HoussamNadir.

The model may reorder, select, rephrase and omit, but never fabricate an experience, a date, an employer, a diploma or a number. Translation is the only permitted transformation, with strict fidelity to the degree level.

The ATS score is not produced by the model. A real ATS is a keyword-matching engine, not a judge: the LLM extracts and ranks the gaps, the score is a deterministic function. Re-scoring always returns the same number, and applying a rewrite can only add a keyword, so it can never lower the score.

The OpenAI client is capped at 90 s with a single retry, instead of 10 minutes and 2 retries. On Vercel, a hung request has to fail while the Lambda is still alive, otherwise the catch block that issues the refund never runs and the user pays for a generation they never received.

The application has a deliberate visual identity; the PDFs stay strictly ATS-safe: one column, typography only, no colour and no ornament. That is exactly where most generators fail.

The Stripe amount is never trusted from the client: the credit count comes from a server-side table indexed by Price ID, with a signature-verified webhook. Extension tokens are stored as SHA-256 only. An explicit 30-page cap guards against PDF decompression bombs.

A summary does not tell a student whether they are ready. Without binding a document to a chapter, a quiz answer cannot be attributed to a subject, so nothing can be measured beyond a worthless global average.

Course → Chapter → Document is mandatory: an orphan document does not exist. It is the precondition for the entire product. The Exam Readiness Score is a pure function of about 850 lines, with no network and no LLM, and the retention factor is gated: a chapter with no reviewed flashcard scores strictly the same as before, proven by test.

The student enters their real grade after the exam; the product displays the mean error between predicted score and grade obtained. The real grade is never fed back into the calculation: the score makes itself refutable instead of declaring itself correct.

Coverage acts as a confidence multiplier: three correct answers cannot make it read "Ready". The overall score is smoothed, so one bad quiz does not collapse everything.

A DocumentChapterSpan bridge model with page ranges rather than a foreign key: one PDF often spans several chapters, and one chapter is spread across several PDFs. No scalar metric is stored as raw JSON.

A declared capacity is an imagined capacity. And with six domains and time lags, one analysis cycle tests hundreds of pairs: an individual threshold would mechanically guarantee false links on every pass.

Facts against projections, visible in the table names: every stored calculation carries the proj_ prefix, so clearProjections() is safe at any moment and a scoring formula can be corrected without leaving an inconsistent history. No fact table points at a projection, and an architecture test verifies it, because the rule was silently broken once already.

A day left blank drops out of the calculation instead of counting as zero: it lowers the displayed confidence, never the score. Three days without data show "score 74, low confidence", not "score 31", otherwise the product would punish not opening the app.

What is displayed is an empirical conditional frequency: two numbers reproducible by hand. Links are tested per full cycle, the number of tests is counted, and publication is filtered on the false discovery rate. Every pattern freezes its cycle.

packages/core never imports db, api, ingestion or React: 13,700 lines testable with no database, no network, no API key. The logic cannot diverge between web and mobile: it is a property of the structure, not a discipline.

A cloud misconfiguration is invisible in a code review: a public S3 bucket, an open SSH port, a user without MFA. It becomes visible in production, or in a breach.

A report is not enough: nobody reads a report. The check becomes blocking: a critical finding stops the CI/CD pipeline, which moves security from the audit to the front door.

A cybersecurity course gives you the concepts; a real AWS account gives you the unpleasant surprises. This tool came out of needing to check my own deployments before a grader, or an attacker, did it for me.

Network discovery, service enumeration, basic web security and troubleshooting in Linux environments. Advent of Cyber (TryHackMe, Dec. 2025) for structured investigative method.