phase 16 implementation

docs/phase15/ABUSE_CONTROL_REPORT_v1.0.md

@@ -0,0 +1,22 @@
+# Phase 15 Abuse-control Report
+
+**Date:** 2026-06-25  
+**Status:** Partial static controls; production gate blocked
+
+## Summary
+
+The API enforces a 16 KiB body limit, request marker, origin check, strict schema, content type, and honeypot. No distributed rate limit or approved CAPTCHA/accessibility alternative exists.
+
+## Executed evidence
+
+- Static API controls pass.
+- Exact content type defect fixed.
+
+## Unexecuted or blocked evidence
+
+- Rapid requests, oversized/malformed payloads, origins, scripted submissions, slow assistive-technology users, international formats, threshold behavior.
+- Distributed rate limiting and operational monitoring.
+
+## Release disposition
+
+Production submission remains blocked.

docs/phase15/ANALYTICS_VALIDATION_REPORT_v1.0.md

@@ -0,0 +1,21 @@
+# Phase 15 Analytics Validation Report
+
+**Date:** 2026-06-25  
+**Status:** Static contract passed; provider/runtime blocked
+
+## Summary
+
+The allowlisted event schema permits only route, locale, direction, resolved theme, source, step, error code/count, and reason values. The current sink has no network and requires test consent.
+
+## Executed evidence
+
+- Analytics/privacy validators pass.
+- Forbidden payload keys include name, email, company, message, phone, field value, and server response.
+
+## Unexecuted or blocked evidence
+
+- Provider, consent gating in real browser, duplicate hydration events, route changes, captured event evidence, retention, region, DPA.
+
+## Release disposition
+
+Analytics must remain disabled.

docs/phase15/AUTOMATED_ACCESSIBILITY_REPORT_v1.0.md

@@ -0,0 +1,21 @@
+# Phase 15 Automated Accessibility Report
+
+**Date:** 2026-06-25  
+**Status:** Blocked
+
+## Summary
+
+Axe suites are authored for shell, homepage, component system, and demo workflow. They could not execute on the final Phase 15 tree.
+
+## Executed evidence
+
+- A11y source scenarios inspected.
+- Static semantic controls and WCAG matrix prepared.
+
+## Unexecuted or blocked evidence
+
+- Axe results for EN/FR/AR, themes, mobile, form states, dialogs, FAQ, scheduler, forced colors.
+
+## Release disposition
+
+No automated accessibility pass is claimed.

docs/phase15/BROWSER_HISTORY_REPORT_v1.0.md

@@ -0,0 +1,21 @@
+# Phase 15 Browser History and Navigation Report
+
+**Date:** 2026-06-25  
+**Status:** Blocked
+
+## Summary
+
+Source avoids form values in URLs and keeps the demo in a dialog on the localized homepage. Direct entry, locale/theme changes, back/forward, refresh, success, resubmit, deep links, and external return were not executed.
+
+## Executed evidence
+
+- Static privacy audit finds no form-value URL construction.
+- Authored browser scenarios include success URL checks.
+
+## Unexecuted or blocked evidence
+
+- Complete back/forward/refresh/modal/scheduler/hash/redirect history matrix and focus restoration.
+
+## Release disposition
+
+History behavior is unverified on the final candidate.

docs/phase15/BUNDLE_ANALYSIS_REPORT_v1.0.md

@@ -0,0 +1,21 @@
+# Phase 15 Bundle Analysis Report
+
+**Date:** 2026-06-25  
+**Status:** Blocked for final build
+
+## Summary
+
+Source review confirms no new runtime dependency was added and the content-type helper is server-side. Final route chunks and client boundaries could not be measured.
+
+## Executed evidence
+
+- Direct dependency pins and lockfile contract pass.
+- No vendor SDK, consent manager, scheduler, email, or analytics network package is present.
+
+## Unexecuted or blocked evidence
+
+- Production route bundle sizes, duplicate packages/locales/icons, source maps, tree shaking, dynamic imports, and client secret inspection.
+
+## Release disposition
+
+Bundle approval requires the final production build.

docs/phase15/CLEAN_ROOM_BASELINE_REPORT_v1.0.md

@@ -0,0 +1,24 @@
+# Phase 15 Clean-room Baseline Report
+
+**Date:** 2026-06-25  
+**Status:** Blocked / failed acceptance
+
+## Summary
+
+The supplied ZIP was extracted into a fresh directory and its Phase 14 manifest verified 466 files. The exact Phase 15 clean install could not begin because the host does not provide the pinned Node/pnpm toolchain and cannot resolve the package registry.
+
+## Executed evidence
+
+- Fresh archive manifest passed (C15-001).
+- ZIP SHA-256 and lockfile SHA-256 are recorded in the implementation report.
+- No dependency or lockfile update was performed.
+
+## Unexecuted or blocked evidence
+
+- Node 24.17.0 is not installed; observed Node is 22.16.0.
+- pnpm 11.9.0 activation failed because registry DNS is unavailable.
+- Frozen install and every dependency-backed command are blocked.
+
+## Release disposition
+
+This gate fails Phase 15 acceptance. A connected clean runner using the pinned versions must rerun the complete matrix.

docs/phase15/COMMAND_MATRIX_v1.0.csv

@@ -0,0 +1,27 @@
+ID,Command,Environment,Status,Exit_code,Duration_seconds,Test_count,Pass_count,Failure_count,Skipped_count,Warning_count,Evidence_path,Related_defects,Notes
+C15-001,node scripts/validate-phase14-manifest.mjs,Fresh extraction of supplied Phase 14 ZIP; Node 22.16.0,Passed,0,0.22,466 files,466,0,0,0,docs/quality/phase15-command-logs/02-phase14-manifest-baseline.log,,Verified the supplied archive before Phase 15 modifications.
+C15-002,corepack prepare pnpm@11.9.0 --activate,Debian 13; Node 22.16.0; Corepack 0.32.0; registry DNS unavailable,Blocked,1,0.17,1,0,1,0,0,docs/quality/PHASE_15_TOOLCHAIN_SETUP.log,P14-009; P15-005,Could not download the pinned package manager.
+C15-003,pnpm install --frozen-lockfile,Required Node 24.17.0 and pnpm 11.9.0,Not executed - prerequisite blocked,,,,,,,,docs/quality/PHASE_15_TOOLCHAIN_SETUP.log,P14-009; P15-005,No pnpm binary and no registry DNS. No dependency update was attempted.
+C15-004,node scripts/run-validations.mjs,Current Phase 15 tree; Node 22.16.0; no installed packages required,Passed,0,1.52,16 validators,16,0,0,0,docs/quality/phase15-command-logs/10-final-validations.log,P15-001; P15-002; P15-003; P15-004,Repository-native dependency-free validators.
+C15-005,python3 scripts/phase15-static-audit.py --root /mnt/data/phase14_baseline,Fresh Phase 14 extraction; Python 3.13.5,Failed as expected - baseline findings,1,1.37,467 files,,11 findings,0,0,docs/quality/PHASE_15_BASELINE_STATIC_AUDIT_RESULTS_v1.0.json,P15-001; P15-002; P15-003; P15-004,Found 4 High and 7 Medium defects before fixes.
+C15-006,python3 scripts/phase15-static-audit.py,Current Phase 15 tree; Python 3.13.5,Passed,0,1.38,544 files,544,0,0,0,docs/quality/phase15-command-logs/13-final-static-audit.log,P15-001; P15-002; P15-003; P15-004,No findings under the same audit after remediation.
+C15-007,node --experimental-strip-types media-type behavior assertions,Node 22.16.0,Passed with runtime warnings,0,1.37,8 assertions,8,0,0,2,docs/quality/phase15-command-logs/08-content-type-behavior.log,P15-002,Warnings concern experimental type stripping and do not affect the assertions.
+C15-008,node --check scripts; node --experimental-strip-types --check TypeScript; python3 -m py_compile audit,Node 22.16.0; Python 3.13.5,Passed,0,6.76,99 files,99,0,0,0,docs/quality/phase15-command-logs/09-syntax-check.log,,"33 JavaScript modules, 64 TypeScript modules, and two Python scripts."
+C15-009,pnpm format:check,Exact pinned toolchain and installed dependencies required,Not executed - clean install blocked,,,,,,,,docs/quality/PHASE_15_TOOLCHAIN_SETUP.log,P15-005,Formatting validation
+C15-010,pnpm lint,Exact pinned toolchain and installed dependencies required,Not executed - clean install blocked,,,,,,,,docs/quality/PHASE_15_TOOLCHAIN_SETUP.log,P15-005,ESLint
+C15-011,pnpm typecheck,Exact pinned toolchain and installed dependencies required,Not executed - clean install blocked,,,,,,,,docs/quality/PHASE_15_TOOLCHAIN_SETUP.log,P15-005,Next type generation and strict TypeScript
+C15-012,pnpm test:unit,Exact pinned toolchain and installed dependencies required,Not executed - clean install blocked,,,,,,,,docs/quality/PHASE_15_TOOLCHAIN_SETUP.log,P15-005,Unit tests and coverage
+C15-013,pnpm test:integration,Exact pinned toolchain and installed dependencies required,Not executed - clean install blocked,,,,,,,,docs/quality/PHASE_15_TOOLCHAIN_SETUP.log,P15-005,Integration tests
+C15-014,pnpm test:browser,Exact pinned toolchain and installed dependencies required,Not executed - clean install blocked,,,,,,,,docs/quality/PHASE_15_TOOLCHAIN_SETUP.log,P15-005,Functional browser tests
+C15-015,pnpm test:a11y,Exact pinned toolchain and installed dependencies required,Not executed - clean install blocked,,,,,,,,docs/quality/PHASE_15_TOOLCHAIN_SETUP.log,P15-005,Automated accessibility tests
+C15-016,pnpm test:visual,Exact pinned toolchain and installed dependencies required,Not executed - clean install blocked,,,,,,,,docs/quality/PHASE_15_TOOLCHAIN_SETUP.log,P15-005,Visual-regression tests
+C15-017,pnpm test:e2e,Exact pinned toolchain and installed dependencies required,Not executed - clean install blocked,,,,,,,,docs/quality/PHASE_15_TOOLCHAIN_SETUP.log,P15-005,Aggregate Playwright tests
+C15-018,pnpm test:security,Exact pinned toolchain and installed dependencies required,Not executed - clean install blocked,,,,,,,,docs/quality/PHASE_15_TOOLCHAIN_SETUP.log,P15-005,Package-script security validation; underlying static validator ran through C15-004
+C15-019,pnpm test:privacy,Exact pinned toolchain and installed dependencies required,Not executed - clean install blocked,,,,,,,,docs/quality/PHASE_15_TOOLCHAIN_SETUP.log,P15-005,Package-script privacy validation; underlying static validator ran through C15-004
+C15-020,SITE_ORIGIN=https://approved.example PUBLIC_RELEASE_APPROVED=false pnpm build,Exact pinned toolchain and installed dependencies required,Not executed - clean install blocked,,,,,,,,docs/quality/PHASE_15_TOOLCHAIN_SETUP.log,P15-005,Production build
+C15-021,pnpm audit --audit-level low,Exact pinned toolchain and installed dependencies required,Not executed - clean install blocked,,,,,,,,docs/quality/PHASE_15_TOOLCHAIN_SETUP.log,P15-005,Registry-backed dependency audit
+C15-022,pnpm exec playwright install --with-deps chromium firefox webkit,Exact pinned toolchain and installed dependencies required,Not executed - clean install blocked,,,,,,,,docs/quality/PHASE_15_TOOLCHAIN_SETUP.log,P15-005,Pinned browser installation
+C15-023,Performance audit commands,Exact pinned toolchain and installed dependencies required,Not executed - clean install blocked,,,,,,,,docs/quality/PHASE_15_TOOLCHAIN_SETUP.log,P15-005,Lighthouse/Web Vitals and route timing
+C15-024,Production-like deployment and smoke commands,Exact pinned toolchain and installed dependencies required,Not executed - clean install blocked,,,,,,,,docs/quality/PHASE_15_TOOLCHAIN_SETUP.log,P15-005,Deployment rehearsal
+C15-025,Rollback platform commands,Exact pinned toolchain and installed dependencies required,Not executed - clean install blocked,,,,,,,,docs/quality/PHASE_15_TOOLCHAIN_SETUP.log,P15-005,Rollback rehearsal
+C15-026,node scripts/generate-phase15-manifest.mjs && node scripts/validate-phase15-manifest.mjs,Final Phase 15 repository; Node 22.16.0; dependency-free,Passed,0,0.52,548 files,548,0,0,0,docs/quality/phase15-command-logs/12-phase15-package-manifest.log,,The validation log is explicitly excluded from its own manifest to avoid a self-referential checksum.

docs/phase15/CONSENT_VALIDATION_REPORT_v1.0.md

@@ -0,0 +1,23 @@
+# Phase 15 Consent Validation Report
+
+**Date:** 2026-06-25  
+**Status:** Blocked by product/legal decisions
+
+## Summary
+
+Analytics is disabled by default and optional marketing consent is not implemented. This prevents premature vendor loading but does not constitute a complete consent system.
+
+## Executed evidence
+
+- Static environment defaults prohibit production analytics.
+- Test analytics requires an explicit test-only document flag.
+- Consent matrix reviewed.
+
+## Unexecuted or blocked evidence
+
+- No-choice, necessary-only, accept/reject, withdrawal, returning visitor, locale change, consent version, vendor failure, delayed JavaScript.
+- Localized approved legal language and storage mechanism.
+
+## Release disposition
+
+No consent-compliance claim is permitted.

docs/phase15/CONTENT_EVIDENCE_REVIEW_v1.0.md

@@ -0,0 +1,22 @@
+# Phase 15 Content and Evidence Review
+
+**Date:** 2026-06-25  
+**Status:** Static prohibited-content controls passed; approvals blocked
+
+## Summary
+
+Runtime validation finds no TODO/TBD/lorem, invented metrics, fake quotes, guessed external destinations, or research-only backdoor. Public claims and assets still require accountable approval.
+
+## Executed evidence
+
+- Prohibited-content validator passes.
+- No production image/logo/customer evidence asset is present.
+- Pending legal and unsupported destinations remain gated.
+
+## Unexecuted or blocked evidence
+
+- Native linguistic approval, claims, customer logos/testimonials, security/compliance statements, pricing, screenshots, contact details, legal content.
+
+## Release disposition
+
+Content is structurally safe but not final-approved.

docs/phase15/CROSS_BROWSER_TEST_REPORT_v1.0.md

@@ -0,0 +1,22 @@
+# Phase 15 Cross-browser Test Report
+
+**Date:** 2026-06-25  
+**Status:** Blocked
+
+## Summary
+
+The configured matrix includes Chromium, Firefox, WebKit, mobile Chrome, and mobile Safari. No current application run was possible.
+
+## Executed evidence
+
+- Playwright project configuration statically reviewed.
+- Canonical visual snapshots are now Chromium-only; other engines remain functional targets.
+
+## Unexecuted or blocked evidence
+
+- Browser installation in the pinned environment.
+- Functional results by browser/version/OS/device/locale/theme/viewport.
+
+## Release disposition
+
+No browser support claim is approved from configuration alone.

docs/phase15/DEFECT_REGISTER_v1.0.csv

@@ -0,0 +1,6 @@
+ID,Summary,Severity,User_impact,Business_impact,Security_impact,Privacy_impact,Accessibility_impact,Affected_locale,Affected_theme,Affected_browser,Affected_viewport,Reproduction_steps,Expected_behavior,Actual_behavior,Evidence,Owner,Status,Release_disposition,Resolution_commit,Retest_result
+P15-001,Two release-evidence CSV files had inconsistent column counts,High,Indirect; evidence could be misread or fields shifted,Release decisions could use corrupted issue or QA records,None direct,None direct,None direct,All,All,All,All,Parse all repository CSV files with a standards-compliant CSV reader,Every row matches the header width,P14-009 had 11 fields instead of 9; P14-M10 had 10 instead of 11,PHASE_15_BASELINE_STATIC_AUDIT_RESULTS_v1.0.json,Engineering + QA,Resolved,Fixed in Phase 15,Unavailable; supplied archive had no Git metadata,All CSV files parse; C15-004 and C15-006 pass
+P15-002,Demo API accepted JSON look-alike media types by prefix,Medium,Malformed clients could reach JSON parsing instead of receiving 415,Ambiguous API contract and weaker request validation,Broader-than-documented content-type acceptance,No direct data exposure identified,None,All,All,All clients,N/A,Send Content-Type application/jsonp,415 unsupported_content_type,Prefix check treated it as JSON,PHASE_15_BASELINE_STATIC_AUDIT_RESULTS_v1.0.json,Engineering + Security,Resolved,Fixed in Phase 15,Unavailable; supplied archive had no Git metadata,Eight dependency-free assertions pass; Vitest regression authored but not run
+P15-003,Visual tests used a stale theme key and inconsistent snapshot project scope,Medium,Dark-mode regressions could be recorded under the wrong theme,Unreliable visual approval evidence,None,None,Theme contrast regressions could be missed,EN/FR/AR,Dark/system,All Playwright projects,Configured visual matrix,Inspect component-system visual setup and run snapshots outside Chromium,Canonical theme key; canonical Chromium snapshots only,Unused storage key and non-canonical project execution,PHASE_15_BASELINE_STATIC_AUDIT_RESULTS_v1.0.json,Engineering + Design QA,Resolved,Fixed; browser retest still blocked,Unavailable; supplied archive had no Git metadata,Static regression validator passes; browser snapshots not executed
+P15-004,CI omitted the demo-service integration test suite,High,Server-side conversion failures could merge undetected,Primary lead workflow lacked CI integration protection,Adapter error/timeout/idempotency regressions could escape CI,Boundary regressions could escape CI,None direct,All,All,Server boundary,N/A,Inspect Phase 14 CI quality job,CI runs pnpm test:integration,Only unit and Playwright suites were configured,PHASE_15_BASELINE_STATIC_AUDIT_RESULTS_v1.0.json,Engineering + QA,Resolved,CI command added; execution pending connected CI,Unavailable; supplied archive had no Git metadata,Phase 15 validator confirms command presence; integration suite not locally executed
+P15-005,"Final Phase 15 dependency-backed, browser, performance, deployment, rollback, and manual QA evidence is incomplete",High,"Accessibility, browser, performance, and conversion defects may remain undiscovered",Release readiness cannot be established,Dependency and dynamic security checks are stale or absent,Runtime analytics/consent behavior lacks current browser evidence,"Manual WCAG, keyboard, screen-reader, zoom, and reflow evidence absent",EN/FR/AR,Light/dark/system,Chromium/Firefox/WebKit/mobile engines,1440/1024/768/390/320 and zoom states,Attempt pinned toolchain activation and frozen install,Exact toolchain installs and all Phase 15 gates execute,"Host has Node 22.16.0, no pnpm, no registry DNS, and no project dependencies",PHASE_15_TOOLCHAIN_SETUP.log; COMMAND_MATRIX_v1.0.csv,Engineering + QA + Accessibility + Security,Open - environment blocked,Blocks Phase 15 acceptance and Phase 16 readiness,N/A,Not retested; requires connected pinned CI and human QA

docs/phase15/DEPLOYMENT_REHEARSAL_REPORT_v1.0.md

@@ -0,0 +1,21 @@
+# Phase 15 Deployment Rehearsal Report
+
+**Date:** 2026-06-25  
+**Status:** Not run
+
+## Summary
+
+No production-like deployment was built or started from the Phase 15 manifest. Historical Phase 14 standalone HTTP evidence is retained but stale after code and CI changes.
+
+## Executed evidence
+
+- Dockerfile and CI deployment build path statically reviewed.
+- Production environment defaults fail closed.
+
+## Unexecuted or blocked evidence
+
+- Clean build, assets, headers, redirects, metadata, robots, health/startup failure, flags, observability, no test adapter, exact commands and timing.
+
+## Release disposition
+
+Deployment gate blocks release.

docs/phase15/DESIGN_FIDELITY_REPORT_v1.0.md

@@ -0,0 +1,21 @@
+# Phase 15 Design Fidelity Report
+
+**Date:** 2026-06-25  
+**Status:** Blocked for visual comparison
+
+## Summary
+
+Section order and component composition validators pass, but no rendered comparison against Phase 7 production designs was performed.
+
+## Executed evidence
+
+- Homepage composition and content-model validators pass.
+- Design-token immutability and semantic color controls pass.
+
+## Unexecuted or blocked evidence
+
+- Typography, spacing, alignment, media scale, responsive adaptation, themes, RTL, focus, loading, error, and success visual comparison.
+
+## Release disposition
+
+Design fidelity is unverified, not failed.

docs/phase15/DESTINATION_BROKEN_LINK_REPORT_v1.0.md

@@ -0,0 +1,23 @@
+# Phase 15 Destination and Broken-link Report
+
+**Date:** 2026-06-25  
+**Status:** Static registry passed; external destinations blocked
+
+## Summary
+
+The route and destination validators pass. Demo is local-only; contact sales, product tour, login, cookie settings, and support are blocked; pricing/legal/accessibility routes are placeholders.
+
+## Executed evidence
+
+- Five route IDs have complete locale/hash/query/hreflang contracts.
+- No unapproved runtime external URL was found.
+- Destination registry is explicit.
+
+## Unexecuted or blocked evidence
+
+- Rendered broken-link crawl of generated routes.
+- Production URLs, redirects, status codes, canonical/hreflang, external security behavior.
+
+## Release disposition
+
+Blocked destinations must not be activated until approved.

docs/phase15/DEVICE_VIEWPORT_REPORT_v1.0.md

@@ -0,0 +1,21 @@
+# Phase 15 Device and Viewport Report
+
+**Date:** 2026-06-25  
+**Status:** Blocked for rendered validation
+
+## Summary
+
+Responsive CSS and authored tests cover the required widths, but no final rendered matrix was observed.
+
+## Executed evidence
+
+- Logical CSS validator passes across 47 CSS files.
+- Authored scenarios include 1440, 1024, 768, 390, and 320 widths.
+
+## Unexecuted or blocked evidence
+
+- Horizontal overflow, clipping, focus visibility, touch targets, safe areas, reduced height, and mobile landscape checks.
+
+## Release disposition
+
+Responsive implementation remains unaccepted until browser evidence is attached.

docs/phase15/END_TO_END_TEST_REPORT_v1.0.md

@@ -0,0 +1,22 @@
+# Phase 15 End-to-End Test Report
+
+**Date:** 2026-06-25  
+**Status:** Blocked
+
+## Summary
+
+The repository contains authored Playwright flows for locale pages, navigation, the demo workflow, responsive states, no-JavaScript behavior, accessibility, and visual checks. No current Phase 15 browser flow executed.
+
+## Executed evidence
+
+- Scenario source was inspected.
+- CI now invokes browser, accessibility, and visual slices explicitly.
+
+## Unexecuted or blocked evidence
+
+- All 50 required Phase 15 end-to-end scenarios.
+- Success, validation, timeout, duplicate, history, offline, and dependency-failure browser evidence.
+
+## Release disposition
+
+High release blocker P15-005 remains open.

docs/phase15/FAILURE_SIMULATION_REPORT_v1.0.md

@@ -0,0 +1,21 @@
+# Phase 15 Failure Simulation Report
+
+**Date:** 2026-06-25  
+**Status:** Blocked for current execution
+
+## Summary
+
+Deterministic scenarios exist for success, duplicate, timeout, integration error, validation, and blocked configuration. Current browser/server simulations did not run.
+
+## Executed evidence
+
+- Source adapters and scenario guards reviewed.
+- Test scenarios remain disabled in production.
+
+## Unexecuted or blocked evidence
+
+- CRM/scheduler/analytics/consent/email/DNS/network/slow/partial/rate-limit/storage/script/CSP/offline failures.
+
+## Release disposition
+
+Authored scenarios are not observed resilience evidence.

docs/phase15/FINAL_RELEASE_RECOMMENDATION_v1.0.md

@@ -0,0 +1,38 @@
+# Phase 15 Final Release Recommendation
+
+## Recommendation
+
+**Not ready for Phase 16**
+
+The repository has materially better static controls than the supplied Phase 14 baseline, but final QA is not complete. The exact clean installation, production build, dependency audit, unit/integration regression, cross-browser flows, automated accessibility, manual keyboard/screen-reader/zoom review, visual baselines, performance budgets, deployment rehearsal, and rollback rehearsal have not been executed against the final Phase 15 manifest.
+
+## Defect and issue counts
+
+- Critical unresolved: **1**
+- High unresolved: **21**
+- Medium unresolved: **17**
+- Low unresolved: **2**
+- Phase 15 defects resolved: **4**
+- Accepted exceptions: **0**
+
+The cumulative counts include inherited business, research, legal, localization, design, integration, operations, and verification issues. The Phase 15 defect register contains one open High aggregate acceptance blocker, P15-005.
+
+## Failed or blocked release gates
+
+The blocked gates include exact runtime/frozen install, final package-backed checks, current unit/integration/build, dependency/license audit, browser/accessibility/visual/manual matrices, performance and bundle measurement, production-like deployment, rollback, CRM, legal/privacy consent, analytics approval, distributed idempotency/rate limiting, native localization review, participant acceptance research, production origin, final brand assets, destinations, and a real commit identifier.
+
+## Required Phase 16 approvals
+
+Phase 16 must not begin release-candidate freeze until engineering QA closes P15-005. Business/legal work still required includes final copy, claims/evidence, customer assets, legal/privacy text, analytics and consent, CRM/scheduler operations, production destinations, domain/hosting, credentials, launch ownership, and final assets.
+
+## Required remediation before production
+
+1. Commit the Phase 15 repository and record the SHA.
+2. Run the complete command matrix on Node 24.17.0 and pnpm 11.9.0 from a frozen clean install.
+3. Fix and retest every resulting Critical, High, and Medium defect.
+4. Complete browser, accessibility, localization/RTL, theme, responsive, visual, performance, deployment, rollback, and observability evidence.
+5. Resolve or formally approve every production business/legal gate. No Critical or High exception currently exists.
+
+## Overall risk statement
+
+Static source integrity is improved and production integrations remain safely disabled. Release risk is nevertheless **unacceptably high** because the final executable artifact has not been built or observed in browsers and assistive technologies, and the production data-processing and destination decisions are unresolved.

docs/phase15/IDEMPOTENCY_DUPLICATE_REPORT_v1.0.md

@@ -0,0 +1,22 @@
+# Phase 15 Idempotency and Duplicate Report
+
+**Date:** 2026-06-25  
+**Status:** Local static design reviewed; production gate blocked
+
+## Summary
+
+The current process-local store coalesces repeated keys, caches non-retryable results, removes retryable failures, and contains no personal data in keys. It is explicitly test/local only.
+
+## Executed evidence
+
+- Historical Phase 14 integration test covered repeated transport.
+- Source review confirms retryable failures release the key.
+
+## Unexecuted or blocked evidence
+
+- Current integration/browser retry execution.
+- Distributed durable store, late vendor success, cross-instance duplicate policy, legitimate later request policy.
+
+## Release disposition
+
+P14-004 blocks scaled production.

docs/phase15/IMAGE_FONT_PERFORMANCE_REPORT_v1.0.md

@@ -0,0 +1,21 @@
+# Phase 15 Image and Font Performance Report
+
+**Date:** 2026-06-25  
+**Status:** Blocked for rendered/network measurement
+
+## Summary
+
+The public directory contains no production visual assets. Inter and Noto Sans Arabic remain package dependencies. No network waterfall or font-layout measurement ran.
+
+## Executed evidence
+
+- Asset inventory confirms no unapproved logo, screenshot, hero image, or social image was added.
+- Arabic font is separately represented in dependency and token foundations.
+
+## Unexecuted or blocked evidence
+
+- Final logo/social/hero assets, responsive sizes, compression, preload policy, Arabic font payload, CLS, cache headers.
+
+## Release disposition
+
+Final asset approval and performance measurement remain Phase 16 gates after QA rerun.

docs/phase15/INTEGRATION_TEST_REPORT_v1.0.md

@@ -0,0 +1,23 @@
+# Phase 15 Integration Test Report
+
+**Date:** 2026-06-25  
+**Status:** Blocked for current release candidate
+
+## Summary
+
+Phase 14 recorded four passing demo-service integration tests. Phase 15 discovered that CI did not execute this suite and corrected the workflow, but the final suite could not run locally.
+
+## Executed evidence
+
+- CI now contains `pnpm test:integration`.
+- Static validator confirms the integration gate remains configured.
+- Historical Phase 14 integration tests cover success, idempotent transport, normalized failure, and timeout.
+
+## Unexecuted or blocked evidence
+
+- Current Vitest integration execution.
+- Production/sandbox CRM, scheduler, email, and durable idempotency integrations do not exist.
+
+## Release disposition
+
+The integration gate is blocked until connected CI executes the suite and approved vendor adapters exist.

docs/phase15/KEYBOARD_ACCESSIBILITY_REPORT_v1.0.md

@@ -0,0 +1,21 @@
+# Phase 15 Keyboard Accessibility Report
+
+**Date:** 2026-06-25  
+**Status:** Not run
+
+## Summary
+
+Native controls, native dialog, focus-return references, skip navigation, form error links, and visible-focus styles are present in source. Keyboard-only behavior was not manually observed.
+
+## Executed evidence
+
+- Source-level focus and semantic review.
+- Manual test matrix created.
+
+## Unexecuted or blocked evidence
+
+- Complete pointer-free path including mobile navigation, form errors, consent, dialogs, success, and recovery.
+
+## Release disposition
+
+Manual keyboard acceptance is a High blocker.

docs/phase15/LOCALIZATION_QA_REPORT_v1.0.md

@@ -0,0 +1,24 @@
+# Phase 15 Localization QA Report
+
+**Date:** 2026-06-25  
+**Status:** Static parity passed; linguistic approval blocked
+
+## Summary
+
+English, French, and Arabic catalogs have exact key parity and valid direction metadata. Native linguistic review remains open.
+
+## Executed evidence
+
+- Locale validator passes.
+- Metadata/route parity validator passes.
+- No non-reserved personal-data fixture or runtime implementation key was found by the audit.
+
+## Unexecuted or blocked evidence
+
+- Native French review.
+- Native formal Modern Standard Arabic review.
+- External vendor localization because vendors are not selected.
+
+## Release disposition
+
+Mechanical parity is not translation approval; P9-005 remains High.

docs/phase15/MANUAL_TEST_MATRIX_v1.0.csv

@@ -0,0 +1,9 @@
+ID,Area,Platform_or_AT,Locale,Theme,Viewport_or_zoom,Status,Evidence,Blocking_issue
+M15-001,Keyboard-only primary demo flow,Desktop browser,en/fr/ar,light/dark,1440/390,Not run,Authored Playwright and component semantics only,P15-005
+M15-002,NVDA flow,NVDA + Firefox/Chrome on Windows,en/ar,light/dark,desktop,Not run,None; human AT required,P15-005
+M15-003,VoiceOver macOS,VoiceOver + Safari,en/ar,light/dark,desktop,Not run,None; human AT required,P15-005
+M15-004,VoiceOver iOS,VoiceOver + Mobile Safari,en/ar,system,390-class device,Not run,None; physical/device lab required,P15-005
+M15-005,TalkBack Android,TalkBack + Chrome,en/ar,system,390-class device,Not run,None; device/emulator required,P15-005
+M15-006,200% and 400% zoom/reflow,Desktop browsers,en/fr/ar,light/dark,200%/400%,Not run,Responsive source and tests authored only,P15-005
+M15-007,Forced colors and reduced motion,Windows forced colors; reduced-motion media,en/fr/ar,all,desktop/mobile,Not run,CSS controls present; human review absent,P15-005
+M15-008,Arabic reading and focus order,Browser + Arabic screen reader review,ar,light/dark,1440/390/320,Not run,Logical CSS validator passes; human review absent,P15-005

docs/phase15/OBSERVABILITY_VALIDATION_REPORT_v1.0.md

@@ -0,0 +1,21 @@
+# Phase 15 Observability Validation Report
+
+**Date:** 2026-06-25  
+**Status:** Blocked
+
+## Summary
+
+Correlation identifiers are non-sensitive and raw form logging is absent. No production logging, metrics, dashboards, alert thresholds, retention, or environment separation is implemented.
+
+## Executed evidence
+
+- Static no-raw-log controls pass.
+- Redaction helper and correlation IDs reviewed.
+
+## Unexecuted or blocked evidence
+
+- Submission/failure/vendor latency/rate-limit/duplicate/config/client/server/build/deployment metrics and alerts.
+
+## Release disposition
+
+P14-005 blocks production operations.

docs/phase15/PERFORMANCE_REPORT_v1.0.md

@@ -0,0 +1,22 @@
+# Phase 15 Performance Report
+
+**Date:** 2026-06-25  
+**Status:** Blocked
+
+## Summary
+
+Approved budgets exist for LCP, INP, CLS, TTFB, transfer sizes, fonts, media, and third-party requests. No final production build or browser timing was available.
+
+## Executed evidence
+
+- Budget contract inspected: LCP 2500 ms, INP 200 ms, CLS 0.1, TTFB 800 ms maximums.
+- No approved vendor SDK or third-party runtime was added.
+
+## Unexecuted or blocked evidence
+
+- Cold/warm desktop/mobile measurements in EN and AR.
+- LCP asset, main-thread, hydration, form latency, scheduler latency, failure response, and third-party request measurement.
+
+## Release disposition
+
+Performance gate is blocked; historical Phase 14 build inventory is not a Phase 15 measurement.

docs/phase15/PRIVACY_VALIDATION_REPORT_v1.0.md

@@ -0,0 +1,23 @@
+# Phase 15 Privacy Validation Report
+
+**Date:** 2026-06-25  
+**Status:** Static controls passed; legal and runtime approval blocked
+
+## Summary
+
+Static checks find no personal data in analytics contracts, URLs, runtime logs, fixtures outside reserved domains, or browser persistence paths for form values. No production processing destination exists.
+
+## Executed evidence
+
+- Privacy validator passes.
+- Audit finds only reserved `.test`/`.invalid` email fixtures.
+- Analytics context remains strict and excludes form fields.
+
+## Unexecuted or blocked evidence
+
+- Runtime browser capture, logs, monitoring, vendor payloads, retention, deletion, recipients, transfers, staging separation.
+- Legal/privacy approval.
+
+## Release disposition
+
+P14-002 and related legal gates block production.

docs/phase15/RELEASE_GATE_MATRIX_v1.0.csv

@@ -0,0 +1,21 @@
+Gate,Severity,Status,Evidence,Owner,Exit_criteria,Accepted_exception
+Supplied Phase 14 package integrity,High,Passed,C15-001,Engineering,Manifest validates fresh extraction,No
+Phase 15 static validators,High,Passed,C15-004,Engineering + QA,All dependency-free validators pass,No
+Repository integrity and secret/PII fixture audit,High,Passed,C15-006,Engineering + Security + Privacy,Zero Critical/High/Medium findings,No
+Exact Node 24.17.0 and pnpm 11.9.0 frozen install,High,Blocked,C15-002; C15-003,Engineering + Security,Connected clean environment completes frozen install,No
+"Format, lint, strict typecheck, unit, integration, and production build on final manifest",High,Blocked,C15-009 through C15-020,Engineering + QA,All commands exit zero on final manifest,No
+Dependency and license audit,High,Blocked,C15-021,Security + Legal,Registry-backed audit and configured license check pass,No
+Cross-browser functional execution,High,Blocked,C15-014; P14-008,QA,"Chromium, Firefox, WebKit, mobile Chrome, mobile Safari pass",No
+Automated accessibility execution,High,Blocked,C15-015; P14-008,Accessibility + QA,Axe matrix passes with reviewed exceptions,No
+"Manual keyboard, screen-reader, zoom, reflow, forced-colors, and RTL review",High,Blocked,MANUAL_TEST_MATRIX_v1.0.csv,Accessibility + QA + Localization,Human matrix completed with evidence,No
+Visual-regression baseline generation and approval,High,Blocked,C15-016; VISUAL_REGRESSION_REPORT_v1.0.md,Design + QA,Pinned Chromium baselines generated and all diffs reviewed,No
+Performance and bundle budgets,High,Blocked,PERFORMANCE_REPORT_v1.0.md; BUNDLE_ANALYSIS_REPORT_v1.0.md,Engineering,Final build measured against approved budgets,No
+Production-like deployment and rollback rehearsal,High,Blocked,DEPLOYMENT_REHEARSAL_REPORT_v1.0.md; ROLLBACK_REHEARSAL_REPORT_v1.0.md,Infrastructure + Engineering,Documented rehearsal succeeds and is timed,No
+Approved CRM/lead destination,High,Blocked,P14-001,Sales Ops + Engineering,"Approved vendor, credentials, mapping, retries, duplicates, sandbox, monitoring",No
+Approved legal/privacy/form processing,High,Blocked,P14-002,Legal + Privacy,"Localized notice, legal basis, consent, retention, deletion, recipients, transfers approved",No
+Approved analytics provider and consent,High,Blocked,P14-003,Analytics + Legal,"Provider, DPA, consent, region, retention, event policy approved",No
+Distributed idempotency and abuse controls,High,Blocked,P14-004; P9-002,Engineering + Sales Ops,"Durable store, rate limit, duplicate policy, monitoring validated",No
+Native French and Arabic review,High,Open,P9-005,Localization + Content,Native reviewers approve all visible and metadata strings,No
+Participant and accessibility acceptance research,Critical,Blocked,P9-001,Research + Product,Required cohorts completed; S0/S1 findings fixed and retested,No
+"Canonical domain, brand assets, and public destinations",High,Blocked,P10-001; P10-002; destination registry,Product + Infrastructure + Design,"Approved production origin, logo, legal, login, sales, support, tour, pricing destinations",No
+Final source-control commit identity,Medium,Blocked,Supplied ZIP contains no .git metadata,Engineering,Commit final manifest and record immutable SHA,No

docs/phase15/REPOSITORY_INTEGRITY_AUDIT_v1.0.md

@@ -0,0 +1,23 @@
+# Phase 15 Repository Integrity Audit
+
+**Date:** 2026-06-25  
+**Status:** Passed for static package integrity
+
+## Summary
+
+The baseline manifest passed before changes. The Phase 15 audit checks JSON/CSV structure, symlinks, generated files, secret patterns, reserved test email domains, runtime URLs, dependency pinning, and release-control invariants.
+
+## Executed evidence
+
+- Baseline manifest: 466 files verified.
+- Baseline audit exposed 4 High and 7 Medium findings.
+- Current audit reports zero findings under the same controls.
+
+## Unexecuted or blocked evidence
+
+- Final package manifest validation occurs after all reports are generated.
+- Git commit history was not supplied and cannot be audited.
+
+## Release disposition
+
+Static repository integrity is acceptable, but it does not replace build, dependency, browser, or human QA evidence.

docs/phase15/RETEST_REPORT_v1.0.md

@@ -0,0 +1,24 @@
+# Phase 15 Retest Report
+
+**Date:** 2026-06-25  
+**Status:** Static retest passed; full regression blocked
+
+## Summary
+
+All four remediated Phase 15 defects pass targeted static or dependency-free retests. Browser and package-backed nearby regressions were not executable.
+
+## Executed evidence
+
+- P15-001: CSV structure passes.
+- P15-002: exact media-type assertions and validator pass.
+- P15-003: canonical theme key and Chromium scope validator pass.
+- P15-004: CI integration command validator passes.
+
+## Unexecuted or blocked evidence
+
+- Prettier/ESLint/typecheck/unit/integration/build.
+- Browser visual/theme/form regression.
+
+## Release disposition
+
+Resolved defects remain conditionally closed until the final connected CI run.

docs/phase15/RISK_ACCEPTANCE_REGISTER_v1.0.csv

@@ -0,0 +1 @@
+ID,Gate,Risk,User_impact,Business_impact,Mitigation,Owner,Approver,Expiration,Required_follow_up

docs/phase15/RISK_ACCEPTANCE_SUMMARY_v1.0.md

@@ -0,0 +1,3 @@
+# Phase 15 Risk Acceptance Summary
+
+No accepted exceptions were created. `RISK_ACCEPTANCE_REGISTER_v1.0.csv` intentionally contains only its header.

docs/phase15/ROLLBACK_REHEARSAL_REPORT_v1.0.md

@@ -0,0 +1,20 @@
+# Phase 15 Rollback Rehearsal Report
+
+**Date:** 2026-06-25  
+**Status:** Documented concept; not rehearsed
+
+## Summary
+
+The public demo and analytics can be disabled through existing flags, and production defaults are blocked. No platform rollback was executed.
+
+## Executed evidence
+
+- Feature-flag inventory and Phase 14 rollback guidance reviewed.
+
+## Unexecuted or blocked evidence
+
+- Restore previous release, disable CRM/scheduler/analytics independently, verify no resend, stale secret handling, fallback UX, timing, owner confirmation.
+
+## Release disposition
+
+Rollback readiness is unproven.

docs/phase15/RTL_QA_REPORT_v1.0.md

@@ -0,0 +1,22 @@
+# Phase 15 RTL QA Report
+
+**Date:** 2026-06-25  
+**Status:** Static controls passed; end-to-end review blocked
+
+## Summary
+
+The Arabic locale is configured for server-rendered RTL and the CSS validator reports 47 files using logical declarations. Native visual, focus-order, screen-reader, mixed-direction, and scheduler checks did not run.
+
+## Executed evidence
+
+- Locale direction metadata passes.
+- Logical CSS validation passes.
+- Bidi primitives and LTR treatment for email/tel/url values are present.
+
+## Unexecuted or blocked evidence
+
+- Rendered header, hero, workflow, forms, error summaries, dialogs, footer, animation, and 320px overflow review.
+
+## Release disposition
+
+Arabic RTL is not accepted from text alignment alone.

docs/phase15/SCREEN_READER_REPORT_v1.0.md

@@ -0,0 +1,22 @@
+# Phase 15 Screen-reader Report
+
+**Date:** 2026-06-25  
+**Status:** Not run
+
+## Summary
+
+No NVDA, VoiceOver, or TalkBack session was performed. The report intentionally contains no invented announcements.
+
+## Executed evidence
+
+- Screen-reader combinations and required flows are listed in MANUAL_TEST_MATRIX_v1.0.csv.
+- Static language, direction, labels, status regions, and dialog relationships reviewed.
+
+## Unexecuted or blocked evidence
+
+- Actual announcement transcripts for English and Arabic.
+- Focus movement, error/status announcements, mixed-direction values, and mobile AT behavior.
+
+## Release disposition
+
+Screen-reader acceptance is blocked.

docs/phase15/SECURITY_VALIDATION_REPORT_v1.0.md

@@ -0,0 +1,23 @@
+# Phase 15 Security Validation Report
+
+**Date:** 2026-06-25  
+**Status:** Static controls passed; dynamic and dependency checks blocked
+
+## Summary
+
+Static review confirms request marker, same-origin check, exact JSON content type, body limit, strict schema, honeypot, bounded timeout, idempotency, normalized errors, no-store responses, CSP, and server-only environment controls. The prefix media-type defect was fixed.
+
+## Executed evidence
+
+- Phase 14 security validator passes through C15-004.
+- Secret-pattern and runtime URL audit passes.
+- Exact content-type behavior assertions pass.
+
+## Unexecuted or blocked evidence
+
+- Registry vulnerability/license audit.
+- Dynamic CSRF, origin, replay, malformed input, CSP, headers, rate limit, webhook, and vendor credential testing on final build.
+
+## Release disposition
+
+Security is not production-approved. Rate limiting, durable idempotency, vendors, and dynamic evidence remain blockers.

docs/phase15/SEO_METADATA_REVIEW_v1.0.md

@@ -0,0 +1,22 @@
+# Phase 15 SEO and Metadata Review
+
+**Date:** 2026-06-25  
+**Status:** Static foundation passed; rendered validation blocked
+
+## Summary
+
+Localized metadata, canonical, hreflang, Open Graph, Twitter, robots, and non-indexable placeholder controls pass static validation.
+
+## Executed evidence
+
+- Metadata validator passes.
+- Five route IDs have complete locale alternates.
+- Public release defaults to noindex.
+
+## Unexecuted or blocked evidence
+
+- Production origin, rendered status codes/redirects, sitemap if implemented, social assets, final metadata copy, crawl.
+
+## Release disposition
+
+SEO release approval awaits production domain, assets, build, and crawl evidence.

docs/phase15/STATIC_ANALYSIS_REPORT_v1.0.md

@@ -0,0 +1,24 @@
+# Phase 15 Static Analysis Report
+
+**Date:** 2026-06-25  
+**Status:** Partially passed
+
+## Summary
+
+All dependency-free repository validators and the Phase 15 audit pass after four defects were repaired. Package-backed formatting, ESLint, strict TypeScript, dead-code tooling, dependency/license analysis, and client-bundle inspection could not run on the final tree.
+
+## Executed evidence
+
+- 16 repository validators pass.
+- 33 JavaScript and 64 TypeScript modules plus two Python scripts pass syntax checks.
+- JSON/CSV, secret, URL, PII-fixture, direct-dependency, visual-control, and CI-control audit passes.
+
+## Unexecuted or blocked evidence
+
+- Prettier check, ESLint, strict typecheck, dead-code and unused-dependency tools.
+- Registry-backed audit and license validation.
+- Production client-bundle secret inspection.
+
+## Release disposition
+
+Static source controls pass; the overall static-analysis gate remains blocked until package-backed checks run.

docs/phase15/THEME_QA_REPORT_v1.0.md

@@ -0,0 +1,22 @@
+# Phase 15 Theme QA Report
+
+**Date:** 2026-06-25  
+**Status:** Static controls passed; browser verification blocked
+
+## Summary
+
+Light, dark, and system foundations, nonce pre-paint bootstrap, persistence, and CSS fallback are present. A stale visual-test storage key was fixed.
+
+## Executed evidence
+
+- Theme validators pass.
+- Canonical visual setup now uses `hpc.theme.preference`.
+- Semantic token controls pass.
+
+## Unexecuted or blocked evidence
+
+- No-flash behavior, OS theme changes, delayed JavaScript, disabled JavaScript, contrast, embeds, and forced-colors states.
+
+## Release disposition
+
+Theme acceptance remains blocked pending rendered evidence.

docs/phase15/UNIT_TEST_REPORT_v1.0.md

@@ -0,0 +1,22 @@
+# Phase 15 Unit Test Report
+
+**Date:** 2026-06-25  
+**Status:** Blocked for current release candidate
+
+## Summary
+
+A Vitest regression test was added for exact JSON media-type handling. The current unit suite could not execute because dependencies are unavailable. Phase 14 recorded 39 passing unit tests, but that result predates Phase 15 code changes.
+
+## Executed evidence
+
+- Eight dependency-free assertions validate the new media-type helper.
+- Phase 14 historical result: 39 passed, 0 failed, with recorded coverage.
+
+## Unexecuted or blocked evidence
+
+- Current `pnpm test:unit` and coverage thresholds.
+- Current React/component and Zod-dependent tests.
+
+## Release disposition
+
+Do not use the Phase 14 unit result as current release evidence. Rerun on the final manifest.

docs/phase15/VISUAL_REGRESSION_REPORT_v1.0.md

@@ -0,0 +1,22 @@
+# Phase 15 Visual Regression Report
+
+**Date:** 2026-06-25  
+**Status:** Blocked
+
+## Summary
+
+No approved PNG baselines exist. Phase 15 corrected snapshot determinism but did not generate or approve product images.
+
+## Executed evidence
+
+- Snapshot suites now use canonical Chromium scope.
+- Component-system test now writes the actual theme storage key.
+
+## Unexecuted or blocked evidence
+
+- Baseline generation in pinned Chromium.
+- Manual diff classification for locales, themes, viewports, interaction states, focus, reduced motion, forced colors.
+
+## Release disposition
+
+Updating baselines is prohibited until the application executes and reviewers inspect every diff.

docs/phase15/WCAG_2_2_AA_EVIDENCE_MATRIX_v1.0.csv

@@ -0,0 +1,37 @@
+Criterion,Level,Applicability,Status,Evidence,Remaining_validation,Related_issue
+1.1.1 Non-text Content,A,Applicable,Static evidence only,MediaFrame requires alt; icon primitives support accessible names,Browser and screen-reader inspection of every rendered media state,P15-005
+1.3.1 Info and Relationships,A,Applicable,Static evidence only,"Semantic landmarks, labels, fieldsets, headings, native dialog",Manual screen-reader verification,P15-005
+1.3.2 Meaningful Sequence,A,Applicable,Static evidence only,DOM order and logical CSS reviewed,EN/FR/AR screen-reader and keyboard order,P15-005
+1.3.3 Sensory Characteristics,A,Applicable,Static evidence only,Instructions do not rely solely on position,Rendered content review,P15-005
+1.4.1 Use of Color,A,Applicable,Static evidence only,Status text/icons accompany semantic color tokens,Manual light/dark/forced-colors review,P15-005
+1.4.3 Contrast Minimum,AA,Applicable,Blocked,Token intent exists,Measured contrast in all states/themes required,P15-005
+1.4.4 Resize Text,AA,Applicable,Blocked,Responsive typography authored,200% browser verification required,P15-005
+1.4.10 Reflow,AA,Applicable,Blocked,320px responsive scenarios authored,400% and narrow viewport execution required,P15-005
+1.4.11 Non-text Contrast,AA,Applicable,Blocked,Focus and border tokens exist,Rendered measurement required,P15-005
+1.4.12 Text Spacing,AA,Applicable,Blocked,Content-driven dimensions used,Text-spacing override test required,P15-005
+1.4.13 Content on Hover or Focus,AA,Applicable,Static evidence only,Tooltip component defined,Keyboard/pointer dismissal and persistence review,P15-005
+2.1.1 Keyboard,A,Applicable,Blocked,Native controls and keyboard tests authored,Full keyboard-only flow required,P15-005
+2.1.2 No Keyboard Trap,A,Applicable,Blocked,Native dialog used,Manual modal/drawer trap and escape review,P15-005
+2.2.1 Timing Adjustable,A,Limited,Static evidence only,No user-facing session timer; bounded server timeout preserves form,Slow completion and retry review,P15-005
+2.2.2 Pause Stop Hide,A,Applicable,Static evidence only,No autoplay media; reduced-motion styles exist,Rendered animation review,P15-005
+2.3.1 Three Flashes,A,Applicable,Static evidence only,No flashing content identified in source,Visual confirmation,P15-005
+2.4.1 Bypass Blocks,A,Applicable,Static evidence only,Skip navigation validator and shell tests authored,Keyboard confirmation,P15-005
+2.4.2 Page Titled,A,Applicable,Static evidence only,Localized metadata builder validator passes,Rendered route title verification,P15-005
+2.4.3 Focus Order,A,Applicable,Blocked,Logical DOM order and native controls,Manual all-state focus order,P15-005
+2.4.4 Link Purpose,A,Applicable,Static evidence only,Destination registry and localized labels,Rendered route review,P15-005
+2.4.6 Headings and Labels,AA,Applicable,Static evidence only,Structured headings and explicit form labels,Screen-reader review,P15-005
+2.4.7 Focus Visible,AA,Applicable,Blocked,Focus tokens/styles exist,Rendered keyboard review in themes/forced colors,P15-005
+2.4.11 Focus Not Obscured Minimum,AA,Applicable,Blocked,Sticky shell and dialog CSS reviewed,Viewport/zoom execution required,P15-005
+2.5.7 Dragging Movements,AA,Applicable,Static evidence only,No drag-only control identified,Rendered interaction inventory confirmation,P15-005
+2.5.8 Target Size Minimum,AA,Applicable,Blocked,Component sizing tokens exist,Measured desktop/mobile targets required,P15-005
+3.1.1 Language of Page,A,Applicable,Static evidence only,Server-rendered lang and dir validators pass,Rendered HTML verification,P15-005
+3.1.2 Language of Parts,AA,Applicable,Static evidence only,Bidi and localized content primitives exist,Foreign-language option pronunciation review,P15-005
+3.2.1 On Focus,A,Applicable,Static evidence only,No focus-triggered navigation identified,Manual interaction review,P15-005
+3.2.2 On Input,A,Applicable,Static evidence only,Locale/theme actions are explicit controls,Manual form and selector review,P15-005
+3.2.3 Consistent Navigation,AA,Applicable,Static evidence only,Shared shell components,Cross-route rendered comparison,P15-005
+3.3.1 Error Identification,A,Applicable,Static evidence only,"Error summary, field errors, aria-invalid",Screen-reader announcement review,P15-005
+3.3.2 Labels or Instructions,A,Applicable,Static evidence only,Required/optional labels and supporting text,Rendered/AT review,P15-005
+3.3.3 Error Suggestion,AA,Applicable,Static evidence only,Localized actionable validation messages,Manual flow review,P15-005
+3.3.4 Error Prevention,AA,Applicable,Static evidence only,No irreversible legal/financial transaction; duplicate controls present,Business policy review,P14-004
+4.1.2 Name Role Value,A,Applicable,Static evidence only,Native controls and explicit labels; ARIA in composites,Automated and screen-reader execution,P15-005
+4.1.3 Status Messages,AA,Applicable,Static evidence only,"LiveRegion, role=alert, success aria-live",Actual announcement capture required,P15-005

docs/phase15/ZOOM_REFLOW_REPORT_v1.0.md

@@ -0,0 +1,23 @@
+# Phase 15 Zoom and Reflow Report
+
+**Date:** 2026-06-25  
+**Status:** Blocked
+
+## Summary
+
+Source uses content-driven dimensions and logical properties, and text-expansion scenarios exist. Actual 200%/400% zoom, OS text scaling, French expansion, Arabic expansion, and pseudolocalization were not run.
+
+## Executed evidence
+
+- Static logical CSS checks pass.
+- Manual matrix identifies required zoom and AT combinations.
+
+## Unexecuted or blocked evidence
+
+- 200% and 400% browser zoom.
+- Text-spacing overrides and OS scaling.
+- Dialog/error-summary focus visibility at zoom.
+
+## Release disposition
+
+WCAG reflow and resize criteria are not verified.