T0 residual classification

Residual or status occurrence	Class	Disposition
Optional W01/W02/W05 business workflows	A	Downstream; explicitly excluded from this audit.
SC-REPORT/LEARN/ASSESS blocked workflows	A only while absent, disabled, and unexposed	Must be resolved before their T1 navigation is exposed.
SC-ATTEND+, SC-FOUND, SC-DAP, SC-BOS product/SKU questions	C / PRODUCT_DECISION	Named decision required before exposure; not a Core pass.
Foundation HR reset controller BLOCKED	B only after absence is proven	No controller found; stale FE/registry references remain an optional defect.
Password expiry/lockout, customer impersonation, break-glass	B	No supported Core route found; keep explicit exclusion.
Reset timing	A/S2	Informational only; body-shape anti-enumeration is not enough to close other gaps.
Activation PARTIAL	D	Token purpose has no call site; activation does not establish the DEC-014 server contract.
User-create DECISION_REQUIRED and bulk-reset revoke incomplete	D	Directly contradicts U07/DEC-014.
Unsigned product contract and unsigned DEC-014	D / PRODUCT_DECISION	Roadmap requires signatures before T0 exit.
Core-only topology CI, auto-created baseline, optional suite contamination	D	T0 quality-gate and reproducibility failure.
Installed-unentitled leadership/optional APIs	D	Live data exposure; S0.
Native /web/reset_password enabled with Odoo semantics	D	Alternate public credential route outside DEC-014; missing-login response enumerates account absence.
Historical predictable-password migration/provision scripts	D	S0 if reachable (live Golden contains source-known active accounts); otherwise evidence/cleanup blocker.
Documentation stale versions and old parent password text	S3	Hygiene, but cannot be used as evidence of credential safety.

No item labelled BLOCKED, PARTIAL, OPEN, or DECISION_REQUIRED that affects the certified Core/platform boundary is accepted as a harmless downstream residual.