jobtrackingapp/docs/redesign/phase-4/p4-06/README.md

# P4-06 — Shared validation checkpoint

Application under review: `c99f4fb7ddf522eb75ed7d644b0469fb59124412` on `codex/ui-redesign-phase4`, 2026-09-13. This checkpoint changes acceptance documentation and two browser-test readiness boundaries only. **No application, backend, dependency, CI, deployment, schema or Phase 5 implementation changes. No B07 work. F04 remains open.** The containing commit is discoverable with `git log -- docs/redesign/phase-4/p4-06`.

Sources: [approved plan](../../phase-3/PHASE4_IMPLEMENTATION_PLAN.md), [Phase 3 impact](../../phase-3/PRESERVATION_IMPACT_MATRIX.md), [Phase 2 contracts](../../phase-2/PRESERVATION_MATRIX.md), [traceability](../../phase-2/TRACEABILITY.md), and all five implementation records below. Historical statements such as “next slice not started” describe their individual checkpoints; this report reconciles their current status without rewriting historical evidence.

## Acceptance and Phase 5 readiness

**CONDITIONAL GO for Phase 5 planning, not blanket approval for broad page migration or production release.** The representative Phase 4 primitives compose without replacing MUI or moving state owners. Open named/focus/contrast failures must be resolved within their separately authorized owner before accepting migration of the affected surface. In particular shell/command planning must account for P4-02-D01 and the manually reproduced P4-06-O01/O02 below; tooltip contrast remains a shared-control gate. Package/tailoring and broader CV editor work have independent blocking integrity/rendering prerequisites.

The exact recommended next task is **plan the bounded Phase 5 AppShell/grouped-navigation migration**: reconcile existing destinations/legacy links and the 57 contracts with the approved information architecture; retain the private provider tree, route/query contracts and account-switch boundary; specify desktop collapse versus mobile drawer state, focus entry/return, account/notification/command behavior and compatibility tests. Include the known shell/command/feedback defects as acceptance prerequisites. Identify the first small implementation diff and its EN/NB × light/dark × desktop/320px evidence before editing. Do not include Dashboard, Jobs/Board, job details or CV redesign in that first slice. This is a recommendation only; no Phase 5 ticket/package has been created.

## Combined foundation and reuse boundary

| Slice | Retained result | Combined responsibility / limit |
|---|---|---|
| [P4-01](../p4-01/README.md) | Semantic MUI palette, both themes, 3px focus-visible treatment, loaded fixtures, readable omitted CV sections | Existing provisional hue/font/identity; background/paper/elevated, text, border, focus, action and status roles. Status labels/icons retain meaning. Printed white CV paper/template accents remain document styling, not application theme errors |
| [P4-02](../p4-02/README.md) | Names for existing CV/AI/attachment controls, labelled confirm/prompt/command dialogs, persistent loaded-state live region | Preserve MUI focus trap/return and existing field/save owners. Announce completion only after observed loading; error-only callers do not announce false completion. No general form framework or per-background-refresh announcements |
| [P4-03](../p4-03/README.md) | Named keyboard-scrollable CV preview region, focused edit/preview pane survives width changes | Existing preview HTML/iframe, save queue, pagination and renderer remain. Keyboard access is accepted; margin/template fidelity and stale-revision safety are not thereby certified |
| [P4-04](../p4-04/README.md) | PageHeader/PageSection, opt-in title/section/description typography, width/gutters/rhythm | Settings is the only page consumer. Semantic h1/h2/h3, wrap-safe actions/text; no page-wide Save or new draft owner. Reading 60rem; data 82.5rem and editor 100% are aliases awaiting real consumer acceptance, not pre-certified migrated pages |
| [P4-05](../p4-05/README.md) | Opt-in Comfortable/Compact MUI table/card spacing on existing Jobs/Trash | Default Comfortable; local component state only, no persistence/API/schema. Same columns/actions/sorting/paging/statuses/selection. Existing 768px card adaptation; target sizing independent of density |

Inspected owners: `theme.ts`, `mui-theme.d.ts`, `layout/PageLayout.tsx`, `layout/AppShell.tsx`, `App.tsx`, `ViewStateNotice.tsx`, Settings subcards, `JobTable.tsx`, `CvBuilderEditor.tsx`, and the named-control/dialog callers. Compared Phase 3→P4-05 diffs with the records. `App.tsx` only opts Settings into the reading header/description; its routes/auth/provider owners are unchanged. `AppShell` combines semantic colors/focus with an optional layout prop, retaining the original navigation groups, widths, collapse key and handlers. Several other source-file diffs from the docs restructure are comment/link changes only.

Consumers should use MUI semantic palette/focus, select a reviewed page-width role, compose headings/sections at the real semantic level and opt into density only where it makes sense. These primitives own presentation, not selection/query/draft/persistence. Future screens need their own populated/error/long-content fixtures; they must not invent replacement page wrappers or a competing table/theme system to bypass failed acceptance. Editor breakpoints (900/1024) remain intentionally distinct from the shell/table's 768px boundary.

Whole-container opacity on omitted CV sections/items was removed in P4-01 because it reduced editable-text contrast. Existing inclusion/visibility indicators still communicate omission. Editing, persistence, canonical-versus-variant ownership and generated output semantics are unchanged. Transient drag opacity is a different retained behavior.

## Preservation reconciliation

The [57-row acceptance matrix](PRESERVATION_ACCEPTANCE.md) retains every original group and its underlying sub-capabilities, test references, extra P4 evidence and unresolved gaps. **57/57 are mapped; this is not exhaustive behavioral coverage.** Disposition: 8 scoped acceptances, 34 retained-regression groups and 15 conditional groups with specific migration gates. These are review categories, not a percentage of product readiness.

Representative high-risk protection spans real account isolation/permissions; query/selection/row actions and workspace Back; dirty navigation; CV override/autosave/undo/redo with canonical/sibling readback; named dialogs and focus return; real upload/document ownership; explicit AI accept/reject/edited acceptance in component/service tests; native Settings saves and failure recovery. Real model truthfulness, provider mail/payment/calendar delivery, all historic restore paths and all route/state combinations remain outside the local proof.

P2-D01 remains the one expected browser failure: native SQLite submitted-package capture returns 500 after successful setup. **Later archived-binary assertions are not reached.** Service tests for immutable packages do not close that native gap. Source/history concurrency (F01/audit D01), session identity (B02) and creation-intent idempotency are separate contracts.

## Verification adjustment discovered at this checkpoint

The initial complete run reported **46 actual passes, five unexpected failures, and P2-D01 expected failure** (reporter: 47 passed, five failed). Three P4-01 scans sampled partially transparent dialog/toast content: company buttons 4.37/4.12:1 and a saving toast 4.48:1. Two P4-05 checkbox-wrapper focus samples read 0px while the native input was focused. A focused rerun of the same unmodified 16 cases passed, so the initial result is retained rather than erased or called a clean baseline.

Inspection found normal finite MUI Fade/Grow transitions in P4-01 and `ButtonBase` applying the wrapper focus class through React state. The focused instrumented run observed company-dialog opacity between approximately 0.798 and 0.956 immediately before waiting for finite transitions, and a notification-toast transition at 0.956. All 16 focused cases passed both before and after the readiness adjustment. The bounded test changes are:

- [semantic-foundations.spec.ts](../../../../job-tracker-ui/e2e/semantic-foundations.spec.ts): at loaded-state axe boundaries, allow a paint cycle and await currently running **finite** animations. Record animation type/opacity in result attachments. Keep normal motion enabled, infinite loading animations untouched, all axe rules/thresholds and the original scoped assertion. This tests settled loaded content, not every intermediate animation frame.
- [table-density.spec.ts](../../../../job-tracker-ui/e2e/table-density.spec.ts): use the normal bounded assertion timeout to observe the existing 3px solid wrapper ring after native focus. The ring requirement, focus assertion, keyboard actions, data/paging/actions and test count are unchanged. No eventual failure is converted into a pass or rule exclusion.

No product color or interaction was changed to address these observations. Full rerun and transition evidence are summarized in [RESULTS.json](RESULTS.json). The two readiness changes are the only executable changes in P4-06. No new browser/Jest/backend cases are introduced.

## Visual, accessibility and responsive evidence

V1–V5 refer to fresh execution of the existing five P4 browser files in the final complete run. All use the built static frontend and real disposable local API with synthetic users/data. Browser/provider traffic is blocked by the fixtures. The [visual review](VISUAL_REVIEW.md) records inspected frames, capture limitations and manual observations; all 33 retained fresh images and scan summaries are indexed in [RESULTS.json](RESULTS.json). Original P4 screenshots remain unchanged.

| Evidence | Populated workflow / assertions | Limits |
|---|---|---|
| V1 `semantic-foundations` | Companies loading→error/Retry→empty→real populated; company form keyboard/return; Jobs labelled statuses; command/nav focus; loaded CV and Settings, both themes; company full EN/NB matrix | Gates contrast only, attaches other violations/incompletes. Historical full-scan results must not be described as full axe passes |
| V2 `named-controls-modal-state` | Four theme/locale cases, named CV controls/cover-letter options; actual attachment rename/purpose controls; prompt/confirm focus; company failed-save draft; command dialog | Explicit command-list/mobile-progress baseline findings retained. Provider AI success not called; modal-toast limitation still open |
| V3 `builder-preview-keyboard` | Four theme/locale cases; one/multi-page native preview, keyboard PageDown/Home/End, pane retention at 390/768/899/900/1024/1440, preview 503/Retry, native autosave/undo/redo and source/sibling isolation | Known light Redo-tooltip contrast remains a narrow expected finding. Does not prove margins/templates, whole-editor screen-reader operation or revision safety |
| V4 `settings-page-layout` | Four theme/locale cases; one h1/named sections; 1920/1440/1024/768/767/390/320 reflow; long EN/NB heading, rule draft through resize; awaited native rule/notification saves, 503 retry, ZIP and account-link actions | No concurrent SQLite safety claim. Existing tab-unmount draft behavior retained. No paid deletion/restore/provider operation |
| V5 `table-density` | Four theme/locale cases; both densities, all columns/actions, checked selection, native sort/page/delete/Trash restore/workspace Back, 1440/1024/768 tables and 390/320 cards, scroll focus/keyboard, 32px fine/44px phone targets, error/Retry | Local preference only; no actual coarse-pointer hardware or saved-view CRUD/partial bulk-failure certification. CV document density is separate |
| M1 manual local browser | Running local app in Codex in-app browser; Settings loaded h1/h2/h3 and theme-menu keyboard selection/return; desktop sidebar collapse, reload persistence, 320px drawer Tab/Escape and return; light/Bokmål and dark/English visual inspection | Synthetic seeded admin; no real user/production data. Exposed pre-existing collapsed-drawer and long admin-badge failures below. This is manual UI/AX observation, not NVDA/Narrator certification |

Manual visual review distinguishes readable main-page headings/forms/cards from shell defects; it does not rely solely on a zero-overflow body measurement. The table fixtures check actual descendant bounds and title width, retained horizontal scrolling and stable content. Both densities retain labelled status plus selection checkboxes rather than color-only meaning. The standard drawer returns focus on Escape; the collapsed-mobile first item is a documented counterexample to a universal focus-visibility claim.

The evidence ledger reports **violations and incomplete rules separately**. P4-01's contrast-only gate and the later narrow known-defect assertions are not full accessibility passes. The inherited generic `accessibility.spec.ts` waits for the main landmark, not every populated route's data, and does not attach its incomplete results; its success must not substitute for V1–V5 or be included as a complete scan census. Incomplete color contrast, aria-hidden-focus, table/other checks require human review; reading representative screenshots/names does not resolve every node. Manual checks of static headings, labels, visible focus, wrapping and incomplete contexts supplement the automation, without certifying screen-reader announcements. Reduced-motion media is exercised by V2–V5; V1 keeps normal transitions. Full native screen reader, physical touch/software keyboard, OS forced-colors and 200%/400% browser-zoom testing remain intentional gaps. Every affected migration must add appropriate proof before acceptance.

## Open/deferred issue reconciliation

| Issue | Current status/evidence | Owner / Phase 5 effect |
|---|---|---|
| Original unnamed CV/AI/attachment controls and preview keyboard region | Closed only for the named P4-02/P4-03 targets; current fixtures verify them | No remaining blocker for those bounded fixes; not all controls/render combinations certified |
| Historical standalone TS2571 | Not present in current successful type gate; historical evidence preserved | No current blocker; retain standalone CI gate |
| F04/B06 ingress | **Open**, no deployed peer/listener/firewall/NAT/IPv6/DNS/TLS/restart evidence collected | Production/release gate; not a reason to replace local UI foundations |
| P2-D01 native package/tailoring SQLite ordering | **Open**, unchanged expected failure, archive assertions unreached | Blocks package/tailoring/document-relationship restructuring; separately repair/prove native archive before affected migration |
| P4-02-D01 command List children | **Open**, retained axe `list` result | Shell/command owner must resolve structural semantics before that migration is accepted |
| P4-02-D02 company save feedback outside modal | **Open**, retained draft but transient toast outside accessible modal subtree | Company form owner; require durable accessible in-modal failure, preserve modal background isolation |
| P4-02-D03 mobile progress scrolling | **Open**, retained `scrollable-region-focusable` | Job workspace/mobile owner before restructuring that surface |
| P4-02-D04 literal AI context `{name}` | **Open**, both locales; no context/API change here | Application AI content owner before affected UI migration |
| P4-03-D01 light Redo Tooltip contrast | **Open**, known 3.89:1 context, narrowly recognized by inherited tests | Separately scoped shared-theme repair before accepting affected hovered/focused controls; no global contrast exemption |
| P4-04-O01 toast overlap | **Open**, existing transient feedback can obscure bottom actions | Shell/feedback placement owner; normal dismissal is not a repair |
| P4-04-O02 SQLite notification-save contention | **Open**, earlier 2/10 concurrent attempts failed; current fixtures await PUT before readback | Separate backend reliability owner; no claim that concurrent preferences are safe; does not require page primitive replacement |
| P4-05-O01 raw English statuses/browser-locale dates | **Open**, stable keys/semantics retained, EN/NB density/paging names work | Jobs localization owner; migration must preserve raw custom labels and date meaning |
| P4-06-O01 collapsed desktop state leaks into mobile drawer | **Newly observed baseline defect**, reproduced manually: collapse→reload→320px→open→Tab. Mobile retains icons only; names remain in AX via title. First Dashboard row is y=74–118 under fixed header; center hit-test returns HEADER, not focused button, despite 3px outline. Expanded control is y=130–174 and hit-tests correctly. Escape returns to trigger | Shell/responsive owner; blocks acceptance of the first shell migration until mobile labels and focus visibility are independently protected. Present in pre-Phase-4 `f696f23` AppShell: shared `desktopNavCollapsed` label/padding branches plus app-bar z-index above drawer. No P4 product change introduced it |
| P4-06-O02 long admin version badge at 320px | **Newly observed baseline limitation**, synthetic `e2e-verification` badge overlaps logo/language controls in light/Bokmål and dark/English. Normal non-admin fixtures do not exercise the badge | Shell/admin header owner; long metadata must reflow before shell acceptance. Same pre-P4 badge/layout code; not proof of current production overlap with a shorter version |
| CV margins/templates/preview/pagination fidelity | **Open**, keyboard access does not fix document geometry or theme-specific rendering | Dedicated rendering/PDF acceptance before broad CV migration; preserve template options and preview/PDF relationship |
| F01/audit D01 stale revision; creation idempotency | **Open**, distinct from completed account isolation | Separate integrity owners; serialize CV editor changes with revision work; do not begin B07 here |
| P2-O01 isolated initial rules 500 | **Unconfirmed** historical observation; not closed by passing runs and not equated with reproduced notification contention | Separate reliability triage if it recurs; no silent retry allowance |
| P3-O01/O02 analytics definitions/navigation retention | **Open**, [Phase 3 decisions](../../phase-3/OPEN_DECISIONS.md) retained | Dashboard/route migration owners must define population/period and query/error behavior before changing those surfaces |
| Production runner/browser gate, provider delivery, restore/rollback, billing/deletion configuration; F19/F20/F21 | **Unverified/open**, [known issues](../../../roadmap/known-issues.md) unchanged | Separate release/operational/domain gates. Local tests do not close them or authorize deployment; calendar/timezone/worker/configuration fixes are outside this checkpoint |

No deferred defect was silently fixed. New baseline observations are recorded in the existing TODO ledger, not turned into Phase 5 implementation tickets.

## Final validation

Fresh commands ran on Windows/PowerShell, local .NET SDK and Chromium, with normal single-worker/serialized settings. Synthetic DBs and authenticated traces/logs are ignored artifacts, not committed credentials. The final complete browser run took 7.8 minutes, with one attempt per case and no unexpected failures. Final values and exact outcome distinction are in [RESULTS.json](RESULTS.json).

| Gate | Inherited P4-05 | Final P4-06 |
|---|---:|---|
| Backend Release | 916 | **916 passed**, zero failed/skipped |
| Frontend Jest | 354 / 75 suites | **354 passed / 75 suites**, zero failed/skipped |
| Browser actual success | 51 | **51 passed**; reporter says 52 because it includes the expected failure |
| Browser expected failure | P2-D01 | Retained, not counted as actual success |
| Rate-limit / ingress / PDF | 9 / 6 / 1 | **9 / 6 / 1 passed** |
| Configuration/Compose | 3 | **3 passed** |
| TypeScript / lint / frontend production / API Release | Passing | **All passed**; API zero warnings/errors; separate e2e TypeScript also passed |
| Secret / whitespace / docs/PRES links | Passing | **Passed**; 124 current/root Markdown files, zero missing local targets; all 57 unique contracts and 147 referenced test targets reconciled |

Additional unchanged local checks: supply-chain script tests **3**, model-evaluation harness tests **5**, browser-extension node tests **3**. B01 transport/SSRF, B02 session/ownership, B03 admission/recovery and B05 export regressions remain part of the 916 backend suite; native account-isolation and CSV/public PDF browser cases pass, alongside the separate B04/ingress/PDF burst suites. The PDF burst test uses inert child processes to measure shared capacity; inherited browser smoke also generates real Chromium PDFs. No F04 production topology claim follows from those local tests.

The retained scan census is **118 scans**, with **eight known rule occurrences**: command `list` four, mobile `scrollable-region-focusable` two, light-tooltip `color-contrast` two. V1/V4/V5 have zero violations in their 38/20/24 retained scans. Incomplete-rule occurrences remain separate: color contrast 92, aria-prohibited-attr 34, aria-hidden-focus 24, aria-valid-attr-value 4 and th-has-data-cells 4. These counts are occurrences across scans, not unique defects; none is treated as a pass.

Phase 3 inherited 916 backend / 313 frontend / 23 actual browser successes plus P2-D01. Phase 4 adds **41 Jest tests** (20+12+0+3+6) and **28 browser cases** (12+4+4+4+4), reaching 354 and 51. P4-06 adds zero cases; two existing browser files gain readiness checks only. Backend/security/configuration counts are unchanged. No CI/package/infrastructure adjustment was necessary.

```powershell
$env:DOTNET_ROOT='C:/Users/Connor/.dotnet'
$env:DOTNET_HOST_PATH='C:/Users/Connor/.dotnet/dotnet.exe'
& $env:DOTNET_HOST_PATH test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-restore --logger 'trx;LogFileName=p4-06.trx' --results-directory .artifacts/redesign-p4-06 -- xUnit.parallelizeTestCollections=false xUnit.maxParallelThreads=1
& $env:DOTNET_HOST_PATH build JobTrackerApi/JobTrackerApi.csproj --configuration Release --no-restore -warnaserror
# In job-tracker-ui:
npm test -- --watchAll=false --runInBand --json --outputFile=../.artifacts/p4-06-jest.json
npm run typecheck
npm run lint
$env:NEXT_PUBLIC_API_BASE_URL='http://localhost:5302/api'
$env:NEXT_TELEMETRY_DISABLED='1'
npm run build
$env:PLAYWRIGHT_STATIC_EXPORT='true'
$env:PLAYWRIGHT_PREBUILT_EXPORT='true'
$env:PLAYWRIGHT_JSON_OUTPUT_FILE='../.artifacts/p4-06-browser.json'
node node_modules/@playwright/test/cli.js test --reporter=list,json
# Run these sequentially; each owns its own disposable API on port 5302.
node node_modules/@playwright/test/cli.js test --config=playwright.rate-limits.config.ts --reporter=list,json
node node_modules/@playwright/test/cli.js test --config=playwright.ingress.config.ts --reporter=list,json
node node_modules/@playwright/test/cli.js test --config=playwright.pdf.config.ts --reporter=list,json
# At repository root:
python scripts/test-ingress.py
python scripts/test-supply-chain.py
python scripts/test-ollama-evaluation.py
node --test browser-extension/tests/*.test.mjs
python scripts/supply-chain.py scan-secrets
python .artifacts/p4-04-check-doc-links.py
git diff --check
git diff --cached --check
```

Special browser reports use separate `PLAYWRIGHT_JSON_OUTPUT_FILE` names (`p4-06-rate-limits.json`, `p4-06-ingress.json`, `p4-06-pdf.json`). Historical capture environment flags remain unset so prior PNGs are never overwritten. An additional ignored TypeScript project includes the two edited e2e files plus MUI augmentation; standalone application TypeScript does not include e2e. No test retries are configured locally. No provider/dependency vulnerability network query or production CI verdict is claimed.

Before push: verify all 57 unique IDs match the source ledger, local Markdown/test links resolve, changed files contain no application/CI/package changes, staged secret/whitespace checks pass. Push only the requested Phase 4 branch, verify remote SHA equals HEAD and the working tree is clean. **Stop before Phase 5 and B07.**

Final scope review: 33 synthetic screenshots, the report/matrix/visual review/result ledger, Phase 4 index/Phase 2 trace/TODO updates, and the two test-readiness edits above. No Phase 4 historical evidence was overwritten. The API/application source trees and CI/package files have no diff from `c99f4fb7`. This completes the acceptance checkpoint with the conditional verdict and open gates stated above; it does not approve deployment or begin the next phase.