fix(web): bound Bulk results for tenant 10 migration

CHANGELOG.md

@@ -7,6 +7,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Tenant 10 Bulk result layout repair
+
+- Fix long resource locations and error details widening the Bulk result
+  grid at narrow viewports. Bound its flexible tracks with minmax(0,1fr)
+  and reuse CopyableField for clipped, tooltip-accessible, full-value copying.
+  Missing locations and empty details do not expose meaningless copy buttons.
+- Preserve actual bulk execution, duplicate rejection, failure CSV content,
+  corrected-row retry and owned-fixture cleanup. Add a deterministic
+  long-value regression with 1440 px / 900 px bounds, actual truncation and exact
+  clipboard checks, alongside bulk/manual execution coverage.
+- RED: actual Azure browser run 347/348, no skips/flakes, with one measured
+  layout failure; deterministic long-value case also fails on unchanged
+  Azure image. GREEN: Bulk component 9 to 10 tests, five built-loopback
+  browser flows, production build and strict added-spec type check.
+  Updated full web coverage passes 1,662 tests across 125 files (previously
+  1,661): statements 83.06%, branches 75.86%, functions 75.53%, lines 85.74%.
+  Configured floors pass; branch coverage was previously 75.89%.
+  Reviewed immutable-image publication remains pending. API unit/E2E
+  remain unchanged by this frontend-only delta; no
+  new API run count is claimed here.
+- Full web tsc is not green: executable virtual-HEAD comparison verifies
+  the same 66 diagnostics/two production diagnostics and zero added errors.
+  No visual baseline was regenerated. Version remains 0.55.67 for the
+  operator-authorized migration repair; performance remains unqualified
+  and customer production must not change.
+- Self-improvement applied: long-value fixtures catch environment-dependent
+  grid sizing before deployment. Design disposition accepted: existing
+  copy/truncate composition; no speculative service or strategy extraction.
+
 ### 0.55.67 tenant 10 migration release under a scoped exception
 
 - Record explicit operator authorization

Session_starter.md

@@ -1,5 +1,30 @@
 ## SCIMServer - Condensed Session Memory
 
+**Current tenant 10 checkpoint:** PR270 merged normally as6102aff4 and its
+authoritative scanned image is deployed on dev. Both actual database carries
+passed full nine-table fidelity/schema checks. Available-data authorization
+supersedes waiting for source freeze; performance remains unqualified.
+Dev environment repair has actual-AST RED/GREEN and complete Azure readback.
+Live acceptance reports1,841 passes/zero failures, including four explicitly
+skipped retired-API placeholders. Browser acceptance has347 passes/one
+unintended Bulk layout failure, zero skips/flakes. Canary app remains absent.
+
+Separate repair branch `fix/tenant10-bulk-result-overflow-20261103` uses
+bounded fractional grid tracks and existing CopyableField truncation.
+Deterministic long values reproduce RED on unchanged Azure image. Ten
+component tests, five built-loopback browser flows with migrated-dev backend,
+strict added-spec compilation and production build pass. Actual1440/900px
+bounds, clipping and complete clipboard values are asserted; failed and GREEN
+screenshots were inspected. No baseline regeneration. Virtual HEAD compiler
+comparison verifies unchanged66 errors/two production errors, no additions.
+Updated whole-web coverage passes1,662/125 files, with statements83.06%,
+branches75.86%, functions75.53%, lines85.74%; all size budgets pass.
+Web ESLint remains N/A because no config exists, not a passing lint run.
+Review, corrected-image publication,
+full actual target acceptance, operator visual confirmation and cutover remain
+pending. Customer production is untouched. Older no-app/source-freeze/pending
+release statements below are preparation history, not the current state.
+
 **2026-11-03 authorized migration release:** the operator explicitly authorized
 `T10-0.55.67-PERF-EXCEPTION-2026-11-03` for this 0.55.67 tenant 10 dev/canary
 migration only. Performance remains unqualified; all other security,

docs/CONTEXT_INSTRUCTIONS.md

@@ -16,15 +16,32 @@ data-integrity, functional, browser and migration gate remains mandatory;
 customer production must not change. The existing migration execution document
 records the exact authorization, scope and required merged-commit/image-digest
 binding. Historical no-waiver holds below are superseded, not failed receipts.
-Use release-only branch `ops/tenant10-release-exception-20261103`; keep
-qualification research PR251 draft. Complete API/web trees match integrated
-candidate5823a225 after importing four unchanged version-bearing blobs.
-No runtime, schema, dependency graph, workflow or normal qualification logic
-changes. Root/web dependency restore, unchanged-lock verification, API Prisma
-generation and public-registry/sha512 provenance pass. Normal protected review,
-final immutable artifact, actual target acceptance, source freeze/final carry
-and cutover remain pending. Self-improvement applied: bounded authorization
-and honest pending evidence. Design disposition accepted: no general bypass.
+PR270 merged normally as6102aff4; authoritative41714210347 produced the
+scanned immutable image. Both actual target databases passed complete
+nine-table content/schema/constraint/index equality. The operator explicitly
+accepts available point-in-time data; no source freeze or synchronized
+zero-loss claim is required. Dev is deployed with corrected environment
+values/references, a Healthy revision and authenticated0.55.67/Prisma readback.
+Live acceptance reports1,841 passes/zero failures, including four explicit
+retired-API placeholders that are not exercised checks. Full dev browser
+acceptance has347 passes/one unintended Bulk layout failure, zero skips/flakes.
+
+Current repair branch `fix/tenant10-bulk-result-overflow-20261103` bounds the
+Bulk result grid and reuses existing copy/truncate fields. Unit RED/GREEN,
+five built-loopback frontend/browser flows with the migrated-dev backend,
+strict added-spec compilation and production build pass. Full web tsc remains
+non-green at66 diagnostics/two production diagnostics; executable HEAD
+comparison proves zero added diagnostics. Updated full coverage passes
+1,662 tests / 125 files, with statements83.06%, branches75.86%,
+functions75.53%, lines85.74%; all size budgets pass. Web ESLint remains N/A
+because no config exists. Protected publication, review, a corrected
+immutable image and actual target reruns
+remain mandatory. Canary application, operator visual confirmation and role
+cutover remain pending. No customer-production changes or performance campaign.
+Keep PR251 research draft. Self-improvement applied: deterministic long values,
+actual bounds/clipping/full clipboard assertions and immutable scoped reports.
+Design disposition accepted: existing primitive composition; no general bypass
+or speculative domain-service extraction.
 
 **Authoritative current state:** PR267 is merged at84099293570af5ab06f7d8e2f93e7e6ae2c0236f.
 Reviewed883fb6c6 passes29 protected gates, and exact-tip5757623103 reports

docs/GLOBAL_NAVIGATION_AND_WORKFLOW_CONTEXT.md

@@ -1,6 +1,6 @@
 # Global navigation and workflow context
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
+> **Status:** User-facing reference - **Last verified:** 2026-11-03 - **Product version:** `0.55.67`
 
 See [current release notes](RELEASE_NOTES.md) for deployment and acceptance
 boundaries. Endpoints now uses available window height, Dashboard uses compact
@@ -17,6 +17,13 @@ remains under each trust's More menu. See the
 [isolated integration checkpoint](auth/ENDPOINT_TOKEN_LIFETIME_TDD_HANDOFF.md#current-master-integration-preparation-2026-10-21);
 this is not a deployed navigation change.
 
+**Tested but unreleased Bulk layout repair (2026-11-03):** copying a result
+identifier, location or error detail does not navigate or change endpoint
+selection. Long values are bounded and retain their complete clipboard text.
+The change remains inside the URL-owned Bulk tab; global Back/Forward and
+workflow selection are unchanged. Built loopback frontend checks pass, but
+the corrected Azure image and operator visual acceptance remain pending.
+
 ## Purpose
 
 The admin UI now exposes one global Back/Forward pair and uses endpoint identity according to workflow intent. The top-level workflows remain separate because they answer different operational questions.

docs/PHASE_M2_BULK_OPERATIONS.md

@@ -1,11 +1,47 @@
 # Phase M2 - Bulk Operations UI
 
-> **Date:** 2026-05-15 - **Version:** 0.51.0-alpha.2 - **Predecessor:** v0.51.0-alpha.1 (Phase M1 SCIM Workbench)
+> **Original release:** 2026-05-15 - **Version:** 0.51.0-alpha.2 - **Predecessor:** v0.51.0-alpha.1 (Phase M1 SCIM Workbench)
 > **Origin:** [docs/UI_NEXT_GAPS_LATERAL_ANALYSIS_2026.md](UI_NEXT_GAPS_LATERAL_ANALYSIS_2026.md) S4.3
 > **Scope:** Frontend-only. New per-endpoint Bulk tab + 3 pure modules + 1 free-form mutation hook + the M1-deferred "Save as live-test" emitter wired to Workbench history rows. New live section `9z-AH` adds Bulk UI contract.
 
 ---
 
+## Current layout repair: tested, not yet deployed
+
+Tenant 10 browser acceptance against 0.55.67 exposed result cells overflowing
+the card at a 900 px viewport. Long absolute resource locations expanded CSS
+Grid's `1fr` tracks because their minimum size was content-driven. This was
+an unintended defect; the failure screenshot was inspected and no visual
+baseline was regenerated.
+
+The repair keeps the identifier/status tracks at 80 px and bounds both text
+tracks with `minmax(0, 1fr)`. Result identifiers, actual locations and actual
+error details use [CopyableField](../web/src/components/primitives/CopyableField.tsx)
+with truncation. Full values remain available through tooltips and copying;
+missing locations and empty details retain non-copyable placeholders.
+Bulk request/response semantics, success/failure badges, CSV failure export
+and retry behavior are unchanged.
+
+| Claim | Verification |
+|---|---|
+| Complete DOM values and copy affordances | Component regression observed RED, then 10/10 component tests passed |
+| Bounded layout independent of hostname | Deterministic long URL/error fixture fails on unchanged Azure image, then passes on built loopback frontend at 1440 px and 900 px |
+| Actual truncation, not CSS presence alone | Browser asserts positive client width and scrollWidth greater than clientWidth on each truncation element |
+| Full values remain copyable | Browser reads clipboard and compares the entire location and error detail |
+| Execution and cleanup still work | Five bulk/manual browser flows pass with migrated-dev backend; real creation, duplicate, retry, CSV content and owned-fixture deletion remain asserted |
+
+The passing frontend is an owned loopback production build, not a repaired
+Azure deployment. Reviewed publication, a new immutable image and complete
+actual dev/canary acceptance remain mandatory. Performance remains unqualified
+under the migration-only exception; customer production is excluded.
+
+Self-improvement applied: deterministic long-value coverage catches the
+deployment-hostname gap before another migration. Design disposition accepted:
+reuse the existing primitive and keep rendering inside the cohesive Bulk tab;
+no new domain service, strategy or dependency is justified.
+
+---
+
 ## 1. Why this exists
 
 [docs/UI_NEXT_GAPS_LATERAL_ANALYSIS_2026.md](UI_NEXT_GAPS_LATERAL_ANALYSIS_2026.md) S4.3 names the Bulk Operations UI as a Tier 1 Operational Completeness gap. The backend has shipped the full surface since v0.18.0: