Record orthogonal review pass 6 in the epic tracker

planning/epic-22-implementation.md

@@ -1016,6 +1016,14 @@ Four reviewers (editor, lifecycle/data integrity, Markdown/export, security/perf
 
 **Still queued (P3):** zero-width regex matches can split a CRLF in Replace All; pasted text is not adapted to a CRLF document's ending; `*it*` at line start produces `*it**`; self-contained HTML export keeps remote fetches inside diagram HTML; diagram fences nested in a quote/list hand their container prefixes to the renderer; the preview scheme handler reads whole subresources on the main actor; Math preview preprocessing is not memoised across caret moves; preview base URL is not refreshed by an unedited Save As; the Commands menu discovers filters from disk inside `body`.
 
+### Post-gate orthogonal review (pass 6, 2026-10-04)
+
+Four reviewers re-audited master after pass 5 (fuzzing their areas: ~3.5M editor inputs, ~250k export pipelines, 1.5M sanitizer inputs, 700k YAML inputs, 4,000-document lifecycle model runs). No P0. The recent fixes held up under fuzzing; the findings were one P1, a set of P2s in code older than this session, and P3 edge cases.
+
+**Fixed:** YAML front matter within the alias *count* budget still expanded ~256x (a ~20 KB file cost 3.5 s and 324 MB per parse) — the expanded size is now budgeted (#340, P1); a corrupt `recovery-fences.json` stopped every file open and new document until deleted by hand — now quarantined (#341); Shift-Tab could leave a selection end between a CR and its LF and typing there ate the CR (#342); Return at the end of a non-last list item inserted a bare blank line instead of a bullet, reversing a pinned test that described the bug (#343); math delimiters and export sentinels were matched per `Character`, so a `$` or sentinel glued to a ZWNJ/ZWJ/VS16/combining scalar (Persian text) mispaired and swallowed prose — the scanner is now UTF-16 with a differential test against the old one (#344); the sidebar drag token expired after 30 s and was consumed by a failed drop, and its UTI was undeclared (#345); the preview reload budget no longer resets on `didFinish` (#346); huge documents and huge paragraphs are sized by estimate instead of re-measured after every edit pause (#347); transaction ties at one offset are ordered deterministically (#348); multi-caret Join Lines with a caret on the last line (#349); ⌘Q before the launch restore no longer publishes an empty session (#350); a leading U+FFFE in BOM-less UTF-16 is refused (#351); Replace in Folder keeps Open Recent entries valid (#352); block-quote `>` markers are stripped from multi-line display math in Export and Preview (#353); a child block's line range is clamped to its parent (#354).
+
+**Still queued (P3):** inline math inside image alt text vanishes without a diagnostic; the leaked-sentinel retry is not re-checked (only reachable with overlapping contributions); multi-selection transforms are O(selections × lines); a clean document that sees a transient read failure is forced `.dirty` and later reconciles as a spurious conflict; `_`/`*` auto-pairing after a word at end of line leaves a stray delimiter; Open Recent bookmarks resolve with mounting/UI allowed and drop entries on an unmounted volume; the Dock icon does nothing when every window is minimized (unverified); `ParseEngine` stack overflows at ~900k nested `>` (hostile only); front-matter `title` scalar coercion (`1.10` → `1.1`); `MathContribution` is O(spans × exclusions) on multi-MB inputs; self-contained export keeps remote fetches inside diagram HTML; a failed open re-reads the whole file on the main actor for encoding detection.
+
 ## 18. Definition of Done and residual risk
 
 Per `EPIC_STANDARD.md` §4, plus the epic issue's own acceptance criteria (both the original ~19-item list and the "Additional acceptance criteria" from the 2026-09-21 inherited-debt amendment) — not restated verbatim here to avoid drift between two copies; this document's binding completion gate is: **every checkbox in the epic issue is either checked with linked evidence, or explicitly, individually dispositioned (FIXED/PROVED/REJECTED-FOR-1.0) in `RELEASE_EVIDENCE.md`, before E22 is considered release-complete for the #115 gate.**