Adversarial review resolution matrix¶
Temporary planning record. It shows how every finding from the three independent reviews was handled, how a fresh-context verifier checked those resolutions, what remains open, and the validation run afterwards. Planning only; no review finding authorised implementation.
1. Process¶
- Reviews: three independent, read-only reviewers (Plan agents on the Opus model), launched about 04:05 BST on 3 October 2026, each with a different dimension:
- Review A — scope and decision fidelity: 1 Blocker, 14 Major, 13 Minor, 2 Notes.
- Review B — data contracts, migration, PRISMA and history: 1 Blocker, 32 Major, 5 Minor, 1 Note.
- Review C — UI, workflow, permissions and programme integration: 2 Blockers, 17 Major, 11 Minor, 3 Notes.
- Reports are preserved verbatim; only front matter and a note were added.
- No reviewer edited the package. One writer (this session) resolved every finding.
- Re-verification before adopting reviewer claims as facts. The load-bearing code claims new
in the reviews were checked directly against
mainbefore the documents were changed: strict BSON class maps, search/project deletion failing closed, "reconciliation reserves nothing", the legacy-reservation migration guard, system-question structure bySystemQuestionVersion, outcome defaults, the read-only AF2 reconcile host, the Dockview layout slots, the impersonation edit mode, the #2621 prototype files, the local classification site, the v10 default navigation mode, the authorization plan's G-D/WP9/WP11/WP-M1/M2, and thestudyAttentionflag text. All held. Live PR state was re-read at about 04:52 BST and again at 05:48 BST. - Verification of the resolutions: a fresh-context, read-only verifier checked every row below against the revised package (§8). Its 20 findings were fixed and are recorded there.
- Resolution categories: Changed (accepted and the package now says it); Question (accepted, but the answer is Chris's, so it became an open question with a recommendation); Assumption (accepted as a labelled working assumption with its cost); Partly (accepted in part, with the rest explained); Noted (no change needed). No finding was rejected outright.
2. Self-review changes made while the reviewers were running¶
The package was edited at about 04:06 BST, while the reviews ran; reviewers A and B reviewed that state.
- Renumbered the AF2 production question from Q-26 to Q-25. (Q-14 is unused: no question carries that number.)
- Corrected the release and gate counts in the plan summary.
- Cited the verified AF2 outcome components in the register's RD16 row.
- Changed the C6 evaluation table so the advanced own-Include option is a relaxation, added assumption A-18, and split Q-15 into (a) and (b).
3. The main structural changes¶
These resolve many findings at once:
- Freeze gates and ship gates (F1–F5, F6a, F6b and lane freezes, plus a per-release ship checklist) replace the old G1–G10, so lanes build against fakes in parallel (A-05, B-20, C-02).
- A compatibility floor release, R0, precedes any canonical write (B-01).
- Smaller releases: R1a–R1d, R2a–R2d, R3a–R3d, R4a/R4p/R4b/R4c, R5a/R5b/R5c, new lane releases P2 and AL1, and a GA milestone (A-12, B-08, B-17, C-01, C-03, C-04, C-18, C-30).
- Feature-owned queues carry confirmed workflow obligations whether or not the notification stack is merged (A-01, C-07).
- Sixteen new engineering contract items (E20–E35); new questions Q-03a and Q-26 to Q-36 (Q-26 to Q-30 added after review A, Q-31 to Q-36 after reviews B and C), plus the split of Q-06 into Q-06a and Q-06b.
4. Review A: scope and decision fidelity¶
| ID | Severity | Resolution | Where |
|---|---|---|---|
| A-01 | Blocker | Changed. The "ship without notifications" fallback is gone. Feature-owned queues (my concerns and outcomes; changes awaiting approval; assigned reconciliation work; requested reviews) are the source of truth; notices only add delivery; acceptance passes with every notification flag off | Assumption A-07; contracts C15; notifications §3, §4.1, §5; plan R3c, R4a, R4b |
| A-02 | Major | Changed. Owner-only transfer is a recommended immediate security fix and R1b's entry criterion; R1 now says "enforced", not "unchanged" | Plan §1, R1b, §11; open questions §1; inventory fact 14, §7 |
| A-03 | Major | Changed. The false "every claim is labelled" sentence is replaced by an explicit labelling rule; unlabelled proposals are now marked PROPOSAL (random start and assigned-first, "no cherry-picking", editor default, COMPARISON F3/F4, F7 re-pairing); the structured-reason shape no longer presumes Q-22; the schema-selection question is labelled as an owner clarification recorded in research |
Plan header, R1a, R4a, R4b; contracts header, C9, C12, C14; register precedence 3, §2, §5 |
| A-04 | Major | Changed. RC10 split: screening decisions re-run profile rules; annotation gold never auto-confirms from agreement after a correction; fixture added | Register §4 RC10; plan R4b; contracts C9 |
| A-05 | Major | Changed. Freeze vs ship gates; ordinary reconciliation (R4a) no longer waits for an R3 pilot; as-of export (R5a) and agreement (R5c) no longer wait for PRISMA identification or for each other, because F6 is split into F6a (as-of) and F6b (reports); engine-before-profiles relabelled as a technical choice | Plan §1, §5.6, §5.7, §6; register §3 |
| A-06 | Major | Changed. Pilot reconciliation and conflict paths are explicit: target-1 or reconciliation-can-wait pilots before R4a; extra votes (D1/D2 Allow) resolve screening conflicts before R4p; legacy reconciliation refuses canonical forms | Plan §5.10, R2a, R3a; open questions Q-07 |
| A-07 | Major | Changed. A-19 now says plainly that label questions are answerable, so two forms can't share an entity category until R2d, with a fixture; SF3 placed in R2d in the register | Open questions A-19; plan R2a; register SF3 |
| A-08 | Major | Question. Q-24 maps D1/D2 (extra-vote admission), D3b, D4 and D6, with D5 and D7 unchanged; C6 gains the extra-vote setting | Open questions Q-24, A-16; contracts C6; plan R3a |
| A-09 | Major | Question. Q-26 (profile-version publication) and Q-27 (proposed effects and correction cascade); OD1 and OD16 corrected | Open questions; register §4 |
| A-10 | Major | Question. Q-28 for stage-owned policies on shared work, with a recommendation; C6 row | Open questions Q-28; contracts C6, C11 |
| A-11 | Major | Question. Q-29 for target-1 forms and legacy single-reviewer studies (no auto-promotion); RECON-03 and MIG-08 dispositions; supersession rows | Open questions Q-29; register §2, §5; migration §3 |
| A-12 | Major | Changed. Lane release AL1 (shared-form allocation, joined with the allocation owner) with acceptance criteria; assumption A-09 now lifts at AL1 | Plan §5.8; open questions A-09, E19 |
| A-13 | Major | Question. Q-31 asks how PS1 is met in production; A-08 clarified as strict PS1 until answered; FEAT-024 gate (b) is external join X-STATS-b | Open questions Q-31, A-08; plan §5.11; contracts C8 |
| A-14 | Major | Changed. Search-deletion fact corrected; deletion-lifecycle and PDF programmes inventoried; P1 joins the deletion-lifecycle design (X-DEL) and the PDF programmes; Q-33 | Inventory fact 17, §3; plan §5.8, §8; open questions Q-33 |
| A-15 | Major | Partly. An author column is added (every in-scope PR is chrissena except #2224, nurikarakaya); contract signatories are named as roles; Q-09 includes coordination with #2224's author. Named delivery owners per lane aren't recorded anywhere this session could verify, so they are assigned at G0 (A-10) |
Inventory §3, §4; plan §4, §6.1, §8; open questions Q-09 |
| A-16 | Minor | Changed. D3b relabelled everywhere; D5 (excluded work) kept; D3a recorded under the precedence rule rather than asked | Inventory fact 12, §6; register precedence 1, §2; open questions Q-24 |
| A-17 | Minor | Changed. Placements reconciled (SF3/SF5 R2d; RX2/LC1 R3c; SET2 R3d); R1c depends on the authorization gates; Q-20 is in Batch B everywhere | Register §1; plan §5.3; open questions |
| A-18 | Minor | Changed. RD2, OD4, OD1, OD6, OD12 and RD9 corrected, with open remainders marked | Register §4 |
| A-19 | Minor | Changed. RECON-07 → VS1 (with FORM-08); RECON-12 → BL1; release-name collisions noted | Register precedence 6, §5; migration §7 |
| A-20 | Minor | Changed. The incomplete-session issue is reframed as an independence and exposure risk extending PV1/VS2; the VS1 conflict stays | Open questions Q-10; notifications §2 |
| A-21 | Minor | Changed. C15 wording fixed (write-time expansion, read-time shaping); group routing through feature queues; the notification stack is an external join in the graph | Contracts C15; notifications §4; plan §6.3 |
| A-22 | Minor | Changed. Catalogue rows for FV4 revision, autoUpdate changes, new profile versions and publish pause/retry | Notifications §3 |
| A-23 | Minor | Changed (in the open-questions rewrite that followed review A). Q-15 presents Mode B, Mode C and the hybrid, and relaxation vs replacement | Open questions Q-15 |
| A-24 | Minor | Changed (same rewrite). Q-11 states how RE2 applies to bulk approval; Q-16 is limited to formula and denominators | Open questions Q-11, Q-16 |
| A-25 | Minor | Changed (same rewrite). Q-30 proposes defaults for VS1, BL1 and assignment expiry | Open questions Q-30 |
| A-26 | Minor | Changed. Row-by-row traceability against the planning brief's scope table; C2's scope and contract C13 now carry outcome associations and conflicts with supporting provenance, so the trace is backed by scope | Plan §5.12, §5.8 C2; contracts C13 |
| A-27 | Minor | Changed. One canonical direction per measure; per-source values are evidence only; conflicts block binding | Migration §3 outcome row |
| A-28 | Minor | Changed. PM1 (ordinary-admin defaults), QY4 (prefer a different reviewer) and OC2 (not derived from numeric type; not a validator or effect claim) restored | Register §1.6, §1.8, §1.9 |
| A-29 | Note | Changed. Live state refreshed at about 04:52 and 05:48 BST: #3948, #3949 and #3955 merged; #3956 added; mergeability updated | Inventory §4; plan §8 |
| A-30 | Note | Noted. The package changed materially after the reviews, so a fresh-context verification pass was run (§8) | §8 |
Review A's missing-coverage list: eligibility D1/D2/D4/D6 → Q-24. Profile-version policy and correction cascade → Q-26, Q-27. Target-1 gold → Q-29. Stage-owned policies on shared work → Q-28. Deletion-lifecycle and PDF programmes → inventory §3, plan §8, P1. Owners → partly (A-15). Pilot reconciliation path → plan §5.10. Shared-form allocation → AL1. FEAT-024 production → Q-31. Notification events and group routing → notifications §3–§4. Defaults → Q-30. Brief traceability → plan §5.12. Earlier-year documents → inventory §10. Default authority policy (research §8 #3) → new Q-36; bulk reassignment (RD9) → open remainder in the register.
5. Review B: data contracts, migration, PRISMA and history¶
| ID | Severity | Resolution | Where |
|---|---|---|---|
| B-01 | Blocker | Changed. New release R0: tolerant class maps one release ahead, a canonical-ownership record stored as data and checked by every legacy writer, a per-project admission service, minimum rollback images and image-rollback rehearsal; floor steps repeat before R3a and P1; the R7 wording no longer implies earlier images are valid | Plan §5.2, §6.2; contracts C16; migration §1, §5, §6; inventory fact 21 |
| B-02 | Major | Changed. Study summary projection maintained in each canonical transaction, with a Study version bump, FEAT-024 pending entries, bulk-lock conflict and a reader inventory (E20) | Contracts C1, C7; open questions E20; migration §1 |
| B-03 | Major | Changed. Drafts contract: outside Study, one per session, base-version CAS, two-tab conflict, audited discard feeding LC1, indexing, invisibility, retention (E21); pendingAnswer superseded |
Contracts C5; open questions E21; register §2 |
| B-04 | Major | Changed. Withdraw as an append-only transition; no hard delete of canonical sessions; presentation state outside versions; Save under an older pin in E1; SF6 tests. Whether reviewers may withdraw on their own is left to the C5 ADR | Contracts C5; plan R2a; open questions E1 |
| B-05 | Major | Changed. Two-phase publication with a frozen impact manifest; no rebasing; notices once per recipient; 10,000-session fixture (E22) | Contracts C4; plan R2c; open questions E22 |
| B-06 | Major | Question. Q-31 (wait for FEAT-024 production readiness, or authoritative counting for named pilots); A-08 stays strict PS1 until answered | Open questions Q-31, A-08 |
| B-07 | Major | Changed. Stage-free scope kinds, definition-rewrite fence, digest plan, canonical ProjectQuestion authorization, N-1 breaking-change rule; one receipt authority (E35) |
Contracts C1, C7, C8; inventory fact 15; open questions E3, E35 |
| B-08 | Major | Changed. R2 split into R2a (one stage, no publication beyond v1), R2b (shared sessions), R2c (publication), R2d (overlap and Fix); R2a's entry no longer depends on F2 | Plan §5.4, §7 |
| B-09 | Major | Changed. One form per entity category until R2d, stated with its cost and a fixture | Open questions A-19 |
| B-10 | Major | Changed. Canonical forms refuse quantitative extraction until O1; extraction features leave form content until then; R4c depends on O1 outright | Plan R2a, §5.8, R4c; contracts C4, C14 |
| B-11 | Major | Changed. Legacy reconciliation and reconciled-answer writes refuse canonical forms from R2a; pilot criterion | Plan R2a, §5.10 |
| B-12 | Major | Changed. History capture from first admission: screening writes from R2a, pool entry from R3a, retrieval and lifecycle from P1; an admin source-classification tool in P1 (E26) | Contracts C3; plan R2a, R3a, P1; open questions E26 |
| B-13 | Major | Changed. C12 split: write-shaping parts freeze at F3 with amendments A and H; identification at F-P; report semantics at F6b | Contracts §2, C12; plan §6.1 |
| B-14 | Major | Changed. Amendments G–J added to Q-06a; FEAT-011 checklist mapping table; supersession rows | Open questions Q-06a; migration §7; register §2 |
| B-15 | Major | Changed. Supersession rows for auto-promotion, $unset rollback and "latest version" gold; target-1 is Q-29; no auto-promotion at adoption |
Register §2; inventory §6; open questions Q-29 |
| B-16 | Major | Changed. Fact corrected; deletion-lifecycle programme inventoried; P1 coordinates with it; Q-33 and amendment J | Inventory fact 17, §3; plan P1, §8; open questions Q-33 |
| B-17 | Major | Changed. Lane release P2 (three-level model, dedup service and audit, reviewed merge/split as a C1/C2 operation, E33); the required profiles for the "Included" lifecycle transition are defined through the per-profile phase mapping | Plan §5.8; contracts C1, C12; open questions E33 |
| B-18 | Major | Changed. The flat "frontier never a PRISMA count" rule is removed from C7 and from the migration mapping; "entering screening" is defined in amendment A with fixtures for early-stopped and batched reviews | Contracts C7, C12; migration §3; open questions Q-06a |
| B-19 | Major | Changed. PRISMA fixtures distributed: 2 and 4 to R2a–R2c, 3 to R3a, 2 and 4 to R3b, 6 to C1 and O1, 1 to P1/P2, 7 to P2, 5 and 8 to R5b | Plan §5.4–§5.8 |
| B-20 | Minor | Changed. Write-shaping amendments moved to Batch B (Q-06a); Q-20 consistent; gate criteria split into freeze and ship; R6 per-domain scope completeness; O2 dry-runs synthetic | Open questions; plan §6, §7, §5.9 |
| B-21 | Major | Changed. Scope completeness is a G-ADOPT check; sessions-only waves are never offered | Migration §2; plan §5.9 |
| B-22 | Major | Changed. E10 specifies membership-uncertain answers, admin session-merge choice, "legacy-completed, unvalidated" and unknown authoring definitions | Open questions E10; migration §3 |
| B-23 | Major | Question. Q-35 for legacy reconciled answers, with a recommendation | Open questions Q-35; contracts C9; migration §3 |
| B-24 | Major | Changed. Defaults treated as "value or default (unknown)"; outcome-level answer preferred; consolidation only within one author's series; added to Q-05 | Migration §3; open questions Q-05; plan O2 |
| B-25 | Major | Assumption. A-20: outcome measures are reviewer-created per-study entities, per the recorded owner clarification; the C14 ADR confirms or raises it; the UI comparison no longer implies a project catalogue | Open questions A-20; contracts C14; UI comparison §2.1 |
| B-26 | Major | Changed. C2 key frozen at F1 with author or authority scope and a default whole-study population from the first write; one head per author | Contracts C1, C2, C13 |
| B-27 | Major | Changed. System-question snapshots per SystemQuestionVersion (E24); D38 must allow existing structural variants or mint new identities |
Contracts C4; migration §3; open questions E24 |
| B-28 | Major | Changed. C9 gains task key, candidate drift, shared-question gold ownership (PROPOSAL), a separate profile-adjudication aggregate and snapshot-pointer CAS |
Contracts C9; plan R4a, R4p |
| B-29 | Major | Changed. Production prerequisites per release (eligibility flag and reservation migration, tracking or a dedicated reconciliation claim) | Plan §5.11; contracts C7; open questions Q-25, E6 |
| B-30 | Major | Changed. Three-state exposure that fails safe; real actor and on-behalf-of on every command, receipt and revision; impersonated writes flagged and excluded from independence statistics (wording now identical in C1 and R2a) | Contracts C1, C3; plan R2a; inventory fact 23 |
| B-31 | Major | Changed. Per-project commit sequence from F1; watermark rule at F6a; per-dataset coverage; "not observed" before adoption; legacy timestamp trust; retention decision; blinding rule; OnlyCompleted fix behind a flag (E25) |
Contracts C11; open questions E25; plan R5a |
| B-32 | Major | Changed. Writer and reader inventory extended (session removal, question cascade, fold worker, deletion scheduler, import compensation, bulk PDF, preview seeding, impersonation; #3944 as a reader); notification aggregates in R6 manifests | Migration §1, §3; notifications §1.3, §5 |
| B-33 | Major | Changed. One applicability specification with shared .NET and AF2 fixtures, typed errors and a hidden-question fixture (E23) | Contracts C4, C5; plan R2a; open questions E23 |
| B-34 | Major | Question. Covered by Q-26 (also raised by A-09); profile-version usage added to C8 and to the F5 freeze | Open questions Q-26; contracts C8; plan §6.1 |
| B-35 | Minor | Changed. C15 wording; SourceId per event occurrence; two-event lifecycle fixture | Contracts C15; notifications §1.3, §4 |
| B-36 | Minor | Changed. Per-profile PRISMA phase mapping, Admin authority with override audit, and an owner and UI for metaAnalysisIncluded |
Contracts C12; plan R3b, R5b |
| B-37 | Minor | Changed. Agreement (R5c) and outcome-level statistics are computed from canonical revisions, or need a FEAT-024 scope amendment | Contracts C8; plan R5c |
| B-38 | Minor | Changed. P1 extends the search-population family with source type; Citation backfill comes from re-parsed files or is labelled as derived | Plan P1, P2; migration §3 |
| B-39 | Note | Changed. Baseline refreshed to 2949ca3a7 and then c59d9d0f1 (beyond the reviewer's 9d74077d8) |
All documents' evidence notes; inventory header |
Review B's missing-coverage list: erasure vs immutable history → E32 and migration principle 8. ID minting → E27. Large-form ceiling → E28. LC1 completion trigger → E29 and R3c. Post-commit side effects → E30. Cross-form conditional consistency (D51, D53–D55) → E34. Evidence-based PRISMA lower bounds → R5b and migration §7. Updated reviews (box 1) → R5b rule. Storage evidence → M0 (aggregate-only survey only if authorised) and migration §4. Restore validation → E31 and migration §6.
6. Review C: UI, workflow, permissions and programme integration¶
| ID | Severity | Resolution | Where |
|---|---|---|---|
| C-01 | Blocker | Changed. R1 split. R1a: templates and import. R1b: read-only visibility, owner-only enforcement and the guard fix, with the authorization programme's WP9 explanations joining when ready, so nothing in R1b waits for a schema gate. R1c: #3335's WP11 (generalised dialog, stub retirement, group CRUD), after X-AUTH-SCHEMA, X-AUTH-ENFORCE (or parity tests) and WP9. R1d: delegation. Q-03a moved to Batch A; #2224 author agreement; reviewer parity is the AF2 programme's join, not an R1 deliverable | Plan §1, §5.3, §5.11, §6.3, §7, §8; open questions Q-03a, Q-09, A-17 |
| C-02 | Blocker | Changed. Freeze gates and ship gates; graph, windows and critical path redrawn and, after verification, made consistent with each other | Plan §6, §7 |
| C-03 | Major | Changed. R4a (ordinary reconciliation) ships after R2b and F4; the profile part is R4p after R3b | Plan §5.6 |
| C-04 | Major | Changed. R2a–R2d and R3a–R3d, each with its own acceptance; R3a uses canonical decisions under one default profile, the role the review suggested for the compatibility profile | Plan §5.4, §5.5 |
| C-05 | Major | Changed. One server-authoritative per-project admission service in R0; Q-25 is a per-flag decision table; pilots are staging only until agreed | Plan §1, §5.2, §5.11; contracts C16; open questions Q-25 |
| C-06 | Major | Question. Q-10 reframed: required before conversations are enabled; private visibility, exposure marker and read-only link, reconciler eligibility, extra-reviewer exclusion; three merge routes | Open questions Q-10; notifications §2 |
| C-07 | Major | Changed. Four feature-owned queues; acceptance with notification flags off | Notifications §4.1; plan R3c, R4a, R4b |
| C-08 | Major | Changed. R1c reuses #3941's capture; catalogue rows for held items, corrected inputs, FV4, RA5 withdrawal or expiry and LC1 reviewer effects | Plan R1c; notifications §3, §5 |
| C-09 | Major | Changed. Security fix and R1b entry; owner-reserved activities refused and hidden; ChangeOwner never grantable; copy and user guide corrected | Plan R1b, R1c; contracts C10; open questions §1, Q-03a |
| C-10 | Major | Changed. Export disclosure contract, frozen at F1 so it precedes R2a's previous-version export; U26 | Contracts C10, C11; plan R2a, §6.1; open questions U26; inventory fact 25, §7 |
| C-11 | Major | Changed. All seven #2621 prototypes inventoried with dispositions; gaps on profile-version impact and PRISMA views marked partly designed | UI comparison §1, §2, §3 |
| C-12 | Major | Changed. U13–U29 added, one per remaining gap and reviewer state, each with its release; R2 prototypes in W0; user-testing exit criteria for R3–R5; U10/U11 tagged consistently | Open questions §3; UI comparison §3; plan §7, §9 |
| C-13 | Major | Changed. AF2 screening-renderer contract at F5 (admission for screening steps or a dedicated renderer); A-02 updated; U17 | Plan R3b, §6.1; open questions A-02, U17 |
| C-14 | Major | Changed. Editable reconcile-host contract at F4; AF2 Phase 4 PR 9 as an external join for R4c | Plan R4a, R4c, §5.11, §8 |
| C-15 | Major | Changed. Dockview layout-contract amendment at F1, before R2a's history panel | Contracts C17; plan R2a, §6.1; inventory fact 24 |
| C-16 | Major | Changed. Dispositions for each v10 setting (PROPOSAL); rationale requiredness is Q-32 |
Contracts C9; register §2; open questions Q-32 |
| C-17 | Major | Changed. Capability tests in every ship gate; Q-03 subsets named in the F1–F4 exit evidence; every new view mapped to a capability; Agreement gets its own navigation place | Plan §6.1, §6.2; open questions Q-03; contracts C10; UI comparison §4 |
| C-18 | Major | Changed. Coexistence in C17; an admission rule for new projects; the GA milestone; the editor default made a PROPOSAL tied to its two modes; U27 |
Contracts C17; plan R1a, §5.9; open questions U27 |
| C-19 | Major | Changed. AF2 extension points at F1 and an explicit L5 order (R2a → R2b → R2c → R3a → C1 → O1 → R2d → R3b) that matches the windows | Plan §7; contracts C17 |
| C-20 | Minor | Changed as a PROPOSAL: a parity exit set, to agree with the AF2 owner |
Plan §8 |
| C-21 | Minor | Changed. v10 navigation claim corrected; checklist footer kept; one Reconcile entry; Agreement and project settings placed; "question templates" term; M3 navigation owner join; categories-to-entity-types transition | UI comparison §2.1, §4; contracts C17; open questions Q-13 |
| C-22 | Minor | Changed. Four-step wizard; vocabulary mapped; option mapping is Q-34; within-session conflicts in U6 | UI comparison §1, §2.1; open questions Q-34, U6 |
| C-23 | Minor | Changed. No hard delete for canonical sessions | Plan R2a; contracts C5; UI comparison §2.3 |
| C-24 | Minor | Changed. Extraction refused on canonical forms until O1 | Plan R2a; contracts C4 |
| C-25 | Minor | Changed. R3c acceptance covers Fix under LC1; U4 adds route choice and the approval wait | Plan R3c; open questions U4 |
| C-26 | Minor | Changed. U1 adds partial/blank agreement rules, no hidden disagreeing candidate, keyboard pairing and N-candidate performance | Open questions U1 |
| C-27 | Minor | Changed. Allocation join at F1/F-A; #3939 merged or its definition extracted is R3c's entry; #2986 harvested into R2a | Plan R2a, R3c, §5.8, §8 |
| C-28 | Minor | Changed. States, authors and stale-PR dispositions refreshed (#2469's conflict with SF2 recorded) | Inventory §4; plan §8 |
| C-29 | Minor | Changed. Audit reuses authorizationAudit; anti-escalation covers adding others; ChangeOwner is never grantable and AssignPermissions only through R1d's envelope |
Plan R1c, R1d; contracts C10; open questions Q-03a |
| C-30 | Minor | Changed. As-of export is R5a, entering on R4a and F6a only, independent of P1, of the PRISMA report amendments and of the agreement methods (R5c) | Plan R5a, R5c, §6.1 |
| C-31 | Note | Changed. Guard typo fix in R1b (authorization WP1d) | Plan R1b; inventory §7 |
| C-32 | Note | Changed. The local classification site is listed as found, not reviewed | UI comparison §1 |
| C-33 | Note | Changed. The review files and this matrix now exist | reviews/ |
Review C's missing-coverage list: accessibility → ship checklist item 5, UI comparison §5 and every U validation. Reviewer progress lists → R2b. Terminology and copy contract → C17 at F1 and plan §9. Pilot operations UX → plan §9, U28. Help and change communication → plan §9 and GA criteria. Today's screening-reconciliation path → UI comparison §5, to document before F4. Inbox rendering → U25. Narrow screens and performance budgets → UI comparison §5.
7. Remaining blockers and open items¶
None of the review blockers remains open as a planning defect. These items remain, by design:
- Decisions only Chris can make, all with recommendations: the ownership-transfer security fix; Q-10 (urgent); Batch A (Q-07, Q-08, Q-09, Q-13, Q-03a); then Batches B and C. The ones most likely to move the schedule are Q-25 (production flags), Q-31 (PS1 in production) and Q-06a (PRISMA write-shaping amendments).
- External programme gates outside this plan's control: AF2 production readiness, FEAT-024
gate (b), the paused eligibility programme, the authorization gates and WP9/WP11 for custom
groups and the permissions dialog, AF2 Phase 4 PR 9, the deletion-lifecycle design and the
notification stack's merge. Each is a named external join with an owner role. A
PROPOSALto split #3335's WP11 would let a dialog over existing groups land earlier. - Owners: named delivery owners per lane are assigned at G0 (A-15 partly resolved).
- Contract ADRs: E1–E35 are engineering contracts to write at their freeze gates; this package states requirements, not designs.
- Unreviewed or unavailable assets: Review Prototype v3/v5, the Figma file, the remote classification site and the local classification build (found, not reviewed).
8. Fresh-context verification of the resolutions¶
Because the resolutions changed the package substantially (A-30), one further read-only verifier
(Plan agent, Opus model) checked the revised package against this matrix, the verbatim reviews,
the ledger, the planning brief and main. It edited nothing.
Its verdict: the restructure mostly landed. 89 of 102 rows were confirmed as claimed; 13 were
partial, mislabelled or introduced new inconsistencies. All four blockers had their core fix in
place. The five invariants were stated exactly and never contradicted. Every referenced question,
engineering, UI and assumption ID was defined exactly once, and the batches matched. No old-sense
release names survived. The notification constraints held. Nine inventory code claims held at
2949ca3a7. It raised 20 findings, none a blocker, all now fixed:
| ID | Severity | Finding | Resolution |
|---|---|---|---|
| V-01 | Major | R1b was shown as shippable after G0, but its dialog, stub retirement and explanations are the authorization programme's WP11 and WP9, and WP11 waits for that programme's schema gate | Fixed. R1b narrowed to read-only visibility, owner-only enforcement and the guard fix; WP9 explanations join R1b when ready (external join X-AUTH-WP9); the dialog, stub retirement and group CRUD (WP11) moved to R1c; a PROPOSAL to split WP11; §1, §5.3, §5.11, §6.3, §6.4, §7, §8 updated |
| V-02 | Major | The first window started at "Plan submitted" and scheduled M0 and the R1a/R1b builds before plan approval | Fixed. A "Before G0" row allows only review and decisions; nothing is built, prototyped or committed before G0; W0 starts at G0 |
| V-03 | Minor | The critical path made GA wait for R5b | Fixed. §6.4 separates the GA chain from parallel full-scope tails (P1 → P2 → R5b, O1 → R4c, R5a, R5c, C2, AL1, R1c/R1d) |
| V-04 | Minor | R2a's prerequisites disagreed between sections, and W2 re-coupled R2a to F2 | Fixed. R2a has an explicit entry line (R0 soaked; F1 including AF2 extension points, the layout amendment, export disclosure and the copy contract); the windows give each item its own condition |
| V-05 | Minor | Export disclosure froze at F4, after R2a needs it | Fixed. Export disclosure freezes at F1 (C10 catalogue row, §6.1) |
| V-06 | Minor | The reviewer-workspace order placed C1 after R3b while C1 ships earlier, and omitted O1 | Fixed. Order R2a → R2b → R2c → R3a → C1 → O1 → R2d → R3b, matching the windows |
| V-07 | Minor | The A1 lane release had no acceptance criteria | Fixed. AL1 (renamed, see V-17) has acceptance criteria |
| V-08 | Minor | As-of export still waited for the PRISMA report amendments and agreement methods through a single F6 | Fixed. F6 split into F6a (as-of) and F6b (reports); agreement is its own release, R5c; R5a enters on R4a and F6a only |
| V-09 | Minor | "Outcome associations" and "conflicts with supporting provenance" existed only in the trace table | Fixed. Added to C2's scope and to contract C13 |
| V-10 | Minor | The migration mapping restated the removed frontier rule; P2's required profiles were undefined | Fixed. Migration row defers to amendment A; C12 defines required profiles through the phase mapping; P2 cites it |
| V-11 | Minor (fidelity) | Wording implied ChangeOwner and Delete become grantable after R1d | Fixed. ChangeOwner is never grantable (PM1); AssignPermissions only through R1d's envelope (PM2); Delete per Q-03 (C10, Q-03a, R1c) |
| V-12 | Minor (matrix) | A-23/A-24/A-25 were labelled as self-review fixes; §3 counts were wrong | Fixed. Relabelled "Changed"; counts corrected (16 engineering items; Q-26 to Q-36 listed); §2 notes Q-14 is unused |
| V-13 | Minor | Q-03's per-freeze subsets appeared only in Q-03, and the catalogue subset's F1 deadline clashed with its Batch B placement | Fixed. Subsets named in the F1–F4 exit evidence; the catalogue subset's earlier deadline is stated in Q-03 and §11 |
| V-14 | Minor | Graph, gate-row and window gaps (X-TRACK, R1a → R3d, lane freezes, P2's reviewed part, O2's P1 gate; C17 at F1, amendment H at F3, C8 profiles at F5; missing build and ship windows) | Fixed. All added to the graph, the gate table, the windows and the §1 table |
| V-15 | Minor | The "notify or only flag outdated annotations" question was referenced but not in the authoritative list | Fixed. Q-20 now includes it, with a recommendation |
| V-16 | Note | Stale references: "U1–U26", unsuffixed Q-06, Q-14's absence, Q-18 listed as a C1 dependency | Fixed. U1–U29 (U29 added for the agreement view); Q-06a/Q-06b; Q-14 noted as unused; C1 now depends on Q-19 only |
| V-17 | Note | Label collisions: asset IDs F1–F3 vs freeze gates; lane release A1 vs research case A1 and assumption IDs; X-AUTH-C/D names borrowed inconsistently from two plans | Fixed. Assets renamed RP4 and RP1–2/RB; COMPARISON F7 prefixed; lane release renamed AL1; research cases and assumptions labelled explicitly; gates renamed X-AUTH-SCHEMA (G-D in #3335's handover plan) and X-AUTH-ENFORCE (M6/G-C in the authority-transition plan) |
| V-18 | Note | Loose citations for "never offered a study they reviewed", for invariant 10, and a C1/R2a wording mismatch | Fixed. Cited to QY4 and Q-36; invariant 10 cites PM1/PM2 and RA1–RA2; C1 and R2a wording aligned |
| V-19 | Note | "Only Entity subclasses tolerate extra elements" overstated the baseline | Fixed. C1 and inventory fact 21 note FEAT-024's pending-statistics maps already ignore extra elements; the strict-map claim for the three embedded types stands |
| V-20 | Note | main moved to c59d9d0f1 and #3955 merged during the check; the README claimed verification before this section existed |
Fixed. Baseline and PR states refreshed at 05:48 BST; README and this section now agree |
Validation after resolution¶
Run in the PR3617 worktree at about 06:00 BST on 3 October 2026, after the verifier's fixes. Details are in validation evidence §6.
| Check | Command | Result |
|---|---|---|
| Documentation validator | ./docs/scripts/validate-docs.sh --verbose --skip-indexes |
Exit 0. All 14 package files pass the front-matter checks; no broken links anywhere. The 63 warnings are pre-existing ones from elsewhere in the repository, none from this package. |
| Anchor check | Scratchpad script checking every file.md#anchor link under both GitHub and MkDocs slug rules |
42 anchored links; all resolve under both rules |
| Consistency sweep | rg for old release, gate and ID names; question IDs referenced vs defined |
No stale names outside the matrix rows that describe them; every referenced question ID is defined |
| Worktree safety | git status; file modification times |
Only the new folder was added; the 2 modified and 16 untracked pre-existing research files are untouched |
--skip-indexes is deliberate: without it the validator regenerates existing index.md files,
and this package must not modify existing files. The PR owner should regenerate the planning
index before committing. The Mermaid graph wasn't rendered by a Mermaid tool.