# Sunshine-Performance-Reporting — operating card draft

Review stage: machine-drafted; owner review pending. Static references are not verified operation.
Source: webhostingdoo/Sunshine-Performance-Reporting at 07de262bfcbfe8a448a5ac23ca809734278ab15e.
Scan result: scanned; inspected 144/144 eligible files.
Source freshness: current-at-finish; deployment revision: unknown (not queried).
Business job (dated canonical portfolio): Present client performance and reporting workflows.
Recorded portfolio state: deployed; current use: unknown.

## Evidence sections

## Identity and native run routes

- **Package script: build:demo** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L19)
- **Package script: build:monitoring** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L10)
- **Package script: check:docs** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L30)
- **Package script: check:privacy** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L29)
- **Package script: format:check** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L32)
- **Package script: format:check:v6** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L33)
- **Package script: import** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L28)
- **Package script: preview:command** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L38)
- **Package script: test** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L13)
- **Package script: test:browser** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L20)
- **Package script: test:command** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L34)
- **Package script: test:command-browser** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L36)
- **Package script: test:command-db** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L35)
- **Package script: test:db** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L27)
- **Package script: test:executive-browser** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L14)
- **Package script: test:executive-pipeline** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L16)
- **Package script: test:executive-ux** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L15)
- **Package script: test:hosted** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L22)
- **Package script: test:hosted-browser** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L23)
- **Package script: test:hosted-refresh** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L25)
- **Package script: test:maintenance** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L31)
- **Package script: test:manager-browser** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L18)
- **Package script: test:monitoring** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L11)
- **Package script: test:monitoring-browser** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L12)
- **Package script: test:parity** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L21)
- **Package script: test:security-browser** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L24)
- **Package script: test:signin-browser** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L26)
- **Package script: test:story-browser** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L17)
- **Package script: verify:v6** — Declared command entry point. Command body omitted and never executed by this scanner. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L37)
- **@clerk/backend** — dependencies: 3.21.0. Declaration only; installation is not checked. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L41)
- **@floating-ui/dom** — dependencies: 1.7.4. Declaration only; installation is not checked. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L42)
- **@sentry/browser** — dependencies: 10.75.2. Declaration only; installation is not checked. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L43)
- **@sentry/node-core** — dependencies: 10.75.2. Declaration only; installation is not checked. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L44)
- **@tanstack/table-core** — dependencies: 8.21.3. Declaration only; installation is not checked. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L45)
- **@vercel/functions** — dependencies: 3.10.1. Declaration only; installation is not checked. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L46)
- **Browser document** — HTML source is present. Browser compatibility, hosting and live data access are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/src/command/shell.html#L1)
- **csv-parse** — dependencies: 7.0.3. Declaration only; installation is not checked. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L47)
- **d3-geo** — dependencies: 3.1.1. Declaration only; installation is not checked. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L48)
- **embedded-postgres** — devDependencies: version not summarized. Declaration only; installation is not checked. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L54)
- **esbuild** — devDependencies: 0.28.2. Declaration only; installation is not checked. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L55)
- **node engine** — Declared compatibility: 22.x. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L6)
- **pg** — dependencies: 8.23.1. Declaration only; installation is not checked. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L49)
- **playwright** — devDependencies: 1.58.2. Declaration only; installation is not checked. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L56)
- **prettier** — devDependencies: 3.9.9. Declaration only; installation is not checked. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L57)
- **supabase** — devDependencies: 2.118.0. Declaration only; installation is not checked. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L58)
- 48 further findings are in the adjacent complete profile.

## Providers, APIs and possible writes

- **Invoca** — Mentioned in source documentation; implementation and account access need confirmation. (inferred; source-reported). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/DECISIONS.md#L27)
- **Clerk** — Integration signal in source. Account ownership, provisioning and live connectivity are unverified. (inferred; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L41)
- **Invoca** — Mentioned in source documentation; implementation and account access need confirmation. (inferred; source-reported). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/DECISIONS.md#L27)
- **Sentry** — Integration signal in source. Account ownership, provisioning and live connectivity are unverified. (inferred; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L43)
- **Supabase** — Mentioned in source documentation; implementation and account access need confirmation. (inferred; source-reported). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/DECISIONS.md#L26)
- **Write-call candidate: delete** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/api/command.mjs#L53)
- **Write-call candidate: update** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/api/command.mjs#L172)
- **Write-call candidate: delete** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/api/command.mjs#L178)
- **Write-call candidate: delete** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/api/command.mjs#L181)
- **Write-call candidate: delete** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/api/executive.mjs#L44)
- **Write-call candidate: delete** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/api/executive.mjs#L64)
- **Write-call candidate: delete** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/api/executive.mjs#L67)
- **Write-call candidate: update** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/api/report.mjs#L54)
- **Write-call candidate: delete** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/api/report.mjs#L57)
- **Write-call candidate: delete** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/api/report.mjs#L59)
- **Write-call candidate: update** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/build-command-assets.mjs#L34)
- **Write-call candidate: update** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/build-command-assets.mjs#L35)
- **Write-call candidate: update** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/build-command-assets.mjs#L36)
- **Write-call candidate: update** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/build-command-versions.mjs#L45)
- **Write-call candidate: update** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/build-command-versions.mjs#L49)
- **Write-call candidate: update** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/build-monitoring.mjs#L40)
- **Write-call candidate: update** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/build-monitoring.mjs#L41)
- **Write-call candidate: update** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/build-monitoring.mjs#L42)
- **Write-call candidate: update** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/build-monitoring.mjs#L43)
- **Write-call candidate: update** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/build.mjs#L37)
- **Write-call candidate: update** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/check-privacy.mjs#L59)
- **Attribution parameter: gclid** — Parameter-name reference only; no attribution values collected. Capture, forwarding, consent and retention require review. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/check-privacy.mjs#L84)
- **Attribution parameter: wbraid** — Parameter-name reference only; no attribution values collected. Capture, forwarding, consent and retention require review. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/check-privacy.mjs#L84)
- **Attribution parameter: gbraid** — Parameter-name reference only; no attribution values collected. Capture, forwarding, consent and retention require review. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/check-privacy.mjs#L84)
- **Attribution parameter: msclkid** — Parameter-name reference only; no attribution values collected. Capture, forwarding, consent and retention require review. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/check-privacy.mjs#L84)
- **Write-call candidate: update** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/server/command-prepared.mjs#L49)
- **Write-call candidate: delete** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/server/command-prepared.mjs#L182)
- **Write-call candidate: update** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/server/command-prepared.mjs#L383)
- **Write-call candidate: update** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/server/command-prepared.mjs#L384)
- **Write-call candidate: delete** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/server/command-roster.mjs#L384)
- **Write-call candidate: delete** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/server/command-roster.mjs#L418)
- **Write-call candidate: delete** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/server/command-welcome.mjs#L157)
- **Write-call candidate: delete** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/server/command-welcome.mjs#L669)
- **Write-call candidate: delete** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/server/command.mjs#L171)
- **Write-call candidate: remove** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/src/command/app.js#L4485)
- **Write-call candidate: remove** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/src/command/app.js#L4518)
- **Write-call candidate: remove** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/src/command/app.js#L4519)
- **Write-call candidate: remove** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/src/command/app.js#L4558)
- **Write-call candidate: remove** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/src/command/app.js#L5574)
- **Write-call candidate: delete** — Method-name signal only; this may be a local collection or optional path. Review the receiver, destination, payload and guard before classifying an external write. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/src/command/host.js#L229)
- 25 further findings are in the adjacent complete profile.

## Configuration, access and data

- **Clerk** — Integration signal in source. Account ownership, provisioning and live connectivity are unverified. (inferred; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L41)
- **Supabase** — Mentioned in source documentation; implementation and account access need confirmation. (inferred; source-reported). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/DECISIONS.md#L26)
- **EXECUTIVE\_SCREENSHOT** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/tests/executive-browser.mjs#L503)
- **GITHUB\_EVENT\_NAME** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/ci-scope.mjs#L90)
- **GITHUB\_EVENT\_PATH** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/ci-scope.mjs#L86)
- **GITHUB\_OUTPUT** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/ci-scope.mjs#L92)
- **NEXT\_PUBLIC\_CLERK\_PUBLISHABLE\_KEY** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. Client-visible prefix: review what may be exposed. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/api/index.mjs#L20)
- **PLAYWRIGHT\_BROWSERS\_PATH** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/tests/browser-support.mjs#L9)
- **PORT** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/preview-command.mjs#L11)
- **SENTRY\_DSN** — Secret-like name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/tests/monitoring-browser.mjs#L9)
- **SENTRY\_ENVIRONMENT** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/tests/monitoring-browser.mjs#L11)
- **SENTRY\_RELEASE** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/tests/monitoring-browser.mjs#L10)
- **SPR\_TEST\_BROWSER\_CHANNEL** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/tests/browser-support.mjs#L12)
- **SPR\_TEST\_DATABASE\_PASSWORD** — Secret-like name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/verify-v6.mjs#L13)
- **SPR\_TEST\_DATABASE\_PORT** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/verify-v6.mjs#L7)
- **SPR\_TEST\_DATABASE\_URL** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/verify-v6.mjs#L20)
- **STORY\_SCREENSHOT** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/tests/story-browser.mjs#L205)
- **PostgreSQL** — Integration signal in source. Account ownership, provisioning and live connectivity are unverified. (inferred; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L49)
- **Schema / migration definition** — Schema-related source exists; database contents and applied migration state were not inspected. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/supabase/migrations/20260930193044_incremental_reporting.sql#L1)
- **Supabase** — Mentioned in source documentation; implementation and account access need confirmation. (inferred; source-reported). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/DECISIONS.md#L26)
- **Table reference: sunshine\_reporting.batches** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/supabase/migrations/20260930193044_incremental_reporting.sql#L4)
- **Table reference: sunshine\_reporting.source\_files** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/supabase/migrations/20260930193044_incremental_reporting.sql#L11)
- **Table reference: sunshine\_reporting.sf\_opportunities** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/supabase/migrations/20260930193044_incremental_reporting.sql#L12)
- **Table reference: sunshine\_reporting.ads\_geo\_daily** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/supabase/migrations/20260930193044_incremental_reporting.sql#L15)
- **Table reference: sunshine\_reporting.opportunity\_campaign\_enrichment** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/supabase/migrations/20260930193044_incremental_reporting.sql#L19)
- **Table reference: sunshine\_reporting.import\_row\_results** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/supabase/migrations/20260930193044_incremental_reporting.sql#L26)
- **Table reference: sunshine\_reporting.import\_row\_results** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/supabase/migrations/20260930193044_incremental_reporting.sql#L44)
- **Row-security declaration** — DDL references row-level security. This does not establish deployed policies, role coverage or effective authorization. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/supabase/migrations/20260930193044_incremental_reporting.sql#L44)
- **Table reference: sunshine\_command\_cache.scopes** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/supabase/migrations/20261017152516_command_v6_prepared_reports.sql#L8)
- **Table reference: sunshine\_command\_cache.reports** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/supabase/migrations/20261017152516_command_v6_prepared_reports.sql#L21)
- **Table reference: sunshine\_command\_cache.scopes** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/supabase/migrations/20261017152516_command_v6_prepared_reports.sql#L33)
- **Table reference: sunshine\_command\_cache.reports** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/supabase/migrations/20261017152516_command_v6_prepared_reports.sql#L34)
- **Row-security declaration** — DDL references row-level security. This does not establish deployed policies, role coverage or effective authorization. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/supabase/migrations/20261017152516_command_v6_prepared_reports.sql#L33)
- **Table reference: sunshine\_command\_cache.reports** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/supabase/migrations/20261017162946_command_v6_shared_calculations.sql#L2)
- **Table reference: sunshine\_command\_cache.inputs** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/supabase/migrations/20261017162946_command_v6_shared_calculations.sql#L9)
- **Table reference: sunshine\_command\_cache.inputs** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/supabase/migrations/20261017162946_command_v6_shared_calculations.sql#L15)
- **Row-security declaration** — DDL references row-level security. This does not establish deployed policies, role coverage or effective authorization. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/supabase/migrations/20261017162946_command_v6_shared_calculations.sql#L15)
- **API-key or authorization header** — Source signal only. Review enforcement, caller identity, scopes and bypass paths; no hosted-access conclusion is inferred. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/api/command-prewarm.mjs#L22)
- **API-key or authorization header** — Source signal only. Review enforcement, caller identity, scopes and bypass paths; no hosted-access conclusion is inferred. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/api/command.mjs#L80)
- **API-key or authorization header** — Source signal only. Review enforcement, caller identity, scopes and bypass paths; no hosted-access conclusion is inferred. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/api/executive.mjs#L73)
- **API-key or authorization header** — Source signal only. Review enforcement, caller identity, scopes and bypass paths; no hosted-access conclusion is inferred. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/api/report.mjs#L67)
- **API-key or authorization header** — Source signal only. Review enforcement, caller identity, scopes and bypass paths; no hosted-access conclusion is inferred. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/preview-command.mjs#L216)
- **Login allowlist** — Source signal only. Review enforcement, caller identity, scopes and bypass paths; no hosted-access conclusion is inferred. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/server/auth.mjs#L40)
- **API-key or authorization header** — Source signal only. Review enforcement, caller identity, scopes and bypass paths; no hosted-access conclusion is inferred. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/server/cache.mjs#L9)
- **API-key or authorization header** — Source signal only. Review enforcement, caller identity, scopes and bypass paths; no hosted-access conclusion is inferred. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/server/command-reference.mjs#L5)
- 7 further findings are in the adjacent complete profile.

## Jobs, monitoring, hosting and devices

- **Browser automation** — Browser automation signal; browser binaries, host and permissions may be required. (inferred; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/.github/workflows/v6-ci.yml#L46)
- **Local filesystem access** — Filesystem reference; approved paths, read/write scope and operating identity need confirmation. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/api/index.mjs#L1)
- **Local process access** — Source starts or inspects local processes. Commands, execution owner and machine access need review. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/check-docs.mjs#L1)
- **render configuration** — Hosting configuration found; service project and deployment are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/server/render.mjs#L1)
- **Vercel configuration** — Deployment configuration is present. The live project, environment and deployed revision are not queried. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/vercel.json#L1)
- **Application error logging** — Error logging call exists; destination, alerting, retention and redaction are unverified. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/scripts/build.mjs#L160)
- **Sentry** — Integration signal in source. Account ownership, provisioning and live connectivity are unverified. (inferred; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/package.json#L43)
- **GitHub workflow: v6-ci.yml** — Workflow file exists; required checks, credentials and run outcomes are not queried. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/.github/workflows/v6-ci.yml#L1)
- **Test sources present** — Test paths found in the tree; their contents and outcomes are not inferred from existence. (inferred; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/tests/admissions.test.mjs#L1)
- **In-process timer** — Timer reference; this does not establish a durable or currently running job. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/src/command/host.js#L825)
- **Vercel cron: \*/5 \* \* \* \*** — Declared schedule for /api/command-prewarm. Enabled state, timezone and execution history are unverified. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/vercel.json#L26)
- **Guard-name candidate: SENTRY\_ENABLED** — A flag name appears in source; its default, scope and enforcement on jobs or writes are unverified. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/server/monitoring.mjs#L22)
- **Guard-name candidate: SPR\_COMMAND\_CRON\_MONITOR\_ENABLED** — A flag name appears in source; its default, scope and enforcement on jobs or writes are unverified. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/server/monitoring.mjs#L96)

## Documentation to interpret

- [AGENTS.md](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/AGENTS.md#L1) — repository instructions (evidence only); 48 lines. Body remains at the source.
- [DECISIONS.md](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/DECISIONS.md#L1) — design and decisions; 127 lines. Body remains at the source.
- [README.md](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/README.md#L1) — setup and operations; 30 lines. Body remains at the source.
- [STATE.md](https://github.com/webhostingdoo/Sunshine-Performance-Reporting/blob/07de262bfcbfe8a448a5ac23ca809734278ab15e/STATE.md#L1) — state or handoff; 36 lines. Body remains at the source.

## Questions requiring source interpretation or owner evidence

- Which declared commands actually form setup, run, check and recovery? Review the command definitions and operator procedure.
- Which configuration names are required, optional or obsolete? Trace use/defaults and obtain provisioning evidence without values.
- Which write candidates reach external systems, and which guards protect them? Trace receiver/call paths and review approval boundaries.
- Which accounts, devices, permissions and schedules are active? Obtain dated owner/service evidence under a separate authorized check.
- Does the deployed source match this revision? Obtain deployment/source metadata; source inspection does not establish it.
- Are repeated tracking fingerprints intended? Confirm destination ownership; repetition alone does not establish an incorrect clone.
- Owner, last-used date, review verdict, unattended eligibility and approved dependencies remain unknown until explicitly supplied.

## Coverage limitations

- Static inspection does not verify runtime health, current use, provisioning, live schedules, service account access or deployed/source alignment.
- Only bounded source/configuration files are inspected. Secret files, data exports, binaries, history and raw source text are excluded from results.
- Unknown or dynamically constructed integrations and configuration names may not be detected. Human review is still needed.
- Deep scan: more source and candidate detectors, with an adjacent versioned receipt. Candidate calls and tracking matches still require interpretation.