Your row goes in. The company comes back with the working attached.

upper 0.97

Swept, not chosen — and the sweep that set it is dated. On the superseded 2026-07-29 pairwise snapshot (1,173 labelled pairs, stub adjudicator, run at lower 0.35 and an adjudicator floor of 0.98 that has since been corrected to 0.50) 0.97 was the lowest threshold whose auto-merge precision lower bound cleared 0.99: 1.0000 over 406 merges, 95% CI [0.9906, 1.0000], at 0.6726 automation over the 1,173 pairs. That table is retained to explain how the threshold got here; it is not a current configuration report and not shipped performance. Neither current instrument proves 0.99. The 2026-09-05 continuous-integration gate bounds at 98.94% on 357/357 error-free automated merges at 63.10% automation, which is 24 consecutive clean merges short of a 99% lower bound, and out of fold at this threshold the probabilistic band carries one error in 231 merges, bounding at 0.9759. Automation is non-increasing in the upper threshold, so a higher threshold buys a tighter bound by deciding less. And the knee is one row deep: everything from 0.70 to 0.96 is blocked by a single handwritten holding-company and operating-company pair sharing one group website, which scores 0.9614.

lower 0.35

Not provable on either instrument. No swept value reaches a 0.99 negative predictive value lower bound, so it stays where it is: the four rows that separate the candidates are not enough to move it on. A wrong non-match is a duplicate entity, and nothing gates it. The reject side is the weakest claim this product makes.

adjudicator floor 0.50

Derived by five-fold out-of-fold selection over 370 recorded live verdicts, which chose 0.50 unanimously with zero wrong merges in every held-out half. It had been 0.98, which was not a threshold but a wall: a live run measured the model’s confidence range at 0.20 to 0.93, so a floor at 0.98 sat above the model’s entire output range and discarded every verdict the product had paid for.

the margin guard

Even above the upper threshold, an auto-merge is withheld when the two best candidates sit within 0.02 of each other, or when more than one candidate carries the same decisive identifier. The record escalates and every such row carries indistinguishable_candidates in its features. On the 116-case resolution gold set this cut baseline false binds from 0.0309 to 0.0208 and raised accuracy from 0.9381 to 0.9479, for 0.86 points of resolution rate.

how high it can go

Confidence limits depend on the population behind the decision. The highest shipped population bound is 0.9968. The nominal 95% Wilson lower bound of 1,190 historical prompt-v8 uncorroborated MATCH verdicts with zero recorded errors. The 2026-08-29 population pools six input shapes with repeated company families and calibration/evaluation overlap. Its independence and transfer to new customer inputs are unproven. Legacy replay cannot certify current calibration. Confidence bounds depend on the recorded evidence population; there is no universal score for every match. Read match_confidence_basis and the evidence. A 0.99 filter can return some v8 adjudicated matches while excluding valid identifier matches, so validate its coverage cost on your own inputs. A stricter threshold needs an evaluation on your own labelled records, with the coverage it costs reported beside precision.

Survivorship ranks facts that are valid now ahead of future or superseded episodes, then by source precedence, then by recency taken from when a source last confirmed the value, then by confidence, then by a case-shape and value tiebreak. Every fact is kept, not just the winner: the losers stay readable with their own provenance.

The ordering is total. One set of facts has exactly one ordering regardless of the order they arrived in, so an unchanged record re-assembles byte-identically and does not fire a downstream change-data-capture or screening event for a record that did not change. A name-like attribute tie is broken on case shape, so a mixed-case spelling outranks an ALL-CAPS or all-lowercase one and a tie between spellings does not export shouting into your CRM. Identifiers, codes, domains and emails are not case-ranked, because for those the case is not a spelling choice.

Continued confirmation outranks novelty, which is why the survivorship tiebreak reads the confirmation date rather than the retrieval date. But freshness breaks ties only within a source tier and never across one, so a stale registry value still beats a fresh web observation. The response surfaces the same fields: per-attribute provenance carries first_seen_at, last_checked_at, checks and a derived age_days, and the entity carries last_checked_at and stalest_field_age_days.

This is not a policy somebody has to remember at review time; it is a refusal in the code path between the resolver and the database.

per-field resale

Provenance distinguishes two things a single flag would conflate: licence_permits_resale is a fact about the licence, and resellable is that conjoined with whether your plan carries resale rights. Collapsing them would report a CC0 value as non-redistributable to everyone who has not bought the term.

derived facts

A derivation cannot launder a tier. The licence on a derived value is the most restrictive of all its inputs and of the method's own reference data, its confidence is at most the minimum input confidence, and its freshness is the stalest input's confirmation date. A derivation cannot manufacture certainty either.

CUSIP and SEDOL

Absent by design rather than not yet built. CGS terms prohibit using the data to create or maintain a master file or database of CUSIP descriptions or numbers, which is textbook pass-through, and the persistence layer would raise on one. ISIN is specified and blocked pending legal advice. DUNS is declared absent: nobody was asked, and pooling customer-submitted DUNS across tenants is prohibited.

Every path that writes an entity stamps a derived crosswalk attribute onto it, including one minted by a reviewer’s verdict. It holds one entry per scheme and value, each carrying the fact that supplied it, so the citation is per identifier rather than per record.

what is qualified

A company number is qualified by its jurisdiction and a ticker by its exchange, and a ticker is qualified only from an exchanges fact carrying the same source id. An LEI must pass the ISO 17442 MOD 97-10 checksum. The crosswalk cites the source URL of the most authoritative contributing fact and takes its confidence as the minimum over contributors.

the negatives

Absence is reported as a finding rather than as a silence. NOT_FOUND means a wired source supplies that scheme and had no value for this company; NOT_CONFIGURED means no wired source supplies it at all. Collapsing the two would make “this company has no LEI” and “GLEIF is not wired here” the same answer, and only the first is about the company.

ownership

Sourced, not inferred: GLEIF Level 2 relationship records — direct parent, ultimate parent, branch association, direct children — and the UK register of persons with significant control. Every edge states its basis (accounting consolidation, voting rights, share ownership, registry declared, self declared, unknown) and its certainty (registry asserted, derived by traversal, inferred).

max_hops

Traversal is a projection over facts already held, never a resolution. max_hops defaults to 1 and may be raised to 10 per call. Edges are followed only through exact LEIs and authority-scoped registration numbers, within your tenant, never by name and never across tenants, with cycle detection and hard caps on identifier attempts, nodes, edges and repository reads. not_traversed is populated on every response, parent found or not, so depth can never be inferred from an empty field.

percentages

Control under the UK register is published as bands. Bands are never multiplied and never converted to a midpoint. An indirect percentage is emitted only when every hop carries an exact registry-published percentage; otherwise the response carries percentage_withheld_reason: band_arithmetic_refused as part of the schema.

A batch resolves in two phases. Phase one proposes every record through the unchanged cascade against the entity store as it stood when the batch began, with writes staged so no record can see another record’s proposal. Phase two collects the intra-batch match edges, computes connected components with union-find, and folds each component into one entity.

The defect this replaced was measured, not theorised: the old sequential loop produced nine different partitions across the twenty-four orderings of the same four rows, and a persona run saw 3 of 60 rows flip between merged and unresolved on ordering alone. The same sixty records in four orders now produce an identical partition. Ordering inside consolidation runs on the record’s content fingerprint — the same key the replay cache uses — with the record id kept only as a tiebreak, because the batch endpoint mints record ids from the idempotency key and the row index, so the id literally is the row’s position in your file. An id that names a place in a queue is exactly the thing that must not order a partition.

The caller who abstained can poll the queue. The shortlist is capped at five candidates, a verdict is recorded as match or no-match, and the verdict becomes a labelled training example.

who may decide

A review write requires a distinct review credential. A resolve key can poll the queue but cannot approve anything. A verdict is refused unless it names an accountable reviewer, and the credential and surface that applied it are recorded server-side rather than accepted from the caller — a verdict that cannot evidence who approved a merge is a workflow step, not a four-eyes control.

what a verdict may do

Rejecting candidate A does not approve candidate B. An alternative binding has to clear the confidence floor and the shared margin guard independently, and then it persists its own earned stage and confidence. Weak or near-tied alternatives leave the verdict unapplied, so a human no-match cannot launder an unreviewed match into certainty.

cite it or leave it

A verdict with no cited source is a guess with a person's name on it. Searching hard and finding nothing is a real result, and the queue is designed to accept it: a shared address, a directory listing, a social profile or a bare search-result count are not evidence, and the review procedure says so in those words.

at scale

The queue is pollable, sortable by confidence, filterable by a minimum, and settleable in bulk up to two hundred items in one request. It is a human-paced surface and it is rate-limited as one.