Fix four findings from a review of the released v3.12.0, and release v3.12.1

[amrali-eg]

Two defects from an independent review of the released v3.12.0, one refactor taken because
the inconsistency it describes was the finding, one smoke phase that had been blocked by a
defect in the test driver, and a backlog rebuilt into something a script can check.

What EC did wrong

An unwritable output destination was discovered only after conversion. The journal and
report are written once scanning has returned, so a destination that could never be
written was found after the files had been rewritten — a user who asked for a journal
ended with changed files and no record of the change. Measured on all four shapes of the
mistake (-Journal or -Report, under a missing directory or onto an existing one); all
four converted first. Now checked before either mode dispatches.

The exit code is deliberately unchanged at 3. docs/CLI.md calls a report failure a
processing failure and a test pins it; finding the failure earlier must change when it
is reported, not what it is called. The first attempt put the check among the usage
validators, which made it exit 1 and broke that contract — the existing test caught it.

A plan action no build ever wrote was reported as a conversion. System.Text.Json
accepts a number for any enum, so a damaged plan could carry "Action": 99 and load
without complaint, then reach ToRowResult whose fallback arm was Converted. Measured
before the fix: -Apply exited 0, printed "1 selected, 1 converted, 0 failed", and
wrote a journal recording Status=Converted — with the source hash unchanged. The journal
asserted work that never happened.

EC wrote its own artifacts less carefully than everyone else's. It installs a
converted file through a temporary file and a replacement, and writes its recovery sidecar
the same way with a read-back check — while its plan, journal, report and settings each
truncated their destination and wrote into it. The mechanism already existed and shipped;
four of its own artifacts did not use it. A truncated plan destroys the reviewed plan a
user was about to apply. Closes EC-16.

What the records got wrong

CX-07 recorded a fix that was never made, and should not be: docs/CLI.md states the
opposite behaviour deliberately. CSV formula injection is withdrawn — every path is
resolved through Path.GetFullPath, so the File column always begins with a drive
letter or UNC prefix.

The whole backlog was re-derived from source, not carried forward: 61 unique findings —
44 fixed, 13 open, 1 not reproduced, 1 withdrawn, 1 not a defect, 1 design decision. It is
organised by status rather than discovery date, every finding has a stable id including
the thirty-three that had none, and docs/Test-DefectBacklog.ps1 now recomputes every
figure in the header and checks ids, statuses, scores and links.

That recheck found a third drift in the hand-maintained count — one introduced while
correcting the second — which is why the count is no longer hand-maintained.

What was untested and now is not

The source-choice refusal was this project's only fix covered by a unit test instead of a
smoke phase, because SelectCombo timed out in that dialog state while the identical call
in another phase succeeded. Two failures in sequence: the item this phase needs sits below
the visible part of the dropdown and UI Automation reports it offscreen, so the exact-item
search rejected it, and the keyboard fallback then fronted the main window while a modal
review was open.

The suite is now ten phases. Phase J requires the review to stay open, name the file
outside its directory, and leave every byte unchanged. No production code changed to make
it drivable — the driver was fixed, EC was not reshaped, which is the trade this suite
exists to avoid making.

Compatibility

Semantics stay at 6, plan schema 5, journal schema 4. No detection or
conversion policy change. One exit code moves:

Situation	Before	After
-Apply on a plan carrying an undefined action	Converted, 0	refused, 1

That 0 was a false success. A valid plan written by v3.12.0 applies exactly as before.

Verification

• 742 tests pass, 0 skipped (was 727); Release build 0 warnings
• Every code fix mutation-checked: change reverted, intended tests required to fail, file
  restored byte-identical and confirmed by SHA-256 — including phase J, checked by
  reverting the guard it covers
• Both defects reproduced end to end before and after
• Report output compared byte-for-byte against v3.12.0, BOM included
• Flushing artifacts to disk measured over 2,000 files and a 402 KB report: 152–153 ms
  with, 153–154 ms without
• docs/Test-DefectBacklog.ps1 passes under Windows PowerShell and pwsh 7, and was itself
  checked by changing a header count and requiring it to fail
• No four-corpus audit was run. This release changes neither detection nor conversion
  policy, so the checklist does not require one — but the gap v3.12.0 recorded, a release
  that did change ConversionPolicy without one, is untouched by this and still stands.

Release notes · Defect ledger

🤖 Generated with Claude Code