# Operations & Content — Final Acceptance Matrix

`Yes` means the case is covered by the named automated contract and, for visual
states, by the screenshot manifest. `N/A` means the current backend does not expose
that operation; no route or UI action was invented.

## Auctions

| Page/Action | Case | Expected result | Test name | Passed |
|---|---|---|---|---|
| List | Success | Real DTO records render in compact lifecycle rows. | `all six redesigned list pages render populated records with compact resource regions` | Yes |
| List | Empty | Contextual empty state is compact and adjacent to pagination. | `all six redesigned list pages render contextual empty states without viewport-sized dead space` | Yes |
| List | Loading | Resource region and controls recover in `finally`. | `list pages expose local loading, filter, refresh, and directly-adjacent pagination contracts` | Yes |
| Filter | Open | Panel clears the header; first field and dropdown remain fully visible. | `filter studios preserve real routes, names, and fully visible first rows` | Yes |
| Filter | Apply | Safe query replaces only the auction fragment. | `filter open, apply, reset, loading-finally, and fragment replacement work locally` | Yes |
| Filter | Reset | Values and internal scroll reset without changing the route. | `filter open, apply, reset, loading-finally, and fragment replacement work locally` | Yes |
| Filter | Invalid | Invalid fragment/query is rejected and current rows remain intact. | `invalid filter HTML is rejected without replacing the current resource fragment`; `ObjectId, filter enum, and operator-injection validation reject malformed input` | Yes |
| Create | Success | Not supported by existing backend. | N/A | N/A |
| Create | Validation | Not supported by existing backend. | N/A | N/A |
| Edit | Success | Existing update route and exact fields submit once with multipart CSRF. | `supported create and edit pages preserve exact backend field names and bilingual direction`; `multipart body tokens are parsed for all five upload routes and missing tokens never hit controllers` | Yes |
| Show | Details | Safe grouped lifecycle, people, media, dates, chat, and actions render. | `auction list, details, edit, actions, live data, and chat render from real DTO fixtures` | Yes |
| Workflow | Status | Approve, reject, cancel, live/upcoming/completed states use existing routes/enums. | `supported workflow and visibility controls use real routes and protected state inputs` | Yes |
| Delete | Single | Existing soft-delete action uses custom confirmation. | `custom delete confirmation sends CSRF, removes the row, and avoids window.confirm` | Yes |
| Delete | Bulk | Existing IDs payload is validated and soft-deleted. | `all 22 Operations-Content mutation routes preserve their path and enforce CSRF before the controller` | Yes |
| Security | CSRF rejection | Missing/invalid token returns 403 before every mutation controller. | `missing and invalid CSRF reject every Operations-Content mutation before its controller` | Yes |
| Validation | Invalid ObjectId | Invalid/operator-shaped IDs are rejected before controller/database access. | `ObjectId, filter enum, and operator-injection validation reject malformed input` | Yes |
| Dropdown | Keyboard | Arrow keys, Enter, Escape, focus restoration, and ARIA work. | `custom dropdown supports mouse selection, keyboard navigation, Escape, and ARIA` | Yes |
| Theme | Dark | Dark tokens retain readable hierarchy and controls. | `premium CSS includes measured density, dark, RTL, mobile, focus, and reduced-motion contracts` | Yes |
| Responsive | Mobile | No horizontal overflow; actions and lifecycle content reflow. | `premium CSS includes measured density, dark, RTL, mobile, focus, and reduced-motion contracts` | Yes |
| Media | Broken media | Designed fallback replaces failed image without repeated requests. | `broken media switches to a designed fallback without a repeated broken request` | Yes |

## Reasons

| Page/Action | Case | Expected result | Test name | Passed |
|---|---|---|---|---|
| List | Success | Approved compact Reasons benchmark remains unchanged. | `Reasons benchmark remains on its approved premium assets and custom interaction system` | Yes |
| List | Empty | Approved contextual empty state remains intact. | `Reasons benchmark remains on its approved premium assets and custom interaction system` | Yes |
| List | Loading | Existing local loading/finally behavior remains intact. | `invalid refresh HTML restores the original table and every loading control` | Yes |
| Filter | Open | No user-facing filter panel is supported by the existing backend. | N/A | N/A |
| Filter | Apply | No user-facing filter fields are supported by the existing backend. | N/A | N/A |
| Filter | Reset | No user-facing filter fields are supported by the existing backend. | N/A | N/A |
| Filter | Invalid | Technical refresh query remains validated; no new filter was invented. | `ObjectId, filter enum, and operator-injection validation reject malformed input` | Yes |
| Create | Success | Existing bilingual payload submits through the approved form system. | `supported create and edit pages preserve exact backend field names and bilingual direction` | Yes |
| Create | Validation | Arabic/English writing systems are enforced after blur/submit. | `Arabic and English reason fields reject letters from the wrong writing system`; `form feedback is reserved but hidden until blur or submit` | Yes |
| Edit | Success | Existing edit route, fields, and response URL are preserved. | `Reasons benchmark remains on its approved premium assets and custom interaction system` | Yes |
| Show | Details | Safe bilingual values and timestamps render without raw documents. | `show pages render safe grouped DTO content and media fallbacks` | Yes |
| Workflow | Status | Approved custom active-status dropdown remains intact and keyboard accessible. | `custom status select supports mouse and keyboard selection with focus restoration` | Yes |
| Delete | Single | Existing route uses premium confirmation and safe missing-record behavior. | `single deletes handle missing records and Slider bulk delete preserves the last active item` | Yes |
| Delete | Bulk | Existing IDs validator and route behavior are preserved. | `all 22 Operations-Content mutation routes preserve their path and enforce CSRF before the controller` | Yes |
| Security | CSRF rejection | Missing/invalid token returns 403 before create/edit/delete controllers. | `missing and invalid CSRF reject every Operations-Content mutation before its controller` | Yes |
| Validation | Invalid ObjectId | Invalid IDs are rejected before controller/database access. | `ObjectId, filter enum, and operator-injection validation reject malformed input` | Yes |
| Dropdown | Keyboard | Existing status custom select preserves keyboard/focus behavior. | `custom status select supports mouse and keyboard selection with focus restoration` | Yes |
| Theme | Dark | Approved Reasons dark theme has no regression. | `Reasons benchmark remains on its approved premium assets and custom interaction system` | Yes |
| Responsive | Mobile | Approved compact form/row system reflows without overflow. | `Reasons benchmark remains on its approved premium assets and custom interaction system` | Yes |
| Media | Broken media | This resource has no media field in the existing backend. | N/A | N/A |

## Contact Messages

| Page/Action | Case | Expected result | Test name | Passed |
|---|---|---|---|---|
| List | Success | Safe sender/contact DTO fields render in compact rows. | `all six redesigned list pages render populated records with compact resource regions` | Yes |
| List | Empty | Contextual empty state replaces dead viewport space. | `all six redesigned list pages render contextual empty states without viewport-sized dead space` | Yes |
| List | Loading | Local region and actions recover in `finally`. | `list pages expose local loading, filter, refresh, and directly-adjacent pagination contracts` | Yes |
| Filter | Open | Search/status fields are fully visible below the fixed header. | `filter studios preserve real routes, names, and fully visible first rows` | Yes |
| Filter | Apply | `/contactUs/filter` replaces only the fragment and retains values. | `filter open, apply, reset, loading-finally, and fragment replacement work locally` | Yes |
| Filter | Reset | Form and internal filter scroll reset safely. | `filter open, apply, reset, loading-finally, and fragment replacement work locally` | Yes |
| Filter | Invalid | Invalid enum/operator values and invalid HTML are rejected. | `invalid filter HTML is rejected without replacing the current resource fragment`; `ObjectId, filter enum, and operator-injection validation reject malformed input` | Yes |
| Create | Success | Not supported by existing backend. | N/A | N/A |
| Create | Validation | Not supported by existing backend. | N/A | N/A |
| Edit | Success | Not supported by existing backend; reply remains the existing mutation. | N/A | N/A |
| Show | Details | Sender identity and communication fields render through a safe DTO. | `show pages render safe grouped DTO content and media fallbacks` | Yes |
| Reply | Success | Existing reply route submits once with protected payload and premium modal/form. | `supported workflow and visibility controls use real routes and protected state inputs`; `form mutation transport includes CSRF and blocks duplicate submissions` | Yes |
| Delete | Single | Existing delete route uses custom confirmation and safe not-found response. | `single deletes handle missing records and Slider bulk delete preserves the last active item` | Yes |
| Delete | Bulk | Existing IDs payload and response URL are preserved. | `all 22 Operations-Content mutation routes preserve their path and enforce CSRF before the controller` | Yes |
| Security | CSRF rejection | Missing/invalid token returns 403 before reply/delete controllers. | `missing and invalid CSRF reject every Operations-Content mutation before its controller` | Yes |
| Validation | Invalid ObjectId | Invalid detail/delete/reply IDs are rejected. | `ObjectId, filter enum, and operator-injection validation reject malformed input` | Yes |
| Dropdown | Keyboard | Filter custom select supports keyboard, Escape, and ARIA. | `custom dropdown supports mouse selection, keyboard navigation, Escape, and ARIA` | Yes |
| Theme | Dark | Dark state is readable with semantic statuses intact. | `premium CSS includes measured density, dark, RTL, mobile, focus, and reduced-motion contracts` | Yes |
| Responsive | Mobile | Rows, filter, details, and reply controls reflow without overflow. | `premium CSS includes measured density, dark, RTL, mobile, focus, and reduced-motion contracts` | Yes |
| Media | Broken media | No contact-message media field is exposed by the existing backend. | N/A | N/A |

## Complaints

| Page/Action | Case | Expected result | Test name | Passed |
|---|---|---|---|---|
| List | Success | Real complainant/target/status data renders in compact rows. | `all six redesigned list pages render populated records with compact resource regions` | Yes |
| List | Empty | Contextual empty state is compact. | `all six redesigned list pages render contextual empty states without viewport-sized dead space` | Yes |
| List | Loading | Local region and controls recover in `finally`. | `list pages expose local loading, filter, refresh, and directly-adjacent pagination contracts` | Yes |
| Filter | Open | Existing search/status fields remain fully visible. | `filter studios preserve real routes, names, and fully visible first rows` | Yes |
| Filter | Apply | Existing `/complaints?type=filter` contract is preserved. | `filter open, apply, reset, loading-finally, and fragment replacement work locally` | Yes |
| Filter | Reset | Values reset without changing the route contract. | `filter open, apply, reset, loading-finally, and fragment replacement work locally` | Yes |
| Filter | Invalid | Invalid query/operator values and invalid fragments are rejected. | `invalid filter HTML is rejected without replacing the current resource fragment`; `ObjectId, filter enum, and operator-injection validation reject malformed input` | Yes |
| Create | Success | Not supported by existing backend. | N/A | N/A |
| Create | Validation | Not supported by existing backend. | N/A | N/A |
| Edit | Success | Not supported by existing backend; reply remains the existing workflow. | N/A | N/A |
| Show | Details | Complainant, target, text, status, and existing replies render safely. | `show pages render safe grouped DTO content and media fallbacks` | Yes |
| Reply | Status transition | Existing protected reply route updates only supported workflow fields. | `supported workflow and visibility controls use real routes and protected state inputs` | Yes |
| Delete | Single | Custom confirmation and safe not-found behavior are used. | `custom delete confirmation sends CSRF, removes the row, and avoids window.confirm` | Yes |
| Delete | Bulk | Awaited deletion loop preserves the existing response contract. | `all 22 Operations-Content mutation routes preserve their path and enforce CSRF before the controller` | Yes |
| Security | CSRF rejection | Missing/invalid token returns 403 before reply/delete controllers. | `missing and invalid CSRF reject every Operations-Content mutation before its controller` | Yes |
| Validation | Invalid ObjectId | Invalid detail/delete/reply IDs are rejected. | `ObjectId, filter enum, and operator-injection validation reject malformed input` | Yes |
| Dropdown | Keyboard | Filter custom select supports keyboard, Escape, and ARIA. | `custom dropdown supports mouse selection, keyboard navigation, Escape, and ARIA` | Yes |
| Theme | Dark | Dark rows, filters, details, and modal remain readable. | `premium CSS includes measured density, dark, RTL, mobile, focus, and reduced-motion contracts` | Yes |
| Responsive | Mobile | Complaint data/actions reflow without horizontal overflow. | `premium CSS includes measured density, dark, RTL, mobile, focus, and reduced-motion contracts` | Yes |
| Media | Broken media | Relation/avatar fallback prevents broken UI where media is unavailable. | `broken media switches to a designed fallback without a repeated broken request` | Yes |

## Sliders

| Page/Action | Case | Expected result | Test name | Passed |
|---|---|---|---|---|
| List | Success | Real images/status/dates render in compact rows. | `all six redesigned list pages render populated records with compact resource regions` | Yes |
| List | Empty | Compact empty state keeps CTA and pagination adjacent. | `all six redesigned list pages render contextual empty states without viewport-sized dead space` | Yes |
| List | Loading | Technical refresh restores all controls in `finally`. | `list pages expose local loading, filter, refresh, and directly-adjacent pagination contracts` | Yes |
| Filter | Open | No user-facing filter fields are supported by the existing backend. | N/A | N/A |
| Filter | Apply | No user-facing filter fields are supported by the existing backend. | N/A | N/A |
| Filter | Reset | No user-facing filter fields are supported by the existing backend. | N/A | N/A |
| Filter | Invalid | Technical refresh query is validated; no filter UI was invented. | `ObjectId, filter enum, and operator-injection validation reject malformed input` | Yes |
| Create | Success | Existing multipart route uses premium bilingual form and upload control. | `supported create and edit pages preserve exact backend field names and bilingual direction`; `premium upload controls keep native file fields accessible and expose selected filenames` | Yes |
| Create | Validation | Required bilingual/image fields, MIME, and magic bytes are enforced. | `Slider and Intro uploads enforce MIME plus magic bytes and accept a real PNG signature`; `bilingual validators reject crossed writing systems and accept correct Arabic/English values` | Yes |
| Edit | Success | New image is accepted before old media is removed; invalid upload preserves existing media. | `Slider and Intro uploads enforce MIME plus magic bytes and accept a real PNG signature` | Yes |
| Show | Details | Safe image fallback, bilingual content, status, and timestamps render. | `show pages render safe grouped DTO content and media fallbacks` | Yes |
| Visibility | Active/inactive | Existing `isActive` field is idempotently preserved; last active slider is protected. | `supported workflow and visibility controls use real routes and protected state inputs`; `single deletes handle missing records and Slider bulk delete preserves the last active item` | Yes |
| Delete | Single | Custom confirmation and safe not-found behavior are used. | `custom delete confirmation sends CSRF, removes the row, and avoids window.confirm` | Yes |
| Delete | Bulk | Existing IDs route cannot remove all active sliders. | `single deletes handle missing records and Slider bulk delete preserves the last active item` | Yes |
| Security | CSRF rejection | Missing/invalid multipart/delete token returns 403 before controller. | `multipart body tokens are parsed for all five upload routes and missing tokens never hit controllers`; `missing and invalid CSRF reject every Operations-Content mutation before its controller` | Yes |
| Validation | Invalid ObjectId | Invalid detail/edit/delete IDs are rejected. | `ObjectId, filter enum, and operator-injection validation reject malformed input` | Yes |
| Dropdown | Keyboard | Active-status custom select supports keyboard and ARIA. | `custom dropdown supports mouse selection, keyboard navigation, Escape, and ARIA` | Yes |
| Theme | Dark | List/form/show/modal states retain contrast. | `premium CSS includes measured density, dark, RTL, mobile, focus, and reduced-motion contracts` | Yes |
| Responsive | Mobile | Upload/form/row/action regions reflow without overflow. | `premium CSS includes measured density, dark, RTL, mobile, focus, and reduced-motion contracts` | Yes |
| Media | Broken media | Failed image is replaced once by designed fallback; no proxy was added. | `broken media switches to a designed fallback without a repeated broken request` | Yes |

## Intros

| Page/Action | Case | Expected result | Test name | Passed |
|---|---|---|---|---|
| List | Success | Real bilingual/media DTOs render in compact rows. | `all six redesigned list pages render populated records with compact resource regions` | Yes |
| List | Empty | Contextual compact empty state renders. | `all six redesigned list pages render contextual empty states without viewport-sized dead space` | Yes |
| List | Loading | Technical refresh restores controls in `finally`. | `list pages expose local loading, filter, refresh, and directly-adjacent pagination contracts` | Yes |
| Filter | Open | No user-facing filter fields are supported by the existing backend. | N/A | N/A |
| Filter | Apply | No user-facing filter fields are supported by the existing backend. | N/A | N/A |
| Filter | Reset | No user-facing filter fields are supported by the existing backend. | N/A | N/A |
| Filter | Invalid | Technical refresh query is validated; no filter UI was invented. | `ObjectId, filter enum, and operator-injection validation reject malformed input` | Yes |
| Create | Success | Existing multipart route uses exact fields and premium upload control. | `supported create and edit pages preserve exact backend field names and bilingual direction`; `premium upload controls keep native file fields accessible and expose selected filenames` | Yes |
| Create | Validation | Arabic/English writing system, MIME, and magic bytes are enforced. | `Slider and Intro uploads enforce MIME plus magic bytes and accept a real PNG signature`; `bilingual validators reject crossed writing systems and accept correct Arabic/English values` | Yes |
| Edit | Success | Image remains optional; new valid media replaces old media only after upload. | `Slider and Intro uploads enforce MIME plus magic bytes and accept a real PNG signature` | Yes |
| Show | Details | Safe bilingual text, timestamps, and media fallback render. | `show pages render safe grouped DTO content and media fallbacks` | Yes |
| Workflow | Status/visibility | Not supported by existing backend. | N/A | N/A |
| Delete | Single | Custom confirmation and safe not-found behavior are used. | `custom delete confirmation sends CSRF, removes the row, and avoids window.confirm` | Yes |
| Delete | Bulk | Existing IDs route and response contract are preserved. | `all 22 Operations-Content mutation routes preserve their path and enforce CSRF before the controller` | Yes |
| Security | CSRF rejection | Missing/invalid multipart/delete token returns 403 before controller. | `multipart body tokens are parsed for all five upload routes and missing tokens never hit controllers`; `missing and invalid CSRF reject every Operations-Content mutation before its controller` | Yes |
| Validation | Invalid ObjectId | Invalid detail/edit/delete IDs are rejected. | `ObjectId, filter enum, and operator-injection validation reject malformed input` | Yes |
| Dropdown | Keyboard | No resource dropdown exists in the supported Intro payload. | N/A | N/A |
| Theme | Dark | List/form/show/modal states retain contrast. | `premium CSS includes measured density, dark, RTL, mobile, focus, and reduced-motion contracts` | Yes |
| Responsive | Mobile | Upload/form/row/action regions reflow without overflow. | `premium CSS includes measured density, dark, RTL, mobile, focus, and reduced-motion contracts` | Yes |
| Media | Broken media | Failed media is replaced once by designed fallback. | `broken media switches to a designed fallback without a repeated broken request` | Yes |

## FAQs

| Page/Action | Case | Expected result | Test name | Passed |
|---|---|---|---|---|
| List | Success | Real bilingual questions/answers render as controlled previews. | `all six redesigned list pages render populated records with compact resource regions` | Yes |
| List | Empty | Contextual compact empty state renders. | `all six redesigned list pages render contextual empty states without viewport-sized dead space` | Yes |
| List | Loading | Resource region and controls recover in `finally`. | `list pages expose local loading, filter, refresh, and directly-adjacent pagination contracts` | Yes |
| Filter | Open | Existing sort field and dropdown remain fully visible. | `filter studios preserve real routes, names, and fully visible first rows` | Yes |
| Filter | Apply | `/fqs/filter` replaces only the fragment and retains order. | `filter open, apply, reset, loading-finally, and fragment replacement work locally` | Yes |
| Filter | Reset | Sort and filter scroll reset safely. | `filter open, apply, reset, loading-finally, and fragment replacement work locally` | Yes |
| Filter | Invalid | Invalid order/operator value and invalid fragments are rejected. | `invalid filter HTML is rejected without replacing the current resource fragment`; `ObjectId, filter enum, and operator-injection validation reject malformed input` | Yes |
| Create | Success | Exact bilingual question/answer fields submit once. | `supported create and edit pages preserve exact backend field names and bilingual direction` | Yes |
| Create | Validation | Required Arabic/English writing systems are enforced after blur/submit. | `bilingual validators reject crossed writing systems and accept correct Arabic/English values`; `form feedback is reserved but hidden until blur or submit` | Yes |
| Edit | Success | Existing route, payload names, and response URL are preserved. | `form mutation transport includes CSRF and blocks duplicate submissions` | Yes |
| Show | Details | Full bilingual content is readable without raw/null leakage. | `show pages render safe grouped DTO content and media fallbacks` | Yes |
| Workflow | Status/visibility | Not supported by existing backend. | N/A | N/A |
| Delete | Single | Custom confirmation and safe not-found behavior are used. | `custom delete confirmation sends CSRF, removes the row, and avoids window.confirm` | Yes |
| Delete | Bulk | Existing IDs route and response contract are preserved. | `all 22 Operations-Content mutation routes preserve their path and enforce CSRF before the controller` | Yes |
| Security | CSRF rejection | Missing/invalid create/edit/delete token returns 403 before controller. | `missing and invalid CSRF reject every Operations-Content mutation before its controller` | Yes |
| Validation | Invalid ObjectId | Invalid detail/edit/delete IDs are rejected. | `ObjectId, filter enum, and operator-injection validation reject malformed input` | Yes |
| Dropdown | Keyboard | Filter sort dropdown supports keyboard, Escape, and ARIA. | `custom dropdown supports mouse selection, keyboard navigation, Escape, and ARIA` | Yes |
| Theme | Dark | Long-content list/form/show/modal states retain contrast. | `premium CSS includes measured density, dark, RTL, mobile, focus, and reduced-motion contracts` | Yes |
| Responsive | Mobile | Long text and actions reflow without overflow. | `premium CSS includes measured density, dark, RTL, mobile, focus, and reduced-motion contracts` | Yes |
| Media | Broken media | This resource has no media field in the existing backend. | N/A | N/A |