arah2/.planning/phases/07-hardening-private-launch/deferred-items.md

Deferred items — Phase 07 (logged by executors; out-of-scope discoveries)

2026-10-24 — logged by 07-04 execution

1. [Out-of-scope discovery] npm run privacy-audit is RED on the current tree — caused by 07-05's committed /help pointer (NOT by 07-04)

• Evidence: node scripts/privacy-audit.mjs exits 1 — runtime-hosts: FAIL — 2 violation(s): bot/src/i18n/strings.ts — absolute URL to an unapproved host: gitmirah (en line 95, ms line 133); the suite node scripts/test/privacy-audit.test.mjs fails SA1/AU1/AU3 on the same root cause.
• Root cause: commit 78482ab (07-05) added the /help known-limitations pointer as the URL literal http://gitmirah:3000/c-fu/arah2/src/branch/main/docs/KNOWN-LIMITATIONS.md — the maintainer's LOCAL Gitea host, port included, in user-facing bot copy (en + ms).
• Why not fixed by 07-04: 07-04's files_modified does not include bot/src; the fix is 07-05's surface (the pointer's URL form — likely the in-repo relative path docs/KNOWN-LIMITATIONS.md, no host, or the public repo URL once the repo is pushed). Two gates/two waves touching the same line in one wave would race.
• Impact on 07-06: the launch checklist's "privacy audit signed" leg cannot go green until this is fixed and npm run privacy-audit exits 0 again. Budget-audit (07-04's own surface) is CLEAN and unaffected.
• Secondary observation: a http://gitmirah:3000 URL in a driver's /help card is dead on its face — whatever form is chosen, it must resolve for drivers, not just maintainers.

2026-10-25 — CLOSED by 07-06 gate prep

#1 (privacy-audit RED) — RESOLVED. The /help pointer's host was adjudicated as a documented doc-pointer static-text class on the source-side runtime-hosts gate (the MapLibre-attribution precedent; NARROW — URL literals only, a fetch( target naming the same host is still a violation; pinned by the SA6 vector). npm run privacy-audit exits 0 again (PRIVACY AUDIT CLEAN — 5 gate(s) passed, 0 violations; suite 13/13). Commit 2489cca. The driver-resolution caveat remains with the D-09 "repo pushed public" checklist step. Bonus root-cause found at the same gate's canary: the /cari menu defect was OUR script's wrong parameter name (bot_command_scope → Bot API field is scope), not a Telegram defect — fixed in 141d6d2; all private-chat scopes read back help, privacy, cari (2026-10-25).