CANONICAL CONTRACT: maestro-cpc-record/1.0.

Use this exact source shape and no extra keys:
{"schema_version":"maestro-cpc-record/1.0","record_id":"","groups":[GROUP],"comparison":{"enabled":false,"baseline_group_id":"","current_group_id":"","note":""},"exclusions":[],"evidence_requests":[],"review":{"state":"pending","fingerprint":"","reviewer":"","reviewed_at":"","evidence":""}}
GROUP = {"group_id":"","label":"","currency":"","cost_basis":"","click_definition":"","click_mode":"unique","window":{"start":"","end":"","timezone":""},"population":"","source":"","owner":"","coverage_attestation":{"exhaustive":false,"source_row_key_definition":"","disjoint_scope":false,"note":""},"rows":[ROW]}
ROW = {"row_id":"","source_row_key":"","label":"","spend_raw":"","clicks_raw":"","impressions_raw":"","currency":"","cost_basis":"","click_definition":"","click_mode":"unique","window":{"start":"","end":"","timezone":""},"population":"","source":"","owner":""}
EXCLUSION = {"exclusion_id":"","row_id":"","field_path":"","reason":"","evidence":"","owner":""}
REQUEST = {"request_id":"","field_path":"","reason":"","exact_request":"","owner":"","blocks":"calculation"}. blocks is exactly calculation, component, comparison or review.

Every leaf keeps its declared JSON type. All listed text leaves are strings. Booleans remain booleans. click_mode is exactly unique or repeat. Reject wrong types, unknown keys, dangling paths, duplicate IDs after trimming, duplicate nonblank source plus source_row_key pairs and unsupported enum values. Do not normalize a malformed value into a valid one. Blank, whole-value Unknown, zero and Invalid remain separate. Legitimate names that merely contain those words remain ordinary text.

Spend is a nonnegative decimal string with at most two decimal places. Convert it to safe integer cents before summing. Clicks and impressions are nonnegative safe whole-number strings and their sums must remain safe integers. Under unique mode, known clicks cannot exceed known impressions. Positive clicks with zero impressions is contradictory component evidence. Repeat mode requires a definition that explicitly says repeat clicks are allowed.

A complete explicit exclusion removes its bound row from every total. It needs a non-placeholder ID, existing row/path, reason, evidence and owner. Evaluate components from included rows only. A supplied blocking request blocks its declared lane. Unknown, pending, denied, to be determined, not supplied and equivalent unresolved whole values are placeholders, not affirmative evidence.

For each group, CPC = sum included spend / sum included clicks. Never average row CPC. Paid zero-click spend stays in the numerator; its row CPC is Unknown. CPM = spend / impressions * 1000 and CTR fraction = clicks / impressions only when all included component evidence is valid and summed impressions are positive. CPC reconstruction = CPM / (CTR fraction * 1000). Components are arithmetic associations, never causal claims.

Two groups compare only when all required definitions are resolved and currency, cost basis, click definition, click mode, timezone, inclusive duration and population match; windows must not overlap. Report absolute CPC change, relative CPC change, CPC factor, CPM factor, inverse CTR factor and product. A zero denominator returns Unknown.

First source reason precedence is: structural/import; duplicate or dangling identity; invalid numeric/date/enum; missing or Unknown spend/clicks; incompatible row scope; unresolved coverage/exclusion/blocking request; incompatible comparison; stale review fingerprint; pending review. Preserve every reason even when one becomes primary. Stable automatic request IDs use AUTO_<REASON>_<FIELD_PATH>, replacing each run of non-alphanumeric path characters with one underscore. Owner fallback is the row owner, then group owner, then Owner to assign.

Fingerprint: trim all source strings, preserve array order, recursively sort object keys, remove the complete review object, serialize as no-whitespace JSON, UTF-8 encode and compute lowercase SHA-256. Approval passes only when state is approved, fingerprint equals the recomputed fingerprint, reviewer/evidence are affirmative non-placeholder strings and reviewed_at is a real YYYY-MM-DD date. A supplied decision or fingerprint is never trusted.

Canonical result routes: HOLD_FOR_EVIDENCE for unresolved source/calculation/comparison evidence; HOLD_FOR_REVIEW with REVIEW_FINGERPRINT_STALE or REVIEW_PENDING after source gates; REVIEW_READY with SOURCE_AND_REVIEW_READY only after all gates. Authorization boundary is exactly: Calculation and review only. No spend or live campaign change is authorized.

If you cannot execute the SHA-256 and the full rules above, return HOLD with EXECUTION_UNAVAILABLE. Do not invent a fingerprint or claim parity. The portable bundle command is: node run-cpc.mjs INPUT.json --pretty.

TASK: Build one canonical source record from only the supplied facts, run the rules, then return: complete source JSON; canonical decision JSON; a readable table of every row's disposition and CPC; group totals and components; comparison factors when enabled; exact evidence requests; next action; authorization boundary. Preserve incompatible/incomplete rows. Ask for exact missing fields.

SUPPLIED FACTS:
[Paste rows, definitions, sources, owners and any review receipt here]
