# Private health-dashboard review workspaces and focused release gates

Use this reference for bounded UI/navigation sprints that convert health-dashboard queues or histories into master-detail workspaces without broadening medical, database, worker, or authentication semantics.

## Workspace invariants

- Build exactly one independent editor for the selected item. Do not construct every editor inside closed/detached `<details>` cards and move one form afterward. `<details>` may remain only as an optional disclosure such as “Details und Datenherkunft”.
- On mobile, list and detail are separate durable states. “Zur Liste” removes the selected opaque key from the URL/history; reload must remain on the list. Selecting an item adds the key and moves visible focus to the detail heading.
- The URL is the durable state for workspace, filter/sort state, and opaque selection. Reload, Back, and Forward must restore the visible state—not merely route parameters.
- Task routing to a queue must set the exact workspace and open filter, then restore the remembered exact opaque key only if it remains valid; otherwise select the first open item.

## Exact queue-action identity

- A queue receipt must remain attached to the submitted opaque queue key. Under an `open` filter, “vorgemerkt” is still open/in-process—not done—and must not cause the UI to silently select a different row.
- Keep CSRF, exact queue-key validation, action inbox, and worker revalidation unchanged. UI sprints must not auto-verify or mutate review status.
- Never infer simple/composite product type from unrestricted reason text or keyword matching. If no trusted structured field exists, use “Produktart nicht bestimmt” and fail closed.

## Browser-bundle privacy

- Do not ship unrestricted DB text merely because it is not visibly rendered. Queue reasons, source notes, local paths, URLs, filenames, raw payloads, internal IDs, and worker diagnostics must be excluded from the browser bundle unless explicitly allowlisted and bounded.
- Contract validation should reject fields that must never reach the browser, not merely stop the renderer from using them.
- Add a synthetic sentinel test that injects a private-looking reason and proves the generated HTML does not contain it.

## Document master-detail and route restoration

- Keep list requests paginated/bounded. A selected document deep link must resolve independently of membership in the first list page through an existing bounded opaque-detail/preview endpoint.
- Direct detail resolution should remain bounded (for example, a fixed maximum number of section pages), use the opaque ID only, and preserve reviewed-only versus extracted-but-unreviewed boundaries.
- For unreviewed extracted content, show the explicit warning that it has not been checked against the original. Original availability, extraction, content review, and verified search remain separate states.
- If technical filters cannot be applied server-side without changing API semantics, state clearly that they apply to the currently loaded bounded page and preserve the same filters when advancing the existing cursor. Do not imply global completeness. Report before expanding central API semantics.

## Focused test plan

During the UI sprint, run only focused suites:

1. New workspace browser group: desktop/mobile mapping, filters, exact selection, reload/Back/Forward, task routing, queued action identity, document desktop/mobile, original access, header/search/navigation, no external requests or page overflow.
2. Explicit off-page document test: selected opaque document is absent from list page one; direct detail and extracted preview survive reload and Back/Forward.
3. Explicit bounded-filter test: page-local disclosure is visible and cursor continuation retains filters.
4. Existing targeted regressions: mapping action/CSRF, document originals, V5 authentication, record routes, main navigation.
5. Ruff and syntax only for changed files; no full Python/browser matrix until the milestone requested by the sprint plan.

Before commit, update the focused runner and include the new group in the default future milestone matrix, but do not execute that full matrix prematurely. Keep automated results and manual domain reviews separate. After any concrete review blocker, remediate it and perform one focused remediation review rather than starting repeated broad review rounds.

## Private release sequence

- Verify base SHA, `origin/main`, clean tree, private authenticated preview, and protected V4 hash.
- Commit with the requested exact title; no amend/force-push.
- Push, deploy only private V5 runtime sources/HTML, restart the user service when explicitly authorized, then perform one compact authenticated smoke.
- Smoke only technical outcomes: service state, V4/V5 HTTP, runtime-source hashes, workspace load, allowed original HEAD/open, console/failed/external request counts, and unchanged V4 checksum. Never emit medical values, product/document names, private routes, local paths, or credentials.