@clien-ai/mcp 0.10.9 → 0.12.0

package/dist/types/report.js

@@ -12,12 +12,14 @@
  * — see how research.ts handles it.
  */
 import { z } from 'zod';
+import { CONFIDENCE_BASES, CONFIDENCE_LEVELS, EVIDENCE_SUFFICIENCY_LEVELS, HYPOTHESIS_PRIORITIES, HYPOTHESIS_SEMANTICS_VERSION, ROBUSTNESS_OUTCOMES, VERDICT_STATUSES, hasCoherentRobustnessWorking, normalizeFinalHypothesisState, readRobustnessCounts, robustnessWorkingContradictsSummary, } from '../hypothesis-semantics.js';
 // ⚠️ A types module importing from `tools/` reads backwards, and it is deliberate.
 // `content-type-display.ts` imports NOTHING — it is the package's content-type vocabulary, which
 // happens to live beside the two renderers that were its first callers, and the FUL-341 coupling
 // test parses `CANONICAL_CONTENT_TYPES` out of that exact path as TEXT. Moving the file to break
 // the layering would cost more than the layering does.
 import { CONTENT_TYPE_EXCLUSIONS, CONTENT_TYPE_STATES } from '../tools/content-type-display.js';
+export { CONFIDENCE_BASES, CONFIDENCE_LEVELS, EVIDENCE_SUFFICIENCY_LEVELS, HYPOTHESIS_SEMANTICS_VERSION, ROBUSTNESS_OUTCOMES, VERDICT_STATUSES, } from '../hypothesis-semantics.js';
 /**
  * A competitor discovered during the research run.
  *
@@ -108,7 +110,21 @@ export const ClaimSchema = z
     quoteSpan: z
         .string()
         .optional()
-        .describe('The verbatim span from the cached source quote that grounds this claim (present for GROUNDED).'),
+        // FUL-685: `verbatim` retired on THIS field only. The span is exact against the text we
+        // cached — that is what verification means — but the cached text is an EXCERPT of the
+        // source, and on the Reddit rail the provider is measured transforming what it returns
+        // (FUL-697). "Verbatim span from the source" would be the false half of a true sentence.
+        .describe('The exact span of the cached source excerpt that grounds this claim (present for GROUNDED).'),
+    // FUL-682 (T5 / D15). Present only on a GROUNDED claim whose source is a multi-receipt community
+    // source — one permalink that legitimately yields several bounded excerpts. `sourceId` still
+    // locates the parent; this locates the exact child. Legacy reports omit it and resolve
+    // positionally, unchanged. ⚠️ READ SINCE FUL-685 (T8) — see the `receipts` note below for how
+    // this id resolves and what happens when it does not. D18 still gates the publish that makes
+    // any of it reachable from a client.
+    receiptId: z
+        .string()
+        .optional()
+        .describe('Receipt-child id ("rr1:<hex>") naming the exact cached excerpt containing `quoteSpan`, when the source carries several. Absent on legacy single-excerpt receipts.'),
 })
     .passthrough();
 /**
@@ -122,7 +138,7 @@ export const ReportSourceSchema = z
     .object({
     url: z.string().describe('Live URL the quote was collected from.'),
     platform: z.string().describe('The host the quote came from (e.g. "Hacker News", "Stack Exchange").'),
-    quote: z.string().describe('Verbatim quote, cached at collection time (≤280 chars) so it renders even if the URL later 404s.'),
+    quote: z.string().describe('Cached excerpt, collected at retrieval time (≤600 chars) so it renders even if the URL later 404s.'),
     topic: z.string().optional().describe('Producer-authored 1–2-word topic for the quote; absent on legacy or malformed records.'),
     retrievedAt: z.string().describe('ISO-8601 timestamp of when the quote was retrieved.'),
     authorHandle: z.string().optional().describe('Author handle where platform terms permit; hidden in the public share view.'),
@@ -145,10 +161,37 @@ export const ReportSourceSchema = z
         ' Stamped from the source by code, never model-emitted. ABSENT means UNCLASSIFIED: the ' +
         'source type is genuinely unknown, NOT checked and found benign. ' +
         CONTENT_TYPE_EXCLUSIONS),
+    // FUL-683 (T6 / D13): the source parent's RECEIPT CHILDREN, present only when one URL yields
+    // several bounded excerpts (today, an accepted Reddit thread). Every other source omits it and
+    // keeps its single-`quote` behaviour, which is what makes legacy reports parse unchanged.
+    // Lenient scalars for the same reason as the fields above.
+    //
+    // ⚠️ READ SINCE FUL-685 (T8), which is the MCP half of FUL-711. `resolvePersonaReceipt`
+    // resolves a claim's `receiptId` to the ONE child it names and `renderReceiptPools` prints
+    // that child's excerpt on its own `↳` line under the source's single row. An id that does not
+    // resolve under THIS parent takes the receipt away rather than falling back to `quote`.
+    receipts: z
+        .array(z
+        .object({
+        receiptId: z.string().describe('Content-addressed child id ("rr1:<16 hex>") derived from the normalized URL plus the exact excerpt.'),
+        excerpt: z.string().describe('The bounded excerpt this receipt child holds, cached at retrieval — an excerpt from a discussion, not a speaker\'s exact words.'),
+        retrievedAt: z.string().describe('ISO-8601 timestamp of when this excerpt was retrieved.'),
+    })
+        .passthrough())
+        .optional()
+        // FUL-685: `.catch(undefined)` on the ARRAY, matching the app mirror
+        // (`StagingSourceSchema.receipts`) and the fail-soft-per-field rule the sibling
+        // `identityPriors` states. Without it ONE malformed child — an `excerpt` that arrived as a
+        // number, say — fails `ResearchReportDataSchema` and drops the WHOLE report to the untyped
+        // raw-passthrough branch, losing the typing of every unrelated field to a defect in one
+        // enrichment array. Degrading to absent instead costs exactly what it should: any claim
+        // naming one of those children then fails closed at `resolveSourceReceipt`.
+        .catch(undefined)
+        .describe('Receipt children of this source, when one discussion yielded several excerpts. A claim ' +
+        'carrying `receiptId` addresses exactly one of these; absent means the source has the ' +
+        'single excerpt in `quote`.'),
 })
     .passthrough();
-/** The machine verdict statuses a hypothesis / robustness re-ask can return. MIRROR of `VERDICT_STATUSES`. */
-export const VERDICT_STATUSES = ['validated', 'invalidated', 'inconclusive'];
 /**
  * One reworded re-ask of a hypothesis verdict (robustness probe). MIRROR of
  * `RobustnessVariantSchema` in `agent/src/types.ts`. Failed/flipped variants are
@@ -158,7 +201,7 @@ export const RobustnessVariantSchema = z
     .object({
     framing: z.string().describe('The exact reworded question the verdict was re-asked under.'),
     returnedStatus: z.enum(VERDICT_STATUSES).describe('The verdict this framing returned.'),
-    returnedConfidence: z.number().describe('Confidence (0-1) of this framing\'s verdict.'),
+    returnedConfidence: z.number().min(0).max(1).describe('Confidence (0-1) of this framing\'s verdict.'),
     agreed: z.boolean().describe('True when this framing returned the same verdict as the original synthesis.'),
     reasoning: z.string().optional().describe('One-line reason for this framing\'s verdict.'),
 })
@@ -173,16 +216,70 @@ export const RobustnessVariantSchema = z
 export const RobustnessResultSchema = z
     .object({
     originalStatus: z.enum(VERDICT_STATUSES).describe('The synthesiser verdict that was re-tested.'),
-    survived: z.number().describe('How many framings returned the same verdict.'),
-    total: z.number().describe('How many framings were re-asked (may be < intended if budget-capped).'),
+    survived: z.number().int().min(0).describe('How many framings returned the same verdict.'),
+    total: z.number().int().positive().describe('How many framings were re-asked (may be < intended if budget-capped).'),
     flipped: z.boolean().describe('True when at least one framing returned a different verdict.'),
     downgradedStatus: z
         .enum(VERDICT_STATUSES)
         .optional()
         .describe('Weaker verdict displayed when the original flipped under a rephrasing; absent when it held.'),
     variants: z.array(RobustnessVariantSchema).describe('Every re-ask, passed AND failed — the inspectable working behind the survival count.'),
+})
+    .passthrough()
+    .superRefine((value, ctx) => {
+    if (!readRobustnessCounts(value)) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['survived'],
+            message: 'Robustness survival count must be a possible survived/total ratio',
+        });
+    }
+    if (!hasCoherentRobustnessWorking(value)) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['variants'],
+            message: 'Robustness variants must prove the recorded survival summary',
+        });
+    }
+});
+/**
+ * The effective-result vocabulary (FUL-358). MIRRORS of `CONFIDENCE_LEVELS`,
+ * `EVIDENCE_SUFFICIENCY_LEVELS`, `ROBUSTNESS_OUTCOMES` and `CONFIDENCE_BASES` in
+ * `agent/src/types.ts`, pinned by the schema-coupling test at the repo root.
+ */
+/**
+ * THE effective hypothesis result — verdict, reliability, coverage and robustness outcome,
+ * reconciled once by the producer. MIRROR of `FinalHypothesisStateSchema` in
+ * `agent/src/types.ts`.
+ *
+ * ⚠️ CODE-DERIVED by the agent, never model-written, so it can be quoted as-is. Three separate
+ * axes on purpose: `verdict` is which way the evidence pointed, `sufficiency` is how much of it
+ * there was, and `confidence` is how RELIABLE the verdict is — never the probability the
+ * hypothesis is true. `confidence` ABSENT means WITHHELD; read `confidenceBasis` for why.
+ *
+ * Absent on a legacy report, where the row's numeric `confidence` is the retired measure and is
+ * not comparable with these words.
+ */
+export const FinalHypothesisStateSchema = z
+    .object({
+    version: z.literal(HYPOTHESIS_SEMANTICS_VERSION).describe('Which semantics contract this block was written under.'),
+    verdict: z.enum(VERDICT_STATUSES).describe('The EFFECTIVE verdict every surface shows. A robustness downgrade is applied only when it makes a strictly weaker claim, so a malformed re-ask block can never upgrade a row.'),
+    originalVerdict: z.enum(VERDICT_STATUSES).describe('The synthesiser\'s own verdict, preserved for audit even when the row was downgraded.'),
+    confidence: z.enum(CONFIDENCE_LEVELS).optional().describe('How reliable the final verdict is. ABSENT means withheld — see confidenceBasis. Never a probability that the hypothesis is true.'),
+    confidenceBasis: z.enum(CONFIDENCE_BASES).describe('Why confidence says what it says: read off the evidence, recomputed after the verdict flipped under rephrasing, or withheld because the run attached no evidence.'),
+    sufficiency: z.enum(EVIDENCE_SUFFICIENCY_LEVELS).describe('How much evidence sits behind the verdict, across how many research methods. A coverage axis, independent of which way the verdict pointed.'),
+    robustness: z.enum(ROBUSTNESS_OUTCOMES).describe('What the robustness pass did: held, flipped, or never re-asked. `not_retested` is explicit — it is not the same as held.'),
+    priority: z.enum(HYPOTHESIS_PRIORITIES).optional().catch(undefined).describe('The product priority of the underlying hypothesis, for ranking what to go and ask about first.'),
 })
     .passthrough();
+/**
+ * The cross-field trust boundary for a producer-owned `final` block. Shape-valid enums are not
+ * enough: the block must name the row's original verdict, never strengthen any recorded verdict,
+ * and carry an axis combination the producer can actually emit.
+ */
+export function isSemanticallyValidFinalHypothesisState(row) {
+    return normalizeFinalHypothesisState(row) !== null;
+}
 /** One piece of evidence for/against a hypothesis. MIRROR of `EvidenceSchema`. */
 export const EvidenceSchema = z
     .object({
@@ -203,14 +300,31 @@ export const HypothesisResultSchema = z
     statement: z.string(),
     category: z.enum(['problem', 'solution', 'market', 'willingness_to_pay']),
     status: z.enum(VERDICT_STATUSES).describe('The verdict for this hypothesis.'),
-    confidence: z.number().describe('Confidence (0-1) in the verdict.'),
+    confidence: z.number().describe('Legacy numeric confidence stored on either the retired 0-1 or 0-100 scale. Preserve and label it as legacy; never compare it with final.confidence, rank on it, or trend it.'),
     supportingEvidence: z.array(EvidenceSchema).optional(),
     contradictingEvidence: z.array(EvidenceSchema).optional(),
     robustness: RobustnessResultSchema.optional().describe('Robustness re-ask survival count for this verdict (absent on legacy reports / when not re-tested).'),
     scopeCaveat: z.string().optional().describe('Belief-adjacent scope-mismatch note (FUL-102): present when this hypothesis\'s persona support came from a persona speaking outside its credibility domain. Treat such support as directional, not grounded.'),
+    final: FinalHypothesisStateSchema.optional().describe('THE effective result (FUL-358) — verdict, reliability, evidence sufficiency and robustness outcome, reconciled once and read by every surface. Prefer `final.verdict` over `status` and `final.confidence` over the numeric `confidence` above. Absent on legacy reports, where the numeric `confidence` is the retired measure.'),
     evidenceReading: z.string().optional().describe('One plain-language line naming what this verdict rests on — how many findings support and contradict it, and which research methods they came from. CODE-COMPOSED from this row\'s own evidence arrays, never written by the model, so it can be quoted as-is. It deliberately says nothing about whether the personas disagreed: that is `sycophancySignals.disagreements`, a stricter predicate over persona identity, and reading a split out of this line would contradict it. Absent on reports written before FUL-396 and on a hypothesis the run attached no evidence to.'),
 })
-    .passthrough();
+    .passthrough()
+    .superRefine((row, ctx) => {
+    if (row.robustness && row.robustness.originalStatus !== row.status) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['robustness', 'originalStatus'],
+            message: 'Robustness must re-test this hypothesis result status',
+        });
+    }
+    if (row.final !== undefined && !isSemanticallyValidFinalHypothesisState(row)) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['final'],
+            message: 'Final hypothesis semantics are incoherent with the row',
+        });
+    }
+});
 /**
  * Something a persona explicitly rejected — the willingness-to-say-no signal.
  *
@@ -593,6 +707,109 @@ export const SaturationNoteSchema = z
     estimatedUsdSavable: z.number(),
 })
     .passthrough();
+/**
+ * The five machine-readable outcomes of the Reddit community-evidence rail. MIRROR of the agent's
+ * `REDDIT_RAIL_OUTCOMES`; pinned equal by
+ * `__tests__/integration/mcp/reddit-outcome-vocabulary-coupling.test.ts` in the root suite.
+ *
+ * ⚠️ `completed_empty` IS NOT "ZERO SOURCES". It is reachable only when every planned request
+ * reached a parseable terminal response. Inferring it from an empty accepted set would present a
+ * provider failure as an honest empty search — a false claim about coverage (F7), and the one
+ * relabelling the plan forbids by name.
+ */
+export const REDDIT_RETRIEVAL_OUTCOMES = [
+    'not_run',
+    'failed',
+    'completed_empty',
+    'completed_partial',
+    'completed',
+];
+/**
+ * The reduced, code-stamped Reddit summary a completed report freezes at
+ * `methodology.redditRetrieval` (D6 / FUL-685). MIRROR of the agent's
+ * `RedditRetrievalNoteSchema`.
+ *
+ * ⚠️ ABSENT MEANS **UNRECORDED**, and the digest says nothing at all rather than guessing. Every
+ * report written before this field existed omits it; so does a run of an app deploy that predates
+ * it. "This run did not search Reddit" and "nobody wrote down whether it did" are different
+ * facts, and only one of them is knowable from silence.
+ *
+ * ⚠️ TYPED, NOT LENIENT, ON `outcome` — but the WHOLE note is `.catch(undefined)` at its use
+ * site. The digest branches on `outcome`, so a token it does not recognise cannot be rendered
+ * safely; degrading the note to absent puts such a report back on the unrecorded path instead of
+ * rejecting an otherwise valid legacy report. The counters stay `z.number()` rather than
+ * `.int()` for the usual mirror reason: this package must read what the producer wrote, not
+ * re-adjudicate it.
+ *
+ * ⚠️ CARRIES NO RAW TEXT, NO URL AND NO ATTEMPT ROWS. `validation_reddit_attempts` is private
+ * operational truth and never crosses into an MCP payload.
+ */
+/**
+ * The grammar of a Reddit-rail CODE TOKEN — `outcome` and `reason` both (FUL-719 / D6).
+ *
+ * ⚠️ THE LENIENCY THAT MATTERS IS ACCEPTING AN UNKNOWN TOKEN, NOT ARBITRARY TEXT. `outcome` is
+ * deliberately not a `z.enum` so a SIXTH state from a newer app still parses and the digest can
+ * say UNKNOWN (see the field comment below); nothing about that argument needs the value to be
+ * unbounded in length or content. Left as a bare `z.string()`, both fields are approved keys the
+ * projection copies VERBATIM into `structuredContent.report_data` and `_meta.report_data` — so a
+ * raw slab of provider text, a prompt, or a user's decision context riding on `reason` crosses the
+ * telemetry seam into a stored report a reader can share, which is exactly the leak D6/F16 forbid
+ * and the one the unknown-KEY projection did not close. A review probe demonstrated it.
+ *
+ * Deliberately narrow: lowercase, digits and `_`, first character a letter, 64 characters. Every
+ * value in the producer's `REDDIT_RAIL_OUTCOMES` and `REDDIT_RAIL_REASON_CODES` satisfies it, and
+ * the root coupling test pins that so a future producer token this grammar would silently reject
+ * fails there first.
+ */
+export const REDDIT_CODE_TOKEN_PATTERN = /^[a-z][a-z0-9_]{0,63}$/;
+/** True only for a string that is a bounded {@link REDDIT_CODE_TOKEN_PATTERN} code token. */
+export function isRedditCodeToken(value) {
+    return typeof value === 'string' && REDDIT_CODE_TOKEN_PATTERN.test(value);
+}
+export const RedditRetrievalNoteSchema = z
+    .object({
+    // ⚠️ DELIBERATELY `z.string()`, NOT `z.enum(REDDIT_RETRIEVAL_OUTCOMES)`, and the difference is
+    // a version-skew signal. This client and the app ship on INDEPENDENT release cycles, and a
+    // client older than the deploy answering it is the normal pairing rather than an edge case
+    // (the same asymmetry that forced `deriveMessageCount`'s fallback). A strict enum plus the
+    // `.catch(undefined)` below would turn a SIXTH outcome into an absent note — and an absent
+    // note means UNRECORDED, so the digest would fall silent about a run that really did search
+    // Reddit. That is precisely the ambiguity a typed outcome exists to remove.
+    // `renderRedditRetrieval` owns the unknown case instead: it renders "an outcome this client
+    // does not recognise … treat coverage as UNKNOWN", which is honest in both directions and
+    // tells the reader what to do about it. A value that is not even a string still fails, and
+    // the `.catch(undefined)` below then puts the report back on the unrecorded path.
+    //
+    // ⚠️ BUT BOUNDED BY {@link REDDIT_CODE_TOKEN_PATTERN} (FUL-719): unknown TOKEN yes, raw TEXT
+    // never. An out-of-grammar value fails the note, and the use-site `.catch(undefined)` then
+    // reads it as UNRECORDED — the fail-closed direction, and the same answer a note carrying an
+    // unreadable member already gets.
+    outcome: z.string().regex(REDDIT_CODE_TOKEN_PATTERN).describe('How the Reddit rail settled: not_run | failed | completed_empty | completed_partial | completed. A token outside that set means this client is older than the app that answered — the digest renders it as UNKNOWN, never as coverage. An ABSENT note means UNRECORDED, which is a different fact.'),
+    reason: z.string().regex(REDDIT_CODE_TOKEN_PATTERN).describe('One bounded reason code for that outcome (e.g. "ok", "flag_disabled", "rate_limited"). A code token, never free text — an out-of-grammar value is refused rather than forwarded.'),
+    // ⚠️ THE THREE INTENT COUNTERS AND `costUsd` ARE THE PRODUCER'S (FUL-719). This mirror briefly
+    // carried a different reduction — no intent counters, and `spentMicroUsd` where the producer
+    // writes `costUsd` — which would have rejected every real note for a missing member and left
+    // the digest silent on exactly the runs that searched Reddit. A mirror mirrors what is
+    // written, not what would have been tidier to write.
+    plannedIntents: z.number().describe('Query intents fixed before the first call — the cap this pass ran under.'),
+    completedIntents: z.number().describe('Planned intents that reached a parseable terminal response.'),
+    failedIntents: z.number().describe('Planned intents that did not.'),
+    acceptedSourceCount: z.number().describe('Distinct accepted Reddit discussions — the breadth number. NOT the excerpt count.'),
+    acceptedExcerptCount: z.number().describe('Accepted bounded excerpts across those discussions; one discussion can yield several.'),
+    requestsIssued: z.number().describe('Provider requests actually issued, retries included.'),
+    toolRequests: z.number().describe('Billable searches issued. Spend scales with this, not with requestsIssued.'),
+    latencyMs: z.number().describe('Wall-clock duration of the whole Reddit pass.'),
+    costUsd: z.number().describe('Settled provider spend for the pass, in USD.'),
+});
+/**
+ * The ONLY keys of the Reddit note that may leave this package (D6).
+ *
+ * ⚠️ DERIVED FROM THE SCHEMA, NOT RETYPED. `projectReportDataForMcp` copies exactly these forward
+ * on both its exits — the typed parse and the schema-drift fallback — so a field the app adds
+ * upstream is dropped until someone adds it here on purpose. A hand-written second list would let
+ * the two disagree, and the disagreement would show up as a leak rather than as a test failure.
+ */
+export const REDDIT_RETRIEVAL_NOTE_KEYS = Object.keys(RedditRetrievalNoteSchema.shape);
 /** The evidence-scope and run-cost counters already rendered by the report markdown. */
 export const MethodologyNoteSchema = z
     .object({
@@ -602,6 +819,14 @@ export const MethodologyNoteSchema = z
     totalTokensUsed: z.number(),
     jobDurationSeconds: z.number(),
     saturation: SaturationNoteSchema.optional(),
+    // FUL-685 (T8 / D6). `.catch(undefined)` and not merely `.optional()`: a malformed or
+    // unrecognised value must degrade THIS FIELD to unrecorded, never reject an otherwise valid
+    // legacy report — the same fail-soft-per-field posture `personasSynthesis` takes.
+    redditRetrieval: RedditRetrievalNoteSchema
+        .optional()
+        .catch(undefined)
+        .describe('Code-stamped summary of the Reddit community-evidence rail, frozen at completion. ' +
+        'ABSENT means UNRECORDED — never disabled, empty, or failed.'),
 })
     .passthrough();
 /**
@@ -643,7 +868,7 @@ export const ResearchReportDataSchema = z
     hypothesisResults: z
         .array(HypothesisResultSchema)
         .optional()
-        .describe('Per-hypothesis verdicts (status + confidence + evidence), each carrying its robustness re-ask survival count when re-tested.'),
+        .describe('Per-hypothesis results. Prefer `final`: it is the effective verdict, categorical reliability, evidence sufficiency and robustness outcome. Raw `status` and numeric `confidence` are legacy compatibility fields; do not rank or compare the numeric measure.'),
     insights: z
         .array(InsightSchema)
         .optional()
@@ -784,14 +1009,159 @@ export function projectReportDataForMcp(raw) {
     if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
         return raw;
     const record = raw;
-    if (!Object.prototype.hasOwnProperty.call(record, 'interviewHighlights'))
+    const hasHighlights = Object.prototype.hasOwnProperty.call(record, 'interviewHighlights');
+    const hasHypothesisResults = Object.prototype.hasOwnProperty.call(record, 'hypothesisResults');
+    const methodology = record.methodology;
+    const hasRedditNote = methodology !== null &&
+        typeof methodology === 'object' &&
+        !Array.isArray(methodology) &&
+        Object.prototype.hasOwnProperty.call(methodology, 'redditRetrieval');
+    if (!hasHighlights && !hasRedditNote && !hasHypothesisResults)
         return raw;
     const projected = { ...record };
-    const highlights = z.array(InterviewHighlightSchema).safeParse(record.interviewHighlights);
-    if (highlights.success)
-        projected.interviewHighlights = highlights.data;
-    else
-        delete projected.interviewHighlights;
+    if (hasHypothesisResults && Array.isArray(record.hypothesisResults)) {
+        projected.hypothesisResults = record.hypothesisResults.map((rawRow) => {
+            if (rawRow === null || typeof rawRow !== 'object' || Array.isArray(rawRow))
+                return rawRow;
+            const row = rawRow;
+            const safeRow = { ...row };
+            let changed = false;
+            if (Object.prototype.hasOwnProperty.call(row, 'final')) {
+                const normalized = normalizeFinalHypothesisState(row);
+                if (normalized)
+                    safeRow.final = normalized;
+                else
+                    delete safeRow.final;
+                changed = safeRow.final !== row.final;
+            }
+            const rawRobustness = row.robustness;
+            const robustnessRecord = rawRobustness !== null &&
+                typeof rawRobustness === 'object' &&
+                !Array.isArray(rawRobustness)
+                ? rawRobustness
+                : null;
+            const nonRecordRobustnessIsUnsafe = rawRobustness !== undefined && rawRobustness !== null && robustnessRecord === null;
+            const parentStatusIsUnsafe = robustnessRecord !== null &&
+                !VERDICT_STATUSES.includes(row.status);
+            const carriesMeasuredCounts = robustnessRecord !== null &&
+                (Object.prototype.hasOwnProperty.call(robustnessRecord, 'survived') ||
+                    Object.prototype.hasOwnProperty.call(robustnessRecord, 'total'));
+            const carriesVariants = robustnessRecord !== null &&
+                Object.prototype.hasOwnProperty.call(robustnessRecord, 'variants');
+            const carriesOriginalStatus = robustnessRecord !== null &&
+                Object.prototype.hasOwnProperty.call(robustnessRecord, 'originalStatus');
+            const originalStatusMatches = robustnessRecord !== null &&
+                robustnessRecord.originalStatus === row.status;
+            const workingIsUnsafe = carriesVariants && robustnessWorkingContradictsSummary(robustnessRecord);
+            const originalStatusIsUnsafe = carriesOriginalStatus && !originalStatusMatches;
+            const measuredCountsAreUnsafe = carriesMeasuredCounts && !readRobustnessCounts(robustnessRecord);
+            if (nonRecordRobustnessIsUnsafe || parentStatusIsUnsafe) {
+                delete safeRow.robustness;
+                changed = true;
+            }
+            else if (robustnessRecord && (workingIsUnsafe || originalStatusIsUnsafe || measuredCountsAreUnsafe)) {
+                // Keep a readable downgrade: a broken diagnostic ratio must not erase the weakest
+                // recorded verdict. Contradictory detail cannot authenticate the summary or dependent
+                // final block, so neither may cross the typed or raw-drift exit.
+                const safeRobustness = { ...robustnessRecord };
+                delete safeRobustness.survived;
+                delete safeRobustness.total;
+                delete safeRobustness.flipped;
+                if (workingIsUnsafe || originalStatusIsUnsafe)
+                    delete safeRobustness.variants;
+                if (originalStatusIsUnsafe)
+                    delete safeRobustness.originalStatus;
+                safeRow.robustness = safeRobustness;
+                changed = true;
+            }
+            if (!changed)
+                return rawRow;
+            return safeRow;
+        });
+    }
+    if (hasHighlights) {
+        const highlights = z.array(InterviewHighlightSchema).safeParse(record.interviewHighlights);
+        if (highlights.success)
+            projected.interviewHighlights = highlights.data;
+        else
+            delete projected.interviewHighlights;
+    }
+    // ⚠️ FUL-685 — THE REDDIT NOTE IS PROJECTED HERE FOR THE SAME REASON `researchTaskId` IS:
+    // `prepareReportDataForMcp` returns this projection UNPARSED when the full schema drifts, so a
+    // field stripped only by `RedditRetrievalNoteSchema` would come straight back on that path — and
+    // schema drift is the NORMAL case for a partial payload, not an exotic one.
+    //
+    // D6 makes this note the public face of a private ledger: no raw Reddit text, no transient
+    // context, no attempt rows. Anything the app adds to it later is forwarded verbatim into
+    // `_meta.report_data` and `structuredContent.report_data` unless it is projected away HERE,
+    // before either exit. An unparseable note is DROPPED rather than forwarded, because absent means
+    // UNRECORDED — an honest silence — while a half-readable note is a claim nobody has judged.
+    if (hasRedditNote) {
+        const source = methodology;
+        const nextMethodology = { ...source };
+        const rawNote = source.redditRetrieval;
+        if (rawNote !== null && typeof rawNote === 'object' && !Array.isArray(rawNote)) {
+            // ⚠️ AN ALLOWLIST, NOT A `safeParse`. Validating the note all-or-nothing would DROP a note
+            // whose `outcome` is perfectly readable because one telemetry number arrived corrupt — and
+            // an absent note means UNRECORDED, so a `failed` run would silently lose "the Reddit pass
+            // did NOT complete", which is exactly the honest-limitation signal F7 requires it to carry.
+            // The renderer already handles an unreadable count by omitting the counts sentence.
+            //
+            // Copying approved keys forward is also the only shape that stays correct as the note grows:
+            // a field added upstream is absent here until someone adds it to this list, which is the
+            // decision D6 wants made deliberately rather than by default.
+            //
+            // ⚠️ AND THE VALUE IS CHECKED, NOT ONLY THE KEY (FUL-719). An allowlist of key NAMES closes
+            // the unknown-field path and nothing else: `reason` is an APPROVED key, so a secret placed
+            // in it was copied forward verbatim into both exits — a leak a review probe demonstrated,
+            // and one digest truncation cannot touch because these are typed channels, not prose. So
+            // each approved key is copied only when its value has the SHAPE the contract promises: a
+            // bounded code token for the two code fields, a finite number for the six counters (a
+            // string in `acceptedSourceCount` is the same leak wearing a counter's name).
+            //
+            // ⚠️ PER-KEY, NOT WHOLE-NOTE, for the reason the allowlist itself exists: dropping the note
+            // over one bad telemetry number would cost a `failed` run its "the Reddit pass did NOT
+            // complete" sentence, which is the honest-limitation signal F7 requires it to carry. The
+            // renderer already omits the counts sentence when a count is unreadable, and the parsed path
+            // is stricter of its own accord — a missing `reason` there fails the note and reads as
+            // UNRECORDED.
+            const src = rawNote;
+            const note = {};
+            for (const key of REDDIT_RETRIEVAL_NOTE_KEYS) {
+                if (!Object.prototype.hasOwnProperty.call(src, key))
+                    continue;
+                const value = src[key];
+                const admissible = key === 'outcome' || key === 'reason'
+                    ? isRedditCodeToken(value)
+                    : typeof value === 'number' && Number.isFinite(value);
+                if (admissible)
+                    note[key] = value;
+            }
+            // ⚠️ PER-KEY DEGRADATION STARTS AFTER `outcome` SURVIVES, NEVER BEFORE IT (FUL-728). The
+            // loop above admits keys independently, so a note whose `outcome` is missing or refused
+            // still reached this line — as literal `{}`, or as `reason` plus counters — and was
+            // forwarded verbatim into `_meta.report_data` and `structuredContent.report_data` as a
+            // PRESENT `redditRetrieval`. The contract makes absence mean UNRECORDED; a note that
+            // exists and says nothing is a different fact, and the one nobody wrote down. A client
+            // reading the typed channel cannot tell them apart, and the digest cannot help — it keys
+            // every branch on `outcome` and renders nothing without one, so the text goes silent while
+            // the payload asserts a record.
+            //
+            // This is not the whole-note validation the comment above refuses. Losing a COUNTER costs
+            // a number and the renderer already omits the counts sentence; losing `outcome` costs the
+            // fact the note exists to carry, and every sentence keyed on it — including the `failed`
+            // run's "the Reddit pass did NOT complete", which F7 requires. There is nothing left to
+            // degrade to, so the honest projection is absence.
+            if (typeof note.outcome === 'string')
+                nextMethodology.redditRetrieval = note;
+            else
+                delete nextMethodology.redditRetrieval;
+        }
+        else {
+            delete nextMethodology.redditRetrieval;
+        }
+        projected.methodology = nextMethodology;
+    }
     return projected;
 }
 /**
@@ -887,16 +1257,25 @@ export const MarketSizingLineSchema = z
         operation: z.literal('multiply'),
         formula: z.string().trim().min(1),
         assumptions: z.array(z.string().trim().min(1)).min(1).max(8),
+        range: z.object({
+            low: z.number().nonnegative(),
+            base: z.number().positive(),
+            high: z.number().positive(),
+        }).optional(),
         inputs: z.array(z.object({
             label: z.string().trim().min(1),
             value: z.number().positive(),
-            kind: z.enum(['currency', 'ratio']),
+            kind: z.enum(['currency', 'ratio', 'ratio_assumption']),
             currency: z.string().trim().toUpperCase().refine((code) => ISO_CURRENCY_CODES.has(code), 'currency must be a supported ISO 4217 code').optional(),
-            period: z.string().trim().min(1),
-            geography: z.string().trim().min(1),
-            audience: z.string().trim().min(1),
-            claimId: z.string().regex(/^RCLM-m(?:0|[1-9]\d*)$/),
-            sourceId: z.string().regex(/^RRCP-s(?:0|[1-9]\d*)$/),
+            period: z.string().trim().min(1).optional(),
+            geography: z.string().trim().min(1).optional(),
+            audience: z.string().trim().min(1).optional(),
+            claimId: z.string().regex(/^RCLM-m(?:0|[1-9]\d*)$/).optional(),
+            sourceId: z.string().regex(/^RRCP-s(?:0|[1-9]\d*)$/).optional(),
+            rationale: z.string().trim().min(1).max(500).optional(),
+            low: z.number().min(0).max(1).optional(),
+            base: z.number().positive().max(1).optional(),
+            high: z.number().positive().max(1).optional(),
         }).passthrough()).min(2).max(8),
     }).passthrough().optional(),
 })
@@ -917,14 +1296,32 @@ export const MarketSizingLineSchema = z
     if (currencyInputs.length !== 1 || currencyInputs[0]?.currency !== entry.currency) {
         ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'derived sizing requires exactly one input in the output currency' });
     }
-    if (derivation.inputs.some((input) => input.period !== entry.period || input.geography !== entry.geography || input.audience !== entry.audience ||
-        (input.kind === 'ratio' ? input.currency !== undefined || input.value > 1 : !input.currency))) {
+    if (derivation.inputs.some((input) => input.kind === 'ratio_assumption'
+        ? input.currency !== undefined || input.period !== undefined || input.geography !== undefined ||
+            input.audience !== undefined || input.claimId !== undefined || input.sourceId !== undefined ||
+            !input.rationale || input.low === undefined || input.base === undefined || input.high === undefined ||
+            input.low > input.base || input.base > input.high || input.value !== input.base
+        : input.period !== entry.period || input.geography !== entry.geography || input.audience !== entry.audience ||
+            !input.claimId || !input.sourceId ||
+            (input.kind === 'ratio' ? input.currency !== undefined || input.value > 1 : !input.currency))) {
         ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'derived inputs have incompatible boundary or units' });
     }
     const product = derivation.inputs.reduce((total, input) => total * input.value, 1);
     if (!Number.isFinite(product) || Math.abs(product - entry.value) > Math.max(0.01, entry.value * 1e-9)) {
         ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'derived value does not reconcile with typed inputs' });
     }
+    const expectedRange = derivation.inputs.reduce((range, input) => ({
+        low: range.low * (input.kind === 'ratio_assumption' ? input.low : input.value),
+        base: range.base * input.value,
+        high: range.high * (input.kind === 'ratio_assumption' ? input.high : input.value),
+    }), { low: 1, base: 1, high: 1 });
+    if (derivation.inputs.some((input) => input.kind === 'ratio_assumption')) {
+        const range = derivation.range;
+        const matches = range && ['low', 'base', 'high'].every((key) => Math.abs(range[key] - expectedRange[key]) <= Math.max(0.01, expectedRange[key] * 1e-9));
+        if (!matches) {
+            ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'assumption-derived sizing requires the code-computed range' });
+        }
+    }
 });
 /**
  * The market block a run established — the shape `scan_market` (FUL-479) surfaces to the caller
@@ -990,6 +1387,15 @@ export const ForumThreadSchema = z
      * pre-pivot stored reports still carry it and the schema is `.passthrough()`:
      * removing it would keep the data flowing, just untyped. Not rendered on any
      * surface (see `renderThreads` in `tools/scoped-research.ts`).
+     *
+     * ⚠️ FUL-685 — REDDIT IS COMING BACK, AND THIS FIELD IS STILL NOT HOW. The community-evidence
+     * rail reaches Reddit through a different provider entirely, and its v1 contract omits the
+     * subreddit along with the author handle and every engagement figure — an accepted thread
+     * carries a code-stamped `platform: "Reddit"`, its normalized permalink, and bounded
+     * excerpts, and nothing else. So a value here still means a pre-pivot stored report, and a
+     * renderer that started printing it would be describing the old world. (The two sentences
+     * above are the FUL-131 record and are left as written; the provider posture behind the new
+     * rail is settled separately, on its own terms.)
      */
     subreddit: z.string().optional(),
     sentimentSummary: z.string().optional(),
@@ -1022,6 +1428,28 @@ export const ForumThreadSchema = z
         // the day `get_report` needed the wording too, the choice was one constant or a fifth
         // spelling. `content-type-display.test.ts` pins it across all six surfaces.
         CONTENT_TYPE_EXCLUSIONS),
+    // FUL-718. The same receipt-child shape `ReportSourceSchema.receipts` mirrors, on the other
+    // surface that can carry them: a scoped Community update has no persona spine, so its
+    // `forumResearch.threads[]` is where an accepted discussion's per-excerpt identity lives.
+    // Lenient scalars for the same reason as every field above — `extractItems` DROPS an element
+    // that fails to parse, and one odd child must not cost a whole thread.
+    //
+    // ⚠️ SCHEMA ONLY. Nothing here reads it yet; T8 owns the rendering half, and the digest still
+    // resolves a receipt positionally through the parent.
+    receipts: z
+        .array(z
+        .object({
+        receiptId: z.string().describe('Content-addressed child id ("rr1:<16 hex>") derived from the normalized URL plus the exact excerpt.'),
+        excerpt: z.string().describe('The exact cached excerpt this receipt child holds.'),
+        retrievedAt: z.string().describe('ISO-8601 timestamp of when this excerpt was retrieved.'),
+    })
+        .passthrough())
+        .optional()
+        // Match ReportSourceSchema: one malformed child degrades this optional enrichment rather
+        // than making extractItems discard the otherwise-valid paid discussion.
+        .catch(undefined)
+        .describe('Receipt children of this discussion, when it yielded several bounded excerpts. Each names ' +
+        'one exact excerpt in `relevantQuotes`; absent means no rail minted per-excerpt ids for it.'),
 })
     .passthrough();
 //# sourceMappingURL=report.js.map