# Comprehensive source audit: 2026.11.03.07

This is the historical audit record for `2026.11.03.07`. The subsequent [runtime cleanup](CLEANUP-2026.11.04.md) removes retired surfaces described below; current behavior and configuration are documented in the README/wiki.

This audit started from development commit `91ed2d87563b38cdba1d18730de9e367c01a14b2` (`2026.11.03.06`). The baseline passed 62 Python tests, 225 browser page cases, and 810 native-grid layout cases. Passing that baseline did not establish the behaviors below: focused fault and boundary fixtures reproduced additional defects, which were repaired and rerun before qualification of the combined candidate.

The resulting development candidate has 109 Python tests, 225 browser page cases, and 945 native-grid layout cases. See [validation commands and acceptance limits](VALIDATION.md). These are local source/package and synthetic-host results; they do not establish physical Unraid acceptance or the absence of every possible defect.

## Reviewed components and connections

| Component | Reviewed responsibilities and connected owners |
| --- | --- |
| Main runtime entry point | All CLI, cron, native-command, and lifecycle dispatch branches; operation preconditions; restart/cancel/start; heat; progress, history, and shutdown. |
| Helpers and default configuration | State loading/reloading, integer validation, descriptions, trigger markers, version gates, logging, cron validation, and string utilities. Defaults remain compatible with existing saved settings. |
| Native command wrapper | Parent classification, argument preservation, old-progress preparation, native write status, post-write observer ordering, status passthrough. |
| Background coordination | Mover PID identity, backup marker observations, locked state transitions, overlaps, pause ownership, heat transfer, increment windows, and retry after failed commands. |
| Temperature handling | Native configuration merge, explicit disabled/inherited disk limits, SSD/NVMe/general limits, array pausing, cooling, critical shutdown, and the shutdown policy reread. |
| Completion and notification modules | Progress protocol validity, kernel identity, completion receipts, native finish suppression, corrupt-state fallback, delivery failure, locking, native wrapper pass-through, and genuine errors/cancellation. |
| Partial-check validator and monitor | Authoritative range derivation, correction choice, immutable range, observed start, kernel-run ownership, stop/retry, stale markers, and displayed range. |
| Settings and Assistant pages | Submitted controls, native update form bindings, client validation, escaping, conditional fields, native grid, inline help, RTL/mobile, and unrelated Scheduler controls. |
| History and syslog endpoints | Supported history variants, numeric/date handling, translated labels, escaped persisted text, popup document attributes, and safe display of kernel text. |
| Lifecycle scripts and menu integration | All 15 event dispatchers, entry-point references, supported/placeholder commands, native button ownership, and the unused refresh scaffold. |
| Localization and compatibility | Offline lookup and Legacy fallback, 42 canonical catalogs and 45 native exports, source extraction, positional printf, protected markup, locale aliases, and stable protocol identity. Catalog wording remains subject to native-speaker review. |
| Installer/remover and packaging | Hook/backup ownership and restoration, update preservation, package extraction paths/modes, deterministic builds, failure-safe archive staging, checksums, manifest/archive parity, and case-sensitive installed references. |
| Validation and documentation tooling | Test fixture isolation, native parser/CSS/monitor source integrity, actual source function extraction, synthetic state transitions, browser matrix, branding and documentation checks. |

## Confirmed defects repaired

Test names below refer to `scripts/test_audit.py` unless a different file is named. Related causes are grouped so the ownership relationships remain visible.

| Area | Reproduced defect and final behavior | Focused regression evidence |
| --- | --- | --- |
| Critical shutdown policy | Critical heat shutdown incorrectly depended on completion-shutdown state. It now uses its own setting and rereads saved policy after the notification delay before powering off. | `test_critical_heat_shutdown_is_independent_of_completion_shutdown`; `test_shutdown_rechecks_saved_policy_before_power_command`. |
| Critical-only heat setting | Enabling critical shutdown also enabled heat pauses. Independent guards now keep those choices separate. | `test_shutdown_temperature_monitoring_does_not_enable_pause_policy`. |
| Critical coverage | Early monitor returns and an array-only heat loop excluded idle, stopped, partial, and pool-disk critical conditions. Available critical temperatures are checked before those returns. | `test_critical_temperature_covers_idle_stopped_partial_and_pool_disks`. |
| Inherited temperature limits | Negative native per-disk values were treated as real thresholds, causing false hot classifications. A shared helper follows native explicit-zero, inherited, SSD, and NVMe behavior in both background and main paths. | `test_temperature_pause_inherits_negative_per_disk_limit`; `test_temperature_inheritance_and_disabled_limit_boundaries`. |
| Invalid temperature offsets | Hand-edited nonnumeric offsets could raise a PHP arithmetic TypeError and stop monitoring. Invalid offsets use shipped defaults in memory. | `test_malformed_heat_offsets_do_not_crash_monitor`. |
| Pause confirmation | Failed background/heat pause commands claimed ownership or announced success. Central pause verifies native status and observed state before recording the pause, notifying, or transferring ownership. | `test_failed_background_pause_does_not_claim_ownership_or_send_paused`; `test_failed_temperature_pause_does_not_claim_hot_pause`. |
| Resume retry | Failed background/heat resumes discarded markers or announced success. Ownership is retained on failure; retry remains possible; success requires observed running state. Cooling also honors the relevant operation window. | `test_failed_background_resume_retains_ownership_and_retries`; `test_failed_temperature_resume_keeps_hot_marker_for_retry`; existing overlap/manual/window tests in `test_regressions.py`. |
| Marker timestamps | `LOCK_EX` had been passed as the timestamp to `date()`, writing a 1970 date. It is now the file-write flag. | `test_marker_timestamp_records_creation_time`. |
| Version boundaries | Feature checks excluded exactly Unraid 6.10.3 and 6.11.0. Inclusive comparisons now match those feature boundaries. | `test_declared_unraid_feature_version_boundaries`. |
| Restart disk snapshot | Comparing only current entries missed removed array assignments. Normalized array-only snapshots detect removed, added, or replaced assignments and reject missing identity. | `test_restart_detects_removed_disk_assignments`. |
| Restart inputs and policy | Malformed positions could crash or become unsafe command offsets, and a pending restart ignored a disabled setting. Saved numeric/action/range/correction fields and the current preference are checked first. | `test_invalid_saved_restart_position_is_rejected_without_native_command`; `test_disabling_restart_policy_prevents_pending_restart`. |
| Restart command outcome | Cancellation could wait indefinitely, and restart success was announced without observing a running operation. Six five-second observations bound each wait; command and observed-state failures stop the attempt. | `test_restart_wait_is_bounded_and_failed_start_is_not_reported_successful`; `test_failed_restart_start_does_not_announce_restart`; `test_successful_restart_restores_saved_trigger`. |
| Restart history cleanup | Cleanup crashed on missing history or removed an unrelated canceled row. It now matches operation timing/action and checks writes without unlinking shared history. | `test_history_cancel_cleanup_handles_missing_and_retains_other_runs`. |
| Trigger metadata | Fallback manual detection overwrote explicit scheduled metadata; restart ignored the saved trigger. A single setter maintains mutually exclusive explicit trigger markers. | `test_scheduled_native_callback_keeps_explicit_trigger`; `test_successful_restart_restores_saved_trigger`. |
| Unclean-start classification | Assignment inside a condition changed the action and treated rebuilds as automatic checks. The actual action is compared without mutation. | `test_unclean_start_does_not_reclassify_rebuild_as_automatic_check`. |
| Weekly and overnight windows | Day selections were ignored and the exact overnight resume boundary was excluded. Daily/weekly minute intervals now include resume and exclude pause, including week crossings. | `test_schedule.py::test_weekly_window_and_overnight_resume_boundary`; browser weekly validation. |
| Custom window lifetime | Changed schedules could retain an obsolete custom-window marker. Only changed pause/resume jobs clear it; idle observations and monitor-cadence changes preserve it. | `test_custom_increment_window_survives_idle_and_only_schedule_changes_clear_it`. |
| Cron generation | Invalid expressions, multiline command insertion, and a zero-minute monitor interval replaced working cron jobs. Both client and backend validate the supported syntax; backend writes are staged and renamed only after validation. | `test_invalid_cron_configuration_preserves_last_valid_jobs`; `tests/ui.cjs` cron, identical-times, weekly-day, Apply recovery, and native-control cases. |
| Native observer state | Bare check callbacks no longer read a missing optional argument. Failed native pause/resume/cancel observations cannot create false progress or discard active ownership; partial stop ownership remains with its monitor. | `test_native_bare_check_callback_needs_no_optional_argument`; `test_failed_native_cancel_and_pause_preserve_active_owner`. |
| Native wrapper ordering | The wrapper observed old state before the native command and split/globbed arguments; padded process names impaired scheduled classification. It now prepares old progress, writes quoted arguments, then observes new state. | `test_mdcmd_observer_reads_post_command_state_and_preserves_arguments`. |
| Correction mode | CLI `check` reversed the native scheduled write preference. `NOCORRECT` now maps to non-correcting and an empty native preference maps to correcting; missing preference defaults safely to non-correcting. | `test_cli_check_honors_native_correction_setting`. |
| Full-check start | CLI could request a full check while stopped and announce a failed start. Started-array preconditions, explicit manual trigger, command status, and observed activity are now required. | `test_cli_check_requires_started_array_and_observed_start`; `test_confirmed_pause_resume_full_start_and_cancel`. |
| CLI cancellation | A failed cancel was recorded as canceled; a successful one lost its operation description after state reload. Only observed terminal state is analyzed, with its actual status and original description. | `test_failed_cancel_does_not_claim_cancellation`; `test_confirmed_pause_resume_full_start_and_cancel`. |
| Partial start | A failed start stranded the partial marker and announced success. Native success and an observed operation are required; failure removes ownership. | `test_failed_partial_start_leaves_no_owner_or_started_notice`; `test_runtime.py::test_backend_percent_range_uses_authoritative_bounds`. |
| Partial run identity | A stale range marker could cancel a later operation. New markers bind kernel start, size, action, and correction policy; an unbound/stale marker cannot cancel anything. | `test_stale_partial_marker_never_cancels_another_operation`. |
| Partial stop and range display | Failed stops still announced completion; mutable settings changed the displayed range/correction label. Stop failures retain ownership for retry; monitor/notifications use the stored running snapshot. | `test_partial_success_uses_snapshot_and_failed_stop_retries`. |
| Kernel state validation | Missing state could warn/crash, reload left stale descriptions, and same-length integer overflow passed validation. Invalid state cannot establish an active operation; descriptions refresh on reload. | `test_missing_host_state_is_safe_and_reload_updates_description`; `test_kernel_integer_overflow_cannot_create_active_state`. |
| Duplicate progress | Duplicate pause/stop/restart observations counted the same runtime repeatedly; duplicate resume observations increased increments. Segment accounting uses kernel-start identity and accumulated duration; the writer deduplicates transition families by state rather than string prefix. | `test_completion.py::test_duplicate_transition_observations_do_not_double_count_runtime`; `test_progress_writer_compares_transition_identity_not_prefix`. |
| Correction summary | The initial correction flag was collected but the terminal flag was used for summary labels. The initial policy now survives cleared terminal metadata. | `test_completion.py::test_first_correction_policy_survives_cleared_terminal_flag`. |
| Corrupt progress | A malformed early row could crash analysis while a later valid row suppressed native notifications. Shared protocol validation now defers analysis, preserves the file, and leaves native delivery available. | `test_completion.py::test_corrupt_progress_is_preserved_and_keeps_native_fallback`. |
| Saved-field escaping | Persisted Settings/Assistant values were interpolated into quoted HTML attributes. Values are now escaped at rendering. | `test_settings_and_assistant_escape_saved_attributes`. |
| History display | Nonnumeric duration could crash arithmetic; persisted text could become markup; reconstruction without a subtype warned; header cells were malformed. Numeric/date guards, safe subtype access, escaped output, and balanced table cells preserve valid mixed-format rows. | `test_history_skips_malformed_arithmetic_and_escapes_text`; `test_history_formats_five_through_ten_fields_are_renderable`. |
| Popup document | The popup appended a second language attribute using an undefined variable. It now emits one valid locale attribute. | `test_syslog_popup_has_one_valid_language_attribute`. |
| Assistant native layout | Inline help became extra native definition-list terms and action controls acquired paragraph offsets. Block separation and native spaced wrappers keep labels and controls paired. | `tests/settings-layout.cjs`: 135 Assistant layouts in addition to 810 Scheduler/Plugins layouts. |
| Dormant refresh scaffold | An inherited no-op scaffold read the wrong state path and, if reached, rendered a form with an undefined constant and unsupported `refresh` command. It now emits no form or script; inherited notices and installed path remain. | `test_native_button_scaffold_cannot_submit_an_unsupported_command`, including the formerly reachable file condition. |
| Utility contracts | Case-insensitive suffix comparison checked the wrong string, long suffixes could throw, and severity ignored its explicit argument. Corrected implementations follow the stated inputs. No active runtime callers relied on the broken suffix/severity behavior. | `test_suffix_and_explicit_severity_utilities`. |

## Integration evidence

Synthetic native commands run only inside temporary host copies. Successful commands update fixture `var.ini`; failed commands leave state unchanged. Destructive paths, shutdown, native command files, backup markers, and notifications are redirected into the fixture. The actual plugin code is executed, with only paths and waiting delays changed in test copies. Existing pure ownership tests continue to cover overlaps, manual pauses, heat transfer, and disabled preferences.

Completion tests retain the verbatim native-monitor section with recorded blob integrity, including overlap while Plus holds its completion lock, actual cancellation/error outcomes, failed delivery/history writes, and pass-through of unrelated notifications. All supported history formats and native parser/stylesheet fixtures are exercised. Catalog pruning removed five unreachable messages; there are no newly untranslated runtime keys. All 42 catalogs retain 363 messages and 45 native exports; runtime translation stays offline.

The combined package contains 124 files. Source bytes, installed references, ownership/modes, archive checksum, root/snapshot manifests, extraction-root preservation, and failed-build preservation are validated. Windows and Linux deterministic rebuilds are compared before publication. Published source, manifest, and package are checked against the exact pushed commit. The wiki is synchronized and pushed separately.

## Compatibility decisions and remaining acceptance

- Existing settings and English state/protocol fields are preserved. No stable release or main-branch promotion is part of this audit.
- Legacy partial markers without kernel identity are discarded without issuing cancellation. A partial check begun with an older build can continue as a normal native operation after update; use native controls deliberately if it should be canceled.
- Invalid schedule settings preserve the last valid cron file. Unsupported cron extensions are rejected. If a schedule fails to apply, correct its saved values and inspect the generated file.
- Critical shutdown uses all readable available disks, including pools, while heat pausing remains an array-operation policy. Unknown temperatures cannot establish a critical condition.
- Native version declaration remains Unraid 6.9.2 minimum. Synthetic version gates do not certify every historical/future Unraid build or third-party mover.
- The documented `history` CLI placeholder and unfinished experimental Docker surface are not promoted to operational features. Native Unraid remains responsible for parity button updates.
- Physical `upgradepkg`, disk I/O, real cron/DST/time-zone behavior, array stop/start/reboot, recon/clear offset behavior, native mover/backup transitions, temperature sensors/spin-up, actual shutdown, and notification channels still need acceptance on an Unraid test server. No physical-host result is inferred from a fixture notification.
- Translations retain structural, formatting, alias, and browser qualification. Native-speaker review is outstanding.

## Primary references checked

Native correction preference values were checked in [Unraid ParityCheck.page](https://github.com/unraid/webgui/blob/master/emhttp/plugins/dynamix/ParityCheck.page); temperature inheritance and configuration merge were checked in the [native monitor](https://github.com/unraid/webgui/blob/master/emhttp/plugins/dynamix/scripts/monitor), [Helpers.php](https://github.com/unraid/webgui/blob/master/emhttp/plugins/dynamix/include/Helpers.php), and [CustomMerge.php](https://github.com/unraid/webgui/blob/master/emhttp/plugins/dynamix/include/CustomMerge.php). Native fixture provenance is recorded separately in `tests/fixtures/unraid/sources.json`. The supported cron syntax was checked against [crontab(5)](https://www.man7.org/linux/man-pages/man5/crontab.5.html). External source behavior informed these changes; local regressions establish the plugin behavior described above.