# P7-07 — Documents owner-scoped index

**Implemented scope: CONDITIONAL GO; final hygiene PASS; Documents publication verified.** The backend contract was normally pushed as `8e4db12`; the separate [Documents interface](UI.md) passes its affected component, native, build and finite visual checks. A later normal push publishes its implementation/documentation together with the separate UTC repair; direct development refs match at **2026-10-16 21:01:11.788733 UTC**. Known P7-08 presentation work remains uncommitted, so this does not claim a clean checkout or full Phase 7 acceptance. Follow the exact [Phase 6 handoff](../../phase-6/p6-05/PHASE7_HANDOFF.md#migration-order-and-commit-boundaries) and [Documents architecture](../../phase-3/DOCUMENTS_UX.md). The contract was pushed before interface implementation.

The preceding compose commit `223dcf57d26bab624261994b61a46f2d3e2dd5b2` was normally pushed and directly verified at **2026-10-14 11:03:15.576853 UTC**: clean HEAD = origin = live development; local/origin/live main remains `27657f31131cd95d42f0e1290853ec9c9b3959a4`. [Entry evidence](evidence/entry.json) records the receipt and fresh existing-contract baseline: **37 passing cases**, unchanged Release DLL, with all20 captured sources unchanged before/after. This is an existing-contract subset, not a Documents endpoint or full-suite execution.

## Bounded contract

Authenticated `GET /api/documents` indexes existing CV variants, cover letters/history, application-answer/recruiter drafts, tailored CV drafts, attachments, frozen submitted packages and saved email drafts. It returns metadata, recorded source identifiers and existing destinations. It does not return bodies, notes, settings/profile JSON, rendered HTML, storage paths, bytes, recipient addresses, thread IDs or sending UUIDs.

Use validated pagination, literal metadata search, supported type/state/public-visibility/job filters and whitelisted name/date sorts. Count and page must execute in the database with bounded results. Every source, parent and company join must enforce the authenticated owner. Preserve independent/detached CVs and existing owned resources attached to soft-deleted jobs; expose the deleted-parent flag honestly.

Current CV/attachment, unsent draft material and frozen package are different states. CV public/private is independent of submission. A cover-letter history entry survives clearing current text and records whether current content exists. Submitted metadata uses captured CV identifiers/name/version and attachment counts; it cannot resolve these from mutable current sources. Uploading a certificate does not verify a qualification. A draft does not prove delivery; a captured package does not prove employer receipt.

Date sorting compares genuinely recorded UTC instants, including exact offset/fractional ordering. Legacy attachment `UploadDate` uses `DateTime.Now` without recording its timezone. Preserve its recorded local date for display and classify it `uploaded-local`; its UTC sort key is unavailable. Local/unknown dates remain after comparable dates in both ascending and descending order, with stable type/resource identity ties. Do not label this mixed index “last updated” or infer a timezone. Name sorting is unaffected. This policy requires explicit UI explanation and regression coverage.

## Validation and preservation

New ordinary HTTP regressions must fail against the missing endpoint before implementation, then pass with native SQLite. Cover every source, A/B/anonymous isolation, search/filter/count/pagination, literal wildcard characters, stable ties, offset/fractional dates, unknown-date placement, malformed relationships and source-history preservation. Inspect commands for count/order/limit/offset and absence of resource-body projection or writes. Listing must never render PDF, invoke AI, capture a package or access file storage.

Keep ordinary P2-D01 and exact frozen HTML/letter/archive-byte proof. The old Phase3 P2-D01 blocker is historical: the latest ordinary browser case passes in [P7-06](../p7-06/COMPOSE.md). Source actions retain existing ownership, CV association/detach rules, revision semantics and safe downloads. Native SQLite and MariaDB SQL composition are separate evidence; unexecuted MariaDB behavior cannot become production acceptance.

All57 preservation groups remain56 PARTIAL / C11 DEFERRED, with32 original routes preserved. Derived inventory is739/94 frontend,301 browser,1041 backend; it is not a fresh integrated pass count. Human reader, physical touch/software keyboard, zoom, provider/output and release conditions remain open. P5-13 is withheld; P7-06F is deferred; main unchanged, production NO-GO. No Phase8 implementation.

The observations below retain the contract's chronology. The latest interface result is recorded at the end and in its separate report; earlier pending statements are historical.

## Final backend observation

[Contract report](CONTRACT.md) and [portable results](evidence/contract-results.json) record final12/12 new contracts,80/80 related/auth/draft cases and actualProgram/nativeSQLite cookie3/3 plus ordinaryP2-D01PASS. Full .NET whitespace semantics, ordinal Unicode marker handling, actual bound pagination parameters, frozen metadata/bytes and strict tenant cases retain ordinary assertions. All failed attempts and source/timing qualifications remain. Final26/33/23 sources and binaries match; Release compilation and browser types pass. There is no DocumentsUI/axe/physical/human acceptance yet, and actualMariaDB execution remains unverified. Derivedbackend1053/browser304/frontend739/94 are not integrated passing counts. Hygiene and normal development push follow; the UI starts only after verified contract push.

Final metadata-contract hygiene PASS observed 2026-10-14T16:00:00.842457+00:00: secret and working/staged/phase whitespace gates pass;18 docs/504 local links resolve,57 groups and32 original routes retained. Backend contract implemented CONDITIONAL GO; normal development push pending. Actual MariaDB execution and Documents UI remain unverified; main unchanged, production NO-GO.


## Contract push and UI continuation — 2026-10-16

Metadata contract normal push directly verified as **8e4db121ae0ec3f1637c83ddeaa3f31abd0a61be** at 2026-10-14T16:02:14.215615 UTC: clean HEAD = origin = live development; main27657f3 unchanged. Backend implemented scope remains CONDITIONAL GO, with actual MariaDB execution unverified. A fresh fetch on 2026-10-16 found no intervening commits. The separate Documents interface now proceeds; its entry and bounded requirements are recorded in the P7-07 UI report. Earlier pending-push statements are historical observations. No production deployment or Phase8 implementation.

## Documents interface — final local evidence

[Portable UI results](evidence/ui-results.json) record **86 cases in eight frontend suites**, **eight new Documents browser journeys**, **four existing CV frame journeys** and **ordinary P2-D01**, all passing on the final captured source. App/browser TypeScript, lint and production build pass. The build is `H6tIi63meKxiKJUAiZrOm`; all 29 source existence/hash records and three API/test/build identities match before and after the final native batch. This interface changes no backend source or renderer.

All **18 final images** were actually reviewed: 17 Documents states/layouts and the existing frozen-package consumer image. The 15 default-enabled plus target-size axe scans have zero violation nodes and **101 incomplete nodes**, all retained and contextually triaged. Human screen-reader, real zoom, physical touch/software keyboard and production output acceptance remain open. A cramped attachment-error action was moved below its message and verified in the rebuilt page. Minor long-action wrapping at 1024px and the existing raw CV `Not Found` error copy remain explicit P7-11 residuals.

The original 32 routes remain; `/documents` adds a supported 33rd route. All 57 preservation groups remain 56 PARTIAL / C11 DEFERRED. Added coverage derives frontend **755/95**, browser **312**, backend **1,053**; these are inventories, not a fresh integrated regression result. P7-12 still owns that run. P5-13 remains withheld, followMode deferred and production NO-GO. `main` is unchanged; Phase 8 has not started.

The configured Git host refused port-443 connections during the earlier recorded fetch attempts; those failures remain historical evidence. Actual publication recovery is recorded below. P7-08 through P7-12 remain; their approved order and dependencies are unchanged.

Final [static checks](evidence/ui-static-checks.json) passed at **2026-10-16 16:21 UTC**: secret scan and working/staged/phase whitespace checks, 19 documents / 518 local links, all 57 preservation groups and 33 current routes. Static checks verify local main/origin-main refs only; they do not establish current remote or production state.

## Actual local commit and failed publication — 2026-10-16

Documents interface commit **`5a67ec3d3d5dc27298814b0a3f46540cb54ea3a3`** is safely recorded locally. Its [publication chronology](evidence/ui-publication.json) retains the failed normal push **16:22:30.090899–16:22:51.339211 UTC**, exit **128**, because `git.cesnimda.uk:443` could not be reached. A second normal push of publication-documentation commit **`84350b71a67400cd62730e46bf05f06176bcd733`** also fails at **16:31:50.187856–16:32:11.434629**, exit 128. At those observations publication is blocked and cached `8e4db12` is not current live identity. Main is not pushed; the failed attempts are not removed by the later recovery.

## Verified publication recovery — 2026-10-16

The normal development push **21:00:51.343381–21:00:53.589287 UTC** succeeds, exit 0, publishing **`5a67ec3`**, **`84350b7`** and the separate UTC repair **`9dfea1226f57ba12b944e05e0e83fb2fea846131`**. At **21:01:11.788733**, local HEAD, origin development and the directly queried development ref all equal `9dfea1226f57ba12b944e05e0e83fb2fea846131`; local/origin/live main all remain `27657f31131cd95d42f0e1290853ec9c9b3959a4`. The immutable `.artifacts/phase7/p7-08/utc-push-receipt.json` is **1,680 bytes**, SHA256 `12f339239dfb6ef458d31ca6918555e4eb4ce35bc5dacfa3acd33cd34ebffd65`, linked in the portable publication chronology. Separate notification presentation/tests/native helpers are known unstaged work at that observation: refs are synchronized, but a clean working tree is not claimed. **P7-07 publication: verified; implemented scope remains CONDITIONAL GO. Production: NO-GO; no main push or deployment.**