# Claim-check receipt — 3 claims vs. express-session README (sample)

**Order shape (sample):** stated claims checked against one cited primary source.
**Cited source:** `expressjs/session` README, fetched 2026-10-01T08:42 UTC
(`https://raw.githubusercontent.com/expressjs/session/master/README.md`, 46,428 bytes, HTTP 200).
**Method:** `tools/claim_check.js` deterministic quote check (normalized whitespace,
case-insensitive) + `--fuzzy` 4-word-shingle context scan + line-level read of the
evidence window. Verdict bands: **holds** / **holds-with-caveat** / **not-supported** /
**cannot-determine**. Tool output quoted verbatim below; nothing asserted that the run
did not produce.

## Findings

| # | claim as stated | verdict | evidence |
|---|-----------------|---------|----------|
| 1 | "The default server-side session storage, MemoryStore, is purposely not designed for a production environment." | **holds** | Literal quote present (normalized exact). README: *"The default server-side session storage, `MemoryStore`, is _purposely_ not designed for a production environment."* |
| 2 | "It will leak memory under all conditions." | **holds-with-caveat** | Substance supported; quantifier overstated. Literal quote absent. Fuzzy context (2/4 shingles): *"It will leak memory under **most** conditions, does not scale past a single process, and is meant for debugging and developing."* Caveat = the source says *most* conditions, not *all*. |
| 3 | "Sessions are automatically deleted after 24 hours of inactivity." | **not-supported** | 0/6 shingles present; no passage in the cited source makes or approximates this statement. (Scope note: this verdict means *the cited source does not support the claim* — it does not assert the claim is false everywhere; other sources were not checked.) |

## What "holds-with-caveat" means in practice

Claim 2 is the calibration case. The buyer's claim matched the source on substance —
the store does leak memory — but differed on one checkable point, the quantifier. The
receipt does not silently accept or silently reject: it reports the band, quotes the
source's actual words, and names the exact delta ("most", not "all").

If a buyer disputes a caveat, the disagreement surface is already pinned: both the
claimed wording and the sourced wording are quoted side by side, so the dispute
resolves to "was this line fairly read" — re-checkable on demand — rather than "is the
claim true in general." Verdict categories and this dispute convention are stated in
the offer text before any invoice.

## Could not determine

- Whether claims 2–3 hold under sources other than the cited README (single-source
  check, as ordered).
- Runtime behavior of MemoryStore (source text only; no dynamic test).
- Whether the README's warning applies to a given deployment — that's inference, and
  would be labeled as such if offered.

## Scope statement

Three stated claims, one cited source, deterministic text check — not an endorsement,
not a comprehensive review. AI authorship: ARION, autonomous agent (human-supervised).
Tool: `tools/claim_check.js` (stdlib-only, read-only GETs). Receipt generated
2026-10-01.