jobtrackingapp/docs/redesign/phase-9/p9-remed-02/FINDINGS.md

# P9-REMED-02 finding and independent gate register

Date:25 October2026. Baseline3727a72, branch `fix/p9-pdf-security-requalification`; checkpointb313e20. This successor retains all59 earlier findings and adds P9-REMED-PTR01. Historical acceptance reports remain unchanged. [findings.json](findings.json) retains each inherited criterion/source, status, severity, dependency, owner, evidence and exact closure requirement. It separately records the3727a72 status and current bounded assessment.

**Final local functional regression PASS**, source-bound in [validation.json](validation.json):1130 backend,935 frontend,362 ordinary browser,35 MariaDB and58 sidecar. Separate lanes remain separate. Python findings and hosted isolation keep global automation incomplete; the collector exits1 honestly. Original failed attempts remain retained.

## Current gate-driving changes

| Item | Verified checkpoint and current consequence |
| --- | --- |
| Linux PDF / P9-REQUAL-PDF01 | Baseline11/24 failures reproduced. Original unchanged oracle now16/16+8/8 PASS,36+24pages, with licensed static fonts. Final frozen-source Windows and Linux24/24 plus supplementalLinux2/2 PASS. |
| Python / P9-REQUAL-SEC04 |65/109 baseline advisory alias groups remediated;44 remain individually assessed (filelock3,Torch19,Transformers22). Security **BLOCKED**, no owner risk acceptance. |
| Hosted CI / RD05 | Historical run853 shows host-network/socket preparation, first-guard exit1 and no database execution; fresh metadata does not reverify live HostConfig. **BLOCKED** pending operator isolation and lifecycle proof. |
| Preview recovery / P9-REMED-PTR01 | RAF moved Retry190px during held pointer, so no click/HTTP occurred. Minimal focus-owner repair has unit RED1/46GREEN and native4held-pointer+stale/admin6GREEN. Final935 frontend/362 browser PASS. |
| RD21 | RESOLVED within original six save/concurrency requirements; final35 MariaDB tests,1 MariaDB recovery,2 HTTP observations and6 separate browser companions PASS. Creation-intent idempotency remains separate OPEN debt.
| Human/provider/production | All human M09 cards remain NOT TESTED. Genuine checks carry into their explicit release gates; missing production infrastructure alone is not a development-phase veto. |

## Authoritative acceptance boundaries

[REQUEST §6](../REQUEST.md#6-accessibility-qualification) explicitly carries unfinished genuine human checks into release gates. PARTIAL is neither automatic failure nor completion. The remaining unclosed security risk is a Phase9 acceptance blocker requiring its own disposition; it is not a blanket rule that every advisory is exploitable. Final full-source local functional regression and output evidence now PASS; the security risk disposition remains separate.

[IMPLEMENTATION_PLAN Phase10](../../IMPLEMENTATION_PLAN.md#phase-10--cleanup) independently requires proof no route uses removed code, affected tests pass and the functionality inventory is satisfied. No unused-code census or cleanup permission is invented. Production TLS/backup/storage/rollback/deployed identity and live-provider gates retain separate owners. C11/P5-13 remains DEFERRED/withheld. Duplicate reminder reads and language metadata remain low documented debt; creation-intent idempotency needs a separate contract before implementation.

CV-UX-01 and CV-IMPORT-01 remain prohibited by this mission. No supplied authoritative entry rule permits overriding that explicit instruction, and no owner risk acceptance is implied. The final root addendum must name actual remaining conditions; neither a future conditional Phase9 recommendation nor automated fonts/axe checks automatically authorize a new feature project.

## Complete register

| ID | Current bounded status | Severity/impact | Phase9 | Phase10 | Production | Debt | Owner/required closure |
| --- | --- | --- | --- | --- | --- | --- | --- |
| RD01 | OPEN; local static/loopback ingress contracts only | High: wrong client identity or exposed ingress | operator release gate | candidate-specific ingress compatibility proof | BLOCKED pending actual ingress identity | open operational qualification | Release operator: actual TLS/IPv6/firewall/topology/trusted peer and deployed auth evidence |
| RD02 | NOT TESTED: independently verified off-disk complete backup/restore | Critical if recovery needed: irreversible loss | no independent veto of isolated functional QA | candidate restore dependency | BLOCKED backup/restore | open operational qualification | Release operator: isolated restore of DB/files/CVs/keys/tombstones, hashes and recovery rehearsal |
| RD03 | Fresh MariaDB12.2.2:35 integration cases,1 native recovery,2 HTTP cases and15-minute workload PASS; broader deployed parity remains PARTIAL. | High: schema/provider/startup disagreement | Local bounded provider qualification PASS; deployed parity remains independent. | provider migration proof per candidate | BLOCKED exact deployed parity/migrations | partial broad provider qualification | Database owner: actual approved MariaDB migration, restart, CRUD/constraints/concurrency and effective configuration proof |
| RD04 | NOT TESTED: intended Linux rollback | High: failed release cannot be reversed | no independent veto of isolated functional QA | rollback proof per candidate | BLOCKED actual rollback | open operational qualification | Release operator: isolated failure/rollback rehearsal using complete prior images/configuration/recovery set |
| RD05 | Hosted MariaDB BLOCKED: historical853/job1743 prepares host-network/socket job and exits first guard; fresh25October metadata has no new database run/private isolation proof. Live HostConfig not re-inspected. | High: healthy endpoint may serve wrong release | Hosted infrastructure qualification BLOCKED; no database test PASS/FAIL inferred. Assess independently from local provider closure. | Hosted evidence absent; independent affected testpass/unused-route/inventory criteria remain required. | BLOCKED deployed identity and operator diagnosis | open CI/release qualification | CI/operator owner: prove isolated private service execution and lifecycle without host socket/privileges/public ports/production coupling, then successful exact hosted TRX and cleanup. Keep workflow BLOCKED while isolation cannot be proven. Separate deployed runner/storage/release identity remains unqualified. |
| RD06 | PARTIAL: finite axe/DOM/keyboard evidence; human checks open | High accessibility impact | manual carry-forward allowed only as explicit release qualification (REQUEST §6), no human PASS | affected functionality must remain satisfied; no deletion permission | BLOCKED applicable human accessibility | open human qualification | Accessibility tester: [M09-01–06](../p9-03/MANUAL_CHECKLIST.md), contextual contrast/reader evidence; triage every applicable incomplete |
| RD07 | NOT TESTED: physical input/AT/alternate browsers/forced colors | Medium/High usability exclusion | manual carry-forward release qualification; no physical/AT PASS | affected functionality proof still required | BLOCKED supported device/browser/input acceptance | open human qualification | Product/accessibility owners: actual supported devices/browser/input versions and complete workflows |
| RD08 | DEFERRED; no new model qualification or activation | High: unqualified proposal semantics | C11 explicitly withheld; separate scope | no activation/deletion eligibility | BLOCKED AI activation unless separately qualified | DEFERRED product/model scope | Separate AI qualification owner: production-equivalent identity/inference, original 366-call protocol, independent human semantics, review UI/integration evidence |
| RD09 | Local withheld-operation contract retained; deployed withholding NOT TESTED | High: unreviewed AI write/external request | local withholding contract needs fresh successor | retain withholding and callers | BLOCKED deployed withholding untested | open deployment qualification | Release/AI owners: keep 503/no-provider/no-write guards, verify actual deployment independently |
| RD10 | PARTIAL overall: final original Windows24/24 and Linux24/24 fixtures/60pages each PASS; supplemental Linux2/2 (2+8pages) PASS. Human/physical printing/deployed output NOT TESTED. | Medium/High document reliability | Current original Linux/Windows and supplemental output PASS; human physical-print qualifications remain release gates. | affected rendering must preserve output contracts | BLOCKED intended output environment | open output qualification | Document owner: intended Linux/fonts/photo/crop/print and alternate-browser proof, original bytes/geometry |
| RD11 | Scoped SQLite bootstrap/WAL mechanism repaired before entry; broad reliability remains PARTIAL | High if preference save fails | scoped WAL repair retained; broad reliability qualification open | retain provider/concurrency safeguards | provider contention remains qualified | retained broader reliability | Database owner: retain held-reader/write proof, distinguish old reproduced mechanism from unproven provider/contention cases |
| RD12 | PARTIAL: notification draft/failure recovery and SQLite tests; complete contention/provider behavior unqualified | Medium: settings may not persist | no newly established failure; provider overlap remains qualification | candidate must preserve drafts and recovery | intended-provider qualification open | retained reliability | Database/settings owners: intended-provider overlapping writes and failure/reload recovery with no data loss |
| RD13 | Historical Rules 500 mechanism remains UNCONFIRMED | Medium: failed save/draft retention | historical causal mechanism UNCONFIRMED; not relabelled resolved | candidate must preserve Rules recovery | no complete reliability claim | unconfirmed historical observation | Rules/API owners: original failure trace plus controlled causal reproduction and successor regression; passing retry alone insufficient |
| RD14 | Historical command/dialog focus incident remains UNCONFIRMED; settled drawer proof is a separate finite result | Medium/High keyboard access | historical causal mechanism UNCONFIRMED; human focus qualification | candidate must preserve trap/return/error states | applicable human checks open | unconfirmed historical observation | Shared UI owner: preserve original observations, reproduce affected modal transitions and actual reader/trap/return behavior |
| RD15 | Historical intermittent CV section expansion cause unproven | Medium: editing disrupted | historical cause UNCONFIRMED; no invented current defect | candidate must preserve expansion state | broader reliability qualification | unconfirmed historical observation | CV owner: retain failed observation and reproduce causally before closing; do not weaken expansion assertions |
| RD16 | Scoped company-error repair retained; wider reader/dialog/date contract PARTIAL | Medium: recovery/access | scoped repair historical PASS; broader human contract open | candidate-specific recovery proof | human/provider qualification open | partial preserved contract | Company/UI owners: native failed-save → retained draft → successful retry plus human dialogue checks |
| RD17 | PARTIAL: prior exclusive15-minute MariaDB workload passed at3727a72; current remediation is not a new workload/capacity SLA. Independent bounded performance qualification retained. | Medium: growing rendering cost | Finite15-minute local MariaDB workload PASS; no capacity SLA. | measured bottleneck and full membership before optimization | no production capacity/SLA claim | O(N) known design limit | Jobs owner: agreed budget, bounded sustained profile and CPU/frame attribution before optimization; preserve full membership |
| RD18 | NOT TESTED: physical drag/drop/cancel/browser variants | Medium access/workflow risk | manual carry-forward release qualification; physical behavior not passed | retain accessible reorder alternatives | BLOCKED physical input variants | open device qualification | Input/device tester: real Board/CV selection and named alternatives, no hidden result cap |
| RD19 | DEFERRED: reviewed `followMode` consumer | Medium workflow limitation | accepted deferred reviewed consumer; no activation | ineligible to remove metadata/paths | separate activation gate | DEFERRED product scope | Product/mail owner: separate explicit mode→review/action/fallback design; no auto-send or uncertain resend |
| RD20 | Optional P5-05 quick preview DEFERRED; Phase 8 Dashboard scope was delivered separately | Low optional scope | optional preview DEFERRED; full workspace retained | no deletion of full workspace/aliases | no independent veto while optional scope remains deferred | DEFERRED optional scope | Product owner: explicit separate brief; retain existing full workspace and all routes |
| RD21 | RESOLVED within original six save/concurrency requirements; final35 MariaDB tests,1 MariaDB recovery,2 HTTP observations and6 separate browser companions PASS. Creation-intent idempotency remains separate OPEN debt. | High: stale editor can overwrite acknowledged edits | Original six save/concurrency requirements RESOLVED in tested scope; separate creation debt retained. | no compatibility removal without all-caller/rollback proof | BLOCKED deployment/rollback parity; no historical recovery claim | creation-intent idempotency OPEN, separate concern | Domain/API/UI owners: separate bounded contract issue covering both callers, server compare-and-swap/transaction semantics, conflict recovery and backward compatibility; characterization is not safety acceptance |
| RD22 | NOT TESTED: enabled-worker outage recovery/durability | High: duplicate/lost async work | isolated fixtures do not accept enabled producer | retain stable IDs and recovery paths | BLOCKED enabled-worker recovery | open operational qualification | Worker owner: isolated enabled-producer failure/restart/recovery, no-loss/no-duplicate proof before activation |
| RD23 | OPEN: actual calendar offset/DST/date-only semantics | Medium: wrong event time | actual offset/DST/date-only unqualified | retain calendar semantics until dedicated proof | BLOCKED calendar activation qualification | open provider semantics | Calendar owner: dedicated boundary/DST/provider proof in authorised sandbox before semantic changes |
| RD24 | NOT TESTED: billing/deletion/retention/provider cleanup policy and configuration | High privacy/lifecycle impact | policy and destructive lifecycle outside functional proof | no removal without approved lifecycle policy | BLOCKED policy/restore/provider cleanup | open policy qualification | Product/security/operator owners: approved policy, explicit destructive-action authority, isolated recovery/cleanup proof |
| RD25 | PARTIAL: local SMTP/HTTP/provider contracts; actual OAuth/Turnstile/mail/calendar/model unavailable | High identity/privacy/delivery impact | sandbox/provider qualifications remain; fixtures do not pass them | candidate must preserve auth/delivery contracts | BLOCKED applicable real provider evidence | open provider qualification | Approved provider/human tester: sandbox consent/revoke/reconnect/origin/state/delivery/uncertain-attempt proof |
| RD26 | Legacy Job/Application cutover OPEN | High compatibility/data loss if removed | no legacy cutover authorized | BLOCKED deletion until expand/verify/contract and all readers/writers | BLOCKED unqualified cutover | open migration scope | Migration owner: expand/verify/contract, restore/rollback and all readers/writers/aliases before removal |
| RD27 | NOT TESTED: actual monitoring/alert/recovery coverage | High operational detection risk | no independent veto of isolated functional QA | candidate observability proof where affected | BLOCKED actual alert/recovery | open operational qualification | Operations owner: effective sink, alert trigger, responder/runbook and recovery observations |
| RD28 | Ongoing evidence/provenance obligation | High if failures are misrepresented | fresh exact evidence and source binding required | required exact candidate evidence | required exact deployment evidence | ongoing obligation | QA owner: exact source hashes/counts, original failures, no retries/skips/assertion relaxation; separate characterization from safe behavior |
| P9-OPS-01 | Previously reported EXT4/Docker storage errors UNRECHECKED | Critical if disk faults persist | not a standalone functional defect; retain stated qualification | no permission to delete; affected-candidate proof | BLOCKED until stated operator closure | retained gate | Production operator only: independent storage-health/repair and recovery qualification under separate authority |
| P9-SEC-01 | BLOCKED: five exact compatible/parser pins remove65/109 baseline advisory alias groups;44 remain (filelock3,Torch19,Transformers22), individually assessed without owner risk acceptance. Full model-runtime qualification unavailable. | High dependency risk until assessed | BLOCKER by acceptance-risk judgment under REQUEST9/13/14: selected-model/cache applicability and compatible fixes remain unqualified; not an automatic veto for every advisory. No owner risk waiver. | Unwaived security uncertainty and affected functionality/testpass criteria remain; no cleanup authority. | BLOCKED independent deployed dependencies/model integrity, active parser exposure and release review; local repairs are not deployed. | Remaining serious uncertainty is not accepted optional debt. Individual source-limited assessments remain visible. | Security/sidecar owners: complete narrowly scoped filelock cache/protocol compatibility work, select a patched compatible CPU Torch/Transformers graph, verify immutable model/checkpoint identities and startup/inference/extraction contracts in an approved environment; serious residual risk requires explicit owner disposition. No automatic waiver, model change/download or production action. |
| P9-PUB-01 | Remediation checkpoints normally published throughb313e20 as reported in execution ledger; final commit/remote/clean-tree verification remains root publication responsibility. | Resolved for published checkpoint; final commit still needs its own direct equality proof | not a standalone functional defect; retain stated qualification | no permission to delete; affected-candidate proof | BLOCKED until stated operator closure | retained gate | QA: retain failed attempts and verify each subsequent normal push; no force push |
| P9-T01 | RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged. | Medium test reliability: parser descendant test could time out before it had a descendant | fresh affected regression required | candidate proof only; no cleanup authority | does not clear independent release gates | Resolved in tested Windows environment; Linux run remains separate. | QA; `.artifacts/phase9/sidecar-entry-failed.*`, `sidecar-fixture-red.*`, `sidecar-fixture-green.*`, `sidecar.xml` |
| P9-L01 | RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged. | Low localisation defect: Admin grid vendor controls appear in English in Bokmål | fresh affected regression required | candidate proof only; no cleanup authority | does not clear independent release gates | Resolved in observed local integration; no authorisation, pagination or data contract change. | Frontend; `admin-users-page.test.tsx`, `AdminUsersPage.tsx`; retained RED/GREEN logs/JSON |
| P9-V01 | RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged. | Medium visual defect: wrapped public h2 lines overlap at320px in EN/NB | fresh affected regression required | candidate proof only; no cleanup authority | does not clear independent release gates | Bounded fix verified by native geometry/build; the complete final 362-case ordinary successor also passed. | Frontend; `LandingPage.tsx`, new `landing-presentation.spec.ts`; `landing-red`, `landing-qualified`, `landing-accepted` raw reports |
| P9-V02 | RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged. | Medium visual defect: wrapped bottom CTA title lines overlapped | fresh affected regression required | candidate proof only; no cleanup authority | does not clear independent release gates | bounded CTA repair separate from P9-V01 four-h2 repair | Frontend/QA: preserve existing LandingPage lineHeight1.4 and exact CTA+heading geometry assertions; qualify fresh complete landing and ordinary successors on frozen source, retain original RED/GREEN evidence and native-width images |
| P9-L02 | RETAINED low development debt | Low linguistic residual: stored event type `Created` appears in Bokmål job history/audit | nonblocking development debt with visible limit | candidate proof only; no cleanup authority | does not clear independent release gates | Retained nonblocking development qualification; no data mutation proposed. | UI/localisation owner; separately map known event enums with unknown-value fallback and history/audit tests; human wording review |
| P9-T02 | RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged. | Low test compatibility: existing Admin pagination fixture hard-coded the English vendor accessible name in Bokmål mode | fresh affected regression required | candidate proof only; no cleanup authority | does not clear independent release gates | Test-only repair; no product or authorisation change. | QA; `phase7-admin-users.spec.ts`; original shard report/trace and `admin-grid-green` retained. Other English-name callers belong to the separate English JobTable owner and remain unchanged. |
| P9-PERF-01 | RETAINED low development debt | Low duplicate report work: shell and Dashboard each initially read reminders | nonblocking development debt with visible limit | candidate proof only; no cleanup authority | does not clear independent release gates | Accepted existing development debt; no Phase 10 implementation here. | Shared reminder read owner; measured benefit and independent shell/dashboard failure/loading tests before consolidation. |
| P9-T03 | RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged. | High test isolation | fresh exact fixture/case successor | preserve isolation and assertions | not enabled-worker acceptance | no product fix inferred | QA: retain failed run, unchanged no-write assertions, fixture config delta and fresh full successor |
| M09-01 | NOT TESTED | High accessibility qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | accessibility tester Names, roles, values, selected state, headings, reading order and errors are understandable; retain reader/version and spoken observations. No hidden background content is announced. |
| M09-02 | NOT TESTED | High accessibility qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | accessibility tester Visible focus, logical order, genuine traps only while modal, Escape and focus restoration; no off-screen/hidden tab stops. Record any transition-specific failure. |
| M09-03 | NOT TESTED | High accessibility qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | accessibility tester Each action/position/save/error announces once and agrees with visible DOM order; pointer drag has an equivalent keyboard route. |
| M09-04 | NOT TESTED | High accessibility qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | accessibility tester Applicable normal text ≥4.5:1, large text ≥3:1 and necessary UI boundaries/focus ≥3:1. Record sampled colors/ratios/state. An axe incomplete is not sufficient to close the row. |
| M09-05 | NOT TESTED | High accessibility qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | accessibility tester Invisible zero badge is absent from announcements; live unread count remains meaningful; closed drawer is neither read nor tabbable. Runtime DOM checks cover only the tested states. |
| M09-06 | NOT TESTED | High accessibility qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | accessibility tester Essential controls remain reachable/readable, no lost content or focus; distinguish intentional table/document scrollers from root clipping. Preserve fixed A4/Letter geometry. |
| M09-07 | NOT TESTED | Medium/High human/provider/output qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | product owner with physical devices No keyboard-obscured primary action/data loss; reachable touch targets, no accidental destructive action; record device/input mode. Emulated touch does not close this. |
| M09-08 | NOT TESTED | Medium/High human/provider/output qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | Bokmål reviewer Natural professional Bokmål, consistent established terms, meaningful messages. Separate authored English content, technical names and provider strings from untranslated application copy. |
| M09-09 | NOT TESTED | Medium/High human/provider/output qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | document reviewer Legible fonts, intact glyphs/diacritics, margins, page boundaries, searchable text, photo/crop, correct language/date output and no missing/duplicated content. Retain original bytes, renderer/font versions and print observations. |
| M09-10 | NOT TESTED | Medium/High human/provider/output qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | approved provider tester Correlated origin/state, explicit confirmation, no accidental resend, correct ownership/timezone. Local SMTP/HTTP fixtures do not close external-provider qualification. |
| P9-AX-01 | Requires manual inspection | Accessibility qualification; incomplete is not a confirmed violation | carry exact applicable manual qualification; no violation or human PASS inferred | retain accessible functionality; affected-candidate proof required | applicable manual evidence required | human qualification; do not count repeated occurrences as unique defects | Accessibility tester Shared Dashboard drawer settled predicate, Escape focus and24Tab proof pass. Original Analytics transition cause is not proven; human reader/transition qualification remains. |
| P9-AX-02 | Requires manual inspection | Accessibility qualification; incomplete is not a confirmed violation | carry exact applicable manual qualification; no violation or human PASS inferred | retain accessible functionality; affected-candidate proof required | applicable manual evidence required | human qualification; do not count repeated occurrences as unique defects | Accessibility tester Contextual foreground/background measurement remains required. |
| P9-AX-03 | Requires manual inspection | Accessibility qualification; incomplete is not a confirmed violation | carry exact applicable manual qualification; no violation or human PASS inferred | retain accessible functionality; affected-candidate proof required | applicable manual evidence required | human qualification; do not count repeated occurrences as unique defects | Accessibility tester Contextual foreground/background measurement remains required. |
| P9-AX-04 | Not applicable in tested settled hidden state | Accessibility qualification; incomplete is not a confirmed violation | carry exact applicable manual qualification; no violation or human PASS inferred | retain accessible functionality; affected-candidate proof required | historical zero-state not applicable; live reader state still open | human qualification; do not count repeated occurrences as unique defects | Accessibility tester Four current native EN/NB theme vectors: aria-hidden=true and zero area. Actual reader/live unread-state remains separate. |
| P9-REQUAL-SEC01 | LOCALLY REMEDIATED; post-pin audits zero and complete affected frozen-source successors PASS; production NOT DEPLOYED. | High GHSA-846f-f764-76mx SignedCms CPU exhaustion; Moderate GHSA-2fmv-rv2c-59x7 Windows EnvelopedCms behavior. Vulnerable package presence established; application reachability/exploit not claimed. | Bounded compatible repair and affected regression PASS; independent Python gate remains open. | testpass and functionality-inventory criteria still require final complete evidence; no cleanup authority | NOT DEPLOYED; no deployed fix or app-reachable exploit claim; independent release gates retained | published vulnerable package version repaired locally; remaining evidence qualification | Dependency/QA owner: Direct compatible package override System.Security.Cryptography.Pkcs8.0.2; retain MimeKit4.17.0 ownership. Retain before/after advisory paths, raw hashes and exact lock/pin delta; complete frontend/browser and required full successors, then bind all reports to final source. Production deployed dependencies/exposure remain independent. |
| P9-REQUAL-SEC02 | LOCALLY REMEDIATED; post-pin audits zero and complete affected frozen-source successors PASS; production NOT DEPLOYED. | Critical package advisories GHSA-2464-fhr4-w9xw, GHSA-p3m5-59mp-jv5r and GHSA-673q-mjm6-r5xr. Vulnerable package presence is distinct from reachable deployed paths; no application exploit claimed. | Bounded compatible repair and affected regression PASS; independent Python gate remains open. | testpass and functionality-inventory criteria still require final complete evidence; no cleanup authority | NOT DEPLOYED; no deployed fix or app-reachable exploit claim; independent release gates retained | published vulnerable package version repaired locally; remaining evidence qualification | Dependency/QA owner: Pin Next and eslint-config-next exactly16.4.1. Existing static export, unoptimized images and Sharp0.35.5 mitigate the image-serving path; they do not close every package advisory. Retain before/after advisory paths, raw hashes and exact lock/pin delta; complete frontend/browser and required full successors, then bind all reports to final source. Production deployed dependencies/exposure remain independent. |
| P9-REQUAL-SEC03 | LOCALLY REMEDIATED; post-pin audits zero and complete affected frozen-source successors PASS; production NOT DEPLOYED. | High GHSA-mrhx-c7xc-m3w5 in development dependency graph. No production application reachability/exploit claimed. | Bounded compatible repair and affected regression PASS; independent Python gate remains open. | testpass and functionality-inventory criteria still require final complete evidence; no cleanup authority | NOT DEPLOYED; no deployed fix or app-reachable exploit claim; independent release gates retained | published vulnerable package version repaired locally; remaining evidence qualification | Dependency/QA owner: Use compatible existing ^4 dependency range via Zod4.6.6 override; do not add runtime functionality. Retain before/after advisory paths, raw hashes and exact lock/pin delta; complete frontend/browser and required full successors, then bind all reports to final source. Production deployed dependencies/exposure remain independent. |
| P9-REQUAL-SEC04 | BLOCKED: five exact compatible/parser pins remove65/109 baseline advisory alias groups;44 remain (filelock3,Torch19,Transformers22), individually assessed without owner risk acceptance. Full model-runtime qualification unavailable. | Critical/high provider labels include source-limited model/cache applicability uncertainty; not44 confirmed exploits. One exact vendor PyPI query404 disclosed. | BLOCKER by acceptance-risk judgment under REQUEST9/13/14: selected-model/cache applicability and compatible fixes remain unqualified; not an automatic veto for every advisory. No owner risk waiver. | Unwaived security uncertainty and affected functionality/testpass criteria remain; no cleanup authority. | BLOCKED independent deployed dependencies/model integrity, active parser exposure and release review; local repairs are not deployed. | Remaining serious uncertainty is not accepted optional debt. Individual source-limited assessments remain visible. | Security/sidecar owners: complete narrowly scoped filelock cache/protocol compatibility work, select a patched compatible CPU Torch/Transformers graph, verify immutable model/checkpoint identities and startup/inference/extraction contracts in an approved environment; serious residual risk requires explicit owner disposition. No automatic waiver, model change/download or production action. |
| P9-REQUAL-DB01 | LOCALLY REPAIRED at2b26953; three real RED/GREEN cases, full35 MariaDB/1123 backend and complete successor browser/workload PASS. | High functional provider defect: Documents index returns500 on actual MariaDB startup schema; no acknowledged-save loss reproduced | Provider query repair and complete successor qualification PASS within tested scope. | not permission to remove provider/schema/alias compatibility | withheld: no production operation or deployed qualification | no schema/table collation migration required for this repair | API DocumentsIndexService owner: narrow read-only projection fix, actual MariaDB regression including tenant/search/data preservation, fresh affected full successors |
| P9-REQUAL-PDF01 | RESOLVED within original Linux24-fixture scope: final16/16 fidelity36pages plus8/8 settings24pages PASS, unchanged oracle; finalWindows24/24 and supplementalLinux2/2 PASS. No physical-print/deployed output claim. | High: exported documents shift geometry and gain pages relative to preview. | Confirmed Linux failure closed by final source-bound unchanged-oracle evidence. | Affected functionality/testpass and independent route/unused-code/inventory criteria still required; no cleanup authority. | Human/print/deployed-renderer/release conditions remain unqualified. | Original functional defect resolved in tested scope; human/deployed output qualification remains separate. | Document/QA owners: bind final frozen-source Linux and Windows24-fixture results to unchanged oracle/content/geometry checks, review intentional portable font replacement and retained historical bytes; human/physical printing remains M09-09, not automated closure. |
| P9-REMED-PTR01 | RESOLVED within tested scope: focused unitRED/46GREEN and native6GREEN retained; final complete935 frontend/362 ordinary browser PASS with no retries/skips. Source review found no remaining Important issue. | High usability/recovery defect: pointer-down focus schedules a RAF that scrolls the pane190px before pointer-up; Retry target moves, so no click handler/HTTP retry occurs. | Confirmed pointer defect closed by failing-before and complete passing successor evidence. | No cleanup authority; preserve focused recovery behavior and satisfy independent route/inventory/testpass criteria. | Local repair not deployed; physical/device/human and release evidence remain. | Bounded functional repair, not optional optimization. Original admin deadline failure retained as unreproduced in isolated focused successor. | Frontend/QA owners: retain direct-region focus scrolling/mobile-pane selection while preventing descendant-control target movement; bind unit46/46 plus held-pointer4/4 and stale-draft/admin6/6 focused proof to final935 frontend/362 browser successors. No blanket timeout increase or assertion weakening. |

Inherited evidence entries retain their original historical wording (including then-pending checks) and are explicitly labelled historicalBaselineEvidence in JSON. Current status and final source-bound validation are separate; historical reports were not rewritten.