@ggui-ai/negotiator 0.9.0 → 0.11.0

package/dist/contract-validators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract-validators.d.ts","sourceRoot":"","sources":["../src/contract-validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAElE,OAAO,KAAK,EACV,iBAAiB,EACjB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAMlC;;;;;;;;;GASG;AACH,MAAM,MAAM,6BAA6B,GACrC,kBAAkB,GAClB,aAAa,GACb,mCAAmC,GACnC,2BAA2B,GAC3B,6BAA6B,GAC7B,4BAA4B,GAC5B,8BAA8B,GAC9B,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACzD;AAED;;;;;GAKG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;sDAEkD;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gCAAgC;IAC/C;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAwJD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,YAAY,GACrB,wBAAwB,CAkC1B;AAsCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,YAAY,GACrB,wBAAwB,CA8D1B;AAiCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE,MAAM,GACb,wBAAwB,CAoC1B;AAQD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,YAAY,EACtB,IAAI,EAAE,6BAA6B,EACnC,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,wBAAwB,CAAC,CAkCnC;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,wBAAwB,GAC/B,MAAM,CAKR"}
+{"version":3,"file":"contract-validators.d.ts","sourceRoot":"","sources":["../src/contract-validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAElE,OAAO,KAAK,EACV,iBAAiB,EACjB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAMlC;;;;;;;;;GASG;AACH,MAAM,MAAM,6BAA6B,GACrC,kBAAkB,GAClB,aAAa,GACb,mCAAmC,GACnC,2BAA2B,GAC3B,6BAA6B,GAC7B,4BAA4B,GAC5B,8BAA8B,GAC9B,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACzD;AAED;;;;;GAKG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;sDAEkD;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gCAAgC;IAC/C;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AA8JD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,YAAY,GACrB,wBAAwB,CAkC1B;AAsCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,YAAY,GACrB,wBAAwB,CA8D1B;AAiCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE,MAAM,GACb,wBAAwB,CAoC1B;AAQD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,YAAY,EACtB,IAAI,EAAE,6BAA6B,EACnC,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,wBAAwB,CAAC,CAkCnC;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,wBAAwB,GAC/B,MAAM,CAKR"}

package/dist/contract-validators.js

@@ -163,7 +163,13 @@ function nameImpliesMutation(args) {
 function isEmptyPayloadSchema(schema) {
     if (schema === undefined)
         return true;
-    if (schema.type !== 'object')
+    // `type` may be a draft-07 type ARRAY (`['object','null']`) since
+    // draft-2026-08-19 — treat a type set containing 'object' like the
+    // single-string form.
+    const declaresObject = Array.isArray(schema.type)
+        ? schema.type.includes('object')
+        : schema.type === 'object';
+    if (!declaresObject)
         return false;
     if (schema.properties === undefined)
         return true;

package/dist/ensure-conforming-contract.d.ts

@@ -13,10 +13,14 @@
  *                              seeded with the draft + the deterministic
  *                              findings, looping until the gate is green
  *                              (origin: 'synth')
- *   - repair impossible      → minimal conforming contract (`{}`) + loud
- *     (LLM down / provider      error findings; STILL origin 'synth';
- *      can't synth / budget     NEVER throws.
- *      exhausted)
+ *   - repair impossible      → the conforming SUBSET of the draft (every
+ *     (LLM down / provider      refused entry dropped and reported;
+ *      can't synth / budget     origin 'synth', method 'salvaged-subset')
+ *      exhausted)              — or, when nothing usable survives, a
+ *                              DECLINE (`contract: null`, method
+ *                              'declined') with the findings. NEVER
+ *                              throws; NEVER an empty contract on the
+ *                              agent's behalf (ggui#523 item 3).
  *
  * Determinism lives in the GATE (`lintContract`), never in the repair.
  * The repair LLM is non-deterministic, but the loop only exits when the
@@ -31,34 +35,56 @@
  */
 import { type DataContract, type GadgetDescriptor, type SuggestionFinding } from '@ggui-ai/protocol';
 import type { LLMCaller } from './llm-caller.js';
-export interface EnsureConformingResult {
+/**
+ * How a conforming contract was produced — finer-grained than `origin`,
+ * for telemetry (the efficiency tiers):
+ *   - `verbatim`        — draft was clean; returned as-is (origin agent).
+ *   - `normalized`      — deterministic fix only, NO LLM (origin synth).
+ *   - `llm-repair`      — the bounded LLM repair loop ran (origin synth).
+ *   - `salvaged-subset` — unrepairable within budget; the conforming
+ *                         SUBSET of the draft, refused entries dropped
+ *                         and reported (origin synth).
+ */
+export type EnsureConformingMethod = 'verbatim' | 'normalized' | 'llm-repair' | 'salvaged-subset';
+/** A conforming contract was produced (the common case). */
+export interface EnsureConformingAccepted {
     /** A contract guaranteed to pass `lintContract` with zero errors. */
     readonly contract: DataContract;
     /**
      * - `'agent'` — the draft was already conforming; returned verbatim.
      * - `'synth'` — the draft had errors; this is the repaired result
-     *   (or the minimal-conforming fallback when repair was impossible).
+     *   (or the salvaged subset when repair was impossible).
      */
     readonly origin: 'agent' | 'synth';
-    /**
-     * How the conforming contract was produced — finer-grained than
-     * `origin`, for telemetry (the efficiency tiers):
-     *   - `verbatim`      — draft was clean; returned as-is (origin agent).
-     *   - `normalized`    — deterministic fix only, NO LLM (origin synth).
-     *   - `llm-repair`    — the bounded LLM repair loop ran (origin synth).
-     *   - `fallback-empty`— unrepairable; minimal `{}` contract (origin synth).
-     */
-    readonly method: 'verbatim' | 'normalized' | 'llm-repair' | 'fallback-empty';
+    readonly method: EnsureConformingMethod;
     /**
      * Findings surfaced to the agent. On `origin: 'agent'`, any hygiene
      * warnings on the (valid) draft. On `origin: 'synth'`, the ERROR
      * findings that rejected the agent's draft — so the agent-side model
-     * learns what it got wrong, even though we repaired it.
+     * learns what it got wrong, even though we repaired it. On
+     * `salvaged-subset` they include one finding per dropped entry.
      */
     readonly findings: readonly SuggestionFinding[];
     /** Operator- + LLM-readable explanation. */
     readonly reasoning: string;
 }
+/**
+ * Nothing in the draft could be kept: repair failed AND no entry
+ * survives the gate. There is no contract to propose — the caller
+ * answers `action: 'declined'` with the findings and the agent fixes
+ * and re-handshakes. This is what replaced the empty-contract fallback:
+ * a hollow "success" was indistinguishable from a rejection and the
+ * observed recovery was a field-by-field bisect (ggui#523 item 3).
+ */
+export interface EnsureConformingDeclined {
+    readonly contract: null;
+    readonly origin: 'agent';
+    readonly method: 'declined';
+    /** The ERROR findings that rejected the draft — every one of them. */
+    readonly findings: readonly SuggestionFinding[];
+    readonly reasoning: string;
+}
+export type EnsureConformingResult = EnsureConformingAccepted | EnsureConformingDeclined;
 export declare function ensureConformingContract(deps: {
     readonly llm: LLMCaller;
 }, args: {

package/dist/ensure-conforming-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ensure-conforming-contract.d.ts","sourceRoot":"","sources":["../src/ensure-conforming-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAIjD,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,gBAAgB,CAAC;IAC7E;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAKD,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,EACjC,IAAI,EAAE;IACJ,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACnD,GACA,OAAO,CAAC,sBAAsB,CAAC,CA4FjC"}
+{"version":3,"file":"ensure-conforming-contract.d.ts","sourceRoot":"","sources":["../src/ensure-conforming-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAKjD;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB,GAC9B,UAAU,GACV,YAAY,GACZ,YAAY,GACZ,iBAAiB,CAAC;AAEtB,4DAA4D;AAC5D,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,sBAAsB,GAAG,wBAAwB,GAAG,wBAAwB,CAAC;AAEzF,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,EACjC,IAAI,EAAE;IACJ,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACnD,GACA,OAAO,CAAC,sBAAsB,CAAC,CAkHjC"}

package/dist/ensure-conforming-contract.js

@@ -13,10 +13,14 @@
  *                              seeded with the draft + the deterministic
  *                              findings, looping until the gate is green
  *                              (origin: 'synth')
- *   - repair impossible      → minimal conforming contract (`{}`) + loud
- *     (LLM down / provider      error findings; STILL origin 'synth';
- *      can't synth / budget     NEVER throws.
- *      exhausted)
+ *   - repair impossible      → the conforming SUBSET of the draft (every
+ *     (LLM down / provider      refused entry dropped and reported;
+ *      can't synth / budget     origin 'synth', method 'salvaged-subset')
+ *      exhausted)              — or, when nothing usable survives, a
+ *                              DECLINE (`contract: null`, method
+ *                              'declined') with the findings. NEVER
+ *                              throws; NEVER an empty contract on the
+ *                              agent's behalf (ggui#523 item 3).
  *
  * Determinism lives in the GATE (`lintContract`), never in the repair.
  * The repair LLM is non-deterministic, but the loop only exits when the
@@ -32,8 +36,7 @@
 import { lintContract, dataContractSchema, } from '@ggui-ai/protocol';
 import { synthesizeContract } from './synthesize-contract.js';
 import { normalizeDraft } from './normalize-draft.js';
-/** Trivially-valid last-resort contract — all four specs omitted. */
-const EMPTY_CONTRACT = {};
+import { salvageConformingSubset } from './salvage-draft.js';
 export async function ensureConformingContract(deps, args) {
     const lint = lintContract(args.draft);
     const warnFindings = lint.warnings.map((w) => ({
@@ -101,15 +104,34 @@ export async function ensureConformingContract(deps, args) {
         };
     }
     // Repair impossible (LLM down, provider can't synthesize, or the
-    // repair budget exhausted). We still MUST return a conforming
-    // contract — the handshake never hard-fails. Minimal conforming
-    // contract + loud findings so the agent can re-issue a corrected
-    // contract via ggui_render override if it needs the declared specs.
+    // repair budget exhausted). Keep what conforms: drop exactly the
+    // entries the gate refuses, report each drop, and propose the rest —
+    // the agent's own draft minus the parts the protocol rejected. Never
+    // an empty contract dressed as a proposal.
+    const salvaged = salvageConformingSubset(normalized);
+    if (salvaged !== null) {
+        const droppedPaths = salvaged.dropped.map((d) => d.path);
+        return {
+            contract: salvaged.contract,
+            origin: 'synth',
+            method: 'salvaged-subset',
+            findings: [...errorFindings, ...salvaged.dropped],
+            reasoning: `could not repair the agent draft within budget (${synth.reason}); ` +
+                `proposing the conforming SUBSET of your draft — dropped ${droppedPaths.length} ` +
+                `entr${droppedPaths.length === 1 ? 'y' : 'ies'} the protocol refused (${droppedPaths.join(', ')}). ` +
+                `Each drop is a finding: fix those entries and re-handshake, or render this subset ` +
+                `and re-declare them via ggui_render override.`,
+        };
+    }
+    // Nothing usable survives. Decline: there is no contract to propose,
+    // and the findings say exactly why.
     return {
-        contract: EMPTY_CONTRACT,
-        origin: 'synth',
-        method: 'fallback-empty',
+        contract: null,
+        origin: 'agent',
+        method: 'declined',
         findings: errorFindings,
-        reasoning: `could not repair the agent draft within budget (${synth.reason}); returning a minimal conforming contract — re-issue a corrected contract via ggui_render override if you need the declared specs`,
+        reasoning: `declined: could not repair the agent draft within budget (${synth.reason}) and no entry of it ` +
+            `passes the contract gate — nothing to propose. Fix the findings (every one names its path) ` +
+            `and re-handshake; do not render against this handshake.`,
     };
 }

package/dist/index.d.ts

@@ -31,8 +31,9 @@ export type { RerankCandidate, RerankDecision, RerankQuery, } from './llm-rerank
 export { synthesizeContract } from './synthesize-contract.js';
 export type { SynthesizeContractResult } from './synthesize-contract.js';
 export { ensureConformingContract } from './ensure-conforming-contract.js';
-export type { EnsureConformingResult } from './ensure-conforming-contract.js';
+export type { EnsureConformingAccepted, EnsureConformingDeclined, EnsureConformingMethod, EnsureConformingResult, } from './ensure-conforming-contract.js';
 export { normalizeDraft } from './normalize-draft.js';
+export { salvageConformingSubset, declaresAnySurface, type SalvageResult, } from './salvage-draft.js';
 export { validateContractRedundancy, validateContractNovelty, formatValidationFindings, } from './contract-validators.js';
 export type { ContractValidationFinding, ContractValidationFindingKind, ContractValidationResult, ContractValidationNoveltyDeps, ContractValidationNoveltyOptions, } from './contract-validators.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAChE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,YAAY,EACV,eAAe,EACf,cAAc,EACd,WAAW,GACZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,YAAY,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,yBAAyB,EACzB,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAChE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,YAAY,EACV,eAAe,EACf,cAAc,EACd,WAAW,GACZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,YAAY,EACV,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAItD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,yBAAyB,EACzB,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -29,4 +29,8 @@ export { rerankCandidates } from './llm-rerank.js';
 export { synthesizeContract } from './synthesize-contract.js';
 export { ensureConformingContract } from './ensure-conforming-contract.js';
 export { normalizeDraft } from './normalize-draft.js';
+// The last-resort tier that replaced the empty-contract fallback (ggui#523
+// item 3): keep the conforming subset of a draft, or decline. Shared with
+// the handlers' no-LLM paths so every producer answers the same way.
+export { salvageConformingSubset, declaresAnySurface, } from './salvage-draft.js';
 export { validateContractRedundancy, validateContractNovelty, formatValidationFindings, } from './contract-validators.js';

package/dist/normalize-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize-schema.d.ts","sourceRoot":"","sources":["../src/normalize-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA6JH;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CA2BxD"}
+{"version":3,"file":"normalize-schema.d.ts","sourceRoot":"","sources":["../src/normalize-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA+KH;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CA2BxD"}

package/dist/normalize-schema.js

@@ -109,34 +109,49 @@ function normalizeTypeValue(value, enumSibling) {
         if (lower.includes('|')) {
             // Pipe-union string (`"STRING|null"`). Some models emit the union
             // as one pipe-delimited string rather than the JSON Schema array
-            // form; recover the first valid non-null member, mirroring the
-            // array branch below (drops the nullable arm).
-            for (const member of lower.split('|')) {
-                const norm = normalizeTypeValue(member, enumSibling);
-                if (norm !== undefined && norm !== 'null')
-                    return norm;
-            }
-            return undefined;
+            // form; recover it AS the draft-07 array form — since
+            // draft-2026-08-19 the protocol's JsonSchema.type admits type
+            // arrays, and the nullable arm is load-bearing (schema-precise
+            // render: dropping it narrows the contract and turns the agent's
+            // legal `null` into a contract_violation).
+            return normalizeTypeMembers(lower.split('|'), enumSibling);
         }
         // Unrecognized garbage — drop the constraint rather than guess.
         return undefined;
     }
     if (Array.isArray(value)) {
-        // Union type (`["string", "null"]`). The protocol contract schema
-        // accepts only a single string; recover the first valid non-null
-        // member, dropping the nullable arm.
-        for (const member of value) {
-            if (typeof member === 'string') {
-                const norm = normalizeTypeValue(member, enumSibling);
-                if (norm !== undefined && norm !== 'null')
-                    return norm;
-            }
-        }
-        return 'string';
+        // Draft-07 union type (`["string", "null"]`) — PRESERVED, with
+        // each member normalized individually (invalid members drop). The
+        // pre-draft-2026-08-19 behavior collapsed to the first non-null
+        // member; see the pipe-union note above for why that narrowing is
+        // now a contract-violation factory.
+        return normalizeTypeMembers(value, enumSibling) ?? 'string';
     }
     // `type` was a number / object / boolean — meaningless; drop it.
     return undefined;
 }
+/**
+ * Normalize a list of candidate type members: each member runs through
+ * {@link normalizeTypeValue} (case folding, aliases, drop-words),
+ * survivors dedupe in order. Two-plus survivors → the draft-07 array
+ * form; exactly one → the plain string form; none → `undefined`.
+ */
+function normalizeTypeMembers(members, enumSibling) {
+    const survivors = [];
+    for (const member of members) {
+        if (typeof member !== 'string')
+            continue;
+        const norm = normalizeTypeValue(member, enumSibling);
+        if (typeof norm === 'string' && !survivors.includes(norm)) {
+            survivors.push(norm);
+        }
+    }
+    if (survivors.length === 0)
+        return undefined;
+    if (survivors.length === 1)
+        return survivors[0];
+    return survivors;
+}
 /** Normalize a map of name → schema (e.g. `properties`). */
 function normalizeSchemaMap(value) {
     if (typeof value !== 'object' || value === null || Array.isArray(value)) {

package/dist/salvage-draft.d.ts

@@ -0,0 +1,64 @@
+/**
+ * `salvageConformingSubset` — the last-resort tier that replaces the
+ * empty-contract fallback (ggui#523 item 3, "make `{}` impossible").
+ *
+ * When a draft cannot be made to conform any other way (no LLM bound,
+ * provider down, repair budget exhausted), the negotiator used to hand
+ * back the trivially-conforming `{}` with the findings attached — a
+ * response the agent cannot tell apart from success: `action: create`,
+ * a handshakeId, a `nextStep`, and a contract that declares NOTHING. The
+ * paired render then paints a hollow shell, and the observed recovery
+ * is a field-by-field bisect (No Silent Block, applied to contracts).
+ *
+ * This tier instead keeps what DOES conform. It deletes exactly the
+ * entries the deterministic gate names — one offending property,
+ * action, stream, context slot, or tool at a time (a bad sub-field
+ * first, the whole entry only if that was not enough) — re-lints, and
+ * repeats until the gate is green. The result is the agent's own draft
+ * minus the parts the protocol refused, with every drop reported as a
+ * finding, so the agent sees exactly what to fix in one read.
+ *
+ * It returns `null` — "nothing salvageable" — when what survives
+ * declares no surface at all (no props, actions, streams, context
+ * slots, or tools), or when an error is structural (the root is not an
+ * object). `null` is the DECLINE signal: the caller answers
+ * `action: 'declined'` with the findings, never a proposal. Between the
+ * two, no path produces an empty contract on the agent's behalf.
+ *
+ * Deterministic and pure: no LLM, no mutation of the input, no throw.
+ * Bounded: every iteration removes at least one key or returns.
+ */
+import { type DataContract, type SuggestionFinding } from '@ggui-ai/protocol';
+export interface SalvageResult {
+    /** A contract guaranteed to pass `lintContract` with zero errors, and to declare at least one surface. */
+    readonly contract: DataContract;
+    /**
+     * What was removed to get there — one finding per deleted key, in
+     * deletion order, carrying the gate's own code + message for that
+     * path. Surfaced to the agent verbatim.
+     */
+    readonly dropped: readonly SuggestionFinding[];
+}
+/** Does the contract declare at least one surface an agent could use? */
+export declare function declaresAnySurface(contract: DataContract): boolean;
+/**
+ * Where to cut for an offending path. Returns the key path to delete
+ * (as segments) or `null` when the error is structural.
+ *
+ *   propsSpec.properties.<k>[.…]  → try the sub-field, then the property
+ *   actionSpec|streamSpec|contextSpec.<k>[.…] → sub-field, then the entry
+ *   agentCapabilities.tools.<k>[.…] → sub-field, then the tool
+ *   <spec>[.other]               → the whole spec
+ *   <unknown-top-level-key>[.…]  → that key (retired fields, typos)
+ *   <root>                       → structural, null
+ *
+ * `leafFirst` picks the deeper cut when one exists; the caller retries
+ * with `false` if that cut did not clear the entry.
+ */
+export declare function cutFor(path: string, leafFirst: boolean): readonly string[] | null;
+/**
+ * Keep the conforming subset of `draft` (already normalized by the
+ * caller, ideally). See the module docstring for the contract.
+ */
+export declare function salvageConformingSubset(draft: unknown): SalvageResult | null;
+//# sourceMappingURL=salvage-draft.d.ts.map

package/dist/salvage-draft.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"salvage-draft.d.ts","sourceRoot":"","sources":["../src/salvage-draft.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAkB3B,MAAM,WAAW,aAAa;IAC5B,0GAA0G;IAC1G,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAChD;AAMD,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CASlE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,GAAG,IAAI,CA6BjF;AA8BD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,GAAG,IAAI,CA8C5E"}

package/dist/salvage-draft.js

@@ -0,0 +1,191 @@
+/**
+ * `salvageConformingSubset` — the last-resort tier that replaces the
+ * empty-contract fallback (ggui#523 item 3, "make `{}` impossible").
+ *
+ * When a draft cannot be made to conform any other way (no LLM bound,
+ * provider down, repair budget exhausted), the negotiator used to hand
+ * back the trivially-conforming `{}` with the findings attached — a
+ * response the agent cannot tell apart from success: `action: create`,
+ * a handshakeId, a `nextStep`, and a contract that declares NOTHING. The
+ * paired render then paints a hollow shell, and the observed recovery
+ * is a field-by-field bisect (No Silent Block, applied to contracts).
+ *
+ * This tier instead keeps what DOES conform. It deletes exactly the
+ * entries the deterministic gate names — one offending property,
+ * action, stream, context slot, or tool at a time (a bad sub-field
+ * first, the whole entry only if that was not enough) — re-lints, and
+ * repeats until the gate is green. The result is the agent's own draft
+ * minus the parts the protocol refused, with every drop reported as a
+ * finding, so the agent sees exactly what to fix in one read.
+ *
+ * It returns `null` — "nothing salvageable" — when what survives
+ * declares no surface at all (no props, actions, streams, context
+ * slots, or tools), or when an error is structural (the root is not an
+ * object). `null` is the DECLINE signal: the caller answers
+ * `action: 'declined'` with the findings, never a proposal. Between the
+ * two, no path produces an empty contract on the agent's behalf.
+ *
+ * Deterministic and pure: no LLM, no mutation of the input, no throw.
+ * Bounded: every iteration removes at least one key or returns.
+ */
+import { dataContractSchema, lintContract, } from '@ggui-ai/protocol';
+/** The six top-level spec keys the DataContract declares. */
+const SPEC_KEYS = new Set([
+    'propsSpec',
+    'actionSpec',
+    'streamSpec',
+    'contextSpec',
+    'agentCapabilities',
+    'clientCapabilities',
+]);
+/** Spec maps whose direct children are the droppable entries. */
+const ENTRY_MAP_SPECS = new Set(['actionSpec', 'streamSpec', 'contextSpec']);
+/** Hard cap on gate iterations — every iteration deletes ≥1 key. */
+const MAX_ROUNDS = 100;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Does the contract declare at least one surface an agent could use? */
+export function declaresAnySurface(contract) {
+    const props = contract.propsSpec?.properties;
+    if (props !== undefined && Object.keys(props).length > 0)
+        return true;
+    if (contract.actionSpec !== undefined && Object.keys(contract.actionSpec).length > 0)
+        return true;
+    if (contract.streamSpec !== undefined && Object.keys(contract.streamSpec).length > 0)
+        return true;
+    if (contract.contextSpec !== undefined && Object.keys(contract.contextSpec).length > 0)
+        return true;
+    const tools = contract.agentCapabilities?.tools;
+    if (tools !== undefined && Object.keys(tools).length > 0)
+        return true;
+    return false;
+}
+/**
+ * Where to cut for an offending path. Returns the key path to delete
+ * (as segments) or `null` when the error is structural.
+ *
+ *   propsSpec.properties.<k>[.…]  → try the sub-field, then the property
+ *   actionSpec|streamSpec|contextSpec.<k>[.…] → sub-field, then the entry
+ *   agentCapabilities.tools.<k>[.…] → sub-field, then the tool
+ *   <spec>[.other]               → the whole spec
+ *   <unknown-top-level-key>[.…]  → that key (retired fields, typos)
+ *   <root>                       → structural, null
+ *
+ * `leafFirst` picks the deeper cut when one exists; the caller retries
+ * with `false` if that cut did not clear the entry.
+ */
+export function cutFor(path, leafFirst) {
+    if (path === '' || path === '<root>')
+        return null;
+    const seg = path.split('.');
+    const head = seg[0];
+    if (head === 'propsSpec') {
+        if (seg[1] === 'properties' && seg.length >= 3) {
+            const entry = seg.slice(0, 3);
+            return leafFirst && seg.length > 3 ? seg : entry;
+        }
+        return ['propsSpec'];
+    }
+    if (ENTRY_MAP_SPECS.has(head)) {
+        if (seg.length >= 2) {
+            const entry = seg.slice(0, 2);
+            return leafFirst && seg.length > 2 ? seg : entry;
+        }
+        return [head];
+    }
+    if (head === 'agentCapabilities') {
+        if (seg[1] === 'tools' && seg.length >= 3) {
+            const entry = seg.slice(0, 3);
+            return leafFirst && seg.length > 3 ? seg : entry;
+        }
+        return ['agentCapabilities'];
+    }
+    if (SPEC_KEYS.has(head))
+        return [head];
+    // Unknown / retired top-level field — the whole key goes.
+    return [head];
+}
+/** Delete `keyPath` from a structural copy of `root`; false if absent. */
+function deleteAt(root, keyPath) {
+    let node = root;
+    for (let i = 0; i < keyPath.length - 1; i += 1) {
+        const next = node[keyPath[i]];
+        if (!isRecord(next))
+            return false;
+        // Copy-on-write down the path so the input is never mutated.
+        const copy = { ...next };
+        node[keyPath[i]] = copy;
+        node = copy;
+    }
+    const leaf = keyPath[keyPath.length - 1];
+    if (!(leaf in node))
+        return false;
+    delete node[leaf];
+    // A dropped prop must leave `propsSpec.required` too — a stale name
+    // there is its own gate error and would only cost another round.
+    if (keyPath.length === 3 && keyPath[0] === 'propsSpec' && keyPath[1] === 'properties') {
+        const ps = root['propsSpec'];
+        if (isRecord(ps) && Array.isArray(ps['required'])) {
+            root['propsSpec'] = {
+                ...ps,
+                required: ps['required'].filter((name) => name !== leaf),
+            };
+        }
+    }
+    return true;
+}
+/**
+ * Keep the conforming subset of `draft` (already normalized by the
+ * caller, ideally). See the module docstring for the contract.
+ */
+export function salvageConformingSubset(draft) {
+    if (!isRecord(draft))
+        return null;
+    let working = { ...draft };
+    const dropped = [];
+    /** Cuts already tried at leaf depth for a path — the retry goes to the entry. */
+    const leafTried = new Set();
+    for (let round = 0; round < MAX_ROUNDS; round += 1) {
+        const lint = lintContract(working);
+        if (lint.errors.length === 0) {
+            // Shape passed ⇒ the strict parse cannot throw.
+            const contract = dataContractSchema.parse(working);
+            return declaresAnySurface(contract) ? { contract, dropped } : null;
+        }
+        let cutSomething = false;
+        for (const issue of lint.errors) {
+            const leafFirst = !leafTried.has(issue.path);
+            const cut = cutFor(issue.path, leafFirst);
+            if (cut === null)
+                return null; // structural — nothing to keep
+            const cutKey = cut.join('.');
+            if (leafFirst && cutKey === issue.path)
+                leafTried.add(issue.path);
+            const next = { ...working };
+            if (!deleteAt(next, cut)) {
+                // The path names something that is not there (a reference
+                // target, a computed check) — fall back to the entry cut once,
+                // then give up on this issue for the round.
+                if (leafFirst) {
+                    leafTried.add(issue.path);
+                    const entryCut = cutFor(issue.path, false);
+                    if (entryCut !== null && deleteAt(next, entryCut)) {
+                        working = next;
+                        dropped.push({ code: issue.code, severity: 'error', path: entryCut.join('.'), message: issue.message });
+                        cutSomething = true;
+                        break;
+                    }
+                }
+                continue;
+            }
+            working = next;
+            dropped.push({ code: issue.code, severity: 'error', path: cutKey, message: issue.message });
+            cutSomething = true;
+            break; // one cut per round — re-lint before the next decision
+        }
+        if (!cutSomething)
+            return null; // no cut could be applied — structural
+    }
+    return null;
+}

package/dist/synth-bench/round-trip-score.js

@@ -31,9 +31,9 @@
 import { validatePropsData } from '@ggui-ai/protocol';
 /**
  * True when a contract declares none of the six spec surfaces — the
- * `EMPTY_CONTRACT` (`{}`) that `ensureConformingContract` returns when a
- * draft is unrepairable. Such a contract is structurally valid but
- * carries no wire at all.
+ * empty contract the bench substitutes for a DECLINE (and the `{}` the
+ * retired fallback used to return for an unrepairable draft). Such a
+ * contract is structurally valid but carries no wire at all.
  */
 function isEmptyContract(contract) {
     return (contract.propsSpec === undefined &&

package/dist/synth-bench/run-repair-bench.d.ts

@@ -25,19 +25,26 @@
  * deterministic scorer pinning lives in round-trip-score.test.ts.
  */
 import type { DataContract, SuggestionFinding } from '@ggui-ai/protocol';
+import { type EnsureConformingMethod } from '../ensure-conforming-contract.js';
 import type { LLMCaller } from '../llm-caller.js';
 import { type ScoreResult } from './run-bench.js';
 import { type RoundTripScore } from './round-trip-score.js';
 import { type BenchEntry } from './corpus.js';
 export interface RepairBenchOutcome {
     readonly entry: BenchEntry;
-    /** ensureConformingContract always returns a contract (possibly `{}`). */
-    readonly contract: DataContract;
+    /**
+     * The conforming contract ensureConformingContract produced — or
+     * `null` when it DECLINED (nothing in the draft could be kept; ggui#523
+     * item 3 retired the empty-contract fallback). Scored as the empty
+     * contract so the tiers stay comparable across that change.
+     */
+    readonly contract: DataContract | null;
     /** `agent` = clean draft returned verbatim; `synth` = repaired in-place. */
     readonly origin: 'agent' | 'synth';
     /** How the contract was produced (the efficiency tier): verbatim /
-     *  normalized (deterministic, no LLM) / llm-repair / fallback-empty. */
-    readonly method: 'verbatim' | 'normalized' | 'llm-repair' | 'fallback-empty';
+     *  normalized (deterministic, no LLM) / llm-repair / salvaged-subset /
+     *  declined. */
+    readonly method: EnsureConformingMethod | 'declined';
     /** Structural shape score (ride-along secondary signal). */
     readonly shape: ScoreResult;
     /** Round-trip usability — null when the entry declares no round-trip

package/dist/synth-bench/run-repair-bench.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-repair-bench.d.ts","sourceRoot":"","sources":["../../src/synth-bench/run-repair-bench.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAA4B,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IACnC;4EACwE;IACxE,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,gBAAgB,CAAC;IAC7E,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;0DACsD;IACtD,QAAQ,CAAC,SAAS,EAAE,cAAc,GAAG,IAAI,CAAC;IAC1C,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAItE;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,4DAA4D;QAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,kDAAkD;QAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,iDAAiD;QACjD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,6CAA6C;QAC7C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,uEAAuE;QACvE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,qCAAqC;QACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,CACpB,OAAO,EAAE,kBAAkB,EAC3B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,KACV,IAAI,CAAC;CACX;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,EACjC,OAAO,GAAE,qBAA0B,EACnC,MAAM,GAAE,SAAS,UAAU,EAAkB,GAC5C,OAAO,CAAC,iBAAiB,CAAC,CA6C5B;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,SAAS,kBAAkB,EAAE,GACtC,iBAAiB,CAwCnB;AAQD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAyDzE;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,EACjC,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,iBAAiB,CAAC,CAE5B"}
+{"version":3,"file":"run-repair-bench.d.ts","sourceRoot":"","sources":["../../src/synth-bench/run-repair-bench.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAA4B,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IACnC;;oBAEgB;IAChB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,GAAG,UAAU,CAAC;IACrD,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;0DACsD;IACtD,QAAQ,CAAC,SAAS,EAAE,cAAc,GAAG,IAAI,CAAC;IAC1C,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAItE;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,4DAA4D;QAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,kDAAkD;QAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,iDAAiD;QACjD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,6CAA6C;QAC7C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,uEAAuE;QACvE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,qCAAqC;QACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,CACpB,OAAO,EAAE,kBAAkB,EAC3B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,KACV,IAAI,CAAC;CACX;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,EACjC,OAAO,GAAE,qBAA0B,EACnC,MAAM,GAAE,SAAS,UAAU,EAAkB,GAC5C,OAAO,CAAC,iBAAiB,CAAC,CAkD5B;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,SAAS,kBAAkB,EAAE,GACtC,iBAAiB,CAwCnB;AAQD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAyDzE;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,EACjC,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,iBAAiB,CAAC,CAE5B"}

package/dist/synth-bench/run-repair-bench.js

@@ -24,7 +24,7 @@
  * Live LLM probe — opt-in CLI (run-repair-bench-cli.ts), NOT in CI. The
  * deterministic scorer pinning lives in round-trip-score.test.ts.
  */
-import { ensureConformingContract } from '../ensure-conforming-contract.js';
+import { ensureConformingContract, } from '../ensure-conforming-contract.js';
 import { scoreSynthesizedContract } from './run-bench.js';
 import { scoreContractRoundTrip, } from './round-trip-score.js';
 import { REPAIR_CORPUS } from './corpus.js';
@@ -48,7 +48,8 @@ export async function evaluateRepairCorpus(deps, options = {}, corpus = REPAIR_C
         const startedAt = Date.now();
         // The real production create-path: lint the draft → verbatim if clean
         // (origin agent), repair-in-place otherwise (origin synth). NEVER
-        // throws; an unrepairable draft yields the empty `{}` contract.
+        // throws; an unrepairable draft yields its conforming subset, or a
+        // decline (`contract: null`) when nothing survives.
         const result = await ensureConformingContract({ llm: deps.llm }, {
             draft: entry.draft,
             intent: entry.intent,
@@ -57,9 +58,13 @@ export async function evaluateRepairCorpus(deps, options = {}, corpus = REPAIR_C
                 : {}),
         });
         const latencyMs = Date.now() - startedAt;
-        const shape = scoreSynthesizedContract(result.contract, entry.expected);
+        // A decline carries no contract; score it as the empty contract —
+        // exactly what the retired fallback returned — so pass rates before
+        // and after the posture change measure the same thing.
+        const scored = result.contract ?? {};
+        const shape = scoreSynthesizedContract(scored, entry.expected);
         const roundTrip = entry.roundTrip !== undefined
-            ? scoreContractRoundTrip(result.contract, entry.roundTrip)
+            ? scoreContractRoundTrip(scored, entry.roundTrip)
             : null;
         const outcome = {
             entry,
@@ -134,7 +139,7 @@ export function formatRepairBenchReport(report) {
     for (const o of report.outcomes) {
         byMethod.set(o.method, (byMethod.get(o.method) ?? 0) + 1);
     }
-    const methodStr = ['verbatim', 'normalized', 'llm-repair', 'fallback-empty']
+    const methodStr = ['verbatim', 'normalized', 'llm-repair', 'salvaged-subset', 'declined']
         .filter((m) => byMethod.has(m))
         .map((m) => `${m}×${byMethod.get(m)}`)
         .join(' ');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/negotiator",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Contract-synthesis + match-judge engine for ggui's handshake. Synthesizes or repairs a conforming DataContract from an agent's draft, judges blueprint-match candidates for reuse, and validates contract structure + novelty — the primitives composed by decideHandshake in @ggui-ai/mcp-server-handlers. Deployment-agnostic: concrete embedding and vector-store bindings plug in via the storage interfaces from @ggui-ai/mcp-server-core.",
   "license": "Apache-2.0",
   "keywords": [
@@ -47,8 +47,8 @@
     }
   },
   "dependencies": {
-    "@ggui-ai/mcp-server-core": "0.9.0",
-    "@ggui-ai/protocol": "0.9.0"
+    "@ggui-ai/mcp-server-core": "0.11.0",
+    "@ggui-ai/protocol": "0.11.0"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",

package/src/contract-validators.ts

@@ -249,7 +249,13 @@ function nameImpliesMutation(args: {
  */
 function isEmptyPayloadSchema(schema: JsonSchema | undefined): boolean {
   if (schema === undefined) return true;
-  if (schema.type !== 'object') return false;
+  // `type` may be a draft-07 type ARRAY (`['object','null']`) since
+  // draft-2026-08-19 — treat a type set containing 'object' like the
+  // single-string form.
+  const declaresObject = Array.isArray(schema.type)
+    ? schema.type.includes('object')
+    : schema.type === 'object';
+  if (!declaresObject) return false;
   if (schema.properties === undefined) return true;
   return Object.keys(schema.properties).length === 0;
 }

package/src/ensure-conforming-contract.ts

@@ -13,10 +13,14 @@
  *                              seeded with the draft + the deterministic
  *                              findings, looping until the gate is green
  *                              (origin: 'synth')
- *   - repair impossible      → minimal conforming contract (`{}`) + loud
- *     (LLM down / provider      error findings; STILL origin 'synth';
- *      can't synth / budget     NEVER throws.
- *      exhausted)
+ *   - repair impossible      → the conforming SUBSET of the draft (every
+ *     (LLM down / provider      refused entry dropped and reported;
+ *      can't synth / budget     origin 'synth', method 'salvaged-subset')
+ *      exhausted)              — or, when nothing usable survives, a
+ *                              DECLINE (`contract: null`, method
+ *                              'declined') with the findings. NEVER
+ *                              throws; NEVER an empty contract on the
+ *                              agent's behalf (ggui#523 item 3).
  *
  * Determinism lives in the GATE (`lintContract`), never in the repair.
  * The repair LLM is non-deterministic, but the loop only exits when the
@@ -39,38 +43,65 @@ import {
 import type { LLMCaller } from './llm-caller.js';
 import { synthesizeContract } from './synthesize-contract.js';
 import { normalizeDraft } from './normalize-draft.js';
+import { salvageConformingSubset } from './salvage-draft.js';
 
-export interface EnsureConformingResult {
+/**
+ * How a conforming contract was produced — finer-grained than `origin`,
+ * for telemetry (the efficiency tiers):
+ *   - `verbatim`        — draft was clean; returned as-is (origin agent).
+ *   - `normalized`      — deterministic fix only, NO LLM (origin synth).
+ *   - `llm-repair`      — the bounded LLM repair loop ran (origin synth).
+ *   - `salvaged-subset` — unrepairable within budget; the conforming
+ *                         SUBSET of the draft, refused entries dropped
+ *                         and reported (origin synth).
+ */
+export type EnsureConformingMethod =
+  | 'verbatim'
+  | 'normalized'
+  | 'llm-repair'
+  | 'salvaged-subset';
+
+/** A conforming contract was produced (the common case). */
+export interface EnsureConformingAccepted {
   /** A contract guaranteed to pass `lintContract` with zero errors. */
   readonly contract: DataContract;
   /**
    * - `'agent'` — the draft was already conforming; returned verbatim.
    * - `'synth'` — the draft had errors; this is the repaired result
-   *   (or the minimal-conforming fallback when repair was impossible).
+   *   (or the salvaged subset when repair was impossible).
    */
   readonly origin: 'agent' | 'synth';
-  /**
-   * How the conforming contract was produced — finer-grained than
-   * `origin`, for telemetry (the efficiency tiers):
-   *   - `verbatim`      — draft was clean; returned as-is (origin agent).
-   *   - `normalized`    — deterministic fix only, NO LLM (origin synth).
-   *   - `llm-repair`    — the bounded LLM repair loop ran (origin synth).
-   *   - `fallback-empty`— unrepairable; minimal `{}` contract (origin synth).
-   */
-  readonly method: 'verbatim' | 'normalized' | 'llm-repair' | 'fallback-empty';
+  readonly method: EnsureConformingMethod;
   /**
    * Findings surfaced to the agent. On `origin: 'agent'`, any hygiene
    * warnings on the (valid) draft. On `origin: 'synth'`, the ERROR
    * findings that rejected the agent's draft — so the agent-side model
-   * learns what it got wrong, even though we repaired it.
+   * learns what it got wrong, even though we repaired it. On
+   * `salvaged-subset` they include one finding per dropped entry.
    */
   readonly findings: readonly SuggestionFinding[];
   /** Operator- + LLM-readable explanation. */
   readonly reasoning: string;
 }
 
-/** Trivially-valid last-resort contract — all four specs omitted. */
-const EMPTY_CONTRACT: DataContract = {};
+/**
+ * Nothing in the draft could be kept: repair failed AND no entry
+ * survives the gate. There is no contract to propose — the caller
+ * answers `action: 'declined'` with the findings and the agent fixes
+ * and re-handshakes. This is what replaced the empty-contract fallback:
+ * a hollow "success" was indistinguishable from a rejection and the
+ * observed recovery was a field-by-field bisect (ggui#523 item 3).
+ */
+export interface EnsureConformingDeclined {
+  readonly contract: null;
+  readonly origin: 'agent';
+  readonly method: 'declined';
+  /** The ERROR findings that rejected the draft — every one of them. */
+  readonly findings: readonly SuggestionFinding[];
+  readonly reasoning: string;
+}
+
+export type EnsureConformingResult = EnsureConformingAccepted | EnsureConformingDeclined;
 
 export async function ensureConformingContract(
   deps: { readonly llm: LLMCaller },
@@ -161,15 +192,37 @@ export async function ensureConformingContract(
   }
 
   // Repair impossible (LLM down, provider can't synthesize, or the
-  // repair budget exhausted). We still MUST return a conforming
-  // contract — the handshake never hard-fails. Minimal conforming
-  // contract + loud findings so the agent can re-issue a corrected
-  // contract via ggui_render override if it needs the declared specs.
+  // repair budget exhausted). Keep what conforms: drop exactly the
+  // entries the gate refuses, report each drop, and propose the rest —
+  // the agent's own draft minus the parts the protocol rejected. Never
+  // an empty contract dressed as a proposal.
+  const salvaged = salvageConformingSubset(normalized);
+  if (salvaged !== null) {
+    const droppedPaths = salvaged.dropped.map((d) => d.path);
+    return {
+      contract: salvaged.contract,
+      origin: 'synth',
+      method: 'salvaged-subset',
+      findings: [...errorFindings, ...salvaged.dropped],
+      reasoning:
+        `could not repair the agent draft within budget (${synth.reason}); ` +
+        `proposing the conforming SUBSET of your draft — dropped ${droppedPaths.length} ` +
+        `entr${droppedPaths.length === 1 ? 'y' : 'ies'} the protocol refused (${droppedPaths.join(', ')}). ` +
+        `Each drop is a finding: fix those entries and re-handshake, or render this subset ` +
+        `and re-declare them via ggui_render override.`,
+    };
+  }
+
+  // Nothing usable survives. Decline: there is no contract to propose,
+  // and the findings say exactly why.
   return {
-    contract: EMPTY_CONTRACT,
-    origin: 'synth',
-    method: 'fallback-empty',
+    contract: null,
+    origin: 'agent',
+    method: 'declined',
     findings: errorFindings,
-    reasoning: `could not repair the agent draft within budget (${synth.reason}); returning a minimal conforming contract — re-issue a corrected contract via ggui_render override if you need the declared specs`,
+    reasoning:
+      `declined: could not repair the agent draft within budget (${synth.reason}) and no entry of it ` +
+      `passes the contract gate — nothing to propose. Fix the findings (every one names its path) ` +
+      `and re-handshake; do not render against this handshake.`,
   };
 }

package/src/index.ts

@@ -36,8 +36,21 @@ export type {
 export { synthesizeContract } from './synthesize-contract.js';
 export type { SynthesizeContractResult } from './synthesize-contract.js';
 export { ensureConformingContract } from './ensure-conforming-contract.js';
-export type { EnsureConformingResult } from './ensure-conforming-contract.js';
+export type {
+  EnsureConformingAccepted,
+  EnsureConformingDeclined,
+  EnsureConformingMethod,
+  EnsureConformingResult,
+} from './ensure-conforming-contract.js';
 export { normalizeDraft } from './normalize-draft.js';
+// The last-resort tier that replaced the empty-contract fallback (ggui#523
+// item 3): keep the conforming subset of a draft, or decline. Shared with
+// the handlers' no-LLM paths so every producer answers the same way.
+export {
+  salvageConformingSubset,
+  declaresAnySurface,
+  type SalvageResult,
+} from './salvage-draft.js';
 export {
   validateContractRedundancy,
   validateContractNovelty,

package/src/normalize-schema.ts

@@ -102,7 +102,7 @@ function inferEnumBaseType(enumSibling: unknown): string {
 function normalizeTypeValue(
   value: unknown,
   enumSibling: unknown,
-): string | undefined {
+): string | string[] | undefined {
   if (typeof value === 'string') {
     const lower = value.toLowerCase();
     if (VALID_TYPES.has(lower)) return lower;
@@ -113,33 +113,51 @@ function normalizeTypeValue(
     if (lower.includes('|')) {
       // Pipe-union string (`"STRING|null"`). Some models emit the union
       // as one pipe-delimited string rather than the JSON Schema array
-      // form; recover the first valid non-null member, mirroring the
-      // array branch below (drops the nullable arm).
-      for (const member of lower.split('|')) {
-        const norm = normalizeTypeValue(member, enumSibling);
-        if (norm !== undefined && norm !== 'null') return norm;
-      }
-      return undefined;
+      // form; recover it AS the draft-07 array form — since
+      // draft-2026-08-19 the protocol's JsonSchema.type admits type
+      // arrays, and the nullable arm is load-bearing (schema-precise
+      // render: dropping it narrows the contract and turns the agent's
+      // legal `null` into a contract_violation).
+      return normalizeTypeMembers(lower.split('|'), enumSibling);
     }
     // Unrecognized garbage — drop the constraint rather than guess.
     return undefined;
   }
   if (Array.isArray(value)) {
-    // Union type (`["string", "null"]`). The protocol contract schema
-    // accepts only a single string; recover the first valid non-null
-    // member, dropping the nullable arm.
-    for (const member of value) {
-      if (typeof member === 'string') {
-        const norm = normalizeTypeValue(member, enumSibling);
-        if (norm !== undefined && norm !== 'null') return norm;
-      }
-    }
-    return 'string';
+    // Draft-07 union type (`["string", "null"]`) — PRESERVED, with
+    // each member normalized individually (invalid members drop). The
+    // pre-draft-2026-08-19 behavior collapsed to the first non-null
+    // member; see the pipe-union note above for why that narrowing is
+    // now a contract-violation factory.
+    return normalizeTypeMembers(value, enumSibling) ?? 'string';
   }
   // `type` was a number / object / boolean — meaningless; drop it.
   return undefined;
 }
 
+/**
+ * Normalize a list of candidate type members: each member runs through
+ * {@link normalizeTypeValue} (case folding, aliases, drop-words),
+ * survivors dedupe in order. Two-plus survivors → the draft-07 array
+ * form; exactly one → the plain string form; none → `undefined`.
+ */
+function normalizeTypeMembers(
+  members: readonly unknown[],
+  enumSibling: unknown,
+): string | string[] | undefined {
+  const survivors: string[] = [];
+  for (const member of members) {
+    if (typeof member !== 'string') continue;
+    const norm = normalizeTypeValue(member, enumSibling);
+    if (typeof norm === 'string' && !survivors.includes(norm)) {
+      survivors.push(norm);
+    }
+  }
+  if (survivors.length === 0) return undefined;
+  if (survivors.length === 1) return survivors[0];
+  return survivors;
+}
+
 /** Normalize a map of name → schema (e.g. `properties`). */
 function normalizeSchemaMap(value: unknown): unknown {
   if (typeof value !== 'object' || value === null || Array.isArray(value)) {

package/src/salvage-draft.ts

@@ -0,0 +1,204 @@
+/**
+ * `salvageConformingSubset` — the last-resort tier that replaces the
+ * empty-contract fallback (ggui#523 item 3, "make `{}` impossible").
+ *
+ * When a draft cannot be made to conform any other way (no LLM bound,
+ * provider down, repair budget exhausted), the negotiator used to hand
+ * back the trivially-conforming `{}` with the findings attached — a
+ * response the agent cannot tell apart from success: `action: create`,
+ * a handshakeId, a `nextStep`, and a contract that declares NOTHING. The
+ * paired render then paints a hollow shell, and the observed recovery
+ * is a field-by-field bisect (No Silent Block, applied to contracts).
+ *
+ * This tier instead keeps what DOES conform. It deletes exactly the
+ * entries the deterministic gate names — one offending property,
+ * action, stream, context slot, or tool at a time (a bad sub-field
+ * first, the whole entry only if that was not enough) — re-lints, and
+ * repeats until the gate is green. The result is the agent's own draft
+ * minus the parts the protocol refused, with every drop reported as a
+ * finding, so the agent sees exactly what to fix in one read.
+ *
+ * It returns `null` — "nothing salvageable" — when what survives
+ * declares no surface at all (no props, actions, streams, context
+ * slots, or tools), or when an error is structural (the root is not an
+ * object). `null` is the DECLINE signal: the caller answers
+ * `action: 'declined'` with the findings, never a proposal. Between the
+ * two, no path produces an empty contract on the agent's behalf.
+ *
+ * Deterministic and pure: no LLM, no mutation of the input, no throw.
+ * Bounded: every iteration removes at least one key or returns.
+ */
+import {
+  dataContractSchema,
+  lintContract,
+  type DataContract,
+  type SuggestionFinding,
+} from '@ggui-ai/protocol';
+
+/** The six top-level spec keys the DataContract declares. */
+const SPEC_KEYS = new Set([
+  'propsSpec',
+  'actionSpec',
+  'streamSpec',
+  'contextSpec',
+  'agentCapabilities',
+  'clientCapabilities',
+]);
+
+/** Spec maps whose direct children are the droppable entries. */
+const ENTRY_MAP_SPECS = new Set(['actionSpec', 'streamSpec', 'contextSpec']);
+
+/** Hard cap on gate iterations — every iteration deletes ≥1 key. */
+const MAX_ROUNDS = 100;
+
+export interface SalvageResult {
+  /** A contract guaranteed to pass `lintContract` with zero errors, and to declare at least one surface. */
+  readonly contract: DataContract;
+  /**
+   * What was removed to get there — one finding per deleted key, in
+   * deletion order, carrying the gate's own code + message for that
+   * path. Surfaced to the agent verbatim.
+   */
+  readonly dropped: readonly SuggestionFinding[];
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+/** Does the contract declare at least one surface an agent could use? */
+export function declaresAnySurface(contract: DataContract): boolean {
+  const props = contract.propsSpec?.properties;
+  if (props !== undefined && Object.keys(props).length > 0) return true;
+  if (contract.actionSpec !== undefined && Object.keys(contract.actionSpec).length > 0) return true;
+  if (contract.streamSpec !== undefined && Object.keys(contract.streamSpec).length > 0) return true;
+  if (contract.contextSpec !== undefined && Object.keys(contract.contextSpec).length > 0) return true;
+  const tools = contract.agentCapabilities?.tools;
+  if (tools !== undefined && Object.keys(tools).length > 0) return true;
+  return false;
+}
+
+/**
+ * Where to cut for an offending path. Returns the key path to delete
+ * (as segments) or `null` when the error is structural.
+ *
+ *   propsSpec.properties.<k>[.…]  → try the sub-field, then the property
+ *   actionSpec|streamSpec|contextSpec.<k>[.…] → sub-field, then the entry
+ *   agentCapabilities.tools.<k>[.…] → sub-field, then the tool
+ *   <spec>[.other]               → the whole spec
+ *   <unknown-top-level-key>[.…]  → that key (retired fields, typos)
+ *   <root>                       → structural, null
+ *
+ * `leafFirst` picks the deeper cut when one exists; the caller retries
+ * with `false` if that cut did not clear the entry.
+ */
+export function cutFor(path: string, leafFirst: boolean): readonly string[] | null {
+  if (path === '' || path === '<root>') return null;
+  const seg = path.split('.');
+  const head = seg[0]!;
+
+  if (head === 'propsSpec') {
+    if (seg[1] === 'properties' && seg.length >= 3) {
+      const entry = seg.slice(0, 3);
+      return leafFirst && seg.length > 3 ? seg : entry;
+    }
+    return ['propsSpec'];
+  }
+  if (ENTRY_MAP_SPECS.has(head)) {
+    if (seg.length >= 2) {
+      const entry = seg.slice(0, 2);
+      return leafFirst && seg.length > 2 ? seg : entry;
+    }
+    return [head];
+  }
+  if (head === 'agentCapabilities') {
+    if (seg[1] === 'tools' && seg.length >= 3) {
+      const entry = seg.slice(0, 3);
+      return leafFirst && seg.length > 3 ? seg : entry;
+    }
+    return ['agentCapabilities'];
+  }
+  if (SPEC_KEYS.has(head)) return [head];
+  // Unknown / retired top-level field — the whole key goes.
+  return [head];
+}
+
+/** Delete `keyPath` from a structural copy of `root`; false if absent. */
+function deleteAt(root: Record<string, unknown>, keyPath: readonly string[]): boolean {
+  let node: Record<string, unknown> = root;
+  for (let i = 0; i < keyPath.length - 1; i += 1) {
+    const next = node[keyPath[i]!];
+    if (!isRecord(next)) return false;
+    // Copy-on-write down the path so the input is never mutated.
+    const copy: Record<string, unknown> = { ...next };
+    node[keyPath[i]!] = copy;
+    node = copy;
+  }
+  const leaf = keyPath[keyPath.length - 1]!;
+  if (!(leaf in node)) return false;
+  delete node[leaf];
+  // A dropped prop must leave `propsSpec.required` too — a stale name
+  // there is its own gate error and would only cost another round.
+  if (keyPath.length === 3 && keyPath[0] === 'propsSpec' && keyPath[1] === 'properties') {
+    const ps = root['propsSpec'];
+    if (isRecord(ps) && Array.isArray(ps['required'])) {
+      root['propsSpec'] = {
+        ...ps,
+        required: ps['required'].filter((name) => name !== leaf),
+      };
+    }
+  }
+  return true;
+}
+
+/**
+ * Keep the conforming subset of `draft` (already normalized by the
+ * caller, ideally). See the module docstring for the contract.
+ */
+export function salvageConformingSubset(draft: unknown): SalvageResult | null {
+  if (!isRecord(draft)) return null;
+  let working: Record<string, unknown> = { ...draft };
+  const dropped: SuggestionFinding[] = [];
+  /** Cuts already tried at leaf depth for a path — the retry goes to the entry. */
+  const leafTried = new Set<string>();
+
+  for (let round = 0; round < MAX_ROUNDS; round += 1) {
+    const lint = lintContract(working);
+    if (lint.errors.length === 0) {
+      // Shape passed ⇒ the strict parse cannot throw.
+      const contract = dataContractSchema.parse(working);
+      return declaresAnySurface(contract) ? { contract, dropped } : null;
+    }
+    let cutSomething = false;
+    for (const issue of lint.errors) {
+      const leafFirst = !leafTried.has(issue.path);
+      const cut = cutFor(issue.path, leafFirst);
+      if (cut === null) return null; // structural — nothing to keep
+      const cutKey = cut.join('.');
+      if (leafFirst && cutKey === issue.path) leafTried.add(issue.path);
+      const next: Record<string, unknown> = { ...working };
+      if (!deleteAt(next, cut)) {
+        // The path names something that is not there (a reference
+        // target, a computed check) — fall back to the entry cut once,
+        // then give up on this issue for the round.
+        if (leafFirst) {
+          leafTried.add(issue.path);
+          const entryCut = cutFor(issue.path, false);
+          if (entryCut !== null && deleteAt(next, entryCut)) {
+            working = next;
+            dropped.push({ code: issue.code, severity: 'error', path: entryCut.join('.'), message: issue.message });
+            cutSomething = true;
+            break;
+          }
+        }
+        continue;
+      }
+      working = next;
+      dropped.push({ code: issue.code, severity: 'error', path: cutKey, message: issue.message });
+      cutSomething = true;
+      break; // one cut per round — re-lint before the next decision
+    }
+    if (!cutSomething) return null; // no cut could be applied — structural
+  }
+  return null;
+}

package/src/synth-bench/round-trip-score.ts

@@ -86,9 +86,9 @@ export interface RoundTripScore {
 
 /**
  * True when a contract declares none of the six spec surfaces — the
- * `EMPTY_CONTRACT` (`{}`) that `ensureConformingContract` returns when a
- * draft is unrepairable. Such a contract is structurally valid but
- * carries no wire at all.
+ * empty contract the bench substitutes for a DECLINE (and the `{}` the
+ * retired fallback used to return for an unrepairable draft). Such a
+ * contract is structurally valid but carries no wire at all.
  */
 function isEmptyContract(contract: DataContract): boolean {
   return (

package/src/synth-bench/run-repair-bench.ts

@@ -26,7 +26,10 @@
  */
 
 import type { DataContract, SuggestionFinding } from '@ggui-ai/protocol';
-import { ensureConformingContract } from '../ensure-conforming-contract.js';
+import {
+  ensureConformingContract,
+  type EnsureConformingMethod,
+} from '../ensure-conforming-contract.js';
 import type { LLMCaller } from '../llm-caller.js';
 import { scoreSynthesizedContract, type ScoreResult } from './run-bench.js';
 import {
@@ -37,13 +40,19 @@ import { REPAIR_CORPUS, type BenchEntry } from './corpus.js';
 
 export interface RepairBenchOutcome {
   readonly entry: BenchEntry;
-  /** ensureConformingContract always returns a contract (possibly `{}`). */
-  readonly contract: DataContract;
+  /**
+   * The conforming contract ensureConformingContract produced — or
+   * `null` when it DECLINED (nothing in the draft could be kept; ggui#523
+   * item 3 retired the empty-contract fallback). Scored as the empty
+   * contract so the tiers stay comparable across that change.
+   */
+  readonly contract: DataContract | null;
   /** `agent` = clean draft returned verbatim; `synth` = repaired in-place. */
   readonly origin: 'agent' | 'synth';
   /** How the contract was produced (the efficiency tier): verbatim /
-   *  normalized (deterministic, no LLM) / llm-repair / fallback-empty. */
-  readonly method: 'verbatim' | 'normalized' | 'llm-repair' | 'fallback-empty';
+   *  normalized (deterministic, no LLM) / llm-repair / salvaged-subset /
+   *  declined. */
+  readonly method: EnsureConformingMethod | 'declined';
   /** Structural shape score (ride-along secondary signal). */
   readonly shape: ScoreResult;
   /** Round-trip usability — null when the entry declares no round-trip
@@ -114,7 +123,8 @@ export async function evaluateRepairCorpus(
     const startedAt = Date.now();
     // The real production create-path: lint the draft → verbatim if clean
     // (origin agent), repair-in-place otherwise (origin synth). NEVER
-    // throws; an unrepairable draft yields the empty `{}` contract.
+    // throws; an unrepairable draft yields its conforming subset, or a
+    // decline (`contract: null`) when nothing survives.
     const result = await ensureConformingContract(
       { llm: deps.llm },
       {
@@ -126,10 +136,14 @@ export async function evaluateRepairCorpus(
       },
     );
     const latencyMs = Date.now() - startedAt;
-    const shape = scoreSynthesizedContract(result.contract, entry.expected);
+    // A decline carries no contract; score it as the empty contract —
+    // exactly what the retired fallback returned — so pass rates before
+    // and after the posture change measure the same thing.
+    const scored: DataContract = result.contract ?? {};
+    const shape = scoreSynthesizedContract(scored, entry.expected);
     const roundTrip =
       entry.roundTrip !== undefined
-        ? scoreContractRoundTrip(result.contract, entry.roundTrip)
+        ? scoreContractRoundTrip(scored, entry.roundTrip)
         : null;
     const outcome: RepairBenchOutcome = {
       entry,
@@ -215,7 +229,7 @@ export function formatRepairBenchReport(report: RepairBenchReport): string {
   for (const o of report.outcomes) {
     byMethod.set(o.method, (byMethod.get(o.method) ?? 0) + 1);
   }
-  const methodStr = ['verbatim', 'normalized', 'llm-repair', 'fallback-empty']
+  const methodStr = ['verbatim', 'normalized', 'llm-repair', 'salvaged-subset', 'declined']
     .filter((m) => byMethod.has(m))
     .map((m) => `${m}×${byMethod.get(m)}`)
     .join(' ');