docs(09): record code review disposition

.planning/phases/09-backend-admin-authentication-and-schema-pipeline/09-REVIEW-DISPOSITION.md

@@ -5,83 +5,83 @@ titles: json
 findings:
   - id: CR-01
     severity: critical
-    disposition: open
+    disposition: fixed
     title: "Writable numeric fields cannot be saved; bad field values return 500 instead of 422"
   - id: WR-01
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "Required-permission wildcards never match, and multiple required codes use ALL rather than Winter's ANY"
   - id: WR-02
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "Navigation shows a denied parent item, including its label and target controller"
   - id: WR-03
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "Create, update and delete are not gated by the compiled list and form declarations"
   - id: WR-04
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "A form field that is `required` but limited by `context` makes every create fail"
   - id: WR-05
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "Relation link and unlink ignore the panel's toolbarButtons"
   - id: WR-06
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "A relation list without an explicit `sort` fails when the first column is not sortable"
   - id: WR-07
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "Relation column order depends on a fixed 16-space YAML indentation"
   - id: WR-08
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "List search returns 500 for non-text searchable columns, and the scaffold creates one"
   - id: WR-09
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "Scaffolded admin controllers have no permissions and no record source"
   - id: WR-10
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "Cabana silently reuses any guard already registered under the name \"backend\""
   - id: WR-11
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "Login identifier can resolve to the wrong admin; admin:create does not prevent login/email collisions"
   - id: WR-12
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "The dummy hash cost is fixed at 10 while real hashes use the configured cost (timing oracle)"
   - id: WR-13
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "Admin passwords are passed as command-line flags"
   - id: WR-14
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "Logout cannot revoke a token whose access lifetime has expired but whose refresh window is still open"
   - id: WR-15
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "The editors pivot `granted_by` stores a backend_users id in a frontend-user column"
   - id: WR-16
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "Reflection helpers skip embedded structs and fall back to case-insensitive Go field names"
   - id: WR-17
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "User-level `backend_users.permissions` is ignored, so Winter denies are lost at cutover"
   - id: WR-18
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "The phase gate's zero-test check applies per invocation, not per package"
   - id: WR-19
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "Plugin hooks and scopes query outside the CRUD transaction"
   - id: IN-01
     severity: info
@@ -131,35 +131,35 @@ findings:
     severity: info
     disposition: open
     title: "The scaffold marks a file that must be edited as \"DO NOT EDIT\""
-open: 32
+open: 12
 total: 32
-recorded: 2026-09-27T21:52:17.704Z
+recorded: 2026-10-01T19:43:14.734Z
 ---
 
 # Phase 09: Code Review Disposition
 
 | Finding | Severity | Disposition | Source |
 |---------|----------|-------------|--------|
-| CR-01 | critical | open | - |
+| CR-01 | critical | fixed | 09-REVIEW-FIX.md |
-| WR-01 | warning | open | - |
+| WR-01 | warning | fixed | 09-REVIEW-FIX.md |
-| WR-02 | warning | open | - |
+| WR-02 | warning | fixed | 09-REVIEW-FIX.md |
-| WR-03 | warning | open | - |
+| WR-03 | warning | fixed | 09-REVIEW-FIX.md |
-| WR-04 | warning | open | - |
+| WR-04 | warning | fixed | 09-REVIEW-FIX.md |
-| WR-05 | warning | open | - |
+| WR-05 | warning | fixed | 09-REVIEW-FIX.md |
-| WR-06 | warning | open | - |
+| WR-06 | warning | fixed | 09-REVIEW-FIX.md |
-| WR-07 | warning | open | - |
+| WR-07 | warning | fixed | 09-REVIEW-FIX.md |
-| WR-08 | warning | open | - |
+| WR-08 | warning | fixed | 09-REVIEW-FIX.md |
-| WR-09 | warning | open | - |
+| WR-09 | warning | fixed | 09-REVIEW-FIX.md |
-| WR-10 | warning | open | - |
+| WR-10 | warning | fixed | 09-REVIEW-FIX.md |
-| WR-11 | warning | open | - |
+| WR-11 | warning | fixed | 09-REVIEW-FIX.md |
-| WR-12 | warning | open | - |
+| WR-12 | warning | fixed | 09-REVIEW-FIX.md |
-| WR-13 | warning | open | - |
+| WR-13 | warning | fixed | 09-REVIEW-FIX.md |
-| WR-14 | warning | open | - |
+| WR-14 | warning | fixed | 09-REVIEW-FIX.md |
-| WR-15 | warning | open | - |
+| WR-15 | warning | fixed | 09-REVIEW-FIX.md |
-| WR-16 | warning | open | - |
+| WR-16 | warning | fixed | 09-REVIEW-FIX.md |
-| WR-17 | warning | open | - |
+| WR-17 | warning | fixed | 09-REVIEW-FIX.md |
-| WR-18 | warning | open | - |
+| WR-18 | warning | fixed | 09-REVIEW-FIX.md |
-| WR-19 | warning | open | - |
+| WR-19 | warning | fixed | 09-REVIEW-FIX.md |
 | IN-01 | info | open | - |
 | IN-02 | info | open | - |
 | IN-03 | info | open | - |