[pranems]

Summary

Preserve carried data during browser acceptance and publish the atomic prov10 dev/canary registry cutover after complete exact-image target acceptance.

Both apps already serve reviewed PR271 merge b87412b0ad5edac47bf19aaca92bb233c12304ed, digest sha256:302c85387b6ebd352ae88d9648578d22071dddb69c41d60982afb7dbacb5fe93. This PR changes tests, operational tenant-selection tooling, registry roles and documentation, not application code, dependencies, version or the deployed image. Directory bootstrap scripts intentionally require explicit Tenant at parameter binding; generated recovery recipes no longer pin a former tenant. No directory operation was executed. Performance remains UNQUALIFIED under T10-0.55.67-PERF-EXCEPTION-2026-11-03. Customer production is unchanged.

Linked Defect / Plan Reference

• DELIVERY_PLAN.md defect ID: N/A; quarterly ephemeral tenant rollover.
• Audit doc reference: docs/TENANT_10_MIGRATION_EXECUTION_2026_10_30.md, final acceptance and T10-OWN/FP/OPS/HIST/REG corrections.
• ADR (if applicable): N/A; existing fixture and atomic-role seams.

TDD Process

• RED test written first; observed it fail for the expected reason
• GREEN: minimal implementation that turns the test green
• Refactor (if any) keeps the test green
• Permanent regression guard added (where applicable - see existing patterns in api/src/security/)

Observed REDs include the pre-write carried-resource ownership assertion, exact canary fingerprint framing and the staged-role R5 control (expected valid=False, got True, 14/15). The repaired shape suite creates owned schema-valid resources, verifies original-state preservation and proves cleanup on about:blank. Role/purpose-driven R5 controls pass 15/15 without a validator change.

Feature / Bug-Fix Commit Checklist (standing rule)

Every behavioral change must include all that apply. Tick or strike through with N/A + reason.

• Unit Tests - service-level and controller-level coverage of the new behavior. N/A for new runtime tests: runtime trees are unchanged; focused fingerprint/restore controls pass 8/8 and registry controls 15/15.
• E2E Tests - end-to-end spec under api/test/e2e/ exercising the feature through HTTP. N/A for new API specs: no API behavior changes; actual full deployed-target HTTP/auth acceptance is retained.
• Live Integration Tests - new section in scripts/live-test.ps1 runnable against local + Docker + Azure. No new section required for test isolation; unchanged full live runner passes both targets and independent local/Docker lanes.
• Feature Documentation - dedicated doc in docs/ with architecture, RFC references, Mermaid diagrams, test coverage. Updated existing migration execution/RCA record and coupled operator/infrastructure docs.
• INDEX.md Update - add the new doc reference to docs/INDEX.md. N/A: existing indexed document, no new repository document.
• CHANGELOG.md Update - [Unreleased] entry with full test counts and feature summary
• Session & Context Updates - Session_starter.md and docs/CONTEXT_INSTRUCTIONS.md
• Version Management - bump api/package.json (and any other version refs) when behavior changed. N/A: test/operational metadata only; retain explicitly authorized 0.55.67 and unchanged immutable runtime image.
• Response Contract Tests - API responses contain ONLY documented fields (key allowlist assertion at unit + E2E + live). Existing API contracts are unchanged; no new response shape.

Validation Output

Final deployed dev:
  Live: 1841 reported passes, zero failures, 881.3 seconds.
  Browser: 352/352, 52 files, zero skips/flakes/errors.
  Runner elapsed 28951.733 seconds; summed test durations 1149.844 seconds.
Final deployed canary:
  Live: 1841 reported passes, zero failures, 826 seconds.
  Browser: 352/352, 52 files, zero skips/flakes/errors.
  Runner elapsed 28910.438 seconds; summed test durations 1115.685 seconds.
Live counts include four explicit retired-API placeholders per target.
Browser reports: one Chromium worker, immutable before/after spec hashes.
Before final full runs: strict changed-fixture tsc PASS, eleven shape cases
and seventeen numeric/shared-ownership cases PASS per target.
Large non-test wall interval has unverified cause; not service latency.
Post-test preservation: eight original non-log tables per target, no differences.
Retained encrypted credentials: 17 active dev, six active canary verified.
Original inactive archived reveal failures: one dev/four canary, unchanged.
Live runtime: Node v24.22.2, supported LTS, version 0.55.67, Prisma on both.
Registry: only the two authorized role values change; customer state unchanged.
Retention: policy two; dev two revisions; first canary revision recovers forward.
Performance: UNQUALIFIED, explicitly scoped admission exception, not PASS.
Previous correction de0c2234 normal protected push:
  PASS, all 26 Fast gates, 588.2 seconds, no bypass.
Push API unit: 6254/216 suites, no skips.
Push inmemory HTTP E2E: 2514 pass/118 suites; 42 skips/two skipped suites.
Previous tip a8e45218: hosted checks green; COMMENTED review5762712172
found ownership registration ordering and historical-document scope issues.
Both are corrected with safe browser RED/GREEN and explicit historical scope.
Review5763025420 confirmed those two issues resolved, then identified shared
creator ownership and retiring directory defaults. Both corrected in 5a078a5b.
Latest 5a078a5b protected push: PASS, all 26 Fast gates, 869.4 seconds.
API unit 6254/216; inmemory HTTP 2514/118 with 42 explicit skips/two suites.
Jest emitted its worker/open-handle teardown warning; exit zero, not hidden.
Latest exact-tip hosted checks: all seven SUCCESS.
Review5768362818: COMMENTED, not formal approval; concrete threads resolved.
Source-only private-evidence limitation independently verified at 12:43Z.
Normally merged as 759f243a0cbaf2ad8f7caa069787e6ed56eacc69 at 12:44:37Z.
Fetched canonical roles and unchanged customer/runtime trees verified.
Final appended recovery archive: 34 files size/SHA256 verified.
Original 83-file immutable archive retained and referenced, not overwritten.

Commands and results:

• pwsh -NoProfile -File scripts\test-scim-estates.ps1: PASS, 15/15 after observed R5 RED.
• pwsh -NoProfile -File scripts\test-tenant-cutover.ps1: PASS, 14 assertions, no Azure calls.
• pwsh -NoProfile -File scripts\audit-doc-freshness.ps1: PASS, 27 documents.
• npm run docs:mermaid:render -- docs\TENANT_10_MIGRATION_EXECUTION_2026_10_30.md: PASS, two diagrams in both strict themes. Existing competing-renderer warning remains; no global extension changes.
• git diff --check: PASS.
• node scripts\audit-doc-content.mjs: PASS after the first protected push correctly blocked a stale active-bootstrap section at C14; node scripts\test-audit-doc-content.mjs: PASS, 23 controls. The corrected bootstrap resolves its profile from the registry; no gate bypass.
• pwsh -NoProfile -File scripts\test-tenant-rollover-review.ps1: PASS, all twelve offline review cases after observed database/ports RED from an invalid assumption that a next tenant always exists. pwsh -NoProfile -File scripts\test-tenant-rollover.ps1: PASS, all eleven offline contracts, no cloud/Docker access.
• pwsh -NoProfile -File scripts\test-tenant-registry-resolution.ps1: PASS, 28 registry/binding/recovery-recipe assertions after observed REDs. Directory writes were not run.
• npx tsc --noEmit -p C:\Users\v-prasrane\.copilot\session-state\eabfb7d5-cc11-4071-bd25-9d4e9ac67fe7\files\tenant10-preservation-spec-typecheck.json: PASS. Full web tsc retains its known 66-diagnostic/two-production baseline; no new diagnostic claimed clean.
• Exact final live/browser invocations use retained protected acceptance credentials and the unchanged source/digest-bound Invoke-Tenant10TargetAcceptance.ps1; full receipts and spec hashes are retained privately, with public counters in the execution record.
• Independent unchanged-runtime evidence: Prisma unit 6,254/216 suites, Prisma HTTP E2E 2,612/122 suites, explicit inmemory unit 6,254/216. Reused merged inmemory HTTP lane: 2,514 passes/118 suites with 42 explicit skips/two suites; selector exclusions are not represented as full coverage. Exact-image Docker/Prisma and matching local-node/inmemory full live each report 1,841 passes.
• Final git fetch origin master, registry integrity/semantic comparison and runtime source-tree comparison: PASS at merge759f243a. Actual approved SP/tenant/subscription, ready revisions, serving digest, authenticated health/version and private eight-table/credential receipts: PASS. No customer cloud operation.

Standing Rules Acknowledgment

• No em-dash (Unicode U+2014) anywhere in the diff. Verified via Select-String -Pattern ([char]0x2014).
• No git commit --amend on history that has been pushed.
• No new credentials, tokens, or secrets committed to source. Forbidden patterns regression spec at api/src/security/forbidden-source-patterns.spec.ts will catch known anti-patterns.
• Migrations are additive-only (expand-contract for column changes). Migration linter at api/src/scripts/lint-migrations.ts enforces this. No migration file changes here.

Destructive Migration Override (skip if not applicable)

• This PR contains a NEW destructive Prisma migration (DROP TABLE/COLUMN, ALTER COLUMN ... TYPE, RENAME, INSERT ... SELECT FROM)
• I have set ALLOW_DESTRUCTIVE_MIGRATION=1 in the CI environment for this PR
• Justification (required if box above is ticked):

  <!-- Why this destructive change is necessary, what the rollback path is, and which release window it ships in -->
  

N/A: no schema or migration change and no override.

Reviewer Hint

Diff areas worth special attention from the reviewer:

• Owned seeded-shape setup, schema-valid API input and original-state comparison/cleanup, including failure before navigation.
• All 16 numeric settings: actual persisted values after reload, invalid bounds do not PATCH, owned endpoint absence after cleanup.
• R5 negative mutations must operate on actual roles/purposes, not old generation keys.
• Registry diff changes only prov10 to active and prov09 to retiring; permanent/customer objects are unchanged.
• Snapshot fidelity is not zero-loss synchronization. Operational audit timestamps/log additions, original inactive credential failures, default dev/test KEK, single-revision canary recovery and unproven off-device DPAPI portability remain explicit.
• Earlier dev profile-write attribution remains unresolved; scoped restoration and the final complete run prove no current mismatch or recurrence.
• Self-improvement is applied through executable ownership/cleanup/preservation/role controls. Design disposition accepted: cohesive existing seams, no runtime abstraction or gate bypass.

[Copilot]

🟡 Changes recommended

The cleanup target is registered before ownership validation, risking deletion of pre-existing data, and deployment documentation presents outdated configuration and measurements as current.

2 open issues

• Validate ownership before registering the cleanup target · New
• Mark retained estate measurements as historical · New

What changed in this PR

This PR isolates browser acceptance tests from carried data and activates prov10 for dev and canary through the estate registry. Application code, deployed images and customer production remain unchanged; performance remains unqualified under the scoped exception.

Changes:

• Add owned shape fixtures, cleanup and preservation assertions, plus numeric-settings persistence coverage.
• Switch prov10 to active and prov09 to retiring; make rollover tests independent of tenant generations.
• Update acceptance evidence, recovery limitations and operational guidance.

File	Description
web/​e2e/​settings-numeric-persistence.spec.ts	Tests numeric persistence and invalid-bound rejection.
web/​e2e/​seeded-shape-coverage.spec.ts	Uses owned fixtures and verifies cleanup and original-state preservation.
Session_starter.md	Refreshes acceptance status and registry-based bootstrap guidance.
scripts/​test-tenant-rollover-review.ps1	Resolves active fixtures by purpose.
scripts/​test-scim-estates.ps1	Makes negative controls role-driven.
scripts/​scim-estates.json	Activates prov10 and retires prov09.
docs/​UI_GUIDE.md	Records deployed Bulk layout acceptance.
docs/​TENANT_10_MIGRATION_EXECUTION_2026_10_30.md	Consolidates acceptance, preservation and recovery evidence.
docs/​strategy/​ENGINEERING_LESSONS_AND_PATTERNS.md	Documents fixture ownership and role-based testing lessons.
docs/​PHASE_M2_BULK_OPERATIONS.md	Updates layout repair deployment status.
docs/​DEPLOYMENT_INFRASTRUCTURE_AND_FORM_FACTORS.md	Adds prov10 deployment measurements and limitations.
docs/​CONTEXT_INSTRUCTIONS.md	Refreshes migration context and validation status.
CHANGELOG.md	Summarizes isolation, preservation and cutover changes.
.github/​copilot-instructions.md	Adds fixture-safety and generation-independent rollover guidance.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Omitted tenant arguments still target the retiring tenant, and the numeric persistence test can mutate or delete a pre-existing endpoint without verifying fixture ownership.

1 open issue

• Reject pre-existing endpoint IDs before fixture mutation · New

1 previously missed issue

In code that hasn't changed since last review

Tenant defaults still target the retiring tenant after activation

scripts/​scim-estates.json:63

[P2] After this activation, setup-auth-proof-apps.ps1:55 and grant-deploy-sp-directory-access.ps1:62 still default -Tenant to proviam09 and select that tenant's isolated profile, overriding the operator's prov10 bootstrap. Omitting the parameter therefore targets the retiring tenant for proof creation, credential updates or directory grants when its credentials remain usable. Resolve omitted tenant arguments from the active registry, or require an explicit tenant, and cover the post-cutover default behavior.

2 resolved since last review

• Validate ownership before registering the cleanup target
• Mark retained estate measurements as historical

_{Review effort: Balanced}

[pranems]

Addressed the previously missed retiring-tenant default finding in 5a078a5: both directory bootstrap entry points require an explicit Tenant at parameter binding, before profile selection. Existing explicit-tenant invocations remain valid. Generated recovery recipes use explicit placeholders rather than prov09. All 28 registry/binding/recipe controls pass after observed REDs; no directory operation or grant was executed. Final protected push: 26/26 gates PASS, 869.4s. Please review the exact updated tip; performance remains UNQUALIFIED and customer production unchanged.

[Copilot]

🔵 Needs a closer look

The dev/canary registry cutover depends on private exact-image deployment, identity, and state-preservation receipts that require operator verification beyond this source-only review.

1 open issue

• Reject pre-existing endpoint IDs before fixture mutation

_{Review effort: Balanced}

[pranems]

Exact-tip operational evidence independently checked at 2026-11-04T12:43Z, beyond source-only review: actual approved automation app 307af53b-2ba3-459f-91c3-0ca9de9ba8b8, prov10 tenant ea9f551e-8155-4010-87a8-b6fa1459f882 and subscription 71091610-e5bc-44a6-bed7-ca4113b6520a match. ARM resolves both URLs and confirms the admitted digest302c8538, Healthy ready revisions, latest routing100%, dev2/canary1 active revisions within registry maximum2. Authenticated health/version confirms 0.55.67, Prisma and Nodev24.22.2. Protected final read-only proofs after full352 acceptance were decrypted in memory and asserted: eight original tables, zero differences, original source matches saved snapshot, no source/target mutation, retained active credentials17/6 healthy; original inactive archived failures1/4 unchanged. Private reports remain protected; no credentials or row-level data published. Latest exact-tip validate/build-and-push, CodeQL and freshness all pass. Review5768362818 is COMMENTED, not approval; its carried-forward shared-helper thread is addressed by the guard before all optional writes and the exercised safe negative control. Performance remains UNQUALIFIED; customer production was not accessed.

[pranems]

Completed canonical cutover: normal merge759f243a contains exact reviewed green tip5a078a5b. Fetched master validates prov10 active/prov09 retiring; only those two registry values differ, permanent customer entries unchanged. API/web runtime source trees match admitted b87412b exactly. Actual dev/canary are Healthy on 0.55.67/Prisma/Nodev24.22.2 and immutable digest302c8538. Final browser352/52 each, zero skips/failures/flakes; original-state and active-credential proofs pass. Appended protected recovery archive contains34 size/SHA256-verified files; prior83-file immutable index retained. Final index SHA256 C57454FEAD4AB40958FC1D784191A3298B68F129542EC82CEF738E47C5921339. Its PR-body snapshot is pre-publication provenance; merged-pr/canonical-verification/final-publication-verification records capture completion. Performance remains UNQUALIFIED under the scoped exception; later source writes, external-client repointing and off-device DPAPI portability are not claimed. Customer production unchanged.