fix: preserve grounded specs across video shards - #2638

Fixes #2639

Multi-shard extraction now retains available grounded specifications and their exact source references, including independent shards that reuse local IDs. This follow-up completes the shared sectional prompt constraints and chooses complete application metadata from a later candidate when the first candidate has empty fields.

Current correction

Head: 2f9649262539638e75104c6c318a69da72dfd326. Tree: a5227c5811fc773c9dfba6b0d180dcf533a8e51b, identical between the local staged merge and GitHub's created tree. This history-preserving integration retains prior head 5d4375e2ef48261b44877a8ab3ea29189ac99373 and current main 512a2558f73d6281b6a880548bedf140b7e30292 as parents. Application source and regression changes are unchanged by this integration; current main's manifests, lockfile and security workflow are retained byte-for-byte.

• Reuse the single-video strict-field, ID, length, capability enum, citation and honesty constraints in the sectional prompt, retaining the sectional 32-row limit.
• Select the first candidate with both application name and purpose populated.
• Detect merged collections over 64 rows and return an explicit blocking aggregate-limit diagnostic with the collection and count. No source-grounded rows are silently truncated.
• Disable only codex/fix-multishard-grounded-spec through git.deploymentEnabled in root and app Vercel configuration. The first follow-up used an invalid github.enabled object; Vercel rejected it before building with github.enabled should be boolean. Configuration-only commit 5d4375e2ef48261b44877a8ab3ea29189ac99373 corrects that shape to the documented branch map: https://vercel.com/docs/project-configuration/git-configuration. This fixes the configuration error without enabling a preview.

Earlier head 7dcc3642900aed3a700c898220d8010d4dd781dd already added shard-local ID namespaces and reference rewriting, exact-case evidence preservation, raw-to-parsed citation rebasing, and shard-time-bound validation. Their regressions passed again with this correction.

Verification — November 12, 2026 (America/Chicago)

The previous head's Security Scan 43346308028 failed the real high-severity npm-audit gate: 25 high, 22 moderate, zero critical. Its frozen install passed. That failure was caused by the old dependency baseline, including affected Undici, Zod, body-parser, Vite and other packages; it was not the expected missing-preview failure.

The clean integration imports current main's already-reviewed dependency fixes and preserves exactly its full-graph npm audit --audit-level=high policy. No exception, severity downgrade, dev-dependency exclusion, or CI weakening is added. Relative to main, the PR remains eight files with the same 517 additions/30 deletions: the existing source/tests/evidence fixture and two branch deployment guards.

Executed against the exact integrated tree:

• Node 24.22.1, repository npm 10.8.0: npx --yes npm@10.8.0 ci --ignore-scripts --legacy-peer-deps --no-audit --no-fund completed, exit 0. The reviewed existing Workflow postinstall patch was run explicitly.
• npm --workspace=apps/web test -- src/lib/__tests__/video-pack-multishard-grounded-spec.test.ts src/lib/__tests__/video-pack-extractor.test.ts src/lib/__tests__/video-pack-extract-merge.test.ts src/lib/__tests__/grounded-spec-pipeline.test.ts src/lib/__tests__/video-pack-consolidator.test.ts src/lib/__tests__/dependency-runtime-compatibility.test.ts src/lib/__tests__/gemini-sdk-continuation.test.ts --maxWorkers=2 --reporter=dot: seven files, 110 tests passed, exit 0.
• npm --workspace=apps/web run type-check, full web lint, and cached diff whitespace check: exit 0.
• npx --yes npm@10.8.0 audit --audit-level=high --json: exit 0, zero critical, zero high, 29 moderate. Moderate findings remain; this is not a clean-audit claim.
• Manifest/lock bytes remained unchanged after frozen install and audit. The four dependency/security files match current main byte-for-byte. Both JSON deployment configurations parse with this exact branch disabled through git.deploymentEnabled.
• Local staged tree a5227c5811fc773c9dfba6b0d180dcf533a8e51b equals GitHub's tree exactly. Existing branch update used an expected-head lease.
• Exact-current-head npm-audit job 131630517401 completed successfully, independently confirming the corrected high-severity gate. Current-head Dependency Review run 43347572496 also passed. Other hosted CI/security/build acceptance is still pending. The earlier seven-file 90-case borrowed-dependency run is historical; this new 110-case receipt uses a fresh exact-lock install.
• One transient executor disconnect interrupted result retrieval; after recovery the suite was repeated and types/lint/audit completed with actual exits above. No passing production build or live extraction is claimed.
• No production build retry was attempted here; the separate local build approval block remains respected. No live extraction, paid provider call, server-side action or deployment was executed.

Security dependency evidence

• Advisory: the old audit included Undici GHSA-2m5v-pch6-74hx, Zod GHSA-mrhx-c7xc-m3w5, body-parser GHSA-27r3-jxmh-p828, and Vite GHSA-587h-7wmj-h5pm. This integration reuses main's fixes; no new advisory exception is introduced.
• Package and versions: dependency files are exactly current main 512a2558f73d6281b6a880548bedf140b7e30292, preserving its direct/transitive classification and floors, including Workflow-owned Undici >=7.30.1, Zod >=4.6.6, body-parser >=2.4.0 and Vite >=8.3.3.
• Validation: exact-lock frozen install, 110 regressions, web types/lint and full-graph high audit pass as above; 29 moderate findings remain. Fresh hosted acceptance is pending.
• Rollback: prepare a reviewed revert that preserves unrelated main changes. Restoring the old dependency baseline reintroduces the observed audit failures. Keep this draft unmerged and undeployed until all required gates pass.

Remaining HOLD: aggregate capacity

The review request to keep all 66 requirements usable remains unresolved. The final schema allows at most 64 rows per collection. Three valid 22-row shards therefore produce a blocking diagnostic rather than an available grounded spec. Changing the supported aggregate bound or selecting a bounded partial result requires a separate reviewed decision; this patch preserves the existing bound and fail-closed behavior. The overflow thread remains open.

Seven other review threads are resolved using the implemented corrections and passing regressions. This remains a draft and unmerged, with this branch excluded from automatic deployments in both versioned configurations. No live extraction, paid provider call, server-side action or production acceptance was executed; the regression uses saved source evidence and offline test responses.