L02-02: Navigate stable findings to report regions

[mberrys]

Summary

Implements L02-02 / #23: selecting a current, stable preflight finding navigates the Quick canvas to report-owned page/region bounds (when available), even when no PDF object identifier exists. The inspector exposes the finding's document revision, effective profile, evidence IDs, coverage scope and explicit targeting limitations, without granting the UI preflight/verdict authority.

Closes #23. Target: dev. Head/source under test: bd3d5de8678132dcc348a1b984ab600d91044c8c; recorded base: dce5a806a58d757762abeaf8d9947ca5308e687a.

Changes

• Extend FindingNavigationRequest and FindingNavigationResult with report-context identity: document key/revision, effective profile digest, evidence IDs, coverage scope and region bounds.
• Add RegionTargeted navigation. Where report bounds are finite/usable and the declared capability permits it, center and zoom with the existing context margin, distinguishing region navigation from object targeting. Findings with no object ID can still target their region.
• Fall back conservatively to page navigation for unsupported checks or invalid/missing geometry; do not synthesize object targets, check support or evidence coverage.
• Filter overlays to evidence IDs actually belonging to the finding and valid in-document pages/bounds. Only current document/finding/revision context may remain selected; a stale request after replacement cannot move the new document's viewport.
• Project accepted report metadata into the findings model and inspector; show explicit absence/limited scope instead of extrapolating preflight findings. The Core/report remain the authority for findings and verdicts.

Files: findingnavigation.{h,cpp}, preflightfindingsmodel.{h,cpp}, inspectormodel.cpp, focused tests (tst_findingnavigationtest.cpp, tst_p4s9interaction.cpp), tools/ProductQuickAccessibilitySmoke/main.cpp, and changes/codex-issue-23-finding-navigation.{md,evidence.yaml}.

Tests and evidence

Windows 11 / Qt 6.11.1 / MSVC 2022 Release / source bd3d5de:

• cmake --build build --config Release --target UnitTestsFindingNavigation, then build/usr/bin/Release/UnitTestsFindingNavigation.exe: 9 QtTest cases passed. Coverage includes region centering/context margin, report profile/revision/evidence binding, unusable bounds, unrelated evidence, and replacement where revision counters are reused under a different document identity.
• ProductQuickAccessibilitySmoke.exe with QT_QPA_PLATFORM=offscreen and QT_QUICK_BACKEND=software: passed using a synthetic two-page finding-region.pdf, bounds 100,200,60,80, evidence navigation-fixture-evidence, profile effective-profile-fixture, and identical-byte replacement.pdf with a new document identity. The smoke checks the canvas/inspector before and after rejecting the old finding. Automatic-backend smoke also passed but reported software on this offscreen host; this is not native document-navigation qualification.
• python scripts/agent/check-change.py --base dce5a806a58d757762abeaf8d9947ca5308e687a --head bd3d5de8678132dcc348a1b984ab600d91044c8c --head-branch codex/issue-23-finding-navigation --build-dir C:/Users/micha/.codex/worktrees/adcf/loop2/build: passed from a clean tracked checkout, including formatting, analysis, architecture/proof contracts, affected builds and all 30 mapped test executables.
• Local proof receipts: %TEMP%/loop-issue23-head-proof.json, %TEMP%/loop-issue23-head-software.log, %TEMP%/loop-issue23-head-auto.log. The primary worktree's unrelated nested checkouts were preserved; the configured build consumed the identical committed source.
• Hosted at head: CI, CodeQL Advanced, Documentation truth and Supply Chain Policy all completed successfully.

Boundaries and review

The smoke constructs an accepted synthetic report context; detection of real defects and report correctness remain in upstream preflight tests. The offscreen software lane provides Quick integration coverage, not native GUI-renderer qualification. Navigation uses the existing viewport and overlay components, not a parallel renderer or report authority.

Quality review: Guards reject non-finite geometry and unrelated evidence; document identity plus revision prevents an old finding from becoming current after replacement. The implementation adds no new independent interpretation of preflight checks.