@aria-framework/ask 0.1.1 → 0.2.0

package/lib/check.js

@@ -9,6 +9,8 @@
  *   isPublicId(v)       this app's id test — an id is sayable only when a look-up returned it
  *   namedTokens         [[regex, replacement]] applied before the token rules: names that contain digits (Soc: "tier 0",
  *                       "P1") — each app's own, none by default
+ *   verbatimFields      (0.1.2) paths ('rows[].fields.upn', 'facts.entities[].value') whose whole value may be said with
+ *                       @ \ / % # + [ ] & in it — see VERBATIM VALUES; every structured field is one too — default none
  *   sayIps, sayWindows  Soc's S4 (an IP the results carry; a window an app-written label names) — default OFF
  *   rowChipLabel(row)   the row chip's words
  *   toolOf(id)          the catalogue — decides which paths of a result are ATTACKER text (the tool's attackerFields)
@@ -23,13 +25,30 @@
  *   - is not `{answer, cites}` with a non-empty answer;
  *   - cites, or places a figure for, a result or extra figure that does not exist;
  *   - TYPES A NUMBER: any numeral (`\p{N}`: 999, ٩٩٩, ９９９, ⁹⁹⁹, ⑨, Ⅸ) or a number WORD (two … million; not one/first/
- *     second/single/half);
+ *     second/single/half) — except a lone small number word equal to exactly one cited figure, which is rewritten into
+ *     that figure's placeholder (0.1.2, SMALL_NUMBER);
  *   - says a token with a digit in it, or a ref-shaped token, that is not SAYABLE (allowedTokens);
  *   - carries a link — a scheme, `www.`, markup, a Markdown link, a path, or a PUBLIC-looking domain the results did not
  *     name from an app-written path;
  *   - claims something was done, asks the person to sign in again, speaks of another partner, or talks about its
  *     instructions or the document.
  *
+ * CLAIMS (0.2.0, every answer): a VERDICT (compromised, malicious, benign, safe, a false positive, "no action needed" …) is
+ * refused unless an APP-WRITTEN field of a cited result says it (`unsupported_verdict`); an ALL/NONE claim about a state
+ * ("all of them are resolved", "none are open") is refused unless every row of the cited result shows it — and the result
+ * returned all its rows (`sweeping_claim`).
+ *
+ * ANALYSE MODE (0.2.0, `checkAnswer(reply, results, { mode: 'analyse', question })` — the plan's intent was analyse): the
+ * answer may group, compare and conclude, and is held to, per sentence:
+ *   - it cites at least one result as [rN] (`uncited_sentence`), and every placeholder in it names a result it cites
+ *     (`uncited_figure`);
+ *   - a conclusion ("suggests", "likely", "therefore", "overall" …) says it comes from the results ("the results show",
+ *     "based on these results") (`unframed_conclusion`);
+ *   - every capitalised name in it is a word of the results it cites or of the question (`unknown_name`) — no new entity;
+ * and, over the whole answer, every typed id, host, value or number is one the CITED results returned (the sayable set is
+ * built from the cited results only). The obeyed phrasings (claimed actions, sign-in, other partners, instructions) apply
+ * as in every answer.
+ *
  * THIS IS A FLOOR, NOT A PROOF. It stops the obeyed shapes the tests name and the bench measures. What it guarantees is
  * that Ask cannot act, cannot invent a figure the page draws, and cannot link anywhere.
  */
@@ -51,18 +70,32 @@ const PURE_NUMBER = /^[\p{N}.,]+$/u;
 const REF_TOKEN = /(?<![\p{L}\p{N}])[\p{L}]{2,5}_[\p{L}\p{N}]{4,}/gu;
 const HOSTLIKE = /^[\p{L}\p{N}][\p{L}\p{N}-]*(?:\.[\p{L}\p{N}-]+)*$/u;
 const LINKISH = /(https?:|ftp:|mailto:|javascript:|data:|file:|www\.|<\s*[a-z!/]|\]\s*\(|&lt;|\bhref\b)/i;
+// KNOWN-DANGEROUS SCHEMES over the whole answer (0.1.2, review round 3 of PR #12): the protocol handlers an OS or app opens
+// on a click or a paste — ms-settings:, zoommtg:, ms-officecmd:, search-ms:, smb:, tel: … Named, not shaped, so "Status:
+// open" and "Shell: bash" are prose (a space follows the colon).
+const DANGEROUS_SCHEME = /(?<![\p{L}\p{N}-])(?:ms-[a-z-]+|search-ms|smb|cifs|nfs|afp|webdav|tel|sip|sips|callto|skype|msteams|zoommtg|zoomus|vnc|rdp|ssh|telnet|sftp|ldaps?|vbscript|mhtml|mk|its|jar|shell|intent|vscode|microsoft-edge|onenote|steam):(?=\S)/iu;
 const DOMAINISH = /(?<![\p{L}\p{N}])[\p{L}\p{N}-]+(?:\.[\p{L}\p{N}-]+)*\.\p{L}{2,}(?:\/[^\s]*)?(?![\p{L}\p{N}])/gu;
+// A SNIPPET (0.2.0, lib/text.js) is attacker text on any path ending in .snippet, whether or not the tool lists it.
+const SNIPPET = /(?:^|\.)snippet$/;
 const INTERNAL_SUFFIX = /\.(local|lan|internal|corp|home\.arpa|localdomain)$/i;
 const NUMBER_WORD = /\b(zero|two|three|four|five|six|seven|eight|nine|ten|eleven|twelve|thirteen|fourteen|fifteen|sixteen|seventeen|eighteen|nineteen|twenty|thirty|forty|fifty|sixty|seventy|eighty|ninety|hundreds?|thousands?|millions?|billions?|dozens?|twice|thrice)\b/i;
 // What an obeyed instruction says — SCOPED to that, not to the vocabulary a security answer is made of ("sign-in attempts",
 // "password spray"). Widened in review L of PR #9: up to two adverbs ("I have now closed it"), "was closed by me", "log
-// back in", "re-enter it at the login page", other tenants or resellers, "my rules".
+// back in", "re-enter it at the login page", other tenants or resellers, "my rules". 0.2.0 (the Noc adoption): the network and
+// device verbs — restarted, rebooted, muted, paused, (un)blocked, isolated, quarantined, disconnected, shut down, reset,
+// acknowledged — in the same first-person, "has been … as/by" and "… by me/us" shapes. A device that "restarted at 03:10"
+// in the data is not a claim.
 const OBEYED = [
   // "I/we" and the verb with up to two words between ("I have now closed", "we've quietly removed", "I have't yet sent").
-  [/\b(i|we)\s+(?:[\p{L}'’]+\s+){0,2}(closed|deleted|removed|assigned|resolved|approved|disabled|enabled|changed|updated|sent|marked|escalated|acknowledged|archived|reset|purged|wiped)\b/iu, 'claims to have done something', 'claims_action'],
-  [/\b(has|have)\s+been\s+(closed|deleted|removed|resolved|approved|disabled|marked|purged|wiped)\s+(as|by)\b/i, 'claims something was done', 'claims_action'],
+  // An OBSERVATION ("we saw it restarted", "I noticed it was blocked") is not a claim: no seeing verb between (final round).
+  [/\b(i|we)\s+(?:(?!(?:saw|see|sees|seen|noticed|notice|found|find|observed|observe|watched|spotted)\b)[\p{L}'’]+\s+){0,2}(closed|deleted|removed|assigned|resolved|approved|disabled|enabled|changed|updated|sent|marked|escalated|acknowledged|archived|reset|purged|wiped|restarted|rebooted|muted|unmuted|paused|resumed|blocked|unblocked|isolated|quarantined|disconnected|shut\s+down|reset|acknowledged)\b/iu, 'claims to have done something', 'claims_action'],
+  [/\b(has|have)\s+been\s+(closed|deleted|removed|resolved|approved|disabled|marked|purged|wiped|restarted|rebooted|muted|unmuted|paused|resumed|blocked|unblocked|isolated|quarantined|disconnected|shut\s+down|reset|acknowledged)\s+(as|by)\b/i, 'claims something was done', 'claims_action'],
+  // Done FOR the person ("The firewall was restarted for you"), and "Done:" with a change after it ("Done: the host is
+  // now isolated") — final round of PR #14.
+  [/\b(closed|deleted|removed|assigned|resolved|approved|disabled|enabled|changed|updated|sent|marked|escalated|acknowledged|archived|reset|purged|wiped|restarted|rebooted|muted|unmuted|paused|resumed|blocked|unblocked|isolated|quarantined|disconnected|shut\s+down)\s+for\s+you\b/i, 'claims something was done for the person', 'claims_action'],
+  [/\bdone\s*[:!—–-]\s*[^.]{0,80}?\b(closed|deleted|removed|assigned|resolved|approved|disabled|enabled|changed|updated|sent|marked|escalated|acknowledged|archived|reset|purged|wiped|restarted|rebooted|muted|unmuted|paused|resumed|blocked|unblocked|isolated|quarantined|disconnected|shut\s+down)\b/i, 'claims something was done', 'claims_action'],
   // The verb "by me / us", however it is introduced ("closed by me", "It was resolved by us").
-  [/\b(closed|deleted|removed|assigned|resolved|approved|disabled|enabled|changed|updated|sent|marked|escalated|acknowledged|archived|reset|purged|wiped)\s+by\s+(me|us|the\s+assistant)\b/i, 'claims something was done', 'claims_action'],
+  [/\b(closed|deleted|removed|assigned|resolved|approved|disabled|enabled|changed|updated|sent|marked|escalated|acknowledged|archived|reset|purged|wiped|restarted|rebooted|muted|unmuted|paused|resumed|blocked|unblocked|isolated|quarantined|disconnected|shut\s+down|reset|acknowledged)\s+by\s+(me|us|the\s+assistant)\b/i, 'claims something was done', 'claims_action'],
   [/\b(were|was|been)\s+(deleted|removed|wiped|purged|erased)\b/i, 'claims something was deleted', 'claims_action'],
   [/\b(sign|log)\s?-?\s?(in|on)\s+(again|at|here|now|to\s+continue|to\s+restore)\b|\b(sign|log)\s+back\s+(in|on)\b|\b(enter|re-?enter|confirm|reset|verify)\s+your\s+(password|credentials?|login)\b|\bre-?enter\b[^.]{0,40}\b(log-?in|sign-?in)\s+page\b|\bsession\s+(has\s+)?expired\b/i, 'sends the person to sign in', 'sign_in'],
   [/\b(other|another)\s+(partners?|tenants?|resellers?)\b|\bevery\s+other\s+(partner|tenant)\b/i, 'speaks of another partner', 'other_partner'],
@@ -95,7 +128,9 @@ const readable = (t) => String(t).normalize('NFKC').replace(INVISIBLE, '').repla
 
 /** Every refusal code checkAnswer can return. */
 const REFUSAL_CODES = Object.freeze(['shape', 'control_chars', 'unknown_cite', 'unknown_figure', 'bad_placeholder', 'link', 'number_word', 'claims_action',
-  'sign_in', 'other_partner', 'instructions', 'unknown_ref', 'typed_number', 'unknown_token', 'disallowed_char']);
+  'sign_in', 'other_partner', 'instructions', 'unknown_ref', 'typed_number', 'unknown_token', 'disallowed_char',
+  // 0.2.0: claims (every answer) and the analyse rules.
+  'unsupported_verdict', 'sweeping_claim', 'uncited_sentence', 'uncited_figure', 'unframed_conclusion', 'unknown_name']);
 
 /**
  * THE MODEL'S OWN TEXT IS ALLOW-LISTED (the coordinator's round on PR #9, the same list as the soc AI-brief check): after
@@ -111,8 +146,200 @@ const REFUSAL_CODES = Object.freeze(['shape', 'control_chars', 'unknown_cite', '
  */
 const ALLOWED_CHAR = /^[\p{L}\p{N} \n.,;:!?'"‘’“”()\-–—_]$/u;
 
+/**
+ * VERBATIM VALUES (0.1.2, D-0175). An honest answer names a UPN (jdoe@contoso.com), an account (KAROO\jdoe), a path
+ * (C:\Windows\System32\winevt, /var/log/auth.log) or a subnet (10.20.0.0/24) — and the allow-list refused every one for its
+ * @ \ / % # + [ ] &. Those characters are now admitted ONLY inside a span of the answer that is, exactly and whole, one
+ * value a look-up returned at a path the binding marks VERBATIM (`verbatimFields`, plus every `structured` field):
+ *   - the value: 3–128 characters, no whitespace, only the allow-list's characters plus VERBATIM_EXTRA, at least one of
+ *     those, unchanged by NFC and by `readable` (no format, compatibility or look-alike character to hide behind), no
+ *     digit directly before a % (a percentage is a FIGURE, never text), and no scheme-shaped part (SCHEMEISH: smb:,
+ *     ms-msdt:, search-ms:, tel: — LINKISH, which still reads the whole unmasked answer, names only six schemes; a drive
+ *     letter "C:" is not one);
+ *   - from an ATTACKER path (the tool's attackerFields, or any path of an unknown or remote tool) also: NO PATH — no "/",
+ *     and "\" only as exactly one DOMAIN\user; no IPv4/IPv6 part unless the app says IPs (sayIps); it starts with a
+ *     letter, holds no ref-shaped token, and every dotted part is an internal host (the attacker-path host rule) — or it
+ *     is an IPv4 CIDR with sayIps. App-written verbatim values keep paths, shares and subnets;
+ *   - the span: the answer's NFC text holds it exactly (case and all), with no token character on either side and no
+ *     ".x" / ":x" joining it to more, so a superstring, a substring or two values joined is not the value. The char rule, DOMAINISH and the token rules then
+ *     read the span as one plain word; LINKISH, the obeyed phrasings and the number words still read the whole answer.
+ */
+const VERBATIM_EXTRA = /[@\\/%#+[\]&]/u;
+const VERBATIM_VALUE = /^[\p{L}\p{N}.,;:!?'"‘’“”()\-–—_@\\/%#+[\]&]{3,128}$/u;
+const CIDR4 = /^(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\/(?:3[0-2]|[12]?\d)$/;
+// The span's edges (review of PR #12): a token character, or a "." / ":" followed by more of a token, next to it means it is
+// part of something longer ("jdoe@contoso.com:KAROO\x" is two values joined, not one).
+const VERBATIM_BEFORE = String.raw`(?<![\p{L}\p{N}_@\\/%#+[\]&.:\-])`;
+const VERBATIM_AFTER = String.raw`(?![\p{L}\p{N}_@\\/%#+[\]&\-]|[.:][\p{L}\p{N}_@\\/%#+[\]&])`;
+// A SCHEME-SHAPED PART anywhere in a verbatim value (review of PR #12): LINKISH names six schemes, and smb:, ms-msdt:,
+// search-ms:, tel: are as much a place to send somebody. Two or more characters before the colon, so a drive letter
+// ("C:\…") is not one.
+const SCHEMEISH = /(?:^|[^\p{L}\p{N}+.-])\p{L}[\p{L}\p{N}+.-]+:/u;
+// An IP address inside a value (review of PR #12): "admin@203.0.113.5", "admin@[203.0.113.5]", "a\\203.0.113.5\share".
+const IP_PART = /(?<![\p{N}.])\d{1,3}(?:\.\d{1,3}){3}(?!\p{N})|(?<![\p{L}\p{N}:])[0-9a-f]{0,4}(?::[0-9a-f]{0,4}){2,7}(?![\p{L}\p{N}:])/iu;
+// The one backslash an ATTACKER value may carry: DOMAIN\user (review of PR #12) — never a path.
+const DOMAIN_USER = /^\p{L}[\p{L}\p{N}_-]*\\[\p{L}\p{N}_$-][\p{L}\p{N}_.$-]*$/u;
+/** May this value of a verbatim path be said whole? See VERBATIM VALUES. */
+function verbatimOk(v, fromAttacker, sayIps) {
+  if (typeof v !== 'string' || !VERBATIM_VALUE.test(v) || !VERBATIM_EXTRA.test(v)) return false;
+  if (v.normalize('NFC') !== v || readable(v) !== v) return false;
+  if (/\p{N}%/u.test(v) || SCHEMEISH.test(v)) return false;
+  if (!fromAttacker) return true;
+  if (CIDR4.test(v)) return sayIps;
+  // ATTACKER TEXT: no path ("/" never; "\" only as DOMAIN\user), no IP unless the app says IPs, a letter first, no ref, and
+  // every dotted part an internal host — the attacker-path host rule, read on the value's parts.
+  if (v.includes('/') || (v.includes('\\') && !DOMAIN_USER.test(v))) return false;
+  // AN IP INSIDE AN ADDRESS SHAPE is refused whatever sayIps says (0.2.0, from the Soc events.search adoption): sayIps
+  // means a plain IP from an IP field may be said (allowedTokens' ips), never one embedded in an @-, \- or bracketed value.
+  if (IP_PART.test(v)) return false;
+  // A numeric host after "@" — decimal or hex (admin@3405803781, admin@0xCB007105) is an IP too (round 3 of PR #12).
+  if (/@(?:\d+|0x[0-9a-f]+)(?![\p{L}\p{N}_-])/iu.test(v)) return false;
+  if (!/^\p{L}/u.test(v) || (v.match(REF_TOKEN) || []).length) return false;
+  for (const m of v.matchAll(/[\p{L}\p{N}-]+(?:\.[\p{L}\p{N}-]+)+/gu)) if (!INTERNAL_SUFFIX.test(m[0])) return false;
+  return true;
+}
+const escapeRe = (t) => t.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&');
+/** Every exact, whole occurrence of a verbatim value → the plain word "x" (values longest first). */
+function maskVerbatim(text, values) {
+  let out = text;
+  for (const v of values) out = out.replace(new RegExp(`${VERBATIM_BEFORE}${escapeRe(v)}${VERBATIM_AFTER}`, 'gu'), 'x');
+  return out;
+}
+
+/**
+ * A SMALL NUMBER WORD THAT IS A CITED FIGURE (0.1.2). "There are two open tickets [r1]" with r1's count 2 was refused as
+ * number_word — the top cause of withheld honest answers. A plain word zero–twenty or thirty–ninety standing alone (no
+ * number word, "one", "a", "and" or digits joined to it by a space or hyphen: "nine hundred", "twenty-one" stay refused),
+ * directly followed by a word that can be what is counted (not "of", "is", "." … — NOT_COUNTED), in no idiom ("zero
+ * trust", "zero day", "two factor" — IDIOM_AFTER; "Windows ten", "phase two", "tier two" — IDIOM_BEFORE), is REWRITTEN into the placeholder of the ONE figure of that value among the CITED results (figureOf: a count or an
+ * extra). No such figure, two of them, only an uncited result's, the word inside quotation marks, or the word beside a
+ * word it also stands next to in attacker text: not rewritten, so number_word refuses it. An obfuscated word (ｆｉｖｅ,
+ * fi​ve) is never rewritten: the rewrite reads the raw text, the refusal the readable one.
+ */
+const SMALL_NUMBER = Object.freeze({ zero: 0, two: 2, three: 3, four: 4, five: 5, six: 6, seven: 7, eight: 8, nine: 9, ten: 10, eleven: 11,
+  twelve: 12, thirteen: 13, fourteen: 14, fifteen: 15, sixteen: 16, seventeen: 17, eighteen: 18, nineteen: 19, twenty: 20, thirty: 30, forty: 40,
+  fifty: 50, sixty: 60, seventy: 70, eighty: 80, ninety: 90 });
+const SMALL_WORD = new RegExp(String.raw`(?<![\p{L}\p{N}_'’@\\/%#+[\]&.\-])(${Object.keys(SMALL_NUMBER).join('|')})(?![\p{L}\p{N}_'’@\\/%#+[\]&\-]|\.[\p{L}\p{N}])`, 'giu');
+const JOINED_NUMBER = new RegExp(String.raw`^(?:${Object.keys(SMALL_NUMBER).join('|')}|eleven|hundreds?|thousands?|millions?|billions?|dozens?|twice|thrice|one|a|and|\p{N}+)$`, 'iu');
+const QUOTE_PAIRS = Object.freeze([['"', '"'], ['“', '”'], ['‘', '’'], ["'", "'"]]);
+// What follows a rewritten word (review of PR #12): directly, after whitespace only, a word that can be what is counted —
+// not a function word ("two of", "ten is") — and the pair is no idiom ("zero trust", "Windows ten", "phase two").
+const NOT_COUNTED = /^(?:of|and|or|nor|to|in|on|at|is|are|was|were|be|been|being|has|have|had|the|a|an|more|less|fewer|than|times|per|percent|by|for|from|with|as|it|its|that|this|these|those|which|who|if|but|so|not|no|too|very|out|up|down|off|over|under|again|each|or|then|seconds?|minutes?|hours?|days?|weeks?|months?|years?|times?)$/i;
+// ^ A TIME SPAN is no data figure (round 3 of PR #12): "two weeks ago", "for two days", "within two hours" stay refused.
+const IDIOM_AFTER = /^(?:zero (?:trust|day|days|touch|tolerance|knowledge|click|downtime|width|configuration|sign)|two (?:factor|step|way|fa)|three (?:way))$/i;
+const IDIOM_BEFORE = /^(?:windows|win|office|ios|android|iphone|pixel|galaxy|top|version|v|level|tier|phase|step|stage|round|chapter|page|section|part|day|week|month|number|no|catch|plan|option|type|class|grade|category|priority|severity|sev)$/i;
+
 const trim = (t) => String(t).replace(/^[.:\-/]+|[.:\-/]+$/g, '');
 
+// ── 0.2.0: CLAIMS AND THE ANALYSE RULES ──────────────────────────────────────────────────────────────────────────────
+// THE WORD LISTS ARE A FLOOR, NOT A PROOF: a verdict or an all/none claim in words no list names passes the check. The
+// bench measures what slips through; review rounds widen the lists (fix round of PR #14: clean, legitimate, secure, no
+// threat, not a concern, a breach occurred, was owned; no … are, there are no …, all … resolved, got, have all been).
+/**
+ * A verdict the model may not reach on its own: it must be what an app-written text of the ROW the sentence names says
+ * (or, naming none, of the result itself or of every cited row).
+ */
+const VERDICT = /\b(compromised|breached|hacked|infected|malicious|benign|harmless|clean|legitimate|secure|false[\s_-]+positives?|true[\s_-]+positives?|under\s+attack|exfiltrated|safe|(?:was|been|got)\s+owned|(?:a\s+)?breach\s+(?:occurred|happened)|no\s+threats?|not\s+a\s+(?:threat|concern)|nothing\s+suspicious|expected\s+activity|nothing\s+to\s+worry\s+about|no\s+cause\s+for\s+concern|no\s+(?:further\s+)?action\s+(?:is\s+)?(?:needed|required))\b/giu;
+/**
+ * "ALL / NONE OF THEM ARE <state>" (review rounds of PR #14). A QUANTIFIER — all, every, each, both, everything, they,
+ * none, nothing, not one, no <noun>; or "not all" (a PARTIAL claim: at least one row is not in the state) — then, within
+ * six words, a COPULA (is, are, was, were, has/have been, remain(s), stay(s), got, became) and its COMPLEMENT: the state
+ * is the copula's complement ("every record from the closed quarter is OPEN"), never any word in between, so a state
+ * word inside a qualifier ("assigned to jdoe") is not the claim. The complement may be negated ("no longer open", "not
+ * open", "unresolved"), which flips the claim. Also: "all records resolved" (no copula, the state ending the clause),
+ * "there are no open records", "no open records remain". The state vocabulary is STATE_WORDS plus every state and
+ * synonym the cited tools declare. A claim is decided ONLY from the declared field (`stateFields`); a word no cited tool
+ * declares is refused. A qualifier between the quantifier and the copula narrows the set; the claim is evaluated over
+ * EVERY cited row — sound for all/none (true of all rows → true of any subset), and otherwise refused.
+ */
+const STATE_WORDS = Object.freeze(['resolved', 'closed', 'fixed', 'solved', 'handled', 'complete', 'completed', 'healthy', 'reporting', 'online', 'offline',
+  'patched', 'acknowledged', 'assigned', 'unassigned', 'open', 'failed', 'down', 'benign', 'malicious', 'compromised', 'safe', 'pending', 'active', 'inactive',
+  'escalated', 'expired', 'overdue', 'muted', 'paused', 'blocked', 'isolated', 'enabled', 'disabled', 'stale', 'running', 'stopped', 'unresolved']);
+const SWEEP_QUANT = /\b(not\s+all|all|every|each|both|everything|they|none|nothing|not\s+one|not\s+a\s+single|no\s+longer\s+any|neither|no(?!\s+(?:one|longer|doubt|question)\b))\b/giu;
+const SWEEP_COPULA = /^(?:are|is|were|was|have\s+been|has\s+been|(?:continues?|continued|remains?|remained)\s+to\s+be|remain|remains|stay|stays|got|get|became|become)\b/iu;
+const SWEEP_ADVERB = /^(?:now|still|already|currently|all|both|each|also|again)\b\s*/iu;
+const SWEEP_NEGATION = /^(?:no\s+longer|not|never)\b\s*/iu;
+/** The all/none/not-all claims in one flattened sentence: [{ word, polarity: 'all' | 'none' | 'notall' }]. */
+function sweepsOf(lower, vocab) {
+  const isState = (w) => vocab.has(w) || (w.startsWith('un') && vocab.has(w.slice(2)));
+  const out = [];
+  const flip = (p) => (p === 'all' ? 'none' : p === 'none' ? 'all' : 'notall');
+  for (const q of lower.matchAll(SWEEP_QUANT)) {
+    const qw = q[1].replace(/\s+/g, ' ');
+    let polarity = qw === 'not all' ? 'notall' : ['all', 'every', 'each', 'both', 'everything', 'they'].includes(qw) ? 'all' : 'none';
+    const rest = lower.slice(q.index + q[0].length).split(/[.!?;,]/)[0];
+    const words = rest.trim().split(/\s+/).filter(Boolean);
+    let found = false;
+    // <quantifier> … <copula> <complement>, the copula within six words.
+    for (let i = 0; i <= Math.min(6, words.length - 1) && !found; i += 1) {
+      const tail = words.slice(i).join(' ');
+      const cop = SWEEP_COPULA.exec(tail);
+      if (!cop) continue;
+      let comp = tail.slice(cop[0].length).trim();
+      while (SWEEP_ADVERB.test(comp)) comp = comp.replace(SWEEP_ADVERB, '');
+      let p = polarity;
+      const neg = SWEEP_NEGATION.exec(comp);
+      if (neg) { comp = comp.slice(neg[0].length); p = flip(p); }
+      const w = (comp.split(/\s+/)[0] || '').toLowerCase();
+      if (isState(w)) {
+        out.push(vocab.has(w) ? { word: w, polarity: p } : { word: w.slice(2), polarity: flip(p) });
+        found = true;
+      } else if (cop) break;   // the first copula's complement is not a state: no claim from this quantifier
+    }
+    // "all records resolved": no copula, the state ends the clause.
+    if (!found && polarity === 'all' && qw !== 'they') {
+      const m = /^((?:[\p{L}'’]+\s+){0,3})([\p{L}]+)\s*(?:now\s*)?$/u.exec(rest.trim());
+      if (m && isState(m[2]) && !SWEEP_COPULA.test(m[1])) out.push(vocab.has(m[2]) ? { word: m[2], polarity } : { word: m[2].slice(2), polarity: flip(polarity) });
+    }
+  }
+  // "there are no <state> …", "no <state> <noun> remain(s) / exist(s) / are left".
+  for (const m of lower.matchAll(/\bthere\s+(?:are|is|were|was)\s+(?:no|not\s+any)\s+([\p{L}]+)/giu)) if (isState(m[1])) out.push({ word: m[1], polarity: 'none' });
+  for (const m of lower.matchAll(/\bno\s+([\p{L}]+)\s+[\p{L}]+\s+(?:remain|remains|exist|exists|are\s+left|is\s+left)\b/giu)) if (isState(m[1])) out.push({ word: m[1], polarity: 'none' });
+  return out;
+}
+/** A conclusion, and the words that frame it as the results'. */
+const CONCLUSION = /\b(therefore|thus|hence|overall|suggests?|suggesting|indicates?|indicating|implies|implying|points?\s+to|likely|unlikely|probably|appears?\s+to|seems?\s+to|conclude[sd]?|conclusion|taken\s+together|clearly|evidently|must\s+be)\b/i;
+const FRAME = /\b(?:the|these|those|both|its|their)\s+(?:cited\s+)?(?:results?|look[\s-]?ups?|figures|records|rows|counts?)\b|\b(?:according\s+to|based\s+on|from|in)\s+(?:the\s+|these\s+)?(?:cited\s+)?(?:results?|look[\s-]?ups?)\b/i;
+/** A capitalised word: a name, unless it is an ordinary word (NAME_COMMON) or a word of the results or the question. */
+const CAPITALISED = /(?<![\p{L}\p{N}_'’-])\p{Lu}[\p{L}\p{N}'’-]*/gu;
+const NAME_COMMON = new Set(('a an the this that these those there here it its they their them we our you your i he she his her one both each every '
+  + 'all any some most many more few fewer less least several no none nothing neither nor either not only just also and or but so yet '
+  + 'if then than as at by for from in into of on onto to with within without across between among about after before since until '
+  + 'while when where which who whom whose what why how although though because however whereas meanwhile otherwise still therefore '
+  + 'thus hence overall together taken compared comparing based according looking grouped group by first second third next finally last '
+  + 'yes today tonight yesterday currently right now recently lately earlier later open new is are was were be been has have had do does '
+  + 'did can could may might must should would will shall per summary status partner partners customer customers result results '
+  + 'look lookup lookups record records row rows figure figures count counts monday tuesday wednesday thursday friday saturday sunday '
+  + 'january february march april may june july august september october november december '
+  // Discourse adverbs (fix round of PR #14).
+  + 'similarly additionally notably moreover furthermore likewise conversely instead again specifically particularly generally '
+  + 'consequently accordingly nonetheless nevertheless besides alternatively importantly interestingly unlike like contrast').split(' '));
+const wordsOf = (t) => String(t || '').normalize('NFKC').toLowerCase().split(/[^\p{L}\p{N}]+/u).filter(Boolean);
+/**
+ * The answer's sentences: split after . ! ? and at newlines. Cites opening a piece ("open. [r1] The …") belong to the
+ * sentence before; a piece with no letter (a lone cite) joins the one before.
+ */
+function sentencesOf(answer) {
+  const out = [];
+  for (let piece of String(answer).split(/(?<=[.!?])\s+|\n+/)) {
+    if (!piece.trim()) continue;
+    const lead = out.length ? /^(?:\s*\[r[1-4]\])+/.exec(piece) : null;
+    if (lead) { out[out.length - 1] += lead[0]; piece = piece.slice(lead[0].length); if (!piece.trim()) continue; }
+    const letters = /\p{L}/u.test(piece.replace(PLACEHOLDER, ' ').replace(CITE, ' '));
+    if (!letters && out.length) out[out.length - 1] += ` ${piece}`; else out.push(piece);
+  }
+  return out;
+}
+/** Lower-cased, with spaces, hyphens and underscores folded to one space ("false_positive" reads "false positive"). */
+const flat = (t) => readable(t).toLowerCase().replace(/[\s_-]+/g, ' ').trim();
+const hasPhrase = (text, phrase) => new RegExp(`(?<![\\p{L}\\p{N}])${escapeRe(phrase)}(?![\\p{L}\\p{N}])`, 'u').test(text);
+/** Does this row's value of a declared state field show the state? (strings case-blind, booleans exactly) — undefined when the row has no value. */
+function stateOf(row, def) {
+  const v = (row.fields || {})[def.field];
+  if (v === undefined || v === null || v === '') return undefined;
+  return def.values.some((x) => (typeof x === 'boolean' ? v === x : typeof v === 'string' && v.trim().toLowerCase() === String(x).toLowerCase()));
+}
+
 /** Every string of a result with its path in attackerFields' spelling (rows[].fields.entity, facts.entities[].value). */
 function stringsOf(r) {
   const out = [];
@@ -185,6 +412,16 @@ function createCheck(o = {}) {
   const rowChipLabel = typeof o.rowChipLabel === 'function' ? o.rowChipLabel : DEFAULT_ROW_CHIP;
   const sayIps = o.sayIps === true;
   const sayWindows = o.sayWindows === true;
+  // KNOWN NAMES (0.2.0): words the app says are ordinary in its answers though no result holds them (a product, "Sophos").
+  const knownNames = Object.freeze([...(o.knownNames || [])].map((n) => { if (typeof n !== 'string' || !n.trim()) throw new Error('ask check: knownNames is a list of names'); return n; }).flatMap((n) => wordsOf(n)));
+  // VERBATIM PATHS (0.1.2): a fact or a row field, in attackerFields' spelling — never a title, a label or a ref.
+  const verbatimFields = Object.freeze([...(o.verbatimFields || [])]);
+  for (const f of verbatimFields) {
+    if (typeof f !== 'string' || !/^(?:facts|rows\[\]\.fields)\.[a-z0-9_]+(?:\[\])?(?:\.[a-z0-9_]+)?$/i.test(f)) {
+      throw new Error(`ask check: verbatimFields names a fact or row-field path ('rows[].fields.upn', 'facts.entities[].value'), not ${String(f)}`);
+    }
+  }
+  const verbatimPaths = new Set([...verbatimFields, ...structured.flatMap((k) => [`facts.${k}`, `rows[].fields.${k}`])]);
 
   /**
    * The SAYABLE tokens:
@@ -201,6 +438,7 @@ function createCheck(o = {}) {
     set.numbers = new Set();
     set.ips = new Set();
     set.windows = new Set();
+    set.verbatim = new Set();
     const numeric = (v) => { if (typeof v === 'string' && /^(0(\.\d{1,3})?|1(\.0{1,3})?)$/.test(v)) set.numbers.add(v); };
     const field = (v) => {
       if (typeof v !== 'string' || !v || v.length > 64) return;
@@ -216,7 +454,7 @@ function createCheck(o = {}) {
       for (const k of numericStructured) numeric((r.facts || {})[k]);
       for (const k of idFacts) own((r.facts || {})[k]);
       for (const [path, v] of stringsOf(r)) {
-        const fromAttacker = remote || attacker.has(path);
+        const fromAttacker = remote || attacker.has(path) || SNIPPET.test(path);
         for (const w of readable(v).split(/[\s,;()"'“”‘’!?]+/)) {
           const t = trim(w);
           if (!t) continue;
@@ -225,6 +463,7 @@ function createCheck(o = {}) {
           if (!fromAttacker || isInternalHost(t)) set.add(t);
         }
         if (!fromAttacker) windows(v);
+        if (verbatimPaths.has(path) && verbatimOk(v, fromAttacker, sayIps)) set.verbatim.add(v);
       }
       windows(r.label);
       for (const x of r.extras || []) windows(x.label);
@@ -239,37 +478,250 @@ function createCheck(o = {}) {
     return set;
   }
 
+  /** Attacker text as the word rules read it, lower-cased: where a number word may be a quote. */
+  function attackerTexts(results) {
+    const out = [];
+    for (const r of results) {
+      const tool = r && r.tool ? toolOf(r.tool) : null;
+      const remote = !tool || tool.kind === 'remote';
+      const attacker = new Set(tool && !remote ? tool.attackerFields : []);
+      for (const [path, v] of stringsOf(r)) if (remote || attacker.has(path) || SNIPPET.test(path)) out.push(readable(v).toLowerCase().replace(/\s+/g, ' '));
+      for (const x of r.extras || []) if ((remote || attacker.has('extras[].label')) && typeof x.label === 'string') out.push(readable(x.label).toLowerCase().replace(/\s+/g, ' '));
+    }
+    return out;
+  }
+
+  /** SMALL NUMBER WORDS → the one cited figure of that value (see SMALL_NUMBER); anything else is left for the rules. */
+  function spellFigures(answer, cites, results) {
+    const cited = new Set([...(cites || []), ...[...answer.matchAll(CITE)].map((m) => m[1])].filter((c) => /^r[1-4]$/.test(c) && results[Number(c.slice(1)) - 1]));
+    const figures = [];
+    for (const rid of cited) {
+      const r = results[Number(rid.slice(1)) - 1];
+      if (r.help) continue;
+      if (Number.isInteger(r.count)) figures.push({ mark: `{{${rid}}}`, count: r.count });
+      for (const x of r.extras || []) if (Number.isInteger(x.count) && figureOf(results, rid, x.key)) figures.push({ mark: `{{${rid}.${x.key}}}`, count: x.count });
+    }
+    if (!figures.length) return answer;
+    let attackerText = null;
+    const has = (s, phrase) => new RegExp(`(?<![\\p{L}\\p{N}])${escapeRe(phrase)}(?![\\p{L}\\p{N}])`, 'u').test(s);
+    // An apostrophe inside a word ("it’s", "don't") is no quotation mark (review of PR #12).
+    const quoted = (raw) => {
+      const before = raw.replace(/(?<=[\p{L}\p{N}])['’](?=\p{L})/gu, '');
+      return QUOTE_PAIRS.some(([a, b]) => (a === b ? (before.split(a).length - 1) % 2 === 1 : before.lastIndexOf(a) > before.lastIndexOf(b)));
+    };
+    return answer.replace(SMALL_WORD, (w, _g, at) => {
+      const before = answer.slice(0, at);
+      const after = answer.slice(at + w.length);
+      const prevJoin = before.match(/([\p{L}\p{N}]+)[\s-]+$/u);
+      const nextJoin = after.match(/^[\s-]+([\p{L}\p{N}]+)/u);
+      if ((prevJoin && JOINED_NUMBER.test(prevJoin[1])) || (nextJoin && JOINED_NUMBER.test(nextJoin[1]))) return w;
+      if (quoted(before)) return w;
+      const lw = w.toLowerCase();
+      const counted = (after.match(/^[ \t]+(\p{L}[\p{L}'’]*)/u) || [])[1];
+      if (!counted || NOT_COUNTED.test(counted) || IDIOM_AFTER.test(`${lw} ${counted}`)) return w;
+      const prevWord = (before.match(/(\p{L}+)[ \t]+$/u) || [])[1];
+      if (prevWord && IDIOM_BEFORE.test(prevWord)) return w;
+      const prev = (before.match(/([\p{L}\p{N}_'’-]+)[^\p{L}\p{N}]*$/u) || [])[1];
+      const next = (after.match(/^[^\p{L}\p{N}]*([\p{L}\p{N}_'’-]+)/u) || [])[1];
+      attackerText = attackerText || attackerTexts(results);
+      if (attackerText.some((s) => (prev && has(s, `${prev.toLowerCase()} ${lw}`)) || (next && has(s, `${lw} ${next.toLowerCase()}`)))) return w;
+      const match = figures.filter((f) => f.count === SMALL_NUMBER[lw]);
+      return match.length === 1 ? match[0].mark : w;
+    });
+  }
+
+  /** The attacker paths of a result: its tool's attackerFields; every path of an unknown or remote tool; any snippet. */
+  function attackerOf(r) {
+    const tool = r && r.tool ? toolOf(r.tool) : null;
+    const remote = !tool || tool.kind === 'remote';
+    const attacker = new Set(tool && !remote ? tool.attackerFields : []);
+    return (path) => remote || attacker.has(path) || SNIPPET.test(path);
+  }
+  /**
+   * What the APP wrote at the RESULT level (facts, label, notes, extras' labels — no row, no attacker path), flattened. An
+   * extra whose label the app derives from an enum (a verdict or state code: `{ key, count, label, enum: true }`) is
+   * app-written even where the tool lists `extras[].label` as attacker text (fix round of PR #14: a breakdown's groups).
+   */
+  function resultAppTexts(r) {
+    const isAttacker = attackerOf(r);
+    const out = [];
+    for (const [path, v] of stringsOf(r)) if (path.startsWith('facts') && !isAttacker(path)) out.push(flat(v));
+    if (!isAttacker('label') && typeof r.label === 'string') out.push(flat(r.label));
+    // An extra marked enum counts only for a group-by key the tool declares (groupBy) and a label in its closed list.
+    const tool = r && r.tool ? toolOf(r.tool) : null;
+    const enumOk = (x) => x.enum === true && tool && tool.kind !== 'remote' && tool.groupBy && typeof x.by === 'string' && tool.groupBy[x.by]
+      && tool.groupBy[x.by].enum.some((v) => flat(v) === flat(x.label));
+    for (const x of r.extras || []) if ((enumOk(x) || !isAttacker('extras[].label')) && typeof x.label === 'string') out.push(flat(x.label));
+    for (const n of r.notes || []) if (typeof n.label === 'string') out.push(flat(n.label));
+    return out;
+  }
+  /** One row's app-written text, flattened: where a verdict about THAT row must show. */
+  function rowAppText(r, row) {
+    const isAttacker = attackerOf(r);
+    const parts = [];
+    if (!isAttacker('rows[].title') && typeof row.title === 'string') parts.push(row.title);
+    const walk = (v, path) => {
+      if (typeof v === 'string') { if (!isAttacker(path)) parts.push(v); } else if (Array.isArray(v)) v.forEach((x) => walk(x, `${path}[]`));
+      else if (v && typeof v === 'object') for (const [k, x] of Object.entries(v)) walk(x, `${path}.${k}`);
+    };
+    walk(row.fields || {}, 'rows[].fields');
+    return flat(parts.join(' '));
+  }
+  /**
+   * The rows a sentence NAMES (review round 3 of PR #14): by its ref, or by a field the tool DECLARES as the row's identity
+   * (`rowName: 'title'` or `['title', 'hostname']` — 'title' is the row's title, anything else a row field) — never by
+   * any other field, so a customer name every row shares, or a value planted in another row, names nothing.
+   */
+  function namedRows(r, sentence, lower) {
+    const tool = r && r.tool ? toolOf(r.tool) : null;
+    const names = tool && tool.kind !== 'remote' && tool.rowName ? [].concat(tool.rowName) : [];
+    return (r.rows || []).filter((row) => {
+      if (typeof row.ref === 'string' && row.ref && sentence.includes(row.ref)) return true;
+      return names.some((k) => {
+        const v = k === 'title' ? row.title : (row.fields || {})[k];
+        return typeof v === 'string' && flat(v).length >= 4 && hasPhrase(lower, flat(v));
+      });
+    });
+  }
+  /** The state words a sweep may claim: STATE_WORDS and every state and synonym the cited tools declare. */
+  function stateVocab(scope) {
+    const out = new Set(STATE_WORDS);
+    for (const r of scope) {
+      const tool = r && r.tool ? toolOf(r.tool) : null;
+      for (const [w, def] of Object.entries((tool && tool.stateFields) || {})) { out.add(w); for (const x of def.synonyms || []) out.add(x); }
+    }
+    return out;
+  }
+  /** The declared state definition a word claims in one result — the state itself, a synonym, or "un<state>" (negated). */
+  function defOf(r, word) {
+    const tool = r && r.tool ? toolOf(r.tool) : null;
+    const fields = tool && tool.kind !== 'remote' && tool.stateFields ? tool.stateFields : {};
+    for (const [w, def] of Object.entries(fields)) if (w === word || (def.synonyms || []).includes(word)) return { def, negated: false };
+    if (word.startsWith('un')) for (const [w, def] of Object.entries(fields)) if (w === word.slice(2) || (def.synonyms || []).includes(word.slice(2))) return { def, negated: true };
+    return null;
+  }
+  /** Every word a result holds, attacker text included ("every name comes from the results"), and its look-up's words. */
+  function vocabularyOf(r) {
+    const out = new Set(knownNames);
+    for (const [, v] of stringsOf(r)) for (const w of wordsOf(readable(v))) out.add(w);
+    for (const t of [r.label, r.words, ...(r.extras || []).map((x) => x.label), ...(r.notes || []).map((n) => n.label)]) for (const w of wordsOf(readable(t || ''))) out.add(w);
+    for (const row of r.rows || []) if (typeof row.ref === 'string') for (const w of wordsOf(row.ref)) out.add(w);
+    return out;
+  }
+
+  /**
+   * THE CLAIM AND ANALYSE RULES over the answer's sentences (see the header). Returns { injected, format } — the first
+   * refusal of each class (or null). EVERY sentence is read for the injection-class rules (verdict, all/none, unframed
+   * conclusion, unknown name) before any format-class refusal (uncited sentence or figure) counts, so an uncited lead
+   * sentence never hides a later obeyed one (review round 3 of PR #14). `cited` is the whole answer's cited indexes.
+   */
+  function claimRefusal(answer, results, cited, analyse, question) {
+    const qWords = new Set(wordsOf(readable(question || '')));
+    let format = null;
+    for (const sentence of sentencesOf(answer)) {
+      const own = [...new Set([...sentence.matchAll(CITE)].map((m) => Number(m[1].slice(1)) - 1))];
+      const scope = (own.length ? own : [...cited]).map((i) => results[i]).filter(Boolean);
+      const text = readable(sentence.replace(MARK_BEFORE_PUNCT, '').replace(MARK_AFTER_DOT, '').replace(PLACEHOLDER, ' ').replace(CITE, ' '));
+      const lower = flat(text);
+      // A VERDICT, PER ROW: what the app-written text of EVERY row the sentence names says; naming none, what the result
+      // itself says, or what every one of its rows says (rows that disagree settle nothing).
+      for (const m of text.matchAll(VERDICT)) {
+        const phrase = flat(m[0]);
+        const supported = scope.some((r) => {
+          const named = namedRows(r, sentence, lower);
+          if (named.length) return named.every((row) => hasPhrase(rowAppText(r, row), phrase));
+          if (resultAppTexts(r).some((t) => hasPhrase(t, phrase))) return true;
+          const rows = r.rows || [];
+          return rows.length > 0 && rows.every((row) => hasPhrase(rowAppText(r, row), phrase));
+        });
+        if (!supported) return { injected: { ok: false, code: 'unsupported_verdict', reason: `calls something “${m[0].slice(0, 30)}”, which no cited row says` }, format };
+      }
+      // ALL / NONE / NOT ALL OF THEM in a state: decided ONLY from a field the tool declares holds that state.
+      for (const claim of sweepsOf(lower, stateVocab(scope))) {
+        const holds = scope.length > 0 && scope.every((r) => {
+          const d = defOf(r, claim.word);
+          const rows = r.rows || [];
+          if (!d || !rows.length) return false;
+          const p = d.negated ? (claim.polarity === 'all' ? 'none' : claim.polarity === 'none' ? 'all' : 'notall') : claim.polarity;
+          // NOT ALL: one row that holds the field and is not in the state is enough, from any number of rows shown.
+          if (p === 'notall') return rows.some((row) => stateOf(row, d.def) === false);
+          if (Number.isInteger(r.count) && r.count !== rows.length) return false;
+          return rows.every((row) => stateOf(row, d.def) === (p === 'all'));
+        });
+        if (!holds) return { injected: { ok: false, code: 'sweeping_claim', reason: `says ${claim.polarity === 'notall' ? 'not all' : claim.polarity} of them are “${claim.word}”, which no declared state field of the cited rows shows` }, format };
+      }
+      if (!analyse) continue;
+      // ANALYSE: framed conclusions, no new names, every sentence cited, every figure from a result its sentence cites.
+      if (CONCLUSION.test(lower) && !FRAME.test(lower)) return { injected: { ok: false, code: 'unframed_conclusion', reason: 'draws a conclusion without saying it comes from the results' }, format };
+      const vocab = new Set(qWords);
+      for (const r of scope) for (const w of vocabularyOf(r)) vocab.add(w);
+      for (const m of text.matchAll(CAPITALISED)) {
+        for (const w of wordsOf(m[0])) {
+          if (w.length < 2 || /\p{N}/u.test(w) || NAME_COMMON.has(w) || vocab.has(w)) continue;
+          return { injected: { ok: false, code: 'unknown_name', reason: `names “${m[0].slice(0, 40)}”, which the cited results do not` }, format };
+        }
+      }
+      if (!format && !own.length) format = { ok: false, code: 'uncited_sentence', reason: 'a sentence cites no result' };
+      for (const m of sentence.matchAll(PLACEHOLDER)) {
+        if (!format && !own.includes(Number(m[1].slice(1)) - 1)) format = { ok: false, code: 'uncited_figure', reason: `a figure ${m[0]} from a result its sentence does not cite` };
+      }
+    }
+    return { injected: null, format };
+  }
+
   /**
    * Check one answer. Returns { ok: true, answer, cites } or { ok: false, code, reason } — `code` is one of REFUSAL_CODES.
    * @param {*} reply the model's parsed JSON
    * @param {object[]} results the look-ups' results, in order (r1 = results[0])
+   * @param {{mode?: 'lookup'|'analyse', question?: string}} [opts] 0.2.0: analyse mode, and the question its names may come from
    */
-  function checkAnswer(reply, results) {
+  function checkAnswer(reply, results, opts = {}) {
+    const analyse = opts.mode === 'analyse';
     if (!reply || typeof reply !== 'object' || Array.isArray(reply)) return { ok: false, code: 'shape', reason: 'not an object' };
     const keys = Object.keys(reply).filter((k) => !['answer', 'cites'].includes(k));
     if (keys.length) return { ok: false, code: 'shape', reason: 'unexpected fields' };
-    const answer = typeof reply.answer === 'string' ? reply.answer.trim() : '';
+    let answer = typeof reply.answer === 'string' ? reply.answer.trim() : '';
     if (!answer) return { ok: false, code: 'shape', reason: 'empty answer' };
-    if (answer.length > 700) return { ok: false, code: 'shape', reason: 'answer too long' };
+    // TOO LONG is a format refusal, applied AFTER the injection-class rules (final round of PR #14): a long obeyed answer is
+    // refused for what it obeys, not for its length.
+    const tooLong = answer.length > 700;
     if (!Array.isArray(reply.cites) || reply.cites.some((c) => typeof c !== 'string')) return { ok: false, code: 'shape', reason: 'cites is not a list of ids' };
     if (/[\u0000-\u0008\u000b-\u001f\u007f]/.test(answer)) return { ok: false, code: 'control_chars', reason: 'control characters' };
 
-    for (const c of reply.cites) if (!/^r[1-4]$/.test(c) || !results[Number(c.slice(1)) - 1]) return { ok: false, code: 'unknown_cite', reason: `cites ${String(c).slice(0, 8)}, which no look-up returned` };
-    for (const m of answer.matchAll(CITE)) if (!results[Number(m[1].slice(1)) - 1]) return { ok: false, code: 'unknown_cite', reason: `cites ${m[1]}, which no look-up returned` };
-    for (const m of answer.matchAll(PLACEHOLDER)) if (!figureOf(results, m[1], m[2])) return { ok: false, code: 'unknown_figure', reason: `a figure ${m[0]} no look-up returned` };
+    // INJECTION-CLASS RULES FIRST (review round 3 of PR #14): a FORMAT refusal found on the way (an unknown cite or figure,
+    // a malformed placeholder, a number word) is kept, not returned, until every link, obeyed and claim rule has read the
+    // whole answer — so a format slip never hides an obeyed sentence.
+    let fmt = null;
+    const later = (code, reason) => { if (!fmt) fmt = { ok: false, code, reason }; };
+    for (const c of reply.cites) if (!/^r[1-4]$/.test(c) || !results[Number(c.slice(1)) - 1]) later('unknown_cite', `cites ${String(c).slice(0, 8)}, which no look-up returned`);
+    for (const m of answer.matchAll(CITE)) if (!results[Number(m[1].slice(1)) - 1]) later('unknown_cite', `cites ${m[1]}, which no look-up returned`);
+    const knownCites = reply.cites.filter((c) => /^r[1-4]$/.test(c) && results[Number(c.slice(1)) - 1]);
+    answer = spellFigures(answer, knownCites, results);
+    for (const m of answer.matchAll(PLACEHOLDER)) if (!figureOf(results, m[1], m[2])) later('unknown_figure', `a figure ${m[0]} no look-up returned`);
     const bare = answer.replace(MARK_BEFORE_PUNCT, '').replace(MARK_AFTER_DOT, '').replace(PLACEHOLDER, ' ').replace(CITE, ' ');
-    if (/[{}]/.test(bare)) return { ok: false, code: 'bad_placeholder', reason: 'a malformed figure placeholder' };
+    if (/[{}]/.test(bare)) later('bad_placeholder', 'a malformed figure placeholder');
     // NFKC, other full stops and NO format characters for the word rules: what the person would read.
     const norm = readable(bare);
-    const allowed = allowedTokens(results);
-    if (LINKISH.test(norm)) return { ok: false, code: 'link', reason: 'a link or markup' };
-    for (const m of norm.matchAll(DOMAINISH)) {
+    const cited = new Set([...knownCites, ...[...answer.matchAll(CITE)].map((m) => m[1])].map((c) => Number(c.slice(1)) - 1).filter((i) => results[i]));
+    // ANALYSE: what may be typed is what the CITED results returned.
+    const allowed = allowedTokens(analyse ? results.filter((_, i) => cited.has(i)) : results);
+    if (LINKISH.test(norm) || DANGEROUS_SCHEME.test(norm)) return { ok: false, code: 'link', reason: 'a link or markup' };
+    // VERBATIM SPANS read as one plain word by DOMAINISH, the token rules and the allow-list (and by nothing else).
+    const verbatim = [...allowed.verbatim].sort((a, b) => b.length - a.length);
+    const normV = maskVerbatim(norm, verbatim);
+    const rawV = maskVerbatim(bare.normalize('NFC'), verbatim);
+    for (const m of normV.matchAll(DOMAINISH)) {
       const d = m[0];
       if (d.includes('/') || !(INTERNAL_SUFFIX.test(d) || allowed.has(trim(d)))) return { ok: false, code: 'link', reason: 'a link or markup' };
     }
     const word = NUMBER_WORD.exec(norm);
-    if (word) return { ok: false, code: 'number_word', reason: `writes the number “${word[0]}” instead of a figure placeholder` };
+    if (word) later('number_word', `writes the number “${word[0]}” instead of a figure placeholder`);
     for (const [re, why, code] of OBEYED) if (re.test(norm)) return { ok: false, code, reason: why };
+    const claim = claimRefusal(answer, results, cited, analyse, opts.question);
+    if (claim.injected) return claim.injected;
+    if (tooLong) return { ok: false, code: 'shape', reason: 'answer too long' };
+    if (fmt) return fmt;
+    if (claim.format) return claim.format;
 
     const named = (x) => {
       let y = x;
@@ -279,7 +731,7 @@ function createCheck(o = {}) {
     };
     // BOTH READINGS: the raw text keeps a Roman numeral (Ⅸ — NFKC makes it the letters IX), the readable one joins what
     // a format character split.
-    for (const src of [bare, norm].map(named)) {
+    for (const src of [rawV, normV].map(named)) {
       for (const t of src.match(REF_TOKEN) || []) {
         if (!allowed.has(t)) return { ok: false, code: 'unknown_ref', reason: `names “${t.slice(0, 40)}”, which is not an id a look-up returned` };
       }
@@ -291,7 +743,7 @@ function createCheck(o = {}) {
         if (tok && /\p{N}/u.test(tok) && !allowed.has(tok) && !(HOSTLIKE.test(tok) && INTERNAL_SUFFIX.test(tok))) return { ok: false, code: 'unknown_token', reason: `states “${tok.slice(0, 40)}”, which no look-up returned as an id, a field or a host` };
       }
     }
-    for (const ch of bare.normalize('NFC')) {
+    for (const ch of rawV) {
       if (!ALLOWED_CHAR.test(ch)) return { ok: false, code: 'disallowed_char', reason: `a character outside the allowed set (U+${ch.codePointAt(0).toString(16).toUpperCase().padStart(4, '0')})` };
     }
     return { ok: true, answer, cites: [...new Set(reply.cites)] };
@@ -339,7 +791,7 @@ function createCheck(o = {}) {
     return chips;
   }
 
-  const config = Object.freeze({ structured, numericStructured, sayableIdFields: { facts: idFacts, rows: idRows }, sayIps, sayWindows,
+  const config = Object.freeze({ structured, numericStructured, verbatimFields, sayableIdFields: { facts: idFacts, rows: idRows }, sayIps, sayWindows, knownNames,
     namedTokens: namedTokens.map(([re, to]) => [String(re), String(to)]) });
   /**
    * WHAT DECIDES A VERDICT (review H3 of PR #9): the rule sources and this app's config, including its id test and row-chip
@@ -350,8 +802,10 @@ function createCheck(o = {}) {
 }
 
 /** Every module-level rule and helper a verdict depends on, as text (with createCheck's own source). */
-const RULE_SOURCES = [PLACEHOLDER, CITE, DIGIT_TOKEN, PURE_NUMBER, REF_TOKEN, HOSTLIKE, LINKISH, DOMAINISH, INTERNAL_SUFFIX, NUMBER_WORD, IPV4, IPV6, WINDOW,
-  MARK_BEFORE_PUNCT, MARK_AFTER_DOT, INVISIBLE, OTHER_DOTS, BRACKETED_DOT, SPELLED_DOT, SPACED_DOT, ALLOWED_CHAR, ...OBEYED.map(([re, why, code]) => `${re}|${why}|${code}`), REFUSAL_CODES.join(','),
-  unitOf, isInternalHost, readable, trim, stringsOf, figureOf, segmentsOf, helpChips, createCheck].map(String);
+const RULE_SOURCES = [PLACEHOLDER, CITE, DIGIT_TOKEN, PURE_NUMBER, REF_TOKEN, HOSTLIKE, LINKISH, DANGEROUS_SCHEME, DOMAINISH, INTERNAL_SUFFIX, NUMBER_WORD, IPV4, IPV6, WINDOW,
+  MARK_BEFORE_PUNCT, MARK_AFTER_DOT, VERBATIM_EXTRA, VERBATIM_VALUE, CIDR4, VERBATIM_BEFORE, VERBATIM_AFTER, SCHEMEISH, IP_PART, DOMAIN_USER, SMALL_WORD, JOINED_NUMBER, NOT_COUNTED, IDIOM_AFTER, IDIOM_BEFORE, JSON.stringify(SMALL_NUMBER),
+  JSON.stringify(QUOTE_PAIRS), INVISIBLE, OTHER_DOTS, BRACKETED_DOT, SPELLED_DOT, SPACED_DOT, ALLOWED_CHAR, ...OBEYED.map(([re, why, code]) => `${re}|${why}|${code}`), REFUSAL_CODES.join(','),
+  SNIPPET, VERDICT, STATE_WORDS.join(' '), SWEEP_QUANT, SWEEP_COPULA, SWEEP_ADVERB, SWEEP_NEGATION, sweepsOf, CONCLUSION, FRAME, CAPITALISED, [...NAME_COMMON].join(' '),
+  unitOf, isInternalHost, readable, verbatimOk, escapeRe, maskVerbatim, trim, wordsOf, sentencesOf, flat, hasPhrase, stateOf, stringsOf, figureOf, segmentsOf, helpChips, createCheck].map(String);
 
-module.exports = { createCheck, REFUSAL_CODES, NUMBER_WORD, REF_TOKEN, PLACEHOLDER, LINKISH, segmentsOf, figureOf, stringsOf, readable };
+module.exports = { createCheck, REFUSAL_CODES, NUMBER_WORD, REF_TOKEN, PLACEHOLDER, LINKISH, VERDICT, segmentsOf, figureOf, stringsOf, readable, sentencesOf };