feat(cv-qa): map missing records from reviewed source evidence

docs/cv-integration-qa/CAREER_PROFILE_MAPPING.md

@@ -0,0 +1,24 @@
+# CV-QA-01 source-backed mapping and new records
+
+26 October 2026. Entry gap: the old review could only accept/correct fields emitted by extraction. An unmatched extracted record could already be added; a missing record/field could not. This distinction is independently tested rather than treating updates as creation proof.
+
+## Implemented contract
+
+Owned review now includes source blocks, an allowlisted field catalog with current contact/list values, and existing-record targets with their actual affected values. The user can create a missing record, select its section/destination, assign literal source values, explicitly mark corrections, add list fields and approve the mapped record. Selecting evidence proposes its literal text only into an empty value; it never overwrites a correction or approves anything. Changing fields/target clears approval. Narrow screens reuse the existing MUI review layout, labels and EN/Bokmål translations.
+
+`apply-reviewed` accepts optional mappings `{clientId,category,targetIndex,fields:[{name,value,sourceBlockId,corrected}]}`. Null target deliberately creates an object record; contact updates selected singleton leaves; scalar lists append. Existing targets are validated against the owned canonical snapshot/revision before extracted merge. On 409, local values survive, all confirmations and prior target indices reset, and comparison must be reviewed again. Actual current values are shown before updating an existing target. Caller metadata/IDs/derived dates/arbitrary JSON paths are never accepted.
+
+The same canonical contracts cover contact/labelled links; summary; work title/employer/location/literal dates/current flag/bullets/skills; education qualification/stated level/institution/location/dates/details; certificates name/issuer/location/date/details; project name/role/location/dates/bullets/skills; languages/name/explicit level/notes; skills; interests/awards/publications/organisations/references and custom title/items (including courses). Canonical structured skill categories/proficiency and arbitrary new entities remain unsupported; original source can be retained as custom/detail text.
+
+Every assigned value requires an owned source block. Whole-token boundaries reject `Py` from `Python`, `SQL` from `NoSQL`, and `2020` from `12020`. Explicit corrections may differ and are labelled `user-correction`; literal user assignments are `user-source-mapping`, distinct from algorithmic extraction. Block/page/artifact/run/file hash metadata is stamped server-side. Limits:25 mappings,200 total fields,8000 characters/value; unknown categories/fields/targets/evidence, duplicate client IDs/scalar writes and invalid booleans/link pairs fail closed. Existing list values retain their original evidence and unrelated data survives.
+
+Mappings participate in the existing canonical expectedVersion/atomic transaction/history/children/Identity projection and idempotency acknowledgement. Original candidates remain unchanged; actual decisions/mappings are retained in review audit. Old unmapped request hashes remain compatible with historical replay. No schema/storage/profile ownership was duplicated.
+
+## Checkpoint evidence
+
+- `mapping-red-01.log`: missing mapping contracts reproduced before implementation. `mapping-target-red-01.log`: missing existing-value comparison/catalog contracts. Whole-token tests were added before implementation.
+- `mapping-green-02.log`:77 focused backend cases PASS, zero skips, including mapping-only apply, invalid input, current values, date precision, old review/provenance/preservation contracts. Focused counts overlap other suites.
+- `mapping-mariadb-01`:72/72 actual MariaDB12.2.2 PASS, zero skips, isolated startup/test/cleanup exits0. Two new provider cases exercise17 explicitly mapped groups into an EMPTY canonical profile: two jobs, two education records, two languages, project, certification, contacts/portfolio, skills/summary and long-tail/custom sections. Independent database readback confirms relational child counts, source identity, absent language level, literal year dates and rejected original SQL proposal absent. Identical replay creates one revision only. Injected Identity failure leaves no canonical children/history/acknowledgement and the review stays pending.
+- `ui-review-mapping-red.log`, `ui-target-values-red.log`, `ui-source-fill-red.log`: missing UI flow/comparison/proposal behavior reproduced first. UI review/mapping tests and TypeScript/lint pass; complete browser/mobile/new-user qualification is tracked in later checkpoints.
+
+This is bounded mapping/new-record implementation evidence, not whole-CV acceptance. A separate source audit identified apply/discard/retention lifecycle concurrency risks for real-provider reproduction/remediation at CV-QA-04. No release decision is made here. Missing models/human qualifications remain independent.

docs/cv-integration-qa/PLAN.md

@@ -27,7 +27,7 @@ Approaches considered: positional/lexicon guessing would improve apparent recall
 ## Checkpoint tasks
 
 - [x] **CV-QA-00:** verify ef425c2/remote/ancestry/raw evidence; audit source/authority; fresh actual MariaDB70; field matrix and preservation delta; commit/push/verify.
-- [ ] **CV-QA-01:** add failing backend/controller/provider tests for explicit source-backed record/field mappings and mapping-only apply. Extend review DTO with owned source blocks, field catalog and current-record target labels. Request mappings have stable client ID, allowlisted category, optional target index, and fields `{name,value,sourceBlockId,corrected}`; no caller IDs/metadata/derived dates/arbitrary patches. Apply under existing revision/transaction, stamp actual source identity, include mappings in idempotency/audit; validator/size bounds remain. Root adds accessible EN/NB generic mapping controls and UI tests for rejection, source selection and stale retained drafts. Run focused tests/provider; commit/push/verify.
+- [x] **CV-QA-01:** source-backed mapping/new records/current comparisons implemented; focused backend77 and actual MariaDB72 PASS, UI/TypeScript/lint PASS. See CAREER_PROFILE_MAPPING.md; complete integration/recovery qualification remains later checkpoints.
 - [ ] **CV-QA-02:** red tests in CvMultilineImportTests for labelled multiline records, safe header-defined table order, repeated source occurrences and ambiguous record after resolved record. Update CvDocumentInterpreter to preserve source units and section-local state, attach only clear continuations, retain ambiguity for explicit assignment. Ground respects validated selected source block evidence. Extend a separate frozen synthetic corpus/oracle with both orders/missing dates/headings/overlaps/lists/tables; preserve original corpus/hash. Report parsing versus interpretation versus mapping versus reviewed correctness, denominators/F1/record/provenance/abstention. Real Docling fixtures; commit/push/verify.
 - [ ] **CV-QA-03:** qualify same/revised/older/overlapping imports and explicit targets, similar-but-distinct employers, partial/conflicting dates, per-field rejection, source/corrections/mobile/keyboard. Extend reviewed HTTP/browser tests; fix bounded defects; commit/push/verify.
 - [ ] **CV-QA-04:** actual MariaDB multi-record mapping/partial approval/rejected-field readback, replay/stale/concurrent first/existing write, rollback and owner checks. Existing lease/cancel/recovery retained; measure database interruption scope honestly. Commit/push/verify.