jobtrackingapp/docs/redesign/phase-10/P10-04.md

P10-04 — Functional and data integrity qualification

2 November 2026. PARTIALLY COMPLETE. Selected document-contract regression executed against Phase 10 application sources after CLEAN-20. This checkpoint is not full regression or final acceptance.

Fresh results

PASSED: 27 tests, zero failures/skips, native exit 0, across ApplicationAssetsTests, CvRevisionReadinessTests and CvExportRevisionTests. Coverage includes association/tenant isolation, canonical-profile ownership, letter history and restoration, null/inherited overrides, stale-write rejection and PDF-export revision preconditions. Local in-memory/temporary SQLite fixtures, mocked PDF exporter; no physical PDF acceptance, production database, model or provider validation.

Command: pinned local .NET SDK 9.0.317, Release test with --no-restore, filter FullyQualifiedName~ApplicationAssetsTests|FullyQualifiedName~CvRevisionReadinessTests|FullyQualifiedName~CvExportRevisionTests, TRX logger. Restore separately passed with locked mode; lockfiles and product source remained unchanged. Initial invocation incorrectly passed --locked-mode to dotnet test and was rejected by MSBuild before running tests; this was corrected by separate locked restore, without configuration edits.

Raw native evidence: document-contracts.trx.gz. Uncompressed SHA256 692a0fe8016140c3198e76e6b3c1d56f438d80390666bc7f1b2dc06b4ac4ead5. Test records identify individual cases and execution timestamps.

Remaining qualification

Additional PASSED executions, same Release assembly and native exit 0:

• ProfileCvControllerTests: 36 passed, zero failures/skips. Includes import admission, reviewed persistence and deterministic/fixture parsing with mocked AI dependencies. No live classifier/model or provider was used. Native TRX, uncompressed SHA256 844cd54ff382bff0d48429336f8588ab010f0c72ea255ca02fe300b1561dc513.
• SqliteDateTimeOffsetCompatibilityTests and CareerProfileServiceTests: 26 passed, zero failures/skips. Local canonical-profile history plus SQLite submission capture, sparse/missing-attachment package handling, owner-scoped date ordering and extraction endpoints. Native TRX, uncompressed SHA256 1ac55913fdc3b705afbed27829fb280bef08d33c62fa26faa2c04e23c0c95908.

The three filters are disjoint: 89 distinct backend cases passed, zero failed/skipped. They are selected regression coverage, not a complete backend pass.

Frontend PASSED: five suites, 92 tests, zero failures/pending, native exit 0, 41.237 seconds. Exact selected paths: career-history-view.test.tsx, application-assets.test.tsx, cover-letter-document.test.tsx, cv-document-controls.test.tsx, cv-import-review.test.tsx; Jest --runInBand --runTestsByPath, local mocked contracts. Native JSON, uncompressed SHA256 b919a96d94218ff166de684f6b82d3ce6f34d47b51d52480721e8955df2df257. Browser/real PDF fidelity and semantic AI quality are separate evidence. Backend and frontend counts remain separate.

Migration rehearsal/rollback, MariaDB integration, sidecar, complete suites, security acceptance, hosted CI and human/device qualification remain NOT RUN here. Reuse unchanged accepted renderer evidence only within its source/fixture/environment boundaries. No migration or destructive cleanup is proposed. P10-05 remains open; production remains NO-GO.

Additional attachment qualification

Fresh AttachmentConsistencyTests execution: 14 PASSED, zero failures/skips, native exit 0. Reused the existing Release assembly with --no-build/--no-restore after confirming no backend/test source difference between the Phase 10 and security branches. Relational temporary SQLite and synthetic files only. The named case Another_users_attachment_cannot_be_downloaded_renamed_or_deleted verifies three NotFound results and preserves the foreign file/row. Other selected cases cover upload/storage consistency. This is direct controller/local fixture evidence, not authenticated HTTP or deployed/MariaDB isolation acceptance. No application code changed.

Native TRX. These 14 cases are disjoint from the earlier 89 backend cases: selected backend coverage is now 103 distinct cases, with the 92 frontend tests kept separate. Complete suites and P10-05 remain open.