test(release): complete local action matrix

docs/work-programmes/master-work-plan.md

@@ -16,7 +16,7 @@ Allowed statuses are `NOT STARTED`, `IN PROGRESS`, `IMPLEMENTED — NOT VERIFIED
 
 `DONE` requires every applicable acceptance criterion, focused and regression tests, browser/accessibility/theme/mobile checks, tenant and entitlement checks, documentation, migration/rollback evidence, and production verification. Repository-only work that still requires production is at most `VERIFIED LOCALLY`.
 
-Exactly one implementation item may be `IN PROGRESS`. As of this revision it is **VER-001**.
+Exactly one implementation item may be `IN PROGRESS`. As of this revision it is **SEC-009**.
 
 ## Consolidated dependency order
 
@@ -60,8 +60,8 @@ This queue records the highest-value work that can proceed without production cr
 | 4 | Dedicated Job Details parity and JOBS-002 closure | JOBS-002 | Locally complete. Application answers/recruiter drafts now live on the dedicated page, note markers are encapsulated, edits are lossless, dirty navigation is guarded, focus returns to the row, tenant regressions pass, and Chromium covers 375/768/1440 light/dark/history/error/long data. Production smoke remains. |
 | 5 | Cross-application contrast/accessibility pass | UX-002, UX-003, VER-001 | Locally complete. All icon controls own programmatic names; CV cards are keyboard links; the A4 public CV scales without inner/outer mobile overflow; dark Alert contrast is measured in Chromium at WCAG AA; full frontend/build/Playwright pass. Native assistive-technology and a general CI crawler remain external/future gates. |
 | 6 | Honest Free/Pro homepage and upgrade surfaces | PRODUCT-001 | Locally complete. One catalogue drives exactly Free/Pro; retired tier/price/Free-AI/unlimited claims are gone; configured billing state controls the real upgrade action; contextual notices are reusable/dismissible. Frontend 232/232, policy/billing 30/30, build and Chromium 8/8 pass. |
-| 7 | Complete application action matrix and full regression | VER-001 | In progress. Reconcile the rolling matrix, run the complete backend/frontend/sidecar/E2E/configuration gates and accurately classify external production/provider checks. |
-| 8 | Tracking and blocker reconciliation | All | Keep this plan, progress, handoff, verification log and `BLOCKERS.md` aligned after every logical increment; remove stale CI/dependency statements only when current evidence proves them obsolete. |
+| 7 | Complete application action matrix and full regression | VER-001 | Locally complete. Backend 647/647, frontend 232/232, sidecar 22/22, build, Compose configuration, safe-failure preflight and Chromium 9/9 pass; external provider/native-AT/production cells remain explicitly unverified. |
+| 8 | Tracking and blocker reconciliation | All | Complete for this checkpoint. The plan, progress, handoff, verification log, action matrix and `BLOCKERS.md` distinguish repository work from external gates; continue updating them with each later package. |
 
 ## Requirement coverage index
 
@@ -268,8 +268,8 @@ This queue records the highest-value work that can proceed without production cr
 - **Required tests:** two users/every entity, manifest/checksums/redaction, fault/restart/idempotence, provider failures, disposable restore replay.
 - **Required browser verification:** disposable self/admin export/delete and confirmations.
 - **Required production verification:** backup retention/tombstone rehearsal before self-service enablement.
-- **Status:** `NOT STARTED`.
-- **Blocker:** legal/operator retention and production restore decisions; repository work can proceed to disabled/dark launch.
+- **Status:** `IN PROGRESS`.
+- **Blocker:** legal/operator retention and production restore decisions block activation, not the repository-side disabled/dark launch.
 - **Evidence:** audit JT-009 inventory/design.
 - **Commit:** none.
 - **Remaining work:** owner inventory/export first, deletion second.
@@ -754,11 +754,11 @@ This queue records the highest-value work that can proceed without production cr
 - **Required tests:** full backend/frontend/Python/E2E plus regressions for confirmed defects.
 - **Required browser verification:** running app, synthetic users/data, 375/768/1440, themes/keyboard/focus/refresh/back/tabs/slow/error; no real email/paid provider/destructive production action.
 - **Required production verification:** applicable smoke actions only after deployment; local and production classifications remain distinct.
-- **Status:** `IN PROGRESS`.
-- **Blocker:** browser tooling/access and external providers may block individual rows, not the matrix.
-- **Evidence:** audit user-journey/action gaps.
+- **Status:** `VERIFIED LOCALLY`.
+- **Blocker:** remote CI, external providers, native assistive technology and production access block individual external cells, not the completed local matrix.
+- **Evidence:** `docs/verification/ver-001-complete-regression.md`; V-172. Backend 647/647, frontend 57 suites/232 tests, sidecar 22/22, production build, Compose config, preflight negative tests and Chromium 9/9 pass.
 - **Commit:** none.
-- **Remaining work:** create early and update per package; final sweep last.
+- **Remaining work:** keep the rolling matrix current; execute only its provider/native-AT/production cells when those environments and approvals exist.
 
 ### DEP-001 — Frontend advisory deployment gate
 
@@ -801,7 +801,7 @@ This queue records the highest-value work that can proceed without production cr
 Full decisions are in `docs/work-programmes/decisions.md`.
 
 1. **AI provider architecture:** ADR-004/current roadmap say one deployment provider; the newer Ollama programme explicitly requires local-first plus controlled fallback. The new programme is the target, implemented centrally and compatibly; old config/models remain for rollback.
-2. **Free AI:** current code gives Free users limited AI; the new programme says Free has no AI. POL-001 must change behavior server-side without deleting existing user data or renaming persisted roles prematurely.
+2. **Free AI:** resolved by POL-001/PRODUCT-001. Free has no AI admission at the server boundary, manual/existing data remains accessible, and public copy now matches that behavior without renaming persisted roles.
 3. **Production authority:** Work says no production deploy unless instructed; Ollama programme and the current request authorize only scoped local-AI production work after inventory/backup/rollback. No other production mutation is authorized.
 4. **Schema ownership:** OPS-001A chose one EF-owned, provider-conditional migration for `UserOperations` and deliberately omitted reconciler DDL. MariaDB script generation passes; executable server verification remains.
 5. **Compose documentation:** docs claim a separate dev override, but the filename is auto-loaded by production deploy. SEC-002 corrects actual behavior.