The review document was the last place several findings existed, so it could
not just be deleted. Everything still useful moved out first:
- roadmap items csrf-tokens, template-data-typing, structured-logging and
review-2026-08-followups are now self-contained — each row names the file,
the symptom and what "done" means, instead of pointing at a paragraph number
in a plan file.
- security.md's CSRF accepted-risk bullet now names the csrf-tokens item, so
the two records of that decision cannot drift apart unnoticed; the item says
the same in the other direction.
- CHANGELOG [Unreleased] records the review itself in its intro rather than as
an added file: the document was created and removed inside one unreleased
cycle, so it never was part of a release.
- the declined finding (//go:build linux for the /proc reader) keeps its
rationale in the roadmap so it is not raised again.
Also repaired three links to inbound-relay.md, deleted back when that feature's
plan was cleaned up: the two inbound plans now point at architecture.md § Mail
path for the as-built behaviour.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Add journal and allow/deny list design, quarantine candidate, roadmap entries, and Composer to Opus to Fable routing note.
Co-authored-by: Cursor <cursoragent@cursor.com>
mixandClaude Opus 5