{"metadata": {"vulnerability": "CVE-2026-41907", "count": 240, "kinds": {"milestone": 49, "sighting": 6, "kev": 0, "other": 185}, "linked_omitted": 0}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0325", "record": "NCSC-2026-0325", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2025-11-13T15:32:44.634Z", "date_only": false, "value": "2025-11-13T15:32:44.634000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.2.release_date", "linked_record": true}, {"timestamp": "2025-11-13T16:01:24.744Z", "date_only": false, "value": "2025-11-13T16:01:24.744054+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.2.discovery_date", "linked_record": true}, {"timestamp": "2025-12-02T18:54:10.166Z", "date_only": false, "value": "2025-12-02T18:54:10.166000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.1.release_date", "linked_record": true}, {"timestamp": "2025-12-02T20:01:45.330Z", "date_only": false, "value": "2025-12-02T20:01:45.330964+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.1.discovery_date", "linked_record": true}, {"timestamp": "2026-01-10T02:39:41.078Z", "date_only": false, "value": "2026-01-10T02:39:41.078000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.3.release_date", "linked_record": true}, {"timestamp": "2026-01-10T04:01:28.174Z", "date_only": false, "value": "2026-01-10T04:01:28.174269+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.3.discovery_date", "linked_record": true}, {"timestamp": "2026-01-14T19:07:13.745Z", "date_only": false, "value": "2026-01-14T19:07:13.745000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.20.release_date", "linked_record": true}, {"timestamp": "2026-01-14T20:01:00.899Z", "date_only": false, "value": "2026-01-14T20:01:00.899462+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.20.discovery_date", "linked_record": true}, {"timestamp": "2026-01-28T19:30:31.215Z", "date_only": false, "value": "2026-01-28T19:30:31.215000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-01-28T20:01:42.791Z", "date_only": false, "value": "2026-01-28T20:01:42.791305+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-03-12T19:56:55.092Z", "date_only": false, "value": "2026-03-12T19:56:55.092000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.4.release_date", "linked_record": true}, {"timestamp": "2026-03-12T20:08:05.950Z", "date_only": false, "value": "2026-03-12T20:08:05.950000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.5.release_date", "linked_record": true}, {"timestamp": "2026-03-12T20:17:18.984Z", "date_only": false, "value": "2026-03-12T20:17:18.984000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.6.release_date", "linked_record": true}, {"timestamp": "2026-03-12T20:27:05.600Z", "date_only": false, "value": "2026-03-12T20:27:05.600000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.7.release_date", "linked_record": true}, {"timestamp": "2026-03-12T21:01:21.390Z", "date_only": false, "value": "2026-03-12T21:01:21.390673+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.6.discovery_date", "linked_record": true}, {"timestamp": "2026-03-12T21:01:25.538Z", "date_only": false, "value": "2026-03-12T21:01:25.538271+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.5.discovery_date", "linked_record": true}, {"timestamp": "2026-03-12T21:01:29.187Z", "date_only": false, "value": "2026-03-12T21:01:29.187989+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.7.discovery_date", "linked_record": true}, {"timestamp": "2026-03-12T21:01:33.639Z", "date_only": false, "value": "2026-03-12T21:01:33.639277+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.4.discovery_date", "linked_record": true}, {"timestamp": "2026-03-20T22:23:32.147Z", "date_only": false, "value": "2026-03-20T22:23:32.147000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.22.release_date", "linked_record": true}, {"timestamp": "2026-03-20T23:02:27.802Z", "date_only": false, "value": "2026-03-20T23:02:27.802640+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.22.discovery_date", "linked_record": true}, {"timestamp": "2026-03-24T19:35:47.908Z", "date_only": false, "value": "2026-03-24T19:35:47.908000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.23.release_date", "linked_record": true}, {"timestamp": "2026-03-24T20:02:32.870Z", "date_only": false, "value": "2026-03-24T20:02:32.870828+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.23.discovery_date", "linked_record": true}, {"timestamp": "2026-03-25T17:02:48.402Z", "date_only": false, "value": "2026-03-25T17:02:48.402000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.21.release_date", "linked_record": true}, {"timestamp": "2026-03-25T18:01:56.017Z", "date_only": false, "value": "2026-03-25T18:01:56.017766+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.21.discovery_date", "linked_record": true}, {"timestamp": "2026-03-26T21:20:48.191Z", "date_only": false, "value": "2026-03-26T21:20:48.191000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.24.release_date", "linked_record": true}, {"timestamp": "2026-03-26T21:20:48.191Z", "date_only": false, "value": "2026-03-26T21:20:48.191000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.3.release_date", "linked_record": true}, {"timestamp": "2026-03-26T21:39:16.362Z", "date_only": false, "value": "2026-03-26T21:39:16.362000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.25.release_date", "linked_record": true}, {"timestamp": "2026-03-26T21:39:16.362Z", "date_only": false, "value": "2026-03-26T21:39:16.362000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.4.release_date", "linked_record": true}, {"timestamp": "2026-03-26T22:01:52.640Z", "date_only": false, "value": "2026-03-26T22:01:52.640474+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.24.discovery_date", "linked_record": true}, {"timestamp": "2026-03-26T22:01:52.640Z", "date_only": false, "value": "2026-03-26T22:01:52.640474+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.3.discovery_date", "linked_record": true}, {"timestamp": "2026-03-26T22:02:21.858Z", "date_only": false, "value": "2026-03-26T22:02:21.858105+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.25.discovery_date", "linked_record": true}, {"timestamp": "2026-03-26T22:02:21.858Z", "date_only": false, "value": "2026-03-26T22:02:21.858105+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.4.discovery_date", "linked_record": true}, {"timestamp": "2026-03-27T14:04:52.297Z", "date_only": false, "value": "2026-03-27T14:04:52.297000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.26.release_date", "linked_record": true}, {"timestamp": "2026-03-27T14:04:52.297Z", "date_only": false, "value": "2026-03-27T14:04:52.297000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.5.release_date", "linked_record": true}, {"timestamp": "2026-03-27T15:03:02.892Z", "date_only": false, "value": "2026-03-27T15:03:02.892793+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.26.discovery_date", "linked_record": true}, {"timestamp": "2026-03-27T15:03:02.892Z", "date_only": false, "value": "2026-03-27T15:03:02.892793+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.5.discovery_date", "linked_record": true}, {"timestamp": "2026-03-31T01:48:45.759Z", "date_only": false, "value": "2026-03-31T01:48:45.759000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.27.release_date", "linked_record": true}, {"timestamp": "2026-03-31T03:02:04.502Z", "date_only": false, "value": "2026-03-31T03:02:04.502444+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.27.discovery_date", "linked_record": true}, {"timestamp": "2026-04-02T00:00:00Z", "date_only": false, "value": "2026-04-02T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-41907", "record": "MSRC_CVE-2026-41907", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-04-06T16:22:45.353Z", "date_only": false, "value": "2026-04-06T16:22:45.353000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.28.release_date", "linked_record": true}, {"timestamp": "2026-04-06T17:01:34.639Z", "date_only": false, "value": "2026-04-06T17:01:34.639203+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.28.discovery_date", "linked_record": true}, {"timestamp": "2026-04-13T03:52:35Z", "date_only": false, "value": "2026-04-13T03:52:35+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.29.discovery_date", "linked_record": true}, {"timestamp": "2026-04-13T23:59:59Z", "date_only": false, "value": "2026-04-13T23:59:59+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.29.release_date", "linked_record": true}, {"timestamp": "2026-04-19T15:20:09Z", "date_only": false, "value": "2026-04-19T15:20:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://api.github.com/repos/uuidjs/uuid/security-advisories/GHSA-w5hq-g745-h8pq", "record": "CVE-2026-41907", "field": "creation_timestamp", "uuid": "effcdc92-e8e3-47c9-afd6-c99023bbc7df", "url": "https://api.github.com/repos/uuidjs/uuid/security-advisories/GHSA-w5hq-g745-h8pq", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-04-19T15:20:09Z", "date_only": false, "value": "2026-04-19T15:20:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq", "record": "CVE-2026-41907", "field": "creation_timestamp", "uuid": "d2b4caeb-21b5-46b5-af02-b7e49d0d8d14", "url": "https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-04-22T15:11:54.673Z", "date_only": false, "value": "2026-04-22T15:11:54.673Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-41907", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-04-22T20:53:24Z", "date_only": false, "value": "2026-04-22T20:53:24Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-W5HQ-G745-H8PQ", "record": "GHSA-W5HQ-G745-H8PQ", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-04-24T02:27:47.719Z", "date_only": false, "value": "2026-04-24T02:27:47.719000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.32.release_date", "linked_record": true}, {"timestamp": "2026-04-24T02:27:47.719Z", "date_only": false, "value": "2026-04-24T02:27:47.719000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.7.release_date", "linked_record": true}, {"timestamp": "2026-04-24T03:01:02.377Z", "date_only": false, "value": "2026-04-24T03:01:02.377527+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.32.discovery_date", "linked_record": true}, {"timestamp": "2026-04-24T03:01:02.377Z", "date_only": false, "value": "2026-04-24T03:01:02.377527+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.7.discovery_date", "linked_record": true}, {"timestamp": "2026-04-24T18:09:24.744Z", "date_only": false, "value": "2026-04-24T18:09:24.744Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-41907", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-04-24T18:09:24.744Z", "date_only": false, "value": "2026-04-24T18:09:24.744000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.34.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-04-24T18:09:24.744Z", "date_only": false, "value": "2026-04-24T18:09:24.744000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.9.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-04-24T18:09:24.744Z", "date_only": false, "value": "2026-04-24T18:09:24.744Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-41907", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-24T19:02:43.860Z", "date_only": false, "value": "2026-04-24T19:02:43.860767+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.34.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-04-24T19:02:43.860Z", "date_only": false, "value": "2026-04-24T19:02:43.860767+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.9.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-04-24T19:17:00Z", "date_only": false, "value": "2026-04-24T19:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-41907", "record": "UBUNTU-CVE-2026-41907", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-04-24T19:17:14Z", "date_only": false, "value": "2026-04-24T19:17:14Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-W5HQ-G745-H8PQ", "record": "GHSA-W5HQ-G745-H8PQ", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-04-24T19:17:14.490Z", "date_only": false, "value": "2026-04-24T19:17:14.490", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-41907", "record": "FKIE_CVE-2026-41907", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-04-26T01:04:53Z", "date_only": false, "value": "2026-04-26T01:04:53.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-41907", "record": "MSRC_CVE-2026-41907", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-04-26T01:04:53Z", "date_only": false, "value": "2026-04-26T01:04:53.000Z", "kind": "other", "label": "None available", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-41907", "record": "MSRC_CVE-2026-41907", "field": "vulnerabilities.0.remediations.0.date", "linked_record": true}, {"timestamp": "2026-04-27T13:13:45.256Z", "date_only": false, "value": "2026-04-27T13:13:45.256759Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-41907", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-04-27T13:13:45.256Z", "date_only": false, "value": "2026-04-27T13:13:45.256759Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-41907", "record": "FKIE_CVE-2026-41907", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-04-27T13:35:34.363Z", "date_only": false, "value": "2026-04-27T13:35:34.363Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-41907", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-04-27T13:35:34.363Z", "date_only": false, "value": "2026-04-27T13:35:34.363Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-41907", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-27T14:43:21Z", "date_only": false, "value": "2026-04-27T14:43:21.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-41907", "record": "MSRC_CVE-2026-41907", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-04-27T14:43:21Z", "date_only": false, "value": "2026-04-27T14:43:21.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-41907", "record": "MSRC_CVE-2026-41907", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-04-28T07:17:25.100Z", "date_only": false, "value": "2026-04-28T07:17:25.100Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-41907", "record": "MSRC_CVE-2026-41907", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-05-04T19:31:57.253Z", "date_only": false, "value": "2026-05-04T19:31:57.253000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.8.release_date", "linked_record": true}, {"timestamp": "2026-05-04T19:31:57.253Z", "date_only": false, "value": "2026-05-04T19:31:57.253000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-05-04T20:01:14.938Z", "date_only": false, "value": "2026-05-04T20:01:14.938426+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.8.discovery_date", "linked_record": true}, {"timestamp": "2026-05-04T20:01:14.938Z", "date_only": false, "value": "2026-05-04T20:01:14.938426+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-05-05T06:40:28Z", "date_only": false, "value": "2026-05-05T06:40:28.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/cc4d9b85509a9bc85167e4592e568bc8", "record": "CVE-2026-41907", "field": "creation_timestamp", "uuid": "3e27fa95-b4d8-4f90-aa82-cfd61b733415", "url": "https://gist.github.com/alon710/cc4d9b85509a9bc85167e4592e568bc8"}, {"timestamp": "2026-05-05T10:29:16.378Z", "date_only": false, "value": "2026-05-05T10:29:16.378000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.9.release_date", "linked_record": true}, {"timestamp": "2026-05-05T10:29:16.378Z", "date_only": false, "value": "2026-05-05T10:29:16.378000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.1.release_date", "linked_record": true}, {"timestamp": "2026-05-05T11:01:00.332Z", "date_only": false, "value": "2026-05-05T11:01:00.332189+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.9.discovery_date", "linked_record": true}, {"timestamp": "2026-05-05T11:01:00.332Z", "date_only": false, "value": "2026-05-05T11:01:00.332189+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.1.discovery_date", "linked_record": true}, {"timestamp": "2026-05-07T13:36:55.871Z", "date_only": false, "value": "2026-05-07T13:36:55.871000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.33.release_date", "linked_record": true}, {"timestamp": "2026-05-07T13:36:55.871Z", "date_only": false, "value": "2026-05-07T13:36:55.871000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.8.release_date", "linked_record": true}, {"timestamp": "2026-05-07T15:01:54.137Z", "date_only": false, "value": "2026-05-07T15:01:54.137775+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.33.discovery_date", "linked_record": true}, {"timestamp": "2026-05-07T15:01:54.137Z", "date_only": false, "value": "2026-05-07T15:01:54.137775+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.8.discovery_date", "linked_record": true}, {"timestamp": "2026-05-12T19:43:16.470Z", "date_only": false, "value": "2026-05-12T19:43:16.470000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.10.release_date", "linked_record": true}, {"timestamp": "2026-05-12T21:01:14.436Z", "date_only": false, "value": "2026-05-12T21:01:14.436876+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.10.discovery_date", "linked_record": true}, {"timestamp": "2026-05-13T15:24:54.596Z", "date_only": false, "value": "2026-05-13T15:24:54.596000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.11.release_date", "linked_record": true}, {"timestamp": "2026-05-13T17:01:04.018Z", "date_only": false, "value": "2026-05-13T17:01:04.018478+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.11.discovery_date", "linked_record": true}, {"timestamp": "2026-05-15T14:53:57.263Z", "date_only": false, "value": "2026-05-15T14:53:57.263000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.37.release_date", "linked_record": true}, {"timestamp": "2026-05-15T14:53:57.263Z", "date_only": false, "value": "2026-05-15T14:53:57.263000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.13.release_date", "linked_record": true}, {"timestamp": "2026-05-15T16:00:55.786Z", "date_only": false, "value": "2026-05-15T16:00:55.786944+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.37.discovery_date", "linked_record": true}, {"timestamp": "2026-05-15T16:00:55.786Z", "date_only": false, "value": "2026-05-15T16:00:55.786944+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.13.discovery_date", "linked_record": true}, {"timestamp": "2026-05-21T18:25:56Z", "date_only": false, "value": "2026-05-21T18:25:56Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-W5HQ-G745-H8PQ", "record": "GHSA-W5HQ-G745-H8PQ", "field": "modified", "linked_record": true}, {"timestamp": "2026-05-22T15:01:21.462Z", "date_only": false, "value": "2026-05-22T15:01:21.462000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.30.release_date", "linked_record": true}, {"timestamp": "2026-05-22T16:00:52.844Z", "date_only": false, "value": "2026-05-22T16:00:52.844126+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.30.discovery_date", "linked_record": true}, {"timestamp": "2026-05-24T05:30:09.671Z", "date_only": false, "value": "2026-05-24T05:30:09.671000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.12.release_date", "linked_record": true}, {"timestamp": "2026-05-24T05:30:09.671Z", "date_only": false, "value": "2026-05-24T05:30:09.671000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.2.release_date", "linked_record": true}, {"timestamp": "2026-05-24T07:00:47.549Z", "date_only": false, "value": "2026-05-24T07:00:47.549016+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.12.discovery_date", "linked_record": true}, {"timestamp": "2026-05-24T07:00:47.549Z", "date_only": false, "value": "2026-05-24T07:00:47.549016+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.2.discovery_date", "linked_record": true}, {"timestamp": "2026-05-28T12:01:20.306Z", "date_only": false, "value": "2026-05-28T12:01:20.306283Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mmvxybrjfa2y", "record": "CVE-2026-41907", "field": "creation_timestamp", "uuid": "d1d155b4-58ef-4d3c-826f-aa8d64290500", "content": "\n\ud83d\udea8 New MEDIUM CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-41907 impacts uuid in 3 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/541\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "url": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mmvxybrjfa2y"}, {"timestamp": "2026-05-29T19:55:07.337Z", "date_only": false, "value": "2026-05-29T19:55:07.337000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.12.release_date", "linked_record": true}, {"timestamp": "2026-05-29T21:02:00.092Z", "date_only": false, "value": "2026-05-29T21:02:00.092772+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.12.discovery_date", "linked_record": true}, {"timestamp": "2026-06-02T17:55:09.919Z", "date_only": false, "value": "2026-06-02T17:55:09.919000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.31.release_date", "linked_record": true}, {"timestamp": "2026-06-02T17:55:09.919Z", "date_only": false, "value": "2026-06-02T17:55:09.919000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.6.release_date", "linked_record": true}, {"timestamp": "2026-06-02T18:23:02.765Z", "date_only": false, "value": "2026-06-02T18:23:02.765000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.35.release_date", "linked_record": true}, {"timestamp": "2026-06-02T20:01:56.630Z", "date_only": false, "value": "2026-06-02T20:01:56.630167+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.31.discovery_date", "linked_record": true}, {"timestamp": "2026-06-02T20:01:56.630Z", "date_only": false, "value": "2026-06-02T20:01:56.630167+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.6.discovery_date", "linked_record": true}, {"timestamp": "2026-06-02T20:02:09.305Z", "date_only": false, "value": "2026-06-02T20:02:09.305521+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.35.discovery_date", "linked_record": true}, {"timestamp": "2026-06-05T22:06:07.082Z", "date_only": false, "value": "2026-06-05T22:06:07.082000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.36.release_date", "linked_record": true}, {"timestamp": "2026-06-05T23:01:44.292Z", "date_only": false, "value": "2026-06-05T23:01:44.292958+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.36.discovery_date", "linked_record": true}, {"timestamp": "2026-06-12T00:00:00Z", "date_only": true, "value": "2026-06-12", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0788", "record": "CERTFR-2026-AVI-0788", "field": "vendor_advisories.14.published_at", "linked_record": true}, {"timestamp": "2026-06-12T18:01:30.362Z", "date_only": false, "value": "2026-06-12T18:01:30.362000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.16.release_date", "linked_record": true}, {"timestamp": "2026-06-12T19:00:57.360Z", "date_only": false, "value": "2026-06-12T19:00:57.360953+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.16.discovery_date", "linked_record": true}, {"timestamp": "2026-06-15T00:00:00Z", "date_only": true, "value": "2026-06-15", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0788", "record": "CERTFR-2026-AVI-0788", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-06-16T00:00:00Z", "date_only": true, "value": "2026-06-16", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0788", "record": "CERTFR-2026-AVI-0788", "field": "vendor_advisories.5.published_at", "linked_record": true}, {"timestamp": "2026-06-16T21:26:22.537Z", "date_only": false, "value": "2026-06-16T21:26:22.537000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.38.release_date", "linked_record": true}, {"timestamp": "2026-06-16T22:01:24.571Z", "date_only": false, "value": "2026-06-16T22:01:24.571224+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.38.discovery_date", "linked_record": true}, {"timestamp": "2026-06-17T00:00:00Z", "date_only": true, "value": "2026-06-17", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0788", "record": "CERTFR-2026-AVI-0788", "field": "vendor_advisories.1.published_at", "linked_record": true}, {"timestamp": "2026-06-17T16:05:38.785Z", "date_only": false, "value": "2026-06-17T16:05:38.785000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.17.release_date", "linked_record": true}, {"timestamp": "2026-06-17T16:36:55.439Z", "date_only": false, "value": "2026-06-17T16:36:55.439000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.11.release_date", "linked_record": true}, {"timestamp": "2026-06-17T16:46:42.706Z", "date_only": false, "value": "2026-06-17T16:46:42.706000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.14.release_date", "linked_record": true}, {"timestamp": "2026-06-17T16:56:18.579Z", "date_only": false, "value": "2026-06-17T16:56:18.579000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.13.release_date", "linked_record": true}, {"timestamp": "2026-06-17T17:01:45.297Z", "date_only": false, "value": "2026-06-17T17:01:45.297604+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.17.discovery_date", "linked_record": true}, {"timestamp": "2026-06-17T17:14:50.991Z", "date_only": false, "value": "2026-06-17T17:14:50.991000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.10.release_date", "linked_record": true}, {"timestamp": "2026-06-17T17:31:03.163Z", "date_only": false, "value": "2026-06-17T17:31:03.163000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.15.release_date", "linked_record": true}, {"timestamp": "2026-06-17T19:02:16.713Z", "date_only": false, "value": "2026-06-17T19:02:16.713859+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.10.discovery_date", "linked_record": true}, {"timestamp": "2026-06-17T19:02:29.292Z", "date_only": false, "value": "2026-06-17T19:02:29.292011+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.15.discovery_date", "linked_record": true}, {"timestamp": "2026-06-17T19:03:30.813Z", "date_only": false, "value": "2026-06-17T19:03:30.813843+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.14.discovery_date", "linked_record": true}, {"timestamp": "2026-06-17T19:03:52.323Z", "date_only": false, "value": "2026-06-17T19:03:52.323822+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.13.discovery_date", "linked_record": true}, {"timestamp": "2026-06-17T19:04:00.272Z", "date_only": false, "value": "2026-06-17T19:04:00.272340+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.11.discovery_date", "linked_record": true}, {"timestamp": "2026-06-18T00:00:00Z", "date_only": true, "value": "2026-06-18", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0788", "record": "CERTFR-2026-AVI-0788", "field": "vendor_advisories.19.published_at", "linked_record": true}, {"timestamp": "2026-06-19T00:00:00Z", "date_only": false, "value": "2026-06-19T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0788", "record": "CERTFR-2026-AVI-0788", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-06-19T00:00:00Z", "date_only": false, "value": "2026-06-19T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0788", "record": "CERTFR-2026-AVI-0788", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-06-19T00:00:00Z", "date_only": false, "value": "2026-06-19T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0788", "record": "CERTFR-2026-AVI-0788", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-06-22T14:59:14.906Z", "date_only": false, "value": "2026-06-22T14:59:14.906000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.40.release_date", "linked_record": true}, {"timestamp": "2026-06-22T16:01:01.300Z", "date_only": false, "value": "2026-06-22T16:01:01.300830+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.40.discovery_date", "linked_record": true}, {"timestamp": "2026-06-29T13:22:44.674Z", "date_only": false, "value": "2026-06-29T13:22:44.674000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.19.release_date", "linked_record": true}, {"timestamp": "2026-06-29T14:01:55.592Z", "date_only": false, "value": "2026-06-29T14:01:55.592330+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.19.discovery_date", "linked_record": true}, {"timestamp": "2026-06-30T08:30:34.502Z", "date_only": false, "value": "2026-06-30T08:30:34.502000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.18.release_date", "linked_record": true}, {"timestamp": "2026-06-30T10:00:59.843Z", "date_only": false, "value": "2026-06-30T10:00:59.843854+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.18.discovery_date", "linked_record": true}, {"timestamp": "2026-07-08T15:15:54.675Z", "date_only": false, "value": "2026-07-08T15:15:54.675000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.41.release_date", "linked_record": true}, {"timestamp": "2026-07-08T16:01:38.408Z", "date_only": false, "value": "2026-07-08T16:01:38.408322+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.41.discovery_date", "linked_record": true}, {"timestamp": "2026-07-10T00:00:00Z", "date_only": true, "value": "2026-07-10", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0901", "record": "CERTFR-2026-AVI-0901", "field": "vendor_advisories.2.published_at", "linked_record": true}, {"timestamp": "2026-07-13T00:00:00Z", "date_only": true, "value": "2026-07-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0901", "record": "CERTFR-2026-AVI-0901", "field": "vendor_advisories.6.published_at", "linked_record": true}, {"timestamp": "2026-07-14T00:00:00Z", "date_only": true, "value": "2026-07-14", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0901", "record": "CERTFR-2026-AVI-0901", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-07-14T20:03:56.430Z", "date_only": false, "value": "2026-07-14T20:03:56.430000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.39.release_date", "linked_record": true}, {"timestamp": "2026-07-14T21:02:55.149Z", "date_only": false, "value": "2026-07-14T21:02:55.149976+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.39.discovery_date", "linked_record": true}, {"timestamp": "2026-07-15T00:00:00Z", "date_only": true, "value": "2026-07-15", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0901", "record": "CERTFR-2026-AVI-0901", "field": "vendor_advisories.3.published_at", "linked_record": true}, {"timestamp": "2026-07-17T00:00:00Z", "date_only": false, "value": "2026-07-17T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0901", "record": "CERTFR-2026-AVI-0901", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-07-17T00:00:00Z", "date_only": false, "value": "2026-07-17T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0901", "record": "CERTFR-2026-AVI-0901", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-07-17T00:00:00Z", "date_only": false, "value": "2026-07-17T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0901", "record": "CERTFR-2026-AVI-0901", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-07-23T00:00:00Z", "date_only": true, "value": "2026-07-23", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0958", "record": "CERTFR-2026-AVI-0958", "field": "vendor_advisories.27.published_at", "linked_record": true}, {"timestamp": "2026-07-24T00:00:00Z", "date_only": true, "value": "2026-07-24", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0958", "record": "CERTFR-2026-AVI-0958", "field": "vendor_advisories.5.published_at", "linked_record": true}, {"timestamp": "2026-07-27T00:00:00Z", "date_only": true, "value": "2026-07-27", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0958", "record": "CERTFR-2026-AVI-0958", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-07-28T00:00:00Z", "date_only": true, "value": "2026-07-28", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0958", "record": "CERTFR-2026-AVI-0958", "field": "vendor_advisories.1.published_at", "linked_record": true}, {"timestamp": "2026-07-29T00:00:00Z", "date_only": true, "value": "2026-07-29", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0958", "record": "CERTFR-2026-AVI-0958", "field": "vendor_advisories.7.published_at", "linked_record": true}, {"timestamp": "2026-07-30T00:00:00Z", "date_only": true, "value": "2026-07-30", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0958", "record": "CERTFR-2026-AVI-0958", "field": "vendor_advisories.2.published_at", "linked_record": true}, {"timestamp": "2026-07-30T07:10:53Z", "date_only": false, "value": "2026-07-30T07:10:53Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-RZ36238", "record": "CLEANSTART-2026-RZ36238", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-07-31T00:00:00Z", "date_only": false, "value": "2026-07-31T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0958", "record": "CERTFR-2026-AVI-0958", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-07-31T00:00:00Z", "date_only": false, "value": "2026-07-31T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0958", "record": "CERTFR-2026-AVI-0958", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-07-31T00:00:00Z", "date_only": false, "value": "2026-07-31T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0958", "record": "CERTFR-2026-AVI-0958", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-08-06T18:16:13.295Z", "date_only": false, "value": "2026-08-06T18:16:13.295301Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pierbover.com/post/3msgnkyrjjc2q", "record": "CVE-2026-41907", "field": "creation_timestamp", "uuid": "46362ffc-4358-4a2b-8664-3e4f808b8863", "content": "You would think Google having the best engineers and unlimited AI usage would be on top of things...\n\nAnd yet the Google Cloud Storage client has had a vulnerability since April when CVE-2026-41907 was reported.\n\ngithub.com/advisories/G...\n\nnpmx.dev/package/@goo...", "url": "https://bsky.app/profile/pierbover.com/post/3msgnkyrjjc2q"}, {"timestamp": "2026-08-13T12:10:09Z", "date_only": false, "value": "2026-08-13T12:10:09Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-AG43501", "record": "CLEANSTART-2026-AG43501", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-13T12:10:09Z", "date_only": false, "value": "2026-08-13T12:10:09Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-RO58683", "record": "CLEANSTART-2026-RO58683", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-13T12:10:09Z", "date_only": false, "value": "2026-08-13T12:10:09Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-VJ19248", "record": "CLEANSTART-2026-VJ19248", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-14T12:25:42Z", "date_only": false, "value": "2026-08-14T12:25:42Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-QS50818", "record": "CLEANSTART-2026-QS50818", "field": "modified", "linked_record": true}, {"timestamp": "2026-08-18T18:22:46Z", "date_only": false, "value": "2026-08-18T18:22:46+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-08-18T18:22:46Z", "date_only": false, "value": "2026-08-18T18:22:46+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-18T18:22:46Z", "date_only": false, "value": "2026-08-18T18:22:46+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.34.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-18T22:00:00Z", "date_only": false, "value": "2026-08-18T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2923", "record": "WID-SEC-W-2026-2923", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-08-18T22:00:00Z", "date_only": false, "value": "2026-08-18T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2923", "record": "WID-SEC-W-2026-2923", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-18T22:00:00Z", "date_only": false, "value": "2026-08-18T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2923", "record": "WID-SEC-W-2026-2923", "field": "vulnerabilities.43.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-19T10:53:50Z", "date_only": false, "value": "2026-08-19T10:53:50+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-08-19T10:53:50Z", "date_only": false, "value": "2026-08-19T10:53:50+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-19T10:53:50Z", "date_only": false, "value": "2026-08-19T10:53:50+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "vulnerabilities.9.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-24T09:52:27.784Z", "date_only": false, "value": "2026-08-24T09:52:27.784044Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0325", "record": "NCSC-2026-0325", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-08-24T09:52:27.784Z", "date_only": false, "value": "2026-08-24T09:52:27.784044Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0325", "record": "NCSC-2026-0325", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-24T09:52:27.784Z", "date_only": false, "value": "2026-08-24T09:52:27.784044Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0325", "record": "NCSC-2026-0325", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-08-31T22:00:00Z", "date_only": false, "value": "2026-08-31T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2923", "record": "WID-SEC-W-2026-2923", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-09-01T22:00:00Z", "date_only": false, "value": "2026-09-01T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2923", "record": "WID-SEC-W-2026-2923", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-09-03T22:00:00Z", "date_only": false, "value": "2026-09-03T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2923", "record": "WID-SEC-W-2026-2923", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-09-04T00:36:24Z", "date_only": false, "value": "2026-09-04T00:36:24+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-09-04T00:36:24Z", "date_only": false, "value": "2026-09-04T00:36:24+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-09-08T02:07:51.017Z", "date_only": false, "value": "2026-09-08T02:07:51.017566Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-XP70950", "record": "CLEANSTART-2026-XP70950", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-11T00:00:00Z", "date_only": true, "value": "2026-09-11", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1206", "record": "CERTFR-2026-AVI-1206", "field": "vendor_advisories.14.published_at", "linked_record": true}, {"timestamp": "2026-09-14T00:00:00Z", "date_only": true, "value": "2026-09-14", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1206", "record": "CERTFR-2026-AVI-1206", "field": "vendor_advisories.9.published_at", "linked_record": true}, {"timestamp": "2026-09-15T00:00:00Z", "date_only": true, "value": "2026-09-15", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1206", "record": "CERTFR-2026-AVI-1206", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-09-16T00:00:00Z", "date_only": true, "value": "2026-09-16", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1206", "record": "CERTFR-2026-AVI-1206", "field": "vendor_advisories.7.published_at", "linked_record": true}, {"timestamp": "2026-09-16T22:00:00Z", "date_only": false, "value": "2026-09-16T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2923", "record": "WID-SEC-W-2026-2923", "field": "document.tracking.revision_history.4.date", "linked_record": true}, {"timestamp": "2026-09-17T00:00:00Z", "date_only": true, "value": "2026-09-17", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1206", "record": "CERTFR-2026-AVI-1206", "field": "vendor_advisories.1.published_at", "linked_record": true}, {"timestamp": "2026-09-17T22:00:00Z", "date_only": false, "value": "2026-09-17T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2923", "record": "WID-SEC-W-2026-2923", "field": "document.tracking.revision_history.5.date", "linked_record": true}, {"timestamp": "2026-09-18T00:00:00Z", "date_only": false, "value": "2026-09-18T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1206", "record": "CERTFR-2026-AVI-1206", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-09-18T00:00:00Z", "date_only": false, "value": "2026-09-18T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1206", "record": "CERTFR-2026-AVI-1206", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-18T00:00:00Z", "date_only": false, "value": "2026-09-18T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1206", "record": "CERTFR-2026-AVI-1206", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-09-18T09:58:54.724Z", "date_only": false, "value": "2026-09-18T09:58:54.724605Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-SX19522", "record": "CLEANSTART-2026-SX19522", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-AG43501", "record": "CLEANSTART-2026-AG43501", "field": "modified", "linked_record": true}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-RO58683", "record": "CLEANSTART-2026-RO58683", "field": "modified", "linked_record": true}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-RZ36238", "record": "CLEANSTART-2026-RZ36238", "field": "modified", "linked_record": true}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-VJ19248", "record": "CLEANSTART-2026-VJ19248", "field": "modified", "linked_record": true}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-XP70950", "record": "CLEANSTART-2026-XP70950", "field": "modified", "linked_record": true}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-AG43501", "record": "CLEANSTART-2026-AG43501", "field": "withdrawn", "linked_record": true}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-RO58683", "record": "CLEANSTART-2026-RO58683", "field": "withdrawn", "linked_record": true}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-RZ36238", "record": "CLEANSTART-2026-RZ36238", "field": "withdrawn", "linked_record": true}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-VJ19248", "record": "CLEANSTART-2026-VJ19248", "field": "withdrawn", "linked_record": true}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-XP70950", "record": "CLEANSTART-2026-XP70950", "field": "withdrawn", "linked_record": true}, {"timestamp": "2026-09-21T22:00:00Z", "date_only": false, "value": "2026-09-21T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2923", "record": "WID-SEC-W-2026-2923", "field": "document.tracking.revision_history.6.date", "linked_record": true}, {"timestamp": "2026-09-22T22:00:00Z", "date_only": false, "value": "2026-09-22T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2923", "record": "WID-SEC-W-2026-2923", "field": "document.tracking.revision_history.7.date", "linked_record": true}, {"timestamp": "2026-09-23T22:00:00Z", "date_only": false, "value": "2026-09-23T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2923", "record": "WID-SEC-W-2026-2923", "field": "document.tracking.revision_history.8.date", "linked_record": true}, {"timestamp": "2026-09-24T22:00:00Z", "date_only": false, "value": "2026-09-24T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2923", "record": "WID-SEC-W-2026-2923", "field": "document.tracking.revision_history.9.date", "linked_record": true}, {"timestamp": "2026-09-25T00:00:00Z", "date_only": true, "value": "2026-09-25", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1256", "record": "CERTFR-2026-AVI-1256", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-09-28T00:00:00Z", "date_only": true, "value": "2026-09-28", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1256", "record": "CERTFR-2026-AVI-1256", "field": "vendor_advisories.1.published_at", "linked_record": true}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": true, "value": "2026-09-30", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1256", "record": "CERTFR-2026-AVI-1256", "field": "vendor_advisories.3.published_at", "linked_record": true}, {"timestamp": "2026-10-01T22:00:00Z", "date_only": false, "value": "2026-10-01T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2923", "record": "WID-SEC-W-2026-2923", "field": "document.tracking.revision_history.10.date", "linked_record": true}, {"timestamp": "2026-10-02T00:00:00Z", "date_only": false, "value": "2026-10-02T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1256", "record": "CERTFR-2026-AVI-1256", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-10-02T00:00:00Z", "date_only": false, "value": "2026-10-02T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1256", "record": "CERTFR-2026-AVI-1256", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-02T00:00:00Z", "date_only": false, "value": "2026-10-02T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1256", "record": "CERTFR-2026-AVI-1256", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-10-04T22:00:00Z", "date_only": false, "value": "2026-10-04T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2923", "record": "WID-SEC-W-2026-2923", "field": "document.tracking.revision_history.11.date", "linked_record": true}, {"timestamp": "2026-10-08T00:43:41.290Z", "date_only": false, "value": "2026-10-08T00:43:41.290183Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-ZG01610", "record": "CLEANSTART-2026-ZG01610", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-08T14:26:21Z", "date_only": false, "value": "2026-10-08T14:26:21Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-ZG01610", "record": "CLEANSTART-2026-ZG01610", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-09T05:45:08Z", "date_only": false, "value": "2026-10-09T05:45:08Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-SX19522", "record": "CLEANSTART-2026-SX19522", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-09T07:34:48Z", "date_only": false, "value": "2026-10-09T07:34:48Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-RZ17218", "record": "CLEANSTART-2026-RZ17218", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-12T22:00:00Z", "date_only": false, "value": "2026-10-12T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2923", "record": "WID-SEC-W-2026-2923", "field": "document.tracking.revision_history.12.date", "linked_record": true}, {"timestamp": "2026-10-15T22:00:00Z", "date_only": false, "value": "2026-10-15T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2923", "record": "WID-SEC-W-2026-2923", "field": "document.tracking.revision_history.13.date", "linked_record": true}, {"timestamp": "2026-10-17T09:40:58Z", "date_only": false, "value": "2026-10-17T09:40:58Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-41907", "record": "UBUNTU-CVE-2026-41907", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-19T12:54:26Z", "date_only": false, "value": "2026-10-19T12:54:26Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-FA47344", "record": "CLEANSTART-2026-FA47344", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-20T00:43:15.715Z", "date_only": false, "value": "2026-10-20T00:43:15.715519Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-FA47344", "record": "CLEANSTART-2026-FA47344", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-26T18:43:07Z", "date_only": false, "value": "2026-10-26T18:43:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/Kevinjohn/9c7367be1c8231f260ed1e3c3136535c", "record": "CVE-2026-41907", "field": "creation_timestamp", "uuid": "74019e84-c609-494e-b484-b98f50395f0e", "content": "# Review 2 \u2014 Existing ecosystem adoption\n\n**Evidence date:** 2026-10-26  \n**Frozen source:** `6c92d3710ed1d30bc925bd97e5d701ea551db452`  \n**Scope:** runtime, frontend, shared domain, tests, development tooling, packaging and documentation/tooling support.  \n**Disposition:** read-only ecosystem review. No source, dependency, lockfile, package, fork, or public repository was changed.\n\n## Conclusion\n\nThe installed Adonis 7 / Lucid stack and the frontend toolchain already cover most generic framework responsibilities. The strongest current choices are Adonis Core, Lucid, Vine, Bouncer, Tuyau, Limiter, Auth/Session/Mail, TanStack Query for ordinary server reads, Zustand for the revision-aware planning client, date-fns, Paraglide, Vitest, Playwright, and the existing workspace scripts. Their adapters preserve product requirements that generic packages do not own: company membership authorization, confidential projections, atomic proof/audit/revision writes, one-connection SQLite transactions, date-only schedule semantics, explicit error contracts, and accessible scheduler behavior.\n\nNo adoption is recommended as a direct replacement for an authoritative product path. Five conditional opportunities merit follow-up: narrow Vine alignment for auth/admission requests (#1595), a source-scale TanStack Virtual maintenance comparison, one complex-form trial using React Hook Form or TanStack Form, a distinct non-authoritative activity-feed trial, and a post-publication compatibility trial for the existing Masquerade extraction. FullCalendar v7 is a real resource-scheduler candidate but requires a license eligibility decision and deep product/accessibility parity work. These are opportunity assessments, not defect severities or effort-ranked tasks.\n\nThe older-package review finds useful upgrade/fork opportunities. Age or missing Adonis 7 support alone is not grounds for rejection: the current owner continuations of soft-delete and Masquerade are inspected as substantive candidates, subject to their exact release, transaction and semantics gaps. No package was installed or executed during this review.\n\n## Evidence and limits\n\nThe report integrates the backend/runtime review, frontend/tooling review, shared foundation inventory, registry/source evidence, extraction discovery, and the passive package-advisory tail. The canonical issue and its public review index are tracked at [#1604](https://github.com/Kevinjohn/capacitylens/issues/1604). The dependency inventory covers 97 direct dependencies across four workspaces and 1,173 lockfile package records / 751 snapshots; those are pinned resolver facts, not semantic validation.\n\nAll package/version observations below are frozen lockfile or dated registry facts, not claims about what is latest. Published artifact details and upstream source references are cited directly where relevant. Package source tests were inspected where stated but not run. The Account Kit archive is the exception to an early foundation note: the exact local tarball includes MIT `LICENSE.md`, hashes to `18696d27971605dbbada54ccb9066260499fc9ab3f258cd7684ed6098dacf573`, matching the public [v0.1.2 release asset](https://github.com/Kevinjohn/oss-adonisjs-account-kit/releases/tag/v0.1.2), whose tag resolves to [`fc8bea27424a3c7ad8852c61e14feaaf7710046a`](https://github.com/Kevinjohn/oss-adonisjs-account-kit/tree/fc8bea27424a3c7ad8852c61e14feaaf7710046a). This is a GitHub release asset, not an npm publication.\n\nThe dependency inventory records manifest specifier, lockfile specifier, exact resolved version, source kind, and import evidence separately; do not infer a declared range from the resolved version in the capability table. For serious downloaded runtime candidates, companion evidence records registry tarball integrity, upstream `gitHead`/tag matching where available, packaged license and test-file presence, release/maintenance evidence, and observed direct dependencies. Advisory coverage is bounded to the exact versions and declared dependency edges listed below; it is not an exhaustive graph scan or security clearance. Recheck advisories, the resolved dependency graph and license compatibility before implementation or adoption. Where package families have different peer, release, license or test status, they are explicitly distinguished below rather than treated as one lineage.\n\nThis ecosystem review used source reading, pinned artifact/registry inspection and passive exact-version advisory queries. No application or candidate package suite, live-provider check, release-to-release upgrade rehearsal, deployment, or Docker activity was performed. The separate #1600 scratch reproduction is described below. Absence from a scoped search is not proof that no package exists. There was no maintainer contact, fork, package publication, or installation into the frozen source.\n\n## Capability and candidate matrix\n\nThe table distinguishes (1) platform capability, (2) installed owner and exact frozen version, and (3) official/community alternatives researched. \u201cRemoved\u201d is the code/responsibility a hypothetical adoption could actually eliminate; retained adapters and policy are called out. An empty candidate field means the review found no evidence-backed replacement in the searched scope, not that the entire ecosystem was exhaustively ruled out.\n\n| Area | Current responsibility and installed version | Official capability / community candidates | Recommendation; actually removable work and retained boundary |\n|---|---|---|---|\n| Runtime, boot, DI, providers | Adonis Core `7.5.2`; providers, configuration, lifecycle and framework service resolution. | Core 7 lifecycle/providers; no credible community replacement identified. Official queue/scheduler docs were reviewed, but documented scheduler/queue features require Core `7.6+`, above this frozen Core `7.5.2`. | **Retain.** No runtime scaffolding is shown to be removable. Keep product providers and explicit backup start/stop lifecycle. |\n| Environment/config | Core environment schema and app `config/*` adapters. | Adonis typed environment/config APIs; no replacement candidate. | **Retain.** Config schema is already an explicit framework boundary; domain policy remains app-owned. |\n| Routes and generated client | Tuyau Core `1.2.2`; generated route registry and typed client; frontend React Query integration `1.1.0`. | Official Adonis/Tuyau docs and source. #1593 is merged; #1595/#1596 retain remaining contract work. | **Retain.** Do not add a second route schema. #1595 can narrow handwritten request guards; preserve status 400, product codes, headers and generated-contract behavior. |\n| Validation | Vine `4.4.0`; shared domain parsers; several hand-written auth/admission body/query checks. | Official Vine schema/type support. | **Selective alignment through #1595.** Could remove duplicated shape checks on a few request paths. Keep closed-body checks and domain parsing where they encode product semantics; preserve the current error contract. |\n| Errors and HTTP contract | Adonis exception handler with product mapping; local transfer failure mapper. | Core exception handling; no useful drop-in package for account-kit/domain/privacy mapping. #1596 is the canonical contract issue. | **Retain adapter.** No safe generic replacement. Keep flat product errors, status 400, headers and sanitized diagnostics. |\n| Health/readiness | Core `HealthChecks` + Lucid `DbCheck`; app readiness also calls `checkDatabase()` and schema integrity. | Official Core health system. | **Retain platform; simplify duplicate probe under #1598.** The removable work is one duplicate DB/schema path; do not add a health package. |\n| Logging | Adonis Logger `7.1.1` / Pino; `logging_safety` and sanitized request/error diagnostics. | Official logger; generic observability packages are additive and no provider is selected. | **Retain.** Library does not remove privacy and redaction rules. Existing tests cover redaction; not rerun here. |\n| Rate limiting | `@adonisjs/limiter` `3.0.1`, SQLite store, API/auth budgets. | Official Limiter package. | **Retain.** Product request budgets remain app policy. Redis/external store is outside the one-process SQLite architecture. |\n| Auth, accounts, invitations, session, mail | Account Kit `0.1.2` vendored; Auth `10.1.0`, Session `8.1.0`, Mail `10.4.0`; Bouncer `4.0.1`. | Official Auth is a guard/session substrate; its documented scope does not cover full account registration, verification, recovery, invitation/admission lifecycle. Account Kit source/release and MIT archive license inspected. | **Retain Account Kit and adapters.** Replacing it with Auth would put registration, recovery, invitations and admission back in app code. CapacityLens retains company memberships, roles, resource links, Bouncer policy, UI and company wording. |\n| Transactions, ORM and migrations | Lucid `22.4.2`; better-sqlite3 `13.0.3`; pool max/min 1; explicit transaction handles and Lucid migration baseline. | Official Lucid transactions/configuration. Audit and tested sources confirm caller-owned transaction propagation. | **Retain.** No replacement justifies changing the one-connection, single-file SQLite boundary, atomic audit/revision, or migration ownership. |\n| Audit | Explicit `writeAudit(trx, metadata)` with selected changed-field/cascade metadata; many planning, admission, membership, import, privacy and masquerade callers. | Community `@holoyan/adonisjs-activitylog` 1.x; `adonis-auditing@2.0.0`; `@adogrove/adonis-auditing@2.1.1`. | **Retain authoritative audit.** At most trial a package for a distinct activity feed. No package can replace caller-selected safe fields, product audit schema, caller transaction, tenant policy or revision behavior without adaptation. Adogrove\u2019s AGPL artifact declares older peer metadata (Core 6/Lucid 20/21) despite newer source/dev testing; not a current drop-in. |\n| Backup and retention | Native SQLite online backup; private temp, ownership/mode, integrity/schema checks, fsync and atomic publication, count retention. | Searches covered framework- and DB-level backup/archive candidates; none evidenced the complete single-file verified/private boundary. | **Retain.** A generic file helper would not remove path privacy, atomic publication, schema integrity, durability, retention and operator semantics. No general backup package recommendation. |\n| Import/export/transfer | Shared versioned CapacityLens document; role-projected export; proof-bound atomic transfer apply and audit/revision behavior. | No generic JSON/CSV package addresses this contract; account kit/action proof overlap tracked #1597. | **Retain shared format and product service.** Package adoption must not alter identity omission, authorization projection, proof consumption, atomicity or no-op/revision semantics. |\n| Periodic backup scheduling | Immediate startup backup + 24-hour interval, overlap coalescing, awaited drain on shutdown. | `adonisjs-scheduler@2.8.0`; `@outloud/adonis-scheduler@2.0.0`; older `adonis5-scheduler@2.1.1` and `adonis-scheduler@3.0.2`. Official Core queues/scheduler docs require Core 7.6+. | **Retain interval.** Current code is simpler for one recurring job. No work removed by a scheduler package yet; evaluate again only if actual recurring job requirements grow. Older scheduler packages are upgrade leads only if needs change. |\n| Soft delete and lifecycle | Product archive/restore for catalogue/resources; controlled hard-delete tombstones in planning. No generic `deleted_at` lifecycle. | Published `@ajzinkyaw/adonis-lucid-soft-deletes@2.1.0` MIT; existing owner continuation `@kevinjohn/lucid-soft-deletes@3.0.0-alpha.1` in GitHub source, not published; see older package section. | **Reject for current lifecycle; retain as future upgrade opportunity.** No current responsibility should be removed because product lifecycle is not soft delete. If an authorized need emerges, inspect owner continuation first. |\n| Masquerade | Product session/company/actor/target record, role rechecks, confidential read projection, hard write denial, product audit/revision. | Existing owner extraction `oss-adonisjs-masquerade`, MIT, Core 7/Auth 10/Lucid 22 integration and conformance tests in source; unpublished. | **Trial/extend after release and boundary decision.** It may replace state protocol, guards and persistence adapter; it cannot replace company authorization, target projection, route coverage, product audit/revision, UI, or transaction needs. Do not dismiss due to absent published release alone. |\n| Query/cache and planning state | TanStack Query `5.104.2`; Zustand `5.0.15`; Tuyau Query `1.1.0`. Query used for account/admin reads; Zustand for planning commands/cache/history. | Official TanStack Query retry/cache API; Zustand vanilla/slice and optional persist middleware. | **Retain split ownership.** A broad rewrite could remove some adapters but adds unproven replay/revision/history risks. Retain explicit retry `0`, typed fetch adapter, uncached planning authority and scoped cache clearing. A future trial must model 409, ambiguous commit, lookup, replay prevention, account switch and undo/redo. |\n| Routing | React Router DOM `7.18.4`, client data router, lazy chunks and static SPA served by Adonis. | Official React Router framework/data-loader mode. | **Retain; wait on migration.** No concrete missing capability identified. Framework-mode server loading does not directly replace current static SPA, central planning snapshot or authorization timing. Keep exact recovery/bearer routes, permission gates and not-found behavior. |\n| Dates, localization and recurrence | date-fns `4.3.0`; Paraglide `2.25.4`; Intl; bounded shared ISO-date/repeat utilities. `rrule` appears in lock graph but no direct import. | Official date-fns v4 and Paraglide capabilities; `@date-fns/tz` and recurrence frameworks considered. | **Retain.** No recurrence package needed for finite bounded independent batches. Do not introduce timezone-bearing Date objects into date-only schedule geometry. Preserve leap/month-end/four-digit range and no UTC-slice semantics. |\n| Scheduler grid / virtualization | Custom row-height/prefix-sum virtual window and viewport geometry; Radix `1.6.7`; tested drag-source pinning and keyboard behavior. | TanStack Virtual `3.14.23` / virtual-core `3.19.8` MIT; FullCalendar v7 `@fullcalendar/react-scheduler` + `fullcalendar-scheduler` `7.1.3` tri-licensed; React Big Calendar `1.20.0` MIT. | **Trial TanStack Virtual for maintenance comparison**, independent of any performance defect; keep current implementation pending same-contract evidence. **Conditional FullCalendar v7 trial** only after license eligibility and complete behavior/accessibility parity. **Wait** on React Big Calendar absent resource-by-week fit. Preserve custom schedule policy, geometry, access and command semantics. |\n| Drag and drop | Product-owned scheduler geometry, pointer/keyboard interaction, move/resize/reassignment policy and accessibility. | dnd-kit modular current line `@dnd-kit/react` `0.5.1` MIT; legacy `@dnd-kit/core` `6.3.1` is a distinct API line. | **Retain policy; optional sensor-only trial.** A sensor may replace low-level event plumbing only if it leaves geometry, keyboard focus, row pinning, authorization and server command policy intact. No compatibility/parity trial was run. |\n| Forms | Controlled allocation form with interdependent dates/hours/status/note/task, errors, dirty/reset/focus behavior. No direct form-state/schema package. | React Hook Form `7.91.0`; TanStack Form `1.33.5`. | **One complex-form trial.** Compare actual code/responsibility removed, not package popularity. Preserve shared calculations, server validation/error ownership, payload contract, dirty/reset, async and focus behavior. No second consumer is not an automatic rejection. |\n| UI primitives | Source-owned shadcn-style primitives on Radix; Tailwind CSS `4.3.3`, C/V/A `0.7.1`, Lucide `1.31.0`; local deviations documented. | Radix and installed libraries; upstream shadcn registry is not a package adoption path for local primitives. | **Retain source-owned primitives.** No wholesale re-pull. A component update must preserve local behavior and adjacent rationale; no package adoption removes product-specific tokens/accessibility choices. |\n| Shared domain / wire contracts | `@capacitylens/shared` workspace code: pure schedule/date/lifecycle/tenancy/wire rules plus tests. | No evidence-backed external domain package; core rules are product-specific. | **Retain.** No current independent consumer supports a separate package; do not generalize scheduling, planning revision, restoration or confidentiality. |\n| Unit/component testing | Vitest `4.1.11`, Testing Library React `16.3.3`, user-event `14.6.7`, coverage-v8 `4.1.11`; Japa covers backend separately. | Official Vitest/Testing Library and Japa integrations. | **Retain.** Existing boundary fits Vite frontend/shared tests. The #1600 discovery failure is handled below; it does not justify replacing the test runner. Suites were not run in this review. |\n| Browser E2E/accessibility | Playwright `1.63.0`, axe Playwright `4.13.0`; isolated port lanes, DB/auth fixture policy, Chromium default and optional WebKit/Firefox. | Official Playwright browser projects and axe integration. | **Retain.** No Cypress/WebDriver replacement identified that removes current lane, DB and auth behavior. Existing config/test coverage is source evidence, not a passing test result. |\n| Mutation testing | Stryker `9.6.1`, Vitest runner `9.6.1`, Vitest `4.1.11`. | Official Stryker docs describe `vitest.related:false`; scratch attempts and runner source inspected. | **Retain while fixing discovery investigation.** Exact #1600 reproduction confirmed `No tests were executed`; `related:false` and adding frontend `dir` did not fix it. Direct Vitest listing from frontend workspace found 3,944 test rows. Root/cwd/config interaction is the likely boundary but no accepted fix or upstream defect is established. |\n| Workspace, build, release, process lanes | Turbo `2.11.3`; Vite `8.3.1`; TypeScript `6.0.2`; ESLint `10.8.1`; Prettier `3.9.9`; pnpm `11.4.0`; repository scripts implement lane locks, process cleanup, package and deploy workflow. | General task runners/process helpers/release tooling considered; no evidence that they own lane semantics or artifact validation. | **Retain.** Generic command syntax would not remove process ownership, lock safety, lane allocation, packaging checks and their tests. Package manager and workspace configuration are explicit repository policy. |\n| Documentation/build outputs | Markdown docs sources and standalone generated HTML/assets; package/docs build scripts and pinned runtime. | Official VitePress/standalone build stack already used. No replacement candidate identified that removes repository integration. | **Retain.** Docs/tooling support was inspected as part of build/release scope; no docs framework adoption proposed. Regeneration is only required if a later implementation changes docs inputs. |\n\n## Exact-version advisory and transitive check\n\nOn **2026-10-26**, passive queries checked exact published package versions against the OSV npm ecosystem endpoint and GitHub Advisory Database `affects` endpoint. Published manifests, peer/runtime dependency declarations, license metadata and registry integrity were checked separately. No semver ranges were resolved into a hypothetical lockfile, no package was installed or executed, and no npm audit/scanner ran. Empty results mean the queried database returned no record for that exact queried version; they are not a security clearance. Some second-order transitive versions are marked not queried in the detailed register and must not be read as clean results.\n\nThe exact serious candidate set included: `@holoyan/adonisjs-activitylog@1.0.0`; `adonis-auditing@2.0.0`; `@adogrove/adonis-auditing@2.1.1`; `@outloud/adonis-scheduler@2.0.0` / `croner@9.0.0`; `adonisjs-scheduler@2.8.0` / `node-cron@3.0.3` / `uuid@8.3.2`; `@ajzinkyaw/adonis-lucid-soft-deletes@2.1.0`; `@tanstack/react-virtual@3.14.23` / `@tanstack/virtual-core@3.19.8`; `react-hook-form@7.91.0`; `@tanstack/react-form@1.33.5`; FullCalendar React/resource scheduler/core/headless packages `7.1.3` and the distinct old `@fullcalendar/resource-timeline@6.1.22`; `react-big-calendar@1.20.0`; `@dnd-kit/react@0.5.1` and its `0.5.1` modules; plus the listed form/calendar/drag transitive packages in the registry matrix. Exact OSV and GitHub queries for the named direct published candidate releases returned no records except `uuid@8.3.2`; individual second-order leaves have query statuses recorded separately and some were not queried. Account Kit `0.1.2`, Masquerade source commit `9fd2d232dd4a47220a86af27ba42d551a79886dd`, and soft-delete continuation commit `9bf84b410271d2ed082b0a4bca7cd000515d80f3` were checked separately; the source-only repositories have no npm release, and OSV exact Git-commit queries returned no records. That is source-version query evidence, not source-safety certification.\n\nThe only identified advisory path is a **conditional scheduler dependency**, not an installed CapacityLens dependency: `adonisjs-scheduler@2.8.0` declares `node-cron@^3.0.2`; registry metadata observed `node-cron@3.0.3`, whose exact manifest pins `uuid@8.3.2`. OSV returns [GHSA-w5hq-g745-h8pq](https://osv.dev/vulnerability/GHSA-w5hq-g745-h8pq) / CVE-2026-41907 (also aliased to CVE-2026-41988); the GitHub query returns that record and a [duplicate advisory record](https://github.com/advisories/GHSA-qmq6-f8pr-cx5x). The described affected behavior is `uuid` v3/v5/v6 calls with caller-provided undersized buffer or invalid offset. Static inspection of the integrity-matched [`node-cron@3.0.3` source](https://github.com/kelektiv/node-cron/tree/e65a2d0dca1590f7a4af4ab9d6ec81b5cc4728d6) found use of `uuid.v4()` for generated task IDs, outside those described affected functions. Thus the dependency graph contains a flagged version, but no affected call was identified in the inspected node-cron path. Preserve the advisory in any future scheduler adoption review and re-evaluate the candidate's semver resolution and call path then; this is not a current application finding.\n\nAn unrelated malware advisory record for the `react-hook-form` package name identifies **`7.73.0`**, not candidate `7.91.0`. The queried candidate `7.91.0` had no exact-version OSV or GitHub Advisory match on the evidence date. See [MAL-2026-2853](https://osv.dev/vulnerability/MAL-2026-2853). This result does not replace pre-adoption verification of the exact artifact and future transitive graph.\n\nOther exact candidate-version queries returned no records in the queried OSV/GitHub databases. No vulnerability-free or legal-eligibility claim follows: candidate ranges were not newly resolved, selected transitive packages may have incomplete query coverage, and unpublished code can only be checked at the queried source commit. Registry releases, advisories, package ownership and licenses can change; repeat the checks before any adoption.\n\n## Older AdonisJS package upgrade and fork opportunities\n\nThese are capability assessments, separate from their current compatibility and publication status. Lack of Adonis 7 support, low recent activity, or inactivity alone is not a rejection reason. The recommendations below are conditional; no maintainers were contacted and no fork or upgrade was performed.\n\n### Soft-delete lineages\n\n- **Original package:** `lucid-soft-deletes` / `@ajzinkyaw/adonis-lucid-soft-deletes` `2.1.0`, MIT tarball, published peer range supports Lucid `^22.1.1` but declares Core 6-era compatibility and identifies Adonis 6 in its README. The exact registry tarball lacks test files. Upstream `lookinlab/adonis-lucid-soft-deletes` main contains a Lucid 22 migration; do not assume that branch equals a released package. Inspect source/tag history before any contribution or fork.\n- **Existing owner continuation:** [`Kevinjohn/oss-adonisjs-lucid-soft-delete`](https://github.com/Kevinjohn/oss-adonisjs-lucid-soft-delete), MIT ancestry, `@kevinjohn/lucid-soft-deletes@3.0.0-alpha.1`, Node >=24, Core 7/Lucid 22/Luxon 3 peers. It has substantial source tests and history, including claimed consumer coverage against Core 7.0/Lucid 22.0 and Core 7.6/Lucid 22.4.2, SQLite/PostgreSQL, but those suites were not run here. No npm publication or GitHub release/tag was present at review time; branch version is not a released artifact.\n- **Technical/contract surface:** migration touches provider/container APIs, Lucid model scopes and query paths, TypeScript exports, SQLite/Postgres support, transaction attachment, and tests. Existing documentation names important bypasses (`withCount`, `whereHas`, pojo, joins/raw/DB queries, bulk delete); has-many-through intermediate filtering is also an explicit caveat. Those boundaries need proof, not a blanket \u201call queries scoped\u201d claim.\n- **Recommendation:** reject for present product need because CapacityLens uses archive/restore and controlled hard-delete tombstones, not soft deletion. If true soft deletion becomes a product requirement, evaluate the existing owner continuation first after a tagged/published artifact exists. Compare it with upstream contribution and an authorized fork; validate license ancestry, exact tarball/source match, minimum peer versions, tenant isolation and all documented query bypasses. No current product lifecycle code is eligible for deletion.\n\n### Masquerade lineages\n\n- **Existing extraction:** [`Kevinjohn/oss-adonisjs-masquerade`](https://github.com/Kevinjohn/oss-adonisjs-masquerade), MIT, Core 7/Auth 10/Lucid 22 source, substantial tests/docs/conformance harness, but `0.0.0` branch version with no GitHub release/tag and npm 404 at evidence date. Treat as an existing body of implementation, not an installable artifact.\n- **Capability and incompatibility are distinct:** package source separates actor/effective target, rechecks actor/target policy, defaults to view-only, blocks sensitive routes, has a revision context token and atomic control-store CAS/event log. Current CapacityLens source provides actor/effective/view-as behavior and read-only projection. Its own source tests/docs demonstrate actor/effective and view-mode behavior. The package is not directly compatible with the product contract because its owner key `(namespace, actorId, actorIncarnation)` is account-wide across sessions/tokens rather than the current session-bound owner key; it also has broader optional edit mode. Its Lucid store rejects caller transactions and owns its CAS/event transaction, while product state plus audit belongs in the caller transaction.\n- **Recommendation:** extend/trial the existing extraction after release and a deliberate owner-scope/transaction decision; do not reject the package merely because the app already has a local implementation. A compatible adapter could replace state protocol/guards/store responsibilities, but app-owned company authorization, tenant scoping, role checks, confidential projection, route coverage, UI and product audit/revision remain. Prove account/session scope across multiple sessions and companies; membership change/demotion; every unsafe route; sign-out/stop; callback failures; transaction rollback/commit; audit/event atomicity; uncertain commit recovery; and exact published-artifact compatibility.\n\n### Older scheduler/audit candidates\n\n- `@outloud/adonis-scheduler@2.0.0` is a published MIT package with cross-major framework support, exact tarball/source correspondence inspected, but package archive tests are absent while upstream repository has scheduler/lock specs. `adonisjs-scheduler@2.8.0` is MIT and declares Core 6/7 support; registry metadata lacks `gitHead` and artifact tests are narrow. Neither improves the current one-interval backup behavior. Reconsider only if real recurring job semantics grow.\n- `adonis5-scheduler@2.1.1` and `adonis-scheduler@3.0.2` are older-major lineages; they are not current drop-ins, but a substantial framework port could be reassessed if their underlying capability later becomes needed. Current simple timer is sufficient.\n- `@adogrove/adonis-auditing@2.1.1` is a published AGPL artifact with release/tag evidence; changelog claims Adonis 7 and transaction tests, but peer metadata remains Core 6/Lucid 20/21 while dev/test metadata uses Core 7/Lucid 22. Treat as an upgrade/publish-correction opportunity only if a model-audit feed is actually required. Its snapshot model does not replace compact, caller-transaction product audit.\n- `adonis-auditing@2.0.0` (maxupunk) and `@holoyan/adonisjs-activitylog` 1.x have inspectable published community artifacts. Their model snapshot/event schemas could support a distinct feed, but privacy, tenancy, metadata selection and transaction semantics need an explicit adapter and prototype. This is a trial hypothesis, not a replacement recommendation.\n\n## Frontend and shared candidates requiring a real trial\n\n### TanStack Virtual (maintenance comparison)\n\nPublished `@tanstack/react-virtual@3.14.23` and `@tanstack/virtual-core@3.19.8` are MIT and have compatible React peer declarations. The candidate could replace the custom prefix-sum/range/spacer bookkeeping in `useSchedulerGridVirtualization.ts` and `virtualWindow.ts`. It would not remove group flattening, collapse/row-height policy, dragged-source pinning, resource-jump behavior, date/column geometry, focus restoration, ARIA, keyboard interactions, or product actions. Its generic engine includes dynamic measurements, observers, anchoring and platform handling that the fixed-height current grid does not need. **Trial for total responsibility/maintenance comparison even without an observed performance defect.** Accept only if a source-scale prototype demonstrates a simpler complete boundary and preserves unmeasured/fit windows, stable scroll extent, off-window drag source, keyboard focus, sparse boundaries and browser matrix. No prototype or performance experiment was run.\n\n### FullCalendar v7 and other calendar replacements\n\nThe v7 package family `@fullcalendar/react-scheduler@7.1.3` + `fullcalendar-scheduler@7.1.3` is published, not technically absent. v7 is a distinct package family from `@fullcalendar/resource-timeline@6.1.22`. The v7 scheduler artifacts carry a commercial / CC BY-NC-ND evaluation-noncommercial / AGPLv3 tri-license; CapacityLens declares AGPL-3.0-only, but this review did not decide application/license eligibility. Resource timeline is structurally relevant, but there is no parity evidence for week granularity, working-day/capacity rules, private projections, keyboard editing, product status, revision-aware writes or current accessible workflows. **Conditional broad trial** only after a clear license eligibility decision and comparative parity prototype. React Big Calendar `1.20.0` (MIT) has no demonstrated equivalent resource-by-week fit; **wait**, not categorical exclusion.\n\n### Forms and drag sensors\n\nReact Hook Form `7.91.0` and TanStack Form `1.33.5` each merit a one-form trial on the allocation modal because it coordinates multiple fields, dirty/reset states, async errors and focus. The prototype should report actual app code removed and adapter code added, and preserve calculations, validation authority, payload and user-visible error behavior. No second consumer alone is not a rejection. dnd-kit\u2019s current modular `@dnd-kit/react@0.5.1` is a possible low-level sensor/keyboard source; `@dnd-kit/core@6.3.1` is a distinct older line. A sensor trial does not authorize replacing grid geometry or business policy. No trial ran.\n\n## Issue and PR reconciliation\n\nThe ecosystem capability and version matrix remains pinned to frozen source `6c92d3710ed1d30bc925bd97e5d701ea551db452`. A separate decision-history refresh records branch head [`f52bee5fe75604b33c1191294a80259825461aba`](https://github.com/Kevinjohn/capacitylens/commit/f52bee5fe75604b33c1191294a80259825461aba) on 2026-10-26. Six previously captured PRs (#1589, #1590, #1592, #1593, #1594 and #1606) are now merged. **#1591 remains OPEN**, although its merge commit is in the ancestry of the stack merged to the branch; integrated code and formal PR/issue status are distinct. This refresh reconciles relevant issue/PR overlap but is not a broad review of all 102 changed paths from the frozen source to the current branch. Keep baseline recommendations and current landed changes separate until a scoped delta review covers the affected capability.\n\nThe review supplements the current tracked work and does not reopen or silently replace it:\n\n- **#1595:** remains open. Partial work is now landed: #1590 adds an export-query validator/generated query type, and #1593 adopts generated route names and success response types in `authClient.ts`; raw fetch/body typing and some query assembly remain. Reconcile the remaining body/method/query acceptance against the merged integrated tree. Preserve product error behavior.\n- **#1596:** remains open. #1590 normalizes some product error codes/status and adds contract tests; #1593 adds generated route/success types, while auth runtime error parsing remains. The full error code/metadata/Kit status/header/network-vs-HTTP/browser-narrowing contract is not established by those merges.\n- **#1597:** Account Kit public action-proof parity remains gated on equivalent binding and atomic consumption. Account Kit\u2019s internal callback/transaction helpers do not establish parity for action proofs. The app proof remains caller-transaction-bound.\n- **#1598:** remains open and owns duplicate readiness DB/schema probe simplification; the merged #1591 diagnostics change does not establish a readiness change. Do not add another health library.\n- **#1599:** tracker for #1595\u2013#1598; no new duplicate implementation issue is created by this report.\n- **#1600:** exact test-discovery failure is reproduced in an isolated scratch snapshot under supported Node 24.21.0 / pnpm 11.4.0. Stryker instrumented 115 files / 8,003 mutants, then Vitest reported no tests. `vitest.related:false` alone and with `dir:\"apps/frontend\"` still failed; direct Vitest from the frontend workspace listed 3,944 test rows. Workspace-relative Vite include paths support a root/cwd mismatch hypothesis, but the negative dir experiment means no fix is accepted and no upstream defect is assigned. Do not phrase this as an ecosystem package replacement.\n- **#1601:** release-to-release upgrade rehearsal is separate; no distinct release artifact pair was exercised here.\n- **#1602:** runtime/dependency policy documentation is separate; this report records frozen versions and exact evidence rather than creating a new policy document.\n- **#1556:** starter extraction remains gated on sibling-needs inventory and reconciliation of Next. This report does not access unspecified sibling repositories or promote a starter candidate.\n- **#1482, #1553\u2013#1555:** existing framework/product boundaries remain authoritative where current source and later decisions support them. Issue/PR state is not treated as proof of code behavior.\n\nThe canonical [#1604 issue](https://github.com/Kevinjohn/capacitylens/issues/1604) is the public reference for the review record and issue/PR reconciliation. Cross-review corrections carried into final integration are: **OBS-000033** records a lost \u201cB activity\u201d selection that Save refuses, with no evidence that a wrong-project selection persists; **OBS-000065** cleanup P2 is rejected based on supported-launcher counterevidence. These corrections do not change the package adoption dispositions.\n\n## Opportunity value, confidence, severity and validation\n\nThis is an opportunity review, not an application defect report. No P0\u2013P3 defect is assigned to a package choice. Opportunity value and evidence confidence are separate judgments; neither is implementation-effort ranking. The #1600 runner behavior is a reproduced tooling issue in its canonical issue, not grounds to claim the rest of the toolchain defective.\n\n| Opportunity | Value | Confidence in evidence | Missing proof / next decision |\n|---|---|---|---|\n| Retain installed first-party runtime stack and Account Kit boundary | High | High for frozen source/API behavior; high for Account Kit artifact provenance | No live provider or package-suite test; future #1597 parity still gated. |\n| Simplify readiness under #1598 | Medium | High source evidence | Focused behavior test if implementation proceeds. |\n| Selective Vine/auth contract alignment under #1595 | Medium | High source and issue overlap | Reconcile remaining acceptance against merged #1590/#1593 work; preserve current response contract. |\n| TanStack Virtual source-scale maintenance comparison | Medium | High package metadata/current implementation; medium net-maintenance prediction | Implement isolated same-contract prototype; no need to assert a performance defect first. |\n| RHF or TanStack Form one-form trial | Medium-low | High on current form complexity and package availability; low on net change | Prototype both/one on the same form, compare responsibility removed and preserved states. |\n| FullCalendar v7 resource-timeline trial | Medium-high capability value; eligibility unresolved | High package existence/license notice; medium product fit | Decide license eligibility; then parity, keyboard/accessibility and command contract review. |\n| Masquerade existing extraction | High underlying value | High source boundary evidence; package release status is explicit | Publish/inspect exact supported artifact before trial; resolve account-wide vs session key and caller transaction/event ownership. |\n| Soft-delete owner continuation | Low for current product; potentially useful if requirements change | High on source/license/test-history inspection; no published-artifact validation | Only proceed if product adopts true soft-delete; prove all documented scope bypasses and publish exact release first. |\n| Generic activity feed package | Low-medium | Medium | Establish distinct feed need and prove tenancy/privacy/caller-transaction behavior. |\n| New standalone backend/frontend/shared package | Low demonstrated reuse | High for lack of a second in-repo consumer; hypothetical outside consumers unknown | Keep local; sibling/starter demand remains gated by #1556. |\n\n## Coverage and explicit limitations\n\n| Subsystem | Disposition | Evidence boundary |\n|---|---|---|\n| Backend platform/runtime/auth/DB/audit/backup/import | Inspected; current installed package and candidate matrix recorded | Static source, official docs and exact serious candidate artifacts; suites not run. |\n| Frontend state/forms/routing/dates/UI/scheduler | Inspected; candidate matrix recorded | Source/component tests read; no app tests or prototype run. |\n| Shared domain and contracts | Inspected; retained product-owned disposition | Shared exports, domain boundaries, wire types and tests were reviewed against the capability search; no external replacement for product rules was supported. |\n| Tests and browser tooling | Inspected; retained, with #1600 reproduction recorded | Focused Stryker issue reproduction only; test runner suites otherwise not run. |\n| Scripts/build/release/package manager | Inspected; retained repository-specific tooling | Package inventory, key scripts and tests read; no docs/package/build suite run for this report. |\n| Documentation and generated outputs | Inspected as build/release capability; retain | No docs source edits or rebuild were needed. |\n| Vendored Account Kit | Inspected archive, license, build output, public release digest/tag and source transaction tests | Test sources were read, not executed; not an npm publication. |\n| Older package forks and upgrades | Inspected source/artifact/release status where listed | No maintainers contacted, no fork/install/publication or compatibility execution. |\n| Docker | Not applicable by explicit repository boundary | No Docker image/build/test/workflow inspection or execution was needed. |\n| External sibling consumer demand | Blocked / not applicable to this assignment | #1556 requires an authorized sibling-needs inventory; unspecified repositories were not accessed. |\n\nThe ecosystem-adoption review and its passive advisory/transitive evidence are complete for the stated capability inventory. The independent cross-report completeness audit is delivered separately. This is not a defect-free or production-readiness certification, and the frozen-source findings do not imply that the current branch's full delta has been reviewed.\n\n\n{\n  \"source\": {\n    \"repository\": \"https://github.com/Kevinjohn/capacitylens\",\n    \"revision\": \"6c92d3710ed1d30bc925bd97e5d701ea551db452\",\n    \"contentSetSHA256\": \"b3fb9719c7ae3ae01f5a8f7b81cb005960da20ebec47089e869d3055b121cf24\",\n    \"trackedPathCount\": 1770,\n    \"inScopePathCount\": 1766,\n    \"explicitExclusionCount\": 4,\n    \"allSnapshotBytesMatchGitBlobs\": true\n  },\n  \"coverageCounts\": {\n    \"pathDisposition\": {\n      \"not_applicable\": 4,\n      \"inspected\": 1766\n    },\n    \"lenses\": {\n      \"framework\": {\n        \"not_applicable\": 4,\n        \"inspected\": 1766\n      },\n      \"ecosystem\": {\n        \"not_applicable\": 4,\n        \"inspected\": 1766\n      },\n      \"extraction\": {\n        \"not_applicable\": 4,\n        \"inspected\": 1766\n      }\n    },\n    \"uniquePrimarySubsystemOwnership\": true,\n    \"allPrimaryUnitsComplete\": true\n  },\n  \"observationDispositionCounts\": {\n    \"unresolved\": 24,\n    \"validated\": 42,\n    \"rejected\": 3,\n    \"duplicate\": 6\n  },\n  \"observations\": [\n    {\n      \"id\": \"OBS-000001\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"api\",\n      \"severity\": null,\n      \"title\": \"Invitation path IDs accept non-decimal numeric spellings\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/backend/app/controllers/invitations_controller.ts#L35-L38\"\n    },\n    {\n      \"id\": \"OBS-000002\",\n      \"disposition\": \"validated\",\n      \"category\": \"test_gap\",\n      \"severity\": null,\n      \"title\": \"Company-creation test probes a retired route and wrong actor\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/backend/tests/functional/membership/member_access_tracking.spec.ts#L324-L343\"\n    },\n    {\n      \"id\": \"OBS-000003\",\n      \"disposition\": \"validated\",\n      \"category\": \"test_gap\",\n      \"severity\": null,\n      \"title\": \"Masquerade export denial probe uses an unregistered endpoint\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/backend/tests/functional/auth/masquerade.spec.ts#L309-L314\"\n    },\n    {\n      \"id\": \"OBS-000004\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"reliability\",\n      \"severity\": null,\n      \"title\": \"Repeated admission cursor can make the team read loop indefinitely\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/account/teamAccessClient.ts#L270-L284\"\n    },\n    {\n      \"id\": \"OBS-000005\",\n      \"disposition\": \"validated\",\n      \"category\": \"architecture\",\n      \"severity\": null,\n      \"title\": \"Readiness repeats the database probe after the registered health check\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/backend/start/routes.ts#L58-L66\"\n    },\n    {\n      \"id\": \"OBS-000006\",\n      \"disposition\": \"validated\",\n      \"category\": \"test_reliability\",\n      \"severity\": \"P3\",\n      \"title\": \"Child write-lock helper can wait indefinitely when subprocess exits before readiness\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/backend/tests/helpers/write_lock.ts#L37-L37\"\n    },\n    {\n      \"id\": \"OBS-000007\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"reliability\",\n      \"severity\": null,\n      \"title\": \"Backup publication does not verify required tenant-enforcement triggers\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/backend/app/services/backup/snapshot.ts#L68-L85\"\n    },\n    {\n      \"id\": \"OBS-000008\",\n      \"disposition\": \"rejected\",\n      \"category\": \"api\",\n      \"severity\": null,\n      \"title\": \"Getting-started dismissal implementation conflicts with the per-person device-preference decision\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/backend/database/migrations/202610120001_create_capacitylens_baseline.ts#L379-L390\"\n    },\n    {\n      \"id\": \"OBS-000009\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"test_reliability\",\n      \"severity\": null,\n      \"title\": \"Snapshot timestamp parser normalizes impossible filename components\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/backend/app/services/backup/names.ts#L20-L36\"\n    },\n    {\n      \"id\": \"OBS-000010\",\n      \"disposition\": \"duplicate\",\n      \"category\": \"test_gap\",\n      \"severity\": null,\n      \"title\": \"Stale company creation route probe does not test Admin authorization\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/backend/tests/functional/membership/member_access_tracking.spec.ts#L324-L343\"\n    },\n    {\n      \"id\": \"OBS-000011\",\n      \"disposition\": \"duplicate\",\n      \"category\": \"test_gap\",\n      \"severity\": null,\n      \"title\": \"Nonexistent export route is an accidental pass in masquerade test\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/backend/tests/functional/auth/masquerade.spec.ts#L309-L314\"\n    },\n    {\n      \"id\": \"OBS-000012\",\n      \"disposition\": \"validated\",\n      \"category\": \"test_gap\",\n      \"severity\": null,\n      \"title\": \"Action proof dialog lacks a direct UI test\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/auth/ActionProofDialog.tsx#L22\"\n    },\n    {\n      \"id\": \"OBS-000013\",\n      \"disposition\": \"validated\",\n      \"category\": \"test_gap\",\n      \"severity\": null,\n      \"title\": \"Admission request panel has no direct rendering test\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/components/team/AdmissionRequestsPanel.tsx#L26\"\n    },\n    {\n      \"id\": \"OBS-000014\",\n      \"disposition\": \"duplicate\",\n      \"category\": \"reliability\",\n      \"severity\": null,\n      \"title\": \"Backup publication does not verify required tenant-enforcement triggers\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/backend/app/services/backup/snapshot.ts#L68-L85\"\n    },\n    {\n      \"id\": \"OBS-000015\",\n      \"disposition\": \"duplicate\",\n      \"category\": \"test_reliability\",\n      \"severity\": null,\n      \"title\": \"Snapshot timestamp parser normalizes impossible filename components\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/backend/app/services/backup/names.ts#L20-L36\"\n    },\n    {\n      \"id\": \"OBS-000016\",\n      \"disposition\": \"validated\",\n      \"category\": \"correctness\",\n      \"severity\": \"P3\",\n      \"title\": \"External projectId refusal names disciplineId\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/backend/app/services/planning_operations/entity_policy.ts#L123\"\n    },\n    {\n      \"id\": \"OBS-000017\",\n      \"disposition\": \"validated\",\n      \"category\": \"test_gap\",\n      \"severity\": null,\n      \"title\": \"Safe-integer rejection branches lack direct regression assertions\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/backend/app/validators/planning_operations.ts#L67\"\n    },\n    {\n      \"id\": \"OBS-000018\",\n      \"disposition\": \"validated\",\n      \"category\": \"test_gap\",\n      \"severity\": null,\n      \"title\": \"Inactive-slice fallback fixture does not exercise unreadable JSON\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/data/fetchInactiveSlice.test.ts#L48-L59\"\n    },\n    {\n      \"id\": \"OBS-000019\",\n      \"disposition\": \"validated\",\n      \"category\": \"test_gap\",\n      \"severity\": null,\n      \"title\": \"Drag hook tests omit Escape and lost-capture cancellation paths\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/hooks/useDragResize.test.tsx#L126-L156\"\n    },\n    {\n      \"id\": \"OBS-000020\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"architecture and accessibility opportunity\",\n      \"severity\": null,\n      \"title\": \"Evaluate current dnd-kit sensors as an optional scheduler input and lifecycle layer\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/hooks/useDragResize.ts#L76-L200\"\n    },\n    {\n      \"id\": \"OBS-000021\",\n      \"disposition\": \"validated\",\n      \"category\": \"documentation\",\n      \"severity\": \"P3\",\n      \"title\": \"User-story reference contradicts current date-format transfer contract\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/user-stories/settings/US-SET-17-date-style.md#L59-L61\"\n    },\n    {\n      \"id\": \"OBS-000022\",\n      \"disposition\": \"validated\",\n      \"category\": \"documentation\",\n      \"severity\": \"P3\",\n      \"title\": \"Published documentation links target seven missing heading fragments\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/docs-src/index.md#L22-L22\"\n    },\n    {\n      \"id\": \"OBS-000023\",\n      \"disposition\": \"validated\",\n      \"category\": \"documentation\",\n      \"severity\": \"P2\",\n      \"title\": \"Current security material still describes retired federation and session controls\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/docs-src/security/threat-model.md#L72-L102\"\n    },\n    {\n      \"id\": \"OBS-000024\",\n      \"disposition\": \"validated\",\n      \"category\": \"documentation\",\n      \"severity\": \"P3\",\n      \"title\": \"Central user-story reference points maintainers at retired root source paths\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/user-stories/REFERENCE.md#L551-L554\"\n    },\n    {\n      \"id\": \"OBS-000025\",\n      \"disposition\": \"validated\",\n      \"category\": \"test_gap\",\n      \"severity\": null,\n      \"title\": \"Test gap: rendered keyboard focus styling is not pinned for composed wrappers\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/components/ui/layers.test.ts#L19-L49\"\n    },\n    {\n      \"id\": \"OBS-000026\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"authorization\",\n      \"severity\": null,\n      \"title\": \"Diagnostics GET bypasses the masquerade read boundary\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/backend/app/middleware/masquerade_read_only_middleware.ts#L6-L19\"\n    },\n    {\n      \"id\": \"OBS-000027\",\n      \"disposition\": \"validated\",\n      \"category\": \"test_gap\",\n      \"severity\": null,\n      \"title\": \"Add a concurrent restoration-consumption regression case\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/backend/tests/functional/planning/restoration.spec.ts#L234\"\n    },\n    {\n      \"id\": \"OBS-000028\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"performance opportunity\",\n      \"severity\": null,\n      \"title\": \"Measure repeated per-resource day scans in Capacity Overview\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/components/capacity-overview/capacityOverviewModel.ts#L100-L114\"\n    },\n    {\n      \"id\": \"OBS-000029\",\n      \"disposition\": \"validated\",\n      \"category\": \"domain correctness defect\",\n      \"severity\": \"P2\",\n      \"title\": \"Active-only projection retains placeholders whose bound project is inactive\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/packages/shared/src/domain/lifecycle/projection.ts#L43-L49\",\n      \"validationRefs\": [\n        \"VAL-000016\"\n      ],\n      \"effectiveActual\": \"activeOnly retains a project-bound placeholder beneath an archived project, while the real time-off write validator rejects the same resource as effectively inactive.\",\n      \"effectiveImpact\": \"Normal active resource availability conflicts with write acceptance.\",\n      \"effectiveProof\": \"Four-case isolated real-function probe: three controls passed and one desired projection assertion failed. Controls preserve active sibling, unresolved/cross-company diagnostic references and input immutability.\",\n      \"remainingLimits\": [\n        \"No live UI or server-database execution\",\n        \"No source fix or full suite\",\n        \"Archive-confirmation copy semantics remain separate\"\n      ]\n    },\n    {\n      \"id\": \"OBS-000030\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"protocol/maintainability observation\",\n      \"severity\": null,\n      \"title\": \"Ownership-transfer state contract is unused beside a different active transfer API\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/packages/shared/src/account/ownershipTransfer.ts#L46-L55\"\n    },\n    {\n      \"id\": \"OBS-000031\",\n      \"disposition\": \"validated\",\n      \"category\": \"documentation/API contract mismatch\",\n      \"severity\": \"P3\",\n      \"title\": \"Lifecycle module summary describes soft-delete and purge transitions absent from the API\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/packages/shared/src/domain/lifecycle.ts#L1-L8\"\n    },\n    {\n      \"id\": \"OBS-000032\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"correctness\",\n      \"severity\": null,\n      \"title\": \"Invalid repeat occurrence can extend a surviving series annotation\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/components/scheduler/schedulerModel.ts#L265-L271\"\n    },\n    {\n      \"id\": \"OBS-000033\",\n      \"disposition\": \"validated\",\n      \"category\": \"correctness / async draft-state race\",\n      \"severity\": \"P2\",\n      \"title\": \"Inline activity completion can overwrite a newer allocation target selection\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/components/scheduler/useAllocationTargetState.ts#L203-L245\",\n      \"validationRefs\": [\n        \"VAL-000017\"\n      ],\n      \"effectiveActual\": \"While inline activity creation for Project A is pending, the user selects Project B and its activity. A late completion preserves Project B but replaces its activity selection with the out-of-scope A activity; the picker becomes blank. Save refuses validation and creates no allocation.\",\n      \"effectiveImpact\": \"Lost activity selection and a blocked save; wrong-project allocation persistence is not established.\",\n      \"effectiveProof\": \"Real rendered AllocationModal controls plus deferred store action under Node24.21.0/pnpm11.4.0/Vitest4.1.11. One test passed by asserting this baseline regression; unchanged source/test hashes and full durable rerun log preserved.\",\n      \"remainingLimits\": [\n        \"No wrong-project persistence proved\",\n        \"No duplicate-create behavior proved by this test\",\n        \"No full suite, E2E, CI or production run\"\n      ]\n    },\n    {\n      \"id\": \"OBS-000034\",\n      \"disposition\": \"validated\",\n      \"category\": \"test gap / regression coverage\",\n      \"severity\": null,\n      \"title\": \"Hidden-task preservation test edits a different allocation\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/components/scheduler/AllocationModal.activity-and-task.test.tsx#L182-L220\"\n    },\n    {\n      \"id\": \"OBS-000035\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"documentation\",\n      \"severity\": null,\n      \"title\": \"Product orientation sidebar reopening conflicts with standing decision\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/components/useProductOrientation.ts#L17-L32\"\n    },\n    {\n      \"id\": \"OBS-000036\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"accessibility\",\n      \"severity\": null,\n      \"title\": \"Gate-stage reuse can skip initial focus after a direct recovery transition\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/components/AppEntryGate.tsx#L23-L30\"\n    },\n    {\n      \"id\": \"OBS-000037\",\n      \"disposition\": \"rejected\",\n      \"category\": \"documentation\",\n      \"severity\": null,\n      \"title\": \"Internal-project visibility promise conflicts with current palette implementation and tests\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/components/CommandPalette.tsx#L150-L155\"\n    },\n    {\n      \"id\": \"OBS-000038\",\n      \"disposition\": \"validated\",\n      \"category\": \"correctness / policy false acceptance\",\n      \"severity\": \"P3\",\n      \"title\": \"DCO check accepts a matching line outside the commit trailer block\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/scripts/check-dco.mjs#L39-L50\"\n    },\n    {\n      \"id\": \"OBS-000039\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"correctness / policy false acceptance\",\n      \"severity\": null,\n      \"title\": \"Dependabot validator accepts empty required ecosystem and directory values\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/scripts/check-dependabot.mjs#L23-L35\"\n    },\n    {\n      \"id\": \"OBS-000040\",\n      \"disposition\": \"validated\",\n      \"category\": \"resource management / test hygiene\",\n      \"severity\": null,\n      \"title\": \"Screenshot publication tests leave temporary fixtures behind\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/scripts/check-screenshot-publication.test.mjs#L12-L32\"\n    },\n    {\n      \"id\": \"OBS-000041\",\n      \"disposition\": \"validated\",\n      \"category\": \"diagnostic correctness\",\n      \"severity\": \"P3\",\n      \"title\": \"Gitleaks paths diagnostic reports the wrong TOML table\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/scripts/check-gitleaks-config.mjs#L83-L99\"\n    },\n    {\n      \"id\": \"OBS-000042\",\n      \"disposition\": \"validated\",\n      \"category\": \"ux_consistency\",\n      \"severity\": null,\n      \"title\": \"Catalogue forms do not communicate pending save state consistently\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/components/activities/ActivityForm.tsx#L145-L185\"\n    },\n    {\n      \"id\": \"OBS-000043\",\n      \"disposition\": \"duplicate\",\n      \"category\": \"documentation\",\n      \"severity\": null,\n      \"title\": \"Date-format story contradicts full-import company-setting behavior\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/components/ImportExport.tsx#L184-L214\"\n    },\n    {\n      \"id\": \"OBS-000044\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"correctness / deterministic presentation\",\n      \"severity\": null,\n      \"title\": \"Fuzzy match tie ordering depends on host locale\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/lib/fuzzy.ts#L72-L77\"\n    },\n    {\n      \"id\": \"OBS-000045\",\n      \"disposition\": \"validated\",\n      \"category\": \"test coverage gap\",\n      \"severity\": null,\n      \"title\": \"Activity archive-impact copy has no direct test\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/lib/archiveImpactCopy.test.ts#L13-L33\"\n    },\n    {\n      \"id\": \"OBS-000046\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"correctness\",\n      \"severity\": null,\n      \"title\": \"Sparse weekday arrays pass runtime shape checks\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/packages/shared/src/lib/accountWorkingDays.ts#L13-L14\"\n    },\n    {\n      \"id\": \"OBS-000047\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"correctness\",\n      \"severity\": null,\n      \"title\": \"Fractional weekday values are coerced by the weekend bitmask\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/packages/shared/src/lib/dateMath.ts#L207-L215\"\n    },\n    {\n      \"id\": \"OBS-000048\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"reliability_performance\",\n      \"severity\": null,\n      \"title\": \"Custom recurrence candidate arrays are built before occurrence cap enforcement\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/packages/shared/src/lib/repeatingDates.ts#L21-L30\"\n    },\n    {\n      \"id\": \"OBS-000049\",\n      \"disposition\": \"validated\",\n      \"category\": \"test_gap\",\n      \"severity\": null,\n      \"title\": \"Spring-forward date test does not pin a DST timezone\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/packages/shared/src/lib/dateMath.test.ts#L42-L48\"\n    },\n    {\n      \"id\": \"OBS-000050\",\n      \"disposition\": \"validated\",\n      \"category\": \"style_nit\",\n      \"severity\": null,\n      \"title\": \"Integrity fixture names conflict with comic-book fixture convention\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/packages/shared/src/lib/integrity.test.support.ts#L43-L65\"\n    },\n    {\n      \"id\": \"OBS-000051\",\n      \"disposition\": \"validated\",\n      \"category\": \"test_gap\",\n      \"severity\": null,\n      \"title\": \"Default test entity builders use a different account ID than the default account\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/test/fixtures.ts#L26-L27\"\n    },\n    {\n      \"id\": \"OBS-000052\",\n      \"disposition\": \"validated\",\n      \"category\": \"product_copy\",\n      \"severity\": \"P3\",\n      \"title\": \"Import recovery guidance refers to Google confirmation in a password-only product\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/messages/en.json#L901-L901\"\n    },\n    {\n      \"id\": \"OBS-000053\",\n      \"disposition\": \"validated\",\n      \"category\": \"documentation_convention\",\n      \"severity\": null,\n      \"title\": \"Generic fixture display labels do not follow fictional-data convention\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/packages/shared/src/data/fixtures.ts#L21-L25\"\n    },\n    {\n      \"id\": \"OBS-000054\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"test_gap\",\n      \"severity\": null,\n      \"title\": \"Package export test does not cover built default condition\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/packages/shared/src/packageExports.test.ts#L7-L19\"\n    },\n    {\n      \"id\": \"OBS-000055\",\n      \"disposition\": \"validated\",\n      \"category\": \"testing\",\n      \"severity\": null,\n      \"title\": \"Password reset browser journey does not assert existing-session revocation\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/e2e/reset-password.auth.spec.ts#L12-L42\"\n    },\n    {\n      \"id\": \"OBS-000056\",\n      \"disposition\": \"validated\",\n      \"category\": \"test coverage gap\",\n      \"severity\": null,\n      \"title\": \"Repeated time-off test does not prove individual entries are independent\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/e2e/timeoff.spec.ts#L152-L200\"\n    },\n    {\n      \"id\": \"OBS-000057\",\n      \"disposition\": \"validated\",\n      \"category\": \"test assertion opportunity\",\n      \"severity\": null,\n      \"title\": \"Demo drag and resize tests assert rendered geometry but not changed date semantics\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/e2e/scheduler.spec.ts#L176-L231\"\n    },\n    {\n      \"id\": \"OBS-000058\",\n      \"disposition\": \"validated\",\n      \"category\": \"test coverage / field boundary behavior\",\n      \"severity\": null,\n      \"title\": \"NumberField blur-clamp contract lacks a direct regression test\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/components/common/fields/textFields.tsx#L175-L184\"\n    },\n    {\n      \"id\": \"OBS-000059\",\n      \"disposition\": \"validated\",\n      \"category\": \"test_gap\",\n      \"severity\": null,\n      \"title\": \"DST repeat test runs in UTC\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/lib/repeatingTimeOff.test.ts#L20-L31\"\n    },\n    {\n      \"id\": \"OBS-000060\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"performance_opportunity\",\n      \"severity\": null,\n      \"title\": \"Repeat advisories rescan all absence rows for every projected day\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/lib/repeatingAllocations.ts#L167-L199\"\n    },\n    {\n      \"id\": \"OBS-000061\",\n      \"disposition\": \"validated\",\n      \"category\": \"test-gap\",\n      \"severity\": \"P2\",\n      \"title\": \"Mutation test runner discovers no tests from the configured root invocation\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/stryker.config.json#L9-L22\",\n      \"validationRefs\": [\n        \"VAL-000015\"\n      ],\n      \"effectiveActual\": \"The root mutation invocation instrumented 115 files and 8,003 mutants but discovered no tests and exited 1. related:false alone and with dir:apps/frontend did not repair discovery; workspace-local direct Vitest listing found tests.\",\n      \"effectiveImpact\": \"Mutation testing supplies no test execution or mutation score under the reviewed configuration. Root/cwd mismatch remains a hypothesis, not an accepted fix.\",\n      \"effectiveProof\": \"Supported-runtime isolated Stryker execution, Node24.21.0/pnpm11.4.0/Stryker9.6.1/Vitest4.1.11; no source changes.\",\n      \"remainingLimits\": [\n        \"No accepted fix or full mutation campaign\",\n        \"Direct test listing is not a passing application suite\"\n      ]\n    },\n    {\n      \"id\": \"OBS-000062\",\n      \"disposition\": \"duplicate\",\n      \"category\": \"security-policy/test-gap\",\n      \"severity\": null,\n      \"title\": \"Dependency advisory checks and dependency review run after merge, not on pull requests\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/.github/workflows/security.yml#L44-L60\"\n    },\n    {\n      \"id\": \"OBS-000063\",\n      \"disposition\": \"validated\",\n      \"category\": \"contribution-policy/test-gap\",\n      \"severity\": null,\n      \"title\": \"DCO policy has no configured pre-merge check\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/.github/workflows/gate.yml#L46-L63\"\n    },\n    {\n      \"id\": \"OBS-000064\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"tooling-configuration\",\n      \"severity\": null,\n      \"title\": \"Root shadcn config likely points CSS at a missing root-relative path\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/components.json#L6-L12\"\n    },\n    {\n      \"id\": \"OBS-000065\",\n      \"disposition\": \"rejected\",\n      \"category\": \"correctness\",\n      \"severity\": null,\n      \"title\": \"Orphan cleanup can signal a listener after its lane becomes claimed\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/scripts/lanes.mjs#L98-L116\"\n    },\n    {\n      \"id\": \"OBS-000066\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"framework alignment / maintainability opportunity\",\n      \"severity\": null,\n      \"title\": \"Use the installed Playwright fixed-time clock where browser compatibility permits\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/e2e/browserTestSupport.ts#L77-L94\"\n    },\n    {\n      \"id\": \"OBS-000067\",\n      \"disposition\": \"validated\",\n      \"category\": \"test reliability / weak synchronization\",\n      \"severity\": null,\n      \"title\": \"Replace arbitrary waits around demo reload/export with observable readiness\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/e2e/crud.spec.ts#L26-L30\"\n    },\n    {\n      \"id\": \"OBS-000068\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"stale test configuration / maintenance\",\n      \"severity\": null,\n      \"title\": \"Reconcile the unreferenced Dex fixture with the current password-only decision\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/e2e/oidc/dex.yaml#L1-L23\"\n    },\n    {\n      \"id\": \"OBS-000069\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"correctness\",\n      \"severity\": null,\n      \"title\": \"Reject canonical snapshots without exactly one company row\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/data/planning/planningCacheController.ts#L200\"\n    },\n    {\n      \"id\": \"OBS-000070\",\n      \"disposition\": \"validated\",\n      \"category\": \"test_gap\",\n      \"severity\": null,\n      \"title\": \"Assert planning HTTP restoration-count error metadata at the Tuyau adapter\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/data/planning/planningTransport.ts#L17\"\n    },\n    {\n      \"id\": \"OBS-000071\",\n      \"disposition\": \"validated\",\n      \"category\": \"test_gap\",\n      \"severity\": null,\n      \"title\": \"Verify abort propagation through the generated planning client and wrapped fetch\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/data/planning/planningTransport.test.ts#L14\"\n    },\n    {\n      \"id\": \"OBS-000072\",\n      \"disposition\": \"validated\",\n      \"category\": \"test_gap\",\n      \"severity\": null,\n      \"title\": \"Cover media-query change and unsubscribe behavior in useIsMobile\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/hooks/useIsMobile.ts#L5\"\n    },\n    {\n      \"id\": \"OBS-000073\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"test and release-verification gap\",\n      \"severity\": null,\n      \"title\": \"Routine packaged smoke does not cover an upgrade between release archives\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/scripts/smoke-packaged-server.mjs#L294-L307\"\n    },\n    {\n      \"id\": \"OBS-000074\",\n      \"disposition\": \"unresolved\",\n      \"category\": \"release output reliability / safe publication\",\n      \"severity\": null,\n      \"title\": \"Release archive publication writes directly over versioned output files\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/scripts/package-managed-release.mjs#L332-L338\"\n    },\n    {\n      \"id\": \"OBS-000075\",\n      \"disposition\": \"validated\",\n      \"category\": \"security-policy/test-gap\",\n      \"severity\": null,\n      \"title\": \"Dependency advisory enforcement timing is not explicit for pull requests\",\n      \"sourceURL\": \"https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/.github/workflows/security.yml#L44-L60\"\n    }\n  ],\n  \"validationLedger\": {\n    \"records\": 17,\n    \"interpretation\": \"17 pre-audit records: 14 packet/attempt/integrity/metadata entries plus three bounded behavior proofs. Subsequent independent-audit integrity validations are reported separately; this is not 17 application suites.\",\n    \"proofExecutions\": [\n      {\n        \"proof\": \"mutation-runner-discovery\",\n        \"date\": \"2026-10-26\",\n        \"command\": \"pnpm exec stryker run --dryRunOnly\",\n        \"result\": \"Failed to find tests after instrumenting 115 files and 8,003 mutants; no tests executed. Two config variants also found none.\",\n        \"exitStatus\": 1,\n        \"runtime\": \"Node 24.21.0; pnpm 11.4.0; Stryker 9.6.1; Vitest 4.1.11\",\n        \"limits\": \"Bounded investigation; no accepted fix, full suite, or candidate package test.\",\n        \"reportSection\": \"#file-coverage-and-evidence-md\"\n      },\n      {\n        \"proof\": \"placeholder-projection-mismatch\",\n        \"date\": \"2026-10-26\",\n        \"command\": \"vitest run --config vitest.config.ts src/domain/lifecyclePlaceholder.probe.test.ts\",\n        \"result\": \"Four isolated tests: three passed and one expected baseline assertion failed. Projection retained an archived-project placeholder; write validation rejected it.\",\n        \"exitStatus\": 1,\n        \"runtime\": \"Node 24.21.0; pnpm 11.4.0; Vitest 4.1.11\",\n        \"limits\": \"Scratch-only focused probe; no implementation, live UI/server or full suite.\",\n        \"reportSection\": \"#file-coverage-and-evidence-md\"\n      },\n      {\n        \"proof\": \"inline-activity-pending-race\",\n        \"date\": \"2026-10-26\",\n        \"command\": \"vitest run src/components/scheduler/inlineActivityPendingRace.validation.test.tsx\",\n        \"result\": \"One isolated test passed: late Project A response clears Project B activity selection; save is rejected until an activity is selected.\",\n        \"exitStatus\": 0,\n        \"runtime\": \"Node 24.21.0; pnpm 11.4.0; Vitest 4.1.11\",\n        \"limits\": \"No wrong-project persistence; no full suite, E2E, CI or production-browser verification.\",\n        \"rawLogSha256\": \"95caff23e98f4b0ad18af78d0fd2a58b79d8318d1ba8dee8e83448c9512edc5d\",\n        \"proofMetadataOriginalPreserved\": true,\n        \"reportSection\": \"#file-coverage-and-evidence-md\"\n      }\n    ],\n    \"sourceArtifactURL\": \"https://github.com/Kevinjohn/capacitylens/tree/6c92d3710ed1d30bc925bd97e5d701ea551db452\",\n    \"phase\": \"Source-review phase before independent final auditing\",\n    \"independentAuditRecordPolicy\": \"Additional read-only artifact integrity checks are described in the independent completeness audit; they add no application behavior proof.\",\n    \"independentAuditReport\": \"#file-independent-completeness-audit-md\"\n  },\n  \"knownLimits\": [\n    \"Source tests were mainly inspected, not run.\",\n    \"Security review was passive and low scope; no active security audit was conducted.\",\n    \"No candidate package compatibility suites were run.\",\n    \"No Docker execution, live release or live upgrade/recovery rehearsal was run.\",\n    \"Independent completeness audit and its scoped verdict are delivered separately.\"\n  ],\n  \"packageArtifacts\": [\n    {\n      \"name\": \"@adogrove/adonis-auditing\",\n      \"version\": \"2.1.1\",\n      \"license\": \"AGPL-3.0-or-later\",\n      \"publicTarballURL\": \"https://registry.npmjs.org/@adogrove/adonis-auditing/-/adonis-auditing-2.1.1.tgz\",\n      \"registryIntegrity\": \"sha512-ePrd3dtbwKoXUonUCNmA7rLxAdEkJzr/pBcnr6CTKoDtoJA+hlkrzhbL4yyNaHIetlU8QA2tRxBWqI2iKGuzCA==\",\n      \"downloadedTarballSHA256\": \"b12fce55146b8c9bcff4855724d516e35bd6d17caa90a84ec0631f898d9afa97\",\n      \"observedDate\": \"2026-10-26\",\n      \"validationPerformed\": \"Registry metadata and downloaded tarball integrity inspected; candidate package test suites were not run.\"\n    },\n    {\n      \"name\": \"adonisjs-scheduler\",\n      \"version\": \"2.8.0\",\n      \"license\": \"MIT\",\n      \"publicTarballURL\": \"https://registry.npmjs.org/adonisjs-scheduler/-/adonisjs-scheduler-2.8.0.tgz\",\n      \"registryIntegrity\": \"sha512-j2J6t4uHfJ4A4GvxD08HUDRsEJnz31pkmuG/FlJEPlWUKZ99x8qsuCKAuaCd+bPHzWHXtQOqf4e/eVIzclzEdQ==\",\n      \"downloadedTarballSHA256\": \"fb0ac3c6675d1aa70f070193dec605de895ad4088f8c52103a5c7908da02cb42\",\n      \"observedDate\": \"2026-10-26\",\n      \"validationPerformed\": \"Registry metadata and downloaded tarball integrity inspected; candidate package test suites were not run.\"\n    },\n    {\n      \"name\": \"adonis-auditing\",\n      \"version\": \"2.0.0\",\n      \"license\": \"MIT\",\n      \"publicTarballURL\": \"https://registry.npmjs.org/adonis-auditing/-/adonis-auditing-2.0.0.tgz\",\n      \"registryIntegrity\": \"sha512-NUYXwt3i9tDJI2AloMOhNMXgxpTQh+sOI8JjYviu96rrwY9i9YiQyYSSmsThhAeSPlj0nvJ6SRr2f3BbZzUhew==\",\n      \"downloadedTarballSHA256\": \"e4a2fb6786e333b60df9abd294c37370c440e8d878ee95b3e39560eb0d248d0d\",\n      \"observedDate\": \"2026-10-26\",\n      \"validationPerformed\": \"Registry metadata and downloaded tarball integrity inspected; candidate package test suites were not run.\"\n    },\n    {\n      \"name\": \"@holoyan/adonisjs-activitylog\",\n      \"version\": \"1.0.0\",\n      \"license\": \"MIT\",\n      \"publicTarballURL\": \"https://registry.npmjs.org/@holoyan/adonisjs-activitylog/-/adonisjs-activitylog-1.0.0.tgz\",\n      \"registryIntegrity\": \"sha512-l/V8B4r9AkfylhSt8VHBBNUYWBr+7PEPdH59kCQkFcoxAIBIBaSP48Zi2PsQ8ggfZinf7wGP+CG+LxELAoXQRA==\",\n      \"downloadedTarballSHA256\": \"041a3314e05e49670b419124e6778d20087928fd55959bfb5ec6f2780f18d8fe\",\n      \"observedDate\": \"2026-10-26\",\n      \"validationPerformed\": \"Registry metadata and downloaded tarball integrity inspected; candidate package test suites were not run.\"\n    },\n    {\n      \"name\": \"@outloud/adonis-scheduler\",\n      \"version\": \"2.0.0\",\n      \"license\": \"MIT\",\n      \"publicTarballURL\": \"https://registry.npmjs.org/@outloud/adonis-scheduler/-/adonis-scheduler-2.0.0.tgz\",\n      \"registryIntegrity\": \"sha512-nrK9NZv4tlT2wtFWavb6Ule7Cm69yyL/IltKaVoX8y4VwZmM8V1TJ8WdZDAsoiu3V9DTnxlr5k68y47rt72w2g==\",\n      \"downloadedTarballSHA256\": \"63edfb288535a1c6800c245010c7291c440111759e3f40a947d6518a9029ad69\",\n      \"observedDate\": \"2026-10-26\",\n      \"validationPerformed\": \"Registry metadata and downloaded tarball integrity inspected; candidate package test suites were not run.\"\n    },\n    {\n      \"name\": \"@ajzinkyaw/adonis-lucid-soft-deletes\",\n      \"version\": \"2.1.0\",\n      \"license\": \"MIT\",\n      \"publicTarballURL\": \"https://registry.npmjs.org/@ajzinkyaw/adonis-lucid-soft-deletes/-/adonis-lucid-soft-deletes-2.1.0.tgz\",\n      \"registryIntegrity\": \"sha512-Qa9gXNmF3gGHd3vcpzlrKA9GYuKNRGSvRDVraiI7GacLz0sDFa6skxencuUdmip3krvTfYVatJrMvbHpWXlvqw==\",\n      \"downloadedTarballSHA256\": \"751befce85dd17d2be1413b904419785d763d3b73114e6fd2a40908ad6e7b368\",\n      \"observedDate\": \"2026-10-26\",\n      \"validationPerformed\": \"Registry metadata and downloaded tarball integrity inspected; candidate package test suites were not run.\"\n    }\n  ],\n  \"packageAdvisorySupplement\": {\n    \"date\": \"2026-10-26\",\n    \"sourceRevision\": \"6c92d3710ed1d30bc925bd97e5d701ea551db452\",\n    \"scope\": \"Passive exact-version registry and advisory lookups across 15 candidate groups (39 package records); no packages installed and no semver ranges resolved into a new lockfile.\",\n    \"packageRecords\": [\n      {\n        \"name\": \"@holoyan/adonisjs-activitylog\",\n        \"version\": \"1.0.0\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@holoyan/adonisjs-activitylog/1.0.0\",\n        \"registryIntegrity\": \"sha512-l/V8B4r9AkfylhSt8VHBBNUYWBr+7PEPdH59kCQkFcoxAIBIBaSP48Zi2PsQ8ggfZinf7wGP+CG+LxELAoXQRA==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"adonis-auditing\",\n        \"version\": \"2.0.0\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/adonis-auditing/2.0.0\",\n        \"registryIntegrity\": \"sha512-NUYXwt3i9tDJI2AloMOhNMXgxpTQh+sOI8JjYviu96rrwY9i9YiQyYSSmsThhAeSPlj0nvJ6SRr2f3BbZzUhew==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@adogrove/adonis-auditing\",\n        \"version\": \"2.1.1\",\n        \"license\": \"AGPL-3.0-or-later\",\n        \"registryURL\": \"https://registry.npmjs.org/@adogrove/adonis-auditing/2.1.1\",\n        \"registryIntegrity\": \"sha512-ePrd3dtbwKoXUonUCNmA7rLxAdEkJzr/pBcnr6CTKoDtoJA+hlkrzhbL4yyNaHIetlU8QA2tRxBWqI2iKGuzCA==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@outloud/adonis-scheduler\",\n        \"version\": \"2.0.0\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@outloud/adonis-scheduler/2.0.0\",\n        \"registryIntegrity\": \"sha512-nrK9NZv4tlT2wtFWavb6Ule7Cm69yyL/IltKaVoX8y4VwZmM8V1TJ8WdZDAsoiu3V9DTnxlr5k68y47rt72w2g==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"croner\",\n        \"version\": \"9.0.0\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/croner/9.0.0\",\n        \"registryIntegrity\": \"sha512-onMB0OkDjkXunhdW9htFjEhqrD54+M94i6ackoUkjHKbRnXdyEyKRelp4nJ1kAz32+s27jP1FsebpJCVl0BsvA==\",\n        \"osvQueryStatus\": \"not-queried\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"not-queried\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"adonisjs-scheduler\",\n        \"version\": \"2.8.0\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/adonisjs-scheduler/2.8.0\",\n        \"registryIntegrity\": \"sha512-j2J6t4uHfJ4A4GvxD08HUDRsEJnz31pkmuG/FlJEPlWUKZ99x8qsuCKAuaCd+bPHzWHXtQOqf4e/eVIzclzEdQ==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"node-cron\",\n        \"version\": \"3.0.3\",\n        \"license\": \"ISC\",\n        \"registryURL\": \"https://registry.npmjs.org/node-cron/3.0.3\",\n        \"registryIntegrity\": \"sha512-dOal67//nohNgYWb+nWmg5dkFdIwDm8EpeGYMekPMrngV3637lqnX0lbUcCtgibHTz6SEz7DAIjKvKDFYCnO1A==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"uuid\",\n        \"version\": \"8.3.2\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/uuid/8.3.2\",\n        \"registryIntegrity\": \"sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [\n          \"GHSA-w5hq-g745-h8pq\"\n        ],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": [\n          \"GHSA-qmq6-f8pr-cx5x\",\n          \"GHSA-w5hq-g745-h8pq\"\n        ]\n      },\n      {\n        \"name\": \"@ajzinkyaw/adonis-lucid-soft-deletes\",\n        \"version\": \"2.1.0\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@ajzinkyaw/adonis-lucid-soft-deletes/2.1.0\",\n        \"registryIntegrity\": \"sha512-Qa9gXNmF3gGHd3vcpzlrKA9GYuKNRGSvRDVraiI7GacLz0sDFa6skxencuUdmip3krvTfYVatJrMvbHpWXlvqw==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"adonisjs-account-kit\",\n        \"version\": \"0.1.2\",\n        \"license\": null,\n        \"registryURL\": \"https://registry.npmjs.org/adonisjs-account-kit/0.1.2\",\n        \"registryIntegrity\": null,\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"not-queried\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@tanstack/react-virtual\",\n        \"version\": \"3.14.23\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@tanstack/react-virtual/3.14.23\",\n        \"registryIntegrity\": \"sha512-Oyy58qQwdaQieA+A4WUDtnh9D1rv5FZvGdw8og9Xeyh88V6HH94vMSyV5i9ATIbYNe9t5Ix0WXRo9NOTpHDkYw==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@tanstack/virtual-core\",\n        \"version\": \"3.19.8\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@tanstack/virtual-core/3.19.8\",\n        \"registryIntegrity\": \"sha512-Oz/SYBo/aVPyQkwtOw7Q23myITUgFIof2glQqydYJAPL6mH2SkJDkvDKZTklB+7gv5jGLZQhyTcd7SO1A1EODQ==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"react-hook-form\",\n        \"version\": \"7.91.0\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/react-hook-form/7.91.0\",\n        \"registryIntegrity\": \"sha512-5BEBUnCBwa28AFXYTYmOaB/+CSpJ/+CWVASHEvIGUzFdHyUiPHeRhG7r5hOZ8nZi0yP7pbHdFNXO/p31EKTJFQ==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@tanstack/react-form\",\n        \"version\": \"1.33.5\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@tanstack/react-form/1.33.5\",\n        \"registryIntegrity\": \"sha512-LlRB28qJwO/QCGaHvWnbdh4haBgTFiZVmzA2uzxSBS3YA7/IqrQ6HOBK70CkFQ+DbflZ7NawsmSln13h5iIdTA==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@tanstack/form-core\",\n        \"version\": \"1.33.5\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@tanstack/form-core/1.33.5\",\n        \"registryIntegrity\": \"sha512-3dfx9MBP0aq5sXKteikG629X9oviptrQj0IFRk9YGcb+lB7Kv5x8S17oOSk1wUWgjQZ4xVJEMbKwOAODymocgA==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@tanstack/react-store\",\n        \"version\": \"0.11.0\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@tanstack/react-store/0.11.0\",\n        \"registryIntegrity\": \"sha512-tX4YXh3PDkmpvGQWkWqKpzs/MSqbtuwY9dWdWhtV9Q50PmO+jOkUKIWIX4G85dwt7lxdHLXsiaEKPdKmC8F41w==\",\n        \"osvQueryStatus\": \"not-queried\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@tanstack/store\",\n        \"version\": \"0.11.0\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@tanstack/store/0.11.0\",\n        \"registryIntegrity\": \"sha512-WlzzCt3xi0G6pCAJu1U+2jiECwabETDpQDi3hfkFZvJii9AuZqEKbOiVarX1/bWhTNjU486yQtJCCasi/0q+Cw==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"not-queried\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@tanstack/pacer-lite\",\n        \"version\": \"0.1.1\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@tanstack/pacer-lite/0.1.1\",\n        \"registryIntegrity\": \"sha512-y/xtNPNt/YeyoVxE/JCx+T7yjEzpezmbb+toK8DDD1P4m7Kzs5YR956+7OKexG3f8aXgC3rLZl7b1V+yNUSy5w==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"not-queried\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@tanstack/devtools-event-client\",\n        \"version\": \"0.4.1\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@tanstack/devtools-event-client/0.4.1\",\n        \"registryIntegrity\": \"sha512-GRxmPw4OHZ2oZeIEUkEwt/NDvuEqzEYRAjzUVMs+I0pd4C7k1ySOiuJK2CqF+K/yEAR3YZNkW3ExrpDarh9Vwg==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"not-queried\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"use-sync-external-store\",\n        \"version\": \"1.6.0\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/use-sync-external-store/1.6.0\",\n        \"registryIntegrity\": \"sha512-Pp6GSwGP/NrPIrxVFAIkOQeyw8lFenOHijQWkUTrDvrF4ALqylP2C/KCkeS9dpUM3KvYRQhna5vt7IL95+ZQ9w==\",\n        \"osvQueryStatus\": \"not-queried\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"not-queried\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@fullcalendar/react\",\n        \"version\": \"7.1.3\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@fullcalendar/react/7.1.3\",\n        \"registryIntegrity\": \"sha512-tZNr0hylQwFy8bOEAiMRv6KCc0mVFlCFLDPdiSoo8IZz17WWe9feB0FnU902jKX/Gi7djDIzAhLCkDbgecCknw==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@fullcalendar/react-scheduler\",\n        \"version\": \"7.1.3\",\n        \"license\": \"SEE LICENSE IN LICENSE.md\",\n        \"registryURL\": \"https://registry.npmjs.org/@fullcalendar/react-scheduler/7.1.3\",\n        \"registryIntegrity\": \"sha512-GIFJsdbjilbxL7PV7coxlfOYVVbITjBF2bCTHwNtNoywXBpIUPDyFzZtudbQXVNmxXsjEnYEyxfI1UsrZvdISQ==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"fullcalendar-scheduler\",\n        \"version\": \"7.1.3\",\n        \"license\": \"SEE LICENSE IN LICENSE.md\",\n        \"registryURL\": \"https://registry.npmjs.org/fullcalendar-scheduler/7.1.3\",\n        \"registryIntegrity\": \"sha512-FiJxwQawRDcuGLcxtT2cC+sRdIuyya+rqZixNmNzOg/eO5/ov0XQzQN5mXXU/cISYzNP8xQiHDSlLBF60OSmUg==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@fullcalendar/core\",\n        \"version\": \"7.1.3\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@fullcalendar/core/7.1.3\",\n        \"registryIntegrity\": \"sha512-DLGXqX7CnuUQHH679FgE6+jc927wa708ydIcnfVx372IOK/OiDZjqc+IBwuKnu2EyqleCooDoAnUAcvXBhHosA==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"not-queried\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@full-ui/headless-calendar\",\n        \"version\": \"7.1.3\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@full-ui/headless-calendar/7.1.3\",\n        \"registryIntegrity\": \"sha512-CFomIp87osqY65Hlu2c0e2ZnofBe9tKOO8IoPzIfSPVDK/+aGz4Itj6mLu4xPjIvzRDQiopcVzYlip6u1bvYxw==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"not-queried\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@full-ui/headless-grid\",\n        \"version\": \"7.1.3\",\n        \"license\": \"SEE LICENSE IN LICENSE.md\",\n        \"registryURL\": \"https://registry.npmjs.org/@full-ui/headless-grid/7.1.3\",\n        \"registryIntegrity\": \"sha512-ocsIdYEupJyXHKUfii2kGe1MfmTVxZ7ldje6m2+Z6JWrT+G0keeB9fH/J3WDVWdA9WcQIEYfUfBuQZ/euveZ8Q==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"not-queried\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"temporal-polyfill\",\n        \"version\": \"1.0.1\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/temporal-polyfill/1.0.1\",\n        \"registryIntegrity\": \"sha512-N2SoI9olnW7BUsU8RosDphZQl9s+WJ8O7PoJMFCr/e5/1rFkVI4GNOWaSeySG+UoP04foPYsnLWbJmbXOiShZg==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"not-queried\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"temporal-spec\",\n        \"version\": \"1.0.0\",\n        \"license\": \"Apache-2.0\",\n        \"registryURL\": \"https://registry.npmjs.org/temporal-spec/1.0.0\",\n        \"registryIntegrity\": \"sha512-00Ahj1e1ifaERTMOIIGpOCdOo9IEk2m6GGSMedsn9a2SIsGLdOTbmME1Htv6IM82b6VHrzSUTIVc7YHy6hdhFQ==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"not-queried\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"temporal-utils\",\n        \"version\": \"1.0.1\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/temporal-utils/1.0.1\",\n        \"registryIntegrity\": \"sha512-HAixuesxFQIUaQk3ptX2jhfO/FsOkgVkDDMawvp6n/fkB1q6BKfs3lURw9I+pK/2e2e/q/vrLrxmeqauBoyGMQ==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"not-queried\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"preact\",\n        \"version\": \"10.29.8\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/preact/10.29.8\",\n        \"registryIntegrity\": \"sha512-ej2aVZ+vZ8WO7tvlQWRM9N63A0KzF9q4mWJfDUHgYaIofWY9hu74QdnQrjoPMmZi2/nZ5gN0bJCQF49xQqx09Q==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"not-queried\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@fullcalendar/resource-timeline\",\n        \"version\": \"6.1.22\",\n        \"license\": \"SEE LICENSE IN LICENSE.md\",\n        \"registryURL\": \"https://registry.npmjs.org/@fullcalendar/resource-timeline/6.1.22\",\n        \"registryIntegrity\": \"sha512-wAMP1oH8pyCwMvFhil2LApbLg+wzHz6dOa6YCqq+zjDcjp88WAt+jPf9kZhi0b/omlSN701rlbi12TkBfO0NVA==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"react-big-calendar\",\n        \"version\": \"1.20.0\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/react-big-calendar/1.20.0\",\n        \"registryIntegrity\": \"sha512-Lp1mvG34l/9xtb/2LsBb4UAF3iPcUkmDqbmpsvDHzp/n8GA5gtn3+nf8BsULWw08opKDgv38nQi75dQlOOqzkg==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@dnd-kit/react\",\n        \"version\": \"0.5.1\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@dnd-kit/react/0.5.1\",\n        \"registryIntegrity\": \"sha512-WL8LvALUL9PqUUVun4xu4e8HO3x6rPwTxnnNwovj/VOUVyWpTmIaAK5Yj8jkzqNK01W74sQbwtffpLep1Ckj/Q==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"ok\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@dnd-kit/dom\",\n        \"version\": \"0.5.1\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@dnd-kit/dom/0.5.1\",\n        \"registryIntegrity\": \"sha512-r7/l4D+nsH1mFXWkplXCkZC9JlY7UjxsVuTu4yCqzC00XgX+SXiK3Oazp42KKG3mshfBNVtm15BI9rKNlkw2fA==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"not-queried\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@dnd-kit/state\",\n        \"version\": \"0.5.1\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@dnd-kit/state/0.5.1\",\n        \"registryIntegrity\": \"sha512-SN0BZ0d/ob9dK8sTqk/0z3eNBWV6xPSrLbHUBbiCo9Sj3xfhPFk6ej2oZpDcqk7LWaujT57ocgdtznY7wQ2yFw==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"not-queried\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@dnd-kit/abstract\",\n        \"version\": \"0.5.1\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@dnd-kit/abstract/0.5.1\",\n        \"registryIntegrity\": \"sha512-XI13sUYRvRgggMocjHlQhLRgENm/2GF94KF7mk+c0uxse7sbn75r0BgxoNPDlzLTDPWx6PkS0YHoeXN9JWhnOA==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"not-queried\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@dnd-kit/geometry\",\n        \"version\": \"0.5.1\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@dnd-kit/geometry/0.5.1\",\n        \"registryIntegrity\": \"sha512-7X/Ro2U5qW96SihIukMitnc3pYc5n/PmHmJ28oApLBIJRfLxPLgrL6X0ZbQT7qUEfdUIqXnehobJ3jXAc4hdAA==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"not-queried\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@dnd-kit/collision\",\n        \"version\": \"0.5.1\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@dnd-kit/collision/0.5.1\",\n        \"registryIntegrity\": \"sha512-exQmBlWWQ6calIup4KNQudiEF8Do61Lpzw/F0M3UOhqdKi9dx0ZXGf+qfdfmew8rJzPMj3MzKeGqNMEbCKA22g==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"not-queried\",\n        \"githubAdvisories\": []\n      },\n      {\n        \"name\": \"@preact/signals-core\",\n        \"version\": \"1.10.0\",\n        \"license\": \"MIT\",\n        \"registryURL\": \"https://registry.npmjs.org/@preact/signals-core/1.10.0\",\n        \"registryIntegrity\": \"sha512-qlKeXlfqtlC+sjxCPHt6Sk0/dXBrKZVcPlianqjNc/vW263YBFiP5mRrgKpHoO0q222Thm1TdYQWfCKpbbgvwA==\",\n        \"osvQueryStatus\": \"ok\",\n        \"osvAdvisories\": [],\n        \"githubAdvisoryQueryStatus\": \"not-queried\",\n        \"githubAdvisories\": []\n      }\n    ],\n    \"transitiveFinding\": {\n      \"package\": \"uuid\",\n      \"version\": \"8.3.2\",\n      \"advisory\": \"GHSA-w5hq-g745-h8pq\",\n      \"cve\": \"CVE-2026-41907\",\n      \"dependencyPath\": \"adonisjs-scheduler@2.8.0 -> node-cron@3.0.3 -> uuid@8.3.2\",\n      \"impactBoundary\": \"The advisory concerns UUID v3/v5/v6 calls with caller buffers. Inspected node-cron 3.0.3 code calls uuid.v4 only; no affected call was identified. The candidate scheduler is not installed in the reviewed application.\",\n      \"publicAdvisoryURL\": \"https://github.com/advisories/GHSA-w5hq-g745-h8pq\",\n      \"osvURL\": \"https://osv.dev/vulnerability/GHSA-w5hq-g745-h8pq\",\n      \"nodeCronArtifact\": {\n        \"version\": \"3.0.3\",\n        \"license\": null,\n        \"tarballURL\": null,\n        \"registryIntegrity\": null,\n        \"tarballSHA256\": \"eacae1b8e837a047b603e311a6da175a93ffb56d2bd2ac1e8ec1cf02cea8a914\"\n      }\n    },\n    \"limits\": \"Passive evidence only; not an active security audit or safety clearance. Exact empty query results mean no matching record in the queried data source.\"\n  },\n  \"researchSources\": [\n    {\n      \"title\": \"TanStack Query: retries\",\n      \"url\": \"https://tanstack.com/query/latest/docs/framework/react/guides/query-retries\",\n      \"sourceType\": \"official documentation\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"TanStack Query: network modes\",\n      \"url\": \"https://tanstack.com/query/latest/docs/framework/react/guides/network-mode\",\n      \"sourceType\": \"official documentation\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"React Router: routing\",\n      \"url\": \"https://reactrouter.com/start/framework/routing\",\n      \"sourceType\": \"official documentation\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"React Router: data loading\",\n      \"url\": \"https://reactrouter.com/start/framework/data-loading\",\n      \"sourceType\": \"official documentation\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"date-fns releases\",\n      \"url\": \"https://github.com/date-fns/date-fns/releases\",\n      \"sourceType\": \"upstream source/release history\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"date-fns upstream commit history\",\n      \"url\": \"https://github.com/date-fns/date-fns/commits/main\",\n      \"sourceType\": \"upstream source history\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"Zustand persistence middleware\",\n      \"url\": \"https://github.com/pmndrs/zustand/blob/main/docs/reference/middlewares/persist.md\",\n      \"sourceType\": \"upstream documentation\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"Zustand README and source metadata\",\n      \"url\": \"https://github.com/pmndrs/zustand\",\n      \"sourceType\": \"upstream source and package metadata\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"React Hook Form releases\",\n      \"url\": \"https://github.com/react-hook-form/react-hook-form/releases\",\n      \"sourceType\": \"upstream source/release history\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"Vitest getting started and package requirements\",\n      \"url\": \"https://vitest.dev/guide/index.html\",\n      \"sourceType\": \"official documentation\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"Stryker Vitest runner\",\n      \"url\": \"https://stryker-mutator.io/docs/stryker-js/vitest-runner/\",\n      \"sourceType\": \"official documentation\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"Stryker troubleshooting: Vitest related tests not found\",\n      \"url\": \"https://stryker-mutator.io/docs/stryker-js/troubleshooting/#vitest-failed-to-find-test-files-related-to-mutated-files\",\n      \"sourceType\": \"official documentation\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"Playwright browser projects\",\n      \"url\": \"https://playwright.dev/docs/browsers\",\n      \"sourceType\": \"official documentation\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"Playwright running tests\",\n      \"url\": \"https://playwright.dev/docs/running-tests\",\n      \"sourceType\": \"official documentation\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"Tuyau documentation and source\",\n      \"url\": \"https://tuyau.dev/docs/introduction\",\n      \"sourceType\": \"upstream documentation\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"dnd-kit source repository\",\n      \"url\": \"https://github.com/clauderic/dnd-kit\",\n      \"sourceType\": \"upstream source\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"TanStack Virtual source repository\",\n      \"url\": \"https://github.com/TanStack/virtual\",\n      \"sourceType\": \"upstream source\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"FullCalendar source repository\",\n      \"url\": \"https://github.com/fullcalendar/fullcalendar\",\n      \"sourceType\": \"upstream source\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"React Big Calendar package manifest\",\n      \"url\": \"https://github.com/bigcalendar/react-big-calendar/blob/master/package.json\",\n      \"sourceType\": \"upstream package manifest/source\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"FullCalendar React package manifest\",\n      \"url\": \"https://github.com/fullcalendar/fullcalendar-react/blob/main/package.json\",\n      \"sourceType\": \"upstream package manifest/source\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"FullCalendar changelog and premium licensing\",\n      \"url\": \"https://github.com/fullcalendar/fullcalendar/blob/main/CHANGELOG.md\",\n      \"sourceType\": \"upstream changelog/source\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"dnd-kit React adapter package manifest\",\n      \"url\": \"https://github.com/clauderic/dnd-kit/blob/main/packages/react/package.json\",\n      \"sourceType\": \"upstream package manifest/source\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"dnd-kit repository overview\",\n      \"url\": \"https://github.com/clauderic/dnd-kit\",\n      \"sourceType\": \"upstream source and project documentation\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"TanStack React Virtual package manifest\",\n      \"url\": \"https://github.com/TanStack/virtual/blob/main/packages/react-virtual/package.json\",\n      \"sourceType\": \"upstream package manifest/source\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"TanStack Virtual package release commit\",\n      \"url\": \"https://github.com/TanStack/virtual/commit/78371e8\",\n      \"sourceType\": \"upstream versioning commit\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"dnd-kit DOM package changelog\",\n      \"url\": \"https://github.com/clauderic/dnd-kit/blob/main/packages/dom/CHANGELOG.md\",\n      \"sourceType\": \"upstream changelog/source\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"React Big Calendar v1.20.0 release\",\n      \"url\": \"https://github.com/bigcalendar/react-big-calendar/releases\",\n      \"sourceType\": \"upstream release history\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"npm registry metadata: @tanstack/react-virtual 3.14.23\",\n      \"url\": \"https://registry.npmjs.org/@tanstack%2Freact-virtual\",\n      \"sourceType\": \"npm registry packument\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"npm registry metadata: @tanstack/virtual-core 3.19.8\",\n      \"url\": \"https://registry.npmjs.org/@tanstack%2Fvirtual-core\",\n      \"sourceType\": \"npm registry packument and tarball\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"npm registry metadata: react-hook-form 7.91.0\",\n      \"url\": \"https://registry.npmjs.org/react-hook-form\",\n      \"sourceType\": \"npm registry packument and tarball\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"npm registry metadata: @tanstack/react-form 1.33.5\",\n      \"url\": \"https://registry.npmjs.org/@tanstack%2Freact-form\",\n      \"sourceType\": \"npm registry packument and tarball\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"npm registry metadata: @fullcalendar/react 7.1.3\",\n      \"url\": \"https://registry.npmjs.org/@fullcalendar%2Freact\",\n      \"sourceType\": \"npm registry packument and tarball\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"npm registry metadata: @fullcalendar/resource-timeline 6.1.22\",\n      \"url\": \"https://registry.npmjs.org/@fullcalendar%2Fresource-timeline\",\n      \"sourceType\": \"npm registry packument and tarball\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"npm registry metadata: @dnd-kit/react 0.5.1\",\n      \"url\": \"https://registry.npmjs.org/@dnd-kit%2Freact\",\n      \"sourceType\": \"npm registry packument and tarball\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"npm registry metadata: react-big-calendar 1.20.0\",\n      \"url\": \"https://registry.npmjs.org/react-big-calendar\",\n      \"sourceType\": \"npm registry packument\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"FullCalendar v7 official license terms\",\n      \"url\": \"https://fullcalendar.io/license\",\n      \"sourceType\": \"official license documentation\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"FullCalendar v7 official premium plugins docs\",\n      \"url\": \"https://fullcalendar.io/docs/premium\",\n      \"sourceType\": \"official docs\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"FullCalendar v7 timeline view docs\",\n      \"url\": \"https://fullcalendar.io/docs/timeline-view\",\n      \"sourceType\": \"official docs\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"FullCalendar v7 plugin index\",\n      \"url\": \"https://fullcalendar.io/docs/plugin-index\",\n      \"sourceType\": \"official docs\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"npm registry metadata and artifacts: FullCalendar v7 scheduler packages\",\n      \"url\": \"https://registry.npmjs.org/%40fullcalendar%2Freact-scheduler\",\n      \"sourceType\": \"npm registry packument and tarballs\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"npm registry metadata: @tanstack/react-virtual 3.14.23\",\n      \"url\": \"https://registry.npmjs.org/@tanstack%2Freact-virtual\",\n      \"sourceType\": \"npm registry packument\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"npm registry metadata: @tanstack/virtual-core 3.19.8\",\n      \"url\": \"https://registry.npmjs.org/@tanstack%2Fvirtual-core\",\n      \"sourceType\": \"npm registry packument and tarball\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"npm registry metadata: react-hook-form 7.91.0\",\n      \"url\": \"https://registry.npmjs.org/react-hook-form\",\n      \"sourceType\": \"npm registry packument and tarball\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"npm registry metadata: @tanstack/react-form 1.33.5\",\n      \"url\": \"https://registry.npmjs.org/@tanstack%2Freact-form\",\n      \"sourceType\": \"npm registry packument and tarball\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"npm registry metadata: @fullcalendar/react 7.1.3\",\n      \"url\": \"https://registry.npmjs.org/@fullcalendar%2Freact\",\n      \"sourceType\": \"npm registry packument and tarball\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"npm registry metadata: @fullcalendar/resource-timeline 6.1.22\",\n      \"url\": \"https://registry.npmjs.org/@fullcalendar%2Fresource-timeline\",\n      \"sourceType\": \"npm registry packument and tarball\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"npm registry metadata: @dnd-kit/react 0.5.1\",\n      \"url\": \"https://registry.npmjs.org/@dnd-kit%2Freact\",\n      \"sourceType\": \"npm registry packument and tarball\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"npm registry metadata: react-big-calendar 1.20.0\",\n      \"url\": \"https://registry.npmjs.org/react-big-calendar\",\n      \"sourceType\": \"npm registry packument\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"TanStack Virtual upstream React tests\",\n      \"url\": \"https://github.com/TanStack/virtual/tree/main/packages/react-virtual/tests\",\n      \"sourceType\": \"upstream test source\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"TanStack Form upstream React tests\",\n      \"url\": \"https://github.com/TanStack/form/tree/main/packages/react-form/tests\",\n      \"sourceType\": \"upstream test source\",\n      \"accessed\": \"2026-10-26\"\n    },\n    {\n      \"title\": \"React Hook Form release-pinned test suite\",\n      \"url\": \"https://github.com/react-hook-form/react-hook-form/tree/de3c9469df8b28315265178b58909ee05aa57b74/src/__tests__\",\n      \"sourceType\": \"upstream release-pinned test source\",\n      \"accessed\": \"2026-10-26\"\n    }\n  ],\n  \"issueSnapshots\": [\n    {\n      \"number\": 1553,\n      \"title\": \"AdonisJS alignment programme: delivery tracker (Now / Next / Future)\",\n      \"state\": \"OPEN\",\n      \"url\": \"https://github.com/Kevinjohn/capacitylens/issues/1553\",\n      \"snapshotDate\": \"2026-10-26\"\n    },\n    {\n      \"number\": 1554,\n      \"title\": \"AdonisJS alignment \\u2014 Now tracker (B0\\u2013B6, twelve ordered issues)\",\n      \"state\": \"CLOSED\",\n      \"url\": \"https://github.com/Kevinjohn/capacitylens/issues/1554\",\n      \"snapshotDate\": \"2026-10-26\"\n    },\n    {\n      \"number\": 1555,\n      \"title\": \"AdonisJS alignment \\u2014 Next tracker (X1\\u2013X5)\",\n      \"state\": \"OPEN\",\n      \"url\": \"https://github.com/Kevinjohn/capacitylens/issues/1555\",\n      \"snapshotDate\": \"2026-10-26\"\n    },\n    {\n      \"number\": 1556,\n      \"title\": \"AdonisJS alignment \\u2014 Future tracker (draft: F1 starter direction)\",\n      \"state\": \"OPEN\",\n      \"url\": \"https://github.com/Kevinjohn/capacitylens/issues/1556\",\n      \"snapshotDate\": \"2026-10-26\"\n    },\n    {\n      \"number\": 1595,\n      \"title\": \"Type ordinary auth and read requests through Vine and Tuyau\",\n      \"state\": \"OPEN\",\n      \"url\": \"https://github.com/Kevinjohn/capacitylens/issues/1595\",\n      \"snapshotDate\": \"2026-10-26\"\n    },\n    {\n      \"number\": 1596,\n      \"title\": \"Type the product HTTP error contract without changing validation status\",\n      \"state\": \"OPEN\",\n      \"url\": \"https://github.com/Kevinjohn/capacitylens/issues/1596\",\n      \"snapshotDate\": \"2026-10-26\"\n    },\n    {\n      \"number\": 1597,\n      \"title\": \"Move action proofs to Account Kit only after transactional parity\",\n      \"state\": \"OPEN\",\n      \"url\": \"https://github.com/Kevinjohn/capacitylens/issues/1597\",\n      \"snapshotDate\": \"2026-10-26\"\n    },\n    {\n      \"number\": 1598,\n      \"title\": \"Include schema integrity in Adonis readiness health checks\",\n      \"state\": \"OPEN\",\n      \"url\": \"https://github.com/Kevinjohn/capacitylens/issues/1598\",\n      \"snapshotDate\": \"2026-10-26\"\n    },\n    {\n      \"number\": 1599,\n      \"title\": \"Next 1.1 \\u2014 AdonisJS integration follow-ups\",\n      \"state\": \"OPEN\",\n      \"url\": \"https://github.com/Kevinjohn/capacitylens/issues/1599\",\n      \"snapshotDate\": \"2026-10-26\"\n    },\n    {\n      \"number\": 1600,\n      \"title\": \"Mutation testing runs no tests on the AdonisJS branch\",\n      \"state\": \"OPEN\",\n      \"url\": \"https://github.com/Kevinjohn/capacitylens/issues/1600\",\n      \"snapshotDate\": \"2026-10-26\"\n    },\n    {\n      \"number\": 1601,\n      \"title\": \"Prove a native upgrade between AdonisJS release archives\",\n      \"state\": \"OPEN\",\n      \"url\": \"https://github.com/Kevinjohn/capacitylens/issues/1601\",\n      \"snapshotDate\": \"2026-10-26\"\n    },\n    {\n      \"number\": 1602,\n      \"title\": \"Document CapacityLens runtime and dependency upgrade policy\",\n      \"state\": \"OPEN\",\n      \"url\": \"https://github.com/Kevinjohn/capacitylens/issues/1602\",\n      \"snapshotDate\": \"2026-10-26\"\n    }\n  ],\n  \"pullRequestSnapshots\": {\n    \"merged\": [\n      {\n        \"number\": 1589,\n        \"state\": \"MERGED\",\n        \"url\": \"https://github.com/Kevinjohn/capacitylens/pull/1589\"\n      },\n      {\n        \"number\": 1590,\n        \"state\": \"MERGED\",\n        \"url\": \"https://github.com/Kevinjohn/capacitylens/pull/1590\"\n      },\n      {\n        \"number\": 1592,\n        \"state\": \"MERGED\",\n        \"url\": \"https://github.com/Kevinjohn/capacitylens/pull/1592\"\n      },\n      {\n        \"number\": 1593,\n        \"state\": \"MERGED\",\n        \"url\": \"https://github.com/Kevinjohn/capacitylens/pull/1593\"\n      },\n      {\n        \"number\": 1594,\n        \"state\": \"MERGED\",\n        \"url\": \"https://github.com/Kevinjohn/capacitylens/pull/1594\"\n      },\n      {\n        \"number\": 1606,\n        \"state\": \"MERGED\",\n        \"url\": \"https://github.com/Kevinjohn/capacitylens/pull/1606\"\n      }\n    ],\n    \"open\": [\n      {\n        \"number\": 1591,\n        \"state\": \"OPEN\",\n        \"url\": \"https://github.com/Kevinjohn/capacitylens/pull/1591\",\n        \"codeIntegratedInMergedStack\": true\n      }\n    ],\n    \"branchNotReviewed\": true,\n    \"context\": \"PR #1591 remains open although its commit is in the merged stack; the newer branch is a state snapshot, not a reviewed baseline.\"\n  },\n  \"branchDelta\": {\n    \"head\": \"f52bee5fe75604b33c1191294a80259825461aba\",\n    \"commitsAhead\": 28,\n    \"changedPathsSinceFrozenBaseline\": 102,\n    \"reviewedAsNewBaseline\": false,\n    \"note\": \"Current branch evidence is a graph/state snapshot only; no review conclusion is extended to these newer paths.\"\n  },\n  \"reportSections\": {\n    \"framework\": {\n      \"url\": \"#file-framework-alignment-md\",\n      \"title\": \"Framework and ecosystem alignment \\u2014 capability map and disposition\"\n    },\n    \"ecosystem\": {\n      \"url\": \"#file-ecosystem-adoption-md\",\n      \"title\": \"Existing ecosystem adoption \\u2014 capability and candidate matrix\"\n    },\n    \"extraction\": {\n      \"url\": \"#file-reusable-opportunities-md\",\n      \"title\": \"Reusable package opportunities \\u2014 decision frame\"\n    }\n  },\n  \"sourceIntegrityNote\": \"An imported coverage JSON sidecar needed a mechanical syntax repair; its original was preserved and hashed, with property keys inserted only.\",\n  \"coverageRationaleCodes\": {\n    \"SUBSYSTEM_SOURCE_REVIEW\": {\n      \"framework\": \"Framework fit was assessed from source at subsystem level; no runtime coverage is implied.\",\n      \"ecosystem\": \"Package fit was assessed at subsystem level; candidate compatibility tests were not run.\",\n      \"extraction\": \"Reuse boundaries were assessed at subsystem level; no second consumer is assumed.\"\n    },\n    \"DOCKER_SCOPE\": {\n      \"allLenses\": \"The explicit Docker boundary excludes semantic review; the path remains in the source inventory.\"\n    }\n  },\n  \"sourceURLPolicy\": \"Each coverage path is relative to the repository root and pinned by source.revision; construct its public blob URL using the repository URL and that revision. Source-level observation URLs include line anchors.\",\n  \"finalAuditState\": \"delivered separately\",\n  \"currentBranchReviewed\": false,\n  \"coverageSidecarCorrection\": {\n    \"originalSHA256\": \"0e35978370a87fea4ecb1158d4345ab8459a015994fef3caf8de8455fad769f6\",\n    \"correction\": \"Inserted 43 omitted JSON property keys only; evidence text, paths and dispositions were unchanged.\",\n    \"originalPreserved\": true,\n    \"publicNote\": \"An imported coverage JSON sidecar needed a mechanical syntax repair before use.\"\n  },\n  \"effectiveProofAdjudications\": {\n    \"sourceRevision\": \"6c92d3710ed1d30bc925bd97e5d701ea551db452\",\n    \"authority\": \"Final behavioral and proof adjudication; supersedes historical candidate wording. No new executions were performed for this reconciliation.\",\n    \"proofExecutions\": [\n      {\n        \"observationId\": \"OBS-000061\",\n        \"validationRefs\": [\n          \"VAL-000015\"\n        ],\n        \"subsystem\": \"Workspace, scripts, CI and release packaging\",\n        \"effectiveActual\": \"The root mutation invocation instrumented 115 files and 8,003 mutants but discovered no tests and exited 1. related:false alone and with dir:apps/frontend did not repair discovery; workspace-local direct Vitest listing found tests.\",\n        \"effectiveImpact\": \"Mutation testing supplies no test execution or mutation score under the reviewed configuration. Root/cwd mismatch remains a hypothesis, not an accepted fix.\",\n        \"effectiveProof\": \"Supported-runtime isolated Stryker execution, Node24.21.0/pnpm11.4.0/Stryker9.6.1/Vitest4.1.11; no source changes.\",\n        \"remainingLimits\": [\n          \"No accepted fix or full mutation campaign\",\n          \"Direct test listing is not a passing application suite\"\n        ]\n      },\n      {\n        \"observationId\": \"OBS-000029\",\n        \"validationRefs\": [\n          \"VAL-000016\"\n        ],\n        \"subsystem\": \"Shared domain rules and wire contracts\",\n        \"effectiveActual\": \"activeOnly retains a project-bound placeholder beneath an archived project, while the real time-off write validator rejects the same resource as effectively inactive.\",\n        \"effectiveImpact\": \"Normal active resource availability conflicts with write acceptance.\",\n        \"effectiveProof\": \"Four-case isolated real-function probe: three controls passed and one desired projection assertion failed. Controls preserve active sibling, unresolved/cross-company diagnostic references and input immutability.\",\n        \"remainingLimits\": [\n          \"No live UI or server-database execution\",\n          \"No source fix or full suite\",\n          \"Archive-confirmation copy semantics remain separate\"\n        ]\n      },\n      {\n        \"observationId\": \"OBS-000033\",\n        \"validationRefs\": [\n          \"VAL-000017\"\n        ],\n        \"subsystem\": \"Frontend planning cache and scheduling interactions\",\n        \"effectiveActual\": \"While inline activity creation for Project A is pending, the user selects Project B and its activity. A late completion preserves Project B but replaces its activity selection with the out-of-scope A activity; the picker becomes blank. Save refuses validation and creates no allocation.\",\n        \"effectiveImpact\": \"Lost activity selection and a blocked save; wrong-project allocation persistence is not established.\",\n        \"effectiveProof\": \"Real rendered AllocationModal controls plus deferred store action under Node24.21.0/pnpm11.4.0/Vitest4.1.11. One test passed by asserting this baseline regression; unchanged source/test hashes and full durable rerun log preserved.\",\n        \"remainingLimits\": [\n          \"No wrong-project persistence proved\",\n          \"No duplicate-create behavior proved by this test\",\n          \"No full suite, E2E, CI or production run\"\n        ]\n      }\n    ]\n  }\n}\n\n\n# Supporting evidence\n\nEvidence captured 2026-10-26 for frozen source revision [`6c92d3710ed1d30bc925bd97e5d701ea551db452`](https://github.com/Kevinjohn/capacitylens/tree/6c92d3710ed1d30bc925bd97e5d701ea551db452). Baseline integrity verification matched all 1,770 tracked snapshot file bytes to their Git blobs; the isolated placeholder and mutation probes also recorded zero before/after source changes and the same source-tree hash. This supplement records three bounded baseline probes, the later merged-branch and issue reconciliation, and passive package advisory research. It does not review the later integrated branch as a new baseline.\n\n## Inline activity pending-request probe {#validation-inline-activity}\n\nThe focused UI probe reproduced a user-visible draft regression on the frozen source. While adding an activity under Project A was pending, the user could switch to Project B and select an existing B activity. When the A request completed, its result replaced the selected activity ID. The picker then appeared blank because that activity was outside B's scope; submission marked Activity invalid, kept the modal open, and created no allocation. This is lost user input, not an incorrectly attributed saved allocation.\n\nThe probe used the real allocation modal, project/activity controls, selection handlers, and a deferred wrapper around the original store action. It did not call hook setters directly. The source trace is in [`AllocationTargetFields.tsx`](https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/components/scheduler/AllocationTargetFields.tsx), [`useAllocationTargetState.ts`](https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/components/scheduler/useAllocationTargetState.ts), and [`typedPlanningActions.ts`](https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/apps/frontend/src/store/typedPlanningActions.ts). The project selector and inline add button receive no disabled/pending state; completion unconditionally selects the created activity after awaiting the store action.\n\n**Executed check:** Node `v24.21.0`, pnpm `11.4.0`, Vitest `4.1.11`; the exact isolated scratch-only invocation was `node ../../node_modules/.pnpm/vitest@4.1.11_@types+node@24.13.6_@vitest+coverage-v8@4.1.11_jsdom@29.1.1_vite@8.3.1_@types+node@24.13.6_yaml@2.9.1_/node_modules/vitest/vitest.mjs run src/components/scheduler/inlineActivityPendingRace.validation.test.tsx`. Result: 1 test passed because it asserted the observed baseline regression. The same focused test was rerun to retain complete output; it again passed. The scratch probe SHA-256 is `e2c25458a79ec86574b0fa34a93562d2995851fe58b5cf0f26d997988bdafe33`; durable runner-log SHA-256 is `95caff23e98f4b0ad18af78d0fd2a58b79d8318d1ba8dee8e83448c9512edc5d`. The rerun changed no source, probe, dependency setup, or scope. Source/test hashes were confirmed unchanged across it.\n\nAn initial package-manager invocation stopped before running tests because pnpm refused to reconcile a symlinked shared dependency directory in a non-interactive session. The test was run using the already-installed Vitest launcher under the pinned Node runtime; no install or dependency-tree modification occurred. This is focused baseline evidence, not a fix or full-suite, E2E, production-browser, or CI validation.\n\n## Placeholder projection probe {#validation-placeholder-projection}\n\nAn isolated probe found a mismatch between resource projection and write validation. `activeOnly()` retained a resource belonging to an archived project, even though the time-off write validator rejected that same resource as effectively inactive. The expected projection for this probe retained only the active-project resource. Controls showed that projection hid archived projects without mutating input and retained unresolved or cross-company references for integrity diagnosis. No implementation was made.\n\nThe relevant frozen-source paths are [`projection.ts`](https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/packages/shared/src/domain/lifecycle/projection.ts), [`ancestry.ts`](https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/packages/shared/src/domain/lifecycle/ancestry.ts), and [`validationLookup.ts`](https://github.com/Kevinjohn/capacitylens/blob/6c92d3710ed1d30bc925bd97e5d701ea551db452/packages/shared/src/domain/validationLookup.ts). The existing mutation coverage exercises write refusal for an archived-project placeholder; the projection tests lacked this resource-parent case.\n\n**Executed check:** Node `v24.21.0`, pnpm `11.4.0`, Vitest `4.1.11`; isolated scratch invocation `../../node_modules/.bin/vitest run --config vitest.config.ts src/domain/lifecyclePlaceholder.probe.test.ts` (after selecting Node `24.21.0` from `.nvmrc`). Result: four tests, three passed and one expected baseline assertion failed (exit 1), explicitly showing the archived-project resource in the actual projection. Probe SHA-256: `4af080d1194b6c3a9e043b19d7b895ad1bd7bfc77971073cbf2f39445e811c56`. Run-log SHA-256: `6285a316a685a1df00d605108dc203ff51b39ca966ae4cfad758cc06c934ba50`. The archived source inventory covered 1,770 tracked paths; before/after comparison found zero changes. Its source-tree hash was `08f5b00afd1ab7c2c2897b0b983bcb466ca40b96401209baebe1535a47c31ef9`.\n\nA package-manager invocation stopped before test execution when pnpm declined shared-module reconciliation; the existing Vitest launcher was used instead. This does not cover live UI/server behavior, archive-confirmation copy, or the broad suite.\n\n## Mutation test discovery probe {#validation-mutation}\n\nThe reported Stryker/Vitest discovery failure reproduced against the frozen snapshot. Stryker instrumented 115 files and 8,003 mutants, then related-test lookup found no tests; the command exited 1 with \u201cNo tests were executed.\u201d Setting `vitest.related` to `false`, and then combining it with `vitest.dir: \"apps/frontend\"`, still did not discover tests. Direct Vitest listing from the frontend workspace succeeded and emitted 3,944 test-case rows. Workspace-relative include paths make a root/cwd mismatch plausible, but the failed `dir` comparison means this is not an accepted fix; the Stryker/Vitest version interaction remains possible.\n\n**Executed check:** Node `24.21.0`, pnpm `11.4.0`, Stryker core and Vitest runner `9.6.1`, Vitest `4.1.11`; `pnpm exec stryker run --dryRunOnly` reproduced the no-tests failure. The official [Stryker Vitest runner configuration](https://stryker-mutator.io/docs/stryker-js/vitest-runner/) and [troubleshooting entry](https://github.com/stryker-mutator/stryker-js/blob/master/docs/troubleshooting.md#vitest-failed-to-find-test-files-related-to-mutated-files) describe related-test settings, but this repository's attempts show that setting alone is insufficient here. The source-tree hash before and after was `08f5b00afd1ab7c2c2897b0b983bcb466ca40b96401209baebe1535a47c31ef9`.\n\nThe frozen install initially encountered a registry DNS failure and succeeded on the same frozen-lockfile command through an authorized route. Shared package build and Paraglide compilation passed in the isolated copy. Stryker's logging server initially hit a sandbox bind restriction; the same dry run then started and reproduced the issue. No accepted fix or candidate package installation resulted. No application test suite was run as part of this investigation, and this does not establish a full mutation run.\n\n## Merged branch delta {#merged-branch-delta}\n\nThe review baseline remains frozen at `6c92d3710ed1d30bc925bd97e5d701ea551db452`. A later GitHub snapshot reported `platform/adonisjs` at `f52bee5fe75604b33c1191294a80259825461aba`, 28 commits and 102 changed paths ahead of that baseline. This supplement does not review or clear that integrated branch as a new baseline.\n\nSix PRs captured earlier as open later reported **MERGED**: #1589, #1590, #1592, #1593, #1594, and #1606. Their actual merge ancestry is a stack: #1589 \u2192 #1590 \u2192 #1593 \u2192 #1592 \u2192 #1591 \u2192 #1594 \u2192 #1606. PR #1591 remains formally **OPEN**, although its merge commit is the first parent of #1594's merge, so its code is in the integrated ancestry. Its formal state and its linked issue remain open. #1589's final merge wraps the stack tip back onto the frozen baseline; its aggregate merge is not attributable only to its earlier fixture-helper diff.\n\nThe six earlier PR comparisons shared the frozen merge base and reported zero commits behind. #1590 partially advances #1595/#1596 by adding an export-query validator/generated query type and product error normalization/tests. #1593 adds generated route names and success response types, but its auth client retains raw fetch and `body: unknown`, and the state query remains manually assembled. These do not close either issue. No relevant captured PR changes the action-proof service (#1597) or readiness path (#1598). #1594 does not repair the Stryker discovery failure (#1600); #1606 adds a separate changed-files checker, not a mutation runner fix.\n\nOther scoped delta observations remain qualified. #1594 moves the UI config next to the frontend workspace, addressing the observed root CSS-path mismatch, but a focused `pnpm run ui:check` on the integrated tree remains needed before carrying it as confirmed. The readiness duplication remains unaddressed. The distinct-release upgrade rehearsal (#1601) is conditional on two supported archives. The release archive final-path publication concern remains applicable because #1594's change in that script concerns development-package inventory, not archive publication. Fresh issue snapshots showed #1595\u2013#1602 open; #1599 remains the follow-up tracker for #1595\u2013#1598.\n\nVisible current checks showed lint and type-check passing on the six merged PRs; documentation build passed for #1589, #1592, #1594, and #1606. The captured current check snapshots did not show E2E or the full gate on exact integrated head `f52bee5\u2026`. #1591's PR body reports gate/E2E success on its stack, but the current visible check display showed only a skipped explanatory check; that report is not independently visible current check evidence. These comparisons update overlap only and do not review the 102-path integrated delta.\n\n## Issue overlap and status {#issue-overlap}\n\nIssue state records plans and trackers; frozen source and scoped PR deltas establish behavior. As of the 2026-10-26 fresh snapshot, #1595 (ordinary request/body/query typing), #1596 (typed product HTTP error contract), #1597 (transactional action-proof parity), #1598 (schema-integrity readiness), #1599 (follow-up tracker), #1600 (mutation test discovery), #1601 (distinct-release upgrade rehearsal), and #1602 (runtime/dependency policy documentation) were **OPEN**. #1599 is separate follow-up tracking for #1595\u2013#1598. #1601 is conditional on the availability of two supported release archives. None authorizes implementation within the review-only scope.\n\nThe earlier 16:32 capture held six PRs as open proposals; the later snapshot changed those six to merged. Their saved proposal diffs remain evidence of earlier scope, while merge objects and parent relationships establish landed ancestry. #1591 is the exception: its code is in the stack, but the PR and linked issue remain formally open. Do not equate an open issue with absent code or infer completion from a partial merged capability.\n\nAdditional explicit boundaries: #1553 is the delivery tracker; #1554 is closed, while #1555 and #1556 are open. #1482 is the canonical historical PRD, with later owner decisions superseding older assumptions. The older #1556 reusable-starter direction remains a draft and depends on a sibling-repository inventory and completion of Next; it does not authorize extracting product-specific scheduling, planning revision, restoration, confidentiality, or lifecycle rules. These states are planning context, not executed checks.\n\n## Passive package advisory review {#passive-advisory-review}\n\nOn 2026-10-26, a passive metadata and advisory check covered 15 candidate groups and 39 package records, including 18 exact npm candidate versions queried against OSV and the GitHub Advisory Database. Direct and selected transitive package pins/floors were queried. No candidate is directly installed in the frozen source. No package was installed, no new lock graph was resolved, and no code or tests were run. An empty exact-version query means only that the queried source returned no matching record; it is not a security clearance.\n\nOne conditional transitive advisory was found: `adonisjs-scheduler@2.8.0` declares `node-cron@^3.0.2`; registry metadata showed `node-cron@3.0.3`, whose manifest pins `uuid@8.3.2`. OSV reports [GHSA-w5hq-g745-h8pq / CVE-2026-41907](https://github.com/advisories/GHSA-w5hq-g745-h8pq) for the uuid version. The described affected calls involve uuid v3/v5/v6 with an undersized buffer or invalid offset. Static inspection of the integrity-matched node-cron 3.0.3 artifact found only `uuid.v4()` use for generated task IDs, outside the affected functions; no affected call was identified in that inspected path. `adonisjs-scheduler` is not currently installed. This remains a transitive advisory to preserve if that candidate is considered later, not evidence of an installed vulnerable path.\n\nThe OSV malware record for `react-hook-form` named version `7.73.0`; candidate `7.91.0` did not match that record or exact-version GitHub Advisory results. Unpublished Account Kit, Masquerade, and soft-delete source commits returned no OSV GIT records; they have no npm release in the reviewed state, so an npm 404 is not an advisory no-result. The published older soft-delete artifact declares Core `^6.2.3`, so the available artifact does not establish compatibility with the newer upstream branch.\n\nThe review also compared declared dependencies, peer ranges, licenses, and ownership boundaries. It did not resolve candidate caret ranges into a new lockfile or establish package runtime, accessibility, scheduler, audit-record, form, or drag-and-drop parity. FullCalendar premium licensing eligibility was not established from metadata. No npm audit or scanner ran. This is a bounded passive check, not an ecosystem-wide vulnerability assessment, source-level security audit, exploitability finding, or legal clearance.\n\nSources: [npm Registry API](https://registry.npmjs.org/), [OSV query API](https://api.osv.dev/v1/query), [GitHub Advisory Database](https://github.com/advisories), and [OSV advisory record](https://osv.dev/vulnerability/GHSA-w5hq-g745-h8pq).\n", "url": "https://gist.github.com/Kevinjohn/9c7367be1c8231f260ed1e3c3136535c"}, {"timestamp": "2026-10-26T21:10:00.170Z", "date_only": false, "value": "2026-10-26T21:10:00.170", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-41907", "record": "FKIE_CVE-2026-41907", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-30T11:04:40.824Z", "date_only": false, "value": "2026-10-30T11:04:40.824408Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-RZ17218", "record": "CLEANSTART-2026-RZ17218", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T15:23:30.232Z", "date_only": false, "value": "2026-10-30T15:23:30.232713Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-QS50818", "record": "CLEANSTART-2026-QS50818", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-07T05:57:39Z", "date_only": false, "value": "2026-11-07T05:57:39+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-07T05:57:39Z", "date_only": false, "value": "2026-11-07T05:57:39+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-07T05:57:39Z", "date_only": false, "value": "2026-11-07T05:57:39+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:56928", "record": "RHSA-2026:56928", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2923", "record": "WID-SEC-W-2026-2923", "field": "document.tracking.revision_history.14.date", "linked_record": true}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2923", "record": "WID-SEC-W-2026-2923", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-09T11:12:27.096Z", "date_only": false, "value": "2026-11-09T11:12:27.096+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2923", "record": "WID-SEC-W-2026-2923", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-10T17:16:50Z", "date_only": false, "value": "2026-11-10T17:16:50Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-DS96104", "record": "CLEANSTART-2026-DS96104", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-11T00:41:36.928Z", "date_only": false, "value": "2026-11-11T00:41:36.928572Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-DS96104", "record": "CLEANSTART-2026-DS96104", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T09:02:14Z", "date_only": false, "value": "2026-11-11T09:02:14+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-11T09:02:14Z", "date_only": false, "value": "2026-11-11T09:02:14+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-11T09:02:14Z", "date_only": false, "value": "2026-11-11T09:02:14+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "document.tracking.current_release_date", "linked_record": true}], "metrics": {"as_of": "2026-11-11T11:50:41.148Z", "anchors": {"origin": {"timestamp": "2026-04-02T00:00:00Z", "date_only": false, "value": "2026-04-02T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-41907", "record": "MSRC_CVE-2026-41907", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": {"timestamp": "2026-04-24T19:02:43.860Z", "date_only": false, "value": "2026-04-24T19:02:43.860767+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.34.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-04-02T00:00:00Z", "date_only": false, "value": "2026-04-02T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-41907", "record": "MSRC_CVE-2026-41907", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": {"timestamp": "2026-04-19T15:20:09Z", "date_only": false, "value": "2026-04-19T15:20:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://api.github.com/repos/uuidjs/uuid/security-advisories/GHSA-w5hq-g745-h8pq", "record": "CVE-2026-41907", "field": "creation_timestamp", "uuid": "effcdc92-e8e3-47c9-afd6-c99023bbc7df", "url": "https://api.github.com/repos/uuidjs/uuid/security-advisories/GHSA-w5hq-g745-h8pq", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": {"timestamp": "2026-08-18T18:22:46Z", "date_only": false, "value": "2026-08-18T18:22:46+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.34.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 1524009.0, "hours": 423.3358333333333, "days": 17.638993055555556, "min_seconds": 1437609.0, "max_seconds": 1524009.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-04-02T00:00:00Z", "date_only": false, "value": "2026-04-02T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-41907", "record": "MSRC_CVE-2026-41907", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-04-19T15:20:09Z", "date_only": false, "value": "2026-04-19T15:20:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://api.github.com/repos/uuidjs/uuid/security-advisories/GHSA-w5hq-g745-h8pq", "record": "CVE-2026-41907", "field": "creation_timestamp", "uuid": "effcdc92-e8e3-47c9-afd6-c99023bbc7df", "url": "https://api.github.com/repos/uuidjs/uuid/security-advisories/GHSA-w5hq-g745-h8pq", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start"]}, "total_time_to_patch": {"available": true, "seconds": 10020002.14, "hours": 2783.3339277777777, "days": 115.97224699074074, "min_seconds": 10020002.14, "max_seconds": 10020002.14, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-04-24T19:02:43.860Z", "date_only": false, "value": "2026-04-24T19:02:43.860767+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.34.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-08-18T18:22:46Z", "date_only": false, "value": "2026-08-18T18:22:46+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.34.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, "discovery_after_disclosure": true}, "disclosure_to_patch": {"available": true, "seconds": 11989366.0, "hours": 3330.3794444444443, "days": 138.7658101851852, "min_seconds": 11902966.0, "max_seconds": 11989366.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-04-02T00:00:00Z", "date_only": false, "value": "2026-04-02T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-41907", "record": "MSRC_CVE-2026-41907", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-08-18T18:22:46Z", "date_only": false, "value": "2026-08-18T18:22:46+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.34.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}}, "time_unpatched": {"available": true, "seconds": 11989366.0, "hours": 3330.3794444444443, "days": 138.7658101851852, "min_seconds": 11902966.0, "max_seconds": 11989366.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-04-02T00:00:00Z", "date_only": false, "value": "2026-04-02T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-41907", "record": "MSRC_CVE-2026-41907", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-08-18T18:22:46Z", "date_only": false, "value": "2026-08-18T18:22:46+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.34.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 10465357.0, "hours": 2907.043611111111, "days": 121.12681712962963, "min_seconds": 10465357.0, "max_seconds": 10465357.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-04-19T15:20:09Z", "date_only": false, "value": "2026-04-19T15:20:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://api.github.com/repos/uuidjs/uuid/security-advisories/GHSA-w5hq-g745-h8pq", "record": "CVE-2026-41907", "field": "creation_timestamp", "uuid": "effcdc92-e8e3-47c9-afd6-c99023bbc7df", "url": "https://api.github.com/repos/uuidjs/uuid/security-advisories/GHSA-w5hq-g745-h8pq", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-08-18T18:22:46Z", "date_only": false, "value": "2026-08-18T18:22:46+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:56431", "record": "RHSA-2026:56431", "field": "vulnerabilities.34.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}}}}