# Owner draft protection — v0.19.1 checkpoint

Updated 30 October 2026 after final-package browser continuation. This is a bounded repair in the independent local prototype. It is **not a repair or approval of the live SHS application**, and final browser verification is incomplete.

## What changed

Opening a saved owner job or reading its history no longer counts as an unsaved edit. The job compares its editable fields with their saved values. Reverting a change becomes clean again; valid tag case, spacing and order are equivalent. A successful save advances the saved baseline. Validation failures and stale-save rejections retain both the draft and its original baseline.

Job notes, workflow fields, quote lines and notes, time entries, Materials, customer-transfer selections and reasons, staff enquiries, private photo details, sharing captions and selected upload files remain protected. Opening an untouched quote, time editor or job-customer review is clean. Some unrelated workspace forms still conservatively treat an open editor as dirty; this patch does not claim to replace every form's policy.

Owner navigation, job Back, sign-out and the changed nested Cancel controls use one shared in-page Keep editing / Discard dialog. The first requested action owns the choice; repeated clicks cannot replace it or run the action twice. Keep editing and Escape preserve the draft. The native modal makes its background inert and restores focus to its opener. During a confirmed asynchronous transition, the workspace stays inert. A failed sign-out retains the private workspace and displays its error. Existing identity-change clearing still takes priority.

Conflicting job editors stay mounted but are disabled while another draft needs attention. Private photo edits and customer-sharing text cannot silently replace one another. Clearing a selected photo deliberately returns that selection to a clean state. Quote, time, enquiry and transfer fields are disabled while their corresponding save is in progress. Financial calculations, document history, backend identity rules, permissions, portal/feedback projection and enquiry-upload contracts are unchanged.

## What was verified

- 151 client tests pass, including 26 new baseline/transition cases. They cover field changes, equivalent/reverted values, failed and stale saves, in-flight baselines, one pending action, repeat clicks, failed logout and identity reset.
- 88 structural render cases pass (74 general and 14 reporting). These render HTML; they do not prove browser interactions.
- 36 relevant backend regression cases pass: workflow, time/history, stale customer transfer, private/photo-sharing separation, document revisions and authentication boundaries. The full 662-case v0.19 backend suite was not rerun.
- The production frontend build passes. The existing main-chunk advisory remains (597.04 kB).
- 27 saved accessibility observations and one screenshot record actual fictional-data Chrome Incognito checks: clean open/history/sign-out; real-note protection; Keep editing, Escape and focus return; exact reversion/equivalent tags; 422 and 409 draft retention; corrected save and reopen; one logout after double-clicking Discard; another tab clearing private content on reload; untouched quote cancellation; changed quote price/notes retained by Keep editing.

The request audit records workflow responses 422, 200 and 409. It records three logout requests: two clean sign-outs and one deliberate dirty discard, with no extra request from the double-click. Fixture preparation used test APIs; it is separate from the actual browser actions. No quote was saved and no customer transfer or photo-sharing decision was submitted in this browser session.

## Final-package continuation and remaining checks

On 30 October the unchanged saved v0.19.1 package passed eleven additional workflow groups: clean job/history, dirty quote Cancel/Keep/Discard/reopen, quote save lock, nested Materials and time drafts, private photo caption, proposed sharing text, customer review/preview lock, new-customer enquiry, existing-customer enquiry/save lock, and clean sign-out. The native in-page modal/focus and inert transition were inspected. Test-only request delays outside the package exposed in-flight controls. One fictional private £25 quote and one repeat enquiry were intentionally saved; no transfer or photo sharing was committed.

Selected-file retention/Clear/discard remains unverified: the Chrome upload tool still rejected file selection after Sandy enabled its requested setting and a fresh-tab retry. Native capture also failed. No further setting question is pending, and the unchanged restriction is not being re-probed. The new test tab was closed; one older normal test tab remained listed with a detached debugger, and two older private test tabs could not be inspected. Their cleanup remains unverified.

The final-package evidence is the external `SHS-Leave-Guard-Verification-v0.19.1/closeout/verification.json`, alongside the immutable initial evidence. A summary is preserved in [leave-guard-milestone-checks.json](leave-guard-milestone-checks.json). The final bundle was actually exercised; the entire bounded stage is still not closed. No unlock, old-dialog dismissal or password setup is pending.

## Preservation and restart boundaries

Sandy's review stays on frozen **v0.19.0 at http://localhost:8789/workspace**, PID 58260 at verification. All 331 runtime files still match the v0.19 archive. This task did not operate its tabs, data or session; user-owned data is deliberately not asserted byte-identical because Sandy may edit it. Do not upgrade, rebuild, sign out, restart or stop that preview for these tests.

The final-package QA used port **8790**, separate invented data and normal Chrome after the earlier private-session recovery failed. Sandy's review stayed in a separate in-app browser. The QA process (then PID 62099) stopped cleanly; process identity was verified and Sandy's v0.19 review remained running. Historical IDs are not instructions to stop a current process. Old QA-tab cleanup remains pending; never operate the protected review tabs to finish it.

At the saved v0.19.1 checkpoint, all 53 backend files matched v0.19. Schema, 207 route policies, dependency versions and lock files are unchanged. Recovery remains format 12 with pinned formats 1–11; backend backup metadata remains v0.19.0. No new full backup/restore drill is claimed. The previously completed v0.19 recovery evidence remains historical evidence for the unchanged backend.

The original SHS ZIP rehashes unchanged. Neither reference extraction, normal data nor either protected review was written. Some prior preservation inventories have cloud-only gaps; this patch does not turn them into fresh full verification. Thirty unchanged files in the maintained development source were recovered from the verified v0.19 ZIP after matching Git-index hashes, with their original placeholders retained. They were not protected review or original-source files.

All **45 capabilities** remain tracked and all **14 original SHS findings remain OPEN**. The separately authorised v0.20 photo-format/size stage now has its own guide and evidence; it does not close the selected-file gap here. Full photo-to-gallery publication, wider staff/recurrence/customer flows, real phone/PWA/accessibility tests, delivery, domains, subscriptions, production recovery and live approval remain open.