fix(admin): complete processing diagnostics and failure evidence

docs/pre-phase10-ux/D_ADDENDUM_ACCEPTANCE.md

@@ -0,0 +1,35 @@
+# D owner-addendum qualification
+
+29 October 2026. This adds evidence to the preserved initial D acceptance; final cumulative acceptance remains pending.
+
+## Completed requirements
+
+The administrator list now filters before paging by UTC creation interval (inclusive start, exclusive end), actual owner-verified job, configured processing family, fixed failure code and bounded search. Search covers safe account identity, owned job title/company and exact operation GUID only. Invalid identifiers, intervals, worker names and failure codes return 400. The UI explains invalid filters and stops automatic retries until a correction. Dates earlier than MariaDB's supported range are rejected. Existing owner/status/task filters and bounded paging remain intact.
+
+Details expose the internal owner identifier, actual extraction-run identifier and explicit absence of a linked job. Job navigation is offered only when the authenticated administrator also owns that job; administrative metadata access grants no new ordinary-user job-reading permission. The list displays elapsed duration and current failure state. A named account-partitioned read limit permits 120 requests/minute without queueing; normal polling uses approximately 36/minute. Existing authorization remains mandatory.
+
+Failure metadata uses the latest retained, owner-bound typed failure event with a sanitized matching code. Successful/retrying operations label retained failures as previous failures. Missing historical timestamps stay unknown; a later success timestamp is never presented as the failure time. Only an actually failed terminal operation may fall back to its recorded completion time. No arbitrary messages, payloads or source text enter this projection.
+
+## Verification
+
+Evidence paths are relative to `.artifacts/pre-phase10-ux/`. Focused reruns are not added to full-suite totals.
+
+| Check | Result | Evidence |
+| --- | --- | --- |
+| Full backend | 1,447 passed, zero failed/skipped | `d-addendum-backend-final/backend.trx` |
+| Full frontend | 1,031 passed across 112 suites, zero failed/pending | `d-addendum-frontend-full-02.json` |
+| TypeScript, full lint, production frontend build | exit 0 each | `d-addendum-{typecheck,lint,build}-final.log` |
+| Admin boundaries, filters, recovery, responsive EN/NB/themes | two passed | `d-addendum-browser-02.json` |
+| Real browser zoom 100/200/400%, EN/light and NB/dark | two passed | same browser report; original geometry assertions retained |
+| Real MariaDB, including final failure-event projection | 90 passed, zero failed/skipped; cleanup exit 0 | `d-addendum-mariadb-final-02/` |
+| Follow-up static review | timestamp finding resolved; no further blocker | existing server review worker, 29 October |
+
+The initial RED API/UI cases remain in `d-addendum-api-red/` and `d-addendum-ui-red.json`. The timestamp regression was independently reproduced with the former completion-time binding (`d-failure-time-red.json`) before restoring the corrected binding. The first provider attempt found an actual collation mismatch in the new cross-table ownership filters. Explicit provider-appropriate binary collation fixed those comparisons without rewriting data or schemas; `d-addendum-mariadb-02/` passed 90 tests before the final failure-time query was added. A subsequent final attempt could not start because Docker Desktop was stopped (`d-addendum-mariadb-final/`); it did not reach tests or MariaDB. This infrastructure failure is not a test pass.
+
+The initial zoom recovery run passed both admin cases but was stopped while waiting for extension startup; retain `d-addendum-browser-final.log` as an incomplete attempt. Isolated diagnostic launches ruled out the long worktree path. The test context now enables its deliberate local extension and captures its service worker before navigation; the fresh four-case report passes. Application code, zoom percentages, timeout and geometry assertions were not relaxed.
+
+## Scope and gates
+
+The sealed security scan through `d52403d` does not include this later delta. Its bounded filters, rate policy, failure-event query and UI were reviewed separately; no new security blocker was identified. This is source review, not a new sealed scan or production acceptance.
+
+Full cumulative ordinary/specialized browser, final Docling, PDF fidelity, source/runtime closure and local C/D activation remain pending. Historical PDF coordinate-oracle failures, human/device/language/print checks, real AI extraction qualification and production infrastructure debt remain open. No production operation, main merge, deployment or Phase 10 cleanup occurred.

docs/pre-phase10-ux/INTEGRATION_PROGRESS.md

@@ -1,5 +1,15 @@
 # Integrated qualification progress
 
+## 29 October addendum
+
+The mandatory D owner-addendum audit identified missing diagnostic filters and identifiers in the initial checkpoint. `D_ADDENDUM_ACCEPTANCE.md` records the completed changes, reproduced failures and current independent evidence: backend 1,447, frontend 1,031 across 112 suites, TypeScript/lint/build exit zero, and four focused browser cases (including actual 100/200/400% zoom) passed. Final MariaDB is being rerun; the first final attempt could not start Docker and reached no tests. The source delta is separately reviewed and lies outside the original sealed security scan.
+
+Fresh deterministic interpretation/scoring is now complete for the 36 source-bound structural documents: PDF typed precision 100%, recall 81.97%, F1 90.09%; DOCX typed precision/recall/F1 100%. Both formats recovered 134/134 expected literal fragments and correctly abstained in all six designated ambiguous cases. PDF provenance is 24/27 and DOCX 27/27. PDF unresolved-source classification remains limited (16 true positives, 27 false positives, two false negatives); text recovery alone does not establish record reconstruction. Evidence: `.artifacts/pre-phase10-ux/integration-scoring-02/`, including separate frozen-split results. No generative model was invoked; synthetic corpus results do not estimate population accuracy or qualify reviewed persistence/real AI.
+
+The earlier rows below are preserved as historical evidence, not final-source results. Full ordinary/specialized browser, provider/PDF closure, local C/D activation and final handoff remain pending.
+
+## 28 October checkpoint
+
 28 October 2026. Cumulative branch `test/pre-phase10-ux-acceptance` contains A/B/C/D through source `d52403d`, test-fixture correction `4dcc07b` and security evidence `019d0aa`. This is an intermediate evidence checkpoint, not final acceptance or permission for Phase 10 implementation.
 
 The verified preceding CV-QA baseline is backend 1,336, frontend 995 in 109 suites, ordinary browser 364, specialized browser configurations 53, real MariaDB 80 and Python 76 offline plus 14 real parser tests. Historical evidence remains in `docs/cv-integration-qa/`; CV-UX commit `4a0af62` is an ancestor. The newer C/D focused evidence must not be added to overlapping full-suite counts.

docs/pre-phase10-ux/PLAN.md

@@ -24,6 +24,8 @@ No main merge, production service/database/storage/model/cache/deployment operat
 
 ## Checkpoints
 
+- [x] D-owner-addendum: actual pre-paging diagnostic filters, bounded read policy, owner/import identifiers, permitted job navigation and source-based failure times; RED/GREEN plus backend1447/frontend1031/MariaDB90/browser4/type/lint/build. See D_ADDENDUM_ACCEPTANCE.md. Final cumulative qualification remains below.
+
 - [x] P10-UX-00: read owner specification, verify latest CV-QA ancestry/remote/entry, isolate managed worktree, audit four owners and choose compatibility-first design. Create feedback register and branch plan.
 - [x] A-01: reproduce blank hydration/header/export and Strict Mode history failures in focused tests plus actual local development browser. Save RED evidence; no application fix before reproduction.
 - [x] A-02: nullable explicit inclusion flags across resolver/editor/AI/matcher, deliberate creation/profile selection, empty export validation; pure immutable grouped session history/shortcuts/epoch guards; focused unit/provider/browser and RD21 checks, review, docs, commit/push/verify. Evidence: A_ACCEPTANCE.md, backend108/frontend98/browser4/MariaDB82, TypeScript/lint0; fresh review fixes have RED/GREEN tests. Commit is the source-bearing checkpoint immediately following5d4b8f2.

docs/pre-phase10-ux/SECURITY_REVIEW.md

@@ -1,5 +1,7 @@
 # Cumulative security qualification
 
+29 October addendum: the subsequent Admin diagnostic filters, account read-rate policy, identifiers, owner-permitted job navigation and retained failure-time projection were separately reviewed against the current source. The reviewer identified a completion-time/failure-time mix-up; retained typed owner-bound failure events now supply the actual timestamp and stage, with null for unknown recovered history. Regression reproduction plus backend 1,447, frontend 1,031, real MariaDB 90 and four focused browser cases passed. No further correctness/security blocker was identified by the follow-up review. This later delta is outside the sealed scan below; it is not represented as a second sealed scan. See `D_ADDENDUM_ACCEPTANCE.md`.
+
 28 October 2026. Static frozen-diff review, not production security acceptance.
 
 Codex Security scan `9772bf28-2e7a-4061-8e31-b016e1056f1b` completed and sealed for range `4a8c907d70cbed235728f7d690b5409e72b93abe..d52403dba873a17c83cbc18f0f87d544b72bd3d2`. All 136 changed files are accounted for: 58 server/test/provider paths, 48 frontend/test/configuration paths, and 30 local operator/documentation/Python/proof paths. The compact tool inventory contained 106 paths; the remaining Git changes were reviewed explicitly. No plausible new candidates or reportable findings remained. No application execution, production access or network fetch was performed by security reviewers.