chat: stop hallucinating diversity gaps on tech-recruiter offers

security round 2: payload caps, traceback strip, GDPR delete, path allowlist

security: top-5 audit findings — auth namespacing, SSRF guard, OAuth URL hygiene, rate limit, CSP

editorial: tighten typography + page-budget warning + per-finding skip flag

audit: one-click grammar fixes with rollback

audit: AI CV audit + structured contract/headcount/exit fields

bullet UX: AI improve + drag-to-reorder across 10 HTML templates

chat: in-chat tone picker with real-bullet samples (spec 46afe50)

cv: mark unknowns with {GAP: ...} tokens instead of fabricating

llm: generate CV in the chat language, not the UI locale

chat: stop re-asking the same theme — explicit 'already asked' block

analyze: coerce LLM list fields to flat list[str]

chat: use mistral-small for next-question — 30s→~5s on 'go' first turn

chat: render markdown in assistant bubbles (bullets, bold, headings)

feat(chat): rank themes by leverage, bundle questions across experiences

fix: coerce language dicts to strings + stop asking headcount in chat

fix: bump rate limits 50/500, catch empty Mistral responses

fix: chat now finishes — question counter + forced completion after 8

feat: company context fields in editor — sector, stage, headcount, team

feat: rewrite chat from scratch — goal-driven, no more loops

fix: structured conversation flow — stay on one company before moving on

feat: switch chat to Mistral Large + radically simplified prompt

fix: remove experience cleanup prompt — was causing deletion loop

feat: two-pass LinkedIn parser handles multi-role companies correctly

fix: voice puts text in input for review + never auto-delete experiences

fix: correct mistralai import path — Mistral is in mistralai.client

feat: switch entire backend from Gemini to Mistral (LLM + STT)

fix: use dict for thinking_config — SDK version on HF lacks ThinkingConfig class

perf: disable thinking on chat + analyze — all 3000 tokens go to output

fix: bump chat token budget 1500→3000 to prevent truncated JSON

feat: switch voice transcription to Groq Whisper + fix truncated JSON

perf: cut token budget 16K→8K + force user-select on chat containers

feat: coherence check on heuristic parse — falls back to LLM if suspicious

feat: instant LinkedIn PDF parsing via heuristics, LLM as fallback

perf: reduce PDF parser token budget 16K → 4K for faster parsing

fix: backend audit — rate limits, prompt restructure, security, cleanup

fix: first question lists all companies + use first name only

fix: add 60s timeout to Gemini call in PDF parser

fix: prevent LLM from re-asking already covered topics

fix: headcount question lists all companies by name for batch answer

fix: batch headcount into single question + ask about experience cleanup

fix: sanitize CVData arrays at boundary + batch headcount question

fix: move request_options from GenerativeModel to generate_content calls

perf: analyze token budget 16K→2K — cuts gap analysis wait time

refactor: new flow — chat-only step, editor+tone, then design

fix: CV experience structure — context→scope→spotlights pattern

fix: chat prompt rewrite — short responses, focused questions, natural philosophy

fix: 5 chat bugs — philosophy extraction, merge, edit sync, drilling, duplicates

feat: cover letter generation — backend endpoint + frontend page + PDF export

security: harden backend — session secret, auth, SSRF, rate limits, timeouts