jobtrackingapp/docs/redesign/phase-9/p9-remed-02/PLAN.md

P9-REMED-02 execution ledger

Spec: user mission, 24 October 2026. Baseline3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28; branch fix/p9-pdf-security-requalification. Main remains5f835e5.

1. P9-PDF-00: reproduce all24 original Linux fixture outputs and unchanged oracle; inventory runtime/fonts/locale/geometry.
2. P9-PDF-01/02: trace canonical/variant/model/render/preview/export owners; isolate causes, then minimal proven fixes with RED/GREEN. Preserve content/revisions/settings and legal font distribution.
3. P9-SEC-00/01: fresh per-advisory evidence, reachability/patch compatibility; bounded dependency remediation, no owner risk acceptance or model download.
4. P9-CI-00: read-only effective runner/service isolation assessment and exact operator prerequisites; no live changes.
5. P9-REG-00: freeze final source, full affected/backend/frontend/browser/contracts/MariaDB/sidecar/PDF/security/preservation successors and independent final review.
6. Publish dated addendum, blocker decisions and precise Phase9/CV-UX entry conditions; normal checkpoint pushes with direct equality.

Ruling: reuse the verified clean existing checkout on the explicitly requested dedicated branch; preserve existing local artifacts and dev data. No new worktree requested. Baseline tests deliberately contain known PDF/security failures; reproduction is authorized rather than an unexplained green-baseline requirement. Ruling: parallel independent security and CI investigation under dispatching-parallel-agents; root owns rendering and serial runtime qualification. Workers have exclusive file ownership and cannot commit or touch production. Pre-flight: PDF runtime/config changes invalidate affected PDF/browser/backend/build evidence; Python changes require lock/startup/parser/security/sidecar successors. CI remains read-only and cannot confer hosted PASS from local tests.

All historical evidence is immutable. New raw outputs: .artifacts/p9-remed-02/. No Phase10, CV-UX-01, CV-IMPORT-01, production access, destructive dev reset or owner security waiver.

P9-PDF-00 complete: baseline realLinux5producer cases PASS, unchanged oracle9/16+4/8 (same11failedfixtures),65PDF/60previewpages. Runtime image5a1c1e8,Debian12,Chromium156/.NET9.0.21; all51startupmigrations and cleanup confirmed. One preflight was attempted before Compose health completed and refused before schema creation; no hidden test retry. P9-CI-00 assessment complete: fresh baseline hosted853 still hostnetwork/socket, firstgateBLOCKED; operator isolation prerequisites remain. No safe workflow-only recovery. Ruling: font substitution hypothesis receives a controlled sameHTML experiment before application changes. Distinct user font choices, persisted stack strings and null inheritance must remain. Packaged open replacements may intentionally change platform-dependent glyph metrics; record those visual changes and keep original oracle and historical evidence unchanged.

P9-SEC-00/01 bounded checkpoint ready: exact5pins changed among49; 58/58 completeWindows sidecar, actualHTTP startup+3uploads andLinux3.12 parser-only2regression/3decode PASS.65/109advisorygroups remediated;44remain individually assessed, modelruntimeBLOCKED; no owner risk acceptance. P9-PDF-02 first implementation:17unmodified OFL fonts/6families embedded only as used by sharedThemed renderer; settings/Career/revisions/legacyfrozen artifacts untouched.6newself-contained-font tests RED6/6 then fullbackend1129/1129PASS. Dockerfirstbuildfailed duplicateContent packaging, successorfix usesUpdateforSDKdefaultJSON; successfulimagee403cd9. StaticbuildPASS nativeexit0 (outerlog-displaycommand hitcp1252 aftersuccess, retained). Full24focusedLinuxrun underway.

Security checkpoint0554e27af1f2695767bde18d68e776ccdf76d5cd normallypushed; directremoteequalityverified. PDF font trial: embeddedvariablefonts makeall24preview/exportpagesagree36+24 and positionalmarkersalign, but originaloracle8/16+0/8FAIL becauseChromium156emitsType3variablefontdescriptorsmissingFontBBox/Ascent/Descent. Imageinspectiondefaultminimalshowsheaderinsidephysicalmargin; extractorassignedtop14.8167mm, notactualglyph16mm. StaticupstreamArimo controlledexperiment emitsType0 withpropermetrics/top16.6109mm. Nooracle/tolerancechanges. Addedstatic-outlineguardRED1/1; replaceonlyvendoredvariableassetswithupstreamunmodifiedstaticreleases. Completebackend1130successor and staticLinuxfull24run underway. VariabletrialandbothREDreportsretained.

Review ruling: discard the uncommitted experimental dynamic PDF collector and its2offlineguards; reuse prior exact collector unchanged, including8settings-state membership and historical36+24 totals. The static font fix must satisfy that stronger existing gate; no reference/tolerance change.

P9-PDF-02/03 staticcheckpoint: Linux5producerPASS; unchangedoriginaloracle16/16+8/8PASS,36+24pages,zero inputdrift. OriginaloracleSHA25664f82e622cc11483c33307d987e969f6cf27f82ab6bdbd72c2aeb1bfbceade87 unchanged. Metadatareviewclosed37/37font+licensehasheswithimmutableURLs; .gitattributespreservesasset/licensebytesacrossOS. Fullbackend1130PASS. Noexpectations/tolerances/referencechanges. CompleteWindows/broadregressionstillpending.