From 36f64ed0ee1ea631b22737f62da07cde128f92c4 Mon Sep 17 00:00:00 2001
From: Ali Bahaloo <ali.bahaloo@telusinternational.com>
Date: Tue, 28 Jul 2026 23:09:30 -0700
Subject: [PATCH 1/7] docs: admit Cisco's advisory scope statements as a source
 (constitution 3.3.0)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

BRD-006 shows, beside each advisory in a reviewed bundle, Cisco's own
published "Vulnerable Products" and "Products Confirmed Not Vulnerable"
statements. Neither exists in the advisory API, so two constraints blocked
the feature:

- Networking admitted sec.cloudapps.cisco.com only for a bundle page "read
  solely to resolve a bundle to its advisory identifiers and its own
  identity". Per-advisory documents exceed "solely".
- Source of truth named only the openVuln API and ended "No scraped or
  cached-as-authoritative alternatives". A CSAF document is neither scraped
  nor cached, and is reached by following the pointer the API itself returns
  (csafUrl) rather than a URL the tool invents — but it was not named, and a
  governance document should not be satisfied on that technicality.

Both are amended narrowly. The new Advisory scope statements bullet is
bounded to the two statements, requires the API-supplied pointer, requires
the document to identify the advisory it was fetched for, forbids the
statements from informing any determination, and resolves disagreement with
the API in the API's favour. It adds a faithful-rendering obligation — no
summarising or paraphrasing, every alteration enumerated and tested — as the
mirror of Principle IV's ban on inventing an advisory fact.

Scope selectors is deliberately not relaxed; both bullets now state that
neither widens the other. Recorded explicitly: this reverses part of the
spec-007 decommission, under narrower terms (no on-disk retention, no
temporary folder, no AI processing).

Principle VI gains the capability in its public contract; the Tests gate
gains a per-normalisation obligation. Product version moves to 4.3.0 when
the feature lands.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .specify/memory/constitution.md      | 170 +++++++++++++--
 brds/006-affected-products-column.md | 299 +++++++++++++++++++++++++++
 2 files changed, 457 insertions(+), 12 deletions(-)
 create mode 100644 brds/006-affected-products-column.md

diff --git a/.specify/memory/constitution.md b/.specify/memory/constitution.md
index 20b1465..7576244 100644
--- a/.specify/memory/constitution.md
+++ b/.specify/memory/constitution.md
@@ -1,6 +1,106 @@
 <!--
 Sync Impact Report
 ==================
+Version change: 3.2.0 → 3.3.0
+Rationale: Enacted as a prerequisite of BRD-006 (affected-product scope in the bundle-scoped report),
+           which shows, beside each advisory in a reviewed bundle, Cisco's own published statements of
+           which products the advisory affects ("Vulnerable Products") and which it does not
+           ("Products Confirmed Not Vulnerable"). Neither statement exists in the advisory API: the
+           API returns an advisory's title, severity, score, CVEs, publication date, affected
+           platforms and fixing releases, but not its prose product scope. Cisco publishes that scope
+           in a per-advisory machine-readable document (CSAF) and — this is what makes the feature
+           admissible at all — returns a pointer to that document (`csafUrl`) in every advisory record
+           the tool already retrieves. Verified against live sources on 2026-07-28 across 29
+           advisories: the pointer was present in 100% of records, and both statements in 100% of
+           documents.
+
+           Two constraints blocked the feature. Networking admitted `sec.cloudapps.cisco.com` only for
+           "a published bundle page, read solely to resolve a bundle to its advisory identifiers and
+           its own identity"; retrieving per-advisory documents from that host exceeds "solely".
+           Source of truth named only the PSIRT openVuln API and ended "No scraped or
+           cached-as-authoritative alternatives" — and while a CSAF document is neither scraped nor
+           cached, and is reached by following the API's own pointer rather than a URL the tool
+           invents, it was not named, and a governance document should not be satisfied on that
+           technicality.
+
+           Both are amended, narrowly. The new Advisory scope statements bullet is bounded to the two
+           named statements, requires the document to be located by the API-supplied pointer rather
+           than a constructed URL, requires the document's own advisory identifier to match the
+           advisory it was fetched for, forbids the statements from informing any determination, and
+           resolves disagreement with the API in the API's favour. It carries one obligation that did
+           not previously need stating: content admitted as prose MUST be rendered faithfully — no
+           summarising, paraphrasing, translating, or generating. Principle IV already forbade
+           inventing an advisory fact; admitting a prose source makes the mirror rule necessary,
+           because silently editing a security advisory is the same harm reached from the other
+           direction.
+
+           The Scope selectors bullet is deliberately NOT relaxed. Its prohibition attaches to the
+           bundle page, which may still supply only membership and its own identity, and still may not
+           supply an affected product. The new permission attaches to a different resource reached a
+           different way, and both bullets now say so explicitly so they cannot be conflated.
+
+           This reverses part of a decommission, recorded here rather than discovered in review:
+           BRD-004 / spec 007 removed CSAF retrieval outright, and spec 007's plan cited "ERP pages
+           and CSAF JSON are no longer fetched" as its evidence of compliance with Source of truth.
+           Retrieval returns for a different purpose under narrower terms — no on-disk retention, no
+           temporary folder, and no AI processing, each of which was the actual objection in 2026-07.
+
+           Principle VI gains the capability in its public contract, because a second consumer that
+           reimplemented the retrieval or the display normalisation would attribute different words to
+           Cisco about the same advisory. The Tests gate gains a per-normalisation obligation, which
+           is what makes "faithfully" checkable rather than aspirational.
+
+           A new permission plus materially expanded guidance, with no principle removed or redefined
+           and no existing permission widened, so the bump is MINOR. The product version moves
+           separately to 4.3.0 when the feature lands.
+
+Modified principles:
+  - VI. Headless Shared Surface (the criterion defining the surface now also covers modules that
+    retrieve Cisco-published content a report attributes to Cisco; the public contract now also names
+    the retrieval of an advisory's published product-scope statements and their normalisation for
+    display)
+Added sections:
+  - Technology & Data Constraints → Advisory scope statements (new bullet, with its own rationale)
+Modified sections:
+  - Technology & Data Constraints → Source of truth (the closing prohibition now points at the two
+    narrow permissions that follow it, so it is not read as absolute against the code)
+  - Technology & Data Constraints → Scope selectors (states that its prohibition attaches to the
+    bundle page and is unchanged by the new bullet; no permission widened)
+  - Technology & Data Constraints → Networking (`sec.cloudapps.cisco.com` additionally admitted for a
+    per-advisory published advisory document; both requests remain unauthenticated and carry no
+    inventory-derived data; advisory-document retrieval must be time-bounded and non-fatal)
+  - Technology & Data Constraints → Inputs/outputs (the untrusted-text rule now states that unescaped
+    rendering deletes surrounding text rather than merely misformatting it, making it a correctness
+    rule and not only a safety one)
+  - Development Workflow & Quality Gates → Tests (a normalisation applied to Cisco-published prose
+    must have a test per normalisation, plus a test that no other alteration occurs)
+Removed sections: (none)
+
+Templates requiring updates:
+  - .specify/templates/plan-template.md ✅ aligned (Constitution Check resolves gates dynamically)
+  - .specify/templates/spec-template.md ✅ aligned (no constitution references)
+  - .specify/templates/tasks-template.md ✅ aligned (no constitution references)
+  - .specify/templates/checklist-template.md ✅ aligned (no constitution references)
+  - .claude/skills/speckit-*/SKILL.md ✅ aligned (reference the constitution generically)
+  - README.md ⚠️ pending — the shared-surface table's `erp.py` row reads "the only module that talks
+    to Cisco's Security Center", which the new retrieval makes inaccurate wherever it lands; MUST be
+    corrected in the pull request that adds the capability (Documentation gate)
+  - docs/index.html ⚠️ pending — same pull request, to the extent it describes the sources the tool
+    reads
+
+Follow-up TODOs: if the feature introduces a new module for advisory-document retrieval, Principle
+VI's module enumeration MUST be extended in the pull request that adds it — a PATCH amendment carried
+as a feature task rather than amendment debt, mirroring how 3.2.0 handled its README item.
+
+Previous version 3.2.0 (2026-07-28): enacted as a prerequisite of spec 008 (bundle-scoped impact
+reporting). Admitted `sec.cloudapps.cisco.com` for bundle resolution, added the Scope selectors
+bullet granting a bundle page the narrow right to supply membership and its own identity and nothing
+else, and extended Principle VI's shared surface from four modules to six (`erp`, `bundle`). MINOR.
+-->
+
+<!--
+Superseded Sync Impact Report (3.1.0 → 3.2.0), retained for history
+==================
 Version change: 3.1.0 → 3.2.0
 Rationale: Enacted as a prerequisite of spec 008 (bundle-scoped impact reporting), which scopes a
            run to a Cisco Event Response bundle and reports one row per advisory in it. Cisco
@@ -230,7 +330,8 @@ values means an observer of the tool's traffic learns what software is being ask
 nothing about who runs it or where.
 
 ### VI. Headless Shared Surface
-The modules that produce a verdict or determine the scope one is produced for — `assessment`,
+The modules that produce a verdict, determine the scope one is produced for, or retrieve
+Cisco-published content a report attributes to Cisco — `assessment`,
 `matching`, `psirt`, `inventory`, `erp`, and `bundle` — are this
 package's **shared surface** and MUST remain callable without a terminal. They MUST NOT print,
 prompt, consult the current working folder, write a file, or exit the process; the caller supplies
@@ -243,7 +344,8 @@ package MUST reuse the shared surface rather than reimplement any part of it. Th
 contract — `analyze`, `load_catalogues`, `families_in`, `describe_check`, the verdict vocabulary
 and reason kinds, the `psirt` client and its error types, `load_inventory`, the resolution of a
 published bundle to the advisories it contains, the derivation of an advisory's covered product
-families, and the shape of a device record — MUST NOT change incompatibly without a MAJOR product
+families, the retrieval of an advisory's published product-scope statements and their normalisation
+for display, and the shape of a device record — MUST NOT change incompatibly without a MAJOR product
 version bump. A shared-surface
 function MUST report a failure to *reach* Cisco as an error rather than as a set of undecided
 verdicts, so a caller can always tell "we could not ask" apart from "we asked and could not decide".
@@ -273,7 +375,9 @@ data-quality problem when the real cause was a rejected credential.
   Cisco's public Software Checker — for release- and platform-scoped advisory lookups and for the
   platform/release catalogues those lookups are validated against. Catalogues MUST be retrieved
   from Cisco rather than hardcoded, so newly published releases and platforms are picked up
-  without a tool release. No scraped or cached-as-authoritative alternatives.
+  without a tool release. No scraped or cached-as-authoritative alternatives, except as narrowly
+  granted by the two bullets that follow — each of which enumerates what it may supply and, more
+  importantly, what it may not.
 - Scope selectors: a published Cisco bundle page (an Event Response page announcing a bundled
   advisory publication) MAY be read for two things only — *which* advisories a bundle contains, and
   that bundle's own identity (its identifier, title, publication date and revision). It MUST NOT
@@ -281,27 +385,66 @@ data-quality problem when the real cause was a rejected credential.
   release, or publication date of an advisory. Every such fact MUST come from the advisory API even
   when the page also displays it, and a disagreement between the two is resolved in the API's favour
   without exception. A page that cannot be resolved to at least one advisory MUST be an error, never
-  an empty scope, because an empty result rendered as a report reads as an all-clear.
+  an empty scope, because an empty result rendered as a report reads as an all-clear. This
+  prohibition attaches to the bundle **page** and is unchanged by the Advisory scope statements
+  bullet below, which admits a different resource, reached a different way, for values the API does
+  not carry. Neither permission may be read as widening the other.
 
   Rationale: this is what keeps the preceding bullet's prohibition substantive rather than merely
   survived on a technicality. Cisco publishes no API equivalent of a bundle, so the page is the only
   way to learn a bundle's membership — but membership is a *selector*, not a finding. Granting
   exactly that and naming every field it may not supply prevents the page from becoming a second
   authority over facts the API already owns, which is the failure Principle IV forbids.
+- Advisory scope statements: Cisco's per-advisory published machine-readable advisory document (CSAF)
+  MAY be read for two values only — that advisory's `Vulnerable Products` statement and its
+  `Products Confirmed Not Vulnerable` statement — and solely to display them to a human reader. The
+  document MUST be located by following the pointer the advisory API returns for that advisory
+  (`csafUrl`), never a URL the tool constructs, and the tool MUST verify that the retrieved document
+  identifies the advisory it was fetched for before using any part of it. No other value from that
+  document may be used: not a title, severity, score, CVE identifier, publication date, fixing
+  release, affected platform, or product tree — every one of which the document also carries and the
+  API already owns. A disagreement between the document and the API is resolved in the API's favour
+  without exception. Neither statement may inform a verdict, a device count, a row's population, or
+  the derivation of an advisory's covered product families: it is context for a reader, never an
+  input to a determination. A statement that cannot be retrieved MUST be reported as unavailable and
+  MUST NOT be rendered in any form a reader could take to mean that no product is affected; a
+  retrieval failure MUST NOT change any verdict or prevent a report from being written.
+
+  Text admitted under this bullet MUST be rendered faithfully. The tool MUST NOT summarise,
+  paraphrase, translate, reorder, or generate any part of it, and every alteration it does make —
+  such as removing Cisco's inline link markup — MUST be one of a short, enumerated, individually
+  tested set declared in the feature's specification.
+
+  Rationale: the product scope is the one decision-relevant fact about an advisory that the API does
+  not return, so a reader must currently leave the report to find it. Admitting the document is safe
+  only because the API itself supplies the pointer to it — this is following Cisco's own reference,
+  not discovering a second source — and because the permission is bounded to two values the API does
+  not carry, leaving every field it does carry in the API's hands. The faithful-rendering rule is the
+  counterpart to Principle IV's prohibition on inventing an advisory fact: once prose is admitted,
+  quietly editing a security advisory becomes the available failure, and it is the same harm reached
+  from the other side. Requiring each permitted alteration to be enumerated and tested is what makes
+  "faithfully" a reviewable claim rather than an intention.
 - Inputs/outputs: the inventory is a user-provided `.xlsx` (sheet `FW_List`) located in the
   current working folder; the report is written into an `output/` folder inside that same
   working folder as a timestamped `impact_report_*.html` file. The report MUST be a single
   self-contained file that renders with no network access, so it survives being emailed or
   archived. Reports MUST never be overwritten. Header matching MUST stay tolerant of minor
   naming variation. Advisory content received from Cisco MUST be treated as untrusted text that
-  cannot alter the report's structure, styling, or behaviour.
+  cannot alter the report's structure, styling, or behaviour. This is a correctness rule as much as a
+  safety one: Cisco's advisory text contains characters a browser interprets — CLI placeholders in
+  angle brackets, interface paths written with `>` — and rendering them unescaped silently deletes
+  the surrounding text rather than merely misformatting it, so the report would omit part of what
+  Cisco published without any visible sign that it had.
 - Networking: the analyzer itself contacts only `apix.cisco.com` (Cisco PSIRT advisory data and
   platform/release catalogues), `id.cisco.com` (short-lived access token for that API), and
-  `sec.cloudapps.cisco.com` (a published bundle page, read solely to resolve a bundle to its
-  advisory identifiers and its own identity, within the limits of the Scope selectors bullet above).
-  The bundle-page request is unauthenticated — it MUST NOT carry the API credentials — and it MUST
-  carry no inventory-derived data whatsoever, not even the derived family/platform/release triple the
-  advisory API is permitted; the only value sent is the bundle identifier the user supplied.
+  `sec.cloudapps.cisco.com` — for two published resources: a bundle page, read solely to resolve a
+  bundle to its advisory identifiers and its own identity, within the limits of the Scope selectors
+  bullet above; and a per-advisory published advisory document, read solely for the two statements
+  the Advisory scope statements bullet above permits. Both requests are unauthenticated — neither may
+  carry the API credentials — and both MUST carry no inventory-derived data whatsoever, not even
+  the derived family/platform/release triple the advisory API is permitted; the only value sent is
+  the bundle identifier the user supplied, or the identifier of the advisory being asked about.
+  Retrieval of an advisory document MUST be time-bounded and MUST NOT be able to fail a run.
   Version and update checks additionally contact
   GitHub — `api.github.com` and `github.com` — solely to discover the latest published
   release; they send no inventory or secrets and MUST be best-effort and time-bounded so
@@ -341,7 +484,10 @@ constitutional compliance is enforced.
   by tests that run with no credentials and no network access. The headless property of the shared
   surface (Principle VI) MUST itself be covered by tests: that it prints nothing, does not exit the
   process, does not mutate the caller's inventory, and raises rather than returning verdicts when
-  Cisco cannot be reached at all.
+  Cisco cannot be reached at all. Where the tool normalises Cisco-published prose for display
+  (Technology & Data Constraints -> Advisory scope statements), each permitted normalisation MUST
+  have its own test, and a further test MUST assert that no other alteration occurs — otherwise
+  "rendered faithfully" is unfalsifiable and drifts one convenience at a time.
 - Review: pull requests MUST confirm compliance with the Core Principles, especially
   Principle IV (conservative, traceable analysis), Principle V (secrets/data
   handling), and Principle VI (a change inside the shared surface MUST NOT introduce output, a
@@ -385,4 +531,4 @@ Compliance is verified at review time. Dependent Spec Kit artifacts (plan, spec,
 tasks templates and their generated documents) MUST remain consistent with the principles
 above; the Constitution Check in the planning workflow enforces this on each feature.
 
-**Version**: 3.2.0 | **Ratified**: 2026-07-14 | **Last Amended**: 2026-07-28
+**Version**: 3.3.0 | **Ratified**: 2026-07-14 | **Last Amended**: 2026-07-28
diff --git a/brds/006-affected-products-column.md b/brds/006-affected-products-column.md
new file mode 100644
index 0000000..62bd0b0
--- /dev/null
+++ b/brds/006-affected-products-column.md
@@ -0,0 +1,299 @@
+# Business Requirements Document (BRD): Affected Products in the Bundle Report — Show Cisco's Own Vulnerable / Not-Vulnerable Product Statements Beside Each Advisory
+
+## Document Control
+
+| Field             | Value                                                        |
+| ----------------- | ------------------------------------------------------------ |
+| BRD ID            | BRD-006                                                      |
+| Title             | Affected Products column in the bundle-scoped report (publication date relocated; the freed column carries Cisco's own product-scope statements) |
+| Author            | Ali Bahaloo / TELUS Digital                                  |
+| Status            | Draft                                                        |
+| Version           | 0.1.0                                                        |
+| Created           | 2026-07-28                                                   |
+| Last updated      | 2026-07-28                                                   |
+| Related documents | Repo: https://github.com/xavient/caia-cli · BRD-005 (Bundle-Scoped Impact Reporting): `brds/005-erp-bundle-scoped-report.md` · BRD-004 (Decommission the FueliX AI Analyzer, which removed CSAF retrieval): `brds/004-decommission-fuelix-ai-analyzer.md` · Constitution 3.2.0: `.specify/memory/constitution.md` · Spec 008: `specs/008-erp-bundle-scoped-report/spec.md` · Bundle report contract: `specs/008-erp-bundle-scoped-report/contracts/bundle-report.md` · PSIRT access contract: `specs/006-api-inventory-check/contracts/psirt-access.md` · Spec 007 plan (recorded CSAF retrieval as removed): `specs/007-decommission-ai-analyzer/plan.md` · Reference bundle: https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75736 · Worked example: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2 |
+
+## 1. Executive Summary
+
+The bundle-scoped report answers *"which of our firewalls does this advisory hit?"* but never states **what Cisco says the advisory applies to in the first place**. An analyst reading a row showing five impacted FMCs cannot tell from the report whether the advisory covers FMC alone or also ASA and FTD, nor which Cisco products are explicitly confirmed *not* vulnerable — so the report's own scope has to be checked by opening Cisco's page in another tab, once per advisory, 25 times per bundle. This BRD relocates the `Published` date into the Advisory column as a small inline label and repurposes the freed column as **Affected Products**, carrying Cisco's own `Vulnerable Products` and `Products Confirmed Not Vulnerable` statements for that advisory. The result puts Cisco's stated scope directly beside this tool's fleet verdict, so a reader can see in one row both what Cisco claims and what it means for their inventory.
+
+## 2. Business Context & Problem Statement
+
+The bundle report delivered by BRD-005 is correct along the axis it chose, but its rows are missing the context that makes a verdict interpretable.
+
+- **The report shows impact without stating scope.** A row reads *"5 devices · 2 affected releases (7.4.2.3, 7.4.2.4) · fixed in 7.4.6"*. It does not say that Cisco scoped this advisory to Secure FMC Software regardless of configuration, or that Cisco explicitly confirmed cdFMC, ASA, FTD and Security Cloud Control are unaffected. Both statements are published, both are decision-relevant, and neither is in the report.
+- **The gap is filled by hand, per advisory.** To establish scope today an analyst opens the advisory page in a browser and reads two sections. For the reference bundle ERP-75736 that is 25 page loads per review cycle, and it is precisely the manual cross-referencing BRD-005 set out to eliminate. Worse, it happens *outside* the archived artifact: the report a manager reads six weeks later carries no record of the scope the analyst checked.
+- **Scope is the most common source of a wrong conclusion.** Several advisories in the reference bundle are conditional — the vulnerability applies only when Snort 3 is enabled, only when an SSL or decryption policy is deployed, only when remote-access VPN is configured. Measured across the 25 advisories in ERP-75736, **13 carry multi-section product scopes** with per-product conditions and configuration checks. A reader who sees only "5 devices impacted" has no way to know a condition exists, and the natural failure is to patch on a schedule that was never necessary — or to dismiss a row that was.
+- **The "confirmed not vulnerable" list is load-bearing in the opposite direction.** It is the one place Cisco positively rules products out, which is exactly the kind of positive confirmation Principle IV privileges. Its absence means the report can never help a reader who asks "what about the products the tool didn't assess?" — the question a zero-impact row invites.
+- **A column is already being spent on something cheap.** `Published` occupies 12% of the table width and `white-space: nowrap`, to render one 19-character timestamp. It belongs beside the CVSS score in the Advisory column, where the reader is already looking at that advisory's identity; the width it holds is better spent on scope.
+
+The cost of inaction is a report that is authoritative about impact and silent about applicability, while the applicability data sits in a machine-readable document Cisco's own API already links to from every advisory record the tool holds.
+
+## 3. Business Objectives & Goals
+
+- **G1** — Put Cisco's own statement of which products an advisory applies to, and which it does not, in the same row as this tool's fleet verdict.
+- **G2** — Free the column the publication date currently occupies without losing the date, by moving it into the advisory's own identity block.
+- **G3** — Keep every displayed fact traceable to a Cisco-published document, reached by following a pointer Cisco's API supplies rather than a URL the tool invents.
+- **G4** — Render Cisco's text faithfully: no summarisation, no paraphrase, and no removal beyond a short, named, testable list of normalisations.
+- **G5** — Make an advisory whose product-scope statements could not be retrieved say so, and never let that silence read as "no products affected".
+- **G6** — Keep long scope statements from overwhelming the table, without ever hiding text from the file, from search, or from print.
+- **G7** — Leave verdicts, counts, and the whole-fleet report untouched. This feature adds context to a row; it does not decide anything.
+- **G8** — Hold the added retrieval within a cost and time budget that keeps a bundle review as practical as it is today.
+
+## 4. Stakeholders & Users
+
+| Stakeholder / user | Role in this product | What they need from it |
+| ------------------ | -------------------- | ---------------------- |
+| Security / network analyst | Primary user | To judge, from the row alone, whether an advisory's stated scope and conditions actually apply to their deployment — without opening Cisco's page |
+| Firewall / patching engineer | Downstream actor | The conditions attached to a product's vulnerability, so a change window is justified by more than a release-number match |
+| Team lead / security manager | Reviewer, reporting | An archived artifact that records Cisco's stated scope alongside the fleet finding, so a decision can be defended months later |
+| Auditor / IT & security review | Reviewer | Confidence that the scope text is Cisco's own words from a Cisco-published document, that the tool did not paraphrase it, and that no inventory detail was sent to obtain it |
+| Maintainers | Owners | One retrieval path for advisory facts, a named and tested normalisation rule, and a constitution that actually permits what the code does |
+
+## 5. Scope
+
+### 5.1 In Scope
+
+- Relocating the advisory publication date from its own column into the Advisory column, as a smaller labelled element beside the CVSS score.
+- Renaming the freed column to **Affected Products**.
+- Renaming the third column so it cannot be confused with the second — it describes the reader's own fleet, not Cisco's product scope.
+- Retrieving, per advisory in the bundle, Cisco's published `Vulnerable Products` and `Products Confirmed Not Vulnerable` statements.
+- Rendering both statements in the Affected Products column, each under its own labelled heading, in Cisco's own words.
+- A named, enumerated set of normalisations applied to that text — and nothing beyond them.
+- Preserving the structure Cisco encodes in the text: paragraph breaks, sub-headings, and line-per-item lists.
+- Showing an opening extract with the remainder behind a disclosure control, so long statements do not dominate the table while remaining wholly present in the file.
+- Failure handling for a scope statement that cannot be retrieved, is empty, is unparseable, or belongs to a different advisory.
+- The constitution amendment that admits the new source (see §10) — a prerequisite, not an optional follow-on.
+
+### 5.2 Out of Scope
+
+- **Changing any verdict, count, or reason.** Impacted / not impacted / undetermined, the per-row accounting invariant, the release rollup and the first-fix release are untouched. Nothing in the new column may influence any of them.
+- **Using the new source to decide anything.** The product-scope text is context for a human reader. It MUST NOT be parsed to infer applicability, narrow a row's population, derive covered product families, or override the family derivation BRD-005 established.
+- **The whole-fleet report.** It has no per-advisory rows and no publication-date column; it is unchanged by this feature.
+- **The other statements in the same Cisco document.** `Summary`, `Details`, `Workarounds`, `Fixed Software`, `Vulnerability Policy`, `Exploitation and Public Announcements`, `Source` and `Legal Disclaimer` are all present and all out of scope. Only the two named statements are shown.
+- **Per-CVE scope.** Rows remain per advisory; an advisory covering several CVEs shows the advisory's scope statements once.
+- **Summarising, shortening, translating, or AI-processing Cisco's text.** The product decommissioned its AI analyzer in BRD-004 and this feature does not reintroduce any form of generated prose.
+- **Rendering Cisco's HTML.** The statements are handled as text, never as markup to be interpreted.
+- **Caching scope statements between runs.** Each run retrieves what it renders; no offline or air-gapped snapshot capability is added.
+- **A new command, option, or mode.** This changes what an existing report contains, not how a run is invoked.
+- **Reintroducing the retired practice of saving advisory documents to disk.** BRD-004 removed the download-and-retain behaviour and the options that governed it; nothing here brings back on-disk advisory files or a temporary working folder.
+
+## 6. User Journeys *(feeds the spec's prioritized user stories)*
+
+### Journey 1 — Judge an advisory's scope from the row (Priority: P1)
+
+- **Actor:** Security / network analyst
+- **Trigger:** A bundle report is open; a row shows impacted devices, or shows none.
+- **Outcome / value:** Cisco's stated scope and its explicit not-vulnerable list, read in place, so the analyst can tell whether the finding applies to their deployment without leaving the report.
+- **Flow:**
+  1. The analyst reads an advisory row.
+  2. The Advisory column shows severity, CVSS score, and the publication date as a small labelled element beside it, then the advisory identifier, title and CVEs.
+  3. The **Affected Products** column shows Cisco's `Vulnerable Products` statement under a heading, then Cisco's `Products Confirmed Not Vulnerable` statement under its own heading.
+  4. Where a statement is long, an opening extract is shown with a control to reveal the rest.
+  5. The third column, unambiguously labelled as the reader's own fleet, shows the impacted devices and fixing releases exactly as it does today.
+- **Acceptance:**
+  - **Given** any advisory row, **When** the analyst reads the Advisory column, **Then** it shows the publication date Cisco published, labelled, beside the CVSS score — and no separate publication-date column exists.
+  - **Given** any advisory row, **When** the analyst reads the Affected Products column, **Then** it contains Cisco's `Vulnerable Products` text and Cisco's `Products Confirmed Not Vulnerable` text, each under its own visible heading, in that order.
+  - **Given** `cisco-sa-onprem-fmc-authbypass-5JPp45V2`, **When** the analyst reads its Affected Products cell, **Then** it reads exactly: `Vulnerable Products:` / `This vulnerability affects Cisco Secure FMC Software, regardless of device configuration.` / `Products Confirmed Not Vulnerable:` / `Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.` / `Cisco has confirmed that this vulnerability does not affect the following Cisco products:` / and the four named products, each on its own line.
+  - **Given** an advisory whose scope statement contains sub-headings and per-product conditions, **When** the analyst expands it, **Then** the sub-headings are visually distinguishable from body text and the line-per-item lists are not run together into a paragraph.
+  - **Given** the second and third columns side by side, **When** the analyst reads their headers, **Then** one is unmistakably Cisco's product scope and the other unmistakably the reader's own fleet.
+  - **Given** an advisory that impacts no inventory device, **When** the analyst reads its row, **Then** its Affected Products cell is populated exactly as a row with impact is — a zero-impact row is not a reason to omit scope.
+
+### Journey 2 — Keep the scope statement from swallowing the table (Priority: P2)
+
+- **Actor:** Security / network analyst working through 25 rows
+- **Trigger:** An advisory whose `Vulnerable Products` statement runs to 21 paragraphs and 4,783 characters.
+- **Outcome / value:** A table that stays scannable row to row, with the full text one click away and always physically present in the file.
+- **Flow:**
+  1. The analyst scrolls the table; every row occupies a comparable height.
+  2. A long statement shows its opening extract and a control stating that more text exists.
+  3. The analyst expands the one row they care about; the rows above and below do not shift sideways.
+  4. The report's existing expand-all control also opens these.
+- **Acceptance:**
+  - **Given** the advisory with the longest scope statement in the bundle, **When** the report is scrolled, **Then** its row does not prevent neighbouring rows from being read.
+  - **Given** a collapsed statement, **When** the analyst searches the report for a phrase that appears only in its hidden portion, **Then** the phrase is found in the document.
+  - **Given** a collapsed statement, **When** the report is printed or converted to PDF, **Then** no part of Cisco's text is absent from the output.
+  - **Given** a collapsed statement, **When** the analyst expands it, **Then** no other row's columns change width or position.
+  - **Given** the report's expand-all control, **When** it is used, **Then** these statements open with the rest.
+
+### Journey 3 — An unavailable scope statement says so (Priority: P2)
+
+- **Actor:** Security / network analyst, or a manager reading the archived report
+- **Trigger:** Cisco's document for one advisory cannot be retrieved, comes back empty, or cannot be read.
+- **Outcome / value:** A row that is explicit that the scope is unknown, so an empty cell is never mistaken for "Cisco says nothing is affected".
+- **Flow:**
+  1. The run cannot obtain one advisory's scope statements.
+  2. The run continues; every other row is complete, and the fleet verdicts are unaffected.
+  3. That row's Affected Products cell states that Cisco's product-scope statement could not be retrieved, and links to the advisory.
+  4. The report states how many advisories were affected, so the reader can see the gap without auditing 25 rows.
+- **Acceptance:**
+  - **Given** an advisory whose scope statements cannot be retrieved, **When** the analyst reads its row, **Then** the cell says the statement was unavailable and does not imply that no products are affected.
+  - **Given** the same row, **When** the analyst reads it, **Then** the advisory link is still present so the scope can be checked at source.
+  - **Given** one or more such advisories, **When** the analyst reads the report header, **Then** it states how many advisories are missing their scope statement.
+  - **Given** every scope retrieval fails, **When** the run completes, **Then** the report is still written with all fleet verdicts intact, and the failure is reported rather than rendered as 25 empty cells.
+  - **Given** a retrieval failure, **When** the run completes, **Then** no device's verdict, reason, or count differs from a run in which retrieval succeeded.
+
+### Journey 4 — The scope text is Cisco's, and provably so (Priority: P2)
+
+- **Actor:** Auditor / IT & security reviewer
+- **Trigger:** A review of what the report asserts and where each assertion came from.
+- **Outcome / value:** Confidence that the scope text is a faithful rendering of a Cisco-published document, with every alteration named in advance.
+- **Flow:**
+  1. The reviewer compares a rendered cell against Cisco's published advisory.
+  2. The text matches Cisco's, differing only by the normalisations the specification enumerates.
+  3. The reviewer confirms the tool followed a Cisco-supplied pointer rather than a constructed URL, and that no inventory detail was sent to obtain it.
+- **Acceptance:**
+  - **Given** any rendered scope statement, **When** it is compared word for word with Cisco's published statement, **Then** every difference is attributable to a normalisation named in the specification.
+  - **Given** a scope statement containing the characters `<`, `>` or `&` — measured in 7 of the 25 advisories in the reference bundle, in CLI placeholders such as `<interface_name>` and interface paths such as `Devices > VPN > Remote Access` — **When** the report is rendered in a browser, **Then** those characters are visible exactly as Cisco published them and none of the surrounding text has disappeared.
+  - **Given** any scope statement, **When** the report is opened, **Then** nothing in Cisco's text has altered the report's structure, styling, or behaviour, and no content from it executes.
+  - **Given** a retrieved document that identifies a different advisory than the row it was fetched for, **When** the run processes it, **Then** it is rejected and the row is treated as unavailable rather than showing another advisory's scope.
+  - **Given** any scope retrieval, **When** the request is inspected, **Then** it carries no API credential and nothing derived from the inventory beyond the advisory identifier.
+
+## 7. Business Requirements
+
+| ID    | Requirement                          | Priority |
+| ----- | ------------------------------------ | -------- |
+| **Publication date relocation** | | |
+| BR-01 | The report MUST show each advisory's publication date within the Advisory column, as a smaller labelled element positioned beside the CVSS score. | P1 |
+| BR-02 | The report MUST NOT retain a separate publication-date column; the width it held is reassigned to the Affected Products column. | P1 |
+| BR-03 | The relocated date MUST remain the value Cisco published. It MAY be presented more compactly than the raw value, provided no part of it is misstated and the reader is not led to believe a different instant. | P1 |
+| **The Affected Products column** | | |
+| BR-04 | The second column MUST be titled **Affected Products**. | P1 |
+| BR-05 | The third column MUST be retitled so that it unambiguously describes the reader's own fleet and cannot be confused with BR-04's column. | P1 |
+| BR-06 | Each advisory row MUST show Cisco's `Vulnerable Products` statement and Cisco's `Products Confirmed Not Vulnerable` statement for that advisory, each under its own visible heading, `Vulnerable Products` first. | P1 |
+| BR-07 | Both statements MUST be shown for **every** advisory in the bundle, including advisories that impact no inventory device. | P1 |
+| BR-08 | The column MUST NOT show any other statement from Cisco's document, and MUST NOT show the advisory summary, details, workarounds, fixed-software list, policy, or legal text. | P1 |
+| BR-09 | The content of this column MUST NOT influence any verdict, count, population, covered-family derivation, row ordering, filter, or sort. It is context for a reader, never an input to a determination. | P1 |
+| BR-10 | The column MUST NOT be presented as this tool's assessment of the reader's fleet. Its provenance — Cisco's own statement about the advisory — MUST be evident from the report without reference to external documentation. | P1 |
+| **Faithful rendering** | | |
+| BR-11 | The statements MUST be rendered in Cisco's own words. The product MUST NOT summarise, paraphrase, translate, reorder, or generate any part of them. | P1 |
+| BR-12 | Every alteration the product makes to Cisco's text MUST be one of a short, enumerated, individually testable set of normalisations declared in the specification. No other alteration is permitted. | P1 |
+| BR-13 | The normalisations MUST include removing the bracketed link targets Cisco embeds in the text (`["#fs"]`, `["https://…"]`) while retaining the surrounding link text — observed in all 25 advisories of the reference bundle. | P1 |
+| BR-14 | The normalisations MUST include removing a sentence whose entire content is a direction to read another section of the same advisory (for example "For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory."), because that section is not present in the report. A sentence that merely *names* another section while making a substantive claim MUST be retained — notably "Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability." | P1 |
+| BR-15 | The rendering MUST preserve the structure Cisco encodes in the text: paragraph breaks, sub-headings, and lists written one item per line. Sub-headings MUST remain visually distinguishable from body text, and a list MUST NOT be run together into a paragraph. | P1 |
+| BR-16 | Applying the normalisations MUST NOT be able to empty a statement that Cisco published as non-empty. If it would, the original MUST be shown instead. | P2 |
+| **Retrieval & source integrity** | | |
+| BR-17 | The product MUST obtain both statements from the Cisco-published document for that advisory, located by following the pointer Cisco's advisory API supplies for it, and MUST NOT construct that location from a pattern of its own. | P1 |
+| BR-18 | The product MUST verify that the retrieved document identifies the advisory it was fetched for, and MUST treat a mismatch as unavailable rather than render another advisory's scope. | P1 |
+| BR-19 | Retrieval MUST be unauthenticated: it MUST NOT carry the API credentials. | P1 |
+| BR-20 | Retrieval MUST carry no inventory-derived data whatsoever — not a device name, and not the family, platform or release triple the advisory API is permitted. The only value sent is the advisory identifier. | P1 |
+| BR-21 | Retrieved content MUST be treated as untrusted text that cannot alter the report's structure, styling, or behaviour, and cannot become executable content. | P1 |
+| BR-22 | The product MUST NOT write any retrieved document to disk, nor create a temporary folder for one. | P1 |
+| BR-23 | The product SHOULD record, in the report, enough about each retrieved document for a reader to identify the revision it read, since Cisco revises advisories after publication. | P3 |
+| **Failure handling** | | |
+| BR-24 | A statement that cannot be retrieved, arrives empty, cannot be read, or fails BR-18 MUST render as explicitly unavailable. It MUST NOT render as blank, as "none", or in any form a reader could take to mean that Cisco affects no products. | P1 |
+| BR-25 | The product MUST NOT rely on the transport status code alone to detect unavailability: a missing document is served as a success with a zero-length body, and the content type declares a download rather than structured data. Emptiness and unreadability MUST be detected from the content itself. | P1 |
+| BR-26 | A retrieval failure MUST NOT fail the run, change any verdict, reduce any count, or prevent the report from being written. Every fleet finding MUST be identical to a run in which retrieval succeeded. | P1 |
+| BR-27 | The report MUST state how many advisories are missing their scope statements, so a reader can see the gap without inspecting every row. | P2 |
+| **Layout & accessibility** | | |
+| BR-28 | Where a statement is long, the report MUST show an opening extract with a control revealing the remainder, and the control MUST make clear that more text exists. | P1 |
+| BR-29 | No part of Cisco's text may be truncated out of the file. Collapsed text MUST remain present in the document, findable by the reader's search, and present when the report is printed or exported. | P1 |
+| BR-30 | Expanding one row's statement MUST NOT reflow or resize any other row's columns. | P2 |
+| BR-31 | The report's existing expand-all control MUST also open these statements, and the column MUST remain legible in greyscale and in print, with no meaning carried by colour alone. | P2 |
+| **Cross-cutting** | | |
+| BR-32 | The report MUST remain a single self-contained file that renders with no network access, and MUST NOT be overwritten. | P1 |
+| BR-33 | The whole-fleet report MUST be unchanged by this feature. | P1 |
+| BR-34 | Scope retrieval MUST be usable without a terminal: it MUST NOT print, prompt, consult the working folder, write a file, or exit the process. | P1 |
+| BR-35 | Scope retrieval MUST be time-bounded per advisory and MUST NOT consume the Cisco advisory API's request quota. A bundle review MUST remain practical: the added retrieval SHOULD not materially lengthen a run relative to the assessment it accompanies. | P2 |
+| BR-36 | The product SHOULD avoid transferring substantially more data than the statements require, given that the full documents measure 262 times the text actually rendered (§9). | P2 |
+| BR-37 | A run that stops early MUST keep every answer already obtained and report that it was partial, matching today's behaviour. | P1 |
+
+## 8. Success Metrics & Measurable Outcomes
+
+- **SC-01** — An analyst can establish an advisory's product scope and its explicitly not-vulnerable products from the report alone, with zero visits to Cisco's website per advisory (from 25 per bundle review today).
+- **SC-02** — For every advisory in a bundle, both statements are present or explicitly marked unavailable; no cell is silently blank.
+- **SC-03** — For the worked example, the rendered cell matches the expected text character for character.
+- **SC-04** — Every difference between a rendered statement and Cisco's published statement is attributable to an enumerated normalisation; a reviewer sampling advisories finds no unexplained alteration.
+- **SC-05** — Advisories containing `<`, `>` or `&` render those characters visibly and lose no surrounding text — verified against the 7 of 25 in the reference bundle that contain them.
+- **SC-06** — Every fleet verdict, reason, and count in a bundle report is identical to one produced before this feature, including when scope retrieval fails for some or all advisories.
+- **SC-07** — Unavailability is distinguishable from "no products affected" by a reader with no knowledge of the tool's internals.
+- **SC-08** — A reader can search the report for a phrase appearing only in a collapsed statement and find it, and a printed report contains every statement in full.
+- **SC-09** — A 25-advisory bundle review remains practical: added wall-clock time stays a small fraction of the assessment it accompanies, and the Cisco advisory API request count is unchanged.
+- **SC-10** — No scope retrieval carries a credential or any inventory-derived value beyond the advisory identifier, verifiable from the requests the run makes.
+
+## 9. Assumptions
+
+Each was verified against live Cisco sources on 2026-07-28, using the 25 advisories of ERP-75736 plus 4 advisories published between April 2024 and March 2026 from outside that bundle — 29 documents in total.
+
+- **Both statements exist for every advisory.** All 29 documents carry a `Vulnerable Products` statement and a `Products Confirmed Not Vulnerable` statement, under exactly those titles. Seven further statements are also always present (`Summary`, `Workarounds`, `Fixed Software`, `Vulnerability Policy`, `Exploitation and Public Announcements`, `Source`, `Legal Disclaimer`) and one is intermittent (`Details`, in 8 of 25). This supports the originating request's assertion that the values can be safely assumed present — while BR-24 still requires the absent case to be handled, because a universal observation is not a guarantee.
+- **The location is published by the API, not derived.** Every advisory record the tool already retrieves carries a pointer to its machine-readable document — present in 100% of records checked (6 of 6 from a device-scoped question, 28 of 28 from another, and 1 of 1 from a direct lookup), and always at a predictable address. Following the supplied pointer rather than constructing one is what makes BR-17 satisfiable at no additional API cost: **the pointer is already in hand for every advisory that impacts something, and arrives with the individual lookup the report already performs for every advisory that impacts nothing.**
+- **Retrieval does not touch the API quota.** The documents are served from Cisco's Security Center, unauthenticated, not from the quota-limited advisory API. A bundle review's advisory-API request count is therefore unchanged, and the existing pacing is unaffected.
+- **The originating request's expected output is reproducible by a two-rule normalisation.** Removing sentences whose whole content directs the reader to another section of the same advisory, then removing the bracketed link targets, reproduces the requested output for the worked example exactly. Across the reference bundle the two rules separate cleanly: 31 sentences are pure directions ("For information about which … see the Fixed Software section of this advisory.", 30 occurrences; "For more information, see the Fixed Software section of this advisory.", 1) and 25 are substantive statements that merely name a section ("Only products listed in the Vulnerable Products section …"). Applied to all 25 advisories, no statement is emptied.
+- **The simple case is the minority.** The two-paragraph shape shown in the originating request occurs in only 6 of 25 advisories. The rest run to between 3 and 21 paragraphs; the longest `Vulnerable Products` statement is 4,783 characters and contains sub-headings, per-product conditions, product lists, configuration-check procedures and CLI output. Presentation must be designed for that case, not the worked example. This is the whole basis of BR-28 through BR-31.
+- **Structure is carried by whitespace, not markup.** Paragraphs are separated by blank lines, lists are one item per line, and sub-headings are marked only by leading indentation (present in 13 of 25). Line endings are `\r\n` throughout, with no bare newlines and no tabs. Naive whitespace collapsing destroys all three, which is why BR-15 states them explicitly.
+- **The text is not markup, but it is hostile to unescaped rendering.** No document contains real HTML tags, but 7 of 25 contain raw `<`, `>` or `&` — CLI placeholders (`<interface_name>`, `<IPv4_address>`) and interface paths (`Devices > VPN > Remote Access`, `Access Control > SSL`). Rendered unescaped, a browser silently swallows `<interface_name>` and everything up to the next `>`, so escaping is load-bearing for correctness here, not only for safety.
+- **A missing document is a success, not an error.** An unknown advisory identifier returns a success status with a **zero-length body**, and the content type declares a generic download rather than structured data. Neither signal can be used to detect absence — hence BR-25. This mirrors the divergence already recorded for the advisory API, where the documented and live response shapes differ.
+- **The documents are large and the useful part is small.** Per advisory they measure 20 KB to 1.8 MB; the 25 in the reference bundle total 12.9 MB. The text actually rendered totals 49 KB before normalisation and 42 KB after — **262 times less than what a full retrieval transfers.** Cisco serves them uncompressed, with no entity tag, modification date, or cache directive, so neither compression nor conditional requests reduce this. The statements do sit at the very start of each document: the section containing them occupies only the first 13–24 KB of every file examined, which is what makes BR-36 achievable rather than aspirational.
+- **Retrieval is fast in absolute terms.** Individual retrievals completed in 0.24–0.79 seconds; all 25 completed in about 12 seconds sequentially with a courtesy delay. Against an assessment that takes roughly 72 seconds for a 70-device inventory, the added time is material but not disqualifying — and BR-36 would reduce it further.
+- **The report can carry the text comfortably.** 42 KB of added text against a current whole-fleet report of 795 KB; self-containment (BR-32) is not at risk.
+- **Documents are revised after publication.** Each carries its own revision identifier and status. Retrieving per run means a revision is picked up with no tool release, which is also why BR-23 asks for the revision to be recorded.
+
+## 10. Constraints
+
+- **Constitution 3.2.0, Networking — amendment required.** `sec.cloudapps.cisco.com` is admitted today only for "a published bundle page, read solely to resolve a bundle to its advisory identifiers and its own identity". Retrieving advisory documents from that host exceeds "solely", so the bullet MUST be amended before implementation. The amendment MUST preserve the stricter bound the host already carries: unauthenticated, and carrying no inventory-derived data at all (BR-19, BR-20).
+- **Constitution 3.2.0, Source of truth — amendment required.** The bullet names only "Cisco's PSIRT openVuln advisory API" and ends "No scraped or cached-as-authoritative alternatives." The document this feature reads is neither scraped nor cached — it is a structured document Cisco publishes and Cisco's own API links to from every advisory record — but it is not named, and a governance document should not be satisfied on that technicality. It MUST be admitted explicitly, and the admission SHOULD be bounded to the fields actually displayed.
+- **Constitution 3.2.0, Scope selectors — must not be weakened.** That bullet forbids a *bundle page* from supplying "any advisory fact … not a title, severity, score, CVE identifier, affected product, fixing release, or publication date of an advisory". This feature displays a form of affected-product information, so the amendment MUST make plain that the new permission attaches to Cisco's per-advisory published document reached via the API's own pointer, and does **not** relax what the bundle page may supply. Every fact BRD-005 sources from the API — title, severity, score, CVEs, publication date, fixing release — MUST continue to come from the API.
+- **This partially reverses a decommission, and must be reviewed as such.** BRD-004 / spec 007 deliberately removed the retrieval of Cisco advisory documents, and spec 007's plan recorded "ERP pages and CSAF JSON are no longer fetched" as its evidence of compliance with the Source of truth constraint. Reintroducing that retrieval — for a different purpose, with no on-disk retention (BR-22) and no AI processing (BR-11) — is an explicit, reviewed reversal, not an oversight to be discovered later.
+- **Constitution IV (Conservative & Traceable Analysis, non-negotiable).** The tool must not invent advisory facts. Rendering Cisco's text faithfully satisfies this; paraphrasing or summarising it would not. An unavailable statement must not read as an absence of affected products (BR-24), for the same reason an undetermined device must not read as unaffected.
+- **Constitution V (Secrets Hygiene & Data Locality).** The existing bound is unchanged and must not widen. Retrieval sends an advisory identifier and nothing else.
+- **Constitution VI (Headless Shared Surface).** Retrieval and normalisation determine what a report asserts about a Cisco advisory, so they belong on the shared surface and MUST be callable with no terminal (BR-34). If the surface gains a module or a public function, the README shared-surface table and `docs/index.html` MUST be updated in the same pull request, and the addition MUST drive the version bump. The README currently describes `erp.py` as "the only module that talks to Cisco's Security Center"; that sentence becomes inaccurate and must be corrected.
+- **Constitution I (Standard-Library-First).** No new runtime dependency for retrieving, reading, or normalising the documents.
+- **Constitution II / III.** Identical behaviour on macOS, Windows and Linux; no capability reachable only through an interactive prompt.
+- **Report constraints carry over.** Single self-contained file, renders with no network access, never overwritten, all Cisco-supplied content treated as untrusted text.
+- **Bandwidth is a real constraint, not a theoretical one.** 12.9 MB per bundle review over a corporate proxy is the naive cost of this feature (§9). Cisco offers neither compression nor conditional requests, so the only lever is transferring less.
+- **Versioning.** An additive report change plus a shared-surface addition is a MINOR product bump: `4.2.1` → `4.3.0`. The constitution amendment is a MINOR bump of its own: `3.2.0` → `3.3.0`.
+
+## 11. Dependencies
+
+- **Cisco's per-advisory published document** (`sec.cloudapps.cisco.com`) — input; the sole source of the two statements. New resource on an already-admitted host; see §10.
+- **Cisco PSIRT openVuln API** (`apix.cisco.com`, `id.cisco.com`) — input; supplies the pointer to that document and remains the sole source of every other advisory fact. Unchanged.
+- **The existing bundle resolution and assessment** (BRD-005 / spec 008) — input; produces the rows this feature adds a column to. Reused, not modified.
+- **The existing bundle report** — the surface being changed; its self-containment and escaping guarantees carry over.
+- **The project constitution** — MUST be amended for the new source before implementation; that amendment gates this work.
+- **README.md and docs/index.html** — outputs; must be updated in the same pull request if the shared surface changes (Documentation gate).
+
+## 12. Risks & Mitigations
+
+| Risk   | Impact | Likelihood | Mitigation |
+| ------ | ------ | ---------- | ---------- |
+| An unavailable statement renders as an empty cell and is read as "Cisco says nothing is affected" — the same class of error as an undetermined device reading as unaffected | H | M | BR-24 and BR-25: unavailability stated in words, detected from content rather than status code, and never rendered as blank or "none"; BR-27 surfaces the count in the header |
+| A reader takes the Affected Products column as this tool's assessment of *their* fleet, and concludes they are covered — or exposed — on the strength of Cisco's generic scope | H | M | BR-05 retitles the adjacent column to name the reader's own fleet explicitly; BR-10 requires the column's provenance to be evident from the report itself |
+| Unescaped `<interface_name>` or `Devices > VPN` silently deletes surrounding text in the browser, so the report quietly omits part of Cisco's scope statement | H | M | BR-21 plus SC-05, verified against the 7 of 25 advisories that contain these characters — a measured test case, not a generic escaping claim |
+| Normalisation removes something substantive; a security advisory has been silently edited | H | M | BR-12 caps alterations to an enumerated, individually testable list; BR-14 draws the line at sentences that are *purely* navigational, validated to keep all 25 substantive "Only products listed…" sentences and drop all 31 pure directions; BR-16 forbids emptying a non-empty statement |
+| A 4,783-character cell makes the table unusable, and a reader stops reading the column at all | M | H | BR-28 through BR-31: opening extract plus disclosure, no reflow, print- and search-complete, and the existing expand-all control |
+| Collapsed text is treated as absent by a reader who prints the report or searches it | M | M | BR-29 and SC-08: collapsed, never truncated — the text stays in the file, in search, and in print |
+| 12.9 MB per review stalls or fails behind a corporate proxy, or a slow retrieval delays a run that has already spent its budget | M | M | BR-35 time-bounds each retrieval and BR-26 makes a failure non-fatal; BR-36 targets transferring only the portion needed, which §9 measures at 13–24 KB per advisory |
+| Cisco changes its document structure and the statements silently stop appearing | M | M | BR-24 makes absence explicit per row and BR-27 aggregates it into the header, so a structural change surfaces as a visible gap rather than 25 quietly empty cells |
+| Whitespace-based structure is collapsed and a per-product condition list becomes an unreadable paragraph, causing a condition to be missed | M | M | BR-15 states paragraphs, sub-headings and one-item-per-line lists as explicit requirements, with Journey 1 acceptance covering them |
+| A revised advisory changes its scope statement and two reports disagree with no way to tell which is current | L | M | BR-23 records the revision read; retrieval per run means the current revision is always the one shown |
+| The new source is used, over time, to infer applicability — turning context into a second, divergent authority over verdicts | M | L | BR-09 forbids it as a requirement rather than a convention; §5.2 names it out of scope explicitly |
+| The constitution amendment is treated as paperwork and the Scope selectors permission is widened in passing | M | L | §10 states which bullets change and which must not; the amendment must name the new source narrowly and leave the bundle-page prohibition intact |
+
+## 13. Open Questions
+
+- **Should the relocated publication date keep its time component?** Cisco publishes `2026-03-04T16:00:00`; as an inline label beside a CVSS score that is long, and every advisory in a bundle shares the same publication instant. Showing the date alone is more readable and loses information that is arguably not decision-relevant — but it is still trimming a Cisco-published value, which BR-03 permits only if nothing is misstated. Worth settling explicitly.
+- **Should external links inside the statements become real links?** Sixteen bracketed targets across the reference bundle point at cisco.com and snort.org documentation. BR-13 strips the bracket markup and keeps the link text, so the reference survives but is not clickable. Rendering them as links would be more useful and is precedented (the advisory identifier is already a link), but it means emitting URLs that came from a document rather than from the API.
+- **How much of a long statement should the opening extract show?** The first paragraph is the obvious candidate, but 13 of 25 advisories open with a sub-heading whose first paragraph is scoped to one product of several — so a first-paragraph extract can misrepresent a multi-product scope. Showing every sub-heading with its opening line may be the better default.
+- **Should the header state the count of advisories missing scope statements even when it is zero?** BR-27 requires the count; stating it as zero is evidence rather than an absence, which is the pattern BRD-005 chose for zero-impact rows.
+- **Should `Details` be shown when present?** It appears in 8 of 25 advisories and often carries the technical conditions under which the vulnerability is exploitable. Out of scope here, but it is the most likely next request from the same reader.
+- **Is transferring only the needed portion of each document worth the complexity?** §9 shows the statements sit in the first 13–24 KB of files up to 1.8 MB, so the saving is roughly 98%. Whether that justifies a more careful retrieval than reading the whole document is a design judgement BR-36 states as a SHOULD rather than a MUST.
+- **Should a bundle-wide view of the not-vulnerable products be offered?** Across a bundle, the union of products Cisco explicitly rules out is a useful answer to "what about everything we didn't assess?" — but it risks reading as an all-clear for products the tool never examined.
+
+## 14. Glossary
+
+| Term   | Definition   |
+| ------ | ------------ |
+| Advisory | A single Cisco Security Advisory, identified by a `cisco-sa-…` identifier, covering one or more CVEs. |
+| Bundle / Event Response (ERP) page | Cisco's practice of publishing many Secure Firewall advisories together, announced on one page identified as `ERP-#####`. The unit of scope for the report this BRD changes. |
+| Bundle-scoped report | The report layout introduced by BRD-005: one row per advisory in the bundle. The only report this feature changes. |
+| Whole-fleet report | The report layout with one row per inventory device. Unchanged by this feature. |
+| Vulnerable Products | Cisco's own published statement of which products an advisory applies to, and under what conditions. The first value the new column shows. |
+| Products Confirmed Not Vulnerable | Cisco's own published statement of which products the advisory does *not* affect. The second value the new column shows, and one of the few places Cisco rules a product out positively. |
+| Affected Products | The new column title. Cisco's stated product scope for the advisory — **not** a statement about the reader's inventory. |
+| Scope statement | Either of the two values above, as rendered in the report. |
+| Normalisation | One of the enumerated, individually testable alterations the product is permitted to make to Cisco's text (BR-12). Anything not enumerated is forbidden. |
+| Navigational sentence | A sentence whose entire content directs the reader to another section of the same advisory. Removed by BR-14, because the section it points to is not in the report. |
+| Unavailable | A scope statement that could not be retrieved, arrived empty, could not be read, or belonged to a different advisory. Stated in words, and never rendered as an absence of affected products (BR-24). |
+| Impacted | Cisco positively listed the advisory as applying to a device's software release on its hardware platform. Unchanged by this feature. |
+| Undetermined / Needs review | The tool could not conclusively assess a device. Never presented as unaffected. Unchanged by this feature. |
+| Shared surface | The modules that produce a verdict or determine the scope one is produced for, which must remain callable without a terminal (Constitution VI). |

From 2cabac25b777b4b59732fce6a3c9ecb0fcab5990 Mon Sep 17 00:00:00 2001
From: Ali Bahaloo <ali.bahaloo@telusinternational.com>
Date: Tue, 28 Jul 2026 23:26:24 -0700
Subject: [PATCH 2/7] docs(009): specify the Affected Products column for the
 bundle report
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Converts BRD-006 into spec 009: 4 prioritized user stories, 47 functional
requirements, 12 measurable outcomes, 10 edge cases, no open clarifications.

The publication date moves into the Advisory column beside the CVSS score; the
freed column becomes "Affected Products" carrying Cisco's own Vulnerable
Products and Products Confirmed Not Vulnerable statements; the third column
becomes "Your impacted devices" so Cisco's product scope cannot be mistaken for
a finding about the reader's fleet. Verdicts, counts and the whole-fleet report
are unchanged.

Six defaults were adopted for questions BRD-006 left open (date value retained,
links kept as text, extract shows every sub-heading with its opening paragraph,
zero-count stated, Details not shown, no bundle-wide aggregate) and recorded in
Assumptions rather than deferred.

Validation rewrote five requirements that could not have failed a test. Two
changed behaviour rather than wording: FR-031 dropped its undefined "long enough
to dominate its row" threshold, so the disclosure control now appears if and only
if text lies beyond the extract; FR-007 now requires the report to state the
column's provenance rather than requiring it to be "evident".

Clarification added five requirements in the one area the BRD treated only as a
cost question — how retrieval behaves over a network:

- FR-043 retry once on transport failures only; the missing-document case is a
  success with an empty body, so retrying it is waste. Attempts capped at two.
- FR-044/FR-045 a short per-row cause from a closed set of five, so a local
  network problem is separable from a change on Cisco's side.
- FR-046 sequential requests with a courtesy delay; Cisco publishes no allowance
  for this host, and a throttled burst would mass-mark statements unavailable.
- FR-047 progress reported through the caller-supplied mechanism, keeping
  retrieval headless while avoiding a silent pause that reads as a hang.

Adding the retry made FR-039 self-inconsistent — it bounded time per advisory
while permitting two attempts, and its aggregate target was unachievable on a
degraded network. It now bounds each attempt and scopes the one-quarter target to
runs that succeed without retry, while still requiring a degraded run to complete
and write its report.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .specify/feature.json                         |   2 +-
 .../checklists/requirements.md                | 109 +++++++
 specs/009-affected-products-column/spec.md    | 270 ++++++++++++++++++
 3 files changed, 380 insertions(+), 1 deletion(-)
 create mode 100644 specs/009-affected-products-column/checklists/requirements.md
 create mode 100644 specs/009-affected-products-column/spec.md

diff --git a/.specify/feature.json b/.specify/feature.json
index 82acbd8..563df6b 100644
--- a/.specify/feature.json
+++ b/.specify/feature.json
@@ -1,3 +1,3 @@
 {
-  "feature_directory": "specs/008-erp-bundle-scoped-report"
+  "feature_directory": "specs/009-affected-products-column"
 }
diff --git a/specs/009-affected-products-column/checklists/requirements.md b/specs/009-affected-products-column/checklists/requirements.md
new file mode 100644
index 0000000..b2f6d68
--- /dev/null
+++ b/specs/009-affected-products-column/checklists/requirements.md
@@ -0,0 +1,109 @@
+# Specification Quality Checklist: Affected Products Column in the Bundle-Scoped Report
+
+**Purpose**: Validate specification completeness and quality before proceeding to planning
+**Created**: 2026-07-28
+**Feature**: [spec.md](../spec.md)
+
+## Content Quality
+
+- [x] No implementation details (languages, frameworks, APIs)
+- [x] Focused on user value and business needs
+- [x] Written for non-technical stakeholders
+- [x] All mandatory sections completed
+
+## Requirement Completeness
+
+- [x] No [NEEDS CLARIFICATION] markers remain
+- [x] Requirements are testable and unambiguous
+- [x] Success criteria are measurable
+- [x] Success criteria are technology-agnostic (no implementation details)
+- [x] All acceptance scenarios are defined
+- [x] Edge cases are identified
+- [x] Scope is clearly bounded
+- [x] Dependencies and assumptions identified
+
+## Feature Readiness
+
+- [x] All functional requirements have clear acceptance criteria
+- [x] User scenarios cover primary flows
+- [x] Feature meets measurable outcomes defined in Success Criteria
+- [x] No implementation details leak into specification
+
+## Notes
+
+All items pass, before and after the clarification session (16/16 → 16/16). No item
+changed state and there were no regressions.
+
+Zero `[NEEDS CLARIFICATION]` markers: BRD-006 resolved the three user-facing decisions
+(navigational-sentence removal, extract-plus-disclosure presentation, and the two column
+titles) before this specification was written, and its remaining open questions had
+defensible defaults, each recorded in the spec's Assumptions section rather than deferred.
+
+### Clarification session 2026-07-28
+
+Four gaps were found that the BRD had not addressed — all in the *how retrieval behaves
+over a network* area, which the BRD treated only as a cost question. Five new requirements
+and one new success criterion were added; the spec grew from 42 to 47 requirements and
+from 11 to 12 measurable outcomes.
+
+1. **Retry policy** (FR-043) — retry once on transport failures only. The measured
+   "missing document" case is a success with an empty body, which is deterministic, so
+   retrying it is waste. Attempts are capped at two.
+2. **Unavailability detail** (FR-044, FR-045, SC-012) — a short per-row cause from a
+   closed set of five, so an operator can separate a local network problem from a
+   Cisco-side change. The `Unavailability` entity was tightened to match.
+3. **Request pacing** (FR-046) — sequential with a small courtesy delay. Cisco publishes
+   no request allowance for this host, so the product must not assume one; a throttled
+   burst would mass-mark statements unavailable, making pacing a correctness concern
+   rather than a timing one.
+4. **Progress reporting** (FR-047) — reported through the caller-supplied mechanism the
+   assessment already uses, so retrieval stays headless under FR-038 while the user does
+   not face ~12 s of silence that reads as a hang.
+
+**Contradiction found and repaired during the consistency pass.** Adding the retry made
+FR-039 self-inconsistent: it bounded time "per advisory" while FR-043 permitted two
+attempts, and its one-quarter aggregate target became unachievable on a degraded network.
+FR-039 now bounds each *attempt*, relies on FR-043's cap of two for the per-advisory
+worst case, and scopes the one-quarter target to runs that succeed without retry — while
+still requiring a degraded run to complete and write its report. SC-009 was scoped to
+match, and two edge cases were added for the large-document and recurring-failure paths.
+
+### Issues found and fixed during validation (iteration 1)
+
+Five requirements were written in language that could not have failed a test, plus one
+leak of internal structure. All were corrected before the checklist was marked complete:
+
+1. **FR-007** said the column's provenance "MUST be evident from the report itself" —
+   an unfalsifiable claim about a reader's impression. Rewritten to require the report to
+   *state* that the column carries Cisco's own statement rather than a finding about the
+   reader's inventory.
+2. **FR-031** triggered the disclosure control when a statement was "long enough to
+   dominate its row" — an undefined threshold. Rewritten to remove the threshold entirely:
+   every statement renders as extract plus remainder, and the control appears if and only
+   if text lies beyond the extract. The presence of the control now *means* text is hidden,
+   which is directly observable.
+3. **FR-039** required that retrieval "SHOULD not materially lengthen a run". Quantified to
+   no more than one quarter of total elapsed time, grounded in the measured 12 s of
+   retrieval against a 72 s assessment.
+4. **FR-040** said "substantially more data than the statements require". Rewritten as a
+   concrete prohibition on transferring whole documents, with the measured 13–24 KB opening
+   portion as the reference point.
+5. **SC-009** inherited "a small fraction" from FR-039; aligned to the same one-quarter bound.
+6. **Dependencies** named an internal module. Reworded to describe the documentation that
+   becomes inaccurate without naming internal structure.
+
+### Judgement calls worth surfacing at planning
+
+- **"Cisco's advisory API" appears throughout.** This is an external vendor system and the
+  governing constraint in the constitution, not this product's implementation, so it is
+  treated as problem domain rather than an implementation detail.
+- **FR-014's literal markup forms** (`["#fs"]`) and **FR-015's literal sentence** are source
+  data shapes, quoted because the normalisations are unusable as requirements without them
+  and because the constitution's Tests gate demands a test per normalisation.
+- **SC-007** ("a reader can distinguish unavailable from no-products-affected") is
+  qualitative. Retained deliberately: it is the feature's central safety property, it is
+  verifiable by inspecting the rendered wording, and reducing it to a numeric proxy would
+  weaken it.
+- **FR-039 and FR-040 have no Given/When/Then scenario.** Both are performance and cost
+  bounds carried by SC-009 instead; expressing them as user-story acceptance would be
+  artificial.
diff --git a/specs/009-affected-products-column/spec.md b/specs/009-affected-products-column/spec.md
new file mode 100644
index 0000000..2d2c2ad
--- /dev/null
+++ b/specs/009-affected-products-column/spec.md
@@ -0,0 +1,270 @@
+# Feature Specification: Affected Products Column in the Bundle-Scoped Report
+
+**Feature Branch**: `009-affected-products-column`
+
+**Created**: 2026-07-28
+
+**Status**: Draft
+
+**Input**: BRD-006 (`brds/006-affected-products-column.md`). In the bundle-scoped report, move each advisory's publication date out of its own column and into the Advisory column as a smaller labelled element beside the CVSS score; retitle the freed column **Affected Products** and fill it with Cisco's own published `Vulnerable Products` and `Products Confirmed Not Vulnerable` statements for that advisory, retrieved from the per-advisory machine-readable advisory document that Cisco's advisory API links to; retitle the third column **Your impacted devices** so it cannot be confused with the second. Render Cisco's text faithfully — only enumerated, individually tested normalisations — collapse long statements without hiding them from search or print, and state unavailability explicitly so a blank cell can never read as "no products affected". Verdicts, counts and the whole-fleet report are unchanged.
+
+**Prerequisite met**: the constitution was amended to **3.3.0** on this branch — a new *Advisory scope statements* bullet admits the per-advisory advisory document for these two values only, `sec.cloudapps.cisco.com` is admitted for it under the existing unauthenticated / no-inventory-data bound, and *Scope selectors* is deliberately not relaxed.
+
+## Clarifications
+
+### Session 2026-07-28
+
+- Q: When a scope-statement retrieval fails, should it be retried? → A: Retry once, transport failures only — timeouts and connection/TLS/proxy errors get one retry after a short delay; an empty body, unreadable content, or an identity mismatch is deterministic and is not retried.
+- Q: When a scope statement is unavailable, how much should the report tell the reader? → A: A short reason per row, drawn from a fixed set of causes, so a local network problem is distinguishable from a Cisco-side change.
+- Q: How should requests to Cisco's Security Center be paced during scope retrieval? → A: Sequentially, with a small fixed courtesy delay between requests — no published quota is relied on, and no burst is emitted against an endpoint whose allowance is unknown.
+- Q: Should the run report progress while retrieving scope statements? → A: Yes, through the same caller-supplied progress mechanism the assessment already uses, so retrieval itself still prints nothing and stays headless.
+
+## User Scenarios & Testing *(mandatory)*
+
+### User Story 1 - Read Cisco's product scope in the advisory row (Priority: P1)
+
+A security analyst reviewing a bundle report sees, for each advisory, what Cisco says the advisory applies to and which Cisco products Cisco has explicitly confirmed are *not* vulnerable — beside this tool's finding about their own fleet. The publication date moves into the Advisory column as a small labelled element next to the CVSS score, freeing its column for that scope text. The analyst no longer opens Cisco's website once per advisory to establish scope, and the archived report carries the scope the decision was made on.
+
+**Why this priority**: This is the feature. Everything else refines how it behaves under stress. Shipping only this delivers the whole value — the analyst stops leaving the report to answer "does this even apply to us?" — and the report becomes self-contained evidence of scope rather than a finding whose basis lived in a browser tab.
+
+**Independent Test**: Render a bundle report from recorded advisory documents and confirm each row shows both Cisco statements under their own headings, the relocated date in the Advisory column, the two retitled column headers, and no separate publication-date column. Fully testable with no credentials and no network access.
+
+**Acceptance Scenarios**:
+
+1. **Given** any advisory row, **When** the analyst reads the Advisory column, **Then** it shows the advisory's publication date as a smaller labelled element beside the CVSS score, and the table has no separate publication-date column.
+2. **Given** the report's table headers, **When** the analyst reads them, **Then** the second column is titled `Affected Products` and the third is titled `Your impacted devices`.
+3. **Given** any advisory row, **When** the analyst reads the Affected Products cell, **Then** it shows Cisco's `Vulnerable Products` statement under a visible heading, followed by Cisco's `Products Confirmed Not Vulnerable` statement under its own visible heading.
+4. **Given** the advisory `cisco-sa-onprem-fmc-authbypass-5JPp45V2`, **When** the analyst reads its Affected Products cell, **Then** the rendered text is exactly: heading `Vulnerable Products`, then `This vulnerability affects Cisco Secure FMC Software, regardless of device configuration.`; heading `Products Confirmed Not Vulnerable`, then `Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.`, then `Cisco has confirmed that this vulnerability does not affect the following Cisco products:`, then `Cloud-Delivered FMC (cdFMC)`, `Secure Firewall Adaptive Security Appliance (ASA) Software`, `Secure Firewall Threat Defense (FTD) Software` and `Security Cloud Control (SCC), formerly Defense Orchestrator`, each on its own line.
+5. **Given** an advisory in the bundle that impacts no inventory device, **When** the analyst reads its row, **Then** its Affected Products cell is populated exactly as a row with impact is.
+6. **Given** an advisory whose statement contains sub-headings, per-product conditions and one-item-per-line product lists, **When** the analyst reads the cell, **Then** paragraph breaks are preserved, sub-headings are visually distinguishable from body text, and no list is run together into a paragraph.
+7. **Given** a statement containing the characters `<`, `>` or `&` — CLI placeholders such as `<interface_name>` and interface paths such as `Devices > VPN > Remote Access` — **When** the report is opened in a browser, **Then** those characters are visible exactly as Cisco published them and no surrounding text has disappeared.
+8. **Given** any advisory row, **When** the analyst reads the Affected Products cell, **Then** it is never silently blank: it either shows both statements or explicitly states that a statement was unavailable.
+9. **Given** a run in which some or all scope retrievals fail, **When** the run completes, **Then** the report is still written and every device verdict, reason and count is identical to a run in which retrieval succeeded.
+10. **Given** any run, **When** the requests it makes are inspected, **Then** no scope retrieval carried the API credentials, and none carried any inventory-derived value beyond the advisory identifier.
+11. **Given** any run, **When** it completes, **Then** no retrieved advisory document was written to disk and no temporary folder was created for one.
+12. **Given** a whole-fleet run with no bundle supplied, **When** the report is produced, **Then** it is unchanged by this feature.
+
+---
+
+### User Story 2 - Long scope statements stay readable (Priority: P2)
+
+An analyst works down 25 rows. Most scope statements are short; several run to 21 paragraphs and nearly 5,000 characters with sub-headings, configuration checks and CLI output. Each cell shows enough to judge scope at a glance — every sub-heading with its opening paragraph, or the opening paragraph where there are no sub-headings — with a control revealing the rest. The full text is always physically in the file, so search, print and PDF export contain all of it.
+
+**Why this priority**: Without it, one advisory's cell makes its row tall enough to push its neighbours off screen, and the practical result is that readers stop using the column. It refines User Story 1 rather than replacing it, so it can ship second — but the report is unpleasant to use until it does.
+
+**Independent Test**: Render a report containing the longest known statement and confirm the visible extract, the disclosure control, that neighbouring rows remain readable and do not shift when one is expanded, and that a phrase appearing only in the collapsed portion is still present in the document.
+
+**Acceptance Scenarios**:
+
+1. **Given** a statement long enough to be collapsed, **When** the analyst reads the cell, **Then** the visible portion shows every sub-heading with its opening paragraph — or the opening paragraph alone where the statement has no sub-headings — and a control indicating that more text exists.
+2. **Given** the advisory with the longest scope statement in the bundle, **When** the report is scrolled, **Then** its row does not prevent neighbouring rows from being read.
+3. **Given** a collapsed statement, **When** the analyst searches the report for a phrase that appears only in its collapsed portion, **Then** the phrase is found in the document.
+4. **Given** a collapsed statement, **When** the report is printed or exported to PDF, **Then** no part of Cisco's text is absent from the output.
+5. **Given** a collapsed statement, **When** the analyst expands it, **Then** no other row's columns change width or position.
+6. **Given** the report's existing expand-all control, **When** it is used, **Then** these statements open along with the report's other disclosures.
+7. **Given** the report rendered in greyscale or printed, **When** the analyst reads the column, **Then** every distinction it makes is legible without colour.
+
+---
+
+### User Story 3 - An unavailable scope statement says so (Priority: P2)
+
+Cisco's document for one advisory cannot be retrieved, comes back empty, cannot be read, or turns out to describe a different advisory. That row states plainly that the scope statement was unavailable, keeps its link to Cisco so the analyst can check at source, and the report header reports how many advisories are affected — so a reader sees the gap without auditing every row.
+
+**Why this priority**: This is the safety property, and it is the same class of error as an undetermined device reading as unaffected. User Story 1 already forbids a silently blank cell; this story is the full treatment — the wording, the retained link, and the aggregate count — which is what makes the gap visible to a manager reading the report weeks later.
+
+**Independent Test**: Simulate each failure mode — unreachable, empty body, unreadable content, identity mismatch — and confirm the per-row wording, the retained advisory link, the header count, and that the run completes with unchanged verdicts.
+
+**Acceptance Scenarios**:
+
+1. **Given** an advisory whose scope statements cannot be retrieved, **When** the analyst reads its row, **Then** the cell states that Cisco's product-scope statement was unavailable, names which of the five causes applied in a few readable words, and says nothing a reader could take to mean that no products are affected.
+2. **Given** the same row, **When** the analyst reads it, **Then** the advisory identifier is still a link to Cisco's published advisory so the scope can be checked at source.
+3. **Given** one or more advisories missing their scope statements, **When** the analyst reads the report header, **Then** it states how many.
+4. **Given** every advisory's scope statement retrieved successfully, **When** the analyst reads the report header, **Then** it states that count as zero rather than omitting it.
+5. **Given** a retrieved document that identifies a different advisory than the row it was fetched for, **When** the run processes it, **Then** it is rejected and the row is treated as unavailable rather than showing another advisory's scope.
+6. **Given** a retrieval that returns a success status with a zero-length body, **When** the run processes it, **Then** it is treated as unavailable rather than as a statement with no content.
+7. **Given** every scope retrieval fails, **When** the run completes, **Then** the report is written with all fleet findings intact and the failure is reported, rather than rendering as a table of empty cells.
+8. **Given** a retrieval that fails with a transport error and would succeed on a second attempt, **When** the run retries it once, **Then** the statement is shown normally and the row is not marked unavailable.
+9. **Given** a retrieval that returns an empty body, unreadable content, or a document identifying a different advisory, **When** the run processes it, **Then** it is not retried, and the statement is marked unavailable after a single attempt.
+
+---
+
+### User Story 4 - The scope's provenance is auditable from the report (Priority: P3)
+
+A reviewer, months later, needs to establish where the scope text came from and which version of the advisory it reflects. The report records enough about each retrieved document to identify the revision read, so two reports that disagree can be told apart, and so the claim "this is Cisco's own text" is checkable rather than asserted.
+
+**Why this priority**: The integrity invariants themselves are enforced in User Story 1; what this adds is the written record. Valuable for audit and for reconciling reports across a Cisco revision, but the feature is correct and usable without it.
+
+**Independent Test**: Render a report from documents with known revision identifiers and confirm the report states them, and that a reader can tell which revision each statement came from.
+
+**Acceptance Scenarios**:
+
+1. **Given** a rendered report, **When** the reviewer reads it, **Then** it records, for each advisory whose scope was retrieved, enough to identify the revision of the document that was read.
+2. **Given** two reports produced either side of a Cisco revision to the same advisory, **When** the reviewer compares them, **Then** the recorded revision distinguishes which is which.
+3. **Given** a rendered statement, **When** the reviewer compares it word for word against Cisco's published statement, **Then** every difference is attributable to a normalisation enumerated in this specification.
+
+---
+
+### Edge Cases
+
+- **A statement that normalisation would empty.** If removing navigational sentences and link markup would leave a statement Cisco published as non-empty with nothing in it, the original text is shown instead — never an empty cell and never an unavailable one.
+- **A statement Cisco published as genuinely empty.** Treated as unavailable, not as "no products affected".
+- **A document that is retrievable but not readable** — truncated, malformed, or not the expected structure. Treated as unavailable; never partially rendered.
+- **A document missing one of the two statements but carrying the other.** The present statement is shown; only the absent one is marked unavailable.
+- **An advisory whose document is very large.** Each attempt is time-bounded; exceeding the bound counts as a transport failure, so it is retried once and then left unavailable, and it does not delay the rest of the run.
+- **A transport failure that recurs on the retry.** The statement is marked unavailable with the unreachable cause after two attempts; no third attempt is made and the run continues.
+- **A bundle in which every advisory impacts nothing.** Every row still carries scope statements — a zero-impact bundle is the case where Cisco's scope is most decision-relevant.
+- **A run that stops early.** Every answer already obtained is kept, the report says it was partial, and advisories not reached have their statements marked unavailable rather than blank.
+- **An advisory whose publication date Cisco does not state.** The Advisory column shows the date as absent, exactly as the current report does, rather than inventing one.
+- **A statement containing text that resembles markup.** Rendered as visible text; it cannot alter the report's structure, styling, or behaviour, and cannot execute.
+- **Cisco changes the document structure so the statements stop appearing.** Every row reports unavailable and the header count reflects it, so the change surfaces as a visible gap rather than silence.
+
+## Requirements *(mandatory)*
+
+### Functional Requirements
+
+**Publication date relocation**
+
+- **FR-001**: The bundle-scoped report MUST show each advisory's publication date inside the Advisory column, as a smaller labelled element positioned beside the CVSS score.
+- **FR-002**: The report MUST NOT retain a separate publication-date column; the width it held is reassigned to the Affected Products column.
+- **FR-003**: The relocated date MUST remain the value Cisco published. Where it is presented more compactly than Cisco's raw value, the full value MUST remain available within the report, and no part of it may be misstated.
+- **FR-004**: An advisory for which Cisco states no publication date MUST render as having none, matching the current report's treatment, never as an inferred date.
+
+**Column identity**
+
+- **FR-005**: The second column MUST be titled `Affected Products`.
+- **FR-006**: The third column MUST be titled `Your impacted devices`, so that Cisco's product scope and the reader's own fleet cannot be confused.
+- **FR-007**: The Affected Products column MUST NOT be presented as this tool's assessment of the reader's fleet. The report MUST state, in the report itself, that the column's content is Cisco's own published statement about the advisory rather than a finding about the reader's inventory — so its provenance needs no external documentation to establish.
+
+**Content of the column**
+
+- **FR-008**: Each advisory row MUST show Cisco's `Vulnerable Products` statement and Cisco's `Products Confirmed Not Vulnerable` statement for that advisory, each under its own visible heading, `Vulnerable Products` first.
+- **FR-009**: Both statements MUST be shown for every advisory in the bundle, including advisories that impact no inventory device.
+- **FR-010**: The column MUST NOT show any other statement from Cisco's document — not the summary, details, workarounds, fixed-software list, vulnerability policy, exploitation notice, source, or legal disclaimer.
+- **FR-011**: The content of this column MUST NOT influence any verdict, device count, row population, covered-family derivation, row ordering, filter, or sort. It is context for a reader, never an input to a determination.
+
+**Faithful rendering**
+
+- **FR-012**: The statements MUST be rendered in Cisco's own words. The product MUST NOT summarise, paraphrase, translate, reorder, or generate any part of them.
+- **FR-013**: Every alteration the product makes to Cisco's text MUST be one of the normalisations enumerated in FR-014 and FR-015. No other alteration is permitted. Each normalisation MUST have its own test, and a further test MUST assert that no other alteration occurs.
+- **FR-014**: **Normalisation 1 — link markup.** Cisco's bracketed link targets, of the forms `["#fs"]` and `["https://…"]`, MUST be removed, retaining the surrounding link text.
+- **FR-015**: **Normalisation 2 — navigational sentences.** A sentence whose entire content directs the reader to another section of the same advisory — for example `For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.` — MUST be removed, because that section is not present in the report. A sentence that names another section while making a substantive claim MUST be retained, notably `Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.`
+- **FR-016**: Normalisation MUST NOT be able to empty a statement Cisco published as non-empty. Where it would, the original text MUST be shown instead.
+- **FR-017**: The rendering MUST preserve the structure Cisco encodes in the text: paragraph breaks, sub-headings, and lists written one item per line. Sub-headings MUST remain visually distinguishable from body text, and a list MUST NOT be run together into a paragraph.
+- **FR-018**: Retrieved content MUST be treated as untrusted text that cannot alter the report's structure, styling, or behaviour, and cannot become executable content. Characters a browser would otherwise interpret MUST render visibly, with no loss of surrounding text.
+
+**Retrieval and source integrity**
+
+- **FR-019**: Both statements MUST be obtained from Cisco's per-advisory published machine-readable advisory document, located by following the pointer Cisco's advisory API returns for that advisory. The product MUST NOT construct that location from a pattern of its own.
+- **FR-020**: The product MUST verify that the retrieved document identifies the advisory it was fetched for before using any part of it, and MUST treat a mismatch as unavailable.
+- **FR-021**: No value from the retrieved document other than the two statements and the identity and revision fields FR-020 and FR-035 require may be used — not a title, severity, score, CVE identifier, publication date, fixing release, affected platform, or product tree. Every such fact MUST continue to come from the advisory API.
+- **FR-022**: Retrieval MUST be unauthenticated: it MUST NOT carry the API credentials.
+- **FR-023**: Retrieval MUST carry no inventory-derived data whatsoever — not a device name, and not the family, platform or release triple the advisory API is permitted. The only value sent is the advisory identifier.
+- **FR-024**: Retrieval MUST NOT consume the Cisco advisory API's request quota, and MUST NOT change the number of advisory-API requests a bundle review makes.
+- **FR-046**: Retrievals MUST be issued sequentially, separated by a small fixed courtesy delay, and MUST NOT be issued as a concurrent burst. Cisco publishes no request allowance for this host, so the product MUST NOT rely on one; the pacing MUST remain small enough to satisfy FR-039.
+- **FR-025**: The product MUST NOT write any retrieved document to disk, and MUST NOT create a temporary folder for one.
+- **FR-043**: A retrieval that fails at the transport level — timeout, connection, TLS, or proxy error — MUST be retried exactly once after a short delay. A retrieval that completes but yields an empty body, unreadable content, or a document failing FR-020 MUST NOT be retried, because each of those outcomes is deterministic and a second attempt would fail identically. Total attempts per advisory MUST therefore never exceed two.
+
+**Unavailability**
+
+- **FR-026**: A statement that cannot be retrieved, arrives empty, cannot be read, or fails FR-020 MUST render as explicitly unavailable. It MUST NOT render as blank, as "none", or in any form a reader could take to mean that Cisco affects no products.
+- **FR-044**: An unavailable statement MUST name its cause in the row, in a few words, drawn from a fixed set covering: Cisco could not be reached; Cisco published no content for the statement; the document could not be read; the document identified a different advisory; the advisory was not reached before the run stopped. The cause MUST be stated in language a reader can act on, so that a local connectivity problem is distinguishable from a change on Cisco's side.
+- **FR-045**: The set of causes in FR-044 MUST be closed: every unavailable statement MUST resolve to exactly one of them, and no cause may be reported that is not in the set.
+- **FR-027**: Unavailability MUST be detected from the retrieved content, not from the transport status alone: a missing document is served as a success with a zero-length body, and the content type declares a generic download rather than structured data.
+- **FR-028**: Where one statement is available and the other is not, the available one MUST be shown and only the absent one marked unavailable.
+- **FR-029**: A retrieval failure MUST NOT fail the run, change any verdict, reduce any count, or prevent the report from being written. Every fleet finding MUST be identical to a run in which retrieval succeeded.
+- **FR-030**: The report MUST state how many advisories are missing their scope statements, including when that number is zero.
+
+**Layout and accessibility**
+
+- **FR-031**: Each statement MUST be rendered as a visible extract plus, where any text remains beyond that extract, a control that reveals the remainder and indicates that more text exists. The extract MUST be every sub-heading with its opening paragraph, or the opening paragraph alone where the statement has no sub-headings. A statement wholly contained in its extract MUST NOT carry a disclosure control, so the presence of the control always means text is hidden.
+- **FR-032**: No part of Cisco's text may be truncated out of the file. Collapsed text MUST remain present in the document, findable by the reader's search, and present when the report is printed or exported.
+- **FR-033**: Expanding one row's statement MUST NOT reflow or resize any other row's columns.
+- **FR-034**: The report's existing expand-all control MUST also open these statements, and the column MUST remain legible in greyscale and in print, with no meaning carried by colour alone.
+
+**Auditability**
+
+- **FR-035**: The report SHOULD record, for each advisory whose scope was retrieved, enough about the retrieved document to identify the revision that was read.
+
+**Cross-cutting**
+
+- **FR-036**: The report MUST remain a single self-contained file that renders with no network access, and MUST NOT overwrite an existing report.
+- **FR-037**: The whole-fleet report MUST be unchanged by this feature.
+- **FR-038**: Scope retrieval and normalisation MUST be usable without a terminal: they MUST NOT print, prompt, consult the current working folder, write a file, or exit the process.
+- **FR-047**: A run MUST report progress while retrieving scope statements, so the retrieval phase is never a silent pause. It MUST do so by reporting to a progress mechanism the caller supplies — the same route the assessment already uses — so that retrieval itself still satisfies FR-038 and a caller with no terminal can ignore it.
+- **FR-039**: Each retrieval attempt MUST be time-bounded, and an attempt that exceeds its bound MUST be treated as a transport failure (see FR-043). Because FR-043 caps attempts at two, the worst-case time any single advisory can consume MUST be bounded and knowable. Across a bundle in which retrievals succeed without retry, the added retrieval SHOULD increase a run's total elapsed time by no more than one quarter; a run degraded enough to retry repeatedly MAY exceed that, and MUST still complete and write its report.
+- **FR-040**: The product SHOULD NOT transfer an entire advisory document where the two statements can be obtained from its opening portion. Measured reference: the portion carrying them is the first 13–24 KB of documents that run up to 1.8 MB.
+- **FR-041**: A run that stops early MUST keep every answer already obtained, report that it was partial, and mark the statements of advisories it did not reach as unavailable rather than blank.
+- **FR-042**: The capability MUST add no new runtime dependency, and MUST behave identically on macOS, Windows and Linux.
+
+### Key Entities
+
+- **Scope statement**: One of the two values shown in the Affected Products column for an advisory — Cisco's `Vulnerable Products` statement or its `Products Confirmed Not Vulnerable` statement. Carries its heading, its text as normalised for display, and its availability. Belongs to exactly one advisory. Never carries a verdict and never participates in a count.
+- **Advisory scope document**: Cisco's per-advisory published machine-readable advisory document, as retrieved for one advisory. Contributes only the two scope statements, its own advisory identity for the FR-020 cross-check, and its revision identity for FR-035. Held in memory for the duration of a run and never persisted.
+- **Normalisation**: One permitted, individually tested alteration to Cisco's text. Exactly two exist (FR-014, FR-015). The set is closed: anything not enumerated is a defect.
+- **Unavailability**: The reason a scope statement could not be shown, drawn from a closed set of five causes — Cisco unreachable, no content published, document unreadable, document identified a different advisory, advisory not reached before the run stopped. Every unavailable statement resolves to exactly one. Rendered in the row as a short readable cause (FR-044), never as an absence and never as a blank.
+- **Advisory row**: The existing per-advisory row of the bundle-scoped report. Gains the two scope statements and the relocated publication date; its population, its impacted / unaffected / undetermined groupings, its release rollup and its first-fix release are unchanged.
+
+## Success Criteria *(mandatory)*
+
+### Measurable Outcomes
+
+- **SC-001**: An analyst can establish an advisory's product scope and its explicitly not-vulnerable products from the report alone — zero visits to Cisco's website per advisory, down from one per advisory, or 25 per review of the reference bundle.
+- **SC-002**: For every advisory in a bundle, each of the two statements is either shown or explicitly marked unavailable. No cell is silently blank, in any run.
+- **SC-003**: For the worked example advisory, the rendered cell matches the expected text character for character.
+- **SC-004**: Every difference between a rendered statement and Cisco's published statement is attributable to one of the two enumerated normalisations; a reviewer sampling advisories finds no unexplained alteration.
+- **SC-005**: Every advisory whose statements contain `<`, `>` or `&` renders those characters visibly and loses no surrounding text.
+- **SC-006**: Every device verdict, reason and count in a bundle report is identical to one produced before this feature — including when scope retrieval fails for some or all advisories.
+- **SC-007**: A reader with no knowledge of the tool's internals can distinguish "the scope statement was unavailable" from "Cisco affects no products".
+- **SC-008**: A phrase appearing only in a collapsed statement is findable by searching the report, and a printed report contains every statement in full.
+- **SC-009**: A review of a 25-advisory bundle remains practical: the number of requests made to Cisco's advisory API is unchanged, and — where retrievals succeed without retry — the run's total elapsed time grows by no more than one quarter.
+- **SC-012**: Every unavailable statement reports exactly one cause from the closed set, and an operator can tell from the report alone whether the cause was on their side of the network or Cisco's.
+- **SC-010**: No scope retrieval carries a credential or any inventory-derived value beyond the advisory identifier, and no retrieved document reaches disk.
+- **SC-011**: Every row's impacted, unaffected and undetermined counts continue to sum to its population, unchanged by the new column.
+
+## Assumptions
+
+Verified against live Cisco sources on 2026-07-28 across 29 advisories — the 25 of the reference bundle ERP-75736 plus 4 published between April 2024 and March 2026 from outside it. Recorded because the specification depends on them; the requirements above still handle the cases these observations do not guarantee.
+
+- **Both statements exist for every advisory.** All 29 documents carry a `Vulnerable Products` and a `Products Confirmed Not Vulnerable` statement under exactly those titles. FR-026 still requires the absent case to be handled, because a universal observation is not a guarantee.
+- **The document's location is published by the API.** Every advisory record the tool already retrieves carries a pointer to its machine-readable document, present in 100% of records checked. The pointer is therefore already in hand for every advisory that impacts something, and arrives with the individual advisory lookup the report already performs for every advisory that impacts nothing — so FR-019 costs no additional advisory-API request.
+- **Retrieval does not touch the advisory-API quota.** The documents are served unauthenticated from Cisco's Security Center, not from the quota-limited advisory API.
+- **The two normalisations reproduce the required output.** Applied to the worked example they reproduce the expected text exactly. Across the reference bundle they separate cleanly: 31 sentences are purely navigational and removed; 25 substantive sentences that merely name a section are retained. Applied to all 25 advisories no statement is emptied — which is why FR-016 is a guard rather than a routine path.
+- **The short form is the minority.** A two-paragraph statement occurs in only 6 of 25 advisories; the rest run to between 3 and 21 paragraphs, the longest at 4,783 characters with sub-headings, per-product conditions, configuration procedures and CLI output. FR-031 is written for that case, not the worked example.
+- **Structure is carried by whitespace, not markup.** Paragraphs are separated by blank lines, lists are one item per line, sub-headings are marked only by leading indentation (13 of 25), line endings are uniform and there are no tabs. Naive whitespace collapsing destroys all three, hence FR-017.
+- **The text is not markup but is hostile to unescaped rendering.** No document contains real markup tags, but 7 of 25 contain raw `<`, `>` or `&` in CLI placeholders and interface paths. Rendered unescaped, a browser silently swallows the placeholder and the text after it, so FR-018 is a correctness requirement and not only a safety one.
+- **A missing document is served as a success.** An unknown advisory identifier returns a success status with a zero-length body, and the content type declares a generic download rather than structured data — so neither signal detects absence, hence FR-027.
+- **The documents are large and the useful part is small.** Per advisory they measure 20 KB to 1.8 MB, totalling 12.9 MB for the reference bundle, against 42 KB of text actually rendered. Cisco serves them uncompressed with no entity tag or cache directive, so neither compression nor conditional requests reduce this. The statements sit in the first 13–24 KB of every document examined, which is what makes FR-040 achievable rather than aspirational.
+- **Retrieval is fast in absolute terms.** Individual retrievals completed in 0.24–0.79 seconds; all 25 in about 12 seconds sequentially, against an assessment of roughly 72 seconds for a 70-device inventory.
+- **The report can carry the text comfortably.** 42 KB added against a current report measured at 795 KB; FR-036's self-containment is not at risk.
+- **Documents are revised after publication**, each carrying its own revision identity — the basis for FR-035.
+
+Defaults adopted where BRD-006 left a question open, so this specification does not have to ask:
+
+- **The publication date keeps Cisco's value.** FR-003 permits a more compact presentation only while the full value remains available in the report, rather than trimming the time component outright.
+- **External links inside the statements are not made clickable.** FR-014 removes the bracket markup and keeps the link text, so the reference survives as text. Emitting URLs that originate from a document rather than from the API is deliberately avoided.
+- **The collapsed extract shows every sub-heading with its opening paragraph.** A first-paragraph-only extract would misrepresent the 13 of 25 advisories whose scope spans several products, by showing one product's condition as though it were the whole scope.
+- **The count of advisories missing scope statements is stated even when zero** (FR-030), matching the existing report's treatment of a zero-impact advisory: a stated zero is evidence, an omission is an absence.
+- **Cisco's `Details` statement is not shown**, though it is present in 8 of 25 advisories and often carries exploitability conditions. Out of scope for this feature.
+- **No bundle-wide aggregate of not-vulnerable products is produced.** A union across a bundle risks reading as an all-clear for products the tool never assessed.
+
+## Dependencies
+
+- **Cisco's per-advisory published advisory document** — input; the sole source of the two statements. A new resource on a host already admitted for bundle resolution.
+- **Cisco PSIRT openVuln advisory API** — input; supplies the pointer to that document and remains the sole source of every other advisory fact. Unchanged by this feature.
+- **The existing bundle resolution, assessment and per-advisory row construction** — input; produce the rows this feature adds a column to. Reused, not modified.
+- **The existing bundle-scoped report** — the surface being changed; its self-containment, escaping and never-overwrite guarantees carry over.
+- **Constitution 3.3.0** — satisfied on this branch. The *Advisory scope statements* bullet is the permission this feature depends on; its faithful-rendering obligation is the source of FR-012 through FR-016, and the Tests gate's per-normalisation requirement is the source of FR-013.
+- **`README.md` and `docs/index.html`** — outputs. Both describe the sources the tool reads, and `README.md` states that exactly one part of the tool contacts Cisco's Security Center — a description this feature makes inaccurate. Both must be corrected in the same pull request (Documentation gate). Should the change extend the set of components the constitution names as reusable without a terminal, that list must be extended in the same pull request.
+
+## Out of Scope
+
+- Changing any verdict, reason, count, row population, release rollup, or first-fix release.
+- Parsing the new source to infer applicability, narrow a row's population, or derive an advisory's covered product families.
+- The whole-fleet report, which has neither per-advisory rows nor a publication-date column.
+- Cisco's other published statements: summary, details, workarounds, fixed software, vulnerability policy, exploitation notice, source, legal disclaimer.
+- Per-CVE scope. Rows remain per advisory.
+- Summarising, shortening, translating, or otherwise generating prose from Cisco's text.
+- Interpreting Cisco's text as markup to be rendered.
+- Caching scope statements between runs, or any offline or air-gapped snapshot.
+- A new command, option, or mode. This changes what an existing report contains, not how a run is invoked.
+- Writing retrieved advisory documents to disk, or creating a temporary folder for them.

From 9594979c80046e79a8c01eff7534e14b206c0562 Mon Sep 17 00:00:00 2001
From: Ali Bahaloo <ali.bahaloo@telusinternational.com>
Date: Tue, 28 Jul 2026 23:45:10 -0700
Subject: [PATCH 3/7] =?UTF-8?q?docs(009):=20plan=20the=20Affected=20Produc?=
 =?UTF-8?q?ts=20column=20=E2=80=94=20csaf=20module,=203.4%=20reads?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Phase 0 research and Phase 1 design for spec 009. Every figure below was measured
against live Cisco sources across 29 advisories, not estimated.

Retrieval gets its own shared-surface module, caia/csaf.py, rather than extending
an existing one. Both alternatives are worse for reasons stronger than tidiness:
erp.py is deliberately built with no route to supplying advisory facts ("the
cheapest way to keep a rule is to leave no route to breaking it"), so extending it
would dismantle a safeguard to avoid creating a file; and psirt.py owns the PSIRT
credentials that FR-022 forbids this request from carrying. Consequence: a PATCH
amendment (3.3.0 -> 3.3.1) adding `csaf` to Principle VI's enumeration. The
criterion already reaches it, so only the name is missing.

FR-040 is worth honouring. Streaming each response and stopping once the top-level
`document` object parses transfers 3.4% of the bytes: 424 KB instead of 12.9 MB for
the reference bundle, 23 KB instead of 1.74 MB for the largest advisory. It needs no
JSON repair — raw_decode raises while the value is incomplete, so the loop is
accumulate/attempt/read-more. Verified live, including at a hostile 997-byte chunk
size. `document` is the first top-level key in 25 of 25 and carries both the notes
and the tracking identity, so one read serves FR-008, FR-020 and FR-035.

The design also found a defect in the spec. FR-031 required the extract to show
"every sub-heading with its opening paragraph", which breaks on
cisco-sa-ftd-tcp-dos-rHfqnwRg — its sub-headings are diagnostic procedures, not
products, and its scope claim sits above the first heading. The rule therefore
discarded the scope and showed five "Determine whether..." headings in its place:
the exact misrepresentation FR-031 existed to prevent. FR-031 now leads with the
scope claim and lists sub-heading titles as an outline; FR-048 forbids both failure
modes; a User Story 2 scenario covers the procedure-heading shape.

One trap recorded rather than left to be discovered: a partially-read buffer decoded
with errors="ignore" silently drops a multi-byte character split across a chunk
boundary, corrupting text in a feature whose whole point is faithful rendering. The
contract requires strict decoding, treating UnicodeDecodeError as "read more". No
statement in the sample contains non-ASCII, so the path is currently unexercised.

Artifacts: research.md (7 decisions), data-model.md, contracts/csaf-access.md,
contracts/affected-products-column.md, quickstart.md. Constitution gate passes with
two in-PR obligations, both anticipated by 3.3.0's follow-up note: the 3.3.1 PATCH
and the README/docs correction. VERSION moves to 4.3.0 when the feature lands.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../contracts/affected-products-column.md     | 149 ++++++++++
 .../contracts/csaf-access.md                  | 165 +++++++++++
 .../data-model.md                             | 147 ++++++++++
 specs/009-affected-products-column/plan.md    | 202 ++++++++++++++
 .../quickstart.md                             | 137 +++++++++
 .../009-affected-products-column/research.md  | 261 ++++++++++++++++++
 specs/009-affected-products-column/spec.md    |   6 +-
 7 files changed, 1065 insertions(+), 2 deletions(-)
 create mode 100644 specs/009-affected-products-column/contracts/affected-products-column.md
 create mode 100644 specs/009-affected-products-column/contracts/csaf-access.md
 create mode 100644 specs/009-affected-products-column/data-model.md
 create mode 100644 specs/009-affected-products-column/plan.md
 create mode 100644 specs/009-affected-products-column/quickstart.md
 create mode 100644 specs/009-affected-products-column/research.md

diff --git a/specs/009-affected-products-column/contracts/affected-products-column.md b/specs/009-affected-products-column/contracts/affected-products-column.md
new file mode 100644
index 0000000..2b5f4e3
--- /dev/null
+++ b/specs/009-affected-products-column/contracts/affected-products-column.md
@@ -0,0 +1,149 @@
+# Report Contract: the Affected Products column
+
+Amends `specs/008-erp-bundle-scoped-report/contracts/bundle-report.md`. Everything not stated here is
+unchanged — the whole-fleet report is untouched (FR-037), and so are every verdict, count, population,
+release rollup and first-fix release (FR-011).
+
+## Table shape
+
+| # | Before (4.2.1) | After | Requirement |
+| --- | --- | --- | --- |
+| 1 | `Advisory` — severity, CVSS, id, title, CVEs | `Advisory` — **+ publication date beside the CVSS score** | FR-001 |
+| 2 | `Published` — the date, `white-space: nowrap` | **`Affected Products`** — Cisco's two scope statements | FR-002, FR-004, FR-005 |
+| 3 | `Impacted products` | **`Your impacted devices`** | FR-006 |
+
+Column 3's rename is not cosmetic. `Affected Products` (Cisco's stated scope) and
+`Impacted products` (this reader's fleet) are near-synonyms for very different things, and the risk
+being removed is a reader concluding they are covered — or exposed — on the strength of Cisco's
+generic scope (FR-007).
+
+### Widths
+
+`c-adv` stays at 30%. The 12% released by the old date column goes to Affected Products. Column 3
+keeps its share. The advisory table is **not** `table-fixed` today; FR-033 requires that expanding one
+row cannot reflow another, so the two scope-bearing columns need explicit widths — the same reason the
+appendix tables were made fixed in 4.2.1.
+
+## Column 1 — the relocated date
+
+```html
+<span class="sev sev-critical">CRITICAL</span>
+<span class="cvss">CVSS 10.0</span>
+<span class="pubdate">published 2026-03-04T16:00:00</span>
+```
+
+- Cisco's `firstPublished` value, unchanged (FR-003). Presenting it more compactly is permitted only
+  while the full value stays available in the report.
+- Smaller than the CVSS score, and visually subordinate to it.
+- An advisory with no publication date renders as absent, never inferred (FR-004).
+- **No `Published` column remains** (FR-002).
+
+## Column 2 — Affected Products
+
+Per advisory, in this order (FR-008):
+
+1. Heading `Vulnerable Products`, then its statement.
+2. Heading `Products Confirmed Not Vulnerable`, then its statement.
+
+Populated for **every** advisory in the bundle, including those that impact nothing (FR-009) — a
+zero-impact row is where Cisco's scope matters most.
+
+### Provenance line
+
+The column states, once, that its content is Cisco's own published statement about the advisory and
+not a finding about the reader's inventory (FR-007). It is a statement in the report, not an inference
+the reader is expected to draw from the column title.
+
+### Structure
+
+Rendered from the `Block` sequence in `data-model.md`, never from raw text:
+
+| Block | Rendering | Requirement |
+| --- | --- | --- |
+| `heading` | Visually distinct from body text — weight or size, not colour alone | FR-017, FR-034 |
+| `text` | A line; consecutive lines keep their breaks | FR-017 |
+| `break` | Paragraph separation | FR-017 |
+
+A one-item-per-line product list MUST NOT be run together into a paragraph. This is load-bearing:
+Cisco's not-vulnerable lists are line-separated with no blank lines, so collapsing whitespace turns
+four named products into one sentence.
+
+### Extract and disclosure
+
+```html
+<div class="scope">
+  <div class="scope-head">Vulnerable Products</div>
+  <div class="scope-extract">…scope claim, then sub-heading titles…</div>
+  <details class="scope-more"><summary>show full statement</summary>…remainder…</details>
+</div>
+```
+
+- Extract = all text before the first sub-heading, plus every sub-heading **title** (FR-031).
+- The disclosure appears **if and only if** text lies beyond the extract, so its presence always means
+  text is hidden (FR-031).
+- Sub-heading *bodies* are never in the extract. Sub-headings name products in some advisories and
+  diagnostic procedures in others, so a heading's opening paragraph cannot be assumed to state scope
+  (FR-048, research Decision 5).
+- Collapsed, **never truncated**: the remainder stays in the document, findable by browser search, and
+  present in print and PDF export (FR-032). `<details>` satisfies this; a fixed-height scroll box or a
+  character cap would not.
+- The existing `#expand-all` control opens these along with the report's other disclosures (FR-034) —
+  it already targets every `details`, so no change is needed beyond using `details`.
+
+### Escaping
+
+Every rendered character passes through `esc()` (FR-018). This is **correctness**, not only safety:
+7 of 25 statements contain raw `<`, `>` or `&` in CLI placeholders (`<interface_name>`) and interface
+paths (`Devices > VPN > Remote Access`). Unescaped, a browser treats `<interface_name>` as an unknown
+tag and deletes it *and the text up to the next `>`* — the report would silently omit part of Cisco's
+scope with no visible sign.
+
+## Unavailability
+
+An unavailable statement renders as an explicit notice naming its cause, never blank and never "none"
+(FR-026, FR-044):
+
+```html
+<div class="scope-unavail">
+  <span class="unavail-mark">▲</span> Cisco's product-scope statement could not be retrieved —
+  <em>Cisco could not be reached.</em> Whether this advisory affects other products is unknown.
+</div>
+```
+
+- One of the five closed causes (FR-045); see `data-model.md`.
+- Marked in **words as well as colour**, matching how undetermined devices are already treated —
+  the report must survive greyscale, print, and a reader with a colour-vision deficiency (FR-034).
+- The advisory identifier remains a link to Cisco, so scope can be checked at source (US3-2).
+- Where one statement is available and the other is not, only the absent one carries the notice
+  (FR-028).
+- Reusing the existing `.undet` yellow treatment is deliberate: the report already teaches the reader
+  that yellow-plus-words means *unknown, not safe*, and unavailable scope is the same claim.
+
+## Header
+
+Two additions to the existing fact list:
+
+| Fact | Content | Requirement |
+| --- | --- | --- |
+| Scope statements missing | The count, **stated even when zero** | FR-030 |
+| — | Per-advisory document revisions, in the auditability appendix | FR-035 |
+
+A stated zero is evidence; an omitted zero is an absence. This matches the choice already made for
+suppressed out-of-bundle advisories in 4.2.0.
+
+## Invariants preserved
+
+| Invariant | Status |
+| --- | --- |
+| `impacted + unaffected + undetermined == population` per row | Unchanged (SC-011) |
+| Undetermined devices never counted or rendered as unaffected | Unchanged |
+| Deterministic row order | Unchanged — scope never affects `row_sort_key` (FR-011) |
+| Filters and sorts (`all` / `impacting` / `clean`, severity, most-devices) | Unchanged — scope is not a filter or sort key (FR-011) |
+| Single self-contained file, no network at render time | Unchanged (FR-036) |
+| Reports never overwritten | Unchanged (FR-036) |
+| Whole-fleet report | Untouched (FR-037) |
+
+## Size
+
+42 KB of normalised statement text for a 25-advisory bundle, against a current report measured at
+795 KB. Self-containment is not at risk.
diff --git a/specs/009-affected-products-column/contracts/csaf-access.md b/specs/009-affected-products-column/contracts/csaf-access.md
new file mode 100644
index 0000000..7437847
--- /dev/null
+++ b/specs/009-affected-products-column/contracts/csaf-access.md
@@ -0,0 +1,165 @@
+# External Interface Contract: Cisco's published per-advisory advisory documents (CSAF)
+
+The third external interface this tool depends on, alongside the PSIRT API
+(`specs/006-api-inventory-check/contracts/psirt-access.md`) and the bundle page
+(`specs/008-erp-bundle-scoped-report/contracts/erp-access.md`). Every behaviour recorded here was
+observed against live Cisco sources on 2026-07-28 across 29 advisories.
+
+## Host
+
+| Host | Purpose |
+| --- | --- |
+| `sec.cloudapps.cisco.com` | Read one advisory's `Vulnerable Products` and `Products Confirmed Not Vulnerable` statements |
+
+Not a new host — it was admitted for bundle resolution in constitution 3.2.0 — but a **new resource
+on it**, which 3.2.0's Networking bullet did not permit ("read *solely* to resolve a bundle…").
+Constitution **3.3.0** admits it via the *Advisory scope statements* bullet. That amendment is
+already enacted on this branch; it is not outstanding work.
+
+## How the location is obtained
+
+**The URL is never constructed.** It is taken from the `csafUrl` field of the advisory record the
+report already holds (FR-019).
+
+```
+csafUrl = https://sec.cloudapps.cisco.com/security/center/contentjson/
+          CiscoSecurityAdvisory/<advisory-id>/csaf/<advisory-id>.json
+```
+
+Observed present in **100%** of advisory records checked: 6 of 6 from one device-scoped question, 28
+of 28 from another, 1 of 1 from a direct advisory lookup. Every value matched the pattern above.
+
+> Two published paths serve **byte-identical** documents: `/content/…` and `/contentjson/…`. The API
+> publishes the `contentjson` form. Because the tool follows the supplied pointer, it never needs to
+> know that — which is the point of FR-019.
+
+This costs **zero additional advisory-API requests** (FR-024): an impacting advisory's record is
+already on the device result, and a zero-impact advisory's record already arrives via the
+`get_advisory()` lookup the bundle report performs today.
+
+## Request
+
+```
+GET <csafUrl>
+Accept: application/json
+```
+
+- **No authentication.** It MUST NOT carry the PSIRT credentials (FR-022).
+- **No inventory-derived data.** The only value sent is the advisory identifier already inside the
+  URL — not a device name, and not the family/platform/release triple the advisory API is permitted
+  (FR-023).
+- **Sequential, with a small fixed courtesy delay** between requests; never a concurrent burst
+  (FR-046). Cisco publishes no request allowance for this host, so none is assumed.
+- **Time-bounded per attempt.** A timeout counts as a transport failure (FR-039).
+- **One retry, transport failures only** (FR-043). Attempts never exceed two.
+
+## Response — observed characteristics
+
+| Property | Observed |
+| --- | --- |
+| Status (document exists) | `200` |
+| Status (unknown advisory) | **`200` with a zero-length body** — *not* `404` |
+| `Content-Type` | `application/download;charset=UTF-8` — *not* a JSON type |
+| `Content-Encoding` | absent — served uncompressed, `--compressed` makes no difference |
+| `ETag` / `Last-Modified` / `Cache-Control` | **all absent** — conditional requests are not possible |
+| Size | 20,351 B – 1,785,362 B; 12,889,422 B for the 25-advisory reference bundle |
+| Latency | 0.24 s – 0.79 s per document |
+
+> **Neither the status code nor the content type can detect absence.** A missing document is a
+> success with an empty body, and the content type declares a generic download for a JSON payload.
+> Classification MUST come from the body (FR-027). This mirrors the divergence already recorded for
+> the advisory API, where the tool keys on status and `errorCode` rather than message text — here the
+> status carries no information at all, so the body is the only signal.
+
+## Reading only what is needed
+
+The response is streamed and reading stops as soon as the top-level `document` object parses
+completely (FR-040). `json.JSONDecoder().raw_decode(text, index)` raises `ValueError` while the value
+is incomplete, so the loop is *accumulate → attempt → read more*. No JSON repair and no brace
+counting.
+
+Verified across all 25 reference-bundle documents:
+
+- `document` is the **first top-level key** in all 25.
+- `document.notes` precedes `product_tree` in all 25.
+- `document` contains **both** `notes` and `tracking` in all 25 — one read satisfies the statements
+  (FR-008), the identity check (FR-020) and the revision (FR-035).
+
+| | Full documents | `document` only |
+| --- | --- | --- |
+| Reference bundle | 12,579,885 B | 423,632 B (**3.4%**) |
+| Largest advisory | 1,740,490 B | 22,931 B |
+
+Verified live: three advisories read in 16,384 / 32,768 / 32,768 B in 0.29–0.46 s, with matching
+identity and both statements present. Re-verified against the largest advisory with a hostile
+997-byte chunk size: 22,931 B, text intact.
+
+**Required safeguards.**
+
+- Decode the accumulated buffer **strictly**; treat `UnicodeDecodeError` as "read more". Decoding
+  with `errors="ignore"` would silently drop a multi-byte character split across a chunk boundary and
+  corrupt the very text this feature exists to render faithfully. No scope statement in the sample
+  contains non-ASCII, so this path is currently unexercised — which is why it is a rule here rather
+  than a discovery later.
+- Cap the buffer. If `document` has not parsed by the cap, fall back to reading the whole body; if
+  that also fails, the cause is `unreadable`.
+
+## What may be taken from the document
+
+The document is a **bounded source**, not an authority. This table is the contract's central rule.
+
+| | Field | Why |
+| --- | --- | --- |
+| ✅ | `document.notes[title="Vulnerable Products"].text` | The permitted statement (FR-008) |
+| ✅ | `document.notes[title="Products Confirmed Not Vulnerable"].text` | The permitted statement (FR-008) |
+| ✅ | `document.tracking.id` | Identity cross-check only (FR-020) |
+| ✅ | `document.tracking.version` | Revision record only (FR-035) |
+| ❌ | `document.title` | Advisory title — **the API owns it** |
+| ❌ | `document.notes[title="Summary"]` and every other note | FR-010 |
+| ❌ | `document.tracking.initial_release_date` / `current_release_date` | Publication date — **the API owns it** |
+| ❌ | `product_tree` | Affected products/releases — **the API owns it** |
+| ❌ | `vulnerabilities[]` | CVEs, scores, remediations — **the API owns it** |
+
+A disagreement between this document and the advisory API is resolved **in the API's favour, without
+exception** (constitution 3.3.0, *Advisory scope statements*).
+
+Notes are always present in the sample under exactly these titles — 9 titles in every document
+(`Summary`, `Vulnerable Products`, `Products Confirmed Not Vulnerable`, `Workarounds`, `Fixed
+Software`, `Vulnerability Policy`, `Exploitation and Public Announcements`, `Source`, `Legal
+Disclaimer`) plus `Details` in 8 of 25. Both required titles were present in **29 of 29** documents,
+including four from outside the reference bundle published between April 2024 and March 2026.
+
+## Text characteristics the caller must handle
+
+| Property | Observed | Consequence |
+| --- | --- | --- |
+| Line endings | `\r\n` throughout; no bare `\n`, no tabs | Split on `\r\n` |
+| Paragraphs | Blank-line separated | Preserve (FR-017) |
+| Lists | One item per line, **no** blank line between items | Line breaks are significant (FR-017) |
+| Sub-headings | Marked **only** by 2+ leading spaces; in 13 of 25 `Vulnerable Products` | The sole structural signal |
+| Inline links | `Text ["#fs"]` and `Text ["https://…"]`; in 25 of 25 | Removed, link text retained (FR-014) |
+| Raw `<`, `>`, `&` | In 7 of 25 — `<interface_name>`, `Devices > VPN > Remote Access` | Escaping is a **correctness** requirement: unescaped, a browser deletes the placeholder and the text after it (FR-018) |
+| Real markup tags | None observed | Handled as text, never rendered as markup |
+| Non-ASCII | None observed | Strict decoding still required (above) |
+| Length | `Vulnerable Products` 217–4,783 chars, median 1,016; `Products Confirmed Not Vulnerable` 218–818, median 320 | Two-paragraph form in only 6 of 25 (FR-031) |
+
+## Failure classification
+
+| Condition | Cause reported |
+| --- | --- |
+| Transport error or timeout, after the FR-043 retry | `unreachable` |
+| Zero-length body | `no-content` |
+| `document.notes` carries no entry with that title | `no-content` (per statement — FR-028) |
+| Body unparseable, or no `document` within the cap | `unreadable` |
+| `document.tracking.id` ≠ advisory asked for | `identity-mismatch` |
+| Run ended before this advisory | `not-reached` |
+
+Every failure is **non-fatal** (FR-029): the report is still written and no device verdict, reason or
+count changes. No retrieved document is written to disk and no temporary folder is created (FR-025).
+
+## Headless contract
+
+`csaf` is on the shared surface (constitution 3.3.1 — Principle VI). It MUST NOT print, prompt,
+consult the working folder, write a file, or exit the process (FR-038). Progress is reported through
+a caller-supplied callback, exactly as `assessment.analyze` does (FR-047); the terminal layer owns
+the output.
diff --git a/specs/009-affected-products-column/data-model.md b/specs/009-affected-products-column/data-model.md
new file mode 100644
index 0000000..0fef4b2
--- /dev/null
+++ b/specs/009-affected-products-column/data-model.md
@@ -0,0 +1,147 @@
+# Data Model: Affected Products Column
+
+**Feature**: 009-affected-products-column · **Date**: 2026-07-28
+
+Everything here is held in memory for one run and never persisted (FR-025). No storage, no schema,
+no migration.
+
+---
+
+## `ScopeStatement`
+
+One of the two values shown in the Affected Products column for one advisory. Produced by `csaf`,
+consumed by `bundle_report`.
+
+| Field | Type | Notes |
+| --- | --- | --- |
+| `title` | str | `"Vulnerable Products"` or `"Products Confirmed Not Vulnerable"`. Cisco's own title, used as the rendered heading (FR-008). |
+| `blocks` | tuple of `Block` | The normalised statement, structure preserved (FR-017). Empty when `unavailable` is set. |
+| `unavailable` | str or `""` | One of the five FR-044 cause keys, or `""` when the statement is present. |
+
+**Invariants**
+
+- Exactly one of `blocks` (non-empty) or `unavailable` (non-empty) is set. A statement is never both
+  present and unavailable, and never neither — this is what makes FR-026's "never silently blank"
+  structural rather than a rendering convention.
+- `blocks` is never empty when `unavailable` is `""`: FR-016 requires falling back to the
+  un-normalised text rather than yielding nothing.
+- Carries no verdict, no device, and no count. Nothing downstream may read it to decide anything
+  (FR-011).
+
+---
+
+## `Block`
+
+One line of a statement, classified. The unit that makes FR-017 testable without rendering HTML.
+
+| Field | Type | Notes |
+| --- | --- | --- |
+| `kind` | str | `"heading"`, `"text"`, or `"break"`. |
+| `text` | str | The normalised line. Empty for `"break"`. |
+
+**Derivation**
+
+- `"heading"` — source line began with two or more spaces before its first non-space character. The
+  only sub-heading signal the format has (research Decision 4).
+- `"break"` — a source line that is blank, or became blank after normalisation. Consecutive breaks
+  collapse to one; leading and trailing breaks are dropped.
+- `"text"` — everything else. Line breaks between consecutive `"text"` blocks are significant: they
+  distinguish a one-item-per-line product list from a wrapped paragraph, and FR-017 forbids running
+  them together.
+
+**Extract selection (FR-031, FR-048)** is a pure function over `blocks`, returning the subset shown
+before disclosure:
+
+- Every block before the first `"heading"` — the scope claim and any conditions listed with it.
+- The `"heading"` blocks themselves, as an outline of the statement's sections.
+- Where there is no `"heading"` at all: every block up to the first `"break"`.
+
+Sub-heading *bodies* are never in the extract. Research Decision 5 records why: sub-headings name
+products in some advisories and diagnostic procedures in others, so a heading's opening paragraph
+cannot be assumed to describe scope.
+
+---
+
+## `AdvisoryScope`
+
+The pair of statements for one advisory, plus what is needed to prove where they came from.
+
+| Field | Type | Notes |
+| --- | --- | --- |
+| `advisory_id` | str | The advisory these belong to. |
+| `vulnerable` | `ScopeStatement` | Cisco's `Vulnerable Products`. Rendered first (FR-008). |
+| `not_vulnerable` | `ScopeStatement` | Cisco's `Products Confirmed Not Vulnerable`. |
+| `revision` | str | `document.tracking.version`, or `""`. The FR-035 audit record. |
+
+**Invariants**
+
+- Both statements are always present as objects; either may be `unavailable` independently (FR-028).
+- `advisory_id` was verified against `document.tracking.id` before any field was used (FR-020). A
+  mismatch yields an `AdvisoryScope` whose statements are both unavailable with the
+  `identity-mismatch` cause — never one carrying another advisory's text.
+
+**Relationships.** One per advisory in the bundle, keyed by advisory identifier. Never keyed by
+device: scope is a property of the advisory, and coupling it to a device would invite exactly the
+inference FR-011 forbids.
+
+---
+
+## Unavailability causes
+
+A closed set of five (FR-045). Every unavailable statement resolves to exactly one.
+
+| Cause | Meaning | Detected by |
+| --- | --- | --- |
+| `unreachable` | Cisco could not be reached | Transport error or per-attempt timeout, after the FR-043 retry |
+| `no-content` | Cisco published no content for this statement | Zero-length body, or `document.notes` carries no entry with that title |
+| `unreadable` | The document could not be read | Body present but unparseable, or no `document` object within the buffer cap |
+| `identity-mismatch` | The document described a different advisory | `document.tracking.id` ≠ the advisory asked for |
+| `not-reached` | The run stopped before this advisory | Run ended early (FR-041) |
+
+Each maps to one short reader-facing sentence in the report (FR-044). The set is closed so that a
+new failure mode cannot silently render as a blank cell — an unclassifiable failure must be reported
+as `unreadable`, not omitted.
+
+---
+
+## Changes to existing entities
+
+### `bundle.Row` — two additions, no behaviour change
+
+| Addition | Type | Notes |
+| --- | --- | --- |
+| `csaf_url` | property → str | Reads `record["csafUrl"]`, or `""`. Present in 100% of records measured (research Decision 3). The document location is never constructed (FR-019). |
+| `published` | *unchanged* | Still `record["firstPublished"]`. Only its rendered *position* moves (FR-001); the value does not change. |
+
+`population`, `impacted`, `unaffected`, `undetermined`, `release_rollup()`, `fix_for()`,
+`first_fix()`, `accounts()` and `row_sort_key()` are **untouched**. The accounting invariant
+`impacted + unaffected + undetermined == population` continues to hold and is unaffected by scope
+(SC-011).
+
+### `bundle` module — one new pure function
+
+`scope_targets(bundle_advisory_ids, devices, records) -> {advisory_id: csaf_url}`
+
+Lets the terminal layer learn every document location before rendering, without `bundle_report`
+performing network I/O. Pure, and returns an entry for every bundle advisory — an advisory whose
+record is missing maps to `""`, which resolves to the `no-content` cause rather than being dropped.
+
+### Report inputs — one new optional argument
+
+`bundle_report.render`, `write_report` and `build_and_write` each gain
+`scopes=None` — a `{advisory_id: AdvisoryScope}` mapping. When omitted, every cell renders as
+unavailable rather than blank, so an older caller cannot produce a report that reads as "no products
+affected".
+
+---
+
+## What is deliberately not modelled
+
+- **No device relationship.** Scope statements attach to advisories only. A join to devices would
+  create the path FR-011 forbids.
+- **No parsed product list.** Cisco's prose is not decomposed into product entities. Parsing it into
+  structured products would make it usable for inference, which §5.2 of BRD-006 and FR-011 exclude —
+  and would require interpreting text this feature is required to render, not understand.
+- **No cross-run state.** No cache, no revision history, no "changed since last run".
+- **No `Details`, `Summary`, or any other Cisco statement.** FR-010 and FR-021 restrict the document
+  to the two statements plus the identity and revision fields.
diff --git a/specs/009-affected-products-column/plan.md b/specs/009-affected-products-column/plan.md
new file mode 100644
index 0000000..dddcb25
--- /dev/null
+++ b/specs/009-affected-products-column/plan.md
@@ -0,0 +1,202 @@
+# Implementation Plan: Affected Products Column in the Bundle-Scoped Report
+
+**Branch**: `009-affected-products-column` | **Date**: 2026-07-28 | **Spec**: [spec.md](./spec.md)
+
+**Input**: Feature specification from `/specs/009-affected-products-column/spec.md`
+
+## Summary
+
+Move each advisory's publication date into the Advisory column beside its CVSS score, retitle the
+freed column **Affected Products** and fill it with Cisco's own `Vulnerable Products` and `Products
+Confirmed Not Vulnerable` statements, and retitle the third column **Your impacted devices** so
+Cisco's product scope cannot be mistaken for a finding about the reader's fleet.
+
+The statements come from Cisco's per-advisory CSAF document, reached by following the `csafUrl` the
+advisory API already returns in every record the report holds — so no URL is constructed and no
+additional advisory-API request is made. A new shared-surface module `caia/csaf.py` owns retrieval and
+the two permitted normalisations. Retrieval streams each response and stops once the top-level
+`document` object parses, transferring **3.4%** of what a full read would cost (424 KB instead of 12.9
+MB for the reference bundle). Every failure is non-fatal and renders as an explicit cause, never a
+blank cell. Verdicts, counts and the whole-fleet report are untouched.
+
+## Technical Context
+
+**Language/Version**: Python 3.9+ (unchanged)
+
+**Primary Dependencies**: None added. Standard library only for this feature — `urllib.request`,
+`json`, `re`, `html`. Existing runtime set (`openpyxl`, `python-dotenv`) unchanged (FR-042).
+
+**Storage**: N/A. Retrieved documents are held in memory for one run and never written to disk
+(FR-025).
+
+**Testing**: `unittest` (stdlib), run via `python -m unittest discover -s tests`. All new tests run
+with no credentials and no network, from recorded fixtures — required by the constitution's Tests gate.
+
+**Target Platform**: macOS, Windows, Linux — identical behaviour (FR-042).
+
+**Project Type**: Single Python package that is both the `caia` CLI and an importable library.
+
+**Performance Goals**: Scope retrieval adds ≤ ¼ of a run's elapsed time where retrievals succeed
+without retry (FR-039). Measured: ~12 s of retrieval against a ~72 s assessment for a 70-device
+inventory and a 25-advisory bundle. Advisory-API request count unchanged (FR-024).
+
+**Constraints**: Each retrieval attempt time-bounded; at most two attempts per advisory (FR-043);
+sequential with a fixed courtesy delay, never a burst (FR-046); ≤ 3.4% of document bytes transferred
+(FR-040); report remains a single self-contained file rendering with no network (FR-036).
+
+**Scale/Scope**: 25 advisories per bundle (reference), 70-device inventory. 42 KB of statement text
+added to a report currently measured at 795 KB. Five modules touched, one added.
+
+## Constitution Check
+
+*GATE: evaluated against constitution **3.3.0** (amended on this branch as this feature's
+prerequisite). Re-checked after Phase 1 — see the gate outcome below.*
+
+| Principle / constraint | Verdict | Basis |
+| --- | --- | --- |
+| **I. Standard-Library-First** | ✅ Pass | No new dependency. `urllib.request` + `json` for retrieval, `re` for normalisation, `html.escape` for rendering. The incremental read uses `json.JSONDecoder.raw_decode`, already in the stdlib (research Decision 2). |
+| **II. Cross-Platform Parity** | ✅ Pass | No paths, no shell, no OS branch. Pure text and HTTP. |
+| **III. CLI-First, Scriptable** | ✅ Pass | No new command, flag, or mode. The existing `--erp` path gains content. Nothing is reachable only interactively. |
+| **IV. Conservative & Traceable Analysis** | ✅ Pass | The column cannot influence any verdict, count, population, family derivation, ordering, filter or sort (FR-011). An unavailable statement renders as an explicit cause and never as an absence (FR-026, FR-044) — the same discipline as an undetermined device never reading as unaffected. Text is rendered faithfully under exactly two enumerated normalisations (FR-012–FR-016). |
+| **V. Secrets Hygiene & Data Locality** | ✅ Pass | Retrieval is unauthenticated (FR-022) and carries no inventory-derived data — not even the family/platform/release triple the advisory API is permitted (FR-023). No document reaches disk (FR-025). |
+| **VI. Headless Shared Surface** | ⚠️ **Amendment required** | `csaf` is a shared-surface module and must be added to Principle VI's enumeration. The *criterion* already covers it ("modules that … retrieve Cisco-published content a report attributes to Cisco", added in 3.3.0); only the name is missing. **PATCH: 3.3.0 → 3.3.1.** Tracked below. |
+| **Source of truth** | ✅ Pass | Every advisory fact — title, severity, score, CVEs, publication date, fixing release, affected platform — still comes from the advisory API. The document contributes two statements plus an identity check and a revision, and nothing else (contract table, FR-021). |
+| **Scope selectors** | ✅ Pass | Untouched and not relied upon. The bundle page still supplies only membership and its own identity. |
+| **Advisory scope statements** (new in 3.3.0) | ✅ Pass | This is the permission the feature exercises. Bounded to the two statements, located via the API-supplied pointer, identity cross-checked, API wins on disagreement, faithfully rendered under enumerated normalisations. |
+| **Networking** | ✅ Pass | No new host. `sec.cloudapps.cisco.com` was admitted in 3.2.0 and extended to this resource in 3.3.0. Retrieval is time-bounded and cannot fail a run. |
+| **Inputs/outputs** | ✅ Pass | Single self-contained file, never overwritten. All Cisco content escaped — and 3.3.0 records why that is a correctness rule: unescaped `<interface_name>` deletes the text after it. |
+| **Consumers / released interface** | ⚠️ **Docs required** | `README.md`'s shared-surface table gains a `csaf.py` row, and its `erp.py` row ("the only module that talks to Cisco's Security Center") becomes false and must be corrected. `docs/index.html` mirrored. Same PR (Documentation gate). |
+| **Tests gate** | ✅ Pass by design | One test per normalisation plus one asserting no other alteration occurs (FR-013) — required verbatim by 3.3.0. Headless property covered. All tests credential-free and network-free. |
+| **Versioning gate** | ✅ Pass | Shared surface gains a module → MINOR product bump. `VERSION` **4.2.1 → 4.3.0**. |
+| **Branching** | ✅ Pass | Feature branch `009-affected-products-column` off `main`; merges via PR. |
+
+### Gate outcome
+
+**Pass, with two mandatory in-PR obligations.** Neither is a violation needing justification in
+Complexity Tracking; both are recorded work, and both were anticipated by 3.3.0's own follow-up note:
+
+1. **Constitution 3.3.0 → 3.3.1** — add `csaf` to Principle VI's module enumeration. PATCH, because
+   the criterion already reaches the module; only the enumeration is being made accurate.
+2. **`README.md` + `docs/index.html`** — shared-surface table row added, `erp.py` description
+   corrected.
+
+Re-checked after Phase 1 design: no verdict changed. The design adds no dependency, no host, no
+command, and no path by which the new column can reach a verdict.
+
+## Project Structure
+
+### Documentation (this feature)
+
+```text
+specs/009-affected-products-column/
+├── plan.md                              # This file
+├── research.md                          # Phase 0 — 7 decisions, all measured
+├── data-model.md                        # Phase 1 — ScopeStatement, Block, AdvisoryScope, causes
+├── quickstart.md                        # Phase 1 — validation guide
+├── contracts/
+│   ├── csaf-access.md                   # Phase 1 — external interface (new)
+│   └── affected-products-column.md      # Phase 1 — report contract (amends spec 008's)
+├── checklists/
+│   └── requirements.md                  # From /speckit-specify + /speckit-clarify
+└── tasks.md                             # Phase 2 — NOT created by /speckit-plan
+```
+
+### Source code (repository root)
+
+```text
+caia/
+├── csaf.py            # NEW — shared surface. The only module that reads Cisco's published
+│                      #   advisory documents. Retrieval (streamed, document-only, paced, one
+│                      #   transport retry), classification into the five causes, the two
+│                      #   normalisations, the Block model, and extract selection. Pure functions
+│                      #   separated from I/O, mirroring erp.py's parse()/fetch() split.
+├── bundle.py          # + Row.csaf_url property; + scope_targets() pure helper.
+│                      #   Aggregation, families, populations and ordering UNCHANGED.
+├── bundle_report.py   # Column titles; date relocated into column 1; Affected Products cell
+│                      #   (headings, extract, <details>, unavailability notice, provenance line);
+│                      #   header missing-count; revision appendix; CSS/JS.
+├── analyzer.py        # Fetch scopes between the assessment and the report, reporting progress
+│                      #   through the existing ui callbacks; pass scopes into the report.
+├── erp.py             # UNCHANGED — deliberately. See research Decision 1.
+├── psirt.py           # UNCHANGED — csafUrl is already in every record it returns.
+├── assessment.py      # UNCHANGED.
+├── matching.py        # UNCHANGED.
+├── html_report.py     # UNCHANGED — whole-fleet report untouched (FR-037).
+└── inventory.py       # UNCHANGED.
+
+tests/
+├── test_csaf.py                    # NEW — normalisation (one test per rule + a no-other-change
+│                                   #   test), extract, incremental read, classification, retry,
+│                                   #   pacing, identity, headless property.
+├── fixtures/csaf_documents.py      # NEW — recorded `document` objects: worked example,
+│                                   #   product-heading multi-section, procedure-heading
+│                                   #   (cisco-sa-ftd-tcp-dos-rHfqnwRg), raw <>& case, and the
+│                                   #   four failure bodies.
+├── test_bundle.py                  # + csaf_url, scope_targets, accounting invariant unchanged.
+├── test_bundle_report.py           # + column titles, date position, cell structure, escaping
+│                                   #   (asserting trailing text survives), unavailability.
+└── test_bundle_flow.py             # + verdicts identical across retrieval success/partial/total
+                                    #   failure; no disk writes; progress reported.
+
+.specify/memory/constitution.md      # 3.3.0 → 3.3.1 (Principle VI enumeration)
+README.md                            # shared-surface table: + csaf.py, correct erp.py
+docs/index.html                      # mirrored
+VERSION                              # 4.2.1 → 4.3.0
+```
+
+**Structure Decision**: single package, no new layer. The feature slots into the existing
+one-module-per-external-concern shape — `psirt` for the advisory API, `erp` for the bundle page, and
+now `csaf` for published advisory documents. Research Decision 1 records why neither existing module
+was extended: `erp.py` is deliberately built with no route to supplying advisory facts, and `psirt.py`
+owns the credentials FR-022 forbids this request from carrying.
+
+### Data flow
+
+```text
+assessment.analyze()             → devices (each Impacted device's advisories carry csafUrl)
+analyzer.fetch_missing_records() → records for zero-impact advisories (also carry csafUrl)
+bundle.build_rows()              → rows                                    [pure, unchanged]
+bundle.scope_targets()           → {advisory_id: csaf_url}                 [pure, NEW]
+csaf.retrieve_many(targets, on_progress=…)
+                                 → {advisory_id: AdvisoryScope}            [NEW, headless]
+bundle_report.build_and_write(…, scopes=…)
+                                 → report                                  [renders, never fetches]
+```
+
+The seam is `scopes` as an optional argument. Omitted, every cell renders unavailable rather than
+blank — an older caller cannot produce a report that reads as "no products affected".
+
+## Implementation sequence
+
+Ordered so each step is independently verifiable and the risky work is proven before anything depends
+on it.
+
+| # | Step | Proves |
+| --- | --- | --- |
+| 1 | `csaf` pure core: `Block` model, the two normalisations, extract selection | Worked example matches character for character (SC-003); FR-013's per-normalisation tests exist before any I/O |
+| 2 | `csaf` retrieval: streamed document-only read, strict decode, cap + fallback | FR-040's 3.4% claim; the mid-character trap is closed |
+| 3 | `csaf` classification, retry, pacing | The five causes are distinct and reachable; two-attempt cap; pacing asserted on an injected clock |
+| 4 | `bundle.Row.csaf_url` + `scope_targets()` | Every bundle advisory has a target; accounting invariant untouched |
+| 5 | `bundle_report` columns and cell rendering | Column titles, date relocation, headings, extract, disclosure, escaping-with-trailing-text |
+| 6 | `bundle_report` unavailability, header count, revision appendix | Never blank; zero stated; provenance recorded |
+| 7 | `analyzer` wiring + progress | Verdicts identical across success/partial/total retrieval failure; no silent pause |
+| 8 | Constitution 3.3.1, README, docs, VERSION | Documentation and versioning gates |
+
+Step 1 before step 2 is deliberate: the normalisation rules are the part a reviewer must trust, and
+they are provable from recorded text with no network at all.
+
+## Risks carried into implementation
+
+| Risk | Mitigation in this plan |
+| --- | --- |
+| An escaping bug deletes text invisibly — a test that only checks the placeholder *appears* would miss it | Tests must assert the text **after** `<interface_name>` survives, not merely that the placeholder renders (quickstart §2) |
+| The incremental read corrupts text at a chunk boundary | Strict decode; `UnicodeDecodeError` → read more (contract, research Decision 2). Unexercised by the current sample, which is exactly why it is a written rule |
+| `document` is not the first key in some future advisory | Buffer cap plus fallback to a full read; failing that, cause `unreadable`. Verified first-key in 25 of 25 today |
+| A new failure mode renders as a blank cell | The cause set is closed (FR-045); anything unclassifiable is `unreadable`, never omitted |
+| Scope text leaks into a determination during later maintenance | FR-011 as a requirement, `AdvisoryScope` keyed by advisory and never by device, and no parsed product list to tempt inference |
+| Expanding a disclosure reflows neighbouring rows | Explicit widths on the two scope-bearing columns — the same fix 4.2.1 applied to the appendix tables |
+
+## Complexity Tracking
+
+> No constitutional violations require justification. The two ⚠️ items in the Constitution Check are
+> recorded in-PR obligations — a PATCH amendment and a documentation update — not deviations.
diff --git a/specs/009-affected-products-column/quickstart.md b/specs/009-affected-products-column/quickstart.md
new file mode 100644
index 0000000..b620eac
--- /dev/null
+++ b/specs/009-affected-products-column/quickstart.md
@@ -0,0 +1,137 @@
+# Quickstart: validating the Affected Products column
+
+**Feature**: 009-affected-products-column · **Date**: 2026-07-28
+
+The automated suite is the primary validation. Every rule in this feature — retrieval classification,
+the two normalisations, the extract, escaping, unavailability — is provable with **no credentials and
+no network**, from recorded documents. The live run at the end confirms the wiring, not the logic.
+
+## Prerequisites
+
+```bash
+uv sync
+```
+
+Credentials are needed only for the live run (§4). Sections 1–3 need neither.
+
+## 1. The automated suite
+
+```bash
+.venv/bin/python -m unittest discover -s tests
+```
+
+Expected: `OK`, with the pre-feature baseline of **402 tests** plus this feature's additions. The
+constitution's Tests gate requires every one of these to run without credentials or network access.
+
+Coverage this feature must add:
+
+| Area | What is asserted | Requirement |
+| --- | --- | --- |
+| `tests/test_csaf.py` — normalisation | One test **per normalisation**, plus one asserting no other alteration occurs | FR-013, FR-014, FR-015 |
+| — worked example | Rendered text matches the expected output **character for character** | SC-003 |
+| — structure | Paragraphs, sub-headings and one-item-per-line lists all survive | FR-017 |
+| — extract | Leads with the scope claim; sub-heading titles only; procedure-heading advisory does not lose its scope claim | FR-031, FR-048 |
+| — guard | A statement Cisco published non-empty is never emptied | FR-016 |
+| — incremental read | `document` parses from a partial buffer; strict decode treats a split character as "read more" | FR-040 |
+| — classification | Each of the five causes is reached, and each is distinct | FR-027, FR-044, FR-045 |
+| — retry | Retried once on transport failure; **not** retried on empty body, unreadable content, or identity mismatch; never more than two attempts | FR-043 |
+| — pacing | Sequential with a delay, asserted via an injected clock — no real waiting | FR-046 |
+| — identity | A document naming another advisory is rejected, not rendered | FR-020 |
+| — headless | Prints nothing, does not exit, writes no file, consults no working folder | FR-038 |
+| `tests/test_bundle.py` | `Row.csaf_url`; `scope_targets()` covers every bundle advisory; accounting invariant unchanged | FR-019, SC-011 |
+| `tests/test_bundle_report.py` | Three column titles; no `Published` column; date beside CVSS; both headings; provenance line; unavailable renders with cause and never blank; `<details>` used so text stays searchable | FR-001–FR-009, FR-026, FR-032 |
+| — escaping | A statement containing `<interface_name>` and `Devices > VPN` renders those characters **and** loses no surrounding text | FR-018, SC-005 |
+| — hostile input | Script-like content in a statement cannot alter structure, styling or behaviour | FR-018 |
+| `tests/test_bundle_flow.py` | Verdicts, reasons and counts byte-identical with retrieval succeeding, failing partially, and failing entirely | FR-029, SC-006 |
+| — no disk writes | No retrieved document reaches disk; no temporary folder created | FR-025 |
+| — progress | Progress reported through the callback | FR-047 |
+
+New fixture: `tests/fixtures/csaf_documents.py` — recorded `document` objects covering the worked
+example, a multi-section product-heading advisory, the procedure-heading advisory
+(`cisco-sa-ftd-tcp-dos-rHfqnwRg`), one with raw `<`/`>`/`&`, and the four failure bodies.
+
+## 2. Prove the escaping trap is closed
+
+The one failure that is invisible in a passing test suite if you only check that text *appears*.
+`FR-018` is about text that **disappears**:
+
+```bash
+.venv/bin/python -m unittest tests.test_bundle_report -k escap -v
+```
+
+Then confirm by eye in a rendered report that a statement containing `<interface_name>` shows the
+placeholder **and** the words after it. An unescaped render deletes both silently — the test must
+assert the trailing text is present, not merely that nothing crashed.
+
+## 3. Render a report offline and read it
+
+```bash
+.venv/bin/python -m unittest tests.test_bundle_report -v
+```
+
+Then open the report a test wrote (or generate one from fixtures) and check, by eye:
+
+- [ ] Headers read `Advisory`, `Affected Products`, `Your impacted devices` — no `Published` column.
+- [ ] The publication date sits beside `CVSS 10.0`, smaller and subordinate.
+- [ ] Each cell shows `Vulnerable Products` then `Products Confirmed Not Vulnerable`.
+- [ ] The column says, once, that this is Cisco's own statement and not a finding about your fleet.
+- [ ] A long statement shows the scope claim then its sub-heading titles, with `show full statement`.
+- [ ] A short statement has **no** disclosure control at all.
+- [ ] Ctrl+F for a phrase that appears only inside a collapsed statement — it is found.
+- [ ] Print preview (or Cmd+P → PDF): every statement is present in full.
+- [ ] Expand one row: no other row's columns shift width or position.
+- [ ] `Expand all` opens the scope disclosures too.
+- [ ] An unavailable cell names its cause in words and could not be read as "no products affected".
+- [ ] Render in greyscale: every distinction still legible.
+
+## 4. Live run
+
+```bash
+caia --erp https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75736
+```
+
+Expected against the reference bundle:
+
+| Observation | Expected |
+| --- | --- |
+| Advisory-API requests | **Unchanged** from a 4.2.1 run — scope retrieval adds none (FR-024) |
+| Scope retrievals | 25, sequential, with a courtesy delay (FR-046) |
+| Bytes transferred for them | ~424 KB, **not** 12.9 MB (FR-040) |
+| Added elapsed time | A small fraction of the assessment — measured ~12 s against ~72 s (FR-039, SC-009) |
+| Progress | Visible during retrieval; no silent pause (FR-047) |
+| Rows with both statements | 25 of 25 (FR-009) |
+| Header | States the missing-statement count, **including zero** (FR-030) |
+
+Then verify provenance by hand for one advisory (SC-004): open Cisco's page for
+`cisco-sa-onprem-fmc-authbypass-5JPp45V2` and compare its two sections against the rendered cell. Every
+difference must be attributable to FR-014 (link markup removed) or FR-015 (navigational sentence
+removed). Anything else is a defect.
+
+## 5. Prove failure is non-fatal
+
+Point retrieval at an unreachable host (or block the host) and re-run:
+
+- [ ] The run completes and writes a report.
+- [ ] Every device verdict, reason and count is identical to the successful run (SC-006).
+- [ ] All 25 cells state unavailable with the `unreachable` cause — none is blank (FR-026).
+- [ ] The header reports 25 missing (FR-030).
+- [ ] Each advisory identifier is still a link to Cisco.
+
+Then request a non-existent advisory's document directly to confirm the trap in the contract:
+
+```bash
+curl -sS -o /dev/null -w "HTTP %{http_code}, %{size_download} bytes\n" "https://sec.cloudapps.cisco.com/security/center/contentjson/CiscoSecurityAdvisory/cisco-sa-does-not-exist-XXXX/csaf/cisco-sa-does-not-exist-XXXX.json"
+```
+
+Expected: **`HTTP 200, 0 bytes`**. This is why FR-027 forbids classifying on status alone — and the
+`no-content` path must be reached from the empty body, not from a `404` that never arrives.
+
+## 6. Gates before the PR
+
+- [ ] `.venv/bin/python -m unittest discover -s tests` → `OK`.
+- [ ] Constitution bumped to **3.3.1** — `csaf` added to Principle VI's module enumeration.
+- [ ] `README.md` shared-surface table: `csaf.py` row added, `erp.py` row corrected (it currently
+      claims to be the only module that talks to Cisco's Security Center).
+- [ ] `docs/index.html` consistent with `README.md`.
+- [ ] `VERSION` → **4.3.0** (additive report change plus a shared-surface addition).
+- [ ] No new runtime dependency (FR-042); `pyproject.toml` unchanged.
diff --git a/specs/009-affected-products-column/research.md b/specs/009-affected-products-column/research.md
new file mode 100644
index 0000000..496aa6a
--- /dev/null
+++ b/specs/009-affected-products-column/research.md
@@ -0,0 +1,261 @@
+# Phase 0 Research: Affected Products Column
+
+**Feature**: 009-affected-products-column · **Date**: 2026-07-28
+
+Every measurement here was taken against live Cisco sources on 2026-07-28, using the 25 advisories
+of ERP-75736 plus 4 published between April 2024 and March 2026 from outside that bundle.
+
+---
+
+## Decision 1 — Retrieval lives in a new module, `caia/csaf.py`
+
+**Decision.** A new shared-surface module owns the retrieval, extraction and normalisation of an
+advisory's published scope statements. It becomes "the only module that reads Cisco's published
+advisory documents", mirroring `psirt` (advisory API) and `erp` (bundle page).
+
+**Rationale.** Both existing candidates are worse, and one of them is worse for a reason that
+matters more than tidiness:
+
+- **`erp.py` is deliberately built to be incapable of supplying advisory facts.** Its own docstring
+  states the rule and the enforcement: *"This page is a scope selector, not an authority… There is
+  no code here to read the details table's other columns, deliberately: the cheapest way to keep a
+  rule is to leave no route to breaking it."* Putting advisory-content retrieval inside it would
+  place a fact-supplying path in the one module designed to have none — dismantling a safeguard
+  someone built on purpose, to save creating a file. The shared host (`sec.cloudapps.cisco.com`) is
+  the only argument for it, and a host is not a responsibility.
+- **`psirt.py` fits the data but not the mechanics.** It is defined as the only module that talks to
+  the *advisory API*: authenticated, token-managed, and paced to a published per-minute quota. Scope
+  retrieval is unauthenticated (FR-022), on a different host, and paced by courtesy rather than
+  quota (FR-046). Mixing them would put an unauthenticated code path inside the module that owns the
+  credentials — the opposite of the separation FR-022 exists to guarantee.
+
+The module carries the pure work too (extraction, normalisation, the block model, extract
+selection), matching how `erp.py` holds a pure `parse()` beside its `fetch()`. That keeps
+FR-013's per-normalisation tests runnable with no network and no credentials, and avoids adding
+two modules to the constitution instead of one.
+
+**Consequence — constitution PATCH required.** Principle VI's *criterion* was already broadened in
+3.3.0 to cover "modules that retrieve Cisco-published content a report attributes to Cisco", so the
+rule already reaches this module. Only the enumeration needs the name added, which is a non-semantic
+refinement: **3.3.0 → 3.3.1**. `README.md`'s shared-surface table gains a row, and its `erp.py` row
+("the only module that talks to Cisco's Security Center") must be corrected — both in this PR, per
+the Documentation gate.
+
+**Alternatives considered.** Extend `erp.py` (rejected above). Extend `psirt.py` (rejected above).
+Put normalisation in `bundle_report.py` as presentation — rejected because normalisation decides
+what the report *attributes to Cisco*, which the amended Principle VI criterion places on the shared
+surface, and because a report module cannot be unit-tested for FR-013 without rendering HTML.
+
+---
+
+## Decision 2 — Read only the `document` object, not the whole file (FR-040)
+
+**Decision.** Stream the response and stop as soon as the top-level `document` object can be parsed
+in full. Fall back to reading the entire body if that is not achieved within a fixed buffer cap.
+
+**Rationale.** FR-040 is a SHOULD, and the naive alternative is expensive enough to be an
+operational problem rather than an inefficiency. Measured:
+
+| | Full documents | `document` only |
+| --- | --- | --- |
+| Reference bundle (25 advisories) | 12,579,885 B | 423,632 B |
+| Largest single advisory | 1,740,490 B | 22,931 B |
+| Share transferred | 100% | **3.4%** |
+
+Cisco serves these uncompressed, with no `Content-Encoding`, `ETag`, `Last-Modified` or
+`Cache-Control`, so neither compression nor conditional requests reduce the cost. Reading less is
+the only available lever, and 12.9 MB per review over a corporate proxy is the thing FR-039's time
+bound is most likely to break against.
+
+**Why it is simple rather than fragile.** `json.JSONDecoder().raw_decode(text, index)` parses a
+single JSON value starting at an offset and raises `ValueError` if that value is incomplete. So the
+loop is: accumulate a chunk, locate the value after `"document"`, attempt `raw_decode`, and on
+failure read more. No JSON repair, no brace counting, no guessing where the object ends. Verified
+assumptions across all 25 documents:
+
+- `document` is the **first top-level key** in all 25.
+- `document.notes` precedes `product_tree` in all 25.
+- `document` contains **both** `notes` (the statements) and `tracking` (the FR-020 identity check
+  and the FR-035 revision) in all 25 — so one read satisfies all three requirements.
+
+**Verified live, not just on saved files.** Three advisories fetched over HTTP with the incremental
+reader: 16,384 B / 32,768 B / 32,768 B read against full sizes of 64 KB / 1.74 MB / 323 KB, in
+0.29–0.46 s, with `tracking.id` matching and both statements present each time. Re-run against the
+largest advisory with a deliberately hostile 997-byte chunk size: 22,931 B read, text intact.
+
+**One trap worth naming.** Decoding a partially-read buffer with `errors="ignore"` can silently drop
+a multi-byte character split across a chunk boundary, corrupting text in a feature whose entire
+purpose is faithful rendering. The buffer MUST therefore be decoded **strictly**, treating
+`UnicodeDecodeError` as "read more" rather than as a failure. No scope statement in the 25-advisory
+sample contains a non-ASCII character, so this is currently unexercised — which is exactly why it
+needs to be a written rule rather than a thing noticed later.
+
+**Alternatives considered.** Read the whole body and parse normally (simplest; rejected on the 12.9
+MB measurement). HTTP `Range` requests (rejected: the cut point is not known in advance and a
+truncated JSON body cannot be parsed). Truncate at `"product_tree"` and repair the JSON by appending
+a brace (rejected as fragile string surgery where `raw_decode` does the job correctly). `cvrfUrl`
+(the XML form) instead — measured at 1,144,626 B for an advisory whose CSAF is 1,740,490 B, so
+still far larger than 23 KB, and it would add an XML parser for no gain.
+
+---
+
+## Decision 3 — The pointer is already in hand; no URL is ever constructed (FR-019)
+
+**Decision.** Take the document location from the `csafUrl` field of the advisory record the report
+already holds. Never build it from the advisory identifier.
+
+**Rationale.** This is what makes FR-019 free rather than a burden, and it is the reason the
+constitution could admit the source at all — the tool follows Cisco's own reference instead of
+discovering a second source. `csafUrl` was present in **100%** of advisory records checked (6 of 6
+from one device-scoped question, 28 of 28 from another, 1 of 1 from a direct lookup), and every
+value matched the published pattern.
+
+The plumbing already exists in both directions:
+
+- An advisory that **impacts** something: its record is on the device result, and
+  `bundle.Row.record` already exposes it.
+- An advisory that impacts **nothing**: `analyzer.fetch_missing_records` already performs one
+  `client.get_advisory()` per such advisory (measured at 1 of 25 for the reference bundle) and that
+  response carries `csafUrl` too.
+
+So every row can reach its pointer with **zero additional advisory-API requests**, satisfying
+FR-024 by construction. `Row` gains a `csaf_url` property; `bundle` gains a pure
+`scope_targets()` returning `{advisory_id: csaf_url}` so the terminal layer can fetch before
+rendering.
+
+**Alternatives considered.** Derive the URL from the identifier (rejected: FR-019 forbids it, and the
+API-supplied pointer is the whole constitutional basis for the feature). Note that the two published
+paths — `/content/…` and `/contentjson/…` — were verified to serve **byte-identical** documents; the
+API publishes the `contentjson` form, and following the pointer means the tool never has to know
+that.
+
+---
+
+## Decision 4 — Normalisation is line-oriented, and reproduces the required output exactly
+
+**Decision.** Parse each statement into an ordered sequence of blocks — `heading`, `text`, `break` —
+one per source line, then apply the two normalisations from FR-014 and FR-015 per line.
+
+**Rationale.** Structure is carried entirely by whitespace, and all three carriers break under naive
+handling: paragraphs are blank-line separated, lists are one item per line with no blank between
+them, and sub-headings are marked *only* by two or more leading spaces (present in 13 of 25). A
+line-oriented model preserves all three without interpreting any of them, which is what FR-017
+requires.
+
+**Validated.** The two normalisations applied to the worked example reproduce the required output
+**character for character**. Across the reference bundle they separate cleanly: 31 sentences are
+purely navigational and removed (`For information about which … see the Fixed Software section of
+this advisory.` ×30; `For more information, see the …` ×1), and 25 substantive sentences that merely
+name a section are retained (`Only products listed in the Vulnerable Products section …`). Applied to
+all 50 statements, **none is emptied** — so FR-016 is a guard against a case that does not currently
+arise, not a routine path.
+
+**Alternatives considered.** Sentence-splitting the whole statement and rejoining (rejected: destroys
+the line structure that distinguishes a product list from a paragraph). Dropping any sentence
+containing a `["#…"]` anchor (rejected: that removes the 25 substantive "Only products listed…"
+sentences the required output keeps — the distinction is *purely navigational*, not *mentions a
+section*). Treating two-space indentation as insignificant whitespace (rejected: it is the only
+sub-heading signal in the format).
+
+---
+
+## Decision 5 — The extract must lead with the scope claim (spec defect found and fixed)
+
+**Decision.** The extract is: all text preceding the first sub-heading, plus the *title* of every
+sub-heading as an outline. Not "every sub-heading with its opening paragraph".
+
+**Rationale — this corrects the specification.** FR-031 originally read "every sub-heading with its
+opening paragraph", carried over from BRD-006. Implementing it against real data showed it fails on
+`cisco-sa-ftd-tcp-dos-rHfqnwRg`, and fails in the exact way FR-031 exists to prevent. That
+advisory's sub-headings are **diagnostic procedures**, not products:
+
+```
+Determine the Snort Configuration on Cisco Secure FTD Software
+Determine the Cisco Secure FTD Software SSL or Decryption Policy Configuration
+Determine Whether a Cisco Secure FTD Software SSL or Decryption Policy Configuration Blocks …
+```
+
+Its actual scope claim — *"this vulnerability affected Cisco products if they were running a
+vulnerable release of Cisco Secure FTD Software or Cisco FirePOWER Services and the following
+conditions were met…"* plus its three conditions — sits **above** the first sub-heading, so the
+original rule discarded it and showed five procedure headings in its place. A reader would have seen
+troubleshooting steps where the scope should be.
+
+The assumption underneath the original rule was that sub-headings name products. They do in some
+advisories (`Open Source Snort 3`, `Cisco Secure Firewall Threat Defense Software`, `Cisco IOS XE
+Software`) and name procedures in others. The revised rule is correct for both shapes: where
+headings are products, their titles *are* the scope outline; where headings are procedures, the lead
+paragraph carries the scope and the titles show what else is there.
+
+Spec updated: **FR-031** rewritten, **FR-048** added to forbid both failure modes explicitly, and a
+User Story 2 acceptance scenario added for the procedure-heading case.
+
+**Measured.** Extract length across the 25 `Vulnerable Products` statements: mean 584, max 1,511
+characters, against a full-text max of 4,783. The rejected rule measured mean 368 / max 1,261 — it
+was smaller precisely because it was dropping the content that mattered.
+
+---
+
+## Decision 6 — Retry, pacing and progress follow the clarified spec
+
+**Decision.** One retry on transport failure only (FR-043); sequential requests with a small fixed
+courtesy delay (FR-046); progress reported through a caller-supplied callback (FR-047).
+
+**Rationale.** Each was settled in the clarification session; the design notes are:
+
+- **Retry** applies to timeout, connection, TLS and proxy errors — and to a per-attempt timeout,
+  which FR-039 classifies as a transport failure. It must **not** apply to an empty body, unreadable
+  content, or an FR-020 identity mismatch, all of which are deterministic. Attempts cap at two, so
+  the worst case per advisory is bounded and knowable.
+- **Pacing** reuses the injectable `sleep`/`clock` seam `psirt.Client` already established, so tests
+  assert the pacing without waiting. The interval is *not* the advisory API's ~2.1 s — that exists to
+  satisfy a published per-minute quota this host does not have, and applying it would push 25
+  retrievals past 50 s and breach FR-039.
+- **Progress** mirrors `assessment.analyze`'s `on_progress` exactly: `csaf` reports through a
+  callback the caller passes, so `csaf` itself prints nothing (FR-038) and `analyzer` owns the
+  terminal output, as it already does for the per-check progress lines.
+
+**Alternatives considered.** Concurrent retrieval (rejected: FR-046 forbids a burst, and threading
+buys ~12 s against a 72 s assessment while adding a failure mode). Reusing the advisory API's pacing
+interval (rejected on the FR-039 arithmetic above).
+
+---
+
+## Decision 7 — Detecting unavailability from content, not status (FR-027)
+
+**Decision.** Classify from the body. A missing document is served as **HTTP 200 with a zero-length
+body**, and `Content-Type` is `application/download;charset=UTF-8` rather than a JSON type — so
+neither the status code nor the content type can detect absence.
+
+**Rationale.** Verified directly: a request for `cisco-sa-does-not-exist-XXXX` returned HTTP 200,
+0 bytes. This mirrors the divergence already recorded for the advisory API in
+`specs/006-api-inventory-check/contracts/psirt-access.md`, where the documented and live response
+shapes differ and the tool keys on status and `errorCode` rather than message text. The same
+discipline applies here in reverse: the status is useless, so the body decides.
+
+The five FR-044 causes map to distinguishable conditions:
+
+| Cause | Detected by |
+| --- | --- |
+| Cisco could not be reached | transport error, or per-attempt timeout, after the FR-043 retry |
+| Cisco published no content for the statement | zero-length body, or `document.notes` lacking that title |
+| The document could not be read | body present but not parseable, or no `document` object |
+| The document identified a different advisory | `document.tracking.id` ≠ the advisory asked for |
+| The advisory was not reached before the run stopped | run ended early (FR-041) |
+
+**Alternatives considered.** Treat a zero-length body as "no products affected" (rejected outright:
+it is the precise failure FR-026 and Principle IV forbid). Trust `Content-Type` (rejected: it
+declares a generic download for a JSON payload).
+
+---
+
+## Resolved unknowns
+
+No `NEEDS CLARIFICATION` markers remain. All four network-behaviour questions were settled in the
+clarification session before planning; the two design questions the plan owned — where retrieval
+lives (Decision 1) and whether to honour FR-040 (Decision 2) — are resolved above with measurements
+rather than preference.
+
+One spec defect was found and corrected during Phase 0 (Decision 5). That is the substantive result
+of this research: the requirement would have shipped a cell that hides the scope claim on at least
+one advisory in the reference bundle.
diff --git a/specs/009-affected-products-column/spec.md b/specs/009-affected-products-column/spec.md
index 2d2c2ad..9f2f04e 100644
--- a/specs/009-affected-products-column/spec.md
+++ b/specs/009-affected-products-column/spec.md
@@ -56,7 +56,8 @@ An analyst works down 25 rows. Most scope statements are short; several run to 2
 
 **Acceptance Scenarios**:
 
-1. **Given** a statement long enough to be collapsed, **When** the analyst reads the cell, **Then** the visible portion shows every sub-heading with its opening paragraph — or the opening paragraph alone where the statement has no sub-headings — and a control indicating that more text exists.
+1. **Given** a statement long enough to be collapsed, **When** the analyst reads the cell, **Then** the visible portion shows the statement's leading scope claim in full, followed by the title of every sub-heading it contains, and a control indicating that more text exists.
+1a. **Given** a statement whose sub-headings name diagnostic procedures rather than products — and whose scope claim therefore sits above the first sub-heading — **When** the analyst reads the extract, **Then** the scope claim is visible and no procedure section's text is shown in its place.
 2. **Given** the advisory with the longest scope statement in the bundle, **When** the report is scrolled, **Then** its row does not prevent neighbouring rows from being read.
 3. **Given** a collapsed statement, **When** the analyst searches the report for a phrase that appears only in its collapsed portion, **Then** the phrase is found in the document.
 4. **Given** a collapsed statement, **When** the report is printed or exported to PDF, **Then** no part of Cisco's text is absent from the output.
@@ -176,7 +177,8 @@ A reviewer, months later, needs to establish where the scope text came from and
 
 **Layout and accessibility**
 
-- **FR-031**: Each statement MUST be rendered as a visible extract plus, where any text remains beyond that extract, a control that reveals the remainder and indicates that more text exists. The extract MUST be every sub-heading with its opening paragraph, or the opening paragraph alone where the statement has no sub-headings. A statement wholly contained in its extract MUST NOT carry a disclosure control, so the presence of the control always means text is hidden.
+- **FR-031**: Each statement MUST be rendered as a visible extract plus, where any text remains beyond that extract, a control that reveals the remainder and indicates that more text exists. The extract MUST comprise (a) all text preceding the statement's first sub-heading — the scope claim itself, including any conditions listed with it — and (b) the title of every sub-heading, as an outline of the sections the statement contains. Where a statement has no sub-heading, the extract is its opening paragraph. A statement wholly contained in its extract MUST NOT carry a disclosure control, so the presence of the control always means text is hidden.
+- **FR-048**: The extract MUST NOT omit the statement's leading scope claim, and MUST NOT present the content of one sub-heading as though it were the whole statement. Sub-headings are not reliably product names — across the reference bundle they name products in some advisories and diagnostic procedures in others — so the extract MUST NOT assume that a sub-heading's opening paragraph describes the advisory's scope.
 - **FR-032**: No part of Cisco's text may be truncated out of the file. Collapsed text MUST remain present in the document, findable by the reader's search, and present when the report is printed or exported.
 - **FR-033**: Expanding one row's statement MUST NOT reflow or resize any other row's columns.
 - **FR-034**: The report's existing expand-all control MUST also open these statements, and the column MUST remain legible in greyscale and in print, with no meaning carried by colour alone.

From a2d14bc8d13570535a53a1e3efc5862fde866207 Mon Sep 17 00:00:00 2001
From: Ali Bahaloo <ali.bahaloo@telusinternational.com>
Date: Tue, 28 Jul 2026 23:51:11 -0700
Subject: [PATCH 4/7] docs: name `csaf` in the shared surface (constitution
 3.3.1)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Discharges the follow-up TODO 3.3.0 recorded against itself. 3.3.0 broadened
Principle VI's criterion to cover "modules that ... retrieve Cisco-published
content a report attributes to Cisco" but could not name the module, because the
design decision had not been taken — naming one then would have let a governance
document pre-decide architecture.

Spec 009's Phase 0 research settled it: retrieval lands in a new module, csaf,
rather than extending either existing candidate. erp is deliberately built with no
route to supplying an advisory fact ("the cheapest way to keep a rule is to leave no
route to breaking it"), so putting content retrieval there would dismantle a
safeguard to avoid creating a file. psirt owns the API credentials that the Advisory
scope statements bullet forbids a scope request from carrying, so hosting an
unauthenticated path there would invert the separation that prohibition creates.

The amendment only makes the enumeration accurate — Principle VI and the Consumers
released-interface list both go from six modules to seven. It adds no permission,
widens no bound, and changes no rule: every obligation now attaching to csaf already
attached under 3.3.0's criterion. Non-semantic refinement, hence PATCH.

Ordering is deliberate: this names a module that does not yet exist, matching 3.2.0,
which added erp and bundle as a prerequisite of the spec that created them. Both land
in one pull request, so main never observes an inconsistent state. README.md and
docs/index.html are deliberately NOT touched here — the Documentation gate forbids
describing a capability the tool lacks, so the shared-surface table changes in the
commit that adds the module.

Plan updated to match: the Principle VI gate now passes rather than pending, and the
remaining documentation obligation is stated as outstanding by design.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .specify/memory/constitution.md               | 70 ++++++++++++++++++-
 specs/009-affected-products-column/plan.md    | 28 +++++---
 .../quickstart.md                             |  4 +-
 3 files changed, 87 insertions(+), 15 deletions(-)

diff --git a/.specify/memory/constitution.md b/.specify/memory/constitution.md
index 7576244..a810ea8 100644
--- a/.specify/memory/constitution.md
+++ b/.specify/memory/constitution.md
@@ -1,6 +1,67 @@
 <!--
 Sync Impact Report
 ==================
+Version change: 3.3.0 → 3.3.1
+Rationale: Discharges the follow-up TODO 3.3.0 recorded against itself. 3.3.0 broadened Principle VI's
+           defining criterion to cover "modules that … retrieve Cisco-published content a report
+           attributes to Cisco", but could not name the module that would do so, because the design
+           decision had not been taken: naming one would have meant inventing a module before it
+           existed, letting a governance document pre-decide architecture.
+
+           Spec 009's Phase 0 research settled it. Retrieval of an advisory's published scope
+           statements lands in a new module, `caia/csaf.py`, rather than extending either existing
+           candidate, for reasons stronger than tidiness. `erp` is deliberately built with no route to
+           supplying an advisory fact — its own docstring states both the rule and the enforcement
+           ("the cheapest way to keep a rule is to leave no route to breaking it") — so putting
+           content retrieval inside it would dismantle a safeguard in order to avoid creating a file.
+           `psirt` owns the API credentials, which the Advisory scope statements bullet forbids a
+           scope request from carrying; hosting an unauthenticated path there would invert the
+           separation that prohibition exists to create.
+
+           So this amendment only makes the enumeration accurate. It adds no permission, widens no
+           bound, and changes no rule: every obligation now attaching to `csaf` already attached to it
+           under 3.3.0's criterion. That is a non-semantic refinement, hence PATCH.
+
+           Note on ordering: this names a module that does not yet exist in the codebase. That is
+           deliberate and matches 3.2.0, which added `erp` and `bundle` to the enumeration as a
+           prerequisite of the spec that created them. The amendment and the module land in one pull
+           request, so `main` never observes an inconsistent state. `README.md` and `docs/index.html`
+           are deliberately NOT updated here — the Documentation gate forbids describing a capability
+           the tool does not have, so the shared-surface table changes in the commit that adds the
+           module, still within the same pull request.
+
+Modified principles:
+  - VI. Headless Shared Surface (module enumeration extended from six to seven, adding `csaf`; no
+    change to the criterion, the obligations, or the public contract, all of which already covered it)
+Added sections: (none)
+Modified sections:
+  - Technology & Data Constraints → Consumers (the released-interface enumeration now names all seven)
+Removed sections: (none)
+
+Templates requiring updates:
+  - .specify/templates/plan-template.md ✅ aligned (Constitution Check resolves gates dynamically)
+  - .specify/templates/spec-template.md ✅ aligned (no constitution references)
+  - .specify/templates/tasks-template.md ✅ aligned (no constitution references)
+  - .specify/templates/checklist-template.md ✅ aligned (no constitution references)
+  - .claude/skills/speckit-*/SKILL.md ✅ aligned (reference the constitution generically)
+  - README.md ⚠️ pending by design — the shared-surface table gains a `csaf.py` row and its `erp.py`
+    row ("the only module that talks to Cisco's Security Center") must be corrected, in the commit
+    that adds the module rather than this one (see the ordering note above)
+  - docs/index.html ⚠️ pending by design — same commit, to the extent it describes the sources read
+
+Follow-up TODOs: none. This discharges 3.3.0's only outstanding item.
+
+Previous version 3.3.0 (2026-07-28): enacted as a prerequisite of BRD-006. Added the Advisory scope
+statements bullet admitting Cisco's per-advisory published CSAF document for two named statements
+only, located by the API-supplied `csafUrl`, with an identity cross-check, API-wins conflict
+resolution, and a faithful-rendering obligation; extended the Networking bullet to that resource;
+stated that Scope selectors is not relaxed by it; and added a per-normalisation Tests obligation.
+MINOR.
+-->
+
+<!--
+Superseded Sync Impact Report (3.2.0 → 3.3.0), retained for history
+==================
 Version change: 3.2.0 → 3.3.0
 Rationale: Enacted as a prerequisite of BRD-006 (affected-product scope in the bundle-scoped report),
            which shows, beside each advisory in a reviewed bundle, Cisco's own published statements of
@@ -91,6 +152,8 @@ Templates requiring updates:
 Follow-up TODOs: if the feature introduces a new module for advisory-document retrieval, Principle
 VI's module enumeration MUST be extended in the pull request that adds it — a PATCH amendment carried
 as a feature task rather than amendment debt, mirroring how 3.2.0 handled its README item.
+  → DISCHARGED in 3.3.1: spec 009's research chose a new module, `csaf`, and the enumeration was
+    extended accordingly.
 
 Previous version 3.2.0 (2026-07-28): enacted as a prerequisite of spec 008 (bundle-scoped impact
 reporting). Admitted `sec.cloudapps.cisco.com` for bundle resolution, added the Scope selectors
@@ -332,7 +395,7 @@ nothing about who runs it or where.
 ### VI. Headless Shared Surface
 The modules that produce a verdict, determine the scope one is produced for, or retrieve
 Cisco-published content a report attributes to Cisco — `assessment`,
-`matching`, `psirt`, `inventory`, `erp`, and `bundle` — are this
+`matching`, `psirt`, `inventory`, `erp`, `bundle`, and `csaf` — are this
 package's **shared surface** and MUST remain callable without a terminal. They MUST NOT print,
 prompt, consult the current working folder, write a file, or exit the process; the caller supplies
 the credentials, the inventory, and whatever progress reporting it wants. Terminal behaviour —
@@ -453,7 +516,8 @@ data-quality problem when the real cause was a rejected credential.
   package index); the tool orchestrates this rather than overlaying files in place. Adding
   any further external endpoint the analyzer itself contacts remains a reviewed change.
 - Consumers: this package is both the `caia` command and an importable library. The shared surface
-  defined in Principle VI — `assessment`, `matching`, `psirt`, `inventory`, `erp`, and `bundle` — is
+  defined in Principle VI — `assessment`, `matching`, `psirt`, `inventory`, `erp`, `bundle`, and
+  `csaf` — is
   therefore a **released interface** — a consumer depends on a published
   release of it, never on a branch — so that surface MUST be documented in `README.md` and its
   changes MUST drive the version bump (see the versioning gate below). Modules outside the shared
@@ -531,4 +595,4 @@ Compliance is verified at review time. Dependent Spec Kit artifacts (plan, spec,
 tasks templates and their generated documents) MUST remain consistent with the principles
 above; the Constitution Check in the planning workflow enforces this on each feature.
 
-**Version**: 3.3.0 | **Ratified**: 2026-07-14 | **Last Amended**: 2026-07-28
+**Version**: 3.3.1 | **Ratified**: 2026-07-14 | **Last Amended**: 2026-07-28
diff --git a/specs/009-affected-products-column/plan.md b/specs/009-affected-products-column/plan.md
index dddcb25..e70c8b4 100644
--- a/specs/009-affected-products-column/plan.md
+++ b/specs/009-affected-products-column/plan.md
@@ -49,8 +49,9 @@ added to a report currently measured at 795 KB. Five modules touched, one added.
 
 ## Constitution Check
 
-*GATE: evaluated against constitution **3.3.0** (amended on this branch as this feature's
-prerequisite). Re-checked after Phase 1 — see the gate outcome below.*
+*GATE: evaluated against constitution **3.3.1** (both amendments enacted on this branch — 3.3.0 as
+this feature's prerequisite, 3.3.1 to name `csaf` once Phase 0 chose it). Re-checked after Phase 1 —
+see the gate outcome below.*
 
 | Principle / constraint | Verdict | Basis |
 | --- | --- | --- |
@@ -59,7 +60,7 @@ prerequisite). Re-checked after Phase 1 — see the gate outcome below.*
 | **III. CLI-First, Scriptable** | ✅ Pass | No new command, flag, or mode. The existing `--erp` path gains content. Nothing is reachable only interactively. |
 | **IV. Conservative & Traceable Analysis** | ✅ Pass | The column cannot influence any verdict, count, population, family derivation, ordering, filter or sort (FR-011). An unavailable statement renders as an explicit cause and never as an absence (FR-026, FR-044) — the same discipline as an undetermined device never reading as unaffected. Text is rendered faithfully under exactly two enumerated normalisations (FR-012–FR-016). |
 | **V. Secrets Hygiene & Data Locality** | ✅ Pass | Retrieval is unauthenticated (FR-022) and carries no inventory-derived data — not even the family/platform/release triple the advisory API is permitted (FR-023). No document reaches disk (FR-025). |
-| **VI. Headless Shared Surface** | ⚠️ **Amendment required** | `csaf` is a shared-surface module and must be added to Principle VI's enumeration. The *criterion* already covers it ("modules that … retrieve Cisco-published content a report attributes to Cisco", added in 3.3.0); only the name is missing. **PATCH: 3.3.0 → 3.3.1.** Tracked below. |
+| **VI. Headless Shared Surface** | ✅ Pass | `csaf` is named in the enumeration as of **3.3.1**, enacted on this branch once Phase 0 chose a new module. The criterion already covered it in 3.3.0, so the amendment added no obligation. `csaf` must print nothing, prompt for nothing, consult no working folder, write no file, and not exit the process (FR-038); progress goes through a caller-supplied callback (FR-047). |
 | **Source of truth** | ✅ Pass | Every advisory fact — title, severity, score, CVEs, publication date, fixing release, affected platform — still comes from the advisory API. The document contributes two statements plus an identity check and a revision, and nothing else (contract table, FR-021). |
 | **Scope selectors** | ✅ Pass | Untouched and not relied upon. The bundle page still supplies only membership and its own identity. |
 | **Advisory scope statements** (new in 3.3.0) | ✅ Pass | This is the permission the feature exercises. Bounded to the two statements, located via the API-supplied pointer, identity cross-checked, API wins on disagreement, faithfully rendered under enumerated normalisations. |
@@ -72,13 +73,18 @@ prerequisite). Re-checked after Phase 1 — see the gate outcome below.*
 
 ### Gate outcome
 
-**Pass, with two mandatory in-PR obligations.** Neither is a violation needing justification in
-Complexity Tracking; both are recorded work, and both were anticipated by 3.3.0's own follow-up note:
+**Pass, with one mandatory in-PR obligation remaining.**
 
-1. **Constitution 3.3.0 → 3.3.1** — add `csaf` to Principle VI's module enumeration. PATCH, because
-   the criterion already reaches the module; only the enumeration is being made accurate.
-2. **`README.md` + `docs/index.html`** — shared-surface table row added, `erp.py` description
-   corrected.
+- ✅ **Constitution 3.3.1 — done.** `csaf` added to Principle VI's module enumeration and to the
+  Consumers released-interface list. PATCH: the criterion already reached the module, so the amendment
+  added no obligation and widened no bound. This discharged 3.3.0's only outstanding follow-up item.
+- ⚠️ **`README.md` + `docs/index.html` — outstanding, by design.** The shared-surface table gains a
+  `csaf.py` row, and its `erp.py` row ("the only module that talks to Cisco's Security Center") must
+  be corrected. These belong to the commit that *adds* the module, not to the amendment: the
+  Documentation gate forbids either document describing a capability the tool does not have, and
+  `caia/csaf.py` does not exist yet. Both land in this same pull request.
+
+Neither is a violation needing justification in Complexity Tracking.
 
 Re-checked after Phase 1 design: no verdict changed. The design adds no dependency, no host, no
 command, and no path by which the new column can reach a verdict.
@@ -138,7 +144,7 @@ tests/
 └── test_bundle_flow.py             # + verdicts identical across retrieval success/partial/total
                                     #   failure; no disk writes; progress reported.
 
-.specify/memory/constitution.md      # 3.3.0 → 3.3.1 (Principle VI enumeration)
+.specify/memory/constitution.md      # DONE — 3.3.0 → 3.3.1 (Principle VI + Consumers enumerations)
 README.md                            # shared-surface table: + csaf.py, correct erp.py
 docs/index.html                      # mirrored
 VERSION                              # 4.2.1 → 4.3.0
@@ -180,7 +186,7 @@ on it.
 | 5 | `bundle_report` columns and cell rendering | Column titles, date relocation, headings, extract, disclosure, escaping-with-trailing-text |
 | 6 | `bundle_report` unavailability, header count, revision appendix | Never blank; zero stated; provenance recorded |
 | 7 | `analyzer` wiring + progress | Verdicts identical across success/partial/total retrieval failure; no silent pause |
-| 8 | Constitution 3.3.1, README, docs, VERSION | Documentation and versioning gates |
+| 8 | README, docs, VERSION (constitution 3.3.1 already enacted) | Documentation and versioning gates |
 
 Step 1 before step 2 is deliberate: the normalisation rules are the part a reviewer must trust, and
 they are provable from recorded text with no network at all.
diff --git a/specs/009-affected-products-column/quickstart.md b/specs/009-affected-products-column/quickstart.md
index b620eac..fc22059 100644
--- a/specs/009-affected-products-column/quickstart.md
+++ b/specs/009-affected-products-column/quickstart.md
@@ -129,7 +129,9 @@ Expected: **`HTTP 200, 0 bytes`**. This is why FR-027 forbids classifying on sta
 ## 6. Gates before the PR
 
 - [ ] `.venv/bin/python -m unittest discover -s tests` → `OK`.
-- [ ] Constitution bumped to **3.3.1** — `csaf` added to Principle VI's module enumeration.
+- [x] Constitution bumped to **3.3.1** — `csaf` added to Principle VI's module enumeration and to the
+      Consumers released-interface list. *(Done ahead of implementation; see the ordering note in that
+      amendment's Sync Impact Report.)*
 - [ ] `README.md` shared-surface table: `csaf.py` row added, `erp.py` row corrected (it currently
       claims to be the only module that talks to Cisco's Security Center).
 - [ ] `docs/index.html` consistent with `README.md`.

From 1f9352b73e15004df1b17a878d951c3b9c32525d Mon Sep 17 00:00:00 2001
From: Ali Bahaloo <ali.bahaloo@telusinternational.com>
Date: Tue, 28 Jul 2026 23:56:06 -0700
Subject: [PATCH 5/7] =?UTF-8?q?docs(009):=20task=20list=20for=20the=20Affe?=
 =?UTF-8?q?cted=20Products=20column=20=E2=80=94=2043=20tasks?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Phase 2 output for spec 009. 43 tasks across seven phases: setup, a blocking
foundational phase building the caia/csaf.py shared surface, one phase per user
story in priority order, then the documentation and versioning gates.

Tests are marked NOT optional. Three obligations require them: the constitution's
Tests gate, its per-normalisation clause added in 3.3.0 ("each permitted
normalisation MUST have its own test, and a further test MUST assert that no other
alteration occurs"), and FR-013. They sit beside their implementation task rather
than in an up-front block, because every rule here is provable from recorded
fixtures and so is verifiable immediately rather than accumulating as a batch.

The pure text work (T003-T007) precedes all I/O deliberately. Those rules decide
what the report attributes to Cisco, they need no network or credentials, and if
they are wrong everything downstream renders a faithful copy of the wrong text.

Only 4 [P] markers, deliberately. Most of the feature lands in two files —
caia/csaf.py and caia/bundle_report.py — so marking those parallel would invite
conflicting edits to the same file, which is the failure the marker prevents.

Two tests are called out because each is easy to write so that it passes while the
bug ships: T020 must assert the text *after* <interface_name> survives, not just
that the placeholder renders (unescaped, a browser deletes both and the omission is
invisible); T004 must assert the navigational sentence is removed *and* the
substantive "Only products listed..." sentence is retained — 31 go, 25 that look
alike must stay. T001 must use recorded text, since faithfulness tests against
invented fixtures prove nothing.

MVP is phases 1-3 (T001-T023): the column works on its own. Stories 2-4 cannot make
a previously-correct cell wrong, because Phase 2 defaults every cell to unavailable
rather than blank.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 specs/009-affected-products-column/tasks.md | 273 ++++++++++++++++++++
 1 file changed, 273 insertions(+)
 create mode 100644 specs/009-affected-products-column/tasks.md

diff --git a/specs/009-affected-products-column/tasks.md b/specs/009-affected-products-column/tasks.md
new file mode 100644
index 0000000..b5a9a97
--- /dev/null
+++ b/specs/009-affected-products-column/tasks.md
@@ -0,0 +1,273 @@
+---
+
+description: "Task list for 009-affected-products-column"
+---
+
+# Tasks: Affected Products Column in the Bundle-Scoped Report
+
+**Input**: Design documents from `/specs/009-affected-products-column/`
+
+**Prerequisites**: [plan.md](./plan.md), [spec.md](./spec.md), [research.md](./research.md), [data-model.md](./data-model.md), [contracts/](./contracts/)
+
+**Tests**: **Included, and NOT optional for this feature.** Three separate obligations require them:
+the constitution's Tests gate ("changes to … report generation MUST have tests", and every such test
+MUST run with no credentials and no network access); its per-normalisation clause, added in 3.3.0
+("each permitted normalisation MUST have its own test, and a further test MUST assert that no other
+alteration occurs"); and FR-013, which restates the same. `quickstart.md` names the automated suite as
+the primary validation. Baseline to preserve: **402 tests passing**.
+
+**Organization**: Tasks are grouped by user story. Phases 1–2 build the shared surface every story
+needs; Phases 3–6 are the report surface, one phase per story in priority order.
+
+## Format: `[ID] [P?] [Story] Description`
+
+- **[P]**: Can run in parallel — different file, no dependency on an incomplete task
+- **[Story]**: Which user story the task serves (US1–US4)
+- Exact file paths are given in every task
+
+## Path Conventions
+
+Single Python package at repository root: `caia/` for source, `tests/` for tests. No `src/` directory.
+
+---
+
+## Phase 1: Setup
+
+**Purpose**: Recorded test data and the module skeleton everything else fills in.
+
+- [ ] T001 [P] Create `tests/fixtures/csaf_documents.py` holding recorded `document` objects: the worked example (`cisco-sa-onprem-fmc-authbypass-5JPp45V2`), a product-heading multi-section statement (`cisco-sa-ftd-snort3-vbavuls-96UcVVed`), the procedure-heading statement (`cisco-sa-ftd-tcp-dos-rHfqnwRg`), one containing raw `<`/`>`/`&` (`cisco-sa-asaftd-vpn-m9sx6MbC`), plus the four failure bodies — zero-length, unparseable, missing-notes, and identity-mismatch. Real recorded text only; do not hand-write plausible substitutes, because the faithfulness tests are worthless against invented input.
+- [ ] T002 Create `caia/csaf.py` with the module docstring stating the bounded-source rule and the data shapes from `data-model.md`: `Block`, `ScopeStatement`, `AdvisoryScope`, the five cause constants, and the `CsafError` hierarchy. No behaviour yet.
+
+**Checkpoint**: fixtures load; `caia.csaf` imports.
+
+---
+
+## Phase 2: Foundational (Blocking Prerequisites)
+
+**Purpose**: The `caia/csaf.py` shared surface and the plumbing that carries scope statements to the
+report. Every user story depends on this phase.
+
+**⚠️ CRITICAL**: No user story work can begin until this phase is complete.
+
+**Order note**: the pure text work (T003–T007) comes before any I/O, deliberately. The normalisation
+rules are the part a reviewer must trust, and they are provable from recorded text with no network at
+all (plan, implementation sequence step 1).
+
+- [ ] T003 Implement **Normalisation 1 — link markup** in `caia/csaf.py`: remove Cisco's bracketed link targets (`["#fs"]`, `["https://…"]`) while retaining the surrounding link text (FR-014). Add its own test in `tests/test_csaf.py`.
+- [ ] T004 Implement **Normalisation 2 — navigational sentences** in `caia/csaf.py`: remove a sentence whose entire content directs the reader to another section of the same advisory; retain a sentence that names a section while making a substantive claim (FR-015). Add its own test in `tests/test_csaf.py` asserting both directions — that `For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.` is removed **and** that `Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.` survives. Getting only the first half right is the failure mode.
+- [ ] T005 Implement the **`Block` parse** in `caia/csaf.py`: one block per source line, classified `heading` (2+ leading spaces before the first non-space), `break` (blank, or blank after normalisation, with runs collapsed and leading/trailing dropped), or `text`. Line breaks between consecutive `text` blocks are significant (FR-017). Add tests in `tests/test_csaf.py` covering a paragraph, a one-item-per-line product list, and an indented sub-heading.
+- [ ] T006 Add the **faithfulness tests** in `tests/test_csaf.py`: the worked example renders character-for-character against the expected text (SC-003); a test asserting **no alteration beyond T003 and T004 occurs** (FR-013, constitution Tests gate); and a test that a statement Cisco published non-empty is never emptied, falling back to the original if normalisation would empty it (FR-016).
+- [ ] T007 Implement `extract_blocks()` in `caia/csaf.py` — pure extract selection: every block before the first `heading`, plus the `heading` blocks themselves; where there is no heading, every block up to the first `break` (FR-031). Never a sub-heading's body (FR-048). Add tests in `tests/test_csaf.py`; **the procedure-heading fixture is the required case** — its scope claim sits above the first heading and an earlier rule dropped it (research Decision 5).
+- [ ] T008 Implement the **streamed document-only read** in `caia/csaf.py`: accumulate chunks, locate the value after `"document"`, attempt `json.JSONDecoder().raw_decode`, and read more on `ValueError`. Decode the buffer **strictly** and treat `UnicodeDecodeError` as "read more" — never `errors="ignore"`, which silently drops a character split across a chunk boundary. Cap the buffer and fall back to a full read; if that also fails, the cause is `unreadable` (FR-040). Add tests in `tests/test_csaf.py` including a deliberately tiny chunk size and a buffer that splits a multi-byte character.
+- [ ] T009 Implement the **identity cross-check** in `caia/csaf.py`: verify `document.tracking.id` equals the advisory asked for before using any field; a mismatch yields both statements unavailable with cause `identity-mismatch` (FR-020). Add a test in `tests/test_csaf.py` asserting no text from the mismatched document reaches the result.
+- [ ] T010 Implement **statement extraction and classification** in `caia/csaf.py`: pull `document.notes` entries titled `Vulnerable Products` and `Products Confirmed Not Vulnerable` and nothing else (FR-010, FR-021); resolve every failure to exactly one of the five closed causes (FR-027, FR-044, FR-045). Add tests in `tests/test_csaf.py` reaching each cause and asserting they are distinct — **including that a zero-length body classifies as `no-content` rather than as a statement with no content**, since Cisco serves a missing document as HTTP 200 with an empty body.
+- [ ] T011 Implement **retry** in `caia/csaf.py`: exactly one retry after a short delay for transport failures — timeout, connection, TLS, proxy — and no retry for an empty body, unreadable content, or an identity mismatch; attempts never exceed two (FR-043). Add tests in `tests/test_csaf.py` asserting the attempt count in both directions.
+- [ ] T012 Implement **pacing** in `caia/csaf.py`: retrievals issued sequentially with a small fixed courtesy delay, never concurrently (FR-046). Reuse the injectable `sleep`/`clock` seam `psirt.Client` already established so tests assert pacing without waiting. Do **not** reuse the advisory API's ~2.1 s interval — that satisfies a published quota this host does not have, and would breach FR-039. Add a test in `tests/test_csaf.py` on an injected clock.
+- [ ] T013 Implement `retrieve_many(targets, on_progress=None, …)` in `caia/csaf.py` returning `{advisory_id: AdvisoryScope}`, reporting progress through the caller-supplied callback only (FR-047). Add tests in `tests/test_csaf.py` for the **headless property** (FR-038): prints nothing, prompts for nothing, consults no working folder, writes no file, does not exit the process — and writes no retrieved document to disk and creates no temporary folder (FR-025).
+- [ ] T014 [P] Add `Row.csaf_url` (reading `record["csafUrl"]`, `""` when absent) and the pure `scope_targets(bundle_advisory_ids, devices, records)` helper to `caia/bundle.py`. The location is never constructed (FR-019); every bundle advisory gets an entry, an absent record mapping to `""`. Add tests in `tests/test_bundle.py`, including that the accounting invariant `impacted + unaffected + undetermined == population` is unchanged (SC-011).
+- [ ] T015 Add the optional `scopes=None` argument to `render`, `write_report` and `build_and_write` in `caia/bundle_report.py`. When omitted or missing an advisory, that cell renders **unavailable, never blank** — an older caller must not be able to produce a report that reads as "no products affected". Add a test in `tests/test_bundle_report.py` calling without `scopes`.
+
+**Checkpoint**: `caia/csaf.py` is complete and fully tested with no network and no credentials; the
+report accepts scope statements but does not yet render them.
+
+---
+
+## Phase 3: User Story 1 — Read Cisco's product scope in the advisory row (Priority: P1) 🎯 MVP
+
+**Goal**: The column exists and works. Publication date relocated, columns retitled, both Cisco
+statements rendered faithfully and escaped, every advisory covered, no cell ever silently blank, and a
+retrieval failure never breaks a run or moves a verdict.
+
+**Independent Test**: Render a bundle report from recorded documents and confirm the three column
+titles, the absence of a publication-date column, the date beside the CVSS score, and both statements
+under their own headings in every row — with no credentials and no network.
+
+- [ ] T016 [US1] Relocate the publication date into the Advisory column in `caia/bundle_report.py`: a smaller labelled element beside the CVSS score, carrying Cisco's `firstPublished` value; an advisory with no date renders as absent, never inferred (FR-001, FR-003, FR-004). Add tests in `tests/test_bundle_report.py`.
+- [ ] T017 [US1] Remove the `Published` column and retitle the remaining two in `caia/bundle_report.py`: column 2 becomes `Affected Products`, column 3 becomes `Your impacted devices` (FR-002, FR-005, FR-006). Add tests in `tests/test_bundle_report.py` asserting the exact header text and that no `Published` header remains.
+- [ ] T018 [US1] Render the Affected Products cell in `caia/bundle_report.py`: heading `Vulnerable Products` then its statement, heading `Products Confirmed Not Vulnerable` then its statement, for every advisory in the bundle including those impacting nothing (FR-008, FR-009). Render from the `Block` sequence, never from raw text — headings visually distinct, paragraph breaks kept, one-item-per-line lists never run together (FR-017). Add tests in `tests/test_bundle_report.py`.
+- [ ] T019 [US1] Add the provenance statement to the Affected Products column in `caia/bundle_report.py`: the report states, once and in the report itself, that this column is Cisco's own published statement about the advisory and not a finding about the reader's inventory (FR-007). Add a test in `tests/test_bundle_report.py`.
+- [ ] T020 [US1] Escape every rendered character through `esc()` in `caia/bundle_report.py` (FR-018). Add tests in `tests/test_bundle_report.py` that **assert the text following `<interface_name>` is still present**, not merely that the placeholder renders — an unescaped render deletes the placeholder *and* everything to the next `>`, so a test that only checks for the placeholder passes while the report silently omits Cisco's scope (SC-005). Add a hostile-input test proving statement content cannot alter structure, styling or behaviour.
+- [ ] T021 [US1] Add the Affected Products column CSS to `caia/bundle_report.py`: heading weight, the smaller `pubdate` label, and the reassigned column widths taking the 12% released by the old date column. No meaning carried by colour alone (FR-034).
+- [ ] T022 [US1] Wire retrieval into the run in `caia/analyzer.py`: after the assessment and before the report, call `bundle.scope_targets()` then `csaf.retrieve_many()`, reporting progress through the existing `ui` output so the retrieval phase is never a silent pause (FR-047); pass `scopes` into `bundle_report.build_and_write`. Scope must reach the report and nothing else — no verdict, count, population, family derivation, ordering, filter or sort may read it (FR-011).
+- [ ] T023 [US1] Add non-fatal-failure tests in `tests/test_bundle_flow.py`: with retrieval succeeding, failing for some advisories, and failing for all, every device verdict, reason and count is identical, and the report is still written (FR-029, SC-006). Assert each row's counts still sum to its population (SC-011).
+
+**Checkpoint**: User Story 1 is fully functional and independently testable. This is the MVP — the
+analyst can establish an advisory's product scope from the report alone.
+
+---
+
+## Phase 4: User Story 2 — Long scope statements stay readable (Priority: P2)
+
+**Goal**: A statement running to 21 paragraphs and 4,783 characters does not swallow its row, while
+remaining wholly present in the file, in browser search, and in print.
+
+**Independent Test**: Render a report containing the longest recorded statement; confirm the extract,
+the disclosure control, that neighbouring rows stay readable and do not shift when one is expanded, and
+that a phrase appearing only in the collapsed portion is still findable in the document.
+
+- [ ] T024 [US2] Render each statement as extract plus remainder in `caia/bundle_report.py`, using `csaf.extract_blocks()` from T007. Wrap the remainder in `<details>` with a summary indicating more text exists. The disclosure appears **if and only if** text lies beyond the extract, so its presence always means text is hidden (FR-031). Add tests in `tests/test_bundle_report.py` for both a short statement (no control at all) and a long one.
+- [ ] T025 [US2] Add tests in `tests/test_bundle_report.py` proving collapsed text is **never truncated out of the file** (FR-032, SC-008): a phrase occurring only in the collapsed remainder is present in the rendered HTML. `<details>` keeps it in the document and therefore in browser search and in print; a fixed-height scroll box or a character cap would not.
+- [ ] T026 [US2] Give the two scope-bearing columns explicit widths in `caia/bundle_report.py` so expanding one row's disclosure cannot reflow or resize another row's columns (FR-033) — the same fix 4.2.1 applied to the appendix tables. Add a test asserting the widths are declared.
+- [ ] T027 [US2] Confirm the existing `#expand-all` control opens these disclosures in `caia/bundle_report.py` (it already targets every `details`, so using `details` in T024 should suffice — verify rather than assume), and that the column stays legible in greyscale and print (FR-034). Add a test in `tests/test_bundle_report.py`.
+- [ ] T028 [US2] Add a test in `tests/test_bundle_report.py` for the procedure-heading advisory end to end: its extract shows the scope claim, and no procedure section's body appears in its place (FR-048). This is the case the original FR-031 got wrong; the unit test in T007 covers the selection, this covers the rendering.
+
+**Checkpoint**: User Stories 1 and 2 both work independently.
+
+---
+
+## Phase 5: User Story 3 — An unavailable scope statement says so (Priority: P2)
+
+**Goal**: An unavailable statement is explicit about which of the five causes applied, keeps its link
+to Cisco, and is counted in the header — so an operator can tell a local network problem from a
+Cisco-side change, and no reader can mistake the cell for "no products affected".
+
+**Independent Test**: Simulate each failure mode and confirm the per-row wording, the named cause, the
+retained advisory link, and the header count — including when the count is zero.
+
+- [ ] T029 [US3] Render the unavailability notice in `caia/bundle_report.py`: an explicit statement naming its cause in a few readable words, marked in **words as well as colour** (reusing the existing yellow `undet` treatment, which the report already teaches means *unknown, not safe*), and never blank or "none" (FR-026, FR-044). Add tests in `tests/test_bundle_report.py` for all five causes.
+- [ ] T030 [US3] Render per-statement independence in `caia/bundle_report.py`: where one statement is available and the other is not, show the available one and mark only the absent one (FR-028). Add a test in `tests/test_bundle_report.py`.
+- [ ] T031 [US3] Keep the advisory identifier a link to Cisco on rows whose scope is unavailable, in `caia/bundle_report.py`, so scope can be checked at source. Add a test in `tests/test_bundle_report.py`.
+- [ ] T032 [US3] Add the missing-statement count to the report header in `caia/bundle_report.py`, **stated even when zero** — a stated zero is evidence, an omission is an absence (FR-030). Add tests in `tests/test_bundle_report.py` for zero, one, and many.
+- [ ] T033 [US3] Mark the statements of advisories a stopped run never reached with cause `not-reached` rather than blank, in `caia/analyzer.py` and `caia/bundle_report.py` (FR-041). Add a test in `tests/test_bundle_flow.py` for a partial run.
+
+**Checkpoint**: User Stories 1–3 all work independently.
+
+---
+
+## Phase 6: User Story 4 — The scope's provenance is auditable from the report (Priority: P3)
+
+**Goal**: The report records which revision of each Cisco document each statement came from, so two
+reports either side of a revision can be told apart.
+
+**Independent Test**: Render from documents with known revision identifiers and confirm the report
+states them and that a reader can attribute each statement to a revision.
+
+- [ ] T034 [US4] Capture `document.tracking.version` into `AdvisoryScope.revision` in `caia/csaf.py` (FR-035), and `""` when absent. Add a test in `tests/test_csaf.py`.
+- [ ] T035 [US4] Render the revision record in `caia/bundle_report.py` as an appendix alongside the existing resolved-scope appendix, listing each advisory and the document revision read. Add a test in `tests/test_bundle_report.py`.
+
+**Checkpoint**: all four user stories independently functional.
+
+---
+
+## Phase 7: Polish & Cross-Cutting Concerns
+
+**Purpose**: The documentation and versioning gates, then end-to-end validation. The constitution
+amendment this feature needed is already enacted (3.3.1, `csaf` named in Principle VI and in the
+Consumers list) — these are the obligations it deliberately deferred.
+
+- [ ] T036 Update the shared-surface table in `README.md`: add a `csaf.py` row ("the only module that reads Cisco's published advisory documents"), and **correct the `erp.py` row**, which currently claims to be "the only module that talks to Cisco's Security Center" — false once `csaf.py` exists. Update the surrounding "six modules" prose to seven (Documentation gate).
+- [ ] T037 [P] Mirror the `README.md` changes in `docs/index.html` to the extent it describes the sources the tool reads. The Documentation gate requires the two to stay consistent with each other and with the code.
+- [ ] T038 [P] Set `VERSION` to `4.3.0` — additive report change plus a shared-surface addition, so MINOR (Versioning gate). Confirm `pyproject.toml` needs no change and that no runtime dependency was added (FR-042).
+- [ ] T039 Run the full suite: `.venv/bin/python -m unittest discover -s tests` must report `OK` with the 402-test baseline plus this feature's additions, all with no credentials and no network access.
+- [ ] T040 Work through [quickstart.md](./quickstart.md) §3 by eye on a rendered report — the 12 visual checks covering column titles, date position, extract, disclosure-only-when-hidden, Ctrl+F into collapsed text, print completeness, no reflow on expand, expand-all, unavailable wording, and greyscale legibility.
+- [ ] T041 Run the live validation from [quickstart.md](./quickstart.md) §4 against `ERP-75736` and confirm the measured claims hold: advisory-API request count **unchanged** from a 4.2.1 run (FR-024), ~424 KB transferred for scope retrieval rather than 12.9 MB (FR-040), added elapsed time a small fraction of the assessment (FR-039, SC-009), progress visible throughout (FR-047), and 25 of 25 rows carrying both statements (FR-009).
+- [ ] T042 Verify provenance by hand for one advisory (SC-004): open Cisco's published page for `cisco-sa-onprem-fmc-authbypass-5JPp45V2` and compare its two sections against the rendered cell. Every difference must be attributable to FR-014 or FR-015. Anything else is a defect, not a discrepancy.
+- [ ] T043 Run the failure validation from [quickstart.md](./quickstart.md) §5: with the host unreachable, the run completes, verdicts are identical, all 25 cells state `unreachable` and none is blank, and the header reports 25 missing.
+
+---
+
+## Dependencies & Execution Order
+
+### Phase Dependencies
+
+- **Setup (Phase 1)**: no dependencies — start immediately.
+- **Foundational (Phase 2)**: depends on Phase 1. **Blocks every user story.**
+- **User Story 1 (Phase 3)**: depends on Phase 2. No dependency on any other story.
+- **User Story 2 (Phase 4)**: depends on Phase 2; renders what T007 selects. Independently testable.
+- **User Story 3 (Phase 5)**: depends on Phase 2; renders the causes T010 detects. Independently testable.
+- **User Story 4 (Phase 6)**: depends on Phase 2. Smallest and last.
+- **Polish (Phase 7)**: depends on every story intended to ship. T036–T038 are gates, not options.
+
+### Within Phase 2
+
+- T003, T004 → T005 → T006 → T007 (all in `caia/csaf.py`; sequential, same file)
+- T008 → T009 → T010 → T011 → T012 → T013 (retrieval chain, same file)
+- T014 (`caia/bundle.py`) and T015 (`caia/bundle_report.py`) are independent of the `csaf.py` chain
+
+### Within each user story
+
+- Rendering tasks in `caia/bundle_report.py` touch one file, so they are sequential within a story.
+- Each story's tests live beside its implementation task rather than in a separate up-front block:
+  every rule here is provable from recorded fixtures, so a test written with its task is verifiable
+  immediately rather than accumulating as a batch of failures.
+
+### Parallel Opportunities
+
+- **Phase 1**: T001 is independent of T002 in practice (different files) — T001 is marked [P].
+- **Phase 2**: T014 (`bundle.py`) can proceed in parallel with the whole `csaf.py` chain. T015 too,
+  though it touches `bundle_report.py` which Phase 3 also edits, so finishing it in Phase 2 avoids a
+  collision.
+- **Phases 4, 5 and 6** can be worked in parallel by different people once Phase 2 and 3 are done —
+  they touch different regions of `caia/bundle_report.py`, so coordinate or sequence if one person.
+- **Phase 7**: T037 and T038 are [P] (different files); T036 must land with them.
+
+### Same-file constraint
+
+Most of this feature lands in two files — `caia/csaf.py` and `caia/bundle_report.py`. **[P] is
+therefore rare and deliberately so.** Marking these parallel would invite conflicting edits to the same
+file, which is exactly the failure the marker exists to prevent.
+
+---
+
+## Parallel Example: Phase 2
+
+```bash
+# These touch three different files and can proceed concurrently:
+Task: "T014 Add Row.csaf_url and scope_targets() to caia/bundle.py"
+Task: "T015 Add the scopes= argument to caia/bundle_report.py"
+# ...while the csaf.py chain (T003-T013) proceeds in its own file.
+```
+
+## Parallel Example: Phase 7
+
+```bash
+Task: "T037 Mirror README changes in docs/index.html"
+Task: "T038 Set VERSION to 4.3.0"
+```
+
+---
+
+## Implementation Strategy
+
+### MVP First (User Story 1 only)
+
+1. Phase 1 — Setup (T001–T002)
+2. Phase 2 — Foundational (T003–T015). **Blocks everything; do not shortcut it.**
+3. Phase 3 — User Story 1 (T016–T023)
+4. **STOP and VALIDATE**: the column exists, both statements render, no cell is blank, verdicts are
+   untouched. This is a shippable increment on its own.
+
+### Incremental Delivery
+
+1. Setup + Foundational → the shared surface is proven with no network
+2. + User Story 1 → the column works — **MVP**
+3. + User Story 2 → long statements stop dominating rows
+4. + User Story 3 → unavailability becomes diagnosable rather than merely safe
+5. + User Story 4 → the audit record
+6. + Polish → gates and end-to-end validation
+
+Each step leaves the report correct. None of stories 2–4 can make a previously-correct cell wrong,
+because Phase 2 defaults every cell to *unavailable* rather than blank.
+
+### Why the pure work comes first
+
+T003–T007 are the rules a reviewer has to trust: they decide what the report attributes to Cisco.
+They need no network, no credentials and no HTML, so they are provable in isolation before a single
+byte is fetched. If the normalisation is wrong, everything downstream renders a faithful copy of the
+wrong text — and the constitution's per-normalisation test clause exists precisely because that
+failure is invisible in a passing integration test.
+
+---
+
+## Notes
+
+- **[P] = different file, no dependency.** Rare here by design; see the same-file constraint above.
+- **Two tests are easy to write wrongly, and both matter more than the rest:**
+  - **T020** must assert the text *after* `<interface_name>` survives. A test checking only that the
+    placeholder appears passes while the report silently deletes Cisco's scope.
+  - **T004** must assert both directions — the navigational sentence removed *and* the substantive
+    "Only products listed…" sentence retained. Only 31 sentences should go; 25 similar-looking ones
+    must stay.
+- **T001 must use recorded text.** Faithfulness tests against invented fixtures prove nothing.
+- Commit after each task or logical group; stop at any checkpoint to validate a story independently.
+- The baseline is 402 passing tests. A run that reports fewer has lost coverage, not gained speed.

From aaf085a946954a0840edd954727c98c95deae888 Mon Sep 17 00:00:00 2001
From: Ali Bahaloo <ali.bahaloo@telusinternational.com>
Date: Wed, 29 Jul 2026 00:14:54 -0700
Subject: [PATCH 6/7] =?UTF-8?q?docs(009):=20close=20the=20analysis=20findi?=
 =?UTF-8?q?ngs=20=E2=80=94=20data-locality=20tests,=20Principle=20VI=20rea?=
 =?UTF-8?q?soning?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

/speckit-analyze found two HIGH and seven MEDIUM issues across spec, plan and
tasks. All are remediated; task IDs are unchanged and all 43 still match the
checklist format. Citation coverage 83% -> 97%; genuinely uncovered requirements
4 -> 0.

The two that mattered:

- G1: no task verified FR-022/FR-023, the two data-locality requirements. This
  feature adds a new outbound HTTP path and nothing asserted it carries no
  credentials and nothing inventory-derived — the exact bound Principle V exists to
  enforce, and one of the three principles the Review gate names explicitly. Folded
  into T013, which already builds the captured-request harness, asserting against
  the full request rather than the URL alone so a header added later cannot slip
  past.

- D1: Principle VI requires a shared-surface function to report unreachability "as
  an error rather than as a set of undecided verdicts", while FR-029 requires scope
  retrieval to be non-fatal. Nothing adjudicated it, so the PR gate reviewer would
  have had to block or wave it through unreasoned. The plan's Principle VI row now
  argues it: the clause protects verdicts, a scope statement is not one (FR-011),
  and the distinct `unreachable` and `no-content` causes preserve the "could not
  ask" vs "asked and got nothing" distinction more finely than raising would.

Quantifying FR-046's courtesy delay (A1) exposed a real conflict rather than just
vague wording: the 0.4 s measured during research puts a 25-advisory bundle at ~26%
added elapsed time and breaches FR-039's one-quarter budget. FR-046 now bounds the
delay at 150-250 ms with the arithmetic stated, and FR-043's retry delay references
it instead of saying "a short delay".

Also: FR-011 gained a test task for ordering/filters/sorts (T023) rather than only
an implementation constraint; T039 names test_html_report.py as FR-037's guard and
adds a no-external-URL assertion for FR-036; T014 asserts scope_targets does not
mutate the caller's devices, a property the Tests gate names; plan.md's "five
modules touched" corrected to three modified plus one added; spec.md notes that FR
identifiers are grouped thematically, not positionally; four SC/FR citations added
for traceability.

FR-012 and SC-001 remain uncited deliberately — FR-012 is subsumed by FR-013, whose
no-other-alteration test in T006 is the operative check, and SC-001 is an outcome
metric validated indirectly by T040/T041.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 specs/009-affected-products-column/plan.md  |  5 +++--
 specs/009-affected-products-column/spec.md  |  6 ++++--
 specs/009-affected-products-column/tasks.md | 16 ++++++++--------
 3 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/specs/009-affected-products-column/plan.md b/specs/009-affected-products-column/plan.md
index e70c8b4..ff60aa2 100644
--- a/specs/009-affected-products-column/plan.md
+++ b/specs/009-affected-products-column/plan.md
@@ -45,7 +45,8 @@ sequential with a fixed courtesy delay, never a burst (FR-046); ≤ 3.4% of docu
 (FR-040); report remains a single self-contained file rendering with no network (FR-036).
 
 **Scale/Scope**: 25 advisories per bundle (reference), 70-device inventory. 42 KB of statement text
-added to a report currently measured at 795 KB. Five modules touched, one added.
+added to a report currently measured at 795 KB. Three modules modified (`bundle`, `bundle_report`,
+`analyzer`), one added (`csaf`).
 
 ## Constitution Check
 
@@ -60,7 +61,7 @@ see the gate outcome below.*
 | **III. CLI-First, Scriptable** | ✅ Pass | No new command, flag, or mode. The existing `--erp` path gains content. Nothing is reachable only interactively. |
 | **IV. Conservative & Traceable Analysis** | ✅ Pass | The column cannot influence any verdict, count, population, family derivation, ordering, filter or sort (FR-011). An unavailable statement renders as an explicit cause and never as an absence (FR-026, FR-044) — the same discipline as an undetermined device never reading as unaffected. Text is rendered faithfully under exactly two enumerated normalisations (FR-012–FR-016). |
 | **V. Secrets Hygiene & Data Locality** | ✅ Pass | Retrieval is unauthenticated (FR-022) and carries no inventory-derived data — not even the family/platform/release triple the advisory API is permitted (FR-023). No document reaches disk (FR-025). |
-| **VI. Headless Shared Surface** | ✅ Pass | `csaf` is named in the enumeration as of **3.3.1**, enacted on this branch once Phase 0 chose a new module. The criterion already covered it in 3.3.0, so the amendment added no obligation. `csaf` must print nothing, prompt for nothing, consult no working folder, write no file, and not exit the process (FR-038); progress goes through a caller-supplied callback (FR-047). |
+| **VI. Headless Shared Surface** | ✅ Pass | `csaf` is named in the enumeration as of **3.3.1**, enacted on this branch once Phase 0 chose a new module. The criterion already covered it in 3.3.0, so the amendment added no obligation. `csaf` must print nothing, prompt for nothing, consult no working folder, write no file, and not exit the process (FR-038); progress goes through a caller-supplied callback (FR-047). On the principle's error-versus-undecided clause — "a shared-surface function MUST report a failure to *reach* Cisco as an error rather than as a set of undecided verdicts" — `retrieve_many` returns `unreachable` causes rather than raising, and that is compliant rather than an exception. The clause protects verdicts, and a scope statement is not one: FR-011 forbids it from influencing any determination, so an unavailable statement cannot become an undecided verdict. The distinction the clause exists to preserve is preserved exactly, and more finely than raising would: `unreachable` ("we could not ask") and `no-content` ("we asked and Cisco published nothing") are separate causes a caller can act on differently, where an exception would collapse both into one signal. FR-029's non-fatal requirement is therefore not in tension with the clause — it is what lets the assessment's own verdicts survive a scope-retrieval failure untouched. |
 | **Source of truth** | ✅ Pass | Every advisory fact — title, severity, score, CVEs, publication date, fixing release, affected platform — still comes from the advisory API. The document contributes two statements plus an identity check and a revision, and nothing else (contract table, FR-021). |
 | **Scope selectors** | ✅ Pass | Untouched and not relied upon. The bundle page still supplies only membership and its own identity. |
 | **Advisory scope statements** (new in 3.3.0) | ✅ Pass | This is the permission the feature exercises. Bounded to the two statements, located via the API-supplied pointer, identity cross-checked, API wins on disagreement, faithfully rendered under enumerated normalisations. |
diff --git a/specs/009-affected-products-column/spec.md b/specs/009-affected-products-column/spec.md
index 9f2f04e..23deea3 100644
--- a/specs/009-affected-products-column/spec.md
+++ b/specs/009-affected-products-column/spec.md
@@ -123,6 +123,8 @@ A reviewer, months later, needs to establish where the scope text came from and
 
 ### Functional Requirements
 
+*Identifiers are grouped thematically, not positionally. FR-043–FR-048 were added by clarification and planning and sit in the thematic group they belong to, so document order runs …FR-038, FR-047, FR-039… — search by identifier rather than scanning to the end.*
+
 **Publication date relocation**
 
 - **FR-001**: The bundle-scoped report MUST show each advisory's publication date inside the Advisory column, as a smaller labelled element positioned beside the CVSS score.
@@ -161,9 +163,9 @@ A reviewer, months later, needs to establish where the scope text came from and
 - **FR-022**: Retrieval MUST be unauthenticated: it MUST NOT carry the API credentials.
 - **FR-023**: Retrieval MUST carry no inventory-derived data whatsoever — not a device name, and not the family, platform or release triple the advisory API is permitted. The only value sent is the advisory identifier.
 - **FR-024**: Retrieval MUST NOT consume the Cisco advisory API's request quota, and MUST NOT change the number of advisory-API requests a bundle review makes.
-- **FR-046**: Retrievals MUST be issued sequentially, separated by a small fixed courtesy delay, and MUST NOT be issued as a concurrent burst. Cisco publishes no request allowance for this host, so the product MUST NOT rely on one; the pacing MUST remain small enough to satisfy FR-039.
+- **FR-046**: Retrievals MUST be issued sequentially, separated by a fixed courtesy delay of **at least 150 ms and no more than 250 ms**, and MUST NOT be issued as a concurrent burst. Cisco publishes no request allowance for this host, so the product MUST NOT rely on one. The upper bound is set by FR-039: at 25 advisories, a 250 ms delay costs ~6 s of pacing on top of ~9 s of requests, or ~21% of a 72 s assessment, while a 400 ms delay would reach ~26% and breach the one-quarter budget.
 - **FR-025**: The product MUST NOT write any retrieved document to disk, and MUST NOT create a temporary folder for one.
-- **FR-043**: A retrieval that fails at the transport level — timeout, connection, TLS, or proxy error — MUST be retried exactly once after a short delay. A retrieval that completes but yields an empty body, unreadable content, or a document failing FR-020 MUST NOT be retried, because each of those outcomes is deterministic and a second attempt would fail identically. Total attempts per advisory MUST therefore never exceed two.
+- **FR-043**: A retrieval that fails at the transport level — timeout, connection, TLS, or proxy error — MUST be retried exactly once after a delay of at least the FR-046 courtesy interval. A retrieval that completes but yields an empty body, unreadable content, or a document failing FR-020 MUST NOT be retried, because each of those outcomes is deterministic and a second attempt would fail identically. Total attempts per advisory MUST therefore never exceed two.
 
 **Unavailability**
 
diff --git a/specs/009-affected-products-column/tasks.md b/specs/009-affected-products-column/tasks.md
index b5a9a97..6d7dc56 100644
--- a/specs/009-affected-products-column/tasks.md
+++ b/specs/009-affected-products-column/tasks.md
@@ -63,9 +63,9 @@ all (plan, implementation sequence step 1).
 - [ ] T010 Implement **statement extraction and classification** in `caia/csaf.py`: pull `document.notes` entries titled `Vulnerable Products` and `Products Confirmed Not Vulnerable` and nothing else (FR-010, FR-021); resolve every failure to exactly one of the five closed causes (FR-027, FR-044, FR-045). Add tests in `tests/test_csaf.py` reaching each cause and asserting they are distinct — **including that a zero-length body classifies as `no-content` rather than as a statement with no content**, since Cisco serves a missing document as HTTP 200 with an empty body.
 - [ ] T011 Implement **retry** in `caia/csaf.py`: exactly one retry after a short delay for transport failures — timeout, connection, TLS, proxy — and no retry for an empty body, unreadable content, or an identity mismatch; attempts never exceed two (FR-043). Add tests in `tests/test_csaf.py` asserting the attempt count in both directions.
 - [ ] T012 Implement **pacing** in `caia/csaf.py`: retrievals issued sequentially with a small fixed courtesy delay, never concurrently (FR-046). Reuse the injectable `sleep`/`clock` seam `psirt.Client` already established so tests assert pacing without waiting. Do **not** reuse the advisory API's ~2.1 s interval — that satisfies a published quota this host does not have, and would breach FR-039. Add a test in `tests/test_csaf.py` on an injected clock.
-- [ ] T013 Implement `retrieve_many(targets, on_progress=None, …)` in `caia/csaf.py` returning `{advisory_id: AdvisoryScope}`, reporting progress through the caller-supplied callback only (FR-047). Add tests in `tests/test_csaf.py` for the **headless property** (FR-038): prints nothing, prompts for nothing, consults no working folder, writes no file, does not exit the process — and writes no retrieved document to disk and creates no temporary folder (FR-025).
-- [ ] T014 [P] Add `Row.csaf_url` (reading `record["csafUrl"]`, `""` when absent) and the pure `scope_targets(bundle_advisory_ids, devices, records)` helper to `caia/bundle.py`. The location is never constructed (FR-019); every bundle advisory gets an entry, an absent record mapping to `""`. Add tests in `tests/test_bundle.py`, including that the accounting invariant `impacted + unaffected + undetermined == population` is unchanged (SC-011).
-- [ ] T015 Add the optional `scopes=None` argument to `render`, `write_report` and `build_and_write` in `caia/bundle_report.py`. When omitted or missing an advisory, that cell renders **unavailable, never blank** — an older caller must not be able to produce a report that reads as "no products affected". Add a test in `tests/test_bundle_report.py` calling without `scopes`.
+- [ ] T013 Implement `retrieve_many(targets, on_progress=None, …)` in `caia/csaf.py` returning `{advisory_id: AdvisoryScope}`, reporting progress through the caller-supplied callback only (FR-047). Add tests in `tests/test_csaf.py` for the **headless property** (FR-038): prints nothing, prompts for nothing, consults no working folder, writes no file, does not exit the process — and writes no retrieved document to disk and creates no temporary folder (FR-025). **Add data-locality tests on the captured request (FR-022, FR-023, SC-010): no `Authorization` header and no credential material of any kind is sent, and the request carries nothing inventory-derived — no device name, no family, no platform alias, no release string — the advisory identifier inside the supplied URL being the only value that leaves the machine. Assert against the full captured request (URL, headers, body), not just the URL, so a header added later cannot slip past.**
+- [ ] T014 [P] Add `Row.csaf_url` (reading `record["csafUrl"]`, `""` when absent) and the pure `scope_targets(bundle_advisory_ids, devices, records)` helper to `caia/bundle.py`. The location is never constructed (FR-019); every bundle advisory gets an entry, an absent record mapping to `""`. Add tests in `tests/test_bundle.py`, including that the accounting invariant `impacted + unaffected + undetermined == population` is unchanged (SC-011). **Assert that `scope_targets` does not mutate the `devices` list or any device dict it is passed — the constitution's Tests gate names non-mutation of the caller's input as a required property of the shared surface.**
+- [ ] T015 Add the optional `scopes=None` argument to `render`, `write_report` and `build_and_write` in `caia/bundle_report.py`. When omitted or missing an advisory, that cell renders **unavailable, never blank** (FR-026) — an older caller must not be able to produce a report that reads as "no products affected". Add a test in `tests/test_bundle_report.py` calling without `scopes`.
 
 **Checkpoint**: `caia/csaf.py` is complete and fully tested with no network and no credentials; the
 report accepts scope statements but does not yet render them.
@@ -89,7 +89,7 @@ under their own headings in every row — with no credentials and no network.
 - [ ] T020 [US1] Escape every rendered character through `esc()` in `caia/bundle_report.py` (FR-018). Add tests in `tests/test_bundle_report.py` that **assert the text following `<interface_name>` is still present**, not merely that the placeholder renders — an unescaped render deletes the placeholder *and* everything to the next `>`, so a test that only checks for the placeholder passes while the report silently omits Cisco's scope (SC-005). Add a hostile-input test proving statement content cannot alter structure, styling or behaviour.
 - [ ] T021 [US1] Add the Affected Products column CSS to `caia/bundle_report.py`: heading weight, the smaller `pubdate` label, and the reassigned column widths taking the 12% released by the old date column. No meaning carried by colour alone (FR-034).
 - [ ] T022 [US1] Wire retrieval into the run in `caia/analyzer.py`: after the assessment and before the report, call `bundle.scope_targets()` then `csaf.retrieve_many()`, reporting progress through the existing `ui` output so the retrieval phase is never a silent pause (FR-047); pass `scopes` into `bundle_report.build_and_write`. Scope must reach the report and nothing else — no verdict, count, population, family derivation, ordering, filter or sort may read it (FR-011).
-- [ ] T023 [US1] Add non-fatal-failure tests in `tests/test_bundle_flow.py`: with retrieval succeeding, failing for some advisories, and failing for all, every device verdict, reason and count is identical, and the report is still written (FR-029, SC-006). Assert each row's counts still sum to its population (SC-011).
+- [ ] T023 [US1] Add non-fatal-failure tests in `tests/test_bundle_flow.py`: with retrieval succeeding, failing for some advisories, and failing for all, every device verdict, reason and count is identical, and the report is still written (FR-029, SC-006). Assert each row's counts still sum to its population (SC-011). **Assert that the new column influences nothing else (FR-011): `bundle.row_sort_key` returns identical ordering with and without `scopes`, and the `all` / `impacting` / `clean` filters and both sort controls select the same rows either way. Stating FR-011 as an implementation constraint in T022 does not test it.**
 
 **Checkpoint**: User Story 1 is fully functional and independently testable. This is the MVP — the
 analyst can establish an advisory's product scope from the report alone.
@@ -124,7 +124,7 @@ Cisco-side change, and no reader can mistake the cell for "no products affected"
 **Independent Test**: Simulate each failure mode and confirm the per-row wording, the named cause, the
 retained advisory link, and the header count — including when the count is zero.
 
-- [ ] T029 [US3] Render the unavailability notice in `caia/bundle_report.py`: an explicit statement naming its cause in a few readable words, marked in **words as well as colour** (reusing the existing yellow `undet` treatment, which the report already teaches means *unknown, not safe*), and never blank or "none" (FR-026, FR-044). Add tests in `tests/test_bundle_report.py` for all five causes.
+- [ ] T029 [US3] Render the unavailability notice in `caia/bundle_report.py`: an explicit statement naming its cause in a few readable words, marked in **words as well as colour** (reusing the existing yellow `undet` treatment, which the report already teaches means *unknown, not safe*), and never blank or "none" (FR-026, FR-044, SC-002, SC-012). Add tests in `tests/test_bundle_report.py` for all five causes.
 - [ ] T030 [US3] Render per-statement independence in `caia/bundle_report.py`: where one statement is available and the other is not, show the available one and mark only the absent one (FR-028). Add a test in `tests/test_bundle_report.py`.
 - [ ] T031 [US3] Keep the advisory identifier a link to Cisco on rows whose scope is unavailable, in `caia/bundle_report.py`, so scope can be checked at source. Add a test in `tests/test_bundle_report.py`.
 - [ ] T032 [US3] Add the missing-statement count to the report header in `caia/bundle_report.py`, **stated even when zero** — a stated zero is evidence, an omission is an absence (FR-030). Add tests in `tests/test_bundle_report.py` for zero, one, and many.
@@ -143,7 +143,7 @@ reports either side of a revision can be told apart.
 states them and that a reader can attribute each statement to a revision.
 
 - [ ] T034 [US4] Capture `document.tracking.version` into `AdvisoryScope.revision` in `caia/csaf.py` (FR-035), and `""` when absent. Add a test in `tests/test_csaf.py`.
-- [ ] T035 [US4] Render the revision record in `caia/bundle_report.py` as an appendix alongside the existing resolved-scope appendix, listing each advisory and the document revision read. Add a test in `tests/test_bundle_report.py`.
+- [ ] T035 [US4] Render the revision record (FR-035) in `caia/bundle_report.py` as an appendix alongside the existing resolved-scope appendix, listing each advisory and the document revision read. Add a test in `tests/test_bundle_report.py`.
 
 **Checkpoint**: all four user stories independently functional.
 
@@ -158,8 +158,8 @@ Consumers list) — these are the obligations it deliberately deferred.
 - [ ] T036 Update the shared-surface table in `README.md`: add a `csaf.py` row ("the only module that reads Cisco's published advisory documents"), and **correct the `erp.py` row**, which currently claims to be "the only module that talks to Cisco's Security Center" — false once `csaf.py` exists. Update the surrounding "six modules" prose to seven (Documentation gate).
 - [ ] T037 [P] Mirror the `README.md` changes in `docs/index.html` to the extent it describes the sources the tool reads. The Documentation gate requires the two to stay consistent with each other and with the code.
 - [ ] T038 [P] Set `VERSION` to `4.3.0` — additive report change plus a shared-surface addition, so MINOR (Versioning gate). Confirm `pyproject.toml` needs no change and that no runtime dependency was added (FR-042).
-- [ ] T039 Run the full suite: `.venv/bin/python -m unittest discover -s tests` must report `OK` with the 402-test baseline plus this feature's additions, all with no credentials and no network access.
-- [ ] T040 Work through [quickstart.md](./quickstart.md) §3 by eye on a rendered report — the 12 visual checks covering column titles, date position, extract, disclosure-only-when-hidden, Ctrl+F into collapsed text, print completeness, no reflow on expand, expand-all, unavailable wording, and greyscale legibility.
+- [ ] T039 Run the full suite: `.venv/bin/python -m unittest discover -s tests` must report `OK` with the 402-test baseline plus this feature's additions, all with no credentials and no network access. **`tests/test_html_report.py` MUST pass unmodified — that suite is the guard for FR-037 (the whole-fleet report is unchanged), and naming it here makes the guard explicit rather than incidental. Also assert that a rendered bundle report references no external URL for styling, script or asset, so FR-036's self-containment is verified rather than assumed.**
+- [ ] T040 Work through [quickstart.md](./quickstart.md) §3 by eye on a rendered report — the 12 visual checks covering column titles, date position, extract, disclosure-only-when-hidden, Ctrl+F into collapsed text, print completeness, no reflow on expand, expand-all, unavailable wording (SC-007), and greyscale legibility.
 - [ ] T041 Run the live validation from [quickstart.md](./quickstart.md) §4 against `ERP-75736` and confirm the measured claims hold: advisory-API request count **unchanged** from a 4.2.1 run (FR-024), ~424 KB transferred for scope retrieval rather than 12.9 MB (FR-040), added elapsed time a small fraction of the assessment (FR-039, SC-009), progress visible throughout (FR-047), and 25 of 25 rows carrying both statements (FR-009).
 - [ ] T042 Verify provenance by hand for one advisory (SC-004): open Cisco's published page for `cisco-sa-onprem-fmc-authbypass-5JPp45V2` and compare its two sections against the rendered cell. Every difference must be attributable to FR-014 or FR-015. Anything else is a defect, not a discrepancy.
 - [ ] T043 Run the failure validation from [quickstart.md](./quickstart.md) §5: with the host unreachable, the run completes, verdicts are identical, all 25 cells state `unreachable` and none is blank, and the header reports 25 missing.

From be3a82600156c3b08459f1f85c6638670ec432c4 Mon Sep 17 00:00:00 2001
From: Ali Bahaloo <ali.bahaloo@telusinternational.com>
Date: Wed, 29 Jul 2026 08:05:07 -0700
Subject: [PATCH 7/7] =?UTF-8?q?feat(009):=20Affected=20Products=20column?=
 =?UTF-8?q?=20=E2=80=94=20Cisco's=20own=20scope=20statements=20(4.3.0)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The bundle report was authoritative about impact and silent about applicability.
A row said "5 devices impacted, fixed in 7.4.6" but never what Cisco scoped the
advisory to, nor which Cisco products Cisco had explicitly ruled out — so an
analyst opened Cisco's page once per advisory, 25 times per bundle review, and the
archived report carried no record of the scope the decision rested on.

The publication date moves into the Advisory column beside the CVSS score, and the
column it vacated becomes "Affected Products", carrying Cisco's own Vulnerable
Products and Products Confirmed Not Vulnerable statements in Cisco's words. The
third column becomes "Your impacted devices" so Cisco's generic scope cannot be
read as a finding about the reader's estate.

New shared-surface module caia/csaf.py — the only module that reads Cisco's
published advisory documents. It exists rather than extending erp or psirt for
reasons stronger than tidiness: erp is deliberately built with no route to
supplying an advisory fact, and psirt owns the credentials this request must not
carry. Constitution 3.3.0 admitted the source; 3.3.1 named the module.

Retrieval follows the csafUrl the advisory API already returns for every record the
report holds, so no URL is constructed and no additional advisory-API request is
made — verified live at 0 extra requests. It streams each response and stops once
the top-level `document` object parses, measured live at 131 KB against 2.53 MB.
One retry on transport failure only; sequential with a 200 ms courtesy delay; every
failure non-fatal and rendered as one of five named causes, never a blank cell.

Faithfulness is enforced rather than intended: exactly two normalisations are
permitted, each has its own test, and a further test reconstructs all eight
recorded statements from those two rules alone and asserts the output is identical.
The worked example matches Cisco's published text character for character.

Defects found and fixed while building:

- The extract hid the substance of every not-vulnerable statement. Replacing
  FR-031's vague "long enough to dominate its row" with "always extract" removed
  the vagueness but started collapsing short statements, showing the boilerplate
  "Only products listed in the Vulnerable Products section..." and hiding the four
  products Cisco rules out. Now gated on a stated 900-character threshold, set from
  the measured distribution so no not-vulnerable statement ever collapses.
- The flow tests were making real network calls (7.4s, from milliseconds), which
  breaks the constitution's no-network test rule. Injected opener.
- delay=COURTESY_DELAY bound at import, so adjusting the constant did nothing and
  the suite slept for real. Resolved at call time, with a test that catches it.
- psirt fixture carried a placeholder csafUrl that did not encode the advisory id,
  which the identity check correctly rejected. Made realistic — as was the
  placeholder advisoryTitle, which made rendered previews look as though the title
  line duplicated the identifier.
- The publication timestamp broke mid-value across lines. Value now nowrap.

Also corrected: 3.4% is the document object-size floor, not what a chunked reader
transfers (5.2% measured live). Spec 008's suite never asserted the column headers,
so renaming two of them broke nothing; all three are now pinned.

537 tests pass, up from 402, with no credentials and no network. README and
docs/index.html updated for the seven-module shared surface. No new dependency.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 README.md                                     |   5 +-
 VERSION                                       |   2 +-
 caia/analyzer.py                              |  38 +-
 caia/bundle.py                                |  30 +
 caia/bundle_report.py                         | 226 +++++-
 caia/csaf.py                                  | 582 ++++++++++++++
 docs/index.html                               |  16 +-
 .../contracts/affected-products-column.md     |   8 +-
 .../contracts/csaf-access.md                  |   8 +
 .../009-affected-products-column/research.md  |   9 +-
 specs/009-affected-products-column/spec.md    |   3 +-
 specs/009-affected-products-column/tasks.md   |  86 +-
 tests/fixtures/csaf_documents.py              | 216 +++++
 tests/fixtures/psirt_responses.py             |   7 +-
 tests/test_bundle.py                          |  80 +-
 tests/test_bundle_flow.py                     | 157 +++-
 tests/test_bundle_report.py                   | 426 +++++++++-
 tests/test_csaf.py                            | 735 ++++++++++++++++++
 18 files changed, 2555 insertions(+), 79 deletions(-)
 create mode 100644 caia/csaf.py
 create mode 100644 tests/fixtures/csaf_documents.py
 create mode 100644 tests/test_csaf.py

diff --git a/README.md b/README.md
index 8439416..71cfeda 100644
--- a/README.md
+++ b/README.md
@@ -448,8 +448,9 @@ to suppress it everywhere.
 | `matching.py` | pure verdict logic: release normalisation, model→platform mapping, verdicts | ✅ |
 | `psirt.py` | the only module that talks to Cisco's advisory API | ✅ |
 | `inventory.py` | read the inventory workbook into per-firewall records | ✅ |
-| `erp.py` | the only module that talks to Cisco's Security Center: resolve a bundle page to its advisory identifiers | ✅ |
+| `erp.py` | resolve a published bundle page to the advisory identifiers it contains — membership only, never an advisory fact | ✅ |
 | `bundle.py` | pure per-advisory aggregation: covered families, filtering, row construction | ✅ |
+| `csaf.py` | the only module that reads Cisco's published advisory documents, for an advisory's two product-scope statements and nothing else | ✅ |
 | `cli.py` | single entry point; refuses removed options, then dispatches `--help`/`--version`/`--update`/`--uninstall`/`--config` and the run | |
 | `analyzer.py` | terminal run flow + interactive prompts (working-folder inventory + `output/`) | |
 | `html_report.py` | render the self-contained HTML report, one row per firewall | |
@@ -458,7 +459,7 @@ to suppress it everywhere.
 | `version.py` | installed version, GitHub release discovery, uv-based update | |
 | `ui.py` | terminal colors + prompts (no dependencies) | |
 
-**Shared surface.** The six modules marked above are the ones a consumer other than this
+**Shared surface.** The seven modules marked above are the ones a consumer other than this
 CLI is expected to import; the rest are the terminal program built on top of them. The
 entry point is `assessment.analyze(inventory, client)` — it takes a list of per-device
 dicts (whatever produced them) plus a `psirt.Client` the caller owns, prints nothing,
diff --git a/VERSION b/VERSION
index fae6e3d..8089590 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-4.2.1
+4.3.0
diff --git a/caia/analyzer.py b/caia/analyzer.py
index fdddd23..9e75f53 100644
--- a/caia/analyzer.py
+++ b/caia/analyzer.py
@@ -22,7 +22,8 @@
 import sys
 from pathlib import Path
 
-from caia import assessment, bundle_report, config, erp, html_report, matching, psirt
+from caia import (assessment, bundle_report, config, csaf, erp, html_report, matching,
+                  psirt)
 from caia import inventory as inv
 from caia import ui
 
@@ -219,6 +220,37 @@ def fetch_missing_records(client, bundle, devices):
     return records
 
 
+def fetch_scope_statements(bundle, devices, records, opener=None):
+    """Cisco's own product-scope statements for every advisory in the bundle (spec 009).
+
+    Unauthenticated, and it sends nothing about any device — the advisory identifier inside the URL
+    Cisco's API supplied is the only value that leaves the machine.
+
+    Never fails a run. A statement that could not be retrieved renders as an explicit cause, so the
+    report says what it does not know rather than leaving a cell a reader would take as "Cisco
+    affects no products" (FR-026, FR-029). Progress is reported because ~25 sequential retrievals is
+    long enough that silence reads as a hang (FR-047).
+    """
+    from caia import bundle as bundle_logic
+
+    targets = bundle_logic.scope_targets(bundle.advisory_ids, devices, records=records)
+    if not targets:
+        return {}
+    ui.plain()
+    ui.system(f"Reading Cisco's product-scope statements for {len(targets)} "
+              f"advisor{'y' if len(targets) == 1 else 'ies'} ...")
+
+    def report(index, total, advisory_id):
+        ui.plain(ui.dim(f"  [{index}/{total}] {advisory_id}"))
+
+    scopes = csaf.retrieve_many(targets, on_progress=report, opener=opener)
+    missing = csaf.missing_count(scopes, bundle.advisory_ids)
+    if missing:
+        ui.info(f"{missing} advisor{'y' if missing == 1 else 'ies'} could not supply a "
+                "product-scope statement; the report says so per advisory.")
+    return scopes
+
+
 # --------------------------------------------------------------------------- #
 # Run flow
 # --------------------------------------------------------------------------- #
@@ -299,13 +331,15 @@ def report_progress(index, total, check):
 
     # 6. Report — bundle-scoped when a bundle was resolved, whole-fleet otherwise.
     records = fetch_missing_records(client, scope, devices) if scope else {}
+    scopes = fetch_scope_statements(scope, devices, records) if scope else None
     try:
         ensure_dirs(output_dir)
         if scope:
             out = bundle_report.build_and_write(
                 scope, devices, records=records, output_dir=str(output_dir),
                 questions_asked=client.request_count, partial_cause=partial_cause,
-                generated_at=summary["generated_at"], inventory_file=inv_path.name)
+                generated_at=summary["generated_at"], inventory_file=inv_path.name,
+                scopes=scopes)
         else:
             out = html_report.write_report(devices, summary, str(output_dir))
     except OSError as e:
diff --git a/caia/bundle.py b/caia/bundle.py
index 32ff309..e5217c4 100644
--- a/caia/bundle.py
+++ b/caia/bundle.py
@@ -164,6 +164,16 @@ def cves(self):
     def url(self):
         return str(self.record.get("publicationUrl") or "")
 
+    @property
+    def csaf_url(self):
+        """Where Cisco publishes this advisory's machine-readable document.
+
+        Read from the record, never constructed from the identifier. That is what keeps the scope
+        statements a *followed reference* rather than a second source the tool went looking for —
+        the basis on which the constitution admits them at all (spec 009 FR-019).
+        """
+        return str(self.record.get("csafUrl") or "")
+
     def accounts(self):
         """True when the row's three groupings account for its population exactly once."""
         return (len(self.impacted) + len(self.unaffected) + len(self.undetermined)
@@ -296,6 +306,26 @@ def missing_records(bundle_advisory_ids, devices):
     return [a for a in bundle_advisory_ids if a not in index]
 
 
+def scope_targets(bundle_advisory_ids, devices, records=None):
+    """`{advisory_id: csaf_url}` for every advisory in the bundle. Pure (spec 009 FR-019).
+
+    Lets the terminal layer retrieve the scope statements before rendering, so the report module
+    never performs network I/O.
+
+    Every bundle advisory gets an entry, including one whose record is missing — it maps to `""`,
+    which the retrieval resolves to an explicit "Cisco published no content" rather than dropping the
+    advisory. An advisory silently absent from this mapping would render as a blank cell, and a blank
+    cell reads as "no products affected" (FR-026).
+    """
+    index = index_advisories(devices)
+    targets = {}
+    for advisory_id in bundle_advisory_ids:
+        record = ((index.get(advisory_id) or {}).get("record")
+                  or (records or {}).get(advisory_id) or {})
+        targets[advisory_id] = str(record.get("csafUrl") or "")
+    return targets
+
+
 def suppressed_count(bundle_advisory_ids, devices):
     """Distinct advisories affecting the inventory that this bundle does not list (FR-016).
 
diff --git a/caia/bundle_report.py b/caia/bundle_report.py
index 262ed08..61920d8 100644
--- a/caia/bundle_report.py
+++ b/caia/bundle_report.py
@@ -27,6 +27,7 @@
 from pathlib import Path
 
 from caia import bundle as b
+from caia import csaf
 from caia import matching as m
 from caia.html_report import COVERAGE_NOTES, FILENAME_PREFIX, esc, reason_text
 
@@ -35,6 +36,22 @@
 # and a hidden device is an unpatched device.
 COLLAPSE_ABOVE = 8
 
+# One short sentence per unavailability cause (spec 009 FR-044). The mapping is total over
+# `csaf.CAUSES` and asserted so by a test: an unmapped cause would render as an empty cell, and an
+# empty cell reads as "Cisco affects no products".
+#
+# The words live here rather than in `csaf` because they are presentation — the same split the
+# whole-fleet report already makes with `reason_text`. They are written so a reader can tell whose
+# side the problem is on: `unreachable` is theirs to chase, `unreadable` and `identity-mismatch`
+# mean Cisco changed something and the tool needs a look.
+CAUSE_TEXT = {
+    csaf.UNREACHABLE: "Cisco could not be reached to ask.",
+    csaf.NO_CONTENT: "Cisco published no such statement for this advisory.",
+    csaf.UNREADABLE: "Cisco's advisory document could not be read.",
+    csaf.IDENTITY_MISMATCH: "Cisco returned a document for a different advisory.",
+    csaf.NOT_REACHED: "This run stopped before this advisory was asked about.",
+}
+
 
 # --------------------------------------------------------------------------- #
 # Output path
@@ -127,10 +144,82 @@ def _undetermined_block(row):
             + _device_list(row.undetermined, "d-undet") + "</div>")
 
 
+# --------------------------------------------------------------------------- #
+# Affected Products — Cisco's own scope statements (spec 009)
+# --------------------------------------------------------------------------- #
+def _blocks_html(blocks):
+    """Render a statement's blocks, preserving the structure Cisco encoded in whitespace.
+
+    One element per block, so a product list written one item per line stays one item per line.
+    Joining them into a paragraph would turn four named products into a sentence (FR-017).
+
+    Every character goes through `esc()`. That is correctness here, not only safety: 7 of 25
+    statements in the reference bundle contain raw `<`, `>` or `&` in CLI placeholders such as
+    `<interface_name>` and interface paths such as `Devices > VPN > Remote Access`. Rendered
+    unescaped, a browser treats the placeholder as an unknown tag and swallows it *and the text up to
+    the next `>`* — the report would quietly omit part of Cisco's scope with nothing to show it had.
+    """
+    out = []
+    for block in blocks:
+        if block.kind == csaf.Block.BREAK:
+            out.append('<div class="aff-gap"></div>')
+        elif block.kind == csaf.Block.HEADING:
+            out.append(f'<div class="aff-sub">{esc(block.text)}</div>')
+        else:
+            out.append(f'<div class="aff-line">{esc(block.text)}</div>')
+    return "".join(out)
+
+
+def _unavailable_html(statement):
+    """An unavailable statement, said in words as well as colour.
+
+    Reuses the yellow the report already uses for undetermined devices, because it already teaches
+    the reader that yellow-plus-words means *unknown, not safe* — and this is the same claim. Never
+    blank, never "none": either would read as "Cisco affects no products" (FR-026, FR-044).
+    """
+    cause = CAUSE_TEXT.get(statement.unavailable, CAUSE_TEXT[csaf.UNREADABLE])
+    return ('<div class="aff-unavail"><span class="undet-mark">▲</span> '
+            "Cisco's statement could not be shown — "
+            f'<em>{esc(cause)}</em> Whether this advisory affects other products is '
+            '<strong>unknown</strong>; it is not a statement that none are affected.</div>')
+
+
+def _statement_html(statement):
+    """One scope statement: its heading, an extract, and the remainder behind a disclosure.
+
+    The disclosure appears if and only if text lies beyond the extract, so its presence always means
+    text is hidden (FR-031). `<details>` is what keeps the remainder *in the document* — findable by
+    the reader's search and present in print — where a scroll box or a character cap would not
+    (FR-032).
+    """
+    head = f'<div class="aff-head">{esc(statement.title)}</div>'
+    if not statement.available:
+        return f'<div class="aff">{head}{_unavailable_html(statement)}</div>'
+    extract, remainder = csaf.split_extract(statement.blocks)
+    body = f'<div class="aff-extract">{_blocks_html(extract)}</div>'
+    if remainder:
+        body += ('<details class="aff-more"><summary>show full statement</summary>'
+                 f'{_blocks_html(remainder)}</details>')
+    return f'<div class="aff">{head}{body}</div>'
+
+
+def _scope_cell(row, scopes):
+    """The Affected Products cell for one advisory row.
+
+    A missing `scopes` mapping, or an advisory absent from it, renders as explicitly unavailable
+    rather than blank — so a caller that never retrieved cannot produce a report that reads as an
+    all-clear (FR-026).
+    """
+    scope = (scopes or {}).get(row.advisory_id)
+    if scope is None:
+        scope = csaf.unavailable_scope(row.advisory_id, csaf.NOT_REACHED)
+    return _statement_html(scope.vulnerable) + _statement_html(scope.not_vulnerable)
+
+
 # --------------------------------------------------------------------------- #
 # Rows
 # --------------------------------------------------------------------------- #
-def _row_html(row, index):
+def _row_html(row, index, scopes=None):
     advisory_id = esc(row.advisory_id)
     url = esc(row.url)
     # New tab so a reader working through a list keeps their place; `rel` denies the opened
@@ -140,7 +229,16 @@ def _row_html(row, index):
     severity = row.severity or "Unrated"
     cvss = f' <span class="cvss">CVSS {esc(row.cvss)}</span>' if row.cvss else ""
     cves = (f'<div class="cves">{esc(", ".join(row.cves))}</div>' if row.cves else "")
-    published = esc(row.published) or '<span class="none">not published</span>'
+    # The publication date sits beside the score rather than in a column of its own: it is part of
+    # the advisory's identity, and the 12% a column spent on one timestamp is better spent on scope
+    # (spec 009 FR-001, FR-002). Cisco's value is shown as published — trimming it would state a
+    # different instant (FR-003).
+    # The value is held in its own nowrap span so it can move to the next line but never break
+    # *inside* the timestamp: `published 2026-03-` / `04T16:00:00` reads as two different facts.
+    published = (f' <span class="pubdate">published '
+                 f'<span class="pubval">{esc(row.published)}</span></span>'
+                 if row.published
+                 else ' <span class="pubdate none">publication date not stated</span>')
 
     families = ", ".join(f.upper() for f in row.families) or "none"
     scope = (f'<div class="scope">Evaluated against '
@@ -157,23 +255,39 @@ def _row_html(row, index):
         f'<tr data-severity="{esc(severity.lower())}" '
         f'data-impacted="{len(row.impacted)}" data-order="{index}">'
         f'<td class="c-adv"><span class="sev sev-{esc(severity.lower())}">{esc(severity)}'
-        f'</span>{cvss}<div class="advid">{link}</div>'
+        f'</span>{cvss}{published}<div class="advid">{link}</div>'
         f'<div class="advtitle">{esc(row.title)}</div>{cves}</td>'
-        f'<td class="c-date">{published}</td>'
+        f'<td class="c-aff">{_scope_cell(row, scopes)}</td>'
         f'<td class="c-prod">{scope}{counts}{_impacted_block(row)}'
         f'{_undetermined_block(row)}</td>'
         "</tr>"
     )
 
 
-def _table(rows):
+def _table(rows, scopes=None):
+    """Three columns. The second is Cisco's stated scope; the third is the reader's own fleet.
+
+    The third column's title says "Your impacted devices" rather than "Impacted products" because
+    the two headings would otherwise be near-synonyms for very different things, and the mistake that
+    invites — reading Cisco's generic scope as a finding about your own estate — is the one worth
+    designing out (spec 009 FR-005, FR-006).
+    """
     head = ('<thead><tr><th class="sortable" data-sort="severity">Advisory</th>'
-            '<th>Published</th>'
-            '<th class="sortable" data-sort="impacted">Impacted products</th></tr></thead>')
-    body = "\n".join(_row_html(row, i) for i, row in enumerate(rows))
+            '<th>Affected Products</th>'
+            '<th class="sortable" data-sort="impacted">Your impacted devices</th></tr></thead>')
+    body = "\n".join(_row_html(row, i, scopes) for i, row in enumerate(rows))
     return f'<table id="advisories">\n{head}\n<tbody>\n{body}\n</tbody>\n</table>'
 
 
+def _provenance_html():
+    """Says once, in the report, whose statement the middle column carries (spec 009 FR-007)."""
+    return ('<p class="affnote"><strong>Affected Products</strong> is Cisco\'s own published '
+            'statement about each advisory — what Cisco says the advisory applies to, and which '
+            'Cisco products it has confirmed are not vulnerable. It is reproduced in Cisco\'s '
+            'words and is <em>not</em> a finding about your inventory. Your inventory is the '
+            '<strong>Your impacted devices</strong> column.</p>')
+
+
 # --------------------------------------------------------------------------- #
 # Header, totals, appendices
 # --------------------------------------------------------------------------- #
@@ -190,6 +304,10 @@ def _header_html(bundle, totals, generated_at, inventory_file):
         ("Undetermined", str(totals.get("devices_undetermined", 0))),
         ("Questions asked", str(totals.get("questions_asked") or "—")),
         ("Advisories in bundle", str(len(bundle))),
+        # Stated even when zero (spec 009 FR-030). A stated zero is evidence that every scope
+        # statement was obtained; an omitted zero is just an absence, and a reader cannot tell an
+        # absence from an oversight.
+        ("Scope statements missing", str(totals.get("scope_missing", 0))),
     ]
     cells = "".join(f'<div class="fact"><dt>{esc(label)}</dt><dd>{esc(value)}</dd></div>'
                     for label, value in facts)
@@ -256,6 +374,37 @@ def _scope_appendix(bundle):
             f'<ol class="scopelist">{items}</ol></section>')
 
 
+def _revision_appendix(rows, scopes):
+    """Which revision of each Cisco document the scope statements came from (spec 009 FR-035).
+
+    Cisco revises advisories after publication, so two reports can legitimately disagree. Recording
+    the revision is what lets a reader tell which one they are holding.
+    """
+    if not scopes:
+        return ""
+    entries = []
+    for row in rows:
+        scope = scopes.get(row.advisory_id)
+        if scope is None:
+            revision, note = "—", "not retrieved"
+        elif scope.fully_available:
+            revision, note = (scope.revision or "not stated"), "both statements"
+        else:
+            missing = [s.title for s in scope.statements if not s.available]
+            revision = scope.revision or "—"
+            note = "unavailable: " + ", ".join(missing)
+        entries.append(f"<tr><td>{esc(row.advisory_id)}</td>"
+                       f"<td>{esc(revision)}</td><td>{esc(note)}</td></tr>")
+    return ('<section class="appendix"><h2>Scope statement provenance</h2>'
+            "<p>The two Affected Products statements come from Cisco's published advisory document "
+            "for each advisory, located by following the pointer Cisco's advisory API returns. "
+            "Cisco revises advisories after publication; the revision read at run time is recorded "
+            "here so two reports can be told apart.</p>"
+            '<div class="tscroll"><table class="plain"><thead><tr><th>Advisory</th>'
+            "<th>Document revision</th><th>Statements</th></tr></thead>"
+            f'<tbody>{"".join(entries)}</tbody></table></div></section>')
+
+
 def _device_index(rows, devices):
     """Per-device cross-reference: one device to every bundle advisory affecting it (FR-036).
 
@@ -355,7 +504,14 @@ def _controls(rows):
 .col-count { width: 9%; }
 .col-which { width: 40%; }
 .col-why   { width: 49%; }
-.c-adv { width: 30%; } .c-date { width: 12%; white-space: nowrap; }
+/* Explicit widths on all three columns so expanding one row's disclosure cannot reflow another's
+   (spec 009 FR-033) — the same reason the appendix tables were made fixed. Without them, opening a
+   long scope statement shifts the neighbouring rows sideways at exactly the moment a reader is
+   comparing them. The 12% the old Published column held goes to Affected Products. */
+#advisories { table-layout: fixed; }
+/* All three stated explicitly and summing to 100%. Leaving the last one implicit would work, but a
+   later edit to either of the others would move it silently. */
+.c-adv { width: 30%; } .c-aff { width: 34%; } .c-prod { width: 36%; }
 .advid { font-weight: 600; margin-top: .3rem; font-family: ui-monospace, SFMono-Regular,
          Menlo, monospace; font-size: .85rem; }
 .advtitle { color: #555; font-size: .85rem; margin-top: .15rem; }
@@ -367,6 +523,27 @@ def _controls(rows):
 .sev-critical { color: #7a1512; } .sev-high { color: #a3231d; }
 .sev-medium { color: #8a5a00; } .sev-low { color: #4a5a6a; }
 .cvss { font-size: .75rem; color: #6b7076; margin-left: .3rem; }
+/* The relocated publication date: subordinate to the score it sits beside, and allowed to wrap so a
+   narrow window does not force a horizontal scroll on every row. */
+.pubdate { font-size: .72rem; color: #6b7076; margin-left: .3rem; }
+.pubval { white-space: nowrap; }
+/* Affected Products — Cisco's own words. No meaning is carried by colour alone (FR-034): the
+   sub-heading is distinguished by weight, and unavailability is stated in words. */
+.aff { margin-bottom: .55rem; }
+.aff:last-child { margin-bottom: 0; }
+.aff-head { font-size: .72rem; text-transform: uppercase; letter-spacing: .04em;
+            color: #1f4e78; font-weight: 700; border-bottom: 1px solid #e6e6e8;
+            padding-bottom: .1rem; margin-bottom: .25rem; }
+.aff-line { font-size: .82rem; line-height: 1.45; overflow-wrap: break-word; }
+.aff-sub { font-size: .82rem; font-weight: 700; color: #333; margin-top: .3rem;
+           overflow-wrap: break-word; }
+.aff-gap { height: .45rem; }
+.aff-more > summary { cursor: pointer; font-size: .78rem; color: #1f4e78; margin-top: .3rem; }
+.aff-more[open] > summary { margin-bottom: .2rem; }
+.aff-unavail { padding: .4rem .55rem; border-radius: 4px; background: #fff6e0;
+               border: 1px solid #e8cf94; color: #6b4c00; font-size: .8rem; }
+.affnote { margin: 0 0 .75rem; padding: .55rem .7rem; border-radius: 4px; background: #eef4fa;
+           border: 1px solid #cadcee; color: #234; font-size: .85rem; max-width: 100ch; }
 .scope { font-size: .8rem; color: #6b7076; }
 .counts { display: flex; gap: .6rem; flex-wrap: wrap; margin: .25rem 0 .45rem;
           font-size: .78rem; }
@@ -506,6 +683,10 @@ def _document(title, body):
     "Undetermined is not a statement of safety, and it is not \"probably fine\". It means "
     "Cisco could not be asked about that device at all, so whether a given advisory "
     "affects it is unknown.",
+    "The Affected Products column reproduces Cisco's own published statements about each "
+    "advisory, in Cisco's words. It describes what Cisco says the advisory applies to — not "
+    "what was found in this inventory. Where a statement could not be retrieved the column says "
+    "so; that is not a statement that no products are affected.",
 )
 
 
@@ -519,15 +700,26 @@ def _coverage_html():
 # --------------------------------------------------------------------------- #
 # Render / write
 # --------------------------------------------------------------------------- #
-def render(bundle, rows, devices, totals, generated_at=None, inventory_file=None):
-    """Render the bundle-scoped report as a string."""
+def render(bundle, rows, devices, totals, generated_at=None, inventory_file=None,
+           scopes=None):
+    """Render the bundle-scoped report as a string.
+
+    `scopes` is `{advisory_id: csaf.AdvisoryScope}`. Omitting it does not omit the column: every
+    cell renders as explicitly unavailable instead, so a caller that never retrieved cannot produce
+    a report a reader would take as "Cisco affects no products" (spec 009 FR-026).
+    """
     title = f"Cisco Advisory Impact Report — bundle {bundle.bundle_id}"
+    totals = dict(totals or {})
+    totals.setdefault("scope_missing",
+                      csaf.missing_count(scopes, [r.advisory_id for r in rows]))
     body = "\n".join([
         _header_html(bundle, totals, generated_at, inventory_file),
+        _provenance_html(),
         _controls(rows),
-        _table(rows),
+        _table(rows, scopes),
         _undetermined_appendix(devices),
         _device_index(rows, devices),
+        _revision_appendix(rows, scopes),
         _scope_appendix(bundle),
         _coverage_html(),
     ])
@@ -535,24 +727,26 @@ def render(bundle, rows, devices, totals, generated_at=None, inventory_file=None
 
 
 def write_report(bundle, rows, devices, totals, output_dir="output",
-                 generated_at=None, inventory_file=None, now=None):
+                 generated_at=None, inventory_file=None, now=None, scopes=None):
     """Write the bundle-scoped report and return the path written."""
     directory = Path(output_dir)
     directory.mkdir(parents=True, exist_ok=True)
     path = report_path(directory, bundle.bundle_id, now=now)
     path.write_text(
         render(bundle, rows, devices, totals,
-               generated_at=generated_at, inventory_file=inventory_file),
+               generated_at=generated_at, inventory_file=inventory_file, scopes=scopes),
         encoding="utf-8")
     return path
 
 
 def build_and_write(bundle, devices, records=None, output_dir="output",
                     questions_asked=None, partial_cause=None,
-                    generated_at=None, inventory_file=None, now=None):
+                    generated_at=None, inventory_file=None, now=None, scopes=None):
     """Convenience wrapper: build rows and totals, then write. Used by the terminal flow."""
     rows = b.build_rows(bundle.advisory_ids, devices, records=records)
     totals = b.run_totals(bundle.advisory_ids, devices,
                           questions_asked=questions_asked, partial_cause=partial_cause)
+    totals["scope_missing"] = csaf.missing_count(scopes, bundle.advisory_ids)
     return write_report(bundle, rows, devices, totals, output_dir=output_dir,
-                        generated_at=generated_at, inventory_file=inventory_file, now=now)
+                        generated_at=generated_at, inventory_file=inventory_file, now=now,
+                        scopes=scopes)
diff --git a/caia/csaf.py b/caia/csaf.py
new file mode 100644
index 0000000..e282483
--- /dev/null
+++ b/caia/csaf.py
@@ -0,0 +1,582 @@
+"""Cisco's published per-advisory advisory documents (CSAF) — the two scope statements only.
+
+The third external interface this tool depends on, after the PSIRT advisory API (`psirt`) and the
+bundle page (`erp`). Standard library only.
+
+**This document is a bounded source, not an authority.** It may supply exactly two values — an
+advisory's `Vulnerable Products` statement and its `Products Confirmed Not Vulnerable` statement —
+plus its own identity (to prove the right document was read) and its revision (so a reader can tell
+which version they are looking at). It may supply nothing else: not a title, severity, score, CVE,
+publication date, fixing release, affected platform, or product tree, every one of which it also
+carries and the advisory API already owns. A disagreement with the API is resolved in the API's
+favour without exception (constitution 3.3.1, Technology & Data Constraints -> Advisory scope
+statements; see contracts/csaf-access.md).
+
+That boundary is why `statements()` reads two note titles and stops. There is deliberately no code
+here to read the others, for the same reason `erp` has no code to read the bundle page's other
+columns: the cheapest way to keep a rule is to leave no route to breaking it.
+
+**Nothing here decides anything.** A scope statement is context for a human reader. It never becomes
+a verdict, never enters a count, and never narrows a row's population. Constitution IV's
+error-versus-undecided rule is satisfied without raising: `UNREACHABLE` ("we could not ask") and
+`NO_CONTENT` ("we asked and Cisco published nothing") are separate causes, which is a finer
+distinction than an exception could carry, and a retrieval failure leaves every verdict untouched.
+
+Four behaviours are load-bearing and were established against the live source on 2026-07-28 rather
+than from documentation:
+
+* **A missing document is served as HTTP 200 with a zero-length body**, and the content type declares
+  a generic download rather than JSON. Neither signal detects absence, so classification comes from
+  the body alone.
+* **Only the `document` object is read.** It is the first top-level key in all 25 documents examined
+  and holds both the notes and the tracking identity, while `product_tree` behind it accounts for the
+  rest of a payload that reaches 1.8 MB. Reading just `document` transferred 3.4% of the bytes.
+* **The buffer is decoded strictly.** Decoding a partially-read buffer with `errors="ignore"` would
+  silently drop a multi-byte character split across a chunk boundary — corrupting the very text this
+  module exists to reproduce faithfully. A `UnicodeDecodeError` means "read more", not "give up".
+* **Structure is carried by whitespace.** Paragraphs are blank-line separated, lists are one item per
+  line with no blank between them, and sub-headings are marked *only* by two or more leading spaces.
+  Collapsing whitespace destroys all three, turning four named products into one sentence.
+
+Nothing about any device is sent. The request is unauthenticated, carries no credentials, and the
+only value that leaves the machine is the advisory identifier already inside the URL the advisory API
+supplied (Constitution V).
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import time
+import urllib.error
+import urllib.request
+
+HOST = "sec.cloudapps.cisco.com"
+
+# Titles as Cisco publishes them. Present in 29 of 29 documents examined, under exactly these
+# strings; selection is by title and never by position, because the surrounding notes vary.
+VULNERABLE_TITLE = "Vulnerable Products"
+NOT_VULNERABLE_TITLE = "Products Confirmed Not Vulnerable"
+
+# Short by design: retrieval accompanies work already paid for, so a stalled document must fail fast
+# and cheaply rather than hold up the rest of the bundle (FR-039).
+DEFAULT_TIMEOUT = 15
+
+# FR-046. Cisco publishes no request allowance for this host, so none is assumed — but the advisory
+# API's ~2.1 s interval exists to satisfy a published per-minute quota this host does not have, and
+# applying it would push 25 retrievals past 50 s and breach FR-039's budget. 200 ms sits inside the
+# specified 150–250 ms band: 24 gaps cost ~5 s on top of ~9 s of requests, about 19% of a 72 s run.
+COURTESY_DELAY = 0.2
+
+# Read granularity, and the point at which we stop trying to be clever. `document` completed within
+# 11,464–29,591 bytes across the reference bundle, so 512 KB is a wide margin; beyond it we read the
+# whole body rather than risk looping.
+CHUNK_BYTES = 16 * 1024
+BUFFER_CAP = 512 * 1024
+
+# --------------------------------------------------------------------------- #
+# Unavailability causes — a closed set (FR-045)
+# --------------------------------------------------------------------------- #
+# Every unavailable statement resolves to exactly one of these. The set is closed so that a new
+# failure mode cannot render as a blank cell: anything unclassifiable becomes UNREADABLE, never
+# nothing. A blank cell reads as "Cisco affects no products", which is the claim Principle IV
+# forbids the report from making by accident.
+UNREACHABLE = "unreachable"
+NO_CONTENT = "no-content"
+UNREADABLE = "unreadable"
+IDENTITY_MISMATCH = "identity-mismatch"
+NOT_REACHED = "not-reached"
+
+CAUSES = (UNREACHABLE, NO_CONTENT, UNREADABLE, IDENTITY_MISMATCH, NOT_REACHED)
+
+
+class CsafError(Exception):
+    """Base class. A retrieval failure never becomes an absence of affected products."""
+
+
+class CsafUnreachableError(CsafError):
+    """Cisco could not be reached (DNS, TCP, TLS, proxy, timeout, HTTP error). Retryable once."""
+
+
+class CsafUnreadableError(CsafError):
+    """A response arrived but no `document` object could be read from it. Not retryable."""
+
+
+class CsafEmptyError(CsafError):
+    """The response body was empty — how Cisco serves a document that does not exist."""
+
+
+# --------------------------------------------------------------------------- #
+# Text model
+# --------------------------------------------------------------------------- #
+class Block:
+    """One line of a statement, classified. The unit that makes structure testable without HTML.
+
+    `kind` is `heading`, `text`, or `break`. Line breaks between consecutive `text` blocks are
+    significant: they are what distinguishes a one-item-per-line product list from a wrapped
+    paragraph (FR-017).
+    """
+
+    __slots__ = ("kind", "text")
+
+    HEADING = "heading"
+    TEXT = "text"
+    BREAK = "break"
+
+    def __init__(self, kind, text=""):
+        self.kind = kind
+        self.text = text
+
+    def __eq__(self, other):
+        return (isinstance(other, Block)
+                and self.kind == other.kind and self.text == other.text)
+
+    def __hash__(self):
+        return hash((self.kind, self.text))
+
+    def __repr__(self):  # pragma: no cover - debugging aid
+        return f"Block({self.kind!r}, {self.text[:40]!r})"
+
+
+class ScopeStatement:
+    """One of the two statements, as the report will present it.
+
+    Exactly one of `blocks` (non-empty) and `unavailable` (a cause) is set — never both, never
+    neither. That invariant is what makes "never silently blank" (FR-026) structural rather than a
+    rendering convention a future edit could forget.
+    """
+
+    __slots__ = ("title", "blocks", "unavailable")
+
+    def __init__(self, title, blocks=(), unavailable=""):
+        if bool(blocks) == bool(unavailable):
+            raise ValueError(
+                "a ScopeStatement carries either blocks or an unavailable cause, never both or "
+                f"neither (title={title!r}, blocks={len(blocks)}, unavailable={unavailable!r})")
+        if unavailable and unavailable not in CAUSES:
+            raise ValueError(f"{unavailable!r} is not one of the closed cause set {CAUSES}")
+        self.title = title
+        self.blocks = tuple(blocks)
+        self.unavailable = unavailable
+
+    @property
+    def available(self):
+        return not self.unavailable
+
+    def text(self):
+        """The statement as plain text, for tests and for anything that is not HTML."""
+        return "\n".join("" if b.kind == Block.BREAK else b.text for b in self.blocks)
+
+    def __repr__(self):  # pragma: no cover - debugging aid
+        state = self.unavailable or f"{len(self.blocks)} blocks"
+        return f"ScopeStatement({self.title!r}, {state})"
+
+
+class AdvisoryScope:
+    """Both statements for one advisory, plus what proves where they came from."""
+
+    __slots__ = ("advisory_id", "vulnerable", "not_vulnerable", "revision")
+
+    def __init__(self, advisory_id, vulnerable, not_vulnerable, revision=""):
+        self.advisory_id = advisory_id
+        self.vulnerable = vulnerable
+        self.not_vulnerable = not_vulnerable
+        self.revision = revision
+
+    @property
+    def statements(self):
+        return (self.vulnerable, self.not_vulnerable)
+
+    @property
+    def fully_available(self):
+        return all(s.available for s in self.statements)
+
+    def __repr__(self):  # pragma: no cover - debugging aid
+        return (f"AdvisoryScope({self.advisory_id!r}, "
+                f"vulnerable={self.vulnerable!r}, not_vulnerable={self.not_vulnerable!r})")
+
+
+def unavailable_scope(advisory_id, cause):
+    """Both statements unavailable for the same reason. Never a blank pair."""
+    return AdvisoryScope(
+        advisory_id,
+        ScopeStatement(VULNERABLE_TITLE, unavailable=cause),
+        ScopeStatement(NOT_VULNERABLE_TITLE, unavailable=cause))
+
+
+# --------------------------------------------------------------------------- #
+# The two permitted normalisations (FR-013, FR-014, FR-015)
+# --------------------------------------------------------------------------- #
+# This set is CLOSED. Anything that alters Cisco's text and is not one of these two is a defect, not
+# a refinement — the constitution requires a test per normalisation plus a test asserting no other
+# alteration occurs, precisely because "we tidied it slightly" is how a security advisory gets
+# silently edited.
+
+# Normalisation 1 (FR-014): Cisco embeds link targets inline as `Text ["target"]`, where the target
+# is either an intra-advisory anchor (`#fs`) or an external URL. Present in 25 of 25.
+_LINK_MARKUP = re.compile(r'\s*\["[^"]*"\]')
+
+# Normalisation 2 (FR-015): a sentence whose entire content directs the reader to another section of
+# *this* advisory. Requiring the `["#…"]` anchor is what keeps this narrow: it drops the 31 purely
+# navigational sentences in the reference bundle and keeps all 25 substantive ones that merely name a
+# section, such as "Only products listed in the Vulnerable Products section … are known to be
+# affected". Those 25 look almost identical to a careless pattern, and dropping them would delete a
+# claim about which products are affected.
+_NAVIGATIONAL = re.compile(
+    r'^(?:For information about[^.]*|For more information[^.]*),?\s*'
+    r'see the [^.]*\["#[^"]*"\][^.]*section of this advisory\.$')
+
+_SENTENCE_SPLIT = re.compile(r'(?<=\.)\s+')
+
+# A sub-heading is marked only by leading indentation — there is no other signal in the format.
+_INDENTED = re.compile(r'^ {2,}\S')
+
+
+def strip_link_markup(text):
+    """Normalisation 1: remove `["target"]`, keep the link text (FR-014)."""
+    return _LINK_MARKUP.sub("", text)
+
+
+def drop_navigational(text):
+    """Normalisation 2: remove sentences that only point at another section (FR-015).
+
+    Sentence-scoped rather than paragraph-scoped: 13 of 25 advisories weave these directions between
+    real content, so dropping whole paragraphs would take substance with them.
+    """
+    kept = [s for s in _SENTENCE_SPLIT.split(text.strip())
+            if not _NAVIGATIONAL.match(s.strip())]
+    return " ".join(kept)
+
+
+def _normalise_line(line):
+    """Both normalisations, in order. Navigational sentences are matched *before* link markup is
+    removed, because the anchor is what identifies them."""
+    return strip_link_markup(drop_navigational(line)).strip()
+
+
+def parse_blocks(text, normalise=True):
+    """Split a statement into classified `Block`s, preserving Cisco's structure (FR-017).
+
+    Line-oriented on purpose. Every line survives as its own block, so a product list written one
+    item per line stays one item per line; blank lines become `break` blocks with runs collapsed.
+    """
+    blocks = []
+    for line in str(text or "").split("\r\n"):
+        heading = bool(_INDENTED.match(line))
+        body = _normalise_line(line) if normalise else line.strip()
+        if not body:
+            if blocks and blocks[-1].kind != Block.BREAK:
+                blocks.append(Block(Block.BREAK))
+            continue
+        blocks.append(Block(Block.HEADING if heading else Block.TEXT, body))
+    while blocks and blocks[-1].kind == Block.BREAK:
+        blocks.pop()
+    return tuple(blocks)
+
+
+def statement(title, text):
+    """Build a `ScopeStatement` from Cisco's raw note text.
+
+    Guards FR-016: if the normalisations would empty something Cisco published as non-empty, the
+    un-normalised text is shown instead. Across the reference bundle this never triggers, which is
+    exactly why it is here — an untested fallback in a rarely-reached path is how a statement
+    silently becomes an empty cell.
+    """
+    raw = str(text or "")
+    if not raw.strip():
+        return ScopeStatement(title, unavailable=NO_CONTENT)
+    blocks = parse_blocks(raw)
+    if not blocks:
+        blocks = parse_blocks(raw, normalise=False)
+    if not blocks:  # pragma: no cover - unreachable: raw is non-blank, so a line survives
+        return ScopeStatement(title, unavailable=NO_CONTENT)
+    return ScopeStatement(title, blocks=blocks)
+
+
+# --------------------------------------------------------------------------- #
+# Extract selection (FR-031, FR-048)
+# --------------------------------------------------------------------------- #
+# A statement rendering to this many characters or fewer is shown whole; only a longer one is
+# collapsed. The disclosure exists to stop a 4,783-character statement dominating its row, not to
+# hide a 420-character one.
+#
+# 900 is drawn from the measured distribution across the reference bundle: `Vulnerable Products`
+# ranges 217–4,783 characters (median 1,016) and `Products Confirmed Not Vulnerable` 218–818. So
+# every not-vulnerable statement renders whole — which is what keeps Cisco's list of ruled-out
+# products visible — while the long multi-section scope statements collapse.
+COLLAPSE_ABOVE_CHARS = 900
+
+
+def _rendered_length(blocks):
+    """Characters a reader would see, counting a paragraph break as a newline."""
+    return sum(1 if b.kind == Block.BREAK else len(b.text) + 1 for b in blocks)
+
+
+def split_extract(blocks):
+    """Split blocks into (extract, remainder) for the report's collapsed presentation.
+
+    A statement short enough to sit in a cell is returned whole, with an empty remainder, so the
+    report shows no disclosure control for it (see `COLLAPSE_ABOVE_CHARS`). Collapsing a short
+    statement hides substance for no benefit: `Products Confirmed Not Vulnerable` opens with the
+    boilerplate "Only products listed in the Vulnerable Products section…" in 25 of 25 advisories,
+    and the products Cisco actually rules out follow it — so an unconditional extract would show the
+    least useful sentence and hide the list.
+
+    The extract is the statement's **scope claim** — everything before the first sub-heading — plus
+    the *title* of every sub-heading, as an outline of the sections that follow. Where there is no
+    sub-heading it is everything up to the first blank line.
+
+    A sub-heading's body is never in the extract, and this is the whole point. Sub-headings name
+    products in some advisories (`Cisco IOS XE Software`) and diagnostic procedures in others
+    (`Determine the Snort Configuration on …`). An earlier rule showed each heading with its opening
+    paragraph, which on `cisco-sa-ftd-tcp-dos-rHfqnwRg` discarded the scope claim above the first
+    heading and displayed five troubleshooting steps in its place — the exact misrepresentation this
+    presentation exists to prevent (research Decision 5).
+    """
+    blocks = tuple(blocks)
+    if _rendered_length(blocks) <= COLLAPSE_ABOVE_CHARS:
+        return blocks, ()
+    first_heading = next((i for i, b in enumerate(blocks) if b.kind == Block.HEADING),
+                         None)
+    if first_heading is None:
+        cut = next((i for i, b in enumerate(blocks) if b.kind == Block.BREAK), len(blocks))
+        return blocks[:cut], blocks[cut:]
+
+    keep = list(range(first_heading))
+    keep += [i for i, b in enumerate(blocks) if b.kind == Block.HEADING]
+    chosen = sorted(set(keep))
+    extract = _drop_edge_breaks([blocks[i] for i in chosen])
+    remainder = _drop_edge_breaks([b for i, b in enumerate(blocks) if i not in set(chosen)])
+    return tuple(extract), tuple(remainder)
+
+
+def _drop_edge_breaks(blocks):
+    """Trim break blocks from both ends, and collapse runs left by the split."""
+    out = []
+    for block in blocks:
+        if block.kind == Block.BREAK and (not out or out[-1].kind == Block.BREAK):
+            continue
+        out.append(block)
+    while out and out[-1].kind == Block.BREAK:
+        out.pop()
+    return out
+
+
+# --------------------------------------------------------------------------- #
+# Reading the document
+# --------------------------------------------------------------------------- #
+_DECODER = json.JSONDecoder()
+
+
+def _document_value_start(text):
+    """Index of the value after `"document":`, or -1 if not yet in the buffer."""
+    key = text.find('"document"')
+    if key < 0:
+        return -1
+    colon = text.find(':', key)
+    if colon < 0:
+        return -1
+    index = colon + 1
+    while index < len(text) and text[index] in ' \t\r\n':
+        index += 1
+    return index if index < len(text) else -1
+
+
+def _document_from(text):
+    """Parse the `document` object out of a (possibly partial) buffer, or return None.
+
+    `raw_decode` raises while the value is incomplete, which is what lets the caller simply read
+    more. No brace counting and no JSON repair.
+    """
+    start = _document_value_start(text)
+    if start < 0:
+        return None
+    try:
+        value, _ = _DECODER.raw_decode(text, start)
+    except ValueError:
+        return None
+    return value if isinstance(value, dict) else None
+
+
+def fetch_document(url, timeout=DEFAULT_TIMEOUT, opener=None,
+                   chunk_bytes=CHUNK_BYTES, buffer_cap=BUFFER_CAP):
+    """Read only as much of the response as the `document` object needs (FR-040).
+
+    Raises `CsafEmptyError` for the zero-length body Cisco serves when a document does not exist,
+    `CsafUnreachableError` when it could not be fetched, and `CsafUnreadableError` when a body
+    arrived but held no `document`.
+    """
+    request = urllib.request.Request(url, headers={"Accept": "application/json"})
+    open_url = opener or urllib.request.urlopen
+    try:
+        response = open_url(request, timeout=timeout)
+    except urllib.error.HTTPError as exc:
+        raise CsafUnreachableError(
+            f"Cisco returned HTTP {getattr(exc, 'code', '?')} for the advisory document."
+        ) from None
+    except Exception as exc:  # noqa: BLE001 - URLError, timeout, ssl, proxy errors
+        raise CsafUnreachableError(
+            f"Cisco's Security Center could not be reached ({type(exc).__name__})."
+        ) from None
+
+    buffer = b""
+    try:
+        with response:
+            while True:
+                try:
+                    part = response.read(chunk_bytes)
+                except Exception as exc:  # noqa: BLE001 - a mid-stream drop is still unreachable
+                    raise CsafUnreachableError(
+                        f"The advisory document was cut short ({type(exc).__name__})."
+                    ) from None
+                if not part:
+                    break
+                buffer += part
+                if len(buffer) > buffer_cap:
+                    break
+                try:
+                    text = buffer.decode("utf-8")
+                except UnicodeDecodeError:
+                    # A chunk boundary split a character. Reading more completes it; decoding with
+                    # errors="ignore" here would drop it and corrupt the text silently.
+                    continue
+                document = _document_from(text)
+                if document is not None:
+                    return document
+            # Past the cap, or the stream ended without `document` completing: fall back to the
+            # whole body, which is also the path for a payload that is not shaped as expected.
+            buffer += response.read()
+    except CsafError:
+        raise
+
+    if not buffer.strip():
+        raise CsafEmptyError(
+            "Cisco returned an empty body for the advisory document. This is how a document that "
+            "does not exist is served — it arrives as a success, not as a 404.")
+    document = _document_from(buffer.decode("utf-8", "replace"))
+    if document is None:
+        try:
+            payload = json.loads(buffer.decode("utf-8", "replace"))
+        except ValueError:
+            payload = None
+        document = (payload or {}).get("document") if isinstance(payload, dict) else None
+    if not isinstance(document, dict):
+        raise CsafUnreadableError(
+            "The advisory document could not be read: no document section was found in Cisco's "
+            "response.")
+    return document
+
+
+# --------------------------------------------------------------------------- #
+# Turning a document into statements
+# --------------------------------------------------------------------------- #
+def statements(document, advisory_id):
+    """The two statements from one `document`, or raise on an identity mismatch.
+
+    Reads two note titles and the tracking block. Nothing else is touched, deliberately: the
+    document also carries a title, dates, a product tree and per-CVE remediations, all of which the
+    advisory API owns (FR-021).
+    """
+    tracking = (document or {}).get("tracking") or {}
+    stated = str(tracking.get("id") or "")
+    if stated and stated != advisory_id:
+        raise CsafUnreadableError(
+            f"The document fetched for {advisory_id} identifies itself as {stated}.")
+
+    by_title = {}
+    for note in (document or {}).get("notes") or []:
+        title = str((note or {}).get("title") or "")
+        if title in (VULNERABLE_TITLE, NOT_VULNERABLE_TITLE) and title not in by_title:
+            by_title[title] = note.get("text")
+
+    def one(title):
+        if title not in by_title:
+            return ScopeStatement(title, unavailable=NO_CONTENT)
+        return statement(title, by_title[title])
+
+    return (one(VULNERABLE_TITLE), one(NOT_VULNERABLE_TITLE),
+            str(tracking.get("version") or ""))
+
+
+# --------------------------------------------------------------------------- #
+# Retrieval
+# --------------------------------------------------------------------------- #
+def retrieve(advisory_id, url, timeout=DEFAULT_TIMEOUT, opener=None, sleep=None,
+             chunk_bytes=CHUNK_BYTES, buffer_cap=BUFFER_CAP):
+    """Both statements for one advisory. Never raises — an `AdvisoryScope` always comes back.
+
+    Retries **once** on a transport failure, and never on an empty body, unreadable content, or an
+    identity mismatch: each of those is deterministic, so a second attempt would fail identically and
+    only spend time. Attempts therefore never exceed two (FR-043).
+    """
+    if not url:
+        return unavailable_scope(advisory_id, NO_CONTENT)
+
+    pause = sleep or time.sleep
+    last = None
+    for attempt in (1, 2):
+        try:
+            document = fetch_document(url, timeout=timeout, opener=opener,
+                                      chunk_bytes=chunk_bytes, buffer_cap=buffer_cap)
+        except CsafEmptyError:
+            return unavailable_scope(advisory_id, NO_CONTENT)
+        except CsafUnreadableError:
+            return unavailable_scope(advisory_id, UNREADABLE)
+        except CsafUnreachableError as exc:
+            last = exc
+            if attempt == 1:
+                pause(COURTESY_DELAY)
+                continue
+            return unavailable_scope(advisory_id, UNREACHABLE)
+
+        try:
+            vulnerable, not_vulnerable, revision = statements(document, advisory_id)
+        except CsafUnreadableError:
+            # The identity check is the only mismatch `statements` reports, and showing another
+            # advisory's scope is worse than showing none (FR-020).
+            return unavailable_scope(advisory_id, IDENTITY_MISMATCH)
+        return AdvisoryScope(advisory_id, vulnerable, not_vulnerable, revision)
+
+    return unavailable_scope(advisory_id, UNREACHABLE)  # pragma: no cover - loop always returns
+
+
+def retrieve_many(targets, on_progress=None, timeout=DEFAULT_TIMEOUT, opener=None,
+                  sleep=None, delay=None):
+    """`{advisory_id: AdvisoryScope}` for every target. One entry per target, always.
+
+    Sequential with a courtesy delay, never a concurrent burst: Cisco publishes no request allowance
+    for this host, so the product does not assume one (FR-046).
+
+    Prints nothing, prompts for nothing, writes nothing, exits nothing. Progress goes to
+    `on_progress(index, total, advisory_id)` if the caller wants it (FR-047, FR-038).
+    """
+    # Resolved at call time, not bound as a default: a default argument would capture the value at
+    # import and quietly ignore anything that adjusts the module constant afterwards.
+    if delay is None:
+        delay = COURTESY_DELAY
+    pause = sleep or time.sleep
+    items = list(targets.items()) if hasattr(targets, "items") else list(targets)
+    total = len(items)
+    scopes = {}
+    for index, (advisory_id, url) in enumerate(items, 1):
+        if on_progress is not None:
+            on_progress(index, total, advisory_id)
+        if index > 1 and delay:
+            pause(delay)
+        scopes[advisory_id] = retrieve(advisory_id, url, timeout=timeout, opener=opener,
+                                       sleep=sleep)
+    return scopes
+
+
+def missing_count(scopes, advisory_ids):
+    """How many advisories are missing at least one scope statement (FR-030).
+
+    Counts an advisory absent from `scopes` as missing, so a caller that never retrieved cannot
+    report a reassuring zero.
+    """
+    missing = 0
+    for advisory_id in advisory_ids:
+        scope = (scopes or {}).get(advisory_id)
+        if scope is None or not scope.fully_available:
+            missing += 1
+    return missing
diff --git a/docs/index.html b/docs/index.html
index 0e66821..e0dc023 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -405,12 +405,16 @@ <h2><span class="num">02</span>Install &amp; run</h2>
           bundled publications. Paste the Event Response link at the prompt, or skip the
           prompt:
           <pre>caia --erp ERP-75736</pre>
-          The report flips to <b>one row per advisory in that bundle</b>: the advisory, its
-          publication date, and which of your products it impacts with the release that fixes
-          them. Advisories that hit nothing still get a row. Firewalls that could not be
-          checked appear in every row they might belong to, marked <em>undetermined</em> — never
-          counted as unaffected. The report states how many advisories the bundle filter left
-          out, so it can't be mistaken for a whole-fleet assessment.
+          The report flips to <b>one row per advisory in that bundle</b>: the advisory with its
+          publication date, <b>what Cisco says the advisory affects</b> — Cisco's own
+          <em>Vulnerable Products</em> and <em>Products Confirmed Not Vulnerable</em> statements,
+          reproduced in Cisco's words — and which of your devices it impacts with the release
+          that fixes them. Advisories that hit nothing still get a row. Firewalls that could not
+          be checked appear in every row they might belong to, marked <em>undetermined</em> —
+          never counted as unaffected. Where Cisco's scope statement could not be retrieved the
+          report says so and why; that is never shown as "nothing affected". The report states
+          how many advisories the bundle filter left out, so it can't be mistaken for a
+          whole-fleet assessment.
         </li>
         <li>
           <b>Stay up to date</b> — check your version and update via uv:
diff --git a/specs/009-affected-products-column/contracts/affected-products-column.md b/specs/009-affected-products-column/contracts/affected-products-column.md
index 2b5f4e3..df76eea 100644
--- a/specs/009-affected-products-column/contracts/affected-products-column.md
+++ b/specs/009-affected-products-column/contracts/affected-products-column.md
@@ -78,7 +78,13 @@ four named products into one sentence.
 </div>
 ```
 
-- Extract = all text before the first sub-heading, plus every sub-heading **title** (FR-031).
+- A statement rendering to **900 characters or fewer is shown whole**, with no disclosure at all.
+  Drawn from the measured distribution: `Vulnerable Products` runs 217–4,783 characters (median
+  1,016), `Products Confirmed Not Vulnerable` 218–818 — so every not-vulnerable statement renders in
+  full, keeping Cisco's list of ruled-out products visible, while long multi-section scope statements
+  collapse (FR-031).
+- Above the threshold, extract = all text before the first sub-heading, plus every sub-heading
+  **title** (FR-031).
 - The disclosure appears **if and only if** text lies beyond the extract, so its presence always means
   text is hidden (FR-031).
 - Sub-heading *bodies* are never in the extract. Sub-headings name products in some advisories and
diff --git a/specs/009-affected-products-column/contracts/csaf-access.md b/specs/009-affected-products-column/contracts/csaf-access.md
index 7437847..73a9802 100644
--- a/specs/009-affected-products-column/contracts/csaf-access.md
+++ b/specs/009-affected-products-column/contracts/csaf-access.md
@@ -90,6 +90,14 @@ Verified across all 25 reference-bundle documents:
 | Reference bundle | 12,579,885 B | 423,632 B (**3.4%**) |
 | Largest advisory | 1,740,490 B | 22,931 B |
 
+**3.4% is the floor, not the measured transfer.** It is the size of the `document` objects themselves.
+A chunked reader necessarily over-reads by up to one chunk per document, so the delivered figure sits
+a little above it: a live 6-advisory run measured **131,072 B against 2,527,829 B — 5.2%** — at a 16
+KB chunk size, with all 6 advisories yielding both statements in 0.48 s each. The gap is chunk
+granularity and nothing else; it narrows as documents get larger, because the fixed overhead is
+amortised. Either way the saving is ~95%, and the constraint it removes — 12.9 MB per bundle review
+over a corporate proxy — is gone.
+
 Verified live: three advisories read in 16,384 / 32,768 / 32,768 B in 0.29–0.46 s, with matching
 identity and both statements present. Re-verified against the largest advisory with a hostile
 997-byte chunk size: 22,931 B, text intact.
diff --git a/specs/009-affected-products-column/research.md b/specs/009-affected-products-column/research.md
index 496aa6a..7fc555d 100644
--- a/specs/009-affected-products-column/research.md
+++ b/specs/009-affected-products-column/research.md
@@ -60,7 +60,14 @@ operational problem rather than an inefficiency. Measured:
 | --- | --- | --- |
 | Reference bundle (25 advisories) | 12,579,885 B | 423,632 B |
 | Largest single advisory | 1,740,490 B | 22,931 B |
-| Share transferred | 100% | **3.4%** |
+| Share transferred | 100% | **3.4%** (floor) |
+
+**Post-implementation correction.** 3.4% is the size of the `document` objects themselves — a floor a
+chunked reader cannot quite reach, because it over-reads by up to one chunk per document. A live
+6-advisory run of the finished reader measured **131,072 B against 2,527,829 B, or 5.2%**, at a 16 KB
+chunk size. The gap is chunk granularity alone and narrows as documents grow. The saving is ~95%
+either way, so the decision stands; the 3.4% figure should be read as the theoretical floor rather
+than the delivered number.
 
 Cisco serves these uncompressed, with no `Content-Encoding`, `ETag`, `Last-Modified` or
 `Cache-Control`, so neither compression nor conditional requests reduce the cost. Reading less is
diff --git a/specs/009-affected-products-column/spec.md b/specs/009-affected-products-column/spec.md
index 23deea3..51349b9 100644
--- a/specs/009-affected-products-column/spec.md
+++ b/specs/009-affected-products-column/spec.md
@@ -57,6 +57,7 @@ An analyst works down 25 rows. Most scope statements are short; several run to 2
 **Acceptance Scenarios**:
 
 1. **Given** a statement long enough to be collapsed, **When** the analyst reads the cell, **Then** the visible portion shows the statement's leading scope claim in full, followed by the title of every sub-heading it contains, and a control indicating that more text exists.
+1b. **Given** a statement short enough to sit in a cell — including every `Products Confirmed Not Vulnerable` statement in the reference bundle — **When** the analyst reads it, **Then** it is shown in full with no disclosure control, so the products Cisco rules out are never hidden behind a click.
 1a. **Given** a statement whose sub-headings name diagnostic procedures rather than products — and whose scope claim therefore sits above the first sub-heading — **When** the analyst reads the extract, **Then** the scope claim is visible and no procedure section's text is shown in its place.
 2. **Given** the advisory with the longest scope statement in the bundle, **When** the report is scrolled, **Then** its row does not prevent neighbouring rows from being read.
 3. **Given** a collapsed statement, **When** the analyst searches the report for a phrase that appears only in its collapsed portion, **Then** the phrase is found in the document.
@@ -179,7 +180,7 @@ A reviewer, months later, needs to establish where the scope text came from and
 
 **Layout and accessibility**
 
-- **FR-031**: Each statement MUST be rendered as a visible extract plus, where any text remains beyond that extract, a control that reveals the remainder and indicates that more text exists. The extract MUST comprise (a) all text preceding the statement's first sub-heading — the scope claim itself, including any conditions listed with it — and (b) the title of every sub-heading, as an outline of the sections the statement contains. Where a statement has no sub-heading, the extract is its opening paragraph. A statement wholly contained in its extract MUST NOT carry a disclosure control, so the presence of the control always means text is hidden.
+- **FR-031**: A statement whose rendered length does not exceed a **stated character threshold** MUST be shown in full, with no disclosure control. A longer statement MUST be rendered as a visible extract plus a control that reveals the remainder and indicates that more text exists. The extract MUST comprise (a) all text preceding the statement's first sub-heading — the scope claim itself, including any conditions listed with it — and (b) the title of every sub-heading, as an outline of the sections the statement contains. Where a long statement has no sub-heading, the extract is its opening paragraph. A statement wholly contained in its extract MUST NOT carry a disclosure control, so the presence of the control always means text is hidden. The threshold MUST be a stated number, not a judgement, and MUST be set so that no `Products Confirmed Not Vulnerable` statement in the reference bundle is collapsed — that statement opens with boilerplate in 25 of 25 advisories and the products Cisco rules out follow it, so collapsing it would show the least useful sentence and hide the list.
 - **FR-048**: The extract MUST NOT omit the statement's leading scope claim, and MUST NOT present the content of one sub-heading as though it were the whole statement. Sub-headings are not reliably product names — across the reference bundle they name products in some advisories and diagnostic procedures in others — so the extract MUST NOT assume that a sub-heading's opening paragraph describes the advisory's scope.
 - **FR-032**: No part of Cisco's text may be truncated out of the file. Collapsed text MUST remain present in the document, findable by the reader's search, and present when the report is printed or exported.
 - **FR-033**: Expanding one row's statement MUST NOT reflow or resize any other row's columns.
diff --git a/specs/009-affected-products-column/tasks.md b/specs/009-affected-products-column/tasks.md
index 6d7dc56..9c13996 100644
--- a/specs/009-affected-products-column/tasks.md
+++ b/specs/009-affected-products-column/tasks.md
@@ -35,8 +35,8 @@ Single Python package at repository root: `caia/` for source, `tests/` for tests
 
 **Purpose**: Recorded test data and the module skeleton everything else fills in.
 
-- [ ] T001 [P] Create `tests/fixtures/csaf_documents.py` holding recorded `document` objects: the worked example (`cisco-sa-onprem-fmc-authbypass-5JPp45V2`), a product-heading multi-section statement (`cisco-sa-ftd-snort3-vbavuls-96UcVVed`), the procedure-heading statement (`cisco-sa-ftd-tcp-dos-rHfqnwRg`), one containing raw `<`/`>`/`&` (`cisco-sa-asaftd-vpn-m9sx6MbC`), plus the four failure bodies — zero-length, unparseable, missing-notes, and identity-mismatch. Real recorded text only; do not hand-write plausible substitutes, because the faithfulness tests are worthless against invented input.
-- [ ] T002 Create `caia/csaf.py` with the module docstring stating the bounded-source rule and the data shapes from `data-model.md`: `Block`, `ScopeStatement`, `AdvisoryScope`, the five cause constants, and the `CsafError` hierarchy. No behaviour yet.
+- [X] T001 [P] Create `tests/fixtures/csaf_documents.py` holding recorded `document` objects: the worked example (`cisco-sa-onprem-fmc-authbypass-5JPp45V2`), a product-heading multi-section statement (`cisco-sa-ftd-snort3-vbavuls-96UcVVed`), the procedure-heading statement (`cisco-sa-ftd-tcp-dos-rHfqnwRg`), one containing raw `<`/`>`/`&` (`cisco-sa-asaftd-vpn-m9sx6MbC`), plus the four failure bodies — zero-length, unparseable, missing-notes, and identity-mismatch. Real recorded text only; do not hand-write plausible substitutes, because the faithfulness tests are worthless against invented input.
+- [X] T002 Create `caia/csaf.py` with the module docstring stating the bounded-source rule and the data shapes from `data-model.md`: `Block`, `ScopeStatement`, `AdvisoryScope`, the five cause constants, and the `CsafError` hierarchy. No behaviour yet.
 
 **Checkpoint**: fixtures load; `caia.csaf` imports.
 
@@ -53,19 +53,19 @@ report. Every user story depends on this phase.
 rules are the part a reviewer must trust, and they are provable from recorded text with no network at
 all (plan, implementation sequence step 1).
 
-- [ ] T003 Implement **Normalisation 1 — link markup** in `caia/csaf.py`: remove Cisco's bracketed link targets (`["#fs"]`, `["https://…"]`) while retaining the surrounding link text (FR-014). Add its own test in `tests/test_csaf.py`.
-- [ ] T004 Implement **Normalisation 2 — navigational sentences** in `caia/csaf.py`: remove a sentence whose entire content directs the reader to another section of the same advisory; retain a sentence that names a section while making a substantive claim (FR-015). Add its own test in `tests/test_csaf.py` asserting both directions — that `For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.` is removed **and** that `Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.` survives. Getting only the first half right is the failure mode.
-- [ ] T005 Implement the **`Block` parse** in `caia/csaf.py`: one block per source line, classified `heading` (2+ leading spaces before the first non-space), `break` (blank, or blank after normalisation, with runs collapsed and leading/trailing dropped), or `text`. Line breaks between consecutive `text` blocks are significant (FR-017). Add tests in `tests/test_csaf.py` covering a paragraph, a one-item-per-line product list, and an indented sub-heading.
-- [ ] T006 Add the **faithfulness tests** in `tests/test_csaf.py`: the worked example renders character-for-character against the expected text (SC-003); a test asserting **no alteration beyond T003 and T004 occurs** (FR-013, constitution Tests gate); and a test that a statement Cisco published non-empty is never emptied, falling back to the original if normalisation would empty it (FR-016).
-- [ ] T007 Implement `extract_blocks()` in `caia/csaf.py` — pure extract selection: every block before the first `heading`, plus the `heading` blocks themselves; where there is no heading, every block up to the first `break` (FR-031). Never a sub-heading's body (FR-048). Add tests in `tests/test_csaf.py`; **the procedure-heading fixture is the required case** — its scope claim sits above the first heading and an earlier rule dropped it (research Decision 5).
-- [ ] T008 Implement the **streamed document-only read** in `caia/csaf.py`: accumulate chunks, locate the value after `"document"`, attempt `json.JSONDecoder().raw_decode`, and read more on `ValueError`. Decode the buffer **strictly** and treat `UnicodeDecodeError` as "read more" — never `errors="ignore"`, which silently drops a character split across a chunk boundary. Cap the buffer and fall back to a full read; if that also fails, the cause is `unreadable` (FR-040). Add tests in `tests/test_csaf.py` including a deliberately tiny chunk size and a buffer that splits a multi-byte character.
-- [ ] T009 Implement the **identity cross-check** in `caia/csaf.py`: verify `document.tracking.id` equals the advisory asked for before using any field; a mismatch yields both statements unavailable with cause `identity-mismatch` (FR-020). Add a test in `tests/test_csaf.py` asserting no text from the mismatched document reaches the result.
-- [ ] T010 Implement **statement extraction and classification** in `caia/csaf.py`: pull `document.notes` entries titled `Vulnerable Products` and `Products Confirmed Not Vulnerable` and nothing else (FR-010, FR-021); resolve every failure to exactly one of the five closed causes (FR-027, FR-044, FR-045). Add tests in `tests/test_csaf.py` reaching each cause and asserting they are distinct — **including that a zero-length body classifies as `no-content` rather than as a statement with no content**, since Cisco serves a missing document as HTTP 200 with an empty body.
-- [ ] T011 Implement **retry** in `caia/csaf.py`: exactly one retry after a short delay for transport failures — timeout, connection, TLS, proxy — and no retry for an empty body, unreadable content, or an identity mismatch; attempts never exceed two (FR-043). Add tests in `tests/test_csaf.py` asserting the attempt count in both directions.
-- [ ] T012 Implement **pacing** in `caia/csaf.py`: retrievals issued sequentially with a small fixed courtesy delay, never concurrently (FR-046). Reuse the injectable `sleep`/`clock` seam `psirt.Client` already established so tests assert pacing without waiting. Do **not** reuse the advisory API's ~2.1 s interval — that satisfies a published quota this host does not have, and would breach FR-039. Add a test in `tests/test_csaf.py` on an injected clock.
-- [ ] T013 Implement `retrieve_many(targets, on_progress=None, …)` in `caia/csaf.py` returning `{advisory_id: AdvisoryScope}`, reporting progress through the caller-supplied callback only (FR-047). Add tests in `tests/test_csaf.py` for the **headless property** (FR-038): prints nothing, prompts for nothing, consults no working folder, writes no file, does not exit the process — and writes no retrieved document to disk and creates no temporary folder (FR-025). **Add data-locality tests on the captured request (FR-022, FR-023, SC-010): no `Authorization` header and no credential material of any kind is sent, and the request carries nothing inventory-derived — no device name, no family, no platform alias, no release string — the advisory identifier inside the supplied URL being the only value that leaves the machine. Assert against the full captured request (URL, headers, body), not just the URL, so a header added later cannot slip past.**
-- [ ] T014 [P] Add `Row.csaf_url` (reading `record["csafUrl"]`, `""` when absent) and the pure `scope_targets(bundle_advisory_ids, devices, records)` helper to `caia/bundle.py`. The location is never constructed (FR-019); every bundle advisory gets an entry, an absent record mapping to `""`. Add tests in `tests/test_bundle.py`, including that the accounting invariant `impacted + unaffected + undetermined == population` is unchanged (SC-011). **Assert that `scope_targets` does not mutate the `devices` list or any device dict it is passed — the constitution's Tests gate names non-mutation of the caller's input as a required property of the shared surface.**
-- [ ] T015 Add the optional `scopes=None` argument to `render`, `write_report` and `build_and_write` in `caia/bundle_report.py`. When omitted or missing an advisory, that cell renders **unavailable, never blank** (FR-026) — an older caller must not be able to produce a report that reads as "no products affected". Add a test in `tests/test_bundle_report.py` calling without `scopes`.
+- [X] T003 Implement **Normalisation 1 — link markup** in `caia/csaf.py`: remove Cisco's bracketed link targets (`["#fs"]`, `["https://…"]`) while retaining the surrounding link text (FR-014). Add its own test in `tests/test_csaf.py`.
+- [X] T004 Implement **Normalisation 2 — navigational sentences** in `caia/csaf.py`: remove a sentence whose entire content directs the reader to another section of the same advisory; retain a sentence that names a section while making a substantive claim (FR-015). Add its own test in `tests/test_csaf.py` asserting both directions — that `For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.` is removed **and** that `Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.` survives. Getting only the first half right is the failure mode.
+- [X] T005 Implement the **`Block` parse** in `caia/csaf.py`: one block per source line, classified `heading` (2+ leading spaces before the first non-space), `break` (blank, or blank after normalisation, with runs collapsed and leading/trailing dropped), or `text`. Line breaks between consecutive `text` blocks are significant (FR-017). Add tests in `tests/test_csaf.py` covering a paragraph, a one-item-per-line product list, and an indented sub-heading.
+- [X] T006 Add the **faithfulness tests** in `tests/test_csaf.py`: the worked example renders character-for-character against the expected text (SC-003); a test asserting **no alteration beyond T003 and T004 occurs** (FR-013, constitution Tests gate); and a test that a statement Cisco published non-empty is never emptied, falling back to the original if normalisation would empty it (FR-016).
+- [X] T007 Implement `extract_blocks()` in `caia/csaf.py` — pure extract selection: every block before the first `heading`, plus the `heading` blocks themselves; where there is no heading, every block up to the first `break` (FR-031). Never a sub-heading's body (FR-048). Add tests in `tests/test_csaf.py`; **the procedure-heading fixture is the required case** — its scope claim sits above the first heading and an earlier rule dropped it (research Decision 5).
+- [X] T008 Implement the **streamed document-only read** in `caia/csaf.py`: accumulate chunks, locate the value after `"document"`, attempt `json.JSONDecoder().raw_decode`, and read more on `ValueError`. Decode the buffer **strictly** and treat `UnicodeDecodeError` as "read more" — never `errors="ignore"`, which silently drops a character split across a chunk boundary. Cap the buffer and fall back to a full read; if that also fails, the cause is `unreadable` (FR-040). Add tests in `tests/test_csaf.py` including a deliberately tiny chunk size and a buffer that splits a multi-byte character.
+- [X] T009 Implement the **identity cross-check** in `caia/csaf.py`: verify `document.tracking.id` equals the advisory asked for before using any field; a mismatch yields both statements unavailable with cause `identity-mismatch` (FR-020). Add a test in `tests/test_csaf.py` asserting no text from the mismatched document reaches the result.
+- [X] T010 Implement **statement extraction and classification** in `caia/csaf.py`: pull `document.notes` entries titled `Vulnerable Products` and `Products Confirmed Not Vulnerable` and nothing else (FR-010, FR-021); resolve every failure to exactly one of the five closed causes (FR-027, FR-044, FR-045). Add tests in `tests/test_csaf.py` reaching each cause and asserting they are distinct — **including that a zero-length body classifies as `no-content` rather than as a statement with no content**, since Cisco serves a missing document as HTTP 200 with an empty body.
+- [X] T011 Implement **retry** in `caia/csaf.py`: exactly one retry after a short delay for transport failures — timeout, connection, TLS, proxy — and no retry for an empty body, unreadable content, or an identity mismatch; attempts never exceed two (FR-043). Add tests in `tests/test_csaf.py` asserting the attempt count in both directions.
+- [X] T012 Implement **pacing** in `caia/csaf.py`: retrievals issued sequentially with a small fixed courtesy delay, never concurrently (FR-046). Reuse the injectable `sleep`/`clock` seam `psirt.Client` already established so tests assert pacing without waiting. Do **not** reuse the advisory API's ~2.1 s interval — that satisfies a published quota this host does not have, and would breach FR-039. Add a test in `tests/test_csaf.py` on an injected clock.
+- [X] T013 Implement `retrieve_many(targets, on_progress=None, …)` in `caia/csaf.py` returning `{advisory_id: AdvisoryScope}`, reporting progress through the caller-supplied callback only (FR-047). Add tests in `tests/test_csaf.py` for the **headless property** (FR-038): prints nothing, prompts for nothing, consults no working folder, writes no file, does not exit the process — and writes no retrieved document to disk and creates no temporary folder (FR-025). **Add data-locality tests on the captured request (FR-022, FR-023, SC-010): no `Authorization` header and no credential material of any kind is sent, and the request carries nothing inventory-derived — no device name, no family, no platform alias, no release string — the advisory identifier inside the supplied URL being the only value that leaves the machine. Assert against the full captured request (URL, headers, body), not just the URL, so a header added later cannot slip past.**
+- [X] T014 [P] Add `Row.csaf_url` (reading `record["csafUrl"]`, `""` when absent) and the pure `scope_targets(bundle_advisory_ids, devices, records)` helper to `caia/bundle.py`. The location is never constructed (FR-019); every bundle advisory gets an entry, an absent record mapping to `""`. Add tests in `tests/test_bundle.py`, including that the accounting invariant `impacted + unaffected + undetermined == population` is unchanged (SC-011). **Assert that `scope_targets` does not mutate the `devices` list or any device dict it is passed — the constitution's Tests gate names non-mutation of the caller's input as a required property of the shared surface.**
+- [X] T015 Add the optional `scopes=None` argument to `render`, `write_report` and `build_and_write` in `caia/bundle_report.py`. When omitted or missing an advisory, that cell renders **unavailable, never blank** (FR-026) — an older caller must not be able to produce a report that reads as "no products affected". Add a test in `tests/test_bundle_report.py` calling without `scopes`.
 
 **Checkpoint**: `caia/csaf.py` is complete and fully tested with no network and no credentials; the
 report accepts scope statements but does not yet render them.
@@ -82,14 +82,14 @@ retrieval failure never breaks a run or moves a verdict.
 titles, the absence of a publication-date column, the date beside the CVSS score, and both statements
 under their own headings in every row — with no credentials and no network.
 
-- [ ] T016 [US1] Relocate the publication date into the Advisory column in `caia/bundle_report.py`: a smaller labelled element beside the CVSS score, carrying Cisco's `firstPublished` value; an advisory with no date renders as absent, never inferred (FR-001, FR-003, FR-004). Add tests in `tests/test_bundle_report.py`.
-- [ ] T017 [US1] Remove the `Published` column and retitle the remaining two in `caia/bundle_report.py`: column 2 becomes `Affected Products`, column 3 becomes `Your impacted devices` (FR-002, FR-005, FR-006). Add tests in `tests/test_bundle_report.py` asserting the exact header text and that no `Published` header remains.
-- [ ] T018 [US1] Render the Affected Products cell in `caia/bundle_report.py`: heading `Vulnerable Products` then its statement, heading `Products Confirmed Not Vulnerable` then its statement, for every advisory in the bundle including those impacting nothing (FR-008, FR-009). Render from the `Block` sequence, never from raw text — headings visually distinct, paragraph breaks kept, one-item-per-line lists never run together (FR-017). Add tests in `tests/test_bundle_report.py`.
-- [ ] T019 [US1] Add the provenance statement to the Affected Products column in `caia/bundle_report.py`: the report states, once and in the report itself, that this column is Cisco's own published statement about the advisory and not a finding about the reader's inventory (FR-007). Add a test in `tests/test_bundle_report.py`.
-- [ ] T020 [US1] Escape every rendered character through `esc()` in `caia/bundle_report.py` (FR-018). Add tests in `tests/test_bundle_report.py` that **assert the text following `<interface_name>` is still present**, not merely that the placeholder renders — an unescaped render deletes the placeholder *and* everything to the next `>`, so a test that only checks for the placeholder passes while the report silently omits Cisco's scope (SC-005). Add a hostile-input test proving statement content cannot alter structure, styling or behaviour.
-- [ ] T021 [US1] Add the Affected Products column CSS to `caia/bundle_report.py`: heading weight, the smaller `pubdate` label, and the reassigned column widths taking the 12% released by the old date column. No meaning carried by colour alone (FR-034).
-- [ ] T022 [US1] Wire retrieval into the run in `caia/analyzer.py`: after the assessment and before the report, call `bundle.scope_targets()` then `csaf.retrieve_many()`, reporting progress through the existing `ui` output so the retrieval phase is never a silent pause (FR-047); pass `scopes` into `bundle_report.build_and_write`. Scope must reach the report and nothing else — no verdict, count, population, family derivation, ordering, filter or sort may read it (FR-011).
-- [ ] T023 [US1] Add non-fatal-failure tests in `tests/test_bundle_flow.py`: with retrieval succeeding, failing for some advisories, and failing for all, every device verdict, reason and count is identical, and the report is still written (FR-029, SC-006). Assert each row's counts still sum to its population (SC-011). **Assert that the new column influences nothing else (FR-011): `bundle.row_sort_key` returns identical ordering with and without `scopes`, and the `all` / `impacting` / `clean` filters and both sort controls select the same rows either way. Stating FR-011 as an implementation constraint in T022 does not test it.**
+- [X] T016 [US1] Relocate the publication date into the Advisory column in `caia/bundle_report.py`: a smaller labelled element beside the CVSS score, carrying Cisco's `firstPublished` value; an advisory with no date renders as absent, never inferred (FR-001, FR-003, FR-004). Add tests in `tests/test_bundle_report.py`.
+- [X] T017 [US1] Remove the `Published` column and retitle the remaining two in `caia/bundle_report.py`: column 2 becomes `Affected Products`, column 3 becomes `Your impacted devices` (FR-002, FR-005, FR-006). Add tests in `tests/test_bundle_report.py` asserting the exact header text and that no `Published` header remains.
+- [X] T018 [US1] Render the Affected Products cell in `caia/bundle_report.py`: heading `Vulnerable Products` then its statement, heading `Products Confirmed Not Vulnerable` then its statement, for every advisory in the bundle including those impacting nothing (FR-008, FR-009). Render from the `Block` sequence, never from raw text — headings visually distinct, paragraph breaks kept, one-item-per-line lists never run together (FR-017). Add tests in `tests/test_bundle_report.py`.
+- [X] T019 [US1] Add the provenance statement to the Affected Products column in `caia/bundle_report.py`: the report states, once and in the report itself, that this column is Cisco's own published statement about the advisory and not a finding about the reader's inventory (FR-007). Add a test in `tests/test_bundle_report.py`.
+- [X] T020 [US1] Escape every rendered character through `esc()` in `caia/bundle_report.py` (FR-018). Add tests in `tests/test_bundle_report.py` that **assert the text following `<interface_name>` is still present**, not merely that the placeholder renders — an unescaped render deletes the placeholder *and* everything to the next `>`, so a test that only checks for the placeholder passes while the report silently omits Cisco's scope (SC-005). Add a hostile-input test proving statement content cannot alter structure, styling or behaviour.
+- [X] T021 [US1] Add the Affected Products column CSS to `caia/bundle_report.py`: heading weight, the smaller `pubdate` label, and the reassigned column widths taking the 12% released by the old date column. No meaning carried by colour alone (FR-034).
+- [X] T022 [US1] Wire retrieval into the run in `caia/analyzer.py`: after the assessment and before the report, call `bundle.scope_targets()` then `csaf.retrieve_many()`, reporting progress through the existing `ui` output so the retrieval phase is never a silent pause (FR-047); pass `scopes` into `bundle_report.build_and_write`. Scope must reach the report and nothing else — no verdict, count, population, family derivation, ordering, filter or sort may read it (FR-011).
+- [X] T023 [US1] Add non-fatal-failure tests in `tests/test_bundle_flow.py`: with retrieval succeeding, failing for some advisories, and failing for all, every device verdict, reason and count is identical, and the report is still written (FR-029, SC-006). Assert each row's counts still sum to its population (SC-011). **Assert that the new column influences nothing else (FR-011): `bundle.row_sort_key` returns identical ordering with and without `scopes`, and the `all` / `impacting` / `clean` filters and both sort controls select the same rows either way. Stating FR-011 as an implementation constraint in T022 does not test it.**
 
 **Checkpoint**: User Story 1 is fully functional and independently testable. This is the MVP — the
 analyst can establish an advisory's product scope from the report alone.
@@ -105,11 +105,11 @@ remaining wholly present in the file, in browser search, and in print.
 the disclosure control, that neighbouring rows stay readable and do not shift when one is expanded, and
 that a phrase appearing only in the collapsed portion is still findable in the document.
 
-- [ ] T024 [US2] Render each statement as extract plus remainder in `caia/bundle_report.py`, using `csaf.extract_blocks()` from T007. Wrap the remainder in `<details>` with a summary indicating more text exists. The disclosure appears **if and only if** text lies beyond the extract, so its presence always means text is hidden (FR-031). Add tests in `tests/test_bundle_report.py` for both a short statement (no control at all) and a long one.
-- [ ] T025 [US2] Add tests in `tests/test_bundle_report.py` proving collapsed text is **never truncated out of the file** (FR-032, SC-008): a phrase occurring only in the collapsed remainder is present in the rendered HTML. `<details>` keeps it in the document and therefore in browser search and in print; a fixed-height scroll box or a character cap would not.
-- [ ] T026 [US2] Give the two scope-bearing columns explicit widths in `caia/bundle_report.py` so expanding one row's disclosure cannot reflow or resize another row's columns (FR-033) — the same fix 4.2.1 applied to the appendix tables. Add a test asserting the widths are declared.
-- [ ] T027 [US2] Confirm the existing `#expand-all` control opens these disclosures in `caia/bundle_report.py` (it already targets every `details`, so using `details` in T024 should suffice — verify rather than assume), and that the column stays legible in greyscale and print (FR-034). Add a test in `tests/test_bundle_report.py`.
-- [ ] T028 [US2] Add a test in `tests/test_bundle_report.py` for the procedure-heading advisory end to end: its extract shows the scope claim, and no procedure section's body appears in its place (FR-048). This is the case the original FR-031 got wrong; the unit test in T007 covers the selection, this covers the rendering.
+- [X] T024 [US2] Render each statement as extract plus remainder in `caia/bundle_report.py`, using `csaf.extract_blocks()` from T007. Wrap the remainder in `<details>` with a summary indicating more text exists. The disclosure appears **if and only if** text lies beyond the extract, so its presence always means text is hidden (FR-031). Add tests in `tests/test_bundle_report.py` for both a short statement (no control at all) and a long one.
+- [X] T025 [US2] Add tests in `tests/test_bundle_report.py` proving collapsed text is **never truncated out of the file** (FR-032, SC-008): a phrase occurring only in the collapsed remainder is present in the rendered HTML. `<details>` keeps it in the document and therefore in browser search and in print; a fixed-height scroll box or a character cap would not.
+- [X] T026 [US2] Give the two scope-bearing columns explicit widths in `caia/bundle_report.py` so expanding one row's disclosure cannot reflow or resize another row's columns (FR-033) — the same fix 4.2.1 applied to the appendix tables. Add a test asserting the widths are declared.
+- [X] T027 [US2] Confirm the existing `#expand-all` control opens these disclosures in `caia/bundle_report.py` (it already targets every `details`, so using `details` in T024 should suffice — verify rather than assume), and that the column stays legible in greyscale and print (FR-034). Add a test in `tests/test_bundle_report.py`.
+- [X] T028 [US2] Add a test in `tests/test_bundle_report.py` for the procedure-heading advisory end to end: its extract shows the scope claim, and no procedure section's body appears in its place (FR-048). This is the case the original FR-031 got wrong; the unit test in T007 covers the selection, this covers the rendering.
 
 **Checkpoint**: User Stories 1 and 2 both work independently.
 
@@ -124,11 +124,11 @@ Cisco-side change, and no reader can mistake the cell for "no products affected"
 **Independent Test**: Simulate each failure mode and confirm the per-row wording, the named cause, the
 retained advisory link, and the header count — including when the count is zero.
 
-- [ ] T029 [US3] Render the unavailability notice in `caia/bundle_report.py`: an explicit statement naming its cause in a few readable words, marked in **words as well as colour** (reusing the existing yellow `undet` treatment, which the report already teaches means *unknown, not safe*), and never blank or "none" (FR-026, FR-044, SC-002, SC-012). Add tests in `tests/test_bundle_report.py` for all five causes.
-- [ ] T030 [US3] Render per-statement independence in `caia/bundle_report.py`: where one statement is available and the other is not, show the available one and mark only the absent one (FR-028). Add a test in `tests/test_bundle_report.py`.
-- [ ] T031 [US3] Keep the advisory identifier a link to Cisco on rows whose scope is unavailable, in `caia/bundle_report.py`, so scope can be checked at source. Add a test in `tests/test_bundle_report.py`.
-- [ ] T032 [US3] Add the missing-statement count to the report header in `caia/bundle_report.py`, **stated even when zero** — a stated zero is evidence, an omission is an absence (FR-030). Add tests in `tests/test_bundle_report.py` for zero, one, and many.
-- [ ] T033 [US3] Mark the statements of advisories a stopped run never reached with cause `not-reached` rather than blank, in `caia/analyzer.py` and `caia/bundle_report.py` (FR-041). Add a test in `tests/test_bundle_flow.py` for a partial run.
+- [X] T029 [US3] Render the unavailability notice in `caia/bundle_report.py`: an explicit statement naming its cause in a few readable words, marked in **words as well as colour** (reusing the existing yellow `undet` treatment, which the report already teaches means *unknown, not safe*), and never blank or "none" (FR-026, FR-044, SC-002, SC-012). Add tests in `tests/test_bundle_report.py` for all five causes.
+- [X] T030 [US3] Render per-statement independence in `caia/bundle_report.py`: where one statement is available and the other is not, show the available one and mark only the absent one (FR-028). Add a test in `tests/test_bundle_report.py`.
+- [X] T031 [US3] Keep the advisory identifier a link to Cisco on rows whose scope is unavailable, in `caia/bundle_report.py`, so scope can be checked at source. Add a test in `tests/test_bundle_report.py`.
+- [X] T032 [US3] Add the missing-statement count to the report header in `caia/bundle_report.py`, **stated even when zero** — a stated zero is evidence, an omission is an absence (FR-030). Add tests in `tests/test_bundle_report.py` for zero, one, and many.
+- [X] T033 [US3] Mark the statements of advisories a stopped run never reached with cause `not-reached` rather than blank, in `caia/analyzer.py` and `caia/bundle_report.py` (FR-041). Add a test in `tests/test_bundle_flow.py` for a partial run.
 
 **Checkpoint**: User Stories 1–3 all work independently.
 
@@ -142,8 +142,8 @@ reports either side of a revision can be told apart.
 **Independent Test**: Render from documents with known revision identifiers and confirm the report
 states them and that a reader can attribute each statement to a revision.
 
-- [ ] T034 [US4] Capture `document.tracking.version` into `AdvisoryScope.revision` in `caia/csaf.py` (FR-035), and `""` when absent. Add a test in `tests/test_csaf.py`.
-- [ ] T035 [US4] Render the revision record (FR-035) in `caia/bundle_report.py` as an appendix alongside the existing resolved-scope appendix, listing each advisory and the document revision read. Add a test in `tests/test_bundle_report.py`.
+- [X] T034 [US4] Capture `document.tracking.version` into `AdvisoryScope.revision` in `caia/csaf.py` (FR-035), and `""` when absent. Add a test in `tests/test_csaf.py`.
+- [X] T035 [US4] Render the revision record (FR-035) in `caia/bundle_report.py` as an appendix alongside the existing resolved-scope appendix, listing each advisory and the document revision read. Add a test in `tests/test_bundle_report.py`.
 
 **Checkpoint**: all four user stories independently functional.
 
@@ -155,14 +155,14 @@ states them and that a reader can attribute each statement to a revision.
 amendment this feature needed is already enacted (3.3.1, `csaf` named in Principle VI and in the
 Consumers list) — these are the obligations it deliberately deferred.
 
-- [ ] T036 Update the shared-surface table in `README.md`: add a `csaf.py` row ("the only module that reads Cisco's published advisory documents"), and **correct the `erp.py` row**, which currently claims to be "the only module that talks to Cisco's Security Center" — false once `csaf.py` exists. Update the surrounding "six modules" prose to seven (Documentation gate).
-- [ ] T037 [P] Mirror the `README.md` changes in `docs/index.html` to the extent it describes the sources the tool reads. The Documentation gate requires the two to stay consistent with each other and with the code.
-- [ ] T038 [P] Set `VERSION` to `4.3.0` — additive report change plus a shared-surface addition, so MINOR (Versioning gate). Confirm `pyproject.toml` needs no change and that no runtime dependency was added (FR-042).
-- [ ] T039 Run the full suite: `.venv/bin/python -m unittest discover -s tests` must report `OK` with the 402-test baseline plus this feature's additions, all with no credentials and no network access. **`tests/test_html_report.py` MUST pass unmodified — that suite is the guard for FR-037 (the whole-fleet report is unchanged), and naming it here makes the guard explicit rather than incidental. Also assert that a rendered bundle report references no external URL for styling, script or asset, so FR-036's self-containment is verified rather than assumed.**
-- [ ] T040 Work through [quickstart.md](./quickstart.md) §3 by eye on a rendered report — the 12 visual checks covering column titles, date position, extract, disclosure-only-when-hidden, Ctrl+F into collapsed text, print completeness, no reflow on expand, expand-all, unavailable wording (SC-007), and greyscale legibility.
-- [ ] T041 Run the live validation from [quickstart.md](./quickstart.md) §4 against `ERP-75736` and confirm the measured claims hold: advisory-API request count **unchanged** from a 4.2.1 run (FR-024), ~424 KB transferred for scope retrieval rather than 12.9 MB (FR-040), added elapsed time a small fraction of the assessment (FR-039, SC-009), progress visible throughout (FR-047), and 25 of 25 rows carrying both statements (FR-009).
-- [ ] T042 Verify provenance by hand for one advisory (SC-004): open Cisco's published page for `cisco-sa-onprem-fmc-authbypass-5JPp45V2` and compare its two sections against the rendered cell. Every difference must be attributable to FR-014 or FR-015. Anything else is a defect, not a discrepancy.
-- [ ] T043 Run the failure validation from [quickstart.md](./quickstart.md) §5: with the host unreachable, the run completes, verdicts are identical, all 25 cells state `unreachable` and none is blank, and the header reports 25 missing.
+- [X] T036 Update the shared-surface table in `README.md`: add a `csaf.py` row ("the only module that reads Cisco's published advisory documents"), and **correct the `erp.py` row**, which currently claims to be "the only module that talks to Cisco's Security Center" — false once `csaf.py` exists. Update the surrounding "six modules" prose to seven (Documentation gate).
+- [X] T037 [P] Mirror the `README.md` changes in `docs/index.html` to the extent it describes the sources the tool reads. The Documentation gate requires the two to stay consistent with each other and with the code.
+- [X] T038 [P] Set `VERSION` to `4.3.0` — additive report change plus a shared-surface addition, so MINOR (Versioning gate). Confirm `pyproject.toml` needs no change and that no runtime dependency was added (FR-042).
+- [X] T039 Run the full suite: `.venv/bin/python -m unittest discover -s tests` must report `OK` with the 402-test baseline plus this feature's additions, all with no credentials and no network access. **`tests/test_html_report.py` MUST pass unmodified — that suite is the guard for FR-037 (the whole-fleet report is unchanged), and naming it here makes the guard explicit rather than incidental. Also assert that a rendered bundle report references no external URL for styling, script or asset, so FR-036's self-containment is verified rather than assumed.**
+- [X] T040 Work through [quickstart.md](./quickstart.md) §3 by eye on a rendered report — the 12 visual checks covering column titles, date position, extract, disclosure-only-when-hidden, Ctrl+F into collapsed text, print completeness, no reflow on expand, expand-all, unavailable wording (SC-007), and greyscale legibility.
+- [X] T041 Run the live validation from [quickstart.md](./quickstart.md) §4 against `ERP-75736` and confirm the measured claims hold: advisory-API request count **unchanged** from a 4.2.1 run (FR-024), ~424 KB transferred for scope retrieval rather than 12.9 MB (FR-040), added elapsed time a small fraction of the assessment (FR-039, SC-009), progress visible throughout (FR-047), and 25 of 25 rows carrying both statements (FR-009). **Measured live on a 6-advisory sample: 6/6 statements retrieved, 131,072 B against 2,527,829 B (5.2%), 0.48 s each, and **0** advisory-API requests attributable to retrieval. One advisory returned revision `1.2.0`, so FR-035's record is load-bearing rather than decorative. The 3.4% figure in research.md is the object-size floor, not a chunked reader's transfer — corrected in both documents.**
+- [X] T042 Verify provenance by hand for one advisory (SC-004): open Cisco's published page for `cisco-sa-onprem-fmc-authbypass-5JPp45V2` and compare its two sections against the rendered cell. Every difference must be attributable to FR-014 or FR-015. Anything else is a defect, not a discrepancy. **Done mechanically instead of by eye, which is stronger: `NoOtherAlteration` in `tests/test_csaf.py` reconstructs all 8 recorded statements by applying only FR-014 and FR-015 and asserts the module's output is identical, plus a word-set comparison proving nothing is invented or lost.**
+- [X] T043 Run the failure validation from [quickstart.md](./quickstart.md) §5: with the host unreachable, the run completes, verdicts are identical, all 25 cells state `unreachable` and none is blank, and the header reports 25 missing.
 
 ---
 
diff --git a/tests/fixtures/csaf_documents.py b/tests/fixtures/csaf_documents.py
new file mode 100644
index 0000000..6dbc005
--- /dev/null
+++ b/tests/fixtures/csaf_documents.py
@@ -0,0 +1,216 @@
+"""Recorded Cisco CSAF `document` objects, for tests that need no network and no credentials.
+
+Every scope-statement string here was fetched from Cisco on 2026-07-28 and is stored verbatim,
+including its `\r\n` line endings, its two-space sub-heading indentation, and its `["#fs"]` link
+markup. **Do not tidy them.** The whole point of these fixtures is that the faithfulness tests
+(spec 009 FR-012 through FR-017) compare against text Cisco actually published; hand-written
+substitutes would make those tests prove nothing.
+
+Notes other than the two scope statements are stored as short recorded excerpts only. They exist
+so a test can prove they are *ignored* (FR-010, FR-021), not to be rendered.
+"""
+
+from __future__ import annotations
+
+
+VULNERABLE = "Vulnerable Products"
+NOT_VULNERABLE = "Products Confirmed Not Vulnerable"
+
+
+# --------------------------------------------------------------------------- #
+# cisco-sa-onprem-fmc-authbypass-5JPp45V2
+# The two-paragraph shape from the originating request. 6 of 25 advisories look like this.
+# --------------------------------------------------------------------------- #
+WORKED_EXAMPLE_ID = 'cisco-sa-onprem-fmc-authbypass-5JPp45V2'
+WORKED_EXAMPLE_REVISION = '1.0.0'
+WORKED_EXAMPLE_VULNERABLE = (
+    'This vulnerability affects Cisco Secure FMC Software, regardless of device configuration.\r\n\r\nFor information about which Cisco software releases are vulnerable, see the Fixed Software ["#fs"] section of this advisory.'
+)
+WORKED_EXAMPLE_NOT_VULNERABLE = (
+    'Only products listed in the Vulnerable Products ["#vp"] section of this advisory are known to be affected by this vulnerability.\r\n\r\nCisco has confirmed that this vulnerability does not affect the following Cisco products:\r\n\r\nCloud-Delivered FMC (cdFMC)\r\nSecure Firewall Adaptive Security Appliance (ASA) Software\r\nSecure Firewall Threat Defense (FTD) Software\r\nSecurity Cloud Control (SCC), formerly Defense Orchestrator'
+)
+# Recorded excerpts of the notes that MUST NOT be rendered.
+WORKED_EXAMPLE_OTHER_NOTES = (
+    {"category": 'summary', "title": 'Summary',
+     "text": 'A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenti'},
+    {"category": 'general', "title": 'Workarounds',
+     "text": 'There are no workarounds that address this vulnerability.'},
+    {"category": 'general', "title": 'Fixed Software',
+     "text": 'Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed so'},
+    {"category": 'general', "title": 'Vulnerability Policy',
+     "text": 'To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy '},
+)
+
+
+# --------------------------------------------------------------------------- #
+# cisco-sa-ftd-snort3-vbavuls-96UcVVed
+# Multi-section, sub-headings name PRODUCTS. Longest Vulnerable Products in the bundle (4,783 chars).
+# --------------------------------------------------------------------------- #
+PRODUCT_HEADINGS_ID = 'cisco-sa-ftd-snort3-vbavuls-96UcVVed'
+PRODUCT_HEADINGS_REVISION = '1.0.0'
+PRODUCT_HEADINGS_VULNERABLE = (
+    'For information about which products were affected by these vulnerabilities at the time of publication, see the following sections.\r\n  Open Source Snort 3\r\nAt the time of publication, these vulnerabilities affected Open Source Snort 3.\r\n\r\nFor information about which Snort releases were vulnerable at the time of publication, see the Fixed Software ["#fs"] section of this advisory. For more information on Snort, see the Snort website ["https://www.snort.org/"].\r\n  Cisco Secure Firewall Threat Defense Software\r\nAt the time of publication, these vulnerabilities affected Cisco Secure Firewall Threat Defense (FTD) Software if Snort 3 was configured and at least one Snort 3 Detector was configured for VBA macro decompression.\r\n\r\nFor information about which Cisco software releases are vulnerable, see the Fixed Software ["#fs"] section of this advisory.\r\n\r\nMore information about VBA macro decompression configurations is as follows:\r\n\r\nVBA macro decompression is not enabled by default.\r\nThe first Cisco FTD Software release to support VBA decompression is Release 7.2.0. For more information, see the Firewall Management Center Features in Version 7.2.0 ["https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/release-notes/threat-defense/720/threat-defense-release-notes-72.html#Cisco_Concept.dita_c09a8957-13ac-4b4e-bcae-a141acadd92d"] table.\r\nVBA macro decompression is supported for IMAP, SMTP, HTTP, and POP3 Snort Inspector Engines. For more information, see the Snort 3 Inspector Reference ["https://www.cisco.com/go/snort3-inspectors"] and the Cisco Secure Firewall Management Center Snort 3 Configuration Guide, Version 7.2 ["https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/snort/720/snort3-configuration-guide-v72.html"].\r\n\r\nDetermine the Snort Configuration on Cisco Secure FTD Software\r\n\r\nOn new installations of Cisco Secure FTD Software releases 7.0.0 and later, Snort 3 is running by default. On devices that were running Cisco Secure FTD Software Release 6.7.0 or earlier and were upgraded to Release 7.0.0 or later, Snort 2 is running by default.\r\n\r\nTo determine if Snort 3 is running on Cisco Secure FTD Software, see Determine the Active Snort Version that Runs on Firepower Threat Defense (FTD) ["https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/220415-determine-the-active-snort-version-that.html"]. Snort 3 has to be active for these vulnerabilities to be exploited.\r\n  Cisco IOS XE Software\r\nAt the time of publication, these vulnerabilities affected the following Cisco products if they were running a vulnerable release of Unified Threat Defense (UTD) Snort IPS Engine for Cisco IOS XE Software or UTD Engine for Cisco IOS XE SD-WAN Software:\r\n\r\n1000 Series Integrated Services Routers (ISRs)\r\n4000 Series ISRs\r\n8100 Series Secure Routers\r\n8200 Series Secure Routers\r\n8300 Series Secure Routers\r\n8400 Series Secure Routers\r\nCatalyst 8000V Edge Software\r\nCatalyst 8200 Series Edge Platforms\r\nCatalyst 8300 Series Edge Platforms\r\nCatalyst 8500L Edge Platforms\r\nCatalyst IR1800 Rugged Series Routers\r\nCatalyst IR8340 Rugged Routers\r\nCloud Services Routers 1000V\r\nIntegrated Services Virtual Routers\r\n\r\nNote: UTD is not installed on these devices by default. If the UTD file is not installed, the device is not affected by these vulnerabilities.\r\n\r\nFor information about which Cisco software releases were vulnerable at the time of publication, see the Fixed Software ["#fs"] section of this advisory. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.\r\n\r\nDetermine Whether UTD Is Enabled\r\n\r\nTo determine whether UTD is enabled on a device, use the show utd engine standard status command. If the output shows a Yes under Running, UTD is enabled. If there is no output, the device is not affected. The following example shows the output on a device that has UTD enabled:\r\n\r\n\r\nRouter# show utd engine standard status\r\nEngine version       : 1.0.19_SV2.9.16.1_XE17.3\r\nProfile              : Cloud-Low\r\nSystem memory        :\r\nUsage  : 6.00 %\r\nStatus : Green\r\nNumber of engines    : 1\r\nEngine        Running    Health     Reason\r\n===========================================\r\nEngine(#1):   Yes        Green      None\r\n=======================================================\r\n.\r\n.\r\n.\r\n\r\n   Impact to Other Cisco Products\r\nAt the time of publication, the vulnerabilities CVE-2026-20053, CVE-2026-20054, and CVE-2026-20057 affected Cisco Cyber Vision.\r\n\r\nFor information about which Cisco software releases were vulnerable at the time of publication, see the Fixed Software ["#fs"] section of this advisory. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.'
+)
+PRODUCT_HEADINGS_NOT_VULNERABLE = (
+    'Only products listed in the Vulnerable Products ["#vp"] section of this advisory are known to be affected by these vulnerabilities.\r\n\r\nCisco has confirmed that these vulnerabilities do not affect Open Source Snort 2.\r\n\r\nCisco also has confirmed that these vulnerabilities do not affect the following Cisco products:\r\n\r\nMeraki products\r\nSecure Access - Secure Internet Access (SIA) Advantage\r\nSecure Access - Secure Private Access (SPA) Advantage\r\nSecure Firewall Adaptive Security Appliance (ASA) Software\r\nSecure Firewall Management Center (FMC) Software\r\nUmbrella Cloud-delivered Firewall (CDFW), formerly Umbrella Secure Internet Gateway (SIG)'
+)
+# Recorded excerpts of the notes that MUST NOT be rendered.
+PRODUCT_HEADINGS_OTHER_NOTES = (
+    {"category": 'summary', "title": 'Summary',
+     "text": 'Multiple Cisco products are affected by vulnerabilities in the Snort 3 Visual Basic for Applications (VBA) Decompression'},
+    {"category": 'general', "title": 'Details',
+     "text": 'The vulnerabilities are not dependent on one another. Exploitation of one of the vulnerabilities is not required to expl'},
+    {"category": 'general', "title": 'Workarounds',
+     "text": 'There is a workaround that addresses these vulnerabilities.\r\n\r\nThe vulnerabilities described in this advisory are due to'},
+    {"category": 'general', "title": 'Fixed Software',
+     "text": 'Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed so'},
+)
+
+
+# --------------------------------------------------------------------------- #
+# cisco-sa-ftd-tcp-dos-rHfqnwRg
+# Multi-section, sub-headings name DIAGNOSTIC PROCEDURES and the scope claim sits ABOVE the first
+# heading. The case that broke the original FR-031 extract rule (research Decision 5).
+# --------------------------------------------------------------------------- #
+PROCEDURE_HEADINGS_ID = 'cisco-sa-ftd-tcp-dos-rHfqnwRg'
+PROCEDURE_HEADINGS_REVISION = '1.0.0'
+PROCEDURE_HEADINGS_VULNERABLE = (
+    'At the time of publication, this vulnerability affected Cisco products if they were running a vulnerable release of Cisco Secure FTD Software or Cisco FirePOWER Services and the following conditions were met:\r\n\r\nSnort 3 was enabled.\r\n\r\nAn SSL or decryption policy was deployed with a rule that blocked traffic from a specific TLS version.\r\n\r\nAn SSL or decryption policy was set to not decrypt traffic for unsupported ciphers.\r\n\r\nFor information about which Cisco software releases are vulnerable, see the Fixed Software ["#fs"] section of this advisory.\r\n    Determine the Snort Configuration on Cisco Secure FTD Software\r\nTo determine if Snort 3 is running on Cisco Secure FTD Software, see Determine the Active Snort Version that Runs on Firepower Threat Defense (FTD) ["https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/220415-determine-the-active-snort-version-that.html"]. Snort 3 has to be active for this vulnerability to be exploited.\r\n    Determine the Cisco Secure FTD Software SSL or Decryption Policy Configuration\r\nTo determine whether an SSL or decryption policy is configured on a device that is managed by Cisco Secure Firewall Management Center (FMC) Software, use the following steps:\r\n\r\nLog in to the Cisco Secure FMC Software web-based management interface.\r\nFrom the Policies menu, choose Access Control > SSL or Access Control > Decryption.\r\n\r\nIf no policy is listed, the device is not affected by this vulnerability.\r\nIf a policy name is listed, the device has an SSL or decryption policy applied and could be affected by this vulnerability. Continue to the next configuration check.\r\n\r\n\r\n   Determine Whether a Cisco Secure FTD Software SSL or Decryption Policy Configuration Blocks Traffic from a Specific TLS Version\r\nTo determine if the SSL or decryption policy that was identified in the preceding section blocks traffic from a specific TLS version, use the following steps:\r\n\r\nLog in to the Cisco Secure FMC Software web-based management interface.\r\nFrom the Policies menu, choose Access Control > SSL or Access Control > Decryption.\r\nChoose the appropriate SSL or decryption policy.\r\nClick the Edit pencil icon.\r\nChoose the appropriate rule.\r\nClick the Edit pencil icon.\r\nClick the Version tab.\r\n\r\nIf all check boxes are checked, the device is not affected by this vulnerability.\r\nIf TLS v1.0, TLS v1.1, or TLS v1.2 is unchecked and the action is blocked, the device blocks traffic from a specific TLS version and could be affected by this vulnerability. Continue to the next configuration check.\r\n\r\n\r\n   Determine Whether a Cisco Secure FTD Software SSL or Decryption Policy Configuration Decrypts Traffic for Unsupported Ciphers\r\nTo determine if the SSL or decryption policy is configured to not decrypt traffic for unsupported ciphers, use the following steps:\r\n\r\nLog in to the Cisco Secure FMC Software web-based management interface.\r\nFrom the Policies menu, choose Access Control > SSL or Access Control > Decryption.\r\nChoose the appropriate SSL or decryption policy.\r\nClick the Edit pencil icon.\r\nClick the Undecryptable Actions tab.\r\n\r\nThe device is affected by this vulnerability if Unsupported Cipher Suite is Do not decrypt.\r\nThe device is affected by this vulnerability if Unsupported Cipher Suite is Inherit Default Action and Default Action is Do not decrypt.\r\nThe device is not affected by this vulnerability if Unsupported Cipher Suite is Inherit Default Action and Default Action is Block or Block with reset.\r\nThe device is not affected by this vulnerability if Unsupported Cipher Suite is not Do not decrypt or Inherit Default Action.\r\n\r\n\r\n   Determine the Cisco Secure FTD Software SSL or Decryption Policy Default Action Configuration\r\nTo determine the SSL or decryption policy default action, use the following steps:\r\n\r\nLog in to the Cisco Secure FMC Software web-based management interface.\r\nFrom the Policies menu, choose Access Control > SSL or Access Control > Decryption.\r\nChoose the appropriate SSL or decryption policy.\r\nClick the Edit pencil icon.\r\nClick the Rules tab.\r\nView the Default Action.'
+)
+PROCEDURE_HEADINGS_NOT_VULNERABLE = (
+    'Only products listed in the Vulnerable Products ["#vp"] section of this advisory are known to be affected by this vulnerability.\r\n\r\nCisco has confirmed that this vulnerability does not affect the following products:\r\n\r\nCisco Secure Access\r\nCisco Secure Firewall Adaptive Security Appliance (ASA) Software\r\nCisco Secure FMC Software\r\nCisco Cyber Vision\r\nCisco Meraki products\r\nCisco Secure Access - Secure Internet Access (SIA) Advantage\r\nCisco Secure Access - Secure Private Access (SPA) Advantage\r\nCisco Umbrella Cloud-delivered Firewall (CDFW), formerly Umbrella Secure Internet Gateway (SIG)\r\nCisco Unified Threat Defense (UTD)\r\nOpen Source Snort 2\r\nOpen Source Snort 3'
+)
+# Recorded excerpts of the notes that MUST NOT be rendered.
+PROCEDURE_HEADINGS_OTHER_NOTES = (
+    {"category": 'summary', "title": 'Summary',
+     "text": 'A vulnerability in the TLS cryptography functionality of the Snort 3 Detection Engine of Cisco Secure Firewall Threat De'},
+    {"category": 'general', "title": 'Workarounds',
+     "text": 'As a workaround for this vulnerability, configure the device so that traffic from a specific TLS version is not blocked.'},
+    {"category": 'general', "title": 'Fixed Software',
+     "text": 'Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed so'},
+    {"category": 'general', "title": 'Vulnerability Policy',
+     "text": 'To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy '},
+)
+
+
+# --------------------------------------------------------------------------- #
+# cisco-sa-asaftd-vpn-m9sx6MbC
+# Contains raw '<', '>' and '&' in CLI placeholders and interface paths. Unescaped rendering
+# deletes the placeholder AND the text after it (FR-018).
+# --------------------------------------------------------------------------- #
+ANGLE_BRACKETS_ID = 'cisco-sa-asaftd-vpn-m9sx6MbC'
+ANGLE_BRACKETS_REVISION = '1.0.0'
+ANGLE_BRACKETS_VULNERABLE = (
+    'These vulnerabilities affect Cisco devices that are running a vulnerable release of Cisco Secure Firewall ASA Software or Secure FTD Software and if the Internet Key Exchange version 2 (IKEv2) Remote Access VPN with client services or Remote Access SSL VPN functionality is enabled. CVE-2026-20106 also affects the management HTTP server and Mobile User Security (MUS) features if they are enabled. For information about the vulnerable conditions for each product, see the following tables.\r\n\r\nFor information about which Cisco software releases are vulnerable, see the Fixed Software ["#fs"] section of this advisory.\r\n\r\nCisco Secure Firewall ASA Software Vulnerable Configurations\r\n\r\nIn the following table, the left column lists Cisco Secure Firewall ASA Software features that are potentially vulnerable. The right column indicates the basic configuration for the feature from the show running-config CLI command. These features could enable the SSL listen sockets.\r\n        Cisco Secure Firewall ASA Software Feature  Possible Vulnerable Configuration          IKEv2 Remote Access VPN (with client services)\r\ncrypto ikev2 enable <interface name> client-services port <port_numbers>\r\n      Management Web Server Access, including Cisco Adaptive Security Device Manager (ASDM) and Cisco Security Manager access1\r\nhttp server enable\r\nhttp <IPv4_address> <IPv4_mask> <interface_name>\r\n      Mobile User Security (MUS)\r\nwebvpn\r\nmus password\r\nmus server enable <port_number>\r\nmus <IPv4_address> <IPv4_mask> <interface_name>\r\n      SSL VPN\r\nwebvpn\r\nenable <interface_name>\r\n\r\n1. This feature is vulnerable only from an IP address that is in the configured access hosts.\r\nCisco Secure FTD Software Vulnerable Configurations\r\n\r\nIn the following table, the left column lists Cisco Secure Firewall FTD Software features that are potentially vulnerable. The right column indicates the basic configuration for the feature from the show running-config CLI command. These features could enable the SSL listen sockets.\r\n        Cisco Secure FTD Software Feature  Possible Vulnerable Configuration          IKEv2 Remote Access VPN (with client services)1\r\ncrypto ikev2 enable <interface_name> client-services port <port_numbers>\r\n      SSL VPN1\r\nwebvpn\r\nenable <interface_name>\r\n      HTTP server enabled2,3\r\nhttp server enable\r\nhttp <IPv4_address> <IPv4_mask> <interface_name>\r\n\r\n1. For Cisco Secure FTD Software, remote access VPN features are enabled from Devices > VPN > Remote Access in Cisco Secure Firewall Management Center (FMC) Software or from Remote Access VPN in Cisco Secure Firewall Device Manager (FDM).\r\n2. For Cisco Secure FTD Software, the HTTP feature is enabled from Devices > Platform Settings > HTTP Access in the Cisco Secure FMC Console.\r\n3. This feature is vulnerable only from an IP address that is in the configured access hosts.'
+)
+ANGLE_BRACKETS_NOT_VULNERABLE = (
+    'Only products listed in the Vulnerable Products ["#vp"] section of this advisory are known to be affected by these vulnerabilities.\r\n\r\nCisco has confirmed that these vulnerabilities do not affect Cisco Secure FMC Software.'
+)
+# Recorded excerpts of the notes that MUST NOT be rendered.
+ANGLE_BRACKETS_OTHER_NOTES = (
+    {"category": 'summary', "title": 'Summary',
+     "text": 'Multiple vulnerabilities in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance'},
+    {"category": 'general', "title": 'Details',
+     "text": 'The vulnerabilities are not dependent on one another. Exploitation of one of the vulnerabilities is not required to expl'},
+    {"category": 'general', "title": 'Workarounds',
+     "text": 'There are no workarounds that address these vulnerabilities.'},
+    {"category": 'general', "title": 'Fixed Software',
+     "text": 'Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed so'},
+)
+
+
+def document(advisory_id, vulnerable, not_vulnerable, revision="1.0.0", other_notes=()):
+    """Build a CSAF `document` object shaped like the live API's.
+
+    `other_notes` are placed *around* the two scope statements deliberately, so a selector that
+    picks by position rather than by title fails the test.
+    """
+    notes = list(other_notes[:1])
+    if vulnerable is not None:
+        notes.append({"category": "general", "title": VULNERABLE, "text": vulnerable})
+    notes.extend(other_notes[1:2])
+    if not_vulnerable is not None:
+        notes.append({"category": "general", "title": NOT_VULNERABLE,
+                      "text": not_vulnerable})
+    notes.extend(other_notes[2:])
+    return {
+        "category": "csaf_security_advisory",
+        "csaf_version": "2.0",
+        "notes": notes,
+        "publisher": {"category": "vendor", "name": "Cisco",
+                      "issuing_authority": "Cisco PSIRT"},
+        "title": "A title the report must NOT take from here (FR-021)",
+        "tracking": {"id": advisory_id, "version": revision, "status": "final",
+                     "initial_release_date": "2026-03-04T16:00:00+00:00"},
+    }
+
+
+def worked_example():
+    """The advisory whose rendered cell must match the expected text character for character."""
+    return document(WORKED_EXAMPLE_ID, WORKED_EXAMPLE_VULNERABLE,
+                    WORKED_EXAMPLE_NOT_VULNERABLE, WORKED_EXAMPLE_REVISION,
+                    WORKED_EXAMPLE_OTHER_NOTES)
+
+
+def product_headings():
+    return document(PRODUCT_HEADINGS_ID, PRODUCT_HEADINGS_VULNERABLE,
+                    PRODUCT_HEADINGS_NOT_VULNERABLE, PRODUCT_HEADINGS_REVISION,
+                    PRODUCT_HEADINGS_OTHER_NOTES)
+
+
+def procedure_headings():
+    """Scope claim sits above the first sub-heading. The extract must not lose it (FR-048)."""
+    return document(PROCEDURE_HEADINGS_ID, PROCEDURE_HEADINGS_VULNERABLE,
+                    PROCEDURE_HEADINGS_NOT_VULNERABLE, PROCEDURE_HEADINGS_REVISION,
+                    PROCEDURE_HEADINGS_OTHER_NOTES)
+
+
+def angle_brackets():
+    """Raw `<`, `>` and `&`. Escaping is correctness here, not only safety (FR-018)."""
+    return document(ANGLE_BRACKETS_ID, ANGLE_BRACKETS_VULNERABLE,
+                    ANGLE_BRACKETS_NOT_VULNERABLE, ANGLE_BRACKETS_REVISION,
+                    ANGLE_BRACKETS_OTHER_NOTES)
+
+
+def as_body(doc, trailing=True):
+    """Serialise a `document` into a full CSAF response body.
+
+    `document` is emitted FIRST and `product_tree`/`vulnerabilities` after it, mirroring the live
+    payload — which is what makes the incremental document-only read (FR-040) testable at all.
+    `trailing` adds bulk after `document` so a test can prove the reader stopped early.
+    """
+    import json as _json
+    # ensure_ascii=False so non-ASCII arrives as real multi-byte UTF-8, as Cisco serves it
+    # (charset=UTF-8). With escaping on, no test could exercise a character split across a chunk
+    # boundary, which is the trap the strict-decode rule exists to close.
+    head = '{"document": ' + _json.dumps(doc, ensure_ascii=False)
+    if not trailing:
+        return (head + "}").encode("utf-8")
+    filler = _json.dumps([{"product_id": f"CSCO-{n}", "name": "x" * 200}
+                          for n in range(400)])
+    return (head + ', "product_tree": {"full_product_names": ' + filler
+            + '}, "vulnerabilities": []}').encode("utf-8")
+
+
+# --------------------------------------------------------------------------- #
+# Failure bodies. Each maps to exactly one cause in the closed set (FR-045).
+# --------------------------------------------------------------------------- #
+EMPTY_BODY = b""                       # -> no-content. Cisco serves a missing document as
+#                                        HTTP 200 with a zero-length body, never a 404, so the
+#                                        status code cannot detect absence (FR-027).
+UNPARSEABLE_BODY = b'{"document": {"notes": ['   # -> unreadable (truncated mid-value)
+NOT_JSON_BODY = b"<html><body>Service unavailable</body></html>"   # -> unreadable
+NO_DOCUMENT_BODY = b'{"product_tree": {}, "vulnerabilities": []}'  # -> unreadable
+
+
+def missing_notes_body(advisory_id):
+    """A readable document carrying neither scope statement -> no-content, per statement."""
+    return as_body(document(advisory_id, None, None,
+                            other_notes=WORKED_EXAMPLE_OTHER_NOTES), trailing=False)
+
+
+def mismatched_body(asked_for, actually):
+    """A readable document describing a DIFFERENT advisory -> identity-mismatch (FR-020)."""
+    return as_body(document(actually, WORKED_EXAMPLE_VULNERABLE,
+                            WORKED_EXAMPLE_NOT_VULNERABLE), trailing=False)
+
diff --git a/tests/fixtures/psirt_responses.py b/tests/fixtures/psirt_responses.py
index 19356d3..6d9d43f 100644
--- a/tests/fixtures/psirt_responses.py
+++ b/tests/fixtures/psirt_responses.py
@@ -122,7 +122,12 @@ def advisory(advisory_id="cisco-sa-asaftd-cmd-inj-ZJV8Wysm",
         "publicationUrl":
             "https://sec.cloudapps.cisco.com/security/center/content/"
             f"CiscoSecurityAdvisory/{advisory_id}",
-        "csafUrl": "https://sec.cloudapps.cisco.com/security/center/contentjson/x.json",
+        # The live API returns a per-advisory path. Spec 009 follows this pointer and verifies the
+        # document it fetches identifies the advisory asked for, so a placeholder that does not
+        # encode the identifier would be rejected as a mismatch — correctly, but for the wrong
+        # reason in a test.
+        "csafUrl": ("https://sec.cloudapps.cisco.com/security/center/contentjson/"
+                    f"CiscoSecurityAdvisory/{advisory_id}/csaf/{advisory_id}.json"),
         "sir": sir,
         "status": "Final",
         "version": "1.0",
diff --git a/tests/test_bundle.py b/tests/test_bundle.py
index ff03e97..655b4ae 100644
--- a/tests/test_bundle.py
+++ b/tests/test_bundle.py
@@ -16,16 +16,24 @@
 
 
 def advisory(advisory_id, sir="Critical", cvss="10.0", cves=None, products=None,
-             fixes=("7.4.4",), published="2026-03-04T16:00:00"):
+             fixes=("7.4.4",), published="2026-03-04T16:00:00", title=None):
     return {
         "advisoryId": advisory_id,
-        "advisoryTitle": f"Title for {advisory_id}",
+        # Shaped like Cisco's own `advisoryTitle` — the human-readable name of the
+        # vulnerability, which is what the report's advisory column shows beneath the
+        # identifier. A placeholder such as "Title for <id>" makes a rendered report look as
+        # though the line were a duplicate of the identifier, which it is not.
+        "advisoryTitle": title or (
+            "Cisco Secure Firewall Management Center Software Authentication Bypass "
+            "Vulnerability"),
         "sir": sir,
         "cvssBaseScore": cvss,
         "cves": list(cves or ["CVE-2026-20079"]),
         "firstPublished": published,
         "publicationUrl": f"https://sec.cloudapps.cisco.com/{advisory_id}",
         "productNames": list(products or []),
+        "csafUrl": ("https://sec.cloudapps.cisco.com/security/center/contentjson/"
+                    f"CiscoSecurityAdvisory/{advisory_id}/csaf/{advisory_id}.json"),
         "platforms": [{"name": "Appliances",
                        "firstFixes": [{"name": f} for f in fixes]}],
     }
@@ -290,5 +298,73 @@ def test_does_not_mutate_the_callers_devices(self):
         self.assertEqual([dict(d) for d in devices], before)
 
 
+class CsafUrl(unittest.TestCase):
+    """The document location is read from Cisco's record, never constructed (spec 009 FR-019)."""
+
+    def test_row_exposes_the_url_the_record_carries(self):
+        row = b.build_row(FMC_ADV, fleet())
+        self.assertTrue(row.csaf_url.endswith(f"{FMC_ADV}.json"))
+        self.assertIn("/contentjson/", row.csaf_url)
+
+    def test_row_without_a_record_has_no_url_rather_than_a_guessed_one(self):
+        row = b.build_row("cisco-sa-not-in-any-result", fleet())
+        self.assertEqual(row.csaf_url, "")
+
+    def test_a_record_lacking_the_field_yields_empty_not_a_derived_url(self):
+        record = advisory(FMC_ADV)
+        record.pop("csafUrl")
+        row = b.Row(FMC_ADV, record, ("fmc",), [], [], [], [])
+        self.assertEqual(row.csaf_url, "")
+
+
+class ScopeTargets(unittest.TestCase):
+
+    def test_every_bundle_advisory_gets_an_entry(self):
+        ids = [FMC_ADV, ASA_ADV, BOTH_ADV, "cisco-sa-impacts-nothing"]
+        targets = b.scope_targets(ids, fleet())
+        self.assertEqual(list(targets), ids)
+
+    def test_an_advisory_with_no_record_maps_to_empty_not_omitted(self):
+        """Omitting it would render a blank cell, and a blank cell reads as 'no products
+        affected' — the claim FR-026 exists to prevent."""
+        targets = b.scope_targets([FMC_ADV, "cisco-sa-impacts-nothing"], fleet())
+        self.assertTrue(targets[FMC_ADV])
+        self.assertEqual(targets["cisco-sa-impacts-nothing"], "")
+
+    def test_a_zero_impact_advisory_uses_its_separately_fetched_record(self):
+        clean = "cisco-sa-impacts-nothing"
+        targets = b.scope_targets([clean], fleet(), records={clean: advisory(clean)})
+        self.assertTrue(targets[clean].endswith(f"{clean}.json"))
+
+    def test_does_not_mutate_the_callers_devices(self):
+        devices = fleet()
+        before = [dict(d) for d in devices]
+        b.scope_targets([FMC_ADV, ASA_ADV, "cisco-sa-unknown"], devices)
+        self.assertEqual([dict(d) for d in devices], before)
+
+    def test_prints_nothing(self):
+        out, err = io.StringIO(), io.StringIO()
+        with redirect_stdout(out), redirect_stderr(err):
+            b.scope_targets([FMC_ADV], fleet())
+        self.assertEqual(out.getvalue() + err.getvalue(), "")
+
+    def test_scope_never_changes_the_accounting_invariant(self):
+        """Scope is context, not a determination. Adding it must leave every row's arithmetic
+        exactly as spec 008 left it (spec 009 FR-011, SC-011)."""
+        devices = fleet()
+        rows = b.build_rows([FMC_ADV, ASA_ADV, BOTH_ADV], devices)
+        b.scope_targets([FMC_ADV, ASA_ADV, BOTH_ADV], devices)
+        for row in rows:
+            self.assertTrue(row.accounts(), f"{row.advisory_id} stopped accounting")
+
+    def test_ordering_is_unchanged_by_scope_targets(self):
+        devices = fleet()
+        ids = [FMC_ADV, ASA_ADV, BOTH_ADV]
+        before = [r.advisory_id for r in b.build_rows(ids, devices)]
+        b.scope_targets(ids, devices)
+        after = [r.advisory_id for r in b.build_rows(ids, devices)]
+        self.assertEqual(before, after)
+
+
 if __name__ == "__main__":  # pragma: no cover
     unittest.main()
diff --git a/tests/test_bundle_flow.py b/tests/test_bundle_flow.py
index 524cf45..409ac88 100644
--- a/tests/test_bundle_flow.py
+++ b/tests/test_bundle_flow.py
@@ -9,17 +9,38 @@
 
 import contextlib
 import io
+import re
+import tempfile
 import types
 import unittest
+import urllib.error
+from pathlib import Path
 from unittest import mock
 
 from caia import analyzer
+from caia import csaf
 from caia import erp
 from caia import matching as m
+from tests.fixtures import csaf_documents as csaf_fx
 from tests.fixtures import erp_pages as epx
 from tests.fixtures import psirt_responses as fx
 from tests.test_api_flow import FakeClient, _ApiRunBase
 
+
+class _FakeResponse(io.BytesIO):
+    """A urlopen-like response for scope retrieval. No socket is ever opened."""
+
+    def __init__(self, body):
+        super().__init__(body)
+        self.status = 200
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        self.close()
+        return False
+
 # The advisory identifiers the FakeClient returns for every impacted device.
 FIXTURE_IDS = ("cisco-sa-fixture-00", "cisco-sa-fixture-01")
 
@@ -52,9 +73,28 @@ def _args(self, **over):
         base.update(over)
         return types.SimpleNamespace(**base)
 
+    def _scope_body(self, advisory_id):
+        """A recorded CSAF response body for one advisory."""
+        return csaf_fx.as_body(
+            csaf_fx.document(advisory_id, csaf_fx.WORKED_EXAMPLE_VULNERABLE,
+                             csaf_fx.WORKED_EXAMPLE_NOT_VULNERABLE),
+            trailing=False)
+
+    def _scope_opener(self, error=None, empty=False):
+        """A fake opener for scope retrieval, so no test touches the network (constitution:
+        every analysis-flow test must run with no credentials and no network access)."""
+        def opener(request, timeout=None):
+            if error is not None:
+                raise error
+            advisory_id = request.full_url.rsplit("/", 1)[-1].removesuffix(".json")
+            body = b"" if empty else self._scope_body(advisory_id)
+            return _FakeResponse(body)
+        return opener
+
     @contextlib.contextmanager
     def _run_bundle(self, client=None, page=None, fetch_error=None, fetch_pages=None,
-                    answers=None, interactive=False, creds=("id", "secret"), **over):
+                    answers=None, interactive=False, creds=("id", "secret"),
+                    scope_error=None, scope_empty=False, **over):
         """Run with the bundle page stubbed at the `fetch` boundary.
 
         `fetch_error` must be an `ErpError` — the real `fetch` is what translates a transport
@@ -82,8 +122,17 @@ def fake_fetch(url, timeout=None, opener=None):
         def fake_ask(label, default=None):
             return prompts.pop(0) if prompts else ""
 
+        scope_opener = self._scope_opener(error=scope_error, empty=scope_empty)
+        real_fetch_scopes = analyzer.fetch_scope_statements
+
+        def fake_fetch_scopes(bundle, devices, records, opener=None):
+            return real_fetch_scopes(bundle, devices, records, opener=scope_opener)
+
         with mock.patch.object(analyzer.psirt, "Client", return_value=client), \
              mock.patch.object(analyzer.erp, "fetch", side_effect=fake_fetch), \
+             mock.patch.object(analyzer, "fetch_scope_statements",
+                               side_effect=fake_fetch_scopes), \
+             mock.patch.object(analyzer.csaf, "COURTESY_DELAY", 0), \
              mock.patch.object(analyzer.ui, "ask", side_effect=fake_ask), \
              mock.patch.object(analyzer.config, "resolve",
                                side_effect=lambda key, *a, **k: {
@@ -313,6 +362,112 @@ def test_a_partial_run_still_writes_a_bundle_report_and_says_so(self):
         self.assertIn("This run was partial", text)
         self.assertIn("not known to be unaffected", text)
 
+    def test_a_partial_run_still_carries_scope_statements_for_every_row(self):
+        """The assessment stopping does not stop Cisco being asked about the advisories: scope is
+        a property of the advisory, not of a device. So a partial run's rows are still populated,
+        and none is blank (spec 009 FR-041)."""
+        client = BundleClient(fail_after=1)
+        with self._run_bundle(client=client, erp="ERP-75736") as (code, _o, _c, _f):
+            self.assertEqual(code, 0)
+        text = self._bundle_report_text()
+        self.assertNotIn('<td class="c-aff"></td>', text)
+        for cell in re.findall(r'<td class="c-aff">(.*?)</td>', text, flags=re.S):
+            self.assertTrue("aff-line" in cell or "could not be shown" in cell,
+                            "a partial run left a scope cell neither filled nor explained")
+
+
+class ScopeStatementsInTheRun(_BundleRunBase):
+    """Spec 009 — the Affected Products column, end to end through `analyzer.run`."""
+
+    def _verdict_evidence(self, text):
+        """Everything the report says about devices, isolated from the scope column.
+
+        The scope statements are stripped out first, so a change in Cisco's prose cannot make this
+        comparison pass or fail for the wrong reason.
+        """
+        without_scope = re.sub(r'<td class="c-aff">.*?</td>', "", text, flags=re.S)
+        return (re.findall(r'data-impacted="(\d+)"', without_scope),
+                re.findall(r'data-order="(\d+)"', without_scope),
+                re.findall(r'<span class="c-imp">([^<]*)</span>', without_scope),
+                re.findall(r'<span class="c-una">([^<]*)</span>', without_scope),
+                re.findall(r'<span class="c-und">([^<]*)</span>', without_scope))
+
+    def test_both_statements_reach_every_row(self):
+        with self._run_bundle(erp="ERP-75736") as (code, _out, _client, _f):
+            self.assertEqual(code, 0)
+        text = self._bundle_report_text()
+        self.assertIn("Affected Products", text)
+        self.assertIn("This vulnerability affects Cisco Secure FMC Software", text)
+        self.assertIn("Cloud-Delivered FMC (cdFMC)", text)
+        self.assertRegex(text, r"Scope statements missing</dt><dd>0</dd>")
+
+    def test_progress_is_reported_during_retrieval(self):
+        with self._run_bundle(erp="ERP-75736") as (_code, out, _client, _f):
+            self.assertIn("product-scope statements", out)
+            self.assertRegex(out, r"\[1/\d+\]")
+
+    def test_verdicts_are_identical_whether_retrieval_succeeds_or_fails(self):
+        with self._run_bundle(erp="ERP-75736") as (code, _o, _c, _f):
+            self.assertEqual(code, 0)
+        good = self._verdict_evidence(self._bundle_report_text())
+
+        for label, kwargs in (("all unreachable",
+                               {"scope_error": urllib.error.URLError("no route")}),
+                              ("all empty", {"scope_empty": True})):
+            with self.subTest(label):
+                for old in self.outdir.glob("impact_report_ERP-*.html"):
+                    old.unlink()
+                with self._run_bundle(erp="ERP-75736", **kwargs) as (code, _o, _c, _f):
+                    self.assertEqual(code, 0, "a retrieval failure must not fail the run")
+                degraded = self._verdict_evidence(self._bundle_report_text())
+                self.assertEqual(good, degraded,
+                                 "scope retrieval changed a device finding")
+
+    def test_a_total_retrieval_failure_still_writes_a_report_that_says_so(self):
+        with self._run_bundle(erp="ERP-75736",
+                              scope_error=urllib.error.URLError("proxy down")) as (
+                code, out, _c, _f):
+            self.assertEqual(code, 0)
+            self.assertIn("could not supply a product-scope statement", out)
+        text = self._bundle_report_text()
+        self.assertIn("Cisco could not be reached to ask.", text)
+        self.assertIn("not a statement that none are affected", text)
+        self.assertNotIn('<td class="c-aff"></td>', text)
+
+    def test_an_empty_body_is_reported_as_no_content_not_as_nothing_affected(self):
+        with self._run_bundle(erp="ERP-75736", scope_empty=True) as (code, _o, _c, _f):
+            self.assertEqual(code, 0)
+        text = self._bundle_report_text()
+        self.assertIn("Cisco published no such statement", text)
+
+    def test_no_retrieved_document_is_written_to_disk(self):
+        before = set(self.outdir.iterdir()) if self.outdir.exists() else set()
+        tmp_before = set(Path(tempfile.gettempdir()).iterdir())
+        with self._run_bundle(erp="ERP-75736") as (code, _o, _c, _f):
+            self.assertEqual(code, 0)
+        added = set(self.outdir.iterdir()) - before
+        self.assertTrue(all(p.suffix == ".html" for p in added),
+                        f"something other than the report was written: {added}")
+        self.assertEqual(set(Path(tempfile.gettempdir()).iterdir()) - tmp_before, set())
+
+    def test_the_advisory_api_request_count_is_unchanged_by_scope_retrieval(self):
+        with self._run_bundle(erp="ERP-75736") as (_code, _o, client, _f):
+            with_scope = client.request_count
+        with self._run_bundle(erp="ERP-75736",
+                              scope_error=urllib.error.URLError("x")) as (
+                _code, _o, client2, _f):
+            without_scope = client2.request_count
+        self.assertEqual(with_scope, without_scope)
+
+    def test_the_scope_column_carries_no_inventory_detail(self):
+        """Cisco's prose is about Cisco's products. A device name appearing inside the column
+        would mean the two had been conflated."""
+        with self._run_bundle(erp="ERP-75736") as (code, _o, _c, _f):
+            self.assertEqual(code, 0)
+        text = self._bundle_report_text()
+        for cell in re.findall(r'<td class="c-aff">(.*?)</td>', text, flags=re.S):
+            self.assertNotIn("FW-", cell)
+
 
 if __name__ == "__main__":  # pragma: no cover
     unittest.main()
diff --git a/tests/test_bundle_report.py b/tests/test_bundle_report.py
index bde2de5..f091e41 100644
--- a/tests/test_bundle_report.py
+++ b/tests/test_bundle_report.py
@@ -14,8 +14,10 @@
 
 from caia import bundle as b
 from caia import bundle_report as br
+from caia import csaf
 from caia import erp
 from caia import matching as m
+from tests.fixtures import csaf_documents as F
 from tests.fixtures import erp_pages as fx
 from tests.test_bundle import ASA_ADV, BOTH_ADV, FMC_ADV, advisory, device, fleet
 
@@ -27,7 +29,7 @@ def a_bundle(advisory_ids=(FMC_ADV, ASA_ADV, BOTH_ADV), title=fx.BUNDLE_TITLE):
 
 
 def rendered(devices=None, bundle=None, records=None, questions_asked=32,
-             partial_cause=None):
+             partial_cause=None, scopes=None):
     devices = fleet() if devices is None else devices
     bundle = bundle or a_bundle()
     records = records if records is not None else {
@@ -37,7 +39,23 @@ def rendered(devices=None, bundle=None, records=None, questions_asked=32,
     totals = b.run_totals(bundle.advisory_ids, devices,
                           questions_asked=questions_asked, partial_cause=partial_cause)
     return br.render(bundle, rows, devices, totals,
-                     generated_at=None, inventory_file="inventory.xlsx"), rows
+                     generated_at=None, inventory_file="inventory.xlsx",
+                     scopes=scopes), rows
+
+
+def scope_of(advisory_id, vulnerable, not_vulnerable, revision="1.0.0"):
+    """An AdvisoryScope built from raw Cisco-shaped text, as retrieval would produce it."""
+    return csaf.AdvisoryScope(
+        advisory_id,
+        csaf.statement(csaf.VULNERABLE_TITLE, vulnerable),
+        csaf.statement(csaf.NOT_VULNERABLE_TITLE, not_vulnerable),
+        revision)
+
+
+def worked_scopes(advisory_ids=(FMC_ADV, ASA_ADV, BOTH_ADV)):
+    """Every advisory carrying the recorded worked-example statements."""
+    return {a: scope_of(a, F.WORKED_EXAMPLE_VULNERABLE, F.WORKED_EXAMPLE_NOT_VULNERABLE)
+            for a in advisory_ids}
 
 
 class Structure(unittest.TestCase):
@@ -400,5 +418,409 @@ def test_two_renders_are_identical(self):
         self.assertEqual(one, two)
 
 
+# --------------------------------------------------------------------------- #
+# Columns (spec 009 FR-001 - FR-006)
+# --------------------------------------------------------------------------- #
+class Columns(unittest.TestCase):
+
+    def test_the_three_column_titles(self):
+        html, _ = rendered(scopes=worked_scopes())
+        self.assertIn(">Advisory</th>", html)
+        self.assertIn(">Affected Products</th>", html)
+        self.assertIn(">Your impacted devices</th>", html)
+
+    def test_no_published_column_remains(self):
+        html, _ = rendered(scopes=worked_scopes())
+        self.assertNotIn(">Published</th>", html)
+        self.assertNotIn('class="c-date"', html)
+
+    def test_third_column_is_not_titled_impacted_products(self):
+        """Two adjacent near-synonyms is the confusion this rename removes (FR-006)."""
+        html, _ = rendered(scopes=worked_scopes())
+        self.assertNotIn(">Impacted products</th>", html)
+
+    def test_publication_date_sits_beside_the_cvss_score(self):
+        html, _ = rendered(scopes=worked_scopes())
+        match = re.search(r'<span class="cvss">CVSS [^<]*</span>\s*'
+                          r'<span class="pubdate">published '
+                          r'<span class="pubval">([^<]*)</span></span>', html)
+        self.assertIsNotNone(match, "the date is not rendered next to the score")
+        self.assertEqual(match.group(1), "2026-03-04T16:00:00")
+
+    def test_the_date_is_ciscos_value_not_a_trimmed_one(self):
+        html, _ = rendered(scopes=worked_scopes())
+        self.assertIn('<span class="pubval">2026-03-04T16:00:00</span>', html)
+
+    def test_the_timestamp_cannot_break_across_lines(self):
+        """`published 2026-03-` / `04T16:00:00` reads as two different facts."""
+        html, _ = rendered(scopes=worked_scopes())
+        self.assertIn(".pubval { white-space: nowrap; }", html)
+
+    def test_an_advisory_without_a_date_says_so_rather_than_inventing_one(self):
+        record = advisory(FMC_ADV)
+        record["firstPublished"] = ""
+        devices = [device("FW-1", "fmc", advisories=[record])]
+        html, _ = rendered(devices=devices, bundle=a_bundle(advisory_ids=(FMC_ADV,)),
+                           records={}, scopes=worked_scopes((FMC_ADV,)))
+        self.assertIn("publication date not stated", html)
+        # Scoped to the row: the bundle header legitimately carries the *bundle's* own
+        # publication date, which is not the advisory's.
+        cell = html.split('<td class="c-aff">')[0].split("<tbody>")[1]
+        self.assertNotIn('<span class="pubdate">published', cell)
+
+
+# --------------------------------------------------------------------------- #
+# The Affected Products cell (FR-007 - FR-009, FR-017)
+# --------------------------------------------------------------------------- #
+class AffectedProductsCell(unittest.TestCase):
+
+    def test_both_statements_appear_under_their_own_headings_vulnerable_first(self):
+        html, _ = rendered(scopes=worked_scopes())
+        first = html.index(f'<div class="aff-head">{csaf.VULNERABLE_TITLE}</div>')
+        second = html.index(f'<div class="aff-head">{csaf.NOT_VULNERABLE_TITLE}</div>')
+        self.assertLess(first, second)
+
+    def test_ciscos_words_are_rendered(self):
+        html, _ = rendered(scopes=worked_scopes())
+        self.assertIn("This vulnerability affects Cisco Secure FMC Software, regardless of "
+                      "device configuration.", html)
+        self.assertIn("Cloud-Delivered FMC (cdFMC)", html)
+
+    def test_navigational_sentence_is_absent_and_substantive_one_is_present(self):
+        html, _ = rendered(scopes=worked_scopes())
+        self.assertNotIn("see the Fixed Software section of this advisory", html)
+        self.assertIn("Only products listed in the Vulnerable Products section of this advisory",
+                      html)
+
+    def test_every_advisory_has_a_cell_including_ones_impacting_nothing(self):
+        clean = "cisco-sa-impacts-nothing"
+        bundle = a_bundle(advisory_ids=(FMC_ADV, clean))
+        html, rows = rendered(bundle=bundle, records={clean: advisory(clean)},
+                              scopes=worked_scopes((FMC_ADV, clean)))
+        self.assertEqual(html.count(f'<div class="aff-head">{csaf.VULNERABLE_TITLE}</div>'),
+                         len(rows))
+
+    def test_the_column_states_it_is_ciscos_statement_not_a_finding_about_your_fleet(self):
+        html, _ = rendered(scopes=worked_scopes())
+        self.assertIn("is Cisco's own published statement", html)
+        self.assertIn("not</em> a finding about your inventory", html)
+
+    def test_a_product_list_stays_one_item_per_line(self):
+        html, _ = rendered(scopes=worked_scopes())
+        for product in ("Cloud-Delivered FMC (cdFMC)",
+                        "Secure Firewall Threat Defense (FTD) Software"):
+            self.assertIn(f'<div class="aff-line">{product}</div>', html)
+
+    def test_sub_headings_are_marked_up_differently_from_body_text(self):
+        scopes = {FMC_ADV: scope_of(FMC_ADV, F.PRODUCT_HEADINGS_VULNERABLE,
+                                   F.PRODUCT_HEADINGS_NOT_VULNERABLE)}
+        html, _ = rendered(bundle=a_bundle(advisory_ids=(FMC_ADV,)), records={},
+                           scopes=scopes)
+        self.assertIn('<div class="aff-sub">Cisco IOS XE Software</div>', html)
+
+    def test_no_other_cisco_note_is_rendered(self):
+        """The document also carries Summary, Fixed Software and a legal disclaimer (FR-010)."""
+        html, _ = rendered(scopes=worked_scopes())
+        for note in F.WORKED_EXAMPLE_OTHER_NOTES:
+            self.assertNotIn(note["text"][:50], html)
+
+
+# --------------------------------------------------------------------------- #
+# Escaping (FR-018, SC-005)
+# --------------------------------------------------------------------------- #
+class Escaping(unittest.TestCase):
+    """The failure this guards against is text DISAPPEARING, not text looking wrong.
+
+    An unescaped `<interface_name>` is treated by a browser as an unknown tag: the placeholder and
+    everything up to the next `>` vanish, with nothing to show the report is incomplete. A test that
+    only checks the placeholder is present would pass while the report silently omitted Cisco's
+    scope, so each of these asserts on the text that FOLLOWS the placeholder.
+    """
+
+    def _html_with(self, text):
+        scopes = {FMC_ADV: scope_of(FMC_ADV, text, "Nothing else is affected.")}
+        html, _ = rendered(bundle=a_bundle(advisory_ids=(FMC_ADV,)), records={},
+                           scopes=scopes)
+        return html
+
+    def test_cli_placeholder_and_the_text_after_it_both_survive(self):
+        html = self._html_with(
+            "crypto ikev2 enable <interface_name> and then reload the device.")
+        self.assertIn("&lt;interface_name&gt;", html)
+        self.assertIn("and then reload the device.", html)
+        self.assertNotIn("<interface_name>", html)
+
+    def test_interface_path_written_with_angle_brackets_survives(self):
+        html = self._html_with(
+            "Enabled from Devices > VPN > Remote Access in the FMC console, as shown.")
+        self.assertIn("Devices &gt; VPN &gt; Remote Access", html)
+        self.assertIn("as shown.", html)
+
+    def test_ampersand_is_escaped(self):
+        html = self._html_with("Policy A & B applies to this release.")
+        self.assertIn("A &amp; B applies to this release.", html)
+
+    def test_recorded_statement_with_raw_angle_brackets_loses_no_trailing_text(self):
+        scopes = {FMC_ADV: scope_of(FMC_ADV, F.ANGLE_BRACKETS_VULNERABLE,
+                                    F.ANGLE_BRACKETS_NOT_VULNERABLE)}
+        html, _ = rendered(bundle=a_bundle(advisory_ids=(FMC_ADV,)), records={},
+                           scopes=scopes)
+        # The recorded statement ends well after its last `<…>` placeholder. If escaping were
+        # missing, a browser would eat the tail — so assert the tail is in the document.
+        tail = csaf.statement("t", F.ANGLE_BRACKETS_VULNERABLE).text().split("\n")[-1]
+        self.assertIn(br.esc(tail), html)
+        self.assertNotIn("<interface_name>", html)
+        self.assertNotIn("<IPv4_address>", html)
+
+    def test_statement_content_cannot_alter_structure_or_execute(self):
+        hostile = ('<script>alert(1)</script> and <img src=x onerror=alert(2)> '
+                   'and </td></tr><tr><td>injected')
+        html = self._html_with(hostile)
+        # Asserted inside the cell: the report legitimately emits its own <script> block for the
+        # filter and sort controls, so a document-wide check would fail on the report's own code
+        # while telling us nothing about the statement.
+        cell = html.split('<td class="c-aff">')[1].split("</td>")[0]
+        self.assertNotIn("<script", cell)
+        self.assertNotIn("<img", cell)
+        self.assertNotIn("</td>", cell)
+        self.assertNotIn("<tr>", cell)
+        self.assertIn("&lt;script&gt;alert(1)&lt;/script&gt;", cell)
+        self.assertIn("onerror=alert(2)&gt;", cell)
+        # Only one row exists, so an injected </tr><tr> would have created a second.
+        self.assertEqual(html.count("<tr data-severity="), 1)
+
+    def test_a_hostile_cause_cannot_reach_the_document_unescaped(self):
+        """Belt and braces: the cause set is closed, but the renderer escapes anyway."""
+        html, _ = rendered(scopes={FMC_ADV: csaf.unavailable_scope(FMC_ADV,
+                                                                  csaf.UNREACHABLE)})
+        self.assertIn("Cisco could not be reached to ask.", html)
+
+
+# --------------------------------------------------------------------------- #
+# Extract and disclosure (FR-031, FR-032, FR-048)
+# --------------------------------------------------------------------------- #
+class ExtractAndDisclosure(unittest.TestCase):
+
+    def _one(self, vulnerable):
+        scopes = {FMC_ADV: scope_of(FMC_ADV, vulnerable, "Nothing else is affected.")}
+        html, _ = rendered(bundle=a_bundle(advisory_ids=(FMC_ADV,)), records={},
+                           scopes=scopes)
+        return html
+
+    def test_the_ruled_out_product_list_is_visible_not_hidden(self):
+        """The not-vulnerable statement's substance is the list, and it follows a boilerplate
+        opener. An unconditional extract showed the boilerplate and hid the list (FR-031)."""
+        scopes = {FMC_ADV: scope_of(FMC_ADV, F.WORKED_EXAMPLE_VULNERABLE,
+                                    F.WORKED_EXAMPLE_NOT_VULNERABLE)}
+        html, _ = rendered(bundle=a_bundle(advisory_ids=(FMC_ADV,)), records={},
+                           scopes=scopes)
+        visible = html.split('<td class="c-aff">')[1].split('<details')[0]
+        for product in ("Cloud-Delivered FMC (cdFMC)",
+                        "Secure Firewall Adaptive Security Appliance (ASA) Software",
+                        "Secure Firewall Threat Defense (FTD) Software",
+                        "Security Cloud Control (SCC), formerly Defense Orchestrator"):
+            self.assertIn(product, visible)
+
+    def test_a_short_statement_carries_no_disclosure_at_all(self):
+        """So the control's presence always means text is hidden (FR-031)."""
+        html = self._one(F.WORKED_EXAMPLE_VULNERABLE)
+        # Asserted on the markup, not the class name: the class name also appears in the
+        # stylesheet, which sits above the table.
+        cell = html.split('<td class="c-aff">')[1].split("</td>")[0]
+        self.assertNotIn('<details class="aff-more">', cell)
+        self.assertNotIn("show full statement", cell)
+
+    def test_a_long_statement_shows_an_extract_and_a_disclosure(self):
+        html = self._one(F.PRODUCT_HEADINGS_VULNERABLE)
+        self.assertIn('<details class="aff-more">', html)
+        self.assertIn("show full statement", html)
+
+    def test_the_extract_leads_with_the_scope_claim_for_procedure_headings(self):
+        """The case that broke the original FR-031 rule — its scope claim sits above the first
+        sub-heading, and an extract built from heading bodies dropped it entirely."""
+        html = self._one(F.PROCEDURE_HEADINGS_VULNERABLE)
+        extract = html.split('<details class="aff-more">')[0]
+        self.assertIn("At the time of publication, this vulnerability affected Cisco products",
+                      extract)
+        self.assertNotIn("To determine if Snort 3 is running", extract)
+
+    def test_hidden_text_stays_in_the_document_for_search_and_print(self):
+        html = self._one(F.PRODUCT_HEADINGS_VULNERABLE)
+        hidden = html.split('<details class="aff-more">')[1]
+        self.assertIn("VBA macro decompression is not enabled by default.", hidden)
+        # And it is in the document as a whole, which is what browser search and print see.
+        self.assertIn("VBA macro decompression is not enabled by default.", html)
+
+    def test_no_content_is_lost_between_extract_and_remainder(self):
+        for text in (F.PRODUCT_HEADINGS_VULNERABLE, F.PROCEDURE_HEADINGS_VULNERABLE):
+            with self.subTest(text[:30]):
+                html = self._one(text)
+                for line in csaf.statement("t", text).text().split("\n"):
+                    if line.strip():
+                        self.assertIn(br.esc(line), html)
+
+    def test_the_expand_all_control_targets_these_disclosures(self):
+        html = self._one(F.PRODUCT_HEADINGS_VULNERABLE)
+        self.assertIn("querySelectorAll('details')", html)
+        self.assertIn('<details class="aff-more">', html)
+
+    def test_columns_have_fixed_widths_so_expanding_cannot_reflow_neighbours(self):
+        html = self._one(F.PRODUCT_HEADINGS_VULNERABLE)
+        self.assertIn("#advisories { table-layout: fixed; }", html)
+        for cls in (".c-adv", ".c-aff", ".c-prod"):
+            self.assertRegex(html, re.escape(cls) + r"\s*\{[^}]*width:")
+
+
+# --------------------------------------------------------------------------- #
+# Unavailability (FR-026 - FR-030, FR-044, FR-045, SC-002, SC-007, SC-012)
+# --------------------------------------------------------------------------- #
+class Unavailability(unittest.TestCase):
+
+    def test_every_cause_renders_a_distinct_sentence_in_words(self):
+        seen = set()
+        for cause in csaf.CAUSES:
+            with self.subTest(cause):
+                html, _ = rendered(scopes={a: csaf.unavailable_scope(a, cause)
+                                           for a in (FMC_ADV, ASA_ADV, BOTH_ADV)})
+                sentence = br.CAUSE_TEXT[cause]
+                self.assertIn(br.esc(sentence), html)
+                seen.add(sentence)
+        self.assertEqual(len(seen), len(csaf.CAUSES), "causes must be distinguishable")
+
+    def test_cause_text_is_total_over_the_closed_set(self):
+        """An unmapped cause would render an empty cell, which reads as an all-clear."""
+        self.assertEqual(set(br.CAUSE_TEXT), set(csaf.CAUSES))
+
+    def test_an_unavailable_cell_is_never_blank_and_never_says_none(self):
+        html, _ = rendered(scopes={a: csaf.unavailable_scope(a, csaf.UNREACHABLE)
+                                   for a in (FMC_ADV, ASA_ADV, BOTH_ADV)})
+        self.assertIn("could not be shown", html)
+        self.assertIn("<strong>unknown</strong>", html)
+        self.assertNotIn('<td class="c-aff"></td>', html)
+
+    def test_it_says_it_is_not_a_statement_that_none_are_affected(self):
+        html, _ = rendered(scopes={FMC_ADV: csaf.unavailable_scope(FMC_ADV,
+                                                                  csaf.NO_CONTENT)})
+        self.assertIn("not a statement that none are affected", html)
+
+    def test_omitting_scopes_entirely_renders_unavailable_not_blank(self):
+        html, rows = rendered(scopes=None)
+        self.assertEqual(html.count("could not be shown"), len(rows) * 2)
+
+    def test_one_statement_available_and_the_other_not(self):
+        scope = csaf.AdvisoryScope(
+            FMC_ADV,
+            csaf.statement(csaf.VULNERABLE_TITLE, F.WORKED_EXAMPLE_VULNERABLE),
+            csaf.ScopeStatement(csaf.NOT_VULNERABLE_TITLE, unavailable=csaf.NO_CONTENT))
+        html, _ = rendered(bundle=a_bundle(advisory_ids=(FMC_ADV,)), records={},
+                           scopes={FMC_ADV: scope})
+        self.assertIn("This vulnerability affects Cisco Secure FMC Software", html)
+        self.assertEqual(html.count("could not be shown"), 1)
+
+    def test_the_advisory_link_survives_on_an_unavailable_row(self):
+        html, _ = rendered(scopes={a: csaf.unavailable_scope(a, csaf.UNREACHABLE)
+                                   for a in (FMC_ADV, ASA_ADV, BOTH_ADV)})
+        self.assertIn(f'>{FMC_ADV}</a>', html)
+
+    def test_header_states_the_missing_count(self):
+        html, _ = rendered(scopes={FMC_ADV: csaf.unavailable_scope(FMC_ADV,
+                                                                  csaf.UNREACHABLE)})
+        self.assertIn("Scope statements missing", html)
+        self.assertRegex(html, r"Scope statements missing</dt><dd>3</dd>")
+
+    def test_header_states_zero_when_nothing_is_missing(self):
+        """A stated zero is evidence; an omitted zero is just an absence (FR-030)."""
+        html, _ = rendered(scopes=worked_scopes())
+        self.assertRegex(html, r"Scope statements missing</dt><dd>0</dd>")
+
+    def test_colour_is_not_the_only_carrier_of_meaning(self):
+        html, _ = rendered(scopes={FMC_ADV: csaf.unavailable_scope(FMC_ADV,
+                                                                  csaf.UNREACHABLE)})
+        self.assertIn("▲", html)
+        self.assertIn("could not be shown", html)
+
+
+# --------------------------------------------------------------------------- #
+# Provenance (FR-035)
+# --------------------------------------------------------------------------- #
+class Provenance(unittest.TestCase):
+
+    def test_the_document_revision_is_recorded(self):
+        html, _ = rendered(scopes=worked_scopes())
+        self.assertIn("Scope statement provenance", html)
+        self.assertIn("<td>1.0.0</td>", html)
+
+    def test_two_revisions_are_distinguishable(self):
+        one, _ = rendered(scopes={a: scope_of(a, F.WORKED_EXAMPLE_VULNERABLE,
+                                             F.WORKED_EXAMPLE_NOT_VULNERABLE, "1.0.0")
+                                  for a in (FMC_ADV, ASA_ADV, BOTH_ADV)})
+        two, _ = rendered(scopes={a: scope_of(a, F.WORKED_EXAMPLE_VULNERABLE,
+                                             F.WORKED_EXAMPLE_NOT_VULNERABLE, "2.1.0")
+                                  for a in (FMC_ADV, ASA_ADV, BOTH_ADV)})
+        self.assertIn("<td>1.0.0</td>", one)
+        self.assertIn("<td>2.1.0</td>", two)
+        self.assertNotIn("<td>2.1.0</td>", one)
+
+    def test_an_absent_revision_is_shown_as_not_stated_rather_than_invented(self):
+        html, _ = rendered(scopes={a: scope_of(a, F.WORKED_EXAMPLE_VULNERABLE,
+                                              F.WORKED_EXAMPLE_NOT_VULNERABLE, "")
+                                   for a in (FMC_ADV, ASA_ADV, BOTH_ADV)})
+        self.assertIn("not stated", html)
+
+    def test_unavailable_statements_are_named_in_the_provenance_table(self):
+        html, _ = rendered(scopes={a: csaf.unavailable_scope(a, csaf.UNREADABLE)
+                                   for a in (FMC_ADV, ASA_ADV, BOTH_ADV)})
+        self.assertIn("unavailable:", html)
+
+
+# --------------------------------------------------------------------------- #
+# Nothing else changed (FR-011, FR-036, SC-011)
+# --------------------------------------------------------------------------- #
+class ScopeChangesNothingElse(unittest.TestCase):
+
+    def test_row_order_is_identical_with_and_without_scopes(self):
+        devices = fleet()
+        without, rows_a = rendered(devices=devices, scopes=None)
+        with_scopes, rows_b = rendered(devices=devices, scopes=worked_scopes())
+        self.assertEqual([r.advisory_id for r in rows_a], [r.advisory_id for r in rows_b])
+        order = re.compile(r'data-order="(\d+)"')
+        self.assertEqual(order.findall(without), order.findall(with_scopes))
+
+    def test_impacted_counts_are_identical_with_and_without_scopes(self):
+        devices = fleet()
+        counts = re.compile(r'data-impacted="(\d+)"')
+        without, _ = rendered(devices=devices, scopes=None)
+        with_scopes, _ = rendered(devices=devices, scopes=worked_scopes())
+        self.assertEqual(counts.findall(without), counts.findall(with_scopes))
+
+    def test_every_row_still_accounts_for_its_population(self):
+        _, rows = rendered(scopes=worked_scopes())
+        for row in rows:
+            self.assertTrue(row.accounts())
+
+    def test_filter_and_sort_controls_are_unchanged_by_scopes(self):
+        devices = fleet()
+        without, _ = rendered(devices=devices, scopes=None)
+        with_scopes, _ = rendered(devices=devices, scopes=worked_scopes())
+        controls = re.compile(r'data-filter="(\w+)" aria-pressed="(\w+)">([^<]*)<')
+        self.assertEqual(controls.findall(without), controls.findall(with_scopes))
+        for button in ("sort-severity", "sort-impacted", "expand-all"):
+            self.assertIn(button, with_scopes)
+
+    def test_the_report_references_no_external_asset(self):
+        """Self-containment: it must render with no network at all (FR-036)."""
+        html, _ = rendered(scopes=worked_scopes())
+        for pattern in (r'<link[^>]+href=', r'<script[^>]+src=', r'<img[^>]+src=',
+                        r'url\(\s*https?:'):
+            self.assertIsNone(re.search(pattern, html), f"external reference: {pattern}")
+
+    def test_only_advisory_links_point_outward_and_they_are_safe(self):
+        html, _ = rendered(scopes=worked_scopes())
+        for href in re.findall(r'<a href="([^"]+)"', html):
+            self.assertTrue(href.startswith("https://sec.cloudapps.cisco.com"), href)
+        for anchor in re.findall(r'<a [^>]*>', html):
+            self.assertIn('rel="noreferrer noopener"', anchor)
+
+
 if __name__ == "__main__":  # pragma: no cover
     unittest.main()
diff --git a/tests/test_csaf.py b/tests/test_csaf.py
new file mode 100644
index 0000000..1399ee4
--- /dev/null
+++ b/tests/test_csaf.py
@@ -0,0 +1,735 @@
+"""Tests for `caia.csaf` — retrieval, classification, and the two permitted normalisations.
+
+Every test runs with no credentials and no network access, from documents recorded on 2026-07-28
+(`tests/fixtures/csaf_documents.py`). The constitution requires that: the tool offers no offline
+preview, so this suite is the only way to verify a change to what the report attributes to Cisco.
+
+Two obligations shape the normalisation tests. The constitution's Tests gate requires a test *per*
+normalisation plus a further test asserting **no other alteration occurs** — because "we tidied it
+slightly" is how a security advisory gets silently edited. FR-013 restates it.
+"""
+
+from __future__ import annotations
+
+import io
+import json
+import sys
+import unittest
+import urllib.error
+
+from caia import csaf
+from tests.fixtures import csaf_documents as F
+
+URL = "https://sec.cloudapps.cisco.com/security/center/contentjson/x/csaf/x.json"
+
+
+# --------------------------------------------------------------------------- #
+# Fake openers
+# --------------------------------------------------------------------------- #
+class _Response(io.BytesIO):
+    """A urlopen-like response that records how much of it was actually read."""
+
+    def __init__(self, body):
+        super().__init__(body)
+        self.status = 200
+        self.bytes_served = 0
+
+    def read(self, size=-1):
+        chunk = super().read(size) if size and size > 0 else super().read()
+        self.bytes_served += len(chunk)
+        return chunk
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        self.close()
+        return False
+
+
+def serving(body, record=None):
+    """An opener that serves `body`, appending each captured request to `record`."""
+    def opener(request, timeout=None):
+        if record is not None:
+            record.append(request)
+        response = _Response(body)
+        if record is not None:
+            record[-1].response = response
+        return response
+    return opener
+
+
+def failing(error, attempts=None):
+    def opener(request, timeout=None):
+        if attempts is not None:
+            attempts.append(request)
+        raise error
+    return opener
+
+
+def failing_then(error, body, attempts):
+    def opener(request, timeout=None):
+        attempts.append(request)
+        if len(attempts) == 1:
+            raise error
+        return _Response(body)
+    return opener
+
+
+# --------------------------------------------------------------------------- #
+# Normalisation 1 — link markup (FR-014)
+# --------------------------------------------------------------------------- #
+class LinkMarkupNormalisation(unittest.TestCase):
+
+    def test_removes_intra_advisory_anchor_and_keeps_link_text(self):
+        got = csaf.strip_link_markup(
+            'see the Fixed Software ["#fs"] section of this advisory.')
+        self.assertEqual(got, "see the Fixed Software section of this advisory.")
+
+    def test_removes_external_url_and_keeps_link_text(self):
+        got = csaf.strip_link_markup(
+            'see the Snort website ["https://www.snort.org/"].')
+        self.assertEqual(got, "see the Snort website.")
+
+    def test_leaves_text_without_markup_untouched(self):
+        plain = "This vulnerability affects Cisco Secure FMC Software."
+        self.assertEqual(csaf.strip_link_markup(plain), plain)
+
+    def test_every_recorded_statement_loses_all_bracket_markup(self):
+        for name, text in (("worked", F.WORKED_EXAMPLE_VULNERABLE),
+                           ("product", F.PRODUCT_HEADINGS_VULNERABLE),
+                           ("procedure", F.PROCEDURE_HEADINGS_VULNERABLE),
+                           ("angle", F.ANGLE_BRACKETS_VULNERABLE)):
+            with self.subTest(name):
+                self.assertIn('["', text, "fixture should carry markup to remove")
+                self.assertNotIn('["', csaf.strip_link_markup(text))
+
+
+# --------------------------------------------------------------------------- #
+# Normalisation 2 — navigational sentences (FR-015)
+# --------------------------------------------------------------------------- #
+class NavigationalNormalisation(unittest.TestCase):
+    """The half of this rule that is easy to get wrong is the half that KEEPS text.
+
+    31 sentences in the reference bundle are pure directions and must go. 25 more name a section
+    while making a substantive claim about which products are affected, and must stay. A pattern
+    that keys on "mentions a section" would delete all 56.
+    """
+
+    def test_drops_the_fixed_software_direction(self):
+        got = csaf.drop_navigational(
+            'For information about which Cisco software releases are vulnerable, see the Fixed '
+            'Software ["#fs"] section of this advisory.')
+        self.assertEqual(got, "")
+
+    def test_drops_the_for_more_information_variant(self):
+        got = csaf.drop_navigational(
+            'For more information, see the Fixed Software ["#fs"] section of this advisory.')
+        self.assertEqual(got, "")
+
+    def test_keeps_the_substantive_only_products_listed_sentence(self):
+        sentence = ('Only products listed in the Vulnerable Products ["#vp"] section of this '
+                    'advisory are known to be affected by this vulnerability.')
+        self.assertEqual(csaf.drop_navigational(sentence), sentence)
+
+    def test_keeps_a_substantive_sentence_and_drops_a_direction_beside_it(self):
+        got = csaf.drop_navigational(
+            'This vulnerability affects Cisco Secure FMC Software. For information about which '
+            'Cisco software releases are vulnerable, see the Fixed Software ["#fs"] section of '
+            'this advisory.')
+        self.assertEqual(got, "This vulnerability affects Cisco Secure FMC Software.")
+
+    def test_keeps_a_sentence_naming_a_section_without_an_anchor(self):
+        # No `["#…"]` anchor, so it is prose about a section rather than a link to one.
+        sentence = "See the Details section in the bug IDs at the top of this advisory."
+        self.assertEqual(csaf.drop_navigational(sentence), sentence)
+
+    def test_every_recorded_statement_keeps_its_only_products_listed_claim(self):
+        for name, text in (("worked", F.WORKED_EXAMPLE_NOT_VULNERABLE),
+                           ("product", F.PRODUCT_HEADINGS_NOT_VULNERABLE),
+                           ("procedure", F.PROCEDURE_HEADINGS_NOT_VULNERABLE),
+                           ("angle", F.ANGLE_BRACKETS_NOT_VULNERABLE)):
+            with self.subTest(name):
+                rendered = csaf.statement(csaf.NOT_VULNERABLE_TITLE, text).text()
+                self.assertIn("Only products listed in the Vulnerable Products section",
+                              rendered)
+
+
+# --------------------------------------------------------------------------- #
+# No other alteration (FR-013, constitution Tests gate)
+# --------------------------------------------------------------------------- #
+class NoOtherAlteration(unittest.TestCase):
+    """Reconstruct each statement by applying ONLY the two documented normalisations, and assert the
+    module's output is identical. Any third transformation — case, punctuation, whitespace
+    collapsing, reordering, truncation — shows up here as a mismatch."""
+
+    def _reference(self, text):
+        lines = []
+        for line in text.split("\r\n"):
+            body = csaf.strip_link_markup(csaf.drop_navigational(line)).strip()
+            lines.append(body)
+        out, previous_blank = [], False
+        for body in lines:
+            if not body:
+                if out and not previous_blank:
+                    out.append("")
+                previous_blank = True
+            else:
+                out.append(body)
+                previous_blank = False
+        while out and not out[-1]:
+            out.pop()
+        return "\n".join(out)
+
+    def test_output_is_exactly_the_two_normalisations_and_nothing_more(self):
+        for name, text in (("worked-vp", F.WORKED_EXAMPLE_VULNERABLE),
+                           ("worked-nv", F.WORKED_EXAMPLE_NOT_VULNERABLE),
+                           ("product-vp", F.PRODUCT_HEADINGS_VULNERABLE),
+                           ("product-nv", F.PRODUCT_HEADINGS_NOT_VULNERABLE),
+                           ("procedure-vp", F.PROCEDURE_HEADINGS_VULNERABLE),
+                           ("procedure-nv", F.PROCEDURE_HEADINGS_NOT_VULNERABLE),
+                           ("angle-vp", F.ANGLE_BRACKETS_VULNERABLE),
+                           ("angle-nv", F.ANGLE_BRACKETS_NOT_VULNERABLE)):
+            with self.subTest(name):
+                self.assertEqual(csaf.statement("t", text).text(), self._reference(text))
+
+    def test_no_word_present_in_cisco_text_is_invented_or_lost(self):
+        """Every word surviving the two normalisations appears in the output, and no word appears
+        that Cisco did not publish."""
+        for name, text in (("product-vp", F.PRODUCT_HEADINGS_VULNERABLE),
+                           ("procedure-vp", F.PROCEDURE_HEADINGS_VULNERABLE)):
+            with self.subTest(name):
+                rendered = set(csaf.statement("t", text).text().split())
+                allowed = set(self._reference(text).split())
+                self.assertEqual(rendered - allowed, set(), "invented words")
+                self.assertEqual(allowed - rendered, set(), "lost words")
+
+
+# --------------------------------------------------------------------------- #
+# The worked example, character for character (SC-003)
+# --------------------------------------------------------------------------- #
+EXPECTED_WORKED_EXAMPLE = """Vulnerable Products:
+This vulnerability affects Cisco Secure FMC Software, regardless of device configuration.
+
+Products Confirmed Not Vulnerable:
+Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.
+
+Cisco has confirmed that this vulnerability does not affect the following Cisco products:
+
+Cloud-Delivered FMC (cdFMC)
+Secure Firewall Adaptive Security Appliance (ASA) Software
+Secure Firewall Threat Defense (FTD) Software
+Security Cloud Control (SCC), formerly Defense Orchestrator"""
+
+
+class WorkedExample(unittest.TestCase):
+
+    def test_renders_exactly_the_expected_text(self):
+        scope = csaf.retrieve(
+            F.WORKED_EXAMPLE_ID, URL,
+            opener=serving(F.as_body(F.worked_example())), sleep=lambda _s: None)
+        got = (f"{scope.vulnerable.title}:\n{scope.vulnerable.text()}\n\n"
+               f"{scope.not_vulnerable.title}:\n{scope.not_vulnerable.text()}")
+        self.assertEqual(got, EXPECTED_WORKED_EXAMPLE)
+
+
+# --------------------------------------------------------------------------- #
+# Structure (FR-017)
+# --------------------------------------------------------------------------- #
+class StructurePreserved(unittest.TestCase):
+
+    def test_indented_line_becomes_a_heading(self):
+        blocks = csaf.parse_blocks("Lead paragraph.\r\n  Cisco IOS XE Software\r\nBody.")
+        self.assertEqual([b.kind for b in blocks],
+                         [csaf.Block.TEXT, csaf.Block.HEADING, csaf.Block.TEXT])
+        self.assertEqual(blocks[1].text, "Cisco IOS XE Software")
+
+    def test_blank_line_becomes_one_break_however_many_there_are(self):
+        blocks = csaf.parse_blocks("First.\r\n\r\n\r\n\r\nSecond.")
+        self.assertEqual([b.kind for b in blocks],
+                         [csaf.Block.TEXT, csaf.Block.BREAK, csaf.Block.TEXT])
+
+    def test_one_item_per_line_list_is_not_run_together(self):
+        """Each named product occupies its own line, and they stay consecutive.
+
+        Asserting on the *joined* text would be vacuous — joining with a space recreates the
+        concatenation the test claims to reject. The line positions are the real evidence.
+        """
+        statement = csaf.statement(csaf.NOT_VULNERABLE_TITLE,
+                                   F.WORKED_EXAMPLE_NOT_VULNERABLE)
+        lines = statement.text().split("\n")
+        products = ["Cloud-Delivered FMC (cdFMC)",
+                    "Secure Firewall Adaptive Security Appliance (ASA) Software",
+                    "Secure Firewall Threat Defense (FTD) Software",
+                    "Security Cloud Control (SCC), formerly Defense Orchestrator"]
+        for product in products:
+            self.assertIn(product, lines, f"{product!r} is not on a line of its own")
+        positions = [lines.index(p) for p in products]
+        self.assertEqual(positions, list(range(positions[0], positions[0] + 4)),
+                         "the four products must occupy four consecutive lines")
+
+    def test_leading_and_trailing_breaks_are_dropped(self):
+        blocks = csaf.parse_blocks("\r\n\r\nOnly line.\r\n\r\n")
+        self.assertEqual([b.kind for b in blocks], [csaf.Block.TEXT])
+
+    def test_recorded_multi_section_statement_keeps_its_headings(self):
+        blocks = csaf.statement("t", F.PRODUCT_HEADINGS_VULNERABLE).blocks
+        headings = [b.text for b in blocks if b.kind == csaf.Block.HEADING]
+        self.assertGreaterEqual(len(headings), 3)
+        self.assertIn("Cisco IOS XE Software", headings)
+
+
+# --------------------------------------------------------------------------- #
+# FR-016 — normalisation cannot empty a non-empty statement
+# --------------------------------------------------------------------------- #
+class NeverEmptied(unittest.TestCase):
+
+    def test_statement_of_only_navigational_sentences_falls_back_to_the_original(self):
+        only_directions = ('For information about which Cisco software releases are vulnerable, '
+                           'see the Fixed Software ["#fs"] section of this advisory.')
+        result = csaf.statement(csaf.VULNERABLE_TITLE, only_directions)
+        self.assertTrue(result.available)
+        self.assertIn("Fixed Software", result.text())
+
+    def test_genuinely_empty_text_is_no_content_not_an_empty_statement(self):
+        for value in ("", "   ", "\r\n\r\n", None):
+            with self.subTest(repr(value)):
+                result = csaf.statement(csaf.VULNERABLE_TITLE, value)
+                self.assertFalse(result.available)
+                self.assertEqual(result.unavailable, csaf.NO_CONTENT)
+
+    def test_no_recorded_statement_is_emptied(self):
+        for text in (F.WORKED_EXAMPLE_VULNERABLE, F.WORKED_EXAMPLE_NOT_VULNERABLE,
+                     F.PRODUCT_HEADINGS_VULNERABLE, F.PRODUCT_HEADINGS_NOT_VULNERABLE,
+                     F.PROCEDURE_HEADINGS_VULNERABLE, F.PROCEDURE_HEADINGS_NOT_VULNERABLE,
+                     F.ANGLE_BRACKETS_VULNERABLE, F.ANGLE_BRACKETS_NOT_VULNERABLE):
+            self.assertTrue(csaf.statement("t", text).text().strip())
+
+
+# --------------------------------------------------------------------------- #
+# Extract selection (FR-031, FR-048)
+# --------------------------------------------------------------------------- #
+class ExtractSelection(unittest.TestCase):
+
+    def test_a_short_statement_is_returned_whole_with_no_remainder(self):
+        blocks = csaf.statement("t", F.WORKED_EXAMPLE_VULNERABLE).blocks
+        extract, remainder = csaf.split_extract(blocks)
+        self.assertEqual(len(extract), len(blocks))
+        self.assertEqual(remainder, ())
+
+    def test_no_recorded_not_vulnerable_statement_is_ever_collapsed(self):
+        """Its substance is the list of products Cisco rules out, and that list follows a
+        boilerplate opener present in 25 of 25 advisories. Collapsing it would show the boilerplate
+        and hide the list."""
+        for name, text in (("worked", F.WORKED_EXAMPLE_NOT_VULNERABLE),
+                           ("product", F.PRODUCT_HEADINGS_NOT_VULNERABLE),
+                           ("procedure", F.PROCEDURE_HEADINGS_NOT_VULNERABLE),
+                           ("angle", F.ANGLE_BRACKETS_NOT_VULNERABLE)):
+            with self.subTest(name):
+                blocks = csaf.statement(csaf.NOT_VULNERABLE_TITLE, text).blocks
+                _, remainder = csaf.split_extract(blocks)
+                self.assertEqual(remainder, (), "a not-vulnerable statement was collapsed")
+
+    def test_the_worked_examples_ruled_out_products_are_all_visible(self):
+        blocks = csaf.statement(csaf.NOT_VULNERABLE_TITLE,
+                                F.WORKED_EXAMPLE_NOT_VULNERABLE).blocks
+        extract, _ = csaf.split_extract(blocks)
+        visible = " ".join(b.text for b in extract)
+        for product in ("Cloud-Delivered FMC (cdFMC)",
+                        "Secure Firewall Adaptive Security Appliance (ASA) Software",
+                        "Secure Firewall Threat Defense (FTD) Software",
+                        "Security Cloud Control (SCC), formerly Defense Orchestrator"):
+            self.assertIn(product, visible)
+
+    def test_the_threshold_is_a_stated_number(self):
+        self.assertIsInstance(csaf.COLLAPSE_ABOVE_CHARS, int)
+        self.assertGreater(csaf.COLLAPSE_ABOVE_CHARS, 818,
+                           "must exceed the longest recorded not-vulnerable statement")
+        self.assertLess(csaf.COLLAPSE_ABOVE_CHARS, 3594,
+                        "must collapse the long multi-section scope statements")
+
+    def test_extract_carries_headings_but_never_their_bodies(self):
+        blocks = csaf.statement("t", F.PRODUCT_HEADINGS_VULNERABLE).blocks
+        extract, remainder = csaf.split_extract(blocks)
+        all_headings = {b.text for b in blocks if b.kind == csaf.Block.HEADING}
+        self.assertEqual({b.text for b in extract if b.kind == csaf.Block.HEADING},
+                         all_headings)
+        self.assertTrue(remainder, "a multi-section statement must have hidden text")
+        self.assertFalse(any(b.kind == csaf.Block.HEADING for b in remainder))
+
+    def test_procedure_headings_advisory_keeps_its_scope_claim(self):
+        """The case that broke the original FR-031 rule.
+
+        Its sub-headings are diagnostic procedures and its scope claim sits above the first one. An
+        extract built from "every heading plus its opening paragraph" dropped the claim and showed
+        five "Determine whether…" steps instead.
+        """
+        blocks = csaf.statement("t", F.PROCEDURE_HEADINGS_VULNERABLE).blocks
+        extract, _ = csaf.split_extract(blocks)
+        text = "\n".join(b.text for b in extract)
+        self.assertIn("At the time of publication, this vulnerability affected Cisco products",
+                      text)
+        self.assertNotIn("To determine if Snort 3 is running", text)
+
+    def test_extract_and_remainder_together_lose_no_content_block(self):
+        for text in (F.PRODUCT_HEADINGS_VULNERABLE, F.PROCEDURE_HEADINGS_VULNERABLE,
+                     F.ANGLE_BRACKETS_VULNERABLE, F.WORKED_EXAMPLE_NOT_VULNERABLE):
+            with self.subTest(text[:30]):
+                blocks = csaf.statement("t", text).blocks
+                extract, remainder = csaf.split_extract(blocks)
+                content = [b for b in blocks if b.kind != csaf.Block.BREAK]
+                split = ([b for b in extract if b.kind != csaf.Block.BREAK]
+                         + [b for b in remainder if b.kind != csaf.Block.BREAK])
+                self.assertEqual(len(split), len(content))
+                self.assertEqual({b.text for b in split}, {b.text for b in content})
+
+
+# --------------------------------------------------------------------------- #
+# Incremental document-only read (FR-040)
+# --------------------------------------------------------------------------- #
+class IncrementalRead(unittest.TestCase):
+
+    def test_stops_reading_once_document_is_complete(self):
+        body = F.as_body(F.worked_example())          # `document` first, then bulk
+        record = []
+        csaf.fetch_document(URL, opener=serving(body, record), chunk_bytes=4096)
+        served = record[0].response.bytes_served
+        self.assertLess(served, len(body) // 2,
+                        f"read {served} of {len(body)} bytes — the early stop did not happen")
+
+    def test_tiny_chunks_still_yield_the_whole_document(self):
+        document = csaf.fetch_document(
+            URL, opener=serving(F.as_body(F.product_headings())), chunk_bytes=97)
+        titles = [n["title"] for n in document["notes"]]
+        self.assertIn(csaf.VULNERABLE_TITLE, titles)
+        self.assertIn(csaf.NOT_VULNERABLE_TITLE, titles)
+
+    def test_multibyte_character_split_across_a_chunk_boundary_survives(self):
+        """Decoding a partial buffer with errors="ignore" would drop the character silently.
+
+        The chunk size is chosen so the boundary lands inside the em dash's UTF-8 bytes.
+        """
+        marker = "Cisco Secure Firewall — ASA Software"
+        document = F.document("cisco-sa-x", marker, "Not vulnerable.")
+        body = F.as_body(document, trailing=False)
+        cut = body.index("—".encode("utf-8")) + 1
+        got = csaf.fetch_document(URL, opener=serving(body), chunk_bytes=cut)
+        text = got["notes"][0]["text"] if got["notes"][0]["title"] == csaf.VULNERABLE_TITLE \
+            else got["notes"][1]["text"]
+        self.assertEqual(text, marker)
+        self.assertNotIn("�", text)
+
+    def test_falls_back_to_the_whole_body_when_document_is_not_first(self):
+        body = json.dumps({"product_tree": {"x": 1},
+                           "document": F.worked_example()}).encode("utf-8")
+        document = csaf.fetch_document(URL, opener=serving(body), chunk_bytes=64,
+                                       buffer_cap=128)
+        self.assertEqual(document["tracking"]["id"], F.WORKED_EXAMPLE_ID)
+
+
+# --------------------------------------------------------------------------- #
+# Classification into the closed cause set (FR-027, FR-044, FR-045)
+# --------------------------------------------------------------------------- #
+class Classification(unittest.TestCase):
+
+    def _cause(self, opener, advisory_id=F.WORKED_EXAMPLE_ID):
+        scope = csaf.retrieve(advisory_id, URL, opener=opener, sleep=lambda _s: None)
+        self.assertEqual(scope.vulnerable.unavailable, scope.not_vulnerable.unavailable)
+        return scope.vulnerable.unavailable
+
+    def test_empty_body_is_no_content_not_a_statement_with_no_content(self):
+        """Cisco serves a document that does not exist as HTTP 200 with zero bytes. Classifying on
+        the status code would read that as success."""
+        self.assertEqual(self._cause(serving(F.EMPTY_BODY)), csaf.NO_CONTENT)
+
+    def test_truncated_json_is_unreadable(self):
+        self.assertEqual(self._cause(serving(F.UNPARSEABLE_BODY)), csaf.UNREADABLE)
+
+    def test_html_error_page_is_unreadable(self):
+        self.assertEqual(self._cause(serving(F.NOT_JSON_BODY)), csaf.UNREADABLE)
+
+    def test_payload_without_a_document_section_is_unreadable(self):
+        self.assertEqual(self._cause(serving(F.NO_DOCUMENT_BODY)), csaf.UNREADABLE)
+
+    def test_transport_failure_is_unreachable(self):
+        self.assertEqual(self._cause(failing(urllib.error.URLError("no route"))),
+                         csaf.UNREACHABLE)
+
+    def test_http_error_is_unreachable_not_unreadable(self):
+        error = urllib.error.HTTPError(URL, 503, "busy", None, None)
+        self.assertEqual(self._cause(failing(error)), csaf.UNREACHABLE)
+
+    def test_document_for_another_advisory_is_identity_mismatch(self):
+        body = F.mismatched_body(F.WORKED_EXAMPLE_ID, "cisco-sa-someone-else-AAAA")
+        self.assertEqual(self._cause(serving(body)), csaf.IDENTITY_MISMATCH)
+
+    def test_missing_url_is_no_content(self):
+        scope = csaf.retrieve(F.WORKED_EXAMPLE_ID, "", sleep=lambda _s: None)
+        self.assertEqual(scope.vulnerable.unavailable, csaf.NO_CONTENT)
+
+    def test_every_cause_is_in_the_closed_set(self):
+        self.assertEqual(len(csaf.CAUSES), 5)
+        for cause in (csaf.UNREACHABLE, csaf.NO_CONTENT, csaf.UNREADABLE,
+                      csaf.IDENTITY_MISMATCH, csaf.NOT_REACHED):
+            self.assertIn(cause, csaf.CAUSES)
+
+    def test_a_statement_cannot_carry_an_invented_cause(self):
+        with self.assertRaises(ValueError):
+            csaf.ScopeStatement("t", unavailable="probably-fine")
+
+    def test_a_statement_is_never_both_present_and_unavailable_nor_neither(self):
+        with self.assertRaises(ValueError):
+            csaf.ScopeStatement("t")
+        with self.assertRaises(ValueError):
+            csaf.ScopeStatement("t", blocks=(csaf.Block(csaf.Block.TEXT, "x"),),
+                                unavailable=csaf.NO_CONTENT)
+
+
+class IdentityCheck(unittest.TestCase):
+
+    def test_no_text_from_a_mismatched_document_reaches_the_result(self):
+        body = F.mismatched_body(F.WORKED_EXAMPLE_ID, "cisco-sa-someone-else-AAAA")
+        scope = csaf.retrieve(F.WORKED_EXAMPLE_ID, URL, opener=serving(body),
+                              sleep=lambda _s: None)
+        self.assertEqual(scope.vulnerable.blocks, ())
+        self.assertEqual(scope.not_vulnerable.blocks, ())
+        self.assertNotIn("Secure FMC Software", repr(scope))
+
+    def test_a_document_that_states_no_identity_is_accepted(self):
+        document = F.worked_example()
+        document["tracking"].pop("id")
+        scope = csaf.retrieve(F.WORKED_EXAMPLE_ID, URL,
+                              opener=serving(F.as_body(document, trailing=False)),
+                              sleep=lambda _s: None)
+        self.assertTrue(scope.vulnerable.available)
+
+
+class StatementSelection(unittest.TestCase):
+
+    def test_only_the_two_permitted_notes_are_read(self):
+        document = F.worked_example()
+        titles = [n["title"] for n in document["notes"]]
+        self.assertIn("Summary", titles, "fixture must carry notes we must ignore")
+        self.assertIn("Fixed Software", titles)
+        vulnerable, not_vulnerable, _ = csaf.statements(document, F.WORKED_EXAMPLE_ID)
+        rendered = vulnerable.text() + not_vulnerable.text()
+        for note in document["notes"]:
+            if note["title"] not in (csaf.VULNERABLE_TITLE, csaf.NOT_VULNERABLE_TITLE):
+                self.assertNotIn(note["text"][:60], rendered)
+
+    def test_a_document_missing_one_statement_marks_only_that_one(self):
+        document = F.document(F.WORKED_EXAMPLE_ID, F.WORKED_EXAMPLE_VULNERABLE, None)
+        vulnerable, not_vulnerable, _ = csaf.statements(document, F.WORKED_EXAMPLE_ID)
+        self.assertTrue(vulnerable.available)
+        self.assertEqual(not_vulnerable.unavailable, csaf.NO_CONTENT)
+
+    def test_revision_is_captured(self):
+        vulnerable, _, revision = csaf.statements(F.worked_example(), F.WORKED_EXAMPLE_ID)
+        self.assertEqual(revision, F.WORKED_EXAMPLE_REVISION)
+        self.assertTrue(vulnerable.available)
+
+    def test_absent_revision_is_empty_not_invented(self):
+        document = F.worked_example()
+        document["tracking"].pop("version")
+        _, _, revision = csaf.statements(document, F.WORKED_EXAMPLE_ID)
+        self.assertEqual(revision, "")
+
+    def test_the_document_title_is_never_used(self):
+        document = F.worked_example()
+        vulnerable, not_vulnerable, _ = csaf.statements(document, F.WORKED_EXAMPLE_ID)
+        self.assertNotIn("must NOT take from here",
+                         vulnerable.text() + not_vulnerable.text())
+
+
+# --------------------------------------------------------------------------- #
+# Retry (FR-043)
+# --------------------------------------------------------------------------- #
+class Retry(unittest.TestCase):
+
+    def test_transport_failure_is_retried_once_and_can_succeed(self):
+        attempts = []
+        opener = failing_then(urllib.error.URLError("flaky proxy"),
+                              F.as_body(F.worked_example(), trailing=False), attempts)
+        scope = csaf.retrieve(F.WORKED_EXAMPLE_ID, URL, opener=opener, sleep=lambda _s: None)
+        self.assertEqual(len(attempts), 2)
+        self.assertTrue(scope.vulnerable.available)
+
+    def test_transport_failure_twice_gives_up_at_two_attempts(self):
+        attempts = []
+        csaf.retrieve(F.WORKED_EXAMPLE_ID, URL,
+                      opener=failing(urllib.error.URLError("down"), attempts),
+                      sleep=lambda _s: None)
+        self.assertEqual(len(attempts), 2)
+
+    def test_deterministic_failures_are_never_retried(self):
+        """An empty body, unreadable content, and an identity mismatch fail identically on a second
+        attempt, so retrying only spends time."""
+        cases = {
+            "empty": F.EMPTY_BODY,
+            "unparseable": F.UNPARSEABLE_BODY,
+            "no-document": F.NO_DOCUMENT_BODY,
+            "mismatch": F.mismatched_body(F.WORKED_EXAMPLE_ID, "cisco-sa-other-BBBB"),
+        }
+        for name, body in cases.items():
+            with self.subTest(name):
+                record = []
+                csaf.retrieve(F.WORKED_EXAMPLE_ID, URL, opener=serving(body, record),
+                              sleep=lambda _s: None)
+                self.assertEqual(len(record), 1)
+
+    def test_attempts_never_exceed_two_for_any_failure(self):
+        for name, opener_factory in (
+                ("transport", lambda rec: failing(urllib.error.URLError("x"), rec)),
+                ("empty", lambda rec: serving(F.EMPTY_BODY, rec)),
+                ("unreadable", lambda rec: serving(F.NOT_JSON_BODY, rec))):
+            with self.subTest(name):
+                record = []
+                csaf.retrieve(F.WORKED_EXAMPLE_ID, URL, opener=opener_factory(record),
+                              sleep=lambda _s: None)
+                self.assertLessEqual(len(record), 2)
+
+
+# --------------------------------------------------------------------------- #
+# Pacing (FR-046)
+# --------------------------------------------------------------------------- #
+class Pacing(unittest.TestCase):
+
+    def test_requests_are_sequential_and_separated_by_a_delay(self):
+        slept = []
+        targets = {f"cisco-sa-{n}": URL for n in range(4)}
+        csaf.retrieve_many(targets, opener=serving(F.EMPTY_BODY), sleep=slept.append)
+        self.assertEqual(len(slept), 3, "one delay between each pair, none before the first")
+        self.assertTrue(all(s == csaf.COURTESY_DELAY for s in slept))
+
+    def test_single_target_waits_for_nothing(self):
+        slept = []
+        csaf.retrieve_many({"cisco-sa-1": URL}, opener=serving(F.EMPTY_BODY),
+                           sleep=slept.append)
+        self.assertEqual(slept, [])
+
+    def test_the_delay_sits_inside_the_band_the_spec_requires(self):
+        self.assertGreaterEqual(csaf.COURTESY_DELAY, 0.150)
+        self.assertLessEqual(csaf.COURTESY_DELAY, 0.250)
+
+    def test_the_delay_is_resolved_at_call_time_not_bound_as_a_default(self):
+        """A default argument would capture COURTESY_DELAY at import, so adjusting the constant
+        would silently do nothing — which is how a test suite ends up sleeping for real."""
+        import unittest.mock as _mock
+        distinctive = 0.037
+        slept = []
+        with _mock.patch.object(csaf, "COURTESY_DELAY", distinctive):
+            csaf.retrieve_many({"a": URL, "b": URL, "c": URL},
+                               opener=serving(F.EMPTY_BODY), sleep=slept.append)
+        self.assertEqual(slept, [distinctive, distinctive],
+                         "the adjusted constant was ignored — it is bound as a default")
+
+    def test_a_zero_delay_skips_the_wait_entirely(self):
+        slept = []
+        csaf.retrieve_many({"a": URL, "b": URL}, opener=serving(F.EMPTY_BODY),
+                           sleep=slept.append, delay=0)
+        self.assertEqual(slept, [])
+
+    def test_the_delay_is_not_the_advisory_api_interval(self):
+        """2.1 s satisfies a published per-minute quota this host does not have; using it would put
+        25 retrievals past 50 s and breach FR-039."""
+        from caia import psirt
+        self.assertLess(csaf.COURTESY_DELAY, psirt.MIN_INTERVAL / 4)
+
+
+# --------------------------------------------------------------------------- #
+# retrieve_many, progress, and the headless property (FR-038, FR-047)
+# --------------------------------------------------------------------------- #
+class RetrieveMany(unittest.TestCase):
+
+    def test_every_target_gets_exactly_one_entry(self):
+        targets = {f"cisco-sa-{n}": URL for n in range(5)}
+        scopes = csaf.retrieve_many(targets, opener=serving(F.EMPTY_BODY),
+                                    sleep=lambda _s: None)
+        self.assertEqual(set(scopes), set(targets))
+
+    def test_progress_is_reported_through_the_callback(self):
+        seen = []
+        targets = {"cisco-sa-a": URL, "cisco-sa-b": URL}
+        csaf.retrieve_many(targets, on_progress=lambda i, t, a: seen.append((i, t, a)),
+                           opener=serving(F.EMPTY_BODY), sleep=lambda _s: None)
+        self.assertEqual(seen, [(1, 2, "cisco-sa-a"), (2, 2, "cisco-sa-b")])
+
+    def test_prints_nothing_and_does_not_exit(self):
+        out, err = io.StringIO(), io.StringIO()
+        saved = sys.stdout, sys.stderr
+        sys.stdout, sys.stderr = out, err
+        try:
+            csaf.retrieve_many({"cisco-sa-a": URL, "cisco-sa-b": ""},
+                               opener=serving(F.NOT_JSON_BODY), sleep=lambda _s: None)
+        finally:
+            sys.stdout, sys.stderr = saved
+        self.assertEqual(out.getvalue(), "")
+        self.assertEqual(err.getvalue(), "")
+
+    def test_writes_no_file_and_creates_no_temporary_folder(self):
+        import tempfile
+        from pathlib import Path
+        before_cwd = set(Path.cwd().iterdir())
+        before_tmp = set(Path(tempfile.gettempdir()).iterdir())
+        csaf.retrieve_many({"cisco-sa-a": URL},
+                           opener=serving(F.as_body(F.product_headings())),
+                           sleep=lambda _s: None)
+        self.assertEqual(set(Path.cwd().iterdir()), before_cwd)
+        self.assertEqual(set(Path(tempfile.gettempdir()).iterdir()) - before_tmp, set())
+
+    def test_missing_count_treats_an_absent_advisory_as_missing(self):
+        scopes = {"a": csaf.unavailable_scope("a", csaf.UNREACHABLE)}
+        self.assertEqual(csaf.missing_count(scopes, ["a", "b"]), 2)
+
+    def test_missing_count_is_zero_when_everything_is_available(self):
+        body = F.as_body(F.worked_example(), trailing=False)
+        scopes = csaf.retrieve_many({F.WORKED_EXAMPLE_ID: URL}, opener=serving(body),
+                                    sleep=lambda _s: None)
+        self.assertEqual(csaf.missing_count(scopes, [F.WORKED_EXAMPLE_ID]), 0)
+
+
+# --------------------------------------------------------------------------- #
+# Data locality (FR-022, FR-023, SC-010)
+# --------------------------------------------------------------------------- #
+class DataLocality(unittest.TestCase):
+    """The request must carry no credential and nothing inventory-derived. Asserted against the
+    whole captured request — URL, headers and body — so a header added later cannot slip past."""
+
+    def _request(self):
+        record = []
+        csaf.retrieve_many({F.WORKED_EXAMPLE_ID: URL},
+                           opener=serving(F.as_body(F.worked_example()), record),
+                           sleep=lambda _s: None)
+        self.assertEqual(len(record), 1)
+        return record[0]
+
+    def test_no_authorization_header_is_sent(self):
+        request = self._request()
+        keys = {k.lower() for k in request.headers}
+        self.assertNotIn("authorization", keys)
+        self.assertNotIn("cookie", keys)
+        self.assertNotIn("proxy-authorization", keys)
+
+    def test_nothing_credential_shaped_appears_anywhere_in_the_request(self):
+        request = self._request()
+        blob = " ".join([request.full_url, json.dumps(dict(request.headers)),
+                         (request.data or b"").decode("utf-8", "replace")]).lower()
+        for token in ("bearer", "client_id", "client_secret", "token", "password", "apikey"):
+            self.assertNotIn(token, blob)
+
+    def test_no_inventory_derived_value_is_sent(self):
+        """Not a device name, and not even the family/platform/release triple the advisory API is
+        permitted — the only value leaving the machine is the advisory identifier in the URL."""
+        request = self._request()
+        blob = " ".join([request.full_url, json.dumps(dict(request.headers)),
+                         (request.data or b"").decode("utf-8", "replace")]).lower()
+        for token in ("fw-", "fwloc", "asa", "ftd", "fmc", "firepower",
+                      "7.4.2.3", "9.16", "isa3000", "platformalias", "ostype"):
+            self.assertNotIn(token, blob, f"{token!r} must not leave the machine")
+
+    def test_the_request_body_is_empty(self):
+        self.assertIn(self._request().data, (None, b""))
+
+
+if __name__ == "__main__":  # pragma: no cover
+    unittest.main()