Correct the counts the added finding invalidated Ten findings, not nine; 185 checks, not 183; Outstanding is §10, not §8. Both openings now say why the tenth was nearly missed rather than quietly absorbing it into the total, since that is the part worth remembering.
Correct the outstanding count, and add the guard that was missed Ed asked whether the Security page's summary — "two significant items remain open" — was accurate. It was not. Checking it turned up a third: a fail-open access guard in the task service, the last of the round-two list's "S3's cousins", now fixed in 980b0939. Both round-three pages gain the finding, the plain-English one as item 8 and the developer guide as 6b with the lock-wait reproduction. Security.md now lists the two genuinely open items separately from the two unscheduled features, rather than rolling everything into one sentence ending "and the rest" — which was the phrasing that let a miscount hide.
Document round three of the security work Two new pages for the nine findings deferred when round two merged, following the same pair as before: plain English for an operator, and a developer guide that gives each finding its risk, a reproducible proof of concept, the mitigation and why that mitigation actually closes it. The existing round-two pages now say what has been superseded and what has not, rather than leaving a reader to work out that their outstanding sections are partly historical. Security.md carries both new links, and the sidebar lists all four. Care taken to keep the same framing Erlend asked for: the outstanding sections lead, they name CSRF and lms/content as open in main today, and the round-three guide records where a mitigation is conditional rather than absolute — the CSP layer on the branding directory is skipped entirely without mod_headers, which was measured on a stock WAMP rather than assumed.