fix(cv-import): bound source retention and guard worker recovery

docs/cv-import/SIDECAR.md

@@ -28,6 +28,14 @@ Scans and image-only PDFs fail cleanly with OCR disabled. Encrypted documents, a
 
 The adapter is a qualification seam; the active import path remains deterministic and does not call it. Actual provider/model compatibility, factual relationship validation, EN/Bokmål language quality, adversarial semantics, GPU behavior and model accuracy remain **BLOCKED**. Enabling production inference requires a separately approved immutable artifact and isolated qualification; environment configuration is not acceptance.
 
+The local transport disables environment proxies and rejects redirects, so an operator-configured local address cannot redirect document content to an external service.
+
+## Isolated Linux development image
+
+`Dockerfile.cv-import-dev` layers the current source and separate interpreter over an explicitly inspected existing runtime. It is not referenced by production Compose. Prepare a fresh context containing that Dockerfile, app.py/parser_child.py/cv_import_ai.py, the CV import lock and a `wheels/` directory downloaded with the lock's hashes for Linux/Python 3.12. Tag the inspected base ID locally, pass that tag as `CV_IMPORT_BASE_IMAGE`, and build with `--network none --pull=false`. Verify the tag resolves to the inspected ID before building. No registry publication occurs.
+
+The Linux child caches trusted platform metadata before installing its subprocess/network deny hook, then parses untrusted bytes. HOME/USERPROFILE point only at the private work directory; they never expose the host's model cache. The actual child retains POSIX CPU/address-space limits. `.artifacts/cv-import/real-sidecar-api-03.log` records PDF 200, DOCX 200, scan 422 through FastAPI and the real isolated Docling subprocess. Earlier failed API/build attempts are retained. Base-image/dependency security still inherits the open advisory qualifications; these runtime checks do not close them.
+
 ## Current focused evidence
 
 - `.artifacts/cv-import/sidecar-focused-02.log`: 23 passed, including real native PDF/DOCX conversion and synthetic model-adapter tests; no generative inference.

docs/cv-import/TODO.md

@@ -3,7 +3,7 @@
 - [x] CV-IMPORT-00: baseline, entry provider gate, audit and implementation plan.
 - [x] CV-IMPORT-01: secure upload and real Docling extraction (native PDF layout/OCR limitations explicit).
 - [x] CV-IMPORT-02: grounded structured interpretation and disabled local AI qualification seam.
-- [ ] CV-IMPORT-03: genuine progress, recovery, cancellation and retention.
+- [x] CV-IMPORT-03: genuine progress, lease/cancellation recovery and bounded retention; full final freeze remains separate.
 - [ ] CV-IMPORT-04: review/corrections/conflicts/source UI.
 - [ ] CV-IMPORT-05: revisioned transactional Career Profile persistence.
 - [ ] CV-IMPORT-06: accuracy/security/resilience qualification.
@@ -14,3 +14,5 @@ Evidence: entry actual MariaDB 64/64 PASS, no skips; `.artifacts/cv-import/entry
 Known open acceptance gates inherited from CV-UX: live model BLOCKED; human accessibility/language/device/printing OPEN; hosted MariaDB/isolation BLOCKED/UNVERIFIED; Python advisory qualification CONDITIONAL; production and Phase 10 NO-GO.
 
 Extraction subcheckpoint pushed `3ea8ff9`. Backend reviewed integration focused 51 PASS and actual provider 69 PASS; qualification remains conditional until the final frozen-source lanes. Root continued implementation after delegated workers exhausted their service usage; unfinished worker edits were inspected and tested, not assumed complete.
+
+CV-IMPORT-03 evidence: `lifecycle-green-01` 52 focused backend PASS; `backend-full-01` 1,250 PASS, zero skips. Expired-operation cancellation regression failed before the shared status guards. Linux real sidecar API attempt 03 passed PDF/DOCX and refused the scan in network-disabled/read-only isolation. Earlier attempts remain failed: Linux platform metadata subprocess and missing private HOME were fixed at the child boundary. Source retention includes orphan generated upload files and preserves unrelated files. Original source inspection is unavailable after expiry; approved canonical history is retained.