feat(dashboard): quantify cases and preserve project journeys

.dockerignore

@@ -0,0 +1,8 @@
+.git
+.codegraph
+.venv
+frontend/node_modules
+frontend/dist
+frontend/storybook-static
+**/__pycache__
+**/.pytest_cache

.env.example

@@ -39,6 +39,8 @@ MCP_RATE_LIMIT_WINDOW_SECONDS=
 # running contextual-orchestrator to turn the channels on.
 ORCHESTRATOR_BASE_URL=
 ORCHESTRATOR_API_KEY=
+SOURCE_RESEARCH_MAXIMUM_LEADS=
+SOURCE_RESEARCH_MAXIMUM_RESULTS=
 
 # GitHub workflows inject the canonical provider names from masked secrets.
 # Non-GitHub Compose runs also accept the operator's ~/.env compatibility
@@ -49,7 +51,6 @@ LLM_GATEWAY_API_URL=
 # Compatibility alias; LLM_GATEWAY_API_URL wins when both are set.
 LLM_GATEWAY_URL=
 LLM_GATEWAY_API_KEY=
-LLM_GATEWAY_EMBEDDING_MODEL=
 LLM_API_GATEWAY=
 LLM_API_KEY=
 CALDAV_BASE_URL=

.github/workflows/tests.yml

@@ -10,7 +10,10 @@ permissions:
   contents: read
 
 concurrency:
-  group: tests-${{ github.ref }}
+  # A merged pull request can report the base ref on ``closed``. Keying PR
+  # events by number lets that close run cancel an older queued synchronize
+  # run for the same PR instead of consuming runners after the PR is closed.
+  group: tests-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:

.gitignore

@@ -7,3 +7,6 @@ __pycache__/
 .codegraph/
 .env
 .coverage
+
+# Local agent worktree scratch (never commit)
+.worktrees/

AGENTS.md

@@ -21,6 +21,14 @@ documents unless an ADR explicitly promotes a decision from them --
 to its governing ADR. Update research notes as literature changes; never
 use them to introduce an untracked architecture decision.
 
+Customer-facing copy must help the reader take the next product action. Do
+not expose implementation boundaries, provider or package names, schema
+versions, internal status or reason codes, environment variables, transport
+setup, hashes, or developer remediation instructions as explanatory UI copy.
+Keep that evidence in governed audit and administrator surfaces and logs;
+translate a customer-visible state into the source, decision, retry, or
+administrator action the reader can actually take.
+
 ## Hard rule: no real data in repository artifacts
 
 This repository ships **synthetic fixtures only** (`lineageweave/fixtures.py`)
@@ -188,8 +196,10 @@ contextual-orchestrator owns model discovery and selection.
 
 `NullEmbeddingClient`, `NullAdjudicationClient`,
 `NullKeymanExtractionClient`, `NullEntityRelationshipClient`,
-`NullPostSummaryClient`, `NullPostChatClient`, and
-`NullCommitmentExtractionClient` (and any new channel client you add)
+`NullPostSummaryClient`, `NullPostChatClient`,
+`NullCommitmentExtractionClient`, `NullRelationVerificationClient`,
+`NullClaimVerificationClient`, and `NullSourceResearchClient`
+(and any new channel client you add)
 must set `available = False` and make their channel dropped +
 renormalized (`reconstruct.active_weights`), never silently return a
 placeholder score, invented Keyman, guessed relationship, fabricated
@@ -202,6 +212,14 @@ adjudication does -- never a raw LLM API. Demo TEPP seed goes through
 envelope is Failed (`tepp_not_available` / `tepp_result_not_persisted`),
 never a fabricated theta or a local psychometric substitute.
 
+Public source-reference research (ADR 0268) is a post-scoped write action
+on existing semantic units or image regions. Only `visibility_code=public`
+posts may send lead text to SearXNG or retrieve a result URL. Private posts
+fail closed without egress. Redirects and non-global targets are rejected.
+Unavailable search, retrieval, or adjudication is `research_unavailable`,
+never a fabricated supported/refuted judgment. Global Ask public
+verification (ADR 0215) still never fetches result URLs.
+
 The lineage `text` channel follows [ADR 0190](docs/adr/0190-lineage-text-channel-embedding-swap.md):
 when an embedding provider is configured, `reconstruct()` precomputes
 batched label embeddings once per reconstruction and scores cosine
@@ -237,6 +255,20 @@ vector degrades that pair back to difflib; it never fabricates a score.
 
 ## Tests
 
+### Isolated Compose lifecycle
+
+- The canonical standalone Compose project is `lineageweave` (ADR 0224).
+- A test, review, or stacked-PR environment may use an explicit isolated
+  project name only while that environment is needed. Once its stated test or
+  review objective has succeeded, preserve the relevant evidence and port any
+  required behavior into the canonical Compose contract, then run `docker
+  compose -p <exact-project> down` so its containers and network do not become
+  a second production-looking stack.
+- Never use `down -v` or otherwise delete named volumes without separate,
+  explicit authorization. Resolve the exact project from Compose labels before
+  cleanup; never target a glob, directory root, or another agent's active
+  environment.
+
 ```bash
 # backend extra compiles fast-mlsirm's PyO3 core -- needs rustc 1.97.1
 # (see backend/Dockerfile). Without it, pip falls over at build time.
@@ -250,6 +282,8 @@ in the same spirit) -- never against real data, per the hard rule above.
 `backend/tests/` and `tests/test_schema.py` are real-integration tests
 against a live local stack (`make up`) and self-skip without one -- see
 [README.md](README.md#local-product-stack-docker-compose).
+`tests/test_source_post_voice_history_live.py` is the same pattern for
+ADR 0252 A → B → A cutoff and concurrent primary-Voice history.
 
 `tests/test_public_docstrings.py` enforces repository-wide docstring
 coverage: every public function and class under `lineageweave/` and
@@ -271,16 +305,21 @@ stops startup instead of leaving a healthy-looking partial schema, and
 application code must not compensate for a missing table.
 
 Period leftover pairs (ADR 0017 / 0018 / 0048 / 0049 / 0119 / 0158 / 0162 /
-0163 / 0164 / 0182 / 0201) are computed in `lineageweave/leftover_pairs.py` from the
+0163 / 0164 / 0182 / 0185 / 0201 / 0233 / 0266) are computed in `lineageweave/leftover_pairs.py` from the
 residual after a real GRM/GPCM score, never invented. Distances are
 Euclidean on the two-dimensional Gabriel leftover map; missing cells stay
 out of the factorization. Closest and farthest post–criterion pairs
 persist to `report_leftover_pair` with signed residual `R`, observed
 `Y`, and expected `E[Y|θ, item]` so `R = Y − E` remains auditable,
 plus leftover-map rank so rank 0 is not read as structure,
-unexplained leftover, and the ADR 0201 reconstruction evidence. ADR 0201
-is the sole normative reconstruction formula, storage, and audit contract;
-do not duplicate or reinterpret it here. The pairs sit above the member
+unexplained leftover, the ADR 0201 reconstruction evidence, ADR 0185
+cross-share evidence, ADR 0233 unexplained leftover share
+`s = U² / R²`, and ADR 0266 explained leftover share `e = R̂² / R²`.
+ADR 0201 is the sole normative reconstruction formula,
+storage, and audit contract; do not duplicate or reinterpret it here.
+ADR 0233 is the sole unexplained leftover share contract. ADR 0266 is
+the sole explained leftover share contract. When `R`, `R̂`, `U`, `x`,
+`s`, and `e` are finite, `e + s + x = 1`. The pairs sit above the member
 list so a click opens that post with the leftover criterion current
 in Post quality (ADR 0158). Leftover-map axis share (ADR 0148) is Gabriel inertia of
 residual SVD axes 1 and 2 and persists to `report_leftover_map_axis`.
@@ -289,6 +328,13 @@ and are not a leftover score. Complete-case coverage (ADR 0168) persists to
 `report_leftover_map_coverage` and captions the pair list with how
 many scored posts entered the map.
 
+Authorized occupational construct catalog search (ADR 0257) matches official
+O*NET preferred labels or descriptions only when a source-eligible, ABAC-visible
+Post supports that construct. Hidden Posts, withdrawn truth, and conflicting
+truth statuses omit the hit. Clicking a hit opens that Post. Do not return
+catalog rows as a vocabulary oracle, scores, or person traits. Continuation
+is a construct-IRI keyset; never OFFSET.
+
 Global Ask relative-time filters (ADR 0150 / 0202) bind to
 `source_post.event_occurred_at` and fall back to `created_at` only
 when the event instant is missing. Cited evidence names **Time
@@ -317,7 +363,11 @@ pnpm run lint && pnpm run test && pnpm run build
 Repeated web objects use `frontend/src/styles/tokens.css`, not inline hex
 (ADR 0099 badge/accent tokens, with dark-mode overrides guarded by
 `tokens.test.ts`); new stories belong in the inventory at
-`docs/storybook-inventory.md`.
+`docs/storybook-inventory.md`. Success, unavailable, and retry copy share
+`StatusNotice` (ADR 0220): Calendar's missing Naruon projection is the first
+migrated flow. Success and unavailable stay a named region (not live
+`role="status"`); retry stays `role="alert"`. Do not add a second placeholder
+or interpolate provider payloads into that notice.
 
 A run-bearing analysis-run registry empties only after an unrevoked
 `analysis_run_retention_grant` and `GRANT analysis_run_retention_admin`
@@ -332,6 +382,9 @@ v0.88.0). Do not invent a theta.
 Opening a cutoff-rewritten title shows **Body this run knew** from
 `source_post_revision` beside the live rewrite (ADR 0025 / v2.1.0).
 Do not invent the earlier sentence when no revision covers the cutoff.
+Global Ask uses the same revision cover when `knowledge_cutoff` is set
+(ADR 0216 / #271); omit the field to keep the live-query contract, and
+never substitute a live body for a missing historical cover.
 
 A corporate-entity similarity result has three outcomes: unique, miss,
 or tie (ADR 0026). A tie is not a miss. Keep the organization name