feat(cli): add saved source-change reviews with explicit acknowledgment

.github/workflows/ci.yml

@@ -21,6 +21,7 @@ jobs:
       - run: bun run typecheck
       - run: bun run check:boundaries
       - run: bun run test
+      - run: bun run check:examples
       # What a release of this tree would put on npm: internal ranges that name
       # the versions built here, nothing depending on an unpublished package,
       # and the packed tarballs installing together and starting the CLI. The

.github/workqueue/CLI-REVIEW-01.md

@@ -0,0 +1,63 @@
+---
+id: CLI-REVIEW-01
+status: done
+priority: high
+dependencies: []
+packages: ["evidence-graph", "ingestion", "persistence", "cli"]
+layer: L1
+effort: large
+---
+
+# Saved source review
+
+## What
+
+Make repeated review of known MediaWiki sources a complete CLI workflow: observe
+since the last acknowledged revision, inspect full text and provenance, then
+acknowledge the saved report without fetching newer edits.
+
+## Why
+
+A revision stream alone leaves consumers to maintain review baselines, recover
+interrupted runs, add source context, and distinguish empty output from missing
+history. Passage status must describe the latest observed revision.
+
+## Implementation
+
+- Atomic JSON state and reports with separate reviewed and fetched cursors.
+- Watchlists, source-scoped entry identities, resumable pending inputs, and stale-report checks.
+- Markdown/JSON reports, mechanical view filters, full text, source links, and offline sample.
+- Parent and content-availability metadata, bounded cache selection, and captured explorer inputs.
+- Shared passage status implementation and matching uncertainty in CLI/MCP.
+- Documentation and a real-user fit assessment protocol.
+
+## Invariants
+
+- Deterministic observation; interpretation stays with the consumer.
+- Fetching never acknowledges revisions.
+- No text comparisons across known missing parents or unavailable text.
+- Native event identity is preserved; review entry identity includes the source.
+- Incomplete reports cannot advance a reviewed cursor.
+
+## Acceptance
+
+- [x] Review, resume, filtering, acknowledgment, and subsequent edits pass offline and compiled CLI checks.
+- [x] Latest passage absence and uncertainty pass regression checks through CLI/MCP.
+- [x] Explorer preserves captured ranges and exposes coverage.
+- [x] Captured examples regenerate identically.
+- [x] Core build, Biome, typecheck, boundary, tests, and packed-consumer gates pass.
+
+Real-user demand and time savings are not established by these checks. The guide
+provides a repeat-review protocol for assessing fit with actual users.
+
+## Validation
+
+- Core build, Biome, typecheck, architecture boundary, and packed-consumer gates passed.
+- 148 suites passed with 1,109 passing tests; live suites are skipped in the default gate.
+- Separate live MediaWiki contract run passed 9 tests.
+- Compiled CLI watchlist tests cover filtering, acknowledgment without fetching, and later edits.
+- A Node consumer installed from six local package tarballs completed the offline review, acknowledgment, and quiet next review.
+- SQLite migration was checked against an actual database with the prior schema.
+- All three example capture scripts passed byte-comparison checks; 99 relative documentation links and anchors passed.
+
+The source changes have not been published. Real-user fit remains unmeasured.

CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## Unreleased
 
+### Added
+
+- `refract review`: source watchlists, saved fetched/reviewed revision cursors, resumable history fetching, and explicit acknowledgment of an inspected report.
+- Markdown and JSON review reports with source identity, changed text, revision links, mechanical filters, saved inputs, and coverage. `review --sample` demonstrates the complete workflow offline.
+- Optional revision parent and source-text availability metadata. Coverage reports missing inputs and avoids text comparisons across known gaps.
+
+### Fixed
+
+- Latest passage disappearance now reports absence from the latest fetched revision. Partial matches expose inspectable candidate text and uncertainty; unavailable latest text returns `unknown` through the CLI and MCP.
+- Bounded analysis no longer mixes unrelated cached revisions into the selected range. Interactive analysis serves its captured inputs; the explorer accepts explicit bounds and shows coverage.
+
+## Unreleased
+
 ### Fixed
 - **`refract verify --html` marked every event's proof "Merkle Root Match"**, including in a bundle that had failed verification. Each row now shows the verifier's result for that event's hash and for its proof, the page lists the checks that failed, and it states what `verify` checks and what it does not. The receipt and the command's output no longer say "cryptographically verified" or "integrity verified": nothing in a bundle is signed. Revision IDs read from the bundle are HTML-escaped like the other fields.
 - **`refract mcp` answered notifications with "Method not found"**. A message with no `id`, such as the `notifications/initialized` every MCP client sends after `initialize`, got a -32601 error reply, which JSON-RPC 2.0 forbids. Both `refract mcp` and `@refract-org/mcp` now ignore notifications, including unknown ones, without writing anything back. An unknown request, one that has an `id`, still gets -32601; that now includes a request named `initialized`, which used to get no reply at all.