diff --git a/AUDIT-REPORT.md b/AUDIT-REPORT.md
index c5e2557..39dadbe 100644
--- a/AUDIT-REPORT.md
+++ b/AUDIT-REPORT.md
@@ -3,7 +3,7 @@
 **Date:** 2026-05-27
 **Auditor:** Claude Code (6 parallel specialist agents)
 **Scope:** Full monorepo — API, Web, Mobile, Lambdas, Infrastructure/CI/CD, QA/Testing
-**Remediation Status:** Phase 1-6 complete (2026-05-27). All Critical and High findings fixed. 20 Medium findings fixed. CI pipeline runs all 108 tests. Test infrastructure bootstrapped.
+**Remediation Status:** Phase 1-6 complete (2026-05-27). All Critical and High findings fixed. 25 Medium findings fixed. CI pipeline runs all 108 tests. Test infrastructure bootstrapped.
 
 ---
 
@@ -96,15 +96,15 @@ All items below have been remediated:
 |----|---------|--------|
 | WEB-M1 | Dev login shown when client ID absent — verify API gate | |
 | WEB-M2 | 401 interceptor clears token but not Redux state | **FIXED** — dispatches Redux logout on 401 |
-| WEB-M3 | Proposal form accepts 1-char scope (no minimum) | |
-| WEB-M4 | ServiceCategory `Other` not in shared contract | |
+| WEB-M3 | Proposal form accepts 1-char scope (no minimum) | **FIXED** — 10-char minimum with inline MUI error |
+| WEB-M4 | ServiceCategory `Other` not in shared contract | **FIXED** — added `Other` to shared contract, aligned with API enum |
 | WEB-M5 | `CreateProposalRequest` type diverges from shared contract | **FIXED** — typed ServiceCategory/Priority, ProposalFormState interface |
 | WEB-M6 | No file size/type validation on vendor PDF upload | **FIXED** — PDF-only, 25MB max, toast on failure |
 | WEB-M7 | AdminWorkspace shows no error state for failed fetch | **FIXED** — Alert with retry button on query error |
-| WEB-M8 | Dashboard stats show zeros on fetch error | |
-| WEB-M9 | Missing loading state for line items | |
+| WEB-M8 | Dashboard stats show zeros on fetch error | **FIXED** — Alert with retry button on both dashboards |
+| WEB-M9 | Missing loading state for line items | **FIXED** — MUI Skeleton in admin workspace |
 | WEB-M10 | Proposal state transitions not guarded on client | **FIXED** — canApprove/canSend/canRevise guards with tooltips |
-| WEB-M11 | `returnToReview` API method wired but never called from UI | |
+| WEB-M11 | `returnToReview` API method wired but never called from UI | **FIXED** — Return to Review button on approved proposals with confirmation dialog |
 | WEB-M12 | Table rows not keyboard accessible | |
 | WEB-M13 | ToastContainer rendered outside RouterProvider | **FIXED** — moved inside ErrorBoundary |