docs(launch): prepare crawlable multilingual content and SEO contracts

docs/launch-site/CONTENT_ARCHITECTURE.md

@@ -0,0 +1,20 @@
+# Public content architecture — proposed, not implemented
+
+2 November 2026. Independent preparation under the owner's current direct-roadmap instruction. No visual concept selected, public route added, marketing claim published or application source changed. Final layout/section order remains an owner decision.
+
+Reuse the current Next static-export build, React Router private shell, MUI design tokens, shared plan ownership and en/nb translation contracts. Avoid a CMS or second application shell. Public descriptive content should be emitted as crawlable static HTML from repository-managed, locale-aware content; authenticated routes retain their current client-only providers. Do not turn private account data, feature flags or arbitrary query strings into build-time content.
+
+Separate content domains:
+
+- Feature catalogue: stable feature ID and links to implementation, scoped acceptance, deployed identity, entitlement, market, locale, approved screenshot and marketing approval. Missing evidence withholds a current-availability claim. Existing MARKETING_CLAIM_VALIDATION.md remains the authority; do not duplicate it into a competing status list.
+- Page copy: complete title, description, headings, feature narratives, links, FAQ and accessible text in approved locale resources. Whole sentences and explicit placeholders; reuse terminology and distinguish canonical Career Profile from a CV variant.
+- Market: available product/provider capabilities, actual billing/currency, legal links and applicable languages. A market is not a language, nationality or automatic grant to fetch jobs.
+- Assets: genuine synthetic product captures with source commit/date/surface/theme/viewport, rights and alt-text context. The five application design concepts are conceptual prototypes, not screenshots of a released product. No unlicensed images or invented customer testimonials.
+
+Draft profession-neutral content options for later copy review: “Your job search, organised.” / “Jobbsøkingen din, organisert.” Supporting proposition: “Keep applications, career information and documents together.” / “Samle søknader, karriereinformasjon og dokumenter på ett sted.” These are unpublished candidate copy, not released-capability approval or native-language acceptance. Avoid promising universal import accuracy, live international sources, automatic employer actions, AI availability or privacy certifications.
+
+Candidate narrative modules (not an approved order): clear outcome and product preview; tracking and next steps; Career Profile/document workflow; optional import review; how it works; verified plan information; factual FAQ; supported registration path; legal/support footer. Where registration is disabled, the CTA must use the existing truthful sign-in/access path rather than promise account creation. Legal destinations and final FAQ answers require verified content; never invent links or policies.
+
+Implementation gate: after final visual approval, use the approved composition with static public copy and a small client interaction boundary for preference/navigation. Preserve signed-in redirect, protected-route return state and the existing dashboard-first optional onboarding. No second onboarding flow. Reverting future content is an ordinary version-controlled content rollback; no database migration is proposed by this architecture.
+
+Open: final visual choice, actual released feature/plan/provider evidence, production origin/deployed identity, public asset provenance and native copy review. Full European catalogue work does not automatically publish locale pages.

docs/launch-site/HOMEPAGE_AUDIT.md

@@ -0,0 +1,21 @@
+# LAUNCH-00 source audit - partial checkpoint
+
+2026-11-02. `feature/launch-site-redesign`, accepted conditional baseline `5cb903b989742b7a96cb22ddf4c0e24993b18980`. Full authoritative homepage prompt read. LAUNCH-00 IN_PROGRESS; LAUNCH-01 concepts NOT YET PRODUCED. No final design selected or implemented.
+
+| Finding | Source evidence | User implication / proposed direction |
+| --- | --- | --- |
+| Main Get started opens sign-in | `LandingPage.tsx` passes `goToLogin` to hero CTA; Free-plan CTA separately goes to `/register` | Registration intent has an extra mode-selection step. Propose direct registration while preserving sign-in return state |
+| Existing signup owner should be reused | `App.tsx:522` maps `/register` to `LoginPage initialMode=register`; LoginPage respects auth config and registration availability | No second onboarding implementation; final CTA must reflect actual enabled registration |
+| Product previews are conceptual assets | `LandingPage.tsx` uses `/mockups/dashboard.svg`, `pipeline.svg`, `workspace.svg` | Replace with provenance-bound synthetic captures in approved design; never label current artwork a genuine screenshot |
+| Implementation details occupy hero copy | LandingPage renders React/TypeScript/ASP.NET/EF/FastAPI/Gmail text | Replace with plain user outcomes across professions; framework names do not explain job-search value |
+| Marketing content depends on client execution and auth probe | `app/page.tsx` loads ClientShell; `ClientShell.tsx` uses `ssr:false`; LandingPage shows loading until `/auth/me` resolves/rejects | Crawlable HTML and loading/failure behavior need measured review; cannot assume static export includes full marketing copy |
+| Metadata is generic | `app/layout.tsx` has global title/description and initial `lang=en` | Design market/content-locale metadata and canonical/alternate rules without disturbing authenticated routing; no SEO score claimed |
+| Brand continuity exists | Indigo/cyan hero, shared MUI/theme, custom en/nb translations | Explore distinct compositions while preserving identity; avoid rebuilding app shell |
+| Product presentation is limited | Six feature cards, six steps and three conceptual images; no actual redesigned CV/import/gallery imagery | Prioritise actual accepted tracking, canonical Career Profile and reviewed document workflow; do not imply new Global Jobs is shipped |
+| Pricing shows capabilities, not amounts | `planCatalog.ts` defines Free/Pro, explicitly delegates commercial terms to configured checkout | Do not invent amounts/currencies/trials or promise active Pro AI; release and entitlement validation required |
+| Footer lacks privacy/legal links in this component | LandingPage footer contains copyright text and sign-in button | Verify existing legal destinations and approved copy before adding links; no invented compliance claims |
+| Responsive layouts are declared | MUI breakpoints change hero controls, feature grids, plan columns and footer | Source intent only; mobile/tablet/keyboard/reflow/contrast require actual rendered checks |
+
+Preserve signed-in redirect to `/dashboard`, interrupted protected-route return state, shared language behavior, plan policy ownership and existing registration constraints. New public market language must not overwrite job-ad or document output language. Existing custom en/nb implementation is not full European locale support.
+
+Not yet checked: current rendered desktop/mobile site, external design-pattern research, runtime signup, slow/offline auth probe, keyboard/AT/contrast, image loading/performance, crawled output, real deployment availability and final asset rights. These omissions keep LAUNCH-00 open. No product tests were rerun for this Markdown-only source checkpoint.

docs/launch-site/INTERNATIONALISATION.md

@@ -0,0 +1,11 @@
+# Marketing locale integration — proposed contract
+
+2 November 2026. EN/Bokmål source support is existing; no additional locale is released by this report. Reuse I18N-00 registry/catalogue proposals and their review gates instead of a second country-language mapping. Full European locale identities, script distinctions and native review remain the localisation workstream's responsibility.
+
+Keep marketing content locale, selected market, application UI language, ad-language preferences and document language distinct. A marketing selector may offer a deliberate explicit application-language action after sign-in; it must not silently write ad/document preferences. Current shared UI preference behavior must be inspected and migrated compatibly before introducing a separate persisted marketing choice. No persistence change is made here.
+
+Supported choices show native and English names, retain English access, and allow another supported language independent of market. Bokmål/nb/nb-NO/no legacy compatibility does not grant Nynorsk support. Unreleased languages may be described truthfully as forthcoming only with approved copy; they do not receive public routes, hreflang or sitemap entries. User-generated CV/job text is not translated by changing chrome language.
+
+Complete each published variant's visible, form, error, accessibility, metadata, social and legal text. Validate keys/placeholders, fallback behavior, interpolation escaping, long labels, plural/number/date/currency rules and dirty-form switching. Native terminology review is separate from syntactic coverage. Currency display follows real billing capability, not a selected country. Preserve provider names, original job language, rights/attribution and the distinction between source descriptions and any reviewed translation.
+
+Acceptance remains BLOCKED for additional released locales until architecture entry, coverage, translation rights/proficient review, actual market capabilities, approved content and integrated QA are satisfied. This does not prevent independent catalogue, fixture, content and SEO planning. See SEO_STRATEGY.md for published-only URL constraints and CONTENT_ARCHITECTURE.md for content ownership.

docs/launch-site/MARKETING_CLAIM_VALIDATION.md

@@ -0,0 +1,20 @@
+# Preliminary claims and content boundaries
+
+All claims below are **WITHHELD from public release approval**. Source implementation and conditional development acceptance do not establish production availability. No production inspection was authorised or performed.
+
+| Proposed subject | Implementation/development evidence | Missing marketing proof |
+| --- | --- | --- |
+| Track applications in table/Kanban | Existing LandingPage/plan catalogue and conditional pre-P10 handoff | Deployed version, applicable account entitlement, genuine synthetic capture and approved copy |
+| Career Profile and CV variants | Canonical profile/document contracts in architecture and CV handoff | Current deployed behavior and accurate plan/theme availability |
+| Import, review and correct CV facts | Pre-P10 accepted deterministic supported-fixture workflow | No universal parsing or AI-accuracy claim; actual released formats/languages and limitations |
+| CV templates and PDF | Scoped development appearance/metric approval retained | Physical-print limits, deployed design/version and screenshots |
+| Reminders/mail/integrations | Existing source owners; provider qualification separate | Actual enabled countries/providers/consent/delivery; avoid blanket automation promises |
+| International job search | GJ-00 planning separately published; later implementation blocked | Accepted implementation, provider rights and per-country deployed capabilities |
+| AI assistance | Some contracts implemented; real CV model quality/activation blocked | Accepted model compatibility/accuracy, privacy/consent and enabled deployment |
+| Free/Pro | Shared public catalogue exists; no price encoded here | Server policy/checkout consistency, active billing, tax/currency wording and approved current prices |
+| Languages | Existing en/nb source catalogues; I18N audit separate | Native review and per-surface release state; additional locale candidates are not supported language packs |
+| Privacy/security | Existing controls and conditional security evidence | Approved truthful wording; no certification/compliance guarantee |
+
+Each final catalogue entry needs feature ID, implementation commit, acceptance artifact, deployed version, entitlement, market, locale, screenshot provenance and owner marketing approval. Missing fields deny availability claims. This is a documentation contract, not a new executable publishing system.
+
+Proposed section sequence for concept exploration: outcome-led hero; genuine tracking preview; career/document journey; broad-profession story; how it works; verified plans; FAQ; registration CTA; legal/support footer. Final order remains a design choice. No fabricated customer quotes, statistics, discounts or job-provider coverage.

docs/launch-site/RELEASE_HANDOFF.md

@@ -0,0 +1,16 @@
+# Partial homepage planning handoff
+
+Continuation 2 November: CONTENT_ARCHITECTURE.md, INTERNATIONALISATION.md and SEO_STRATEGY.md add independent design-neutral content/routing/publication proposals. Byte-matched existing build-shell evidence confirms raw export lacks descriptive marketing HTML, canonical and hreflang. No public UI/routes/metadata implementation or final visual choice made. These source/build checks are not live SEO, performance or release qualification. The five application UI concepts remain separate from LAUNCH-01's required homepage exploration; no sixth application concept created.
+
+Branch `feature/launch-site-redesign`, baseline `5cb903b989742b7a96cb22ddf4c0e24993b18980`. Documentation-only source audit. LAUNCH-00 remains IN_PROGRESS. LAUNCH-01 four actual desktop/mobile concepts are PENDING, not replaced by written descriptions. No owner design decision requested until reviewable concepts exist.
+
+Next authorised work:
+
+1. Inspect rendered homepage/signup and research contemporary patterns using credible public sources. Preserve existing routing and privacy boundaries.
+2. Obtain provenance-bound synthetic screenshots from accepted evidence or an isolated test environment. The committed pre-P10 visual manifest contains real PDF previews/contact sheets, not a complete set of dashboard/CV editor/mobile product captures. Inspect any image before reuse; do not touch the separate pre-p10-ux worktree.
+3. Produce four distinct, viewable desktop/mobile concepts and an asset/licence manifest. No external image/font acquisition without appropriate rights. Concept placeholders cannot be represented as real application screenshots.
+4. Present concrete concepts for mix-and-match owner feedback, then stop final implementation until explicit final-design approval. Design approval does not authorise publication.
+
+No assets, app code, tests, routes, packages, production services or authenticated dashboard were changed. Rendered/browser/performance/accessibility/SEO checks NOT RUN. No production feature/pricing/language availability was asserted.
+
+The delegated design task stopped at a service usage limit before saving deliverables. Parent continued the source audit and preserved this checkpoint. No design agent is running in the background.

docs/launch-site/SEO_STRATEGY.md

@@ -0,0 +1,22 @@
+# SEO baseline and design-neutral proposal
+
+2 November 2026. Source/available-build review only; no deployment, crawl, search-engine ranking, Lighthouse or performance score claimed.
+
+## Measured raw-export baseline
+
+Reused the successful local I18N static build, checking byte identity of launch-branch `app/layout.tsx`, `app/page.tsx` and `app/[[...slug]]/ClientShell.tsx` first. Their SHA256 values respectively: `8e4f0cd2776d821c958480aec5c93943674acb0fe28cd60d0822df40009cb262`, `bf661f17c1c7c06ff8fda41b1afa44144bce694c815d52c3d5a927e32063b1b1`, `0afd4379fbfaeb2059cfa860b10523b212a20dc19c64f961de77bb8572ee6791`. ClientShell disables SSR for the application. This is reused build evidence for unchanged shell sources, not a fresh launch-branch build or proof of every bundle.
+
+A standard-library HTML parser excluding script/style text found only `Jobbjakt` and `You need to enable JavaScript to run this app.` in out/index.html; canonical link count 0, hreflang count 0. This confirms missing descriptive raw HTML, not an assertion that JavaScript-capable crawlers cannot index the client UI. Root metadata is generic and document language initially en. Record post-implementation comparisons against this narrow baseline.
+
+## Proposed contract after design/routing approval
+
+- Emit approved public headings, descriptions, feature text and FAQs in static HTML. Keep private routes and provider/account content outside the prerendered marketing boundary.
+- Give each published page a descriptive locale-specific title/description, semantic heading hierarchy, Open Graph metadata and approved social asset. Use factual SoftwareApplication/Organization structured data only when supported by the actual page; no fabricated ratings, offers or testimonials.
+- Obtain the production public origin from release-approved configuration. Do not guess a hostname or use localhost as a public canonical. Canonicals must refer to the intended published page, with query/tracking variants normalised.
+- Derive canonical/reciprocal alternate/sitemap entries from the same approved published market/content-locale inventory. Include only fully supported published variants; self and reciprocal links must agree. An unreviewed locale is absent, not an empty indexable page. Use valid language/script/region tags; country NO must not be treated as Bokmål nb.
+- Decide URL shape separately from visuals: proposed explicit `/market/{market}/{contentLocale}/...` or another approved unambiguous scheme. This is a proposal, not an added route. Preserve existing auth and application links and static-host fallback behavior; do not implement speculative duplicate country pages.
+- Keep incomplete/pre-release previews outside production index publication. Robots directives are not an authorisation boundary or protection for private content. Do not expose private or admin routes through sitemap generation.
+
+## Required verification before acceptance
+
+Parse exported HTML per approved locale/market; assert meaningful non-JS content, title/description/lang, one intended h1, canonical origin, reciprocal published-only alternates and sitemap membership. Check no unpublished variants, private URLs or unsupported prices/providers. Follow links in an isolated browser; test auth redirect/registration configuration, language persistence and separation from ad/document preferences. Then measure responsive/accessibility/performance budgets on realistic test conditions, preserving manual/device/native-language and deployed-origin gates. No executable SEO publishing infrastructure is introduced by this report.

docs/release-readiness/01_SYSTEM_INVENTORY.md

@@ -1,22 +0,0 @@
-# Preliminary release discovery
-
-2026-11-02. Branch `planning/release-readiness-discovery`; accepted conditional development baseline `5cb903b989742b7a96cb22ddf4c0e24993b18980`. Stage 1 IN_PROGRESS. No release candidate nominated. Production NO-GO. This report records source inspection and a bounded offline check, not full release qualification.
-
-| Component / inspected owner | Dependency / failure boundary | Required release evidence |
-| --- | --- | --- |
-| `job-tracker-ui/package.json`, `Dockerfile`, `nginx.conf.template` | Next static export, React/MUI and React Router; nginx serves `out`, proxies `/api/`, `/health`, `/ready`; configured host and forwarded-header handling | Exact build/image, browser journeys and deployed proxy/TLS identity |
-| `JobTrackerApi/Program.cs`, `JobTrackerApi.csproj` | net9.0, EF 9.0.14, Pomelo 9.0.0; authentication/authorization then rate limiting/session middleware and controllers | Endpoint-by-endpoint ownership/session/CSRF/error tests; source registration alone is not security proof |
-| `JobTrackerApi/Data/DatabaseConfiguration.cs` | Defaults to MariaDB; missing connection throws; SQLite requires explicit transitional selection | Actual MariaDB migration/upgrade/rollback and preservation evidence; retain legacy paths |
-| `docker-compose.database.yml` | Development persistent volume and separate integration tmpfs service; MariaDB 12.2.2 pinned digest; loopback ports | Isolated provider tests; no claim of equality with production |
-| Career/CV domain and PDF | Program registers CareerProfileService, ApplicationAssetsService, CV/letter renderers and Playwright exporter | Canonical facts, null-as-inherit, revisions, historical artifacts and physical print remain separate contracts |
-| Background services | Program registers backup, rules, reminders, saved search, export, enrichment, summarizer probe, AI operation, retention, email recovery and account deletion workers | Verify configuration, failure recovery and tenant isolation for enabled workers; registration is not runtime activation |
-| Auth/mail/provider integrations | Architecture documents Google/Microsoft identity, Gmail/Graph/IMAP/SMTP, NAV, optional translation, local/external AI, Stripe | Synthetic local tests separate from licensed/provider/account delivery and consent |
-| `.gitea/workflows/ci-deploy.yml` | Test pipeline; deployment limited by source condition to push on `refs/heads/main` | Fresh hosted artifact/commit/runner evidence; development branch push is not hosted qualification |
-| `.gitea/workflows/mariadb-integration.yml` | Isolated runner label, explicit initial exit-1 isolation gate | Operator isolation evidence and authorised workflow review before enabling; do not remove gate during discovery |
-| Existing backup/deployment runbooks | Database, attachments/CV artifacts, keys and deletion tombstones; code rollback differs from data restore | Disposable restore with independent content/decryption/deletion checks; approved RPO/RTO and failure rehearsal |
-
-Public boundary currently inspected: nginx host routing, `/health`, `/ready`, `/api/`; API controllers are mapped but a complete anonymous/authenticated endpoint census is still PENDING. External mail/job/AI requests, uploaded documents, browser credentials, database records and stored artifacts are separate trust boundaries. No live endpoints, Docker engines, databases, credentials, models or production services were accessed.
-
-Local development, test and production are not interchangeable: integration uses a generated project and disposable service; production needs the external network, server-side environment, actual ingress and operator controls. Current architecture/runbooks describe these differences; exact intended staging/production configuration and image identity remain unverified.
-
-The latest handoff's source-bound PDF metric/visual approvals supersede the older acceptance paragraph describing unchanged S01 coordinate failures. They are preserved for the approved development scope. Physical print, device, AT and language review remain open. No export was rerun because no renderer/font/fixture/application source changed.

docs/release-readiness/02_RELEASE_BASELINE.md

@@ -1,11 +0,0 @@
-# Discovery baseline and actual checks
-
-Date 2026-11-02. Source `5cb903b989742b7a96cb22ddf4c0e24993b18980`; application freeze `ba04d817fed26d659bfa2a56b089d6cac851dc34`. No accepted post-roadmap release candidate, build identifier or release image exists in this discovery checkpoint.
-
-Fresh check: `rtk proxy python scripts/test-mariadb-integration.py` exited 0; **5 tests passed** in 0.030 seconds. This existing offline suite mocks subprocess execution. The printed cleanup failure/exit 17 and setup error/exit 1 are intentional negative-test outcomes asserted by the suite, not a real container failure. No MariaDB/Docker execution occurred. This proves five runner guards, not database behavior, hosted isolation or a full regression.
-
-Read-only source checks confirmed the MariaDB default/missing-connection fail-closed behavior and the hosted workflow's explicit isolation blocker. Refer to SYSTEM_INVENTORY for inspected paths. `git diff --check` is a documentation hygiene check, not product qualification.
-
-Historical test totals, PDF exports, security scans and provider runs remain attributed to their original evidence. They are not fresh runs here. `docs/automation/handoffs/pre-phase10/FINAL_DEVELOPMENT_ENTRY.md` records the latest approved unchanged-source applicability and narrow PDF metric/visual closure. Direct chat does not adopt or activate its historical autonomous-controller instructions.
-
-NOT RUN: full backend/frontend/browser/Python/provider suites, builds, container validation, security scan/advisory refresh, performance, native review, deployment smoke, restore or rollback rehearsal. These require the actual release-stage source/environment and their own applicable gates. Discovery does not mark any mandatory release gate PASS merely because historical tests exist.

docs/release-readiness/11_BACKUP_RESTORE_ROLLBACK.md

@@ -1,36 +0,0 @@
-# Recovery implementation review and rehearsal plan
-
-2026-11-02; source `5cb903b989742b7a96cb22ddf4c0e24993b18980`. Read-only discovery. The entire 765-line `deploy/deploy.sh` was inspected, never executed or sourced. No operational keys, credentials, environment files, databases, containers or remote storage were accessed.
-
-## Distinct recovery mechanisms
-
-| Owner | Verified source behavior | Qualification boundary |
-| --- | --- | --- |
-| `SqliteDatabaseBackupRunner` | SQLite-only VACUUM snapshot and count retention; explicitly unsupported for MariaDB | Does not prove MariaDB backups exist |
-| `BackupController` | Authenticated, encrypted user-data export using application Data Protection; includes structured records and attachment metadata | Not a server-wide database/files/keys recovery set; do not use it as disaster recovery proof |
-| `deploy/deploy.sh:backup_database` | Requires explicit provider; SQL dump for MariaDB, volume archive for SQLite; rejects missing/empty/malformed/trailerless dumps | Format checks do not restore or compare records; emergency skip exists and is not approved here |
-| `backup_recovery_volumes` | MariaDB additionally archives required application data volume; independently archives tombstones when present | Consistency between dump/files/tombstones and current key availability still needs isolated rehearsal |
-| Retention/off-host copy | Daily/monthly retention and optional rclone copy | Source message calls remote encrypted but source does not establish actual remote encryption configuration; off-host configuration and recovery remain unverified |
-| `finish_deploy` | On failure after replacement, restarts previous backend/frontend image references when both exist; retains failed exit | No database reversal, no previous AI image restoration, and no post-rollback health check in this handler |
-| Tombstone store and replay | Validates ledger records; Program invokes `StageRestoredAccountsAsync` at startup; deleted identities are staged again | Test restored data with latest independent tombstones; corrupt ledger must fail closed. Existing AccountDeletionTests include restore replay, not a complete operational restore |
-
-Build retry paths prune Docker build/system cache and deployment may warm an Ollama model. Therefore even a proposed "local deploy smoke" must not run this script against the shared workstation. No such action was taken.
-
-## RR-11: backup connection parser mismatch - reproduced
-
-The script's host `sed` expression accepts `Server=` but returns no host for `SERVER=` and `Host=`. The latter is a documented MySqlConnector alias ([official connection options](https://mysqlconnector.net/connection-options/), checked 2026-11-02). The script then fails its required-host check before dump execution. Impact: a valid application connection spelling can prevent deployment backup/deployment; no observed data loss or actual production impact. Engineering priority proposed P2; not a security vulnerability rating.
-
-Three synthetic cases used only loopback and dummy identifiers. Exact source expression was extracted from the `db_host` assignment, then executed through Git Bash with `echo <shell-quoted synthetic input> | sed -n <shell-quoted source expression>`. Results: canonical `Server` -> `127.0.0.1`; uppercase `SERVER` -> empty; alias `Host` -> empty. Assertions confirmed all three results. No connection was opened. Initial direct Windows-to-sed invocations failed the positive-control assertion and were discarded as invalid harness evidence; the shell-native rerun passed its positive control.
-
-Proposed future remediation: parse with the same supported connection-string semantics as the API, or explicitly validate/document a narrower deploy contract before any operational step. Cover aliases/case, quoted separators, duplicate keys, missing required values and secret-redaction behavior. Do not print real input. Any implementation belongs to an authorised release remediation scope, not P10 cleanup.
-
-## Isolated rehearsal specification - NOT RUN
-
-1. Bind accepted candidate, image digests, migration history and disposable host ownership. Use synthetic accounts and a separate temporary MariaDB/files/key/tombstone set; never copy production data here without separate authority.
-2. Seed two owners with canonical profiles, CV overrides, letter history, submitted packages, attachments, encrypted provider placeholders and completed deletion tombstones. Record independent counts and artifact hashes, without recording plaintext secrets.
-3. Produce the actual supported dump/files/tombstone recovery set. Demonstrate a failed dump or missing required volume prevents promotion. Verify off-host retrieval/decryption separately if that integration is approved.
-4. Restore into a second isolated environment. Independently compare rows/ownership/revisions/artifact bytes; exercise application decryption and document reopening. Restore an older database with newer tombstones and prove erased accounts cannot regain access. Inject a malformed ledger and assert fail-closed startup.
-5. Rehearse prior-image rollback after failed replacement, then after a representative additive migration and writes. Check `/health`, `/ready`, exact version and authenticated read/write preservation. Document when image rollback is insufficient and database restore would lose newer writes.
-6. Measure recovery duration and data-loss window against owner-approved RTO/RPO. No target or measurement exists in this checkpoint. Preserve cleanup and evidence identities; no production execution or release approval implied.
-
-Fresh checks: Git Bash `bash -n deploy/deploy.sh` PASSED (syntax only); `python scripts/test-mariadb-workflow.py` PASSED 4/4 (source quarantine guards only). These are separate from the earlier 5/5 offline runner tests. Restore, failure injection, hosted isolation, live encryption and rollback health remain NOT TESTED.

docs/release-readiness/13_REMEDIATION_REGISTER.md

@@ -1,21 +0,0 @@
-# Preliminary release blocker reconciliation
-
-Discovery only, 2026-11-02. These are qualification gaps unless a concrete defect is stated. No inferred P0/P1 vulnerability ratings or owner risk acceptance.
-
-| ID | Historical item / current finding | Status / closure evidence needed |
-| --- | --- | --- |
-| RR-01 | Phase 9/10 and production NO-GO | Phase 10 assessment now independently published, implementation still awaits exact approval. Later roadmap acceptance absent. BLOCKED for final RC |
-| RR-02 | Old Linux 11/24 and later S01 failure narratives | Latest handoff records approved S01 36/36 per platform and owner visual acceptance for unchanged development output. Do not reopen these metrics without affected change; physical print/device remain NOT TESTED |
-| RR-03 | Python advisory/native parser/image qualification | Latest scoped conditional disposition retained; current advisories and production-equivalent native isolation NOT TESTED. No new scan or risk waiver |
-| RR-04 | Hosted MariaDB/isolation | Source explicitly fails before execution until isolated runner proof. BLOCKED; fresh local 5 guard tests do not close it |
-| RR-05 | Human/device/provider | Actual AT/contrast, physical devices/print, native language and live provider accounts not qualified here. BLOCKED/NOT TESTED by lane |
-| RR-06 | Old known-issues F19 SQLite fallback statement | Current DatabaseConfiguration defaults to MariaDB and throws without connection. Old wording is superseded for this source. SQLite retirement still BLOCKED on transfer/restore/parity gates |
-| RR-07 | Old F01 stale-write statement | MariaDB acceptance documents bounded RD21 resolution; later handoff carries it. Do not reopen all old F01 findings based on stale index wording; final affected API census/regression remains required |
-| RR-08 | MySQL TLS / dependency / production identity | Latest handoff retains MYSQL-TLS-01 and OPS-01. No live configuration read; current advisory disposition and deployed equivalence unverified |
-| RR-09 | Backup/restore and rollback | Existing procedures and historical seeded rehearsal are not a current restore. Need isolated recovery-set completeness, decryption, tombstone behavior, post-write rollback compatibility and agreed RPO/RTO |
-| RR-10 | AI quality/activation | Deterministic Docling fixtures are distinct from real-model semantic accuracy. Optional unqualified adapter remains disabled; no AI invocation authorised here |
-| RR-11 | Backup host parsing rejects supported `Host=` alias; uppercase spelling also unrecognised | REPRODUCED with synthetic input and shell-native positive control. Deployment aborts before backup; proposed P2 compatibility defect. Fix scope awaits authorised release remediation |
-| RR-12 | Rollback restores core images without post-rollback health qualification; no schema/data/AI reversal | VERIFIED source limitation, runtime impact NOT TESTED. Requires isolated post-migration/post-write recovery rehearsal; no rollback guarantee |
-| RR-13 | Off-host encryption and recovery-set consistency not established by script success messages | NOT TESTED operational qualification. Verify remote encryption, retrieval/decryption, database/files/key/tombstone consistency in approved isolation |
-
-Next remediation is evidence work: complete the source/endpoint/environment census and resolve historical records against their exact latest evidence. RR-11 now has a bounded future fix proposal in 11_BACKUP_RESTORE_ROLLBACK.md; no runtime implementation is authorised by this discovery checkpoint. Every fix needs minimal scope, targeted verification and the applicable stage approval.

docs/release-readiness/14_RELEASE_ACCEPTANCE_MATRIX.md

@@ -1,26 +0,0 @@
-# Preliminary acceptance matrix
-
-2026-11-02. **NO-GO for production.** This is a discovery snapshot, not Stage 7 final acceptance. No accepted final RC or production-equivalent build is nominated. PASS applies only to an executed gate, not historical source evidence.
-
-| Mandatory gate | Current release verdict | Missing release evidence / dependency |
-| --- | --- | --- |
-| Functional regression | BLOCKED | Accepted final roadmap source; fresh applicable critical journeys |
-| Frontend/UX | BLOCKED | Accepted design/implementation and final source-bound browser evidence |
-| Accessibility | NOT TESTED | Actual AT/device/contrast/manual evidence plus automation |
-| Authentication/authorization | NOT TESTED | Final endpoint/tenant/session qualification |
-| Security assessment | BLOCKED | Dedicated security initiative start and predecessor gates; no scan run |
-| Backend APIs | NOT TESTED | Final API census and applicable regression |
-| MariaDB/migrations | BLOCKED | Hosted isolation and actual RC upgrade/recovery evidence; five offline guards are not this gate |
-| CV/PDF fidelity | BLOCKED | Final RC source equivalence and retained scoped approvals; physical print still missing |
-| AI integrations | BLOCKED | Explicit isolated-model qualification and semantic evidence |
-| Email/OAuth | BLOCKED | Actual configured provider/consent/account verification |
-| Performance/reliability | NOT TESTED | Approved load targets and bounded final-source measurements |
-| Docker/infrastructure | NOT TESTED | Exact images/environment/configuration/ingress parity |
-| CI/CD | BLOCKED | Hosted isolation and fresh actual run/artifacts |
-| Backup/restore | NOT TESTED | Disposable complete recovery rehearsal with content assertions |
-| Deployment/rollback | NOT TESTED | Authorised isolated rehearsal; production execution remains prohibited |
-| Monitoring | NOT TESTED | Failure detection, delivery and redaction evidence |
-| Documentation | NOT TESTED | Complete release-source/runbook reconciliation, beyond this partial discovery |
-| Human/device/provider | BLOCKED | Real reviewers/devices/accounts and source-bound records |
-
-No gate is marked FAIL without fresh evidence of unacceptable behavior. No missing qualification is marked PASS. Historical source-specific acceptance may be reused where permitted and unchanged, but cannot establish final release readiness by itself.

docs/release-readiness/HANDOFF.md

@@ -1,11 +0,0 @@
-# Release discovery handoff
-
-Branch `planning/release-readiness-discovery`, baseline `5cb903b989742b7a96cb22ddf4c0e24993b18980`; documentation only. Stage 1 IN_PROGRESS, not complete. Full authoritative release prompt read. No final GO/NO-GO completion report or deployable release claimed.
-
-Completed: initial source inventory, historical blocker reconciliation, preliminary 18-gate matrix and five fresh offline MariaDB runner guard tests. Preserved scoped PDF acceptance and separate model/provider/human/hosted/production gates.
-
-Next authorised work: complete endpoint and environment census, map each failure boundary to existing test/runbook owners, and inspect remaining backup/restore/deployment implementation without executing it. Then prepare a concrete isolated-rehearsal plan. Final baseline/qualification depends on accepted roadmap source; do not run thousands of unchanged tests to fill this report.
-
-Continuation: recovery implementation inspection and isolated rehearsal specification are now recorded in 11_BACKUP_RESTORE_ROLLBACK.md. RR-11 parser mismatch reproduced using three synthetic cases; RR-12/13 retain rollback/encryption qualification limits. Four source quarantine guard tests and shell syntax check passed. No deployment script execution. Next: endpoint/environment census, then remaining independent I18N/homepage audit work. Stage 1 remains IN_PROGRESS.
-
-No production credentials/environment files were opened; no infrastructure, models, main branch or autonomous orchestrator changed. The earlier delegated researcher was interrupted by a service limit; parent supplied this partial checkpoint. No background agent remains active.