Docs-Audit: security-findings.md marker inventory has drifted from the code tags #497

Affected documentation: docs/security-findings.md

Evidence (origin/main c273550): grep of H-N / M-N / L-N / C-N / F-N markers across src/

The file says it aggregates every security tag in the codebase and that new tags must be added to it. That no longer holds:

• H-15 (Sub-Workflow Cancellation Inheritance) claims fire-and-forget children "inherit the parent's cancellation token". Fire-and-forget children are now dispatched as a durable intent (StartWorkflowActivity.cs ~245-258). The parent token covers only the dispatch call, and no cancel cascade via ParentExecutionId was found. Only the waited path links tokens (~295-296). The described protection may no longer exist in this form.
• Tag collisions. The same tag names different findings in code:
  • H-1: AuthSessionIssuer.cs, UsersController.cs, StepRunner.cs
  • H-3: JwtKeyResolver.cs, AdminBootstrap.cs
  • H-4: SecurityHardeningWarnings.cs (AllowedHosts), RateLimitingSetup.cs (IPv6 /64)
  • H-17: AuthenticationSetup.cs
  • M-2: AuthController.cs
  • L-2: AuthController.cs uses it for generic invalid credentials; the doc uses L-2 for resume caps
• Tags in code but not in the doc: H-2, H-6, H-11, H-12, M-3, M-6, M-16, M-17, M-18, L-1a, L-6, L-17.
• Tags in the doc but no longer in code: H-9, H-13, H-15, M-7, M-8, M-9, M-11, M-12, M-15, M-20, M-23, L-2 (resume caps), L-5, F-1, C-2-b, M-30, M-31. The behaviour mostly still exists; only the tag comments are gone.
• Line anchors. Most #Lnn anchors are stale. Examples: ExternalTriggerController.cs:90 is now :188; RateLimitingSetup.cs:65 is now :82.
• DEP-5 says the lint warning cap moved 11→13 and is recorded in ci.yml. The cap is 11 and lives in src/nodepilot-ui/package.json (lint:ci).

Required changes

• Decide whether H-15 still describes a real protection; rewrite or retire it
• Resolve the tag collisions (renumber in code or document both meanings)
• Add or retire the unmatched tags
• Refresh the line anchors, or switch to symbol references
• Reconcile DEP-5 with the actual lint cap

Why not auto-fixed: H-15 and the tag scheme need a decision about whether code or doc is authoritative. Verified value drift (metric names, keys, limits, pins) was fixed in the weekly audit PR.

Automated documentation-audit finding; requires triage.