@slicedearth/whoisleuth-cli 2.2.0 → 2.4.0

package/packages/cases/case-record-core.mjs

@@ -1,7 +1,9 @@
 // Pure, framework-neutral analyst-case records, evidence histories, bounded
 // record normalization, and analyst updates.
-import { CASE_DISPOSITIONS, CASE_SCHEMA_VERSION, CASE_REVIEW_REASONS, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, EVIDENCE_SOURCES, MAX_DOMAIN_LENGTH, MAX_NOTES_PER_CASE, MAX_NOTE_LENGTH, MAX_TAGS_PER_CASE, MAX_TAG_LENGTH, } from "./case-record-contracts.mjs";
+import { CASE_REVIEW_REASONS, CASE_SOURCES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, EVIDENCE_SOURCES, MAX_DOMAIN_LENGTH, MAX_NOTES_PER_CASE, MAX_NOTE_LENGTH, MAX_TAGS_PER_CASE, MAX_TAG_LENGTH, } from "./case-record-contracts.mjs";
+import { dispositionLabel, isValidDisposition, isValidStatus, statusLabel, } from "./case-record-decisions.mjs";
 import { normalizeExplicitIsoTimestamp, normalizeLegacyIsoTimestamp } from "../evidence/observation.mjs";
+import { PUBLISHED_V2_3_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
 import { canonicalRegistrableDomain } from "../../lib/registrable-domain.mjs";
 // Forward-version policy (two distinct guarantees):
 //   - A locally-stored envelope that declares a version greater than this is
@@ -26,13 +28,9 @@ export const EVIDENCE_SOURCE_RANK = {
     import: 1,
     unknown: 0,
 };
-const STATUS_VALUES = new Set(CASE_STATUSES.map((item) => item.value));
-const DISPOSITION_VALUES = new Set(CASE_DISPOSITIONS.map((item) => item.value));
 const REVIEW_REASON_VALUES = new Set(CASE_REVIEW_REASONS.map((item) => item.value).filter(Boolean));
 const SOURCE_VALUES = new Set(CASE_SOURCES.map((item) => item.value));
-const STATUS_LABELS = Object.fromEntries(CASE_STATUSES.map((item) => [item.value, item.label]));
-const DISPOSITION_LABELS = Object.fromEntries(CASE_DISPOSITIONS.map((item) => [item.value, item.label]));
-const SOURCE_LABELS = Object.fromEntries(CASE_SOURCES.map((item) => [item.value, item.label]));
+const SOURCE_LABELS = new Map(CASE_SOURCES.map((item) => [item.value, item.label]));
 // Availability tokens that actually assert something about the domain. Anything
 // else ('unknown', 'error', empty) is not, on its own, material evidence.
 export const CONCLUSIVE_AVAILABILITY = new Set([
@@ -59,21 +57,13 @@ export function objectRecord(value) {
         ? value
         : {};
 }
-export function statusLabel(value) {
-    return (typeof value === 'string' ? STATUS_LABELS[value] : '') || String(value || '');
-}
-export function dispositionLabel(value) {
-    return (typeof value === 'string' ? DISPOSITION_LABELS[value] : '') || String(value || '');
-}
 export function sourceLabel(value) {
-    return (typeof value === 'string' ? SOURCE_LABELS[value] : '') || String(value || '');
-}
-export function isValidStatus(value) {
-    return typeof value === 'string' && STATUS_VALUES.has(value);
+    return isValidSource(value) ? SOURCE_LABELS.get(value) : String(value || '');
 }
-export function isValidDisposition(value) {
-    return typeof value === 'string' && DISPOSITION_VALUES.has(value);
+export function isValidSource(value) {
+    return typeof value === 'string' && SOURCE_VALUES.has(value);
 }
+export { dispositionLabel, isValidDisposition, isValidStatus, statusLabel, };
 /** Fresh, safe, effectively-unique id for a brand-new local record. */
 export function makeId() {
     if (typeof globalThis.crypto?.randomUUID === 'function')
@@ -147,16 +137,16 @@ export function normalizeEvidenceHostnameForCase(value, caseDomain) {
     return canonicalRegistrableDomain(hostname) === canonicalCase ? hostname : null;
 }
 export function normalizeStatus(value) {
-    return typeof value === 'string' && STATUS_VALUES.has(value) ? value : DEFAULT_STATUS;
+    return isValidStatus(value) ? value : DEFAULT_STATUS;
 }
 export function normalizeDisposition(value) {
-    return typeof value === 'string' && DISPOSITION_VALUES.has(value) ? value : DEFAULT_DISPOSITION;
+    return isValidDisposition(value) ? value : DEFAULT_DISPOSITION;
 }
 export function normalizeReviewReasonCode(value) {
     return typeof value === 'string' && REVIEW_REASON_VALUES.has(value) ? value : null;
 }
 export function normalizeSource(value) {
-    return typeof value === 'string' && SOURCE_VALUES.has(value) ? value : DEFAULT_SOURCE;
+    return isValidSource(value) ? value : DEFAULT_SOURCE;
 }
 /** Parsed ISO string, or null when missing/invalid (used for import ordering). */
 export function isoOrNull(value) {
@@ -174,7 +164,7 @@ export function caseTimestampOrNull(value, sourceVersion) {
         return explicit;
     return sourceVersion !== undefined
         && sourceVersion !== null
-        && sourceVersion < CASE_SCHEMA_VERSION
+        && sourceVersion < PUBLISHED_V2_3_CASE_SCHEMA_VERSION
         ? normalizeLegacyIsoTimestamp(value)
         : null;
 }

package/packages/cases/case-record-decisions.mjs

@@ -0,0 +1,72 @@
+// Lightweight canonical Case status and disposition definitions. Persistence,
+// portability and presentation consumers derive these identities and policies
+// without importing the wider Case record or serialisation graph.
+export const CASE_STATUSES = Object.freeze([
+    { value: 'new', label: 'New' },
+    { value: 'reviewing', label: 'Reviewing' },
+    { value: 'monitoring', label: 'Monitoring' },
+    { value: 'escalated', label: 'Escalated' },
+    { value: 'resolved', label: 'Resolved' },
+]);
+export const CASE_DISPOSITIONS = Object.freeze([
+    { value: 'unreviewed', label: 'Unreviewed' },
+    { value: 'suspicious', label: 'Suspicious' },
+    { value: 'confirmed_abuse', label: 'Confirmed abuse' },
+    { value: 'false_positive', label: 'False positive' },
+    { value: 'expected', label: 'Expected' },
+    { value: 'closed_no_action', label: 'Closed without action' },
+]);
+export const DEFAULT_STATUS = 'new';
+export const DEFAULT_DISPOSITION = 'unreviewed';
+const CASE_STATUS_OPERATION_POLICIES = Object.freeze({
+    new: { closed: false, closureRequired: false, directEdit: 'allowed' },
+    reviewing: { closed: false, closureRequired: false, directEdit: 'allowed' },
+    monitoring: { closed: false, closureRequired: false, directEdit: 'allowed' },
+    escalated: { closed: false, closureRequired: false, directEdit: 'allowed' },
+    resolved: { closed: true, closureRequired: true, directEdit: 'existing_only' },
+});
+const CASE_DISPOSITION_DECISION_POLICIES = Object.freeze({
+    unreviewed: { reviewed: false, supportsDefensiveResponse: false },
+    suspicious: { reviewed: true, supportsDefensiveResponse: true },
+    confirmed_abuse: { reviewed: true, supportsDefensiveResponse: true },
+    false_positive: { reviewed: true, supportsDefensiveResponse: false },
+    expected: { reviewed: true, supportsDefensiveResponse: false },
+    closed_no_action: { reviewed: true, supportsDefensiveResponse: false },
+});
+function statusOption(value) {
+    return CASE_STATUSES.find((option) => option.value === value);
+}
+function dispositionOption(value) {
+    return CASE_DISPOSITIONS.find((option) => option.value === value);
+}
+export function isValidStatus(value) {
+    return Boolean(statusOption(value));
+}
+export function isValidDisposition(value) {
+    return Boolean(dispositionOption(value));
+}
+export function statusLabel(value) {
+    return statusOption(value)?.label ?? String(value || '');
+}
+export function dispositionLabel(value) {
+    return dispositionOption(value)?.label ?? String(value || '');
+}
+export function caseStatusRequiresClosure(value) {
+    const option = statusOption(value);
+    return option ? CASE_STATUS_OPERATION_POLICIES[option.value].closureRequired : false;
+}
+export function caseStatusIsClosed(value) {
+    const option = statusOption(value);
+    return option ? CASE_STATUS_OPERATION_POLICIES[option.value].closed : false;
+}
+export function isReviewedCaseDisposition(value) {
+    const option = dispositionOption(value);
+    return option ? CASE_DISPOSITION_DECISION_POLICIES[option.value].reviewed : false;
+}
+export function caseDispositionSupportsDefensiveResponse(value) {
+    const option = dispositionOption(value);
+    return option ? CASE_DISPOSITION_DECISION_POLICIES[option.value].supportsDefensiveResponse : false;
+}
+export function caseStatusOptionsForDirectEdit(currentStatus) {
+    return CASE_STATUSES.filter((option) => (CASE_STATUS_OPERATION_POLICIES[option.value].directEdit === 'allowed' || option.value === currentStatus));
+}

package/packages/cases/case-record-model.mjs

@@ -6,4 +6,5 @@ export * from "./case-record-core.mjs";
 export * from "./case-brand-profile-references.mjs";
 export * from "./case-evidence-model.mjs";
 export * from "./case-record-operations.mjs";
+export * from "./case-record-projection.mjs";
 export * from "./case-investigation-branch-model.mjs";

package/packages/cases/case-record-operations.mjs

@@ -1,13 +1,20 @@
 // Pure, framework-neutral analyst-case records, evidence histories, bounded
 // record normalization, and analyst updates.
 import { canonicalRegistrableDomain } from "../../lib/registrable-domain.mjs";
+import { parseCredentialFreeHttpUrl } from "../evidence/lookup-target.mjs";
+import { selectExistingCase } from "./case-selection.mjs";
 import { appendCaseAction, appendCaseAssertion, appendCaseClosure, appendCaseDecision, appendCaseEvidencePin, appendCaseEvidencePins, appendCaseManualTrailEvent, appendCaseObservedEffectReview, appendCaseSighting, buildCaseClosureLinkContext, normalizeCaseActions, normalizeCaseAssertions, normalizeCaseClosureHistory, normalizeCaseDecisions, normalizeCaseEvidencePins, normalizeCaseManualTrail, normalizeCaseObservedEffectHistory, normalizeCaseSightings, updateCaseAction, updateCaseAssertion, } from "./case-response-model.mjs";
-import { CASE_SCHEMA_VERSION, MAX_CASES, MAX_NOTES_PER_CASE, } from "./case-record-contracts.mjs";
+import { MAX_CASES, MAX_NOTES_PER_CASE, } from "./case-record-contracts.mjs";
+import { PUBLISHED_V2_3_CASE_SCHEMA_VERSION, INCIDENT_CASE_SCHEMA_VERSION, MAX_CASE_OBJECTIVE_LENGTH } from "../contracts/case-portability.mjs";
+import { readCaseAttachments } from "./case-attachment-model.mjs";
+import { assertCurrentRecheckQuestion, assertRecheckNonReproduction, readCaseRecheckAnswerContext } from "./case-recheck-model.mjs";
+import { caseDispositionSupportsDefensiveResponse, caseStatusIsClosed, caseStatusOptionsForDirectEdit, caseStatusRequiresClosure, isReviewedCaseDisposition, } from "./case-record-decisions.mjs";
 import { DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_SET, caseTimestampOrNull, deterministicId, makeId, normalizeDisposition, normalizeDomain, normalizeNoteBody, normalizeReviewReasonCode, normalizeNotes, normalizeSource, normalizeStatus, normalizeTags, objectRecord, safeId, } from "./case-record-core.mjs";
 import { assertCaseBrandProfileIds, normalizeCaseBrandProfileIds, } from "./case-brand-profile-references.mjs";
 import { normalizeEvidenceHistory, } from "./case-evidence-model.mjs";
 import { appendCaseInvestigationBranch, caseInvestigationBranchReferences, normalizeCaseInvestigationBranches, updateCaseInvestigationBranch, } from "./case-investigation-branch-model.mjs";
-export const MAX_CASE_OBJECTIVE_LENGTH = 320;
+export { caseDispositionSupportsDefensiveResponse, caseStatusIsClosed, caseStatusOptionsForDirectEdit, caseStatusRequiresClosure, isReviewedCaseDisposition, };
+export { MAX_CASE_OBJECTIVE_LENGTH };
 export const MAX_CASE_INCIDENT_URL_LENGTH = 1_850;
 export const INCIDENT_CONTEXT_STATEMENT_PREFIX = 'Investigate incident URL: ';
 const OBJECTIVE_PREFIX = 'Objective: ';
@@ -21,18 +28,8 @@ export function normalizeCaseObjective(value) {
     return boundedContextText(value, MAX_CASE_OBJECTIVE_LENGTH);
 }
 export function parseIncidentUrlContext(value) {
-    if (typeof value !== 'string' || !value || value.length > MAX_CASE_INCIDENT_URL_LENGTH)
-        return null;
-    if (/[\u0000-\u001f\u007f]/u.test(value) || value.trim() !== value)
-        return null;
-    let parsed;
-    try {
-        parsed = new URL(value);
-    }
-    catch {
-        return null;
-    }
-    if (!['http:', 'https:'].includes(parsed.protocol) || parsed.username || parsed.password || !parsed.hostname)
+    const parsed = parseCredentialFreeHttpUrl(value, MAX_CASE_INCIDENT_URL_LENGTH);
+    if (!parsed)
         return null;
     const hostname = parsed.hostname.toLowerCase().replace(/\.$/u, '');
     const registrableDomain = canonicalRegistrableDomain(hostname);
@@ -140,7 +137,7 @@ export function normalizeCase(raw, existing, nowIso, sourceVersion) {
     const createdAt = existing ? existing.createdAt : caseTimestampOrNull(record.createdAt, sourceVersion) || now;
     const updatedAt = caseTimestampOrNull(record.updatedAt, sourceVersion) || createdAt;
     const timestampOptions = {
-        legacyTimestamps: sourceVersion != null && sourceVersion < CASE_SCHEMA_VERSION,
+        legacyTimestamps: sourceVersion != null && sourceVersion < PUBLISHED_V2_3_CASE_SCHEMA_VERSION,
         ...(sourceVersion === undefined ? {} : { sourceVersion }),
     };
     const evidencePins = normalizeCaseEvidencePins(record.evidencePins, updatedAt, timestampOptions);
@@ -153,10 +150,12 @@ export function normalizeCase(raw, existing, nowIso, sourceVersion) {
     const closures = normalizeCaseClosureHistory(sourceVersion != null && sourceVersion < 13 ? undefined : record.closures, updatedAt, new Set(observedEffects.reviews.map((item) => item.id)), new Set(actions.map((item) => item.id)), timestampOptions, buildCaseClosureLinkContext(observedEffects, actions));
     const normalizedStatus = normalizeStatus(record.status);
     const branchReferences = caseInvestigationBranchReferences({ evidencePins, actions, assertions });
+    const attachments = readCaseAttachments(record.attachments);
     return {
         id: existing ? existing.id : safeId(record.id) || deterministicId(domain),
         domain,
-        status: normalizedStatus === 'resolved'
+        title: sourceVersion != null && sourceVersion < INCIDENT_CASE_SCHEMA_VERSION ? '' : normalizeCaseObjective(record.title),
+        status: caseStatusRequiresClosure(normalizedStatus)
             && closures.records.length === 0 && !closures.preV13HistoryUnavailable
             ? 'reviewing'
             : normalizedStatus,
@@ -176,6 +175,7 @@ export function normalizeCase(raw, existing, nowIso, sourceVersion) {
         observedEffects,
         closures,
         branches: normalizeCaseInvestigationBranches(record.branches, updatedAt, branchReferences, timestampOptions),
+        ...(attachments === undefined ? {} : { attachments }),
         createdAt,
         updatedAt,
     };
@@ -211,15 +211,22 @@ export function createCase(input, nowIso) {
     const observedEffects = input.observedEffectReview !== undefined
         ? appendCaseObservedEffectReview(normalizeCaseObservedEffectHistory(undefined, now), input.observedEffectReview, now, pinIds, new Set(sightings.map((item) => item.id)))
         : normalizeCaseObservedEffectHistory(undefined, now);
+    for (const review of observedEffects.reviews) {
+        if (!review.recheck)
+            continue;
+        assertCurrentRecheckQuestion(review.recheck, assertions);
+        assertRecheckNonReproduction(review.state, review.recheck, review.completeness, evidencePins, evidencePins.find(pin => pin.id === review.evidencePinId), review.observedAt);
+    }
     const closures = input.closure !== undefined
         ? appendCaseClosure(normalizeCaseClosureHistory(undefined, now), input.closure, now, observedEffects, actions)
         : normalizeCaseClosureHistory(undefined, now);
-    if (normalizeStatus(input.status) === 'resolved' && input.closure === undefined) {
+    if (caseStatusRequiresClosure(normalizeStatus(input.status)) && input.closure === undefined) {
         throw new Error('Opening a resolved case requires a deliberate closure reason and its linked review context.');
     }
     return {
         id: makeId(),
         domain,
+        title: normalizeCaseObjective(input.title),
         status: input.closure !== undefined ? 'resolved' : normalizeStatus(input.status),
         disposition: normalizeDisposition(input.disposition),
         reviewReasonCode: normalizeReviewReasonCode(input.reviewReasonCode),
@@ -252,25 +259,46 @@ export function createCase(input, nowIso) {
     };
 }
 /**
- * Opens the existing case for a domain, or creates one. Returns a new array
+ * Opens an explicitly selected or unambiguous Case, or creates one. Returns a new array
  * (callers persist it) plus the resolved record and whether it was created.
  * @param {CaseRecord[]} cases
  * @param {{ domain: unknown, status?: unknown, disposition?: unknown, source?: unknown, tags?: unknown, evidence?: unknown, note?: unknown }} input
  * @param {string} [nowIso]
  * @returns {{ cases: CaseRecord[], record: CaseRecord, created: boolean }}
  */
-export function openOrCreateCase(cases, input, nowIso) {
+export function openOrCreateCase(cases, input, nowIso, selection = {}) {
     const domain = normalizeDomain(input.domain);
     if (!domain)
         throw new Error('A valid domain is required to open a case.');
-    const existing = cases.find((item) => item.domain === domain);
+    const existing = selectExistingCase(cases, domain, selection);
     if (existing)
         return { cases, record: existing, created: false };
     if (cases.length >= MAX_CASES)
         throw new Error(`Cases are limited to ${MAX_CASES}. Delete or export some first.`);
     const record = createCase({ ...input, domain }, nowIso);
+    if (cases.some(existingCase => existingCase.id === record.id))
+        throw new Error('A unique Case ID could not be allocated. No data was changed; try again.');
     return { cases: [record, ...cases], record, created: true };
 }
+/** Start a separate incident; reuse only the deliberately selected observation. */
+export function createCaseIncident(cases, input, nowIso) {
+    const domain = normalizeDomain(input.domain);
+    const title = normalizeCaseObjective(input.title);
+    if (!domain)
+        throw new Error('Enter a valid domain for the incident.');
+    if (!title)
+        throw new Error('Enter a title that distinguishes this incident.');
+    if (typeof input.title === 'string' && input.title.trim().length > MAX_CASE_OBJECTIVE_LENGTH)
+        throw new Error(`Incident titles are limited to ${MAX_CASE_OBJECTIVE_LENGTH} characters.`);
+    let evidence;
+    if (input.reuse) {
+        const source = cases.find(record => record.id === input.reuse?.caseId && record.domain === domain);
+        evidence = source?.evidenceHistory.find(snapshot => snapshot.id === input.reuse?.snapshotId);
+        if (!evidence)
+            throw new Error('The selected source observation is no longer available for this domain. No Case was created.');
+    }
+    return openOrCreateCase(cases, { domain, title, ...(evidence ? { evidence: structuredClone(evidence) } : {}) }, nowIso, { newIncident: true });
+}
 /**
  * Applies a partial update to one case by id, bumping updatedAt. A `note` in
  * the patch is appended (respecting the per-case note bound); a `tags` array
@@ -291,6 +319,9 @@ export function updateCase(cases, id, patch, nowIso) {
     const current = cases[index];
     if (!current)
         throw new Error('That case no longer exists.');
+    if (patch.title !== undefined && patch.expectedTitle !== undefined && patch.expectedTitle !== (current.title ?? '')) {
+        throw new Error('The incident title changed after this draft was started. Reload and review the current title before saving; your draft has not been applied.');
+    }
     let notes = current.notes;
     if (patch.note !== undefined) {
         const body = normalizeNoteBody(patch.note);
@@ -350,17 +381,24 @@ export function updateCase(cases, id, patch, nowIso) {
     }
     let observedEffects = normalizeCaseObservedEffectHistory(current.observedEffects, current.updatedAt, pinIds, new Set(sightings.map((item) => item.id)));
     if (patch.observedEffectReview !== undefined) {
+        const review = objectRecord(patch.observedEffectReview);
+        const context = readCaseRecheckAnswerContext(review.recheck);
+        if (context) {
+            assertCurrentRecheckQuestion(context, assertions);
+            assertRecheckNonReproduction(review.state, context, String(review.completeness), evidencePins, evidencePins.find(pin => pin.id === review.evidencePinId), typeof review.observedAt === 'string' ? review.observedAt : null);
+        }
         observedEffects = appendCaseObservedEffectReview(observedEffects, patch.observedEffectReview, now, pinIds, new Set(sightings.map((item) => item.id)));
     }
     let closures = normalizeCaseClosureHistory(current.closures, current.updatedAt, new Set(observedEffects.reviews.map((item) => item.id)), new Set(actions.map((item) => item.id)), {}, buildCaseClosureLinkContext(observedEffects, actions));
     if (patch.closure !== undefined) {
         closures = appendCaseClosure(closures, patch.closure, now, observedEffects, actions);
     }
-    if (patch.status === 'resolved' && patch.closure === undefined) {
+    if (caseStatusRequiresClosure(patch.status) && patch.closure === undefined) {
         throw new Error('Resolve this case through the deliberate closure review so the reason and evidence state remain explicit.');
     }
     const record = {
         ...current,
+        title: patch.title === undefined ? current.title ?? '' : normalizeCaseObjective(patch.title),
         status: patch.closure !== undefined
             ? 'resolved'
             : patch.status !== undefined ? normalizeStatus(patch.status) : current.status,
@@ -392,8 +430,8 @@ export function updateCase(cases, id, patch, nowIso) {
 }
 /**
  * Records one reviewed conclusion as a single pure Case mutation. The selected
- * observations become bounded Case pins before the decision is created, so the
- * decision cannot point at absent evidence. Counterevidence is retained as a
+ * observations become bounded Case pins or reference existing retained pins,
+ * so the decision cannot point at absent evidence. Counterevidence is retained as a
  * separate resolved contradiction assertion rather than being hidden inside a
  * favourable disposition.
  */
@@ -401,7 +439,7 @@ export function recordCaseConclusion(cases, id, input, nowIso) {
     const now = caseTimestampOrNull(nowIso) || new Date().toISOString();
     const disposition = normalizeDisposition(input.disposition);
     const reviewReasonCode = normalizeReviewReasonCode(input.reviewReasonCode);
-    if (disposition === 'unreviewed') {
+    if (!isReviewedCaseDisposition(disposition)) {
         throw new Error('Select a reviewed disposition before recording a conclusion.');
     }
     if (!reviewReasonCode) {
@@ -420,14 +458,36 @@ export function recordCaseConclusion(cases, id, input, nowIso) {
     if (!current)
         throw new Error('That case no longer exists.');
     const existingPinIds = new Set(current.evidencePins.map((pin) => pin.id));
-    const withPins = updateCase(cases, id, {
-        evidencePins: input.evidence.map((item) => item.pin),
-    }, now);
+    const selectedExisting = new Set();
+    for (const item of input.evidence) {
+        if (Object.hasOwn(item, 'pin') === Object.hasOwn(item, 'pinId'))
+            throw new Error('Select one new pin or one retained pin ID for each conclusion fact.');
+        if (Object.hasOwn(item, 'pinId')) {
+            if (typeof item.pinId !== 'string' || !existingPinIds.has(item.pinId))
+                throw new Error('The selected conclusion pin is no longer retained in this Case.');
+            if (selectedExisting.has(item.pinId))
+                throw new Error('Select each retained conclusion pin once.');
+            selectedExisting.add(item.pinId);
+        }
+    }
+    const newEvidence = input.evidence.filter(item => Object.hasOwn(item, 'pin'));
+    const withPins = newEvidence.length
+        ? updateCase(cases, id, { evidencePins: newEvidence.map(item => item.pin) }, now)
+        : { cases, record: current };
     const addedPins = withPins.record.evidencePins.filter((pin) => !existingPinIds.has(pin.id));
-    if (addedPins.length !== input.evidence.length) {
+    if (addedPins.length !== newEvidence.length) {
         throw new Error('The selected conclusion evidence could not be retained completely.');
     }
-    const supportingPinIds = addedPins.flatMap((pin, index) => (input.evidence[index]?.stance === 'supports' ? [pin.id] : []));
+    let nextAdded = 0;
+    const selectedPins = input.evidence.map(item => {
+        const pin = Object.hasOwn(item, 'pinId')
+            ? withPins.record.evidencePins.find(pin => pin.id === item.pinId)
+            : addedPins[nextAdded++];
+        if (!pin)
+            throw new Error('The selected conclusion evidence could not be retained completely.');
+        return pin;
+    });
+    const supportingPinIds = selectedPins.flatMap((pin, index) => (input.evidence[index]?.stance === 'supports' ? [pin.id] : []));
     let concluded = updateCase(withPins.cases, id, {
         disposition,
         reviewReasonCode,
@@ -437,7 +497,7 @@ export function recordCaseConclusion(cases, id, input, nowIso) {
             evidencePinIds: supportingPinIds,
         },
     }, now);
-    const contradictionRelations = addedPins.flatMap((pin, index) => (input.evidence[index]?.stance === 'contradicts'
+    const contradictionRelations = selectedPins.flatMap((pin, index) => (input.evidence[index]?.stance === 'contradicts'
         ? [{ evidencePinId: pin.id, stance: 'contradicts' }]
         : []));
     if (contradictionRelations.length) {
@@ -452,7 +512,7 @@ export function recordCaseConclusion(cases, id, input, nowIso) {
             },
         }, now);
     }
-    const unresolvedRelations = addedPins.flatMap((pin, index) => (input.evidence[index]?.stance === 'unresolved'
+    const unresolvedRelations = selectedPins.flatMap((pin, index) => (input.evidence[index]?.stance === 'unresolved'
         ? [{ evidencePinId: pin.id, stance: 'unresolved' }]
         : []));
     if (unresolvedRelations.length) {
@@ -503,6 +563,8 @@ export function recordCaseRecheckOutcome(cases, id, input, nowIso) {
     const current = cases.find((item) => item.id === id);
     if (!current)
         throw new Error('That case no longer exists.');
+    if (input.recheck && input.observationHostname !== input.recheck.targetHostname)
+        throw new Error('This recheck concerns a different or unknown hostname. Recollect the saved question target before recording its answer.');
     const beforePinIds = new Set(current.evidencePins.map((pin) => pin.id));
     const withPin = updateCase(cases, id, {
         evidencePin: {
@@ -514,6 +576,7 @@ export function recordCaseRecheckOutcome(cases, id, input, nowIso) {
             sourceState: 'reviewed',
             observedAt: input.observedAt,
             collectionDepth: input.collectionDepth,
+            observationHostname: input.observationHostname,
             completeness: input.completeness,
             truncated: false,
             limitations: input.limitations,
@@ -532,6 +595,7 @@ export function recordCaseRecheckOutcome(cases, id, input, nowIso) {
             evidencePinId: comparisonPin.id,
             followUpAt: input.followUpAt,
             limitations: input.limitations,
+            ...(input.recheck ? { recheck: input.recheck } : {}),
         },
     }, now);
 }