docs: begin plan 09 review

docs/execution/approved-issue-plans-ledger.md

@@ -41,7 +41,7 @@ state changes are outside scope.
 | 06 image storage delivery | #2684, #2778 | blocked | audit `task_855fbee0a803` | `codex-audit-backend-01-06` | `7a98f6662` → no source change | coordinate 12/15/25 renderer/image fixtures | #2684 ACL cause fixed by merged #3432 (`35cecf9`); #2778 Browserless path obsolete; current topology unproved | #3432 hosted checks successful; audit storage/upload/PDF tests, typechecks, boundaries passed | #3432 merged before run | deployment retest plus shared real-encoding/backend/render fixture before repair | deployed digest; disposable S3/Garage/SeaweedFS/MinIO/proxy and browser/server raster matrix unavailable |
 | 07 AIO deployment | #2722 | reviewing | implementation `task_aee702e37eae`; review `task_b29de2cd974c` / `ctx_46d7f32205a1` | `codex/issue-2722-postgres-docs` | `7a98f6662` → `e37b73566` | none | two docs committed locally; separate PostgreSQL/no-AIO policy plus topology/Unraid/reused-DB/upgrade gaps addressed | implementer reports Compose config, Markdown lint, focused source/diff/scope gates green; independent rerun active | — | resolve independent findings, fresh verify, publish unmerged PR without closing keyword | no AIO implementation permitted; optional Unraid host smoke unavailable |
 | 08 root public resume | #2669 | plan amendment required before implementation | audit `task_9f27829ca50f` | planned `codex/issue-2669-root-resume` | `7a98f6662` → — | none | current password redirect rejects `/`; public view is slug-hook-bound; SSR canonical cannot import server env; expanded auth/canonical contract identified | audit focused API/web suites, typechecks, boundaries passed | — | amend ownership for identity-vs-return auth flow and server-derived canonical root, then dispatch coherent feature | engineering scope correction; feature remains narrower than arbitrary domain/TLS registry |
-| 09 external version backup | #2705 | pending implementation | audit `task_9f27829ca50f` | planned `codex/issue-2705-git-backup-docs` | `7a98f6662` → — | none | current resume, independent cover-letter, and account export shapes verified; manual local Git workflow approved | audit export/import suites, markdown lint, typechecks, boundaries passed | — | publish plain Git commands and format distinctions; validate in disposable local repo | no automatic sync, remote, or whole-account restore; agent-only `rtk` syntax forbidden in user docs |
+| 09 external version backup | #2705 | reviewing | implementation `task_e450ea143bfa`; review `task_129b49e32bc7` / `ctx_68b13c76cc72` | `codex/issue-2705-git-backup-docs` | `7a98f6662` → `d4ef67113` | none | two docs committed locally with export-shape distinctions, plain local Git workflow, privacy/image limits, import-as-new recovery | implementer reports API/import/schema/web tests, synthetic Git round trip, Markdown/diff/scope gates green; DB integration/E2E skipped; independent rerun active | — | resolve independent findings, fresh verify, publish unmerged PR | no automatic sync, remote, or whole-account restore |
 | 10 legacy link routing | #2836 | pending implementation after brief correction | audit `task_9f27829ca50f` | planned `codex/issue-2836-retired-slug-notices` | `7a98f6662` → — | none | prospective same-username slug-attempt notice remains coherent; exact DB/API/UI/E2E owner set verified | audit focused API/web suites, DB/API/web typechecks, boundaries passed | — | correct final E2E target to `public-sharing.spec.ts`, then implement migration/API/owner UI atomically | historical cause absent; no redirects/emails/recovery; prospective partial coverage only |
 | 11 job search policy | #3010 | pending implementation | audit `task_9f27829ca50f` | planned `codex/issue-3010-jsearch-docs` | `7a98f6662` → — | none | history proves JSearch removed in v5.1.0; current provider-native search and supplied-description tailoring verified | audit agent/capability tests, markdown lint, typechecks, boundaries passed | — | make minimal three-file factual docs correction | removal motive unknown; JSearch not restored and live search remains provider/model-dependent |
 | 12 preview/export failures | #3323, #3290, #3033, #3007, #2609 | blocked corrective work; diagnostic-ready | audit `task_1c6582ccdeae` | `codex-audit-rendering-12-19` | `7a98f6662` → no source change | renderer ownership; share observation harness with 18 | zero drift; staged-preview/error-boundary baselines remain; reports cross persistence/font/PDF/viewer/deployment boundaries | audit focused web/PDF suites, affected typechecks, boundaries, build passed | — | isolate PT Sans, browser/config, and template-selection boundaries; no shared fix | exact JSON/output/browser/config/current reproduction missing |
@@ -78,11 +78,12 @@ state changes are outside scope.
 | Plans 12–19 | `task_1c6582ccdeae` / `ctx_795fced595ef` | `codex-audit-rendering-12-19` | complete; worker release pending | 15A/16/19 implementation-ready; remaining causes split into diagnostics with named evidence gates |
 | Plans 20–34 | `task_47ed7eb02d48` / `ctx_50d8257459ab` | `codex-audit-builder-20-34` | complete; worker release pending | ready: 20A, 21, 22, 23A, 28 diagnostics, 32, 34; remaining plans split at evidence/design gates |
 | Plan 07 implementation | `task_aee702e37eae` / `ctx_ed134b1d79ce` | `codex/issue-2722-postgres-docs` | implementation complete; worker released | commit `e37b73566`; two-file docs change; implementation report complete |
-| Plan 09 implementation | `task_e450ea143bfa` / `ctx_3b575cf1d5c7` | `issue-2705-git-backup-docs`; target `codex/issue-2705-git-backup-docs` | starting | two-file docs change, synthetic local-Git validation, commit, independent review |
+| Plan 09 implementation | `task_e450ea143bfa` / `ctx_3b575cf1d5c7` | `codex/issue-2705-git-backup-docs` | implementation complete; worker released | commit `d4ef67113`; two-file docs change and synthetic local-Git validation |
 | Plan 11 implementation | `task_58d76423d364` / not dispatched | planned `codex/issue-3010-jsearch-docs` | waits on plans 07–11 audit | three-file docs change, source/test validation, commit, independent review |
 | Plan 02 synthetic recovery | `task_bae016c4d1f2` / `ctx_303f5d1f1031` | `codex/issue-3181-recovery-procedure` | implementation complete; worker released | commit `3f53deca8`; pure comparator, safeguards docs, TDD evidence |
 | Plan 02 independent review | `task_46be9a1a4d82` / `ctx_e9f651d38a65` | same Plan 02 worktree | reviewing | findings-first review and independent verification |
 | Plan 07 independent review | `task_b29de2cd974c` / `ctx_46d7f32205a1` | same Plan 07 worktree | reviewing | factual/safety review and independent validation |
+| Plan 09 independent review | `task_129b49e32bc7` / `ctx_68b13c76cc72` | same Plan 09 worktree | reviewing | format/workflow/privacy review and independent validation |
 
 ## Existing PR and residual accounting
 

docs/execution/briefs/review-plan-09.md

@@ -0,0 +1,26 @@
+# Independent review: plan 09 local Git backup documentation
+
+Review only; do not edit, commit, push, open PR, mutate issues, or spawn subagents. Read current worktree `AGENTS.md`, RTK,
+issue/domain guidance, code-review/documentation skills, `.orchestration/plan-09-implementation.md`, and approved plan 09.
+Trust local planning checkout only when HEAD equals `a2557b2ad40e06e1e63eb655f286e6a78fe6bf0d`; otherwise use pinned `git show`
+for `plans/09-external-version-backup.md`.
+
+Fetch current `origin/main` and live issue/PR state. Confirm reviewed commit and inspect full `origin/main...HEAD` diff. Verify
+claims against current export/import/version source and tests, then review:
+
+- Correctly distinguish single-resume JSON, embedded cover-letter sections, independent cover-letter JSON, and account
+  archive. Account archive must not be presented as single-resume import or whole-account restore.
+- User code uses plain local Git commands only: targeted `git add --`, inspect diff, commit, show. No `rtk`, remote URL,
+  credentials, `git push`, global Git config mutation, or automatic sync.
+- Restore is import-as-new and non-destructive. Filenames stable. Images described as URL references with availability risk.
+  Private-data and repository-visibility warning is prominent and actionable.
+- Existing rolling history comparison is accurate and non-duplicative. Scope contains exactly two approved docs.
+- Synthetic validation/report evidence is reproducible; note database/E2E skips accurately and inspect whether retained temp
+  path creates any repository or privacy risk.
+
+Rerun focused API/import/schema/web tests, Markdown lint, disposable local-Git sequence using synthetic data, and diff/scope
+checks where practical. Record skipped DB/E2E gates. Findings first, severity-ordered with file/line and evidence. If none,
+state `No findings` plus residual risks.
+
+Write `.orchestration/plan-09-review.md` with reviewed SHA/base, findings, commands/results, skipped gates, risks, and verdict
+`ready for publication` or `changes required`. Final response at most ten lines.