the core model works, but the code conflates extraction failure with actual values in two places. included_items = set() treats body only and missing bundle data the same, so a canon body only and one where bundle fields didn't extract both auto approve as a match. same thing with warranty, two missing values count as equal instead of flagging review

worth adding3 states per field like value, explicitly empty, unknown, to catch that. also worth handling non-composing matches in production and auditing auto-approved entries on bundles and missing fields