[Audit] Track the 2026-10-08 solution quality audit and 43 findings

Start by reviewing the audit summary and linked findings, especially the four P1 issues and the first-use tutorial finding (#75); inspect the linked issue evidence and acceptance criteria for any specific change. The tracker itself requests no application-code change and spans 43 findings across many subsystems, so it is not a bounded implementation task. Done is defined by resolving the individual findings, not by editing this index.

Audit of main at 33775b35ce39b259cc6a4ea33db6216aba19d702 on 2026-10-08.

This tracker indexes 43 new issues: 4 P1, 38 P2 and 1 P3, covering security, reliability, maintainability, duplicated code, complexity, coverage, and the documentation/new-tool tutorial. Each linked issue includes evidence, commit-specific source links and acceptance criteria. No tracked application code was changed during the audit.

Fix first

• [P1] Correct macOS 64-bit termios ABI to prevent native memory corruption
• [P1] Validate directory relationships before overwrite moves delete data
• [P1] Define safe symlink handling for recursive directory copies
• [P1] Make the first copy-paste tutorial display a visible working dashboard

Validation and metrics

• .NET restore/build, format check, TypeScript/Vite and Release WASM publication succeed.
• 509 tests pass, zero failures/skips, but Cobertura reports only 38.37% line / 32.55% branch coverage across the seven instrumented assemblies. Razor coverage is 10.13%; StdinParser, Renderer, SystemFileSystemOperations and FakeShell are untested by the current suite.
• Normal clean build reports 671 warnings; missing/mismatched XML docs remain.
• 3 vulnerable npm build dependency packages / 5 advisories; NuGet scan reports no known vulnerable packages. Build-time advisory exposure is distinguished from demonstrated production exploitation.
• jscpd: 24 clones / 769 duplicated lines / 3.39% for source, samples and docs terminal (10-line/80-token thresholds; bin/obj excluded).
• Lizard: flex layout complexity 67; chart render methods 40–45. These are tool-specific indicators, not Sonar grades.
• Chromium desktop/mobile and axe AA checks reveal mobile overflow, contrast and keyboard accessibility defects. Basic WASM help works, arrow keys corrupt the command. Table preview draws a placeholder instead of mounting the demo. The published entry page also references a scoped stylesheet that returns 404.
• A fresh tutorial project using published Razor 0.1.1 builds but renders an empty frame; literal step 4 fails with two CS0102 errors. The site has no end-to-end packaging tutorial for a new tool.

New issues

| 43 | P1 | Security | Correct macOS 64-bit termios ABI to prevent native memory corruption |
| 44 | P1 | Reliability | Validate directory relationships before overwrite moves delete data |
| 45 | P1 | Security | Define safe symlink handling for recursive directory copies |
| 46 | P2 | Reliability | Respect filesystem case sensitivity in copy and move path comparisons |
| 47 | P2 | Security | Update vulnerable dependencies in the documentation build lockfile |
| 48 | P2 | Reliability | Parse terminal escape sequences across read boundaries and bound incomplete input |
| 49 | P2 | Reliability | Preserve modifiers in Unix CSI arrow and navigation key events |
| 50 | P2 | Reliability | Prevent surrogate corruption in input events and editing operations |
| 51 | P2 | Reliability | Render grapheme clusters and terminal cell widths consistently |
| 52 | P2 | Reliability | Emit ShowCursor when a Renderer cursor becomes visible |
| 53 | P2 | Reliability | Clear focus and release renderable ownership when nodes are removed or destroyed |
| 54 | P2 | Reliability | Validate dimensions and checked allocation products before creating or resizing buffers |
| 55 | P2 | Reliability | Parse layout dimensions using invariant culture |
| 56 | P2 | Reliability | Clip long words and non-wrapped text to the renderable bounds |
| 57 | P2 | Reliability | Intersect and restore clipping regions when rendering nested ScrollBox controls |
| 58 | P2 | Reliability | Detect CSV delimiters outside quoted fields and complete logical records |
| 59 | P2 | Reliability | Preserve a final quoted empty field when parsing CSV |
| 60 | P2 | Reliability | Unsubscribe Once listeners before invoking user callbacks |
| 61 | P2 | Reliability | Roll back plugin registry state when registration callbacks fail |
| 62 | P2 | Reliability | Balance persistent rope branches to avoid linear tree depth |
| 63 | P2 | Reliability | Validate renderer configuration before starting background threads |
| 64 | P2 | Reliability | Implement the documented Opacity parameter or clearly remove unsupported behavior |
| 65 | P2 | Reliability | Honor Textarea.WrapMode and keep long-line cursor content visible |
| 66 | P2 | Reliability | Expose render failures instead of silently swallowing every exception |
| 67 | P2 | Reliability | Make event dispatch safe across input, render and Razor lifecycle threads |
| 68 | P2 | Reliability | Dispose the actual DotNetObjectReference passed to the documentation terminal |
| 69 | P2 | Reliability | Handle terminal escape sequences without appending arrow keys to fake-shell commands |
| 70 | P2 | Documentation | Render documentation previews from the actual Razor components and demos |
| 71 | P2 | Documentation | Remove horizontal page overflow from the mobile documentation layouts |
| 72 | P2 | Documentation | Raise documentation text contrast to WCAG AA levels |
| 73 | P2 | Documentation | Make overflowed code and API regions accessible from the keyboard |
| 74 | P2 | Documentation | Distinguish inline documentation links without relying only on color |
| 75 | P1 | Documentation | Make the first copy-paste tutorial display a visible working dashboard |
| 76 | P2 | Documentation | Make tutorial step 4 an unambiguous replacement that compiles |
| 77 | P2 | Documentation | Provide an end-to-end guide for creating and packaging a new dotnet tool |
| 78 | P2 | Documentation | Replace placeholder XML comments and complete public API contracts |
| 79 | P2 | Test coverage | Add meaningful coverage and integration gates for untested production paths |
| 80 | P2 | Complexity | Decompose the flex-layout algorithm and test its decision matrix |
| 81 | P2 | Complexity | Separate chart data transformation, scaling and painting from complex RenderSelf methods |
| 82 | P2 | Maintainability | Share the chess engine between the standalone tool and Razor sample |
| 83 | P2 | Maintainability | Centralize shared glyph-width and chart drawing helpers to prevent divergent fixes |
| 84 | P2 | Security | Define safe plain-text handling of terminal control characters |
| 86 | P3 | Documentation | Resolve the missing scoped stylesheet referenced by the published WASM page |

Existing work to retain

• #24 SDK pinning.
• #29 complete public API assembly inventory.
• #32 frame-path allocations.
• #33 full-text materialization in EditBuffer (distinct from new rope balance defect).
• #34 lookup/regex optimization candidates, to benchmark.

Relevant open PRs: #40 grapheme rendering and #41 terminal lifecycle. Closed #38 claimed real previews; current main still uses synthetic drawing. Do not treat an open PR as a fix already present on main.

Scope and limits

The audit inventories/analyzes sources, samples, tests, static pages and the WASM app, with manual review concentrated on risk-sensitive contracts and executable reproductions. Native execution was Linux x64. Darwin ABI evidence comes from Apple's termios header; actual macOS/Windows terminal checks remain required. Automated browser/axe checks are not a complete assistive-technology review. Coverage is for the existing suite, excluding audit probes. No claim of zero remaining defects is made.

The local audit report preserves logs, coverage XML, C# probes, browser/axe results, screenshots and all issue payloads. Remediation should prioritize memory safety/data preservation, then the first-use tutorial, runtime regressions, meaningful tests and documentation accessibility.