IDE Known Anomalies and Residuals

Field	Value
Status	Unresolved anomalies, resolved field defects, accepted residuals, and deferrals
Baseline	ide-software-freeze-2026-08-21 / 91c0e98a9bc9429a0486bebdebffc7d8dbbe300e
Last product-source commit in frozen baseline	ae00e754
Date	2026-09-08

A. Unresolved Anomalies and Evidence-Control Items

ID	Cross-references	Description	Impact	Current control/status	Disposition category
ANOM-002	RA-003, RA-016, RA-017, RA-020	After some connection gaps without a pending issued dose, delivery can retain limited within-window attribution precision	Insulin conservation is retained, but a recovered share may not identify the exact original slot	Replay evidence is labeled and bounded; no insulin is silently dropped	Residual-risk decision
ANOM-006	-	An archive can report build 1 when Git-derived build stamping falls back	Weakens build-to-evidence identity	Physical-run preflight requires tag/SHA, expected build, installed build, install ID, subject/device, and UTC window	Enforce preflight for every claimed physical run
ANOM-007	RA-023, SRS-CGM-006	Reopening CGM setup during an active replacement acquisition can install a fresh G7 manager and reset the retained prior-sensor, trigger, and episode-time evidence	Weakens replacement-state continuity and the ten-minute/evidence audit trail	September 3 review traced the observed manual to initial_acquisition transition to this UI-manager replacement path; no wrong-sensor adoption was observed	Accepted for submission under D06/D07; controlled exercise and final disposition required before participant deployment
RES-004	RA-015	Backup basal also engages when current CGM freshness cannot be established, not only when CGM is confirmed stale	The behavior is broader than a stale-only interpretation	Automated freeze coverage exists; clinical behavior confirmed on 2026-08-21	Documented residual behavior
RES-009	RA-016, RA-017	A previously consumed request tuple can resurface in pump-input telemetry after recovery	Current C++ gate rejected the tuple, so no second insulin ingestion was observed; telemetry may imply duplicate delivery	Request-step consumption control prevents duplicate ingestion	Evidence-hygiene residual
RES-010	RA-023	Manual or device-lifecycle-triggered replacement acquisition has no authoritative intended-sensor identity and can encounter another nearby G7 advertiser	Wrong-person glucose could influence automated dosing if the wrong sensor were adopted	Staleness alone never releases the bound sensor, and adoption requires authenticated glucose discovery. Physical isolation applies to planned replacement. Post-connection comparison is a detection control, not a gate on the first accepted reading. The September 3 review also identified non-atomic concurrent-candidate handling that has not been physically reproduced.	Submission deferral accepted under D06; no participant deployment before the controlled exercise and final disposition of ANOM-007 and the concurrent-candidate finding

B. Resolved Field Defects in the Frozen Code

ID	Cross-references	Historical defect	Frozen-baseline resolution	Evidence status
ANOM-001	RA-010, RA-015	Transient DASH reconnect could briefly show No Pod	Routine disconnects use display debounce; immediate clearing is reserved for genuine pod-gone events	Freeze automated coverage mapped; operator observation remains support until retained if claimed
ANOM-003	RA-018	A sustained CGM outage could leave programmed backup basal masked after the controller forced open	Fingerstick-supported CGM-outage controls add due scheduling, escalating guidance, a backup-basal bridge, and immediate re-close after eligible BG or CGM return	Freeze automated and simulation execution mapped; physical outage claim remains deferred unless signed
ANOM-004	RA-020	Backup basal delivered during a connected CGM-outage release window was not credited to algorithm accounting	Frozen code uses live per-step credit and bounded schedule-weighted, quantized pod-away replay with persisted conservation context	Freeze AUTO/SIM evidence mapped; clinical 0.01 U positioning is confirmed
ANOM-005	RA-014	A combined meal step could omit the basal component from the pump command, causing next-step feedback rejection	Frozen code commands bolus + basal + meal exactly; TV-ALG-012 reproduces the defect and proves accepted feedback	Freeze algorithm execution passed; physical command/feedback claim remains support until retained

C. Accepted or Documented Residual Behaviors

ID	Cross-references	Behavior	Rationale and limitation
RES-001	-	When a prior pod is retired, expired, or unavailable, known in-flight insulin may be recorded as assumed delivered under clinical policy	Prevents silent disposal and is explicitly labeled; may conservatively over-account if the dose did not complete
RES-002	-	A merged recovered share is booked at the algorithm-compatible request-step position rather than exact wall-clock delivery time	Preserves the C++ reconciliation contract; chart/evidence uses request-step attribution
RES-003	-	Participant Files sharing/open-in-place was removed	Historical residual is retired; local data use protected clinical-gated paths
RES-005	-	Primary and safety diagnostic text files can share a name when sessions start in the same wall second	Diagnostic-only; dosing state and structured telemetry remain isolated
RES-006	-	Runtime inline resolvers execute reconciliation policy; the pure classifier is a verification model, not production authority	Sponsor-accepted design; runtime, property, simulation, and parity tests verify the executed path
RES-007	-	Modeled fallback exposure is not always clamped to a known pod service stop or fault time	Operator-review estimate may over-project; unreconciled modeled exposure is not treated as confirmed algorithm input
RES-008	-	resumed_without_reconciliation groups several pod-liveness cases	Dosing disposition is the same; evidence label has limited granularity

D. Closed Verification Deviations

The three deviations below were closed by controlled companion executions. The original execution records remain preserved.

ID	Closure
ALG-DEV-SA-006	Freeze static-analysis/linkage companion passed 6/6 with literal SHA and requirement linkage.
AUTO-DEV-001	Profile-specific test seeding was corrected; the complete serial UI companion passed 44/44.
AUTO-DEV-002	The assertion now measures the common action container; the complete serial UI companion passed 44/44.
CYBER-DEV-001	Closed 2026-09-03 by designation of Build 843 with the controlled CryptoSwift 1.10.0 resolution; archive-826 mismatch history remains preserved.

These were evidence-linkage or test-harness defects, not product failures.

E. Deferred Scope and Submission Dependencies

• step-0 fingerstick rescue
• historical CGM reconstruction for fallback replay
• unsigned hardware-only and supplemental alert claims
• commercial cloud, broader provider/authentication, and Part 11 closure
• formal participant usability or summative human-factors study is not claimed; the available evidence boundary was clinically approved on 2026-08-27
• completion of the D06 controlled multi-device replacement exercise and final deployment disposition before first participant deployment

Register Discipline

New unresolved software defects must enter the controlled bug tracker and this reviewer register if they survive to a future baseline. Working observations must follow the controlled evidence-promotion process before use as formal evidence.