[StepenkoAnatoli]

What this changes

This builds plan v0.4 (the quote-level refresh) on top of main ab2e605. Each item is one
ADR, or a measurement under it.

• ADR-0193, evidence-supersession/quote-survived-refresh. A citation of a row that a
  refresh replaced now passes when every usable quote of the old row is found in both captures,
  the old and the new.
  • The new capture must be readable, not an error page, and not followed by a refresh that
    found the page gone.
  • A recorded status that is not a number reopens the citation (4b-fix).
  • Every other state stays cites-superseded-row, now with a reason and a drift attribution.
  • The pass and every reopen end with the limit line: surviving words say nothing about
    whether the claim still holds.
  • No citation is moved.
  • A refresh that landed on another URL (Stage 7 gap 1, owner rulings 2026-10-26): it is
    joined on the ledger's asked-for URL, and the quote is rechecked against the current row of
    the landed URL, or the citation reopens with "asked for X ... and landed on Y". Rows first
    captured through a redirect are joined on the address their own fetch asked for, second to
    their own URL. A gone landed page, a gone through-address or a move of a move never passes.
    supersededRows and the collector are unchanged (ADR-0193 decision 8, ADR-0194 decision 1).
• ADR-0194, evidence-supersession/cites-gone-page. A cited row fails when a later refresh
  found its page gone (404 or 410), unless its Finding names that status. The failure
  classifier moves to lib/fetch-failure.mjs, which the collector and the gate now share.
• ADR-0192. The matcher ignores spacing beside punctuation, so a quote copied from one
  transport matches the other. No verdict of the 41 baseline corpora moves.
• ADR-0191. The short-quote floor is measured on the compared text. No gate failure is
  removed: a quote short only on its compared text warns and is still compared.
• ADR-0195. measure.mjs reports quote coverage of closed unknowns: 108 / 183 on the 41
  baseline corpora. It never gates.
• ADR-0196. lead-orchestrator's kit note carries the research rules to builders and
  reviewers.
• Plan B3. In keyless captures, a quoted > inside an attribute no longer ends a tag. Known
  limit: a closing tag written inside a quoted value still ends the element.
• Measurements and decision corpora. The refresh baseline and movement.mjs, the
  punctuation-spacing research, the pre-registered recheck study, and the first real quoted
  refresh (warc-export: 2 pages, 2 quotes).
• Docs. AGENTS.md (Rule 1 step 4 and the Baseline paragraph), the template AGENTS.md, and
  WORK-WITH-EVIDENCE.md.

ADRs 0192-0195 are an exception to the ADR-0157 hold, by the owner's ruling of 2026-10-25.

How it was checked

• Every commit that touched fetchproof/ ran the full suite in its commit hook.
• Each unit had a fresh-context reviewer, then a fix unit.
• Phase 4b had four reviewers: spec, breaker, mutation and invariant. All 18 surviving mutants
  are now pinned.
• Break-test (Stage 6): the baseline full suite was 2205/0. One in-range finding (movement.mjs could not be
  imported when argv[1] names no file) is fixed with a red-first test. Two intermittents are explained, not fixed (below).
• Gap-audit (Stage 7): 16 of 19 requirements verified by it, the other two closed since. Gap 1
  (a redirected refresh escaped the recheck) is fixed in this PR after three build rounds and three
  fresh reviews; gaps 2 and 3 are pinned as KNOWN GAP tests; gap 4's shape is closed by the same
  join, and only its Firecrawl wording fact stays unverified (1 credit, not spent).
• four-dimension-audit (fresh context, at the final head): SPEC 9/10, DESIGN 7/10, CORRECTNESS 8/10,
  QUALITY 6/10; no new S1/S2. Its main notes: checks.mjs now holds the refresh logic inline (1494
  lines), and about a quarter of the added lib lines are review-history comments. A refactor is
  left for a follow-up PR.
• The run's traceability and report are in the run folder (not committed):
  docs/orchestration/2026-10-25-quote-level-refresh/ (TRACEABILITY.md, REPORT.md).

Full suite on the final head (6d9ed56): 2228 passed, 0 failed, in 1828 s on Windows. Root preflight: PASS.

For the owner

1. ADR-0191's reopen trigger. Did it fire on the punctuation-spacing E-02 quote? That is a
   quote of link markup, in a corpus about markup (U1 review F2).
2. ADR-0194's exemption blind spot. A Finding that names 404 or 410 as content is exempt
   too: 8 of 344 cited rows. This is recorded, not narrowed. Narrowing it needs a new marker
   convention.
3. quote-survived-refresh passes are printed only with --show-pass and in --json.
   Should the gate print them by default, so the advice to re-read the new row is seen?

Follow-ups (not in this PR)

• browser-transport.mjs:295 strips tags with the same attribute-text leak B3 fixed in the
  keyless converter.
• The resultLinks class regex is quadratic on an unclosed <a href. This is pre-existing:
  3.5 s per 130 KB.
• Six older bin scripts use the main-guard pattern that movement.mjs had. Reached through a
  link, they exit 0 silently.
• The collector reads a string status such as 404 Not Found as no status. The recheck no
  longer passes on it.
• The panel test "an oversized POST receives the 413 JSON refusal" fails about 5 in 300 runs under
  load. The break-test found the mechanism: the server closes the connection while the client is still
  uploading, so the client gets a reset instead of the 413. A proposed fix (answer after reading the body)
  ran 300/300 clean; it is outside this PR's range.
• Under heavy machine load, the requests test auto-collect: a fresh panel start re-delivers every old result by staging the whole research/ folder before the dirty-tree check, so an operator's unfinished edits are committed and pushed under an old request's subject #325 ("a delivery held back by an earlier
  request's failed push...") failed in a hook run and in 2 of 3 group runs. Alone it takes
  29-38 s against the 60 s per-test watchdog. The break-test then reproduced a 60 s watchdog timeout
  with the test alone under load: it starts about 90 git and node processes.
• hardening's builtin scan (withoutCommentsAndStrings) pairs quote marks without knowing regex
  literals, so a quoted name in a comment after a regex holding quotes reads as code.
• The harness's runPending calls entry.fn() before its watchdog starts, so a synchronous
  test cannot time out.
• normalizeForMatch link-regex quirks: \[...\](PDF) and [ [edit](url) ].
• movement.mjs's statusOf hides found for too-short anchors.
• From the last G1-fix review (all fail safe or wording):
  • the move-of-a-move reopen can name the wrong moved address when two addresses redirect into
    the landed page (probe W);
  • ADR-0193 decision 8 does not say that a later 404 of the old address is ignored once the
    row's own URL has been fetched (the K case);
  • a move passes on an older capture when the landed page's newest capture has no row (probe U,
    the same class as a refresh with no row);
  • movedCitation's docstring omits "and the landed page has not moved on since".
• Struck-through quotes (~~...~~) and text changed inside an ellipsis gap still survive the
  recheck (pinned as KNOWN GAP tests).
• Structure (four-dimension-audit DESIGN 1, QUALITY 1-3): move the refresh-judgement functions out of
  checks.mjs into their own module, and trim the review-history docstrings to the rule and an ADR pointer.
  Left until after merge, so three review rounds and the mutation evidence stay valid.
• Work the plan leaves for later:
  • the misleading-quote suite;
  • the section 10.5 reviewer measurement;
  • the section 12 trials.