# P7-10 System

**Implemented CONDITIONAL GO; final hygiene/publication pending.** Entry: Audit `f9e1d06bf7fc4081b70ebf461f1645ef219e0a93`, normally pushed and directly verified20October13:26:54UTC; separate Qwen3.5 adapter preparation `1d34406d1bacdb33d180f0e7e37bb0cb099ece5e`, pushed/directly verified13:33:16UTC. Main remains at its separately authorized CI repair `d1fcd23`; these development commits do not establish deployment.

## Findings and bounded implementation

The old combined load discarded successful diagnostic responses on another failure, swallowed optional failures as absent results, and erased SMTP drafts and write-only password/clear state on refresh or locale changes. Initial failure could display invented offline/disabled/zero metrics. Tabs lacked named panels. Operational writes could compete, and a late acknowledgement could replace newer edits.

The existing four read endpoints now retain independent availability and targeted GET-only retry. No status means no fabricated metric cards. A failed refresh qualifies retained values; denied access clears sensitive diagnostics and prevents operations. Shared page/section surfaces, density tokens, wrapping metadata/actions and linked tabs/panels retain the existing status/settings architecture and all original diagnostic values/helpers.

SMTP fields, password and clear-state revisions preserve unsaved edits through refresh and newer edits through a submitted acknowledgement. Blank-password retention and explicit clear payloads are unchanged. All existing save/test/probe/allowlisted-maintenance operations share synchronous admission and session/lifetime guards. Successful explicit probe retains its status readback; failed readback offers GET recovery without replaying POST. Focus moves to the named pending region and returns to a surviving control or heading. No automatic operation runs on entry or tab changes.

## Evidence and qualifications

Initial ordinary unit baseline:4 passing/5 failing against the old owner. Expanded regression covers independent optional reads, denied refresh, failed-save retention, password clearing, newer snapshots, probe/readback recovery and session disposal. Existing backend **46/46 PASS**, zero skipped: AuthAndSystemControllerTests, MaintenanceJobDispatcherTests and ApiAuthorizationPostureTests, unchanged Release binary.

The first candidate passed20 frontend cases,3 native cases, app/browser TypeScript, lint and production build. Native cases use real isolated login/non-admin403 checks but controlled administrator System reads and SMTP PUT acknowledgements. They never send email, change actual SMTP configuration, run AI probes or dispatch maintenance. Six paired EN/NB/light/dark widths320–1920 exercise both panels and root reflow. Fourteen all-enabled axe scans reported0violations/100incomplete nodes, including the inherited roleless version badge, short badge text and overlapped focus/field backgrounds. These remain qualified automated evidence.

Three candidate PNGs were actually inspected:320px Bokmål dark settings,1024px English dark diagnostics and1440px retained-newer SMTP draft. That review found a saved-message ambiguity while newer edits remained unsaved. A localized SMTP dirty caption now distinguishes newer/failed edits from acknowledged values; two existing unit assertions and a native assertion failed ordinarily before the correction. No saving semantics changed.

Final **20/20 frontend PASS**13:38:37–13:38:53UTC; **3/3 native PASS**13:38:27–13:39:04UTC, zero skips/flaky/retries, export **`EAHpn0GPj6rRy3WtHltbf`**. App/browser TypeScript, lint and build pass on the final source. [Portable results](evidence/system-results.json) record command/source/image identities; source hashes are post-run observations. Both final320px Bokmål settings and1440px newer-draft images were actually inspected. Twelve other final images remain automated evidence; earlier candidates/REDs are retained separately. Fourteen final axe scans remain0violations/100incomplete nodes. Full-page fixed-shell/skip-link capture artifacts are qualified rather than human/device acceptance.

Sixteen added System cases derive884 frontend cases/99 suites; three native additions derive348 cases/57 files. These are inventories, not fresh whole-suite passes. Sidecar is separately56/56 after the seven-case Qwen compatibility repair. Final integrated acceptance remains P7-12.

No API/schema, provider capability, diagnostic source, renderer/PDF/revision/frozen association or AI-safety contract changes. Actual SMTP/probe/maintenance/provider execution, human screen-reader, physical touch/software keyboard, actual zoom and production output remain unverified. Separate recent-auth enforcement is absent in existing administrator operations and is not claimed. All57 groups retain56 PARTIAL/C11 DEFERRED and33 routes; P5-13 stays withheld. Phase8 has not started. Production readiness remains NO-GO despite separate owner release authorization.