feat(capture): record the Capture a link Capture came from (ADR-0040 writer)#1997

• X
• Mastodon
• Reddit
• LinkedIn

Reviewed commit: c531f67f8f25b407b70ccfd9cc4488d677508092 (head unchanged at end of review). Own diff: b4809c04..c531f67f (b4809c04 merges #1981 into the base; it differs from a fresh git merge-tree of the two only by the tests/verifier/binary.test.ts import resolution, which keeps both sides' imports correctly).

Failure scenario for 1: a later change drops status !== 'verified' as redundant next to the hash comparison. A link job then signs a source whose screenshot or text file was altered or deleted, or whose row hash was edited (chain-broken), and no test fails. ADR-0040 requires a source that "verifies against the chain". The signed hash would still be true of the page bytes, so the defect is the ADR rule going unenforced, not a false fingerprint. Fix: one test with a sidecar-altered source.

Failure scenario for 2: an admin edits link_href or linked_from_content_hash in Settings → Database, then exports a package. The report prints the edited value under "Link address" or "Link source SHA-256". The signed entry in manifest.jsonl still holds the original, and the report tells readers to compare against the entries. The mechanism matches the existing rows. It weighs more here because a 64-hex SHA-256 line reads as a checked digest, and the Operator statement (:1562) says the digests reproduced are those of the verification run, which never recomputes the source's hash. Reading the three fields from the verified entry, as #1985 does, closes it.

Checklist answers: (1) The hash comes only from the parsed, chain-verified entry (:144-158). Hex is checked at :159 and bytes plus status at :165. Every refusal returns before the render (:205-216), and the only route to signing passes linkProvenance at :301. (2) The address is compared as an exact string at enqueue (:410) and at run time (:132). The render loads job.url (backgroundRenderer.ts:540). A redirect changes only url/finalUrl. #1990's private-name rule refuses the job at enqueue or at the hop and cannot change the address. (3) The archive is at version 14 with the gate at caseArchive.ts:769, the remap is at captureRepo.ts:598-599, migration 44 skips present columns, and the drift test passes. (4) receivedEvidence.ts:275-277 copies the three fields from the signed entry. A scratch test also confirmed a member can link from a teammate's received source and the result verifies. (5) See finding 2. (6) The protocol.handle page server lives only in the e2e spec (:573-574). The packaged files list is out/**, resources/**, package.json and node_modules/**, the fixture is per test, and viewer partitions exist from startup (index.ts:223), so only the hidden render's recapture-<uuid> session (backgroundRenderer.ts:404) gets it. It handles only https, and the sentinel is http on 127.0.0.1, so the zero-request assertions still count.

Verification (local, Node 20.20.2, scratch worktree at head): pnpm lint 0, pnpm typecheck 0, pnpm build 0. BIRDBRAIN_TEST_SYSTEM_SHARP=1 BIRDBRAIN_REQUIRE_OPENSSL=1 BIRDBRAIN_REQUIRE_JQ=1 pnpm test:coverage exited 0 with 8032 passed and 25 skipped. A first run without the system sharp failed setup on libOpenEXR, as expected. pnpm coverage:diff exited 0 at 252/252 lines (100%). xvfb-run -a pnpm test:e2e e2e/mhtml-link-interactivity.spec.ts exited 0 with 6 passed. CI at head: test, e2e, lint, typecheck, build and probe pass. merge-gate fails with "evidence-affecting with no sign-off at head", as designed.

Controls: evidence-affecting is on both the PR and #1995. Auto-merge is null. No Co-authored-by trailer appears on the 7 own commits. The attribution is the maintainer byline, which the post-pr-body skill accepts. Evidence impact is substantive and justifies the missing KAT by #1981's frozen digest plus a writer body test parsed by the strict schema. Advisory-tier hits (ipcHandlers.ts, shared/ipc.ts, shared/types.ts) carry the link payload and types, and the blocking-tier review already covers them.

319417d7 (finding 1), 62c7ade9 (finding 2), 3290c2ee (finding 3), ea051e53 (finding 4), 9715f9a3 (finding 5), 5db2bc69 (finding 6)

Reviewed commit: 0675f94a8bdbedbfd5620ad52e85c80861a5ef14 (head re-read at end: unchanged). Delta from c531f67f: six own commits 319417d7..5db2bc69, then two merges. b809fcd6 (base at 19267c2c) and 0675f94a (46c61427) each equal a fresh git merge-tree of their parents; 0675f94a changes no file.

Failure scenario for 2: a later change drops the verdict and passes true, as the engine path once did. A package whose manifest.jsonl was edited (say linkHref or linkedFromContentHash in the link entry, which breaks the chain) then prints the edited address and a 64-hex "Link source SHA-256" instead of "not reported: the manifest chain did not verify", and no test fails. Fix: copy e1dcee4c's shape for a link Capture.

Failure scenario for 4: the operator chooses Capture link on an address that a Recapture is already rendering. That job's failed event raises "Link not captured: ", and the link job then stores the page. Or that job's stored event ends the listener, and the link job's refusal is visible only in Capture Health.

Corrected wording for 3: ADR status paragraph "…accepted it on 2026-10-26, amended to schema 6 (see "The fields need schema 6"). The verifier reads them from #1981 and Capture link writes them from #1995." Glossary: drop "planned: " so the line reads "…it is a new sighting; it names the Capture whose stored page held the link (ADR-0040)".

Earlier findings, each fix mutated (perl substitution, then the named files rerun, then restored):

• (1) status !== 'verified' || changed to &&: "skips a source whose screenshot no longer verifies, though its page does" fails.
• (2) Each report row switched back to the row value, or the chainVerified check dropped: 1 to 3 tests fail in reportCaptureEngine.test.ts and export.test.ts.
• (3) The run-time refusal notice changed to info: the MhtmlViewer.test.tsx refusal test fails.
• (4) The entry id switched to the row id: the import-rename test fails. The row rowId line dropped: the import-rename and linkProvenanceIngest tests fail.
• (5) The comment at recapture.ts:399-401 is accurate.
• (6) The LinksTab id changed: the new LinksTab test fails.

Agreement with #1981 as merged: the capture-entry schema region and fieldMinReaderSchemaVersion are byte-identical to main. Field names, the all-or-none rule, the stamp-6 refine, sha256HexField (^[0-9a-f]{64}$, matching recapture.ts:120 and checked at :160) and linkHref min(1) all agree. The verifier passes linkedFromCaptureId through without resolving it, so the entry-id ruling cannot break verification.

Verification: gh pr checks 1997 at head shows test, e2e, lint, typecheck, build and probe passing. merge-gate fails for missing sign-off, as expected. agent/pre-pass is pending, which is this run. Locally (Node 20 via mise, system sharp, scratch tree), the 17 touched test files ran: 16 passed and 1 skipped, with 711 tests passed and 22 skipped. The skipped file is tests/verifier/binary.test.ts, which needs a built verifier binary, and CI ran it. Lint, build and full coverage were not re-run locally (scope set to touched tests). CI's test job, which includes diff coverage, is green. The probe flagged 6 tests that pass on revert, all #1981 refusal or absence guards and none a finding, and 0 of 40 probed mutants survived (29 were not run for time).

Trial merges: with origin/feat/1927-report-capture-engine-fields (c7219ba3) the merge is clean. The base gained only tests since 19267c2c. On the merged tree, export.test.ts and reportCaptureEngine.test.ts pass 164/164 and pnpm typecheck exits 0. With origin/main (14bf7977), 14 files conflict, and the base alone conflicts with main in 8 of them. That is expected from #1980/#1981 squash-merging separately. The core.ts conflict is LATEST_SCHEMA_VERSION 44 against 43, so no migration number collides.

Evidence gate: evidence-affecting is on the PR and on #1995. Blocking-tier paths touched in the delta: recapture.ts, captureLifecycle.ts, reportHtml.ts, export.ts. The Evidence impact section is substantive and current. The KAT is justified by #1981's frozen body plus the writer body test. Backward verification holds: entries without the fields are unchanged. Controls: auto-merge null; no Co-authored-by on any commit since c531f67f; the body passes post-pr-body check.sh and ends with the maintainer byline. Bot surface: no reviews or inline comments; CodeRabbit skipped the draft.

• Finding 2: 75cf6bd2. Mutation resolveLinkSources(manifest.entries, localVerified) to true fails export.test.ts "quotes none of a link Capture's source in report.html when the local chain does not verify"; mutation resolveLinkSources(remote, true) to false fails reportCaptureEngine.test.ts "prints an accepted member's link source from that member's entry". Each run: 1 failed, 165 passed.
• Finding 3: ab4c3029; the base merge c7a89225 conflicted on ADR-0040's status paragraph and the glossary line and kept this branch's wording. The wording follows the verdict's, with "them" changed to "the fields" because the new sentence has no earlier noun for it.
• Finding 4: 34f29a2c. CaptureEvent.linkedFrom is set on every event runJob emits for a link job; useLinkMenuTarget requires source === 'recapture' and a matching linkedFrom.captureId and linkedFrom.linkHref. Mutations each fail one test: dropping the source check, matching by url again, dropping the captureId check (MhtmlViewer.test.tsx), and emitting events untagged or tagging every job (recapture.test.ts). Left out of scope and listed in the description: the store pairs a Recapture's terminal event with its received entry by address, so the exclusion skip that names the final address leaves a received entry in Capture Health (read from appStore.ts, not run). Two clicks on the same link from the same page still share the first job's outcome.
• Merges: fe0325e4 takes the base at c7219ba3 (clean). c7a89225 takes the base at 76f8b4b6, which holds main through #1984. It conflicted in eight files, all resolved, and changed one base test so it expects the source on the not-in-Case notice's Capture link.

Reviewed commit: c7a892257a3ed8800b52d78b70dc7f4092cdae15 (head re-read at the end: unchanged; auto-merge null). Delta from 0675f94a: fe0325e4 (merge), 75cf6bd2, ab4c3029, 34f29a2c, c7a89225 (merge).

Finding 2 of the last round (chain gate untested): resolved. These mutations ran in my scratch tree with perl, each followed by export.test.ts and reportCaptureEngine.test.ts, then a restore:

• local verdict to true: 1 failed, the "quotes none … when the local chain does not verify" test
• remote true to false: 1 failed, the "accepted member's link source" test
• .slice(manifest.entries.length) dropped: 1 failed, the tampered-chain test
• chainVerified render guard dropped (reportHtml.ts): 2 failed

Finding 3 of the last round (ADR and glossary): resolved. ADR-0040:8-9 reads "The verifier reads the fields from #1981 and Capture link writes them from #1995." CONTEXT.md:345 has no _planned:_. Both claims hold: 55c73c87 is on main, and the writer is on this branch.

Finding 4 of the last round (notice matched by address): resolved. recapture.ts:192-196 wraps every runJob emit; the only bare deps.emitEvent left is the enqueue-time exclusion at :388, which also returns as a rejection that the hook handles. I ran five mutations: untagged events, the redirect-skip emit untagged, the linkHref check dropped, the source check dropped and the captureId check dropped. Each fails exactly one test, in recapture.test.ts or MhtmlViewer.test.tsx.

Evidence gate on 34f29a2c. It changes the shape of events only. CaptureEvent.linkedFrom (types.ts:1398-1400) goes from recapture.ts to sendEvent(... CAPTURE_ACTIVITY ...) at index.ts:657-661, and then into appStore.captureEvents, which is in memory and not persisted (appStore.ts:51, 293-317). It never reaches the manifest, the signed entry, the database or an export. No signed field changed.

Merge c7a89225 against git merge-tree --write-tree 34f29a2c 76f8b4b6 (01c83964). The same 8 files conflict. Each resolution:

• CONTEXT.md and ADR-0040 take this branch's wording.
• LinksTab.tsx keeps base's followCaptureLink.
• MhtmlViewer.tsx takes base's { toastWayback: true }.
• CaptureViewer.tsx keeps both linkedFrom and the Back trail (rendered at :204-229).
• useLinkMenuTarget.ts takes base's signature, the same dependency list base had (it already held captureId), and fixes the auto-merged ), into )\n},.
• MhtmlViewer.test.tsx keeps both imports and changes one expectation, adding linkedFrom to the not-in-Case Capture link.
• The e2e spec appends this branch's test after base's click-through test.

git diff 76f8b4b6 c7a89225 removes no line from the e2e spec, CaptureViewer, LinksTab or MhtmlViewer. Lines starting with it(/test(, counted per file as merge base / ours / theirs / merged, give merged = ours + theirs - base every time:

recapture, export and reportCaptureEngine are unchanged by the merge.

Verification. gh pr checks 1997 at the end:

• passing: lint, typecheck, build, test, e2e, probe, hunks, adr-numbers and the security checks
• merge-gate: fails, reason "evidence-affecting with no sign-off at head"
• agent/pre-pass: pending; that is this review

The CI test job ran on ubuntu-24.04: 8305 passed and 25 skipped, and diff coverage was 172 of 173 lines (99.42%). The probe found 3 tests that still pass with the change reverted. All 3 are absence guards, so none is a finding. Of the mutants, 0 of 40 survived, 28 were caught and 12 were not run for time.

Local runs used Node 20 via mise, system sharp and a scratch tree:

• the 16 test files touched against main: 15 passed and 1 skipped (verifier binary), 861 tests passed and 22 skipped
• pnpm build: exit 0
• e2e/mhtml-link-interactivity.spec.ts under xvfb-run -a: 7 of 7 passed, including the Back-trail and Capture link tests

Not run locally: the full suite with coverage and pnpm lint. CI's test and lint jobs are authoritative here and are green.

Trial merge with origin/main f787d88d (#1998). git merge-tree is clean. On the merged tree, pnpm typecheck exited 0. Eleven test files passed with 605 tests: LinksTab, MhtmlViewer, CaptureViewer, ipcHandlers, preload bridge, recapture, waybackLinkCheck, waybackBatchModel, waybackLinkBatch, export and reportCaptureEngine. #1984 (93b5fe8f) and #1985 (76f8b4b6) are still open, and both heads are ancestors of this head.

Evidence gate.

• evidence-affecting is on the PR and on #1995.
• Blocking-tier paths are touched: recapture.ts, captureLifecycle.ts, manifest.ts, caseArchive.ts, export.ts, reportHtml.ts, receivedEvidence.ts and db/**.
• Advisory-tier: ipcHandlers.ts, ipc.ts and types.ts, which add typed payloads and an event field, none of them evidentiary.
• The Evidence impact section is substantive and current. Its "activity events only" sentence is confirmed above.
• No KAT was added. That is justified: #1981's frozen schema-6 body, plus this branch's writer-body pin in linkProvenanceIngest.test.ts.
• Backward verification: entries without the fields are unchanged (withCaptureEntry omits them).

Controls.

• Auto-merge: null.
• No Co-authored-by trailer on any of the 65 commits in origin/main..HEAD.
• The body passes post-pr-body check.sh, and it ends with the maintainer byline.
• Bot surface, read with --paginate: 5 issue comments, 0 reviews and 0 inline comments. CodeRabbit skipped the PR as a draft, so it left no findings to judge.

Is everything except the tag resolved? Yes. Findings 2-4 from the last round are fixed and mutation-checked. What remains is advisory, and the description line in finding 2 is a one-line edit.

Reviewed commit: c7a892257a3ed8800b52d78b70dc7f4092cdae15

Reviewed commit and head check

• Commit: reviewed c7a892257a3ed8800b52d78b70dc7f4092cdae15 on feat/1995-link-capture-writer. I re-read the head at the end of the review: it is still c7a89225, auto_merge is null and mergeable_state is dirty.
• Diff basis: main has since squash-merged #1984, #1985 and #1998. The three-dot diff from the old merge base (a0d938b1) therefore also shows #1984 and #1985 content, and so does pnpm coverage:diff. To isolate what this PR actually adds, I simulated the merge with origin/main (aa87bd36) and reviewed that result: 33 files, +1460/-46.

Findings

The conflicts in finding 1

All four conflicts are adjacency conflicts: main's side is the PR side minus the link additions. Keeping the HEAD side of each conflict produced files byte-identical to the PR head, so the conflicts carry no semantic difference. On that resolved tree, pnpm typecheck exits 0, and these six test files pass, 505 tests: LinksTab, ipcHandlers, MhtmlViewer, recapture, reportCaptureEngine, export. The merge commit is still a new head, and it needs a delta review and fresh CI.

What I checked and found sound

Writer: recapture.ts readLinkSource (:129-172) and enqueueLink (:407)

• The enqueue-time checks re-run when the job runs.
• job.url is never normalized: enqueue and validateUrl leave it alone, and the job renders it as given (renderPage(job.url) at :236). So the exact-string linkHref check compares like with like.
• The hash comes from the parsed signed entry, never from the row.
• The entry is bound to the row with entryDescribesRow, as Duplicate does.
• A hash that is not lower-case hex is refused.
• verifyCapture must return verified with computedHash === contentHash, which also covers a source whose screenshot alone was tampered.
• Exclusion skips at enqueue time carry no linkedFrom, and the renderer handles them through onSuccess.
• Every event runJob emits for a link job carries the tag.

Ingest: captureLifecycle.ts

• The entry signs the source's entry id.
• The row keeps the row id.
• withCaptureEntry (manifest.ts) writes the fields only when they are set.

Report

• The link address is page-controlled, and add() values are escaped at render (reportHtml.ts:1829).
• Link rows print only when the chain verified; otherwise the report prints the not-reported note.
• The resolver mirrors resolveExportCaptureEngine.

Archive and migration

• importCaptureRows remaps the id as it does for duplicate_of.
• CASE_ARCHIVE_SCHEMA_VERSION goes to 14.
• Migration 44 is idempotent, as v43 is.
• LATEST_SCHEMA_VERSION goes to 44.

Doc and comment claims, each checked against the code

• ADR-0040, linkedFromCaptureId and #1815: matches signedCaptureId (captureLifecycle.ts:796).
• Plan B4, canonicalizeUrl drops the fragment and trailing slash: true (urlCanonicalize.ts:12-13,35).
• The body says the linkedFrom tag reaches only the app window: true (index.ts:657-660).
• The migration 44 comment's reference to v43: true.
• The caseArchive.ts comment that an older build drops the columns without error: true; import is driven by CAPTURE_COLUMNS.
• The CONTEXT.md glossary line dropping _planned:_: true once merged.

Scope

• The changes map onto #1995's scope, its three review requirements and B5.
• The refusal notice and the event tag support the viewer sending the source, and are not drive-by additions.

Verify loop (pinned sha, Node v20.20.2, tool shell bash)

CI at the head sha: every required check is green. merge-gate failed twice. The log says this is the expected evidence sign-off block: "evidence-affecting with no sign-off at head".

Test reliability probe at this head: 0 of 40 probed mutants survived, 28 were caught, and 12 did not run within the time budget. Three tests still pass with the source changes reverted:

• Two belong to #1984, now on main.
• One is this PR's "carries none of them on an ordinary entry". That is a negative guard that is meant to pass without the change, so it is not a finding.

Evidence gate

• Labels: the PR carries evidence-affecting, and so does issue #1995.
• Blocking-tier paths touched: recapture.ts, captureLifecycle.ts, manifest.ts, db/**, caseArchive.ts, export.ts, reportHtml.ts, sharing/receivedEvidence.ts.
• Advisory-tier hits:
  • src/main/ipcHandlers.ts, the recapture enqueue handler: one line routing linkedFrom payloads to enqueueLink. It does reach the writer, but the enforcement is in blocking-tier recapture.ts, and the PR is already labelled.
  • src/shared/ipc.ts, RecaptureEnqueuePayload and LinkedFrom: type only.
  • src/shared/types.ts, Capture fields, LinkProvenance and CaptureEvent.linkedFrom: types and comment only (see finding 7).
• Evidence impact section: substantive. It says what the entry claims, what verification does and does not prove, and how backward verification is kept.
• Known-answer test: none added. The section justifies this: #1981's manifestSchema6LinkProvenance.test.ts freezes the canonical body and digest. On this branch, linkProvenanceIngest.test.ts pins both bodies field by field against the strict schema, and recapture.test.ts asserts that verifyCapture returns verified on a link Capture. I accept the justification.
• Backward verification: an ordinary entry keeps the schema-3 stamp and has none of the new fields (pinned). The full suite, including the verifier and package tests, passes.
• Auto-merge: not enabled.

Completion controls

• Attribution: optional on this PR. check.sh --any-author on the body exits 0, and there is no attribution line mid-body.
• Auto-merge: null.
• Co-authored-by trailers: none. git log origin/main..HEAD --format=%B | grep -i co-authored-by exited 1 over all 65 commits on the branch.
• Draft state: not reported, per ADR-0025.

What I could not check

• Vale, because it is not installed here.
• Whether the refusal in finding 3 can actually arrive before the IPC reply. That depends on the timing between Electron IPC and microtasks, and I did not reproduce it.

Friction notes

1. re-derived, anchor: "Review passes" step 1 (git diff origin/main...origin/<branch>). After the PR's stack base was squash-merged into main, the prescribed three-dot diff also showed #1984 and #1985 content, and the merge base used by coverage:diff was stale. Cost: I simulated the merge (git merge-tree, then a resolved scratch merge) to get the PR's net diff, and typechecked and tested that tree separately. Fix: add a line saying that when mergeable_state is dirty or the stack base has squash-merged, the reviewer should review against a simulated merge with origin/main.

• Finding 1: 653d6d71 merges origin/main at 2d5f1594. Conflicts in export.ts, reportHtml.ts, export.test.ts and reportCaptureEngine.test.ts; in every hunk the main side was the branch side minus the link lines. Each resolved file equals the pre-merge branch head c7a89225, and git diff origin/main on each removes only a line it replaces with a superset (an import list, the engine: line). main is at LATEST_SCHEMA_VERSION 43 and CASE_ARCHIVE_SCHEMA_VERSION 13, so migration 44 and archive 14 are unchanged.
• Findings 3 and 4: 315fc942. One flag, settled, set on the job's terminal event, gates both the queued notice and the reject-path warning. New test in MhtmlViewer.test.tsx: dropping if (settled) return fails it on the queued notice; changing onError: () => stop() to onError: () => {} fails it on the leftover listener. Each mutation: 1 failed, 24 passed.
• Finding 5: 4b70cc7e. New recapture.test.ts describe with two peers and a sync pull; forcing authorInstallationId: null in readLinkSource fails it with a skipped event (1 failed, 49 passed).
• Finding 7: a674fcb7, comment only; the copy is receivedEvidence.ts setting linkedFromCaptureId: entry.linkedFromCaptureId.

• Item 4: 315fc942
• Item 5: 4ea0274d

Reviewed commit: 4ea0274dd206458f270aaf484585e1552155f82e (head re-read at the end: unchanged; auto_merge null; mergeable_state blocked by merge-gate only)

Previous reviewed commit: c7a892257a3ed8800b52d78b70dc7f4092cdae15. Delta: 653d6d71 (merge of main at 2d5f1594), 315fc942, 4b70cc7e, a674fcb7, 4ea0274d.

Earlier blockers, each mutated by me (perl edit, single test file, git checkout restore; script run under bash -c):

• M1, if (settled) return dropped: MhtmlViewer 1 failed / 24 passed (the new test at :308).
• M2, onError: () => stop() changed to onError: () => {}: 1 failed / 24 passed (same test, on the listener count).
• M3, settled = true dropped: 1 failed / 24 passed.
• M5, authorInstallationId: null forced in readLinkSource (recapture.ts:141): recapture 1 failed / 49 passed (the teammate test at :839).
• Two mutants survived: M4, if (accepted === 0) stop() dropped (finding 2), and M6, settled set after the stored check (finding 3).

Logic of 315fc942. recapture.ts:353-363: drain() starts runJob synchronously. runJob emits received, which the listener ignores, then awaits readLinkSource. That function returns { refused } for a source with no manifest entry before its first await (:138). The tagged skip is therefore emitted one microtask after enqueue returns, and it can beat the IPC reply. The commit message says "can", which is accurate. Enqueue-time exclusions (:388) carry no linkedFrom, so settled cannot be true when accepted === 0, and the listener never double-warns.

Comment and doc claims in the delta.

• types.ts:352-355 says a received row copies the entry id. True: receivedEvidence.ts:275.
• The plan, B4 step 3, adds a third reader: the not-in-Case Capture link. True: MhtmlViewer.tsx:177, :188 and :251 take outcome.url, which guestLink.ts:78 and :104 pass through unchanged.
• 315fc942's comment at useLinkMenuTarget.ts:72-73 matches the code.

Merge 653d6d71. I rebuilt it with git merge-tree --write-tree c7a89225 2d5f1594. The same four files conflict, and no other file differs from the automatic result. Each of the four resolved files is byte-identical to c7a89225. Main touched these files only through #1984 and #1985 (git log a0d938b1..2d5f1594). git diff 2d5f1594 653d6d71 on them deletes only lines that it re-adds as supersets: the reportHtml import list in export.ts, engine: gaining , linkSource: in reportHtml.ts, and the import in reportCaptureEngine.test.ts. export.test.ts is additions only. No main-branch content was dropped. Main is at schema 43 and archive 13; the branch moves them to 44 and 14.

PR body, Summary sentence by sentence.

• Sentence 1 holds: the signed entry, the hash check and verifyCapture run before ingest.
• Sentence 2 holds. The viewer falls back to the URL when there is no title (body, Changes).
• Sentence 3 holds; see finding 1.
• Sentence 4, about the interactive session that opened the PR and applied its labels by hand, matches the label events: thebristolsound added agent-authored and evidence-affecting at 22:48:31Z on 2026-10-26. The post-pr-body skill permits a handoff sentence.

I found no false claim in the Summary. Nit: the clause "and the session coordinating this review round posts the updated description" describes this round only, and it will read stale in the squash commit. Optional rewording: "An earlier interactive session opened this draft and applied its labels by hand."

• Changes and Evidence impact claims checked this round: the merge bullet's PR list matches git log a0d938b1..2d5f1594, the schema numbers match, the MhtmlViewer test list matches, the teammate-source claim matches (M5), and the test counts match CI.

Verification.

• CI at 4ea0274d, from gh pr checks 1997:
  • Pass: lint, typecheck, build, test, e2e, probe, hunks, adr-numbers, changes, label, seed, withdraw, and the security checks.
  • merge-gate fails with "evidence-affecting with no sign-off at head", which is expected.
  • agent/pre-pass is pending; that is this review.
• CI test job: 492 files passed and 2 skipped; 8375 tests passed and 25 skipped. Diff coverage is 100/100 changed lines. Both match the body.
• Probe:
  • One test still passes with the source changes reverted: "carries none of them on an ordinary entry". It is an absence guard, so it is not a finding.
  • Mutants: 0 of 40 survived, 27 were caught and 13 were not run for time. M4 and M6 were not in its sample.
• Local run, Node v20.20.2 via mise, with system sharp and xvfb-run: the 13 test files the PR touches against main passed, 761 tests, exit 0.
• Not run locally, per instruction: the full suite with coverage, lint, typecheck, build and e2e. I left the full loop to CI at this sha.
• Trial merge: origin/main (2d5f1594, re-fetched at the end) is an ancestor of the head, so the merge is a no-op and clean.

Evidence gate.

• Labels: evidence-affecting is on the PR and on #1995.
• The delta touches no blocking-tier path. useLinkMenuTarget.ts and the tests are not on the list. types.ts is advisory-tier, and its change is a comment on Capture fields with no evidence behaviour.
• The merge brings no new evidence code: export.ts and reportHtml.ts resolve byte-identical to c7a89225, which was reviewed last round.
• The Evidence impact section is substantive and now names the teammate-source verification. Its no-KAT justification, which points to #1981's frozen body and this branch's pinned body, still holds.

Controls.

• Auto-merge: null.
• git log origin/main..HEAD --format=%B | grep -ic co-authored-by prints 0 over 70 commits.
• The body passes post-pr-body check.sh (exit 0) and ends with the maintainer byline.
• Bot surface, read with --paginate: 0 reviews, 0 inline comments and 9 issue comments. The only bot comment is CodeRabbit's draft skip, which has no findings.

Reviewed commit: 4ea0274dd206458f270aaf484585e1552155f82e

Head re-read at the end of the review: unchanged. Auto-merge: null.

Correctness trace. IPC recapture:enqueue (ipcHandlers.ts:1129) routes any payload with linkedFrom !== undefined to enqueueLink, which type-checks both fields, refuses supersedesCaptureId, requires urls exactly [linkHref] (exact string), and checks source existence and Case, then funnels into enqueue (URL scheme, local-address and exclusion checks). runJob emits received, then readLinkSource before the render: re-checks address/existence/Case, requires a manifest index, reads the author's chain, strict-parses the entry, requires type === 'capture' and entryDescribesRow, refuses non-lower-hex contentHash, then requires verifyCapture(..., {record:false}) to be verified with computedHash === contentHash. Any throw lands in the existing catch and emits a tagged failed. The ingest spreads signed into the entry context (manifest.ts writes each field only when defined; fieldMinReaderSchemaVersion stamps 6) and writes the row with rowId overriding linkedFromCaptureId. Archive import remaps the id via ctx.mapId; receive copies the three fields from the signed entry (received row id is the entry id). Report rows come only from strict-parsed signed entries, printed only when the chain verified, through esc() (reportHtml.ts:1829). Every main-process file that handles duplicate_of_capture_id or supersedes_capture_id also handles the new column (grep comparison).

Docs claims checked. ADR status line: #1981 is on main (55c73c87) and src/shared/schemas.ts on main has the fields. Plan B4 linkHref paragraph: src/shared/urlCanonicalize.ts does drop fragment and trailing slash; the not-in-Case notice passes the did-start-navigation URL unchanged through linkClickOutcome (guestLink.ts:104). Migration comment's "as v43 does" matches migrations.ts v43. Evidence-impact claim that the linkedFrom event tag reaches only the app window: index.ts:654-660 sends it to mainWindow only. Too-old claim: tests/shared/verify/manifestSchema6TooOld.test.ts has a link-provenance describe block.

Evidence gate. Touched blocking-tier paths: recapture.ts, captureLifecycle.ts, manifest.ts, caseArchive.ts, export.ts, reportHtml.ts, sharing/receivedEvidence.ts. Advisory-tier: src/shared/ipc.ts (new LinkedFrom payload type, part of the evidence path, already covered by the blocking label) and src/shared/types.ts (row/event fields). PR labels: evidence-affecting, agent-authored, review:stale, size:L; issue #1995: evidence-affecting. Evidence impact section is substantive. No new KAT: justified by #1981's frozen schema-6 link body (manifestSchema6LinkProvenance.test.ts); the writer's body is pinned field for field and strict-parsed in linkProvenanceIngest.test.ts. Backward verification: entries without the fields keep their body (pinned at schema 3 in the same test); full suite green. The regression-guard test the reliability probe flags as passing with the source reverted is exactly that unchanged-body guard, so it is expected.

Verification (Node v20.20.2, local, at the pinned sha). pnpm lint exit 0; pnpm typecheck exit 0; pnpm build exit 0; BIRDBRAIN_REQUIRE_OPENSSL=1 BIRDBRAIN_REQUIRE_JQ=1 pnpm test:coverage exit 0, 8375 passed, 25 skipped (8400), matching the PR body; pnpm coverage:diff 100/100 changed lines (types.ts not instrumented). No extension changes, so no extension build. CI: every check passes except merge-gate, which fails with "evidence-affecting with no sign-off at head" (ADR-0041), the expected state before maintainer approval. Test reliability probe: 0 survived, 27 caught, 13 not run for time.

Acceptance criteria (#1995 B5). All seven covered: recapture.test.ts (write, other Case, deleted, failing verify, urls empty/two/different/canonical spelling, ordinary job, non-hex hash), linkProvenanceIngest.test.ts, linkProvenanceColumnsMigration.test.ts plus drift test, caseArchiveRoundTrip.test.ts remap, receivedEvidence.test.ts, MhtmlViewer.test.tsx and reportCaptureEngine.test.ts, and the e2e spec (CI e2e pass). The event tagging and refusal notice go beyond the listed scope but serve the requirement that a refusal at run time is visible; not flagged.

Completion controls. Commit trailers: git log origin/main..HEAD --format=%B | grep -i co-authored found none. Auto-merge: null. Attribution: body ends with a Created with ... (T3 Code) byline, which post-pr-body/scripts/check.sh accepts in both default and --any-author modes (exit 0). Draft state not assessed per ADR-0025.

Not checked. I did not run the e2e spec locally (CI e2e passed at this sha). I did not run pnpm test:reliability locally; I read the CI probe's summary and ran one targeted mutant.

• c99efe4d: merge of the main branch through #2002
• 82420164: tests that one link Capture carries the link fields and the capture engine fields together

Reviewed commit: 824201645e2d20973a89dc7d8aaeae8966688055 (delta round from 4ea0274d; base main at 18f29504)

Correction for 2, exact sentence: "Main merge, second: c99efe4d takes main through #2002 (#2017, #1996, #1999, #2000 and #2002 since 653d6d71)." Corrected wording: "Main merge, second: c99efe4d takes main through #2002 (#2016, #2015, #2014, #2006, #2017, #1996, #1999, #2000 and #2002 since 653d6d71)."

Trace for 3: the row engine columns have no reader that reaches an operator or a verdict. git grep over src/renderer and src/preload finds no read of inventory, scrollToLoad, boundTls, transactionRecordHash or pdfHash on a Capture. The report reads the signed entry (reportHtml.ts:160, resolveCaptureEngineFacts over ManifestEntrySchema). Packaging ships the Transaction Record and PDF only when the entry anchors them (export.ts:1615-1624). Sidecar verification takes its hashes from the chain entry (captureLifecycle.ts:715-733). Both verifiers read the entry: src/shared/verify/manifestChain.ts:454-473 and evidencePackage.ts:924-940, and the standalone script hashes the whole entry body (verifyProcedure.ts:85, jq -cS 'del(.entryHash, .signature)'). The only place the gap shows is the raw Settings, Database view of the row.

Both sets together, re-derived at head:

• Signed entry: captureLifecycle.ts:461 spreads linkSource.signed beside inventory, scrollToLoad, transactionRecordHash, boundTls, boundTlsAbsent and pdfHash (lines 462 to 467); manifest.ts:1281-1290 writes each only when set.
• Row: captureLifecycle.ts:523-530 passes both sets to insertCapture. captureRepo.ts:258-266 maps both. CAPTURE_INSERT_SQL (captureRepo.ts:214) names its columns from CAPTURE_COLUMNS (lines 194 to 200, engine then link) and binds values by column name (line 271), so the order of the row object cannot misplace a value. Migration 44 (migrations.ts:1908-1925) adds the three link columns after v43.
• Case Archive: CASE_ARCHIVE_SCHEMA_VERSION is 14 (caseArchive.ts:191) on main's 13; importCaptureRows remaps linked_from_capture_id (captureRepo.ts:621-623) and copies the engine columns through CAPTURE_COLUMNS. The round trip test asserts the engine columns on one Capture and the link columns on another.
• Schema numbers: main is at LATEST_SCHEMA_VERSION 43 and archive 13; this branch takes 44 (core.ts:6) and 14. origin/main has not moved since 18f29504.
• Source check order: readLinkSource (recapture.ts:195-238) runs at recapture.ts:277-291, before renderPage (line 305), so the source verifies against its signed record before any engine field exists; linkSource and the engine fields reach the same ingest call (lines 379 to 388).
• Verifiers: manifestChain.ts:454-473 reads both sets; ManifestEntrySchema (schemas.ts:672-684) declares both, and no refinement ties one set to the other.

Mutations, each applied alone in a scratch tree and reverted, against the new test named in brackets (recapture: "signs the capture engine fields beside the link fields, and the row mirrors both"; report: "prints the link rows and the capture engine fields from one entry carrying both"). All 11 failed the test with an assertion error:

Evidence gate: blocking-tier paths touched (captureLifecycle.ts, recapture.ts and others); PR and issue #1995 both carry evidence-affecting. Evidence impact is substantive and its new sentences on the engine fields match the code. Auto-merge is null. No Co-authored-by trailer on any branch commit. The PR body ends with the byline as its last authored line.

Review surface since comment 6508749761 (all three endpoints read with --paginate): no reviews and no review comments exist on the PR; two issue comments are new, 6509335087 (merge refused while the PR was a draft) and 6540220041 (implementer dispositions). Finding (7) is in the PR body's findings list; the reply's item 7 is the chain-validity guard.

Verification at head: CI is green for lint, typecheck, build, test (7m53s), e2e (9m57s), probe and the rest; merge-gate fails as in finding 4; agent/pre-pass waits on this verdict. Test reliability: 1 of 46 touched tests passes with the source reverted ("carries none of them on an ordinary entry"), which tests an unchanged entry by design; 0 of 40 probed mutants survived. Locally on Node 20 with the system sharp addon: recapture.test.ts 64 passed, reportCaptureEngine.test.ts 47, linkProvenanceIngest.test.ts 2, caseArchiveRoundTrip.test.ts 7, sharing/receivedEvidence.test.ts 33. The full loop was left to CI at this commit. Trial merge with origin/main 18f29504 is clean (git merge-tree exit 0; the branch already contains it).

Not checked: the full local suite with coverage, lint, typecheck and build were not re-run (CI is authoritative at this commit).