fix(F17): a PDF in a folder is not proof the package can be rebuilt

Build sweep run this session: 48 sources, 46 built, 2 failed. Infineon_AI_Engineer's
cover letter fails on font expansion (the font is not scalable); cv_template.tex
fails on unfilled placeholders, which is expected for the academic legacy path.
Overfull boxes: Microsoft ISE 25.33pt, Isovalent 0.88pt. All historical, all
left alone.

New: resume_builder/helpers/package_manifest.py records, per application
package, what a rebuild would ACTUALLY do - sources, class-file hashes, PDFs
present, and the reasons a rebuild would not reproduce the submitted document.
It is descriptive; nothing in it authorises rewriting a submitted file.

What it found across 21 packages:
- 17 are DATE-DEPENDENT. The cover letters use 	oday, so recompiling a
  historical package silently restamps it with today's date.
- 1 has an INCOMPLETE SOURCE DISTRIBUTION: output/NATO_AI_ENGINEER ships no
  resume.cls. It builds on this machine only because a copy exists elsewhere,
  and the shipped PDF hid that. Not repaired by copying the newest class in -
  the repo carries THREE different resume.cls variants (13/7/1 copies) and older
  macros differ, so that "fix" could silently change a historical document.
- 1 has no PDF at all, so nothing is reviewable without a build.

Classification: 7 application packages were in no reuse category. Added to
historical_revalidate, and the register now records the default explicitly -
anything unlisted is treated as revalidate-before-reuse. Being recent is not the
same as being verified; none of the seven was re-read for this.

Prevention rather than repair: 	oday removed from the cover-letter template so
new packages stop adding to the pile. A test now fails if it comes back, if the
manifest goes stale, or if a package is left unclassified.

Also: scan_document gained a template mode. A placeholder in a TEMPLATE is what
makes it a template; the defect is one surviving into a generated document.

37/37 tests pass; counter-proof still catches all 9.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Qej5SBvhcbGXHwLqNWiskM

FIX_PROGRESS.md

@@ -6,13 +6,12 @@ Do not rewrite submitted application archives or invent missing evidence.
 
 ## Resume point
 
-F01–F16 complete. **Next: F17** — reproducible builds and safe historical-archive
-classification. Start from the 13 older packages listed in the F05/F06 verification notes
-below; they carry genuine findings under today's rules and must NOT be silently rewritten.
-F17 also needs the 45-document LaTeX sweep, which has not been re-run this session.
+F01–F17 complete. **Next: F18** — evidence earlier on page one and a rendered skills budget.
+F18/F19 change how the CVs look; the user authorised this on 2026-09-11. They need compiling
+and visual inspection, not blind patching, so budget for a build loop.
 Read this file and inspect `git log`/`git diff` before resuming; do not repeat completed work.
 
-Checkpoints: `afdef7e` (F01+F02) · `fc5f3e4` (F03–F06) · `ce5b7f5` (F07) · `3519b2f` (F08–F10) · `afd8174` (F11–F13) · `ce8619b` (F14) · plus F15–F16.
+Checkpoints: `afdef7e` (F01+F02) · `fc5f3e4` (F03–F06) · `ce5b7f5` (F07) · `3519b2f` (F08–F10) · `afd8174` (F11–F13) · `ce8619b` (F14) · `c7e8d4e` (F15–F16) · plus F17.
 
 ## User rulings — 2026-09-11
 
@@ -43,7 +42,7 @@ Checkpoints: `afdef7e` (F01+F02) · `fc5f3e4` (F03–F06) · `ce5b7f5` (F07) ·
 | F14 | DONE | Buckets renamed to keyword relevance with an explicit 'NOT a fit judgement'; German titles and platform/DevOps vocabulary added. Kdo Cy *ICT-System Engineer (DevSecOps/Platform Automation)* went 0→10; *Senior Dateningenieur* 1→3, level with its English twin |
 | F15 | DONE | Taleo deadline moved out of `posted` (a closing date was making roles look freshly published); `unit`, `compensation`, `contact` and `date_provenance` carried as fields through to the report and JSON. Named contacts now surface — directly serving the channel rule |
 | F16 | DONE | Restricted runs write `<date>.only-x.md` and leave the daily report intact; seen-state committed only after the report is on disk, and never by a restricted run; unique temp names for atomic writes |
-| F17 | TODO | Reproducible new builds and safe historical archive classification |
+| F17 | DONE | Build sweep 46/48; `package_manifest.py` records per package what a rebuild would really do; 7 unclassified packages registered with a safe default; `	oday` removed from the cover-letter template. Historical packages untouched |
 | F18 | TODO | Evidence earlier on page one; rendered skills budget |
 | F19 | TODO | Education layout, phrasing guidance, reproducible word counts |
 
@@ -96,7 +95,19 @@ mid-remediation — it would destroy the ability to attribute a regression to a
   `--only=kdocy` wrote `2026-09-11.only-kdocy.md` while leaving the full report untouched.
 - F16 context: the daily-report clobber is not hypothetical. It happened twice in this session
   (2026-09-10 and 09-11) and both times the full run had to be repeated by hand.
-- Not re-run this session: the 45-document LaTeX build sweep and the visual sampling.
+- F17 build sweep RUN this session: 48 sources, 46 built, 2 failed —
+  `Infineon_AI_Engineer` cover letter (font expansion: the font is not scalable) and
+  `cv_template.tex` (unfilled placeholders, expected for the academic legacy template).
+  Overfull boxes: Microsoft ISE 25.33pt, Isovalent 0.88pt. Both are historical; not touched.
+- F17 findings across 21 application packages: **17 are date-dependent** (`	oday` in the cover
+  letter, so a rebuild restamps them), **1 has an incomplete source distribution** (NATO ships no
+  `resume.cls` and only builds because a copy exists elsewhere on this machine), 1 has no PDF.
+  The repo carries **three different `resume.cls` variants** (13/7/1 copies), which is exactly why
+  copying the newest one into NATO would not be a safe repair.
+- F17 classification: 7 packages were unregistered; added to `historical_revalidate`, with a
+  recorded default that anything unlisted is treated that way. Being recent is not being verified —
+  none was re-read for this.
+- Still not re-run: the visual page sampling (F18).
 
 ## Completion rules