test: align career workspace smoke

docs/audits/verification-log.md

@@ -172,3 +172,4 @@ Output was reduced to filenames and commit counts. The token artifact appears un
 | V-138 | Focused `JobApplicationsFollowUpDraftTests|BackgroundWorkerTenantTests`; focused follow-up/trust-loop Jest; full backend/frontend; production build; `npm.cmd audit`; staged diff review | Repository root / `job-tracker-ui` | Verify legacy direct SMTP retirement while preserving draft generation, scheduled reminders and the provider-confirmed Job email boundary | PASS — focused backend 10/10 and UI 2/2; full backend 621/621 and frontend 49/49 suites, 190/190 tests; build and audit pass; legacy action returns 410 with no SMTP dependency; `8fe3903` pushed | JSDOM/fake services only; no provider/email/browser/production execution. Remote CI/live confirmation remains | External/deployment limitation |
 | V-139 | Focused `BackupControllerTests|BackgroundWorkerTenantTests|EmailSendAttemptStoreTests`; full backend; staged diff/secret/content-field review | Repository root | Verify owner-readable content-free send-attempt exports and hard-job-delete cascade isolation | PASS — focused 16/16; full backend 622/622; encrypted and daily exports include one owner attempt without payload hash; real SQLite deletes only the target job's attempt; `aff34cc` pushed | Complete account deletion/files/backups/retention remain SEC-009; no production export or deletion occurred | Deliberately bounded lifecycle increment |
 | V-140 | Running local API/frontend plus in-app browser at `/correspondence` and `/correspondence/review`; DOM/URL/layout/server-log inspection; screenshots | Local development environment | Verify authenticated empty Job email, disconnected capability states, view navigation and compatibility redirect in a real browser | PASS/PARTIAL — linked view and review view render; provider states are explicit; direct legacy route canonicalizes to `?view=review`; 1280×720 document width equals viewport; expected disconnected Gmail 409s are handled without 5xx; screenshots saved | Disposable local account/database only. No provider/send. Browser could not resize or dispatch native Tab traversal, so required widths/themes/keyboard and production remain blocked | Browser/tool/provider limitation |
+| V-141 | Gitea commit status and public run 608 log inspection; focused `e2e/smoke.spec.ts` assertion review; `npm run test:e2e`; `git diff --check` | Repository root / `job-tracker-ui` | Verify the reported deployment audit remediation remotely and correct the next evidence-backed CI failure | PASS/PARTIAL — remote `Audit frontend dependencies` passes; CI advanced to browser smoke and failed only because Career Workspace expected removed copy. The assertion now checks the stable `Open CV Builder` route; local Playwright passes 4/4 | Replacement pull-request CI and merge-to-main live deploy remain pending; no production action occurred | Remote CI partially verified; live pending |

docs/verification/dep-001-frontend-advisories.md

@@ -2,7 +2,7 @@
 
 Updated: 2026-08-10
 
-Status: `VERIFIED LOCALLY`. The repository fix is pushed; CI and live deployment verification remain.
+Status: `VERIFIED LOCALLY`. Remote run 608 confirms the dependency-audit step passes; the pull-request job then failed on an unrelated stale Career Workspace smoke assertion. Live deployment still requires merge-to-main and production verification.
 
 ## Trigger
 
@@ -24,10 +24,12 @@ The live deployment pipeline failed its frontend dependency audit on five adviso
 - `npm.cmd run build`: PASS, production compilation, TypeScript and static generation.
 - Resolved versions: `react-router-dom`/`react-router` `7.18.2`, `js-yaml` `3.15.1`, `nanoid` `3.3.18`.
 - Commit: `b55a592` (pushed to `release-readiness`).
+- Gitea pull-request run 608: `Audit frontend dependencies` PASS; the job advanced through frontend tests and failed later at `Test browser smoke flows` because `e2e/smoke.spec.ts` still expected intentionally removed page copy.
+- Corrected smoke assertion: full local Playwright suite 4/4 passed against disposable local API/frontend data.
 
 ## Remaining gate
 
-Confirm the repository CI dependency-audit job and subsequent live deployment complete from the pushed commit. No production access or deployment was performed in this session.
+Confirm a new pull-request run passes end to end, then merge/deploy from `main` and run production route smoke. No production access or deployment was performed in this session.
 
 ## Rollback
 

docs/work-programmes/decisions.md

@@ -479,3 +479,13 @@
 - **Consequences:** export schemas gain an additive `EmailSendAttempts` collection. Complete account/database/file/token/backup deletion remains an explicit SEC-009 release item rather than hidden in MAIL-001.
 - **User approval required:** No; this is the approved MAIL-001 export/cascade requirement using synthetic local data only.
 - **Reversible:** Yes. Revert `aff34cc`; no schema or stored data changes. Existing export files remain valid historical artifacts under their configured retention.
+
+## DEC-049 — Keep Career Workspace smoke behavior-based
+
+- **Date:** 2026-08-10
+- **Decision:** Replace the removed marketing-copy assertion in the Career Workspace Playwright smoke with an assertion that the visible `Open CV Builder` action targets `/career/builder`.
+- **Reason/evidence:** Gitea run 608 proves the dependency audit now passes and the page heading renders, but CI fails on copy that the current unit test explicitly expects to be absent. The route action is always rendered and tests the supported user journey. Full local Playwright passes 4/4.
+- **Alternatives considered:** restore obsolete copy solely for the test; weaken the smoke to heading-only; increase timeout. These would contradict current product behavior, reduce journey coverage or hide no timing defect.
+- **Consequences:** wording can evolve without breaking CI while the page-to-builder navigation contract remains protected. Replacement CI and live deployment verification are still required.
+- **User approval required:** No; this is a focused correction to a stale test exposed by the user-authorized deployment repair.
+- **Reversible:** Yes. Revert the focused smoke change, though run 608 would fail again until the expectation or page behavior is reconciled.

docs/work-programmes/master-progress.md

@@ -2,18 +2,18 @@
 
 Updated: 2026-08-10
 
-- **Overall programme status:** Active. Seven packages are locally verified; nineteen packages through CAREER-002 are implemented with automated/runtime evidence but blocked from applicable browser/provider/production gates; MAIL-001 is in progress with ten committed implementation increments. DEP-001 removed the frontend advisory deployment gate locally and is pushed for CI/live verification.
+- **Overall programme status:** Active. Seven packages are locally verified; nineteen packages through CAREER-002 are implemented with automated/runtime evidence but blocked from applicable browser/provider/production gates; MAIL-001 is in progress with ten committed implementation increments. Gitea run 608 confirms DEP-001 cleared the remote dependency audit; its later stale Career Workspace smoke assertion is corrected locally (4/4 Playwright) and awaits replacement CI.
 - **Current work package:** `MAIL-001` — consolidated job-email hub and explicit sending (`IN PROGRESS`); routing/reads/detail, ledger, Gmail/Graph delivery/re-consent, safe send API/UI, recovery, legacy SMTP retirement and content-free export/job-cascade coverage are committed. Local empty/disconnected and legacy-route browser smoke passes partially. Shared provider actions/capability behavior is next; full account deletion stays SEC-009.
 - **Completed work packages:** None are `DONE`; all repository security/AI packages still have applicable browser, provider and/or production gates.
 - **Locally verified work:** SEC-001, SEC-002, SEC-003, SEC-005A, CORE-001, PROD-002 and DEP-001 (`VERIFIED LOCALLY`).
 - **Implemented, verification incomplete:** SEC-004, SEC-005B, SEC-008, CORE-002, BG-001, OPS-001A/B/C, POL-001/002, AI-001/002/003/004, UX-001/002, QA-001, CAREER-001 and CAREER-002 (`IMPLEMENTED — NOT VERIFIED`). CAREER-002 now protects unsaved edits and provides tested structured custom-entry, profile-override and preview-error interactions; all automated/build gates pass.
 - **Production-verified work:** None.
-- **Blocked work:** SEC-006 parser upgrades remain outside the scoped frontend advisory permission; PROD-001/003/004 and REL-001 require documented production access and unfinished dependencies. Real provider, SMTP/MariaDB and production environments are unavailable; DEP-001 awaits CI/live confirmation. The in-app browser is available for local UI checks.
+- **Blocked work:** SEC-006 parser upgrades remain outside the scoped frontend advisory permission; PROD-001/003/004 and REL-001 require documented production access and unfinished dependencies. Real provider, SMTP/MariaDB and production environments are unavailable; DEP-001 awaits replacement CI plus live verification. The in-app browser is available for local UI checks.
 - **Deferred work:** None. Conditional multi-replica coordination, model deletion, realtime operation delivery and unrelated production changes remain outside current packages.
 - **Next five work packages:** MAIL-001 consolidated email experience; JOBS-001 job-search/application redesign; HOME-001 homepage/Pro promotion; UX-003 authentication/profile polish; PRODUCT-001 homepage/Pro claims. SEC-006/007 resume after package-index permission.
 - **Status counts:** 7 `VERIFIED LOCALLY`; 19 `IMPLEMENTED — NOT VERIFIED`; 1 `IN PROGRESS`; 8 `NOT STARTED`; 5 `BLOCKED`; 0 `DONE`; 0 `DEFERRED`.
-- **Test status:** backend 622/622; frontend 49/49 suites and 190/190 tests; npm audit 0 vulnerabilities; DEP-001 focused router 24/24 and production build pass; MAIL-001 export/cascade 16/16, recovery/send 10/10, legacy follow-up/backend worker 10/10, legacy UI 2/2, composer 7/7, delivery/capability 18/18, provider/correspondence 5/5 and hub detail 5/5. Jest open-handle/slow-run behavior is recorded in V-127/V-128/V-130/V-131/V-135.
-- **Deployment status:** `b55a592` is pushed to remove the frontend audit blocker; remote CI/live result is pending. No deployment was performed directly, no production migrations were run and the AI operation worker remains disabled by default.
+- **Test status:** backend 622/622; frontend 49/49 suites and 190/190 tests; Playwright smoke 4/4; npm audit 0 vulnerabilities; DEP-001 focused router 24/24 and production build pass; MAIL-001 export/cascade 16/16, recovery/send 10/10, legacy follow-up/backend worker 10/10, legacy UI 2/2, composer 7/7, delivery/capability 18/18, provider/correspondence 5/5 and hub detail 5/5. Jest open-handle/slow-run behavior is recorded in V-127/V-128/V-130/V-131/V-135.
+- **Deployment status:** Gitea pull-request run 608 passed `Audit frontend dependencies`, then failed at the stale Career Workspace Playwright assertion. The assertion fix passes 4/4 locally and is being pushed for replacement CI. Deploy runs only on `main`, so live remains unchanged. No deployment was performed directly, no production migrations were run and the AI operation worker remains disabled by default.
 - **Production status:** Unchanged and unverified. No provider/model call, model pull, external request or paid API occurred.
 - **Known regressions:** None found by automated/local browser checks. Jest still needs `--forceExit` and reports its existing open-handle notice. Email-provider/send tests are fake/local only; real delivery is not claimed. Current MAIL browser evidence is 1280×720 only because the browser surface could not resize or perform native Tab traversal. Interrupted attempts are aged after 15 minutes and notified without retry; the five-minute scan is unmeasured on a large ledger. Direct clean EF-only SQLite migration still hits the pre-existing historical blank-chain defect before later migrations; normal startup owns reconciliation. Cross-feature monthly AI usage accounting remains a rollout gap.
 - **Outstanding security findings:** JT-001 repository ownership remains High deployment risk until migration/inventory/provider checks; production portion of JT-002; JT-006/JT-009 and associated JT-011/JT-012/JT-022 prerequisites. JT-005 foundations are implemented; AI worker activation awaits controlled rollout. JT-007/JT-008/JT-010 lack browser/provider/production verification.

docs/work-programmes/master-work-plan.md

@@ -759,9 +759,9 @@ Ordering differences from the suggested list:
 - **Required production verification:** CI audit and live deployment from the fixed commit.
 - **Status:** `VERIFIED LOCALLY`.
 - **Blocker:** final deployment verification depends on the remote CI/live environment.
-- **Evidence:** `docs/verification/dep-001-frontend-advisories.md`; V-137; audit 0 vulnerabilities, focused 24/24, full 190/190 and production build pass.
+- **Evidence:** `docs/verification/dep-001-frontend-advisories.md`; V-137/V-141; audit 0 vulnerabilities, focused 24/24, full 190/190 and production build pass; Gitea run 608 passed the dependency audit and exposed an unrelated stale browser assertion, corrected with local Playwright 4/4.
 - **Commit:** `b55a592` (pushed).
-- **Remaining work:** observe CI/live deployment, run route smoke and update to `DONE` only after production verification.
+- **Remaining work:** observe the replacement CI run, merge/deploy from `main`, run production route smoke and update to `DONE` only after production verification.
 
 ### REL-001 — Production validation and remaining audit closure
 

docs/work-programmes/session-handoff.md

@@ -3,16 +3,16 @@
 Updated: 2026-08-10
 
 - **Exact current task:** MAIL-001 — trace shared provider-neutral thread/application actions and implement only capabilities the existing providers can safely support.
-- **Last completed step:** content-free send-attempt export and hard-job-delete cascade coverage was committed/pushed as `aff34cc`; encrypted/daily exports exclude the internal payload hash and two-owner tests pass.
-- **Files currently modified:** MAIL-001 browser evidence/tracking only; application/dependency changes are committed.
-- **Commands already run:** dependency tree/advisory review; `npm audit`; router/full frontend/build; legacy follow-up/backend worker/UI; export/backup/daily worker/cascade focused tests; full backend. See V-126–V-139.
-- **Test results:** npm audit 0 vulnerabilities; router focused 24/24; frontend 49/49 suites and 190/190 tests; production build passes. MAIL-001 export/cascade focused 16/16, legacy follow-up/backend worker 10/10, legacy UI 2/2 and full backend 622/622 pass.
-- **Services currently running:** task-owned local API session 92840 on 5202 and Next dev session 30156 on 3000 for MAIL-001 browser evidence. Stop both before handoff. Pre-existing Docker services were not changed.
+- **Last completed step:** inspected public Gitea run 608 logs: the dependency audit passes remotely, while the job failed later on stale Career Workspace copy. Replaced that assertion with the stable CV Builder route action; full local Playwright passes 4/4.
+- **Files currently modified:** the focused Playwright assertion plus DEP-001/progress/verification/decision tracking; no unrelated files.
+- **Commands already run:** dependency tree/advisory review; `npm audit`; router/full frontend/build; legacy follow-up/backend worker/UI; export/backup/daily worker/cascade focused tests; full backend; Gitea status/log inspection; full `npm run test:e2e`. See V-126–V-141.
+- **Test results:** npm audit 0 vulnerabilities; remote dependency-audit step PASS; router focused 24/24; frontend 49/49 suites and 190/190 tests; Playwright 4/4; production build passes. MAIL-001 export/cascade focused 16/16, legacy follow-up/backend worker 10/10, legacy UI 2/2 and full backend 622/622 pass.
+- **Services currently running:** none on task-owned ports 3000/5202. Playwright stopped its disposable API/Next servers. Pre-existing Docker services were not changed.
 - **Temporary files or processes:** disposable local user `audit-mail-20260810@example.test`, its local session, two synthetic screenshots and a startup-created local database backup. The API applied already-committed pending development migrations to the local development database. No provider account, real email, private content, paid service or production service was accessed.
 - **Production changes currently active:** none. No deployment, migration, provider connection/sync/send or production payload occurred.
 - **Rollback status:** revert `ee5ef7e` to stop recovery, then `449faeb` to remove the composer; keep admission disabled before reverting `123fc55`/`e9937ac` and downgrade the ledger before reverting `653f011`. No production migration/deploy/provider grant occurred.
-- **Uncommitted changes:** MAIL-001 browser screenshots/evidence/tracking only; commit/push, then stop task-owned services before the next application increment.
-- **Known failures:** durable/new-message drafts, export coverage, full thread/category actions and non-Gmail review remain; existing accounts need re-consent and IMAP stays read-only. Browser/provider/MariaDB/production unavailable or unverified; recovery scan performance is unmeasured at large ledger scale; Jest open handles; SEC-006 parser dependency work is still separately gated; parser isolation remains SEC-007. DEP-001 still needs remote CI/live confirmation.
-- **Exact next action:** commit/push V-139 tracking, then inventory Gmail/Graph/IMAP read/unread/archive/pin/read-later/spam/trash contracts and job-workspace embedding. Do not invent unsupported cross-provider actions; expose capability differences and reuse the canonical detail/link domain.
+- **Uncommitted changes:** focused CI smoke assertion and its tracking only; review, commit and push as one deployment-fix package.
+- **Known failures:** replacement CI and live deployment are not yet verified. Durable/new-message drafts, full thread/category actions and non-Gmail review remain; existing accounts need re-consent and IMAP stays read-only. Browser/provider/MariaDB/production unavailable or unverified; recovery scan performance is unmeasured at large ledger scale; Jest open handles; SEC-006 parser dependency work is still separately gated; parser isolation remains SEC-007.
+- **Exact next action:** commit/push the Career Workspace smoke correction, observe replacement CI, then inventory Gmail/Graph/IMAP read/unread/archive/pin/read-later/spam/trash contracts and job-workspace embedding. Do not invent unsupported cross-provider actions; expose capability differences and reuse the canonical detail/link domain.
 - **Work that can continue independently:** remaining MAIL-001 repository work and later UX packages. SEC-006/007 await package-index permission; PROD-001/003/004 await production access.
 - **Decisions still required from the user:** none for synthetic/code-inspected repository work. Any provider connection or send test, internet/package upgrades, private data, external/paid providers and production actions retain explicit approval/safety gates; SEC-009 retention/legal policy remains unresolved.

job-tracker-ui/e2e/smoke.spec.ts

@@ -49,7 +49,7 @@ test("Career Workspace loads from the authenticated application shell", async ({
   await login(page);
   await page.goto("/career");
   await expect(page.getByRole("heading", { name: "Career Workspace" })).toBeVisible();
-  await expect(page.getByText(/job-specific CVs stay separate/i)).toBeVisible();
+  await expect(page.getByRole("link", { name: "Open CV Builder" })).toHaveAttribute("href", "/career/builder");
 });
 
 test("a public CV renders anonymously and downloads as PDF", async ({ page }) => {