@kontourai/survey 5.0.0 → 6.0.0

package/dist/example-data/public-directory-review-resource.d.ts

@@ -35,12 +35,12 @@ export declare const publicDirectoryReviewItemExample: {
                 excerpt: string;
             };
             extraction: {
-                model?: undefined;
                 extractionId: string;
                 target: string;
                 confidence: number;
                 extractor: string;
                 extractedAt: string;
+                model?: undefined;
             };
             claimTarget: {
                 claimId: string;
@@ -61,13 +61,13 @@ export declare const publicDirectoryReviewItemExample: {
                 claimId: string;
             };
             producer: {
-                proposalId?: undefined;
-                oldValue?: undefined;
                 sourceAuthority: {
                     authorityClass: string;
                     declaredBy: string;
                     scope: string;
                 };
+                proposalId?: undefined;
+                oldValue?: undefined;
             };
         } | {
             id: string;

package/dist/src/extraction-envelope.d.ts

@@ -168,7 +168,39 @@ export interface ExtractionEnvelopeImportOptions {
     sourceKind: RawSource["kind"];
     /** Survey meaning is supplied at the boundary; it is not added to the upstream wire contract. */
     claimTarget: (proposal: PortableExtractionProposal, index: number) => ClaimTargetHint;
+    /**
+     * The prepared artifact as the caller resolved it (the same shape the source
+     * inspector takes). When supplied, the import checks the text against the
+     * envelope's prepared-artifact digest and length, and every proposal's span
+     * against its excerpt: a proposal whose span does not match gets no
+     * ReviewItem and an `excerpt-mismatch` diagnostic, and an artifact that does
+     * not verify makes the import `unresolved`. The text is not stored in the
+     * record. Without it the import records `status.provenance: "unverified"`.
+     */
+    artifact?: ResolvedExtractionArtifact;
 }
+export type ArtifactUnavailableCode = "not-found" | "storage-error" | "access-denied" | "invalid-artifact" | "unknown";
+/** A prepared artifact as a caller resolved it: its text and digest, or why it could not be read. */
+export type ResolvedExtractionArtifact = {
+    status: "available";
+    text: string;
+    actualDigest: string;
+} | {
+    status: "unavailable";
+    code: ArtifactUnavailableCode;
+} | {
+    status: "digest-mismatch";
+    actualDigest: string;
+};
+/**
+ * Whether the import checked its proposals' excerpts against the prepared
+ * artifact text. `verified` means the supplied text matched the envelope's
+ * digest and length and every proposal that produced a ReviewItem matched its
+ * span; `unverified` means no text was supplied, or the text did not verify
+ * (a diagnostic then says why). Records written before this field existed have
+ * no `provenance` and are unverified.
+ */
+export type ExtractionEnvelopeImportProvenance = "verified" | "unverified";
 /**
  * Why an import is `unresolved`: its prepared artifact did not resolve, or the
  * extraction itself produced nothing reviewable. `extraction-failed` is a
@@ -180,6 +212,8 @@ export type ExtractionEnvelopeImportDiagnostic = {
     kind: "artifact-unavailable";
     status: "unavailable" | "storage-error" | "identity-mismatch" | "invalid-artifact";
     artifactRef?: string;
+    /** The caller's resolver code, present when the artifact supplied at import could not be read. */
+    code?: ArtifactUnavailableCode;
     message: string;
 } | {
     kind: "digest-mismatch";
@@ -196,6 +230,13 @@ export type ExtractionEnvelopeImportDiagnostic = {
     kind: "extraction-incomplete";
     reason: PortableExtractionPartialReason;
     message: string;
+}
+/** The prepared text at this proposal's span is not its excerpt; the proposal produced no ReviewItem. */
+ | {
+    kind: "excerpt-mismatch";
+    proposalIndex: number;
+    locator: string;
+    message: string;
 };
 export interface ExtractionEnvelopeImport {
     apiVersion: typeof extractionEnvelopeImportApiVersion;
@@ -212,6 +253,7 @@ export interface ExtractionEnvelopeImport {
     status: {
         state: "grounded" | "unresolved";
         diagnostics: ExtractionEnvelopeImportDiagnostic[];
+        provenance?: ExtractionEnvelopeImportProvenance;
     };
 }
 export interface ExtractionEnvelopeImportResult {
@@ -242,5 +284,29 @@ export declare function buildReviewItemsFromExtractionEnvelopeImport(record: Ext
 export declare function exportExtractionEnvelopeImport(record: ExtractionEnvelopeImport): string;
 export declare function reimportExtractionEnvelope(serialized: string): ExtractionEnvelopeImport;
 export declare function createExtractionEnvelopeResolutionIdentity(record: ExtractionEnvelopeImport, proposalIndex: number): ExtractionEnvelopeResolutionIdentity;
+/** Proposals the import excluded because their span did not match their excerpt. */
+export declare function excerptMismatchProposalIndices(record: ExtractionEnvelopeImport): Set<number>;
+/** Validate the caller-resolved artifact shape; resolver detail beyond the code is refused. */
+export declare function assertResolvedExtractionArtifact(artifact: unknown): asserts artifact is ResolvedExtractionArtifact;
+export type PreparedArtifactCheck = {
+    status: "aligned";
+    text: string;
+} | {
+    status: "unavailable";
+    code: ArtifactUnavailableCode;
+} | {
+    status: "digest-mismatch";
+    actualDigest: string;
+} | {
+    status: "wrong-length";
+};
+/**
+ * Checks resolved text against the envelope's prepared-artifact identity: the
+ * caller's reported digest, the digest of the text itself, and the declared
+ * length. Shared by import-time verification and the source inspector.
+ */
+export declare function checkPreparedArtifact(prepared: PortableExtractionResultEnvelope["result"]["preparedArtifact"], artifact: ResolvedExtractionArtifact): PreparedArtifactCheck;
+/** Whether the verified prepared text at a proposal's `chars:` span is exactly its excerpt. */
+export declare function proposalSpanMatches(text: string, proposal: PortableExtractionProposal): boolean;
 /** Validate and defensively clone a persisted or browser-delivered import. */
 export declare function validateExtractionEnvelopeImport(value: unknown): ExtractionEnvelopeImport;

package/dist/src/extraction-envelope.js

@@ -26,13 +26,16 @@ export function importExtractionEnvelope(serialized, options) {
     const producerNamespace = options.producerNamespace ?? envelope.result.provider;
     nonEmpty(name, "Extraction envelope import name");
     nonEmpty(producerNamespace, "Extraction envelope producer namespace");
-    const diagnostics = diagnosticsFor(envelope);
+    const verification = options.artifact === undefined
+        ? { provenance: "unverified", diagnostics: [] }
+        : verifyAgainstArtifact(envelope, options.artifact);
+    const diagnostics = [...diagnosticsFor(envelope), ...verification.diagnostics];
     const record = {
         apiVersion: extractionEnvelopeImportApiVersion,
         kind: "ExtractionEnvelopeImport",
         metadata: { name, producerNamespace },
         spec: { envelope, sourceKind: options.sourceKind, claimTargets: cloneJson(claimTargets) },
-        status: { state: diagnostics.length ? "unresolved" : "grounded", diagnostics },
+        status: { state: stateFor(diagnostics, envelope.result.proposals.length), diagnostics, provenance: verification.provenance },
     };
     return { record, reviewItems: buildReviewItemsFromExtractionEnvelopeImport(record) };
 }
@@ -58,16 +61,23 @@ export function buildReviewItemsFromExtractionEnvelopeImport(record) {
 }
 function claimSlotGroups(record) {
     const groups = new Map();
-    record.spec.envelope.result.proposals.forEach((proposal, index) => {
+    const excluded = excerptMismatchProposalIndices(record);
+    const slotOf = (proposal, index) => {
         const target = record.spec.claimTargets[index];
-        const slot = {
+        return {
             subjectType: target.subjectType, subjectId: target.subjectId, facet: target.facet, claimType: target.claimType,
             fieldOrBehavior: target.fieldOrBehavior, claimId: target.claimId ?? null, pathIndices: proposal.pathIndices ?? null,
         };
+    };
+    record.spec.envelope.result.proposals.forEach((proposal, index) => {
+        if (excluded.has(index))
+            return;
+        const target = record.spec.claimTargets[index];
+        const slot = slotOf(proposal, index);
         const key = canonicalJson(slot);
         const group = groups.get(key);
         if (!group) {
-            groups.set(key, { slot, members: [{ proposal, index }] });
+            groups.set(key, { slot, members: [{ proposal, index }], excluded: [] });
             return;
         }
         const first = group.members[0].index;
@@ -77,6 +87,14 @@ function claimSlotGroups(record) {
         }
         group.members.push({ proposal, index });
     });
+    // An excluded proposal is unverifiable, not disproven: the slot it would have
+    // joined keeps a record of it, so a rival value cannot vanish without trace.
+    // A slot whose every proposal was excluded has no item; the import
+    // diagnostics are then the only record, as for any excluded proposal.
+    record.spec.envelope.result.proposals.forEach((proposal, index) => {
+        if (excluded.has(index))
+            groups.get(canonicalJson(slotOf(proposal, index)))?.excluded.push({ proposal, index });
+    });
     return [...groups.values()];
 }
 export function exportExtractionEnvelopeImport(record) {
@@ -123,6 +141,13 @@ function buildReviewItem(record, group) {
                     proposalIndices: group.members.map((member) => member.index),
                     source: envelope.source,
                     ...(envelope.result.preparedArtifact ? { preparedArtifact: envelope.result.preparedArtifact } : {}),
+                    // Present only on verified imports, so an unverified import's items stay
+                    // byte-identical to the ones earlier releases produced.
+                    ...(record.status.provenance === "verified" ? { excerptVerification: "verified" } : {}),
+                    ...(group.excluded.length ? { excludedProposals: group.excluded.map(({ proposal, index }) => ({
+                            proposalIndex: index, value: proposal.candidateValue, locator: proposal.provenance.locator,
+                            excerpt: proposal.provenance.excerpt, reason: "excerpt-mismatch",
+                        })) } : {}),
                 } } },
         spec: {
             target: lead.fieldPath, candidates,
@@ -207,6 +232,146 @@ function evidenceInputs(record, proposal) {
         extractedAt: record.spec.envelope.result.extractedAt,
         provenance: proposal.provenance };
 }
+/** Proposals the import excluded because their span did not match their excerpt. */
+export function excerptMismatchProposalIndices(record) {
+    return new Set(record.status.diagnostics.flatMap((diagnostic) => diagnostic.kind === "excerpt-mismatch" ? [diagnostic.proposalIndex] : []));
+}
+/**
+ * An import is grounded when nothing but excerpt mismatches was diagnosed and
+ * at least one proposal survived them. Every proposal excluded must not read as
+ * a complete run that found nothing.
+ */
+function stateFor(diagnostics, proposalCount) {
+    const mismatches = diagnostics.filter((diagnostic) => diagnostic.kind === "excerpt-mismatch").length;
+    if (mismatches !== diagnostics.length)
+        return "unresolved";
+    return mismatches > 0 && mismatches === proposalCount ? "unresolved" : "grounded";
+}
+/** Validate the caller-resolved artifact shape; resolver detail beyond the code is refused. */
+export function assertResolvedExtractionArtifact(artifact) {
+    if (!artifact || typeof artifact !== "object" || Array.isArray(artifact))
+        throw new Error("Invalid resolved extraction artifact.");
+    const a = artifact;
+    const keys = Object.keys(a).sort();
+    if (a.status === "available") {
+        if (keys.join(",") !== "actualDigest,status,text" || typeof a.text !== "string" || typeof a.actualDigest !== "string" || !/^[a-f0-9]{64}$/.test(a.actualDigest))
+            throw new Error("Invalid available extraction artifact.");
+    }
+    else if (a.status === "digest-mismatch") {
+        if (keys.join(",") !== "actualDigest,status" || typeof a.actualDigest !== "string" || !/^[a-f0-9]{64}$/.test(a.actualDigest))
+            throw new Error("Invalid digest-mismatch extraction artifact.");
+    }
+    else if (a.status === "unavailable") {
+        if (keys.join(",") !== "code,status" || !ARTIFACT_UNAVAILABLE_CODES.has(a.code))
+            throw new Error("Invalid unavailable extraction artifact.");
+    }
+    else
+        throw new Error("Invalid resolved extraction artifact status.");
+}
+/**
+ * Checks resolved text against the envelope's prepared-artifact identity: the
+ * caller's reported digest, the digest of the text itself, and the declared
+ * length. Shared by import-time verification and the source inspector.
+ */
+export function checkPreparedArtifact(prepared, artifact) {
+    if (artifact.status === "unavailable")
+        return { status: "unavailable", code: artifact.code };
+    if (artifact.status === "digest-mismatch")
+        return { status: "digest-mismatch", actualDigest: artifact.actualDigest };
+    const textDigest = sha256Hex(artifact.text);
+    if (!prepared || artifact.actualDigest !== prepared.digest || textDigest !== artifact.actualDigest)
+        return { status: "digest-mismatch", actualDigest: textDigest };
+    if (artifact.text.length !== prepared.contentLength)
+        return { status: "wrong-length" };
+    return { status: "aligned", text: artifact.text };
+}
+/** Whether the verified prepared text at a proposal's `chars:` span is exactly its excerpt. */
+export function proposalSpanMatches(text, proposal) {
+    const match = /^chars:(\d+)-(\d+)$/.exec(proposal.provenance.locator);
+    if (!match)
+        return false;
+    return text.slice(Number(match[1]), Number(match[2])) === proposal.provenance.excerpt;
+}
+function verifyAgainstArtifact(envelope, artifact) {
+    assertResolvedExtractionArtifact(artifact);
+    const prepared = envelope.result.preparedArtifact;
+    if (!prepared)
+        throw new Error("The artifact option requires result.preparedArtifact to verify against.");
+    const check = checkPreparedArtifact(prepared, artifact);
+    if (check.status === "unavailable")
+        return { provenance: "unverified", diagnostics: [unreadableArtifactDiagnostic(prepared.ref, check.code)] };
+    if (check.status === "wrong-length")
+        return { provenance: "unverified", diagnostics: [wrongLengthDiagnostic(prepared.ref)] };
+    if (check.status === "digest-mismatch")
+        return { provenance: "unverified", diagnostics: [suppliedDigestMismatchDiagnostic(prepared, check.actualDigest)] };
+    const diagnostics = [];
+    envelope.result.proposals.forEach((proposal, index) => {
+        if (!proposalSpanMatches(check.text, proposal))
+            diagnostics.push(excerptMismatchDiagnostic(index, proposal));
+    });
+    return { provenance: "verified", diagnostics };
+}
+function unreadableArtifactDiagnostic(artifactRef, code) {
+    const status = code === "storage-error" ? "storage-error" : code === "invalid-artifact" ? "invalid-artifact" : "unavailable";
+    return { kind: "artifact-unavailable", status, artifactRef, code, message: `Prepared artifact could not be read to verify excerpts (${code}); no candidate is grounded.` };
+}
+function wrongLengthDiagnostic(artifactRef) {
+    return { kind: "artifact-unavailable", status: "invalid-artifact", artifactRef, message: "Prepared artifact text does not have the declared content length; no candidate is grounded." };
+}
+function suppliedDigestMismatchDiagnostic(prepared, actualDigest) {
+    return { kind: "digest-mismatch", artifactRef: prepared.ref, expectedDigest: prepared.digest, actualDigest,
+        message: "Prepared artifact text supplied at import does not match the extraction artifact digest; no candidate is grounded." };
+}
+function excerptMismatchDiagnostic(index, proposal) {
+    return { kind: "excerpt-mismatch", proposalIndex: index, locator: proposal.provenance.locator,
+        message: `Proposal ${index} (${proposal.fieldPath}): the prepared text at ${proposal.provenance.locator} is not its excerpt, so it produced no review item.` };
+}
+/**
+ * The import-time verification diagnostics a record may carry after the
+ * envelope-derived ones. They cannot be recomputed without the artifact text,
+ * so a reloaded record is checked for being one the import could have
+ * written: each diagnostic is rebuilt from its own fields and must match.
+ */
+function verificationDiagnosticsAreCoherent(envelope, provenance, diagnostics) {
+    if (provenance === undefined)
+        return diagnostics.length === 0;
+    const prepared = envelope.result.preparedArtifact;
+    const rebuild = (value) => {
+        if (!value || typeof value !== "object" || Array.isArray(value) || !prepared)
+            return undefined;
+        const d = value;
+        if (provenance === "verified") {
+            const proposal = Number.isSafeInteger(d.proposalIndex) ? envelope.result.proposals[d.proposalIndex] : undefined;
+            return d.kind === "excerpt-mismatch" && proposal ? excerptMismatchDiagnostic(d.proposalIndex, proposal) : undefined;
+        }
+        if (d.kind === "artifact-unavailable") {
+            if (d.code === undefined)
+                return wrongLengthDiagnostic(prepared.ref);
+            return ARTIFACT_UNAVAILABLE_CODES.has(d.code) ? unreadableArtifactDiagnostic(prepared.ref, d.code) : undefined;
+        }
+        if (d.kind === "digest-mismatch" && typeof d.actualDigest === "string" && /^[a-f0-9]{64}$/.test(d.actualDigest))
+            return suppliedDigestMismatchDiagnostic(prepared, d.actualDigest);
+        return undefined;
+    };
+    if (provenance !== "verified" && provenance !== "unverified")
+        return false;
+    if (provenance === "verified" && !prepared)
+        return false;
+    if (provenance === "unverified" && diagnostics.length > 1)
+        return false;
+    let previous = -1;
+    for (const diagnostic of diagnostics) {
+        const expected = rebuild(diagnostic);
+        if (!expected || canonicalJson(expected) !== canonicalJson(diagnostic))
+            return false;
+        if (expected.kind === "excerpt-mismatch") {
+            if (expected.proposalIndex <= previous)
+                return false;
+            previous = expected.proposalIndex;
+        }
+    }
+    return true;
+}
 function diagnosticsFor(envelope) {
     return [...artifactDiagnostics(envelope), ...outcomeDiagnostics(envelope)];
 }
@@ -257,9 +422,12 @@ function validateImport(value) {
     if (targets.length !== envelope.result.proposals.length)
         throw new Error("spec.claimTargets must align with proposals.");
     const status = obj(record.status, "status");
-    exact(status, ["state", "diagnostics"], "status");
+    exact(status, ["state", "diagnostics"], "status", ["provenance"]);
+    const diagnostics = array(status.diagnostics, "status.diagnostics");
     const expected = diagnosticsFor(envelope);
-    if (canonicalJson(status.diagnostics) !== canonicalJson(expected) || status.state !== (expected.length ? "unresolved" : "grounded"))
+    if (canonicalJson(diagnostics.slice(0, expected.length)) !== canonicalJson(expected)
+        || !verificationDiagnosticsAreCoherent(envelope, status.provenance, diagnostics.slice(expected.length))
+        || status.state !== stateFor(diagnostics, envelope.result.proposals.length))
         throw new Error("Import status does not match envelope state.");
 }
 /** Validate and defensively clone a persisted or browser-delivered import. */
@@ -592,6 +760,7 @@ const FAILURE_KINDS = new Set(["authentication", "rate-limit", "timeout", "inval
 const MODEL_SOURCES = new Set(["provider-reported", "configured"]);
 const SCHEMA_MATCHES = new Set(["ok", "type-mismatch", "enum-mismatch", "format-invalid"]);
 const VALUE_IN_EXCERPT_MATCHES = new Set(["match", "mismatch", "not-evaluated", "not-applicable"]);
+const ARTIFACT_UNAVAILABLE_CODES = new Set(["not-found", "storage-error", "access-denied", "invalid-artifact", "unknown"]);
 const PREPARATION_MODES = new Set(["text", "markdown", "transcript", "pdf-text", "image-ocr"]);
 const ARTIFACT_INVALID_REASONS = new Set(["not-an-object", "invalid-format", "invalid-version", "invalid-digest", "invalid-ref", "invalid-preparation-mode", "invalid-preparation-version", "invalid-content-length", "invalid-source-snapshot-ref", "ill-formed-unicode", "invalid-resolved-text"]);
 const STABLE_IDENTITY = /^[A-Za-z0-9][A-Za-z0-9._:@/+~-]{0,255}$/;

package/dist/src/index.d.ts

@@ -8,7 +8,7 @@ export type { BindReviewQueueOptions, ReviewQueueBinding, ReviewQueueBindingIssu
 export { resolvePortablePdfRegion } from "./pdf-layout.js";
 export type { PortablePdfBoundingBox, PortablePdfLayout, PortablePdfPageGeometry, PortablePdfRegionContext, PortablePdfTable, PortablePdfTableCell, PortablePdfTextElement, PortablePdfTextRange, } from "./pdf-layout.js";
 export type { ExtractionAlignmentState, ArtifactUnavailableCode, BuiltExtractionInspectorCandidate, BuiltExtractionInspectorModel, ExtractionInspectorCandidate, ExtractionInspectorEntry, ExtractionInspectorExportOptions, ExtractionInspectorFilters, ExtractionInspectorInput, ExtractionInspectorModel, ExtractionInspectorSource, ResolvedExtractionArtifact, } from "./review-workbench/extraction-inspector.js";
-export type { ExtractionEnvelopeImport, ExtractionEnvelopeImportDiagnostic, ExtractionEnvelopeImportOptions, ExtractionEnvelopeImportResult, ExtractionEnvelopeResolutionIdentity, PortableExtractionCoverageEntry, PortableExtractionEvidenceMatch, PortableExtractionPartialReason, PortableExtractionOccurrence, PortableExtractionProducedBy, PortableExtractionProposal, PortableExtractionResultEnvelope, PortablePreparedArtifactState, } from "./extraction-envelope.js";
+export type { ExtractionEnvelopeImport, ExtractionEnvelopeImportDiagnostic, ExtractionEnvelopeImportOptions, ExtractionEnvelopeImportProvenance, ExtractionEnvelopeImportResult, ExtractionEnvelopeResolutionIdentity, PortableExtractionCoverageEntry, PortableExtractionEvidenceMatch, PortableExtractionPartialReason, PortableExtractionOccurrence, PortableExtractionProducedBy, PortableExtractionProposal, PortableExtractionResultEnvelope, PortablePreparedArtifactState, } from "./extraction-envelope.js";
 export type { CandidateRole, ClaimTargetHint, ProducerPolicy, ExtractionReference, ResourceEnvelope, ResourceMetadata, ReviewActor, ReviewCandidate, ReviewDecision, ReviewDecisionMode, ReviewDecisionSpec, ReviewDecisionStatus, ReviewItem, ReviewItemSpec, ReviewItemStatus, ReviewLocator, ReviewResource, ReviewResourceApiVersion, ReviewResourceKind, ReviewSession, ReviewSessionEvent, ReviewSessionEventSpec, ReviewSessionEventStatus, ReviewSessionEventType, ReviewSessionSpec, ReviewSessionStatus, ReviewValueDescriptor, ReviewValueType, SourceReference, SurveyRecordProjectionHint, } from "./review-resource.js";
 export { toSurfaceReviewedExtractionDecision, toSurfaceReviewedExtractionImport, toSurfaceReviewedExtractionItem, } from "./surface-reviewed-extraction.js";
 export { candidateReviewRecord, candidateSetStatusFor, SurveyInputBuilder } from "./builder.js";

package/dist/src/mcp/review-mcp.js

@@ -5,6 +5,7 @@ import { serveStdio } from "@modelcontextprotocol/server/stdio";
 import { z } from "zod";
 import { buildReviewSessionEvents, currentReviewItem, decisionSelectsNoCandidate, deriveQueueRowStatus, nextUnresolvedItemName, reviewSessionSummary, workbenchDecisionDefinitions, } from "../review-workbench/review-workbench.js";
 import { createServerReviewSessionRecord, currentSessionState, deriveServerReviewSessionApplyResult, } from "../review-workbench/server-review-session.js";
+import { buildReviewItemPresentation, excludedProposalsSentence } from "../review-workbench/review-presentation.js";
 import { appendReviewSessionEvents, readReviewSessionFile, storedReviewSessionName, updateReviewSessionFile, } from "../review-session-file.js";
 const SESSION_NAME = "mcp-review-session";
 const UI_RESOURCE_URI_META_KEY = "ui/resourceUri";
@@ -78,12 +79,22 @@ function itemDetailText(item, snapshot, events) {
             `  source: ${candidate.source?.sourceRef ?? "none"}`,
             ...(candidate.locator?.excerpt ? [`  excerpt: ${candidate.locator.excerpt}`] : []),
         ])),
+        ...extractionImportLines(item),
     ];
     if (item.spec.rationale) {
         lines.push(``, `Rationale: ${item.spec.rationale}`);
     }
     return lines.join("\n");
 }
+/** What an envelope import says about the item's evidence, including rival values it excluded. */
+function extractionImportLines(item) {
+    const presentation = buildReviewItemPresentation(item);
+    const excluded = excludedProposalsSentence(presentation.excludedProposals);
+    return [
+        ...(excluded ? [``, `Excluded: ${excluded} Check the source before accepting.`] : []),
+        ...(presentation.excerptVerification ? [``, `Excerpts ${presentation.excerptVerification === "verified" ? "were" : "were not"} checked against the prepared source text at import.`] : []),
+    ];
+}
 // ---- UI card -------------------------------------------------------------
 function escapeJsonInHtml(value) {
     return JSON.stringify(value)
@@ -131,6 +142,7 @@ function buildReviewCardHtml(item, snapshot, events) {
         ? proposedCandidates.map((candidate, index) => proposedCard(candidate, `Proposed ${index + 1} of ${proposedCandidates.length}`)).join("\n  ")
         : proposedCard(proposedCandidates[0], "Proposed");
     const itemNameJson = escapeJsonInHtml(item.metadata.name);
+    const excludedNote = excludedProposalsSentence(buildReviewItemPresentation(item).excludedProposals);
     const decisionBadge = decision
         ? `<span class="badge badge-${decision === "accept-proposed" ? "accept" : decision === "reject-proposed" ? "reject" : "hold"}">${escapeHtml(workbenchDecisionDefinitions[decision].label)}</span>`
         : `<span class="badge badge-pending">${escapeHtml(status)}</span>`;
@@ -232,6 +244,7 @@ h1{font-size:15px;font-weight:700;margin:0 0 4px}
   </div>
   ${proposedCards}
 </div>
+${excludedNote ? `<p class="feedback" id="excluded-note">${escapeHtml(excludedNote)}</p>` : ""}
 ${conflict ? `<p class="feedback" id="conflict-note">${proposedCandidates.length} different values were proposed. This card cannot choose one of them yet: reject them all, or use Could not confirm with a reason.</p>` : ""}
 
 <div class="divider"></div>
@@ -339,6 +352,13 @@ async function toolItem(itemName, options) {
         decision: current.decisionsByItemName[item.metadata.name],
         note: current.notesByItemName[item.metadata.name],
         candidateSetStatus: item.spec.candidateSetStatus,
+        ...(() => {
+            const presentation = buildReviewItemPresentation(item);
+            return {
+                ...(presentation.excerptVerification ? { excerptVerification: presentation.excerptVerification } : {}),
+                ...(presentation.excludedProposals.length ? { excludedProposals: presentation.excludedProposals.map(({ proposalIndex, value, locator, excerpt }) => ({ proposalIndex, value, locator, excerpt })) } : {}),
+            };
+        })(),
         candidates: item.spec.candidates.map((c) => ({
             id: c.id,
             role: c.role,

package/dist/src/review-workbench/audit-rows.d.ts

@@ -25,7 +25,7 @@
  * it is a duplicate placement or a constant, but a key is never renamed or
  * repointed at a different fact. Hosts may hold selectors against these values.
  */
-export declare const reviewAuditRowKeys: readonly ["current-candidate-id", "proposed-candidate-id", "claim-id", "raw-source-id", "locator", "model", "extractor", "extracted-at", "history-value", "candidate-id", "source-reference", "excerpt", "observed", "source-authority-class", "declared-by", "authority-scope", "extraction-id", "actor", "reviewed-at", "status", "rationale", "outcome", "checksum", "candidate-set-id", "authority-trace-status", "authority-trace-detail"];
+export declare const reviewAuditRowKeys: readonly ["current-candidate-id", "proposed-candidate-id", "claim-id", "raw-source-id", "locator", "model", "extractor", "extracted-at", "excluded-proposal", "history-value", "candidate-id", "source-reference", "excerpt", "observed", "source-authority-class", "declared-by", "authority-scope", "extraction-id", "actor", "reviewed-at", "status", "rationale", "outcome", "checksum", "candidate-set-id", "authority-trace-status", "authority-trace-detail"];
 /** One of {@link reviewAuditRowKeys}. */
 export type ReviewAuditRowKey = (typeof reviewAuditRowKeys)[number];
 /**

package/dist/src/review-workbench/audit-rows.js

@@ -35,6 +35,7 @@ export const reviewAuditRowKeys = [
     "model",
     "extractor",
     "extracted-at",
+    "excluded-proposal",
     // Unselected candidate history
     "history-value",
     "candidate-id",

package/dist/src/review-workbench/extraction-inspector.d.ts

@@ -1,18 +1,7 @@
-import { type ExtractionEnvelopeImportDiagnostic, type ExtractionEnvelopeImportResult } from "../extraction-envelope.js";
+import { type ExtractionEnvelopeImportDiagnostic, type ExtractionEnvelopeImportResult, type ResolvedExtractionArtifact } from "../extraction-envelope.js";
 import { type PortablePdfRegionContext } from "../pdf-layout.js";
 export type ExtractionAlignmentState = "aligned" | "excerpt-mismatch" | "artifact-unavailable" | "digest-mismatch";
-export type ArtifactUnavailableCode = "not-found" | "storage-error" | "access-denied" | "invalid-artifact" | "unknown";
-export type ResolvedExtractionArtifact = {
-    status: "available";
-    text: string;
-    actualDigest: string;
-} | {
-    status: "unavailable";
-    code: ArtifactUnavailableCode;
-} | {
-    status: "digest-mismatch";
-    actualDigest: string;
-};
+export type { ArtifactUnavailableCode, ResolvedExtractionArtifact } from "../extraction-envelope.js";
 export interface ExtractionInspectorEntry {
     /** Result returned by importExtractionEnvelope; includes authoritative ReviewItem identities. */
     importResult: ExtractionEnvelopeImportResult;
@@ -97,6 +86,21 @@ export interface ExtractionInspectorSource {
     extractionDiagnostic?: Extract<ExtractionEnvelopeImportDiagnostic, {
         kind: "extraction-failed" | "extraction-incomplete";
     }>;
+    /**
+     * Whether the import checked excerpts against the prepared artifact
+     * (`status.provenance`; a record without it is `unverified`). Always set by
+     * {@link buildExtractionInspectorModel}; optional for hand-authored models.
+     */
+    importProvenance?: "verified" | "unverified";
+    /**
+     * Proposals the import left out because the prepared text at their span is
+     * not their excerpt. They have no candidate row; this is where they are shown.
+     */
+    excludedProposals?: Array<{
+        proposalIndex: number;
+        field: string;
+        locator: string;
+    }>;
     message: string;
 }
 export interface ExtractionInspectorModel {
@@ -159,7 +163,7 @@ export declare function buildExtractionInspectorModel(input: ExtractionInspector
  * stop when there is one, otherwise the artifact alignment. A failed
  * extraction over an aligned artifact must not show the aligned posture.
  */
-export declare function inspectorSourcePosture(source: Pick<ExtractionInspectorSource, "alignment" | "extractionDiagnostic">): ExtractionAlignmentState | "extraction-failed" | "extraction-incomplete";
+export declare function inspectorSourcePosture(source: Pick<ExtractionInspectorSource, "alignment" | "extractionDiagnostic" | "excludedProposals">): ExtractionAlignmentState | "extraction-failed" | "extraction-incomplete" | "proposals-excluded";
 export declare function filterExtractionInspectorCandidates(model: ExtractionInspectorModel, filters: ExtractionInspectorFilters): ExtractionInspectorCandidate[];
 export declare function exportExtractionInspector(model: ExtractionInspectorModel, options?: ExtractionInspectorExportOptions): string;
 export declare function mountExtractionInspector(container: HTMLElement, model: ExtractionInspectorModel, options?: ExtractionInspectorMountOptions): () => void;

package/dist/src/review-workbench/extraction-inspector.js

@@ -1,6 +1,5 @@
-import { buildReviewItemsFromExtractionEnvelopeImport, validateExtractionEnvelopeImport } from "../extraction-envelope.js";
+import { assertResolvedExtractionArtifact, buildReviewItemsFromExtractionEnvelopeImport, checkPreparedArtifact, excerptMismatchProposalIndices, proposalSpanMatches, validateExtractionEnvelopeImport } from "../extraction-envelope.js";
 import { canonicalJson } from "./canonical.js";
-import { sha256Hex } from "../sha256.js";
 import { resolvePortablePdfRegion, } from "../pdf-layout.js";
 /**
  * Build a read-only view from one or more results already produced by Survey's
@@ -19,14 +18,14 @@ export function buildExtractionInspectorModel(input) {
             throw new Error("Invalid extraction import result.");
         const record = validateExtractionEnvelopeImport(entry.importResult.record);
         assertImportedResult(entry.importResult, record);
-        assertResolvedArtifact(entry.artifact);
+        assertResolvedExtractionArtifact(entry.artifact);
         const envelope = record.spec.envelope;
         const prepared = envelope.result.preparedArtifact;
         const sourceKey = `${record.metadata.producerNamespace}:${record.metadata.name}:${entryIndex}`;
         if (sourceKeys.has(sourceKey))
             throw new Error("Extraction inspector source identity collision.");
         sourceKeys.add(sourceKey);
-        const source = sourceModel(sourceKey, record.metadata.name, prepared, record.status.diagnostics, entry.artifact, envelope.result.ocrDerived);
+        const source = sourceModel(sourceKey, record.metadata.name, prepared, record.status.diagnostics, entry.artifact, envelope.result.ocrDerived, envelope.result.proposals, record.status.provenance ?? "unverified");
         sources.push(source);
         const candidateStart = candidates.length;
         const itemByProposalIndex = new Map();
@@ -118,25 +117,6 @@ function resolveHighlightElementIds(model) {
     }
     return resolved;
 }
-function assertResolvedArtifact(artifact) {
-    if (!artifact || typeof artifact !== "object" || Array.isArray(artifact))
-        throw new Error("Invalid resolved extraction artifact.");
-    const keys = Object.keys(artifact).sort();
-    if (artifact.status === "available") {
-        if (keys.join(",") !== "actualDigest,status,text" || typeof artifact.text !== "string" || !/^[a-f0-9]{64}$/.test(artifact.actualDigest))
-            throw new Error("Invalid available extraction artifact.");
-    }
-    else if (artifact.status === "digest-mismatch") {
-        if (keys.join(",") !== "actualDigest,status" || !/^[a-f0-9]{64}$/.test(artifact.actualDigest))
-            throw new Error("Invalid digest-mismatch extraction artifact.");
-    }
-    else if (artifact.status === "unavailable") {
-        if (keys.join(",") !== "code,status" || !["not-found", "storage-error", "access-denied", "invalid-artifact", "unknown"].includes(artifact.code))
-            throw new Error("Invalid unavailable extraction artifact.");
-    }
-    else
-        throw new Error("Invalid resolved extraction artifact status.");
-}
 function assertImportedResult(result, record) {
     if (!result || typeof result !== "object" || !result.record || !Array.isArray(result.reviewItems))
         throw new Error("Invalid extraction import result.");
@@ -148,7 +128,9 @@ function assertImportedResult(result, record) {
     const grounded = record.status?.state === "grounded";
     const proposals = record.spec.envelope.result.proposals;
     const covered = reviewItems.flatMap(envelopeItemProposalIndices).sort((left, right) => left - right);
-    if ((!grounded && reviewItems.length !== 0) || (grounded && canonicalJson(covered) !== canonicalJson(proposals.map((_proposal, index) => index))))
+    const excluded = excerptMismatchProposalIndices(record);
+    const expectedCovered = proposals.map((_proposal, index) => index).filter((index) => !excluded.has(index));
+    if ((!grounded && reviewItems.length !== 0) || (grounded && canonicalJson(covered) !== canonicalJson(expectedCovered)))
         throw new Error("Extraction import ReviewItems do not match its grounding state.");
     const canonicalItems = buildReviewItemsFromExtractionEnvelopeImport(record);
     if (canonicalJson(reviewItems) !== canonicalJson(canonicalItems))
@@ -183,39 +165,51 @@ function envelopeItemProposalIndices(item) {
  * extraction over an aligned artifact must not show the aligned posture.
  */
 export function inspectorSourcePosture(source) {
+    // Dropped proposals are a loss of evidence: they lead over an aligned
+    // artifact and over an extraction that merely stopped short.
+    if (source.alignment === "aligned" && source.excludedProposals?.length && source.extractionDiagnostic?.kind !== "extraction-failed")
+        return "proposals-excluded";
     if (source.extractionDiagnostic)
         return source.extractionDiagnostic.kind;
     return source.alignment;
 }
-function sourceModel(key, importName, prepared, diagnostics, artifact, ocrDerived) {
+function sourceModel(key, importName, prepared, diagnostics, artifact, ocrDerived, proposals, importProvenance) {
     let alignment;
     let message;
     const artifactUnresolved = diagnostics.some((diagnostic) => diagnostic.kind === "artifact-unavailable" || diagnostic.kind === "digest-mismatch");
+    const excludedProposals = diagnostics.flatMap((diagnostic) => diagnostic.kind === "excerpt-mismatch"
+        ? [{ proposalIndex: diagnostic.proposalIndex, field: proposals[diagnostic.proposalIndex]?.fieldPath ?? "", locator: diagnostic.locator }]
+        : []);
     const extractionDiagnostic = diagnostics.find((diagnostic) => diagnostic.kind === "extraction-failed" || diagnostic.kind === "extraction-incomplete");
-    if (artifactUnresolved || artifact.status === "unavailable") {
+    const check = checkPreparedArtifact(prepared, artifact);
+    if (artifactUnresolved || check.status === "unavailable") {
         alignment = "artifact-unavailable";
-        message = `Prepared artifact unavailable (${artifact.status === "unavailable" ? artifact.code : "invalid-artifact"}). Candidates are not grounded.`;
+        message = `Prepared artifact unavailable (${check.status === "unavailable" ? check.code : "invalid-artifact"}). Candidates are not grounded.`;
     }
-    else if (artifact.status === "digest-mismatch" || !prepared || artifact.actualDigest !== prepared.digest
-        || sha256Hex(artifact.text) !== artifact.actualDigest) {
+    else if (check.status === "digest-mismatch") {
         alignment = "digest-mismatch";
         message = "Prepared artifact digest does not match the extraction artifact. Candidates are not grounded.";
     }
-    else if (artifact.text.length !== prepared.contentLength) {
+    else if (check.status === "wrong-length") {
         alignment = "artifact-unavailable";
         message = "Prepared artifact content has the wrong length. Candidates are not grounded.";
     }
     else {
         alignment = "aligned";
-        message = extractionDiagnostic
+        message = extractionDiagnostic || excludedProposals.length
             ? "Prepared artifact identity verified."
             : `Prepared artifact identity verified. Exact source spans are available.${ocrDerived ? " Prepared text is OCR-derived." : ""}`;
     }
+    if (excludedProposals.length) {
+        const named = excludedProposals.map((p) => `#${p.proposalIndex} ${p.field} (${p.locator})`).join(", ");
+        message = `${excludedProposals.length} proposal${excludedProposals.length === 1 ? " was" : "s were"} excluded at import because the prepared text at the span is not the excerpt: ${named}. ${message}`;
+    }
+    message = `${message} ${importProvenance === "verified" ? "Excerpts were checked against the prepared artifact at import." : "Excerpts were not checked against the prepared artifact at import."}`;
     // The extraction's own failure leads: an aligned artifact with no candidates
     // must not read as a complete run that found nothing.
     if (extractionDiagnostic)
         message = `${extractionDiagnostic.message} ${message}`;
-    return { key, importName, ...(extractionDiagnostic ? { extractionDiagnostic } : {}), ...(prepared?.ref ? { artifactRef: prepared.ref } : {}), ...(prepared?.digest ? { expectedDigest: prepared.digest } : {}), ...("actualDigest" in artifact ? { actualDigest: artifact.actualDigest } : {}), ...(alignment === "aligned" && artifact.status === "available" ? { artifactText: artifact.text } : {}), ...(ocrDerived ? { ocrDerived: true } : {}), alignment, message };
+    return { key, importName, importProvenance, ...(excludedProposals.length ? { excludedProposals } : {}), ...(extractionDiagnostic ? { extractionDiagnostic } : {}), ...(prepared?.ref ? { artifactRef: prepared.ref } : {}), ...(prepared?.digest ? { expectedDigest: prepared.digest } : {}), ...("actualDigest" in artifact ? { actualDigest: artifact.actualDigest } : {}), ...(alignment === "aligned" && artifact.status === "available" ? { artifactText: artifact.text } : {}), ...(ocrDerived ? { ocrDerived: true } : {}), alignment, message };
 }
 function candidateModel(source, reviewItemName, proposal, index, provider, model, attempt, pass, pdfPageOffsets, pdfLayout, ocrDerived) {
     const match = /^chars:(\d+)-(\d+)$/.exec(proposal.provenance.locator);
@@ -224,10 +218,10 @@ function candidateModel(source, reviewItemName, proposal, index, provider, model
     const start = Number(match[1]), end = Number(match[2]);
     if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 0 || end < start)
         throw new Error(`Extraction proposal ${index} has an invalid text span.`);
-    const alignment = source.alignment === "aligned" && source.artifactText.slice(start, end) !== proposal.provenance.excerpt ? "excerpt-mismatch" : source.alignment;
+    const alignment = source.alignment === "aligned" && !proposalSpanMatches(source.artifactText, proposal) ? "excerpt-mismatch" : source.alignment;
     if (alignment === "excerpt-mismatch") {
         source.alignment = alignment;
-        source.message = "One or more source spans do not match their recorded excerpts. Affected candidates are not grounded.";
+        source.message = `One or more source spans do not match their recorded excerpts. Affected candidates are not grounded.${source.importProvenance === "unverified" ? " Excerpts were not checked against the prepared artifact at import." : ""}`;
     }
     let pdfRegion = pdfLayout ? resolvePortablePdfRegion(pdfLayout, proposal.provenance.locator) : undefined;
     const page = resolvePdfPage(pdfPageOffsets, start);
@@ -306,7 +300,7 @@ export function mountExtractionInspector(container, model, options = {}) {
         next.hidden = pageCount === 1;
         previous.disabled = page === 0;
         next.disabled = page >= pageCount - 1;
-        postures.innerHTML = model.sources.map(s => { const posture = inspectorSourcePosture(s); return `<div class="inspector-posture ${s.alignment}${posture !== s.alignment ? ` ${posture}` : ""}" role="status" data-posture="${escapeHtml(posture)}"><strong>${escapeHtml(s.importName)}: ${escapeHtml(posture)}</strong><span>${escapeHtml(s.message)}</span></div>`; }).join("");
+        postures.innerHTML = model.sources.map(s => { const posture = inspectorSourcePosture(s); const classes = [...new Set([s.alignment, s.extractionDiagnostic?.kind, s.excludedProposals?.length ? "proposals-excluded" : undefined, posture].filter(Boolean))].join(" "); return `<div class="inspector-posture ${classes}" role="status" data-posture="${escapeHtml(posture)}"><strong>${escapeHtml(s.importName)}: ${escapeHtml(posture)}</strong><span>${escapeHtml(s.message)}</span></div>`; }).join("");
         sourcesRoot.innerHTML = model.sources.map(s => { const anchored = model.candidates.filter(c => c.sourceKey === s.key); const marked = visible.filter(c => c.sourceKey === s.key); return `<div class="inspector-source" aria-label="Prepared source for ${escapeHtml(s.importName)}"><h3>${escapeHtml(s.importName)}</h3><pre tabindex="0">${s.artifactText === undefined ? `${anchored.map(c => anchorHtml(c, highlightIdFor(c))).join("")}<span class="source-unavailable">${escapeHtml(s.message)}</span>` : renderSource(s.artifactText, anchored, marked, highlightIdFor)}</pre></div>`; }).join("");
     };
     root.querySelectorAll("select").forEach(select => select.addEventListener("change", event => { event.stopPropagation(); const key = select.dataset.filter; if (select.value)

package/dist/src/review-workbench/review-presentation.d.ts

@@ -50,6 +50,25 @@ export interface ReviewItemPresentation {
     readonly reviewItemLink?: ReviewPresentationLink;
     readonly traceRefs: readonly ReviewTraceRef[];
     readonly candidates: readonly ReviewCandidatePresentation[];
+    /**
+     * Proposals for this claim that an envelope import left out because the
+     * source text at their cited span is not their excerpt. Unverifiable, not
+     * disproven: every decision surface shows them. Empty for other items.
+     */
+    readonly excludedProposals: readonly ExcludedProposalPresentation[];
+    /**
+     * For an envelope-imported item, whether its import checked excerpts
+     * against the prepared artifact. Absent for other items, and for an item
+     * whose envelope binding is missing, which cannot claim either.
+     */
+    readonly excerptVerification?: "verified" | "unverified";
+}
+export interface ExcludedProposalPresentation {
+    readonly proposalIndex: number;
+    readonly value: unknown;
+    readonly valueText: string;
+    readonly locator: string;
+    readonly excerpt: string;
 }
 export interface ReviewResultPresentation {
     readonly result: ReviewWorkbenchResult;
@@ -106,6 +125,11 @@ export interface InterpretationReadingPresentation {
  * authored record under a label nothing derived.
  */
 export declare function buildInterpretationReadingPresentation(source: InterpretationReadingSource): InterpretationReadingPresentation;
+/**
+ * One sentence naming every excluded proposal, for surfaces that speak in
+ * text (the MCP item, the recorded decision prompt). Undefined when none.
+ */
+export declare function excludedProposalsSentence(excluded: readonly ExcludedProposalPresentation[]): string | undefined;
 export declare function buildReviewItemPresentation(item: ReviewItem, adapter?: ReviewPresentationAdapter): ReviewItemPresentation;
 export declare function buildReviewCandidatePresentation(item: ReviewItem, candidate: ReviewCandidate, adapter?: ReviewPresentationAdapter, targetLabel?: string): ReviewCandidatePresentation;
 export declare function buildReviewResultPresentation(result: ReviewWorkbenchResult, item: ReviewItem | undefined, adapter?: ReviewPresentationAdapter): ReviewResultPresentation;

package/dist/src/review-workbench/review-presentation.js

@@ -49,6 +49,50 @@ export function buildInterpretationReadingPresentation(source) {
         provenanceLabel: "Authored judgment",
     };
 }
+const EXTRACTION_ENVELOPE_PRODUCER = "survey.kontourai.io/extraction-envelope";
+/**
+ * The envelope-import binding an item carries, or undefined when it has none.
+ * A binding names its import and proposals, and every candidate points back
+ * at the same import; anything less cannot vouch for what the import checked.
+ */
+function extractionEnvelopeBinding(item) {
+    const metadata = item.metadata?.producer?.[EXTRACTION_ENVELOPE_PRODUCER];
+    if (!metadata || typeof metadata !== "object" || Array.isArray(metadata))
+        return undefined;
+    const binding = metadata;
+    if (typeof binding.importName !== "string" || !binding.importName || !Array.isArray(binding.proposalIndices) || binding.proposalIndices.length === 0)
+        return undefined;
+    const bound = item.spec.candidates.length > 0 && item.spec.candidates.every((candidate) => {
+        const own = candidate.producer?.[EXTRACTION_ENVELOPE_PRODUCER];
+        return own?.importName === binding.importName;
+    });
+    return bound ? binding : undefined;
+}
+/** The well-formed `excludedProposals` entries of a bound envelope item; malformed entries are ignored, never rendered. */
+function excludedProposalsOf(item, binding, adapter) {
+    if (!binding || !Array.isArray(binding.excludedProposals))
+        return [];
+    return binding.excludedProposals.flatMap((entry) => {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+            return [];
+        const e = entry;
+        if (!Number.isSafeInteger(e.proposalIndex) || typeof e.locator !== "string" || typeof e.excerpt !== "string" || !("value" in e))
+            return [];
+        const proposed = item.spec.candidates.find((candidate) => candidate.role === "proposed");
+        const valueText = (proposed ? adapter.summarizeValue?.(e.value, { item, candidate: proposed, value: e.value }) : undefined) ?? formatValue(e.value);
+        return [{ proposalIndex: e.proposalIndex, value: e.value, valueText, locator: e.locator, excerpt: e.excerpt }];
+    });
+}
+/**
+ * One sentence naming every excluded proposal, for surfaces that speak in
+ * text (the MCP item, the recorded decision prompt). Undefined when none.
+ */
+export function excludedProposalsSentence(excluded) {
+    if (excluded.length === 0)
+        return undefined;
+    const named = excluded.map((entry) => `${entry.valueText} (proposal ${entry.proposalIndex}, ${entry.locator})`).join(", ");
+    return `${excluded.length === 1 ? "Another proposed value was" : `${excluded.length} other proposed values were`} excluded at import because the source text at the cited span is not the excerpt: ${named}. Unverifiable is not disproven.`;
+}
 export function buildReviewItemPresentation(item, adapter = {}) {
     const context = { item };
     const targetLabel = adapter.labelForTarget?.(item.spec.target, context) ?? humanizeIdentifier(item.spec.target);
@@ -61,6 +105,14 @@ export function buildReviewItemPresentation(item, adapter = {}) {
         reviewItemLink: adapter.linkForReviewItem?.(item, context),
         traceRefs: traceRefsForReviewItem(item, adapter),
         candidates: item.spec.candidates.map((candidate) => buildReviewCandidatePresentation(item, candidate, adapter, targetLabel)),
+        ...extractionPresentation(item, adapter),
+    };
+}
+function extractionPresentation(item, adapter) {
+    const binding = extractionEnvelopeBinding(item);
+    return {
+        excludedProposals: excludedProposalsOf(item, binding, adapter),
+        ...(binding ? { excerptVerification: binding.excerptVerification === "verified" ? "verified" : "unverified" } : {}),
     };
 }
 export function buildReviewCandidatePresentation(item, candidate, adapter = {}, targetLabel = adapter.labelForTarget?.(item.spec.target, { item }) ?? humanizeIdentifier(item.spec.target)) {

package/dist/src/review-workbench/review-workbench-css.generated.js

@@ -246,9 +246,10 @@ export const REVIEW_WORKBENCH_CSS = `/* Bundled, scoped Survey Review Workbench
 .survey-workbench-embed .inspector-heading, .survey-workbench-embed .inspector-layout{ display: grid; grid-template-columns: minmax(15rem, .7fr) minmax(0, 1.3fr); gap: 1rem; }
 .survey-workbench-embed .inspector-heading h2{ margin: 0; }
 .survey-workbench-embed .inspector-posture{ display: flex; flex-direction: column; padding: .75rem; border-radius: var(--k-radius-sm); background: var(--k-positive-wash); }
-.survey-workbench-embed .inspector-posture.digest-mismatch, .survey-workbench-embed .inspector-posture.artifact-unavailable, .survey-workbench-embed .inspector-posture.excerpt-mismatch{ background: var(--k-negative-wash); color: var(--k-negative); border: 2px solid currentColor; }
-.survey-workbench-embed .inspector-posture.extraction-failed{ background: var(--k-negative-wash); color: var(--k-negative); border: 2px solid currentColor; }
+/* Caution first: an artifact failure on the same source must win the tie and stay negative. */
 .survey-workbench-embed .inspector-posture.extraction-incomplete{ background: var(--k-caution-wash); color: var(--k-caution); border: 2px solid currentColor; }
+.survey-workbench-embed .inspector-posture.digest-mismatch, .survey-workbench-embed .inspector-posture.artifact-unavailable, .survey-workbench-embed .inspector-posture.excerpt-mismatch, .survey-workbench-embed .inspector-posture.proposals-excluded{ background: var(--k-negative-wash); color: var(--k-negative); border: 2px solid currentColor; }
+.survey-workbench-embed .inspector-posture.extraction-failed{ background: var(--k-negative-wash); color: var(--k-negative); border: 2px solid currentColor; }
 .survey-workbench-embed .inspector-filters{ display: flex; flex-wrap: wrap; gap: .6rem; margin: 1rem 0; }
 .survey-workbench-embed .inspector-filters label{ display: grid; gap: .25rem; font-size: .75rem; color: var(--k-text-muted); }
 .survey-workbench-embed .inspector-filters select, .survey-workbench-embed .inspector-filters input{ color: var(--k-text); background: var(--k-sunken); border: 1px solid var(--k-line); padding: .4rem; }
@@ -834,6 +835,12 @@ export const REVIEW_WORKBENCH_CSS = `/* Bundled, scoped Survey Review Workbench
   font-size: 12px;
 }
 
+.survey-workbench-embed .excerpt-verification{
+  margin: 0;
+  font-size: 12px;
+  color: var(--k-muted);
+}
+
 /* decisions */
 
 /* The decision row is the point of the card, so it sits on its own line,

package/dist/src/review-workbench/review-workbench.css

@@ -243,9 +243,10 @@
 .survey-workbench-embed .inspector-heading, .survey-workbench-embed .inspector-layout{ display: grid; grid-template-columns: minmax(15rem, .7fr) minmax(0, 1.3fr); gap: 1rem; }
 .survey-workbench-embed .inspector-heading h2{ margin: 0; }
 .survey-workbench-embed .inspector-posture{ display: flex; flex-direction: column; padding: .75rem; border-radius: var(--k-radius-sm); background: var(--k-positive-wash); }
-.survey-workbench-embed .inspector-posture.digest-mismatch, .survey-workbench-embed .inspector-posture.artifact-unavailable, .survey-workbench-embed .inspector-posture.excerpt-mismatch{ background: var(--k-negative-wash); color: var(--k-negative); border: 2px solid currentColor; }
-.survey-workbench-embed .inspector-posture.extraction-failed{ background: var(--k-negative-wash); color: var(--k-negative); border: 2px solid currentColor; }
+/* Caution first: an artifact failure on the same source must win the tie and stay negative. */
 .survey-workbench-embed .inspector-posture.extraction-incomplete{ background: var(--k-caution-wash); color: var(--k-caution); border: 2px solid currentColor; }
+.survey-workbench-embed .inspector-posture.digest-mismatch, .survey-workbench-embed .inspector-posture.artifact-unavailable, .survey-workbench-embed .inspector-posture.excerpt-mismatch, .survey-workbench-embed .inspector-posture.proposals-excluded{ background: var(--k-negative-wash); color: var(--k-negative); border: 2px solid currentColor; }
+.survey-workbench-embed .inspector-posture.extraction-failed{ background: var(--k-negative-wash); color: var(--k-negative); border: 2px solid currentColor; }
 .survey-workbench-embed .inspector-filters{ display: flex; flex-wrap: wrap; gap: .6rem; margin: 1rem 0; }
 .survey-workbench-embed .inspector-filters label{ display: grid; gap: .25rem; font-size: .75rem; color: var(--k-text-muted); }
 .survey-workbench-embed .inspector-filters select, .survey-workbench-embed .inspector-filters input{ color: var(--k-text); background: var(--k-sunken); border: 1px solid var(--k-line); padding: .4rem; }
@@ -831,6 +832,12 @@
   font-size: 12px;
 }
 
+.survey-workbench-embed .excerpt-verification{
+  margin: 0;
+  font-size: 12px;
+  color: var(--k-muted);
+}
+
 /* decisions */
 
 /* The decision row is the point of the card, so it sits on its own line,

package/dist/src/review-workbench/review-workbench.js

@@ -6,7 +6,7 @@ import { buildSurfaceProjectionPreview, formatValue, } from "./review-surface-pr
 import { buildReviewCandidatePresentation, buildReviewItemPresentation, } from "./review-presentation.js";
 import { findSoleCandidateById, reviewResourceApiVersion, } from "../review-resource.js";
 import { validateAuthorizing, buildAuthorizedActionAuthorizing } from "../review-authorizing.js";
-import { humanizeIdentifier } from "./review-presentation.js";
+import { excludedProposalsSentence, humanizeIdentifier } from "./review-presentation.js";
 import { editedValueFromEditorText, isIsoCalendarDate, parsePlainDecimal } from "./edited-value.js";
 import { createAuditFactTrace, } from "./audit-rows.js";
 export { reviewAuditRowKeys } from "./audit-rows.js";
@@ -129,6 +129,13 @@ function buildDecisionCardAuthorizing(state) {
  * followed by the selected decision label so the block is self-contained.
  */
 function decisionCardRenderedPrompt(state, targetLabel) {
+    // The card shows proposals excluded at import; the recorded prompt must say
+    // the reviewer was told about them.
+    const excluded = excludedProposalsSentence(buildReviewItemPresentation(state.item).excludedProposals);
+    const base = decisionCardBasePrompt(state, targetLabel);
+    return excluded ? `${base} ${excluded}` : base;
+}
+function decisionCardBasePrompt(state, targetLabel) {
     const currentCandidate = state.item.spec.candidates.find((c) => c.role === "current");
     const proposedCandidates = state.item.spec.candidates.filter((c) => c.role === "proposed");
     // A conflict card lists every proposed value and offers reject-all or could
@@ -693,6 +700,7 @@ function renderFieldCard(item, session, presentationAdapter) {
             ? renderConflictingProposals(item, proposedCandidates, presentationAdapter, presentation.targetLabel)
             : "<p class=\"field-value\">No proposed value is available for this field.</p>"}
         ${proposed ? renderProvenanceRow(item, proposed, presentationAdapter) : ""}
+        ${renderExtractionImportNotes(presentation)}
         <div class="decide">
           ${keepDecision === undefined ? "" : `<button class="btn keep" type="button" data-testid="keep-current" data-item-name="${escapeHtml(item.metadata.name)}">${keepLabel}</button>`}
           ${proposed ? `<button class="btn use" type="button" data-testid="use-proposed" data-item-name="${escapeHtml(item.metadata.name)}">Use proposed</button>
@@ -924,6 +932,35 @@ function renderProvenanceRow(item, proposed, presentationAdapter) {
     </div>
   `;
 }
+/**
+ * What an envelope import says about this field's evidence: whether its
+ * excerpts were checked against the prepared source text, and any rival
+ * proposals the import left out because their excerpt was not at their span.
+ * Such a proposal is unverifiable, not disproven, so the reviewer sees it
+ * before accepting the value that remained. Empty for items from other
+ * producers.
+ */
+function renderExtractionImportNotes(presentation) {
+    const { excerptVerification: verification, excludedProposals: excluded } = presentation;
+    if (verification === undefined && excluded.length === 0)
+        return "";
+    const excludedHtml = excluded.length === 0 ? "" : `
+      <div class="noprov" data-testid="excluded-proposals" role="note">
+        ${WARNING_SVG}
+        <span class="tag">${excluded.length} excluded</span>
+        <span>${excluded.length === 1 ? "Another proposal for this field was" : `${excluded.length} other proposals for this field were`} left out because the source text at the cited span is not the excerpt:
+          ${excluded.map((entry) => `<span data-testid="excluded-proposal" data-proposal-index="${escapeHtml(String(entry.proposalIndex))}"><q>${escapeHtml(entry.valueText)}</q> (proposal ${escapeHtml(String(entry.proposalIndex))}, ${escapeHtml(entry.locator)})</span>`).join(", ")}.
+          Unverifiable is not disproven: check the source before deciding.</span>
+      </div>`;
+    const verificationHtml = verification === undefined ? "" : `
+      <p class="excerpt-verification" data-testid="excerpt-verification" data-verified="${verification === "verified" ? "true" : "false"}">${verification === "verified"
+        ? "Excerpts checked against the prepared source text at import."
+        : "Excerpts not checked against the prepared source text at import."}</p>`;
+    return `
+    <div class="prov import-notes">${excludedHtml}${verificationHtml}
+    </div>
+  `;
+}
 function renderConfidenceMeter(confidence) {
     const clamped = Math.max(0, Math.min(1, confidence));
     const pct = Math.round(clamped * 100);
@@ -980,6 +1017,7 @@ function renderAuditDetails(item, current, proposed, session, presentationAdapte
           ${proposed?.extraction.model ? fieldItem("model", "Model", proposed.extraction.model) : ""}
           ${proposed ? placementItem(trace, { of: proposed.id, property: "extraction.extractor" }, "extractor", "Extractor", proposed.extraction.extractor ?? "unknown") : ""}
           ${proposed ? fieldItem("extracted-at", "Extracted at", proposed.extraction.extractedAt ?? "unknown") : ""}
+          ${buildReviewItemPresentation(item, presentationAdapter).excludedProposals.map((entry) => fieldItem("excluded-proposal", `Excluded proposal ${entry.proposalIndex}`, `${entry.valueText} at ${entry.locator}: excerpt not at the cited span`)).join("")}
         </dl>
         ${preview
         ? `<div class="preview-section-grid">${renderSurfacePreviewSections(preview, trace)}</div><p class="preview-disclaimer preview-disclaimer-footer">${escapeHtml(preview.postureDisclaimer)}</p>`

package/dist/src/review-workbench/review-workbench.standalone.css

@@ -38,9 +38,10 @@
 .inspector-heading, .inspector-layout { display: grid; grid-template-columns: minmax(15rem, .7fr) minmax(0, 1.3fr); gap: 1rem; }
 .inspector-heading h2 { margin: 0; }
 .inspector-posture { display: flex; flex-direction: column; padding: .75rem; border-radius: var(--k-radius-sm); background: var(--k-positive-wash); }
-.inspector-posture.digest-mismatch, .inspector-posture.artifact-unavailable, .inspector-posture.excerpt-mismatch { background: var(--k-negative-wash); color: var(--k-negative); border: 2px solid currentColor; }
-.inspector-posture.extraction-failed { background: var(--k-negative-wash); color: var(--k-negative); border: 2px solid currentColor; }
+/* Caution first: an artifact failure on the same source must win the tie and stay negative. */
 .inspector-posture.extraction-incomplete { background: var(--k-caution-wash); color: var(--k-caution); border: 2px solid currentColor; }
+.inspector-posture.digest-mismatch, .inspector-posture.artifact-unavailable, .inspector-posture.excerpt-mismatch, .inspector-posture.proposals-excluded { background: var(--k-negative-wash); color: var(--k-negative); border: 2px solid currentColor; }
+.inspector-posture.extraction-failed { background: var(--k-negative-wash); color: var(--k-negative); border: 2px solid currentColor; }
 .inspector-filters { display: flex; flex-wrap: wrap; gap: .6rem; margin: 1rem 0; }
 .inspector-filters label { display: grid; gap: .25rem; font-size: .75rem; color: var(--k-text-muted); }
 .inspector-filters select, .inspector-filters input { color: var(--k-text); background: var(--k-sunken); border: 1px solid var(--k-line); padding: .4rem; }
@@ -626,6 +627,12 @@ h1, h2, h3, p {
   font-size: 12px;
 }
 
+.excerpt-verification {
+  margin: 0;
+  font-size: 12px;
+  color: var(--k-muted);
+}
+
 /* decisions */
 
 /* The decision row is the point of the card, so it sits on its own line,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontourai/survey",
-  "version": "5.0.0",
+  "version": "6.0.0",
   "description": "Producer-side source, extraction, candidate, and review contracts for projecting verified claims into Surface.",
   "license": "Apache-2.0",
   "type": "module",