docs(confidence-engine): record tester readiness findings

docs/current-project-state.md

@@ -303,16 +303,46 @@ The following material learnings are carried forward as durable context for safe
 ### Focused input bound
 - 10,000-character server-side + UI boundary on focused investigation (commit `a6796c6`).
 
-### Investigation snapshot size envelope
-- Authenticated persistence lacks a whole-snapshot size ceiling. Not a pre-tester blocker — legitimate size/depth is unknown; monitor via metadata later without logging content.
+### Investigation snapshot size envelope / investigation growth
+- Authenticated persistence lacks a whole-snapshot size ceiling.
+- No arbitrary whole-investigation snapshot ceiling before real-user evidence.
+- Legitimate turn depth and mature investigation size are unknown.
+- Later observation may use serialized snapshot bytes, revision, contribution count and finding count without recording content.
+- Not a pre-tester blocker.
 
 ### Prompt injection
 - **Low risk under the current architecture.** Untrusted text can influence model reasoning but no evidence it gains application authority. No model-accessible arbitrary tools, DB targeting, auth control, or privileged side effects found. Output passes structured validation before application mutation. Not a pre-tester blocker.
 
-### Deferred non-security observations
+### Deferred non-security observations (backlog only — no code change)
 - Orchestrator update flow indentation/control-flow clarity deferred.
 - Investigation overview validation may accept unexpected extra fields.
 - Provider JSON recovery permissiveness deferred as future robustness review.
+- Malformed persistence-envelope/runtime validation deferred.
+- Initial Analyse duplicate-submit prevention deferred (action not disabled by `status === "loading"`).
+
+### Tester-readiness position
+
+```
+controlled external testing: GO
+
+known pre-tester security blockers: none identified
+
+next uncertainty worth reducing: real first-time-user product value, trust and independent usability
+```
+
+Do not claim commercial launch readiness, general production scalability, security certification or proven product-market fit.
+
+### Reasoning concurrency (deferred)
+- No server-side per-user reasoning concurrency protection; no CE-level global limit.
+- Multiple tabs/users can reach provider concurrently — Ollama/provider behaviour not controlled by CE repository code.
+- Controlled cohort of ~5–10 invited testers: **not a release blocker**.
+- Before wider/public access, reasoning-resource concurrency protection should be reconsidered.
+- If instrumentation needed later: prefer metadata only (endpoint/action, request start/end or duration, concurrent active call count, result/timeout classification). Do not log investigation content for capacity measurement.
+
+### Rate limiting (deferred)
+- No application-level per-user reasoning rate limit currently exists.
+- Not required for controlled tester cohort; revisit before wider/public access.
+- Future protection should target scarce reasoning/provider capacity, not indiscriminately throttle cheap authenticated persistence/read operations.
 
 ---