feat(phase-11): kill JD-scraping leak in keyword pool — V2-only

Scoped to V2 per request (plan assumed shared V1+V2 chokepoint). New
filter_scraped_noise()/_is_skill_like() in src/external_ats.py, applied only in
src/resume_v2_natural.py::_allocate_keywords. Rejects geography (graphql safe from
'hq'), the hiring company's own name, cue-gated person names (so job-title
headings survive), corporate-entity/role nouns, and job-board UI blurbs. V1
extractor path untouched. New tests/test_jd_leak_filter.py (6 tests); V1 (11) + V2
(17) suites green — 34 total.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.planning/REQUIREMENTS.md

@@ -106,3 +106,6 @@ V2 must NOT append keyword lists. Instead, fan out across the existing model poo
 
 ## R26: Label V1 + documentation + default-safe
 Explicitly label the current behavior as "V1" in README.md and HISTORY.md, document V2, and ensure V1 stays the default so existing flows are unaffected if no version is specified.
+
+## R27: Kill the JD-scraping leak in the keyword extractor
+The keyword extraction layer (the code that turns a raw JD into the keyword pool consumed by BOTH V1 structured placement and V2 sentence generation) is leaking scraped, non-skill text directly into the candidate's resume. Real evidence from a generated Backbase resume: the Skills "Other" block contained the company CEO's name (`jouk pleiter`), geography boilerplate (`headquartered, amsterdam, north america europe, middle east asia-pacific africa, latin america`), About-us marketing copy (`backbase helped financial institutions … bold climate action … worldwide network, backbasers partners`), and recruiter-blurb fragments (`re interested, likely, recruiter, don, show`); the injected summary contained scraped LinkedIn UI text (`actively engaged on LinkedIn Corporation to get alerts, reach applicants, and stay a top applicant`) and a stray collaborator name (`Mohammed Nayeem`). The extractor MUST NOT emit: company marketing/boilerplate copy, person/named-entity tokens (executives, recruiters, collaborators), location/geography lists, multi-word sentence fragments, or generic recruiter/UI-blurb tokens. Only genuine, role-relevant skill / tool / domain keywords survive. Scope is the extraction + filtering layer ONLY — NOT the honesty guardrails, injection grammar, or fit-gate (deferred). Success: a JD containing company boilerplate + a CEO name + a geography list yields a keyword pool with zero of those tokens, and a regenerated resume's Skills "Other" line and summary contain no scraped non-skill text.

.planning/phases/11-jd-scraping-leak-fix/11-01-SUMMARY.md

@@ -0,0 +1,61 @@
+---
+phase: 11-jd-scraping-leak-fix
+plan: 01
+type: summary
+status: DONE
+requirements: [R27]
+deviation: "Scoped to V2-only per user instruction (plan assumed shared V1+V2 chokepoint)"
+---
+
+# 11-01 Summary: Kill the JD-Scraping Leak (V2-only)
+
+## Deviation from plan
+The verified plan fixed the **shared** chokepoint (`_is_term_like` in
+`external_ats.py`), which would have changed both V1 and V2. The user instructed
+"ensure this only goes in V2." Implementation was re-scoped: the filter is a
+standalone function applied **only in the V2 allocation path**; the shared V1
+extractor is untouched.
+
+## What was built
+
+### src/external_ats.py (additive — definitions only, not wired into V1)
+- `_GEO_EXTENDED`, `_ENTITY_NOISE`, `_ROLE_NOISE`, `_SENTENCE_STARTERS`,
+  `_UI_BLURB`, `_NAME_CUE_BEFORE`
+- `_contains_geo_token()` — word-boundary single-word match (so `hq` never
+  blocks `graphql`) + substring match for multi-word geo phrases
+- `_contains_person_name()` — **cue-gated**: a Title-Case bigram is a name only
+  if it sits next to a person cue ("Recruiter: …", "… is the CEO", "— Manager").
+  Scans all adjacent pairs, so a name embedded in a longer gram is caught. Avoids
+  false-flagging job-title/domain headings ("Forward Deployed", "Banking
+  Integrations", "Product Manager")
+- `_is_skill_like(term, original_jd, company)` — the rejection gate: UI noise,
+  UI blurbs, geography, role/entity nouns, the hiring company's own name
+  (word-boundary + s/rs/ers suffix), and cue-gated person names
+- `filter_scraped_noise(terms, original_jd, company)` — public V2 entry point
+
+### src/resume_v2_natural.py (V2 path only)
+- `_allocate_keywords()` gained a `company` param; calls
+  `filter_scraped_noise(decision["includable"], jd_text, company)` right after
+  `decide_includable_terms`
+- `generate_v2()` passes `company` into `_allocate_keywords`
+
+### tests/test_jd_leak_filter.py (new, 6 tests)
+- `test_bad_tokens_absent`, `test_good_tokens_present`, `test_no_false_positives`
+- `test_v2_allocation_excludes_scraped` — end-to-end via `_allocate_keywords`
+- `test_v1_extractor_unchanged` — **proves V2-only**: `amsterdam` still in the V1
+  `extract_external_keywords` pool, removed only by `filter_scraped_noise`
+- `test_real_jd_coverage_not_regressed` — clean JD keeps ≥90% of its pool
+
+### Docs
+- README "Generation Modes" → V2 scraped-noise filter subsection (notes V1 not filtered)
+- HISTORY → Phase 11 entry
+
+## Verification
+- `pytest tests/test_jd_leak_filter.py tests/test_structured_placement.py tests/test_resume_v2.py -q` → **34 passed**
+- Real Backbase JD, V2 pool after fix: `['banking integrations api management',
+  'forward deployed product manager', 'gcp', 'ipaas reconciliation agile',
+  'rest soap graphql webhooks']` — zero names/geography/company/boilerplate.
+
+## Out of scope (deferred, unchanged)
+Honesty guardrails (`_REGULATED_CRED`/`_specialty_hit`), injection grammar/
+coherence, fit-gate, upstream scraper. V1 placement behavior.

.planning/phases/11-jd-scraping-leak-fix/11-CONTEXT.md

@@ -0,0 +1,78 @@
+---
+phase: 11-jd-scraping-leak-fix
+type: context
+captured: 2026-06-25
+source: real generated resume (Backbase Forward Deployed PM) + user-confirmed scope
+---
+
+# Phase 11 Context — Kill the JD-Scraping Leak
+
+## Origin
+A live resume generated for a **Backbase "Forward Deployed Product Manager for
+Banking Integrations"** role (LinkedIn job 4415276270) was analyzed as if by the
+hiring HR head. It would be rejected instantly — not for tuning reasons but
+because the **keyword extractor leaked raw scraped JD/company text directly into
+the resume**, producing fabrication-looking content and obvious automated-stuffing
+signals.
+
+## The actual leaked tokens (verbatim evidence)
+From `Saiteja_Tirunagari_Backbase_Resume.tex`:
+
+1. **Skills "Other" block** (`% ats-skills-other`, line 266) contained:
+   - Executive name: `jouk pleiter` (Backbase's CEO)
+   - Geography list: `headquartered, amsterdam, north america europe, middle east asia-pacific africa, latin america`
+   - About-us marketing copy: `backbase helped financial institutions, institutions stand, re taking bold climate, action helping future-proof, planet alongside, worldwide network, backbasers partners, peers, members, share`
+   - Recruiter/UI-blurb fragments: `re interested, likely, recruiter, don, show`
+   - Other sentence fragments: `things grand central, voice, client inside`
+
+2. **Injected summary** (`% ats-injected-start`, line 148) contained:
+   - Scraped LinkedIn UI text: `actively engaged on LinkedIn Corporation to get alerts, reach applicants, and stay a top applicant in competitive PM roles`
+   - Unsupported claim tokens: `GCP, banking integrations`
+
+3. **Injected bullets** referenced a stray collaborator name: `Mohammed Nayeem`
+   (bleed-through from unrelated profile/JD data).
+
+## Root-cause hypothesis (to confirm in research)
+The JD→keyword extraction layer is treating the ENTIRE scraped page (company
+"About us", CEO bio, recruiter blurb, LinkedIn chrome) as JD body, then tokenizing
+it into the keyword pool with no named-entity / boilerplate / fragment filtering.
+This pool feeds BOTH:
+- V1 structured placement (`src/latex_resume.py` — `decide_includable_terms`,
+  inject into `% ats-skills-other` + `% ats-injected-start`)
+- V2 sentence generation (`src/resume_v2_natural.py` — `_allocate_keywords`)
+
+## Scope decision (USER-CONFIRMED)
+**IN scope:** the extraction + filtering layer only — stop non-skill tokens from
+ever entering the keyword pool.
+
+The extractor MUST NOT emit:
+- company marketing / boilerplate copy
+- person / named-entity tokens (executives, recruiters, collaborators)
+- location / geography lists
+- multi-word sentence fragments
+- generic recruiter / UI-blurb tokens
+
+Only genuine, role-relevant **skill / tool / domain** keywords survive.
+
+**OUT of scope (explicitly deferred by the user — do NOT touch):**
+- honesty guardrails (`_REGULATED_CRED`, `_specialty_hit`)
+- grammar/coherence of the injected sentences
+- fit-gate / domain-mismatch down-ranking
+- the upstream JD scraper itself (we filter at extraction, not at scrape)
+
+## Constraints
+- Fix at the SHARED extraction layer so both V1 and V2 benefit from one change.
+- Do NOT over-filter: legitimate keywords (REST, SOAP, GraphQL, iPaaS, Agile,
+  banking-integration domain terms) must still survive — no regression in real
+  keyword coverage.
+- Existing tests must stay green: `tests/test_structured_placement.py` (V1, 11
+  tests), `tests/test_resume_v2.py` (V2, 17 tests).
+- Project rule [[feedback_docs_update]]: update README.md + HISTORY.md.
+- Honesty principle [[ats_no_stuffing_principle]]: this is the mechanism behind
+  "keyword dumps get stripped" — fixing extraction is the upstream cure.
+
+## Success (acceptance)
+A JD containing company boilerplate + a CEO name + a geography list yields a
+keyword pool with **zero** of those tokens; a regenerated resume's Skills "Other"
+line and summary contain no scraped non-skill text; true-keyword coverage does
+not regress; both V1 and V2 test suites pass.

HISTORY.md

@@ -4,6 +4,39 @@ A running log of everything built, fixed, and changed. Most recent first.
 
 ---
 
+## 2026-06-25 — Phase 11: Kill the JD-Scraping Leak (V2-only)
+
+A live Backbase resume exposed the keyword extractor leaking scraped, non-skill
+text into the resume: the Skills "Other" block held the CEO's name (`jouk
+pleiter`), geography (`amsterdam`, `latin america`), About-us copy (`worldwide
+network`, `backbasers partners`), and recruiter fragments; the summary held
+LinkedIn UI chrome (`actively engaged on LinkedIn Corporation…`) and a stray
+collaborator name (`mohammed nayeem`).
+
+- **Fix (scoped to V2 only, per request):** new `filter_scraped_noise()` +
+  `_is_skill_like()` in `src/external_ats.py`, applied in
+  `src/resume_v2_natural.py::_allocate_keywords` after `decide_includable_terms`.
+  Rejects: geography (word-boundary matched so `graphql` is safe from the `hq`
+  substring), the hiring company's own name (threaded in as `company`),
+  person names (cue-gated — a Title-Case bigram next to "Recruiter:" / "is the
+  CEO" / "— Manager", so job-title headings like "Forward Deployed" /
+  "Banking Integrations" are NOT false-flagged), corporate-entity nouns
+  (corporation, members, backbasers…), and job-board UI blurbs (actively
+  engaged, easy apply…).
+- **V1 is deliberately untouched** — the shared `_is_term_like` /
+  `extract_external_keywords` path is unchanged, so V1 structured placement
+  behaves exactly as before. A regression test (`test_v1_extractor_unchanged`)
+  asserts `amsterdam` still appears in the V1 pool.
+- **Result:** the Backbase JD's V2 pool now yields only genuine keywords
+  (`rest soap graphql webhooks`, `ipaas reconciliation agile`, `banking
+  integrations`, `gcp`) — zero names, geography, company, or boilerplate.
+- **Scope:** extraction/filtering only. Honesty guardrails, injection grammar,
+  and fit-gate are NOT part of this phase (deferred).
+- **Tests:** new `tests/test_jd_leak_filter.py` (6 tests); existing V1 (11) and
+  V2 (17) suites stay green — 34 total.
+
+---
+
 ## 2026-06-25 — Designation + Filename Update
 
 - **Designation**: Changed NxtWave role from "Internal Product Manager" to

README.md

@@ -424,6 +424,17 @@ genuine-sounding experience bullets. Reads as natural prose rather than keyword
 lists; honesty boundaries preserved; slightly slower (one LLM call + compile).
 Falls back to V1 comma placement if the LLM call fails.
 
+**Scraped-noise filter (V2-only).** Before allocation, V2 passes the keyword pool
+through `filter_scraped_noise()` (`src/external_ats.py`), which drops tokens a raw
+JD scrape drags in but that are never resume keywords: company geography
+(Amsterdam, Latin America…), the hiring company's own name, executive/recruiter
+and other person names (cue-gated, e.g. "Recruiter: …" / "… is the CEO"),
+corporate-entity/boilerplate nouns (corporation, members, backbasers…), and
+job-board page chrome ("actively engaged", "easy apply"…). Genuine skill/tool/
+domain keywords (REST, SOAP, GraphQL, iPaaS, reconciliation, Agile, banking
+integrations…) are preserved. **V1 placement is intentionally NOT filtered** —
+this is scoped to V2 only.
+
 ### Selecting a version
 
 | Surface | How to choose |

src/external_ats.py

@@ -81,6 +81,149 @@ _UI_SUBSTR = (
 )
 
 
+# ── V2-only scraped-noise filter (R27) ───────────────────────────────────────
+# These three sets + helpers reject scraped, non-skill tokens (company
+# geography, executive/recruiter names, role/boilerplate nouns) that the broad
+# extractor cannot tell apart from real skills. They are applied ONLY in the V2
+# allocation path via `filter_scraped_noise()`; V1 structured placement does NOT
+# call them, so V1 behaviour is unchanged.
+
+# Geography / location tokens that are never skills. Word-boundary matching is
+# used for single-word entries so 'hq' never blocks 'graphql'; multi-word phrases
+# ('latin america') match as substrings.
+_GEO_EXTENDED: frozenset = frozenset({
+    "amsterdam", "netherlands", "europe", "africa", "asia", "asia-pacific",
+    "latin america", "latin", "north america", "south america", "middle east",
+    "apac", "emea", "headquartered", "headquarters", "hq", "worldwide",
+    "global", "offices", "office",
+})
+
+# Corporate-entity / boilerplate suffix words that travel with "About us" copy.
+_ENTITY_NOISE: frozenset = frozenset({
+    "corporation", "incorporated", "subsidiary", "subsidiaries", "conglomerate",
+})
+
+# Job-board / LinkedIn page chrome that the DOM scrape drags in (the broad V1
+# extractor's _UI_NOISE list doesn't cover these exact fragments).
+_UI_BLURB: tuple = (
+    "actively engaged", "actively reviewing", "get alerts", "reach applicants",
+    "top applicant", "easy apply", "be an early applicant", "promoted by",
+    "set alert", "job alert", "people you can reach",
+)
+
+# Generic role/people nouns that indicate a person or HR context, not a skill.
+_ROLE_NOISE: frozenset = frozenset({
+    "recruiter", "recruiters", "applicant", "applicants",
+    "founder", "co-founder", "cofounder", "ceo", "cto", "coo", "cfo",
+    "investor", "investors", "partner", "partners",
+    "member", "members", "shareholder", "shareholders",
+    "colleague", "colleagues", "peer", "peers", "backbasers",
+    "hire", "hiring", "hired",
+})
+
+# Common sentence/clause-starting words that appear Title Case but are NOT part
+# of a person name — excluded from the two-word name pattern.
+_SENTENCE_STARTERS: frozenset = frozenset({
+    "The", "A", "An", "We", "Our", "You", "This", "That", "These", "Those",
+    "For", "At", "In", "On", "By", "With", "To", "From", "And", "Or", "But",
+    "If", "As", "Is", "Are", "Was", "About", "During", "After", "Before",
+    "When", "Where", "Please", "Must", "Will", "Can", "Has", "Have", "Had",
+    "Be", "Do", "Does", "Did", "Should", "Would", "Could", "May", "Might",
+    "Not", "All", "Some", "Any", "Each", "Also", "Both", "More", "Most",
+    "How", "What", "Who", "Why", "Which",
+})
+
+# Cue words that appear immediately BEFORE a person name in a JD ("Recruiter:
+# Mohammed Nayeem", "Founder Jouk Pleiter").
+_NAME_CUE_BEFORE = (
+    r"recruiter|contact|hiring manager|posted by|submitted by|reach out to|"
+    r"founder|co-?founder|ceo|cto|coo|cfo|president|vice president|vp|"
+    r"director|head of [a-z ]+|lead"
+)
+
+
+def _contains_geo_token(term: str) -> bool:
+    """True if `term` is or contains a geography/location token. Single-word geo
+    entries use word-boundary matching so the 'hq' substring never blocks
+    'graphql'; multi-word geo phrases (e.g. 'latin america') match as substrings."""
+    tl = (term or "").lower()
+    for g in _GEO_EXTENDED:
+        if g == tl:
+            return True
+        if " " in g and g in tl:
+            return True
+        if " " not in g and re.search(
+            r"(?<![a-z])" + re.escape(g) + r"(?![a-z])", tl
+        ):
+            return True
+    return False
+
+
+def _contains_person_name(term_lower: str, original_jd: str) -> bool:
+    """True if `term_lower` contains a two-word Title-Case sequence that, in the
+    original JD, sits next to a person cue — a label before it ('Recruiter:') or a
+    predicate/appositive after it ('is the CEO', '— Account Manager', ', founder').
+
+    Context-gated on purpose: a bare Title-Case bigram is NOT enough (job-title and
+    domain headings like 'Forward Deployed' or 'Banking Integrations' are Title
+    Case too). Requiring a person cue avoids those false positives while still
+    catching real names embedded anywhere in a multi-word gram.
+    """
+    words = term_lower.split()
+    if len(words) < 2:
+        return False
+    orig = original_jd or ""
+    for w1, w2 in zip(words, words[1:]):
+        cap1, cap2 = w1.capitalize(), w2.capitalize()
+        if cap1 in _SENTENCE_STARTERS or cap2 in _SENTENCE_STARTERS:
+            continue
+        name = re.escape(cap1) + r"\s+" + re.escape(cap2)
+        before = r"(?:" + _NAME_CUE_BEFORE + r")\s*[:\-–—]?\s+" + name
+        after = name + r"\s*(?:\bis\b|\bwas\b|,|[\-–—]|\bthe ceo\b|\bfounder\b)"
+        if re.search(before, orig, flags=re.I) or re.search(after, orig):
+            return True
+    return False
+
+
+def _is_skill_like(term: str, original_jd: str = "", company: str = "") -> bool:
+    """Return False (reject) if `term` is geography, a corporate-entity/role noun,
+    the company's own name, or a person name. This is the sole V2 rejection gate;
+    it does NOT touch the V1 extractor's stopword/UI/filler checks."""
+    tl = (term or "").strip().lower()
+    if not tl:
+        return True
+    if _is_ui_noise(tl):
+        return False
+    if any(b in tl for b in _UI_BLURB):
+        return False
+    if _contains_geo_token(tl):
+        return False
+    parts = tl.split()
+    if tl in _ROLE_NOISE or any(w in _ROLE_NOISE for w in parts):
+        return False
+    if any(w in _ENTITY_NOISE for w in parts):
+        return False
+    if company:
+        for ctok in re.findall(r"[a-z0-9]+", company.lower()):
+            if len(ctok) >= 4 and re.search(
+                r"\b" + re.escape(ctok) + r"(?:s|rs|ers)?\b", tl
+            ):
+                return False
+    if original_jd and _contains_person_name(tl, original_jd):
+        return False
+    return True
+
+
+def filter_scraped_noise(
+    terms: List[str], original_jd: str = "", company: str = ""
+) -> List[str]:
+    """V2-only: drop scraped non-skill tokens (geography, executive/recruiter
+    names, corporate-entity/boilerplate nouns, the company's own name) from an
+    already-extracted term list, preserving order. V1 does NOT call this — V1's
+    pool is unchanged by design."""
+    return [t for t in (terms or []) if _is_skill_like(t, original_jd, company)]
+
+
 # Generic JD action-verbs / weak edge words trimmed from the START/END of a
 # maximal run so an extracted phrase reads like a SKILL, not a sentence fragment
 # ("lead end-to-end product lifecycle" → "end-to-end product lifecycle").

src/resume_v2_natural.py

@@ -30,7 +30,7 @@ from src.latex_resume import (
     _is_hardcoded_resume,
     _specialty_hit,
 )
-from src.external_ats import external_coverage
+from src.external_ats import external_coverage, filter_scraped_noise
 from src.candidate_fit import _REGULATED_CRED
 
 log = logging.getLogger("resume_v2")
@@ -131,11 +131,17 @@ Return JSON:
 
 # ── Keyword allocation (same waterfall as V1) ────────────────────────────────
 
-def _allocate_keywords(jd_text: str, base_text: str, latex_src: str) -> tuple[dict, dict]:
+def _allocate_keywords(jd_text: str, base_text: str, latex_src: str,
+                       company: str = "") -> tuple[dict, dict]:
     """Allocate JD keywords to sections using the exact V1 waterfall.
     Returns (allocations_dict, decision_dict)."""
     decision = decide_includable_terms(jd_text, base_text, maximum_ats_mode=True)
-    includable = decision["includable"]
+    # V2-only (R27): strip scraped non-skill noise — company geography, the
+    # company's own name, executive/recruiter names, role/boilerplate nouns — that
+    # the shared extractor leaves in the pool. V1 structured placement does NOT
+    # filter, so its behaviour is unchanged. `jd_text` is the original
+    # (pre-lowercase) JD, needed for the person-name cue heuristic.
+    includable = filter_scraped_noise(decision["includable"], jd_text, company)
 
     src_low = (latex_src or "").lower()
     seen: set[str] = set()
@@ -409,7 +415,7 @@ def generate_v2(
     base_text = latex_to_text(latex_src or "")
 
     # 1. Allocate keywords (exact V1 waterfall)
-    allocations, decision = _allocate_keywords(jd_text, base_text, latex_src)
+    allocations, decision = _allocate_keywords(jd_text, base_text, latex_src, company)
 
     has_keywords = any(
         (isinstance(v, list) and v) or (isinstance(v, dict) and any(vv for vv in v.values()))

tests/test_jd_leak_filter.py

@@ -0,0 +1,175 @@
+"""tests/test_jd_leak_filter.py — V2 JD-scraping-leak filter (R27).
+
+Verifies the V2-ONLY scraped-noise filter: company geography, executive/recruiter
+names, and role/boilerplate nouns are dropped from the V2 keyword pool, while
+genuine skill/tool/domain keywords survive. Also asserts the change is scoped to
+V2 — the shared V1 extractor (`extract_external_keywords`) is unchanged.
+
+Run: python -m pytest tests/test_jd_leak_filter.py -x -q
+"""
+from __future__ import annotations
+
+import os
+import pytest
+
+try:
+    from src.external_ats import (
+        filter_scraped_noise,
+        _is_skill_like,
+        extract_external_keywords,
+    )
+except Exception as exc:  # pragma: no cover - import guard
+    pytestmark = pytest.mark.skip(f"external_ats import unavailable: {exc}")
+
+
+# Real Backbase-style JD: an "About us" block (geography, CEO, boilerplate) +
+# a recruiter line, wrapped around the genuine role requirements.
+BACKBASE_LIKE_JD = """
+Forward Deployed Product Manager for Banking Integrations
+
+About Backbase:
+Backbase is headquartered in Amsterdam with offices in North America, Europe,
+Middle East, Asia-Pacific, Africa, and Latin America. Jouk Pleiter is the CEO
+and founder. Our worldwide network of backbasers, partners, peers, and members
+share a bold vision.
+
+About the Role:
+We are looking for a Product Manager with experience in banking integrations,
+API management, REST, SOAP, GraphQL, webhooks, iPaaS, reconciliation, Agile,
+and stakeholder management. GCP experience preferred.
+
+Recruiter: Mohammed Nayeem - Account Manager.
+Actively engaged on LinkedIn Corporation to get alerts, reach applicants.
+"""
+
+# Tokens that MUST NOT survive the V2 filter.
+BAD_TOKENS = {
+    "jouk pleiter",
+    "amsterdam",
+    "latin america",
+    "north america",
+    "headquartered",
+    "worldwide network",
+    "recruiter",
+    "members",
+    "mohammed nayeem",
+    "backbasers",
+    "corporation",
+    "linkedin corporation",
+    "actively engaged",
+}
+
+# The hiring company — its own name must never become a resume keyword.
+COMPANY = "Backbase"
+
+# Tokens that MUST survive (genuine skill/tool/domain keywords).
+GOOD_TOKENS = {
+    "rest",
+    "soap",
+    "graphql",
+    "webhooks",
+    "reconciliation",
+    "agile",
+    "gcp",
+    "stakeholder management",
+    "banking integrations",
+}
+
+
+def _flatten_allocations(allocations: dict) -> set[str]:
+    out: set[str] = set()
+    for v in allocations.values():
+        if isinstance(v, list):
+            out.update(x.lower() for x in v)
+        elif isinstance(v, dict):
+            for pts in v.values():
+                out.update(x.lower() for x in pts)
+    return out
+
+
+# ── filter_scraped_noise (the V2 gate, unit level) ───────────────────────────
+
+def test_bad_tokens_absent():
+    """Every known scraped token is rejected by the V2 filter."""
+    candidates = list(BAD_TOKENS) + list(GOOD_TOKENS)
+    survivors = {t.lower() for t in
+                 filter_scraped_noise(candidates, BACKBASE_LIKE_JD, COMPANY)}
+    leaked = BAD_TOKENS & survivors
+    assert not leaked, f"scraped tokens leaked through V2 filter: {sorted(leaked)}"
+
+
+def test_good_tokens_present():
+    """No genuine keyword is over-filtered."""
+    candidates = list(BAD_TOKENS) + list(GOOD_TOKENS)
+    survivors = {t.lower() for t in
+                 filter_scraped_noise(candidates, BACKBASE_LIKE_JD, COMPANY)}
+    dropped = GOOD_TOKENS - survivors
+    assert not dropped, f"genuine keywords wrongly dropped: {sorted(dropped)}"
+
+
+def test_no_false_positives():
+    """High-risk substrings/headings are kept (graphql vs 'hq'; Title-Case heading
+    'Banking Integrations' is a domain term, not a person name)."""
+    assert _is_skill_like("graphql", BACKBASE_LIKE_JD)          # 'hq' must not match
+    assert _is_skill_like("ipaas", BACKBASE_LIKE_JD)
+    assert _is_skill_like("reconciliation", BACKBASE_LIKE_JD)
+    assert _is_skill_like("banking integrations", BACKBASE_LIKE_JD)
+    assert _is_skill_like("stakeholder management", BACKBASE_LIKE_JD)
+    # And the leak tokens are rejected at the unit level too.
+    assert not _is_skill_like("jouk pleiter", BACKBASE_LIKE_JD)
+    assert not _is_skill_like("amsterdam", BACKBASE_LIKE_JD)
+    assert not _is_skill_like("recruiter", BACKBASE_LIKE_JD)
+    assert not _is_skill_like("mohammed nayeem", BACKBASE_LIKE_JD)
+
+
+# ── V2 allocation path (integration) ─────────────────────────────────────────
+
+def test_v2_allocation_excludes_scraped():
+    """End-to-end: V2's _allocate_keywords pool contains none of the bad tokens."""
+    try:
+        from src.resume_v2_natural import _allocate_keywords
+        from src.default_resume import get_default_resume_latex
+        from src.latex_resume import latex_to_text
+    except Exception as exc:
+        pytest.skip(f"V2 allocation deps unavailable: {exc}")
+    latex_src = get_default_resume_latex()
+    base_text = latex_to_text(latex_src)
+    allocations, _decision = _allocate_keywords(
+        BACKBASE_LIKE_JD, base_text, latex_src, COMPANY)
+    placed = _flatten_allocations(allocations)
+    leaked = {b for b in BAD_TOKENS if any(b == p or b in p for p in placed)}
+    assert not leaked, f"scraped tokens reached V2 allocations: {sorted(leaked)}"
+
+
+# ── Scope guard: the change is V2-only ───────────────────────────────────────
+
+def test_v1_extractor_unchanged():
+    """The shared V1 extractor is NOT filtered — proving the fix is V2-scoped.
+    'amsterdam' still appears in extract_external_keywords output (V1 path)."""
+    pool = {t.lower() for t in extract_external_keywords(BACKBASE_LIKE_JD)}
+    assert "amsterdam" in pool, (
+        "V1 extractor output changed — filter must be V2-only, not in the shared path"
+    )
+    # But the V2 filter would remove it.
+    assert "amsterdam" not in {
+        t.lower() for t in filter_scraped_noise(list(pool), BACKBASE_LIKE_JD)
+    }
+
+
+def test_real_jd_coverage_not_regressed():
+    """A clean PM JD with no boilerplate keeps virtually all of its keyword pool
+    after V2 filtering (the filter only removes scraped non-skill noise)."""
+    clean_jd = (
+        "We are looking for a Product Manager. Responsibilities: roadmap planning. "
+        "Stakeholder management. A/B testing. Product analytics. Agile delivery. "
+        "Scrum ceremonies. User research. Feature prioritization. SQL dashboards. "
+        "OKRs and KPIs. PRD writing. Go-to-market strategy. Customer retention. "
+        "Funnel optimization. REST and GraphQL APIs. Data-driven decisions."
+    )
+    pool = extract_external_keywords(clean_jd)
+    filtered = filter_scraped_noise(pool, clean_jd, company="")
+    assert pool, "extractor produced no keywords for a clean JD"
+    # A clean JD has no geography/names/boilerplate, so the filter drops ~nothing.
+    assert len(filtered) >= int(0.9 * len(pool)), (
+        f"V2 filter over-pruned a clean JD: {len(filtered)}/{len(pool)} kept"
+    )