@@ -342,7 +342,7 @@ def resolve_target_response_timeout(timeout_profile, standard_timeout):
 # The backend release, recorded in every JobConfig at launch so a report names
 # the scanner that produced it. `pentester_api_01.__VER__` must equal it (a test
 # guards the pair; the plugin loader reads the literal there).
-REDMESH_BACKEND_VERSION = "0.12.0"
+REDMESH_BACKEND_VERSION = "0.13.0"
 
 # =====================================================================
 # Risk score computation
 
@@ -180,6 +180,10 @@ class Finding:
   # `enrich_finding_for_probe`; the report labels the latter as policy instead
   # of printing a bare badge (RM-086 item 5).
   severity_source: str = ""
+  # What happened after an accepted login, for findings that record one
+  # (`models.finding_schema.AUTHENTICATED_ACTIONS`); "" otherwise. Not identity
+  # and not content: `finding_identity` reads neither (RM-118).
+  authenticated_action: str = ""
 
   # Metadata
   ai_generated: bool = False             # P12 invariant — must stay False for finding data
@@ -267,14 +271,15 @@ def compute_dedup_key(
     normalised asset and classification from that payload, and ignores
     `description` and `severity`.
 
-    It does **not** yet ignore the title, and the difference matters here. No
-    blackbox probe sets `affected_assets`, so every `Finding` reaching this
-    method falls to `dedup_key`'s last-resort branch, which folds in the
-    lowercased title to keep two genuinely different findings from one probe
-    from colliding. So rewording a *description* preserves the key — the defect
-    B2 exists to fix — while rewording a *title* still forks it. RM-061 owns
-    giving blackbox findings a url and parameter; until it lands, this is as
-    stable as identity can honestly be.
+    It does **not** yet ignore the title, and the difference matters here.
+    Almost no blackbox probe sets `affected_assets` (the CSRF probe is the
+    exception, RM-117), so most `Finding`s reaching this method fall to
+    `dedup_key`'s last-resort branch, which folds in the lowercased title to
+    keep two genuinely different findings from one probe from colliding. So
+    rewording a *description* preserves the key — the defect B2 exists to fix —
+    while rewording a *title* still forks it. RM-061 owns giving the remaining
+    blackbox findings a url and parameter; until it lands, this is as stable as
+    identity can honestly be.
     """
     return _dedup_key(
       self._identity_payload(probe_id), asset_canonical=asset_canonical,
 
@@ -31,6 +31,22 @@
 )
 
 
+def _probe_display_name(probe_id):
+  """The registered `display_name` for a probe id, or "" when it has none.
+
+  Importing `worker` is what registers the probes (`@register_probe` runs at
+  import), so a host that never imported a worker still resolves names.
+  Graybox probes are not in this registry and keep their id in the report.
+  """
+  try:
+    from .. import worker as _worker  # noqa: F401  (registers the probes)
+    from ..worker.probe_registry import get_probe_metadata
+    metadata = get_probe_metadata(probe_id)
+  except Exception:
+    return ""
+  return getattr(metadata, "display_name", "") or ""
+
+
 def normalize_risk_score(raw_total):
   """
   Map a raw risk total onto 0-100 without saturating.
@@ -202,6 +218,11 @@ def normalize_flat_finding(finding, port, protocol, probe_name, category):
       # had, reading a raw severity string where `Finding.compute_signature`
       # read `Severity.value`.
       item["probe"] = probe_name
+      # What the report prints for the probe (RM-118). Not identity and not
+      # content: `finding_identity` reads neither.
+      display_name = _probe_display_name(probe_name)
+      if display_name:
+        item["probe_display_name"] = display_name
       # The probe-time signature wins over anything computed here.
       #
       # This walk runs on opposite sides of `_redact_report` depending on the
 
@@ -13,6 +13,7 @@
 from dataclasses import dataclass, asdict, field
 
 from extensions.business.cybersec.red_mesh.models.shared import _strip_none
+from extensions.business.cybersec.red_mesh.models.finding_schema import read_archived_findings
 from ..tenancy.execution import (
   ExecutionBinding, binding_from_record, binding_value, copy_bound_config, checked_archive_config,
 )
@@ -407,7 +408,7 @@ def from_dict(cls, d: dict) -> PassReport:
       quick_summary=d.get("quick_summary"),
       llm_failed=d.get("llm_failed"),
       llm_report_sections=d.get("llm_report_sections"),
-      findings=d.get("findings"),
+      findings=read_archived_findings(d.get("findings")),
       scan_metrics=d.get("scan_metrics"),
       worker_scan_metrics=d.get("worker_scan_metrics"),
       redmesh_test_attestation=d.get("redmesh_test_attestation"),
@@ -471,6 +472,13 @@ def from_dict(cls, d: dict) -> UiAggregate:
     )
 
 
+def _read_archived_pass(pass_dict):
+  """Gate an archived pass's findings without reshaping the pass (RM-062)."""
+  if not isinstance(pass_dict, dict) or "findings" not in pass_dict:
+    return pass_dict
+  return {**pass_dict, "findings": read_archived_findings(pass_dict["findings"])}
+
+
 @dataclass(frozen=True)
 class JobArchive:
   """
@@ -522,7 +530,7 @@ def from_dict(cls, d: dict) -> JobArchive:
       job_id=d["job_id"],
       job_config=d.get("job_config", {}),
       timeline=d.get("timeline", []),
-      passes=d.get("passes", []),
+      passes=[_read_archived_pass(p) for p in d.get("passes", [])],
       ui_aggregate=d.get("ui_aggregate", {}),
       duration=d.get("duration", 0),
       date_created=d.get("date_created", 0),
 
@@ -229,7 +229,8 @@ def dedup_key(finding: dict, *, asset_canonical: str | None = None) -> str:
   neither a scenario id nor a specific location. Blackbox probes do not yet
   attach url/parameter — RM-061 owns that — so for them the title is the only
   thing separating "reflected XSS in search" from "stored XSS in comment": same
-  port, same probe, same CWE, same synthesised `{host, port}` asset. Dropping it
+  port, same probe, same CWE, same synthesised `{host, port}` asset. (The CSRF
+  probe already sets page + form action, RM-117.) Dropping it
   unconditionally would merge two real findings into one, which is a worse
   failure than the wording-fork it avoids. Findings that do carry a location or
   a scenario id — every graybox finding, and every blackbox finding once RM-061
 
@@ -31,6 +31,21 @@
 # half-confidence finding with nothing anywhere saying it was not understood.
 FINDING_CONFIDENCES = ("certain", "firm", "tentative")
 
+# What happened after an accepted login (RM-118). The report read this from
+# prose — a `; authenticated action:` marker in evidence and title phrases — so a
+# probe rewording flipped a client-facing line with every test green. ""
+# means the finding records no login.
+AUTHENTICATED_ACTION_PERFORMED = "performed"          # the RoE-gated action ran and returned output
+AUTHENTICATED_ACTION_ATTEMPTED = "attempted"          # permitted; tried or ran, completed nothing
+AUTHENTICATED_ACTION_NOT_PERMITTED = "not_permitted"  # the RoE withheld it
+AUTHENTICATED_ACTION_NOT_APPLICABLE = "not_applicable"  # no action exists for the service
+AUTHENTICATED_ACTIONS = (
+  AUTHENTICATED_ACTION_PERFORMED,
+  AUTHENTICATED_ACTION_ATTEMPTED,
+  AUTHENTICATED_ACTION_NOT_PERMITTED,
+  AUTHENTICATED_ACTION_NOT_APPLICABLE,
+)
+
 REQUIRED_FINDING_FIELDS = (
   "finding_id",
   "title",
@@ -73,6 +88,8 @@
   # opened, so the caveat the letter promised was recorded and not shown.
   "severity_source",
   "backport_status",
+  # Read by name for §3.5.2 (RM-118).
+  "authenticated_action",
   "affected_assets",
   "evidence_items",
   "evidence_artifacts",
@@ -149,6 +166,7 @@ class FlatFinding:
   status: str = ""
   severity_source: str = ""
   backport_status: str = ""
+  authenticated_action: str = ""
   # Verbatim carrier for anything the contract does not name. Not a dumping
   # ground: it is what makes "the contract does not know this field" different
   # from "this field did not exist", which is the distinction the whitelists
@@ -214,6 +232,9 @@ def validate_flat_finding(payload: Any) -> list[str]:
     errors.append(f"severity is invalid: {payload['severity']}")
   if "confidence" in payload and payload["confidence"] not in FINDING_CONFIDENCES:
     errors.append(f"confidence is invalid: {payload['confidence']}")
+  action = payload.get("authenticated_action", "")
+  if action and action not in AUTHENTICATED_ACTIONS:
+    errors.append(f"authenticated_action is invalid: {action}")
 
   return errors
 
@@ -251,3 +272,20 @@ def flat_finding_from_dict(payload: dict) -> FlatFinding:
 
   extra = {key: value for key, value in payload.items() if key not in _KNOWN_FIELDS}
   return FlatFinding(**known, extra=extra, _present=present)
+
+
+def read_archived_findings(findings: Any) -> Any:
+  """Read an archived findings list through the contract (RM-062).
+
+  Each finding goes through `flat_finding_from_dict`, so a schema or version
+  this build does not understand raises instead of being read under the wrong
+  assumptions. The round trip loses nothing, and the source key order is kept so
+  the stored content does not change. `None` (no findings key) passes through.
+  """
+  if findings is None:
+    return None
+  out = []
+  for payload in findings:
+    restored = flat_finding_from_dict(payload).to_dict()
+    out.append({key: restored[key] for key in payload})
+  return out
@@ -572,7 +572,7 @@ def _run_manual_analysis_worker(work: _ManualAnalysisWork) -> _ManualAnalysisOut
   return _ManualAnalysisWorker(work).run()
 
 
-__VER__ = '0.12.0'
+__VER__ = '0.13.0'
 
 
 _CONFIG = {