jobtrackingapp/docs/release-readiness/13_REMEDIATION_REGISTER.md

Preliminary release blocker reconciliation

Discovery only, 2026-11-02. These are qualification gaps unless a concrete defect is stated. No inferred P0/P1 vulnerability ratings or owner risk acceptance.

ID	Historical item / current finding	Status / closure evidence needed
RR-01	Phase 9/10 and production NO-GO	CLEAN-20 implementation and verification are published. Independent Phase 10 acceptance and later roadmap acceptance remain open. BLOCKED for final RC
RR-02	Old Linux 11/24 and later S01 failure narratives	Latest handoff records approved S01 36/36 per platform and owner visual acceptance for unchanged development output. Do not reopen these metrics without affected change; physical print/device remain NOT TESTED
RR-03	Python advisory/native parser/image qualification	Latest scoped conditional disposition retained; current advisories and production-equivalent native isolation NOT TESTED. No new scan or risk waiver
RR-04	Hosted MariaDB/isolation	Source explicitly fails before execution until isolated runner proof. BLOCKED; fresh local 5 guard tests do not close it
RR-05	Human/device/provider	Actual AT/contrast, physical devices/print, native language and live provider accounts not qualified here. BLOCKED/NOT TESTED by lane
RR-06	Old known-issues F19 SQLite fallback statement	Current DatabaseConfiguration defaults to MariaDB and throws without connection. Old wording is superseded for this source. SQLite retirement still BLOCKED on transfer/restore/parity gates
RR-07	Old F01 stale-write statement	MariaDB acceptance documents bounded RD21 resolution; later handoff carries it. Do not reopen all old F01 findings based on stale index wording; final affected API census/regression remains required
RR-08	MySQL TLS / dependency / production identity	Latest handoff retains MYSQL-TLS-01 and OPS-01. No live configuration read; current advisory disposition and deployed equivalence unverified
RR-09	Backup/restore and rollback	Existing procedures and historical seeded rehearsal are not a current restore. Need isolated recovery-set completeness, decryption, tombstone behavior, post-write rollback compatibility and agreed RPO/RTO
RR-10	AI quality/activation	Deterministic Docling fixtures are distinct from real-model semantic accuracy. Optional unqualified adapter remains disabled; no AI invocation authorised here
RR-11	Backup host parsing rejected supported Host= alias and uppercase spelling	FIXED AND OFFLINE-TESTED. See bounded remediation. Real dump/restore qualification remains open
RR-12	Previous handler omitted post-rollback health checks; schema/data/AI recovery remains separate	Health probes FIXED in a39ac847 and six offline handler methods passed, including failed endpoints and diagnostics. See health follow-up. Actual image identity, startup timing and recovery after migration/writes still require isolated rehearsal
RR-13	Off-host encryption and recovery-set consistency need independent proof. Failed transfer, partial monthly copy and retention errors previously let deployment continue	Transfer/marker gates and explicit daily prune, monthly enumeration/sort and removal failure propagation FIXED AND OFFLINE-TESTED. Final backup suite 16/16 methods; four retention failure assertions reproduced first. See retention follow-up. Actual encryption, retrieval/decryption and database/files/key/tombstone consistency require approved isolation
RR-14	July first-deploy runbook inferred rollback safety from its no-op migration baseline, while current migration Up methods add schema	Historical scope and current qualification links clarified. AddJobRevision adds Version and AddUserOperationEvents creates a table/indexes. Exact old/new image compatibility after migration/writes remains an isolated rehearsal gate

Continue evidence work against the source endpoint and environment census. Actual qualification requires an accepted candidate and isolated environment. Every fix needs minimal scope, targeted verification and the applicable stage approval.