jobtrackingapp/docs/redesign/audit/RISKS_AND_MIGRATION.md

Risks and proposed migration approach

This report proposes the next steps; it does not authorize or implement Phase 2, B07 or a backend overhaul. Original security findings keep their IDs and queue ownership. Validated implementation queue remains the source for those fixes.

Prioritized regression risks

Risk	Source evidence	Smallest appropriate response / gate
Lost identity boundary during a new shell/cache/client	App, api, sessionBoundary; B02 server session preconditions	Keep private provider unmount, immutable provenance, abort/late-response checks and real A→B tests. Session headers never become rate-limit owner identity
Editor redesign hides existing lost-update behavior	CV save payload lacks expected revision; page-local save queue is not cross-editor concurrency	Coordinate existing D01/D02 integrity tickets before changing save/conflict UX. Do not call history/undo optimistic concurrency or add a generic concurrency framework
Creation replay becomes easier through capture/dialog rerenders	Preview/duplicate warning and subsequent create are separate requests	Preserve current review flow; existing D04 creation-intent ticket is distinct from identity and record revision. No idempotency work in this audit
Route consolidation loses entry contracts	Two router layers, legacy /applications/:id, old section mappings, ?add, notification/company deep links	Route manifest + redirect tests before moving navigation; keep capture and OAuth callbacks functional
New styling repeats existing contrast/focus defects	Validated F14 theme pair contrast; builder preview scroll-region transition	A01 semantic foreground/background/state colors, A02 preview structure, A03 loaded/manual verification before broad page work
Thin initial-state tests create false confidence	Eight-route axe sample; component API mocks; historical TS2571 now corrected during release repair	Phase 2 loaded-interaction and explicit standalone type gate; require feature-ledger evidence per migrated workflow
CV/profile semantics blur in a unified editor	Canonical profile save versus CV override/settings and published slug	Clearly display source versus document override; test master unchanged, source selection, history, publish/unpublish and long PDF
AI presentation implies facts or silently applies changes	Contextual suggestions and extraction accept/discard already exist	Preserve preview/reject/apply and source/context metadata; prompt instructions alone do not prove factual accuracy
Draft/history/mail/package behavior lost in visual simplification	ApplicationAssets 769 lines, inbox 750, correspondence 747; separate persistence/attempt APIs	Extract by cohesive responsibility, not one generic form; keep conflict/send uncertainty, frozen package and unsaved guards
Broad navigation has competing labels/destinations	Eleven main nav entries plus account/admin; profile vs career; table/board separate; embedded operations/review	Design grouped IA with an explicit preservation/redirect map; improve discoverability without deleting capabilities
Styling consistency remains expensive	Central theme plus hardcoded shell navy/indigo, page-local shadows and large sx compositions	Retain MUI; establish tokens and a few layout/field/state primitives, then validate representative surfaces
Large editor/page modules couple visual and persistence work	Editor 1,131 lines; career 879; job table 866	One cohesive extraction at a time, bracketed by real workflow tests; file length alone is not a rewrite justification
Dashboard customization mistaken for an existing server contract	Only five visibility booleans in owner-local storage	Keep current prefs until Phase 8; separately decide device-only vs cross-device contract before persistence/schema work
International/mobile regressions	Mixed 768/900/MUI breakpoints; hardcoded English mobile accessible name; EN-only axe	Preserve current mobile adaptations; long Bokmål labels and locale/date semantics in the representative matrix
App route identity churn	Router memo depends on job display preferences in App	Potential state-reset risk, not reproduced here; test changing preferences during meaningful workflow before refactoring router ownership
Unstable release proof or assumed production ingress	New CI prerequisite/build failures; Docker unavailable; F04 open; HTTP redirect observed to unreachable port 444	No stable/live claim from push alone. Keep required gates and complete operator evidence; no trust-all fallback or invented proxy CIDR

Line counts come from the source census; they are prioritization context, not measured performance. No new authorization bypass is alleged by this redesign audit.

Recommended order

1. Finish the authorized release attempt and retain the checkpoint. Required CI and deploy preflight must pass before calling the changes live. Production F04 runtime/firewall/DNS/peer checks remain a separate closure gate. Audit/planning can continue without claiming Phase 0 stability.
2. Phase 2 — Functional baseline. Add explicit standalone CI type checking (the TS2571 assertion was corrected separately in release repair a861ca4); trace preservation IDs to existing tests; add missing loaded workflow/route/AI-review tests. Preserve B01–B06 regression suites. Coordinate outstanding record-integrity and recovery tickets through their existing queue, without silently starting them here.
3. Phase 3 — UX architecture. Define grouped navigation, Jobs view switch, destination for embedded Documents/Analytics/Notifications, full-page/preview contract, contextual AI pattern and mobile workflow rules. Map every current route/feature to its destination and backward-compatible entry. Keep API contracts.
4. Phase 4 — Shared foundations. Use existing MUI/Emotion/theme system. Resolve proven semantic contrast and focus defects, then unify tokens, page/layout/state primitives, labelled fields, buttons, dialogs/drawers and tables. Avoid a speculative new design-system framework.
5. Phase 5 — Representative migration. Shell → Jobs table/board entry → full job workspace → CV editor; dashboard presentation can join after shell tokens stabilize. Preserve a data-rich populated example, empty/error/locked case, mobile and keyboard path for each. Do not modify editor save semantics concurrently with integrity work.
6. Phase 6 — Review checkpoint. Inspect EN/NB × light/dark × desktop/mobile, loaded accessibility, long data, CSV/PDF downloads, identity switching and history. Correct shared defects before repeating the design.
7. Phase 7 — Remaining routes and nested functions. Auth/account, career/import/evidence, CV library/public CV, correspondence, reminders/operations, settings and admin; update every preservation row with evidence.
8. Phase 8 — Dashboard customization. Add ordering/reset/resizing only with defined layout and persistence semantics. Coordinate any needed migration with restore/rollback readiness. Keep aggregate admin reporting separate.
9. Phase 9 — Cross-product QA and release evidence. Full regression, manual access/mobile, document pagination and provider/production checks. Feature parity, not only appearance, determines readiness.
10. Phase 10 — Cleanup. Delete legacy modules only after route/import checks and preservation-ledger completion. Do not use static unreachability alone as approval.

No router/state/styling dependency replacement is currently recommended. If a later prototype demonstrates a concrete limitation, compare the smallest alternative against MUI reuse and measure migration/keyboard/theme cost before choosing it.

Session-sized next scopes and coordination

Suggested future scope	Boundaries / expected proof	Parallel constraints
Type and baseline bookkeeping	Preserve the corrected test assertion; explicit type script/CI gate, known-failure classification	Independent of visual work; coordinate CI edits with deployment repair
Route/preservation regression	Existing route helpers, full/overlay/capture navigation tests	Do not change router structure at the same time
Theme semantic contract	Central theme/MUI states + representative loaded contrast fixtures	Separate from backend; integrate before page styling
Builder focus contract	Actual preview container, viewport transition and keyboard scroll tests	Must not run concurrently with D01/editor save refactor
Shell/navigation proposal	Documentation/interactive prototype and route map only until Phase 3 approved	Can be prepared while tests run; no new production routing yet
First screen migration	One agreed shell or Jobs surface with existing handlers/contracts retained	Use settled tokens; no simultaneous edits of its route/state owner

These are future implementation boundaries, not work started by Phase 1. Mail delivery, billing, schema, restore and infrastructure changes remain outside redesign sessions unless explicitly authorized and independently gated.

Decisions required from Connor

No answer is required to complete this audit. Ask only when the dependent phase starts:

• Brand/name/accent: the brief intentionally leaves them unsettled. Keep current naming and theme until Phase 3/4 chooses them; do not block baseline tests on branding.
• Dashboard persistence: whether layout should follow the account across devices materially changes Phase 8's persistence scope. Existing implementation is device-local and owner-keyed.
• Private local draft recovery: preserve in-memory drafts and existing server drafts now. New persistent device-local career/CV content needs the privacy/retention choice already recorded under W05.
• Product additions/deprecations: new goals/general assistant/providers or removing an existing preservation row need explicit product scope. Navigation relocation alone need not become a series of permission questions.

The repository already answers the current framework, default language, existing calendar support, account/profile distinction and owned-resource semantics. Do not ask Connor to supply those facts.

Stop conditions

• No large visual migration until loaded regression baseline and shared UI contracts are defined. No stable release label while required CI is red or deployment state unknown.
• No editor persistence redesign before resolving its record conflict contract; B02 must remain green throughout. No schema change before recovery/rollback prerequisites.
• No implicit feature deletion, master-profile mutation from CV overrides, silent AI application, unknown email resend, or private cache reuse across identities.
• No public accessibility claim without manual primary-flow evidence. No F04 closure without actual deployed/runtime evidence; direct-port failure from one workstation is insufficient.
• Stop at Phase 1's audit deliverables in this session. Phase 2 and B07 have not begun.