.yml -p jobtracker-it-p9-requal --profile integration rm --stop --force mariadb-test",
+  "exitCode": 0,
+  "containerAbsenceVerified": true,
+  "persistentDevContainer": "jobtracker-local-mariadb-dev-1",
+  "persistentDevContainerPreservedStopped": true,
+  "persistentVolumePreserved": "jobtracker-local_mariadb_dev",
+  "productionAccess": false,
+  "linuxOwnedResourcesRemoved": {
+    "apiRemoved": true,
+    "databaseDisconnected": true,
+    "networkRemoved": true,
+    "schemaRemoved": true
+  }
+}
@@ -0,0 +1,28 @@
+{
+  "observedUtc": "2026-10-24T16:31:37.351654+00:00",
+  "reconcilerGuards": {
+    "passed": 12,
+    "exitCode": 0
+  },
+  "mariaDbOwnershipGuards": {
+    "passed": 2,
+    "exitCode": 0
+  },
+  "linuxRunnerGuards": {
+    "passed": 2,
+    "exitCode": 0
+  },
+  "qualificationHelperInputs": 14,
+  "helperDrift": [],
+  "combinedCollectorExitCode": 1,
+  "combinedGateFailures": [
+    "linux-pdf",
+    "python-advisories"
+  ],
+  "gitDiffCheckExitCode": 0,
+  "note": "Offline guards are not provider qualification. Runtime outcomes come from validation.json.",
+  "finalTrackedSecretScan": {
+    "exitCode": 0,
+    "result": "No high-confidence credential patterns in staged/tracked package."
+  }
+}
@@ -3,8 +3,8 @@
  "reportDate": "2026-10-24",
  "baselineCommit": "549b2cba5a791862ba3f854312ea819a86dc42a0",
  "branch": "fix/p9-ci-and-requalification",
-  "scope": "source-based register; historical evidence distinguished from fresh execution; final decisions owned by root acceptance addendum",
-  "freshExecution": "PENDING root-owned validation ledger; this register does not run or attest tests",
+  "scope": "Final source-bound requalification register; historical reports preserved; separate acceptance gates.",
+  "freshExecution": "Complete: validation.json records actual successes and retained Linux PDF/Python failures; automationComplete is false.",
  "gateRules": {
    "phase9": "REQUEST §§6,13,18: classify each item independently; unfinished genuine human checks remain release gates. No production-only condition automatically vetoes local functional QA. Remaining mandatory functional criteria require evidence.",
    "phase10": "IMPLEMENTATION_PLAN.md:164-170: no route uses removed code + tests pass + functionality inventory satisfied. REQUEST prohibits automatically starting Phase10. No blanket conditional deletion eligibility.",
@@ -92,14 +92,18 @@
        {
          "path": "docs/database/mariadb-standardisation/validation.json",
          "kind": "historical raw result index"
+        },
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/validation.json",
+          "kind": "fresh native result ledger; separate lane counts and limits"
        }
      ],
      "severityAndImpact": "High: schema/provider/startup disagreement",
      "dependency": "Production; provider acceptance",
      "ownerAndRequiredClosure": "Database owner: actual approved MariaDB migration, restart, CRUD/constraints/concurrency and effective configuration proof",
-      "status": "MariaDB 12.2.2 RD21 runtime scope verified historically (32 provider cases, 1 native journey); broader provider/deployment parity still PARTIAL",
+      "status": "Fresh MariaDB12.2.2:35 integration cases,1 native recovery,2 HTTP cases and15-minute workload PASS; broader deployed parity remains PARTIAL.",
      "gates": {
-        "phase9": "bounded provider save qualification historical PASS; full fresh matrix pending",
+        "phase9": "Local bounded provider qualification PASS; deployed parity remains independent.",
        "phase10": "provider migration proof per candidate",
        "production": "BLOCKED exact deployed parity/migrations",
        "debt": "partial broad provider qualification"
@@ -150,15 +154,19 @@
        {
          "kind": "current root-reported hosted investigation; final evidence pending root CI report",
          "detail": "Merged host Docker socket binding found. No privileged socket fallback or production host access authorized; explicit blocked workflow gate retained."
+        },
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/validation.json",
+          "kind": "fresh native result ledger; separate lane counts and limits"
        }
      ],
      "severityAndImpact": "High: healthy endpoint may serve wrong release",
      "dependency": "Production",
      "ownerAndRequiredClosure": "CI/operator owner: prove isolated private service execution and lifecycle without host socket/privileges/public ports/production coupling, then successful exact hosted TRX and cleanup. Keep workflow BLOCKED while isolation cannot be proven. Separate deployed runner/storage/release identity remains unqualified.",
-      "status": "Hosted database lane BLOCKED: root investigation found merged runner host Docker socket binding; private service isolation/lifecycle unknown. Local historical MariaDB proof is independent.",
+      "status": "Hosted MariaDB BLOCKED: inspected847/849 fail first isolation gate; no database tests. Existing host network/socket binding is not safe service isolation.",
      "gates": {
-        "phase9": "fresh required CI pending root evidence",
-        "phase10": "testpass criterion pending root evidence",
+        "phase9": "Hosted automation infrastructure BLOCKED; not an executed MariaDB failure.",
+        "phase10": "Hosted pipeline remains BLOCKED; no automatic cleanup permission.",
        "production": "BLOCKED deployed identity and operator diagnosis",
        "debt": "open CI/release qualification"
      }
@@ -288,12 +296,16 @@
        {
          "path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
          "kind": "historical assessment"
+        },
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/validation.json",
+          "kind": "fresh native result ledger; separate lane counts and limits"
        }
      ],
      "severityAndImpact": "Medium/High document reliability",
      "dependency": "Acceptance qualification; production",
      "ownerAndRequiredClosure": "Document owner: intended Linux/fonts/photo/crop/print and alternate-browser proof, original bytes/geometry",
-      "status": "PARTIAL: native local PDF corpus and visual sheets; deployed fonts/photo/print absent",
+      "status": "Windows24 fixtures/60 pages PASS; Linux13/24 fixtures PASS,65 exported versus60 expected pages: P9-REQUAL-PDF01 OPEN; physical printing NOT TESTED.",
      "gates": {
        "phase9": "finite output qualification; human/Linux/print not passed",
        "phase10": "affected rendering must preserve output contracts",
@@ -477,14 +489,18 @@
        {
          "path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
          "kind": "historical assessment"
+        },
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/validation.json",
+          "kind": "fresh native result ledger; separate lane counts and limits"
        }
      ],
      "severityAndImpact": "Medium: growing rendering cost",
      "dependency": "Performance qualification",
      "ownerAndRequiredClosure": "Jobs owner: agreed budget, bounded sustained profile and CPU/frame attribution before optimization; preserve full membership",
-      "status": "Board remains O(N); 200/1,000-job and new bounded 250-job observations are finite",
+      "status": "Finite exclusive MariaDB workload PASS:250 applications,2 readers,900006ms,3382 reads,20 navigations,zero failures and selected exact-state checks; no capacity SLA.",
      "gates": {
-        "phase9": "finite capacity evidence; fresh sustained lane pending",
+        "phase9": "Finite15-minute local MariaDB workload PASS; no capacity SLA.",
        "phase10": "measured bottleneck and full membership before optimization",
        "production": "no production capacity/SLA claim",
        "debt": "O(N) known design limit"
@@ -593,14 +609,18 @@
        {
          "path": "docs/database/mariadb-standardisation/validation.json",
          "kind": "historical raw result index"
+        },
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/validation.json",
+          "kind": "fresh native result ledger; separate lane counts and limits"
        }
      ],
      "severityAndImpact": "High: stale editor can overwrite acknowledged edits",
      "dependency": "Data-integrity acceptance; production",
      "ownerAndRequiredClosure": "Domain/API/UI owners: separate bounded contract issue covering both callers, server compare-and-swap/transaction semantics, conflict recovery and backward compatibility; characterization is not safety acceptance",
-      "status": "RESOLVED within qualified MariaDB 12.2.2 save/concurrency scope; current branch successor qualification pending root ledger; creation-intent idempotency remains separate OPEN debt",
+      "status": "RESOLVED within original six save/concurrency clauses and tested scope; fresh source-bound provider/browser/regression evidence. Creation-intent idempotency remains separate OPEN debt.",
      "gates": {
-        "phase9": "bounded save/concurrency resolved historically; fresh full successor pending; creation idempotency separate",
+        "phase9": "Original six save/concurrency requirements RESOLVED in tested scope; separate creation debt retained.",
        "phase10": "no compatibility removal without all-caller/rollback proof",
        "production": "BLOCKED deployment/rollback parity; no historical recovery claim",
        "debt": "creation-intent idempotency OPEN, separate concern"
@@ -852,15 +872,19 @@
        {
          "kind": "fresh Python risk observation",
          "detail": "P9-REQUAL-SEC04 retains locked Python critical/high provider labels and incomplete query coverage; post-pin NuGet/npm zero audits do not establish blanket security PASS."
+        },
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/validation.json",
+          "kind": "fresh native result ledger; separate lane counts and limits"
        }
      ],
      "severityAndImpact": "High dependency risk until assessed",
      "dependency": "Production",
      "ownerAndRequiredClosure": "Dependency owner: retain exact live audit paths/identifiers/severities and reachability analysis, minimally update compatible pins, run complete affected and full successors on frozen source, refresh raw advisories, retain actual residuals. Offline policy pass cannot clear live advisories or prove production repaired.",
-      "status": "Inherited advisory/review gate retained. Fresh live audit observations linked as P9-REQUAL-SEC01–03; compatible local pins and post-pin audits zero, full final-source successors pending. No production deployment or app-reachable exploit claimed. Fresh locked Python advisory finding P9-REQUAL-SEC04 is OPEN with INCOMPLETE coverage; no blanket security PASS.",
+      "status": "Compatible NuGet/npm repairs and fresh regression PASS; Python P9-REQUAL-SEC04 OPEN, coverage INCOMPLETE. No blanket security PASS.",
      "gates": {
-        "phase9": "local dependency fixes and post-pin zero audits recorded; complete frozen successors pending",
-        "phase10": "testpass criterion pending final dependency source",
+        "phase9": "Compatible repairs and fresh successors PASS; Python advisory risk disposition remains OPEN.",
+        "phase10": "Unwaived Python gate and affected Linux fidelity failure; no cleanup permission.",
        "production": "BLOCKED independent deployed versions, exposure and release gates; no production fix claimed",
        "debt": "inherited live-advisory gate retained; three new observations independently tracked"
      }
@@ -879,12 +903,16 @@
        {
          "path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
          "kind": "historical assessment"
+        },
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/validation.json",
+          "kind": "fresh native result ledger; separate lane counts and limits"
        }
      ],
      "severityAndImpact": "Resolved for published checkpoint; final commit still needs its own direct equality proof",
      "dependency": "Final publication / handoff completeness",
      "ownerAndRequiredClosure": "QA: retain failed attempts and verify each subsequent normal push; no force push",
-      "status": "Initial HTTP502 blockage recovered on23October; all checkpoint ancestors published in normal push; direct feature equality verified at `0fb108bd673ea91749f6fa057295e5b6d15d557f`",
+      "status": "Normal checkpoint pushes verified through7092697; final publication follows ledger and direct remote receipt. No force-push or main change.",
      "gates": {
        "phase9": "not a standalone functional defect; retain stated qualification",
        "phase10": "no permission to delete; affected-candidate proof",
@@ -906,12 +934,16 @@
          "path": "docs/redesign/phase-9/p9-06/DEFECTS.md",
          "kind": "historical defect/reproduction/closure record",
          "detail": "Entry sidecar 55 pass/1 fail (missing PID); isolated run passes; explicit slow startup reproduces the race. Fixture now waits for its child PID before the unchanged 200 ms deadline. Real process-tree kill and HTTP 504 assertions retained. Focused green and full 56/56 successor. No parser product change."
+        },
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/validation.json",
+          "kind": "fresh native result ledger; separate lane counts and limits"
        }
      ],
      "severityAndImpact": "Medium test reliability: parser descendant test could time out before it had a descendant",
      "dependency": "Resolved in tested Windows environment; Linux run remains separate.",
      "ownerAndRequiredClosure": "QA; `.artifacts/phase9/sidecar-entry-failed.*`, `sidecar-fixture-red.*`, `sidecar-fixture-green.*`, `sidecar.xml`",
-      "status": "RESOLVED within historical tested scope; fresh successor pending",
+      "status": "RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged.",
      "gates": {
        "phase9": "fresh affected regression required",
        "phase10": "candidate proof only; no cleanup authority",
@@ -933,12 +965,16 @@
          "path": "docs/redesign/phase-9/p9-06/DEFECTS.md",
          "kind": "historical defect/reproduction/closure record",
          "detail": "Sole DataGrid owner omitted localeText. New English desktop test passes while Bokmål fails to find “Rader per side:”. Reuse installed `nbNO` locale in AdminUsersPage. Focused 12/12 green; first integrated Jest919/104 and native desktop matrix green; final complete successors recorded in validation.json."
+        },
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/validation.json",
+          "kind": "fresh native result ledger; separate lane counts and limits"
        }
      ],
      "severityAndImpact": "Low localisation defect: Admin grid vendor controls appear in English in Bokmål",
      "dependency": "Resolved in observed local integration; no authorisation, pagination or data contract change.",
      "ownerAndRequiredClosure": "Frontend; `admin-users-page.test.tsx`, `AdminUsersPage.tsx`; retained RED/GREEN logs/JSON",
-      "status": "RESOLVED within historical tested scope; fresh successor pending",
+      "status": "RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged.",
      "gates": {
        "phase9": "fresh affected regression required",
        "phase10": "candidate proof only; no cleanup authority",
@@ -960,12 +996,16 @@
          "path": "docs/redesign/phase-9/p9-06/DEFECTS.md",
          "kind": "historical defect/reproduction/closure record",
          "detail": "Four larger h2 owners inherited a fixed body line height. Original native geometry2/2 RED; explicit lineHeight1.4 now2/2 GREEN across16 width/theme/locale vectors; independent EN/light and NB/dark PNG inspection confirms separation. Intermediate1.2 still failed unchanged geometry assertions and was superseded."
+        },
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/validation.json",
+          "kind": "fresh native result ledger; separate lane counts and limits"
        }
      ],
      "severityAndImpact": "Medium visual defect: wrapped public h2 lines overlap at320px in EN/NB",
      "dependency": "Bounded fix verified by native geometry/build; the complete final 362-case ordinary successor also passed.",
      "ownerAndRequiredClosure": "Frontend; `LandingPage.tsx`, new `landing-presentation.spec.ts`; `landing-red`, `landing-qualified`, `landing-accepted` raw reports",
-      "status": "RESOLVED within historical tested scope; fresh successor pending",
+      "status": "RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged.",
      "gates": {
        "phase9": "fresh affected regression required",
        "phase10": "candidate proof only; no cleanup authority",
@@ -988,12 +1028,16 @@
          "path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
          "kind": "historical separate bottom CTA repair and complete 362-case ordinary successor",
          "detail": "Existing bottom CTA owner inherited fixed body line height; explicit1.4 repair retains exact translated CTA plus all four h2s in both native landing cases. Both languages failed before and passed after. Original-width inspection of all four320px green images retained."
+        },
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/validation.json",
+          "kind": "fresh native result ledger; separate lane counts and limits"
        }
      ],
      "severityAndImpact": "Medium visual defect: wrapped bottom CTA title lines overlapped",
      "dependency": "LandingPage bottom CTA owner and landing-presentation.spec.ts; exact EN/NB, theme/width geometry and original image evidence",
      "ownerAndRequiredClosure": "Frontend/QA: preserve existing LandingPage lineHeight1.4 and exact CTA+heading geometry assertions; qualify fresh complete landing and ordinary successors on frozen source, retain original RED/GREEN evidence and native-width images",
-      "status": "RESOLVED within historical tested scope; fresh successor pending",
+      "status": "RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged.",
      "gates": {
        "phase9": "fresh affected regression required",
        "phase10": "candidate proof only; no cleanup authority",
@@ -1042,12 +1086,16 @@
          "path": "docs/redesign/phase-9/p9-06/DEFECTS.md",
          "kind": "historical defect/reproduction/closure record",
          "detail": "First native shard97pass/1fail: no button named “Go to next page” in NB. The installed locale exposes “Gå til neste side”. Locator now uses installed enUS/nbNO pagination names; the six original width/locale/theme, long-identity, page-change, focus/reachability and no-write assertions remain. Focused 1/1 green; the final isolated 98-case shard and complete 362-case successor passed."
+        },
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/validation.json",
+          "kind": "fresh native result ledger; separate lane counts and limits"
        }
      ],
      "severityAndImpact": "Low test compatibility: existing Admin pagination fixture hard-coded the English vendor accessible name in Bokmål mode",
      "dependency": "Test-only repair; no product or authorisation change.",
      "ownerAndRequiredClosure": "QA; `phase7-admin-users.spec.ts`; original shard report/trace and `admin-grid-green` retained. Other English-name callers belong to the separate English JobTable owner and remain unchanged.",
-      "status": "RESOLVED within historical tested scope; fresh successor pending",
+      "status": "RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged.",
      "gates": {
        "phase9": "fresh affected regression required",
        "phase10": "candidate proof only; no cleanup authority",
@@ -1098,12 +1146,16 @@
        {
          "path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
          "kind": "historical 87 pass/1 fail then full corrected successor"
+        },
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/validation.json",
+          "kind": "fresh native result ledger; separate lane counts and limits"
        }
      ],
      "severityAndImpact": "High test isolation",
      "dependency": "controlled native fixture; production worker unchanged",
      "ownerAndRequiredClosure": "QA: retain failed run, unchanged no-write assertions, fixture config delta and fresh full successor",
-      "status": "RESOLVED historical fixture; fresh successor pending",
+      "status": "RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged.",
      "gates": {
        "phase9": "fresh exact fixture/case successor",
        "phase10": "preserve isolation and assertions",
@@ -1473,14 +1525,18 @@
        {
          "kind": "root-reported post-pin checks",
          "detail": "Backend1123/1123, MariaDB32/32, build/types/lint pass. Frontend and full browser successors pending. Do not add repeated/focused counts or qualify final source with pre-pin frontend934."
+        },
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/validation.json",
+          "kind": "fresh native result ledger; separate lane counts and limits"
        }
      ],
      "severityAndImpact": "High GHSA-846f-f764-76mx SignedCms CPU exhaustion; Moderate GHSA-2fmv-rv2c-59x7 Windows EnvelopedCms behavior. Vulnerable package presence established; application reachability/exploit not claimed.",
      "dependency": "compatible locked dependency correction plus complete affected/frozen-source successor qualification",
      "ownerAndRequiredClosure": "Dependency/QA owner: Direct compatible package override System.Security.Cryptography.Pkcs8.0.2; retain MimeKit4.17.0 ownership. Retain before/after advisory paths, raw hashes and exact lock/pin delta; complete frontend/browser and required full successors, then bind all reports to final source. Production deployed dependencies/exposure remain independent.",
-      "status": "LOCALLY REMEDIATED; post-pin audits zero; complete final-source successor validation PENDING; production NOT DEPLOYED",
+      "status": "LOCALLY REMEDIATED; post-pin audits zero and complete affected frozen-source successors PASS; production NOT DEPLOYED.",
      "gates": {
-        "phase9": "bounded dependency remediation observed locally; full frozen successor qualification pending",
+        "phase9": "Bounded compatible repair and affected regression PASS; independent Python gate remains open.",
        "phase10": "testpass and functionality-inventory criteria still require final complete evidence; no cleanup authority",
        "production": "NOT DEPLOYED; no deployed fix or app-reachable exploit claim; independent release gates retained",
        "debt": "published vulnerable package version repaired locally; remaining evidence qualification"
@@ -1516,14 +1572,18 @@
        {
          "kind": "root-reported post-pin checks",
          "detail": "Backend1123/1123, MariaDB32/32, build/types/lint pass. Frontend and full browser successors pending. Do not add repeated/focused counts or qualify final source with pre-pin frontend934."
+        },
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/validation.json",
+          "kind": "fresh native result ledger; separate lane counts and limits"
        }
      ],
      "severityAndImpact": "Critical package advisories GHSA-2464-fhr4-w9xw, GHSA-p3m5-59mp-jv5r and GHSA-673q-mjm6-r5xr. Vulnerable package presence is distinct from reachable deployed paths; no application exploit claimed.",
      "dependency": "compatible locked dependency correction plus complete affected/frozen-source successor qualification",
      "ownerAndRequiredClosure": "Dependency/QA owner: Pin Next and eslint-config-next exactly16.4.1. Existing static export, unoptimized images and Sharp0.35.5 mitigate the image-serving path; they do not close every package advisory. Retain before/after advisory paths, raw hashes and exact lock/pin delta; complete frontend/browser and required full successors, then bind all reports to final source. Production deployed dependencies/exposure remain independent.",
-      "status": "LOCALLY REMEDIATED; post-pin audits zero; complete final-source successor validation PENDING; production NOT DEPLOYED",
+      "status": "LOCALLY REMEDIATED; post-pin audits zero and complete affected frozen-source successors PASS; production NOT DEPLOYED.",
      "gates": {
-        "phase9": "bounded dependency remediation observed locally; full frozen successor qualification pending",
+        "phase9": "Bounded compatible repair and affected regression PASS; independent Python gate remains open.",
        "phase10": "testpass and functionality-inventory criteria still require final complete evidence; no cleanup authority",
        "production": "NOT DEPLOYED; no deployed fix or app-reachable exploit claim; independent release gates retained",
        "debt": "published vulnerable package version repaired locally; remaining evidence qualification"
@@ -1559,14 +1619,18 @@
        {
          "kind": "root-reported post-pin checks",
          "detail": "Backend1123/1123, MariaDB32/32, build/types/lint pass. Frontend and full browser successors pending. Do not add repeated/focused counts or qualify final source with pre-pin frontend934."
+        },
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/validation.json",
+          "kind": "fresh native result ledger; separate lane counts and limits"
        }
      ],
      "severityAndImpact": "High GHSA-mrhx-c7xc-m3w5 in development dependency graph. No production application reachability/exploit claimed.",
      "dependency": "compatible locked dependency correction plus complete affected/frozen-source successor qualification",
      "ownerAndRequiredClosure": "Dependency/QA owner: Use compatible existing ^4 dependency range via Zod4.6.6 override; do not add runtime functionality. Retain before/after advisory paths, raw hashes and exact lock/pin delta; complete frontend/browser and required full successors, then bind all reports to final source. Production deployed dependencies/exposure remain independent.",
-      "status": "LOCALLY REMEDIATED; post-pin audits zero; complete final-source successor validation PENDING; production NOT DEPLOYED",
+      "status": "LOCALLY REMEDIATED; post-pin audits zero and complete affected frozen-source successors PASS; production NOT DEPLOYED.",
      "gates": {
-        "phase9": "bounded dependency remediation observed locally; full frozen successor qualification pending",
+        "phase9": "Bounded compatible repair and affected regression PASS; independent Python gate remains open.",
        "phase10": "testpass and functionality-inventory criteria still require final complete evidence; no cleanup authority",
        "production": "NOT DEPLOYED; no deployed fix or app-reachable exploit claim; independent release gates retained",
        "debt": "published vulnerable package version repaired locally; remaining evidence qualification"
@@ -1583,7 +1647,7 @@
        },
        {
          "path": ".artifacts/p9-requal-01/security/python-locked/",
-          "kind": "fresh exact locked Python provider query evidence; root/CI-owned tracked summary pending"
+          "kind": "fresh exact locked Python provider queries; completed tracked summaries linked below"
        }
      ],
      "evidence": [
@@ -1594,8 +1658,13 @@
          "lockedFileSha256": "36f2912965d183e59f2d8320f3817ca8dd0fee6d76e05cfd63ac92defe6c6031"
        },
        {
-          "kind": "pending tracked evidence packaging",
-          "detail": "CI agent preparing python-advisories.json and PYTHON_SECURITY.md; exact paths/final report hashes owned by root/CI ledger. No completed tracked summary claimed by this register."
+          "path": "docs/redesign/phase-9/p9-requal-01/python-advisories.json",
+          "kind": "completed machine-readable advisory summary",
+          "detail": "See PYTHON_SECURITY.md for current reviewed call sites and limitations. Findings remain OPEN and coverage INCOMPLETE; applicability and exploitability are not fully assessed."
+        },
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/validation.json",
+          "kind": "fresh native result ledger; separate lane counts and limits"
        }
      ],
      "severityAndImpact": "Critical/high provider-labelled advisories among locked packages; exploitability not assessed; coverage INCOMPLETE due one provider query404",
@@ -1623,18 +1692,55 @@
        {
          "path": "docs/redesign/phase-9/p9-requal-01/DOCUMENTS_PROVIDER_REPAIR.md",
          "kind": "verified provider defect, targeted RED/GREEN, full backend and35-case provider successor"
+        },
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/validation.json",
+          "kind": "fresh native result ledger; separate lane counts and limits"
        }
      ],
      "severityAndImpact": "High functional provider defect: Documents index returns500 on actual MariaDB startup schema; no acknowledged-save loss reproduced",
      "dependency": "MariaDB document query qualification and sustained workload preflight",
      "ownerAndRequiredClosure": "API DocumentsIndexService owner: narrow read-only projection fix, actual MariaDB regression including tenant/search/data preservation, fresh affected full successors",
-      "status": "LOCALLY REPAIRED at2b26953; targeted3/3 and full35/35 MariaDB plus1123/1123 backend PASS; broad successor checkpoint pending",
+      "status": "LOCALLY REPAIRED at2b26953; three real RED/GREEN cases, full35 MariaDB/1123 backend and complete successor browser/workload PASS.",
      "gates": {
-        "phase9": "provider query repair proven; fresh complete successor qualification pending",
+        "phase9": "Provider query repair and complete successor qualification PASS within tested scope.",
        "phase10": "not permission to remove provider/schema/alias compatibility",
        "production": "withheld: no production operation or deployed qualification",
        "debt": "no schema/table collation migration required for this repair"
      }
+    },
+    {
+      "id": "P9-REQUAL-PDF01",
+      "aliases": [
+        "RD10"
+      ],
+      "criterion": "Preview/export document fidelity on intended Linux rendering configuration; unchanged two corpora and geometry/page oracle.",
+      "source": [
+        {
+          "path": "docs/redesign/phase-9/REQUEST.md",
+          "section": "10: PDF and print validation"
+        }
+      ],
+      "evidence": [
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/LINUX_PDF.md",
+          "kind": "fresh real Linux renderer and unchanged oracle results"
+        },
+        {
+          "path": "docs/redesign/phase-9/p9-requal-01/validation.json",
+          "kind": "native reports and source hashes"
+        }
+      ],
+      "severityAndImpact": "High: exported documents shift geometry and gain pages relative to preview.",
+      "dependency": "Document renderer, fonts, browser/runtime and preservation contracts",
+      "ownerAndRequiredClosure": "Document-rendering owner: reproduce font/browser/layout causes, minimally repair approved Linux configuration or shared owner with failing regression proof; pass unchanged24-fixture/60-page oracles and affected regression while preserving document bytes/typography contracts. Physical printing separate.",
+      "status": "OPEN: Linux producer5/5 PASS but fidelity9/16 and settings4/8 PASS;65 exported versus60 expected pages. Root cause not yet isolated.",
+      "gates": {
+        "phase9": "BLOCKER: measured functional output failure, not absent human evidence.",
+        "phase10": "Unwaived affected functionality/testpass failure; no cleanup permission.",
+        "production": "BLOCKED Linux document fidelity plus independent print/release checks.",
+        "debt": "Confirmed defect; not optional optimization."
+      }
    }
  ]
 }
@@ -3814,5 +3814,15 @@
        "debt": "no deletion authority"
      }
    }
-  ]
+  ],
+  "freshQualification": {
+    "ledger": "validation.json",
+    "sourceLineage": "source-lineage.json",
+    "ordinaryCases": 362,
+    "diagnosticsCases": 18,
+    "routes": 33,
+    "windowsPdf": "24/24 PASS",
+    "linuxPdf": "13/24 PASS; P9-REQUAL-PDF01 OPEN",
+    "policy": "Tagged finite cases are not full capability acceptance. No group status promoted;56 PARTIAL/C11 DEFERRED."
+  }
 }
@@ -0,0 +1,21 @@
+{
+  "observedUtc": "2026-10-24T16:31:37.351654+00:00",
+  "branch": "fix/p9-ci-and-requalification",
+  "baseline": "549b2cba5a791862ba3f854312ea819a86dc42a0",
+  "rd21Ancestor": "0d16a691e0249fe1264bf960de5e59eaa9b87fed",
+  "publishedCheckpoints": [
+    "75cd04cfc2da0837b556bdcf1424846349c4c73d",
+    "780b9bc64f0923237c5a03f89d240bbe331f058e",
+    "1a1b7c82213c24fbbc9bd4e1553a92f4c76eabd9",
+    "2b26953d6f3c3fdacdffefa2c0a696c9084f1afd",
+    "5ac11549b2caa27469aa9fb2b5b9ed402471a453",
+    "7092697cb3e20a5f22e173648fd544de3de6c553"
+  ],
+  "verifiedPrePublicationHead": "7092697cb3e20a5f22e173648fd544de3de6c553",
+  "verifiedRemoteTrackingHead": "7092697cb3e20a5f22e173648fd544de3de6c553",
+  "localMain": "5f835e54a9b74e6b71418422e28431b2af06453f",
+  "remoteTrackingMain": "5f835e54a9b74e6b71418422e28431b2af06453f",
+  "pushPolicy": "Normal pushes only. Final evidence commit identity is the commit containing this ledger; verified directly after publication and reported to user. A self-containing commit cannot record its own hash.",
+  "deployment": false,
+  "mainMerged": false
+}
@@ -0,0 +1,22 @@
+{
+  "observedUtc": "2026-10-24T16:16:24.813220+00:00",
+  "applicationRepairCommit": "2b26953",
+  "fixtureSuccessor": "durable CV sibling readback; no app/binary changes",
+  "predecessor": "attempts/linux-timestamp-baseline/qualification-inputs.json",
+  "inputs": {
+    "docs/redesign/phase-9/p9-requal-01/linux/playwright.config.ts": "89f12b541a018789798d118c66f748963ede2c10b008a3e4c0e79140899f06a0",
+    "docs/redesign/phase-9/p9-requal-01/linux-run.py": "5750ee3939596470fac9f8f860de3b39f2fd8796ff7282ea00406911571e7d0b",
+    "docs/redesign/phase-9/p9-requal-01/mariadb-lane.py": "b9b4c75a556bb2d38293db5959887c175ee43036f6e71592d31f552df7decbb6",
+    "docs/redesign/phase-9/p9-requal-01/observations/persistence.spec.ts": "8a85878b9b39b142738adb150c92e7a73dd9dee87a17b69a48c96d045cdc516b",
+    "docs/redesign/phase-9/p9-requal-01/observations/playwright.config.ts": "05f53ebf7eb1786a57eac32289346d27641609815a2127ad1641c0ebc27fda81",
+    "docs/redesign/phase-9/p9-requal-01/pdf-proof.py": "958f9d88a4475c78a20dee1f76fa961885cbfdef4212e45eca18eac4ffa85b9a",
+    "docs/redesign/phase-9/p9-requal-01/performance/mariadb-proof.mjs": "d0ead1e67db241f478b28fcb57c55a9932a41f45fe4e6de2104fc28c636810bc",
+    "docs/redesign/phase-9/p9-requal-01/performance/metrics.mjs": "fc61dec32c67c30b26d8c07c9224685847526856a8b1bf345873cf5c11d554ba",
+    "docs/redesign/phase-9/p9-requal-01/performance/playwright.config.ts": "68308727bd544a82cebc640b0a84c732cc70d23283c3b9d1c6c5a8d6c939d99b",
+    "docs/redesign/phase-9/p9-requal-01/performance/sustained.spec.ts": "7bc1fb44a077865149ce28fb15ecae37ce2e01baebb444cb7ae9bd7e8efad010",
+    "docs/redesign/phase-9/p9-requal-01/reconcile.py": "7b96482362341b2572b8b4b7f682811eeb005b42ebc039fc08126bde5c533f78",
+    "docs/redesign/phase-9/p9-requal-01/test-linux-run.py": "feaafae7d85642c33208c86a6c76ff132f409a00bc71087db938cf46fee05c16",
+    "docs/redesign/phase-9/p9-requal-01/test-mariadb-lane.py": "7cc4b7a892d44a8b3dd305474a3bbfc8afd33e912b645be769416317cadf1e17",
+    "docs/redesign/phase-9/p9-requal-01/test-reconcile.py": "34a9428edfc34e192b1db200da5fbe49bc15588e725c8eae9b37e6ee76634304"
+  }
+}
@@ -0,0 +1,15 @@
+{
+  "schemaVersion": 1,
+  "wholeSuiteCheckpoint": "5ac11549b2caa27469aa9fb2b5b9ed402471a453",
+  "fixtureSuccessorCommit": "7092697cb3e20a5f22e173648fd544de3de6c553",
+  "inputCount": 1043,
+  "changedInputs": [
+    "job-tracker-ui/e2e/cv-settings-presentation.spec.ts"
+  ],
+  "allOtherFrozenInputsIdentical": true,
+  "ordinaryWholeSuite": 362,
+  "affectedWindowsSuccessor": 4,
+  "linuxSuccessor": 5,
+  "countPolicy": "Affected successors replace affected evidence; never add4 to362. Whole suite ran before this sole fixture change. Application/static export/assemblies unchanged.",
+  "predecessorManifest": "attempts/linux-timestamp-baseline/source-freeze.json"
+}
@@ -141,3 +141,9 @@ Operations **c5176e3251c869e13284b994b59b2f7aa9220eb1** is normally pushed and d
 # Phase 8 acceptance checkpoint

 - [x] Dashboard customisation P8-00–P8-05 implemented and locally validated on `feature/phase8-dashboard-customisation`; [final acceptance and Phase9 handoff](../redesign/phase-8/p8-05/FINAL_ACCEPTANCE.md). Phase8 CONDITIONAL GO; Phase9 readiness CONDITIONAL GO; production NO-GO. Human/device/provider/performance/release qualifications remain; no main merge, deployment or Phase9/10 execution.
+
+# P9-REQUAL-01 final checkpoint — 24 October 2026
+
+- [x] Implement bounded requalification and publish evidence on `fix/p9-ci-and-requalification`; see [final addendum](../redesign/phase-9/p9-requal-01/ACCEPTANCE_ADDENDUM_2026-10-24.md). RD21 RESOLVED within tested scope.
+- [ ] Resolve P9-REQUAL-PDF01 Linux fidelity failures and assess/remediate P9-REQUAL-SEC04 Python advisories with qualified successors.
+- [ ] Operator: isolated hosted runner/service lifecycle evidence; owner: applicable M09 human/device/provider cards. Hosted BLOCKED; Phase9/Phase10/production NO-GO. No Phase10 implementation, main merge or production changes.