# P9-REQUAL-01 — Phase9 requalification, 24 October 2026

**Final: RD21 RESOLVED in tested scope; hosted MariaDB BLOCKED; Phase9 NO-GO; Phase10 NO-GO; production NO-GO.** Historical acceptance records remain unchanged.

## Verified source and repairs

The dedicated branch is `fix/p9-ci-and-requalification`, descended from approved development
baseline `549b2cba5a791862ba3f854312ea819a86dc42a0` and RD21 repair
`0d16a691e0249fe1264bf960de5e59eaa9b87fed`. It does not start from production main.
Application repair checkpoint: `2b26953d6f3c3fdacdffefa2c0a696c9084f1afd`.
Hardened qualification checkpoint: `5ac11549b2caa27469aa9fb2b5b9ed402471a453`.
Both normal pushes and direct remote equality were verified. Local/remote main remains
`5f835e54a9b74e6b71418422e28431b2af06453f`.

The compatible Pkcs/Next/Zod security pins are recorded in [SECURITY.md](SECURITY.md).
The real MariaDB Documents UNION defect was reproduced by three cases, fixed only in read-only
name projections, and verified in the full35-case provider suite; see [provider repair](DOCUMENTS_PROVIDER_REPAIR.md).
No application API, migration, stored collation, database version or document-rendering contract changed.
Qualification cleanup/startup/serialization corrections and every superseded runtime attempt are
retained in [attempts and repairs](ATTEMPTS_AND_REPAIRS.md). [Independent source review](SOURCE_REVIEW.md)
records its actual findings and limits. No manual or release approval is inferred from that review.

## Fresh regression checkpoint

All results below are separate lanes. Focused RED/GREEN runs and earlier full-suite passes are
not added to successor totals. Accepted runtime results require native case membership, process
success, zero retries/skips and unchanged frozen inputs. Discovery-only empty results are not skips.

| Lane | Current actual result |
| --- | --- |
| Backend |1123 passed, zero failures/skips |
| Frontend |934 passed in105 suites, zero failures/pending/todo |
| MariaDB integration |35 passed, zero failures/skips, exact12.2.2, generated schemas and teardown |
| Ordinary browser |PASS:362 cases, exact discovery membership; shards98/87/88/89 |
| Six separate browser contracts |PASS:23 cases across six separate lanes |
| RD21 companions / corrected diagnostics |PASS:6 /18 cases |
| Volume / RD21 volume |PASS:3 /3 cases |
| MariaDB browser / HTTP durability |PASS:1 native recovery /2 HTTP cases; creation case is characterization only |
| AI sidecar |56 passed, model loading disabled; no model/inference qualification |
| Type checks / lint / static production build |PASS; Next16.4.1; local build, no deployment |
| Existing security helpers / secret scan / SBOM |PASS within stated scope; NuGet/npm report zero vulnerabilities |
| Locked Python advisory review |FINDINGS;49 pins,109 published alias groups across8 packages; coverage INCOMPLETE |
| Windows PDF oracles |PASS:16 fixtures/36 pages plus8 fixtures/24 pages; unchanged oracle, no input drift |
| Exclusive15-minute MariaDB workload |PASS:900006ms,3382 reads/zero failures,20 navigations, selected exact-state invariants; archived failed setup attempts excluded |
| Linux renderer producers |PASS:5 cases; owned API/network/schema teardown confirmed |
| Linux PDF oracles |FAIL:9/16 fidelity plus4/8 settings;65 exported versus60 expected pages |
| Affected Windows settings successor |PASS:4 cases; replaces affected fixture evidence, not added to362 |

Final native case indexes, process outcomes, source/report identities and detailed measurements
belong to [validation.json](validation.json). Large raw reports, traces, PDFs and screenshots are
retained locally under `.artifacts/p9-requal-01/`; separately archived attempts preserve failures.

## Hosted infrastructure and provider limits

Hosted run843 had no Docker CLI and executed no database tests. Read-only investigation found
Gitea1.26.0/act_runner0.4.1, runner5 `Live-Runner`, `ubuntu-latest` mapped to `node:20-bookworm`,
host networking and an existing merged host Docker-socket bind. That label does not prove a VM
or private isolation. The first-step guard prevents repository/test commands; runner preparation
still occurs before it. Inspected runs847 and849 confirm **BLOCKED**, with no MariaDB service/test
execution. A guard failure is not a hosted database-test failure or pass.

The [operator handoff](CI_OPERATOR_HANDOFF.md) requires a dedicated isolated nonproduction runner,
verified private job/service network, no job daemon socket/privilege/public DB port/persistent data,
and success/failure/cancel cleanup evidence before enabling native services and the restricted
CI-service transport. No runner or live deployment infrastructure was changed.

Local MariaDB uses official Linux/amd64
`mariadb:12.2.2@sha256:42a27baaba3e8f3f0159d16381d5a7156661aa91dcc65f663cabb6a6f9503c00`.
The actual server is12.2.2; this proves tested version parity, not equality with the owner's running
production image ID/configuration. That image ID is not a registry manifest digest. Local schemas
are disposable and credentials/volumes are separate from production. Existing SQLite fixtures
remain explicitly transitional and are never counted as MariaDB execution.

## Acceptance findings and human requirements

[FINDINGS.md](FINDINGS.md) and [findings.json](findings.json) register59 findings independently
against Phase9, Phase10, production and debt. All57 preservation groups and33 routes remain;
56 groups are PARTIAL and C11 DEFERRED. No source presence or passing tagged fixture promotes an
entire capability to PASS. Canonical/variant boundaries, null-as-inherit overrides and frozen
documents retain their specific contracts; no legacy alias or metadata was removed.

[M09-01–10 owner-test cards](MANUAL_ACCEPTANCE.md) specify prerequisites, exact actions, expected
results and required recordings. Genuine reader/keyboard/contrast/zoom, physical-device, natural
Bokmål, printing and provider checks remain NOT TESTED where the required human/environment is
absent. Automated axe and finite image inspection do not establish full accessibility compliance.
The original REQUEST§6 explicitly carries unfinished genuine human checks into release gates;
production-only storage/backup requirements do not independently veto isolated functional QA.

The open Python gate is different: published critical/high records affect dependencies with actual
upload-parser/model-loading call sites. Existing child/time/resource controls do not establish
advisory closure. Per-advisory reachability and compatible major parser/ML transition remain
unproven. REQUEST§§9/13/14 call for an individual risk disposition; they do not mechanically mandate
NO-GO for every advisory. This report's acceptance-risk judgment withholds closure for this
unassessed critical/high uncertainty pending validated remediation or an explicitly approved risk
disposition. C11/P5-13 remains withheld.
Duplicate reminder reads remain low documented debt; creation-intent idempotency remains a separate
open contract. No optimization, duplicate-create protocol or Phase10 cleanup was introduced.

## Final decisions and next action

| Gate | Decision | Reason |
| --- | --- | --- |
| RD21 |RESOLVED |Original six save/concurrency clauses satisfied within tested scope; separate creation debt retained |
| Hosted MariaDB CI |BLOCKED |Private service isolation/lifecycle unavailable; no hosted database tests ran |
| Phase9 |NO-GO |Confirmed Linux PDF output failure and unclosed critical/high Python advisory risk disposition |
| Phase10 readiness |NO-GO |Unwaived affected functionality/testpass failures; unused-code/route/inventory prerequisites unproven |
| Production |NO-GO |Task restrictions and independent release/security/recovery/manual gates remain |

The final collector deliberately exits1: `linux-pdf:FAIL`, `python-advisories:FINDINGS`; `automationComplete:false`. These are retained acceptance failures, not substituted passes. [Linux findings](LINUX_PDF.md) identify11 failed fixtures and observed font/browser differences without claiming a proven sole cause.

MariaDB local development configuration is READY within previously verified isolated persistent-startup scope; its persistent service/data are preserved and currently stopped. Local disposable integration testing is READY (35 real-provider cases plus isolated browser/workload lanes). Hosted CI is BLOCKED. Historical revision fixture repairs remain verified (18/18 and3/3 baseline evidence, fresh complete backend successor); assertions were not weakened. SQLite retirement is STAGED, not performed. MariaDB12.3 LTS migration readiness is PLAN ONLY, not qualified/executed. Production floating `latest` remains a pinning risk; use a separately approved exact version/registry digest with backup/restore/rollback evidence, never the running image ID as a manifest reference.

Source lineage is explicit: complete362 ordinary cases ran at5ac1154; the sole subsequent runtime-input change is the CV sibling preservation fixture at7092697. It takes an independent successful durable GET as its pre-action baseline and retains full strict after-body equality. Four affected Windows cases and five Linux producers passed afterward; no application/static/DLL source changed. [Source lineage](source-lineage.json) and both frozen input manifests record this distinction.

The next specific development action is a bounded Phase9 Linux document-rendering parity investigation using the retained failing corpus, alongside separately scoped Python parser/ML advisory assessment and validated remediation. An operator must provide the isolated runner described in CI_OPERATOR_HANDOFF.md before hosted execution can be enabled. Owners can complete prioritized M09 cards in parallel. These actions do not begin Phase10 cleanup.
Production remains NO-GO under the task restrictions. Live storage, independently verified off-disk
backup/restore/rollback, ingress/deployed identity, provider/model integrity and applicable human
release gates remain unverified. There was no merge, deployment, production database access,
SQLite retirement or MariaDB12.3 upgrade. The existing staged retirement/LTS plans remain plans.