jobtrackingapp/docs/audits/2026-09-07/coverage.md

# Coverage of all 416 requested audit areas

This index preserves the exact numbered titles from the supplied request. Each row points to its assessment or acceptance plan and states the evidence boundary. **416 indexed areas does not mean 416 passed tests, exhaustive source review of every symbol, or production certification.** Areas requiring a live provider, deployed host, a destructive failure drill, a native screen reader or a complete endpoint/input corpus remain open. An explicit unverified row is an outstanding verification task, not a favorable finding.

Baseline and commands are in [verification.md](verification.md). Prioritized changes are [F01–F21](findings.md); repeated rows about the same root cause do not create extra findings. The [50 explicit failure answers](resilience.md#what-happens-if) distinguish current source behavior from proposed recovery.

Evidence codes:
- **O — Observed:** executed in this audit, limited to the stated input/environment. This may be a failed expectation.
- **S — Source:** a relevant implementation boundary was inspected; runtime outcome is inferred, not certified.
- **P — Proposal:** recommended design, policy, checklist or acceptance test; not claimed implemented.
- **R — Needs runtime verification:** remaining live/staging/manual/inventory evidence. Where the note says source review too, the complete source inventory is also outstanding.
- **N — Not currently evidenced/deployed:** an optional technology should not be added solely to satisfy a heading. SQLite/MariaDB replace PostgreSQL-specific assumptions; Redis and a general broker are absent.

All R entries remain on the acceptance backlog. Prioritize P1-related entries first, then core user-path accessibility and operational proof. Cosmetic/optional feature entries do not justify indiscriminate platform expansion.

| # | Requested area | Evidence | Assessment and remaining boundary |
|---|---|---|---|
| 1 | Formal threat modelling | S/P | [Assessment](threat-data.md#abuse-matrix) — Trust/abuse model and proposed enforcement; distributed abuse load remains untested. |
| 2 | Abuse-case analysis | S/P | [Assessment](threat-data.md#abuse-matrix) — Trust/abuse model and proposed enforcement; distributed abuse load remains untested. |
| 3 | Rate-limiting strategy | S/P | [Assessment](threat-data.md#abuse-matrix) — Trust/abuse model and proposed enforcement; distributed abuse load remains untested. |
| 4 | Data lifecycle map | S/P | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — Sensitive copies and target retention mapped; live inventories and custody unverified. |
| 5 | Data classification | S/P | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — Sensitive copies and target retention mapped; live inventories and custody unverified. |
| 6 | Concurrency testing | O/R | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Stale and simultaneous CV PUTs tested; job/profile concurrency and multi-replica races remain. |
| 7 | Lost-update prevention | O | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Stale CV save overwrote the newer value; F01, expected revision precondition absent. |
| 8 | Idempotency review | O/S | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Repeated job POST created distinct rows; durable AI idempotency exists; billing/email gaps remain. |
| 9 | Unexpected user behaviour | O/R | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Repeated saves, modified owner IDs, offline refresh and Unicode tried; broader confused-user study remains. |
| 10 | Network resilience | O/R | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Offline save failure visible; delayed responses, network flapping and 502 recovery not fully injected. |
| 11 | Offline and interrupted editing | O | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — After acknowledging the unload warning, reload lost the offline edit; F09. |
| 12 | Dependency failure testing | S/R | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — State/retry/failure assessment; only specifically recorded probes executed. |
| 13 | Partial failure scenarios | S/R | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — State/retry/failure assessment; only specifically recorded probes executed. |
| 14 | Transaction-boundary review | S/R | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Career projections, file snapshots, email and billing cross boundaries; transactional matrix specifies repairs. |
| 15 | Background-work reliability | S/R | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Durable AI leases exist; outer worker dependency errors can stop host, F20; outage drill pending. |
| 16 | Browser state audit | S/R | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Storage/cache patterns inspected; no all-route corrupt-storage/private-window certification. |
| 17 | Multi-tab session behaviour | O | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Logout revoked backend session but left another tab's private editor mounted; F08. |
| 18 | Session-expiry UX | R | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Needs runtime verification: actual session expiry, reauthentication and recovery with unsaved edits. |
| 19 | Permission model design | O/S | [Assessment](threat-data.md#assets-and-intended-access) — Owner and Pro policies inspected; tested cross-owner CV denial and ordinary-user admin denial. |
| 20 | Administrator access model | S | [Assessment](threat-data.md#assets-and-intended-access) — Admin can access global job activity content; minimal support scopes/security audit incomplete, F13. |
| 21 | Support access and impersonation | S/P | [Assessment](threat-data.md#assets-and-intended-access) — No support impersonation solution introduced; prefer scoped metadata and audited time-limited access. |
| 22 | Audit-trail architecture | S/P | [Assessment](threat-data.md#assets-and-intended-access) — JobEvents activity is not an immutable privileged/security ledger; F13. |
| 23 | Supportability and diagnostics | S/P | [Assessment](threat-data.md#assets-and-intended-access) — Trace IDs exist; safe metadata diagnostics proposed instead of routine private-content access. |
| 24 | Error identifiers | S/P | [Assessment](threat-data.md#assets-and-intended-access) — Existing request/error identifiers useful; propagate safe reference to client, worker and support views. |
| 25 | Content design and microcopy audit | S/P | [Assessment](product-operations.md#critical-paths-and-time-to-value) — Proposed copy/navigation/onboarding improvements; no recruited usability study. |
| 26 | English/Bokmål terminology consistency | O/P | [Assessment](product-operations.md#critical-paths-and-time-to-value) — NB UI includes English template descriptions and inconsistent capitalization; native editorial review proposed. |
| 27 | Onboarding audit | R | [Assessment](product-operations.md#critical-paths-and-time-to-value) — Needs runtime verification: registration/verification/first-run journey against a local mail sink. |
| 28 | Time-to-value | S/P | [Assessment](product-operations.md#critical-paths-and-time-to-value) — Existing manual-add sequence has optional steps; offer earlier save; no timed user study. |
| 29 | Feature discoverability | S/P | [Assessment](product-operations.md#critical-paths-and-time-to-value) — Proposed copy/navigation/onboarding improvements; no recruited usability study. |
| 30 | Progressive disclosure | S/P | [Assessment](product-operations.md#critical-paths-and-time-to-value) — Proposed copy/navigation/onboarding improvements; no recruited usability study. |
| 31 | Feature-flag architecture | S/P | [Assessment](product-operations.md#feature-maintenance-and-simplification) — Existing switches retained; owner/default/expiry register proposed. |
| 32 | Feature-flag lifecycle | S/P | [Assessment](product-operations.md#feature-maintenance-and-simplification) — Existing switches retained; owner/default/expiry register proposed. |
| 33 | Database evolution strategy | S/R | [Assessment](resilience.md#time-and-compatibility-policy) — Additive/backfill/contract stages proposed; current nontransactional SQLite migration warning observed separately. |
| 34 | Backwards-compatible deployment | S/R | [Assessment](resilience.md#time-and-compatibility-policy) — Previous-image rollback is not schema rollback; old/new contract rehearsal needed. |
| 35 | API compatibility strategy | S/P | [Assessment](resilience.md#time-and-compatibility-policy) — Unversioned DTO contract requires additive evolution and supported-client window; not automatic major-version routing. |
| 36 | Frontend deployment version mismatch | R | [Assessment](resilience.md#time-and-compatibility-policy) — Needs runtime verification: old open tab versus new API/static assets; retain dirty edits before reload. |
| 37 | Cache strategy audit | O/S | [Assessment](resilience.md#time-and-compatibility-policy) — Private responses lacked explicit cache policy; no cross-user HTTP cache exploit demonstrated. |
| 38 | Date/time correctness | O | [Assessment](resilience.md#time-and-compatibility-policy) — Offset-bearing follow-up instants change on calendar export; F21. |
| 39 | DST testing | O | [Assessment](resilience.md#time-and-compatibility-policy) — Four offset/DST cases fail; repeated autumn hour collapses to one exported time. |
| 40 | Locale correctness | O/R | [Assessment](resilience.md#time-and-compatibility-policy) — EN/NB themes rendered; full date/number/plural/locale fallback matrix remains. |
| 41 | Currency handling | P/R | [Assessment](resilience.md#time-and-compatibility-policy) — Store currency explicitly and avoid implicit conversion; full salary/offer round-trip matrix unverified. |
| 42 | Translation-layout testing | O/R | [Assessment](resilience.md#time-and-compatibility-policy) — Eight actual locale/theme/width states tested; doubled-length pseudolocale and every route remain. |
| 43 | Generated-document accessibility | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: tagged output, reading order and independent browser Print. |
| 44 | Print behaviour | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: tagged output, reading order and independent browser Print. |
| 45 | Data portability | O/S | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — CSV/account export exercised; complete import round trip and all portability formats not certified. |
| 46 | Export security | O/S | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — Formula CSV and no-store gaps observed; recent-auth owner export controls retained. |
| 47 | Deletion semantics | S/R | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — Soft delete, hard deletion and immutable submitted snapshots distinguished; cross-resource races remain. |
| 48 | Account deletion lifecycle | S/R | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — Staged purge and tombstones exist; external billing cancellation and restored-backup drill incomplete. |
| 49 | Resource-exhaustion testing | S/R | [Assessment](threat-data.md#abuse-matrix) — Shared PDF admission absent; 1,000-renderer exhaustion deliberately not executed. |
| 50 | Token-budget protection | S/R | [Assessment](threat-data.md#abuse-matrix) — AI reservation limits exist; process-local and cross-pipeline admission need concurrent proof. |
| 51 | AI cost controls | S/P | [Assessment](threat-data.md#abuse-matrix) — Use provider actuals plus estimated reservations, per-workflow/user/global budgets and kill switches. |
| 52 | AI observability | S/P | [Assessment](threat-data.md#abuse-matrix) — Persisted AI usage/status useful; content-free metrics and provider bill reconciliation proposed. |
| 53 | AI model changes | P/R | [Assessment](threat-data.md#abuse-matrix) — Pin evaluated routes/prompt versions; no live model-change/evaluation performed. |
| 54 | Property-based testing | P/R | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Invariant/property suite proposed; example regression suites are not property-based coverage. |
| 55 | Fuzz testing | O/R | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Existing malformed parser tests pass; broad mutation/fuzz campaign not performed. |
| 56 | Chaos/failure testing | O/R | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Offline/browser/API contention injected locally; DB/host/provider chaos remains in isolated staging. |
| 57 | Disk-space exhaustion | P/R | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Bounded synthetic tests specified; no destructive host exhaustion or broad fuzz campaign. |
| 58 | Memory exhaustion | P/R | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Bounded synthetic tests specified; no destructive host exhaustion or broad fuzz campaign. |
| 59 | CPU exhaustion | P/R | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Bounded synthetic tests specified; no destructive host exhaustion or broad fuzz campaign. |
| 60 | Long-term maintenance burden | P | [Assessment](product-operations.md#feature-maintenance-and-simplification) — Feature value/maintenance/risk table protects useful boundaries and questions speculative complexity. |
| 61 | Build vs buy review | P/R | [Assessment](product-operations.md#feature-maintenance-and-simplification) — Use Identity/Stripe/MUI/current queue; no researched vendor price or replacement recommendation. |
| 62 | Telemetry strategy | P/R | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Minimal content-free telemetry proposed; deployed collector/consent not verified. |
| 63 | Privacy-preserving analytics | P/R | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Minimal content-free telemetry proposed; deployed collector/consent not verified. |
| 64 | Incident-response readiness | P/R | [Assessment](product-operations.md#incident-response-and-technical-runbooks) — Technical runbooks supplied; issuer rotation/contact/disclosure drills remain. |
| 65 | Security incident scenarios | P/R | [Assessment](product-operations.md#incident-response-and-technical-runbooks) — Key leak, admin compromise, dependency compromise and data leak runbooks; no live attack exercise. |
| 66 | Secret rotation | P/R | [Assessment](product-operations.md#incident-response-and-technical-runbooks) — Rotate issuer credentials, revoke sessions and preserve decryptability; key-custody drill unexecuted. |
| 67 | Security disclosure readiness | P/R | [Assessment](product-operations.md#incident-response-and-technical-runbooks) — Assign private disclosure channel and triage owner before launch; delivery/ownership not verified. |
| 68 | Release quality gates | P/R | [Assessment](product-operations.md#release-gates-and-production-readiness-checklist) — Concrete gates and recovery constraints supplied; no production approval claimed. |
| 69 | Production-readiness checklist | P/R | [Assessment](product-operations.md#release-gates-and-production-readiness-checklist) — Concrete gates and recovery constraints supplied; no production approval claimed. |
| 70 | Rollback-readiness | P/R | [Assessment](product-operations.md#release-gates-and-production-readiness-checklist) — Concrete gates and recovery constraints supplied; no production approval claimed. |
| 71 | Performance objectives | S/P | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Bottlenecks and measurement triggers mapped; no capacity or SLO achievement claim. |
| 72 | Error-budget thinking | P | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Proposed internal 99.5% core SLO; collect baseline before commitments; optional AI tracked separately. |
| 73 | Capacity planning | S/P | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Bottlenecks and measurement triggers mapped; no capacity or SLO achievement claim. |
| 74 | Scaling triggers | S/P | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Bottlenecks and measurement triggers mapped; no capacity or SLO achievement claim. |
| 75 | Single points of failure | S | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Host, DB/files/key ring and operator are common failure domains; document recovery ownership. |
| 76 | Dependency ownership | S/P | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Public proxy, MariaDB, provider and backup custodians need named ownership outside public source. |
| 77 | Product invariants | S/P | [Assessment](threat-data.md#product-invariants-and-enforcement) — Owner/version/quota/side-effect invariants and enforcement/test targets mapped. |
| 78 | Database-enforced invariants | S/R | [Assessment](threat-data.md#product-invariants-and-enforcement) — Owner filters and constraints exist; CV version uniqueness/preconditions and reservations need strengthening. |
| 79 | State-machine review | S/R | [Assessment](threat-data.md#product-invariants-and-enforcement) — AI/deletion/package transitions reviewed; model invalid/duplicate/out-of-order transitions explicitly. |
| 80 | Safe retries | S/P | [Assessment](threat-data.md#product-invariants-and-enforcement) — Retry reads/transient work within budgets; reconcile ambiguous external side effects by operation identity. |
| 81 | Safe failure behaviour | S/P | [Assessment](threat-data.md#product-invariants-and-enforcement) — Do not report unsaved, unsent or uncharged work as successful; preserve recoverable inputs. |
| 82 | Accessibility under failure | O/R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Failed save is visible; failure announcement/focus and screen-reader recovery remain unverified. |
| 83 | Design quality gates | P | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Both themes/languages, interaction states and core axe/manual checks proposed as release gates. |
| 84 | Component ownership | S/P | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Use MUI/theme/AppShell/shared feedback owners; consolidate demonstrated repeated callers incrementally. |
| 85 | Storybook/component showcase | P | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — A lightweight state showcase may help; Storybook is not required without recurring review need. |
| 86 | All-state component testing | P/R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Loading/empty/error/disabled/long-text/selected/focus states defined; complete component sweep remains. |
| 87 | Extremely long-content testing | O/R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Existing long-content browser cases pass; maximal text, large datasets and all states untested. |
| 88 | Unicode and unusual-input testing | O/R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Åse/emoji survive local profile/render; combining/RTL/confusable corpus remains. |
| 89 | Copy/paste behaviour | S/R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Clipboard success shown before promise resolution; permission-denied/formatted-paste matrix remains. |
| 90 | Undo/recovery strategy | O/S | [Assessment](threat-data.md#product-invariants-and-enforcement) — Undo and unload warning exist; confirmed refresh loses offline draft, F09. |
| 91 | Versioning strategy for CV content | O/S | [Assessment](threat-data.md#product-invariants-and-enforcement) — History version is not concurrency control; stale write succeeds, F01. |
| 92 | Document provenance | S | [Assessment](threat-data.md#product-invariants-and-enforcement) — Submitted packages freeze content/copies; live CV settings render against current Career Profile. |
| 93 | AI content provenance | S/P | [Assessment](threat-data.md#product-invariants-and-enforcement) — Operation/prompt metadata helps provenance; distinguish generated claims from verified user facts. |
| 94 | Dependency-locking and reproducible builds | O/S | [Assessment](findings.md#f18--p2-supply-chain-and-production-environment-proof-remain-incomplete) — Installed locked environment builds; Docker lock enforcement and mutable image/action gaps remain. |
| 95 | Software supply-chain security | O/S | [Assessment](findings.md#f18--p2-supply-chain-and-production-environment-proof-remain-incomplete) — Tracked-secret scan and supply-chain helper tests pass; no current advisory/network scan. |
| 96 | SBOM | S/R | [Assessment](findings.md#f18--p2-supply-chain-and-production-environment-proof-remain-incomplete) — SBOM generator exists; no newly verified release-image SBOM/provenance attached. |
| 97 | Dependency update strategy | P/R | [Assessment](findings.md#f18--p2-supply-chain-and-production-environment-proof-remain-incomplete) — Small automated update PRs with suites/exception expiry; actual hosted update policy not verified. |
| 98 | End-of-life tracking | R | [Assessment](findings.md#f18--p2-supply-chain-and-production-environment-proof-remain-incomplete) — Needs external verification: .NET/Node/Python/library support dates and maintainer/advisory status. |
| 99 | Infrastructure documentation | S | [Assessment](product-operations.md#operational-ownership-and-alerts) — Architecture document is stale on counts/router/CAPTCHA/profile authority; F17. |
| 100 | Operational runbooks | P | [Assessment](product-operations.md#operational-ownership-and-alerts) — Fourteen incident runbooks include diagnosis, safe recovery and verification. |
| 101 | Monitoring ownership | P/R | [Assessment](product-operations.md#operational-ownership-and-alerts) — Signals have proposed responsible roles; actual people and backup contact not confirmed. |
| 102 | Alert quality | P/R | [Assessment](product-operations.md#operational-ownership-and-alerts) — Dedup, impact, safe trace, runbook and recovery notifications required; no delivered alert drill. |
| 103 | Backup monitoring | S/P/R | [Assessment](product-operations.md#operational-ownership-and-alerts) — Backup age/size/off-site failure signals proposed; independent alert delivery unproven. |
| 104 | Restore drills | R | [Assessment](product-operations.md#operational-ownership-and-alerts) — Needs runtime verification: isolated DB/files/key/tombstone restore and measured RPO/RTO. |
| 105 | Migration rehearsal | S/R | [Assessment](product-operations.md#operational-ownership-and-alerts) — Fresh local SQLite startup migrates with warnings; interrupted/large/MariaDB migration rehearsal remains. |
| 106 | Production data protection in non-production | O/P | [Assessment](verification.md#environment-and-boundaries) — Only synthetic local accounts/documents used; production-data masking/access policy proposed. |
| 107 | Test-data strategy | O | [Assessment](verification.md#environment-and-boundaries) — Deterministic synthetic accounts/profile/jobs/Unicode fixtures; no real user documents required. |
| 108 | Environment parity | R | [Assessment](verification.md#environment-and-boundaries) — Needs runtime verification: actual Linux/Chromium/MariaDB/TLS/proxy/resource limits parity. |
| 109 | Staging strategy | P/R | [Assessment](verification.md#environment-and-boundaries) — Isolated production-like environment required for remaining drills; not provisioned by this audit. |
| 110 | Safe third-party test modes | R | [Assessment](verification.md#environment-and-boundaries) — Needs runtime verification: Stripe test mode, OAuth test identity and local/sandbox mail. |
| 111 | Domain-boundary tests | O/R | [Assessment](resilience.md#time-and-compatibility-policy) — Existing domain suites pass; complete cross-boundary external contract matrix remains. |
| 112 | Contract tests | S/R | [Assessment](resilience.md#time-and-compatibility-policy) — Provider fakes/suite coverage useful; current live provider contracts not called. |
| 113 | API schema quality | R | [Assessment](resilience.md#time-and-compatibility-policy) — Needs runtime verification: generated schema operation coverage, examples, nullable/enums/error documentation. |
| 114 | Consistent error contract | S/P | [Assessment](resilience.md#time-and-compatibility-policy) — Normalize actionable error/reference/retry semantics across API, workers and UI; preserve existing contracts. |
| 115 | Graceful degradation | S/P | [Assessment](product-operations.md#critical-paths-and-time-to-value) — Core tracking/editing prioritized; optional dependency failure should degrade independently. |
| 116 | Critical-path definition | P | [Assessment](product-operations.md#critical-paths-and-time-to-value) — Core auth/tracking/save/career/download paths explicitly prioritized above optional AI/discovery. |
| 117 | User-impact severity | P | [Assessment](product-operations.md#critical-paths-and-time-to-value) — P0/P1/P2 reflect user impact and preconditions; evidence gap is separate from confirmed exploit. |
| 118 | Feature maintenance scoring | P | [Assessment](product-operations.md#feature-maintenance-and-simplification) — Value/maintenance/risk judgments supplied; no feature deletion justified without usage evidence. |
| 119 | "Should this exist?" review | P | [Assessment](product-operations.md#feature-maintenance-and-simplification) — Value/maintenance/risk judgments supplied; no feature deletion justified without usage evidence. |
| 120 | Product coherence | P | [Assessment](product-operations.md#feature-maintenance-and-simplification) — Value/maintenance/risk judgments supplied; no feature deletion justified without usage evidence. |
| 121 | Information architecture map | S/R | [Assessment](product-operations.md#navigation-and-domain-language) — Routes and target information architecture mapped; complete navigation-state sweep remains. |
| 122 | Navigation depth | S/P | [Assessment](product-operations.md#navigation-and-domain-language) — Reduce early manual-add steps and contextualize secondary tools; no forced removal of useful deep links. |
| 123 | URL design | S | [Assessment](product-operations.md#navigation-and-domain-language) — Routed job/career workspace retained; stable owner-safe resource routes and compatibility redirects. |
| 124 | Browser Back/Forward behaviour | O/R | [Assessment](product-operations.md#navigation-and-domain-language) — Existing back/deep-link/dirty-navigation browser case passes; all modal/filter combinations remain. |
| 125 | Deep linking | O/R | [Assessment](product-operations.md#navigation-and-domain-language) — Existing workspace deep links pass; complete unauthenticated/revoked/missing-resource link matrix remains. |
| 126 | Search-state persistence | R | [Assessment](product-operations.md#navigation-and-domain-language) — Needs runtime verification: reload/back/forward/share of every search/filter/page state. |
| 127 | Destructive-operation recovery | S/O/R | [Assessment](product-operations.md#navigation-and-domain-language) — Trash/staged deletion and unload warnings exist; destructive recovery/provider races need broader drills. |
| 128 | Notification strategy | S/P | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Respect channel preferences, dedup and durable delivery; F07 reminder behavior needs repair. |
| 129 | Toast abuse | S/P | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Failed saves require persistent recovery; transient toasts only for noncritical confirmation. |
| 130 | Confirmation-dialog audit | O/R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Unload warning observed; complete confirm/cancel/focus and irreversible-action audit remains. |
| 131 | Latency perception | O/P | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Local navigation timing retained; show truthful queued/loading states; no WAN performance claim. |
| 132 | Cancellation | S/R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Durable AI cancellation exists; component unmount and synchronous downstream cancellation still need proof. |
| 133 | Retry UX | O/S | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — CV retry/failed state exists; external effects must not blindly retry ambiguous outcomes. |
| 134 | Empty/zero-data analytics | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: zero-data charts, text alternatives and keyboard data exploration. |
| 135 | Accessibility of charts | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: zero-data charts, text alternatives and keyboard data exploration. |
| 136 | CSV injection | O | [Assessment](findings.md#f05--p1-csv-quoting-does-not-neutralize-spreadsheet-formulas) — Export retains harmless =1+1 formula; structural CSV quoting is insufficient, F05. |
| 137 | Spreadsheet/import security | O/R | [Assessment](findings.md#f05--p1-csv-quoting-does-not-neutralize-spreadsheet-formulas) — Harmless formula export observed; full spreadsheet/import payload corpus remains. |
| 138 | Email-link security | S/R | [Assessment](threat-data.md#abuse-matrix) — Canonical origin and token/session controls reviewed; safe open-redirect/one-use/expiry mail-link matrix remains. |
| 139 | Email enumeration | S/R | [Assessment](threat-data.md#abuse-matrix) — Abuse controls exist; timing/response equivalence across register/login/resend/recovery not newly measured. |
| 140 | Email deliverability monitoring | R | [Assessment](threat-data.md#abuse-matrix) — Needs runtime verification: bounce/delivery, sender reputation and independent provider alerting. |
| 141 | User-controlled URLs | S/R | [Assessment](findings.md#f11--p1-conditional-import-dns-validation-is-not-bound-to-the-actual-connection) — DNS-check/connect gap identified; no real private destination probed. |
| 142 | SSRF-hardening of importers | S/R | [Assessment](findings.md#f11--p1-conditional-import-dns-validation-is-not-bound-to-the-actual-connection) — DNS-check/connect gap identified; no real private destination probed. |
| 143 | HTML sanitisation | S/R | [Assessment](threat-data.md#abuse-matrix) — React/server encoding intended; private iframe flags weaken isolation; no stored-XSS exploit established. |
| 144 | Markdown security | R | [Assessment](threat-data.md#abuse-matrix) — Needs runtime verification: complete Markdown/raw HTML/link-scheme sink corpus; no regex sanitizer recommended. |
| 145 | CSP strategy | S/P | [Assessment](findings.md#f15--p2-private-caching-and-browser-security-headers-are-incomplete) — CSP absent/incomplete at proxy; stage report-only policy then enforce reviewed directives. |
| 146 | Cookie security | S/R | [Assessment](findings.md#f15--p2-private-caching-and-browser-security-headers-are-incomplete) — Cookie/CSRF/session controls inspected; deployed Secure/SameSite/domain/subdomain behavior remains. |
| 147 | Subdomain trust | R | [Assessment](findings.md#f15--p2-private-caching-and-browser-security-headers-are-incomplete) — Needs runtime verification: actual DNS/subdomain ownership, cookie scope and sibling-origin trust. |
| 148 | Reverse-proxy trust | S/R | [Assessment](findings.md#f15--p2-private-caching-and-browser-security-headers-are-incomplete) — Direct port3000 ingress and forwarded-header chain are conditional risk F04; firewall unverified. |
| 149 | Host validation | S/R | [Assessment](findings.md#f15--p2-private-caching-and-browser-security-headers-are-incomplete) — Canonical origin/allowlists help; attacker-controlled forwarded scheme/IP must be tested at real ingress. |
| 150 | TLS review | R | [Assessment](product-operations.md#incident-response-and-technical-runbooks) — Needs runtime verification: external TLS chain, renewal, cipher policy and certificate alerts. |
| 151 | File-storage architecture | S | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — Staged file store, quarantine/reconciliation and package copies reviewed; storage shares host fate. |
| 152 | Orphaned-file detection | S/R | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — Reconciliation exists; interrupted/concurrent file-record drills needed across all artifact categories. |
| 153 | Temporary-file management | S/R | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — Parser temp cleanup and export DeleteOnClose exist; renderer/crash residue needs bounded cleanup proof. |
| 154 | Malware scanning strategy | S/P | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — Parser bounds are not antivirus; add scanning only with operational/retention/quarantine requirements. |
| 155 | Document parser isolation | O/S | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — 37 parser tests pass; subprocess limits and constrained sidecar source reviewed. |
| 156 | AI prompt-injection testing suite | P/R | [Assessment](threat-data.md#product-invariants-and-enforcement) — Adversarial job/CV instruction corpus proposed; no live-model injection suite run. |
| 157 | AI output validation | O/S | [Assessment](threat-data.md#product-invariants-and-enforcement) — Existing parser/schema validation tests pass; probabilistic fact correctness remains separate. |
| 158 | AI action boundaries | S/P | [Assessment](threat-data.md#product-invariants-and-enforcement) — Untrusted job/CV text must not grant tools/permissions or trigger send/payment/publication. |
| 159 | Prompt/version management | S/P | [Assessment](threat-data.md#product-invariants-and-enforcement) — Keep versioned prompts/routes and provenance; review rollout/rollback with evaluated fixtures. |
| 160 | AI evaluation suite | O/R | [Assessment](threat-data.md#product-invariants-and-enforcement) — Five Ollama evaluation-helper tests pass; no live model quality evaluation. |
| 161 | Norwegian-language AI quality | R | [Assessment](threat-data.md#product-invariants-and-enforcement) — Needs runtime verification: Bokmål semantic quality, factual preservation and reviewer scoring. |
| 162 | User fact preservation | S/P | [Assessment](threat-data.md#product-invariants-and-enforcement) — Preserve authoritative career facts; reject unsupported structured claims and require review. |
| 163 | Human-review requirement | S/P | [Assessment](threat-data.md#product-invariants-and-enforcement) — Human review required before using generated claims in outward-facing artifacts/actions. |
| 164 | Subscription-entitlement races | S/R | [Assessment](findings.md#f02--p1-billing-has-no-complete-account-lifecycle-or-concurrent-reconciliation) — Current-state re-fetch helps sequential events; concurrency and reconciliation need sandbox proof. |
| 165 | Webhook-order handling | S/R | [Assessment](findings.md#f02--p1-billing-has-no-complete-account-lifecycle-or-concurrent-reconciliation) — Current-state re-fetch helps sequential events; concurrency and reconciliation need sandbox proof. |
| 166 | Billing reconciliation | S/R | [Assessment](findings.md#f02--p1-billing-has-no-complete-account-lifecycle-or-concurrent-reconciliation) — Current-state re-fetch helps sequential events; concurrency and reconciliation need sandbox proof. |
| 167 | GDPR request workflows | S/P/R | [Assessment](threat-data.md#retention-matrix) — Export/deletion inventory and stages mapped; legal classification/timelines require responsible review. |
| 168 | Data-retention matrix | P/R | [Assessment](threat-data.md#retention-matrix) — Retention matrix gives proposed defaults and backup behavior; no deployed-policy compliance claim. |
| 169 | Log-retention policy | S/P | [Assessment](threat-data.md#retention-matrix) — Docker file rotation is not complete log retention; set content-safe TTL/custody/access policy. |
| 170 | PII-in-logs scan | S | [Assessment](threat-data.md#retention-matrix) — SMTP recipient/subject and client URL/stack logging can contain PII; F16. |
| 171 | Sensitive exception data | S/R | [Assessment](threat-data.md#retention-matrix) — Truncation is not redaction; sanitize before logging; complete exception corpus remains. |
| 172 | Source-map exposure | R | [Assessment](findings.md#f18--p2-supply-chain-and-production-environment-proof-remain-incomplete) — Needs runtime verification: source maps in final deployed assets and public path exposure. |
| 173 | Production debug configuration | S/R | [Assessment](findings.md#f18--p2-supply-chain-and-production-environment-proof-remain-incomplete) — Environment config/source reviewed; final deployed debug/telemetry behavior not inspected. |
| 174 | Admin endpoint discovery | O/S | [Assessment](findings.md#f18--p2-supply-chain-and-production-environment-proof-remain-incomplete) — Admin controllers identified; ordinary-user audit request returns403; complete hosted admin surface remains. |
| 175 | Object-level authorization regression suite | O/R | [Assessment](verification.md#normal-verification) — New CV GET/PUT/DELETE owner probes pass; broader existing tests pass; future routes need registry gate. |
| 176 | Security regression rule | P | [Assessment](verification.md#normal-verification) — Every security fix retains a meaningful boundary regression; normal green suite is not blanket proof. |
| 177 | "Prove the fix" requirement | P | [Assessment](verification.md#normal-verification) — Each finding specifies failing test/expected correction/staging/detection; no fix marked complete here. |
| 178 | Root-cause requirement | S/P | [Assessment](findings.md) — Each finding gives root cause, bounded change, regression and rollout expectations. |
| 179 | Fix scope | S/P | [Assessment](findings.md) — Each finding gives root cause, bounded change, regression and rollout expectations. |
| 180 | Regression-risk assessment | S/P | [Assessment](findings.md) — Each finding gives root cause, bounded change, regression and rollout expectations. |
| 181 | Migration strategy for large refactors | P | [Assessment](product-operations.md#feature-maintenance-and-simplification) — Expand/backfill/contract and compatibility tests before removing legacy representation. |
| 182 | Strangler-style modernisation | P | [Assessment](product-operations.md#feature-maintenance-and-simplification) — Replace one demonstrated boundary/caller at a time; avoid unnecessary new services/frameworks. |
| 183 | Dead-code confidence | P/R | [Assessment](product-operations.md#feature-maintenance-and-simplification) — Check runtime routes, stored IDs, migrations and deployment references before declaring code dead. |
| 184 | Comment quality | P | [Assessment](product-operations.md#feature-maintenance-and-simplification) — Explain constraints and intent; remove stale claims through focused documentation changes. |
| 185 | Naming consistency | P | [Assessment](product-operations.md#feature-maintenance-and-simplification) — Align identifiers with existing domain glossary; avoid broad cosmetic rename churn. |
| 186 | Domain-language consistency | S/P | [Assessment](product-operations.md#feature-maintenance-and-simplification) — Reconcile UI/API/domain glossary; distinguish job, application record and application letter. |
| 187 | Architecture decision records | P | [Assessment](product-operations.md#feature-maintenance-and-simplification) — Record decisions for provider, time, quota, rendering and recovery when implementation choices land. |
| 188 | Documentation freshness | S | [Assessment](product-operations.md#feature-maintenance-and-simplification) — Current architecture labels conflict with code; use dated verified source baseline, F17. |
| 189 | New-developer setup test | R | [Assessment](verification.md#normal-verification) — Needs runtime verification: fresh machine/clone setup; audit reused installed dependencies. |
| 190 | One-command development startup | S/R | [Assessment](verification.md#normal-verification) — Document existing startup paths; one-command clean-environment success not established. |
| 191 | Seed/demo data | O/R | [Assessment](verification.md#normal-verification) — Harness seeds safe demo fixtures; general public/demo reset workflow not audited. |
| 192 | Test isolation | O/R | [Assessment](verification.md#normal-verification) — Fresh synthetic SQLite and serial backend settings used; CI parallel/shared-resource isolation remains. |
| 193 | Flaky-test audit | O/R | [Assessment](verification.md#normal-verification) — One browser run reports zero flaky tests; repeated-run flake rate was not measured. |
| 194 | Test-speed audit | O | [Assessment](verification.md#normal-verification) — Observed suite durations recorded; no comparative optimization benchmark performed. |
| 195 | Mutation testing | P/R | [Assessment](verification.md#normal-verification) — Target permission/revision/time guards with mutation tests; no mutation score measured. |
| 196 | Coverage quality | O/S | [Assessment](verification.md#normal-verification) — Green suite misses builder axe and standalone test type error; count alone is insufficient. |
| 197 | Production smoke tests | O/S | [Assessment](product-operations.md#incident-response-and-technical-runbooks) — Local core suite passes; deployed public health/ready smoke exists in source, not executed here. |
| 198 | Synthetic monitoring | P/R | [Assessment](product-operations.md#incident-response-and-technical-runbooks) — Content-free synthetic core journey proposed; production probe identity/side effects not configured. |
| 199 | Uptime monitoring | P/R | [Assessment](product-operations.md#incident-response-and-technical-runbooks) — Independent external uptime/readiness monitoring and delivered alert need proof. |
| 200 | DNS monitoring | R | [Assessment](product-operations.md#incident-response-and-technical-runbooks) — Needs runtime verification: authoritative/recursive DNS monitoring and owner escalation. |
| 201 | SSL expiry alerts | R | [Assessment](product-operations.md#incident-response-and-technical-runbooks) — Needs runtime verification: independent certificate expiry alert and renewal drill. |
| 202 | Dependency outage communication | P | [Assessment](product-operations.md#incident-response-and-technical-runbooks) — Communicate affected optional service/status while core tracking remains usable; avoid misleading success. |
| 203 | Maintenance mode | P/R | [Assessment](product-operations.md#incident-response-and-technical-runbooks) — Document admission/maintenance behavior; actual safe activation not tested. |
| 204 | Read-only mode | P/R | [Assessment](product-operations.md#incident-response-and-technical-runbooks) — Read-only mode must deliberately reject mutations and stop writers; no new implementation supplied. |
| 205 | Data integrity verification | S/P | [Assessment](threat-data.md#product-invariants-and-enforcement) — Verify owner/FK/version/usage/file invariants without reading private content unnecessarily. |
| 206 | Storage reconciliation | S/R | [Assessment](threat-data.md#product-invariants-and-enforcement) — Staged attachment recovery is useful; reconcile CV/package/generated storage accounting too. |
| 207 | Database integrity checks | R | [Assessment](threat-data.md#product-invariants-and-enforcement) — Needs runtime verification: production-provider integrity checks, real query plans and restored-row/file hashes. |
| 208 | Privacy by default | S | [Assessment](threat-data.md#data-classification) — Private CV default and external-AI consent off are strengths; public copies require explicit lifecycle. |
| 209 | Secure defaults | S/R | [Assessment](threat-data.md#data-classification) — Default switches reduce exposure; missing aggregate limits and database fallback still need repair. |
| 210 | Fail-fast configuration | S | [Assessment](threat-data.md#data-classification) — Empty/unknown provider can silently select SQLite in app startup, F19. |
| 211 | Configuration schema validation | S/P | [Assessment](threat-data.md#data-classification) — Deployment validation does not replace application startup provider/config validation, F19. |
| 212 | Environment-specific safeguards | S/P | [Assessment](threat-data.md#data-classification) — Guard intended provider/origin/secrets at startup; prevent demo/development fallback in deployed environment. |
| 213 | Secret handling in Docker | S/R | [Assessment](findings.md#f18--p2-supply-chain-and-production-environment-proof-remain-incomplete) — Container environment/key/volume boundaries reviewed; actual host secret custody unverified. |
| 214 | Secret handling in CI | S/R | [Assessment](findings.md#f18--p2-supply-chain-and-production-environment-proof-remain-incomplete) — CI script/runner inputs reviewed; actual secret scoping/masking/fork exposure unverified. |
| 215 | Pull-request security | R | [Assessment](findings.md#f18--p2-supply-chain-and-production-environment-proof-remain-incomplete) — Needs runtime verification: untrusted PR execution, runner isolation and credential availability. |
| 216 | Branch protection | R | [Assessment](findings.md#f18--p2-supply-chain-and-production-environment-proof-remain-incomplete) — Needs runtime verification: hosted branch protection, required checks and bypass permissions. |
| 217 | Deployment permissions | R | [Assessment](findings.md#f18--p2-supply-chain-and-production-environment-proof-remain-incomplete) — Needs runtime verification: deploy environment approvals, scoped SSH and registry credentials. |
| 218 | Server hardening | R | [Assessment](findings.md#f18--p2-supply-chain-and-production-environment-proof-remain-incomplete) — Needs runtime verification: OS patching, SSH/firewall/users/audit policy and recovery access. |
| 219 | Docker socket exposure | S/R | [Assessment](findings.md#f18--p2-supply-chain-and-production-environment-proof-remain-incomplete) — Compose source does not prove other host containers lack Docker socket; inventory actual mounts. |
| 220 | Container privilege review | S | [Assessment](findings.md#f18--p2-supply-chain-and-production-environment-proof-remain-incomplete) — Backend/root Chromium lacks full privilege/resource isolation; constrained parser shows a better bounded boundary. |
| 221 | Network segmentation | S/R | [Assessment](findings.md#f18--p2-supply-chain-and-production-environment-proof-remain-incomplete) — Internal AI network helps; actual shared networks, egress/firewall and lateral reachability unverified. |
| 222 | Database exposure | R | [Assessment](findings.md#f18--p2-supply-chain-and-production-environment-proof-remain-incomplete) — Needs runtime verification: external MariaDB bind/firewall/users/TLS/backups. |
| 223 | Admin-interface exposure | S/R | [Assessment](findings.md#f18--p2-supply-chain-and-production-environment-proof-remain-incomplete) — API admin role checks exist; public route/network exposure and operator access require deployed check. |
| 224 | CORS audit | S/R | [Assessment](findings.md#f15--p2-private-caching-and-browser-security-headers-are-incomplete) — Configured origin boundaries reviewed; full credentialed CORS/preflight/origin bypass matrix remains. |
| 225 | CSRF model | S/O | [Assessment](findings.md#f15--p2-private-caching-and-browser-security-headers-are-incomplete) — Cookie mutations require matching CSRF header; local authenticated harness exercises intended path. |
| 226 | XSS persistence testing | R | [Assessment](findings.md#f15--p2-private-caching-and-browser-security-headers-are-incomplete) — Needs runtime verification: comprehensive persisted HTML/Markdown/URL payloads across all sinks. |
| 227 | Content upload/download headers | S/O/R | [Assessment](findings.md#f15--p2-private-caching-and-browser-security-headers-are-incomplete) — Sample cache gaps observed; full content-type/disposition/nosniff matrix remains. |
| 228 | Separate download origin | P | [Assessment](findings.md#f15--p2-private-caching-and-browser-security-headers-are-incomplete) — Consider isolated download/render origin for untrusted content with measured requirements; not automatic new service. |
| 229 | CSP report strategy | P/R | [Assessment](findings.md#f15--p2-private-caching-and-browser-security-headers-are-incomplete) — Report-only CSP can identify required sources; sanitize/rate-limit reports before enforcement. |
| 230 | Referrer policy | S/R | [Assessment](findings.md#f15--p2-private-caching-and-browser-security-headers-are-incomplete) — Proxy referrer policy exists; public/private downstream-link leakage needs deployed verification. |
| 231 | Permissions policy | S/R | [Assessment](findings.md#f15--p2-private-caching-and-browser-security-headers-are-incomplete) — Proxy permissions policy exists; check final responses and iframe requirements. |
| 232 | Browser security headers | S/O/R | [Assessment](findings.md#f15--p2-private-caching-and-browser-security-headers-are-incomplete) — Source proxy headers inspected and local cache samples checked; complete deployed policy unverified. |
| 233 | Security-header regression test | P | [Assessment](findings.md#f15--p2-private-caching-and-browser-security-headers-are-incomplete) — Add endpoint/browser header regressions for actual trusted ingress and sensitive response classes. |
| 234 | Privacy-policy alignment | P/R | [Assessment](threat-data.md#retention-matrix) — Policy must match actual mail/AI/billing/backups/logs/support access; no legal compliance conclusion. |
| 235 | Terms/consent versioning | P/R | [Assessment](threat-data.md#retention-matrix) — Record policy/version/time for material consent; deployed persistence and consent change UX unverified. |
| 236 | Cookie consent | P/R | [Assessment](threat-data.md#retention-matrix) — Inventory cookies/storage/external assets first; responsible advisor decides applicable consent obligations. |
| 237 | Product deletion vs billing | S/R | [Assessment](findings.md#f02--p1-billing-has-no-complete-account-lifecycle-or-concurrent-reconciliation) — Deletion does not complete subscription cancellation/reconciliation. |
| 238 | Email-address change workflow | R | [Assessment](threat-data.md#abuse-matrix) — Needs runtime verification: confirm new email, notification/recovery/session consequences and collision cases. |
| 239 | Password-change workflow | S/R | [Assessment](threat-data.md#abuse-matrix) — Session-stamp revocation patterns exist; complete change/reset/trusted-device UX matrix remains. |
| 240 | 2FA recovery | R | [Assessment](threat-data.md#abuse-matrix) — Needs runtime verification: recovery-code single use, lockout, device loss and accessible recovery. |
| 241 | OAuth account linking | O/S | [Assessment](threat-data.md#abuse-matrix) — Existing linking/security tests pass; live Google/Microsoft provider journey not called. |
| 242 | Deleted/recreated email account | R | [Assessment](threat-data.md#abuse-matrix) — Needs runtime verification: delete/recreate email and provider identity collision; never inherit old ownership. |
| 243 | Case-normalisation | S/R | [Assessment](threat-data.md#abuse-matrix) — Identity normalization exists; exhaustive email/source/provider case comparisons remain. |
| 244 | Unicode-normalisation security | R | [Assessment](threat-data.md#abuse-matrix) — Needs runtime verification: Unicode normalization/confusables in security identifiers; display spelling must remain. |
| 245 | Job URL canonicalisation | O/S | [Assessment](threat-data.md#product-invariants-and-enforcement) — Three extension capture-URL tests pass; canonicalization must not conflate distinct resource identity. |
| 246 | Duplicate detection | O/S | [Assessment](threat-data.md#product-invariants-and-enforcement) — Same-intent job POST duplicates observed; define dedup intent before enforcing uniqueness. |
| 247 | Referential history | S | [Assessment](threat-data.md#product-invariants-and-enforcement) — Preserve submitted package evidence across edits/deletes; live links must handle removed resources. |
| 248 | Event/history integrity | S/R | [Assessment](threat-data.md#product-invariants-and-enforcement) — History versions do not prevent conflict; verify append integrity and owner references across deletion. |
| 249 | Audit vs activity timeline | S | [Assessment](threat-data.md#product-invariants-and-enforcement) — Global job activity exposes content and is not a minimal privileged security ledger; F13. |
| 250 | Search privacy | S/R | [Assessment](threat-data.md#abuse-matrix) — Owner-filtered search required; logs/URLs and client residue can undermine privacy. |
| 251 | Pagination security | S/R | [Assessment](threat-data.md#abuse-matrix) — Pagination cannot bypass owner scope; full filter/cursor/soft-delete authorization corpus remains. |
| 252 | Sorting/filter injection | S/R | [Assessment](threat-data.md#abuse-matrix) — EF parameterization helps values; dynamic sort/filter names need allowlists and rejection tests. |
| 253 | Search denial-of-service | S | [Assessment](threat-data.md#abuse-matrix) — Unbounded materialization and user-owned row growth create resource risk; F10. |
| 254 | Regex review | R | [Assessment](threat-data.md#abuse-matrix) — Needs source/runtime verification: complete regex inventory, timeouts and adversarial backtracking corpus. |
| 255 | Serialization review | S/R | [Assessment](threat-data.md#abuse-matrix) — DTO/JSON/parser boundaries inspected selectively; serializer depth/type/size fuzz matrix remains. |
| 256 | DTO boundary enforcement | S/R | [Assessment](threat-data.md#abuse-matrix) — Explicit DTOs help; owner/role/entitlement/version fields need negative assignment regressions. |
| 257 | Mass-assignment testing | R | [Assessment](threat-data.md#abuse-matrix) — Needs runtime verification: extra JSON owner/admin/plan/deleted/version fields on all mutations. |
| 258 | Numeric-boundary testing | R | [Assessment](threat-data.md#abuse-matrix) — Needs runtime verification: negative/overflow/precision/NaN/infinity inputs for all numeric domains. |
| 259 | Nullability testing | R | [Assessment](threat-data.md#abuse-matrix) — Needs runtime verification: missing/null/empty distinctions and required fields across all DTOs. |
| 260 | Enum evolution | P/R | [Assessment](threat-data.md#abuse-matrix) — Treat new/unknown enum values deliberately in old clients/imports; compatibility tests proposed. |
| 261 | Soft-delete filter correctness | O/S | [Assessment](resilience.md#transaction-and-background-work-review) — Global owner/soft-delete filters and regression suites useful; administrative bypasses need explicit review. |
| 262 | EF Core query review | S/R | [Assessment](resilience.md#transaction-and-background-work-review) — Read-all exports/boards and quota sums identified; production-provider query plan measurements pending. |
| 263 | Connection-pool behaviour | R | [Assessment](resilience.md#transaction-and-background-work-review) — Needs runtime verification: MariaDB pool exhaustion/waits/timeouts; SQLite differs; PostgreSQL absent. |
| 264 | Database timeout handling | R | [Assessment](resilience.md#transaction-and-background-work-review) — Needs runtime verification: database timeout UX, host survival and accepted-operation recovery. |
| 265 | Migration locking | R | [Assessment](resilience.md#transaction-and-background-work-review) — Needs runtime verification: concurrent migrators/provider lock behavior and crash recovery. |
| 266 | Index migration safety | R | [Assessment](resilience.md#transaction-and-background-work-review) — Needs runtime verification: index build lock/disk/time on realistic MariaDB and SQLite shape. |
| 267 | Database backup consistency | S/R | [Assessment](resilience.md#transaction-and-background-work-review) — Live deploy tar is not consistency proof; daily VACUUM INTO is stronger; restore drill F12. |
| 268 | Encryption at rest | R | [Assessment](threat-data.md#data-classification) — Needs runtime verification: actual database/file/backup disk encryption and off-site key custody. |
| 269 | Encryption in transit | R | [Assessment](threat-data.md#data-classification) — Needs runtime verification: external HTTPS and DB/provider transport configuration. |
| 270 | Field-level encryption | S/P | [Assessment](threat-data.md#data-classification) — Protect provider tokens/TOTP using existing platform primitives; no custom searchable encryption proposed. |
| 271 | Encryption-key management | S/R | [Assessment](threat-data.md#data-classification) — Data Protection key ring is part of recovery and exposure boundary; live custody/rotation unproven. |
| 272 | Search versus encryption trade-off | P | [Assessment](threat-data.md#data-classification) — Encrypting searchable career fields adds query/rotation cost; require threat need and explicit tradeoff. |
| 273 | Screenshot/print privacy | P/R | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — Sensitive screen/print output needs user intent; browser/screenshot/print retention not globally preventable. |
| 274 | Public-link security | S/R | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — Unpredictable public slug, rotation/revocation and rate rules help; aggregate PDF control missing. |
| 275 | Public-profile privacy | S/P | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — Public profile is explicit publication; show exactly what fields/metadata become visible before sharing. |
| 276 | robots/noindex | S | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — Public HTML has noindex; PDF parity incomplete; robots directives are not access control. |
| 277 | Attachment metadata privacy | R | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — Needs runtime verification: EXIF/document properties and internal IDs in attachment outputs. |
| 278 | PDF metadata | R | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — Needs runtime verification: generated PDF author/title/producer/path/language metadata and reading order. |
| 279 | Generated filename safety | S/R | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — Filename construction reviewed selectively; Unicode/path/control-character download corpus remains. |
| 280 | Content-disposition encoding | R | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — Needs runtime verification: Unicode Content-Disposition compatibility and CRLF/control rejection. |
| 281 | Browser download behaviour | O/R | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — Existing PDF download browser checks pass; Safari/mobile/cancel/retry/large-download matrix remains. |
| 282 | Temporary download URLs | S/P/R | [Assessment](threat-data.md#data-lifecycle-and-copy-map) — Owner/public-link boundaries mapped; expiry/single-use rules for any temporary capability need specific contract tests. |
| 283 | Storage quota | S | [Assessment](threat-data.md#abuse-matrix) — Attachment byte sum is racy and excludes other retained artifacts; aggregate quota F10. |
| 284 | Usage accounting | S | [Assessment](threat-data.md#abuse-matrix) — AI usage estimates and file accounting need reservation/reconciliation across categories/processes. |
| 285 | Quota UX | P/R | [Assessment](threat-data.md#abuse-matrix) — Explain quota used/remaining and recoverable choices; preserve data rather than delete silently. |
| 286 | Downgrade behaviour | S/R | [Assessment](threat-data.md#abuse-matrix) — Server entitlement rechecks help; downgrade over-quota handling and UI sandbox journey remain. |
| 287 | Trial-expiry UX | R | [Assessment](threat-data.md#abuse-matrix) — Needs runtime verification: configured trial states and expiry warning/action behavior. |
| 288 | Billing failure UX | R | [Assessment](threat-data.md#abuse-matrix) — Needs runtime verification: failed payment, dunning, grace period and delayed event UX. |
| 289 | Norwegian consumer considerations | R | [Assessment](product-operations.md#navigation-and-domain-language) — Requires responsible legal/commercial review; no Norway consumer-law compliance determination made. |
| 290 | International readiness | P/R | [Assessment](product-operations.md#navigation-and-domain-language) — Norwegian-first product can retain explicit locale/currency/time semantics; no all-market readiness claim. |
| 291 | Address model | P/R | [Assessment](resilience.md#time-and-compatibility-policy) — Use optional structured address/display text; international addresses and no-postcode cases need tests. |
| 292 | Telephone-number model | P/R | [Assessment](resilience.md#time-and-compatibility-policy) — Preserve international prefix/display input; avoid Norway-only length assumptions; round-trip unverified. |
| 293 | Salary model | P/R | [Assessment](resilience.md#time-and-compatibility-policy) — Salary needs amount/range/currency/period; never silently treat annual/monthly or currencies alike. |
| 294 | Workplace model | P/R | [Assessment](resilience.md#time-and-compatibility-policy) — Distinguish remote/hybrid/on-site and location text; avoid country-specific required fields without need. |
| 295 | Job-source model | S/P | [Assessment](resilience.md#time-and-compatibility-policy) — Keep source URL/provenance/acquisition time; canonicalization must not erase meaningful distinctions. |
| 296 | Company model | P/R | [Assessment](resilience.md#time-and-compatibility-policy) — Company display spelling and normalized search separate; history/merge policy needs explicit tests. |
| 297 | Contact model | P/R | [Assessment](resilience.md#time-and-compatibility-policy) — Contact details remain private owner data; deletion/normalization and contact role semantics need tests. |
| 298 | Correspondence model | S/R | [Assessment](resilience.md#time-and-compatibility-policy) — Mail content/tokens/attempts have distinct lifecycle; uncertain send is not safe to repeat. |
| 299 | Reminder model | O/S | [Assessment](resilience.md#time-and-compatibility-policy) — Calendar instant bug observed; reminder delivery/time-zone/DST recurrence remains F07/F21. |
| 300 | Notification preferences | S/R | [Assessment](resilience.md#time-and-compatibility-policy) — Reminder preference checks exist; every channel/category/opt-out needs delivery-level verification. |
| 301 | Accessibility preferences | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: persist/obey reduced motion, contrast/text/input preferences. |
| 302 | High-contrast support | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: Windows forced colors/high contrast; dark mode is not equivalent. |
| 303 | Windows accessibility testing | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: Windows Narrator/NVDA and native keyboard/platform behavior. |
| 304 | Text-spacing WCAG testing | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: required text spacing without clipped/hidden controls or data. |
| 305 | Reflow testing | O/R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Outer builder overflow0 at375/1440; actual zoom/320 effective width reflow remains. |
| 306 | Orientation | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: portrait/landscape and no unjustified orientation restriction. |
| 307 | Pointer gestures | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: single-pointer alternatives to complex/path-based gestures. |
| 308 | Drag-and-drop alternatives | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: keyboard/status-menu alternative to drag/drop and accessible announcements. |
| 309 | Auto-updating content | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: polling/preview/autosave updates preserve focus and offer understandable announcements. |
| 310 | Session timeout accessibility | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: timeout warning, extension/reauthentication and preserved accessible draft. |
| 311 | Authentication accessibility | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: cognitive/keyboard/screen-reader authentication and error recovery. |
| 312 | CAPTCHA fallback | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: configured Turnstile failure/unavailable/accessibility fallback. |
| 313 | Password-manager support | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: password-manager fill/save, paste and change/reset flows. |
| 314 | Autocomplete attributes | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs source/runtime verification: appropriate autocomplete/inputmode across identity/contact forms. |
| 315 | Copy-link behaviour | S/R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Clipboard promise must determine success feedback; denied permission matrix unexecuted. |
| 316 | Focus after navigation | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: route change moves/announces focus predictably without trapping users. |
| 317 | Page-title updates | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: distinct localized page titles for SPA routes. |
| 318 | Live-region strategy | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: meaningful save/error/queue live regions without repeated announcement spam. |
| 319 | AI streaming accessibility | P/R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — For streamed AI output, announce status/completion without token-by-token speech; current full flow unverified. |
| 320 | Reduced-data considerations | P/R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Avoid mandatory heavy AI/assets for core tracking; reduced-data behavior not measured. |
| 321 | Asset caching | S/R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Static-export caching needs version policy; actual proxy/CDN headers and stale-asset behavior unverified. |
| 322 | Service-worker audit | N/P | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — No deployed service-worker behavior established; do not introduce private offline caches during this repair. |
| 323 | PWA decision | P | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — PWA is not a current launch requirement; first solve revision and recoverable draft contracts. |
| 324 | Mobile keyboard behaviour | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: real mobile keyboard overlap, viewport resizing and focused fields. |
| 325 | Safe-area insets | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: device safe-area insets and bottom action reachability. |
| 326 | Touch hover assumptions | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: every hover-only action has touch/keyboard access. |
| 327 | Right-click/middle-click | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: navigation links support middle/right click and modified keyboard activation. |
| 328 | Copyability | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: key IDs/errors/output text remain selectable/copyable with clear feedback. |
| 329 | Scroll restoration | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: useful scroll restoration for lists/detail/back/refresh. |
| 330 | Sticky element collisions | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: stacked sticky toolbars at zoom/mobile/landscape do not obscure content. |
| 331 | Anchor offset | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: anchor targets and focused fields clear fixed headers. |
| 332 | Z-index audit | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs source/runtime verification: stacking contexts, overlay order and hidden focus under portals. |
| 333 | Portal usage | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: portal theme/context/focus/click-outside behavior. |
| 334 | Modal nesting | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: modal nesting, one focus trap and escape/back order. |
| 335 | Escape-key consistency | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: Escape semantics across menus/dialogs/drawer/unsaved prompts. |
| 336 | Form submission semantics | O/R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Basic login/forms exercised; all Enter/submission/preventDefault/validation paths remain. |
| 337 | Double-submit protection | O/S | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Repeated creation creates two rows; editor queue only protects one instance, F01. |
| 338 | Optimistic UI correctness | S/R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Optimistic success must reconcile failures/conflicts; complete delayed/out-of-order response suite remains. |
| 339 | Stale cache correctness | S/R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Old editor state overwrites newer server state; no complete revision/stale-cache contract. |
| 340 | Cross-account cache clearing | O/R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Cross-tab logout leaves editor content; full account-switch and browser Back cache sweep remains. |
| 341 | Sensitive browser cache | O | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Auth/CV/CSV sampled responses lack no-store; no actual shared-cache disclosure demonstrated. |
| 342 | Clipboard security | S/P | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Copy only deliberate values; acknowledge clipboard rejection; clipboard retention is outside server control. |
| 343 | Autofill/privacy | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: autofill suggestions, shared-device residue and sensitive form storage. |
| 344 | Telemetry failures | R | [Assessment](resilience.md#dependency-and-operation-failure-matrix) — Needs runtime verification: telemetry loss must not block normal save/auth actions. |
| 345 | Logging failures | S/R | [Assessment](resilience.md#dependency-and-operation-failure-matrix) — PII logging risks identified; disk-full/log-sink outage and blocking/backpressure behavior untested. |
| 346 | Monitoring dependency | P/R | [Assessment](resilience.md#dependency-and-operation-failure-matrix) — Independent monitor/dead-man signal proposed; app host must not be sole observer of its failure. |
| 347 | Health-check side effects | S | [Assessment](resilience.md#dependency-and-operation-failure-matrix) — Liveness/readiness separation exists; probes should not trigger costly provider calls or writes. |
| 348 | Readiness semantics | S/R | [Assessment](resilience.md#dependency-and-operation-failure-matrix) — Ready checks database; optional-service readiness semantics and outage behavior need deployed proof. |
| 349 | Startup ordering | O/R | [Assessment](resilience.md#dependency-and-operation-failure-matrix) — Local fresh startup succeeds; external database/proxy/model ordering and restart races untested. |
| 350 | Graceful shutdown | S/R | [Assessment](resilience.md#dependency-and-operation-failure-matrix) — Cancellation/leases reviewed; host termination during writes/render/send needs isolated drill. |
| 351 | Deployment interruption | R | [Assessment](product-operations.md#release-gates-and-production-readiness-checklist) — Needs runtime verification: interruption at backup/migration/replace/smoke checkpoints. |
| 352 | Zero-downtime realism | S/R | [Assessment](product-operations.md#release-gates-and-production-readiness-checklist) — Single-host Compose replacement is not demonstrated zero downtime; define acceptable maintenance window. |
| 353 | Database migration rollback limitations | S | [Assessment](product-operations.md#release-gates-and-production-readiness-checklist) — Old-image rollback cannot reverse destructive/provider-specific schema changes, F12. |
| 354 | Backup before destructive migration | S/R | [Assessment](product-operations.md#release-gates-and-production-readiness-checklist) — Predeploy backup exists but consistency/integrity must be proven before destructive migration. |
| 355 | Deployment observability | S/P | [Assessment](product-operations.md#release-gates-and-production-readiness-checklist) — Deploy smoke/logs help; correlate release/config/backup/migration status with user impact. |
| 356 | Release correlation | P/R | [Assessment](product-operations.md#release-gates-and-production-readiness-checklist) — Expose safe commit/artifact/config identifiers in diagnostics; actual full release correlation not proven. |
| 357 | Feature rollout strategy | P | [Assessment](product-operations.md#release-gates-and-production-readiness-checklist) — Use small cohort and observed gates; percentage-rollout platform unnecessary at this scale. |
| 358 | Kill switches | S/P | [Assessment](product-operations.md#release-gates-and-production-readiness-checklist) — Document worker/provider/registration switches and effect on accepted work; test both states. |
| 359 | Configuration change audit | P/R | [Assessment](product-operations.md#release-gates-and-production-readiness-checklist) — Privileged config changes need safe actor/time/reason record; actual operational audit unverified. |
| 360 | Admin safety | S | [Assessment](threat-data.md#assets-and-intended-access) — Admin minimum scope/recent auth/immutable audit incomplete; normal user denied, F13. |
| 361 | Bulk operations | P/R | [Assessment](threat-data.md#assets-and-intended-access) — Require bounded batches, explicit targets, preview/recovery and owner checks per item; complete workflow untested. |
| 362 | Batch API design | P | [Assessment](threat-data.md#assets-and-intended-access) — Batch cost must be bounded per item and aggregate; specify partial-success/idempotency contract first. |
| 363 | Background exports | S/P | [Assessment](resilience.md#transaction-and-background-work-review) — Large export generation should be bounded/streamed or durable queued; existing JSON collections buffer. |
| 364 | Email queue | S/P | [Assessment](resilience.md#transaction-and-background-work-review) — Use database outbox for transactional auth/reminder mail; no broker required initially. |
| 365 | Email idempotency | S | [Assessment](resilience.md#transaction-and-background-work-review) — Direct sends and commit order can duplicate or lose outcome; ambiguous external send needs reconciliation. |
| 366 | Reminder delivery reliability | S | [Assessment](resilience.md#transaction-and-background-work-review) — Reminder loop sends before common SaveChanges; disabled sender can mark sent, F07. |
| 367 | Time-sensitive jobs | S/R | [Assessment](resilience.md#time-and-compatibility-policy) — Backup local-hour cron has DST skip/double risk; date-based catch-up/dedup drill needed. |
| 368 | Clock dependence | S/R | [Assessment](resilience.md#time-and-compatibility-policy) — UTC lease/deadline/time-provider conventions required; substantial clock-skew drill unexecuted. |
| 369 | Client/server time mismatch | O/R | [Assessment](resilience.md#time-and-compatibility-policy) — Explicit offset round-trip is already wrong F21; actual client/server skew matrix remains. |
| 370 | Pagination limits | S | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Paged endpoints do not bound unpaged board/analytics/export paths; cap all expensive work. |
| 371 | Export limits | O/S | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Export limiter shares IP across accounts; generation still buffers, F06/F10. |
| 372 | Search-index strategy | P/R | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Inspect actual provider plans before new search index/server; owner-scoped queries first. |
| 373 | Redis decision | N/P | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Redis absent; no measured cache/shared-state need justifies adding it now. |
| 374 | Queue decision | S/P | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Existing durable database AI queue useful; extend precise delivery semantics rather than add broker. |
| 375 | Modular-monolith assessment | S/P | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Modular monolith is appropriate; current controllers/services/EF support focused boundary repair. |
| 376 | Microservice boundary warning | P | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Independent deployment adds failure/transaction/operational cost; do not split domain services speculatively. |
| 377 | Scalability myths | P | [Assessment](product-operations.md#performance-capacity-and-cost-model) — User count is not concurrency/capacity proof; benchmark actual workload and bottlenecks. |
| 378 | Cost architecture | P | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Host/DB/storage/backups/egress/mail/AI/operator-time cost model supplied; no current prices claimed. |
| 379 | Cost observability | P | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Measure per-success workload cost including failed/retried attempts and actual provider charges. |
| 380 | Cost abuse alerts | P/R | [Assessment](product-operations.md#performance-capacity-and-cost-model) — User/workflow/global budget anomaly and admission alerts proposed; delivery not tested. |
| 381 | Data-growth projections | P | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Explicit synthetic storage growth example; history/package/backups multiply retained bytes. |
| 382 | Archive strategy | P/R | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Set retention and owner-safe archive semantics before introducing partitioning/services. |
| 383 | Query-plan testing | R | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Needs runtime verification: realistic SQLite/MariaDB EXPLAIN plans and worst-owner data. |
| 384 | Performance regression testing | P/R | [Assessment](product-operations.md#performance-capacity-and-cost-model) — Define p95/p99/memory/bytes baseline and budgets; no load-regression gate measured. |
| 385 | Bundle regression | O/P | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Static build passes; route payload/bundle growth budgets proposed, not benchmarked. |
| 386 | Lazy-loading strategy | S/P | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Retain route-level loading and split only measured heavy paths; no speculative dynamic-import rewrite. |
| 387 | Third-party frontend scripts | O/R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Google Fonts request was blocked in harness; complete production third-party script inventory remains. |
| 388 | Font strategy | O/P | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Fallback-font rendering captured; evaluate approved self-hosting and compare document layout. |
| 389 | Image strategy | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: actual asset formats/sizes/alt text/lazy behavior and layout shifts. |
| 390 | Skeleton accessibility | P/R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Skeletons must preserve layout and expose meaningful busy state; no all-component proof. |
| 391 | Motion performance | P/R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Honor reduced motion and avoid expensive animation; profile real low-end/mobile devices. |
| 392 | CSS performance | R | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Needs runtime verification: style recalculation/layout/paint hot paths before CSS optimization. |
| 393 | Memory leaks frontend | R | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Needs runtime verification: repeated route/editor mount, timers/listeners/iframe/blob memory growth. |
| 394 | Request cancellation | S/R | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Audit cancellation at component and downstream boundaries; full late-response/unmount harness absent. |
| 395 | Race-condition frontend testing | O/R | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Stale and simultaneous CV saves demonstrate race; all frontend response reorder cases remain. |
| 396 | Debounce/throttle audit | S | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Editor debounce/save queue helps one instance; no cross-client conflict or durable recovery guarantee. |
| 397 | Autosave state indicator | O/S | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Saved/failed indicator and local queue exist; prevent false success across stale/conflicting revisions. |
| 398 | Unsaved-change protection | O | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Unload warning exists and was deliberately accepted in reload probe; do not report absent warning. |
| 399 | Draft recovery | O | [Assessment](resilience.md#resilience-test-matrix--break-jobjakt) — Offline unsaved edit not restored after confirmed reload; scope privacy-aware draft recovery. |
| 400 | Final cross-cutting audit deliverables | P | [Assessment](README.md#read-the-assessment) — Requested matrices, models, runbooks and acceptance deliverables supplied. |
| 401 | Add a "What happens if...?" section | S/O/R | [Assessment](resilience.md#what-happens-if) — All 50 questions answered; observed/source/runtime boundaries stated individually. |
| 402 | Add a "Break Jobjakt" testing phase | O/R | [Assessment](verification.md#break-jobjakt-observations) — 27 observations, 22 unmet expectations; remaining safe staging scenarios listed. |
| 403 | Add a "Commercial product readiness" assessment | P | [Assessment](README.md#commercial-assessment) — Personal, 100-user, 10,000-user and charging-money readiness judgments with blockers. |
| 404 | Add a "Professional polish" checklist | S/O/P | [Assessment](product-operations.md#visual-accessibility-and-professional-polish-review) — Professional polish review/checklist and retained synthetic screenshots. |
| 405 | Console-cleanliness requirement | O/R | [Assessment](verification.md#console-network-and-backend-logs) — Local logs inspected; injected failures separated from normal warnings; production remains unverified. |
| 406 | Network-cleanliness requirement | O/R | [Assessment](verification.md#console-network-and-backend-logs) — Local logs inspected; injected failures separated from normal warnings; production remains unverified. |
| 407 | Backend-log cleanliness | O/R | [Assessment](verification.md#console-network-and-backend-logs) — Fresh startup migration/key warnings recorded; no recurrent normal request exception observed; production logs uninspected. |
| 408 | Accessibility cleanliness | O/R | [Assessment](findings.md#f14--p2-launch-quality-gate-builder-accessibility-is-outside-the-green-axe-suite) — Serious builder findings in all eight states; manual screen reader still required. |
| 409 | No known P0 before launch | P | [Assessment](README.md#launch-blockers-in-execution-order) — No confirmed P0 in scope; unresolved P1s and missing production gates block launch. |
| 410 | Definition of Done | P | [Assessment](product-operations.md#definition-of-done-and-practical-pr-checklists) — Tailored DoD and PR/security/UI/database/deployment checklists supplied. |
| 411 | PR checklist | P | [Assessment](product-operations.md#definition-of-done-and-practical-pr-checklists) — Tailored DoD and PR/security/UI/database/deployment checklists supplied. |
| 412 | Security checklist | P | [Assessment](product-operations.md#definition-of-done-and-practical-pr-checklists) — Tailored DoD and PR/security/UI/database/deployment checklists supplied. |
| 413 | UI checklist | P | [Assessment](product-operations.md#definition-of-done-and-practical-pr-checklists) — Tailored DoD and PR/security/UI/database/deployment checklists supplied. |
| 414 | Database-change checklist | P | [Assessment](product-operations.md#definition-of-done-and-practical-pr-checklists) — Tailored DoD and PR/security/UI/database/deployment checklists supplied. |
| 415 | Deployment checklist | P | [Assessment](product-operations.md#definition-of-done-and-practical-pr-checklists) — Tailored DoD and PR/security/UI/database/deployment checklists supplied. |
| 416 | Final challenge | P | [Assessment](README.md#commercial-assessment) — Measurable correctness/security/a11y/recovery criteria define paid-user recommendation. |