diff --git a/.agents/tasks/dva-notes-review.md b/.agents/tasks/dva-notes-review.md
new file mode 100644
index 0000000..765ad2c
--- /dev/null
+++ b/.agents/tasks/dva-notes-review.md
@@ -0,0 +1,276 @@
+# DVA-C02 Notes Review: Findings Report
+
+Scope: all 33 markdown files in `c:\src\repos\DVA-02-Notes` (read-only review; nothing modified). Images checked: `ACM/terminating_diagram_at_alb.png`, `ACM/terminating_ssl_e2e.png`, `Route 53/route_53_routing_example.png` all exist.
+
+Severity key: **high** = factually wrong, **medium** = misleading/incomplete (likely to cost exam points), **low** = typo/formatting.
+
+## Summary answer
+
+Yes, there are several real errors. The most important ones:
+
+1. **VPC is "Virtual Private Cloud", not "Virtual Private Connection"** (`VPC/_VPC.md`), and the description actually describes VPC peering / VPN, not a VPC.
+2. **ACM pricing is wrong** (`ACM/_ACM.md`): imported certificates are not $400/month. ACM public and imported certs are free; the $400/month is AWS Private CA (per private CA). "Public vs Private" is also conflated with "ACM-issued vs imported".
+3. **Elastic Beanstalk deployment policies are described incorrectly** (`_Concepts/Deployments.md`): All-at-once doesn't recreate instances; Immutable and Traffic Splitting use a temporary ASG behind the *same* load balancer (not a new ELB); the policy is "Traffic splitting", not "Traffic Shifting"; Blue/Green swaps environment CNAMEs.
+4. **CodeDeploy blue/green does not support on-premises instances** (`_Concepts/Deployments.md` says "EC2 / On-Prem, Lambda & ECS").
+5. **Route 53 is not a CloudFront origin** (`CloudFront/_CloudFront.md`).
+6. **AppSync auth list is incomplete**: missing OpenID Connect and AWS Lambda authorizers (5 modes, a common exam question).
+7. **Outdated info**: CodeCommit is back to GA (since 24 Nov 2025), X-Ray SDKs/Daemon entered maintenance mode on 25 Feb 2026 (OpenTelemetry recommended), CloudFront Functions are no longer "only ES 5.1", OAI is "legacy" rather than "not available".
+8. **REST is not "a kind of CRUD"** (`_Concepts/Glossary/REST.md`). This contradicts `CRUD vs REST.md`.
+9. **About 15 broken wiki-links**, including CodePipeline's "Build" stage linking to CodePipeline itself instead of CodeBuild.
+
+---
+
+## Evidence, by file
+
+### `_Concepts/Deployments.md`
+
+| # | Snippet | Problem | Correct info | Sev |
+|---|---|---|---|---|
+| D1 | `[[_Elastic BeanStalk\|_Elastic BeanStalk]]` (line 4) | Broken link; no Elastic Beanstalk note exists. | Create `_Elastic BeanStalk.md` or remove the link. | low |
+| D2 | CodeDeploy In-place: "Stops apps on _every_ instance" | Misleading. Instances are taken down according to the deployment configuration (`CodeDeployDefault.OneAtATime`, `HalfAtATime`, `AllAtOnce`, or custom minimum healthy hosts), not all at once. | Note the deployment configs and minimum healthy hosts. | medium |
+| D3 | CodeDeploy Blue/Green scope: "EC2 / On-Prem, Lambda & ECS" | **Wrong**: AWS says EC2/On-Premises blue/green "work with Amazon EC2 instances only" ([CodeDeploy docs](https://docs.aws.amazon.com/codedeploy/latest/userguide/applications-create.html)). | Scope: EC2 (not on-prem), Lambda, ECS. | high |
+| D4 | CodeDeploy Blue/Green description ("Make a new set of instances…") | Only true for EC2. For Lambda and ECS, blue/green means **traffic shifting** between versions/task sets using Canary, Linear, or AllAtOnce configs (e.g. `LambdaCanary10Percent5Minutes`, `ECSLinear10PercentEvery1Minutes`). This is heavily tested. | Add a Lambda/ECS row with canary/linear/all-at-once. | medium |
+| D5 | EB All at Once: "Recreates the instances and boots them again" | **Wrong**. All-at-once deploys the new version to the *existing* instances simultaneously; no new instances are created. | "Deploys to all existing instances at once; short downtime; fastest; no extra cost." | high |
+| D6 | EB Rolling with Additional Batches: "switch out the old instances over time until one is left, which you discard" | Misleading. EB launches one extra batch first so full capacity is kept, then deploys in batches to existing instances. At the end the extra batch's worth of instances is terminated. Impact should read "full capacity maintained, small extra cost". | See [EB deployment policies](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.rolling-version-deploy.html). | medium |
+| D7 | EB Immutable: "spin up an entire extra Auto Scailing Group, then once ready, point the ELB to the new ASG. The safest… because the old instances remain." | EB creates a **temporary ASG behind the same load balancer**. Old and new serve together, then new instances move to the original ASG and old instances are **terminated**. It's "safest" because rollback is just terminating the new instances. Typo "Scailing". | See [Immutable updates](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/environmentmgmt-updates-immutable.html). | medium |
+| D8 | EB Blue/Green: "You spin up an entire extra ELB, then switch out the URLs." | Blue/green in EB means cloning a whole separate **environment** (its own ASG, LB, etc.) and doing **Swap Environment URLs** (a CNAME swap). It isn't a built-in deployment policy. | "New environment, then swap CNAMEs; Route 53 weighted records also possible." | medium |
+| D9 | EB "Traffic Shifting": "spin up and extra ELB, the split the traffic" | **Wrong name and mechanism**. The policy is **Traffic splitting** (canary). It launches new instances in a temporary ASG behind the **same** load balancer and sends a set percentage of traffic to them for an evaluation period. Typos "and extra", "the split". | See [AWS What's New, 2020](https://aws.amazon.com/about-aws/whats-new/2020/05/aws-elastic-beanstalk-traffic-splitting-deployment-policy/) and the EB docs above. | high |
+| D10 | "the reregistered", "replace and existing instance" | Typos ("then re-registered", "replace the existing instances"). | | low |
+| D11 | Five empty rows and a dotted row at the end of the table | Formatting leftovers. | Remove them. | low |
+
+### `_Concepts/CRUD vs REST.md`
+- Content is fine. Note that `REST.md` contradicts it (see below). **(medium, inconsistency)**
+
+### `_Concepts/Glossary/REST.md`
+- "A kind of [[CRUD]]": **wrong**. REST is an architectural style (stateless, resource-based, uniform interface). HTTP methods often *map* to CRUD (POST→Create, GET→Read, PUT/PATCH→Update, DELETE→Delete), but REST isn't a kind of CRUD. This contradicts `CRUD vs REST.md`, which is correct. **(medium)**
+
+### `_Concepts/Glossary/HTTPS.md`
+- "a layer of encryption, either on the Application on IP layer": **wrong**. HTTPS is HTTP over **TLS** (sits between the application and transport/TCP layers). IP-layer encryption is IPsec, which isn't HTTPS. Also "on" should be "or". Default port 443 (HTTP is 80) is worth adding. **(medium)**
+
+### `_Concepts/Glossary/HTTP.md`
+- "Web browser protocol": oversimplified. HTTP is an application-layer request/response protocol used by browsers and also by APIs (REST, GraphQL, AWS APIs). **(low)**
+
+### `_Concepts/Glossary/VPN.md`
+- "Secures connections between two networks": incomplete. A VPN can also connect a single client to a network (client VPN versus site-to-site). **(low)**
+
+### `_Concepts/Glossary/API.md`, `AWS.md`, `CRUD.md`, `SQL.md`
+- No errors. `AWS.md` heading `# [[AWS]]` links to itself (harmless). **(low)**
+
+### `README.md`
+- No issues.
+
+### `ACM/_ACM.md`
+
+| # | Snippet | Problem | Correct info | Sev |
+|---|---|---|---|---|
+| A1 | `# Amazon Certificate Manager` | The service is **AWS** Certificate Manager. | | low |
+| A2 | "1. Public - Certificates provided by ACM (Free) 2. Privates - Certificates you import ($400 / month)" | **Wrong**. Two separate ideas are mixed up. (a) ACM-issued public certs used with integrated services are free. (b) **Imported** certs are also free to manage in ACM. (c) **Private** certs come from **AWS Private CA**, which costs about $400/month per CA (general-purpose mode) plus per-cert fees. ACM docs: no additional charge for certificates you manage with ACM ([ACM user guide](https://docs.aws.amazon.com/acm/latest/userguide/)). | Re-split into: Public (ACM-issued, free) / Imported (free) / Private (via AWS Private CA, paid). | high |
+| A3 | "public and private SSL/TLS certificate" | "certificates" (plural). | | low |
+| A4 | Attachable resources list | Missing the exam-relevant constraint: **for CloudFront, the ACM cert must be in `us-east-1`**. For ALB/NLB/API Gateway regional endpoints, the cert must be in the same Region. Also "ELB" should say ALB/NLB (CLB too). Note that ACM-issued certs can't be installed directly on EC2 (except by export, see A6). | Add the Region rule. | medium |
+| A5 | `[[ELB]]` (twice), `[[API Gateway]]`, `[[_Elastic BeanStalk\|…]]` | Broken links. The files are `_ELB.md` and `_API Gateway.md`. No Beanstalk note exists. | `[[_ELB\|ELB]]`, `[[_API Gateway\|API Gateway]]`. | low |
+| A6 | E2E: "You can't do this with ACM by itself. You can set up Let's Encrypt for it." | Partly outdated. ACM now supports **exportable public certificates** (paid) that can be installed on your own servers ([ACM public certs doc](https://docs.aws.amazon.com/acm/latest/userguide/acm-public-certificates.html)). Also, ALB doesn't validate target certificates, so a self-signed cert on the instance is enough for ALB→EC2 encryption. | Mention both options. | medium |
+| A7 | "Terminating SSL at Load Balancer… beyond the ALB is unencrypted" | Fine, but worth noting that NLB can also do TLS passthrough (TCP listener) for true end-to-end. | | low |
+| A8 | "on each instances" | "each instance". | | low |
+
+### `ALB/_ALB.md`, `NLB/_NLB.md`, `S3/_S3.md`
+- Placeholders with no content, so nothing is wrong. These are core DVA-C02 topics (S3 especially) and are gaps. **(medium, coverage gap)**
+
+### `ELB/_ELB.md`
+- Lists only ALB and NLB. ELB also includes the **Gateway Load Balancer** and the legacy **Classic Load Balancer**. **(low)**
+
+### `API Gateway/_API Gateway.md`
+- REST / HTTP / WebSocket flavours are correct.
+- `[[REST]]` and `[[HTTP]]` link to glossary terms, not to the API Gateway API types, which could mislead. **(low)**
+- Placeholder: missing stages, integration types, caching (TTL default 300s), throttling (10,000 rps / 5,000 burst account default), usage plans/API keys, authorizers. **(medium, coverage gap)**
+
+### `AppSync/_AppSync.md`
+
+| # | Snippet | Problem | Correct info | Sev |
+|---|---|---|---|---|
+| P1 | `# Authorisation`: API Key, AWS IAM, Cognito User Pools | **Incomplete**. AppSync has five auth types: API key, **AWS Lambda**, IAM, **OpenID Connect**, Cognito User Pools ([AppSync docs](https://docs.amazonaws.cn/en_us/appsync/latest/devguide/security-authz.html)). Several can be combined (multiple auth modes). Heading level `#` is inconsistent with the other `##` sections. | Add OIDC and Lambda. | high |
+| P2 | "Full request caching: Self explanatory; caches all requests." | Oversimplified. AWS describes it as caching each resolver's result separately for all resolvers invoked during a request, keyed by request context ([AppSync caching](https://docs.aws.amazon.com/appsync/latest/devguide/enabling-caching.html), [API ref](https://docs.aws.amazon.com/appsync/latest/APIReference/API_ApiCache.html)). | | medium |
+| P3 | "Caching isn't serverless; you must provision an on-demand instance." | "On-demand" is misleading. You choose a cache **instance type** (dedicated, ElastiCache-backed) that's billed hourly while it exists. | | low |
+| P4 | "Resolvers… used to implement the state-changing operations" | Resolvers fulfil **all** operations, reads (queries) included. Also missing: unit vs **pipeline** resolvers. | | medium |
+| P5 | API Types: GraphQL APIs, Merged APIs | Missing **AppSync Event APIs** (WebSocket pub/sub, launched in 2024) ([Event API docs](https://docs.aws.amazon.com/appsync/latest/eventapi/configure-event-api-auth.html)). "a collection of Graph APIs" should be "source GraphQL APIs". | | low |
+| P6 | Data sources | Fine. Could add the "None" data source (local resolvers). The RDS entry is really Aurora via the RDS Data API. | | low |
+| P7 | "Resolvers attached to specific fields" | Grammar: "are attached"; "used" should be capitalised. | | low |
+
+### `AppSync/GraphQL.md`
+- "GraphQL is an FOSS agnostic query adaptor": imprecise. GraphQL is an open-source **query language and runtime specification** for APIs. "adaptor" is the wrong word. **(low)**
+- "composed on" should be "composed of". "Allow for data to be create" should be "created". **(low)**
+- The **Fields** bullet is empty. **(low)**
+- The examples don't match: the schema defines `Query { me: User }` and `User { id, name }`, but the query uses `currentUser { name age }`. `age` isn't on `User` and `currentUser` isn't a Query field. `createUser` and `newPerson` aren't defined either. This would fail validation. **(low/medium)**
+- Missing: GraphQL APIs typically use one endpoint with POST. **(low)**
+
+### `Athena/_Athena.md`
+- The analogy suggests the **catalog** decides which "boxes" to open. Data skipping actually comes from **partitioning** (partition pruning) and **columnar formats** (Parquet/ORC) with compression. The Glue Data Catalog stores schema and location. **(medium)**
+- "query any book in any format (CSV, JSON, Parquet)": overstated. Athena supports specific SerDes/formats (CSV/TSV, JSON, Parquet, ORC, Avro, Ion, logs, etc.), not *any* format. **(low)**
+- "never alters the original books": mostly true for standard tables, but Athena can write results/CTAS/`INSERT INTO`, and with **Apache Iceberg** tables it supports `UPDATE`/`DELETE`/`MERGE`. **(low)**
+- Missing exam facts: serverless (Trino/Presto engine), priced per TB scanned, query results written to S3, workgroups for cost control. **(medium, coverage gap)**
+- Typo: "a box contains fictions" should be "fiction". **(low)**
+
+### `CloudFront/_CloudFront.md`
+
+| # | Snippet | Problem | Correct info | Sev |
+|---|---|---|---|---|
+| C1 | "**Origin**… Examples include: S3, EC2, ELB, Route53." | **Wrong**. Route 53 is DNS and can't be an origin. | Origins: S3, ALB/ELB, EC2, API Gateway, Lambda function URLs, MediaStore/MediaPackage, any custom HTTP server. | high |
+| C2 | Origin Request row use cases "Add security headers (CSP/HSTS), set cookies…, customise error messages" vs. Origin Response row "Rewrite URLs…, inject headers for origin authentication…" | The use cases look **swapped**. URL rewrites, adding origin-auth headers, and picking the origin by user agent are **origin request** tasks. Adding security headers and customising error responses are **response** tasks. | | medium |
+| C3 | Origin Response description: "After CloudFront receives the request from the origin." | Should say "receives the **response** from the origin". | | low |
+| C4 | "Max Memory… L@E 128MB-3,008MB" | Unclear: **viewer** triggers are fixed at 128 MB, and higher memory applies only to origin triggers. The exact current upper bound (3,008 MB versus Lambda's 10,240 MB) is **unverified**; the AWS doc page couldn't be fetched (TLS error) and third-party sources disagree. | Write "128 MB (viewer) / up to Lambda max (origin)" and check against [AWS comparison page](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/edge-functions-choosing.html). | low |
+| C5 | "Lambda@Edge… JavaScript" / CF Functions "Only supports ECMAScript 5.1" | Outdated. CloudFront Functions runtime 2.0 is ES 5.1 compliant **plus some ES6–ES12 features** ([AWS docs](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/functions-javascript-runtime-20.html)). Runtime 2.0 is also needed for CloudFront KeyValueStore. | | medium |
+| C6 | `CloudFront will failover on: GET, HEAD, and OPTION` | Typo: `OPTIONS`. The status codes (400, 403, 404, 416, 500, 502, 503, 504) are correct. Failover also happens on connection failures/timeouts. | | low |
+| C7 | "OAI… Lots of drawbacks. Not available anymore." | Overstated. OAI is **legacy** and AWS recommends OAC, but OAI still works on existing distributions ([AWS re:Post KC](https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-serve-static-website/)). Name the drawbacks: no SSE-KMS, no S3 Regions launched after Dec 2022, limited PUT/POST support. | | medium |
+| C8 | "can stream Videos On Demand using [[ISS Microsoft Smooth Streaming]]" | Typo "ISS" should be "IIS". Smooth Streaming is legacy. CloudFront more commonly serves HLS/DASH (e.g. with MediaPackage). | | low |
+| C9 | "Regional Caches: Compute located in board geographical locations" | "broad". They're larger caches that sit between edge locations and the origin; calling them "compute" is odd. Edge locations are points of presence/caches, not general compute. | | low |
+| C10 | "Distribution: A collection of Edge locations and Regional Cache…" | A distribution is a **configuration** (origins, cache behaviours, policies, certs, domain names) that tells CloudFront where to fetch content and how to cache/deliver it. It isn't a set of locations (the price class chooses which locations are used). | | medium |
+| C11 | "Origin Request always returns:" | Should be "always includes". The list (URL path, body, Host, User-Agent, X-Amz-Cf-Id) is fine. | | low |
+| C12 | "⚠️ If you are dealing with CORS, you will be setting things here, as this will mess with them." | Unclear. Suggest: "CORS response headers (Access-Control-Allow-*) can be set via a response headers policy (AWS has managed CORS policies). To *forward* the `Origin` header to the origin, use an origin request policy." | | low |
+| C13 | "charged pre request" | "per request". | | low |
+| C14 | `[[AWS WAF]]`, `[[Videos On Demand]]`, `[[ISS Microsoft Smooth Streaming]]` | Broken links (no such notes). | | low |
+| C15 | Managed cache policies list | Correct but incomplete. Also `UseOriginCacheControlHeaders` and `UseOriginCacheControlHeaders-QueryStrings`. | | low |
+
+### `CloudFront/CloudFront Functions.md`
+- "Only supports ECMAScript 5.1": outdated (see C5). **(medium)**
+- "They live directly at Edge Locations": correct.
+
+### `CloudFront/Lambda@Edge.md`
+- Python and Node.js: correct. "deployed at Regional Edge Caches": correct.
+- Missing exam-relevant facts: functions must be **authored in `us-east-1`** and replicated, you must reference a **numbered version** (not `$LATEST` or an alias), and there are no environment variables. **(medium, gap)**
+
+### `CodeBuild/_CodeBuild.md`
+- "build tools such as Apache, Maven, Gradle": it's **Apache Maven** (one tool), not "Apache" and "Maven". **(low)**
+- Workflow step 3 says `buildspec.yaml`, but the section header says `buildspec.yml`. The default filename is **`buildspec.yml`**. **(medium, inconsistency)**
+- Step 4 "Push into a bucket, or any other AWS SDK action (I think?)": artifacts go to **S3**. Docker images are pushed to ECR by commands you write (usually in `post_build`). Also covers reports and cache. **(medium)**
+- Build environments: "If you need specific software, you need to make an image and upload it to ECR and reference it in the pipeline". Not required: you can install software in the `install` phase (`runtime-versions`, package managers). Custom images can come from ECR **or Docker Hub/other registries** and are set on the **build project**, not the pipeline. **(medium)**
+- Triggers: also webhooks (GitHub, Bitbucket, GitLab) and EventBridge schedules. **(low)**
+- "Scaled automatically": should be "Scales". **(low)**
+- Missing: `env` (variables, `parameter-store`, `secrets-manager`), `artifacts`, `cache`, `reports` sections, `finally` blocks, VPC config, logs to CloudWatch/S3, default timeout. **(low, gap)**
+
+### `CodeCommit/_CodeCommit.md`
+- No mention of service status. AWS closed CodeCommit to new customers on 25 Jul 2024, then **returned it to full GA on 24 Nov 2025** ([AWS DevOps blog](https://aws.amazon.com/blogs/devops/aws-codecommit-returns-to-general-availability), [InfoQ](https://infoq.com/news/2025/12/aws-codecommit-ga)). Worth noting because study materials from 2024–25 call it deprecated. **(medium)**
+- "HIPPA" should be "HIPAA". **(low)**
+- "No limit on the size of your repositories": matches AWS marketing. Note that Git LFS wasn't supported historically (on the roadmap per InfoQ). **(low)**
+- Missing exam-relevant auth options: HTTPS Git credentials, SSH keys, `git-remote-codecommit` (GRC), and triggers/notifications (SNS/Lambda/EventBridge). **(low, gap)**
+
+### `CodeDeploy/_CodeDeploy.md`
+- Blue/Green section describes only EC2 (instances and ELB). It's missing (a) **EC2 only; on-premises can't use blue/green** ([docs](https://docs.aws.amazon.com/codedeploy/latest/userguide/applications-create.html)), and (b) Lambda/ECS blue/green via Canary/Linear/AllAtOnce traffic shifting. **(medium)**
+- Deployment Groups: "A set of EC2 instances or Lambda Functions". For EC2/on-prem it's instances chosen by **tags** and/or **ASGs**; for ECS it's an ECS service plus load balancer; for Lambda, the group holds the deployment config/alarms. **(low)**
+- Application: "revision deployment configuration, and group" is missing a comma ("revision, deployment configuration, and deployment group"). **(low)**
+- Missing exam staples: the **CodeDeploy agent** (EC2/on-prem), `appspec.yml` location (root of revision) and **lifecycle hooks** (`ApplicationStop`, `BeforeInstall`, `AfterInstall`, `ApplicationStart`, `ValidateService`; Lambda: `BeforeAllowTraffic`/`AfterAllowTraffic`), and rollback on CloudWatch alarms. **(medium, gap)**
+- Consistent with `Deployments.md` on in-place being EC2/On-Prem only (correct).
+
+### `CodePipeline/_CodePipeline.md`
+- `[[_CodePipeline|Build]]`: the "Build" stage links to **CodePipeline**. It should be `[[_CodeBuild|Build]]`. **(low but misleading)**
+- `[[CodeDeploy||Deploy]]` has a double pipe and the wrong target. It should be `[[_CodeDeploy|Deploy]]`. **(low)**
+- `[[_CloudFormation|CloudFormation]]`: broken link (no note). **(low)**
+- "Actions are not restricted to specific stages": **wrong for Source actions**. Source actions can only be in the **first stage**, and the first stage can only contain source actions. Every pipeline needs at least 2 stages. **(medium)**
+- "Action Groups group several Actions": I couldn't confirm "action group" as an official CodePipeline concept. Actions in a stage run in series/parallel by `runOrder`. **(unverified)**
+- "invoke a CloudFormation template": better put as "create/update a CloudFormation stack or change set". **(low)**
+- Typos: "The can pull" should be "They can"; "Deploy Actions is a Build Stage" should be "in a Build Stage"; "Pipeline are only limited" should be "Pipelines are". **(low)**
+
+### `Lambda/_Lambda.md`
+- "A Docker container or a runner that runs code for you": misleading. Lambda runs functions in **Firecracker microVMs**. Container images are one *packaging* option (zip is the other), but Lambda isn't a Docker container. **(medium)**
+- `[[API Gateway|API Gateway]]` is broken (file is `_API Gateway.md`). `[[_DynamoDB|DynamoDB]]` is broken (no note). **(low)**
+- Placeholder: missing limits (15 min timeout, 128 MB–10,240 MB memory, /tmp up to 10 GB, 1,000 default concurrency, 50 MB zipped / 250 MB unzipped deployment, 6 MB sync payload), versions/aliases, layers, invocation types, DLQ/destinations. **(medium, coverage gap)**
+
+### `Route 53/_Route53.md`
+- "A DNS with AWS Services": Route 53 is a managed DNS **service** (registrar, authoritative DNS, health checks). **(low)**
+- "Resolve VPC's outside of AWS": misleading. **Route 53 Resolver** inbound/outbound endpoints let on-premises networks resolve private VPC DNS names (and the reverse), which is hybrid DNS. **(medium)**
+- Missing: routing policies (simple, weighted, latency, failover, geolocation, geoproximity, multivalue, IP-based) and alias vs CNAME (alias works at the zone apex and is free for AWS targets). These are exam staples. **(medium, gap)**
+
+### `Route 53/Record Sets.md`
+- "Record sets are a collection of records which determine where to send traffic": a record set is the set of records with the **same name and type** (e.g. multiple A values). **(low)**
+- "They are always changed in batch via the API": `ChangeResourceRecordSets` takes a change batch, which is roughly correct. **(low)**
+
+### `Route 53/Route 53 Hosted Zone.md`
+- Correct overall. Private hosted zones can be associated with **one or more** VPCs. "Revisit this." is a leftover TODO. **(low)**
+
+### `Route 53/Use Cases.md`
+- "our web backed by ALB" should be "our web app backed by ALB". The image exists. **(low)**
+
+### `VPC/_VPC.md`
+- "Virtual Private Connection": **wrong**. VPC is **Virtual Private Cloud**, a logically isolated virtual network in an AWS Region (CIDR, subnets, route tables, IGW/NAT, security groups/NACLs). **(high)**
+- The description ("a private link between 2 places… connect 2 AWS accounts… a VPN between two places") describes **VPC peering**, **PrivateLink**, or **Site-to-Site VPN**, not a VPC. **(high)**
+
+### `X-Ray/_X-Ray.md`
+
+| # | Snippet | Problem | Correct info | Sev |
+|---|---|---|---|---|
+| X1 | X-Ray SDK / Daemon sections | Outdated. **X-Ray SDKs/Daemon entered maintenance mode on 25 Feb 2026** (security fixes only) and AWS recommends migrating to **OpenTelemetry/ADOT** ([support timeline](https://docs.aws.amazon.com/xray/latest/devguide/xray-sdk-daemon-timeline.html)). End of support is reported as 25 Feb 2027 ([Classmethod](https://dev.classmethod.jp/articles/x-ray-sdk-daemon-migration-to-opentelemetry/), end date unverified on AWS's page). The X-Ray service itself is still supported. | | medium |
+| X2 | X-Ray Daemon | Missing the key exam fact: the daemon listens on **UDP port 2000**. | | medium |
+| X3 | "Comes with Elastic BeanStalk and Lambda by default" | Lambda runs the daemon only when **Active tracing** is enabled. On EB the daemon is pre-installed but must be enabled (`XRayEnabled` option or `.ebextensions`). On EC2/ECS you install/run it yourself (sidecar for ECS). Instances also need IAM permissions (`AWSXRayDaemonWriteAccess`). | | medium |
+| X4 | Annotations: "Up to 50 annotations per trace" | Correct, but it misses the key contrast with Metadata: annotations are **indexed** key-value pairs (string/number/boolean) usable in **filter expressions**. | | medium |
+| X5 | "Errors, Faults, and Exceptions" | Missing the definitions: **Error = 4xx**, **Fault = 5xx**, **Throttle = 429**. | | medium |
+| X6 | "Tracing Header: All requests are traced up to a configurable minimum…" | This is sampling (reservoir + fixed rate) under the wrong heading. The header is `X-Amzn-Trace-Id` (correct) with `Root`, `Parent`, `Sampled` fields. | | low |
+| X7 | "A Trace ID is the path of a request" | A **trace** is the collection of segments produced by one request. The trace ID is its identifier. | | low |
+| X8 | Groups: "Groups only update after you update them, the data before still remains" | Garbled. A group's filter expression applies to **new** traces only after it's created or edited. | | low |
+| X9 | Integration list "ELB" | X-Ray integrates with **ALB** (adds/propagates the trace header), not all ELB types. App Mesh is being discontinued (Sept 2026, **unverified**). | | low |
+| X10 | `[[_Elastic BeanStalk]]` | Broken link. | | low |
+| X11 | `[...]{.underline}` | Pandoc span syntax. It may not render outside Zettlr/Pandoc. | | low |
+| — | Sampling defaults (1 req/s reservoir + 5%) | Correct. | | — |
+
+---
+
+## Broken internal links (consolidated)
+
+Existing note names: `API, AWS, CRUD, HTTP, HTTPS, REST, SQL, VPN, CRUD vs REST, Deployments, _ACM, _ALB, _API Gateway, _AppSync, GraphQL, _Athena, _CloudFront, CloudFront Functions, Lambda@Edge, _CodeBuild, _CodeCommit, _CodeDeploy, _CodePipeline, _ELB, _Lambda, _NLB, _Route53, Record Sets, Route 53 Hosted Zone, Use Cases, _S3, _VPC, _X-Ray`.
+
+| File | Link | Issue |
+|---|---|---|
+| `_Concepts/Deployments.md` | `[[_Elastic BeanStalk]]` | note missing |
+| `ACM/_ACM.md` | `[[ELB]]` ×2 | should be `_ELB` |
+| `ACM/_ACM.md` | `[[API Gateway]]` | should be `_API Gateway` |
+| `ACM/_ACM.md` | `[[_Elastic BeanStalk]]` | note missing |
+| `CloudFront/_CloudFront.md` | `[[AWS WAF]]`, `[[Videos On Demand]]`, `[[ISS Microsoft Smooth Streaming]]` | notes missing |
+| `CodePipeline/_CodePipeline.md` | `[[_CodePipeline\|Build]]` | wrong target, should be `_CodeBuild` |
+| `CodePipeline/_CodePipeline.md` | `[[CodeDeploy\|\|Deploy]]` | double pipe; should be `_CodeDeploy` |
+| `CodePipeline/_CodePipeline.md` | `[[_CloudFormation]]` | note missing |
+| `Lambda/_Lambda.md` | `[[API Gateway\|API Gateway]]` | should be `_API Gateway` |
+| `Lambda/_Lambda.md` | `[[_DynamoDB]]` | note missing |
+| `X-Ray/_X-Ray.md` | `[[_Elastic BeanStalk]]` | note missing |
+
+All three image references resolve to existing PNGs.
+
+## Internal inconsistencies
+
+- `REST.md` ("a kind of CRUD") contradicts `CRUD vs REST.md` ("an architectural style").
+- `Deployments.md` says CodeDeploy Blue/Green covers On-Prem. `_CodeDeploy.md` describes only EC2 blue/green and never mentions Lambda/ECS traffic shifting. Both should state: EC2 (not on-prem), Lambda, ECS.
+- `_CodeBuild.md` uses both `buildspec.yaml` and `buildspec.yml`.
+- `_ACM.md` and `_ELB.md` treat "ELB" as a single attachable thing, while `_ELB.md` defines it as an umbrella term.
+- `_CloudFront.md` and `Lambda@Edge.md` agree on Node.js/Python and Regional Edge Caches, which is consistent and correct.
+
+## Typos and grammar (grouped, low)
+
+- Deployments: "Auto Scailing", "the reregistered", "replace and existing instance", "spin up and extra ELB, the split".
+- ACM: "Amazon Certificate Manager", "certificate" (plural), "Privates", "each instances".
+- AppSync: "Resolvers attached… used to…".
+- GraphQL: "composed on", "data to be create".
+- Athena: "a box contains fictions".
+- CloudFront: "board geographical", "ISS", "OPTION", "pre request", "receives the request from the origin".
+- CodeBuild: "Apache, Maven", "Scaled automatically".
+- CodeCommit: "HIPPA".
+- CodeDeploy: missing comma in the Application description.
+- CodePipeline: "The can pull", "Deploy Actions is a Build Stage", "Pipeline are only limited".
+- HTTPS: "Application on IP layer".
+- Route 53 Use Cases: "our web backed by".
+
+## Could not verify
+
+- Current Lambda@Edge origin-trigger memory maximum (3,008 MB vs 10,240 MB). The AWS comparison page failed to load (TLS error).
+- Whether "Action Groups" is official CodePipeline terminology.
+- X-Ray SDK end-of-support date (25 Feb 2027) on AWS's own page. The maintenance-mode date (25 Feb 2026) is confirmed by AWS docs.
+- App Mesh discontinuation date.
+
+## Conclusions and recommendations
+
+Fix these first, because they're wrong rather than just incomplete:
+1. `VPC/_VPC.md`: rename to Virtual Private Cloud and rewrite the definition. Move the peering/VPN content to a "VPC connectivity" subsection.
+2. `ACM/_ACM.md`: fix pricing (public and imported certs free; Private CA ~$400/month per CA). Add the CloudFront `us-east-1` rule.
+3. `_Concepts/Deployments.md`: rewrite the EB rows (all-at-once is in place; immutable and traffic splitting use a temporary ASG behind the same LB; blue/green is a CNAME swap). Remove "On-Prem" from CodeDeploy blue/green. Add Lambda/ECS canary/linear/all-at-once.
+4. `CloudFront/_CloudFront.md`: remove Route 53 from origins, swap the origin request/response use cases, and update CF Functions (runtime 2.0) and OAI (legacy).
+5. `AppSync/_AppSync.md`: add OIDC and Lambda authorization.
+6. `Glossary/REST.md`, `HTTPS.md`: fix the definitions (REST is an architectural style; HTTPS is HTTP over TLS, port 443).
+7. Update the status notes: CodeCommit is GA again (Nov 2025); X-Ray SDK/Daemon are in maintenance mode (Feb 2026), so prefer ADOT/OpenTelemetry. Add the daemon's UDP 2000 port.
+8. Fix the broken wiki-links, especially CodePipeline's Build → `_CodeBuild`.
+
+Then fill the exam-critical gaps: S3, ALB/NLB, API Gateway, Lambda limits, Route 53 routing policies, CodeDeploy AppSpec hooks.