# Pre-publication review disposition

Review basis: private snapshot `7994b6e`, reviewed 27 August 2026. Findings
were rechecked against the working branch before changes were made. This is an
engineering disposition, not an independent legal opinion or a guarantee that
the application has no defects.

## Accepted and implemented

- **T0.1 Option A:** purchase activation now issues a perpetual,
  machine-bound entitlement (`expires_unix=0`). Clean export does not depend on
  periodic service renewal. Refund, disabled-key and fraud controls prevent
  future activation, transfer and support-assisted reset; an entitlement
  already issued to a computer cannot be remotely revoked.
- **T1.1:** the shipped MinGW/UCRT64 build enables stack protection, supported
  control-flow protection, `_FORTIFY_SOURCE=2` for optimized non-sanitizer
  builds, ASLR, DEP/NX, high-entropy VA and a relocation section. The produced
  PE images are inspected for those flags.
- **T1.2:** Evaluation `--preview-image` and `--preview-image-pts` still captures
  receive the visible Evaluation mark before the file is written. Failure to
  apply the mark fails the capture closed. In-app shared-memory preview remains
  unmarked. The 320-pixel thumbnail-strip route remains an internal UI surface
  and is deliberately not degraded.
- **T1.3:** all website and image responses receive HSTS, MIME sniffing,
  framing, referrer and camera/microphone/geolocation headers. HSTS preload is
  deliberately omitted until every subdomain is independently ready for the
  browser preload commitment. CSP remains a separately tested follow-up.
- **T3.2, T3.4-T3.8:** activation redirects are no-follow; metadata and
  worker/CLI numeric input use checked parsing; S337M odd-byte payloads fail
  safely; persisted UI values are clamped or allow-listed; and the launch
  version is consistently `1.0.0`.
- The supplied review's separate still-capture, network, compiler-hardening,
  rate-limit, IPC, journal, retail-override and worker-failure concerns were
  checked against the current source. Existing fail-closed controls were kept
  where already correct rather than rewritten.

## Not applicable after the perpetual decision

- **T2.1 clock high-water mark:** a perpetual token has no expiry that can be
  extended by rolling the clock back. Adding DPAPI time-floor state would add a
  new paid-user lockout mode without preserving a meaningful expiry control.
- Periodic refresh timers, expiry-boundary tests and a service-continuity unlock
  promise are not part of Option A. Stored purchase credentials remain solely
  for explicit deactivation, transfer and support-assisted reactivation.

## Rejected or deferred with reasons

- **T2.2 single-instance guard:** SmartCut64 permits independent editing jobs in
  parallel. Removing that workflow immediately before release would be a
  product regression. Shared preference and queue writes remain per-user and
  ordinary last-writer-wins; project journals are tied to their project paths.
  A future optional "open files in existing instance" mode needs a dedicated
  design and collision tests.
- **T2.3 synchronous wait re-entrancy:** the reviewed waits already use
  window-modal progress dialogs or action guards on the current branch. No
  second implementation was added.
- **T3.1 pipe fail-closed:** the current pipe creation path already refuses to
  serve if its restrictive security descriptor cannot be created. The pipe is
  first-instance, randomly named, same-user restricted and exposes no delivery
  operation.
- **T3.3 replace project parsing with `src/core/json.hpp`:** the named header is
  a small flat-value helper, not the full UTF-8 JSON parser described by the
  review. GUI project files already use Qt's `QJsonDocument`. Replacing the
  worker's established project protocol requires a bounded schema/parser
  migration and corpus gate; it is deferred rather than presenting a partial
  substring substitution as a security fix.
- **Tier 4 decomposition/whole-tree formatting:** both are worthwhile
  maintainability projects, but their large mechanical diff would increase
  pre-release regression and audit risk. They should be isolated after 1.0.0.

## External launch gates

Engineering tests cannot approve codec-patent exposure, trademark clearance,
GPL/LGPL and customer-term compliance, or mandatory consumer-law wording.
Those independent reviews remain tracked in `docs/EXTERNAL_RELEASE_BLOCKERS.md`
and must not be represented as complete without retained professional evidence.
