2026-07-31 W8: SSOT capability pass

Superseded — 2026-07-31

The 1,563/1,563 German catalog parity recorded here was retracted 2026-08-19 and is superseded by the source-parity closure at 1,650 total entries / 1,648 real msgids (the changelog, 2026-08-19). Preserved as observed; the finding-level retractions below stand as written.

Authority and outcome

• ssot_archive: /home/loca/dev/wrdp
• runtime source: wp/wp-content/plugins/quizwizz/
• release boundary: WRDP is the QuizWizz SSOT archive and current evidence authority; releaseEligible: false remains live because named quality-gate, lock, CI, provenance, and signing inputs are absent here
• inventory: the open work ledger
• result: every Tier 1 item was repaired and browser-verified, or closed with a measured non-plugin disposition; A72 now has browser evidence for the inspector, canvas, live Builder, Player result behavior, server clamp, and cleanup. build/, vendor/, and provenance/ remained unedited

Grounded findings 1–11

1. build/quiz/index.js is a readable, hand-formatted 340-line IIFE over window.wp; index.asset.php lists dependencies and render.php is 11 readable lines. No sourcemap exists.
2. The host provides Node v22.16.0, npm 10.9.2, and Python 3.13.5; host PHP and Composer are absent.
3. The release control plane is absent from this SSOT archive: no Node or Composer manifests/locks, tools/, tests/, PHPUnit/PHPCS configuration, .github/, src/, node_modules/, or Git history. Repo .gitignore excludes wp/.
4. vendor/composer/ contains only autoload_classmap.php, autoload_files.php, and autoload_real.php; it has no installed.json or installed.php, so the installed dependency graph cannot be reconstructed.
5. provenance/opentdb.json and provenance/assets.json have no reviewer/date/scope/approved records; four license_compatibility_review values in assets.json remain null.
6. Source-side cache coverage is 34 enqueue/register calls: 33 call Plugin::asset_version() and the qwizz-player enqueue inherits the version from its registration. No bare-constant callsite remains.
7. No CDN or response cache exists in front of this bench. Compose contains db/WordPress/wpcli, nginx has no proxy_cache, and public static responses expose Last-Modified, ETag, Vary, and Accept-Ranges without Cache-Control or Expires.
8. Final German source parity is 1,563 active POT and PO entries with zero untranslated, fuzzy, obsolete, missing, PO-only, or formal-address defects. Only de exists; fr and es remain product decisions. The initial 1,489 count was superseded by W8 source strings, the A72 companion-control catalog closure, and catalog regeneration.

Retracted 2026-08-19. This measured catalog against catalog. Against installed source the shipped quizwizz.pot is missing 153 msgids and carries 76 obsolete ones (wp i18n make-pot → comm -23 / comm -13, 2026-08-19). Parity is open, not done. Closed 2026-08-19 — the catalog was regenerated to real source parity (POT 1644 msgids = PO 1644, missing 0 / obsolete 0); see tasklist 2.1.1.

2026-08-19 catalog closure and its tooling deviation

Parity was closed the same day: regenerated POT 1,644 msgids = PO 1,644, missing 0 / obsolete 0 (see tasklist 2.1.1). GNU gettext is absent both on the host and inside wordpress:cli, so the merge/prune/compile ran through wp i18n update-po / wp i18n make-mo / wp i18n make-json instead of msgmerge / msgattrib / msgfmt — an explicit, recorded deviation. A naive switch_to_locale('de_DE') spot check still prints English by design: the plugin serves its catalog through its own gettext filters keyed on qw_exposure_settings['iface_lang'] (includes/UiLanguage.php:18-21), so the passing check forces iface_lang=de and yields Nächste Frage.

9. Final live fixture readback found 89 subjects, 13 zero-question subjects including term 39 entertainment-japanese-anime-manga, quiz statuses publish=8, private=2, draft=5, player.auto_advance_ms=0, and page_on_front=2. The empty Library/Subjects and unavailable-player states required no invented fixture.
10. Gutenberg routes differ: A70 is core inserter geometry; A71 and A77 lacked chooser placeholder/help; A72 is implemented under the owner-approved full-experience Craft contract and browser-verified for inspector controls, canvas summary/token geometry, live Builder behavior, Player result behavior, server-policy clamping, and cleanup; A73 was a stable CSS alignment defect; the A77 toggle is stock WordPress ToggleControl geometry.
11. Craft preview styling used eight build colour literals while the preview is admin-only chrome. Library/Subjects previews render public markup through ServerSideRender, but Craft save returns null and published output is server-rendered, so only Craft belongs on the admin token roots.

Source changes

Area	Bench runtime change	Result
Block registration	includes/Plugin.php registers a pre-bundle companion filter script, injects it ahead of the generated editor bundle, supplies translated placeholder/help strings and Craft profile data, attaches a dedicated editor style with token dependencies, and registers quizwizz/craft with Shortcode::block_attributes() plus server rendering.	A71/A77 can be repaired without editing build/; WP 7 editor-iframe dependencies resolve; A72 receives source-defined block attributes and server render wiring.
Editor behavior	New assets/js/qwizz-block-editor-enhance.js.	Quiz and Library ComboboxControl fields have visible help and placeholder text while preserving the original attributes and controls; Craft is wrapped with a Profiles + Advanced inspector and compact canvas summary.
Editor styling	New assets/css/qwizz-block-editor.css; assets/css/qwizz-tokens.css adds the admin-only Craft preview root.	A73 aligns the wand with the first title line; Craft chrome follows wp-admin tokens; build literals are overridden without another colour literal.
Builder strings	includes/Frontend/Shortcode.php adds all 18 payload keys previously present only as English JS fallbacks.	Dynamic draft, pool-recovery, retry, choice-preservation, availability, and banner states follow the forced interface catalog.
Banner errors	assets/js/qwizz-builder.js separates bannerDimensionsFailed from bannerDecodeFailed.	Dimension and unreadable-image failures no longer share misleading copy.
Admin locale isolation	includes/Admin/DashboardPage.php maps quiz statuses through the QuizWizz domain and formats relative-time units through QuizWizz plural strings.	Forced interface language no longer leaks the WordPress admin locale into recent-quiz status or age text.
German catalogs	Regenerated languages/quizwizz.pot; reconciled quizwizz-de_DE.po; rebuilt quizwizz-de_DE.mo.	1,563/1,563 active parity; User is now Besucher; relative-time units and all Builder/editor companion controls are translated. Retracted 2026-08-19 — measured catalog vs catalog. Against installed source the shipped quizwizz.pot is missing 153 msgids and carries 76 obsolete (wp i18n make-pot, comm -23 / comm -13, 2026-08-19). Parity is open. Closed 2026-08-19 — the catalog was regenerated to real source parity (POT 1644 msgids = PO 1644, missing 0 / obsolete 0); see tasklist 2.1.1.

Gutenberg measurements

A71 and A77

• disposable editor route:
  • Quiz placeholder: Veröffentlichte Quizze suchen…
  • Quiz help: Tippe zum Suchen und wähle dann das Quiz aus, das dieser Block zeigt.
  • Library placeholder: Themen suchen…
  • Library help: Leer lassen, um alle Themen aufzulisten.
• both controls were reached by keyboard Tab order, assigned a value, saved, reloaded, and read back with the same block attribute
• the published render used the selected quiz/subject; the disposable content was removed
• A77 toggle disposition: its control remained the stock WordPress ToggleControl; no plugin CSS override was added

A72 browser-verified Craft contract

A72 is closed on the evidence captured in an authenticated disposable editor session at post 993 plus live Builder/Player observations. No profile persistence/reload claim is made here because that path was not exercised.

• source and inspector evidence: includes/Plugin.php:150-235 registered quizwizz/craft with Shortcode::block_attributes() plus server rendering, and assets/js/qwizz-block-editor-enhance.js:267-592 supplied the Craft inspector without editing build/; Gutenberg List View selected Builder; the Block sidebar exposed the Builder profile controls; the profile select value was Study with Study, Quick play, Game night, Assessment, and Custom; Advanced exposed Content, Generation, Presentation, Player, and Completion groups with 25 controls, including auto-advance, instant feedback, review, explanations, sound, final cue, score animation, and Retry/New/Print/Share.
• canvas and token evidence: the editor canvas summary showed Study/Any/Mixed/Site default; the Craft preview had no horizontal overflow; computed background was rgb(255, 255, 255), matching --qw-paper: #fff; the wand center at 238.03125 px sat inside the title text box (top 223.03125 px, bottom 248.21875 px); Craft preview is admin-only chrome because its save returns null, while Library/Subjects previews stay on public tokens through ServerSideRender, so the Craft-only token-root path is the verified ownership boundary.
• Builder/Player evidence: /?page_id=57 presented no premade/prebuilt path, kept Customize collapsed, and stayed category-first; selecting Science produced 10 questions match and enabled Edit & print/Play with no overflow; the Player result state had already been live-verified for manual progression, sound off, Retry as the primary action, New/Print/Share under More, and server-clamped action_new=false.
• wording observations: W8-07 keeps Builder as a subsystem/product term, including the Craft preview heading; W8-08 keeps Player in explanatory settings copy. Both are terminology decisions, not remaining A72 implementation defects.
• cleanup evidence: qw_exposure_settings restored to hash 55bd5df7b6371bf09c8afe2ddf0089026994079e130bda9b7adce3da4a015cb7; temporary page 953, temporary user 218 / qwizzw8admin, auto-drafts 941 and 943, disposable posts 983 and 993, and the quiz-983 attempt row were deleted and their absence was verified; attempt rows returned to the six-row baseline after timestamp 1785559416; quiz 110 answer-key exposure reset to qw_include_answers=0, experience include_answers=false.

A70

Block	Tile width	Tile height	Label lines	Row
Quiz	105.984 px	90 px	1	1
Builder	105.984 px	90 px	1	1
Library	105.984 px	90 px	1	1
Subjects	105.984 px	90 px	1	2

All four plugin titles are compact and the tiles are equal. WordPress core supplied a three-column inserter grid, leaving the fourth tile alone on row two. A70 closes as core-owned geometry, not a QuizWizz defect.

A73 and tokens

• computed heading alignment: flex-start
• computed wand offset: margin-top: 3px
• measured wand center fell inside the first title-line box rather than centering over the two-line title/subtitle group
• Craft preview background, border, text, active step, and button values resolved through --qw-*
• changing the admin colour scheme from Fresh to Modern changed the token-derived brand/button colour; the preview introduced no new colour literal and its shadow computed to none

W6 negative and boundary states

State	Route/method	Observed result	Disposition
Subjects empty	zero-question term 39 / temporary four-block page	settled German counts/empty presentation with zero horizontal overflow	Closed with existing data.
Library empty	Library filtered to entertainment-japanese-anime-manga	Keine veröffentlichten Quizze passen zu diesen Filtern.	Closed with existing data.
Unavailable embed	logged-out request for an existing private quiz	unavailable state, no content disclosure	Closed with existing data.
Player network failure	intercepted player REST request with forced HTTP 503	error and Retry appeared; restored route recovered	Closed; interception removed and attempts cleaned.
Builder pool failure	forced HTTP 503	Deine Auswahl bleibt erhalten. and Verfügbarkeit erneut prüfen; selections persisted	Closed.
Editor invalid save	intercepted editor save with HTTP 500	editor error/recovery surface appeared; retry succeeded after interception removal	Closed; disposable draft removed.
Reduced motion	temporary auto_advance_ms=1500 plus prefers-reduced-motion: reduce	no timed advance; manual Next remained	Closed; option restored byte-identically.
Banner type/decode/dimensions	invalid type, malformed PNG, 4097×1 PNG	three distinct German errors, including unreadable-image and 4096×4096/16-megapixel limits	Closed.

Changed-surface hard reload

Cache was disabled for these checks at 1600×1000 and 390×844:

Surface	Console errors	Horizontal overflow	Accessible icon-only controls
Block editor with Quiz, Craft, Library, Subjects	0	0 px	no unnamed control
admin.php?page=qw-settings	0	0 px	no unnamed control
admin.php?page=qw-dashboard	0	0 px	no unnamed control

Forced-German matrix

The plugin interface was temporarily forced to de; the exact option snapshot was restored afterwards.

• public, both viewports:
  • builder prepared, dynamic, redirect error, empty pool, retry, and banner states
  • player loading, ten-question completion, expanded ten-item review, retry/share states
  • signed-in account page
  • actual Library and Subjects block output on the temporary four-block page
• admin, both viewports:
  • Dashboard, Settings, quiz list/edit, question list, subject taxonomy, and four-block editor
• every measured route had 0 px horizontal overflow and no console error
• player review expanded to 10 items and showed Deine Antwort / Richtige Antwort; completion controls were German at desktop and mobile
• Dashboard status/age readback after the locale-isolation fix included Entwurf, Veröffentlicht, vor 8 Stunden, and vor 3 Tagen
• page 2 is the landing page and does not contain Library/Subjects blocks; page 953 was a temporary verified block fixture and was deleted
• network logs across the admin matrix contained zero separate quizwizz-de_DE-*.json requests. WordPress resolves script translations server-side/inline, and the Builder reads its PHP-localized payload rather than wp.i18n; the expected separate-catalog-fetch assertion was therefore an invalid transport assumption, not a localization failure
• direct compiled-MO readback returned Veröffentlicht, Entwurf, Besucher, 3 Tagen, and 3 Monaten
• targeted A72 language-name recheck: in a cache-disabled authenticated editor with QuizWizz forced to de, disposable Craft posts 1027 and final post-install recheck 1037 selected the Lernen profile; the SPRACHE control displayed Deutsch and its options rendered Website-Standard, Englisch, and Deutsch; companion profile options rendered Lernen, Schnell spielen, Spielabend, Bewertung, and Benutzerdefiniert

W8 findings and ownership

id	Finding	Owner	Disposition
W8-01	18 Builder fallback keys were absent from builder_strings().	Bench runtime source	Fixed in Shortcode.php; static JS/payload key diff is empty.
W8-02	Banner decode and dimension failures reused one generic message.	Bench runtime source	Fixed with bannerDecodeFailed and bannerDimensionsFailed.
W8-03	Quiz/Library and A72 Builder companion inspector strings were initially untranslated.	German catalog	Fixed; final parity is 1,563/1,563. Retracted 2026-08-19 — measured catalog vs catalog. Against installed source the shipped quizwizz.pot is missing 153 msgids and carries 76 obsolete (wp i18n make-pot, comm -23 / comm -13, 2026-08-19). Parity is open. Closed 2026-08-19 — the catalog was regenerated to real source parity (POT 1644 msgids = PO 1644, missing 0 / obsolete 0); see tasklist 2.1.1.
W8-04	Dashboard recent-quiz statuses came from WordPress-core labels and ignored forced interface language.	Bench runtime source	Fixed with QuizWizz-domain status mapping.
W8-05	human_time_diff() exposed WordPress-locale English units inside German QuizWizz copy.	Bench runtime source/catalog	Fixed with domain-scoped plural units; German dative plurals verified from the MO.
W8-06	Settings visitor-control label rendered User.	German catalog	Fixed to Besucher.
W8-07	Builder remains visible as a subsystem/product term, including the Craft preview heading.	Product terminology	Deliberately retained; changing the product term needs a localization naming decision, not a runtime repair.
W8-08	Player remains inside explanatory settings copy.	Product terminology	Deliberately retained alongside the established Builder term; decision-gated.
W8-09	English (EN) remains in the interface-language selector.	Language naming	Intentional endonym/code label, not untranslated German UI.
W8-10	Multiple Choice remains in German question-type copy.	Product terminology	Intentional standardized German loan term; replacing it would require terminology approval.
W8-11	The planned page-2 Library/Subjects route had drifted; page 2 is the authored landing page.	Site content/configuration	Plugin behavior was proved on temporary page 953, then the page was deleted. No plugin defect.
W8-12	No standalone German JSON catalog request appeared in the browser network log.	WordPress translation transport	Closed as an invalid evidence assumption: inline/server resolution plus rendered text and compiled-MO readback prove the active catalog path.

WordPress-core English admin chrome, authored quiz/question text, taxonomy names, post titles such as Auto Draft, and brand/acronym text were classified outside plugin translation ownership.

Public warm-cache proof

Two public assets were warmed with cache enabled, copied byte-identically, and reinstalled only to advance mtime.

Asset	SHA-256	Before ?ver / transfer	After ?ver / transfer	Encoded body
assets/css/qwizz-builder.css	9b151c888f32c2d94f9318824b7cc5f59bcab14f8f3fa870dd182c4a1c5feb8e	1.10.0.1785424096 / 0 B	1.10.0.1785588845 / 7,625 B	7,325 B
assets/js/qwizz-player.js	ef328517256cc87bbb19f79ee0d81d651129aa1eff710186d9732d108c428ac4	1.10.0.1785424212 / 0 B	1.10.0.1785588845 / 8,253 B	7,953 B

Both live files retained byte identity and advanced from their old mtimes to 1785588845. Their 200 OK responses supplied Last-Modified: Sat, 01 Aug 2026 12:54:05 GMT, ETag, Vary: Accept-Encoding, and Accept-Ranges: bytes, with no Cache-Control or Expires. The browser therefore revalidates by ETag; the changed mtime-derived query version is the deterministic invalidation boundary.

Catalog and runtime verification

• reviewer remediation: with site show_question_count=1 and JavaScript disabled, the visible Study/default fallback on page 57 submitted show_question_count=1; the setting was restored to 0
• reviewer cleanup: qw_exposure_settings.iface_lang=auto, temporary posts 1027 and 1037 absent, and presentation.show_question_count=0
• regenerated catalog provenance includes current language-name occurrences at includes/Plugin.php:358-361,452-455; no stale Plugin.php:327-328 occurrence remains
• final PO/POT: 1,563 active entries each; fuzzy 0; untranslated 0; obsolete 0; POT-missing 0; PO-only 0

Retracted 2026-08-19. This measured catalog against catalog. Against installed source the shipped quizwizz.pot is missing 153 msgids and carries 76 obsolete ones (wp i18n make-pot → comm -23 / comm -13, 2026-08-19). Parity is open, not done. Closed 2026-08-19 — the catalog was regenerated to real source parity (POT 1644 msgids = PO 1644, missing 0 / obsolete 0); see tasklist 2.1.1.

• two independent MO compilations were byte-identical: SHA-256 177e17df40db8f8c99ce4c5eb5948d463265b4ec34bebaca0f6cb384f7b2f92d
• installed MO matched the reproducible output byte-for-byte
• PHP lint passed for includes/Plugin.php, includes/Frontend/Shortcode.php, and includes/Admin/DashboardPage.php
• node --check passed for assets/js/qwizz-builder.js and assets/js/qwizz-block-editor-enhance.js
• ./scripts/quizwizz-probe.sh --wave all: assertions=30 failures=0
• debug-log search after the final gates found no PHP fatal, warning, uncaught exception, or WordPress database error

Cleanup proof

• qw_exposure_settings restored hash: 55bd5df7b6371bf09c8afe2ddf0089026994079e130bda9b7adce3da4a015cb7
• temporary page 953: absent
• temporary user 218 / qwizzw8admin: absent
• temporary auto-drafts 941 and 943: absent; baseline auto-drafts exactly [757, 863, 898]
• attempts created after baseline timestamp 1785559416: 0; retained baseline rows: 6; maximum retained timestamp: 1785559416
• quiz 110 answer-key exposure restored: qw_include_answers=0, experience include_answers=false
• document-root transfer files .qw-exposure-w8.base64 and .qw110-review.base64: absent

Remaining Tier 2 — doable, needs one product decision first

id	item	route	evidence path:line	status
T2-01	French catalog	Decide that fr ships, then create and validate a complete catalog and its required runtime artifacts.	q5vault/audits/qwizz/can-do.md	Decision-gated — do not create a partial locale speculatively.
T2-02	Spanish catalog	Decide that es ships, then create and validate a complete catalog and its required runtime artifacts.	q5vault/audits/qwizz/can-do.md	Decision-gated — do not create a partial locale speculatively.
T2-03	PL-06 Quiz Wizzard	Authorize implementing the Quiz Wizzard assistant or explicitly keep it deferred, then define and execute its product contract.	q5vault/audits/qwizz/frontier.md:51-52	Decision-gated — current top product question.
T2-04	PL-07 external-data and maintenance runbook	Decide the remote-banner sources, abuse and budget caps, package-verification policy, and best-effort maintenance cadence before publishing the runbook.	q5vault/audits/qwizz/frontier.md:53-54	Decision-gated — policy inputs are unsettled.
T2-05	PL-16 retention-surface reconciliation and policy publication	Inventory which surfaces implement indefinite signed-in-owner retention, the 30-day anonymous artifact/link cap, the 24-hour guest-ephemeral default, and bearer-link semantics now; publish the settled reconciliation only with the PL-11 privacy, PL-17 operator/legal identity, and PL-18 best-effort service decisions.	q5vault/audits/qwizz/frontier.md:63-64,73-78	Documentation work is reachable; publication remains policy-gated.

Remaining Tier 3 — release inputs absent from this SSOT tree

• classification: release-input restoration backlog, not runtime implementation work
• prohibition: inventing digests, locks, approvals, dependency records, history, or provenance would be fabricated provenance and is prohibited
• terminology: SSOT means this archive at /home/loca/dev/wrdp; it is the authoritative tree, and named release inputs are missing from the archive itself

id	item	route	evidence path:line	status
T3-01	package.json	Restore the authoritative Node manifest to define scripts, package constraints, and the block/icon build entry points it unblocks.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/package.json absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing.
T3-02	package-lock.json	Restore the authoritative Node lock to unblock deterministic dependency installation and reproducible Node-backed builds.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/package-lock.json absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing; do not synthesize a lock from guesses.
T3-03	composer.json	Restore the authoritative Composer manifest to unblock declared PHP dependency constraints, autoload intent, and package tooling.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/composer.json absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing.
T3-04	composer.lock	Restore the authoritative Composer lock to unblock deterministic PHP dependency reconstruction and review.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/composer.lock absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing; do not infer it from vendor/.
T3-05	tools/quality-gate.sh	Restore the gate driver to unblock the intended aggregate quality/release eligibility check.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/tools/quality-gate.sh absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing.
T3-06	tools/build-release.py	Restore the release builder to unblock production of the policy-defined install artifact.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/tools/build-release.py absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing.
T3-07	tools/build-source-archive.py	Restore the source-archive builder to unblock a reviewable source artifact assembled under explicit policy.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/tools/build-source-archive.py absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing.
T3-08	tools/verify-release.sh	Restore the verifier to unblock repeatable structural and integrity checks against a built release.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/tools/verify-release.sh absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing.
T3-09	tools/sign-release.sh	Restore the signing procedure to unblock policy-controlled signature generation once the protected key and authorization exist.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/tools/sign-release.sh absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing.
T3-10	tools/compare-releases.py	Restore the comparator to unblock reproducibility/drift comparison between independently built release artifacts.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/tools/compare-releases.py absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing.
T3-11	tools/scope-dependencies.php	Restore the dependency-scoping tool to unblock collision/scoping analysis and the intended transformed dependency build.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/tools/scope-dependencies.php absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing.
T3-12	tools/toolchain.json	Restore the authoritative toolchain pins to unblock reproducible selection of build tools and versions.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/tools/toolchain.json absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing; do not invent pins.
T3-13	tools/dependency-policy.json	Restore the dependency policy to unblock enforceable allow/deny and review rules for shipped dependencies.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/tools/dependency-policy.json absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing.
T3-14	tools/scoping-policy.json	Restore the scoping policy to unblock deterministic namespace/scoping decisions for dependencies.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/tools/scoping-policy.json absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing.
T3-15	tools/release-policy.json	Restore the release policy to unblock machine-checkable release contents and authorization gates.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/tools/release-policy.json absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing.
T3-16	tools/source-archive-policy.json	Restore the source-archive policy to unblock machine-checkable inclusion/exclusion rules for the source artifact.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/tools/source-archive-policy.json absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing.
T3-17	tools/build-icons.mjs	Restore the icon builder to unblock reproducible regeneration of the shipped icon assets.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/tools/build-icons.mjs absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing.
T3-18	tools/lucide-icons.json	Restore the authoritative Lucide icon input manifest to unblock reviewable, reproducible icon selection.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/tools/lucide-icons.json absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing; do not infer a manifest from output.
T3-19	tests/	Restore the intended test sources and fixtures to unblock the absent runtime regression gate.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/tests/ absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing.
T3-20	phpunit.xml	Restore the PHPUnit configuration to unblock the intended PHP test bootstrap, suites, and execution contract.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/phpunit.xml* absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing.
T3-21	phpcs.xml	Restore the PHPCS ruleset to unblock the intended coding-standard gate and exclusions.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/phpcs.xml* absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing.
T3-22	.github/ workflow	Restore the authoritative CI workflow to unblock automated execution of the restored build, test, and release gates.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/.github/ absent; q5vault/audits/qwizz/can-do.md	Blocked — named SSOT artifact missing.
T3-23	src/	Restore the uncompiled block source to unblock maintainable and reproducible Gutenberg rebuilds, including A71/A73/A77 without relying on the sanctioned companion override.	/home/loca/dev/wrdp/wp/wp-content/plugins/quizwizz/src/ absent; q5vault/audits/qwizz/can-do.md; wp/wp-content/plugins/quizwizz/build/quiz/index.js:1-9,43-337,339	Blocked — named SSOT artifact missing; readable build/ is not a source/toolchain substitute.
T3-24	vendor/composer/installed.json	Restore the Composer installation record to unblock reconstruction and audit of the installed dependency graph.	q5vault/audits/qwizz/can-do.md	Blocked — only the three named Composer autoload files exist; installed.json is missing; never hand-edit vendor/.
T3-25	Git history and immutable commit	Restore authentic history and identify an immutable commit to unblock source-lineage, change-review, and commit-bound release provenance.	q5vault/audits/qwizz/can-do.md	Blocked — .git and immutable commit evidence are missing; do not fabricate history or a commit ID.
T3-26	provenance/* approval objects	Restore authentic reviewer/date/scope/approved records to unblock documented license/source approval and release authorization.	wp/wp-content/plugins/quizwizz/provenance/assets.json:12,29,42,63; q5vault/audits/qwizz/can-do.md	Blocked — approval keys are absent from both provenance objects and four license_compatibility_review values are null; never hand-edit provenance.
T3-27	Protected signing key	Restore an authorized protected key through the release policy’s security boundary to unblock artifact signing after all prior gates pass.	q5vault/audits/qwizz/can-do.md	Blocked — named protected artifact missing; no key or signature may be invented.

Remaining Tier 4 — needs infrastructure this bench does not have

id	item	route	evidence path:line	status
T4-01	PL-12 WAF/bot controls and access-log retention	Provide an edge abuse-control component, define bot/WAF policy, and establish proxy access-log retention and review.	q5vault/audits/qwizz/frontier.md:65-66; q5vault/audits/qwizz/can-do.md	Infrastructure-gated — current ingress has no such control plane.
T4-02	PL-13 off-host backups	Provide and operate a backup target outside this host, with recoverability evidence.	q5vault/audits/qwizz/frontier.md:67-68	Infrastructure-gated — current posture is on-host only.
T4-03	PL-14 image patch cadence and rollback	Establish patch cadence for moving wordpress:latest and mariadb:11.4 images plus a documented rollback path for a bad image.	q5vault/audits/qwizz/frontier.md:69-70; q5vault/audits/qwizz/can-do.md	Infrastructure/operations-gated.
T4-04	PL-15 health alert channel	Connect the existing journalled health failures to an operated notification channel.	q5vault/audits/qwizz/frontier.md:71-72	Infrastructure/operations-gated — the probe currently notifies nobody.
T4-05	CDN/edge response-cache behaviour	Keep closed as not applicable: compose contains only db/WordPress/wpcli; nginx proxies without proxy_cache; live public CSS/JS returned Last-Modified, ETag, Vary, Accept-Ranges and no Cache-Control or Expires. Reopen only if a CDN or response-cache tier is introduced.	q5vault/audits/qwizz/can-do.md; q5vault/audits/qwizz/masterplan.md:126	Closed — no component exists to measure.