diff --git a/work/projects/cpm-post-release-analysis-2026-10-27.md b/work/projects/cpm-post-release-analysis-2026-10-27.md
index 8125b07b..332143d9 100644
--- a/work/projects/cpm-post-release-analysis-2026-10-27.md
+++ b/work/projects/cpm-post-release-analysis-2026-10-27.md
@@ -376,3 +376,7 @@ Re-cut of the post-release data (macOS 1.213.x, 26–27 Oct, matured since the s
 - **macOS app build with the filter:** `xcodebuild -scheme "macOS Browser" -configuration Debug CODE_SIGNING_ALLOWED=NO` succeeded (the change compiles in the app target). Product: `/private/tmp/claude-501/-Users-admin-DuckDuckGo-apple-browsers-git/2490a862-c422-4358-b940-1f30df9cbb83/scratchpad/app-dd/Build/Products/Debug/DuckDuckGo.app` (scratchpad of that session; may be cleaned). The app was not launched: no window run on the host Mac. The real-app check is still open: three tabs idle >30 s, a dead host in each, `log stream` for `CPM Health Monitor`; with the filter there should be no `timeoutElapsed` for the error pages.
 - **Integration test (28–29 Oct):** `macOS/IntegrationTests/Tab/CPMErrorPageMonitoringTests.swift` (added to both Integration Tests targets in the pbxproj). Real `Tab` + `WKWebView` + `TestSchemeHandler` failing with `NSURLErrorCannotFindHost`; the tab gets a stub `WebExtensionManaging` whose health monitor records events. Asserts the monitor sees `started:other`, `failed`, then `started:error_page`, and the error page finish for the failed URL arrives after it (the real macOS path: `Navigation` alternate load → `.errorPage`). `build-for-testing` of scheme `macOS Integration Tests` succeeded and SwiftLint strict is clean; **not run locally** (integration tests are left to CI, no host windows). Without the macOS mapping the second start would be `started:other` and the test would fail; that was not observed, only reasoned.
 - **Integration test run locally (29 Oct), correction of the line above:** with the signed Debug build (dev identity, entitlements present), `macOS Integration Tests` → `CPMErrorPageMonitoringTests` **passes** (1 test, 0 failures). Negative control with the macOS mapping removed from `PrivacyDashboardTabExtension.cpmMessagingNavigationKind`: the same test **fails** in the real app stack, with the monitor receiving `["started:other", "failed", "started:other", "committed:https://testhost.com/", "finished:https://testhost.com/"]`, i.e. the error page is reported as an ordinary navigation of the failed https URL (this is the false positive, observed in the app's own `Tab`/`Navigation` path, not only in the harness). The mapping was restored afterwards. Note for running locally: do not build with `CODE_SIGNING_ALLOWED=NO`; the host app then lacks the keychain entitlement (`-34018`) and macOS asks for keychain access.
+- **Corner cases checked (29 Oct):**
+  - Integration tests (real `Tab`, `macOS Integration Tests`, run locally with the signed Debug build), all pass: ordinary load error (`-1003`), SSL error (`NSURLErrorServerCertificateUntrusted`), malicious-site warning (`MaliciousSiteError`, via the `duck://error` redirect). In each, after the failed load the page starts as `.errorPage`, so the monitor never measures it.
+  - Harness (`CPMReproCornerCaseTests`, real WebKit, real extension, loopback HTTP), all pass: HTTP Basic auth with accepted credentials (CPM answers) and with a cancelled challenge (401 page, no episode); client redirects at 0.1 s, 2 s, meta refresh and a redirect after the 4 s grace (CPM answers on the target, no episode); PDF, text/plain and JSON documents (CPM answers on all three, content scripts do run on PDF); a Fire-window tab with a non-persistent data store (CPM answers). A 6 s JS timer redirect never fired in a window-less web view (timer throttling), which is a test artefact.
+  - Not checked: downloads, http→https upgrade redirects, background or minimised windows, mass tab opening, popups from `about:blank`, closing a tab mid-measurement, iOS error pages, the macOS basic-auth dialog UI itself (by code reading nothing is committed while it is open, and cancel leads to no error page).