## FINDINGS — not PASS

### P1 — `transfer_preview` still exposes internal numeric IDs
- **Source:** `scripts/health/dashboard_v5/document_reconciliation.py:255`
  - Stores raw `document_id` inside `new_value_json`.
- **Exposure:** `scripts/health/dashboard_v5/read_api.py:3337-3348`
  - Deserializes and returns `old_value_json`/`new_value_json` without an allowlist.

**Concrete counterexample on the current tree:** after staging synthetic candidate `cand_111…`, the authenticated document-review API returned:

```text
public_document=api-document-2df83bdf927d0d6abdec7d11
transfer_preview.new={
  'date': '2026-06-10',
  'document_id': 1,
  'page': 1,
  ...
}
```

The new `/api/v1/lab-review` projection sanitizes its preview, but the existing document-review projection still reveals the underlying numeric document namespace.

### P1 — revision/digest binding remains optional and bypasses source-review enforcement
- `scripts/health/health_dashboard_server.py:1144-1163` treats `expected_candidate_revision` and `preview_revision` as optional.
- `scripts/health/health_dashboard_action_worker.py:429-461` also accepts candidate actions without them.
- `scripts/health/health_dashboard_action_worker.py:1881-1918` performs digest recomputation **and source original/page review enforcement only when** `expected_candidate_revision` is present.

**Concrete counterexample on a disposable synthetic DB:** I cleared both `original_reviewed_at` and page `reviewed_at`, then submitted a valid `candidate_decision/confirmed` payload with both binding fields omitted. Current code produced:

```text
candidate_status=confirmed
staging_status=reviewed_pending_preview
source_review=None
page_review=None
```

Thus a crafted authenticated, same-origin, CSRF-valid POST can bypass the recomputed-preview and source-review gates.

## Other requested checks

Closed on the reviewed paths:

- Per-tab URL parameter allowlist: `dashboard-v5-record.js:161-190`.
- Lab provenance label mapping: `lab_review.py:164-172,333-348`.
- Principal-authenticated session bootstrap and HttpOnly session cookie.
- Exact scheme/host/port Origin enforcement and one-time CSRF.
- HTTP server queues actions rather than writing the health DB directly.
- No migration added; no production data or runtime was accessed.

Verification:

- Focused Sprint 7C-E tests: **16 passed**.
- Python AST and JavaScript syntax checks passed.
- `git diff --check` passed.
- Review probes used temporary synthetic databases only.
- **Files modified/created by review:** none.