docs(17): record code review disposition

.planning/phases/17-blog-companions/17-REVIEW-DISPOSITION.md

@@ -0,0 +1,103 @@
+---
+phase: 17
+review: 17-REVIEW.md
+titles: json
+findings:
+  - id: CR-01
+    severity: critical
+    disposition: open
+    title: "Sitemap writes admin-supplied `javascript:` URLs into `<loc>`, which sitemap.xsl renders as a clickable link on the public origin (stored XSS)"
+  - id: WR-01
+    severity: warning
+    disposition: open
+    title: "Moving a menu entry to another menu orphans its subtree, and a parent from another menu silently overrides the chosen menu"
+  - id: WR-02
+    severity: warning
+    disposition: open
+    title: "Reorder page sends overlapping saves; out-of-order completion leaves the database on an older tree than the screen shows"
+  - id: WR-03
+    severity: warning
+    disposition: open
+    title: "A registry menu entry or sitemap row saved without a reference passes validation and then silently disappears"
+  - id: WR-04
+    severity: warning
+    disposition: open
+    title: "`journal-post` resolves unpublished posts, exposing draft titles and URLs on the anonymous menu API and in sitemap.xml"
+  - id: WR-05
+    severity: warning
+    disposition: fixed
+    title: "`/sitemap.xml` is anonymous, unthrottled and resolves every registry item on each request"
+  - id: WR-06
+    severity: warning
+    disposition: fixed
+    title: "The menu importer skips the URL, target and same-menu-parent rules that admin saves enforce"
+  - id: WR-07
+    severity: warning
+    disposition: fixed
+    title: "Opening a singleton settings entry in a new tab lands on a list route that answers 404"
+  - id: IN-01
+    severity: info
+    disposition: open
+    title: "FAQ slugs and menu codes are not validated against the format the public APIs accept"
+  - id: IN-02
+    severity: info
+    disposition: open
+    title: "menu_items.yaml comment misstates the Journal default patterns"
+  - id: IN-03
+    severity: info
+    disposition: open
+    title: "The seaglass policy lets stored HTML reuse any site `class` and (from the UGC base) `id`"
+  - id: IN-04
+    severity: info
+    disposition: open
+    title: "The list's reorder link stringifies a multi-value filter and ignores the toolbar"
+  - id: IN-05
+    severity: info
+    disposition: open
+    title: "sitemap:import-winter counts an item mapped to \"\" as both remapped and dropped"
+  - id: IN-06
+    severity: info
+    disposition: open
+    title: "The singleton route creates a row on a GET"
+  - id: IN-07
+    severity: info
+    disposition: open
+    title: "The frontend_url rewrite inserts the setting unescaped into XML"
+  - id: IN-08
+    severity: info
+    disposition: open
+    title: "A reorder sort value outside the int4 range is a 500, not a 422"
+  - id: IN-09
+    severity: info
+    disposition: open
+    title: "Repeater row errors stay at their old index after a row is moved or removed"
+open: 14
+total: 17
+recorded: 2026-10-12T19:49:51.034Z
+---
+
+# Phase 17: Code Review Disposition
+
+| Finding | Severity | Disposition | Source |
+|---------|----------|-------------|--------|
+| CR-01 | critical | open | - |
+| WR-01 | warning | open | - |
+| WR-02 | warning | open | - |
+| WR-03 | warning | open | - |
+| WR-04 | warning | open | - |
+| WR-05 | warning | fixed | 17-REVIEW-FIX.md |
+| WR-06 | warning | fixed | 17-REVIEW-FIX.md |
+| WR-07 | warning | fixed | 17-REVIEW-FIX.md |
+| IN-01 | info | open | - |
+| IN-02 | info | open | - |
+| IN-03 | info | open | - |
+| IN-04 | info | open | - |
+| IN-05 | info | open | - |
+| IN-06 | info | open | - |
+| IN-07 | info | open | - |
+| IN-08 | info | open | - |
+| IN-09 | info | open | - |
+
+Dispositions: `open` (recorded, not yet triaged), `fixed`, `skipped`, `deferred`.
+Set `deferred` by hand and put the reason in the Source cell; both are preserved. A `|` in the reason is kept as prose and escaped on the next run.
+Re-running the gate keeps every row it can. A row the current review no longer reports is kept and its Source cell flagged, so a finding does not leave this record silently. ONE exception: when a finding id is REUSED by a different finding, the earlier decision cannot keep a row — the id is taken — and it is dropped. A RECORDED decision (anything but `open`) is named on the console when that happens; a row still at `open` is replaced silently, because `open` records no decision to lose.