hypgraph 0.7.17__tar.gz → 0.7.18__tar.gz

{hypgraph-0.7.17 → hypgraph-0.7.18}/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.7.18 — 2026-10-31: a scoped bundle can't call an active node superseded
+
+- **A scoped bundle can't show an active node as superseded and still say its views are checked.** A re-audit of
+  0.7.17 found that a bundle naming a `scope.inv` (which the chain doesn't cover) could show any node, an active claim
+  or the investigation itself, as superseded, and verify against its published head with `views: "checked"` and
+  coverage complete: the verifier let a scoped bundle call any non-withdrawn node superseded, because links from
+  other investigations are left out. Now, in the Python and browser verifiers alike, that allowance applies only
+  when events really are redacted (without them every link is in the bundle, so the lifecycle fails) and only to a
+  type a `supersedes` or `corrects` link can point at (never an investigation or a review), and even then the views
+  are `"unconfirmed"`, not `"checked"`, with a warning naming each node; `hypgraph verify` prints
+  `views: NOT CHECKED`. The Explorer header shows a *views not checked* pill for `historical` and `unconfirmed`
+  views, and the verify page names both instead of calling them checked (`tests/test_verify_scoped_views.py`).
+- **The spec says what a verifier does with lifecycles.** `docs/spec.md` and `docs/verification.md` no longer say a
+  verifier accepts the value either rule gives: the current rule is authoritative, a 0.3-only lifecycle is
+  `historical`, a scoped one superseded from outside is `unconfirmed`, anything else fails.
+
 ## 0.7.17 — 2026-10-31: a superseded node can't verify as active
 
 - **A superseded node can't verify as active.** A pre-launch audit of 0.7.16 found that the verifier accepted a node's

{hypgraph-0.7.17 → hypgraph-0.7.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: hypgraph
-Version: 0.7.17
+Version: 0.7.18
 Summary: The evidence layer for AI research agents: a hash-chained research record that checks every claim as it is written and derives how well each is known.
 Project-URL: Homepage, https://hypgraph.com
 Project-URL: Documentation, https://hypgraph.com/engineers/

{hypgraph-0.7.17 → hypgraph-0.7.18}/docs/PLAN.md

@@ -109,7 +109,7 @@ claim's derived standing.
 Multi-writer sync between graphs (bundles cover sharing), authentication (the host's job; the HTTP server binds to
 loopback and is read-only unless started with `--writable`), and a hosted service.
 
-## Status at 0.7.17 (2026-10-31)
+## Status at 0.7.18 (2026-10-31)
 
 All seven phases are done: the library, bundles, the server and UI, the MCP server, the website, Pegasus running on
 the package, and releases to PyPI from tags with trusted publishing. What came after the plan, by release, is in

{hypgraph-0.7.17 → hypgraph-0.7.18}/docs/RELEASE-READINESS.md

@@ -58,6 +58,18 @@ was taken from a changelog without being checked against the code.*
 > **Where that stands.** #75 is merged with green CI (17 of 17 checks); from the 0.7.17 wheel in a fresh venv the
 > suite is 424 passed, and hypswarm (118 passed) and hypmesh (37 passed) pass on it. Released as 0.7.17.
 
+> **Re-audit of 0.7.17 (2026-10-31).** Confirmed and fixed for 0.7.18: a bundle naming a `scope.inv` (not covered by
+> the chain) could show any non-withdrawn node, an active claim or the investigation itself, as superseded and verify
+> against its published head with `views: "checked"` and coverage complete; the published Broad Street bundle, which
+> has no redacted events, was enough. The scoped allowance now needs redacted events and a type a `supersedes` /
+> `corrects` link can reach (never an investigation or a review), and even then the views are `"unconfirmed"`, with
+> each node named, in Python and the browser alike. The verify page and the Explorer header now say *views not
+> checked* for `historical` and `unconfirmed` views, and the spec no longer says a verifier accepts either rule.
+> Tests: `tests/test_verify_scoped_views.py`.
+>
+> **Where that stands.** #77 is merged with green CI (17 of 17 checks); from the 0.7.18 wheel in a fresh venv the
+> suite is 431 passed, and hypswarm (118 passed) and hypmesh (37 passed) pass on it. Released as 0.7.18.
+
 ## Recommendation: CONDITIONAL GO
 
 HypGraph is ready for a public developer preview once #59, #60 and #61 are merged with green CI and released as one

{hypgraph-0.7.17 → hypgraph-0.7.18}/docs/spec.md

@@ -153,7 +153,9 @@ out a change hidden among them. `scope.title` is a label; a viewer names the sco
 **What a verifier vouches for.** `ok` means the chain links and every row and event agree, both ways. `coverage:
 complete` means every row field was vouched for by its event and nothing is redacted (`partial` otherwise). `views:
 checked` means every fact the derived views show that the rows fix is present and agrees with the rows, and the
-scope is a real one; `views: none` means the bundle carries no views. None of them vouches for standing, the report,
+scope is a real one; `views: none` means the bundle carries no views. `views: historical` and `views: unconfirmed`
+mean the views verify but some lifecycles in them couldn't be checked (below), and the warning names each one: a
+viewer must not present them as checked. None of them vouches for standing, the report,
 stages or work orders (as exported), for who an author really is, or that the head was published.
 
 **Anchoring.** A bundle proves only its own consistency. To prove it wasn't rebuilt from scratch, publish its `head`
@@ -171,10 +173,16 @@ investigation node), which investigations the list shows (each once), which node
 `by` and `why`. Every one of these must be **present**, not only equal where present: a viewer fills a missing fact
 with a default, and a withdrawn claim without its lifecycle would read as active. The lifecycle is derived from the
 verified rows (withdrawn when a withdrawal exists; superseded when a live `supersedes` or `corrects` replacement is
-active or, since 0.4, itself superseded; an investigation's own `state` otherwise), and a verifier accepts the value
-either rule gives. A scoped bundle leaves out links to other investigations, so it may also call a node superseded
-(never a withdrawn node anything but withdrawn). A bundle exported without derived views verifies, and a verifier says
-it has none (`views: none`). **Standing** (review state, support, at-risk, the sentence) can't
+active or, since 0.4, itself superseded; an investigation's own `state` otherwise). A verifier checks the
+lifecycle against the current rule. A lifecycle that only 0.3's rule gives (it counted an active replacement only)
+verifies, since a 0.3 export shows it so, but the chain doesn't record which version exported a bundle, so the views
+are `historical`, not `checked`. A scoped bundle with redacted events leaves out links from other investigations, and
+one of them may replace a node: a node shown superseded with no replacement in the rows verifies only if its type can
+be replaced at all (every type but `investigation` and `review`) and it isn't withdrawn, and the views are
+`unconfirmed`, since that replacement is among the redacted events. A bundle with no redacted events holds every link,
+scoped or not, so any other lifecycle the rows don't give fails. `scope` isn't covered by the chain, so naming one
+never loosens a check on its own. A bundle exported without derived views verifies, and a verifier says it has none
+(`views: none`). **Standing** (review state, support, at-risk, the sentence) can't
 be checked from the rows alone: it is what the exporting engine derived, and so are the report, the workflow stages,
 completion, the question board and work-order status. A verifier reports them as not checked, or re-derives them with
 the same engine version (`hypgraph verify FILE --standing`, under the caller's policy with `--policy`) and compares.

{hypgraph-0.7.17 → hypgraph-0.7.18}/docs/verification.md

@@ -90,6 +90,11 @@ separate implementation.
   title and lifecycle, each link's ends and fields, the full investigation list — must be present in the derived
   views, not only right where present: a view that drops a withdrawn claim's lifecycle fails, rather than being shown
   as active. A bundle exported without derived views (`export(derived=False)`) verifies and says `views: none`.
+- **A lifecycle that can't be checked isn't called checked.** One only hypgraph 0.3's rule gives verifies with
+  `views: historical`. In a scoped bundle with redacted events, a node shown superseded with no replacement in the
+  rows (a replacement in another investigation would be redacted) verifies with `views: unconfirmed`, and only if its
+  type can be superseded at all; investigations and reviews can't. Without redacted events every link is in the
+  bundle, so such a node fails. The warning names each node; the Explorer and the verify page say *views not checked*.
 
 ## Scoped bundles and references
 

{hypgraph-0.7.17 → hypgraph-0.7.18}/src/hypgraph/__init__.py

@@ -16,7 +16,7 @@ Standing is derived on every read, never stored; every write is an event in a SH
 their numbers; reviews pin versions; independence is counted, not assumed. See https://hypgraph.com.
 """
 
-__version__ = "0.7.17"
+__version__ = "0.7.18"
 
 from .bundle import anchored, verify_bundle  # noqa: E402
 from .graph import Author, Graph, GraphError, file_sha256  # noqa: E402

{hypgraph-0.7.17 → hypgraph-0.7.18}/src/hypgraph/bundle.py

@@ -34,7 +34,7 @@ from pathlib import Path
 from typing import TYPE_CHECKING, Any
 
 from . import __version__
-from .schema import SAME_TYPE
+from .schema import RELS, SAME_TYPE
 from .store import GENESIS, ROW_TABLES, check_rows, event_body, now
 
 if TYPE_CHECKING:
@@ -242,13 +242,15 @@ def _verify_bundle(b: dict, policy: dict | None = None) -> dict:
     if problem:
         return {"ok": False, "problem": problem}
     historical: list = []
-    problem = _derived_problem(b, tables, historical)
+    unconfirmed: list = []
+    problem = _derived_problem(b, tables, historical, unconfirmed, red)
     if problem:
         return {"ok": False, "problem": f"the derived views contradict the verified record: {problem}"}
     out = {"ok": True, "checked": checked, "head": prev, "complete": red == 0, "redacted": red,
            "nodes": len(tables["nodes"]), "edges": len(tables["edges"]), "unchecked": rows["unchecked"],
            "coverage": "complete" if not rows["unchecked"] and not red else "partial",
-           "views": "none" if b.get("derived") is None else "historical" if historical else "checked",
+           "views": ("none" if b.get("derived") is None else "historical" if historical
+                     else "unconfirmed" if unconfirmed else "checked"),
            "policy": {"trusted": sorted(policy or {}), "importer": importer},
            "standing": {"checked": False, "note": STANDING_NOTE}}
     notes = []
@@ -262,19 +264,31 @@ def _verify_bundle(b: dict, policy: dict | None = None) -> dict:
                      "used.")
     if historical:
         notes.append(_historical_note(historical))
+    if unconfirmed:
+        notes.append(_unconfirmed_note(unconfirmed))
     if notes:
         out["warning"] = " ".join(notes)
     return out
 
 
+def _listed(names: list) -> str:
+    return "; ".join(names[:8]) + (f"; and {len(names) - 8} more" if len(names) > 8 else "")
+
+
 def _historical_note(historical: list) -> str:
-    shown = "; ".join(f"{name} shown {s}, the current rule makes it {w}" for name, s, w in historical[:8])
-    more = f"; and {len(historical) - 8} more" if len(historical) > 8 else ""
+    shown = _listed([f"{name} shown {s}, the current rule makes it {w}" for name, s, w in historical])
     return (f"The views are not checked: {len(historical)} lifecycle(s) follow hypgraph 0.3's rule, not the current "
-            f"one ({shown}{more}). A bundle exported by 0.3 shows them so, but the chain doesn't record which version "
+            f"one ({shown}). A bundle exported by 0.3 shows them so, but the chain doesn't record which version "
             "exported a bundle, so this can't be told from an edited view. Go by the current rule.")
 
 
+def _unconfirmed_note(unconfirmed: list) -> str:
+    return (f"The views are not checked: {len(unconfirmed)} node(s) are shown superseded with no replacement in this "
+            f"bundle ({_listed(unconfirmed)}). A replacement in another investigation would be among the redacted "
+            "events, which keep only their hashes, so this can't be confirmed here: the rows make them active. Only "
+            "the full record, verified against the published head, settles it.")
+
+
 def _j(v: Any) -> str:
     """A value in a problem, written as the browser's verifier writes it (JSON.stringify)."""
     return json.dumps(v, ensure_ascii=False, separators=(",", ":"))
@@ -320,6 +334,10 @@ def _scope_problem(b: dict, tables: dict, redacted: int) -> str:
     return ""
 
 
+# the node types a supersedes or corrects link can point at: no other type can be superseded
+REPLACEABLE = frozenset().union(*(RELS[r][1] for r in SAME_TYPE))
+
+
 def _eid(v: Any) -> int | None:
     """A link id as the browser's verifier reads one (Number.isInteger): 7 and 7.0, not true or "7"."""
     if isinstance(v, bool) or not isinstance(v, (int, float)) or not float(v).is_integer():
@@ -327,7 +345,8 @@ def _eid(v: Any) -> int | None:
     return int(v)
 
 
-def _derived_problem(b: dict, tables: dict, historical: list | None = None) -> str:
+def _derived_problem(b: dict, tables: dict, historical: list | None = None, unconfirmed: list | None = None,
+                     redacted: int = 0) -> str:
     """The derived views are presentation, but a viewer shows them beside a verified chain: every fact in them that
     the rows fix — which investigations there are, which nodes and live links each has, each node's type, code,
     author, time, version, title and lifecycle, each link's ends and fields — must be present and agree with the
@@ -337,7 +356,13 @@ def _derived_problem(b: dict, tables: dict, historical: list | None = None) -> s
     A lifecycle is checked against the current rule only. One that matches only 0.3's rule (the end of a chain of
     replacements shown active) is no problem — a 0.3 export shows it so — but it isn't checked either: the chain
     doesn't record which version exported a bundle, so it can't be told from an edited view. Each such node goes on
-    ``historical`` as (name, shown, current), and the bundle's views are reported as historical, not checked."""
+    ``historical`` as (name, shown, current), and the bundle's views are reported as historical, not checked.
+
+    A bundle with no redacted events holds every link, scoped or not, so a lifecycle the rows don't give fails. A
+    scoped bundle with redacted events leaves out links from other investigations, and one of them may replace a node:
+    a node of a type that can be replaced (``REPLACEABLE``) shown superseded with no replacement in the rows goes on
+    ``unconfirmed`` by name, and the views are reported as unconfirmed, not checked. ``scope`` isn't covered by the
+    chain, so naming one never loosens anything on its own."""
     d = b.get("derived")
     if d is None:
         return ""
@@ -392,8 +417,12 @@ def _derived_problem(b: dict, tables: dict, historical: list | None = None) -> s
         w, shown = lifecycle(n["id"], True), st["lifecycle"]
         if shown == w:
             return ""
-        if scope and n["id"] not in withdrawn and shown == "superseded":
-            return ""   # a scoped bundle leaves out links to other investigations: one may replace it
+        if (shown == "superseded" and scope and redacted and n["id"] not in withdrawn
+                and n["type"] in REPLACEABLE):
+            # a replacement in another investigation is among the redacted events: possible, not confirmable
+            if unconfirmed is not None and name not in unconfirmed:
+                unconfirmed.append(name)
+            return ""
         if shown == lifecycle(n["id"], False):
             if historical is not None and (name, shown, w) not in historical:
                 historical.append((name, shown, w))

{hypgraph-0.7.17 → hypgraph-0.7.18}/src/hypgraph/cli.py

@@ -299,6 +299,9 @@ def cmd_verify(args) -> int:
         text += "\n  no derived views: exported without them, so a viewer has nothing to show beyond the rows"
     if ok and res.get("views") == "historical":
         text += "\n  views: NOT CHECKED — some lifecycles follow hypgraph 0.3's rule, not the current one (see the note)"
+    if ok and res.get("views") == "unconfirmed":
+        text += ("\n  views: NOT CHECKED — some nodes are shown superseded by something outside this bundle, which "
+                 "can't be confirmed here (see the note)")
     if ok and res.get("unchecked"):
         text += ("\n  not covered (written before events hashed these fields): "
                  + ", ".join(f"{f} ×{n}" for f, n in sorted(res["unchecked"].items())))

{hypgraph-0.7.17 → hypgraph-0.7.18}/src/hypgraph/ui/hypgraph.i18n.js

@@ -21,7 +21,7 @@
 "chain.ok": "⛓ verificado · {n}", "chain.ok.tip": "cadena de hashes y cada fila verificadas de nuevo: {n} eventos, cabeza {head}…",
 "chain.partial": "cobertura parcial", "chain.partial.tip": "No todos los campos de las filas están respaldados por su evento",
 "chain.partial.redacted": "{n} evento(s) fuera de esta investigación están ocultos", "chain.exported": "situación tal como se exportó",
-"chain.bad": "⛓ no se verifica", "chain.bad.at": "⛓ no se verifica en el #{n}",
+"chain.views": "vistas no comprobadas", "chain.bad": "⛓ no se verifica", "chain.bad.at": "⛓ no se verifica en el #{n}",
 "stream.live": "en directo", "stream.polling": "consultando", "stream.polling.tip": "este servidor no tiene flujo de eventos; se consulta cada 5 s",
 "stream.reconnecting": "reconectando", "stream.offline": "sin conexión",
 "exported": "{what} según el bundle exportado, sin verificar: la cadena cubre las filas del registro, no lo que un motor derivó de ellas. Vuelva a derivarlo con <code>hypgraph verify --standing</code>.",
@@ -154,7 +154,7 @@
 "chain.ok": "⛓ vérifié · {n}", "chain.ok.tip": "chaîne de hachage et chaque ligne vérifiées à nouveau : {n} événements, tête {head}…",
 "chain.partial": "couverture partielle", "chain.partial.tip": "Tous les champs des lignes ne sont pas garantis par leur événement",
 "chain.partial.redacted": "{n} événement(s) hors de cette enquête sont masqués", "chain.exported": "statut tel qu'exporté",
-"chain.bad": "⛓ ne se vérifie pas", "chain.bad.at": "⛓ ne se vérifie pas au n° {n}",
+"chain.views": "vues non contrôlées", "chain.bad": "⛓ ne se vérifie pas", "chain.bad.at": "⛓ ne se vérifie pas au n° {n}",
 "stream.live": "en direct", "stream.polling": "interrogation", "stream.polling.tip": "cet hôte n'a pas de flux d'événements ; interrogation toutes les 5 s",
 "stream.reconnecting": "reconnexion", "stream.offline": "hors ligne",
 "exported": "{what} d'après le bundle exporté, sans vérification : la chaîne couvre les lignes du registre, pas ce qu'un moteur en a dérivé. Dérivez-le à nouveau avec <code>hypgraph verify --standing</code>.",
@@ -287,7 +287,7 @@
 "chain.ok": "⛓ verifiziert · {n}", "chain.ok.tip": "Hash-Kette und jede Zeile erneut verifiziert: {n} Ereignisse, Head {head}…",
 "chain.partial": "teilweise Abdeckung", "chain.partial.tip": "Nicht jedes Zeilenfeld ist durch sein Ereignis abgesichert",
 "chain.partial.redacted": "{n} Ereignis(se) außerhalb dieser Untersuchung sind geschwärzt", "chain.exported": "Stand wie exportiert",
-"chain.bad": "⛓ nicht verifizierbar", "chain.bad.at": "⛓ nicht verifizierbar bei Nr. {n}",
+"chain.views": "Ansichten nicht geprüft", "chain.bad": "⛓ nicht verifizierbar", "chain.bad.at": "⛓ nicht verifizierbar bei Nr. {n}",
 "stream.live": "live", "stream.polling": "Abfrage", "stream.polling.tip": "dieser Host hat keinen Ereignisstrom; Abfrage alle 5 s",
 "stream.reconnecting": "verbindet neu", "stream.offline": "offline",
 "exported": "{what} unverifiziert aus dem exportierten Bundle: Die Kette deckt die Zeilen des Protokolls ab, nicht das, was eine Engine daraus abgeleitet hat. Leiten Sie es mit <code>hypgraph verify --standing</code> neu ab.",
@@ -420,7 +420,7 @@
 "chain.ok": "⛓ 已验证 · {n}", "chain.ok.tip": "哈希链和每一行均已重新验证：{n} 个事件，链头 {head}…",
 "chain.partial": "部分覆盖", "chain.partial.tip": "并非每个行字段都有其事件担保",
 "chain.partial.redacted": "此调查之外的 {n} 个事件已隐去", "chain.exported": "现状为导出时所带",
-"chain.bad": "⛓ 验证失败", "chain.bad.at": "⛓ 在第 {n} 号验证失败",
+"chain.views": "视图未核查", "chain.bad": "⛓ 验证失败", "chain.bad.at": "⛓ 在第 {n} 号验证失败",
 "stream.live": "实时", "stream.polling": "轮询中", "stream.polling.tip": "此主机没有事件流；每 5 秒检查一次",
 "stream.reconnecting": "正在重连", "stream.offline": "离线",
 "exported": "{what}为记录包导出时所带，未经验证：哈希链只覆盖记录的行，不覆盖引擎从中推导出的内容。可用 <code>hypgraph verify --standing</code> 重新推导。",

{hypgraph-0.7.17 → hypgraph-0.7.18}/src/hypgraph/ui/hypgraph.js

@@ -32,6 +32,8 @@
   const esc = (s) => String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
   const RISKY = ['requires', 'derived_from', 'based_on'];
   const SAME_TYPE = ['supersedes', 'corrects'];      // schema.SAME_TYPE: a replacement of the same type
+  // bundle.REPLACEABLE: the types a supersedes / corrects link can point at (schema.RELS); no other type is superseded
+  const REPLACEABLE = ['artifact', 'claim', 'decision', 'experiment', 'hypothesis', 'question', 'result', 'run', 'source', 'task'];
   const cap = (t) => (t ? t[0].toUpperCase() + t.slice(1) : '');
 
   // ── hashing (WebCrypto, with a small fallback for insecure contexts) ─────
@@ -204,8 +206,9 @@
 
   /** The derived views are presentation; every fact in them the rows fix must agree with the verified rows. A
    *  lifecycle is checked against the current rule only; one that matches only 0.3's rule goes on `historical` as
-   *  [name, shown, current] (bundle.py _derived_problem): not a problem, not checked either. */
-  function derivedProblem(b, tables, historical = null) {
+   *  [name, shown, current] (bundle.py _derived_problem): not a problem, not checked either. A scoped bundle with
+   *  redacted events may show a replaceable node superseded from another investigation: it goes on `unconfirmed`. */
+  function derivedProblem(b, tables, historical = null, unconfirmed = null, redacted = 0) {
     const d = b.derived;
     if (d == null) return '';
     if (typeof d !== 'object') return 'derived is not an object';
@@ -241,7 +244,11 @@
       if (!st || typeof st !== 'object' || !('lifecycle' in st)) return `${where} shows ${name} without its lifecycle`;
       const w = lifecycle(n.id, true), shown = st.lifecycle;
       if (shown === w) return '';
-      if (scope && !withdrawn.has(n.id) && shown === 'superseded') return '';   // a scoped bundle leaves out links to other investigations
+      if (shown === 'superseded' && scope && redacted && !withdrawn.has(n.id) && REPLACEABLE.includes(n.type)) {
+        // a replacement in another investigation is among the redacted events: possible, not confirmable
+        if (unconfirmed && !unconfirmed.includes(name)) unconfirmed.push(name);
+        return '';
+      }
       if (shown === lifecycle(n.id, false)) {
         if (historical && !historical.some(([a, s, c]) => a === name && s === shown && c === w)) historical.push([name, shown, w]);
         return '';
@@ -342,22 +349,23 @@
     if (rows.problem) return { ok: false, problem: rows.problem + (stated !== importer ? ` (the bundle names ${stated} as its importer, which the chain doesn't cover; if you trust that, verify with --importer ${stated})` : '') };
     const sp = scopeProblem(b, tables, red);
     if (sp) return { ok: false, problem: sp };
-    const historical = [];
-    const dp = derivedProblem(b, tables, historical);
+    const historical = [], unconfirmed = [];
+    const dp = derivedProblem(b, tables, historical, unconfirmed, red);
     if (dp) return { ok: false, problem: `the derived views contradict the verified record: ${dp}` };
     const partial = Object.keys(rows.unchecked).length > 0 || red > 0;
     const out = { ok: true, checked, head: prev, complete: red === 0, redacted: red, nodes: tables.nodes.length,
       edges: tables.edges.length, unchecked: rows.unchecked, coverage: partial ? 'partial' : 'complete',
-      views: b.derived == null ? 'none' : historical.length ? 'historical' : 'checked',
+      views: b.derived == null ? 'none' : historical.length ? 'historical' : unconfirmed.length ? 'unconfirmed' : 'checked',
       policy: { trusted: Object.keys(policy || {}).sort(), importer }, standing: { checked: false, note: STANDING_NOTE } };
     const notes = [];
     if (red) notes.push(`${red} event(s) are redacted. The bundle says they lie outside this investigation, but a redacted event keeps only its hash, so that can't be checked: a change hidden among them (a withdrawal, say) would not show. Only the full record, verified against the published head, rules that out.`);
     if (stated !== importer) notes.push(`The bundle names ${stated} as its importer; the chain doesn't cover that, so ${importer} was used.`);
+    const listed = (names) => names.slice(0, 8).join('; ') + (names.length > 8 ? `; and ${names.length - 8} more` : '');
     if (historical.length) {
-      const shown = historical.slice(0, 8).map(([a, s, c]) => `${a} shown ${s}, the current rule makes it ${c}`).join('; ');
-      const more = historical.length > 8 ? `; and ${historical.length - 8} more` : '';
-      notes.push(`The views are not checked: ${historical.length} lifecycle(s) follow hypgraph 0.3's rule, not the current one (${shown}${more}). A bundle exported by 0.3 shows them so, but the chain doesn't record which version exported a bundle, so this can't be told from an edited view. Go by the current rule.`);
+      const shown = listed(historical.map(([a, s, c]) => `${a} shown ${s}, the current rule makes it ${c}`));
+      notes.push(`The views are not checked: ${historical.length} lifecycle(s) follow hypgraph 0.3's rule, not the current one (${shown}). A bundle exported by 0.3 shows them so, but the chain doesn't record which version exported a bundle, so this can't be told from an edited view. Go by the current rule.`);
     }
+    if (unconfirmed.length) notes.push(`The views are not checked: ${unconfirmed.length} node(s) are shown superseded with no replacement in this bundle (${listed(unconfirmed)}). A replacement in another investigation would be among the redacted events, which keep only their hashes, so this can't be confirmed here: the rows make them active. Only the full record, verified against the published head, settles it.`);
     if (notes.length) out.warning = notes.join(' ');
     return anchored(out, head);
   }
@@ -599,7 +607,7 @@
     "chain.ok": "⛓ verified · {n}", "chain.ok.tip": "hash chain and every row re-verified: {n} events, head {head}…",
     "chain.partial": "partial coverage", "chain.partial.tip": "Not every row field is vouched for by its event",
     "chain.partial.redacted": "{n} event(s) outside this investigation are redacted", "chain.exported": "standing as exported",
-    "chain.bad": "⛓ does not verify", "chain.bad.at": "⛓ does not verify at #{n}",
+    "chain.views": "views not checked", "chain.bad": "⛓ does not verify", "chain.bad.at": "⛓ does not verify at #{n}",
     "stream.live": "live", "stream.polling": "polling", "stream.polling.tip": "this host has no event stream; checking every 5 s",
     "stream.reconnecting": "reconnecting", "stream.offline": "offline",
     "exported": "{what} as exported with the bundle, not verified: the chain covers the record's rows, not what an engine derived from them. Re-derive it with <code>hypgraph verify --standing</code>.",
@@ -892,6 +900,7 @@
       // the verifier's own problem, warning and note are shown verbatim (English): only the frame around them is translated
       $('#hg-chain').innerHTML = !v ? '' : v.ok ? `<span class="pill ok" title="${esc(T('chain.ok.tip', { n: v.checked, head: String(v.head || '').slice(0, 12) }))}">${esc(T('chain.ok', { n: v.checked }))}</span>` +
           (v.coverage === 'partial' ? ` <span class="pill warn" title="${esc(T('chain.partial.tip') + (Object.keys(v.unchecked || {}).length ? ': ' + Object.entries(v.unchecked || {}).map(([f, n]) => `${f} ×${n}`).join(', ') : '') + (v.redacted ? '; ' + T('chain.partial.redacted', { n: v.redacted }) : ''))}">${esc(T('chain.partial'))}</span>` : '') +
+          (v.views === 'historical' || v.views === 'unconfirmed' ? ` <span class="pill warn" title="${esc(v.warning || '')}">${esc(T('chain.views'))}</span>` : '') +
           (v.standing && !v.standing.checked ? ` <span class="pill neutral" title="${esc(v.standing.note || '')}">${esc(T('chain.exported'))}</span>` : '')
         : `<span class="pill bad" title="${esc(v.problem || '')}">${esc(v.broken_at ? T('chain.bad.at', { n: v.broken_at }) : T('chain.bad'))}</span>`;
       const s = !live ? '' : S.stream === 'live' ? `<span class="pill ok"><span class="d"></span>${esc(T('stream.live'))}</span>`

hypgraph-0.7.18/tests/test_verify_scoped_views.py

@@ -0,0 +1,198 @@
+"""A scoped bundle can't show an active node as superseded and still say its views are checked (re-audit of 0.7.17,
+2026-10-31).
+
+The verifier let a scoped bundle call any non-withdrawn node superseded, since a scoped export leaves out links from
+other investigations. But ``scope.inv`` isn't covered by the chain: naming one on the published Broad Street bundle,
+which has no redacted events, let an active claim, or the investigation itself, be shown superseded and verify
+against the published head with ``views: "checked"`` and coverage complete. Now the allowance needs redacted events
+(without them every link is in the bundle) and a node of a type a ``supersedes`` / ``corrects`` link can reach (never
+an investigation or a review), and even then the views are ``unconfirmed``, with each node named. The browser's
+verifier must decide every case the same way.
+"""
+from __future__ import annotations
+
+import copy
+import json
+import re
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+from hypgraph.bundle import REPLACEABLE, verify_bundle
+from hypgraph.demos import broad_street
+from hypgraph.schema import RELS, SAME_TYPE, TYPES
+
+ROOT = Path(__file__).resolve().parent.parent
+UI_JS = ROOT / "src" / "hypgraph" / "ui" / "hypgraph.js"
+JS_VERIFY = ROOT / "dev" / "js_verify.js"
+PUBLISHED = ROOT / "site" / "data" / "broad-street.bundle.json"
+
+
+def _nodes(m: dict, inv: str) -> list:
+    return m["derived"]["by_inv"][inv]["subgraph"]["nodes"]
+
+
+def _shown(m: dict, inv: str, nid: str) -> dict:
+    return next(n for n in _nodes(m, inv) if n["id"] == nid)
+
+
+def _first(m: dict, inv: str, type: str, life: str = "active") -> dict:
+    return next(n for n in _nodes(m, inv) if n["type"] == type and n["state"]["lifecycle"] == life)
+
+
+def _inv_shown_superseded(m: dict, inv: str) -> None:
+    next(x for x in m["derived"]["investigations"] if x["id"] == inv)["state"]["lifecycle"] = "superseded"
+    _shown(m, inv, inv)["state"]["lifecycle"] = "superseded"
+
+
+@pytest.fixture(scope="module")
+def pub():
+    b = json.loads(PUBLISHED.read_text(encoding="utf-8"))
+    inv = next(n["id"] for n in b["nodes"] if n["type"] == "investigation")
+    return {"bundle": b, "inv": inv}
+
+
+@pytest.fixture(scope="module")
+def rec():
+    """Broad Street with one result withdrawn, plus a second investigation whose hypothesis supersedes one of Broad
+    Street's: a scoped export of Broad Street shows that hypothesis superseded, and the link that does it is among the
+    redacted events."""
+    g, inv, _ = broad_street.build()
+    full = g.export()
+    old = _first(full, inv, "hypothesis")["id"]
+    res = next(n for n in full["nodes"] if n["inv"] == inv and n["type"] == "result")
+    g.withdraw(author=res["created_by"], node=res["id"], why="The tally was entered against the wrong street.")
+    farr = g.author("farr")
+    inv2 = farr.investigation("A second inquiry", "Whether the water theory holds in another district.")["id"]
+    farr.add("hypothesis", inv2, links=[{"rel": "supersedes", "to": old}],
+             statement="Cholera in the second district follows its water companies.",
+             predictions=["Deaths follow the water company, not the street."])
+    scoped = g.export(inv)
+    return {"g": g, "inv": inv, "old": old, "scoped": scoped, "full": g.export()}
+
+
+def _cases(pub, rec) -> dict:
+    """name → (bundle or {bundle, head}, verdict): "checked", "unconfirmed" (verifies, views not checked) or False."""
+    b, inv = pub["bundle"], pub["inv"]
+    out = {}
+
+    def scoped_pub(name, verdict, edit=None):
+        m = copy.deepcopy(b)
+        m["scope"]["inv"] = inv
+        if edit:
+            edit(m)
+        out[name] = ({"bundle": m, "head": b["head"]}, verdict)
+    scoped_pub("published, scope named", "checked")
+    scoped_pub("published, scope named, active claim shown superseded", False,
+               lambda m: _first(m, inv, "claim").setdefault("state", {}).update(lifecycle="superseded"))
+    scoped_pub("published, scope named, investigation shown superseded", False,
+               lambda m: _inv_shown_superseded(m, inv))
+
+    s, sinv = rec["scoped"], rec["inv"]
+
+    def scoped_rec(name, verdict, edit=None):
+        m = copy.deepcopy(s)
+        if edit:
+            edit(m)
+        out[name] = (m, verdict)
+    scoped_rec("redacted, superseded from another investigation", "unconfirmed")
+    scoped_rec("redacted, an active claim shown superseded", "unconfirmed",
+               lambda m: _first(m, sinv, "claim").setdefault("state", {}).update(lifecycle="superseded"))
+    scoped_rec("redacted, investigation shown superseded", False, lambda m: _inv_shown_superseded(m, sinv))
+    scoped_rec("redacted, a review shown superseded", False,
+               lambda m: _first(m, sinv, "review")["state"].update(lifecycle="superseded"))
+    scoped_rec("redacted, withdrawn shown superseded", False,
+               lambda m: _first(m, sinv, "result", "withdrawn")["state"].update(lifecycle="superseded"))
+    scoped_rec("redacted, superseded hypothesis shown active", "checked",
+               lambda m: _shown(m, sinv, rec["old"])["state"].update(lifecycle="active"))
+    return out
+
+
+def _verify(x):
+    return verify_bundle(x["bundle"], head=x["head"]) if "bundle" in x else verify_bundle(x)
+
+
+def _verdict(v: dict):
+    return v["views"] if v["ok"] else False
+
+
+def test_the_fixture_is_the_real_case(rec):
+    """The scoped export redacts the second investigation's events and shows the old hypothesis superseded with no
+    replacement among its rows: the case the allowance exists for."""
+    s, old = rec["scoped"], rec["old"]
+    assert s["redacted_events"] > 0
+    assert _shown(s, rec["inv"], old)["state"]["lifecycle"] == "superseded"
+    assert not any(e["dst"] == old and e["rel"] in SAME_TYPE for e in s["edges"])
+    assert verify_bundle(rec["full"])["views"] == "checked"
+
+
+def test_every_case_gets_its_verdict(pub, rec):
+    wrong = {}
+    for name, (x, want) in _cases(pub, rec).items():
+        v = _verify(x)
+        if _verdict(v) != want:
+            wrong[name] = (_verdict(v), v.get("problem") or v.get("warning"))
+    assert wrong == {}, wrong
+
+
+def test_the_audits_reproduction_fails(pub):
+    """The published bundle with a scope named and an active claim shown superseded: chain, rows and head untouched."""
+    b, inv = copy.deepcopy(pub["bundle"]), pub["inv"]
+    b["scope"]["inv"] = inv
+    claim = _first(b, inv, "claim")
+    claim["state"]["lifecycle"] = "superseded"
+    v = verify_bundle(b, head=pub["bundle"]["head"])
+    assert not v["ok"], v
+    assert f'shows {claim["code"]} as "superseded"; the record makes it "active"' in v["problem"], v["problem"]
+
+
+def test_unconfirmed_names_each_node(rec):
+    v = verify_bundle(rec["scoped"], head=rec["scoped"]["head"])
+    assert v["ok"] and v["anchored"] and v["coverage"] == "partial" and v["views"] == "unconfirmed", v
+    code = _shown(rec["scoped"], rec["inv"], rec["old"])["code"]
+    assert re.search(rf"1 node\(s\) are shown superseded with no replacement in this bundle \({re.escape(code)}\)",
+                     v["warning"]), v["warning"]
+    assert "The views are not checked" in v["warning"]
+
+
+def test_the_cli_says_the_views_are_not_checked(rec, tmp_path):
+    f = tmp_path / "unconfirmed.bundle.json"
+    f.write_text(json.dumps(rec["scoped"]), encoding="utf-8")
+    out = subprocess.run([sys.executable, "-m", "hypgraph", "verify", str(f)], capture_output=True, text=True,
+                         encoding="utf-8")
+    assert out.returncode == 0 and "views: NOT CHECKED" in out.stdout and "outside this bundle" in out.stdout, out.stdout
+
+
+def test_replaceable_follows_the_schema():
+    """Only a type a supersedes / corrects link can point at can be superseded; the browser's list is the same."""
+    want = set().union(*(RELS[r][1] for r in SAME_TYPE))
+    assert set(REPLACEABLE) == want and set(TYPES) - want == {"investigation", "review"}
+    js = UI_JS.read_text(encoding="utf-8")
+    listed = re.search(r"const REPLACEABLE = \[([^\]]*)\]", js).group(1)
+    assert set(re.findall(r"'([a-z_]+)'", listed)) == want
+
+
+@pytest.mark.skipif(not shutil.which("node"), reason="node is not installed")
+def test_the_browser_verifier_agrees(pub, rec, tmp_path):
+    cases = _cases(pub, rec)
+    paths = []
+    for i, (name, (x, _)) in enumerate(cases.items()):
+        p = tmp_path / f"s{i:03d}.json"
+        p.write_text(json.dumps(x), encoding="utf-8")
+        paths.append(p)
+    out = subprocess.run(["node", str(JS_VERIFY), str(UI_JS), *map(str, paths)], capture_output=True, text=True,
+                         encoding="utf-8", timeout=300)
+    assert out.returncode == 0, out.stderr[-2000:]
+    js = json.loads(out.stdout)
+    disagree = {}
+    for (name, (x, want)), p in zip(cases.items(), paths):
+        py = _verify(x)
+        keys = ("ok", "views", "warning", "coverage", "anchored") if py["ok"] else ("ok", "problem")
+        py_said = {k: py.get(k) or "" for k in keys}
+        js_said = {k: js[p.name].get(k) or "" for k in keys}
+        if py_said != js_said or _verdict(py) != want:
+            disagree[name] = (py_said, js_said)
+    assert disagree == {}, disagree