@aria-framework/ask 0.1.2 → 0.2.0

package/lib/check.js

@@ -33,6 +33,22 @@
  *   - claims something was done, asks the person to sign in again, speaks of another partner, or talks about its
  *     instructions or the document.
  *
+ * CLAIMS (0.2.0, every answer): a VERDICT (compromised, malicious, benign, safe, a false positive, "no action needed" …) is
+ * refused unless an APP-WRITTEN field of a cited result says it (`unsupported_verdict`); an ALL/NONE claim about a state
+ * ("all of them are resolved", "none are open") is refused unless every row of the cited result shows it — and the result
+ * returned all its rows (`sweeping_claim`).
+ *
+ * ANALYSE MODE (0.2.0, `checkAnswer(reply, results, { mode: 'analyse', question })` — the plan's intent was analyse): the
+ * answer may group, compare and conclude, and is held to, per sentence:
+ *   - it cites at least one result as [rN] (`uncited_sentence`), and every placeholder in it names a result it cites
+ *     (`uncited_figure`);
+ *   - a conclusion ("suggests", "likely", "therefore", "overall" …) says it comes from the results ("the results show",
+ *     "based on these results") (`unframed_conclusion`);
+ *   - every capitalised name in it is a word of the results it cites or of the question (`unknown_name`) — no new entity;
+ * and, over the whole answer, every typed id, host, value or number is one the CITED results returned (the sayable set is
+ * built from the cited results only). The obeyed phrasings (claimed actions, sign-in, other partners, instructions) apply
+ * as in every answer.
+ *
  * THIS IS A FLOOR, NOT A PROOF. It stops the obeyed shapes the tests name and the bench measures. What it guarantees is
  * that Ask cannot act, cannot invent a figure the page draws, and cannot link anywhere.
  */
@@ -59,17 +75,27 @@ const LINKISH = /(https?:|ftp:|mailto:|javascript:|data:|file:|www\.|<\s*[a-z!/]
 // open" and "Shell: bash" are prose (a space follows the colon).
 const DANGEROUS_SCHEME = /(?<![\p{L}\p{N}-])(?:ms-[a-z-]+|search-ms|smb|cifs|nfs|afp|webdav|tel|sip|sips|callto|skype|msteams|zoommtg|zoomus|vnc|rdp|ssh|telnet|sftp|ldaps?|vbscript|mhtml|mk|its|jar|shell|intent|vscode|microsoft-edge|onenote|steam):(?=\S)/iu;
 const DOMAINISH = /(?<![\p{L}\p{N}])[\p{L}\p{N}-]+(?:\.[\p{L}\p{N}-]+)*\.\p{L}{2,}(?:\/[^\s]*)?(?![\p{L}\p{N}])/gu;
+// A SNIPPET (0.2.0, lib/text.js) is attacker text on any path ending in .snippet, whether or not the tool lists it.
+const SNIPPET = /(?:^|\.)snippet$/;
 const INTERNAL_SUFFIX = /\.(local|lan|internal|corp|home\.arpa|localdomain)$/i;
 const NUMBER_WORD = /\b(zero|two|three|four|five|six|seven|eight|nine|ten|eleven|twelve|thirteen|fourteen|fifteen|sixteen|seventeen|eighteen|nineteen|twenty|thirty|forty|fifty|sixty|seventy|eighty|ninety|hundreds?|thousands?|millions?|billions?|dozens?|twice|thrice)\b/i;
 // What an obeyed instruction says — SCOPED to that, not to the vocabulary a security answer is made of ("sign-in attempts",
 // "password spray"). Widened in review L of PR #9: up to two adverbs ("I have now closed it"), "was closed by me", "log
-// back in", "re-enter it at the login page", other tenants or resellers, "my rules".
+// back in", "re-enter it at the login page", other tenants or resellers, "my rules". 0.2.0 (the Noc adoption): the network and
+// device verbs — restarted, rebooted, muted, paused, (un)blocked, isolated, quarantined, disconnected, shut down, reset,
+// acknowledged — in the same first-person, "has been … as/by" and "… by me/us" shapes. A device that "restarted at 03:10"
+// in the data is not a claim.
 const OBEYED = [
   // "I/we" and the verb with up to two words between ("I have now closed", "we've quietly removed", "I have't yet sent").
-  [/\b(i|we)\s+(?:[\p{L}'’]+\s+){0,2}(closed|deleted|removed|assigned|resolved|approved|disabled|enabled|changed|updated|sent|marked|escalated|acknowledged|archived|reset|purged|wiped)\b/iu, 'claims to have done something', 'claims_action'],
-  [/\b(has|have)\s+been\s+(closed|deleted|removed|resolved|approved|disabled|marked|purged|wiped)\s+(as|by)\b/i, 'claims something was done', 'claims_action'],
+  // An OBSERVATION ("we saw it restarted", "I noticed it was blocked") is not a claim: no seeing verb between (final round).
+  [/\b(i|we)\s+(?:(?!(?:saw|see|sees|seen|noticed|notice|found|find|observed|observe|watched|spotted)\b)[\p{L}'’]+\s+){0,2}(closed|deleted|removed|assigned|resolved|approved|disabled|enabled|changed|updated|sent|marked|escalated|acknowledged|archived|reset|purged|wiped|restarted|rebooted|muted|unmuted|paused|resumed|blocked|unblocked|isolated|quarantined|disconnected|shut\s+down|reset|acknowledged)\b/iu, 'claims to have done something', 'claims_action'],
+  [/\b(has|have)\s+been\s+(closed|deleted|removed|resolved|approved|disabled|marked|purged|wiped|restarted|rebooted|muted|unmuted|paused|resumed|blocked|unblocked|isolated|quarantined|disconnected|shut\s+down|reset|acknowledged)\s+(as|by)\b/i, 'claims something was done', 'claims_action'],
+  // Done FOR the person ("The firewall was restarted for you"), and "Done:" with a change after it ("Done: the host is
+  // now isolated") — final round of PR #14.
+  [/\b(closed|deleted|removed|assigned|resolved|approved|disabled|enabled|changed|updated|sent|marked|escalated|acknowledged|archived|reset|purged|wiped|restarted|rebooted|muted|unmuted|paused|resumed|blocked|unblocked|isolated|quarantined|disconnected|shut\s+down)\s+for\s+you\b/i, 'claims something was done for the person', 'claims_action'],
+  [/\bdone\s*[:!—–-]\s*[^.]{0,80}?\b(closed|deleted|removed|assigned|resolved|approved|disabled|enabled|changed|updated|sent|marked|escalated|acknowledged|archived|reset|purged|wiped|restarted|rebooted|muted|unmuted|paused|resumed|blocked|unblocked|isolated|quarantined|disconnected|shut\s+down)\b/i, 'claims something was done', 'claims_action'],
   // The verb "by me / us", however it is introduced ("closed by me", "It was resolved by us").
-  [/\b(closed|deleted|removed|assigned|resolved|approved|disabled|enabled|changed|updated|sent|marked|escalated|acknowledged|archived|reset|purged|wiped)\s+by\s+(me|us|the\s+assistant)\b/i, 'claims something was done', 'claims_action'],
+  [/\b(closed|deleted|removed|assigned|resolved|approved|disabled|enabled|changed|updated|sent|marked|escalated|acknowledged|archived|reset|purged|wiped|restarted|rebooted|muted|unmuted|paused|resumed|blocked|unblocked|isolated|quarantined|disconnected|shut\s+down|reset|acknowledged)\s+by\s+(me|us|the\s+assistant)\b/i, 'claims something was done', 'claims_action'],
   [/\b(were|was|been)\s+(deleted|removed|wiped|purged|erased)\b/i, 'claims something was deleted', 'claims_action'],
   [/\b(sign|log)\s?-?\s?(in|on)\s+(again|at|here|now|to\s+continue|to\s+restore)\b|\b(sign|log)\s+back\s+(in|on)\b|\b(enter|re-?enter|confirm|reset|verify)\s+your\s+(password|credentials?|login)\b|\bre-?enter\b[^.]{0,40}\b(log-?in|sign-?in)\s+page\b|\bsession\s+(has\s+)?expired\b/i, 'sends the person to sign in', 'sign_in'],
   [/\b(other|another)\s+(partners?|tenants?|resellers?)\b|\bevery\s+other\s+(partner|tenant)\b/i, 'speaks of another partner', 'other_partner'],
@@ -102,7 +128,9 @@ const readable = (t) => String(t).normalize('NFKC').replace(INVISIBLE, '').repla
 
 /** Every refusal code checkAnswer can return. */
 const REFUSAL_CODES = Object.freeze(['shape', 'control_chars', 'unknown_cite', 'unknown_figure', 'bad_placeholder', 'link', 'number_word', 'claims_action',
-  'sign_in', 'other_partner', 'instructions', 'unknown_ref', 'typed_number', 'unknown_token', 'disallowed_char']);
+  'sign_in', 'other_partner', 'instructions', 'unknown_ref', 'typed_number', 'unknown_token', 'disallowed_char',
+  // 0.2.0: claims (every answer) and the analyse rules.
+  'unsupported_verdict', 'sweeping_claim', 'uncited_sentence', 'uncited_figure', 'unframed_conclusion', 'unknown_name']);
 
 /**
  * THE MODEL'S OWN TEXT IS ALLOW-LISTED (the coordinator's round on PR #9, the same list as the soc AI-brief check): after
@@ -161,11 +189,13 @@ function verbatimOk(v, fromAttacker, sayIps) {
   // ATTACKER TEXT: no path ("/" never; "\" only as DOMAIN\user), no IP unless the app says IPs, a letter first, no ref, and
   // every dotted part an internal host — the attacker-path host rule, read on the value's parts.
   if (v.includes('/') || (v.includes('\\') && !DOMAIN_USER.test(v))) return false;
-  if (!sayIps && IP_PART.test(v)) return false;
+  // AN IP INSIDE AN ADDRESS SHAPE is refused whatever sayIps says (0.2.0, from the Soc events.search adoption): sayIps
+  // means a plain IP from an IP field may be said (allowedTokens' ips), never one embedded in an @-, \- or bracketed value.
+  if (IP_PART.test(v)) return false;
   // A numeric host after "@" — decimal or hex (admin@3405803781, admin@0xCB007105) is an IP too (round 3 of PR #12).
   if (/@(?:\d+|0x[0-9a-f]+)(?![\p{L}\p{N}_-])/iu.test(v)) return false;
   if (!/^\p{L}/u.test(v) || (v.match(REF_TOKEN) || []).length) return false;
-  for (const m of v.matchAll(/[\p{L}\p{N}-]+(?:\.[\p{L}\p{N}-]+)+/gu)) if (!INTERNAL_SUFFIX.test(m[0]) && !(sayIps && IPV4.test(m[0]))) return false;
+  for (const m of v.matchAll(/[\p{L}\p{N}-]+(?:\.[\p{L}\p{N}-]+)+/gu)) if (!INTERNAL_SUFFIX.test(m[0])) return false;
   return true;
 }
 const escapeRe = (t) => t.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&');
@@ -201,6 +231,115 @@ const IDIOM_BEFORE = /^(?:windows|win|office|ios|android|iphone|pixel|galaxy|top
 
 const trim = (t) => String(t).replace(/^[.:\-/]+|[.:\-/]+$/g, '');
 
+// ── 0.2.0: CLAIMS AND THE ANALYSE RULES ──────────────────────────────────────────────────────────────────────────────
+// THE WORD LISTS ARE A FLOOR, NOT A PROOF: a verdict or an all/none claim in words no list names passes the check. The
+// bench measures what slips through; review rounds widen the lists (fix round of PR #14: clean, legitimate, secure, no
+// threat, not a concern, a breach occurred, was owned; no … are, there are no …, all … resolved, got, have all been).
+/**
+ * A verdict the model may not reach on its own: it must be what an app-written text of the ROW the sentence names says
+ * (or, naming none, of the result itself or of every cited row).
+ */
+const VERDICT = /\b(compromised|breached|hacked|infected|malicious|benign|harmless|clean|legitimate|secure|false[\s_-]+positives?|true[\s_-]+positives?|under\s+attack|exfiltrated|safe|(?:was|been|got)\s+owned|(?:a\s+)?breach\s+(?:occurred|happened)|no\s+threats?|not\s+a\s+(?:threat|concern)|nothing\s+suspicious|expected\s+activity|nothing\s+to\s+worry\s+about|no\s+cause\s+for\s+concern|no\s+(?:further\s+)?action\s+(?:is\s+)?(?:needed|required))\b/giu;
+/**
+ * "ALL / NONE OF THEM ARE <state>" (review rounds of PR #14). A QUANTIFIER — all, every, each, both, everything, they,
+ * none, nothing, not one, no <noun>; or "not all" (a PARTIAL claim: at least one row is not in the state) — then, within
+ * six words, a COPULA (is, are, was, were, has/have been, remain(s), stay(s), got, became) and its COMPLEMENT: the state
+ * is the copula's complement ("every record from the closed quarter is OPEN"), never any word in between, so a state
+ * word inside a qualifier ("assigned to jdoe") is not the claim. The complement may be negated ("no longer open", "not
+ * open", "unresolved"), which flips the claim. Also: "all records resolved" (no copula, the state ending the clause),
+ * "there are no open records", "no open records remain". The state vocabulary is STATE_WORDS plus every state and
+ * synonym the cited tools declare. A claim is decided ONLY from the declared field (`stateFields`); a word no cited tool
+ * declares is refused. A qualifier between the quantifier and the copula narrows the set; the claim is evaluated over
+ * EVERY cited row — sound for all/none (true of all rows → true of any subset), and otherwise refused.
+ */
+const STATE_WORDS = Object.freeze(['resolved', 'closed', 'fixed', 'solved', 'handled', 'complete', 'completed', 'healthy', 'reporting', 'online', 'offline',
+  'patched', 'acknowledged', 'assigned', 'unassigned', 'open', 'failed', 'down', 'benign', 'malicious', 'compromised', 'safe', 'pending', 'active', 'inactive',
+  'escalated', 'expired', 'overdue', 'muted', 'paused', 'blocked', 'isolated', 'enabled', 'disabled', 'stale', 'running', 'stopped', 'unresolved']);
+const SWEEP_QUANT = /\b(not\s+all|all|every|each|both|everything|they|none|nothing|not\s+one|not\s+a\s+single|no\s+longer\s+any|neither|no(?!\s+(?:one|longer|doubt|question)\b))\b/giu;
+const SWEEP_COPULA = /^(?:are|is|were|was|have\s+been|has\s+been|(?:continues?|continued|remains?|remained)\s+to\s+be|remain|remains|stay|stays|got|get|became|become)\b/iu;
+const SWEEP_ADVERB = /^(?:now|still|already|currently|all|both|each|also|again)\b\s*/iu;
+const SWEEP_NEGATION = /^(?:no\s+longer|not|never)\b\s*/iu;
+/** The all/none/not-all claims in one flattened sentence: [{ word, polarity: 'all' | 'none' | 'notall' }]. */
+function sweepsOf(lower, vocab) {
+  const isState = (w) => vocab.has(w) || (w.startsWith('un') && vocab.has(w.slice(2)));
+  const out = [];
+  const flip = (p) => (p === 'all' ? 'none' : p === 'none' ? 'all' : 'notall');
+  for (const q of lower.matchAll(SWEEP_QUANT)) {
+    const qw = q[1].replace(/\s+/g, ' ');
+    let polarity = qw === 'not all' ? 'notall' : ['all', 'every', 'each', 'both', 'everything', 'they'].includes(qw) ? 'all' : 'none';
+    const rest = lower.slice(q.index + q[0].length).split(/[.!?;,]/)[0];
+    const words = rest.trim().split(/\s+/).filter(Boolean);
+    let found = false;
+    // <quantifier> … <copula> <complement>, the copula within six words.
+    for (let i = 0; i <= Math.min(6, words.length - 1) && !found; i += 1) {
+      const tail = words.slice(i).join(' ');
+      const cop = SWEEP_COPULA.exec(tail);
+      if (!cop) continue;
+      let comp = tail.slice(cop[0].length).trim();
+      while (SWEEP_ADVERB.test(comp)) comp = comp.replace(SWEEP_ADVERB, '');
+      let p = polarity;
+      const neg = SWEEP_NEGATION.exec(comp);
+      if (neg) { comp = comp.slice(neg[0].length); p = flip(p); }
+      const w = (comp.split(/\s+/)[0] || '').toLowerCase();
+      if (isState(w)) {
+        out.push(vocab.has(w) ? { word: w, polarity: p } : { word: w.slice(2), polarity: flip(p) });
+        found = true;
+      } else if (cop) break;   // the first copula's complement is not a state: no claim from this quantifier
+    }
+    // "all records resolved": no copula, the state ends the clause.
+    if (!found && polarity === 'all' && qw !== 'they') {
+      const m = /^((?:[\p{L}'’]+\s+){0,3})([\p{L}]+)\s*(?:now\s*)?$/u.exec(rest.trim());
+      if (m && isState(m[2]) && !SWEEP_COPULA.test(m[1])) out.push(vocab.has(m[2]) ? { word: m[2], polarity } : { word: m[2].slice(2), polarity: flip(polarity) });
+    }
+  }
+  // "there are no <state> …", "no <state> <noun> remain(s) / exist(s) / are left".
+  for (const m of lower.matchAll(/\bthere\s+(?:are|is|were|was)\s+(?:no|not\s+any)\s+([\p{L}]+)/giu)) if (isState(m[1])) out.push({ word: m[1], polarity: 'none' });
+  for (const m of lower.matchAll(/\bno\s+([\p{L}]+)\s+[\p{L}]+\s+(?:remain|remains|exist|exists|are\s+left|is\s+left)\b/giu)) if (isState(m[1])) out.push({ word: m[1], polarity: 'none' });
+  return out;
+}
+/** A conclusion, and the words that frame it as the results'. */
+const CONCLUSION = /\b(therefore|thus|hence|overall|suggests?|suggesting|indicates?|indicating|implies|implying|points?\s+to|likely|unlikely|probably|appears?\s+to|seems?\s+to|conclude[sd]?|conclusion|taken\s+together|clearly|evidently|must\s+be)\b/i;
+const FRAME = /\b(?:the|these|those|both|its|their)\s+(?:cited\s+)?(?:results?|look[\s-]?ups?|figures|records|rows|counts?)\b|\b(?:according\s+to|based\s+on|from|in)\s+(?:the\s+|these\s+)?(?:cited\s+)?(?:results?|look[\s-]?ups?)\b/i;
+/** A capitalised word: a name, unless it is an ordinary word (NAME_COMMON) or a word of the results or the question. */
+const CAPITALISED = /(?<![\p{L}\p{N}_'’-])\p{Lu}[\p{L}\p{N}'’-]*/gu;
+const NAME_COMMON = new Set(('a an the this that these those there here it its they their them we our you your i he she his her one both each every '
+  + 'all any some most many more few fewer less least several no none nothing neither nor either not only just also and or but so yet '
+  + 'if then than as at by for from in into of on onto to with within without across between among about after before since until '
+  + 'while when where which who whom whose what why how although though because however whereas meanwhile otherwise still therefore '
+  + 'thus hence overall together taken compared comparing based according looking grouped group by first second third next finally last '
+  + 'yes today tonight yesterday currently right now recently lately earlier later open new is are was were be been has have had do does '
+  + 'did can could may might must should would will shall per summary status partner partners customer customers result results '
+  + 'look lookup lookups record records row rows figure figures count counts monday tuesday wednesday thursday friday saturday sunday '
+  + 'january february march april may june july august september october november december '
+  // Discourse adverbs (fix round of PR #14).
+  + 'similarly additionally notably moreover furthermore likewise conversely instead again specifically particularly generally '
+  + 'consequently accordingly nonetheless nevertheless besides alternatively importantly interestingly unlike like contrast').split(' '));
+const wordsOf = (t) => String(t || '').normalize('NFKC').toLowerCase().split(/[^\p{L}\p{N}]+/u).filter(Boolean);
+/**
+ * The answer's sentences: split after . ! ? and at newlines. Cites opening a piece ("open. [r1] The …") belong to the
+ * sentence before; a piece with no letter (a lone cite) joins the one before.
+ */
+function sentencesOf(answer) {
+  const out = [];
+  for (let piece of String(answer).split(/(?<=[.!?])\s+|\n+/)) {
+    if (!piece.trim()) continue;
+    const lead = out.length ? /^(?:\s*\[r[1-4]\])+/.exec(piece) : null;
+    if (lead) { out[out.length - 1] += lead[0]; piece = piece.slice(lead[0].length); if (!piece.trim()) continue; }
+    const letters = /\p{L}/u.test(piece.replace(PLACEHOLDER, ' ').replace(CITE, ' '));
+    if (!letters && out.length) out[out.length - 1] += ` ${piece}`; else out.push(piece);
+  }
+  return out;
+}
+/** Lower-cased, with spaces, hyphens and underscores folded to one space ("false_positive" reads "false positive"). */
+const flat = (t) => readable(t).toLowerCase().replace(/[\s_-]+/g, ' ').trim();
+const hasPhrase = (text, phrase) => new RegExp(`(?<![\\p{L}\\p{N}])${escapeRe(phrase)}(?![\\p{L}\\p{N}])`, 'u').test(text);
+/** Does this row's value of a declared state field show the state? (strings case-blind, booleans exactly) — undefined when the row has no value. */
+function stateOf(row, def) {
+  const v = (row.fields || {})[def.field];
+  if (v === undefined || v === null || v === '') return undefined;
+  return def.values.some((x) => (typeof x === 'boolean' ? v === x : typeof v === 'string' && v.trim().toLowerCase() === String(x).toLowerCase()));
+}
+
 /** Every string of a result with its path in attackerFields' spelling (rows[].fields.entity, facts.entities[].value). */
 function stringsOf(r) {
   const out = [];
@@ -273,6 +412,8 @@ function createCheck(o = {}) {
   const rowChipLabel = typeof o.rowChipLabel === 'function' ? o.rowChipLabel : DEFAULT_ROW_CHIP;
   const sayIps = o.sayIps === true;
   const sayWindows = o.sayWindows === true;
+  // KNOWN NAMES (0.2.0): words the app says are ordinary in its answers though no result holds them (a product, "Sophos").
+  const knownNames = Object.freeze([...(o.knownNames || [])].map((n) => { if (typeof n !== 'string' || !n.trim()) throw new Error('ask check: knownNames is a list of names'); return n; }).flatMap((n) => wordsOf(n)));
   // VERBATIM PATHS (0.1.2): a fact or a row field, in attackerFields' spelling — never a title, a label or a ref.
   const verbatimFields = Object.freeze([...(o.verbatimFields || [])]);
   for (const f of verbatimFields) {
@@ -313,7 +454,7 @@ function createCheck(o = {}) {
       for (const k of numericStructured) numeric((r.facts || {})[k]);
       for (const k of idFacts) own((r.facts || {})[k]);
       for (const [path, v] of stringsOf(r)) {
-        const fromAttacker = remote || attacker.has(path);
+        const fromAttacker = remote || attacker.has(path) || SNIPPET.test(path);
         for (const w of readable(v).split(/[\s,;()"'“”‘’!?]+/)) {
           const t = trim(w);
           if (!t) continue;
@@ -344,7 +485,7 @@ function createCheck(o = {}) {
       const tool = r && r.tool ? toolOf(r.tool) : null;
       const remote = !tool || tool.kind === 'remote';
       const attacker = new Set(tool && !remote ? tool.attackerFields : []);
-      for (const [path, v] of stringsOf(r)) if (remote || attacker.has(path)) out.push(readable(v).toLowerCase().replace(/\s+/g, ' '));
+      for (const [path, v] of stringsOf(r)) if (remote || attacker.has(path) || SNIPPET.test(path)) out.push(readable(v).toLowerCase().replace(/\s+/g, ' '));
       for (const x of r.extras || []) if ((remote || attacker.has('extras[].label')) && typeof x.label === 'string') out.push(readable(x.label).toLowerCase().replace(/\s+/g, ' '));
     }
     return out;
@@ -389,30 +530,181 @@ function createCheck(o = {}) {
     });
   }
 
+  /** The attacker paths of a result: its tool's attackerFields; every path of an unknown or remote tool; any snippet. */
+  function attackerOf(r) {
+    const tool = r && r.tool ? toolOf(r.tool) : null;
+    const remote = !tool || tool.kind === 'remote';
+    const attacker = new Set(tool && !remote ? tool.attackerFields : []);
+    return (path) => remote || attacker.has(path) || SNIPPET.test(path);
+  }
+  /**
+   * What the APP wrote at the RESULT level (facts, label, notes, extras' labels — no row, no attacker path), flattened. An
+   * extra whose label the app derives from an enum (a verdict or state code: `{ key, count, label, enum: true }`) is
+   * app-written even where the tool lists `extras[].label` as attacker text (fix round of PR #14: a breakdown's groups).
+   */
+  function resultAppTexts(r) {
+    const isAttacker = attackerOf(r);
+    const out = [];
+    for (const [path, v] of stringsOf(r)) if (path.startsWith('facts') && !isAttacker(path)) out.push(flat(v));
+    if (!isAttacker('label') && typeof r.label === 'string') out.push(flat(r.label));
+    // An extra marked enum counts only for a group-by key the tool declares (groupBy) and a label in its closed list.
+    const tool = r && r.tool ? toolOf(r.tool) : null;
+    const enumOk = (x) => x.enum === true && tool && tool.kind !== 'remote' && tool.groupBy && typeof x.by === 'string' && tool.groupBy[x.by]
+      && tool.groupBy[x.by].enum.some((v) => flat(v) === flat(x.label));
+    for (const x of r.extras || []) if ((enumOk(x) || !isAttacker('extras[].label')) && typeof x.label === 'string') out.push(flat(x.label));
+    for (const n of r.notes || []) if (typeof n.label === 'string') out.push(flat(n.label));
+    return out;
+  }
+  /** One row's app-written text, flattened: where a verdict about THAT row must show. */
+  function rowAppText(r, row) {
+    const isAttacker = attackerOf(r);
+    const parts = [];
+    if (!isAttacker('rows[].title') && typeof row.title === 'string') parts.push(row.title);
+    const walk = (v, path) => {
+      if (typeof v === 'string') { if (!isAttacker(path)) parts.push(v); } else if (Array.isArray(v)) v.forEach((x) => walk(x, `${path}[]`));
+      else if (v && typeof v === 'object') for (const [k, x] of Object.entries(v)) walk(x, `${path}.${k}`);
+    };
+    walk(row.fields || {}, 'rows[].fields');
+    return flat(parts.join(' '));
+  }
+  /**
+   * The rows a sentence NAMES (review round 3 of PR #14): by its ref, or by a field the tool DECLARES as the row's identity
+   * (`rowName: 'title'` or `['title', 'hostname']` — 'title' is the row's title, anything else a row field) — never by
+   * any other field, so a customer name every row shares, or a value planted in another row, names nothing.
+   */
+  function namedRows(r, sentence, lower) {
+    const tool = r && r.tool ? toolOf(r.tool) : null;
+    const names = tool && tool.kind !== 'remote' && tool.rowName ? [].concat(tool.rowName) : [];
+    return (r.rows || []).filter((row) => {
+      if (typeof row.ref === 'string' && row.ref && sentence.includes(row.ref)) return true;
+      return names.some((k) => {
+        const v = k === 'title' ? row.title : (row.fields || {})[k];
+        return typeof v === 'string' && flat(v).length >= 4 && hasPhrase(lower, flat(v));
+      });
+    });
+  }
+  /** The state words a sweep may claim: STATE_WORDS and every state and synonym the cited tools declare. */
+  function stateVocab(scope) {
+    const out = new Set(STATE_WORDS);
+    for (const r of scope) {
+      const tool = r && r.tool ? toolOf(r.tool) : null;
+      for (const [w, def] of Object.entries((tool && tool.stateFields) || {})) { out.add(w); for (const x of def.synonyms || []) out.add(x); }
+    }
+    return out;
+  }
+  /** The declared state definition a word claims in one result — the state itself, a synonym, or "un<state>" (negated). */
+  function defOf(r, word) {
+    const tool = r && r.tool ? toolOf(r.tool) : null;
+    const fields = tool && tool.kind !== 'remote' && tool.stateFields ? tool.stateFields : {};
+    for (const [w, def] of Object.entries(fields)) if (w === word || (def.synonyms || []).includes(word)) return { def, negated: false };
+    if (word.startsWith('un')) for (const [w, def] of Object.entries(fields)) if (w === word.slice(2) || (def.synonyms || []).includes(word.slice(2))) return { def, negated: true };
+    return null;
+  }
+  /** Every word a result holds, attacker text included ("every name comes from the results"), and its look-up's words. */
+  function vocabularyOf(r) {
+    const out = new Set(knownNames);
+    for (const [, v] of stringsOf(r)) for (const w of wordsOf(readable(v))) out.add(w);
+    for (const t of [r.label, r.words, ...(r.extras || []).map((x) => x.label), ...(r.notes || []).map((n) => n.label)]) for (const w of wordsOf(readable(t || ''))) out.add(w);
+    for (const row of r.rows || []) if (typeof row.ref === 'string') for (const w of wordsOf(row.ref)) out.add(w);
+    return out;
+  }
+
+  /**
+   * THE CLAIM AND ANALYSE RULES over the answer's sentences (see the header). Returns { injected, format } — the first
+   * refusal of each class (or null). EVERY sentence is read for the injection-class rules (verdict, all/none, unframed
+   * conclusion, unknown name) before any format-class refusal (uncited sentence or figure) counts, so an uncited lead
+   * sentence never hides a later obeyed one (review round 3 of PR #14). `cited` is the whole answer's cited indexes.
+   */
+  function claimRefusal(answer, results, cited, analyse, question) {
+    const qWords = new Set(wordsOf(readable(question || '')));
+    let format = null;
+    for (const sentence of sentencesOf(answer)) {
+      const own = [...new Set([...sentence.matchAll(CITE)].map((m) => Number(m[1].slice(1)) - 1))];
+      const scope = (own.length ? own : [...cited]).map((i) => results[i]).filter(Boolean);
+      const text = readable(sentence.replace(MARK_BEFORE_PUNCT, '').replace(MARK_AFTER_DOT, '').replace(PLACEHOLDER, ' ').replace(CITE, ' '));
+      const lower = flat(text);
+      // A VERDICT, PER ROW: what the app-written text of EVERY row the sentence names says; naming none, what the result
+      // itself says, or what every one of its rows says (rows that disagree settle nothing).
+      for (const m of text.matchAll(VERDICT)) {
+        const phrase = flat(m[0]);
+        const supported = scope.some((r) => {
+          const named = namedRows(r, sentence, lower);
+          if (named.length) return named.every((row) => hasPhrase(rowAppText(r, row), phrase));
+          if (resultAppTexts(r).some((t) => hasPhrase(t, phrase))) return true;
+          const rows = r.rows || [];
+          return rows.length > 0 && rows.every((row) => hasPhrase(rowAppText(r, row), phrase));
+        });
+        if (!supported) return { injected: { ok: false, code: 'unsupported_verdict', reason: `calls something “${m[0].slice(0, 30)}”, which no cited row says` }, format };
+      }
+      // ALL / NONE / NOT ALL OF THEM in a state: decided ONLY from a field the tool declares holds that state.
+      for (const claim of sweepsOf(lower, stateVocab(scope))) {
+        const holds = scope.length > 0 && scope.every((r) => {
+          const d = defOf(r, claim.word);
+          const rows = r.rows || [];
+          if (!d || !rows.length) return false;
+          const p = d.negated ? (claim.polarity === 'all' ? 'none' : claim.polarity === 'none' ? 'all' : 'notall') : claim.polarity;
+          // NOT ALL: one row that holds the field and is not in the state is enough, from any number of rows shown.
+          if (p === 'notall') return rows.some((row) => stateOf(row, d.def) === false);
+          if (Number.isInteger(r.count) && r.count !== rows.length) return false;
+          return rows.every((row) => stateOf(row, d.def) === (p === 'all'));
+        });
+        if (!holds) return { injected: { ok: false, code: 'sweeping_claim', reason: `says ${claim.polarity === 'notall' ? 'not all' : claim.polarity} of them are “${claim.word}”, which no declared state field of the cited rows shows` }, format };
+      }
+      if (!analyse) continue;
+      // ANALYSE: framed conclusions, no new names, every sentence cited, every figure from a result its sentence cites.
+      if (CONCLUSION.test(lower) && !FRAME.test(lower)) return { injected: { ok: false, code: 'unframed_conclusion', reason: 'draws a conclusion without saying it comes from the results' }, format };
+      const vocab = new Set(qWords);
+      for (const r of scope) for (const w of vocabularyOf(r)) vocab.add(w);
+      for (const m of text.matchAll(CAPITALISED)) {
+        for (const w of wordsOf(m[0])) {
+          if (w.length < 2 || /\p{N}/u.test(w) || NAME_COMMON.has(w) || vocab.has(w)) continue;
+          return { injected: { ok: false, code: 'unknown_name', reason: `names “${m[0].slice(0, 40)}”, which the cited results do not` }, format };
+        }
+      }
+      if (!format && !own.length) format = { ok: false, code: 'uncited_sentence', reason: 'a sentence cites no result' };
+      for (const m of sentence.matchAll(PLACEHOLDER)) {
+        if (!format && !own.includes(Number(m[1].slice(1)) - 1)) format = { ok: false, code: 'uncited_figure', reason: `a figure ${m[0]} from a result its sentence does not cite` };
+      }
+    }
+    return { injected: null, format };
+  }
+
   /**
    * Check one answer. Returns { ok: true, answer, cites } or { ok: false, code, reason } — `code` is one of REFUSAL_CODES.
    * @param {*} reply the model's parsed JSON
    * @param {object[]} results the look-ups' results, in order (r1 = results[0])
+   * @param {{mode?: 'lookup'|'analyse', question?: string}} [opts] 0.2.0: analyse mode, and the question its names may come from
    */
-  function checkAnswer(reply, results) {
+  function checkAnswer(reply, results, opts = {}) {
+    const analyse = opts.mode === 'analyse';
     if (!reply || typeof reply !== 'object' || Array.isArray(reply)) return { ok: false, code: 'shape', reason: 'not an object' };
     const keys = Object.keys(reply).filter((k) => !['answer', 'cites'].includes(k));
     if (keys.length) return { ok: false, code: 'shape', reason: 'unexpected fields' };
     let answer = typeof reply.answer === 'string' ? reply.answer.trim() : '';
     if (!answer) return { ok: false, code: 'shape', reason: 'empty answer' };
-    if (answer.length > 700) return { ok: false, code: 'shape', reason: 'answer too long' };
+    // TOO LONG is a format refusal, applied AFTER the injection-class rules (final round of PR #14): a long obeyed answer is
+    // refused for what it obeys, not for its length.
+    const tooLong = answer.length > 700;
     if (!Array.isArray(reply.cites) || reply.cites.some((c) => typeof c !== 'string')) return { ok: false, code: 'shape', reason: 'cites is not a list of ids' };
     if (/[\u0000-\u0008\u000b-\u001f\u007f]/.test(answer)) return { ok: false, code: 'control_chars', reason: 'control characters' };
 
-    for (const c of reply.cites) if (!/^r[1-4]$/.test(c) || !results[Number(c.slice(1)) - 1]) return { ok: false, code: 'unknown_cite', reason: `cites ${String(c).slice(0, 8)}, which no look-up returned` };
-    for (const m of answer.matchAll(CITE)) if (!results[Number(m[1].slice(1)) - 1]) return { ok: false, code: 'unknown_cite', reason: `cites ${m[1]}, which no look-up returned` };
-    answer = spellFigures(answer, reply.cites, results);
-    for (const m of answer.matchAll(PLACEHOLDER)) if (!figureOf(results, m[1], m[2])) return { ok: false, code: 'unknown_figure', reason: `a figure ${m[0]} no look-up returned` };
+    // INJECTION-CLASS RULES FIRST (review round 3 of PR #14): a FORMAT refusal found on the way (an unknown cite or figure,
+    // a malformed placeholder, a number word) is kept, not returned, until every link, obeyed and claim rule has read the
+    // whole answer — so a format slip never hides an obeyed sentence.
+    let fmt = null;
+    const later = (code, reason) => { if (!fmt) fmt = { ok: false, code, reason }; };
+    for (const c of reply.cites) if (!/^r[1-4]$/.test(c) || !results[Number(c.slice(1)) - 1]) later('unknown_cite', `cites ${String(c).slice(0, 8)}, which no look-up returned`);
+    for (const m of answer.matchAll(CITE)) if (!results[Number(m[1].slice(1)) - 1]) later('unknown_cite', `cites ${m[1]}, which no look-up returned`);
+    const knownCites = reply.cites.filter((c) => /^r[1-4]$/.test(c) && results[Number(c.slice(1)) - 1]);
+    answer = spellFigures(answer, knownCites, results);
+    for (const m of answer.matchAll(PLACEHOLDER)) if (!figureOf(results, m[1], m[2])) later('unknown_figure', `a figure ${m[0]} no look-up returned`);
     const bare = answer.replace(MARK_BEFORE_PUNCT, '').replace(MARK_AFTER_DOT, '').replace(PLACEHOLDER, ' ').replace(CITE, ' ');
-    if (/[{}]/.test(bare)) return { ok: false, code: 'bad_placeholder', reason: 'a malformed figure placeholder' };
+    if (/[{}]/.test(bare)) later('bad_placeholder', 'a malformed figure placeholder');
     // NFKC, other full stops and NO format characters for the word rules: what the person would read.
     const norm = readable(bare);
-    const allowed = allowedTokens(results);
+    const cited = new Set([...knownCites, ...[...answer.matchAll(CITE)].map((m) => m[1])].map((c) => Number(c.slice(1)) - 1).filter((i) => results[i]));
+    // ANALYSE: what may be typed is what the CITED results returned.
+    const allowed = allowedTokens(analyse ? results.filter((_, i) => cited.has(i)) : results);
     if (LINKISH.test(norm) || DANGEROUS_SCHEME.test(norm)) return { ok: false, code: 'link', reason: 'a link or markup' };
     // VERBATIM SPANS read as one plain word by DOMAINISH, the token rules and the allow-list (and by nothing else).
     const verbatim = [...allowed.verbatim].sort((a, b) => b.length - a.length);
@@ -423,8 +715,13 @@ function createCheck(o = {}) {
       if (d.includes('/') || !(INTERNAL_SUFFIX.test(d) || allowed.has(trim(d)))) return { ok: false, code: 'link', reason: 'a link or markup' };
     }
     const word = NUMBER_WORD.exec(norm);
-    if (word) return { ok: false, code: 'number_word', reason: `writes the number “${word[0]}” instead of a figure placeholder` };
+    if (word) later('number_word', `writes the number “${word[0]}” instead of a figure placeholder`);
     for (const [re, why, code] of OBEYED) if (re.test(norm)) return { ok: false, code, reason: why };
+    const claim = claimRefusal(answer, results, cited, analyse, opts.question);
+    if (claim.injected) return claim.injected;
+    if (tooLong) return { ok: false, code: 'shape', reason: 'answer too long' };
+    if (fmt) return fmt;
+    if (claim.format) return claim.format;
 
     const named = (x) => {
       let y = x;
@@ -494,7 +791,7 @@ function createCheck(o = {}) {
     return chips;
   }
 
-  const config = Object.freeze({ structured, numericStructured, verbatimFields, sayableIdFields: { facts: idFacts, rows: idRows }, sayIps, sayWindows,
+  const config = Object.freeze({ structured, numericStructured, verbatimFields, sayableIdFields: { facts: idFacts, rows: idRows }, sayIps, sayWindows, knownNames,
     namedTokens: namedTokens.map(([re, to]) => [String(re), String(to)]) });
   /**
    * WHAT DECIDES A VERDICT (review H3 of PR #9): the rule sources and this app's config, including its id test and row-chip
@@ -508,6 +805,7 @@ function createCheck(o = {}) {
 const RULE_SOURCES = [PLACEHOLDER, CITE, DIGIT_TOKEN, PURE_NUMBER, REF_TOKEN, HOSTLIKE, LINKISH, DANGEROUS_SCHEME, DOMAINISH, INTERNAL_SUFFIX, NUMBER_WORD, IPV4, IPV6, WINDOW,
   MARK_BEFORE_PUNCT, MARK_AFTER_DOT, VERBATIM_EXTRA, VERBATIM_VALUE, CIDR4, VERBATIM_BEFORE, VERBATIM_AFTER, SCHEMEISH, IP_PART, DOMAIN_USER, SMALL_WORD, JOINED_NUMBER, NOT_COUNTED, IDIOM_AFTER, IDIOM_BEFORE, JSON.stringify(SMALL_NUMBER),
   JSON.stringify(QUOTE_PAIRS), INVISIBLE, OTHER_DOTS, BRACKETED_DOT, SPELLED_DOT, SPACED_DOT, ALLOWED_CHAR, ...OBEYED.map(([re, why, code]) => `${re}|${why}|${code}`), REFUSAL_CODES.join(','),
-  unitOf, isInternalHost, readable, verbatimOk, escapeRe, maskVerbatim, trim, stringsOf, figureOf, segmentsOf, helpChips, createCheck].map(String);
+  SNIPPET, VERDICT, STATE_WORDS.join(' '), SWEEP_QUANT, SWEEP_COPULA, SWEEP_ADVERB, SWEEP_NEGATION, sweepsOf, CONCLUSION, FRAME, CAPITALISED, [...NAME_COMMON].join(' '),
+  unitOf, isInternalHost, readable, verbatimOk, escapeRe, maskVerbatim, trim, wordsOf, sentencesOf, flat, hasPhrase, stateOf, stringsOf, figureOf, segmentsOf, helpChips, createCheck].map(String);
 
-module.exports = { createCheck, REFUSAL_CODES, NUMBER_WORD, REF_TOKEN, PLACEHOLDER, LINKISH, segmentsOf, figureOf, stringsOf, readable };
+module.exports = { createCheck, REFUSAL_CODES, NUMBER_WORD, REF_TOKEN, PLACEHOLDER, LINKISH, VERDICT, segmentsOf, figureOf, stringsOf, readable, sentencesOf };

package/lib/eta.js

@@ -0,0 +1,51 @@
+/**
+ * THE BENCH PROGRESS LINE (0.2.0): "N of M · about X min left", with the time elapsed after it. A pure function of the
+ * counts and two instants, so a test fixes the clock and the page needs no client script — the admin page re-renders the
+ * region on every call and draws whatever this returns.
+ *
+ *   progressLine({ done: 12, of: 351, sinceMs, nowMs, startedMs, endpointsLeft })
+ *     → { text: '12 of 351 · about 14 min left · 1 min 20 s elapsed', secondsLeft: 812 | null, elapsedSeconds: 80 }
+ *
+ * The estimate is (calls left) × (mean seconds per call so far on THIS endpoint); calls left include the whole of every
+ * endpoint still to come. It is shown only from MIN_CALLS calls on — two calls in, the mean is noise. Under a minute it
+ * says "less than a minute left". The first endpoint's mean is not a promise about the next one's; the estimate is only
+ * as good as the calls so far, and says "about".
+ */
+
+'use strict';
+
+const MIN_CALLS = 5;
+
+/** "42 s", "3 min 05 s", "1 h 02 min". */
+function duration(seconds) {
+  const s = Math.max(0, Math.round(seconds));
+  if (s < 60) return `${s} s`;
+  if (s < 3600) return `${Math.floor(s / 60)} min ${String(s % 60).padStart(2, '0')} s`;
+  return `${Math.floor(s / 3600)} h ${String(Math.floor((s % 3600) / 60)).padStart(2, '0')} min`;
+}
+
+/** The estimate alone: seconds left, or null when there is not enough to say. */
+function secondsLeft({ done, of, sinceMs, nowMs, endpointsLeft = 0 }) {
+  if (!(done >= MIN_CALLS) || !(of > 0) || !Number.isFinite(sinceMs) || !Number.isFinite(nowMs) || nowMs < sinceMs) return null;
+  const mean = (nowMs - sinceMs) / 1000 / done;
+  const left = Math.max(0, of - done) + Math.max(0, endpointsLeft) * of;
+  return left * mean;
+}
+
+// From 60 min on the elapsed format ("about 2 h 55 min left"), never "about 175 min" beside "2 h 55 min elapsed".
+function leftWords(seconds) {
+  if (seconds < 60) return 'less than a minute left';
+  const m = Math.round(seconds / 60);
+  return m < 60 ? `about ${m} min left` : `about ${duration(m * 60)} left`;
+}
+
+function progressLine({ done, of, sinceMs, nowMs, startedMs, endpointsLeft = 0 }) {
+  const parts = [`${done} of ${of}`];
+  const left = secondsLeft({ done, of, sinceMs, nowMs, endpointsLeft });
+  if (left !== null) parts.push(leftWords(left));
+  const elapsedSeconds = Number.isFinite(startedMs) && Number.isFinite(nowMs) && nowMs >= startedMs ? (nowMs - startedMs) / 1000 : null;
+  if (elapsedSeconds !== null) parts.push(`${duration(elapsedSeconds)} elapsed`);
+  return { text: parts.join(' · '), secondsLeft: left, elapsedSeconds };
+}
+
+module.exports = { MIN_CALLS, progressLine, secondsLeft, duration };

package/lib/history.js

@@ -1,16 +1,36 @@
 /**
- * A person's own Ask history (the last 20, kept per the retention setting) and their thumbs mark.
+ * A person's own Ask history (the last 20, kept per the retention setting), their thumbs mark, and — 0.2.0 — the two
+ * reads that use an earlier question again: a HISTORY READ (rechecked) and a FOLLOW-UP (carried, bounded).
  *
  * ONE PERSON'S ROWS SPAN PARTNERS, so each read widens to platform scope around ONE model call bounded by `asked_by = <the
  * principal's id>` — the model refuses any other scope. The id comes from `principalOf` (the session today), never from
  * the request: nothing a person sends can name somebody else's history, and another person's ref reads as none.
+ *
+ * THE HISTORY RECHECK (roadmap 150). An answer is drawn again only if the viewer, NOW, still passes `mayUse` for every
+ * tool that answer used (a tool no longer registered fails), no such tool is switched off (tools_off), and reads at the
+ * same reading, acting state and partner it was asked at. Otherwise the person sees "no longer available to you" — the answer is not sent. A permission removed
+ * since, or a partner the person no longer works inside, takes the old answer away with it.
+ *
+ * WHAT A FOLLOW-UP CARRIES (D-0169 item 9), and nothing else: the previous question's TEXT as the person typed it, the
+ * ids of the TOOLS its look-ups used, and the REFS those look-ups returned (rows' own `ref`, this app's public ids,
+ * passing `isPublicId`, at most 10). Never the model's answer, never a result's text or a resolved round-2 value. It is
+ * carried only when the previous question is the SAME PERSON's (the read is bounded by asked_by), at the SAME CONTEXT
+ * (kind and ref, or both none), passes the history recheck above (same reading, acting state, partner, every tool still
+ * usable), was answered or withheld (its look-ups ran), and was asked within FOLLOW_UP_MINUTES. Anything else: the
+ * question is asked fresh, with nothing carried.
  */
 
 'use strict';
 
-/** @param {{invoke, asPlatform, principalOf, modelName?}} o */
+const FOLLOW_UP_MINUTES = 15;
+const MAX_REFS = 10;
+const utcMs = (t) => Date.parse(`${String(t).replace(' ', 'T')}Z`);
+
+/** @param {{invoke, asPlatform, principalOf, modelName?, catalogue?, isPublicId?, now?}} o */
 function createHistory(o) {
   const model = o.modelName || 'AskQuestion';
+  const now = typeof o.now === 'function' ? o.now : Date.now;
+  const isPublicId = typeof o.isPublicId === 'function' ? o.isPublicId : () => false;
   const meOf = (req, can) => {
     const p = o.principalOf(req, can);
     if (!p || p.id == null) throw new Error('ask history: needs a signed-in user');
@@ -26,7 +46,49 @@ function createHistory(o) {
   }
   const one = (req, can, ref) => { const me = meOf(req, can); return o.asPlatform(() => o.invoke(model, 'oneFor', me, String(ref))); };
   const rate = (req, can, ref, mark) => { const me = meOf(req, can); return o.asPlatform(() => o.invoke(model, 'rate', me, String(ref), mark)); };
-  return { list, one, rate };
+
+  /**
+   * May this viewer, now, see this stored question's answer again? { ok: true } or { ok: false, why: 'tool' | 'reading' |
+   * 'scope' }. `q` is oneFor's row (with `calls`); `reading` is the viewer's reading now.
+   */
+  function recheck(q, req, can, reading, toolsOff = []) {
+    const who = o.principalOf(req, can);
+    const off = new Set(Array.isArray(toolsOff) ? toolsOff : []);
+    for (const c of q.calls || []) {
+      const tool = o.catalogue ? o.catalogue.byId(c.tool) : null;
+      if (!tool || !o.catalogue.mayUse(can, tool)) return { ok: false, why: 'tool' };
+      // A TOOL SWITCHED OFF hides its old answers too; they stay stored and show again when it is switched back on.
+      if (off.has(c.tool)) return { ok: false, why: 'tool_off' };
+    }
+    const then = q.result && q.result.reading != null ? String(q.result.reading) : null;
+    if (then !== (reading == null ? null : String(reading))) return { ok: false, why: 'reading' };
+    if (!!q.acting !== !!(who && who.acting)) return { ok: false, why: 'scope' };
+    const pid = who && who.scope && who.scope.partnerId != null ? Number(who.scope.partnerId) : null;
+    if (pid != null && q.partner_id != null && Number(q.partner_id) !== pid) return { ok: false, why: 'scope' };
+    return { ok: true };
+  }
+
+  /**
+   * The previous question a follow-up carries — { ref, question, tools, refs } — or null (see the header). `context` is
+   * the NEW question's resolved context; `reading` the reading now.
+   */
+  async function followUp(req, can, ref, { context = null, reading = null, toolsOff = [] } = {}) {
+    if (typeof ref !== 'string' || !isPublicId(ref, 'ask_question')) return null;
+    const q = await one(req, can, ref);
+    if (!q || !['answered', 'withheld'].includes(q.outcome)) return null;
+    const age = now() - utcMs(q.created_at);
+    if (!(age >= 0 && age <= FOLLOW_UP_MINUTES * 60000)) return null;
+    if ((q.context_kind || null) !== (context ? context.kind : null) || (q.context_ref || null) !== (context ? context.ref : null)) return null;
+    if (!recheck(q, req, can, reading, toolsOff).ok) return null;
+    const tools = [...new Set((q.calls || []).map((c) => String(c.tool)))];
+    const refs = [];
+    for (const l of (q.result && q.result.lookups) || []) {
+      for (const r of l.refs || []) if (typeof r === 'string' && isPublicId(r) && !refs.includes(r) && refs.length < MAX_REFS) refs.push(r);
+    }
+    return { ref: q.public_id, question: String(q.question || ''), tools, refs };
+  }
+
+  return { list, one, rate, recheck, followUp, FOLLOW_UP_MINUTES };
 }
 
-module.exports = { createHistory };
+module.exports = { createHistory, FOLLOW_UP_MINUTES, MAX_REFS };