# Known issues and blockers

The following items are preserved from the current blocker/audit records and are not represented as resolved merely because local tests pass.

- **Production release/verification:** authenticated production smoke, provider delivery, backup restore, rollback rehearsal, proxy topology, host firewall, and complete UI/browser verification require operator access. See root `BLOCKERS.md`.
- **Stripe activation:** code exists, but the recurring `price_...` value, portal, webhook, and production secrets are not fully configured/verified.
- **Account deletion:** self-service deletion stays disabled until retention, legal-hold, tombstone, restore, and provider-cleanup policy is approved and rehearsed.
- **Legacy schema cutover:** duplicated opportunity columns remain for compatibility until production data/backups and old-client requirements are validated.
- **Ingress/DNS:** outbound URL import destination validation is enforced at socket connection by completed B01, including mapped-address regression coverage. The separate inbound F04/B06 production proxy-peer, client-IP and firewall boundary still needs deployed evidence; local tests do not close it.
- **Email/AI operational durability:** local failure handling exists, but independent delivery alerts, provider outages, and worker containment require runtime verification.
- **Accessibility/UI:** full keyboard, screen-reader, zoom, contrast, focus, and CV-builder failure-state review remains partly manual.
- **Open audit carryovers verified against source:** stale CV/profile/job saves still expose version counters without a client revision precondition (F01); startup still falls back to SQLite when the provider or connection is missing (F19); and calendar export still treats unspecified `DateTime` values as UTC, so offset/DST preservation is not proven (F21).
- **Conditional worker risk:** AI worker processing is disabled by default, but the enabled hosted loop still has no outer catch/backoff boundary for unexpected database failures (F20). Treat worker survival as requiring verification before enabling it in production.

For exact source IDs, dates, and evidence, use the archived audit packets rather than adding duplicate status reports here.