trackly-cli 0.13.4 → 0.14.0

package/README.md

@@ -35,7 +35,7 @@ trackly jobs --function product
 
 ## At a Glance
 
-3,800+ companies | 170K+ jobs | 40+ ATS types | CLI + MCP | 48 local MCP tools
+3,800+ companies | 170K+ jobs | 40+ ATS types | CLI + MCP | 54 local MCP tools
 
 ## CLI Commands
 
@@ -181,6 +181,10 @@ Then use natural language in any of these clients:
 | trackly_start_apply_execution | Start a target-counted accessible Apply execution |
 | trackly_get_active_apply_execution | Recover the active execution before legacy batch recovery |
 | trackly_get_apply_execution | Read the authoritative progress funnel and immutable child waves |
+| trackly_list_recoverable_apply_executions | List bounded exact-member recovery candidates after context loss |
+| trackly_recover_exact_apply_members | Recover only one explicitly confirmed candidate set without substitutes |
+| trackly_list_apply_review_handoffs | Rediscover active, value-free review-handoff receipts for one execution |
+| trackly_claim_apply_review_handoff | Claim and classify one exact review-handoff group before reconciliation |
 | trackly_get_apply_execution_snapshot | Fetch a compact bounded projection for current execution members and required profile keys |
 | trackly_resume_parked_apply_member | Explicitly resume one parked member for a fresh non-mutating access probe |
 | trackly_approve_apply_execution_resume | Approve one exact resume identity for an unchanged execution snapshot |
@@ -204,6 +208,8 @@ Then use natural language in any of these clients:
 | trackly_report_apply_observation | Send redacted ATS mechanics feedback |
 | trackly_lint_application_text | Locally lint application writing and return only value-free violations plus a draft hash |
 | trackly_diagnose_local_path | Locally diagnose the exact implicated filesystem path without deleting files |
+| trackly_validate_apply_tab_keep_set | Locally validate an exact expected/keep tab set against complete caller-supplied inventories without controlling the browser or sending tab IDs remotely |
+| trackly_validate_apply_resume_upload | Locally validate adapter capability and ordered value-free attachment proof stages |
 | trackly_report_apply_observations | Bulk-send up to 20 leased, batch-bound redacted observations |
 | trackly_record_application_outcome | Record review or confirmed submission outcome |
 | trackly_record_application_outcomes | Bulk-record up to 20 leased batch outcomes with per-member conflicts |
@@ -274,7 +280,7 @@ trackly config --base-url http://127.0.0.1:3000  # Point at a different backend
 | Job search + filters | Yes | Yes | Yes |
 | Apply/save/dismiss | Yes | Yes | Yes |
 | AI-powered search | Yes (trackly ask) | Yes | Yes |
-| MCP integration | Yes (48 local tools) | -- | -- |
+| MCP integration | Yes (54 local tools) | -- | -- |
 | Browser required | No | Yes | No |
 | Best for | Terminal + AI agents | Visual browsing | Custom integrations |
 
@@ -288,7 +294,7 @@ Install trackly-cli (`npm install -g trackly-cli`), authenticate with `trackly l
 
 **What MCP servers exist for job searching?**
 
-trackly-cli includes a built-in MCP server with 48 tools for job search, company lookup, discovery preferences, application tracking, accessible execution and frozen-batch orchestration, profile onboarding, beta evidence, and manual-submit form preparation. Run `trackly mcp` or use `trackly agent setup --client claude`.
+trackly-cli includes a built-in MCP server with 54 tools for job search, company lookup, discovery preferences, application tracking, accessible execution and frozen-batch orchestration, profile onboarding, beta evidence, and manual-submit form preparation. Run `trackly mcp` or use `trackly agent setup --client claude`.
 
 **How do I use Claude Code for job hunting?**
 

package/contracts/trackly-apply-contract-history.json

@@ -6,9 +6,16 @@
     "contractSha256": "8c52daa8b62095a6431d5b954505079c3f7c802e5c5ae39efa8ea7e988dfbc7a"
   },
   "3.6.2": {
-    "contractSha256": "83e107ad7ae2abdc42cdacb9848d8e3bf345951ed7b8f42d5cd9b5e203528bf2"
+    "contractSha256": "83e107ad7ae2abdc42cdacb9848d8e3bf345951ed7b8f42d5cd9b5e203528bf2",
+    "toolsSha256": "d9d24da4b79a4cc65aec589debd2b9072e41b309fd6bf6a65e95dd4b5bef3c08"
   },
   "3.6.3": {
     "contractSha256": "93a8e55196c14f04afb923711997eacdc26dbdeae50b253b906d547abd346e30"
+  },
+  "3.7.0": {
+    "toolsSha256": "8380e2a9fabef4da18ea731f55c8994aef5a4738bb6e7daef9be4ce6ebfec64f"
+  },
+  "3.7.1": {
+    "contractSha256": "0eb582fcac72804347c5da53d214a67908f657f600536db7b42167350bb3f3ab"
   }
 }

package/contracts/trackly-apply-tools.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "3.6.3",
+  "contractVersion": "3.7.1",
   "constants": {
     "applyExecutionMaxTarget": 20,
     "applyScenarioCodes": ["browser_reclaim", "resume_upload", "resume_parser_recheck", "semantic_boolean_commit", "custom_select_commit", "multi_step_navigation", "free_text_voice", "required_error_sweep", "final_consent", "handoff_reclaim", "critical_contact_integrity", "manual_submit_boundary", "job_identity_match"],
@@ -16,7 +16,12 @@
     "applySurfaceEvidenceTypes": ["surface_inventory_reconciled", "surface_missing", "surface_close_attempted", "surface_close_receipt", "surface_post_close_absent", "surface_close_failed"],
     "applySurfaceOwnershipStates": ["controller_owned", "user_owned", "controller_user_union", "unresolved"],
     "applySubmissionEvidenceTypes": ["request_accepted", "confirmation_detected", "provider_receipt_detected"],
-    "applySubmissionEvidenceSources": ["submission_request", "success_page", "user_confirmation", "provider_receipt", "post_submit_receipt"]
+    "applySubmissionEvidenceSources": ["submission_request", "success_page", "user_confirmation", "provider_receipt", "post_submit_receipt"],
+    "applyPositiveSubmissionStrategyCodes": ["greenhouse_confirmation_redirect", "greenhouse_semantic_success", "ashby_semantic_success_banner", "ashby_submitted_state", "lever_confirmation_redirect", "lever_semantic_confirmation"],
+    "applyExecutionRecoveryEligibilityCodes": ["recoverable", "already_applied", "inactive", "revoked", "changed_requisition", "concurrently_owned", "lineage_unavailable", "retention_expired"],
+    "applyHandoffReconciliationClassifications": ["detected", "user_confirmed", "unresolved", "contradictory"],
+    "applyUploadStages": ["semantic_control_discovered", "file_chooser_armed", "file_chooser_opened", "set_files_succeeded", "user_facing_filename_committed", "parser_fields_rechecked"],
+    "applyUploadFailureCodes": ["upload_capability_unavailable", "upload_stage_missing", "upload_stage_out_of_order", "upload_stage_duplicate", "control_ambiguous", "chooser_timeout", "chooser_open_without_commit", "file_missing", "file_expired", "set_files_failed", "filename_uncommitted", "unexpected_file_navigation", "parser_unsettled", "parser_field_regression"]
   },
   "tools": {
     "trackly_get_apply_queue": "{limit:z.number().int().min(1).max(100).optional(),cursor:z.string().min(1).max(2048).optional()}",
@@ -26,6 +31,10 @@
     "trackly_start_apply_execution": "{mode:z.literal('complete_next_n_accessible'),target:z.number().int().min(1).max(APPLY_EXECUTION_MAX_TARGET),idempotencyKey:z.string().min(16).max(200).regex(SAFE_IDEMPOTENCY_KEY)}",
     "trackly_get_active_apply_execution": "{}",
     "trackly_get_apply_execution": "{executionId:z.number().int().min(1)}",
+    "trackly_list_recoverable_apply_executions": "{}",
+    "trackly_recover_exact_apply_members": "{sourceExecutionId:z.number().int().min(1),sourceSnapshotHash:z.string().regex(/^[a-f0-9]{64}$/),candidateIds:z.array(z.number().int().min(1)).min(1).max(APPLY_EXECUTION_MAX_TARGET).refine((values)=>newSet(values).size===values.length,{message:'candidateIdsmustbeunique'}),explicitExactSetConfirmation:z.literal(true),idempotencyKey:z.string().min(16).max(200).regex(SAFE_IDEMPOTENCY_KEY)}",
+    "trackly_list_apply_review_handoffs": "{executionId:z.number().int().min(1)}",
+    "trackly_claim_apply_review_handoff": "{handoffId:z.number().int().min(1),members:z.array(z.object({memberId:z.number().int().min(1),classification:z.enum(APPLY_HANDOFF_RECONCILIATION_CLASSIFICATION_CODES)}).strict()).min(1).max(APPLY_EXECUTION_MAX_TARGET).refine((values)=>newSet(values.map(({memberId})=>memberId)).size===values.length,{message:'membersmustcontainuniquememberIdvalues'}),idempotencyKey:z.string().min(16).max(200).regex(SAFE_IDEMPOTENCY_KEY)}",
     "trackly_get_apply_execution_snapshot": "{executionId:z.number().int().min(1),memberIds:z.array(z.number().int().min(1)).min(1).max(APPLY_EXECUTION_MAX_TARGET),profileKeys:z.array(z.string().min(1).max(200)).max(100).optional(),browserSurface:z.enum(APPLY_BROWSER_SURFACES)}",
     "trackly_resume_parked_apply_member": "{executionId:z.number().int().min(1),memberId:z.number().int().min(1),expectedRevision:z.number().int().min(1),browserSurface:z.enum(APPLY_BROWSER_SURFACES),explicitUserResume:z.literal(true),idempotencyKey:z.string().min(16).max(200).regex(SAFE_IDEMPOTENCY_KEY)}",
     "trackly_approve_apply_execution_resume": "{executionId:z.number().int().min(1),expectedRevision:z.number().int().min(1),originalSnapshotHash:z.string().regex(/^[a-f0-9]{64}$/),profileRevision:z.number().int().min(1),resumeId:z.number().int().min(1),resumeSha256:z.string().regex(/^[a-f0-9]{64}$/),resumeFilename:z.string().min(1).max(255),resumeSizeBytes:z.number().int().min(1),expiresAt:z.string().datetime(),idempotencyKey:z.string().min(16).max(200).regex(SAFE_IDEMPOTENCY_KEY)}",
@@ -48,11 +57,13 @@
     "trackly_get_apply_protocol": "{}",
     "trackly_report_apply_observation": "{runId:z.number().int().min(1),batchId:z.number().int().min(1).optional(),memberId:z.number().int().min(1).optional(),inspectionEpoch:z.number().int().min(0).optional(),leaseToken:z.string().min(1).max(1024).optional(),provider:z.string().regex(SAFE_OBSERVATION_CODE),fieldLabel:z.string().min(1).max(1000),observationType:z.string().regex(SAFE_OBSERVATION_CODE),resolutionCode:z.string().regex(SAFE_OBSERVATION_CODE).optional(),metadata:z.object({controlType:z.string().regex(SAFE_OBSERVATION_CODE).optional(),required:z.boolean().optional(),errorCode:z.string().regex(SAFE_OBSERVATION_CODE).optional(),committed:z.boolean(),scenarioCode:z.enum(APPLY_SCENARIO_CODES),browserSurface:z.enum(APPLY_BROWSER_SURFACES),browserBindingHash:z.string().regex(/^[a-f0-9]{64}$/).optional(),resumedAfterHandoff:z.boolean().optional()})}",
     "trackly_report_apply_observations": "{observations:z.array(z.object({runId:z.number().int().min(1),batchId:z.number().int().min(1),memberId:z.number().int().min(1),inspectionEpoch:z.number().int().min(0),leaseToken:z.string().min(1).max(1024),provider:z.string().regex(SAFE_OBSERVATION_CODE),fieldLabel:z.string().min(1).max(1000),observationType:z.string().regex(SAFE_OBSERVATION_CODE),resolutionCode:z.string().regex(SAFE_OBSERVATION_CODE).optional(),metadata:z.object({controlType:z.string().regex(SAFE_OBSERVATION_CODE).optional(),required:z.boolean().optional(),errorCode:z.string().regex(SAFE_OBSERVATION_CODE).optional(),committed:z.boolean(),scenarioCode:z.enum(APPLY_SCENARIO_CODES),browserSurface:z.enum(APPLY_BROWSER_SURFACES),browserBindingHash:z.string().regex(/^[a-f0-9]{64}$/).optional(),resumedAfterHandoff:z.boolean().optional()})})).min(1).max(APPLY_BATCH_MAX_BULK_MUTATIONS)}",
-    "trackly_record_application_outcome": "{runId:z.number().int().min(1),batchId:z.number().int().min(1).optional(),memberId:z.number().int().min(1).optional(),inspectionEpoch:z.number().int().min(0).optional(),leaseToken:z.string().min(1).max(1024).optional(),outcome:z.enum(['review_ready','submitted','failed','blocked']),confirmation:z.enum(['user_confirmation','success_page']).optional()}",
-    "trackly_record_application_outcomes": "{outcomes:z.array(z.object({runId:z.number().int().min(1),batchId:z.number().int().min(1),memberId:z.number().int().min(1),inspectionEpoch:z.number().int().min(0),leaseToken:z.string().min(1).max(1024),outcome:z.enum(['review_ready','submitted','failed','blocked']),confirmation:z.enum(['user_confirmation','success_page']).optional()})).min(1).max(APPLY_BATCH_MAX_BULK_MUTATIONS)}",
+    "trackly_record_application_outcome": "{runId:z.number().int().min(1),idempotencyKey:z.string().min(16).max(200).regex(SAFE_IDEMPOTENCY_KEY),batchId:z.number().int().min(1).optional(),memberId:z.number().int().min(1).optional(),inspectionEpoch:z.number().int().min(0).optional(),leaseToken:z.string().min(1).max(1024).optional(),outcome:z.enum(['review_ready','submitted','failed','blocked']),confirmation:z.enum(['user_confirmation','success_page']).optional()}",
+    "trackly_record_application_outcomes": "{idempotencyKey:z.string().min(16).max(200).regex(SAFE_IDEMPOTENCY_KEY),outcomes:z.array(z.object({runId:z.number().int().min(1),batchId:z.number().int().min(1),memberId:z.number().int().min(1),inspectionEpoch:z.number().int().min(0),leaseToken:z.string().min(1).max(1024),outcome:z.enum(['review_ready','submitted','failed','blocked']),confirmation:z.enum(['user_confirmation','success_page']).optional()})).min(1).max(APPLY_BATCH_MAX_BULK_MUTATIONS).refine((values)=>newSet(values.map(({runId})=>runId)).size===values.length,{message:'outcomesmustcontainuniquerunIdvalues'})}",
     "trackly_prepare_resume": "{runId:z.number().int().min(1),browserSurface:z.enum(APPLY_BROWSER_SURFACES),browserBindingHash:z.string().regex(/^[a-f0-9]{64}$/)}",
     "trackly_lint_application_text": "{text:z.string().max(20000),emDashPolicy:z.enum(['forbid','allow_if_voice_sample','allow']).optional(),voiceSampleAllowsEmDash:z.boolean().optional(),prohibitedPhrases:z.array(z.string().min(1).max(200)).max(50).optional(),minLength:z.number().int().min(0).max(20000).optional(),maxLength:z.number().int().min(0).max(20000).optional(),claims:z.array(z.object({claimFingerprint:z.string().regex(/^[a-f0-9]{64}$/),evidenceRefs:z.array(z.string().regex(SAFE_OBSERVATION_CODE)).max(20)}).strict()).max(100),claimsComplete:z.literal(true)}",
     "trackly_diagnose_local_path": "{exactPath:z.string().min(1).max(4096),originalErrno:z.string().regex(ERRNO_PATTERN).optional()}",
+    "trackly_validate_apply_tab_keep_set": "{expectedTabIds:z.array(opaqueTabIdSchema).min(1).max(100),keepTabIds:z.array(opaqueTabIdSchema).max(100),controllerInventory:z.object({complete:z.boolean(),tabIds:z.array(opaqueTabIdSchema).max(1000)}).strict(),userInventory:z.object({complete:z.boolean(),tabIds:z.array(opaqueTabIdSchema).max(1000)}).strict()}",
+    "trackly_validate_apply_resume_upload": "{capabilities:z.object({semanticControlDiscovery:z.boolean(),chooserArming:z.boolean(),fileAttachment:z.boolean(),committedFilenameInspection:z.boolean(),parserFieldRecheck:z.boolean()}).strict(),events:z.array(z.object({stage:z.enum(APPLY_UPLOAD_STAGES),outcome:z.enum(['passed','failed']),failureCode:z.enum(APPLY_UPLOAD_FAILURE_CODES).optional()}).strict()).max(APPLY_UPLOAD_STAGES.length)}",
     "trackly_verify_prepared_resume": {
       "local": "{runId:z.number().int().min(1),resumeId:z.number().int().min(1),confirmationId:z.string().min(1).max(200),exactLocalPath:z.string().min(1).max(4096),sha256:z.string().regex(/^[a-f0-9]{64}$/i),sizeBytes:z.number().int().min(1),expiresAt:z.string().datetime()}",
       "hosted": "{runId:z.number().int().min(1),confirmationId:z.string().min(1).max(200)}"

package/docs/trackly-tools.md

@@ -106,6 +106,10 @@ API-key creation attempts.
 - **trackly_start_apply_execution** — Start a server-owned `complete_next_n_accessible` execution with a target from 1–20, then consume the returned authoritative `progress` and `nextAction` before doing browser work.
 - **trackly_get_active_apply_execution** — Recover the active execution before legacy batch recovery.
 - **trackly_get_apply_execution** — Read an execution's latest current-wave identity and authoritative aggregate progress funnel.
+- **trackly_list_recoverable_apply_executions** — List a bounded, value-free menu of exact recovery candidates after local context loss.
+- **trackly_recover_exact_apply_members** — Recover only the explicitly confirmed candidates from one retained source snapshot, with no substitutions.
+- **trackly_list_apply_review_handoffs** — Rediscover active, nonexpired review-handoff receipts for one execution without browser or profile values.
+- **trackly_claim_apply_review_handoff** — Claim one exact handoff receipt and classify every member before grouped submission reconciliation.
 - **trackly_get_apply_execution_snapshot**: Fetch a compact bounded projection of current members, requested profile keys, mutability, allowed operations, milestones, lease timing, and the authoritative funnel.
 - **trackly_resume_parked_apply_member**: Resume one parked member only after explicit user instruction; a fresh non-mutating access probe remains required before form mutation.
 - **trackly_approve_apply_execution_resume**: Approve one exact resume identity for an execution's unchanged original snapshot while preserving immediate per-run local verification before upload.
@@ -134,9 +138,16 @@ API-key creation attempts.
 - **trackly_verify_prepared_resume** — Local MCP only: immediately before attachment, recompute the user-confirmed resume hash and size, validate the exact path/run/expiration, and lock the file read-only. Any mismatch requires a fresh preview and confirmation.
 - **trackly_lint_application_text**: Local MCP only: require an explicitly complete claim-reference packet, then return a draft hash, length, and stable value-free writing violations without sending or echoing application text to Trackly.
 - **trackly_diagnose_local_path**: Local MCP only: measure the exact implicated path's filesystem, inode, quota observability, and write-probe result without deleting user files or claiming a global disk cause.
+- **trackly_validate_apply_tab_keep_set**: Local MCP only: fail closed unless a caller-supplied nonempty expected tab set exactly matches the keep set and is covered by complete controller and user inventories. This pure helper allows unrelated tabs, performs no browser action, and never sends tab IDs to Trackly.
+- **trackly_validate_apply_resume_upload**: Local MCP only: validate the browser adapter's capabilities and ordered, value-free attachment proof stages without opening a chooser, reading a path, controlling a browser, or sending form data to Trackly.
 
 Apply contract v3 intentionally gives this verifier different local and hosted schemas: local MCP receives the full proof needed to inspect the private file, while hosted MCP accepts only run and confirmation identifiers and returns the manual/local-agent requirement. Local paths are never sent remotely. Resume fingerprints are sent only to authenticated Trackly resume approval and truth-certification endpoints, never observations or employer forms. Version 3.1 also records universal value-free evidence for critical-contact integrity and the manual-submit boundary. Version 3.2 authorizes the exact stored HTTPS origin for jobs Trackly ingested from employer careers sources, without granting redirect, iframe, or hostname-suffix privileges. Version 3.3.1 adds active-batch recovery, epoch-bound observations/outcomes, and truth certification for forms with no resume control. Version 3.4 adds server-owned accessible executions above immutable child batches, typed access dispositions, and an authoritative target-completion funnel.
 
+Version 3.7 adds public exact-member recovery and scoped review-handoff claims,
+plus local tab-finalizer and resume-upload proof validators. Recovery candidates
+are bounded and value-free. The local helpers perform no browser actions and
+send no tab IDs, filenames, paths, page text, or form values to Trackly.
+
 ### Maintenance behavior
 
 REST, refresh, download, CLI, and local/hosted MCP surfaces use canonical `code: "maintenance_mode"`; older `planned_maintenance` responses are accepted only as a compatibility alias. Structured errors retain HTTP and service status, retry time, estimated return, and request ID without clearing valid credentials. Maintenance is resumable rather than retryable: wait for the advertised window, refetch the Apply protocol and profile, then resume the existing `agent_browser` run. Never create a duplicate run or click Submit.

package/lib/agent.js

@@ -8,13 +8,13 @@ const { spawnSync } = require('node:child_process');
 const { apiRequest, downloadFile, getConfigPaths, hasAuth, maintenanceOutput } = require('./client');
 const { version: PACKAGE_VERSION } = require('../package.json');
 const { contractVersion: MCP_CONTRACT_VERSION } = require('../contracts/trackly-apply-tools.json');
-const SKILL_VERSION = '4.4.2';
+const SKILL_VERSION = '4.5.0';
 const CLI_USER_AGENT = `trackly-cli/${PACKAGE_VERSION}`;
 const MCP_USER_AGENT = `trackly-mcp/${PACKAGE_VERSION}`;
 
 const SKILL_NAME = 'trackly-apply';
 const SKILL_MAJOR = Number(SKILL_VERSION.split('.')[0]);
-const MIN_APPLY_PROTOCOL_VERSION = '3.5.0';
+const MIN_APPLY_PROTOCOL_VERSION = '3.6.0';
 const CACHE_TTL_MS = 2 * 60 * 60 * 1000;
 const MANAGED_FILE = '.trackly-managed.json';
 const SKILL_MANIFEST_VERSION = 1;

package/lib/apply-tab-set.js

@@ -0,0 +1,124 @@
+'use strict';
+
+const APPLY_TAB_SET_FAILURE_CODES = Object.freeze({
+  CONTROLLER_INVENTORY_INCOMPLETE: 'controller_inventory_incomplete',
+  USER_INVENTORY_INCOMPLETE: 'user_inventory_incomplete',
+  EXPECTED_SET_EMPTY: 'expected_set_empty',
+  KEEP_SET_EMPTY_WITH_EXPECTED_TABS: 'keep_set_empty_with_expected_tabs',
+  DUPLICATE_EXPECTED_TAB_ID: 'duplicate_expected_tab_id',
+  DUPLICATE_KEEP_TAB_ID: 'duplicate_keep_tab_id',
+  DUPLICATE_CONTROLLER_TAB_ID: 'duplicate_controller_tab_id',
+  DUPLICATE_USER_TAB_ID: 'duplicate_user_tab_id',
+  AMBIGUOUS_CROSS_TYPE_TAB_ID: 'ambiguous_cross_type_tab_id',
+  EXPECTED_KEEP_CARDINALITY_MISMATCH: 'expected_keep_cardinality_mismatch',
+  EXPECTED_KEEP_SET_MISMATCH: 'expected_keep_set_mismatch',
+  EXPECTED_TAB_MISSING_FROM_INVENTORY_UNION: 'expected_tab_missing_from_inventory_union',
+});
+
+function canonicalizeTabId(tabId) {
+  if (typeof tabId === 'number') {
+    if (!Number.isSafeInteger(tabId)) throw new TypeError('Tab IDs supplied as numbers must be safe integers.');
+    return String(tabId);
+  }
+  if (typeof tabId !== 'string' || tabId.trim().length === 0) {
+    throw new TypeError('Tab IDs must be safe integers or nonblank opaque strings.');
+  }
+  if (tabId.length > 512) throw new RangeError('Opaque tab IDs must not exceed 512 characters.');
+  return tabId;
+}
+
+function canonicalizeTabIds(tabIds, { label, maxItems }) {
+  if (!Array.isArray(tabIds)) throw new TypeError('Tab ID collections must be arrays.');
+  if (tabIds.length > maxItems) {
+    throw new RangeError(`${label} must not contain more than ${maxItems} tab IDs.`);
+  }
+  return tabIds.map(canonicalizeTabId);
+}
+
+function hasDuplicates(tabIds) {
+  return new Set(tabIds).size !== tabIds.length;
+}
+
+function hasCrossTypeCollision(collections) {
+  const typesByCanonicalId = new Map();
+  for (const tabId of collections.flat()) {
+    const canonical = canonicalizeTabId(tabId);
+    const types = typesByCanonicalId.get(canonical) ?? new Set();
+    types.add(typeof tabId);
+    typesByCanonicalId.set(canonical, types);
+  }
+  return [...typesByCanonicalId.values()].some((types) => types.size > 1);
+}
+
+function sameSet(left, right) {
+  if (left.length !== right.length) return false;
+  const rightSet = new Set(right);
+  return left.every((tabId) => rightSet.has(tabId));
+}
+
+function validateApplyTabKeepSet({
+  expectedTabIds,
+  keepTabIds,
+  controllerInventory,
+  userInventory,
+}) {
+  const expected = canonicalizeTabIds(expectedTabIds, { label: 'expectedTabIds', maxItems: 100 });
+  const keep = canonicalizeTabIds(keepTabIds, { label: 'keepTabIds', maxItems: 100 });
+  const controller = canonicalizeTabIds(controllerInventory?.tabIds, {
+    label: 'controllerInventory.tabIds',
+    maxItems: 1000,
+  });
+  const user = canonicalizeTabIds(userInventory?.tabIds, {
+    label: 'userInventory.tabIds',
+    maxItems: 1000,
+  });
+  const failureCodes = [];
+  const addFailure = (code) => {
+    if (!failureCodes.includes(code)) failureCodes.push(code);
+  };
+
+  if (controllerInventory?.complete !== true) {
+    addFailure(APPLY_TAB_SET_FAILURE_CODES.CONTROLLER_INVENTORY_INCOMPLETE);
+  }
+  if (userInventory?.complete !== true) {
+    addFailure(APPLY_TAB_SET_FAILURE_CODES.USER_INVENTORY_INCOMPLETE);
+  }
+  if (expected.length === 0) addFailure(APPLY_TAB_SET_FAILURE_CODES.EXPECTED_SET_EMPTY);
+  if (expected.length > 0 && keep.length === 0) {
+    addFailure(APPLY_TAB_SET_FAILURE_CODES.KEEP_SET_EMPTY_WITH_EXPECTED_TABS);
+  }
+  if (hasDuplicates(expected)) addFailure(APPLY_TAB_SET_FAILURE_CODES.DUPLICATE_EXPECTED_TAB_ID);
+  if (hasDuplicates(keep)) addFailure(APPLY_TAB_SET_FAILURE_CODES.DUPLICATE_KEEP_TAB_ID);
+  if (hasDuplicates(controller)) addFailure(APPLY_TAB_SET_FAILURE_CODES.DUPLICATE_CONTROLLER_TAB_ID);
+  if (hasDuplicates(user)) addFailure(APPLY_TAB_SET_FAILURE_CODES.DUPLICATE_USER_TAB_ID);
+  if (hasCrossTypeCollision([
+    expectedTabIds, keepTabIds, controllerInventory.tabIds, userInventory.tabIds,
+  ])) addFailure(APPLY_TAB_SET_FAILURE_CODES.AMBIGUOUS_CROSS_TYPE_TAB_ID);
+  if (expected.length !== keep.length) {
+    addFailure(APPLY_TAB_SET_FAILURE_CODES.EXPECTED_KEEP_CARDINALITY_MISMATCH);
+  }
+  if (!sameSet(expected, keep)) addFailure(APPLY_TAB_SET_FAILURE_CODES.EXPECTED_KEEP_SET_MISMATCH);
+
+  const inventoryUnion = new Set([...controller, ...user]);
+  if (expected.some((tabId) => !inventoryUnion.has(tabId))) {
+    addFailure(APPLY_TAB_SET_FAILURE_CODES.EXPECTED_TAB_MISSING_FROM_INVENTORY_UNION);
+  }
+
+  const safeToFinalize = failureCodes.length === 0;
+  return {
+    safeToFinalize,
+    failureCodes,
+    expectedCount: expected.length,
+    keepCount: keep.length,
+    controllerInventoryCount: controller.length,
+    userInventoryCount: user.length,
+    inventoryUnionCount: inventoryUnion.size,
+    canonicalKeepTabIds: safeToFinalize ? keep : [],
+  };
+}
+
+module.exports = {
+  APPLY_TAB_SET_FAILURE_CODES,
+  canonicalizeTabId,
+  validateApplyTabKeepSet,
+};

package/lib/apply-upload.js

@@ -0,0 +1,66 @@
+'use strict';
+
+const APPLY_CONTRACT = require('../contracts/trackly-apply-tools.json');
+
+const APPLY_UPLOAD_STAGES = Object.freeze([...APPLY_CONTRACT.constants.applyUploadStages]);
+const APPLY_UPLOAD_FAILURE_CODES = Object.freeze([
+  ...APPLY_CONTRACT.constants.applyUploadFailureCodes,
+]);
+const APPLY_UPLOAD_CAPABILITIES = Object.freeze([
+  'semanticControlDiscovery',
+  'chooserArming',
+  'fileAttachment',
+  'committedFilenameInspection',
+  'parserFieldRecheck',
+]);
+
+function validateApplyResumeUpload({ capabilities, events }) {
+  const failureCodes = [];
+  const seen = new Set();
+  let expectedIndex = 0;
+  let lastPassedStage = null;
+
+  for (const capability of APPLY_UPLOAD_CAPABILITIES) {
+    if (capabilities[capability] !== true) failureCodes.push('upload_capability_unavailable');
+  }
+
+  for (const event of events) {
+    if (seen.has(event.stage)) {
+      failureCodes.push('upload_stage_duplicate');
+      continue;
+    }
+    seen.add(event.stage);
+    const index = APPLY_UPLOAD_STAGES.indexOf(event.stage);
+    const isExpectedStage = index === expectedIndex;
+    if (!isExpectedStage) failureCodes.push('upload_stage_out_of_order');
+
+    const hasFailureCode = Boolean(event.failureCode);
+    if (hasFailureCode) {
+      failureCodes.push(event.failureCode);
+    }
+
+    if (event.outcome === 'failed' || hasFailureCode) {
+      if (!event.failureCode) failureCodes.push('upload_stage_missing');
+    } else if (isExpectedStage) {
+      expectedIndex += 1;
+      lastPassedStage = event.stage;
+    }
+  }
+
+  if (expectedIndex !== APPLY_UPLOAD_STAGES.length) failureCodes.push('upload_stage_missing');
+  const uniqueFailureCodes = [...new Set(failureCodes)];
+  return {
+    safeToClaimAttachment: uniqueFailureCodes.length === 0,
+    failureCodes: uniqueFailureCodes,
+    lastPassedStage,
+    completedStageCount: expectedIndex,
+    requiredStageCount: APPLY_UPLOAD_STAGES.length,
+  };
+}
+
+module.exports = {
+  APPLY_UPLOAD_CAPABILITIES,
+  APPLY_UPLOAD_FAILURE_CODES,
+  APPLY_UPLOAD_STAGES,
+  validateApplyResumeUpload,
+};

package/mcp/apply-tools.js

@@ -5,6 +5,12 @@ const { apiRequest } = require('../lib/client');
 const { prepareResume, verifyPreparedResume } = require('../lib/agent');
 const { lintApplicationText } = require('../lib/application-text');
 const { diagnoseLocalPath, ERRNO_PATTERN } = require('../lib/path-diagnostics');
+const { validateApplyTabKeepSet } = require('../lib/apply-tab-set');
+const {
+  APPLY_UPLOAD_FAILURE_CODES,
+  APPLY_UPLOAD_STAGES,
+  validateApplyResumeUpload,
+} = require('../lib/apply-upload');
 const { isIso3166Alpha2 } = require('../lib/iso-country-codes');
 const APPLY_CONTRACT = require('../contracts/trackly-apply-tools.json');
 
@@ -22,6 +28,8 @@ const APPLY_SURFACE_EVIDENCE_TYPES = APPLY_CONTRACT.constants.applySurfaceEviden
 const APPLY_SURFACE_OWNERSHIP_STATES = APPLY_CONTRACT.constants.applySurfaceOwnershipStates;
 const APPLY_SUBMISSION_EVIDENCE_TYPES = APPLY_CONTRACT.constants.applySubmissionEvidenceTypes;
 const APPLY_SUBMISSION_EVIDENCE_SOURCES = APPLY_CONTRACT.constants.applySubmissionEvidenceSources;
+const APPLY_EXECUTION_RECOVERY_ELIGIBILITY_CODES = APPLY_CONTRACT.constants.applyExecutionRecoveryEligibilityCodes;
+const APPLY_HANDOFF_RECONCILIATION_CLASSIFICATION_CODES = APPLY_CONTRACT.constants.applyHandoffReconciliationClassifications;
 const APPLY_BATCH_MAX_MEMBERS = 100;
 const APPLY_BATCH_MAX_CHECKPOINTS_PER_REQUEST = 20;
 const APPLY_BATCH_MAX_ACTIONS_PER_CHECKPOINT = 25;
@@ -32,6 +40,12 @@ const SAFE_IDEMPOTENCY_KEY = /^[\x20-\x7e]+$/;
 const iso3166Alpha2Schema = z.string().regex(/^[A-Za-z]{2}$/).refine(isIso3166Alpha2, {
   message: 'Expected an ISO 3166-1 alpha-2 country code',
 });
+const opaqueTabIdSchema = z.union([
+  z.number().int().safe(),
+  z.string().min(1).max(512).refine((value) => value.trim().length > 0, {
+    message: 'Expected a nonblank opaque tab ID',
+  }),
+]);
 const applyExecutionDispositionSchema = z.object({
   jobId: z.number().int().min(1),
   classification: z.enum(APPLY_EXECUTION_ACCESS_CLASSIFICATIONS),
@@ -44,6 +58,133 @@ const applyExecutionDispositionSchema = z.object({
   probeOnlyNoDraft: z.boolean().optional(),
   browserSurface: z.enum(APPLY_BROWSER_SURFACES),
 }).strict();
+const recoverableCandidateSchema = z.object({
+  candidateId: z.number().int().min(1),
+  jobId: z.number().int().min(1),
+  queuePosition: z.number().int().min(0),
+  eligibilityCode: z.enum(APPLY_EXECUTION_RECOVERY_ELIGIBILITY_CODES),
+}).strict();
+const recoverableExecutionSourceSchema = z.object({
+  sourceExecutionId: z.number().int().min(1),
+  sourceSnapshotHash: z.string().regex(/^[a-f0-9]{64}$/),
+  recoverableUntil: z.string().datetime(),
+  candidates: z.array(recoverableCandidateSchema).max(APPLY_EXECUTION_MAX_TARGET),
+}).strict().refine(({ candidates }) => (
+  new Set(candidates.map(({ candidateId }) => candidateId)).size === candidates.length
+), { message: 'recoverable source candidate IDs must be unique' });
+const recoverableExecutionsResponseSchema = z.object({
+  success: z.literal(true),
+  sources: z.array(recoverableExecutionSourceSchema).max(APPLY_EXECUTION_MAX_TARGET),
+}).strict().refine(({ sources }) => (
+  new Set(sources.map(({ sourceExecutionId }) => sourceExecutionId)).size === sources.length
+), { message: 'recoverable source execution IDs must be unique' });
+// Discovery responses are strict and value-free so unexpected fields never enter agent context.
+// Mutation responses permit additive top-level metadata, but keep safety-critical nested rows strict.
+const exactRecoveryResponseSchema = z.object({
+  success: z.literal(true),
+  replay: z.boolean(),
+  execution: z.object({
+    id: z.number().int().min(1),
+    mode: z.literal('recover_exact_members'),
+  }).passthrough(),
+  assertedCandidateIds: z.array(z.number().int().min(1)).max(APPLY_EXECUTION_MAX_TARGET),
+  eligibleCandidateIds: z.array(z.number().int().min(1)).max(APPLY_EXECUTION_MAX_TARGET),
+  eligibility: z.array(recoverableCandidateSchema).max(APPLY_EXECUTION_MAX_TARGET),
+}).passthrough();
+
+function validateExactRecoveryResponse(input, response) {
+  const requested = [...input.candidateIds].sort((a, b) => a - b);
+  const asserted = [...response.assertedCandidateIds].sort((a, b) => a - b);
+  const eligible = [...response.eligibleCandidateIds].sort((a, b) => a - b);
+  const eligibilityIds = response.eligibility
+    .map(({ candidateId }) => candidateId)
+    .sort((a, b) => a - b);
+  const matchesRequested = (values) => (
+    values.length === requested.length
+    && values.every((value, index) => value === requested[index])
+  );
+  if (
+    new Set(response.assertedCandidateIds).size !== response.assertedCandidateIds.length
+    || new Set(response.eligibleCandidateIds).size !== response.eligibleCandidateIds.length
+    || new Set(eligibilityIds).size !== eligibilityIds.length
+    || !matchesRequested(asserted)
+    || !matchesRequested(eligible)
+    || !matchesRequested(eligibilityIds)
+    || response.eligibility.some(({ eligibilityCode }) => eligibilityCode !== 'recoverable')
+  ) {
+    throw new Error('Exact recovery response does not match the requested candidate set.');
+  }
+  return response;
+}
+const handoffClaimMemberSchema = z.object({
+  memberId: z.number().int().min(1),
+  classification: z.enum(APPLY_HANDOFF_RECONCILIATION_CLASSIFICATION_CODES),
+}).strict();
+const handoffMemberSchema = z.object({
+  handoffId: z.number().int().min(1),
+  ordinal: z.number().int().min(0),
+  batchId: z.number().int().min(1),
+  memberId: z.number().int().min(1),
+  runId: z.number().int().min(1),
+  memberVersion: z.number().int().min(1),
+  inspectionEpoch: z.number().int().min(0),
+  reconciliationClassification: z.enum(APPLY_HANDOFF_RECONCILIATION_CLASSIFICATION_CODES).nullable(),
+  reconciliationResultStatus: z.string().max(100).nullable(),
+}).strict();
+const handoffListResponseSchema = z.object({
+  success: z.literal(true),
+  executionId: z.number().int().min(1),
+  handoffs: z.array(z.object({
+    id: z.number().int().min(1),
+    executionId: z.number().int().min(1),
+    orderedMemberSetHash: z.string().regex(/^[a-f0-9]{64}$/),
+    generation: z.number().int().min(1),
+    status: z.enum(['active', 'partially_reconciled']),
+    claimedAt: z.string().datetime().nullable(),
+    expiresAt: z.string().datetime(),
+    members: z.array(handoffMemberSchema).min(1).max(APPLY_EXECUTION_MAX_TARGET),
+  }).strict()).max(APPLY_EXECUTION_MAX_TARGET),
+}).strict();
+
+function validateHandoffListResponse(requestedExecutionId, response) {
+  const handoffIds = response.handoffs.map(({ id }) => id);
+  if (
+    response.executionId !== requestedExecutionId
+    || new Set(handoffIds).size !== handoffIds.length
+    || response.handoffs.some((handoff) => (
+      handoff.executionId !== requestedExecutionId
+      || new Set(handoff.members.map(({ memberId }) => memberId)).size !== handoff.members.length
+      || handoff.members.some((member) => member.handoffId !== handoff.id)
+    ))
+  ) {
+    throw new Error('Review handoff response does not match the requested execution and receipt bindings.');
+  }
+  return response;
+}
+const handoffClaimResponseSchema = z.object({
+  success: z.literal(true),
+  handoffId: z.number().int().min(1),
+  executionId: z.number().int().min(1),
+  orderedMemberSetHash: z.string().regex(/^[a-f0-9]{64}$/),
+  members: z.array(handoffClaimMemberSchema).min(1).max(APPLY_EXECUTION_MAX_TARGET),
+  transition: z.literal('claimed'),
+}).passthrough();
+
+function validateHandoffClaimResponse(request, response) {
+  const requestedMembers = request.members.map(({ memberId, classification }) => `${memberId}:${classification}`);
+  const returnedMembers = response.members.map(({ memberId, classification }) => `${memberId}:${classification}`);
+  if (
+    response.handoffId !== request.handoffId
+    || response.executionId !== request.executionId
+    || response.orderedMemberSetHash !== request.orderedMemberSetHash
+    || new Set(returnedMembers).size !== returnedMembers.length
+    || requestedMembers.length !== returnedMembers.length
+    || !requestedMembers.every((member) => returnedMembers.includes(member))
+  ) {
+    throw new Error('Handoff claim response does not match the requested handoff and member classifications.');
+  }
+  return response;
+}
 
 const truthCertificationCommon = {
   batchId: z.number().int().min(1),
@@ -121,7 +262,7 @@ const startApplyRunSchema = z.object({
   }
 });
 
-const APPLY_RELIABILITY_PROMPT = 'Protocol 3.5 / skill 4.4.2 reliability gate: only active=true identifies resumable execution work. A response with active=false and preserved=true is terminal read-only reconciliation evidence. Require nextAction=none and never fetch its compact snapshot, continue an unresolved wave, mutate a member, or interpret historical funnel counts as current work. For an active execution recovery or start, fetch one compact execution snapshot with only the current member IDs and profile keys required by the visible forms. Treat mutable and allowedOperations as authoritative. Never reopen or mutate authentication, account-creation, OTP, pre-form-CAPTCHA, or manual-only members. Only an explicit user request may call trackly_resume_parked_apply_member, and the returned member still requires a fresh non-mutating access probe. Use execution-scoped exact-resume content approval across unchanged replacement waves, but immediately verify the exact local path, hash, size, run binding, and expiration before every upload. Run trackly_lint_application_text before entering free text and fail closed on every violation or unsupported claim. Reconcile every newly supplied reusable answer to the canonical profile before review: save it, confirm it already matches, or report a schema gap. Never create app-shell tabs to reveal an already-bound browser tab without an exact focus receipt. Diagnose I/O errors only against the exact implicated path. Report the server funnel and durable milestone after every state change and at least once every 60 seconds during active work. Never click Submit.';
+const APPLY_RELIABILITY_PROMPT = 'Protocol 3.6 / skill 4.5.0 reliability gate: recover active work first. After full local context loss, list recoverable executions, show only stable job identity, obtain explicit confirmation of the exact candidate set, and call exact-member recovery without substitutions. Treat recovered tab presence, form state, and mutation authority as three separate facts; reacquire a fresh browser binding and inspection epoch before mutation. Before resolving broad submission statements, list active review handoffs for the execution; use only an explicit receipt or the sole returned active receipt, classify every member as detected, user_confirmed, unresolved, or contradictory, and claim that exact handoff before writing outcomes. Use provider-specific positive success evidence; an unchanged URL or title is never negative evidence. Validate an exact expected browser keep set locally before finalization. For resume uploads, negotiate the browser surface capabilities, identify the semantic control, arm the chooser before clicking, attach the immediately verified file, prove the user-facing filename committed, and recheck parser-modified fields. Use compact snapshots and server-provided mutability. Preserve user-edited and unknown non-empty fields. Never reopen parked work without explicit user resumption. Never click Submit.';
 
 function registerApplyTools(
   server,
@@ -143,6 +284,8 @@ function registerApplyTools(
       idempotencyKey ? { 'Idempotency-Key': idempotencyKey } : undefined,
     )
   );
+  const discoveredHandoffBindings = new Map();
+  const discoveredHandoffIdsByExecution = new Map();
   server.tool(
     'trackly_get_apply_queue',
     'Get the deterministic queue of jobs the user already approved by saving as check later. Do not rescore or veto these jobs.',
@@ -271,6 +414,101 @@ function registerApplyTools(
     ), 'Failed to fetch apply execution')
   );
 
+  server.tool(
+    'trackly_list_recoverable_apply_executions',
+    'List bounded, value-free exact-member recovery candidates after local context loss. Show the stable job identities to the user and obtain explicit confirmation before recovery; never infer or substitute candidates.',
+    {},
+    wrapTool(async () => recoverableExecutionsResponseSchema.parse(await applyControlRequest(
+      'GET', '/api/jobscout/apply/executions/recoverable',
+    )), 'Failed to list recoverable apply executions')
+  );
+
+  server.tool(
+    'trackly_recover_exact_apply_members',
+    'Create an exact-member recovery execution from one confirmed source snapshot. The asserted candidate set is immutable and replacements are forbidden.',
+    {
+      sourceExecutionId: z.number().int().min(1),
+      sourceSnapshotHash: z.string().regex(/^[a-f0-9]{64}$/),
+      candidateIds: z.array(z.number().int().min(1)).min(1).max(APPLY_EXECUTION_MAX_TARGET)
+        .refine((values) => new Set(values).size === values.length, {
+          message: 'candidateIds must be unique',
+        }),
+      explicitExactSetConfirmation: z.literal(true),
+      idempotencyKey: z.string().min(16).max(200).regex(SAFE_IDEMPOTENCY_KEY),
+    },
+    wrapTool(async ({ idempotencyKey, ...input }) => validateExactRecoveryResponse(
+      input,
+      exactRecoveryResponseSchema.parse(await applyControlRequest('POST', '/api/jobscout/apply/executions/recover', {
+        mode: 'recover_exact_members',
+        ...input,
+      }, idempotencyKey)),
+    ), 'Failed to recover exact apply members')
+  );
+
+  server.tool(
+    'trackly_list_apply_review_handoffs',
+    'List active, nonexpired review-handoff receipts for one execution after context loss. Returns only stable IDs, lifecycle metadata, and member bindings; never browser values, URLs, or local paths.',
+    { executionId: z.number().int().min(1) },
+    wrapTool(async ({ executionId }) => {
+      const response = validateHandoffListResponse(
+        executionId,
+        handoffListResponseSchema.parse(await applyControlRequest(
+        'GET', `/api/jobscout/apply/executions/${executionId}/review-handoffs`,
+        )),
+      );
+      for (const handoffId of discoveredHandoffIdsByExecution.get(executionId) || []) {
+        discoveredHandoffBindings.delete(handoffId);
+      }
+      const discoveredHandoffIds = new Set();
+      for (const handoff of response.handoffs) {
+        discoveredHandoffBindings.set(handoff.id, {
+          executionId: handoff.executionId,
+          orderedMemberSetHash: handoff.orderedMemberSetHash,
+          memberIds: handoff.members.map(({ memberId }) => memberId),
+        });
+        discoveredHandoffIds.add(handoff.id);
+      }
+      discoveredHandoffIdsByExecution.set(executionId, discoveredHandoffIds);
+      return response;
+    }, 'Failed to list apply review handoffs')
+  );
+
+  server.tool(
+    'trackly_claim_apply_review_handoff',
+    'Claim one exact, unambiguous review-handoff group and classify every member before grouped submission reconciliation. Never use this tool to infer submission or replace success-page evidence or explicit user confirmation.',
+    {
+      handoffId: z.number().int().min(1),
+      members: z.array(z.object({
+        memberId: z.number().int().min(1),
+        classification: z.enum(APPLY_HANDOFF_RECONCILIATION_CLASSIFICATION_CODES),
+      }).strict()).min(1).max(APPLY_EXECUTION_MAX_TARGET)
+        .refine((values) => new Set(values.map(({ memberId }) => memberId)).size === values.length, {
+          message: 'members must contain unique memberId values',
+        }),
+      idempotencyKey: z.string().min(16).max(200).regex(SAFE_IDEMPOTENCY_KEY),
+    },
+    wrapTool(async ({ handoffId, idempotencyKey, members }) => {
+      const binding = discoveredHandoffBindings.get(handoffId);
+      if (!binding) {
+        throw new Error('Review handoff must be selected from the latest discovery response.');
+      }
+      const { memberIds, ...receiptBinding } = binding;
+      const requestedMemberIds = new Set(members.map(({ memberId }) => memberId));
+      if (
+        requestedMemberIds.size !== memberIds.length
+        || memberIds.some((memberId) => !requestedMemberIds.has(memberId))
+      ) {
+        throw new Error('Handoff claim must classify every discovered member exactly once.');
+      }
+      return validateHandoffClaimResponse(
+        { handoffId, members, ...receiptBinding },
+        handoffClaimResponseSchema.parse(await applyControlRequest(
+        'POST', `/api/jobscout/apply/review-handoffs/${handoffId}/claim`, { members }, idempotencyKey,
+        )),
+      );
+    }, 'Failed to claim apply review handoff')
+  );
+
   server.tool(
     'trackly_get_apply_execution_snapshot',
     'Fetch a compact, bounded projection for one Apply execution. Request only the current members and profile keys needed for the visible form. The response owns mutability, allowed operations, milestones, lease timing, and progress.',
@@ -757,6 +995,7 @@ function registerApplyTools(
     'Record review readiness or a user-confirmed outcome. Before handoff use literal outcome=review_ready and verify awaiting_manual_submit. Mark submitted with literal outcome=submitted only after a success page or explicit user confirmation.',
     {
       runId: z.number().int().min(1),
+      idempotencyKey: z.string().min(16).max(200).regex(SAFE_IDEMPOTENCY_KEY),
       batchId: z.number().int().min(1).optional(),
       memberId: z.number().int().min(1).optional(),
       inspectionEpoch: z.number().int().min(0).optional(),
@@ -764,13 +1003,19 @@ function registerApplyTools(
       outcome: z.enum(['review_ready', 'submitted', 'failed', 'blocked']),
       confirmation: z.enum(['user_confirmation', 'success_page']).optional(),
     },
-    wrapTool(async ({ runId, ...body }) => apiRequest('POST', `/api/jobscout/apply/runs/${runId}/outcome`, body, false, false, MCP_USER_AGENT), 'Failed to record application outcome')
+    wrapTool(async ({ runId, idempotencyKey, ...body }) => applyControlRequest(
+      'POST',
+      `/api/jobscout/apply/runs/${runId}/outcome`,
+      body,
+      idempotencyKey
+    ), 'Failed to record application outcome')
   );
 
   server.tool(
     'trackly_record_application_outcomes',
     'Bulk-record up to 20 leased, batch-bound review or user-confirmed outcomes. Before handoff every item uses literal outcome=review_ready and every recorded run must return awaiting_manual_submit. After manual confirmation use literal outcome=submitted. Each member returns recorded or a stable conflict without hiding sibling results.',
     {
+      idempotencyKey: z.string().min(16).max(200).regex(SAFE_IDEMPOTENCY_KEY),
       outcomes: z.array(z.object({
         runId: z.number().int().min(1),
         batchId: z.number().int().min(1),
@@ -779,16 +1024,17 @@ function registerApplyTools(
         leaseToken: z.string().min(1).max(1024),
         outcome: z.enum(['review_ready', 'submitted', 'failed', 'blocked']),
         confirmation: z.enum(['user_confirmation', 'success_page']).optional(),
-      })).min(1).max(APPLY_BATCH_MAX_BULK_MUTATIONS),
+      })).min(1).max(APPLY_BATCH_MAX_BULK_MUTATIONS).refine(
+        (values) => new Set(values.map(({ runId }) => runId)).size === values.length,
+        { message: 'outcomes must contain unique runId values' }
+      ),
     },
     wrapTool(
-      async (params) => apiRequest(
+      async ({ idempotencyKey, ...params }) => applyControlRequest(
         'POST',
         '/api/jobscout/apply/outcomes/bulk',
         params,
-        false,
-        false,
-        MCP_USER_AGENT
+        idempotencyKey
       ),
       'Failed to record bulk application outcomes'
     )
@@ -835,6 +1081,44 @@ function registerApplyTools(
     wrapTool(async ({ exactPath, originalErrno }) => diagnoseLocalPath(exactPath, { originalErrno }), 'Local path diagnosis failed')
   );
 
+  server.tool(
+    'trackly_validate_apply_tab_keep_set',
+    'Locally validate a caller-supplied session-finalizer keep set against complete controller and user tab inventories. This pure helper never enumerates, focuses, closes, hands off, or finalizes browser tabs and never sends tab IDs to Trackly.',
+    {
+      expectedTabIds: z.array(opaqueTabIdSchema).min(1).max(100),
+      keepTabIds: z.array(opaqueTabIdSchema).max(100),
+      controllerInventory: z.object({
+        complete: z.boolean(),
+        tabIds: z.array(opaqueTabIdSchema).max(1000),
+      }).strict(),
+      userInventory: z.object({
+        complete: z.boolean(),
+        tabIds: z.array(opaqueTabIdSchema).max(1000),
+      }).strict(),
+    },
+    wrapTool(async (params) => validateApplyTabKeepSet(params), 'Apply tab keep-set validation failed')
+  );
+
+  server.tool(
+    'trackly_validate_apply_resume_upload',
+    'Locally validate the browser adapter capabilities and ordered, value-free proof stages required to claim one resume attachment. This helper does not open a chooser, read a local path, control the browser, or send values to Trackly.',
+    {
+      capabilities: z.object({
+        semanticControlDiscovery: z.boolean(),
+        chooserArming: z.boolean(),
+        fileAttachment: z.boolean(),
+        committedFilenameInspection: z.boolean(),
+        parserFieldRecheck: z.boolean(),
+      }).strict(),
+      events: z.array(z.object({
+        stage: z.enum(APPLY_UPLOAD_STAGES),
+        outcome: z.enum(['passed', 'failed']),
+        failureCode: z.enum(APPLY_UPLOAD_FAILURE_CODES).optional(),
+      }).strict()).max(APPLY_UPLOAD_STAGES.length),
+    },
+    wrapTool(async (params) => validateApplyResumeUpload(params), 'Apply resume upload validation failed')
+  );
+
   server.tool(
     'trackly_verify_prepared_resume',
     'Immediately before attachment, recompute the prepared resume fingerprint, validate its run and expiration, and lock the confirmed file read-only.',
@@ -857,11 +1141,20 @@ function registerApplyTools(
     messages: [{
       role: 'user',
       content: { type: 'text', text: APPLY_RELIABILITY_PROMPT },
+    }, {
+      role: 'user',
+      content: { type: 'text', text: 'Only active=true identifies resumable execution work. Active=false and preserved=true is terminal read-only reconciliation evidence.' },
+    }, {
+      role: 'user',
+      content: {
+        type: 'text',
+        text: 'Protocol 3.6.0 reliability gate for new work: require MCP contract 3.7.1 and skill 4.5.0. After complete local context loss, list bounded recovery candidates, obtain explicit confirmation of the exact set, and recover only that set. Treat tab recovery, form-state recovery, and mutation authority as independent. List active handoff receipts for the execution before resolving grouped submission statements; use the named receipt or the sole returned active receipt, classify every member, and claim that receipt before recording outcomes. Validate tab keep sets and resume upload stages locally. Never send raw browser values or click Submit.',
+      },
     }, {
       role: 'user',
       content: {
         type: 'text',
-        text: 'Protocol 3.5.0 reliability gate: require the fetched compatibleSkillMinimumVersion or newer for new execution work. Read the Apply protocol first. Only protocol 3.5 or newer with the compact-snapshot capability may call trackly_get_apply_execution_snapshot or the parked-member resume and execution-resume approval tools. An already-active protocol 3.4 execution is read-only legacy recovery: use only its published get or stop tools and never mutate its browser forms. Only when the fetched protocol is 3.4 or newer call trackly_get_active_apply_execution before legacy batch recovery, including when accessible execution is disabled. For protocol 3.3, skip the execution endpoint and recover the already-active immutable fixed batch directly; protocol 3.2 remains valid only for an already-active explicit legacy single run. A disabled rollout may preserve an active execution: recover it read-only and use only get or stop tools until the capability is enabled; never start, advance, or record dispositions while disabled. If disabled and no execution is active, use the legacy fixed-batch path. Recover every entry in execution.unresolvedWaves in ascending waveOrder; an older unresolved wave remains part of recovery after a replacement wave exists, and execution.currentWave is only the latest scheduling identity, never the complete recovery set. For “fill/apply to the next N,” recover or start one complete_next_n_accessible execution with target 1–20 and follow only the server nextAction and authoritative funnel. If the requested N differs from the active target, explain the mismatch, obtain explicit confirmation, stop the old execution with reason target_changed, refetch its terminal state, then start the new target. If an immutable fixed batch is active when the user requests complete_next_n_accessible, explain the incompatible mode and summarize any review-ready, submitted, or unresolved work before browser mutation. Resume that exact fixed batch when the user chooses to finish it. If the user instead says to start fresh, leave, replace, discard, or otherwise abandon the old batch, treat that statement as explicit cancellation confirmation: refetch the latest batch revision, call trackly_cancel_apply_batch with reason user_requested_restart and a fresh idempotency key, refetch until no active fixed batch remains, preserve every existing browser tab without mutation, and start the requested accessible execution in the same turn. Never wait for batch expiry and never create a scheduled continuation merely to escape an obsolete batch. If cancellation reports submission_in_progress, preserve everything and stop for the user; do not cancel or start replacement work. If the user asks to stop, call trackly_stop_apply_execution with reason user_requested and refetch its terminal state. Continue immutable child waves from the original recent-first snapshot until durablyReviewReady plus submitted reaches target, the queue is exhausted, or the user stops. Accessible drafts awaiting answers and forms currently being filled occupy target slots; authentication, account creation, OTP, pre-form CAPTCHA, exclusions, manual-only, conflicts, and revocations do not. Record only typed value-free live-probe dispositions. Advance only when no current-wave member remains unclassified queued or inspecting. Never calculate replacements or progress locally. For an explicit “inspect the next N records” request, use the existing fixed immutable batch and never replenish it; if a different accessible execution is active, confirm the intent change with the user, stop that execution with reason target_changed, refetch its terminal state, then recover or create the fixed batch. A cache hint may prioritize a live minimal non-mutating probe but never authorizes private-data entry or replaces that probe. After a redirect or contradictory observation, report only the fresh live disposition with its exact binding and let the backend invalidate its own hint. Preserve every user-edited or unknown non-empty field through the local provenance ledger. Never submit.',
+        text: 'Legacy protocol compatibility gate: require the fetched compatibleSkillMinimumVersion or newer for all new work and use protocol 3.6.0 as specified above. Read the Apply protocol first. Only protocol 3.5 or newer with the compact-snapshot capability may call trackly_get_apply_execution_snapshot or the parked-member resume and execution-resume approval tools. An already-active protocol 3.4 execution is read-only legacy recovery: use only its published get or stop tools and never mutate its browser forms. Only when the fetched protocol is 3.4 or newer call trackly_get_active_apply_execution before legacy batch recovery, including when accessible execution is disabled. For protocol 3.3, skip the execution endpoint and recover the already-active immutable fixed batch directly; protocol 3.2 remains valid only for an already-active explicit legacy single run. A disabled rollout may preserve an active execution: recover it read-only and use only get or stop tools until the capability is enabled; never start, advance, or record dispositions while disabled. If disabled and no execution is active, use the legacy fixed-batch path. Recover every entry in execution.unresolvedWaves in ascending waveOrder; an older unresolved wave remains part of recovery after a replacement wave exists, and execution.currentWave is only the latest scheduling identity, never the complete recovery set. For “fill/apply to the next N,” recover or start one complete_next_n_accessible execution with target 1–20 and follow only the server nextAction and authoritative funnel. If the requested N differs from the active target, explain the mismatch, obtain explicit confirmation, stop the old execution with reason target_changed, refetch its terminal state, then start the new target. If an immutable fixed batch is active when the user requests complete_next_n_accessible, explain the incompatible mode and summarize any review-ready, submitted, or unresolved work before browser mutation. Resume that exact fixed batch when the user chooses to finish it. If the user instead says to start fresh, leave, replace, discard, or otherwise abandon the old batch, treat that statement as explicit cancellation confirmation: refetch the latest batch revision, call trackly_cancel_apply_batch with reason user_requested_restart and a fresh idempotency key, refetch until no active fixed batch remains, preserve every existing browser tab without mutation, and start the requested accessible execution in the same turn. Never wait for batch expiry and never create a scheduled continuation merely to escape an obsolete batch. If cancellation reports submission_in_progress, preserve everything and stop for the user; do not cancel or start replacement work. If the user asks to stop, call trackly_stop_apply_execution with reason user_requested and refetch its terminal state. Continue immutable child waves from the original recent-first snapshot until the authoritative backend funnel says targetReached, the queue is exhausted, or the user stops. Treat achievementCount and target-capped completed as the cumulative target authority. durablyReviewReady and submitted are current operator projections only; never add them together locally to reconstruct completion. Accessible drafts awaiting answers and forms currently being filled occupy target slots; authentication, account creation, OTP, pre-form CAPTCHA, exclusions, manual-only, conflicts, and revocations do not. Record only typed value-free live-probe dispositions. Advance only when no current-wave member remains unclassified queued or inspecting. Never calculate replacements or progress locally. For an explicit “inspect the next N records” request, use the existing fixed immutable batch and never replenish it; if a different accessible execution is active, confirm the intent change with the user, stop that execution with reason target_changed, refetch its terminal state, then recover or create the fixed batch. A cache hint may prioritize a live minimal non-mutating probe but never authorizes private-data entry or replaces that probe. After a redirect or contradictory observation, report only the fresh live disposition with its exact binding and let the backend invalidate its own hint. Preserve every user-edited or unknown non-empty field through the local provenance ledger. Never submit.',
       },
     }, {
       role: 'user',

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "trackly-cli",
-  "version": "0.13.4",
+  "version": "0.14.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "trackly-cli",
-      "version": "0.13.4",
+      "version": "0.14.0",
       "license": "MIT",
       "dependencies": {
         "@modelcontextprotocol/sdk": "1.30.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trackly-cli",
-  "version": "0.13.4",
+  "version": "0.14.0",
   "mcpName": "io.github.trackly-app/trackly",
   "description": "AI job search CLI + hosted MCP server with OAuth. 170K+ jobs, 3,800+ companies, 40+ ATS. Works with Claude, ChatGPT, Cursor, Windsurf, Codex via hosted streamable-http or local stdio.",
   "bin": {

package/server.json

@@ -17,12 +17,12 @@
       ]
     }
   ],
-  "version": "0.13.4",
+  "version": "0.14.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "trackly-cli",
-      "version": "0.13.4",
+      "version": "0.14.0",
       "runtimeHint": "npx",
       "runtimeArguments": [
         {

package/skills/trackly-apply/SKILL.md

@@ -27,7 +27,7 @@ references define the server-frozen batch, grouped-question, tab-reconciliation,
 and missing-surface recovery contract; they are mandatory even for a one-job batch.
 Read [references/legal-clarifications.md](references/legal-clarifications.md) when a form asks for a legal, regulatory, consent, or employer-relationship decision.
 
-1. Call `trackly_get_apply_protocol`. Skill 4.4.2 requires protocol 3.5.0 or newer for new reliability work. Protocol 3.2 remains valid only for an already-active explicit legacy single run; an already-active explicit 3.2 single run may finish through its legacy path. Preserve the protocol's documented recovery paths for already-active older work. Require `compatibleSkillMajor: 4` and `compatibleSkillMinimumVersion` no newer than this installed skill. Reject an older or incompatible version for new work and report that the backend must finish updating or `trackly agent setup` must update the skill. Protocol 3.2 added exact-origin trust for jobs Trackly ingested directly from employer careers sources; do not recreate the retired ownership-timestamp gate in the client.
+1. Call `trackly_get_apply_protocol`. Skill 4.5.0 requires protocol 3.6.0 or newer for new reliability work. Protocol 3.2 remains valid only for an already-active explicit legacy single run; an already-active explicit 3.2 single run may finish through its legacy path. Preserve the protocol's documented recovery paths for already-active older work. Require `compatibleSkillMajor: 4` and `compatibleSkillMinimumVersion` no newer than this installed skill. Reject an older or incompatible version for new work and report that the backend must finish updating or `trackly agent setup` must update the skill. Protocol 3.2 added exact-origin trust for jobs Trackly ingested directly from employer careers sources; do not recreate the retired ownership-timestamp gate in the client.
 2. Call `trackly_get_profile_onboarding` or fetch both the profile schema and application profile. When present, render `schema.screens` in ascending `order` as one grouped question packet per screen. Within a screen, preserve category `order` and then field `order`; use each field's user-facing `rationale` when the user asks why it is needed. Ask only unknown or confirmation-needed fields and honor `consistencyRules` before submitting profile changes, resolving contradictions with the user instead of guessing. When `schema.screens` is absent on a legacy backend, fall back to the existing category-based onboarding behavior. Treat `completeness.percent` as required onboarding readiness only. Use `coverage.missingReusableKeys` to explain reusable optional gaps, while `coverage.contextualKeys` are intentionally asked only on the relevant employer form. Do not claim that 100% required completeness answers every possible application question.
 3. Save answers with `trackly_update_application_profile`:
    - Use `answered`, `intentionally_blank`, `declined`, or `unknown` exactly.
@@ -44,7 +44,9 @@ Read [references/legal-clarifications.md](references/legal-clarifications.md) wh
    - Use `writing.em_dash_policy` and `writing.optional_question_policy` when the fetched schema exposes them. An unanswered em-dash policy fails closed to `forbid` for form writing.
    - Infer a direct prior-employer answer of No only when the profile explicitly marks history complete, the target and backend-confirmed aliases are absent, and the question is limited to direct employment. Ask for subsidiary, affiliate, acquisition, contractor, or otherwise ambiguous relationships.
 4. Require the one-time profile confirmation, complete education entries, and default-resume metadata before browser work. Do not prepare or upload the resume when the form has no attachment control.
-5. For every protocol 3.4 or newer request, call `trackly_get_active_apply_execution` before legacy recovery. Resume execution work only when the response says `active: true`. A response with `preserved: true` and `active: false` exposes a stopped, closed, or otherwise terminal execution only for read-only reconciliation. Never fetch its compact snapshot, continue its wave, mutate its members, or interpret historical `currentlyFilling` or reservation counts as current work; require `progress.nextAction: none`. Only with protocol 3.5 or newer and an enabled compact-snapshot capability may an active recovery or new execution call `trackly_get_apply_execution_snapshot`, using only the current member IDs, profile keys needed by the visible forms, and actual browser surface. An already-active protocol 3.4 execution is read-only legacy recovery: use only its published get or stop operations, never call the 3.5-only snapshot, resume, approval, advance, or disposition tools, and never mutate its browser forms. For protocol 3.5 or newer, treat snapshot `mutable` and `allowedOperations` values as authoritative. Never mutate or reopen authentication, account-creation, OTP, pre-form-CAPTCHA, or manual-only members. Only an explicit user request may call `trackly_resume_parked_apply_member`; the returned member still requires a fresh non-mutating probe before private data or form mutation. Resume unresolved waves in ascending order only for `active: true` and obey the server `nextAction` and funnel. Never reconstruct progress or choose replacements locally. Count only `durablyReviewReady` and `submitted`; let the backend own reservations, capacity, attempted-job deduplication, immutable waves, and advancement. Continue until `targetReached`, `queueExhausted`, a blocking `nextAction`, or the user stops.
+5. For every protocol 3.4 or newer request, call `trackly_get_active_apply_execution` before legacy recovery. Resume execution work only when the response says `active: true`. A response with `preserved: true` and `active: false` exposes a stopped, closed, or otherwise terminal execution only for read-only reconciliation. Never fetch its compact snapshot, continue its wave, mutate its members, or interpret historical `currentlyFilling` or reservation counts as current work; require `progress.nextAction: none`. Only with protocol 3.5 or newer and an enabled compact-snapshot capability may an active recovery or new execution call `trackly_get_apply_execution_snapshot`, using only the current member IDs, profile keys needed by the visible forms, and actual browser surface. An already-active protocol 3.4 execution is read-only legacy recovery: use only its published get or stop operations, never call the 3.5-only snapshot, resume, approval, advance, or disposition tools, and never mutate its browser forms. For protocol 3.5 or newer, treat snapshot `mutable` and `allowedOperations` values as authoritative. Never mutate or reopen authentication, account-creation, OTP, pre-form-CAPTCHA, or manual-only members. Only an explicit user request may call `trackly_resume_parked_apply_member`; the returned member still requires a fresh non-mutating probe before private data or form mutation. Resume unresolved waves in ascending order only for `active: true` and obey the server `nextAction` and funnel. Never reconstruct progress or choose replacements locally. Treat backend `achievementCount`, target-capped `completed`, `targetReached`, and `nextAction` as authoritative. `durablyReviewReady` and `submitted` remain current operator projections and must never be added together by the client to reconstruct cumulative completion. Let the backend own reservations, capacity, attempted-job deduplication, immutable waves, and advancement. Continue until `targetReached`, `queueExhausted`, a blocking `nextAction`, or the user stops.
+   - After full local context loss with no active execution, call `trackly_list_recoverable_apply_executions`. For every distinct returned `jobId`, call `trackly_get_job`, bind that Trackly-owned job record to the returned `candidateId`, and show the user its company, role, requisition identity when available, and source-execution identity; do not identify candidates from chat, tab order, search results, or page copy. A missing or mismatched Trackly job record blocks confirmation. Require explicit confirmation of one exact candidate set, then call `trackly_recover_exact_apply_members` with that source execution, snapshot hash, and only those candidate IDs. Verify `assertedCandidateIds`, `eligibleCandidateIds`, and the eligibility candidate IDs each contain exactly the confirmed set with no duplicates. Never add substitutes, newly saved jobs, or merely similar roles.
+   - Exact recovery restores server lineage only. Treat tab restored, form state restored, and mutation authority restored as three independent receipts. Bind every recovered surface with a fresh recovery binding and inspection epoch, revalidate the full form, and preserve every user-edited or unknown non-empty value before any write. Earlier-epoch browser, field, upload, integrity, and submission evidence cannot authorize the recovered form.
    - Every compact snapshot request must contain a non-empty list of only the current member IDs. Never request an empty or inferred all-members projection.
    - Recover every entry in `execution.unresolvedWaves` in ascending `waveOrder`; `currentWave` identifies only the latest scheduling wave, not the complete recovery set.
    - Immediately consume the start response's authoritative `progress` and `nextAction`; do not issue a speculative advance first.
@@ -69,7 +71,7 @@ Read [references/legal-clarifications.md](references/legal-clarifications.md) wh
    - For each fixed batch member, preserve an explicit job ID -> application run ID -> browser tab mapping. Complete the full start -> conditional resume preparation/confirmation/verification when an upload control exists -> form completion -> `review_ready` lifecycle for every member. A review-ready run does not block the next member. Never submit any of them.
 6. When the selected job or current fixed batch member has no `runId`, call `trackly_start_apply_run` with the complete `batchId`, `memberId`, `expectedMemberVersion`, `expectedInspectionEpoch`, and `leaseToken` returned by Trackly. This is the sanctioned idempotent lookup for a recovered member whose `runId` is absent; call it with the exact recovered binding and Trackly will reuse the bound active run. When the member already has a `runId`, do not call `trackly_start_apply_run` in this or any subsequent start step: reuse that exact run and bind or recover its browser surface through `trackly_bind_apply_surface` as required. Never create a replacement run because browser control was interrupted.
    - If a bound start returns a transport failure, a non-access HTTP 5xx response, or an error explicitly marked `retryable: true`, preserve the frozen member and browser state. Refetch the active batch, renew its lease, and retry the same complete binding once. Classify the retry response independently with these same rules: route canonical `maintenance_mode` or legacy `planned_maintenance` directly through **Resume after maintenance**; surface controlled-access/request errors marked `retryable: false` and every other HTTP 4xx response unchanged; only a second transport failure, non-access HTTP 5xx response, or explicitly retryable error becomes `backend_run_start_unavailable`. Route maintenance on either attempt without consuming or relabeling the retry, and never relabel a permanent retry response as an outage. For `backend_run_start_unavailable`, continue other members and report a Trackly control-plane failure. Do not call `trackly_checkpoint_apply_batch` for this condition because start failure has not produced the required run ID. The unchanged frozen member is the durable resume point. Never switch that frozen member to an unbound legacy run or blame the employer form.
-   - Require `run.protocolVersion` to be 3.1.0 or newer and to share protocol major 3 with the fetched protocol. A new reliability execution member requires 3.5.0 or newer; already-active older work may use only the recovery path published by its fetched protocol. Never continue a pre-evidence 3.0.x run under skill 4.4.2. Preserve that run instead of starting a replacement, record it `blocked` with a value-free protocol-upgrade reason when possible, and tell the user the saved job can be retried only after the stale run is cleared through Trackly's supported lifecycle. Stop and refetch the protocol and active execution or batch if support level, execution mode, provider, required scenarios, authorized origin policy, member version, or inspection epoch changes after run creation.
+   - Require `run.protocolVersion` to be 3.1.0 or newer and to share protocol major 3 with the fetched protocol. A new reliability execution member requires 3.6.0 or newer; already-active older work may use only the recovery path published by its fetched protocol. Never continue a pre-evidence 3.0.x run under skill 4.5.0. Preserve that run instead of starting a replacement, record it `blocked` with a value-free protocol-upgrade reason when possible, and tell the user the saved job can be retried only after the stale run is cleared through Trackly's supported lifecycle. Stop and refetch the protocol and active execution or batch if support level, execution mode, provider, required scenarios, authorized origin policy, member version, or inspection epoch changes after run creation.
    - In guided mode, inspect the page before preparing any resume bytes. Confirm the employer, role, HTTPS origin, reachable review path, semantic controls, whether an attachment control exists, and absence of a credential, verification, CAPTCHA, or submit-only wall. A missing file input is not itself a blocker; skip the resume path when the application has no attachment control. Any other failed precondition is an execution blocker, not permission to improvise.
 7. Pass the browser readiness gate before preparing resume bytes:
    - Use semantic browser control through Codex in-app browser controls, Chrome MCP/extension browser control, or Claude in Chrome.
@@ -79,7 +81,7 @@ Read [references/legal-clarifications.md](references/legal-clarifications.md) wh
    - After a handoff, context resume, or browser-control interruption, reclaim and re-verify every mapped tab before continuing.
    - Report `observationType: browser_ready` for the current run with the exact current `batchId`, `memberId`, and `inspectionEpoch`, plus `scenarioCode: browser_reclaim`, the allowed `browserSurface`, `committed: true`, and that `browserBindingHash`. Do not call `trackly_prepare_resume` until this same-run attestation succeeds. When preparation is permitted, bind it to the exact run ID, browser surface, and browser binding hash. Accessibility may provide an independent verification signal, but coordinate-only clicking is forbidden for form completion.
    - If the semantic browser bridge is unavailable, preserve every existing run and tab mapping, record the blocker when possible, and stop before any upload or form mutation.
-8. If and only if the application offers or requires a resume attachment, read [references/browser-upload.md](references/browser-upload.md). For an accessible execution, call `trackly_approve_apply_execution_resume` once after the user approves the exact unchanged resume and original snapshot. Reuse only that content approval within the unchanged execution. For every run, still call `trackly_prepare_resume` with the exact run ID, browser surface, and binding hash and immediately verify the exact path, hash, size, and expiration before upload. If hosted MCP reports local preparation unavailable, use local Trackly MCP or manual upload. If no attachment control exists, skip steps 8–11 and do not report `resume_upload` as exercised.
+8. If and only if the application offers or requires a resume attachment, read [references/browser-upload.md](references/browser-upload.md). For an accessible execution, call `trackly_approve_apply_execution_resume` once after the user approves the exact unchanged resume and original snapshot. Reuse only that content approval within the unchanged execution. For every run, still call `trackly_prepare_resume` with the exact run ID, browser surface, and binding hash and immediately verify the exact path, hash, size, and expiration before upload. Require the browser upload capability gate and the local `trackly_validate_apply_resume_upload` stage proof before claiming attachment success. If hosted MCP reports local preparation unavailable, use local Trackly MCP or manual upload. If no attachment control exists, skip steps 8–11 and do not report `resume_upload` as exercised.
 9. Preserve the user’s filename returned by `trackly_prepare_resume`. Internal cache identifiers belong only in private parent directories and must never appear in the employer-facing upload filename.
 10. Before any upload, let the user inspect the exact prepared file returned by `trackly_prepare_resume`:
    - Prefer an inline visual preview. Otherwise open the exact local file in Quick Look or Preview.app.
@@ -138,6 +140,12 @@ Every required scenario and both universal evidence scenarios must have correspo
 
 ## Review handoff
 
+After context loss, call `trackly_list_apply_review_handoffs` for the execution
+before interpreting any grouped submission statement. Use the named receipt or
+the sole active receipt returned by Trackly; if multiple receipts remain, ask
+the user to identify the intended group. Never guess a receipt from tabs or
+chat history.
+
 After every conditional field is settled and all other review gates pass, bulk checkpoint every ready member with `review/manual_submit`, the current unchanged inspection epoch in both epoch fields, and any `resolvedActionIds`. Use the returned member versions and epochs; this checkpoint resolves the listed human actions and moves the durable member lifecycle to `review_ready` without invalidating current-epoch browser evidence or an unchanged resume-content approval. Do not wait for `needs_input` members: whenever at least one member is durably `review_ready`, ask for one explicit final truthfulness confirmation for the exact complete subset that is currently `review_ready`. If any form in that certified subset used a resume attachment, certify with `resumeDependency: approved` and the exact approved resume identity. If no form in the subset exposes a resume control, certify with `resumeDependency: not_applicable` and omit the resume ID and hash; do not invent an upload requirement. Then call `trackly_record_application_outcomes` once with every member in that certified subset using its exact current `runId`, `batchId`, `memberId`, `inspectionEpoch`, and `leaseToken`; every item must use the literal `outcome: review_ready`. Verify every recorded run returns `awaiting_manual_submit` before showing the review handoff. A member conflict does not invalidate successful siblings: preserve its tab, refresh that member once, and surface the returned stable conflict code instead of blindly replaying a different transition. A member that becomes ready later requires a fresh certification for the then-current complete `review_ready` subset; never reuse an older certification for it. Use singular `trackly_record_application_outcome` only for a legacy single run or an isolated post-review transition. Use the normal review block in [references/review-handoff.md](references/review-handoff.md) only after documented visibility proof for the exact review tab succeeds. If visibility is unverified, preserve the tab, use the separate visibility-unverified block, and do not tell the user to submit until the tab is reclaimed and visibly proven. For a single run, keep the browser on the final review state and stop. For a frozen batch, preserve every review-ready tab, hand off each certified review-ready subset without waiting on unrelated human actions, and continue the same lifecycle for the remaining mapped members. Members with unresolved actions stay frozen and resumable. Never submit any member. End with job ID -> run ID -> browser tab -> ATS -> status plus the actual scenario coverage for each run.
 
 After the user submits manually:

package/skills/trackly-apply/references/batch-orchestration.md

@@ -1,6 +1,11 @@
 # Batch orchestration
 
 Protocol 3.4 adds a server-owned Apply execution above immutable child batches.
+Protocol 3.6 adds exact-member recovery after local context loss and scoped
+review-handoff reconciliation.
+After context loss, rediscover active handoff receipts with
+`trackly_list_apply_review_handoffs`; never reconstruct or guess a handoff ID
+from chat history, tab order, or application similarity.
 The execution is the target-completion ledger; each child batch remains the
 auditable browser-work unit. Protocol 3.3 fixed batches and protocol 3.2 single
 runs remain recovery-only compatibility paths.
@@ -57,6 +62,35 @@ its top-level `response.batchId`. Never guess across those response shapes. If
 the applicable field is null or `unresolvedWaves` is empty, follow
 `response.progress.nextAction` rather than guessing a prior batch.
 
+## Exact recovery after local context loss
+
+When no active execution exists but unfinished lineage may still be retained,
+call `trackly_list_recoverable_apply_executions`. The returned source snapshot
+and candidates are the complete bounded recovery menu. Resolve every distinct
+returned `jobId` through `trackly_get_job`, bind that Trackly-owned record to
+its `candidateId`, and present its company, role, requisition identity when
+available, and source execution to the user. A missing or mismatched Trackly
+job record blocks confirmation. Require explicit confirmation of the exact
+candidate set. Never infer the set from browser tabs, conversation memory,
+search results, page copy, employer similarity, or queue position.
+
+Call `trackly_recover_exact_apply_members` with one source execution, its exact
+snapshot hash, the confirmed candidate IDs, and a fresh idempotency key. The
+response may never replace candidates. Verify that `assertedCandidateIds`,
+`eligibleCandidateIds`, and the eligibility candidate IDs each contain exactly
+the user-confirmed set with no duplicates before browser work.
+
+Recovery has three independent proof dimensions:
+
+1. the exact browser tab was restored;
+2. the employer form state was restored or safely reconstructed; and
+3. Trackly granted current mutation authority.
+
+Never let one imply another. Rebind each recovered surface, accept the new
+inspection epoch, inventory the form, preserve every user-edited and unknown
+non-empty field, and rerun required integrity evidence. All prior-epoch
+browser, upload, field, review, and submission evidence is stale.
+
 ## Replace an obsolete fixed batch
 
 An active legacy fixed batch and a new accessible execution are mutually

package/skills/trackly-apply/references/browser-lifecycle.md

@@ -92,6 +92,13 @@ Before resuming, handing off, or closing a tab:
 5. Reclaim a matching tab only after employer, role, requisition, HTTPS origin,
    ATS tenant when applicable, run ID, and browser binding all revalidate.
 
+Immediately before a session-finalizer call, pass the complete expected and
+keep sets plus complete controller and user inventories through
+`trackly_validate_apply_tab_keep_set`. Continue only when it returns
+`safeToFinalize: true`. This helper is a local validator, not a browser
+controller: it does not discover, focus, close, hand off, or finalize tabs.
+Unrelated tabs may remain in the inventories. Raw tab IDs stay local.
+
 For every initial tab and every recovery, call `trackly_bind_apply_surface`
 with the existing frozen member and run. Use `initial_binding` for the first
 surface and `recovery_binding` after a missing tab or handoff. The returned URL
@@ -253,6 +260,13 @@ When an incomplete member's tab is missing:
    revalidate the exact requisition before recording any outcome and never
    activate Submit again.
 
+When protocol 3.6 exact-member recovery created the current execution, prove
+three facts separately in the operator receipt: whether the tab was restored,
+whether the employer form state was restored or reconstructed, and whether
+current mutation authority was reacquired. A recovered tab alone never grants
+write authority. A recovered server member alone never proves the draft or tab
+survived.
+
 If the recovered origin or identity differs, semantic controls are
 unobservable, or access is blocked by credentials or a pre-form challenge,
 stop private-data mutation and create the appropriate human action. Continue

package/skills/trackly-apply/references/browser-upload.md

@@ -1,11 +1,43 @@
-# Browser upload contract
+# Browser upload
 
-Use semantic browser controls only. Coordinates, text injection, and a visible filename without committed input state are not upload proof.
+Resume approval proves the content the user authorized. Attachment proof proves
+that the browser committed that exact file. Neither fact substitutes for the
+other.
 
-1. Discover the exact attachment control semantically.
-2. Open its file chooser through the browser adapter.
-3. Use the adapter's advertised `setFiles` capability with the immediately verified local path.
-4. Verify the employer-facing filename exactly matches the prepared user-facing filename and contains no cache identifier.
-5. Recheck contact and parser-modified fields after the upload settles.
+## Capability gate
 
-Require all five proofs: `semantic_control_discovered`, `file_chooser_opened`, `set_files_succeeded`, `user_facing_filename_committed`, and `parser_fields_rechecked`. Fail closed when the active browser surface cannot prove any step. Never substitute an undocumented browser primitive.
+Before opening a file chooser, require the active browser adapter to advertise
+all five capabilities: semantic control discovery, chooser arming, file
+attachment, committed-filename inspection, and parser-field recheck. If any is
+missing, fail closed before opening the chooser and hand the upload to the user. Never
+navigate to a `file://` URL or paste a local path into an ordinary text field.
+
+Perform these stages in exact order:
+
+1. identify the exact semantic Resume or CV control;
+2. arm the file chooser before clicking that control;
+3. prove the chooser opened;
+4. run `trackly_verify_prepared_resume`, then immediately attach that verified
+   file through the adapter's documented file-setting primitive;
+5. verify the employer-facing filename committed; and
+6. recheck every contact, employment, education, and other field that resume
+   parsing may have changed.
+
+Pass only the value-free stage outcomes to
+`trackly_validate_apply_resume_upload`. Do not pass a filename, local path,
+resume hash, form value, URL, page text, or tab identifier. Claim attachment
+success only when it returns `safeToClaimAttachment: true`.
+
+Stable failure codes include capability unavailable, ambiguous control,
+chooser timeout, chooser opened without a commit, missing or expired file,
+file-setting failure, uncommitted filename, unexpected file navigation,
+unsettled parser, and parser-field regression. A failure is a handoff or retry
+decision, never permission to guess another control or weaken verification.
+
+Snapshot field provenance immediately before upload. Mark parser changes as
+`parser_filled`; preserve a later user edit byte-for-byte. After ledger loss,
+preserve every unknown non-empty value. Never let parser rechecks or the final
+required-field sweep overwrite user-owned or unknown external values.
+
+The employer-facing filename must remain the user's confirmed filename.
+Random cache identifiers may appear only in private parent directories.

package/skills/trackly-apply/references/review-handoff.md

@@ -15,6 +15,53 @@ Funnel: target=; ready=; submitted=; filling=; awaitingAnswer=; authParked=; exc
 
 Use the compact execution snapshot as authority. Give a bounded next-update estimate, not an invented overall completion time.
 
+## Deterministic operator receipts
+
+Every handoff names the browser surface and authoritative funnel. Use the
+matching template; do not improvise internal routing language.
+
+### Recovery
+
+```text
+Recovery in progress — not submitted
+Completed: exact Trackly source and user-confirmed candidate set recovered
+Tab restored: yes/no
+Form state restored: yes/no
+Current mutation authority: yes/no
+Unresolved:
+Your next action: wait / inspect / answer
+Resume: exact approved resume / no attachment / manual upload required
+Browser surface:
+Funnel:
+My next action:
+```
+
+### Upload requires the user
+
+```text
+Application preserved — resume upload requires you
+Completed:
+Unresolved: browser surface cannot prove the required attachment stages
+Your next action: attach the exact approved resume and confirm the committed filename
+Resume: exact approved resume
+Browser surface:
+Funnel:
+My next action: recheck parser-modified fields, finish integrity sweep, stop at review
+```
+
+### Submission reconciled
+
+```text
+Submission confirmed and reconciled
+Completed: success evidence recorded; member=submitted; job=applied_confirmed
+Unresolved: tab cleanup pending / none
+Your next action: none
+Resume: exact approved resume / no attachment
+Browser surface:
+Funnel:
+My next action: verify authorized tab disposition only
+```
+
 ## Approval scope receipt
 
 Before persisting a broad statement such as “always,” show which separate categories it will update: personal facts, consent choices, writing preferences, resume approval, and truthfulness certification. Never let approval of one category authorize another. Consolidate genuinely unknown questions into one packet after filling everything already known. Explain legal terms in plain language using the protocol glossary; do not expose internal action codes or routing labels.
@@ -141,5 +188,45 @@ open for manual submission, and list remaining human actions separately.
 Members that become ready later require a new certification for the exact
 then-current `review_ready` subset.
 
+## Group submission reconciliation
+
+A broad statement such as “I submitted all of them” applies only to one
+explicit review-handoff receipt. Call `trackly_list_apply_review_handoffs` for
+the execution, then resolve it to the receipt the user names or to the sole
+active receipt returned by Trackly. If multiple receipts could
+match, ask the user to choose; never fan the statement across executions or
+tabs.
+
+Inspect every member in the selected receipt and classify exactly one of:
+`detected`, `user_confirmed`, `unresolved`, or `contradictory`. Use
+provider-positive evidence only:
+
+- Greenhouse: a same-requisition thank-you page, confirmation route, or
+  semantic success state;
+- Ashby: a same-requisition explicit application-success banner or page,
+  including when the route does not change; and
+- Lever: a same-requisition confirmation redirect or semantic success state.
+
+An unchanged URL or page title is never evidence that submission failed. Build
+any local `DetectedSubmission` only from a versioned provider strategy, the
+handoff/member identity, current inspection epoch, evidence type, confidence,
+and a value-free fingerprint derived from those identifiers. Never hash DOM
+text, URLs, local paths, or raw tab IDs into that record.
+
+If a rediscovered receipt is `partially_reconciled`, preserve every member that
+already has a stored reconciliation result and inspect only members whose
+stored result remains `unresolved`. Do not replay the original claim with a
+partial member list: the claim receipt is an immutable exact-set idempotency
+record. Record later positive evidence and submitted outcomes through the
+normal per-member outcome path, naming the receipt and only its unresolved
+members in any follow-up confirmation.
+
+Call `trackly_claim_apply_review_handoff` with the exact receipt and a
+classification for every member. Write submission evidence and outcomes only
+for `detected` and `user_confirmed`. Ask one consolidated question containing
+only the `unresolved` members. Preserve every `contradictory` member and its
+tab without an outcome. Refetch and require member `submitted` plus job
+`applied_confirmed` before any authorized closure.
+
 Do not include restricted answers in chat unless needed for the user’s review.
 Never include credentials, an OTP, or a CAPTCHA response.