[AZ-460] [AZ-462] [AZ-466] [AZ-475] Batch 4 - destructive UX/forms/overlay/save

AZ-466 — Destructive UX policy + ConfirmDialog a11y + no-alert (4pts):
  src/components/ConfirmDialog.test.tsx (8 fast),
  tests/destructive_ux.test.tsx (4 fast, AdminPage class-delete drift),
  e2e/tests/destructive_ux.e2e.ts. New static checks STC-SEC7 (alert
  allowlist) + STC-SEC8 (destructive-surfaces gated/drift) wired through
  scripts/check-banned-deps.mjs reading tests/security/banned-deps.json.

AZ-475 — Numeric form input rejection (2pts):
  tests/form_hygiene.test.tsx (3 fast). Documents two SettingsPage drifts:
  silent zero coercion via parseInt(v)||0 and labels missing htmlFor.

AZ-462 — Overlay membership at in-window edges (2pts):
  tests/overlay_membership.test.tsx (6 fast). Documents getTimeWindowDetections
  strict < drift; AC-1 boundary tests are it.fails(); AC-2 / control PASS.
  Mocks HTMLCanvasElement.getContext to capture strokeRect.

AZ-460 — Annotation save URL + payload contract (2pts):
  tests/annotations_endpoint.test.tsx (6 fast),
  e2e/tests/annotations_endpoint.e2e.ts. AC-1 URL canary PASSes; AC-2
  payload missing 4 fields documented as it.fails(); AC-3 manual-draw
  PASS, AI-suggestion-accept + bulk-edit-save QUARANTINE skip.

Test infrastructure:
  - tests/setup.ts: NoopResizeObserver + NoopEventSource JSDOM polyfills.
  - tests/msw/handlers/annotations.ts: doubly-prefixed paths matching
    production calls (e.g. /api/annotations/annotations).
  - tests/msw/handlers/flights.ts: plural /aircrafts paths.

Verification: bun run test:fast → 80 passed, 13 skipped (14 files).
scripts/run-tests.sh --static-only → 24/24 PASS (was 22; +STC-SEC7/SEC8).
Per-batch self-review verdict: PASS_WITH_WARNINGS. Cumulative review
of batches 04-06 due after batch 6 per implement/SKILL.md Step 14.5.
Report: _docs/03_implementation/batch_04_report.md.

Also includes the previously-untracked
_docs/03_implementation/cumulative_review_batches_01-03_report.md
generated at the start of this session before batch 4 began.

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/_autodev_state.md

@@ -8,7 +8,7 @@ status: in_progress
 sub_step:
   phase: 14
   name: batch-loop
-  detail: "batch 4 next: 18 tasks remaining (AZ-460/461/462/463/464/466/469/470/471/472/473/474/475/476/477/478/479/480)"
+  detail: "batch 4 of ~5 complete; 14 tasks remain in todo/"
 retry_count: 0
 cycle: 1
 tracker: jira
@@ -22,29 +22,8 @@ step_3_ac_gap_handling: rollback-to-6c (option A)
   `_docs/02_document/state.json`, `FINAL_report.md`, `architecture.md`,
   `glossary.md`, plus `_docs/01_solution/solution.md` and
   `_docs/00_problem/{problem,acceptance_criteria,restrictions,security_approach}.md`.
-- Suite-level architecture: `../_docs/`. UI design: `_docs/ui_design/`.
-- Legacy reference: `_docs/legacy/wpf-era.md` + research copy at
-  `suite/annotations-research` (detached @ `22529c2`).
-- /document scope was src/ AND mission-planner/ (two disjoint groups).
-- 2026-05-11 Step 6 entry: added "Blackbox Tests" cross-cutting
-  component to `_docs/02_document/module-layout.md` so the implement
-  skill's Step 4 (file ownership) can resolve test-task ownership
-  for AZ-456..AZ-482 (epic AZ-455).
-- 2026-05-11 batch 1 (AZ-456) shipped: vitest+MSW (fast) + Playwright
-  e2e harness + stubs + scripts. 11 fast tests pass; 13 static checks
-  pass. AZ-456 → In Testing; report at
-  `_docs/03_implementation/batch_01_report.md`. Next batch picks up
-  AZ-457..AZ-482 (26 tasks remaining).
-- 2026-05-11 batch 2 (AZ-457/459/465/481) shipped: 38 fast tests pass
-  + 4 skipped; 19 static checks pass. Reports at
-  `_docs/03_implementation/batch_02_report.md`. 22 tasks remain.
-- 2026-05-11 batch 3 (AZ-458/467/468/482) shipped: 57 fast tests pass
-  + 9 skipped (drifts/quarantines); 22 static checks pass. Reports at
-  `_docs/03_implementation/batch_03_report.md`. 18 tasks remain.
-  Drifts documented (production follow-ups for Phase B): Header
-  flight-dropdown a11y (FT-P-30/31/N-09); ProtectedRoute spinner a11y
-  + 10s timeout + route RBAC (FT-P-32/33, FT-N-03/05); SSE bearer-
-  rotation reconnect (AC-2 / NFT-PERF-03); AnnotationsPage annotation-
-  status SSE (FT-P-09/10/NFT-PERF-06). New deny-list source
-  `tests/security/banned-deps.json` + checker
-  `scripts/check-banned-deps.mjs` introduced (AZ-482 constraint).
+- Implement-skill batch reports at `_docs/03_implementation/batch_0{1,2,3,4}_report.md`.
+- Cumulative review (batches 01-03) PASS_WITH_WARNINGS at
+  `_docs/03_implementation/cumulative_review_batches_01-03_report.md`.
+  Next cumulative review due after batch 6 (every 3 batches per
+  `implement/SKILL.md` Step 14.5).