ADR-0029: SLA deadlines are permanent facts in their own table

Status: Accepted (WP-12). Implemented in 0008_security.sql (vulnerability_finding_deadlines) and crates/commonlayer-security/src/domain/deadlines.rs.

Context

The eligibility engine judges maintainers on whether acknowledgement and remediation deadlines were met. If a breach flag could be cleared (by acknowledging late, or by a finding reopening), past facts would change under evaluations that already relied on them.

Decision

• Each deadline of each finding episode is a row in vulnerability_finding_deadlines. A trigger raises CL003 when a breach or an approaching notice would be cleared.
• A reopened finding starts a new episode with new deadlines; earlier breaches stay.
• "Approaching" fires once when less than max(25 % of the window, 24 h) remains; for windows of 24 h or less the 25 % mark is used.
• Low, negligible and unknown severities remediate by the end of the calendar month after the month the finding opened ("end of the next maintenance cycle").
• While an exception is approved, the remediation deadline is the extended date and is excluded from breach checks; on expiry or revocation it reverts to the original date.

Consequences

• SlaRecord for eligibility is built from this table, so evaluations re-derive the same way later.
• Closing a finding marks unmet deadlines of the episode as met at that time; a late closure stays late.