WA-VERIFY-107: Audit load_defaults behavioral flags coverage (Rails 7.0/7.1)

[kitcommerce]

Summary

Adds notes/WA-VERIFY-107-load-defaults-audit.md — a complete coverage audit of all config.load_defaults behavioral flags introduced in Rails 7.0 and 7.1, mapped to Workarea's actual test and documentation state.

Closes #1126

What was audited

• Current load_defaults version in all three engine dummy apps
• Every Rails 7.0 versioned default flag
• Every Rails 7.1 versioned default flag
• QueryCache middleware position and test coverage
• BigDecimal/Money cache round-trip test coverage

Key findings

PASS (2)

• All engine dummy apps consistently pinned to load_defaults 6.1 ✅
• QueryCache middleware is present and cache-between-request isolation is tested ✅

N/A (9)

• 7 ActiveRecord-only flags (Workarea uses Mongoid)
• cookies_same_site_protection — compatible with Workarea's cookie usage
• cache_format_version 7.1 — deploy-procedure concern, already documented in pattern doc

NEEDS-FOLLOW-UP (4 gaps identified)

1. BigDecimal/Money cache round-trip — no automated regression test exists; silent precision loss possible at cache layer
2. raise_on_open_redirects — open-redirect paths in Workarea controllers not explicitly verified
3. active_job.use_big_decimal_serializer — no job-argument round-trip test for BigDecimal/Money values
4. add_autoload_paths_to_load_path = false — blocked on Mongoid 8; cannot validate until 7.1 appraisal bundles

Files changed

• notes/WA-VERIFY-107-load-defaults-audit.md (new)

Client impact

None — documentation and verification only, no code changes.