summercms/.planning/phases/09-backend-admin-authentication-and-schema-pipeline/09-REVIEW-DISPOSITION.md

phase, review, titles, findings, open, total, recorded

phase	review	titles	findings	open	total	recorded
09	09-REVIEW.md	json	id severity disposition title CR-01 critical fixed Writable numeric fields cannot be saved; bad field values return 500 instead of 422 id severity disposition title WR-01 warning fixed Required-permission wildcards never match, and multiple required codes use ALL rather than Winter's ANY id severity disposition title WR-02 warning fixed Navigation shows a denied parent item, including its label and target controller id severity disposition title WR-03 warning fixed Create, update and delete are not gated by the compiled list and form declarations id severity disposition title WR-04 warning fixed A form field that is `required` but limited by `context` makes every create fail id severity disposition title WR-05 warning fixed Relation link and unlink ignore the panel's toolbarButtons id severity disposition title WR-06 warning fixed A relation list without an explicit `sort` fails when the first column is not sortable id severity disposition title WR-07 warning fixed Relation column order depends on a fixed 16-space YAML indentation id severity disposition title WR-08 warning fixed List search returns 500 for non-text searchable columns, and the scaffold creates one id severity disposition title WR-09 warning fixed Scaffolded admin controllers have no permissions and no record source id severity disposition title WR-10 warning fixed Cabana silently reuses any guard already registered under the name "backend" id severity disposition title WR-11 warning fixed Login identifier can resolve to the wrong admin; admin:create does not prevent login/email collisions id severity disposition title WR-12 warning fixed The dummy hash cost is fixed at 10 while real hashes use the configured cost (timing oracle) id severity disposition title WR-13 warning fixed Admin passwords are passed as command-line flags id severity disposition title WR-14 warning fixed Logout cannot revoke a token whose access lifetime has expired but whose refresh window is still open id severity disposition title WR-15 warning fixed The editors pivot `granted_by` stores a backend_users id in a frontend-user column id severity disposition title WR-16 warning fixed Reflection helpers skip embedded structs and fall back to case-insensitive Go field names id severity disposition title WR-17 warning fixed User-level `backend_users.permissions` is ignored, so Winter denies are lost at cutover id severity disposition title WR-18 warning fixed The phase gate's zero-test check applies per invocation, not per package id severity disposition title WR-19 warning fixed Plugin hooks and scopes query outside the CRUD transaction id severity disposition title IN-01 info open A no-op relation mutation returns `{}` id severity disposition title IN-02 info open Relation search does not escape LIKE wildcards id severity disposition title IN-03 info open `last_page` is inconsistent between the list and relation endpoints id severity disposition title IN-04 info open Page parsing and the offset computation can overflow id severity disposition title IN-05 info open Controllers with unroutable IDs are accepted id severity disposition title IN-06 info open The bulk-delete decoder is looser than the relation decoder id severity disposition title IN-07 info open Dead dropdown branches and SQL built by string concatenation in the albums controller id severity disposition title IN-08 info open The password-reset cutoff also rejects logins made within about 1-2 seconds of the reset id severity disposition title IN-09 info open Album scoping hides database errors as an empty list id severity disposition title IN-10 info open Read-only GETs take row locks id severity disposition title IN-11 info open Logout reports success without revoking when no blacklist is configured id severity disposition title IN-12 info open The scaffold marks a file that must be edited as "DO NOT EDIT"	12	32	2026-10-01T19:43:14.734Z

Phase 09: Code Review Disposition

Finding	Severity	Disposition	Source
CR-01	critical	fixed	09-REVIEW-FIX.md
WR-01	warning	fixed	09-REVIEW-FIX.md
WR-02	warning	fixed	09-REVIEW-FIX.md
WR-03	warning	fixed	09-REVIEW-FIX.md
WR-04	warning	fixed	09-REVIEW-FIX.md
WR-05	warning	fixed	09-REVIEW-FIX.md
WR-06	warning	fixed	09-REVIEW-FIX.md
WR-07	warning	fixed	09-REVIEW-FIX.md
WR-08	warning	fixed	09-REVIEW-FIX.md
WR-09	warning	fixed	09-REVIEW-FIX.md
WR-10	warning	fixed	09-REVIEW-FIX.md
WR-11	warning	fixed	09-REVIEW-FIX.md
WR-12	warning	fixed	09-REVIEW-FIX.md
WR-13	warning	fixed	09-REVIEW-FIX.md
WR-14	warning	fixed	09-REVIEW-FIX.md
WR-15	warning	fixed	09-REVIEW-FIX.md
WR-16	warning	fixed	09-REVIEW-FIX.md
WR-17	warning	fixed	09-REVIEW-FIX.md
WR-18	warning	fixed	09-REVIEW-FIX.md
WR-19	warning	fixed	09-REVIEW-FIX.md
IN-01	info	open	-
IN-02	info	open	-
IN-03	info	open	-
IN-04	info	open	-
IN-05	info	open	-
IN-06	info	open	-
IN-07	info	open	-
IN-08	info	open	-
IN-09	info	open	-
IN-10	info	open	-
IN-11	info	open	-
IN-12	info	open	-

Dispositions: open (recorded, not yet triaged), fixed, skipped, deferred. Set deferred by hand and put the reason in the Source cell; both are preserved. A | in the reason is kept as prose and escaped on the next run. Re-running the gate keeps every row it can. A row the current review no longer reports is kept and its Source cell flagged, so a finding does not leave this record silently. ONE exception: when a finding id is REUSED by a different finding, the earlier decision cannot keep a row — the id is taken — and it is dropped. A RECORDED decision (anything but open) is named on the console when that happens; a row still at open is replaced silently, because open records no decision to lose.