jobtrackingapp/docs/redesign/phase-9/RISKS.md

# Retained risk and release register

Stable RD IDs come from [Phase 7](../phase-7/DEBT.md); the [Phase 8 acceptance](../phase-8/p8-05/FINAL_ACCEPTANCE.md) is the entry qualification. Severity below describes potential impact if the gate is ignored, not a claim that an untested system is currently broken. None of the production conditions was rechecked live or repaired in Phase 9.

Phase 9 can complete an assessment while withholding acceptance. Open high data-integrity risks and required human/provider evidence must stay visible in the final decision. Phase 10 receives a bounded handoff, not deletion authority.

| ID | Current status / reproducibility | Severity / user impact | Owner, next action and evidence required for closure | Gate |
|---|---|---|---|---|
| RD01 / F04 | OPEN; local static/loopback ingress contracts only | High: wrong client identity or exposed ingress | Release operator: actual TLS/IPv6/firewall/topology/trusted peer and deployed auth evidence | Production |
| RD02 | NOT TESTED: independently verified off-disk complete backup/restore | Critical if recovery needed: irreversible loss | Release operator: isolated restore of DB/files/CVs/keys/tombstones, hashes and recovery rehearsal | Production |
| RD03 / F19 | PARTIAL: SQLite and generated MariaDB SQL; MariaDB runtime unavailable | High: schema/provider/startup disagreement | Database owner: actual approved MariaDB migration, restart, CRUD/constraints/concurrency and effective configuration proof | Production; provider acceptance |
| RD04 | NOT TESTED: intended Linux rollback | High: failed release cannot be reversed | Release operator: isolated failure/rollback rehearsal using complete prior images/configuration/recovery set | Production |
| RD05 | OPEN: old runner crashes/deployed identity not superseded | High: healthy endpoint may serve wrong release | Infrastructure owner: native core/operator diagnosis, successful protected CI, exact deployed SHA and authenticated smoke | Production |
| RD06 | PARTIAL: finite axe/DOM/keyboard evidence; human checks open | High accessibility impact | Accessibility tester: [M09-01–06](p9-03/MANUAL_CHECKLIST.md), contextual contrast/reader evidence; triage every applicable incomplete | Acceptance qualification; production |
| RD07 | NOT TESTED: physical input/AT/alternate browsers/forced colors | Medium/High usability exclusion | Product/accessibility owners: actual supported devices/browser/input versions and complete workflows | Acceptance qualification; production |
| RD08 / C11 / P5-13 | DEFERRED; no new model qualification or activation | High: unqualified proposal semantics | Separate AI qualification owner: production-equivalent identity/inference, original 366-call protocol, independent human semantics, review UI/integration evidence | AI activation; production |
| RD09 | Local withheld-operation contract retained; deployed withholding NOT TESTED | High: unreviewed AI write/external request | Release/AI owners: keep 503/no-provider/no-write guards, verify actual deployment independently | Production / AI |
| RD10 | PARTIAL: native local PDF corpus and visual sheets; deployed fonts/photo/print absent | Medium/High document reliability | Document owner: intended Linux/fonts/photo/crop/print and alternate-browser proof, original bytes/geometry | Acceptance qualification; production |
| RD11 | Scoped SQLite bootstrap/WAL mechanism repaired before entry; broad reliability remains PARTIAL | High if preference save fails | Database owner: retain held-reader/write proof, distinguish old reproduced mechanism from unproven provider/contention cases | Reliability qualification |
| RD12 | PARTIAL: notification draft/failure recovery and SQLite tests; complete contention/provider behavior unqualified | Medium: settings may not persist | Database/settings owners: intended-provider overlapping writes and failure/reload recovery with no data loss | Reliability qualification |
| RD13 | Historical Rules 500 mechanism remains UNCONFIRMED | Medium: failed save/draft retention | Rules/API owners: original failure trace plus controlled causal reproduction and successor regression; passing retry alone insufficient | Reliability qualification |
| RD14 | Historical command/dialog focus incident remains UNCONFIRMED; settled drawer proof is a separate finite result | Medium/High keyboard access | Shared UI owner: preserve original observations, reproduce affected modal transitions and actual reader/trap/return behavior | Accessibility qualification |
| RD15 | Historical intermittent CV section expansion cause unproven | Medium: editing disrupted | CV owner: retain failed observation and reproduce causally before closing; do not weaken expansion assertions | Reliability qualification |
| RD16 | Scoped company-error repair retained; wider reader/dialog/date contract PARTIAL | Medium: recovery/access | Company/UI owners: native failed-save → retained draft → successful retry plus human dialogue checks | Preservation qualification |
| RD17 | Board remains O(N); 200/1,000-job and new bounded 250-job observations are finite | Medium: growing rendering cost | Jobs owner: agreed budget, bounded sustained profile and CPU/frame attribution before optimization; preserve full membership | Performance qualification |
| RD18 | NOT TESTED: physical drag/drop/cancel/browser variants | Medium access/workflow risk | Input/device tester: real Board/CV selection and named alternatives, no hidden result cap | Human/device qualification |
| RD19 | DEFERRED: reviewed `followMode` consumer | Medium workflow limitation | Product/mail owner: separate explicit mode→review/action/fallback design; no auto-send or uncertain resend | Deferred scope; not silently completed |
| RD20 | Optional P5-05 quick preview DEFERRED; Phase 8 Dashboard scope was delivered separately | Low optional scope | Product owner: explicit separate brief; retain existing full workspace and all routes | Deferred scope |
| RD21 | OPEN: canonical Career/generic job revision contract and creation-intent idempotency | High: stale editor can overwrite acknowledged edits | Domain/API/UI owners: separate bounded contract issue covering both callers, server compare-and-swap/transaction semantics, conflict recovery and backward compatibility; characterization is not safety acceptance | Data-integrity acceptance; production |
| RD22 / F20 | NOT TESTED: enabled-worker outage recovery/durability | High: duplicate/lost async work | Worker owner: isolated enabled-producer failure/restart/recovery, no-loss/no-duplicate proof before activation | Production / enabled producer |
| RD23 / F21 | OPEN: actual calendar offset/DST/date-only semantics | Medium: wrong event time | Calendar owner: dedicated boundary/DST/provider proof in authorised sandbox before semantic changes | Calendar qualification |
| RD24 | NOT TESTED: billing/deletion/retention/provider cleanup policy and configuration | High privacy/lifecycle impact | Product/security/operator owners: approved policy, explicit destructive-action authority, isolated recovery/cleanup proof | Production / lifecycle activation |
| RD25 | PARTIAL: local SMTP/HTTP/provider contracts; actual OAuth/Turnstile/mail/calendar/model unavailable | High identity/privacy/delivery impact | Approved provider/human tester: sandbox consent/revoke/reconnect/origin/state/delivery/uncertain-attempt proof | Provider acceptance; production |
| RD26 | Legacy Job/Application cutover OPEN | High compatibility/data loss if removed | Migration owner: expand/verify/contract, restore/rollback and all readers/writers/aliases before removal | Phase 10 deletion eligibility; production |
| RD27 | NOT TESTED: actual monitoring/alert/recovery coverage | High operational detection risk | Operations owner: effective sink, alert trigger, responder/runbook and recovery observations | Production |
| RD28 | Ongoing evidence/provenance obligation | High if failures are misrepresented | QA owner: exact source hashes/counts, original failures, no retries/skips/assertion relaxation; separate characterization from safe behavior | Every decision |
| P9-OPS-01 | Previously reported EXT4/Docker storage errors UNRECHECKED | Critical if disk faults persist | Production operator only: independent storage-health/repair and recovery qualification under separate authority | Production |
| P9-SEC-01 | Live advisories NOT REFRESHED; inherited NuGet Pkcs high/moderate and expiring dev exception retained | High dependency risk until assessed | Dependency owner: authorised live advisory refresh, actual locked versions/paths and exception expiry review; offline policy tests do not clear advisories | Production |
| P9-PUB-01 | Feature publication initially blocked by Git server HTTP 502 | Medium review/recoverability risk | Git service owner / QA: successful normal push and direct ref equality for each published checkpoint; never force push | Publication / handoff completeness |

The pre-existing duplicate initial reminder read is tracked as P9-PERF-01 in [DEFECTS.md](p9-06/DEFECTS.md). No shared loader/query framework was introduced without measured benefit and consumer proof. The new admin vendor-locale repair closes only P9-L01 after its integrated successor; it does not certify every third-party or provider string.