| Previous finding | Disposition | Evidence |
|---|---|---|
| **1. P1 — Encoded addresses and private links bypass validation** | **Not fully fixed** | Original entity and percent-encoding examples now fail validation. However, `[source](https://github.com/carlosframework/./platform)` still passes the rendered-page gate; the browser resolves it to the private platform repository. Neither [Go decoding](/home/paulca/amadan.net/carlos/platform-changelog/internal/changelog/build.go:616) nor the [website check](/home/paulca/github.com/carlosframework/website-changelog/hack/check-docs.mjs:142) normalizes URL paths. Likewise, `ops**@**example.org` renders a visible address and passes. **Remaining fix:** validate rendered text and parsed, normalized link destinations. |
| **2. P1 — Invalid notes form silently removes notes** | **Fixed** | [Go validation](/home/paulca/amadan.net/carlos/platform-changelog/internal/changelog/committed_test.go:53) requires a recognized form and matching payload. The [website gate](/home/paulca/github.com/carlosframework/website-changelog/hack/check-docs.mjs:134) now rejects the original v0.24.2 `"bullet"` mutation; confirmed with in-memory rendering. |
| **3. P2 — Every agent assigned to every person** | **Fixed** | [Tally](/home/paulca/amadan.net/carlos/platform-changelog/internal/changelog/credit.go:126) preserves identity pairings. Landing `da866a92` still counts 24 own commits, but its [generated credit](/home/paulca/amadan.net/carlos/platform-changelog/docs/site/changelog.json:1115) now correctly lists Paul with Claude and Tony alone, consistent with `9fe9ec28`. |

No new P1 or P2 findings. The remaining privacy failures belong to finding 1.

Reviewed platform `d10798d0` and website `973f407`. All 28 release ranges and 363 unique changes’ own-commit counts match Git. Existing website checks, vendored-data comparison, and in-memory rendering checks ran. Go tests could not start because the sandbox blocks their work directory; full `npm run check` requires writes. No files edited.

**accept with fixes**