jobtrackingapp/docs/redesign/phase-5/p5-15/READINESS_DEBT.md

P5-15 — readiness debt and operator exit proof

Current final scoped acceptance successor

The owner's latest instruction authorises continuous bounded repairs and independent acceptance work through Phase 6 preparation; earlier checkpoint stop instructions remain historical. Native file selection, hidden preview layout, drawer focus, source navigation and report targets are separately repaired, validated and pushed. Their original 02 failures are retained, not relabeled as passes. CV/document qualification is conditional for its measured local scope. Final native/automated regression passes:1,033backend/498frontend/148browser/3diagnostics, unchanged revision/fidelity/security gates. Implemented scope is CONDITIONAL GO for Phase6 planning; original full scope is NOT COMPLETE and production remains NO-GO.

Fresh312axe scans contain39all-enabled violation-node occurrences and2,367incomplete occurrences; contextual semantic/contrast/name triage and human acceptance stay open. Twelve concurrent preference rounds did not reproduce the historical500s; their cause and suppressed language-save error path are not declared repaired. Native Board200/1,000 exact membership and finite local timings do not close O(N) capacity/native-touch qualification. Successor dispositions and the intermittent register preserve those obligations.

The 57-group matrix now records 0 PASS / 56 PARTIAL / 0 FAIL / 1 DEFERRED =57. Whole-group acceptance remains incomplete. Postponed human screen-reader acceptance is NOT COMPLETE / NOT VERIFIED; physical devices/software keyboards, incomplete axe triage and deployed font/portrait qualification remain open. P5-13 remains deferred/unqualified/Production-withheld, 0/366 calls, no human semantic review or review UI. P5-05 and followMode reviewed compose remain explicitly deferred.

Production assessment: NO-GO, main unchanged. F04, current complete backup/isolated restore, deployed configuration/schema/secrets, rollback and smoke/monitoring evidence are still required. Phase 6 planning does not waive them or declare the original full Phase 5 scope complete.

Planning-only P5-15-00, 2026-10-09; source 46a0c0c6d23464869f50c0d88552963c29cfdacf, codex/ui-redesign-phase4. Production: NO-GO. Full Phase 5: CONDITIONAL / PARTIAL. Prepared procedures are not executed or verified evidence. No application change, test execution, infrastructure/provider call, Docker recovery, migration, production action, commit or push occurred here. The Part A decision records actual production branch main and automatic deployment on a successful main push; no unconditional GO, merge/push/deploy approval follows from this plan.

Reconciled against OPEN_BLOCKERS, P4-06, known issues, TODO, root blockers, release readiness, Part A, P5-14, semantic qualification, and current operational sources below. Historical records keep their original outcomes; successor evidence closes only its demonstrated scope. The broad known-issues F01 statement predates local CV revision repair; profile/job revision debt remains, while CV's scoped guard is passing locally.

P5-15-02 current acceptance delta

Screen-reader scheduling update —2026-10-10: owner requested completing the operator session later. RD06 remains NOT COMPLETE / NOT VERIFIED; operator availability is recorded, but no actual spoken results exist. The manual packet retains the required workflows and evidence. This is a scheduling deferral, not acceptance, a waiver or a new approved feature exclusion. Existing release/full-scope blockers remain in effect.

The 02 native audit and findings supersede inherited accessibility counts/status only for measured scopes. Confirmed A11Y-01 P1 keyboard upload/import failure is A+B, owned by attachments/import UI and accessibility, requiring its own native-keyboard repair/round-trip before release or progression. Reduced-motion drawer return/source404/report target sizing are also open acceptance defects. New A11Y-11 P1 initial mobile visible-page zero-width/collapsed content is also A+B, CV/rendering owner, requiring independent P5-15-04-CV-01; native PDF remains authoritative and this fixture page count matches. No broad remediation is hidden in this audit. Mandatory independent human reader and physical-device/software-keyboard acceptance remain unperformed; operator availability alone does not close RD06/07. Actual Chromium zoom adds bounded measurements, not all-action/all-browser acceptance. All production/provider/recovery blockers and P5-13 deferral remain unchanged.

Classification

Class	Meaning
A — production-release blocker	Critical actual-runtime/recovery/security/deployment acceptance is missing, or a conditional feature would be unsafe to release enabled. A main push can auto-deploy, so do not push/merge main while its critical gates are unresolved.
B — full Phase 5 scope blocker	Mandatory planned capability or affected-screen human/accessibility/preservation acceptance is incomplete. Independent approved local slices can continue; full Phase 5 is not accepted.
C — approved deferred scope	Explicit decision permits omission for the bounded checkpoint. Deferral is neither implementation nor verification and can coexist with B (or A if the unavailable workflow is exposed in production).
D — non-blocking conditional risk	Separately owned limitation does not block the unchanged, bounded local presentation checkpoint. It becomes a gate when its trigger applies; it is not proof that the defective workflow is accepted. Known failures are never closed by unrelated passing suites.

Owners below are responsible roles, not invented assignees. Each next checkpoint is a work boundary, not automatic permission to operate. Resolve a row with linked reproduction/change/exit evidence and a dated owner decision; do not erase the original failed trace. Multiple classes are deliberate.

Debt register

ID / current status and exact scope	Class	Owner / next checkpoint	Exit proof
RD01 F04/B06 actual production ingress — OPEN. Real Traefik socket peer, generated nginx trust, effective API client identity, listeners/networks/NAT/firewall/IPv6/TLS/restart are unobserved. Historical HTTP redirect reached an unreachable :444; public HTTPS/connection failures do not close it.	A	Deployment/security operator; authorized G-RELEASE ingress assessment before any main release	Current SHA/images/topology, trusted vs untrusted socket-source evidence, external A/AAAA direct/spoofed denial, canonical reachable redirect/TLS, real-chain A/B limiter/session tests and isolated invalid-config/restart proof. Shared NAT source for both paths is a stop condition.
RD02 current complete backup/restore — UNVERIFIED. Fresh DB plus uploaded/CV data, required exports, Data Protection keys and separately protected tombstones are not demonstrated. Historical seeded MariaDB restore/old gzip-valid DB-only dump is insufficient.	A	Backup/data operator; pre-release recovery rehearsal	Timestamp/hash/manifest/custody/retention/off-host evidence for a current complete set; isolated restore with row/content/non-ASCII/attachment/package/PDF comparisons, application boot, protected-data decryption and tombstone replay. Existence/format checks alone are not a restore.
RD03 current configuration/provider/schema/startup — UNVERIFIED; F19 OPEN. Program.cs defaults missing provider to SQLite and changes missing connection to SQLite. Candidate adds no DDL migration, but startup still migrates/reconciles; actual provider/schema/counts are unknown.	A; D for unrelated local UI	Deployment/database owner; pre-release runtime/schema inspection	Verify non-secret effective provider/origin/auth/ingress/gates, secret presence/custody privately, schema and __EFMigrationsHistory, before/after counts on restored current data. Missing server connection must not be accepted as an empty fallback database. Repair F19 only in separately scoped backend work if necessary.
RD04 rollback/failure recovery — UNVERIFIED. Commit-tagged core images/automatic rollback code exist; real failure-injection rehearsal and complete prior images/config are not proved. Database restore loses newer writes.	A	Release operator; disposable Linux topology rehearsal before release	Deliberate post-replacement failure returns nonzero/failed CI, restores previous core images, retains DB/files/keys/tombstones and existing counts/login, then passes smoke. Rehearse schema/data rollback only if needed, on isolated restore; never blindly restore production DB.
RD05 protected CI/deployed SHA/authenticated acceptance — UNVERIFIED. Part A recorded main at 27657f31131cd95d42f0e1290853ec9c9b3959a4; that is a repository observation, not current deployed identity. Remote branch protection/runner and candidate deployment have no acceptance evidence.	A	Release/CI owner; after RD01–04 permit release	Complete candidate protected test/browser results; approved history-preserving main release without force; actual deployment outcome, matching SHA/version, health/readiness/public auth, existing-account/owner/data/Career/workspace/CV/PDF/attachment smoke and rollback decision. A feature-branch push or public health 200 is insufficient.
RD06 human accessibility / incomplete axe — OPEN. Actual P5-14 JSON: 242 scans, 0 reported violations, 1,839 repeated incomplete target occurrences: contrast 1,574; hidden-focus 34; prohibited-attribute 209; valid-value 18; table-header 4. Counts are not distinct issues or passes. P5-02-D01 spoken names/live-state remains mandatory.	B; A where an unresolved serious failure prevents safe release acceptance	Accessibility/UI owners + human reviewer; P5-15 authorized manual checkpoint	Execute M01–M12, including real NVDA/Narrator and M12 physical-device/mobile-AT evidence, full affected matrix and contextual rule dispositions; retain exact names/reading order/live/errors/focus evidence. M13 remains blocked by deferred P5-13. Do not suppress rules, remove modal isolation or count AX-tree inspection as spoken acceptance.
RD07 physical touch/software keyboard/mobile AT/zoom/forced-colors/text spacing — NOT VERIFIED. P5-14 emulated taps/keyboard/geometry qualify only demonstrated cases. 320px CV fit is an overview.	B	UI/accessibility + device reviewer; P5-15 device/reflow checkpoint	Actual phone/tablet and mobile reader, keyboard/rotation/selection/drag/cancel/alternative results; browser 200%/400%, text spacing and forced colors with reachable primary actions/drafts/focus. All missing lanes remain explicit.
RD08 P5-13 configured-model semantics and AI review UI — DEFERRED, BLOCKED / NOT QUALIFIED / NOT IMPLEMENTED. Frozen 32 synthetic cases; 0/366 actual required calls; 0 human reviews; critical factuality unmeasured. Current candidate Ollama qwen2.5:7b is not deployed identity. Docker AF_UNIX/error-1920 environment remains unresolved.	B + C; A if unqualified proposal generation/Apply is exposed	AI/backend + human reviewer/UI owner; separately authorized P5-13 return task	Exact return conditions: deployed provider/model/digest/settings/runtime/prompt identity; supported non-destructive isolated equivalent; uncached smoke; unchanged 366 calls with repeats/output/errors; human rubric; no fabricated/false-approved/ambiguous claims; bounded fixes/full rerun; actual review UI and responsive/AT regression. Do not retry Docker recovery during P5-15.
RD09 Production CV proposal withholding — local proof only. Existing Program.cs omits CvAiSuggestionService in Production; generation/Apply return 503 cv_ai_unavailable before provider/write. Other AI registrations remain available. Current deployment is unverified.	A verification gate + C temporary withholding	API/release owner; authorized deployed-service check	Matching deployed SHA/environment plus authenticated unavailable generation/Apply with no CV/profile/history mutation or provider call, ordinary editing/save/history/PDF and unrelated AI still available. Keep guard until RD08 passes; a UI deferral alone does not withhold an API.
RD10 production Linux/fonts/photos/print/other browsers — UNVERIFIED. Local 16/16 standard (36=36 pages) and 8/8 settings (24=24) unchanged fidelity are finite. Photo/wrapped-line/template/font/native-print qualification remains open.	B for full affected CV acceptance; A for release environment font/data smoke	CV/rendering + release reviewer; isolated production-equivalent render checkpoint	Effective Linux/browser/fonts/image revisions; native preview/private/public PDF/photo/non-ASCII/long-line/template checks at unchanged tolerances and manual readability/print; supported alternate-browser/device evidence. Do not infer missing production fonts from local success or alter tolerances.
RD11 P5-06-O01 language preference 500 — OPEN, root cause unproven. Actual PUT /api/auth/preferences/language uses UserManager.UpdateAsync; source caller applies UI/localStorage first and swallows failed PUT. This can silently leave server preference stale; concurrent Dashboard reads accompany the historical 500, not a proved root cause.	B for reliable affected Settings/locale acceptance; A if reproduced on intended production provider/workflow; D only for independent presentation scope	Backend/identity + i18n owner; scoped reliability investigation before locale persistence acceptance	Reproduce overlapping native path on disposable intended provider with sanitized exception/status/correlation and before/after preference; verify failure feedback and recovery, successful readback/relogin, account isolation and regression. Fixture sequencing/204 on later saves does not close original 500 or swallowed failure.
RD12 P4-04-O02 notification-setting contention — OPEN. Native PUT /api/notification-settings through UserManager.UpdateAsync produced SQLite error 5/DB locked in 2/10; readback retained old value. Settings currently retains draft and in-page error; sequential success is not a contention fix.	B for complete affected settings reliability; A if intended deployed provider reproduces; D for unchanged independent UI	Backend/identity owner; scoped concurrent API reproduction before more polling/writes	Trace exact locking/transaction/provider cause and bounded fix, concurrent success/failure/draft/retry/readback evidence on real disposable DB. Never treat GET 200 as PUT success or hide a 500 with generic retries.
RD13 P2-O01 rules-save 500 — historical unconfirmed, still OPEN. Rules GET can create per-user settings; PUT gets/creates then SaveChangesAsync. Creation-race catch/reload exists, but does not prove the historical failure cause. R-02 provides persistent in-page save feedback, explicit retry/discard and internal draft retention; the historical server500 cause remains unknown/open.	D conditional reliability; B if recurrence/failure feedback prevents affected flow acceptance; A if deployed critical persistence fails	Backend/rules + Settings owner; scoped triage if recurring and M07 error acceptance	Retain trace/status/exception and native before/after rule values; investigate actual concurrent/create/save path. Prove accessible actionable error and deliberate successful recovery; do not equate this unproven cause with notification locking.
RD14 command/dialog focus observations P5-04b-R01/P5-07-O01 — OPEN. Command focus gained/lost around entry; attachment Shift+Tab failed while existing onEntered refocused Cancel. Unchanged focused reruns passed; transition race is not instrumented/proven.	B affected shared focus acceptance	Shared dialog/shell owner; targeted instrumented investigation plus M02/M05/M09	Preserve failed observations; reproduce/instrument entry/exit focus ownership, keyboard trap and return under normal/reduced motion and AT, then bounded fix/retest if warranted. Rerun alone does not close it.
RD15 P5-04b-R02 CV section expansion — cause unproven. One unchanged full-run smoke failed before PDF; three unchanged focused runs passed.	D baseline investigation; B if recurring affected CV preservation failure	CV readiness owner; targeted expansion reproduction before broader CV acceptance	Actual event/focus/expanded-state trace and retained assertion, diagnosis or bounded reproduction-backed disposition. Keep original failure; do not mark fixed from later broad pass.
RD16 P4-02-D02 company error outside modal — OPEN. Failed save retains draft, but transient toast is outside modal's accessible subtree. P5-00 bottom feedback placement does not repair this.	B for full affected dialog acceptance; D for unrelated local P5 slices	Company form/Phase 7 owner; M07/M09 targeted accessibility checkpoint	Durable visible/spoken in-modal failure, retained draft, retry/recovery and focus/return evidence without disabling background isolation. No universal dialog pass while this counterexample remains.
RD17 Board full-array scaling — O(N) ceiling retained. One settled complete read, no duplicate Table read/page crawl; entire matching array renders. Finite fixture is not large-account performance proof.	D conditional capacity gate	Jobs/API owner; measured representative large-account checkpoint before scaling claims	Agreed representative data/load/latency/request/render/memory budget; prove current bound or separately scoped paging/virtualization preserving full membership/filter/status semantics. No speculative infrastructure rewrite in P5-15.
RD18 Board/CV physical dragging — NOT VERIFIED beyond scoped automation. P5-10-O01 closes only tested entry/section ownership/default-drop cases; physical selection/drop/cancel/browser variants remain separate. Named alternatives exist.	B mandatory physical acceptance; D unsupported cross-section move feature	Jobs/CV/device reviewer; M03/M06/M12	Actual hardware/pointer/selection/cancel/default-drop evidence and accessible equivalents; preserve source/sibling/title/order/no-write. Cross-section entry movement is not an implemented feature to invent.
RD19 followMode — approved metadata-only deferral. Query retention repaired; no compose-mode consumer. Connor's 2026-10-07 decision preserves metadata and defers UI to mail phase.	C	Mail/route owner; authorized mail-phase design	Retain query/history regressions now; future explicit reviewed compose context, draft/source/entitlement/no-send/uncertain-delivery acceptance. Do not claim mode activation or generation/send from this parameter.
RD20 P5-05 / NEW-10 quick preview and future product scope — explicitly deferred/reserved. Phase 7 full Career/library/Documents/mail/Settings/Admin/Notifications; Phase 8 dashboard order/resize/reset/cross-device persistence; NEW/OD contracts remain separate.	C	Product/domain owners; authorized future-phase scope decision	Accepted data/ownership/route/privacy contract and separately approved implementation/evidence. Preserve existing capabilities/routes now; no fake quick-preview, global AI/chat, favorite/goals/admin metrics/integration.
RD21 profile/job stale saves and creation-intent idempotency — OPEN, distinct from CV revision/account isolation. Scoped CV expected-version/history/draft recovery is passing locally; no automatic B07.	D for unchanged local UI; B/A if changed or relied-on workflow risks overwrite/duplicate production data	Domain/backend integrity owner; separate concurrency/idempotency task before expansion	Actual two-client source revision and no-overwrite/latest-state proof for profile/job; duplicate creation-intent/request proof separately. Do not use B02 identity or CV success to close other entities.
RD22 worker survival F20 / durability — OPEN conditional feature gate. AI worker disabled by default; enabled loop lacks outer unexpected DB recovery. Other worker gates/configuration must be inspected, not assumed disabled.	D while disabled; A before enabled production/new producers	Operations/backend owner; before worker enablement	Intended gate state, isolated unexpected DB/provider outage with surviving/recovering worker, bounded retry/deadline/cancel/no-loss/duplicate safety and independent failure alert. No worker enablement here.
RD23 calendar DateTime/offset/DST F21 — OPEN. Unspecified values treated as UTC; deadline/follow-up export links retained, no new interview scheduling.	D unchanged; B/A before calendar semantics change/claim	Calendar/backend owner; dedicated offset/DST qualification	Actual source/output offsets across DST boundaries, all-day/timed intent and export/provider readback; explicit timezone contract and regression. Mock navigation is not provider calendar correctness.
RD24 billing/deletion/retention/provider cleanup — configuration/policy proof pending. Stripe recurring price/portal/webhook/secrets; deletion tombstone retention/legal holds/provider purge/restore policy unaccepted. Gates remain disabled as intended; current runtime gate state needs inspection.	D + A before activation (not an approved implementation pass)	Product/legal/operations/billing owners; separately authorized activation/restore rehearsal	Approved policy, protected complete recovery keys/tombstones, sandbox lifecycle/cleanup/replay and live configuration proof without secret disclosure. Keep account deletion/billing activation out of P5-15; production exposure unexpectedly enabled is a stop condition.
RD25 provider mail/AI/calendar/OAuth/signup — partial local proof. Mocks/local HTTP tests do not certify live delivery, reconnect, email verification, Turnstile, uncertain send, real model or external calendar.	D unchanged presentation; A configured required production/auth paths or before changed provider behavior	Provider/auth + operator; authorized sandbox/existing-account smoke	Explicit provider/session consent, real configured test accounts, identity/privacy/no-loss/no-duplicate/uncertain-delivery and recovery evidence. Never auto-resend uncertain delivery. P5-13 factuality gate remains separate.
RD26 legacy Job/Application cutover — OPEN contract stage. Compatibility dual writes/reads/columns remain; no drop authorized.	D current compatibility; A before schema cutover	Database/domain owner; restored-production expand/verify/contract checkpoint	Four read-only reports in migrations return zero in production and fresh restore; old-client requirement reviewed, one observation release, then separately approved later migration and rollback proof.
RD27 monitoring/alerts/recovery operations — current coverage UNVERIFIED. Container logs bounded to three 10MB files; centralized aggregation not configured. Health/ready, backup age, worker failures and delivery signals need actual owner/action evidence.	A for required release failure detection/recovery; D centralized sink until need proven	Operations owner; pre-release alert/runbook exercise	Sanitized alert routing/ownership, stale-backup/worker/provider failure and health/readiness failure drill on isolated target, retained failed deployment status/logs, recoverable incident record. Central aggregation only if incident/multi-host needs justify it.
RD28 evidence boundaries — preserve scoped closures. Original unnamed-target/preview-keyboard/Tooltip/mobile shell/status/date/query/package/CV revision fixes have successor proof, not universal certification. Settled-transition capture waits and historical NB missing glyph/cropped/blank-tail captures remain finite.	D record quality; B if only evidence for mandatory acceptance is deficient	Test/UI reviewer; authorized P5-15 evidence collection	Capture before axe where necessary, DOM/text and native content assertions, full viewport/start/focused scroll; retain failures and exact actual/expected outcomes. P2-D01 is ordinary passing now; no expected-failure resurrection. TS2571 is not current debt.

Investigated 500 path and limits

This checkpoint inspected the current callers and controllers without running them:

• I18nProvider setLanguage calls applyLanguage (React state, local storage and document language), then PUTs /auth/preferences/language with .catch(() => undefined). AuthController reads the current user, validates EN/NB, mutates UiLanguage and calls UserManager.UpdateAsync; ordinary unsuccessful Identity results become 400. The recorded generic 500 can therefore be an exception, but the trace does not prove which one. An exception through the same Identity store as notifications is a hypothesis, not a confirmed SQLite root cause.
• NotificationSettingsController reads/mutates the current Identity user and calls UpdateAsync; an unsuccessful result returns 500, and prior diagnostic exceptions are specifically SQLite error 5 through UserStore.UpdateAsync. SettingsView preserves the draft and sets an in-page error on failed PUT. Waiting for PUT before polling readback protects sequential fixture correctness; it does not repair concurrent server locking.
• RulesController has read-side get/create plus PUT save; its create-race catch detaches/reloads only when another settings row exists. RulesSettingsCard leaves draft in place and reports failed save through toast. Neither proves the cause of P2-O01 or durable AT-visible failure.

No root cause was invented, provider equivalence assumed, retry added or failure downgraded to visual-only. Actual deployed provider/configuration and concurrent endpoint behavior must be verified before treating these as release-safe. A later runtime investigation can change classification with proof; this plan cannot.

Production readiness operator checklist — prepared, not executed

Use current deployment, backups, disaster recovery, migrations, monitoring, configuration, deploy script, protected workflow and the B06 exact safe handoff. The historical first-deployment runbook is supplementary; current G-RELEASE gates take precedence over its older migration/runtime claims.

All items below are NOT EXECUTED / NOT VERIFIED. Commands are for a later authorized operator task, not this documentation checkpoint. VERIFIED_* names and /operator-approved/* paths are safe placeholders: replace privately from verified inventory/session, never guess a host/user/key/password. Read secret-bearing output locally and record only allowlisted non-secret facts, hashes/counts and outcome; do not paste live .env, rendered Compose environment, full container inspect, cookies, tokens, private text or provider payloads. Every shell command is RTK-prefixed; if the approved Linux host lacks RTK, arrange the approved equivalent separately rather than implicitly installing tooling.

1. Establish target and authorization. Confirm the current candidate SHA/branch, production main, protected workflow/runner policy and explicit release authority. A successful main push deploys automatically; preserve NO-GO until pre-release items pass. Establish an operator-approved session using existing protected deployment credentials, without copying them into notes. Record current backend/frontend images/version/SHA, app/company counts and fallback/feature gates before replacement. Do not run deploy.sh for inventory.

   rtk proxy bash -lc 'cd /opt/job-tracker/app && git rev-parse HEAD'
   rtk proxy bash -lc 'cd /opt/job-tracker/app && docker compose --env-file /opt/job-tracker/shared/.env -f docker-compose.yml ps'
   rtk proxy docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Ports}}'
   

   Privately confirm actual provider/connection, canonical origin, auth-required/verification/registration/OAuth configuration, precise ingress peers and all worker/deletion/billing/external-AI gates. Record presence/custody/rotation evidence for secrets, not values. Confirm no unqualified CV proposal path is accidentally deployed/enabled. Exit: current baseline and intended configuration known; no F19 fallback masquerading as valid empty data.

2. Validate configuration securely; inspect actual ingress boundary. The existing validator consumes rendered production Compose without printing environment. Its pass is only repository configuration proof. Read generated nginx configuration, actual Traefik configuration/placement/network and trusted forwarding locally; inspect host/provider firewall, Docker NAT/FORWARD and IPv6 separately. Obtain actual socket peer through the handoff's bounded SYN-only namespace capture while controlled health requests run. If trusted/untrusted paths share a NAT source, stop and review binding/firewall/dedicated proxy topology.

   rtk proxy bash -lc 'cd /opt/job-tracker/app && docker compose --env-file /opt/job-tracker/shared/.env -f docker-compose.yml --profile bundled-ollama config --format json | python3 scripts/validate-ingress.py'
   rtk proxy sudo ss -lntp
   rtk proxy sudo nft list ruleset
   rtk proxy sudo iptables-save
   rtk proxy sudo ip6tables-save
   rtk proxy docker network inspect jobtracker_shared --format '{{json .IPAM.Config}} {{json .Containers}}'
   rtk proxy docker exec VERIFIED_FRONTEND_CONTAINER nginx -T
   rtk proxy sudo nsenter -t VERIFIED_FRONTEND_PID -n tcpdump -nn -i any -c 10 'tcp dst port 80 and (tcp[tcpflags] & tcp-syn != 0)'
   

   Use only installed applicable firewall tools; unavailable tools require equivalent operator evidence. Exit: actual trust source/network/listener/firewall/NAT proof, no backend/AI/Ollama public exposure and no trust-all workaround. These inspection commands do not authorize network changes or restart.

3. Verify external DNS/TLS/redirect/direct/spoofed paths. On an independently controlled external machine, verify every current A/AAAA address and actual hostname; keep TLS validation enabled. Inspect the effective API client IP/scheme/host with flow/configuration evidence; a public auth-config 200 alone cannot prove header sanitization. Repeat IPv6 with bracketed direct addresses and -6; do not infer it from IPv4.

   rtk proxy dig VERIFIED_CANONICAL_HOST A
   rtk proxy dig VERIFIED_CANONICAL_HOST AAAA
   rtk proxy curl --max-time 10 -sS -D - -o /dev/null https://VERIFIED_CANONICAL_HOST/api/auth/config
   rtk proxy curl --max-time 10 -sS -D - -o /dev/null https://VERIFIED_CANONICAL_HOST/api/auth/config -H 'X-Forwarded-For: 198.51.100.10' -H 'X-Forwarded-Proto: http' -H 'X-Forwarded-Host: attacker.example.test'
   rtk proxy curl --max-time 5 -sS -D - -o /dev/null http://VERIFIED_PUBLIC_IP:3000/api/auth/config -H 'Host: VERIFIED_CANONICAL_HOST' -H 'X-Forwarded-For: 198.51.100.10' -H 'X-Forwarded-Proto: https'
   rtk proxy curl --max-time 5 -sS -o /dev/null http://VERIFIED_PUBLIC_IP:5202/health
   rtk proxy curl --max-time 5 -sS -o /dev/null http://VERIFIED_PUBLIC_IP:8080/health
   rtk proxy curl --max-time 10 -sS -D - -o /dev/null http://VERIFIED_CANONICAL_HOST/api/auth/config
   

   Exit: canonical certificate/chain/hostname valid, HTTP redirects to a reachable intended HTTPS origin (the old :444 failure rechecked), direct app/backend denied, spoofed edge metadata overwritten/rejected and actual identity verified. Probe only recorded app listeners, not unrelated services or production login limits.

4. Take and inspect a fresh complete recovery set — separately authorized mutation. Use the established backup-only script on the confirmed provider/configuration after operator approval. This mode also creates links/files, applies retention and may copy off-host; it is not a read-only preflight. Do not skip DB backup. Confirm DB format matches provider; pair matching stamp with files/CV/exports/Data Protection keys and separate tombstones, manifests/hash/freshness/custody/retention/encrypted off-host copy. Script permits absent tombstone volume at first deployment; that is not proof deletion/restore is safe.

   rtk proxy bash -lc 'cd /opt/job-tracker/app && DEPLOY_BACKUP_ONLY=true bash deploy/deploy.sh'
   rtk proxy ls -lt /opt/job-tracker/backups
   rtk proxy gzip -t /operator-approved/current-recovery/database.sql.gz
   rtk proxy tar -tzf /operator-approved/current-recovery/files.tar.gz
   rtk proxy sha256sum /operator-approved/current-recovery/database.sql.gz /operator-approved/current-recovery/files.tar.gz /operator-approved/current-recovery/tombstones.tar.gz
   

   Choose the actual MariaDB dump or SQLite archive, not the illustrative filenames above. Keep archive names/contents private if they identify users. Exit: verified manifest includes complete required artifacts and keys; gzip/schema/trailer checks are merely format proof, not restore proof.

5. Restore current production recovery into an isolated target — separately authorized rehearsal. Never point the restore client at production. Use an operator-created protected client-options file; no inline password. Restore DB plus owned files/keys and tombstones independently; boot the matching app in isolated equivalent topology. Verify table/application/company/CV/profile/history/frozen-package counts/content, exact attachment hashes, languages/non-ASCII, protected-provider-data decryption, and deleted-account tombstone replay after restart. Keep deletion disabled until policy/provider cleanup is approved.

   rtk proxy bash -lc 'gzip -dc /operator-approved/current-recovery/database.sql.gz | mariadb --defaults-extra-file=/operator-approved/isolated-client.cnf --database=VERIFIED_ISOLATED_DATABASE'
   rtk proxy mariadb --defaults-extra-file=/operator-approved/isolated-client.cnf --database=VERIFIED_ISOLATED_DATABASE --execute='SELECT COUNT(*) AS applications FROM JobApplications; SELECT COUNT(*) AS companies FROM Companies; SELECT MigrationId FROM __EFMigrationsHistory ORDER BY MigrationId;'
   

   This example applies to MariaDB/MySQL only. SQLite uses the documented archive/backup path; choose the actual provider's isolated restore, preserving side files/keys. File/tombstone restore paths must be explicitly reviewed against the isolated target; this plan invents no volume names or destructive extraction command. Exit: actual restorable app/key/deletion semantics, not merely equal DB counts.

6. Rehearse startup/schema and ingress failure paths in isolated equivalent Linux topology. Verify current migration history/provider and guarded reconciler on the restored data, including repeated startup, non-empty counts and failure on invalid intended configuration. Preserve legacy columns/dual writes. Run the existing synthetic ingress probe only on an approved disposable engine with already-installed image; it is supplementary to real Traefik+app/Compose evidence.

   rtk proxy python3 scripts/test-ingress.py
   rtk proxy python3 scripts/test-ingress-topology.py --image nginx:1.29.8-alpine
   

   Execute the four read-only production-cutover SQL reports on current production and isolated fresh restore only when authorized; retain all four zero results. No column drop/reset/history edit follows. Exit: required startup/schema/restart proof; actual-chain B04 A/B budgets and B02 sessions verified without consuming live login quotas; no missing-config fallback data accepted.

7. Rehearse release failure and code/image rollback before release. On disposable equivalent Linux topology with restored synthetic/current authorized data, retain prior backend/frontend images and protected configuration; run the established script under a reviewed deliberate post-replacement failure. Capture its nonzero exit/failed CI, automatic restoration of both previous images, app/key/file/tombstone preservation and after-rollback health/login/count smoke. There is no documented one-flag failure-injection shortcut; agree the injection with the operator instead of inventing one. Database rollback is separately required only if data/schema is the confirmed problem. Exit: recoverable prior release and a failed deployment that remains failed; logs/manifest preserved, no silent retry-deploy loop.

8. Complete protected CI and authorize release only after critical exits. Collect the candidate's protected test/browser results, runner/branch policy and relevant P5-14 baseline preservation checks without changing assertions or retry/skip accounting. A CI pass alone does not clear RD01–04/06–10 or enable deferred features. Operator records explicit scope, candidate SHA, NO-GO/conditional exclusions and rollback readiness; only then can a separately authorized history-preserving main merge/push trigger deployment. No release command is supplied or executed by this plan.

9. Verify deployed outcome and authenticated owner/data workflows. Record actual workflow/deploy status, matching SHA/image/version, healthy containers and canonical health/readiness/auth config; health does not establish login or data preservation. Confirm anonymous private API remains 401. Use existing approved accounts through the browser, keeping credentials out of notes: A/B isolation, existing counts, Companies/Career languages, Dashboard/Analytics/Jobs/Table/Board/workspace, ordinary CV editing/history/templates/preview/private/public PDF and existing attachment. Verify intended-provider locale/notification/rules persistence, including scoped concurrency diagnosis, and expected Production CV proposal unavailability. Providers/registration/Turnstile/email/OAuth require separately approved dedicated test accounts; record uncertain delivery without auto-resend.

   rtk proxy curl --max-time 10 -fsS https://VERIFIED_CANONICAL_HOST/health
   rtk proxy curl --max-time 10 -fsS https://VERIFIED_CANONICAL_HOST/ready
   rtk proxy curl --max-time 10 -fsS https://VERIFIED_CANONICAL_HOST/api/auth/config
   rtk proxy curl --max-time 10 -sS -o /dev/null -w '%{http_code}\n' https://VERIFIED_CANONICAL_HOST/api/jobapplications
   

   Exit: SHA/version and existing owned data match, auth/session boundary and actual user journeys pass; failures trigger the rehearsed decision. P5-13 remains unqualified even if the unavailable guard passes.

10. Verify monitoring and failure handling. Record operator-owned health/ready/container, backup freshness/manifest, worker and provider delivery signals plus alert response/runbook. Exercise stale-backup, failed-ready, disabled/unavailable provider and worker failure in isolated target, ensuring actionable failure/no data loss/no duplicate delivery, without enabling production workers. Keep failed-deployment evidence/logs and confirm three×10MB local log retention; assess an external sink only if justified. Exit: a named operator can detect/respond/recover; prepared probes or unconfigured alert ideas are not evidence.

Decision boundary

The next authorized local acceptance task can execute the manual plan and appropriate regression evidence for implemented screens. It cannot declare deferred P5-13 complete, substitute screenshots/emulation for human/device proof, fix unrelated backend/operational debt implicitly, or perform G-RELEASE. Production remains NO-GO while A gates are unresolved; full Phase 5 remains CONDITIONAL / PARTIAL while B obligations remain. Approved C exclusions permit only their documented bounded scope. D rows stay open until their trigger and exit proof are reconciled.