feat(settings): preserve drafts and connection recovery

docs/redesign/phase-7/p7-09/OAUTH_SENDER.md

@@ -39,3 +39,5 @@ Seven of76 retained final PNGs were actually displayed and reviewed, covering Co
 The **16 new ordinary frontend cases / zero suites** derive **807/95**; three new browser cases derive **326**; backend stays **1054**. These are inventories, not fresh integrated passes. All57 groups stay56 PARTIAL/C11 DEFERRED and33 routes remain. Final [staged hygiene](evidence/oauth-static-checks.json) **PASS** at08:27:17 UTC: secret and all whitespace gates,25 docs/583 links,57 groups/33 routes. Normal commit/publication follows this gate. Bounded repair: **CONDITIONAL GO**; both P7-09 presentation boundaries remain pending.
 
 Actual OAuth grants, provider interoperability and production qualification remain open. Local callback HTML and connect URLs are explicitly controlled client-guard fixtures, and canonical server status remains disconnected. No mailbox, inference, send or grant is contacted. P5-13/worker/model withholding and production **NO-GO** remain unchanged.
+
+Normal publication **`dac29278db3c187349b97771ca2f383c9e6e0962`** is directly verified at **2026-10-17T08:27:48.643285 UTC**: clean HEAD=origin=live development, local/origin/live main27657f3 unchanged. This observed receipt supersedes the preceding pending-publication observation. [Preferences and Connections](PREFERENCES.md) now proceeds; no production or Phase8 authorization follows.

docs/redesign/phase-7/p7-09/PREFERENCES.md

@@ -0,0 +1,49 @@
+# P7-09 — Preferences and Connections
+
+First presentation boundary from the [approved handoff](../../phase-6/p6-05/PHASE7_HANDOFF.md). The separate [sender repair](OAUTH_SENDER.md) is normally pushed as **`dac29278db3c187349b97771ca2f383c9e6e0962`**. Direct refs at **2026-10-17T08:27:48.643285 UTC** prove clean HEAD=origin=live development and unchanged local/origin/live main27657f3. Exact receipt: `.artifacts/phase7/p7-09/oauth-push-receipt.json`. No publication blocker remains for that repair.
+
+## Baseline and bounded scope
+
+The published entry has final **39/3 frontend**, sender3/Application5/ordinaryP2-D01=9 native and four type/lint/build gates passing on `j_uwah2_BImymFemE3cLg`. These executed entry results remain separate from new presentation acceptance. Existing Settings14, Connections12 and correspondence13 are retained. Derived inventory at entry is807/95 frontend,326 browser,1054 backend; the latest whole-suite counts remain inherited untilP7-12.
+
+| Owner | Confirmed friction | Required bounded result |
+|---|---|---|
+| Settings notification preference | Locale-dependent GET replaces unsaved edits; failed initial read lacks recovery; duplicate saves and late acknowledgements can overwrite newer choices | Stable single-flight read; explicit GET-only Retry; independent draft/last-acknowledged baseline, dirty/Discard and submitted-snapshot save acknowledgement; current-language feedback and disposal |
+| Parent Rules session | Existing six-field draft/validation/snapshot/discard owner is accepted | Retain all fields,1–365 validation, internal-tab retention, section save scope and current routes/panel associations |
+| Mailbox providers | Failed/unfinished status resembles disconnection; repeated actions and failed post-write refresh can mislead; IMAP fields remain editable during submission | Independent truthful loading/error/known status, GET-only Retry and no mutation replay; scoped action exclusion and captured IMAP payload; sender correlation unchanged |
+| Connected accounts presentation | Legacy rounded wrapper, heavy weights and duplicated header style | Existing PageSection, appropriate heading hierarchy, wrapping and shared spacing; no new information architecture |
+
+User/local appearance/table preferences, server language, notification email delivery and Rules remain independent. No save-all, new revision protocol, shared settings store, provider feature or backend/schema change. The existing theme/router/MUI/toast/session ownership stays authoritative. Failed real writes and RD11/RD12/RD13 remain visible and separately owned; a successful mocked or later real response does not diagnose their historical root cause.
+
+## Evidence and acceptance
+
+Meaningful ordinary REDs are retained: Settings **14 PASS / 7 FAIL** at08:31:47–08:31:58 UTC, before its product changes; Connections **12 PASS / 9 FAIL**, before its product changes. Failures demonstrate draft replacement, duplicate writes, stale feedback/disposal, missing recovery and incorrect provider/port states. Final GREEN and combined consumers, serialized production build/browser journeys, finite width/theme/language screenshots, all axe incomplete contexts, preservation reconciliation and staged hygiene are **PENDING**. Existing sender tests stay strict.
+
+Candidate Settings **21/1 PASS** and Connections **22/1 PASS** retain every existing case. Connections adds a separate meaningful removed-IMAP-field focus regression (**21 PASS / 1 FAIL**, then22 PASS). The new boolean preference owner acknowledges only its submitted snapshot; provider failures retain an unknown or refresh-required state and Retry performs GET only. IMAP no longer coerces an empty/zero port to993; it validates the existing server range1–65535 before submitting the captured credentials. No protocol or grant semantics change.
+
+The first combined **91/6 PASS** was followed by a failed lint gate (two cleanup-ref warnings). Capturing the stable ref objects in effect setup corrected those warnings without suppression. The next91/6 PASS/type gate exposed26 unsupported Testing Library `ByRole` `exact:true` options; only those options were removed, preserving literal accessible names, default exact matching and every assertion. No build/native ran in either failed batch. Raw capsules `.artifacts/phase7/p7-09/preferences-lint-attempt1/` and `preferences-types-attempt1/` retain the actual failures. Final combined **91/6 PASS**,08:37:32–08:37:59 UTC, and fresh app/browser TypeScript/lint PASS now precede browser validation. No failed gate is represented as successful acceptance.
+
+Unchanged-binary backend **52/52 PASS**,08:30:10–08:30:13 UTC: ExternalOrigin14, Gmail19, Microsoft7, IMAP9 and NotificationSettings3. The command's additional `RulesControllerTests` filter matches no cases and supplies no Rules coverage; existing/native Rules evidence remains separate. Exact raw command/TRX/log is `.artifacts/phase7/current/backend-career/p709-preferences-contracts-20261017T083010Z/`. This is not a new backend test, Release build or whole-suite run. No real grant, IMAP connection, send, model call, billing, deletion, restore or production action belongs to this boundary.
+
+PRES-S03/S04/S05/M06/E09 and all57 groups remain binding; no whole-group promotion. Human reader/touch/software keyboard/real zoom and production font/photo/output requirements remain open. **Presentation acceptance: PENDING.** Data/privacy/plan/backup follows this boundary; Phase8 implementation and deployment remain prohibited.
+
+## Final first-boundary result
+
+Implemented Preferences/Connections: **CONDITIONAL GO**, pending final [staged hygiene](evidence/preferences-static-checks.json) and normal publication. [Portable results](evidence/preferences-results.json) identify final91/6, backend52/52, all17 native cases, frozen source/export, peer review and every failed attempt. No skip, expected failure, assertion relaxation or flaky outcome is used.
+
+| Executed evidence | Actual result |
+|---|---|
+| Combined frontend | **91/6 PASS**,08:37:32–08:37:59 UTC; Settings21, Connections22, correspondence13, i18n6, onboarding23, notification shell6 |
+| Build and types | App TypeScript08:37:55–08:38:07 and production build08:38:13–08:38:28 PASS, export **`InBPthl1fsnID3NNdgwbI`**. Final native-only fixture edits get fresh lint08:45:29–08:46:00 and browser TypeScript08:46:00–08:46:07 PASS; no fictional rebuild |
+| New browser journeys | **5/5 PASS**,08:41:11–08:42:04: actual persistence, separate saves, submitted snapshot/newer draft, owner/disposal, controlled read/write recovery and seven paired width/theme/language samples |
+| Existing consumers | OAuth **3/3 PASS**,08:42:04–08:42:22; Rules4+Settings4 **8/8 PASS**,08:46:07–08:47:56; ordinary **P2-D01 1/1 PASS**,08:47:56–08:48:10 |
+| Source preservation | Final34 inputs held08:45:29–08:48:37. Earlier build/unit31 inputs and primary/OAuth32 inputs match, with only the three separately recorded native fixture changes. Both backend DLLs unchanged |
+| Visual and accessibility | All18 new PNGs actually displayed/reviewed: parent0–8, independent peer9–17. New18 scans0 violations/62 incompletes; existing36 scans0/222 retained separately |
+
+The first browser attempt2/5 failed at an early mobile/desktop selector branch before the lazy panel appeared; waiting for either visible control corrects that fixture precondition. The first existing consumer run3/8 failed at a global status locator that also selected P7-08's unread announcement and four obsolete Skeleton assertions. Their replacements scope the exact Rules status and assert the actual named busy notification group/progress indicator. Held reads, exact HTTP/status/persistence/export and downstream assertions remain unchanged. All raw failures remain retained.
+
+Every incomplete category is recorded: new43/consumer174 overlapped backgrounds, new18/consumer36 short badges, new1/consumer12 closing MUI-menu focus diagnostics. Full contexts remain raw. These are indeterminate contrast or pending settled keyboard/AT checks, not waived findings or human acceptance. No new rule is disabled. Consumer PNGs are retained without claiming all were visually reviewed.
+
+**17 new frontend cases / zero suites** derive **824/95**; **five new browser cases** derive **331**; backend remains1054. These remain inventories, not full-suite execution; inherited whole573/89,1033 backend and49 sidecar awaitP7-12. All57 groups remain56 PARTIAL/C11 DEFERRED, with33 routes; RD11/RD12/RD13/RD21 and manual/provider/output/release debt remain. The next data lifecycle boundary first needs the separately reviewable PascalCase-export/camelCase-import compatibility repair; it is not implemented here.
+
+Final staged hygiene **PASS**,2026-10-17T08:50:12 UTC: secret and working/staged/phase whitespace gates,26 docs/593 local links,57 groups/33 routes. All33 tracked staged inputs match the final canonical-LF snapshots; the sole ignored input is the recorded local runner. Normal commit/push follows; the actual hash/remote receipt is recorded after observation. Data lifecycle and wholeP7-09 remain pending.

docs/redesign/phase-7/p7-09/README.md

@@ -29,6 +29,6 @@ Notification reads depend on locale callbacks and can replace an unsaved choice;
 
 All **57 groups remain 56 PARTIAL / C11 DEFERRED**, with **33 current routes**. RD11 language, RD12 notification and RD13 Rules failures remain independently diagnosed; successful reruns do not close them. F20/RD21, other reliability/scaling debt, human screen-reader, physical touch/software keyboard, real zoom and production fonts/photos/print remain qualified. P5-13 is withheld; followMode is deferred. Production remains **NO-GO**, main is unchanged and Phase 8 implementation has not started.
 
-The [separate sender repair](OAUTH_SENDER.md) now has final39/3, four type/lint/build gates and nine ordinary browser cases passing, including P2-D01. [Finite results](evidence/oauth-results.json) retain the actual REDs,39/3 final source, three new client-guard cases and all qualifications. Derived inventories become807/95 frontend and326 browser; backend1054 unchanged. Sender repair final hygiene/publication remain pending; preferences/Connections then data/privacy/plan/backup are still the two approved presentation boundaries.
+The [separate sender repair](OAUTH_SENDER.md) is published asdac2927, directly verified clean08:27:48 UTC; its39/3, native9, type/lint/build/hygiene and all qualifications remain recorded. The first [Preferences/Connections boundary](PREFERENCES.md) now has final91/6, backend52, native17 and gates PASS, all18 new PNGs reviewed and qualified54 axe scans0/284. [Finite results](evidence/preferences-results.json) retain precise source/run scopes and failures. Derived inventories become824/95 frontend and331 browser; backend1054 unchanged. First-boundary final hygiene/publication remain pending; data/privacy/plan/backup follows, beginning with the separately bounded import compatibility repair. Neither the second boundary nor allP7-09 is accepted yet.
 
 **P7-09 acceptance: PENDING.** Each repair/presentation boundary needs meaningful regression, applicable native/visual evidence, preservation reconciliation, hygiene, commit and normal push/direct verification.

docs/redesign/phase-7/p7-09/evidence/oauth-results.json

@@ -3,7 +3,7 @@
   "checkpoint": "P7-09",
   "slice": "Independent OAuth sender repair",
   "recordedUtc": "2026-10-17T08:26:39.793290+00:00",
-  "decision": "Bounded client repair CONDITIONAL GO; final staged hygiene PASS, normal publication pending",
+  "decision": "Bounded client repair CONDITIONAL GO; staged hygiene PASS, normally pushed and directly verified",
   "entry": {
     "path": "docs/redesign/phase-7/p7-09/evidence/entry.json",
     "bytes": 6161,
@@ -459,5 +459,34 @@
     "path": "docs/redesign/phase-7/p7-09/evidence/oauth-static-checks.json",
     "sha256": "2efe01046430d1b9522ec348b0dfb1462d16589dff137ef7068f4b5b6609017e",
     "checkedUtc": "2026-10-17T08:27:18.310998+00:00"
+  },
+  "publication": {
+    "command": [
+      "rtk",
+      "proxy",
+      "git",
+      "push",
+      "origin",
+      "HEAD:refs/heads/codex/ui-redesign-phase4"
+    ],
+    "startedUtc": "2026-10-17T08:27:46.777675+00:00",
+    "finishedUtc": "2026-10-17T08:27:48.414087+00:00",
+    "exitCode": 0,
+    "head": "dac29278db3c187349b97771ca2f383c9e6e0962",
+    "log": ".artifacts/phase7/p7-09/oauth-push-receipt.log",
+    "logSha256": "68af881724e54d7bfb8f98c4c3e8b7b53b7ac72ab0bfb4b269d65ba2e2e053d7",
+    "observedUtc": "2026-10-17T08:27:48.643285+00:00",
+    "originDevelopment": "dac29278db3c187349b97771ca2f383c9e6e0962",
+    "liveDevelopment": "dac29278db3c187349b97771ca2f383c9e6e0962",
+    "main": "27657f31131cd95d42f0e1290853ec9c9b3959a4",
+    "originMain": "27657f31131cd95d42f0e1290853ec9c9b3959a4",
+    "liveMain": "27657f31131cd95d42f0e1290853ec9c9b3959a4",
+    "pendingPaths": [],
+    "workingTreeClean": true,
+    "raw": {
+      "path": ".artifacts/phase7/p7-09/oauth-push-receipt.json",
+      "sha256": "d997d9128b720a690f456e5fe094a7af5bd59efce4b0415430c4b01804ffff68",
+      "bytes": 856
+    }
   }
 }

docs/redesign/phase-7/p7-09/evidence/preferences-static-checks.json

@@ -0,0 +1,104 @@
+{
+  "schemaVersion": 1,
+  "checkpoint": "p7-09",
+  "status": "PASS",
+  "checkedUtc": "2026-10-17T08:50:12.966801+00:00",
+  "commands": [
+    {
+      "name": "secret-scan",
+      "command": [
+        "rtk",
+        "proxy",
+        "C:\\Users\\Connor\\AppData\\Local\\Programs\\Python\\Python312\\python.exe",
+        "-X",
+        "utf8",
+        "scripts/supply-chain.py",
+        "scan-secrets"
+      ],
+      "startedUtc": "2026-10-17T08:50:09.548379+00:00",
+      "finishedUtc": "2026-10-17T08:50:12.129725+00:00",
+      "exitCode": 0,
+      "log": ".artifacts/phase7/current/static/20261017T085009Z/secret-scan.log",
+      "logSha256Raw": "c5a88d5ebdc042adba125c1eaacbe44f9f4a5c19898c0f195573c00d511aa28d"
+    },
+    {
+      "name": "working-whitespace",
+      "command": [
+        "rtk",
+        "proxy",
+        "git",
+        "diff",
+        "--check"
+      ],
+      "startedUtc": "2026-10-17T08:50:12.129725+00:00",
+      "finishedUtc": "2026-10-17T08:50:12.220613+00:00",
+      "exitCode": 0,
+      "log": ".artifacts/phase7/current/static/20261017T085009Z/working-whitespace.log",
+      "logSha256Raw": "d2993bc68ad9a63f711c8f5473155e2ba00fdcd461220cc3849185f2f9ad93e6"
+    },
+    {
+      "name": "staged-whitespace",
+      "command": [
+        "rtk",
+        "proxy",
+        "git",
+        "diff",
+        "--cached",
+        "--check"
+      ],
+      "startedUtc": "2026-10-17T08:50:12.220613+00:00",
+      "finishedUtc": "2026-10-17T08:50:12.315419+00:00",
+      "exitCode": 0,
+      "log": ".artifacts/phase7/current/static/20261017T085009Z/staged-whitespace.log",
+      "logSha256Raw": "d2993bc68ad9a63f711c8f5473155e2ba00fdcd461220cc3849185f2f9ad93e6"
+    },
+    {
+      "name": "phase7-whitespace",
+      "command": [
+        "rtk",
+        "proxy",
+        "git",
+        "diff",
+        "--check",
+        "b5319981ad3d1bd635daff861453d23c0de5320b"
+      ],
+      "startedUtc": "2026-10-17T08:50:12.315419+00:00",
+      "finishedUtc": "2026-10-17T08:50:12.477488+00:00",
+      "exitCode": 0,
+      "log": ".artifacts/phase7/current/static/20261017T085009Z/phase7-whitespace.log",
+      "logSha256Raw": "d2993bc68ad9a63f711c8f5473155e2ba00fdcd461220cc3849185f2f9ad93e6"
+    }
+  ],
+  "untrackedSecretScan": {
+    "files": 0,
+    "findings": 0
+  },
+  "documentation": {
+    "files": 26,
+    "relativeLinks": 593,
+    "errors": []
+  },
+  "preservation": {
+    "groups": 57,
+    "statuses": {
+      "PARTIAL": 56,
+      "PASS": 0,
+      "FAIL": 0,
+      "DEFERRED": 1
+    },
+    "originalRoutesPreserved": true,
+    "currentConcreteRoutes": 33
+  },
+  "production": {
+    "main": "27657f31131cd95d42f0e1290853ec9c9b3959a4",
+    "originMain": "27657f31131cd95d42f0e1290853ec9c9b3959a4",
+    "status": "NO-GO",
+    "qualification": "Local fetched refs; direct push observation recorded separately."
+  },
+  "hashPolicy": "Portable JSON UTF8 LF; raw log hashes measure exact saved bytes.",
+  "limits": [
+    "Pattern scanner skips binary and files over2MiB; not historical Git/production secrets.",
+    "Local links check target existence, not URL/heading anchors.",
+    "Static evidence is not runtime/manual/device/provider/production acceptance."
+  ]
+}