[DoRmAmMu1997]

An extraction proposal could outlive a human correction, and queue order could let older filing evidence supersede the current source. This binds proposals and manual drafts to an explicit manual revision and source identity, then checks that authority again under the issue lock before committing. Unknown legacy baselines and stale proposals require fresh review; neither confidence nor an approval click bypasses later human edits.

Automatic approval selects at most one current candidate per issue: the latest unambiguous dated RHP, otherwise the latest dated DRHP. Unknown/tied chronology, conflicting current terms and competing same-date verified cap claims require review. A failed or unavailable current candidate never falls back to an older filing. Source/date/cache writers share the lock, while PDF verification stays outside transactions.

Manual forms retain their loaded revision, clear source-bound fields on source changes, and expose explicit reload/copy actions. Copying values clears citations and requires verification against the newly selected PDF. Stale drafts remain inspectable with Save disabled. Reload discards that draft and clears its warning. Immutable history, receipt checks, proposal CAS and atomic rollback remain intact.

Dependency: stacks on #155 (codex/scanner-database-verification), which stacks on #150. Migration 20260927ipo014 follows 20260921ipo013; the schema and corresponding ORM change ship together. Historical proposals are backfilled with an unknown baseline, never silently trusted or rewritten.

Validation on 5baf0ef, including current main 9ded279 and the database verification branch:

• Python 3.12: 2,443 passed, 19 skipped; 90.83% coverage including app.py, across twelve commit-locked groups. Pre-commit validation, compileall, Ruff, full mypy, Bandit, pinned dependency audit and diff checks passed.
• Python 3.13 and 3.14: 142 focused cases passed and 12 PostgreSQL cases skipped on each, covering approval, manual edits, models, migration upgrades and real Streamlit AppTest transitions. Full-suite skips comprise 17 PostgreSQL cases requiring the hosted disposable server and two platform/optional cases.
• Added dedicated PostgreSQL authority checks: the same two-proposal, stale/unknown-baseline, human-save-during-verification and pre-lock source-mutation scenarios run on both databases. Three PostgreSQL-only tests hold a real approval lock and require the server's lock-unavailable SQLSTATE for competing date/cache/insert writes. Independent review of this follow-up found no actionable issue; actual hosted execution remains required and is not inferred from local skips.
• Independent correctness/security review covered all 24 changed paths. Its competing-cap finding was reproduced, fixed and independently reverified; no outstanding finding remains in that review's scope. Detailed Google-style contracts, Beginner notes and safety/concurrency comments were reviewed explicitly.
• Actual browser checks use the production renderer with synthetic repository facades: source switching, retained stale drafts, disabled stale saves, explicit reload and copied values were exercised. The final Streamlit 1.65 recheck confirmed reload clears both values and warning and makes no save call. Providers and application databases were not contacted.

Hosted run 39584117954 passed 2,460 tests with two platform skips on each supported Python, including all PostgreSQL approval-race cases, and passed Docker/Compose smoke. The quality jobs subsequently failed only the dependency audit, which now reports eight advisories in Pillow 12.3.0 with 13.0.0 as the listed fix. The PostgreSQL tests did execute; their local skips are not used as proof.

The shared dependency gate remains unresolved: as verified October 21, latest stable Streamlit 1.66.0 requires Pillow below 13. Its official Pillow 13 compatibility change has merged upstream but is not yet in a stable release. No advisory suppression, conflicting install or development-framework substitution has been applied. This package does not complete the broader modernization or final integrated security review. No merge or production deployment is included.

Co-authored-by: Codex codex@openai.com