docs(roadmap): add performance baseline and parallel checkpoints

docs/direct-roadmap/LATEST_CHECKPOINT.md

@@ -1,5 +1,15 @@
 # Direct execution continuation
 
+## Parallel roadmap checkpoints
+
+- A3 Audit search now includes exact event type, inclusive local dates and keyboard event details. Published and read back `fd524a4b9d55d671d4f9c93134057d42f9cd6373` on `codex/a3-ui-10`. Passed 11 selected tests, full lint/build with TypeScript, 36 configurations and 108 controlled axe scans/captures. Browser used synthetic reads and no writes.
+- A3 compact Users actions published and read back `327d99dfdacc16f72e008807ea3f27805cf0c570`. 14 targeted tests, lint, export with TypeScript and 36 configurations with 72 scans/captures passed. Initial pilots caught lost keyboard focus after cancellation, now corrected. Full server-backed Admin suite, native device checks and real password-reset delivery remain open.
+- Launch concept gallery and eight desktop/phone renders published and read back `ccb114944a228be72b73cc657bb21214941a668c` on `feature/launch-site-redesign`. 20 Chromium cases passed. Review `docs/launch-site/concepts/index.html` in that worktree. LAUNCH-02 awaits owner selection or a mix of concepts. Live signup, approved claims, native review and production performance remain open.
+- Localisation published and read back `af33e45542aea1e18088c44308161284fdca47a7` on `codex/i18n-mobile-salary` and `4c12f7691ff5e73f537135ffed60c0b599c7ce37` on `codex/i18n-admin-metrics`. 20 and 23 scoped tests respectively, type-check, scoped lint and export passed. Salary and Admin numeric formatting remain isolated pending reviewed A3 integration and native/browser checks.
+- Release published and read back `e73681008ae6a8919de777d2db93d566b683dceb` for offline rollback, `cedf33a358e4b8df202c0f7038313bba8e67de61` for off-host copy failure handling and `24a629972ed94f3df725f197689efe2ca3976603` for atomic monthly completion. Latest release branch runs passed 12 backup, five rollback, four hosted quarantine checks and Bash syntax. No real restore, off-host transfer, deployed system or host test was run. Post-rollback health and actual encrypted restore remain open.
+- All 18 performance areas are classified in the existing TODO. [Performance baseline](PERF_BASELINE.md) separates export, cold synthetic browser and historical MariaDB evidence. Isolated PERF changes were published and read back at `21db35d2b965fbda2ddf5b419ac2646fcae05517` (Companies, 16 tests, two consumers share one GET) and `97d06180b7f41f8cd9d93c30b373ff3e8eac67b2` (Jobs, 34 tests and locale-switch duplicate GET 1→0). Review exact deltas before A3 integration.
+- A3 PERF page correspondence `bca750446f1069eb55d648be838be192d70c2d30` published and read back. 36 selected tests passed. Captured SQLite SQL returned 250→15 and 2,500→15 groups on a 15-item page. MariaDB execution and latency remain open.
+
 ## Roadmap TODO and audit search
 
 The [roadmap TODO](ROADMAP_TODO.md) is the consolidated checklist, including open historical carryovers. On `codex/a3-ui-10`, published `49e79875d9681efab0880d7e812bb0e536b7d30c` qualifies recent Audit Log metadata search over the existing 200-event response. Runtime `1a8a97a57894bde4029ca0d878df6d4a815424a4` passed 10 tests, lint, build with TypeScript and 36 responsive configurations with 72 scans/captures. The first phone no-match copy clipped, then passed after moving outside the wide table. Notes and old/new values are excluded from matching. No browser writes. Next eligible A3 work is structured Audit filtering and safe detail expansion, or compact Admin and Application actions.

docs/direct-roadmap/NEXT_ACTIONS.md

@@ -3,9 +3,10 @@
 10 November 2026.
 
 1. Continue P10-05 qualification on the frozen cleanup branch. CLEAN-20 is published. Reconcile full local regression, source-bound evidence and the 57 preservation groups. Further removal requires its own proven candidate and approval.
-2. Continue approved A3-IM10 from published `49e79875` on `codex/a3-ui-10`. Recent Audit metadata search is complete. Next eligible slices include compact admin/application actions, structured Audit filtering and safe expansion. Use the route and discrepancy registers for remaining correspondence, Settings and import states. Prepare final Gate F once the visual, workflow and regression evidence is reviewable.
+2. Continue approved A3-IM10 from published `327d99df` on `codex/a3-ui-10`. Recent Audit filters and details and compact Admin Users actions are qualified in scoped fixtures. Next: compact application actions, remaining correspondence/Settings/import states and real connected workflow evidence. Prepare final Gate F once the visual, workflow and regression evidence is reviewable.
 3. Continue independently eligible localisation on its isolated branch. The 188 historical dynamic calls are accounted for. Prioritise contextual display coverage and automated locale checks. Native and additional locale publication gates remain open.
-4. Continue launch audit inputs and prepare four desktop/mobile concept pairs from `98483b80`. Continue eligible offline security/recovery work on the existing branches. RR-11 is fixed and tested offline. Preserve launch design/claims decisions, integrated security scope, and approved recovery environment requirements.
+4. Four desktop/mobile launch concept pairs are published at `ccb11494`. Retain owner selection before refinement and final approval before implementation. RR-11 and scoped RR-12/13 offline checks/fixes are published through `24a62997`. Actual recovery, integrated security and production remain separately gated.
 5. Keep Product Review findings provisional until Phase 10 acceptance. Reuse the published GJ-00 pack. GJ-01 awaits the accepted predecessors, implementation scope and provider rights.
+6. Continue PERF from the source census and comparable baseline. Carry the page correspondence delta into MariaDB plan comparison when isolated. Review the Companies and locale Jobs deltas and measure cold bundle ownership. Keep replica, CDN, production, migrations and protected removal gated.
 
 Use [the complete roadmap TODO](ROADMAP_TODO.md), [the latest checkpoint](LATEST_CHECKPOINT.md) and branch-specific handoffs to resume. The orchestrator remains paused. Keep pre-p10-ux and unrelated work intact. Publication belongs on the relevant development branch.

docs/direct-roadmap/OWNER_DECISIONS.md

@@ -13,3 +13,12 @@ The owner selected A3, approved the implementation and approved progression thro
 ## Later decisions — not requested prematurely
 
 Product-ranked scope, Global Jobs implementation and provider licences, I18N implementation and human language release, homepage design selection, security target/environment and material-risk disposition, and final release approval retain their own concrete review gates. Research does not grant these decisions. Do not ask for generic blanket approval or treat this list as completed sign-off.
+
+| Decision | Options and recommendation | Work held |
+| --- | --- | --- |
+| Homepage concept selection | Review the four published directions at `ccb11494`. Select or combine elements, then review the refined design. Keep product and pricing claims under their own review. | LAUNCH-02 refinement and later public implementation |
+| MFA recovery and private support access | Review the separate technical proposals on the security branch. Prefer user-controlled recovery and explicit, scoped, revocable support consent. Retain present access while decisions are pending. | Factor reset/change workflow and cross-owner private support access |
+| Global Jobs entry and rights | Review the accepted predecessor reports and provider rights before approving country/provider scope. Defer capabilities without documented access. | GJ-01 onward and provider activation |
+| Isolated diagnostics and recovery rehearsal | Approve a specific disposable target, fixtures and operational acceptance criteria once the plan is ready. Retain production separation. | Real rollback, restore and diagnostic execution |
+| Performance infrastructure | Keep the current topology while measurement is incomplete. Compare isolated replica, CDN and pool experiments only against a measured capacity or latency need. | Any external service, paid plan, DNS or production topology change |
+| Final qualification | Review the source-bound A3, Phase 10, locale, security and release packages independently at their required gates. | Final milestone and production release decisions |

docs/direct-roadmap/PERF_BASELINE.md

@@ -0,0 +1,29 @@
+# Performance baseline and measurement boundaries
+
+10 November 2026. The [roadmap TODO](ROADMAP_TODO.md) owns the 18 performance items and their status. This file holds measurement evidence and the comparison protocol.
+
+## Frontend artifact baseline
+
+Read-only census of the existing Windows Next.js 16.4.1 / Turbopack export for isolated I18N source `4c12f7691ff5e73f537135ffed60c0b599c7ce37`. The index SHA-256 is `6f99eecb975bd8f5aee81ada5dbc15abbf6364df0df80dd8ffdd5bc2381a835e`. Gzip sizes use local gzip level 6. They are estimates of encoded content size and exclude response headers.
+
+| Export inventory | Files | Raw bytes | Gzip-6 bytes |
+| --- | ---: | ---: | ---: |
+| All JavaScript | 58 | 3,603,806 | 1,069,697 |
+| All CSS | 2 | 3,958 | 1,189 |
+| Modern async JS declared in root HTML, deduplicated | 6 | 468,253 | 139,328 |
+| Legacy nomodule JS | 1 | 112,594 | 39,627 |
+| CSS declared in root HTML | 1 | 293 | 227 |
+
+No source maps were emitted. The largest exported JS chunk is 550,002 raw bytes and contains JobTable and catalogue identifiers. The largest inventoried image files are favicon.ico (147,708 bytes), logo512.png (133,453 bytes) and logo192.png (32,284 bytes). The three current landing SVGs total 27,380 bytes.
+
+Cold loopback Chromium 151 at 1366×900 used fresh contexts, blocked external fonts and fixture responses with 15 Jobs. Observed JavaScript resources were 18 files / 2,005,036 raw bytes / 591,192 estimated gzip bytes for both `/` and `/login`, and 20 / 2,033,779 / 601,065 for `/jobs`. This includes dynamic client requests. Compression estimates still exclude headers and deployed encoding. There was one initial paged Jobs GET and one duplicate on EN→NB. The published fix `97d06180b7f41f8cd9d93c30b373ff3e8eac67b2` kept one initial GET and reduced the extra GET from one to zero under the same fixture. 34 tests, type-check, scoped lint and export passed. See `docs/i18n/JOBS_LOCALE_READS.md` on `codex/perf-jobs-locale-read`. It is isolated from A3.
+
+The single unthrottled samples do not establish a timing distribution or field vitals. Repeat on the exact A3 candidate with identical cache, network and CPU settings, routes, browser and fixture sizes. Use route request logs to separate shell bytes from lazy chunks. Use the Turbopack analyzer to trace ownership before moving an import and React Profiler to find costly commits. [Next.js bundling](https://nextjs.org/docs/pages/guides/package-bundling) · [React Profiler](https://react.dev/reference/react/Profiler)
+
+## Backend and database baseline
+
+Historical P9 requalification used MariaDB 12.2.2, 250 applications, eight Career roles and two readers over 15 minutes. It recorded 3,382 successful reads, p50 23.84 ms and p95 33.24 ms. Later P9-SEC-02 source reported p50 24.08 ms and p95 33.41 ms. These are historical source-bound measurements. No new backend/API latency, MariaDB plan, contention, resource or pool measurement was run in this intake. [P9 performance receipt](../redesign/phase-9/p9-requal-01/PERFORMANCE.md)
+
+The ordinary applications page fix at `bca750446f1069eb55d648be838be192d70c2d30` reduced correspondence aggregate rows from 250 and 2,500 to 15 in two disposable SQLite fixtures. Board and empty results issue zero such aggregate commands. 36 selected tests passed, including existing tenant, paging, filter and board parity. This measures rows returned by the aggregate. It does not establish MariaDB rows examined or endpoint latency. Preserve existing readiness and follow-up semantics in future work. Only use MariaDB ANALYZE on an approved disposable dataset because it executes the statement. [EF Core efficient queries](https://learn.microsoft.com/en-us/ef/core/performance/efficient-querying) · [MariaDB ANALYZE](https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/analyze-and-explain-statements/analyze-format-json)
+
+Existing public static and authenticated data boundaries remain distinct. Any output cache candidate needs explicit HTTP, tenant and mutation checks. Evaluate byte reduction before enabling compression on additional routes and keep HTTPS side-channel exposure in scope. Pool size and replica proposals need a capacity budget, actual connection measurements and isolated failure tests. [ASP.NET Core 9 output caching](https://learn.microsoft.com/en-us/aspnet/core/performance/caching/output?view=aspnetcore-9.0) · [ASP.NET Core 9 compression](https://learn.microsoft.com/en-us/aspnet/core/performance/response-compression?view=aspnetcore-9.0) · [MySqlConnector options](https://mysqlconnector.net/connection-options/)

docs/direct-roadmap/ROADMAP_STATUS.md

@@ -17,10 +17,11 @@ Updated 10 November 2026. This register records direct-chat work. See [the conti
 | I18N-01 / I18N-00 audit | PARTIAL | All 188 historical dynamic call reviews accounted for in published `4172c23d`. Full visible-text, native, market and European coverage remain open |
 | I18N-01–08 implementation/acceptance | PARTIAL | Bounded EN/NB improvements tested and published. Later stage prerequisites, native review and additional locale publication remain separate |
 | LAUNCH-SITE-01 / LAUNCH-00 audit | PARTIAL | Design-neutral contracts at `af8c48ce` and rendered baseline reconciliation at `98483b80`. Design research, asset rights and public claims remain open |
-| LAUNCH-01 four desktop/mobile concepts | PENDING | No viewable concepts produced; eligible independent task after completing audit inputs |
-| LAUNCH-SITE final design/implementation | AWAITING_APPROVAL | Four concrete concepts must be delivered before owner selection; no final design auto-selection |
+| LAUNCH-01 four desktop/mobile concepts | PUBLISHED FOR REVIEW | Gallery and eight rendered screenshots at `ccb11494`. 20 controlled browser checks passed |
+| LAUNCH-SITE final design/implementation | AWAITING_APPROVAL | Owner selection or combination is next. Refine and obtain final design approval before application implementation |
 | SECURITY-AUDIT-01 | OFFLINE PREFLIGHT PARTIAL | Approved root policy published at `de3d5031`. Formal integrated scan requires a completed application baseline and applicable environment/cost approval |
-| RELEASE-READINESS-01 / discovery and RR-11 | PARTIAL | Parser fix `f19e7ebf` published with 31 offline tests. RR-12/13 still require isolated rollback, restore and off-host encryption evidence |
+| RELEASE-READINESS-01 / discovery and RR-11–13 | PARTIAL | Parser fix and offline rollback, off-host copy failure and monthly completion guards published through `24a62997`. Isolated rollback, restore and off-host encryption evidence remain open |
 | Release stages 2–7 baseline, qualification, remediation, requalification, rehearsal, final acceptance | BLOCKED | Final release candidate/prerequisites not accepted; each stage needs actual applicable environment and source-bound evidence |
+| PERF-01 / 18 performance areas | IN PROGRESS | Added to the existing roadmap TODO. Measure comparable local baselines first. Replica, CDN, protected dependency and production decisions retain their gates |
 
 Implemented, tested, accepted, published and production-ready are separate. Production is NO-GO. Historical counts are not fresh executions. See [blockers](BLOCKERS.md), [owner decisions](OWNER_DECISIONS.md), [completed work](WORK_COMPLETED.md) and [next actions](NEXT_ACTIONS.md).

docs/direct-roadmap/ROADMAP_TODO.md

@@ -32,9 +32,11 @@ Updated 10 November 2026. This is the cross-phase work list. The source prompts,
 - [ ] **Calendar**. Recorded closing dates and follow-ups are covered. Resolve genuine interview scheduling, original precision/timezone and provider/ICS qualification as applicable. Preserve agenda/month toggle and preference.
 - [ ] **Career, CV, letter and documents**. Finish connected overview-to-document reuse and create/import-to-edit/preview/export evidence. Preserve revisions, null-as-inherit, canonical profile ownership, frozen packages, import review and RD21.
 - [ ] **Correspondence**. Improve inbox, mailbox state, relevant job context and review. Scope explicit consent, provider permissions, multi-mailbox storage and retention separately. Preserve conflict, attachment and confirmed-send flows.
-- [ ] **Admin Users**. Alignment and read-only 2FA shipped. Compact actions and creation/role/reset/deletion dialogue, error and keyboard coverage remain. **Gated** MFA recovery design approval and authorisation for factor changes.
+- [x] **Admin Users compact actions**. One keyboard menu retains existing role, reset and delete paths. Published `327d99df` with 14 tests and 72 controlled browser states.
+- [ ] **Admin Users**. Continue server-backed creation/role/reset/deletion and native error/device coverage. **Gated** MFA recovery design approval and authorisation for factor changes.
 - [x] **Audit recent search**. Search the existing admin response by user, type, application ID/title or company. The limit and no-match state are explicit. Published `49e79875` with 10 selected tests and 72 browser states.
-- [ ] **Audit and privacy**. Mail-subject redaction shipped. Add structured filters and safe record expansion, minimise exposed fields and verify isolation across remaining delivery paths. **Gated** private support access proposal, consent, expiry and revocation.
+- [x] **Recent Audit filters and details**. Exact event type and inclusive local dates combine with recent search. Keyboard disclosure uses already permitted values. Published `fd524a4b` with 11 tests and 108 controlled browser states.
+- [ ] **Audit and privacy**. Mail-subject redaction shipped. Historical search, additional supported filters, safe event history and isolation across remaining delivery paths remain open. **Gated** private support access proposal, consent, expiry and revocation.
 - [ ] **System Status**. Last successful browser refresh shipped. Qualify actual worker/queue/task/provider/mail/enrichment/error/timing signals with honest stale/unavailable states. Design exists for isolated allowlisted diagnostics. **Gated** execution, audit and isolation approval. Retain CV benchmark evidence.
 - [ ] **Settings and automation**. Qualify individual rules and explanatory states, remaining recovery cases and per-user Ghosted pause contract. Keep model/provider execution and real mutations separately authorised.
 - [ ] **Bookmarklet and terminology**. Finish EN/NB terminology and display review. Retain bookmarklet until device parity for URL paste, extension and PWA sharing, then seek retirement approval.
@@ -56,7 +58,7 @@ Updated 10 November 2026. This is the cross-phase work list. The source prompts,
 
 - [ ] **I18N-00** Close full surface and catalogue inventory and locale priorities. All 188 historical dynamic call reviews are accounted for. Full visible text and locale acceptance remain open.
 - [ ] **I18N-01** Locale registry, locale aliases/legacy NB, persisted user choice, fallback/negotiation, formatting and migration. Keep UI, job and document languages independent.
-- [ ] **I18N-02** All React copy, navigation, form/dialog/error/loading states, accessibility, responsive text expansion and language switch continuity.
+- [ ] **I18N-02** All React copy, navigation, form/dialog/error/loading states, accessibility, responsive text expansion and language switch continuity. Mobile salary formatting and Admin metric formatting are published independently at `af33e455` and `4c12f769`. A3 integration and native/browser coverage remain open.
 - [ ] **I18N-03** API error codes, validation, mail, notifications, background/operational messages, locale persistence and fallbacks.
 - [ ] **I18N-04** Career Profile, Docling/import review, CV and letter editors, generated content, templates and PDF. Preserve document language and revision fidelity.
 - [ ] **I18N-05** Multilingual discovery, occupation names, aliases, matching, provider languages and regional formatting. Coordinate with GJ.
@@ -75,8 +77,8 @@ Updated 10 November 2026. This is the cross-phase work list. The source prompts,
 ## LAUNCH-SITE-01 · Public launch site
 
 - [ ] **LAUNCH-00** Close research, registration/degraded-auth, performance and asset-rights audit inputs. Existing 12 rendered states and raw SEO findings published at `98483b80`.
-- [ ] **LAUNCH-01** Produce four high-fidelity desktop/mobile concept pairs using genuine synthetic product captures and appropriate cleared imagery. Present minimalist, premium SaaS, friendly/human and editorial choices for owner selection.
-- [ ] **LAUNCH-02** Refine selected elements and obtain explicit final design approval. **Gated**.
+- [x] **LAUNCH-01** Four high-fidelity desktop/mobile concept pairs published at `ccb11494`, with synthetic product captures and 20 scoped browser checks.
+- [ ] **LAUNCH-02** Owner selects or mixes minimalist, premium SaaS, friendly/human and editorial directions. Refine selected elements and obtain explicit final design approval. **Gated**.
 - [ ] **LAUNCH-03** Build public foundation and responsive accessible hero/navigation without disturbing auth/signup or protected return routes.
 - [ ] **LAUNCH-04** Validate product screenshots, photography rights and optimisation. Use synthetic data, truthful captions, responsive assets and alternatives.
 - [ ] **LAUNCH-05** Implement reviewed hero, workflow, feature, trust, plans, FAQ and conversion content. Confirm legal/privacy links, signup and honest feature/price claims.
@@ -109,7 +111,7 @@ Bounded offline fixes and root security policy exist. Formal integrated scope, t
 
 ## RELEASE-READINESS-01 · Qualification and production decision
 
-- [ ] **Stage 1** Close discovery, prior blockers and baseline scope. Endpoint/environment census published at `47c6834c`. Backup parser RR-11 published with 31 offline tests. RR-12 rollback and RR-13 recovery remain open.
+- [ ] **Stage 1** Close discovery, prior blockers and baseline scope. Endpoint/environment census and RR-11 parser are published. RR-12 handler tests and RR-13 failure guards for off-host transfers and monthly completion markers are published through `24a62997`. Runtime rollback and recovery remain open.
 - [ ] **Stage 2** Freeze exact candidate, environment, image/digest, migration/config/dependency identities, CI and evidence provenance.
 - [ ] **Stage 3 · Functional** Accounts/auth, jobs/tracking, dashboard, career/CV/documents, AI, correspondence, integrations, notifications, admin, billing and exports. Qualify real browser, sidecar and MariaDB lanes separately.
 - [ ] **Stage 3 · UX** Responsive/visual and keyboard/AT/accessibility, EN/NB and launched locales, reflow/contrast, physical devices and representative workflows.
@@ -121,6 +123,32 @@ Bounded offline fixes and root security policy exist. Formal integrated scope, t
 - [ ] **Stage 6** Rehearse isolated upgrade, image rollback and data rollback, database/files/keys/tombstones restore, encrypted off-host retrieval, validation, RPO/RTO and operational recovery.
 - [ ] **Stage 7** Publish final matrix, evidence, risk/owner decisions and GO/NO-GO. Production deployment requires a separate explicit decision.
 
+## PERF-01 · Performance and scalability
+
+Source: owner PERF-01 prompt and Full-Roadmap-Autonomy Addendum, 10 November 2026. Performance item numbers below are the owner's stable IDs. Priority is provisional until comparable measurements exist. The [performance baseline](PERF_BASELINE.md) records export bytes and historical MariaDB evidence separately. Record source, environment, fixture sizes, repetitions and before/after values together.
+
+| ID | Status, priority and effort | Next action and acceptance boundary |
+| --- | --- | --- |
+| PERF-BASE | PARTIAL · high · medium | Export inventory measured on isolated Next.js source `4c12f769`. Freeze the exact A3 runtime and synthetic workloads. Capture actual transfer, route and interaction timings, API latency/bytes/error/throughput, query plans/counts and resource/queue signals where runnable. |
+| PERF-01 | PARTIAL · high · medium | Isolated `21db35d2` fixes stale Companies completions after invalidation/relogin and correctly shares one GET across two pending consumers. Review A3 integration. RulesEngine 30-second owner cache and post-save invalidation remain separate. Avoid shared authenticated caching. |
+| PERF-02 | GATED topology · low · high | Nginx and compose use a singleton backend. Liveness/readiness and leased user operations exist, while other workers and session dependencies are local. Keep singleton until measured capacity warrants change. Compare one and two replicas in an isolated environment with one migration, backup and scheduler owner. Require cross-node auth, failover and no duplicate jobs. |
+| PERF-03 | PARTIAL · high · high | `JobTrackerContext` indexes tenant jobs, follow-ups, documents, revisions, queues, notifications and saved searches. Check actual MariaDB plans for default application sorting, agenda, Audit timestamp and due operations on representative tenants. Compare rows examined, p95 and write cost. Migration gates remain. |
+| PERF-04 | PARTIAL · medium · medium | `app/layout.tsx` and `public/` ship a 147,708-byte ICO and PWA icons. Measure requested assets before changing icon variants. CV thumbnails already viewport-gate sandboxed iframes. Qualify responsive launch image sizes, layout and rights with the Launch gate. Preserve original uploads and evidence. |
+| PERF-05 | PARTIAL · medium · medium | `ViewStateNotice` and `PageLoader` mostly use spinners. Editor, Career, checklist and some Settings already use skeletons. Test slow dashboard/discovery/list/detail/document/mail/Admin reads. Add layout-matching skeletons only where perceived loading improves. Check reduced motion, CLS, focus and empty/error separation. |
+| PERF-06 | PARTIAL · high · medium | `AnalyticsService` already projects counts, date groups and bounded inputs. Measure serial counts and group scans before combining SQL or caching. Career completeness is computed from the current profile. Preserve null/deleted/stage/date semantics and mutation consistency. |
+| PERF-07 | PARTIAL · high · medium | Ordinary application paging published at `bca75044`. The correspondence aggregate now returns 15 groups for a 15-row page, down from 250 and 2,500 in the fixtures. 36 tests passed. Users fixed two readers at 75 rows, Documents has count/page SQL, and Audit/Processing batch projections. Profile MariaDB plans and remaining query growth. |
+| PERF-08 | PARTIAL · high · low | JobTable/Kanban already debounce 250 ms, CV preview 300 ms with sequence protection, Discover submits explicitly. The isolated Jobs fix `97d06180` reduced the extra locale-switch GET from one to zero. Review A3 integration and measure other repeated reads. Keep Audit search local and writes immediate. |
+| PERF-09 | PARTIAL · high · medium | `ClientShell.tsx` and `App.tsx` already split many routes. JobTable, Login and Landing stay eager within the client app. Trace the 550,002-byte largest export chunk and compare cold routes before changing imports. Preserve auth, state and accessibility. |
+| PERF-10 | GATED external service · low · medium | No CDN in inspected source. Measure isolated proxy cache headers and European public TTFB before proposing a CDN. Compare static immutable origin caching, asset purge and revalidation. Keep HTML revalidatable and API/documents private. DNS, cost and topology require approval. |
+| PERF-11 | PARTIAL · high · high | Applications, Documents, Correspondence and Processing have paged paths, with some application filters materialised first. Users is full-fetch, Audit is bounded, and board's full array is contractual. Prioritise ordinary table query/bytes, then stable Users paging or Audit timestamp/ID cursor. Preserve last-admin count, filtering, ordering, mutations and keyboard. |
+| PERF-12 | OPEN · medium · medium | No compression middleware/directive found in inspected app/NGINX source. External ingress unknown. Compare payloads raw/gzip/Brotli and CPU on isolated responses. Prefer projection and paging. Verify one encoding layer, Vary and side-channel boundaries. |
+| PERF-13 | PARTIAL · high · medium | JobTable and Dashboard already memoise specific row/chart computations. Profile list typing, dashboard, editor and navigation commits before changing dependencies. Prioritise confirmed duplicate reads. Preserve drafts, history, context and revisions. |
+| PERF-14 | ACTIVE mechanism · low · low | Next.js 16.4.1/Turbopack emits compact assets and zero export source maps in the isolated baseline. Retain bundler minification. Compare exact A3 reproducible sizes and deployed source-map exposure during release. |
+| PERF-15 | PARTIAL · high · medium | Route/editor/Admin, nested Kanban and viewport-gated CV thumbnails are already lazy in part. Current landing SVGs load eagerly. Defer measured offscreen assets only. Protect critical content, focus, preview sandbox and state. |
+| PERF-16 | PARTIAL · medium · medium | `app/layout.tsx` starts the external Archivo stylesheet and the theme bootstrap. Google Sign-In and Turnstile already load conditionally. Measure blocked/offline font and startup waterfall, then compare a licence-cleared delivery option. Preserve auth, theme, provider and CSP ordering. |
+| PERF-17 | GATED removal · low · medium | P10-03 found no proven safe dependency removal. Inventory frontend, .NET and Python reflection, build, sidecar and runtime consumers. Require exact candidate approval, locked restore and compatibility evidence before removal. |
+| PERF-18 | PARTIAL · medium · medium | Scoped EF contexts use Pomelo 9 and MySqlConnector 2.4, whose connection pooling is enabled by default. No source override found. Measure driver pool wait/usage/timeouts, cancellation and DB headroom in a disposable environment. Separate context pooling from connection pooling. Tune only with capacity and rollback evidence. |
+
 ## Separately gated or excluded
 
 - [ ] Optional P7-06F follow-mode composer: retain deferral pending action/fallback decision. P7-12 completed conditionally. Preserve its native/provider/release limits.