jobtrackingapp/docs/redesign/phase-9/RISKS.md

Retained risk and release register

Stable RD IDs come from Phase 7; the Phase 8 acceptance is the entry qualification. Severity below describes potential impact if the gate is ignored, not a claim that an untested system is currently broken. None of the production conditions was rechecked live or repaired in Phase 9.

Phase 9 can complete an assessment while withholding acceptance. Open high data-integrity risks and required human/provider evidence must stay visible in the final decision. Phase 10 receives a bounded handoff, not deletion authority.

ID	Current status / reproducibility	Severity / user impact	Owner, next action and evidence required for closure	Gate
RD01 / F04	OPEN; local static/loopback ingress contracts only	High: wrong client identity or exposed ingress	Release operator: actual TLS/IPv6/firewall/topology/trusted peer and deployed auth evidence	Production
RD02	NOT TESTED: independently verified off-disk complete backup/restore	Critical if recovery needed: irreversible loss	Release operator: isolated restore of DB/files/CVs/keys/tombstones, hashes and recovery rehearsal	Production
RD03 / F19	PARTIAL: SQLite and generated MariaDB SQL; MariaDB runtime unavailable	High: schema/provider/startup disagreement	Database owner: actual approved MariaDB migration, restart, CRUD/constraints/concurrency and effective configuration proof	Production; provider acceptance
RD04	NOT TESTED: intended Linux rollback	High: failed release cannot be reversed	Release operator: isolated failure/rollback rehearsal using complete prior images/configuration/recovery set	Production
RD05	OPEN: old runner crashes/deployed identity not superseded	High: healthy endpoint may serve wrong release	Infrastructure owner: native core/operator diagnosis, successful protected CI, exact deployed SHA and authenticated smoke	Production
RD06	PARTIAL: finite axe/DOM/keyboard evidence; human checks open	High accessibility impact	Accessibility tester: M09-01–06, contextual contrast/reader evidence; triage every applicable incomplete	Acceptance qualification; production
RD07	NOT TESTED: physical input/AT/alternate browsers/forced colors	Medium/High usability exclusion	Product/accessibility owners: actual supported devices/browser/input versions and complete workflows	Acceptance qualification; production
RD08 / C11 / P5-13	DEFERRED; no new model qualification or activation	High: unqualified proposal semantics	Separate AI qualification owner: production-equivalent identity/inference, original 366-call protocol, independent human semantics, review UI/integration evidence	AI activation; production
RD09	Local withheld-operation contract retained; deployed withholding NOT TESTED	High: unreviewed AI write/external request	Release/AI owners: keep 503/no-provider/no-write guards, verify actual deployment independently	Production / AI
RD10	PARTIAL: native local PDF corpus and visual sheets; deployed fonts/photo/print absent	Medium/High document reliability	Document owner: intended Linux/fonts/photo/crop/print and alternate-browser proof, original bytes/geometry	Acceptance qualification; production
RD11	Scoped SQLite bootstrap/WAL mechanism repaired before entry; broad reliability remains PARTIAL	High if preference save fails	Database owner: retain held-reader/write proof, distinguish old reproduced mechanism from unproven provider/contention cases	Reliability qualification
RD12	PARTIAL: notification draft/failure recovery and SQLite tests; complete contention/provider behavior unqualified	Medium: settings may not persist	Database/settings owners: intended-provider overlapping writes and failure/reload recovery with no data loss	Reliability qualification
RD13	Historical Rules 500 mechanism remains UNCONFIRMED	Medium: failed save/draft retention	Rules/API owners: original failure trace plus controlled causal reproduction and successor regression; passing retry alone insufficient	Reliability qualification
RD14	Historical command/dialog focus incident remains UNCONFIRMED; settled drawer proof is a separate finite result	Medium/High keyboard access	Shared UI owner: preserve original observations, reproduce affected modal transitions and actual reader/trap/return behavior	Accessibility qualification
RD15	Historical intermittent CV section expansion cause unproven	Medium: editing disrupted	CV owner: retain failed observation and reproduce causally before closing; do not weaken expansion assertions	Reliability qualification
RD16	Scoped company-error repair retained; wider reader/dialog/date contract PARTIAL	Medium: recovery/access	Company/UI owners: native failed-save → retained draft → successful retry plus human dialogue checks	Preservation qualification
RD17	Board remains O(N); 200/1,000-job and new bounded 250-job observations are finite	Medium: growing rendering cost	Jobs owner: agreed budget, bounded sustained profile and CPU/frame attribution before optimization; preserve full membership	Performance qualification
RD18	NOT TESTED: physical drag/drop/cancel/browser variants	Medium access/workflow risk	Input/device tester: real Board/CV selection and named alternatives, no hidden result cap	Human/device qualification
RD19	DEFERRED: reviewed followMode consumer	Medium workflow limitation	Product/mail owner: separate explicit mode→review/action/fallback design; no auto-send or uncertain resend	Deferred scope; not silently completed
RD20	Optional P5-05 quick preview DEFERRED; Phase 8 Dashboard scope was delivered separately	Low optional scope	Product owner: explicit separate brief; retain existing full workspace and all routes	Deferred scope
RD21	OPEN: canonical Career/generic job revision contract and creation-intent idempotency	High: stale editor can overwrite acknowledged edits	Domain/API/UI owners: separate bounded contract issue covering both callers, server compare-and-swap/transaction semantics, conflict recovery and backward compatibility; characterization is not safety acceptance	Data-integrity acceptance; production
RD22 / F20	NOT TESTED: enabled-worker outage recovery/durability	High: duplicate/lost async work	Worker owner: isolated enabled-producer failure/restart/recovery, no-loss/no-duplicate proof before activation	Production / enabled producer
RD23 / F21	OPEN: actual calendar offset/DST/date-only semantics	Medium: wrong event time	Calendar owner: dedicated boundary/DST/provider proof in authorised sandbox before semantic changes	Calendar qualification
RD24	NOT TESTED: billing/deletion/retention/provider cleanup policy and configuration	High privacy/lifecycle impact	Product/security/operator owners: approved policy, explicit destructive-action authority, isolated recovery/cleanup proof	Production / lifecycle activation
RD25	PARTIAL: local SMTP/HTTP/provider contracts; actual OAuth/Turnstile/mail/calendar/model unavailable	High identity/privacy/delivery impact	Approved provider/human tester: sandbox consent/revoke/reconnect/origin/state/delivery/uncertain-attempt proof	Provider acceptance; production
RD26	Legacy Job/Application cutover OPEN	High compatibility/data loss if removed	Migration owner: expand/verify/contract, restore/rollback and all readers/writers/aliases before removal	Phase 10 deletion eligibility; production
RD27	NOT TESTED: actual monitoring/alert/recovery coverage	High operational detection risk	Operations owner: effective sink, alert trigger, responder/runbook and recovery observations	Production
RD28	Ongoing evidence/provenance obligation	High if failures are misrepresented	QA owner: exact source hashes/counts, original failures, no retries/skips/assertion relaxation; separate characterization from safe behavior	Every decision
P9-OPS-01	Previously reported EXT4/Docker storage errors UNRECHECKED	Critical if disk faults persist	Production operator only: independent storage-health/repair and recovery qualification under separate authority	Production
P9-SEC-01	Live advisories NOT REFRESHED; inherited NuGet Pkcs high/moderate and expiring dev exception retained	High dependency risk until assessed	Dependency owner: authorised live advisory refresh, actual locked versions/paths and exception expiry review; offline policy tests do not clear advisories	Production
P9-PUB-01	Feature publication initially blocked by Git server HTTP 502	Medium review/recoverability risk	Git service owner / QA: successful normal push and direct ref equality for each published checkpoint; never force push	Publication / handoff completeness

The pre-existing duplicate initial reminder read is tracked as P9-PERF-01 in DEFECTS.md. No shared loader/query framework was introduced without measured benefit and consumer proof. The new admin vendor-locale repair closes only P9-L01 after its integrated successor; it does not certify every third-party or provider string.