9228 engineer test and deployment instructions

Build / deployment:
- Build the existing MyFocus.vbproj with its installed .NET Framework/Telerik toolchain. Include new Classes/DocumentPrivacyPolicy.vb and project compile entry, DocumentHelper.vb, shared uploader code-behind, both document type/subtype editor markup/code-behind, and the audited bulk generator and fixed-configuration PersonalDetails controls.
- Existing per-type/subtype switches are reused. Existing databases require no new SQL setting or data migration. Missing columns/NULL preserve the legacy requested privacy; trusted generated PDFs, generated bulk-template documents, fixed server-configured form privacy, and existing documents remain unchanged.
- Upcoming release includes read-only 909 - Verification - Document upload privacy policy.sql beside existing document scripts. It reports column/default availability; it never changes flags or document privacy. Existing 002/003/901/902 scripts were not altered.

Administrator behavior:
- Document Type > Enable Private off: hide Public/Private choice for new user uploads, enforce Public. On: permit the choice subject to a restrictive subtype.
- Document Sub Type > Enable Private off: enforce Public for that subtype. On: permit the choice only if the parent allows it.
- Existing inherited NULL rows remain NULL on unrelated admin saves. New editor defaults already select Public only. Existing explicit client choices are preserved.

Unit verification:
- dotnet test Tests/MyFocus.UnitTests/MyFocus.UnitTests.csproj --filter TestCategory=DocumentPrivacyPolicyUnit
- Ten tests exercise the 18 requested/type/subtype combinations, missing/NULL metadata, the actual source indexing gate with controlled policy dependency, policy-read failure, four upload paths, generated-PDF preservation inherited admin-save behavior, both configured controls posted-field tampering, recreated dynamic controls with Init-before-ViewState precedence, and Nothing index compatibility.

Authorized local native verification:
- F:/CodexWork/2026-10-20/document-privacy-policy-9228/work/Privacy-Fixture.ps1 creates isolated type/subtype metadata from the existing fictional local fixture and configures ParentOff/SubtypeOff/Allowed/Inherited cases.
- Run-Privacy.ps1 uses the existing local credential manager helper, executes the opt-in DocumentPrivacyPolicyLive Playwright test for each case, independently checks persisted PRIVATE through SQL, then always deletes the new documents through HRF_SP_DOCUMENT_DELETE, exact new library files and fixture metadata.
- The gate MYFOCUS_RUN_DOCUMENT_PRIVACY_UPLOAD_TESTS=1, an exact synthetic CODEX9228 marker and localhost URL are required. Do not substitute production targets or arbitrary live metadata. Browser assertions cover actual native type/subtype selection, choice visibility, native file upload and saved-document listing. Expected SQL receipts are Public/Public/Private/Private respectively; completion requires Passed=true in the current receipt.
- Review Native_Upload_Receipt.json and Cleanup_Receipt.json; any incomplete cleanup must be resolved before declaring tests complete.

Manual employee-profile UAT:
1. Open Employee Details > Employee Main > Personal > Documents > Add New for an authorized test employee.
2. Choose an explicitly Public-only type: Accessibility must be absent. Save a synthetic allowed file and verify PRIVATE=N through normal document access.
3. Choose a type/subtype allowing Private: choose Private, save, verify PRIVATE=Y and existing uploader-only viewing behavior. Repeat with parent off/subtype on and parent on/subtype off; both must be Public.
4. Verify changing from an allowed type after selecting Private to a restricted type cannot retain Private at persistence. Verify existing archived/private/confidential documents and denied users retain their prior access.
5. Verify an inherited/null configuration retains the prior choice behavior; unrelated admin saves must not write NULL to a new explicit value.
6. Verify native task, profile, evidence and bootstrap upload hosts, normal cancel/save routing, validation, and cleanup without changing a business record's privacy.

Trust boundary:
- The assembly-scoped fixed-privacy path is only used by audited server-generated bulk templates and fixed-configured dynamic form uploaders. It is never selected by a browser flag or verified=True. Both synchronous TextBox and asynchronous HiddenField echoes are ignored for type/subtype/privacy/confidential/index; fresh server configuration wins over MAC-protected restored ViewState.
- Native task tests use the existing authorized MAN mode. EMP mode correctly has no Add document action; no permissions are changed for testing.


Final executed results (20 October 2026): application build passed; 10/10 focused unit tests passed; all4 native Playwright cases passed. Independent DOC_PRIVATE values N,N,Y,Y. Native_Upload_Receipt Passed=true; Cleanup_Receipt CleanupPassed=true, RemovedFixtureDocuments=4, ExistingDocumentsChanged=false. Release_SQL_Receipt Passed=true and ReadOnly=true. Full explanation and UAT limits: 9228_Implementation_Report.html.