docs(plan): advance to application workspace

docs/work-programmes/decisions.md

@@ -629,3 +629,13 @@
 - **Consequences:** UX-003 becomes the only in-progress package. JOBS remains explicitly incomplete rather than `DONE`; its live gates stay visible.
 - **User approval required:** No; this is tracking and safe local sequencing within the approved programme.
 - **Reversible:** Yes; JOBS can resume when live NAV or production verification becomes available.
+
+## DEC-064 — Use one accessible Kanban move state model
+
+- **Date:** 2026-08-10
+- **Decision:** Drive pointer and keyboard moves from the same picked-up job and active-column state. Use live theme variables for every surface/tone, Space to pick up/cancel, Enter or Space on a focused valid column to drop, and update local state only after the API succeeds.
+- **Reason/evidence:** the prior static light palette caused confirmed white columns in dark mode, while native drag alone exposed no target or keyboard semantics and rejected moves became unhandled promises. Shared state makes valid/active/invalid/selected/failure states consistent without replacing the precise status menu.
+- **Alternatives considered:** isolated dark hex colours; CSS-only drop feedback; optimistic moves with rollback; a second keyboard-only status implementation; replacing drag with a new library. These duplicate policy, risk stale UI or add unnecessary dependency/complexity.
+- **Consequences:** pointer and keyboard users receive the same server-confirmed behavior and announcements; custom `Other` remains visibly invalid. The existing exact-stage menu stays available and now has an accessible name.
+- **User approval required:** No; this is approved local UX/accessibility work with mocked browser APIs.
+- **Reversible:** Revert `fb6f17e` and `4e5ce0c`; no schema/data change is involved.

docs/work-programmes/master-progress.md

@@ -2,17 +2,17 @@
 
 Updated: 2026-08-10
 
-- **Overall programme status:** Active. Seven packages are locally verified; twenty-one packages through JOBS-001 are implemented with automated/runtime evidence but blocked from applicable live/provider/production gates; UX-003 is now in progress. Gitea run 609 passes the prior complete pull-request CI; DEP-001 awaits approved merge-to-main and production verification.
-- **Current work package:** `UX-003` — Kanban theme-state correction (`IN PROGRESS`); re-read Phase 10 and reproduce every specified board state before editing.
+- **Overall programme status:** Active. Seven packages are locally verified; twenty-two packages through UX-003 are implemented with automated/runtime evidence but blocked from applicable live/provider/production gates; JOBS-002 is now in progress. Gitea run 609 passes the prior complete pull-request CI; DEP-001 awaits approved merge-to-main and production verification.
+- **Current work package:** `JOBS-002` — applications table and embedded workspace (`IN PROGRESS`); Phase 11 route/list/workspace inventory and current-behavior reproduction are next.
 - **Completed work packages:** None are `DONE`; all repository security/AI packages still have applicable browser, provider and/or production gates.
 - **Locally verified work:** SEC-001, SEC-002, SEC-003, SEC-005A, CORE-001, PROD-002 and DEP-001 (`VERIFIED LOCALLY`).
-- **Implemented, verification incomplete:** SEC-004, SEC-005B, SEC-008, CORE-002, BG-001, OPS-001A/B/C, POL-001/002, AI-001/002/003/004, UX-001/002, QA-001, CAREER-001/002, MAIL-001 and JOBS-001 (`IMPLEMENTED — NOT VERIFIED`). JOBS repository/browser-mock scope is implemented; live NAV and production remain.
+- **Implemented, verification incomplete:** SEC-004, SEC-005B, SEC-008, CORE-002, BG-001, OPS-001A/B/C, POL-001/002, AI-001/002/003/004, UX-001/002/003, QA-001, CAREER-001/002, MAIL-001 and JOBS-001 (`IMPLEMENTED — NOT VERIFIED`). UX-003 safe local/browser scope is implemented; production/native-device gates remain.
 - **Production-verified work:** None.
 - **Blocked work:** SEC-006 parser upgrades remain outside the scoped frontend advisory permission; PROD-001/003/004 and REL-001 require documented production access and unfinished dependencies. Real provider, SMTP/MariaDB and production environments are unavailable; DEP-001 awaits approved merge/live verification. The in-app browser is available for local UI checks.
 - **Deferred work:** None. Conditional multi-replica coordination, model deletion, realtime operation delivery and unrelated production changes remain outside current packages.
-- **Next five work packages:** UX-003 Kanban theme states; JOBS-002 applications/workspace; PRODUCT-001 homepage/Pro claims; VER-001 action matrix; production-blocked SEC-006/007 when package-index permission is available.
-- **Status counts:** 7 `VERIFIED LOCALLY`; 21 `IMPLEMENTED — NOT VERIFIED`; 1 `IN PROGRESS`; 6 `NOT STARTED`; 5 `BLOCKED`; 0 `DONE`; 0 `DEFERRED`.
-- **Test status:** backend 631/631; frontend 50/50 suites and 201/201 tests; Playwright 5/5; npm audit 0 vulnerabilities; production build passes. JOBS-001 focused backend 2/2, UI 7/7 cumulative and mocked browser 1/1 pass at 375/768/1440. DEP-001 router and MAIL-001 suites remain as recorded. EF model-current and provider draft scripts pass; historical JT-019 and Jest force-exit/open-handle behavior remain recorded.
+- **Next five work packages:** JOBS-002 applications/workspace; PRODUCT-001 homepage/Pro claims; VER-001 action matrix; production-blocked SEC-006/007 when package-index permission is available; REL-001 after prerequisites.
+- **Status counts:** 7 `VERIFIED LOCALLY`; 22 `IMPLEMENTED — NOT VERIFIED`; 1 `IN PROGRESS`; 5 `NOT STARTED`; 5 `BLOCKED`; 0 `DONE`; 0 `DEFERRED`.
+- **Test status:** backend 631/631; frontend 50/50 suites and 204/204 tests; Playwright 6/6; npm audit 0 vulnerabilities; production build passes. UX-003 component 7/7 and mocked browser 1/1 pass at 1440/768/375 with dark/light, pointer/keyboard and mobile containment. JOBS-001, DEP-001 and MAIL-001 suites remain as recorded. Historical JT-019 and Jest force-exit/open-handle behavior remain recorded.
 - **Deployment status:** Gitea pull-request run 609 passed the complete CI job in 4m20s. Deploy was intentionally skipped because the workflow deploys only a `push` to `main`; live remains unchanged. No merge/deployment was performed directly, no production migrations were run and the AI operation worker remains disabled by default.
 - **Production status:** Unchanged and unverified. No provider/model call, model pull, external request or paid API occurred.
 - **Known regressions:** None found by automated/local browser checks. Jest still needs `--forceExit` and reports its existing open-handle notice. Email-provider/send tests are fake/local only; real delivery is not claimed. Current MAIL browser evidence is 1280×720 only because the browser surface could not resize or perform native Tab traversal. Interrupted attempts are aged after 15 minutes and notified without retry; the five-minute scan is unmeasured on a large ledger. Direct clean EF-only SQLite migration still hits the pre-existing historical blank-chain defect before later migrations; normal startup owns reconciliation. Cross-feature monthly AI usage accounting remains a rollout gap.
@@ -48,5 +48,6 @@ Updated: 2026-08-10
 - `docs/verification/career-002-cv-builder.md`
 - `docs/verification/mail-001-job-email-hub.md`
 - `docs/verification/jobs-001-job-discovery.md`
+- `docs/verification/ux-003-kanban-theme.md`
 - `docs/verification/prod-002-ai-evaluation.md`
 - `docs/work-programmes/master-work-plan.md`

docs/work-programmes/master-work-plan.md

@@ -685,9 +685,9 @@ Ordering differences from the suggested list:
 - **Required tests:** route/history/filter persistence/focus/unsaved/direct link/mobile, tenant authorization.
 - **Required browser verification:** three widths/themes/keyboard/back-forward/refresh/error/long data.
 - **Required production verification:** existing application/workspace smoke.
-- **Status:** `NOT STARTED`.
+- **Status:** `IN PROGRESS`.
 - **Blocker:** none after dependencies.
-- **Evidence:** source requirement and existing workspace architecture.
+- **Evidence:** source requirement and existing workspace architecture; initial Phase 11 inventory begins at V-158.
 - **Commit:** none.
 - **Remaining work:** do not place every field in table or duplicate workspace data.
 
@@ -703,11 +703,11 @@ Ordering differences from the suggested list:
 - **Required tests:** component/visual state coverage.
 - **Required browser verification:** three widths, light/dark, pointer and keyboard drag, focus/contrast.
 - **Required production verification:** board smoke.
-- **Status:** `IN PROGRESS`.
-- **Blocker:** none for repository/browser reproduction; production board smoke remains external.
-- **Evidence:** source requirement; browser tooling was proven available by V-156.
-- **Commit:** none.
-- **Remaining work:** smallest token-level root fix.
+- **Status:** `IMPLEMENTED — NOT VERIFIED`.
+- **Blocker:** production board smoke and native assistive-device testing remain external.
+- **Evidence:** `docs/verification/ux-003-kanban-theme.md`; V-157. Confirmed white dark-mode columns, then verified shared theme surfaces, pointer/keyboard/invalid/failure/loading states, 1440/768/375 behavior and dark/light contrast; component 7/7, frontend 204/204, Playwright 6/6 and build pass.
+- **Commit:** `fb6f17e` (theme/state/keyboard/mobile root fix and evidence), `4e5ce0c` (required-width and real browser hover/drag verification).
+- **Remaining work:** production board smoke and native assistive-device validation only.
 
 ### PRODUCT-001 — Homepage plans and respectful Pro promotion
 

docs/work-programmes/session-handoff.md

@@ -2,17 +2,17 @@
 
 Updated: 2026-08-10
 
-- **Exact current task:** UX-003 — re-read Work Phase 10 and reproduce Kanban light/dark, drag, empty, loading, error and keyboard states before editing.
-- **Last completed step:** committed and pushed `82f4526`; mocked JOBS browser flow passes at 375/768/1440 and visual inspection confirmed the dark information-banner contrast fix.
-- **Files currently modified:** authoritative JOBS-001 tracking/decision/evidence only; application/tests/screenshots are committed.
-- **Commands already run:** JOBS source/import trace, focused backend/UI tests, full regressions/builds, mocked Playwright discovery and complete E2E suite, screenshot inspection and diff reviews. See V-154–V-156.
-- **Test results:** backend 631/631; frontend 50 suites and 201/201; JOBS focused backend 2/2 and UI 7/7 cumulative; Playwright 5/5 including JOBS at three widths/themes/keyboard/import; production build passes. Jest retains its known force-exit/open-handle warning.
+- **Exact current task:** JOBS-002 — read Phase 11 and inventory the applications table, route-backed workspace, filters/history/focus/unsaved state and tests before editing.
+- **Last completed step:** pushed `4e5ce0c`; UX-003 now has required 1440/768/375 dark/light, browser pointer hover/drag and keyboard evidence after the root implementation `fb6f17e`.
+- **Files currently modified:** UX-003 tracking/decision/verification evidence only; application/tests/screenshots are committed.
+- **Commands already run:** Phase 10 trace; failing pre-fix computed-color browser reproduction; iterative focused component/build/browser checks; screenshot inspection; full frontend/build and complete Playwright. See V-157.
+- **Test results:** backend 631/631 (unchanged); frontend 50 suites and 204/204; Kanban component 7/7; Playwright 6/6 including Kanban 1440/768/375, dark/light, pointer/keyboard; production build passes. Jest retains its known force-exit/open-handle warning.
 - **Services currently running:** none on task-owned ports 3000/5202. Playwright stopped its disposable API/Next servers. Pre-existing Docker services were not changed.
 - **Temporary files or processes:** no task-owned process is running and the failed disposable migration database was removed. Existing synthetic browser evidence/account and startup-created local backup remain documented. No provider account, real email, private content, paid service or production service was accessed.
 - **Production changes currently active:** none. No deployment, migration, provider connection/sync/send or production payload occurred.
 - **Rollback status:** downgrade `20260810080858_AddEmailDraftClientRequestId`, then `20260810075206_AddEmailDrafts`, before reverting draft commits; then follow the existing MAIL rollback order (`ee5ef7e`, `449faeb`, `123fc55`/`e9937ac`, ledger downgrade before `653f011`). No production migration/deploy/provider grant occurred.
-- **Uncommitted changes:** JOBS-001 closure/UX-003 transition tracking, decision and V-156 evidence only; commit and push before UX implementation.
+- **Uncommitted changes:** UX-003 closure/JOBS-002 transition tracking, decision, V-157 and verification document only; commit and push before JOBS-002 implementation.
 - **Known failures:** live deployment is not verified because PR deploy is intentionally skipped and the active branch is not approved for merge. Draft export/API/UI, full thread/category actions and non-Gmail review remain; existing accounts need re-consent and IMAP stays read-only. A clean full-chain SQLite apply fails in the pre-existing JT-019 migration before the new draft migration. Browser/provider/MariaDB/production unavailable or unverified; recovery scan performance is unmeasured at large ledger scale; Jest open handles; SEC-006 parser dependency work is still separately gated; parser isolation remains SEC-007.
-- **Exact next action:** read `docs/todo/work.md` Phase 10 and inspect `KanbanBoard`, its style tokens and tests; reproduce specified state contrast in a mocked browser before choosing the smallest root fix.
-- **Work that can continue independently:** UX-003, JOBS-002, PRODUCT-001 and VER-001. JOBS live NAV/production, MAIL provider mutations, SEC-006/007 and PROD packages retain their recorded external gates.
+- **Exact next action:** read `docs/todo/work.md` Phase 11 and inspect `JobTable`, `/jobs` routing, `ApplicationWorkspacePage`, filter persistence/deep links and existing tests; reproduce list-context loss and direct-route behavior before choosing the first increment.
+- **Work that can continue independently:** JOBS-002, PRODUCT-001 and VER-001. UX/JOBS production, MAIL provider mutations, SEC-006/007 and PROD packages retain their recorded external gates.
 - **Decisions still required from the user:** none for synthetic/code-inspected repository work. Any provider connection or send test, internet/package upgrades, private data, external/paid providers and production actions retain explicit approval/safety gates; SEC-009 retention/legal policy remains unresolved.