US04-06: Automate Phase D End-to-End Acceptance

README.md

@@ -102,3 +102,37 @@ work_item/scripts/python -m pytest tests/e2e -m phase_c -q
 The deterministic naming provider is enabled only by test configuration
 (`PHOTO_PIPELINE_FAKE_NAMING_LOG`); without it the application falls back to the
 offline naming-policy name. Phase A and B suites remain green in the full run above.
+
+### Phase D acceptance gate
+
+Phase D (Epic E04: guarded renaming) is the first phase that changes the library on
+disk, so its gate is the strictest. One command runs the rename API journeys, the
+filesystem fault injection, and the browser suite:
+
+```bash
+work_item/scripts/python -m pytest tests/e2e -m phase_d -q
+```
+
+- `tests/e2e/test_phase_d_pipeline.py` drives a real server over HTTP: plan and
+  export, confirmation with the plan version and checksum (a stale token is refused
+  without touching disk), a valid apply, the case-only rename procedure, a collision
+  whose occupant survives, a source that changed after planning, and durability
+  across a full restart.
+- **Fault injection is real.** `PHOTO_PIPELINE_FAULT_AFTER=<journal state>` kills the
+  server process the instant that state is persisted. The suite crashes it at every
+  journal transition in turn (`moving`, `moved`, `database_updated`, `verified`),
+  starts a fresh process against the same database and library, and requires recovery
+  to converge from journal and disk evidence alone — with the asset set, the stable
+  IDs, and every content hash unchanged. Ambiguous evidence is never guessed: it stays
+  classified `manual` and keeps blocking. An unresolved rename is the cancellation
+  boundary — there is no cancel once a run starts, and unrelated mutations (album
+  proposal generation and approval) are refused with 409 `rename_recovery_required`
+  until it is resolved, while reads stay available.
+- `tests/e2e/test_renames_ui.py` covers the browser journeys: preview of every
+  affected path, confirmation carrying the server-issued token, apply with progress
+  and terminal verification, stale confirmation, collision, interruption, recovery,
+  rollback, keyboard confirmation, and the view still matching the journal after a
+  server restart.
+
+The fault barrier is test-only configuration; without `PHOTO_PIPELINE_FAULT_AFTER`
+the apply path has no crash points. Phases A–C remain green in the full run above.