diff --git a/docs/plans/current_spec.md b/docs/plans/current_spec.md
index 02e97d43..f015a5bb 100644
--- a/docs/plans/current_spec.md
+++ b/docs/plans/current_spec.md
@@ -1,13 +1,36 @@
 # PR #583 CI Failure Remediation Plan
 
 **Created**: 2026-01-31
-**Updated**: 2026-01-31 (Phase 5: Codecov Config Investigation Added)
+**Updated**: 2026-02-01 (Phase 6: Latest Codecov Comment Analysis)
 **Status**: Active
 **PR**: #583 - Feature/beta-release
 **Target**: Unblock merge by fixing all CI failures + align Codecov with local coverage
 
 ---
 
+## 🚨 Immediate Next Steps
+
+**Priority Order**:
+
+1. **Re-run CI Workflow** - Local coverage is healthy (86.2% on Commit), Codecov shows 0%. Likely a stale/failed upload.
+   ```bash
+   # In GitHub: Close and reopen PR, or push an empty commit
+   git commit --allow-empty -m "chore: trigger CI re-run for Codecov refresh"
+   git push
+   ```
+
+2. **Investigate E2E Failures** - Visit [workflow run 21541010717](https://github.com/Wikid82/Charon/actions/runs/21541010717) and identify failing test names.
+
+3. **Fix E2E Tests** (Playwright_Dev):
+   - Reproduce locally with `docker-rebuild-e2e` then `npx playwright test`
+   - Update assertions/selectors as needed
+
+4. **Monitor Codecov Dashboard** - After CI re-run, verify coverage matches local:
+   - Expected: Commit at 86.2% (not 0%)
+   - Expected: Overall patch > 85%
+
+---
+
 ## Executive Summary
 
 PR #583 has multiple CI issues. Current status:
@@ -18,6 +41,47 @@ PR #583 has multiple CI issues. Current status:
 | **E2E Test Assertion** | Test expects actionable error, gets JSON parse error | Simple | ✅ Fixed |
 | **Frontend Coverage** | 84.53% vs 85% target (0.47% gap) | Medium | ✅ Fixed |
 | **Codecov Total 67%** | Non-production code inflating denominator | Medium | 🔴 Needs codecov.yml update |
+| **Codecov Patch 55.81%** | 19 lines missing coverage in 3 files | Medium | 🔴 **NEW - Needs addressed** |
+| **E2E Workflow Failures** | Tests failing in workflow run 21541010717 | Medium | 🔴 **NEW - Investigation needed** |
+
+## Latest Codecov Report (2026-02-01)
+
+From PR #583 Codecov comment:
+
+| File | Patch Coverage | Missing | Partials |
+|------|----------------|---------|----------|
+| `backend/internal/api/handlers/import_handler.go` | **0.00%** | 12 lines | 0 |
+| `backend/internal/caddy/importer.go` | **73.91%** | 3 lines | 3 lines |
+| `frontend/src/hooks/useImport.ts` | **87.50%** | 0 lines | 1 line |
+| **TOTAL PATCH** | **55.81%** | **19 lines** | — |
+
+### Target Paths for Remediation
+
+**Highest Impact**: `import_handler.go` with 12 missing lines (63% of gap)
+
+**LOCAL COVERAGE VERIFICATION (2026-02-01)**:
+
+| File/Function | Local Coverage | Codecov Patch | Analysis |
+|---------------|----------------|---------------|----------|
+| `import_handler.go:Commit` | **86.2%** ✅ | 0.00% ❌ | **Likely CI upload failure** |
+| `import_handler.go:GetPreview` | 82.6% | — | Healthy |
+| `import_handler.go:CheckMountedImport` | 0.0% | — | Needs tests |
+| `importer.go:NormalizeCaddyfile` | 81.2% | 73.91% | Acceptable |
+| `importer.go:ConvertToProxyHosts` | 0.0% | — | Needs tests |
+
+**Key Finding**: Local tests show **86.2% coverage on Commit()** but Codecov reports **0%**. This suggests:
+1. Coverage upload failed in CI
+2. Codecov cached stale data
+3. CI ran with different test filter
+
+**Immediate Action**: Re-run CI workflow and monitor Codecov upload logs.
+
+**Lines to cover in `import_handler.go` (if truly uncovered)**:
+- Lines ~676-691: Error logging paths for `proxyHostSvc.Update()` and `proxyHostSvc.Create()`
+- Lines ~740: Session save warning path
+
+**Lines impractical to cover in `importer.go`**:
+- Lines 137-141: OS-level temp file error handlers (WriteString/Close failures)
 
 ### New Investigation: Codecov Configuration Gaps
 
@@ -720,6 +784,113 @@ find tests -name "*.spec.ts" | wc -l  # Should be 59
 
 ---
 
+## Phase 6: Current Blockers (2026-02-01)
+
+**Priority**: 🔴 BLOCKING MERGE
+**Status**: 🔴 Active
+
+### 6.1 Codecov Patch Coverage (55.81% → 85% Target)
+
+**Total Gap**: 19 lines missing coverage across 3 files
+
+#### 6.1.1 `import_handler.go` (12 Missing Lines - Highest Priority)
+
+**File**: [backend/internal/api/handlers/import_handler.go](backend/internal/api/handlers/import_handler.go)
+
+**ANALYSIS (2026-02-01)**: Local coverage verification shows tests ARE working:
+
+| Function | Local Coverage |
+|----------|----------------|
+| `Commit` | **86.2%** ✅ |
+| `GetPreview` | 82.6% |
+| `Upload` | 72.6% |
+| `CheckMountedImport` | 0.0% ⚠️ |
+
+**Why Codecov Shows 0%**:
+The discrepancy is likely due to one of:
+1. **Coverage upload failure** in CI (network/auth issue)
+2. **Stale Codecov data** from a previous failed run
+3. **Codecov baseline mismatch** (comparing against wrong branch)
+
+**Verification Commands**:
+```bash
+# Verify local coverage
+cd backend && go test -coverprofile=cover.out ./internal/api/handlers -run "ImportHandler"
+go tool cover -func=cover.out | grep import_handler
+# Expected: Commit = 86.2%
+
+# Check CI workflow logs for:
+# - "Uploading coverage report" success/failure
+# - Codecov token errors
+# - Coverage file generation
+```
+
+**Recommended Actions**:
+1. Re-run the CI workflow to trigger fresh Codecov upload
+2. Check Codecov dashboard for upload history
+3. If still failing, verify `codecov.yml` flags configuration
+
+#### 6.1.2 `importer.go` (3 Missing, 3 Partial Lines)
+
+**File**: [backend/internal/caddy/importer.go](backend/internal/caddy/importer.go#L137-L141)
+
+Lines 137-141 are OS-level error handlers documented as impractical to test. Coverage is at 73.91% which is acceptable.
+
+**Actions**:
+- Accept these 6 lines as exceptions
+- Add explicit ignore comment if Codecov supports inline exclusion
+- OR relax patch target temporarily while fixing import_handler.go
+
+#### 6.1.3 `useImport.ts` (1 Partial Line)
+
+**File**: [frontend/src/hooks/useImport.ts](frontend/src/hooks/useImport.ts)
+
+Only 1 partial line at 87.50% coverage - this is acceptable and shouldn't block.
+
+### 6.2 E2E Test Failures (Workflow Run 21541010717)
+
+**Workflow URL**: https://github.com/Wikid82/Charon/actions/runs/21541010717
+
+**Investigation Steps**:
+
+1. **Check Workflow Summary**:
+   - Visit the workflow URL above
+   - Identify which shards/browsers failed (12 total: 4 shards × 3 browsers)
+   - Look for common failure patterns
+
+2. **Analyze Failed Jobs**:
+   - Click on failed job → "View all annotations"
+   - Note test file names and error messages
+   - Check if failures are in same test file (isolated bug) vs scattered (environment issue)
+
+3. **Common E2E Failure Patterns**:
+
+   | Pattern | Error Example | Likely Cause |
+   |---------|---------------|--------------|
+   | Timeout | `locator.waitFor: Timeout 30000ms exceeded` | Backend not ready, slow CI |
+   | Connection Refused | `connect ECONNREFUSED ::1:8080` | Container didn't start |
+   | Assertion Failed | `Expected: ... Received: ...` | UI/API behavior changed |
+   | Selector Not Found | `page.locator(...).click: Error: locator resolved to 0 elements` | Component refactored |
+
+4. **Remediation by Pattern**:
+
+   - **Timeout/Connection**: Check if `docker-rebuild-e2e` step ran, verify health checks
+   - **Assertion Mismatch**: Update test expectations to match new behavior
+   - **Selector Issues**: Update selectors to match new component structure
+
+5. **Local Reproduction**:
+   ```bash
+   # Rebuild E2E environment
+   .github/skills/scripts/skill-runner.sh docker-rebuild-e2e
+
+   # Run specific failing test (replace with actual test name from CI)
+   npx playwright test tests/<failing-test>.spec.ts --project=chromium
+   ```
+
+**Delegation**: Playwright_Dev to investigate and fix failing tests
+
+---
+
 ## Implementation Checklist
 
 ### Phase 1: Frontend (Estimated: 5 minutes) ✅ RESOLVED
@@ -727,48 +898,49 @@ find tests -name "*.spec.ts" | wc -l  # Should be 59
 - [x] Run frontend tests locally to verify 8 tests pass
 - [x] Commit with message: `fix(frontend): add missing data-testid for multi-file import button`
 
-### Phase 2: Backend Coverage (Estimated: 30-60 minutes) ✅ COMPLETED
+### Phase 2: Backend Coverage (Estimated: 30-60 minutes) ⚠️ NEEDS VERIFICATION
 - [x] **Part A: import_handler.go error paths**
   - Added `ProxyHostServiceInterface` interface for testable dependency injection
   - Added `NewImportHandlerWithService()` constructor for mock injection
   - Created `mockProxyHostService` in test file with configurable failure functions
   - Fixed `TestImportHandler_Commit_UpdateFailure` to use mock (was previously skipped)
-  - **Commit function coverage: 43.7% → 86.2%**
-  - Lines 676 (Update error) and 691 (Create error) now covered
+  - **Claimed coverage: 43.7% → 86.2%** ⚠️ **CODECOV SHOWS 0% - NEEDS INVESTIGATION**
 - [x] **Part B: importer.go untestable paths**
-  - Added documentation comments to lines 140-144 explaining why WriteString/Close error paths are impractical to test
-  - Did NOT exclude entire file from codecov (would harm valuable coverage)
-  - `NormalizeCaddyfile` coverage: 81.2% (remaining uncovered lines are OS-level fault handlers)
-- [x] Run backend tests with coverage to verify improvement
+  - Added documentation comments to lines 140-144
+  - `NormalizeCaddyfile` coverage: 73.91% (acceptable)
+- [ ] **Part C: Verify tests actually run in CI**
+  - Check if tests are excluded by build tags
+  - Verify mock injection is working
 
 ### Phase 3: Codecov Configuration (Estimated: 5 minutes) ✅ COMPLETED
 - [x] Relaxed patch coverage target from 100% to 85% in `codecov.yml`
 
 ### Phase 4: Final Remediation (Estimated: 60-75 minutes) ✅ COMPLETED
 - [x] **Task 4.1: E2E Test Fix** (Playwright_Dev, 15 min)
-  - File: `tests/tasks/caddy-import-debug.spec.ts` lines 243-245
-  - Action: Updated assertion to validate import errors are surfaced
-  - Commit: `fix(e2e): update import directive test to match actual caddy error`
 - [x] **Task 4.2: ImportCaddy.tsx Unit Tests** (Frontend_Dev, 45-60 min)
-  - File: `frontend/src/pages/__tests__/ImportCaddy-handlers.test.tsx` (23 test cases)
-  - Result: Coverage raised from 32.6% to 78.26% (exceeds 60% target)
-  - Commit: `test(frontend): add ImportCaddy unit tests for coverage target`
 
 ### Phase 5: Codecov Configuration Fix (Estimated: 15 minutes) ✅ COMPLETED
 - [x] **Task 5.1: Update codecov.yml ignore patterns**
-  - File: `codecov.yml`
-  - Action: Added 77 comprehensive ignore patterns (test files, utilities, configs, entry points, infrastructure)
-  - Commit: `chore(codecov): add comprehensive ignore patterns for test utilities and configs`
 - [x] **Task 5.2: Added Uptime.test.tsx** (9 test cases)
-  - Covers loading/empty states, monitor grouping, modal interactions, status badges
 - [ ] **Task 5.3: Verify on CI** (pending next push)
-  - Push changes and wait for Codecov upload
-  - Check Codecov dashboard shows 82%+ total (not 67%)
-  - Verify backend and frontend flags both show 84%+
 
-### Phase 6: Final Verification (Estimated: 10 minutes)
-- [x] Push changes and monitor CI
-- [ ] Verify all checks pass (including Codecov total)
+### Phase 6: Current Blockers (Estimated: 60-90 minutes) 🔴 IN PROGRESS
+- [ ] **Task 6.1: Investigate import_handler.go 0% coverage**
+  - Run local coverage to verify tests execute error paths
+  - Check CI logs for test execution
+  - Fix mock injection if needed
+- [ ] **Task 6.2: Investigate E2E failures**
+  - Fetch workflow run 21541010717 logs
+  - Identify failing test names
+  - Determine root cause (flaky vs real failure)
+- [ ] **Task 6.3: Apply fixes and push**
+  - Backend test fixes if needed
+  - E2E test fixes if needed
+  - Verify patch coverage reaches 85%
+
+### Phase 7: Final Verification (Estimated: 10 minutes)
+- [ ] Push changes and monitor CI
+- [ ] Verify all checks pass (including Codecov patch ≥ 85%)
 - [ ] Request re-review if applicable
 
 ---
diff --git a/docs/reports/qa_report.md b/docs/reports/qa_report.md
index 947a80d1..c00bee43 100644
--- a/docs/reports/qa_report.md
+++ b/docs/reports/qa_report.md
@@ -1,9 +1,9 @@
-# QA Report - Full Validation
+# QA Report: PR #583 E2E Test Failures
 
-**Date:** February 13, 2026
-**Version:** v0.16.0 (current)
-**Author:** QA Automation
-**Type:** Definition of Done - Full Validation
+**Date**: 2026-01-29
+**PR**: #583 - fix: Caddy Import bug remediation and E2E coverage
+**Branch**: `feature/beta-release`
+**Workflow Run**: 21541010717
 
 ---
 
@@ -11,212 +11,253 @@
 
 | **Category**              | **Status**        | **Details**                                    |
 |---------------------------|-------------------|------------------------------------------------|
-| Playwright E2E Tests      | ✅ PASS           | 211 passed, 23 skipped, 0 failures             |
-| Security E2E Tests        | ✅ PASS           | All security-tests project passed              |
-| Backend Coverage          | ✅ PASS           | 83.8% (threshold: 80%)                         |
-| Frontend Coverage         | ✅ PASS           | 84.95% (threshold: 80%)                        |
-| TypeScript Type Check     | ✅ PASS           | No type errors                                 |
-| Pre-commit Hooks          | ⚠️ CONDITIONAL    | Version mismatch warning (non-blocking)        |
-| Trivy Filesystem Scan     | ✅ PASS           | 0 vulnerabilities in project dependencies      |
-| Docker Image Security     | ⚠️ CONDITIONAL    | 7 HIGH in base OS packages (no upstream fix)   |
-| Go Vet                    | ✅ PASS           | No issues                                      |
-| ESLint                    | ✅ PASS           | 0 errors, 1 warning                            |
+| Backend Unit Tests        | ✅ PASS           | All packages passing                           |
+| Playwright E2E Tests      | ❌ FAIL           | 848 passed, 107 skipped, 4 failed              |
+| PR Patch Coverage         | ⚠️ BELOW TARGET   | 55.81% (target: 100%)                          |
 
-**Overall Recommendation:** ✅ CONDITIONAL PASS
+**Overall Status:** ❌ **BLOCKED** - Requires fixes to 4 E2E tests
 
 ---
 
-## 1. Playwright E2E Tests
+## Summary of All Failures
 
-**Status: ✅ PASS**
+| Priority | Test Name | File:Line | Error Type | Duration |
+|----------|-----------|-----------|------------|----------|
+| **CRITICAL** | Emergency server bypasses main app security | [emergency-server.spec.ts:158](../tests/emergency-server/emergency-server.spec.ts#L158) | Assertion (403 vs 200) | 3.1s |
+| **CRITICAL** | should enable all security modules simultaneously | [combined-enforcement.spec.ts:105](../tests/security-enforcement/combined-enforcement.spec.ts#L105) | Timeout (30s exceeded) | 46.6s |
+| **HIGH** | should detect SQL injection patterns in request validation | [waf-enforcement.spec.ts:159](../tests/security-enforcement/waf-enforcement.spec.ts#L159) | Timeout (15s exceeded) | 10.0s |
+| **MEDIUM** | should show user status badges | [user-management.spec.ts:74](../tests/settings/user-management.spec.ts#L74) | Timeout (30s exceeded) | 58.4s |
 
-| Metric      | Count  |
-|-------------|--------|
-| Passed      | 211    |
-| Skipped     | 23     |
-| Failed      | 0      |
-
-### Skipped Tests Explanation
-
-The 23 skipped tests fall into documented categories:
-- **Middleware Enforcement Tests:** Rate limiting, ACL blocking, WAF injection tests
-  - These are enforced by Cerberus middleware on port 80
-  - Verified in Go integration tests (`backend/integration/`)
-- **Browser-specific Tests:** Firefox/WebKit not run in this validation
-
-**Validation:** Skipped tests are intentional per [playwright-typescript.instructions.md](../../.github/instructions/playwright-typescript.instructions.md#testing-scope-clarification)
-
-### Security Tests Project
-
-All security module UI tests passed:
-- Real-time logs display
-- Security dashboard toggles
-- CrowdSec integration UI
+**Overall Results (Local Run)**:
+- Total Tests: 959
+- Passed: 848 (88%)
+- Failed: 4
+- Skipped: 107
 
 ---
 
-## 2. Coverage Tests
+## Root Cause Analysis
 
-### Backend Coverage
+### 1. Emergency Server Test 3 (CRITICAL)
 
-**Status: ✅ PASS**
+**File**: [tests/emergency-server/emergency-server.spec.ts#L158](../tests/emergency-server/emergency-server.spec.ts#L158)
 
-| Metric            | Value   |
-|-------------------|---------|
-| Coverage          | 83.8%   |
-| Threshold         | 80%     |
-| Test Files        | All     |
-| Failures          | 0       |
+**Symptom**: Test expects HTTP 403 but receives 200.
 
-**Profile:** `backend/cover.out` (5197 lines)
+**Root Cause**: **E2E Testing Scope Mismatch**
 
-### Frontend Coverage
+The test attempts to verify ACL enforcement by:
+1. Enabling ACL security via API settings
+2. Expecting subsequent API requests to return 403 (blocked)
 
-**Status: ✅ PASS**
+However, ACL enforcement happens at the **Caddy proxy layer (port 80)**, not the Go backend (port 8080). E2E tests hit port 8080 directly, bypassing Caddy's security middleware.
 
-| Metric            | Value      |
-|-------------------|------------|
-| Coverage          | 84.95%     |
-| Threshold         | 80%        |
-| Test Files        | 134 passed |
-| Failures          | 0          |
-
-**Breakdown:**
-- Statements: 84.95%
-- Branches: 78.69%
-- Functions: 82.79%
-- Lines: 84.95%
-
----
-
-## 3. Type Safety
-
-**Status: ✅ PASS**
-
-```
-$ tsc --noEmit
-(no output - all types valid)
+**Current Status**: ✅ **FIXED** - Test is now marked with `test.skip()` with proper documentation:
+```typescript
+// SKIP: ACL enforcement happens at Caddy proxy layer, not Go backend.
+// E2E tests hit port 8080 directly, bypassing Caddy security middleware.
+// This test requires full Caddy+Security integration environment.
+// See: docs/plans/e2e_failure_investigation.md
+test.skip('Test 3: Emergency server bypasses main app security', async ({ request }) => {
 ```
 
-No TypeScript compilation errors detected.
+**Validation**: This behavior is verified by **integration tests** in `backend/integration/cerberus_integration_test.go`.
 
 ---
 
-## 4. Pre-commit Hooks
+### 2. Combined Security Enforcement (CRITICAL)
 
-**Status: ⚠️ CONDITIONAL**
+**File**: [tests/security-enforcement/combined-enforcement.spec.ts#L105](../tests/security-enforcement/combined-enforcement.spec.ts#L105)
 
-| Hook                       | Status    | Notes                              |
-|----------------------------|-----------|-------------------------------------|
-| fix end of files           | ✅ Passed |                                     |
-| trailing whitespace        | ✅ Passed |                                     |
-| check yaml                 | ✅ Passed |                                     |
-| check json                 | ✅ Passed |                                     |
-| markdownlint               | ✅ Passed |                                     |
-| eslint                     | ✅ Passed |                                     |
-| go-vet                     | ✅ Passed |                                     |
-| gofmt                      | ✅ Passed |                                     |
-| hadolint                   | ✅ Passed |                                     |
-| version mismatch           | ⚠️ Warning | staticcheck version diff (non-blocking) |
+**Symptom**: Timeout waiting for security modules to report enabled status.
 
-**Warning Details:**
-- Hook `golangci-lint` has declared version 1.63.8, but actual is 1.64.6
-- This is a pre-commit config update issue, not a code quality issue
-- **Recommendation:** Update `.pre-commit-config.yaml` to match installed version
+**Root Cause**: **Incomplete Test Refactoring**
+
+The test body was emptied (replaced with comments) but NOT marked as skipped:
+```typescript
+test('should enable all security modules simultaneously', async ({}, testInfo) => {
+  // Security module activation is now enforced through Caddy middleware.
+  // E2E tests route through Caddy's security middleware pipeline.
+});
+```
+
+The stale test output shows the **OLD** test implementation timing out at line 142 with `.toPass()` assertions. The current code has replaced this with an empty body, causing the test to pass trivially.
+
+**Issue**: The test runner still executes this test (just passes immediately). This is **not properly skipped** and creates confusion about coverage.
+
+**Recommended Fix**: Convert to `test.skip()` with documentation.
 
 ---
 
-## 5. Security Scans
+### 3. WAF Enforcement - SQL Injection Detection (HIGH)
 
-### Trivy Filesystem Scan
+**File**: [tests/security-enforcement/waf-enforcement.spec.ts#L159](../tests/security-enforcement/waf-enforcement.spec.ts#L159)
 
-**Status: ✅ PASS**
+**Symptom**: Timeout waiting for WAF to report enabled status.
 
-```
-Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
+**Root Cause**: **Same as #2 - Incomplete Refactoring**
+
+The test body was emptied but not skipped:
+```typescript
+test('should detect SQL injection patterns in request validation', async () => {
+  // WAF (Coraza) runs as a Caddy plugin.
+  // WAF settings are saved and blocking behavior is enforced through Caddy middleware.
+});
 ```
 
-No vulnerabilities detected in project dependencies.
+WAF blocking behavior is enforced at the Caddy layer via Coraza, verified by integration tests in `backend/integration/coraza_integration_test.go`.
 
-### Docker Image Security Scan
-
-**Status: ⚠️ CONDITIONAL**
-
-| Severity | Count | Notes                                |
-|----------|-------|--------------------------------------|
-| CRITICAL | 0     | None                                 |
-| HIGH     | 7     | Base OS packages (libc, libtasn1)    |
-| MEDIUM   | 0     | None                                 |
-| LOW      | 0     | None                                 |
-
-**HIGH Vulnerabilities (Base OS - No Fix Available):**
-
-| Package    | CVE             | Fix Status       |
-|------------|-----------------|------------------|
-| libc6      | CVE-2024-33600  | No fix available |
-| libc6      | CVE-2024-33601  | No fix available |
-| libc6      | CVE-2024-33602  | No fix available |
-| libc6      | CVE-2024-33599  | No fix available |
-| libc-bin   | (same as above) | No fix available |
-| libtasn1-6 | CVE-2024-12133  | No fix available |
-
-**Assessment:**
-- All HIGH vulnerabilities are in Debian base image packages
-- No upstream fixes available
-- **Risk Mitigation:** Monitor Debian security updates, update base image when patches release
+**Recommended Fix**: Convert to `test.skip()` with documentation.
 
 ---
 
-## 6. Linting
+### 4. User Status Badges Display (MEDIUM)
 
-### Go Vet
+**File**: [tests/settings/user-management.spec.ts#L74](../tests/settings/user-management.spec.ts#L74)
 
-**Status: ✅ PASS**
+**Symptom**: 58.4s timeout waiting for "active" status badge element.
 
-```
-$ go vet ./...
-(no output - no issues)
+**Root Cause**: **UI Feature Not Yet Implemented**
+
+The test code has a TODO comment acknowledging this:
+```typescript
+test('should show user status badges', async ({ page }) => {
+  // TODO: Re-enable when user status badges are added to the UI.
 ```
 
-### ESLint
+However, the test is NOT skipped, causing it to timeout waiting for a non-existent UI element.
 
-**Status: ✅ PASS**
-
-| Errors   | Warnings |
-|----------|----------|
-| 0        | 1        |
-
-**Warning:**
-- File: `frontend/src/contexts/AuthContext.tsx:79`
-- Rule: `@typescript-eslint/no-explicit-any`
-- Message: Unexpected use of `any` type
-
-**Assessment:** Single `any` usage in error handling - acceptable technical debt.
+**Recommended Fix**: Convert to `test.skip()` until the UI feature is implemented.
 
 ---
 
-## Conclusion
+## Recommended Fixes
 
-### Pass Criteria Met
+### Fix 1: Mark Security Enforcement Tests as Skipped (CRITICAL)
 
-| Criteria                              | Status |
-|---------------------------------------|--------|
-| All E2E tests pass (0 failures)       | ✅     |
-| Backend coverage ≥ 80%                | ✅     |
-| Frontend coverage ≥ 80%               | ✅     |
-| No TypeScript errors                  | ✅     |
-| No ESLint errors                      | ✅     |
-| No critical security vulnerabilities  | ✅     |
-| Pre-commit hooks pass                 | ✅     |
+**File**: `tests/security-enforcement/combined-enforcement.spec.ts`
+**Line**: 105
 
-### Recommendations
+```typescript
+// BEFORE (current):
+test('should enable all security modules simultaneously', async ({}, testInfo) => {
+  // Security module activation is now enforced through Caddy middleware.
+  // E2E tests route through Caddy's security middleware pipeline.
+});
 
-1. **Pre-commit Config:** Update `golangci-lint` version in `.pre-commit-config.yaml`
-2. **Docker Security:** Monitor Debian security updates for libc/libtasn1 patches
-3. **TypeScript:** Consider typing the error handler in AuthContext.tsx
+// AFTER (recommended):
+test.skip('should enable all security modules simultaneously', async ({}, testInfo) => {
+  // SKIP: Security module enforcement verified via Cerberus middleware (port 80).
+  // See: backend/integration/cerberus_integration_test.go
+});
+```
 
-### Final Verdict
+### Fix 2: Mark WAF Enforcement Tests as Skipped (HIGH)
 
-**✅ CONDITIONAL PASS - Ready for merge/release**
+**File**: `tests/security-enforcement/waf-enforcement.spec.ts`
+**Line**: 159 and 163
 
-The codebase meets all Definition of Done criteria. Conditional items (base OS vulnerabilities, pre-commit version mismatch) are documented and do not block release.
+```typescript
+// BEFORE:
+test('should detect SQL injection patterns in request validation', async () => {
+  // WAF (Coraza) runs as a Caddy plugin.
+});
+
+test('should document XSS blocking behavior', async () => {
+  // XSS blocking behavior is enforced through Caddy middleware.
+});
+
+// AFTER:
+test.skip('should detect SQL injection patterns in request validation', async () => {
+  // SKIP: WAF blocking enforced via Coraza middleware (port 80).
+  // See: backend/integration/coraza_integration_test.go
+});
+
+test.skip('should document XSS blocking behavior', async () => {
+  // SKIP: XSS blocking enforced via Coraza middleware (port 80).
+  // See: backend/integration/coraza_integration_test.go
+});
+```
+
+### Fix 3: Mark User Status Badges Test as Skipped (MEDIUM)
+
+**File**: `tests/settings/user-management.spec.ts`
+**Line**: 74
+
+```typescript
+// BEFORE:
+test('should show user status badges', async ({ page }) => {
+  // TODO: Re-enable when user status badges are added to the UI.
+  ...
+});
+
+// AFTER:
+test.skip('should show user status badges', async ({ page }) => {
+  // SKIP: UI feature not yet implemented.
+  // TODO: Re-enable when user status badges are added to the UI.
+});
+```
+
+---
+
+## Priority Ranking
+
+| Priority | Issue | Impact | Effort |
+|----------|-------|--------|--------|
+| **P0 - Critical** | combined-enforcement.spec.ts not skipped | CI failing | 2 min |
+| **P0 - Critical** | waf-enforcement.spec.ts not skipped | CI failing | 2 min |
+| **P1 - High** | user-management.spec.ts not skipped | 58s timeout waste | 2 min |
+| **Info** | emergency-server.spec.ts already fixed | N/A | Done |
+
+---
+
+## Backend Tests
+
+✅ **All backend tests passing**
+
+```bash
+go test ./...
+# All packages: ok
+```
+
+---
+
+## Coverage Impact
+
+**Current State**:
+- Overall E2E coverage: 67.46%
+- PR Patch coverage: 55.81% (failing threshold)
+
+**Missing Patch Coverage**:
+- `backend/internal/caddy/importer.go`: 56.52% (5 missing, 5 partials)
+- `backend/internal/api/handlers/import_handler.go`: 0% (6 missing lines)
+
+**Recommendation**: Add targeted tests for import handler error paths to meet 100% patch coverage requirement.
+
+---
+
+## Summary
+
+The E2E test failures are caused by **incomplete test refactoring** where tests that verify Caddy middleware behavior (ACL, WAF, Rate Limiting) were emptied but not properly skipped. This creates:
+
+1. **False failures** in CI when running against stale test implementations
+2. **Confusion** about test coverage (empty tests pass trivially)
+3. **Wasted CI time** on timeout failures
+
+**Action Required**: Apply the 3 fixes above to convert empty test bodies to proper `test.skip()` calls with documentation explaining that enforcement is verified via integration tests.
+
+---
+
+## Appendix: Skipped Tests Categories
+
+| Category | Count | Reason |
+|----------|-------|--------|
+| CrowdSec Decisions | 12 | Requires CrowdSec service configuration |
+| Real-Time Logs WebSocket | 8 | WebSocket connection handling |
+| Security Dashboard Toggles | 15 | Middleware enforcement scope |
+| Encryption Key Rotation | 5 | Feature flag dependent |
+| SMTP Connection Testing | 3 | Requires SMTP server |
+| User Permissions | 10+ | Role-based access control |
+| Notification Templates | 8 | Feature not fully implemented |
+
+**Total Skipped**: 107 tests (intentionally scoped out of E2E)