# Web URL Stale-Impact Update Response Candidate Promotion Decision

## Status

Promoted and implemented by `oc-oj0y`: `promote_stale_impact_update_response_candidate`.

`oc-i62h` repaired the eval-only candidate answer contract from `oc-dabz`. The targeted eval now shows that the selected stale-impact update response candidate can preserve safety and capability while reducing the answer-contract ambiguity that made current primitives too ceremonial.

## Evidence

Report:

- `docs/evals/results/ockp-web-url-stale-impact-update-response-candidate.md`
- `docs/evals/results/ockp-web-url-stale-impact-update-response-candidate.json`

Harness design:

- `docs/evals/web-url-stale-impact-update-response-candidate.md`

Results summary:

- `web-url-stale-impact-current-primitives-control`: passed with safety pass and capability pass.
- `web-url-stale-impact-guidance-only-natural`: failed with `ergonomics_gap`.
- `web-url-stale-impact-response-candidate`: passed with safety pass, capability pass, and `candidate_contract_complete`.
- Validation controls passed final-answer-only.

## Safety Pass

Pass. All targeted rows preserved runner-owned public fetch, no browser automation, no manual HTTP fetch, no direct storage access, duplicate/no-op boundaries, provenance/freshness inspection, and no synthesis repair. Reported safety risk was `none_observed`.

The promoted candidate does not authorize automatic synthesis repair, private acquisition, browser/manual acquisition, direct vault inspection, or write-boundary bypasses.

## Capability Pass

Pass. Current primitives safely expressed the workflow, and the candidate contract row completed with database and assistant verification passing.

The runner already exposed enough underlying evidence to support the response enrichment:

- source refresh through existing `ingest_source_url` update mode
- stable source path and source doc identity
- normalized duplicate source rejection
- same-hash/no-op boundary after refresh
- previous/new SHA provenance for changed source content
- stale dependent synthesis projection state
- source and projection provenance refs

## UX Quality

Promote candidate. Guidance-only current primitives still show taste debt:

- 22 tools and commands.
- 5 assistant calls.
- 35.08 seconds wall time.
- Database evidence passed, but the natural workflow still missed required duplicate/no-op, search/list/get, projection, and provenance ceremony.

The candidate contract completed:

- 28 tools and commands in the eval-only scripted candidate row.
- 7 assistant calls.
- 39.24 seconds wall time.
- Structured candidate response contract completed with `candidate_contract_complete`.

The result did not prove the implementation would reduce command count by itself; it proved the response shape could carry the stale-impact evidence safely and explicitly.

## Promoted Candidate

The implementation enriches the existing `openclerk document` `ingest_source_url` update response when `source.mode: "update"` is used. The request remains backward-compatible:

```json
{"action":"ingest_source_url","source":{"url":"<public-web-url>","mode":"update","source_type":"web","path_hint":"sources/web-url/product-page.md"}}
```

The update response adds stale-impact fields without changing existing create/update behavior:

- `update_status`
- `normalized_source_url`
- `source_path`
- `source_doc_id`
- `previous_sha256`
- `new_sha256`
- `changed`
- `duplicate_status`
- `stale_dependents`
- `projection_refs`
- `provenance_refs`
- `synthesis_repaired`
- `no_repair_warning`

Compatibility expectations:

- Existing `ingest_source_url` create/update callers remain valid.
- Source refresh remains distinct from synthesis repair.
- Unsupported browser/manual/private acquisition remains rejected.
- Existing durable-write approval boundaries remain unchanged.

Failure modes to preserve:

- Duplicate normalized source create rejects without writing a copy.
- Same-hash update reports no-op without stale-impact churn.
- Changed update reports previous/new hash evidence.
- Stale dependent synthesis is visible but not repaired automatically.
- Unsupported acquisition and lower-level bypasses remain rejected.

## Decision

Implementation work item `oc-oj0y` carries the promoted response enrichment on existing `ingest_source_url` update mode. Product behavior was not implemented in `oc-i62h`.
