clearotron 0.2.0 → 0.3.0-beta.0

package/driver/register-digest-record.mjs

@@ -168,6 +168,36 @@ const FINDING_COLUMNS = Object.freeze(
 // finding it there together with screen_verdict / class / status.
 const NEGATIVE_COLUMNS = Object.freeze(["Mark", "Search Term / Variant", "Result", "Notes"]);
 
+/**
+ * The "Mark" cell for one Negative-results row.
+ *
+ * A `duplicate-of-surfaced` row is not a statement about the MARK. It is a statement about one
+ * registration of a mark whose position is already reported above it — the digest's own rule is "one
+ * row per POSITION, never one per registration of the same right". Printing the bare mark under a
+ * column headed "Mark" says the opposite of what the row means, and the document then reads as both
+ * "keep this mark, here is the reasoning" in the incumbent table and "no separate row for this mark"
+ * here. Nine readers scan this file, and one of them is the drafting seat that decides what the client
+ * is shown.
+ *
+ * Naming the record removes the contradiction and changes no judgment the digest made: the row is
+ * still a drop, still on the same ground, still carrying the seat's own reason.
+ *
+ * ✕ EVERY OTHER GROUND IS LEFT ALONE, deliberately. `off-field`, `dead-status` and `out-of-class` are
+ * about the record on its own terms, where the bare mark is what a reader wants and is not ambiguous.
+ * A blanket change to this column would touch every negative row in every report for a defect that
+ * only exists on the duplicate class.
+ *
+ * The office comes from the record uri (`/mark/wo/…` -> `WO`); every uri in the archived corpus carries
+ * a two-letter office in that position. When it cannot be read the BARE MARK is printed rather than a
+ * broken qualifier — a missing qualifier is a smaller defect than "OSLER DELPHI — UNDEFINED record".
+ */
+export function negativeMarkCell(row) {
+  const mark = String(row?.cells?.mark ?? "").trim();
+  if (row?.ground !== "duplicate-of-surfaced" || !mark) return mark;
+  const office = String(row?.cells?.uri ?? "").split("/")[2] ?? "";
+  return /^[a-z]{2}$/i.test(office) ? `${mark} \u2014 ${office.toUpperCase()} record` : mark;
+}
+
 // ── THE FLOOR, AND WHAT ITS ZERO MEANS ────────────────────────────────────────────────────────────
 //
 // `validators.registerFindings` carried `nonEmpty(c)` with no character number, so there is no
@@ -353,7 +383,7 @@ export function renderRegisterFindings(model, facts = emptyFacts()) {
   out.push(DIGEST_SECTIONS.negative, "");
   out.push(model.negative_rows.length
     ? table(NEGATIVE_COLUMNS, model.negative_rows.map((r) => [
-      r.cells.mark, r.variant || r.cells.mark, r.drop_reason,
+      negativeMarkCell(r), r.variant || r.cells.mark, r.drop_reason,
       [`URI ${r.cells.uri}`, r.screen_verdict ? `screen_verdict=${r.screen_verdict}` : "",
         r.cells.classes ? `class=${r.cells.classes}` : "", r.cells.status ? `status=${r.cells.status}` : ""]
         .filter(Boolean).join("; "),

package/driver/repairs.mjs

@@ -555,7 +555,7 @@ export function countRecoveryLanes(history, { total = 0 } = {}) {
 
 // ── CAP PARKS: A PROVIDER SAYING "NOT YET" IS NOT A STAGE FAILING (tracker issue 103) ──────────────
 //
-// Owner, watching indigo-falcon spend 4 of its 6 recovery parks against one subscription cap:
+// Owner, watching a run spend 4 of its 6 recovery parks against one subscription cap:
 //
 //   "surely it can work out when the cap expires and try after that time and not just keep trying
 //    and then die."

package/driver/result-noun-fields.mjs

@@ -95,6 +95,13 @@ export const RESULT_NOUN_FIELDS = Object.freeze([
   { file: "driver/skills-store-provenance.mjs", noun: "outcome", sites: 6, atWriteSite: 0, verdict: "out-of-scope" },
   { file: "driver/status-snapshot.mjs", noun: "outcome", sites: 1, atWriteSite: 0, verdict: "out-of-scope" },
   { file: "mcp-server/lib/events.mjs", noun: "recovered", sites: 1, atWriteSite: 0, verdict: "out-of-scope" },
+  // Read at the writing site, as this table requires. All three sites are in `knockoutSearches`, a
+  // READ-ONLY projection that composes the rows `list_searches` answers with: it opens no artifact and
+  // writes nothing, so nothing here can reach `_driver/*.json` or `run.jsonl`. Each value is a literal
+  // chosen from the run's own stored record — "found" or "no-hit" from whether the mark has findings,
+  // and "recorded" for a register term whose stored row says it did NOT answer. None is a call's return
+  // read back as a verdict, which is the defect this table exists to find.
+  { file: "mcp-server/lib/knockout.mjs", noun: "outcome", sites: 3, atWriteSite: 0, verdict: "out-of-scope" },
   { file: "mcp-server/lib/ops.mjs", noun: "settled", sites: 1, atWriteSite: 0, verdict: "out-of-scope" },
   { file: "mcp-server/server.mjs", noun: "outcome", sites: 1, atWriteSite: 0, verdict: "out-of-scope" },
   { file: "scripts/backfill-started-at.mjs", noun: "outcome", sites: 5, atWriteSite: 0, verdict: "out-of-scope" },

package/driver/skills/knockout-assess/SKILL.md

@@ -162,9 +162,14 @@ your job. These two fields are how what you concluded reaches the reader instead
 every id against that store and refuses one it does not hold — so the report can state a filing's
 source as a fact rather than as a word you typed about your own sourcing.
 
-- **`registerReads`** — on the MARK. Rows of `{recordId, read}` for a filing you weighed that did **not**
-  become a `findings[]` record. `read` is what you concluded about *that* filing: whether it bears on the
-  rating, and why. It prints on that filing's card.
+- **`registerReads`** — on the MARK. Rows of `{recordId, read, band?}` for a filing you weighed that did
+  **not** become a `findings[]` record. `read` is what you concluded about *that* filing: whether it bears
+  on the rating, and why. It prints on that filing's card. `band` is **optional** and is how you rate that
+  filing on its own — in the framework's band words, the same vocabulary as the mark's rating. Send it
+  whenever you formed a view on the filing itself: a registered right is often the one hard legal fact on
+  the page, and with no band its card is the only one carrying no rating while softer uses around it carry
+  one, which reads as though the registration mattered least. Omit it and the read still prints, claiming
+  no rating.
 - **`weighedFilings`** — on a FINDING. The `recordId`s whose evidence your reasoning for that conflict
   actually used. The report derives the finding's source labelling from this, so list one only if you
   reasoned from it.
@@ -205,7 +210,8 @@ line, which describes the card and claims nothing about the rating. So:
                "classesDriving": [8], "bullets": ["..."], "purpleNotes": ["..."],
                "registerEstimate": "...", "parodyNote": null, "crowdedField": false,
                "registerReads": [ { "recordId": "<verbatim from the filings you were given>",
-                                    "read": "<what you concluded about THAT filing>" } ],
+                                    "read": "<what you concluded about THAT filing>",
+                                    "band": "<OPTIONAL — your rating of THAT filing, in the ladder's words>" } ],
                "basis": "<ONE sentence: why this band, for this name, in these classes>",
                "factors": ["<2-4 load-bearing observations, one line each>"],
                "counterFactors": ["<1-3: what holds it at this band rather than the next>"],

package/driver/stages-knockout.mjs

@@ -301,7 +301,7 @@ export const KO_STAGES = {
       // a finding with no register evidence. Omitting either field is always safe: the card keeps its
       // neutral line, which describes the card and is true.
       existsSync(K.registerRecords)
-        ? `WHEN YOU WEIGH ONE OF THOSE FILINGS, SAY SO BY ITS OWN ID — copy "recordId" verbatim from the file above. "registerReads" on the MARK: rows of {recordId, read} for a filing you weighed that did NOT become a findings[] record; "read" is what you concluded about THAT filing — whether it bears on the rating and why — and it prints on that filing's card in the reader's own report. "weighedFilings" on a FINDING: the recordIds whose evidence your reasoning for that conflict actually used, because the report derives that finding's source labelling from it. Both are optional and both are joined against the filings you were given, so an id we do not hold is refused by name. A filing you did not weigh simply gets no row: do not invent a read to fill one, and never write "not weighed" as a read.`
+        ? `WHEN YOU WEIGH ONE OF THOSE FILINGS, SAY SO BY ITS OWN ID — copy "recordId" verbatim from the file above. "registerReads" on the MARK: rows of {recordId, read, band?} for a filing you weighed that did NOT become a findings[] record; "read" is what you concluded about THAT filing — whether it bears on the rating and why — and it prints on that filing's card in the reader's own report. "band" is OPTIONAL and is your rating of THAT filing on its own, in the framework's band words: send it whenever you formed a view on the filing itself, because a registered right left unbanded is the only card on the page with no rating while softer uses beside it carry one, which reads as though the registration mattered least. Omit it and your read still prints, claiming no rating. "weighedFilings" on a FINDING: the recordIds whose evidence your reasoning for that conflict actually used, because the report derives that finding's source labelling from it. Both are optional and both are joined against the filings you were given, so an id we do not hold is refused by name. A filing you did not weigh simply gets no row: do not invent a read to fill one, and never write "not weighed" as a read.`
         : "",
       `A DEGRADED mark's row must carry degraded:true and the purple "Manual verification recommended"`,
       `note; a mark WITH a payload must never claim degraded (the validator joins both against the disk).`,

package/driver/stages.mjs

@@ -3267,7 +3267,7 @@ export const STAGES = {
       `DECLINATIONS: what you do not deliver, you decline BY NAME through the \`record_declination\` tool. A record that reached your findings surface leaves this stage as a finding in ${P.findings} or as a declination, and there is no third way out.`,
       ...(Array.isArray(findingsSurface) && findingsSurface.length ? [
         `DECLINATIONS (MANDATORY): the register digest carried ${findingsSurface.length} record(s) onto your findings surface. Each one leaves this stage by one of two routes and there is no third: it becomes a finding in ${P.findings}, or you decline it BY NAME with a reason and a ground. A record you simply do not mention is reported as a defect of this run, named individually in its trace and shipped as an open doubt, so silence costs you more than a declination ever will.`,
-        `Decline by calling the \`record_declination\` tool. Its schema names the fields it takes and what each is for — read them there, not here. The one thing to know before you call: you cite a record by its POSITION in the list below — there is no field for a mark name or a uri, so a record you were not handed cannot be expressed at all. The reason vocabulary is closed: ${DECLINATION_REASON_TOKENS.join(" / ")}, each an omission synthesis-rules.md already authorises, and if your ground is none of them the rules do not let you omit the record. The grounds you write are one or two lines in your OWN words on why THIS record does not earn a line — never machine-parsed, and what the reviewing lawyer reads. Send them in one batch where you can; a refused row never voids its neighbours, and the answer names what is still undecided so you can finish in this turn.`,
+        `Decline by calling the \`record_declination\` tool. Its schema names the fields it takes and what each is for — read them there, not here. The one thing to know before you call: you cite a record by its POSITION in the list below — there is no field for a mark name or a uri, so a record you were not handed cannot be expressed at all. The reason vocabulary is closed: ${DECLINATION_REASON_TOKENS.join(" / ")}, each an omission synthesis-rules.md already authorises, and if your ground is none of them the rules do not let you omit the record. ONE OF THEM IS NOT AVAILABLE ON A LIVE RECORD IN AN INSTRUCTED CLASS: \`not-worth-the-line\` is a statement about the report's budget rather than about the mark, and a live registration inside one of the matter's own classes is never omitted for want of room — carry it, or decline it on something true of THAT MARK. The call is refused if you try, so it costs you a turn. The grounds you write are one or two lines in your OWN words on why THIS record does not earn a line — never machine-parsed, and what the reviewing lawyer reads. Send them in one batch where you can; a refused row never voids its neighbours, and the answer names what is still undecided so you can finish in this turn.`,
         `A REFUSAL FROM THAT TOOL IS ABOUT BOOKKEEPING, NEVER ABOUT YOUR LEGAL JUDGMENT. There is exactly ONE case: declining a mark IDENTICAL to the applied-for mark, live, in one of the matter's own filed classes, on a discretionary ground — because synthesis-rules.md orders that an on-point identical mark in the relevant class is never dropped, "regardless of filer profile", so such a declination contradicts the instruction you are already following. Nothing else is refused. If that record really is the applicant's own, or already delivered under another record, say exactly that with own-right or duplicate-of-delivered and it is accepted. Whether goods are related, whether a name is off-field, whether a conflict is worth the line — those are your calls and the tool does not have an opinion about any of them.`,
         `The records on your findings surface, by position:`,
         ...findingsSurface.map((r, i) => `  ${i}. ${r.mark ?? "(unnamed)"}${r.owner ? ` — ${r.owner}` : ""}${r.tier ? ` [${r.tier}]` : ""}${r.uri ? ` ${r.uri}` : ""}`),

package/driver/suite-census.json

@@ -189,6 +189,12 @@
           "skips": 1,
           "todos": 0
         },
+        "a-door-that-is-not-there-is-not-a-door-that-agrees.test.mjs": {
+          "tests": 19,
+          "asserts": 69,
+          "skips": 0,
+          "todos": 0
+        },
         "a-doubt-cannot-answer-itself.test.mjs": {
           "tests": 17,
           "asserts": 40,
@@ -201,6 +207,18 @@
           "skips": 0,
           "todos": 0
         },
+        "a-drop-with-a-stated-reason-is-checked.test.mjs": {
+          "tests": 13,
+          "asserts": 32,
+          "skips": 0,
+          "todos": 0
+        },
+        "a-dynamic-import-of-a-path-is-a-file-url.test.mjs": {
+          "tests": 3,
+          "asserts": 6,
+          "skips": 1,
+          "todos": 0
+        },
         "a-fact-about-a-named-party.test.mjs": {
           "tests": 30,
           "asserts": 80,
@@ -286,8 +304,8 @@
           "todos": 0
         },
         "a-memo-over-a-delivered-report-leaves-it-alone.test.mjs": {
-          "tests": 9,
-          "asserts": 45,
+          "tests": 13,
+          "asserts": 52,
           "skips": 0,
           "todos": 0
         },
@@ -375,9 +393,15 @@
           "skips": 0,
           "todos": 0
         },
-        "a-real-install-starts-with-an-empty-archive.test.mjs": {
+        "a-queued-what-if-is-answered-before-its-run-archives.test.mjs": {
           "tests": 3,
-          "asserts": 8,
+          "asserts": 12,
+          "skips": 0,
+          "todos": 0
+        },
+        "a-real-install-starts-with-an-empty-archive.test.mjs": {
+          "tests": 6,
+          "asserts": 16,
           "skips": 0,
           "todos": 0
         },
@@ -483,6 +507,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-screenshot-of-an-error-page-is-not-a-report.test.mjs": {
+          "tests": 21,
+          "asserts": 55,
+          "skips": 4,
+          "todos": 0
+        },
         "a-secret-file-is-compared-not-printed.test.mjs": {
           "tests": 5,
           "asserts": 16,
@@ -501,6 +531,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-shared-proprietor-is-not-a-bucket-collision.test.mjs": {
+          "tests": 6,
+          "asserts": 14,
+          "skips": 0,
+          "todos": 0
+        },
         "a-signal-immune-fixture-is-reaped-by-its-owner.test.mjs": {
           "tests": 10,
           "asserts": 20,
@@ -543,6 +579,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-unit-is-attributed-by-what-it-runs-not-only-by-what-it-declares.test.mjs": {
+          "tests": 10,
+          "asserts": 27,
+          "skips": 0,
+          "todos": 0
+        },
         "a-verb-is-a-module-until-it-is-the-command.test.mjs": {
           "tests": 3,
           "asserts": 8,
@@ -676,8 +718,8 @@
           "todos": 0
         },
         "an-experiment-receipt-names-its-engine.test.mjs": {
-          "tests": 6,
-          "asserts": 22,
+          "tests": 8,
+          "asserts": 27,
           "skips": 0,
           "todos": 0
         },
@@ -687,12 +729,24 @@
           "skips": 1,
           "todos": 0
         },
+        "an-observed-model-id-says-whether-it-is-pinned.test.mjs": {
+          "tests": 4,
+          "asserts": 10,
+          "skips": 0,
+          "todos": 0
+        },
         "an-ordered-field-is-a-field-the-tool-can-express.test.mjs": {
           "tests": 1,
           "asserts": 6,
           "skips": 0,
           "todos": 0
         },
+        "an-unread-probe-is-not-a-failed-measurement.test.mjs": {
+          "tests": 5,
+          "asserts": 11,
+          "skips": 0,
+          "todos": 0
+        },
         "anchor-and-script-aware-quote.test.mjs": {
           "tests": 12,
           "asserts": 40,
@@ -724,8 +778,8 @@
           "todos": 0
         },
         "ask-ledger.test.mjs": {
-          "tests": 21,
-          "asserts": 100,
+          "tests": 26,
+          "asserts": 119,
           "skips": 0,
           "todos": 0
         },
@@ -1324,8 +1378,8 @@
           "todos": 0
         },
         "declination-is-stated-not-inferred.test.mjs": {
-          "tests": 20,
-          "asserts": 60,
+          "tests": 24,
+          "asserts": 69,
           "skips": 0,
           "todos": 0
         },
@@ -1373,7 +1427,7 @@
         },
         "deployment-hostnames.test.mjs": {
           "tests": 13,
-          "asserts": 37,
+          "asserts": 36,
           "skips": 0,
           "todos": 0
         },
@@ -1882,8 +1936,8 @@
           "todos": 0
         },
         "example-replay.test.mjs": {
-          "tests": 6,
-          "asserts": 24,
+          "tests": 8,
+          "asserts": 31,
           "skips": 0,
           "todos": 0
         },
@@ -2433,6 +2487,12 @@
           "skips": 2,
           "todos": 0
         },
+        "no-run-codenames-in-tracked-files.test.mjs": {
+          "tests": 6,
+          "asserts": 13,
+          "skips": 4,
+          "todos": 0
+        },
         "no-test-writes-inside-the-checkout.test.mjs": {
           "tests": 16,
           "asserts": 35,
@@ -2826,7 +2886,7 @@
         "production-dependencies.test.mjs": {
           "tests": 4,
           "asserts": 7,
-          "skips": 0,
+          "skips": 3,
           "todos": 0
         },
         "products.test.mjs": {
@@ -2964,7 +3024,7 @@
         "reading-the-demo-does-not-edit-the-repository.test.mjs": {
           "tests": 2,
           "asserts": 8,
-          "skips": 0,
+          "skips": 1,
           "todos": 0
         },
         "reason-cut-is-visible.test.mjs": {
@@ -3076,8 +3136,8 @@
           "todos": 0
         },
         "reference-score-owner-identity.test.mjs": {
-          "tests": 9,
-          "asserts": 30,
+          "tests": 10,
+          "asserts": 34,
           "skips": 0,
           "todos": 0
         },
@@ -3137,7 +3197,7 @@
         },
         "register-count.test.mjs": {
           "tests": 20,
-          "asserts": 145,
+          "asserts": 148,
           "skips": 0,
           "todos": 0
         },
@@ -3160,8 +3220,8 @@
           "todos": 0
         },
         "register-digest-record.test.mjs": {
-          "tests": 30,
-          "asserts": 102,
+          "tests": 32,
+          "asserts": 114,
           "skips": 0,
           "todos": 0
         },
@@ -3238,8 +3298,8 @@
           "todos": 0
         },
         "release-pipeline.test.mjs": {
-          "tests": 52,
-          "asserts": 243,
+          "tests": 87,
+          "asserts": 334,
           "skips": 0,
           "todos": 0
         },
@@ -3856,8 +3916,8 @@
           "todos": 0
         },
         "start-background-units.test.mjs": {
-          "tests": 6,
-          "asserts": 20,
+          "tests": 9,
+          "asserts": 26,
           "skips": 0,
           "todos": 0
         },
@@ -4252,8 +4312,8 @@
           "todos": 0
         },
         "the-narrative-is-checked-against-its-depth-rules.test.mjs": {
-          "tests": 15,
-          "asserts": 55,
+          "tests": 19,
+          "asserts": 70,
           "skips": 0,
           "todos": 0
         },
@@ -4335,6 +4395,12 @@
           "skips": 0,
           "todos": 0
         },
+        "the-reference-strip-left-sentences-unfinished.test.mjs": {
+          "tests": 6,
+          "asserts": 13,
+          "skips": 3,
+          "todos": 0
+        },
         "the-repair-order-and-the-tool-schema-agree.test.mjs": {
           "tests": 6,
           "asserts": 27,
@@ -4347,6 +4413,12 @@
           "skips": 1,
           "todos": 0
         },
+        "the-report-carries-what-the-assessment-wrote.test.mjs": {
+          "tests": 10,
+          "asserts": 41,
+          "skips": 0,
+          "todos": 0
+        },
         "the-report-shell-keeps-what-a-repair-does-not-resend.test.mjs": {
           "tests": 6,
           "asserts": 28,
@@ -4690,8 +4762,8 @@
           "todos": 0
         },
         "verify-knockout.test.mjs": {
-          "tests": 1,
-          "asserts": 5,
+          "tests": 2,
+          "asserts": 11,
           "skips": 0,
           "todos": 0
         },
@@ -4922,6 +4994,12 @@
           "skips": 0,
           "todos": 0
         },
+        "knockout-audit-tools.test.mjs": {
+          "tests": 16,
+          "asserts": 73,
+          "skips": 0,
+          "todos": 0
+        },
         "lexsearch.test.mjs": {
           "tests": 5,
           "asserts": 11,
@@ -5043,8 +5121,8 @@
           "todos": 0
         },
         "whatif.test.mjs": {
-          "tests": 9,
-          "asserts": 29,
+          "tests": 10,
+          "asserts": 32,
           "skips": 0,
           "todos": 0
         }

package/driver/unit-inventory.mjs

@@ -641,6 +641,53 @@ export function unitInventoryVerdict({
  * @param {string|null} raw  the value `systemctl show -p WorkingDirectory` printed
  * @returns {{path: string|null, prefixes: string, why: string|null}}
  */
+/**
+ * Which checkout is a unit actually serving — and which piece of evidence said so.
+ *
+ * A unit can be attributed two ways and they are not equally good.
+ *
+ * `WorkingDirectory` is a DECLARATION. It is what the unit file asks for, and it is frequently not a
+ * checkout at all: a unit written as `WorkingDirectory=~` reports `!/home/<user>`, which resolves to a
+ * home directory that is not a git tree, and the unit then drops out of the comparison entirely. That is
+ * not a rare shape — it is what a unit looks like when its author put the checkout in `ExecStart=`
+ * instead, which is the normal thing to do, because systemd cannot expand a variable in
+ * `WorkingDirectory=` and can in `ExecStart=`.
+ *
+ * The RUNNING COMMAND LINE is an OBSERVATION: the absolute path the live process was actually started
+ * with. So it wins, and that order is the point rather than a preference. The incident this comparison
+ * exists for is a deployment that served its portal from one clone while running its runner from
+ * another — and in that state the declaration and the process disagree, with the process telling the
+ * truth. Preferring the declaration would take the wrong side of exactly the case the check is for.
+ *
+ * WHEN BOTH RESOLVE AND DISAGREE, that IS the finding, and it is returned rather than quietly resolved:
+ * a unit whose declared tree and running tree differ has been repointed since it started, and it is
+ * serving the older one until something restarts it.
+ *
+ * PURE — the caller does the reading (systemd, the unit file, the process table) and this decides.
+ *
+ * @param {object} a
+ * @param {string|null} a.declaredTree  a git tree resolved from `WorkingDirectory`, or null
+ * @param {string|null} a.runningTree   a git tree resolved from the live process's argv, or null
+ * @param {string|null} a.declaredWhy   why the declaration gave nothing, if it gave nothing
+ * @param {string|null} a.runningWhy    why the process gave nothing, if it gave nothing
+ * @returns {{clone: string|null, source: string|null, disagreement: string|null, why: string|null}}
+ */
+export function unitClone({ declaredTree = null, runningTree = null, declaredWhy = null, runningWhy = null } = {}) {
+  const norm = (p) => String(p ?? "").replace(/\/+$/, "") || null;
+  const declared = norm(declaredTree);
+  const running = norm(runningTree);
+  const disagreement = declared && running && declared !== running
+    ? `the unit declares ${declared} and its running process was started from ${running} — it is serving the second until something restarts it`
+    : null;
+  if (running) return { clone: running, source: "the running command line", disagreement, why: null };
+  if (declared) return { clone: declared, source: "WorkingDirectory", disagreement, why: null };
+  // BOTH REASONS, never the first one that came to hand. A caller that reports only "no WorkingDirectory"
+  // sends the next reader to fix a unit file when the process table was the half that could not be read.
+  const parts = [declaredWhy, runningWhy].filter(Boolean);
+  return { clone: null, source: null, disagreement: null,
+    why: parts.length ? parts.join("; and ") : "neither the unit's WorkingDirectory nor its running command line named a checkout" };
+}
+
 export function unitWorkingDirectory(raw) {
   const s = String(raw ?? "").trim();
   if (!s) return { path: null, prefixes: "", why: "the unit reported no WorkingDirectory" };

package/driver/unit-state-verdict.mjs

@@ -14,9 +14,9 @@
 //
 // Anything that is neither `active` nor `inactive` is a fault. `prelim-driver` is a `Type=oneshot` fired
 // by a 90-second timer, so EVERY drain passes through `activating` — and `activating` landed in that
-// list. The filter tolerated the oneshot at rest and failed it for working. deploy-test.sh gates the
-// hourly test-instance deploy on this script's exit code, so a deploy that happened to land inside a
-// drain window reported the instance unhealthy and exited 1 on a deployment that was fine.
+// list. The filter tolerated the oneshot at rest and failed it for working. The hourly test-instance
+// deploy gates on this script's exit code, so a deploy that happened to land inside a drain window
+// reported the instance unhealthy and exited 1 on a deployment that was fine.
 //
 // The bug is not the enumeration — was right to give this three outcomes instead of two. The bug is
 // INVERSE ENUMERATION over an incomplete vocabulary: listing the two states you have seen and calling
@@ -39,7 +39,7 @@
 // The ruling on says "starting and stopping are both tolerated for a one-shot". That is descriptive
 // of the case that was observed, not a restriction: the issue's own Scope section carries no unit-type
 // qualifier, the arm has never been unit-type-aware, and it already tolerates `inactive` for everything.
-// It is also the wrong place to draw the line — deploy-test.sh RESTARTS the long-running services
+// It is also the wrong place to draw the line — the hourly deploy RESTARTS the long-running services
 // immediately before running this check, so `trademark-portal=activating` is the same race with a
 // different unit, and a oneshot-only fix would leave it standing. The unit's Type is still carried into
 // the message so a reader can tell a oneshot mid-fire from a service mid-restart.
@@ -63,9 +63,9 @@
 // This is not caution for its own sake. An earlier draft of this fix also widened the count to treat
 // transitional units as up, on the reasoning that a oneshot mid-fire is "not nothing". The consequence:
 // {5 services activating, 3 inactive} returned `pass` with a message that began "0 active" — a green
-// tick on the deploy's final gate having confirmed that ZERO services were running. deploy-test.sh
+// tick on the deploy's final gate having confirmed that ZERO services were running. The hourly deploy
 // restarts the long-running services immediately before running this check, so that is the ordinary
-// shape of the box, not a corner. Widening a count to make a message read better is how a guard dies.
+// shape of the instance, not a corner. Widening a count to make a message read better is how a guard dies.
 
 /** The six documented ActiveState values of systemd 255, mapped to what the check must do about them. */
 export const ACTIVE_STATE_MEANING = Object.freeze({
@@ -134,8 +134,8 @@ export function unitsActiveVerdict({ units, probe }) {
   // CHANGES NOTHING HERE. The count below is origin/main's, predicate and message unchanged:
   // `active`, literally, and nothing else. An earlier draft of this fix widened it to count
   // transitional units as up, which defeated this guard outright — {5 activating, 3 inactive} then
-  // returned `pass` with a message that began "0 active", on the deploy's FINAL gate, on a box where
-  // deploy-test.sh has just restarted every long-running service. 's Scope names one thing, the
+  // returned `pass` with a message that began "0 active", on the deploy's FINAL gate, on an instance
+  // where the hourly deploy has just restarted every long-running service. Scope names one thing, the
   // state vocabulary of the FAULT branch above. Transitional units are named in the messages here so
   // they are never swallowed; they are counted as up nowhere.
   const activeCount = (units ?? []).filter((u) => u.active === "active").length;

package/driver/verify-knockout.mjs

@@ -442,7 +442,7 @@ export const validators = {
       // — the register reads and the per-finding weighed lists, both joined to the store.
       if (m.registerReads !== undefined && m.registerReads !== null) {
         if (!Array.isArray(m.registerReads))
-          return { ok: false, reason: `mark "${m.name}": registerReads must be an ARRAY of { recordId, read } rows, or omitted entirely` };
+          return { ok: false, reason: `mark "${m.name}": registerReads must be an ARRAY of { recordId, read, band? } rows, or omitted entirely` };
         const held = registerRecordIdsFor(runDir, m.name);
         for (const row of m.registerReads) {
           const id = String(row?.recordId ?? "").trim();
@@ -451,6 +451,14 @@ export const validators = {
           if (!read) return { ok: false, reason: `mark "${m.name}": registerReads row "${id}" has an empty read. Omit the row rather than sending an empty one: a filing with no read keeps the card's neutral line, which is true` };
           if (!held.has(id))
             return { ok: false, reason: `mark "${m.name}": registerReads cites "${id}", which is not a record this run holds for that mark. The id must be copied from the filings you were handed — the driver joins it against the store and never takes your word for it` };
+          // The band is OPTIONAL and, when present, is the same closed vocabulary the mark's own rating
+          // uses — the card prints it as this filing's rating, so a word outside the frozen ladder would
+          // put a chip on the page in a dialect the framework does not define. Absence stays free: a read
+          // with no band prints the read and no chip, which is what every run before this one produced.
+          if (row?.band != null && String(row.band).trim()) {
+            if (ladder.length && bandIdx(ladder, row.band) < 0)
+              return { ok: false, reason: `knockout_band_unknown:${m.name}: registerReads row "${id}" carries band "${row.band}", which is not in the frozen ladder (${ladder.join(" / ")}) — rate the filing in the framework's own vocabulary, or omit the band and let the read stand alone` };
+          }
         }
       }
       for (const f of (Array.isArray(m.findings) ? m.findings : [])) {

package/driver/verify.mjs

@@ -170,8 +170,8 @@ function needs(content, markers, label, names = []) {
 //
 // THE CLASS. Every gate below keys on prose the MODEL composes, so each is one phrasing drift away
 // from killing a run that produced the section perfectly. Measured across three runs and two engines:
-// pewter-lantern (codex) wrote "## Negative-results matrix" and was rejected twice, killing a client
-// run; umber-beacon (anthropic) wrote "## Negative results (per-cell detail)" — different spelling AND
+// one run on codex wrote "## Negative-results matrix" and was rejected twice, killing the run; another
+// on anthropic wrote "## Negative results (per-cell detail)" — different spelling AND
 // different trailing words, same skill. PR 336 widened the regex to `[\s-]`, which fixed those two
 // instances and left the class exactly where it was: the gate still asks the model to guess a spelling.
 //