jobtrackingapp/docs/redesign/phase-9/rd21-remediation/reviews/final-re-review.md

RD21 scoped final re-review

Scope: one re-review of 05a7386..1b89a77, using the supplied exact diff, final-review.md, final-fix-report.md, connected workspace/draft source, and focused execution log summaries. No new full-branch audit or test execution was performed.

Finding verdicts

1. Committed revision header hidden by CORS: ADDRESSED. JobTrackerApi/Program.cs:151 explicitly exposes X-Job-Version through the existing allowlisted, credentialed policy. The client still rejects missing/invalid committed revisions. The new browser test reads the header using actual page JavaScript and performs two consecutive native Answers saves with direct SQLite assertions, covering the original browser-specific failure rather than only APIRequestContext headers.

2. Answers initialized from stale sibling-write snapshot: ADDRESSED. job-tracker-ui/src/views/ApplicationWorkspacePage.tsx:81-83,142-146,157-165,277 gives each Answers entry a new identity and mounts its editor only after a matching successful overview read. Text fields and revision are accepted together. Request invalidation excludes late prior-entry/job results. Failed initial reads stay closed until retry succeeds. Leaving Answers avoids a redundant read when a workspace snapshot has already been accepted; leaving an unfinished direct-entry read still obtains the header. Existing post-save refresh retains the editor identity, and the unchanged ApplicationAssets.tsx:858-862 dirty-draft guard keeps a draft paired with its original revision when parent props refresh.

New material breakage

None identified in this fix diff. No additional fixes requested by this scoped re-review.

Evidence and assessment

Read log summaries confirm focused Jest 55 passed across 2 suites and focused browser 2 passed. The added tests cover delayed prior-entry responses, failed read/retry, leaving an unfinished initial entry, cross-origin header access, consecutive native saves, and cover-letter-to-Answers persistence. These are inspected execution artifacts, not independently rerun tests; the focused results overlap broader suites and must not be added to their totals. API/UI build and lint passes are reported in final-fix-report.md; this review did not independently execute them.

Both code-review findings are closed at 1b89a77. Broader backend/frontend/browser qualification remains coordinator-owned. Required MariaDB runtime qualification remains unavailable: formal RD21 closure remains UNRESOLVED under the unchanged acceptance criteria, even where SQLite implementation evidence passes. This is not Phase 9, Phase 10, production or merge authorization.

No additional behaviors were set aside as new scope judgments in this fix-only review. The prior review's separately identified bounds remain in force. No product, test, database, Git-state, build, browser or external-network operations were performed; only this requested review report was written.