[Vinald]

A full re-pass of REVIEW.md, widened beyond the original code review to cover dependencies, build toolchain, security, and test-coverage gaps — plus three small fixes surfaced along the way.

REVIEW.md changes

• Status table at the top marking H1/M1/M2/L8/L9 as fixed (with PR refs) and everything else as still open, so the document stays trustworthy as a living reference.
• New: Dependencies & toolchain — pdf_combiner/file_picker/share_plus/archive are multiple majors behind (with a note that pdf_combiner upgrading likely lets the file_magic_number override be dropped entirely); documents the JDK/Gradle-daemon toolchain trap hit while verifying PR Add in-app tutorial screen with a first-launch welcome prompt #8 on the emulator (flutter config --jdk-dir silently overrides JAVA_HOME, and killed processes can leave stale Gradle/Kotlin daemons pinned to a dead JDK); flags that CI only runs analyze+test, never an actual flutter build apk.
• New: Security review — no network calls anywhere in lib/, no hardcoded secrets, no path-traversal/zip-slip surface (archive only builds zips, never extracts untrusted ones), no missing Android permissions (image_picker/file_picker/share_plus merge their own via AAR manifests). Unencrypted local storage and the web build's un-pinned pdf.js CDN load are noted as Info-level, standard for the app's threat model.
• New: Test coverage gaps — a table of every screen with zero test coverage (SettingsScreen, LatexEditorScreen, PreviewScreen, PdfCombinerScreen, ExportSheet, SignaturePicker, contact_section.dart, and the resume/letter editors' actual save/dirty-state flow), with SignaturePicker called out as highest-value since it feeds directly into the still-open M3 finding.
• New: code quality — unused cupertino_icons dependency (C1); the devtools_options.yaml tracking issue (C4) — the .gitignore entry from PR Rewrite README and add architecture + contributing docs #3 didn't actually untrack it since it had already been git add -A'd in PR Replace personal CV content with generic placeholder data #2, so it kept showing up as a diff in every subsequent PR.

Code changes

• pubspec.yaml — removed unused cupertino_icons (C1).
• devtools_options.yaml — untracked via git rm --cached (C4); stays on disk, .gitignore now actually takes effect.
• README.md — added the JDK/Gradle-daemon troubleshooting note to the build section (D2), so the next person who hits "JAVA_HOME is set to an invalid directory" after exporting JAVA_HOME doesn't lose the time I did.

flutter analyze clean · all 32 tests pass.

🤖 Generated with Claude Code