cesnimda
7.7 KiB
P7-09 — Privacy, usage and backup presentation
Implemented CONDITIONAL GO; final hygiene and publication pending. Preferences/Connections and the separate import prerequisite are already published. This closes the remaining approved second boundary without enabling billing, deletion, restore, provider grants or P5-13.
Contracts and confirmed findings
Privacy retains the authenticated /ai/settings GET/PUT owner and its exact two-boolean write payload. Availability, effective policy and provider remain server-owned. The previous card had no read recovery, could overwrite newer edits on save acknowledgement, and could report success after unmount or in the previous language. Its new six-case regression recorded five ordinary failures and one pass before repair. An earlier mock-setup failure is retained but is not product RED evidence.
Usage retains independent /ai/usage and /billing/status GET owners, server values/limits and existing capability-gated checkout/portal endpoints. The previous card lost its heading after a read failure, silently hid billing read errors and formatted numbers in the browser host's locale. Focused RED recorded five failures and two passes. No statistics or entitlements are invented; zero limits remain server values rather than inferred eligibility.
Backup retains readable account ZIP and encrypted backup formats, filenames/content-disposition, recent-auth enforcement and exact server-provided deletion confirmation. An unavailable lifecycle read previously looked disabled. Synchronous competing downloads and late disposal also failed the new four-case regression. No backend/schema, deletion flag or restore behavior changes.
Quick Capture already uses the shared section and an accessible read-only/manual-code alternative to dragging. Preserve its origin, encoded source URL, bookmarklet and click hint. Verify it rather than rebuilding it.
Changes and finite evidence
Privacy has GET-only Retry, truthful read versus save errors, draft/discard state, submitted-snapshot acknowledgement, synchronous save admission and session/unmount disposal. Current-locale completion feedback uses the existing notification owner. Historical external consent can still be revoked even when new external processing is unavailable. Retry focus has a named landing target; later edits are not discarded or silently saved.
Usage preserves its heading/loading/error shell and independently retries failed reads without replaying writes or resetting the other resource. Numbers and byte units follow the selected English/Bokmål locale; zero storage limits produce finite progress. Checkout/portal admission and late-response guards preserve the existing server redirect contract. They do not activate billing or qualify real billing navigation.
Backup distinguishes loading, unknown/error, explicitly disabled, available and pending states. Downloads and deletion confirmation share synchronous admission; callbacks check the immutable session/lifetime before downloading, notifying or acting on a prompt result. Existing server error/recent-auth feedback remains. Readable export is the primary action; encrypted backup remains a secondary action. The card remains lazy and disposable on its existing Settings tab boundary. A review-found Retry focus loss failed an ordinary additional regression before correction.
Affected frontend 47 cases / six suites PASS on 20 October 2026: six privacy, ten usage, four backup lifetime, four existing account-data export, two Settings lifetime and 21 existing Settings cases. Backend 22 existing cases PASS across privacy policy, account export/deletion and billing contracts, using the unchanged Release test binary. These are focused results, not a fresh whole-suite claim. New cases derive frontend inventory 855/99 from the last full 837/97 baseline; four added browser cases derive 339 from 335. Final gate timestamps/export/source identities and exact native results must be appended below before acceptance.
Preservation and qualifications
The final native Settings suite passes 9/9, zero skips/retries/flaky outcomes, 07:52:55–07:54:24 UTC. Four cases are new: actual privacy persistence/isolation/recovery, eight-width privacy/backup/Quick Capture, independent actual Free usage/billing read recovery, and actual protected ZIP byte identity/lifecycle/disposal. It retains all five existing Preferences/Connections cases. Import four, actual CSV consumer one and ordinary P2-D01 one also pass on the final export. Fresh Rules/Settings eight-case consumer completion is recorded in the final results before publication.
There are 37 PNGs and 37 all-enabled axe scans, zero violations, 141 incomplete nodes: 37 invisible zero-count badge text checks, 99 overlapping-background contrast checks, and five closing MUI menu portal focus checks. Raw rule/node contexts are retained without exclusions. The latter portals are marked aria-hidden while the closing option remains mounted; native section selection restores focus, but settled tabbing and human AT acceptance remain qualified. Fixed chrome/snackbar and scrolled control overlap prevents automated background determination; contextual contrast/manual obligations remain. No incomplete is relabelled a passing contrast or reader check.
Six final PNGs were actually inspected: 320px Bokmål dark Backup and dirty Privacy, 768px Bokmål light Privacy, 390px English light usage recovery and real export, and 1440px English light Privacy. Other images are retained automated evidence. The added geometry checks initially identified MUI Switch's intentionally transparent 300%-wide input; only unpainted opacity-zero input proxies are excluded from painted-control bounds. Their visible labels/controls, root overflow and all-enabled axe checks remain tested. This is fixture triage, not a product overflow fix or accessibility exclusion.
The portable final results record exact commands, result hashes, final export identity, during-run source observation and matching post-run identities. The observation is explicitly not represented as preceding command start. Earlier candidates, ordinary REDs, setup failures and their builds remain historical evidence.
Final export TUs6Z9wfC6aEYGOeW_UZ- passes app/browser TypeScript, lint and build plus 23/23 native cases, zero skips/retries/flaky outcomes: Settings nine, import four, CSV one, ordinary P2-D01 one and fresh Rules/Settings consumers eight. The consumer lane completed 07:57:22 UTC. This supersedes the pending-consumer observations above. All nine observed source identities still match after the runs. Final hygiene and publication are recorded in the ledger; no whole-suite, deployed or human acceptance is inferred from these gates.
All 57 preservation groups remain 56 PARTIAL / C11 DEFERRED, with 33 routes. S03/S04/S05/J10/E09/W11 receive bounded presentation, lifecycle and persistence evidence. Existing Rules ownership, language/local preferences, notification delivery and provider controls remain separate. Backend ownership, actual deletion availability and recent-auth checks are not replaced by UI state.
Account deletion is not executed in native tests. Unit tests exercise its existing exact-phrase and disposal guards with mocks. A downloaded ZIP is not backup/restore proof. Real billing/provider/SMTP/model/deletion/restore operations, human screen-reader, physical touch/software keyboard, actual browser zoom, production fonts/photos/print and all retained reliability/production debts remain unverified. P5-13 stays withheld, followMode stays deferred, Phase 8 implementation has not started. Production readiness remains NO-GO despite the owner's separate authorization to deploy the existing release.