[afoote-mitre]

Summary

• Reject negative numeric values and the standalone CPE NA value as ordered versionStart/versionEnd boundaries.
• Preserve negative signs in semantic CPE version comparisons so values such as -1 and 1 cannot compare as equivalent.
• Add unit, route-integration, OpenAPI contract, and generated Postman regression coverage.
• Clarify the distinction between the 10,000-result pagination window and the 10,000-candidate semantic post-filter limit in README and Swagger documentation.

Version tokenization previously discarded a leading minus sign, causing a boundary such as -1 to compare as equal to 1 and return unintended matches. The API documentation also did not clearly distinguish direct-search exact totals from bounded semantic candidate totals.