docs(qa): qualify Phase 9 regression and acceptance

2026-10-23 07:31:27 +02:00
parent 0fb108bd67
commit 8e7e3f6387
63 changed files with 64728 additions and 6835 deletions
@@ -2,7 +2,7 @@

 Status is evidence-specific. Historic acceptance records remain unchanged. A passing characterization of a known limitation does not make the limitation safe.

-**P9-V02: Medium visual defect, focused repair verified; full successor pending.** Original-detail inspection after the first complete regression found a separate bottom CTA title at `LandingPage.tsx:261`: 24/30px font inherited body1's fixed 18px line height. The extended native test retains all four h2 checks and also requires the translated CTA title; both EN/NB fail before the repair (`landing-cta-red`, exit 1). The CTA owner now specifies proportional 1.4 line height. Types/lint/build pass, native geometry passes 2/2 across 16 vectors, and original-width crops of all four EN/NB light/dark 320px green images show separated CTA lines with contained body/button/footer. All 12 old homepage originals were checked at original detail; no other ink collision was confirmed. Full rebuilt-source Jest/browser/diagnostic/contract successors remain required. Earlier 362/18/23 passes are superseded for the changed UI; backend and sidecar bytes are unchanged. [Exact source/export delta](../p9-00/cta-delta.json) retains identities.
+**P9-V02: Medium visual defect, resolved in the final rebuilt-source regression.** Original-detail inspection after the first complete regression found a separate bottom CTA title at `LandingPage.tsx:261`: 24/30px font inherited body1's fixed 18px line height. The extended native test retains all four h2 checks and also requires the translated CTA title; both EN/NB fail before the repair (`landing-cta-red`, exit 1). The CTA owner now specifies proportional 1.4 line height. Types/lint/build pass, native geometry passes 2/2 across 16 vectors, and original-width crops of all four EN/NB light/dark 320px green images show separated CTA lines with contained body/button/footer. All 12 old homepage originals were checked at original detail; no other ink collision was confirmed. Full rebuilt-source Jest 919/104 suites, ordinary 362/362, diagnostics 18/18 and contracts 23/23 passed with successful exits and strict reconciliation. Earlier 362/18/23 passes are superseded for the changed UI; backend and sidecar bytes are unchanged. [Exact source/export delta](../p9-00/cta-delta.json) retains identities.

 **P9-T03: test isolation failure (High for qualification integrity).** The original browser API fixture inherited `SavedJobSearchAlertsEnabled=true`. Its browser interception could not block server-originated provider traffic. The third shard completed with 87 passes/1 failure: the responsive discovery test's active saved search acquired `lastRunAtUtc=2026-10-23T01:04:07.2042193+00:00` instead of remaining null. The enabled worker starts after 30 seconds and its real NAV search completes before writing that timestamp. This establishes that the original fixture did not provide the intended local-only provider boundary; it is not a product regression or live-provider acceptance. Synthetic accounts/searches were used. No payload/header/token capture or further external investigation was performed.

@@ -0,0 +1,17 @@
+# P9-06 remediation and regression
+
+Final latest-source regression completed **362/362 ordinary, 18/18 diagnostics, 3/3 volume and 23/23 contracts**, with successful exits, strict reconciliation and zero failures/skips/flakiness/retries or run-level errors. Full Jest passes 919/104 suites; types/lint/build pass. P9-V02 was repaired and all UI-dependent gates repeated on its rebuilt bytes. [Validation](../validation.json) and [defects](DEFECTS.md) retain earlier failures and superseded complete runs; no incomplete successor is accepted.
+
+P9-T03 exposed server-originated NAV work outside the original browser-only interception boundary. The browser fixture now disables the existing saved-search alert worker; all four ordinary shards and inherited diagnostics passed with unchanged assertions. The earlier 98/98 and 87/87 shards and third shard's 87 pass/1 fail remain superseded. Production worker settings are unchanged. [Worker-isolation delta](../p9-00/worker-isolation-delta.json) records the configuration-only change and source identities.
+
+Two bounded product repairs were made: the sole AdminUsers grid now receives the installed Bokmål vendor locale, and the existing four public h2 styles specify a proportional line height. No backend contract, schema, renderer, dependency, state/router system or inference configuration changed. The parser descendant test synchronizes its own startup before the unchanged deadline; it does not change the parser product timeout or process-kill behavior.
+
+The existing native Admin test also needed its hard-coded English pager locator synchronized with the new vendor locale. It now obtains the accessible name from installed enUS/nbNO. Original long-identity, actual page-change, focus/reachability and no-write assertions remain. The failed97pass/1fail shard and focused six-vector1/1 green are retained; the complete98-case successor is required. Only that ordinary test file differs between the retained earlier825-input manifest and the new ordinary manifest.
+
+New regression proof includes two parameterized Admin locale Jest cases (baseline917 becomes919), two ordinary landing cases over16 geometry vectors (baseline360 becomes362),18 separate route/accessibility/RD21/performance diagnostics, and three separately isolated native API volume cases. Existing focused landing tests remain unchanged. Original RED observations, insufficient1.2 spacing, fixture mistakes, transition timing and interrupted attempts remain retained in [DEFECTS](DEFECTS.md) and raw reports; no configured retry/skip or assertion relaxation replaced them.
+
+The final ordinary protocol uses four **serial native Playwright shards**, keeping connected files together under fullyParallel=false. All four completed reports must have exit0; their362 unique IDs must exactly equal native discovery, with one actual passed result each, zero failures/skips/flakiness/retries and no run-level errors. Discovery-only not-run records are not counted as regression skips. The same825 selected source/build inputs are checked before each shard and after all contracts; supplementary volume sources are hashed separately. This changes result checkpointing after repeated runner interruption, preserving all original assertions and workflows.
+
+Separate AI/auth/rate/ingress/PDF-admission/preferences lanes retain their original configs and assertions. Native PDF admission is an inert-child limit contract, distinct from actual CV fidelity. SQLite/test-host, scoped intercepted recovery, native API persistence, image inspection and human/provider acceptance remain labelled separately. Passing the characterization of High RD21 does not close data-loss safety.
+
+Read-only AI review examined both product repairs, parser fixture synchronization, diagnostic readiness, final route images, supplementary isolation/content assertions and reporting gates. Findings led to localised mobile-preview selection, actual theme checks, settled pagination/drawer checks, ready Profile/Reminders captures, exact timeline content comparison and complete diagnostic/discovery gates. [Final acceptance](../p9-07/FINAL_ACCEPTANCE.md) records decisions and uncompleted gates; no review is described as human or production acceptance.
@@ -0,0 +1,41 @@
+[
+  {
+    "id": "8c0c9ecd34e57cee381c-1dea0c2574f64b68b116",
+    "project": "",
+    "file": "cv-ai-readiness.spec.ts",
+    "title": "bound CV proposals use real owned saves and reject fabricated or stale output without source/history mutation",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 1283,
+        "errors": [],
+        "attachments": [
+          {
+            "name": "synthetic-provider-contract-calls",
+            "contentType": "application/json",
+            "bytes": 8638,
+            "sha256": "4272f7694531b4c08796faefc247722e1a2ee2a07750a004233b1eb738d13249"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "8c0c9ecd34e57cee381c-c2d35f5e57184c5e7786",
+    "project": "",
+    "file": "cv-ai-readiness.spec.ts",
+    "title": "Production withholds CV review before provider calls or content writes while existing AI remains available",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 686,
+        "errors": [],
+        "attachments": []
+      }
+    ]
+  }
+]
@@ -0,0 +1,41 @@
+[
+  {
+    "id": "d7599fc2c2391460bfd0-9d7d9f44d8dd91087b94",
+    "project": "chromium",
+    "file": "auth-recovery.spec.ts",
+    "title": "[PRES-E02] incomplete recovery links explain the problem without submitting tokens",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 8134,
+        "errors": [],
+        "attachments": []
+      }
+    ]
+  },
+  {
+    "id": "d7599fc2c2391460bfd0-d746f9d614c710b3f0f7",
+    "project": "chromium",
+    "file": "auth-recovery.spec.ts",
+    "title": "[PRES-E02 PRES-E05 PRES-E09] real registration, SMTP verification and password recovery preserve protected return and revoke the old session",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 4795,
+        "errors": [],
+        "attachments": [
+          {
+            "name": "verified-recovery-complete",
+            "contentType": "image/png",
+            "bytes": 58743,
+            "sha256": "3f3fe80aa1114e533423e734cde8ee731b7e50b2dcc2232ba5507e648d685d43"
+          }
+        ]
+      }
+    ]
+  }
+]
@@ -0,0 +1,98 @@
+[
+  {
+    "id": "ed69554c53210704c98c-aa6114ab653335b0849c",
+    "project": "",
+    "file": "production.spec.ts",
+    "title": "unsafe production CORS overrides fail before the API starts listening",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 316,
+        "errors": [],
+        "attachments": []
+      }
+    ]
+  },
+  {
+    "id": "ed69554c53210704c98c-b5aa0dee57975d249ef8",
+    "project": "",
+    "file": "production.spec.ts",
+    "title": "production CORS defaults to the canonical origin, never localhost or arbitrary origins",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 54,
+        "errors": [],
+        "attachments": []
+      }
+    ]
+  },
+  {
+    "id": "ed69554c53210704c98c-f08f9970acd7897ea78b",
+    "project": "",
+    "file": "production.spec.ts",
+    "title": "forwarded host cannot replace Host and internal liveness does not expose other routes",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 19,
+        "errors": [],
+        "attachments": []
+      }
+    ]
+  },
+  {
+    "id": "ed69554c53210704c98c-a22e20df1ecd17804b5c",
+    "project": "",
+    "file": "production.spec.ts",
+    "title": "forged forwarding scheme cannot downgrade canonical HTTPS cookie security",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 19,
+        "errors": [],
+        "attachments": []
+      }
+    ]
+  },
+  {
+    "id": "ed69554c53210704c98c-1cbee69d1531ff47c6ff",
+    "project": "",
+    "file": "production.spec.ts",
+    "title": "untrusted direct source cannot reset its IP allowance using IP, scheme or host forwarding",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 68,
+        "errors": [],
+        "attachments": []
+      }
+    ]
+  },
+  {
+    "id": "ed69554c53210704c98c-3f2473964eebe1793601",
+    "project": "",
+    "file": "production.spec.ts",
+    "title": "trusted proxy gives two real clients independent IP allowances and ignores leftmost extra hops",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 30,
+        "errors": [],
+        "attachments": []
+      }
+    ]
+  }
+]
@@ -0,0 +1,25 @@
+[
+  {
+    "id": "57651d46c5b669da1368-ce86a9d6459ea6ed64a0",
+    "project": "",
+    "file": "admission.spec.ts",
+    "title": "authenticated bursts across variant, job and public routes share actual render capacity and recover",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 1825,
+        "errors": [],
+        "attachments": [
+          {
+            "name": "bounded-admission-observations",
+            "contentType": "application/json",
+            "bytes": 183,
+            "sha256": "aef6250c4f3779a00826e9d50959e80a8e4af63bc6adf77a48c04c94be7a0de0"
+          }
+        ]
+      }
+    ]
+  }
+]
@@ -0,0 +1,155 @@
+[
+  {
+    "id": "14778efd97370ce75a77-800209363045a0fecbb1",
+    "project": "chromium",
+    "file": "preferences.spec.ts",
+    "title": "[P5-15-01 diagnostic] an unsaved Rules draft survives switching to Notifications and back",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 1835,
+        "errors": [],
+        "attachments": [
+          {
+            "name": "unsaved-rule-tab-retention",
+            "contentType": "application/json",
+            "bytes": 95,
+            "sha256": "fec5c1c4c27d82d0b94fea7003a101df101fbbe3ed5b97242feee92729f0c68b"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "14778efd97370ce75a77-3886d34583c00e75099c",
+    "project": "chromium",
+    "file": "preferences.spec.ts",
+    "title": "[P5-15-01 diagnostic] native language and notification saves persist during concurrent report reads",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 9425,
+        "errors": [],
+        "attachments": [
+          {
+            "name": "preference-round-1",
+            "contentType": "application/json",
+            "bytes": 679,
+            "sha256": "476ad3e78c2c7ef74a3bf4e022fb218039e76600882d56d255f92c4acef12eda"
+          },
+          {
+            "name": "preference-round-2",
+            "contentType": "application/json",
+            "bytes": 668,
+            "sha256": "42b0dbfa0477e9341a496a7f243f870ca308d6c86439325b67d2b08aa32151af"
+          },
+          {
+            "name": "preference-round-3",
+            "contentType": "application/json",
+            "bytes": 679,
+            "sha256": "476ad3e78c2c7ef74a3bf4e022fb218039e76600882d56d255f92c4acef12eda"
+          },
+          {
+            "name": "preference-round-4",
+            "contentType": "application/json",
+            "bytes": 668,
+            "sha256": "42b0dbfa0477e9341a496a7f243f870ca308d6c86439325b67d2b08aa32151af"
+          },
+          {
+            "name": "preference-round-5",
+            "contentType": "application/json",
+            "bytes": 679,
+            "sha256": "476ad3e78c2c7ef74a3bf4e022fb218039e76600882d56d255f92c4acef12eda"
+          },
+          {
+            "name": "preference-round-6",
+            "contentType": "application/json",
+            "bytes": 668,
+            "sha256": "42b0dbfa0477e9341a496a7f243f870ca308d6c86439325b67d2b08aa32151af"
+          },
+          {
+            "name": "preference-round-7",
+            "contentType": "application/json",
+            "bytes": 679,
+            "sha256": "476ad3e78c2c7ef74a3bf4e022fb218039e76600882d56d255f92c4acef12eda"
+          },
+          {
+            "name": "preference-round-8",
+            "contentType": "application/json",
+            "bytes": 668,
+            "sha256": "42b0dbfa0477e9341a496a7f243f870ca308d6c86439325b67d2b08aa32151af"
+          },
+          {
+            "name": "preference-round-9",
+            "contentType": "application/json",
+            "bytes": 679,
+            "sha256": "476ad3e78c2c7ef74a3bf4e022fb218039e76600882d56d255f92c4acef12eda"
+          },
+          {
+            "name": "preference-round-10",
+            "contentType": "application/json",
+            "bytes": 668,
+            "sha256": "42b0dbfa0477e9341a496a7f243f870ca308d6c86439325b67d2b08aa32151af"
+          },
+          {
+            "name": "preference-round-11",
+            "contentType": "application/json",
+            "bytes": 679,
+            "sha256": "476ad3e78c2c7ef74a3bf4e022fb218039e76600882d56d255f92c4acef12eda"
+          },
+          {
+            "name": "preference-round-12",
+            "contentType": "application/json",
+            "bytes": 668,
+            "sha256": "42b0dbfa0477e9341a496a7f243f870ca308d6c86439325b67d2b08aa32151af"
+          },
+          {
+            "name": "native-preference-concurrency",
+            "contentType": "application/json",
+            "bytes": 8948,
+            "sha256": "0f998f18a4cda0f4631fd98284ae324fad3cb755fc349fb0b30fb4b5ba2e8486"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "14778efd97370ce75a77-e7315ff91caea6ab494f",
+    "project": "chromium",
+    "file": "preferences.spec.ts",
+    "title": "[P5-15-04 PRES-J07 J05] native full-result Board retains membership at 200 and 1000 owned jobs",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 11426,
+        "errors": [],
+        "attachments": [
+          {
+            "name": "board-200-native-membership",
+            "contentType": "application/json",
+            "bytes": 83,
+            "sha256": "8290fd60d7f731bd334499528b730b44665e2470ad4af7585f3ac18ffd5a509e"
+          },
+          {
+            "name": "board-1000-native-membership",
+            "contentType": "application/json",
+            "bytes": 86,
+            "sha256": "3cf751d7ac4e6fdd70fd5d8060ea893b639be9854545d2ad680207f93e083bde"
+          },
+          {
+            "name": "board-full-result-scaling",
+            "contentType": "application/json",
+            "bytes": 341,
+            "sha256": "38daa07d10e4e4b5d4b72af37fb2719429bbbb516a50120e84f27512a262eb79"
+          }
+        ]
+      }
+    ]
+  }
+]
@@ -0,0 +1,167 @@
+[
+  {
+    "id": "8603831629f4016ade15-413cabef86db688c278c",
+    "project": "",
+    "file": "isolation.spec.ts",
+    "title": "A exhausting account exports does not throttle the other account on the same IP",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 1004,
+        "errors": [],
+        "attachments": [
+          {
+            "name": "shared-ip-observations",
+            "contentType": "application/json",
+            "bytes": 97,
+            "sha256": "86f18a98252d8729d284e256c7866f691142a4499c63c219b29862801d7abf2b"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "8603831629f4016ade15-6e8127441d833b255ecf",
+    "project": "",
+    "file": "isolation.spec.ts",
+    "title": "B exhausting account exports does not throttle the other account on the same IP",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 429,
+        "errors": [],
+        "attachments": [
+          {
+            "name": "shared-ip-observations",
+            "contentType": "application/json",
+            "bytes": 97,
+            "sha256": "21ec24c560fef21dc2db56fd0379bbf9bca456afaab87331a434ea5bf9deb7fe"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "8603831629f4016ade15-44049b89f2ba8cc90dba",
+    "project": "",
+    "file": "isolation.spec.ts",
+    "title": "concurrent accounts share an IP while sessions, bearer/cookie and changed IPs share each owner's allowance",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 518,
+        "errors": [],
+        "attachments": [
+          {
+            "name": "concurrent-session-observations",
+            "contentType": "application/json",
+            "bytes": 169,
+            "sha256": "f33ee7fd2efc820e35e7b330f8f25c72bc270f6052f10e1eb58000a0e0044aa3"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "id": "8603831629f4016ade15-3c3251aa8da3c416b606",
+    "project": "",
+    "file": "isolation.spec.ts",
+    "title": "crafted body/query/headers and B02 context cannot select the email-send owner",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 388,
+        "errors": [],
+        "attachments": []
+      }
+    ]
+  },
+  {
+    "id": "8603831629f4016ade15-ac269e0e7d56b610a971",
+    "project": "",
+    "file": "isolation.spec.ts",
+    "title": "export and disabled deletion consume the same account-data policy without affecting another account",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 369,
+        "errors": [],
+        "attachments": []
+      }
+    ]
+  },
+  {
+    "id": "8603831629f4016ade15-97ade2f9efed92c59d4c",
+    "project": "",
+    "file": "isolation.spec.ts",
+    "title": "invalid credentials are rejected before account partitioning and cannot select anonymous login partitions",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 565,
+        "errors": [],
+        "attachments": []
+      }
+    ]
+  },
+  {
+    "id": "8603831629f4016ade15-b138c1b57d0d85148feb",
+    "project": "",
+    "file": "isolation.spec.ts",
+    "title": "login/security policies remain IP based for authenticated and anonymous requests",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 362,
+        "errors": [],
+        "attachments": []
+      }
+    ]
+  },
+  {
+    "id": "8603831629f4016ade15-9143f2e1b30e6be99490",
+    "project": "",
+    "file": "isolation.spec.ts",
+    "title": "public PDF remains IP plus slug scoped even after authentication",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 317,
+        "errors": [],
+        "attachments": []
+      }
+    ]
+  },
+  {
+    "id": "8603831629f4016ade15-dcf8adf118fda6bb2506",
+    "project": "",
+    "file": "isolation.spec.ts",
+    "title": "untrusted direct peers cannot evade IP limits with forged forwarding headers",
+    "status": "expected",
+    "results": [
+      {
+        "status": "passed",
+        "retry": 0,
+        "durationMs": 19,
+        "errors": [],
+        "attachments": []
+      }
+    ]
+  }
+]