Store document image uploads in SQLite

Reviewed-on: #47

README.md

@@ -179,6 +179,18 @@ python3 scripts/documents-client.py save "$api_work_dir/document.json"
 
 客户端只自动重试一次临时网络或 `502/503/504` 错误，保持正文和请求 ID 不变；`409` 等业务错误不会自动覆盖。它不跟随 HTTP 重定向，避免将 Bearer 凭据转发到其他地址。正文和 Key 继续保存在数据库或私有文件中，不因使用 API 而进入 Git。
 
+### 上传正文图片
+
+使用前述 HTTPS 或 SSH 隧道配置以及 `read-write` 文档 API Key：
+
+```sh
+python3 scripts/documents-client.py upload-image ./diagram.png
+```
+
+客户端向 `POST /api/documents/images` 发送原始图片字节，`Content-Type` 为 `image/png`、`image/jpeg` 或 `image/webp`。服务端接受最大 8 MiB、2500 万像素的静态图，转换为最大 2000 × 4000 像素、2 MiB 的 WebP，并按处理后内容去重。
+
+把响应中的 `url` 放入 Markdown，例如 `![渲染流程图](/api/documents/images/<id>)`，然后通过章节 API 保存正文。登录读者和文档 API Key 均可读取图片。图片存入现有持久化 SQLite，同步纳入整库备份。仅导出正文的 `docs export` 保留图片引用，迁移时需使用包含图片的整库备份。
+
 ## 研究数据与检查
 
 研究工作台提供公司筛选、经营指标、原始证据、收费与交付模式、技术材料及核查记录。它区分公司披露、支付平台指标、第三方估算、融资和客户收益；未知收入不填零，材料可访问也不代表性能或商业效果已经验证。研究范围、样本限制和个案结论以工作台记录为准。

apps/docs/package.json

@@ -20,7 +20,8 @@
     "react": "19.3.1",
     "react-dom": "19.3.1",
     "react-markdown": "10.1.0",
-    "remark-gfm": "4.0.1"
+    "remark-gfm": "4.0.1",
+    "sharp": "0.35.5"
   },
   "devDependencies": {
     "@tailwindcss/postcss": "4.3.3",
@@ -33,7 +34,6 @@
     "eslint": "^9.39.5",
     "eslint-config-next": "16.4.3",
     "postcss": "8.5.31",
-    "sharp": "0.35.5",
     "tailwindcss": "4.3.3",
     "typescript": "~5.9.3"
   }

apps/docs/scripts/auth-cli.ts

@@ -182,10 +182,10 @@ async function main() {
   assert.equal(researchResponse.status, 200, "authenticated research API");
   assert.ok(researchResponse.headers.get("cache-control")?.includes("no-store"));
   const research = await researchResponse.json();
-  assert.equal(research.companies.length, 1253);
+  assert.equal(research.companies.length, 1312);
   assert.equal(research.categories.length, 11);
-  assert.equal(research.evidence.length, 4894);
-  assert.equal(research.observations.length, 491);
+  assert.equal(research.evidence.length, 5354);
+  assert.equal(research.observations.length, 495);
   assert.equal((await request("/api/research/ai-companies", { method: "POST", headers })).status, 405);
   const researchPage = await request("/docs/other-research/ai-company-research/overview", { headers });
   assert.equal(researchPage.status, 200);

apps/docs/src/lib/document-images.ts

@@ -0,0 +1,39 @@
+import { createHash } from "node:crypto";
+import { openSiteDatabase } from "./site-database";
+
+function openImages() {
+  const db = openSiteDatabase();
+  try {
+    db.exec(`CREATE TABLE IF NOT EXISTS document_images (
+      id TEXT PRIMARY KEY,
+      bytes BLOB NOT NULL
+    )`);
+    return db;
+  } catch (error) {
+    db.close();
+    throw error;
+  }
+}
+
+export function saveDocumentImage(bytes: Buffer) {
+  const id = createHash("sha256").update(bytes).digest("hex");
+  const db = openImages();
+  try {
+    db.prepare("INSERT INTO document_images (id, bytes) VALUES (?, ?) ON CONFLICT(id) DO NOTHING").run(id, bytes);
+    return id;
+  } finally {
+    db.close();
+  }
+}
+
+export function readDocumentImage(id: string) {
+  const db = openImages();
+  try {
+    const row = db.prepare("SELECT bytes FROM document_images WHERE id = ?").get(id) as
+      | { bytes: Uint8Array }
+      | undefined;
+    return row ? Buffer.from(row.bytes) : undefined;
+  } finally {
+    db.close();
+  }
+}

apps/docs/src/pages/api/documents/images/[id].ts

@@ -0,0 +1,24 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+import { documentApiError } from "@/lib/documents-api";
+import { readDocumentImage } from "@/lib/document-images";
+
+// The site proxy accepts a logged-in reader or a document API key on this route.
+export default function handler(request: NextApiRequest, response: NextApiResponse) {
+  try {
+    response.setHeader("Cache-Control", "private, no-store");
+    response.setHeader("X-Content-Type-Options", "nosniff");
+    if (request.method !== "GET" && request.method !== "HEAD") {
+      response.setHeader("Allow", "GET, HEAD");
+      return response.status(405).end();
+    }
+    const id = request.query.id;
+    if (typeof id !== "string" || !/^[a-f0-9]{64}$/.test(id)) return response.status(404).end();
+    const bytes = readDocumentImage(id);
+    if (!bytes) return response.status(404).end();
+    response.setHeader("Content-Type", "image/webp");
+    response.setHeader("Content-Length", bytes.length);
+    return request.method === "HEAD" ? response.status(200).end() : response.status(200).send(bytes);
+  } catch (error) {
+    return documentApiError(response, error);
+  }
+}

apps/docs/src/pages/api/documents/images/index.ts

@@ -0,0 +1,64 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+import sharp from "sharp";
+import { authorizeDocuments, documentApiError } from "@/lib/documents-api";
+import { saveDocumentImage } from "@/lib/document-images";
+
+const maxUploadBytes = 8 * 1024 * 1024;
+const maxStoredBytes = 2 * 1024 * 1024;
+const imageTypes = new Set(["image/png", "image/jpeg", "image/webp"]);
+const imageFormats = new Set(["png", "jpeg", "webp"]);
+
+export const config = { api: { bodyParser: false } };
+
+export default async function handler(request: NextApiRequest, response: NextApiResponse) {
+  try {
+    if (request.method !== "POST") {
+      response.setHeader("Allow", "POST");
+      return response.status(405).end();
+    }
+    if (!authorizeDocuments(request, response, true)) return;
+
+    const type = request.headers["content-type"]?.split(";")[0].trim().toLowerCase();
+    if (!type || !imageTypes.has(type)) {
+      return response.status(415).json({ error: "请上传 PNG、JPEG 或 WebP 图片" });
+    }
+    if (Number(request.headers["content-length"]) > maxUploadBytes) {
+      return response.status(413).json({ error: "图片上传上限为 8 MiB" });
+    }
+
+    const chunks: Buffer[] = [];
+    let length = 0;
+    for await (const chunk of request.iterator({ destroyOnReturn: false })) {
+      const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      length += bytes.length;
+      if (length > maxUploadBytes) {
+        return response.status(413).json({ error: "图片上传上限为 8 MiB" });
+      }
+      chunks.push(bytes);
+    }
+
+    let encoded: Buffer;
+    try {
+      const input = sharp(Buffer.concat(chunks), { limitInputPixels: 25_000_000 });
+      const { format, pages } = await input.metadata();
+      if (!format || !imageFormats.has(format) || type !== `image/${format}` || (pages ?? 1) > 1) {
+        return response.status(415).json({ error: "图片格式需与声明一致，且只支持静态图片" });
+      }
+      encoded = await input.rotate()
+        .resize({ width: 2000, height: 4000, fit: "inside", withoutEnlargement: true })
+        .webp({ quality: 85 })
+        .toBuffer();
+    } catch {
+      return response.status(400).json({ error: "无法解码图片，或像素数量超过限制" });
+    }
+    if (encoded.length > maxStoredBytes) {
+      return response.status(413).json({ error: "处理后的图片超过 2 MiB，请缩小后重试" });
+    }
+
+    const id = saveDocumentImage(encoded);
+    const url = `/api/documents/images/${id}`;
+    return response.status(200).json({ id, url, contentType: "image/webp", size: encoded.length });
+  } catch (error) {
+    return documentApiError(response, error);
+  }
+}

apps/docs/src/pages/docs/[...slug].tsx

@@ -23,6 +23,10 @@ import { collectionEntries, collectionLabel } from "@/lib/collections";
 import { Icon } from "@/components/Icon";
 import { headingsFor } from "@/lib/navigation";
 
+function isZoomableFigure(source: string) {
+  return source.startsWith("/figures/endor-") || /^\/api\/documents\/images\/[a-f0-9]{64}$/.test(source);
+}
+
 type Props = { doc: Doc; docs: DocLink[] };
 const AICompanyResearch = dynamic(() => import("@/components/AICompanyResearch"));
 export const getServerSideProps: GetServerSideProps<Props> = async ({ params, res, resolvedUrl }) => {
@@ -120,14 +124,14 @@ export default function DocPage({
                     const slides = node?.children.flatMap((child) =>
                       child.type === "element" && child.tagName === "img" &&
                       typeof child.properties.src === "string" &&
-                      child.properties.src.startsWith("/figures/endor-")
+                      isZoomableFigure(child.properties.src)
                         ? [{ source: child.properties.src, alt: String(child.properties.alt ?? "") }]
                         : [],
                     ) ?? [];
                     const onlyImages = node?.children.every((child) =>
                       (child.type === "element" && child.tagName === "img" &&
                         typeof child.properties.src === "string" &&
-                        child.properties.src.startsWith("/figures/endor-")) ||
+                        isZoomableFigure(child.properties.src)) ||
                       (child.type === "text" && child.value.trim() === ""),
                     );
                     if (slides.length > 1 && onlyImages) return <FigureGallery slides={slides} />;
@@ -141,7 +145,7 @@ export default function DocPage({
                     );
                   },
                   img: ({ src, alt }) =>
-                    typeof src === "string" && src.startsWith("/figures/endor-") ? (
+                    typeof src === "string" && isZoomableFigure(src) ? (
                       <ArchitectureFigure source={src} alt={alt ?? "Endor 架构图"} />
                     ) : (
                       // eslint-disable-next-line @next/next/no-img-element

apps/docs/tests/research.test.ts

@@ -92,7 +92,8 @@ test("ARR ledger preserves historical estimates without promoting targets, run r
   const ids = new Set(rows.map((row) => row.observation.id));
   for (const id of ["O064", "O065", "O066", "O069", "O070", "O071", "O046"])
     assert.ok(ids.has(id), `${id}: historical claims, estimates and unknown currencies remain visible`);
-  for (const id of ["O050", "O052", "O053", "O055", "SR-O-AI067-runrate", "ROCKET-O-arr", "AQ-O-RUNRATE"])
+  for (const id of ["O050", "O052", "O053", "O055", "SR-O-AI067-runrate", "ROCKET-O-arr", "AQ-O-RUNRATE",
+    "SRLEARN1-O-CLAIR-D2C", "SRLEARN1-O-CLAIR-B2B"])
     assert.ok(!ids.has(id), `${id}: excluded or ambiguous records cannot enter the ARR ledger`);
   assert.equal(rows.find((row) => row.observation.id === "O066")?.observation.selection, "historical-estimate");
   assert.equal(rows.find((row) => row.observation.id === "O046")?.observation.unit, "原文$，币种待核");
@@ -123,11 +124,11 @@ test("research revisions share the authentication database and preserve replay l
     for (let i = 0; i < 20; i++) consumeCode(config, "invalid");
     assert.equal(consumeCode(config, "invalid"), "limited");
     const initial = readResearchSnapshot();
-    assert.equal(initial.companies.length, 1253);
-    assert.equal(initial.evidence.length, 4894);
-    assert.equal(initial.observations.length, 491);
+    assert.equal(initial.companies.length, 1312);
+    assert.equal(initial.evidence.length, 5354);
+    assert.equal(initial.observations.length, 495);
     const businessReviews = initial.reviews.filter((review) => review.type === businessModelReviewType);
-    assert.equal(businessReviews.length, 7);
+    assert.equal(businessReviews.length, 26);
     assert.deepEqual(businessReviews, seed.reviews.filter((review) => review.type === businessModelReviewType)
       .sort((a, b) => a.id.localeCompare(b.id)),
       "business model assessments and company/evidence links persist in the shared database");
@@ -169,9 +170,9 @@ test("research validation rejects broken evidence and unsafe source links", () =
 
 test("reviews link explicit companies without turning global or excluded cases into companies", () => {
   const snapshot = structuredClone(seed) as ResearchSnapshot;
-  assert.equal(snapshot.reviews.filter((r) => r.scope === "companies").length, 248);
-  assert.equal(snapshot.reviews.filter((r) => r.scope === "dataset").length, 147);
-  assert.equal(snapshot.reviews.filter((r) => r.scope === "excluded-candidate").length, 54);
+  assert.equal(snapshot.reviews.filter((r) => r.scope === "companies").length, 299);
+  assert.equal(snapshot.reviews.filter((r) => r.scope === "dataset").length, 159);
+  assert.equal(snapshot.reviews.filter((r) => r.scope === "excluded-candidate").length, 65);
   const review = snapshot.reviews.find((r) => r.id === "R4")!;
   assert.deepEqual(reviewCompanyIds(snapshot, review), ["AI007", "AI013", "AI021", "AI034"]);
   assert.deepEqual(reviewCompanyIds(snapshot, snapshot.reviews.find((r) => r.id === "CN-R-PSI")!), []);
@@ -190,11 +191,11 @@ test("reviews link explicit companies without turning global or excluded cases i
 test("disclosure counts exclude client income, biographies, targets and duplicate milestones", () => {
   const snapshot = seed as ResearchSnapshot;
   const summary = categorySummary(snapshot);
-  assert.equal(summary.reduce((n, c) => n + c.count, 0), 1253);
+  assert.equal(summary.reduce((n, c) => n + c.count, 0), 1312);
   assert.equal(summary.reduce((n, c) => n + c.self, 0), 63);
   assert.equal(summary.reduce((n, c) => n + c.estimate, 0), 2);
   assert.equal(summary.reduce((n, c) => n + c.platform, 0), 19);
-  assert.equal(summary.reduce((n, c) => n + c.unknown, 0), 1169);
+  assert.equal(summary.reduce((n, c) => n + c.unknown, 0), 1228);
   assert.equal(snapshot.companies.find((c) => c.name === "Rork")?.revenueStatus, "unknown");
   assert.equal(snapshot.companies.find((c) => c.name === "Result")?.revenueStatus, "unknown");
   assert.ok(snapshot.observations.filter((o) => o.selection === "signal").every((o) => o.scope === "公司整体"));
@@ -229,8 +230,8 @@ test("service run rates, legacy freight revenue and paid adoption do not become
 
 test("technical reviews keep accessible materials separate from tested capabilities", () => {
   const snapshot = structuredClone(seed) as ResearchSnapshot;
-  assert.equal(snapshot.companies.filter((c) => c.technicalReview).length, 244);
-  assert.equal(snapshot.companies.filter((c) => c.technicalReview?.level === "public-artifact").length, 28);
+  assert.equal(snapshot.companies.filter((c) => c.technicalReview).length, 303);
+  assert.equal(snapshot.companies.filter((c) => c.technicalReview?.level === "public-artifact").length, 29);
   assert.equal(snapshot.companies.filter((c) => c.technicalReview?.level === "independent-test").length, 1);
   assert.equal(snapshot.companies.find((c) => c.id === "AI051")?.revenueStatus, "unknown");
   assert.match(snapshot.companies.find((c) => c.id === "AI051")!.technicalReview!.testScope!, /Sep 2026/);
@@ -630,6 +631,216 @@ test("the public SR007 roster preserves unique entries and Alven's older operato
     "a current category change must retain the unresolved historical product attribution");
 });
 
+test("public Speedrun cohort rosters preserve the finite boundary without inventing founding years", () => {
+  const snapshot = seed as ResearchSnapshot;
+  const rosters = snapshot.candidateBatches!.filter((batch) => /^SR00[1-7]-public-roster-2026-1$/.test(batch.id));
+  assert.equal(rosters.length, 7);
+  for (const [index, count] of [25, 25, 32, 42, 59, 59, 79].entries()) {
+    const batch = rosters.find((item) => item.id.startsWith(`SR${String(index + 1).padStart(3, "0")}-`))!;
+    assert.equal(batch.records.length, count);
+    assert.equal(batch.complete, false, "a complete directory page is not completed company-level research");
+  }
+  const rows = rosters.flatMap((batch) => batch.records);
+  assert.equal(rows.length, 321);
+  assert.equal(new Set(rows.map((row) => row.url)).size, 321);
+  const newlyRegistered = rosters.filter((batch) => !batch.id.startsWith("SR007-")).flatMap((batch) => batch.records);
+  assert.equal(newlyRegistered.length, 242);
+  assert.equal(newlyRegistered.filter((row) => row.status === "pending-year").length, 5);
+  assert.equal(newlyRegistered.filter((row) => row.status === "linked").length, 68);
+  assert.equal(newlyRegistered.filter((row) => row.status === "existing-outside-cohort").length, 1);
+  assert.equal(newlyRegistered.filter((row) => row.status === "outside-cohort").length, 144);
+  assert.equal(newlyRegistered.filter((row) => row.status === "pending-ai").length, 24,
+    "a known self-reported founding year does not by itself establish the current AI business");
+  assert.equal(newlyRegistered.filter((row) => row.profileStatus === "readable").length, 232);
+  assert.ok(newlyRegistered.filter((row) => row.status === "outside-cohort").every((row) =>
+    row.profileStatus === "readable" && row.evidenceIds?.some((id) => (id.startsWith("SRALL1-P-") || id.startsWith("SRPRO1-P-")))),
+  "old founding years require independent profile evidence, not cohort age");
+  const variants = newlyRegistered.filter((row) => row.name === "Variant");
+  assert.equal(variants.length, 2);
+  assert.equal(new Set(variants.map((row) => row.url)).size, 2, "same-name profiles must not be merged by name");
+  assert.equal(variants.filter((row) => row.companyId === "AI066").length, 1);
+  assert.ok(!snapshot.observations.some((row) => row.evidence.startsWith("SRALL1-")),
+    "roster discovery and outside-cohort claims do not create financial observations");
+  const profiles = snapshot.evidence.filter((row) => row.id.startsWith("SRPRO1-P-"));
+  assert.equal(profiles.length, 226);
+  for (const proof of profiles) {
+    const candidate = newlyRegistered.find((row) => row.id === proof.id.slice("SRPRO1-P-".length))!;
+    assert.equal(candidate.url, proof.url);
+    assert.ok(candidate.evidenceIds?.includes(proof.id));
+  }
+  for (const id of ["AI162", "AI163", "AI164", "AI165", "AI166", "AI167"]) {
+    const company = snapshot.companies.find((row) => row.id === id)!;
+    assert.equal(company.year, 2025);
+    assert.equal(company.revenueStatus, "unknown");
+    assert.equal(company.technicalReview!.level, "description");
+  }
+  assert.ok(!snapshot.observations.some((row) => row.evidence.startsWith("SRPRO1-")),
+    "future GPU capacity, free trials, customer savings and unread financial claims are not realized revenue");
+});
+
+test("Speedrun brand dates and survey benchmark scores do not create new-company revenue", () => {
+  const snapshot = seed as ResearchSnapshot;
+  const rows = snapshot.candidateBatches!.flatMap((batch) => batch.records);
+  for (const id of ["SR004R-C11", "SR004R-C20"]) {
+    const row = rows.find((item) => item.id === id)!;
+    assert.equal(row.status, "pending-year", "a known brand year must retain unresolved underlying entity dates");
+    assert.equal(row.companyId, undefined);
+    assert.ok(row.evidenceIds!.some((proof) => proof.startsWith("SR004F2-")));
+  }
+  for (const id of ["SR004R-C08", "SR004R-C15"]) {
+    assert.equal(rows.find((item) => item.id === id)!.status, "pending-ai");
+  }
+  for (const [id, category] of [["AI168", "C06"], ["AI169", "C05"]]) {
+    const company = snapshot.companies.find((item) => item.id === id)!;
+    assert.equal(company.cat, category);
+    assert.equal(company.revenueStatus, "unknown");
+    assert.equal(company.technicalReview!.level, "description");
+  }
+  assert.ok(!snapshot.observations.some((row) => row.evidence.startsWith("SR004F2-")),
+    "brand-deal opportunities, listed fees and survey agreement are not financial observations");
+  const model = snapshot.reviews.find((row) => row.id === "MODEL1-SIMULATION-PANEL")!;
+  assert.deepEqual(reviewCompanyIds(snapshot, model), ["AI169"]);
+  assert.ok(model.evidenceIds.includes("SR004F2-REHEARSALS-PRICE"));
+});
+
+test("recruiting service adoption and official balance sheets do not become ARR", () => {
+  const snapshot = seed as ResearchSnapshot;
+  for (const id of ["AI170", "AI171", "AI172", "AI173", "AI174", "AI175"]) {
+    const company = snapshot.companies.find((row) => row.id === id)!;
+    assert.equal(company.year, 2025);
+    assert.equal(company.revenueStatus, "unknown");
+    assert.equal(company.technicalReview!.level, "description");
+  }
+  const accounts = snapshot.evidence.find((row) => row.id === "SR005F3-DEX-ACCOUNTS")!;
+  assert.equal(accounts.companyId, "AI171");
+  assert.equal(new URL(accounts.url).hostname, "find-and-update.company-information.service.gov.uk");
+  assert.equal(accounts.publishedAt, "2026-09-08", "filing date is preserved without becoming a revenue measurement date");
+  assert.ok(!snapshot.observations.some((row) => row.evidence.startsWith("SR005F3-")),
+    "balance-sheet cash, client quotes, salaries and recruiting outcomes do not disclose revenue");
+  const model = snapshot.reviews.find((row) => row.id === "MODEL1-RECRUITING-SERVICE")!;
+  assert.deepEqual(reviewCompanyIds(snapshot, model), ["AI175", "AI171"]);
+  assert.ok(model.evidenceIds.includes("SR005F3-JOOBA-TERMS"));
+});
+
+test("current products preserve unresolved identity and separate trading from software revenue", () => {
+  const snapshot = seed as ResearchSnapshot;
+  const presia = snapshot.candidateBatches!.flatMap((batch) => batch.records)
+    .find((row) => row.id === "SR005R-C44")!;
+  assert.equal(presia.status, "pending-ai");
+  assert.equal(presia.companyId, undefined, "a reused domain does not resolve a changed business entity");
+  assert.ok(presia.evidenceIds!.includes("SR005F4-PRESIA-ASSET"));
+  for (const id of ["AI176", "AI177", "AI178", "AI179", "AI180"]) {
+    const company = snapshot.companies.find((row) => row.id === id)!;
+    assert.equal(company.revenueStatus, "unknown");
+  }
+  const syzygy = snapshot.companies.find((row) => row.id === "AI180")!;
+  assert.equal(syzygy.technicalReview!.level, "public-artifact");
+  assert.ok(syzygy.technicalReview!.evidenceIds.includes("SR005F4-SYZYGY-FILES"));
+  assert.ok(!snapshot.observations.some((row) => row.evidence.startsWith("SR005F4-")),
+    "landed prices, customer savings, model scores and listed subscriptions are not reported ARR");
+  const supply = snapshot.reviews.find((row) => row.id === "MODEL1-PHYSICAL-SUPPLY")!;
+  assert.deepEqual(reviewCompanyIds(snapshot, supply), ["AI179"]);
+  assert.ok(snapshot.reviews.find((row) => row.id === "MODEL1-LOCAL-CLOUD")!.companyIds!.includes("AI180"));
+});
+
+test("new founding-year reports retain beta, academic and self-reported enforcement boundaries", () => {
+  const snapshot = seed as ResearchSnapshot;
+  for (const id of ["AI181", "AI182", "AI184", "AI185", "AI186"]) {
+    const company = snapshot.companies.find((row) => row.id === id)!;
+    assert.equal(company.year, 2026);
+    assert.equal(company.revenueStatus, "unknown");
+    assert.equal(company.technicalReview!.level, "description");
+  }
+  assert.equal(snapshot.companies.find((row) => row.id === "AI183")!.year, 2025);
+  assert.ok(!snapshot.observations.some((row) => row.evidence.startsWith("SR006F5-")),
+    "trial credits, customer revenue impact, demonstration fundraises and normalized research scores are not ARR");
+  const research = snapshot.reviews.find((row) => row.id === "SR006F5-R-RESEARCH")!;
+  assert.deepEqual(reviewCompanyIds(snapshot, research), ["AI185", "AI169"]);
+  assert.ok(research.evidenceIds.includes("SR004F2-REHEARSALS-BENCH"));
+  const pricing = snapshot.reviews.find((row) => row.id === "MODEL1-MESSAGE-ENFORCEMENT")!;
+  assert.deepEqual(reviewCompanyIds(snapshot, pricing), ["AI186"]);
+  assert.ok(pricing.evidenceIds.includes("SR006F5-ZERODRIFT-TERMS"));
+});
+
+test("rebrands and ambiguous monthly receipts stay outside comparable ARR", () => {
+  const snapshot = seed as ResearchSnapshot;
+  const rows = snapshot.candidateBatches!.flatMap((batch) => batch.records);
+  for (const id of ["SR006R-C37", "SR006R-C54"]) {
+    const row = rows.find((item) => item.id === id)!;
+    assert.equal(row.status, "pending-year");
+    assert.equal(row.companyId, undefined, "brand dates must not overwrite existing legal-entity dates");
+  }
+  const idilio = rows.find((item) => item.id === "SR006R-C22")!;
+  assert.equal(idilio.status, "pending-ai");
+  assert.ok(idilio.evidenceIds!.includes("SR006F6-IDILIO-SR"));
+  assert.ok(!snapshot.observations.some((row) => row.evidence.startsWith("SR006F6-")),
+    "pipeline, retained client revenue, illustrative tax values and undated monthly receipts are not comparable ARR");
+  for (const id of ["AI187", "AI188", "AI189"]) {
+    assert.equal(snapshot.companies.find((row) => row.id === id)!.revenueStatus, "unknown");
+  }
+  const tax = snapshot.reviews.find((row) => row.id === "MODEL1-TAX-PREP")!;
+  assert.deepEqual(reviewCompanyIds(snapshot, tax), ["AI188"]);
+  assert.ok(tax.evidenceIds.includes("SR006F6-GROVE-PRICE"));
+});
+
+test("care and legal delivery preserve financial exclusions and linked cost reviews", () => {
+  const snapshot = seed as ResearchSnapshot;
+  for (const id of ["AI190", "AI191", "AI192", "AI193", "AI194", "AI195"]) {
+    const company = snapshot.companies.find((row) => row.id === id)!;
+    assert.equal(company.revenueStatus, "unknown");
+    assert.equal(company.technicalReview!.level, "description");
+    const candidate = snapshot.candidateBatches!.flatMap((batch) => batch.records)
+      .find((row) => row.companyId === id)!;
+    assert.equal(candidate.status, "linked");
+    assert.equal(candidate.categoryId, company.cat);
+    assert.ok(company.evidenceIds.every((proof) => snapshot.evidence.some((row) => row.id === proof && row.companyId === id)));
+  }
+  assert.ok(!snapshot.observations.some((row) => row.evidence.startsWith("SRCARE1-")),
+    "undefined annual run rate, customer savings, list prices and usage are not comparable ARR");
+  const hardware = snapshot.reviews.find((row) => row.id === "MODEL1-HARDWARE-LIFETIME")!;
+  assert.deepEqual(reviewCompanyIds(snapshot, hardware), ["AI195"]);
+  const clinical = snapshot.reviews.find((row) => row.id === "MODEL1-CARE-OPERATIONS")!;
+  assert.deepEqual(reviewCompanyIds(snapshot, clinical), ["AI191", "AI194"]);
+});
+
+test("enterprise contracts and launch-year conflicts retain their exclusions", () => {
+  const snapshot = structuredClone(seed) as ResearchSnapshot;
+  const accelerator = snapshot.candidateBatches!.flatMap((batch) => batch.records)
+    .find((row) => row.id === "SR006R-C01")!;
+  assert.equal(accelerator.status, "pending-year");
+  assert.equal(accelerator.companyId, undefined);
+  assert.ok(accelerator.evidenceIds!.includes("SRENTER1-ACCELER8-DEALROOM"));
+  for (const [id, value, bound] of [["HEAVI", 100000, "="], ["VERRA", 700000, "≈"]] as const) {
+    const contract = snapshot.observations.find((row) => row.id === `SRENTER1-O-${id}-CONTRACT`)!;
+    assert.equal(contract.value, value);
+    assert.equal(contract.bound, bound);
+    assert.equal(contract.selection, "excluded");
+    assert.equal(contract.observedAt, undefined);
+    assert.equal(contract.comparisonGroup, null);
+    assert.equal(snapshot.companies.find((row) => row.id === contract.company)!.revenueStatus, "unknown");
+    contract.metric = "arr";
+    assert.ok(!arrDisclosures(snapshot).some((row) => row.observation.id === contract.id),
+      "even a wrongly added ARR label must not promote an excluded contract");
+    assert.ok(!platformIncomeSample(snapshot, { windowDays: 90 }).points
+      .some((row) => row.observation.id === contract.id));
+  }
+});
+
+test("financial candidates need current AI evidence before they acquire company and income links", () => {
+  const snapshot = seed as ResearchSnapshot;
+  const candidates = snapshot.candidateBatches!.flatMap((batch) => batch.records);
+  for (const id of ["SR006R-C06", "SR006R-C16", "SR005R-C35", "SR006R-C08"]) {
+    const candidate = candidates.find((row) => row.id === id)!;
+    assert.equal(candidate.status, "pending-ai");
+    assert.equal(candidate.companyId, undefined);
+    assert.ok(candidate.evidenceIds!.some((proof) => proof.startsWith("SRFIN1-")));
+  }
+  const financial = snapshot.reviews.find((row) => row.id === "MODEL1-FINANCIAL-OPERATIONS")!;
+  assert.deepEqual(reviewCompanyIds(snapshot, financial), ["AI202", "AI203", "AI204"]);
+  assert.ok(!snapshot.observations.some((row) => row.evidence.startsWith("SRFIN1-")),
+    "bank size, FX processing, artist revenue, demo portfolios and benchmark scores are not vendor income");
+});
+
 test("annual launch archives exclude older companies only with evidence and reuse existing records", () => {
   const snapshot = structuredClone(seed) as ResearchSnapshot;
   const batch = snapshot.candidateBatches!.find((b) => b.id === "PH-2025-visible-1")!;
@@ -657,7 +868,7 @@ test("unreconciled directory financials remain source reviews instead of income
   assert.ok(review.evidenceIds.includes("PH-TANA-DR"));
   assert.equal(reviewCompanyIds(snapshot, review).length, 0);
   assert.ok(!snapshot.observations.some((o) => o.evidence === "PH-TANA-DR"));
-  assert.equal(snapshot.candidateBatches!.flatMap((b) => b.records).filter((r) => r.status === "pending-year").length, 131);
+  assert.equal(snapshot.candidateBatches!.flatMap((b) => b.records).filter((r) => r.status === "pending-year").length, 136);
 });
 
 test("product pivots and founder histories do not become new company years or current revenue", () => {

content/research/ai-income-analysis.json

@@ -1,5 +1,5 @@
 {
-  "sourceVersion": "2026-11-01-sr007-followup-10",
+  "sourceVersion": "2026-11-01-source-closeout-1",
   "asOf": "2026-11-01",
   "metric": "platform-mrr-usd",
   "sampleUnit": "product-or-business",

pnpm-lock.yaml

@@ -28,6 +28,9 @@ importers:
       remark-gfm:
         specifier: 4.0.1
         version: 4.0.1(supports-color@7.2.0)
+      sharp:
+        specifier: 0.35.5
+        version: 0.35.5(@types/node@22.20.5)
     devDependencies:
       '@tailwindcss/postcss':
         specifier: 4.3.3
@@ -59,9 +62,6 @@ importers:
       postcss:
         specifier: 8.5.31
         version: 8.5.31
-      sharp:
-        specifier: 0.35.5
-        version: 0.35.5(@types/node@22.20.5)
       tailwindcss:
         specifier: 4.3.3
         version: 4.3.3

scripts/audit-ai-research.py

@@ -4,7 +4,7 @@ from collections import Counter
 import json
 from pathlib import Path
 import sys
-from urllib.parse import urlsplit
+from urllib.parse import parse_qs, urlsplit
 
 ROOT = Path(__file__).resolve().parents[1]
 DATA = json.loads((ROOT / 'content/research/ai-companies.seed.json').read_text())
@@ -49,6 +49,54 @@ def source_register():
             assert roster['defaultCohort'] == 'SR007' and roster['next'] is None
             assert len(batch['records']) == roster['recordCount'] == roster['reportedCount']
             assert len({row['url'] for row in batch['records']}) == roster['recordCount']
+        if source['id'] == 'S14' and source.get('publicRosterAudits'):
+            audits = source['publicRosterAudits']
+            assert {a['cohort'] for a in audits} == {f'SR{i:03d}' for i in range(1, 8)}
+            assert len(audits) == 7
+            profile_urls = []
+            for audit in audits:
+                batch = next(b for b in DATA['candidateBatches'] if b['id'] == audit['candidateBatchId'])
+                query = parse_qs(urlsplit(audit['url']).query)
+                assert urlsplit(audit['url']).netloc == 'speedrun.a16z.com'
+                assert query == {'limit': ['100'], 'offset': ['0'], 'cohort': [audit['cohort']]}
+                assert urlsplit(audit['url']).path == '/api/companies/companyparams'
+                assert audit['httpStatus'] == 200 and audit['accessedAt'] <= DATA['asOf']
+                assert audit['next'] is None and audit['previous'] is None
+                assert len(batch['records']) == audit['recordCount'] == audit['reportedCount']
+                assert audit['uniquePublicIds'] == audit['uniqueSlugs'] == audit['recordCount']
+                assert len(audit['responseSha256']) == 64 and all(c in '0123456789abcdef' for c in audit['responseSha256'])
+                assert batch['sourceId'] == 'S14' and not batch['complete']
+                proof = next(e for e in DATA['evidence'] if e['id'] == audit['evidenceId'])
+                assert proof['url'] == audit['url'] and proof['companyId'] is None
+                profile_urls.extend(row['url'] for row in batch['records'])
+            assert len(profile_urls) == len(set(profile_urls)), 'duplicate profiles across public cohorts'
+        if source['id'] == 'S14' and source.get('profileAudit'):
+            audit = source['profileAudit']
+            entries = audit['records']
+            candidates = {row['id']: row for b in DATA['candidateBatches'] for row in b['records']}
+            evidence_by_id = {row['id']: row for row in DATA['evidence']}
+            assert len(entries) == audit['recordCount'] == audit['readable']
+            assert audit['failed'] == 0 and len({e['candidateId'] for e in entries}) == len(entries)
+            years = Counter(str(e['foundedYear']) for e in entries)
+            assert dict(years) == audit['yearCounts']
+            for entry in entries:
+                row = candidates[entry['candidateId']]
+                proof = evidence_by_id[entry['evidenceId']]
+                assert row['profileStatus'] == 'readable' and proof['url'] == row['url']
+                assert entry['evidenceId'] in row['evidenceIds']
+                assert isinstance(entry['foundedYear'], int) and 1800 <= entry['foundedYear'] <= int(DATA['asOf'][:4])
+                assert isinstance(entry['teamSize'], int) and entry['teamSize'] >= 0
+                assert len(entry['htmlSha256']) == 64 and all(c in '0123456789abcdef' for c in entry['htmlSha256'])
+                if entry['foundedYear'] not in [2025, 2026]:
+                    assert row['status'] == 'outside-cohort' and not row.get('companyId')
+            assert sum(e['foundedYear'] not in [2025, 2026] for e in entries) == audit['outsideTargetYears']
+            assert sum(e['foundedYear'] in [2025, 2026] for e in entries) == audit['targetYearSelfReports']
+            assert sum(candidates[e['candidateId']]['status'] == 'linked' for e in entries) == audit['newLinkedCompanies']
+            assert sum(candidates[e['candidateId']]['status'] == 'pending-ai' for e in entries) == audit['pendingCurrentAIOrIdentity']
+            assert sum(candidates[e['candidateId']]['status'] == 'pending-year' for e in entries) == audit['pendingFoundingIdentity']
+            assert audit['targetYearSelfReports'] == (
+                audit['newLinkedCompanies'] + audit['pendingCurrentAIOrIdentity'] + audit['pendingFoundingIdentity']
+            ), 'self-reported years must retain unresolved brand/entity dates'
         if source['url']:
             assert urlsplit(source['url']).scheme in {'http', 'https'} and urlsplit(source['url']).netloc
         for host in source['hosts']:

scripts/documents-client.py

@@ -45,14 +45,15 @@ def read_token(filename):
     return value
 
 
-def request(base, token, method, path, payload=None, request_id=None):
-    data = None if payload is None else json.dumps(payload, ensure_ascii=False).encode()
+def request(base, token, method, path, payload=None, request_id=None, *, image_type=None):
+    data = payload if image_type else (None if payload is None else json.dumps(payload, ensure_ascii=False).encode())
     if data is not None and len(data) > 8 * 1024 * 1024:
         raise ValueError('Request exceeds 8 MiB; split into smaller atomic batches')
     headers = {'Authorization': 'Bearer ' + token, 'Accept': 'application/json'}
     if data is not None:
-        headers['Content-Type'] = 'application/json'
-        headers['Idempotency-Key'] = request_id
+        headers['Content-Type'] = image_type or 'application/json'
+        if request_id is not None:
+            headers['Idempotency-Key'] = request_id
     opener = urllib.request.build_opener(NoRedirect())
     for attempt in range(2):
         req = urllib.request.Request(base + path, data=data, method=method, headers=headers)
@@ -127,6 +128,8 @@ def main():
     editing.add_argument('slug')
     editing.add_argument('file')
     editing.add_argument('--request-id')
+    upload = sub.add_parser('upload-image', help='Upload a static image and print its Markdown URL')
+    upload.add_argument('file')
     saving = sub.add_parser('save')
     saving.add_argument('file', help='Private JSON file or - for stdin; one document or {documents: [...]}')
     saving.add_argument('--request-id', help='Reuse this id only with the same input when retrying')
@@ -136,7 +139,18 @@ def main():
     try:
         base = server_url(args.url)
         token = read_token(args.key_file)
-        if args.command == 'list':
+        if args.command == 'upload-image':
+            image = Path(args.file)
+            image_types = {'.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.webp': 'image/webp'}
+            image_type = image_types.get(image.suffix.lower())
+            if not image_type:
+                raise ValueError('Use a PNG, JPEG or WebP image')
+            with image.open('rb') as source:
+                data = source.read(8 * 1024 * 1024 + 1)
+            if len(data) > 8 * 1024 * 1024:
+                raise ValueError('Image exceeds 8 MiB')
+            result = request(base, token, 'POST', '/api/documents/images', data, image_type=image_type)
+        elif args.command == 'list':
             result = request(base, token, 'GET', '/api/documents?' + urllib.parse.urlencode(
                 {'limit': args.limit, 'offset': args.offset}))
         elif args.command == 'get':