jobtrackingapp/docs/redesign/phase-5/p5-15/p5-15-01/PRES_RESULTS.md

# P5-15-01 functional preservation results

**Current R-03 successor:** [Analytics authentication repair](analytics-auth-repair/README.md) supersedes AUTH-01 for its proved return-path scope. The unchanged original native assertion now passes both in isolation and the final full run. [Fresh final validation](analytics-auth-repair/evidence/validation.json) records **134/134 ordinary browser cases**, zero failures/skips/flaky/retries, diagnostics2/2, backend1,033/frontend490, unchanged revision/rendering/security gates. [Native proof](analytics-auth-repair/evidence/auth-proof.json) includes the genuine RED, encoded query/fragment/default/history/expiry/logout cases, foreign resource404s and rejected unsafe return targets. The [parent current column](../PRESERVATION_ACCEPTANCE.md) records **56 PARTIAL / 1 DEFERRED**, zero PASS/FAIL/BLOCKED/NOT VERIFIED whole groups: **only E02 moves FAIL→PARTIAL**. Original audit rows, counts and failed historical observations below remain unchanged.

The affected groups are E02 (local return journey), E03 (existing provider completion boundary), E04 (existing challenge completion), E07 (shared protected navigation) and E09 (account/session disposal). W01 supplies another owned/foreign protected Job-section deep link; J02 supplies unchanged saved-search regression safety, with all three repair cases passing alongside four Rules cases and117 inherited browser cases. This evidence does not qualify real Google/Microsoft, reset-mail/Turnstile, authenticators/recovery devices, BFCache/offline/old-bundle behavior, screen readers or physical devices. Full mandatory requirements remain in the original matrix and the current parent traceability table. Automated axe267/zero violations/**2,041 incomplete node occurrences** is not full accessibility acceptance. Original followMode metadata-only deferral, C11/P5-13 withholding, historical preference500 causes, unexplained CV Unsaved intermittent assertion and production evidence blockers remain open. Production remains NO-GO; P5-15-02 is not started.

**Historical R-02 successor:** [Rules draft repair](rules-draft-repair/README.md) closes SETTINGS-01 for its verified draft/save/error/account scope. This matrix remains the historical01 audit; the [parent successor matrix](../PRESERVATION_ACCEPTANCE.md) now records **55PARTIAL/1FAIL/1DEFERRED**, zero whole-group PASS/BLOCKED/NOT VERIFIED. Fresh R-02 full regression/native evidence is in the successor, including ordinary browser128pass/1fail and diagnostics2/2. E02/AUTH-01 stays FAIL and P5-13 remains deferred/withheld; no P5-15-02 or production GO is implied.

**Historical R-01 successor:** [saved-search repair](saved-search-repair/README.md) verifies the native SQLite/list feedback repair. J02 becomes PARTIAL in R-01; its57 totals are54PARTIAL/2FAIL/1DEFERRED in the retained [parent successor column](../PRESERVATION_ACCEPTANCE.md). This01 matrix and its53PARTIAL/3FAIL/1DEFERRED totals remain the original audit outcome, not a current open-defect count. No full group has been certified PASS.

Audit source **`932b962b9038ddb5ad59b982c0199475bfb50454`**, branch `codex/ui-redesign-phase4`, 2026-10-09. This document compares every original protected capability with actual current API/owner, frontend reach action, read/write boundary, inspected tests and outstanding evidence. It is a functional evidence record; no application repair, provider/model call, production operation, Docker recovery or B07 work belongs to it.

The original [Phase 1 ledger](../../../audit/FUNCTIONALITY_INVENTORY.md), [Phase 2 matrix](../../../phase-2/PRESERVATION_MATRIX.md), [approved Phase 5 plan](../../PHASE5_PLAN.md), [P5-15-00 matrix](../PRESERVATION_ACCEPTANCE.md) and [execution plan](../EXECUTION_PLAN.md) remain the contracts. Architecture follows the [API/controller/service/tenant boundaries](../../../../architecture/backend.md) and [client React Router/API layer](../../../../architecture/frontend.md). Each row includes the original full capability; its short test description covers representative assertions only.

**Status discipline:** PASS requires adequate current evidence for the whole named criterion. PARTIAL means evidenced sub-behaviors with required long-tail/manual/provider proof still missing. FAIL means an observed contradiction, including a carried defect when freshly reproduced. DEFERRED requires an approved exclusion. BLOCKED means execution cannot be performed in the available environment; NOT VERIFIED means adequate evidence has not been collected. A PARTIAL group can contain those outstanding sub-checks. Test/source existence is static observation, never an execution or PASS. Before means P5-15-00 acceptance; after means this audit's full original capability decision. Child test results may pass while their group remains PARTIAL.

## Execution provenance and limits

**Fresh backend/frontend execution:** [backend summary](evidence/backend-summary.json) records 1,023/1,023 backend cases, 108/108 focused AI and 5/5 revision subsets (included within 1,023), offline sidecar 49/49, configuration helpers 3/3, supply-chain helpers 3/3, offline evaluation helpers 5/5 and extension parser 3/3; zero failures/skips. API/test Release builds passed with zero warnings/errors. [Frontend/static summary](evidence/frontend-summary.json) records 459/459 tests across 82/82 suites, zero failed/pending/todo cases, success true; app TypeScript, complete current E2E/AI plus diagnostic TypeScript, lint and production build exited zero. Both runs used unchanged application source from the audit checkpoint. Backend runtime is Windows/.NET SDK 9.0.317, host 9.0.19; deterministic fixtures and disposable SQLite/files. Run dates, commands, counts/hashes and provider limitations are in those portable summaries.

**Fresh browser/native reconciliation:** [browser evidence](evidence/browser-summary.json) records all 117 inherited cases passing in the full run. The five added cases were rerun after harness corrections: two pass; three fail on real application behavior. The latest unique-case result is **119 pass / 3 fail / 122 total**, combined across declared runs, not one all-green final run. Separate preference diagnostics are **one pass / one fail**, outside that total. Real-HTTP 2, rate-limit 9, ingress 6 and PDF admission 1 passed. All runs have zero skips, expected failures and flaky retries. [Fresh fidelity](evidence/fidelity-summary.json): 16/16 (36=36 pages), settings 8/8 (24=24), unchanged tolerances; native package/revision fixtures remain green. Counts overlap across rows and must never be added into a second total. Human, provider, physical-device and production acceptance remain absent. [Journeys](JOURNEYS_AND_CONTROLS.md) distinguish real writes/readback, fault injection, API setup and browser interaction.

The ignored `.artifacts/p5-15-01/matrix/source-checks.json` records the exact 57 IDs, inspected mapped test names/assertion excerpts and file SHA-256 values. It is a local source cross-check, not a new production test framework or substitute for final run reports.

## Complete 57-capability matrix

API paths below include `/api`; `{id}` means the owned resource ID and nested `{jobId}` means the owning job. Controller routes and HTTP attributes were inspected directly. Source ownership is an intended boundary, with negative test anchors separately mapped; it is not a blanket security certification. Read paths can seed deterministic system checklist state where specifically stated. Every reach action is a current source action to execute, not a claim that it was clicked in this static review.

| ID / complete original capability | Actual API path and owner | Frontend route / entry and concrete reach action | Read/write and ownership semantics | Inspected test anchors / protected contract | Source observation versus fresh execution | Required missing/manual/provider evidence; risk / owner | P5-15-00 before | P5-15-01 after |
|---|---|---|---|---|---|---|---|---|
| **PRES-E01** — Public product explanation, Free/Pro feature comparison, honest unavailable-billing states and sign-in/register links<br>Original contract: `LandingPage`, `planCatalog`; do not invent prices or purchasable capabilities | `GET /api/billing/status`;<br>`BillingController / AccountPlans` | / public landing: choose Sign in/Create account; compare Free/Pro | Public read; billing configuration and server entitlements determine availability; landing cannot activate payment | [F:landing-page](../../../../../job-tracker-ui/src/landing-page.test.tsx); [F:planCatalog](../../../../../job-tracker-ui/src/planCatalog.test.ts); [B:AccountPlans](../../../../../JobTrackerApi.Tests/AccountPlansTests.cs)<br>Representative tests with inspected assertions: `shows exactly Free and Pro without invented commercial terms`; `publishes only capability-based Free and Pro plans`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: AccountPlansTests 7/7. Frontend: landing-page.test.tsx 2/2, planCatalog.test.ts 1/1.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Smoke and all-role census verify public plans, configured-disabled registration and sign-in entry; actual billing activation remains unverified. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Actual checkout/billing provider availability and public mobile/keyboard acceptance remain unverified.<br>Public/commerce owner; M — audit loaded mobile/keyboard EN/NB plans and honest unavailable billing; provider readiness separately. | **PARTIAL** | **PARTIAL** |
| **PRES-E02** — Local sign-in/registration, remember-me, configured Turnstile, resend verification, reset password, verify email<br>Original contract: `LoginPage`, reset/verification views, `TurnstileWidget`; server configuration controls availability | `GET /api/auth/config`;<br>`POST /api/auth/login, register, request-password-reset, reset-password, verify-email, resend-verification-email`;<br>`AuthController` | /login or /register public forms; Forgot password opens /forgot-password; emailed token opens /reset-password or /verify-email | Public token/config reads and explicit identity writes; configured registration/Turnstile, remember cookie and challenge control sign-in; never infer mail delivery | [F:login-page](../../../../../job-tracker-ui/src/login-page.test.tsx); [F:verify-email-page](../../../../../job-tracker-ui/src/verify-email-page.test.tsx); [B:LocalAuthIdentity](../../../../../JobTrackerApi.Tests/LocalAuthIdentityTests.cs); [B:AuthAndSystemController](../../../../../JobTrackerApi.Tests/AuthAndSystemControllerTests.cs); [EmailOwnershipIntegrationTests.cs](../../../../../JobTrackerApi.Tests/EmailOwnershipIntegrationTests.cs) — actual confirmation/change-email tokens, not mailbox ownership<br>Representative tests with inspected assertions: `posts remember-me preference without storing an auth token in browser storage`; `confirms the account and shows success when the link is valid`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: LocalAuthIdentityTests 3/3, AuthAndSystemControllerTests 38/38, EmailOwnershipIntegrationTests 3/3. Frontend: login-page.test.tsx 13/13, verify-email-page.test.tsx 4/4.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Real local login works; anonymous route census then reproduces loss of /analytics?months=6 after sign-in. **FAIL AUTH-01**; missing-token/config-disabled states are intentional. Reset delivery/provider journeys remain unverified. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Real reset-mail delivery, Turnstile/browser configuration and complete token-reset submit journey remain unverified.<br>Identity owner; H — trace reset request/token submit/verification/challenge errors in real App; sandbox mail/Turnstile only under later authorization.  **Confirmed defect:** [register](DEFECTS.md); separate owner repair required. | **PARTIAL** | **FAIL** |
| **PRES-E03** — Google/Microsoft sign-in/link flows, Microsoft legacy relink, provider popup success/error handling<br>Original contract: `GoogleAuthCard`, `MicrosoftAuthCard`, `MicrosoftLegacyRelinkPage`; OAuth/state/origin rules remain | `POST /api/auth/google/exchange, google/link`;<br>`POST /api/auth/microsoft/exchange, microsoft/link, microsoft/legacy-relink/confirm`;<br>`AuthController + token validators` | /login provider buttons; /profile link controls; emailed recovery enters /microsoft-legacy-relink | Exchange creates authenticated identity only after validated token; linking requires own local identity; OAuth popup origin/state and provider token identity remain mandatory | [F:login-page](../../../../../job-tracker-ui/src/login-page.test.tsx); [F:microsoft-legacy-relink-page](../../../../../job-tracker-ui/src/microsoft-legacy-relink-page.test.tsx); [B:GoogleTokenValidator](../../../../../JobTrackerApi.Tests/GoogleTokenValidatorTests.cs); [B:MicrosoftTokenValidator](../../../../../JobTrackerApi.Tests/MicrosoftTokenValidatorTests.cs)<br>Representative tests with inspected assertions: `handles Microsoft cancellation without exchanging or navigating`; `Exchange_microsoft_token_creates_new_user_when_registration_allowed`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: AuthAndSystemControllerTests 38/38, GoogleTokenValidatorTests 1/1, MicrosoftTokenValidatorTests 17/17. Frontend: login-page.test.tsx 13/13, microsoft-legacy-relink-page.test.tsx 1/1.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** All-role census verifies missing-token Microsoft relink page only; actual external sign-in/link/consent is NOT VERIFIED. No provider calls were made. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Real provider consent/popups, revoked grants and sandbox outcomes remain unverified; origin/state contracts remain required.<br>Identity/provider owner; H — audit popup origin/state, revoke/relink and provider errors using approved sandbox; keep sign-in and mailbox grants separate. | **PARTIAL** | **PARTIAL** |
| **PRES-E04** — 2FA challenge, recovery codes, setup/verify/disable/regenerate, trusted devices and revocation<br>Original contract: `TwoFactorChallenge`, `TwoFactorSettingsCard`; preserve sensitive confirmation and recovery presentation | `GET /api/auth/2fa/status, trusted-devices`;<br>`POST setup, verify-setup, challenge, disable, recovery-codes/regenerate, trusted-devices/revoke-all`;<br>`DELETE trusted-devices/{id}`;<br>`TwoFactorController` | /login challenge after password; account menu Profile opens /profile Security setup/verify/recovery/disable/trusted-device controls | Sensitive own-account security writes require confirmation/code/password; setup secret is pending until verification; trusted-device identity cannot bypass another account | [F:two-factor-settings](../../../../../job-tracker-ui/src/two-factor-settings.test.tsx); [F:login-page](../../../../../job-tracker-ui/src/login-page.test.tsx); [B:TwoFactorController](../../../../../JobTrackerApi.Tests/TwoFactorControllerTests.cs); [B:SessionsController](../../../../../JobTrackerApi.Tests/SessionsControllerTests.cs)<br>Representative tests with inspected assertions: `shows the 2FA code step when login requires two-factor, then proceeds like a normal login on success`; `Login_locks_account_after_five_failed_attempts_and_rejects_sixth_even_with_correct_password`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: AuthAndSystemControllerTests 38/38, TwoFactorControllerTests 9/9, SessionsControllerTests 8/8. Frontend: login-page.test.tsx 13/13, two-factor-settings.test.tsx 2/2.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** No native authenticator/recovery-device journey added; fresh named backend/component assertions only. Full real-device security flow NOT VERIFIED. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Real mobile authenticator/recovery and trusted-device UI traversal remain open; no security-form acceptance inferred from navigation.<br>Identity/accessibility owner; H — manual keyboard/screen-reader recovery/trusted-device traversal plus real authenticator proof. | **PARTIAL** | **PARTIAL** |
| **PRES-E05** — Active session list, current-device distinction, single/other-session revocation, logout<br>Original contract: `SessionsSettingsCard`, `AppShell`, `auth`, `sessionBoundary`; invalidation must clear private UI | `DELETE /api/auth/sessions/{id}`;<br>`GET /api/auth/sessions`;<br>`POST revoke-others`;<br>`POST /api/auth/logout`;<br>`SessionsController + AuthController` | Account menu Profile opens /profile session card; Revoke/other sessions; user menu Sign out | Owner session reads/revocations; current session distinguished; logout revokes exact principal and client clears private state | [F:session-boundary](../../../../../job-tracker-ui/src/session-boundary.test.ts); [F:account-scoped-state](../../../../../job-tracker-ui/src/account-scoped-state.test.tsx); [B:SessionsController](../../../../../JobTrackerApi.Tests/SessionsControllerTests.cs); [B:AuthSessionRevocation](../../../../../JobTrackerApi.Tests/AuthSessionRevocationTests.cs)<br>Representative tests with inspected assertions: `Login_creates_a_user_session_row_and_threads_its_id_into_the_token`; `another session cannot be adopted even if the readable cookie signal is unchanged`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: SessionsControllerTests 8/8, AuthSessionRevocationTests 8/8. Frontend: session-boundary.test.ts 15/15, account-scoped-state.test.tsx 2/2.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Account-isolation browser fixtures verify finite session invalidation/private-state disposal and crafted session-context denial. Native session-card revoke/recovery long-tail remains unverified. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Session-card selection/refresh after remote revocation remains open; broad device/AT acceptance is not established.<br>Identity/shell owner; H — audit session card remote-revoke refresh and Sign out private disposal/focus at every shell entry. | **PARTIAL** | **PARTIAL** |
| **PRES-E06** — Avatar upload/remove, name/display name/headline, account email-change request/cancel/confirm, local password change<br>Original contract: `ProfilePage`; account identity is distinct from canonical career data | `PUT /api/auth/profile`;<br>`POST/DELETE /api/auth/avatar`;<br>`POST change-password, email-change/request, email-change/cancel, email-change/confirm`;<br>`GET email-change`;<br>`AuthController + AvatarStorage` | Account menu Profile /profile: edit names/headline, upload/remove image, security/password/email controls; emailed /confirm-email-change | Own account identity writes; password/recent proof for sensitive changes; pending email is distinct from accepted email; avatar storage is separate from career source | [F:profile-page](../../../../../job-tracker-ui/src/profile-page.test.tsx); [F:verify-email-page](../../../../../job-tracker-ui/src/verify-email-page.test.tsx); [B:AvatarStorage](../../../../../JobTrackerApi.Tests/AvatarStorageTests.cs); [B:LocalAuthIdentity](../../../../../JobTrackerApi.Tests/LocalAuthIdentityTests.cs); [EmailOwnershipIntegrationTests.cs](../../../../../JobTrackerApi.Tests/EmailOwnershipIntegrationTests.cs) — actual confirmation/change-email tokens, not mailbox ownership<br>Representative tests with inspected assertions: `confirms a pending email change and requires a fresh sign-in`; `GetRequiredUserId_returns_null_when_subject_claim_is_missing`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: LocalAuthIdentityTests 3/3, AuthAndSystemControllerTests 38/38, AvatarStorageTests 1/1, EmailOwnershipIntegrationTests 3/3. Frontend: verify-email-page.test.tsx 4/4, profile-page.test.tsx 15/15.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** All-role profile route/native read verified; no complete native avatar/email/password mutation journey added. Fresh named token/form cases only for those mutations. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Avatar upload/remove and password-change browser journeys remain unverified; account identity stays distinct from Career Profile.<br>Identity owner; H — audit native avatar/remove/password/email-change, missing/error states and cross-account negative paths. | **PARTIAL** | **PARTIAL** |
| **PRES-E07** — Collapsible desktop sidebar, mobile drawer, active subsection matching, keyboard command launcher<br>Original contract: `AppShell`, `QuickCommandDialog`; job/company search and fixed navigation/add commands | `GET /api/jobapplications/choices`;<br>`GET /api/companies`;<br>`OperationsController notifications`;<br>`AppShell + QuickCommandDialog` | Desktop rail collapse/mobile menu; Ctrl/Cmd+K search job/company or fixed destination/Add job; bell opens popover | Navigation/search reads only; reviewed Add job opens modal without creation; private query caches must discard on account switch; hidden Admin entry never establishes permission | [F:sidebar-active-nav](../../../../../job-tracker-ui/src/sidebar-active-nav.test.ts); [F:app-shell-notifications](../../../../../job-tracker-ui/src/app-shell-notifications.test.tsx); [B:JobApplicationsAuthorization](../../../../../JobTrackerApi.Tests/JobApplicationsAuthorizationTests.cs); [B:CompanyRelationship](../../../../../JobTrackerApi.Tests/CompanyRelationshipTests.cs)<br>Representative tests with inspected assertions: `/career activates Career Workspace only`; `notification bell exposes its unread count and keyboard-accessible action`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: JobApplicationsAuthorizationTests 4/4, CompanyRelationshipTests 2/2. Frontend: sidebar-active-nav.test.ts 10/10, app-shell-notifications.test.tsx 3/3.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh shell/readiness/utility native keyboard, collapse/mobile controls, destination and role census pass their finite fixtures. AUTH-01 remains a cross-cutting sign-in context defect; spoken names/announcements remain unverified. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Original route/command/drawer defects have scoped successor evidence; manual screen reader and inherited command/focus timing debt remain open. This census is not browser route acceptance.<br>Shell/accessibility owner; H — audit every nav/command destination, collapsed/mobile labels, route focus, dirty Cancel and manual spoken names (P5-02-D01; P5-04b-R01). | **PARTIAL** | **PARTIAL** |
| **PRES-E08** — Theme light/dark/system, EN/Bokmål preference with server hydration, toast/confirm/prompt and error routes<br>Original contract: `themePrefs`, `I18nProvider`, `toast`, `confirm`, `prompt`, route error/not-found views | `PUT /api/auth/preferences/language`;<br>`GET /api/auth/me`;<br>`AuthController`;<br>`browser themePrefs` | Settings /settings General theme/language selectors; shell preferences; confirm/prompt/toast; unknown route and error retry | Theme is browser preference; language has local presentation and server hydration/write; modal Cancel must not mutate; toast success cannot replace server acknowledgment | [F:theme-state](../../../../../job-tracker-ui/src/theme-state.test.tsx); [F:i18n-provider](../../../../../job-tracker-ui/src/i18n-provider.test.tsx); [B:LocalAuthIdentity](../../../../../JobTrackerApi.Tests/LocalAuthIdentityTests.cs)<br>Representative tests with inspected assertions: `GetRequiredUserId_returns_null_when_subject_claim_is_missing`; `Login_locks_account_after_five_failed_attempts_and_rejects_sixth_even_with_correct_password`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: LocalAuthIdentityTests 3/3, AuthAndSystemControllerTests 38/38. Frontend: theme-state.test.tsx 7/7, i18n-provider.test.tsx 2/2.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh shell/settings theme/locale/focus/feedback fixtures pass; three genuine concurrent preference rounds persist/reload correctly. Historical intermittent 500 is not closed; no human full contrast/AT acceptance. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Full theme/locale/state/OS cross-product, spoken names/announcements, incomplete axe, zoom/forced-colours/text-spacing and shared-dialog timing remain unverified.<br>Shared UI/accessibility owner; H — audit loaded error/confirm/prompt states, OS theme, locale hydration, zoom/forced colours and announcements; incomplete axe remains open. | **PARTIAL** | **PARTIAL** |
| **PRES-E09** — Cross-tab account switch, stale mutation/read rejection, BFCache/focus revalidation and reauthentication<br>Original contract: `api`, `sessionBoundary`, `App`; B02 server precondition and client unmount/abort must survive extraction | `GET /api/auth/me, csrf`;<br>`SessionContextMiddleware + JobTrackerContext current-user filters` | Private shell revalidates at account/tab/focus/BFCache boundaries; sign out/sign in A then B; stale request callback | Client abort/unmount and server X-Session-Context 428/409 preserve owner; no stale read/write can adopt cookie-switched B or expose A state | [F:session-boundary](../../../../../job-tracker-ui/src/session-boundary.test.ts); [F:account-scoped-state](../../../../../job-tracker-ui/src/account-scoped-state.test.tsx); [B:SessionContextMiddleware](../../../../../JobTrackerApi.Tests/SessionContextMiddlewareTests.cs); [B:CurrentUserIdLiveEvaluation](../../../../../JobTrackerApi.Tests/CurrentUserIdLiveEvaluationTests.cs)<br>Representative tests with inspected assertions: `cookie switch rejects a stale callback before transport and never adopts B's context`; `keeps saved views private to the account that created them`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: SessionContextMiddlewareTests 13/13, CurrentUserIdLiveEvaluationTests 2/2. Frontend: session-boundary.test.ts 15/15, account-scoped-state.test.tsx 2/2.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh account-isolation browser runs actual cookie/session transport, retained A request with B context, missing/forged context and two-tab disposal. Finite boundaries pass, not every BFCache/offline/device combination. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Real BFCache variations/long offline retries and deployed old-bundle/session behavior remain unverified; images and mocked components cannot prove tenant isolation.<br>Identity owner; H — rerun real account-switch/two-tab stale read/write evidence at execution checkpoint; extend BFCache/offline/old-bundle audit when authorized. | **PARTIAL** | **PARTIAL** |
| **PRES-J01** — Search NAV listings by role/company/municipality, sorting, source/freshness/deadline/work-arrangement details, external listing links<br>Original contract: `JobDiscoveryPage`; provider failures and empty results distinguishable | `GET /api/job-discovery/search`;<br>`JobDiscoveryController + NavJobDiscoverySearchService` | Primary Discover /discover: enter role/company/municipality, Search, sort, inspect listing and external source | Read discovery provider metadata; empty differs from provider failure; saving requires reviewed AddJobModal, search never creates application | [F:job-discovery](../../../../../job-tracker-ui/src/job-discovery.test.tsx); [B:JobDiscoveryController](../../../../../JobTrackerApi.Tests/JobDiscoveryControllerTests.cs); [B:JobOpportunitySync](../../../../../JobTrackerApi.Tests/JobOpportunitySyncTests.cs)<br>Representative tests with inspected assertions: `distinguishes the initial guidance from a completed empty search`; `Search_filters_recent_active_nav_jobs`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: JobDiscoveryControllerTests 3/3, JobOpportunitySyncTests 1/1. Frontend: job-discovery.test.tsx 7/7.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Discover route/header resolves, but NAV search/import browser data are deterministic substituted provider fixtures. Saved-search500 is separately J02; real external NAV acquisition remains NOT VERIFIED. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Live NAV freshness/availability and long result keyboard traversal remain open.<br>Discovery owner; M — audit long results/mobile keyboard/source/deadline/retry; live NAV availability separately. | **PARTIAL** | **PARTIAL** |
| **PRES-J02** — Named saved searches, run/delete, automatic alert preference, new/updated results and dismissal<br>Original contract: `JobDiscoveryPage`, saved-search APIs; retain owner scope and alert metadata | `GET/POST/PATCH/DELETE /api/job-discovery/saved-searches`;<br>`POST {id}/run`;<br>`PATCH {id}/results/{externalJobId}/dismiss`;<br>`JobDiscoveryController` | Discover /discover: name/save search, select/run, toggle alert, dismiss result, delete saved search | Saved search/results/alert metadata owner-scoped; run is explicit persisted search update; background baseline does not alert all existing results | [F:job-discovery](../../../../../job-tracker-ui/src/job-discovery.test.tsx); [B:SavedJobSearchAlert](../../../../../JobTrackerApi.Tests/SavedJobSearchAlertTests.cs); [B:JobDiscoveryController](../../../../../JobTrackerApi.Tests/JobDiscoveryControllerTests.cs)<br>Representative tests with inspected assertions: `shows honest source metadata and offers the existing reviewed save flow`; `Saved_search_tracks_new_seen_and_dismissed_results_per_owner`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: JobDiscoveryControllerTests 3/3, SavedJobSearchAlertTests 1/1. Frontend: job-discovery.test.tsx 7/7.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Normal and admin saved-search GETs fail500 on entry and refresh (four genuine observations); exact installed SQLite translation rejects DateTimeOffset ORDER BY. **FAIL DISCOVERY-01**; no app fix or provider call. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Scheduler-to-notification browser journey and mobile delete confirmation remain unverified; no new producer or delivery certification.<br>Discovery/notifications owner; M — audit saved search delete/pause/run, mobile confirmation and scheduler-to-owned-notification chain.  **Confirmed defect:** [register](DEFECTS.md); separate owner repair required. | **PARTIAL** | **FAIL** |
| **PRES-J03** — Add job manually or from URL/pasted listing, reviewed preview, company lookup/create, tags and dates, duplicate warning<br>Original contract: `AddJobModal`; preview is not a write; keep B01 outbound boundary and existing review step | `POST /api/jobimport/preview`;<br>`GET /api/jobapplications/duplicate-check`;<br>`POST /api/jobapplications`;<br>`GET/POST /api/companies`;<br>`JobImportController + JobApplicationsController` | Shell Add job or Jobs Add job: manual/URL/pasted preview, select/create company, tags/dates, confirm Save | Preview outbound guarded by B01 and is not application write; create explicit after review; owned company association validated; duplicate warning does not imply deduplication | [F:quick-capture](../../../../../job-tracker-ui/src/quick-capture.test.tsx); [B:JobImportService](../../../../../JobTrackerApi.Tests/JobImportServiceTests.cs); [B:JobImportHttpTransport](../../../../../JobTrackerApi.Tests/JobImportHttpTransportTests.cs)<br>Representative tests with inspected assertions: `auto-imports from initialUrl and prefills the form`; `Preview_rejects_equivalent_private_literals_before_http_send`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: JobImportServiceTests 16/16, JobImportHttpTransportTests 76/76. Frontend: quick-capture.test.tsx 4/4.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Smoke executes reviewed Add UI and observes created role; native fixture setup elsewhere is API creation, not full UI acquisition. URL/NAV imports use approved synthetic provider fixtures; live imports unverified. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Duplicate/company/date edge UI and creation-intent idempotency remain independent gaps; import network boundary evidence is separate from live site success.<br>Capture/API owner; H — audit reviewed duplicate/company/date boundaries and interrupted creation; creation-intent idempotency stays a separate contract. | **PARTIAL** | **PARTIAL** |
| **PRES-J04** — Capture via browser extension, bookmarklet and share/capture query; optional job attachment and tailored CV draft after create<br>Original contract: `QuickCaptureCard`, `captureUrl`, `App`, `browser-extension`; preserve payload/URL contracts | `POST /api/jobimport/preview`;<br>`POST /api/jobapplications`;<br>`attachment and tailored-cv APIs`;<br>`captureUrl + AddJobModal` | Settings Quick capture install/bookmarklet; extension/share opens capture query handled by App; reviewed Add job then optional attachment/CV | Capture query preserves URL/text payload, no auto-create; optional post-create writes bind to created owned job; extension parsing tests are not installed-browser proof | [F:captureUrl](../../../../../job-tracker-ui/src/captureUrl.test.ts); [F:quick-capture](../../../../../job-tracker-ui/src/quick-capture.test.tsx); [B:JobImportService](../../../../../JobTrackerApi.Tests/JobImportServiceTests.cs); [B:CvBuilder](../../../../../JobTrackerApi.Tests/CvBuilderTests.cs)<br>Representative tests with inspected assertions: `auto-imports from initialUrl and prefills the form`; `Preview_rejects_equivalent_private_literals_before_http_send`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: JobImportServiceTests 16/16, CvBuilderTests 35/35. Frontend: quick-capture.test.tsx 4/4, captureUrl.test.ts 4/4.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Existing acquisition/capture assertions freshly rerun; original extension/parser3 pass. Real installed extension/PWA/platform share and external acquisition not executed. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Installed extension permissions/share flow and optional attachment failure recovery remain unverified.<br>Capture owner; H — audit installed extension/share/no-replay and post-create attachment failure recovery without auto-create. | **PARTIAL** | **PARTIAL** |
| **PRES-J05** — Job table search/filter/sort/pagination, visible columns/page size, saved named views, row/card actions<br>Original contract: `JobTable`, `SavedViewsMenu`; mobile cards and accessible full-workspace entry already exist | `GET /api/jobapplications (paged), board, choices`;<br>`JobApplicationsController` | Primary Jobs /jobs: search/filter/sort, page/page-size/columns/density, Saved views; activate row/card workspace; Board switch | Queries/saved-view owner state retain complete matching records; read Table/Board identity parity; row control events must not open workspace accidentally | [F:application-workspace-overlay](../../../../../job-tracker-ui/src/application-workspace-overlay.test.tsx); [F:account-scoped-state](../../../../../job-tracker-ui/src/account-scoped-state.test.tsx); [B:JobApplicationsController](../../../../../JobTrackerApi.Tests/JobApplicationsControllerTests.cs); [B:JobApplicationsEndpointBehavior](../../../../../JobTrackerApi.Tests/JobApplicationsEndpointBehaviorTests.cs)<br>Representative tests with inspected assertions: `keeps saved views private to the account that created them`; `opens the dedicated workspace from the whole row and preserves list state on return`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: JobApplicationsControllerTests 2/2, JobApplicationsEndpointBehaviorTests 9/9. Frontend: account-scoped-state.test.tsx 2/2, application-workspace-overlay.test.tsx 18/18.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh density/integrated Board fixtures preserve finite filter/sort/page/selection/row-focus/density contracts. Added250 exact-ID test traverses17 Table pages and equals Board API/DOM population. Saved-view/bulk long-tail remains outstanding. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Finite saved-view/filter/Back/error/selection fixtures do not exhaust saved-view CRUD or dirty nested page-size combinations; full-array scaling remains limited.<br>Jobs owner; H — audit full saved-view CRUD, Back/refresh/unknown query, dirty nested page-size and all-result scaling. | **PARTIAL** | **PARTIAL** |
| **PRES-J06** — Selection/bulk status/delete/restore, soft-delete/trash and restore, edit job/company association<br>Original contract: `JobTable`, `EditJobDialog`; preserve partial-error handling and confirmation semantics | `PUT /api/jobapplications/{id}`;<br>`PATCH {id}/status`;<br>`DELETE {id}`;<br>`POST {id}/restore`;<br>`JobApplicationsController + JobApplicationLifecycleController` | Jobs select rows then bulk status/delete; row edit; secondary Trash /trash select/restore; confirmation dialogs | Owner-scoped writes and soft deletion; partial bulk failures retained; restoring differs from recreating; foreign job/company associations denied | [F:application-workspace-overlay](../../../../../job-tracker-ui/src/application-workspace-overlay.test.tsx); [F:confirm-flow](../../../../../job-tracker-ui/src/confirm-flow.test.tsx); [B:JobApplicationsController](../../../../../JobTrackerApi.Tests/JobApplicationsControllerTests.cs); [B:JobApplicationsAuthorization](../../../../../JobTrackerApi.Tests/JobApplicationsAuthorizationTests.cs)<br>Representative tests with inspected assertions: `GetHistory_returns_not_found_for_other_users_job`; `opens the dedicated workspace from the whole row and preserves list state on return`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: JobApplicationsAuthorizationTests 4/4, JobApplicationsControllerTests 2/2. Frontend: application-workspace-overlay.test.tsx 18/18, confirm-flow.test.tsx 1/1.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh Jobs/Trash density fixtures exercise owned selection/status/delete-scope/restore/readback for named cases; backend mutations remain green. Not every bulk partial-failure/edit field is a complete browser journey. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Scoped native restore and bulk/mutation fixtures supersede earlier bare-confirm gaps; all bulk partial-failure/dirty-state combinations and deeper manual AT remain unverified.<br>Jobs/API owner; H — audit selected scope, partial bulk failures and Trash restore with native persistence/dirty protection. | **PARTIAL** | **PARTIAL** |
| **PRES-J07** — Kanban grouped status views, drag move, keyboard pickup/drop/cancel, direct status selection, job opening<br>Original contract: `KanbanBoard`, `pipeline`; same records as table, not a second job model | `GET /api/jobapplications/board`;<br>`PATCH /api/jobapplications/{id}/status`;<br>`JobApplicationsController + JobApplicationLifecycleController` | Jobs Board /jobs?view=board; legacy /kanban redirects; drag, keyboard pickup/drop/Cancel, card status menu/open | Same owned complete matching IDs as Table; custom/unknown status represented; failed status move rolls back; explicit no-drag selector writes same status API | [F:kanban-grouped-board](../../../../../job-tracker-ui/src/kanban-grouped-board.test.tsx); [F:pipeline](../../../../../job-tracker-ui/src/pipeline.test.ts); [B:JobPipeline](../../../../../JobTrackerApi.Tests/JobPipelineTests.cs)<br>Representative tests with inspected assertions: `a custom status gets an Other column that is not a drop target`; `statusLabel localizes canonical and passes through custom`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: JobPipelineTests 46/46. Frontend: kanban-grouped-board.test.tsx 15/15, pipeline.test.ts 11/11.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh Board presentation/integration fixtures prove pointer/keyboard status movement, custom statuses, failed-move feedback, query/history and exact IDs. Added250 population passes; scaling and physical native touch remain unqualified. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Physical touch/native drag, broader responsive focus/cancel combinations and full-result scaling remain open; grouped statuses are not a new pipeline.<br>Jobs/accessibility owner; H — audit keyboard cancel/view focus, physical touch/drag and complete filtered membership at scale; no new pipeline. | **PARTIAL** | **PARTIAL** |
| **PRES-J08** — Company directory, recruiter/contact/source/location and pipeline/contact-date editing; company relationship job history<br>Original contract: `CompaniesTable`; company creation is integrated with job/import flows, not assumed standalone CRUD | `GET/POST/PUT /api/companies`;<br>`GET /api/companies/{id}/relationship`;<br>`CompaniesController` | Jobs group Companies /companies; command company result opens relationship; row edit contact/recruiter/source/pipeline; creation from Add job/import | Owned directory reads and edit writes; company job/contact history owner-bound; integrated creation exists, no standalone CRUD flow inferred | [F:companies-relationship](../../../../../job-tracker-ui/src/companies-relationship.test.tsx); [F:quick-command-preservation](../../../../../job-tracker-ui/src/quick-command-preservation.test.tsx); [B:CompanyRelationship](../../../../../JobTrackerApi.Tests/CompanyRelationshipTests.cs)<br>Representative tests with inspected assertions: `Relationship_combines_owned_applications_and_contact_history`; `opens one company relationship view with applications and recent contact`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: CompanyRelationshipTests 2/2. Frontend: companies-relationship.test.tsx 1/1, quick-command-preservation.test.tsx 9/9.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** All-role company route/native GET and existing creation/edit component/backend cases pass. Full native recruiter/contact/pipeline CRUD and outside-modal feedback race remain outstanding. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | All contact/date edits and source-URL safety browser journeys remain unverified; P4-02-D02 inaccessible modal-save error is open for its owner.<br>Companies/accessibility owner; H — fix and prove durable in-modal save error before form migration (P4-02-D02); audit contact/date/source links. | **PARTIAL** | **PARTIAL** |
| **PRES-J09** — Offer comparison including recorded compensation, decision deadline and notes, source-job links<br>Original contract: `OfferComparisonPage`; no new compensation calculator implied | `GET /api/jobapplications`;<br>`PUT /api/jobapplications/{id}`;<br>`JobApplicationsController` | Secondary Offers /offers compares offer records, open source job; source job edit compensation/deadline/notes | Recorded compensation read, no invented calculation; edit remains job owner write; missing values remain unknown | [F:offer-comparison](../../../../../job-tracker-ui/src/offer-comparison.test.tsx); [B:AnalyticsSalary](../../../../../JobTrackerApi.Tests/AnalyticsSalaryTests.cs); [B:JobApplicationsEndpointBehavior](../../../../../JobTrackerApi.Tests/JobApplicationsEndpointBehaviorTests.cs)<br>Representative tests with inspected assertions: `Save_application_drafts_updates_cover_letter_and_notes`; `compares recorded offer facts without filling missing values`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: JobApplicationsEndpointBehaviorTests 9/9, AnalyticsSalaryTests 1/1. Frontend: offer-comparison.test.tsx 2/2.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** All-role Offers route/native GET passes; named compensation/offer comparison fixtures pass. Full multi-offer native editing/decision workflow not newly performed. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Mobile many-offer comparison and localized currency/date visual acceptance remain open; no new salary facts are claimed.<br>Offers owner; M — audit many-offer narrow layout, currency/period/date labels and safe source links across EN/NB. | **PARTIAL** | **PARTIAL** |
| **PRES-J10** — JSON/CSV job export; JSON import; CSV-to-import-JSON conversion and import counts<br>Original contract: `ImportExportJobs`; preserve B05 blob bytes/BOM, spreadsheet safety and typed formats; do not claim full account restore from job import | `GET /api/export/jobs`;<br>`POST /api/companies, /api/jobapplications`;<br>`ExportController + ImportExportJobs` | Settings General /settings Jobs Import/export: JSON/CSV download, JSON upload, CSV-to-import-JSON conversion | Blob/BOM/CSV spreadsheet safety retained; import creates owned company/job records and reports counts, not existing-record restoration; job import is not complete account restore | [F:csv-export](../../../../../job-tracker-ui/src/csv-export.test.tsx); [B:CsvExport](../../../../../JobTrackerApi.Tests/CsvExportTests.cs); [B:JobApplicationsController](../../../../../JobTrackerApi.Tests/JobApplicationsControllerTests.cs)<br>Representative tests with inspected assertions: `Application_package_record_exposes_expected_fields`; `%s download preserves server bytes and a generated safe filename`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: JobApplicationsControllerTests 2/2, CsvExportTests 25/25. Frontend: csv-export.test.tsx 2/2.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh named import/export backend/component cases pass; no complete file-upload/conversion/download UI lifecycle added. Production account restore is separate, unverified. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Full JSON import/count/roundtrip browser proof and spreadsheet-client compatibility remain separately bounded; byte/formula/Unicode fixtures are not exhaustive.<br>Settings/data owner; H — audit native JSON import counts/roundtrip, Unicode/formula-safe bytes and target spreadsheet compatibility. | **PARTIAL** | **PARTIAL** |
| **PRES-W01** — Dedicated job workspace and reusable quick overlay; overview/analysis/CV/cover-letter/interview sections; old deep-link mapping<br>Original contract: `ApplicationWorkspacePage`, `ApplicationWorkspace`, `jobWorkspaceRoute`; retain full-page/overlay parity | `GET /api/jobapplications/{id}/workspace`;<br>`ApplicationWorkspaceController` | Jobs row /jobs/:id; legacy /applications/:id redirect; seven tabs plus aliases; reusable overlay host where already invoked | Overview read aggregates owners without copying canonical data; URL/query/Back/dirty protections; mount/navigation must not generate AI; P5-05 new quick-preview host remains deferred | [F:application-workspace-overlay](../../../../../job-tracker-ui/src/application-workspace-overlay.test.tsx); [F:applicationWorkspace](../../../../../job-tracker-ui/src/applicationWorkspace.test.ts); [B:ApplicationWorkspace](../../../../../JobTrackerApi.Tests/ApplicationWorkspaceTests.cs)<br>Representative tests with inspected assertions: `opens the dedicated workspace from the whole row and preserves list state on return`; `workspace navigation exposes seven purposes and preserves legacy links`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: ApplicationWorkspaceTests 10/10. Frontend: application-workspace-overlay.test.tsx 18/18, applicationWorkspace.test.ts 3/3.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh job-section/Overview/preservation plus32-route census verify direct/alias entry, refresh, sections, Back/Forward and Jobs context; foreign/missing Job404 has no private title. Quick-preview host remains unused/approved deferred. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Reusable overlay has no active production host; followMode metadata retained but mode-specific UI explicitly deferred to mail. Full manual AT and historical transition-capture limits remain.<br>Workspace/mail owner; H — audit all canonical/legacy entries and numeric navigation-helper arguments, safe query/state, dirty/Back/focus; carry followMode UI to mail phase. | **PARTIAL** | **PARTIAL** |
| **PRES-W02** — Job detail/status/progression, next actions, dates, description, recruiter/contact and timeline<br>Original contract: `JobDetailsSection`, `ApplicationProgress`, `ApplicationTimeline`; do not redefine pipeline enums or history | `GET /api/jobapplications/{id}`;<br>`PATCH {id}/status, followup`;<br>`GET {id}/history, timeline`;<br>`JobApplicationLifecycleController + ApplicationIntelligenceController` | Job workspace Overview header/status/Edit; Timeline Activity subview | Owned status/date writes and append-only history; moving backward has explicit applied-date semantics; human notes differ from package answers/events | [F:application-intelligence](../../../../../job-tracker-ui/src/application-intelligence.test.tsx); [F:workflow-trust-signals](../../../../../job-tracker-ui/src/workflow-trust-signals.test.tsx); [B:JobApplicationsWorkflowSignals](../../../../../JobTrackerApi.Tests/JobApplicationsWorkflowSignalsTests.cs); [B:JobApplicationsAppliedDateHistory](../../../../../JobTrackerApi.Tests/JobApplicationsAppliedDateHistoryTests.cs)<br>Representative tests with inspected assertions: `timeline renders grouped days, milestones and readable summaries`; `follow-up workflow signals route all overview surfaces to the same follow-up workspace`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: JobApplicationsWorkflowSignalsTests 2/2, JobApplicationsAppliedDateHistoryTests 4/4. Frontend: application-intelligence.test.tsx 11/11, workflow-trust-signals.test.tsx 3/3.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh populated/sparse Overview and sections fixtures exercise header/status/metadata/actions/timeline under four theme/locale pairs; no inferred events. Long-tail contact/date/history mutations remain outstanding. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Localized backend event/content text, timezone/reload/status-to-timeline combinations and human AT remain unverified; job revision semantics were not repaired.<br>Workspace/API owner; H — audit native edit/status/date-to-timeline and localized stored content/timezones; job revision debt separately. | **PARTIAL** | **PARTIAL** |
| **PRES-W03** — Analysis, profile match/gaps, strategy snapshot, workflow assistance and status suggestions<br>Original contract: `ApplicationAnalysis`, `ApplicationMatch`, `ApplicationStatusSuggestion`, `ApplicationStrategySnapshot`; show provenance/loading/failure and confirmation | `GET /api/jobapplications/{id}/analysis, match, status-suggestion, focus-plan`;<br>`POST focus-plan/operations, {id}/refresh-ai`;<br>`ApplicationIntelligenceController + StrategySnapshotController` | Job workspace Match; refresh/strategy generation and suggestion Apply controls | Saved/read projections distinct from explicit provider generation; accepted status suggestion writes only after confirmation; owner/provenance/failure state retained | [F:application-intelligence](../../../../../job-tracker-ui/src/application-intelligence.test.tsx); [F:application-workflow-assist](../../../../../job-tracker-ui/src/application-workflow-assist.test.tsx); [B:ApplicationIntelligence](../../../../../JobTrackerApi.Tests/ApplicationIntelligenceTests.cs); [B:StrategySnapshotOperation](../../../../../JobTrackerApi.Tests/StrategySnapshotOperationTests.cs)<br>Representative tests with inspected assertions: `timeline renders grouped days, milestones and readable summaries`; `recruiter status suggestions require an explicit apply action`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: ApplicationIntelligenceTests 19/19, StrategySnapshotOperationTests 4/4. Frontend: application-intelligence.test.tsx 11/11, application-workflow-assist.test.tsx 2/2.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh deterministic analysis/strategy/match suites and native section presentation pass finite behavior; no live model quality or new grounded analysis generated for qualification. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Live model truthfulness, freshness/cancelled generation and provider quality remain unverified; P5-13 production CV withholding must not disable these unrelated AI paths.<br>Workspace/AI owner; H — audit reviewed suggestions/error/cancel/freshness/no-write entry; qualify live factuality separately from CV exception. | **PARTIAL** | **PARTIAL** |
| **PRES-W04** — Checklist create/edit/complete/delete/order, progress and recommended next action<br>Original contract: `ApplicationChecklist`; keep keyboard reorder and persisted item identity | `GET/POST/PATCH/DELETE /api/jobapplications/{id}/checklist`;<br>`PUT checklist/order`;<br>`ApplicationChecklistController` | Job workspace Tasks: add/edit/complete/delete task, keyboard move up/down, progress/next action | Item IDs owned through job; first read can seed/recompute deterministic system checklist, not AI generation; manual reorder persists identity | [F:application-checklist](../../../../../job-tracker-ui/src/application-checklist.test.tsx); [B:ApplicationChecklist](../../../../../JobTrackerApi.Tests/ApplicationChecklistTests.cs)<br>Representative tests with inspected assertions: `reordering sends the new id order`; `Reordering_persists_the_new_order`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: ApplicationChecklistTests 15/15. Frontend: application-checklist.test.tsx 7/7.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh sections/checklist fixtures exercise owned task completion/edit/readback and next-action presentation. GET seed/recompute remains an existing server write contract; all scheduler/CRUD combinations not certified. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Real mobile interruption/edit/delete combinations and human AT remain open; no task due-date schema or automatic notification added.<br>Workspace owner; H — audit native mobile item edit/delete/reorder/interruption and manual/system/dismissed next actions. | **PARTIAL** | **PARTIAL** |
| **PRES-W05** — Select/attach a CV, create/tailor document variants, review tailoring guidance and selected-source context<br>Original contract: `ApplicationCvSection`, `ApplicationTailoringSection`, `applicationWorkspace`; owner+job association enforced by API | `GET/PUT /api/jobapplications/{id}/cv`;<br>`GET tailoring`;<br>`tailored-cv-draft GET/PUT/generate`;<br>`ApplicationAssetsController + JobApplicationsController` | Job workspace Application CV: select/attach/detach, create/tailor variant, open identified CV builder | Association changes owned job pointer and does not mutate canonical profile/other CV; selected CV must share owner; generation explicit and guidance requires review | [F:application-assets](../../../../../job-tracker-ui/src/application-assets.test.tsx); [F:cv-builder-deep-link](../../../../../job-tracker-ui/src/cv-builder-deep-link.test.tsx); [B:ApplicationAssets](../../../../../JobTrackerApi.Tests/ApplicationAssetsTests.cs); [B:CvBuilder](../../../../../JobTrackerApi.Tests/CvBuilderTests.cs)<br>Representative tests with inspected assertions: `Resolver_defaults_include_every_populated_section`; `cv section shows the attached variant and the ones available to attach`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: CvBuilderTests 35/35, ApplicationAssetsTests 15/15. Frontend: application-assets.test.tsx 18/18, cv-builder-deep-link.test.tsx 41/41.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh native preservation/section fixtures select owned CV/tailoring source and preserve captured CV association after source changes; backend native ZIP proof separately passes. Job tailoring live-model quality not qualified. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | P2-D01 is an ordinary passing native regression, not current expected failure. Broader attach-render combinations, provider tailoring quality and deployed restore remain unverified; CV review production exception stays distinct.<br>Workspace/CV owner; H — audit attach/render/detach/create/tailor with source and foreign-owner checks; retain ordinary native P2-D01 successor. | **PARTIAL** | **PARTIAL** |
| **PRES-W06** — Cover-letter editing, AI suggestion review/reject/apply, saved versions and restore, unsaved navigation protection<br>Original contract: `ApplicationAssets`, `CoverLetterAiAssistant`; document override must not mutate master profile | `GET/PUT /api/jobapplications/{id}/cover-letter`;<br>`POST cover-letter/versions/{version}/restore`;<br>`ApplicationAssetsController + AiWorkspaceController` | Job workspace Application Cover letter: edit/save, request AI/review/apply/reject, versions restore; attempt leaving dirty | Owned document versions separate from canonical source; no write on navigation; Cancel keeps draft, Discard permits leave; restore is explicit new document state | [F:application-assets](../../../../../job-tracker-ui/src/application-assets.test.tsx); [F:application-workspace-overlay](../../../../../job-tracker-ui/src/application-workspace-overlay.test.tsx); [B:ApplicationAssets](../../../../../JobTrackerApi.Tests/ApplicationAssetsTests.cs)<br>Representative tests with inspected assertions: `opens the dedicated workspace from the whole row and preserves list state on return`; `cover letter loads the current text and its history`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: ApplicationAssetsTests 15/15. Frontend: application-workspace-overlay.test.tsx 18/18, application-assets.test.tsx 18/18.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh workspace draft/navigation fixtures cover dirty Cancel/Discard and native cover-letter state; named accept/reject/history backend/component cases pass. No live provider or every restore race qualification. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Native/mocked review/history evidence does not establish live-model or provider quality; full screen-reader and every reject/history sequence remain unverified.<br>Workspace/AI owner; H — audit native manual/AI reject/accept/save/history and dirty Cancel/Discard; actual model quality separately. | **PARTIAL** | **PARTIAL** |
| **PRES-W07** — Application draft fields, submission/package preparation, frozen submitted-package versions and archived attachment download<br>Original contract: `ApplicationAssets`, `SubmittedPackagesSection`, `applicationWorkspace`; historical package is distinct from current draft | `PUT /api/jobapplications/{id}/application-drafts`;<br>`GET/POST submitted-packages`;<br>`GET submitted-packages/{packageId}/attachments/{attachmentId}`;<br>`ApplicationAssetsController + SubmittedApplicationPackageService` | Job workspace Application Answers/Submission: edit drafts, prepare/capture, open frozen version, download ZIP/archive attachment | Current drafts differ from immutable historical capture; answer markers preserve human notes; exact archived bytes/hash survive source edits/delete; owner+job+package enforced | [F:application-assets](../../../../../job-tracker-ui/src/application-assets.test.tsx); [F:application-drafts](../../../../../job-tracker-ui/src/application-drafts.test.ts); [B:SubmittedApplicationPackage](../../../../../JobTrackerApi.Tests/SubmittedApplicationPackageTests.cs); [B:JobApplicationsApplicationPackage](../../../../../JobTrackerApi.Tests/JobApplicationsApplicationPackageTests.cs)<br>Representative tests with inspected assertions: `document package history is read-only and separates captured notes from answers`; `application answer helpers keep human notes separate`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: SubmittedApplicationPackageTests 4/4, JobApplicationsApplicationPackageTests 11/11. Frontend: application-assets.test.tsx 18/18, application-drafts.test.ts 3/3.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh browser capture/immutable JSON/readback/archive-file download and fresh native backend ZIP/extraction fixture pass. Frozen source/answers/attachments remain historical; production storage/restore not tested. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Earlier P2-D01 capture expected failure is superseded by ordinary native passing evidence. Production restore/rollback and all storage/provider combinations remain unverified; capture is not external send.<br>Workspace/storage owner; H — retain native capture→source mutation→archive/ZIP immutable-byte regression; release owner proves restore/rollback independently. | **PARTIAL** | **PARTIAL** |
| **PRES-W08** — Attachments upload/drag-drop, category/purpose, rename, AI-use flag, preview/download/delete<br>Original contract: `Attachments`; owner-scoped binary retrieval, consent selection and size/error handling | `GET/POST /api/attachments`;<br>`GET /api/attachments/{jobId}, download/{id}`;<br>`PATCH/DELETE {id}`;<br>`AttachmentsController` | Job workspace Documents: Upload/drop file, category/purpose/name/AI-use, preview/download/delete confirmation | Binary and metadata owner-scoped; 10 MB/type/storage boundaries; per-file consent controls AI use; archive retention independent from current attachment deletion | [F:attachments](../../../../../job-tracker-ui/src/attachments.test.tsx); [B:AttachmentsController](../../../../../JobTrackerApi.Tests/AttachmentsControllerTests.cs); [B:AttachmentConsistency](../../../../../JobTrackerApi.Tests/AttachmentConsistencyTests.cs)<br>Representative tests with inspected assertions: `attachments metadata controls update purpose and ai usage`; `Controller_requires_local_authorization`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: AttachmentsControllerTests 3/3, AttachmentConsistencyTests 14/14. Frontend: attachments.test.tsx 3/3.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh attachment/section fixtures retain owned archived/current file relationships and download/delete behavior; owner-negative backend cases pass. Initial attachment-focus race/human and all MIME/device combinations remain open. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Archive gate is locally satisfied for recorded native fixtures; physical drag/drop, broad rename/download/manual AT and production storage behavior remain unverified.<br>Workspace/storage owner; H — audit upload/category/name/consent/preview/download/delete and physical drop with live/frozen identity. | **PARTIAL** | **PARTIAL** |
| **PRES-W09** — Interview questions/categories, manual items, answers, ready status, remove, contextual AI review/add-to-prep<br>Original contract: `InterviewPrep`, `applicationWorkspace`; generated facts/answers require review | `GET/POST/PATCH/DELETE /api/jobapplications/{id}/interview-prep`;<br>`POST {id}/ai/generate`;<br>`InterviewPrepController + AiWorkspaceController` | Job workspace Interview: add question/category/answer, ready toggle/remove; AI generate/review/Add to prep | Owned prep items only explicitly accepted from AI history; generated facts/answers must not become truth automatically; source context/refresh and consent retained | [F:interview-prep](../../../../../job-tracker-ui/src/interview-prep.test.tsx); [B:InterviewPrepPersistence](../../../../../JobTrackerApi.Tests/InterviewPrepPersistenceTests.cs); [B:InterviewAiContext](../../../../../JobTrackerApi.Tests/InterviewAiContextTests.cs)<br>Representative tests with inspected assertions: `prep renders grouped items with progress and marks AI-sourced ones`; `GetInterviewPrep_persists_and_reuses_the_generated_note`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: InterviewPrepPersistenceTests 3/3, InterviewAiContextTests 8/8. Frontend: interview-prep.test.tsx 13/13.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh interview manual question/preparation/context section fixtures pass; deterministic grounded AI cases only. Actual provider quality and every question/answer manipulation not newly certified. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Real-model quality, physical mobile keyboard/populated reload and manual AT remain open; prep does not establish scheduled interview data.<br>Workspace/AI owner; H — audit populated mobile keyboard/reload/manual removal and explicit AI review; no scheduled-interview inference. | **PARTIAL** | **PARTIAL** |
| **PRES-W10** — Interview debrief template and follow-up content/date, readiness and next-action state<br>Original contract: `InterviewPrep`; neutral prompts must not seed invented company/achievement facts | `GET/PUT /api/jobapplications/{id}/follow-up`;<br>`GET {id}/followup-draft, readiness`;<br>`InterviewPrepController + JobApplicationsController` | Job workspace Interview Debrief template/answer and follow-up edit/date; Overview next-action opens Timeline correspondence | Neutral template, no invented achievements; own follow-up content/date writes; old send-followup gone, real delivery belongs to Mail; followMode only metadata | [F:interview-prep](../../../../../job-tracker-ui/src/interview-prep.test.tsx); [B:JobApplicationsFollowUpDraft](../../../../../JobTrackerApi.Tests/JobApplicationsFollowUpDraftTests.cs); [B:InterviewPrep](../../../../../JobTrackerApi.Tests/InterviewPrepTests.cs)<br>Representative tests with inspected assertions: `starts a structured interview debrief without inventing answers`; `Follow_up_draft_uses_imported_thread_and_saved_package_context`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: JobApplicationsFollowUpDraftTests 2/2, InterviewPrepTests 11/11. Frontend: interview-prep.test.tsx 13/13.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh interview/debrief/next-action and section query fixtures pass named state; followMode retains compatibility metadata only. Mode-specific follow-up compose UI remains approved later-mail deferral. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Timezone/reload chains and provider delivery remain unverified; followMode-specific compose UI is deferred rather than implemented.<br>Workspace/mail/calendar owner; H — audit debrief/date/reload and metadata links; defer mode-specific compose UI under recorded decision. | **PARTIAL** | **PARTIAL** |
| **PRES-W11** — Follow-up/reminder workflow, rule-driven dates/stages, notifications, deadline/follow-up ICS and Google/Outlook calendar event actions<br>Original contract: `RemindersView`, `RulesSettingsCard`, `ApplicationCalendarActions`; calendar integration already exists, date-only/timestamp semantics must survive | `GET /api/jobapplications/reminders`;<br>`GET/PUT /api/rules`;<br>`PATCH {id}/followup`;<br>`GET /api/calendar/status, jobs/{id}/events.ics`;<br>`POST jobs/{id}/events`;<br>`ApplicationCalendarController` | Reminders /reminders opens job/follow-up; Settings Follow-ups; job calendar menu Download ICS/Add Google/Outlook | Owned reminder/date writes; rules do not ghost prospects; date-only all-day vs timestamp preserved; provider connection does not imply writable calendar consent | [F:daily-control-loop](../../../../../job-tracker-ui/src/daily-control-loop.test.tsx); [F:application-calendar](../../../../../job-tracker-ui/src/application-calendar.test.tsx); [B:ApplicationCalendarController](../../../../../JobTrackerApi.Tests/ApplicationCalendarControllerTests.cs); [B:RulesEngineProspect](../../../../../JobTrackerApi.Tests/RulesEngineProspectTests.cs)<br>Representative tests with inspected assertions: `dashboard attention card opens follow-up workspace`; `adds the selected application date to a writable connected calendar`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: ApplicationCalendarControllerTests 4/4, RulesEngineProspectTests 5/5. Frontend: daily-control-loop.test.tsx 4/4, application-calendar.test.tsx 3/3.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh reminders route/read, calendar/rule/date/export backend/component fixtures pass; native Rules draft loss is recorded under S03. External calendar operations and actual scheduled delivery remain NOT VERIFIED. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | F21 DST/date-only/provider timezone gap, actual Google/Outlook events, scheduler delivery and historical unconfirmed rules-save 500 remain open.<br>Calendar/API owner; H — investigate F21 DST/date-only semantics before event changes; audit real ICS/rules/reminder and approved provider writes. | **PARTIAL** | **PARTIAL** |
| **PRES-W12** — Async operation progress, pending/failed/retry/cancel states and associated notifications<br>Original contract: `OperationsPage`, profile processing components; preserve operation IDs and server state, avoid duplicate starts on rerender | `GET /api/operations, {id}`;<br>`POST {id}/retry, cancel`;<br>`GET /api/notifications`;<br>`OperationsController + UserOperationStore` | Account/utility Operations /operations: inspect pending/failure, Retry/Cancel; bell opens linked operation | Persistent owner operation IDs, explicit retry/cancel and notification read/dismiss; idempotent producer/worker claims; rerender is not duplicate generation authorization | [F:operations-page](../../../../../job-tracker-ui/src/operations-page.test.tsx); [F:profile-page](../../../../../job-tracker-ui/src/profile-page.test.tsx); [B:OperationsController](../../../../../JobTrackerApi.Tests/OperationsControllerTests.cs); [B:UserOperationStore](../../../../../JobTrackerApi.Tests/UserOperationStoreTests.cs)<br>Representative tests with inspected assertions: `profile page loads persisted structured cv and can re-parse it`; `shows persistent operation and notification states with accessible actions`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: OperationsControllerTests 3/3, UserOperationStoreTests 10/10. Frontend: profile-page.test.tsx 15/15, operations-page.test.tsx 3/3.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** All-role Operations route/native GET and named dispatcher/operation cancellation/retry suites pass. No production worker/provider execution launched; full async delivery remains unverified. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Long disconnect/reconnect and F20 enabled worker fault containment remain operational gaps; no live job/worker recovery was certified.<br>Operations/worker owner; H — audit disconnect/reconnect/late-result/no-duplicate starts/cancel/retry; F20 recovery before enabling producers. | **PARTIAL** | **PARTIAL** |
| **PRES-C01** — Canonical structured career profile: personal details, summary, skills, work, education, languages, interests and long-tail/custom sections<br>Original contract: `CareerProfilePage`, `views/career/*`; profile save is an account singleton, CV is an identified derived resource | `GET/PUT /api/career/profile`;<br>`CareerProfileController + CareerProfileService` | Career /career section Profile: structured personal/summary/work/education/skills/languages/interests/custom fields Save | Canonical account singleton write with version history; CV identified lens separate; no selected-CV override may replace canonical source | [F:profile-page](../../../../../job-tracker-ui/src/profile-page.test.tsx); [B:CareerProfileController](../../../../../JobTrackerApi.Tests/CareerProfileControllerTests.cs); [B:CareerProfileService](../../../../../JobTrackerApi.Tests/CareerProfileServiceTests.cs)<br>Representative tests with inspected assertions: `profile page loads persisted structured cv and can re-parse it`; `Put_then_get_round_trips_the_profile_and_updates_the_projection`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: CareerProfileControllerTests 6/6, CareerProfileServiceTests 21/21. Frontend: profile-page.test.tsx 15/15.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh source-scope/preservation native fixtures prove canonical source versus selected/sibling CV isolation and readback; no complete all-entry canonical CRUD/import journey. Named backend/component cases pass. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Full long-tail Career/mobile save and canonical concurrent updates remain separate; scoped CV acceptance never implies canonical-profile revision safety.<br>Career/API owner; H — audit every long-tail/custom field and mobile save/source isolation; canonical concurrent saves remain separate. | **PARTIAL** | **PARTIAL** |
| **PRES-C02** — Profile overview, completeness/import guidance, manual edit, copy raw CV text, avatar and version history/restore<br>Original contract: `CareerWorkspacePage`, `CareerProfilePage`; preserve projection/history behavior without redesigning schema | `GET /api/career/profile/completeness, versions`;<br>`POST versions/{version}/restore`;<br>`GET /api/profile-cv/runs`;<br>`CareerProfileController` | Career /career overview/profile: completeness/import guidance, edit, raw-text copy/avatar, History Restore | Projection read and explicit profile restore writes a canonical version; account avatar identity remains separate; source history not CV settings history | [F:career-workspace-page](../../../../../job-tracker-ui/src/career-workspace-page.test.tsx); [F:profile-page](../../../../../job-tracker-ui/src/profile-page.test.tsx); [B:CareerProfileService](../../../../../JobTrackerApi.Tests/CareerProfileServiceTests.cs)<br>Representative tests with inspected assertions: `/career shows the profile completeness overview`; `SaveVersionAsync_assigns_stable_ids_to_items_missing_one`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: CareerProfileServiceTests 21/21. Frontend: profile-page.test.tsx 15/15, career-workspace-page.test.tsx 7/7.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh current Career route/read and revision/profile named suites pass; complete native canonical-history restore/avatar/raw-copy long-tail remains outstanding. No new profile-snapshot semantics invented. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Clipboard/avatar and complete native profile historical restore/manual AT remain unverified; real extraction quality is separate.<br>Career owner; M — audit raw copy, overview/completeness/import guidance and full historical restore without silent data replacement. | **PARTIAL** | **PARTIAL** |
| **PRES-C03** — CV/file upload and extraction, rebuild/improve/reprocess, progress/history, diff, explicit low-confidence selection, accept/discard, retry/cancel<br>Original contract: `CareerProfilePage`, `/profile-cv/*`; uploaded proposal is not silently canonical truth | `POST /api/profile-cv/upload, rebuild, improve, reprocess`;<br>`GET runs, runs/{id}/diff`;<br>`POST runs/{id}/accept, discard`;<br>`ProfileCvController + operation store` | Career /career Profile Import/upload/history/diff: select low-confidence changes, Accept/Discard, Retry/Cancel | Owned extracted proposal not silently canonical; explicit accept only selected content; file artifacts/progress/failed operations require retention and recovery | [F:profile-page](../../../../../job-tracker-ui/src/profile-page.test.tsx); [B:ProfileCvController](../../../../../JobTrackerApi.Tests/ProfileCvControllerTests.cs); [B:CvProfileDiffService](../../../../../JobTrackerApi.Tests/CvProfileDiffServiceTests.cs)<br>Representative tests with inspected assertions: `pending CV extraction can be reviewed and applied`; `Upload_rejects_unsupported_extension`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: ProfileCvControllerTests 32/32, CvProfileDiffServiceTests 11/11. Frontend: profile-page.test.tsx 15/15.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh deterministic extraction/review/progress/selection regression suites pass. Actual external extraction/provider/cancellation delivery and all formats/low-confidence combinations remain unverified. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Unusual/scanned/OCR document quality and full low-confidence deselection/discard browser acceptance remain unverified; no provider certification.<br>Career/extraction owner; H — audit low-confidence deselect/discard/retry/cancel and corpus quality; approve provider calls separately. | **PARTIAL** | **PARTIAL** |
| **PRES-C04** — Evidence bank: sourced statement/title/category/tags, add/list/delete and truthfulness guidance<br>Original contract: `CareerEvidenceBank`; evidence belongs to profile owner and is not AI-invented experience | `GET/POST/PUT/DELETE /api/career/evidence`;<br>`CareerEvidenceController` | Career /career Evidence: add sourced title/statement/category/tags, list/delete | Own user-approved evidence with provenance; statements cannot become invented employment; deletion explicit and tenant-bound | [F:career-evidence](../../../../../job-tracker-ui/src/career-evidence.test.tsx); [B:CareerEvidenceController](../../../../../JobTrackerApi.Tests/CareerEvidenceControllerTests.cs)<br>Representative tests with inspected assertions: `saves factual evidence with provenance and tags`; `Evidence_is_user_approved_tenant_scoped_and_deletable`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: CareerEvidenceControllerTests 1/1. Frontend: career-evidence.test.tsx 1/1.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh evidence-bank CRUD/owner backend/component cases pass; no native full add/tag/delete route traversal added. Evidence-source factual review remains a human obligation. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Full delete/many-item search/keyboard browser acceptance remains open; broader Career page work stays Phase 7.<br>Career owner; M — audit evidence source/category/tags/delete and large-list keyboard/source navigation. | **PARTIAL** | **PARTIAL** |
| **PRES-C05** — CV library create/name/copy/delete, template gallery and real sample thumbnails, publish/unpublish/share and PDF download<br>Original contract: `CvBuilderPage`, `cvBuilder`; separate public slug from numeric private ID | `GET/POST/PUT/DELETE /api/cv/variants`;<br>`POST {id}/duplicate`;<br>`PUT {id}/public`;<br>`themes/preview`;<br>`CvVariantController` | CV library /career/builder: Create/name/copy/delete, template card real sample, Publish/Unpublish/Share/PDF; open /:id | Owned private numeric IDs distinct from public slug; publish explicit; copying preserves selected settings; deleting/unpublishing removes public reach as documented | [F:cv-builder-page](../../../../../job-tracker-ui/src/cv-builder-page.test.tsx); [F:cv-template-thumbnail](../../../../../job-tracker-ui/src/cv-template-thumbnail.test.tsx); [B:CvBuilder](../../../../../JobTrackerApi.Tests/CvBuilderTests.cs); [B:PublicCvController](../../../../../JobTrackerApi.Tests/PublicCvControllerTests.cs)<br>Representative tests with inspected assertions: `Create_then_save_increments_version_and_keeps_history`; `shows the empty state and creates a CV then navigates to the editor`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: CvBuilderTests 35/35, PublicCvControllerTests 3/3. Frontend: cv-builder-page.test.tsx 6/6, cv-template-thumbnail.test.tsx 1/1.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh smoke API setup publishes synthetic public CV and downloads anonymous HTML/PDF; editor-frame UI revoke and library/template fixtures pass. This is not full UI creation/publication lifecycle or deployed rendering proof. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Complete publish/unpublish/old-link revocation chain and every library/template combination remain unverified; library redesign is not claimed.<br>CV owner; H — audit create/copy/delete/gallery/share/publish/unpublish and old-public-link revocation; keep numeric/slug identity distinct. | **PARTIAL** | **PARTIAL** |
| **PRES-C06** — Studio Template/Content/Customize/AI Tools/History navigation; debounced preview, page boundaries/automatic fit and save state<br>Original contract: `CvBuilderEditor`; existing mobile edit/preview and desktop split must retain parity; automatic fit is not a manual zoom control | `GET /api/cv/variants/{id}, preview`;<br>`POST /api/cv/preview`;<br>`PUT variants/{id}`;<br>`CvVariantController` | Identified studio /career/builder/:id Template/Content/Customize/AI Tools/History; mobile Edit/Preview and Fit/Return | Debounced read preview and queued explicit/autosave owner revision write; white document page/count separate from application theme; fit not manual zoom | [F:cv-builder-deep-link](../../../../../job-tracker-ui/src/cv-builder-deep-link.test.tsx); [B:CvBuilder](../../../../../JobTrackerApi.Tests/CvBuilderTests.cs)<br>Representative tests with inspected assertions: `Section_presentation_is_normalized_and_shared_by_preview_and_pdf_renderer`; `pane navigation focuses the existing preview without changing the pending draft`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: CvBuilderTests 35/35. Frontend: cv-builder-deep-link.test.tsx 41/41.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh CV frame/responsive/preview native fixtures verify five tabs, save/history access, mode switching, region names, fit/page indicators and retention; measured16/16 standard fidelity. Human/device/production-font acceptance open. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | P5-14 now supplies the integrated held-PUT pane/viewport, preview boundary-key/scroll, reachable return, canvas and hit-test successor. Physical touch/software keyboard, 200%/400% zoom, human AT, broader wrapped/short-height states and production rendering remain unaccepted.<br>CV/accessibility owner; H — retain P5-14 held-PUT/responsive/scroll checks; obtain physical touch/software keyboard/zoom/manual AT evidence. | **PARTIAL** | **PARTIAL** |
| **PRES-C07** — Built-in item visibility/order, custom sections, preset/free-text section catalog, item/content overrides, hide/remove, native section drag and keyboard reorder<br>Original contract: `CvBuilderEditor`, `components/cv/*`, `useDragReorder`; selected profile source and overrides remain distinguishable | `PUT /api/cv/variants/{id}`;<br>`GET /api/cv/outline`;<br>`CvVariantController + CvVariantService` | Studio Content: show/hide/remove, source/reset override, custom preset/free-text section, move up/down/native drag | Selected CV settings/override writes retain stable source/item IDs; omitted differs from deleted canonical; custom section ownership and nested/foreign drop boundaries retained | [F:cv-builder-deep-link](../../../../../job-tracker-ui/src/cv-builder-deep-link.test.tsx); [F:cvBuilder](../../../../../job-tracker-ui/src/cvBuilder.test.ts); [B:CvBuilder](../../../../../JobTrackerApi.Tests/CvBuilderTests.cs)<br>Representative tests with inspected assertions: `Resolver_applies_item_override_bullets_without_touching_the_master`; `[P5-10 PRES-C07 C10] resetting one entry field preserves omission, sibling override and order and supports undo`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: CvBuilderTests 35/35. Frontend: cv-builder-deep-link.test.tsx 41/41, cvBuilder.test.ts 13/13.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh source-scope/responsive native fixtures verify override/reset/omission/CV-only entry, section order/reorder alternatives and canonical isolation; native browser pointer automation is not physical-touch acceptance. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | P5-14 closes P5-10-O01 only for tested ownership/default-drop cases: entry/section order, inactive nested lists and foreign editable-title non-mutation. Physical touch/text selection/all-browser gestures and exhaustive saved override/reset combinations remain unqualified.<br>CV/accessibility owner; H — retain tested native nested ownership/default-drop checks; audit physical touch/text selection/all-browser overrides before broader claim. | **PARTIAL** | **PARTIAL** |
| **PRES-C08** — Template-capability-aware typography/colors/header/headings, skills presentation/groups, one/two-column and sidebar settings, photo/icons<br>Original contract: `CvCustomizeTab`, theme registry; retain unsupported-setting handling and server render equivalence | `GET /api/cv/themes`;<br>`PUT /api/cv/variants/{id}`;<br>`CvVariantController + theme renderer registry` | Studio Template/Customize Style: typography/color/header/headings/skills/groups/columns/sidebar/photo/icons | Capability-aware setting writes; unsupported controls/default reset do not erase unrelated dormant values; server renderer authoritative, theme toggle must not change document palette | [F:cv-builder-deep-link](../../../../../job-tracker-ui/src/cv-builder-deep-link.test.tsx); [F:cvBuilder](../../../../../job-tracker-ui/src/cvBuilder.test.ts); [B:CvBuilder](../../../../../JobTrackerApi.Tests/CvBuilderTests.cs)<br>Representative tests with inspected assertions: `Resolver_defaults_include_every_populated_section`; `choosing a template restores its own structure instead of inheriting the previous template layout`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: CvBuilderTests 35/35. Frontend: cv-builder-deep-link.test.tsx 41/41, cvBuilder.test.ts 13/13.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh template/style controls and8 native settings exports pass; representative capabilities/IDs/colors/fonts retained. Production font/photo and every template/capability combination remain unqualified. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | All-template/font/photo/wrapped-line/browser/control combinations and broad custom-colour/manual AT remain unverified; finite capability matrix and Pro locks are not exhaustive.<br>CV/renderer owner; M — audit capability controls/locks and broader font/photo/wrapped text; manual custom-colour names and contrast. | **PARTIAL** | **PARTIAL** |
| **PRES-C09** — A4/Letter, density, margins/spacing, date format, document language, per-section rows/grid/compact/bubbles and columns<br>Original contract: `cvBuilder`, `CvCustomizeTab`, content controls; do not drop advanced controls merely to simplify layout | `PUT /api/cv/variants/{id}`;<br>`POST variants/{id}/export-pdf`;<br>`CvVariantController` | Studio Customize Layout/Advanced: A4/Letter/density/margin/spacing/date/language/rows/grid/compact/bubbles/columns | Validated document settings owner revision write; retained advanced fields/render semantics; locale of controls distinct from document language; geometry oracles unchanged | [F:cvBuilder](../../../../../job-tracker-ui/src/cvBuilder.test.ts); [F:cv-builder-deep-link](../../../../../job-tracker-ui/src/cv-builder-deep-link.test.tsx); [B:CvBuilder](../../../../../JobTrackerApi.Tests/CvBuilderTests.cs)<br>Representative tests with inspected assertions: `Variant_settings_reject_css_injection_in_visual_overrides`; `editor sections, design controls and document settings render in Bokmål`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: CvBuilderTests 35/35. Frontend: cv-builder-deep-link.test.tsx 41/41, cvBuilder.test.ts 13/13.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh settings/Layout control before/after exports yield24 preview=24PDF pages; standard36=36 also passes unchanged tolerances. Actual wider zoom/reflow and arbitrary settings combinations remain unverified. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Recorded unchanged-tolerance local fidelity supersedes prior six-fixture failures; all advanced combinations, deployment fonts/photo/wrapped text and manual print inspection remain open.<br>CV/renderer owner; H — retain unchanged numerical oracle/settings exports; audit advanced locale/layout combinations and actual deployed print/fonts. | **PARTIAL** | **PARTIAL** |
| **PRES-C10** — Undo/redo of editor settings, save queue, unsaved guard, history/version restore and preview lifecycle<br>Original contract: `CvBuilderEditor`; current queue serializes one mounted editor only, not concurrent browsers | `PUT /api/cv/variants/{id}`;<br>`GET versions`;<br>`POST versions/{version}/restore`;<br>`CvVariantController + CvVariantService` | Studio Undo/Redo, save status/retry/recovery; History select Restore; dirty navigation Keep editing/Discard | Undo local settings vs reset live-source override vs persisted history lens distinct; expected revision blocks lost update; queue serializes mounted editor, not all browsers | [F:cv-builder-deep-link](../../../../../job-tracker-ui/src/cv-builder-deep-link.test.tsx); [B:CvBuilder](../../../../../JobTrackerApi.Tests/CvBuilderTests.cs)<br>Representative tests with inspected assertions: `Resolver_defaults_include_every_populated_section`; `revision conflict retains the draft and blocks later autosaves until explicit reload`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: CvBuilderTests 35/35. Frontend: cv-builder-deep-link.test.tsx 41/41.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh five backend revision safety cases plus browser dirty/conflict/recovery/history access and undo/redo fixtures pass; generated/unaccepted AI history protections deterministic. No all multi-device race certification. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | CV stale-write/history safety has scoped native evidence; long offline/history combinations and profile/job concurrent edits remain separate. No new save owner or history store.<br>CV/API owner; H — audit long offline/history/conflict/undo/dirty transitions; retain downloadable draft and one save/history owner. | **PARTIAL** | **PARTIAL** |
| **PRES-C11** — Per-section AI improve/translate/custom instruction and whole-document translate/improve/spelling review<br>Original contract: `AiSectionAssistant`, builder AI tab; source/target language, current/suggestion comparison, apply/reject | `POST /api/cv/ai/assist, variants/{id}/ai/apply`;<br>`CvVariantController + optional CvAiSuggestionService` | Studio AI Tools and per-section assistant: improve/translate/custom/spelling, compare, Apply/Reject | Pro entitlement, owner/revision/proposal binding and explicit apply; Production service withheld 503 cv_ai_unavailable; qualification/review UI obligation deferred, not fulfilled by safety tests | [F:ai-section-assistant](../../../../../job-tracker-ui/src/ai-section-assistant.test.tsx); [F:cv-builder-deep-link](../../../../../job-tracker-ui/src/cv-builder-deep-link.test.tsx); [B:AiWorkspace](../../../../../JobTrackerApi.Tests/AiWorkspaceTests.cs); [B:AiPrivacyPolicy](../../../../../JobTrackerApi.Tests/AiPrivacyPolicyTests.cs) ; [Production no-write checks](../../../../../JobTrackerApi.Tests/CvAiReadinessTests.cs), [isolated HTTP contract](../../../../../job-tracker-ui/ai-tests/cv-ai-readiness.spec.ts)<br>Representative tests with inspected assertions: `[PRES-C11 PRES-C07] whole-document AI %s changes only an explicitly accepted CV override`; `section AI uses the CV document language and requires explicit server acceptance`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: AiWorkspaceTests 9/9, AiPrivacyPolicyTests 9/9, CvAiReadinessTests 29/29. Frontend: cv-builder-deep-link.test.tsx 41/41, ai-section-assistant.test.tsx 14/14.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Approved P5-13 deferral:0/366 configured-model calls,0 human reviews, UI unimplemented. Fresh108 deterministic AI and realHTTP2 prove Production503 before provider/write and unrelated AI fixture availability only. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Full CV rewriting/review remains DEFERRED — BLOCKED / NOT QUALIFIED: deployed model identity unverified; frozen 32-case/366-call qualification has 0 completed calls and 0 human reviews; factuality unmeasured; P5-13 review UI unimplemented. Current Production guard returns 503 cv_ai_unavailable; safe withholding is an exception, not successful generation/review. Existing assistant affordances can report unavailable.<br>AI/CV/product owner; H — meet frozen model identity/corpus/rubric/human review and review-UI return conditions; retain Production 503/no-write/unrelated-AI checks. | **DEFERRED** | **DEFERRED** |
| **PRES-C12** — Authenticated PDF export and anonymous published-CV preview/PDF; long searchable multipage documents<br>Original contract: `PublicCvPage`, `cvBuilder`, server renderer; B03 shared resource admission and public ownership/publication checks | `POST /api/cv/variants/{id}/export-pdf`;<br>`GET /api/public-cv/{slug}, {slug}/pdf`;<br>`CvVariantController + PublicCvController + PdfRenderAdmission` | Private studio/library PDF; Share public /cv/:slug anonymous page and PDF download | Private owner check; anonymous only published slug; revoke/unknown slug denies render; shared owner/global admission prevents overlaunch; long searchable pages require native output proof | [F:public-cv-page](../../../../../job-tracker-ui/src/public-cv-page.test.tsx); [B:PublicCvController](../../../../../JobTrackerApi.Tests/PublicCvControllerTests.cs); [B:PdfRenderAdmission](../../../../../JobTrackerApi.Tests/PdfRenderAdmissionTests.cs)<br>Representative tests with inspected assertions: `Pdf_download_is_rate_limited`; `public CV exposes the rendered CV and PDF download`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: PublicCvControllerTests 3/3, PdfRenderAdmissionTests 22/22. Frontend: public-cv-page.test.tsx 1/1.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh16 standard and8 settings native preview/PDF exports pass exact page membership and unchanged metrics; browser public/download and native frozen attachment proof pass. Production fonts/photos/storage/render deployment unverified. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | P5-14 retains unchanged 16-fixture/36-page native preview/PDF and 8-settings/24-page export historical proof at unchanged tolerances. This is finite local evidence; deployed Chromium/Linux/fonts/photo/all-print-engine and manual print inspection remain unverified.<br>CV/rendering/release owner; H — audit public revoke/private denial/PDF busy recovery and deployed Linux/fonts/photos/manual print; preserve admission. | **PARTIAL** | **PARTIAL** |
| **PRES-M01** — Job-scoped manual note/email log, search, delete, paste/import message; current job/company context<br>Original contract: `Correspondence`; manual record is different from sending a real email | `GET/POST /api/correspondence`;<br>`GET {jobId}, message/{id}, page`;<br>`DELETE {id}`;<br>`CorrespondenceController` | Job workspace Timeline Correspondence: log note/email, contextual search, paste/import, delete | Owner/job-bound manual records and search; recording is not delivery; imported text/context cannot bypass owned job relationship | [F:end-to-end-trust-loop](../../../../../job-tracker-ui/src/end-to-end-trust-loop.test.tsx); [F:correspondence-search-context](../../../../../job-tracker-ui/src/correspondence-search-context.test.ts); [B:CorrespondenceController](../../../../../JobTrackerApi.Tests/CorrespondenceControllerTests.cs)<br>Representative tests with inspected assertions: `overview entry opens the canonical communication workspace without sending mail`; `builds contextual suggestions for the shared application correspondence view`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: CorrespondenceControllerTests 3/3. Frontend: end-to-end-trust-loop.test.tsx 1/1, correspondence-search-context.test.ts 2/2.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh timeline/correspondence section fixture and native inbox GET pass; full mail filters/open/reply/send/provider lifecycle not traversed. Named backend/component cases prove their finite contracts. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Full manual edit/delete/paste-import browser combinations and manual AT remain unverified; logging correspondence is not sending mail.<br>Mail/workspace owner; H — audit native log CRUD/search/paste import and no-send distinction. | **PARTIAL** | **PARTIAL** |
| **PRES-M02** — Gmail candidate search/import, linked-thread refresh/sync history, import thread, unlink/relink/move with job selection<br>Original contract: `Correspondence`; cross-job relationship changes remain owner-bound | `GET /api/gmail/job-candidates, messages`;<br>`POST import, import-thread, refresh-linked-threads, manual-sync, unlink-thread, relink-thread`;<br>`GmailController` | Job Timeline Correspondence Gmail tools: candidate/import/thread/refresh, unlink/relink/move owned job picker | Owner provider grant + job/thread/message links; move cannot cross tenant; provider absence/error distinct from no correspondence; sync is external and remains sandbox-unverified | [F:correspondence-gmail-import](../../../../../job-tracker-ui/src/correspondence-gmail-import.test.tsx); [B:GmailController](../../../../../JobTrackerApi.Tests/GmailControllerTests.cs); [B:EmailOwnershipIntegration](../../../../../JobTrackerApi.Tests/EmailOwnershipIntegrationTests.cs)<br>Inherited EmailOwnershipIntegration anchor is an identity-token suite and is excluded from this mail group’s fresh coverage.<br>Representative tests with inspected assertions: `automatically refreshes already-linked Gmail threads without manual re-import`; `Import_thread_rejects_missing_message_ids`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: GmailControllerTests 19/19. Frontend: correspondence-gmail-import.test.tsx 6/6.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh named draft/correspondence owner and conflict tests pass; no real delivery/provider integration executed. Identity email-token tests are excluded from mailbox ownership evidence. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Live provider threads, multi-account reconnect/revoked grants and sync failures remain unverified.<br>Mail/provider owner; H — audit owned thread/job link/move/unlink/reconnect and approved live sync failures. | **PARTIAL** | **PARTIAL** |
| **PRES-M03** — Global correspondence inbox with pagination/search/filter/direction/provider/link state, full message and attachment information, source-job links<br>Original contract: `CorrespondenceInboxPage`; provider read failure distinct from no messages | `GET /api/correspondence/page, message/{id}`;<br>`GET /api/email/providers, messages, thread, message`;<br>`EmailController + CorrespondenceController` | Secondary Correspondence /correspondence: search/filter/page/provider/direction/link; open message and source-job link | Owned saved inbox can display while provider unavailable; fetched plain text avoids provider HTML injection; large mailbox/binary attachment delivery not proven by mock detail | [F:correspondence-inbox-page](../../../../../job-tracker-ui/src/correspondence-inbox-page.test.tsx); [B:EmailController](../../../../../JobTrackerApi.Tests/EmailControllerTests.cs); [B:EmailOwnershipIntegration](../../../../../JobTrackerApi.Tests/EmailOwnershipIntegrationTests.cs)<br>Inherited EmailOwnershipIntegration anchor is an identity-token suite and is excluded from this mail group’s fresh coverage.<br>Representative tests with inspected assertions: `keeps saved correspondence visible when provider status is unavailable`; `Provider_status_is_owner_scoped_and_does_not_claim_send_support`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: EmailControllerTests 3/3. Frontend: correspondence-inbox-page.test.tsx 16/16.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh named provider/correspondence ownership tests pass; no external binary mailbox sync or live reconnect exercised. Identity email confirmation tests contribute no mailbox isolation proof. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Real large-mailbox/attachment-binary flows and complete native inbox/AT acceptance remain open; global inbox redesign stays Phase 7.<br>Mail owner; H — audit large native inbox paging/provider failure/detail/attachment binaries and manual AT. | **PARTIAL** | **PARTIAL** |
| **PRES-M04** — Compose/reply, choose connected provider and job/recipient, save/resume/delete drafts, review/confirm send, delivery states and explicit new attempt<br>Original contract: `CorrespondenceInboxPage`; persisted draft revision and send idempotency/uncertain delivery controls must survive navigation changes | `GET/POST/PUT/DELETE /api/email/drafts`;<br>`POST {id}/new-attempt`;<br>`POST /api/email/send`;<br>`EmailDraftsController + EmailController` | Correspondence /correspondence Compose or message Reply; select provider/job/recipient, Save/Resume/Delete, review final Send | Owned draft revision + ClientRequestId/send identity; explicit send confirmation; uncertain delivery never auto-retried; definitive failure permits explicit new attempt only; followMode compose UI deferred | [F:correspondence-inbox-page](../../../../../job-tracker-ui/src/correspondence-inbox-page.test.tsx); [B:EmailDraftsController](../../../../../JobTrackerApi.Tests/EmailDraftsControllerTests.cs); [B:EmailDraftPersistence](../../../../../JobTrackerApi.Tests/EmailDraftPersistenceTests.cs)<br>Representative tests with inspected assertions: `resumes a saved draft and surfaces revision conflicts without overwriting it`; `Revision_conflicts_prevent_lost_updates_and_cross_tenant_deletes`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: EmailDraftsControllerTests 5/5, EmailDraftPersistenceTests 1/1. Frontend: correspondence-inbox-page.test.tsx 16/16.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh named inbox/draft/send conflict and section entry fixtures pass finite semantics; no real send/reconnect or every dirty/uncertain interruption journey. followMode UI remains deferred, no automatic resend. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Actual sandbox mail delivery/reconnect and every dirty/send interruption remain unverified; no automatic uncertain-send retry. followMode-specific UI remains deferred.<br>Mail/API owner; H — audit draft conflicts, explicit send/uncertain-new-attempt, reconnect/dirty interruption; followMode UI deferred, no automatic resend. | **PARTIAL** | **PARTIAL** |
| **PRES-M05** — Gmail review candidates, proposed jobs, link/reject/keep decisions, notes, manual sync and create suggested job<br>Original contract: `GmailReviewPage` embedded in inbox; retain legacy review redirect | `GET /api/gmail/review-candidates, suggested-jobs`;<br>`POST review-decision, manual-sync, create-suggested-job`;<br>`GmailController` | Correspondence Review view /correspondence?view=review; /correspondence/review alias; Link/Reject/Keep/notes/Sync/Create | Reviewed owner decisions; no create on navigation/sync; proposed-job creation explicit and retains connection/thread association; real provider source unknown | [F:gmail-review-page](../../../../../job-tracker-ui/src/gmail-review-page.test.tsx); [F:correspondence-inbox-page](../../../../../job-tracker-ui/src/correspondence-inbox-page.test.tsx); [B:GmailController](../../../../../JobTrackerApi.Tests/GmailControllerTests.cs)<br>Representative tests with inspected assertions: `Save_review_decision_links_thread_and_imports_messages`; `renders correspondence inbox items and reloads with filters`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: GmailControllerTests 19/19. Frontend: correspondence-inbox-page.test.tsx 16/16, gmail-review-page.test.tsx 3/3.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** All-role review alias retains destination and intentional Gmail-not-connected409 with named warning; fresh review/component/backend cases pass. Actual provider suggested-job/link/create not exercised. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Real provider review and complete suggested-job creation browser journey remain unverified; no automatic creation from navigation.<br>Mail/capture owner; H — audit review alias, proposed-job/link/reject/keep/notes/sync/create confirmation and owner boundaries. | **PARTIAL** | **PARTIAL** |
| **PRES-M06** — Gmail/Google and Microsoft Graph connection/status/disconnect, IMAP connection/status/disconnect<br>Original contract: `EmailProviderConnections`, `ConnectedAccountsPage`; login identity and mail-provider identity are separate capabilities | `GET /api/gmail/status, connect-url`;<br>`DELETE connection`;<br>`/api/microsoft-graph equivalents`;<br>`GET /api/imap/status`;<br>`POST connect`;<br>`DELETE connection`;<br>`provider controllers` | Settings Manage connected accounts /settings/connected-accounts; Google/Outlook Connect/Disconnect; IMAP host/user/password connection | Owner provider authorization independent from sign-in link; IMAP SSRF/ciphertext credential handling; actual token revocation/expiry/reconnect remains external evidence | [F:email-provider-connections](../../../../../job-tracker-ui/src/email-provider-connections.test.tsx); [B:MicrosoftGraphController](../../../../../JobTrackerApi.Tests/MicrosoftGraphControllerTests.cs); [B:ImapController](../../../../../JobTrackerApi.Tests/ImapControllerTests.cs)<br>Representative tests with inspected assertions: `renders connection controls in Norwegian Bokmål`; `Status_returns_sync_state_fields_for_connected_account`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: MicrosoftGraphControllerTests 7/7, ImapControllerTests 9/9. Frontend: email-provider-connections.test.tsx 3/3.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** All-role connected-account route observes genuine Gmail status; backend/component Graph/IMAP contracts pass. Full live Gmail/Graph/IMAP grant/revoke/expiry and every status not established by census. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Actual provider authorization/revocation/token expiry/reconnect remain unverified; no credentials or live provider operations in this review.<br>Connections/provider owner; H — audit actual grants/revoke/expiry/reconnect and IMAP safety; provider sandbox authorization required. | **PARTIAL** | **PARTIAL** |
| **PRES-S01** — Personal dashboard counts, activity/funnel/company/skill trends, stage/salary insights and actionable next steps<br>Original contract: `DashboardView`, analytics APIs; chart transformations and empty/error states preserved | `GET /api/jobapplications/stats, analytics, analytics-overview, tag-trends`;<br>`JobApplicationAnalyticsController` | Primary Dashboard /dashboard and Analytics /analytics: report period/table/value/insight/action drill-down | Read owned exact population/period/stage/salary metrics; no invented compensation/denominator; error distinct from empty; Dashboard flags do not hide Analytics report families | [F:daily-control-loop](../../../../../job-tracker-ui/src/daily-control-loop.test.tsx); [F:workflow-trust-signals](../../../../../job-tracker-ui/src/workflow-trust-signals.test.tsx); [B:StageAnalytics](../../../../../JobTrackerApi.Tests/StageAnalyticsTests.cs); [B:AnalyticsSalary](../../../../../JobTrackerApi.Tests/AnalyticsSalaryTests.cs)<br>Representative tests with inspected assertions: `Salary_insights_keep_currency_and_period_groups_separate`; `follow-up workflow signals route all overview surfaces to the same follow-up workspace`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: AnalyticsSalaryTests 1/1, StageAnalyticsTests 4/4. Frontend: workflow-trust-signals.test.tsx 3/3, daily-control-loop.test.tsx 4/4.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh Dashboard/Analytics browser fixtures validate real recorded cohorts/exact chart alternatives/periods/drill-down and account isolation; four theme/locale pairs. New unsupported metrics remain absent; production timezone/provider/human chart reading not certified. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Scoped native chart/value/population transformations supersede earlier unmapped chart gaps; server timezone/date/population limits and unsupported NEW metrics remain explicit.<br>Reports/API owner; M — audit exact cohort/sample/date definitions and drill-down links; retain unsupported-metric boundaries. | **PARTIAL** | **PARTIAL** |
| **PRES-S02** — Five per-owner local visibility preferences; onboarding progress and dismiss; notification bell/unread/read/dismiss<br>Original contract: `DashboardView`, `OnboardingChecklist`, `NotificationsPopover`; no server widget-order/resize contract exists yet | `GET /api/notifications, unread-count`;<br>`POST {id}/read`;<br>`DELETE {id}`;<br>`OperationsController`;<br>`browser owner-local flags` | Dashboard visibility toggles/onboarding Dismiss; shell bell read/dismiss/open notification | Five local flags owner keyed; no server widget-order/resize/reset contract; notification writes tenant-bound and idempotent; server language save is distinct from local flag persistence | [F:onboarding-checklist](../../../../../job-tracker-ui/src/onboarding-checklist.test.tsx); [F:notifications-popover](../../../../../job-tracker-ui/src/notifications-popover.test.tsx); [B:JobLifecycleEvent](../../../../../JobTrackerApi.Tests/JobLifecycleEventTests.cs)<br>Representative tests with inspected assertions: `uses structured career data and connected inbox status for onboarding progress`; `shows notifications and updates read and dismissed state in place`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: JobLifecycleEventTests 9/9. Frontend: onboarding-checklist.test.tsx 1/1, notifications-popover.test.tsx 6/6.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh Dashboard five owner-local visibility flags/reload/account-switch and shell notification fixtures pass. Three language/notification overlap rounds pass separately; earlier generic language500 remains open, not a Dashboard-toggle failure. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Five owner-local Dashboard visibility flags and scoped reload/account evidence remain; order/resize/reset is deferred. Recorded P5-06-O01 generic language-preference 500 during overlapping Dashboard/setup reads has no established exception/root cause; sequential fixture setup does not close concurrent save reliability.<br>Dashboard/shell/identity owner; H — investigate recorded P5-06-O01 language-save 500 during reads; audit five flags A/B/reload plus bell/onboarding; order/resize/reset deferred. | **PARTIAL** | **PARTIAL** |
| **PRES-S03** — Follow-up/ghosting rule settings, email reminder preference, table preferences, theme/language and connected-account links<br>Original contract: `SettingsView`, `RulesSettingsCard`; preferences have different scopes, do not replace with one unsafely shared object | `GET/PUT /api/rules, notification-settings`;<br>`PUT /api/auth/preferences/language`;<br>`RulesController + NotificationSettingsController + AuthController` | Settings General/Follow-ups/Notifications tabs or mobile section picker; edit/Save rules and reminders, table/theme/language; connections link | Rules/reminder/language server writes vs browser/table preferences have separate scopes; failure must preserve actionable draft; tab unmount discards local RulesSettingsCard draft in current source | [F:settings-view](../../../../../job-tracker-ui/src/settings-view.test.tsx); [F:theme-state](../../../../../job-tracker-ui/src/theme-state.test.tsx); [B:NotificationSettingsController](../../../../../JobTrackerApi.Tests/NotificationSettingsControllerTests.cs); [B:RulesEngineProspect](../../../../../JobTrackerApi.Tests/RulesEngineProspectTests.cs)<br>Representative tests with inspected assertions: `uses one browser preference and falls back to System`; `A_prospect_is_never_followed_up_or_ghosted_however_old`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: RulesEngineProspectTests 5/5, NotificationSettingsControllerTests 3/3. Frontend: theme-state.test.tsx 7/7, settings-view.test.tsx 5/5.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Native Rules diagnostic loses unsaved5 back to14 on tab return; persisted14 and zero writes. **FAIL SETTINGS-01**. Saved rule/readback and three overlapping language/notification saves pass, but historical500 remains open. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | P4-04-O02 recorded SQLite notification saves had 2/10 HTTP 500/database-locked attempts; isolated rules 500 remains unconfirmed. P5-06-O01 language-preference 500 and rule drafts lost on tab unmount stay open; sequential success does not establish concurrency safety.<br>Settings/API/identity owner; H — investigate P4-04-O02 concurrent notification 500 and P5-06-O01 language-save 500; audit rule draft/tab lifecycle, unknown route/preferences.  **Confirmed defect:** [register](DEFECTS.md); separate owner repair required. | **PARTIAL** | **FAIL** |
| **PRES-S04** — AI privacy settings, usage/limits, honest Free/Pro lock states, billing status, conditional checkout and portal<br>Original contract: `AiPrivacySettingsCard`, `AiUsageCard`, `AccountPlanProvider`; server entitlement authoritative, not client context defaults | `GET/PUT /api/ai/settings`;<br>`GET /api/ai/usage`;<br>`GET /api/billing/status`;<br>`POST checkout, portal`;<br>`AiSettingsController + AiUsageController + BillingController` | Settings General privacy/usage/plan; Pro locks in domains; Upgrade/Manage only when server billing available | Server entitlement and monthly owner metering authoritative; privacy consent external processing gated; conditional billing is not real checkout proof; C11 Production exception bounded | [F:settings-view](../../../../../job-tracker-ui/src/settings-view.test.tsx); [F:ai-usage-card](../../../../../job-tracker-ui/src/ai-usage-card.test.tsx); [B:AiPrivacyPolicy](../../../../../JobTrackerApi.Tests/AiPrivacyPolicyTests.cs); [B:AiUsageMeter](../../../../../JobTrackerApi.Tests/AiUsageMeterTests.cs)<br>Representative tests with inspected assertions: `External_processing_requires_admin_gate_user_consent_and_pro`; `settings view has no accent picker and uses one follow-up section, one notification section`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: AiPrivacyPolicyTests 9/9, AiUsageMeterTests 3/3. Frontend: settings-view.test.tsx 5/5, ai-usage-card.test.tsx 2/2.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh entitlement/privacy/usage deterministic suites and realHTTP withholding fixtures pass; existing unrelated AI remains available in fixture. No live checkout/webhook/provider consent or P5-13 semantic qualification. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Actual checkout/webhooks/portal and provider consent/delivery remain unverified. Production CV unavailability is temporary authorized P5-13 debt, not fulfillment or disabling other AI.<br>AI/commerce/API owner; H — retain entitlement/privacy/metering and bounded Production CV exception; separately prove checkout/webhooks/portal before activation. | **PARTIAL** | **PARTIAL** |
| **PRES-S05** — Account export, encrypted backup download, lifecycle status and deliberate deletion confirmation<br>Original contract: `BackupCard`; recent-auth/password/provider restrictions remain; a downloadable backup is not proven restore readiness | `POST /api/export/account, /api/backup/encrypted`;<br>`GET /api/account-lifecycle/status`;<br>`POST delete`;<br>`ExportController + BackupController + AccountLifecycleController` | Settings Backup: readable ZIP/encrypted download; lifecycle/deletion enabled server flag then deliberate confirmation | Recent-auth/password/provider restrictions; complete owner ZIP/redaction distinct from full recoverable restore; account deletion destructive, not run in this audit | [F:account-data-export](../../../../../job-tracker-ui/src/account-data-export.test.tsx); [B:AccountDataExport](../../../../../JobTrackerApi.Tests/AccountDataExportTests.cs); [B:BackupController](../../../../../JobTrackerApi.Tests/BackupControllerTests.cs)<br>Representative tests with inspected assertions: `downloads the readable account ZIP from the protected endpoint`; `Readable_zip_is_complete_checksummed_owner_isolated_and_redacted`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: AccountDataExportTests 3/3, BackupControllerTests 3/3. Frontend: account-data-export.test.tsx 4/4.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh account ZIP/encrypted backup/lifecycle backend/component cases pass; native Job-package ZIP proof is distinct. No current production database backup/restore or destructive account lifecycle rehearsal. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Actual database/account restore, verified recoverable backups, paid deletion/provider cancellation and rollback remain production release gates; no destructive rehearsal occurred.<br>Account lifecycle/release owner; H — audit exact confirmations/ZIP/backup gates; current recoverable restore/paid deletion/provider cancellation/rollback require authorized rehearsal. | **PARTIAL** | **PARTIAL** |
| **PRES-A01** — Admin user list/create, role promotion/demotion guards, reset link and delete with last-admin/self warnings<br>Original contract: `AdminUsersPage`, `/users`; API roles enforce privilege regardless of navigation | `GET/POST /api/users`;<br>`PUT {id}/roles`;<br>`DELETE {id}`;<br>`POST {id}/send-password-reset`;<br>`UsersController` | Admin Users /admin/users via role-gated Admin group; create/list/promote/demote/reset/delete confirmations | Admin API authority independent from shell; last-admin guard and self-confirmation, role changes revoke sessions/trusted devices; actual reset email not proved by controller mock | [F:admin-users-page](../../../../../job-tracker-ui/src/admin-users-page.test.tsx); [B:UsersController](../../../../../JobTrackerApi.Tests/UsersControllerTests.cs); [B:ApiAuthorizationPosture](../../../../../JobTrackerApi.Tests/ApiAuthorizationPostureTests.cs)<br>Representative tests with inspected assertions: `warns before demoting another administrator`; `SetRoles_rejects_removing_the_final_administrator`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: UsersControllerTests 7/7, ApiAuthorizationPostureTests 5/5. Frontend: admin-users-page.test.tsx 4/4.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh32-route census normal403/admin200 and account metadata distinction; guarded role/last-admin/self backend suites pass. Full native successful user mutations/reset delivery/role revocation not performed. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Mounted-view role revocation, full mutations and actual reset delivery remain unverified; hidden nav/synthetic shell never proves authorization.<br>Admin/identity owner; H — audit full guarded mutations, mounted-role revoke and real reset; crafted API denial remains mandatory. | **PARTIAL** | **PARTIAL** |
| **PRES-A02** — Admin audit event list/detail, supported undo and job restore<br>Original contract: `AdminAuditPage`; preserve event/ownership semantics rather than generic mutation buttons | `GET /api/admin/audit`;<br>`POST {id}/undo`;<br>`AdminAuditController` | Admin Audit /admin/audit: filters/list/detail, supported Undo/job restore | Admin read/mutation with supported event semantics and restore ownership; unsupported undo unavailable; role posture test alone is not successful undo proof | [F:admin-audit-page](../../../../../job-tracker-ui/src/admin-audit-page.test.tsx); [B:AuthAndSystemController](../../../../../JobTrackerApi.Tests/AuthAndSystemControllerTests.cs); [B:ApiAuthorizationPosture](../../../../../JobTrackerApi.Tests/ApiAuthorizationPostureTests.cs)<br>Inherited AuthAndSystemController anchor has no Audit/Undo assertion and is excluded from this group’s fresh coverage. Authorization posture is reflection evidence only.<br>Representative tests with inspected assertions: `Every_controller_either_requires_authorization_or_is_listed_as_public`; `distinguishes an unavailable audit log from an empty audit log and retries`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: ApiAuthorizationPostureTests 5/5. Frontend: admin-audit-page.test.tsx 2/2.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh normal403/admin200 route/read and named error/retry UI/authorization-posture cases pass. Successful native AuditUndo/job restore remains NOT VERIFIED; no false attribution of38 auth/system tests. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Complete successful native undo/job restore browser acceptance remains open; role posture is not undo behavior proof.<br>Admin/API owner; H — audit persisted successful undo/job restore, unsupported actions and non-admin denial. | **PARTIAL** | **PARTIAL** |
| **PRES-A03** — Separate system health/build/database/AI/email status, SMTP settings/test, AI probe, CV corpus benchmark and maintenance run controls<br>Original contract: `AdminSystemPage`; sensitive config values/logs must not move into personal dashboard | `GET /api/admin/system, email-settings, cv-benchmark, maintenance-jobs`;<br>`PUT email-settings`;<br>`POST ai/probe, maintenance-jobs/{jobId}/runs`;<br>`POST /api/users/send-test-email`;<br>`AdminSystemController` | Admin System /admin/system status/build/database/AI/mail; SMTP Settings/Test, probe, benchmark/maintenance control | Admin-only sensitive reads/writes; secret redaction and allowlisted dispatch; actual production SMTP/model/probe/maintenance external operations not performed | [F:admin-system-page](../../../../../job-tracker-ui/src/admin-system-page.test.tsx); [B:AuthAndSystemController](../../../../../JobTrackerApi.Tests/AuthAndSystemControllerTests.cs); [B:MaintenanceJobDispatcher](../../../../../JobTrackerApi.Tests/MaintenanceJobDispatcherTests.cs)<br>Representative tests with inspected assertions: `Login_locks_account_after_five_failed_attempts_and_rejects_sixth_even_with_correct_password`; `loads and saves smtp settings from the settings tab`. These protect finite fixtures; mocked UI/controller providers do not prove real delivery or every listed control. | **Observed source:** owner/entry/call boundary and assertion excerpts inspected.<br>**Fresh execution:** Backend: AuthAndSystemControllerTests 38/38, MaintenanceJobDispatcherTests 3/3. Frontend: admin-system-page.test.tsx 4/4.<br>All above mapped cases passed at audit source; counts overlap between rows and are not additive. **Fresh native/observed outcome:** Fresh normal403/admin200 system route/read and named SMTP/allowlisted dispatcher tests pass. No live SMTP/probe/model/maintenance run or production sensitive-output qualification. [Journey scope](JOURNEYS_AND_CONTROLS.md); [native results](evidence/browser-summary.json). | Actual production SMTP/model/probes/benchmark/maintenance and sensitive-output qualification remain unverified; no live jobs launched.<br>Admin/operations owner; H — audit metadata/diagnostic sensitive outputs and guarded controls; production SMTP/model/maintenance proof separately authorized. | **PARTIAL** | **PARTIAL** |

## Discrepancies and separate exceptions

- **S03 draft-loss blind spot:** `SettingsView.tsx:43–44` returns `null` for inactive tab panels; `RulesSettingsCard` keeps an unsaved draft in mounted component state. Changing tabs therefore destroys that draft. The existing native preservation test at `redesign-preservation.spec.ts:209` resizes with the draft mounted, saves rules, then changes tabs; it does not protect unsaved tab traversal. The separate native diagnostic now fails that exact unsaved tab traversal:14→5→14, no writes. S03 is FAIL under SETTINGS-01; this is a freshly confirmed previously recorded risk, not a newly introduced audit regression.
- **Preference reliability:** P4-04-O02 notification SQLite lock/500 and P5-06-O01 language-save 500 during overlapping reads are distinct inherited failures. Sequential successful saves, local flag reload, or a non-recurrence do not establish concurrency safety or erase those records. Fresh repetition/API exception/DB-provider evidence belongs to the functional audit; bounded remediation belongs to an explicit owning checkpoint.
- **Approved `followMode` exception:** `jobWorkspaceRoute.ts` produces it and `ApplicationWorkspacePage` clones current query parameters before changing `section/sub`. No consumer of it is present in the workspace or inbox compose owner. Metadata preservation is testable; mode-specific compose UI remains the approved mail deferral and is not accepted by URL assertions. This affects W10/W11/M04 reach meaning, without inventing missing behavior as a new implementation request.
- **P5-05 separate:** a new active quick-preview host remains reserved/deferred. W01 still protects actual full-workspace and reusable overlay contracts. An unused host is not an executed journey, and P5-05 is not C11 or a failure inferred from absence.
- **C11 explicitly DEFERRED:** P5-13 qualification has zero configured-model calls/human reviews and its new review UI remains unfinished. Current Production optional-service absence yields `503 cv_ai_unavailable` before generation/Apply writes. Passing deterministic guards and unrelated-AI availability prove controlled withholding only; they do not fulfill original AI generation/review.
- **Superseded historical failures:** original Phase 2 P2-D01 expected failure, stale-CV revision failures and repaired P5-10/P5-14 drag/geometry cases retain their historical records but have newer bounded native/revision evidence. Do not reinstate expected failures or claim their supersession satisfies all provider/manual/render combinations.
- **Ownership test precision:** authorization posture tests assert endpoint attributes; controller/service tests assert scoped resources; browser account-isolation and crafted API denials test transport behavior. None alone proves every route's successful control traversal, mounted-role revocation, real OAuth, BFCache variation, mailbox binary or successful Admin undo.
- **GET is not database-pure:** `ApplicationWorkspaceService:111–112` obtains checklist state through `ApplicationChecklistService.GetAsync`. First reads seed missing owned deterministic checklist rows; recomputation can save system completion state. These behaviors are covered by the retained checklist tests. Browser zero mutation-request counts establish no frontend-triggered unintended mutation/AI generation; they cannot establish zero server persistence on every GET. The matrix preserves the existing seed/recompute contract explicitly rather than proposing a behavioral repair during this audit.
- **Inherited mail/audit mappings corrected:** `EmailOwnershipIntegrationTests` contains exactly three real Identity confirmation/change-email token cases, no Gmail/mailbox tenant assertions; inherited M02/M03 anchors therefore contribute zero mail behavioral cases here. They are relevant E02/E06 identity evidence. `AuthAndSystemControllerTests` contains no AdminAudit/Undo assertions; its 38 passing cases are excluded from A02, while AdminSystem/auth evidence remains valid. A02’s frontend error/retry/localization and API authorization reflection assertions do not prove successful undo/job restore. Both are documentary coverage discrepancies, not evidence of an application security failure.

## Reconciliation

Exact census: **57 unique rows = E9 + J10 + W12 + C12 + M6 + S5 + A3**. Before: **56 PARTIAL, 1 DEFERRED (C11)**. After: **53 PARTIAL, 3 FAIL (E02/J02/S03), 1 DEFERRED (C11)**. Whole-group statuses are deliberately conservative: no full group is promoted solely from a representative test, source review, route header or axe scan. A PARTIAL row states which finite behavior passes and what remains NOT VERIFIED/BLOCKED; absence of human/provider evidence is not a functional FAIL.

| Status | P5-15-00 before | P5-15-01 verified after |
|---|---:|---:|
| PASS | 0 | 0 |
| PARTIAL | 56 | 53 |
| FAIL | 0 | 3 |
| DEFERRED | 1 | 1 |
| BLOCKED | 0 | 0 |
| NOT VERIFIED | 0 | 0 |
| **Total** | **57** | **57** |

Zero whole-group BLOCKED/NOT VERIFIED does not erase blocked or unverified sub-workflows: every PARTIAL group has fresh representative executable evidence, with its remaining gaps listed. This matrix cannot declare exhaustive behavioral acceptance. Confirmed failures are one P1 saved-search availability defect and two P2 recoverable context/draft failures; E07 also references AUTH-01 but is not double-counted as a second defect.

Original full Phase 5 acceptance remains unavailable with C11/P5-13 and mandatory human/device/provider obligations outstanding. Production remains **NO-GO**; no production, provider, model, destructive account/DB or deployment operation occurred in this matrix task.