P7-07 — Documents owner-scoped index

Backend implemented scope: CONDITIONAL GO; final hygiene and normal push pending. Documents UI has not started. Follow the exact Phase 6 handoff and Documents architecture. Implement and push the metadata projection before the interface.

The preceding compose commit 223dcf57d26bab624261994b61a46f2d3e2dd5b2 was normally pushed and directly verified at 2026-10-14 11:03:15.576853 UTC: clean HEAD = origin = live development; local/origin/live main remains 27657f31131cd95d42f0e1290853ec9c9b3959a4. Entry evidence records the receipt and fresh existing-contract baseline: 37 passing cases, unchanged Release DLL, with all20 captured sources unchanged before/after. This is an existing-contract subset, not a Documents endpoint or full-suite execution.

Bounded contract

Authenticated GET /api/documents indexes existing CV variants, cover letters/history, application-answer/recruiter drafts, tailored CV drafts, attachments, frozen submitted packages and saved email drafts. It returns metadata, recorded source identifiers and existing destinations. It does not return bodies, notes, settings/profile JSON, rendered HTML, storage paths, bytes, recipient addresses, thread IDs or sending UUIDs.

Use validated pagination, literal metadata search, supported type/state/public-visibility/job filters and whitelisted name/date sorts. Count and page must execute in the database with bounded results. Every source, parent and company join must enforce the authenticated owner. Preserve independent/detached CVs and existing owned resources attached to soft-deleted jobs; expose the deleted-parent flag honestly.

Current CV/attachment, unsent draft material and frozen package are different states. CV public/private is independent of submission. A cover-letter history entry survives clearing current text and records whether current content exists. Submitted metadata uses captured CV identifiers/name/version and attachment counts; it cannot resolve these from mutable current sources. Uploading a certificate does not verify a qualification. A draft does not prove delivery; a captured package does not prove employer receipt.

Date sorting compares genuinely recorded UTC instants, including exact offset/fractional ordering. Legacy attachment UploadDate uses DateTime.Now without recording its timezone. Preserve its recorded local date for display and classify it uploaded-local; its UTC sort key is unavailable. Local/unknown dates remain after comparable dates in both ascending and descending order, with stable type/resource identity ties. Do not label this mixed index “last updated” or infer a timezone. Name sorting is unaffected. This policy requires explicit UI explanation and regression coverage.

Validation and preservation

New ordinary HTTP regressions must fail against the missing endpoint before implementation, then pass with native SQLite. Cover every source, A/B/anonymous isolation, search/filter/count/pagination, literal wildcard characters, stable ties, offset/fractional dates, unknown-date placement, malformed relationships and source-history preservation. Inspect commands for count/order/limit/offset and absence of resource-body projection or writes. Listing must never render PDF, invoke AI, capture a package or access file storage.

Keep ordinary P2-D01 and exact frozen HTML/letter/archive-byte proof. The old Phase3 P2-D01 blocker is historical: the latest ordinary browser case passes in P7-06. Source actions retain existing ownership, CV association/detach rules, revision semantics and safe downloads. Native SQLite and MariaDB SQL composition are separate evidence; unexecuted MariaDB behavior cannot become production acceptance.

All57 preservation groups remain56 PARTIAL / C11 DEFERRED, with32 original routes preserved. Derived inventory is739/94 frontend,301 browser,1041 backend; it is not a fresh integrated pass count. Human reader, physical touch/software keyboard, zoom, provider/output and release conditions remain open. P5-13 is withheld; P7-06F is deferred; main unchanged, production NO-GO. No Phase8 implementation.

Next: finish the backend contract and its bounded evidence, commit/push/verify it, then migrate the Documents interface using the existing shared design system.

Final backend observation

Contract report and portable results record final12/12 new contracts,80/80 related/auth/draft cases and actualProgram/nativeSQLite cookie3/3 plus ordinaryP2-D01PASS. Full .NET whitespace semantics, ordinal Unicode marker handling, actual bound pagination parameters, frozen metadata/bytes and strict tenant cases retain ordinary assertions. All failed attempts and source/timing qualifications remain. Final26/33/23 sources and binaries match; Release compilation and browser types pass. There is no DocumentsUI/axe/physical/human acceptance yet, and actualMariaDB execution remains unverified. Derivedbackend1053/browser304/frontend739/94 are not integrated passing counts. Hygiene and normal development push follow; the UI starts only after verified contract push.

Final metadata-contract hygiene PASS observed 2026-10-14T16:00:00.842457+00:00: secret and working/staged/phase whitespace gates pass;18 docs/504 local links resolve,57 groups and32 original routes retained. Backend contract implemented CONDITIONAL GO; normal development push pending. Actual MariaDB execution and Documents UI remain unverified; main unchanged, production NO-GO.