docs(redesign): complete Phase 1 audit checkpoint

.gitea/workflows/ci-deploy.yml

@@ -48,6 +48,8 @@ jobs:
               && install https://dotnetcli.azureedge.net/dotnet )
           fi
           echo "$DOTNET_ROOT" >> "$GITHUB_PATH"
+          # Native test apphosts need the custom runtime location in later steps too.
+          echo "DOTNET_ROOT=$DOTNET_ROOT" >> "$GITHUB_ENV"
           "$DOTNET_ROOT/dotnet" --info
 
       - name: Setup Node

JobTrackerApi.Tests/JobImportHttpTransportTests.cs

@@ -335,7 +335,9 @@ public sealed class JobImportHttpTransportTests
         {
             var error = await Assert.ThrowsAsync<HttpRequestException>(request);
             Assert.IsType<AuthenticationException>(error.InnerException);
-            Assert.Null(server.Request); // No HTTP data sent before TLS authenticates the origin.
+            // TLS rejection can surface as EOF after the server handshake on Linux.
+            // Both no read and a zero-byte read mean no HTTP data reached this origin.
+            Assert.True(string.IsNullOrEmpty(server.Request));
         }
         Assert.Equal("jobs.example.test", sni);
         Assert.Null(handler.SslOptions.RemoteCertificateValidationCallback);

docs/audits/2026-09-07/validation/b06-completion.md

@@ -322,3 +322,83 @@ Validation before the corrective push: **3/3 tests through `docker compose` and
 [Run 738](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/738/jobs/1611), for `97fce89`, passed Compose installation, all repository safety scripts, browser-extension tests, secret/SBOM checks, parser tests and the Release API build. Test-project build then failed with MSB3021/MSB3024: the Linux `PdfBrowserStub` apphost was copied to an output path already used as the fixture directory. Windows' `.exe` suffix had hidden the collision. The project reference now sets `Private="false"`; it still builds the fixture, while the existing explicit subdirectory copy is its sole output owner. SDK target inspection confirms this disables transitive content copying. No renderer or admission behavior changes.
 
 Local verification: `C:/Users/Connor/.dotnet/dotnet.exe test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-restore --filter FullyQualifiedName~PdfRenderAdmissionTests --logger "console;verbosity=minimal"` built successfully and passed **22/22** tests, including real exporter/fixture failure recovery. A preliminary unqualified `dotnet` invocation could not find the pinned SDK because PATH selected the system runtime; the explicit installed SDK resolved it. Diff checks pass. Linux runner confirmation remains required after push; a build/package fix does not close F04.
+
+[Run 739](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/739/jobs/1613), for `23cc250`, failed earlier in the unchanged API compiler: `csc.dll` exited 139 on both the ordinary and existing single-process retry. This is the previously documented runner crash signature, not a compile diagnostic or test assertion. It prevented Linux confirmation of the packaging correction. No retries/gates were weakened. Fresh local broader verification with the explicit SDK passed **915/915** selected backend tests, no selected skips, with only the same documented external-DNS-dependent IMAP exclusion; `.artifacts/redesign-audit/backend.trx` records the run.
+
+Pushing this evidence provides one further complete CI attempt with unchanged application/test logic. If the existing bounded retry is exhausted again, stop release attempts and obtain runner-host diagnostics under the [runner investigation](../../../infrastructure/runner-investigation.md); do not increase retry loops indefinitely or deploy past a red test gate. Phase 1 redesign audit is separately committed on `codex/ui-redesign-audit`, with no redesign implementation. F04 remains open regardless of CI outcome until its runtime/production checklist is proven.
+
+[Run 740](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/740/jobs/1615) recovered from the compiler issue, confirmed the Linux fixture **build** fix, and executed all 916 backend cases: **903 passed, 13 failed**. These were actionable portability failures rather than another compiler crash: two TLS-rejection cases recorded an empty HTTP read instead of null, and eleven PDF process cases could not start the .NET fixture (exit 131 or ensuing start-marker timeout). The workflow installed .NET in `/root/.dotnet`, but exported `DOTNET_ROOT` only inside the setup step; PATH alone does not supply the runtime location to a native apphost ([Microsoft runtime-location documentation](https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-environment-variables#dotnet_root-dotnet_rootx86-dotnet_root_x86-dotnet_root_x64)).
+
+The correction persists the already-validated runtime path through `GITHUB_ENV`. The TLS assertion accepts null **or an empty string**, while still requiring `HttpRequestException` with `AuthenticationException`, original-host SNI, no custom validation callback and zero HTTP request content. It does not accept whitespace or any HTTP bytes, trust a bad certificate or alter the transport. Fresh explicit-SDK Release verification with `DOTNET_ROOT` set: **98/98** `PdfRenderAdmissionTests|JobImportHttpTransportTests` pass; `.artifacts/redesign-audit/portability.trx`. No application code or test filters changed. The earlier stop rule applies to repeated compiler crashes, not evidence-backed correction of these now-observed test/setup defects.
+
+### Release dependency gate — 2026-09-10 local / 2026-09-09 UTC
+
+[Run 741](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/741/jobs/1617), `2024c37`, confirmed **916/916 Linux backend tests passed, zero skipped**. Compose/safety/parser/build checks also passed. Deployment was then skipped because `npm audit --audit-level=high` found three vulnerable package entries: Next critical, sharp high and js-yaml high. A fresh local audit reproduced the same report. These advisories were updated in the public database on September 8; earlier audit results are historical, not proof of the current dependency gate.
+
+The targeted patch raises the Next and matching lint-config floor to 16.3.3 (lock resolves 16.3.4), updates the existing sharp override from 0.35.3 to 0.35.4, and updates the transitive js-yaml 3.x lock to 3.15.2. Its 4.x copy already uses patched 4.3.2. Lockfile review shows only these dependency families and their required platform/compiler artifacts changed. React, MUI, routing, API and schema contracts were not changed.
+
+Primary advisory evidence: [Next Windows-hosted server issue](https://github.com/advisories/GHSA-p293-qw3h-jr36), [Next AVIF optimization issue](https://github.com/advisories/GHSA-2xp9-vwfh-vxw4), [sharp/libheif](https://github.com/advisories/GHSA-rgj7-g3m4-5g8c), [js-yaml merge budget](https://github.com/advisories/GHSA-2883-xcg3-v3hh). The intended production frontend is a static nginx export, not a Windows Next server or a running Next image optimizer; the advisories alone do not establish production exploitation. Build/development dependencies still fall within the existing release policy, so the gate is retained and patched instead of suppressed.
+
+Initial commands: `npm install --package-lock-only --ignore-scripts --no-audit --no-fund`, then `npm update js-yaml --package-lock-only --ignore-scripts --no-audit --no-fund`; `npm audit --package-lock-only --audit-level=high` reports **zero vulnerabilities**. Actual installation, frontend regression/build and new CI results follow separately; a lockfile-only audit is not runtime verification.
+
+Fresh installation with `npm ci --no-audit --no-fund` succeeded (820 packages); installed-tree `npm audit --audit-level=high` also reports **zero vulnerabilities**. Next's updated lint preset introduced `no-location-assign-relative-destination`, which assumes Next Router. This static SPA uses React Router and deliberately performs full navigation after account deletion to clear private state. That one inapplicable navigation rule is disabled with a configuration comment; both existing full-navigation calls and B02 cleanup remain unchanged.
+
+The patched Next build compiled application code but then exposed the historical `interview-prep.test.tsx:120` TS2571 as a build blocker. The smallest test-only correction uses `objectContaining({ content: expect.not.stringMatching(...) })` on the unknown Axios request argument. The existing positive assertion still requires the exact endpoint/category/title and a string containing the debrief prompt; the negative assertion still rejects invented company/achievement/metric content. No cast, type exclusion, strictness relaxation or production behavior change was introduced. R01a's explicit standalone CI command remains outstanding; its original reproduction is retained.
+
+Fresh local release verification after these changes:
+
+| Command (UI directory unless noted) | Result |
+|---|---|
+| `npm test -- --watchAll=false --runInBand` | **67 suites / 298 tests passed**, 102.468s, after the dependency update |
+| `npm test -- --watchAll=false --runInBand src/interview-prep.test.tsx` | **13/13 passed** after the assertion correction |
+| `node node_modules/typescript/bin/tsc --noEmit --incremental false` | **Exit 0** after correction; original error reproduced before it |
+| `npm run build` with `NEXT_PUBLIC_API_BASE_URL=http://localhost:5302/api` and telemetry disabled | **Exit 0**, Next 16.3.4 static export, including TypeScript |
+| `npm run test:e2e` with `PLAYWRIGHT_STATIC_EXPORT=true`, `PLAYWRIGHT_PREBUILT_EXPORT=true`, explicit installed `DOTNET_HOST_PATH`/`DOTNET_ROOT` | **18/18 passed**, 1.4m; Release API build zero warnings/errors. Includes B02 account isolation, B05 exact CSV bytes, anonymous public CV and long searchable PDF |
+| `npm run lint` | **Exit 0**, zero warnings after the rule compatibility adjustment; one redundant concurrent run raced Playwright's temporary `test-results` cleanup (ENOENT), so final lint is run serially |
+| Root: `python scripts/supply-chain.py scan-secrets`; `git diff --check` | **Pass**; line-ending notices only |
+
+Logs are under `.artifacts/redesign-audit/`. The latest full Linux backend run remains **916/916 at `2024c37`**; no backend source changed in this dependency correction. Deployment still requires the next full CI run and production preflight. This is authorized release repair, not Phase 2 redesign or B07; **F04 remains open**.
+
+### Runner dependency corruption after the patch
+
+[Run 742](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/742/jobs/1619), `a861ca4`, again passed **916/916 backend tests**, no skips (16s), repository/parser/build checks, locked frontend installation and the dependency audit. Lint stopped before analyzing application code with exit 2: installed `es-abstract/2025/RegExpCreate.js:19` contained `var"flags`, causing `SyntaxError: Invalid or unexpected token`. Subsequent gates and deployment were skipped.
+
+Independent verification downloaded the exact `es-abstract` **1.24.2** tarball URL from the lockfile, verified its SHA-512 integrity against that lock and read the member without extracting it. The official member and locally installed file match byte-for-byte; line 19 is `var flags = typeof F === 'undefined' ? '' : ToString(F);`. This is evidence of different dependency bytes in the runner's failure, not a source lint violation or a need to edit the dependency. The corruption mechanism is unproven; the existing [runner investigation](../../../infrastructure/runner-investigation.md) documents analogous failures.
+
+This evidence-only push makes **one further unchanged-code CI attempt** with the workflow's existing isolated install cache. No new retry loop, lint suppression or gate bypass is added. If corrupted dependency bytes or assertion-free process crashes recur, stop release retries and request runner-host diagnostics; do not generate repeated empty commits. Public `/health` still reports version **299**, `/ready` reports ready before this attempt; that is the existing deployment, not proof that `a861ca4` is live. The completed Phase 1 audit is pushed separately at `957fb57` on `codex/ui-redesign-audit`.
+
+### Final release retry — 2026-09-10
+
+[Run 743, test job 1621](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/743/jobs/1621), for `27657f31131cd95d42f0e1290853ec9c9b3959a4`, completed in **7m25s**; Gitea recorded the failed status at **2026-09-09 22:32:25 UTC** (September 10 locally). Repository safety/Compose, extension, parser, secret/SBOM, backend build and dependency checks passed. The full backend suite passed **916/916**, zero skipped (15s test duration); frontend passed **67/67 suites, 298/298 tests** (82.867s). Locked installation, npm audit, lint and the production frontend build all passed. The previous malformed `es-abstract` source did not recur at lint.
+
+The browser gate failed: **6 passed, 12 failed** (1.4m). The first failure was `worker process exited unexpectedly (code=null, signal=SIGSEGV)` in the authenticated accessibility case; its existing retry timed out in `beforeEach` after 30 seconds. The remaining eleven failures report `page.goto: Target page, context or browser has been closed`, including after their existing retries. There is no reported accessibility violation or application assertion mismatch in these failures. This establishes a process/browser execution failure, but does **not** establish its underlying host, runtime or hardware cause. The local **18/18** browser result above remains separate evidence and cannot replace the failed CI gate.
+
+[Deploy job 1622](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/743/jobs/1622) was **skipped**. At **2026-09-10 05:07:21 UTC**, read-only HTTPS requests still returned `/health` → `{"status":"ok","version":"299"}` and `/ready` → `{"status":"ready"}`. The requested commits are pushed to main, but this release has **not deployed**. No production service was replaced by this run.
+
+The documented stop condition is now reached: **no further unchanged-code release retries or gate bypasses**. Capture runner diagnostics before another attempt. This result is recorded on `codex/ui-redesign-audit` so that documenting the block does not itself start another main deployment. Phase 1 is complete; Phase 2 and B07 have not started. **B06 implementation complete, but F04 remains open**, for the runtime/production reasons in the closure checklist above as well as the unshipped release.
+
+#### Runner evidence to collect before another attempt
+
+Run these read-only commands on the actual Ubuntu **runner host**, which must be identified independently of the application host. No SSH alias or credentials are assumed. Use the run's timestamps for a bounded kernel-log window; the example covers this observed attempt. Do not reset Docker, delete caches, alter limits or restart production services just to obtain evidence.
+
+```bash
+date -u
+uname -srmo
+free -h
+df -h / /tmp /dev/shm
+df -i / /tmp
+docker ps -a --no-trunc --format '{{.ID}} {{.Names}} {{.Image}} {{.Status}}'
+docker stats --no-stream --format '{{.Name}} memory={{.MemUsage}} cpu={{.CPUPerc}} pids={{.PIDs}}'
+sudo journalctl -k --utc --since '2026-09-09 22:20:00 UTC' --until '2026-09-09 22:40:00 UTC' --no-pager \
+  | grep -Ei 'segfault|oom|out of memory|killed process|I/O error|machine check|hardware error|EDAC'
+# If systemd-coredump is installed: list metadata only, not memory dumps.
+command -v coredumpctl >/dev/null && \
+  coredumpctl --since '2026-09-09 22:20:00 UTC' --until '2026-09-09 22:40:00 UTC' --no-pager list
+# Select a verified runner/job container ID from the inventory, if it still exists.
+read -r -p 'Observed runner/job container ID: ' runner_container_id
+test -n "$runner_container_id" && docker inspect --format \
+  '{{.Name}} image={{.Image}} state={{json .State}} memory={{.HostConfig.Memory}} memorySwap={{.HostConfig.MemorySwap}} pidsLimit={{.HostConfig.PidsLimit}} shmSize={{.HostConfig.ShmSize}} ulimits={{json .HostConfig.Ulimits}}' \
+  "$runner_container_id"
+```
+
+Return selected, sanitized output plus the job-container identity/image and exact failure window. **Do not provide environment dumps, runner registration/config files, tokens, core files, full Docker inspection or unrelated logs.** A removed job container or unavailable kernel/core records is an evidence gap, not a clean bill of health. Host free memory after completion does not prove the earlier job's cgroup or shared-memory capacity. OOM/cgroup failures, segfault records, or storage/hardware errors would direct the next investigation; absent records do not justify guessing a cause. Retain the existing failed-job browser trace/error-context artifacts if available, keeping synthetic test data separate from production information. A successful full CI run, actual deploy completion and live version/health verification are still required before calling the push live; F04 then additionally requires its independent ingress evidence.

docs/audits/2026-09-07/validation/implementation-queue.md

@@ -32,7 +32,7 @@ The numbered order is the default integration order. Independent work may start
 
 | Order / ticket | Size and ownership | Concrete scope and acceptance | Dependencies / rollback risk |
 |---|---|---|---|
-| **R01a Standalone type gate** | S. `interview-prep.test.tsx`, UI package script, CI workflow. | Narrowly type/narrow the mocked request payload, add explicit standalone type checking to CI. Prove 13 interview tests, standalone tsc, and the changed workflow command. Keep strictness and test coverage. | Can run in parallel with Batch 0. No production-code behavior or schema. Do not weaken the gate to preserve a green build. |
+| **R01a Standalone type gate — partially resolved during authorized release repair, 2026-09-10** | S. `interview-prep.test.tsx`, UI package script, CI workflow. | The patched Next build exposed the historical TS2571. A test-only object matcher now preserves the positive/negative content assertions without dereferencing an unknown Axios payload; 13 interview tests, standalone tsc and Next build pass. An explicit standalone CI command remains outstanding; keep strictness and test coverage. See [release evidence](b06-completion.md#release-dependency-gate--2026-09-10-local--2026-09-09-utc). | Can run in parallel with Batch 0. No production-code behavior or schema. Do not weaken the gate to preserve a green build. |
 | **R01b Production DB configuration validation** | S. Provider-selection code in `Program.cs` and startup tests. | Fail startup for an unknown production provider or missing required configured connection. Preserve deliberate dev SQLite defaults and valid explicit SQLite/MariaDB. Assert no fallback database is created on rejected startup. | Integrate after Batch 0 `Program.cs` mutations. No schema; rejecting an existing invalid environment can prevent boot, so validate deployed inputs first. |
 | **R02 Consistent recovery-set creation** | M. `deploy.sh`, existing backup runner/scripts, isolated fixture and operator documentation. | Replace live SQLite tar as the DB consistency mechanism; coordinate file inventory/checkpoint or a short write pause, manifest/checksums and incomplete-set marking. Preserve keys/tombstone recovery. For MariaDB, coordinate the file set with the consistent SQL dump. | No new app schema. Can develop synthetic fixture in parallel with Batch 0. A backup that is only present is not yet verified. Keep previous verified sets. |
 | **R03 Restore drill and schema-compatible rollback** | M. Deploy rollback logic, isolated restore harness and runbook; no production restore in the implementation session. | Restore latest/previous synthetic sets under active-source writes; integrity, FK owner boundaries, attachment hashes, provider-token decryptability and deletion replay must hold. Run previous/new binaries against the intended schema; allow automatic image rollback only when compatible. Record measured RPO/RTO, required key custody and operator steps. | Depends on R02 and Connor's recovery objectives. **Blocks every schema-changing ticket below.** Failed restore is a stop, not permission to reset the source DB. Do not run downgrade migrations automatically. |

docs/redesign/README.md

@@ -40,3 +40,5 @@ AI should support this flow naturally and contextually. It must never invent fac
 These documents define the intended target state. They should be updated as the remaining functional work is completed. The full redesign implementation should begin only after a stable pre-redesign baseline has been created and protected by tests.
 
 2026-09-09: [Phase 1 source audit](audit/README.md) completed on `codex/ui-redesign-audit`: current routes, protected functionality, component/test/API inventories, identity/storage boundaries and proposed migration gates. No redesign implementation or B07 started. Required release checks and F04 production verification remain separate from this audit's completion.
+
+2026-09-10: [Final Phase 1 summary and scope classification](audit/PHASE1_SUMMARY.md) completes the audit checkpoint: 57 protected capability groups, 31 route patterns, existing-versus-new distinctions, preservation contract, baseline defects/tests and the recommended Phase 2 baseline session. This finalization changes documentation only. B06/F04 runtime and production closure remain open; no Phase 2+ work has started.

docs/redesign/audit/FUNCTIONALITY_INVENTORY.md

@@ -2,6 +2,8 @@
 
 This is the current source-backed preservation baseline. **All rows are Preserve** until a later approved migration explicitly records relocation, merger or deprecation. Target-only ideas are separated at the end. A component's existence proves implemented behavior, not live provider availability or usability quality. The [API census](API_CALL_SITES.md) and [component census](COMPONENT_INVENTORY.md) supply the individual call sites/consumers behind these groups.
 
+There are **57 protected capability groups**. The [completion summary](PHASE1_SUMMARY.md) classifies existing behavior, UX improvements, new requirements and known defects separately. A preserve-and-improve classification never removes a capability from this contract; known defective behavior is not the intended behavior to preserve.
+
 ## Entry, navigation and account
 
 | ID | Current user-facing function | Source / important contract |
@@ -57,8 +59,8 @@ This is the current source-backed preservation baseline. **All rows are Preserve
 | C03 | CV/file upload and extraction, rebuild/improve/reprocess, progress/history, diff, explicit low-confidence selection, accept/discard, retry/cancel | `CareerProfilePage`, `/profile-cv/*`; uploaded proposal is not silently canonical truth |
 | C04 | Evidence bank: sourced statement/title/category/tags, add/list/delete and truthfulness guidance | `CareerEvidenceBank`; evidence belongs to profile owner and is not AI-invented experience |
 | C05 | CV library create/name/copy/delete, template gallery and real sample thumbnails, publish/unpublish/share and PDF download | `CvBuilderPage`, `cvBuilder`; separate public slug from numeric private ID |
-| C06 | Studio Template/Content/Customize/AI Tools/History navigation; debounced preview and save state | `CvBuilderEditor`; existing mobile edit/preview and desktop split must retain parity |
-| C07 | Built-in item visibility/order, custom sections, preset/free-text section catalog, item/content overrides, hide/remove, keyboard reorder | `CvBuilderEditor`, `components/cv/*`; selected profile source and overrides remain distinguishable |
+| C06 | Studio Template/Content/Customize/AI Tools/History navigation; debounced preview, page boundaries/automatic fit and save state | `CvBuilderEditor`; existing mobile edit/preview and desktop split must retain parity; automatic fit is not a manual zoom control |
+| C07 | Built-in item visibility/order, custom sections, preset/free-text section catalog, item/content overrides, hide/remove, native section drag and keyboard reorder | `CvBuilderEditor`, `components/cv/*`, `useDragReorder`; selected profile source and overrides remain distinguishable |
 | C08 | Template-capability-aware typography/colors/header/headings, skills presentation/groups, one/two-column and sidebar settings, photo/icons | `CvCustomizeTab`, theme registry; retain unsupported-setting handling and server render equivalence |
 | C09 | A4/Letter, density, margins/spacing, date format, document language, per-section rows/grid/compact/bubbles and columns | `cvBuilder`, `CvCustomizeTab`, content controls; do not drop advanced controls merely to simplify layout |
 | C10 | Undo/redo of editor settings, save queue, unsaved guard, history/version restore and preview lifecycle | `CvBuilderEditor`; current queue serializes one mounted editor only, not concurrent browsers |
@@ -89,10 +91,12 @@ This is the current source-backed preservation baseline. **All rows are Preserve
 | A02 | Admin audit event list/detail, supported undo and job restore | `AdminAuditPage`; preserve event/ownership semantics rather than generic mutation buttons |
 | A03 | Separate system health/build/database/AI/email status, SMTP settings/test, AI probe, CV corpus benchmark and maintenance run controls | `AdminSystemPage`; sensitive config values/logs must not move into personal dashboard |
 
-## Target brief items that are not current features
+## Relationship to the target brief
 
 The target grouped navigation would reorganize an existing collapsible sidebar. Jobs/Table and Kanban can become view choices over the existing APIs. Dedicated Analytics/Documents/Notifications destinations would relocate embedded capabilities. They are not permission to delete offers, reminders, correspondence review, operations or legacy URLs.
 
-Dashboard drag/order/resize/reset and cross-device persistence are new work beyond the five local booleans. A general assistant/chat, goals system, new brand/name and additional email/calendar providers are not implied by existing contextual AI or integrations. Retain implemented Google/Outlook calendar actions even though the product brief describes broader calendar ambitions as future work.
+Dashboard drag/order/resize/reset are new work beyond the five local booleans; cross-device persistence is an unresolved scope choice. Optional goals, a new logo and expanded contextual access are separately identified additions; a general chat platform, product rename or additional providers are not implied by existing AI/integrations. Retain implemented Google/Outlook calendar actions even though the product brief describes broader calendar ambitions as future work.
+
+The [new-requirements matrix](PHASE1_SUMMARY.md#3-genuinely-new-requirements-and-conditional-additions) distinguishes required versus suggested/future additions: expanded command search/actions, application density, configurable status mappings, per-task scheduling, intent-led onboarding, contextual-assistant access and aggregate admin metrics. Existing raw custom status values, job reminders, onboarding checklist, operational admin dashboard and CV document density must remain intact; none alone establishes the corresponding new contract. The brief asks for contextual assistant access, not necessarily a general chat platform; a new logo is required, while a name change remains undecided.
 
 During migration, extend this table with destination, regression test and review evidence per ID. Do not treat a screen screenshot or a count of passing tests as proof that all rows survived.

docs/redesign/audit/PHASE1_SUMMARY.md

@@ -0,0 +1,117 @@
+# Phase 1 completion summary
+
+Completed **2026-09-10** on `codex/ui-redesign-audit`. This is an audit checkpoint, not a verified production release. **No visual redesign, component-library migration, route restructuring, Phase 2 implementation or B07 work has begun. B06/F04 closure remains open.**
+
+The detailed [architecture assessment](README.md), [functionality ledger](FUNCTIONALITY_INVENTORY.md), [route/workflow map](ROUTE_MAP.md), [API/identity map](API_AND_IDENTITY.md), [component inventory](COMPONENT_INVENTORY.md), [test assessment](TEST_INVENTORY.md) and [migration risks](RISKS_AND_MIGRATION.md) form this completed audit. The source census remains valid: the only `src`/`app` change since its checkpoint is the separately documented interview test assertion. This final completion commit changes documentation only.
+
+## 1. Existing functionality to preserve
+
+All **57 preservation IDs** in the full ledger remain protected, including features that already satisfy the brief. These are capability groups, not a claim of 57 individual controls or complete runtime test coverage.
+
+| Ledger IDs | Complete functional coverage by area |
+|---|---|
+| E01–E09 | Public plans; local and provider authentication; registration/verification/reset/email change; 2FA/recovery/trusted devices; sessions/logout; account identity/avatar/password; sidebar/command search; theme/localisation/shared feedback; cross-account state isolation |
+| J01–J10 | NAV discovery and saved alerts; reviewed manual/URL/paste capture; extension/bookmarklet capture; table/mobile cards/filter/sort/pagination/columns/saved views; edit/bulk actions/trash/restore; Kanban; companies/contacts; offer comparison; JSON/CSV export and import/conversion |
+| W01–W12 | Full job workspace and quick overlay/deep links; progression/timeline; analysis/match/strategy; checklist; CV selection/tailoring; cover letters/review/version restore; application drafts/frozen submitted packages; attachments; interview prep/debrief; reminders/calendar/notifications; asynchronous operations |
+| C01–C12 | Canonical Career Profile and long-tail sections; overview/completeness/history; file extraction/diff/accept/discard; evidence bank; CV library/copy/publish/share; responsive editor/preview; item and section visibility/order/overrides; template-aware customization; page/document settings; undo/redo/save/history; section/document AI review; private/public PDF |
+| M01–M06 | Job correspondence records; Gmail search/import/thread linking; global inbox/filter/attachment information; provider compose/reply/drafts/review/send/delivery uncertainty; Gmail review decisions; Google/Microsoft/IMAP connections |
+| S01–S05 | Personal analytics/next actions; owner-local widget visibility/onboarding/notifications; follow-up/email/table/theme/language preferences; AI privacy/usage/Free–Pro/billing capabilities; account export/encrypted backup/lifecycle/deletion |
+| A01–A03 | Admin user/role/reset/deletion guards; audit/undo/restore; separate operational diagnostics/email settings/AI probes/CV benchmarks/maintenance |
+
+The route map accounts for **31 concrete patterns: 29 page patterns and two compatibility aliases**. It also records not-found/error boundaries and non-route entry points: capture query strings, command search, notification links, workspace section/tab aliases, OAuth popups and public CV slugs. Embedded Documents, Analytics and Notifications functionality is inventoried even though these are not current standalone routes.
+
+Protected workflows include discover/capture → review/create → analyse/match → select/tailor CV → prepare material → submit/freeze package → track/remind → interview/outcome; import CV → review canonical profile → create/edit/publish/export variant; inbox/import → link → draft/review/send; and account/session/admin lifecycle. Exact sub-actions and source owners are in the ledger; a redesigned page must not silently omit its nested functions.
+
+## 2. Existing functionality needing UX improvement
+
+These are **preserve-and-improve**, not missing features or authorization to implement them now. Assessment concerns coherence/discoverability unless a defect is explicitly identified in section 4. No new user study or visual/manual accessibility session is claimed.
+
+| Existing capability / IDs | Already satisfies the brief | Remaining UX work |
+|---|---|---|
+| Navigation and command launcher, E07 | Collapsible sidebar, section support, mobile drawer, active child-route matching, Ctrl/Cmd+K job/company search | Main features currently share one broad Manage group. Improve grouping and discoverability; retain account/admin separation. Extra command capabilities are new scope below |
+| Job views and workspace, J05–J07, W01–W12 | Desktop table/mobile cards, saved views, keyboard Kanban, full job page and shared quick overlay, next actions and artifact relationships | Present table/board as views of one workspace; clarify section hierarchy and full-page/preview transitions. Preserve every alias, status and nested workflow |
+| Career and CV, C01–C12 | Canonical profile, document overrides, real template previews, page boundaries/automatic fit, drag and keyboard reorder, undo/history, desktop split/mobile edit-preview, PDF | Improve source-versus-override clarity, advanced-control discovery and preview focus. Keep advanced existing controls despite the brief's shorter suggested list |
+| Contextual AI, W03/W05/W06/W09, C03/C11 | Context selection, source material, preview/diff and accept/reject already exist | Standardize current/suggested/evidence presentation and locked/error states. Presence of review UI is not proof that every AI output is factually correct |
+| Dashboard/onboarding, S01–S02 | Metrics/trends, next actions, five owner-local visibility switches, guided checklist/dismissal | Improve hierarchy and empty/loaded states; additional widget/layout contracts are new work |
+| Mail/documents/notifications, M01–M06, W06–W08/W11–W12 | Drafts, explicit send/review, delivery states, job-linked files, inbox/review, reminders and operations | Make destinations and status distinctions easier to find. Unified navigation relocates these capabilities; it does not replace their persistence contracts |
+| Calendar and account/settings/admin, W11, E02–E06, S03–S05, A01–A03 | Follow-up/deadline Google/Outlook event creation and ICS; account controls; separate admin tools | Preserve provider availability/permission handling and clarify account versus career versus provider identity; keep operational diagnostics separate from personal data |
+| Themes/localisation/responsiveness, E08 and all flows | MUI theme, light/dark/system, EN/Bokmål and existing workflow adaptations | Standardize tokens, layout/focus/error states and test populated EN/NB/mobile surfaces. New density and brand choices are separate requirements |
+
+## 3. Genuinely new requirements and conditional additions
+
+These distinctions come from comparing the brief to the current handlers/models, not from treating every desired noun as a missing page. Proposed defaults are not permission to change stored data.
+
+| Brief requirement | Current boundary / incremental work | Scope decision |
+|---|---|---|
+| Dashboard ordering, resizing, reset and remembered layout | [DashboardView](../../../job-tracker-ui/src/components/DashboardView.tsx) persists only `cards/activity/funnel/companies/skills` visibility flags | New layout behavior. Decide device-local versus cross-device persistence before backend/schema work; Phase 8 |
+| Expanded command palette | [QuickCommandDialog](../../../job-tracker-ui/src/components/QuickCommandDialog.tsx) searches jobs/companies and has six static commands | Add CV/document search, CV creation, Career Profile, appearance/language and contextual commands where specified; reuse existing actions |
+| Comfortable/compact application density | Theme/table display preferences exist; CV **document** density exists | New application preference affecting chosen dense surfaces; do not confuse it with document density |
+| Configurable statuses and category mapping | [JobPipeline](../../../JobTrackerApi/Services/JobPipeline.cs) preserves free-text/custom values; [pipeline.ts](../../../job-tracker-ui/src/pipeline.ts) defines fixed groups and an Other fallback | New configuration/mapping workflow. Preserve Waiting/Ghosted, raw values, analytics and rules; never replace statuses with the brief's suggested list |
+| Per-task due dates and notifications | [Checklist model](../../../JobTrackerApi/Models/ApplicationChecklistItem.cs) stores status/order/completion; follow-up and deadline dates belong to the job | New task scheduling contract if adopted. Existing job reminders do not prove per-task scheduling |
+| Optional editable weekly goals | Existing analytics and onboarding do not store a weekly target | New optional capability with supportive defaults; no universal application quota |
+| Intent-led onboarding and suggested profile preferences | [OnboardingChecklist](../../../job-tracker-ui/src/components/OnboardingChecklist.tsx) links existing account/profile/job/provider steps; it does not collect the brief's initial job-seeker intent | New intake/personalization scope if adopted. Suggested desired-role/remote/salary preferences need an explicit data contract; do not infer them from job salary/location |
+| Shared contextual-assistant entry and command actions | Domain-specific AI controls/wrappers exist; no persistent shell assistant is wired into the current route graph | New interaction surface/reuse work. A general-purpose chat platform is not required to satisfy contextual access |
+| Aggregate product/admin dashboard and candidate metrics | [AdminSystemPage](../../../job-tracker-ui/src/views/AdminSystemPage.tsx) is operational; personal dashboard analytics already exist | Cohort/adoption/conversion and CV-performance additions require defined measures, permitted aggregate data and availability. Candidate widget lists are not a promise every metric exists or must ship; correlation is not causation |
+| Manual CV preview zoom | [CvBuilderEditor](../../../job-tracker-ui/src/views/CvBuilderEditor.tsx) automatically fits page width; drag reorder, pagination and history already exist | Manual zoom is a recommended incremental control, not a reason to rebuild the preview or declare all builder capabilities missing |
+| Logo and brand treatment | Existing mark/theme remain functional | New logo is required by the brief; exact accent/name decisions are deferred. No automatic product rename |
+| Broader event/provider support, priority/favourite and optional quick-drawer form | Existing calendar actions cover follow-up/deadline; current quick overlay is functional; suggested fields/providers are not all current contracts | Conditional product additions or presentation choices. Broader calendar is explicitly future scope. Do not remove existing integration or introduce schema merely to match illustrative examples |
+
+Grouped navigation, a Jobs view switch, and clearer Documents/Analytics/Notifications destinations belong to **section 2's reorganization of existing behavior**; they do not automatically require new APIs or a new resource model. New analytical measures or cross-job queries must be scoped separately from relocating existing views.
+
+## 4. Known baseline defects and technical/UX debt
+
+The existing validated queue owns these defects; this final audit pass records them and does not fix or re-audit them. Prior independently reproduced findings remain distinct from source-only risks and unresolved production evidence.
+
+| Status / owner | Known issue relevant to redesign | Required treatment |
+|---|---|---|
+| Open, F01 / D01–D03 | CV/profile/job lost-update and atomic-history/projection contracts | Preserve existing history; a mounted editor's save queue does not solve concurrent writers. Coordinate before changing persistence/conflict UX |
+| Open, D04–D07 | Duplicate creation intent, concurrent/omitted byte accounting and export/history growth | Preserve current warnings/quotas; do not silently add idempotency, retention or storage redesign |
+| Open, F14 / A01–A03 | Previously validated shared contrast and preview keyboard-scroll defect; thin loaded-state accessibility coverage | Track structural fixes separately; no compliance claim from shell-only axe samples |
+| Open, W01/W05 | Calendar date/timezone correctness and private unsaved-draft recovery scope | Preserve current semantics while documenting defects. Do not persist private drafts across accounts or invent new storage |
+| Open, R01b/R02/R03/R05 and paid-lifecycle queue | Production DB fallback validation, consistent backup/restore/rollback proof, worker survival, billing entitlement/deletion | Separate owners and release gates. No schema work before recovery proof; billing UI cannot establish entitlement correctness |
+| Historical error fixed; R01a partly open | `interview-prep.test.tsx:120` TS2571 reproduced, then corrected with a test-only matcher during authorized release repair | Standalone tsc now passes. Explicit standalone CI gate is still missing; do not continue calling TS2571 an active failure |
+| Current CI block | Run 743 browser worker SIGSEGV, then timeout/closed-browser errors; deploy skipped | Obtain runner diagnostics before another release attempt. Do not weaken gates or label the crash an application assertion failure |
+| Source-backed maintainability/UX debt | Two router layers; large stateful forms; mixed breakpoints; hardcoded shell colors alongside theme; hardcoded English mobile accessible name | Small, tested future changes. Module size is not performance evidence; cleanup candidates are not approved deletions |
+| Unverified risk | Router identity changes with display preferences; optional labels/select patterns; loaded EN/NB/theme/mobile/manual accessibility gaps | Targeted regression/manual checks needed. Do not promote these to reproduced security defects |
+| Open, B06/F04 | Actual deployed ingress trust and bypass protection remain unproven | Separate production verification below; repository checks cannot close it |
+
+See [validated ticket boundaries](../../audits/2026-09-07/validation/implementation-queue.md), [test limitations](TEST_INVENTORY.md) and [regression-risk evidence](RISKS_AND_MIGRATION.md). Identity isolation, record concurrency and creation idempotency remain three different contracts.
+
+## Functionality preservation contract
+
+Every ledger ID defaults to **preserve**. Before migrating a workflow, record its destination, retained actions/state transitions, exact API/data meaning, permission/session boundary and regression evidence. Relocation/merger must retain capability; deprecation requires an explicit documented decision. No deletion is approved in this audit.
+
+Preserve direct links/aliases/capture/OAuth flows; owner/session/role/entitlement checks; canonical Career Profile versus document overrides; AI preview/reject/apply and factual provenance; dirty/conflict recovery and private-state disposal; server drafts/history/frozen packages and uncertain-send behavior; publication versus private downloads; B01–B05 safety contracts; typed date/JSON/CSV/PDF formats and Norwegian text. Existing backend defects are recorded for their own tickets, not redefined as acceptable intended behavior.
+
+A migrated workflow needs same-account success and cross-account denial, populated/empty/error/locked states, EN/NB, light/dark, desktop/mobile, keyboard/focus and artifact checks appropriate to its behavior. A screenshot, module presence or aggregate test count alone is insufficient preservation evidence.
+
+## Frontend architecture and stack assessment
+
+**Retain the current stack.** React 19/strict TypeScript is a client-rendered SPA packaged by Next 16 static export, with React Router 7 owning application routes and nginx handling static/deep-link/API routing. MUI 7, MUI X, Emotion and MUI icons already provide the foundation; styling combines central theme/global CSS and substantial local `sx`. TanStack Table is used, not TanStack Query. No Redux/Zustand/cache-platform replacement is warranted.
+
+Local React state and focused contexts own forms/auth/theme/language/plan/feedback; shared Axios owns cookies/XSRF/B02 request provenance/cancellation and blob downloads. The API census contains **266 call expressions**; ownership is server-enforced. Improve shared component contracts and existing tokens before page migration. No demonstrated limitation justifies replacing the component library, routing or backend.
+
+## Test and CI baseline
+
+| Evidence | Result / limit |
+|---|---|
+| Latest completed CI, run 743 at main `27657f3` | **916/916 backend**, zero skips; **67 suites / 298 frontend tests**; lint, dependency audits, Compose/safety/parser and production builds passed |
+| Same CI browser gate | **6 passed / 12 failed**; initial worker SIGSEGV, retry timeout and closed-browser errors. Deploy skipped; not a green release |
+| Local release checks at `a861ca4`, unchanged source since | **18/18 browser**, standalone tsc, lint and static build passed; installed npm audit zero vulnerabilities. Local success does not replace CI |
+| Prior B06 focused tests | **166 backend, 3 Compose, 6 native Production ingress, 9 native B04 HTTP** checks passed; no actual Traefik/nginx topology |
+| Accessibility/test census | 76 frontend test files, 106 backend test-source files; general axe samples eight routes in English, not all loaded interactions/manual accessibility |
+| Final audit-only validation | **621 local links valid, 57 unique ledger IDs, 31 route patterns, 266 API rows, all 120 production source files match the census**; only intervening `src` change is the documented test assertion. Secret scan and diff checks pass; application suites were not rerun for prose edits |
+
+Exact commands, historical failures and classification are preserved in [TEST_INVENTORY](TEST_INVENTORY.md) and the [release report](../../audits/2026-09-07/validation/b06-completion.md#final-release-retry--2026-09-10). Previous CI/build changes were separate authorized release/baseline repairs: Compose availability, Linux fixture/runtime/TLS-test portability, blocking dependency advisories and the test-only TS2571 correction. They are not redesign implementation, and this final pass adds none.
+
+## Unresolved production validation
+
+**B06 implementation complete, but B06 runtime/production closure and F04 remain open.** Intended path: Traefik → host 3000 → nginx → internal API 8080. Docker Desktop's inference-socket failure prevented the real local container chain. No verified production SSH alias was available; no credentials or CI secrets were obtained.
+
+Actual nginx startup/fail-closed configuration/restart, Traefik socket peer and trusted CIDR, backend client IP/scheme, real-chain B02/B04 behavior, host/container listeners, firewall/NAT/IPv6 and independent direct-port denial still need evidence. Public DNS/valid HTTPS were observed, but intended-address inventory and the HTTP redirect to unreachable HTTPS port 444 remain unresolved. Live `/health` last observed **2026-09-10 05:07 UTC**, version **299**, ready; this is not deployment of the pushed audit repairs. Exact safe operator commands and expected evidence remain in the [B06 report](../../audits/2026-09-07/validation/b06-completion.md).
+
+## Recommended Phase 2 starting point
+
+Start only when separately authorized: **a bounded functional-baseline session, with no layout or route changes**. Add the explicit standalone type-check script/CI step while coordinating with runner repair; map the 57 preservation IDs to existing assertions and add the highest-risk missing tests for route/overlay/capture parity, populated CV/profile overrides and AI accept/reject. Preserve real API/B02 identity tests and B01/B03/B04/B05 suites.
+
+Exit requires a documented pass/fail/unavailable baseline, meaningful loaded-workflow proof and a preservation checklist tied to tests. Existing defects stay separately ticketed; failed tests are not made green by weakening expectations. Record-integrity and recovery prerequisites govern later persistence/schema work. Phase 3 navigation proposals and Phase 4 visuals follow their own checkpoints; no stable/live tag or F04 closure is warranted while their evidence is missing. Branding, product additions and cross-device layout decisions do not block this audit's completion.

docs/redesign/audit/README.md

@@ -4,12 +4,17 @@ Date: 2026-09-09. Source checkpoint: `97fce89c002fe86e737ca7387170321d464b80d7`
 
 **Phase 1 source audit complete; redesign implementation has not started.** The repository already implements much of the proposed workflow. Retain its MUI/React foundation and domain contracts, improve shared semantics, then migrate representative screens in small steps. A replacement frontend framework or component library is not justified by the observed problems.
 
+Finalized 2026-09-10: [Phase 1 completion summary](PHASE1_SUMMARY.md) explicitly separates existing functionality to preserve, existing functionality needing UX improvement, new/conditional requirements and baseline defects/debt. It includes the preservation contract, validation limits and bounded Phase 2 starting point. All 57 ledger IDs remain protected; this is a separate documentation checkpoint, not a stable/live release tag.
+
 This is a source and regression-evidence audit, not a new visual usability study, production certification, or execution of security ticket B07. The existing security queue still governs unresolved integrity/recovery work. F04 remains open. A pushed revision is not proof of a successful deployment; see [release evidence](../../audits/2026-09-07/validation/b06-completion.md#authorized-release-attempt-and-ci-prerequisite-correction).
 
+Release status, 2026-09-10: main `27657f3` is pushed. Run 743 passed 916 backend and 298 frontend tests, lint, audits and production builds, but the browser gate failed with a worker SIGSEGV and subsequent browser-closed errors; deployment was skipped. Further release attempts await runner diagnostics. The live endpoint still reports version 299. This does not block delivering the Phase 1 findings, but it does block claiming a verified live checkpoint for subsequent work.
+
 ## Deliverables and method
 
 | Handoff requirement | Evidence |
 |---|---|
+| Final summary and four-way scope classification | [Phase 1 completion summary](PHASE1_SUMMARY.md) |
 | Architecture, styling, state | This document |
 | Every declared route/page | [Route map](ROUTE_MAP.md): 31 concrete route patterns, including two redirect aliases; 29 page patterns |
 | Existing user functionality | [Preservation ledger](FUNCTIONALITY_INVENTORY.md), including nested screens and non-navigation entry points |
@@ -87,6 +92,6 @@ The automated axe suite samples eight routes and largely waits for `body`/`main`
 2. The full job workspace, canonical Career Profile, contextual AI review, CV history and adaptive mobile surfaces already exist. The redesign should improve coherence and discoverability.
 3. Shared visual semantics and loaded-state accessibility coverage are weaker than the broad test count suggests. Fix foundations before whole-page migration.
 4. Five local dashboard visibility switches are not the proposed configurable dashboard. Ordering, resizing and cross-device persistence are future scope requiring a bounded contract.
-5. The known standalone TypeScript failure reproduces. The source baseline is documented, but release/production and unresolved integrity gates must not be called green by implication.
+5. The known standalone TypeScript failure reproduced during the audit; subsequent authorized release repair `a861ca4` corrected its test-only assertion after patched Next made it build-blocking. Standalone tsc now passes; an explicit standalone CI gate remains outstanding. Release/production and unresolved integrity gates must not be called green by implication.
 
 Next work is **Phase 2 — Functional baseline**, subject to the gates in [RISKS_AND_MIGRATION](RISKS_AND_MIGRATION.md). No Phase 2 code, B07, or redesign component changes were made here.

docs/redesign/audit/RISKS_AND_MIGRATION.md

@@ -11,7 +11,7 @@ This report proposes the next steps; it does not authorize or implement Phase 2,
 | Creation replay becomes easier through capture/dialog rerenders | Preview/duplicate warning and subsequent create are separate requests | Preserve current review flow; existing D04 creation-intent ticket is distinct from identity and record revision. No idempotency work in this audit |
 | Route consolidation loses entry contracts | Two router layers, legacy `/applications/:id`, old section mappings, `?add`, notification/company deep links | Route manifest + redirect tests before moving navigation; keep capture and OAuth callbacks functional |
 | New styling repeats existing contrast/focus defects | Validated F14 theme pair contrast; builder preview scroll-region transition | A01 semantic foreground/background/state colors, A02 preview structure, A03 loaded/manual verification before broad page work |
-| Thin initial-state tests create false confidence | Eight-route axe sample; component API mocks; standalone TS2571 | Phase 2 loaded-interaction and type baseline; require feature-ledger evidence per migrated workflow |
+| Thin initial-state tests create false confidence | Eight-route axe sample; component API mocks; historical TS2571 now corrected during release repair | Phase 2 loaded-interaction and explicit standalone type gate; require feature-ledger evidence per migrated workflow |
 | CV/profile semantics blur in a unified editor | Canonical profile save versus CV override/settings and published slug | Clearly display source versus document override; test master unchanged, source selection, history, publish/unpublish and long PDF |
 | AI presentation implies facts or silently applies changes | Contextual suggestions and extraction accept/discard already exist | Preserve preview/reject/apply and source/context metadata; prompt instructions alone do not prove factual accuracy |
 | Draft/history/mail/package behavior lost in visual simplification | `ApplicationAssets` 769 lines, inbox 750, correspondence 747; separate persistence/attempt APIs | Extract by cohesive responsibility, not one generic form; keep conflict/send uncertainty, frozen package and unsaved guards |
@@ -28,7 +28,7 @@ Line counts come from the [source census](source-inventory.json); they are prior
 ## Recommended order
 
 1. **Finish the authorized release attempt and retain the checkpoint.** Required CI and deploy preflight must pass before calling the changes live. Production F04 runtime/firewall/DNS/peer checks remain a separate closure gate. Audit/planning can continue without claiming Phase 0 stability.
-2. **Phase 2 — Functional baseline.** Narrow TS2571 and add full type checking; trace preservation IDs to existing tests; add missing loaded workflow/route/AI-review tests. Preserve B01–B06 regression suites. Coordinate outstanding record-integrity and recovery tickets through their existing queue, without silently starting them here.
+2. **Phase 2 — Functional baseline.** Add explicit standalone CI type checking (the TS2571 assertion was corrected separately in release repair `a861ca4`); trace preservation IDs to existing tests; add missing loaded workflow/route/AI-review tests. Preserve B01–B06 regression suites. Coordinate outstanding record-integrity and recovery tickets through their existing queue, without silently starting them here.
 3. **Phase 3 — UX architecture.** Define grouped navigation, Jobs view switch, destination for embedded Documents/Analytics/Notifications, full-page/preview contract, contextual AI pattern and mobile workflow rules. Map every current route/feature to its destination and backward-compatible entry. Keep API contracts.
 4. **Phase 4 — Shared foundations.** Use existing MUI/Emotion/theme system. Resolve proven semantic contrast and focus defects, then unify tokens, page/layout/state primitives, labelled fields, buttons, dialogs/drawers and tables. Avoid a speculative new design-system framework.
 5. **Phase 5 — Representative migration.** Shell → Jobs table/board entry → full job workspace → CV editor; dashboard presentation can join after shell tokens stabilize. Preserve a data-rich populated example, empty/error/locked case, mobile and keyboard path for each. Do not modify editor save semantics concurrently with integrity work.
@@ -44,7 +44,7 @@ No router/state/styling dependency replacement is currently recommended. If a la
 
 | Suggested future scope | Boundaries / expected proof | Parallel constraints |
 |---|---|---|
-| Type and baseline bookkeeping | One test payload narrowing, explicit type script/CI gate, known-failure classification | Independent of visual work; coordinate CI edits with deployment repair |
+| Type and baseline bookkeeping | Preserve the corrected test assertion; explicit type script/CI gate, known-failure classification | Independent of visual work; coordinate CI edits with deployment repair |
 | Route/preservation regression | Existing route helpers, full/overlay/capture navigation tests | Do not change router structure at the same time |
 | Theme semantic contract | Central theme/MUI states + representative loaded contrast fixtures | Separate from backend; integrate before page styling |
 | Builder focus contract | Actual preview container, viewport transition and keyboard scroll tests | Must not run concurrently with D01/editor save refactor |

docs/redesign/audit/TEST_INVENTORY.md

@@ -31,15 +31,18 @@ The default browser suite currently contains **18 tests**. The nine special brow
 | Fresh release-prerequisite checks | `python scripts/test-ingress.py` → 3/3 pass; real standalone Compose path also tested; official downloaded Linux binary digest verified; tracked-secret scan and diff check pass |
 | Fresh packaging regression at `23cc250` | Explicit installed .NET 9.0.317 SDK: Release build + **22/22 PDF admission tests** pass, then **915/915 selected backend tests** pass (same documented external-DNS IMAP exclusion). Results: `.artifacts/redesign-audit/backend.trx` |
 | Actual CI push verification | Runs 736/737 exposed missing Compose/token prerequisites; corrected. Run 738 passed Compose/safety/extension/parser/API build, then exposed Linux PDF test-fixture packaging collision. Follow-up result belongs in [release log](../../audits/2026-09-07/validation/b06-completion.md#authorized-release-attempt-and-ci-prerequisite-correction) |
+| Fresh Linux backend confirmation | Run 741, `2024c37`, passed **916/916 backend cases**, zero skipped, after test packaging/runtime-location and TLS EOF-or-no-read portability corrections. This includes the locally excluded DNS-dependent case. Application behavior and all security assertions remain protected; deployment has separate gates |
+| Subsequent authorized release correction, `a861ca4` | Next 16.3.4/sharp 0.35.4/js-yaml 3.15.2 resolve three blocking dependency entries: installed npm audit **zero vulnerabilities**. Fresh **298 frontend / 18 browser** pass, plus **13 interview tests** after the test-only TS2571 correction. Standalone tsc, lint and production static build pass. Exact commands and failed-before evidence remain in the B06 release log; this is release repair, not a redesign implementation |
+| Final CI retry, run 743 at `27657f3` | **916 backend / 298 frontend** pass, zero backend skips; Compose/safety/parser, dependency audits, lint and production builds pass. Browser gate: **6 passed / 12 failed**, beginning with worker SIGSEGV, then retry timeout and closed-browser navigation errors. Deploy skipped. Repeated process crashes reached the bounded stop condition; runner-host evidence is required before another release attempt. See [exact result and diagnostic handoff](../../audits/2026-09-07/validation/b06-completion.md#final-release-retry--2026-09-10). Local browser success is not a replacement for CI |
 | Live/container boundary | Local Docker engine unavailable; F04 production evidence remains incomplete. No audit claim of real proxy-chain success |
 
 The selected broader backend suite was repeated for the PDF fixture packaging change; the frontend suite was not repeated merely for documentation edits. Preserve the distinction between prior unchanged-source evidence, newly executed checks and actual CI failures. Run 739 subsequently failed earlier in the unchanged API compiler with `csc.dll` exit 139 on both existing attempts; it did not reach the corrected test-project build. No test gate was bypassed.
 
 ## Exact TypeScript root cause
 
-[Interview test:120](../../../job-tracker-ui/src/interview-prep.test.tsx#L120) reads `.content` from `mockedApi.post.mock.calls[0][1]`. Axios's mocked generic request-data argument is typed `unknown`; the test dereferences it without narrowing. The runtime assertion can pass because Babel removes types. The production component's emitted behavior is not shown broken by this test diagnostic.
+[Interview test:120](../../../job-tracker-ui/src/interview-prep.test.tsx#L120) originally read `.content` from `mockedApi.post.mock.calls[0][1]`. Axios's mocked generic request-data argument is typed `unknown`; the test dereferenced it without narrowing. The runtime assertion passed because Babel removes types. The production component's emitted behavior was not shown broken by this test diagnostic.
 
-[tsconfig](../../../job-tracker-ui/tsconfig.json) includes `src`, including tests. CI runs Jest/lint/Next build but has no explicit full standalone `tsc --noEmit` gate. Next's successful build is not evidence that this exact standalone test-inclusive program passed. Phase 2 should narrow the test payload appropriately and introduce a deliberate full type gate. Do not weaken strictness, blanket-exclude tests or call this a P1 production outage. No type fix was made in Phase 1.
+[tsconfig](../../../job-tracker-ui/tsconfig.json) includes `src`, including tests. CI runs Jest/lint/Next build but has no explicit full standalone `tsc --noEmit` gate. The patched Next 16.3.4 release build independently failed on this exact diagnostic. Authorized release repair `a861ca4` replaced the property dereference with an object matcher, retaining both positive prompt and negative invented-content assertions. Fresh standalone tsc, 13 interview tests and Next build now pass. The original Phase 1 reproduction above remains historical evidence. Phase 2 still needs a deliberate standalone CI gate; no strictness or test coverage was weakened.
 
 ## Missing regression proof before redesign
 

docs/todo/work.md

@@ -1,11 +1,14 @@
 # Redesign — 2026-09-09
 
 - [x] Read the Astra handoff and required product documents; complete Phase 1 source audit with 31 concrete route patterns, functionality preservation ledger, 266 API call sites, component/test inventory, identity/storage map, responsive/localisation assessment and migration gates. See `docs/redesign/audit/README.md`. No redesign implementation or B07 started.
-- [ ] Complete the authorized `main` release through required CI/deploy gates; commits are pushed, but a push alone is not live confirmation. Compose runner prerequisite and Linux PDF fixture packaging failures were fixed without weakening tests; current outcome is recorded in the B06 completion report.
+- [x] Finalize Phase 1 separately, 2026-09-10: classify all 57 preservation groups, UX improvements, genuinely new/conditional requirements and baseline defects; retain already-implemented CV drag/fit, custom status values, calendar and other protected workflows. Final summary/contract/test limits/Phase 2 starting point: `docs/redesign/audit/PHASE1_SUMMARY.md`. Documentation only; B06/F04 closure remains open.
+- [ ] Complete the authorized `main` release through required CI/deploy gates. Main `27657f3` is pushed; run 743 passed 916 backend/298 frontend tests, lint, dependency audits and production builds, then the browser gate failed (worker SIGSEGV, retry timeout and closed-browser errors; 6 passed/12 failed). Deploy skipped; live remains version 299. Stop further release retries pending runner-host diagnostics; exact read-only handoff and evidence are in `docs/audits/2026-09-07/validation/b06-completion.md`. No gate was bypassed.
 - [ ] Next redesign work: Phase 2 functional baseline, subject to the audit's integrity/recovery and release gates. No automatic implementation in Phase 1.
 
 # Expanded production audit — 2026-09-07
 
+- [x] Authorized release repair, 2026-09-10: patch Next/sharp/js-yaml dependency advisories; preserve deliberate React Router full navigation and correct the historical TS2571 test assertion when the patched Next build makes it release-blocking. Local standalone tsc/build and 13 interview tests pass. R01a's explicit standalone CI command remains outstanding; deployment and F04 closure are separate gates in the B06 report.
+
 - [ ] B06 implementation complete; **F04 open, runtime/production verification incomplete**. Fresh 166 focused backend, 3 Compose, 6 Production HTTP and 9 B04 HTTP checks pass; prior broader/build evidence retained. Public DNS/valid HTTPS observed; ports 3000/5202/8080 unreachable from this workstation. HTTP redirects to unreachable HTTPS port 444. Docker inference-socket failure blocks real Compose/Traefik/nginx tests; actual peers/backend client IP and production host/firewall evidence require operator handoff (no documented SSH alias). See `docs/audits/2026-09-07/validation/b06-completion.md`. B01–B05 preserved; B07 not started.
 
 - [x] B05 only: shared spreadsheet-safe text policy across all 13 CSV text columns; typed fields/storage/JSON unchanged. Original Excel `=1+1` evaluation now literal text; UTF-8 BOM and byte-preserving download retain Norwegian text. 25 focused CSV cases, 902 broader backend, 298 frontend, 18 browser tests, nine unchanged B04 HTTP scenarios and B03 admission probe pass; Release builds/lint pass. Existing R01a TS2571 remains. Evidence: `docs/audits/2026-09-07/validation/b05-completion.md`. B06 recommended next, not started.

job-tracker-ui/eslint.config.mjs

@@ -15,6 +15,8 @@ export default defineConfig([
       "react-hooks/purity": "off",
       "@next/next/no-page-custom-font": "off",
       "@next/next/no-img-element": "off",
+      // React Router owns this static SPA; full navigation also clears private session state.
+      "@next/next/no-location-assign-relative-destination": "off",
     },
   },
   {

job-tracker-ui/package-lock.json

@@ -26,7 +26,7 @@
         "@types/react-dom": "^19.2.3",
         "axios": "^1.19.0",
         "date-fns": "^4.1.0",
-        "next": "^16.2.12",
+        "next": "^16.3.3",
         "react": "^19.2.4",
         "react-dom": "^19.2.4",
         "react-router-dom": "^7.18.2",
@@ -42,7 +42,7 @@
         "@types/jest": "^30.0.0",
         "babel-jest": "^30.4.1",
         "eslint": "^9.39.5",
-        "eslint-config-next": "^16.2.12",
+        "eslint-config-next": "^16.3.3",
         "identity-obj-proxy": "^3.0.0",
         "jest": "^30.4.2",
         "jest-environment-jsdom": "^30.4.1"
@@ -2610,9 +2610,9 @@
       }
     },
     "node_modules/@img/sharp-darwin-arm64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.35.3.tgz",
-      "integrity": "sha512-RMnFX7YQsMoh7lWfcM4NEHHymBX/rLuKNPVM84XE9ONPcaSCDgE7CHIHpSgPcO2xcRthgBy1HfNO319mwhIAkg==",
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.35.4.tgz",
+      "integrity": "sha512-Uhfl4V4lhP2nbUVF9+hyH1+luj86f1gUFeo8ALYxFoULoU+G87D43BfeMP8XHsk9boxAnCY/bf2EHwhA7MuGsA==",
       "cpu": [
         "arm64"
       ],
@@ -2628,13 +2628,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-darwin-arm64": "1.3.2"
+        "@img/sharp-libvips-darwin-arm64": "1.3.3"
       }
     },
     "node_modules/@img/sharp-darwin-x64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.35.3.tgz",
-      "integrity": "sha512-Xo+5uFBtLN0BKqieTxiFzFPQAUlBbbH5iBKyRX/z1JrbnYsHTfKJnUfL8+p2TPXr1pXqao4eeL4Rl144uDpK9w==",
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.35.4.tgz",
+      "integrity": "sha512-hWniXY3bG5qKpkKrAwPe4y+VTPmf086YQAnkxWh7uA1YrlRouWGa0M0Mxj3ZjnXFkv7/TD1bTy9lGUK26vRvWw==",
       "cpu": [
         "x64"
       ],
@@ -2650,20 +2650,20 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-darwin-x64": "1.3.2"
+        "@img/sharp-libvips-darwin-x64": "1.3.3"
       }
     },
     "node_modules/@img/sharp-freebsd-wasm32": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-freebsd-wasm32/-/sharp-freebsd-wasm32-0.35.3.tgz",
-      "integrity": "sha512-lUxcqWIj2wMQ9BrwNjngcr1gWUr5xgaGThBRqPPalIC2n67Cqj1uPh8NnA/ZhAg8hUbKl+kVHKwgUIwe6ZYPrg==",
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-freebsd-wasm32/-/sharp-freebsd-wasm32-0.35.4.tgz",
+      "integrity": "sha512-lIsKw/BU+kjB4eZjxrYrZmwOJYi3Ajrv66iAlBmUPyKc3HpnloevB1g3wxGD9P/5BbQ1brBGl65VRRrCvQDEqA==",
       "license": "Apache-2.0",
       "optional": true,
       "os": [
         "freebsd"
       ],
       "dependencies": {
-        "@img/sharp-wasm32": "0.35.3"
+        "@img/sharp-wasm32": "0.35.4"
       },
       "engines": {
         "node": ">=20.9.0"
@@ -2673,9 +2673,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-darwin-arm64": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.3.2.tgz",
-      "integrity": "sha512-9J6ypZFpQBj4YnePGoq/S38w6nz+vqg5WZLrLGY4YuSemdMq47GMLBPO42MzwdGwpg/agZ7xzZcFHa48xlywfg==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.3.3.tgz",
+      "integrity": "sha512-suTBPTDGrI9WodccaDdwZItTSaBYASlBk1NSfElSHrUfzu3szG6lvIF58+WiFvnfzuK8ZBFS5zE00PxqxnRiPg==",
       "cpu": [
         "arm64"
       ],
@@ -2689,9 +2689,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-darwin-x64": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.3.2.tgz",
-      "integrity": "sha512-m2pW1n6cns9VaubNwsZ+c3CRYjxNQWgJ5gPlnL1nbBcpkBvFm6SCFN5o0psFHI8w9n11NKhFkeEDns98tiqbEw==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.3.3.tgz",
+      "integrity": "sha512-FVJZ5mITMobmXIz/hPDTw0EintTW5H3WfrxwLqEqjiIihlu+hVRyGrFQ60xl0Lxn7Bt3zdpevPaQi0HEzqz9fw==",
       "cpu": [
         "x64"
       ],
@@ -2705,12 +2705,15 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-arm": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.3.2.tgz",
-      "integrity": "sha512-1eMLzy92I4J6rmi4mAT8yC3HxOtniyGELlzGbNMLLeqe052ahFQ0h6LFq+lh5DsDIdYViIDst08abvSbcEdLXQ==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.3.3.tgz",
+      "integrity": "sha512-3rbU4vqXXc3hY/OiXdl52xZvT0F1yEngWfvqudtPJg/KkyiaQw2DRsFrNzpmLvfavbwOq3qXn36GP8obHRULQA==",
       "cpu": [
         "arm"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -2721,12 +2724,15 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-arm64": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.3.2.tgz",
-      "integrity": "sha512-dqVSFynCox4C/J8kT16V7SIFAns0IjgLwkvYT7p8LQVmJ5OS5b6tI9IGflxTeuBS//zXeFIUbwt5dwxyZ17cnA==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.3.3.tgz",
+      "integrity": "sha512-0DaL0A6Xu6sQSQFwe4iVCrKWU2cCTItnRsYsCdxAMm9NF6twAA9BKnoqy4hqz4+azQ0JHuA26qiUKsf1XJ/v5A==",
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -2737,12 +2743,15 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-ppc64": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.3.2.tgz",
-      "integrity": "sha512-3z0NHDxD6n5I9gc05U1eW1AyRm+Gznzq3naMrthPNqE6oYykcogW0l/jfpJdjYnuNl8R7yI9pNbE1XiUeyq0Aw==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.3.3.tgz",
+      "integrity": "sha512-cdn1OvUBwsXhbC0zSzJnNzf5MZ/mTrobawDvNXBTxe8VtqKAm0sRuEY2Evzovb/w9JMk4TvRxqt1mekSuJz64w==",
       "cpu": [
         "ppc64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -2753,12 +2762,15 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-riscv64": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.3.2.tgz",
-      "integrity": "sha512-bsb4rI+NldGOsXuej2r8OdSS8+zXDVaCWxyWrcv6kneTOlgAHtZABRzBBCwdsPiD90J4myNJuHpg6kA20ImW/w==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.3.3.tgz",
+      "integrity": "sha512-HjPVx7yKz+0lqdhDlTw1tt90wamBoxhiXpvl1XZpJLiHH4RCJ5yDTqH+VlYPv2fwFs89JFw4c1IexYOcQUi4IQ==",
       "cpu": [
         "riscv64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -2769,12 +2781,15 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-s390x": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.3.2.tgz",
-      "integrity": "sha512-/ABshyj8gCpyIrNXnHn4LorDJ0HHm1VhXPBlxZ8zAtfVPAaSafXPGn+sUSIRiwaSBy0mmFjSjiXI5mkcwdChKQ==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.3.3.tgz",
+      "integrity": "sha512-neWLh+3yCNThxnfy3c4BbVBeGgt9aftno+XbT56iK28RgeDs3UOFWviLWlUu0bArYVYJaFDK+RRohbicUNCm8Q==",
       "cpu": [
         "s390x"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -2785,12 +2800,15 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-x64": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.3.2.tgz",
-      "integrity": "sha512-ITPEtgffGJ0S6G9dRyw/366tJQqFRcHWPHhC+Stpg3Z8AEMrDrTr2lhdz4f/Y/HMbRh//7Z5mBzEpVdi62Oc3w==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.3.3.tgz",
+      "integrity": "sha512-4vKmvAst9nrowcqquKFAyZJUDolUaIp8uRiN0mWFguJ1IplC9/pitXtlnnlU4aa/eJw3J7i67V+pwUL+wZGdsA==",
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -2801,12 +2819,15 @@
       }
     },
     "node_modules/@img/sharp-libvips-linuxmusl-arm64": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.3.2.tgz",
-      "integrity": "sha512-zE9EdiUzUmg5mDT5a1rk5fYJ6GWPloTwWBYDS14naqHsL+EaMpDj1AWnpLgh3u0YCORv2Tt50wrcrpYqkP97Kw==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.3.3.tgz",
+      "integrity": "sha512-Y9kQaLMuNoB0bPYOOdcZMaseNrFpPodIWWMrx+CZyydf2xn68j9WYc6sWWRrDwNkzCQjKYfc68L7jKjGlHMibw==",
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -2817,12 +2838,15 @@
       }
     },
     "node_modules/@img/sharp-libvips-linuxmusl-x64": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.3.2.tgz",
-      "integrity": "sha512-m0lrLiUt+lBYnCFr8qV/65yMR4E/c7/wf78I5eKTdkEakFAlZ9QlzEM3QIhhAwVeUhLAHLcCq7a7Vszq/oFNZQ==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.3.3.tgz",
+      "integrity": "sha512-fj8Mv0HHfD1Rr+4I68+3agJynxDWtBFgicTbSOb9Bke6pIwzGcJ+RX/yHjmiEGFMCavY/dxvem7MyNaJF+wDiw==",
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -2833,12 +2857,15 @@
       }
     },
     "node_modules/@img/sharp-linux-arm": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm/-/sharp-linux-arm-0.35.3.tgz",
-      "integrity": "sha512-affVWCTLooy8TSxbDx2qkzuDeaWLNVBA+P//FNBirHsXpP2fuBhk5AuboYUnrDnzoXes8GFjpTx0SBFOCRg+FA==",
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm/-/sharp-linux-arm-0.35.4.tgz",
+      "integrity": "sha512-7OAS8gI0EReKGVN2HssHlM6umJgxF5VI3xN0p9FA91p/YO+ou5hiNghLdZ5BEHztwaaK5+bLKRf8x/o2L2nk9A==",
       "cpu": [
         "arm"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2851,16 +2878,19 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-arm": "1.3.2"
+        "@img/sharp-libvips-linux-arm": "1.3.3"
       }
     },
     "node_modules/@img/sharp-linux-arm64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.35.3.tgz",
-      "integrity": "sha512-QgKDspHPnrU+GQ55XPhGwyhC8acLVOOSyAvo1oVfFmrIXLkDNmGWzAfDZ4xK8oSA1qBQrALcHX0G5UZni/SuFQ==",
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.35.4.tgz",
+      "integrity": "sha512-De4jpEnAU8Hd5oT0j1G3uL4ZvTuipVMn7YC6vPaJhy6/7EwEae0SVAoBrUMYQbkLGDm85taVWwuPc1a44LTzCQ==",
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2873,16 +2903,19 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-arm64": "1.3.2"
+        "@img/sharp-libvips-linux-arm64": "1.3.3"
       }
     },
     "node_modules/@img/sharp-linux-ppc64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.35.3.tgz",
-      "integrity": "sha512-sMd8rDxmpLOwv/7N44klFjOD5DUO7FLdjiXDI0hoxYaf7Ar262dQIEkosE98bps+5HPLtp/EvNqeqQtOycP/IA==",
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.35.4.tgz",
+      "integrity": "sha512-2oYZJeIl4kCcMGk4ouZVjnkCtFrpQFlNEtJ6GbxzhHQchwH0NH/qEb9ykmOl29dqwMq+JhFdZn+1ak2FKhI9fQ==",
       "cpu": [
         "ppc64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2895,16 +2928,19 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-ppc64": "1.3.2"
+        "@img/sharp-libvips-linux-ppc64": "1.3.3"
       }
     },
     "node_modules/@img/sharp-linux-riscv64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.35.3.tgz",
-      "integrity": "sha512-0Eob78yjlYPfL5vMNWAW55l3R9Y6BQS/gOfe0ZcP9mEz9ohhKSt4im1hayiknXgf8AWrFqMvJcKIdmLmEe7yeQ==",
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.35.4.tgz",
+      "integrity": "sha512-cPbNChoRURAWdebDIHSenxRpgEdy7JkPydSnUxRm9VvKD7m0/xVaR/8Fzlu81pk5nHEvHH87UZUA7cTtwnbJSA==",
       "cpu": [
         "riscv64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2917,16 +2953,19 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-riscv64": "1.3.2"
+        "@img/sharp-libvips-linux-riscv64": "1.3.3"
       }
     },
     "node_modules/@img/sharp-linux-s390x": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.35.3.tgz",
-      "integrity": "sha512-KgAxQ0DxpNOq1rG2t5cgTgShJFGSuU7XO45cqC+1NVOuZnP6tlgZRuSYOfNupGkHID0o3cJOsw4DVeJpMovcGw==",
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.35.4.tgz",
+      "integrity": "sha512-RY0JFY8Fd6RonCBtHz+DvadaPkXDSI1AUn6yWL9TipqkZ1vY8w8evqdgyDFnkm4/K1ve1TvZiaePP5oSd4+WVQ==",
       "cpu": [
         "s390x"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2939,16 +2978,19 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-s390x": "1.3.2"
+        "@img/sharp-libvips-linux-s390x": "1.3.3"
       }
     },
     "node_modules/@img/sharp-linux-x64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.35.3.tgz",
-      "integrity": "sha512-8pqvxubL2PGdhlPy6GLqzDYMUjyRmKAwKHYKixpdJYBUK7PJ0C029XdsnpFIdgRZG68fZiGdHVWcKPvtiPB4cA==",
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.35.4.tgz",
+      "integrity": "sha512-9qvvEAuk8k89TfWUoX2htWjbAMX8p+NxCppjpcg5k6xMsjhBQPTsoIh36h9Qde4WRuGpJeYnOjdosDn/cnv+OA==",
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2961,16 +3003,19 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-x64": "1.3.2"
+        "@img/sharp-libvips-linux-x64": "1.3.3"
       }
     },
     "node_modules/@img/sharp-linuxmusl-arm64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.35.3.tgz",
-      "integrity": "sha512-Vz0iQjzzcSX3HCbfwFfCSG/9SCIqyO0mH2sXyiHaAYfBk0cRsCWXRyQYX0ovCK/PAQBbTzQ0dsPQHh5MAFL59w==",
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.35.4.tgz",
+      "integrity": "sha512-KB5jxpfWQTr0nc3xdHtWChdbifHrBGsd2SM62Eyxrl8afikm+f5qGBU75SJIZBT/S1MC8XyacdlXBMSWq6OURA==",
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2983,16 +3028,19 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linuxmusl-arm64": "1.3.2"
+        "@img/sharp-libvips-linuxmusl-arm64": "1.3.3"
       }
     },
     "node_modules/@img/sharp-linuxmusl-x64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.35.3.tgz",
-      "integrity": "sha512-6O1NPKcDVj9QEdg7Hx549EX8U0rp6yXQERqru6yRN7fGBn32UvIRJUlWnk+8xDCiG76hXVBbX82NZ/ZKr0euIg==",
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.35.4.tgz",
+      "integrity": "sha512-f+eZJZIQNEEd26RPSW+76chwOf1XtA2Y/O+5ocVyLliHkeih3e+jhLVBdNTd2rS3IbNXK8+ug93Vf5ZXtF5Lxg==",
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -3005,17 +3053,17 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linuxmusl-x64": "1.3.2"
+        "@img/sharp-libvips-linuxmusl-x64": "1.3.3"
       }
     },
     "node_modules/@img/sharp-wasm32": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.35.3.tgz",
-      "integrity": "sha512-cZ0XkcYGpHZkqW6iCkqTcmUC0CD9DhD5d/qeZlZkfRBn6GnHniZXLUo5+9xw8Iv76YE6LQFN9YNBlKREcCG76w==",
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.35.4.tgz",
+      "integrity": "sha512-zQnl4Kwp7Q6NHsENtU2T/00Zi+w3AQNwz3+UaTyVBy2FpXrzXzGjndpK61onhZjRtRpQXxCTeqw19bVyXOh7jA==",
       "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/runtime": "^1.11.1"
+        "@emnapi/runtime": "^1.11.3"
       },
       "engines": {
         "node": ">=20.9.0"
@@ -3025,16 +3073,16 @@
       }
     },
     "node_modules/@img/sharp-webcontainers-wasm32": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-webcontainers-wasm32/-/sharp-webcontainers-wasm32-0.35.3.tgz",
-      "integrity": "sha512-2rnq7bX3NzeR2T4YWgz8qiG4h3TSdMe+vN1iQXpJleSJ3SM5zQ8Fy2SyyXAWlbxpEZ2Y+Z4u1BePgJEYbSy80Q==",
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-webcontainers-wasm32/-/sharp-webcontainers-wasm32-0.35.4.tgz",
+      "integrity": "sha512-ESfNkywmCfPNyaZjxooddJQiQ+l/nTpGEOGthxiLnIHXC/CmcBixnfwUleX9mCz9ovrUUvKMap/pm8RYbzfwaA==",
       "cpu": [
         "wasm32"
       ],
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
-        "@img/sharp-wasm32": "0.35.3"
+        "@img/sharp-wasm32": "0.35.4"
       },
       "engines": {
         "node": ">=20.9.0"
@@ -3044,9 +3092,9 @@
       }
     },
     "node_modules/@img/sharp-win32-arm64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.35.3.tgz",
-      "integrity": "sha512-4bPwFdMbeC4JQ8L8LOyWp6nsHcboP5fxkp6iPOXz2Vg49R42TuMs2whkJ5OAP4/Ul035qOzy0AecOF9VOscn4w==",
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.35.4.tgz",
+      "integrity": "sha512-iNdlBX9gLVvqe2I3uIJSIKTq6wckP/DYxZtcqxm09x5Gi24DnFBmPAWZmr60ZyYMG0xlzo6goG3670ar+RXvRw==",
       "cpu": [
         "arm64"
       ],
@@ -3063,9 +3111,9 @@
       }
     },
     "node_modules/@img/sharp-win32-ia32": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.35.3.tgz",
-      "integrity": "sha512-r53mXsBN6lFUDiST764SvgwUdHAqM4rPAiDzAmf4fLoB6X/rkfyTrLCg6+g17wJJiCmB3JYgHuUldCWUIRFSXw==",
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.35.4.tgz",
+      "integrity": "sha512-kqRsbaa5CS6KHlpxnN7WhE6vAAugXyZButpRdvDWetlv6Qv4N9WTcrWzF7tXfB9T7MsoadqdI8hmwLq6UlLvtw==",
       "cpu": [
         "ia32"
       ],
@@ -3082,9 +3130,9 @@
       }
     },
     "node_modules/@img/sharp-win32-x64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.35.3.tgz",
-      "integrity": "sha512-D4y1vNeZrIIJCN+uHaWVtH86B+aCrdMYYjicy9pXHvbGZeGYLLSd3wdVuC37FxVXlU1ARsk84eKWfWMXGYEqvA==",
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.35.4.tgz",
+      "integrity": "sha512-XtmnYhBcrORsJ4XJngyzr/EWP0hRZLAZRFaApdKuviyqF78+ylxh2y06ZmtULAMOnObJ3ucpN0AcwSWnMowTRg==",
       "cpu": [
         "x64"
       ],
@@ -4054,25 +4102,58 @@
       }
     },
     "node_modules/@next/env": {
-      "version": "16.2.12",
-      "resolved": "https://registry.npmjs.org/@next/env/-/env-16.2.12.tgz",
-      "integrity": "sha512-d0Z5Bc13Fa4nR8pFAKx2jay2yhJM16vlfHbTzYnUQAxlNb6B6lmn4hjt69lYNt4kRtyYP6gEM49lPRHNbIyneg==",
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/env/-/env-16.3.4.tgz",
+      "integrity": "sha512-cjWZnUUa6jZq2kFaNe/ZyJdZonOZ/QoN0Zka2nz/FLOrfx14pQuM9c5RaSVkWMqgdt4ksgPAMWPyHSs/CyV48Q==",
       "license": "MIT"
     },
     "node_modules/@next/eslint-plugin-next": {
-      "version": "16.2.12",
-      "resolved": "https://registry.npmjs.org/@next/eslint-plugin-next/-/eslint-plugin-next-16.2.12.tgz",
-      "integrity": "sha512-uF2z/qAK2q7B5/6CpnFcBRX6jOq5iCO+Uqh1UkJhXljX1JwLarLYhhoJadO6dPb6moTprOKewMXheBcbIoSbug==",
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/eslint-plugin-next/-/eslint-plugin-next-16.3.4.tgz",
+      "integrity": "sha512-szW9y2Aumu4z88YXfTzcFsgUAg2k64uzbtcO5L9f1AKS4w/GUKJcbFllRflROVyNPgJtGOnvNxiyp3v6b+prIA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
+        "@eslint-community/eslint-utils": "4.9.1",
         "fast-glob": "3.3.1"
       }
     },
+    "node_modules/@next/eslint-plugin-next/node_modules/@eslint-community/eslint-utils": {
+      "version": "4.9.1",
+      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.1.tgz",
+      "integrity": "sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "eslint-visitor-keys": "^3.4.3"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0"
+      }
+    },
+    "node_modules/@next/eslint-plugin-next/node_modules/eslint-visitor-keys": {
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
+      "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
     "node_modules/@next/swc-darwin-arm64": {
-      "version": "16.2.12",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.2.12.tgz",
-      "integrity": "sha512-0W1R0teHWJrqKX0FH20IzzIWAOuGtBxPGuObrxy1lE8hQvCFj49KE8a3WUg0D7sq6rn6zkM4c7YGUnhudBS6oA==",
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.3.4.tgz",
+      "integrity": "sha512-iBr3I5LZNk5/bgl5//iTgD2tcym14MX0Xo7fD//u9dYAEgGzza1y9oywluPtf74YnOswVdH1908aK9xVz7zQTw==",
       "cpu": [
         "arm64"
       ],
@@ -4086,9 +4167,9 @@
       }
     },
     "node_modules/@next/swc-darwin-x64": {
-      "version": "16.2.12",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.2.12.tgz",
-      "integrity": "sha512-Hy5Ls099+aFUmOLmIgPfLqNi6iCwhL3uQCssz5rWk+5Nkc6TUKCE83DY5BbNylfm3+mfwcSFnLRfrZDJhVxdtw==",
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.3.4.tgz",
+      "integrity": "sha512-2dpiSyl2Jw/NrBPaU2MAKGSa+2MR82pJIn4Sm5Rjr+gxAeuh0z158Su3Z2O8zn7UNNq+ej4bToed6RcRN/Lydg==",
       "cpu": [
         "x64"
       ],
@@ -4102,12 +4183,15 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-gnu": {
-      "version": "16.2.12",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.2.12.tgz",
-      "integrity": "sha512-+YqU2h1cQkHsGfvjAsrSmst8UIFBibBGm5x3Xgel8NLMiDQtNOM4sM2GOEMvG5YiOBNeN/Ykk8cQC2S0Xrqljg==",
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.3.4.tgz",
+      "integrity": "sha512-+t+U8HZT+fApePCS5h89CSH3datz29MkzyfCn+6fpsZBG/oiEOhINcb9rtkv6sdpToLGFn2e6146NzaKCXkqrA==",
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4118,12 +4202,15 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-musl": {
-      "version": "16.2.12",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.2.12.tgz",
-      "integrity": "sha512-0qjhiYBaKAqF63LA1ZWAAnKTzFUguAaZiRa5etMLGGPj/B6uEVjtIZldIzFEp3wHlB0koK6aTzqPtSdplTCjoA==",
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.3.4.tgz",
+      "integrity": "sha512-mx03GNs1ocQA5JQ4FxDMmIsNkdrZh8cuezKCrId28e5/gIPU/l7Kcy2+vmCCzdjnnmXJy+iOAu+7K0QppO6Urg==",
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4134,12 +4221,15 @@
       }
     },
     "node_modules/@next/swc-linux-x64-gnu": {
-      "version": "16.2.12",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.2.12.tgz",
-      "integrity": "sha512-7A3q26W+h7gnA15uqBToNuDqBEFZZcqh0mW2mn4AJh/G5pdg2RVE3n4slzLEliASZFG3NmsbEzng/x2Sh09mBg==",
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.3.4.tgz",
+      "integrity": "sha512-YIhGY6fSMfha52bnVxnzc9zaVBzJg+cqQTOD8tXIBSx4fuv0pVMxQTE0PaS59YhnMOiYiG09IMwxJAf/CFm/Dw==",
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4150,12 +4240,15 @@
       }
     },
     "node_modules/@next/swc-linux-x64-musl": {
-      "version": "16.2.12",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.2.12.tgz",
-      "integrity": "sha512-qSjL/uppm+cbh21s72Ss8gkiOhQ4dExWHNGOWy6eZV7STj5WsKehgxT61beSsOj+YYQuTplL376lOCdMQU5T8w==",
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.3.4.tgz",
+      "integrity": "sha512-+eaaX6axpDb0yF1GCpiERe6njplvdC+nks/fKfcHu3XPGRrald8P3/X7yv7QLdjA51knnxwl9pxdIJsg+w1L+Q==",
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4166,9 +4259,9 @@
       }
     },
     "node_modules/@next/swc-win32-arm64-msvc": {
-      "version": "16.2.12",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.2.12.tgz",
-      "integrity": "sha512-X6hzsOUJac/e7AWSbn9gQ9nzHld1xWP5iyjHpYWvud8pufB679O1xg4JDyKr8Xd69Jvd+kM2Der6uftiZCmjYA==",
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.3.4.tgz",
+      "integrity": "sha512-0jcXW7Xs/uzICrmgV3MhDYDeRy++1CqnpDIerlPIqYO4bhzB4WNbX/aRnQclustsAyTkFKB0z6rbcjmNg5tR8A==",
       "cpu": [
         "arm64"
       ],
@@ -4182,9 +4275,9 @@
       }
     },
     "node_modules/@next/swc-win32-x64-msvc": {
-      "version": "16.2.12",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.2.12.tgz",
-      "integrity": "sha512-F6fakeHuFTLOPt0bslQJdf+xtT+WIP9DVn/m4y1w1mRnVPyh3D/cNvzlRkxM444xfm+IvvYNSOrKiA2CDJ0Uxw==",
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.3.4.tgz",
+      "integrity": "sha512-vvBzwu1pYQCp92maZCFCIw/XgOTMR5tur9GjakwIo2cmwRTMKajRZZDS9+e4KsUZWKu1E007WUeAFXRRjZeuzw==",
       "cpu": [
         "x64"
       ],
@@ -4330,9 +4423,9 @@
       }
     },
     "node_modules/@swc/helpers": {
-      "version": "0.5.15",
-      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.15.tgz",
-      "integrity": "sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g==",
+      "version": "0.5.23",
+      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.23.tgz",
+      "integrity": "sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==",
       "license": "Apache-2.0",
       "dependencies": {
         "tslib": "^2.8.0"
@@ -6856,13 +6949,13 @@
       }
     },
     "node_modules/eslint-config-next": {
-      "version": "16.2.12",
-      "resolved": "https://registry.npmjs.org/eslint-config-next/-/eslint-config-next-16.2.12.tgz",
-      "integrity": "sha512-iaaf4vvKo5h2LBdGt0JuRv7t0Ysqr9FMCiFxbptDg8LqOE//mIKR80DdpOnSVM7qjLH3jT8P0aFiwXxBEGZRXw==",
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/eslint-config-next/-/eslint-config-next-16.3.4.tgz",
+      "integrity": "sha512-35/8RM10huEL9vlr8hUZMERMENHBrnyHN3ZZkF9efSgzGaqK34jIqry44A956//zriUhUAUW0XSkcolhrryqAA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@next/eslint-plugin-next": "16.2.12",
+        "@next/eslint-plugin-next": "16.3.4",
         "eslint-import-resolver-node": "^0.3.6",
         "eslint-import-resolver-typescript": "^3.5.2",
         "eslint-plugin-import": "^2.32.0",
@@ -9749,9 +9842,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "3.15.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz",
-      "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==",
+      "version": "3.15.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz",
+      "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10215,16 +10308,16 @@
       "license": "MIT"
     },
     "node_modules/next": {
-      "version": "16.2.12",
-      "resolved": "https://registry.npmjs.org/next/-/next-16.2.12.tgz",
-      "integrity": "sha512-iD59eYQWmbFcEbX7v/acG5DRym9iw1DdaPoD0WTA920naWsE25wShzJW4+UvAs8MK9EC2kBfIH6vtto1H1PHGw==",
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/next/-/next-16.3.4.tgz",
+      "integrity": "sha512-/Ztf6CeRH+ejEXUrYtqI4gkS66eFIHuSwqi60RgcpWKodxFZx2/dqVCMKBwILfAHXQ+F1b1vAudgj3mnxqtoIA==",
       "license": "MIT",
       "dependencies": {
-        "@next/env": "16.2.12",
-        "@swc/helpers": "0.5.15",
+        "@next/env": "16.3.4",
+        "@swc/helpers": "0.5.23",
         "baseline-browser-mapping": "^2.9.19",
         "caniuse-lite": "^1.0.30001579",
-        "postcss": "8.4.31",
+        "postcss": "8.5.23",
         "styled-jsx": "5.1.6"
       },
       "bin": {
@@ -10234,15 +10327,15 @@
         "node": ">=20.9.0"
       },
       "optionalDependencies": {
-        "@next/swc-darwin-arm64": "16.2.12",
-        "@next/swc-darwin-x64": "16.2.12",
-        "@next/swc-linux-arm64-gnu": "16.2.12",
-        "@next/swc-linux-arm64-musl": "16.2.12",
-        "@next/swc-linux-x64-gnu": "16.2.12",
-        "@next/swc-linux-x64-musl": "16.2.12",
-        "@next/swc-win32-arm64-msvc": "16.2.12",
-        "@next/swc-win32-x64-msvc": "16.2.12",
-        "sharp": "^0.34.5"
+        "@next/swc-darwin-arm64": "16.3.4",
+        "@next/swc-darwin-x64": "16.3.4",
+        "@next/swc-linux-arm64-gnu": "16.3.4",
+        "@next/swc-linux-arm64-musl": "16.3.4",
+        "@next/swc-linux-x64-gnu": "16.3.4",
+        "@next/swc-linux-x64-musl": "16.3.4",
+        "@next/swc-win32-arm64-msvc": "16.3.4",
+        "@next/swc-win32-x64-msvc": "16.3.4",
+        "sharp": "^0.35.4"
       },
       "peerDependencies": {
         "@opentelemetry/api": "^1.1.0",
@@ -11426,9 +11519,9 @@
       }
     },
     "node_modules/sharp": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.35.3.tgz",
-      "integrity": "sha512-ej0zVHuZGHCiABXcNxeYhpRnPNPAcvbG8RMdBAhDAxLKkCRVSpK3Iyu7qbqw3JMzoj0REeM6f3tJLtVwl0023Q==",
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.35.4.tgz",
+      "integrity": "sha512-n++8XWcj+jCOr2IOl7h8LbKnGBDY4aPbmprMONBNFdn0ImXqpGVv5zliDs0V9HbmbCQLpbuo2ej9rAoOQTvMDA==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -11443,31 +11536,31 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-darwin-arm64": "0.35.3",
-        "@img/sharp-darwin-x64": "0.35.3",
-        "@img/sharp-freebsd-wasm32": "0.35.3",
-        "@img/sharp-libvips-darwin-arm64": "1.3.2",
-        "@img/sharp-libvips-darwin-x64": "1.3.2",
-        "@img/sharp-libvips-linux-arm": "1.3.2",
-        "@img/sharp-libvips-linux-arm64": "1.3.2",
-        "@img/sharp-libvips-linux-ppc64": "1.3.2",
-        "@img/sharp-libvips-linux-riscv64": "1.3.2",
-        "@img/sharp-libvips-linux-s390x": "1.3.2",
-        "@img/sharp-libvips-linux-x64": "1.3.2",
-        "@img/sharp-libvips-linuxmusl-arm64": "1.3.2",
-        "@img/sharp-libvips-linuxmusl-x64": "1.3.2",
-        "@img/sharp-linux-arm": "0.35.3",
-        "@img/sharp-linux-arm64": "0.35.3",
-        "@img/sharp-linux-ppc64": "0.35.3",
-        "@img/sharp-linux-riscv64": "0.35.3",
-        "@img/sharp-linux-s390x": "0.35.3",
-        "@img/sharp-linux-x64": "0.35.3",
-        "@img/sharp-linuxmusl-arm64": "0.35.3",
-        "@img/sharp-linuxmusl-x64": "0.35.3",
-        "@img/sharp-webcontainers-wasm32": "0.35.3",
-        "@img/sharp-win32-arm64": "0.35.3",
-        "@img/sharp-win32-ia32": "0.35.3",
-        "@img/sharp-win32-x64": "0.35.3"
+        "@img/sharp-darwin-arm64": "0.35.4",
+        "@img/sharp-darwin-x64": "0.35.4",
+        "@img/sharp-freebsd-wasm32": "0.35.4",
+        "@img/sharp-libvips-darwin-arm64": "1.3.3",
+        "@img/sharp-libvips-darwin-x64": "1.3.3",
+        "@img/sharp-libvips-linux-arm": "1.3.3",
+        "@img/sharp-libvips-linux-arm64": "1.3.3",
+        "@img/sharp-libvips-linux-ppc64": "1.3.3",
+        "@img/sharp-libvips-linux-riscv64": "1.3.3",
+        "@img/sharp-libvips-linux-s390x": "1.3.3",
+        "@img/sharp-libvips-linux-x64": "1.3.3",
+        "@img/sharp-libvips-linuxmusl-arm64": "1.3.3",
+        "@img/sharp-libvips-linuxmusl-x64": "1.3.3",
+        "@img/sharp-linux-arm": "0.35.4",
+        "@img/sharp-linux-arm64": "0.35.4",
+        "@img/sharp-linux-ppc64": "0.35.4",
+        "@img/sharp-linux-riscv64": "0.35.4",
+        "@img/sharp-linux-s390x": "0.35.4",
+        "@img/sharp-linux-x64": "0.35.4",
+        "@img/sharp-linuxmusl-arm64": "0.35.4",
+        "@img/sharp-linuxmusl-x64": "0.35.4",
+        "@img/sharp-webcontainers-wasm32": "0.35.4",
+        "@img/sharp-win32-arm64": "0.35.4",
+        "@img/sharp-win32-ia32": "0.35.4",
+        "@img/sharp-win32-x64": "0.35.4"
       },
       "peerDependenciesMeta": {
         "@types/node": {

job-tracker-ui/package.json

@@ -21,7 +21,7 @@
     "@types/react-dom": "^19.2.3",
     "axios": "^1.19.0",
     "date-fns": "^4.1.0",
-    "next": "^16.2.12",
+    "next": "^16.3.3",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
     "react-router-dom": "^7.18.2",
@@ -61,7 +61,7 @@
     "@types/jest": "^30.0.0",
     "babel-jest": "^30.4.1",
     "eslint": "^9.39.5",
-    "eslint-config-next": "^16.2.12",
+    "eslint-config-next": "^16.3.3",
     "identity-obj-proxy": "^3.0.0",
     "jest": "^30.4.2",
     "jest-environment-jsdom": "^30.4.1"
@@ -69,6 +69,6 @@
   "overrides": {
     "brace-expansion": "2.1.4",
     "postcss": "8.5.25",
-    "sharp": "0.35.3"
+    "sharp": "0.35.4"
   }
 }

job-tracker-ui/src/interview-prep.test.tsx

@@ -117,7 +117,9 @@ test("starts a structured interview debrief without inventing answers", async ()
       content: expect.stringContaining("Questions asked:"),
     },
   ));
-  expect(mockedApi.post.mock.calls[0][1].content).not.toMatch(/Acme|achievement|metric/i);
+  expect(mockedApi.post.mock.calls[0][1]).toEqual(expect.objectContaining({
+    content: expect.not.stringMatching(/Acme|achievement|metric/i),
+  }));
 });
 
 test("marking an item ready patches it", async () => {