jobtrackingapp/docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md

# Phase 9 acceptance — 23 October 2026

**P9-00–07 assessment completed. All required automated gates passed on the final rebuilt source; application acceptance remains NO-GO for the unresolved qualifications below.**

The assessment recommends **Phase 9 NO-GO, Phase 10 readiness NO-GO and production NO-GO**. The critical distinction is between completing the QA assessment and proving the application safe: two independently authenticated local clients reproduced acknowledged-edit loss in canonical Career and generic job saves (RD21). Passing CV/Dashboard revision tests do not protect those other domains. A passing RD21 characterization records unsafe behavior; it is not a safety pass.

| Independent decision | Reason / required closure |
|---|---|
| Phase 9 QA: **NO-GO** | High RD21 data loss remains unresolved. Human accessibility, intended-provider and output qualifications remain open. Scoped fixes and finite automated passes do not clear them. |
| Phase 10 readiness: **NO-GO** | Broad cleanup/deletion lacks complete preservation and migration proof. Retain all 33 routes, all 57 capabilities, compatibility aliases and canonical/CV/frozen boundaries. [Handoff](PHASE10_HANDOFF.md) lists possible separately scoped candidates, not permission to implement them. |
| Production release: **NO-GO** | RD21 plus unrechecked storage errors, backup/restore/rollback, ingress/deployed identity, MariaDB, human accessibility, live advisories and model/provider qualifications. No production operation was performed. |

## Checkpoint dispositions

| Checkpoint | Completed evidence / qualification |
|---|---|
| P9-00 inventory |33 actual routes, 57 preservation groups, 43 API controller/partial owners, actual roles/entitlements and page/shared/service/database/document/test ownership. [Entry inventory](../p9-00/INVENTORY.md) and source manifest distinguish candidate coverage from executed results. |
| P9-01 connected journeys | [Functional report](../p9-01/README.md), all 362 executed ordinary cases and final [QA matrix](../QA_MATRIX.md). Persisted local journeys and controlled failures remain distinguishable; intended-provider journeys remain unqualified. |
| P9-02 responsive/visual |396 route/theme/locale/width captures. AI reviewer inspected all 33 contact sheets, nine selected final full-page originals and native-width CTA crops from all 12 latest homepage originals. P9-V01/P9-V02 heading overlaps repaired. [Exact scope](../p9-02/README.md); no human/device/readability substitution. |
| P9-03 accessibility/localisation |64 inherited incompletes deduplicated into four groups, with originals retained. Final 16 settled scans: 0 violations/120 incomplete occurrences. 2,871 keys per language, no parity/placeholder gaps. Admin vendor locale repaired; human checks remain. [Results/checklist](../p9-03/README.md). |
| P9-04 integrity/provider/security | Local backend/isolation/security evidence passes in its scope; **RD21 stale-write safety FAIL**, MariaDB runtime **NOT TESTED**. Docker Linux engine remained unavailable on 23 October; no service installation/restart was attempted. [Data/security report](../p9-04/README.md). |
| P9-05 documents/edge/performance | Native 16-fixture/36-page plus Settings 8-fixture/24-page corpora pass the original oracle; all 60 thumbnails and selected full-size comparisons inspected. Three API volume cases and a 63.332 s finite workload completed. [Report](../p9-05/README.md). Human/Linux/print/capacity qualifications remain. |
| P9-06 remediation/regression | Three product defects in two existing UI owners and three fixture repairs qualified with original failures retained. Complete ordinary, diagnostic and separate-contract successors pass; interrupted/superseded attempts excluded. [Defects](../p9-06/DEFECTS.md). |
| P9-07 acceptance/handoff | This report, [risk register](../RISKS.md), [preservation](../PRESERVATION.md), cleanup eligibility and publication ledger. Recommendations do not activate Phase 10, C11/P5-13 or production. |

## Actual verification

| Lane | Completed result / scope |
|---|---|
| Backend Release | **1,084 passed**, 0 failed/skipped. Unchanged backend source/assembly; isolated SQLite/test-host evidence. |
| Frontend Jest | **919 passed /104 suites**, 0 failed/pending; completed exit 0 on final UI source. |
| Ordinary browser | **362 passed** across four serial native shards: 98 + 87 + 88 + 89. Exact discovery membership, one actual passed result each, four exit 0 records; zero run-level errors, failures, skips, flakiness or retries. |
| Separate browser contracts | **23 passed**: AI withholding 2, auth recovery 2, rate limits 9, ingress 6, PDF admission 1, preferences 3. Six exit 0 records; every actual case passed once with zero errors/retries/skips/flakiness. |
| Sidecar | **56 passed**, 0 failed/skipped, `SKIP_MODEL_LOAD=1`; no inference semantics claim. |
| Phase 9 diagnostics | **18 passed**, zero failed/skipped/flaky/retries, exit 0 under the corrected provider-worker fixture: 12 route cases cover 396 vectors, four accessibility cases cover 16 scans, one unsafe-write characterization and one sustained workload. |
| Volume supplement | **3 passed**, zero failed/skipped/flaky/retries, exit 0. 100 CV revisions +restore 101, 100 long timeline messages, 100 notifications with native membership/count/ownership assertions. No large-history browser usability claim. |
| Types/lint/build |PASS; final production static export and extended diagnostic TypeScript checking. No deployment. |
| Offline security helpers |PASS: supply-chain 3, Ollama-evaluation 5, browser-runtime 6, ingress 3, dependency-policy/SMTP 15, extension URL 3, tracked-secret scan; SBOM generated. No live advisory refresh or blanket security certification. |
| Native fidelity oracle |16/16 +8/8 fixtures;36 +24 pages, unchanged exact membership/page count and original dimension/position/font/colour tolerances. Reverified successfully against the final shard-produced bytes after the document producers completed. |

[Machine-readable validation](../validation.json) retains process timestamps/exits, source/report hashes, exact cases, failed/superseded attempts and raw provenance. The final UI runs use the updated 825-input manifest. The [Admin locator delta](../p9-00/admin-fixture-delta.json), [worker-isolation delta](../p9-00/worker-isolation-delta.json) and [CTA/export delta](../p9-00/cta-delta.json) retain the exact changes and manifest hashes. Only the last changes product/export bytes; backend and sidecar remain unchanged. Full Jest and all four ordinary shards, diagnostics and separate contracts qualify the rebuilt UI, retaining provider-worker isolation. Volume sources are hashed separately. Discovery is list-only: its not-run statuses do not enter regression skip counts.

New regression proof comprises two parameterized Admin locale Jest cases (917 to 919 tests), two ordinary landing cases with extended CTA coverage (360 to 362 cases), 18 separate diagnostics and three API volume cases. Vector/item counts are observations inside those cases, not extra test totals.

The switch to four serial native shards preserves connected files and assertions while keeping completed reports across interruptions. No partial log is accepted as a full run; no retry/skip was configured to hide a failure. Original early harness mistakes, transition traces and interrupted attempts remain in the defect/provenance record. `evidence.py` requires unique IDs and exact discovery membership; `reconcile.py` additionally rejects failed/missing lanes/processes before generating final ledgers.

## Fixes, open defects and release limits

- **P9-V01, Medium, resolved locally:** four public h2 owners inherited fixed body line height. Existing style now specifies1.4; native geometry fails before and passes after over 16 language/theme/width vectors. Independent image review confirms line separation.
- **P9-L01, Low, resolved locally:** AdminUsers omitted the installed MUI nbNO vendor locale. Two new parameterized Jest cases and visible native pagination proof retain English defaults and Bokmål controls.
- **P9-V02, Medium, resolved locally and in full regression:** the separate bottom CTA title also inherited fixed body line height. Its existing owner now specifies 1.4. The two retained native tests require the exact translated CTA alongside all four h2s; both languages fail before and pass after. Original-width inspection of all four 320px green images confirms separation and contained body/button/footer.
- **P9-T01, Medium test reliability, resolved in tested Windows environment:** the descendant timeout fixture could expire before creating its PID. Synchronize fixture startup, then retain the original 200 ms timeout, actual process-tree kill and 504 assertions. No parser product change.
- **P9-T02, Low test compatibility, resolved in integration:** the native Admin fixture expected an English pager in Bokmål. It now uses installed vendor locale names with the original pagination/visibility/focus/no-write assertions. The first shard's 97 pass/1 fail and focused 1/1 green are retained; the complete first-shard successor passed 98/98 with exit 0.
- **RD21, High, OPEN / safety FAIL:** stale Career PUT200 restores old summary; stale generic job PUT204 restores old title. [Exact observations and separate contract issue](../p9-04/RD21_CONCURRENCY_ISSUE.md). Closure requires atomic server comparison, all callers, recoverable conflicts, compatibility and SQLite/MariaDB proof; creation idempotency and later-Identity partial commits remain separate. No client-only workaround or architectural expansion was added in QA.
- **P9-T03, High test isolation, resolved in the corrected fixture:** the existing browser API fixture left the server's saved-search provider worker enabled. Shard 3's 87 pass/1 fail exposed an actual worker-written timestamp during a UI-only preservation check. Browser interception could not constrain server-originated NAV traffic. The fixture now disables that worker; all four ordinary shards and inherited diagnostics passed again with every assertion retained. Earlier reports remain superseded. Production worker settings are unchanged; earlier traffic is not live-provider acceptance.
- **P9-PERF-01, Low, retained:** initial shell/Dashboard duplicate reminder GET. Candidate only for separately measured shared-owner work with independent failure/loading/account-disposal proof.
- **P9-L02, Low, retained:** raw stored `Created` event type remains in Bokmål job/audit metadata. Dictionary parity does not translate authored/provider/technical data. Known enum presentation needs a bounded follow-up and human terminology review.

Accessibility classification retains53 painted-background contrast cases and the original Analytics drawer cause as human qualifications. Ten inherited zero-badge occurrences are not applicable in the verified hidden/zero-area state. Fresh open-modal background incompletes are separately qualified tool/state observations. Actual NVDA/VoiceOver, reader announcements, physical touch/drag/software keyboard, forced colours, human zoom/reflow and professional Bokmål acceptance remain [M09-01–10](../p9-03/MANUAL_CHECKLIST.md). Native zoom and emulated input observations do not close human rows.

SQLite startup/migrations, WAL/held-reader behavior, owner/revision guards, uploads/document ownership, auth/session/CSRF/admin protections and URL/transport boundaries have bounded local evidence. MariaDB SQL generation does not qualify MariaDB runtime. External OAuth/Turnstile/mail/calendar/model behavior, enabled-worker recovery and policy-level retention/deletion remain separate. No live secrets, databases, Docker services or production configuration were changed.

The final workload used 250 applications, eight Career roles/48 distinct long bullets, two paced readers, 240 successful GETs and 20 native navigations over **63.332 s**. API p50/p95/max were **12/42/48 ms**. Native ready ranges: Dashboard 942–977 ms, Table 981–1035 ms, Board 951–966 ms, long CV 1492–1549 ms. Windows 16 logical CPUs/~34.1 GB RAM, Chromium 151.0.7922.34, isolated SQLite, static export. CDP task/CPU/heap/DOM observations are retained. Jest had finished before this final run; the shared host and automation overhead still limit comparisons. No SLA, capacity, long-term leak diagnosis, backend resource attribution or inference throughput is established.

## Preservation, Git and next action

All 33 routes and all 57 functionality groups remain. **56 PARTIAL / PRES-C11 DEFERRED; zero upgrades to PASS.** Later Phase 7 residual obligations supersede obsolete Phase 2 gap descriptions without rewriting history: P2-D01/frozen archive and CV revision repairs remain ordinary passing contracts, not newly reopened defects. Canonical stale saves are a different RD21 boundary. C11/P5-13 remains withheld; no model/integration was activated.

Branch: **`feature/phase9-full-qa`**, based on accepted Phase 8 **`1c24e406f194f0f42277d837b3008a7a28dca26a`**. Published repair checkpoint **`0fb108bd673ea91749f6fa057295e5b6d15d557f`** has direct remote equality. Temporary HTTP502 errors recovered; remote main remained **`5f835e54a9b74e6b71418422e28431b2af06453f`**. [Publication ledger](PUBLICATION.md) retains chronology. The delivery message supplies the final reporting commit SHA and its direct remote comparison, avoiding a self-referential commit hash here. No main merge or production deployment occurred.

Next required product work is the separately scoped RD21 contract repair, followed by intended-provider and human qualifications. Phase 10 receives a candidate/eligibility list only; no alias/schema/feature deletion is approved. Production operators retain independent storage, backup/restore/rollback, ingress, dependency and deployed-identity gates. This assessment neither repairs nor accepts production.