fix(F07): propagate recorded corrections into active writing sources

The review's key point is that the error ran BOTH ways.

Overstatement, narrowed to canonical scope:
- BS-1 variants claimed "eliminated manual wafer inspection", "no manual
  intervention" and "unattended quality monitoring". Canonical BS-1 supports a
  qualitative reduction whose size is unverified. Reworded; the scope limit is
  now stated inline where the variants are written.
- bundle_data_platform called BS-1 a "zero-downtime constrained deployment".
  Integration into a fab that runs continuously is not a measured zero-downtime
  property.
- experience_swisscom carried "grounded retrieval" as a skill and ATS keyword
  while SW-8 records retrieval implementation as explicitly unknown, and its
  reframing note invited "evaluation discipline" although formal model
  evaluation is a globally forbidden pattern. Both removed.
- PyTorch sat in bundle_ml_ai_engineer as a bold tool and an ATS must-include
  with no certification context - the exact way the context gets lost.

Undervaluation, the half that quietly costs him roles:
- BS-6 (Linux administration, intensive Ansible incl. self-written extensions)
  has been canonical since 2026-08-27 but appeared in NO bundle, so the normal
  selection paths could not see it. Added to the data-platform and data-engineer
  bundles with its currency limit (employer-side ended Dec 2022; PP-3 is
  personal) and the standing GitOps prohibition.
- Linux, Ansible and Bash were missing from skills_taxonomy entirely.
- skills_taxonomy still said the IBM certification year was "not recorded" and
  that PyTorch needed verification; both were settled on 2026-08-27.

Not rewritten, deliberately: the NVIDIA and RUAG cover letters state the
production line could not be stopped. That exceeds the canonical record but is
plausible and both are already submitted. Recorded as an OPEN ITEM in
experience_bosch.md to be confirmed with the user before any reuse.

Validator PASS, 31/31 tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Qej5SBvhcbGXHwLqNWiskM

resume_builder/bundles/bundle_data_engineer.md

@@ -122,3 +122,13 @@ Python, Kafka, AWS (S3 · Glue · Athena · Redshift · Airflow · CloudFormatio
 - Listing all tools in paragraph form
 - Mentioning Bundeswehr unless specifically relevant (leadership angle for management-adjacent roles)
 - Overplaying test automation background
+
+## Infrastructure and Linux operations (BS-6) — added 2026-09-11, review F07
+
+BS-6 was absent from every bundle although it has been canonical since 2026-08-27, so genuine strengths never reached the selection paths.
+
+- **Linux administration and automation at Bosch (2020–2022):** Linux servers carried the ML platform, Docker hosts, backend services and the Ansible control path.
+- **Ansible beyond a single project:** configuration management and infrastructure automation, including self-written extensions (a credential plugin with local caching).
+- **Use it when** the JD names Linux, Ansible, configuration management, IaC or platform operations — exactly the DevOps/SRE-flavoured reqs where this profile reads thin without it.
+- **Currency limit, always state it:** employer-side Linux/Ansible ended Dec 2022; `PP-3` carries the current half and is a **personal** self-hosted Debian server. Never present PP-3 as employer work or as physical-datacenter evidence.
+- **GitOps remains forbidden:** playbooks lived in Git but ran push-based from Jenkins/GitLab with no reconciliation agent. The substance is writable as “version-controlled infrastructure automation with Ansible from Git, executed through Jenkins/GitLab pipelines”.

resume_builder/bundles/bundle_data_platform.md

@@ -66,9 +66,10 @@
 | SW-3 | K8s + GitLab | **Lead bullet** — "Deployed and operated Python data applications on Kubernetes with GitLab CI/CD; drove infrastructure automation in agile DevOps team" | K8s + CI/CD ownership = core platform signal |
 | SW-1 | AWS migration | "Migrated pipelines in his owned domains from legacy Teradata/Oracle processing onto Swisscom's AWS platform (Glue, Athena/Iceberg, Redshift, Airflow, CloudFormation)" | Scoped migration delivery plus AWS breadth |
 | SW-2 | Component Owner | "Owned Fulfillment ETL pipelines (Oracle/Kafka → Teradata) — platform reliability, Data Governance compliance, 2nd/3rd-level support and on-call duty" | Platform SLA + on-call = reliability engineer signal |
-| BS-1 | ML inference | "Containerized and orchestrated ML inference (Docker, K8s, Ansible) into 24/7 semiconductor production — zero-downtime constrained deployment" | Production-grade containerization under hardest constraints |
+| BS-1 | ML inference | "Containerized and orchestrated ML inference (Docker, K8s, Ansible) into a continuously operating 24/7 semiconductor production environment" | Production-grade containerization in an environment that cannot be paused. **Do not write *zero-downtime*** — canonical BS-1 evidences integration into continuous production, not a measured zero-downtime deployment property |
 | BS-4 | ELK PoC | "Built an anomaly-detection **proof of concept** on ELK + Kafka (Docker) with Grafana, Prometheus and Loki monitoring, validating centralized logging and alerting for 24/7 semiconductor production" | PoC-scoped observability breadth — **the PoC framing is mandatory, not optional** |
 | SW-5 | Security Champion | "2025/2026 team Security Champion; include only if the JD explicitly requires security or DevSecOps exposure" | Secondary team-role evidence, not ownership or certification |
+| BS-6 | Linux/Ansible | "Administered and automated Linux servers carrying the ML platform, Docker hosts and backend services at Bosch; wrote Ansible extensions including a credential plugin with local caching" | **Infrastructure-as-Code and Linux operations evidence.** Added 2026-09-11 (review F07): BS-6 existed in `claims.json` and `experience_bosch.md` since 2026-08-27 but appeared in NO bundle, so the selection paths could not see it. Currency limit: employer-side Linux/Ansible ended Dec 2022; `PP-3` (personal Debian server) carries the current half and must be named as personal. GitOps stays forbidden — execution was push-based from Jenkins/GitLab, not agent-reconciled |
 | BS-2 | Data services | "Built multi-language data services (Python/Java/C#) over OracleDB and Hadoop/ImpalaSQL — platform-layer data access for semiconductor analysis teams" | Enterprise DB + Hadoop infrastructure |
 | BS-3 | App Owner | "Application Owner for semiconductor analytics platform — SLOs, reliability, vendor management, on-call coverage" | Platform SLA ownership |
 | FC-1 | CI/CD initiative | "Independently introduced Jenkins CI/CD pipeline with quality gates at Fraunhofer CML — first build automation adopted by the research team" | Initiative: built CI/CD from zero |

resume_builder/bundles/bundle_ml_ai_engineer.md

@@ -71,14 +71,16 @@
 ## S4: Skills Guide
 
 **Bold tools (resume Technical Skills section):**
-Python, Kubernetes, Docker, AWS (S3 · Glue · Athena · Airflow), Kafka, PyTorch · Scikit-learn
+Python, Kubernetes, Docker, AWS (S3 · Glue · Athena · Airflow), Kafka, Scikit-learn
+*(PyTorch and TensorFlow/Keras are **certification-context-only** in `claims.json` — list them only beside the IBM AI Engineering certificate, never as production tooling.)*
 
 **Must-include skills (ATS match):**
 - Python, MLOps, ML inference deployment
 - Docker, Kubernetes, Ansible
 - AWS (S3, Glue, Athena, Redshift, Airflow), Apache Iceberg
 - Apache Kafka
-- PyTorch, Scikit-learn, Pandas, NumPy
+- Scikit-learn, Pandas, NumPy
+- PyTorch / TensorFlow **only with certification context** — see the note above; a bare ATS listing is the exact way the context gets lost
 - CI/CD (GitLab, Jenkins)
 
 **Nice-to-have (include if JD mentions):**