# Batch Report

**Batch**: 04
**Tasks**: AZ-466 (Destructive UX policy + ConfirmDialog + no-alert), AZ-475 (Numeric form hygiene), AZ-462 (Overlay window membership), AZ-460 (Annotation save URL + payload contract)
**Date**: 2026-05-11
**Cycle**: Phase A baseline, Step 6 — Implement Tests
**Total complexity**: 10 pts (4 + 2 + 2 + 2)

## Task Results

| Task | Status | Files Modified | Tests | AC Coverage | Issues |
|------|--------|---------------|-------|-------------|--------|
| AZ-466_test_destructive_ux | Done | 2 created (1 ConfirmDialog unit + 1 cross-component); 1 e2e created; 1 modified (`tests/security/banned-deps.json` adds `alert_calls` + `destructive_surfaces`); 1 modified (`scripts/check-banned-deps.mjs` + `scripts/run-tests.sh` add STC-SEC7 / STC-SEC8) | 8 fast `ConfirmDialog.test.tsx` (7 pass, 1 skipped); 4 fast `tests/destructive_ux.test.tsx` (3 pass + 1 skip QUARANTINE incl. 2 `it.fails()`); 2 e2e `e2e/tests/destructive_ux.e2e.ts` (both `test.fail`); 2 new static checks (PASS) | 5 / 5 ACs covered | 5 documented drifts: ConfirmDialog missing 4 a11y attrs (`role="dialog"`, `aria-modal`, `aria-labelledby`, `aria-describedby`); no focus trap; AdminPage class-delete bypasses ConfirmDialog (file in `destructive_surfaces.drift`); `alert()` allowlist seeded with 4 production callsites (Phase B drains it) |
| AZ-475_test_form_hygiene | Done | 1 created (`tests/form_hygiene.test.tsx`) | 3 fast (2 pass, including 1 control + 1 `it.fails()` per AC) | 2 / 2 ACs covered | 2 documented drifts: `<label>` lacks `htmlFor`; `parseInt(v) \|\| 0` silently coerces empty/non-numeric to 0 and PUTs |
| AZ-462_test_overlay_membership | Done | 1 created (`tests/overlay_membership.test.tsx`) | 6 fast (5 pass, including 2 `it.fails()` for AC-1 inclusive boundary) | 3 / 3 ACs covered | 1 documented drift: `getTimeWindowDetections` uses strict `<` instead of `<=`; AC-1 boundary tests are `it.fails()` until production lifts the operator |
| AZ-460_test_annotations_endpoint | Done | 1 created (`tests/annotations_endpoint.test.tsx`); 1 e2e created (`e2e/tests/annotations_endpoint.e2e.ts`); 1 modified (`tests/msw/handlers/annotations.ts` doubly-prefixed paths); 1 modified (`tests/msw/handlers/flights.ts` plural `aircrafts` paths) | 6 fast (4 pass, 2 skipped QUARANTINE, including 1 `it.fails()` for AC-2 payload shape); 3 e2e (1 skip-on-no-seed, 2 `test.fail` for AC-2) | 3 / 3 ACs covered | 2 documented drifts: save body sends only `{mediaId, time, detections}` instead of the 6-field wire contract `{Source, WaypointId, videoTime, mediaId, detections, status}`; AI-suggestion-accept and bulk-edit-save entry points wholly absent in production (`it.skip` QUARANTINE) |

## AC Test Coverage: All covered (13 / 13 ACs across the four tasks)

### AZ-466 — Destructive UX policy (5 ACs, 14 scenarios)

| Scenario | Where | Profile | Status |
|----------|-------|---------|--------|
| AC-1 / FT-P-04 (ConfirmDialog `role="dialog"` + aria-modal) | `src/components/ConfirmDialog.test.tsx` | fast | `it.fails()` — both attrs missing |
| AC-1 / FT-P-05 (ConfirmDialog labeled by title via aria-labelledby + described by message) | same | fast | `it.fails()` — neither attr today |
| AC-1 / FT-P-06 (Escape key closes dialog) | same | fast | PASS — production already calls onClose on Escape |
| AC-1 / focus-trap (Tab cycles within dialog) | same | fast | `it.skip` QUARANTINE — no trap implemented |
| AC-1 / control: dialog renders (positive sanity) | same | fast | PASS |
| AC-1 / control: confirm/cancel callbacks fire | same | fast | PASS |
| AC-1 / control: hidden when closed | same | fast | PASS |
| AC-2 / FT-P-26 (Delete → Confirm → DELETE fires) | `tests/destructive_ux.test.tsx` + `e2e/tests/destructive_ux.e2e.ts` | fast + e2e | `it.fails()` (fast) + `test.fail` (e2e) — AdminPage bypasses ConfirmDialog |
| AC-2 / FT-N-07 (Delete → Cancel → no DELETE) | same | fast + e2e | `it.fails()` + `test.fail` |
| AC-2 / control: production today deletes immediately | `tests/destructive_ux.test.tsx` | fast | PASS — pins drift |
| AC-3 / no `alert()` outside allowlist | `scripts/run-tests.sh::STC-SEC7` → `check-banned-deps.mjs --kind=alert_calls` | static | PASS (allowlist enforced; new alerts FAIL) |
| AC-4 / FT-P-27 (every destructive surface gated or in drift list) | `STC-SEC8` → `--kind=destructive_surfaces` | static | PASS (3 files: 2 gated, 1 drift) |
| AC-4 / runtime mirror (one example via class-delete) | `tests/destructive_ux.test.tsx` | fast | covered by AC-2 above |
| AC-5 / NFT-SEC-07 (no `alert()` in `src/`) | `STC-SEC7` (allowlist) | static | PASS — static check is the gating signal |

**AC summary**:
- AC-1 ConfirmDialog a11y → 4 `it.fails()` + 1 `it.skip` + 4 controls; FT-P-06 (Escape) PASS.
- AC-2 Delete-confirm-cancel happy path → `it.fails()` + control + e2e companion (`test.fail`).
- AC-3 / AC-5 No `alert()` → STC-SEC7 with 4-entry allowlist (Phase B drains).
- AC-4 Destructive surfaces enumeration → STC-SEC8 file-level heuristic (3 files: `MediaList.tsx` and `FlightsPage.tsx` gated; `AdminPage.tsx` in drift).

### AZ-475 — Numeric form input rejection (2 ACs, 3 scenarios)

| Scenario | Where | Profile | Status |
|----------|-------|---------|--------|
| AC-1 / FT-N-11 (clear → validation error + no PUT) | `tests/form_hygiene.test.tsx` | fast | `it.fails()` — silent zero today |
| AC-1 / control: production silently coerces empty input to 0 and PUTs | same | fast | PASS — pins drift |
| AC-2 / FT-N-12 (non-numeric → validation error + no PUT) | same | fast | `it.fails()` — same coercion path |

**AC summary**:
- AC-1 Empty input rejection → `it.fails()` + control proving `defaultCameraWidth: 0` PUTs today.
- AC-2 Non-numeric rejection → `it.fails()` (the `<input type="number">` path swallows non-numeric chars; the helper sets the value via dispatchEvent to force the React state).

### AZ-462 — Overlay membership at in-window edges (3 ACs, 6 scenarios)

| Scenario | Where | Profile | Status |
|----------|-------|---------|--------|
| AC-1 / FT-P-14 (annotation EXACTLY on lower bound IS rendered) | `tests/overlay_membership.test.tsx` | fast | `it.fails()` — strict `<` excludes boundary |
| AC-1 / FT-P-15 (annotation EXACTLY on upper bound IS rendered) | same | fast | `it.fails()` — same drift |
| AC-1 / control: strict `<` excludes the boundary today | same | fast | PASS — pins drift |
| AC-2 / FT-N-01 (annotation BEFORE lower bound NOT rendered) | same | fast | PASS |
| AC-2 / FT-N-02 (annotation AFTER upper bound NOT rendered) | same | fast | PASS |
| AC-2 / positive control: annotation INSIDE the window IS rendered | same | fast | PASS — proves test apparatus would observe a render |

**AC summary**:
- AC-1 Inclusive boundary → 2 `it.fails()` + control proving exclusion today.
- AC-2 Strict exclusion outside the window → 2 PASS + positive control (apparatus sanity).
- AC-3 Canvas-output assertion (not React state) → satisfied by mocking `HTMLCanvasElement.prototype.getContext` to capture every `strokeRect` call.

### AZ-460 — Annotation save URL + payload contract (3 ACs, 6 scenarios)

| Scenario | Where | Profile | Status |
|----------|-------|---------|--------|
| AC-1 / FT-P-07 (URL canary: `/api/annotations/annotations`) | `tests/annotations_endpoint.test.tsx` + `e2e/tests/annotations_endpoint.e2e.ts` | fast + e2e | PASS (fast) — production already POSTs the doubly-prefixed URL; e2e gated by suite stack |
| AC-2 / FT-P-08 (required-fields: Source, WaypointId, videoTime, mediaId, detections, status) | same | fast + e2e | `it.fails()` + `test.fail` — production sends only `{mediaId, time, detections}` |
| AC-2 / control: production sends partial body (`{mediaId, detections}`) | `tests/annotations_endpoint.test.tsx` | fast | PASS — pins drift |
| AC-3 / manual-draw / select-existing entry point | same + e2e | fast + e2e | PASS — exercises the only wired entry point |
| AC-3 / AI-suggestion-accept entry point | same | fast | `it.skip` QUARANTINE — no production path today |
| AC-3 / bulk-edit-save entry point | same | fast | `it.skip` QUARANTINE — no production path today |

**AC summary**:
- AC-1 URL canary → PASS for the only wired save path; e2e companion gated.
- AC-2 Required fields → `it.fails()` for the missing 4 fields; control pins the partial-body drift.
- AC-3 Multi-entry-point coverage → 1 PASS for manual-draw + 2 `it.skip` QUARANTINE for unimplemented paths (test shape documented in skip comments).

## Code Review Verdict: PASS_WITH_WARNINGS

Self-review walked inline per `.cursor/skills/code-review/SKILL.md` phases 1–7.

- **Phase 1 (Context)**: 4 task specs re-read; `_docs/02_document/module-layout.md` Blackbox Tests envelope respected; reuses helpers from AZ-456 (`tests/helpers/{render,auth}.ts`) and fixtures (`seed_users`, `seed_flights`). No new shared helpers introduced — the form-hygiene file inlines a small `inputForLabel(...)` DOM-traversal helper because SettingsPage's labels lack `htmlFor` (drift documented in the test header).
- **Phase 2 (Spec compliance)**: every AC across the four task specs has at least one test (running, `it.fails()`, or `it.skip` with QUARANTINE reason). Drift handling uniform with batches 1–3: `it.fails()` for documented production drift (attribute/operator/payload-field exists in spec but absent in code); `it.skip` for behavior wholly absent (AI-suggestion-accept save, bulk-edit save, focus trap inside ConfirmDialog).
- **Phase 3 (Code quality)**: `check-banned-deps.mjs`'s new `checkDestructiveSurfaces` is a single function with one responsibility (file-level heuristic comparing `gated` ∪ `drift` against the live filesystem); `tests/security/banned-deps.json` `alert_calls` and `destructive_surfaces` sections each have an `ac:` field, a `scope:` field, an explicit `match:` description, and inline `$*_comment` hooks for code review; the test files use Arrange/Act/Assert structure consistently; no bare `catch` blocks; no error suppression.
- **Phase 4 (Security)**: no new secrets in test fixtures (reuses AZ-457's `test-bearer-default`); the AZ-466 changes strengthen security posture (every `alert()` and every destructive surface is now allowlisted and code-review-visible); the new static checks fail-closed on additions; the `check-banned-deps.mjs` walks files and runs ripgrep / regex over them — no execution of test inputs.
- **Phase 5 (Performance)**: fast suite **5.5 s wall-clock** for 80 + 13-skipped tests across 14 files (was 4.4 s for 57 + 9 skipped in batch 3 — +1.1 s for 23 new tests, well under the 5 min budget). Static profile **~16 s** for 24 checks (was 12 s for 22 in batch 3; +4 s primarily from the two new STC-SEC7 / STC-SEC8 checks reading `tests/security/banned-deps.json`). The `it.fails()` tests each consume ~1 s waiting for the assertion to NOT match — same shape as batches 1–3, acceptable.
- **Phase 6 (Cross-task consistency)**: the four tasks touch **disjoint** subsystems (ConfirmDialog + AdminPage destructive UX vs SettingsPage form hygiene vs CanvasEditor overlay vs AnnotationsPage save). Shared surface = `tests/helpers/`, `tests/fixtures/`, `tests/msw/`, `tests/security/banned-deps.json` — all consumed read-only or strictly extended (new sections, never modifying existing ones). No contract collisions; no duplicate symbols.
- **Phase 7 (Architecture compliance)**:
  - Test files import only public seams:
    - `src/components/ConfirmDialog.test.tsx`: `ConfirmDialog` default export.
    - `tests/destructive_ux.test.tsx`: `AdminPage` default export.
    - `tests/form_hygiene.test.tsx`: `SettingsPage` default export.
    - `tests/overlay_membership.test.tsx`: `CanvasEditor` default export + `AnnotationSource`/`AnnotationStatus`/etc. enums (public types).
    - `tests/annotations_endpoint.test.tsx`: `AnnotationsPage` default export + `FlightProvider` (public symbol on `FlightContext.tsx`) + public enums.
  - No imports of `*.internal.*` files, no reaching into other components' private files.
  - E2E tests don't import any production modules — Playwright primitives only (consistent with batches 1–3).
  - No new cyclic module dependencies introduced.
  - Test setup: `tests/setup.ts` gained two no-op JSDOM polyfills (`ResizeObserver` and `EventSource`). These are environment polyfills (not production code workarounds), and per-test installations of richer stubs (e.g. `tests/sse_lifecycle.test.tsx`'s EventSource fake) override + restore — verified by re-running batch 3's SSE suite alongside the new tests with no regressions.

### Findings

1. **Low / Maintainability / Drift** — AZ-466 AC-1 four ConfirmDialog a11y attributes (`role="dialog"`, `aria-modal`, `aria-labelledby`, `aria-describedby`) are missing today; FT-P-04 / FT-P-05 are `it.fails()`. The Escape handler exists (FT-P-06 PASSes), but no focus trap (`it.skip` QUARANTINE). **Recommendation**: file `feat(confirm-dialog): a11y attrs + focus trap` in Phase B. Touches one file (`src/components/ConfirmDialog.tsx`); should also localize the title via `t()` if the existing copy is hard-coded.

2. **Low / Maintainability / Drift** — AZ-466 AC-4 `AdminPage.handleDeleteClass` calls `api.delete` without ConfirmDialog. The file is recorded in `tests/security/banned-deps.json::destructive_surfaces.drift` to keep the static check passing while making the gap visible in code review. **Recommendation**: `feat(admin): gate class-delete via ConfirmDialog` — moves `src/features/admin/AdminPage.tsx` from `drift` to `gated` and flips FT-P-26 / FT-N-07 from `it.fails()` to PASS.

3. **Low / Maintainability / Drift** — AZ-466 AC-3 / AC-5 `alert()` allowlist contains 4 callsites (`MediaList.tsx`, `FlightsPage.tsx`, `JsonEditorDialog.tsx`, `flightPlan.tsx`). Each is a per-feature blocker dialog or validation message that should migrate to a non-blocking toast or an inline error. **Recommendation**: 4 small Phase B tasks (one per file), each removing one allowlist entry — measurable progress.

4. **Low / Maintainability / Drift** — AZ-475 AC-1 silent-zero coercion AND `<label>` without `htmlFor`. Two related drifts in the same file (`SettingsPage.tsx`). **Recommendation**: combined Phase B task `feat(settings): numeric input validation + label association` that lands a `useNumericField()` hook (or equivalent) and adds `id`/`htmlFor` so screen readers and `getByLabelText` both work.

5. **Low / Maintainability / Drift** — AZ-462 AC-1 strict `<` in `getTimeWindowDetections` → boundary annotations are dropped. **Recommendation**: one-character production change (`<` → `<=`) + flip FT-P-14/15 from `it.fails()` to PASS. Confirm with the suite annotations service that `lowerBound` and `upperBound` are inclusive on the wire.

6. **Low / Architecture / Drift** — AZ-460 AC-2 save body shape (4 missing fields). The fields touch the wire contract; the suite annotations service must be checked to see what it expects today. **Recommendation**: a Phase B task `feat(annotations-save): emit Source/WaypointId/videoTime/status` that lifts the body shape. May require a coordinated change with the annotations service if the server today happily accepts the partial body.

7. **Low / Architecture / Drift** — AZ-460 AC-3 only one save entry point exists. The AI-suggestion-accept and bulk-edit-save paths are documented in `it.skip` QUARANTINE comments with the test shape they should take when the production paths land. **Recommendation**: 2 Phase B feature tasks (AI-accept, bulk-edit) — the test side is ready to be activated by removing the `.skip`.

8. **Low / Architecture / Drift (test infrastructure)** — `tests/msw/handlers/annotations.ts` and `tests/msw/handlers/flights.ts` both gained doubly-prefixed / plural paths (`/api/annotations/annotations`, `/api/flights/aircrafts`) to match what production callers actually use. The single-prefix paths are kept for backward compatibility with batch 1–3 tests. **Recommendation**: Phase B tracker entry `chore(test-infra): drop the single-prefix annotation/flight paths` once production has been confirmed to use only the doubly-prefixed/plural shapes everywhere.

9. **Low / Architecture / Drift (test infrastructure)** — `tests/msw/handlers/admin.ts` `/api/admin/users` returns `paginate(seedUsers)` while `AdminPage` reads it as a flat `User[]`. The destructive-UX test override returns `[]` (flat) to keep AdminPage from crashing. **Recommendation**: confirm whether the suite admin service emits a flat array or a paginated payload, then align the MSW default with production. Either way, file as `chore(admin-handler): align msw with prod /admin/users shape`.

10. **Low / Architecture / Interpretation (carried over from batches 1–3)** — Test helpers (`tests/helpers/{render,auth,sse-mock}.ts`) and the polyfills in `tests/setup.ts` import / patch production accessors. Reaffirmed per the batch-1 / 2 / 3 rule: "Black-box discipline applies to test bodies, not to test setup helpers / composition-root wrappers / consumer-pattern mirrors". The polyfills are JSDOM environment plumbing (no-op stubs for browser APIs JSDOM doesn't ship), not production-code workarounds.

## Auto-Fix Attempts: 0
## Stuck Agents: None

## Files Changed (10)

### Created — `src/` (1)
```
src/components/ConfirmDialog.test.tsx     # AZ-466 fast — 8 tests (1 skipped)
```

### Created — `tests/` (3)
```
tests/destructive_ux.test.tsx              # AZ-466 fast — 4 tests (1 skipped)
tests/form_hygiene.test.tsx                # AZ-475 fast — 3 tests
tests/overlay_membership.test.tsx          # AZ-462 fast — 6 tests
tests/annotations_endpoint.test.tsx        # AZ-460 fast — 6 tests (2 skipped)
```

### Created — `e2e/tests/` (2)
```
e2e/tests/destructive_ux.e2e.ts            # AZ-466 e2e — 2 scenarios (both test.fail)
e2e/tests/annotations_endpoint.e2e.ts      # AZ-460 e2e — 3 scenarios (1 skip-on-no-seed, 1 test.fail)
```

### Modified (5)
```
tests/setup.ts                             # JSDOM polyfills: NoopResizeObserver, NoopEventSource
tests/security/banned-deps.json            # New sections: alert_calls (4-entry allowlist) + destructive_surfaces (2 gated, 1 drift)
scripts/check-banned-deps.mjs              # New checkDestructiveSurfaces; allowlist support in checkSourceTree; main() routing
scripts/run-tests.sh                       # Add STC-SEC7 (no-alert) + STC-SEC8 (destructive surfaces)
tests/msw/handlers/annotations.ts          # Add doubly-prefixed annotation/settings/classes handlers (production shape)
tests/msw/handlers/flights.ts              # Add plural /api/flights/aircrafts handlers (production shape)
_docs/_autodev_state.md                    # Batch 4 sub_step pointer + notes
```

(File count = 4 created in `tests/` + 1 created in `src/` + 2 created in `e2e/tests/` + 5 modified + 2 MSW handlers modified = 14 file touches; uniqueness count is 12 — `tests/msw/handlers/annotations.ts` and `tests/msw/handlers/flights.ts` are extensions of existing files.)

## Verification Run (host)

```
$ bun run test:fast
 ✓ tests/infrastructure.test.ts (5 tests) 53ms
 ✓ src/api/client.test.ts (9 tests) 61ms
 ✓ tests/sse_lifecycle.test.tsx (9 tests | 1 skipped) 74ms
 ✓ src/auth/AuthContext.test.tsx (4 tests) 249ms
 ✓ src/components/Header.test.tsx (6 tests | 1 skipped) 302ms
 ✓ src/components/ConfirmDialog.test.tsx (8 tests | 1 skipped) 285ms
 ✓ tests/wire_contract.test.ts (11 tests | 2 skipped) 8ms
 ✓ tests/i18n.test.tsx (4 tests | 2 skipped) 4ms
 ✓ tests/annotations_endpoint.test.tsx (6 tests | 2 skipped) 523ms
 ✓ src/auth/ProtectedRoute.test.tsx (12 tests | 3 skipped) 1101ms
 ✓ mission-planner/src/test/jsonImport.test.ts (6 tests) 5ms
 ✓ tests/overlay_membership.test.tsx (6 tests) 2137ms
 ✓ tests/form_hygiene.test.tsx (3 tests) 2351ms
 ✓ tests/destructive_ux.test.tsx (4 tests | 1 skipped) 2342ms

 Test Files  14 passed (14)
      Tests  80 passed | 13 skipped (93)

$ ./scripts/run-tests.sh --static-only
[run-tests] static profile PASSED — 24/24 checks (was 22 in batch 3; +2 from batch 4: STC-SEC7, STC-SEC8)

$ ./scripts/run-tests.sh
[run-tests] static profile : ran (PASS)
[run-tests] fast profile   : ran (PASS)
[run-tests] e2e profile    : skipped (host)
[run-tests] exit code      : 0
```

E2E profile not exercised in this batch — same Risk 4 as batches 1–3 (requires `docker compose -f e2e/docker-compose.suite-e2e.yml up -d` plus parent-suite `:test` images). The new e2e companion files (`e2e/tests/destructive_ux.e2e.ts`, `e2e/tests/annotations_endpoint.e2e.ts`) will run on the suite stack.

## Next Batch

Remaining: **14 test-implementation tasks** in `_docs/02_tasks/todo/`:
- AZ-461 (detection endpoints sync/async/long-video, 2pts)
- AZ-463 (flight selection persistence + memory soaks, 3pts)
- AZ-464 (bulk-validate URL + body + UI sync, 2pts)
- AZ-469 (browser support + responsive variants, 2pts)
- AZ-470 (panel-width debounced PUT + rehydration, 2pts)
- AZ-471 (CanvasEditor draw/resize/multi-select/zoom/pan, 5pts)
- AZ-472 (DetectionClasses load + hotkeys + click + fallback, 3pts)
- AZ-473 (PhotoMode switch + auto-select + yoloId wire, 2pts) — soft dep on AZ-472
- AZ-474 (Tile-split + YOLO parser + auto-zoom + indicator, 3pts)
- AZ-476 (Upload 501 MB → 413 → user-visible error, 2pts)
- AZ-477 (Settings save 500/network resilience, 3pts)
- AZ-478 (Network offline + SSE disconnect + tainted-canvas, 3pts)
- AZ-479 (Bundle ≤2 MB + mission-planner excluded + FCP + soak, 3pts)
- AZ-480 (Prod image nginx:alpine + 500M + 9 routes + edge RAM, 3pts)

All carry **Component**: `Blackbox Tests` and **Dependencies**: `AZ-456` (✓ done). Soft cross-dep: AZ-473 needs AZ-472's DetectionClasses fixtures.

Suggested next batch (4 tasks, ~9 pts, dependency-disjoint at the file level): AZ-461 (detection endpoints, 2pts); AZ-464 (bulk-validate URL/body/sync, 2pts); AZ-470 (panel-width debounced PUT, 2pts); AZ-472 (DetectionClasses load + hotkeys, 3pts). Together they touch the detect/ endpoints, bulk dataset endpoints, useResizablePanel hook, and the DetectionClasses component — disjoint at the file level.

A cumulative cross-batch review (batches 04–06) is due **after batch 6** per `implement/SKILL.md` Step 14.5 (every 3 batches). Today's per-batch self-review is recorded above; the cumulative pass will compare batches 04–06 against architecture findings F1–F9 (the same baseline used by the batches 01–03 cumulative review).

Recommendation: continue in a new conversation. Batch 4 added 6 new files + 2 new static checks + 23 new fast tests + 2 new e2e files; the next batch will load distinct task specs (detect endpoints, bulk-validate, resizable-panel, DetectionClasses).