# Documents UX

ARC-10; PRES-C05–PRES-C12, PRES-W05–PRES-W08, PRES-M04, PRES-S05, PRES-E09. NEW-11 covers missing cross-job read projections, not a replacement storage model.

## Purpose and existing resources

Documents is an owner-scoped **index of existing resources** with links to the editor that owns each one. It does not make every artifact a new generic Document record.

| Category | Existing backing / destination | State and relationship rule |
|---|---|---|
| CVs | CvVariant / CV library and editor | Current settings + canonical inherited content; optional job link; private/public independent of submission |
| Cover letters | Job letter text/history and ApplicationAssets | One job's draft/versions; edit at job Application → Letter |
| Application answers / recruiter draft | Existing package draft fields | Job-owned text; not a new standalone response library |
| Uploaded attachments | Attachments owned through job | Purpose/type/size/name/date; current upload/rename/AI-use/download/delete retained |
| References / certificates | Attachment categories where the existing purpose supports them | Display as uploaded evidence; no new verification/credential issuer system |
| Generated materials | Existing variant/letter/tailored output paths | Generated preview/PDF may be transient; do not claim every download is stored |
| Submitted packages | Submitted package records, frozen content and archived files | Immutable historical evidence; version/time/job and captured source identifiers |
| Email drafts | Existing correspondence draft service | Context link to Correspondence; not a file or proof of delivery |

A certificate uploaded to a job is not automatically a verified Career Profile qualification. A public CV is not automatically submitted. A frozen package is a recorded snapshot, not confirmation that an employer received it.

## Index and data availability

Proposed /documents has text search, type, linked job and Draft / Submitted filters; sort by updated/captured date where present. CV public/private state is a separate badge/filter. Row/card: name, kind, linked role/company, source/version when recorded, draft/frozen state and open/download actions. Mobile uses structured cards; desktop may use a compact table/list.

CV library reads exist. Attachments, letters and package history are mainly job-scoped. A coherent cross-job index/search needs a bounded server projection with authenticated-owner queries, pagination, supported sort and metadata-only responses. Do not download every job/body/attachment to synthesize an index in the browser. Until that projection exists, provide honest links to CVs and selected-job documents rather than pretending a complete All documents result.

No binary relocation, schema unification or new upload-to-account bucket is presumed. General account-level reference storage would be a separately approved NEW requirement. Preserve job attachment limits and safe response headers; never render file content in search snippets.

## Relationships and actions

Open routes to the existing owner editor. Show “Used for” only when a relationship/submission actually records it. Current attachment/variant relation and submitted version are separate; changing current material cannot relabel history as the newest version.

Retain current CV association cardinality: CvVariant has an optional JobApplicationId and attaching may re-point it. Do not offer “attach everywhere” as though a many-to-many relation exists. Detaching does not delete the variant. Deleting a job does not imply deleting independent CVs. Preserve all ownership/reference guards.

Download current PDF renders current CV; archived package download uses captured content/files. Distinct labels prevent confusing the two. No regenerate button overwrites frozen packages. Capturing again creates a new package via the existing operation. Live attachment deletion never implies erasing its historical archived copy; source-copy failure stays an error.

AI-use toggle is explicit context inclusion permission for that attachment; do not broaden it when moving its card to Documents. Upload is not permission to use all files with every AI action.

## Error, dirty and authorization behavior

Missing/deleted/foreign resource yields existing safe API result and no private metadata. An index entry may become stale: refresh and explain unavailable; never attach another matching-name item. Navigation from a dirty letter/CV honors its guard; account switching disposes results/drafts. No owner IDs from filters select an API tenant.

P2-D01 blocks native SQLite package capture/tailoring. Existing mocked/service proofs are not successful archive-preservation evidence. Freeze/history presentation migration waits for its separate repair and actual unchanged HTML/letter/binary checks. A unified Documents page must not conceal that baseline defect.

## Validation

List/search isolation with A/B, draft vs frozen vs public labels, source editor links, foreign attach denied, detach keeps variant, live source mutation does not alter captured content, archived bytes survive live deletion, no extra render on listing, correct download filenames/encoding. Extend Phase 2 W07/W08 evidence before claiming complete document parity.