Show the steps of making a backup, each at what the page knows (Section 06b)

[404SecNotFound]

Section 06, part b (roadmap 9.6). Stacked on #231 (06a), so this shows only its own diff. GitHub retargets it to main once #231 merges.

What changes

• Six visible steps on the Encrypt tab: Content, Access rule, Review, Create, Check saved copy, Prepare recovery. BAR.md keeps one form with no Next-button wizard, so this is status only and gates nothing.
• Each state is backed by evidence. workflowSteps in src/lib/backup-workflow.ts marks a step done only on evidence the page has.
  • A download or print is Started, never Done. The browser does not say whether anything was kept.
  • Check saved copy is Done only when every printed container symbol has been photographed on the Recovery tab and matched to this backup. Checks add up across photos. Strips, unmatched symbols and symbols from another backup do not count.
  • Prepare recovery is Done only after a rehearsal from the shares opened the backup.
  • Once the form moves on, Create reads Changed and names what changed, and nothing further is offered as next.
• Accessible states. Every state is a word as well as a colour, and the step to act on carries aria-current="step".
• Placement. On a wide screen the list sits in the right column above the container pane. Below 980px it is the first row, above the form.

Found by the gates and fixed in 1b08065

• workspace-layout.spec.ts holds the Content section within 340px of the top at 1440x1000. With the list above the form it sat at 432px. The list moved rather than the threshold.
• share-lifecycle.spec.ts found the form's "Keep open" reachable behind the shares dialog. Radix hides the page behind a modal once, when it opens, using the aria-hidden package. That package keeps every [aria-live] element and its ancestors exposed, so the list's live region left the form's wrapper exposed. A lock warning mounted later inside it was never hidden. In the original position the test fails with the live region and passes without it. The live region is removed.

Tests

• npm run test:backup-workflow grows from 24 to 50 checks. Four faults in the step rules each failed their own checks: a started download counted as done, a partial printout check counted as done, unmatched symbols counted, and recovery done without a rehearsal.
• tests/browser/workflow-steps.spec.ts (new) has 3 Chromium tests. Four faults in the page wiring each compiled, built and failed their own test: rehearsal ignored, printout coverage never recorded, checks not accumulating, and exports not passed.

Gates run locally on 1b08065

• npm run typecheck, all 38 Node test:* scripts and the 4 Python gates pass.
• npm run build passes.
• Chromium with --workers=2 had 327 passed, 5 skipped and 0 failed.
• Firefox and WebKit were not run locally. CI covers them.

Open point for review

A password-only backup has no rehearsal on this page. Its recovery step stays at "To do" and points to a verify on the Decrypt tab, which today clears the receipt. That lifetime is a later part of Section 06.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GbCLpWTtk1prQYV8z6rYHr

---

Generated by Claude Code