@kontourai/survey 1.15.0 → 1.16.0

package/README.md

@@ -105,6 +105,24 @@ Keep producer operational state outside Survey. Queue status, reviewer form stat
 
 When you build an `authorized-action` authorizing block outside the workbench, pair `buildAuthorizedActionAuthorizing` with `buildPromptRef({ module, component, version?, scheme? })` — `buildPromptRef` formats a well-formed, versioned `promptRef` (bare `"review-workbench/decision-card@v1"` or scheme-prefixed `"survey://<module>/<component>@v1"`) that `buildAuthorizedActionAuthorizing` accepts directly, instead of hand-formatting the string.
 
+## Review lifecycle
+
+`ReviewOutcome.resolution` optionally records the terminal result of a review
+round while preserving compatibility with outcomes that infer their result from
+`status`. The explicit `could_not_confirm` resolution requires a non-empty
+`resolutionReason`; `attemptEvidenceIds` may record evidence of what the reviewer
+tried. It is valid only with an unchanged `proposed` or `assumed` status.
+Other explicit resolutions must also agree with status: accepted is
+verified/assumed, rejected is rejected, and held is any non-rejected retained
+posture.
+
+Could-not-confirm is terminal for the review round, but it is not rejection,
+verification, or escalation. Surface projection stays quiet: the claim keeps its
+pre-review status, no attempt evidence is projected, and no review-derived
+freshness, validity, gap, or verification posture is added. The outcome remains
+available in Survey review records, canonical review proof v3, and the distinct
+`learning.could-not-confirm` producer-learning signal.
+
 ## Review Workbench embed
 
 **Web component** (shadow DOM, no framework required):
@@ -181,7 +199,7 @@ Drive review-queue decisions from an MCP agent (Claude Desktop, Cursor, or any M
 npx survey-review-mcp --session path/to/session.json
 ```
 
-Three tools: `survey_review_queue` (queue state), `survey_review_item` (item detail), and `survey_review_decide` (record a decision). Each queue and item call includes an embedded, fully self-contained review card with Accept / Hold / Reject buttons. See [docs/review-mcp.md](docs/review-mcp.md).
+Three tools: `survey_review_queue` (queue state), `survey_review_item` (item detail), and `survey_review_decide` (record a decision). Each queue and item call includes an embedded, fully self-contained review card with Accept / Hold / Reject / Could not confirm actions. See [docs/review-mcp.md](docs/review-mcp.md).
 
 At viewports ≤ 980 px, the queue panel becomes a slide-in drawer with a compact progress bar. At narrow container widths, `cqi`-based type scaling keeps candidate values from overflowing at 360 px. CSS custom properties (`--k-*`) inherit through the shadow boundary so the host can theme either mode without forking styles.
 

package/dist/src/calibration.d.ts

@@ -151,6 +151,7 @@ export interface CalibrationMetrics {
  * label. A sample is skipped when it carries no human label or no prediction:
  *
  * - status "proposed" (not yet reviewed);
+ * - resolution "could_not_confirm" (no human correctness label);
  * - a machine auto-accept, unless `includeAutoAccepted` is set;
  * - no `selectedCandidateId`, or the selected candidate / its confidence is
  *   missing or non-finite (no prediction to calibrate).

package/dist/src/calibration.js

@@ -37,6 +37,7 @@ const DEFAULT_MIN_BIN_SAMPLES = 1;
  * label. A sample is skipped when it carries no human label or no prediction:
  *
  * - status "proposed" (not yet reviewed);
+ * - resolution "could_not_confirm" (no human correctness label);
  * - a machine auto-accept, unless `includeAutoAccepted` is set;
  * - no `selectedCandidateId`, or the selected candidate / its confidence is
  *   missing or non-finite (no prediction to calibrate).
@@ -66,6 +67,10 @@ export function deriveCalibration(input, options = {}) {
     const samples = [];
     let skippedCount = 0;
     for (const outcome of input.reviewOutcomes) {
+        if (outcome.resolution === "could_not_confirm") {
+            skippedCount++;
+            continue;
+        }
         if (cutoff !== undefined) {
             const t = outcome.reviewedAt ? Date.parse(outcome.reviewedAt) : NaN;
             if (isNaN(t) || t < cutoff) {

package/dist/src/index.d.ts

@@ -1,4 +1,4 @@
-export type { CandidateSetStatus, Candidate, CandidateSet, ClaimTarget, EscalationDimension, EscalationRecord, Extraction, Interpretation, LocatorScheme, ProvenanceResolution, RawSource, RawSourceKind, ReviewAuthorizing, ReviewAuthorizingAuthorizedAction, ReviewAuthorizingExchange, ReviewAuthorizingExplicitStatement, ReviewAuthorizingKind, ReviewOutcome, ReviewStatus, SurveyInput, } from "./types.js";
+export type { CandidateSetStatus, Candidate, CandidateSet, ClaimTarget, EscalationDimension, EscalationRecord, Extraction, Interpretation, LocatorScheme, ProvenanceResolution, RawSource, RawSourceKind, ReviewAuthorizing, ReviewAuthorizingAuthorizedAction, ReviewAuthorizingExchange, ReviewAuthorizingExplicitStatement, ReviewAuthorizingKind, ReviewOutcome, ReviewResolution, ReviewStatus, SurveyInput, } from "./types.js";
 export { SURVEY_INPUT_CONTRACT_VERSION } from "./types.js";
 export { reviewResourceApiVersion } from "./review-resource.js";
 export type { CandidateRole, ClaimTargetHint, ProducerPolicy, ExtractionReference, ResourceEnvelope, ResourceMetadata, ReviewActor, ReviewCandidate, ReviewDecision, ReviewDecisionMode, ReviewDecisionSpec, ReviewDecisionStatus, ReviewItem, ReviewItemSpec, ReviewItemStatus, ReviewLocator, ReviewResource, ReviewResourceApiVersion, ReviewResourceKind, ReviewSession, ReviewSessionEvent, ReviewSessionEventSpec, ReviewSessionEventStatus, ReviewSessionEventType, ReviewSessionSpec, ReviewSessionStatus, ReviewValueDescriptor, ReviewValueType, SourceReference, SurveyRecordProjectionHint, } from "./review-resource.js";

package/dist/src/learning-projections.d.ts

@@ -1,6 +1,6 @@
 import type { SurveyInput } from "./types.js";
-export type LearningProjectionKind = "learning.comfort-zone" | "learning.escalation" | "learning.rejected-candidate";
-export type LearningProjectionSignal = "comfort-zone.outside" | "escalation.unresolved" | "rejected-candidate.reason";
+export type LearningProjectionKind = "learning.comfort-zone" | "learning.escalation" | "learning.rejected-candidate" | "learning.could-not-confirm";
+export type LearningProjectionSignal = "comfort-zone.outside" | "escalation.unresolved" | "rejected-candidate.reason" | "could-not-confirm.reason";
 export type LearningProjectionSeverity = "info" | "attention";
 export interface LearningProjection {
     id: string;

package/dist/src/learning-projections.js

@@ -40,6 +40,31 @@ export function buildSurveyLearningProjections(input) {
         }
     }
     for (const reviewOutcome of input.reviewOutcomes) {
+        if (reviewOutcome.resolution === "could_not_confirm") {
+            const target = candidateSetTargets.get(reviewOutcome.candidateSetId);
+            const claim = findClaimForReview(claimsByCandidateSet.get(reviewOutcome.candidateSetId) ?? [], reviewOutcome);
+            const resolutionReason = normalizeText(reviewOutcome.resolutionReason) ?? "(no reason recorded)";
+            projections.push({
+                id: `${reviewOutcome.id}.learning.could-not-confirm`,
+                kind: "learning.could-not-confirm",
+                source: input.source,
+                createdAt: reviewOutcome.reviewedAt ?? input.generatedAt,
+                target,
+                claimId: claim?.id,
+                reviewOutcomeId: reviewOutcome.id,
+                signal: "could-not-confirm.reason",
+                severity: "attention",
+                summary: `Could not confirm: ${resolutionReason}`,
+                metadata: {
+                    couldNotConfirm: {
+                        reason: resolutionReason,
+                        ...(reviewOutcome.attemptEvidenceIds?.length
+                            ? { attemptEvidenceIds: [...reviewOutcome.attemptEvidenceIds] }
+                            : {}),
+                    },
+                },
+            });
+        }
         if (reviewOutcome.withinComfortZone !== false)
             continue;
         const target = candidateSetTargets.get(reviewOutcome.candidateSetId);

package/dist/src/mcp/review-mcp.js

@@ -30,6 +30,7 @@ const MCP_DECISION_MAP = {
     accept: "accept-proposed",
     hold: "keep-current",
     reject: "reject-proposed",
+    "could-not-confirm": "could-not-confirm",
 };
 async function readSessionFile(path) {
     const raw = await readFile(path, "utf8");
@@ -59,7 +60,7 @@ function queueSummaryText(snapshot, events) {
         `Active item: ${activeItem.metadata.name} (${activeItem.spec.target})`,
         ...(nextItem ? [`Next unresolved: ${nextItem}`] : ["All items resolved."]),
         ``,
-        `Session summary: accepted=${summary.accepted} keptCurrent=${summary.keptCurrent} rejected=${summary.rejected} escalated=${summary.escalated} unresolved=${summary.unresolved}`,
+        `Session summary: accepted=${summary.accepted} keptCurrent=${summary.keptCurrent} rejected=${summary.rejected} couldNotConfirm=${summary.couldNotConfirm ?? 0} escalated=${summary.escalated} unresolved=${summary.unresolved}`,
         ``,
         `Items:`,
         ...rows,
@@ -202,12 +203,13 @@ h1{font-size:15px;font-weight:700;margin:0 0 4px}
 .note-label{font-size:11px;color:var(--k-text-muted);margin-bottom:4px}
 .note-input{width:100%;background:var(--k-panel-raised);border:1px solid var(--k-line-strong);border-radius:var(--k-radius-sm);color:var(--k-text);font:inherit;font-size:12px;padding:7px 10px;resize:vertical;min-height:52px}
 .note-input:focus{outline:2px solid var(--k-brand);outline-offset:1px;border-color:transparent}
-.btn-row{display:grid;grid-template-columns:1fr 1fr 1fr;gap:8px;margin-top:10px}
+.btn-row{display:grid;grid-template-columns:1fr 1fr;gap:8px;margin-top:10px}
 .btn{padding:9px 4px;border:1px solid var(--k-line-strong);border-radius:var(--k-radius-sm);background:var(--k-panel-raised);color:var(--k-text-muted);font:inherit;font-size:12px;font-weight:600;cursor:pointer;transition:background .12s,color .12s,border-color .12s}
 .btn:hover{background:var(--k-panel);border-color:var(--k-brand);color:var(--k-text)}
 .btn-accept:hover,.btn-accept.active{background:color-mix(in srgb,var(--k-positive) 16%,transparent);border-color:var(--k-positive);color:var(--k-positive)}
 .btn-hold:hover,.btn-hold.active{background:color-mix(in srgb,var(--k-caution) 16%,transparent);border-color:var(--k-caution);color:var(--k-caution)}
 .btn-reject:hover,.btn-reject.active{background:color-mix(in srgb,var(--k-negative) 16%,transparent);border-color:var(--k-negative);color:var(--k-negative)}
+.btn-unconfirmed:hover,.btn-unconfirmed.active{background:color-mix(in srgb,var(--k-caution) 16%,transparent);border-color:var(--k-caution);color:var(--k-caution)}
 .feedback{font-size:11px;color:var(--k-text-faint);margin-top:8px;min-height:16px}
 </style>
 </head>
@@ -239,13 +241,14 @@ h1{font-size:15px;font-weight:700;margin:0 0 4px}
 
 <div class="divider"></div>
 
-<div class="note-label">Reviewer note (optional)</div>
+<div class="note-label">Reviewer note (required for Could not confirm)</div>
 <textarea class="note-input" id="note" placeholder="Add a rationale for this decision...">${escapeHtml(current.notesByItemName[item.metadata.name] ?? "")}</textarea>
 
 <div class="btn-row">
   <button class="btn btn-accept${decision === "accept-proposed" ? " active" : ""}" id="btn-accept">Accept proposed</button>
   <button class="btn btn-hold${decision === "keep-current" ? " active" : ""}" id="btn-hold">Hold / Keep current</button>
   <button class="btn btn-reject${decision === "reject-proposed" ? " active" : ""}" id="btn-reject">Reject proposed</button>
+  <button class="btn btn-unconfirmed${decision === "could-not-confirm" ? " active" : ""}" id="btn-unconfirmed">Could not confirm</button>
 </div>
 <div class="feedback" id="feedback"></div>
 
@@ -256,20 +259,29 @@ h1{font-size:15px;font-weight:700;margin:0 0 4px}
 
   function postDecision(decision) {
     var note = document.getElementById('note').value;
+    if (decision === 'could-not-confirm' && !note.trim()) {
+      document.getElementById('feedback').textContent = 'A reason is required when you could not confirm.';
+      document.getElementById('note').focus();
+      return false;
+    }
     window.parent.postMessage({
       jsonrpc: "2.0",
       id: msgId++,
       method: "tools/call",
       params: {
         name: "survey_review_decide",
-        arguments: { itemName: itemName, decision: decision, note: note || undefined }
+        arguments: decision === 'could-not-confirm'
+          ? { itemName: itemName, decision: decision, reason: note }
+          : { itemName: itemName, decision: decision, note: note || undefined }
       }
     }, "*");
+    return true;
   }
 
   document.getElementById('btn-accept').addEventListener('click', function () { postDecision('accept'); document.getElementById('feedback').textContent = 'Submitting accept…'; });
   document.getElementById('btn-hold').addEventListener('click', function () { postDecision('hold'); document.getElementById('feedback').textContent = 'Submitting hold…'; });
   document.getElementById('btn-reject').addEventListener('click', function () { postDecision('reject'); document.getElementById('feedback').textContent = 'Submitting reject…'; });
+  document.getElementById('btn-unconfirmed').addEventListener('click', function () { if (postDecision('could-not-confirm')) document.getElementById('feedback').textContent = 'Submitting could not confirm…'; });
 
   window.addEventListener('message', function (evt) {
     var data = evt.data;
@@ -347,10 +359,13 @@ async function toolItem(itemName, options) {
     }
     return content;
 }
-async function toolDecide(itemName, mcpDecision, note, options) {
+async function toolDecide(itemName, mcpDecision, note, attemptEvidenceIds, options) {
     const wbDecision = MCP_DECISION_MAP[mcpDecision];
     if (!wbDecision) {
-        throw new DomainError(`Invalid decision: ${mcpDecision}. Must be accept, hold, or reject.`);
+        throw new DomainError(`Invalid decision: ${mcpDecision}. Must be accept, hold, reject, or could-not-confirm.`);
+    }
+    if (wbDecision === "could-not-confirm" && !note?.trim()) {
+        throw new DomainError("survey_review_decide requires a non-empty reason for could-not-confirm");
     }
     const file = await readSessionFile(options.sessionPath);
     const { snapshot, events } = file;
@@ -378,6 +393,14 @@ async function toolDecide(itemName, mcpDecision, note, options) {
                 },
             }
             : {}),
+        ...(attemptEvidenceIds?.length
+            ? {
+                attemptEvidenceIdsByItemName: {
+                    ...current.attemptEvidenceIdsByItemName,
+                    [itemName]: [...attemptEvidenceIds],
+                },
+            }
+            : {}),
     };
     // Use the server session APIs for apply-path validation
     const record = createServerReviewSessionRecord({
@@ -518,19 +541,29 @@ async function handleLine(line, options, serverVersion) {
                         {
                             name: "survey_review_decide",
                             title: "Record a review decision",
-                            description: "Apply a decision to a review item and persist it to the session file. Decision must be accept (accept-proposed), hold (keep-current), or reject (reject-proposed). Domain failures return isError:true.",
+                            description: "Apply a decision to a review item and persist it to the session file. Decision must be accept, hold, reject, or could-not-confirm. Could-not-confirm requires a reason. Domain failures return isError:true.",
                             inputSchema: {
                                 type: "object",
                                 properties: {
                                     itemName: { type: "string", description: "The ReviewItem name to decide." },
                                     decision: {
                                         type: "string",
-                                        enum: ["accept", "hold", "reject"],
-                                        description: "accept = accept-proposed, hold = keep-current, reject = reject-proposed.",
+                                        enum: ["accept", "hold", "reject", "could-not-confirm"],
+                                        description: "accept = accept-proposed, hold = keep-current, reject = reject-proposed, could-not-confirm = terminal non-answer.",
                                     },
                                     note: { type: "string", description: "Optional reviewer note / rationale." },
+                                    reason: { type: "string", minLength: 1, description: "Required non-empty reason when decision is could-not-confirm." },
+                                    attemptEvidenceIds: {
+                                        type: "array",
+                                        items: { type: "string" },
+                                        description: "Optional evidence ids recording what was attempted before could-not-confirm.",
+                                    },
                                 },
                                 required: ["itemName", "decision"],
+                                allOf: [{
+                                        if: { properties: { decision: { const: "could-not-confirm" } }, required: ["decision"] },
+                                        then: { required: ["reason"] },
+                                    }],
                             },
                         },
                     ],
@@ -587,11 +620,16 @@ async function handleLine(line, options, serverVersion) {
                     const itemName = typeof toolArgs.itemName === "string" ? toolArgs.itemName : "";
                     const decision = typeof toolArgs.decision === "string" ? toolArgs.decision : "";
                     const note = typeof toolArgs.note === "string" ? toolArgs.note : undefined;
+                    const reason = typeof toolArgs.reason === "string" ? toolArgs.reason : undefined;
+                    const attemptEvidenceIds = Array.isArray(toolArgs.attemptEvidenceIds)
+                        && toolArgs.attemptEvidenceIds.every((value) => typeof value === "string")
+                        ? toolArgs.attemptEvidenceIds
+                        : undefined;
                     if (!itemName)
                         throw new DomainError("survey_review_decide requires itemName");
                     if (!decision)
                         throw new DomainError("survey_review_decide requires decision");
-                    content = await toolDecide(itemName, decision, note, options);
+                    content = await toolDecide(itemName, decision, decision === "could-not-confirm" ? reason : note, attemptEvidenceIds, options);
                 }
                 else {
                     send({ jsonrpc: "2.0", id, error: { code: -32602, message: `Unknown tool: ${name || "(missing name)"}` } });

package/dist/src/producer-discipline.d.ts

@@ -1,4 +1,5 @@
 import type { TrustStatus } from "@kontourai/surface";
+import type { CandidateSetStatus, ReviewResolution } from "./types.js";
 /**
  * Producer Discipline core — CONTEXT.md "Producer Discipline" /
  * "Source-of-Authority Observation".
@@ -28,13 +29,25 @@ import type { TrustStatus } from "@kontourai/surface";
  * src/index.ts.
  */
 export interface ReviewOutcomePosture {
+    status?: TrustStatus;
     actor?: string;
     reviewedAt?: string;
+    resolution?: ReviewResolution;
+    resolutionReason?: string;
+    attemptEvidenceIds?: readonly string[];
 }
+/** Explicit review resolutions refine (but may not contradict) status:
+ * accepted -> verified/assumed; rejected -> rejected; held -> any non-rejected
+ * pre-existing posture; could_not_confirm -> proposed/assumed with reviewer,
+ * time, and reason. */
+export declare function assertReviewResolutionConsistency(subject: string, review: ReviewOutcomePosture): void;
 export declare function assertReviewOutcomeDiscipline(input: {
     /** Message subject, e.g. `Claim ${id}` or `Source-of-authority observation ${id}` —
      *  each call site supplies its own noun so error text is unchanged. */
     subject: string;
     status: TrustStatus | undefined;
     review?: ReviewOutcomePosture;
+    /** Candidate-set conflict/escalation is an independent pre-review posture.
+     * A could-not-confirm round must preserve it as disputed, never downgrade it. */
+    candidateSetStatus?: CandidateSetStatus;
 }): void;

package/dist/src/producer-discipline.js

@@ -1,4 +1,45 @@
+/** Explicit review resolutions refine (but may not contradict) status:
+ * accepted -> verified/assumed; rejected -> rejected; held -> any non-rejected
+ * pre-existing posture; could_not_confirm -> proposed/assumed with reviewer,
+ * time, and reason. */
+export function assertReviewResolutionConsistency(subject, review) {
+    if (review.resolution === undefined)
+        return;
+    const statusAllowed = review.resolution === "accepted"
+        ? review.status === "verified" || review.status === "assumed"
+        : review.resolution === "rejected"
+            ? review.status === "rejected"
+            : review.resolution === "held"
+                ? review.status === "verified" || review.status === "assumed" || review.status === "proposed"
+                : review.status === "proposed" || review.status === "assumed";
+    if (!statusAllowed) {
+        throw new Error(`${subject} review resolution ${review.resolution} cannot use status ${review.status ?? "undefined"}`);
+    }
+    if (review.resolution !== "could_not_confirm")
+        return;
+    if (!review.resolutionReason?.trim()) {
+        throw new Error(`${subject} review resolution could_not_confirm requires a non-empty resolutionReason`);
+    }
+    if (!review.actor?.trim()) {
+        throw new Error(`${subject} review resolution could_not_confirm requires a review actor`);
+    }
+    if (!review.reviewedAt?.trim()) {
+        throw new Error(`${subject} review resolution could_not_confirm requires reviewedAt`);
+    }
+}
 export function assertReviewOutcomeDiscipline(input) {
+    if (input.review) {
+        assertReviewResolutionConsistency(input.subject, input.review);
+    }
+    if (input.review?.resolution === "could_not_confirm"
+        && (input.status === "verified" || input.status === "rejected")) {
+        throw new Error(`${input.subject} review resolution could_not_confirm cannot use status ${input.status}`);
+    }
+    if (input.review?.resolution === "could_not_confirm"
+        && (input.candidateSetStatus === "conflict" || input.candidateSetStatus === "escalated")
+        && input.status !== "disputed") {
+        throw new Error(`${input.subject} review resolution could_not_confirm cannot mask ${input.candidateSetStatus} as ${input.status}`);
+    }
     if (input.status !== "verified" && input.status !== "assumed")
         return;
     if (!input.review) {

package/dist/src/review-proof.d.ts

@@ -1,11 +1,13 @@
 import type { IntegrityAnchor } from "@kontourai/surface";
 import type { Candidate, CandidateSet, ClaimTarget, Extraction, RawSource, ReviewAuthorizing, ReviewOutcome } from "./types.js";
 export declare const REVIEW_PROOF_SCHEMA = "survey.review-proof";
-export declare const REVIEW_PROOF_SCHEMA_VERSION = 2;
+export declare const REVIEW_PROOF_SCHEMA_VERSION = 3;
 export declare const REVIEW_PROOF_PACKAGE_NAME = "@kontourai/survey";
-export declare const REVIEW_PROOF_CONTRACT_VERSION = "2";
+export declare const REVIEW_PROOF_CONTRACT_VERSION = "3";
 declare const LEGACY_REVIEW_PROOF_SCHEMA_VERSION = 1;
 declare const LEGACY_REVIEW_PROOF_CONTRACT_VERSION = "1";
+declare const REVIEW_PROOF_SCHEMA_VERSION_V2 = 2;
+declare const REVIEW_PROOF_CONTRACT_VERSION_V2 = "2";
 export interface ReviewProofInput {
     rawSource: RawSource;
     extraction: Extraction;
@@ -128,20 +130,32 @@ type CanonicalReviewAuthorizing = (Extract<ReviewAuthorizing, {
 export type CanonicalReviewProofPayloadV2 = Omit<CanonicalReviewProofPayloadV1, "schemaVersion" | "proof" | "reviewOutcome"> & {
     schemaVersion: 2;
     proof: Omit<CanonicalReviewProofPayloadV1["proof"], "schemaVersion" | "packageVersion"> & {
-        schemaVersion: typeof REVIEW_PROOF_SCHEMA_VERSION;
-        packageVersion: typeof REVIEW_PROOF_CONTRACT_VERSION;
+        schemaVersion: typeof REVIEW_PROOF_SCHEMA_VERSION_V2;
+        packageVersion: typeof REVIEW_PROOF_CONTRACT_VERSION_V2;
     };
     reviewOutcome?: NonNullable<CanonicalReviewProofPayloadV1["reviewOutcome"]> & {
         authorizing?: CanonicalReviewAuthorizing;
     };
 };
-export type CanonicalReviewProofPayload = CanonicalReviewProofPayloadV1 | CanonicalReviewProofPayloadV2;
-export declare function buildCanonicalReviewProofPayload(input: ReviewProofInput): CanonicalReviewProofPayloadV2;
+export type CanonicalReviewProofPayloadV3 = Omit<CanonicalReviewProofPayloadV2, "schemaVersion" | "proof" | "reviewOutcome"> & {
+    schemaVersion: 3;
+    proof: Omit<CanonicalReviewProofPayloadV2["proof"], "schemaVersion" | "packageVersion"> & {
+        schemaVersion: typeof REVIEW_PROOF_SCHEMA_VERSION;
+        packageVersion: typeof REVIEW_PROOF_CONTRACT_VERSION;
+    };
+    reviewOutcome?: NonNullable<CanonicalReviewProofPayloadV2["reviewOutcome"]> & {
+        resolution?: ReviewOutcome["resolution"];
+        resolutionReason?: string;
+        attemptEvidenceIds?: string[];
+    };
+};
+export type CanonicalReviewProofPayload = CanonicalReviewProofPayloadV1 | CanonicalReviewProofPayloadV2 | CanonicalReviewProofPayloadV3;
+export declare function buildCanonicalReviewProofPayload(input: ReviewProofInput): CanonicalReviewProofPayloadV3;
 export declare function canonicalReviewProofJson(payload: CanonicalReviewProofPayload): string;
 export declare function hashCanonicalReviewProofPayload(payload: CanonicalReviewProofPayload): string;
 /**
- * Verifies the integrity hash of a persisted v1 or v2 canonical review proof.
- * Envelope compatibility and v2 authorizing admissibility are checked before
+ * Verifies the integrity hash of a persisted v1, v2, or v3 canonical review proof.
+ * Envelope compatibility and version-specific admissibility are checked before
  * the expected hash is compared.
  */
 export declare function verifyCanonicalReviewProofPayload(payload: unknown, expectedHash: string): boolean;

package/dist/src/review-proof.js

@@ -1,15 +1,21 @@
 import { createHash } from "node:crypto";
 import { validateAuthorizing } from "./review-authorizing.js";
+import { assertReviewResolutionConsistency } from "./producer-discipline.js";
 export const REVIEW_PROOF_SCHEMA = "survey.review-proof";
-export const REVIEW_PROOF_SCHEMA_VERSION = 2;
+export const REVIEW_PROOF_SCHEMA_VERSION = 3;
 export const REVIEW_PROOF_PACKAGE_NAME = "@kontourai/survey";
 // Version of the review proof contract emitted by this helper. This is intentionally
 // independent from the npm package release version because it participates in hashes.
-export const REVIEW_PROOF_CONTRACT_VERSION = "2";
+export const REVIEW_PROOF_CONTRACT_VERSION = "3";
 const LEGACY_REVIEW_PROOF_SCHEMA_VERSION = 1;
 const LEGACY_REVIEW_PROOF_CONTRACT_VERSION = "1";
+const REVIEW_PROOF_SCHEMA_VERSION_V2 = 2;
+const REVIEW_PROOF_CONTRACT_VERSION_V2 = "2";
 export function buildCanonicalReviewProofPayload(input) {
     assertCandidateConsistency(input);
+    if (input.reviewOutcome) {
+        assertReviewResolutionConsistency("Canonical review proof", input.reviewOutcome);
+    }
     return {
         schemaVersion: REVIEW_PROOF_SCHEMA_VERSION,
         proof: {
@@ -77,6 +83,13 @@ export function buildCanonicalReviewProofPayload(input) {
                 candidateSetId: input.reviewOutcome.candidateSetId,
                 candidateId: input.reviewOutcome.candidateId,
                 status: input.reviewOutcome.status,
+                ...(input.reviewOutcome.resolution !== undefined ? { resolution: input.reviewOutcome.resolution } : {}),
+                ...(input.reviewOutcome.resolutionReason !== undefined
+                    ? { resolutionReason: input.reviewOutcome.resolutionReason }
+                    : {}),
+                ...(input.reviewOutcome.attemptEvidenceIds
+                    ? { attemptEvidenceIds: [...input.reviewOutcome.attemptEvidenceIds].sort() }
+                    : {}),
                 actor: input.reviewOutcome.actor,
                 reviewedAt: input.reviewOutcome.reviewedAt,
                 rationale: input.reviewOutcome.rationale,
@@ -187,8 +200,8 @@ export function hashCanonicalReviewProofPayload(payload) {
     return createHash("sha256").update(canonicalReviewProofJson(payload)).digest("hex");
 }
 /**
- * Verifies the integrity hash of a persisted v1 or v2 canonical review proof.
- * Envelope compatibility and v2 authorizing admissibility are checked before
+ * Verifies the integrity hash of a persisted v1, v2, or v3 canonical review proof.
+ * Envelope compatibility and version-specific admissibility are checked before
  * the expected hash is compared.
  */
 export function verifyCanonicalReviewProofPayload(payload, expectedHash) {
@@ -210,7 +223,30 @@ export function verifyCanonicalReviewProofPayload(payload, expectedHash) {
                 || packageVersion !== LEGACY_REVIEW_PROOF_CONTRACT_VERSION) {
                 return false;
             }
-            if (isRecord(reviewOutcome) && Object.prototype.hasOwnProperty.call(reviewOutcome, "authorizing")) {
+            if (isRecord(reviewOutcome)
+                && (Object.prototype.hasOwnProperty.call(reviewOutcome, "authorizing")
+                    || Object.prototype.hasOwnProperty.call(reviewOutcome, "resolution")
+                    || Object.prototype.hasOwnProperty.call(reviewOutcome, "resolutionReason")
+                    || Object.prototype.hasOwnProperty.call(reviewOutcome, "attemptEvidenceIds"))) {
+                return false;
+            }
+        }
+        else if (schemaVersion === REVIEW_PROOF_SCHEMA_VERSION_V2) {
+            if (proofSchemaVersion !== REVIEW_PROOF_SCHEMA_VERSION_V2 || packageVersion !== REVIEW_PROOF_CONTRACT_VERSION_V2) {
+                return false;
+            }
+            if (reviewOutcome !== undefined && !isRecord(reviewOutcome))
+                return false;
+            if (isRecord(reviewOutcome)
+                && Object.prototype.hasOwnProperty.call(reviewOutcome, "authorizing")
+                && reviewOutcome.authorizing !== undefined
+                && validateAuthorizing(reviewOutcome.authorizing).length > 0) {
+                return false;
+            }
+            if (isRecord(reviewOutcome)
+                && (Object.prototype.hasOwnProperty.call(reviewOutcome, "resolution")
+                    || Object.prototype.hasOwnProperty.call(reviewOutcome, "resolutionReason")
+                    || Object.prototype.hasOwnProperty.call(reviewOutcome, "attemptEvidenceIds"))) {
                 return false;
             }
         }
@@ -226,6 +262,21 @@ export function verifyCanonicalReviewProofPayload(payload, expectedHash) {
                 && validateAuthorizing(reviewOutcome.authorizing).length > 0) {
                 return false;
             }
+            if (isRecord(reviewOutcome)) {
+                if (reviewOutcome.resolution !== undefined
+                    && reviewOutcome.resolution !== "accepted"
+                    && reviewOutcome.resolution !== "rejected"
+                    && reviewOutcome.resolution !== "held"
+                    && reviewOutcome.resolution !== "could_not_confirm") {
+                    return false;
+                }
+                if (reviewOutcome.attemptEvidenceIds !== undefined
+                    && (!Array.isArray(reviewOutcome.attemptEvidenceIds)
+                        || reviewOutcome.attemptEvidenceIds.some((id) => typeof id !== "string"))) {
+                    return false;
+                }
+                assertReviewResolutionConsistency("Canonical review proof", reviewOutcome);
+            }
         }
         else {
             return false;

package/dist/src/review-resource.d.ts

@@ -168,6 +168,9 @@ export interface ReviewDecisionSpec {
     reviewItemName: string;
     candidateId?: string;
     status: ReviewOutcome["status"];
+    resolution?: ReviewOutcome["resolution"];
+    resolutionReason?: string;
+    attemptEvidenceIds?: string[];
     actor?: ReviewActor;
     reviewedAt?: string;
     rationale?: string;
@@ -216,6 +219,9 @@ export interface ReviewSessionEventSpec {
     reviewDecisionName?: string;
     candidateId?: string;
     status?: ReviewOutcome["status"];
+    resolution?: ReviewOutcome["resolution"];
+    resolutionReason?: string;
+    attemptEvidenceIds?: string[];
     rationale?: string;
     data?: Record<string, unknown>;
 }

package/dist/src/review-workbench/producer-decision-mode.js

@@ -15,6 +15,8 @@ const KNOWN_DECISION_MODES = new Set([
  * `unknown-decision-mode` issue.
  */
 export function validateReviewDecisionMode(item, result) {
+    if (result.decision === "could-not-confirm")
+        return [];
     const decisionMode = item.spec.producerPolicy?.decisionMode;
     if (decisionMode === undefined) {
         return [];

package/dist/src/review-workbench/review-queue-session.d.ts

@@ -1,6 +1,6 @@
 import { type ReviewCandidate, type ReviewItem, type ReviewSession, type ReviewSessionEvent, type ReviewSessionEventSpec } from "../../src/review-resource.js";
-export type ReviewWorkbenchDecision = "accept-proposed" | "keep-current" | "reject-proposed";
-export type ReviewQueueRowStatus = "pending" | "in-review" | "resolved" | "rejected" | "escalated";
+export type ReviewWorkbenchDecision = "accept-proposed" | "keep-current" | "reject-proposed" | "could-not-confirm";
+export type ReviewQueueRowStatus = "pending" | "in-review" | "resolved" | "rejected" | "could-not-confirm" | "escalated";
 export declare const reviewWorkbenchSessionStorageKey = "kontourai.survey.review-workbench.session-events.v1";
 export declare const defaultReviewSessionName = "review-workbench-session";
 export interface ReviewWorkbenchState {
@@ -15,6 +15,7 @@ export interface ReviewWorkbenchState {
      * proposed candidate's original value applies.
      */
     readonly editedValue?: unknown;
+    readonly attemptEvidenceIds?: readonly string[];
 }
 export interface ReviewQueueSessionState {
     readonly items: readonly ReviewItem[];
@@ -30,11 +31,13 @@ export interface ReviewQueueSessionState {
      * original value").
      */
     readonly editedValuesByItemName?: Readonly<Record<string, unknown>>;
+    readonly attemptEvidenceIdsByItemName?: Readonly<Record<string, readonly string[]>>;
 }
 export interface ReviewSessionSummary {
     readonly accepted: number;
     readonly keptCurrent: number;
     readonly rejected: number;
+    readonly couldNotConfirm?: number;
     readonly escalated: number;
     readonly unresolved: number;
 }
@@ -57,6 +60,12 @@ export declare const workbenchDecisionDefinitions: {
         candidateRole: "proposed";
         status: "rejected";
     };
+    "could-not-confirm": {
+        label: string;
+        effect: string;
+        candidateRole: "proposed";
+        status: "proposed";
+    };
 };
 export declare function initialReviewWorkbenchState(item?: ReviewItem): ReviewWorkbenchState;
 export declare function initialReviewQueueSessionState(items?: readonly ReviewItem[]): ReviewQueueSessionState;

package/dist/src/review-workbench/review-queue-session.js

@@ -1,4 +1,5 @@
 import { publicDirectoryReviewItemExample, reviewWorkbenchQueueExamples } from "./review-workbench-data.js";
+import { assertReviewResolutionConsistency } from "../producer-discipline.js";
 import { reviewResourceApiVersion, } from "../../src/review-resource.js";
 export const reviewWorkbenchSessionStorageKey = "kontourai.survey.review-workbench.session-events.v1";
 export const defaultReviewSessionName = "review-workbench-session";
@@ -21,6 +22,12 @@ export const workbenchDecisionDefinitions = {
         candidateRole: "proposed",
         status: "rejected",
     },
+    "could-not-confirm": {
+        label: "Could not confirm",
+        effect: "The review round ends without changing or escalating the proposed claim.",
+        candidateRole: "proposed",
+        status: "proposed",
+    },
 };
 export function initialReviewWorkbenchState(item = publicDirectoryReviewItemExample) {
     return {
@@ -49,6 +56,7 @@ export function currentReviewWorkbenchState(session) {
         note: session.notesByItemName[item.metadata.name] ?? "",
         decision: session.decisionsByItemName[item.metadata.name],
         editedValue: session.editedValuesByItemName?.[item.metadata.name],
+        attemptEvidenceIds: session.attemptEvidenceIdsByItemName?.[item.metadata.name],
         reviewedAt: session.reviewedAt,
         actorId: session.actorId,
     };
@@ -65,6 +73,9 @@ export function deriveQueueRowStatus(item, session) {
     if (decision === "reject-proposed") {
         return "rejected";
     }
+    if (decision === "could-not-confirm") {
+        return "could-not-confirm";
+    }
     if (decision === "accept-proposed" || decision === "keep-current" || item.spec.candidateSetStatus === "resolved") {
         return "resolved";
     }
@@ -96,6 +107,9 @@ export function reviewSessionSummary(session) {
         if (decision === "reject-proposed") {
             return { ...summary, rejected: summary.rejected + 1 };
         }
+        if (decision === "could-not-confirm") {
+            return { ...summary, couldNotConfirm: (summary.couldNotConfirm ?? 0) + 1 };
+        }
         if (item.spec.candidateSetStatus === "escalated") {
             return { ...summary, escalated: summary.escalated + 1 };
         }
@@ -194,6 +208,9 @@ export function buildReviewSessionEvents(session, sessionName = defaultReviewSes
         if (!decision) {
             continue;
         }
+        if (decision === "could-not-confirm" && !note?.trim()) {
+            throw new Error(`ReviewItem ${item.metadata.name} could not confirm requires a non-empty reason.`);
+        }
         const candidate = candidateForDecision(item, decision);
         const definition = workbenchDecisionDefinitions[decision];
         const reviewDecisionName = `${item.metadata.name}-${decision}`;
@@ -203,9 +220,20 @@ export function buildReviewSessionEvents(session, sessionName = defaultReviewSes
         // the server apply boundary derives effectiveValue from it. Without this
         // the edit lives only in browser state and never survives replay.
         const editedValue = decision === "accept-proposed" ? session.editedValuesByItemName?.[item.metadata.name] : undefined;
+        const attemptEvidenceIds = decision === "could-not-confirm"
+            ? session.attemptEvidenceIdsByItemName?.[item.metadata.name]
+            : undefined;
+        assertReviewResolutionConsistency(`ReviewItem ${item.metadata.name}`, {
+            status: definition.status,
+            resolution: decision === "could-not-confirm" ? "could_not_confirm" : undefined,
+            resolutionReason: decision === "could-not-confirm" ? note : undefined,
+            attemptEvidenceIds,
+            actor: session.actorId,
+            reviewedAt: session.reviewedAt,
+        });
         const data = editedValue !== undefined
             ? { workbenchDecision: decision, workbenchEditedValue: editedValue }
-            : { workbenchDecision: decision };
+            : { workbenchDecision: decision, ...(attemptEvidenceIds?.length ? { attemptEvidenceIds } : {}) };
         events.push(buildReviewSessionEvent(session, {
             sessionName,
             sequence: events.length + 1,
@@ -215,6 +243,13 @@ export function buildReviewSessionEvents(session, sessionName = defaultReviewSes
             reviewDecisionName,
             candidateId: candidate.id,
             status: definition.status,
+            ...(decision === "could-not-confirm"
+                ? {
+                    resolution: "could_not_confirm",
+                    resolutionReason: note,
+                    ...(attemptEvidenceIds ? { attemptEvidenceIds: [...attemptEvidenceIds] } : {}),
+                }
+                : {}),
             data,
         }));
         events.push(buildReviewSessionEvent(session, {
@@ -227,6 +262,13 @@ export function buildReviewSessionEvents(session, sessionName = defaultReviewSes
             candidateId: candidate.id,
             status: definition.status,
             rationale: note,
+            ...(decision === "could-not-confirm"
+                ? {
+                    resolution: "could_not_confirm",
+                    resolutionReason: note,
+                    ...(attemptEvidenceIds ? { attemptEvidenceIds: [...attemptEvidenceIds] } : {}),
+                }
+                : {}),
             data,
         }));
     }
@@ -264,7 +306,13 @@ export function replayReviewSessionEvents(startState, events) {
             if (isClearedWorkbenchDecisionEvent(event)) {
                 const { [itemName]: _removedDecision, ...remainingDecisions } = session.decisionsByItemName;
                 const { [itemName]: _removedEdit, ...remainingEdits } = session.editedValuesByItemName ?? {};
-                return { ...session, decisionsByItemName: remainingDecisions, editedValuesByItemName: remainingEdits };
+                const { [itemName]: _removedAttempts, ...remainingAttempts } = session.attemptEvidenceIdsByItemName ?? {};
+                return {
+                    ...session,
+                    decisionsByItemName: remainingDecisions,
+                    editedValuesByItemName: remainingEdits,
+                    attemptEvidenceIdsByItemName: remainingAttempts,
+                };
             }
             const decision = workbenchDecisionFromEvent(event);
             if (!decision) {
@@ -276,12 +324,19 @@ export function replayReviewSessionEvents(startState, events) {
             // reviewer moved away from.
             const editedValue = workbenchEditedValueFromEvent(event);
             const editedValuesByItemName = { ...session.editedValuesByItemName };
+            const attemptEvidenceIdsByItemName = { ...session.attemptEvidenceIdsByItemName };
             if (decision === "accept-proposed" && editedValue !== undefined) {
                 editedValuesByItemName[itemName] = editedValue;
             }
             else {
                 delete editedValuesByItemName[itemName];
             }
+            if (decision === "could-not-confirm" && event.spec.attemptEvidenceIds?.length) {
+                attemptEvidenceIdsByItemName[itemName] = [...event.spec.attemptEvidenceIds];
+            }
+            else {
+                delete attemptEvidenceIdsByItemName[itemName];
+            }
             return {
                 ...session,
                 decisionsByItemName: {
@@ -289,6 +344,7 @@ export function replayReviewSessionEvents(startState, events) {
                     [itemName]: decision,
                 },
                 editedValuesByItemName,
+                attemptEvidenceIdsByItemName,
             };
         }
         return session;

package/dist/src/review-workbench/review-session-replay.d.ts

@@ -1,6 +1,6 @@
 import type { ReviewSessionEvent } from "../review-resource.js";
 import { type ReviewQueueSessionState } from "./review-queue-session.js";
-export type ReviewSessionReplayIssueCode = "invalid-sequence" | "duplicate-sequence" | "non-contiguous-sequence" | "unknown-active-item" | "unknown-review-item" | "unknown-candidate" | "missing-review-item" | "invalid-workbench-decision" | "decision-candidate-mismatch" | "decision-status-mismatch";
+export type ReviewSessionReplayIssueCode = "invalid-sequence" | "duplicate-sequence" | "non-contiguous-sequence" | "unknown-active-item" | "unknown-review-item" | "unknown-candidate" | "missing-review-item" | "invalid-workbench-decision" | "decision-candidate-mismatch" | "decision-status-mismatch" | "decision-resolution-mismatch" | "missing-resolution-reason";
 export interface ReviewSessionReplayIssue {
     readonly code: ReviewSessionReplayIssueCode;
     readonly eventName: string;

package/dist/src/review-workbench/review-session-replay.js

@@ -76,6 +76,25 @@ export function validateReviewSessionEventsForSnapshot(snapshot, events) {
                         message: `ReviewSessionEvent ${event.metadata.name} decision ${decision} expects status ${expectedStatus}, but references ${event.spec.status ?? "no status"}.`,
                     });
                 }
+                const expectedResolution = decision === "could-not-confirm" ? "could_not_confirm" : undefined;
+                if (event.spec.resolution !== expectedResolution) {
+                    issues.push({
+                        ...eventRef,
+                        code: "decision-resolution-mismatch",
+                        reviewItemName: itemName,
+                        candidateId: event.spec.candidateId,
+                        message: `ReviewSessionEvent ${event.metadata.name} decision ${decision} expects resolution ${expectedResolution ?? "none"}, but references ${event.spec.resolution ?? "no resolution"}.`,
+                    });
+                }
+                if (decision === "could-not-confirm" && !event.spec.resolutionReason?.trim()) {
+                    issues.push({
+                        ...eventRef,
+                        code: "missing-resolution-reason",
+                        reviewItemName: itemName,
+                        candidateId: event.spec.candidateId,
+                        message: `ReviewSessionEvent ${event.metadata.name} decision could-not-confirm requires a non-empty resolutionReason.`,
+                    });
+                }
             }
         }
         if (event.spec.candidateId && itemName && itemsByName.has(itemName)) {

package/dist/src/review-workbench/review-surface-preview.js

@@ -8,7 +8,7 @@ export function buildSurfaceProjectionPreview(item, decision, presentationAdapte
         canonicalClaim: buildPreviewClaim(item, selectedCandidate, decision, projection, presentationAdapter),
         candidateHistory: buildCandidateHistory(item, selectedCandidate, presentationAdapter),
         sourceEvidence: buildSourceEvidence(selectedCandidate),
-        reviewEvent: buildReviewEvent(decision, projection),
+        reviewEvent: decision.spec.resolution === "could_not_confirm" ? undefined : buildReviewEvent(decision, projection),
         integrityPosture: buildIntegrityPosture(item, selectedCandidate, projection),
         authorityTrace: portableAuthorityTrace(selectedCandidate.producer?.authorityTrace),
         postureDisclaimer: postureDisclaimer(),

package/dist/src/review-workbench/review-workbench-css.generated.js

@@ -437,6 +437,7 @@ export const REVIEW_WORKBENCH_CSS = `/* Bundled, scoped Survey Review Workbench
 .survey-workbench-embed .field[data-state="accepted"] .stripe{ background: var(--k-positive); }
 .survey-workbench-embed .field[data-state="kept"] .stripe{ background: var(--k-faint); }
 .survey-workbench-embed .field[data-state="rejected"] .stripe{ background: var(--k-negative); }
+.survey-workbench-embed .field[data-state="could-not-confirm"] .stripe{ background: var(--k-caution); }
 .survey-workbench-embed .field[data-state="review"] .stripe{ background: var(--k-brand); }
 
 .survey-workbench-embed .fbody{
@@ -491,6 +492,7 @@ export const REVIEW_WORKBENCH_CSS = `/* Bundled, scoped Survey Review Workbench
 .survey-workbench-embed .chip.accepted{ color: var(--k-positive); background: var(--k-positive-wash); }
 .survey-workbench-embed .chip.kept{ color: var(--k-muted); background: var(--k-sunken); }
 .survey-workbench-embed .chip.rejected{ color: var(--k-negative); background: var(--k-negative-wash); }
+.survey-workbench-embed .chip.could-not-confirm{ color: var(--k-caution); background: var(--k-caution-wash); }
 
 .survey-workbench-embed .frow1 .push{
   margin-left: auto;
@@ -755,6 +757,12 @@ export const REVIEW_WORKBENCH_CSS = `/* Bundled, scoped Survey Review Workbench
   background: var(--k-panel-raised, var(--k-raised));
 }
 
+.survey-workbench-embed .btn.unconfirmed{
+  border-color: var(--k-caution);
+  color: var(--k-caution);
+  background: var(--k-caution-wash);
+}
+
 /* "Suggestion was wrong" — optional quiet calibration toggle on Keep current.
    Ticking it turns a keep-current decision into the reject signal. Not a third action. */
 .survey-workbench-embed .wrong{

package/dist/src/review-workbench/review-workbench.css

@@ -434,6 +434,7 @@
 .survey-workbench-embed .field[data-state="accepted"] .stripe{ background: var(--k-positive); }
 .survey-workbench-embed .field[data-state="kept"] .stripe{ background: var(--k-faint); }
 .survey-workbench-embed .field[data-state="rejected"] .stripe{ background: var(--k-negative); }
+.survey-workbench-embed .field[data-state="could-not-confirm"] .stripe{ background: var(--k-caution); }
 .survey-workbench-embed .field[data-state="review"] .stripe{ background: var(--k-brand); }
 
 .survey-workbench-embed .fbody{
@@ -488,6 +489,7 @@
 .survey-workbench-embed .chip.accepted{ color: var(--k-positive); background: var(--k-positive-wash); }
 .survey-workbench-embed .chip.kept{ color: var(--k-muted); background: var(--k-sunken); }
 .survey-workbench-embed .chip.rejected{ color: var(--k-negative); background: var(--k-negative-wash); }
+.survey-workbench-embed .chip.could-not-confirm{ color: var(--k-caution); background: var(--k-caution-wash); }
 
 .survey-workbench-embed .frow1 .push{
   margin-left: auto;
@@ -752,6 +754,12 @@
   background: var(--k-panel-raised, var(--k-raised));
 }
 
+.survey-workbench-embed .btn.unconfirmed{
+  border-color: var(--k-caution);
+  color: var(--k-caution);
+  background: var(--k-caution-wash);
+}
+
 /* "Suggestion was wrong" — optional quiet calibration toggle on Keep current.
    Ticking it turns a keep-current decision into the reject signal. Not a third action. */
 .survey-workbench-embed .wrong{

package/dist/src/review-workbench/review-workbench.js

@@ -1,4 +1,5 @@
 import { canonicalJson } from "./canonical.js";
+import { assertReviewResolutionConsistency } from "../producer-discipline.js";
 import { candidateForDecision, buildReviewSessionEvent, buildReviewSessionEvents, buildReviewSessionResource, currentReviewWorkbenchState, defaultReviewSessionName, effectiveValueForDecision, initialReviewQueueSessionState, replayReviewSessionEvents, reviewWorkbenchSessionStorageKey, workbenchDecisionDefinitions, } from "./review-queue-session.js";
 import { validateReviewSessionEventsForSnapshot, } from "./review-session-replay.js";
 import { buildSurfaceProjectionPreview, formatValue, } from "./review-surface-preview.js";
@@ -16,13 +17,16 @@ export function buildReviewDecision(state) {
         return undefined;
     }
     const definition = workbenchDecisionDefinitions[state.decision];
+    if (state.decision === "could-not-confirm" && !state.note.trim()) {
+        throw new Error("Could not confirm requires a non-empty reason.");
+    }
     const candidate = candidateForDecision(state.item, state.decision);
     const projection = {
         ...candidate.projection,
         reviewOutcomeId: candidate.projection?.reviewOutcomeId
             ?? `${state.item.metadata.name}:${state.decision}:review-outcome`,
     };
-    return {
+    const reviewDecision = {
         apiVersion: reviewResourceApiVersion,
         kind: "ReviewDecision",
         metadata: {
@@ -34,6 +38,13 @@ export function buildReviewDecision(state) {
             reviewItemName: state.item.metadata.name,
             candidateId: candidate.id,
             status: definition.status,
+            ...(state.decision === "could-not-confirm"
+                ? {
+                    resolution: "could_not_confirm",
+                    resolutionReason: state.note.trim(),
+                    ...(state.attemptEvidenceIds?.length ? { attemptEvidenceIds: [...state.attemptEvidenceIds] } : {}),
+                }
+                : {}),
             actor: {
                 id: state.actorId,
             },
@@ -47,6 +58,15 @@ export function buildReviewDecision(state) {
             appliedToClaimIds: candidate.projection?.claimId ? [candidate.projection.claimId] : undefined,
         },
     };
+    assertReviewResolutionConsistency(`ReviewDecision ${reviewDecision.metadata.name}`, {
+        status: reviewDecision.spec.status,
+        resolution: reviewDecision.spec.resolution,
+        resolutionReason: reviewDecision.spec.resolutionReason,
+        attemptEvidenceIds: reviewDecision.spec.attemptEvidenceIds,
+        actor: reviewDecision.spec.actor?.id,
+        reviewedAt: reviewDecision.spec.reviewedAt,
+    });
+    return reviewDecision;
 }
 /**
  * Stable versioned prompt identifier for the workbench decision card control.
@@ -177,6 +197,9 @@ function duplicateTargetIssues(items) {
     return issues;
 }
 function mapReviewApplyResultToActions(input) {
+    if (input.result.decision === "could-not-confirm") {
+        return [];
+    }
     const context = buildReviewApplyActionContext(input.result, input.itemByName, input.issues);
     if (!context || input.options.skip?.(context)) {
         return [];
@@ -442,6 +465,8 @@ function fieldCardState(item, decision) {
         return "kept";
     if (decision === "reject-proposed")
         return "rejected";
+    if (decision === "could-not-confirm")
+        return "could-not-confirm";
     if (item.spec.candidateSetStatus === "resolved")
         return "kept";
     return "review";
@@ -451,6 +476,7 @@ function chipLabel(state) {
         case "accepted": return "Accepted";
         case "kept": return "Kept current";
         case "rejected": return "Kept — flagged wrong";
+        case "could-not-confirm": return "Could not confirm";
         default: return "Needs review";
     }
 }
@@ -540,6 +566,7 @@ function renderFieldCard(item, session, presentationAdapter) {
             <input type="checkbox" class="wrongbox" data-testid="wrong-toggle" data-item-name="${escapeHtml(item.metadata.name)}">
             Suggestion was wrong
           </label>
+          <button class="btn unconfirmed" type="button" data-testid="could-not-confirm" data-item-name="${escapeHtml(item.metadata.name)}">Could not confirm</button>
         </div>
         <div class="decided">
           <span class="chip ${state}" data-testid="decided-chip">${chipLabel(state)}</span>
@@ -813,7 +840,7 @@ function renderProducerFeedbackTags(item) {
   `;
 }
 function renderFooterTally(session) {
-    const counts = { review: 0, accepted: 0, kept: 0, rejected: 0 };
+    const counts = { review: 0, accepted: 0, kept: 0, rejected: 0, "could-not-confirm": 0 };
     for (const item of session.items) {
         const state = fieldCardState(item, session.decisionsByItemName[item.metadata.name]);
         counts[state] += 1;
@@ -824,6 +851,7 @@ function renderFooterTally(session) {
         <span>Accepted <b data-testid="tally-accepted">${counts.accepted}</b></span>
         <span>Kept <b data-testid="tally-kept">${counts.kept}</b></span>
         <span>Flagged <b data-testid="tally-rejected">${counts.rejected}</b></span>
+        <span>Unconfirmed <b data-testid="tally-could-not-confirm">${counts["could-not-confirm"]}</b></span>
         <span>Remaining <b data-testid="tally-review">${counts.review}</b></span>
       </div>
     </footer>
@@ -973,10 +1001,13 @@ function createReviewWorkbenchController(root, startState, options) {
         // effectiveValue from snapshot + events alone. setDecision updates the
         // session before this runs, so the edit is already in state.
         const editedValue = itemName && decision === "accept-proposed" ? session.editedValuesByItemName?.[itemName] : undefined;
+        const attemptEvidenceIds = itemName && decision === "could-not-confirm"
+            ? session.attemptEvidenceIdsByItemName?.[itemName]
+            : undefined;
         const defaultData = decision
             ? (editedValue !== undefined
                 ? { workbenchDecision: decision, workbenchEditedValue: editedValue }
-                : { workbenchDecision: decision })
+                : { workbenchDecision: decision, ...(attemptEvidenceIds?.length ? { attemptEvidenceIds } : {}) })
             : undefined;
         events = [
             ...events,
@@ -989,6 +1020,13 @@ function createReviewWorkbenchController(root, startState, options) {
                 reviewDecisionName: item && decision ? `${item.metadata.name}-${decision}` : undefined,
                 candidateId: candidate?.id,
                 status: definition?.status,
+                ...(decision === "could-not-confirm"
+                    ? {
+                        resolution: "could_not_confirm",
+                        resolutionReason: note?.trim(),
+                        ...(attemptEvidenceIds ? { attemptEvidenceIds: [...attemptEvidenceIds] } : {}),
+                    }
+                    : {}),
                 rationale: note,
                 data: dataOverride ?? defaultData,
             }),
@@ -998,6 +1036,9 @@ function createReviewWorkbenchController(root, startState, options) {
         session = update(session);
     };
     const setDecision = (itemName, decision, rawEditedValue) => {
+        if (decision === "could-not-confirm" && !session.notesByItemName[itemName]?.trim()) {
+            throw new Error("Could not confirm requires a non-empty reason.");
+        }
         applySessionUpdate((current) => {
             const item = current.items.find((entry) => entry.metadata.name === itemName);
             const proposed = item?.spec.candidates.find((candidate) => candidate.role === "proposed");
@@ -1025,11 +1066,14 @@ function createReviewWorkbenchController(root, startState, options) {
             delete remainingDecisions[itemName];
             const remainingEdits = { ...current.editedValuesByItemName };
             delete remainingEdits[itemName];
+            const remainingAttemptEvidenceIds = { ...current.attemptEvidenceIdsByItemName };
+            delete remainingAttemptEvidenceIds[itemName];
             return {
                 ...current,
                 activeItemName: itemName,
                 decisionsByItemName: remainingDecisions,
                 editedValuesByItemName: remainingEdits,
+                attemptEvidenceIdsByItemName: remainingAttemptEvidenceIds,
             };
         });
         appendEvent("decision-changed", itemName, { workbenchDecision: null });
@@ -1082,6 +1126,9 @@ function queueSessionFromStartState(startState) {
         editedValuesByItemName: startState.editedValue !== undefined
             ? { [startState.item.metadata.name]: startState.editedValue }
             : {},
+        ...(startState.attemptEvidenceIds?.length
+            ? { attemptEvidenceIdsByItemName: { [startState.item.metadata.name]: [...startState.attemptEvidenceIds] } }
+            : {}),
         reviewedAt: startState.reviewedAt,
         actorId: startState.actorId,
     };
@@ -1125,6 +1172,23 @@ function bindFieldCardInteractions(root, controller) {
             controller.renderCurrentState();
         });
     });
+    root.querySelectorAll("[data-testid='could-not-confirm']").forEach((button) => {
+        button.addEventListener("click", () => {
+            const itemName = button.dataset.itemName ?? "";
+            const note = controller.currentSession().notesByItemName[itemName]?.trim() ?? "";
+            const field = button.closest("[data-testid='review-field']");
+            const textarea = field?.querySelector("[data-testid='reviewer-note']");
+            if (!note) {
+                textarea?.setCustomValidity?.("A reason is required when you could not confirm.");
+                textarea?.reportValidity?.();
+                textarea?.focus();
+                return;
+            }
+            textarea?.setCustomValidity?.("");
+            controller.setDecision(itemName, "could-not-confirm");
+            controller.renderCurrentState();
+        });
+    });
     root.querySelectorAll("[data-testid='undo-decision']").forEach((button) => {
         button.addEventListener("click", () => {
             controller.clearDecision(button.dataset.itemName ?? "");
@@ -1133,6 +1197,7 @@ function bindFieldCardInteractions(root, controller) {
     });
     root.querySelectorAll("[data-testid='reviewer-note']").forEach((textarea) => {
         textarea.addEventListener("input", () => {
+            textarea.setCustomValidity?.("");
             const itemName = textarea.dataset.itemName ?? "";
             controller.updateReviewerNote(itemName, textarea.value);
             refreshAuditPayloadForItem(textarea, controller, itemName);

package/dist/src/review-workbench/review-workbench.standalone.css

@@ -283,6 +283,7 @@ h1, h2, h3, p {
 .field[data-state="accepted"] .stripe { background: var(--k-positive); }
 .field[data-state="kept"] .stripe { background: var(--k-faint); }
 .field[data-state="rejected"] .stripe { background: var(--k-negative); }
+.field[data-state="could-not-confirm"] .stripe { background: var(--k-caution); }
 .field[data-state="review"] .stripe { background: var(--k-brand); }
 
 .fbody {
@@ -337,6 +338,7 @@ h1, h2, h3, p {
 .chip.accepted { color: var(--k-positive); background: var(--k-positive-wash); }
 .chip.kept { color: var(--k-muted); background: var(--k-sunken); }
 .chip.rejected { color: var(--k-negative); background: var(--k-negative-wash); }
+.chip.could-not-confirm { color: var(--k-caution); background: var(--k-caution-wash); }
 
 .frow1 .push {
   margin-left: auto;
@@ -601,6 +603,12 @@ h1, h2, h3, p {
   background: var(--k-panel-raised, var(--k-raised));
 }
 
+.btn.unconfirmed {
+  border-color: var(--k-caution);
+  color: var(--k-caution);
+  background: var(--k-caution-wash);
+}
+
 /* "Suggestion was wrong" — optional quiet calibration toggle on Keep current.
    Ticking it turns a keep-current decision into the reject signal. Not a third action. */
 .wrong {

package/dist/src/to-surface.js

@@ -27,11 +27,16 @@ export function buildSurveyTrustBundle(input, options = {}) {
         const extraction = requireMapValue(extractions, candidate.extractionId, "extraction");
         const rawSource = requireMapValue(rawSources, extraction.sourceId, "raw source");
         const review = selectReview(reviewsByCandidateSet.get(candidateSet.id) ?? [], candidate.id);
-        const status = projection.status ?? statusFor({ candidateSet, candidate, review });
-        assertProducerDiscipline({ status, review, extraction, rawSource, projection });
+        const projectionReview = review?.resolution === "could_not_confirm" ? undefined : review;
+        const unreviewedStatus = statusFor({ candidateSet, candidate });
+        const status = projection.status
+            ?? (review?.resolution === "could_not_confirm"
+                ? (unreviewedStatus === "disputed" ? unreviewedStatus : review.status)
+                : statusFor({ candidateSet, candidate, review }));
+        assertProducerDiscipline({ status, review, candidateSet, extraction, rawSource, projection });
         const claimValue = projection.value ?? candidate.value;
         const createdAt = projection.createdAt ?? extraction.extractedAt;
-        const updatedAt = projection.updatedAt ?? review?.reviewedAt ?? input.generatedAt;
+        const updatedAt = projection.updatedAt ?? projectionReview?.reviewedAt ?? input.generatedAt;
         const evidenceId = `${projection.id}.evidence.source`;
         const claim = {
             id: projection.id,
@@ -57,7 +62,15 @@ export function buildSurveyTrustBundle(input, options = {}) {
             },
             metadata: {
                 ...projection.metadata,
-                survey: buildSurveyMetadata({ projection, rawSource, extraction, candidateSet, candidate, review }),
+                survey: buildSurveyMetadata({
+                    projection,
+                    rawSource,
+                    extraction,
+                    candidateSet,
+                    candidate,
+                    review: projectionReview,
+                    comfortZoneReview: review,
+                }),
             },
         };
         // Promote the review's comfort-zone signal — and, when calibration is
@@ -82,7 +95,7 @@ export function buildSurveyTrustBundle(input, options = {}) {
             }
             : undefined;
         const affirmedConclusion = status === "verified" || status === "assumed";
-        const calibrated = calibrationMetrics && review && affirmedConclusion
+        const calibrated = calibrationMetrics && projectionReview && affirmedConclusion
             ? lookupCalibratedValue(calibrationMetrics, extraction.extractor, extraction.target, calibrationMinSamples)
             : undefined;
         if (comfortZone || calibrated) {
@@ -91,13 +104,16 @@ export function buildSurveyTrustBundle(input, options = {}) {
                 ...(comfortZone ? { comfortZone } : {}),
             };
         }
-        if (options.reviewProofs && review) {
+        // Could-not-confirm stays byte-quiet at the Surface boundary. In particular,
+        // do not attach an anchor whose public observedAt would disclose review time;
+        // callers can persist/recompute Survey's canonical v3 proof separately.
+        if (options.reviewProofs && projectionReview) {
             claim.currentIntegrityAnchor = buildReviewProofAnchor({
                 rawSource,
                 extraction,
                 candidate,
                 candidateSet,
-                reviewOutcome: review,
+                reviewOutcome: projectionReview,
                 claim: {
                     ...projection,
                     value: claimValue,
@@ -129,16 +145,16 @@ export function buildSurveyTrustBundle(input, options = {}) {
                 confidence: candidate.confidence ?? extraction.confidence,
             },
         });
-        const rationale = review?.rationale ?? candidateSet.rationale;
+        const rationale = projectionReview?.rationale ?? candidateSet.rationale;
         events.push({
             id: `${projection.id}.event.${status}`,
             claimId: projection.id,
             status,
-            actor: projection.actor ?? review?.actor ?? projection.collectedBy,
+            actor: projection.actor ?? projectionReview?.actor ?? projection.collectedBy,
             method: projection.eventMethod ?? eventMethodFor(status, candidateSet),
-            evidenceIds: review?.evidenceIds?.length ? review.evidenceIds : [evidenceId],
-            createdAt: review?.reviewedAt ?? input.generatedAt,
-            verifiedAt: status === "verified" || status === "assumed" ? review?.reviewedAt ?? input.generatedAt : undefined,
+            evidenceIds: projectionReview?.evidenceIds?.length ? projectionReview.evidenceIds : [evidenceId],
+            createdAt: projectionReview?.reviewedAt ?? input.generatedAt,
+            verifiedAt: status === "verified" || status === "assumed" ? projectionReview?.reviewedAt ?? input.generatedAt : undefined,
             notes: rationale,
         });
     }
@@ -357,11 +373,11 @@ function buildSurveyMetadata(input) {
                 },
             }
             : {}),
-        ...(input.review?.withinComfortZone === false
+        ...(input.comfortZoneReview?.withinComfortZone === false
             ? {
                 comfortZone: {
                     withinComfortZone: false,
-                    ...(input.review.comfortZoneNote ? { note: input.review.comfortZoneNote } : {}),
+                    ...(input.comfortZoneReview.comfortZoneNote ? { note: input.comfortZoneReview.comfortZoneNote } : {}),
                 },
             }
             : {}),
@@ -384,6 +400,7 @@ function assertProducerDiscipline(input) {
         subject: `Claim ${input.projection.id}`,
         status: input.status,
         review: input.review,
+        candidateSetStatus: input.candidateSet.status,
     });
     if (input.rawSource.kind !== "manual-entry" && !input.extraction.locator) {
         throw new Error(`Claim ${input.projection.id} needs a source locator for ${input.rawSource.kind}`);

package/dist/src/types.d.ts

@@ -49,6 +49,7 @@ export interface CandidateSet {
     metadata?: Record<string, unknown>;
 }
 export type ReviewStatus = Extract<TrustStatus, "verified" | "assumed" | "rejected" | "proposed">;
+export type ReviewResolution = "accepted" | "rejected" | "held" | "could_not_confirm";
 export type ReviewAuthorizingKind = "explicit-statement" | "exchange" | "authorized-action";
 export interface ReviewAuthorizingExplicitStatement {
     kind: "explicit-statement";
@@ -74,6 +75,13 @@ export interface ReviewOutcome {
     candidateSetId: string;
     candidateId?: string;
     status: ReviewStatus;
+    /** Explicit terminal resolution for this review round. Absent outcomes retain
+     *  the legacy status-inference behavior. */
+    resolution?: ReviewResolution;
+    /** Required, non-empty explanation when resolution is `could_not_confirm`. */
+    resolutionReason?: string;
+    /** Evidence of attempts made before the reviewer concluded they could not confirm. */
+    attemptEvidenceIds?: string[];
     actor?: string;
     reviewedAt?: string;
     rationale?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontourai/survey",
-  "version": "1.15.0",
+  "version": "1.16.0",
   "description": "Producer-side source, extraction, candidate, and review contracts for projecting verified claims into Surface.",
   "license": "Apache-2.0",
   "type": "module",