fix(resume-builder): two regressions caught by transcript replay

QA replay of the user's original 10-turn session against the post-1A+1B
agent exposed two real failure modes:

1. **max_iterations=5 too tight for serial tool calls.** When the model
   chose to fetch 6 GitHub READMEs SEQUENTIALLY (one fetch_github_readme
   per loop iteration) instead of in parallel, the agentic loop
   exhausted at iteration 5, raised AgentExecutionError, and the regex
   step-machine fallback dumped the URL list into experience_notes —
   producing none of the captured projects/skills the user expected.
   Bumped cap to 12 (10 URLs of headroom + 2 for the final answer).
   Above ~12 is a runaway-loop signal; below ~10 leaves no room for
   the ~6-URL-in-one-turn case the user actually exercised.

2. **projects_notes captured as Python list repr.** The LLM occasionally
   emits prose fields as LISTS of per-item descriptions after a
   multi-tool round-trip ([{"name": "Proj A", ...}, ...] or
   ["Proj A — …", "Proj B — …"]). _apply_llm_draft_updates was
   wrapping in str(), which captured the Python repr "['…', '…']"
   into projects_notes. The structuring LLM then choked on the
   malformed shape and the regex fallback rendered the raw list literal
   into the markdown. Added _coerce_prose_field(value) that joins
   list/tuple inputs with \n\n so the structuring pass sees clean
   newline-separated entries instead. Applied to all three prose
   fields (experience_notes / education_notes / projects_notes) in
   both _apply_draft_updates and _apply_llm_draft_updates for symmetry.

Verification: 61 tests across the affected suites green.

Slice-1B follow-up only — the actual remaining quality bugs visible
in the rendered PDF (projects-not-bulleted, Link field grabs first
tech word, first-person voice leak in education/publications) are
structuring-prompt issues for the next slice.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: LEANDERANTONY

backend/services/resume_builder_service.py

@@ -406,13 +406,13 @@ def _apply_draft_updates(session: ResumeBuilderSession, updates: dict):
             updates.get("professional_summary", "") or ""
         ).strip()
     if "experience_notes" in updates:
-        session.draft.experience_notes = str(
-            updates.get("experience_notes", "") or ""
-        ).strip()
+        session.draft.experience_notes = _coerce_prose_field(
+            updates.get("experience_notes")
+        )
     if "education_notes" in updates:
-        session.draft.education_notes = str(
-            updates.get("education_notes", "") or ""
-        ).strip()
+        session.draft.education_notes = _coerce_prose_field(
+            updates.get("education_notes")
+        )
     if "skills" in updates:
         skills = updates.get("skills", [])
         if not isinstance(skills, list):
@@ -428,7 +428,9 @@ def _apply_draft_updates(session: ResumeBuilderSession, updates: dict):
             [str(item).strip() for item in certifications if str(item).strip()]
         )
     if "projects_notes" in updates:
-        session.draft.projects_notes = str(updates.get("projects_notes", "") or "").strip()
+        session.draft.projects_notes = _coerce_prose_field(
+            updates.get("projects_notes")
+        )
     if "publications" in updates:
         publications = updates.get("publications", [])
         if not isinstance(publications, list):
@@ -1839,29 +1841,59 @@ def _apply_llm_draft_updates(session: ResumeBuilderSession, updates: dict):
             updates.get("professional_summary") or ""
         ).strip()
     if "experience_notes" in updates:
-        session.draft.experience_notes = str(
-            updates.get("experience_notes") or ""
-        ).strip()
+        session.draft.experience_notes = _coerce_prose_field(
+            updates.get("experience_notes")
+        )
     if "education_notes" in updates:
-        session.draft.education_notes = str(
-            updates.get("education_notes") or ""
-        ).strip()
+        session.draft.education_notes = _coerce_prose_field(
+            updates.get("education_notes")
+        )
     if "skills" in updates:
         session.draft.skills = dedupe_strings(_coerce_string_list(updates.get("skills")))
     if "certifications" in updates:
         session.draft.certifications = dedupe_strings(
             _coerce_string_list(updates.get("certifications"))
         )
     if "projects_notes" in updates:
-        session.draft.projects_notes = str(
-            updates.get("projects_notes") or ""
-        ).strip()
+        session.draft.projects_notes = _coerce_prose_field(
+            updates.get("projects_notes")
+        )
     if "publications" in updates:
         session.draft.publications = dedupe_strings(
             _coerce_string_list(updates.get("publications"))
         )
 
 
+def _coerce_prose_field(value) -> str:
+    """Coerce an LLM-emitted prose field to a clean string.
+
+    The LLM contract specifies that ``experience_notes`` /
+    ``education_notes`` / ``projects_notes`` are STRINGS — verbatim
+    user prose, one block per field. In practice the model
+    occasionally emits them as LISTS of entries, especially right
+    after a multi-URL tool round-trip where each fetched README
+    becomes a logical project. Naively wrapping that in ``str(...)``
+    captured the Python ``repr()`` of the list, including the square
+    brackets and quoted entries — and the downstream structuring
+    prompt choked on the malformed shape, then the regex fallback
+    rendered the raw list literal into the markdown.
+
+    This helper joins list/tuple inputs with ``\n\n`` so the
+    structuring pass sees newline-separated entries instead of a
+    stringified list. Single-string inputs pass through unchanged.
+    """
+    if value is None:
+        return ""
+    if isinstance(value, (list, tuple)):
+        cleaned_parts = [
+            str(item).strip()
+            for item in value
+            if str(item or "").strip()
+        ]
+        return "\n\n".join(cleaned_parts).strip()
+    return str(value).strip()
+
+
 def _summarize_tool_event(event: dict) -> dict:
     """Compress one tool-loop trace entry for `conversation_history`.
 
@@ -1943,11 +1975,19 @@ def _run_llm_turn(
             tools=RESUME_BUILDER_TOOL_SPECS,
             tool_executor=execute_resume_builder_tool,
             expected_keys=prompt["expected_keys"],
-            # Five iterations is enough for the realistic case (one
-            # URL → one fetch → one JSON answer) with headroom for the
-            # model to retry on transient tool errors. A higher cap
-            # invites runaway loops on malformed responses.
-            max_iterations=5,
+            # Twelve iterations: covers the realistic worst case of a
+            # user pasting ~10 GitHub URLs in one turn and the model
+            # choosing to fetch them SERIALLY instead of in parallel
+            # (one fetch_github_readme per iteration + the final
+            # answer = N+1 iterations). The original cap of 5 hit a
+            # regression on QA replay when the model serialized 6
+            # fetches — the loop exhausted at iteration 5, the
+            # service caught AgentExecutionError, and the regex
+            # fallback dumped the URL list into experience_notes.
+            # Above ~12 is a runaway-loop signal (prompt drift or
+            # tool bug); below ~10 leaves no headroom for the
+            # ~6-URL-in-one-turn case the user actually exercised.
+            max_iterations=12,
             temperature=None,
             max_completion_tokens=get_openai_max_completion_tokens_for_task("resume_builder"),
             task_name="resume_builder",