Article 14 flaw notices give broad known facts about the product. The 72-hour stage also gives fixes or risk steps now in place. It lists steps users can take.
A weak part only matters to the report when the team can link it to a product that the maker shipped.
Build a version matrix
Create one row for each product release. Add fields for the part version, build source, weak-code state, setup, and path to the code. Add support state, sales States, and a ready risk step. Record proof links and the check time for each result.
Use fixed build and release IDs when you can. One market name may cover files, device code, or use modes that differ. If each user gets a custom build, save the setup rule used to decide if the part is present.
Reconcile conflicting inventories
Compare part scans with build lists, fixed source sets, release records, and product setup. Record clashes. Do not pick the newest tool result by default. A scan may show today’s work area while the event affects an old image.
For a split or local form of a part, save the source change and patch set. The vendor’s version name may not prove the weak code is present. Use a reviewer who can trace the result to the released product.
Use explicit impact states
Give each version one of five states: at risk, not at risk, check open, proof missing, or replaced. Add a reason. “Not seen” does not mean “not at risk.” One weak release does not put the whole product family at risk.
Link each risk step to the versions on which it was tested. A setup change may help one use but fail or cause harm in another. Keep this line clear in the authority report and user note.
Add a state for user action. Mark it none found, under test, approved, or fix ready. Link it to versions and use rules. Do not present a code idea as a step users can take.
Freeze the reporting snapshot
Before each Article 14 stage, save the table used for the report. Later code updates should add to the live record. They must not change the proof for the old report.
Give each open cell an owner if it could change scope or user steps. A reviewer should quickly see which shipped releases have the flaw. They should see which are exposed and what users can do now.
At each handoff, compare the table with the last filed copy. Explain releases added, removed, or still open. Keep the proof for the change. A reviewer can then tell better facts from silent scope drift.
A parts list or scan tool may give proof. It does not make the legal result. Keep the human-checked product map and its source clear.
Continue this workflow with the component-trigger assessment and the stable identifier map.