# Current execution state - Community final safety/deployment 2026-10-14: LOCAL_DONE / INTEGRATION_PENDING, tested source 96cc0bcc on isolated codex/community-first. [Final safety evidence](docs-backend-evidence-community-safety-COMMUNITY_FINAL_SAFETY.md). Fixed invisible public prices/anchors, orphan consensus groups, transactional report→operator queue, quota/owner/expiry races, atomic INVALIDATE/BLOCK, missing trust worker and durable-job event deduplication/version progression. Frozen real PostGIS/race matrix, actual signed API→worker→summary→like/dislike/remove/report and Android data/app JVM + 15 final Home cases/lint/debug/native-test/release compilation PASS. User explicitly authorized protected green-CI main merge and Abastevo-only VPS publication; other systems/images and occupied checkouts excluded. Private backup restored into isolated Abastevo rehearsal database; live schema 74/intake 0 unchanged, one legacy orphan report identified for bounded repair. Next: cumulative dev→main PR/current-head CI, guarded merge, checksum-verified migration rehearsal/cutover and actual HTTPS proof. Device/elapsed retention/full G09 certification remain owed; PRM22 deferred. - Community Home continuation 2026-10-14: LOCAL_DONE / INTEGRATION_PENDING, tested source 8e6f8387 on isolated codex/community-first / [PR135](https://github.com/AlexandreZanata/Abastevo/pull/135). [Evidence](docs-backend-evidence-community-safety-COMMUNITY_HOME_CONSOLIDATION.md). Removed developer capture from both APKs; ordinary camera/OCR/review/signed contribution has no GPS admission. Home ANP / Community selector shares average/minimum/maximum filters; full-city backend summary is independent of feed pages, source/time/unit separated, foreground refresh every 15s. Community-only station keys/typed cache/UI fixed. Real PostGIS 65-station four-order pagination, 1,500-station one-query/EXPLAIN, rounding/transaction/expiry tests and actual signed contribution→worker→Home summary PASS. Android 1,583 discovered/1,581 executed JVM cases plus final 12 Home cases, 90.19% domain coverage, lint/debug/release/native-test compilation PASS; parallel incremental lint/Hilt race resolved sequentially without disabling lint. Backend fast/vulnerability/mobile static/secret checks PASS. Next: current-head required Quick verification and review on cumulative PR135; integration, native/device/staging/provider proof remain pending. Primary dirty adapter/occupied dev preserved; no merge/deploy/wiki. - Community-first construction 2026-10-14: LOCAL_DONE / INTEGRATION_PENDING on isolated codex/community-first from integrated dev/main 68483db9; tested source e2a58f25. [Evidence](docs-backend-evidence-community-safety-PRM_COMMUNITY_FIRST.md). PRM15–PRM20 source and PRM21-T01/T03 local acceptance/handoff complete; PRM21-T02 [rollout/rollback prepared](docs-backend-evidence-community-safety-PRM_COMMUNITY_FIRST_ROLLOUT.md), actual staging/device proof OWED. Rust, real PostGIS/API-worker/private S3 campaigns, backend fast/vulnerability/mobile static and Android 1,580 discovered / 1,578 executed JVM tests PASS (two explicit opt-ins skipped); domain instruction coverage 90.15%, lint/debug/release/native-test compilation PASS. New normal v2 capture and independent-evidence validation omit GPS/150m, normal nominal search preserves address-only identity, signed helpfulness/report controls replace fake local counters. Next: authorized cumulative GitHub PR to main; required Quick verification and actual integration remain pending. PRM22 DEFERRED, no national coverage claim. Primary unrelated dirty adapter/occupied dev preserved; no merge/deploy/wiki. - Community-first PRM amendment 2026-10-13: PLANNING_LOCAL_DONE / IMPLEMENTATION_PLANNED. [PRM15–PRM22 plan](docs-planning-PREMIUM_BACKEND_APP_PLAN.md#2026-10-13-community-first-planning-amendment--prm15prm22), [next-agent prompt](docs-planning-PRM_COMMUNITY_FIRST_PROMPT.md), [source inventory/document validation](docs-planning-PRM_COMMUNITY_FIRST_VALIDATION.md). Added 21 initial-policy tasks for optional station coordinates/nominal address, normal name search, no mandatory 150m capture/intake barrier and free community validation/moderation, plus three DEFERRED future proximity tasks. Future enforcement requires validated product, strictly >90% reliably verified national coordinate coverage and new explicit activation authority. Documentation only in an isolated detached checkout from a104ed80; occupied dev e22824db/evidence adapter and Premium implementation worktree preserved. No runtime checks/changes, coverage claim, PR/remote publication/deployment/merge/wiki. Next: explicit implementation request and scoped amendment reconciliation into maintained dev, then PRM15-T01; existing in-flight authorizations remain scoped. - Main reconciliation 2026-10-13: INTEGRATED. All progress branches merged into protected `main` as `68483db9` via guarded PR132 dev → main (finish, commits preserved, no bypass). PR131 (premium), PR133 (audit) and PR134 (mobile-sync) closed as merged by ancestry; all 13 branch tips proven ancestors of `main`. Final head `cacd0a67`: Quick verification + fast + integration + test all success; local evidence 846 JVM Android green, landing 45/45 twice, backend fast gate green, real-PostGIS RED→GREEN for the discover v2 scope-key lookup. Two timing-sensitive integration cases flaked once on CI and passed on rerun plus 5/5 local -race each (documented, not weakened). Wiki mirrored once from `68483db9` (remote `00ea7e7`, owned pages only, manual pages preserved). `dev` retained and synced at `68483db9`. Primary checkout detached at `e22824db` with the owner's dirty Store edit preserved/excluded; bundle + 22 archive refs kept. Retired locally only `codex/main-reconciliation`; remaining construction branches still occupy others' worktrees and were left untouched. [Record](docs-planning-repository-reconciliation-20261013.md). No deployment/release certification; commercial acceptance (G24) and production certification (G09) remain separate. - Landing fusion 2026-10-12 (user-authorized, Codex wins): illustrated hero + six-scene + fleet art fused from `codex/landing-hero-art` (landing scope only; app/backend excluded). Overrides kept: header 24px/17.6px, 1152px/12px margins, mobile centered hero, no stats strip, no cheapest/savings/coverage claims; art decorative only. - LH07 2026-10-12: minimal opening LOCAL_DONE / INTEGRATION_PENDING on isolated `codex/landing-hero-art`, base `e90edab`. [Evidence](docs-assets-landing-minimal-20261012-BRIEF.md). Removed landscape from HTML/runtime manifest/dist; clean neutral opening with circular CSS support, balanced typography/spacing and authentic Android preview. Standard margins, existing text/buttons and all six artwork bytes preserved. Typecheck/build/check and 45 tests PASS; nine browser widths in both themes without overflow/phone overlap, one theme icon and no hero background image. Primary security work and unrelated prompt edit untouched. Next: integrate five landing checkpoints after concurrent dev work is saved, then protected delivery. No remote/release claim. - LH06 2026-10-12: fleet action/Android frame LOCAL_DONE / INTEGRATION_PENDING on isolated `codex/landing-hero-art`, base `4e999aa`. [Evidence/asset/prompt](docs-assets-landing-fleet-android-20261012-BRIEF.md). Regenerated only small-fleet scene (person organizing fuel costs beside vans, rose accent, 28 KB at 640px); five other scene hashes unchanged. Header/hero use standard 72rem/12px bounds; landscape stays full bleed. Refined Android punch-hole/metal frame with authentic minimum-720px capture. Typecheck/build/check, 45 tests and nine browser widths in both themes PASS; margins align, no overflow/phone overlap. Primary security work, reference checkout and unrelated prompt edit untouched. Next: integrate four landing checkpoints after concurrent work is saved, then protected delivery. No remote/release claim. - LH05 2026-10-12: illustrated landing LOCAL_DONE / INTEGRATION_PENDING on isolated `codex/landing-hero-art`, base `c126127`. [Evidence/assets](docs-assets-landing-illustrated-20261012-BRIEF.md). Full-viewport flat editorial landscape behind authentic Android home; source badges outside phone, six unique-color scenes and four reusable transparent decorations. 3840×2160 export is enlarged from native 1672×941 (recorded); runtime hero ≤95 KB. OpenCode `41d1372` gutters/branding/hero-fact removal/404 header retained. Typecheck/build/check and 45 tests PASS; nine browser widths in both themes without overflow/overlap, one theme icon. Primary security work and unrelated prompt edit untouched. Next: integrate the three landing checkpoints into maintained dev after concurrent work is saved, then protected batch delivery. No remote/publication/release claim. - LH04 2026-10-12: reference landing synchronization LOCAL_DONE / INTEGRATION_PENDING on isolated `codex/landing-hero-art`, based on 5360f8b. [Evidence](docs-assets-landing-sync-20261012-BRIEF.md). Adopted localhost:8099 (landing-refresh df2b992) headline, paragraph, branded two-line GitHub/Play actions and four hero facts; retained authentic Brazil/Android composition, six illustrations and grayscale theme. Native header navigation on all 25 script-enabled pages; honest prelaunch status and verified published-state links. Typecheck/build/check and 44 tests PASS. Browser seven widths 320–1440: zero overflow, controls contained, one theme icon, phone/badges separated and equal desktop art/copy height. Primary security work and unrelated existing prompt edit untouched. Next: integrate both landing commits into maintained dev after active work is saved, then protected batch delivery. No publication/release claim. - LH01–LH03 2026-10-12: landing artwork/theme LOCAL_DONE / INTEGRATION_PENDING in isolated `.worktrees/landing-hero-art` (`codex/landing-hero-art`, base dev `9fa7ad1`); active security edits in primary dev untouched. [Evidence/assets/prompts](docs-assets-landing-hero-20261011-BRIEF.md). Authentic Android home over artistic Brazil, equal desktop copy/art height, external source badges, six generated/traced SVG cards; latest check/camera regenerated and normalized to remove alpha defects. Black/grayscale dark theme with white text and mutually exclusive sun/moon SVGs. Typecheck/build/check and 42 tests PASS; six vectors >99% rendered silhouette/ink/white fidelity. Responsive and theme evidence in linked record. Next: integrate atomic commit into dev after active security work is committed, then protected final delivery. No hosting/backend/mobile/release change. - Games emulator/polish 2026-10-11: SCOPED_EMULATOR_PASS / INTEGRATION_PENDING on isolated `games`; [commands, captures and remaining gate](docs-mobile-games-polish-emulator.md), [original seven microtasks](docs-mobile-games-mvp.md). M08–M11 complete within authorized scope: illustrated selection, native scenes/HUD/feedback, responsive controls; preview bounds, landscape start/pause and narrow-label regressions fixed. Final offline API 26: 10 portrait + 2 landscape cases PASS; 9 affected unit cases PASS, lint zero errors, debug/test/release builds and APK-size check PASS (4,345,457 bytes). Full app 258 and unchanged-domain 508 cases previously passed; global domain coverage still blocks aggregate acceptance (87.2467% < 90%; baseline already 86.5864%). Atomic commits backed up to `origin/games` (GitHub canonical rename: AlexandreZanata/Abastevo). Backend/other agents preserved; no physical-phone operation, PR/merge/wiki or release certification. Next: resolve global coverage under its owning scope before integration; physical-device obligations remain owed. - Premium PRM09-T01 2026-10-13: LOCAL_DONE / INTEGRATION_PENDING on isolated codex/premium-backend / PR131 (draft). Formal entry records G-PR-BACKEND still pending (no readiness claimed). Typed Kotlin ports/DTOs, Go-parity consumption/cost, additive Room 10->11 with owner/origin partitions and durable enqueue. [Evidence](docs-backend-evidence-premium-PRM_NEXT_TEN.md#prm09-t01--typed-ports-exact-values-and-owner-scoped-room-state). Domain/data/application targeted tests + assembleDebug PASS; lintDebug pre-existing 27 MissingTranslation failures on clean tree, untouched. Occupied dev preserved; no merge/deploy/wiki. Next PRM09-T02. Real payments OFF, Play sandbox PROOF_OWED. - Premium acceptance-five 2026-10-13: IN_PROGRESS on isolated codex/premium-backend / PR131 (draft during construction), batch parent 8553b7a; authorized PRM07-T06 + PRM08-T01..T04, one commit each. Completed sequentially through PRM08-T05, tested working tree atop b3149241; task unit, race and static checks PASS. [Evidence](docs-backend-evidence-premium-PRM_NEXT_TEN.md). Next PRM07-T01. Payments/real Play sandbox deferred, dev/mobile preserved; no merge/deploy. - OneSignal notification planning 2026-10-13: CONTENT/PLAN LOCAL_DONE; PRM11–PRM14 implementation PLANNED. [Bodies/cost/identity contract](docs-product-NOTIFICATION_CONTENT_CONTRACT.md), [extended Premium plan](docs-planning-PREMIUM_BACKEND_APP_PLAN.md). Added 17 microtasks without renumbering the original 62; source order integrates OneSignal backend before G-PR-BACKEND and app/provider acceptance before commercialization. No SDK/credential/send/deploy/mobile edit. First-ten backend batch source complete on PR131; real payments deferred. - Premium first-ten batch 2026-10-13: PRM00-T01..T04 + PRM01-T01..T06 source LOCAL_DONE / INTEGRATION_PENDING on isolated codex/premium-backend, main base 5dc9b2b; ten task commits plus separate authorized notification plan. [PR131](https://github.com/AlexandreZanata/Abastevo/pull/131), [tested source anchor/commands/evidence](docs-backend-evidence-premium-PRM_FIRST_TEN.md#prm01-t06--private-status-purchase-restore-and-free-exit-api). Full quick-verify PASS (43s; no vulnerabilities); subscription race and real-PostGIS subscription/account/migration/API matrix PASS. Tested PRM01-T06 source candidate on 44653cd; exact source digest retained in evidence. Private status/signed same-owner restore/free expired export integrated in API; provider ports nil, sales OFF. Dev/mobile edits preserved. Review/remote CI/merge pending; no merge/deploy/wiki/Android change. Next plan task PRM01-T07 (recurring reconciliation/runbook/real provider proof), outside this completed batch; payment-module/catalog wiring and sandbox remain user-deferred. - MOBILE-SYNC-01 station auto-sync 2026-10-13: LOCAL_DONE / INTEGRATION_PENDING on isolated `codex/mobile-station-sync` (dev `e22824db` plus audit `8fefff7d`); original occupied dev and its unrelated backend edit preserved/excluded. [Evidence](docs-mobile-stations-auto-sync-20261013.md). Foreground sync on entry/resume/validated-reconnect/60s while RESUMED plus unique 15min connected WorkManager job; municipal IBGE scope with scoped Room snapshot (page bound 100); cancellable OkHttp gateway with serialized use case; non-clickable list-summary card (city/fuel/cheapest-first) in 8 locales. 62 scoped JVM tests green, lint 0 errors, debug/test APKs compile; 18 physical API36 cases PASS including shell-level radio loss/return and live staging Sorriso read/outage/reconnect; product APK `05d6abc4…`, radios restored. Next: atomic commit, then scoped dev-targeted integration PR (fresh `origin/dev` + audit merge + cherry-pick, excluding Home `e22824db`); no main merge without Quick verification, no release claim. - ING-AUDIT-01 scoped GitHub delivery 2026-10-13: INTEGRATION_PENDING / PR_PENDING. Explicit user scope: only this chat's source/activation evidence. Another session advanced remote dev from `bc6d5f29` to `268155ff` with 15 unrelated UI commits during publication preflight; those commits and unfinished local evidence edits are preserved/excluded. Publish the existing clean isolation branch `codex/station-reliability-audit` (`2cc8b7b`, `73ca2d76`, scoped delivery records) with a main-targeted PR containing only this chat, using ADR-020's existing clean delivery branch path. [Tested source and authorized VPS evidence](docs-backend-STATION_RELIABILITY_AUDIT_20261013.md); behavior/base inputs unchanged from tested main `b7800b2b`. Live main protection verified: required `Quick verification`, strict current-base checks, enforced for admins, no force push. Next: push the isolated branch, open scoped protected PR, record actual URL/check state in delivery metadata. No main merge, unrelated dev integration or further VPS rollout is part of this publication request. - ING-AUDIT-01 national activation 2026-10-13: ACTIVATED_STAGING / INTEGRATION_PENDING; explicit user follow-up supersedes the earlier approval block. [Execution/preservation evidence](docs-backend-STATION_RELIABILITY_AUDIT_20261013.md#completed-execution-and-activation). Tested `2cc8b7b` tools ran the authorized Abastevo `registry-sync` container: 45,762 = 45,641 accepted + 0 duplicates + 121 quarantined, 168.695s; verify-only replay 7.111s. All 45,618 prior UUIDs, existing CNPJ bindings/profiles, protected locality/status/locations and ten curated facts preserved; 28 new identities, 11 source-backed refreshes, four absent source CNPJs retained without inferred revocation. Only CronJob tools reference activated, daily 03:00 America/Cuiaba, unchanged 250m/256Mi image/security/state; 26+3 guard samples, zero violations/restarts/OOM, final 4/4 ready. API/worker/storage/edge/other apps untouched. Source integration/PR/wiki, API/worker policy rollout, unknown coordinates, 121 quarantined rows and native/release/soak gates remain separate. Original occupied dev preserved. - ING-AUDIT-01 Sorriso reliability initial checkpoint 2026-10-13 (activation later superseded by the entry above): LOCAL_DONE / INTEGRATION_PENDING in an isolated main-based checkout; original occupied dev preserved. [Audit, official ANP references and independent RFB/IBGE/OSM sources](docs-backend-STATION_RELIABILITY_AUDIT_20261013.md). Zero live CNPJ duplicates; UI appended legal/trade-name matches twice, now filtered by full visible CNPJ. Rust0.3.1 header/field hardening, actual API contract/pagination/quotas/versioned replay and copied-location refusal pass JVM/lint/APK and real PostGIS/race. VPS isolated preparation 45,738=45,617+0+121; Sorriso API25/replay same run, 24 candidate points with149.9/150.1m geometry checks, all still unreviewed, canonical UUIDs preserved. Full national persistent publication rejected by automatic approval review pending explicit confirmation; active daily tools/API/worker/storage unchanged. Native install, protected dev delivery/PR/wiki and national activation remain pending; no production certification. - Bottom tab navigation 2026-10-13: LOCAL_DONE / INTEGRATION_PENDING, isolated from occupied dev at `8a4503c`. [Behavior/tested source evidence](docs-mobile-bottom-tab-base-navigation.md). Every Explore/Community/Profile bottom-bar action now opens its base without restoring a child stack; single-top retained. Focused JVM navigation 18/18, lint zero errors, debug app/test APKs passed; five actual-controller regression cases compiled, native execution OWED in deferred device batch. User authorized delivery to dev only; no PR/main merge/deployment/wiki claim. Occupied checkout preserved. Next: push scoped commit to dev; final protected batch/native acceptance remain separate. - Safety/consent batch delivery 2026-10-13: INTEGRATION_PENDING / CI_PENDING. User requested the cumulative dev → main PR now and merge only on green CI. [Delivery scope](docs-backend-evidence-community-safety-RVA_BATCH_DELIVERY_2026-10-13.md). Clean owner-consent head f7c0d7a includes committed dev corrections; live main/dev 5dc9b2b are ancestors. Preserve original dev's uncommitted intake-gate removal, excluded from the tested batch. Independent delivery checkout will publish dev without changing that occupied checkout. Required Quick verification + all applicable CI/review/head/base guards before finish; no source merge implies release, enabled training/uploads, full offline completion or passed stability/24h proofs. - RVA08 E Android refresh 2026-10-13: LOCAL_DONE / INTEGRATION_PENDING. [Evidence](docs-backend-evidence-community-safety-RVA08_OWNER_CONSENT.md#e-requested-adb-apk-refresh--2026-10-13). User-requested physical API36 reinstall succeeded with `adb install -r`; original installation retained, matching certificate, latest 3.1.0-debug/code4 APK already byte-identical. Clean e6a8dfa build/focused test tasks up-to-date; no fresh suite execution claimed. Real Profile → Settings → full-term reader displays the exact 5,224-byte asset/hash and remains open; no consent checkbox/submission, data clear or VPS mutation. Remaining operational/offline gates unchanged. - RVA08 directory follow-up 2026-10-12: LOCAL_DONE / INTEGRATION_PENDING. Real SQL tracer reproduced 5/43/81 search calls; bounded page-reference batch now uses two, preserves detail/pagination/source trust, passes two-connection concurrency/fault recovery and full read/HTTP race suites. [Evidence](docs-backend-evidence-community-safety-RVA08_STAGING_ACCEPTANCE_2026-10-12.md#bounded-directory-read-follow-up-opening). API b058a60 deployed, worker 610bdd9/schema74 retained. Actual consent 16/16 and two bounded 600/600 HTTPS windows pass, but an intervening repeat failed (eight timeouts/one drop, telemetry timeout); sustained stability/capacity remain OWED. Aggregate diagnostic shows 16.75% mean CPU steal, 53.97% over 5.020s; causal link to failed repeat unproven. Final annotations reconciled to schema74/API b058a60/worker610bdd9; 3/3 ready, HTTPS terms/health200 and retention inspection correct at 23:15Z. Limits unchanged, no other workload changes. - RVA07.C/RVA08 staging 2026-10-12: IN_PROGRESS on isolated `codex/owner-consent`. [Evidence](docs-backend-evidence-community-safety-RVA08_STAGING_ACCEPTANCE_2026-10-12.md). Abastevo-only backup/rehearsal, live schema 54–73 and persistent private media deployed. Consent rollout used API/worker 610bdd9, then API b058a60 superseded it as recorded above; scoped internal 3 MiB relay preserved. First OFF without prior grant and retryable DB-outage errors corrected RED→GREEN; real PostGIS/race/Android plus actual API/worker regression pass. Private backup/restore rehearsal and live append-only 000074 passed; 16 real HTTPS consent cases PASS, both synthetic owners OFF. Worker removed five originals/four abandoned finals; elapsed READY canary cleanup due Oct 13 20:09Z, deadline 22:09Z. Shared-edge upload patch syntax-tested, NOT_APPLIED pending explicit scope extension; intake zero/training OFF. External and VPS HTTPS plus loopback campaigns all stopped with drops/timeouts; stability/root cause/capacity owed. No new ADB device, other workload mutation, main merge or full retention claim; original dirty dev preserved. - RVA08 D consent device 2026-10-12: LOCAL_DONE / INTEGRATION_PENDING on `codex/owner-consent`, parent b4f6f00; whole RVA08/offline batch IN_PROGRESS. [Evidence](docs-backend-evidence-community-safety-RVA08_OWNER_CONSENT.md#d-native-consent-checkpoint). Physical USB API36: eight native cases passed (10.794s), including actual bundled terms, unchecked explicit review, separate owner keys, real disk OFF/reopen, foreign-owner refusal, persisted retry deadline, startup/periodic worker and auth continuity. RED complete-reader action hidden by system navigation; fixed pinned Compose window measurement, real route now fully usable. Privacy summaries corrected in eight locales; collection OFF, no real-user consent or data clear. Debug/native APKs and final lint green. Public staging terms GET returns 404: deployment/digest and real signed staging flow still OWED, together with RVA07.C 24h/provider/backup/budget and remaining synchronization/helpfulness phases. No VPS mutation or main merge; original dev's unrelated dirty Store preserved. Next: reconcile staging within Abastevo-only deployment scope, remaining RVA08 then RVA10–14/CS15–25; final protected dev→main batch and wiki afterward. - RVA08 A2/C consent 2026-10-12: LOCAL_DONE / INTEGRATION_PENDING in isolated `codex/owner-consent` from b83625d; whole RVA08/offline batch IN_PROGRESS. [Evidence](docs-backend-evidence-community-safety-RVA08_OWNER_CONSENT.md). Real Settings privacy/rights cards, complete offline pt-BR terms with shared SHA-256, unchecked explicit confirmation, scoped atomic durable OFF, retained retry/body, signed private/write transport, bounded OFF-only startup/periodic recovery and account/origin-separated Keystore aliases. Full JVM 1,472 discovered / 1,470 executed, zero failures (two explicit opt-ins); lint/debug APK green. Real Kotlin→TLS→Go verifier/PostGIS grant 101/revoke 102/replay/stale/forged/other-owner proof passed; existing privacy SQL/S3 race green. Native review/Keystore/persistence tests compile, execution OWED: no physical ADB device; owned API26 emulator without KVM stopped after five-minute installation limit (no cases executed). Checkpoint a05cba7 backed up on GitHub branch codex/owner-consent; no PR/merge. Old provisional digest override now refuses startup; deployment must match the embedded actual text. Original dev's unidentified reservation-gate removal preserved, excluded from this worktree; tested Store hash remains f495194c…. Next: native consent evidence when connected; remaining RVA08 helpfulness transport/integration, then RVA10–14/CS15–25. RVA07.C actual 24h/provider/backup/device/deployment budget still OWED; training collection OFF. No VPS/release/merge claim. - RVA08 A1 2026-10-12: consent view ownership LOCAL_DONE / INTEGRATION_PENDING; whole RVA08 IN_PROGRESS. [Evidence](docs-backend-evidence-community-safety-RVA08_OWNER_CONSENT.md). Four RED late-account/logout/update/reverse-refresh regressions closed by Main-serialized view generations; old results cannot render/reload/release current guard. Full app JVM 290 tests, zero failures/skips and lint green (32s), including repair of 27 missing helpfulness/privacy translations in seven supported locales. Corrected RVA07 predecessor is 7f3c9e7, full repeated SQL/S3 race 37.961s with tested/committed Store hash equal. Next RVA08 A2 durable owner+origin+key commands/OFF/revisions, then signed transport; global prefs/unsigned gateway remain pending. RVA07 C elapsed/provider/device/backup and deployment budget OWED; collection OFF. No VPS/phone/publication/merge claim. - RVA07 B3.3c.2 reservation correction 2026-10-12: post-commit review invalidated closure at 89fe92a (reservation body omitted). Corrected successor restores atomic gate; repeated full evidence SQL/S3 race and affected units/vet, with source SHA-256 and committed blob matching required. No publication/merge; use successor checkpoint, retain external obligations. [Evidence](docs-backend-evidence-community-safety-RVA07_DEADLINE_ENFORCEMENT.md). - RVA07 B3.3c.2 2026-10-12: intake assurance LOCAL_DONE / INTEGRATION_PENDING; phase IN_PROGRESS. [Evidence](docs-backend-evidence-community-safety-RVA07_DEADLINE_ENFORCEMENT.md). Production gated store, default-zero explicit budget (source ceiling 100), three-minute latest successful worker observation, atomic global capacity and 22h-boundary refusal; append-only 000073. SQL RED 40/4 overshoot corrected, GREEN exact four winners, replay/timeout/unknown/stale/rollback/duplicate-key/upgrade/10k-history query plans. Full evidence SQL/S3 race 29.009s, privacy erase/restore 5.243s, actual signed API+worker SQL/S3 flows 20.132s and affected units/vet/sqlc/diff green. Next: C autonomous/provider/backup/temp/device proof preparation, then RVA08 independent source; measured deployment budget/24h proof OWED. No VPS/phone/old-soak/release/publication/merge claim. - RVA07 B3.3c.1 2026-10-12: safety dispatcher isolation LOCAL_DONE / INTEGRATION_PENDING; phase IN_PROGRESS. [Evidence](docs-backend-evidence-community-safety-RVA07_DEADLINE_ENFORCEMENT.md). Existing worker has four fixed serial kind-scoped safety loops plus general loop excluding them, with cancellation/join and required-handler guard; no new service/container. SQL blocking-general/cleanup-progress and foreign-claim isolation green; actual claim EXPLAIN uses append-only 000072 partial index over 20k unrelated rows, upgrade/replay preserves live lease/dedupe. Full jobs SQL race 6.281s, affected units/vet/sqlc/diff green. Next: B3.3c.2 intake health/inventory/backlog/capacity, then C autonomous/provider proofs; RVA12 queue retention. No measured VPS capacity/phone/soak/release claim. - RVA07 B3.3b.2 2026-10-12: predeadline/pass bounds LOCAL_DONE / INTEGRATION_PENDING; phase IN_PROGRESS. [Evidence](docs-backend-evidence-community-safety-RVA07_DEADLINE_ENFORCEMENT.md). Cleanup begins at 22h without moving the 24h anchor; source/final leases and commits respect margin, source fence uses live time, queued validators cannot extend retention. Whole pass 45s, separate 20s original/final slices, 32+32 candidates and 5s transfers; append-only 000071 hot index. Real SQL/S3 boundary/live-writer recovery, writer refusal, 10k receipt EXPLAIN and upgrade/replay green; full evidence race 20.163s, privacy erase/restore 4.585s and affected units/vet/sqlc/diff green. Next: B3.3c admission/worker/backlog capacity, C autonomous/provider/backup/device proofs. Two-hour reserve is not a capacity or 24h certification; no VPS/phone/old-soak/release claim. - RVA07 B3.3b.1 2026-10-12: actual minute dispatch LOCAL_DONE / INTEGRATION_PENDING; phase IN_PROGRESS. [Evidence](docs-backend-evidence-community-safety-RVA07_DEADLINE_ENFORCEMENT.md). Fixed shared scheduler bug collapsing minute intervals into hourly dedupe; evidence now requests every-minute dispatch. Real SQL RED second minute stalled at four jobs, GREEN four schedules × three minutes × 12 concurrent restart views yields 4/8/12 exact jobs; full jobs SQL race 6.710s, affected units/vet/diff green. Earlier minute interval declarations alone were insufficient. Next: B3.3b.2 predeadline/pass fairness/live lease clock, B3.3c admission/capacity, then C proofs. No capacity/VPS/phone/soak/release claim. - RVA07 B3.3a 2026-10-12: confirmed metadata purge LOCAL_DONE / INTEGRATION_PENDING; phase IN_PROGRESS. [Evidence](docs-backend-evidence-community-safety-RVA07_DEADLINE_ENFORCEMENT.md). At most 100 oldest hash rows, only after both byte receipts, SKIP LOCKED and append-only 000070 partial index; uncertain copies retain inventory. SQL RED loss reproduced then 205-row restart, 12-way concurrency, rollback, 10k live-history EXPLAIN and upgrade/replay green; full evidence SQL/S3 race 22.238s, affected units/vet/sqlc/diff green. Next: B3.3b predeadline dispatch/pass fairness/live clock, B3.3c admission/capacity, then C autonomous/provider/backup proofs. No VPS/phone/old-soak/release claim. - RVA07 B3.2b 2026-10-12: final cleanup/recovery LOCAL_DONE / INTEGRATION_PENDING; whole phase IN_PROGRESS. [Evidence](docs-backend-evidence-community-safety-RVA07_DEADLINE_ENFORCEMENT.md). 32-final/45s reconciliation, 5s DELETE+HEAD absence, UUID lease/atomic object+inventory receipts, stale cleaner refusal and restart/repair; unconfirmed destinations join overdue audit. Actual SQL/S3 late writer/erasure, lost reply/outage/repair, foreign-owner reuse, 12-way claim, receipt rollback, 65-copy 32/32/1/0, 10k history EXPLAIN index, 000069 upgrade/replay passed. Full evidence SQL race 16.346s and privacy erasure/restore 1.824s green, affected units/vet/sqlc/format/diff; CI fixture owned startup/cleanup 2.657s passed after prior approval usage-limit interruption. Next: B3.3 predeadline dispatch + pass/admission/retention bounds, then C autonomous/provider/backup proofs. Storage-only restore protocol remains RVA14.C; no old-soak/VPS/phone/release claim. - RVA07 B3.2a 2026-10-11: final inventory/admission/commit fence LOCAL_DONE / INTEGRATION_PENDING; whole phase IN_PROGRESS. [Evidence](docs-backend-evidence-community-safety-RVA07_DEADLINE_ENFORCEMENT.md). Append-only 000068 inventories destination before PUT with 60s UUID authority/five attempts, 20s job, reservation deadline and read-only duplicate reuse. Guarded commits cannot recreate READY after erasure/lease expiry; pending final inventory prevents premature erasure completion. 12-way SQL race, trigger rollback, expiry/identity/budget/deadline, conservative anchor/reuse and upgrade/replay passed; full evidence SQL race (14.604s), affected units/vet/sqlc/format/diff green. Next immediately: B3.2b bounded inventory cleanup + actual S3 recovery, then B3.3/C. Historical object-only sweep is insufficient; no SLO/provider/release claim. - RVA07 B3.1 2026-10-11: quarantine ingress/erasure fence LOCAL_DONE / INTEGRATION_PENDING; whole phase IN_PROGRESS. [Evidence](docs-backend-evidence-community-safety-RVA07_DEADLINE_ENFORCEMENT.md). Session row lock serializes ingress with expiry, fresh live-transfer check prevents deletion/marker while admitted upload remains active; sweep uses same guard. SQL RED false erasure ack closed; late completion/recovery and concurrent erasure lock/budget proofs pass. Full evidence SQL race, dependent privacy erasure/restore, affected units/vet/sqlc/diff/secret checks green; forward outage assertion strengthened to require error. Next: B3.2 final-output inventory/verification lease, then B3.3 predeadline dispatch and C proofs. No provider/SLO/release claim or existing-soak mutation. - RVA07 B2.2 2026-10-11: bounded owner training erasure LOCAL_DONE / INTEGRATION_PENDING; whole phase IN_PROGRESS. [Evidence](docs-backend-evidence-community-safety-RVA07_DEADLINE_ENFORCEMENT.md). Append-only 000067 durable keyset cursor with nonce/absence ack transaction, 32-copy/45s attempts, no owner inventory snapshot, OFF revision/deadline retained on retry. Real SQL/S3 65-copy restart 32/32/1, foreign-owner control, bytes restored beside PURGED receipts, 12-way owner claim, cursor rollback/stale nonce and upgrade/replay all green; full privacy SQL race, affected unit/vet/sqlc/diff/secret checks passed. Next: B3 evidence late-writer fences, immutable inventory-before-output and predeadline dispatch; then C wall-time/provider/backup proofs. Collection OFF; no VPS/device/release claim. - RVA07 B2.1 2026-10-11: bounded training-output disposal LOCAL_DONE / INTEGRATION_PENDING; whole phase IN_PROGRESS. [Evidence](docs-backend-evidence-community-safety-RVA07_DEADLINE_ENFORCEMENT.md). Immediate every-minute cleanup, 32-item/45s pass, 5s copy transfer, nonce lease/terminal ack, append-only 000066 partial due index. Real SQL/S3 provider-failure/restart/abandoned-writer/stale-ack cases passed; 12-way claim uniqueness and 65-row 32/32/1/0 drain passed; 10k terminal receipt EXPLAIN uses partial index/no inventory seq scan; upgrade/replay and full privacy SQL race plus units/vet/sqlc/diff/secret green. Next: B2.2 owner erasure batching, B3 evidence late-writer/deadline fixes, then C proofs. No wall-time/provider/release claim; collection OFF. - RVA07 A/B1 2026-10-11: truthful cleanup/health LOCAL_DONE / INTEGRATION_PENDING; whole phase IN_PROGRESS. [Evidence](docs-backend-evidence-community-safety-RVA07_DEADLINE_ENFORCEMENT.md). RED three false-success cases reproduced; GREEN query errors preserve UNKNOWN and partial effects, storage failures error after other cleanup, jobs refuse unknown/partial/overdue acknowledgements. Actual PostGIS observation failures retain deletion markers; affected evidence/privacy/API/worker/ops race suites, vet/diff/secret checks green. Next: B2 bounded training disposal and durable per-copy acknowledgements, then evidence late-writer fencing/deadline dispatch and C proofs. Historical soaks untouched, no deadline/release claim. - RVA06 2026-10-11: fail-closed minimization correction LOCAL_DONE / INTEGRATION_PENDING; actual content minimizer PENDING, collection OFF. [Evidence](docs-backend-evidence-community-safety-RVA06_MINIMIZATION_GATE.md). RED valid JPEG incorrectly PASS; GREEN valid/EXIF layouts UNCERTAIN with zero output, malformed/oversize/bomb/cancelled refused; explicit production source refusal has no enable switch. Real SQL proves no inventory creation, affected race suites/vet/diff/secret checks green. Zaflas controller identity/contact supplied by owner recorded in draft terms; rights-channel handling/public activation still unverified. Next: RVA07 bounded cleanup, deadline margin and truthful health. Historical soaks untouched; no VPS/device/release claim. - RVA05 2026-10-11: inventory/output protocol LOCAL_DONE / INTEGRATION_PENDING. [Evidence](docs-backend-evidence-community-safety-RVA05_OUTPUT_RECOVERY.md). Append-only 000065 immutable key and nonce-fenced output receipts; pending inventory unselectable, replay repairs original key/date, bounded bytes/time/five attempts, READY only after hash and consent revalidation. Real SQL/private S3 lost-reply/corruption/crash/revoke-during-PUT/stale-cleanup matrix green, 12-way lease and upgrade/queued-revision regressions green; full privacy SQL race, unit/consumers/vet/sqlc/diff/secret checks passed. RVA04 physical-output race evidenced. Next: RVA06 honest minimization/collection OFF gate, then RVA07 bounded recurring cleanup/deadline health. No VPS/device/release claim. - RVA04 2026-10-11: A/B database checkpoint LOCAL_DONE / INTEGRATION_PENDING; physical-output acceptance continues in RVA05. [Consent fence evidence](docs-backend-evidence-community-safety-RVA04_CONSENT_FENCE.md). Append-only 000064 durable owner/revision receipts, shared owner transaction lock, exact current consent revalidation at derivative commit and restore-safe selection. OFF excludes all rows immediately; tombstone writes limited to 32 plus recurring 32-row repair, immutable first covering deadline per image. RED stale-commit/active-after-OFF reproduced; real SQL race, paused sanitizer, 65-row bounds/restart/stale restore, regrant deadlines, rollback/upgrade and full privacy SQL race suites green; unit/consumer/vet/sqlc/diff checks green. Next: RVA05 crash-consistent inventory/object output and paused-write race. Collection remains OFF; purge/retention metrics and external proofs remain owed. - RVA03 2026-10-11: LOCAL_DONE / INTEGRATION_PENDING. [Erasure recovery contract/evidence](docs-backend-evidence-community-safety-RVA03_ERASURE_RECOVERY.md). Append-only 000063 atomically records account-wide intent including binding-free accounts, backfills historical deleted rows and enables every-minute session-independent repair with expiring nonce-fenced leases/per-contributor checkpoints. FAILED privacy work resumes using its persisted owner reference; storage errors/remaining evidence batches cannot falsely complete. Social/evidence reads bounded; HTTP dispatch-failure acceptance, cancellation, 12-way SQL lease race, restart/stale nonce/backfill, physical cleanup and full four-adapter SQL race suites green; affected unit/consumer/vet/sqlc/format/diff checks green. Next: RVA04 transactional training consent/revocation fence. Late media writes/deadline health and resource-throughput closure remain RVA07/RVA12/final acceptance; no VPS/device/release claim. - RVA09 2026-10-11: LOCAL_DONE / INTEGRATION_PENDING. [JWKS admission evidence](docs-backend-evidence-community-safety-RVA09_JWKS_ADMISSION.md). Unknown-key refreshes and failed provider loads bounded per issuer/30s; context-cancellable independent single-flight, map cap and no network-held global mutex. RED 20 invalid tokens→21 fetches; GREEN same/unique bursts≤2, outage budget, provider isolation, cancellation and rotation/TTL/redirect suites pass under race; vet/format/diff green. Next: RVA03 durable account-wide erasure recovery and retryable privacy failures. Link-route/global admission remains explicitly tracked in RVA12. - RVA02 2026-10-11: LOCAL_DONE / INTEGRATION_PENDING. [Admission contract/evidence](docs-backend-evidence-community-safety-RVA02_ADMISSION_CONTRACT.md). Append-only 000062 records unlinkable admission timestamps atomically; deleting credentials cannot refund quota, bounded prune/backfill, compatibility stores share admission. RED create/delete bypass closed; account race suites and real SQL 115 racers→100 admissions, expiry/restart-view and active/deleted upgrade/backfill passed; sqlc/vet/format/diff green. Next: RVA09 unknown-kid refresh admission, then RVA03 resumable erasure. RVA00 reconciliation completed by normal main synchronization and canonical-document checkpoint; no runtime phase or external proof inferred from that checkpoint. - RVA01 2026-10-11: LOCAL_DONE / INTEGRATION_PENDING, bounded API photo ingress replaces production direct-storage PUT issuance. [Contract/evidence](docs-backend-evidence-community-safety-RVA01_INGRESS_CONTRACT.md). Exact bytes/hash checked before S3; four in-flight transfers, five durable attempts, nonce-fenced actual-byte receipt/replay; append-only 000061 upgrade. Evidence/API/server/OpenAPI unit race checks, three real-SQL ingress tests and both real API/worker/S3 flows passed; sqlc/vet/format/diff/secret checks green. Local disposable project only; no VPS/phone/soak change. Next: RVA02 deletion-independent signup accounting; later provider/device/release acceptance remains owed. - RVA00 opening 2026-10-11: IN_PROGRESS; user authorized complete security/offline corrections, GitHub publication and protected main merge. Review baseline `603d5ba`; fetched main/dev now `5dc9b2b` (prior PR129 and landing integrated). Preserve prior evidence/soaks and reconcile canonical planning files; synchronize maintained dev before runtime edits. Next: RVA01 actual ingress enforcement, immediate critical tests; no unrelated VPS workloads. - Independent security/offline reassessment 2026-10-11: REVIEW_LOCAL_DONE / REMEDIATION_NOT_STARTED at immutable tracked dev `603d5ba8acd32da6b5b0de72988ac614e8c18ee6`. [Assessment](docs-security-SECURITY_OFFLINE_REASSESSMENT_2026-10-11.md), [complete RVA00–14 + CS15–25 correction plan](docs-planning-SECURITY_OFFLINE_CORRECTION_PLAN_2026-10-11.md), [sanitized reproductions](docs-security-evidence-reassessment-2026-10-11-README.md). Fourteen review items: five HIGH (two conditional training activation blockers), eight MEDIUM and one functional integration blocker; no demonstrated CRITICAL. CS15 A/B1 are planning-only partial work; CS16–25 are not accepted, with reusable partial CS21/22 dependencies. 71 Go packages, eight real-PostGIS packages and 94 selected JVM tests passed; added characterizations reproduced admission/erasure/training/retry/redirect/JWKS gaps and bounded parser heap exhaustion. Passing characterization is not safe behavior. No runtime fixes, VPS/phone, existing-soak changes, publication or release claim; unique disposable local DB removed. Existing SEC05-E/CS10C autonomous-deadline proof and phone/scan obligations remain pending. Next: user chooses implementation agent; then RVA00 current-head/ownership reconciliation, not automatic feature activation. - PR128/PR129 delivery recovery 2026-10-11: LOCAL_DONE / INTEGRATION_PENDING in isolated `/tmp/abastevo-pr-delivery-20261011` on dev; primary foreign edits preserved. [Failure/repair evidence](docs-backend-CI_PR128_PR129_RECOVERY.md). Normal current-main merge preserves history; immutable loopback MinIO test fixtures fix the real image-pull failure; cold-pull stdout/stderr parsing and a cleanup-capture defect also repaired, with both real-S3 race matrices and leak regression green; verified renamed-origin allowlist passes 45 flow guards plus batch harness. Required Quick verification and every applicable CI signal must pass on exact head/base before merging PR128 into dev and cumulative PR129 into main. Next: publish repair, reconcile landing, validate and guarded delivery. No deploy/release/device/soak acceptance. - Security remediation SEC09-E 2026-10-11: LOCAL_DONE / INTEGRATION_PENDING on maintained dev, final protected delivery (merge gated on green). [Evidence](docs-backend-evidence-community-safety-SEC09E_PROTECTED_DELIVERY.md). Origin repointed to Abastevo per move; fast-forward push of dev (SEC01-D→SEC09-E) updating reused PR #129; foreign-dirty/untracked planning files excluded from every commit. Merge only via finish helper when Quick verification is green; wiki mirror after. Owes: PR checks, SEC05-E soak (due 2026-10-12T19:11:39Z), CS10C soak (due 2026-10-12T16:11:11Z), SEC08-D phone matrix, edge-Caddy port conflict. Next action: merge when green, mirror wiki, run due soak proofs. - Security remediation SEC09-D 2026-10-11: LOCAL_DONE on maintained dev, staging runbook + rollback doc (no rollout). [Evidence](docs-backend-evidence-community-safety-SEC09D_STAGING_RUNBOOK.md). Abastevo-only rollout order (db→migrate→api/worker→caddy) with measured-headroom rate bounds (5 req/s history explicitly not a budget), stop conditions (p95/5xx/backlog/overdue/OOM), forward-only migration rollback, and no-shared-workload antiblast. Doc-only; diff-check clean, no secrets/PII. Next microtask: SEC09-E final protected delivery. - Security remediation SEC09-C 2026-10-11: LOCAL_DONE on maintained dev, integration + fault evidence at 375e213 (no product change). [Evidence](docs-backend-evidence-community-safety-SEC09C_INTEGRATION_FAULT.md). New real-PostGIS 000060 upgrade proof (applies alone, live family intact, history writable, replay empty); Android domain/application/data/app + assembleDebug re-green; build/vet/gofmt/sqlc/diff-check clean, secrets passed. Next microtask: SEC09-D staging runbook and rollback. - Security remediation SEC09-B 2026-10-11: LOCAL_DONE on maintained dev, dependency/container scans (no dep change). [Evidence](docs-backend-evidence-community-safety-SEC09B_DEPENDENCY_SCANS.md). govulncheck clean, cargo audit exit 0 (25 crates), Android catalog pinned with empty dep diff since 1b67367, all images digest-pinned, release minify+shrink with one exported activity and no pprof/debug routes. Scan-only; diff-check clean, no secrets/PII. Next microtask: SEC09-C integration and fault evidence. - Security remediation SEC09-A 2026-10-11: LOCAL_DONE on maintained dev, current-head review at 29f2725 (one harness race fix). [Evidence](docs-backend-evidence-community-safety-SEC09A_CURRENT_HEAD_REVIEW.md). 71 unit packages green; real-PostGIS -race green across account/community/privacy/feedback/identity incl. real-HTTP suites; new MaxConns=2 saturation proof (reads proceed behind stuck advisory lock, same-account waits bounded); feedback IDGen harness race fixed. Edge Caddy test env-blocked (port 18081 squatted, pre-existing at 1b67367). Next microtask: SEC09-B dependency and container scans. - Security remediation SEC08-D 2026-10-11: OWED / PROOF_OWED on maintained dev, real-phone staging matrix frozen but NOT RUN (no device/window). [Evidence](docs-backend-evidence-community-safety-SEC08D_PHONE_MATRIX.md). 4-case matrix (Fake GPS refusal, TEST_ONLY exclusion, genuine pass, offline capture) + entry criteria recorded; verdict cells empty, nothing fabricated; no photos/coords in Git. Doc-only; diff-check clean. Next microtask: SEC09-A current-head review. - Security remediation SEC08-C 2026-10-11: LOCAL_DONE on maintained dev, attestation decision doc (no code/dependency change). [Evidence](docs-backend-evidence-community-safety-SEC08C_ATTESTATION_DECISION.md). Platform attestation declined for this batch (proves app integrity, not GPS; offline captures can't carry verdicts; device-exclusion + privacy/support costs); OS-flag + recompute path stays the only verifier; grep-verified no fingerprint/blacklist/settings-read/GPS-retention/permission introduced. Doc-only; diff-check clean, no secrets/PII/GPS. Next microtask: SEC08-D real-phone staging matrix. - Security remediation SEC08-B 2026-10-11: LOCAL_DONE on maintained dev, adversarial synthetic client tests (no behavior change). [Evidence](docs-backend-evidence-community-safety-SEC08B_ADVERSARIAL_CLIENT.md). Separate c-adv/tok-synth-adv client through signed Submit + HTTP route: consistent fabrication lands VERIFIED/NEAR (residual measured); replay converges to one row; 50km teleport keeps bands with suspect flag; stale/coarse refuse forged with zero rows; missing/unreviewed degrade to UNKNOWN; garbage verdict refuses, honest SIMULATED stays silent. 8 new tests; community tree green; build/vet/gofmt/diff-check clean, secrets passed. Next microtask: SEC08-C attestation decision. - Security remediation SEC08-A 2026-10-11: LOCAL_DONE on maintained dev, location assurance policy doc (no code change). [Evidence](docs-backend-evidence-community-safety-SEC08A_LOCATION_ASSURANCE.md). Five layers distinguished (request/key, OS mock, geometry, station quality, presence); self-attestation never yields HIGH trust alone (server recompute refuses forged VERIFIED, missing source caps UNKNOWN, only VERIFIED carries proximity); 150m geometry + unknown/manual outcomes preserved; contract versioning rule frozen. Doc-only; diff-check clean, no secrets/PII/GPS. Next microtask: SEC08-B adversarial synthetic client test. - Security remediation SEC07-C 2026-10-11: LOCAL_DONE on maintained dev, Android refresh serialization (no transport/backend change). [Evidence](docs-backend-evidence-community-safety-SEC07C_ANDROID_REFRESH.md). 8-racer proof pins max API overlap 1 behind the mutex shape (Direct lock overlaps 8, probe removed); ambiguous replies cost one call with the session kept; new session-invalid verdict clears local authority without key fallback; foreign-account clears. 5 new + denial matrix extended; :application + :domain full green; diff-check clean, no secrets/PII. Next microtask: SEC08-A location assurance policy. - Security remediation SEC07-B 2026-10-11: LOCAL_DONE on maintained dev, per-issuer JWKS expiry (no session/Android change). [Evidence](docs-backend-evidence-community-safety-SEC07B_JWKS_EXPIRY.md). Per-issuer stamps (one provider never prolongs the other); exactly one TTL-bypassing refresh on unknown kids (rotation verifies, removal refuses, outage unavailable); redirects never followed (copied-client pin, zero attacker requests). 4 new + pre-existing OIDC suites green; build/vet/gofmt/diff-check clean, secrets passed. Next microtask: SEC07-C Android refresh serialization. - Security remediation SEC07-A 2026-10-11: LOCAL_DONE on maintained dev, proof-based refresh reuse (no JWKS/Android change). [Evidence](docs-backend-evidence-community-safety-SEC07A_REFRESH_REUSE.md). Random invalid refresh refuses session-invalid with the family live; history-hit replay revokes with session reuse; migration 000060 hashed history (8-deep, same-tx archive+prune) + sqlc vet/generate clean + 401 mapping. 3 unit + 2 real-PostGIS (-race) new tests; full account unit + integration green; build/vet/gofmt/sqlc/diff-check clean, secrets passed. Next microtask: SEC07-B per-issuer JWKS expiry. - Security remediation SEC06-E 2026-10-11: LOCAL_DONE on maintained dev, measured histories (no prod-code change). [Evidence](docs-backend-evidence-community-safety-SEC06E_MEASURED_HISTORIES.md). Counting-DAO pins at 1/100/1k/10k rows: dispatch ≤50, history ≤200, zero listAll on hot paths, retention batch ≤500; 10k pages 1ms/98MiB, flat across 100x growth; offline restart serves head + history, reconnect takes one bounded page; honest 19 676-row parse within ceilings. New 3/3 + :data full green; diff-check clean, no secrets/PII. Next microtask: SEC07-A refresh reuse proof. - Security remediation SEC06-D 2026-10-11: LOCAL_DONE on maintained dev, retry/refusal/attempt budgets (no sync-flow change). [Evidence](docs-backend-evidence-community-safety-SEC06D_RETRY_BUDGETS.md). Attempts park at 25 (tick MAX, history kept) with deterministic ±25% jitter; 429 Retry-After honored (bounded, malformed falls back); permanent allowlist parks distinctly, transient keeps backoff; fresh nonces under stable operation id; FIFO fairness across owners. 8 new tests; domain/application/data/app full suites + assembleDebug green; diff-check clean, no secrets/PII. Next microtask: SEC06-E measured histories. - Security remediation SEC06-C 2026-10-11: LOCAL_DONE on maintained dev, outbox SQL bounds + pages + retention (no retry change). [Evidence](docs-backend-evidence-community-safety-SEC06C_OUTBOX_BOUNDS.md). Single-find/bounded-page dispatch (keyset first, zero listAll), newest-first history pages, terminal retention (newest 1000, batch 500, amortized on writes); dispatch/owner indexes + migration 9→10 (schema 10.json aligned); owner/origin/revision/lease semantics kept. 5 new proofs + migration test; domain/application/data/app full suites green; diff-check clean, no secrets/PII. Next microtask: SEC06-D retry and retention budgets. - Security remediation SEC06-B 2026-10-11: LOCAL_DONE on maintained dev, XLSX expansion ceilings (no outbox/retry change). [Evidence](docs-backend-evidence-community-safety-SEC06B_XLSX_CEILINGS.md). Coordinates validate pre-allocation (ZZZZZZ1 refuses, XFD1048576 parses); entry bytes cap declared+actual, 1M strings/32 KiB texts/1024 worksheets caps, missing entries refuse, init failure closes ZIP. 8 crafted-zip tests (all tiny/fast); honest fixtures (incl. 19 676-row file) re-green; :data full suite green; diff-check clean, no secrets/PII. Next microtask: SEC06-C outbox SQL bounds. - Security remediation SEC06-A 2026-10-11: LOCAL_DONE on maintained dev, source-origin + transfer bounds (no parser/outbox change). [Evidence](docs-backend-evidence-community-safety-SEC06A_SOURCE_BOUNDS.md). Approved gov.br origins (HTTPS/exact host/path, no userinfo) gated pre-fetch and re-checked post-redirect; 64 MiB capped copy + atomic publish (partials purge); sanitized names (traversal pre-fetch refusal); 4 MiB capped listing read; loopback seam (production empty). 8 new tests (zero-request refusals, redirect/file-hygiene, oversize, names); :data full suite green; diff-check clean, no secrets/PII. Next microtask: SEC06-B XLSX ceilings. - Security remediation SEC05-E 2026-10-11: SOAK_RUNNING / PROOF_OWED on maintained dev (time-gated; mechanism proven, wall-clock proof owed). [Evidence](docs-backend-evidence-community-safety-SEC05E_EVERY_COPY_SOAK.md). Fake-clock every-copy compliance green (all categories deleted+marked, quiet signal); live soak seeded 2026-10-11T19:11:39Z (disposable PostGIS + MinIO, 1 original + 1 final, pre-due audit quiet) with env-gated TestSEC05ESoakVerify due after 2026-10-12T19:11:39Z (tripped pre-sweep → real Sweep → quiet receipt). Do NOT claim compliance before that run. Next microtask: SEC06-A source-origin enforcement (or the due soak proof). - Security remediation SEC05-D 2026-10-11: LOCAL_DONE on maintained dev, backup assessment + selective exclusion (no soak). [Evidence](docs-backend-evidence-community-safety-SEC05D_BACKUP_ASSESSMENT.md). Room database excluded from Auto Backup, cloud backup and device transfer (was backup-eligible with private metadata); prefs already excluded (pinned); cacheDir photos need no rule; packs re-download, restore boots fresh-install path. JVM XML pins + :app full suite green; diff-check clean, no secrets/PII. Next microtask: SEC05-E every-copy observation (time-gated). - Security remediation SEC05-C 2026-10-11: LOCAL_DONE on maintained dev, Android transient-cache cleanup (no backup/soak change). [Evidence](docs-backend-evidence-community-safety-SEC05C_TRANSIENT_CACHE.md). Cache policy v1: stale `.tmp` purge past 1 h file-age grace (live writers safe, rollback keeps), delete(id) drops tmp sibling, expiry = portable 24 h OR capture >1 h future (skew live, tamper refused+deleted); lifetime survives restart via envelope; powered-off limitation retained. 4 new cache tests; :data full suite green; diff-check clean, no secrets/PII. Next microtask: SEC05-D backup assessment. - Security remediation SEC05-B 2026-10-11: LOCAL_DONE on maintained dev, scheduling margin + catch-up + alarms (no cadence/schema change). [Evidence](docs-backend-evidence-community-safety-SEC05B_SCHEDULING_CATCHUP.md). Post-pass Overdue in SweepReport (degrades to zero, never fails cleanup); warn-level overdue alarm with worst-lag stamps; batch-honoring fakes mirror bounded SQL. 250-backlog converges in 3 runs then quiet; namespace signal alarms correctly. Evidence suites green; build/vet/gofmt/diff-check clean, secrets passed. Next microtask: SEC05-C Android transient-cache cleanup. - Security remediation SEC05-A 2026-10-11: LOCAL_DONE on maintained dev, overdue originals in audit + breaker (no scheduling/Android/soak change). [Evidence](docs-backend-evidence-community-safety-SEC05A_OVERDUE_ORIGINALS.md). New OverdueOriginals (strict created_at anchor, terminal/job agnostic) + AuditOverdue both namespaces + Unhealthy() + cmd/api breaker trips on either (sqlc vet clean). Originals-alone trip (AUD-06 repro gone), healthy-zero needs both, marked-deleted silences; real-PostGIS 48 h proof. Evidence unit + targeted integration (-race) green; build/vet/gofmt/sqlc/diff-check clean, secrets passed. Next microtask: SEC05-B scheduling margin and catch-up. - Security remediation SEC04-D 2026-10-11: LOCAL_DONE on maintained dev, replay proofs + erased-owner local cleanup (SEC04 exit; no worker-scope change). [Evidence](docs-backend-evidence-community-safety-SEC04D_REPLAY_LOCAL_CLEANUP.md). Backend: lost-response convergence, partial-restore scope-exact replay + stamps, 8-way parallel duplicate deletions converge. Android: purgeOwned (fail-closed, no schema change), photo session/cache purge, OwnerLocalErasure orchestration, gateway checkScope send-guard (pre-existing, load-bearing), ViewModel logout/delete wiring (failure keeps queue). 3 backend + 7 Android new tests; domain/application/data/app full suites + backend unit green; diff-check clean, no secrets/PII. Next microtask: SEC05-A overdue inventory. - Security remediation SEC04-C 2026-10-11: LOCAL_DONE on maintained dev, attribution + aggregates + training split (no worker-scope change). [Evidence](docs-backend-evidence-community-safety-SEC04C_ATTRIBUTION_TRAINING.md). DeleteAccountKeys (sqlc vet clean) minimizes key verifiers atomically (audit row stays); real-SQL proofs: post-delete key login key-invalid with free handle, social composition (erased rows gone, surviving reply verbatim, stats rebuilt to remaining author, foreign denominators survive, re-erase zero, training counts untouched). Account/feedback/privacy unit + integration (-race) green; build/vet/gofmt/sqlc/diff-check clean, secrets passed. Next microtask: SEC04-D local cleanup + replay proofs. - Security remediation SEC04-B 2026-10-11: LOCAL_DONE on maintained dev, deletion linkage (no training split, no local sweep). [Evidence](docs-backend-evidence-community-safety-SEC04B_DELETION_LINKAGE.md). Migration 000059 intents (append-only, sqlc vet clean) written atomically with revoke+unlink; RequestErasure port (nil refuses closed pre-mutation); DeletionReceipt (intent, not completion); cmd/api wires privacy intents per contributor (deterministic submissions, durable jobs) + sync feedback erasure. 4 unit + HTTP receipt + 2 real-PostGIS proofs (capture/revoke/replay + wired ledger/tombstone composition); account/feedback/privacy unit + integration (-race) green; build/vet/gofmt/sqlc/diff-check clean, secrets passed. Next microtask: SEC04-C attribution + aggregates + training split. - Security remediation SEC04-A 2026-10-11: PLANNING-ONLY, LOCAL (no behavior change). [Inventory](docs-backend-evidence-community-safety-SEC04A_ERASURE_INVENTORY.md). Frozen linked-owner inventory (account/contributor/social/media/queue/credential/alias/backup), retention exceptions (verifiers 24h, sessions 7d, audit 180d, copies 24h, hashes 90d, ledger persists) and receipt-vs-acknowledgement rule; bindings must be captured before unlinking (AUD-05 root). Wiring rides SEC04-B/C/D. Next microtask: SEC04-B intent + revoke + enqueue. - Security remediation SEC03-D 2026-10-11: LOCAL_DONE on maintained dev, namespace + monitoring (SEC03 exit; no provider change). [Evidence](docs-backend-evidence-community-safety-SEC03D_NAMESPACE_MONITORING.md). 8-case namespace matrix (q/ vs f/ vs public/traversal); worker Download bound pin (MaxBytes+1); IntakeHealth (reserved/accepted/rejected declared buckets + oldest incomplete, secrets-free) in SweepReport + worker log, 3 new SQL aggregates (sqlc vet clean); rejected-original reconciliation pin; real-PostGIS health proof exact. Evidence unit + integration (-race) green; build/vet/gofmt/sqlc/diff-check clean, secrets passed. Next microtask: SEC04-A erasure inventory. - Security remediation SEC03-C 2026-10-11: LOCAL_DONE on maintained dev, provider-compatible matrix over real S3 (no provider/production change). [Evidence](docs-backend-evidence-community-safety-SEC03C_PROVIDER_MATRIX.md). Disposable loopback MinIO, real SigV4/HTTP: max exact ok, max+1 transport-accepts/bounded-read-refuses, mismatch stored (claim owns it), wrong type/key 403, missing 404/delete-nil, backdated URL 4xx, interrupted stays absent, reuse overwrites (claim decides), 4 parallel complete; full verify loop (honest READY + retrievable final, oversize/mismatch refuse with zero final). Evidence suites green; vet/gofmt/diff-check clean, secrets passed. Next microtask: SEC03-D namespace + monitoring. - Security remediation SEC03-B 2026-10-11: LOCAL_DONE on maintained dev, transfer-boundary decision + pins (no provider/transport change). [Evidence](docs-backend-evidence-community-safety-SEC03B_TRANSFER_BOUNDARY.md). Keep direct presigned PUT (UNSIGNED-PAYLOAD proven uncappable; no exact-length PUT without provider proof; no S3 POST on R2) + enforce at verify (MaxBytes+1 one-download bind, Snapshot cap, claim/dims/sanitize gates) + SEC03-A admission + 5-min TTL + quarantine-only keys + sweep reconciliation. 3 new boundary pins (declared-never-widens, substitution-mismatch, absence-transient); evidence suites green; vet/gofmt/diff-check clean, secrets passed. Next microtask: SEC03-C provider-compatible matrix. - Security remediation SEC03-A 2026-10-11: LOCAL_DONE on maintained dev, atomic reservations + byte budgets (no transfer-boundary change). [Evidence](docs-backend-evidence-community-safety-SEC03A_ATOMIC_RESERVATION.md). ReserveBudget (count + live ISSUED/VERIFYING bytes, expiry releases) admits with the row in one tx/lock (pg_advisory_xact_lock per contributor); replays converge at full quota, divergent bodies conflict. Frozen MaxReserveBytesPerDay (10x3MiB); new SumLiveBytesSince (sqlc vet clean). Parallel 12-over-9 admits exactly 10 (unit + real PostGIS); byte bind/release proven. Evidence unit + integration (-race) green; build/vet/gofmt/sqlc/diff-check clean, secrets passed. Next microtask: SEC03-B transfer boundary. - Security remediation SEC02-C 2026-10-11: LOCAL_DONE on maintained dev, global/per-client split + viability + edge proof (no VPS edge change). [Evidence](docs-backend-evidence-community-safety-SEC02C_BUDGET_SPLIT.md). Process-local GlobalBreaker (hourly ceilings, 503 overloaded + Retry-After, zero disables) sheds before fairness (429); ANPFUEL_GLOBAL_QUOTA_* (default disabled, validated) + cmd/api wiring. Viability pins (10 units; 6/60 + 4/10 headroom); real docker Caddy→API proof PASS (observed loopback billed, direct forgery bills peer). Identity/config unit + integration (-race) green; build/vet/gofmt/diff-check clean, secrets passed. Next microtask: SEC03-A atomic reservations. - Security remediation SEC02-B 2026-10-11: LOCAL_DONE on maintained dev, trusted-proxy resolver + wiring (no global breaker, no VPS edge change). [Evidence](docs-backend-evidence-community-safety-SEC02B_TRUSTED_RESOLVER.md). Narrow Resolver (trusted immediate peer only, last-valid chain entry, peer fallback, fail-closed peers) + ANPFUEL_TRUSTED_PROXIES (default trust-nothing, startup-validated) + cmd/api wiring + env examples. 3/3 SEC02-A regressions GREEN + 13-case resolver matrix + parse/config matrices; identity unit + integration (-race) green; build/vet/gofmt/diff-check clean, secrets passed. Next microtask: SEC02-C global/per-client split + viability. - Security remediation SEC02-A 2026-10-11: LOCAL_DONE on maintained dev, proxy-fairness regressions only (no behavior change). [Evidence](docs-backend-evidence-community-safety-SEC02A_PROXY_REGRESSIONS.md). 3 skipped tests (shared-bucket flaw + spoof guard + malformed fallback), flaw body proven FAILING unskipped then restored skipped per repo precedent. Suites green; vet/gofmt/diff-check clean, secrets passed. Resolver + budgets ride SEC02-B/C. Next microtask: SEC02-B trusted resolver + wiring. - Security remediation SEC01-D 2026-10-11: LOCAL_DONE on maintained dev, retry/rollback + stable 429s (no SMTP, no SEC02+ scope). [Evidence](docs-backend-evidence-community-safety-SEC01D_RETRY_ROLLBACK.md). Mail-failure DeleteCode rollback (zero rows/budget, recovered retry 1/1); cooldown duplicates converge (1 row/1 mail); exhausted global nil with zero growth; hourly rotation re-admits; duplicate comment-ID replays converged, foreign reuse fails closed; account 429s carry Retry-After (aggregate 3600, session 60) and feedback 429s (report exact, comment 60) with stable codes and no identity echo. Unit + real-PostGIS (-race) green; build/vet/gofmt/sqlc/diff-check clean, secrets passed. Next microtask: SEC02-A proxy-fairness regressions. - Landing PR #128 reconciliation 2026-10-11: LOCAL_RECONCILED / REMOTE_CHECK_PENDING, isolated `codex/landing-reconcile-dev`; [evidence](docs-release-evidence-landing-redesign.md). Ordinary merge of published dev `47b5464` into landing `04dbdf8`; sole PROGRESS conflict resolved retaining both parents. Typecheck/build/check + 40 landing tests PASS; backend/app and in-progress local dev work preserved. User-authorized landing→dev merge requires current-head Quick verification; main/deploy/index remain pending. - Security remediation SEC01-C 2026-10-11: LOCAL_DONE on maintained dev, atomic admission + budgets (no SMTP, no SEC01-D matrix). [Evidence](docs-backend-evidence-community-safety-SEC01C_ATOMIC_ADMISSION.md). Frozen: aggregate mail 20/h, key-usernames 100/h, live sessions 10/account, live comments 100/account; ValidEmail + ParseComment before any store IO (zero lookups for malformed); TryIssue/TryCreateKey/TryCreateFamily/TryInsert under one lock/tx (pg_advisory_xact_lock); purges with exact counts (codes ≤24h after expiry, families ≤7d after absolute). 6/6 SEC01-A regressions GREEN (session rewritten to cap+second-account) + 5 new unit + 4 new real-PostGIS parallel/purge tests; account/feedback unit + integration (-race) green; build/vet/gofmt/sqlc/diff-check clean, secrets passed. Next microtask: SEC01-D real-SQL flood/rollback/retry proofs. - Security remediation SEC01-B 2026-10-11: LOCAL_DONE on maintained dev, bounded mailbox + config-gated delivery (no SMTP, no aggregate bounds). [Evidence](docs-backend-evidence-community-safety-SEC01B_MAILBOX_BOUND.md). Memory outbox ring-capped at 100 (oldest drops); Service.MailEnabled off-by-default answers nil before any store write (zero rows/mail, no oracle); ANPFUEL_MAIL_MODE off|memory (smtp refused); cmd/api wires cap + flag. New cap/gate/config tests green incl. RED pre-GREEN; existing fixtures opt in explicitly; account unit + integration (-race) green; build/vet/gofmt/diff-check clean, secrets passed. Next microtask: SEC01-C atomic admission + budgets. - Security remediation SEC01-A 2026-10-11: LOCAL_DONE on maintained dev, admission regressions only (no behavior change). [Evidence](docs-backend-evidence-community-safety-SEC01A_ADMISSION_REGRESSIONS.md). 6 skipped tests (account: aggregate email/usernames/sessions + invalid-address store cost; feedback: per-account flood + invalid-text pipeline cost), each proven FAILING unskipped then restored skipped per repo precedent. Suites green; vet/gofmt/diff-check clean, secrets passed. Bounds + fixes ride SEC01-B/C/D. Next microtask: SEC01-B mailbox bound. - Security remediation SEC00-C 2026-10-11: PLANNING-ONLY, LOCAL (unpublished by policy; no push this turn). Versioned budget freeze in docs/planning/SEC00C_BUDGET_FREEZE.md (untracked): item/byte/time tables with code-anchored ceilings (quota v1, reserves 10/day, attempts 5, pages ≤100, 3MiB uploads, 8/16/64KiB bodies, OTP 600s, session 900s, challenges 5min, idempotency 7d, sessions 24h, presign 5min, JWKS 3600s, lease 5min/retry 1min, purge TTL 24h) + concurrency posture (3 still-reproducing gaps owned by SEC01–03) + PROPOSED section explicitly unadvertised + current 429/503 semantics. Next microtask: SEC01-A admission regressions. - Security remediation SEC00-B 2026-10-11: PLANNING-ONLY, LOCAL (unpublished by policy; no push this turn). Route/capability inventory by access class in docs/planning/SEC00B_ROUTE_INVENTORY.md (untracked): anonymous reads, anonymous signed price writes (intentional, not a bypass), account-only social writes (incl. suggestions/claims verified), private owner reads, upload grants, restricted operator CLI (no HTTP). All classes verified against registrations/handler comments/cmd wiring; OpenAPI security:[] means proof-based, not anonymous. Next microtask: SEC00-C budget freeze. - Security remediation SEC00-A 2026-10-11: PLANNING-ONLY, LOCAL (unpublished by policy; no push this turn). Reconciled dev at 9474af8 (3 ahead of origin/dev; PR129 code-only at a5674aa) and re-ran all 11 audit characterization probes against current source in an isolated worktree (since removed; checkout untouched): 9 unit + 2 real-SQL on a unique disposable PostGIS (since removed) — ALL still reproduce. Record in docs/planning/SEC00A_REPRODUCTION_RECORD.md (untracked). Probes must be inverted into regressions task by task, not blessed. Next microtask: SEC00-B route/capability inventory. - Community safety CS15-B1 2026-10-11: PLANNING-ONLY, LOCAL (unpublished by policy; no push this turn). Safety-rows decision freeze in docs/planning/OFFLINE_DECISION_FREEZE_CS15B1.md (untracked): helpfulness/consent/promotion/purge/erasure/settings rows with frozen defaults, guest/account prerequisites, offline permit decisions, queue/receipt conflict states and completeness classes; limits verified in code (quota v1, idempotency 7d, job attempts 5, body 64KiB, sweep daily, TTL 24h). Non-safety areas ride CS15-B2; manifests ride CS15-C. Next microtask: soak SLO proof after 2026-10-12T16:11:11Z (then CS15-B2). - Community safety CS15-A 2026-10-11: PLANNING-ONLY, LOCAL (unpublished by policy; no push this turn). Capability inventory written to docs/planning/OFFLINE_CAPABILITY_INVENTORY.md (untracked): 21 verified routes, 50 use-case files in 20 groups, 12 backend modules, ANP import pipeline, payment absent (grep-verified), consent/helpfulness panels confirmed unplaced. Nothing invented; no outcomes frozen (CS15-B) and no manifests/seeds/budgets (CS15-C). Next microtask: soak SLO proof after 2026-10-12T16:11:11Z (then CS15-B). - Community safety CS12A 2026-10-11: LOCAL_DONE on maintained dev, consent live-stack integration tests only (no prod-code change). [Evidence](docs-backend-evidence-community-safety-CS12A_CONSENT_LIVE.md). Fixture mirrors cmd/api (real verifier/registrar/stores, P-256 proofs, disposable PostGIS). 7 tests green under -race: owner flow, live-clock replay convergence, cross-owner isolation, guest 401×3, revoked-key 401 with zero rows, tampered-body refusal with zero rows, stale-terms 400. Passed first run (composition already correct; RED was the missing coverage). Full privacy suites green; vet/gofmt/diff-check clean, secrets passed. No quota wiring (self-limiting singleton, recorded); no per-route metrics framework (recorded). Soak still SOAK_RUNNING. Next microtask: soak SLO proof after 2026-10-12T16:11:11Z. - Community safety CS11C 2026-10-11: LOCAL_DONE on maintained dev, per-photo opt-in state + row + strings + tests only (no placement/wire/PT). [Evidence](docs-backend-evidence-community-safety-CS11C_PHOTO_OPT_IN.md). Opt-in state (default-off, consent-gated checks, wipe on clear, blank-safe, lock-guarded) + checkbox row (unchecked default, disabled with gate text, hoisted state, TalkBack helper) + 2 English strings. 10 JVM tests green (6+4) incl. RED pre-GREEN; full app suite + assembleDebug green. Flags ride the future producer payload; server enforces consent+scope at commit regardless. diff-check clean. Soak still SOAK_RUNNING. Next microtask: soak SLO proof after 2026-10-12T16:11:11Z (then CS12). - Community safety CS11B 2026-10-11: LOCAL_DONE on maintained dev, consent ViewModel/panel/DI/strings only (no placement/per-photo/PT). [Evidence](docs-backend-evidence-community-safety-CS11B_CONSENT_VIEW.md). ViewModel (Guest/Loading/Content/Updating/Offline/Pending/Rejected; sync-first foreground; toggle grants/revokes then reloads server-exact; single flight; retry) + panel (switch, server state, terms/regrant/pending/delete/rights; guest renders nothing; TalkBack helper; no fixed heights) + 11 English strings + DI (client, binds, use-case; Hilt KSP green). 12 JVM tests green (8+4) incl. RED pre-GREEN; full app/data suites + assembleDebug green. KSP false-start from scripted edit bisected and resolved (byte-identical method builds clean). diff-check clean. Soak still SOAK_RUNNING. Next microtask: CS11C per-photo opt-in at review. - Community safety CS11A 2026-10-11: LOCAL_DONE on maintained dev, training-consent Android client layers only (no ViewModel/panel/strings/DI/screens). [Evidence](docs-backend-evidence-community-safety-CS11A_CONSENT_CLIENT.md). Domain ports (frozen kinds, receipt, owner status, gateway) + OkHttp client (3 endpoints, strict parse, frozen privacy.* mapping, no client retries) + SharedPreferences state store (toggle OFF default, monotonic revision, pending revocation) + use case (guest zero-IO, grant fail-closed offline, revoke queues pending, syncPending uploads, per-decision revisions). 16 JVM tests green (8+8) incl. RED pre-GREEN; full data/application/domain suites green. diff-check clean. Soak still SOAK_RUNNING. Next microtask: CS11B consent ViewModel/panel/DI/strings. - Community safety CS10D 2026-10-11: LOCAL_DONE on maintained dev, TRAINING erasure scope only (no soak claim/VPS/APK). [Evidence](docs-backend-evidence-community-safety-CS10D_TRAINING_ERASURE.md). ScopeTraining after EVIDENCE + migration 000058 ledger CHECK + EraseTrainingContributor (consent REVOKED past stored revision, derivatives tombstoned, bytes purged immediately, re-runs converge, failures → FAILED) + ListDerivativesByOwner + runScopes/replay/report + worker/ops wiring (explicit refusal when unconfigured). 3 new unit tests + scope-failure test + 5→6 ledger assertions green; real-PostGIS erasure journey proves revoke/tombstone/byte-purge/6 rows/converged repeat; full privacy suites green under -race. vet/gofmt/sqlc/diff-check clean, secrets passed. Soak still SOAK_RUNNING (untouched). Next microtask: soak SLO proof after 2026-10-12T16:11:11Z (then CS11). - Community safety CS10C 2026-10-11: LOCAL_DONE (mechanics) / SOAK_RUNNING on maintained dev — promotion worker + byte namespace + purge + soak start (no erasure scope/VPS/APK). [Evidence](docs-backend-evidence-community-safety-CS10C_WORKER_PURGE_SOAK.md). Job `privacy-training-promote` (identifier-only payload, source hash-bind, replay converges, fail-closed) + `Propose` returns minimized bytes for the single namespace write + `privacy-training-sweep-daily` over `SweepRevoked` (due→delete→confirm; missing vs failures split; rows stay REVOKED) + SigV4 `TrainingObjects` + worker wiring (explicit refusal when unconfigured). New unit tests green incl. RED pre-GREEN; full privacy suites green under -race; build/vet/gofmt/diff-check clean, secrets passed. Soak seeded 16:11:11Z on local MinIO (named volume) + scratch PostGIS: overdue copy purged on first sweep (checked=1 purged=1), 3 fresh copies due 2026-10-12T16:11:11Z retained, control alive. SLO proof due after the wall clock — do NOT claim before TestSoakVerify then. Next microtask: erasure TRAINING scope; then soak proof. - Community safety CS10B 2026-10-11: LOCAL_DONE on maintained dev, derivative persistence + sanitizer adapter only (no job/worker/bytes/soak/APK). [Evidence](docs-backend-evidence-community-safety-CS10B_DERIVATIVE_STORE.md). Migration 000057 inventory (PK image+revision, ACTIVE/REVOKED, append-only) + sqlc derivatives.sql (regenerated, vet clean) + `PromotionStore` (converged puts, owner-scoped reads, guarded revoke mark) + media-mapped sanitizer (PASS minimizes, all refusals FAIL, UNCERTAIN reserved). 8 new tests green under -race on real PostGIS (round trip, convergence/conflict, 10-way concurrency, revoke flow, 000057-only upgrade, non-destructive pins, JPEG pass/fail-closed); full privacy suites green. vet/gofmt/sqlc/diff-check clean, secrets passed. Job handler deferred to CS10C (no queue producer exists yet). Collection stays OFF. Next microtask: CS10C worker/byte namespace/24h soak/restore drill. - Community safety CS10A 2026-10-11: LOCAL_DONE on maintained dev, promotion domain + worker contract only (no migration/SQL/adapter/scheduling/purge/soak/APK). [Evidence](docs-backend-evidence-community-safety-CS10A_PROMOTION_CONTRACT.md). Commit-time consent re-check (revoke between queue and commit refuses), future-only per-image scope, fail-closed verdicts (FAIL/UNCERTAIN refuse, outage writes nothing), identifier-only derivative rows, image-plus-revision convergence, idempotent owner revocation with restore-filter tombstones, shared SelectableForTraining filter. 15 new tests (domain 8 + application 6 + fixture 1) green under -race incl. RED pre-GREEN; build/vet/gofmt/diff-check clean, secrets passed. Collection stays OFF. Next microtask: CS10B derivative persistence + worker wiring. - Community safety CS09C 2026-10-11: LOCAL_DONE on maintained dev, training-consent signed HTTP + OpenAPI only (no migration/worker/S3/APK). [Evidence](docs-backend-evidence-community-safety-CS09C_CONSENT_HTTP.md). 3 owner routes (grant/revoke/status, 200 + receipts, anonymous 401 first, strict 64KiB/UTF-8/canonical-revision bodies, frozen privacy.* codes, no-store, no leaks) + cmd/api wiring (guarded store, verifier caller, configured terms digest with provisional default) + OpenAPI 3 paths/4 schemas + 4 apicontract vectors. E2e correction: live-clock identical retries now converge (revision is the identity, instants are stamps); ConsentView gained terms_digest. 8 unit + router e2e on real PostGIS green under -race; CS09A/B suites re-green; apicontract green; build/vet/gofmt/diff-check clean, secrets passed. Collection stays OFF. Next microtask: CS10 promotion/24h expiry/physical deletion. - Community safety CS09B 2026-10-11: LOCAL_DONE on maintained dev, training-consent persistence only (no HTTP/OpenAPI/worker/S3/APK). [Evidence](docs-backend-evidence-community-safety-CS09B_CONSENT_STORE.md). Migration 000056 singleton (`privacy_training_consents`, revision-guarded, append-only) + sqlc consent.sql (regenerated, vet clean) + `ConsentStore` (compile-time port assertion; upsert-greater/replay-identical/conflict-divergent/refuse-stale; owner no-oracle reads). 7 new real-PostGIS tests green under -race (round trip, revision guard, 10-way concurrency, owner isolation, application flow incl. stale-grant refusal, 000056-only upgrade with history intact, non-destructive pins); full privacy unit + integration suites green. vet/gofmt/sqlc/diff-check clean, secrets passed. Collection stays OFF. Next microtask: CS09C consent signed HTTP + OpenAPI. - Community safety CS09A 2026-10-11: LOCAL_DONE on maintained dev, training-consent domain + server contract only (no migration/HTTP/worker/S3/APK). [Evidence](docs-backend-evidence-community-safety-CS09A_CONSENT_CONTRACT.md). Frozen TRAINING purpose + training-terms-v1, default-OFF absent, revision-ordered singleton (stale refuses, identical replays, divergent conflicts), future-only per-image scope, revoke stops selection atomically with purge signal, owner-bound no-oracle reads. 20 new tests (domain 10 + application 9 + fixture 1) green incl. RED pre-GREEN and -race concurrent revokes; vet/gofmt/build/diff-check clean, secrets passed. Collection stays OFF. Next microtask: CS09B consent persistence + signed HTTP/OpenAPI. - Security audit 2026-10-11: AUDIT_LOCAL_DONE / REMEDIATION_NOT_STARTED; immutable dev snapshot `954a8d8`, no runtime changes. [Executive/source audit](docs-security-SECURITY_AUDIT_2026-10-11.md), [SEC00–SEC09 remediation microtasks](docs-planning-SECURITY_REMEDIATION_PLAN_2026-10-11.md), [sanitized reproductions](docs-security-evidence-audit-2026-10-11-README.md). Recorded 3 HIGH and 9 MEDIUM findings/conditional risks, no demonstrated CRITICAL: aggregate admission, direct-upload bytes and proxy quota fairness first; privacy erasure/retention, Android cache/parser/outbox, refresh/JWKS and GPS assurance next. All 67 tested Go packages and eight real disposable-PostGIS adapter packages passed; bounded probes reproduced defects; Go/Rust advisory scans reported zero findings, static/secret gates passed. Characterization PASS is not safe behavior. Concurrent CS02–CS07A construction reached `d04c96f` during review and is outside the tested snapshot; unfinished Android changes also require review. No VPS/phone, production data, deployment, GitHub/wiki publication or release certification. Next: SEC00 current-head reconciliation under the implementation scope; fixes remain planned. - Community safety CS08B 2026-10-11: LOCAL_DONE on maintained dev, ViewModel/panel/DI/guest (no screen placement). [Evidence](docs-backend-evidence-community-safety-CS08B_HELPFULNESS_VIEW.md). ViewModel (Disabled/Guest/Idle/Loading/Content/Submitting/Rejected, stable id, single flight) + panel (counts/choice/notice, Denunciar delegates, guest card) + pure TalkBack helper + 15 strings + under_review DTO + DI bindings. ViewModel 6/6 + a11y 4/4 green; Hilt MissingBinding seen pre-DI, green after; debug compile successful. Next microtask: CS09 consent/inventory/rights. - Community safety CS08A 2026-10-11: LOCAL_DONE on maintained dev, client layers only (no DI/ViewModel). [Evidence](docs-backend-evidence-community-safety-CS08A_HELPFULNESS_CLIENT.md). Ports (frozen choices/kinds/shapes) + usecase (flag gate, validations, fixed rejections) + flag store (default OFF) + HTTP client (routes, idempotency, kind mapping, fixed text). Application 6/6 + data MockWebServer 4/4 + full application suite green. diff-check clean. Next microtask: CS08B ViewModel/panel/DI/guest. - Community safety CS07A 2026-10-11: LOCAL_DONE on maintained dev, harness + local runs only (no staging). [Evidence](docs-backend-evidence-community-safety-CS07A_BENCH_HARNESS.md). Bench (warmup + tally/cast/flip, mirrors anti-drift) stable 2x: tally p50 0.07ms/p95 0.28ms; cast p50 3.6ms/p95 8.9ms; flip p50 2.9ms/p95 15.2ms. Protocolo staging congelado (5×120s, warmup, teto 5rps, headroom 5%). vet/gofmt/diff-check clean, secrets passed. Next microtask: CS07B staging guard runs (authorized window). - Community safety CS06 2026-10-11: LOCAL_DONE on maintained dev, isolation proofs only (no route/schema/migration). [Evidence](docs-backend-evidence-community-safety-CS06_PROJECTIONS_ISOLATION.md). Floor display vectors (unanimous/splits/edges/2^40); full helpfulness lifecycle leaves prices/ratings/inputs byte-identical; static pins (no cross-refs either direction; no DELETE on dispute/vote audit — 35d bounds ledger/media only). Unit + integration green. vet/gofmt/diff-check clean, secrets passed. Next microtask: CS07 benchmark/guardrails. - Community safety CS05B 2026-10-11: LOCAL_DONE on maintained dev, annotation + adversarial script (no migration). [Evidence](docs-backend-evidence-community-safety-CS05B_REVIEW_ANNOTATION.md). `ReviewLookup` port + `TallyResult.UnderReview` (nil-safe, fail-closed 503); moderation `OpenReview`; frozen `under_review` + `review_notice` wording; wiring cmd/api + fixture; OpenAPI + vector; `scripts/helpfulness-adversarial.sh` (loopback-only local, https+confirm staging, guards exercised; staging run owed). Unit + e2e (RED pre-wiring → GREEN; dismiss clears) + full HTTP package + contract green. vet/gofmt/diff-check clean, secrets passed. Next microtask: CS06 projections/consensus. - Community safety CS05A 2026-10-11: LOCAL_DONE on maintained dev, moderation target only (no routes). [Evidence](docs-backend-evidence-community-safety-CS05A_CONTRIBUTION_MODERATION.md). `CONTRIBUTION` target (P2, UUID) + frozen reasons (SPAM/HARASSMENT/VOTE_GAMING/OFF_TOPIC/OTHER, enforced for new target only) + REVIEW/INVALIDATE/RESOLVE/DISMISS eligibility + consensus job mapping + migration 000055 (000026 precedent) + ops CLI. Hide = REJECTED + recompute (no new writer); proven: invalidate → cast/tally refuse, audit 1/0 intact. Unit + one-open-case + full invalidate-flow integration green. vet/gofmt/sqlc/diff-check clean, secrets passed. Next microtask: CS05B annotation + adversarial pass. - Community safety CS04 2026-10-11: LOCAL_DONE on maintained dev, read pins + measured plans only. [Evidence](docs-backend-evidence-community-safety-CS04_FEED_PLANS.md). New: EXPLAIN pins (cheapest index-only, tally pkey single search, rebuild target idx, zero seq scans) over 1500-row load; tiebreak ascending across all 30 pages; 4 orders serve; 8×4 ValidateFeed matrix; FeedItem no-leak. Measured: feed 4.1ms exec / 0.7ms planning; tally 1 index search. RLS absent by design (P08 owns roles); 35d is retention not feed expiry. vet/gofmt/diff-check clean, secrets passed. Next microtask: CS05 moderation queue. - Community safety CS03B 2026-10-11: LOCAL_DONE on maintained dev, identity hardening only (no migration). [Evidence](docs-backend-evidence-community-safety-CS03B_LIMITER_ROTATION.md). Fixed 2 real gaps in `HashIPSubject` (IPv4-mapped fork via missing `Unmap()`; `%zone` accepted) caught RED by new pins. Proven: 50 farm subjects → exactly 50 live rows, expiry+sweep → 0 with budgets back; attribution token identical across full rotation (no vote fork; old key dead per existing proof). Full identity unit+integration green. vet/gofmt/diff-check clean, secrets passed. No global subject ceiling (NAT-availability rationale, residual recorded). Next microtask: CS04 feeds/query plans. - Community safety CS03A 2026-10-11: LOCAL_DONE on maintained dev, quota only (no migration). [Evidence](docs-backend-evidence-community-safety-CS03A_HELPFULNESS_QUOTA.md). `HelpfulnessPorts.CheckQuota` (fingerprint/write, fail-closed nil) with 429 + Retry-After mapping in cmd/api and fixture. Proven: stable per-account token binds one vote across device keys; shared fingerprint keeps kiosk accounts separate. Fixed two latent tally races exposed by quota wiring (in-tx retry 25P02; stale-snapshot rebuild overwrite) via single-pass bump + advisory-lock serialization. Unit (denial/kiosk/stability) + HTTP 429 + real-Limiter exhaustion (3 ok, 4th denied, tally 3/0) green; CS02A 11/11 re-green incl. 2x race; full unit + HTTP integration green. vet/gofmt/diff-check clean, secrets passed. Next microtask: CS03B cardinality/IP/rotation. - Community safety CS02B 2026-10-11: LOCAL_DONE on maintained dev, HTTP+OpenAPI only. [Evidence](docs-backend-evidence-community-safety-CS02B_HELPFULNESS_HTTP.md). 3 versioned routes (cast 201/remove 200/public tally + signed overlay), strict bodies (64KiB, unknown/dup/trailing/UTF-8 rejected), frozen error codes (self-vote 403, stale 409, invalid-vote 400), no voter/key/device/cursor leaks, no-store; real wiring in cmd/api. Binding fix: vote identity binds caller.Token like confirmations (e2e caught author self-vote 201 → now 403). Unit 12/12, full-stack e2e (signed proof, replay, negatives) green, CS02A 10/10 re-green incl. race, apicontract 4 vectors green. vet/gofmt/diff-check clean, secrets passed. Next microtask: CS03 admission/abuse. - Community safety CS02A 2026-10-11: LOCAL_DONE on maintained dev, store only (no HTTP/OpenAPI). [Evidence](docs-backend-evidence-community-safety-CS02A_HELPFULNESS_STORE.md). Migration 000054 (votes uniques, tallies with non-negative checks, observation visibility columns) + sqlc queries + `HelpfulnessStore` pg implementation. Real-PostGIS: 10/10 green incl. 20-voter concurrency, flips, removals, crash-replay, per-contributor submission scope, corrupt-tally rebuild, ownership/eligibility, erase+recast, 000054 upgrade, non-destructive guard; concurrent trio also `-race` green. Key fix: delta-upsert rejected by PG CHECK-before-conflict semantics → plain UPDATE + exact rebuild on missing. vet/gofmt/diff-check clean, secrets scan passed; local staticcheck predates go1.27 (env gap, CI pinned). Next microtask: CS02B helpfulness HTTP + OpenAPI. - Offline community extension 2026-10-11: PLANNING_LOCAL_DONE / IMPLEMENTATION_NOT_STARTED, opening maintained dev `61f7c1b`; existing CI contributor commit preserved. [CS15–CS25 additional phases/rules](docs-planning-COMMUNITY_SAFETY_EXECUTION_PLAN.md), [updated implementation and eight-line microtask prompts](docs-planning-COMMUNITY_SAFETY_EXECUTION_PROMPT.md), [inactive Portuguese offline notice](docs-product-COMMUNITY_PRIVACY_TERMS_PT_BR.md). Execution order CS00–CS12 → CS15–CS25 → CS13 → CS14 preserves final staging/device GPS acceptance. Reuse Room station cache/outbox; city feed lacks persistent cache-first reads, dispatch scans listAll, current capture needs online two-minute authorization. Plan covers bounded offline city packs/local pages, all-route capability matrix, queued social/price/privacy actions, versioned offline-capture decision, clock/expiry/owner rules, reconnect quotas/idempotency, abuse/resource/recovery tests and actual device/24h evidence. Full coverage means tested outcomes, never unseen fresh prices, instant remote acknowledgement or absolute abuse immunity. No runtime/dependency/VPS/device/GitHub/wiki operation; docs checks only. Next: selected pending microtask under explicit dependency order; all implementation/runtime gates remain pending. - Landing redesign LR39 2026-10-11: LOCAL_DONE on branch `landing`, final SEO/AI report in [evidence](docs-release-evidence-landing-redesign.md) (verified vs owed per source, no ranking guarantee). Landing construction batch LR00–LR39 complete; integration/deploy/index owed per LR36–LR38. - Landing redesign LR38 2026-10-11: LOCAL_DONE on branch `landing`, index follow-up. - Landing redesign LR37 2026-10-11: RECORDED on branch `landing` — DEPLOY_PENDING, no remote change (no infra approvals requested or received). Owed: integration, protected delivery, then preview/publish/smoke/rollback approvals. Next: LR38 index follow-up. - Landing redesign LR36 2026-10-11: DECISION on branch `landing` — INTEGRATION_PENDING, no merge. - Landing redesign LR35 2026-10-11: LOCAL_DONE on branch `landing`, scoped union once at `3da311e`. - Landing redesign LR34 2026-10-11: LOCAL_DONE on branch `landing`, pending-media sweep. - Landing redesign LR33 2026-10-11: LOCAL_DONE on branch `landing`, final review. - Landing redesign LR32 2026-10-11: LOCAL_DONE on branch `landing`, accessibility exit. - Landing redesign LR31 2026-10-11: LOCAL_DONE on branch `landing`, store readiness. - Landing redesign LR30 2026-10-11: LOCAL_DONE on branch `landing`, error/redirect pass. - Landing redesign LR29 2026-10-11: LOCAL_DONE on branch `landing`, performance pass. - Landing redesign LR28 2026-10-11: LOCAL_DONE on branch `landing`, crawler directives. - Landing redesign LR27 2026-10-11: LOCAL_DONE on branch `landing`, indexation evidence. - Landing redesign LR26 2026-10-11: LOCAL_DONE on branch `landing`, navigation hardening. - Landing redesign LR25 2026-10-11: LOCAL_DONE on branch `landing`, legal copy review. - Landing redesign LR24 2026-10-11: LOCAL_DONE on branch `landing`, search/recovery/CRUD reference. - Landing redesign LR23 2026-10-11: LOCAL_DONE on branch `landing`, permission/location pass. - Landing redesign LR22 2026-10-11: LOCAL_DONE on branch `landing`, offline/error states. Airplane-offline cache + empty-search captures (radios restored off, query cleared, list verified); TU29 page + TU08 error step; manifest 23/69. Build/check green, 35/35 tests. Next: LR23 permission/location pass. - Landing redesign LR21 2026-10-11: LOCAL_DONE on branch `landing`, seven evidence-backed chapters (TU05/06/07/08/17/23/28 from accepted masters + fresh read-only bound dumps, no new captures). 14 chapter pages live; TU01/03/04/11/12/15/16/18/19/22/24/25/27/29/30 pending (no captures or blocked). Build/check green, 35/35 tests. Next: LR22 empty/error/offline states. - Landing redesign LR20 2026-10-11: LOCAL_DONE on branch `landing`, vehicle-form lesson TU26. Blank dark form (nothing typed/toggled/saved) + page; suggest/claim/manage entries unobserved, alert OS permission pending. Build/check green, 35/35 tests. Device left on Explorar. Next: LR21 remaining lessons. - Landing redesign LR19 2026-10-11: LOCAL_DONE on branch `landing`, report-rules lesson TU21. Rules dialog capture (read-only, dismissed) + page; rating/comment/vote composers gated by station verification + empty feed, pending hermetic preproduction. Build/check green, 35/35 tests. Next: LR20 management lessons. - Landing redesign LR18 2026-10-11: LOCAL_DONE on branch `landing`, photo entry lesson TU14. Capture-entry frame (degraded list, disabled shutter, dev toggle off) + page; shutter never pressed, OCR/outbox pending on synthetic fixtures. Build/check green, 35/35 tests. Next: LR19 participation lessons. - Landing redesign LR17 2026-10-11: LOCAL_DONE on branch `landing`, account lesson TU13. Profile-connected capture (demo `zanatateste`, no key in pixels) + page; auth/key visuals secure-blocked (hierarchy-verified, never invented); TU11/TU12 visuals pending. Build/check green, 35/35 tests. Next: LR18 photo lessons. - Landing redesign LR16 2026-10-11: LOCAL_DONE on branch `landing`, driver lessons BUC01/BUC02. Chapter pages TU02/TU09/TU10 (10 steps, native-viewBox overlays, prev/next, hub links flipped, sitemap); full text without JS, no app-write semantics. Build/check green, 35/35 tests. Conta `zanatateste` segue logada para LR17+. Next: LR17 account lessons. - Landing redesign LR15 2026-10-11: LOCAL_DONE on branch `landing`, tutorial hub. `/como-usar/` with 30 chapters, 4 journeys, status labels, zero dead links; home nav + sitemap + build/check wired. Build/check green, 34/34 tests. Chapter links flip on as pages land (LR16+). Next: LR16 driver lessons. - Landing redesign LR14 2026-10-11: LOCAL_DONE on branch `landing`, three annotated lessons. `lesson.json` for TU02/TU09/TU10 (10 steps, real bounds from dumps) + municipios-mt master/derivatives (manifest 17, app 51); validator covers shipped lessons. Build/check green, 33/33 tests. Next: LR15 tutorial hub. - Landing redesign LR13 2026-10-11: LOCAL_DONE on branch `landing`, tutorial data contract. `lesson.json` schema + overlay/prev-next rules in [catalog](docs-product-LANDING_MOBILE_TUTORIAL_CATALOG.md); pure `validateLesson` (`src/tutorial.ts`, test-only, never shipped) + shared chapter styles; 3 validator tests. Typecheck green, 33/33 tests. Next: LR14 three annotated lessons. - Landing redesign LR12 2026-10-11: LOCAL_DONE on branch `landing`, source/project/footer pass. Explicit ANP non-affiliation + source separation + no-promise copy; legal/GitHub/MIT destinations preserved and test-guarded. Build/check green, 30/30 tests. Conta `zanatateste` logada no aparelho registrada para LR16+; aparelho intocado neste lote. Next: LR13 tutorial data contract. - Landing redesign LR11 2026-10-11: LOCAL_DONE on branch `landing`, app gallery + stories. 3 authentic figures (srcset 360/720/1080, lazy, alt, captions with status) + static layout; no carousel/autoplay; emitted-asset test. Build/check green, 30/30 tests. Next: LR12 source/privacy/project/footer. - Landing redesign LR10 2026-10-11: LOCAL_DONE on branch `landing`, header/hero revision. Candidate H1 + `Conheça o aplicativo`→#aplicativo primary CTA (contract-amended, checks updated), 1152px width, 32–56px H1, solid AA CTA; hero phone-free (test-guarded). Typecheck/build/check green, 29/29 tests. Tutorial anchor wiring owed at LR15 (no orphan links). Next: LR11 gallery/stories. - Landing redesign LR09 2026-10-11: LOCAL_DONE on branch `landing`, asset build extension. Provenance-gated `assets/app/` copying (48 WebP hash-verified, masters refused, missing/traversal loud) + 4 build tests; typecheck/build/check green, landing tests 29/29. Chapter route registration owed at LR15 with chapter sources. Next: LR10 header/hero. - Landing redesign LR08 2026-10-11: LOCAL_DONE on branch `landing`, responsive derivatives. 48 deterministic WebP (360/720/1080w, q85, aspect-preserved, no upscale) + provenance in `landing/static/assets/app/`; 360w legible at 100%, rebuild identical, landing tests 25/25 green. Build wiring/alt assignment owed at LR09/LR11. Next: LR09 asset build. - Landing redesign LR07 2026-10-11: LOCAL_DONE on branch `landing`, manifest selection. 16 entries with roles + claim classes, rejected list, 13 missing rows in manifest; [README selection](docs-assets-landing-redesign-20261011-README.md). Integrity re-verified 16/16, diff-check clean, secrets passed. Next: LR08 responsive derivatives. - Landing redesign LR06 2026-10-11: LOCAL_DONE on branch `landing`, conditional states view-only. 2 clean captures (contributions-empty, settings) in manifest (16 total); auth/key screens uncapturable by FLAG_SECURE (recorded, TU11/TU12 visuals pending); fixture-gated states (photo/OCR/outbox/feedback/claim) pending, never staged on user phone. Hash/dim checks, diff-check clean, secrets passed. Next: LR07 manifest selection. - Landing redesign LR05 2026-10-11: LOCAL_DONE on branch `landing`, public-read marketing set. 6 clean 1220×2712 captures (stations-list, station-detail, station-sources, community-feed, history, week-picker) in media [README](docs-assets-landing-redesign-20261011-README.md)/manifest (14 total); read-only authorized phone session, Sorriso kept, no mutations; notification + secure-screen frames rejected. 100% visual review + hash/dim checks, diff-check clean, secrets passed. Next: LR06 conditional states. - Landing redesign LR04 2026-10-11: LOCAL_DONE on branch `landing`, safe capture environment. Standard (pt-BR, 1.0 font, portrait, native res) + seeder ban (`clearAppStorage:262`) + device rule in media [README](docs-assets-landing-redesign-20261011-README.md)/manifest; no new capture, 8/8 hashes re-verified. Diff-check clean, secrets passed. Next: LR05 marketing capture set (needs device session). - Landing redesign LR03 2026-10-11: LOCAL_DONE on branch `landing`, visual contract revision. Reference-v2 composition frozen; token supersessions (1152px width, Manrope/Source Sans, teal/pale palette, frame radii + one device shadow) + measured AA contrast + logo provenance in [contract](docs-product-LANDING_CONTENT_CONTRACT.md). Wireframes well-formed/script-free, diff-check clean, secrets passed. Next: LR04 capture environment. - Landing redesign LR02 2026-10-11: LOCAL_DONE on branch `landing`, IA/copy freeze. Home anchor order + `/como-usar/` hub + 30 frozen chapter slugs in [contract](docs-product-LANDING_CONTENT_CONTRACT.md)/[catalog](docs-product-LANDING_MOBILE_TUTORIAL_CATALOG.md); `/guias/` + legal retained; availability labels fixed. Slug check 30/30 unique, diff-check clean, secrets passed. Next: LR03 visual contract. - Landing redesign LR01 2026-10-11: LOCAL_DONE on branch `landing`, capability/claim freeze. [Catalog](docs-product-LANDING_MOBILE_TUTORIAL_CATALOG.md) maps all 25 Routes.kt constants to TU01–TU30; TU20/CS-offline/training-consent/provider-email explicitly gated; [content contract](docs-product-LANDING_CONTENT_CONTRACT.md) reconciled to username/key primary flow. Route-to-chapter check 25/25, diff-check clean, secrets passed. Next: LR02 IA/copy freeze. - Landing redesign LR00 2026-10-11: LOCAL_DONE on branch `landing` (evidence `20bb603`, ledger refresh `8d10c22` local; `origin/landing` `20bb603`, `dev`/`origin/dev` `a853708`, `main`/`origin/main` `a349d7c`). [Evidence](docs-release-evidence-landing-redesign.md). Worktree `.worktrees/landing-refresh` clean; occupied dev checkout untouched. P25/P26 acceptance and preparation artifacts (local fonts, authentic reference/media, 30-chapter catalog) inventoried and re-verified (8/8 capture hashes+dims, 4/4 font hashes+signatures, TU01–TU30 present); no duplicate foundation work. Git-only validation + secret scan, no runtime suite per plan. Next: LR01 capability/claim inventory. - Landing preparation 2026-10-11: PLANNING_LOCAL_DONE; FONT_INTEGRATION_LOCAL_DONE / INTEGRATION_PENDING; production redesign and complete tutorials NOT_STARTED. Existing **landing** branch, isolated `.worktrees/landing-refresh`, opening `954a8d8`; occupied dev edits untouched. [40 microtasks LR00–LR39](docs-planning-LANDING_REDESIGN_EXECUTION_PLAN.md), [economical-agent prompt](docs-planning-LANDING_REDESIGN_EXECUTION_PROMPT.md), [30-chapter mobile catalog](docs-product-LANDING_MOBILE_TUTORIAL_CATALOG.md) and [authentic reference/media](docs-assets-landing-redesign-20261011-README.md). Separate opening/gallery/tutorial sections; two-step red-rectangle preview uses real app pixels. Eight native 1220×2712 captures, guest/blank states, debug 3.1.0/code4, installed SHA unknown; private overlay attempts rejected. Original dark theme restored. Requested local Manrope/Source Sans 3 WOFF2 + OFL/provenance/hash-copy regression integrated; typecheck/build/check and 25 landing tests passed, gate selection 18/18, browser responsive/font checks passed. Zaflas read-only SEO patterns and current official search/AI crawler research recorded; no ranking guarantee. No account/data mutation, backend behavior, deployment, remote tracker/PR/merge/wiki or index submission. Next: LR00 reconcile prepared artifacts on landing, then the next authorized bounded phase; normal reviewed integration into dev and protected dev→main only at authorized delivery. - Community safety CS01 2026-10-11: LOCAL_DONE on maintained dev at `61f7c1b`, pure domain+contract only. [Evidence](docs-backend-evidence-community-safety-CS01_HELPFULNESS_CONTRACT.md). Frozen: votes bind observation UUID + decision sequence (stale refuses, never transfers); HELPFUL/NOT_HELPFUL only (VALID refuses); floor-bp share null on zero; self/inactive/hidden/deleted/stale refuse pre-mutation; change rewrites, retry replays, remove idempotent; counts public, MyChoice private; erasure via ContributorRef (store in CS02). New: domain/helpfulness.go, application/helpfulness.go, 4 golden fixtures + pinning test; no migration/HTTP/route/VPS. `go test ./internal/modules/community/...` green incl. 16 new tests (RED seen pre-GREEN), vet/gofmt/diff-check clean, secrets scan passed. Next microtask: CS02 atomic votes/HTTP/projections. - Community safety CS00 2026-10-11: LOCAL_DONE on maintained dev at `61f7c1b`, audit only. [Evidence](docs-backend-evidence-community-safety-CS00_AUDIT.md). Verified reuse: community confirm/dispute (000013 uniques, 48h window), feedback VALID/INVALID pattern (000025 one-live-vote, floor pct), moderation one-open-case (000016, P1-P3, 200/500 chars), identity quotas v1 (10/200/60 per hour, keyed IP digests), feed GET /v1/community/feed (route cap 50 vs shared 100, 4 orders, sealed 15min cursor), 24h media/3 MiB reserve/retention TTLs, 100m/100m/s location gates. Missing: HELPFUL tables/routes, contribution+revision target (observations lack revision counter), CONTRIBUTION moderation target, consent/TEST_ONLY inventory. dev contains main (15 ahead, 0 behind). `git diff --check` clean, no secrets/PII, no runtime/VPS/CI change. Next microtask: CS01 helpfulness domain+contract. - Android CI fix 2026-10-11: LOCAL_DONE on maintained dev for protected PR127, coroutine-isolation correction only. `CommunityPricesViewModelTest` now shares one `StandardTestDispatcher` (`runTest(dispatcher)`, repo idiom from CommunityFeed/Vehicle/CaptureOcr tests) so `viewModelScope` (Main) and `advanceUntilIdle()` run on the same scheduler; bare `runTest` left Main coroutines on an unsynchronized scheduler, the textbook `UncaughtExceptionsBeforeTest` flake seen in run38140418786. Forced no-cache reruns green: debug 249/249, release 241/241, community package 44/44. No production-code, dependency or workflow change. Next: push dev so PR127 re-runs remote checks; merge only with green required checks. - Community safety planning 2026-10-11: PLANNING_LOCAL_DONE / IMPLEMENTATION_NOT_STARTED on maintained dev, opening `0f3601c`. [CS00–CS14 phased plan](docs-planning-COMMUNITY_SAFETY_EXECUTION_PLAN.md), [implementation-AI prompt](docs-planning-COMMUNITY_SAFETY_EXECUTION_PROMPT.md) and [Portuguese terms/Settings copy draft](docs-product-COMMUNITY_PRIVACY_TERMS_PT_BR.md). User clarified votes mean contribution helpful/not helpful, independently of price correctness/confidence. Reuse existing votes/reports/identity/feeds/privacy, add bounded admission/storage/query tests and actual all-copy 24h expiry/deletion/restore evidence. Last phase: Abastevo-only staging and connected Android Fake GPS refusal/isolated TEST_ONLY geometry plus genuine-location acceptance. Terms remain NOT_ACTIVE; collection stays OFF. No runtime code, dependency, VPS/device or GitHub/wiki change. Documentation references/consistency, secret surface and diff validation only; no runtime acceptance. Next implementation task: CS00, then bounded sequential phases; PR127 Android failure below still blocks delivery. - CI recovery 2026-10-11: backend corrections LOCAL_DONE / INTEGRATION_PENDING on maintained dev for protected PR127; final delivery BLOCKED by Android CI. [Failure causes, correction and validation](docs-backend-CI_PR127_RECOVERY.md). Lowercase worker errors restore staticcheck; backend CI and the full local runner now build/provide the actual locked Rust preparer, without skipping its pipeline integration test. Pinned Go and dependency-cache paths repaired. Targeted worker race/static checks, workflow/shell validation and complete disposable-PostGIS suite passed (80 tested packages, race detector, actual Rust pipeline). At published head `0f3601c`, backend fast/integration and Quick verification passed; Android `test` failed with `UncaughtExceptionsBeforeTest` in `CommunityPricesViewModelTest` (run38140418786). Local JDK17 debug249/release241 tests passed without establishing the remote failure's cause or a fix. No VPS changes. Next delivery task: diagnose/fix actual coroutine isolation failure, validate changed head, then guarded merge only with successful checks and publish merged-SHA wiki; no lucky-rerun acceptance. Wiki preview also has an independent `IMAGE_OUTSIDE_ASSETS` blocker in RST_VPS_HARDENING.md; no wiki publication occurred. - Daily registry refresh 2026-10-10: LOCAL_DONE / INTEGRATION_PENDING; bounded staging DEPLOYED, behavior13c7c25. [Contract/tests/runbook and sanitized evidence](docs-backend-REGISTRY_DAILY_SYNC.md). Daily03:00 America/Cuiaba now active,250m/256Mi max, no resident refresh process. Live ANP45617 publication120.8s/189.0MiB cgroup peak; unchanged verification2.9s/20.7MiB,10 curated differences preserved. Real PostGIS recovery/concurrency/source-change tests passed; final photo-retry correction passed15 DB cases. Two actual HTTPS5req/s windows each1500 correct, zero errors/drops, worst route p95 mixed274.7ms/final API473.8ms. Same pod/media volume; API/worker each one intentional restart, storage/DB0, no OOM/unexpected restart; only Abastevo affected. All45617 real prepared station IDs have profiles; one pre-existing non-ANP identity has no profile;24552 synthetic assertions remain distinct. Global MinIO hash varied and is not photo-integrity acceptance. No daily scheduled run/24h soak/max-user/G09 certification inferred. Next: protected dev→main PR127 delivery and merged-SHA wiki when checks allow. - RST hardening 2026-10-10: corrections LOCAL_DONE / INTEGRATION_PENDING on maintained dev; runtime PARTIAL. [Scope, tests, measurements and reproduction](docs-backend-RST_VPS_HARDENING.md). PG18/checkpoint and concurrent-throughput fixes; bounded file emission/atomic streaming load, unchanged membership, transient recovery and paged profile publication passed immediate real VPS failure/concurrency/migration/least-privilege tests. Actual ANP import published 45,617 real stations/profiles; 121 municipality variants quarantined; 24,552 synthetic assertions retained separately. Five VPS Rust preparations median4.609s / max113.1MiB RSS under250m CPU. Actual HTTPS pooled5req/s completed one300s window (1,500 correct, p95<=292.2ms); second repetition stopped by host-load reserve5.9409>5.2, so no replicated capacity/max-users acceptance. Only Abastevo modified; existing limits preserved, no observed OOM/unexpected restart. Schema53 temporarily broke old API readiness; compatible API/worker2cd3fb6 override restored200, incident recorded. Selected private raw archive preserved/hash-verified; reproducible aggregate report committed. RST20 24/48h and full RST21 remain NOT_ACCEPTED; UF partition exploratory. No production certification. Next: protected dev→main delivery; then long-harness correction and safe reserved-window measurements without touching other apps. - Rust RST-20 soak pilot 2026-10-10: HISTORICAL_PILOT / SOAK_OWED, isolated PostGIS only; cost slopes require corrected collectors. [Soak evidence](docs-planning-RUST_STATION_INGESTION_RST20.md). 30-min pilot green (9 imports, 6 retained, worst window p95 71 ms, 0 errors, backlog flat); slopes WAL +9.28/table +3.75/dead +944 per min; row-DELETE retention flagged expensive (1,086 s, owed task); checkpoint counters unverified (gap). 24/48h OWED. RST-21 environment prepped (bundle index + collection checker green). Next: RST-21 decision/report (separately authorized). - Ops note 2026-10-10: station-load ingest CLI added (`backend/cmd/station-load`, stage-only, no migrations); PR #126 merged dev→main via guarded helper (checks green, no bypass); staging redeployed from merged main (migration 000049–000052 applied, api+worker rebuilt @a349d7c, 3/3 Running, health 200) and the 20k batch is LOADED (registry 19552/430/18 + pmqc 5000/0/0 complete, 24,552 live assertions, exact oracle; API ready throughout). Path notes: tunnel numbers are path-limited (loader ran on-VPS in 69s vs 10min-timeout over tunnel); one partial tunnel run surgically cleaned (10,213 rows + 1 run, zero residue); gofmt applied once to a stale ignored scratch file blocking the local gate (disclosed). Incidental: local dev DB received its 4 pending forward migrations, consistent, no loss. - Rust RST-19 recovery 2026-10-09: TESTED, isolated PostGIS only. [Recovery evidence](docs-planning-RUST_STATION_INGESTION_RST19.md). Kill/disconnect/duplicate/malformed/checksum/stale faults all fail loudly with invariants held (no loss, no dupes, no false-complete); kill exposed a silent-retry trap, fixed with a 5-line fail-loud reload (no prod callers, replay untouched); reads never error during kill with immediate drain. Disk-full unsupported (shared disk), 48h virtual-clock not executed (owed). Next: RST-20 soak (separately authorized). - Rust RST-18 capacity 2026-10-09: HISTORICAL_DIAGNOSTIC, Reader-direct isolated DBs only; importer/checkpoint metrics invalid, HTTP capacity unproven by this run. [Capacity evidence](docs-planning-RUST_STATION_INGESTION_RST18.md). Open-arrival reads × 1/4 closed-loop disjoint-edition importers on identical cells: local envelope sustainable at 100 rps + 4 importers, knee bracketed in (100, 200] rps (drops + p95 breach, imports still error-free); VPS staging envelope 20 rps reads-alone with knee in (20, 50] explained by the 1-CPU DB pod cap (tunnel numbers discarded as path-limited; zero leftovers, namespace untouched). Next: RST-19 failure/recovery (separately authorized). - Rust RST-17 partitions 2026-10-09: EXPLORATORY, lab DDL only; the 2026-10-10 review supersedes adoption/direction language. [Partition evidence](docs-planning-RUST_STATION_INGESTION_RST17.md). A vs UF-LIST B vs hash-16 C on leveled 100k field (3 trials): B totals −14/−18/−23% with repeatable scan wins and no repeatable regression (hypothesis only, adoption not accepted; A stays deployed); C sign-flips including +33% (rejected); BRIN on history +73.8% at 7 ms/24 KB (accepted as direction). Next: RST-18 concurrent load (separately authorized). - Rust RST-16 spatial reads 2026-10-09: MEASURED, isolated PostGIS only. [Spatial evidence](docs-planning-RUST_STATION_INGESTION_RST16.md). Vincenty oracle agrees exactly at 150m/1km/5km/15km over dense/sparse/empty/cross-UF sites with GiST diagnostics (wide radii sort-bound; border 15km p95 ~167 ms breaches provisional 150 ms, owed to RST-18); authoritative 150m gate allows/refuses 149.9/150/150.1m on real PostGIS with fix-integrity negatives refusing pre-DB (+0.17 ms gate overhead). Next: RST-17 partitions (separately authorized). - Rust RST-15 city reads 2026-10-09: MEASURED, isolated PostGIS only. [Traffic evidence](docs-planning-RUST_STATION_INGESTION_RST15.md). Nine workloads at raw-SQL vs Reader layers, stable 5/20/50 keyset pagination with tie coverage, closed 1/8/32 + open 20 rps, pinned cache states, plan diagnostics, trigram GIN trial (+85% selective text, accept-pending-migration); 1M spot closed-8 dense p95 201 ms breaches the provisional 100 ms hypothesis (owed revision, RST-18). Next: RST-16 spatial reads (separately authorized). - Rust RST-14 construction 2026-10-09: MEASURED, isolated PostGIS only. [Construction evidence](docs-planning-RUST_STATION_INGESTION_RST14.md). Real RST-13→loader chain exposed and fixed two contracts (manifest timestamps; duplicate multiset emission for loader-side dedup); per-stage timing + WAL/storage metrics on fresh DBs (tiny ~0.7 ms/1,422 WAL-B per row, 20k ~0.5 ms/852 B, ~1 commit/row); replay/concurrent converge, stale editions fail visibly; publication NOT_AVAILABLE, COPY/delta loaders owed as separate tasks. Next: RST-15 city reads (separately authorized). - Rust RST-13 preparation 2026-10-09: MEASURED, offline only. [Preparation evidence](docs-planning-RUST_STATION_INGESTION_RST13.md). New `bench_stages` per-stage timing plus additive spill runs/bytes accounting; release matrix 20k/100k/1M (parse 372k→262k rows/s, emit ~450k in-memory/~250k spill-forced, RSS ~3.6 KiB/row); reorder/spill reproduce hashes exactly, deltas publish, accounting reconciles every case. Historical emission buffered all outputs; bounded file emission now tested under hardening (parsed batch remains resident). Next: RST-14 DB construction (separately authorized). - Rust RST-12 harness 2026-10-09: IMPLEMENTED, tooling only. [Harness evidence](docs-planning-RUST_STATION_INGESTION_RST12.md). Extended `stats.py` (sample schema v1, reconcile, histogram merge, overhead aid, budget/refuse exits) plus new stdlib `drive.py` (closed 1/8/32 + open-rate with counted drops, timeout/wrong/cancel paths); 9/9 loopback checks pass, load smoke 46,546 reqs within budgets. One pre-existing `faults.sh` readiness-after-recovery failure reproduced on clean tree (out of scope, fails closed). Next: RST-13 preparation scaling (separately authorized). - Rust RST-11 datasets 2026-10-09: IMPLEMENTED, offline synthetic only. [Datasets evidence](docs-planning-RUST_STATION_INGESTION_RST11.md). Deterministic generator/oracle/request traces (`station-datasets-v1`, 200+5 cities, seeds pinned); committed tiny set 30/24/2/4 with frozen hashes; stress-100k reproduces RST-07 98004/1996/0 accounting; empty strata listed, never invented. Next: RST-12 harness (separately authorized). - Rust RST-10 protocol 2026-10-09: PROTOCOL_FROZEN, no code/DB/network. [Protocol freeze](docs-planning-RUST_STATION_INGESTION_RST10.md). Versioned run-manifest schema, metric dictionary, workload IDs, ceilings/stop conditions and worksheet with provisional budgets as hypotheses; RST-07 pilot as baseline, gaps (8-client evidence, pg_stat_statements) blocking SLO language. Next: RST-11 datasets (separately authorized). - Rust RST-09 handoff 2026-10-09: IMPLEMENTED, read projection only. [Handoff evidence](docs-planning-RUST_STATION_INGESTION_RST09.md). Directory reads carry source-separated official anchors with run freshness (nil for community-only, no trust mixing); unknown locations stay honest nulls excluded from Nearby; code-exact municipality pagination pinned with rollback runbook (additive only, no migration, canonical data survives removal). Contract spec updated without new warnings. Next: RST-10 protocol (separately authorized) or staged live-source verification. - Rust RST-08 discovery ops 2026-10-09: IMPLEMENTED, no live fetch. [Operations evidence](docs-planning-RUST_STATION_INGESTION_RST08.md). New `registry-discover` job wraps bounded discovery with snapshot idempotency, terminal quarantine completion and Fail/backoff/dead-letter on provider faults; worker wiring plus disabled daily schedule mirror the reconcile pattern. Unit and real-PostGIS dispatched tests cover bounded retries (exactly 3 hits), crash recovery via lease expiry, outage dead-lettering and no-refetch replay. Next: RST-09 city/profile handoff. - CI source-enum repair 2026-10-09: FIXED. Migration 000052 restores `dou-editions`/`dou-acts` dropped by 000049/000050 (evolved from the creating migration instead of 000033); enum regression test pins all six sources; dou integration green again. - Rust benchmark planning extension 2026-10-09: PLANNING_LOCAL_DONE / INTEGRATION_PENDING on isolated `codex/ingestion-bench-plan`, parent `e257ee8`; [RST-10–21 performance campaign](docs-planning-RUST_STATION_BENCHMARK_PLAN.md), linked from the [ingestion plan](docs-planning-RUST_STATION_INGESTION_PLAN.md) and [bounded prompt](docs-planning-RUST_STATION_INGESTION_PROMPT.md). Twelve additional phases define reproducible protocol/corpus/harness, preparation and DB construction, geographic city/spatial reads, index/partition comparison, mixed-load capacity, recovery/soak/cost and regression decisions. Existing RST-00–09/P29 IDs and concurrent RST-06 work preserved. Metrics include explicit denominators, error/drop/censored samples, per-city strata, repeated trials, raw artifacts and provisional budgets; no benchmark execution, measured speedup, implementation, DB change or remote publication. Docs links/phase coverage/whitespace/secret surface reviewed. Next benchmark task: explicitly select RST-10 protocol only; implementation tasks keep their separate current evidence. - Rust RST-07 bench 2026-10-09: MEASURED, no partitioning. [Benchmark evidence](docs-planning-RUST_STATION_INGESTION_RST07.md). Shared-seed 100k parses identically both sides (98004/1996/0, multiset hash equal, golden recipe pinned); Rust 322k rows/s at 214 MiB RSS, Go 124–152k rows/s at 8.2 MiB heap, 1M needs 2.19 GiB (streaming follow-up owed). Reads at 100k/1M: candidate covering index cuts city-dense p95 83.7→49.2 ms with no regression (adopted, migration 000051); partitions rejected on data. Revised lab targets recorded. Next: RST-08 incremental operations. - Rust RST-06 review gate 2026-10-09: IMPLEMENTED, staging only. [Review evidence](docs-planning-RUST_STATION_INGESTION_RST06.md). Migration 000050 adds the `review` run source; new `ReviewCandidate` promotes corroborated candidates (same CNPJ, complete runs, unknown quality, 150 m transformed agreement, 90-day window) to reviewed assertions on deterministic snapshots, with rejection staging nothing; CRS math stays in PostGIS/PROJ (measured 4674 shift 0.0000 m, Go-vs-PostGIS scale 0.15%); end-to-end projects reviewed with 0.000 m gap. Directory/community suites green. Next: RST-07 benchmark/index experiment. - Rust RST-05 loader 2026-10-09: IMPLEMENTED, staging only. [Loader evidence](docs-planning-RUST_STATION_INGESTION_RST05.md). Migration 000049 extends the run source enum with `station-prep`; new `LoadBatch` validates manifests/streams before any run exists and stages per-input runs through existing ownership with idempotent replay, live count agreement, succession links and hard unknown/pending gates; real-PostGIS race tests cover empty/upgrade/concurrent/tampered/ID-retention/no-partial/least-privilege role. Publication and official-lookup scope unchanged. Next: RST-06 location review gate on real PostGIS. - Rust RST-04 join 2026-10-09: IMPLEMENTED, no network/DB. [Join evidence](docs-planning-RUST_STATION_INGESTION_RST04.md). New `join` module anchors pointed PMQC candidates at exact registry CNPJs with current/predates/stale/conflicting/missing triage, haversine conflict radius, 3-year staleness and coarse-precision flags; fixture evaluates 6 = 1+1+1+2+1 with identical reordered JSONL and no location promotion. 7 unit + 9 parser + 7 join + 9 deltas tests pass; fmt/clippy/test-locked clean, cargo-audit without findings. Next: RST-05 owned Go loader with real-PostGIS tests. - CI quick gate 2026-10-09: FIXED/MONITORED. `tools/*` classified for full selection with new bounded `scripts/check-rust-fast.sh` (fmt, clippy, locked tests), `make check-rust`, pinned Rust 1.99.0 toolchain in `quick.yml` and gate-harness assertions (18/18 local). Residual local-only `gofmt` stop at ignored foreign scratch `backend/.local/` left untouched; clean CI checkout unaffected. PR #125 OPEN awaiting required check. - Rust RST-03 deltas 2026-10-09: IMPLEMENTED, no network/DB. [Delta evidence](docs-planning-RUST_STATION_INGESTION_RST03.md). `station-prep 0.2.0` emits deterministic JSONL streams plus hashed batch manifest with atomic temp-rename publication, length-prefixed spill sort with run cleanup, golden canonical checksum and Noop/Publish/Stale replay decisions; 4 unit + 9 parser + 9 deltas tests pass, fmt/clippy/test-locked clean, cargo-audit without findings. Next: RST-04 coordinate-candidate hardening, still no reviewed flag. - Rust RST-02 parser 2026-10-09: IMPLEMENTED, no network/DB. [Parser evidence](docs-planning-RUST_STATION_INGESTION_RST02.md). New `tools/station-prep/` library parses local 13-column registry and PMQC extracts to typed rows with bounded memory, kernel-compatible CNPJ checks, alias-table municipality resolution, SHA256 dedup, succession links and stable output order; fixtures evaluate 12 = 7+1+4 and 11 = 5+1+5 with byte-identical reordered JSONL. Pinned csv/serde/serde_json/sha2 with tracked lockfile, MIT-compatible licences, rust-version 1.99, zero cargo-audit findings; fmt/clippy/test-locked clean. Next: RST-03 determinism/deltas with spill strategy. - Rust RST-01 contract 2026-10-09: CONTRACT_FROZEN, no implementation. [Source/batch contract](docs-planning-RUST_STATION_INGESTION_RST01.md). Froze membership-as-evidence mapping, UTF-8/BOM encoding, name-based header quarantine, IBGE alias rules, EPSG:4674 pending candidates and manifest-gated publication; new shared fixtures in `contracts/testdata/station-prep/` (13-column registry, header variant, PMQC assays, IBGE aliases, JSONL outputs, hashed batch manifest). No Cargo/dependency/DB/fetch change. Next: RST-02 pure Rust streaming parser over local files. - Rust RST-00 audit 2026-10-09: AUDIT_DONE, no implementation. [Audit and minimal contract](docs-planning-RUST_STATION_INGESTION_RST00.md). Verified Go Directory/staging ownership, 13-column ANP header gaps (no COD_IBGE/SITUACAO/coordinates), PMQC EPSG:4674 candidates with unknown accuracy not usable in the 150m rule, existing complete-run-gated (non-atomic-snapshot) reconciliation, and indexed-baseline-first city/nearby reads. No Cargo/dependency/DB/fetch change. Next: RST-01 synthetic source/batch contract with fixtures and acceptance. - Rust preparation planning 2026-10-09: [national source/location/performance plan](docs-planning-RUST_STATION_INGESTION_PLAN.md) and [economical-agent prompt](docs-planning-RUST_STATION_INGESTION_PROMPT.md) PLANNING_LOCAL_DONE; implementation PLANNED. Verified live 13-column ANP registry header has no coordinates/COD_IBGE/SITUACAO; PMQC metadata offers optional EPSG:4674 points without metre-accuracy evidence. Ten sequential tasks reuse existing Go Directory/Profile/staging, start with offline Rust preparation, and benchmark indexed baseline against optional read-projection partitioning. No crate, dependency, database partition, national fetch or coordinate promotion. Local links/whitespace/secret-surface reviewed. Next: RST-00 audit after app-first checkpoints and explicit implementation selection. - Premium gasoline extension 2026-10-09: P37-T01/T02 LOCAL_DONE / INTEGRATION_PENDING on isolated `codex/premium-fuel`, parent `e6772c5`; [contract/evidence](docs-mobile-premium-fuel-category.md). Distinct premium grade preserves persisted additive data, manual selection/filters and exact signed submission. Explicit gasoline premium/brands recognized; bare brands stay manual. Ruby PNG generated then traced to six-path SVG, same 128px gasoline export; [repeatable icon workflow](docs-assets-fuel-icons-README.md). Full affected unit suites, zero-error lint/APKs, race/real-PostGIS, OpenAPI/static/secret/diff checks and four POCO OCR/Room cases passed. Combined app (249 unit cases) installed without data wipe; three native icon cases also passed. Backend deployment/live premium receipts remain pending. Independent PC06 remains owed. Rust plan delivered; maintained dev reconciled at behavior head `333c5f2`, preserving login. Next runtime step: separately scoped test-service backend publication before live premium sends. - Owner-scope repair 2026-10-09: P37-T02 LOCAL_DONE / INTEGRATION_PENDING; [contract/evidence](docs-mobile-p37-owner-scope-expiry.md). Retained account identity survives access expiry without using an expired bearer; logout/key/account/origin changes remain blocked. 112 focused cases, final transport regression, zero-error lint/build/R8 and two native feedback cases passed. Exact-capture recovery found no eligible commands and no receipts; mobile delivery remains OWED. Temporary operator harness removed. Next: user-authorized distinct premium fuel category/icon, then Rust importer planning only. - User-scoped OCR expansion 2026-10-08: P37-T01 LOCAL_DONE / INTEGRATION_PENDING on maintained dev parent `82aaa22`. [Behavior, exact-value metrics and limits](docs-mobile-p37-ocr-expanded-validation.md). Twenty hash-checked real photos improved 51→60 exact pairs out of 76, with incorrect associated rows 3→0; sixteen misses and seven incorrect unassigned manual numbers remain explicit. Bounded three-view crop/grayscale reconciliation preserves uncertain/conflicting values for human review. 1,313 executed unit cases (one unrelated opt-in live catalog skip), 32 spatial/view cases, five native POCO cases with 18 format/layout combinations and eight EXIF modes, five scorer cases, zero-error app/data lint/build/static/secret/diff checks passed. No dependency/backend/publication change. Independent PC06 acceptance remains owed; no universal/statistical accuracy claim. Next: finish the confirmed expired-access owner-scope repair and install the combined app without data wipe. - User-scoped send repair 2026-10-08: P37-T02 LOCAL_DONE / INTEGRATION_PENDING on maintained dev parent `1896cf2`. [Behavior and recovery evidence](docs-mobile-p37-send-feedback-recovery.md). Visible queued/received/retrying/partial dialogs now offer immediate return to Community; server receipt is separate from validation. 246 app unit and two native POCO dialog cases, debug lint/build/static/secret/diff checks passed; corrected APK installed without data wipe. Existing backend replay/convergence real-PostGIS race tests passed. Explicitly authorized same-photo recovery restored hash-verified 231,563 bytes and replayed one audited dead job: session READY and job DONE; other two old jobs untouched. Mobile five-command retry backoff still pending at checkpoint, so no sent claim. No new submission, backend deployment or remote Git publication. Next: verify existing mobile receipts while completing the requested broader OCR validation. - User-scoped OCR repair 2026-10-08: P37-T01 split board numbers LOCAL_DONE / INTEGRATION_PENDING on clean maintained dev parent `5bfd214`; actual origin/main already an ancestor. [Behavior and evidence](docs-mobile-p37-split-price-ocr.md). Connected POCO reproduced only ethanol because the other prices were separate integer/fraction OCR blocks. Bounded same-row recovery now recognizes all four exact values on the original review photo (354ms); the other eleven private corpus images retain their prior suggestions. 17 spatial regressions, 1,296 executed domain/application/data/app cases, two native pixel/corpus/corrupt tests, debug builds, zero-error lint and static/secret/diff checks passed; one unrelated opt-in live catalog case remains skipped. Corrected APK installed successfully with ADB, without account/data wipe. No backend/dependency/deployment or GitHub publication. Next: owner re-read in the corrected APK; human confirmation and prior PC05/PC06/release obligations remain unchanged. - User-scoped developer validation 2026-10-08: temporary Android/server photo preview, one native key unlock per app session and shared account/login completion UI. [Behavior and evidence](docs-mobile-android-developer-preview-key-session.md). LOCAL_DONE / INTEGRATION_PENDING to main. Local dev fast-forward completed at d95b189; owned feature 16f3a07 and combined behavior e26d546 preserve all UI/plan commits and maintained dev 60a3fd7, including upload origin and Go security fixes. Fingerprint `9c7c4460d48c2fde18fb81091a6990934fa55cd2914181d2360f746f0773c82b`: 73 focused Android cases, POCO account/media/Keystore cases (account repeated on final APK), race/real-PostGIS/S3/API-worker checks, lint/R8/size (4,224,869 bytes), vet/govulncheck/static/contract/secret/diff checks passed. Final debug APK installed without wiping account/data. Deployment only in `abastevo-temp`: dependency-refreshed API/worker, private storage, backed-up/restored private media, migrations 43–48; unique-photo runtime READY and two prices VALIDATED. Public health ready; repeated smoke exhausted the unchanged public peer challenge quota until 08:00 Cuiaba. Owner extended the preview to seven days: cutoff 2026-10-15 07:45:50 Cuiaba. Owned deadline/restart/config checks and signed no-GPS runtime authorization passed; five private objects restored and verified. Current-source APK reinstalled by ADB without data wipe. Native credential entry and full Android gallery/server walkthrough remain owner QA. No other VPS app mutation or task GitHub publication/production/G09/iOS acceptance. Next: owner UI validation in Curitiba / POSTO PENTEST TEMP after the quota window renews; protected final batch delivery only when authorized. - Continuation 2026-10-07: P37-PC04B Android LOCAL_DONE / INTEGRATION_PENDING on maintained dev, parent `79005fe`. [Android evidence](docs-mobile-p37-photo-subset-android.md); [backend slice](docs-mobile-p37-photo-subset-backend.md). Final serial Gradle `BUILD SUCCESSFUL in 6m 52s` (268 tasks): 61 focused unit tests (application 15, domain 9, data 15, app 22), zero failures/skips; lint debug zero errors; release 4,226,245 bytes without debug hooks; `git diff --check` and secret scan passed. POCO 2311DRK48G/API36: reinstalled current data instrumentation APK and ran isolated Room suites `PhotoReviewOutboxDeviceTest,V8ToV9PhotoOutboxMigrationTest` — `OK (3 tests)`. PC05 consent and expanded PC06 remain pending. No push, PR update, merge, wiki or deployment; no readiness claim beyond local evidence. - Active execution 2026-10-07: P37-PC04 IN_PROGRESS on maintained dev, parent e41936c. [PC04A backend evidence](docs-mobile-p37-photo-subset-backend.md): capture-bound reservation/shared evidence and per-product immutable intake LOCAL_DONE / INTEGRATION_PENDING; affected race/PostGIS/HTTP-process/static/contract checks passed. Android transactional review/signed dispatcher/owner receipts are underway. Actual private S3 media, staging profile and PC05 consent/PC06 expanded acceptance remain owed; collection stays OFF. No deployment, merge or production certification. - Active execution 2026-10-07: P37-PC03 camera/review LOCAL_DONE / INTEGRATION_PENDING on maintained dev, parent df77de6. [Behavior and evidence](docs-mobile-p37-camera-review.md). 42 scoped unit tests; genuine POCO four-case review suite passed normally and at 160% font; real camera/shutter/return and isolated Keystore verified. Serial lint (zero errors), release/R8/size (4,191,429 bytes), release debug-hook exclusion and static/secret/diff checks passed. Next: PC04 signed shared-photo outbox, then PC05 optional permanent training/deletion and PC06 expanded acceptance. Cellular staging TLS/directory works but the selected profile is unavailable; local host/Wi-Fi TLS chain remains untrusted. User accepted test-only contact placeholder until production. No live photo submission, collection activation, merge or production certification is claimed. - Active execution 2026-10-07: P37-PC02 native image OCR LOCAL_DONE / INTEGRATION_PENDING, parent c1efc4b. [Measured adapter/model/limits](docs-mobile-p37-image-ocr.md). POCO API36: actual 12-image run and synthetic/corrupt test passed; 34 unit regressions passed. Exact smoke suggestions 21/40, 19 misses, one conditional LED digit error; p50 331.5ms / p95 769ms. APK model comparison 46.45MB bundled → 4.05MB chosen on-device Play-Services model. Crop/manual confirmation remain essential. Next: PC03 camera eligibility/review/state recovery, PC04 signed shared-photo outbox, PC05 optional training consent and PC06 expanded real acceptance. Staging verified TLS is currently unavailable from this host due network CA interception; no insecure fallback or runtime acceptance claim. - Active execution 2026-10-07: P37-PC01 camera authorization LOCAL_DONE / INTEGRATION_PENDING on maintained dev, parent a20d484. [Contract and immediate PostGIS/auth/concurrency evidence](docs-mobile-p37-photo-capture-eligibility.md). Signed two-minute camera / 24-hour submission receipts preserve retry deadlines and bind one owner/key/station/evidence session. Next: P37-PC02 real Android image OCR, then review/outbox/consent and POCO acceptance. User authorized debug-only controlled proximity tests; release/backend trust remains enforced. No image recognition or deployment acceptance inferred. - Active preparation 2026-10-07: P37-T01–T03 [photo contribution refinement](docs-planning-PHOTO_PRICE_CONTRIBUTION_PLAN.md), PREPARATION_LOCAL_DONE / IMPLEMENTATION_PLANNED on maintained `dev`, source inspected/built `286c418`; opening tree clean, recorded main `a424688` already an ancestor. Private corpus: 1,263 price-visible files / 1,219 unique images from 1,632 originals, preserved and hash-verified; twelve manually annotated samples staged on the user-connected POCO (model 2311DRK48G, API 36). Debug APK build/install/launch and Explore → station detail checked; selected station reports community prices unavailable and disabled update-price action. Existing 16 capture + 3 regex tests passed; no real-image recognition evidence inferred. Camera/proximity/OCR/crop/upload/retention acceptance remain NOT_EXECUTED. User decisions: initial 150m, only detected vertical fuel rows/subsets, no payment inputs, optional permanent training collection with ordinary evidence still 24h; [consent/erasure amendment](docs-security-AI_TRAINING_IMAGE_CONSENT_PLAN.md) is proposed, not active. No app/backend behavior change or remote publication; historical delivery/PR/check states below were not refreshed. Next source task: P37-PC01 backend photo eligibility/compatibility contract and immediate critical tests after prerequisite confirmation, then real image OCR/review. The explicit device request applies to this slice only; wider release/manual obligations remain owed. - Active delivery 2026-10-06: P36-T01 integrated with the completed branding work on maintained `dev`. [Combined evidence](docs-mobile-p36-secure-storage-keyboard-integration.md). LOCAL_DONE / INTEGRATION_PENDING. Merge parents `550958c` and `4dca43c`; preserve both histories and the shared banner/username validation. Combined 303 unit/security/concurrency tests and 5 API-26 emulator tests passed, including real Keystore, signup/Continue/reopen/logout and native keyboard; final lint/APKs, static/secret/diff checks passed. Reuse protected PR [#124](https://github.com/AlexandreZanata/abastevo/pull/124), base `a424688`; next: normal dev push, update cumulative PR, guarded finish with current-head `Quick verification`, then merged-SHA wiki publication. Pending checks stop finalization without polling; no deployment or runtime certification is claimed. - Prior isolated repair 2026-10-06: P36-T01 secure local key/session custody and global keyboard inset consumption. [Behavior and evidence](docs-mobile-p36-secure-storage-keyboard.md). LOCAL_DONE / INTEGRATION_PENDING on isolated `codex/account-keyboard-fix`, parent dev `d0a3565`; original dev is occupied by another contributor and remains untouched. 92 unit/security/concurrency tests, 5 API-26 emulator tests, Android lint/APK and static/secret checks passed. Create → automatic login → Continue → fresh rehydration → explicit offline logout verified with synthetic backend and real Keystore. Next: integrate the isolated commit into dev after owner coordination, revalidate combined UI inputs, then protected dev → main delivery; remote/live/hardware/iOS certification is not claimed. - Prior station-page task 2026-10-06: P35-T02/P36-T02 branded full station-page extension on maintained `dev`, parent `7e22a3a`. [Behavior and evidence](docs-mobile-p35-station-page.md). Status: LOCAL_DONE / INTEGRATION_PENDING. Exact CNPJ binding, real PostGIS, negative/cache/late-response/auth regressions, 77 final app tests, Android lint/APK, contracts/static/secret checks passed. Source fingerprint and exact commands are recorded; hardware/staging runtime remain OWED. - Prior authorized account-continuity task: commit `7e22a3a`, [evidence](docs-mobile-p36-account-continuity.md), LOCAL_DONE / INTEGRATION_PENDING. PR [#124](https://github.com/AlexandreZanata/abastevo/pull/124) remained OPEN at this task's final read, head `7e22a3a`, base main. Prior guarded finish refused pending Quick verification; no merge/wiki occurred. Retain that source work in the cumulative delivery. - Actual history reconciled: dev/origin/dev contained 11 commits beyond origin/main at opening; the station-page extension adds one atomic source commit. Final fetch verified main `a424688` is still an ancestor; no source history rewritten. The consolidation notes below describe the earlier integrated batch. - Delivery: reuse existing protected dev → main PR #124 and update its cumulative scope. Required `Quick verification` must apply to the new head/base; prior evidence cannot authorize this head. Next: atomic commit, normal dev push, guarded `bash scripts/git-flow.sh finish --base origin/main --pr 124 --required "Quick verification"`, then one merged-SHA wiki mirror. Missing/pending checks block integration without CI polling. Final remote outcomes belong in PR metadata/local delivery notes, then the next useful commit. No deployment, tag or device execution follows from source acceptance. - 2026-10-06: repository consolidation FINALIZED (INTEGRATED). Cumulative PR #122 merged to main (merge a424688, head 0a95153); all mobile/backend source now on main. - All 7 remaining open issues (#13, #53, #60, #61, #62, #119, #120) closed administratively as not planned, each with retained obligations pointing at [the consolidation record](docs-planning-repository-consolidation-20261006.md). At consolidation, 0 open issues and 0 open PRs remained on the remote. - Old work branches retired locally and remotely (20 local / 17 remote refs, each verified as ancestor of the merge head before deletion). Only main and dev remain, on origin and locally. - At consolidation, local main and dev were synchronized at a424688 with a clean tree. Subsequent source work follows ADR-020 maintained dev → protected main delivery. - Production private representation remains contained with 503/no-store while contributor proof/binding and private proof storage stay unaccepted; public profile, prices, community and free account source remain available. Administrative closure never certifies incomplete gates. - Standing reservations unchanged: G18 NOT_ACCEPTED; iOS DEFERRED_EXPLICIT_RESUME_ONLY; G09 UNCERTIFIED; G24 user-accepted with manual evidence still owed. No deployment, tag, trust bypass or public pilot followed this integration.