feat(plans): publish honest Free and Pro

docs/work-programmes/decisions.md

@@ -719,3 +719,13 @@
 - **Consequences:** public browser viewing preserves the same A4 layout used by PDF/export while fitting narrow screens; multi-page content reserves its scaled height. PDF output is unchanged.
 - **User approval required:** No; this is a requested responsive/accessibility correction without schema, dependency or production change.
 - **Reversible:** Revert the `PublicCvPage` frame wrapper; no stored data changed.
+
+## DEC-073 — Keep public plan copy capability-based and checkout-owned
+
+- **Date:** 2026-08-15
+- **Decision:** Publish exactly Free and Pro from one frontend capability catalogue, keep `AccountPlans` authoritative for enforcement, and let configured Stripe Checkout own price, interval and any trial terms. Reuse one dismissible contextual Pro notice rather than scattering promotional Alert implementations.
+- **Reason/evidence:** the homepage advertised three tiers, fixed prices, Free AI and unlimited AI while the server allowed only Free-without-AI and finite Pro entitlements. Central copy and conditional billing actions remove that contradiction without changing secure server policy.
+- **Alternatives considered:** hardcode the current Stripe price; query Stripe anonymously; retain a speculative BYOK tier; show an upgrade button when billing is unavailable; interrupt Free users with repeated dialogs. These leak/change commercial ownership, create false actions or use dark patterns.
+- **Consequences:** public claims stay stable across deployment-specific commercial configuration; Free users see honest locked states and retain manual/existing content; checkout terms remain inspectable at the payment boundary.
+- **User approval required:** No; this implements the approved master-plan requirement without external billing action.
+- **Reversible:** Revert the PRODUCT-001 presentation commit. Server entitlement and stored billing state are unchanged.

docs/work-programmes/master-progress.md

@@ -2,17 +2,17 @@
 
 Updated: 2026-08-15
 
-- **Overall programme status:** Active. Seven packages are locally verified; twenty-three are implemented with verification incomplete; PRODUCT-001 is in progress. The prioritized admin-only version indicator, JOBS-002 workspace and scoped cross-application accessibility pass are implemented on the release branch; remote and production verification remain.
-- **Current work package:** `PRODUCT-001` — honest Free/Pro homepage and contextual upgrade surfaces (`IN PROGRESS`). The prerequisite claim inventory is next; no price, trial or limit will be invented.
+- **Overall programme status:** Active. Seven packages are locally verified; twenty-four are implemented with verification incomplete; VER-001 is in progress. The prioritized admin-only version indicator, JOBS-002 workspace, scoped accessibility pass and honest Free/Pro product surfaces are implemented on the release branch; remote and production verification remain.
+- **Current work package:** `VER-001` — complete application action matrix and regression pass (`IN PROGRESS`). Reconcile the matrix against the current tree, run every local gate and classify external checks without overstating them.
 - **Completed work packages:** None are `DONE`; all repository security/AI packages still have applicable browser, provider and/or production gates.
 - **Locally verified work:** SEC-001, SEC-002, SEC-003, SEC-005A, CORE-001, PROD-002 and DEP-001 (`VERIFIED LOCALLY`).
-- **Implemented, verification incomplete:** SEC-004, SEC-005B, SEC-008, CORE-002, BG-001, OPS-001A/B/C, POL-001/002, AI-001/002/003/004, UX-001/002/003, QA-001, CAREER-001/002, MAIL-001 and JOBS-001/002 (`IMPLEMENTED — NOT VERIFIED`). JOBS-002, UX-002 and UX-003 safe local/browser scope is implemented; production/native-device gates remain.
+- **Implemented, verification incomplete:** SEC-004, SEC-005B, SEC-008, CORE-002, BG-001, OPS-001A/B/C, POL-001/002, AI-001/002/003/004, UX-001/002/003, QA-001, CAREER-001/002, MAIL-001, JOBS-001/002 and PRODUCT-001 (`IMPLEMENTED — NOT VERIFIED`). Their safe repository/browser scope is implemented; production/native-device/provider gates remain where recorded.
 - **Production-verified work:** None.
 - **Blocked work:** SEC-006 parser upgrades remain outside the scoped frontend advisory permission; PROD-001/003/004 and REL-001 require documented production access and unfinished dependencies. Real provider, SMTP/MariaDB and production environments are unavailable; DEP-001 awaits approved merge/live verification. The in-app browser is available for local UI checks.
 - **Deferred work:** None. Conditional multi-replica coordination, model deletion, realtime operation delivery and unrelated production changes remain outside current packages.
-- **Immediate order:** PRODUCT-001; VER-001; tracking/blocker reconciliation. Admin version (`a6cffe0`), Career lossless persistence (`f0b9b22`), CV contact contrast (`3b86ea2`), JOBS-002 (`deed948`) and the cross-app accessibility pass are locally complete. External-only work remains skipped, not allowed to stall this queue.
-- **Status counts:** 7 `VERIFIED LOCALLY`; 23 `IMPLEMENTED — NOT VERIFIED`; 1 `IN PROGRESS`; 3 `NOT STARTED`; 5 `BLOCKED`; 0 `DONE`; 0 `DEFERRED`.
-- **Test status:** backend 647/647; frontend 54/54 suites and 228/228 tests; optimized production build/TypeScript pass; Playwright 7/7 plus final targeted 2/2. The application workspace journey passes keyboard entry, Back/Forward, focus return, unsaved navigation, saved-draft refresh, missing-job handling, long data, explicit light/dark 375/768/1440 no-overflow checks and computed dark-Alert AA contrast. The public CV preserves its full A4 viewport while scaling without inner/outer mobile overflow. CV renderer/settings 25/25, CV Builder/public UI 22/22, AI sidecar 22/22 and npm audit 0 evidence remain current. Historical JT-019 and Jest force-exit/open-handle behavior remain recorded.
+- **Immediate order:** VER-001; tracking/blocker reconciliation. Admin version (`a6cffe0`), Career lossless persistence (`f0b9b22`), CV contact contrast (`3b86ea2`), JOBS-002 (`deed948`), accessibility (`a7c2549`) and PRODUCT-001 repository/browser scope are locally complete. External-only work remains skipped, not allowed to stall this queue.
+- **Status counts:** 7 `VERIFIED LOCALLY`; 24 `IMPLEMENTED — NOT VERIFIED`; 1 `IN PROGRESS`; 2 `NOT STARTED`; 5 `BLOCKED`; 0 `DONE`; 0 `DEFERRED`.
+- **Test status:** backend 647/647 remains current; PRODUCT policy/billing slice 30/30; frontend 57/57 suites and 232/232 tests; optimized production build/TypeScript pass; Playwright 8/8. Chromium now also proves exactly two honest public plans, explicit light/dark at 375/768/1440, no retired commercial claims, no overflow and keyboard plan actions. The application workspace and responsive public-CV evidence remains current. CV renderer/settings 25/25, AI sidecar 22/22 and npm audit 0 evidence remain current. Historical JT-019 and Jest force-exit/open-handle behavior remain recorded.
 - **Deployment status:** Gitea pull-request run 609 passed the complete CI job in 4m20s. Deploy was intentionally skipped because the workflow deploys only a `push` to `main`; live remains unchanged. No merge/deployment was performed directly, no production migrations were run and the AI operation worker remains disabled by default.
 - **Production status:** Unchanged and unverified. No provider/model call, model pull, external request or paid API occurred.
 - **Known regressions:** None found by automated/local browser checks. Jest still needs `--forceExit` and reports its existing open-handle notice. Email-provider/send tests are fake/local only; real delivery is not claimed. Current MAIL browser evidence is 1280×720 only because the browser surface could not resize or perform native Tab traversal. Interrupted attempts are aged after 15 minutes and notified without retry; the five-minute scan is unmeasured on a large ledger. Direct clean EF-only SQLite migration still hits the pre-existing historical blank-chain defect before later migrations; normal startup owns reconciliation. Cross-feature monthly AI usage accounting remains a rollout gap.
@@ -49,5 +49,6 @@ Updated: 2026-08-15
 - `docs/verification/mail-001-job-email-hub.md`
 - `docs/verification/jobs-001-job-discovery.md`
 - `docs/verification/ux-003-kanban-theme.md`
+- `docs/verification/product-001-honest-plans.md`
 - `docs/verification/prod-002-ai-evaluation.md`
 - `docs/work-programmes/master-work-plan.md`

docs/work-programmes/master-work-plan.md

@@ -16,7 +16,7 @@ Allowed statuses are `NOT STARTED`, `IN PROGRESS`, `IMPLEMENTED — NOT VERIFIED
 
 `DONE` requires every applicable acceptance criterion, focused and regression tests, browser/accessibility/theme/mobile checks, tenant and entitlement checks, documentation, migration/rollback evidence, and production verification. Repository-only work that still requires production is at most `VERIFIED LOCALLY`.
 
-Exactly one implementation item may be `IN PROGRESS`. As of this revision it is **PRODUCT-001**.
+Exactly one implementation item may be `IN PROGRESS`. As of this revision it is **VER-001**.
 
 ## Consolidated dependency order
 
@@ -59,8 +59,8 @@ This queue records the highest-value work that can proceed without production cr
 | 3 | CV contact/header/sidebar contrast correction | CAREER-002 | Implemented and locally verified. Header/custom-accent and sidebar palettes own readable foregrounds; real Chromium computed-style/overflow checks and a 17-page A4 PDF proof pass. |
 | 4 | Dedicated Job Details parity and JOBS-002 closure | JOBS-002 | Locally complete. Application answers/recruiter drafts now live on the dedicated page, note markers are encapsulated, edits are lossless, dirty navigation is guarded, focus returns to the row, tenant regressions pass, and Chromium covers 375/768/1440 light/dark/history/error/long data. Production smoke remains. |
 | 5 | Cross-application contrast/accessibility pass | UX-002, UX-003, VER-001 | Locally complete. All icon controls own programmatic names; CV cards are keyboard links; the A4 public CV scales without inner/outer mobile overflow; dark Alert contrast is measured in Chromium at WCAG AA; full frontend/build/Playwright pass. Native assistive-technology and a general CI crawler remain external/future gates. |
-| 6 | Honest Free/Pro homepage and upgrade surfaces | PRODUCT-001 | In progress. Inventory existing claims first; do not invent pricing, limits or trial terms before billing configuration is real. |
-| 7 | Complete application action matrix and full regression | VER-001 | Not started. Populate incrementally, then run the complete backend/frontend/sidecar/E2E gates and accurately classify external production/provider checks. |
+| 6 | Honest Free/Pro homepage and upgrade surfaces | PRODUCT-001 | Locally complete. One catalogue drives exactly Free/Pro; retired tier/price/Free-AI/unlimited claims are gone; configured billing state controls the real upgrade action; contextual notices are reusable/dismissible. Frontend 232/232, policy/billing 30/30, build and Chromium 8/8 pass. |
+| 7 | Complete application action matrix and full regression | VER-001 | In progress. Reconcile the rolling matrix, run the complete backend/frontend/sidecar/E2E/configuration gates and accurately classify external production/provider checks. |
 | 8 | Tracking and blocker reconciliation | All | Keep this plan, progress, handoff, verification log and `BLOCKERS.md` aligned after every logical increment; remove stale CI/dependency statements only when current evidence proves them obsolete. |
 
 ## Requirement coverage index
@@ -398,7 +398,7 @@ This queue records the highest-value work that can proceed without production cr
 - **Blocker:** browser localhost is denied; Stripe/MariaDB/production are unavailable. Usage accounting is complete only for AI Workspace, so provider rollout remains blocked until durable execution centralizes it.
 - **Evidence:** `docs/verification/pol-001-free-pro-entitlements.md`; focused backend 74/74; full backend 568/568; focused frontend 22/22; full frontend 47 suites/157 tests; production build.
 - **Commit:** none.
-- **Remaining work:** browser locked/Pro state checks; mocked Stripe expiry/downgrade lifecycle; central all-task usage accounting through AI-003/004 producers; production role/config smoke. PRODUCT-001 separately removes the known landing-page price/third-tier/unlimited claims.
+- **Remaining work:** browser locked/Pro state checks; mocked Stripe expiry/downgrade lifecycle; central all-task usage accounting through AI-003/004 producers; production role/config smoke. PRODUCT-001 has removed the former landing-page price/third-tier/unlimited claims.
 
 ### POL-002 — AI privacy, consent and external-fallback policy
 
@@ -736,11 +736,11 @@ This queue records the highest-value work that can proceed without production cr
 - **Required tests:** copy/capability consistency, Free/Pro/expired/downgraded locked states, dismissal/no false generation.
 - **Required browser verification:** homepage and contextual prompts at three widths/themes/keyboard/accessibility.
 - **Required production verification:** configured price text only if actual billing product exists; otherwise no invented values.
-- **Status:** `IN PROGRESS`.
-- **Blocker:** public plan behavior depends on POL-001 compatibility decision; real billing activation is external.
-- **Evidence:** source requirement.
+- **Status:** `IMPLEMENTED — NOT VERIFIED`.
+- **Blocker:** configured Stripe lifecycle, native assistive technology and production checks remain external; repository behavior no longer depends on a product decision.
+- **Evidence:** `docs/verification/product-001-honest-plans.md`; V-171. Focused frontend 30/30, current policy/billing 30/30, full frontend 57 suites/232 tests, build and Playwright 8/8.
 - **Commit:** none.
-- **Remaining work:** inventory all current contradictory plan claims, then implement only centrally supported honest Free/Pro copy and contextual upgrade surfaces; billing values remain external.
+- **Remaining work:** configured synthetic Checkout/webhook/portal/expiry/downgrade browser journey, native assistive-technology spot check and production smoke. Commercial terms remain owned by Stripe Checkout.
 
 ### VER-001 — Complete application action matrix and regression pass
 
@@ -754,7 +754,7 @@ This queue records the highest-value work that can proceed without production cr
 - **Required tests:** full backend/frontend/Python/E2E plus regressions for confirmed defects.
 - **Required browser verification:** running app, synthetic users/data, 375/768/1440, themes/keyboard/focus/refresh/back/tabs/slow/error; no real email/paid provider/destructive production action.
 - **Required production verification:** applicable smoke actions only after deployment; local and production classifications remain distinct.
-- **Status:** `NOT STARTED`.
+- **Status:** `IN PROGRESS`.
 - **Blocker:** browser tooling/access and external providers may block individual rows, not the matrix.
 - **Evidence:** audit user-journey/action gaps.
 - **Commit:** none.

docs/work-programmes/session-handoff.md

@@ -2,17 +2,17 @@
 
 Updated: 2026-08-15
 
-- **Exact current task:** start PRODUCT-001 claim inventory after committing/pushing the completed cross-application accessibility increment.
-- **Last completed step:** named all icon controls, made CV cards keyboard-operable, preserved/scaled the full A4 public-CV viewport on mobile and added real dark-Alert contrast proof.
-- **Files currently modified:** focused frontend accessibility semantics, public-CV responsive rendering, unit/Chromium regressions and programme evidence.
-- **Commands already run:** accessibility-focused frontend 9/9; full frontend 54 suites/228 tests; optimized build; full Playwright 7/7; final targeted workspace/public-CV Chromium 2/2; static icon-control audit and diff review.
-- **Test results:** all repository tests listed above pass. Chromium measures dark Alert contrast at WCAG AA, proves the public CV has no inner or outer overflow at 375px, and retains the prior workspace light/dark/history/focus evidence. Jest retains the documented force-exit/open-handle notice.
+- **Exact current task:** commit/push PRODUCT-001, then execute VER-001 full action-matrix and regression reconciliation.
+- **Last completed step:** replaced contradictory three-tier/fixed-price/Free-AI/unlimited claims with exactly Free/Pro, centralized public capability copy and reused dismissible contextual upgrade notices.
+- **Files currently modified:** plan catalogue, homepage, active AI notices, billing-state explanation, focused tests, product documentation and programme evidence.
+- **Commands already run:** PRODUCT frontend 30/30; policy/billing backend 30/30; full frontend 57 suites/232 tests; optimized build; full Playwright 8/8; claim searches and diff review.
+- **Test results:** all listed tests pass. Chromium covers exactly two plans, retired-claim absence, explicit light/dark, 375/768/1440 no-overflow and keyboard actions. Jest retains the documented force-exit/open-handle notice.
 - **Services currently running:** none on task-owned ports 3000/5202. Playwright stopped its disposable API/Next servers. Pre-existing Docker services were not changed.
 - **Temporary files or processes:** no task-owned process is running and the failed disposable migration database was removed. Existing synthetic browser evidence/account and startup-created local backup remain documented. No provider account, real email, private content, paid service or production service was accessed.
 - **Production changes currently active:** none. No deployment, migration, provider connection/sync/send or production payload occurred.
 - **Rollback status:** downgrade `20260810080858_AddEmailDraftClientRequestId`, then `20260810075206_AddEmailDrafts`, before reverting draft commits; then follow the existing MAIL rollback order (`ee5ef7e`, `449faeb`, `123fc55`/`e9937ac`, ledger downgrade before `653f011`). No production migration/deploy/provider grant occurred.
-- **Uncommitted changes:** V-170 accessibility/responsive-public-CV increment; no dependency/schema/config/migration change. V-166 through V-169 are pushed as `a6cffe0`, `f0b9b22`, `3b86ea2` and `deed948`.
+- **Uncommitted changes:** V-171 PRODUCT-001 presentation/documentation increment; no backend/dependency/schema/config/migration change. V-166 through V-170 are pushed as `a6cffe0`, `f0b9b22`, `3b86ea2`, `deed948` and `a7c2549`.
 - **Known failures:** live deployment is not verified because PR deploy is intentionally skipped and the active branch is not approved for merge. Draft export/API/UI, full thread/category actions and non-Gmail review remain; existing accounts need re-consent and IMAP stays read-only. A clean full-chain SQLite apply fails in the pre-existing JT-019 migration before the new draft migration. Browser/provider/MariaDB/production unavailable or unverified; recovery scan performance is unmeasured at large ledger scale; Jest open handles; SEC-006 parser dependency work is still separately gated; parser isolation remains SEC-007.
-- **Exact next action:** commit/push V-170, inventory Free/Pro claims and implement the supported PRODUCT-001 surface without invented commercial terms.
-- **Work that can continue independently:** PRODUCT-001, VER-001 and tracking reconciliation. UX/JOBS production, MAIL provider mutations, SEC-006/007 and PROD packages retain their recorded external gates.
+- **Exact next action:** commit/push V-171, reconcile `application-action-matrix.md` against the current repository and run the complete local VER-001 gate set.
+- **Work that can continue independently:** VER-001 and tracking reconciliation. UX/JOBS/PRODUCT production, MAIL provider mutations, SEC-006/007 and PROD packages retain their recorded external gates.
 - **Decisions still required from the user:** none for synthetic/code-inspected repository work. Any provider connection or send test, internet/package upgrades, private data, external/paid providers and production actions retain explicit approval/safety gates; SEC-009 retention/legal policy remains unresolved.