@knights-eye-chess/ai-analysis 0.1.0-dev.14 → 0.1.0-dev.18

package/NPM-PUBLISHING.md

@@ -2,16 +2,20 @@
 
 The owner authorized public npm prereleases on 10 October 2026. Use **`next`** and preserve any existing `latest` tag. Licensing is documented in [LICENSING.md](LICENSING.md).
 
+The first registry prerelease is `0.1.0-dev.14`. The source checkout now prepares
+`0.1.0-dev.17` with Move Classifier `0.1.0-dev.13`.
+This next candidate has not been published; `@next` remains the verified registry release.
+
 ## Prepare the exact candidate
 
-Use Node 24 and npm 11:
+Use Node 24.19.0 and npm 11.9.0:
 
 ```sh
 npm ci
 npm run publish:prepare
 ```
 
-Review `artifacts/knights-eye-chess-ai-analysis-0.1.0-dev.14.tgz`, including its files, exports, declarations, licenses and exact registry dependencies. Reusable source and offline owner tests are intentional; application traces, credentials, vendor archives and source lockfiles are excluded. The checkout stays `private: true`; publish only the staged archive. Archive contents are immutable: use a new version for changed bytes.
+Review `artifacts/knights-eye-chess-ai-analysis-0.1.0-dev.17.tgz`, including its files, exports, declarations, licenses and exact registry dependencies. Reusable source and offline owner tests are intentional; application traces, credentials, vendor archives and source lockfiles are excluded. The checkout stays `private: true`; publish only the staged archive. Archive contents are immutable: use a new version for changed bytes.
 
 Before every coordinated release, run `node tools/release-tooling/sync.mjs --check` in the reviewed app checkout alongside all six component revisions. Record those commits and the result.
 

package/README.md

@@ -22,19 +22,17 @@ engine hosting, persistence and privacy settings for chess data and traces.
 
 ## Get started
 
-Use Node 24 or newer. This preview has not been published to npm. From a checkout
-of [this repository](https://github.com/knights-eye-chess/ai-analysis):
+Use Node 24 or newer. Install the published prerelease with the chess library
+imported by the example below:
 
 ```sh
-npm ci
-npm run pack:checked
+npm install @knights-eye-chess/ai-analysis@next chess.js@1.4.0
 ```
 
-Install the resulting archive in your app:
-
-```sh
-npm install /absolute/path/to/ai-analysis/artifacts/knights-eye-chess-ai-analysis-0.1.0-dev.12.tgz
-```
+The first reviewed registry candidate is `0.1.0-dev.14`; pin the exact version
+for a reproducible install. Source developers can use `npm ci` and
+`npm run pack:checked` in this checkout.
+[SOURCE-ORIGIN.json](SOURCE-ORIGIN.json) records historical archive provenance.
 
 This runnable example uses a local connector with a fixed answer. It needs no
 provider credentials or engine, and demonstrates host wiring rather than model

package/dist/{chunk-XQDZJOYD.js → chunk-6OXAG5H3.js}

@@ -1284,7 +1284,7 @@ function rejectionReason(context, hash, witness) {
   if (witness.authority !== "bounded-engine" || !Array.isArray(witness.licenses) || witness.licenses.length !== 1 || witness.licenses[0] !== "engine.bounded-continuation") return "missing-authority-license";
   if (witness.contextHash !== hash) return "context-mismatch";
   if (!["before", "after"].includes(witness.phase) || witness.fen !== (witness.phase === "before" ? context.fenBefore : context.fenAfter)) return "root-mismatch";
-  if (typeof witness.engineBuild !== "string" || !witness.engineBuild || typeof witness.command !== "string" || !witness.command || !positiveInteger(witness.requestedDepth) || !positiveInteger(witness.multiPv) || witness.multiPv > 32 || !Array.isArray(witness.lines) || witness.lines.length !== witness.multiPv || !Array.isArray(witness.rootMoves) || witness.rootMoves.length > 32 || witness.rootMoves.some((root) => typeof root !== "string" || !UCI.test(root)) || new Set(witness.rootMoves).size !== witness.rootMoves.length) return "invalid-search-scope";
+  if (typeof witness.engineBuild !== "string" || !witness.engineBuild || typeof witness.command !== "string" || !witness.command || !positiveInteger(witness.requestedDepth) || !positiveInteger(witness.multiPv) || witness.multiPv > 32 || !Array.isArray(witness.lines) || witness.lines.length < 1 || witness.lines.length > witness.multiPv || !Array.isArray(witness.rootMoves) || witness.rootMoves.length > 32 || witness.rootMoves.some((root) => typeof root !== "string" || !UCI.test(root)) || new Set(witness.rootMoves).size !== witness.rootMoves.length) return "invalid-search-scope";
   if (witness.lines.some((line) => !line || typeof line.rootMove !== "string")) return "invalid-pv";
   const roots = witness.lines.map((line) => line.rootMove);
   if (new Set(roots).size !== roots.length || witness.rootMoves.some((root) => !roots.includes(root)) || witness.rootMoves.length > 0 && roots.some((root) => !witness.rootMoves.includes(root))) return "root-set-mismatch";

package/dist/{chunk-PLKNJRPF.js → chunk-TYQ5WIL2.js}

@@ -50,7 +50,7 @@ import {
   validateEvidenceLicenseClaims,
   validateReasoningPositionContext,
   withEvidenceLicenses
-} from "./chunk-XQDZJOYD.js";
+} from "./chunk-6OXAG5H3.js";
 
 // src/chess-reasoning/branch-expansion-policy.ts
 var BRANCH_EXPANSION_OPTIONS = { maxNodes: 8, maxPlies: 4, maxLines: 2, depthFloor: 14, depthMode: "decreasing", maxElapsedMs: 2e4 };

package/dist/index.js

@@ -17,7 +17,7 @@ import {
   simpleSystemPolicy,
   simpleToolDescription,
   validateSimpleToolInput
-} from "./chunk-PLKNJRPF.js";
+} from "./chunk-TYQ5WIL2.js";
 import {
   DEFAULT_REASONING_RUN_CONTROLS,
   EVIDENCE_SHARING_VERSION,
@@ -71,7 +71,7 @@ import {
   toPositionAnalysisProvider,
   validateReasoningPositionContext,
   validateSimpleAgentConfig
-} from "./chunk-XQDZJOYD.js";
+} from "./chunk-6OXAG5H3.js";
 export {
   DEFAULT_REASONING_RUN_CONTROLS,
   EVIDENCE_SHARING_VERSION,

package/dist/owner-tests/pipeline-host-preparation.test.mjs

@@ -5879,7 +5879,7 @@ function rejectionReason(context2, hash, witness) {
   if (witness.authority !== "bounded-engine" || !Array.isArray(witness.licenses) || witness.licenses.length !== 1 || witness.licenses[0] !== "engine.bounded-continuation") return "missing-authority-license";
   if (witness.contextHash !== hash) return "context-mismatch";
   if (!["before", "after"].includes(witness.phase) || witness.fen !== (witness.phase === "before" ? context2.fenBefore : context2.fenAfter)) return "root-mismatch";
-  if (typeof witness.engineBuild !== "string" || !witness.engineBuild || typeof witness.command !== "string" || !witness.command || !positiveInteger(witness.requestedDepth) || !positiveInteger(witness.multiPv) || witness.multiPv > 32 || !Array.isArray(witness.lines) || witness.lines.length !== witness.multiPv || !Array.isArray(witness.rootMoves) || witness.rootMoves.length > 32 || witness.rootMoves.some((root) => typeof root !== "string" || !UCI.test(root)) || new Set(witness.rootMoves).size !== witness.rootMoves.length) return "invalid-search-scope";
+  if (typeof witness.engineBuild !== "string" || !witness.engineBuild || typeof witness.command !== "string" || !witness.command || !positiveInteger(witness.requestedDepth) || !positiveInteger(witness.multiPv) || witness.multiPv > 32 || !Array.isArray(witness.lines) || witness.lines.length < 1 || witness.lines.length > witness.multiPv || !Array.isArray(witness.rootMoves) || witness.rootMoves.length > 32 || witness.rootMoves.some((root) => typeof root !== "string" || !UCI.test(root)) || new Set(witness.rootMoves).size !== witness.rootMoves.length) return "invalid-search-scope";
   if (witness.lines.some((line) => !line || typeof line.rootMove !== "string")) return "invalid-pv";
   const roots = witness.lines.map((line) => line.rootMove);
   if (new Set(roots).size !== roots.length || witness.rootMoves.some((root) => !roots.includes(root)) || witness.rootMoves.length > 0 && roots.some((root) => !witness.rootMoves.includes(root))) return "root-set-mismatch";

package/dist/owner-tests/prose-reference-admission.test.mjs

@@ -1037,7 +1037,7 @@ function rejectionReason(context, hash, witness) {
   if (witness.authority !== "bounded-engine" || !Array.isArray(witness.licenses) || witness.licenses.length !== 1 || witness.licenses[0] !== "engine.bounded-continuation") return "missing-authority-license";
   if (witness.contextHash !== hash) return "context-mismatch";
   if (!["before", "after"].includes(witness.phase) || witness.fen !== (witness.phase === "before" ? context.fenBefore : context.fenAfter)) return "root-mismatch";
-  if (typeof witness.engineBuild !== "string" || !witness.engineBuild || typeof witness.command !== "string" || !witness.command || !positiveInteger(witness.requestedDepth) || !positiveInteger(witness.multiPv) || witness.multiPv > 32 || !Array.isArray(witness.lines) || witness.lines.length !== witness.multiPv || !Array.isArray(witness.rootMoves) || witness.rootMoves.length > 32 || witness.rootMoves.some((root) => typeof root !== "string" || !UCI.test(root)) || new Set(witness.rootMoves).size !== witness.rootMoves.length) return "invalid-search-scope";
+  if (typeof witness.engineBuild !== "string" || !witness.engineBuild || typeof witness.command !== "string" || !witness.command || !positiveInteger(witness.requestedDepth) || !positiveInteger(witness.multiPv) || witness.multiPv > 32 || !Array.isArray(witness.lines) || witness.lines.length < 1 || witness.lines.length > witness.multiPv || !Array.isArray(witness.rootMoves) || witness.rootMoves.length > 32 || witness.rootMoves.some((root) => typeof root !== "string" || !UCI.test(root)) || new Set(witness.rootMoves).size !== witness.rootMoves.length) return "invalid-search-scope";
   if (witness.lines.some((line) => !line || typeof line.rootMove !== "string")) return "invalid-pv";
   const roots = witness.lines.map((line) => line.rootMove);
   if (new Set(roots).size !== roots.length || witness.rootMoves.some((root) => !roots.includes(root)) || witness.rootMoves.length > 0 && roots.some((root) => !witness.rootMoves.includes(root))) return "root-set-mismatch";
@@ -1768,3 +1768,54 @@ test("fresh answer witnesses preserve shipped v22 reference geometry and reject
   assert.equal(rejected.referenceGapCounts.unresolvedReferences, 1);
   assert.equal(rejected.blocks[0].tokens[0].reference, void 0);
 });
+test("completed unrestricted MultiPV witnesses accept fewer lines without changing requested scope", () => {
+  const fen = "7r/p1p1p1kp/2p2rpQ/3q4/3P4/2P5/P1P2PP1/R3K2R b KQ - 5 18";
+  const context = { kind: "position", nodeId: "two-legal", historyStartFen: fen, historyUci: [], moveUci: "", moveSan: "", fenBefore: fen, fenAfter: fen };
+  const roots = ["g7g8", "g7f7"];
+  assert.deepEqual(new Set(new Chess34(fen).moves({ verbose: true }).map((m) => m.from + m.to)), new Set(roots));
+  const witness = {
+    version: "fresh-engine-pv-witness/1",
+    acquisition: "same-answer-engine",
+    acquisitionId: 1,
+    evidenceId: "server-engine-acquisition:two-legal",
+    contextHash: reasoningContextHash(context),
+    phase: "before",
+    fen,
+    engineBuild: "test-engine",
+    command: "go depth 18",
+    requestedDepth: 18,
+    multiPv: 3,
+    rootMoves: [],
+    authority: "bounded-engine",
+    licenses: ["engine.bounded-continuation"],
+    lines: roots.map((rootMove, index) => ({
+      rootMove,
+      pv: [rootMove],
+      depth: 18,
+      scoreCp: -200 - index,
+      mateInMoves: null,
+      scoreProvenance: { kind: "root-search", fen, engineBuild: "test-engine", command: "go depth 18", originatingDepth: 18, reportedDepth: 18 }
+    }))
+  };
+  const admitted = admitFreshEnginePvWitnesses(context, [witness]);
+  assert.equal(admitted.audit.acceptedLines, 2);
+  assert.equal(witness.multiPv, 3, "requested MultiPV remains provenance, not returned-line count");
+  assert.equal(admitFreshEnginePvWitnesses(context, [{ ...witness, lines: [witness.lines[0]] }]).audit.acceptedLines, 1);
+  for (const patch of [{ lines: [] }, { multiPv: 1 }, { rootMoves: roots, lines: [witness.lines[0]] }]) {
+    assert.equal(admitFreshEnginePvWitnesses(context, [{ ...witness, ...patch }]).audit.acceptedLines, 0);
+  }
+  for (const change of [(line) => {
+    line.depth = 17;
+  }, (line) => {
+    line.scoreCp = null;
+  }, (line) => {
+    line.pv = ["g7g6"];
+  }]) {
+    const invalid = structuredClone(witness);
+    change(invalid.lines[1]);
+    assert.equal(admitFreshEnginePvWitnesses(context, [invalid]).audit.acceptedLines, 0);
+  }
+  const rendered = simpleProseReferences("[Kg8](move:before:g7g8)", context, [], void 0, void 0, void 0, { freshEnginePvWitnesses: [witness] });
+  assert.equal(rendered.referenceGapCounts.unresolvedReferences, 0);
+  assert.equal(rendered.freshEnginePvAdmission.acceptedLines, 2);
+});

package/dist/research.js

@@ -211,7 +211,7 @@ import {
   wikibooksTargetsForTool,
   withBranchPreparation,
   withRecordedPositionTools
-} from "./chunk-PLKNJRPF.js";
+} from "./chunk-TYQ5WIL2.js";
 import {
   CHESS_REASONING_POLICY_VERSION,
   CHESS_REASONING_SCHEMA_VERSION,
@@ -316,7 +316,7 @@ import {
   validateReasoningPositionContext,
   validateSimpleAgentConfig,
   withEvidenceLicenses
-} from "./chunk-XQDZJOYD.js";
+} from "./chunk-6OXAG5H3.js";
 
 // src/chess-reasoning/ablation-direct-synthesis.ts
 import { SQUARES } from "chess.js";

package/dist/runtime-closure.json

@@ -99,5 +99,5 @@
     "@ai-sdk/provider",
     "@ai-sdk/provider-utils"
   ],
-  "runtimeBytes": 969108
+  "runtimeBytes": 969134
 }

package/dist/shared.js

@@ -62,7 +62,7 @@ import {
   toPositionAnalysisProvider,
   validateReasoningPositionContext,
   validateSimpleAgentConfig
-} from "./chunk-XQDZJOYD.js";
+} from "./chunk-6OXAG5H3.js";
 
 // src/player-perspective.ts
 function normalizedPlayerName(value) {

package/docs/API.md

@@ -80,3 +80,12 @@ remain in the canonical tool wrappers and host.
 
 
 See the [pipeline source](../src/chess-reasoning/answer-pipeline.ts) and [connector contract](../src/chess-reasoning/answer-model-connector.ts).
+
+
+### Completed MultiPV results
+
+Fresh engine presentation witnesses interpret `multiPv` as the requested maximum.
+An unrestricted completed search can return one through that many valid lines;
+the original requested count remains in the witness even when fewer lines arrive.
+Explicit `rootMoves` searches must still cover their entire requested root set.
+Depth, score, provenance, distinct-root and legal-PV checks remain unchanged.

package/npm-release.json

@@ -1,5 +1,5 @@
 {
   "registryDependencies": {
-    "@knights-eye-chess/move-classifier": "0.1.0-dev.10"
+    "@knights-eye-chess/move-classifier": "0.1.0-dev.14"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knights-eye-chess/ai-analysis",
-  "version": "0.1.0-dev.14",
+  "version": "0.1.0-dev.18",
   "type": "module",
   "files": [
     "dist",
@@ -51,7 +51,7 @@
   "dependencies": {
     "@ai-sdk/provider": "4.0.9",
     "@ai-sdk/provider-utils": "5.0.34",
-    "@knights-eye-chess/move-classifier": "0.1.0-dev.10",
+    "@knights-eye-chess/move-classifier": "0.1.0-dev.14",
     "@types/json-schema": "7.0.15",
     "@types/node": "22.19.19",
     "ai": "7.0.85",

package/scripts/check-release-tooling.mjs

@@ -7,7 +7,7 @@ import path from 'node:path';
 export function assertReleaseTooling(root = fileURLToPath(new URL('../', import.meta.url))) {
   const manifest = JSON.parse(readFileSync(path.join(root, 'scripts/release-tooling.json'), 'utf8'));
   if (manifest.schema !== 1 || manifest.canonical !== 'knightseye-net/tools/release-tooling') throw Error('Invalid release tooling stamp');
-  const required = ['scripts/pack.mjs', 'scripts/publish-reviewed.mjs', '.github/workflows/npm-publish.yml', 'scripts/verify-release.mjs', 'scripts/update-dependency.mjs', 'scripts/check-release-tooling.mjs', '.github/workflows/quality.yml'];
+  const required = ['scripts/check-review-marker.mjs', 'scripts/pack.mjs', 'scripts/publish-reviewed.mjs', '.github/workflows/npm-publish.yml', 'scripts/verify-release.mjs', 'scripts/update-dependency.mjs', 'scripts/check-release-tooling.mjs', '.github/workflows/quality.yml'];
   if (!manifest.sha256 || required.some(relative => !/^[a-f0-9]{64}$/.test(manifest.sha256[relative] || ''))) throw Error('Incomplete release tooling stamp');
   for (const [relative, expected] of Object.entries(manifest.sha256)) {
     if (path.isAbsolute(relative) || relative.split('/').includes('..')) throw Error(`Invalid tooling path: ${relative}`);

package/scripts/check-review-marker.mjs

@@ -0,0 +1,79 @@
+// Canonical source: knightseye-net/tools/release-tooling/templates/check-review-marker.mjs.
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const shaPattern = /^[a-f0-9]{40}$/;
+export async function requireReview({ repository, sha, branch, reviewer, token, checkoutSha,
+  fetchImpl = fetch }) {
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repository || '') || !shaPattern.test(sha || '') ||
+      checkoutSha !== sha || !['dev', 'production'].includes(branch) || reviewer !== 'Shedal' || !token) {
+    throw Error('Review gate requires repository, exact checkout SHA, release branch, Shedal and GitHub token');
+  }
+  const prefix = `/repos/${repository}`;
+  async function get(route) {
+    let response;
+    try {
+      response = await fetchImpl(`https://api.github.com${prefix}${route}`, {
+        headers: { Authorization: `Bearer ${token}`, Accept: 'application/vnd.github+json',
+          'X-GitHub-Api-Version': '2022-11-28' }, signal: AbortSignal.timeout(30000), redirect: 'error',
+      });
+    } catch { throw Error('Review evidence API unavailable'); }
+    if (!response.ok) throw Error(`Review evidence API failed: HTTP ${response.status}`);
+    try { return await response.json(); } catch { throw Error('Invalid review evidence JSON'); }
+  }
+  async function list(route) {
+    const all = [];
+    for (let page = 1; page <= 100; page++) {
+      const items = await get(`${route}?per_page=100&page=${page}`);
+      if (!Array.isArray(items)) throw Error('Invalid review evidence list');
+      all.push(...items);
+      if (items.length < 100) return all;
+    }
+    throw Error('Review evidence pagination limit reached');
+  }
+  const associated = await list(`/commits/${sha}/pulls`);
+  const matches = [];
+  const seen = new Set();
+  for (const candidate of associated) {
+    if (!Number.isSafeInteger(candidate.number) || candidate.number <= 0) throw Error('Invalid associated PR');
+    if (seen.has(candidate.number)) continue;
+    seen.add(candidate.number);
+    // Resolve current PR metadata, not the commit-association response's snapshot.
+    const pr = await get(`/pulls/${candidate.number}`);
+    if (pr.number === candidate.number && pr.merged === true && pr.merged_at &&
+        pr.merge_commit_sha === sha && pr.base?.ref === branch &&
+        pr.base?.repo?.full_name === repository) matches.push(pr);
+  }
+  if (matches.length !== 1) throw Error('Expected one merged release PR for the exact checkout SHA');
+  const pr = matches[0];
+  const comments = await list(`/issues/${pr.number}/comments`);
+  const decisions = [];
+  for (const comment of comments) {
+    if (comment.user?.login !== reviewer || typeof comment.body !== 'string') continue;
+    // Standalone line permits Claude's normal generated footer after the decision.
+    const markers = comment.body.split(/\r?\n/).filter(line =>
+      new RegExp(`^claude-review: (approved|rejected) ${sha}$`).test(line));
+    if (!markers.length) continue;
+    const created = Date.parse(comment.created_at), updated = Date.parse(comment.updated_at);
+    if (!Number.isSafeInteger(comment.id) || !Number.isFinite(created) || !Number.isFinite(updated) || updated < created) {
+      throw Error('Invalid review decision metadata');
+    }
+    const edited = updated !== created;
+    decisions.push({ id: comment.id, time: updated, approved: !edited && markers.length === 1 &&
+      markers[0] === `claude-review: approved ${sha}` });
+  }
+  decisions.sort((a, b) => a.time - b.time || a.id - b.id);
+  const latest = decisions.at(-1);
+  if (!latest?.approved) throw Error('Exact commit has no current unedited approval; post a fresh review decision');
+  return { repository, sha, reviewer, pullRequest: pr.number,
+    reviewUrl: `https://github.com/${repository}/pull/${pr.number}#issuecomment-${latest.id}` };
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const checkoutSha = execFileSync('git', ['rev-parse', 'HEAD'], { encoding: 'utf8' }).trim();
+  const receipt = await requireReview({ repository: process.env.GITHUB_REPOSITORY,
+    sha: process.env.GITHUB_SHA, branch: process.env.REVIEW_RELEASE_BRANCH,
+    reviewer: process.env.REVIEWER_LOGIN, token: process.env.GH_TOKEN, checkoutSha });
+  console.log(JSON.stringify(receipt));
+}

package/scripts/publish-reviewed.mjs

@@ -1,8 +1,9 @@
 // Generated from knightseye-net/tools/release-tooling; edit the canonical template and sync.
+import { requireReview } from './check-review-marker.mjs';
 import { assertReleaseTooling } from './check-release-tooling.mjs';
 import { readFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
-import { spawnSync } from 'node:child_process';
+import { spawnSync, execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 
@@ -11,15 +12,15 @@ export function npmFailure(result) {
   for (const output of [result.stdout, result.stderr]) {
     try { const parsed = JSON.parse(output || '{}'); error ||= parsed.error; } catch {}
   }
-  const allowed = new Set(['EOTP', 'E401', 'E403', 'E404', 'E409', 'E422', 'E429', 'E500', 'E502', 'E503', 'E504', 'EPROVENANCE', 'EUSAGE', 'ENEEDAUTH', 'ENOTP', 'EPRIVATE', 'EPUBLISHCONFLICT', 'EUNSCOPED', 'ECONNRESET', 'ETIMEDOUT', 'ENOTFOUND']);
-  const candidate = typeof error?.code === 'string' ? error.code : (result.stderr || '').match(/^npm (?:error|ERR!) code ([A-Z][A-Z0-9]+)\s*$/m)?.[1];
+  const allowed = new Set(['EOTP', 'E401', 'E403', 'E404', 'E408', 'E409', 'E422', 'E429', 'E500', 'E502', 'E503', 'E504', 'EPROVENANCE', 'EUSAGE', 'ENEEDAUTH', 'ENOTP', 'EPRIVATE', 'EPUBLISHCONFLICT', 'EUNSCOPED', 'ECONNRESET', 'ETIMEDOUT', 'ENOTFOUND', 'EAI_AGAIN', 'ECONNREFUSED']);
+  const candidate = typeof error?.code === 'string' ? error.code : result.error?.code || (result.stderr || '').match(/^npm (?:error|ERR!) code ([A-Z][A-Z0-9_]+)\s*$/m)?.[1];
   const code = allowed.has(candidate) ? candidate : 'UNKNOWN';
   const rawStatus = error?.statusCode ?? error?.status ?? (/^E[45]\d\d$/.test(code) ? Number(code.slice(1)) : undefined);
   const httpStatus = Number.isInteger(rawStatus) && rawStatus >= 400 && rawStatus <= 599 ? rawStatus : 'unknown';
   const exitStatus = Number.isInteger(result.status) && result.status >= 0 && result.status <= 255 ? result.status : 'unknown';
   return {code, httpStatus, exitStatus};
 }
-export function publishReviewed({root, version, sha256, env = process.env, run = spawnSync, wait = () => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 2000)}) {
+export function publishReviewed({root, version, sha256, env = process.env, run = spawnSync, wait = milliseconds => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds), now = Date.now}) {
   if (env.GITHUB_ACTIONS !== 'true' || env.GITHUB_EVENT_NAME !== 'workflow_dispatch' || env.GITHUB_REF !== 'refs/heads/dev') throw Error('Publishing requires manual GitHub Actions dispatch on dev');
   if (env.GITHUB_REPOSITORY_VISIBILITY !== 'public') throw Error('Provenance publishing requires a public GitHub repository');
   if (!env.NODE_AUTH_TOKEN?.trim()) throw Error('Missing NODE_AUTH_TOKEN; publication has no authentication fallback');
@@ -35,26 +36,31 @@ export function publishReviewed({root, version, sha256, env = process.env, run =
   const pkg = JSON.parse(metadataResult.stdout);
   if (pkg.name !== source.name || pkg.version !== version || pkg.private || pkg.publishConfig?.access !== 'public' || pkg.publishConfig?.registry !== 'https://registry.npmjs.org/' || pkg.publishConfig?.tag !== 'next') throw Error('Expected reviewed staged registry candidate');
   const integrity = 'sha512-' + createHash('sha512').update(bytes).digest('base64');
-  const lookupArgs = ['view', `${pkg.name}@${version}`, '--json', '--registry', 'https://registry.npmjs.org/'];
+  const lookupArgs = ['view', `${pkg.name}@${version}`, '--json', '--registry', 'https://registry.npmjs.org/', '--prefer-online', '--fetch-retries=0', '--fetch-timeout=15000'];
   const lookupOptions = { ...options, timeout: 15000 };
   const lookup = run('npm', lookupArgs, lookupOptions);
   if (lookup.status === 0) {
-    const existing = JSON.parse(lookup.stdout);
+    let existing;
+    try { existing = JSON.parse(lookup.stdout); } catch { throw Error('Registry lookup returned invalid JSON; refusing publication'); }
     if (existing.name !== pkg.name || existing.version !== version || existing.dist?.integrity !== integrity) throw Error('Published version exists with different identity or integrity');
     return { name: pkg.name, version, sha256, integrity, published: false, alreadyPublished: true, registryConfirmed: true };
   }
-  let error;
-  try { error = JSON.parse(lookup.stdout || '{}').error; } catch {}
-  if (error?.code !== 'E404') throw Error('Registry lookup failed; refusing publication');
+  const absent = npmFailure(lookup);
+  if (absent.code !== 'E404') throw Error(`Registry lookup failed; refusing publication: code=${absent.code}, httpStatus=${absent.httpStatus}, exitStatus=${absent.exitStatus}`);
   const result = run('npm', ['publish', archive, '--ignore-scripts', '--access', 'public', '--tag', 'next', '--registry', 'https://registry.npmjs.org/', '--provenance', '--json'], options);
   if (result.status !== 0) {
     const {code, httpStatus, exitStatus} = npmFailure(result);
     throw Error(`npm publish failed for ${pkg.name}@${version}: code=${code}, httpStatus=${httpStatus}, exitStatus=${exitStatus}`);
   }
-  let visible = false;
-  for (let attempt = 0; attempt < 3; attempt++) {
-    if (attempt) wait();
-    const confirmation = run('npm', lookupArgs, lookupOptions);
+  let visible = false, attempts = 0, lastFailure;
+  const started = now(), deadline = started + 240000;
+  const transientCodes = new Set(['E404', 'E408', 'E429', 'E500', 'E502', 'E503', 'E504', 'ECONNRESET', 'ETIMEDOUT', 'ENOTFOUND', 'EAI_AGAIN', 'ECONNREFUSED']);
+  for (let attempt = 0; attempt < 25; attempt++) {
+    if (attempt) wait(Math.min(10000, Math.max(0, deadline - now())));
+    const remaining = deadline - now();
+    if (remaining <= 0) break;
+    const confirmation = run('npm', lookupArgs, { ...lookupOptions, timeout: Math.min(15000, remaining) });
+    attempts++;
     if (confirmation.status === 0) {
       let existing;
       try { existing = JSON.parse(confirmation.stdout); } catch {}
@@ -62,11 +68,22 @@ export function publishReviewed({root, version, sha256, env = process.env, run =
       visible = true;
       break;
     }
+    lastFailure = npmFailure(confirmation);
+    const {code, httpStatus, exitStatus} = lastFailure;
+    if (['E401', 'E403', 'ENEEDAUTH', 'EOTP', 'ENOTP'].includes(code) || [401, 403].includes(httpStatus) || !(transientCodes.has(code) || [408, 429, 500, 502, 503, 504].includes(httpStatus))) {
+      throw Error(`Postpublication registry confirmation failed for ${pkg.name}@${version}: code=${code}, httpStatus=${httpStatus}, exitStatus=${exitStatus}; publication was not retried`);
+    }
+  }
+  if (!visible) {
+    const {code = 'UNKNOWN', httpStatus = 'unknown', exitStatus = 'unknown'} = lastFailure || {};
+    throw Error(`npm publication returned success but registry confirmation pending for ${pkg.name}@${version}: attempts=${attempts}, elapsedMs=${Math.max(0, Math.min(240000, now() - started))}, code=${code}, httpStatus=${httpStatus}, exitStatus=${exitStatus}; bounded confirmation ended, publication was not retried`);
   }
-  if (!visible) throw Error(`npm publication returned success but registry confirmation failed for ${pkg.name}@${version}; publication was not retried`);
   return { name: pkg.name, version, sha256, integrity, published: true, alreadyPublished: false, registryConfirmed: true };
 }
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
   assertReleaseTooling();
+  await requireReview({ repository: process.env.GITHUB_REPOSITORY, sha: process.env.GITHUB_SHA,
+    checkoutSha: execFileSync('git', ['rev-parse', 'HEAD'], { cwd: fileURLToPath(new URL('../', import.meta.url)), encoding: 'utf8' }).trim(),
+    branch: 'dev', reviewer: 'Shedal', token: process.env.GH_TOKEN });
   console.log(JSON.stringify(publishReviewed({root: fileURLToPath(new URL('../', import.meta.url)), version: process.argv[2], sha256: process.argv[3]})));
 }

package/scripts/release-tooling.json

@@ -3,11 +3,12 @@
   "canonical": "knightseye-net/tools/release-tooling",
   "sha256": {
     "scripts/pack.mjs": "334aa4041e59b14fd2b072969f50beea64449136f7f9146d63d7277fc2e4808a",
-    "scripts/publish-reviewed.mjs": "e9e8a6f5eeff37d5050b96e75fda2fa33084b1f9bc5d5a6688b0aef737dd51c5",
-    ".github/workflows/npm-publish.yml": "b25cec136db205d69a407284dae2bb66f3d56be13ed2a1367f0db167a232050d",
+    "scripts/check-review-marker.mjs": "1d06c9139a835e47f78eef1bff221d5ccdc57c10f0731796ca6f5f0e3ca49e7f",
+    "scripts/publish-reviewed.mjs": "e046dda0c47cb4f7b2d044e22d7c719d5f1fda02762bef4d013125da6258fbd3",
+    ".github/workflows/npm-publish.yml": "0bb481c699566136e271babf8bdb7860b545c0e789034c0e06f5c0556d84b250",
     "scripts/verify-release.mjs": "d0f9baead779e553385bb7c26f1238ad4e60a189a818d4db4f721a1e5f88dedc",
     "scripts/update-dependency.mjs": "9919f172be33973f124eabf56c1dc70e41e941e601783ef01aba1c47dd70db9d",
-    "scripts/check-release-tooling.mjs": "29563619bdc3e86ef10dec1e983274e36138193f04d33f2455501b59a4016e0d",
+    "scripts/check-release-tooling.mjs": "667e9c096ef28cddaefb90be92601828e7268c39f8a285f6644d3784db6f5064",
     ".github/workflows/quality.yml": "a014920a9f89dc494a020bee5f69aec779cf58825f491690f9ed1ec089ed6fa0"
   }
 }

package/src/chess-reasoning/fresh-engine-pv-witnesses.ts

@@ -52,7 +52,7 @@ function rejectionReason(context: ReasoningPositionContext, hash: string, witnes
     || witness.fen !== (witness.phase === 'before' ? context.fenBefore : context.fenAfter)) return 'root-mismatch';
   if (typeof witness.engineBuild !== 'string' || !witness.engineBuild || typeof witness.command !== 'string' || !witness.command
     || !positiveInteger(witness.requestedDepth) || !positiveInteger(witness.multiPv) || witness.multiPv > 32
-    || !Array.isArray(witness.lines) || witness.lines.length !== witness.multiPv
+    || !Array.isArray(witness.lines) || witness.lines.length < 1 || witness.lines.length > witness.multiPv
     || !Array.isArray(witness.rootMoves) || witness.rootMoves.length > 32
     || witness.rootMoves.some(root => typeof root !== 'string' || !UCI.test(root))
     || new Set(witness.rootMoves).size !== witness.rootMoves.length) return 'invalid-search-scope';

package/test/owner/prose-reference-admission.test.mjs

@@ -24,3 +24,31 @@ test('fresh answer witnesses preserve shipped v22 reference geometry and reject
   assert.equal(rejected.referenceGapCounts.unresolvedReferences,1);
   assert.equal(rejected.blocks[0].tokens[0].reference,undefined);
 });
+
+
+test('completed unrestricted MultiPV witnesses accept fewer lines without changing requested scope', () => {
+  const fen='7r/p1p1p1kp/2p2rpQ/3q4/3P4/2P5/P1P2PP1/R3K2R b KQ - 5 18';
+  const context={kind:'position',nodeId:'two-legal',historyStartFen:fen,historyUci:[],moveUci:'',moveSan:'',fenBefore:fen,fenAfter:fen};
+  const roots=['g7g8','g7f7'];
+  assert.deepEqual(new Set(new Chess(fen).moves({verbose:true}).map(m=>m.from+m.to)),new Set(roots));
+  const witness={version:'fresh-engine-pv-witness/1',acquisition:'same-answer-engine',acquisitionId:1,
+    evidenceId:'server-engine-acquisition:two-legal',contextHash:reasoningContextHash(context),phase:'before',fen,
+    engineBuild:'test-engine',command:'go depth 18',requestedDepth:18,multiPv:3,rootMoves:[],
+    authority:'bounded-engine',licenses:['engine.bounded-continuation'],
+    lines:roots.map((rootMove,index)=>({rootMove,pv:[rootMove],depth:18,scoreCp:-200-index,mateInMoves:null,
+      scoreProvenance:{kind:'root-search',fen,engineBuild:'test-engine',command:'go depth 18',originatingDepth:18,reportedDepth:18}}))};
+  const admitted=admitFreshEnginePvWitnesses(context,[witness]);
+  assert.equal(admitted.audit.acceptedLines,2);
+  assert.equal(witness.multiPv,3,'requested MultiPV remains provenance, not returned-line count');
+  assert.equal(admitFreshEnginePvWitnesses(context,[{...witness,lines:[witness.lines[0]]}]).audit.acceptedLines,1);
+  for (const patch of [{lines:[]},{multiPv:1},{rootMoves:roots,lines:[witness.lines[0]]}]) {
+    assert.equal(admitFreshEnginePvWitnesses(context,[{...witness,...patch}]).audit.acceptedLines,0);
+  }
+  for (const change of [line=>{line.depth=17;},line=>{line.scoreCp=null;},line=>{line.pv=['g7g6'];}]) {
+    const invalid=structuredClone(witness);change(invalid.lines[1]);
+    assert.equal(admitFreshEnginePvWitnesses(context,[invalid]).audit.acceptedLines,0);
+  }
+  const rendered=simpleProseReferences('[Kg8](move:before:g7g8)',context,[],undefined,undefined,undefined,{freshEnginePvWitnesses:[witness]});
+  assert.equal(rendered.referenceGapCounts.unresolvedReferences,0);
+  assert.equal(rendered.freshEnginePvAdmission.acceptedLines,2);
+});