{
  "schemaVersion": 1,
  "review": "third-review-2026-08-14",
  "note": "GOV-03. The machine-readable disposition of every finding the third re-review raised. `check:remediation-ledger` joins this file against the prose ledger and refuses a blanket closure claim while any row is not FIXED, so a summary sentence can never outrun the evidence.",
  "dispositions": [
    {
      "id": "NS-01",
      "previous": "PARTIAL",
      "disposition": "FIXED",
      "summary": "A credential owner's answer is decoded once, inside the auth boundary, through own data descriptors.",
      "evidence": ["tests/integration/http-execution-v3-live-authority.test.ts"]
    },
    {
      "id": "NS-02",
      "previous": "PARTIAL",
      "disposition": "FIXED",
      "summary": "Contract composition snapshots first and validates the snapshot, so the installed row is the row that was checked.",
      "evidence": ["tests/unit/contract-registry-immutability.test.ts"]
    },
    {
      "id": "NS-03",
      "previous": "PARTIAL",
      "disposition": "FIXED",
      "summary": "The `responseBody: NONE` probe owns its reader: the operation lifetime reaches it, and the lock is released.",
      "evidence": ["tests/integration/http-execution-v3-live-authority.test.ts"]
    },
    {
      "id": "NS-04",
      "previous": "PARTIAL",
      "disposition": "FIXED",
      "summary": "A journal transaction that cannot be completed is maintenance debt, not a settled write.",
      "evidence": ["tests/unit/opfs-byte-store.test.ts"]
    },
    {
      "id": "NS-05",
      "previous": "PARTIAL",
      "disposition": "FIXED",
      "summary": "A bootstrap failure answers with the request kind it belongs to, so the real cause survives the gateway.",
      "evidence": ["tests/unit/opfs-worker-runtime.test.ts"]
    },
    {
      "id": "NS-06",
      "previous": "PARTIAL",
      "disposition": "FIXED",
      "summary": "A reply is decoded before its pending row is released, and an uncorrelatable reply fails the channel closed.",
      "evidence": ["tests/unit/opfs-worker-runtime.test.ts"]
    },
    {
      "id": "NS-07",
      "previous": "NEW",
      "disposition": "FIXED",
      "summary": "Cursor caps and collaborators are captured at construction, so a later mutation cannot widen a validated cap.",
      "evidence": ["tests/unit/cursor-pagination-runtime.test.ts"]
    },
    {
      "id": "NS-08",
      "previous": "NEW",
      "disposition": "FIXED",
      "summary": "One terminal owner covers the whole public-cache staging body, so nothing writes after the abort.",
      "evidence": ["tests/unit/public-response-cache.test.ts"]
    },
    {
      "id": "RPC-01",
      "previous": "PARTIAL",
      "disposition": "FIXED",
      "summary": "Only a fulfilled, contract-shaped `waitClosed()` receipt prunes an active stream registration.",
      "evidence": ["tests/unit/browser-rpc/browser-rpc-remediation.test.ts"]
    },
    {
      "id": "RPC-02",
      "previous": "PARTIAL",
      "disposition": "FIXED",
      "summary": "Iterator cleanup and the lease decoder read foreign state inside their own boundaries.",
      "evidence": ["tests/unit/browser-rpc/browser-rpc-remediation.test.ts"]
    },
    {
      "id": "RPC-03",
      "previous": "PARTIAL",
      "disposition": "FIXED",
      "summary": "Every registry is snapshotted before any validation runs, and rows with hidden fields are refused.",
      "evidence": ["tests/unit/browser-rpc/browser-rpc-remediation.test.ts"]
    },
    {
      "id": "RPC-04",
      "previous": "PARTIAL",
      "disposition": "FIXED",
      "summary": "A transport result is an exact union: required own keys, no inherited extras, plain prototype.",
      "evidence": ["tests/unit/browser-rpc/browser-rpc-remediation.test.ts"]
    },
    {
      "id": "RT-01",
      "previous": "PARTIAL",
      "disposition": "FIXED",
      "summary": "A tracked task is registered before the authority is invoked, closing the reentrant-close window.",
      "evidence": ["tests/unit/realtime/stream-coordinator.test.ts"]
    },
    {
      "id": "RT-02",
      "previous": "NEW",
      "disposition": "FIXED",
      "summary": "A scheduler that cannot install a deadline fails closed inside the realtime result contract.",
      "evidence": ["tests/unit/realtime/stream-coordinator.test.ts"]
    },
    {
      "id": "TR-01",
      "previous": "PARTIAL",
      "disposition": "FIXED",
      "summary": "The vault snapshots a registration and everything nested in it before validating or storing it.",
      "evidence": ["tests/unit/presigned-transfer.test.ts"]
    },
    {
      "id": "TR-02",
      "previous": "PARTIAL",
      "disposition": "FIXED",
      "summary": "A source lease that arrives after the delivery ended is closed exactly once by a compensator.",
      "evidence": ["tests/unit/presigned-transfer.test.ts"]
    },
    {
      "id": "TR-03",
      "previous": "PARTIAL",
      "disposition": "FIXED",
      "summary": "The shared abort primitive settles once by observation order, and all four consumers use it with bound timer snapshots.",
      "markers": ["X-AUDIT-01", "X-AUDIT-02"],
      "evidence": [
        "tests/unit/abortable-operation.test.ts",
        "tests/unit/image-cdn-runtime.test.ts",
        "tests/unit/resumable-upload-fetch-transport.test.ts"
      ]
    },
    {
      "id": "TR-04",
      "previous": "PARTIAL",
      "disposition": "FIXED",
      "summary": "Teardown proves quiescence of the raw provider registry, not only of the wrappers that bound it.",
      "evidence": ["tests/unit/resumable-upload-runtime.test.ts"]
    },
    {
      "id": "TR-05",
      "previous": "PARTIAL",
      "disposition": "FIXED",
      "summary": "The control-plane decoder validates an owned snapshot, so a stateful answer cannot swap a checked value.",
      "evidence": ["tests/unit/resumable-upload-http-control-plane.test.ts"]
    },
    {
      "id": "SW-01",
      "previous": "PARTIAL",
      "disposition": "FIXED",
      "summary": "The activation marker read is bounded in bytes, cancels what it refuses and releases its reader lock.",
      "evidence": ["tests/unit/service-worker-runtime.test.ts"]
    },
    {
      "id": "SW-02",
      "previous": "PARTIAL",
      "disposition": "FIXED",
      "summary": "The generator and the runtime decoder share one canonical asset-path predicate, and the generator self-validates.",
      "evidence": ["tests/unit/service-worker-web-push-remediation.test.ts"]
    },
    {
      "id": "WP-01",
      "previous": "PARTIAL",
      "disposition": "FIXED",
      "summary": "One observation authority per click; certainty is monotone and the late-effect tail is owned by `waitUntil`.",
      "evidence": ["tests/unit/web-push-worker-runtime.test.ts"]
    },
    {
      "id": "GOV-03",
      "previous": "OPEN",
      "disposition": "FIXED",
      "summary": "This file plus `check:remediation-ledger` bind each row to a disposition and a test path, and block a blanket closure claim while any row is open.",
      "evidence": ["scripts/check-remediation-ledger.ts"]
    },
    {
      "id": "GOV-04",
      "previous": "OPEN",
      "disposition": "FIXED",
      "summary": "The inventory gate requires the exact named consumer set to resolve its import to the shared primitive and prints the set.",
      "evidence": ["scripts/check-adapter-inventory.ts"]
    },
    {
      "id": "GOV-05",
      "previous": "OPEN",
      "disposition": "FIXED",
      "summary": "Duplicate abort mechanics were consolidated onto the shared primitive and the file-transfer budget was reset to cover the remaining correctness code.",
      "markers": [],
      "evidence": ["config/recipes/frontend-capability-recipes.json"]
    }
  ]
}