# Phase 7 plan — final responsive, accessibility, prototype-flow and 606-frame acceptance

**Status:** Planning only. **Phase 7 is not implemented. Waiting for Business Owner approval.**  
**Phase 6:** closed.  
**Stack (locked):** CodeIgniter 4, PHP 8.2+, MySQL 8 InnoDB, server-rendered Views. Do not introduce React, Next.js, JWT, Shield, SMTP, PostgreSQL, Company Admin, numeric role hierarchy, automatic IRN, or new permission codes.

Evidence for this plan lives in `docs/phase7-audit/`. Application files were not modified.

---

## 1. Objective and non-goals

**Objective:** Audit the implemented Phase 0–6 application against the authoritative 606-row CSV, 62 Screen IDs, 12 aliases, P28–P32 Figma handoff requirements, and Phase 0–6 plans/reports. Produce a precise remediation and acceptance plan so eventual implementation can close coverage, responsive, accessibility, navigation, visual/content consistency, prototype flows, security, and tests — without inventing business features.

**Non-goals for Phase 7 implementation (when later approved):**

- New business functionality, schema, migrations, or permission codes unless the Business Owner separately approves a finding that truly requires them.
- Recreating the Figma file, Plugin API wiring, or literal Figma instance API in PHP.
- Physical DELETE, Credit Note Cancel/Delete/Void, automatic IRN, permission union, production `?frame=`, seed/demo/probe routes.
- Starting from a blank catalogue; Frame Names stay CSV-exact.
- Combining or skipping checkpoints.
- Treating HTTP 200 or a frame-name string as operational proof.

Phase 7 **may** correct verified missing render states, responsive composition, accessibility, broken navigation, visual inconsistency, content mismatch, manifest/flow/test gaps.

---

## 2. Source precedence

1. This plan’s non-negotiable rules and the Phase 6 closed baseline.  
2. Authoritative CSV Frame Name / Screen ID / Device / State.  
3. Twelve approved aliases (`docs/reference/Approved-Frame-Name-Aliases.md`) — coverage keys are CSV names.  
4. Phase 0–6 approved plans and implementation reports.  
5. BRD v0.9.22 → addenda → TDD v0.4.1 → Database Architecture v1.2 (MySQL translation) → FRIS v1.0.1 → Blueprint v1.1 → Prompt Pack P00–P32 → P28 matrix notes.  
6. Where Blueprint/Figma chrome contradicts an approved PHP behaviour (direct-post inward, no `INWARD.APPROVE`, no automatic IRN, Hybrid C), the **application plan wins**; the Figma frame remains a coverage/visual contract.

CSV **Frame Name** is the coverage contract. Figma alias names are not additional catalog keys.

---

## 3. Source availability / checksums

Full record: `docs/phase7-audit/00-SOURCE_PREFLIGHT.md` and `source_checksums_observed.csv`.

| Source | Availability |
|---|---|
| Authoritative CSV (606) | Versioned. SHA-256 `314b31b7625b5406515262c1189d9d7b8970ad36677df503a1ace32b714edde7`. Parsed mechanically this turn. |
| 12 aliases | Versioned. SHA-256 `1ff992bd1a39f8b48a44d16e0e5e6e3b9780f306e0254e490d7427d02efc07c8`. |
| Phase 1–6 plans, reports, route matrix | Versioned. |
| Frame catalogues, routes, permissions, tests | Versioned application source. |
| P28 21 cross-page rows | On disk in gitignored `uploads/`; copied to `docs/phase7-audit/P28-Manual-Cross-Page-Prototype-Links.md`. |
| Prompt Pack P00–P32 | On disk, gitignored. Instructions, not completed audits. |
| Blueprint / BRD / FRIS / TDD | Session-controlled uploads; **not in git**. |
| Completed P29/P30/P31/P32 Figma output files | **Not found.** Do not invent. |
| Figma file | URL in `uploads/Figma-Link_abf7.txt` (P32-approved file). Not exported into git. |

**Does this block planning?** No. **Does it block claiming Figma P29–P32 were re-run?** Yes.

---

## 4. Phase 6 baseline (frozen)

| Item | Value |
|---|---|
| Final implementation | `146baa157c2cf861be103f3d2ae7aebea064529d` |
| Final documentation HEAD | `bd0f3ceec6e46857883dfc24e6bd546fbb8bc600` |
| Local tag | `phase-6-final-approved` |
| Tests / assertions / failures | **313 / 10,394 / 0** (independent suite at implementation HEAD) |
| Health JSON `phase` | 6 (remains 6 until Phase 7 implementation is approved and executed) |
| Stack | Unchanged |

Phase 7 implementation, once approved, must keep this suite green and must not reuse Checkpoint I (`34ac7d9`) totals as the Phase 7 result.

---

## 5. 606-frame reconciliation

Mechanical parse of the versioned CSV (not prior report totals). Method and row-level files: `docs/phase7-audit/csv_to_catalog.csv`, `reconciliation_summary.json`.

| Category | Expected | Observed |
|---|---:|---:|
| Manifest frames | 606 | **606** unique names, 606 unique Frame IDs, 0 duplicate names |
| Desktop | 496 | **496** |
| Mobile | 107 | **107** |
| Tablet | 3 | **3** |
| Screen IDs | 62 | **62**; 0 missing, 0 extra vs the required list |
| Approved aliases | 12 | **12**; CSV keys in catalogs; Figma names **not** catalog keys |
| Extra application frames | 0 | **0** (`union(FrameCatalog, Phase2–6Frames)` unique = 606) |
| Missing frames | 0 | **0** |
| Duplicate frame names | 0 | **0** |

Catalog sizes (do not add these to 606):

| Catalog | Names | Notes |
|---|---:|---|
| `FrameCatalog` | 88 | Phase 1, including INV-004, RPT-003, AUD-001 |
| `Phase2Frames` | 216 | Generated list/form/configure set |
| `Phase3Frames` | 110 | |
| `Phase4Frames` | 77 | Includes the same 9 INV-SCR-004 names as FrameCatalog |
| `Phase5Frames::all()` | 92 | Excludes RPT-SCR-003 (kept in FrameCatalog). Canonical Phase 5 coverage is 99 with those 7 |
| `Phase6Frames` | 32 | IAM only; six AUD names stay in FrameCatalog |

**Overlaps (do not double-count):**

- Phase 4 ∩ Phase 1: **9** INV-SCR-004 list frames (`catalog_overlaps.csv`).
- Phase 5 ∩ Phase 1: **7** RPT-SCR-003 names live only in `FrameCatalog`, included in `Phase5Frames::phase5Canonical99()`.
- Phase 6 ∩ Phase 1: **6** AUD-SCR-001 names live only in `FrameCatalog`.

**Tablet frames (exact):**

1. `T-CHL-SCR-002-Create-Approved`
2. `T-DSH-SCR-001-View-Default`
3. `T-RPT-SCR-006-Report-Default`

**Direct matches:** 594 CSV names with no alias. **Approved alias matches:** 12 CSV keys (Figma names are not extra keys). **Missing / extra:** none.

**Unreachable vs simulation:** Every catalog name has a `routeFor()` path. Many states (Loading, some Empty/Error/NoResults/PermissionRestricted/ConcurrentUpdate, inward approval-FSM compatibility) render through non-production `?frame=` overlay (`FrameSimulation`). Production ignores `?frame=`. Those overlays are **not** extra frames; they are visual coverage of the same 606 names. See finding `P7-TST-002`.

---

## 6. 62-Screen-ID census

CSV D/M/T and states: `docs/phase7-audit/screen_census.csv`. Routes/controllers/views: `screen_traceability.csv`.

All 62 required IDs are present. Compact census:

| Screen ID | D | M | T | Σ | Primary route(s) | Controller | Permission (active role) |
|---|---:|---:|---:|---:|---|---|---|
| DSH-SCR-001 | 5 | 1 | 1 | 7 | `GET /` | `HomeController` | `DASHBOARD.VIEW` |
| CMP-SCR-001 | 7 | 2 | 0 | 9 | `/companies` | `CompanyController` | `COMPANY.LIST` |
| CMP-SCR-002 | 9 | 2 | 0 | 11 | `/companies/create`, `/companies/{id}` | `CompanyController` | `COMPANY.ADD/EDIT/VIEW` |
| CMP-SCR-003 | 7 | 2 | 0 | 9 | `/plants` | `PlantController` | `PLANT.LIST` |
| CMP-SCR-004 | 9 | 2 | 0 | 11 | `/plants/create`, `/plants/{id}` | `PlantController` | `PLANT.ADD/EDIT` |
| PTY-SCR-001–006 | 48 | 12 | 0 | 60 | `/clients`, `/clients/{id}/sites`, `/vendors` | Client / ClientSite / Vendor | `CLIENT.*` / `CLIENT_SITE.*` / `VENDOR.*` |
| PRD-SCR-001–004 | 32 | 8 | 0 | 40 | `/products`, `/raw-materials`, `/units` | Product / RawMaterial / Unit | `PRODUCT.*` / `RAW_MATERIAL.*` / `UNIT.*` |
| RCP-SCR-001 | 9 | 2 | 0 | 11 | `/recipes` | `RecipeController` | `RECIPE.*` |
| VEH-SCR-001–004 | 30 | 7 | 0 | 37 | `/vehicle-suppliers`, `/vehicles` | Vehicle / VehicleSupplier | `VEHICLE.*` |
| PRC-SCR-001–002 | 12 | 2 | 0 | 14 | `/rates/universal`, `/rates/company` | `RateController` | `RATE.*` |
| ACH-SCR-001 | 6 | 1 | 0 | 7 | `/charges` | `ChargeController` | `CHARGE.*` |
| STAT-SCR-001 | 6 | 1 | 0 | 7 | `/statutory-timing` | `StatutoryController` | `STATUTORY.VIEW/MANAGE` |
| INW-SCR-001–005 | 47 | 10 | 0 | 57 | `/inward/vendor`, `/production`, `/opening-stock`, `/returns`, `/inward` | Inward / Return | `INWARD.*` / `OPENING_STOCK.ADD` |
| DSP-SCR-001–003 | 28 | 6 | 0 | 34 | `/rejections/create`, `…/reassign`, `…/disposition` | `RejectionController` | `DISPATCH.*` |
| WST-SCR-001–003 | 25 | 5 | 0 | 30 | `/wastage`, `/wastage/create`, `/wastage/{id}`, `…/reverse` | `WastageController` | `WASTAGE.*` |
| CHL-SCR-001 | 7 | 2 | 0 | 9 | `/challans` | `ChallanController` | `CHALLAN.LIST` |
| CHL-SCR-002 | 14 | 2 | 1 | 17 | `/challans/create`, `/challans/{id}` | `ChallanController` | `CHALLAN.*` / `INVOICE.ADD/APPROVE` |
| INV-SCR-001 | 8 | 2 | 0 | 10 | `/invoices/unbilled` | `UnbilledController` | `INVOICE.ADD/LIST/VIEW` |
| INV-SCR-002 | 9 | 2 | 0 | 11 | `/invoices/later` | `LaterInvoiceController` | `INVOICE.ADD/VIEW/EDIT` |
| INV-SCR-003 | 12 | 2 | 0 | 14 | `/invoices/{id}` | `InvoiceController` | `INVOICE.VIEW/EDIT/APPROVE/CANCEL` |
| INV-SCR-004 | 7 | 2 | 0 | 9 | `/invoices` | `InvoiceController` | `INVOICE.LIST` |
| INV-SCR-007 | 10 | 2 | 0 | 12 | `/invoice-reservations` | `InvoiceReservationController` | `INVOICE.RESERVE_NUMBER/RELEASE_NUMBER` |
| INV-SCR-008 | 12 | 3 | 0 | 15 | `/invoices/{id}/irn` | `InvoiceController` | `INVOICE.RECORD_IRN_DETAILS` |
| INV-SCR-010 | 7 | 2 | 0 | 9 | `/credit-notes` | `CreditNoteController` | `CREDIT_NOTE.LIST/VIEW` |
| INV-SCR-011 | 9 | 2 | 0 | 11 | `/credit-notes/create`, `/credit-notes/{id}` | `CreditNoteController` | `CREDIT_NOTE.CREATE/EDIT/APPROVE` |
| INV-SCR-012 | 12 | 3 | 0 | 15 | `/credit-notes/{id}/irn` | `CreditNoteController` | `CREDIT_NOTE.RECORD_IRN_DETAILS` |
| RPT-SCR-001–013 | 78 | 13 | 1 | 92 | `/reports/{slug}`, `/reports/material-ledger` | Report / Ledger | `REPORT.VIEW/EXPORT` |
| IAM-SCR-001 | 13 | 3 | 0 | 16 | `/iam/users…` | `IamUserController` | `IAM.VIEW/MANAGE_USERS` |
| IAM-SCR-002 | 13 | 3 | 0 | 16 | `/iam/roles…` | `IamRoleController` | `IAM.VIEW/MANAGE_ROLES` |
| AUD-SCR-001 | 5 | 1 | 0 | 6 | `/audit` | `AuditController` | `AUDIT.VIEW/EXPORT` |

**Scope:** authenticated group uses `scope:optional`. Record pages 403 on Company/Plant violation (not empty 200) — reconfirm at Checkpoint F.

**Operational vs compatibility:** INW-SCR-001/002/003 Review-PendingApproval/Approved/ReturnedForCorrection remain **compatibility-only** (direct-post on Save). DSP-SCR-003 Reversed is compatibility (no reverse). INW-SCR-004 has no `/approve` route. Loading skeletons are overlay-only. PermissionRestricted is operational when the active role lacks the grant; overlay still used in HTTP frame tests.

**Automated render:** Phase 1–6 `*FrameHttpTest` classes iterate `all()` (88+216+110+77+99+32 names with the documented overlaps). **This is not live-browser proof** and often not semantic-state proof.

**Live browser:** Phase 3–6 implementation reports record sampled live QA. **Not re-run at current HEAD in this planning turn.** Gap `P7-RSP-002` / `P7-A11Y-005`.

**`/account/password`:** operational first-login gate; **not** a CSV frame.

---

## 7. Duplicate / alias / proof-frame treatment

- **Duplicates:** none in CSV; implementation overlap is INV-SCR-004 dual listing only.
- **Aliases:** 12 CSV keys are the catalog names. Figma names (`D-AUD-SCR-001-Default`, `D-RPT-SCR-006-InventoryPosition-Default`, `D-INV-SCR-008-IRNFailed`, …) must be accepted as equivalent in P28 mapping and tests, **not** registered as extra frames. `Phase4Frames::FIGMA_IRN_GENERATED_ALIAS` is already documented as traceability-only.
- **Proof frames:** `D-PTY-PROOF-ClientDeactivationBlocked` and `D-PTY-PROOF-ClientDeactivationWarning` **do not exist** in CSV, catalogs, or `app/`. Classify separately. Do not count in 606. Do not add (`P7-SRC-003`).

---

## 8. Route / View / FrameCatalog traceability

- Production routes: `app/Config/Routes.php` — GET and POST only. No `$routes->delete`. No seed/demo/probe/fixture/`/test` paths (`ProductionRouteAbsenceTest`).
- Unauthenticated `GET /` → `AuthFilter` redirect `/login`. Authenticated `GET /` → Dashboard (`HomeController`). Authenticated `GET /login` → `/`.
- CSRF is global on POST (`app/Config/Filters.php`). Auth + `sessionVersion` + `passwordGate` + `scope:optional` wrap the app group.
- Sidebar: `c_nav_02_sidebar.php` filters by **active-role** permission. No union.
- `?frame=` overlay: `FrameSimulation` in `development`/`testing` only.
- Extra T01 surfaces (`/recipes` list, `/vehicles`, `/raw-materials`, `/vehicle-manufacturers`, `/vehicle-brands`) are **not** additional Frame IDs (Phase 2 plan).

---

## 9. Responsive audit

**Reference viewports:** desktop 1440×1024 (catalog `viewport_size`); tablet **1024×768**; mobile **390×844**.

**Shared shell (code, not live pass):**

- Mobile header + hamburger: `c_nav_01_shell.php`; `min-width/min-height: var(--component-touchtarget-min)` (token 44px).
- Drawer closed by default: `.sidebar { transform: translateX(-100%) }` under `.viewport-mobile` and `@media (max-width: 767px)`.
- No stacked desktop sidebar at those breakpoints (`position: fixed`).
- `html` / `.app-main` `overflow-x: hidden`.
- List/report cards: `.mobile-only` / hide `.desktop-only` at 767px.
- Sticky footer: `.sticky-actions`; IAM mobile adds padding-bottom so the bar does not cover fields.

**Defect / gap:**

| ID | Issue |
|---|---|
| `P7-RSP-001` | `T-RPT-SCR-006` pin+internal scroll is gated on `$ui['device']==='T'` (simulation). Operational 1024×768 does not enter that branch. |
| `P7-RSP-002` | Per-frame 390×844 overflow/touch/footer matrix was **not** re-run at current HEAD for all 107 mobile + 3 tablet frames. Historical Phase 3–6 QA is not this HEAD. |

**Per-frame responsive result (planning):** every M/T CSV name is **accounted** in catalogs and has an HTTP render test in some phase suite. **PASS/FAIL for overflow, 44px, drawer, sticky footer, and 10-column tablet access is G (evidence gap)** until Checkpoint C/I. This plan does not invent 107 live PASSes.

**T-RPT-SCR-006 requirements to implement/verify:** 1024×768; Material column pinned; remaining nine reconciliation columns scroll inside the table viewport; Closing reachable; no page-level horizontal overflow. Mobile reports must stay cards — no mobile horizontally scrolling table (card-list already exists).

---

## 10. Accessibility audit

P30 representative frames (Blueprint 20.3 / Prompt Pack). Application mapping:

| # | Frame | App mapping | Planning result |
|---|---|---|---|
| 1 | D-SHELL-Default | `c_nav_01_shell` + `layouts/app` (not a CSV row) | **D:** no skip link (`P7-A11Y-001`) |
| 2 | D-CHL-SCR-002-Create-Error | `/challans/create` overlay Error | **D/G:** errors exist; no summary-focus / `aria-describedby` system (`P7-A11Y-006`) |
| 3 | D-CHL-SCR-002-Create-Approved | operational or overlay | **G:** live keyboard grid not re-run |
| 4 | D-INV-SCR-003-Review-PendingIRN | `/invoices/{id}` | **D:** native `disabled` not focusable (`P7-A11Y-004`) |
| 5 | D-INV-SCR-008-Create-IRNFailed | CSV key; alias `D-INV-SCR-008-IRNFailed` | **G:** field-set swap exists; announce/focus not proven |
| 6 | D-INV-SCR-008-Create-PermissionRestricted | alias `…-PermissionRestricted` | **G:** statutory block copy exists; timezone spoken-in-full not proven |
| 7 | D-DSP-SCR-003-Review-PermissionRestricted | disposition view | **G:** hidden vs greyed — re-check a11y tree |
| 8 | D-IAM-SCR-001-Edit-PermissionRestricted | `/iam/users/{id}/edit` | Hybrid C shows disabled options + reason; native disabled (`P7-A11Y-004`) |
| 9 | D-RPT-SCR-006-Report-Default | CSV key (alias InventoryPosition) | **G:** table semantics present; pinned column desktop vs tablet |
| 10 | T-RPT-SCR-006-Report-Default | simulation tablet wrap | **E:** see `P7-RSP-001`; scroll container has `tabindex="0"` |
| 11 | M-CHL-SCR-002-Create-Error | mobile overlay | **G:** 44px / cards — live not re-run |
| 12 | D-AUD-SCR-001-View-Default | CSV key; alias `D-AUD-SCR-001-Default` | UTC + IST in `_detail.php`; ordered list of attempts on IRN views; **G** for shell list semantics |
| 13 | D-WST-SCR-001-Create-Draft | `/wastage/create` | **G:** attachment overlay OV-15 present; announced progress not proven |
| 14 | D-CMP-SCR-002-Edit-PermissionRestricted | company form + OV-12 | **D:** no focus trap (`P7-A11Y-003`) |
| 15 | D-DSH-SCR-001-View-Error | dashboard `role="alert"` | Partial: alert exists; “without stealing focus” **G** |

**Cross-cutting P30 vs app:**

| Requirement | Classification |
|---|---|
| Skip link | Application defect |
| Visible 2px/2px focus | Application defect (`app.css` has no `:focus-visible`) |
| Overlay focus trap + restore | Application defect |
| OV-06/13 Cancel-only (no Escape/scrim) | Application defect vs Blueprint (JS Escape currently closes nav; overlays close via `[data-overlay-close]` / scrim patterns) |
| Labels on inputs | Mostly present (`label` wrapping); verify remaining |
| Status not colour-alone | Badges include text; **G** for charts |
| Semantic tables | `table.data-table` used on desktop lists/reports |
| Touch 44×44 | Token + mobile media; **G** live |
| Reduced motion | No `prefers-reduced-motion` in `app.css` — defect/gap |
| Unique page heading | Production pages use one `h1` |
| Contrast vs tokens | Tokens compiled; hardcoded banner hex is a visual defect |
| Figma annotation pins | Figma-only (H); not required in PHP |

Developer-handoff pins are **not** a substitute for server-rendered behaviour.

---

## 11. Visual consistency audit

Translate Figma token/component rules to CSS custom properties, CI4 partials, helpers, layouts — not a Figma API.

Actionable (not exhaustive live pass):

| ID | Screen/frame | Route | File | Element | Expected | Actual | Severity |
|---|---|---|---|---|---|---|---|
| `P7-VIS-001` | Shell / preview | any `?frame=` in development | `public/css/app.css` | `.banner-preview`, `.overlay` scrim | Token colours | `#fff8e1` `#6b5400` `#c9a227`; `rgba(15,23,42,0.45)` | E |
| `P7-VIS-002` | Data tables | list/report routes | views + `app.css` | numeric `td` | Tabular nums, header alignment | KPI-only `tabular-nums` | E/G |
| `P7-RSP-001` | T-RPT-SCR-006 | inventory-position | `report/show.php` | pin wrap | Operational at 1024×768 | Simulation `device===T` only | E |
| — | Calculation Summary | invoice/CN | `c_dat_12_calculation_summary.php` | order + zero round-off | Fixed order; always show round-off | Shared partial + `CalculationContract` — **preserve**; regression-test only | J unless a screen bypasses the partial |
| — | PermissionRestricted | IAM/reports | various | hide vs grey | Hide unauthorised **actions**; Hybrid C **disables** ungrantable options with reason | Matches Hybrid C for IAM; reports hide Export | Verify DSP/INV hide vs grey at Checkpoint E |

Proposed correction style: fix tokens/partials once, then regress consumers. No broad rewrite.

---

## 12. Content / terminology audit

Mechanical scan of `app/Views` (see `terminology_hits.csv`).

| Term | Visible production | Classification |
|---|---|---|
| Billing Manager | Not in production views (asserted in Phase 6 tests) | J |
| Alankit / Generate IRN / IRN queue | Not in `app/` views; tests forbid | J |
| automatic retry | INV-SCR-012 lede: **“There is no automatic retry”** | J — legitimate denial |
| Unit Cost / profit / margin / valuation | RPT lede: **“not reported”** | J — prohibition statement |
| Lorem ipsum / TODO / Alert title / Helper text / breadcrumb Section | Not in production views | J |
| HTML `placeholder=` on search/reason fields | Input hints | J — not Figma component-default “placeholder” catalogue |
| `welcome_message.php` / CI error templates | Not routed as ERP screens | J — unused/framework |
| Write-Off Review / Debit Note / Approve Both | Not found in production views | J |

**Approved terms already in use:** Billing Clerk; Record IRN Outcome / Retry IRN manually (invoice IRN views); Wastage Review and Approval / Wastage Reversal; Invoice approval separate from Challan approval.

**Gap:** no breadcrumb “Section / Current Page” chrome (`P7-NAV-001`). Do not introduce those Figma placeholder labels as visible text.

---

## 13. Business reconciliation

Existing tests still encode the frozen set (`LedgerReconciliationTest`, `Phase6CloseoutTest`, `Phase5InventoryGstTest`, golden invoice/CN tests). **Not re-executed in this planning turn** (suite was already green at `146baa1`). Phase 7 must re-run, not rewrite:

| Item | Frozen value |
|---|---|
| Allocation | 18.000 + 12.000 = **30.000 MT** |
| LOT-2026-00230 remaining | **13.000 MT** |
| Disposition | 3.000 + 7.000 + 2.000 = **12.000 MT**, Fully Disposed, WST-2026-000067 Approved |
| Ledger | 120.000 + 25.000 − 30.000 + 3.000 − 2.000 → closing **116.000 MT** |
| INV-2026-000119 | **₹177,592.00** |
| CRN-2026-000031 | **₹75,089.00**; zero-valued second line visible; round-off **+₹0.28**; invoice credit status changes only after CN IRN success |
| `INWARD.REVERSE` | Store Keeper + Super Admin only; no `INWARD.APPROVE`; no permission union |
| `AUDIT.EXPORT` | Independent from `REPORT.EXPORT` |
| IRN | Manual recording; no automatic retry/job/queue; failure leaves Pending IRN; fresh manual recording allowed |

Checkpoint G is verification only unless a regression appears.

---

## 14. P28 flow reconciliation

**Evidence used (not assumed blindly):**

From `P28-Manual-Cross-Page-Prototype-Links.md` (preserved):

| Metric | Documented |
|---|---:|
| Authoritative prototype-matrix rows | 77 |
| Live matrix reactions | 54 |
| Native/no-navigation rows | 2 |
| Documented cross-page rows | 21 |
| Supplementary back reactions | 3 |
| Total live reactions in the Figma file | 57 |
| Effective unique cross-page connections | 20 (row 17 duplicates row 4) |
| Missing source/destination frames | 0 |

From Prompt Pack P28 / Blueprint §18: **24 flow boards**, desktop wired, mobile not separately wired in Figma Phase 1.

**Figma Plugin API limitation is H for Figma. It is not a web-application limitation.** The PHP app must provide navigation for every **operational** approved flow.

Map (planning — implement in Checkpoint B):

| Flow | Source → app | Notes |
|---|---|---|
| 1 Auth → Dashboard | `/login` → `/` | Operational. No `D-SHELL-Default` CSV frame; shell is layout. |
| 2 Company/Plant/Role switch | `POST /session/switch-role` | Operational select, not Figma `D-SHELL-RoleSwitch` frame. Restricted dashboard is PermissionRestricted overlay or real role. |
| 3 Master creation | Phase 2 create routes | Operational. |
| 4 Vendor inward → inventory | `/inward/vendor` → reports | P28 row uses Figma alias InventoryPosition; app route `/reports/inventory-position`. |
| 5 Production inward | `/inward/production` | Operational. |
| 6 Challan allocation | `/challans/create` | Operational. |
| 7 Challan then Invoice approval | stay on page after challan approve; invoice approve separate | Operational; must not combine. |
| 8 Later Invoice | `/invoices/later` | Operational; no Save and Approve Both. |
| 9 Number reservation | `/invoice-reservations` | Operational. |
| 10 Customer rejection | IRN-generated challan → `/rejections/create` | Need visible control on eligible challan/invoice — verify not overlay-only. |
| 11 Partial reassignment | `/rejections/{id}/reassign` | Operational. |
| 12 Material return | disposition → `/inward/returns` | P28 uses INW-SCR-004; no approve route. |
| 13 Wastage approval | `/wastage/{id}` | Operational. |
| 14 Wastage reversal | `/wastage/{id}/reverse` → ledger | Operational. |
| 15 Invoice IRN success | `/invoices/{id}/irn` | Manual; aliases on INV-008. |
| 16 IRN failure + fresh manual | same IRN route | Not a retry job. |
| 17 Invoice → partial CN | Create Credit Note on IRN-generated invoice | Operational. |
| 18 CN approval + IRN | `/credit-notes/{id}`, `/irn` | Operational. |
| 19 Ledger drill-down | `/reports/material-ledger` links | Verify reference links to inward/challan/wastage — **G**. |
| 20 Inventory drill-down | inventory-position | Adjustment ids printed; **G** for operational drill. |
| 21 User access | `/iam/users` | Operational. |
| 22 Active-role switch | same as flow 2 | Duplicate P28 row 17. |
| 23 Audit inspection | `/audit` row → invoice | **G:** confirm document link, not only expand-in-place. |
| 24 Statutory blocked IRN | `/statutory-timing` → RPT-012 → invoice IRN restricted | Operational block; no override. |

Native/no-navigation and overlay-only Figma steps (OV-05 documentation-only in P28 notes) stay **I** if already approved as non-operational.

Do not create fake POST handlers to match a Figma arrow.

---

## 15. Navigation integrity

Inspected `Routes.php`, sidebar, auth filter, CSRF globals.

| Check | Planning result |
|---|---|
| Broken registered routes | None found in source; Checkpoint B must HTTP-check every sidebar href + form action |
| Wrong methods | Mutations are POST; lists/forms GET |
| GET that mutates | Not observed in route table |
| CSRF on POST | Global |
| Unauthorised action visible | Sidebar hides by active permission; Hybrid C disables ungrantable IAM options |
| Unauthorised POST 403 | Phase 6 tests for IAM/audit export; reconfirm others at F |
| Scope empty 200 vs 403 | Reconfirm at F |
| Production seed/demo/probe | Absent |
| DELETE HTTP | Absent |
| Audit edit/delete | Absent |
| CN Cancel/Delete/Void | Absent |
| Automatic IRN routes/jobs | Absent (`exports:process` is report export only) |
| `/` | Unauthenticated → login; authenticated → Dashboard |

---

## 16. Security audit

Revalidation target (Checkpoint F). **Planning read of source + Phase 6 tests; no destructive browser QA.**

| Control | Source evidence | Result |
|---|---|---|
| Active role only | `AuthorizationService::can` | Intact in code |
| No permission union | Union helper test-only | Intact |
| Company/Plant scope | `ScopeService` + filter | Intact; re-test IDOR |
| CSRF | global | Intact |
| Session fixation / `session_version` | AuthService + SessionVersionFilter | Intact |
| Argon2id | `PasswordHasher` | Intact |
| One-time temp password + 24h | `TemporaryCredentialService` | Intact |
| First-login gate | `PasswordChangeGateFilter` | Intact |
| Hybrid C | `AntiEscalation` | Intact |
| Last interactive Super Admin | domain tests | Intact |
| SYSTEM non-interactive | domain tests | Intact |
| Immutable audit | AuditWriter | Intact |
| Report vs Audit export | separate permissions | Intact |
| Opaque download tokens + 30-day expiry | Phase 5 export | Intact |
| CSV formula injection | `CsvSafe` | Intact |
| No secrets in audit | Phase 6 IAM tests | Intact |
| Production ignores `?frame=` | FrameSimulation | Intact |

Do not deactivate the seeded Super Admin or mutate frozen documents in browser QA. Use fixtures.

No **new** security defect was proven this turn beyond a11y of disabled controls (`P7-A11Y-004`, which is D not B unless it leaks an action). Finding `P7-SEC-001` = J pending Checkpoint F.

---

## 17. Current test inventory

`docs/phase7-audit/test_inventory.csv`: **313** `test*` methods in **80** files (matches Phase 6 baseline count).

Rough grouping by filename (not exclusive):

| Bucket | Methods (filename heuristic) | Kind mix |
|---|---:|---|
| Phase 6 `Phase6*` + PermissionGroups | 49 | feature/integration/unit |
| Phase 5 `Phase5*` + export/dashboard/gst | 23 | |
| Phase 4 `Phase4*` + CN/reservation/later | 38 | |
| Phase 3 `Phase3*` | 36 | |
| Phase 2 `Phase2*` | 9 | |
| Phase 1 `Phase1*` | 8 | |
| Other (Phase 0 auth/schema/ledger/IRN/deactivation, etc.) | 150 | mostly integration |

Kinds: integration 173, feature 83, unit 57.

**Character:**

- Frame-name / HTTP-200 loops: `Phase1FrameHttpTest`, `Phase2FrameHttpTest`, `Phase3FrameHttpTest`, `Phase4FrameHttpTest`, `Phase5FrameHttpTest`, `Phase6CloseoutTest` / user/role frame tests.
- Strong domain: ledger, CN G1, Hybrid C, session matrix, production route absence.
- Responsive HTTP: Phase 3/4/5/6 mobile tests (drawer class, 390×844 **viewport attribute**, cards) — not pointer/overflow measurement.
- Almost no dedicated P28 journey tests, P30 keyboard tests, or alias-name tests.

---

## 18. Test-gap analysis

Do **not** invent a final expected test count.

Gaps to close in Checkpoint H (after behaviour fixes):

- Semantic assertions for Empty vs NoResults vs PermissionRestricted vs Loading (not only `data-frame=`).
- Negative permission POST 403 for every mutating route family.
- Concurrency (`row_version`) beyond existing challan/IAM samples.
- 24 operational flows as journey tests (happy, blocked, back).
- Alias strings must **not** appear as catalog keys; may appear as documented equivalents.
- 107 mobile + 3 tablet: overflow, 44px, drawer closed, sticky footer, no horizontal page scroll — preferably browser-level or measured CSS assertions.
- P30 15-frame keyboard/focus/name checks.
- P29 term forbids already partly in `CreditNoteG1Test` / Phase 6; extend to remaining views.
- P31 token/hard-code checks (CSS scan).
- P32 606 uniqueness already unit-testable from CSV + catalogs (`Phase6FramesTest` pattern generalized).

Duplicated coverage: INV-SCR-004 names exercised by Phase 1 and Phase 4 frame tests — acceptable overlap, not extra frames.

---

## 19. Browser-QA plan

Viewports: **1440×1024**, **1024×768**, **390×844**.

Roles: Super Admin (`n.joshi`), Plant Manager (`r.kumar`), Store Keeper (`s.patil`), Billing Clerk (switch S. Patil), Accounts Manager (`a.deshpande`), first-login fixture, deactivated fixture. **Never** destroy the only Super Admin or frozen documents.

Each record: route, viewport, user, role, Company, Plant, frame/state, expected, actual, console, network, overflow, screenshot/video, PASS/FAIL.

ISO dates via the date input API. Invalid typed dates are not application defects.

HTTP 200 is not a pass.

Native date and file inputs: use browser APIs.

Checkpoint I executes this matrix after A–H.

---

## 20. Finding register

Canonical table: `docs/phase7-audit/finding_register.csv`. Classes: A functional, B security, C business, D a11y, E responsive/visual, F content, G test/evidence, H Figma-only, I accepted compatibility, J no defect.

| ID | Class | Summary | Checkpoint | BO? |
|---|---|---|---|---|
| P7-SRC-001 | G | Gitignore hides P28/Prompt Pack; version into `docs/reference` | 0 | Yes |
| P7-SRC-002 | G | Completed P29–P32 Figma outputs absent; Blueprint 590 stale | 0/A | Yes if Figma re-export required |
| P7-SRC-003 | J | Proof frames absent — do not add | A | No |
| P7-COV-001 | J | Mechanical 606/62/12 already reconcile | A | No |
| P7-NAV-001 | G | Breadcrumb vs sidebar back-paths for 21 P28 rows | B | Yes |
| P7-NAV-002 | G | 24 flows lack journey tests | B/H | No |
| P7-A11Y-001 | D | No skip link | D | No |
| P7-A11Y-002 | D | No 2px focus ring | D | No |
| P7-A11Y-003 | D | No overlay focus trap/restore; OV-06/13 dismiss | D | No |
| P7-A11Y-004 | D | `disabled` not keyboard-reachable | D | Yes if native disabled accepted |
| P7-A11Y-005 | G | 15-frame live a11y not run at HEAD | D/I | No |
| P7-A11Y-006 | D | Error summary / `aria-describedby` | D | No |
| P7-RSP-001 | E | Tablet inventory pin is simulation-only | C | No |
| P7-RSP-002 | G | 107+3 live overflow matrix not at HEAD | C/I | No |
| P7-VIS-001 | E | Hard-coded banner/scrim colours | E | No |
| P7-VIS-002 | G | Tabular numbers on tables | E | No |
| P7-CNT-001 | J | No prohibited visible terms (denial copy OK) | E | No |
| P7-SEC-001 | J | Phase 6 security model intact pending F | F | No unless new defect |
| P7-TST-001 | G | HTTP-200 / missing journeys | H | No |
| P7-TST-002 | G/I | Overlay-only CSV states | A/B/I | Yes if a state must become persisted |

No **A/B/C** blocking functional/security/business defect was proven against frozen figures or the permission model in this read-only pass. Accessibility and tablet-pin issues are still **required Phase 7 work**.

---

## 21. Remediation checkpoints

Propose only. **Do not execute until this plan is approved.**

| CP | Name | Intent | Focused proof | Regression |
|---|---|---|---|---|
| **0** | Source and baseline | Version handoff files if BO agrees; record checksums; confirm HEAD/tag/313/10394/0 | Checksums + `git status` clean | None |
| **A** | Mechanical 606/62 | Automate CSV↔catalog uniqueness in tests; classify overlay vs operational states; do not add proof frames | Extended frames unit tests | Phase 6 suite |
| **B** | Navigation and 24 flows | Map P28 operational steps to controls; fix missing links/drill-downs; no fake POST | Journey tests for flows 1–24 operational subset | Prior + Phase 0–6 |
| **C** | Responsive | Operational T-RPT-006 pin; 390×844 composition; no page overflow | Mobile/tablet tests + measured CSS | A–B |
| **D** | Accessibility | Skip link, focus ring, trap/restore, error association, reduced-motion | P30 15-frame checks | A–C |
| **E** | Visual/content | Tokenize hardcoded colours; tabular nums; PermissionRestricted hide vs grey; terminology scan | CSS/view scans | A–D |
| **F** | Security/permission | Re-run Hybrid C, 403 matrix, scope IDOR, CSRF, session, export, `?frame=` | Existing + any new negative tests | Full prior |
| **G** | Business reconciliation | Re-assert frozen ledger/allocation/disposition/invoice/CN/IRN/grants | Existing golden tests | Full prior |
| **H** | Automated acceptance | Fill G gaps; still **do not invent** a target count | Whole `vendor/bin/phpunit --no-coverage` | All |
| **I** | Live browser matrix | Desktop/tablet/mobile × roles; screenshots/video | QA records | All |
| **J** | Handoff and closeout | Reports listed in §22; tag; health `phase` only if BO wants 7 | Docs + suite + clean tree | All |

Each implementation commit: focused tests, prior-checkpoint regression, exact files, no unrelated refactor, hash, clean tree, rollback for any authorised migration (none expected), BO approval before schema/permission/business changes.

Prefer shared layout/CSS/partials, then consumer regression. No broad mechanical rewrite.

---

## 22. Final handoff artifacts

Produce **after** implementation (not this turn), except this plan and `docs/phase7-audit/*`:

- `docs/PHASE7_IMPLEMENTATION_REPORT.md`
- `docs/FINAL_HANDOFF_REPORT.md`
- `docs/FINAL_ROUTE_MATRIX.md`
- `docs/FINAL_PERMISSION_MATRIX.md`
- `docs/FINAL_FRAME_COVERAGE.csv`
- `docs/FINAL_FLOW_COVERAGE.csv`
- `docs/FINAL_ACCESSIBILITY_REPORT.md`
- `docs/FINAL_SECURITY_REPORT.md`
- `docs/FINAL_KNOWN_LIMITATIONS.md`
- `docs/reference/SOURCE_CHECKSUMS.md` (updated)

Handoff report must identify: implementation HEAD, documentation HEAD, tag, schema/migration status (expect **no** new migration), 606/62/responsive/a11y/flow/security results, test totals, browser-QA totals, accepted limitations, deploy prerequisites, backup/restore, production env vars, cron (`inventory:process-expiry`, `exports:process`, `exports:cleanup`, `jobs:monitor` — **no IRN cron**), **no default/demo credentials in production**.

---

## 23. Entry criteria

- Phase 6 tag `phase-6-final-approved` on `bd0f3ceec6e46857883dfc24e6bd546fbb8bc600`.
- Implementation baseline `146baa1` behaviour unchanged until CP-B+.
- This plan approved by the Business Owner.
- Working tree clean except approved Phase 7 files.
- PHPUnit 313/10394/0 at baseline (reconfirm CP-0).
- No Phase 7 implementation started before approval.

---

## 24. Exit criteria

Eventual Phase 7 acceptance:

- 606/606 manifest frames accounted for  
- 496 desktop, 107 mobile, 3 tablet  
- 62/62 Screen IDs  
- 12 approved aliases only  
- 0 missing application frames, 0 extra, 0 duplicate names  
- 0 broken routes/destinations  
- 0 prohibited DELETE actions  
- 0 automatic IRN behaviour  
- 0 permission-union behaviour  
- 0 actionable security defects  
- 0 business reconciliation failures  
- 0 mobile horizontal **page** overflow  
- 0 missing **required** accessibility behaviour (skip link, focus, trap, names, error association, non-colour status, table semantics, 44px on touch, timezone in statutory detail)  
- All 24 approved flows operationally accounted for (I for approved compatibility-only)  
- All automated tests green (count not predetermined)  
- Full browser QA completed  
- Phase 0–6 frozen behaviour preserved  
- Final handoff package complete  

Accepted Figma-only limitations (H) must be listed in `FINAL_KNOWN_LIMITATIONS.md` and must not hide an application defect.

---

## 25. Blocking Business Owner decisions

| # | Decision | Recommendation |
|---|---|---|
| 1 | Version gitignored/session handoff files (P28, Prompt Pack, Blueprint, BRD, FRIS, TDD, Figma URL) into `docs/reference/`? | **Yes.** Planning can proceed without it; long-term audit cannot. |
| 2 | Re-export completed P29–P32 Figma pages, or accept application-side recreation of those audits? | **Accept application-side audits** as Phase 7 evidence. Optional Figma export is H. CSV 606 overrides Blueprint 590. |
| 3 | Breadcrumb chrome vs sidebar/record links as P28 back-paths? | **Prefer existing sidebar + in-record links** unless BO requires Figma-literal breadcrumbs. Do not ship “Section / Current Page” placeholders. |
| 4 | Native `disabled` vs `aria-disabled` for P30 “disabled remains focusable”? | **Implement aria-disabled (or readonly + reason) for required P30 frames.** Native disabled is a documented limitation only if BO explicitly accepts it. |
| 5 | Which overlay-only CSV states must become real operational states (Loading/Empty/Error)? | **Loading:** keep as non-production overlay (I). **Empty/NoResults:** operational when data/filters match. **PermissionRestricted:** operational via real roles, overlay only for HTTP fixtures. **Inward approval FSM frames:** remain I. |
| 6 | New schema, permissions, or business rules? | **None proposed.** Any finding that seems to need them stops for a separate decision. |
| 7 | Health JSON `phase: 7` after closeout? | **Yes, only at Checkpoint J** after implementation exists. Stay at 6 until then. |
| 8 | Add proof frames to the application? | **No.** |

Until (1)–(5) and this plan are approved, **do not start Checkpoints B–J.** Checkpoint 0 docs-only versioning may proceed if BO approves item 1 independently.

---

## 26. Implementation has not started

No migrations, schema, routes, controllers, models, services, views, CSS, JavaScript, seeders, permission catalogue, FrameCatalog, production data, or existing tests were changed in this planning turn.

README gained only a pointer to this file. Supporting evidence was added under `docs/phase7-audit/`.

**Phase 7 is not implemented. Waiting for Business Owner approval.**

STOP.