docs(cv): record durable processing evidence

docs/work-programmes/session-handoff.md

@@ -2,17 +2,17 @@
 
 Updated: 2026-08-09
 
-- **Exact current task:** AI-004 — design the smallest `cv.process` bridge from persistent `CvExtractionRun` domain state into AI-001 operations, then migrate synchronous upload without weakening parser limits or the human review gate.
-- **Last completed step:** complete initial AI-004 execution trace (V-104). Upload saves an artifact/run and performs extraction, reconstruction, classification/normalization and structured parsing synchronously before returning. Reprocess/rebuild/improve already return 202 with persistent run IDs, but wake an unbounded process-local channel; startup scans queued/running runs. They lack centralized operation admission, cancellation/deadline/retry/provenance and generic persistent notifications.
-- **Files currently modified:** none after the AI-004 trace tracking commit. Preserve any new user edits discovered on resume.
-- **Commands already run:** AI-003 source tracing/build/focused/full tests/frontend build/diff/commits (V-101–V-103); AI-004 bounded controller/partial/queue/model/UI/proxy/registration trace (V-104).
-- **Test results:** backend 592/592; AI-003 focused backend 34/34; frontend 47/47 suites and 160/160 tests; AI-003 UI 6/6; production frontend build and diff check pass. Fake model/synthetic data only.
+- **Exact current task:** UX-001 — replace `LoginPage` local/Google/Microsoft tabs with one accessible sign-in card while preserving the hardened provider callbacks and separate registration behavior.
+- **Last completed step:** AI-004 implementation `c3c5af8` was committed and pushed. Upload/reprocess/rebuild/improve now use one durable `cv.process` operation; duplicate active work is reused; provider failure state, persistent notifications, review gate and operation UI are covered. UX-001 source requirements were re-read and the current separate-tab/provider-card path was located.
+- **Files currently modified:** tracking/evidence documents for AI-004 and the UX-001 status transition. No UX application code is modified yet.
+- **Commands already run:** initial clean-tree review and push through `39e9804`; AI-004 source trace; local-cache-only restore; backend builds/focused/full tests; focused/full frontend tests/build; diff review; implementation commit/push; UX-001 source/route trace. See V-104–V-107.
+- **Test results:** backend 594/594; AI-004 focused backend 40/40; frontend 47/47 suites and 161/161 tests; profile UI 10/10; production frontend build and diff check pass. Synthetic CV/fake model only.
 - **Services currently running:** none started by this session. Node/Jest/build processes exited. Pre-existing Docker services were not changed.
 - **Temporary files or processes:** none created for AI-004. No dependency declaration, database or artifact was changed.
 - **Production changes currently active:** none. No deployment, provider/model call, private CV access, model pull, paid service, production migration or external payload occurred.
-- **Rollback status:** AI-003 rollback is documented in `docs/verification/ai-003-strategy-snapshot-queue.md`; AI-004 has no code to roll back yet. Worker switches remain default-off.
-- **Uncommitted changes:** none expected after the AI-004 trace tracking commit. Confirm with `git status --short --branch`.
-- **Known failures:** browser localhost denied; MariaDB/SMTP/production unavailable; SEC-006 upgrades require explicit internet/package-index permission; historical clean EF-only SQLite chain needs startup reconciliation; Jest reports its existing force-exit/open-handle notice. AI-004 live 504 and restart behavior are not claimed.
-- **Exact next action:** specify the typed `cv.process` subject/idempotency contract and change `ProcessQueuedRunAsync` to return/throw a classified result suitable for `IAiOperationHandler`; then make upload persist a queued run and return 202. Keep `CvExtractionRun` as review/result domain state and `UserOperation` as orchestration state—no raw CV payload or second CV queue.
-- **Work that can continue independently:** repository-only AI-004 producer/handler work with synthetic files/fake parser/provider; frontend durable-state tests; existing parser-limit tests. SEC-006/007 await package-index permission; PROD-001/003/004 await production access.
+- **Rollback status:** AI-004 rollback is documented in `docs/verification/ai-004-cv-processing-queue.md`; worker switches remain default-off. Production is unchanged.
+- **Uncommitted changes:** AI-004 evidence/master tracking status updates only; commit and push them before UX code.
+- **Known failures:** browser localhost denied; MariaDB/SMTP/production unavailable; SEC-006 upgrades require explicit internet/package-index permission; complete parser cancellation/isolation remains SEC-007; historical clean EF-only SQLite chain needs startup reconciliation; Jest reports its existing force-exit/open-handle notice. Live CV 504/restart/private-file behavior is not claimed.
+- **Exact next action:** read `LoginPage.tsx`, `GoogleAuthCard.tsx`, `MicrosoftAuthCard.tsx` and `login-page.test.tsx` completely; isolate sign-in-only button rendering from profile linking controls; replace tabs with one form/separator/two alternative buttons and add invalid/provider cancel/return/accessibility component tests.
+- **Work that can continue independently:** UX-001 repository UI/tests; then UX-002/QA-001 source work. SEC-006/007 await package-index permission; PROD-001/003/004 await production access.
 - **Decisions still required from the user:** none for synthetic repository work. Internet/package upgrades, private CV access, external/paid providers and production actions retain their explicit approval/safety gates; SEC-009 retention/legal policy remains unresolved.