docs: record plan 02 fix publication

docs/execution/approved-issue-plans-ledger.md

@@ -34,7 +34,7 @@ state changes are outside scope.
 | Unit | Issues | Status / current validity | Owner | Worktree / branch | Base → head | Dependencies | Evidence | Tests | PR | Next action | Blockers |
 | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
 | 01 account login/recovery | #3166, #3164, #3078, #3046, #2897, #2837 | blocked | audit `task_855fbee0a803` | `codex-audit-backend-01-06` | `7a98f6662` → no source change | none | zero drift; live issues remain split; #3046/#3078 have merged #3095 candidate only | auth 42, email 6, focused/full API/server suites and affected typechecks/boundaries passed in audit | — | select exact auth/mail/API boundary only after current sanitized trace | current cloud digest, provider/account method, request/status trace, controlled mailbox |
-| 02 hosted v4 recovery | #3181, #2760 | published; hosted fix rereviewing | review `task_51b92554b36b` / `ctx_08bc7a78dd61` | `codex/issue-3181-recovery-procedure` | `7a98f6662` → `325d1fcd1` local | #2760 identity branch depends on 01 evidence | Unicode format-character IDs now rejected across all manifest fields; bot cleanup preserved; scanner extraction and relaxed canonicalization rejected with evidence | 83 comparator, 54 API, 21 auth tests, affected typechecks, boundaries, lint/import/diff/scope gates green; independent rereview active | [#3460](https://github.com/amruthpillai/reactive-resume/pull/3460) | if rereview clean, fresh verify, push, reply/resolve four hosted threads | real recovery still needs verified owner, snapshot, mapping, private delivery |
+| 02 hosted v4 recovery | #3181, #2760 | published; exact-head hosted checks rerunning | coordinator after clean rereview | `codex/issue-3181-recovery-procedure` | `7a98f6662` → `325d1fcd1` pushed | #2760 identity branch depends on 01 evidence | Unicode format-character IDs rejected across all manifest fields; bot cleanup preserved; scanner extraction and relaxed canonicalization rejected with independent evidence; four hosted threads replied/resolved | fresh coordinator 83 comparator, 381 API, 21 auth tests, affected typechecks, boundaries, lint/diff/base gates green; exhaustive independent Unicode/mutation review clean | [#3460](https://github.com/amruthpillai/reactive-resume/pull/3460) | monitor exact-head checks/reviews and verify zero new unresolved threads; keep unmerged | real recovery still needs verified owner, snapshot, mapping, private delivery |
 | 03 MCP registration | #3398, #3153 | no-change | audit `task_855fbee0a803` | `codex-audit-backend-01-06` | `7a98f6662` → no source change | coordinate DB/startup with 05 | merged #3421 (`fe9b59e`) present on main; current schema/startup/auth contracts match plan | #3421 hosted checks successful; audit auth/server/API/DB tests, typechecks, boundaries passed | #3421 merged before run | deployment verification only | deployed digest/log correlation and exact Codex/Claude DCR/consent/PKCE/MCP retest unavailable |
 | 04 AI provider compatibility | #2732, #2766, #2723, #2708 | blocked | audit `task_855fbee0a803` | `codex-audit-backend-01-06` | `7a98f6662` → no source change | serialize edits to AI service | zero drift; historical #2708 Responses path and #2766 structured Test path absent; remaining tuples differ | focused API 96 and full API suites/typecheck/boundaries passed in audit | — | select wire/state/import/base-path unit only after exact current tuple fails | provider/model/base URL/path/version/action/error tuple and allowed endpoint unavailable |
 | 05 AI provider migrations | #3152 | blocked | audit `task_855fbee0a803` | `codex-audit-backend-01-06` | `7a98f6662` → no source change | coordinate DB/startup with 03 | zero drift; table schema, migration, startup ordering, Docker copy path coherent; `42P01` historical cause unresolved | audit API/server/DB tests, typechecks, boundaries passed; no real PostgreSQL migration fixture | — | choose config/packaging/startup/migration repair only after disposable reproduction | affected image layout/digest, working directory, DB schema/search path/journal, fresh+upgrade DB fixture |
@@ -42,7 +42,7 @@ state changes are outside scope.
 | 07 AIO deployment | #2722 | published | implementation/review chain complete | `codex/issue-2722-postgres-docs` | `7a98f6662` → `171637526` | none | image and repository update flows now separate through correct `reactive-resume`/`reactive_resume` log commands; clean rereview | fresh Compose/DB/docs coordinator gates and all exact-head hosted checks green; approved; zero unresolved threads | [#3457](https://github.com/amruthpillai/reactive-resume/pull/3457) | keep unmerged; monitor only | no AIO implementation; optional Unraid host smoke unavailable |
 | 08 root public resume | #2669 | plan amendment required before implementation | audit `task_9f27829ca50f` | planned `codex/issue-2669-root-resume` | `7a98f6662` → — | none | current password redirect rejects `/`; public view is slug-hook-bound; SSR canonical cannot import server env; expanded auth/canonical contract identified | audit focused API/web suites, typechecks, boundaries passed | — | amend ownership for identity-vs-return auth flow and server-derived canonical root, then dispatch coherent feature | engineering scope correction; feature remains narrower than arbitrary domain/TLS registry |
 | 09 external version backup | #2705 | published | implementation/review chain complete | `codex/issue-2705-git-backup-docs` | `7a98f6662` → `4ffdd96bd` | none | clean round-4 rereview; command-site prose requires unused output; replies document selected revision and fresh-file fixes | fresh coordinator 152 tests plus Markdown/diff/scope and all exact-head hosted checks green; approved; zero unresolved threads | [#3458](https://github.com/amruthpillai/reactive-resume/pull/3458) | keep unmerged; monitor only | DB integration/E2E unavailable; no sync/remote/whole-account restore |
-| 10 legacy link routing | #2836 | pending implementation after brief correction | audit `task_9f27829ca50f` | planned `codex/issue-2836-retired-slug-notices` | `7a98f6662` → — | none | prospective same-username slug-attempt notice remains coherent; exact DB/API/UI/E2E owner set verified | audit focused API/web suites, DB/API/web typechecks, boundaries passed | — | correct final E2E target to `public-sharing.spec.ts`, then implement migration/API/owner UI atomically | historical cause absent; no redirects/emails/recovery; prospective partial coverage only |
+| 10 legacy link routing | #2836 | implementing | `task_fd191afc86ba` / `ctx_5100e7419c11` | `codex/issue-2836-retired-link-notices` | `7a98f6662` → work active | none | prospective same-username slug-attempt notice remains coherent; exact DB/API/UI/E2E owner set verified; brief correctly targets `public-sharing.spec.ts` | audit focused API/web suites, DB/API/web typechecks, boundaries passed; implementation TDD/migration/E2E running | — | complete coherent privacy-preserving migration/API/owner UI unit, commit, then independently review | historical cause absent; no redirects/emails/recovery; prospective partial coverage only |
 | 11 job search policy | #3010 | published | implementation/review chain complete | `codex/issue-3010-jsearch-docs` | `7a98f6662` → `1d0397884` | none | two valid wording comments fixed; independent full-diff re-review found no issues; replies carry commit evidence | 52 focused tests plus Markdown/link/diff/base/scope and all exact-head hosted checks green; approved; zero unresolved threads | [#3459](https://github.com/amruthpillai/reactive-resume/pull/3459) | keep unmerged; monitor only | real provider/browser optional gate unavailable; removal motive unknown |
 | 12 preview/export failures | #3323, #3290, #3033, #3007, #2609 | blocked corrective work; diagnostic-ready | audit `task_1c6582ccdeae` | `codex-audit-rendering-12-19` | `7a98f6662` → no source change | renderer ownership; share observation harness with 18 | zero drift; staged-preview/error-boundary baselines remain; reports cross persistence/font/PDF/viewer/deployment boundaries | audit focused web/PDF suites, affected typechecks, boundaries, build passed | — | isolate PT Sans, browser/config, and template-selection boundaries; no shared fix | exact JSON/output/browser/config/current reproduction missing |
 | 13 font/glyph/spacing | #3249, #3159, #3147, #3093, #3089, #2988 | blocked corrective work; diagnostic-ready | audit `task_1c6582ccdeae` | `codex-audit-rendering-12-19` | `7a98f6662` → no source change | serialize font sources with 14/27 | merged metrics/cache/Unicode fixes present and passing; residuals require per-font/per-symptom fixtures | audit focused PDF/font suites, affected typechecks, boundaries, build passed | — | retain regressions; create residual unit only from exact failing font fixture | missing Ropa Sans/source strings/font hashes/before-after artifacts |
@@ -97,7 +97,8 @@ state changes are outside scope.
 | Plan 02 independent review round 5 | `task_a2b0562df7aa` / `ctx_bc5056c8978c` | same Plan 02 worktree | complete; no findings; pushed; worker released | exact head `4125074f9`; full diff, 54 independent assertions, fresh coordinator verification, PR #3460 |
 | Plan 02 autofix review | `task_796f15a35422` / `ctx_c581be24021a` | same Plan 02 worktree | complete; changes required; worker released | bot export cleanup safe; valid P2 Unicode Cf ID gap; three Codacy suggestions rejected/already satisfied with evidence |
 | Plan 02 hosted review fix | `task_1d56264e5f15` / `ctx_2a1a0a6af73e` | same Plan 02 worktree | complete; worker released | commit `325d1fcd1`; reject and document Unicode format-character IDs, add all-field regressions, preserve strict comparator contract |
-| Plan 02 hosted fix rereview | `task_51b92554b36b` / `ctx_08bc7a78dd61` | same Plan 02 worktree | reviewing | full diff and all four hosted dispositions at exact local head `325d1fcd1`; no GitHub mutation |
+| Plan 02 hosted fix rereview | `task_51b92554b36b` / `ctx_08bc7a78dd61` | same Plan 02 worktree | complete; no findings; worker released | full diff, all four hosted dispositions, 1,410 Unicode combinations, and mutation probes approved exact local head `325d1fcd1` |
+| Plan 02 hosted fix publication | coordinator | same Plan 02 worktree | pushed; checks rerunning | exact head `325d1fcd1`; four evidence replies posted and all four prior threads resolved; monitor for new feedback |
 | Plan 09 re-review | `task_1bd82b008a77` / `ctx_ca2a0176b52f` | same Plan 09 worktree | complete; no findings; worker released | full diff and both factual corrections verified before PR #3458 |
 | Plan 09 hosted review follow-up | `task_a44e374822b4` / `ctx_89e6769df19d` | same Plan 09 worktree | complete; changes required; worker released | selected revision prints correctly but no importable file is created |
 | Plan 09 hosted review fix round 2 | `task_8605c30ca032` / `ctx_2e0aa7be1312` | same Plan 09 worktree | complete; worker released | commit `9dd218ba1`; non-destructive recovered-file command plus synthetic proof |
@@ -120,6 +121,7 @@ state changes are outside scope.
 | Plan 16 independent review | `task_e52d01cff964` / `ctx_63c00e7abb56` | same Plan 16 worktree | complete; changes required; worker released | P1 unsupported descendant markup can normalize destructively; P2 conversion is still HTML and E2E does not prove unrelated save persistence; orchestration report accepted by brief |
 | Plan 16 review fix | `task_7b7368639ff8` / `ctx_ba9ed045764f` | same Plan 16 worktree | implementing | fail-closed unsupported grammar, explicit confirmed plain-text conversion, and persisted unrelated-edit E2E proof via TDD |
 | Plan 20A implementation | `task_4237c974827a` / `ctx_00770ded7b0d` | `codex/issue-3378-hidden-section-recovery` | implementing | hidden-section recovery unit from current `origin/main`; test, commit, and report without publication |
+| Plan 10 implementation | `task_fd191afc86ba` / `ctx_5100e7419c11` | `codex/issue-2836-retired-link-notices` | implementing | prospective 90-day owner-only retired-link attempt notices with migration, privacy limits, and E2E |
 
 ## Existing PR and residual accounting