fix: review findings F03-F06 — quotas, rule hierarchy and a validator that checks

F03 — application records
- Quota already removed with F02's tracker; verified uncapped and that
  "interview reached" survives a later withdrawal.
- Aker BP: application date confirmed 2026-07-29 by the user, settling the
  one-day conflict. Its Adjacent-despite-79 classification is kept, NOT
  reclassified: the user does not remember the rationale and judged it
  immaterial on a closed role, and silently reclassifying to make the
  arithmetic tidy is the exact objection the review raised. Recorded as an
  explicit override reason with a rubric version instead.

F04 — rule hierarchy
- Three levels stated in AGENTS.md and CLAUDE.md: immutable evidence rules,
  standing user preferences, market/employer presentation.
- Deliverables separated from QA. The .tex stays the artefact of record; you
  still compile, into the application's own output/ folder, because the user
  cannot approve what he cannot open.
- `resume_reference.md` said "Capgemini/Bundeswehr: include only when directly
  relevant", contradicting the standing never-include rule. Split and fixed.

F05 — a green validator now means something
- Per-claim `forbidden` wording is enforced. 14 of 26 claims carried such a
  list and NONE of it was checked, which is why "owned the full ML lifecycle"
  passed. Matching tolerates inserted adjectives: the real regression read
  "Built a decentralized Data Mesh" and one word defeated the literal list.
- Added identity (e-mail/phone), employer-date, placeholder and
  document-exclusion checks. Capgemini's omission rule now has a canonical
  home in claims.json instead of living only in memory and config.md.
- Registered Groovy and Snowflake as forbidden skills. Both were absent from
  claims.json entirely, so "forbidden" existed in prose with nothing enforcing
  it.
- PASS no longer reads as a truth certificate: it prints what it did not check
  — scope implications, bullet-to-claim support, whether a number is real.

F06 — the scanner stopped fighting the documents
- LaTeX comments are no longer claims; `% never claim Terraform` was a finding
  before, which taught the workflow to write around the checker.
- Markup, accent macros and umlauts are normalized, so `\textbf{Snow}flake`
  cannot smuggle a forbidden skill past a substring test and
  `Universit\"at der Bundeswehr M\"unchen` is recognisably a school.
- Honest denials pass in English and German.
- The triple-list cadence hint knew only English "and", so it silently did
  nothing on every German package. Advisory only, and now labelled as such.

Verification
- The six counter-proofs from the report are caught: 9 errors on one synthetic
  document, where the old scanner found none.
- All six packages built under current rules scan clean — SBB, NVIDIA, RUAG,
  Kdo Cy, Citadel, Aker BP. Four false positives of my own were found and fixed
  on the way there; each is now a regression test.
- 13 older packages do report findings. Those look like genuine historical
  violations and are deliberately NOT fixed here: F17 governs archives and they
  must not be silently rewritten.
- `tests/test_document_scanner.py` added. Full suite 31/31 pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Qej5SBvhcbGXHwLqNWiskM

AGENTS.md

@@ -52,10 +52,30 @@ You are simultaneously:
 
 You write as the strategist but critique as the reader.
 
-**Hard rules:**
-- Output .tex files ONLY. User compiles locally.
+**Rule hierarchy.** When two instructions conflict, the higher level wins. State which level
+you are applying when you deviate.
+
+1. **Evidence rules (immutable).** Anti-fabrication, Scope Discipline, provenance, verb discipline,
+   `claims.json` as highest authority. These are never overridden by a JD, a market convention or a
+   user styling preference. **Accuracy > Relevance > Impact > ATS > Brevity.**
+2. **Standing user preferences.** Recorded in `config.md` and the KB Corrections Log — e.g. Capgemini
+   is omitted from every document and the resulting gap is intentional. Changed only by the user.
+3. **Market and employer presentation.** Profile choice (International Tech vs Swiss/DACH), section
+   order, language, cover-letter convention. Adapt these per target; they never license a level-1 or
+   level-2 breach.
+
+**Deliverables vs QA — these are different things and were previously conflated:**
+- **The `.tex` is the deliverable and the source of truth.** Never hand over a PDF as the artefact of
+  record, and never edit a PDF in place.
+- **You still compile.** Run `validate_resume_system.py`, compile with the local LaTeX distribution,
+  and inspect the rendered pages before calling anything finished — a clean box count is not a
+  visual check.
+- **Compile into the application's own `output/` folder**, not a temp directory, so the user can
+  review what he is approving (`config.md` Output Rules; rule added after a package shipped with no
+  reviewable PDF on 2026-08-27). "Output .tex only" means the .tex is authoritative, **not** that the
+  user should be handed nothing to look at.
+- Refresh any submission-named copy on every recompile; it is a copy, not a build target.
 - Read `config.md` for email, provenance flags, and output preferences.
-- **Accuracy > Relevance > Impact > ATS > Brevity**
 
 ## Evidence-First Workflow