jobtrackingapp/docs/redesign/phase-9/rd21-remediation/reviews/final-fix-report.md

RD21 final-review fix wave

Scope: exactly the two findings in final-review.md. Product changes are Program.cs and ApplicationWorkspacePage.tsx; existing ApplicationAssets dirty-draft/revision ownership stays intact. No commits or pushes by this worker. Coordinator documentation changes were preserved.

Fixes

1. Existing AllowReact CORS policy exposes X-Job-Version. Origins, credentials, CSRF and client fail-closed revision validation are unchanged.
2. Each Answers entry has an identity tied to its job/entry lifetime. The existing aggregate overview loader accepts source fields and revision together, and Answers mounts only after that entry's successful read. Failed reads retain the existing Retry behavior. Late prior-entry/job requests cannot enable the editor. Existing post-save refresh keeps the same editor identity, so the dirty draft guard remains effective. Other workspace tab switches do not all trigger reads; leaving a loaded Answers section skips an unnecessary read, while leaving an unfinished initial read still loads the header.

RED evidence

• final-fix-jest-red.log: 2 failed, 19 skipped. Both new entry tests found stale 42|Saved answer|Saved recruiter message|7 props before a fresh read, including a late-entry race.
• final-fix-browser-red.log: 2 failed against the unchanged API and pre-fix static export. Actual cross-origin browser JavaScript observed a 204 but a null X-Job-Version while independent SQLite already held Version 2 and the exact answer marker. The cover-save→Answers case exposed the editable answer textbox while the fresh read was held.
• Preliminary browser harness attempts were not behavioral evidence: one had incorrect environment quoting/default dotnet SDK selection; another used the wrong database column for answers and timed out waiting for the missing read. Corrected assertions use the established Notes answer marker and the final RED log above contains the intended failures.

Commands and GREEN results

All terminal invocations were prefixed by rtk; PowerShell built-ins ran through rtk proxy powershell -NoProfile -Command. Paths below are relative to the repository, except the pinned SDK. UI commands ran in job-tracker-ui.

# RED Jest
npm test -- --runInBand application-workspace-overlay.test.tsx --testNamePattern='entering Answers|late previous Answers-entry'
# GREEN Jest
npm test -- --runInBand application-workspace-overlay.test.tsx application-assets.test.tsx
# API build
& C:/Users/Connor/.dotnet/dotnet.exe build JobTrackerApi/JobTrackerApi.csproj --configuration Release --no-restore
# Frontend build
$env:NEXT_PUBLIC_API_BASE_URL='http://localhost:5302/api'
npm run build
# Focused lint
npx eslint src/views/ApplicationWorkspacePage.tsx src/application-workspace-overlay.test.tsx --max-warnings=0
# Browser RED and GREEN (GREEN additionally emitted JSON and retained proof attachments)
$env:PLAYWRIGHT_STATIC_EXPORT='true'
$env:PLAYWRIGHT_PREBUILT_EXPORT='true'
$env:DOTNET_ROOT='C:/Users/Connor/.dotnet'
$env:DOTNET_HOST_PATH='C:/Users/Connor/.dotnet/dotnet.exe'
npx playwright test --config=../docs/redesign/phase-9/rd21-remediation/diagnostics/playwright.config.ts persistence.spec.ts --grep 'cross-origin browser|cover-letter save then' --reporter=list,json --output=../.superpowers/sdd/PLAN/final-fix-browser-results

• Focused Jest: 55 passed, 2 suites, final-fix-jest-green.log. Includes four new entry/failed-read/race/navigation tests and existing dirty parent-refresh regression. These are an overlapping subset of the coordinator's eventual broad suite, never additive to it.
• API Release build: pass, 0 warnings/errors, final-fix-api-build.log.
• UI static build including TypeScript: pass, final-fix-ui-build.log. Rebuilt after final source edits.
• Focused ESLint: pass, zero warnings, final-fix-lint.log. An initial unnecessary-dependency warning was fixed by making the entry identity contain its job/active values.
• Browser: 2 passed, final-fix-browser-green.log/json. Actual JS fetch sees the committed revision; two native consecutive Answers saves acknowledge success and advance revisions with independently read SQLite answer markers. Native cover-letter save advances the shared job revision; subsequent held Answers-entry read exposes no answer textbox; released snapshot allows native answer save using the cover-letter revision and preserves both persisted fields. Attachments contain revision observations and SQLite rows.
• rtk git diff --check: pass.

The controlled browser servers use isolated synthetic SQLite data and localhost ports 3300/5302. Existing isolated migration/DataProtection and NO_COLOR/FORCE_COLOR startup warnings remain in logs. No external service calls, production operations or real user data were used.

Broad frontend/backend/browser lanes, MariaDB/provider/deployed/manual qualifications remain with the coordinator. This report is focused regression evidence, not production acceptance.