@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/packages/cases/case-evidence-links.mjs

@@ -0,0 +1,135 @@
+import { array, enumeration, exact, exactOptional, iso, text } from "../evidence/artifact-structure.mjs";
+import { assertWorkspaceInputGraph } from "../workspace/hostile-input.mjs";
+import { MAX_CASE_EVIDENCE_PINS, MAX_RESPONSE_RATIONALE_LENGTH } from "../contracts/case-portability.mjs";
+import { SAFE_ID_RE, freshId } from "./case-response-values.mjs";
+export const CASE_EVIDENCE_LINK_KINDS = ['derived_from', 'shared_source'];
+/** Enough for both directed relationships between every admitted pin pair. */
+export const MAX_CASE_EVIDENCE_LINKS = MAX_CASE_EVIDENCE_PINS * (MAX_CASE_EVIDENCE_PINS - 1) * CASE_EVIDENCE_LINK_KINDS.length;
+function identifier(value) {
+    const id = text(value, 'Evidence link identity', 64);
+    if (!SAFE_ID_RE.test(id))
+        throw new TypeError('Evidence link identity is invalid.');
+    return id;
+}
+function explanation(value) {
+    const result = text(value, 'Evidence relationship basis', MAX_RESPONSE_RATIONALE_LENGTH).trim();
+    if (!result)
+        throw new TypeError('Explain the evidence relationship.');
+    return result;
+}
+export function readCaseEvidenceLinks(value) {
+    if (value === undefined)
+        return undefined;
+    assertWorkspaceInputGraph(value, 'Evidence relationships');
+    const links = array(value, 'Evidence relationships', MAX_CASE_EVIDENCE_LINKS).map(raw => {
+        const row = exactOptional(raw, ['id', 'fromPinId', 'toPinId', 'kind', 'basis', 'createdAt'], ['withdrawal'], 'Evidence relationship');
+        const fromPinId = identifier(row.fromPinId), toPinId = identifier(row.toPinId);
+        if (fromPinId === toPinId)
+            throw new TypeError('An evidence pin cannot derive from or share a source with itself.');
+        iso(row.createdAt, 'Relationship recording time');
+        let withdrawal;
+        if (row.withdrawal !== undefined) {
+            const item = exact(row.withdrawal, ['at', 'reason'], 'Relationship withdrawal');
+            iso(item.at, 'Withdrawal time');
+            if (Date.parse(item.at) < Date.parse(row.createdAt))
+                throw new TypeError('Withdrawal precedes the relationship.');
+            withdrawal = { at: item.at, reason: explanation(item.reason) };
+        }
+        return { id: identifier(row.id), fromPinId, toPinId,
+            kind: enumeration(row.kind, CASE_EVIDENCE_LINK_KINDS, 'Evidence relationship kind'),
+            basis: explanation(row.basis), createdAt: row.createdAt, ...(withdrawal ? { withdrawal } : {}) };
+    });
+    if (new Set(links.map(link => link.id)).size !== links.length)
+        throw new TypeError('Evidence relationship identities must be unique.');
+    return links;
+}
+function derivationGraph(links) {
+    const graph = new Map();
+    for (const link of links)
+        if (!link.withdrawal && link.kind === 'derived_from') {
+            const neighbours = graph.get(link.fromPinId) ?? [];
+            neighbours.push(link.toPinId);
+            graph.set(link.fromPinId, neighbours);
+        }
+    return graph;
+}
+function reaches(graph, from, to) {
+    const pending = [from], visited = new Set();
+    while (pending.length) {
+        const id = pending.pop();
+        if (id === to)
+            return true;
+        if (visited.has(id))
+            continue;
+        visited.add(id);
+        pending.push(...(graph.get(id) ?? []));
+    }
+    return false;
+}
+export function appendCaseEvidenceLink(current, input, pins, now) {
+    const row = exact(input, ['fromPinId', 'toPinId', 'kind', 'basis'], 'New evidence relationship');
+    const link = readCaseEvidenceLinks([{ ...row, id: freshId('evidence-link'), createdAt: now }])[0];
+    const ids = new Set(pins.map(pin => pin.id));
+    if (!ids.has(link.fromPinId) || !ids.has(link.toPinId))
+        throw new TypeError('Select two retained evidence pins.');
+    if (current.some(item => !item.withdrawal && item.kind === link.kind
+        && ((item.fromPinId === link.fromPinId && item.toPinId === link.toPinId)
+            || (link.kind === 'shared_source' && item.fromPinId === link.toPinId && item.toPinId === link.fromPinId)))) {
+        throw new TypeError('This evidence relationship is already recorded. Withdraw it before recording a replacement.');
+    }
+    if (link.kind === 'derived_from' && reaches(derivationGraph(current), link.toPinId, link.fromPinId))
+        throw new TypeError('This derivation would create a cycle. Review the existing links first.');
+    return readCaseEvidenceLinks([...current, link]);
+}
+export function withdrawCaseEvidenceLink(current, input, now) {
+    const row = exact(input, ['id', 'reason'], 'Evidence relationship withdrawal');
+    const id = identifier(row.id), existing = current.find(link => link.id === id);
+    if (!existing || existing.withdrawal)
+        throw new TypeError('This relationship is missing or already withdrawn. Refresh before reviewing it.');
+    return readCaseEvidenceLinks(current.map(link => link.id === id ? { ...link, withdrawal: { at: now, reason: explanation(row.reason) } } : link));
+}
+/** Keep unresolved references; an imported pin can have been omitted by its source. */
+export function mergeCaseEvidenceLinks(local, incoming) {
+    if (local === undefined && incoming === undefined)
+        return undefined;
+    const merged = new Map((readCaseEvidenceLinks(local) ?? []).map(link => [link.id, link]));
+    for (const link of readCaseEvidenceLinks(incoming) ?? []) {
+        const existing = merged.get(link.id);
+        if (!existing) {
+            merged.set(link.id, link);
+            continue;
+        }
+        const { withdrawal: left, ...a } = existing, { withdrawal: right, ...b } = link;
+        if (JSON.stringify(a) !== JSON.stringify(b) || (left && right && JSON.stringify(left) !== JSON.stringify(right))) {
+            throw new TypeError('An imported evidence relationship conflicts with retained provenance. No relationship was overwritten.');
+        }
+        merged.set(link.id, { ...a, ...((left ?? right) ? { withdrawal: left ?? right } : {}) });
+    }
+    return readCaseEvidenceLinks([...merged.values()].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+}
+export function caseEvidenceLinkIssues(links, pins) {
+    const ids = new Set(pins.map(pin => pin.id));
+    const graph = derivationGraph(links);
+    return links.map(link => ({ link,
+        missingPinIds: [link.fromPinId, link.toPinId].filter(id => !ids.has(id)),
+        cyclic: !link.withdrawal && link.kind === 'derived_from' && reaches(graph, link.toPinId, link.fromPinId),
+    }));
+}
+/** Matching context is disclosed, never counted as independent corroboration. */
+export function caseEvidenceSharedContext(pins) {
+    const groups = new Map();
+    function add(kind, identity, label, id) {
+        if (!identity?.trim())
+            return;
+        const key = JSON.stringify([kind, identity]);
+        const group = groups.get(key) ?? { kind, label, pinIds: [] };
+        group.pinIds.push(id);
+        groups.set(key, group);
+    }
+    for (const pin of pins) {
+        add('checkpoint', pin.checkpointId, 'Same collection checkpoint', pin.id);
+        add('import', pin.importContentSha256, 'Same imported content', pin.id);
+        add('source', pin.source, `Same declared source: ${pin.source}`, pin.id);
+    }
+    return [...groups.values()].filter(group => group.pinIds.length > 1);
+}

package/packages/cases/case-evidence-model.mjs

@@ -1,8 +1,13 @@
 // Pure, framework-neutral analyst-case records, evidence histories, bounded
 // record normalization, and analyst updates.
-import { normalizeHttpSummary } from "./http-summary.mjs";
-import { normalizeOpportunityModelVersion } from "../../lib/opportunity-scoring.mjs";
-import { normalizeRiskModelVersion } from "../../lib/risk-scoring.mjs";
+import { httpSummaryFieldIsObserved, normalizeHttpSummary } from "./http-summary.mjs";
+import { normalizeOpportunityModelVersion } from "../analysis/opportunity-scoring.mjs";
+import { normalizeRiskModelVersion } from "../analysis/risk-scoring.mjs";
+import { latestObservationCohort } from "../evidence/latest-observations.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { validWebObservationMode } from "../evidence/lookup-target.mjs";
+import { normalizeWebCollectionQuality, webCollectionAllowsComparison } from "../evidence/collection-quality.mjs";
 import { MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, } from "./case-record-contracts.mjs";
 import { CONCLUSIVE_AVAILABILITY, DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_RANK, EVIDENCE_SOURCE_SET, REGISTERED_LIKE, caseTimestampOrNull, hashString, isoOrNull, normalizeEvidenceHostnameForCase, objectRecord, safeId, } from "./case-record-core.mjs";
 function evidenceString(value, max = MAX_EVIDENCE_STRING_LENGTH) {
@@ -24,7 +29,10 @@ function boolOrNull(value) {
 // are deduplicated and the result is sorted deterministically (largest
 // contribution first, then label) so input order alone can never change a
 // snapshot's fingerprint and two equal factor sets in different order collapse.
-function normalizeFactors(value) {
+function compareFactors(a, b) {
+    return b.points - a.points || (a.label < b.label ? -1 : a.label > b.label ? 1 : 0);
+}
+function normalizeFactors(value, legacyOrder = false) {
     if (!Array.isArray(value))
         return [];
     const seen = new Set();
@@ -45,7 +53,7 @@ function normalizeFactors(value) {
         seen.add(key);
         out.push({ label, points });
     }
-    out.sort((a, b) => b.points - a.points || a.label.localeCompare(b.label));
+    out.sort(legacyOrder ? (a, b) => b.points - a.points || a.label.localeCompare(b.label) : compareFactors);
     return out.slice(0, MAX_EVIDENCE_FACTORS);
 }
 // Case-insensitive, terminal-dot-stripped, deduplicated and sorted so a
@@ -112,7 +120,10 @@ const DEEP_SIGNAL_FIELDS = [
 // another. Deterministic ordering here is what makes the fingerprint stable.
 const MATERIAL_FIELD_ORDER = [
     'inputHostname',
+    'observationHostname',
+    'webObservationMode',
     'scanDepth',
+    'webCollectionQuality',
     'availability', 'confidence', 'riskModelVersion', 'riskScore', 'opportunityModelVersion', 'opportunityScore',
     'riskFactors', 'opportunityFactors',
     'registrar', 'createdDate', 'expiryDate', 'nameservers',
@@ -128,7 +139,7 @@ const MATERIAL_FIELD_ORDER = [
 // The canonical, comparison-safe value of a material field. Registrar casing,
 // nameserver order, and sub-day timestamps are collapsed so they can never
 // count as a "change"; a non-conclusive availability contributes nothing.
-function materialValue(field, snapshot) {
+function materialValue(field, snapshot, legacyOrder = false) {
     switch (field) {
         case 'availability':
             return typeof snapshot.availability === 'string' && CONCLUSIVE_AVAILABILITY.has(snapshot.availability)
@@ -147,9 +158,9 @@ function materialValue(field, snapshot) {
         case 'mutationTypes':
             return snapshot.mutationTypes;
         case 'riskFactors':
-            return snapshot.riskFactors.map((factor) => [factor.label, factor.points]);
+            return (legacyOrder ? snapshot.riskFactors : [...snapshot.riskFactors].sort(compareFactors)).map((factor) => [factor.label, factor.points]);
         case 'opportunityFactors':
-            return snapshot.opportunityFactors.map((factor) => [factor.label, factor.points]);
+            return (legacyOrder ? snapshot.opportunityFactors : [...snapshot.opportunityFactors].sort(compareFactors)).map((factor) => [factor.label, factor.points]);
         default:
             return snapshot[field] ?? null;
     }
@@ -165,7 +176,7 @@ function isEmptyMaterial(value) {
 }
 // Fields that describe the capture rather than assert evidence, so they never
 // on their own keep an otherwise-empty snapshot alive.
-const NON_EVIDENCE_MATERIAL = new Set(['inputHostname', 'scanDepth', 'confidence']);
+const NON_EVIDENCE_MATERIAL = new Set(['inputHostname', 'observationHostname', 'webObservationMode', 'scanDepth', 'webCollectionQuality', 'confidence']);
 // A snapshot with no material evidence (only timestamps/source/depth, or only a
 // bare confidence/unknown-availability) is dropped rather than added to a
 // timeline.
@@ -179,14 +190,13 @@ function hasMaterialEvidence(snapshot) {
     return false;
 }
 // Deterministic string form of the material identity, keys in fixed order.
-function canonicalMaterialString(snapshot) {
+function canonicalMaterialString(snapshot, legacyOrder = false) {
     const canonical = {};
     for (const field of MATERIAL_FIELD_ORDER) {
-        const value = materialValue(field, snapshot);
-        // Preserve historical fingerprints when the new v14 observation-context
-        // field is absent. A retained hostname is still material and therefore
-        // separates otherwise-identical captures.
-        if (field === 'inputHostname' && value === null)
+        const value = materialValue(field, snapshot, legacyOrder);
+        // Optional collection context does not alter historical fingerprints when
+        // absent; recorded context separates otherwise-identical captures.
+        if ((field === 'inputHostname' || field === 'observationHostname' || field === 'webObservationMode' || field === 'webCollectionQuality') && value === null)
             continue;
         canonical[field] = value;
     }
@@ -213,23 +223,46 @@ function buildSnapshot(raw, options) {
     if (!raw || typeof raw !== 'object')
         return null;
     const record = objectRecord(raw);
+    if (record.factorOrder !== undefined && record.factorOrder !== 'code-unit-v1')
+        return null;
+    const historicalSchema = options.sourceVersion !== undefined && Number(options.sourceVersion) <= PUBLISHED_V2_3_CASE_SCHEMA_VERSION;
+    if (historicalSchema && record.factorOrder !== undefined)
+        return null;
+    // Fieldless retained snapshots keep their original identity algorithm. New
+    // captures declare code-unit ordering; the declaration survives every save.
+    const legacyOrder = historicalSchema || (record.factorOrder === undefined && typeof record.fingerprint === 'string');
     const scanDepth = normalizeScanDepth(record.scanDepth);
     const httpSummary = normalizeHttpSummary(record);
+    const webCollectionQuality = normalizeWebCollectionQuality(record.webCollectionQuality, scanDepth);
+    if (webCollectionQuality && options.sourceVersion != null && options.sourceVersion < EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION) {
+        throw new TypeError('Web collection quality requires Case schema 17 or later; historical evidence was not reinterpreted.');
+    }
     const acceptsProfileContext = options.sourceVersion === undefined || Number(options.sourceVersion) >= 12;
     const acceptsInputHostname = options.sourceVersion === undefined || Number(options.sourceVersion) >= 13;
+    const acceptsObservationHostname = options.sourceVersion === undefined || Number(options.sourceVersion) > PUBLISHED_V2_3_CASE_SCHEMA_VERSION;
+    const observationHostname = acceptsObservationHostname
+        ? normalizeEvidenceHostnameForCase(record.observationHostname, options.caseDomain)
+        : null;
+    if (acceptsObservationHostname && record.observationHostname != null && !observationHostname)
+        return null;
+    if (acceptsObservationHostname && !validWebObservationMode(record.webObservationMode))
+        return null;
     const fields = {
         inputHostname: acceptsInputHostname
             ? normalizeEvidenceHostnameForCase(record.inputHostname, options.caseDomain)
             : null,
+        ...(observationHostname ? { observationHostname } : {}),
+        ...(acceptsObservationHostname && scanDepth !== 'fast' && record.webObservationMode === 'selected_url' ? { webObservationMode: record.webObservationMode } : {}),
         scanDepth,
+        ...(webCollectionQuality ? { webCollectionQuality } : {}),
         availability: evidenceString(record.availability),
         confidence: evidenceString(record.confidence),
         riskModelVersion: normalizeRiskModelVersion(record.riskModelVersion),
         riskScore: clampScore(record.riskScore),
         opportunityModelVersion: normalizeOpportunityModelVersion(record.opportunityModelVersion),
         opportunityScore: clampScore(record.opportunityScore),
-        riskFactors: normalizeFactors(record.riskFactors),
-        opportunityFactors: normalizeFactors(record.opportunityFactors),
+        riskFactors: normalizeFactors(record.riskFactors, legacyOrder),
+        opportunityFactors: normalizeFactors(record.opportunityFactors, legacyOrder),
         registrar: evidenceString(record.registrar),
         createdDate: lifecycleTimestamp(record.createdDate, options.sourceVersion),
         expiryDate: lifecycleTimestamp(record.expiryDate, options.sourceVersion),
@@ -274,6 +307,12 @@ function buildSnapshot(raw, options) {
         fields.riskModelVersion = null;
     if (fields.opportunityScore === null && fields.opportunityFactors.length === 0)
         fields.opportunityModelVersion = null;
+    if (webCollectionQuality) {
+        for (const field of ['hasPasswordField', 'hasExternalFormAction', 'pageBaselineMatch', 'faviconMatch', 'faviconNearMatch', 'reusesOfficialAssets']) {
+            if (fields[field] === false && !webCollectionAllowsComparison(field, webCollectionQuality, scanDepth))
+                fields[field] = null;
+        }
+    }
     // A fast capture never evaluates the deep signals, so any value supplied for
     // them (e.g. a profile's default `false`) is discarded as unevaluated.
     if (scanDepth === 'fast') {
@@ -317,10 +356,11 @@ function buildSnapshot(raw, options) {
             ? options.source
             : DEFAULT_EVIDENCE_SOURCE;
     const material = canonicalMaterialString(fields);
-    const fingerprint = hashString(material);
+    const fingerprint = hashString(legacyOrder ? canonicalMaterialString(fields, true) : material);
     const snapshot = {
         id: `ev-${fingerprint}`,
         fingerprint,
+        ...(!legacyOrder ? { factorOrder: 'code-unit-v1' } : {}),
         firstCapturedAt,
         capturedAt,
         source,
@@ -356,7 +396,10 @@ function mergeDuplicateSnapshots(kept, incoming) {
         ? incoming.capturedAt
         : kept.capturedAt;
     const source = chooseSource(kept, incoming);
-    return { ...kept, firstCapturedAt, capturedAt, source };
+    // Preserve an existing historical identifier when a new capture contains
+    // the same evidence under the newer ordering declaration.
+    const base = kept.factorOrder && !incoming.factorOrder ? incoming : kept;
+    return { ...base, firstCapturedAt, capturedAt, source };
 }
 function compareSnapshotChrono(a, b) {
     return (Date.parse(a.capturedAt) - Date.parse(b.capturedAt) ||
@@ -374,6 +417,11 @@ function compareSnapshotChrono(a, b) {
  * @returns {CaseEvidenceSnapshot[]}
  */
 export function normalizeEvidenceHistory(rawList, options = {}) {
+    const ordered = [...evidenceByMaterial(rawList, options).values()].sort(compareSnapshotChrono);
+    const kept = ordered.slice(Math.max(0, ordered.length - MAX_EVIDENCE_SNAPSHOTS_PER_CASE));
+    return assignUniqueSnapshotIds(kept);
+}
+function evidenceByMaterial(rawList, options) {
     const list = Array.isArray(rawList) ? rawList : [];
     const byMaterial = new Map();
     for (const raw of list) {
@@ -385,9 +433,24 @@ export function normalizeEvidenceHistory(rawList, options = {}) {
         // collision can never merge two genuinely different snapshots.
         byMaterial.set(built.material, existing ? mergeDuplicateSnapshots(existing, built.snapshot) : built.snapshot);
     }
-    const ordered = [...byMaterial.values()].sort(compareSnapshotChrono);
-    const kept = ordered.slice(Math.max(0, ordered.length - MAX_EVIDENCE_SNAPSHOTS_PER_CASE));
-    return assignUniqueSnapshotIds(kept);
+    return byMaterial;
+}
+/** Imports add observations without evicting existing local material. Ordinary
+ * collection still uses the newest-history policy in normalizeEvidenceHistory. */
+export function mergeImportedEvidenceHistory(local, imported, caseDomain) {
+    const options = { source: 'import', fallback: null, caseDomain };
+    const retained = evidenceByMaterial(normalizeEvidenceHistory(local, options), options);
+    let omitted = 0;
+    for (const [material, incoming] of evidenceByMaterial(imported, options)) {
+        const existing = retained.get(material);
+        if (existing)
+            retained.set(material, mergeDuplicateSnapshots(existing, incoming));
+        else if (retained.size < MAX_EVIDENCE_SNAPSHOTS_PER_CASE)
+            retained.set(material, incoming);
+        else
+            omitted += 1;
+    }
+    return { records: assignUniqueSnapshotIds([...retained.values()].sort(compareSnapshotChrono)), omitted };
 }
 function assignUniqueSnapshotIds(snapshots) {
     const used = new Set();
@@ -403,15 +466,72 @@ function assignUniqueSnapshotIds(snapshots) {
         return snapshot.id === id ? snapshot : { ...snapshot, id };
     });
 }
-/**
- * The most recent snapshot, or null. Lets UI render "the latest evidence"
- * without knowing the history is a bounded, deduplicated timeline.
- * @param {{ evidenceHistory?: CaseEvidenceSnapshot[] } | null | undefined} record
- * @returns {CaseEvidenceSnapshot | null}
- */
-export function latestCaseEvidence(record) {
+/** Select from an admitted history without assigning order to equal or unknown capture times. */
+export function currentCaseEvidence(record) {
     const history = record && Array.isArray(record.evidenceHistory) ? record.evidenceHistory : [];
-    return history.at(-1) ?? null;
+    const cohort = latestObservationCohort(history, (snapshot) => snapshot.capturedAt);
+    const snapshot = cohort.undated.length === 0 && cohort.latest.length === 1 ? cohort.latest[0] : null;
+    return {
+        snapshot,
+        candidates: [...cohort.latest, ...cohort.undated],
+        capturedAt: cohort.observedAt,
+        limitation: cohort.undated.length
+            ? 'Retained snapshots include an unknown capture time. No single latest assessment is selected.'
+            : cohort.latest.length > 1
+                ? 'Distinct snapshots share the latest capture time. No single latest assessment is selected.'
+                : null,
+    };
+}
+/** The unique latest retained snapshot, or null for empty or temporally ambiguous evidence. */
+export function latestCaseEvidence(record) {
+    return currentCaseEvidence(record).snapshot;
+}
+/** Chronological presentation and comparison admission shared by the browser and Case report. */
+export function caseEvidenceTimeline(history) {
+    return buildEvidenceTimeline(history, true);
+}
+/** Reproduce published report fields only; not current analyst comparisons. */
+export function publishedCaseEvidenceTimelineForVerification(history) {
+    return buildEvidenceTimeline(history, false);
+}
+function buildEvidenceTimeline(history, enforceCollectionQuality) {
+    const dated = (history ?? []).map((snapshot) => ({
+        snapshot,
+        at: normalizeExplicitIsoTimestamp(snapshot.capturedAt),
+    }));
+    const counts = new Map();
+    for (const { at } of dated)
+        if (at)
+            counts.set(at, (counts.get(at) ?? 0) + 1);
+    const hasUndated = dated.some(({ at }) => at === null);
+    dated.sort((a, b) => (a.at === b.at ? 0 : a.at === null ? 1 : b.at === null ? -1 : Date.parse(a.at) - Date.parse(b.at))
+        || (a.snapshot.id < b.snapshot.id ? -1 : a.snapshot.id > b.snapshot.id ? 1 : 0));
+    return dated.map(({ snapshot, at }, index) => {
+        const previous = dated[index - 1];
+        const isBaseline = index === 0 && !hasUndated && at !== null && counts.get(at) === 1;
+        const orderingLimitation = !at || (previous && !previous.at)
+            ? 'Capture order is unknown; no temporal change is inferred.'
+            : counts.get(at) !== 1 || (previous && counts.get(previous.at) !== 1)
+                ? 'Equal-time snapshots have no unique before-and-after order; no temporal change is inferred.'
+                : null;
+        const comparable = previous && !orderingLimitation;
+        const changes = comparable ? compareEvidence(previous.snapshot, snapshot, enforceCollectionQuality) : [];
+        const incomparableReasons = orderingLimitation
+            ? ['other']
+            : comparable ? incomparableReasonsForEvidence(previous.snapshot, snapshot, enforceCollectionQuality) : [];
+        if (comparable && !changes.length && !incomparableReasons.length
+            && canonicalMaterialString(previous.snapshot) !== canonicalMaterialString(snapshot))
+            incomparableReasons.push('other');
+        return {
+            snapshot,
+            isBaseline,
+            hasRepeatedObservation: snapshot.firstCapturedAt !== snapshot.capturedAt,
+            changes: changes.length ? changes : null,
+            hasIncomparableChange: incomparableReasons.length > 0,
+            incomparableReasons,
+            orderingLimitation,
+        };
+    });
 }
 /**
  * Returns the exact hostname from the latest retained observation when it is
@@ -433,38 +553,38 @@ export function caseLookupTarget(record) {
 //                  a mode change is never reported.
 //   (absent)     - always comparable (data available in every capture).
 const COMPARE_FIELDS = [
-    { field: 'availability', label: 'Availability', type: 'availability' },
-    { field: 'confidence', label: 'Confidence', type: 'token' },
-    { field: 'riskScore', label: 'Risk score', type: 'score', depthGate: 'comparable', modelGate: 'risk', direction: 'risk' },
-    { field: 'riskFactors', label: 'Risk factors', type: 'factors', depthGate: 'comparable', modelGate: 'risk' },
-    { field: 'opportunityScore', label: 'Opportunity score', type: 'score', modelGate: 'opportunity' },
-    { field: 'opportunityFactors', label: 'Opportunity factors', type: 'factors', modelGate: 'opportunity' },
-    { field: 'registrar', label: 'Registrar', type: 'registrar' },
-    { field: 'createdDate', label: 'Creation date', type: 'date' },
-    { field: 'expiryDate', label: 'Expiry date', type: 'date' },
-    { field: 'nameservers', label: 'Nameservers', type: 'set', emptyGuard: true },
-    { field: 'hasMx', label: 'MX', type: 'bool', depthGate: 'both-deep' },
-    { field: 'hasSpf', label: 'SPF', type: 'bool', depthGate: 'both-deep' },
-    { field: 'hasDmarc', label: 'DMARC', type: 'bool', depthGate: 'both-deep' },
-    { field: 'activityStatus', label: 'Website activity', type: 'token', depthGate: 'both-deep' },
-    { field: 'websiteProbeDetail', label: 'Website check detail', type: 'text', depthGate: 'both-deep' },
-    { field: 'pageTitle', label: 'Page title', type: 'text', depthGate: 'both-deep' },
-    { field: 'httpEvidenceStatus', label: 'HTTP evidence status', type: 'token', depthGate: 'both-deep' },
-    { field: 'httpFinalOrigin', label: 'Final website origin', type: 'text', depthGate: 'both-deep' },
-    { field: 'httpResponseStatus', label: 'HTTP response status', type: 'number', depthGate: 'both-deep' },
-    { field: 'httpTransportSecurity', label: 'Website transport', type: 'http-transport', depthGate: 'both-deep' },
-    { field: 'httpRedirectCount', label: 'HTTP redirect count', type: 'number', depthGate: 'both-deep' },
-    { field: 'httpCrossOriginRedirect', label: 'Cross-origin redirect', type: 'http-signal', depthGate: 'both-deep' },
-    { field: 'httpHttpsDowngrade', label: 'HTTPS downgrade', type: 'signal', depthGate: 'both-deep' },
-    { field: 'httpContentType', label: 'Website content type', type: 'token', depthGate: 'both-deep' },
-    { field: 'httpSecurityHeaders', label: 'Observed security headers', type: 'set', depthGate: 'both-deep' },
-    { field: 'faviconMatch', label: 'Official favicon match', type: 'signal', depthGate: 'both-deep' },
-    { field: 'faviconNearMatch', label: 'Official favicon near-match', type: 'signal', depthGate: 'both-deep' },
-    { field: 'reusesOfficialAssets', label: 'Official asset reuse', type: 'signal', depthGate: 'both-deep' },
-    { field: 'hasPasswordField', label: 'Password form', type: 'signal', depthGate: 'both-deep' },
-    { field: 'hasExternalFormAction', label: 'External form action', type: 'signal', depthGate: 'both-deep' },
-    { field: 'phishingLanguageMatch', label: 'Phishing language', type: 'phishing', depthGate: 'both-deep' },
-    { field: 'mutationTypes', label: 'Mutation types', type: 'set' },
+    { field: 'availability', scope: 'registration', label: 'Availability', type: 'availability' },
+    { field: 'confidence', scope: 'registration', label: 'Confidence', type: 'token' },
+    { field: 'riskScore', scope: 'web', label: 'Risk score', type: 'score', depthGate: 'comparable', modelGate: 'risk', direction: 'risk' },
+    { field: 'riskFactors', scope: 'web', label: 'Risk factors', type: 'factors', depthGate: 'comparable', modelGate: 'risk' },
+    { field: 'opportunityScore', scope: 'web', label: 'Opportunity score', type: 'score', modelGate: 'opportunity' },
+    { field: 'opportunityFactors', scope: 'web', label: 'Opportunity factors', type: 'factors', modelGate: 'opportunity' },
+    { field: 'registrar', scope: 'registration', label: 'Registrar', type: 'registrar' },
+    { field: 'createdDate', scope: 'registration', label: 'Creation date', type: 'date' },
+    { field: 'expiryDate', scope: 'registration', label: 'Expiry date', type: 'date' },
+    { field: 'nameservers', scope: 'registration', label: 'Nameservers', type: 'set', emptyGuard: true },
+    { field: 'hasMx', scope: 'hostname', label: 'MX', type: 'bool', depthGate: 'both-deep' },
+    { field: 'hasSpf', scope: 'hostname', label: 'SPF', type: 'bool', depthGate: 'both-deep' },
+    { field: 'hasDmarc', scope: 'hostname', label: 'DMARC', type: 'bool', depthGate: 'both-deep' },
+    { field: 'activityStatus', scope: 'web', label: 'Website activity', type: 'token', depthGate: 'both-deep' },
+    { field: 'websiteProbeDetail', scope: 'web', label: 'Website check detail', type: 'text', depthGate: 'both-deep' },
+    { field: 'pageTitle', scope: 'web', label: 'Page title', type: 'text', depthGate: 'both-deep' },
+    { field: 'httpEvidenceStatus', scope: 'web', label: 'HTTP evidence status', type: 'token', depthGate: 'both-deep' },
+    { field: 'httpFinalOrigin', scope: 'web', label: 'Final website origin', type: 'text', depthGate: 'both-deep' },
+    { field: 'httpResponseStatus', scope: 'web', label: 'HTTP response status', type: 'number', depthGate: 'both-deep' },
+    { field: 'httpTransportSecurity', scope: 'web', label: 'Website transport', type: 'http-transport', depthGate: 'both-deep' },
+    { field: 'httpRedirectCount', scope: 'web', label: 'HTTP redirect count', type: 'number', depthGate: 'both-deep' },
+    { field: 'httpCrossOriginRedirect', scope: 'web', label: 'Cross-origin redirect', type: 'http-signal', depthGate: 'both-deep' },
+    { field: 'httpHttpsDowngrade', scope: 'web', label: 'HTTPS downgrade', type: 'signal', depthGate: 'both-deep' },
+    { field: 'httpContentType', scope: 'web', label: 'Website content type', type: 'token', depthGate: 'both-deep' },
+    { field: 'httpSecurityHeaders', scope: 'web', label: 'Observed security headers', type: 'set', depthGate: 'both-deep' },
+    { field: 'faviconMatch', scope: 'web', label: 'Official favicon match', type: 'signal', depthGate: 'both-deep' },
+    { field: 'faviconNearMatch', scope: 'web', label: 'Official favicon near-match', type: 'signal', depthGate: 'both-deep' },
+    { field: 'reusesOfficialAssets', scope: 'web', label: 'Official asset reuse', type: 'signal', depthGate: 'both-deep' },
+    { field: 'hasPasswordField', scope: 'web', label: 'Password form', type: 'signal', depthGate: 'both-deep' },
+    { field: 'hasExternalFormAction', scope: 'web', label: 'External form action', type: 'signal', depthGate: 'both-deep' },
+    { field: 'phishingLanguageMatch', scope: 'web', label: 'Phishing language', type: 'phishing', depthGate: 'both-deep' },
+    { field: 'mutationTypes', scope: 'hostname', label: 'Mutation types', type: 'set' },
 ];
 function depthComparable(a, b) {
     return a === b && (a === 'fast' || a === 'deep');
@@ -482,6 +602,13 @@ function opportunityModelComparable(previous, current) {
 function valuesMateriallyEqual(field, previous, current) {
     return JSON.stringify(materialValue(field, previous)) === JSON.stringify(materialValue(field, current));
 }
+function collectionFieldComparable(field, snapshot) {
+    if (field === 'registrar' || field === 'createdDate' || field === 'expiryDate')
+        return isPresent(snapshot[field]);
+    return field.startsWith('http')
+        ? httpSummaryFieldIsObserved(field, snapshot)
+        : webCollectionAllowsComparison(field, snapshot.webCollectionQuality, snapshot.scanDepth);
+}
 /**
  * Explains material fields that comparison gates deliberately suppress. The
  * reasons are stable machine values for UI/report wording; they are not risk
@@ -489,14 +616,27 @@ function valuesMateriallyEqual(field, previous, current) {
  * in the same observation produced an ordinary material change.
  * @param {CaseEvidenceSnapshot | null | undefined} previous
  * @param {CaseEvidenceSnapshot | null | undefined} current
- * @returns {Array<'observation-context' | 'opportunity-model' | 'scan-depth' | 'risk-model'>}
+ * @returns {Array<'observation-context' | 'opportunity-model' | 'scan-depth' | 'risk-model' | 'collection-quality'>}
  */
 export function caseEvidenceIncomparableReasons(previous, current) {
+    return incomparableReasonsForEvidence(previous, current, true);
+}
+function incomparableReasonsForEvidence(previous, current, enforceCollectionQuality) {
     if (!previous || !current || previous.fingerprint === current.fingerprint)
         return [];
     const reasons = [];
-    if (previous.inputHostname !== current.inputHostname)
+    if (!sameObservationContext(previous, current))
         reasons.push('observation-context');
+    const missingRegistrationValue = ['registrar', 'createdDate', 'expiryDate'].some(field => !valuesMateriallyEqual(field, previous, current) && (!isPresent(previous[field]) || !isPresent(current[field])));
+    const incompleteWebFields = previous.scanDepth === 'deep' && current.scanDepth === 'deep'
+        && (JSON.stringify(previous.webCollectionQuality) !== JSON.stringify(current.webCollectionQuality)
+            || COMPARE_FIELDS.some(spec => (spec.modelGate !== 'risk' || riskModelComparable(previous, current))
+                && (spec.modelGate !== 'opportunity' || opportunityModelComparable(previous, current))
+                && !valuesMateriallyEqual(spec.field, previous, current)
+                && (!collectionFieldComparable(spec.field, previous)
+                    || !collectionFieldComparable(spec.field, current))));
+    if (enforceCollectionQuality && (missingRegistrationValue || incompleteWebFields))
+        reasons.push('collection-quality');
     const hasRiskEvidence = previous.riskScore !== null || current.riskScore !== null
         || previous.riskFactors.length > 0 || current.riskFactors.length > 0;
     if (hasRiskEvidence && !riskModelComparable(previous, current))
@@ -523,6 +663,16 @@ function isPresent(value) {
         return value.length > 0;
     return true;
 }
+function sameObservationHostname(previous, current) {
+    return previous.inputHostname === current.inputHostname
+        && (previous.observationHostname ?? null) === (current.observationHostname ?? null);
+}
+function sameObservationContext(previous, current) {
+    // Compact Case snapshots deliberately omit URL paths and queries. A selected
+    // page cannot therefore establish a comparable website target here.
+    return sameObservationHostname(previous, current)
+        && previous.webObservationMode !== 'selected_url' && current.webObservationMode !== 'selected_url';
+}
 function setsEqual(a, b) {
     return JSON.stringify(a) === JSON.stringify(b);
 }
@@ -648,11 +798,9 @@ function compareField(spec, before, after) {
             return { before: b, after: a, tone: 'neutral' };
         }
         case 'factors': {
-            // Factors are already normalized (deduped + deterministically sorted), so
-            // a set comparison ignores input order and reports a genuine change in the
-            // score's composition even when the total is unchanged.
-            const b = Array.isArray(before) ? before : [];
-            const a = Array.isArray(after) ? after : [];
+            // Historical identity ordering is not a change in the factor set.
+            const b = normalizeFactors(before);
+            const a = normalizeFactors(after);
             if (setsEqual(b, a))
                 return null;
             return { before: b, after: a, tone: 'neutral' };
@@ -675,14 +823,23 @@ function compareField(spec, before, after) {
  * @returns {Array<{ field: string, label: string, before: unknown, after: unknown, tone: string }>}
  */
 export function compareCaseEvidence(previous, current) {
+    return compareEvidence(previous, current, true);
+}
+function compareEvidence(previous, current, enforceCollectionQuality) {
     if (!previous || !current)
         return [];
     const bothDeep = previous.scanDepth === 'deep' && current.scanDepth === 'deep';
     const comparableDepth = depthComparable(previous.scanDepth, current.scanDepth);
     const comparableRiskModel = riskModelComparable(previous, current);
     const comparableOpportunityModel = opportunityModelComparable(previous, current);
+    const sameHostname = sameObservationHostname(previous, current);
+    const sameWebContext = sameObservationContext(previous, current);
     const changes = [];
     for (const spec of COMPARE_FIELDS) {
+        if (spec.scope === 'hostname' && !sameHostname)
+            continue;
+        if (spec.scope === 'web' && !sameWebContext)
+            continue;
         if (spec.depthGate === 'both-deep' && !bothDeep)
             continue;
         if (spec.depthGate === 'comparable' && !comparableDepth)
@@ -691,6 +848,9 @@ export function compareCaseEvidence(previous, current) {
             continue;
         if (spec.modelGate === 'opportunity' && !comparableOpportunityModel)
             continue;
+        if (enforceCollectionQuality && (!collectionFieldComparable(spec.field, previous)
+            || !collectionFieldComparable(spec.field, current)))
+            continue;
         const result = compareField(spec, previous[spec.field], current[spec.field]);
         if (result) {
             changes.push({ field: spec.field, label: spec.label, before: result.before, after: result.after, tone: result.tone });

package/packages/cases/case-evidence-quality.mjs

@@ -0,0 +1,5 @@
+/** Collection completeness does not establish a usable date, comparison or conclusion. */
+export function casePinHasCompleteObservation(pin) {
+    return pin.completeness === 'complete' && !pin.truncated
+        && ['complete', 'success', 'reviewed', 'not_found'].includes(pin.sourceState ?? '');
+}