one fixed, two partial, eleven still open

The useful property of a ranked defect inventory is that it can be re-read. The harder discipline is reading it again and writing down how little has changed, in the same order, with the same numbering, so the gap between what was claimed and what landed cannot be blurred by a fresh summary.

That is what the follow-up commit did. It walked every finding back against the current branch and dispositioned each one: one genuinely fixed, two partial, eleven untouched, none quietly retired as stale. Partial got a precise definition rather than a reassuring one — the in-tree copy of a leaked credential was gone while the history still carried it and the scrubbing plan remained paper, the scanning mechanism had landed while the dependency updates had not. Work that merely touched the same area was separated from the findings themselves: an idempotency floor in the schema with no application guard yet, a business audit trail, a retention purge, a security-header template that shipped switched off, a consumer data-subject flow whose authorization was derived from the session rather than from the request.

Eleven open defects is not a good number. Presenting it as a number is the point. A team that reports its own backlog at the resolution of individual findings, and then tracks them across waves without relabelling partial work as done, is a team whose next report can be believed. The alternative — a paragraph saying hardening is complete — costs nothing to write and tells the reader nothing at all.

What it proves: the honesty of the reporting loop is itself an engineering artifact, and this one was built before the fixes were.