# P5-15-01 functional defect register

**Current R-03 disposition:** [Analytics authentication repair](analytics-auth-repair/README.md) closes AUTH-01 for the verified complete safe return-path scope. The unchanged original assertion is RED→GREEN; all134ordinary browser cases, both separate diagnostics, safe-target/foreign404/account-disposal and existing saved-search/Rules journeys pass. Current open totals for the three original reproduced defects: **P0=0/P1=0/P2=0/P3=0**. This does not close separate debt/evidence gaps or grant whole-group PASS. Production remains NO-GO; P5-15-02 has not begun. R-02 disposition and original observed failures below remain historical.

**Historical R-02 disposition:** [Rules draft repair](rules-draft-repair/README.md) closed SETTINGS-01 for verified internal draft retention and related Save/validation/failure/retry/Discard/account isolation. DISCOVERY-01 remained scoped CLOSED by R-01. **AUTH-01 remained P2/OPEN; reproduced open totals at R-02:P0=0/P1=0/P2=1/P3=0.** Fresh complete R-02 ordinary browser128pass/1fail and diagnostics2/2 retained the remaining real failure. Production and P5-15-02 remained NO-GO. Unknown historical Rules/notification/language500 causes and [CV intermittent observation](INTERMITTENT_FAILURES.md) remain open.

**Historical R-01 disposition:** DISCOVERY-01 is **CLOSED for the verified SQLite listing/error/recovery defect** by the [bounded repair](saved-search-repair/README.md). Live deployed-provider qualification and complete PRES-J02 delivery/device acceptance remain open. AUTH-01 and SETTINGS-01 remained P2/OPEN at R-01; reproduced open counts wereP0=0/P1=0/P2=2/P3=0. Original reproduction/severity/evidence below remain historical; closing this defect does not erase release blockers or grant full-group PASS.

Audit source `932b962b9038ddb5ad59b982c0199475bfb50454`. Findings use synthetic accounts and disposable local data; no production account, provider or infrastructure is exercised. An audit finding is not automatically a regression introduced by Phase 5. Application source is unchanged here; neither source inspection nor an InMemory pass can override a native failure.

P0 means serious security/data loss; P1 an important broken workflow; P2 limited/recoverable functional failure; P3 minor inconsistency. Missing evidence is a gap, not a defect. The original [debt register](../READINESS_DEBT.md) remains authoritative for separately carried items. This register assigns concrete remediation; it does not authorize or perform it.

## P5-15-01-DISCOVERY-01 — Saved-search listing fails on SQLite

**Confirmed P1 at audit / CLOSED by R-01 for the verified SQLite defect.** PRES-J02; `/discover`; `GET /api/job-discovery/saved-searches`. The original local SQLite workflow was NO-GO; see the successor native proof. Production release remains blocked by its separate readiness/provider verification obligations; a SQLite exception is not proof of the deployed MariaDB result.

| Field | Evidence-based finding |
|---|---|
| Expected | List the authenticated owner's saved searches, newest update first, with retained result counts and run/pause/delete/dismiss access; an empty account returns an empty successful list |
| Actual | Real normal and admin route entry return HTTP 500, including an empty account. `JobDiscoveryPage` catches the load error without feedback and leaves the list empty |
| Reproduce | Use the ordinary Playwright disposable Development/SQLite server; log in with a synthetic normal or admin account; open `/discover`; observe the genuine saved-search GET. The added native route census asserts success and retains the failure |
| Native evidence | [Installed-provider proof](evidence/discovery-failure.json) fingerprints the initially collected HTTP/translation evidence; [final census](evidence/browser-summary.json) preserves all 192 observations, repeated normal/admin entry+refresh500s and current failure-trace fingerprints. Intermediate trace paths may have been replaced by later owning-suite runs; historical fingerprints are collection-time evidence. No NAV request is needed |
| Root cause | Current `ListSavedSearches` orders unconverted `DateTimeOffset UpdatedAtUtc`. Installed EF Core SQLite rejects that `ORDER BY` during translation. An ignored translation-only harness reproduces the exact exception with the database connection **Closed** |
| Coverage gap | Existing discovery/saved-alert controller tests pass using EF InMemory; existing SQLite compatibility cases do not cover this query. The responsive discovery browser fixture substitutes search/import responses and does not prove saved-search persistence |
| User impact | Persisted searches and their controls cannot be recovered through the list on refresh; a successful current-session creation is insufficient. Search results from NAV are a separate capability |
| Data/security impact | No demonstrated deletion, corrupted stored rows, owner bypass or cross-account disclosure. The failure precedes SQL execution; availability and silent feedback are the demonstrated defects |
| Proposed repair | Backend discovery owner: reuse the existing provider-compatible ordered-read pattern while retaining owner filtering, result relationships, cancellation and DTO semantics; report load failure/retry without presenting it as an empty list |
| Required regression | Real disposable SQLite: empty list; two dated owned searches plus foreign search; exact descending owned IDs/counts; native normal/admin entry+refresh; prove no provider call. Verify deployed provider separately |
| Checkpoint | Independently scoped P5-15-04 remediation, before accepting the affected workflow. No repair is rolled into this audit |
| Provenance | The controller/model/consumer and test sources match the audit checkpoint. No evidence establishes which earlier release introduced it; do not label it a new redesign regression |

## P5-15-01-AUTH-01 — Login drops protected deep-link query state

**Confirmed P2 at audit / CLOSED by R-03 for the verified authentication-return scope.** PRES-E02/E07 route continuity; representative `/analytics?months=6` → public entry → login. The historical failure table below remains intact. [Successor proof](analytics-auth-repair/evidence/auth-proof.json) retains the original failed URL, corrected exact destination/selected period, encoded query/hash, history/expiry/logout and native foreign404/tampered-target checks. The repair captures the complete destination at App's existing guard and validates it at Login completion; it does not change Analytics data or server authorization. Real providers, challenge/AT/device/production acceptance remain open; E02 is PARTIAL, not PASS. This recoverable context failure did not grant permissions or lose saved application content.

| Field | Evidence-based finding |
|---|---|
| Expected | After successful login, return to the requested safe local destination with its meaningful query state; the requested six-month Analytics period remains selected |
| Actual | Browser reaches `/analytics` without `months=6`; the default period replaces the requested period. The desired-state regression remains failed, never marked expected or skipped |
| Reproduce | Anonymous browser opens `/analytics?months=6`; use landing Sign in; authenticate a synthetic account; inspect destination and period control |
| Root cause | `App` saves `location.pathname` as `state.from`; Landing forwards it and Login validates/navigates that path. Search/hash are already absent before Login receives it |
| Evidence | Added anonymous native census completes the route-entry/refresh checks, then fails the exact post-login URL assertion. Source characterization agrees with the earlier [route plan](../ROUTE_ACCEPTANCE.md#query-state-and-alias-behavior-to-audit) |
| User impact | User must reconstruct the requested reporting context. The same auth-guard source also creates a risk for other query-addressed workflows, but this audit does not claim native failures for every possible query |
| Data/security impact | No demonstrated tenant bypass, unsafe external redirect, record mutation or content loss; retain safe-local-target validation in any repair |
| Proposed repair | Identity/shell owner: preserve the intended safe local pathname/search/hash at the existing auth boundary; retain state/permission/invalidation rules |
| Required regression | Anonymous→login and expired-session return to Analytics period and owned Job section/Jobs filter; reject unsafe/external targets; maintain Back/Forward and account disposal |
| Checkpoint | Separate bounded P5-15-04 repair. Do not change auth/application behavior in this audit |
| Provenance | This path-only limitation was explicitly recorded during P5-15-00; native reproduction confirms the debt, not a newly introduced audit regression |

## P5-15-01-SETTINGS-01 — Unsaved Rules draft disappears on tab change

**Confirmed P2 at audit / CLOSED by R-02 for the verified Settings-session draft/save/error scope.** PRES-S03; `/settings` Follow-ups→Notifications→Follow-ups. The original failed observation below remains historical. R-02 retains the single draft above the unmounting tabs and proves explicit Save/error/retry/discard/account behaviour; unknown backend500 causes and other Settings acceptance stay open. This was silent loss of an in-progress edit, not deletion or corruption of persisted rules.

| Field | Evidence-based finding |
|---|---|
| Expected | An unsaved rule draft survives ordinary settings-tab navigation, or the user receives a deliberate dirty-state warning before discarding it |
| Actual | The rule starts at 14; user edits it to 5; tab round trip displays 14 without warning. API readback remains 14, with zero rule writes |
| Reproduce | Sign in with disposable synthetic account; open Settings→Follow-ups; change Applied follow-up days to 5; open Notifications; return to Follow-ups without Save |
| Evidence | Separate native `preferences.spec.ts` desired-behavior case fails; [browser summary](evidence/browser-summary.json) records original/draft/displayed/readback values, zero writes, HTTP200 and failure evidence fingerprints |
| Root cause | Inactive `SettingsView.TabPanel` returns `null`; `RulesSettingsCard` owns draft state locally. Unmount loses the draft, and remount reloads the persisted rules |
| Coverage gap | Existing native Settings fixture edits across widths while mounted, **saves**, then changes tabs; it never protects an unsaved tab round trip |
| User impact | User must re-enter edits and may assume they saved or retained them. No demonstrated persisted-record loss, duplicate write, revision corruption or account leakage |
| Proposed repair | Settings owner: retain the draft at the existing settings owner or use the established dirty-navigation contract. Preserve per-section Save/API semantics and do not invent autosave |
| Regression required | Unsaved tab and mobile-section round trip, explicit Save/reload, failure/retry and intentional discard; no accidental rule write merely from navigation |
| Checkpoint | Separate bounded P5-15-04 remediation; no application fix is performed in this audit |

## Carried findings and bounded native diagnosis

The two standalone [preference diagnostics](diagnostics/README.md) assert intended behavior without success mocks, expected-failure flags or retries. Their actual outcomes belong in the final audit evidence; discovery of a 500 must not be normalized into a pass. Initial config-start and locator mistakes are harness errors, separately retained, not application defects.

| Item | Current disposition / required action |
|---|---|
| Unsaved Rules draft on tab change | Original native P2 SETTINGS-01 is retained historically; R-02 proves the scoped repair without closing unrelated persistence reliability |
| Language/notification preference writes | Three native overlap rounds succeeded, including six writes, twelve concurrent reads, persisted readback and reload. Historical language PUT500 and notification SQLite/concurrency failures remain open; **not reproduced in this bounded run** is not fixed. No cause for the historical language500 is established; overlapping Identity writes remain a hypothesis |
| Company modal failure feedback; command/attachment initial focus races | Earlier finite failure observations remain open. Current passing keyboard/modal fixtures do not prove the historical race or outside-modal feedback debt closed; P5-15-02 triage and 04 owner repair as needed |
| Board scaling and physical touch | Finite 250-ID parity is functional evidence only; full-result memory/request/DOM growth and real device drag remain unqualified. No arbitrary capacity threshold is invented |
| CV production fonts/photos; actual assistive technology and software keyboard | Verification gaps; not demonstrated functional failures. P5-15-02/03 and named human/device/operator evidence required |
| P5-13 and `followMode` compose UI | Approved deferrals, not accidental dead controls. P5-13 remains unqualified/Production-withheld; metadata-only followMode survives the current route contract |
| F04, current backup/restore, production config/schema/keys and rollback | Existing release blockers remain NOT VERIFIED. No deployment/production checks or `main` push are performed here |

**No P0 is demonstrated by the collected evidence.** That is a bounded finding, not an exhaustive security certification. At the original audit, P1 saved-search verification and dependent activity were blocked; R-01 now supplies the scoped repair proof; independent audit evidence can still be collected safely.

Original audit finding totals: **P0 0 / P1 1 / P2 2 / P3 0**. Historical open totals after R-01: **P0 0 / P1 0 / P2 2 / P3 0**; historical R-02 totals were **P0 0 / P1 0 / P2 1 / P3 0**. These are three distinct original failures, not the same count as failing browser cases: normal/admin cases shared DISCOVERY-01; AUTH-01 occupies the anonymous case; SETTINGS-01 was a separate diagnostic. Carried failures/evidence gaps are additional debt, not silently closed or counted as newly reproduced defects.