docs(dev): record verified local source activation

dev/README.md

@@ -26,7 +26,7 @@ rtk proxy python dev/check_local_ai.py --output .artifacts/pre-phase10-ux/local-
 
 The apply helper validates project, Development environment, loopback backend ports, development database, current backend image, offline model mount and Mailpit settings. It recreates only the development backend/sidecar without a build or pull, preserving the database and volumes. It enables rules, reminders, saved-search alerts, daily exports, job enrichment and queued AI processing. These features still respect account entitlements, AI consent, configured schedules and available input. Email goes only to Mailpit at `http://localhost:8026`; it is not delivered externally.
 
-This configuration operation does not publish source changes. In particular, the running older backend image cannot use the new `Ai:RequestTimeoutSeconds=240` setting until built from the validated feature source. Its old 30-second limit can interrupt CPU generation. Source builds and application checks have separate evidence.
+This configuration helper does not build or publish source changes. Its initial backend image used a30-second limit, which could interrupt CPU generation. The separately qualified source activation below supplies the new240-second development timeout.
 
 OAuth/mail synchronisation, billing and external data providers need their own approved credentials and configuration. Enabling workers cannot provide them. CV document import uses deterministic Docling; generative CV-import assistance stays disabled pending its separate source-grounding/accuracy qualification.
 
@@ -43,3 +43,15 @@ The resumed session found Docker Desktop4.86.0 stopped. Startup failed with Wind
 After stopping only the failed local Desktop/backend processes, the runtime directories were moved aside and recreated. Backups remain in `C:/Users/Connor/AppData/Local/Docker/run.pre-p10-stale-20261028`, `run.pre-p10-stale-20261028-02` and `C:/Users/Connor/AppData/Local/docker-secrets-engine.pre-p10-stale-20261028`. They contain only the inspected stale IPC entries. The Linux engine then responded successfully as `docker-desktop`. Model files, database volumes and Docker settings were not reset. This was local development recovery; production was not accessed.
 
 The same failure pattern is reported in [Docker's Windows issue tracker](https://github.com/docker/for-win/issues/15064). The recovery above is supported by current local inspection and a successful engine response; it is not a general instruction to move Docker data directories or reset an installation.
+
+## Qualified local source activation, 28 October 2026
+
+The existing development stack now runs source checkpoint `3f4db8ca8183704945915ae4d2053e641bafa5b2`. Local URL: **http://jobbjakt.local**. The frontend deliberately rejects an unmatched `localhost` Host header; the canonical host was preserved. Mailpit remains at `http://localhost:8026`.
+
+Backend image: `sha256:462b1d14fe871d64b16a2db28fda30a433657dd4d8ed5f61587a6b80685fb0cf`. Frontend image: `sha256:a59b8313233a20f6a2f0a8cc23785d224b58678e5758c3985fa55f238402886f`. All qualified source-file hashes were rechecked before activation. The backend is the same immutable image used by the passing Linux qualification. The frontend was rebuilt from that source with `/api` routing and the existing local nginx configuration. The qualified static test export was archived separately before this build.
+
+Raw activation/rollback identities, source-image compose override, build logs and actual HTTP checks are in `.artifacts/pre-phase10-ux/local-ai/source-3f4db8c/`. The one-off activation script is retained alongside that directory as execution evidence. Backend/frontend were recreated with no dependency recreation, builds, pulls or volume removal during the compose apply. Previous image IDs remain recorded. Existing database, sidecar, model and email services were retained.
+
+Confirmed: both images healthy; served index matches the built bytes; backend health200; anonymous proxied account request401; actual backend environment has all seven authorised workers enabled and the240-second AI timeout. Ollama blobs were reverified after engine recovery. These checks establish the running source/configuration; model-quality and broader feature qualifications remain separately stated in B_ACCEPTANCE.md.
+
+For subsequent compose operations, retain the generated `source-images.override.json` **after** `dev/local-workers.override.yml`, the primary standalone development compose file and its `.env.dev`. Supply the same read-only `JOBTRACKER_DEV_BART_ARTIFACT` path. Running only the primary compose file can revert these local image/configuration selections. Do not substitute production configuration.

docs/pre-phase10-ux/B_ACCEPTANCE.md

@@ -1,6 +1,6 @@
 # B and owner additions: development acceptance
 
-28 October 2026. Branch `feature/cv-template-library-review`, cumulatively based on accepted A commit `663023a` and local-runtime checkpoint `73ea888`. The source-bearing commit immediately following this report is the qualified checkpoint; source/image hashes are retained in the build records. No main merge or production deployment is authorised.
+28 October 2026. Branch `feature/cv-template-library-review`, cumulatively based on accepted A commit `663023a` and local-runtime checkpoint `73ea888`. Qualified source checkpoint: `3f4db8ca8183704945915ae4d2053e641bafa5b2`, pushed with remote/local equality verified. Source/image hashes are retained in the build records. No main merge or production deployment is authorised.
 
 **Decision: CONDITIONAL GO for continued development and workstream C. Production: NO-GO.** The application changes and finite supported-document checks pass. The unchanged large-name coordinate oracle remains partial, human/device/print qualifications remain open, and the consolidated PRE-P10 regression is still required after C/D.
 
@@ -68,4 +68,6 @@ Local `qwen2.5:7b` matches the repository's recorded production model name. Exac
 | Consolidated PRE-P10 acceptance / Phase10 cleanup | NOT YET READY |
 | Production | NO-GO |
 
-Next: activate qualified source images only in the existing local development stack; then create `feature/dashboard-interactive-grid` from this accepted cumulative checkpoint. Keep all C/D and consolidated integration requirements in PLAN.md. No additional owner approval is needed for these already-authorised safe development steps.
+Qualified source images were activated only in the existing local development stack on28 October. Actual HTTP/byte identity, healthy images, authenticated-proxy boundary, seven worker flags and240-second timeout checks passed; see `dev/README.md` and `.artifacts/pre-phase10-ux/local-ai/source-3f4db8c/http-check.json`. The canonical local frontend host is `jobbjakt.local`; an unmatched localhost Host header is intentionally rejected. This operational check is separate from model-quality acceptance.
+
+Next: create `feature/dashboard-interactive-grid` from this accepted cumulative checkpoint. Keep all C/D and consolidated integration requirements in PLAN.md. No additional owner approval is needed for these already-authorised safe development steps.

docs/pre-phase10-ux/OWNER_ADDENDUM.md

@@ -35,4 +35,4 @@ Original dashboard/admin/final integration checkpoints remain required. No Phase
 
 `dev/README.md` records reproducible setup, guardrails, dependency pins and measured synthetic checks. Raw records are `.artifacts/pre-phase10-ux/local-ai/{verification,inference-smoke,worker-preflight,workers-applied,sidecar-smoke}.json`. Actual summarisation2.518s and CV rewrite40.997s returned nonempty content. This required the qualified parser-capable sidecar and the previously approved trained DistilBART artifact mounted read-only, with Transformers offline. No production service or cache was accessed.
 
-The running backend/frontend retain their previous image identities at this configuration checkpoint. A validated source build is still needed for the new configurable backend AI timeout and UI changes. CV-import generative interpretation remains off; real inference here does not qualify source-grounded factual extraction.
+At the initial73ea888 configuration checkpoint, backend/frontend retained their previous images. On28 October, qualified source3f4db8c was activated locally with healthy images, matching served bytes, the existing canonical `jobbjakt.local` host, all seven worker flags and240-second timeout verified. See `dev/README.md`. CV-import generative interpretation remains off; real runtime inference does not qualify source-grounded factual extraction.

docs/pre-phase10-ux/PLAN.md

@@ -28,7 +28,7 @@ No main merge, production service/database/storage/model/cache/deployment operat
 - [x] A-01: reproduce blank hydration/header/export and Strict Mode history failures in focused tests plus actual local development browser. Save RED evidence; no application fix before reproduction.
 - [x] A-02: nullable explicit inclusion flags across resolver/editor/AI/matcher, deliberate creation/profile selection, empty export validation; pure immutable grouped session history/shortcuts/epoch guards; focused unit/provider/browser and RD21 checks, review, docs, commit/push/verify. Evidence: A_ACCEPTANCE.md, backend108/frontend98/browser4/MariaDB82, TypeScript/lint0; fresh review fixes have RED/GREEN tests. Commit is the source-bearing checkpoint immediately following5d4b8f2.
 - [x] B-00: branch from accepted A; inventory9 IDs, render equivalent short/medium/long/dense samples, establish measured spacing/pagination defects and legacy source/PDF proof. See TEMPLATE_AUDIT.md.
-- [x] B-01 implementation/qualification: versioned designs, actual samples, matching letters, secure optional photographs, queue repair and local runtime. Backend1394/frontend1014/MariaDB84/interactive browser6/real Docling2; revised CV36+letter18 per platform and original Linux24+4. Conditional development acceptance and retained large-name oracle failures: B_ACCEPTANCE.md. Commit/push/remote verification closes this checkpoint.
+- [x] B-01: versioned designs, actual samples, matching letters, secure optional photographs, queue repair and local runtime. Backend1394/frontend1014/MariaDB84/interactive browser6/real Docling2; revised CV36+letter18 per platform and original Linux24+4. Conditional development acceptance and retained large-name oracle failures: B_ACCEPTANCE.md. Source3f4db8c committed/pushed with remote equality verified; qualified source images activated only locally on28 October.
 - [ ] C-00: branch from accepted B; verify official grid API/licence/compatibility/bundle, define v2 JSON and v1 migration tests.
 - [ ] C-01: interactive real widget grid/edit/catalogue with geometry, min sizes, keyboard/touch alternatives, conflict-safe persistence; unit/provider/drag/resize/reflow/browser coverage; commit/push/verify.
 - [ ] D-00: branch from accepted C; define exact safe diagnostic/event schema and admin identity/association policies; tests first.