[pranems]

Summary

Fix the unintended narrow-viewport Bulk result overflow found during tenant 10 acceptance. Bound the flexible grid tracks and reuse existing copy/truncate fields without changing request/response semantics or rewriting visual baselines.

This is a frontend-only repair for the operator-authorized 0.55.67 dev/canary migration. Performance remains UNQUALIFIED under T10-0.55.67-PERF-EXCEPTION-2026-11-03; no other gate is waived and customer production must not change. Version, API runtime, schema, dependencies, lockfiles, workflows and qualification rules are unchanged.

The current Azure image remains the reviewed 6102aff4 artifact. This patch is tested on an owned built-loopback frontend with migrated-dev backend, not yet deployed. A reviewed merge, corrected immutable image, updated source/digest binding and complete actual target reruns remain mandatory.

Linked Defect / Plan Reference

• DELIVERY_PLAN.md defect ID: N/A; migration acceptance failure AD-6.
• Audit doc reference: migration execution record, AD-6 through AD-9; Bulk repair evidence.
• ADR (if applicable): N/A; existing primitive composition, not a new architecture.

TDD Process

• RED test written first; observed it fail for the expected reason. Actual dev 347/348: four cells overflowed at 900 px. The component regression failed for the missing copyable-value field. A deterministic long-value browser case also failed on the unchanged Azure image.
• GREEN: minimal implementation that turns the test green. Component 10/10; five built-loopback bulk/manual browser flows, with zero skips/failures/flakes.
• Refactor (if any) keeps the test green. Use existing CopyableField; do not create copy state or a new service.
• Permanent regression guard added (where applicable - see existing patterns in api/src/security/). Long-value fixture measures 1440/900 px bounds, actual truncation and full clipboard values.

Feature / Bug-Fix Commit Checklist (standing rule)

Every behavioral change must include all that apply. Tick or strike through with N/A + reason.

• Unit Tests - service-level and controller-level coverage of the new behavior. N/A for unchanged API; Bulk component regression adds one test (9 to 10).
• E2E Tests - end-to-end spec under api/test/e2e/ exercising the feature through HTTP. N/A for unchanged API; browser spec verifies real bulk creation, duplicate/conflict, retry, failure CSV and cleanup, plus deterministic layout.
• Live Integration Tests - new section in scripts/live-test.ps1 runnable against local + Docker + Azure. N/A for frontend layout; existing actual dev live run reports 1,841 passes, zero failures, with four explicit retired-API placeholders not claimed as exercised checks. Corrected-image target acceptance remains pending.
• Feature Documentation - dedicated doc in docs/ with architecture, RFC references, Mermaid diagrams, test coverage. Refresh existing Bulk guide and record failure/repair provenance.
• INDEX.md Update - add the new doc reference to docs/INDEX.md. N/A: existing indexed feature document updated, no new feature document.
• CHANGELOG.md Update - [Unreleased] entry with full test counts and feature summary.
• Session & Context Updates - Session_starter.md and docs/CONTEXT_INSTRUCTIONS.md.
• Version Management - bump api/package.json (and any other version refs) when behavior changed. Deliberately retain 0.55.67 for the operator-authorized migration repair; no new public release or customer-prod promotion.
• Response Contract Tests - API responses contain ONLY documented fields (key allowlist assertion at unit + E2E + live). N/A: API serialization unchanged; existing contract gates remain mandatory.

Validation Output

npx vitest run src\pages\BulkTab.test.tsx --maxWorkers=2
  PASS: 10 tests.

npm run test:coverage -- --maxWorkers=2
  PASS: 1,662 tests / 125 files, 619.76s.
  Statements 83.06%, branches 75.86%, functions 75.53%, lines 85.74%.

npm run build
  PASS: production frontend build.

npm run size
  PASS: all configured budgets.

Strict added-browser-spec compilation
  PASS: owned type roots, no dependency borrowing.

Full npx tsc --noEmit
  FAIL at existing baseline: 66 diagnostics, two production diagnostics.
  Executable virtual-HEAD comparison: same baseline, zero added diagnostics.

Built-loopback browser probe, with migrated-dev API backend
  PASS: five bulk/manual tests, zero skips/failures/flakes, 18.656s.
  Not corrected-image Azure acceptance or operator visual approval.

Web ESLint
  N/A: no web eslint.config exists; targeted configuration-discovery attempt failed.

Protected Validate publication
  PASS: all 29 gates, 982.8s, reviewed candidate 506de44b.
  API unit 6,254 tests / 216 suites.
  Inmemory API E2E 2,514 tests / 118 suites, with 42 tests / 2 suites explicitly skipped.
  Web 1,662 tests / 125 files.
  Static, source type ratchet, builds, rendering, migration and governance checks pass.

The actual Azure full browser failure is preserved: 347 passes, one unintended layout failure, zero skips/flakes, 1,037.046s. Failure and corrected screenshots were inspected; no diff PNG was generated and no visual baseline was regenerated. Earlier successful source/image/live evidence is not relabeled as corrected-image acceptance.

The separate numeric-settings acceptance spec remains outside this focused commit.

Standing Rules Acknowledgment

• No em-dash (Unicode U+2014) anywhere in the diff. Verified via Select-String -Pattern ([char]0x2014). Authored additions are ASCII; protected static verification remains mandatory.
• No git commit --amend on history that has been pushed.
• No new credentials, tokens, or secrets committed to source. Forbidden patterns regression spec at api/src/security/forbidden-source-patterns.spec.ts will catch known anti-patterns.
• Migrations are additive-only (expand-contract for column changes). Migration linter at api/src/scripts/lint-migrations.ts enforces this. N/A: no migrations.

Destructive Migration Override (skip if not applicable)

N/A: no schema or migration change.

• This PR contains a NEW destructive Prisma migration (DROP TABLE/COLUMN, ALTER COLUMN ... TYPE, RENAME, INSERT ... SELECT FROM)
• I have set ALLOW_DESTRUCTIVE_MIGRATION=1 in the CI environment for this PR
• Justification (required if box above is ticked):

  <!-- Why this destructive change is necessary, what the rollback path is, and which release window it ships in -->
  

Reviewer Hint

Diff areas worth special attention from the reviewer:

• BulkTab grid tracks and CopyableField composition must bound all four cells while preserving full values, placeholders, badges and existing execution behavior.
• Browser regression must measure real bounds and clipping, not CSS presence alone; clipboard assertions compare entire values.
• Migration documentation must keep deployed old-image evidence, unreleased preview evidence, existing type errors and pending corrected-image acceptance distinct.
• Self-improvement applied: long-value fixtures remove hostname-dependent blind spots. Design disposition accepted: cohesive rendering change using an existing primitive; no speculative strategy/service extraction.

[Copilot]

🔵 Needs a closer look

Only loopback frontend evidence is available; corrected-image dev/canary browser acceptance and explicit operator visual confirmation still require human follow-through.

No open issues 🎉

What changed in this PR

This frontend-only repair addresses Bulk result overflow found during tenant 10 migration acceptance. It bounds long values using existing UI primitives without changing API behavior, dependencies, or visual baselines.

Changes:

• Bound flexible result-grid columns and add truncation with full-value copying for identifiers, locations, and error details.
• Add component and browser regressions covering long values, wide/narrow layouts, clipboard contents, execution flows, and fixture cleanup.
• Document repair evidence separately from deployed-image acceptance. Corrected Azure image validation and operator visual approval remain pending; customer production is unchanged.

File	Description
web/​src/​pages/​BulkTab.tsx	Bounds grid tracks and reuses copyable, truncated result fields.
web/​src/​pages/​BulkTab.test.tsx	Checks complete long values and copy controls.
web/​e2e/​bulk-and-manual-execution.spec.ts	Adds layout, clipboard, execution, and cleanup coverage.
Session_starter.md	Records the migration checkpoint and pending repair acceptance.
docs/​UI_GUIDE.md	Describes unreleased truncation and copying behavior.
docs/​TENANT_10_MIGRATION_EXECUTION_2026_10_30.md	Records deployment evidence, repair results, and execution issues.
docs/​strategy/​ENGINEERING_LESSONS_AND_PATTERNS.md	Documents deterministic long-value layout testing.
docs/​PHASE_M2_BULK_OPERATIONS.md	Explains the repair and its verification boundaries.
docs/​GLOBAL_NAVIGATION_AND_WORKFLOW_CONTEXT.md	Clarifies that copying preserves navigation and endpoint selection.
docs/​CONTEXT_INSTRUCTIONS.md	Updates migration status, validation evidence, and remaining gates.
CHANGELOG.md	Adds the unreleased repair summary and validation results.

_{Review effort: Balanced}

[pranems]

The existing migration-only performance admission T10-0.55.67-PERF-EXCEPTION-2026-11-03 is now bound to the reviewed Bulk repair:

• Version: 0.55.67.
• Reviewed tip: 506de44; independent review 5760950082 was COMMENTED with no open issues, not formal approval.
• Normal merge: b87412b.
• Authoritative merged-source build: https://github.com/pranems/SCIMServer/actions/runs/41740133535 (SUCCESS).
• Merged CodeQL: https://github.com/pranems/SCIMServer/actions/runs/41740131930 (SUCCESS).
• Immutable image: ghcr.io/pranems/scimserver@sha256:302c85387b6ebd352ae88d9648578d22071dddb69c41d60982afb7dbacb5fe93.
• Producer and independent container smoke pull reported the same digest. HIGH/CRITICAL Trivy passed.
  Performance remains UNQUALIFIED. Every other applicable security, data-integrity, functional, migration and measured browser gate remains mandatory. Corrected-image Azure acceptance and operator visual confirmation are pending. Customer production is excluded and unchanged. PR ci: qualify membership performance on isolated Linux runners #251 remains draft research; no performance campaign or threshold change is authorized.