docs(32): record code review disposition

.planning/phases/32-seo-foundation/32-REVIEW-DISPOSITION.md

@@ -5,39 +5,39 @@ titles: json
 findings:
   - id: CR-01
     severity: critical
-    disposition: open
+    disposition: fixed
     title: "[CR-A01] `required: true` on a form extension field makes every save of the host form fail (also for administrators who cannot see the extension)"
   - id: CR-02
     severity: critical
-    disposition: open
+    disposition: fixed
     title: "[CR-A02] Plugin field-type upload route ignores the extension's Permissions/Visible, so administrators without them can run its `Upload`"
   - id: WR-01
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-A01] Admin writes that change or delete records fire no record event (hasMany link/unlink, deferred child unlink, deferred child commit)"
   - id: WR-02
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-A02] `RecordSaved.Locale` is the admin's UI language or the raw `Accept-Language` header, not a content locale, and reorder reports something different"
   - id: WR-03
     severity: warning
-    disposition: open
+    disposition: skipped
     title: "[WR-A03] A failing extension `Load` (or plugin-type `Load`) after a successful save rolls back the whole save"
   - id: WR-04
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-A04] Journal API writes can commit changes (including a slug) and fire no RecordSaved"
   - id: WR-05
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-A05] Journal `postSavedEvent` reports `Old: nil` for a translated `content_html` that existed, because the body is mutated between the snapshot and the event"
   - id: WR-06
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-A06] Tags auto-created by the Journal post API fire no RecordSaved although `journal-tag` is now a content type"
   - id: WR-07
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-A07] `Hide` leaves the owner's relation-manager and partial endpoints of a hidden field reachable"
   - id: IN-01
     severity: info
@@ -65,55 +65,55 @@ findings:
     title: "[IN-A06] The extension's client assets are served to every administrator of the host form"
   - id: CR-03
     severity: critical
-    disposition: open
+    disposition: fixed
     title: "[CR-B01] Exact redirects with a trailing slash or upper-case query characters never match at runtime"
   - id: WR-08
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-B01] A query-specific exact redirect is silently shadowed by the path-only rule"
   - id: WR-09
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-B02] `AddressChanged` writes redirects without validation or the loop simulation"
   - id: WR-10
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-B03] The save-time loop check races with concurrent writes"
   - id: WR-11
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-B04] Undo is not idempotent under concurrent requests"
   - id: WR-12
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-B05] Public resolve and 404 report answer 500 for NUL or invalid UTF-8 paths"
   - id: WR-13
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-B06] The runtime cycle log grows without bound and is keyed by attacker-controlled URLs"
   - id: WR-14
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-B07] Export with a large `page` panics the handler"
   - id: WR-15
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-B08] Public throttle buckets key on the SSR server's IP, capping the whole site"
   - id: WR-16
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-B09] Social image values bypass validation on every non-admin write path"
   - id: WR-17
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-B10] Invalid redirect status, match or query values are silently coerced on API, MCP and import"
   - id: WR-18
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-B11] `set_url_seo`, batch `set_seo` and the records import accept any locale"
   - id: WR-19
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-B12] Entry generation overwrites `entry.URL`, which can swallow an address change and its 301"
   - id: IN-07
     severity: info
@@ -149,31 +149,31 @@ findings:
     title: "[IN-B08] Self canonical and `url` are built from the decoded path"
   - id: CR-04
     severity: critical
-    disposition: open
+    disposition: fixed
     title: "[CR-C01] The SERP preview and the robots.txt tester deadlock: their first action is dropped by the host and `inflight` is never cleared"
   - id: WR-20
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-C01] The social image preview accepts `/\\host/...`, so the admin can load an image from an attacker's host"
   - id: WR-21
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-C02] The CSV export/import round trip changes cells that already start with an apostrophe followed by a formula character"
   - id: WR-22
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-C03] The 404 \"Open/Resolved\" filter and the redirect \"Chains\" filter disagree with the runtime matcher"
   - id: WR-23
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-C04] The URL rule address is uncapped but sits in a btree UNIQUE index, so long values return 500 instead of 422"
   - id: WR-24
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-C05] The robots element's grammar drifts from the Go grammar, and an unparseable value is silently wiped on the next edit"
   - id: WR-25
     severity: warning
-    disposition: open
+    disposition: fixed
     title: "[WR-C06] The element tests never exercise the host protocol; the tester and the image element have no tests"
   - id: IN-15
     severity: info
@@ -211,43 +211,43 @@ findings:
     severity: info
     disposition: open
     title: "[IN-C09] The `disabled` branches in the widget elements are dead, and would be broken if reached"
-open: 52
+open: 23
 total: 52
-recorded: 2026-10-27T13:31:50.257Z
+recorded: 2026-10-27T14:47:23.755Z
 ---
 
 # Phase 32: Code Review Disposition
 
 | Finding | Severity | Disposition | Source |
 |---------|----------|-------------|--------|
-| CR-01 | critical | open | - |
-| CR-02 | critical | open | - |
-| WR-01 | warning | open | - |
-| WR-02 | warning | open | - |
-| WR-03 | warning | open | - |
-| WR-04 | warning | open | - |
-| WR-05 | warning | open | - |
-| WR-06 | warning | open | - |
-| WR-07 | warning | open | - |
+| CR-01 | critical | fixed | 32-REVIEW-FIX.md |
+| CR-02 | critical | fixed | 32-REVIEW-FIX.md |
+| WR-01 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-02 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-03 | warning | skipped | 32-REVIEW-FIX.md |
+| WR-04 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-05 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-06 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-07 | warning | fixed | 32-REVIEW-FIX.md |
 | IN-01 | info | open | - |
 | IN-02 | info | open | - |
 | IN-03 | info | open | - |
 | IN-04 | info | open | - |
 | IN-05 | info | open | - |
 | IN-06 | info | open | - |
-| CR-03 | critical | open | - |
-| WR-08 | warning | open | - |
-| WR-09 | warning | open | - |
-| WR-10 | warning | open | - |
-| WR-11 | warning | open | - |
-| WR-12 | warning | open | - |
-| WR-13 | warning | open | - |
-| WR-14 | warning | open | - |
-| WR-15 | warning | open | - |
-| WR-16 | warning | open | - |
-| WR-17 | warning | open | - |
-| WR-18 | warning | open | - |
-| WR-19 | warning | open | - |
+| CR-03 | critical | fixed | 32-REVIEW-FIX.md |
+| WR-08 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-09 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-10 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-11 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-12 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-13 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-14 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-15 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-16 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-17 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-18 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-19 | warning | fixed | 32-REVIEW-FIX.md |
 | IN-07 | info | open | - |
 | IN-08 | info | open | - |
 | IN-09 | info | open | - |
@@ -256,13 +256,13 @@ recorded: 2026-10-27T13:31:50.257Z
 | IN-12 | info | open | - |
 | IN-13 | info | open | - |
 | IN-14 | info | open | - |
-| CR-04 | critical | open | - |
-| WR-20 | warning | open | - |
-| WR-21 | warning | open | - |
-| WR-22 | warning | open | - |
-| WR-23 | warning | open | - |
-| WR-24 | warning | open | - |
-| WR-25 | warning | open | - |
+| CR-04 | critical | fixed | 32-REVIEW-FIX.md |
+| WR-20 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-21 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-22 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-23 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-24 | warning | fixed | 32-REVIEW-FIX.md |
+| WR-25 | warning | fixed | 32-REVIEW-FIX.md |
 | IN-15 | info | open | - |
 | IN-16 | info | open | - |
 | IN-17 | info | open | - |