Close the audit and add the remediation roadmap

docs/roadmap/audit.md

@@ -1,7 +1,6 @@
 # Repository Audit Ledger
 
-Status: In progress; Stages 1-24 and 26 complete. Stage 25 was interrupted
-before its evidence was recorded.
+Status: Complete; all 27 planned stages complete.
 
 This temporary roadmap document is the evidence ledger for the staged audit
 defined by [the audit plan](audit-plan.md). It records audit evidence and
@@ -222,6 +221,81 @@ retained decision, and no high-impact uncertainty requires a supplemental
 investigation stage. Remediation acceptance, priority, and implementation
 sequencing remain exclusively Stage 27 work.
 
+Stage 27 accepted all 74 confirmed findings for implementation and allocated
+each exactly once across the dependency-ordered
+[audit remediation roadmap](audit-remediation.md). No confirmed finding is
+priority-deferred or blocked on a separate product/architecture decision. The
+roadmap places generated-forecast integrity, security, correctness, data
+integrity, destructive operations, and cancellation before efficiency,
+behavior-preserving consolidation, test cleanup, and roadmap retirement. The
+discovery audit changed only its temporary roadmap documents.
+
+## Final Audit Summary
+
+### Overall Assessment
+
+Weatherreporter's architecture is coherent: dependency direction is acyclic,
+external dependencies remain adapter-local, the normal workflow is stateless,
+deterministic facts and repository templates remain authoritative, and the
+default test suite is offline and repeatable. The audit nevertheless found two
+high-severity shared-prompt defects that can systematically misdirect every
+generated report, 43 medium-severity correctness/security/reliability/
+compatibility/efficiency gaps, and 29 low-severity confirmed maintenance,
+documentation, testing, cleanup, or edge-case gaps. Four low-severity entries
+were rejected only as standalone duplicates and consolidated into broader
+confirmed owners.
+
+The highest remediation risks are prompt/data-package disagreement and
+overstated hazard locality, sensitive or unbounded upstream diagnostics,
+prompt-debug pathname races, Markdown structural injection, destructive output
+target handling, comparison replacement/recovery truthfulness, and lost
+cancellation or failure identity. The suite passes because many findings are
+missing adversarial boundary cases or incorrect-but-current contracts rather
+than ordinary happy-path breakage.
+
+### Reviewed Scope And Exclusions
+
+The audit covered all production and test packages, command paths,
+configuration and maintained examples, embedded prompt/profile/schema/template
+assets, normalized weather acquisition and derivation, briefing modules,
+Promptkit and Distributor adapters, generated-text validation/rendering,
+single/batch/comparison orchestration, filesystem publication, test quality,
+dependency/complexity history, and all current, historical, policy, internal,
+integration, release, and roadmap documentation inventoried by Stage 1.
+
+It did not call live Weather API, Promptkit-provider, or Distributor services;
+use real credentials or private infrastructure; prove power-loss durability;
+define an unsupported-platform promise; perform production remediation; change
+dependencies; rewrite canonical current-state contracts to legitimize defects;
+or prepare a release. Those exclusions preserve deterministic offline audit
+evidence and the architecture's stated boundaries.
+
+### Prioritized Finding Summary
+
+| Priority | Finding set | Assessment and disposition |
+| --- | --- | --- |
+| P0 | `AUD-030`, `AUD-031` | Two high-severity prompt-contract defects. Accepted first because they affect shared instructions for all generated reports. |
+| P1 | Medium security, correctness, reliability, compatibility, cancellation, and destructive-publication findings | Forty-three medium findings accepted before efficiency or cleanup. Their package-level tests must protect malformed input, safe diagnostics, cancellation linearization, recovery state, and visible result truth. |
+| P2 | Low-severity correctness/security edges plus deterministic test and operational quality | Accepted after the P0/P1 contract fixes, except where a low finding is a prerequisite mechanism for a related correctness fix. |
+| P3 | `AUD-039`, `AUD-067` through `AUD-072` | Behavior-preserving consolidation and dormant-surface retirement accepted after the behavior they touch is corrected and locked by tests. |
+| P4 | `AUD-075`, `AUD-076`, and audit-record retirement | Documentation lifecycle work accepted last, after implemented contracts have durable canonical owners. |
+
+The remediation roadmap's allocation table and 35 stages are the authoritative
+finding-to-stage mapping. All 74 confirmed findings are accepted now; none is
+deferred and none requires a prerequisite decision. Rejected `AUD-001`,
+`AUD-022`, and `AUD-032` flow only through `AUD-072`; rejected `AUD-063` flows
+only through `AUD-039`.
+
+### Final Validation Summary
+
+The clean final checkout passed uncached default tests, repository-wide race
+tests, three shuffled repetitions, vet, root CLI help, and whitespace checks.
+Diagnostic coverage was 79.4% of statements; it was used to inspect weak
+critical branches rather than as a target, and `coverage.out` was removed.
+Focused adversarial evidence and narrow test seams support the confirmed
+correctness and safety findings. No generated artifact, unexplained failure,
+candidate status, deferred finding, or unresolved scope question remains.
+
 ## Baseline Metadata
 
 | Item | Recorded baseline |
@@ -371,9 +445,9 @@ inventory commands, graph index refresh, and graph architecture inspection.
 | 22 | Audit cross-cutting efficiency and complexity | Complete |
 | 23 | Audit cross-cutting refactoring and deduplication opportunities | Complete |
 | 24 | Audit documentation coherence and executable contracts | Complete |
-| 25 | Run dynamic robustness and final diagnostic validation | Pending |
+| 25 | Run dynamic robustness and final diagnostic validation | Complete |
 | 26 | Verify, consolidate, and triage findings | Complete |
-| 27 | Produce the remediation roadmap and close the audit | Pending |
+| 27 | Produce the remediation roadmap and close the audit | Complete |
 
 ## Risk-To-Test Coverage
 
@@ -405,7 +479,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 | Cross-cutting efficiency | Graph metrics, workflow traces, and focused latency/allocation diagnostics | 22 | Partly insufficient. Fixed-size registries, service-sized derivation, template parsing, batch composition, and ordinary profile fan-out are proportionate. `AUD-065` records one redundant Weather API request plus serial independent source fetches; `AUD-066` records repeated full comparison-bundle reads during replacement. |
 | Cross-cutting maintainability | Graph similarity, change history, caller traces, and focused structural review | 23 | Partly insufficient. `AUD-067` through `AUD-073` identify duplicated canonicalization/template/date/requirement policy, parallel metadata authority, dormant internal surfaces, and unsafe duplicate capitalization. Important report, prompt-curation, safety-copy, validation, and orchestration similarities remain explicit under `RET-053` through `RET-058`. |
 | Documentation and executable-contract coherence | Canonical documents, code, schemas, templates, examples | 24 | Partly insufficient. `AUD-074` through `AUD-078` record CLI/help drift, stale internal flow/API/test claims, completed-roadmap duplication, an implicit concurrent-executor requirement, and incomplete configuration normalization/bounds. Other volatile identities and maintained examples match their executable owners; linked summaries, historical release notes, and the accepted ADR remain appropriately distinct. |
-| Dynamic robustness and diagnostic checks | Repository-wide deterministic checks | 25 | Pending |
+| Dynamic robustness and diagnostic checks | Repository-wide deterministic checks | 25 | Sufficient for audit closure. Uncached, race-enabled, and three shuffled test runs passed; vet and CLI help passed; coverage remained 79.4% and exposed no additional consequential unowned branch. The diagnostic artifact was removed. |
 | Finding verification and triage | All findings, retained decisions, routed questions, validation records, and coverage entries | 26 | Complete. Seventy-four findings are confirmed and four duplicate standalone entries are rejected into their named root-cause owners. No candidate or deferred status remains; all confirmed entries retain actionable test implications and validation criteria. |
 
 ## Findings
@@ -452,7 +526,8 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   consolidated under `AUD-072`; a separate recommendation would split one
   ownership decision without changing its priority or validation.
 - Related findings: `AUD-072`
-- Remediation reference: pending
+- Remediation reference: Not applicable; consolidated into `AUD-072` and
+  Remediation Stage 31.
 
 ### AUD-002: Clock windows shift on daylight-saving transition days
 
@@ -489,7 +564,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   implementation and passes when transition-day boundaries retain their
   configured local clocks; focused `timeutil` and `forecast` suites pass.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 6.
 
 ### AUD-003: Daily run-ID uniqueness lacks a focused contract test
 
@@ -527,7 +602,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   with the invariant intact, report and multi-Daily batch tests pass and
   `plannedReportsByRunID` receives unique keys.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 6.
 
 ### AUD-004: Unsupported missing-source keys are silently accepted
 
@@ -565,7 +640,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   and pass when validation rejects keys that cannot affect optional-source
   policy; focused config and Weather API policy tests remain green.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 2.
 
 ### AUD-005: Single-report notification identities may render blank
 
@@ -601,7 +676,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   and pass when all active rendered identities are nonblank; focused config,
   app notification, and Distributor adapter tests pass.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 3.
 
 ### AUD-006: Constructed report overrides depend on inaccessible presence flags
 
@@ -641,7 +716,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   construction today and passes when loaded and constructed forms yield the
   same overrides and validation result.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 2.
 
 ### AUD-007: Failed configuration loads can leave secrets applied
 
@@ -676,7 +751,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: Both failure cases leave the environment exactly as it was before
   loading; successful overwrite and single-line-ending behavior remain intact.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 2.
 
 ### AUD-008: Process interrupts do not cancel active workflows
 
@@ -715,7 +790,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   when available, and leaves the existing destination intact; ordinary help,
   version, and successful exits are unchanged.
 - Related findings: `AUD-010`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 4.
 
 ### AUD-009: Generate validates report dates after constructing its executor
 
@@ -754,7 +829,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   constructing an executor or emitting a partial summary; valid requests still
   construct exactly one executor.
 - Related findings: `AUD-007`, `AUD-010`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 4.
 
 ### AUD-010: Assembled non-comparison CLI result paths lack durable tests
 
@@ -795,7 +870,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   selection, or failure return status break a focused CLI test, while internal
   app refactors that preserve request/result contracts require no CLI edits.
 - Related findings: `AUD-008`, `AUD-009`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 4.
 
 ### AUD-011: Unsupported Weather API URL schemes fail only at transport
 
@@ -830,7 +905,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: Unsupported schemes fail before Weather API or Promptkit work;
   ordinary HTTP test servers and configured HTTPS URLs remain accepted.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 5.
 
 ### AUD-012: Weather API failures expose upstream response bodies
 
@@ -866,7 +941,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: Normal failure output is bounded and marker-free for warmup and
   source requests, with existing actionable and retry tests still passing.
 - Related findings: `AUD-013`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 5.
 
 ### AUD-013: The Weather API response limit silently truncates bodies
 
@@ -902,7 +977,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   complete at-limit response remains readable and response bodies always
   close.
 - Related findings: `AUD-012`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 5.
 
 ### AUD-014: Required hourly periods can lack usable time bounds
 
@@ -938,7 +1013,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: Every accepted required hourly period has a usable half-open time
   range, and existing valid fixtures still normalize unchanged.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 5.
 
 ### AUD-015: Weather API warmup retries permanent HTTP failures
 
@@ -969,7 +1044,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: Warmup retries only the documented transient classes and fails
   permanent statuses immediately with endpoint/status context.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 5.
 
 ### AUD-016: Metric fallback values lose their unit during daypart derivation
 
@@ -1011,7 +1086,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   wind decisions and unambiguous summary values; all immediate derived-fact
   consumers retain correct units.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 6.
 
 ### AUD-017: Overnight dayparts omit alerts that begin after midnight
 
@@ -1045,7 +1120,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: Every wrapping daypart includes all and only alerts overlapping
   its full period, while daily alert summaries retain civil-day boundaries.
 - Related findings: `AUD-002`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 6.
 
 ### AUD-018: Invalid precipitation percentages flow into derived summaries
 
@@ -1079,7 +1154,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   and malformed source behavior is deterministic and visible under the chosen
   source-failure policy.
 - Related findings: `AUD-014`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 6.
 
 ### AUD-019: Ordinary “icy” forecast text does not set the ice indicator
 
@@ -1108,7 +1183,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: Representative icy descriptions set the ice indicator without
   broadening matches to unrelated words.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 6.
 
 ### AUD-020: Pointer-shaped AFD options pass validation but fail construction
 
@@ -1147,7 +1222,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   builder in a usable canonical form, and invalid shapes still fail during
   preflight.
 - Related findings: `AUD-006`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 7.
 
 ### AUD-021: Empty weather-story data is published as available
 
@@ -1183,7 +1258,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   policy or are omitted, while a usable story emits `Available: true` with its
   structured fields intact.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 7.
 
 ### AUD-022: Module snapshots accept unsupported schema versions
 
@@ -1219,7 +1294,8 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   retained as part of the broader no-owner decision in `AUD-072`; hardening it
   independently would add a contract for a surface the repository may retire.
 - Related findings: `AUD-072`
-- Remediation reference: pending
+- Remediation reference: Not applicable; consolidated into `AUD-072` and
+  Remediation Stage 31.
 
 ### AUD-023: Apparent temperature is published as heat index
 
@@ -1257,7 +1333,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   retain an accurately named value; focused briefing and downstream schema or
   render tests pass.
 - Related findings: `AUD-016`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 8.
 
 ### AUD-024: Normalized daypart keys can silently overwrite summaries
 
@@ -1291,7 +1367,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: Every accepted daypart maps to one distinct output entry, and
   every collision is rejected before prompt construction.
 - Related findings: `AUD-025`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 10.
 
 ### AUD-025: Planning applies configurable daypart identities inconsistently
 
@@ -1327,7 +1403,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   classification, and unsupported role configurations fail explicitly rather
   than degrading to fallback prose.
 - Related findings: `AUD-024`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 10.
 
 ### AUD-026: Outdoor-window ranking ignores snow, ice, and fog
 
@@ -1360,7 +1436,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: None of the supported hazard-only periods is described as quiet,
   and best/worst selection reflects the documented relative policy.
 - Related findings: `AUD-019`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 8.
 
 ### AUD-027: Subzero temperatures are rendered as positive zero-degree bands
 
@@ -1391,7 +1467,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: Every negative input produces unambiguously below-zero wording,
   and band indices remain monotonic from colder to warmer values.
 - Related findings: `AUD-016`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 8.
 
 ### AUD-028: Embedded official SPC category descriptions have drifted
 
@@ -1432,7 +1508,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   authoritative revision, and repository-authored summaries are labeled as
   such; asset and briefing tests pass.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 11.
 
 ### AUD-029: Raw source warnings cross the curated prompt boundary
 
@@ -1471,7 +1547,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   transport/provenance fields; ordinary warning meaning and existing
   deterministic YAML tests remain intact.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 1.
 
 ### AUD-030: The shared prompt instructs nonexistent briefing paths
 
@@ -1508,7 +1584,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   current serialized package and a category move or prompt-path regression
   fails one focused compatibility test.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 1.
 
 ### AUD-031: The shared prompt overstates SPC product locality
 
@@ -1546,7 +1622,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   treat regional or non-containing SPC material as point-local, while still
   requiring locally relevant digest facts to lead the report.
 - Related findings: `AUD-030`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 1.
 
 ### AUD-032: The exported YAML loader accepts malformed package shapes
 
@@ -1587,7 +1663,8 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   identify a real consumer—so prescribing strict decoding first has
   insufficient cost-benefit evidence.
 - Related findings: `AUD-072`
-- Remediation reference: pending
+- Remediation reference: Not applicable; consolidated into `AUD-072` and
+  Remediation Stage 31.
 
 ### AUD-033: Stanza serialization failures lack a focused contract test
 
@@ -1622,7 +1699,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: The focused test fails if conversion errors lose stanza context
   or are swallowed, and deterministic successful serialization remains green.
 - Related findings: `AUD-043`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 1.
 
 ### AUD-034: Prompt-debug credential redaction misses common aliases and URL forms
 
@@ -1662,7 +1739,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: Every supported debug projection is allowlisted, adversarial
   marker tests find no value leak, and normal summaries remain content-free.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 12.
 
 ### AUD-035: Prompt-debug symlink checks can be raced before writes
 
@@ -1701,7 +1778,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   originally validated root handle across component swaps; attempted
   redirection fails closed without an external file or partial target.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 12.
 
 ### AUD-036: The generated-text catalog accepts a known pair for the wrong report
 
@@ -1740,7 +1817,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: Every current definition resolves once, and swapping any two
   known pairs fails during lookup before prompt inspection or provider work.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 13.
 
 ### AUD-037: Typed decoding accepts property names rejected by the schema
 
@@ -1778,7 +1855,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: A corpus of canonical, missing, added, case-varied, duplicate,
   null, and wrong-type fields produces compatible schema and Go decisions.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 13.
 
 ### AUD-038: Generated prose and decoder diagnostics have no size boundary
 
@@ -1821,7 +1898,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   normalization/rendering, and no malformed provider value can make normal
   error text exceed the documented diagnostic bound.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 13.
 
 ### AUD-039: Generated-text tests duplicate semantic and rendered-output ownership
 
@@ -1867,7 +1944,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   schema/type disagreement, required-field regression, or normalization
   change, and report-template tests fail only for template/render behavior.
 - Related findings: `AUD-037`, `AUD-063`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 32.
 
 ### AUD-040: Render contexts accept conflicting report identities
 
@@ -1911,7 +1988,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   metadata stanza that disagrees with the canonical context input; all four
   normal prepared contexts still render.
 - Related findings: `AUD-036`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 15.
 
 ### AUD-041: Dynamic prose can impersonate deterministic Markdown sections
 
@@ -1956,7 +2033,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   owned nodes create report headings and deterministic list structure, and
   adversarial dynamic strings remain text within their authorized slots.
 - Related findings: `AUD-038`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 15.
 
 ### AUD-042: Today can render a daypart heading with no rows or fallback
 
@@ -1988,7 +2065,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: The Daypart Forecast heading is always followed by at least one
   row or the explicit fallback, and mixed rows retain their existing order.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 15.
 
 ### AUD-043: Generated-text compatibility is validated after collection
 
@@ -2031,7 +2108,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   ordinary, batch, and comparison preflight, while each valid definition is
   resolved once and no model execution occurs on later preparation failures.
 - Related findings: `AUD-036`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 16.
 
 ### AUD-044: Execution provenance is accepted without reconciliation
 
@@ -2079,7 +2156,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   inspected prompt hash and selected profile/backend/model in results and
   debug artifacts.
 - Related findings: `AUD-036`, `AUD-037`, `AUD-040`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 16.
 
 ### AUD-045: Single-report publication replaces non-regular destinations
 
@@ -2120,7 +2197,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   the documented symlink policy; non-regular objects retain their type and
   identity with zero collector, executor, or notifier calls.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 17.
 
 ### AUD-046: Valid long output names fail through the temporary-name pattern
 
@@ -2164,7 +2241,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   and a failed publication leaves neither a partial file nor an app-created
   empty directory under the documented lifecycle.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 17.
 
 ### AUD-047: Cancellation is not checked at the publication linearization point
 
@@ -2206,7 +2283,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   rename succeeds, results truthfully report publication regardless of later
   notification outcome.
 - Related findings: `AUD-038`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 17.
 
 ### AUD-048: Unsupported Distributor endpoint forms fail only after publication
 
@@ -2247,7 +2324,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   production upload client; rejected endpoint forms perform no collection,
   report generation, publication, or notification.
 - Related findings: `AUD-005`, `AUD-011`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 18.
 
 ### AUD-049: Distributor response text crosses into normal batch diagnostics
 
@@ -2287,7 +2364,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   normal notification results or CLI output, while conflict, status, and local
   identity remain actionable.
 - Related findings: `AUD-012`, `AUD-034`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 18.
 
 ### AUD-050: Distributor response bodies have no size boundary
 
@@ -2323,7 +2400,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: Memory use is bounded independently of remote body length and
   oversized responses fail with a stable safe diagnostic.
 - Related findings: `AUD-013`, `AUD-038`, `AUD-049`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 18.
 
 ### AUD-051: Mid-batch cancellation is flattened into ordinary report failures
 
@@ -2367,7 +2444,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   shared context termination stops new work and remains identifiable at every
   application and CLI boundary.
 - Related findings: `AUD-008`, `AUD-047`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 19.
 
 ### AUD-052: Distributor adapter tests bypass the production HTTP boundary
 
@@ -2405,7 +2482,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   repository-to-dependency HTTP path, and each remaining fake has a boundary
   behavior that the local server cannot express efficiently.
 - Related findings: `AUD-049`, `AUD-050`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 18.
 
 ### AUD-053: Comparison recognition accepts ambiguous manifest fields
 
@@ -2444,7 +2521,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: Only exact, unique schema property names reach `Manifest.Validate`
   and no ambiguous manifest can authorize replacement.
 - Related findings: `AUD-037`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 20.
 
 ### AUD-054: Manifest validation does not enforce canonical profile report names
 
@@ -2485,7 +2562,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: Every published and recognized successful report path is exactly
   reproducible from the manifest's ordered profile identity.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 20.
 
 ### AUD-055: Replacement ignores cancellation after moving the prior bundle
 
@@ -2525,7 +2602,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   rename either leaves or restores the exact prior destination and cannot
   return a committed replacement.
 - Related findings: `AUD-008`, `AUD-047`, `AUD-051`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 21.
 
 ### AUD-056: Cleanup errors can leave an invalid retained backup
 
@@ -2567,7 +2644,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: Every cleanup failure reports the actual surviving state; only a
   complete recognized old bundle is called a retained backup.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 21.
 
 ### AUD-057: Long comparison destinations fail through derived sibling names
 
@@ -2604,7 +2681,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
 - Validation: Every preflighted basename can create both sibling forms, and a
   pre-commit failure leaves only the documented parent-directory state.
 - Related findings: `AUD-046`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 21.
 
 ### AUD-058: Late cancellation overwrites completed profile failures
 
@@ -2649,7 +2726,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   cancellation category; result order and no-publication behavior remain
   unchanged under the race detector.
 - Related findings: `AUD-044`, `AUD-051`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 22.
 
 ### AUD-059: Missing-credential test depends on the ambient environment
 
@@ -2685,7 +2762,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   inspection, provider-call count, error category, or test outcome, and the
   full scrubbed/default suites continue to pass.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 23.
 
 ### AUD-060: Symlink tests assume host creation capability
 
@@ -2725,7 +2802,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   hosts report narrowly explained skips rather than setup failures; other
   filesystem and race tests remain unchanged.
 - Related findings: `AUD-035`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 23.
 
 ### AUD-061: SPC policy constants have a redundant implementation-coupled test
 
@@ -2757,7 +2834,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   outcome, while replacing the constants with an equivalent implementation
   requires no test edit.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 24.
 
 ### AUD-062: Two integration tests pay production retry and polling intervals
 
@@ -2794,7 +2871,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   production-sized sleep, and the suite's cancellation/timeout tests still
   detect a wait mechanism that ignores context.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 24.
 
 ### AUD-063: Render-context tests duplicate template output ownership
 
@@ -2838,7 +2915,8 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   Keeping two remediation entries would create overlapping edits and two
   validation plans for one consolidation boundary.
 - Related findings: `AUD-039`
-- Remediation reference: pending
+- Remediation reference: Not applicable; consolidated into `AUD-039` and
+  Remediation Stage 32.
 
 ### AUD-064: Comparison test failure exits can leave workers blocked
 
@@ -2873,7 +2951,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   diagnosis and leaves no blocked comparison workers under the race detector
   or a goroutine-leak probe.
 - Related findings: `AUD-058`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 25.
 
 ### AUD-065: Weather collection duplicates one source and serializes independent requests
 
@@ -2919,7 +2997,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   than their sum; existing normalized fixture output and failure policy remain
   byte-for-byte or semantically unchanged as appropriate.
 - Related findings: `AUD-013`, `AUD-015`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 26.
 
 ### AUD-066: Comparison replacement repeatedly rereads complete bundles
 
@@ -2964,7 +3042,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   deliberate commit authorization without rereading any artifact inside a
   scan; recognized and adversarial bundles retain their current outcomes.
 - Related findings: `AUD-038`, `AUD-053`, `AUD-055`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 27.
 
 ### AUD-067: Daypart key canonicalization has two independent owners
 
@@ -3004,7 +3082,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   snapshot, prompt, and render boundaries; current default keys and rendered
   ordering remain unchanged.
 - Related findings: `AUD-024`, `AUD-025`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 9.
 
 ### AUD-068: Distributor single and batch templates duplicate one parser
 
@@ -3040,7 +3118,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   malformed inputs retain their actionable field names, and a parser mutation
   is detected once rather than by copied syntax suites.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 28.
 
 ### AUD-069: Preparation retains parallel metadata authorities and unused render surfaces
 
@@ -3089,7 +3167,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   impossible or rejected, and template contexts contain no unused complete
   fact bundle.
 - Related findings: `AUD-029`, `AUD-040`, `AUD-063`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 14.
 
 ### AUD-070: Fact requirement policy spans constants, declarations, and switches
 
@@ -3132,7 +3210,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   requirements fail at registry creation, and existing omit/empty/error results
   remain unchanged for all reports.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 29.
 
 ### AUD-071: Generate and comparison repeat report-date policy at four sites
 
@@ -3172,7 +3250,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   resolved dates for all four reports, and no duplicated report-kind switch
   remains in their date path.
 - Related findings: `AUD-009`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 30.
 
 ### AUD-072: Dormant internal compatibility and persistence surfaces have no workflow owner
 
@@ -3226,7 +3304,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   reference, prompt YAML and rendered reports remain unchanged, alert source
   hashes still cover accepted payloads, and the repository suite passes.
 - Related findings: `AUD-001`, `AUD-022`, `AUD-032`, `AUD-038`, `AUD-039`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 31.
 
 ### AUD-073: Duplicate capitalization helpers disagree on Unicode safety
 
@@ -3261,7 +3339,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   label remains valid UTF-8 with its first rune capitalized, and only one
   capitalization implementation remains.
 - Related findings: `AUD-024`, `AUD-025`, `AUD-067`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 10.
 
 ### AUD-074: CLI help and internal guidance disagree with action behavior
 
@@ -3305,7 +3383,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   run, and comparison failed-result tests remain silent under `--quiet`; and
   CLI internals name all three action families.
 - Related findings: `AUD-010`, `AUD-071`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 4.
 
 ### AUD-075: Internal guides describe nonexistent APIs, flows, and tests
 
@@ -3353,7 +3431,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   caller, every claimed focused behavior is discoverable in the listed test
   package, and internal-document links still resolve.
 - Related findings: `AUD-001`, `AUD-003`, `AUD-072`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 33.
 
 ### AUD-076: Completed comparison roadmaps duplicate current contracts
 
@@ -3399,7 +3477,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   command, artifact, and lifecycle contract; active roadmaps contain only
   future or audit coordination work; all repository links resolve.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 34.
 
 ### AUD-077: Concurrent executor substitutability is only implicit
 
@@ -3441,7 +3519,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   call requirement, the Promptkit adapter remains race-clean, and single-report
   executors retain unchanged behavior.
 - Related findings: `AUD-058`
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 22.
 
 ### AUD-078: Configuration normalization and timezone bounds are underdocumented
 
@@ -3486,7 +3564,7 @@ with evidence about meaningful risks, test ownership, gaps, and duplication.
   accepted, representative out-of-range offsets are rejected, and the
   configuration reference agrees with focused parser tests.
 - Related findings: none
-- Remediation reference: pending
+- Remediation reference: Remediation Stage 2.
 
 ## Retained Decisions
 
@@ -6001,16 +6079,50 @@ remediation is intentionally left to Stage 27.
 - Open questions: none; remediation and dynamic-validation leads are routed
   above without changing later-stage scope.
 
+### Stage 25: Run Dynamic Robustness And Final Diagnostic Validation
+
+- Status: Complete.
+- Scope reviewed: the complete default suite and CLI help path, race-enabled
+  execution, three shuffled repetitions, vet, statement coverage, critical
+  weak branches, whitespace validity, and worktree artifact cleanup.
+- Exclusions: no live service, real credential, production mutation, or
+  remediation was introduced. Coverage remained diagnostic rather than a
+  percentage target.
+
+#### Commands And Evidence
+
+- Ran `GOWORK=off go test -count=1 ./...`; all packages passed.
+- Ran `GOWORK=off go test -race -count=1 ./...`; all packages passed with no
+  race report.
+- Ran `GOWORK=off go test -shuffle=on -count=3 ./...`; all three shuffled
+  repetitions passed with no order-dependent or intermittent failure.
+- Ran `GOWORK=off go vet ./...` and
+  `GOWORK=off go run ./cmd/weatherreporter --help`; both passed.
+- Ran `GOWORK=off go test -coverprofile=coverage.out ./...` and inspected the
+  function/package report. Total statement coverage was 79.4%. Lower coverage
+  remained concentrated in thin production wrappers, defensive accessors,
+  report/time helpers, and dormant surfaces already owned by `AUD-003`,
+  `AUD-052`, and `AUD-072`; no additional consequential unowned branch became
+  a finding.
+- Ran `git diff --check`; it passed. Removed `coverage.out` and verified no
+  generated diagnostic artifact remained.
+- Findings: none new. Dynamic execution strengthened the existing evidence for
+  the test, cancellation, concurrency, diagnostic-boundary, and publication
+  findings without changing their ownership.
+- Retained decisions: all existing decisions remained consistent with the
+  dynamic results.
+- Open questions: none.
+
 ### Stage 26: Verify, Consolidate, And Triage Findings
 
 - Status: Complete.
 - Scope reviewed: all 78 candidate findings, all 61 retained decisions, every
   routed open question, finding-specific validation and test implications, the
   stage-coverage table, and every risk-to-test coverage entry.
-- Exclusions: Stage 25 remains pending because its interrupted results were not
-  promoted into audit evidence. No production code, test code, canonical
-  documentation, implementation priority, acceptance decision, or remediation
-  sequence was changed; those remain Stage 27 work.
+- Exclusions: no production code, test code, canonical documentation,
+  implementation priority, acceptance decision, or remediation sequence was
+  changed; those remain Stage 27 work. Stage 25's interrupted evidence was
+  rerun and recorded during final audit closure rather than inferred.
 
 #### Final Disposition
 
@@ -6081,3 +6193,51 @@ directly established.
   rejected as standalone duplicates.
 - Retained decisions: `RET-001` through `RET-061` revalidated.
 - Open questions: none.
+
+### Stage 27: Produce The Remediation Roadmap And Close The Audit
+
+- Status: Complete.
+- Scope reviewed: all 74 confirmed findings, all 61 retained decisions, final
+  coverage and risk matrices, discovery exclusions, repository-wide validation,
+  canonical documentation ownership, dependency ordering, one-prompt stage
+  sizing, and roadmap lifecycle requirements.
+- Exclusions: no finding was remediated; no production code, tests,
+  dependencies, embedded assets, maintained examples, canonical current-state
+  documents, ADRs, or release notes changed.
+
+#### Acceptance And Allocation
+
+- Accepted all 74 confirmed findings for implementation. None was priority-
+  deferred, and the evidence was sufficient to choose a corrective direction
+  without a separate product or architecture decision.
+- Created `docs/roadmap/audit-remediation.md` with 35 independently executable
+  stages. Each stage names its findings, affected areas, work, locked behavior,
+  test expectations, canonical documentation owners, and exit commands.
+- Allocated every confirmed finding exactly once. Correctness, security, data
+  integrity, destructive operations, cancellation, and compatibility precede
+  efficiency, behavior-preserving refactoring, test cleanup, and documentation
+  retirement. Refactors that must preserve behavior have their own stages
+  after related behavioral fixes.
+- Kept the four rejected standalone findings out of the allocation: `AUD-001`,
+  `AUD-022`, and `AUD-032` remain consolidated into `AUD-072`; `AUD-063`
+  remains consolidated into `AUD-039`.
+- Recorded a final lifecycle gate that removes temporary audit records only
+  after remediation is complete and useful contracts/rationale live with their
+  durable canonical owners.
+
+#### Final Verification
+
+- Re-ran and recorded the complete Stage 25 command set on the current checkout
+  to close the previously interrupted evidence gap. All commands passed,
+  coverage remained 79.4%, and `coverage.out` was removed.
+- Verified mechanically that all 78 ledger entries have final statuses, every
+  confirmed finding has one remediation-stage reference, rejected entries have
+  no independent remediation assignment, and the roadmap allocation contains
+  each confirmed ID exactly once.
+- Ran repository link/reference checks for the new roadmap, `git diff --check`,
+  and worktree-scope checks. Only `docs/roadmap/audit.md` and
+  `docs/roadmap/audit-remediation.md` changed during Stage 27.
+- Findings: no new audit findings.
+- Retained decisions: `RET-001` through `RET-061` remain valid and are encoded
+  as locked behavior or reconsideration constraints where relevant.
+- Open questions and unresolved scope gaps: none.