Product catalog and manufacturer questions

The product-research page now has a separate catalog panel. Research dossiers and their quoted evidence, question documents, review receipts and downgrade protections keep their existing behavior.

A catalog identity is manufacturer + model + explicit variant. Matching normalizes Unicode NFC, case and whitespace; punctuation and variants remain distinct. Discovery titles and aliases cannot merge products. Concurrent imports serialize per project and create immutable evidence versions under one canonical identity. CRM companies remain manufacturer/business records, never product records.

Each specification retains its exact quoted assertion, source URL, excerpt SHA-256, capture time, format, declared attribution, model/variant match, typed number/unit when recognized, confidence and missing/contradicted state. Supported means the excerpt states an exact identity, not that the manufacturer or claim was verified. kg/g and m/cm/mm normalize; arbitrary values stay text. Manufacturer/community attributions are declared claims. Conflicting claims remain visible even after a human confirmation. New evidence never changes the confirmed claim. Freshness is recalculated on reads (30 days; future captures are unverified). Version readback uses ?version=N; each version records changed fields.

The catalog form performs at most one search and three fetches through the existing pinned public-web extraction interface. The API allows up to eight fetches. Search snippets are discovery only. The maintained web adapter currently retains a paragraph/metadata brief capped at 1,500 characters; only explicitly labeled specifications in that excerpt are parsed, and absent or unsupported layouts remain unknown. Uploaded PDF bytes use the maintained isolated PDF extraction worker, with a 400,000-byte input cap, 12,000-character excerpt cap and its existing parser deadline/page/memory limits. Public PDF downloading remains unavailable; /pdf accepts already acquired document bytes. No new crawler or model tools are granted by evidence. Every source is untrusted data.

Missing, contradicted, unverified or stale fields produce a versioned UNSENT manufacturer request, linked to the product version and field names. Review uses an interactive human session and a current request version; changed products require a fresh request. The composer contract has no recipient and send:false. Actual mail sending is OPEN until the private composer and verified recipient setup are integrated. A returned evidence record binds request, conversation reference, product and fields, appends a product version and changes the request to needs_human_review. A conversation reference is unverified input, not proof of the sender. Supported returned excerpts do not automatically confirm a specification. Requests show a seven-day follow-up due date and overdue state; no reminder or email is dispatched.

All catalog routes sit under /v1/orgs/{orgId}/projects/{projectId}/product-research/catalog, inherit the artifact flag/auth/no-store boundary, and enforce current org/project membership. Reads require viewer, writes tester, confirmation/review an interactive session. Mutations recheck credential and creator standing before commit. A collection reserves an immutable operation UUID before I/O. Stop, revoked authority, deadline or an ambiguous operation prevents later writes. Repeating a completed operation returns its stored result; stopped/UNKNOWN operations never replay external extraction. A fresh operation is an explicit new intent, not an automatic retry.

Integration status: the five-table catalog schema is committed through official migration13510; deployment and live acceptance are pending. Signed-in catalog use retains the reviewed session authority checks. The ordinary scoped-key route allowlist and curated MCP tools are being qualified separately; the privileged session-based generic call_api fixture does not prove ordinary API-key, MCP or QAC execution. The typed daily action delegates scheduling and frozen approval/egress checks to the existing deterministic workflow executor; engine-owner registration remains OPEN. No independent scheduler was added. The private mail composer is absent at this base; producer contract and local recording seam are delivered. No live product/customer data, provider, paid search, model or email calls were used in acceptance tests.

Implementation relied on the current PostgreSQL transaction-lock documentation and Zod strict object schemas. Source-specific SQL, HTTP, MCP, PDF and browser behavior is exercised against locked local dependencies by the owning catalog tests.