feat(applications): preserve submitted packages

docs/architecture/application-workspace.md

@@ -14,7 +14,9 @@ application's home.
 
 ## What it is NOT
 
-The workspace **owns no data and duplicates none**. It is an aggregate read plus a navigation shell:
+The workspace normally composes existing data. Its one deliberate ownership boundary is an
+append-only submitted-package snapshot: immutable evidence must duplicate what was sent so later
+profile, CV, cover-letter, and attachment edits cannot rewrite history.
 
 | Section | Backed by (existing system) |
 |---|---|
@@ -26,12 +28,13 @@ The workspace **owns no data and duplicates none**. It is an aggregate read plus
 | Application answers / recruiter draft | compatibility fields on `JobApplication`, exposed as separate workspace fields |
 | Analysis / Match / Interview | Phase 5 `AiWorkspacePanel` + `AiInteraction` history |
 | Documents | `Attachment` |
+| Submitted package history | `SubmittedApplicationPackage` + copied, SHA-256-identified attachment bytes |
 | Communication | `Correspondence` |
 | Activity / Timeline | `JobEvent` |
 | Stage semantics | `JobPipeline` |
 
-No career data is copied into the application. Nothing in this feature writes to the master profile,
-a CV variant, or a cover letter.
+Nothing in this feature writes back to the master profile, a CV variant, or a cover letter. A user-
+initiated submission snapshot copies their current values into an append-only evidence record.
 
 ## Backend
 
@@ -234,6 +237,19 @@ With no profile it returns score 0 and asks the user to build one, rather than i
 
 ## Application assets (Phase 5.4)
 
+### Submitted application packages
+
+`POST /api/jobapplications/{id}/submitted-packages` freezes the current package without mutating its
+sources. It records the exact career-profile JSON, variant settings/version, rendered CV HTML,
+cover-letter text, application drafts/notes, opportunity context, and independent copies of every
+live attachment. Each copied file has its own SHA-256 digest and remains downloadable from the
+package even when the live attachment is later renamed, replaced, or deleted.
+
+Packages are append-only and numbered per application. There is no update or delete endpoint.
+List/detail/download routes are tenant-scoped, and account export/deletion includes both snapshot
+metadata and bytes. Capture fails as a unit if any selected attachment is unavailable; it never
+creates a package that silently omits a file.
+
 The workspace becomes the place an application is prepared. The rule is one-directional:
 
 ```

docs/work-programmes/master-progress.md

@@ -1,6 +1,6 @@
 # JobTracker master programme progress
 
-Updated: 2026-08-30
+Updated: 2026-08-31
 
 ## 2026-08-29 audit implementation programme
 
@@ -68,10 +68,11 @@ Updated: 2026-08-30
 - Moved durable interview-preparation items into a provider-aware migration; user and AI content, answers, practice state, sources, ordering, and application cascades are preserved.
 - Moved the complete Career Profile aggregate into a provider-aware migration; canonical and long-tail JSON, version history, all six relational child types, stable ordering, indexes, and cascades are preserved.
 - Completed JT-019 by moving all seven ASP.NET Identity tables into provider-aware migration ownership; accounts, credentials, 2FA state, preferences, roles, claims, external logins, tokens, indexes, and cascades are preserved. Startup schema code is now repair-only.
+- Added immutable submitted-application packages to the Job Workspace. Each append-only snapshot freezes the career-profile/CV source, rendered CV, cover letter, application material and SHA-256-identified copies of all attachments; history can be reviewed and preserved files downloaded without following mutable live references. Tenant filtering, account export/deletion, storage reconciliation, SQLite/MariaDB migrations and EN/NB UI are included.
 
 ### In progress
 
-- No repository implementation package is currently in progress. SEC-006/SEC-007 await a running Linux Docker daemon for image/runtime proof; production activation remains separately gated.
+- Continue the prioritized product-value roadmap with the career evidence bank after the submitted-package batch completes its full regression gate. SEC-006/SEC-007 still await a running Linux Docker daemon for image/runtime proof; production activation remains separately gated.
 
 ### Remaining
 
@@ -104,6 +105,8 @@ Updated: 2026-08-30
 - Status lifecycle extraction: Release build passed with 0 warnings/errors and the complete backend suite passed 736/736, including applied-date preservation, status suggestions, and cross-tenant not-found behavior.
 - Accessibility package: public axe flow passed 1/1 and authenticated axe flow passed 1/1 across six workspaces; ESLint passed with zero warnings; all 60 frontend suites and 260/260 tests passed; optimized Next build and integrated TypeScript passed; npm audit reported zero vulnerabilities after adding `@axe-core/playwright`.
 - Prebuilt-export browser path: focused Playwright passed 1/1 while serving the existing optimized export without invoking another Next build.
+- Submitted-package focused verification: storage/snapshot plus provider migration tests passed 6/6; the complete migration chain passed 18/18; application-assets UI passed 16/16; ESLint and the optimized Next build/TypeScript passed.
+- Submitted-package complete regression: backend 740/740 and frontend 60 suites with 261/261 tests passed. The full run also exposed and fixed a date-sensitive reminder fixture that mixed a fixed worker clock with `DateTime.Now` seed data.
 - Focused frontend: 2 suites, 6 tests passed.
 - Full frontend: 64 suites, 272 tests passed.
 - Next production build and TypeScript: passed.