feat: bind full-text review decisions to retained evidence

AGENTS.md

@@ -18,6 +18,8 @@ ConceptWeave owns automatic, evidence-bound **Semantic Model Engineering**. Do n
 - Preserve source evidence, truth status, and publication state separately.
 - Keep Zotero full-text captures separate from metadata reports and approval receipts; restored captures require bounded verification, and local HTTP continuity is not peer authentication.
 - Full-text review views are read-only evidence; never strip their outer binding into a metadata-only patch and claim full-text decision or approval provenance.
+- Full-text decisions use the separate blank-start worksheet and atomic exact-view application; reverify the capture/report relation through finalization and whole-envelope governance. No reviewed-set downcast grants Zotero write authority.
+- Offline full-text commands reuse the private-file boundary and pass completed-view bytes unchanged into atomic validation. Finalized files await external approval verification; no CLI command issues approval or writes Zotero.
 - Published semantic truth is immutable; correction uses supersession/new release.
 - Public Rust APIs require beginner-readable documentation.
 - Owned production coverage target is 100% line/function/region/branch where tooling exposes it.

ARCHITECTURE.md

@@ -26,6 +26,8 @@ Research Intake's Zotero adapter retains optional full-text observations in a se
 
 Its Full-Text Review View reuses capture verification and canonical pending selection to make exact text inspectable without changing earlier proposals. This bounded read projection is not an aggregate or a decision-application API; the metadata-only approval chain does not acquire full-text provenance from it.
 
+The separate Full-Text Review Worksheet starts blank and retains one capture identity through atomic completed-view application, finalization and whole-envelope governance verification. Every boundary rechecks the capture against the complete report. The offline CLI exposes initialization, evidence-view creation, atomic application and finalization using those existing review cores and private-file helpers. Completed JSON bytes enter the owner parser unchanged, preserving duplicate-key detection. External approval verification remains a caller-owned library boundary; no CLI verifier, service or new source of semantic truth is introduced. Verified review still does not admit Zotero writes, whose exact change set requires independent authorization.
+
 | Context | Type | Owns | Does not own |
 | --- | --- | --- | --- |
 | Source Observation | Supporting | immutable observations, parser receipts, evidence locations | source-system business truth |

CHANGELOG.md

@@ -10,6 +10,8 @@ All notable changes to ConceptWeave are documented here.
 
 ### Added
 
+- Private review commands now show saved text, accept completed decisions without replacing earlier work, and prepare a complete review for independent approval verification. They do not supply decisions or approve a review.
+
 - Private inspection of pending papers alongside their saved text, preserving missing material and leaving previous reports and decisions unchanged.
 
 - Private, replayable paper-text capture for later research review, preserving unavailable material and leaving earlier reports and approvals unchanged.
@@ -32,6 +34,10 @@ All notable changes to ConceptWeave are documented here.
 
 ### Security
 
+- Invalid private review files no longer expose rejected field names or values in error messages. File-role, size and access errors remain distinguishable.
+
+- Completed text-review files reject changed evidence, stale decisions and duplicate fields before updating local work. Earlier approvals cannot silently acquire later text evidence.
+
 - Local research requests bypass environment-configured proxies. This prevents unintended proxy forwarding; local peer authentication remains an explicit release limitation.
 
 - Source receipts bind complete captured metadata and actual classifier inputs; earlier report and review artifacts require regeneration under the versioned digest representation.
@@ -41,4 +47,8 @@ All notable changes to ConceptWeave are documented here.
 
 ### Fixed
 
+- Invalid or stale classification changes are rejected before redeeming approval, preserving it when a request cannot produce a valid plan.
+
+- Oversized private review outputs fail before creating a file, so a successful save stays within the corresponding reader's size limit. Large saved-text captures retain their separate limit.
+
 - Research reads accept valid responses exactly at their documented size limit while still rejecting oversized, incomplete or invalidly encoded responses.

CLAUDE.md

@@ -9,3 +9,5 @@ Keep domain logic in bounded domain modules, LLM/provider logic behind ports/ada
 Zotero source capture must not alter the metadata report or renew its approval. Preserve private-file protections and the full bibliographic denominator, including missing and partial text.
 
 The separate full-text review view does not authorize decisions or writes. Keep its evidence binding intact; existing metadata-only apply/finalization cannot establish full-text-reviewed approval.
+
+Use the capture-bound blank-start worksheet for full-text decision work. Only the dedicated atomic view path may apply completed slots; finalization/evaluation reverify capture/report bindings and require whole-envelope external approval. Offline CLI view/application/finalization preserve that envelope and earlier files. They do not supply a reviewer, authenticate approval, or admit Zotero writes.

THREAT_MODEL.md

@@ -77,4 +77,8 @@ PR #30 commit `9733d28` reproduced the inode-preserving final-component symlink
 
 The optional full-text review view must not be confused with the metadata-only decision or approval artifacts. A required versioned outer envelope and strict legacy parsers prevent silent direct application; an intentional caller can still strip fields, so no full-text-reviewed approval is claimed. The complete capture is reverified before selecting text, unrelated parent text is excluded, and output serialization itself is bounded. The larger serialized-capture input ceiling is separate from the unchanged report/worksheet limit. Source text is untrusted data, never instructions, and source content must not be included in input-error diagnostics.
 
+Capture-bound review uses separate required versioned payloads, with no import of previous metadata decisions. Atomic application permits only completed decision slots in the exact current view; recursive duplicate-key rejection precedes projection so a changed first field cannot hide behind a canonical later field. Finalization and evaluation revalidate the capture against the complete current report, including proposal records, before authority is contacted. Governance must authenticate the entire outer reviewed set and every label. Owner-only storage, private fields and hashes do not defeat a malicious local replacement or prove human review. Preserve old artifacts; stale views fail rather than overwrite concurrent work. These APIs neither implement authenticated governance nor authorize the independent Zotero write contract. Restoring report/capture/worksheet/approval JSON still requires caller-owned bounded private-file admission.
+
+The offline full-text commands reuse those private readers and pass completed-view bytes unchanged into the duplicate-key-aware application boundary. Distinct argument strings do not replace opened-file identity checks. Metadata/review serialization must fit the inclusive 16 MiB reader limit before a new file is created; the larger capture remains a separate bounded artifact. Shared private JSON deserialization replaces syntax/type errors with static diagnostics, preventing unknown-field names or invalid enum values from echoing private material. Role, size and I/O errors remain distinguishable. Finalization writes only an input for independent verification, never an approval result. Test-only labels and receipts cannot be substituted for genuine campaign decisions or authority.
+
 A capability is not release-ready while a valid security finding lacks a deterministic test or equivalent machine-verifiable contract, while required exact-head checks are non-terminal, or while the implemented transport cannot satisfy the advertised security claim. Documentation must describe residual risk without upgrading provider guarantees by inference.

crates/conceptweave-zotero/src/full_text_capture.rs

@@ -6,6 +6,9 @@ use crate::{
     local_agent, validate_item_key, verify_server_id,
 };
 use serde::{Deserialize, Serialize};
+#[path = "full_text_review.rs"]
+mod full_text_review;
+pub use full_text_review::*;
 use sha2::{Digest, Sha256};
 use std::collections::BTreeMap;
 use std::fmt;