jobtrackingapp/docs/redesign/phase-2/PRESERVATION_MATRIX.md

Phase 2 preservation matrix

Baseline: 2d0f131, the 57-group Phase 1 ledger. PRES-E01 is a stable alias of E01, and similarly for all rows; original IDs retain their meaning. No capability has been removed, merged or deprecated. Each row includes all sub-capabilities in its linked baseline group, even when its short label abbreviates them.

Measurement and limits

57/57 groups (100%) have mapped automated behavioral evidence for at least one core behavior. This is group-level preservation coverage, not statement coverage, exhaustive sub-workflow coverage, visual parity or 100% readiness. Every row's remaining gaps are explicit. A passing mock/service test does not prove a real provider, actual browser persistence, or production. In particular W07 retains passing service/component evidence but its new native SQLite capture test is an expected failure, not successful end-to-end preservation proof. See baseline defects.

H = identity/data loss/irreversible action or a high-risk shared navigation/editing surface; M = important reversible presentation/workflow risk. These are redesign regression risks, not security severity labels. “Touch” is expected later-phase impact, not implementation authorization. F links are Jest component/helper tests; B links are backend tests. Named behaviors describe assertions, not mere file existence. The existing App.test harness is deliberately not counted as route proof.

New browser tests live in redesign-preservation.spec.ts; original smoke, account isolation, and special B01–B06 suites stay unchanged. The full original test census supplies secondary coverage beyond the representative tests mapped below.

Preservation ID / capability	Route / entry	Frontend; backend owners	Automated tests and protected behavior	Missing evidence / deliberate gap	Risk	Expected redesign touch
PRES-E01 — Public product/plans; honest unavailable billing	/	LandingPage, planCatalog; AccountPlans	F:landing-page, F:planCatalog, F:LandingPage.authRedirect; B:AccountPlans. Free/Pro copy, unavailable checkout and authenticated redirect	Actual checkout/provider availability; public mobile/keyboard review	M	Yes — public entry
PRES-E02 — Local login/register/remember, challenge, reset and verification	/login; /register; /forgot-password; /reset-password; /verify-email	LoginPage, TurnstileWidget, VerifyEmailPage; AuthController	F:login-page, F:verify-email-page, F:turnstile-widget; B:LocalAuthIdentity, B:AuthAndSystemController. Configuration gates, two-factor branch, safe redirect, verification outcomes; smoke login	Real reset-email delivery, Turnstile widget/browser configuration, complete reset submit journey	H	Yes — entry forms
PRES-E03 — Google/Microsoft login, link, legacy relink and popup results	/login; /microsoft-legacy-relink; provider callbacks	GoogleAuthCard, MicrosoftAuthCard, MicrosoftLegacyRelinkPage; token validators	F:login-page, F:microsoft-legacy-relink-page; B:GoogleTokenValidator, B:MicrosoftTokenValidator, B:LocalAuthIdentity. Provider failure/relink presentation and token validation	Real consent/popups, revoked grants, provider sandbox; callbacks must retain origin/state	H	Yes — account entry
PRES-E04 — 2FA challenge/recovery/setup/disable; trusted-device revocation	/profile; /login	TwoFactorSettingsCard, TwoFactorChallenge; TwoFactorController	F:two-factor-settings, F:login-page; B:TwoFactorController, B:SessionsController. Setup/recovery presentation, disable failure/retry; server trusted-device/session checks	Real mobile authenticator/recovery and trusted-device UI traversal	H	Yes — security forms
PRES-E05 — Session list/current device, revoke one/others, logout	/profile; shell user menu	SessionsSettingsCard, AppShell, auth; SessionsController	F:session-boundary, F:account-scoped-state; B:SessionsController, B:AuthSessionRevocation. Own active sessions only, revoke ownership and next-request invalidation; B02 browser logout	Session-list card UI selection/refresh after remote revoke	H	Yes — shell/account
PRES-E06 — Avatar, account names/headline, email change and password	/profile; /confirm-email-change	ProfilePage; AuthController, AvatarStorage	F:profile-page, F:verify-email-page; B:AvatarStorage, B:LocalAuthIdentity. Email change password/confirmation contract; safe avatar storage and identity endpoints	Avatar upload/remove and password-change browser journeys	H	Yes — account/profile separation
PRES-E07 — Desktop collapse/mobile drawer, active nav and command search/actions	Shell; Ctrl/Cmd+K	AppShell, QuickCommandDialog; job/company search APIs	F:sidebar-active-nav, F:app-shell-notifications, F:quick-command-preservation; B:JobApplicationsAuthorization, B:CompanyRelationship. Active matching and notification entry; NEW job/company destinations, reviewed add and search reset; NEW browser keyboard navigation	Drawer focus return and collapse persistence in EN/NB; all command destinations before shell migration	H	Yes — first restructuring target
PRES-E08 — Theme/system, EN/NB hydration, toast/confirm/prompt and errors	Shell; preferences; fallback routes	themePrefs, I18nProvider, confirm, prompt; auth preference	F:theme-state, F:i18n-provider, F:confirm, F:prompt, F:dialog-flow; B:LocalAuthIdentity. Hydrated theme/language, confirmation/cancellation and dialog behavior	Not-found/error-boundary retry route; full locale/theme/state cross-product and OS theme changes	M	Yes — shared foundations
PRES-E09 — Account-switch private-state disposal and stale request rejection	All private routes; tabs/BFCache/focus	App, api, sessionBoundary; SessionContextMiddleware	F:session-boundary, F:account-scoped-state; B:SessionContextMiddleware, B:CurrentUserIdLiveEvaluation, B:OwnershipGuard. B02 stale mutation/read abort, account-scoped state; four real-API/two-tab account-isolation browser cases	Real BFCache variations and long offline retry; preserve server precondition even with old bundles	H	Yes — all shared state
PRES-J01 — NAV discovery/filter/sort/source/deadline/details	/discover	JobDiscoveryPage; JobDiscoveryController	F:job-discovery; B:JobDiscoveryController, B:JobOpportunitySync. Search/sort/source details, empty versus failure/retry; responsive discovery browser	Live NAV freshness/API availability; long result keyboard traversal	M	Yes — jobs entry
PRES-J02 — Saved searches, run/delete/alerts, result changes/dismissal	/discover	JobDiscoveryPage; saved-search/alert services	F:job-discovery; B:SavedJobSearchAlert, B:JobDiscoveryController. Saved search run, pause and dismiss controls; owner-scoped alert results	Scheduler-to-notification browser journey, delete confirmation on mobile	M	Yes — discovery workspace
PRES-J03 — Reviewed manual/URL/paste job create, company/tags/dates, duplicates	Shell AddJobModal	AddJobModal; JobImportService, JobApplicationsController	F:quick-capture; B:JobImportService, B:JobImportHttpTransport, B:JobApplicationsController. Preview before write, URL prefills, manual browser create; B01 real connection boundary	Duplicate warning and company/date edge UI; creation-intent idempotency remains separate unresolved contract	H	Yes — capture/navigation
PRES-J04 — Extension/bookmarklet/share capture; post-create attachment/CV	?add= / ?addtext=; QuickCaptureCard; browser-extension	App, captureUrl, QuickCaptureCard; job/CV APIs	F:captureUrl, F:quick-capture, F:quick-command-preservation; B:JobImportService, B:CvBuilder. Capture URL encoding/review/no auto-create, post-create CV; extension node tests; NEW keyboard add opens review only	Installed extension permissions/browser-share flow and optional attachment failure recovery	H	Yes — entry contracts
PRES-J05 — Job filters/sort/page/columns, saved views and row/mobile actions	/jobs	JobTable, SavedViewsMenu; JobApplicationsController	F:application-workspace-overlay, F:account-scoped-state, F:daily-control-loop; B:JobApplicationsController, B:JobApplicationsEndpointBehavior. URL hydration, selection does not open row, list return/focus; browser dirty/full workspace	Saved-view CRUD browser journey, page-size changes with dirty nested state	H	Yes — jobs view consolidation
PRES-J06 — Bulk status/delete, soft delete/trash/restore and job edit	/jobs; /trash; EditJobDialog	JobTable, EditJobDialog; job lifecycle/controller	F:application-workspace-overlay, F:confirm-flow; B:JobApplicationsController, B:JobApplicationsAuthorization, B:JobLifecycleEvent. Selection and destructive confirmation primitive; server CRUD/ownership/lifecycle behavior	Bulk partial failure and trash→restore UI journey; shared confirm tests alone do not prove bulk flow	H	Yes — table/actions
PRES-J07 — Kanban grouped statuses, pointer/keyboard move and precise menu	/kanban	KanbanBoard, pipeline; status endpoint	F:kanban-grouped-board, F:pipeline; B:JobPipeline. Keyboard pickup/drop, failed move keeps card, custom group and precise stages; dark browser test	Touch drag, keyboard cancel/focus after responsive view switching	H	Yes — table/board unified entry
PRES-J08 — Company/contact edits, pipeline dates and linked-job history	/companies; ?edit=id	CompaniesTable; company relationship APIs	F:companies-relationship, F:quick-command-preservation; B:CompanyRelationship. Job history/context and NEW command company destination	All contact/date edits persisted through browser; source URL safety	M	Yes — directory/navigation
PRES-J09 — Recorded offers/compensation/deadlines/notes and source links	/offers	OfferComparisonPage; job API	F:offer-comparison; B:AnalyticsSalary, B:JobApplicationsEndpointBehavior. Recorded values/empty states and salary normalization	Mobile many-offer comparison; localized currency/date visual review	M	Yes — jobs/analytics placement
PRES-J10 — CSV/JSON export, JSON import and CSV-to-JSON conversion	/settings; ImportExportJobs	ImportExportJobs; CSV/job controller	F:csv-export; B:CsvExport, B:JobApplicationsController. B05 formula/quotes/UTF-8/typed dates and numeric behavior; CSV browser byte download	Full browser JSON import/count/roundtrip; Excel/LibreOffice compatibility remains separately bounded	H	Yes — settings/download placement
PRES-W01 — Full workspace, sections, legacy links and optional reusable overlay	/jobs/:id; /applications/:id; section/followMode	ApplicationWorkspacePage, jobWorkspaceRoute; workspace API	F:application-workspace-overlay, F:applicationWorkspace, F:application-route-contracts; B:ApplicationWorkspace. Deep links, dirty cancel/discard, missing job and back/filter/focus; NEW actual App command/legacy entry	No active production caller of override/onClose overlay props found; full overlay parity needs a host fixture before adoption	H	Yes — primary workflow
PRES-W02 — Detail/status/progression, recruiter/dates/description/timeline	/jobs/:id overview	WorkspaceHeader, JobDetailsSection, ApplicationProgress/Timeline; workflow APIs	F:application-intelligence, F:workflow-trust-signals, F:daily-control-loop; B:JobApplicationsWorkflowSignals, B:JobApplicationsAppliedDateHistory. Timeline source labels, next-action routing and applied-date history	Edit/status→timeline real-browser sequence across locale/timezone	H	Yes — workspace
PRES-W03 — Analysis, match/gaps, strategy and reviewed status/workflow suggestions	/jobs/:id?section=analysis	ApplicationAnalysis/Match/StrategySnapshot/StatusSuggestion; intelligence/AI services	F:application-intelligence, F:application-workflow-assist; B:ApplicationIntelligence, B:StrategySnapshotOperation, B:JobApplicationsEndpointBehavior. Loading/error/empty states, match and explicit suggested action behavior	Actual model truthfulness/evaluation; source freshness and cancelled generation browser states	H	Yes — contextual AI
PRES-W04 — Checklist create/edit/complete/delete/order and next action	Job overview/checklist entry	ApplicationChecklist; checklist service/controller	F:application-checklist; B:ApplicationChecklist. Persisted item actions and keyboard reorder; localized readiness	Real-API mobile edit/delete and interruption recovery	H	Yes — workspace detail
PRES-W05 — Attach/select/create/tailor CV and source context	Job CV section; builder deep link	ApplicationCvSection/TailoringSection; ApplicationAssetsService	F:application-assets, F:cv-builder-deep-link; B:ApplicationAssets, B:CvBuilder. Attach re-points only, detach keeps variant, foreign owner denied, tailoring never writes source; B02 API browser	P2-D01 SQLite tailoring ordering blocks successful real-browser guidance; actual attach→render relationship beyond existing service coverage	H	Yes — document relationships
PRES-W06 — Cover-letter manual/AI review, versions/restore and dirty protection	Job cover-letter section	ApplicationCoverLetterSection, CoverLetterAiAssistant; assets/history	F:application-assets, F:application-workspace-overlay; B:ApplicationAssets. Manual save/discard/restore, linked-CV AI explicit apply then save, version history owner scope	Whole-browser AI reject/provider success and cover-letter history persistence; no actual model called here	H	Yes — workspace/content editing
PRES-W07 — Application drafts and immutable submitted package/archived binaries	Job cover-letter drafts; CV section package history	ApplicationPackageDraftsSection, SubmittedPackagesSection; package service/storage	F:application-assets, F:application-drafts; B:SubmittedApplicationPackage, B:JobApplicationsApplicationPackage, B:JobApplicationsEndpointBehavior. Drafts keep ordinary notes; service frozen document/hash/copy-failure/tenant assertions; NEW native browser capture oracle	P2-D01 expected failure: SQLite capture 500. NEW post-capture mutation/archive assertions are NOT reached. Require real storage/provider success before package restructuring	H	Yes — documents/submission
PRES-W08 — Attachments upload/category/name/AI consent/preview/download/delete	Job overview Documents accordion; package archive	Attachments; AttachmentsController, AttachmentStorage	F:attachments; B:AttachmentsController, B:AttachmentConsistency, B:AttachmentFlagsRecompute. Empty/flag controls, storage consistency and owned download; NEW browser fixture uploads real UTF-8 binary	Archived bytes after live delete blocked by W07; drag/drop, rename and download browser journey	H	Yes — document surfaces
PRES-W09 — Interview questions/answers/ready/manual removal/AI review	Job interview section	InterviewPrep; interview persistence/AI endpoints	F:interview-prep; B:InterviewPrepPersistence, B:InterviewAiContext, B:InterviewPrep. Explicit AI add, manual/answer readiness, relevant prompt context without invented defaults	Populated mobile keyboard editing and real reload; actual model quality separate	H	Yes — workspace AI
PRES-W10 — Debrief/follow-up draft/date/readiness	Job interview section; follow-up entry	InterviewPrep; follow-up draft services	F:interview-prep; B:JobApplicationsFollowUpDraft, B:InterviewPrep. Neutral debrief template and follow-up content handling	Timezone/reload browser chain; calendar defects remain outside Phase 2	M	Yes — workspace workflow
PRES-W11 — Reminder rules/actions/notifications, ICS and Google/Outlook events	/reminders; job calendar actions; /settings	RemindersView, RulesSettingsCard, ApplicationCalendarActions; calendar/rules APIs	F:daily-control-loop, F:application-calendar, F:settings-view; B:ApplicationCalendarController, B:RulesEngineProspect, B:NotificationSettingsController. Provider write confirmation, ICS and permission; NEW per-scenario rule payload and real saved preference checks	DST/date-only correctness and real provider timezone must be resolved separately; initial rules 500 not reproduced	H	Yes — scheduling/navigation
PRES-W12 — Async progress/failure/retry/cancel/notifications	/operations; profile processing	OperationsPage, CareerProfilePage; operation store/worker	F:operations-page, F:profile-page; B:OperationsController, B:UserOperationStore, B:CvProcessingOperation. Failure retry/cancel, durable operation IDs; extraction polling keeps dirty fields	Long-lived disconnect/reconnect and worker fault/recovery operational gaps	H	Yes — notifications/import
PRES-C01 — Canonical structured career data and long-tail/custom sections	/career?section=profile	CareerProfilePage, career views; CareerProfileService/controller	F:profile-page; B:CareerProfileController, B:CareerProfileService. Structured field changes propagate to saved singleton, stable child IDs and relational roundtrip; NEW CV edit leaves master unchanged	Every long-tail section/mobile keyboard save; concurrent canonical saves outside scope	H	Yes — career workflow
PRES-C02 — Profile overview/completeness/import guidance/raw copy/history/restore	/career	CareerWorkspacePage, CareerProfilePage; version service	F:career-workspace-page, F:profile-page; B:CareerProfileService. First/returning state, completeness/errors and non-destructive history restore	Clipboard/avatar and full browser historical restore; real extraction quality separate	M	Yes — career entry
PRES-C03 — Upload/extract/rebuild/reprocess/diff/select/accept/discard/retry/cancel	Career import/review	CareerProfilePage; profile-CV/processing/diff services	F:profile-page; B:ProfileCvController, B:CvProfileDiffService, B:CvProcessingOperation, B:CvExtractionCoverage. Queue/upload, operation retry, pending explicit apply and polling retains edits; extraction/diff service checks	Manual low-confidence deselection/discard UI; OCR/scanned/unusual real-document quality	H	Yes — career import
PRES-C04 — Evidence bank source/category/tags/add/list/delete	Career overview/evidence	CareerEvidenceBank; CareerEvidenceController	F:career-evidence; B:CareerEvidenceController. Sourced evidence creation, tags and owner boundaries	Delete and many-item search/keyboard browser flow	M	Yes — canonical evidence
PRES-C05 — CV library create/copy/delete/templates/share/publication/PDF	/career/builder	CvBuilderPage, thumbnails; CvVariantService/PublicCvController	F:cv-builder-page, F:cv-template-thumbnail; B:CvBuilder, B:PublicCvController. General/job-specific creation, delete cancel, duplication fresh slug, public revoke/republish; existing public browser PDF	Complete library→publish/unpublish/revoke old link browser chain	H	Yes — CV workspace
PRES-C06 — Studio tabs, preview debounce/pages/fit/save state/mobile panes	/career/builder/:id	CvBuilderEditor, CvPreviewPane; preview API	F:cv-builder-deep-link; B:CvBuilder. Five tabs, deep-link/error/save state and preview retry; NEW real mobile Edit/Preview, reload and desktop split	Keyboard preview scroll/focus (known F15), all theme/page interactions	H	Yes — representative editor
PRES-C07 — Visibility/order/custom sections and item/document overrides	Builder Content	CvBuilderEditor, CV controls/useDragReorder; resolver/settings	F:cv-builder-deep-link, F:cvBuilder; B:CvBuilder. Add/edit/delete/order/hide, override renders without master change; NEW persisted headline and sibling isolation	Native drag/touch and override reset-to-source browser flow; item-level real saved overrides beyond headline	H	Yes — editing controls
PRES-C08 — Capability-aware templates/typography/color/header/skills/sidebar/photo	Builder Template/Customize	CvCustomizeTab, registry; ThemedCvRenderer	F:cv-builder-deep-link, F:cvBuilder, F:cv-template-thumbnail; B:CvBuilder. Template change clears incompatible defaults; normalized overrides reach shared renderer, safe color/markdown	Complete template×advanced control visual/render parity; inaccessible color controls baseline	M	Yes — component foundation
PRES-C09 — A4/Letter/density/margins/dates/document locale/section presentation	Builder Customize/Content	cvBuilder, CvCustomizeTab; settings normalization/render model	F:cvBuilder, F:cv-builder-deep-link; B:CvBuilder. Page sizes, NB controls/default labels/dates, section grid/columns; existing long searchable PDF browser	All advanced combinations, print margins and long localized text manual review	M	Yes — controls must remain
PRES-C10 — Undo/redo, save queue, dirty guard, history restore/preview lifecycle	Builder editor/history	CvBuilderEditor; CvVariantService version history	F:cv-builder-deep-link; B:CvBuilder. Undo/redo, failed save retry, guard cancel, restore-as-new-version; NEW saved override reload	Multi-browser stale-CV revision remains separate defect; history-tab browser restore and offline navigation	H	Yes — do not alter persistence contract
PRES-C11 — Section and whole-document AI improve/translate/instruction/grammar review	Builder AI Tools/content assistant	AiSectionAssistant, DocumentAiTab; CV AI assist	F:ai-section-assistant, F:cv-builder-deep-link; B:AiWorkspace, B:AiPrivacyPolicy, B:ProEntitlementAuthorization. NEW reject/close, edited acceptance, failure retry, whole-document apply/reject and malformed/missing/duplicate IDs rejected; no implicit PUT	Real model factual validation and section→whole review interactions; Free-disabled controls proven in new browser	H	Yes — AI interaction pattern
PRES-C12 — Private PDF and published anonymous CV/PDF, long searchable pages	Builder export; /cv/:slug	PublicCvPage, cvBuilder; HtmlPdfGenerator/shared admission	F:public-cv-page; B:PublicCvController, B:PdfRenderAdmission, B:CvBuilder. Anonymous public rendering versus private refusal; B03 shared capacity/failure; real multipage/public PDF browser	All templates/print engines; deployed Chromium/font behavior and PDF manual inspection	H	Yes — export/preview links
PRES-M01 — Job-scoped manual correspondence/search/delete/paste import	Workspace communication accordion	Correspondence; CorrespondenceController	F:end-to-end-trust-loop, F:correspondence-search-context; B:CorrespondenceController. Canonical communication entry does not send mail, job context and CRUD ownership	Manual note edit/delete/paste-import real browser; preserve send/log distinction	H	Yes — workspace/correspondence
PRES-M02 — Gmail candidate/thread import/refresh/sync/unlink/relink/move	Job communication Gmail tools	Correspondence; GmailController/provider	F:correspondence-gmail-import; B:GmailController, B:EmailOwnershipIntegration. Candidates, selected thread import/move/refresh and diagnostics; owner-bound relationships	Real provider/sandbox threads, multi-account reconnect and sync failure	H	Yes — relationship controls
PRES-M03 — Global inbox filters/page/provider/link/direction/detail/source links	/correspondence	CorrespondenceInboxPage; EmailController	F:correspondence-inbox-page; B:EmailController, B:EmailOwnershipIntegration. Filter/pagination/detail/provider read failure distinct from empty	Real large mailbox and attachment binary browser flows	H	Yes — inbox/navigation
PRES-M04 — Compose/reply/provider/recipient/job; draft conflicts; confirm send/uncertainty	/correspondence drafts/compose	CorrespondenceInboxPage; EmailDrafts/Send/attempt store	F:correspondence-inbox-page; B:EmailDraftsController, B:EmailDraftPersistence, B:EmailSendController, B:EmailSendAttemptStore, B:EmailProviderDelivery. Revision conflicts, explicit send confirm, uncertain state has no automatic retry, deliberate new attempt	Actual sandbox mail delivery and browser reconnect; do not loosen idempotency/conflict guards	H	Yes — high-risk drafts/navigation
PRES-M05 — Review proposed jobs/link/reject/keep/notes/sync/create	/correspondence?view=review; /correspondence/review	GmailReviewPage, CorrespondenceInboxPage; Gmail review	F:gmail-review-page, F:correspondence-inbox-page; B:GmailController. Review decisions/localization and inbox review entry	Real App legacy alias and suggested-job create browser workflow	H	Yes — merged review entry
PRES-M06 — Gmail/Graph/IMAP connect/status/disconnect separate from sign-in	/settings/connected-accounts	EmailProviderConnections; Google/Graph/IMAP controllers	F:email-provider-connections; B:MicrosoftGraphController, B:ImapController, B:ImapServiceSsrfGuard, B:GmailController. Connection state/NB/IMAP form and provider ownership; outbound IMAP safety	Actual provider authorization/revocation/token expiry; no credentials contacted in new tests	H	Yes — settings/account
PRES-S01 — Personal metrics/activity/funnel/company/skills/stage/salary/next actions	/dashboard	DashboardView; analytics/controllers	F:daily-control-loop, F:workflow-trust-signals; B:StageAnalytics, B:AnalyticsSalary. Empty dashboard prioritizes onboarding, attention deep links; server analytics facts	Chart transformation fidelity and full populated/timezone browser dashboard	M	Yes — dashboard/analytics
PRES-S02 — Owner-local five visibility preferences/onboarding dismiss/notifications	/dashboard; notification bell	DashboardView, OnboardingChecklist, NotificationsPopover; notification APIs	F:onboarding-checklist, F:notifications-popover, F:app-shell-notifications, F:account-scoped-state; B:JobLifecycleEvent. Onboarding actions; unread/read/dismiss UI and owner-scoped storage primitive	Five dashboard toggles/reload per account not fully tested at mounted dashboard; ordering/resizing is new work	M	Yes — preserve current preferences
PRES-S03 — Rules/reminder/table/theme/language preferences and account links	/settings tabs/mobile selector	SettingsView, RulesSettingsCard, theme/i18n; rules/notification/auth	F:settings-view, F:theme-state, F:i18n-provider; B:NotificationSettingsController, B:RulesEngineProspect. NEW failed notification retry, rule scenario preservation; NEW mobile→desktop edit + native notification/rule persistence	Initial single rules 500 unconfirmed; unsaved rule drafts are not persisted across tab unmount; table preference/router identity change gap	H	Yes — shared preferences/navigation
PRES-S04 — AI privacy/usage/limits/Free-Pro/server entitlement/conditional billing	/settings; locked AI controls; plans	AiPrivacySettingsCard, AiUsageCard, AccountPlanProvider; billing/entitlement	F:settings-view, F:ai-usage-card, F:pro-feature-notice, F:planCatalog; B:AiPrivacyPolicy, B:AiUsageMeter, B:ProEntitlementAuthorization, B:BillingController. Local-only AI setting, limits/locks, billing readiness; NEW real Free CV AI denied UI and API	Real checkout/webhooks/portal; billing/account deletion issues retain independent queue	H	Yes — settings/AI states
PRES-S05 — Account ZIP/encrypted backup/lifecycle/deletion confirmations	Settings Backup tab	BackupCard; export/backup/deletion services	F:account-data-export; B:AccountDataExport, B:BackupController, B:AccountDeletion, B:DatabaseBackupRunner. ZIP protected download, recent auth, server enable flag and exact deletion phrase; service deletion/backup	Real restored account/database and paid deletion/provider cancellation operational proof; not safe to run against production	H	Yes — account lifecycle
PRES-A01 — Admin user/create/roles/reset/delete/last-admin/self guards	/admin/users	AdminUsersPage; UsersController	F:admin-users-page; B:UsersController, B:ApiAuthorizationPosture. Demotion/delete confirm, last-admin server checks; NEW non-admin crafted create/read denied	Role revocation during mounted admin view and actual reset delivery; route can render empty shell without granting privilege	H	Yes — separate admin area
PRES-A02 — Audit list/detail/supported undo/job restore	/admin/audit	AdminAuditPage; AdminAuditController	F:admin-audit-page; B:AuthAndSystemController, B:ApiAuthorizationPosture. Unavailable-versus-empty retry and NB stored event text; server admin-only posture	Successful undo and job-restore UI against persisted API; role posture test is not undo behavior proof	H	Yes — admin navigation
PRES-A03 — System/build/DB/AI/mail/SMTP/test/probe/benchmark/maintenance	/admin/system	AdminSystemPage; AdminSystemController/maintenance/benchmark	F:admin-system-page; B:AuthAndSystemController, B:MaintenanceJobDispatcher, B:CvCorpusHarness. Health/error/NB, SMTP submit and benchmark controls; dispatcher authorization and modes	Production SMTP/model/corpus/maintenance and sensitive-data presentation; no live jobs launched	H	Yes — admin hierarchy

Before changing a mapped surface

Run its mapped tests and the shared identity/route regressions. Add the missing behavioral fixture needed by the proposed change before editing that workflow. A gap can remain intentional for Phase 3 documentation; it cannot silently become permission to restructure an unprotected workflow. Keep traceability updated per preservation ID and require real EN/NB, light/dark, desktop/mobile and keyboard evidence for each later migration.