Verified resume reliability audit — September 2026

This was generated by AI during triage.

This tracks the verified resume-flow/reliability audit at commit c6c9bde3, dated 2026-09-05. It covers all 29 headline findings and the actionable smaller findings. Related mechanisms are grouped into 43 focused child issues; supporting test assertions are acceptance criteria rather than hundreds of separate bugs.

Evidence and scope

• The audit rechecked every claim and all 77 test files. Stronger probes included actual preview/refinement/confirm/SQLite, concurrency barriers, malformed/compressed documents, real Chromium PDF exports and limited actual Next navigation.
• The unchanged frontend suite passes 302 tests; selected backend integration/database tests pass 149 and PDF/monitor tests pass 41. Passing baseline tests do not cover the reproduced gaps.
• Each child includes reproduction, observed result, controls/limits, acceptance checks and immutable code links. Source reports and raw local evidence remain uncommitted/unpushed under docs/reports/2026-09-05-finding-verification*; issue descriptions are self-contained.
• P1/P2/P3 are audit remediation priorities, not security severity scores. No real-provider quality/cost, deployment, production-load or exhaustive layout result is claimed.

Triage decisions

• Preserve the FE-08 qualification: the forced reused-viewer component fails, but tested real Next dashboard A → Back → B navigation remains correct after late A. Track additional routing coverage without asserting a normal production wrong-delete defect.
• Source/JD preview invalidation, applied-date stamping and narrative grounding require explicit product policy. They are labeled as decisions/improvements.
• Keep the corrected effective LiteLLM server-error retry count, actual resume_matcher.db filename and eval README attribution.
• Existing #909/#776/#760 and historical #877/#791/#799/#808/#838 cover related but different paths; relevant children cross-reference them. No existing issues were closed or rewritten.

Child issues

P1

• #932 — [Bug]: Config integration tests overwrite developer settings (T-01, P37, P40, P41)
• #933 — [Bug]: Late saves overwrite another resume’s Reset baseline (FE-01, FV-03, FV-04)
• #934 — [Bug]: Unusable resume responses silently restore and autosave local drafts (FE-02, FV-06, FV-07)
• #935 — [Bug]: Cover letters and outreach text persist across resume switches (FE-03, FV-08, FV-09, FV-10, FV-11)
• #940 — [Bug]: Final refinement can erase populated resume sections and still persist (AI-1, AI1.a, AI1.b, AI1.c, S12)

P2

• #936 — [Bug]: Attachment download and navigation omit unsaved edits (FE-04, FV-13, FV-14, FV-15)
• #937 — [Bug]: Resume download, rename and deletion failures lack visible recovery feedback (FE-05, FV-19, FV-20, FV-21, FV-45)
• #938 — [Bug]: Malformed restored wizard fields crash preview rendering (FE-06, FV-24, FV-25, FV-26)
• #939 — [Bug]: Upload callbacks run twice under React StrictMode (FE-07, FV-29, FV-30, FV-31)
• #941 — [Bug]: Successful tailoring responses expose internal exception text (AI-2, AI2.a, AI2.b, AI2.c)
• #942 — [Improvement]: Enforce shared AI operation budgets and bounded fanout (AI-3, AI3.g, AI3.h, AI3.i, S20)
• #943 — [Bug]: Effective LiteLLM server-error retries differ from configured policy (AI-3, AI3.a, AI3.b, AI3.c, AI3.e, AI3.f)
• #944 — [Bug]: Empty enhancement and malformed regeneration outputs are reported as success (AI-4, AI4.a, AI4.b)
• #945 — [Bug]: JSON retries penalize valid sparse resumes but accept missing schema content (AI-5, S04)
• #946 — [Bug]: Wizard corrections append duplicate resume entries (AI-6)
• #947 — [Bug]: Date restoration assigns one role’s months to another role (AI-8)
• #948 — [Bug]: Replayed confirmation creates duplicate tailored resumes and tracker cards (DB-01)
• #949 — [Bug]: Failed confirmation leaves a committed orphan resume (DB-02)
• #950 — [Bug]: Concurrent previews overwrite accepted confirmation hashes (DB-03)
• #951 — [Decision]: Define preview source binding, invalidation and expiration (DB-04, P09)
• #952 — [Bug]: Stale processing failures overwrite successful retries (UP-01, P23, P24, P25)
• #953 — [Bug]: Malformed files pass document conversion and reach AI parsing (UP-02, P13, P14, P15)
• #954 — [Bug]: Small compressed uploads block the event loop after large expansion (UP-03, AI-7, P16, P17, S20)
• #955 — [Bug]: Failed master replacement can leave no master resume (DB-05, P19, P20)
• #956 — [Bug]: Rejected job batches leave successfully inserted prefixes (DB-06, P21)
• #957 — [Bug]: Concurrent application creates receive the same board position (DB-07)
• #958 — [Bug]: Null tracker status passes validation and fails in SQLite (P26, P27, P28, P29)
• #959 — [Bug]: E2E monitor cannot seed the async SQLite database (MON-01, MON-X01, MON-X02)
• #960 — [Bug]: PDF retries reuse a disconnected Chromium browser (PDF-01)
• #961 — [Bug]: Vivid PDF clips skill text at the printable right edge (PDF-02)
• #962 — [Improvement]: Bound PDF concurrency and the whole render operation (PDF-X01, PDF-X02)
• #963 — [Bug]: Tailoring eval judges static output without source evidence and retries valid JSON (EVAL-01, AI-9, S06, S13, S14, S15, S16, MON-X03)
• #964 — [Bug]: Uploads have no client deadline and cleared requests still emit success (FV-35, FV-36, FV-37)
• #965 — [Bug]: API timeout stops at response headers and ignores caller cancellation (FV-38, FV-39, FV-40)
• #966 — [Bug]: Stale dashboard responses replace newer resumes and master identity (FV-41, FV-42, FV-43, FV-44, FV-46)
• #967 — [Bug]: Browser storage failure causes misleading save and finalize outcomes (FV-55, FV-56, FV-57)
• #968 — [Bug]: Invalid wizard AI envelopes advance unchanged drafts and misread completion (AI6.d, AI6.e, AI6.f)
• #969 — [Bug]: Empty AI attachments and titles are accepted without a clear failed outcome (S07, S08)
• #970 — [Decision]: Define factual grounding rules for rewritten resume narratives (S02, S03, S15, S21)

P3

• #971 — [Bug]: Monitor timings are zero and preview errors report the wrong stage (MON-X04, S01, S11)
• #972 — [Improvement]: Unify configuration path ownership and atomic non-secret writes (P37, P38, P39)
• #973 — [Improvement]: Add missing resume lifecycle and browser boundary tests (FV-48, FV-49, FV-50, FV-52, FV-53, FV-54, FV-59, FV-61, FE-08)
• #974 — [Docs]: Align storage, retry and validation documentation with current behavior (G-09, S18, S19, AI8.d, G-17)

All 43 child issues were created with needs-triage and appropriate category/area labels. Parent/sub-issue relationships are verified separately. No assignment or deadline has been imposed.