diff --git a/.planning/phases/19.3-framework-transport-and-infrastructure-for-wavepath/19.3-REVIEW-DISPOSITION.md b/.planning/phases/19.3-framework-transport-and-infrastructure-for-wavepath/19.3-REVIEW-DISPOSITION.md
new file mode 100644
index 0000000..59ae78f
--- /dev/null
+++ b/.planning/phases/19.3-framework-transport-and-infrastructure-for-wavepath/19.3-REVIEW-DISPOSITION.md
@@ -0,0 +1,123 @@
+---
+phase: 19.3
+review: 19.3-REVIEW.md
+titles: json
+findings:
+  - id: CR-01
+    severity: critical
+    disposition: open
+    title: "`cors:<profile>` headers are missing from every response produced outside the profile middleware (401, 403, 413, 422, 429, 500)"
+  - id: WR-01
+    severity: warning
+    disposition: open
+    title: "The site-cache purge runs synchronously in the admin request, and bulk delete multiplies it"
+  - id: WR-02
+    severity: warning
+    disposition: open
+    title: "The purge client follows redirects and forwards the bearer token, including https-to-http on the same host"
+  - id: WR-03
+    severity: warning
+    disposition: open
+    title: "The shipped purge route refuses every proxied request, so the https/remote mode the Go side advertises cannot work"
+  - id: WR-04
+    severity: warning
+    disposition: open
+    title: "Credentialed CORS validation only refuses a bare `*`; a wildcard entry or an unanchored pattern still trusts arbitrary origins with credentials"
+  - id: WR-05
+    severity: warning
+    disposition: open
+    title: "In production, the cookie's Secure flag is inferred false without an error when `app.url` is http or unset"
+  - id: WR-06
+    severity: warning
+    disposition: open
+    title: "The api-docs CSP allowlists all of jsDelivr for scripts, which cancels the nonce"
+  - id: WR-07
+    severity: warning
+    disposition: open
+    title: "`storage.uploads.public_url` puts protected (`is_public=false`) files in a publicly served bucket"
+  - id: WR-08
+    severity: warning
+    disposition: open
+    title: "`turnstile:open` without a secret switches off bot protection in production, with nothing logged"
+  - id: WR-09
+    severity: warning
+    disposition: open
+    title: "The zero `CookieConfig` does not give the documented default attributes (no SameSite, no Secure)"
+  - id: IN-01
+    severity: info
+    disposition: open
+    title: "The cache prefix has no enforced separator, so one application's Flush can reach another's keys"
+  - id: IN-02
+    severity: info
+    disposition: open
+    title: "The purge token is not trimmed although the URL is"
+  - id: IN-03
+    severity: info
+    disposition: open
+    title: "The purge and the Journal alias wiring log through `slog.Default()` instead of the app logger"
+  - id: IN-04
+    severity: info
+    disposition: open
+    title: "`SiteCacheFromApp` logs an Error on every call when the configuration is invalid"
+  - id: IN-05
+    severity: info
+    disposition: open
+    title: "The Turnstile middleware buffers the whole body even for content types it never parses"
+  - id: IN-06
+    severity: info
+    disposition: open
+    title: "Each preflight route copies the constraints of the first route on its path only"
+  - id: IN-07
+    severity: info
+    disposition: open
+    title: "The `DiskExtension` script-capable denylist is incomplete"
+  - id: IN-08
+    severity: info
+    disposition: open
+    title: "The cookie refresh and logout handlers do not check `Origin`"
+  - id: IN-09
+    severity: info
+    disposition: open
+    title: "Timing-sensitive cooler unit tests may flake on loaded CI"
+  - id: IN-10
+    severity: info
+    disposition: open
+    title: "The `purgeSiteCache` helper is copied across the FAQ and menu plugins, with a third variant in the Journal"
+  - id: IN-11
+    severity: info
+    disposition: open
+    title: "A published `*bouncer.Turnstile` silently overrides `turnstile.secret`"
+open: 21
+total: 21
+recorded: 2026-10-15T18:18:43.865Z
+---
+
+# Phase 19.3: Code Review Disposition
+
+| Finding | Severity | Disposition | Source |
+|---------|----------|-------------|--------|
+| CR-01 | critical | open | - |
+| WR-01 | warning | open | - |
+| WR-02 | warning | open | - |
+| WR-03 | warning | open | - |
+| WR-04 | warning | open | - |
+| WR-05 | warning | open | - |
+| WR-06 | warning | open | - |
+| WR-07 | warning | open | - |
+| WR-08 | warning | open | - |
+| WR-09 | warning | open | - |
+| IN-01 | info | open | - |
+| IN-02 | info | open | - |
+| IN-03 | info | open | - |
+| IN-04 | info | open | - |
+| IN-05 | info | open | - |
+| IN-06 | info | open | - |
+| IN-07 | info | open | - |
+| IN-08 | info | open | - |
+| IN-09 | info | open | - |
+| IN-10 | info | open | - |
+| IN-11 | info | open | - |
+
+Dispositions: `open` (recorded, not yet triaged), `fixed`, `skipped`, `deferred`.
+Set `deferred` by hand and put the reason in the Source cell; both are preserved. A `|` in the reason is kept as prose and escaped on the next run.
+Re-running the gate keeps every row it can. A row the current review no longer reports is kept and its Source cell flagged, so a finding does not leave this record silently. ONE exception: when a finding id is REUSED by a different finding, the earlier decision cannot keep a row — the id is taken — and it is dropped. A RECORDED decision (anything but `open`) is named on the console when that happens; a row still at `open` is replaced silently, because `open` records no decision to lose.