Append Section V — ~75 additional manual/integration cases surfaced by a
code-grounded gap audit (8 read-only zone audits) of this plan, and correct
two now-stale cases:
- TC-TRASH-01: no confirm dialog / "30-day note" anymore — delete is
immediate with an 8s Undo toast (page-query.ts:132-144).
- TC-SPACE-03: server slugExists does not exclude self (bug to verify),
see new TC-SPACE-11.
New cases cover the fork's recently shipped, uncovered behavior (AI-chat
message queue / stopped-notice / partial-answer persistence, streaming
dictation via Silero VAD, trash undo-toast, MCP write-only headers) and
code-grounded server branches (notification CASL count leak, 3s
restriction-cache realtime leak, MovePageDto bound vs fractional-index
keys, to_tsquery 500, import zip-bomb / HTML-XSS, attachment download
authZ). Cases tagged [BUG?] double as candidate defects. Full rationale in
docs/qa-plan-gaps-pr136.md.
Docs-only.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
c23ca101f1