oh-my-opencode 5.1.48 → 5.1.54

package/packages/omo-codex/plugin/skills/ulw-research/references/deliverable-phase.md

@@ -50,7 +50,7 @@ The request and its destination usually answer the format question already. Deri
 | A prior report of the same kind in this workspace, not pointed at | that report's format, offered as the Q1 default | `template-vibe` | full |
 | A complete existing deliverable for this question (section 2) | its existing format | `edit-existing` | the original's tier |
 
-QA tiers: **light** runs the static gates and one render check of the answer, and records the fidelity gate as `not_run --reason "<why>"` (the reason is required) until Markdown deliverable support ships for it. **Full** runs the static gates, the fidelity gate, the layout gates, visual QA of every page, and the proofread gate (section 7).
+QA tiers: **light** runs the static gates and one render check of the answer, and records the fidelity gate as `not_run --reason "<why>"` (the reason is required); the light tier does not run `fact verify`. **Full** runs the static gates, the fidelity gate, the layout gates, visual QA of every page, and the proofread gate (section 7).
 
 ## 4. The empty-info interview
 
@@ -114,7 +114,7 @@ Each line is `<field>: <value> (answered_by: user|default|request|pending)`; val
 - The source floor is evaluated live against the `meta.json` of every source behind the row (a derived row's sources are its operands' sources): `pointed only: <list>` admits a source whose id (`S4`), URL, or path is in the list; `primary only` admits a source whose declared provenance is `primary` (`source snapshot --provenance primary|secondary`, default `unknown`; `secondary` and `unknown` are refused); `classes: <list>` admits a source whose URL host equals a listed host suffix or ends with `.<suffix>` (`sec.gov`, `go.kr`); `standard` refuses nothing. Under any floor but `standard`, a row resting on no source (an `assumed` row, or a derived row with such an operand) is refused as well: no source of it can be inside the floor. A refused row is `source_outside_floor`. Rows registered while the floor was pending are reclassified the moment it locks or changes. The row's `outside_floor` is the cached result of the last fill, never an input; fill writes it to the ledger even when it refuses.
 - `languages` with `quotes original with translation beside` lets a `{{Q7:label}}` be followed by its translation, `<span data-translates="Q7">...</span>` in HTML or `<!-- translates: Q7 -->` and the sentence in Markdown; fill binds it to Q7, and `fact pairs` emits it as a `translation` pair. Under `quotes original` fill does not bind it.
 - `fallback: omit` makes `--replace-failed` remove a twice-failed sentence instead of replacing it with an attributed block quote.
-- Fill records `brief_sha256` in `<out>.fill-map.json`: the sha256 of the locked block normalized to its seven `field: value` lines in field order (`answered_by` and `asked:` excluded). `fact verify` reads that map (`--fill-map`, else `<report>.fill-map.json` when present) and refuses with `brief_changed` when the hash is not the current block's or the map has none; re-fill, then verify.
+- Fill records `brief_sha256` in `<out>.fill-map.json`: the sha256 of the locked block normalized to its seven `field: value` lines in field order (`answered_by` and `asked:` excluded). `fact verify` requires that map for every edition, HTML or Markdown (`--fill-map`, else whichever of `<report>.fill-map.json` and the `<report>.polished.fill-map.json` that `fact polish-apply` writes records the edition's bytes), and refuses with `brief_changed` when there is no map, when its hash is not the current block's, or when it records none; re-fill, then verify.
 
 **Re-entry.** A session started before this block existed (an `edit-existing` run included) has no `## Fidelity`: run the inference step and write the block with `answered_by: default` before any `fact` command.
 
@@ -169,7 +169,7 @@ Nothing reaches the requester until the gates for its QA tier pass, in this orde
    ```bash
    node "$SKILL_DIR/scripts/report-tools.mjs" fact verify "$SESSION_DIR/report.html" --session-dir "$SESSION_DIR"   # writes fidelity-defects.json
    ```
-   Exit `1` on any blocker or major defect: record `outcome gate fidelity fail`; minors alone exit `0` and are listed. The grammar, the fill step, and the derivations are in section 11; this stage verifies HTML only.
+   Exit `1` on any blocker or major defect: record `outcome gate fidelity fail`; minors alone exit `0` and are listed. This stage verifies HTML and Markdown with its fill map; verify LaTeX through its Markdown source (section 11).
 3. **Layout gates.** Print the probe, evaluate it in the rendered page through the browser skill's owned headless engine, save the returned object as `$SESSION_DIR/boxes.json`, and re-run `check` with `--layout "$SESSION_DIR/boxes.json"`. It adds overflow past the container, clipped text, scroll containers, distorted images, and overlapping siblings.
    ```bash
    node "$SKILL_DIR/scripts/report-tools.mjs" layout-probe --json   # .source is one async expression
@@ -182,9 +182,9 @@ Nothing reaches the requester until the gates for its QA tier pass, in this orde
    node "$SKILL_DIR/scripts/report-tools.mjs" fact pairs "$SESSION_DIR/report.polished.html" --changed-since "$SESSION_DIR/report.html.fill-map.json" --session-dir "$SESSION_DIR"
    ```
 
-**Every reader-facing edition is verified.** The main report, the inline edition (section 9), LaTeX per-section sources, and slide sources are filled by `fact fill` from one placeholder source and each is verified by `fact verify` into its own record; PDF and DOCX are renders of a verified source. A delivered row is recorded with `outcome set <format> delivered --path <file> --verified-by <record>`, where the record's `artifact_sha256` equals the sha256 of the delivered source; a PDF or DOCX adds `--rendered-from <source>` and is matched against that source. In a session with a fact ledger, `outcome verify` refuses a delivered row without a matching record (`edition_unverified`, blocker, integrity). Markdown and LaTeX verification arrive with the Markdown stage; until then `fact verify --format md|tex` exits `2`, and such an edition is recorded `blocked_capability` with that reason rather than delivered unverified.
+**Every reader-facing edition is verified.** The main report, the inline edition (section 9), LaTeX per-section sources, and slide sources are filled by `fact fill` from one placeholder source and each is verified by `fact verify` into its own record; PDF and DOCX are renders of a verified source. A delivered row is recorded with `outcome set <format> delivered --path <file> --verified-by <record>`, where the record's `artifact_sha256` equals the sha256 of the delivered source; a PDF or DOCX adds `--rendered-from <source>` and is matched against that source. Each delivered edition also carries its own meaning record: run `fact pairs` on that edition's source and `fact meaning-check --edition <format>`, which writes `fidelity-meaning-defects.<format>.json` bound to those bytes (section 7). The barrier binds each edition to a record for its current bytes: every record whose `artifact_sha256` equals those bytes is a candidate (its own record, another edition's record for a byte-identical copy or the html edition a PDF renders, and the legacy single file `fidelity-meaning-defects.json`), and the one with the newest `written_at` wins; on equal times the more severe verdict wins (`meaning_drift_confirmed`, then `meaning_unverified`, then clean). In a session with a fact ledger, `outcome verify` refuses a delivered row without a matching record (`edition_unverified`, blocker, integrity). Markdown and LaTeX verification arrive with the Markdown stage; until then `fact verify --format md|tex` exits `2`, and such an edition is recorded `blocked_capability` with that reason rather than delivered unverified.
 
-The light tier runs gate 1 and one render (recorded as `visual`) and records `fidelity`, `layout`, and `proofread` as `not_run` (`fidelity not_run` needs `--reason "<why>"`); `fidelity` stays `not_run` in the light tier until Markdown deliverable support ships for the fidelity verifier. The full tier runs all five.
+The light tier runs gate 1 and one render (recorded as `visual`) and records `fidelity`, `layout`, and `proofread` as `not_run` (`fidelity not_run` needs `--reason "<why>"`); the light tier never runs the fidelity verifier, although `fact verify` checks HTML and Markdown editions. The full tier runs all five.
 
 ## 8. Bounded repair loop
 
@@ -200,9 +200,9 @@ node "$SKILL_DIR/scripts/report-tools.mjs" repair decide --state "$SESSION_DIR/r
 - `action: deliver`: stop repairing and deliver. `reason` is `clean` or the stop condition that fired; the residual defects are written into the manifest and listed in the closing briefing.
 - `action: block` (exit `1`): do not deliver. Either a content-integrity defect remains (`missing_closing_section`, `missing_citation_section`, `broken_asset_reference`, `missing_required_section`, `missing_promised_deliverable`, or a fidelity integrity code: `unresolved_placeholder`, `value_mismatch`, `unit_mismatch`, `quote_not_verbatim`, `claim_status_invalid`, `incompatible_operands`, `pointer_label_mismatch`, `quote_anchor_unresolved`, `unit_duplicated`, `polish_diff_fail`, `fidelity_interview_incomplete`, `derived_not_allowed`, `source_outside_floor`, `brief_changed`, `snapshot_hash_mismatch`, `chart_value_untraceable`, `quote_unbound`, `edition_unverified`), or a stop fired without proof of a usable artifact (`--artifact-bytes` and `--renders`). Tell the requester what blocks delivery and record the affected rows as `failed` with the reason.
 
-**The fidelity barrier is separate from the budget.** A `deliver` decision does not release fidelity defects: `outcome verify` and `outcome finish` use the fidelity gate's `blocksDelivery` predicate over `DEFECT_CODES` (integrity, blocker, or major), never a CLI code list or the row's claimed severity. Unknown codes refuse with `unknown defect code <code>`; known blockers produce `fidelity_unresolved`. Fix the defect and re-verify the edition before delivery. The table and the record schema in `scripts/fidelity-records.mjs` are the spec for the barrier. Every fidelity record carries one envelope (`record_kind`, `artifact_sha256`, `report`, `written_at`, `defects`) plus the fields its kind declares; a record with a missing, unknown, or ill-typed field refuses as malformed (`edition_unverified`). `FIDELITY_RECORDS` has one row per record kind, each rule a column: where its records are, when a delivered session must carry one, the envelope field that binds it to the delivered bytes (`artifact_sha256`), and which defects block. The rows are `fidelity` (`fact verify`, one record per delivered edition, named by `--verified-by`) and `meaning` (`fidelity-meaning-defects.json` from `fact meaning-check`, one per session, required while the locked brief's `meaning check` is `on` or its `## Fidelity` block is malformed; missing: `meaning gate not run`, the same `edition_unverified` refusal, released only by the logged `fidelity not_run` exemption in a session with no ledger or fidelity record). A record whose `artifact_sha256` matches no delivered edition's source bytes refuses as `is for a different edition`, so a meaning record from an earlier draft never passes a rewritten one: rerun `fact pairs` and the readers after every rewrite. A `meaning_drift_confirmed` or `meaning_unverified` in that record holds the barrier like any other major.
+**The fidelity barrier is separate from the budget.** A `deliver` decision does not release fidelity defects: `outcome verify` and `outcome finish` use the fidelity gate's `blocksDelivery` predicate over `DEFECT_CODES` (integrity, blocker, or major), never a CLI code list or the row's claimed severity. Unknown codes refuse with `unknown defect code <code>`; known blockers produce `fidelity_unresolved`. Fix the defect and re-verify the edition before delivery. The table and the record schema in `scripts/fidelity-records.mjs` are the spec for the barrier. Every fidelity record carries one envelope (`record_kind`, `artifact_sha256`, `report`, `written_at`, `defects`) plus the fields its kind declares; a record with a missing, unknown, or ill-typed field refuses as malformed (`edition_unverified`). `FIDELITY_RECORDS` has one row per record kind, each rule a column: where its records are, when a delivered session must carry one, the envelope field that binds it to the delivered bytes (`artifact_sha256`), and which defects block. The rows are `fidelity` (`fact verify`, one record per delivered edition, named by `--verified-by`, plus every existing session fidelity record even when unattached) and `meaning` (`fidelity-meaning-defects.<format>.json` from `fact meaning-check --edition <format>`, one per delivered edition, required while the locked brief's `meaning check` is `on` or its `## Fidelity` block is malformed; missing: `meaning gate not run`, the same `edition_unverified` refusal, released only by the logged `fidelity not_run` exemption in a session with no ledger or fidelity record). An edition with no record of its own uses any edition meaning record for the same bytes (a byte-identical copy at another path, or a PDF of the html edition, shares the html record), else the legacy session record `fidelity-meaning-defects.json`, so a single-edition session written before per-edition records still delivers unchanged; an edition with none refuses with `meaning gate not run` naming the file to write. A record whose `artifact_sha256` does not match its edition's source bytes refuses that edition alone as `is for a different edition`, so a meaning record from an earlier draft never passes a rewritten one: rerun `fact pairs` and the readers after every rewrite. A `meaning_drift_confirmed` or `meaning_unverified` in that record holds the barrier like any other major.
 
-**After a dispute.** `--dispute P<n> --reason` records the disagreement in the calibration log; it does not clear the defect, so `fact meaning-check` keeps exiting `1` and the barrier keeps holding by design. Proceed through `repair decide` with `fidelity-meaning-defects.json` among its `--defects` (the dispute stays recorded on that run): the writer changes the sentence (rewrite it from the quote, or `fact fill --replace-failed` for a sentence that failed twice), then rerun `fact pairs` and the readers. There is no path that delivers a disputed `meaning_drift_confirmed` sentence unchanged.
+**After a dispute.** `--dispute P<n> --reason` records the disagreement in the calibration log; it does not clear the defect, so `fact meaning-check` keeps exiting `1` and the barrier keeps holding by design. Proceed through `repair decide` with the edition's meaning record (`fidelity-meaning-defects.<format>.json`) among its `--defects` (the dispute stays recorded on that run): the writer changes the sentence (rewrite it from the quote, or `fact fill --replace-failed` for a sentence that failed twice), then rerun `fact pairs` and the readers. There is no path that delivers a disputed `meaning_drift_confirmed` sentence unchanged. Only a newer reader run on the same bytes replaces the verdict: among the records for an edition's current bytes (its own, another edition's record for the same bytes, the legacy `fidelity-meaning-defects.json`) the one with the newest `written_at` holds the barrier, whichever file it is in, and on equal times the more severe verdict holds it. A drift confirmed after the edition's own clean run keeps blocking, and a drift verdict stops holding the barrier once a later reader run on those bytes judges the sentence again.
 
 Defaults: 3 repair attempts, a plateau of 2 consecutive attempts that do not improve the (blocker, major, minor) counts compared in that order, and 15 minutes of wall clock from the first decision. A defect set that repeats an earlier attempt exactly stops the loop as an oscillation. When several conditions hold at once the reported reason follows `clean`, `blocking`, `oscillation`, `plateau`, `max_attempts`, `wall_clock`.
 
@@ -222,9 +222,9 @@ node "$SKILL_DIR/scripts/report-tools.mjs" outcome briefing --session-dir "$SESS
 
 - `init` runs when the brief is written (section 4): one `pending` row per promised format (`pdf`, `docx`, `html`, `md`, `latex`, `slides`, `post`).
 - `set` resolves a row: `delivered` (absolute path; bytes are read from disk; pages when paginated), `blocked_capability` (this session cannot produce it), `skipped` (the requester or the lane dropped it), or `failed`. Every status except `delivered` needs `--reason`; `outcome set <format> delivered` records intent permissively, while the required `outcome verify` and `outcome finish` enforce the delivery barrier.
-- `verify` runs before delivery and exits `1` while a row is `pending`, a status lacks its reason, a delivered file is missing or empty, a registry blocker remains (`fidelity_unresolved`), or a delivered edition has no matching verify record (`edition_unverified`, section 7). Delivered HTML/PDF/DOCX without any ledger or record also refuse with `fidelity gate not run`; explicitly record `outcome gate fidelity not_run --reason "<text>"` to exempt an unverified edition. With `meaning check: on`, or a malformed `## Fidelity` block (which cannot prove the check off), a delivered session without `fidelity-meaning-defects.json` refuses with `meaning gate not run` under the same rule; a meaning record for bytes no delivered edition has refuses as `is for a different edition`. This choice is logged in `gateHistory` with its timestamp and reason; it never releases an existing ledger requirement, record, or defect, and a subsequent fidelity gate status replaces the exemption.
+- `verify` runs before delivery and exits `1` while a row is `pending`, a status lacks its reason, a delivered file is missing or empty, a registry blocker remains (`fidelity_unresolved`), or a delivered edition has no matching verify record (`edition_unverified`, section 7). Delivered HTML/PDF/DOCX without any ledger or record also refuse with `fidelity gate not run`; explicitly record `outcome gate fidelity not_run --reason "<text>"` to exempt an unverified edition. With `meaning check: on`, or a malformed `## Fidelity` block (which cannot prove the check off), a delivered edition without a meaning record (bound to the newest record for its current bytes, whether its own `fidelity-meaning-defects.<format>.json`, another edition's record for the same bytes, or the legacy single file `fidelity-meaning-defects.json`; on equal times the more severe verdict) refuses with `meaning gate not run` under the same rule; a meaning record for other bytes than its edition's refuses that edition as `is for a different edition`. This choice is logged in `gateHistory` with its timestamp and reason; it never releases an existing ledger requirement, record, or defect, and a subsequent fidelity gate status replaces the exemption.
 - `finish` refuses (exit `1`, nothing stamped) while the fidelity barrier holds.
-- `finish` stamps the finish time, the elapsed minutes from the session directory's start stamp, and the source and domain counts from `sources-ledger.md`.
+- `finish` stamps the finish time, the elapsed minutes from the manifest's `startedAt` (the run clock `outcome init` recorded once: `--started-at`, else a supervisor's `terminal-state.json` `started_at`, else the session directory's timestamp name; a value after `--now` or more than a day from a timestamped name is refused), and the source and domain counts from `sources-ledger.md`.
 - `briefing` prints the closing block from the manifest and the ledger: sources and distinct domains, elapsed minutes, every deliverable with its status, the gate results, the residual defects, and the repair summary. That text is the closing briefing, pasted as printed, never filled in from memory.
 
 ### Showing the report inline
@@ -239,14 +239,14 @@ When the session has a tool that shows a self-contained HTML page inline in the
 
 ## 10. Command reference
 
-Invoke every command as `node "$SKILL_DIR/scripts/report-tools.mjs" <command>`. Exit codes for all of them: `0` pass, `1` semantic failure, `2` usage or IO error.
+Invoke every command as `node "$SKILL_DIR/scripts/report-tools.mjs" <command>`. Exit codes: `0` pass, `1` semantic failure, `2` usage or IO error. `fact polish-apply` deliberately permits partial application: exit `0` means the output was written, not that every edit applied. Check its top-level JSON `applied` boolean (`false` if any edit was rejected or unlocated); `data.applied` remains the accepted-edit count.
 
 | Command | Flags | Exit `1` when |
 | --- | --- | --- |
 | `check <report.html>` | `--design-spec <spec>` (required), `--layout <boxes.json>`, `--require-section <regex>` (repeatable), `--max-defects N` | any blocker defect |
 | `layout-probe` | `--cap N` (default 400), `--root <selector>` (default `main, article`), `--json` | never |
 | `repair decide` | `--state <file>` and `--defects <json>` (required; repeatable, the files are concatenated), `--artifact-bytes N`, `--renders N`, `--session-dir <dir>`, `--max-attempts N`, `--plateau-limit N`, `--wall-clock-ms N`, `--now <ISO>` | the decision is `block` |
-| `outcome init` | `--promised <list>` (required), `--lane <lane>`, `--session-dir <dir>`, `--now <ISO>` | never |
+| `outcome init` | `--promised <list>` (required), `--lane <lane>`, `--session-dir <dir>`, `--now <ISO>`, `--started-at <ISO>` | never |
 | `outcome set <format> <status>` | `--path <file>`, `--pages N`, `--reason <text>`, `--verified-by <fidelity record>`, `--rendered-from <source>`, `--session-dir <dir>`, `--now <ISO>` | never |
 | `outcome gate <gate> <status>` | `--session-dir <dir>`, `--now <ISO>`, `--reason <text>` (required for `fidelity not_run`; logged in `gateHistory`) | never (a missing reason exits `2`) |
 | `outcome render <png>` | `--page N` (required), `--session-dir <dir>` | never |
@@ -256,18 +256,20 @@ Invoke every command as `node "$SKILL_DIR/scripts/report-tools.mjs" <command>`.
 | `outcome briefing` | `--json`, `--ledger <file>`, `--session-dir <dir>`, `--now <ISO>` | never |
 | `format-extract <reference>` | `--out <design-spec.md>` (required), `--from-url` | never (an unsupported reference exits `2`) |
 | `--help` | `--json` | never |
-| `source snapshot` | `--id S<n>` (required), one of `--url <u>`, `--html <file>`, `--text <file>` (with optional `--extractor NAME@VERSION`), `--command '<argv json>' --cwd <dir>`; `--kind page\|command\|document`, `--provenance primary\|secondary` (default `unknown`, read by `source floor: primary only`), `--revision <r>`, `--session-dir <dir>` | the id already holds different content (`snapshot_exists`) |
+| `source snapshot` | `--id S<n>` (required), one of `--url <u>`, `--html <file>`, `--raw <file>` (optionally with `--text <extraction> --extractor NAME@VERSION`), `--text <file>` alone (a converted-only source: quotes only), `--command '<argv json>' --cwd <dir>`; `--charset <name>` (overrides the detected encoding), `--kind page\|command\|document\|converted-only`, `--provenance primary\|secondary` (default `unknown`, read by `source floor: primary only`), `--revision <r>`, `--replace` (overwrite the id's snapshot; refused while an active row cites it), `--session-dir <dir>`; the contract is in [fact-ledger.md](fact-ledger.md#snapshot-and-locator-contract) | the id already holds different content (`snapshot_exists`); `--replace` on an id an active row cites (`snapshot_pinned`) |
+| `source refresh` | `S<n>` (required); no input flag re-fetches the source's http(s) URL, or one `source snapshot` input flag gives the new capture; `--charset`, `--session-dir <dir>` | a row's quote is not found once in the new snapshot (`quote_not_verbatim`; that row keeps its old pin) |
+| `source probe-conversion` | `<raw-file> <converted-file>` (positional) | the converted text holds a number the raw text does not (`altered`, exit `1`) |
 | `fact add` | `--source S<n>` with `--find <text>` (`--unit-expected <unit>`), or `--table <id> --row <label> --col <label>`, or `--page N --line N`; `--label`, `--entity`, `--valid-at`, `--population`, `--accounting-basis`, `--observation O<n>`, `--json`, `--session-dir <dir>`. Or `--assumed <value> --unit <unit> --rationale <text> --label <label>` | `fact_not_located`, `fact_ambiguous`, `unit_mismatch` (no row written) |
 | `fact quote` | `--source S<n> --match <text>` (required), `--label`, `--json`, `--session-dir <dir>` | `fact_not_located`, `fact_ambiguous` |
 | `fact retract <id>` | `--reason <text>` (required), `--replacement <id>`, `--session-dir <dir>` | never (an illegal transition exits `2`) |
 | `fact export` | `--csv`, `--out <file>`, `--session-dir <dir>` | never |
 | `fact fill <src>` | `--out <file>` or `--view`, `--format html\|md\|tex`, `--inline`, `--replace-failed`, `--brief <brief.md>`, `--session-dir <dir>` | `fidelity_interview_incomplete`, `derived_not_allowed`, `source_outside_floor` (section 4), or a fill error: no edition, fill map, or state is written; the ledger's cached `outside_floor` is (section 4). Off-table `derived numbers` or `fallback` exits `2` |
-| `fact verify <report>` | `--format html\|md` (from the extension by default), `--sources <dir>`, `--claims <claims.json>`, `--fill-map <file>` (a Markdown edition reads `<report>.fill-map.json` by default), `--brief <brief.md>`, `--out <record>`, `--session-dir <dir>` | `fidelity_interview_incomplete` (no record written), or any blocker or major defect, `brief_changed`, `derived_not_allowed`, and `source_outside_floor` under the current brief included (section 4) |
-| `fact pairs <report>` | `--format html\|md`, `--ledger <fact-ledger.json>`, `--claims <claims.json>`, `--changed-since <fill-map.json>` (keep only the pairs whose sentence text is not in the pre-polish artifact that map names, so the readers re-check exactly what polish rewrote; the map must carry `artifact_sha256` and the artifact must still hash to it, otherwise the command exits `2`), `--brief <brief.md>`, `--out <pairs.json>`, `--session-dir <dir>` | `fidelity_interview_incomplete` (with `meaning check: off` it writes `{"skipped": true}` and exits `0`) |
-| `fact polish-apply <report.html>` | `--edits <polish-edits.json>` and `--out <report.polished.html>` (both required; a missing flag or a Markdown edition exits `2`), `--format html`, `--ledger <fact-ledger.json>`, `--brief <brief.md>`, `--session-dir <dir>` | `fidelity_interview_incomplete` (nothing written); otherwise never: it exits `0` whenever it wrote the output. Each rejected (`polish_edit_rejected`) or unlocated (`polish_edit_unlocated`) edit leaves its text unchanged and is printed verbatim, one line per rejection, in the summary and in `data.rejected_reasons`; `data` also carries `applied`, `rejected`, `unlocated`, `applied_indexes`, `input_sha256`, `edits_sha256`, and `out_sha256` |
+| `fact verify <report>` | `--format html\|md` (from the extension by default), `--sources <dir>`, `--claims <claims.json>`, `--fill-map <file>` (every edition needs one; by default `<report>.fill-map.json` or `<report>.polished.fill-map.json`, whichever records the edition's bytes, and none is `brief_changed`; the HTML edition's map also gives each value-mode fact's mode and the unit bound to it at fill), `--brief <brief.md>`, `--out <record>`, `--session-dir <dir>` | `fidelity_interview_incomplete` (no record written), or any blocker or major defect, `brief_changed`, `derived_not_allowed`, and `source_outside_floor` under the current brief included (section 4) |
+| `fact pairs <report>` | `--format html\|md`, `--ledger <fact-ledger.json>`, `--claims <claims.json>`, `--changed-since <fill-map.json>` (the pre-polish fill map, or a polished map, which leads to it through `polishedFrom`: keep only the pairs whose sentence text is not in the artifact the fill map names, so the readers re-check exactly what changed; when that artifact no longer hashes to the map's `artifact_sha256`, because it was polished in place or edited, every pair is kept; the record's `changed_since` is `{fill_map, narrowed}`; a map without `artifact_sha256`, or a fill map changed after polish, exits `2`), `--brief <brief.md>`, `--out <pairs.json>`, `--session-dir <dir>` | `fidelity_interview_incomplete` (with `meaning check: off` it writes `{"skipped": true}` and exits `0`) |
+| `fact polish-apply <report.html>` | `--edits <polish-edits.json>` and `--out <report.polished.html>` (both required; a missing flag or a Markdown edition exits `2`), `--fill-map <file>` (default: the edition's fill map, chosen as `fact verify` chooses it; one that does not record the input's bytes exits `2` and nothing is written), `--format html`, `--ledger <fact-ledger.json>`, `--brief <brief.md>`, `--session-dir <dir>` | `fidelity_interview_incomplete` (nothing written); otherwise never: it exits `0` whenever it wrote the output. With a fill map it also writes `<out>.polished.fill-map.json` (the brief binding, the polished file's hash, and `polishedFrom` naming the fill map) and never rewrites the fill map, even when `--out` is the input. Each rejected (`polish_edit_rejected`) or unlocated (`polish_edit_unlocated`) edit leaves its text unchanged and is printed verbatim, one line per rejection, in the summary and in `data.rejected_reasons`; `data` also carries `applied`, `rejected`, `unlocated`, `applied_indexes`, `input_sha256`, `edits_sha256`, and `out_sha256` |
 | `fact polish-diff` | `--before <pre-polish.html>` and `--after <polished.html>` (both required; a missing flag exits `2`), `--ledger <fact-ledger.json>`, `--out <record>` (default `$SESSION_DIR/polish-defects.json`), `--brief <brief.md>`, `--session-dir <dir>` | `fidelity_interview_incomplete` (nothing written), or a registry blocker in the diff (majors and minors are reported and exit `0`; a defect code the registry does not know refuses with `unknown defect code <code>`). The record is `{command, status, exitCode, before, artifact, artifact_sha256, defects[], counts}`, with `counts` in contract buckets |
-| `fact meaning-check` | `--pairs <pairs.json>` and `--verdicts <file>` (required; repeatable, one per reader tier), `--dispute P<n> --reason <text>`, `--run-id <id>`, `--calibration <file>` (default `fidelity-calibration.jsonl`), `--brief <brief.md>`, `--out <record>` (default `fidelity-meaning-defects.json`), `--session-dir <dir>` | `fidelity_interview_incomplete`, or `meaning_drift_confirmed` (stderr carries one JSON line with the defect and dropped-verdict counts) |
-| `fact derive` | `--op <op>` (required) with the operation's operands (section 11), `--unit`, `--to`, `--rationale`, `--disjoint`, `--label`, `--json`, `--session-dir <dir>` | `incompatible_operands` (no row written) |
+| `fact meaning-check` | `--pairs <pairs.json>` and `--verdicts <file>` (required; repeatable, one per reader tier), `--dispute P<n> --reason <text>`, `--run-id <id>`, `--calibration <file>` (default `fidelity-calibration.jsonl`), `--brief <brief.md>`, `--edition <format>` (writes `fidelity-meaning-defects.<format>.json`, the delivered edition's meaning record), `--out <record>` (default `fidelity-meaning-defects.json`), `--session-dir <dir>` | `fidelity_interview_incomplete`, or `meaning_drift_confirmed` (stderr carries one JSON line with the defect and dropped-verdict counts) |
+| `fact derive` | `--op <op>` and `--now <ISO>` (both required; `--now` is the row's `observed_at`, the script never reads the clock, and without it the command exits `2` with `missing_now` and writes no row) with the operation's operands (section 11), `--unit`, `--to`, `--rationale`, `--disjoint`, `--label`, `--json`, `--session-dir <dir>` | `incompatible_operands` (no row written) |
 | `claims index <claim-graph.md>` | `--out <claims.json>` (required) | never (a malformed claim table exits `2`) |
 
 ## 11. Fidelity gate
@@ -278,18 +280,18 @@ Every number, quotation, and chart value in a reader-facing edition comes from t
 node "$SKILL_DIR/scripts/report-tools.mjs" source snapshot --id S4 --url https://example.org/bridge --session-dir "$SESSION_DIR"
 node "$SKILL_DIR/scripts/report-tools.mjs" fact add --source S4 --find "Span length" --label span_len --session-dir "$SESSION_DIR"
 node "$SKILL_DIR/scripts/report-tools.mjs" fact quote --source S4 --match "no earlier than 2027" --label completion --session-dir "$SESSION_DIR"
-node "$SKILL_DIR/scripts/report-tools.mjs" fact derive --op convert F1 --to mm --label span_mm --session-dir "$SESSION_DIR"
+node "$SKILL_DIR/scripts/report-tools.mjs" fact derive --op convert F1 --to mm --label span_mm --now "$(date -u +%Y-%m-%dT%H:%M:%SZ)" --session-dir "$SESSION_DIR"
 node "$SKILL_DIR/scripts/report-tools.mjs" claims index "$SESSION_DIR/claim-graph.md" --out "$SESSION_DIR/claims.json"
 node "$SKILL_DIR/scripts/report-tools.mjs" fact fill "$SESSION_DIR/report.src.html" --out "$SESSION_DIR/report.html" --session-dir "$SESSION_DIR"
 node "$SKILL_DIR/scripts/report-tools.mjs" fact verify "$SESSION_DIR/report.html" --session-dir "$SESSION_DIR"
 ```
 
-- **Snapshot.** A source directory is immutable: the same id with identical text is a no-op, different text fails with `snapshot_exists`, because ledger rows pin the old hash; use a new id. `--url` fetches with plain fetch (30 s timeout, no browser) and records extractor `tool:source-snapshot@1`. `--html` and `--text` import a capture the browser lane saved and record extractor `model` (lower trust), or the named extractor with `--text --extractor NAME@VERSION`. `--command` runs an argv without a shell, snapshots its stdout, and writes `command.json` with the argv, working directory, exit status, and output hashes.
+- **Snapshot.** A source directory is immutable: the same id with identical text is a no-op, different text fails with `snapshot_exists`, because ledger rows pin the old hash; use a new id, or `--replace` while no active row cites the id (the `conversion_altered_number` recovery). `--url` fetches with plain fetch (30 s timeout, no browser) and records extractor `tool:source-snapshot@1`. `--html` and `--text` import a capture the browser lane saved and record extractor `model` (lower trust), or the named extractor with `--text --extractor NAME@VERSION`. `--command` runs an argv without a shell, snapshots its stdout, and writes `command.json` with the argv, working directory, exit status, and output hashes.
 - **Register.** `fact add` locates one quantity deterministically (`--find`: the first numeral within 80 characters after a unique anchor, in the same sentence; `--table`/`--row`/`--col` by header labels; `--page`/`--line`) and prints the row with 60 characters of source context on each side (`--json` for the full row). `fact quote` stores the whole containing sentence. The row records the source's kind, URL, host, and whether the brief's source floor points at it. A failed locate writes nothing.
 - **Write by reference.** Placeholders: `{{F12:span_len}}` (value and unit), `{{F12:span_len:value}}`, `{{F12:span_len:unit}}`, `{{F12:span_len:q}}` (with the source qualifier), `{{Q7:completion}}`, `{{Q7:completion:lead=8}}`, `{{Q7:completion:from="no earlier":to="2027"}}`. The label must equal the row's label.
 - **Fill.** `fact fill` is all or nothing: on `pointer_label_mismatch`, `unresolved_placeholder`, `quote_anchor_unresolved`, or `unit_duplicated` it exits `1` and writes nothing. On success it writes the output and `<out>.fill-map.json`. `--view` prints the rendered text without writing; `--inline` builds the inline edition (local stylesheets and scripts inlined, image paths made absolute) from the same source; `--format md` and `--format tex` fill Markdown and LaTeX sources; `--replace-failed` replaces a sentence that failed twice with an attributed block quote of its source.
 - **Verify.** `fact verify` writes its record (default `fidelity-defects.json`; `--out` for another edition) with the verified file's `artifact_sha256`, reads `claims.json` and the locked `## Fidelity` block of `brief.md`, and exits `1` on any blocker or major defect; minors alone exit `0`. A Markdown edition (`--format md`, or a `.md` path) is verified with its fill map; a LaTeX edition is verified through its Markdown source, so `--format tex` exits `2`.
-- **Meaning.** With `meaning check: on`, `fact pairs` writes the pairs a separate reader session judges, and `fact meaning-check` turns the readers' verdicts into `fidelity-meaning-defects.json` and the calibration log (verdict schema in [fact-ledger.md](fact-ledger.md)). No script calls a model.
+- **Meaning.** With `meaning check: on`, `fact pairs` writes the pairs a separate reader session judges, and `fact meaning-check --edition <format>` turns the readers' verdicts into that edition's `fidelity-meaning-defects.<format>.json` and the calibration log; run both once per delivered edition whose source bytes differ (the inline edition, a Markdown or LaTeX source) (verdict schema in [fact-ledger.md](fact-ledger.md)). No script calls a model.
 - **Export.** `fact export --csv --out "$SESSION_DIR/assets/<chart>.csv"` writes `fact_id,label,plot_value,unit` for every active value row, the only data a chart may plot, and prints `N of M sources snapshotted, by extractor: ...` for the closing briefing.
 
 Derivations are computed in exact rationals from the operands' stored values and rendered at the operands' fewest significant figures; a refused operation exits `1` with `incompatible_operands` and writes no row.
@@ -304,4 +306,4 @@ Derivations are computed in exact rationals from the operands' stored values and
 | `convert` | one id, `--to <unit>` | a known conversion between the units |
 | `expr` | a formula over ids, `+ - * /`, `0`, `1`, `100`, `--unit`, `--rationale` | none (recorded `unchecked`) |
 
-Exit codes: `0` ok; `1` a semantic failure (`fact_not_located`, `fact_ambiguous`, a fill error, `incompatible_operands`, `snapshot_exists`, or a verify record with a blocker or major defect); `2` usage, an unreadable input, or an invalid ledger write.
+Exit codes: `0` ok; `1` a semantic failure (`fact_not_located`, `fact_ambiguous`, a fill error, `incompatible_operands`, `snapshot_exists`, `snapshot_pinned`, or a verify record with a blocker or major defect); `2` usage, an unreadable input, or an invalid ledger write.

package/packages/omo-codex/plugin/skills/ulw-research/references/fact-ledger-grammar.md

@@ -50,7 +50,7 @@ Always required, never null: `fact_id`, `kind`, `raw` (string), `quote` (string)
 | `snapshot_sha256` | sha256 | sha256 | sha256 or null | sha256 or null | sha256 or null |
 | `rationale` | string or null | string or null | string or null | non-empty | string or null |
 | `exact` | from `value` | null | reduced rational | rational or null | reduced rational |
-| `context` | null | null | written by derive (object or null) | null | written by derive (object or null) |
+| `context` | quote context or null (legacy) | quote context or null (legacy) | written by derive (object or null) | null | written by derive (object or null) |
 | `operation` | null | null | sum/diff/growth/share/ratio/expr | null | `convert` |
 | `precision` | null | null | `{ places, sigfigs }` | null | `{ places, sigfigs }` |
 | `compatibility` | null | null | checked or unchecked (expr) | null | checked or unchecked (expr) |
@@ -61,8 +61,12 @@ Always required, never null: `fact_id`, `kind`, `raw` (string), `quote` (string)
   it when the caller leaves it null. Derived and converted rows get it from
   derive (plan todo 9): a converted value's rational comes from the original and the factor,
   not from the rounded `value`, so `addRow` never computes it from `value`.
-- `locator` is `{ artifact, char_start <= char_end, page?, line?, table?, row_label?,
-  col_label? }`.
+- `locator` is `{ artifact, char_start <= char_end, unit?, page?, line?, table?, row_label?,
+  col_label? }`: `char_start/char_end` are a half-open byte range of `artifact` (raw.bin, or
+  text.txt for a declared or converted extraction) in its own encoding; new rows write
+  `unit: "bytes"`. No unit marks a legacy text locator.
+- Source `snapshot_sha256` binds the pinned body exactly (raw.bin; text.txt for converted-only). Source `context` is `{prefix, suffix}`, each
+  at most 32 Unicode characters copied around the value span, or the whole quote for Q rows.
 - All other fields are nullable with the types in `fact-ledger-schema.mjs`.
 
 Exact rational integer strings are canonical: no leading zeros, negative zero, negative denominator,

package/packages/omo-codex/plugin/skills/ulw-research/references/fact-ledger.md

@@ -8,17 +8,46 @@ Every command is `node "$SKILL_DIR/scripts/report-tools.mjs" <command> --session
 
 | Path | Written by | Holds |
 | --- | --- | --- |
-| `sources/S<n>/text.txt` | `source snapshot` | the extracted text the locators read (one line per block; pages joined by a form feed); `sha256` covers this file |
-| `sources/S<n>/source.html` | `source snapshot` (page sources) | the captured page, read by the table locator |
-| `sources/S<n>/meta.json` | `source snapshot` | `source_id`, `url`, `observed_at`, `sha256`, `extractor`, `revision`, `kind`, `provenance` |
+| `sources/S<n>/raw.bin` | `source snapshot`, `source refresh` | bytes exactly as fetched or captured (absent only for a converted-only source); `snapshot_sha256` is sha256 of this file |
+| `sources/S<n>/text.txt` | `source snapshot`, `source refresh` | the locator text (below): the visible text of a page, the decoded bytes of a document, or a declared or converted extraction; one line per block, pages joined by a form feed |
+| `sources/S<n>/source.html` | `source snapshot` (page sources) | the captured page decoded to UTF-8, a reading aid; locators never read it |
+| `sources/S<n>/meta.json` | `source snapshot`, `source refresh` | `source_id`, `url`, `observed_at`, `sha256`, `extractor`, `revision`, `kind`, `provenance`, `text_source`, `charset`, and `text_sha256` for a declared extraction |
 | `sources/S<n>/sentences.jsonl`, `acronyms.json` | `source snapshot` | the sentence index (`S<n>:s<k>`) and the acronym table the fidelity gate reads |
 | `sources/S<n>/command.json` | `source snapshot --command` | argv, working directory, exit status, stdout and stderr hashes |
 | `fact-ledger.json` | `fact add`, `fact quote`, `fact derive`, `fact retract` | `{ schemaVersion: 1, rows, events }` |
 | `claims.json` | `claims index` | the claim table and the `verified-claims` membership |
 | `fidelity-defects.json` | `fact verify` | the verify record: the fidelity envelope (`record_kind: "fidelity"`, `artifact_sha256`, `report`, `written_at`, `defects`) plus `command`, `status`, `exitCode`, `format`, `counts`, `gatesRun` |
-| `fidelity-meaning-defects.json` | `fact meaning-check` | the meaning record: the fidelity envelope (`record_kind: "meaning"`) plus the run fields under Meaning verdicts |
+| `fidelity-meaning-defects.<format>.json` | `fact meaning-check --edition <format>` | one delivered edition's meaning record (without `--edition`, the legacy session record `fidelity-meaning-defects.json`): the fidelity envelope (`record_kind: "meaning"`) plus the run fields under Meaning verdicts |
 
-A source directory is immutable. Snapshotting the same id again with the same text is a no-op; different text fails with `snapshot_exists`, because rows pin the snapshot hash.
+A source directory is immutable. Snapshotting the same id with the same raw bytes is a no-op; different bytes fail with `snapshot_exists`, because rows pin the snapshot hash; `source refresh` (below) is the one explicit repin. `source snapshot --replace` swaps in a corrected capture under the same id only while no active row cites it (otherwise `snapshot_pinned`, listing the rows); the replacement drops the old `command.json`, and `source.html` and `conversion.json` follow the new capture. A `--text <verified.txt> --replace` over a source that has `raw.bin` keeps those bytes and records the verified text as their declared extraction (`text_source: declared`, measurable, `locator.artifact` `text.txt`); plain `--text` without `--replace` stays converted-only.
+
+Page snapshotting (`--url`, `--html`, or an HTML `--raw`) probes its conversion to the locator text and writes `sources/S<n>/conversion.json` through `writeFidelityRecord` (the `source_conversion` envelope with `conversion_altered_numbers`, `lost`, `raw_count`, `converted_count`); `source snapshot` prints the altered list. `fact add` and `fact quote` refuse a located value, or a number in its sentence, that the list names (`conversion_altered_number`, no row written): write a verified text of the source, run `source snapshot --id S<n> --text <verified.txt> --replace`, and add from it. Numbers are compared with one grouped-number grammar (a 1-3 digit lead, 3-digit groups with one separator type, no digit after the last group; a lone period group such as `1.234` is a decimal). A cell, row, list-item, block or line break never joins digits, digits from a link target, image source, alt text or title cover a converted number only inside Markdown link or image syntax, a converter's line-start list marker (`1. `, `2) `, `(3) `) is exempt only when the source has an `<ol>` item with that number and the markers do not outnumber the `<ol>` items (lazy `1. 1. 1.` numbering passes), a numeric reference label (`[x][1]` with its `[1]: url`) is link syntax, a footnote definition (`[^1]: text`) exempts only its label and its text stays prose, and a space-grouped number a hard wrap split over one line break is read whole when the source holds it whole and not both halves (raw `12 345 and 12 and 345` wrapped inside `12 345` reports both halves). A `-` or U+2212 after a single letter (`x-5`) or an exponent (`1e-5`) is a sign; after an identifier such as `cite_note-7` or `UTF-8` it is not. Markdown markup never decides a sign: emphasis, code, strike, link or image closers before a dash are skipped, read with the CommonMark inline grammar (titles, parentheses inside a target, reference endings and backslash-escaped closers included: `**2019**-2023` and `[1990](/wiki/1990 "1990")-2000` are ranges, `*UTF*-8` an identifier), and an opener between a sign and its digits (`-**5**`) keeps the sign. Named character references (`&minus;`, `&thinsp;`, `&numsp;`) are decoded on both sides with one table, so a verbatim copy probes clean. Raw inline HTML a converter leaves in its Markdown (pandoc's gfm writer keeps `<sup>`, `<sub>`, sized `<img>`, `<span>`, `<br>`) is read with the same tag reader as the raw side: `<sup>`, `<sub>` and break tags are boundaries, any other tag or comment is dropped with its attributes. A reference definition's title may sit alone on the next line. `source probe-conversion <raw-file> <converted-file>` runs the same probe on your own conversion; `lost` is a warning only.
+
+### Conversion probe scope
+
+The probe guarantees these converter outputs: CommonMark links and images (inline, reference and autolink forms, titles, balanced parentheses, backslash escapes), emphasis, strike, code spans and lists; the tag set the html-lite tokenizer reads (`<sup>`, `<sub>`, the block and break tags as boundaries, every other tag and comment dropped); and the named-entity table in `scripts/entities.mjs` plus decimal and hex numeric references. A number the converter left unchanged inside this scope is not reported as altered.
+
+#### Declared out of scope
+
+- Custom converter syntaxes: shortcodes (`{{< figure src="chart-2019.png" >}}`), attribute blocks (`![x](i.png){width=640}`).
+- MathJax and LaTeX (`$\frac{3}{4}$`, `\(\sqrt[3]{8}\)`).
+- Non-CommonMark tables: AsciiDoc table attributes (`[cols="1,3"]`), and a spanning cell repeated once per column.
+- Footnote extensions beyond pandoc's, such as numbered back-reference titles (`"Jump back to footnote 2 in the text"`).
+- A reference definition whose destination sits on the next line, a legacy reference without its semicolon (`&nbsp`), a numeric reference padded past 6 hex or 7 decimal digits, and a converter that writes the text's `&` unescaped where it spells a reference.
+
+Anything outside the guaranteed scope gets no allowance: every digit such a construct adds or reshapes is reported as altered (the safe direction: `fact add` refuses the number, it is never silently accepted). Recover with a verified text: `source snapshot --id S<n> --text <verified.txt> --replace`, then add from it. The probe's class table in the source repository has a row per example above that asserts the altered report, so the boundary is tested.
+
+
+## Snapshot and locator contract
+
+This is the one definition; `SKILL.md` and the collection reference point here.
+
+- **Raw means the captured bytes** of what the run fetched: the page HTML (`--url`, `--html`), a saved file (`--raw <file>`), a PDF, or a command's stdout (`--command`). `snapshot_sha256` is sha256 of `raw.bin`.
+- **A `--text` file is never raw.** `source snapshot --text <file>` alone registers a converted-only source (`kind: converted-only`, no `raw.bin`): `fact add` on it fails with `snapshot_not_raw`, and `fact quote` works but every quote carries the minor `quote_converted_only` warning (printed by `fact quote` with or without `--json`, and reported again by `fact verify`). `--raw <bytes> --text <extraction> --extractor NAME@VERSION` keeps the original bytes and declares the text their extraction (a PDF and its `pdftotext` output); `raw.bin` and `text.txt` are then both pinned (`sha256`, `text_sha256`). An HTML `--raw` file is read as a page, so the text only names the extractor. `--raw` with `--url`, `--html`, or `--command` is a usage error.
+- **Locators match the reader-visible text, never markup.** For a page, the locator text is its text nodes in reading order: attribute values, CSS, `<head>`, `<script>`, `<style>`, `<svg>`, `<noscript>`, `<template>`, code-like elements, and anything hidden from every reader contribute nothing, so a number there can never be located or quoted. Hidden means `aria-hidden="true"`, the `hidden` attribute (not `hidden="until-found"`), a closed `<dialog>`, `display:none` or `content-visibility:hidden` (with their descendants), and `visibility:hidden` or `collapse` (inherited until a descendant sets `visibility:visible`), as set by an inline style or by a rule in the page's own `<style>` elements; `opacity:0`, clipping, zero size, off-screen positioning and text color do not hide. A rule hides only when it applies under every condition: its selector is one tag name, one `.class` or one `#id` (class and id names match case-sensitively, tag names do not), it sits outside every at-rule other than `@layer` and `@media all`, and its `<style>` has no `media` other than `all`. Conditional at-rules (`@media`, `@supports`, `@container`, `@scope`, `@starting-style`) are not applied as hiding rules, and external stylesheets, scripts and compound selectors are not evaluated, so text they hide still counts as visible; a conditional or compound rule that would show the element again under the cascade (importance, inline style, layer, specificity, order) keeps its text visible, since some reader sees it. A quote may span inline markup (`opens <em>no earlier</em> than 2027`), and an unclosed element ends at its block, never at the end of the document. `sentences.jsonl` indexes the same text, so a row's `sentence_id` names its sentence there.
+- **Offsets are bytes of the artifact, in its own encoding.** `locator.artifact` is `raw.bin` (pages and documents) or `text.txt` (declared and converted extractions), `locator.unit` is `bytes`, and `char_start/char_end` are a half-open byte range of that file: the decoded text keeps a map back to the raw bytes (charset from a BOM, `--charset` or the HTTP header, then a `<meta charset>`; UTF-8 by default), so Latin-1 or EUC-KR pages are counted in their own bytes, never through a re-encode. `value_span` is in UTF-16 code units of `quote`. A row without `unit` is a legacy locator into `text.txt`.
+- **Verification fails closed.** `fact verify` reads every snapshot a cited row rests on; when the sources directory, `meta.json`, `raw.bin`, or `text.txt` cannot be read, each such row gets the blocking `snapshot_hash_mismatch` naming the cause (`ENOENT`, `EACCES`, invalid metadata), the verify record is still written, and rows on healthy sources are checked as usual.
+- **Sessions from before this contract** (rows without `locator.unit: "bytes"`) keep verifying against their pinned `text.txt`, but `fact add` refuses their legacy snapshots: snapshot the source again under a new id to add rows.
 
 ## Row fields
 
@@ -31,7 +60,8 @@ A source directory is immutable. Snapshotting the same id again with the same te
 | `raw`, `quote`, `value_span` | the source's own characters for the value, the whole containing sentence or cell, and where `raw` sits inside `quote` |
 | `qualifier` | a bounding word the source puts on the value: `upper_inclusive` (up to, at most), `lower_inclusive` (at least), `approximate` (about), `near` (nearly), `lower_exclusive` (over, more than), `upper_exclusive` (under, less than) |
 | `source_id`, `snapshot_sha256`, `sentence_id` | the snapshot the row was read from, its hash at that moment, and the sentence id |
-| `locator` | where `quote` sits in `text.txt` (`artifact`, `line`, `page`, `char_start`, `char_end`, and `table`, `row_label`, `col_label` for a table cell), plus the source's `source_kind`, `url`, `host`, and `pointed` (whether the brief's source floor names it) |
+| `locator` | where `quote` sits: `artifact` (`raw.bin` or `text.txt`), `unit: "bytes"`, and `char_start/char_end`, a half-open byte range of that artifact (see the contract above); absent unit identifies a legacy row. Also `line`, `page`, table labels, `source_kind`, `url`, `host`, and `pointed` |
+| `context` | source rows: `{prefix, suffix}`, up to 32 Unicode characters each around the value span (around the whole quote for quote rows), copied before normalization; null on legacy rows |
 | `extracted_by` | the snapshot's extractor: `tool:source-snapshot@1` (fetched or executed by the script), `model` (a capture the browser lane imported; lower trust), or `extractor:<name>@<version>`; `fact-derive` for a derivation |
 | `observed_at`, `valid_at` | when the row was registered, and the period the value describes (`--valid-at`) |
 | `entity`, `population`, `accounting_basis`, `observation_id` | declarations the derivations check (`--entity`, `--population`, `--accounting-basis`, `--observation O<n>`) |
@@ -50,6 +80,10 @@ A source directory is immutable. Snapshotting the same id again with the same te
 
 A locator that finds nothing returns `fact_not_located`, more than one candidate `fact_ambiguous`, and nothing is written. Read the printed row and its 60 characters of context on each side before using it; a wrong row is retracted, never edited.
 
+`fact verify` rehashes each snapshot against its metadata and each cited row's pin; drift is `snapshot_hash_mismatch` even if the quote could relocate. Verification never rewrites the ledger or silently repins a hash.
+
+`source refresh S<n>` is the explicit repin: it re-fetches the source's URL (or reads the new capture given with the `source snapshot` input flags), replaces the snapshot, and re-anchors every active byte-located row on that source by its exact quote plus its stored context. A row found exactly once gets the new `snapshot_sha256` and keeps its old locator, so `fact verify` then reports the minor `relocated` with the old and new byte offsets; a row whose quote is gone, or found more than once with the same context, keeps its old pin, is reported as `quote_not_verbatim`, and stays a `snapshot_hash_mismatch` blocker until it is retracted or added again (exit 1).
+
 ## Meaning verdicts
 
 `ingestVerdicts(pairs, verdictFiles, options)` (`scripts/meaning-check.mjs`) folds the meaning readers' verdict files over the pairs of `extractPairs` and returns four lists:
@@ -63,7 +97,7 @@ A locator that finds nothing returns `fact_not_located`, more than one candidate
 
 Coverage is fail-closed. A consumer treats a non-empty `unverified` list as blocking: those pairs were never read, so an empty `defects` list does not mean the report is clean. An unreadable verdict path or invalid JSON raises a `TypeError` naming the file, which the CLI maps to exit code 2.
 
-`fact meaning-check` writes these lists into `fidelity-meaning-defects.json` through the one fidelity record writer (`writeFidelityRecord` in `scripts/fidelity-records.mjs`). The record is the envelope every fidelity record carries, `record_kind` (`meaning`), `artifact_sha256` and `report` (copied from `pairs.json`, so the record names the edition the readers judged), `written_at`, and `defects` (the folded defects plus one `meaning_unverified` per unread pair), followed by the run fields `command`, `status`, `exitCode`, `run_id`, `pairs_sha256`, `counts`, `dropped`, `unverified`, `calibration_path`, `calibration_written`, `calibration_replaced`, and `promotion_eligibility`. Any other field makes the record malformed. A pairs file without `artifact_sha256` and `report` exits 2 before anything is written. The delivery barrier refuses the record when no delivered edition's source bytes hash to its `artifact_sha256`, so a rewrite needs a fresh `fact pairs` and reader run.
+`fact meaning-check` writes these lists into the edition's meaning record (`fidelity-meaning-defects.<format>.json` with `--edition <format>`, else `fidelity-meaning-defects.json`) through the one fidelity record writer (`writeFidelityRecord` in `scripts/fidelity-records.mjs`). The record is the envelope every fidelity record carries, `record_kind` (`meaning`), `artifact_sha256` and `report` (copied from `pairs.json`, so the record names the edition the readers judged), `written_at`, and `defects` (the folded defects plus one `meaning_unverified` per unread pair), followed by the run fields `command`, `status`, `exitCode`, `run_id`, `pairs_sha256`, `counts`, `dropped`, `unverified`, `calibration_path`, `calibration_written`, `calibration_replaced`, and `promotion_eligibility`. Any other field makes the record malformed. A pairs file without `artifact_sha256` and `report` exits 2 before anything is written. The delivery barrier binds each delivered edition to its own record (else any edition meaning record for the same bytes, else the legacy file) and refuses that edition when its source bytes do not hash to the record's `artifact_sha256`, so a rewrite needs a fresh `fact pairs` and reader run for that edition.
 
 ## Operations
 
@@ -72,7 +106,7 @@ Coverage is fail-closed. A consumer treats a non-empty `unverified` list as bloc
 - `fact derive --op <sum|diff|growth|ratio|share|convert|expr> ...` computes a new row from active rows and prints its id; the placeholder uses that id. Operands go by position for sum, diff, and convert (`--to <unit>`), as `--from/--to`, `--part/--whole`, or `--num/--den` for growth, share, and ratio, and as one formula argument for expr. Every op except convert declares its result unit with `--unit <unit>` (`--unit null` for dimensionless); a `%` sum also needs `--disjoint --reference <denominator> --rationale <why>`. The unit rules are in `unit-rules.md`.
 - `fact retract <id> --reason <why>` retires a row; `--replacement <id>` marks it superseded by another active row. Rows that depend on a retired row fail at fill time.
 - `fact export --csv --out <file>` writes `fact_id,label,plot_value,unit` for every active value row: the only data a chart may plot.
-- `fact fill <src> --out <file>` renders every placeholder from the ledger; `fact verify <file>` checks the filled edition against the ledger, the snapshots, and the claim index; `outcome set <format> delivered` records intent permissively, while the required `outcome verify` and `outcome finish` enforce the delivery barrier.
+- `fact fill <src> --out <file>` renders every placeholder from the ledger; `fact verify <file>` checks the edition against the ledger, snapshots, and claim index. A `:value` placeholder keeps its unit in metadata: verify checks the unit written right after the value (with or without a space, a Korean particle allowed: `{{F1:span_len:value}} m`, `{{F3:rate_yoy:value}}%`), a currency sign right before it, its `:unit` element, and the header of its visual table column. The unit after the value is read through inline markup, line breaks and parentheses (`{{F1:span_len:value}} <b>m</b>`, `{{F1:span_len:value}}<br>m`, `{{F1:span_len:value}} (m)`), with a Korean particle or qualifier glued on; a qualifier word on its own (the Korean qualifiers such as chogwa "over" or jeongdo "about", or `or more`) is never read as a unit, and an English unit alias that is also an ordinary word (`won`, `second`, `pound`) counts only as the row's own unit or beside a currency sign or column header of its kind (`$320 pounds` blocks). The longest unit the words after the value spell is the one read, so a longer unit that starts with the row's unit is never taken for it (`12 % p`, `12 percent points` and the spaced Korean percent-point spellings are `%p`, not `%`); English words join only as a spaced alias (`percentage points`), so `m in` stays `m`. Fill records the mode and the unit bound to each value (after it, as its currency sign, or in its column header) in the fill map as `unit_bound`, and verify reads that map for HTML too, so deleting `data-fact-mode`, or replacing or deleting a bound unit, still blocks. A conflicting unit blocks with `unit_mismatch`; no recognizable unit warns with `unit_unbound`. `outcome set <format> delivered` records intent; `outcome verify` and `outcome finish` enforce delivery.
 - `fact pairs <file>` writes `pairs.json` for the meaning readers; `fact meaning-check --pairs pairs.json --verdicts <file> ...` ingests their verdicts.
 
 ## Meaning command

package/packages/omo-codex/plugin/skills/ulw-research/references/fidelity-claim-kinds.md

@@ -11,7 +11,7 @@ A `verified` claim is satisfied only when the cited row itself has a locator art
 |---|---|---|---|---|---|---|---|
 | `fact` | `{{F12:label}}` | none (or `data-claim-kind="fact"`) | `measured`, `converted`, `derived` | any | `claim_kind_mismatch` | none | Accepts exactly what an unmarked numeral accepts, so marking fact is never stricter than not marking. Neither accepts an `assumed` row: an unmarked assumption reads as a fact, so it needs its `{{A:F12:label}}` mark (`claim_kind_mismatch` otherwise). |
 | `quote` | `{{Q7:label}}` | none (or `data-claim-kind="quote"`) | `quote` | any | `claim_kind_mismatch` | none | - |
-| `verified` | `{{V:F12:label}}` | `data-claim-kind="verified"` | `measured`, `quote` | `command` | `unsupported_verification` | `verification_claim_unmarked` on a first-person run: we/I (have) ran, run, executed, verified by (not ran out of); by running after we/our in the sentence; \uC6B0\uB9AC or \uC800\uD76C as the subject word (+ \uAC00, \uB294, or \uD300\uC774), then \uC2E4\uD589\uD588, \uC2E4\uD589\uD558\uC5EC, \uC2E4\uD589\uD574, \uB3CC\uB838, or \uB3CC\uB824 in the clause with no third-party subject between; \uC9C1\uC811 with no third-party subject, then \uC2E4\uD589 or \uB3CC\uB9AC in the clause | The cited row itself must have a locator artifact inside `sources/<source_id>/` whose `meta.json` kind is `command`; another command row in the sentence never counts. Whether it is the right command for the claim is the meaning verifier's call (minor), not this gate's. |
+| `verified` | `{{V:F12:label}}` | `data-claim-kind="verified"` | `measured`, `quote` | `command` | `unsupported_verification` | `verification_claim_unmarked` on a first-person run: we/I (have) ran, run, re-ran, re-run, executed, verified by (not ran out of), or by running after we/our in the sentence; a first-person check: we/I (have) verified, checked, confirmed, measured, tested, double-checked, cross-checked (not checked in/into/out) with a result object in the clause (value, values, result, results, figure, figures, number, numbers, total, totals, count, counts, measurement, measurements, reading, readings, output, outputs, span, length, rate, rates, latency, throughput, score, scores, benchmark, benchmarks, metric, metrics, data, estimate, estimates, speed, duration, size, ratio, growth, or a digit) and no document named before the clause ends (report, reports, filing, filings, document, documents, paper, papers, article, articles, publication, statement, disclosure, website, page, docs, documentation; a comma, a semicolon, or as, which, who, whom, whose, where ends it, and a document word followed by a number is a locator); \uC6B0\uB9AC or \uC800\uD76C as the subject word (+ \uAC00, \uB294, or \uD300\uC774), then \uC2E4\uD589\uD588, \uC2E4\uD589\uD558\uC5EC, \uC2E4\uD589\uD574, \uB3CC\uB838, or \uB3CC\uB824 in the clause with no third-party subject between, or then \uD655\uC778, \uAC80\uC99D, \uCE21\uC815, \uC810\uAC80 + \uD588, \uD558\uC600, \uD558\uC5EC, \uD574, \uD55C with a result object in the clause (\uACB0\uACFC, \uAC12, \uC218\uCE58, \uAE38\uC774, \uD569\uACC4, \uBE44\uC728, \uC18D\uB3C4, \uC9C0\uD45C, \uB370\uC774\uD130, or a digit) and no document before the clause ends (\uBCF4\uACE0\uC11C, \uBB38\uC11C, \uACF5\uC2DC, \uB17C\uBB38, \uAE30\uC0AC, \uC790\uB8CC; a comma, a semicolon, or \uCC98\uB7FC, \uB4EF\uC774, \uAC19\uC774 ends it, and a document word followed by a number is a locator); \uC9C1\uC811 with no third-party subject, then \uC2E4\uD589 or \uB3CC\uB9AC in the clause; a curly apostrophe reads as a straight one | The cited row itself must have a locator artifact inside `sources/<source_id>/` whose `meta.json` kind is `command`; another command row in the sentence never counts. Whether it is the right command for the claim is the meaning verifier's call (minor), not this gate's. |
 | `derived` | `{{D:F12:label}}` | `data-claim-kind="derived"` | `derived`, `converted` | any | `claim_kind_mismatch` | none | - |
 | `assumed` | `{{A:F12:label}}` | `data-claim-kind="assumed"` | `assumed` | any | `claim_kind_mismatch` | none | Numeric assumptions only (an assumed ledger row carries a decimal value); a qualitative assumption stays prose. |
 <!-- claim-kinds:end -->

package/packages/omo-codex/plugin/skills/ulw-research/references/markdown-blocks.md

@@ -0,0 +1,12 @@
+# Markdown block boundaries
+
+The light Markdown model preserves the documented CommonMark paragraph interruption rule:
+only an ordered marker numbered `1` interrupts an open paragraph. In
+`1. a\ncontinued\n2. b`, the blocks remain a list item `a` and a paragraph
+`continued\n2. b`. The model does not attach the unindented continuation to the
+preceding list item. The `2` remains paragraph text with its original source
+offset; fidelity numerals in either block remain available to the numeral parser.
+
+A closing code fence permits at most three leading spaces. A candidate indented
+four spaces stays code; without a later valid close the parser reports
+`unterminated_fence` instead of exposing the code as report prose.

package/packages/omo-codex/plugin/skills/ulw-research/references/report-gates.md

@@ -15,7 +15,7 @@ This reference catalogs every defect code the report gates (`static`, `fidelity`
 | `en_dash_in_prose` | minor | false | En dashes (–) are used incorrectly outside of numeric ranges. Only numeric ranges (e.g., "pages 5–10") should use en dashes. | Use a hyphen for compounds; keep the en dash only between numbers. |
 | `heading_too_long` | minor | false | A heading exceeds one visual line: 26 Korean characters (52 display width units) or 12 English words. | Shorten the heading to one line (26 Korean characters or 12 English words). |
 | `heading_generic` | minor | false | A heading uses generic labels (e.g., "Introduction", "Background") without conveying the section's specific claim or finding. | Make the heading carry the section's claim instead of a generic label. |
-| `unsourced_number` | major | false | A numeric value (percentage, count, duration, ratio) appears without a source attribution, measurement tag, or derivation chain. | Tag the number MEASURED / ASSUMED / DERIVED or cite its source in the same paragraph. |
+| `unsourced_number` | major | false | A numeric value (percentage, count, duration, ratio) appears without source attribution or lineage. Under Sources, an element is split at line breaks and sentence ends, and a sentence is checked exactly as under any other heading unless every numeral in it is a citation-field number: a year, a full date, or a month/day (`10/26`, `Oct 26`, `2026. 10. 26.`; a day count such as `30 days` is checked); a page, volume, issue, number, or edition marker; a number inside a URL, DOI, arXiv id, ISBN, or ISSN; a number inside a quoted title (straight or curly quotes, corner brackets, `<cite>`, or an `<i>`/`<em>` title directly before a URL or date); a number inside link text; or a citation tag's digits. A year range (`2019-2023`, `2019~2023`) is a date. A digit run glued to letters that are not a unit, multiplier, or currency is a name, not a numeral (a commit hash, `#123`, `GPT-4`, `v2.3.1`, `Q3`, `FY27`, `10-Q`), and so is a dotted version (`0.30.14`); `50M`, `10k`, `3x`, `x3`, `2.5GB`, `320m`, `12%`, `5mn`, `40pct`, `5yrs`, and the European grouping `1.234.567` stay numerals. A unit, multiplier, or percent on the right is read before the letters on the left, so a word glued in front of a measure (`rate40%`, or a Korean word written solid before `300` and a counter) keeps it a numeral; Latin letters on both sides make an identifier (`W3C`). A Korean ordinal (the je prefix, the jjae suffix, the cha counter) is a name and a Korean quarter (N bungi) is a date, like `Q3`; a two-digit dotted date (`26.10.26`) is a date. Ruling consequences: `10-K` and `8-K` stay numerals because `K` is a multiplier while `10-Q` is a name, so quote a title that carries a filing code; a slashed month/day also covers fractions (`2/3`) and table scores (`7/12`), which are therefore not checked under Sources (#11386). A version, figure, or count in an unquoted title (`Llama 3.1 model card`, `Buyback $94B`, `Revenue grew 40%`) is checked; quote the title to exempt it. | Tag the number MEASURED / ASSUMED / DERIVED or cite its source in the same paragraph; under Sources only citation-field numbers and names (a hash, #12, GPT-4, Q3, 10-Q) are exempt, so quote a reference title that carries a code or a figure, or wrap it in <cite>: an unquoted one is checked, and 10-K / 8-K stay numerals because K is a multiplier. A slashed N/M reads as a month/day, so a fraction or a score (2/3, 7/12) under Sources is not checked (#11386): write it as a percent or tag it. |
 | `chart_without_figure` | major | false | An image or chart lacks a figure wrapper with a caption. Uncaptioned charts isolate visuals from narrative flow. | Wrap the image or chart in a figure container with a caption. |
 | `chart_svg_no_text` | major | false | An SVG chart or diagram lacks a title, axis labels, units, or value labels. Visuals cannot stand alone without text guidance. | Give the chart a title, axis labels, units, and value labels as SVG text. |
 | `chart_svg_missing_labels` | minor | false | An SVG chart has some labels (e.g., title) but is missing others (e.g., axis ticks or unit). | Add the missing title, axis ticks, or unit label to the chart. |
@@ -37,23 +37,26 @@ Raised only by the fidelity verifier (the fact ledger, fill, verify, meaning, an
 |------|----------|-----------|-----------------|-----------|
 | `unresolved_placeholder` | blocker | true | A fact or quote placeholder is left in the artifact, names an unknown ledger id, is malformed, or uses an unsupported mode. | Register the fact with fact add or remove the sentence; a placeholder is never filled with a guess. |
 | `value_mismatch` | blocker | true | A displayed value differs from its ledger row's rendering, or a stored derived value differs from exact recomputation (a hand edit after fill). | Re-run fact fill; never edit a filled value by hand. |
-| `unit_mismatch` | blocker | true | A displayed, adjacent, or header unit conflicts with the ledger row's unit or scale. | Re-run fact fill, or derive a converted row with fact derive --op convert. |
+| `unit_mismatch` | blocker | true | A displayed, adjacent, or header unit conflicts with the ledger row's unit or scale, or a value-mode fact lost the unit bound to it at fill (the fill map records it: the unit after the value, its currency sign, or its column header). | Re-run fact fill, or derive a converted row with fact derive --op convert. |
+| `unit_unbound` | minor | false | A value-mode fact with a ledger unit shows no recognizable unit: none right after its value (with or without a space, a Korean particle allowed), no currency sign right before it, no :unit element after it, and no unit in its visual column header (a table with a rowspan or without a th row binds no header). | Use the full fact placeholder, or write the unit right after :value (with or without a space; a Korean particle may follow), as its :unit element, or in the matching table column header. |
 | `quote_not_verbatim` | blocker | true | A quotation bound to a quote row does not match the source snapshot contiguously after normalization, or a rendered cut is not the registered cut. | Re-insert the quote through its {{Q<n>}} placeholder; after a second failure the sentence is replaced by the quote. |
 | `claim_status_invalid` | blocker | true | A sentence's claim binding names an unknown claim, a refuted or unresolved claim outside Gaps and Contradictions, or a high-risk claim absent from the verified claims. | The claim id is unknown, refuted, unresolved, or not in verified-claims; move the sentence to Gaps or Contradictions, or remove it. |
 | `incompatible_operands` | blocker | true | A derivation's operands differ in unit, population, period, or accounting basis where the operation requires them to match; derive refuses and writes no row. | The operands differ in unit, population, period, or basis for this operation; fix the rows or declare the operation that fits. |
 | `pointer_label_mismatch` | blocker | true | A placeholder's label differs from the referenced ledger row's label (a typo guard on the id). | The placeholder's label is not the row's label; check the id, then the label. |
 | `quote_anchor_unresolved` | blocker | true | A quote cut's from or to anchor is absent, occurs more than once, or appears in reverse order in the quote. | A from or to anchor is missing or occurs more than once in the quote; pick unique anchor words. |
 | `unit_duplicated` | blocker | true | A unit-bearing placeholder is followed by another copy of its own unit. | The unit after the placeholder repeats the row's unit; use :value or remove the unit. |
+| `conversion_altered_number` | blocker | true | `fact add` located a value (or a number in its sentence) that the source's conversion probe recorded as altered in `sources/S<n>/conversion.json`, such as a footnote digit glued onto it; the converted text cannot back the number, so no row is written. | The source conversion altered this number (sources/S<n>/conversion.json lists it); snapshot a verified text of the source over it with `source snapshot --id S<n> --text <verified.txt> --replace` (refused while an active row cites S<n>; then retract those rows or use a new id), then re-add the fact. |
 | `polish_diff_fail` | blocker | true | The polish pass changed protected fact spans, numerals or units, tickers, table rows, or any markup byte (including every attribute, comments, and script/style/template content). | Revert to the pre-polish artifact and apply text-node edits only; markup changes require the full fidelity gates. |
 | `fidelity_interview_incomplete` | blocker | true | A fidelity field in the brief is still pending or missing when a fidelity command runs. | A fidelity field is pending or missing in brief.md; answer the open question or record its default, then rerun. |
 | `derived_not_allowed` | blocker | true | A placeholder resolves to a derived, converted, or assumed row while the brief allows no derived numbers. | The brief allows no derived or assumed numbers; cite a source row directly or change the brief with the requester. |
 | `source_outside_floor` | blocker | true | A ledger row's source lies outside the source floor the brief records (pointed sources only, primary only, or the allowed source classes), or the row rests on no source under any floor but `standard`. | The row's source is outside the source floor the brief records; use a source the brief allows or remove the fact. |
 | `brief_changed` | blocker | true | `fact verify` reads an edition's fill map whose recorded brief hash is not the hash of the current locked `## Fidelity` block, or that records none. | The edition's fill map was not written under the current ## Fidelity block (it changed after fill, or the map predates the binding); re-run fact fill, then fact verify. |
-| `snapshot_hash_mismatch` | blocker | true | A pinned source snapshot's text no longer hashes to its recorded hash, or indexed slices no longer equal the snapshot text. | The source snapshot changed after it was pinned; re-snapshot the source and re-register its rows. |
+| `snapshot_hash_mismatch` | blocker | true | The pinned snapshot body (raw.bin; text.txt for converted-only and legacy sources) differs from its metadata or from a cited row's pinned sha256, or a cited row's sources dir, meta.json, raw.bin, or text.txt cannot be read (the message names the cause). | The source snapshot changed after it was pinned or cannot be read; restore it, or run source refresh to re-anchor its rows. |
+| `snapshot_not_raw` | blocker | true | A measured row rests on a converted-only source (no raw bytes), or `fact add` was run on such a source or on a legacy text.txt snapshot. | Measured rows need the original bytes: snapshot the source with --url, --html, or --raw <bytes> --text <extraction>; converted-only sources support warned quotations only. |
 | `chart_value_untraceable` | blocker | true | A chart data label, axis tick, or chart data file does not match the ledger-backed data the chart declares, or the chart declares no data source. | A chart value, tick, or data file does not match its ledger-backed data source; re-render the chart from the exported data. |
 | `quote_unbound` | blocker | true | A direct quotation in the report has no ledger quote row behind it; a citation marker alone does not bind it. | A direct quotation has no ledger quote row; register it with fact quote and insert it through its placeholder. |
 | `edition_unverified` | blocker | true | A delivered edition has no fact verify record whose artifact hash matches the delivered source. | The delivered file has no matching fact verify record; run fact verify on that edition and record it with --verified-by. |
-| `untraceable_number` | major | false | A number or date in prose or a table cell resolves to no ledger row and is not structural; a citation does not exempt it. | Replace the typed number with a {{F<n>}} placeholder backed by a ledger row, or register it as assumed with a rationale. |
+| `untraceable_number` | major | false | A number or date in prose or a table cell resolves to no ledger row and is not structural; a citation does not exempt it. Under Sources a sentence is traced unless every numeral in it is a citation-field number (see `unsourced_number`). | Replace the typed number with a {{F<n>}} placeholder backed by a ledger row, or register it as assumed with a rationale. |
 | `unsupported_verification` | major | false | A fact bound to a `verified` mark (`data-claim-kind="verified"`, from a `{{V:F<n>:label}}` placeholder) cites a row whose own locator artifact does not sit in a recorded command-output snapshot, or the mark binds no fact of its own. Another command row in the same sentence never counts. Unmarked prose is never raised here. | A sentence marked verified (data-claim-kind="verified") cites a row that is not recorded command output; cite the recorded output row or drop the verified mark. |
 | `claim_kind_mismatch` | major | false | A fact bound to a claim kind cites a row of a kind that claim kind does not accept, a fact sits under marks of two different kinds (nested marks), a mark binds no fact of its own, or a mark names an unknown kind; the kinds are in [fidelity-claim-kinds.md](fidelity-claim-kinds.md). | An element marked with a claim kind (data-claim-kind) cites a row that kind does not accept, or the kind is unknown; cite a row of that kind or fix the mark (references/fidelity-claim-kinds.md). |
 | `conflicting_readings` | major | false | Two active ledger rows with the same value and unit but different periods or qualifiers are cited as one fact. | Two ledger rows with different periods or qualifiers are cited as one fact; split the sentence or retire one row. |
@@ -68,11 +71,15 @@ Raised only by the fidelity verifier (the fact ledger, fill, verify, meaning, an
 | `polish_hedging_decreased` | major | false | The polish pass removed a hedge the source grounds. | The polish pass removed qualifiers; restore them. |
 | `polish_text_churn` | major | false | More than half of the visible prose changed during the polish pass (`POLISH_CHURN_LIMIT` in `scripts/polish-rules.mjs`). | More than half the text changed during polish; the pass composed instead of proofreading. |
 | `snapshot_mismatch` | major | false | An operation that needs one collection window uses operands from unequal windows or observations outside the window. | The operands come from different collection windows; use rows from one window or state the windows separately. |
+| `operand_timestamp_missing` | major | false | A windowed operation cites an operand without an observed_at timestamp. | Record the operand's observed_at timestamp before checking its collection window. |
+| `operand_missing` | major | false | A windowed operation names an operand id that is not in the fact ledger (a dangling reference, not a missing timestamp). | A windowed operation names an operand that is not in the fact ledger; restore the row or re-derive from existing rows. |
 | `join_integrity_fail` | major | false | A table row combines facts from different source observation rows, or a declared observation id contradicts the row's lineage. | A table row combines facts from different source observations; keep each row to one observation or split it. |
 | `quote_stale_version` | major | false | The quoted source revision differs from the revision the report targets for the same scope. | The quoted source revision differs from the revision the report targets; re-snapshot the target revision or date the quote. |
 | `quote_fuzzy_match` | minor | false | An exact quote match failed but a candidate with similarity of at least 0.95 and identical protected tokens exists (OCR noise); diagnostic only. | The source text is OCR-noisy; confirm the snapshot and prefer the raw document. |
+| `relocated` | minor | false | After `source refresh` repinned a source, the row's exact quote and context occur exactly once at a new byte range; old and new offsets are reported. | After source refresh the exact quote and context sit at one new byte range; review the old and new offsets (verification never rewrites the row). |
+| `quote_converted_only` | minor | false | A quote row rests on a converted-only source, so it is bound to converted text, not to the fetched bytes; `fact quote` and `fact verify` both report it. | The quote comes from a converted-only source with no raw bytes; re-snapshot the original with --raw and --text, or keep the warned quote. |
 | `name_outside_quote` | minor | false | An uppercase Latin token of 2 to 6 letters in the sentence is absent from the supporting source text and that source's acronym table. | A name in the sentence is not in the cited quote; add the source or remove the name. |
-| `verification_claim_unmarked` | minor | false | A sentence reads as a first-person run ("we ran", "we have run", "I ran", "we executed", "we verified by", "by running" after we/our, or the Korean rule in fidelity-claim-kinds.md) and cites a fact not marked `verified` (or cites none and its block is unmarked). A warning only; it never blocks. | The sentence reads as a check we ran but carries no verified mark; mark it {{V:F<n>:label}} on a recorded command-output row, or reword it. |
+| `verification_claim_unmarked` | minor | false | A sentence matches the unmarked cue rule of the `verified` claim kind (a first-person run: we/I (have) ran, run, re-ran, re-run, executed, verified by (not ran out of), or by running after we/our in the sentence; a first-person check: we/I (have) verified, checked, confirmed, measured, tested, double-checked, cross-checked (not checked in/into/out) with a result object in the clause (value, values, result, results, figure, figures, number, numbers, total, totals, count, counts, measurement, measurements, reading, readings, output, outputs, span, length, rate, rates, latency, throughput, score, scores, benchmark, benchmarks, metric, metrics, data, estimate, estimates, speed, duration, size, ratio, growth, or a digit) and no document named before the clause ends (report, reports, filing, filings, document, documents, paper, papers, article, articles, publication, statement, disclosure, website, page, docs, documentation; a comma, a semicolon, or as, which, who, whom, whose, where ends it, and a document word followed by a number is a locator); \uC6B0\uB9AC or \uC800\uD76C as the subject word (+ \uAC00, \uB294, or \uD300\uC774), then \uC2E4\uD589\uD588, \uC2E4\uD589\uD558\uC5EC, \uC2E4\uD589\uD574, \uB3CC\uB838, or \uB3CC\uB824 in the clause with no third-party subject between, or then \uD655\uC778, \uAC80\uC99D, \uCE21\uC815, \uC810\uAC80 + \uD588, \uD558\uC600, \uD558\uC5EC, \uD574, \uD55C with a result object in the clause (\uACB0\uACFC, \uAC12, \uC218\uCE58, \uAE38\uC774, \uD569\uACC4, \uBE44\uC728, \uC18D\uB3C4, \uC9C0\uD45C, \uB370\uC774\uD130, or a digit) and no document before the clause ends (\uBCF4\uACE0\uC11C, \uBB38\uC11C, \uACF5\uC2DC, \uB17C\uBB38, \uAE30\uC0AC, \uC790\uB8CC; a comma, a semicolon, or \uCC98\uB7FC, \uB4EF\uC774, \uAC19\uC774 ends it, and a document word followed by a number is a locator); \uC9C1\uC811 with no third-party subject, then \uC2E4\uD589 or \uB3CC\uB9AC in the clause; a curly apostrophe reads as a straight one; rendered from CLAIM_KINDS, see fidelity-claim-kinds.md) and cites a fact not marked `verified` (or cites none and its block is unmarked). A warning only; it never blocks. | The sentence reads as a check we ran but carries no verified mark; mark it {{V:F<n>:label}} on a recorded command-output row, or reword it. |
 | `scope_widened_warn` | minor | false | The sentence uses a broader scope term than the quote's narrow term, and no supporting fact carries the broad scope. | The sentence uses a broader scope word than the quote; confirm the scope or narrow it. |
 | `particle_unverified` | minor | false | A particle after a filled value could not be checked against the value's final reading. | The particle after this value could not be checked; read it aloud and fix it by hand if wrong. |
 | `fallback_without_entity` | minor | false | A quote that replaced a twice-failed sentence has no entity for its attribution line. | The replacement quote has no entity for attribution; set one on the row. |