jobtrackingapp/docs/audits/2026-09-07/coverage.md

Coverage of all 416 requested audit areas

This index preserves the exact numbered titles from the supplied request. Each row points to its assessment or acceptance plan and states the evidence boundary. 416 indexed areas does not mean 416 passed tests, exhaustive source review of every symbol, or production certification. Areas requiring a live provider, deployed host, a destructive failure drill, a native screen reader or a complete endpoint/input corpus remain open. An explicit unverified row is an outstanding verification task, not a favorable finding.

Baseline and commands are in verification.md. Prioritized changes are F01–F21; repeated rows about the same root cause do not create extra findings. The 50 explicit failure answers distinguish current source behavior from proposed recovery.

Evidence codes:

• O — Observed: executed in this audit, limited to the stated input/environment. This may be a failed expectation.
• S — Source: a relevant implementation boundary was inspected; runtime outcome is inferred, not certified.
• P — Proposal: recommended design, policy, checklist or acceptance test; not claimed implemented.
• R — Needs runtime verification: remaining live/staging/manual/inventory evidence. Where the note says source review too, the complete source inventory is also outstanding.
• N — Not currently evidenced/deployed: an optional technology should not be added solely to satisfy a heading. SQLite/MariaDB replace PostgreSQL-specific assumptions; Redis and a general broker are absent.

All R entries remain on the acceptance backlog. Prioritize P1-related entries first, then core user-path accessibility and operational proof. Cosmetic/optional feature entries do not justify indiscriminate platform expansion.

#	Requested area	Evidence	Assessment and remaining boundary
1	Formal threat modelling	S/P	Assessment — Trust/abuse model and proposed enforcement; distributed abuse load remains untested.
2	Abuse-case analysis	S/P	Assessment — Trust/abuse model and proposed enforcement; distributed abuse load remains untested.
3	Rate-limiting strategy	S/P	Assessment — Trust/abuse model and proposed enforcement; distributed abuse load remains untested.
4	Data lifecycle map	S/P	Assessment — Sensitive copies and target retention mapped; live inventories and custody unverified.
5	Data classification	S/P	Assessment — Sensitive copies and target retention mapped; live inventories and custody unverified.
6	Concurrency testing	O/R	Assessment — Stale and simultaneous CV PUTs tested; job/profile concurrency and multi-replica races remain.
7	Lost-update prevention	O	Assessment — Stale CV save overwrote the newer value; F01, expected revision precondition absent.
8	Idempotency review	O/S	Assessment — Repeated job POST created distinct rows; durable AI idempotency exists; billing/email gaps remain.
9	Unexpected user behaviour	O/R	Assessment — Repeated saves, modified owner IDs, offline refresh and Unicode tried; broader confused-user study remains.
10	Network resilience	O/R	Assessment — Offline save failure visible; delayed responses, network flapping and 502 recovery not fully injected.
11	Offline and interrupted editing	O	Assessment — After acknowledging the unload warning, reload lost the offline edit; F09.
12	Dependency failure testing	S/R	Assessment — State/retry/failure assessment; only specifically recorded probes executed.
13	Partial failure scenarios	S/R	Assessment — State/retry/failure assessment; only specifically recorded probes executed.
14	Transaction-boundary review	S/R	Assessment — Career projections, file snapshots, email and billing cross boundaries; transactional matrix specifies repairs.
15	Background-work reliability	S/R	Assessment — Durable AI leases exist; outer worker dependency errors can stop host, F20; outage drill pending.
16	Browser state audit	S/R	Assessment — Storage/cache patterns inspected; no all-route corrupt-storage/private-window certification.
17	Multi-tab session behaviour	O	Assessment — Logout revoked backend session but left another tab's private editor mounted; F08.
18	Session-expiry UX	R	Assessment — Needs runtime verification: actual session expiry, reauthentication and recovery with unsaved edits.
19	Permission model design	O/S	Assessment — Owner and Pro policies inspected; tested cross-owner CV denial and ordinary-user admin denial.
20	Administrator access model	S	Assessment — Admin can access global job activity content; minimal support scopes/security audit incomplete, F13.
21	Support access and impersonation	S/P	Assessment — No support impersonation solution introduced; prefer scoped metadata and audited time-limited access.
22	Audit-trail architecture	S/P	Assessment — JobEvents activity is not an immutable privileged/security ledger; F13.
23	Supportability and diagnostics	S/P	Assessment — Trace IDs exist; safe metadata diagnostics proposed instead of routine private-content access.
24	Error identifiers	S/P	Assessment — Existing request/error identifiers useful; propagate safe reference to client, worker and support views.
25	Content design and microcopy audit	S/P	Assessment — Proposed copy/navigation/onboarding improvements; no recruited usability study.
26	English/Bokmål terminology consistency	O/P	Assessment — NB UI includes English template descriptions and inconsistent capitalization; native editorial review proposed.
27	Onboarding audit	R	Assessment — Needs runtime verification: registration/verification/first-run journey against a local mail sink.
28	Time-to-value	S/P	Assessment — Existing manual-add sequence has optional steps; offer earlier save; no timed user study.
29	Feature discoverability	S/P	Assessment — Proposed copy/navigation/onboarding improvements; no recruited usability study.
30	Progressive disclosure	S/P	Assessment — Proposed copy/navigation/onboarding improvements; no recruited usability study.
31	Feature-flag architecture	S/P	Assessment — Existing switches retained; owner/default/expiry register proposed.
32	Feature-flag lifecycle	S/P	Assessment — Existing switches retained; owner/default/expiry register proposed.
33	Database evolution strategy	S/R	Assessment — Additive/backfill/contract stages proposed; current nontransactional SQLite migration warning observed separately.
34	Backwards-compatible deployment	S/R	Assessment — Previous-image rollback is not schema rollback; old/new contract rehearsal needed.
35	API compatibility strategy	S/P	Assessment — Unversioned DTO contract requires additive evolution and supported-client window; not automatic major-version routing.
36	Frontend deployment version mismatch	R	Assessment — Needs runtime verification: old open tab versus new API/static assets; retain dirty edits before reload.
37	Cache strategy audit	O/S	Assessment — Private responses lacked explicit cache policy; no cross-user HTTP cache exploit demonstrated.
38	Date/time correctness	O	Assessment — Offset-bearing follow-up instants change on calendar export; F21.
39	DST testing	O	Assessment — Four offset/DST cases fail; repeated autumn hour collapses to one exported time.
40	Locale correctness	O/R	Assessment — EN/NB themes rendered; full date/number/plural/locale fallback matrix remains.
41	Currency handling	P/R	Assessment — Store currency explicitly and avoid implicit conversion; full salary/offer round-trip matrix unverified.
42	Translation-layout testing	O/R	Assessment — Eight actual locale/theme/width states tested; doubled-length pseudolocale and every route remain.
43	Generated-document accessibility	R	Assessment — Needs runtime verification: tagged output, reading order and independent browser Print.
44	Print behaviour	R	Assessment — Needs runtime verification: tagged output, reading order and independent browser Print.
45	Data portability	O/S	Assessment — CSV/account export exercised; complete import round trip and all portability formats not certified.
46	Export security	O/S	Assessment — Formula CSV and no-store gaps observed; recent-auth owner export controls retained.
47	Deletion semantics	S/R	Assessment — Soft delete, hard deletion and immutable submitted snapshots distinguished; cross-resource races remain.
48	Account deletion lifecycle	S/R	Assessment — Staged purge and tombstones exist; external billing cancellation and restored-backup drill incomplete.
49	Resource-exhaustion testing	S/R	Assessment — Shared PDF admission absent; 1,000-renderer exhaustion deliberately not executed.
50	Token-budget protection	S/R	Assessment — AI reservation limits exist; process-local and cross-pipeline admission need concurrent proof.
51	AI cost controls	S/P	Assessment — Use provider actuals plus estimated reservations, per-workflow/user/global budgets and kill switches.
52	AI observability	S/P	Assessment — Persisted AI usage/status useful; content-free metrics and provider bill reconciliation proposed.
53	AI model changes	P/R	Assessment — Pin evaluated routes/prompt versions; no live model-change/evaluation performed.
54	Property-based testing	P/R	Assessment — Invariant/property suite proposed; example regression suites are not property-based coverage.
55	Fuzz testing	O/R	Assessment — Existing malformed parser tests pass; broad mutation/fuzz campaign not performed.
56	Chaos/failure testing	O/R	Assessment — Offline/browser/API contention injected locally; DB/host/provider chaos remains in isolated staging.
57	Disk-space exhaustion	P/R	Assessment — Bounded synthetic tests specified; no destructive host exhaustion or broad fuzz campaign.
58	Memory exhaustion	P/R	Assessment — Bounded synthetic tests specified; no destructive host exhaustion or broad fuzz campaign.
59	CPU exhaustion	P/R	Assessment — Bounded synthetic tests specified; no destructive host exhaustion or broad fuzz campaign.
60	Long-term maintenance burden	P	Assessment — Feature value/maintenance/risk table protects useful boundaries and questions speculative complexity.
61	Build vs buy review	P/R	Assessment — Use Identity/Stripe/MUI/current queue; no researched vendor price or replacement recommendation.
62	Telemetry strategy	P/R	Assessment — Minimal content-free telemetry proposed; deployed collector/consent not verified.
63	Privacy-preserving analytics	P/R	Assessment — Minimal content-free telemetry proposed; deployed collector/consent not verified.
64	Incident-response readiness	P/R	Assessment — Technical runbooks supplied; issuer rotation/contact/disclosure drills remain.
65	Security incident scenarios	P/R	Assessment — Key leak, admin compromise, dependency compromise and data leak runbooks; no live attack exercise.
66	Secret rotation	P/R	Assessment — Rotate issuer credentials, revoke sessions and preserve decryptability; key-custody drill unexecuted.
67	Security disclosure readiness	P/R	Assessment — Assign private disclosure channel and triage owner before launch; delivery/ownership not verified.
68	Release quality gates	P/R	Assessment — Concrete gates and recovery constraints supplied; no production approval claimed.
69	Production-readiness checklist	P/R	Assessment — Concrete gates and recovery constraints supplied; no production approval claimed.
70	Rollback-readiness	P/R	Assessment — Concrete gates and recovery constraints supplied; no production approval claimed.
71	Performance objectives	S/P	Assessment — Bottlenecks and measurement triggers mapped; no capacity or SLO achievement claim.
72	Error-budget thinking	P	Assessment — Proposed internal 99.5% core SLO; collect baseline before commitments; optional AI tracked separately.
73	Capacity planning	S/P	Assessment — Bottlenecks and measurement triggers mapped; no capacity or SLO achievement claim.
74	Scaling triggers	S/P	Assessment — Bottlenecks and measurement triggers mapped; no capacity or SLO achievement claim.
75	Single points of failure	S	Assessment — Host, DB/files/key ring and operator are common failure domains; document recovery ownership.
76	Dependency ownership	S/P	Assessment — Public proxy, MariaDB, provider and backup custodians need named ownership outside public source.
77	Product invariants	S/P	Assessment — Owner/version/quota/side-effect invariants and enforcement/test targets mapped.
78	Database-enforced invariants	S/R	Assessment — Owner filters and constraints exist; CV version uniqueness/preconditions and reservations need strengthening.
79	State-machine review	S/R	Assessment — AI/deletion/package transitions reviewed; model invalid/duplicate/out-of-order transitions explicitly.
80	Safe retries	S/P	Assessment — Retry reads/transient work within budgets; reconcile ambiguous external side effects by operation identity.
81	Safe failure behaviour	S/P	Assessment — Do not report unsaved, unsent or uncharged work as successful; preserve recoverable inputs.
82	Accessibility under failure	O/R	Assessment — Failed save is visible; failure announcement/focus and screen-reader recovery remain unverified.
83	Design quality gates	P	Assessment — Both themes/languages, interaction states and core axe/manual checks proposed as release gates.
84	Component ownership	S/P	Assessment — Use MUI/theme/AppShell/shared feedback owners; consolidate demonstrated repeated callers incrementally.
85	Storybook/component showcase	P	Assessment — A lightweight state showcase may help; Storybook is not required without recurring review need.
86	All-state component testing	P/R	Assessment — Loading/empty/error/disabled/long-text/selected/focus states defined; complete component sweep remains.
87	Extremely long-content testing	O/R	Assessment — Existing long-content browser cases pass; maximal text, large datasets and all states untested.
88	Unicode and unusual-input testing	O/R	Assessment — Åse/emoji survive local profile/render; combining/RTL/confusable corpus remains.
89	Copy/paste behaviour	S/R	Assessment — Clipboard success shown before promise resolution; permission-denied/formatted-paste matrix remains.
90	Undo/recovery strategy	O/S	Assessment — Undo and unload warning exist; confirmed refresh loses offline draft, F09.
91	Versioning strategy for CV content	O/S	Assessment — History version is not concurrency control; stale write succeeds, F01.
92	Document provenance	S	Assessment — Submitted packages freeze content/copies; live CV settings render against current Career Profile.
93	AI content provenance	S/P	Assessment — Operation/prompt metadata helps provenance; distinguish generated claims from verified user facts.
94	Dependency-locking and reproducible builds	O/S	Assessment — Installed locked environment builds; Docker lock enforcement and mutable image/action gaps remain.
95	Software supply-chain security	O/S	Assessment — Tracked-secret scan and supply-chain helper tests pass; no current advisory/network scan.
96	SBOM	S/R	Assessment — SBOM generator exists; no newly verified release-image SBOM/provenance attached.
97	Dependency update strategy	P/R	Assessment — Small automated update PRs with suites/exception expiry; actual hosted update policy not verified.
98	End-of-life tracking	R	Assessment — Needs external verification: .NET/Node/Python/library support dates and maintainer/advisory status.
99	Infrastructure documentation	S	Assessment — Architecture document is stale on counts/router/CAPTCHA/profile authority; F17.
100	Operational runbooks	P	Assessment — Fourteen incident runbooks include diagnosis, safe recovery and verification.
101	Monitoring ownership	P/R	Assessment — Signals have proposed responsible roles; actual people and backup contact not confirmed.
102	Alert quality	P/R	Assessment — Dedup, impact, safe trace, runbook and recovery notifications required; no delivered alert drill.
103	Backup monitoring	S/P/R	Assessment — Backup age/size/off-site failure signals proposed; independent alert delivery unproven.
104	Restore drills	R	Assessment — Needs runtime verification: isolated DB/files/key/tombstone restore and measured RPO/RTO.
105	Migration rehearsal	S/R	Assessment — Fresh local SQLite startup migrates with warnings; interrupted/large/MariaDB migration rehearsal remains.
106	Production data protection in non-production	O/P	Assessment — Only synthetic local accounts/documents used; production-data masking/access policy proposed.
107	Test-data strategy	O	Assessment — Deterministic synthetic accounts/profile/jobs/Unicode fixtures; no real user documents required.
108	Environment parity	R	Assessment — Needs runtime verification: actual Linux/Chromium/MariaDB/TLS/proxy/resource limits parity.
109	Staging strategy	P/R	Assessment — Isolated production-like environment required for remaining drills; not provisioned by this audit.
110	Safe third-party test modes	R	Assessment — Needs runtime verification: Stripe test mode, OAuth test identity and local/sandbox mail.
111	Domain-boundary tests	O/R	Assessment — Existing domain suites pass; complete cross-boundary external contract matrix remains.
112	Contract tests	S/R	Assessment — Provider fakes/suite coverage useful; current live provider contracts not called.
113	API schema quality	R	Assessment — Needs runtime verification: generated schema operation coverage, examples, nullable/enums/error documentation.
114	Consistent error contract	S/P	Assessment — Normalize actionable error/reference/retry semantics across API, workers and UI; preserve existing contracts.
115	Graceful degradation	S/P	Assessment — Core tracking/editing prioritized; optional dependency failure should degrade independently.
116	Critical-path definition	P	Assessment — Core auth/tracking/save/career/download paths explicitly prioritized above optional AI/discovery.
117	User-impact severity	P	Assessment — P0/P1/P2 reflect user impact and preconditions; evidence gap is separate from confirmed exploit.
118	Feature maintenance scoring	P	Assessment — Value/maintenance/risk judgments supplied; no feature deletion justified without usage evidence.
119	"Should this exist?" review	P	Assessment — Value/maintenance/risk judgments supplied; no feature deletion justified without usage evidence.
120	Product coherence	P	Assessment — Value/maintenance/risk judgments supplied; no feature deletion justified without usage evidence.
121	Information architecture map	S/R	Assessment — Routes and target information architecture mapped; complete navigation-state sweep remains.
122	Navigation depth	S/P	Assessment — Reduce early manual-add steps and contextualize secondary tools; no forced removal of useful deep links.
123	URL design	S	Assessment — Routed job/career workspace retained; stable owner-safe resource routes and compatibility redirects.
124	Browser Back/Forward behaviour	O/R	Assessment — Existing back/deep-link/dirty-navigation browser case passes; all modal/filter combinations remain.
125	Deep linking	O/R	Assessment — Existing workspace deep links pass; complete unauthenticated/revoked/missing-resource link matrix remains.
126	Search-state persistence	R	Assessment — Needs runtime verification: reload/back/forward/share of every search/filter/page state.
127	Destructive-operation recovery	S/O/R	Assessment — Trash/staged deletion and unload warnings exist; destructive recovery/provider races need broader drills.
128	Notification strategy	S/P	Assessment — Respect channel preferences, dedup and durable delivery; F07 reminder behavior needs repair.
129	Toast abuse	S/P	Assessment — Failed saves require persistent recovery; transient toasts only for noncritical confirmation.
130	Confirmation-dialog audit	O/R	Assessment — Unload warning observed; complete confirm/cancel/focus and irreversible-action audit remains.
131	Latency perception	O/P	Assessment — Local navigation timing retained; show truthful queued/loading states; no WAN performance claim.
132	Cancellation	S/R	Assessment — Durable AI cancellation exists; component unmount and synchronous downstream cancellation still need proof.
133	Retry UX	O/S	Assessment — CV retry/failed state exists; external effects must not blindly retry ambiguous outcomes.
134	Empty/zero-data analytics	R	Assessment — Needs runtime verification: zero-data charts, text alternatives and keyboard data exploration.
135	Accessibility of charts	R	Assessment — Needs runtime verification: zero-data charts, text alternatives and keyboard data exploration.
136	CSV injection	O	Assessment — Export retains harmless =1+1 formula; structural CSV quoting is insufficient, F05.
137	Spreadsheet/import security	O/R	Assessment — Harmless formula export observed; full spreadsheet/import payload corpus remains.
138	Email-link security	S/R	Assessment — Canonical origin and token/session controls reviewed; safe open-redirect/one-use/expiry mail-link matrix remains.
139	Email enumeration	S/R	Assessment — Abuse controls exist; timing/response equivalence across register/login/resend/recovery not newly measured.
140	Email deliverability monitoring	R	Assessment — Needs runtime verification: bounce/delivery, sender reputation and independent provider alerting.
141	User-controlled URLs	S/R	Assessment — DNS-check/connect gap identified; no real private destination probed.
142	SSRF-hardening of importers	S/R	Assessment — DNS-check/connect gap identified; no real private destination probed.
143	HTML sanitisation	S/R	Assessment — React/server encoding intended; private iframe flags weaken isolation; no stored-XSS exploit established.
144	Markdown security	R	Assessment — Needs runtime verification: complete Markdown/raw HTML/link-scheme sink corpus; no regex sanitizer recommended.
145	CSP strategy	S/P	Assessment — CSP absent/incomplete at proxy; stage report-only policy then enforce reviewed directives.
146	Cookie security	S/R	Assessment — Cookie/CSRF/session controls inspected; deployed Secure/SameSite/domain/subdomain behavior remains.
147	Subdomain trust	R	Assessment — Needs runtime verification: actual DNS/subdomain ownership, cookie scope and sibling-origin trust.
148	Reverse-proxy trust	S/R	Assessment — Direct port3000 ingress and forwarded-header chain are conditional risk F04; firewall unverified.
149	Host validation	S/R	Assessment — Canonical origin/allowlists help; attacker-controlled forwarded scheme/IP must be tested at real ingress.
150	TLS review	R	Assessment — Needs runtime verification: external TLS chain, renewal, cipher policy and certificate alerts.
151	File-storage architecture	S	Assessment — Staged file store, quarantine/reconciliation and package copies reviewed; storage shares host fate.
152	Orphaned-file detection	S/R	Assessment — Reconciliation exists; interrupted/concurrent file-record drills needed across all artifact categories.
153	Temporary-file management	S/R	Assessment — Parser temp cleanup and export DeleteOnClose exist; renderer/crash residue needs bounded cleanup proof.
154	Malware scanning strategy	S/P	Assessment — Parser bounds are not antivirus; add scanning only with operational/retention/quarantine requirements.
155	Document parser isolation	O/S	Assessment — 37 parser tests pass; subprocess limits and constrained sidecar source reviewed.
156	AI prompt-injection testing suite	P/R	Assessment — Adversarial job/CV instruction corpus proposed; no live-model injection suite run.
157	AI output validation	O/S	Assessment — Existing parser/schema validation tests pass; probabilistic fact correctness remains separate.
158	AI action boundaries	S/P	Assessment — Untrusted job/CV text must not grant tools/permissions or trigger send/payment/publication.
159	Prompt/version management	S/P	Assessment — Keep versioned prompts/routes and provenance; review rollout/rollback with evaluated fixtures.
160	AI evaluation suite	O/R	Assessment — Five Ollama evaluation-helper tests pass; no live model quality evaluation.
161	Norwegian-language AI quality	R	Assessment — Needs runtime verification: Bokmål semantic quality, factual preservation and reviewer scoring.
162	User fact preservation	S/P	Assessment — Preserve authoritative career facts; reject unsupported structured claims and require review.
163	Human-review requirement	S/P	Assessment — Human review required before using generated claims in outward-facing artifacts/actions.
164	Subscription-entitlement races	S/R	Assessment — Current-state re-fetch helps sequential events; concurrency and reconciliation need sandbox proof.
165	Webhook-order handling	S/R	Assessment — Current-state re-fetch helps sequential events; concurrency and reconciliation need sandbox proof.
166	Billing reconciliation	S/R	Assessment — Current-state re-fetch helps sequential events; concurrency and reconciliation need sandbox proof.
167	GDPR request workflows	S/P/R	Assessment — Export/deletion inventory and stages mapped; legal classification/timelines require responsible review.
168	Data-retention matrix	P/R	Assessment — Retention matrix gives proposed defaults and backup behavior; no deployed-policy compliance claim.
169	Log-retention policy	S/P	Assessment — Docker file rotation is not complete log retention; set content-safe TTL/custody/access policy.
170	PII-in-logs scan	S	Assessment — SMTP recipient/subject and client URL/stack logging can contain PII; F16.
171	Sensitive exception data	S/R	Assessment — Truncation is not redaction; sanitize before logging; complete exception corpus remains.
172	Source-map exposure	R	Assessment — Needs runtime verification: source maps in final deployed assets and public path exposure.
173	Production debug configuration	S/R	Assessment — Environment config/source reviewed; final deployed debug/telemetry behavior not inspected.
174	Admin endpoint discovery	O/S	Assessment — Admin controllers identified; ordinary-user audit request returns403; complete hosted admin surface remains.
175	Object-level authorization regression suite	O/R	Assessment — New CV GET/PUT/DELETE owner probes pass; broader existing tests pass; future routes need registry gate.
176	Security regression rule	P	Assessment — Every security fix retains a meaningful boundary regression; normal green suite is not blanket proof.
177	"Prove the fix" requirement	P	Assessment — Each finding specifies failing test/expected correction/staging/detection; no fix marked complete here.
178	Root-cause requirement	S/P	Assessment — Each finding gives root cause, bounded change, regression and rollout expectations.
179	Fix scope	S/P	Assessment — Each finding gives root cause, bounded change, regression and rollout expectations.
180	Regression-risk assessment	S/P	Assessment — Each finding gives root cause, bounded change, regression and rollout expectations.
181	Migration strategy for large refactors	P	Assessment — Expand/backfill/contract and compatibility tests before removing legacy representation.
182	Strangler-style modernisation	P	Assessment — Replace one demonstrated boundary/caller at a time; avoid unnecessary new services/frameworks.
183	Dead-code confidence	P/R	Assessment — Check runtime routes, stored IDs, migrations and deployment references before declaring code dead.
184	Comment quality	P	Assessment — Explain constraints and intent; remove stale claims through focused documentation changes.
185	Naming consistency	P	Assessment — Align identifiers with existing domain glossary; avoid broad cosmetic rename churn.
186	Domain-language consistency	S/P	Assessment — Reconcile UI/API/domain glossary; distinguish job, application record and application letter.
187	Architecture decision records	P	Assessment — Record decisions for provider, time, quota, rendering and recovery when implementation choices land.
188	Documentation freshness	S	Assessment — Current architecture labels conflict with code; use dated verified source baseline, F17.
189	New-developer setup test	R	Assessment — Needs runtime verification: fresh machine/clone setup; audit reused installed dependencies.
190	One-command development startup	S/R	Assessment — Document existing startup paths; one-command clean-environment success not established.
191	Seed/demo data	O/R	Assessment — Harness seeds safe demo fixtures; general public/demo reset workflow not audited.
192	Test isolation	O/R	Assessment — Fresh synthetic SQLite and serial backend settings used; CI parallel/shared-resource isolation remains.
193	Flaky-test audit	O/R	Assessment — One browser run reports zero flaky tests; repeated-run flake rate was not measured.
194	Test-speed audit	O	Assessment — Observed suite durations recorded; no comparative optimization benchmark performed.
195	Mutation testing	P/R	Assessment — Target permission/revision/time guards with mutation tests; no mutation score measured.
196	Coverage quality	O/S	Assessment — Green suite misses builder axe and standalone test type error; count alone is insufficient.
197	Production smoke tests	O/S	Assessment — Local core suite passes; deployed public health/ready smoke exists in source, not executed here.
198	Synthetic monitoring	P/R	Assessment — Content-free synthetic core journey proposed; production probe identity/side effects not configured.
199	Uptime monitoring	P/R	Assessment — Independent external uptime/readiness monitoring and delivered alert need proof.
200	DNS monitoring	R	Assessment — Needs runtime verification: authoritative/recursive DNS monitoring and owner escalation.
201	SSL expiry alerts	R	Assessment — Needs runtime verification: independent certificate expiry alert and renewal drill.
202	Dependency outage communication	P	Assessment — Communicate affected optional service/status while core tracking remains usable; avoid misleading success.
203	Maintenance mode	P/R	Assessment — Document admission/maintenance behavior; actual safe activation not tested.
204	Read-only mode	P/R	Assessment — Read-only mode must deliberately reject mutations and stop writers; no new implementation supplied.
205	Data integrity verification	S/P	Assessment — Verify owner/FK/version/usage/file invariants without reading private content unnecessarily.
206	Storage reconciliation	S/R	Assessment — Staged attachment recovery is useful; reconcile CV/package/generated storage accounting too.
207	Database integrity checks	R	Assessment — Needs runtime verification: production-provider integrity checks, real query plans and restored-row/file hashes.
208	Privacy by default	S	Assessment — Private CV default and external-AI consent off are strengths; public copies require explicit lifecycle.
209	Secure defaults	S/R	Assessment — Default switches reduce exposure; missing aggregate limits and database fallback still need repair.
210	Fail-fast configuration	S	Assessment — Empty/unknown provider can silently select SQLite in app startup, F19.
211	Configuration schema validation	S/P	Assessment — Deployment validation does not replace application startup provider/config validation, F19.
212	Environment-specific safeguards	S/P	Assessment — Guard intended provider/origin/secrets at startup; prevent demo/development fallback in deployed environment.
213	Secret handling in Docker	S/R	Assessment — Container environment/key/volume boundaries reviewed; actual host secret custody unverified.
214	Secret handling in CI	S/R	Assessment — CI script/runner inputs reviewed; actual secret scoping/masking/fork exposure unverified.
215	Pull-request security	R	Assessment — Needs runtime verification: untrusted PR execution, runner isolation and credential availability.
216	Branch protection	R	Assessment — Needs runtime verification: hosted branch protection, required checks and bypass permissions.
217	Deployment permissions	R	Assessment — Needs runtime verification: deploy environment approvals, scoped SSH and registry credentials.
218	Server hardening	R	Assessment — Needs runtime verification: OS patching, SSH/firewall/users/audit policy and recovery access.
219	Docker socket exposure	S/R	Assessment — Compose source does not prove other host containers lack Docker socket; inventory actual mounts.
220	Container privilege review	S	Assessment — Backend/root Chromium lacks full privilege/resource isolation; constrained parser shows a better bounded boundary.
221	Network segmentation	S/R	Assessment — Internal AI network helps; actual shared networks, egress/firewall and lateral reachability unverified.
222	Database exposure	R	Assessment — Needs runtime verification: external MariaDB bind/firewall/users/TLS/backups.
223	Admin-interface exposure	S/R	Assessment — API admin role checks exist; public route/network exposure and operator access require deployed check.
224	CORS audit	S/R	Assessment — Configured origin boundaries reviewed; full credentialed CORS/preflight/origin bypass matrix remains.
225	CSRF model	S/O	Assessment — Cookie mutations require matching CSRF header; local authenticated harness exercises intended path.
226	XSS persistence testing	R	Assessment — Needs runtime verification: comprehensive persisted HTML/Markdown/URL payloads across all sinks.
227	Content upload/download headers	S/O/R	Assessment — Sample cache gaps observed; full content-type/disposition/nosniff matrix remains.
228	Separate download origin	P	Assessment — Consider isolated download/render origin for untrusted content with measured requirements; not automatic new service.
229	CSP report strategy	P/R	Assessment — Report-only CSP can identify required sources; sanitize/rate-limit reports before enforcement.
230	Referrer policy	S/R	Assessment — Proxy referrer policy exists; public/private downstream-link leakage needs deployed verification.
231	Permissions policy	S/R	Assessment — Proxy permissions policy exists; check final responses and iframe requirements.
232	Browser security headers	S/O/R	Assessment — Source proxy headers inspected and local cache samples checked; complete deployed policy unverified.
233	Security-header regression test	P	Assessment — Add endpoint/browser header regressions for actual trusted ingress and sensitive response classes.
234	Privacy-policy alignment	P/R	Assessment — Policy must match actual mail/AI/billing/backups/logs/support access; no legal compliance conclusion.
235	Terms/consent versioning	P/R	Assessment — Record policy/version/time for material consent; deployed persistence and consent change UX unverified.
236	Cookie consent	P/R	Assessment — Inventory cookies/storage/external assets first; responsible advisor decides applicable consent obligations.
237	Product deletion vs billing	S/R	Assessment — Deletion does not complete subscription cancellation/reconciliation.
238	Email-address change workflow	R	Assessment — Needs runtime verification: confirm new email, notification/recovery/session consequences and collision cases.
239	Password-change workflow	S/R	Assessment — Session-stamp revocation patterns exist; complete change/reset/trusted-device UX matrix remains.
240	2FA recovery	R	Assessment — Needs runtime verification: recovery-code single use, lockout, device loss and accessible recovery.
241	OAuth account linking	O/S	Assessment — Existing linking/security tests pass; live Google/Microsoft provider journey not called.
242	Deleted/recreated email account	R	Assessment — Needs runtime verification: delete/recreate email and provider identity collision; never inherit old ownership.
243	Case-normalisation	S/R	Assessment — Identity normalization exists; exhaustive email/source/provider case comparisons remain.
244	Unicode-normalisation security	R	Assessment — Needs runtime verification: Unicode normalization/confusables in security identifiers; display spelling must remain.
245	Job URL canonicalisation	O/S	Assessment — Three extension capture-URL tests pass; canonicalization must not conflate distinct resource identity.
246	Duplicate detection	O/S	Assessment — Same-intent job POST duplicates observed; define dedup intent before enforcing uniqueness.
247	Referential history	S	Assessment — Preserve submitted package evidence across edits/deletes; live links must handle removed resources.
248	Event/history integrity	S/R	Assessment — History versions do not prevent conflict; verify append integrity and owner references across deletion.
249	Audit vs activity timeline	S	Assessment — Global job activity exposes content and is not a minimal privileged security ledger; F13.
250	Search privacy	S/R	Assessment — Owner-filtered search required; logs/URLs and client residue can undermine privacy.
251	Pagination security	S/R	Assessment — Pagination cannot bypass owner scope; full filter/cursor/soft-delete authorization corpus remains.
252	Sorting/filter injection	S/R	Assessment — EF parameterization helps values; dynamic sort/filter names need allowlists and rejection tests.
253	Search denial-of-service	S	Assessment — Unbounded materialization and user-owned row growth create resource risk; F10.
254	Regex review	R	Assessment — Needs source/runtime verification: complete regex inventory, timeouts and adversarial backtracking corpus.
255	Serialization review	S/R	Assessment — DTO/JSON/parser boundaries inspected selectively; serializer depth/type/size fuzz matrix remains.
256	DTO boundary enforcement	S/R	Assessment — Explicit DTOs help; owner/role/entitlement/version fields need negative assignment regressions.
257	Mass-assignment testing	R	Assessment — Needs runtime verification: extra JSON owner/admin/plan/deleted/version fields on all mutations.
258	Numeric-boundary testing	R	Assessment — Needs runtime verification: negative/overflow/precision/NaN/infinity inputs for all numeric domains.
259	Nullability testing	R	Assessment — Needs runtime verification: missing/null/empty distinctions and required fields across all DTOs.
260	Enum evolution	P/R	Assessment — Treat new/unknown enum values deliberately in old clients/imports; compatibility tests proposed.
261	Soft-delete filter correctness	O/S	Assessment — Global owner/soft-delete filters and regression suites useful; administrative bypasses need explicit review.
262	EF Core query review	S/R	Assessment — Read-all exports/boards and quota sums identified; production-provider query plan measurements pending.
263	Connection-pool behaviour	R	Assessment — Needs runtime verification: MariaDB pool exhaustion/waits/timeouts; SQLite differs; PostgreSQL absent.
264	Database timeout handling	R	Assessment — Needs runtime verification: database timeout UX, host survival and accepted-operation recovery.
265	Migration locking	R	Assessment — Needs runtime verification: concurrent migrators/provider lock behavior and crash recovery.
266	Index migration safety	R	Assessment — Needs runtime verification: index build lock/disk/time on realistic MariaDB and SQLite shape.
267	Database backup consistency	S/R	Assessment — Live deploy tar is not consistency proof; daily VACUUM INTO is stronger; restore drill F12.
268	Encryption at rest	R	Assessment — Needs runtime verification: actual database/file/backup disk encryption and off-site key custody.
269	Encryption in transit	R	Assessment — Needs runtime verification: external HTTPS and DB/provider transport configuration.
270	Field-level encryption	S/P	Assessment — Protect provider tokens/TOTP using existing platform primitives; no custom searchable encryption proposed.
271	Encryption-key management	S/R	Assessment — Data Protection key ring is part of recovery and exposure boundary; live custody/rotation unproven.
272	Search versus encryption trade-off	P	Assessment — Encrypting searchable career fields adds query/rotation cost; require threat need and explicit tradeoff.
273	Screenshot/print privacy	P/R	Assessment — Sensitive screen/print output needs user intent; browser/screenshot/print retention not globally preventable.
274	Public-link security	S/R	Assessment — Unpredictable public slug, rotation/revocation and rate rules help; aggregate PDF control missing.
275	Public-profile privacy	S/P	Assessment — Public profile is explicit publication; show exactly what fields/metadata become visible before sharing.
276	robots/noindex	S	Assessment — Public HTML has noindex; PDF parity incomplete; robots directives are not access control.
277	Attachment metadata privacy	R	Assessment — Needs runtime verification: EXIF/document properties and internal IDs in attachment outputs.
278	PDF metadata	R	Assessment — Needs runtime verification: generated PDF author/title/producer/path/language metadata and reading order.
279	Generated filename safety	S/R	Assessment — Filename construction reviewed selectively; Unicode/path/control-character download corpus remains.
280	Content-disposition encoding	R	Assessment — Needs runtime verification: Unicode Content-Disposition compatibility and CRLF/control rejection.
281	Browser download behaviour	O/R	Assessment — Existing PDF download browser checks pass; Safari/mobile/cancel/retry/large-download matrix remains.
282	Temporary download URLs	S/P/R	Assessment — Owner/public-link boundaries mapped; expiry/single-use rules for any temporary capability need specific contract tests.
283	Storage quota	S	Assessment — Attachment byte sum is racy and excludes other retained artifacts; aggregate quota F10.
284	Usage accounting	S	Assessment — AI usage estimates and file accounting need reservation/reconciliation across categories/processes.
285	Quota UX	P/R	Assessment — Explain quota used/remaining and recoverable choices; preserve data rather than delete silently.
286	Downgrade behaviour	S/R	Assessment — Server entitlement rechecks help; downgrade over-quota handling and UI sandbox journey remain.
287	Trial-expiry UX	R	Assessment — Needs runtime verification: configured trial states and expiry warning/action behavior.
288	Billing failure UX	R	Assessment — Needs runtime verification: failed payment, dunning, grace period and delayed event UX.
289	Norwegian consumer considerations	R	Assessment — Requires responsible legal/commercial review; no Norway consumer-law compliance determination made.
290	International readiness	P/R	Assessment — Norwegian-first product can retain explicit locale/currency/time semantics; no all-market readiness claim.
291	Address model	P/R	Assessment — Use optional structured address/display text; international addresses and no-postcode cases need tests.
292	Telephone-number model	P/R	Assessment — Preserve international prefix/display input; avoid Norway-only length assumptions; round-trip unverified.
293	Salary model	P/R	Assessment — Salary needs amount/range/currency/period; never silently treat annual/monthly or currencies alike.
294	Workplace model	P/R	Assessment — Distinguish remote/hybrid/on-site and location text; avoid country-specific required fields without need.
295	Job-source model	S/P	Assessment — Keep source URL/provenance/acquisition time; canonicalization must not erase meaningful distinctions.
296	Company model	P/R	Assessment — Company display spelling and normalized search separate; history/merge policy needs explicit tests.
297	Contact model	P/R	Assessment — Contact details remain private owner data; deletion/normalization and contact role semantics need tests.
298	Correspondence model	S/R	Assessment — Mail content/tokens/attempts have distinct lifecycle; uncertain send is not safe to repeat.
299	Reminder model	O/S	Assessment — Calendar instant bug observed; reminder delivery/time-zone/DST recurrence remains F07/F21.
300	Notification preferences	S/R	Assessment — Reminder preference checks exist; every channel/category/opt-out needs delivery-level verification.
301	Accessibility preferences	R	Assessment — Needs runtime verification: persist/obey reduced motion, contrast/text/input preferences.
302	High-contrast support	R	Assessment — Needs runtime verification: Windows forced colors/high contrast; dark mode is not equivalent.
303	Windows accessibility testing	R	Assessment — Needs runtime verification: Windows Narrator/NVDA and native keyboard/platform behavior.
304	Text-spacing WCAG testing	R	Assessment — Needs runtime verification: required text spacing without clipped/hidden controls or data.
305	Reflow testing	O/R	Assessment — Outer builder overflow0 at375/1440; actual zoom/320 effective width reflow remains.
306	Orientation	R	Assessment — Needs runtime verification: portrait/landscape and no unjustified orientation restriction.
307	Pointer gestures	R	Assessment — Needs runtime verification: single-pointer alternatives to complex/path-based gestures.
308	Drag-and-drop alternatives	R	Assessment — Needs runtime verification: keyboard/status-menu alternative to drag/drop and accessible announcements.
309	Auto-updating content	R	Assessment — Needs runtime verification: polling/preview/autosave updates preserve focus and offer understandable announcements.
310	Session timeout accessibility	R	Assessment — Needs runtime verification: timeout warning, extension/reauthentication and preserved accessible draft.
311	Authentication accessibility	R	Assessment — Needs runtime verification: cognitive/keyboard/screen-reader authentication and error recovery.
312	CAPTCHA fallback	R	Assessment — Needs runtime verification: configured Turnstile failure/unavailable/accessibility fallback.
313	Password-manager support	R	Assessment — Needs runtime verification: password-manager fill/save, paste and change/reset flows.
314	Autocomplete attributes	R	Assessment — Needs source/runtime verification: appropriate autocomplete/inputmode across identity/contact forms.
315	Copy-link behaviour	S/R	Assessment — Clipboard promise must determine success feedback; denied permission matrix unexecuted.
316	Focus after navigation	R	Assessment — Needs runtime verification: route change moves/announces focus predictably without trapping users.
317	Page-title updates	R	Assessment — Needs runtime verification: distinct localized page titles for SPA routes.
318	Live-region strategy	R	Assessment — Needs runtime verification: meaningful save/error/queue live regions without repeated announcement spam.
319	AI streaming accessibility	P/R	Assessment — For streamed AI output, announce status/completion without token-by-token speech; current full flow unverified.
320	Reduced-data considerations	P/R	Assessment — Avoid mandatory heavy AI/assets for core tracking; reduced-data behavior not measured.
321	Asset caching	S/R	Assessment — Static-export caching needs version policy; actual proxy/CDN headers and stale-asset behavior unverified.
322	Service-worker audit	N/P	Assessment — No deployed service-worker behavior established; do not introduce private offline caches during this repair.
323	PWA decision	P	Assessment — PWA is not a current launch requirement; first solve revision and recoverable draft contracts.
324	Mobile keyboard behaviour	R	Assessment — Needs runtime verification: real mobile keyboard overlap, viewport resizing and focused fields.
325	Safe-area insets	R	Assessment — Needs runtime verification: device safe-area insets and bottom action reachability.
326	Touch hover assumptions	R	Assessment — Needs runtime verification: every hover-only action has touch/keyboard access.
327	Right-click/middle-click	R	Assessment — Needs runtime verification: navigation links support middle/right click and modified keyboard activation.
328	Copyability	R	Assessment — Needs runtime verification: key IDs/errors/output text remain selectable/copyable with clear feedback.
329	Scroll restoration	R	Assessment — Needs runtime verification: useful scroll restoration for lists/detail/back/refresh.
330	Sticky element collisions	R	Assessment — Needs runtime verification: stacked sticky toolbars at zoom/mobile/landscape do not obscure content.
331	Anchor offset	R	Assessment — Needs runtime verification: anchor targets and focused fields clear fixed headers.
332	Z-index audit	R	Assessment — Needs source/runtime verification: stacking contexts, overlay order and hidden focus under portals.
333	Portal usage	R	Assessment — Needs runtime verification: portal theme/context/focus/click-outside behavior.
334	Modal nesting	R	Assessment — Needs runtime verification: modal nesting, one focus trap and escape/back order.
335	Escape-key consistency	R	Assessment — Needs runtime verification: Escape semantics across menus/dialogs/drawer/unsaved prompts.
336	Form submission semantics	O/R	Assessment — Basic login/forms exercised; all Enter/submission/preventDefault/validation paths remain.
337	Double-submit protection	O/S	Assessment — Repeated creation creates two rows; editor queue only protects one instance, F01.
338	Optimistic UI correctness	S/R	Assessment — Optimistic success must reconcile failures/conflicts; complete delayed/out-of-order response suite remains.
339	Stale cache correctness	S/R	Assessment — Old editor state overwrites newer server state; no complete revision/stale-cache contract.
340	Cross-account cache clearing	O/R	Assessment — Cross-tab logout leaves editor content; full account-switch and browser Back cache sweep remains.
341	Sensitive browser cache	O	Assessment — Auth/CV/CSV sampled responses lack no-store; no actual shared-cache disclosure demonstrated.
342	Clipboard security	S/P	Assessment — Copy only deliberate values; acknowledge clipboard rejection; clipboard retention is outside server control.
343	Autofill/privacy	R	Assessment — Needs runtime verification: autofill suggestions, shared-device residue and sensitive form storage.
344	Telemetry failures	R	Assessment — Needs runtime verification: telemetry loss must not block normal save/auth actions.
345	Logging failures	S/R	Assessment — PII logging risks identified; disk-full/log-sink outage and blocking/backpressure behavior untested.
346	Monitoring dependency	P/R	Assessment — Independent monitor/dead-man signal proposed; app host must not be sole observer of its failure.
347	Health-check side effects	S	Assessment — Liveness/readiness separation exists; probes should not trigger costly provider calls or writes.
348	Readiness semantics	S/R	Assessment — Ready checks database; optional-service readiness semantics and outage behavior need deployed proof.
349	Startup ordering	O/R	Assessment — Local fresh startup succeeds; external database/proxy/model ordering and restart races untested.
350	Graceful shutdown	S/R	Assessment — Cancellation/leases reviewed; host termination during writes/render/send needs isolated drill.
351	Deployment interruption	R	Assessment — Needs runtime verification: interruption at backup/migration/replace/smoke checkpoints.
352	Zero-downtime realism	S/R	Assessment — Single-host Compose replacement is not demonstrated zero downtime; define acceptable maintenance window.
353	Database migration rollback limitations	S	Assessment — Old-image rollback cannot reverse destructive/provider-specific schema changes, F12.
354	Backup before destructive migration	S/R	Assessment — Predeploy backup exists but consistency/integrity must be proven before destructive migration.
355	Deployment observability	S/P	Assessment — Deploy smoke/logs help; correlate release/config/backup/migration status with user impact.
356	Release correlation	P/R	Assessment — Expose safe commit/artifact/config identifiers in diagnostics; actual full release correlation not proven.
357	Feature rollout strategy	P	Assessment — Use small cohort and observed gates; percentage-rollout platform unnecessary at this scale.
358	Kill switches	S/P	Assessment — Document worker/provider/registration switches and effect on accepted work; test both states.
359	Configuration change audit	P/R	Assessment — Privileged config changes need safe actor/time/reason record; actual operational audit unverified.
360	Admin safety	S	Assessment — Admin minimum scope/recent auth/immutable audit incomplete; normal user denied, F13.
361	Bulk operations	P/R	Assessment — Require bounded batches, explicit targets, preview/recovery and owner checks per item; complete workflow untested.
362	Batch API design	P	Assessment — Batch cost must be bounded per item and aggregate; specify partial-success/idempotency contract first.
363	Background exports	S/P	Assessment — Large export generation should be bounded/streamed or durable queued; existing JSON collections buffer.
364	Email queue	S/P	Assessment — Use database outbox for transactional auth/reminder mail; no broker required initially.
365	Email idempotency	S	Assessment — Direct sends and commit order can duplicate or lose outcome; ambiguous external send needs reconciliation.
366	Reminder delivery reliability	S	Assessment — Reminder loop sends before common SaveChanges; disabled sender can mark sent, F07.
367	Time-sensitive jobs	S/R	Assessment — Backup local-hour cron has DST skip/double risk; date-based catch-up/dedup drill needed.
368	Clock dependence	S/R	Assessment — UTC lease/deadline/time-provider conventions required; substantial clock-skew drill unexecuted.
369	Client/server time mismatch	O/R	Assessment — Explicit offset round-trip is already wrong F21; actual client/server skew matrix remains.
370	Pagination limits	S	Assessment — Paged endpoints do not bound unpaged board/analytics/export paths; cap all expensive work.
371	Export limits	O/S	Assessment — Export limiter shares IP across accounts; generation still buffers, F06/F10.
372	Search-index strategy	P/R	Assessment — Inspect actual provider plans before new search index/server; owner-scoped queries first.
373	Redis decision	N/P	Assessment — Redis absent; no measured cache/shared-state need justifies adding it now.
374	Queue decision	S/P	Assessment — Existing durable database AI queue useful; extend precise delivery semantics rather than add broker.
375	Modular-monolith assessment	S/P	Assessment — Modular monolith is appropriate; current controllers/services/EF support focused boundary repair.
376	Microservice boundary warning	P	Assessment — Independent deployment adds failure/transaction/operational cost; do not split domain services speculatively.
377	Scalability myths	P	Assessment — User count is not concurrency/capacity proof; benchmark actual workload and bottlenecks.
378	Cost architecture	P	Assessment — Host/DB/storage/backups/egress/mail/AI/operator-time cost model supplied; no current prices claimed.
379	Cost observability	P	Assessment — Measure per-success workload cost including failed/retried attempts and actual provider charges.
380	Cost abuse alerts	P/R	Assessment — User/workflow/global budget anomaly and admission alerts proposed; delivery not tested.
381	Data-growth projections	P	Assessment — Explicit synthetic storage growth example; history/package/backups multiply retained bytes.
382	Archive strategy	P/R	Assessment — Set retention and owner-safe archive semantics before introducing partitioning/services.
383	Query-plan testing	R	Assessment — Needs runtime verification: realistic SQLite/MariaDB EXPLAIN plans and worst-owner data.
384	Performance regression testing	P/R	Assessment — Define p95/p99/memory/bytes baseline and budgets; no load-regression gate measured.
385	Bundle regression	O/P	Assessment — Static build passes; route payload/bundle growth budgets proposed, not benchmarked.
386	Lazy-loading strategy	S/P	Assessment — Retain route-level loading and split only measured heavy paths; no speculative dynamic-import rewrite.
387	Third-party frontend scripts	O/R	Assessment — Google Fonts request was blocked in harness; complete production third-party script inventory remains.
388	Font strategy	O/P	Assessment — Fallback-font rendering captured; evaluate approved self-hosting and compare document layout.
389	Image strategy	R	Assessment — Needs runtime verification: actual asset formats/sizes/alt text/lazy behavior and layout shifts.
390	Skeleton accessibility	P/R	Assessment — Skeletons must preserve layout and expose meaningful busy state; no all-component proof.
391	Motion performance	P/R	Assessment — Honor reduced motion and avoid expensive animation; profile real low-end/mobile devices.
392	CSS performance	R	Assessment — Needs runtime verification: style recalculation/layout/paint hot paths before CSS optimization.
393	Memory leaks frontend	R	Assessment — Needs runtime verification: repeated route/editor mount, timers/listeners/iframe/blob memory growth.
394	Request cancellation	S/R	Assessment — Audit cancellation at component and downstream boundaries; full late-response/unmount harness absent.
395	Race-condition frontend testing	O/R	Assessment — Stale and simultaneous CV saves demonstrate race; all frontend response reorder cases remain.
396	Debounce/throttle audit	S	Assessment — Editor debounce/save queue helps one instance; no cross-client conflict or durable recovery guarantee.
397	Autosave state indicator	O/S	Assessment — Saved/failed indicator and local queue exist; prevent false success across stale/conflicting revisions.
398	Unsaved-change protection	O	Assessment — Unload warning exists and was deliberately accepted in reload probe; do not report absent warning.
399	Draft recovery	O	Assessment — Offline unsaved edit not restored after confirmed reload; scope privacy-aware draft recovery.
400	Final cross-cutting audit deliverables	P	Assessment — Requested matrices, models, runbooks and acceptance deliverables supplied.
401	Add a "What happens if...?" section	S/O/R	Assessment — All 50 questions answered; observed/source/runtime boundaries stated individually.
402	Add a "Break Jobjakt" testing phase	O/R	Assessment — 27 observations, 22 unmet expectations; remaining safe staging scenarios listed.
403	Add a "Commercial product readiness" assessment	P	Assessment — Personal, 100-user, 10,000-user and charging-money readiness judgments with blockers.
404	Add a "Professional polish" checklist	S/O/P	Assessment — Professional polish review/checklist and retained synthetic screenshots.
405	Console-cleanliness requirement	O/R	Assessment — Local logs inspected; injected failures separated from normal warnings; production remains unverified.
406	Network-cleanliness requirement	O/R	Assessment — Local logs inspected; injected failures separated from normal warnings; production remains unverified.
407	Backend-log cleanliness	O/R	Assessment — Fresh startup migration/key warnings recorded; no recurrent normal request exception observed; production logs uninspected.
408	Accessibility cleanliness	O/R	Assessment — Serious builder findings in all eight states; manual screen reader still required.
409	No known P0 before launch	P	Assessment — No confirmed P0 in scope; unresolved P1s and missing production gates block launch.
410	Definition of Done	P	Assessment — Tailored DoD and PR/security/UI/database/deployment checklists supplied.
411	PR checklist	P	Assessment — Tailored DoD and PR/security/UI/database/deployment checklists supplied.
412	Security checklist	P	Assessment — Tailored DoD and PR/security/UI/database/deployment checklists supplied.
413	UI checklist	P	Assessment — Tailored DoD and PR/security/UI/database/deployment checklists supplied.
414	Database-change checklist	P	Assessment — Tailored DoD and PR/security/UI/database/deployment checklists supplied.
415	Deployment checklist	P	Assessment — Tailored DoD and PR/security/UI/database/deployment checklists supplied.
416	Final challenge	P	Assessment — Measurable correctness/security/a11y/recovery criteria define paid-user recommendation.