v0.9.11

Aelira v0.9.11

Corrective maintenance release for remediation status, outcome accounting, and
upload/review accessibility. Operators on v0.9.10 should upgrade all application
components together. Published v0.9.10 artifacts are not replaced.

Fixed

• Upload, scan-detail and bulk-upload pages use persisted remediation status.
  History and Issues link to the review workflow instead of assuming a saved
  artifact exists. An original scan completing no longer implies that a
  remediated file is available. Batch submission validates the queue receipt
  and keeps original findings visible while individual jobs finish.
• When partial output is withheld, every original finding remains unresolved.
  Withheld changes are distinguished from delivered fixes; unavailable per-issue
  outcomes remain explicitly unreported.
• File-upload labels, nested controls, review scrolling, and low-contrast labels
  are corrected in the affected dashboard workflow. The closed mobile
  navigation drawer no longer accepts keyboard focus.
• PDF validation compares source and output checkpoint results instead of
  labelling every output failure a newly introduced regression.
• PDF reading-order checks use stable page identity, supported MCID/ParentTree
  content decoding and source-bound generated headings and lists. Unresolved
  content prevents a verified after-score.
• Supported mixed table/text pages compare table placement and surrounding text
  instead of skipping the whole page. Ambiguous or unsupported layouts require
  review and cannot produce a complete verification. Internal cell order and
  table semantics are not certified by this placement check.
• The Issues queue uses authorized document eligibility rather than missing
  per-finding capability flags. Tracked document references survive reload and
  can be cleared without cancelling jobs. Issues Found explicitly counts
  original findings, including any since fixed.
• Review filters, evidence actions and status groups wrap on narrow screens.
  Document changes cannot pair an old review response with a different preview.
• Review reads, actions and exports preserve authenticated scan scope. Queues
  and summaries apply the same department and course restrictions before counts
  and pagination; explicit filters cannot widen access. Department-wide access
  remains available to authorized administrators.
• Shared scan/remediation authorization and Scan History reject unsupported
  LMS course bindings rather than treating course IDs as platform-independent.

Changed

• Review includes a collapsible, read-only original/saved PDF comparison with
  actual page images and tagged text. Reads use checksum-verified current bytes
  and preserve scan authorization, including LTI course restrictions. Highlights
  are shown only where source text has an unambiguous visual location.
• Preview parsing rejects unsupported executable PDF resources and bounds
  repeated stream/image invocations before rendering. This initial subset does
  not support every PDF and has no hard process-level execution deadline; see
  reading-order review for supported evidence and limits.
• CI includes a real API, PostgreSQL queue, worker and artifact-download gate
  for synthetic PowerPoint, Excel, Word and PDF documents. Successful downloaded
  PDF and Office artifacts are hashed and uploaded again for an independent scanner run.
  Fixture text and values are compared with the original to catch content loss.
  Manual-required cases must refuse download and reconcile unresolved totals.
• This gate complements the existing simulated-backend browser suite; it is not
  a browser journey or an assistive-technology conformance test. Release review
  also requires a real-browser walkthrough of each changed route and outcome.
• PDF semantic regression checks distinguish persistent failures, newly
  introduced failures and unavailable validation. A candidate that introduces
  a failure must not be represented as a verified output.

Operator action required

No database migration or new production environment variable is required. Back
up the database and retained files, then deploy API, worker and dashboard from
the same 0.9.11 release. Preserve the v0.9.8 operator action requirements and the
v0.9.10 source-retention and rescan guidance.

Existing jobs are not retrospectively assigned invented per-finding outcomes.
Historical score estimates are not retroactively verified.
Re-run remediation from the retained original to obtain new outcome records.
If the original is unavailable, upload and scan it again. Review the saved
document before publishing it; an automated score does not establish conformance.

The partial-output safeguard remains in force. No unavailable file is made
downloadable merely to produce a successful result. These corrections do not
certify every supported format, LMS integration or screen-reader workflow.

Publication integrity

The release workflow requires a signed annotated tag and exact-commit CI,
publishes linux/amd64 and linux/arm64 images, and retains the seven-file SBOM
bundle. This release body is consumed verbatim by the publication workflow.