jobtrackingapp/docs/redesign/audit/RISKS_AND_MIGRATION.md

# Risks and proposed migration approach

This report proposes the next steps; it does not authorize or implement Phase 2, B07 or a backend overhaul. Original security findings keep their IDs and queue ownership. [Validated implementation queue](../../audits/2026-09-07/validation/implementation-queue.md) remains the source for those fixes.

## Prioritized regression risks

| Risk | Source evidence | Smallest appropriate response / gate |
|---|---|---|
| Lost identity boundary during a new shell/cache/client | `App`, `api`, `sessionBoundary`; B02 server session preconditions | Keep private provider unmount, immutable provenance, abort/late-response checks and real A→B tests. Session headers never become rate-limit owner identity |
| Editor redesign hides existing lost-update behavior | CV save payload lacks expected revision; page-local save queue is not cross-editor concurrency | Coordinate existing D01/D02 integrity tickets before changing save/conflict UX. Do not call history/undo optimistic concurrency or add a generic concurrency framework |
| Creation replay becomes easier through capture/dialog rerenders | Preview/duplicate warning and subsequent create are separate requests | Preserve current review flow; existing D04 creation-intent ticket is distinct from identity and record revision. No idempotency work in this audit |
| Route consolidation loses entry contracts | Two router layers, legacy `/applications/:id`, old section mappings, `?add`, notification/company deep links | Route manifest + redirect tests before moving navigation; keep capture and OAuth callbacks functional |
| New styling repeats existing contrast/focus defects | Validated F14 theme pair contrast; builder preview scroll-region transition | A01 semantic foreground/background/state colors, A02 preview structure, A03 loaded/manual verification before broad page work |
| Thin initial-state tests create false confidence | Eight-route axe sample; component API mocks; historical TS2571 now corrected during release repair | Phase 2 loaded-interaction and explicit standalone type gate; require feature-ledger evidence per migrated workflow |
| CV/profile semantics blur in a unified editor | Canonical profile save versus CV override/settings and published slug | Clearly display source versus document override; test master unchanged, source selection, history, publish/unpublish and long PDF |
| AI presentation implies facts or silently applies changes | Contextual suggestions and extraction accept/discard already exist | Preserve preview/reject/apply and source/context metadata; prompt instructions alone do not prove factual accuracy |
| Draft/history/mail/package behavior lost in visual simplification | `ApplicationAssets` 769 lines, inbox 750, correspondence 747; separate persistence/attempt APIs | Extract by cohesive responsibility, not one generic form; keep conflict/send uncertainty, frozen package and unsaved guards |
| Broad navigation has competing labels/destinations | Eleven main nav entries plus account/admin; profile vs career; table/board separate; embedded operations/review | Design grouped IA with an explicit preservation/redirect map; improve discoverability without deleting capabilities |
| Styling consistency remains expensive | Central theme plus hardcoded shell navy/indigo, page-local shadows and large `sx` compositions | Retain MUI; establish tokens and a few layout/field/state primitives, then validate representative surfaces |
| Large editor/page modules couple visual and persistence work | Editor 1,131 lines; career 879; job table 866 | One cohesive extraction at a time, bracketed by real workflow tests; file length alone is not a rewrite justification |
| Dashboard customization mistaken for an existing server contract | Only five visibility booleans in owner-local storage | Keep current prefs until Phase 8; separately decide device-only vs cross-device contract before persistence/schema work |
| International/mobile regressions | Mixed 768/900/MUI breakpoints; hardcoded English mobile accessible name; EN-only axe | Preserve current mobile adaptations; long Bokmål labels and locale/date semantics in the representative matrix |
| App route identity churn | Router memo depends on job display preferences in `App` | Potential state-reset risk, not reproduced here; test changing preferences during meaningful workflow before refactoring router ownership |
| Unstable release proof or assumed production ingress | New CI prerequisite/build failures; Docker unavailable; F04 open; HTTP redirect observed to unreachable port 444 | No stable/live claim from push alone. Keep required gates and complete operator evidence; no trust-all fallback or invented proxy CIDR |

Line counts come from the [source census](source-inventory.json); they are prioritization context, not measured performance. No new authorization bypass is alleged by this redesign audit.

## Recommended order

1. **Finish the authorized release attempt and retain the checkpoint.** Required CI and deploy preflight must pass before calling the changes live. Production F04 runtime/firewall/DNS/peer checks remain a separate closure gate. Audit/planning can continue without claiming Phase 0 stability.
2. **Phase 2 — Functional baseline.** Add explicit standalone CI type checking (the TS2571 assertion was corrected separately in release repair `a861ca4`); trace preservation IDs to existing tests; add missing loaded workflow/route/AI-review tests. Preserve B01–B06 regression suites. Coordinate outstanding record-integrity and recovery tickets through their existing queue, without silently starting them here.
3. **Phase 3 — UX architecture.** Define grouped navigation, Jobs view switch, destination for embedded Documents/Analytics/Notifications, full-page/preview contract, contextual AI pattern and mobile workflow rules. Map every current route/feature to its destination and backward-compatible entry. Keep API contracts.
4. **Phase 4 — Shared foundations.** Use existing MUI/Emotion/theme system. Resolve proven semantic contrast and focus defects, then unify tokens, page/layout/state primitives, labelled fields, buttons, dialogs/drawers and tables. Avoid a speculative new design-system framework.
5. **Phase 5 — Representative migration.** Shell → Jobs table/board entry → full job workspace → CV editor; dashboard presentation can join after shell tokens stabilize. Preserve a data-rich populated example, empty/error/locked case, mobile and keyboard path for each. Do not modify editor save semantics concurrently with integrity work.
6. **Phase 6 — Review checkpoint.** Inspect EN/NB × light/dark × desktop/mobile, loaded accessibility, long data, CSV/PDF downloads, identity switching and history. Correct shared defects before repeating the design.
7. **Phase 7 — Remaining routes and nested functions.** Auth/account, career/import/evidence, CV library/public CV, correspondence, reminders/operations, settings and admin; update every preservation row with evidence.
8. **Phase 8 — Dashboard customization.** Add ordering/reset/resizing only with defined layout and persistence semantics. Coordinate any needed migration with restore/rollback readiness. Keep aggregate admin reporting separate.
9. **Phase 9 — Cross-product QA and release evidence.** Full regression, manual access/mobile, document pagination and provider/production checks. Feature parity, not only appearance, determines readiness.
10. **Phase 10 — Cleanup.** Delete legacy modules only after route/import checks and preservation-ledger completion. Do not use static unreachability alone as approval.

No router/state/styling dependency replacement is currently recommended. If a later prototype demonstrates a concrete limitation, compare the smallest alternative against MUI reuse and measure migration/keyboard/theme cost before choosing it.

## Session-sized next scopes and coordination

| Suggested future scope | Boundaries / expected proof | Parallel constraints |
|---|---|---|
| Type and baseline bookkeeping | Preserve the corrected test assertion; explicit type script/CI gate, known-failure classification | Independent of visual work; coordinate CI edits with deployment repair |
| Route/preservation regression | Existing route helpers, full/overlay/capture navigation tests | Do not change router structure at the same time |
| Theme semantic contract | Central theme/MUI states + representative loaded contrast fixtures | Separate from backend; integrate before page styling |
| Builder focus contract | Actual preview container, viewport transition and keyboard scroll tests | Must not run concurrently with D01/editor save refactor |
| Shell/navigation proposal | Documentation/interactive prototype and route map only until Phase 3 approved | Can be prepared while tests run; no new production routing yet |
| First screen migration | One agreed shell or Jobs surface with existing handlers/contracts retained | Use settled tokens; no simultaneous edits of its route/state owner |

These are future implementation boundaries, not work started by Phase 1. Mail delivery, billing, schema, restore and infrastructure changes remain outside redesign sessions unless explicitly authorized and independently gated.

## Decisions required from Connor

No answer is required to complete this audit. Ask only when the dependent phase starts:

- **Brand/name/accent:** the brief intentionally leaves them unsettled. Keep current naming and theme until Phase 3/4 chooses them; do not block baseline tests on branding.
- **Dashboard persistence:** whether layout should follow the account across devices materially changes Phase 8's persistence scope. Existing implementation is device-local and owner-keyed.
- **Private local draft recovery:** preserve in-memory drafts and existing server drafts now. New persistent device-local career/CV content needs the privacy/retention choice already recorded under W05.
- **Product additions/deprecations:** new goals/general assistant/providers or removing an existing preservation row need explicit product scope. Navigation relocation alone need not become a series of permission questions.

The repository already answers the current framework, default language, existing calendar support, account/profile distinction and owned-resource semantics. Do not ask Connor to supply those facts.

## Stop conditions

- No large visual migration until loaded regression baseline and shared UI contracts are defined. No stable release label while required CI is red or deployment state unknown.
- No editor persistence redesign before resolving its record conflict contract; B02 must remain green throughout. No schema change before recovery/rollback prerequisites.
- No implicit feature deletion, master-profile mutation from CV overrides, silent AI application, unknown email resend, or private cache reuse across identities.
- No public accessibility claim without manual primary-flow evidence. No F04 closure without actual deployed/runtime evidence; direct-port failure from one workstation is insufficient.
- Stop at Phase 1's audit deliverables in this session. Phase 2 and B07 have not begun.