docs(acceptance): publish verified pre-phase10 evidence handoff

2026-10-29 19:11:10 +01:00
parent c16a66e2c8
commit 26d531cc90
162 changed files with 3260 additions and 21 deletions
@@ -0,0 +1,209 @@
+{
+  "schemaVersion": 1,
+  "workstreamId": "AUTOMATION-HANDOFF-01",
+  "kind": "ACCEPTANCE",
+  "authority": "EVIDENCE_ONLY",
+  "sourceBranch": "test/pre-phase10-ux-acceptance",
+  "localCommit": "5032ccb41514807c8ca3008c24ca6326be1170de",
+  "localCommitMeaning": "FROZEN_TESTED_APPLICATION_BASELINE",
+  "snapshotHead": "c16a66e2c85b35caa5a4460c186dc77d28e31ccb",
+  "verifiedRemoteCommit": "c16a66e2c85b35caa5a4460c186dc77d28e31ccb",
+  "remoteObservation": "Snapshot verification 2026-10-29T17:55:24.139000+00:00; current final package HEAD must be resolved and read back independently.",
+  "worktreeCleanliness": {
+    "atSourceBaseline": "CLEAN",
+    "atPackageGeneration": "HANDOFF_FILES_ONLY",
+    "requiredAtConsumption": "CLEAN"
+  },
+  "acceptanceStatus": "CONDITIONAL GO",
+  "entryGateStatus": "BLOCKED",
+  "phase10DevelopmentReadiness": "NO-GO",
+  "eligibleForAutomaticExecution": false,
+  "packageStatus": "READY",
+  "verdicts": [
+    {
+      "criterion": "Pre-Phase-10 UX",
+      "status": "CONDITIONAL GO",
+      "evidence": [
+        "TEST_EVIDENCE.json",
+        "TRACEABILITY.md"
+      ],
+      "limits": "Finite automated development review; manual/PDF/model/operator conditions remain."
+    },
+    {
+      "criterion": "CV Integration",
+      "status": "CONDITIONAL GO",
+      "evidence": [
+        "docling-import",
+        "cv-integration-qa",
+        "long-import",
+        "mariadb-provider"
+      ],
+      "limits": "Supported reviewed workflow only; partial extraction and legacy-text generic-AI precondition retained."
+    },
+    {
+      "criterion": "PDF Spacing",
+      "status": "PARTIAL",
+      "evidence": [
+        "VISUAL_REVIEW.md",
+        "windows-template-oracle",
+        "linux-template-oracle"
+      ],
+      "limits": "Unchanged S01 coordinate failures remain; human aesthetic/print approval absent."
+    },
+    {
+      "criterion": "Automated PDF Fidelity",
+      "status": "FAIL",
+      "evidence": [
+        "windows-template-oracle",
+        "linux-template-oracle"
+      ],
+      "limits": "Original24CV+4letter per platform pass; revised corpus fails only S01. No oracle waiver."
+    },
+    {
+      "criterion": "Semantic Content Completeness",
+      "status": "PASS",
+      "evidence": [
+        "windows-template-completeness",
+        "linux-template-completeness"
+      ],
+      "limits": "Finite36 revised CVs/122pages per platform, source markers/bounds; not model semantic truth."
+    },
+    {
+      "criterion": "Human Print Approval",
+      "status": "NOT TESTED",
+      "evidence": [
+        "MANUAL_ACCEPTANCE.md"
+      ],
+      "limits": "Actual printing requires a human/printer; PDF generation is not printing."
+    },
+    {
+      "criterion": "CV AI Accuracy",
+      "status": "BLOCKED",
+      "evidence": [
+        "cv-model-probe",
+        "AI_RESULTS.md"
+      ],
+      "limits": "Three actual synthetic responses rejected; no accepted end-to-end model quality evidence."
+    },
+    {
+      "criterion": "Human/Device Acceptance",
+      "status": "NOT TESTED",
+      "evidence": [
+        "MANUAL_ACCEPTANCE.md"
+      ],
+      "limits": "Automated emulation/axe are separate and do not supply human approval."
+    },
+    {
+      "criterion": "Python Security",
+      "status": "CONDITIONAL",
+      "evidence": [
+        "installed-python-advisories",
+        "pip-audit"
+      ],
+      "limits": "Current exact installed audit retains one vendor-PyPI404; source-scoped P9 disposition, no risk waiver."
+    },
+    {
+      "criterion": "Hosted CI",
+      "status": "BLOCKED",
+      "evidence": [
+        "AUTHORITY.md",
+        ".gitea/workflows/mariadb-integration.yml"
+      ],
+      "limits": "Quarantined lane/current runner isolation unverified;0 fresh hosted database cases."
+    },
+    {
+      "criterion": "Preservation",
+      "status": "PARTIAL",
+      "evidence": [
+        "preservation-register",
+        "TRACEABILITY.md"
+      ],
+      "limits": "All57 criteria and34 routes retained;56PARTIAL/1DEFERRED states are not promoted."
+    },
+    {
+      "criterion": "Git Publication",
+      "status": "VERIFIED",
+      "evidence": [
+        "git-checkpoint"
+      ],
+      "limits": "Exactc16a66e2c85b35caa5a4460c186dc77d28e31ccb snapshot readback; final resolved local/remote HEAD must be independently rechecked after publishing package."
+    },
+    {
+      "criterion": "Phase 10 Development Readiness",
+      "status": "NO-GO",
+      "evidence": [
+        "BLOCKERS.json",
+        "READY_TO_RUN.md"
+      ],
+      "limits": "Missing protected entry/candidate decisions, affected PDF disposition and controller runtime/test-adapter/policy qualification."
+    },
+    {
+      "criterion": "Automation Handoff Package",
+      "status": "READY",
+      "evidence": [
+        "HANDOFF_SCHEMA.json",
+        "TEST_EVIDENCE.json",
+        "CONTRACT.md"
+      ],
+      "limits": "Ready evidence import proposal; not configured or tested inside the separate orchestrator and not authority to execute."
+    },
+    {
+      "criterion": "Production",
+      "status": "NO-GO",
+      "evidence": [
+        "BLOCKERS.json"
+      ],
+      "limits": "No main merge/deploy; independent release/security/backup/recovery/provider/manual approvals absent."
+    }
+  ],
+  "testEvidenceReferences": [
+    "TEST_EVIDENCE.json",
+    "TRACEABILITY.md",
+    "VISUAL_REVIEW.md",
+    "AI_RESULTS.md"
+  ],
+  "unresolvedBlockerIds": [
+    "P10-ENTRY-01",
+    "P10-CANDIDATE-01",
+    "AUTO-RUNTIME-01",
+    "AUTO-ADAPTER-01",
+    "PDF-S01-01",
+    "HUMAN-01",
+    "AI-CV-01",
+    "DET-RECALL-01",
+    "PYSEC-01",
+    "CI-01",
+    "MYSQL-TLS-01",
+    "OPS-01",
+    "NATIVE-SEC-01",
+    "FUTURE-01",
+    "AI-CONTEXT-01",
+    "AUTO-SCOPE-01"
+  ],
+  "permissibleDeferrals": [
+    "HUMAN-01",
+    "AI-CV-01",
+    "DET-RECALL-01",
+    "PYSEC-01",
+    "CI-01"
+  ],
+  "requiredOwnerApprovals": [
+    {
+      "id": "phase10-development-entry",
+      "state": "NOT_PROVIDED_TO_HANDOFF",
+      "authority": "EXTERNAL_PROTECTED_CONTROLLER_APPROVAL"
+    },
+    {
+      "id": "candidate-specific-cleanup-scope",
+      "state": "NOT_PROVIDED_TO_HANDOFF",
+      "authority": "EXTERNAL_PROTECTED_CONTROLLER_APPROVAL"
+    },
+    {
+      "id": "policy-update",
+      "state": "NOT_PROVIDED_TO_HANDOFF",
+      "authority": "EXTERNAL_PROTECTED_CONTROLLER_APPROVAL"
+    }
+  ],
+  "generatedUtc": "2026-10-29T17:56:46.240720+00:00",
+  "recommendation": "Remain BLOCKED for automatic Phase10. Review this complete evidence, resolve affected mandatory conditions and protected scope, qualify the separate runtime/adapter, and adopt final published baseline/policy through its signed approval flow. Do not start any later workstream, merge or deploy."
+}
@@ -41,14 +41,16 @@
    },
    {
      "id": "AUTO-RUNTIME-01",
-      "description": "The separate orchestrator reports an unqualified native Codex sandbox and missing isolated runner/signing boundary.",
+      "description": "Current single-user controller reports real MXC canary PASS, but no actual owner key or ChatGPT sign-in, operator-controlled policy and disabled real execution; current-context qualification/activation remains incomplete.",
      "evidence": [
-        "AUTHORITY.md",
-        "ROADMAP.md"
+        "CONTROLLER_ADDENDUM.md",
+        "READY_TO_RUN.md",
+        "controller-current-native-qualification-json",
+        "controller-current-setup-results-json"
      ],
      "severity": "HIGH",
      "acceptanceCriterion": "Independent qualified execution boundary",
-      "requiredAction": "Qualify the sandbox/isolated account or VM, protected approval/state ACLs, process/CPU/memory/tool/read/egress/secret boundaries and actual worker execution. This workstream must not modify that runtime.",
+      "requiredAction": "Operator must sign into dedicated auth-only profile, configure the actual protected owner key and qualify its host-positive/worker-negative boundary and fresh current-context controls, then independently approve runtime/queue/entry policy. Existing same-user MXC mode does not require a new account or VM; its finite canaries do not qualify actual owner credentials or roadmap execution. This handoff must not operate that runtime.",
      "blockingPhase": [
        "AUTOMATIC_PHASE-10_EXECUTION"
      ],
@@ -263,11 +265,17 @@
    {
      "id": "AI-CONTEXT-01",
      "description": "Generic strategy admission still requires legacy ProfileCvText; successful reviewed structured import alone does not establish that precondition.",
-      "evidence": ["AI_RESULTS.md", "JobTrackerApi/Services/StrategySnapshotService.cs", "JobTrackerApi/Controllers/ProfileCvController.Import.cs"],
+      "evidence": [
+        "AI_RESULTS.md",
+        "JobTrackerApi/Services/StrategySnapshotService.cs",
+        "JobTrackerApi/Controllers/ProfileCvController.Import.cs"
+      ],
      "severity": "MODERATE",
      "acceptanceCriterion": "Do not claim canonical-only import to generic AI compatibility without exercising it",
      "requiredAction": "Assess canonical-only generic-AI source compatibility during Product Review. Preserve existing consent/source contracts; never silently fill legacy text from unreviewed uploads. The current successful smoke explicitly supplies separately authored fictional CV text.",
-      "blockingPhase": ["GENERIC_AI_FROM_CANONICAL_ONLY_PROFILE_CLAIM"],
+      "blockingPhase": [
+        "GENERIC_AI_FROM_CANONICAL_ONLY_PROFILE_CLAIM"
+      ],
      "responsibleParty": "Product / AI integration owner",
      "deferralAuthority": null,
      "classification": "FUTURE_FEATURE",
@@ -276,11 +284,17 @@
    {
      "id": "AUTO-SCOPE-01",
      "description": "The committed controller policy has stage entry/review approvals but no explicit protected candidate-scope checkpoint after an assessment-only Phase10 entry.",
-      "evidence": ["CONTRACT.md", "GATES.json", "CLEANUP_INVENTORY.md"],
+      "evidence": [
+        "CONTRACT.md",
+        "GATES.json",
+        "CLEANUP_INVENTORY.md"
+      ],
      "severity": "HIGH",
      "acceptanceCriterion": "Concrete owner-approved candidate scope before cleanup implementation",
      "requiredAction": "Bind a full entry approval to already-proven exact candidates, or use the controller's signed policy update to stop after assessment and require a protected candidate-specific-cleanup-scope decision before removal. Do not treat assessment-only approval or worker-written evidence as deletion authority.",
-      "blockingPhase": ["AUTOMATIC_PHASE-10_CLEANUP_IMPLEMENTATION"],
+      "blockingPhase": [
+        "AUTOMATIC_PHASE-10_CLEANUP_IMPLEMENTATION"
+      ],
      "responsibleParty": "Owner / AUTONOMOUS-ROADMAP-01 policy maintainer",
      "deferralAuthority": null,
      "classification": "MANDATORY_ENTRY",
@@ -0,0 +1,17 @@
+# External controller snapshot reconciliation — 29 October 2026
+
+At final review the external worktree advanced from the initially inspected c1663df to **140e182516e86c8718054cf0907593fcd6a38aa7**, branch `codex/autonomous-roadmap-single-user`. This addendum supersedes current-runtime statements based only on the earlier snapshot. Only committed Git objects were read; no external worktree file, setup, login, key, runtime, process, policy or schedule was modified or run by this handoff.
+
+The committed SINGLE_USER_ACCEPTANCE and machine-readable setup/qualification/results now report:
+
+- **69 Python controller tests**, including the original48, and **6 separate .NET signature cases**. These are external-workstream results, not fresh application/handoff executions, and69 must not be added to48.
+- Actual native MXC synthetic filesystem/network/signing canaries PASS, with host-positive controls and seven denied protected-file categories. The earlier legacy CryptUnprotectData failure is historical; it is no longer accurate to describe every supported native mode as failing startup.
+- Same-user installation exists; a new Windows account/VM is not a requirement of this mode. This confinement is not an independently administered account boundary and does not establish exhaustive API/credential safety.
+- Dedicated ChatGPT authentication **NOT_SIGNED_IN**, real owner signing key **NOT_CONFIGURED**, actual owner-key denial **false/not tested**, operator-controlled policy, queue **disabled**, **zero real sessions**. Canary signing-key denial does not qualify a nonexistent actual owner key.
+- Real provider/browser/Python/PDF/security/preservation adapter is still unconfigured. No formal Phase10 entry or accepted candidate-removal scope is supplied. No task was installed; locked-desktop/logged-out/reboot execution remains unqualified.
+
+GATES.json references140e182. The backlog/prompt policy remains based on5032ccb with empty checkpoint deferrableGates; the candidate-scope integration requirement remains open. TEST_EVIDENCE.json indexes the committed external documents/results/backlog as `controller-current-*` artifacts with exact byte hashes, explicitly not as our executed tests. The initial c166 observations remain historical context.
+
+AUTO-RUNTIME-01 remains BLOCKED for **actual key, human sign-in, current-context qualification and independent activation authority**, rather than an assumed universal DPAPI failure or mandatory second account. AUTO-ADAPTER-01, AUTO-SCOPE-01, exact final baseline adoption and Phase10 entry remain separate. The package neither closes nor duplicates the external controller's work.
+
+The operator's next steps, in their own real terminal, are described by that snapshot's SINGLE_USER.md: dedicated same-account authentication, protected owner-key setup, qualification of the exact actual key/current context, and later signed runtime/policy/baseline/entry decisions. Those actions are not performed or pre-approved here. Preserve the external operator-controlled pause until every applicable condition is met.
@@ -3,12 +3,14 @@
  "workstreamId": "AUTOMATION-HANDOFF-01",
  "kind": "GATES",
  "contractStatus": "PROPOSED_EVIDENCE_ADAPTER_NOT_EXECUTABLE_POLICY",
-  "controllerCommit": "c1663df44ca54eb1e6fad8facfcbc2d5eb5db8c8",
+  "controllerCommit": "140e182516e86c8718054cf0907593fcd6a38aa7",
  "controllerFiles": [
    "automation/backlog.json",
    "automation/schemas/backlog.schema.json",
    "automation/schemas/result.schema.json",
-    "docs/automation/GATES.md"
+    "docs/automation/GATES.md",
+    "docs/automation/SINGLE_USER_ACCEPTANCE.md",
+    "docs/automation/SINGLE_USER.md"
  ],
  "executionEnabledByThisPackage": false,
  "externalApprovalPolicy": "Use existing protected RSA/SHA256 owner-SID/request-hash/expiry binding. Bind resolved final baseline, candidate scope, policy/prompt and artifact hashes. No signatures/tokens are created here; all current checkpoint deferrableGates are empty. Any policy update/conditional-deferral requires the controller signed process.",
@@ -0,0 +1,52 @@
+# AUTOMATION-HANDOFF-01 — completed evidence handoff
+
+**Package READY; Pre-Phase-10 UX and CV Integration CONDITIONAL GO; Phase10 development NO-GO; automatic execution NOT authorised; production NO-GO.** This handoff completes safely achievable evidence work, not the missing owner/operator qualifications.
+
+Branch: `test/pre-phase10-ux-acceptance`. Frozen tested application baseline: **5032ccb41514807c8ca3008c24ca6326be1170de**. It contains CV-UX4a0af62, CV-QA4a8c907, cumulative3255da9 and strategy correction caa0c6a. Handoff-only descendants do not change application, existing tests or deployment. Resolve the final package commit using `git rev-parse HEAD`, and independently compare its remote ref and clean working tree: a file cannot truthfully embed the hash of the commit containing itself. ACCEPTANCE.json labels its earlier snapshot/readback explicitly. `verify.mjs --verify-remote` checks the actual current HEAD.
+
+The two previously unpublished commits caa0c6a/5032ccb and completed handoff checkpoints8804231,78e5296,657db9d,c16a66e were normally pushed and exact remote refs read back. DNS/TCP443/HTTPS/TLS and Git recovered without disabling certificate checks. GJ-00 planning remained separately published at0ec9f98e6ed4a646fc5e017d8eb6fade07653f37, diverging18/2 commits from5032ccb; it was not merged or modified. Primary and separate controller worktrees were preserved.
+
+## Fresh execution results
+
+| Lane | Actual outcome |
+|---|---|
+| .NET backend | **1448 passed**,0 failed/skipped |
+| React frontend | **1031 passed /112 suites**,0 failed/pending |
+| Ordinary browser | **380 passed** across four disjoint discovery-verified shards;0 failed/skipped/flaky/retries |
+| Specialized browser contracts | **53 passed**: AI2, auth2, rate9, ingress6, PDF admission1, preferences3, RD21 6, diagnostics18, volume3, RD21-volume3 |
+| Real import browser journeys | **8 passed**: Docling3, integration QA4, long import1 |
+| Real MariaDB | **90 provider tests +3 browser cases passed**, isolated data and fixture cleanup verified |
+| Native Linux rendering browser | **8 passed**, source/image/runtime identity and cleanup retained |
+| Python | **83 offline +14 real Docling passed**; native JUnit repeat replaces overlapping console run |
+| Existing helper/oracle tests | **9 new-benchmark +11 original-benchmark +11 Linux-helper +25 Node-helper passed** |
+| TypeScript, lint, frontend/API builds, Linux native build, Windows apphost restoration | All exit0 |
+| Handoff verification | **18 passed** native parser/schema/source/approval unit and package negative tests; report `handoff-validator` supersedes bootstrap7 |
+| Original PDF fidelity | Per platform24 CVs/60 pages and4 letters/14 pages PASS |
+| Revised PDF corpus | Per platform36 CVs/122 pages content/bounds PASS; full-height sidebar43/43 pages PASS; matching letters18/38 pages PASS |
+| Revised unchanged S01 fidelity | **FAIL: Windows28/36 and Linux20/36 fail S01 only**; criteria unchanged |
+
+These are separate executed lanes, not an assertion that every case exercises a unique product scenario. The original broad regression completed once with source unchanged. Follow-up fixture/collector failures and their non-overlapping recovery are retained in [QUALIFICATION_FAILURES.md](QUALIFICATION_FAILURES.md). Native command arguments, timestamps, exit codes, test identities, source maps and immutable runtime observations are portable artifacts indexed in [TEST_EVIDENCE.json](TEST_EVIDENCE.json). Historical totals and repeated runs are not added to fresh totals.
+
+## Actual local workflow and limits
+
+The existing development environment remains available at `http://jobbjakt.local/`; no handoff-doc activation was necessary. A fresh synthetic PDF passed through the real worker to pending review with owner-correlated events. Separate browser/MariaDB tests cover Upload→Review/correct→Approve→canonical Career Profile→CV Editor→PDF and durable rollback/concurrency protections. Synthetic owner erasure completed. Generic queued strategy and scheduled enrichment actually saved nonempty results; strategy retained a prior provider_unavailable failure. Generic strategy used separately authored fictional ProfileCvText: canonical-only imported structured facts do not satisfy that legacy precondition. AI-CONTEXT-01 records the gap without overwriting user-controlled text.
+
+Real conversion and deterministic extraction are distinct from model inference. Three safely isolated real CV-adapter probes used the approved existing Qwen artifact through a **read-only** model mount; all three were rejected. No compatibility or semantic-accuracy PASS is possible. The active CV adapter remains disabled/disconnected. No model download/replacement, existing Ollama/cache modification or permanent model selection occurred. [AI_RESULTS.md](AI_RESULTS.md) distinguishes actual inference, contract doubles, historical deterministic precision/recall and future qualification.
+
+Security is **CONDITIONAL**: import-lock48 dependencies had0 reported advisories; frontend production0, full frontend5 low; current NuGet scan reports MySqlConnector2.4.0 moderate GHSA-473q-m89c-ghf8. Exact installed Python audit queried63 distributions/126 endpoints with0 advisory records but retained vendor Torch PyPI404, so remains INCOMPLETE. No security risk was accepted on the owner's behalf. Prior source-diff review is historical scoped evidence, not a newly executed exhaustive scan. Hosted MariaDB/CI, native-image, production TLS/filesystem/off-disk backup/recovery/cache/operator qualification remain open in their own scopes.
+
+## Independent decisions and handoff
+
+[ACCEPTANCE.json](ACCEPTANCE.json) contains all15 independent decisions. PDF spacing PARTIAL, revised automated fidelity FAIL, finite semantic content completeness PASS; human printing/device/AT/language NOT TESTED; CV AI BLOCKED; Python security CONDITIONAL; hosted CI BLOCKED; preservation PARTIAL; Git snapshot publication VERIFIED. All57 preservation criteria and34 routes remain retained at their existing56 PARTIAL/1 DEFERRED classifications. No test or historical acceptance record was weakened.
+
+- [TRACEABILITY.md](TRACEABILITY.md): every requested capability mapped to current owners, actual reports and limits.
+- [VISUAL_REVIEW.md](VISUAL_REVIEW.md) and [owner-review.zip](visual/owner-review.zip): actual54 PDFs and first/final comparisons for owner decisions.
+- [MANUAL_ACCEPTANCE.md](MANUAL_ACCEPTANCE.md):11 prioritised human/device/AT/copy/print/workflow checks, all pending.
+- [BLOCKERS.json](BLOCKERS.json) and [AUTHORITY.md](AUTHORITY.md): mandatory entry blockers, source-authorised conditional development debt, production-only blockers and future work kept separate.
+- [PHASE10_BASELINE.md](PHASE10_BASELINE.md) and [CLEANUP_INVENTORY.md](CLEANUP_INVENTORY.md): exact source/compatibility baseline and19 concrete retain/assessment entries; **no approved product removal**.
+- [GATES.json](GATES.json), [ROADMAP.md](ROADMAP.md), [CONTRACT.md](CONTRACT.md), [HANDOFF_SCHEMA.json](HANDOFF_SCHEMA.json): proposed versioned evidence contract, stage05–11 dependencies and separately retained initiatives.
+- [REPRODUCE.md](REPRODUCE.md) and [READY_TO_RUN.md](READY_TO_RUN.md): independent verification and protected entry conditions.
+
+The separate controller was inspected through committed Git objects only, initially c1663df and finally **140e182516e86c8718054cf0907593fcd6a38aa7**. [CONTROLLER_ADDENDUM.md](CONTROLLER_ADDENDUM.md) reconciles its newer single-user mode:69 external Python cases (includes earlier48),6 signature cases and actual MXC canaries PASS, but dedicated sign-in and real owner key missing, operator-controlled/disabled, real adapter unconfigured and no Phase10 authority. Those tests were not rerun here. The older DPAPI failure remains historical. Empty checkpoint deferrableGates and AUTO-SCOPE-01 still require protected policy/candidate decisions. This package does not install a second controller, launch a queue, generate approval signatures or supply an owner decision.
+
+**Required owner/operator action:** review the actual PDFs and affected S01 requirement, complete applicable manual checks, approve the resolved final published baseline and exact cleanup candidate scope through protected approval, and qualify the separate sandbox/test adapter and signed policy. Existing source-authorised conditional debt is not an executable waiver. Production-only issues are not blanket blockers on unrelated assessment, and conditional development permission is not production acceptance. Until mandatory conditions are satisfied, the orchestrator must remain BLOCKED. No Phase10, Product Review, Global Jobs, main merge or production deployment was started.
@@ -4,7 +4,7 @@ Application baseline: **5032ccb41514807c8ca3008c24ca6326be1170de**, branch **tes

 The handoff checkpoint8804231be4e7c309a62d9d6e7d07c9ae0809bc3c was normally pushed and independently read back. Later handoff commits must also be published and verified. The **final integration ref is the resolved clean published HEAD containing this package**; obtain its exact hash with Git and bind the protected owner decision to it. A file cannot contain its own Git commit hash. ACCEPTANCE.json therefore distinguishes the frozen tested application baseline, capture-time HEAD/remote observation and required current consumption checks. Documentation-only descendants are bounded to `docs/automation/handoffs/pre-phase10/`; application or existing-test changes invalidate that shortcut and require fresh affected evidence.

-The separate controller snapshot is c1663df44ca54eb1e6fad8facfcbc2d5eb5db8c8, based on5032ccb. Its branch is not modified here. The operator must use its existing signed policy-update/configure process to adopt the final approved integration baseline/context artifacts **before real execution**, qualify its runtime/test adapter and obtain the required entry approval. Do not edit its policy silently or run another controller. No baseline replacement after started work is authorised by this package.
+The separate controller's final inspected snapshot is140e182516e86c8718054cf0907593fcd6a38aa7, descended from initially inspected c1663df and based on5032ccb. [CONTROLLER_ADDENDUM.md](CONTROLLER_ADDENDUM.md) distinguishes new MXC canary PASS from still-missing actual key/sign-in/runtime activation and test adapter. Its branch is not modified here. The operator must use its existing signed policy-update/configure process to adopt the final approved integration baseline/context artifacts **before real execution**, qualify its current context/test adapter and obtain the required entry approval. Do not edit its policy silently or run another controller. No baseline replacement after started work is authorised by this package.

 GJ-00 planning local/remote0ec9f98e6ed4a646fc5e017d8eb6fade07653f37 is separately verified. Relative to5032ccb, the integration and planning branches have18 and2 unique commits respectively. Neither is a safe blind replacement for the other. No merge/cherry-pick was performed. Future authorised integration must reconcile the planning documents against the later accepted application source.

@@ -24,12 +24,12 @@ No Phase 10, later feature work, main merge, production operations, destructive

 ## Checkpoints

- [ ] AUTO-H01: capture clean starting source/ancestry/remote/session observations; reconcile original CV-UX/import/QA/RD21/Phase9/Phase10 gates and committed orchestrator policy. Produce capability traceability and authority register.
- [ ] AUTO-H02/H03: investigate unchanged S01 PDF failures using actual synthetic rendered bytes, preserve the original oracle, nominate only confirmed formatting defects; run safe parser/model/security checks with existing immutable artifacts. Prepare labelled visual comparison artifacts. No CV-model activation or semantic PASS by inference.
- [ ] AUTO-H04/H05: produce prioritised owner scenarios with blocking scope; diagnose DNS/TCP/HTTPS/TLS/Git separately, normal-push this branch if reachable, inspect GJ-00 ref without changing it.
- [ ] AUTO-H06: run fresh applicable backend/frontend/browser/Docling/MariaDB/RD21/Python/build/type/lint/security/preservation lanes in isolated fixtures. Capture native commands/exits/reports/test identities/source hashes; retain failures and compare historical counts separately.
- [ ] AUTO-H07: create HANDOFF.md, ACCEPTANCE.json, GATES.json, BLOCKERS.json, TEST_EVIDENCE.json, MANUAL_ACCEPTANCE.md, PHASE10_BASELINE.md, READY_TO_RUN.md, HANDOFF_SCHEMA.json. Add minimal schema/evidence verification and negative tests proving missing/tampered/wrong-source reports or fake owner approvals cannot authorise execution.
- [ ] AUTO-H08: record exact candidate/retain inventory, roadmap stages05–11 and separately tracked initiatives, independent decisions and owner actions. Review whole package, validate, commit, normal-push/read-back if available; otherwise preserve precise publication blocker. Stop.
+- [x] AUTO-H01: capture clean starting source/ancestry/remote/session observations; reconcile original CV-UX/import/QA/RD21/Phase9/Phase10 gates and committed orchestrator policy. Produce capability traceability and authority register.
+- [x] AUTO-H02/H03: investigate unchanged S01 PDF failures using actual synthetic rendered bytes, preserve the original oracle, nominate only confirmed formatting defects; run safe parser/model/security checks with existing immutable artifacts. Prepare labelled visual comparison artifacts. No CV-model activation or semantic PASS by inference.
+- [x] AUTO-H04/H05: produce prioritised owner scenarios with blocking scope; diagnose DNS/TCP/HTTPS/TLS/Git separately, normal-push this branch if reachable, inspect GJ-00 ref without changing it.
+- [x] AUTO-H06: run fresh applicable backend/frontend/browser/Docling/MariaDB/RD21/Python/build/type/lint/security/preservation lanes in isolated fixtures. Capture native commands/exits/reports/test identities/source hashes; retain failures and compare historical counts separately.
+- [x] AUTO-H07: create HANDOFF.md, ACCEPTANCE.json, GATES.json, BLOCKERS.json, TEST_EVIDENCE.json, MANUAL_ACCEPTANCE.md, PHASE10_BASELINE.md, READY_TO_RUN.md, HANDOFF_SCHEMA.json. Add minimal schema/evidence verification and negative tests proving missing/tampered/wrong-source reports or fake owner approvals cannot authorise execution.
+- [x] AUTO-H08: record exact candidate/retain inventory, roadmap stages05–11 and separately tracked initiatives, independent decisions and owner actions. Review whole package, validate, commit, normal-push/read-back if available; otherwise preserve precise publication blocker. Stop. Final publication/cleanliness is resolved dynamically after the containing commit, not self-asserted by a hash inside it.

 ## Initial rulings

@@ -40,3 +40,9 @@ The existing controller's result/backlog schemas are not acceptance-package sche
 The initial commit normalised the copied request's CRLF bytes. Scoped .gitattributes now preserves the original request and hash-indexed package bytes exactly across checkouts; no instruction or acceptance criterion is changed. Native evidence is compressed individually for portable verification rather than relying on ignored files in another worktree.

 Existing Phase9 authority allows genuinely unfinished human checks as release debt and individually scoped conditional development; it does not grant broad Phase10 entry or accept unresolved security risks. Exact candidate approval and unused-caller proof remain mandatory. This handoff can be READY as evidence while Phase10 remains BLOCKED.
+
+## Final verification and review
+
+All safely achievable checkpoints completed; completion of the evidence task does not complete the outstanding gates. The final combined18 parser/schema/source/authority/package-negative tests passed and supersede bootstrap7. Native required-readiness exit3 and RTK-wrapper exit1 were independently distinguished. Fresh-context whole-package review found no actionable defects; its scope included source/report/exit binding, approval boundaries, decompression/path limits, temporary-directory cleanup and84 visual ZIP entries matching manifest hashes. The reviewer did not rerun product/production/human tests or grant protected approval. Final publisher must verify clean current HEAD and exact remote equality.
+
+The external controller advanced during this task; CONTROLLER_ADDENDUM.md records the final read-only140e182 snapshot and narrower remaining actual-key/sign-in/context gates. No controller operation occurred here. Updated package text uses LF except existing CRLF files and the exact byte-preserved owner request; compressed native artifacts retain original bytes. No application or pre-existing test source was changed.
@@ -7,7 +7,9 @@ Failed attempts are not deleted, counted as passing tests or hidden by retries.
 | post-01 | Temporary proxy exited before any browser case; immediate port lookup raised KeyError | A separate reproduction retained nginx's exact `mkdir /var/cache/nginx/fastcgi_temp: Read-only file system` error. The one-off fixture omitted FastCGI/uwsgi/scgi paths. post-02 points all temporary paths into the existing bounded `/tmp` mount and checks startup state. Root stays read-only; no application/configuration or test assertion changed |
 | proxy-reproduction-02 | Expected diagnostic exit1 before tests | Exact logs/state and owned-resource cleanup retained; not a product failure or extra test case |
 | post-02 Linux build | The runner incorrectly supplied an output outside `.artifacts/cv-ux-01`; existing helper rejected it before build | linux-post-03 resumes only the unfinished Linux/audit work under a fresh allowed child. The helper guard was preserved; already passing import/MariaDB/Windows lanes were not rerun or double-counted |
-| Revised S01 oracle | Windows8/36 and the separately recorded Linux result; original2mm coordinate threshold unchanged | Content, name wrapping, sidebar raster and visible-ink diagnostics are distinct evidence. No golden/tolerance change or aesthetic self-approval |
+| linux-post-03 collector | Native build and8 Linux browser cases passed; follow-up checker targeted nonexistent `templates` instead of actual `template-library` | linux-pdf-post-04 runs only unfinished PDF/audit checks against the actual corpus. No duplicate Linux browser total or application change |
+| Initial portable export | Raw Playwright JSON with inline screenshots exceeded the verifier's8MiB decompression limit | Original raw files remain untouched. Portable projections remove only inline attachment body strings, retaining all cases/status/errors/retries/counters and a per-body/source/projection hash audit. Visual PDFs/images are separately packaged. The limit stays enforced |
+| Revised S01 oracle | Windows8/36 and Linux16/36 pass; original2mm coordinate threshold unchanged | Remaining28/20 failures are S01-only. Content, name wrapping, sidebar raster and visible-ink diagnostics are distinct evidence. No golden/tolerance change or aesthetic self-approval |
 | Isolated real CV-model probe | All3 synthetic responses rejected with ValueError | No model/validator replacement or activation. Compatibility/semantic accuracy remains BLOCKED; process exit0 means the measurement completed |
 | Initial handoff-validator RED | New tests failed because implementation module was absent | Native parser/hash/approval tests implemented and rerun; final unit/integration results supersede overlapping focused runs, without adding them |

@@ -9,18 +9,18 @@ Before the separate controller starts anything, its operator must independently:
 3. Obtain a protected `phase10-development-entry` approval bound to the **resolved final published commit**, exact candidate scope, current policy/prompt and artifact hashes. No approval was supplied to this handoff, and none is generated. A worker-written GO or signed-looking JSON is not approval.
 4. Establish concrete unused caller/route/old-data proof, affected57-group/34-route preservation, rollback and candidate tests before any removal. Current inventory has **no approved removal**. Retain legacy CV design/run behavior, aliases, revision/persistence contracts, SQLite and migrations.
 5. Resolve affected S01/rendering acceptance or obtain an explicit protected applicability decision supported by unchanged original failures and real visual evidence. Do not silently reinterpret a required automated failure as a deferral. Complete applicable human checks; existing release-only debt does not independently forbid unrelated assessment, but also does not grant implementation authority.
-6. Qualify the separate controller's native sandbox/host/process/secret/read/egress/control-plane boundary and install/approve the actual stage composite test adapter. Its synthetic48+6 test evidence and static queue validity do not qualify real roadmap execution. This workstream did not modify or run it.
+6. Qualify the separate controller's actual owner key, dedicated sign-in and fresh current execution context, then install/approve the real stage composite test adapter. The latest inspected140e182 single-user mode reports69 external Python cases (includes the earlier48),6 signature cases and actual MXC canary PASS; actual owner key/authentication/activation remain missing. Canary PASS and static queue validity do not qualify real roadmap execution. See CONTROLLER_ADDENDUM.md; this workstream did not modify or run it.
 7. Reconcile individual conditional debt with the existing signed policy. Current checkpoint deferrableGates arrays are empty. Any future policy/conditional-deferral requires the controller's protected approval flow and cannot override a mandatory automated requirement. Keep hosted CI BLOCKED until actual isolated execution and cleanup proof; keep CV AI disabled and production NO-GO.

 Local package checks:

 ```powershell
-rtk proxy node --test docs/automation/handoffs/pre-phase10/verify.test.mjs
+rtk proxy node --test docs/automation/handoffs/pre-phase10/verify.test.mjs docs/automation/handoffs/pre-phase10/package.test.mjs
 rtk proxy node docs/automation/handoffs/pre-phase10/verify.mjs
 rtk proxy node docs/automation/handoffs/pre-phase10/verify.mjs --verify-remote
 rtk proxy node docs/automation/handoffs/pre-phase10/verify.mjs --require-ready
 ```

-Normal validation exit0 means evidence integrity is consistent; it prints Phase10 BLOCKED. `--require-ready` deliberately exits3 for this unapproved snapshot. This verifier does not run tests, launch a queue, validate/issue owner signatures or modify the controller. The controller must perform its own protected checks and fresh candidate verification. If it lacks these capabilities, stop rather than trusting a repository status.
+Normal validation exit0 means evidence integrity is consistent; it prints Phase10 BLOCKED. `--require-ready` deliberately produces native Node exit3 for this unapproved snapshot (the installed RTK wrapper maps nonzero child exits to1). This verifier does not run tests, launch a queue, validate/issue owner signatures or modify the controller. The controller must perform its own protected checks and fresh candidate verification. If it lacks these capabilities, stop rather than trusting a repository status.

 No protected owner key/token, credentials, model cache or production endpoint belongs in this package. The separate worktree was inspected through committed Git objects only. No second orchestrator, scheduled automation, main merge, deployment or Phase10 implementation was started.
@@ -0,0 +1,22 @@
+# Reproducing and consuming this evidence
+
+Start in a clean checkout of the **resolved published** `test/pre-phase10-ux-acceptance` branch, containing5032ccb. Do not reset another worktree or assume main contains the application baseline. Use repository-supported tools and isolated fixtures; no production database, service, model cache or credentials are needed.
+
+```powershell
+rtk proxy git status --short
+rtk proxy git rev-parse HEAD
+rtk proxy git merge-base --is-ancestor 5032ccb41514807c8ca3008c24ca6326be1170de HEAD
+rtk proxy node --test docs/automation/handoffs/pre-phase10/verify.test.mjs docs/automation/handoffs/pre-phase10/package.test.mjs
+rtk proxy node docs/automation/handoffs/pre-phase10/verify.mjs --verify-remote
+rtk proxy node docs/automation/handoffs/pre-phase10/verify.mjs --require-ready
+```
+
+The final command must fail closed and report BLOCKED/eligible:false. The native Node exit is3; the installed RTK wrapper maps that child failure to shell exit1. Both were observed separately. Normal validation exit0 confirms internal evidence consistency only. Run the installed frontend dependencies' Ajv validator through the existing module; do not fetch dependencies or unapproved runtime artifacts implicitly. Node24.19.0, .NET SDK9.0.317, Python3.12.10 and Docker29.7.2 were observed. Absolute native report paths are producer metadata; compressed artifact paths resolve relative to this directory.
+
+The four primary structured files ACCEPTANCE/GATES/BLOCKERS/TEST_EVIDENCE validate against HANDOFF_SCHEMA draft7. The verifier checks each compressed artifact SHA/size, bounded decompression, native test counters and membership, exit-code process pointer, commit binding, source-before/after equality and current tracked source scope, ordinary discovery coverage, verifier code committed identity and protected decision invariants. Portable Playwright projections externalize **only** inline attachment body strings; an indexed audit retains original report SHA/path and each omitted body's SHA/length. Case/status/error/retry/stat data is retained. Original raw reports remain unchanged under the producer artifact root. These projections and review JPEGs must not be described as byte-identical originals or used to waive a policy requiring the original attachment payloads.
+
+For fresh application execution, inspect the exact process artifact referenced by each report, including argv, timestamps, exit and executedFromCommit. The one-off bounded producer scripts are also indexed; they are QA records, not a new roadmap executor. Restore the same immutable fixture/image inputs and use a **new** allowed output directory. Do not blindly replay destructive setup, reuse a previous run's paths or accept stored PASS as a new run. Relevant repository lanes include backend `dotnet test`, UI `npm test -- --watchAll=false --runInBand`, `npm run typecheck`, lint/build, four ordinary Playwright shards with `--retries=0`, isolated import/MariaDB and native Linux renderer helpers, and Python offline/real-Docling suites. The process records carry exact filters/configuration rather than an approximate command assembled from historical totals.
+
+Source-binding excludes only the new handoff package; any change in the indexed application/test/helper/previous acceptance scope fails validation until affected evidence is rerun and reviewed. Its frozen baseline is5032ccb; `executedFromCommit` preserves the actual later documentation-only execution commit. The verifier has its own immutable verifierCommit/source map. A later documentation commit does not pretend the earlier tests executed at that future hash. Actual final Git cleanliness/publication must be checked at consumption and bound into any protected approval.
+
+Do not add bootstrap unit7 to final combined validator totals, repeated Python console97 to native JUnit97, or the Linux eight browser cases to each PDF recovery attempt. Native document measurement totals are not test-case totals. See QUALIFICATION_FAILURES.md before interpreting intermediate exit1 records. Source manifests and artifact hashes establish correspondence and detect accidental drift; they are **not cryptographic owner attestation** and cannot defeat a malicious writer who controls every evidence file. The independent protected controller must retain its own trust roots, report generation/review and approval process.
@@ -0,0 +1,42 @@
+# Capability-to-evidence traceability
+
+Fresh source baseline: **5032ccb41514807c8ca3008c24ca6326be1170de**. Report IDs below resolve through TEST_EVIDENCE.json to native reports, actual process exits, test identities and source hashes. PASS means the finite automated behavior exercised, not blanket feature, semantic, human or production acceptance. No application source or existing test was changed for this handoff.
+
+| Required capability | Current owner / actual tests | Fresh report IDs | Decision and limits |
+|---|---|---|---|
+| Completely blank CV, zero unwanted sections | CvBuilderEditor; `e2e/pre-p10-cv-editor.spec.ts`; CvBlankPersistenceTests | ordinary-1/2/3/4, backend, mariadb-provider | Automated PASS; actual blank durable save exercised |
+| Create from Career Profile, section selection | CvBuilderEditor/CareerProfileMapper; pre-p10 editor and cv-section-scope specs | ordinary shards, backend, frontend | Automated PASS; profile remains canonical; explicit supported selections |
+| Undo/redo across supported operations | editor history; pre-p10 editor spec and frontend tests | ordinary shards, frontend | Automated PASS for bounded document operations; not undo of every remote side effect |
+| Save, refresh, lost response and recovery | ApplicationAssetsService/version tokens; provider and RD21 suites | mariadb-provider, mariadb-browser, rd21, rd21-volume | Automated PASS; success requires read-back/durable write |
+| Multiple-session editing, stale writes | existing revision contract; MariaDB concurrency suites | mariadb-provider, rd21, preferences | Automated PASS for conflicts/no lost update; not simultaneous human usability approval |
+| Existing CVs, frozen revisions, job variants and submitted packages | ApplicationAssetsService; original renderer; documents-contract/cv-library specs | backend, ordinary shards, original PDF artifacts | Automated finite PASS; no old-data rewrite; preservation overall remains PARTIAL |
+| Nine-template library and actual previews | CvTemplateGallery/Thumbnail; actual sandboxed HTML samples, explicit Apply | frontend, ordinary shards, windows/linux-browser | Automated PASS; aesthetics PARTIAL |
+| Existing/new title and section spacing | CvTheme/ThemedCvRenderer design versions | windows/linux-template-oracle, -name-ink | PARTIAL: unchanged S01 failures; never waived by ink diagnostic |
+| Optional photos, crop and theme persistence | editor/photo/theme owners; revised corpus | frontend, ordinary shards, template measurements | Automated finite PASS with synthetic geometric photo; human photo/layout review open |
+| Font consistency/weights, margins, headings, bullets/columns/page breaks | licensed bundled fonts/shared physical renderer; original and revised oracles | original PDF artifacts; template-completeness/-name-wrap/-sidebar | Content/bounds PASS; coordinate fidelity FAIL; visual rhythm/whitespace PARTIAL |
+| Multi-page and long names/skills/education, Norwegian characters | four revised fixture profiles and matching letters | template-completeness; matching-letter proofs | 36 CVs/122 pages and18 letters/38 pages per platform; automated finite PASS, physical printing NOT TESTED |
+| Real PDF and DOCX conversion | bounded Python Docling; import-tests/cv-import-docling.spec.ts; Python document tests | docling-import, python-docling | Automated PASS for supported text PDF/DOCX fixtures; scanned/OCR/layout breadth not qualified |
+| Real worker dispatch and progress | existing CV worker/store/AdminProcessing owners | local-worker, docling-import, diagnostics | Actual queued→running/extracting→pending_review plus owner-correlated events PASS; finite timeout/cancel tests separate |
+| Canonical Career Profile field mapping/new records | import interpreter/mapper/reviewed persistence; import-tests/cv-integration-qa.spec.ts | cv-integration-qa, long-import, mariadb-provider, backend | Automated supported workflow PASS; deterministic recall remains PARTIAL; unknown values must stay unknown |
+| Review/correction, group/field approval, source evidence | career/CvImportReview/CvImportMappingEditor | cv-integration-qa, docling-import, frontend, backend | Automated PASS; original PDF preview, DOCX source download/text; no claim of inline Word renderer |
+| Duplicate/conflict resolution, preserve existing values | reviewed apply owner and provider tests | mariadb-provider, cv-integration-qa, backend | Automated PASS for exercised matching/update/skip paths; conservative human decisions retained |
+| Transactional MariaDB apply, idempotent replay, rollback | CvImportReviewedPersistenceTests/CvImportConnectionLossTests/CvImportLifecycleConcurrencyTests | mariadb-provider | 90 provider cases overall, not90 import-only cases; rollback/concurrency/replay covered |
+| Revision safety and repeated requests | existing profile/job revisions and RD21 contracts | mariadb-provider, rd21, mariadb-observations | PASS for covered concurrency/recovery. Two observation cases document repeated creation behavior; do not prove creation-intent idempotency |
+| Failure/retry/cancellation/restart and provenance | CV worker durable states/source ownership and parser tests | backend, python-offline, docling-import, long-import, diagnostics | Automated PASS for finite cases; ownership/tenant/source checks retained; no indefinite success by timers |
+| Dashboard actual drag/resize | DashboardGrid + LayoutEditor; phase8-dashboard-customisation and dashboard-presentation specs | ordinary shards, frontend, preferences | Automated PASS; keyboard alternatives, collision and persistence covered |
+| Dashboard show/hide/save/reset, v1 preferences and stale-save conflicts | dashboardLayout/useDashboardLayout | preferences, frontend, ordinary shards | Automated PASS; hidden/future widget data retained |
+| Dashboard mobile and keyboard use | responsive linear layout/navigation guard | ordinary shards, frontend | Automated viewport/keyboard/axe PASS; physical mobile and AT NOT TESTED |
+| Admin owner + related job/import attribution | AdminProcessingPage/controller/store | diagnostics, backend, local-worker | Automated PASS for scoped IDs and real events; no cross-user progress/result access accepted |
+| Admin stage/status/duration/failures and bounded polling | admin-processing.spec.ts and API tests | diagnostics, frontend, backend | Automated PASS; provider_unavailable history retained even when retry succeeds |
+| Sanitised event logs, redaction, authorisation and tenant isolation | processing diagnostics service + authorisation tests | diagnostics, auth, rate, ingress, backend | Automated PASS for exercised payloads/roles; no claim of exhaustive repository security scan |
+| Real Docling vs deterministic interpretation | separate converter/grounding/interpreter | python-docling, python-offline, benchmark-new/-original, import journeys | Real conversion PASS; extraction recall PARTIAL; benchmark fixtures are finite synthetic source facts |
+| Queued AI strategy generation | existing generic operation worker/StrategySnapshotService | local-worker, ai, backend | Real local queue completed and persisted summary; earlier provider failure retained; separately authored ProfileCvText required |
+| Scheduled job enrichment | current scheduled worker/sidecar | local-worker | Actual scheduler persisted summary+tags at configured cadence; semantic correctness NOT qualified |
+| Safe structured outputs and model failures | cv_import_ai.py and grounding tests; isolated immutable probe | python-offline, cv-model-probe, model-verification artifacts | Contract tests PASS; all3 real CV probes rejected. CV model compatibility/accuracy BLOCKED; adapter stays disabled/disconnected |
+| Generic AI from imported structured profile alone | StrategySnapshotService requires legacy ProfileCvText | AI_RESULTS.md, BLOCKERS AI-CONTEXT-01 | NOT QUALIFIED: reviewed import deliberately does not populate legacy raw CV text; no fabricated compatibility claim |
+| Routes, auth, jobs/applications, CV/letters, settings, administration | existing shared owners; redesign-preservation and route specs | ordinary shards, auth, backend, frontend, preservation-register | 380 ordinary cases with discovery identity; all57 preservation entries/34 routes retained,56 PARTIAL/1 DEFERRED unchanged |
+| EN/Bokmål, light/dark, responsive/reduced motion | existing translations/themes/a11y specs | ordinary shards, frontend, native PDF measurements | Finite automated PASS; human copy/contrast/AT/device approval NOT TESTED. Other languages not newly qualified |
+
+`ordinary-*` denotes four disjoint reports (380 unique executed cases), not an extra suite added to the total. Specialized contracts have53 cases, import journeys8, real-provider browser checks3 and Linux native-browser checks8; these are separate lanes, not all unique product scenarios. Backend1448 and frontend1031 include many of the behaviors above; row counts must never be summed.
+
+See [VISUAL_REVIEW.md](VISUAL_REVIEW.md), [AI_RESULTS.md](AI_RESULTS.md), [MANUAL_ACCEPTANCE.md](MANUAL_ACCEPTANCE.md), [AUTHORITY.md](AUTHORITY.md) and [BLOCKERS.json](BLOCKERS.json) for the deliberately unfinished acceptance decisions. No listed PASS supplies protected Phase10 approval.
@@ -0,0 +1,25 @@
+# Current template visual review — 29 October 2026
+
+**Visual spacing: PARTIAL. Automated revised fidelity: FAIL. Human approval and actual printing: NOT TESTED.** No tolerance, golden, font, renderer or application source was changed during this handoff.
+
+Download [owner-review.zip](visual/owner-review.zip) (about 5 MB). It contains **36 actual CV PDFs and 18 matching cover-letter PDFs**, first/final contact sheets, and adjacent short-CV preview/export images for all nine templates. [manifest.json](visual/manifest.json) records original source and packaged SHA-256 values. PDFs are byte-preserved; JPEG review images are compressed navigation aids, never pixel oracles. Synthetic names, email addresses, long identifiers, Norwegian characters and geometric photo placeholders are deliberate fixtures.
+
+| Fresh measurement | Windows | Linux | Meaning |
+|---|---:|---:|---|
+| Original CV corpus | 24 documents / 60 pages PASS | 24 / 60 PASS | Historical rendering compatibility |
+| Original cover letters | 4 / 14 PASS | 4 / 14 PASS | Historical letter compatibility |
+| Revised CV content/bounds | 36 / 122 PASS | 36 / 122 PASS | Source markers retained; physical text bounds checked |
+| Revised unchanged coordinate oracle | 8/36 PASS; 28 S01-only failures | 16/36 PASS; 20 S01-only failures | Existing 2 mm criterion still fails; exit1 retained |
+| Full-height sidebar raster | 43/43 applicable pages PASS | 43/43 PASS | Actual PDF color samples through top and bottom rows |
+| Name wrap and separate visible-ink checks | PASS | PASS | Distinct diagnostics; cannot waive S01 |
+| Matching themed cover letters | 18 / 38 pages PASS | 18 / 38 PASS | Finite source markers, bounds and theme checks |
+
+The revised corpus covers modern, minimal, executive, technical, ats-classic, nordic, elegant, creative and code; four short/medium/long/dense EN/Bokmål profiles. Dense cases include 12 employers, education and long skill lists. Separate matching letters cover short EN and long Bokmål. Native report IDs are `windows-template-*`, `linux-template-*`, original-PDF/letter artifacts and matching-letter proof artifacts in TEST_EVIDENCE.json. Each measurement is separate from browser test totals.
+
+Agent inspection of the short first-page and dense final-page sheets confirms the intended template differences and full-height colored sidebars are visible. Long names wrap, and some dense final pages have considerable trailing whitespace after the final sections. That observation is a review question, not a new automated failure or a human aesthetic decision. Actual PDFs, bounds/marker diagnostics and unchanged S01 failures remain available for independent inspection.
+
+Open [short first pages](visual/templates-contact-short-en-first.jpg) and [dense final pages](visual/templates-contact-dense-nb-last.jpg), then the corresponding PDFs at 100%. Compare title-to-subtitle/content gaps, heading rhythm, line height, paragraph/bullet indentation, page margins, column alignment, breaks, photo/no-photo variants, font weights and final-page whitespace. Inspect first **and** final pages of long/dense records, not just gallery thumbnails. Print representative classic, modern, code and sidebar layouts at actual size. Record template/profile/page, platform, screenshot or print, result and requested correction using MANUAL_ACCEPTANCE.md cases HUMAN-06/HUMAN-07.
+
+The current gallery uses actual rendered sample HTML; changing template is preview-only until **Apply**. New CVs or explicit Apply use design version2. Existing version1, frozen/historical CVs and submitted packages retain their renderer/settings until an explicit supported edit. This handoff does not rewrite old documents.
+
+S01 compares text-coordinate baselines; separate raster ink diagnostics are closer while still not satisfying the original criterion. No reproducible missing-content/clipping defect was established by the finite checks. An owner must resolve the affected fidelity requirement or supply a protected applicability decision for a concrete cleanup candidate. This evidence does not change a mandatory test into optional release debt.
--- a/Show More
+++ b/Show More