v1.23.2

frontend-production-engineer v1.23.2

An adversarial release. No domain is added, and the router still carries
twenty-four. Nine repairs, against six items of the battery, in nine of the
twenty-four integrated domains and in the public boundary.

Repaired

• 7 — data-table-and-server-driven-state: the sortable header of the
  Correct sample read aria-sort={sort === "reference" ? "ascending" : "none"},
  and the control set one value. The header could never announce a descending
  sort, so a screen reader heard ascending on a table that the request had
  ordered the other way. The sample takes the - prefix that the same file
  states for the DRF ordering parameter, and the checklist asks whether the
  value matches the direction of the request.
• 7 — data-table-and-server-driven-state: the virtualised row read
  rows[virtualRow.index].id. noUncheckedIndexedAccess is mandatory in this
  material, so the expression is Row | undefined and tsc --noEmit stops on
  it. Verification step 9 of the same file runs that command, so the file asked
  for code that its own gate rejects. The row is hoisted and guarded.
• 7 — file-upload-and-transport: the progress helper installed onload
  and onerror alone. abort() fires neither, so a cancel left the promise
  open for the life of the page, the row kept its last percentage, and the
  pending state never cleared. The helper rejects on abort with an
  AbortError, and a warning states why the two handlers are not enough.
• 7 — served-content-and-downloads: the picker sample called
  window.showSaveFilePicker behind an in guard. lib.dom.d.ts carries no
  such method on TypeScript 5.9, so the guard narrows the value to unknown and
  the call fails the typecheck. The sample declares the optional method first.
• 5 — component-styles-and-variants: verification step 4 searched for the
  Tailwind v3 important prefix. Version 4 writes the modifier as a suffix, so
  bg-destructive! passed the step, the checklist item, and the symptom row
  together. The pattern reads the suffix, and the comment states the change.
• 6 — wcag-conformance-and-verification: the route-listing line of
  verification step 5 read rg -c 'page.tsx' -g 'page.tsx' src/app/. -c
  counts matching lines inside files, so the line printed nothing and exited 1
  on every project, and the AxeBuilder list beside it had nothing to compare
  against. The line reads rg --files.
• 6 — version-proof-and-unconfirmed-code: the row for the second proxy.ts
  bypass gave the symptom as a version below the patched minor, and neither the
  symptom nor the migration named that minor. Two other files state 16.2.11 and
  15.5.21, and the row states them now.
• 16 — untrusted-markup-and-injection: the sink row and the checklist asked
  only that a postMessage payload is parsed. A parse proves the shape and
  never the sender, so a shape-valid message from any framing page drove the
  handler. Both ask for an event.origin test against an allowlist first.
• 13 — SKILL.md and event-taxonomy-and-tracking-plan: the seam row for
  the release domain and the analytics domain repeated the second half of the
  routing row word for word, so it never stated what the release domain owns for
  the vendor path. The reference then sent the reader to the reverse-proxy file,
  which holds no vendor rewrite at all. The seam states the ownership, and the
  rule states that one layer alone answers the path.
• 29 — five reference files cited a dossier, and five cited a research
  corpus, as the provenance of a library table or of a stated range. Neither
  exists for a reader who installed this skill, and the reader is never the
  author. Ten sentences state what this skill read, or what the table itself
  holds.
• 25 — README.md: the Codex install section named a bundled pointer skill
  twice. The repository holds no such file, git log -S shows the phrase has
  been unbacked since the scaffold, and instruction-files-and-skill-discovery
  states that Codex reads a cloned SKILL.md directly. A reader who followed
  the section went looking for a file that is not there.
• 25 — README.md: the Gemini section told the reader to copy GEMINI.md
  into a repository root, and it was the only install section with no step that
  obtains the file. It carries the clone.
• 6 — README.md: the blocking paragraph named the last two of seven
  domains as the absolute pair, which reads as security and testing. The
  absolute pair is accessibility and security, and the next sentence of the same
  paragraph already said so.

Domains affected

• 04 project-structure-and-tooling — instruction-files-and-skill-discovery.
• 09 design-system-and-styling — component-styles-and-variants.
• 10 accessibility-wcag — wcag-conformance-and-verification.
• 11 forms-and-validation — form-schema-and-field-binding.
• 12 data-tables-and-visualization — data-table-and-server-driven-state.
• 13 media-and-file-handling — file-upload-and-transport and
  served-content-and-downloads.
• 17 frontend-security — untrusted-markup-and-injection.
• 20 testing-and-quality — end-to-end-journeys-and-flake-control,
  merge-gates-and-quality-signals, network-mocks-and-contract-tests, and
  test-strategy-and-component-tests.
• 23 analytics-privacy-and-consent — consent-gate-and-cookie-inventory and
  event-taxonomy-and-tracking-plan.
• 24 agent-operating-doctrine — version-proof-and-unconfirmed-code.

The version moves from 1.23.1 to 1.23.2. This run adds no domain, so the router
still carries twenty-four and the minor number stays at 23. This run changed
twelve reference files and four files outside references/, so the patch number
moves by one. The frontmatter description is unchanged at 1013 characters.

Limits

• Thirty-five candidate findings met an adversarial verifier that was told to
  refute each one. Nine survived, and this note holds them. Twenty-six fell,
  and the reason was almost always the same: a neighbouring sentence, a
  Not here clause, a seam row, or a Handoffs block already answered the
  objection. Those twenty-six are not repaired, because there was nothing to
  repair.
• Twenty-four task sentences ran against the description and the router alone.
  Twelve fired and twelve stayed silent, and eight of the twelve silences came
  from a deliberate route-out to the backend rather than from luck.
• Four routing candidates fell to the same verifier. The command palette resolves
  through the combobox, the listbox, the modal, and the focus trap that the row
  already names. A browser push task reaches the transport file, which bounds
  itself to an open tab in its first two paragraphs. A stale list after a write
  is settled at the symptom by server-state-and-query-cache. Scroll on
  navigation belongs to domain 01 by three seam rows, and the material for it
  is not in this repository.
• No TypeScript compiler and no Node runtime for this stack are installed on the
  machine that ran this pass. The four sample repairs were read against the
  pinned versions and against lib.dom.d.ts of the installed TypeScript, and
  none was compiled here. The two rg patterns were run against a fixture, and
  both behave as the repaired text states.
• The gate blocks for the seven blocking domains were walked with a failing task
  each. All seven blocked. The security and developer-convenience conflict
  resolved to security, and the exception clause for 'unsafe-inline' matches
  the reference that owns it in both directions.
• Two http:// tokens remain, in an Nginx proxy_pass line. Nginx requires the
  scheme, and the value names an upstream block rather than a host.