clearotron 0.2.0 → 0.3.0-beta.0

package/docs/RELEASES.md

@@ -8,7 +8,7 @@ nothing else.
 
 ```bash
 npm install -g clearotron          # stable — the tested one
-npm install -g clearotron@beta     # newest — every merge, minutes after it lands
+npm install -g clearotron@beta     # newest — cut when there is something worth testing
 ```
 
 ## What each channel promises
@@ -16,7 +16,7 @@ npm install -g clearotron@beta     # newest — every merge, minutes after it la
 | | `latest` (stable) | `beta` |
 |---|---|---|
 | **Version looks like** | `0.2.0` | `0.2.1-beta.4` |
-| **Cut when** | a beta has passed a full clearance run and a from-scratch install by somebody who has never seen the product, and the owner says go | every merge to `main`, automatically |
+| **Cut when** | a beta has passed a full clearance run and a from-scratch install by somebody who has never seen the product, and the owner says go | when a change lands that is worth testing, or while a stable is being prepared |
 | **Promises** | it installed and ran a real clearance end to end before it was published | it built, and the automated suite passed |
 | **Use it if** | you are running this for real work | you want a fix that landed today, or you are helping test |
 
@@ -35,8 +35,10 @@ suggest for yours.
 
 ## How often
 
-A stable is cut when a beta earns it, which we aim at roughly weekly. Betas arrive whenever something
-merges — several a day when a round is running, none for a day when nothing lands.
+A stable is cut when a beta earns it, which we aim at roughly weekly. **Betas are cut deliberately, days
+apart** — when a change lands that somebody should test, or while a stable is being prepared. They are not
+published on every merge, so `beta` is a version somebody chose to publish rather than whatever merged
+last. Some stables have several betas before them and some have none.
 
 Numbering follows the change, not the calendar: `0.2.x` for fixes, `0.3.0` when a feature lands, `1.0`
 when the hit-list redesign ships.

package/docs/architecture/04-configuration-reference.md

@@ -200,7 +200,7 @@ deployment may override (verify live values per deployment).
 | `CLEAROTRON_OAUTH_BRIDGE` | module-relative `providers/oauth-mcp-bridge/bridge.mjs` | Case-law MCP bridge script. (Portable since the module-relative default; set explicitly only for a bridge outside the repo tree.) |
 | `CLEAROTRON_REGISTER_CALL_LOG` | `~/trademark/telemetry/register-calls.jsonl`, or the existing file wherever it already is | Billing-grade provider-call ledger, shared by whichever ONE register provider is wired — not a vendor artifact. Every read site derives the default from`homedir()` at call time (2026-07-19: two sites had hardcoded a literal account home, splitting the ledger under any other service account — guarded by `test/deployment-hostnames.test.mjs`). |
 | `CLEAROTRON_REGISTER_RECORD_LOG` | **runtime-injected per run**: `<runDir>/_driver/register-record-bodies.jsonl` | Citation-fidelity log: the BODY of every fetched official record. ** moved it INTO the run** — created with the run, unioned into the run's`_records/`, archived and purged with it. There is no retention setting and no cleanup job, because it no longer grows on the box: held globally it reached 432 MB in 61 days on production and needed a rotation timer on every install. **Do not set this by hand** — a fixed value pins every run's bodies to one file and restores the problem. A box upgraded across still holds its old global file; nothing writes or reads it, the driver names it once per process on stderr, and archiving it is one`mv`. An empty log cannot read as verified: the run's successful `record_fetch` rows in the (still global) call ledger are compared against the assembled record set, and a gap is reported as a failure. |
-| `CORSEARCH_CALL_LOG` / `CORSEARCH_RECORD_LOG` | — | **Deprecated, honoured for one release.** The pre- names. Unset on every deployed box (all three ran the homedir default), so what actually protects an upgrade is the filename fallback: a`corsearch-calls.jsonl` / `corsearch-records.jsonl` already on disk keeps being read where it sits. Resolution order is in `providers/_shared/ledger-path.mjs`. |
+| `CORSEARCH_CALL_LOG` / `CORSEARCH_RECORD_LOG` | — | **Deprecated, honoured for one release.** These are the names these two variables carried before the rename. Unset on every deployed box (all three ran the homedir default), so what actually protects an upgrade is the filename fallback: a`corsearch-calls.jsonl` / `corsearch-records.jsonl` already on disk keeps being read where it sits. Resolution order is in `providers/_shared/ledger-path.mjs`. |
 | `CLEAROTRON_BAND_RUN_DIR` | set per dispatch | The run dir the band MCP server writes into, injected per stage — unset means the server has no run to write to and says so rather than guessing one. |
 | `CLEAROTRON_FEEDBACK_DIR` | `<poolRoot>/_feedback` | Where report feedback flags are stored. Beside the pool by default so a deployment that moves the pool moves the flags with it. |
 | `USPTO_LOCAL_DB` | **none — set it to use `uspto-local`** | The local USPTO index (`node:sqlite` + FTS5) that `bin/uspto-sync.mjs` builds and the free US register reads. Named in `.env.example`; this is the reference row. |

package/driver/CHANGELOG.md

@@ -1,5 +1,56 @@
 # prelim-driver
 
+## 0.3.0-beta.0
+
+### Minor Changes
+
+- bb1a409: New: A Knockout report now carries the whole assessment behind its ratings. You get the reviewer's notes and the reviewer's own opening read of each name. You also get the reasoning that holds a name at its rating, and what would move it. This was written during every search and reached only the audit workbook, so the report showed a rating without the thinking under it. The notes are marked as reference material rather than mixed into the findings.
+  
+  New: A registered filing the search formed a view on now shows that rating and the read behind it. Before, the one registered right on a page was the only entry carrying no rating, beside softer uses that all carried one. That inverted what matters legally. A filing the search did not weigh still says so plainly.
+- bb1a409: New: The tools that show how a search reached its answer now work on a Knockout search. You can ask what it found, what it looked at, where it searched and came back empty, and read the delivered report itself. Until now they returned nothing at all for a Knockout search, so anyone asking how one of these results was reached saw a blank record.
+  
+  New: The proof-of-search record answers on these searches. It lists what was searched and found nothing, which is what answers a challenge to a result. Where a tool has nothing to show for this kind of search, it now says so in words. An empty list reads as "we looked and found nothing".
+
+### Patch Changes
+
+- df6277c: Fixed: A live registration covering the goods you asked about is no longer left out of a report for want of room. It is reported, or the report says why it is distant.
+- 9ba8cd0: Fixed: A what-if memo is now refused if it writes anywhere in the delivered run except its own memo folder, and the refusal names the file.
+- 8c8e200: Fixed: A what-if question left queued when its run is archived now comes back with a reason, instead of never being answered.
+- bb1a409: Fixed: The delivery record now states plainly when a report's write-up length and ranking rules could not be checked against the delivered text. It says the rules were applied to nothing on that run. Before, this was recorded as an unlabelled failed check. It looked like any other, so a run could deliver with those rules unverified and nobody would see it.
+- 9ba8cd0: For operators: Each run record now says whether the model id it observed was a pinned snapshot or an alias the provider can repoint.
+- aea4a4e: Fixed: The deployment check now says which checkout a service is running from even when its unit file does not declare one.
+- 14d6d28: Fixed: The demo and the install steps now start on native Windows, where they previously crashed on the first internal module they loaded.
+
+## 0.2.1
+
+### Patch Changes
+
+- 3cc154a: Fixed: A report now keeps a mark the search confirmed, instead of dropping it because it was already noted on an internal working sheet. Where a mark is still missing, the run records it by name rather than closing the question.
+- 3cc154a: Fixed: Asking a what-if question about a delivered report now returns a memo, instead of failing to find the run it was asked about.
+- 0f7b44a: New: `clearotron demo` now publishes all four example reports — one per product — instead of only the first.
+- 2138a3c: For operators: The `beta` channel now gets a release when there is something worth testing, days apart, instead of one on every merge.
+- 8b5ab91: Fixed: `doctor` no longer reports a working Cloudflare Access door as unprotected. An API-style door and a failing origin are now told apart, each with its own message. Neither is reported as a pass.
+- 77cf56d: For operators: The configuration reference now explains the two deprecated search-log variables in full, instead of stopping mid-sentence.
+- 0dcd05a: Fixed: the settings catalogue now lists `CLEAROTRON_CHECKOUT_DIR`, the path every service file points at. The installer still fills it in for you. It is written down so that anyone whose service will not start can look it up.
+
+## 0.2.1-beta.2
+
+### Patch Changes
+
+- 8b5ab91: Fixed: `doctor` no longer reports a working Cloudflare Access door as unprotected. An API-style door and a failing origin are now told apart, each with its own message. Neither is reported as a pass.
+
+## 0.2.1-beta.1
+
+### Patch Changes
+
+- 0dcd05a: Fixed: the settings catalogue now lists `CLEAROTRON_CHECKOUT_DIR`, the path every service file points at. The installer still fills it in for you. It is written down so that anyone whose service will not start can look it up.
+
+## 0.2.1-beta.0
+
+### Patch Changes
+
+- 77cf56d: For operators: The configuration reference now explains the two deprecated search-log variables in full, instead of stopping mid-sentence.
+
 ## 0.2.0
 
 ### Minor Changes

package/driver/ask-ledger.mjs

@@ -574,6 +574,64 @@ export function parseAskClosureLines(text) {
   return out;
 }
 
+/**
+ * The marks the CLIENT was actually shown — `findings[].mark` from findings.json, normalized.
+ *
+ * Returns null when the file is absent or unparseable, and null is NOT an empty set: an absence is a
+ * could-not-look, and the caller below fails toward leaving the ask OPEN rather than closing it on a
+ * file it could not read.
+ *
+ * ✕ NEVER a substring search of the serialized document. `"DELFIN" in JSON.stringify(findings)` is true
+ * when the findings name DELFIN TECHNOLOGIES OY and nothing else — a membership test that matches every
+ * longer name inflates whatever it is counting and reads as a clean result. The field, or nothing.
+ * PURE.
+ */
+export function deliveredMarks(findingsJsonText) {
+  let doc;
+  try { doc = JSON.parse(String(findingsJsonText ?? "")); } catch { return null; }
+  const rows = Array.isArray(doc?.findings) ? doc.findings : null;
+  if (!rows) return null;
+  return new Set(rows.map((f) => normMark(f?.mark)).filter(Boolean));
+}
+
+const normMark = (s) => String(s ?? "").toLowerCase().replace(/[^a-z0-9]/g, "");
+
+/**
+ * Owner ruling 2026-09-07 (tracker issue 246), Option A, worded ABOUT THE MARK: a recall ask may close
+ * as immaterial only when the mark it went looking for is in the client's findings. Otherwise the mark
+ * is owed a finding and the ask stays open.
+ *
+ * The defect this answers: a recall probe found OSLER DELPHI, the closure stage pointed at
+ * `register-findings.md` — the run's own working sheet, where the mark genuinely IS reasoned — and the
+ * ask closed. The sheet is a citable file and the citation was true. It is simply not the document the
+ * client reads, and nothing checked that.
+ *
+ * ✕ SCOPED TO `ask:recall:` ASKS CARRYING A `mark_text`, deliberately, and this is the whole difference
+ * between the two readings of the ruling. `ask:recall-overflow:` rows carry a `term` — an owner name, a
+ * law firm, a probe never dispatched (Lewis Silkin LLP, NORDWEST Handel AG). Measured across three runs
+ * they are 28-29 per run and constant whether the run was healthy or not; reopening them would put
+ * names no lawyer asked for into the findings. A `mark_text` is the test because a mark is what a
+ * finding is about.
+ *
+ * Returns the owed row, or null when the ask is out of scope or the mark was delivered. PURE.
+ */
+export function recallMarkOwed(ask, delivered) {
+  if (!String(ask?.ask_id ?? "").startsWith("ask:recall:")) return null;
+  const st = ask?.ask?.structured ?? {};
+  const mark = String(st.mark_text ?? "").trim();
+  if (!mark) return null;                                       // an owner/term probe is not a mark ask
+  if (delivered instanceof Set && delivered.has(normMark(mark))) return null;
+  return {
+    ask_id: ask.ask_id,
+    mark,
+    owner: String(st.owner ?? "").trim() || null,
+    uri: String(st.uri ?? "").trim() || null,
+    // null delivered = findings.json unreadable. Recorded so a reader can tell "the client was not shown
+    // this mark" from "nobody could tell what the client was shown" — they need different repairs.
+    basis: delivered instanceof Set ? "absent-from-findings" : "findings-unreadable",
+  };
+}
+
 /**
  * The anti-confabulation guard, ask side (doubt-ledger applyClosure reused shape-for-shape): an
  * IMMATERIAL line ends its ask IFF the ask is still open AND the quote appears VERBATIM
@@ -586,7 +644,9 @@ export function applyAskClosure(asks, closureLines, fileTexts = {}, { ts = null
   const byId = new Map();
   for (const l of closureLines ?? []) if (l?.id && !byId.has(l.id)) byId.set(l.id, l);
   const unverified = [];
+  const carryIntoFindings = [];
   let immaterialByStage = 0;
+  const delivered = deliveredMarks(fileTexts?.["findings.json"]);
   const out = (asks ?? []).map((a) => {
     if (a?.ending) return a;                                    // the stage may never touch an ended ask
     const l = byId.get(a.ask_id);
@@ -595,13 +655,21 @@ export function applyAskClosure(asks, closureLines, fileTexts = {}, { ts = null
     const hay = squash(fileTexts?.[l.file]);
     const q = squash(l.quote);
     if (q && hay && hay.includes(q)) {
+      // THE CITATION IS VERIFIED AND THAT IS NO LONGER ENOUGH FOR A RECALL ASK ABOUT A MARK.
+      const owed = recallMarkOwed(a, delivered);
+      if (owed) {
+        carryIntoFindings.push(owed);
+        return { ...a, handoff: clip(`the recall probe found ${owed.mark} and the delivered findings do not name it — `
+          + `the closure cited ${l.file}, which is the run's own working sheet, not what the client was shown. `
+          + `This mark is owed a finding.`, 300) };
+      }
       immaterialByStage++;
       return { ...a, ending: mkEnding("judged-immaterial", "doubt-closure-stage", { evidence: `${l.file}: "${clip(l.quote)}"`, reasons: [l.reason], ts }) };
     }
     unverified.push({ ask_id: a.ask_id, file: l.file, quote: l.quote });
     return a;
   });
-  return { asks: out, immaterialByStage, unverified };
+  return { asks: out, immaterialByStage, unverified, carryIntoFindings };
 }
 
 /** Stamp the default handoff on every still-open ask (after closure) — an OPEN ask always names

package/driver/declination-call.mjs

@@ -210,6 +210,38 @@ export function contradictionFor(reason, row, scope) {
       + `own-right or duplicate-of-delivered.`;
   }
 
+  // ── ECONOMY IS NOT A REASON ABOUT A LIVE IN-CLASS MARK (owner ruling 2026-09-07) ─────────────────
+  //
+  // `not-worth-the-line` means "it fits none of the four manageable categories and is not relevant
+  // enough to drive the read". That is a statement about the REPORT'S BUDGET, not about the record. On a
+  // live registration inside one of the matter's own instructed classes it is the one thing the seat may
+  // not say: the reader is paying for a judgment about that mark, and "there was no room" is not one.
+  //
+  // Measured on the run that prompted the ruling: 26 of 49 declinations at this seam were this token,
+  // and two of the lawyer's own reference marks were among them — one carried on every earlier run.
+  //
+  // ✕ WHY THIS IS NOT THE REFUSAL THAT WAS REMOVED BELOW, and the difference is the whole reason it can
+  // stand. That one refused `unrelated-goods` and `off-field-not-major` on class overlap, fired on 170
+  // of 170 records, and made the ENGINE decide relatedness — the lawyer's call. This one refuses ONE
+  // token and leaves every substantive reason available. The seat may still decline this record: it may
+  // say the goods are unrelated, that it is off-field and not a major brand, that it is the applicant's
+  // own right, or that it is already delivered. What it may no longer do is decline it for taking up
+  // space. The refusal is about the SHAPE of the reason, not about whether the record is relevant, so
+  // the relatedness judgment stays exactly where it was.
+  //
+  // It does effectively retire this token for live in-class records, because the sweep is already scoped
+  // to the instructed classes. That was put to the owner as the consequence and ruled anyway.
+  if (reason === "not-worth-the-line" && isLive(row?.status) && shared.length) {
+    return `this record is ${String(row?.status ?? "").trim() || "live"} and sits in class `
+      + `${shared.join(", ")} — one of the matter's own instructed classes. "not worth the line" is a `
+      + `statement about the report's budget, not about this mark, and a live registration in an `
+      + `instructed class is never omitted for want of room. Either carry it, or decline it on something `
+      + `true of THIS MARK: unrelated-goods if its goods do not meet the matter's, off-field-not-major `
+      + `if it is off-field and not a major brand, an active dispute or a well-known enforcer, `
+      + `own-right if it belongs to the applicant, duplicate-of-delivered if the same right is already `
+      + `reported. Say what makes this mark distant, or give it its line.`;
+  }
+
   // THERE IS NO CLASS-OVERLAP REFUSAL, AND THE FIRST DRAFT HAD ONE. It refused `unrelated-goods` and
   // `off-field-not-major` over any record sharing one of the matter's filed classes, on the reasoning
   // that the driver holds both class lists and they disagree with the stated reason.

package/driver/driver.config.mjs

@@ -612,6 +612,26 @@ const MODEL_FAMILY_RE = /(?:^|\/)(?:claude-)?(opus|sonnet|haiku)(?:[-.]|$)/i;
 // mini one would then read as agreement, which is exactly the corruption this gauge exists to catch.
 const OPENAI_ID_RE = /^(?:openai\/)?(gpt-[\w.-]+|o\d[\w.-]*)$/i;
 const DATE_SUFFIX_RE = /-(?:\d{8}|\d{4}-\d{2}-\d{2})$/;
+
+/**
+ * Is this model id a DATED SNAPSHOT, or an undated alias that a provider may repoint?
+ *
+ * `modelBasis: "actual"` says the provider answered rather than that we guessed — it does not say the
+ * answer names a fixed build. Measured across three archived runs: haiku came back
+ * `claude-haiku-4-5-20251001`, opus and sonnet came back `claude-opus-5` and `claude-sonnet-5`. All
+ * three were recorded identically as observed, and two of them name something the provider can move
+ * underneath us. A snapshot rotation behind either alias between two runs leaves EXACTLY that record and
+ * is invisible, which is how an A/B across time ends up eliminating the seat on evidence that could not
+ * have shown it either way.
+ *
+ * Returns "snapshot", "alias", or null when there is no id to judge — null is a could-not-look and is
+ * never collapsed into "alias". PURE.
+ */
+export function modelSnapshotKind(model) {
+  const id = String(model ?? "").trim();
+  if (!id) return null;
+  return DATE_SUFFIX_RE.test(id) ? "snapshot" : "alias";
+}
 export function modelFamily(model) {
   if (!model) return null;
   const resolved = resolveModel(String(model));

package/driver/engine/mcp/recording-server.mjs

@@ -1120,6 +1120,10 @@ serve({
                   properties: {
                     recordId: { type: "string", description: "Copied VERBATIM from the filings you were given." },
                     read: { type: "string", description: "What you concluded about THIS filing." },
+                    // Declared here for the reason the comment above gives: `additionalProperties: false`
+                    // means an undeclared key is a contradiction between the prose and the schema, and the
+                    // seat resolves it whichever way it happens to trust.
+                    band: { type: "string", description: "OPTIONAL — how you rate THIS filing, in the framework's own band words. Send it when you formed a view on the filing itself; the card prints it as that filing's rating. Omit it and your read still prints, with no rating claimed." },
                   },
                 },
               },

package/driver/gateway.mjs

@@ -13,7 +13,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, wri
 import { join, dirname, basename } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
 import { tmpdir } from "node:os";
-import { config, resolveModel, modelFamily, envOn, envGateOn } from "./driver.config.mjs";
+import { config, resolveModel, modelFamily, modelSnapshotKind, envOn, envGateOn } from "./driver.config.mjs";
 import { stageLog, runLog, note, outputMeta } from "./log.mjs";
 // — the closed disposition set has ONE author; this file dictates it and must not retype it.
 import { DISPOSITIONS, POSITION_REQUIRED_DISPOSITIONS } from "./findings-model.mjs";
@@ -1142,6 +1142,11 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     const modelRequested = engine.resolveModelId ? engine.resolveModelId(model) : resolveModel(model);
     const modelActual = (typeof turn.modelWire === "string" && turn.modelWire) ? turn.modelWire : null;
     const modelBasis = modelActual ? "actual" : "unknown";
+    // WHETHER THE OBSERVED ID NAMES A FIXED BUILD. `modelBasis: "actual"` says the provider answered,
+    // not that the answer is pinned: two of the three tiers come back as undated aliases the provider
+    // may repoint, and recorded beside a dated one they read identically. null when there is nothing to
+    // judge, never collapsed into "alias".
+    const modelSnapshot = modelSnapshotKind(modelActual);
     if (modelActual) lastModelWire = modelActual;                       // — never overwritten with null
     // The comparison is by FAMILY (driver.config modelFamily), because `--model haiku` legitimately comes
     // back as `claude-haiku-4-5-20251001`. THREE-VALUED: null when either side names no family this
@@ -1570,7 +1575,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         //   modelMismatch — true/false when both sides name a family, null when either does not.
         // Written even on the rows where they are null, so "this engine cannot report" stays visibly
         // different from "this record predates the gauge".
-        modelActual, modelBasis, modelMismatch,
+        modelActual, modelBasis, modelSnapshot, modelMismatch,
         // W3 billing telemetry: which engine ran + the RESOLVED billing mode (subscription vs api-key). This
         // records INTENT (the mode the engine was configured to bill under), not independent billing evidence
         // — the actual proof is the provider console (claude's stream also reports apiKeySource; codex does
@@ -1705,7 +1710,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           event: "attempt", stage: name, attempt, of: maxRetries + 1, ok: !fail, fail: fail ?? null,
           //: the spine carries the same pair as the per-stage log, or the two disagree about what
           // ran. `model` stays the requested resolution (its existing readers); `modelActual` is the wire.
-          model: modelRequested, modelActual, modelBasis, modelMismatch,
+          model: modelRequested, modelActual, modelBasis, modelSnapshot, modelMismatch,
           wrote, warm: warm || undefined, warmEscalated: attempt === warmEscalatedAt || undefined,
           rescued: rescued ?? undefined, killed: killed || undefined,
           quiescentMs: Number.isFinite(quiescentMs) ? Math.round(quiescentMs) : undefined,   // — see the per-stage row

package/driver/knockout-assess-record.mjs

@@ -154,7 +154,11 @@ const DECLARED = Object.freeze({
   // "the lane that produced the record is a driver fact". The chip is derived from this joined list and
   // from the finding's own receipted evidence — never from a word the seat typed about itself.
   "marks.findings": ["ordinal", "name", "owner", "band", "net", "type", "evidence", "basis", "weighedFilings"],
-  "marks.registerReads": ["recordId", "read"],
+  // `band` is the rater's rating OF THAT FILING, optional, in the framework's own ladder words. It is
+  // declared here as well as in the tool schema because this allowlist — not the schema — is what the
+  // driver validates against: a key the seat sends and this list omits is refused, so the read would
+  // arrive banded and land unbanded with nothing saying why.
+  "marks.registerReads": ["recordId", "read", "band"],
   "marks.negatives": ["term", "source", "note"],
 });
 

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "prelim-driver",
   "private": true,
   "type": "module",
-  "version": "0.2.0",
+  "version": "0.3.0-beta.0",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline.mjs

@@ -107,14 +107,15 @@ import { mintCrossCheckDoubts, mintContradictionDoubts, stitchDoubts, applyClosu
 import { readAcceptedClosures } from "./doubt-closure-tool.mjs";
 import { CLOSURE_EVIDENCE_FILES } from "./doubt-closure-call.mjs";
 import { doubtsForClosure, doubtSelectionNote } from "./doubt-selection.mjs";   // doubt-closure selection
-import { deriveAsks, applyAskClosure, finalizeOpenHandoffs, summarizeAsks } from "./ask-ledger.mjs";   // PR-6 — every ask ends (2026-07-29)
+import { deriveAsks, applyAskClosure, finalizeOpenHandoffs, summarizeAsks } from "./ask-ledger.mjs";
+import { pendingWhatIf, claimWhatIf, finishWhatIf, whatIfRefusal } from "./whatif-queue.mjs";   // tracker issue 240 — a queued job is settled before its run archives   // PR-6 — every ask ends (2026-07-29)
 import { mintPresenceDoubts } from "./presence-reconciliation.mjs";   // presence-or-reason (2026-07-22 — the unjoined-Sheet-2 leak)
 import { escalatedAxes } from "./skeptic-record.mjs";   // THE escalation parse — shared with the record_skeptic transport so the rendered shape and this read cannot drift
 // — every placed candidate ends somewhere a reader can see; the ones that do not are counted by name
 import { PLACEMENT_CARRY_SCHEMA_VERSION, reconcilePlacementCarry, placementCarryEvent, mintPlacementCarryDoubts, entryUris } from "./placement-carry.mjs";
 import { FLOOR_DUTY_SCHEMA_VERSION, reconcileFloorDuty, floorDutyEvent, armFloorDuty, floorDutyArmed, floorDutyBlock, floorDutyBlocksSkip } from "./floor-duty.mjs";   // — the era stamp that turns disclosure into a delivery floor
 import { synthesisDutyForRun } from "./synthesis-record.mjs";   // — the duty checked against the DELIVERED document
-import { RECORD_CARRY_SCHEMA_VERSION, traceRecordCarry, parseStageOutcomes, recordCarryEvent, mintRecordCarryDoubts, bandRecordUri, placementIndex, findingUris , silentlyLostFindings } from "./record-carry.mjs";
+import { RECORD_CARRY_SCHEMA_VERSION, traceRecordCarry, parseStageOutcomes, recordCarryEvent, mintRecordCarryDoubts, bandRecordUri, placementIndex, findingUris , silentlyLostFindings, statedDivergenceFindings } from "./record-carry.mjs";
 import { reconcileSurfaceDuty, surfaceDutyNote } from "./surface-duty.mjs";   // item 3 — silence at the findings surface, read off the rows above
 import { DISCARD_LEDGER_NAME, seamRows, appendDiscardRows, foldDiscardLedger } from "./record-discard.mjs";
 import { readDeclinations } from "./declination-tool.mjs";   // — synthesis's own stated declines
@@ -1532,6 +1533,13 @@ function attachProfile(ctx, job, { write = true } = {}) {
       const current = resolveProfile(job);
       if (current && current.key !== sidecar.profileKey)
         runLog(ctx.paths.runDir, { event: "profile-mismatch", sidecar: sidecar.profileKey, resolved: current.key });
+      // THE MATCH IS RECORDED TOO, and that is the point rather than symmetry for its own sake.
+      // `profile-mismatch` existed and its counterpart did not, so "the profile was right" was carried
+      // by the ABSENCE of a row — and an absence cannot tell "it matched" from "the probe never ran"
+      // (it throws below on a broken profiles/ state) or from "this run predates the probe". Three
+      // different facts, one empty grep. The positive row says which.
+      else if (current)
+        runLog(ctx.paths.runDir, { event: "profile-resolved", sidecar: sidecar.profileKey, resolved: current.key });
     } catch (e) {
       runLog(ctx.paths.runDir, { event: "profile-mismatch-probe-failed", error: String(e.message).slice(0, 120) });
     }
@@ -4651,7 +4659,7 @@ export function buildFailurePacket({ runId, agent, job = {}, failedStage, shortR
   // was healthy and answering, re-triggering now hits the same cap, and "overloaded" points the reader
   // at an availability problem they cannot act on.
   //
-  // The owner pre-committed the wording watching indigo-falcon: a cap death is reported as a
+  // The owner pre-committed the wording watching a capped run: a cap death is reported as a
   // SUBSCRIPTION OUTCOME, NEVER AS AN ENGINE FINDING. So this names the cap, states how long the run
   // actually held out before giving up, and says plainly that nothing about the run or the mark
   // produced it.
@@ -6135,8 +6143,70 @@ function sentinel(runDir, name, obj) {
   atomicWrite(join(runDir, name), JSON.stringify({ ts: new Date().toISOString(), ...obj }, null, 2) + "\n");
 }
 
+/**
+ * Settle every queued what-if BEFORE the run dir moves into the archive — tracker issue 240.
+ *
+ * A queued job lives under the run directory, and the worker enumerates candidates with `liveRunDirs`,
+ * which skips `archive` outright. So archiving carried a pending job out of the worker's reach: not
+ * claimed, not settled, not refused. The client who asked for it got no answer and no explanation, and
+ * no row anywhere said why. That is an absence reported as nothing at all — the one shape
+ * `whatIfRefusal` exists to prevent.
+ *
+ * BEFORE the rename, deliberately: the settlement is written into the run dir and travels with it, so
+ * the answer is on disk in the archive where the read tool will look for it.
+ *
+ * ✕ THE SENTENCE IS PER KIND, and a memo does not get the stage one. `whatIfRefusal`'s standing
+ * refusal — "this run is delivered or archived, what-if runs on live runs only" — is TRUE of a stage
+ * and FALSE of a memo, which runs on archived evidence by design. Telling a client their memo was
+ * refused because the run is archived would be a false sentence in the one place they go to find out
+ * what happened. A memo is closed on the true reason instead: it was queued before the run archived,
+ * and the drain does not reach an archived run.
+ *
+ * ✕ A JOB ANOTHER WORKER IS ACTIVELY RUNNING IS LEFT ALONE. `pendingWhatIf` returns queued jobs and
+ * claims older than an hour, never a fresh claim, so a live worker's job is not settled underneath it.
+ * A fresh claim at the moment of archiving is a race this does not close, and it is written down
+ * rather than papered over.
+ *
+ * Best-effort throughout: a failure to settle must never stop the archive, because a run that cannot
+ * archive is a much larger problem than a job with no row.
+ */
+export function settlePendingWhatIfsBeforeArchive(run) {
+  let pending = [];
+  // NOT a silent catch. This function exists because a job went unanswered with no row anywhere; a
+  // failure to enumerate that returned quietly would reproduce exactly that, one level up, and the
+  // archive would still succeed so nothing downstream would look wrong.
+  try { pending = pendingWhatIf(run.runDir); }
+  catch (e) { note(`what-if settle before archive could not enumerate the queue (${String(e?.message ?? e).slice(0, 120)}) — pending jobs may be unanswered`); return; }
+  for (const entry of pending) {
+    try {
+      // CLAIM FIRST, exactly as the worker does. `finishWhatIf` writes the terminal file and does not
+      // remove the `.json`; the claim is what renames it out of the queue. Settling without claiming
+      // writes a `.failed` beside a `.json` that still reads as QUEUED to every reader — the job would
+      // look pending and answered at the same time, which is worse than the silence being fixed here.
+      const job = claimWhatIf(entry);
+      if (!job) continue;                     // another worker won it, or it vanished — not ours to settle
+      const kind = job?.op?.kind === "memo" ? "memo" : "stage";
+      // ✕ THE SENTENCE IS PER KIND. The standing refusal — "what-if runs on live runs only" — is TRUE
+      // of a stage and FALSE of a memo, which reasons over archived evidence by design. A memo is
+      // closed on the true reason instead.
+      const error = kind === "memo"
+        ? "this what-if was queued before its run was archived, and the drain does not reach an archived run — ask it again against the archived run, which a memo may read"
+        : (whatIfRefusal({ location: "archive", state: run.state ?? null, kind }) ?? "this run is delivered or archived — what-if runs on live runs only");
+      finishWhatIf(run.runDir, entry.id, { ok: false, op: job.op ?? null, error });
+      try { runLog(run.runDir, { event: "whatif-settled-on-archive", id: entry.id, kind, stale: entry.stale }); }
+      catch { /* the row is written; the log line is a convenience and must not undo it */ }
+    } catch (e) {
+      // One job's settlement must not cost the others, or the archive — but it must not be SILENT
+      // either. A swallowed failure here leaves exactly the unanswered job this function exists to
+      // prevent, and the archive still succeeds, so nothing downstream looks wrong.
+      note(`what-if ${entry.id} could not be settled before archive (${String(e?.message ?? e).slice(0, 120)}) — it may be unanswered`);
+    }
+  }
+}
+
 function archive(run) {
   try {
+    settlePendingWhatIfsBeforeArchive(run);
     mkdirSync(dirname(run.archiveDir), { recursive: true });
     renameSync(run.runDir, run.archiveDir);
     return run.archiveDir;
@@ -13215,6 +13285,30 @@ async function pipelineInner(job, opts = {}) {
           note(`recall: ${silent.lost.length} position(s) the digest ended as FINDINGS reached no client `
             + `surface and no step said why — ${silent.lost.map((l) => `${l.mark ?? l.uri} (${l.reason})`).join("; ")}`);
         }
+        // ── AND THE STATED CASE, WHICH IS THE ONE THAT REACHED A CLIENT (tracker issue 248) ────────
+        //
+        // Same inputs, same seam, same best-effort contract — a second call rather than a widened first
+        // one, because the sibling's population boundary is deliberate and correct. It covers a
+        // finding-ending followed by SILENCE; this covers one followed by a SENTENCE.
+        //
+        // On a delivered R2 run the sibling logged `checked:5 matched:5 lost:0` — correctly — on a
+        // delivery missing two marks from the lawyer's final list, one rated HIGH. They were dropped with
+        // a reason, so they were outside its population by design. A drop with a reason nobody verifies
+        // is not accounted for; it is unexamined with a paper trail, and that delivery carried 66 of them.
+        const stated = statedDivergenceFindings({
+          reconciliation: safeReadJson(P.recallReconciliation),
+          carryRows: safeReadJson(P.recordCarry)?.rows ?? null,
+          digestFindingUris: recordedFindingUris(P.runDir),
+        });
+        runLog(P.runDir, { event: "stated-divergence-findings", computable: stated.computable,
+          reason: stated.reason, population_empty: stated.population_empty === true,
+          checked: stated.checked, matched: stated.matched, diverged: stated.diverged.length,
+          marks: stated.diverged.map((d) => d.mark).filter(Boolean).slice(0, 10) });
+        if (stated.diverged.length) {
+          note(`recall: ${stated.diverged.length} position(s) the digest ended as FINDINGS are absent from `
+            + "the findings and were dropped with a STATED reason pointing at another artifact — "
+            + stated.diverged.map((d) => `${d.mark ?? d.uri} (${d.reason}${d.cites_artifact ? ` → ${d.cites_artifact.join(", ")}` : ""})`).join("; "));
+        }
       } catch (e) { /* never mask a delivery */ }
       // — the common-law path, and the jx zh slice on the same tracer. `consumed` used to read
       // CLEAROTRON_JX_CONSUME, which decided whether a zh candidate could reach a finding at all: with it
@@ -13486,6 +13580,21 @@ async function pipelineInner(job, opts = {}) {
                 const askApplied = applyAskClosure(runAsks, acc.ask, fileTexts, { ts: askTs });
                 runAsks = askApplied.asks;
                 for (const u of askApplied.unverified) runLog(run.runDir, { event: "ask-closure-unverified", ...u });
+                // Option A (tracker issue 246): a recall ask whose mark is not in the delivered findings
+                // did NOT close. Each one is a mark the run found and the client was not shown, so it is
+                // recorded by name rather than left to be inferred from an ask that merely stayed open.
+                // ✕ NOT written into findings.json here. See the sidecar's own note: a row appended after
+                // the drafting stage would carry no band and no reasoning.
+                for (const c of askApplied.carryIntoFindings ?? [])
+                  runLog(run.runDir, { event: "ask-closure-mark-owed", ...c });
+                if (askApplied.carryIntoFindings?.length)
+                  writeFileSync(driverDir(run.runDir, "marks-owed-a-finding.json"),
+                    JSON.stringify({
+                      _provenance: "recall asks that could not close because the mark they found is absent from findings.json — owner ruling 2026-09-07, tracker issue 246 Option A, worded about the MARK",
+                      _notWritten: "these are NOT appended to findings.json: a finding carries a band, a net line and a legal position, and a row minted here would carry none of them. The repair belongs where the findings are authored.",
+                      count: askApplied.carryIntoFindings.length,
+                      marks: askApplied.carryIntoFindings,
+                    }, null, 2) + "\n");
               }
             } else {
               note(`doubt-closure failed (non-fatal — the open doubts/asks ship OPEN, as without the stage): ${dc.fail}`);
@@ -15481,6 +15590,17 @@ export async function runExperiment(job, opts) {
     // what RAN.
     engine: experimentEngineName(),
     modelTier: model ?? null,
+    // — THE RATING AUTHORITY THIS ARM RAN UNDER, on the arm's own record.
+    //
+    // `whatIfRun` resolves this correctly and returned it in memory only: nothing in the experiment
+    // directory named the profile it rated under, so a reader coming to the arm tomorrow could not
+    // confirm which framework produced it, and a future regression would be as silent as the one this
+    // was opened on. The frozen sidecar is the authority — never a fresh resolve, which is the mid-run
+    // drift the freeze exists to forbid.
+    //
+    // `null` means the run carries no frozen profile (a legacy run), and it is written rather than
+    // omitted: absent and "there was none" are different facts and only one of them is a defect.
+    ratedUnder: ctx.profile?.profileKey ?? null,
     dispatchTrigger: opts.dispatchTrigger ?? "fresh",
     // — WHICH PASS THIS ARM REPRODUCED, in a word. null on a non-corrective arm;
     // never "dispatched-warm", which is production's alone.

package/driver/predelivery-lint.mjs

@@ -701,7 +701,7 @@ export function competitorClaimChecks({ text, ownerScreen, recordsByUri, markVoc
 // ── COVERAGE CLAIMS IN PROSE vs WHAT THE RUN ACTUALLY SEARCHED (tracker issue 134) ──────────────────
 //
 // THE DEFECT. `coverage_line:` is code-stamped from scope-facts.json; the narrative is model-written
-// prose. Nothing bound them to one searched-territory set. On `amber-summit` the masthead read
+// prose. Nothing bound them to one searched-territory set. On one recorded run the masthead read
 // `registers: JP, WO` while the narrative said "Register searches covered Japan and Korea" — one of
 // them was wrong and nothing detected it until a human compared the two surfaces by eye. They agree
 // on today's runs because a prompt fix stopped the input contradicting itself, which is evidence the
@@ -2454,6 +2454,13 @@ export function flagLines(failures) {
 // vendor vocabulary, no ids, no paths, no field names, no instructions to whoever regenerates the run,
 // never "certified"/"signed". deliveryVocabViolations() below enforces that mechanically.
 const DELIVERY_LINES = {
+  // Keyed on the FULL check id, which deliveryFlagLines resolves before the base — see the note there.
+  // The sentence states the CONSEQUENCE, in the receipt's own terms: not "a check failed" but "the rule
+  // was applied to nothing". Eleven graded runs delivered carrying this, two of them orderable product
+  // demos, and the only place it was written was one row of a fifty-odd-row receipt nobody routes.
+  "narrative-write-ups:could-not-read":
+    "The depth rules for the written-up findings were applied to nothing on this run — the narrative "
+    + "carries no block this check can read, so neither the ranking cut nor the length cap was verified.",
   // template — the summary table against the names actually searched
   "names-cell-populated": "The summary table does not name the mark that was searched.",
   "assessment-row": "A searched name has no assessment of its own in the summary table.",
@@ -2555,15 +2562,26 @@ export function deliveryVocabViolations(line) {
 export function deliveryFlagLines(failures) {
   const groups = new Map();
   for (const f of failures ?? []) {
-    const base = String(f?.id ?? "").split(":")[0];
+    const id = String(f?.id ?? "");
+    const base = id.split(":")[0];
     const family = String(f?.family ?? "");
-    const key = base || `family/${family}`;
-    const g = groups.get(key) ?? { base, family, n: 0 };
+    // A CHECK WHOSE DISTINCTION LIVES IN ITS SUFFIX COULD NOT BE SAID HERE (tracker issue 267).
+    //
+    // Grouping on `base` alone is right for the common case — a word-cap violation on nine write-ups is
+    // one delivery line, not nine. But it also collapsed `narrative-write-ups:could-not-read` into the
+    // same bucket as an ordinary depth violation, and those are different facts: one says a rule was
+    // broken, the other says the rule was ENFORCED ON NOTHING. The second had no sentence of its own to
+    // reach, so it degraded to the generic "a machine check did not pass" and became invisible.
+    //
+    // So: an entry keyed on the FULL id wins where one exists, and everything else groups by base
+    // exactly as before. This adds no line to any run that did not already produce one.
+    const key = DELIVERY_LINES[id] ? id : (base || `family/${family}`);
+    const g = groups.get(key) ?? { base, family, id: DELIVERY_LINES[id] ? id : null, n: 0 };
     g.n += 1;
     groups.set(key, g);
   }
   return [...groups.values()].map((g) => {
-    const sentence = DELIVERY_LINES[g.base] ?? DELIVERY_FAMILY_LINES[g.family] ?? DELIVERY_GENERIC;
+    const sentence = (g.id && DELIVERY_LINES[g.id]) ?? DELIVERY_LINES[g.base] ?? DELIVERY_FAMILY_LINES[g.family] ?? DELIVERY_GENERIC;
     // Belt and braces: a table entry that trips the house rules degrades to the generic instead of
     // shipping. This is what makes "no engine vocabulary reaches a reader" structural rather than a
     // matter of everyone remembering the rule when they add a check.

package/driver/publish/knockout.mjs

@@ -68,9 +68,13 @@ export const knockoutStatement = (framework, marks) =>
 // 11pt, no <!DOCTYPE>, no <head>, no <meta charset> — and they rendered a Depth 2 report as a grey
 // spreadsheet with the register hit-counts the customer paid for buried in a table cell. The report now
 // renders through publish/render-knockout.mjs in the product's own design language, off the same shared
-// stylesheet and brand tokens as the clearance report. Internal working material (the purple staff notes,
-// the model's registerEstimate) is not stripped from the report — it is not IN the report; it lives in
-// the audit workbook, which is what an internal artifact is for.
+// stylesheet and brand tokens as the clearance report.
+//
+// THE REVIEWER'S NOTES ARE ON THE REPORT SINCE 2026-09-07 (owner ruling, tracker issue 274). This
+// paragraph used to end "internal working material (the purple staff notes, the model's registerEstimate)
+// is not IN the report; it lives in the audit workbook". That is now true of `registerEstimate` only: the
+// notes render on the page, labelled, and the workbook keeps its copy. See render-knockout.mjs's header
+// for the ruling and reviewerNotesBlock for the shape.
 
 // ── The workbook: the skill's three sheet names + columns, plus the conditional sheets below ────────
 // ── ONE DRILL-THROUGH KEY: `<MARK> #<ordinal>`, per mark ──────────────────────────────────────
@@ -250,9 +254,11 @@ export async function buildKnockoutWorkbook(findings, receipts, outPath, registe
 // ── The email: a COVER NOTE. Headline band, one line per mark, the report link. Nothing else. ────────
 // The report is the deliverable and the email points at it — the same doctrine the clearance lane
 // follows. The old `delivery.email === 'table'` overlay inlined the full review table into the mail
-// body, and it inlined the INTERNAL variant: purple staff notes and the model's register estimate went
-// out over the wire to whoever the mail reached. A second rendering of the findings in a second dialect
-// is also a second thing to keep true. Per-lawyer client formatting is drafted by the assistant from the
+// body, which put the findings in front of whoever the mail reached rather than whoever opened the
+// report, and made a second rendering of them in a second dialect — a second thing to keep true.
+// (That overlay's other charge, that it shipped an INTERNAL variant, no longer describes anything: the
+// 2026-09-07 ruling put the reviewer's notes on the one report. The reason above is the load-bearing one
+// and it is unaffected — the mail stays a cover note.) Per-lawyer client formatting is drafted by the assistant from the
 // run's report-data.json, not by a template knob in here.
 // `reports` is publishKnockout's own list — `[{mark, url}]`, one per published document — and
 // `auditUrl` is composed by the publisher from the pool URL it already holds. Neither is derived here.