# v1.7 disclosure — fragment 1 of 4: claim-set E session-handling

Calibration fragment — per-class rollup and row-level findings for
claim-set E (session-handling review), findings E-1 through E-4.

## Per-class rollup

| class | n | TP | CTX | NOISE | noise driver |
|---|---|---|---|---|---|
| cookie-flags | 2 | 2 | 0 | 0 | — |
| session-rotation | 2 | 1 | 1 | 0 | — |
| **total** | **4** | **3** | **1** | **0** | |

Severity mix: 2 HIGH / 1 MED / 1 LOW.

**Adjudicated precision: 3/4 = 75.0%.**

## Row-level table (all 4)

| # | claim | sev | class.rule | location | verdict | note |
|---|---|---|---|---|---|---|
| 1 | E-1 | HIGH | cookie-flags.r1 | web/session.js:88 | TP | session cookie missing HttpOnly |
| 2 | E-2 | MED | cookie-flags.r2 | web/session.js:91 | TP | SameSite=None without Secure on http path |
| 3 | E-3 | HIGH | session-rotation.r1 | auth/login.js:120 | TP | session id not rotated post-auth |
| 4 | E-4 | LOW | session-rotation.r2 | auth/login.js:134 | CTX | fixation window bounded by 5m TTL |