diff --git a/.env.example b/.env.example
index 4812d812..4c7c79e9 100644
--- a/.env.example
+++ b/.env.example
@@ -54,3 +54,6 @@ SENTRY_DSN=
 # Optional - enables AZ-SC-007/008 (Azure DevOps pipeline scanning)
 AZURE_DEVOPS_ORG_URL=
 AZURE_DEVOPS_PROJECT=
+
+# Optional - tenant identifier used for lifecycle tracking (defaults to subscription_id if unset)
+OPENSHIELD_TENANT_ID=
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dfaa8141..3c0ed473 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,10 @@ on:
     branches:
       - dev
       - main
+      - feat/311-finding-lifecycle
+      - feat/331-evidence-graph-foundation
+      - feat/332-evidence-graph-node-edge-population
+
   # Post-merge assurance: re-run the full gate on the merged result, so a green
   # PR run against an older base is not the only evidence for dev and main.
   push:
@@ -573,7 +577,7 @@ jobs:
 
       - name: Start image
         env:
-          POSTGRES_PORT: ${{ job.services.postgres.ports[5432] }}
+          POSTGRES_PORT: ${{ job.services.postgres.ports['5432'] }}
         run: |
           set -euo pipefail
           JWT_SECRET="$(python3 -c 'import secrets; print(secrets.token_urlsafe(32))')"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3f654e31..7e63b5f7 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -5,6 +5,10 @@ on:
     branches:
       - dev
       - main
+      - feat/311-finding-lifecycle
+      - feat/331-evidence-graph-foundation
+      - feat/332-evidence-graph-node-edge-population
+
   push:
     branches:
       - dev
diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
index 719600a1..333c0c49 100644
--- a/.github/workflows/dco.yml
+++ b/.github/workflows/dco.yml
@@ -2,7 +2,7 @@ name: Developer Certificate of Origin
 
 on:
   pull_request:
-    branches: [dev, main]
+    branches: [dev, main, feat/311-finding-lifecycle, feat/331-evidence-graph-foundation, feat/332-evidence-graph-node-edge-population]
 
 permissions:
   contents: read
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index a737a3cb..b82b6c61 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -2,7 +2,7 @@ name: Dependency Review
 
 on:
   pull_request:
-    branches: [dev, main]
+    branches: [dev, main, feat/311-finding-lifecycle, feat/331-evidence-graph-foundation, feat/332-evidence-graph-node-edge-population]
 
 permissions:
   contents: read
diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml
index a4c83572..81f5f054 100644
--- a/.github/workflows/website.yml
+++ b/.github/workflows/website.yml
@@ -14,7 +14,7 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [dev, main]
+    branches: [dev, main, feat/311-finding-lifecycle, feat/331-evidence-graph-foundation, feat/332-evidence-graph-node-edge-population]
   workflow_dispatch:
 
 permissions:
diff --git a/alembic/versions/a8d9c2e4f601_finding_lifecycle.py b/alembic/versions/a8d9c2e4f601_finding_lifecycle.py
new file mode 100644
index 00000000..869aef30
--- /dev/null
+++ b/alembic/versions/a8d9c2e4f601_finding_lifecycle.py
@@ -0,0 +1,163 @@
+"""Add finding lifecycle tables: scan_rule_outcomes, scan_lifecycle_applications,
+finding_fingerprints, finding_lifecycles, finding_lifecycle_transitions, patterns.
+
+Revision ID: a8d9c2e4f601
+Revises: b6d2f8a4c1e7
+Create Date: 2026-08-30 00:00:00.000000
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+
+# Revision identifiers, used by Alembic.
+revision: str = "a8d9c2e4f601"
+down_revision: Union[str, Sequence[str], None] = "b6d2f8a4c1e7"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.execute(
+        """
+        CREATE TABLE scan_rule_outcomes (
+            id BIGSERIAL PRIMARY KEY,
+            scan_id UUID NOT NULL REFERENCES scans(scan_id),
+            rule_id TEXT NOT NULL,
+            rule_version TEXT NOT NULL DEFAULT '1',
+            status TEXT NOT NULL,
+            error_category TEXT,
+            collector_version TEXT NOT NULL DEFAULT '1',
+            inventory_boundary TEXT NOT NULL,
+            tenant_id TEXT NOT NULL,
+            subscription_id TEXT NOT NULL,
+            started_at TIMESTAMPTZ,
+            completed_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+            CONSTRAINT ck_scan_rule_outcomes_status
+                CHECK (status IN (
+                    'SUCCESS','EMPTY_SUCCESS','PERMISSION_DENIED',
+                    'TIMEOUT','FAILED','NOT_APPLICABLE'
+                )),
+            CONSTRAINT uq_scan_rule_outcomes_scan_rule
+                UNIQUE (scan_id, rule_id)
+        )
+        """
+    )
+
+    op.execute(
+        """
+        CREATE TABLE scan_lifecycle_applications (
+            scan_id UUID PRIMARY KEY REFERENCES scans(scan_id),
+            applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+            applied_by TEXT NOT NULL DEFAULT 'system'
+        )
+        """
+    )
+
+    op.execute(
+        """
+        CREATE TABLE finding_fingerprints (
+            id BIGSERIAL PRIMARY KEY,
+            tenant_id TEXT NOT NULL,
+            subscription_id TEXT NOT NULL,
+            resource_id_normalized TEXT NOT NULL,
+            rule_id TEXT NOT NULL,
+            evidence_key TEXT NOT NULL DEFAULT '',
+            normalization_version TEXT NOT NULL DEFAULT '1',
+            fingerprint_version TEXT NOT NULL DEFAULT '1',
+            fingerprint_hash TEXT NOT NULL,
+            created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+            CONSTRAINT uq_finding_fingerprints_hash UNIQUE (fingerprint_hash),
+            CONSTRAINT uq_finding_fingerprints_identity
+                UNIQUE (
+                    tenant_id,
+                    subscription_id,
+                    resource_id_normalized,
+                    rule_id,
+                    evidence_key,
+                    normalization_version
+                )
+        )
+        """
+    )
+
+    op.execute(
+        """
+        CREATE TABLE finding_lifecycles (
+            id BIGSERIAL PRIMARY KEY,
+            fingerprint_id BIGINT NOT NULL REFERENCES finding_fingerprints(id),
+            state TEXT NOT NULL,
+            first_seen_scan_id UUID,
+            last_seen_scan_id UUID,
+            occurrence_count INTEGER NOT NULL DEFAULT 1,
+            consecutive_success_count INTEGER NOT NULL DEFAULT 0,
+            reopen_count INTEGER NOT NULL DEFAULT 0,
+            row_version INTEGER NOT NULL DEFAULT 0,  -- monotonic update counter (FOR UPDATE handles serializability)
+            created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+            updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+            CONSTRAINT ck_finding_lifecycles_state
+                CHECK (state IN ('OPEN','RESOLVED','ACCEPTED','SUPPRESSED','REOPENED')),
+            CONSTRAINT uq_finding_lifecycles_fingerprint
+                UNIQUE (fingerprint_id)
+        )
+        """
+    )
+
+    op.execute(
+        """
+        CREATE TABLE finding_lifecycle_transitions (
+            id BIGSERIAL PRIMARY KEY,
+            lifecycle_id BIGINT NOT NULL REFERENCES finding_lifecycles(id),
+            from_state TEXT,
+            to_state TEXT NOT NULL,
+            scan_id UUID,
+            reason TEXT NOT NULL DEFAULT '',
+            transitioned_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+        )
+        """
+    )
+
+    op.execute(
+        """
+        CREATE TABLE patterns (
+            id BIGSERIAL PRIMARY KEY,
+            pattern_type TEXT NOT NULL,
+            lifecycle_id BIGINT REFERENCES finding_lifecycles(id),
+            tenant_id TEXT NOT NULL,
+            subscription_id TEXT NOT NULL,
+            scan_id UUID,
+            finding_ids JSONB NOT NULL DEFAULT '[]',
+            threshold INTEGER NOT NULL,
+            algorithm_version TEXT NOT NULL DEFAULT '1',
+            created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+            updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+            CONSTRAINT ck_patterns_type
+                CHECK (pattern_type IN (
+                    'persistent_finding',
+                    'cross_resource_recurrence',
+                    'reopened_finding'
+                )),
+            CONSTRAINT uq_patterns_type_lifecycle_scan
+                UNIQUE (pattern_type, lifecycle_id, scan_id)
+        )
+        """
+    )
+
+    # Indexes for hot query paths
+    op.execute("CREATE INDEX ix_finding_fingerprints_tenant_sub ON finding_fingerprints (tenant_id, subscription_id)")
+    op.execute(
+        "CREATE INDEX ix_finding_lifecycles_state ON finding_lifecycles (state) WHERE state IN ('OPEN', 'REOPENED')"
+    )
+    op.execute(
+        "CREATE INDEX ix_finding_lifecycle_transitions_lifecycle_id ON finding_lifecycle_transitions (lifecycle_id)"
+    )
+    op.execute("CREATE INDEX ix_patterns_sub_created ON patterns (tenant_id, subscription_id, created_at DESC)")
+
+
+def downgrade() -> None:
+    op.execute("DROP TABLE IF EXISTS patterns CASCADE")
+    op.execute("DROP TABLE IF EXISTS finding_lifecycle_transitions CASCADE")
+    op.execute("DROP TABLE IF EXISTS finding_lifecycles CASCADE")
+    op.execute("DROP TABLE IF EXISTS finding_fingerprints CASCADE")
+    op.execute("DROP TABLE IF EXISTS scan_lifecycle_applications CASCADE")
+    op.execute("DROP TABLE IF EXISTS scan_rule_outcomes CASCADE")
diff --git a/api/app.py b/api/app.py
index 9f8465dd..80699516 100644
--- a/api/app.py
+++ b/api/app.py
@@ -260,6 +260,7 @@ def verify_jwt() -> None:
     from api.routes.compliance import compliance_bp
     from api.routes.drift import drift_bp
     from api.routes.findings import findings_bp
+    from api.routes.patterns import patterns_bp
     from api.routes.prioritization import prioritization_bp
     from api.routes.resources import resources_bp
     from api.routes.scans import scans_bp
@@ -271,6 +272,7 @@ def verify_jwt() -> None:
     app.register_blueprint(compliance_bp)
     app.register_blueprint(drift_bp)
     app.register_blueprint(findings_bp)
+    app.register_blueprint(patterns_bp)
     app.register_blueprint(prioritization_bp)
     app.register_blueprint(resources_bp)
     app.register_blueprint(scans_bp)
diff --git a/api/auth.py b/api/auth.py
index 97c2d91a..9c8fe918 100644
--- a/api/auth.py
+++ b/api/auth.py
@@ -200,9 +200,10 @@ def _verify_shared_secret(self, token: str) -> Dict[str, Any]:
         return {
             "sub": claims["sub"],
             "role": role,
-            "tenant": None,
+            "tenant": _verified_scope_claim(claims, "tid"),
             "issuer": claims.get("iss"),
             "auth_mode": SHARED_SECRET_MODE,
+            **_subscription_scope(claims),
         }
 
     def _get_jwks_client(self) -> Any:
@@ -247,7 +248,8 @@ def _verify_oidc(self, token: str) -> Dict[str, Any]:
             logger.warning("OIDC authorization rejected: %s", type(exc).__name__)
             raise TokenRejected("Invalid token") from exc
 
-        tenant = str(claims.get("tid") or "").lower() or None
+        tenant_claim = _verified_scope_claim(claims, "tid")
+        tenant = tenant_claim.lower() if tenant_claim else None
         if settings.allowed_tenants and tenant not in settings.allowed_tenants:
             logger.warning("OIDC token rejected: tenant %r is not allowed", tenant)
             raise TokenRejected("Invalid token")
@@ -266,6 +268,7 @@ def _verify_oidc(self, token: str) -> Dict[str, Any]:
             "tenant": tenant,
             "issuer": claims["iss"],
             "auth_mode": AUTH_MODE_OIDC,
+            **_subscription_scope(claims),
         }
 
 
@@ -274,3 +277,18 @@ def build_verifier(shared_secret: Callable[[], str], env: Mapping[str, str] = os
     mode = load_auth_mode(env)
     oidc = load_oidc_settings(env) if mode == AUTH_MODE_OIDC else None
     return TokenVerifier(mode, shared_secret, oidc=oidc, env=env)
+
+
+def _verified_scope_claim(claims: Dict[str, Any], key: str) -> Optional[str]:
+    """Validate scope only after signature, issuer and audience verification."""
+    value = claims.get(key)
+    if value is None:
+        return None
+    if not isinstance(value, str) or not value.strip() or len(value) > 256:
+        raise TokenRejected("Invalid token")
+    return value.strip()
+
+
+def _subscription_scope(claims: Dict[str, Any]) -> Dict[str, str]:
+    subscription = _verified_scope_claim(claims, "subscription_id")
+    return {"subscription_id": subscription} if subscription else {}
diff --git a/api/routes/patterns.py b/api/routes/patterns.py
new file mode 100644
index 00000000..2310ca3b
--- /dev/null
+++ b/api/routes/patterns.py
@@ -0,0 +1,201 @@
+"""Patterns routes: list and retrieve published security patterns."""
+
+import logging
+import os
+
+import psycopg2.extras
+from flask import Blueprint, g, jsonify, request
+
+from api.models.finding import DatabaseManager
+
+patterns_bp = Blueprint("patterns", __name__)
+logger = logging.getLogger(__name__)
+
+_ALLOWED_PATTERN_TYPES = frozenset({"persistent_finding", "cross_resource_recurrence", "reopened_finding"})
+_DEFAULT_LIMIT = 20
+_MAX_LIMIT = 100
+_MIN_LIMIT = 1
+
+_VALIDATION_ERROR_MESSAGE = "Invalid request parameters"
+
+
+class _ValidationError(ValueError):
+    """Raised when a client-controlled value violates the public API contract."""
+
+
+def _get_db() -> DatabaseManager:
+    if "db" not in g:
+        g.db = DatabaseManager(os.environ["DATABASE_URL"])
+        g.db.connect()
+    return g.db
+
+
+def _validate_limit(raw: str) -> int:
+    try:
+        value = int(raw)
+    except (ValueError, TypeError) as exc:
+        raise _ValidationError("limit must be an integer") from exc
+    if value < _MIN_LIMIT or value > _MAX_LIMIT:
+        raise _ValidationError(f"limit must be between {_MIN_LIMIT} and {_MAX_LIMIT}")
+    return value
+
+
+def _effective_tenant() -> str:
+    """Use the token's verified tenant; deployment configuration cannot override it."""
+    tenant = (getattr(g, "user", {}) or {}).get("tenant")
+    if not tenant:
+        raise _ValidationError("Verified tenant scope is required")
+    return tenant
+
+
+def _effective_subscription(subscription_id_param: str | None) -> str:
+    """The trusted token issuer must assign an explicit subscription scope."""
+    subscription = (getattr(g, "user", {}) or {}).get("subscription_id")
+    if not subscription or (subscription_id_param and subscription_id_param != subscription):
+        raise _ValidationError("Verified subscription scope is required")
+    return subscription
+
+
+def _row_to_dict(row: dict) -> dict:
+    """Serialise a patterns table row to a JSON-safe dict."""
+    result = dict(row)
+    for key in ("created_at", "updated_at"):
+        val = result.get(key)
+        if val is not None and hasattr(val, "isoformat"):
+            result[key] = val.isoformat()
+    if result.get("scan_id") is not None:
+        result["scan_id"] = str(result["scan_id"])
+    return result
+
+
+@patterns_bp.get("/api/v1/patterns")
+def list_patterns():
+    """Return published security patterns, optionally filtered.
+
+    Query parameters:
+        subscription_id - filter by Azure subscription (must match JWT scope)
+        pattern_type    - one of persistent_finding, cross_resource_recurrence,
+                          reopened_finding
+        limit           - 1-100, default 20
+    """
+    try:
+        allowed_params = {"subscription_id", "pattern_type", "limit"}
+        unknown = set(request.args) - allowed_params
+        if unknown:
+            raise _ValidationError(f"Unsupported query parameter: {sorted(unknown)[0]}")
+        for key in request.args:
+            if len(request.args.getlist(key)) != 1:
+                raise _ValidationError(f"Query parameter {key} must be provided once")
+
+        subscription_id_param = None
+        if "subscription_id" in request.args:
+            val = request.args["subscription_id"].strip()
+            if not val or len(val) > 256:
+                raise _ValidationError("subscription_id is invalid")
+            subscription_id_param = val
+
+        pattern_type = None
+        if "pattern_type" in request.args:
+            raw_pt = request.args["pattern_type"].strip()
+            if raw_pt not in _ALLOWED_PATTERN_TYPES:
+                raise _ValidationError("Unsupported pattern_type")
+            pattern_type = raw_pt
+
+        limit = _DEFAULT_LIMIT
+        if "limit" in request.args:
+            limit = _validate_limit(request.args["limit"])
+
+        effective_sub = _effective_subscription(subscription_id_param)
+        tenant_id = _effective_tenant()
+
+        db = _get_db()
+        conn = db._get_conn()
+
+        with conn.cursor(cursor_factory=psycopg2.extras.RealDictCursor) as cur:
+            cur.execute(
+                """
+                SELECT id, pattern_type, lifecycle_id, tenant_id,
+                       subscription_id, scan_id, finding_ids, threshold,
+                       algorithm_version, created_at, updated_at
+                FROM patterns
+                WHERE tenant_id = %s
+                  AND subscription_id = %s
+                  AND (%s IS NULL OR pattern_type = %s)
+                ORDER BY created_at DESC
+                LIMIT %s
+                """,
+                (tenant_id, effective_sub, pattern_type, pattern_type, limit),
+            )
+            rows = cur.fetchall()
+
+            cur.execute(
+                """
+                SELECT COUNT(*) AS count
+                FROM patterns
+                WHERE tenant_id = %s
+                  AND subscription_id = %s
+                  AND (%s IS NULL OR pattern_type = %s)
+                """,
+                (tenant_id, effective_sub, pattern_type, pattern_type),
+            )
+            total_row = cur.fetchone()
+            total = total_row["count"] if total_row else 0
+
+        return jsonify(
+            {
+                "patterns": [_row_to_dict(r) for r in rows],
+                "total": total,
+            }
+        )
+
+    except _ValidationError:
+        return jsonify({"error": _VALIDATION_ERROR_MESSAGE}), 400
+    except Exception as exc:
+        logger.error("Failed to list patterns: %s", exc)
+        return jsonify({"error": "Failed to retrieve patterns"}), 500
+
+
+@patterns_bp.get("/api/v1/patterns/<int:pattern_id>")
+def get_pattern(pattern_id: int):
+    """Return a single pattern by its integer ID.
+
+    The pattern is only returned when its subscription_id matches the
+    caller's authorized scope. An out-of-scope pattern returns 404 so
+    that the existence of other subscriptions' patterns is not disclosed.
+    """
+    try:
+        if pattern_id <= 0:
+            raise _ValidationError("pattern_id must be a positive integer")
+
+        # Resolve scope first so an unscoped caller cannot enumerate IDs.
+        effective_sub = _effective_subscription(None)
+        tenant_id = _effective_tenant()
+
+        db = _get_db()
+        conn = db._get_conn()
+
+        with conn.cursor(cursor_factory=psycopg2.extras.RealDictCursor) as cur:
+            cur.execute(
+                """
+                SELECT id, pattern_type, lifecycle_id, tenant_id,
+                       subscription_id, scan_id, finding_ids, threshold,
+                       algorithm_version, created_at, updated_at
+                FROM patterns
+                WHERE id = %s
+                  AND tenant_id = %s
+                  AND subscription_id = %s
+                """,
+                (pattern_id, tenant_id, effective_sub),
+            )
+            row = cur.fetchone()
+
+        if row is None:
+            return jsonify({"error": "Pattern not found"}), 404
+
+        return jsonify(_row_to_dict(row))
+
+    except _ValidationError:
+        return jsonify({"error": _VALIDATION_ERROR_MESSAGE}), 400
+    except Exception as exc:
+        logger.error("Failed to get pattern %s: %s", pattern_id, exc)
+        return jsonify({"error": "Failed to retrieve pattern"}), 500
diff --git a/api/services/lifecycle_service.py b/api/services/lifecycle_service.py
new file mode 100644
index 00000000..3f804b32
--- /dev/null
+++ b/api/services/lifecycle_service.py
@@ -0,0 +1,405 @@
+"""LifecycleService: applies scan outcomes to finding lifecycle state machines."""
+
+import hashlib
+import json
+import logging
+from typing import Any, Dict, List, Optional
+
+logger = logging.getLogger(__name__)
+
+# Rule completion is necessary but insufficient for per-resource resolution.
+_RESOLVING_STATUSES = frozenset({"SUCCESS", "EMPTY_SUCCESS"})
+
+# All statuses the DB constraint accepts. Any other value defaults to FAILED to
+# prevent a single malformed outcome from aborting the whole lifecycle transaction.
+_VALID_OUTCOME_STATUSES = frozenset(
+    {
+        "SUCCESS",
+        "EMPTY_SUCCESS",
+        "PERMISSION_DENIED",
+        "TIMEOUT",
+        "FAILED",
+        "NOT_APPLICABLE",
+    }
+)
+
+
+def _normalize_resource_id(resource_id: str) -> str:
+    """Return a stable, lowercased, stripped version of an ARM resource ID."""
+    return resource_id.strip().lower()
+
+
+def _compute_fingerprint_hash(
+    tenant_id: str,
+    subscription_id: str,
+    resource_id_normalized: str,
+    rule_id: str,
+    evidence_key: str,
+    normalization_version: str,
+) -> str:
+    """Return a SHA-256 hex digest over canonical fields."""
+    canonical = json.dumps(
+        [
+            tenant_id,
+            subscription_id,
+            resource_id_normalized,
+            rule_id,
+            evidence_key,
+            normalization_version,
+        ],
+        separators=(",", ":"),
+        sort_keys=False,
+    )
+    return hashlib.sha256(canonical.encode()).hexdigest()
+
+
+class LifecycleService:
+    """Applies scan results to the finding lifecycle state machines.
+
+    All database work for a single apply_scan call executes inside one
+    transaction. The idempotency sentinel (scan_lifecycle_applications) is
+    inserted last, so a crash before commit means the operation never happened
+    and can safely be retried. Any exception triggers an explicit rollback to
+    leave the connection in a clean state for the next operation.
+    """
+
+    def apply_scan(
+        self,
+        db_conn: Any,
+        scan_id: str,
+        subscription_id: str,
+        tenant_id: str,
+        rule_outcomes: List[Dict[str, Any]],
+        findings: Optional[List[Dict[str, Any]]] = None,
+        evaluations: Optional[List[Dict[str, Any]]] = None,
+    ) -> None:
+        """Apply a completed scan's findings to the lifecycle tables.
+
+        Args:
+            db_conn: A psycopg2 connection (autocommit must be False).
+            scan_id: UUID of the completed scan.
+            subscription_id: Azure subscription ID.
+            tenant_id: Tenant identifier for isolation.
+            rule_outcomes: List of dicts with keys 'rule_id' and 'status'.
+            evaluations: Current per-resource PASS/FAIL/UNKNOWN coverage.
+            findings: List of finding dicts with keys 'rule_id', 'resource_id',
+                and optionally 'evidence_key'. Defaults to empty list.
+        """
+        findings = findings or []
+
+        if getattr(db_conn, "autocommit", False):
+            raise ValueError("db_conn must have autocommit=False for transactional lifecycle apply")
+
+        try:
+            with db_conn.cursor() as cur:
+                # --- Idempotency check ----------------------------------------
+                cur.execute(
+                    "SELECT scan_id FROM scan_lifecycle_applications WHERE scan_id = %s",
+                    (scan_id,),
+                )
+                if cur.fetchone() is not None:
+                    logger.info("Scan %s already applied; skipping lifecycle update", scan_id)
+                    return
+
+                # --- Write durable per-rule outcome records -------------------
+                # UNIQUE(scan_id, rule_id) prevents duplicates on double-writes.
+                for outcome in rule_outcomes:
+                    rule_id_o = outcome.get("rule_id", "")
+                    status_o = outcome.get("status", "FAILED")
+                    if not rule_id_o:
+                        continue
+                    if status_o not in _VALID_OUTCOME_STATUSES:
+                        logger.warning(
+                            "Unknown outcome status %r for rule %s; defaulting to FAILED",
+                            status_o,
+                            rule_id_o,
+                        )
+                        status_o = "FAILED"
+                    cur.execute(
+                        """
+                        INSERT INTO scan_rule_outcomes (
+                            scan_id, rule_id, status, tenant_id, subscription_id,
+                            inventory_boundary, started_at, completed_at
+                        )
+                        VALUES (%s, %s, %s, %s, %s, 'subscription', %s, NOW())
+                        ON CONFLICT (scan_id, rule_id) DO NOTHING
+                        """,
+                        (
+                            scan_id,
+                            rule_id_o,
+                            status_o,
+                            tenant_id,
+                            subscription_id,
+                            outcome.get("started_at"),
+                        ),
+                    )
+
+                # Build a lookup: rule_id -> outcome status
+                outcome_by_rule: Dict[str, str] = {
+                    o["rule_id"]: o["status"] for o in rule_outcomes if "rule_id" in o and "status" in o
+                }
+
+                # evaluate()-only rules (engine skips scan() for them, so they
+                # never produce a rule_outcomes entry). Treat such a rule as having
+                # completed cleanly if it produced at least one non-ERROR evaluation.
+                evaluated_cleanly: set = {
+                    e.get("rule_id")
+                    for e in (evaluations or [])
+                    if isinstance(e.get("rule_id"), str)
+                    and e.get("rule_id") not in outcome_by_rule
+                    and e.get("status") != "ERROR"
+                }
+
+                # Rule-level completion is not proof that any particular resource
+                # passed. Conflicting or incomplete coverage must fail closed.
+                resource_statuses: Dict[tuple, set] = {}
+                for evaluation in evaluations or []:
+                    rule_id = evaluation.get("rule_id")
+                    resource_id = evaluation.get("resource_id")
+                    if not isinstance(rule_id, str) or not isinstance(resource_id, str):
+                        continue
+                    key = (rule_id, _normalize_resource_id(resource_id))
+                    resource_statuses.setdefault(key, set()).add(evaluation.get("status"))
+                passing_resources = {
+                    key
+                    for key, statuses in resource_statuses.items()
+                    if statuses == {"PASS"}
+                    and (outcome_by_rule.get(key[0]) in _RESOLVING_STATUSES or key[0] in evaluated_cleanly)
+                }
+                # A violation contradicts a PASS for the same rule/resource,
+                # even when the new finding has a different evidence fingerprint.
+                failing_resources = {
+                    (finding.get("rule_id"), _normalize_resource_id(finding.get("resource_id", "")))
+                    for finding in findings
+                }
+                passing_resources.difference_update(failing_resources)
+                resolving_rule_ids = sorted({key[0] for key in passing_resources})
+
+                # Build the set of fingerprints seen in this scan.
+                seen_fingerprint_keys: set = set()
+                fingerprints_in_scan: List[Dict[str, Any]] = []
+                for finding in findings:
+                    rule_id = finding.get("rule_id", "")
+                    resource_id = finding.get("resource_id", "")
+                    evidence_key = finding.get("evidence_key", "")
+                    resource_id_normalized = _normalize_resource_id(resource_id)
+                    normalization_version = "1"
+
+                    fp_hash = _compute_fingerprint_hash(
+                        tenant_id,
+                        subscription_id,
+                        resource_id_normalized,
+                        rule_id,
+                        evidence_key,
+                        normalization_version,
+                    )
+                    key = (rule_id, resource_id_normalized, evidence_key)
+                    if key not in seen_fingerprint_keys:
+                        seen_fingerprint_keys.add(key)
+                        fingerprints_in_scan.append(
+                            {
+                                "tenant_id": tenant_id,
+                                "subscription_id": subscription_id,
+                                "resource_id_normalized": resource_id_normalized,
+                                "rule_id": rule_id,
+                                "evidence_key": evidence_key,
+                                "normalization_version": normalization_version,
+                                "fingerprint_hash": fp_hash,
+                            }
+                        )
+
+                # --- Upsert fingerprints and lifecycles for seen findings -------
+                seen_fingerprint_ids: set = set()
+                for fp in fingerprints_in_scan:
+                    # ON CONFLICT DO UPDATE forces RETURNING id on pre-existing rows.
+                    cur.execute(
+                        """
+                        INSERT INTO finding_fingerprints (
+                            tenant_id, subscription_id, resource_id_normalized,
+                            rule_id, evidence_key, normalization_version,
+                            fingerprint_version, fingerprint_hash
+                        )
+                        VALUES (%s, %s, %s, %s, %s, %s, '1', %s)
+                        ON CONFLICT (fingerprint_hash) DO UPDATE
+                            SET fingerprint_hash = EXCLUDED.fingerprint_hash
+                        RETURNING id
+                        """,
+                        (
+                            fp["tenant_id"],
+                            fp["subscription_id"],
+                            fp["resource_id_normalized"],
+                            fp["rule_id"],
+                            fp["evidence_key"],
+                            fp["normalization_version"],
+                            fp["fingerprint_hash"],
+                        ),
+                    )
+                    row = cur.fetchone()
+                    fingerprint_id = row[0]
+                    seen_fingerprint_ids.add(fingerprint_id)
+
+                    cur.execute(
+                        """
+                        SELECT id, state, occurrence_count, reopen_count, row_version
+                        FROM finding_lifecycles
+                        WHERE fingerprint_id = %s
+                        FOR UPDATE
+                        """,
+                        (fingerprint_id,),
+                    )
+                    lc_row = cur.fetchone()
+
+                    if lc_row is None:
+                        cur.execute(
+                            """
+                            INSERT INTO finding_lifecycles (
+                                fingerprint_id, state, first_seen_scan_id,
+                                last_seen_scan_id, occurrence_count,
+                                consecutive_success_count, reopen_count, row_version
+                            )
+                            VALUES (%s, 'OPEN', %s, %s, 1, 0, 0, 0)
+                            RETURNING id
+                            """,
+                            (fingerprint_id, scan_id, scan_id),
+                        )
+                        lifecycle_id = cur.fetchone()[0]
+                        cur.execute(
+                            """
+                            INSERT INTO finding_lifecycle_transitions
+                                (lifecycle_id, from_state, to_state, scan_id, reason)
+                            VALUES (%s, NULL, 'OPEN', %s, 'New finding observed')
+                            """,
+                            (lifecycle_id, scan_id),
+                        )
+                    else:
+                        lifecycle_id, state, occurrence_count, reopen_count, row_version = lc_row
+                        if state in ("OPEN", "REOPENED"):
+                            cur.execute(
+                                """
+                                UPDATE finding_lifecycles
+                                SET occurrence_count = occurrence_count + 1,
+                                    last_seen_scan_id = %s,
+                                    updated_at = NOW(),
+                                    row_version = row_version + 1
+                                WHERE id = %s
+                                """,
+                                (scan_id, lifecycle_id),
+                            )
+                        elif state in ("RESOLVED", "ACCEPTED", "SUPPRESSED"):
+                            cur.execute(
+                                """
+                                UPDATE finding_lifecycles
+                                SET state = 'REOPENED',
+                                    last_seen_scan_id = %s,
+                                    occurrence_count = occurrence_count + 1,
+                                    reopen_count = reopen_count + 1,
+                                    consecutive_success_count = 0,
+                                    updated_at = NOW(),
+                                    row_version = row_version + 1
+                                WHERE id = %s
+                                """,
+                                (scan_id, lifecycle_id),
+                            )
+                            cur.execute(
+                                """
+                                INSERT INTO finding_lifecycle_transitions
+                                    (lifecycle_id, from_state, to_state, scan_id, reason)
+                                VALUES (%s, %s, 'REOPENED', %s, 'Finding reappeared in scan')
+                                """,
+                                (lifecycle_id, state, scan_id),
+                            )
+
+                # --- Resolve findings NOT seen in this scan -------------------
+                # Fail-closed: skip resolution entirely if no rule confirmed a
+                # clean result this scan (all outcomes were FAILED/PERMISSION_DENIED).
+                if resolving_rule_ids:
+                    if seen_fingerprint_ids:
+                        # Use != ALL(%s) with a list to avoid single-element tuple
+                        # syntax issues that occur with NOT IN %s.
+                        cur.execute(
+                            """
+                            SELECT fl.id, fl.state, fl.row_version, ff.rule_id, ff.resource_id_normalized
+                            FROM finding_lifecycles fl
+                            JOIN finding_fingerprints ff ON ff.id = fl.fingerprint_id
+                            WHERE ff.tenant_id = %s
+                              AND ff.subscription_id = %s
+                              AND fl.state IN ('OPEN', 'REOPENED')
+                              AND fl.fingerprint_id != ALL(%s)
+                              AND ff.rule_id = ANY(%s)
+                            FOR UPDATE OF fl
+                            """,
+                            (
+                                tenant_id,
+                                subscription_id,
+                                list(seen_fingerprint_ids),
+                                resolving_rule_ids,
+                            ),
+                        )
+                    else:
+                        cur.execute(
+                            """
+                            SELECT fl.id, fl.state, fl.row_version, ff.rule_id, ff.resource_id_normalized
+                            FROM finding_lifecycles fl
+                            JOIN finding_fingerprints ff ON ff.id = fl.fingerprint_id
+                            WHERE ff.tenant_id = %s
+                              AND ff.subscription_id = %s
+                              AND fl.state IN ('OPEN', 'REOPENED')
+                              AND ff.rule_id = ANY(%s)
+                            FOR UPDATE OF fl
+                            """,
+                            (tenant_id, subscription_id, resolving_rule_ids),
+                        )
+                    _resolve_absent_rows(cur, scan_id, passing_resources)
+
+                # --- Idempotency sentinel (inserted last) ---------------------
+                cur.execute(
+                    """
+                    INSERT INTO scan_lifecycle_applications (scan_id, applied_by)
+                    VALUES (%s, 'system')
+                    """,
+                    (scan_id,),
+                )
+
+            db_conn.commit()
+            logger.info("Lifecycle application committed for scan %s", scan_id)
+
+        except Exception:
+            db_conn.rollback()
+            logger.error("Lifecycle application rolled back for scan %s", scan_id, exc_info=True)
+            raise
+
+
+def _resolve_absent_rows(
+    cur: Any,
+    scan_id: str,
+    passing_resources: set,
+) -> None:
+    """Transition OPEN/REOPENED lifecycle rows to RESOLVED for clean-outcome rules.
+
+    Rule-level selection narrows candidates. Each candidate still requires a
+    matching current PASS evaluation for its exact normalized resource ID.
+    """
+    absent_rows = cur.fetchall()
+    for lc_id, state, row_version, rule_id, resource_id in absent_rows:
+        if (rule_id, _normalize_resource_id(resource_id)) in passing_resources:
+            cur.execute(
+                """
+                UPDATE finding_lifecycles
+                SET state = 'RESOLVED',
+                    last_seen_scan_id = %s,
+                    consecutive_success_count = consecutive_success_count + 1,
+                    updated_at = NOW(),
+                    row_version = row_version + 1
+                WHERE id = %s
+                """,
+                (scan_id, lc_id),
+            )
+            cur.execute(
+                """
+                INSERT INTO finding_lifecycle_transitions
+                    (lifecycle_id, from_state, to_state, scan_id, reason)
+                VALUES (%s, %s, 'RESOLVED', %s,
+                        'Rule confirmed clean; finding absent from scan')
+                """,
+                (lc_id, state, scan_id),
+            )
diff --git a/api/services/pattern_service.py b/api/services/pattern_service.py
new file mode 100644
index 00000000..0a8eb5f5
--- /dev/null
+++ b/api/services/pattern_service.py
@@ -0,0 +1,171 @@
+"""PatternService: detects and publishes security patterns from lifecycle state."""
+
+import json
+import logging
+from typing import Any
+
+import psycopg2.extras
+
+logger = logging.getLogger(__name__)
+
+# Hard-coded thresholds stored alongside the pattern record for traceability.
+_PERSISTENT_THRESHOLD = 3
+_CROSS_RESOURCE_THRESHOLD = 2
+_REOPENED_THRESHOLD = 1
+_ALGORITHM_VERSION = "1"
+
+
+class PatternService:
+    """Detects recurring patterns in finding lifecycle data and publishes records."""
+
+    def detect_and_publish(
+        self,
+        db_conn: Any,
+        scan_id: str,
+        subscription_id: str,
+        tenant_id: str,
+    ) -> int:
+        """Detect patterns for the given scan and upsert them into the patterns table.
+
+        Returns the number of patterns upserted.
+        """
+        count = 0
+
+        try:
+            with db_conn.cursor(cursor_factory=psycopg2.extras.RealDictCursor) as cur:
+                # 1. persistent_finding: occurrence_count >= threshold and OPEN/REOPENED
+                cur.execute(
+                    """
+                    SELECT fl.id AS lifecycle_id
+                    FROM finding_lifecycles fl
+                    JOIN finding_fingerprints ff ON ff.id = fl.fingerprint_id
+                    WHERE ff.tenant_id = %s
+                      AND ff.subscription_id = %s
+                      AND fl.state IN ('OPEN', 'REOPENED')
+                      AND fl.occurrence_count >= %s
+                    """,
+                    (tenant_id, subscription_id, _PERSISTENT_THRESHOLD),
+                )
+                persistent_rows = cur.fetchall()
+
+                # 2. cross_resource_recurrence: same rule_id >= 2 OPEN/REOPENED lifecycles
+                cur.execute(
+                    """
+                    SELECT ff.rule_id,
+                           array_agg(fl.id ORDER BY fl.id) AS lifecycle_ids,
+                           COUNT(*) AS lc_count
+                    FROM finding_lifecycles fl
+                    JOIN finding_fingerprints ff ON ff.id = fl.fingerprint_id
+                    WHERE ff.tenant_id = %s
+                      AND ff.subscription_id = %s
+                      AND fl.state IN ('OPEN', 'REOPENED')
+                    GROUP BY ff.rule_id
+                    HAVING COUNT(*) >= %s
+                    """,
+                    (tenant_id, subscription_id, _CROSS_RESOURCE_THRESHOLD),
+                )
+                cross_rows = cur.fetchall()
+
+                # 3. reopened_finding: reopen_count >= 1 and state == REOPENED
+                cur.execute(
+                    """
+                    SELECT fl.id AS lifecycle_id
+                    FROM finding_lifecycles fl
+                    JOIN finding_fingerprints ff ON ff.id = fl.fingerprint_id
+                    WHERE ff.tenant_id = %s
+                      AND ff.subscription_id = %s
+                      AND fl.state = 'REOPENED'
+                      AND fl.reopen_count >= %s
+                    """,
+                    (tenant_id, subscription_id, _REOPENED_THRESHOLD),
+                )
+                reopened_rows = cur.fetchall()
+
+            # All detection queries finished; cursor closed. Upsert via fresh cursors
+            # to avoid open-cursor overlap inside _upsert_pattern.
+            for row in persistent_rows:
+                _upsert_pattern(
+                    db_conn,
+                    pattern_type="persistent_finding",
+                    lifecycle_id=row["lifecycle_id"],
+                    tenant_id=tenant_id,
+                    subscription_id=subscription_id,
+                    scan_id=scan_id,
+                    finding_ids=[],
+                    threshold=_PERSISTENT_THRESHOLD,
+                )
+                count += 1
+
+            for row in cross_rows:
+                lifecycle_ids = row["lifecycle_ids"]
+                # Publish one pattern per lifecycle so each is individually traceable.
+                for lc_id in lifecycle_ids:
+                    sibling_ids = [lid for lid in lifecycle_ids if lid != lc_id]
+                    _upsert_pattern(
+                        db_conn,
+                        pattern_type="cross_resource_recurrence",
+                        lifecycle_id=lc_id,
+                        tenant_id=tenant_id,
+                        subscription_id=subscription_id,
+                        scan_id=scan_id,
+                        finding_ids=sibling_ids,
+                        threshold=_CROSS_RESOURCE_THRESHOLD,
+                    )
+                    count += 1
+
+            for row in reopened_rows:
+                _upsert_pattern(
+                    db_conn,
+                    pattern_type="reopened_finding",
+                    lifecycle_id=row["lifecycle_id"],
+                    tenant_id=tenant_id,
+                    subscription_id=subscription_id,
+                    scan_id=scan_id,
+                    finding_ids=[],
+                    threshold=_REOPENED_THRESHOLD,
+                )
+                count += 1
+
+            db_conn.commit()
+            logger.info("Pattern detection for scan %s: %d pattern(s) upserted", scan_id, count)
+            return count
+
+        except Exception:
+            db_conn.rollback()
+            logger.error("Pattern detection rolled back for scan %s", scan_id, exc_info=True)
+            raise
+
+
+def _upsert_pattern(
+    db_conn: Any,
+    pattern_type: str,
+    lifecycle_id: int,
+    tenant_id: str,
+    subscription_id: str,
+    scan_id: str,
+    finding_ids: list,
+    threshold: int,
+) -> None:
+    """Insert a pattern record if the (type, lifecycle, scan) combination is new."""
+    with db_conn.cursor() as cur:
+        cur.execute(
+            """
+            INSERT INTO patterns (
+                pattern_type, lifecycle_id, tenant_id, subscription_id,
+                scan_id, finding_ids, threshold, algorithm_version,
+                created_at, updated_at
+            )
+            VALUES (%s, %s, %s, %s, %s, %s, %s, %s, NOW(), NOW())
+            ON CONFLICT ON CONSTRAINT uq_patterns_type_lifecycle_scan DO NOTHING
+            """,
+            (
+                pattern_type,
+                lifecycle_id,
+                tenant_id,
+                subscription_id,
+                scan_id,
+                json.dumps(finding_ids),
+                threshold,
+                _ALGORITHM_VERSION,
+            ),
+        )
diff --git a/docs/security/authentication.md b/docs/security/authentication.md
index 4bcdf5f5..c60d9b23 100644
--- a/docs/security/authentication.md
+++ b/docs/security/authentication.md
@@ -132,3 +132,22 @@ API restarts, so schedule it with any smoke-test or automation owners.
   evaluation of PostgreSQL row-level security.
 - Cross-tenant integration tests across scans, findings, compliance, resources,
   drift, AI and enrichment routes.
+
+
+## Pattern API scope claims
+
+`GET /api/v1/patterns` and `GET /api/v1/patterns/<id>` require an explicit
+verified tenant (`tid`) and a single `subscription_id` in the signed token.
+The trusted issuer must assign these claims from the principal's authorized
+subscription membership. A caller cannot supply missing scope with query
+parameters. `subscription_id` can only select the token's assigned subscription,
+and `OPENSHIELD_TENANT_ID` cannot override the token's tenant for these reads.
+Both claims must be nonempty strings of at most 256 characters. Missing scope
+returns HTTP 400; malformed signed claims are rejected during authentication.
+
+In OIDC mode the normal issuer, audience, signature, expiry, role and tenant
+allowlist checks still apply. Configure the issuer to include the authorized
+subscription claim before enabling pattern reads. Standard Entra tokens do not
+automatically include this custom claim. In shared-secret development mode the
+signing authority must include `tid` and `subscription_id`; possession of the
+shared signing secret allows minting scope and is unsuitable for untrusted clients.
diff --git a/requirements-dev.txt b/requirements-dev.txt
index 32cdba87..1bd3066c 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -956,177 +956,177 @@ msal-extensions==1.3.1 \
     --hash=sha256:96d3de4d034504e969ac5e85bae8106c8373b5c6568e4c8fa7af2eca9dbe6bca
 msrest==0.7.1 \
     --hash=sha256:21120a810e1233e5e6cc7fe40b474eeb4ec6f757a15d7cf86702c369f9567c32
-multidict==6.8.0 \
-    --hash=sha256:003a3bddb32915c3f67096ea41d24e53edf710edb65a1f5d0c70ab40b0e4d20b \
-    --hash=sha256:00be37bde741bf60871082cd347a093218c44886e99231b7516671c70f2c280d \
-    --hash=sha256:029897732a9c798737457e382bf84e8c64237eff224a90aea2639f4413c45e4e \
-    --hash=sha256:05c2e90c5289c5f7436ba2c25812a5fbdaa1c1bc11c8d8d3bbf64f5cd7c633dd \
-    --hash=sha256:071da134651b04a8507dfb331ac0988f376337c2aea59486bf20989fb5b5a64e \
-    --hash=sha256:088b04a66b3c1fce6fe4d771ec184a0426262d0b86709c908477b4ac7965df40 \
-    --hash=sha256:093167d22a8c95af30f597b8a5686f20a14512989942d4be804d119899caca20 \
-    --hash=sha256:0935971bffd0b479fc90c4811ca787703e93fcb6afea939a375dfc80285ab368 \
-    --hash=sha256:095f62ea4e7a3be2f6c567ab695ce10e950f2adb905c1bec82281593e0b2d2ad \
-    --hash=sha256:0b143d53590e89f43153d81d505a8448d4d57354354385aef8a51d67ffefa27e \
-    --hash=sha256:0c1c4debad7337627b86837abdf0237ca3cb3d7e17de7eab0177c263878546d4 \
-    --hash=sha256:0eca15d627e942ce186a935061f1568cc46c02e97c419c8da802df2be9f917d8 \
-    --hash=sha256:0ef606c15cac6c90279acf34120784b6f36662cbf382defd3955cd8f1115336b \
-    --hash=sha256:10456943903744ae1249728161c96bd9d2f7eb5ee17fcc2ffda2dc32e1bb36c7 \
-    --hash=sha256:11d71490bf4bbff1141b14b93af419ad68c56b60bea9277fcb3f94dcca4796eb \
-    --hash=sha256:122adc7c46ac1e31ecfc7f81b2530533dccafdba70f5d741649f87e336c63384 \
-    --hash=sha256:13967dca8b2f33230a1427b52438326bb1c9101a1df22a3309ed3fcbbb3c96f0 \
-    --hash=sha256:13e26f59f0eecfc5f67c663ad550ffdaf62c0f657547cde387f6c86af1c9449e \
-    --hash=sha256:15db8e6cab5f4cc9241bc56e69fdf3452cf49c10ee3c7977c742e68a275b3786 \
-    --hash=sha256:18f0e06360c3e451a3ab800355773c8d125a758238d780c800b0ee5e90ee903c \
-    --hash=sha256:1969971900b0871530f9b62280dcc2d75688e74d2a69262bc01faf2b96c78f04 \
-    --hash=sha256:1b8986d4313dcee7c932837d16a535f1840b827bac1ea7c5c4c80751d0423794 \
-    --hash=sha256:1bdb9b8fba5a9aef673ec90db3f55b1ce743f2fbdea4d37dc04d14ccdfc153ff \
-    --hash=sha256:1f57c414be82490bc0e0305fdb834186229b2d9b6a35fa0afd1eb1a772d125ab \
-    --hash=sha256:1f66fe6a021173d0d47968491791966b9f3e6d61115f2491744aa0c07a6e67af \
-    --hash=sha256:202436df907c15adbb94360296c425ea53cf8968a5d2cff9b5b9790ae1972b33 \
-    --hash=sha256:2196ba6df392c3574acadd14ef87550f3611349c8618564de324b806a7a31cee \
-    --hash=sha256:22a310ad37672a261e55a8b5e28d0ae08cfb68abb1f46418ccd19835c3b8e836 \
-    --hash=sha256:23c9ee89967b6a9b4048acb3b93b660ed714ce9c8bf3bbe652959bc120dc02dc \
-    --hash=sha256:2622fe114c0bd66ca5c461859357587f5a5e35ee5ff49fc5643d1bc78dbb41c6 \
-    --hash=sha256:26a7aafc992e78872e2c8c1f7248c0e01139cf9020a7781b0c064fa566832712 \
-    --hash=sha256:27747162712e85c84598d364425dbf1714ff335bdb6ba3171c4e5081196e8916 \
-    --hash=sha256:29631224698de1e42abc8fa7658d830e0aed0029785144b5832b695da5adef2f \
-    --hash=sha256:29b6e7bc4442a56cf8e0dc1cabf3fdc77cd533568d6829fc76a1effd2ce332ec \
-    --hash=sha256:29be9fd289e9ab8f480996ea2f686e1654b80242033843cb11691688329423f1 \
-    --hash=sha256:2ba9933e8f35fe4a70f540b837254c4055da82dc3a9e500a8f95e61498083a15 \
-    --hash=sha256:2cc66abb85e2108c9ff8a1c0d20fa260bf690bbb33caef4ff3ecb2c2cbdfff5d \
-    --hash=sha256:2cd560498ae8e1bcc955643c1d78eb8e338226d07a983c656ea8c4443d3eec0f \
-    --hash=sha256:2f79cc3e8039a8cf5c77e0811b0807953fd52d0863b9b76970b20d696dc64a78 \
-    --hash=sha256:2f8a4b0b4d639d525928c7f30de527bfdf9ead6e44a5e8cb9c50aced5e4590cb \
-    --hash=sha256:307c1acd812fe897e7fbe10c6758822e8c04be4e7c60a9f54901cdf8b5ab8bc3 \
-    --hash=sha256:3126f2a96704505aa4e92a72d6e8a5d7f29d40a987ced8bf69e29d71dfc71fbc \
-    --hash=sha256:31e8901637e20ccb3cf8f8848b5d0f7a00462bf5b34f7cf3dcbb2753b18e8b39 \
-    --hash=sha256:346ac52e56bcda320c0dcdfdd081947ed7cada33afea4e2284bef7b0733bff9b \
-    --hash=sha256:348bb85e2038b40c007383616d73f734869063772372519549ebd7da1723d1a4 \
-    --hash=sha256:3533a03e4e789baf6a286e7b0b1b6da3f3d7c3eab569686ee29ee1d8b52e2cb4 \
-    --hash=sha256:35977263d9bf506dbc65349f63b3b8c91606d4abc110990945e3b94bc671319c \
-    --hash=sha256:397599503b718f0137f26d3f6532d6955069cd2e5917c47ef581495bc2529ff8 \
-    --hash=sha256:3bafff8598f0528017ddc74194e5451d5c22d046c98935f8f86247b0f286e4f8 \
-    --hash=sha256:3d1f48582686a0a3b81e9b43234766cc96697df72081af3f48107bd3f34d34e5 \
-    --hash=sha256:4261863fc8b5ab1b815ede94e592e94c6af5b04616014929057e61859e7382a9 \
-    --hash=sha256:43a4b56555bbcf8af161e7c7682bd93eec10f068c95844511864c018c8e5e13b \
-    --hash=sha256:45cc39ba50fb0754a4359b90f8229ae08598fe2266abe3521b4e5a9ba916534a \
-    --hash=sha256:46029e6e27a3ec0dc55b53f58df82d10f04c5e111f78248279b530bedad2c30a \
-    --hash=sha256:48ea524a25a1cd5972cf293bc95713918cba0bcd6fa9b992d906c857c546abe2 \
-    --hash=sha256:4ee953a5ebaeed38dc21cc032ed17a9d9782802e00042200497ab4b01b0bf7c0 \
-    --hash=sha256:54af1266710cb0f305127ae0b970aff8d208057f8a29cd6e1db99b0114947035 \
-    --hash=sha256:560b211fc3bd4a1e1c6de44f6d38113bf5b410dfc89a4c0d2a3c0edbf1a0dfb8 \
-    --hash=sha256:563661919f603374c40cf45ffcd25535c12b8954203569a2ab1cee5265871cf4 \
-    --hash=sha256:563d6500ca80dac7bba6f48a78e0ffd87e21a7d4d24642c6503a2ddccd70c110 \
-    --hash=sha256:59e539c4eb4d3a53b0e630a6ba2b2f2824732b5e73f90e30a280f12fde157b15 \
-    --hash=sha256:5bbbb696c8024475b1877d14ce20d5f1cc05b8f6d786cea0fe3aa7fedc02e891 \
-    --hash=sha256:5caf684986a2490628f059a99dd107b566a2d34cf947f8eb8387e0500a1f90c5 \
-    --hash=sha256:610c7637bc36b90f39e6c66f710f93d57018f83d53e1e187caaa218c6892b95f \
-    --hash=sha256:628ff11e6720f90acd0c305dfa3339f04a783a20de8cda6ac333ba46447261e8 \
-    --hash=sha256:62b8e291a4f7edbf7cde7a43d831d893ba443a1b627498b53581943b0e348feb \
-    --hash=sha256:6300d5176647145ba1e22991c924fb29743e54b4d7b8bc85a0d3ec0e55e189cb \
-    --hash=sha256:64eaeda36ee8d88f9e8616a587a8c66a663283cf6e0dcf013c1ddd8c758e4aef \
-    --hash=sha256:658f5a1895b804423d97b22d06fc0d0b171c7c01dcc3aa9c8faf0c0e26a249a5 \
-    --hash=sha256:65c85c79f5a2c04fbbc18f006c014674dc5fdf270cb978d8862c82c6f694e60c \
-    --hash=sha256:68186a2d4051c8ffd17be33553bea2ec9bbc8ef860fe2980a221d96126296f31 \
-    --hash=sha256:68d40b2bace413f3231f5729d3fcfb1837fd31c4907e241b5d43211bfd76f3c2 \
-    --hash=sha256:69708fecaa88bcb2341397b49fc95057a835b02a3670c551b37f95dd79e64e3a \
-    --hash=sha256:69b3e519a132bb943b0daae15fc8c2168706b17f826481d32a32a5e784b129e3 \
-    --hash=sha256:6b62b7e0025aa48dec11e125e655d1157985a5fdcec04b1ad500101ad072b891 \
-    --hash=sha256:714597cb5d5e15a8a449d2ae23c45b486a9e8fa33c462c7a33d7f35b65d92943 \
-    --hash=sha256:758233648ac47b07c575224c4eadd73c8929c3b4c31e2afcfea935fde1cda735 \
-    --hash=sha256:75daa15ca16d6285eb2e104b2f05ee6f8d9836c68da3ce5c85f615a0450eed0e \
-    --hash=sha256:77745725125d01fd613b6db043362aa7c6bfbfdb23d45dbfc3d92bf58160af62 \
-    --hash=sha256:7941ef106ca1f2c62314a13c7ed913bcf49641f3efdc12864d588e17870920ac \
-    --hash=sha256:7a2573d0fd34f361a4a14e54d8cda3a91ac4e55fbf0d719698024f3b09c5b147 \
-    --hash=sha256:7a62e302fc8cd6aa8972207e7e951d1fdee7c1dda18568305041d19f0e2c00f5 \
-    --hash=sha256:7bb0dad75068fee80fcb60f88569722c199d8656a16706702dc6e3b786819c90 \
-    --hash=sha256:7bc7003991ebd368a20d05228137a37b3d3066751f3ea1e4f7b8efe8e752f2f5 \
-    --hash=sha256:7d26dc8f070c0ec5579e987fa615ffd6883086106eefdff9e10d160fc5630630 \
-    --hash=sha256:8125e60f3c70e323ac07dd8b3635f7b3bbc5c3a9ac04ae5988f668ff7ae28a18 \
-    --hash=sha256:8180b635290a75af8478f1b3e9810135381ae24833293fe77b85c1c21ff842ab \
-    --hash=sha256:82780eb8bf59e8fb25dd081fde6e058805045d6374a7f2f877effc826ca4434b \
-    --hash=sha256:835d5a90b11d1f5f8200ff3cc8316bded76eebebc92436398947a27657e645e7 \
-    --hash=sha256:83ff054b04915be5c15680da6c6012474a2cc2bf534129a0e8c6a99f17ba7238 \
-    --hash=sha256:8457aff3c12a89a8e1c4674de5c777857fbc429f40fe117a3d29538547cbc364 \
-    --hash=sha256:847d6082ae694dc95e548acb201bc100e1cfa96513bc71fdcb86f709dad6c435 \
-    --hash=sha256:883284137e25318ed9735b742ae46341a864888fae28e8b6314c4f84da080f08 \
-    --hash=sha256:887f9a975996032c686719eb7b3e1e7942fab5079c2b778bbd9afe9a9d78244f \
-    --hash=sha256:8890c89d662560e51c55ac1304d6f919b23942abe9ae1127cb1de9aa6132fa52 \
-    --hash=sha256:88a6df88567680504ae28bfa7a1f2f64243d91e79a40b2c92ef42efc531e23da \
-    --hash=sha256:8d1046b5427dcafe6e8a0e07527dd74f1ee694006160162f53f3a17f15aad3b4 \
-    --hash=sha256:8daafaa0b2eb43f76898ced78b1e0fb91b38c4fa50da516c18067f2a2d578c20 \
-    --hash=sha256:8dc2d9c3a924ed14166e63650b2cf9f59e7821743bdd50b23802bd97ca09bde5 \
-    --hash=sha256:90c10b22860dbd09982d0b8993b66231a861bea2993d4a817ff35273f6ea285a \
-    --hash=sha256:91fa75d0a693832106d98f66c849f034f21c828d14437f1fb97d3784aab89e84 \
-    --hash=sha256:930c6058047410e3edff445f5a6e4457f2e089042dede00e2d18ce06f3ceae2e \
-    --hash=sha256:9442b14eec262a1f74369bbd07e75bc5155105164649a4b9fbc1ebc7b8fb0b14 \
-    --hash=sha256:95c27b4f3f04320fc44e338573f40c5c956b504a7fcf081a157fd0b02579311c \
-    --hash=sha256:9606f583e7acaf61e7b3f56074e14037b9af7cb194590edfc0114b3ae5931ff7 \
-    --hash=sha256:962f18c59a000f30b084ea2e6b8001521bb315efd4e5f10acf9fb36f366b7882 \
-    --hash=sha256:9caef53b20a105c0d66518a34be2f71b2783de8d091767575ef86f6ea422236d \
-    --hash=sha256:9e37024b41d7a7e7e9cce14b248d54707c21c2a2ea30a47b71bdcefcafec00f2 \
-    --hash=sha256:a5a7ee1217949ddd43c6b7bcf70d5c22193bb50e8c695386de5905325e93ce9f \
-    --hash=sha256:a5e1583c14775580da05641240ce0d93f36ce3ddef3d5083a827468b0bcfe874 \
-    --hash=sha256:a9e246f67ac038568b854ed7c5578e4c6af1f742359901a8fcc3603ff1358df6 \
-    --hash=sha256:ab83fdd8cf307353edba9c427c17a3a021c2522d690f5633dd9f72d28b48ccca \
-    --hash=sha256:ac746cb365bac1c462da9e3e6ab8904a8efe2217a56b0b2e3d9480f41d2b2602 \
-    --hash=sha256:ad474c11d851b6fc97cb625e4822bc0cbd567fc07dc2602e28faec5a36b42bbb \
-    --hash=sha256:b03ca066b47b18b205cc080dca6f76cbd159f8cdd33a02a0700164c13b37e463 \
-    --hash=sha256:b1cd4d66ce894a45482e1ac2837c31d0bd447df35065e542b60055aa2d00404b \
-    --hash=sha256:b25426f9f6ed402835617c8f23609a47045f91ecff365eb6734817e039a8ed25 \
-    --hash=sha256:b367c342327717d644db4c0ddb37ceb655c84822215ea0773a3a36911b74b71d \
-    --hash=sha256:b7e62b8fc7bd6cad007b9f2e0ad9c8d4854c06350d5f51e1a439dd18b510ecac \
-    --hash=sha256:b8b7aa75146266fd3e2a2437cf69ae188688c04ab8665b163d4257b46c1e0c83 \
-    --hash=sha256:bb36381e1f9f9d06eba2f10bdd438e5d20c07d5b55e1a3eee30b9f44cbf52316 \
-    --hash=sha256:bb8c7da8c861391f7ae48e3593762be2dabe405109e01aec520fbe1a6d15d14b \
-    --hash=sha256:bb9a60b7faa5d37c426fa91cf4d6738182a1f2755b9fab7c9c64cd466c4ce51e \
-    --hash=sha256:be007d1aee2cbd530347dcafedb400891a3b5f1bd7135f95cf5d5b330b5219ee \
-    --hash=sha256:be569fff1d85cd29391c431c5641c8772acb75bbdc61e60a8e82fceb9023d385 \
-    --hash=sha256:bea7df027015856ba5d0a88e3b4777ff8cb5c66b58fc108050fe79d4dd9d4d2d \
-    --hash=sha256:c0fe437a6d2f36aac2b49517057776575b5bf359df314cca20d230a6e139c089 \
-    --hash=sha256:c2b2a96cf1dd99fe7867be4c013314225f4d5786e6685906e29932d42aca6f11 \
-    --hash=sha256:c2c5fd0fd39574ccd58e1a52565b341aff522c5c836f1b3eb7605c371e61f52c \
-    --hash=sha256:c46a08bf070d6849fed483e9d9833f9d06aecb8382ed985be0b38508b3ae958e \
-    --hash=sha256:c5f3a2af441670d80ce5fdf13b6c1b421fc1fc7fc5182d58ac7486738bb2b742 \
-    --hash=sha256:c60e50bc5b07faac92fd3a20fa21cc8cf3e3f7204d2867b206c73293ebc19101 \
-    --hash=sha256:c68e0c0649d17c2d0339e3674e86a4aeba4a7e6b21c1e394cf947a95433b31d0 \
-    --hash=sha256:c9c98d2f0126ba84cb45601eed97ff67ff767e19ae6eb3c31b02827b54d700e5 \
-    --hash=sha256:ca52b9ec80851366197577154c862c4c4c7036ca76ae94cef5cb59c5cfeab944 \
-    --hash=sha256:cbd86f9787c5e2f5fd27d8b21458222f107347c6731c4e93dde68f554b466a2d \
-    --hash=sha256:d0264f8d5cb0a803f650a6a8572dfa0cd1e099a2234c588dc8fb220b415b865f \
-    --hash=sha256:d0be2b832435001bc623ca7f1499ca1a853d4f082fb61221a80ce71132f50b26 \
-    --hash=sha256:d244cf6b52b5ba1c34c3832f4652a668ebb36d95949b96eed9a1c54d916a90dd \
-    --hash=sha256:d2d236b8a44ae91536a12ebcb996bdb31cf27425f36b4d05c87f2ba2716050ba \
-    --hash=sha256:d3da668e903c934ed0b587ecacfed6901f6ae6384a6e975887592b61845e78bc \
-    --hash=sha256:d6dc7804c50fabd28644d4d18a4b20aad3681b3e64f3acd3182b330ca73f7a32 \
-    --hash=sha256:d7e5ba0a0153e35fbce9c51df530c8b4cb0c3012b46a04ff9a048441a269c2ed \
-    --hash=sha256:d8a5ac357ac283490a8d1899b0383355fd1f8634b14ba0d59e4c0dd97db85556 \
-    --hash=sha256:da1c112c5784ccd9d32cd90be6739fee32644e874eff6ae8f0497cba3e352e58 \
-    --hash=sha256:dc911ae6152e455b16a2a1a626aa6cd612fa01efb9d0a4ab3f5cf328b911483d \
-    --hash=sha256:e0db3a4d1e264e225037a6023888972c25206a96e016021a5bea41c9a939f2a9 \
-    --hash=sha256:e192018b732f7b168e6604cbdf40fa8e05c996693b9eb445a0d8a73f4b77c5d3 \
-    --hash=sha256:e37b744849fb631bb52e3dadde35ffeee365a6c41cf71257b5b7acc9cd83fd38 \
-    --hash=sha256:e41226ecf607f062fe34a2f4cf64ad3a89e3a0180dc800b463b6b14c06dd10dc \
-    --hash=sha256:e418ec99574ca24365ca96546af285c2b021a1a072478a79f0e3cc3b08837154 \
-    --hash=sha256:e6ec7d37841609a691b96a10b4fde386c7cd93ebbb939f59c9f23325ee788395 \
-    --hash=sha256:e886ef8c9879105fe4fc99417447b3a5f35d1131412ce839470bd2089fe2043f \
-    --hash=sha256:e8e1e895e23818d343e4ae7dd95a0a556fdeaf8b471acf1c0a39b93c6f54d478 \
-    --hash=sha256:e9dc7b4ff6ef184504b49ef9a4113d49a646653b2ce89f5f48c1f57cdf6ba081 \
-    --hash=sha256:ea880d441be7c510106bc56064be39266d948aef94ad4955e8784690019a5d9f \
-    --hash=sha256:eabb03dc3e4ed6333ecd1cc9826ec80e7a98b5506deeb832d7260c8e44166d23 \
-    --hash=sha256:ec0a4d066356054d569a66e0a94691a2058b680be5e710298f61db11a3c4609f \
-    --hash=sha256:edda19aff836ec515caafc09ea53d2ab144a041f09ee9a7cefcbd3ae4e976256 \
-    --hash=sha256:f1f4a220db6ed7c8fd16b6d644ffd1f082651693204daf3275e049fadc849e39 \
-    --hash=sha256:f25b61a708bd276e8cbb6afcbbf1b8e793a3be70ba0a842d0b8692020f83b706 \
-    --hash=sha256:f2fa3d3b1c933d4bcb8fd2018700d5e7235c52f2ab8c88d22286965c5c0f00f8 \
-    --hash=sha256:f3071e6515cc63714d014da8f738ae9fa3997c476203f3cd46de380c2376ed7b \
-    --hash=sha256:f3a0a31189acf6703307397c6139ddabd734c20c5ef92649fc93e473df6615a3 \
-    --hash=sha256:f7eefd0233a7c33ca980a5cfef26f1e9b5e2137839e752a99963696729f12d91 \
-    --hash=sha256:f8b09b25e0f4dc2ea9e2adbb1cc3ba11a94d6fa3dd978ae659c8743052e1afbc \
-    --hash=sha256:f8d7b66c9e09c0bb0add2b5895e646b62a0849e71155066f215523de6b95cbe6 \
-    --hash=sha256:fa6c2880709c84457de104385b704fc28860f27e442ad13966fc4af8e714fe9c \
-    --hash=sha256:fc5460940f50dff00731b4132366840ba9685286ea88ea104b661899084f3fea \
-    --hash=sha256:fd789a294d8e098528be29b2669b83005ce569339f8cef167fc0274c3115c34c
+multidict==6.9.1 \
+    --hash=sha256:006c4478de0a1876f4834e14255776286f09b9846b505fe63f67f9d173a9487c \
+    --hash=sha256:024123f0ab402ab33828e24eb80fa8f25167d0d3783ba5f287e39ed741e6abf9 \
+    --hash=sha256:02f6d0c4b70f783305e73f9944d8efe6be1022550f0974ba0ae9d8893c0350fa \
+    --hash=sha256:02fe09dc197b8ae7e355371e51e5dce2f39060cd5a8badf94904527e23a3f188 \
+    --hash=sha256:03731f6fc036180700c9dc2308205a48e5ca6f3ff03087739ab746f294022201 \
+    --hash=sha256:03d47df72f084f757c1cb771188d5f4e3a805e4abc4d67e32509272343ae9382 \
+    --hash=sha256:03fac50ddfd8302175b77863a015eccfae76767cda5506eef86df559ba861e1f \
+    --hash=sha256:042fb0196047e786936a730bd302de83143950da45f2c16078da8f35e1cf7919 \
+    --hash=sha256:083735b7f395894e43adb278d5dae901448883a835ff8f1977e285fefdb10418 \
+    --hash=sha256:095d900c242e00fbe5f321ee072e7278b4153e78c5ce9c1efde167d62c1e4771 \
+    --hash=sha256:0a5769559e3312dd96731fbe15b4abb6033368ac1cad5a98dadd21946a4c7d6c \
+    --hash=sha256:0b2fb8c349d1103863750b5d8cb5ace766917f4b35f3d883c8f778853eaa9f76 \
+    --hash=sha256:0dd655518f136febd96c05131a76a863e32fc2a1d7acd4e3c959e3ceb77d8345 \
+    --hash=sha256:0f2ce963299d42fa3f22a90adc0fdf174792ffef5ff4c7ffb68260548fb05580 \
+    --hash=sha256:0f3bd290711c6e9486173a6ee7cd4e7f00c3971c7908c1ec1b6e5437c5e4c6f9 \
+    --hash=sha256:10083a8a0f4e1b26b599889e90b9802504ce5d3f7722f925bbb7ca47dd22a7c1 \
+    --hash=sha256:13849a1d4f54c3809ae721e9e83ab28f5ea602f33660cb84eb6ef261eac706c1 \
+    --hash=sha256:14c56f73e78faa1f68bbb826197cd5871994e70e841b8590829c35912ece5c64 \
+    --hash=sha256:15db6a102cbaf1949cf028ecf080aac76d20bcd29ad4e092574db6c6b7af78a5 \
+    --hash=sha256:19e31815d41cefc365489e591d105d2baceb2f65aa75d29471fbdbda8651e006 \
+    --hash=sha256:1a53de2772cfb74559df2eb4456ec4eeb908435ec55a84b69370d9d745d62aa8 \
+    --hash=sha256:1a8adfcaf96f587ab138476eaddef95f29b8a2a8a9afbfea8d2fd62180995d02 \
+    --hash=sha256:1a938761c77e0e6edb0c93d02f4e988d44a69e5195e5a3b893e5553311347132 \
+    --hash=sha256:1c9f3c25df6c9d3bbae4f6fd3f514b1c5c740a2110f56ccf36069c85417e289c \
+    --hash=sha256:1ca5ebe6d454f1e5496cf052386a559f1080bf2de75bf327ebca0a6003b79f19 \
+    --hash=sha256:1d804e4caf5d5da37d6dac1325da5629ebef1e27a294c2b568b295814aa36c7b \
+    --hash=sha256:1fee9a16d88a1c4865610de31ef5c666671020d7a81d1f510eaf3c97d00ebeba \
+    --hash=sha256:23136f5a564654eb61061ec6d5620a4c1ea32c8f552b65e9982a12b72bff601b \
+    --hash=sha256:2784090c30a586d5b45197bd9c32f87fb927216cde302f6cfd76d76577e90f08 \
+    --hash=sha256:29138fef49828542e859828107e42e50d0e587c513b7eb4b2d92bade2b0860fe \
+    --hash=sha256:2c1aeb92eea59d824f004341b26d5e4b47a8a441cf9726769b9a90abf9d0e08f \
+    --hash=sha256:2c5d675da8f1cb5650271c8ad5e95c0a3e5a183c105e72d953b12877b1c8d0fd \
+    --hash=sha256:3100d169ceb7bc8f05f89a6db11d1b21f119975fc26f29dc45a472e3569f0879 \
+    --hash=sha256:31199204b3ced121ff5407a2c342326a5d27e3870abbf94bd80dbd2451b7bc8f \
+    --hash=sha256:32217133dddc58c927805cf6c0731d8144584176b768042ee886d51e71860bc9 \
+    --hash=sha256:33fa55b990f81c2927e01399ace0d18926c69d69baa8cdaa819424132fb97987 \
+    --hash=sha256:35ba0263bae5dd3ad5aad767cc9afc01a8598c7dae30f1b3b2de98b1b32c28bd \
+    --hash=sha256:35fc236507fb1b3138f0af5ecd5f94ed752d4d6d826248eae425f86204013eea \
+    --hash=sha256:361f7206cf341ba94fb015688f5c8b480f8e63bd58a4c14a48aeca7851a241cc \
+    --hash=sha256:369b5aa01b241cd3fea6890bdbb11a1425d87bf1515831500d518f4223e9d72c \
+    --hash=sha256:37245ca4105386194dd1d292a6f2aae09bfe1bd7ac6f9ec25093e3cf8e9b143b \
+    --hash=sha256:372c063f37480f62c1ae32dc3a1a0a5942b180c883f99789075a8a8ec3c4e709 \
+    --hash=sha256:37a9ebe00c698279213d56e6c64e1962ab1e092918270649b397cac3dc196ca4 \
+    --hash=sha256:38c9986f9ce50c459b10de216a05f4bd7ed5ac63887d56e500a52bb464b861ce \
+    --hash=sha256:3adf06c66041aa21eeb8a71e82379b74773298c8e6d3d839b151aae441a99b94 \
+    --hash=sha256:3c95601ed98fad3f6e2f8fe809c3b526b0fab31ef525e00a155e227f3d17f58a \
+    --hash=sha256:40aec5299e1ed71fbb988389059da381c3c1a60e0c649acceb2a35d9b128848e \
+    --hash=sha256:43124fe172ada86d03ac3c8dc8179091341f6724d5e5d5b160e1587e4cd3761b \
+    --hash=sha256:4736d350371337825cac1793c9f7c40701c32a03912548c2a7608e51679cbb96 \
+    --hash=sha256:475d04d5192eba487a3e2f935976340baa24529046e9c1c9c7a3b7bf80445ae1 \
+    --hash=sha256:4a409ccc42aefec904038695d5d7fd6d8f3af2721b7b6401d55135ec7d6d298e \
+    --hash=sha256:4d718fa1b5f0d0dd75e86fbbc5b0c93ea3a5d65216c85c61cd5d7cdddfe08455 \
+    --hash=sha256:501ed8b02a5990c67a91c732843609d43a6be1f7576fcdfc867331239f37fbd3 \
+    --hash=sha256:539c2cd5fed0947c135cd7eabaaac55f48300dfa1de0f3ca4edb5efa6606f471 \
+    --hash=sha256:557a4e1708df428ebe6c3081c83a273d275dad2446ce0d81fc648ac71afdb18d \
+    --hash=sha256:56d834b74c993a7d7cb2b8ab33a0d55c3e0d4a3d2f2da2808a4ad3d79189711b \
+    --hash=sha256:5800368526647146978389dfaa46da3356291e9f0fff9a4ef12e8c2bef964a0d \
+    --hash=sha256:59c123d0e948d760a5f930f316cfefa07e8d632ab84327c0693ee6a88171154f \
+    --hash=sha256:5b30ddf7234e611ca877575b62840e6af5977f92f1f9d532eedbb05a44ff8004 \
+    --hash=sha256:5ecace251ccfa705bf3d7d35c5032cf750f5c629809740405697bce5c118c4a4 \
+    --hash=sha256:5f89dad732280e7a10b74d40b91364f88e13c3f2c08c2ef83a8cd42f7a61af2e \
+    --hash=sha256:637f4ae36264bd7b8d9a60193acddc1d735ad52e8ed53a19931ea6d921fea8e5 \
+    --hash=sha256:63ada7ee2e9345695f9e9bc4c65d72222253f07b1ac94fd0e37555cc6f3c7f60 \
+    --hash=sha256:6441cc837aea58be7d9baef1b2383eb8311ab9303f500f99ac90b584cd78bb14 \
+    --hash=sha256:658f90f49cf5af2441cad0a2b801c3ef520471989a1ec55bcb25b255b2ca8d2f \
+    --hash=sha256:66987aa68b0f7c2a1cc5f388ca962b8ed92b10f79de38d6d0d8c716154f519d9 \
+    --hash=sha256:696477ad71385c4795e3b8e4cf10b0d2c28c2a1ca6a955e031cb1e62993e9ee3 \
+    --hash=sha256:6b7e54fd883671d1a8810704851c044b7173287c552b9f5c3d9e0eb9f00ae194 \
+    --hash=sha256:6bc94fe17c3c56e5418f79515b786b101845f70609b0d19d0c1ba13448e5633a \
+    --hash=sha256:6e6b7e3a1520c39a2772f414cd9ddf5995f77e4e823dfa1522af383addd465a3 \
+    --hash=sha256:6ed30be8918e18c8bed0a2e8b70639ecf02feb61ed00ca2e41cfcb2a50fa3f42 \
+    --hash=sha256:73533644e1f69ea1164d56cc6505f564c6c44072b646b66d67df2d31fed0348c \
+    --hash=sha256:73bcafa21a78d0776b3ee7cd2a63c66f968eb7db8e8d594e32d7329950f6e828 \
+    --hash=sha256:7814bbee202acd3bd240204c17d8b87a4c48c81064fd8674dbe527d94d5a4290 \
+    --hash=sha256:783ba7d845d79ce976afd9c1e91a4e5714671defa198ee789e8b23316083a485 \
+    --hash=sha256:79da2491348b30810728050b4a8ec0416f85884125c2fd44655b3d01150d9c3e \
+    --hash=sha256:7a0c98f6a636adf0d7edd60c61589eaf52d149239af754d0bfeb0effedba53a8 \
+    --hash=sha256:7ab379f95caee071a37cbd8be86d4c65accc651d391f9f97748fef006f38769c \
+    --hash=sha256:7bf6478188f4e47bf5686e8a33da4ae28bf43b1b2528d9ee144d28492bfac60b \
+    --hash=sha256:7c6eecfab7ce4cd9487ff8ba936fe38cdfd68c04faf3d5c710363c6a8e695659 \
+    --hash=sha256:7c708566da8014b120a64b1eb6d200c6c0c8cb36296383723cdb6fc82038270b \
+    --hash=sha256:7c8d5882ba25ac0282258be435d8a05aa0cbcacfce15799154a338f847f159b9 \
+    --hash=sha256:7fc59e9ba821b220944ccfe0f89c9dc4745f6d097569992356eb03869f21e953 \
+    --hash=sha256:7fd79c521f6290c69125fa2b85fa65d9e657e6a8ffaf722dc881b926bef4aa5c \
+    --hash=sha256:803f8b575a71b1b299d677c28db0653459c79b5308874efec813f17b7457c7f1 \
+    --hash=sha256:8050e75af7e4c6e2d5260b84eeedb618f3e452e66473432e085b5d1b81429299 \
+    --hash=sha256:81cdc537e0a42e3c0170752fcadbe450246d5c3b4b7231d6eb9672456605ac94 \
+    --hash=sha256:827c92145b3b976b39430129c89d213b250dacbe5fce678e9a03940e6e848983 \
+    --hash=sha256:854fd2f1bc6e8a56b89910b5cd7261a8b40f13ebb31572da985ce59c7da0886d \
+    --hash=sha256:877ca17fdcfdf5c397493a71e5ff97a87bb181417fe717fdadc77c08c09301ac \
+    --hash=sha256:87cc632c88ee5dc80e12681047839304d98ee5c9a708d686505767001c9b8b9a \
+    --hash=sha256:8879510a76940670517ea1cb589978da44b86e286ec3e50d664ef330817afce7 \
+    --hash=sha256:8885e3808aedbd6725b921fb67dacaae0678933561ddd47c2b01315198c70e2e \
+    --hash=sha256:8b193bf7a443c97d81c47052f60c486071a4bdef4a573fa2514f920089414d45 \
+    --hash=sha256:8ed78ccad4c7b421804f5d524b7740946a7ef75d89dc0dac52e9d7c24c472410 \
+    --hash=sha256:8f2973bbd2bebd9d2e0cd6394c1292a1a19ccd56bdcbe1e174059f1a39be5b40 \
+    --hash=sha256:910d4260512660484c0dc1588a316fbb35a40c081c36fc51d1225351af17cfe4 \
+    --hash=sha256:95052e8777a86bae87c0bd0b5ab22d809e3d1d02bf69e3e66ddda5ba75a05805 \
+    --hash=sha256:95f273bea318a194f656527ee2ed19494327bc500b8e87d9358e3222579aa28d \
+    --hash=sha256:963a8d8f97057082679523d0fd4c53a38f86bc58cabe4556faef682ae53fa2fa \
+    --hash=sha256:976fd7689d69ec78d67d31d38d396d8adb562f7e8368279f76aed4aa451fa06d \
+    --hash=sha256:989261c5f1735a165f2e4e87cf6d5f17ab734fa18f9ad0383d5adfcdaefce701 \
+    --hash=sha256:9ae9614c317c50836689ce2dfde07c05fe0b16378562e2221746c3913ede3c80 \
+    --hash=sha256:9b0124b9c17e9890f0819b2e7a5f65ec9a2f5aabd6c8e7ad090c1675cf70dee6 \
+    --hash=sha256:9c4880d017555d70dea367dd49271830842d48e3891c2da97da7ce8c4abcee40 \
+    --hash=sha256:9c62e71e6289d78c0108d8aeb495f8bd3cad4bc1632fedddc9297ddf287ecc20 \
+    --hash=sha256:9d0a21cf76153de8f2d96a877991d6bc59b9ab5180b949e50db73cc193b4a694 \
+    --hash=sha256:9e14d17773b1b3c758ff153659a1824608a0cb562c45f484b5ed8a433428444a \
+    --hash=sha256:a16a1dc8529f9e734a41c3b856f3eae7ebacdc061dde3f8a844e0c7889c97203 \
+    --hash=sha256:a2212a0c842c723d919ea4a22a9296cb6b244b386e4e6ea92adfc7fbf3095519 \
+    --hash=sha256:a313bad717dde740959d50850c315b75fd4eb0c5e6b4dc8535db0f1c369be125 \
+    --hash=sha256:a32b78c1e52ebd8e247bb68300b90b233300d8816faa008ed0713bc539fb6af0 \
+    --hash=sha256:a3ffe881246d28a862f1985824f484cb7361f44d6b99c4c620436ef56462f38d \
+    --hash=sha256:a49ff5cdb33654cb7d6a3c377aa2a83ddefaa1db31eb10bcf3c180aa84f9af8a \
+    --hash=sha256:a8b75dd3d3638d9a19f23e84af4ffab3b8940422c0df2da2a77005ef5aa3d7ea \
+    --hash=sha256:ab64ace1a68682d191d9bedd9d4c939406ad86b1d9f628180410644249ad46c2 \
+    --hash=sha256:abc7c2e4b47bfe6a9aea434d3fdebb9597ee636e914e92ba352f2068b9142f4c \
+    --hash=sha256:ac348379cf4de5538a0a213be1532d289aa801ec5d267c5909446b9ea2f8e2c3 \
+    --hash=sha256:ac51cd64bae51c462ea58ad2492c9b8209667a4ef60c45c4a304518b67598d5d \
+    --hash=sha256:acddcac38adc8342ba48aba98896faa7928854bebb62542362138655b5367ee3 \
+    --hash=sha256:ad4528cdce058b684f75fad1faf4a6a6c992fe2f08376370ca66e4ce5916a84a \
+    --hash=sha256:aec65b53a07f580606593f877eefbb29a45939bfc0d3fe6e6d9f42b41b749f68 \
+    --hash=sha256:aef74e9beabbd6c4aafc091dabff86d046ccf013ce1e4396c0fbb01b4cad9de8 \
+    --hash=sha256:af1b5a92315048c3e36bbebfa7d4760a9c3e910bc4166f11b20d77d20d6bcfca \
+    --hash=sha256:b22ff30006a2f28f8bff878fb93413cbe3a4d1fd517c28081d848c90e9cfd2c8 \
+    --hash=sha256:b2483da477932ad1983d1d33c18bc3771c6fb00cfbaaed70a875fd547ef8e840 \
+    --hash=sha256:b2f0adc22a4eb31e545221d93fc73a0f6a8cc2379d0f4309f71d1d17ba938b82 \
+    --hash=sha256:b4c9e5d05b126b267ac048a89a0e2d9b48b1b648add62d4872906304a8590610 \
+    --hash=sha256:b4da208a63434d21a3df64d29758e650fc4aa8cb05848554b76949c296539cca \
+    --hash=sha256:b5f8771aaaed7f80e84a4e471d2f29ab6721e4595075e54d03ae1ed951b2000a \
+    --hash=sha256:b65121091567847a8cb520d364ab22ba90e00d3cc55fa9eb34bb439f0684bcd1 \
+    --hash=sha256:b66ccc5c2cdd26e74fa5d4c29ffae424cc6148bf93ce574821783fb3b6d452c5 \
+    --hash=sha256:b69651732c64afb691e50cdc3387cae305e0eeff8804fe3e3ce203876494932a \
+    --hash=sha256:b828cf64d62dc09ac183f03c1aeedd164ade96a2ce4934109452edf29de1dd13 \
+    --hash=sha256:b8a65621b98984a62e59403009591b8a5a7736273aefe1cab64cfb85b365cc07 \
+    --hash=sha256:bb0d664505f4b112f384cffeee82e91e3f6448d8e574989479db4439b68cba05 \
+    --hash=sha256:bb58ba73a3f96f9a3e46b1fab69929d7edbbddb3133ee74b5c3c54074a53c4f1 \
+    --hash=sha256:bc94a68ea5e18f8e85dc6b522bcb53093f692c8eb62b4837ac047da73956cbe4 \
+    --hash=sha256:bd82c4977196681a499bb6ca9e462afbc5c91c1c15b6a991dfbd72733fea4dd2 \
+    --hash=sha256:c0c88085affd35c33e124e36930c5ad96aff9294ce195eaa0fd9cec962b64a82 \
+    --hash=sha256:c148e8b596000dd3e4bfe206e70f3e666be18d72032e0012555f2373c52e35d6 \
+    --hash=sha256:c57541034d12b215ab0a2bfa371d1a8a198da18176d0426c27105b9161a6862d \
+    --hash=sha256:c9648ed33dc8179e4ec04bbc73bd7f0038e1e81217a69467f61f02a78bf07e88 \
+    --hash=sha256:ca65cced0d67a9039e93bcd98a369920e499bf98296844ff56ead01c9085321f \
+    --hash=sha256:cf22b43f35b7dbb9f71e8ee2041b5c00029cdfc28ede3a2f31cf8906f9a6c126 \
+    --hash=sha256:d35a4f1c63f07fbb8c8f9946dea98b21eddf6c57421585f71d91864be3ba2a24 \
+    --hash=sha256:d3b6e6840421c83ccb60398e333b44f910b0907bb409597685ab2eedd1e22eab \
+    --hash=sha256:d73fed4e37158ff00cd271871170b79e40138db51e625fd352fa17c6acb34f67 \
+    --hash=sha256:d7bf9e43282d69561618e8a0ea33368d532ebef42f15c096f427090521dd74f3 \
+    --hash=sha256:d9d6544790ba50438a9c1a903c3c4afb1ec8a7832db5518549275b40ef0dd4b1 \
+    --hash=sha256:db4d697b18b6ef5528b1f36bfa25072cd2a421869f5963bc0e92c8a34b9e2800 \
+    --hash=sha256:dd9a137a4a9becda3094f3831cd026380f75f6855e051eefe4c73ade524f1cc3 \
+    --hash=sha256:de7738b8c0bb74c4cc16bbd7fb49fc2bcf6430dba11b3432cd52768ae40933e8 \
+    --hash=sha256:e3b1aa25f01238886a6baed9e13b9a9240ed344346c79ae280ae65e8603b21d5 \
+    --hash=sha256:e58952f04772f59f11c6e007471449809a30165188669bca8fdb19dde40a8f24 \
+    --hash=sha256:e5ccad4b7bac125722f48d6f862bed3b514d8526deea06316bb72f152cd30a7c \
+    --hash=sha256:e7386aa18d98d6b8af44b92173654ec469237fda35f8e8523e43b581a86f476a \
+    --hash=sha256:e81ae656b9935ac4528a71f96bb7a14d949778ed1897c573d3e7ebb9187f8841 \
+    --hash=sha256:e8f1e362c9352b50ed120f001046fdbb80810c9d56580f4c3fc13bbe30823387 \
+    --hash=sha256:e96ca64383efa107262ee3949f047af5ee4f1845ba09463466c04d35a83bd3ec \
+    --hash=sha256:ea999ae6e80e66ad5eea287860951b033d0104ca34d6d87c7b5125ebe0e12721 \
+    --hash=sha256:ecc89dbd4155b2f8a47f4bbd89242a35ed15e8e0ec581cab5ac65fa38407329d \
+    --hash=sha256:ef01d29fca550ab871fd99154f82c6472aacf8e7def272dfb07b460123850390 \
+    --hash=sha256:f04551dce5a7db8c9659f2e4245494c182d0663b83661803e08d46bfcae5eda1 \
+    --hash=sha256:f0700527dd5bfa8b7204b08330542f4f388899d3c14d885d8a368992e0eb562d \
+    --hash=sha256:f2524ec55b3e65cbe235a8b3c36e2af3b635be02ed05e20c94e70c5c943c009e \
+    --hash=sha256:f5844e7befc707367807586f550fa97e23dcfef0728f02b98c7bc498a961a5df \
+    --hash=sha256:f9dad513626a33670f17cddc6078e30e311f444c957e8dbfc5b2b4603c8b4edb \
+    --hash=sha256:fc0dcb22fa9aeabfe3fa4e0430099acff985ec5d77a851382f76cc6146e780e5 \
+    --hash=sha256:fd882aa29bf402b62bf1fd7c19fd5df4b6528cf468a908864b39368572b662a9
 oauthlib==4.0.0 \
     --hash=sha256:624c28c13a0a59cabf9747dfa52af63be3e512a7f2714df16e91b5b3a145e6cd
 packaging==26.3 \
@@ -1483,8 +1483,8 @@ urllib3==2.8.0 \
     --hash=sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3
 websocket-client==1.9.2 \
     --hash=sha256:e1a673830a9c7bfa47b1cd3d5e4178f4c9651d80a4eab02c9c23a1c3ec6250ce
-werkzeug==3.1.8 \
-    --hash=sha256:63a77fb8892bf28ebc3178683445222aa500e48ebad5ec77b0ad80f8726b1f50
+werkzeug==3.1.9 \
+    --hash=sha256:6392e50c78460ba618e5b21f08a71f59c99ce99cdc6cf6e3dd7e6ccca8754fab
 yarl==1.25.1 \
     --hash=sha256:0136d640dfa9b0523853e411430a99f8a91eca85774c6420285a33b755bc6de3 \
     --hash=sha256:0a191bfdb30a79b98e5d175d75285f9fcb78bf0e46ba5efda042e1c72071a0de \
diff --git a/requirements.in b/requirements.in
index 1c8abe85..03e1419e 100644
--- a/requirements.in
+++ b/requirements.in
@@ -1,5 +1,9 @@
 # Direct runtime dependencies. Regenerate locks with scripts/lock_dependencies.py.
 flask==3.1.3
+# Security floors for transitive runtime dependencies.
+# GHSA-g6x2-hccm-hh4m and GHSA-54p9-h82j-f925.
+werkzeug>=3.1.9
+multidict>=6.9.1
 flask-cors==6.0.5
 alembic==1.18.5
 azure-identity==1.25.3
diff --git a/requirements.txt b/requirements.txt
index 45eb9a8a..6897a858 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -833,177 +833,177 @@ msal-extensions==1.3.1 \
     --hash=sha256:96d3de4d034504e969ac5e85bae8106c8373b5c6568e4c8fa7af2eca9dbe6bca
 msrest==0.7.1 \
     --hash=sha256:21120a810e1233e5e6cc7fe40b474eeb4ec6f757a15d7cf86702c369f9567c32
-multidict==6.8.0 \
-    --hash=sha256:003a3bddb32915c3f67096ea41d24e53edf710edb65a1f5d0c70ab40b0e4d20b \
-    --hash=sha256:00be37bde741bf60871082cd347a093218c44886e99231b7516671c70f2c280d \
-    --hash=sha256:029897732a9c798737457e382bf84e8c64237eff224a90aea2639f4413c45e4e \
-    --hash=sha256:05c2e90c5289c5f7436ba2c25812a5fbdaa1c1bc11c8d8d3bbf64f5cd7c633dd \
-    --hash=sha256:071da134651b04a8507dfb331ac0988f376337c2aea59486bf20989fb5b5a64e \
-    --hash=sha256:088b04a66b3c1fce6fe4d771ec184a0426262d0b86709c908477b4ac7965df40 \
-    --hash=sha256:093167d22a8c95af30f597b8a5686f20a14512989942d4be804d119899caca20 \
-    --hash=sha256:0935971bffd0b479fc90c4811ca787703e93fcb6afea939a375dfc80285ab368 \
-    --hash=sha256:095f62ea4e7a3be2f6c567ab695ce10e950f2adb905c1bec82281593e0b2d2ad \
-    --hash=sha256:0b143d53590e89f43153d81d505a8448d4d57354354385aef8a51d67ffefa27e \
-    --hash=sha256:0c1c4debad7337627b86837abdf0237ca3cb3d7e17de7eab0177c263878546d4 \
-    --hash=sha256:0eca15d627e942ce186a935061f1568cc46c02e97c419c8da802df2be9f917d8 \
-    --hash=sha256:0ef606c15cac6c90279acf34120784b6f36662cbf382defd3955cd8f1115336b \
-    --hash=sha256:10456943903744ae1249728161c96bd9d2f7eb5ee17fcc2ffda2dc32e1bb36c7 \
-    --hash=sha256:11d71490bf4bbff1141b14b93af419ad68c56b60bea9277fcb3f94dcca4796eb \
-    --hash=sha256:122adc7c46ac1e31ecfc7f81b2530533dccafdba70f5d741649f87e336c63384 \
-    --hash=sha256:13967dca8b2f33230a1427b52438326bb1c9101a1df22a3309ed3fcbbb3c96f0 \
-    --hash=sha256:13e26f59f0eecfc5f67c663ad550ffdaf62c0f657547cde387f6c86af1c9449e \
-    --hash=sha256:15db8e6cab5f4cc9241bc56e69fdf3452cf49c10ee3c7977c742e68a275b3786 \
-    --hash=sha256:18f0e06360c3e451a3ab800355773c8d125a758238d780c800b0ee5e90ee903c \
-    --hash=sha256:1969971900b0871530f9b62280dcc2d75688e74d2a69262bc01faf2b96c78f04 \
-    --hash=sha256:1b8986d4313dcee7c932837d16a535f1840b827bac1ea7c5c4c80751d0423794 \
-    --hash=sha256:1bdb9b8fba5a9aef673ec90db3f55b1ce743f2fbdea4d37dc04d14ccdfc153ff \
-    --hash=sha256:1f57c414be82490bc0e0305fdb834186229b2d9b6a35fa0afd1eb1a772d125ab \
-    --hash=sha256:1f66fe6a021173d0d47968491791966b9f3e6d61115f2491744aa0c07a6e67af \
-    --hash=sha256:202436df907c15adbb94360296c425ea53cf8968a5d2cff9b5b9790ae1972b33 \
-    --hash=sha256:2196ba6df392c3574acadd14ef87550f3611349c8618564de324b806a7a31cee \
-    --hash=sha256:22a310ad37672a261e55a8b5e28d0ae08cfb68abb1f46418ccd19835c3b8e836 \
-    --hash=sha256:23c9ee89967b6a9b4048acb3b93b660ed714ce9c8bf3bbe652959bc120dc02dc \
-    --hash=sha256:2622fe114c0bd66ca5c461859357587f5a5e35ee5ff49fc5643d1bc78dbb41c6 \
-    --hash=sha256:26a7aafc992e78872e2c8c1f7248c0e01139cf9020a7781b0c064fa566832712 \
-    --hash=sha256:27747162712e85c84598d364425dbf1714ff335bdb6ba3171c4e5081196e8916 \
-    --hash=sha256:29631224698de1e42abc8fa7658d830e0aed0029785144b5832b695da5adef2f \
-    --hash=sha256:29b6e7bc4442a56cf8e0dc1cabf3fdc77cd533568d6829fc76a1effd2ce332ec \
-    --hash=sha256:29be9fd289e9ab8f480996ea2f686e1654b80242033843cb11691688329423f1 \
-    --hash=sha256:2ba9933e8f35fe4a70f540b837254c4055da82dc3a9e500a8f95e61498083a15 \
-    --hash=sha256:2cc66abb85e2108c9ff8a1c0d20fa260bf690bbb33caef4ff3ecb2c2cbdfff5d \
-    --hash=sha256:2cd560498ae8e1bcc955643c1d78eb8e338226d07a983c656ea8c4443d3eec0f \
-    --hash=sha256:2f79cc3e8039a8cf5c77e0811b0807953fd52d0863b9b76970b20d696dc64a78 \
-    --hash=sha256:2f8a4b0b4d639d525928c7f30de527bfdf9ead6e44a5e8cb9c50aced5e4590cb \
-    --hash=sha256:307c1acd812fe897e7fbe10c6758822e8c04be4e7c60a9f54901cdf8b5ab8bc3 \
-    --hash=sha256:3126f2a96704505aa4e92a72d6e8a5d7f29d40a987ced8bf69e29d71dfc71fbc \
-    --hash=sha256:31e8901637e20ccb3cf8f8848b5d0f7a00462bf5b34f7cf3dcbb2753b18e8b39 \
-    --hash=sha256:346ac52e56bcda320c0dcdfdd081947ed7cada33afea4e2284bef7b0733bff9b \
-    --hash=sha256:348bb85e2038b40c007383616d73f734869063772372519549ebd7da1723d1a4 \
-    --hash=sha256:3533a03e4e789baf6a286e7b0b1b6da3f3d7c3eab569686ee29ee1d8b52e2cb4 \
-    --hash=sha256:35977263d9bf506dbc65349f63b3b8c91606d4abc110990945e3b94bc671319c \
-    --hash=sha256:397599503b718f0137f26d3f6532d6955069cd2e5917c47ef581495bc2529ff8 \
-    --hash=sha256:3bafff8598f0528017ddc74194e5451d5c22d046c98935f8f86247b0f286e4f8 \
-    --hash=sha256:3d1f48582686a0a3b81e9b43234766cc96697df72081af3f48107bd3f34d34e5 \
-    --hash=sha256:4261863fc8b5ab1b815ede94e592e94c6af5b04616014929057e61859e7382a9 \
-    --hash=sha256:43a4b56555bbcf8af161e7c7682bd93eec10f068c95844511864c018c8e5e13b \
-    --hash=sha256:45cc39ba50fb0754a4359b90f8229ae08598fe2266abe3521b4e5a9ba916534a \
-    --hash=sha256:46029e6e27a3ec0dc55b53f58df82d10f04c5e111f78248279b530bedad2c30a \
-    --hash=sha256:48ea524a25a1cd5972cf293bc95713918cba0bcd6fa9b992d906c857c546abe2 \
-    --hash=sha256:4ee953a5ebaeed38dc21cc032ed17a9d9782802e00042200497ab4b01b0bf7c0 \
-    --hash=sha256:54af1266710cb0f305127ae0b970aff8d208057f8a29cd6e1db99b0114947035 \
-    --hash=sha256:560b211fc3bd4a1e1c6de44f6d38113bf5b410dfc89a4c0d2a3c0edbf1a0dfb8 \
-    --hash=sha256:563661919f603374c40cf45ffcd25535c12b8954203569a2ab1cee5265871cf4 \
-    --hash=sha256:563d6500ca80dac7bba6f48a78e0ffd87e21a7d4d24642c6503a2ddccd70c110 \
-    --hash=sha256:59e539c4eb4d3a53b0e630a6ba2b2f2824732b5e73f90e30a280f12fde157b15 \
-    --hash=sha256:5bbbb696c8024475b1877d14ce20d5f1cc05b8f6d786cea0fe3aa7fedc02e891 \
-    --hash=sha256:5caf684986a2490628f059a99dd107b566a2d34cf947f8eb8387e0500a1f90c5 \
-    --hash=sha256:610c7637bc36b90f39e6c66f710f93d57018f83d53e1e187caaa218c6892b95f \
-    --hash=sha256:628ff11e6720f90acd0c305dfa3339f04a783a20de8cda6ac333ba46447261e8 \
-    --hash=sha256:62b8e291a4f7edbf7cde7a43d831d893ba443a1b627498b53581943b0e348feb \
-    --hash=sha256:6300d5176647145ba1e22991c924fb29743e54b4d7b8bc85a0d3ec0e55e189cb \
-    --hash=sha256:64eaeda36ee8d88f9e8616a587a8c66a663283cf6e0dcf013c1ddd8c758e4aef \
-    --hash=sha256:658f5a1895b804423d97b22d06fc0d0b171c7c01dcc3aa9c8faf0c0e26a249a5 \
-    --hash=sha256:65c85c79f5a2c04fbbc18f006c014674dc5fdf270cb978d8862c82c6f694e60c \
-    --hash=sha256:68186a2d4051c8ffd17be33553bea2ec9bbc8ef860fe2980a221d96126296f31 \
-    --hash=sha256:68d40b2bace413f3231f5729d3fcfb1837fd31c4907e241b5d43211bfd76f3c2 \
-    --hash=sha256:69708fecaa88bcb2341397b49fc95057a835b02a3670c551b37f95dd79e64e3a \
-    --hash=sha256:69b3e519a132bb943b0daae15fc8c2168706b17f826481d32a32a5e784b129e3 \
-    --hash=sha256:6b62b7e0025aa48dec11e125e655d1157985a5fdcec04b1ad500101ad072b891 \
-    --hash=sha256:714597cb5d5e15a8a449d2ae23c45b486a9e8fa33c462c7a33d7f35b65d92943 \
-    --hash=sha256:758233648ac47b07c575224c4eadd73c8929c3b4c31e2afcfea935fde1cda735 \
-    --hash=sha256:75daa15ca16d6285eb2e104b2f05ee6f8d9836c68da3ce5c85f615a0450eed0e \
-    --hash=sha256:77745725125d01fd613b6db043362aa7c6bfbfdb23d45dbfc3d92bf58160af62 \
-    --hash=sha256:7941ef106ca1f2c62314a13c7ed913bcf49641f3efdc12864d588e17870920ac \
-    --hash=sha256:7a2573d0fd34f361a4a14e54d8cda3a91ac4e55fbf0d719698024f3b09c5b147 \
-    --hash=sha256:7a62e302fc8cd6aa8972207e7e951d1fdee7c1dda18568305041d19f0e2c00f5 \
-    --hash=sha256:7bb0dad75068fee80fcb60f88569722c199d8656a16706702dc6e3b786819c90 \
-    --hash=sha256:7bc7003991ebd368a20d05228137a37b3d3066751f3ea1e4f7b8efe8e752f2f5 \
-    --hash=sha256:7d26dc8f070c0ec5579e987fa615ffd6883086106eefdff9e10d160fc5630630 \
-    --hash=sha256:8125e60f3c70e323ac07dd8b3635f7b3bbc5c3a9ac04ae5988f668ff7ae28a18 \
-    --hash=sha256:8180b635290a75af8478f1b3e9810135381ae24833293fe77b85c1c21ff842ab \
-    --hash=sha256:82780eb8bf59e8fb25dd081fde6e058805045d6374a7f2f877effc826ca4434b \
-    --hash=sha256:835d5a90b11d1f5f8200ff3cc8316bded76eebebc92436398947a27657e645e7 \
-    --hash=sha256:83ff054b04915be5c15680da6c6012474a2cc2bf534129a0e8c6a99f17ba7238 \
-    --hash=sha256:8457aff3c12a89a8e1c4674de5c777857fbc429f40fe117a3d29538547cbc364 \
-    --hash=sha256:847d6082ae694dc95e548acb201bc100e1cfa96513bc71fdcb86f709dad6c435 \
-    --hash=sha256:883284137e25318ed9735b742ae46341a864888fae28e8b6314c4f84da080f08 \
-    --hash=sha256:887f9a975996032c686719eb7b3e1e7942fab5079c2b778bbd9afe9a9d78244f \
-    --hash=sha256:8890c89d662560e51c55ac1304d6f919b23942abe9ae1127cb1de9aa6132fa52 \
-    --hash=sha256:88a6df88567680504ae28bfa7a1f2f64243d91e79a40b2c92ef42efc531e23da \
-    --hash=sha256:8d1046b5427dcafe6e8a0e07527dd74f1ee694006160162f53f3a17f15aad3b4 \
-    --hash=sha256:8daafaa0b2eb43f76898ced78b1e0fb91b38c4fa50da516c18067f2a2d578c20 \
-    --hash=sha256:8dc2d9c3a924ed14166e63650b2cf9f59e7821743bdd50b23802bd97ca09bde5 \
-    --hash=sha256:90c10b22860dbd09982d0b8993b66231a861bea2993d4a817ff35273f6ea285a \
-    --hash=sha256:91fa75d0a693832106d98f66c849f034f21c828d14437f1fb97d3784aab89e84 \
-    --hash=sha256:930c6058047410e3edff445f5a6e4457f2e089042dede00e2d18ce06f3ceae2e \
-    --hash=sha256:9442b14eec262a1f74369bbd07e75bc5155105164649a4b9fbc1ebc7b8fb0b14 \
-    --hash=sha256:95c27b4f3f04320fc44e338573f40c5c956b504a7fcf081a157fd0b02579311c \
-    --hash=sha256:9606f583e7acaf61e7b3f56074e14037b9af7cb194590edfc0114b3ae5931ff7 \
-    --hash=sha256:962f18c59a000f30b084ea2e6b8001521bb315efd4e5f10acf9fb36f366b7882 \
-    --hash=sha256:9caef53b20a105c0d66518a34be2f71b2783de8d091767575ef86f6ea422236d \
-    --hash=sha256:9e37024b41d7a7e7e9cce14b248d54707c21c2a2ea30a47b71bdcefcafec00f2 \
-    --hash=sha256:a5a7ee1217949ddd43c6b7bcf70d5c22193bb50e8c695386de5905325e93ce9f \
-    --hash=sha256:a5e1583c14775580da05641240ce0d93f36ce3ddef3d5083a827468b0bcfe874 \
-    --hash=sha256:a9e246f67ac038568b854ed7c5578e4c6af1f742359901a8fcc3603ff1358df6 \
-    --hash=sha256:ab83fdd8cf307353edba9c427c17a3a021c2522d690f5633dd9f72d28b48ccca \
-    --hash=sha256:ac746cb365bac1c462da9e3e6ab8904a8efe2217a56b0b2e3d9480f41d2b2602 \
-    --hash=sha256:ad474c11d851b6fc97cb625e4822bc0cbd567fc07dc2602e28faec5a36b42bbb \
-    --hash=sha256:b03ca066b47b18b205cc080dca6f76cbd159f8cdd33a02a0700164c13b37e463 \
-    --hash=sha256:b1cd4d66ce894a45482e1ac2837c31d0bd447df35065e542b60055aa2d00404b \
-    --hash=sha256:b25426f9f6ed402835617c8f23609a47045f91ecff365eb6734817e039a8ed25 \
-    --hash=sha256:b367c342327717d644db4c0ddb37ceb655c84822215ea0773a3a36911b74b71d \
-    --hash=sha256:b7e62b8fc7bd6cad007b9f2e0ad9c8d4854c06350d5f51e1a439dd18b510ecac \
-    --hash=sha256:b8b7aa75146266fd3e2a2437cf69ae188688c04ab8665b163d4257b46c1e0c83 \
-    --hash=sha256:bb36381e1f9f9d06eba2f10bdd438e5d20c07d5b55e1a3eee30b9f44cbf52316 \
-    --hash=sha256:bb8c7da8c861391f7ae48e3593762be2dabe405109e01aec520fbe1a6d15d14b \
-    --hash=sha256:bb9a60b7faa5d37c426fa91cf4d6738182a1f2755b9fab7c9c64cd466c4ce51e \
-    --hash=sha256:be007d1aee2cbd530347dcafedb400891a3b5f1bd7135f95cf5d5b330b5219ee \
-    --hash=sha256:be569fff1d85cd29391c431c5641c8772acb75bbdc61e60a8e82fceb9023d385 \
-    --hash=sha256:bea7df027015856ba5d0a88e3b4777ff8cb5c66b58fc108050fe79d4dd9d4d2d \
-    --hash=sha256:c0fe437a6d2f36aac2b49517057776575b5bf359df314cca20d230a6e139c089 \
-    --hash=sha256:c2b2a96cf1dd99fe7867be4c013314225f4d5786e6685906e29932d42aca6f11 \
-    --hash=sha256:c2c5fd0fd39574ccd58e1a52565b341aff522c5c836f1b3eb7605c371e61f52c \
-    --hash=sha256:c46a08bf070d6849fed483e9d9833f9d06aecb8382ed985be0b38508b3ae958e \
-    --hash=sha256:c5f3a2af441670d80ce5fdf13b6c1b421fc1fc7fc5182d58ac7486738bb2b742 \
-    --hash=sha256:c60e50bc5b07faac92fd3a20fa21cc8cf3e3f7204d2867b206c73293ebc19101 \
-    --hash=sha256:c68e0c0649d17c2d0339e3674e86a4aeba4a7e6b21c1e394cf947a95433b31d0 \
-    --hash=sha256:c9c98d2f0126ba84cb45601eed97ff67ff767e19ae6eb3c31b02827b54d700e5 \
-    --hash=sha256:ca52b9ec80851366197577154c862c4c4c7036ca76ae94cef5cb59c5cfeab944 \
-    --hash=sha256:cbd86f9787c5e2f5fd27d8b21458222f107347c6731c4e93dde68f554b466a2d \
-    --hash=sha256:d0264f8d5cb0a803f650a6a8572dfa0cd1e099a2234c588dc8fb220b415b865f \
-    --hash=sha256:d0be2b832435001bc623ca7f1499ca1a853d4f082fb61221a80ce71132f50b26 \
-    --hash=sha256:d244cf6b52b5ba1c34c3832f4652a668ebb36d95949b96eed9a1c54d916a90dd \
-    --hash=sha256:d2d236b8a44ae91536a12ebcb996bdb31cf27425f36b4d05c87f2ba2716050ba \
-    --hash=sha256:d3da668e903c934ed0b587ecacfed6901f6ae6384a6e975887592b61845e78bc \
-    --hash=sha256:d6dc7804c50fabd28644d4d18a4b20aad3681b3e64f3acd3182b330ca73f7a32 \
-    --hash=sha256:d7e5ba0a0153e35fbce9c51df530c8b4cb0c3012b46a04ff9a048441a269c2ed \
-    --hash=sha256:d8a5ac357ac283490a8d1899b0383355fd1f8634b14ba0d59e4c0dd97db85556 \
-    --hash=sha256:da1c112c5784ccd9d32cd90be6739fee32644e874eff6ae8f0497cba3e352e58 \
-    --hash=sha256:dc911ae6152e455b16a2a1a626aa6cd612fa01efb9d0a4ab3f5cf328b911483d \
-    --hash=sha256:e0db3a4d1e264e225037a6023888972c25206a96e016021a5bea41c9a939f2a9 \
-    --hash=sha256:e192018b732f7b168e6604cbdf40fa8e05c996693b9eb445a0d8a73f4b77c5d3 \
-    --hash=sha256:e37b744849fb631bb52e3dadde35ffeee365a6c41cf71257b5b7acc9cd83fd38 \
-    --hash=sha256:e41226ecf607f062fe34a2f4cf64ad3a89e3a0180dc800b463b6b14c06dd10dc \
-    --hash=sha256:e418ec99574ca24365ca96546af285c2b021a1a072478a79f0e3cc3b08837154 \
-    --hash=sha256:e6ec7d37841609a691b96a10b4fde386c7cd93ebbb939f59c9f23325ee788395 \
-    --hash=sha256:e886ef8c9879105fe4fc99417447b3a5f35d1131412ce839470bd2089fe2043f \
-    --hash=sha256:e8e1e895e23818d343e4ae7dd95a0a556fdeaf8b471acf1c0a39b93c6f54d478 \
-    --hash=sha256:e9dc7b4ff6ef184504b49ef9a4113d49a646653b2ce89f5f48c1f57cdf6ba081 \
-    --hash=sha256:ea880d441be7c510106bc56064be39266d948aef94ad4955e8784690019a5d9f \
-    --hash=sha256:eabb03dc3e4ed6333ecd1cc9826ec80e7a98b5506deeb832d7260c8e44166d23 \
-    --hash=sha256:ec0a4d066356054d569a66e0a94691a2058b680be5e710298f61db11a3c4609f \
-    --hash=sha256:edda19aff836ec515caafc09ea53d2ab144a041f09ee9a7cefcbd3ae4e976256 \
-    --hash=sha256:f1f4a220db6ed7c8fd16b6d644ffd1f082651693204daf3275e049fadc849e39 \
-    --hash=sha256:f25b61a708bd276e8cbb6afcbbf1b8e793a3be70ba0a842d0b8692020f83b706 \
-    --hash=sha256:f2fa3d3b1c933d4bcb8fd2018700d5e7235c52f2ab8c88d22286965c5c0f00f8 \
-    --hash=sha256:f3071e6515cc63714d014da8f738ae9fa3997c476203f3cd46de380c2376ed7b \
-    --hash=sha256:f3a0a31189acf6703307397c6139ddabd734c20c5ef92649fc93e473df6615a3 \
-    --hash=sha256:f7eefd0233a7c33ca980a5cfef26f1e9b5e2137839e752a99963696729f12d91 \
-    --hash=sha256:f8b09b25e0f4dc2ea9e2adbb1cc3ba11a94d6fa3dd978ae659c8743052e1afbc \
-    --hash=sha256:f8d7b66c9e09c0bb0add2b5895e646b62a0849e71155066f215523de6b95cbe6 \
-    --hash=sha256:fa6c2880709c84457de104385b704fc28860f27e442ad13966fc4af8e714fe9c \
-    --hash=sha256:fc5460940f50dff00731b4132366840ba9685286ea88ea104b661899084f3fea \
-    --hash=sha256:fd789a294d8e098528be29b2669b83005ce569339f8cef167fc0274c3115c34c
+multidict==6.9.1 \
+    --hash=sha256:006c4478de0a1876f4834e14255776286f09b9846b505fe63f67f9d173a9487c \
+    --hash=sha256:024123f0ab402ab33828e24eb80fa8f25167d0d3783ba5f287e39ed741e6abf9 \
+    --hash=sha256:02f6d0c4b70f783305e73f9944d8efe6be1022550f0974ba0ae9d8893c0350fa \
+    --hash=sha256:02fe09dc197b8ae7e355371e51e5dce2f39060cd5a8badf94904527e23a3f188 \
+    --hash=sha256:03731f6fc036180700c9dc2308205a48e5ca6f3ff03087739ab746f294022201 \
+    --hash=sha256:03d47df72f084f757c1cb771188d5f4e3a805e4abc4d67e32509272343ae9382 \
+    --hash=sha256:03fac50ddfd8302175b77863a015eccfae76767cda5506eef86df559ba861e1f \
+    --hash=sha256:042fb0196047e786936a730bd302de83143950da45f2c16078da8f35e1cf7919 \
+    --hash=sha256:083735b7f395894e43adb278d5dae901448883a835ff8f1977e285fefdb10418 \
+    --hash=sha256:095d900c242e00fbe5f321ee072e7278b4153e78c5ce9c1efde167d62c1e4771 \
+    --hash=sha256:0a5769559e3312dd96731fbe15b4abb6033368ac1cad5a98dadd21946a4c7d6c \
+    --hash=sha256:0b2fb8c349d1103863750b5d8cb5ace766917f4b35f3d883c8f778853eaa9f76 \
+    --hash=sha256:0dd655518f136febd96c05131a76a863e32fc2a1d7acd4e3c959e3ceb77d8345 \
+    --hash=sha256:0f2ce963299d42fa3f22a90adc0fdf174792ffef5ff4c7ffb68260548fb05580 \
+    --hash=sha256:0f3bd290711c6e9486173a6ee7cd4e7f00c3971c7908c1ec1b6e5437c5e4c6f9 \
+    --hash=sha256:10083a8a0f4e1b26b599889e90b9802504ce5d3f7722f925bbb7ca47dd22a7c1 \
+    --hash=sha256:13849a1d4f54c3809ae721e9e83ab28f5ea602f33660cb84eb6ef261eac706c1 \
+    --hash=sha256:14c56f73e78faa1f68bbb826197cd5871994e70e841b8590829c35912ece5c64 \
+    --hash=sha256:15db6a102cbaf1949cf028ecf080aac76d20bcd29ad4e092574db6c6b7af78a5 \
+    --hash=sha256:19e31815d41cefc365489e591d105d2baceb2f65aa75d29471fbdbda8651e006 \
+    --hash=sha256:1a53de2772cfb74559df2eb4456ec4eeb908435ec55a84b69370d9d745d62aa8 \
+    --hash=sha256:1a8adfcaf96f587ab138476eaddef95f29b8a2a8a9afbfea8d2fd62180995d02 \
+    --hash=sha256:1a938761c77e0e6edb0c93d02f4e988d44a69e5195e5a3b893e5553311347132 \
+    --hash=sha256:1c9f3c25df6c9d3bbae4f6fd3f514b1c5c740a2110f56ccf36069c85417e289c \
+    --hash=sha256:1ca5ebe6d454f1e5496cf052386a559f1080bf2de75bf327ebca0a6003b79f19 \
+    --hash=sha256:1d804e4caf5d5da37d6dac1325da5629ebef1e27a294c2b568b295814aa36c7b \
+    --hash=sha256:1fee9a16d88a1c4865610de31ef5c666671020d7a81d1f510eaf3c97d00ebeba \
+    --hash=sha256:23136f5a564654eb61061ec6d5620a4c1ea32c8f552b65e9982a12b72bff601b \
+    --hash=sha256:2784090c30a586d5b45197bd9c32f87fb927216cde302f6cfd76d76577e90f08 \
+    --hash=sha256:29138fef49828542e859828107e42e50d0e587c513b7eb4b2d92bade2b0860fe \
+    --hash=sha256:2c1aeb92eea59d824f004341b26d5e4b47a8a441cf9726769b9a90abf9d0e08f \
+    --hash=sha256:2c5d675da8f1cb5650271c8ad5e95c0a3e5a183c105e72d953b12877b1c8d0fd \
+    --hash=sha256:3100d169ceb7bc8f05f89a6db11d1b21f119975fc26f29dc45a472e3569f0879 \
+    --hash=sha256:31199204b3ced121ff5407a2c342326a5d27e3870abbf94bd80dbd2451b7bc8f \
+    --hash=sha256:32217133dddc58c927805cf6c0731d8144584176b768042ee886d51e71860bc9 \
+    --hash=sha256:33fa55b990f81c2927e01399ace0d18926c69d69baa8cdaa819424132fb97987 \
+    --hash=sha256:35ba0263bae5dd3ad5aad767cc9afc01a8598c7dae30f1b3b2de98b1b32c28bd \
+    --hash=sha256:35fc236507fb1b3138f0af5ecd5f94ed752d4d6d826248eae425f86204013eea \
+    --hash=sha256:361f7206cf341ba94fb015688f5c8b480f8e63bd58a4c14a48aeca7851a241cc \
+    --hash=sha256:369b5aa01b241cd3fea6890bdbb11a1425d87bf1515831500d518f4223e9d72c \
+    --hash=sha256:37245ca4105386194dd1d292a6f2aae09bfe1bd7ac6f9ec25093e3cf8e9b143b \
+    --hash=sha256:372c063f37480f62c1ae32dc3a1a0a5942b180c883f99789075a8a8ec3c4e709 \
+    --hash=sha256:37a9ebe00c698279213d56e6c64e1962ab1e092918270649b397cac3dc196ca4 \
+    --hash=sha256:38c9986f9ce50c459b10de216a05f4bd7ed5ac63887d56e500a52bb464b861ce \
+    --hash=sha256:3adf06c66041aa21eeb8a71e82379b74773298c8e6d3d839b151aae441a99b94 \
+    --hash=sha256:3c95601ed98fad3f6e2f8fe809c3b526b0fab31ef525e00a155e227f3d17f58a \
+    --hash=sha256:40aec5299e1ed71fbb988389059da381c3c1a60e0c649acceb2a35d9b128848e \
+    --hash=sha256:43124fe172ada86d03ac3c8dc8179091341f6724d5e5d5b160e1587e4cd3761b \
+    --hash=sha256:4736d350371337825cac1793c9f7c40701c32a03912548c2a7608e51679cbb96 \
+    --hash=sha256:475d04d5192eba487a3e2f935976340baa24529046e9c1c9c7a3b7bf80445ae1 \
+    --hash=sha256:4a409ccc42aefec904038695d5d7fd6d8f3af2721b7b6401d55135ec7d6d298e \
+    --hash=sha256:4d718fa1b5f0d0dd75e86fbbc5b0c93ea3a5d65216c85c61cd5d7cdddfe08455 \
+    --hash=sha256:501ed8b02a5990c67a91c732843609d43a6be1f7576fcdfc867331239f37fbd3 \
+    --hash=sha256:539c2cd5fed0947c135cd7eabaaac55f48300dfa1de0f3ca4edb5efa6606f471 \
+    --hash=sha256:557a4e1708df428ebe6c3081c83a273d275dad2446ce0d81fc648ac71afdb18d \
+    --hash=sha256:56d834b74c993a7d7cb2b8ab33a0d55c3e0d4a3d2f2da2808a4ad3d79189711b \
+    --hash=sha256:5800368526647146978389dfaa46da3356291e9f0fff9a4ef12e8c2bef964a0d \
+    --hash=sha256:59c123d0e948d760a5f930f316cfefa07e8d632ab84327c0693ee6a88171154f \
+    --hash=sha256:5b30ddf7234e611ca877575b62840e6af5977f92f1f9d532eedbb05a44ff8004 \
+    --hash=sha256:5ecace251ccfa705bf3d7d35c5032cf750f5c629809740405697bce5c118c4a4 \
+    --hash=sha256:5f89dad732280e7a10b74d40b91364f88e13c3f2c08c2ef83a8cd42f7a61af2e \
+    --hash=sha256:637f4ae36264bd7b8d9a60193acddc1d735ad52e8ed53a19931ea6d921fea8e5 \
+    --hash=sha256:63ada7ee2e9345695f9e9bc4c65d72222253f07b1ac94fd0e37555cc6f3c7f60 \
+    --hash=sha256:6441cc837aea58be7d9baef1b2383eb8311ab9303f500f99ac90b584cd78bb14 \
+    --hash=sha256:658f90f49cf5af2441cad0a2b801c3ef520471989a1ec55bcb25b255b2ca8d2f \
+    --hash=sha256:66987aa68b0f7c2a1cc5f388ca962b8ed92b10f79de38d6d0d8c716154f519d9 \
+    --hash=sha256:696477ad71385c4795e3b8e4cf10b0d2c28c2a1ca6a955e031cb1e62993e9ee3 \
+    --hash=sha256:6b7e54fd883671d1a8810704851c044b7173287c552b9f5c3d9e0eb9f00ae194 \
+    --hash=sha256:6bc94fe17c3c56e5418f79515b786b101845f70609b0d19d0c1ba13448e5633a \
+    --hash=sha256:6e6b7e3a1520c39a2772f414cd9ddf5995f77e4e823dfa1522af383addd465a3 \
+    --hash=sha256:6ed30be8918e18c8bed0a2e8b70639ecf02feb61ed00ca2e41cfcb2a50fa3f42 \
+    --hash=sha256:73533644e1f69ea1164d56cc6505f564c6c44072b646b66d67df2d31fed0348c \
+    --hash=sha256:73bcafa21a78d0776b3ee7cd2a63c66f968eb7db8e8d594e32d7329950f6e828 \
+    --hash=sha256:7814bbee202acd3bd240204c17d8b87a4c48c81064fd8674dbe527d94d5a4290 \
+    --hash=sha256:783ba7d845d79ce976afd9c1e91a4e5714671defa198ee789e8b23316083a485 \
+    --hash=sha256:79da2491348b30810728050b4a8ec0416f85884125c2fd44655b3d01150d9c3e \
+    --hash=sha256:7a0c98f6a636adf0d7edd60c61589eaf52d149239af754d0bfeb0effedba53a8 \
+    --hash=sha256:7ab379f95caee071a37cbd8be86d4c65accc651d391f9f97748fef006f38769c \
+    --hash=sha256:7bf6478188f4e47bf5686e8a33da4ae28bf43b1b2528d9ee144d28492bfac60b \
+    --hash=sha256:7c6eecfab7ce4cd9487ff8ba936fe38cdfd68c04faf3d5c710363c6a8e695659 \
+    --hash=sha256:7c708566da8014b120a64b1eb6d200c6c0c8cb36296383723cdb6fc82038270b \
+    --hash=sha256:7c8d5882ba25ac0282258be435d8a05aa0cbcacfce15799154a338f847f159b9 \
+    --hash=sha256:7fc59e9ba821b220944ccfe0f89c9dc4745f6d097569992356eb03869f21e953 \
+    --hash=sha256:7fd79c521f6290c69125fa2b85fa65d9e657e6a8ffaf722dc881b926bef4aa5c \
+    --hash=sha256:803f8b575a71b1b299d677c28db0653459c79b5308874efec813f17b7457c7f1 \
+    --hash=sha256:8050e75af7e4c6e2d5260b84eeedb618f3e452e66473432e085b5d1b81429299 \
+    --hash=sha256:81cdc537e0a42e3c0170752fcadbe450246d5c3b4b7231d6eb9672456605ac94 \
+    --hash=sha256:827c92145b3b976b39430129c89d213b250dacbe5fce678e9a03940e6e848983 \
+    --hash=sha256:854fd2f1bc6e8a56b89910b5cd7261a8b40f13ebb31572da985ce59c7da0886d \
+    --hash=sha256:877ca17fdcfdf5c397493a71e5ff97a87bb181417fe717fdadc77c08c09301ac \
+    --hash=sha256:87cc632c88ee5dc80e12681047839304d98ee5c9a708d686505767001c9b8b9a \
+    --hash=sha256:8879510a76940670517ea1cb589978da44b86e286ec3e50d664ef330817afce7 \
+    --hash=sha256:8885e3808aedbd6725b921fb67dacaae0678933561ddd47c2b01315198c70e2e \
+    --hash=sha256:8b193bf7a443c97d81c47052f60c486071a4bdef4a573fa2514f920089414d45 \
+    --hash=sha256:8ed78ccad4c7b421804f5d524b7740946a7ef75d89dc0dac52e9d7c24c472410 \
+    --hash=sha256:8f2973bbd2bebd9d2e0cd6394c1292a1a19ccd56bdcbe1e174059f1a39be5b40 \
+    --hash=sha256:910d4260512660484c0dc1588a316fbb35a40c081c36fc51d1225351af17cfe4 \
+    --hash=sha256:95052e8777a86bae87c0bd0b5ab22d809e3d1d02bf69e3e66ddda5ba75a05805 \
+    --hash=sha256:95f273bea318a194f656527ee2ed19494327bc500b8e87d9358e3222579aa28d \
+    --hash=sha256:963a8d8f97057082679523d0fd4c53a38f86bc58cabe4556faef682ae53fa2fa \
+    --hash=sha256:976fd7689d69ec78d67d31d38d396d8adb562f7e8368279f76aed4aa451fa06d \
+    --hash=sha256:989261c5f1735a165f2e4e87cf6d5f17ab734fa18f9ad0383d5adfcdaefce701 \
+    --hash=sha256:9ae9614c317c50836689ce2dfde07c05fe0b16378562e2221746c3913ede3c80 \
+    --hash=sha256:9b0124b9c17e9890f0819b2e7a5f65ec9a2f5aabd6c8e7ad090c1675cf70dee6 \
+    --hash=sha256:9c4880d017555d70dea367dd49271830842d48e3891c2da97da7ce8c4abcee40 \
+    --hash=sha256:9c62e71e6289d78c0108d8aeb495f8bd3cad4bc1632fedddc9297ddf287ecc20 \
+    --hash=sha256:9d0a21cf76153de8f2d96a877991d6bc59b9ab5180b949e50db73cc193b4a694 \
+    --hash=sha256:9e14d17773b1b3c758ff153659a1824608a0cb562c45f484b5ed8a433428444a \
+    --hash=sha256:a16a1dc8529f9e734a41c3b856f3eae7ebacdc061dde3f8a844e0c7889c97203 \
+    --hash=sha256:a2212a0c842c723d919ea4a22a9296cb6b244b386e4e6ea92adfc7fbf3095519 \
+    --hash=sha256:a313bad717dde740959d50850c315b75fd4eb0c5e6b4dc8535db0f1c369be125 \
+    --hash=sha256:a32b78c1e52ebd8e247bb68300b90b233300d8816faa008ed0713bc539fb6af0 \
+    --hash=sha256:a3ffe881246d28a862f1985824f484cb7361f44d6b99c4c620436ef56462f38d \
+    --hash=sha256:a49ff5cdb33654cb7d6a3c377aa2a83ddefaa1db31eb10bcf3c180aa84f9af8a \
+    --hash=sha256:a8b75dd3d3638d9a19f23e84af4ffab3b8940422c0df2da2a77005ef5aa3d7ea \
+    --hash=sha256:ab64ace1a68682d191d9bedd9d4c939406ad86b1d9f628180410644249ad46c2 \
+    --hash=sha256:abc7c2e4b47bfe6a9aea434d3fdebb9597ee636e914e92ba352f2068b9142f4c \
+    --hash=sha256:ac348379cf4de5538a0a213be1532d289aa801ec5d267c5909446b9ea2f8e2c3 \
+    --hash=sha256:ac51cd64bae51c462ea58ad2492c9b8209667a4ef60c45c4a304518b67598d5d \
+    --hash=sha256:acddcac38adc8342ba48aba98896faa7928854bebb62542362138655b5367ee3 \
+    --hash=sha256:ad4528cdce058b684f75fad1faf4a6a6c992fe2f08376370ca66e4ce5916a84a \
+    --hash=sha256:aec65b53a07f580606593f877eefbb29a45939bfc0d3fe6e6d9f42b41b749f68 \
+    --hash=sha256:aef74e9beabbd6c4aafc091dabff86d046ccf013ce1e4396c0fbb01b4cad9de8 \
+    --hash=sha256:af1b5a92315048c3e36bbebfa7d4760a9c3e910bc4166f11b20d77d20d6bcfca \
+    --hash=sha256:b22ff30006a2f28f8bff878fb93413cbe3a4d1fd517c28081d848c90e9cfd2c8 \
+    --hash=sha256:b2483da477932ad1983d1d33c18bc3771c6fb00cfbaaed70a875fd547ef8e840 \
+    --hash=sha256:b2f0adc22a4eb31e545221d93fc73a0f6a8cc2379d0f4309f71d1d17ba938b82 \
+    --hash=sha256:b4c9e5d05b126b267ac048a89a0e2d9b48b1b648add62d4872906304a8590610 \
+    --hash=sha256:b4da208a63434d21a3df64d29758e650fc4aa8cb05848554b76949c296539cca \
+    --hash=sha256:b5f8771aaaed7f80e84a4e471d2f29ab6721e4595075e54d03ae1ed951b2000a \
+    --hash=sha256:b65121091567847a8cb520d364ab22ba90e00d3cc55fa9eb34bb439f0684bcd1 \
+    --hash=sha256:b66ccc5c2cdd26e74fa5d4c29ffae424cc6148bf93ce574821783fb3b6d452c5 \
+    --hash=sha256:b69651732c64afb691e50cdc3387cae305e0eeff8804fe3e3ce203876494932a \
+    --hash=sha256:b828cf64d62dc09ac183f03c1aeedd164ade96a2ce4934109452edf29de1dd13 \
+    --hash=sha256:b8a65621b98984a62e59403009591b8a5a7736273aefe1cab64cfb85b365cc07 \
+    --hash=sha256:bb0d664505f4b112f384cffeee82e91e3f6448d8e574989479db4439b68cba05 \
+    --hash=sha256:bb58ba73a3f96f9a3e46b1fab69929d7edbbddb3133ee74b5c3c54074a53c4f1 \
+    --hash=sha256:bc94a68ea5e18f8e85dc6b522bcb53093f692c8eb62b4837ac047da73956cbe4 \
+    --hash=sha256:bd82c4977196681a499bb6ca9e462afbc5c91c1c15b6a991dfbd72733fea4dd2 \
+    --hash=sha256:c0c88085affd35c33e124e36930c5ad96aff9294ce195eaa0fd9cec962b64a82 \
+    --hash=sha256:c148e8b596000dd3e4bfe206e70f3e666be18d72032e0012555f2373c52e35d6 \
+    --hash=sha256:c57541034d12b215ab0a2bfa371d1a8a198da18176d0426c27105b9161a6862d \
+    --hash=sha256:c9648ed33dc8179e4ec04bbc73bd7f0038e1e81217a69467f61f02a78bf07e88 \
+    --hash=sha256:ca65cced0d67a9039e93bcd98a369920e499bf98296844ff56ead01c9085321f \
+    --hash=sha256:cf22b43f35b7dbb9f71e8ee2041b5c00029cdfc28ede3a2f31cf8906f9a6c126 \
+    --hash=sha256:d35a4f1c63f07fbb8c8f9946dea98b21eddf6c57421585f71d91864be3ba2a24 \
+    --hash=sha256:d3b6e6840421c83ccb60398e333b44f910b0907bb409597685ab2eedd1e22eab \
+    --hash=sha256:d73fed4e37158ff00cd271871170b79e40138db51e625fd352fa17c6acb34f67 \
+    --hash=sha256:d7bf9e43282d69561618e8a0ea33368d532ebef42f15c096f427090521dd74f3 \
+    --hash=sha256:d9d6544790ba50438a9c1a903c3c4afb1ec8a7832db5518549275b40ef0dd4b1 \
+    --hash=sha256:db4d697b18b6ef5528b1f36bfa25072cd2a421869f5963bc0e92c8a34b9e2800 \
+    --hash=sha256:dd9a137a4a9becda3094f3831cd026380f75f6855e051eefe4c73ade524f1cc3 \
+    --hash=sha256:de7738b8c0bb74c4cc16bbd7fb49fc2bcf6430dba11b3432cd52768ae40933e8 \
+    --hash=sha256:e3b1aa25f01238886a6baed9e13b9a9240ed344346c79ae280ae65e8603b21d5 \
+    --hash=sha256:e58952f04772f59f11c6e007471449809a30165188669bca8fdb19dde40a8f24 \
+    --hash=sha256:e5ccad4b7bac125722f48d6f862bed3b514d8526deea06316bb72f152cd30a7c \
+    --hash=sha256:e7386aa18d98d6b8af44b92173654ec469237fda35f8e8523e43b581a86f476a \
+    --hash=sha256:e81ae656b9935ac4528a71f96bb7a14d949778ed1897c573d3e7ebb9187f8841 \
+    --hash=sha256:e8f1e362c9352b50ed120f001046fdbb80810c9d56580f4c3fc13bbe30823387 \
+    --hash=sha256:e96ca64383efa107262ee3949f047af5ee4f1845ba09463466c04d35a83bd3ec \
+    --hash=sha256:ea999ae6e80e66ad5eea287860951b033d0104ca34d6d87c7b5125ebe0e12721 \
+    --hash=sha256:ecc89dbd4155b2f8a47f4bbd89242a35ed15e8e0ec581cab5ac65fa38407329d \
+    --hash=sha256:ef01d29fca550ab871fd99154f82c6472aacf8e7def272dfb07b460123850390 \
+    --hash=sha256:f04551dce5a7db8c9659f2e4245494c182d0663b83661803e08d46bfcae5eda1 \
+    --hash=sha256:f0700527dd5bfa8b7204b08330542f4f388899d3c14d885d8a368992e0eb562d \
+    --hash=sha256:f2524ec55b3e65cbe235a8b3c36e2af3b635be02ed05e20c94e70c5c943c009e \
+    --hash=sha256:f5844e7befc707367807586f550fa97e23dcfef0728f02b98c7bc498a961a5df \
+    --hash=sha256:f9dad513626a33670f17cddc6078e30e311f444c957e8dbfc5b2b4603c8b4edb \
+    --hash=sha256:fc0dcb22fa9aeabfe3fa4e0430099acff985ec5d77a851382f76cc6146e780e5 \
+    --hash=sha256:fd882aa29bf402b62bf1fd7c19fd5df4b6528cf468a908864b39368572b662a9
 oauthlib==4.0.0 \
     --hash=sha256:624c28c13a0a59cabf9747dfa52af63be3e512a7f2714df16e91b5b3a145e6cd
 packaging==26.3 \
@@ -1324,8 +1324,8 @@ urllib3==2.8.0 \
     --hash=sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3
 websocket-client==1.9.2 \
     --hash=sha256:e1a673830a9c7bfa47b1cd3d5e4178f4c9651d80a4eab02c9c23a1c3ec6250ce
-werkzeug==3.1.8 \
-    --hash=sha256:63a77fb8892bf28ebc3178683445222aa500e48ebad5ec77b0ad80f8726b1f50
+werkzeug==3.1.9 \
+    --hash=sha256:6392e50c78460ba618e5b21f08a71f59c99ce99cdc6cf6e3dd7e6ccca8754fab
 yarl==1.25.1 \
     --hash=sha256:0136d640dfa9b0523853e411430a99f8a91eca85774c6420285a33b755bc6de3 \
     --hash=sha256:0a191bfdb30a79b98e5d175d75285f9fcb78bf0e46ba5efda042e1c72071a0de \
diff --git a/scanner/engine.py b/scanner/engine.py
index 02137309..32ef71ec 100644
--- a/scanner/engine.py
+++ b/scanner/engine.py
@@ -110,6 +110,7 @@ def run_scan(self, scan_id: Optional[str] = None) -> Dict[str, Any]:
         started_at = datetime.now(timezone.utc).isoformat()
         findings: List[Dict[str, Any]] = []
         evaluations: List[RuleEvaluation] = []
+        rule_outcomes: List[Dict[str, Any]] = []
         detected_at = datetime.now(timezone.utc).isoformat()
 
         logger.info(
@@ -130,11 +131,21 @@ def run_scan(self, scan_id: Optional[str] = None) -> Dict[str, Any]:
 
         for rule in self.rules:
             rule_id = getattr(rule, "RULE_ID", "UNKNOWN")
+            outcome_status = "FAILED"
+            rule_started = datetime.now(timezone.utc).isoformat()
             try:
                 rule_findings = rule.scan(self.client, self.subscription_id)
                 if not isinstance(rule_findings, list):
                     logger.warning("Rule %s returned %s instead of list — skipped", rule_id, type(rule_findings))
                     failed_rule_ids.append(rule_id)
+                    rule_outcomes.append(
+                        {
+                            "rule_id": rule_id,
+                            "status": "FAILED",
+                            "started_at": rule_started,
+                            "completed_at": datetime.now(timezone.utc).isoformat(),
+                        }
+                    )
                     continue
 
                 validated_findings = []
@@ -149,6 +160,7 @@ def run_scan(self, scan_id: Optional[str] = None) -> Dict[str, Any]:
                     finding.setdefault("scan_id", scan_id)
                     validated_findings.append(finding)
                 findings.extend(validated_findings)
+                outcome_status = "SUCCESS" if validated_findings else "EMPTY_SUCCESS"
                 logger.info("Rule %s produced %d finding(s)", rule_id, len(validated_findings))
             except SeverityContractError:
                 RULE_ERRORS_TOTAL.labels(rule_id=rule_id).inc()
@@ -158,7 +170,19 @@ def run_scan(self, scan_id: Optional[str] = None) -> Dict[str, Any]:
                 RULE_ERRORS_TOTAL.labels(rule_id=rule_id).inc()
                 logger.error("Rule %s raised an exception: %s", rule_id, exc, exc_info=True)
                 failed_rule_ids.append(rule_id)
-
+                if isinstance(exc, PermissionError) or getattr(exc, "status_code", None) == 403:
+                    outcome_status = "PERMISSION_DENIED"
+                elif isinstance(exc, TimeoutError):
+                    outcome_status = "TIMEOUT"
+
+            rule_outcomes.append(
+                {
+                    "rule_id": rule_id,
+                    "status": outcome_status,
+                    "started_at": rule_started,
+                    "completed_at": datetime.now(timezone.utc).isoformat(),
+                }
+            )
             evaluations.extend(self._evaluate_rule(rule, rule_id))
 
         # A FAIL evaluation contributes its own finding only if scan() hasn't
@@ -195,6 +219,7 @@ def run_scan(self, scan_id: Optional[str] = None) -> Dict[str, Any]:
             "findings": findings,
             "evaluations": [e.to_dict() for e in evaluations],
             "failed_rule_ids": failed_rule_ids,
+            "rule_outcomes": rule_outcomes,
         }
 
         logger.info("Scan %s complete — %d total finding(s). Normalising results...", scan_id, len(findings))
diff --git a/scanner/worker.py b/scanner/worker.py
index 2ae431ae..a2b1b27d 100644
--- a/scanner/worker.py
+++ b/scanner/worker.py
@@ -25,6 +25,8 @@
     configure_logging,
     init_sentry,
 )
+from api.services.lifecycle_service import LifecycleService
+from api.services.pattern_service import PatternService
 from scanner.engine import ScanEngine
 from scanner.enrichment_worker import process_enrichment_job
 
@@ -216,6 +218,37 @@ def run_worker():
                 if heartbeat.lost.is_set():
                     raise LostLease(f"Scan {scan_id} lost its lease before completion")
                 db.save_scan(result, worker_id, fencing_token)
+
+                # Apply lifecycle tracking. Lifecycle failures are non-fatal:
+                # the scan is already persisted, so we log and continue rather
+                # than marking the scan as failed.
+                try:
+                    tenant_id = os.environ.get("OPENSHIELD_TENANT_ID", subscription_id)
+                    lc_svc = LifecycleService()
+                    lc_svc.apply_scan(
+                        db_conn=db._get_conn(),
+                        scan_id=scan_id,
+                        subscription_id=subscription_id,
+                        tenant_id=tenant_id,
+                        rule_outcomes=result.get("rule_outcomes", []),
+                        findings=result.get("findings", []),
+                        evaluations=result.get("evaluations", []),
+                    )
+                    pat_svc = PatternService()
+                    pat_svc.detect_and_publish(
+                        db_conn=db._get_conn(),
+                        scan_id=scan_id,
+                        subscription_id=subscription_id,
+                        tenant_id=tenant_id,
+                    )
+                except Exception:
+                    logger.error(
+                        "Lifecycle/pattern update failed for scan %s (scan data intact)",
+                        scan_id,
+                        exc_info=True,
+                        extra={"scan_id": scan_id},
+                    )
+
                 SCANS_TOTAL.labels(status="completed").inc()
                 logger.info(
                     "Successfully completed scan %s",
diff --git a/tests/test_container_runtime_config.py b/tests/test_container_runtime_config.py
index f0bea389..6e8ddbcc 100644
--- a/tests/test_container_runtime_config.py
+++ b/tests/test_container_runtime_config.py
@@ -121,7 +121,7 @@ def test_ci_builds_starts_and_scans_one_required_image():
     assert '"$IMAGE_TAG"' in start
     assert "--network host" in start
     assert "127.0.0.1:${POSTGRES_PORT}/ci_db" in start
-    assert _step(steps, "Start image")["env"]["POSTGRES_PORT"] == "${{ job.services.postgres.ports[5432] }}"
+    assert _step(steps, "Start image")["env"]["POSTGRES_PORT"] == "${{ job.services.postgres.ports['5432'] }}"
     assert "OPENSHIELD_ENV=production" in start
     assert "secrets.token_urlsafe(32)" in start
     assert "/ready" in verify
diff --git a/tests/test_engine_integration.py b/tests/test_engine_integration.py
index 1e4e80e1..eb0dcd87 100644
--- a/tests/test_engine_integration.py
+++ b/tests/test_engine_integration.py
@@ -216,3 +216,26 @@ def test_engine_a_rule_that_completes_cleanly_is_never_recorded_as_failed(monkey
 
     result = eng.run_scan()
     assert healthy_rule_id not in result["failed_rule_ids"]
+
+
+def test_engine_retains_legacy_outcomes_and_resource_evaluations(monkeypatch):
+    from types import SimpleNamespace
+    from scanner.evaluation import RuleEvaluation, EvaluationStatus
+
+    _patch_engine_client(monkeypatch, _offline_mock())
+    engine = ScanEngine(_SUB)
+    engine.rules = [
+        SimpleNamespace(
+            RULE_ID="AZ-TEST-001",
+            scan=lambda *args: [],
+            evaluate=lambda *args: [
+                RuleEvaluation(
+                    rule_id="AZ-TEST-001", resource_id="/resource/a", resource_type="test", status=EvaluationStatus.PASS
+                )
+            ],
+        )
+    ]
+    result = engine.run_scan()
+    assert result["rule_outcomes"][0]["status"] == "EMPTY_SUCCESS"
+    assert result["evaluations"][0]["status"] == "PASS"
+    assert result["failed_rule_ids"] == []
diff --git a/tests/test_feature_stack_ci.py b/tests/test_feature_stack_ci.py
new file mode 100644
index 00000000..8071ff5f
--- /dev/null
+++ b/tests/test_feature_stack_ci.py
@@ -0,0 +1,28 @@
+"""Feature-stack PRs must receive the same read-only checks as dev PRs."""
+
+from fnmatch import fnmatchcase
+from pathlib import Path
+
+import pytest
+import yaml
+
+
+@pytest.mark.parametrize("workflow", ["ci", "codeql", "dco", "dependency-review", "website"])
+@pytest.mark.parametrize(
+    "base",
+    [
+        "feat/311-finding-lifecycle",
+        "feat/331-evidence-graph-foundation",
+        "feat/332-evidence-graph-node-edge-population",
+    ],
+)
+def test_feature_stack_receives_required_checks(workflow, base):
+    config = yaml.load(Path(f".github/workflows/{workflow}.yml").read_text(), Loader=yaml.BaseLoader)
+    patterns = config["on"]["pull_request"]["branches"]
+    assert any(fnmatchcase(base, pattern) for pattern in patterns)
+
+
+@pytest.mark.parametrize("workflow", ["ci", "codeql", "website"])
+def test_feature_stack_does_not_expand_push_or_deployment_triggers(workflow):
+    config = yaml.load(Path(f".github/workflows/{workflow}.yml").read_text(), Loader=yaml.BaseLoader)
+    assert set(config["on"]["push"]["branches"]) <= {"dev", "main"}
diff --git a/tests/test_finding_lifecycle.py b/tests/test_finding_lifecycle.py
new file mode 100644
index 00000000..0f8094eb
--- /dev/null
+++ b/tests/test_finding_lifecycle.py
@@ -0,0 +1,496 @@
+"""Tests for LifecycleService using a mocked psycopg2 connection.
+
+All tests use in-memory state to simulate the database without requiring a
+live PostgreSQL instance.
+"""
+
+import pytest
+
+from collections import deque
+
+from api.services.lifecycle_service import (
+    LifecycleService,
+    _compute_fingerprint_hash,
+    _normalize_resource_id,
+)
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+TENANT_ID = "tenant-abc"
+SUB_ID = "sub-001"
+SCAN_ID_1 = "11111111-1111-1111-1111-111111111111"
+SCAN_ID_2 = "22222222-2222-2222-2222-222222222222"
+
+
+def _make_finding(rule_id: str, resource_id: str, evidence_key: str = "") -> dict:
+    return {
+        "rule_id": rule_id,
+        "resource_id": resource_id,
+        "evidence_key": evidence_key,
+    }
+
+
+def _make_outcome(rule_id: str, status: str) -> dict:
+    return {"rule_id": rule_id, "status": status}
+
+
+# ---------------------------------------------------------------------------
+# Fake cursor / connection.
+#
+# The cursor consumes from a shared deque so multiple cursor() calls on the
+# same connection share one result stream. This mirrors how psycopg2 works
+# (multiple cursors on one connection see the same transaction state) and
+# avoids the "second cursor re-reads from the start" bug noted in code review.
+# ---------------------------------------------------------------------------
+
+
+class _FakeCursor:
+    """Fake psycopg2 cursor backed by a shared result deque."""
+
+    def __init__(self, results_deque: deque):
+        self._results = results_deque
+        self.executed: list = []
+        self._current = None
+
+    def execute(self, sql, params=None):
+        self.executed.append((sql.strip(), params))
+        self._current = self._results.popleft() if self._results else None
+
+    def fetchone(self):
+        return self._current
+
+    def fetchall(self):
+        if isinstance(self._current, list):
+            return self._current
+        return [] if self._current is None else [self._current]
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *args):
+        pass
+
+
+class _FakeConn:
+    """Fake connection whose cursor() calls share one result deque."""
+
+    def __init__(self, results: list):
+        self._deque: deque = deque(results)
+        self.committed = False
+        self._cursor_obj: _FakeCursor | None = None
+
+    def cursor(self, **_kwargs):
+        # Return a new cursor object but backed by the same shared deque.
+        self._cursor_obj = _FakeCursor(self._deque)
+        return self._cursor_obj
+
+    def commit(self):
+        self.committed = True
+
+    def rollback(self):
+        pass
+
+    def all_executed(self) -> list:
+        return self._cursor_obj.executed if self._cursor_obj else []
+
+
+# ---------------------------------------------------------------------------
+# Tests
+# ---------------------------------------------------------------------------
+
+
+class TestComputeFingerprintHash:
+    def test_hash_is_stable(self):
+        h1 = _compute_fingerprint_hash(TENANT_ID, SUB_ID, "/sub/001/rg/foo", "RULE-001", "", "1")
+        h2 = _compute_fingerprint_hash(TENANT_ID, SUB_ID, "/sub/001/rg/foo", "RULE-001", "", "1")
+        assert h1 == h2
+
+    def test_different_tenant_different_hash(self):
+        h1 = _compute_fingerprint_hash("tenant-A", SUB_ID, "/rg/foo", "RULE-001", "", "1")
+        h2 = _compute_fingerprint_hash("tenant-B", SUB_ID, "/rg/foo", "RULE-001", "", "1")
+        assert h1 != h2
+
+    def test_tenant_id_included_in_hash(self):
+        """Tenant isolation: fingerprint_hash must encode the tenant_id."""
+        h_a = _compute_fingerprint_hash("tenant-A", SUB_ID, "/rg/foo", "RULE-001", "", "1")
+        h_b = _compute_fingerprint_hash("tenant-B", SUB_ID, "/rg/foo", "RULE-001", "", "1")
+        assert h_a != h_b
+
+    def test_different_rule_different_hash(self):
+        h1 = _compute_fingerprint_hash(TENANT_ID, SUB_ID, "/rg/foo", "RULE-001", "", "1")
+        h2 = _compute_fingerprint_hash(TENANT_ID, SUB_ID, "/rg/foo", "RULE-002", "", "1")
+        assert h1 != h2
+
+
+class TestNormalizeResourceId:
+    def test_lowercase(self):
+        assert _normalize_resource_id("/subscriptions/SUB/resourceGroups/RG") == (
+            "/subscriptions/sub/resourcegroups/rg"
+        )
+
+    def test_strip_whitespace(self):
+        assert _normalize_resource_id("  /rg/foo  ") == "/rg/foo"
+
+
+class TestLifecycleServiceIdempotency:
+    """Applying the same scan_id twice must commit exactly once."""
+
+    def test_second_apply_is_no_op(self):
+        committed_count = 0
+
+        class _TrackingConn:
+            def __init__(self, already_applied: bool):
+                if already_applied:
+                    # idempotency check returns a row -> return immediately
+                    results = [("already-applied",)]
+                else:
+                    # idempotency check None, outcome insert None,
+                    # fingerprint upsert -> (1,), lifecycle lock -> None (new),
+                    # lifecycle insert -> (10,), transition insert None,
+                    # absent-findings query -> [], idempotency insert None
+                    results = [None, None, (1,), None, (10,), None, [], None]
+                self._deque: deque = deque(results)
+                self._cursor_obj = None
+
+            def cursor(self, **_kwargs):
+                self._cursor_obj = _FakeCursor(self._deque)
+                return self._cursor_obj
+
+            def commit(self):
+                nonlocal committed_count
+                committed_count += 1
+
+            def rollback(self):
+                pass
+
+        svc = LifecycleService()
+        svc.apply_scan(
+            _TrackingConn(False),
+            SCAN_ID_1,
+            SUB_ID,
+            TENANT_ID,
+            [_make_outcome("RULE-001", "SUCCESS")],
+            [_make_finding("RULE-001", "/rg/foo")],
+        )
+        svc.apply_scan(
+            _TrackingConn(True),
+            SCAN_ID_1,
+            SUB_ID,
+            TENANT_ID,
+            [_make_outcome("RULE-001", "SUCCESS")],
+            [_make_finding("RULE-001", "/rg/foo")],
+        )
+
+        # Only the first call should have committed.
+        assert committed_count == 1
+
+
+class TestLifecycleStateTransitions:
+    """State machine correctness tests using scripted cursor results."""
+
+    def _run(self, results, findings, outcomes):
+        conn = _FakeConn(results)
+        svc = LifecycleService()
+        svc.apply_scan(
+            conn,
+            SCAN_ID_1,
+            SUB_ID,
+            TENANT_ID,
+            outcomes,
+            findings,
+            evaluations=[{"rule_id": o["rule_id"], "resource_id": "/rg/foo", "status": "PASS"} for o in outcomes],
+        )
+        return conn
+
+    def _all_sql(self, conn: _FakeConn) -> list[str]:
+        return [sql for sql, _ in conn.all_executed()]
+
+    def test_new_finding_creates_open_lifecycle(self):
+        # Sequence (one shared deque, all execute() calls in order):
+        # 1. idempotency check -> None
+        # 2. scan_rule_outcomes insert (for RULE-001 outcome) -> None
+        # 3. fingerprint upsert RETURNING id -> (1,)
+        # 4. lifecycle FOR UPDATE -> None  (new)
+        # 5. lifecycle INSERT RETURNING id -> (10,)
+        # 6. transition insert -> None
+        # 7. absent-findings query (no resolving ids after seen_fingerprint_ids) -> []
+        # 8. idempotency insert -> None
+        results = [None, None, (1,), None, (10,), None, [], None]
+        conn = self._run(
+            results,
+            [_make_finding("RULE-001", "/rg/foo")],
+            [_make_outcome("RULE-001", "SUCCESS")],
+        )
+        assert conn.committed
+        sqls = self._all_sql(conn)
+        assert any("INSERT INTO finding_lifecycles" in s for s in sqls)
+        # Transition to OPEN must be recorded.
+        assert any("finding_lifecycle_transitions" in s and "'OPEN'" in s for s in sqls)
+
+    def test_scan_rule_outcomes_written(self):
+        """scan_rule_outcomes must be populated on every apply_scan call."""
+        results = [None, None, (1,), None, (10,), None, [], None]
+        conn = self._run(
+            results,
+            [_make_finding("RULE-001", "/rg/foo")],
+            [_make_outcome("RULE-001", "SUCCESS")],
+        )
+        sqls = self._all_sql(conn)
+        assert any("INSERT INTO scan_rule_outcomes" in s for s in sqls)
+
+    def test_open_finding_not_seen_in_success_scan_is_resolved(self):
+        # No findings; SUCCESS outcome -> existing OPEN resolved.
+        # 1. idempotency check -> None
+        # 2. scan_rule_outcomes insert -> None
+        # 3. absent-findings query (empty seen_ids branch) -> [(10,'OPEN',0,'RULE-001')]
+        # 4. UPDATE to RESOLVED -> None
+        # 5. transition insert (OPEN -> RESOLVED) -> None
+        # 6. idempotency insert -> None
+        results = [
+            None,
+            None,
+            [(10, "OPEN", 0, "RULE-001", "/rg/foo")],
+            None,
+            None,
+            None,
+        ]
+        conn = self._run(results, [], [_make_outcome("RULE-001", "SUCCESS")])
+        assert conn.committed
+        sqls = self._all_sql(conn)
+        assert any("RESOLVED" in s and "UPDATE" in s.upper() for s in sqls)
+
+    def test_open_finding_not_seen_in_failed_scan_stays_open(self):
+        # FAILED outcome -> fail-closed: no resolution.
+        # 1. idempotency check -> None
+        # 2. scan_rule_outcomes insert -> None
+        # (FAILED is not in resolving_rule_ids; no absent-findings query is issued)
+        # 3. idempotency insert -> None
+        results = [None, None, None]
+        conn = self._run(results, [], [_make_outcome("RULE-001", "FAILED")])
+        assert conn.committed
+        sqls = self._all_sql(conn)
+        assert not any("RESOLVED" in s and "UPDATE" in s.upper() for s in sqls)
+
+    def test_open_finding_not_seen_in_permission_denied_scan_stays_open(self):
+        results = [None, None, None]
+        conn = self._run(results, [], [_make_outcome("RULE-001", "PERMISSION_DENIED")])
+        assert conn.committed
+        sqls = self._all_sql(conn)
+        assert not any("RESOLVED" in s and "UPDATE" in s.upper() for s in sqls)
+
+    def test_resolved_finding_seen_again_becomes_reopened(self):
+        # Fingerprint exists (id=1), lifecycle row has state=RESOLVED -> REOPEN.
+        # 1. idempotency check -> None
+        # 2. scan_rule_outcomes insert -> None
+        # 3. fingerprint upsert RETURNING id -> (1,)
+        # 4. lifecycle FOR UPDATE -> (10,'RESOLVED',1,0,2)
+        # 5. UPDATE to REOPENED (resets consecutive_success_count=0) -> None
+        # 6. transition insert -> None
+        # 7. absent-findings query -> []
+        # 8. idempotency insert -> None
+        results = [None, None, (1,), (10, "RESOLVED", 1, 0, 2), None, None, [], None]
+        conn = self._run(
+            results,
+            [_make_finding("RULE-001", "/rg/foo")],
+            [_make_outcome("RULE-001", "SUCCESS")],
+        )
+        assert conn.committed
+        sqls = self._all_sql(conn)
+        assert any("REOPENED" in s and "UPDATE" in s.upper() for s in sqls)
+        # consecutive_success_count must be reset to 0 on reopen.
+        assert any("consecutive_success_count = 0" in s for s in sqls)
+
+    def test_rule_a_success_does_not_resolve_rule_b_finding(self):
+        """Rule-A SUCCESS must not resolve a finding belonging to Rule-B.
+
+        This is the most critical correctness invariant: a clean outcome for one
+        rule can only affect findings that were produced by that same rule.
+        """
+        # Scan has no findings (empty list), two outcomes:
+        #   RULE-001 SUCCESS  -> in resolving_rule_ids
+        #   RULE-002 FAILED   -> NOT in resolving_rule_ids
+        #
+        # Sequence (empty seen_ids branch):
+        # 1. idempotency check -> None
+        # 2. scan_rule_outcomes insert RULE-001 -> None
+        # 3. scan_rule_outcomes insert RULE-002 -> None
+        # 4. absent-findings query (ff.rule_id = ANY(['RULE-001'])) ->
+        #    returns only RULE-001's lifecycle row; RULE-002 is excluded by SQL
+        # 5. UPDATE RESOLVED for RULE-001 row -> None
+        # 6. transition insert -> None
+        # 7. idempotency insert -> None
+        results = [
+            None,  # idempotency check
+            None,  # scan_rule_outcomes RULE-001
+            None,  # scan_rule_outcomes RULE-002
+            [(10, "OPEN", 0, "RULE-001", "/rg/foo")],  # absent-findings query
+            None,  # UPDATE RESOLVED
+            None,  # transition insert
+            None,  # idempotency insert
+        ]
+        conn = self._run(
+            results,
+            [],
+            [_make_outcome("RULE-001", "SUCCESS"), _make_outcome("RULE-002", "FAILED")],
+        )
+        assert conn.committed
+        # Verify resolving_rule_ids in the SQL params contains only RULE-001.
+        absent_query = next(
+            (item for item in conn.all_executed() if "ff.rule_id = ANY" in item[0]),
+            None,
+        )
+        assert absent_query is not None, "absent-findings query was not issued"
+        _, params = absent_query
+        resolving_ids = params[-1]  # last param is resolving_rule_ids list
+        assert "RULE-001" in resolving_ids
+        assert "RULE-002" not in resolving_ids
+
+    def test_reopened_finding_absent_from_success_scan_is_resolved(self):
+        # REOPENED finding not seen in a SUCCESS scan must transition to RESOLVED.
+        # 1. idempotency -> None
+        # 2. scan_rule_outcomes insert -> None
+        # 3. absent-findings query (empty seen_ids branch) -> [(10,'REOPENED',0,'RULE-001')]
+        # 4. UPDATE to RESOLVED -> None
+        # 5. transition insert (REOPENED -> RESOLVED) -> None
+        # 6. idempotency insert -> None
+        results = [
+            None,
+            None,
+            [(10, "REOPENED", 0, "RULE-001", "/rg/foo")],
+            None,
+            None,
+            None,
+        ]
+        conn = self._run(results, [], [_make_outcome("RULE-001", "SUCCESS")])
+        assert conn.committed
+        sqls = self._all_sql(conn)
+        assert any("RESOLVED" in s and "UPDATE" in s.upper() for s in sqls)
+        # Transition from REOPENED to RESOLVED must be recorded.
+        assert any(
+            "finding_lifecycle_transitions" in sql and params == (10, "REOPENED", SCAN_ID_1)
+            for sql, params in conn.all_executed()
+        )
+
+    def test_reopened_finding_seen_again_increments_occurrence_stays_reopened(self):
+        # REOPENED + seen in scan: occurrence_count increments, no new state transition.
+        # 1. idempotency -> None
+        # 2. scan_rule_outcomes insert -> None
+        # 3. fingerprint upsert -> (1,)
+        # 4. lifecycle FOR UPDATE -> (10,'REOPENED',3,1,4)
+        # 5. UPDATE occurrence_count + 1 -> None
+        # 6. absent-findings query -> []
+        # 7. idempotency insert -> None
+        results = [None, None, (1,), (10, "REOPENED", 3, 1, 4), None, [], None]
+        conn = self._run(
+            results,
+            [_make_finding("RULE-001", "/rg/foo")],
+            [_make_outcome("RULE-001", "SUCCESS")],
+        )
+        assert conn.committed
+        sqls = self._all_sql(conn)
+
+        # No transition record should be emitted for REOPENED->REOPENED.
+        transition_to_reopened = [s for s in sqls if "finding_lifecycle_transitions" in s and "REOPENED" in s]
+        assert not transition_to_reopened
+
+        # occurrence_count should increment.
+        assert any("occurrence_count = occurrence_count + 1" in s for s in sqls)
+
+
+def test_empty_success_without_resource_evidence_does_not_resolve():
+    conn = _FakeConn([None, None, [(10, "OPEN", 0, "RULE-001", "/rg/foo")], None, None, None])
+    LifecycleService().apply_scan(conn, SCAN_ID_1, SUB_ID, TENANT_ID, [_make_outcome("RULE-001", "EMPTY_SUCCESS")], [])
+    assert not any("SET state = 'RESOLVED'" in sql for sql, _ in conn.all_executed())
+
+
+@pytest.mark.parametrize("status", ["UNKNOWN", "ERROR", "FAIL", "NOT_APPLICABLE"])
+def test_incomplete_resource_evidence_does_not_resolve(status):
+    conn = _FakeConn([None, None, None])
+    LifecycleService().apply_scan(
+        conn,
+        SCAN_ID_1,
+        SUB_ID,
+        TENANT_ID,
+        [_make_outcome("RULE-001", "SUCCESS")],
+        [],
+        evaluations=[{"rule_id": "RULE-001", "resource_id": "/rg/foo", "status": status}],
+    )
+    assert not any("SET state = 'RESOLVED'" in sql for sql, _ in conn.all_executed())
+
+
+def test_pass_for_one_resource_does_not_resolve_unobserved_resource():
+    conn = _FakeConn([None, None, [(10, "OPEN", 0, "RULE-001", "/rg/unobserved")], None])
+    LifecycleService().apply_scan(
+        conn,
+        SCAN_ID_1,
+        SUB_ID,
+        TENANT_ID,
+        [_make_outcome("RULE-001", "SUCCESS")],
+        [],
+        evaluations=[{"rule_id": "RULE-001", "resource_id": "/rg/foo", "status": "PASS"}],
+    )
+    assert not any("SET state = 'RESOLVED'" in sql for sql, _ in conn.all_executed())
+
+
+def test_conflicting_pass_and_unknown_cannot_resolve():
+    conn = _FakeConn([None, None, None])
+    LifecycleService().apply_scan(
+        conn,
+        SCAN_ID_1,
+        SUB_ID,
+        TENANT_ID,
+        [_make_outcome("RULE-001", "SUCCESS")],
+        [],
+        evaluations=[
+            {"rule_id": "RULE-001", "resource_id": "/rg/foo", "status": status} for status in ["PASS", "UNKNOWN"]
+        ],
+    )
+    assert not any("SET state = 'RESOLVED'" in sql for sql, _ in conn.all_executed())
+
+
+def test_current_finding_overrides_contradictory_resource_pass():
+    conn = _FakeConn([None, None, (1,), None, (10,), None, None])
+    LifecycleService().apply_scan(
+        conn,
+        SCAN_ID_1,
+        SUB_ID,
+        TENANT_ID,
+        [_make_outcome("RULE-001", "SUCCESS")],
+        [_make_finding("RULE-001", "/rg/foo")],
+        evaluations=[{"rule_id": "RULE-001", "resource_id": "/rg/foo", "status": "PASS"}],
+    )
+    assert not any("FROM finding_lifecycles fl" in sql for sql, _ in conn.all_executed())
+
+
+def test_evaluate_only_rule_can_resolve_without_rule_outcomes_entry():
+    """evaluate()-only rules (PR #381+) never emit rule_outcomes; they must still resolve."""
+    conn = _FakeConn([None, [(10, "OPEN", 0, "EVAL-RULE", "/rg/res")], None, None, None])
+    LifecycleService().apply_scan(
+        conn,
+        SCAN_ID_1,
+        SUB_ID,
+        TENANT_ID,
+        [],  # no rule_outcomes -- engine skipped scan() for this evaluate()-only rule
+        [],
+        evaluations=[{"rule_id": "EVAL-RULE", "resource_id": "/rg/res", "status": "PASS"}],
+    )
+    resolved_sqls = [sql for sql, _ in conn.all_executed() if "SET state = 'RESOLVED'" in sql]
+    assert resolved_sqls, "evaluate()-only PASS should resolve the finding"
+
+
+def test_evaluate_only_rule_with_error_status_cannot_resolve():
+    """An evaluate()-only rule where all evaluations are ERROR must not resolve."""
+    conn = _FakeConn([None, None, None])
+    LifecycleService().apply_scan(
+        conn,
+        SCAN_ID_1,
+        SUB_ID,
+        TENANT_ID,
+        [],
+        [],
+        evaluations=[{"rule_id": "EVAL-RULE", "resource_id": "/rg/res", "status": "ERROR"}],
+    )
+    assert not any("SET state = 'RESOLVED'" in sql for sql, _ in conn.all_executed())
diff --git a/tests/test_lifecycle_postgres.py b/tests/test_lifecycle_postgres.py
new file mode 100644
index 00000000..4c0f386b
--- /dev/null
+++ b/tests/test_lifecycle_postgres.py
@@ -0,0 +1,88 @@
+"""Lifecycle transitions against a migrated PostgreSQL database."""
+
+import os
+import uuid
+
+import pytest
+
+from api.services.lifecycle_service import LifecycleService
+
+pytestmark = pytest.mark.skipif(not os.environ.get("DATABASE_URL"), reason="requires migrated PostgreSQL")
+
+
+def test_resolution_requires_current_pass_for_each_resource():
+    import psycopg2
+
+    conn = psycopg2.connect(os.environ["DATABASE_URL"])
+    tenant = f"lifecycle-test-{uuid.uuid4()}"
+    subscription = str(uuid.uuid4())
+    scans = [str(uuid.uuid4()) for _ in range(5)]
+    service = LifecycleService()
+    outcome = [{"rule_id": "AZ-TEST-001", "status": "SUCCESS"}]
+    resources = ["/resource/pass", "/resource/unknown", "/resource/unobserved"]
+    findings = [{"rule_id": "AZ-TEST-001", "resource_id": resource} for resource in resources]
+
+    def states():
+        with conn.cursor() as cur:
+            cur.execute(
+                "SELECT ff.resource_id_normalized, fl.state FROM finding_lifecycles fl "
+                "JOIN finding_fingerprints ff ON ff.id = fl.fingerprint_id WHERE ff.tenant_id = %s",
+                (tenant,),
+            )
+            return dict(cur.fetchall())
+
+    try:
+        with conn.cursor() as cur:
+            for scan in scans:
+                cur.execute(
+                    "INSERT INTO scans (scan_id, subscription_id, started_at, status) "
+                    "VALUES (%s, %s, NOW(), 'completed')",
+                    (scan, subscription),
+                )
+        conn.commit()
+        service.apply_scan(conn, scans[0], subscription, tenant, outcome, findings)
+        assert set(states().values()) == {"OPEN"}
+        evidence = [
+            {"rule_id": "AZ-TEST-001", "resource_id": resources[0], "status": "PASS"},
+            {"rule_id": "AZ-TEST-001", "resource_id": resources[1], "status": "UNKNOWN"},
+        ]
+        service.apply_scan(conn, scans[1], subscription, tenant, outcome, [], evaluations=evidence)
+        assert states() == {resources[0]: "RESOLVED", resources[1]: "OPEN", resources[2]: "OPEN"}
+        service.apply_scan(conn, scans[2], subscription, tenant, outcome, findings[:1])
+        assert states()[resources[0]] == "REOPENED"
+        service.apply_scan(
+            conn,
+            scans[3],
+            subscription,
+            tenant,
+            [{"rule_id": "AZ-TEST-001", "status": "FAILED"}],
+            [],
+            evaluations=evidence,
+        )
+        assert states()[resources[0]] == "REOPENED"
+        service.apply_scan(conn, scans[4], subscription, tenant, outcome, [], evaluations=evidence)
+        assert states()[resources[0]] == "RESOLVED"
+        service.apply_scan(conn, scans[4], subscription, tenant, outcome, [], evaluations=evidence)
+        with conn.cursor() as cur:
+            cur.execute("SELECT COUNT(*) FROM finding_lifecycle_transitions WHERE scan_id = %s", (scans[4],))
+            assert cur.fetchone()[0] == 1
+    finally:
+        conn.rollback()
+        with conn.cursor() as cur:
+            cur.execute(
+                "DELETE FROM finding_lifecycle_transitions WHERE lifecycle_id IN "
+                "(SELECT fl.id FROM finding_lifecycles fl JOIN finding_fingerprints ff "
+                "ON ff.id = fl.fingerprint_id WHERE ff.tenant_id = %s)",
+                (tenant,),
+            )
+            cur.execute(
+                "DELETE FROM finding_lifecycles WHERE fingerprint_id IN "
+                "(SELECT id FROM finding_fingerprints WHERE tenant_id = %s)",
+                (tenant,),
+            )
+            cur.execute("DELETE FROM finding_fingerprints WHERE tenant_id = %s", (tenant,))
+            cur.execute("DELETE FROM scan_rule_outcomes WHERE scan_id = ANY(%s::uuid[])", (scans,))
+            cur.execute("DELETE FROM scan_lifecycle_applications WHERE scan_id = ANY(%s::uuid[])", (scans,))
+            cur.execute("DELETE FROM scans WHERE scan_id = ANY(%s::uuid[])", (scans,))
+        conn.commit()
+        conn.close()
diff --git a/tests/test_oidc_auth.py b/tests/test_oidc_auth.py
index f8fe5a2f..386b026b 100644
--- a/tests/test_oidc_auth.py
+++ b/tests/test_oidc_auth.py
@@ -294,3 +294,14 @@ def test_oidc_wrong_tenant_is_rejected_at_the_api(oidc_client):
     resp = oidc_client.get("/api/findings", headers=headers)
     assert resp.status_code == 401
     assert resp.get_json()["error"] == "Invalid token"
+
+
+def test_signed_subscription_scope_is_preserved_by_real_oidc_verifier():
+    principal = _verifier().verify(_token(_claims(subscription_id="sub-authorized")))
+    assert principal["subscription_id"] == "sub-authorized"
+    assert principal["tenant"] == TENANT
+
+
+@pytest.mark.parametrize("scope", [[], {}, "", " ", 42])
+def test_malformed_signed_subscription_scope_is_rejected(scope):
+    assert _rejected(_verifier(), _token(_claims(subscription_id=scope))).status == 401
diff --git a/tests/test_patterns.py b/tests/test_patterns.py
new file mode 100644
index 00000000..6422e156
--- /dev/null
+++ b/tests/test_patterns.py
@@ -0,0 +1,411 @@
+"""Tests for PatternService and GET /api/v1/patterns routes.
+
+Pattern detection tests use a mocked DB; route tests use the Flask test client
+with mocked database queries.
+"""
+
+import secrets
+import time
+from collections import deque
+from unittest.mock import MagicMock, patch
+
+import jwt
+import pytest
+
+TENANT_ID = "tenant-abc"
+SUB_ID = "sub-001"
+SCAN_ID = "33333333-3333-3333-3333-333333333333"
+
+_TEST_JWT_SECRET = secrets.token_urlsafe(32)
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+
+def _make_token(sub_id: str | None = None) -> str:
+    payload = {
+        "sub": "test-user",
+        "role": "admin",
+        "tid": TENANT_ID,
+        "iat": int(time.time()),
+        "exp": int(time.time()) + 3600,
+    }
+    if sub_id:
+        payload["subscription_id"] = sub_id
+    return jwt.encode(payload, _TEST_JWT_SECRET, algorithm="HS256")
+
+
+def _auth_headers(sub_id: str | None = None) -> dict:
+    return {
+        "Authorization": f"Bearer {_make_token(sub_id)}",
+        "Content-Type": "application/json",
+    }
+
+
+# ---------------------------------------------------------------------------
+# Fake cursor / connection for service tests
+# ---------------------------------------------------------------------------
+
+
+class _FakeCursor:
+    """Fake cursor backed by a shared deque so all cursors on one connection share state."""
+
+    def __init__(self, results_deque: deque):
+        self._results = results_deque
+        self.executed: list = []
+        self._current = None
+
+    def execute(self, sql, params=None):
+        self.executed.append((sql.strip(), params))
+        self._current = self._results.popleft() if self._results else None
+
+    def fetchone(self):
+        return self._current
+
+    def fetchall(self):
+        if isinstance(self._current, list):
+            return self._current
+        return [] if self._current is None else [self._current]
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *args):
+        pass
+
+
+class _FakeConn:
+    """Fake connection whose cursor() calls share one result deque."""
+
+    def __init__(self, fetchall_pages: list):
+        self._deque: deque = deque(fetchall_pages)
+        self.committed = False
+        self._cursors: list = []
+        self._cursor_obj = None
+
+    def cursor(self, **_kwargs):
+        self._cursor_obj = _FakeCursor(self._deque)
+        self._cursors.append(self._cursor_obj)
+        return self._cursor_obj
+
+    def commit(self):
+        self.committed = True
+
+    def rollback(self):
+        pass
+
+    def all_executed(self) -> list:
+        result = []
+        for c in self._cursors:
+            result.extend(c.executed)
+        return result
+
+
+# ---------------------------------------------------------------------------
+# PatternService unit tests
+# ---------------------------------------------------------------------------
+
+
+class TestPatternServiceDetection:
+    def _run(self, pages, extra_pages=None):
+        """Run detect_and_publish with scripted DB results."""
+        from api.services.pattern_service import PatternService
+
+        all_pages = list(pages)
+        if extra_pages:
+            all_pages.extend(extra_pages)
+        conn = _FakeConn(all_pages)
+        svc = PatternService()
+        count = svc.detect_and_publish(conn, SCAN_ID, SUB_ID, TENANT_ID)
+        return count, conn
+
+    def test_persistent_finding_detected_when_occurrence_ge_3(self):
+        # persistent_finding query returns 1 row -> 1 pattern upserted.
+        # cross_resource query returns [] -> 0.
+        # reopened query returns [] -> 0.
+        count, conn = self._run(
+            [
+                [{"lifecycle_id": 10}],  # persistent_finding
+                [],  # cross_resource_recurrence
+                [],  # reopened_finding
+            ]
+        )
+        assert count == 1
+
+    def test_persistent_finding_not_detected_when_occurrence_lt_3(self):
+        # All queries return empty.
+        count, conn = self._run([[], [], []])
+        assert count == 0
+
+    def test_cross_resource_recurrence_detected_when_2_open_lifecycles(self):
+        # cross_resource query returns 1 group with 2 lifecycle_ids -> 2 patterns.
+        count, conn = self._run(
+            [
+                [],  # persistent_finding
+                [{"rule_id": "RULE-001", "lifecycle_ids": [10, 11], "lc_count": 2}],
+                [],  # reopened_finding
+            ]
+        )
+        assert count == 2
+
+    def test_reopened_finding_detected_when_reopen_count_ge_1(self):
+        count, conn = self._run(
+            [
+                [],  # persistent_finding
+                [],  # cross_resource_recurrence
+                [{"lifecycle_id": 20}],  # reopened_finding
+            ]
+        )
+        assert count == 1
+
+    def test_pattern_response_includes_threshold_and_algorithm_version(self):
+        """The upsert call must include threshold and algorithm_version."""
+        from api.services.pattern_service import PatternService, _ALGORITHM_VERSION, _PERSISTENT_THRESHOLD
+
+        conn = _FakeConn(
+            [
+                [{"lifecycle_id": 10}],  # persistent_finding
+                [],  # cross_resource_recurrence
+                [],  # reopened_finding
+            ]
+        )
+        svc = PatternService()
+        svc.detect_and_publish(conn, SCAN_ID, SUB_ID, TENANT_ID)
+
+        # Find the INSERT INTO patterns call and verify the params.
+        executed = conn._cursor_obj.executed
+        insert_sql, params = next(((sql, p) for sql, p in executed if "INSERT INTO patterns" in sql), (None, None))
+        assert insert_sql is not None
+        # params order: pattern_type, lifecycle_id, tenant_id, subscription_id,
+        #               scan_id, finding_ids, threshold, algorithm_version
+        assert params[6] == _PERSISTENT_THRESHOLD
+        assert params[7] == _ALGORITHM_VERSION
+
+
+# ---------------------------------------------------------------------------
+# Flask route tests for GET /api/v1/patterns
+# ---------------------------------------------------------------------------
+
+
+@pytest.fixture
+def app_client(monkeypatch):
+    """Flask test client with JWT and mocked DB."""
+    monkeypatch.setenv("DATABASE_URL", "postgresql://postgres:postgres@127.0.0.1:1/openshield?connect_timeout=1")
+    monkeypatch.setenv("JWT_SECRET", _TEST_JWT_SECRET)
+
+    from api.app import create_app
+
+    application = create_app()
+    application.config["TESTING"] = True
+    application.config["JWT_SECRET"] = _TEST_JWT_SECRET
+    return application.test_client()
+
+
+def _mock_db_rows(rows: list, total: int):
+    """Build a mock DatabaseManager whose conn returns scripted rows."""
+    mock_conn = MagicMock()
+    mock_cursor = MagicMock()
+    mock_cursor.__enter__ = MagicMock(return_value=mock_cursor)
+    mock_cursor.__exit__ = MagicMock(return_value=False)
+
+    # First fetchall -> rows; second fetchone -> {"count": total}
+    mock_cursor.fetchall.return_value = rows
+    mock_cursor.fetchone.return_value = {"count": total}
+
+    mock_conn.cursor.return_value = mock_cursor
+
+    mock_db = MagicMock()
+    mock_db._get_conn.return_value = mock_conn
+    return mock_db
+
+
+def _sample_pattern_row(sub_id: str = SUB_ID) -> dict:
+    from datetime import datetime, timezone
+
+    return {
+        "id": 1,
+        "pattern_type": "persistent_finding",
+        "lifecycle_id": 10,
+        "tenant_id": TENANT_ID,
+        "subscription_id": sub_id,
+        "scan_id": "33333333-3333-3333-3333-333333333333",
+        "finding_ids": [],
+        "threshold": 3,
+        "algorithm_version": "1",
+        "created_at": datetime(2026, 1, 1, tzinfo=timezone.utc),
+        "updated_at": datetime(2026, 1, 1, tzinfo=timezone.utc),
+    }
+
+
+class TestPatternsRouteList:
+    def test_list_returns_patterns_and_total(self, app_client, monkeypatch):
+        row = _sample_pattern_row()
+        mock_db = _mock_db_rows([row], 1)
+
+        with patch("api.routes.patterns._get_db", return_value=mock_db):
+            resp = app_client.get(
+                "/api/v1/patterns",
+                headers=_auth_headers(sub_id=SUB_ID),
+            )
+
+        assert resp.status_code == 200
+        data = resp.get_json()
+        assert "patterns" in data
+        assert "total" in data
+        assert data["total"] == 1
+        assert len(data["patterns"]) == 1
+
+    def test_list_invalid_limit_returns_400(self, app_client):
+        resp = app_client.get(
+            "/api/v1/patterns?limit=999",
+            headers=_auth_headers(sub_id=SUB_ID),
+        )
+        assert resp.status_code == 400
+
+    def test_list_invalid_pattern_type_returns_400(self, app_client):
+        resp = app_client.get(
+            "/api/v1/patterns?pattern_type=not_a_real_type",
+            headers=_auth_headers(sub_id=SUB_ID),
+        )
+        assert resp.status_code == 400
+
+    def test_list_unknown_query_param_returns_400(self, app_client):
+        resp = app_client.get(
+            "/api/v1/patterns?foo=bar",
+            headers=_auth_headers(sub_id=SUB_ID),
+        )
+        assert resp.status_code == 400
+
+    def test_list_without_subscription_returns_400(self, app_client):
+        # JWT with no subscription_id and no query param must be rejected.
+        resp = app_client.get(
+            "/api/v1/patterns",
+            headers=_auth_headers(),
+        )
+        assert resp.status_code == 400
+
+    def test_list_cross_subscription_query_param_rejected(self, app_client):
+        # JWT scoped to sub-A must reject a query param asking for sub-B.
+        resp = app_client.get(
+            "/api/v1/patterns?subscription_id=sub-B",
+            headers=_auth_headers(sub_id="sub-A"),
+        )
+        assert resp.status_code == 400
+
+    def test_list_returns_only_authorized_subscription(self, app_client):
+        """subscription_id from JWT must be passed as a SQL parameter."""
+        row_authorized = _sample_pattern_row(sub_id="sub-authorized")
+        mock_db = _mock_db_rows([row_authorized], 1)
+
+        with patch("api.routes.patterns._get_db", return_value=mock_db):
+            resp = app_client.get(
+                "/api/v1/patterns",
+                headers=_auth_headers(sub_id="sub-authorized"),
+            )
+
+        assert resp.status_code == 200
+        # Verify subscription_id was enforced in the SQL WHERE clause parameters.
+        mock_cursor = mock_db._get_conn.return_value.cursor.return_value
+        first_call = mock_cursor.execute.call_args_list[0]
+        _, params = first_call[0]
+        assert "sub-authorized" in params
+
+    def test_list_requires_auth(self, app_client):
+        resp = app_client.get("/api/v1/patterns")
+        assert resp.status_code == 401
+
+
+class TestPatternsRouteGet:
+    def _mock_get_db(self, row):
+        mock_db = MagicMock()
+        mock_conn = MagicMock()
+        mock_cursor = MagicMock()
+        mock_cursor.__enter__ = MagicMock(return_value=mock_cursor)
+        mock_cursor.__exit__ = MagicMock(return_value=False)
+        mock_cursor.fetchone.return_value = row
+        mock_conn.cursor.return_value = mock_cursor
+        mock_db._get_conn.return_value = mock_conn
+        return mock_db
+
+    def test_get_existing_pattern(self, app_client):
+        row = _sample_pattern_row()
+        mock_db = self._mock_get_db(row)
+
+        with patch("api.routes.patterns._get_db", return_value=mock_db):
+            resp = app_client.get(
+                "/api/v1/patterns/1",
+                headers=_auth_headers(sub_id=SUB_ID),
+            )
+
+        assert resp.status_code == 200
+        data = resp.get_json()
+        assert data["id"] == 1
+        assert data["pattern_type"] == "persistent_finding"
+        assert data["threshold"] == 3
+        assert data["algorithm_version"] == "1"
+
+    def test_get_nonexistent_pattern_returns_404(self, app_client):
+        # DB returns None when id + subscription_id don't match any row.
+        mock_db = self._mock_get_db(None)
+
+        with patch("api.routes.patterns._get_db", return_value=mock_db):
+            resp = app_client.get(
+                "/api/v1/patterns/99999",
+                headers=_auth_headers(sub_id=SUB_ID),
+            )
+
+        assert resp.status_code == 404
+
+    def test_get_cross_subscription_returns_404(self, app_client):
+        # Pattern exists for sub-001 but caller is scoped to sub-other.
+        # The SQL adds subscription_id = %s to the WHERE clause so the DB
+        # returns None, and the caller sees 404 (not 403, to avoid leaking
+        # that the pattern ID exists in another subscription).
+        mock_db = self._mock_get_db(None)
+
+        with patch("api.routes.patterns._get_db", return_value=mock_db):
+            resp = app_client.get(
+                "/api/v1/patterns/1",
+                headers=_auth_headers(sub_id="sub-other"),
+            )
+
+        assert resp.status_code == 404
+        # Verify subscription_id was enforced as a SQL parameter (not just checked
+        # in Python), so removing the WHERE clause would break this test.
+        mock_cursor = mock_db._get_conn.return_value.cursor.return_value
+        call_args = mock_cursor.execute.call_args
+        _, params = call_args[0]
+        assert "sub-other" in params
+
+    def test_get_requires_auth(self, app_client):
+        resp = app_client.get("/api/v1/patterns/1")
+        assert resp.status_code == 401
+
+
+def test_pattern_query_cannot_supply_scope_missing_from_verified_token(app_client):
+    with patch("api.routes.patterns._get_db") as db:
+        response = app_client.get("/api/v1/patterns?subscription_id=sub-other", headers=_auth_headers())
+    assert response.status_code == 400
+    db.assert_not_called()
+
+
+def test_verified_tenant_overrides_deployment_tenant(app_client, monkeypatch):
+    monkeypatch.setenv("OPENSHIELD_TENANT_ID", "other-tenant")
+    db = _mock_db_rows([], 0)
+    with patch("api.routes.patterns._get_db", return_value=db):
+        response = app_client.get("/api/v1/patterns", headers=_auth_headers(SUB_ID))
+    assert response.status_code == 200
+    params = db._get_conn.return_value.cursor.return_value.execute.call_args_list[0][0][1]
+    assert params[:2] == (TENANT_ID, SUB_ID)
+
+
+def test_missing_verified_tenant_cannot_fall_back_to_deployment(app_client, monkeypatch):
+    monkeypatch.setenv("OPENSHIELD_TENANT_ID", TENANT_ID)
+    payload = {"sub": "viewer", "role": "viewer", "subscription_id": SUB_ID, "exp": int(time.time()) + 3600}
+    token = jwt.encode(payload, _TEST_JWT_SECRET, algorithm="HS256")
+    with patch("api.routes.patterns._get_db") as db:
+        response = app_client.get("/api/v1/patterns", headers={"Authorization": f"Bearer {token}"})
+    assert response.status_code == 400
+    db.assert_not_called()