# Regression evidence — 2026-10-27

This report distinguishes the starting baseline, successor/focused checks and final full-suite lanes. Overlapping runs are never summed. Historical import/editor evidence is preserved. Final machine reconciliation is `evidence-summary.json`; it is authoritative only after all producer exits, source/runtime bindings, exact discovery membership and cleanup checks pass.

| Lane | Verified import baseline | Current evidence |
|---|---:|---|
| Release backend | 1,260 | **1,336 passed**, zero skipped, `final-01/backend/backend.trx`; native exit0 |
| Frontend | 990 /108 suites | **995 passed /109 suites**, zero failed/pending, `frontend-final-01/frontend.json`; before/after359-source identity retained |
| TypeScript / lint / static build | Passed | Passed, each native exit0; `frontend-final-01/processes.json` |
| Ordinary browser / preservation contracts | 364 | **364 passed**, zero skips/retries; exact discovery membership across100/88/89/87 shards; source/runtime closure passed |
| Separate browser configurations | 53 | **53 passed**, zero skips/retries; controlledAI2, auth2, rate9, ingress6, PDF-admission1, preferences3, RD216, diagnostics18, volume3, RD21-volume3 |
| Real Docling import journeys | 2 | **6 passed**, zero retries/skips: retained2 plus new4, `real-browser-01.json` |
| Actual disposable MariaDB | 70 | **80 passed**, zero skipped, including actual precommit connection loss/rollback/retry; startup/restore/test/cleanup0 |
| Offline Python application/security/grounding/adapter | 76 | **76 passed**, `independent-02/python-offline.log`; model loading disabled, no network |
| Real Docling parser/security | 14 | **14 passed**, separate pinned slim runtime, `independent-02/python-docling.log` |
| Original corpus generator/oracle self-checks | 11 | **11 passed**, unchanged tests/annotations |
| New structural corpus/oracle self-checks | — | **9 passed**, separate corpus |
| Node helper contracts | 25 | **25 passed** |
| Linux harness offline contracts | 11 | **11 passed** |
| Legacy insert-only seed guard self-check | 24 | **24 passed**, own temporary SQLite only |
| Windows original CV / letter oracles | 24CV +4letters | **24 CV /60 pages and4 letters /14 pages passed**, unchanged oracles |
| Linux original CV / letter oracles | 24CV +4letters | **24 CV /60 pages and4 letters /14 pages passed**; native renderer6 passed, image/source/DLL/migration and owned cleanup verified |
| Additional actual import PDFs | 2 | **6 rendered**, all searchable; four new-journey semantic marker oracles passed |
| Long actual import / extra PDFs | — | **1 additional browser case passed**, producing3 four-page PDFs; all142 markers and12 record associations per document, physical dimensions and word bounds passed |
| Static security diff | — | **0 findings**,35 paths; separate from runtime/security acceptance |
| Advisory checks | Zero reported within scoped audits | Fresh npm881 dependencies, CV-import lock48 dependencies, NuGet API including transitive: zero reported known advisories; inherited model/cache scan limits remain |

Evidence roots are `.artifacts/cv-integration-qa/` except the unchanged Linux helper's guarded output under `.artifacts/cv-ux-01/cv-qa-linux-*`. Native timestamps remain UTC as recorded; reports use the client's local 27 October date. Current-source full browser lanes serialize builds and producers to prevent apphost/runtime drift.

The full freeze began at Git HEAD `5e68848` with the later QA changes present in its worktree. Its before/after source hashes include those actual files; committing them as `48b899c`, `cf0e5c2` and `89974a2` did not change their bytes. Application content corresponds to `89974a2`; Git HEAD alone is not used as evidence of tested content. Each native lane retains its own runtime/image identity. Later documentation and separately qualified test-only additions do not retroactively change the tested application inputs.

Final reconciliation passed: **911 frozen files unchanged**, three added test/config files separately hashed before/after, all current hashes matched, exact ordinary discovery membership, native process exits and Linux/provider/sidecar cleanup checked. The added files were qualified by a fresh full frontend995/109 run, TypeScript, targeted lint, MariaDB80 and the long real-import lane. The static application build is retained because application/build inputs did not change. Do not add either frontend run to the other, or add focused126 to backend1336. Real import browser total is **6 +1 =7**, outside ordinary364. Total additional imported PDFs is **6 +3 =9 documents /18 pages**.

## Separate lanes and qualification boundaries

The final full runner retains separate controlled-AI, authentication recovery, rate-limit, ingress, PDF-admission, preference-concurrency, RD21, diagnostic and volume configurations. Their actual counts are2/2/9/6/1/3/6/18/3/3, totaling53, checked from native reports. Controlled AI is not live inference; inert PDF-child admission is not the native PDF-fidelity oracle. Actual MariaDB is separate from browser SQLite and no fallback counts as a provider pass.

The backend and frontend increases reflect new meaningful regression tests; existing tests were not weakened/deleted. Focused RED/GREEN attempts expose mapping absence, source/target display gaps, multiline misassociation, certificate-cell guesses, ordering/replay defects and lifecycle races. Their totals overlap full suites and do not increase final totals.

The first independent wrapper completed Python tests but failed while JSON-serializing a `Path`; successor `independent-02` reran all independent commands successfully. The first NuGet wrapper used an unsupported argument; only the corrected native command supports advisory results. The initial sidecar cleanup acknowledgement compared error text case-sensitively after removal; the successor independently verified the exact owned ID and name were absent. These are retained harness failures, not hidden product passes.

The first long-PDF oracle attempt could not locate `pdftotext`; successor `long-pdf-proof-02` uses already installed pdfplumber for every word's bounds and Poppler for all12 rendered pages. Source annotations, PDF bytes and expected facts were not changed. Graphify query/update initially failed on PATH; the newly available skill resolved its existing uv interpreter and the absolute executable completed query and AST-only update (10,691 nodes), without downloads or model/API calls. Graph output and unrelated local tooling/Docker/security work remain outside this workstream's commits.

Not run: real CV-model inference, hosted CI isolation, production deployment/database/filesystem/backup checks, physical devices, human assistive technology/language/contrast acceptance and manual printing. No local automated result closes those gates.