fix(cv): bind letter proposals to current sources and preserve document choices

docs/cv-redesign/AI.md

@@ -14,6 +14,10 @@ The existing cover-letter `AiWorkspaceService` uses the owned linked CV/profile
 
 ## Safety and UX contract
 
+Recorded letter suggestions now bind a SHA256 source identity in existing interaction metadata. The fingerprint represents the job/CV/profile snapshot actually used for generation, relevant identity/attachment state and current letter revision. A fresh post-inference check rejects changed input before history is committed; inference is outside the short relational transaction. Stale inference still finalizes its actual usage reservation. Before local Apply, the client calls authenticated Pro, owner/job/module-scoped `POST /api/jobapplications/{jobId}/ai/history/{id}/validate-source`;204 permits local acceptance,409 requests regeneration,404 hides unavailable ownership. Legacy/malformed unbound results fail closed. Local edits, cancellation, job changes, unmount and an overlapping Save discard late validation responses. This proves source freshness at validation, not factual correctness of generated prose.
+
+Persistent letter language and AI generation language share the local settings draft. Rendering declares allowlisted English or Bokmål metadata; legacy settings default to English. Rewrite/grammar/shorten retain source-language instructions exclusively. The independently reviewed contact copy defaults name/title/email/phone on and optional location off, preserving unselected destination fields.
+
 The source prerequisite now refuses letter inference before model invocation or interaction creation unless an owned linked CV resolves actual career evidence. Identity, section headers, an advert and a prior draft are insufficient. Five source/action refusal combinations were added to the full backend suite. The UI maps `cover_letter_source_required` to actionable EN/Bokmål guidance. The four letter controls are portalled immediately beneath the body field while retaining the existing assistant read lifecycle.
 
 - Original and editable proposed text remain separate; Reject never saves and Accept is explicit.
@@ -32,9 +36,11 @@ The successor focused backend run passed65/65 (`prompt-language-green.trx`). Act
 
 | Action | Implementation | Frontend | Backend | Actual model / production |
 |---|---|---|---|---|
-| Improve writing | Existing CV/letter paths exposed directly | Component pass | CV tests pass; letter regression pending final suite | NOT TESTED / not eligible |
-| Suggest content | New CV action; existing letter generation | Component pass, missing source asks for input | CV tests pass; letter grounding limitation above | NOT TESTED / not eligible |
-| Grammar check | Existing paths exposed directly | Component pass | CV tests pass; letter regression pending final suite | NOT TESTED / not eligible |
-| Shorter | Existing paths exposed directly | Component pass | CV tests pass; letter regression pending final suite | NOT TESTED / not eligible |
+| Improve writing | Existing CV/letter paths exposed directly | Full frontend PASS | Full backend PASS; recorded source validation | BLOCKED / not eligible |
+| Suggest content | New CV action; existing letter generation | Full frontend PASS; missing facts require input | Full backend PASS; letter semantic limitation above | BLOCKED / not eligible |
+| Grammar check | Existing paths exposed directly | Full frontend PASS | Full backend PASS; exclusive source-language instruction | BLOCKED / not eligible |
+| Shorter | Existing paths exposed directly | Full frontend PASS | Full backend PASS; exclusive source-language instruction | BLOCKED / not eligible |
 
 Outstanding: fresh full regression, endpoint authorization/browser coverage, actual approved self-hosted EN/Bokmål inference and adversarial semantic acceptance, source-grounding qualification for letter operations, human accessibility and language review. Production remains NO-GO; no deferred P5-13 operation is activated by this UI work.
+
+Reviewed successor evidence: source-bound letter guard103 focused backend cases pass; full Release backend1227/1227; full frontend981/981 across107 suites with before/after source hashes equal; application-assets53/53 and contact/language10/10 focused cases overlap the full frontend total. Source guard tests first produced19 failures; malformed legacy hardening produced3 failures before correction. Updated physical language assertions and seven responsive scenarios passed in two real browser cases; Windows letter oracle4/4 across14pages has zero differences. Independent re-review found no remaining material frontend/backend issue. Fresh aggregate browser/provider/Linux gates remain pending final reconciliation; actual inference remains unavailable and unqualified.

docs/cv-redesign/CHECKPOINT_IMPLEMENTATION.md

@@ -40,3 +40,11 @@ Remaining: fresh ordinary/contract/RD21 browsers, responsive/localisation automa
 - Letter responsive browser case passes seven widths320–1440, EN/Bokmål, light/dark, keyboard pane/focus/draft preservation, root/main overflow and primary control hit testing (`letter-responsive-03`). The two predecessors expose fixture errors, not product passes: iframe init storage reset and wrong assumed900px breakpoint. The tested application theme breakpoint is1024px.
 - Offline Linux adapter guard/lifecycle checks10/10. Current application publish is overlaid in a new app directory on the exact verified cached native runtime. The first build's unnecessary audit override was removed; its image is explicitly superseded. No advisories are suppressed in the successor helper. Native OS rebuilding and actual Linux rendering are distinct gates.
 - Handoff requirements prepared in CV_IMPORT_HANDOFF.md; import implementation remains unstarted.
+
+## Independent-review corrections
+
+The first independent full review found three P2 acceptance gaps: location was copied by default, all letters declared English HTML language, and letter AI invalidation watched cached source metadata. All three are corrected. Contact copy now has reviewed default/optional field selection; language is an additive normalized settings property retained by history/frozen snapshots; AI suggestions bind actual input source and revalidate after inference and before local Apply. Legacy unbound suggestions require regeneration. No new schema/provider was introduced by these corrections.
+
+Fresh full Release backend1227/1227 (40 added cases, zero removed from the preceding1187 report) and frontend981/981 across107 suites passed. Source-bound frontend process before/after hashes match. Two letter browser cases passed after corrections; the unchanged native oracle passed all four letter fixtures/14pages with zero differences. Actual MariaDB source-bound transaction cases and final aggregate Windows/Linux runs remain pending. Re-review of the corrections found no remaining material defect; review did not substitute for execution.
+
+Actual MariaDB source-boundary successor59/59 passed (`provider-final-03`), including three real relational transaction/held-source cases with a stub inference service. Source hashes match and owned cleanup is confirmed. The intermediate `provider-final-02` preparation failed before starting a service or executing tests and remains preserved. Real API authorization checks also passed (missing owned interaction404; free account403). The seven-scenario responsive browser case additionally passed five targeted WCAG A/AA scans with zero violations; incomplete/manual qualifications remain open and final native reports retain their scan details. Its preceding exact-name locator timeout is a fixture failure retained separately: MUI exposes the select's label together with its selected value.

docs/cv-redesign/CV_IMPORT_HANDOFF.md

@@ -10,4 +10,6 @@ Contact/design copies are explicit reviewed snapshots. Imported facts or later C
 
 CV AI proposals are bound to owned source/revision capabilities and reviewed acceptance. Letter AI requires an owned linked CV with actual visible career evidence. Advert requirements, identity/header text and a previous letter do not establish experience. Import text is untrusted data, never model instructions. Reuse the existing approved self-hosted infrastructure; do not infer semantic, GPU or production readiness from CPU compatibility or mocked UI tests.
 
+Letter suggestions now bind source fingerprints to their recorded interaction. Profile/CV/job/attachment changes invalidate generated output and pre-Apply validation; legacy unbound results must be regenerated. Import must use existing revisioned profile owners so these source boundaries continue to work. Letter document language is an allowlisted additive JSON setting (`en` or `nb-NO`, legacy default `en`); copying contact/design preserves it. Optional location is unchecked by default and unselected destination contact fields are retained.
+
 Before CV-IMPORT entry: read CV-UX final acceptance and its open gates, verify the accepted branch/commit and current architecture, re-establish supported-provider migration/rollback evidence and preserve frozen fixtures. Keep the legacy parser until the separately authorised replacement is qualified. Production, hosted isolation and security/recovery decisions remain separate.

docs/cv-redesign/TODO.md

@@ -18,4 +18,8 @@ Implementation/focused checks are complete for CV-UX-01–05 and CV-UX-AI; their
 
 Reviewed successor:65/65 prompt contract tests,972/972 full frontend,56/56 fresh actual MariaDB and one seven-scenario responsive letter browser case passed. Linux lifecycle self-checks10/10. Full ordinary discovery increases from362 historical to364 (one physical letter producer and one responsive case). Final independent contract/PDF/browser lanes remain open. Actual local inference is blocked by absent approved local services; human/hosted/production gates remain open.
 
+Independent review corrections complete: optional contact selection, persistent physical/AI language, and recorded-source validation after inference/before Apply. Full Release backend1227/1227 and full frontend981/981/107suites passed; source hashes stable. Two focused real letter browser cases and unchanged Windows letter oracle4documents/14pages passed. Final aggregate and actual MariaDB source-transaction lanes remain open. Superseded final-01/02/03 attempts are retained and cannot establish full browser acceptance.
+
+Actual provider source-boundary suite59/59 passed with stable sources and positive cleanup; five targeted letter axe scans and real403/404 authorization checks passed. Final aggregate browser/contract/volume and Windows/Linux original CV+letter PDF gates remain open.
+
 Historical evidence: Phase 9 conditional acceptance is inherited, not fresh CV-UX test execution. Hosted isolation/production/manual/provider/AI semantic limitations remain open. Research checksum verification: 83/83; screenshot pairs: 37/37; contact sheets inspected locally. Raw third-party imagery stays outside Git/product assets.