clearotron 0.3.0 → 0.3.1-beta.0

package/driver/pipeline-knockout.mjs

@@ -1142,10 +1142,10 @@ export async function knockoutInner(ctx, job, opts = {}) {
     writeRunStatus(ctx, { state: "failed", failedStage, reason: shortReason, reasonTruncated, reasonFull, terminalKind });
     recordRunConsumption(ctx, { phase: "failed", tokens: stampTokenRollup(run.runDir, "failed") });
     rollupStatus(run.studioRoot);
-    // The two failure-notice lanes are MUTUALLY EXCLUSIVE, mirroring pipelineInner's failPingSent gate:
-    // the outbox run-failed event is the primary; sendPending + the wake marker are the BACKSTOP only
-    // when the event write failed (sendPending has no failure-side clear in the ack_event loop — arming
-    // both double-notifies and leaves a permanent SEND PENDING; review 2026-07-17).
+    // OWED EITHER WAY, mirroring pipelineInner: the flag is armed whichever lane wrote the packet,
+    // because mark_sent is the only clear and it settles a failure.json on the same evidence a delivery
+    // needs. The marker is NOT duplicated — the primary lane's own packet lands `<runId>.failed.pending`
+    // and the *.pending watch matches it; a second `<runId>.pending` would outlive every settle.
     let failPingSent = false;
     try {
       const rich = buildFailurePacket({
@@ -1160,14 +1160,14 @@ export async function knockoutInner(ctx, job, opts = {}) {
       writeFileSync(driverDir(run.runDir, "failure.json"), JSON.stringify(packet, null, 2) + "\n");
       failPingSent = Boolean(writeOutboxPacket(`${runId}.failed`, packet));
       if (!failPingSent) {
-        // a fresh notice supersedes an older send's skip-guards (a resumed-then-failed-again run must
-        // still notify — the .sent/receipts invariant, clearance parity)
-        try { rmSync(join(run.runDir, ".sent")); } catch { /* none */ }
-        try { rmSync(driverDir(run.runDir, "send-receipts.json"), { force: true }); } catch { /* none */ }
-        writeRunStatus(ctx, { sendPending: true });
         mkdirSync(config.outboxDir, { recursive: true });
         writeFileSync(join(config.outboxDir, `${runId}.pending`), `${agent}\n`);
       }
+      // a fresh notice supersedes an older send's skip-guards (a resumed-then-failed-again run must
+      // still notify — the .sent/receipts invariant, clearance parity)
+      try { rmSync(join(run.runDir, ".sent")); } catch { /* none */ }
+      try { rmSync(driverDir(run.runDir, "send-receipts.json"), { force: true }); } catch { /* none */ }
+      writeRunStatus(ctx, { sendPending: true });
     } catch (nfErr) { note(`knockout failure-notice write skipped (${String(nfErr?.message ?? nfErr).slice(0, 100)})`); }
     note(`=== KNOCKOUT ${terminalKind === REFUSAL_TERMINAL_KIND ? "REFUSED" : "FAILED"} ${run.codename} at ${failedStage}: ${shortReason} ===\n`);
     // `codename`: this lane's terminals reach the SAME CLI exit as the clearance lane's, and the

package/driver/pipeline.mjs

@@ -31,14 +31,14 @@ import { buildRunContext, deriveSlug, kebab } from "./phase0.mjs";
 import { paths, STAGES, axisTier, decideAxes, assertTierSanity, assertEffectiveTier, lines, AGENT_WHATSAPP, whatsappRouting,
   chainEntries, stageOrdinal, stageInputs, stageOutputs, dependencyOrder, REGISTER_AXES, REGISTER_ENUMERATE_TOOL,
   buildEscalationFollowup, buildEnvelopeCloseFollowup, buildFrameReopenFollowup,
-  buildFrameReopenRetryMessage, thinkingFor, composeFollowup, stampDispatchBlocks, recordEmptyReturn, nothingFound, nothingToRead, PROVIDER_META, proseRungDirective, inquiryRungDirective } from "./stages.mjs";
+  buildFrameReopenRetryMessage, thinkingFor, composeFollowup, stampDispatchBlocks, recordEmptyReturn, nothingFound, nothingToRead, PROVIDER_META, proseRungDirective, inquiryRungDirective } from "./stages.mjs"; import { bandSizeForStage } from "./band-size.mjs";
 import { IDENTITY_FILE as REPORT_IDENTITY_FILE } from "./report-overview-record.mjs";
 import { dispatchRows, clearedSignatures } from "./seat-attempts.mjs";
 import { CONTEXT_DERIVATIONS, DISPATCH_EXTRAS, INLINE_CONTEXT, sandboxManifest, sandboxGaps, derivationsFor } from "./stage-context.mjs";   // — what a stage is actually handed
 import { parseVerdict, countCitedDefects, parseCorrectionKinds, parseCorrections, validators, findReviewerCoherenceFlags, verdictHardenedTo } from "./verify.mjs";
 import { readAcceptedFlags } from "./narrative-refutation-record.mjs";   // T3b — the typed flags, not the re-parse
 import { evidenceClaimViolations, evidenceClaimTable } from "./evidence-claim-invariant.mjs";   //
-import { buildCorrectionsApplied, correctionsWorklist, correctionsAppliedTable, correctionScope, scopeDrift, unresolvedFlags } from "./corrections-feedforward.mjs";
+import { buildCorrectionsApplied, correctionsWorklist, correctionsAppliedTable, correctionScope, scopeDrift, unresolvedFlags, reportLines, linesOf, REPORT_LINE_KEY, REPORT_LINE_LABEL } from "./corrections-feedforward.mjs";
 import { parseCoverageLedgerJson, parseCoverageLedgerFull, deriveCoverageStatus, classTokensFromScopeText, coerceToolAbsenceDeferred, applyTaintDeferred, decideRegisterGap, splitDeferredByCloseability, coverageLedgerTableRows, coverageUnitLabel, NON_MATERIAL_AXES, COVERAGE_STATUSES } from "./coverage-ledger.mjs";
 import { receiptSettled, readEnvelopeDecision, settleReceipt, settledDeferralsSection } from "./envelope-settle.mjs";
 import { readRegisterTaint, readActiveTaintAxes } from "./register-taint.mjs";
@@ -4321,7 +4321,7 @@ async function stageOnce(name, ctx, opts = {}) {
     stallSec: def.stallSec,     // per-stage stall override (heavy stages); undefined → global CLEAROTRON_STALL_MS
     expectFile: out,
     validate: def.validate,
-    runDir: P.runDir,
+    runDir: P.runDir, bandSize: bandSizeForStage(name, P),
     // ── — THE PRESENTING SIDE, RECOMPOSED PER ATTEMPT ────────────────────────────────────────
     //
     // A stage that declares `refreshCtx` is saying its dispatch text depends on state the run CHANGES
@@ -5741,9 +5741,9 @@ export function rollbackCorrectivePass(P, runDir, pre, fail) {   // @internal
  * event so e2e can assert exactly that, and a non-zero count is a report of the fix not holding rather
  * than of this backstop working.
  *
- * @returns {null | {restoredFindings: {ordinal: *, mark: *}[], restoredKeys: string[], leftRemoved: {ordinal: *, mark: *}[]}}
+ * @returns {null | {restoredFindings: {ordinal: *, mark: *}[], restoredKeys: string[], restoredRows: {register: string, key: string}[], leftRemoved: {ordinal: *, mark: *}[]}}
  */
-export function repairUnnamedRemovals(P, runDir, pre, namedOrdinals, namedMarks) {   // @internal
+export function repairUnnamedRemovals(P, runDir, pre, namedOrdinals, namedMarks, namedLines = []) {   // @internal
   if (!pre?.raw) return null;                                   // nothing held — nothing to compare against
   let preDoc = null, postDoc = null, postRaw = null;
   try { preDoc = JSON.parse(pre.raw); } catch { return null; }
@@ -5769,10 +5769,38 @@ export function repairUnnamedRemovals(P, runDir, pre, namedOrdinals, namedMarks)
   // covered the day it exists — a list of key names here would be a second place to remember.
   const restoredKeys = Object.keys(preDoc).filter((k) => !(k in postDoc));
 
-  if (!restoredFindings.length && !restoredKeys.length) return null;
+  // ROWS OF A REGISTER, NOT ONLY WHOLE REGISTERS. A pass rewriting a coverage note or an action sends the
+  // complete array in its PATCH, and a patch REPLACES the stored register — so a row the seat left out is
+  // a row deleted, and nothing downstream objects unless the slice was a limited one. A row no flag named
+  // is restored whole, keyed as `reportLines` keys it; a row the reviewer named stays out, as a named
+  // finding does.
+  const lineKeys = new Set(namedLines ?? []);
+  const restoredRows = [];
+  const rowsBack = {};
+  for (const [reg, keyOf] of Object.entries(REPORT_LINE_KEY)) {
+    if (!Array.isArray(preDoc[reg]) || !Array.isArray(postDoc[reg])) continue;
+    const have = new Set(postDoc[reg].map(keyOf));
+    const back = preDoc[reg].filter((r) => !have.has(keyOf(r)) && !lineKeys.has(keyOf(r)));
+    if (!back.length) continue;
+    rowsBack[reg] = back;
+    for (const r of back) restoredRows.push({ register: reg, key: keyOf(r), label: REPORT_LINE_LABEL[reg](r) });
+  }
+
+  if (!restoredFindings.length && !restoredKeys.length && !restoredRows.length) return null;
 
   const merged = { ...postDoc };
   for (const k of restoredKeys) merged[k] = preDoc[k];
+  for (const [reg, back] of Object.entries(rowsBack)) {
+    // In the snapshot's order, the post-pass version of every row it kept, then any row the pass added.
+    const keyOf = REPORT_LINE_KEY[reg];
+    const post = new Map(postDoc[reg].map((r) => [keyOf(r), r]));
+    const restored = new Set(back);
+    const inPre = new Set(preDoc[reg].map(keyOf));
+    merged[reg] = [
+      ...preDoc[reg].flatMap((r) => restored.has(r) ? [r] : post.has(keyOf(r)) ? [post.get(keyOf(r))] : []),
+      ...postDoc[reg].filter((r) => !inPre.has(keyOf(r))),
+    ];
+  }
   if (restoredFindings.length) {
     // Back in the order the reviewer read them, by ordinal — a restored finding appended to the end
     // would be a different document from the one that was correct.
@@ -5785,6 +5813,7 @@ export function repairUnnamedRemovals(P, runDir, pre, namedOrdinals, namedMarks)
     ts: new Date().toISOString(),
     restoredFindings: restoredFindings.map(brief),
     restoredKeys,
+    restoredRows,
     leftRemoved: leftRemoved.map(brief),
   };
   atomicWrite(P.findings, JSON.stringify(merged, null, 2) + "\n");
@@ -5811,7 +5840,22 @@ export function repairUnnamedRemovals(P, runDir, pre, namedOrdinals, namedMarks)
  */
 export function restoredFindingsTable(repair) {   // @internal
   const rows = repair?.restoredFindings ?? [];
-  if (!rows.length) return "";
+  // A RESTORED ROW IS THE DRIVER'S DOING TOO, and this read only findings — so a coverage note or an
+  // action the driver put back reached the reviewer as the pass's own work, which is the one reading
+  // this section exists to prevent. Same repair, same snapshot, same sentence (found in review).
+  const lines = repair?.restoredRows ?? [];
+  if (!rows.length && !lines.length) return "";
+  if (!rows.length) return [
+    "RESTORED BY THE DRIVER, NOT BY THE AUTHOR — read these before anything else.",
+    "The corrective pass removed the line(s) below and no flag of yours named them, so the driver put them",
+    "back exactly as you last read them. They carry NONE of this round's corrections, and they are not the",
+    "author's judgment about anything. If a removal here was in fact right, say so in your review and name",
+    "the ground — that is the statement the pass failed to make.",
+    "",
+    ...lines.map((l) => `  ${l.label} — restored: removed by the corrective pass with no flag naming it`),
+    "",
+    "These lines MOVED, whatever the scope note above says about what did not.",
+  ].join("\n");
   return [
     "RESTORED BY THE DRIVER, NOT BY THE AUTHOR — read these before anything else.",
     "The corrective pass removed the finding(s) below and no flag of yours named them, so the driver put",
@@ -5820,6 +5864,7 @@ export function restoredFindingsTable(repair) {   // @internal
     "and name the ground — that is the statement the pass failed to make.",
     "",
     ...rows.map((f) => `  #${f.ordinal} ${f.mark} — restored: removed by the corrective pass with no flag naming it`),
+    ...lines.map((l) => `  ${l.label} — restored: removed by the corrective pass with no flag naming it`),
     "",
     "These rows MOVED, whatever the scope note above says about findings that did not.",
   ].join("\n");
@@ -5838,6 +5883,35 @@ function correctionNamedOrdinals(P) {
   return out;
 }
 
+/**
+ * The non-finding lines the review's flags name or quote, as `reportLines` keys — matched against the
+ * PRE-corrective document, for the reason the names are: a removed row is absent from the post file.
+ *
+ * ── THIS JOIN DECIDES A RESTORATION, AND ITS TWO FAILURE DIRECTIONS ARE OPPOSITE ─────────────────────
+ *
+ * `linesOf` applies no correction anywhere — but these keys become `namedLines`, and `repairUnnamedRemovals`
+ * keeps a removed row OUT when its key is among them. So a prose match decides whether a row the pass
+ * deleted comes back:
+ *
+ *   a MISS  → the row is restored although the reviewer asked for it to go: the driver overrides a
+ *             judgment that was made, and the reviewer sees it named as restored and can say so again.
+ *   a FALSE HIT → an accidental deletion stays deleted: the row leaves the client's report and the
+ *             restored-lines section says nothing, because the driver believed it was asked for.
+ *
+ * The second is the worse one and it is the same bet the backstop already makes by mark for findings.
+ * What keeps it bounded is that the reviewer is told: every restored row prints in the re-read section,
+ * so an override is visible, and a flag whose wording missed still leaves its own row in the observation
+ * table as unresolved. `namesLine` wants the label's shape — "the coverage line for <area>" — so a flag
+ * writing "the US coverage note" misses unless it also quoted eight running words of the line.
+ */
+function correctionNamedLines(P, doc0) {
+  try {
+    const review = existsSync(P.seniorEyeReview) ? readFileSync(P.seniorEyeReview, "utf8") : "";
+    const lines = reportLines(doc0);
+    return [...new Set(parseCorrections(review).flatMap((r) => linesOf(r?.text, lines).map((l) => l.key)))];
+  } catch { return []; }   // no review read — every row removal is then unnamed, and restored
+}
+
 /**
  * @param {*} doc0 the findings document to match the review's names against. DEFAULTS to the file on
  *   disk, which is right for the staleness check — but WRONG for judging a removal: a finding that was
@@ -6082,12 +6156,9 @@ function plainRegisterExtra(ctx) {
     const visible = [];
     const add = (where, v) => { const t = String(v ?? "").trim(); if (t) visible.push({ where, text: t }); };
     for (const f of doc.findings ?? []) add(`conflict ${f?.ordinal ?? "?"}'s one sentence`, f?.net);
-    for (const c of doc.coverage ?? []) add(`the coverage line for "${c?.area ?? "an area"}"`, c?.note);
-    for (const a of doc.actions ?? []) add(`the action "${a?.id ?? a?.kind ?? ""}"`.replace(/ ""$/, ""), a?.text);
-    for (const k of ["distinctiveness", "connotation"]) {
-      const v = doc.markAssessment?.[k];
-      add(`the mark assessment's ${k}`, typeof v === "string" ? v : v?.read);
-    }
+    // The lines that are not a finding, labelled by `reportLines` — the labels the corrective cycle's
+    // observation joins a flag back to, so what the reviewer is handed and what the driver reads agree.
+    for (const l of reportLines(doc)) add(l.label, l.text);
 
     const hits = [];
     for (const { where, text } of visible) {
@@ -7534,6 +7605,8 @@ export function buildReviewerOpenPointsSection(reviewMd, appliedRows = null) {
     "findings-removed": "the finding this named was removed rather than corrected",
     "not-entity-scoped": "the run could not check whether this was addressed",
     "not-checkable": "the run could not check whether this was addressed",
+    "line-unchanged": "the line this named was left as written",
+    "line-removed": "the line this named was removed rather than corrected",
   };
   const items = rows.map((r) => {
     const bits = [];
@@ -12186,7 +12259,7 @@ async function pipelineInner(job, opts = {}) {
         let preDocForNames = null;
         try { preDocForNames = preCorrective ? parseFindingsJsonLenient(preCorrective.raw) : null; } catch { /* fall back to the file */ }
         const repaired = repairUnnamedRemovals(P, run.runDir, preCorrective,
-          correctionNamedOrdinals(P), correctionNamedSet(P, preDocForNames));
+          correctionNamedOrdinals(P), correctionNamedSet(P, preDocForNames), correctionNamedLines(P, preDocForNames));
         correctiveRepair = repaired;   // carried to the reviewer's re-read, which must know these are the DRIVER's
         if (repaired) {
           // A DEFECT SIGNAL, not a success. After the schema fix a corrective pass sends a targeted edit
@@ -12194,12 +12267,14 @@ async function pipelineInner(job, opts = {}) {
           // primary fix not holding, never this backstop working.
           runLog(run.runDir, { event: "corrective-unnamed-removal-repaired", defect: true,
             restored: repaired.restoredFindings.length, keys: repaired.restoredKeys.length,
+            rows: repaired.restoredRows.length,
             leftRemoved: repaired.leftRemoved.length,
             findings: repaired.restoredFindings.map((f) => `${f.ordinal}:${f.mark}`) });
           note(`[corrections] the corrective pass removed ${repaired.restoredFindings.length} finding(s) `
             + `no flag named — restored whole from the pre-corrective snapshot: `
             + `${repaired.restoredFindings.map((f) => `#${f.ordinal} ${f.mark}`).join(", ")}`
             + (repaired.restoredKeys.length ? `; and ${repaired.restoredKeys.length} top-level register(s): ${repaired.restoredKeys.join(", ")}` : "")
+            + (repaired.restoredRows.length ? `; and ${repaired.restoredRows.length} row(s): ${repaired.restoredRows.map((r) => r.key).join(", ")}` : "")
             + (repaired.leftRemoved.length ? `. ${repaired.leftRemoved.length} removal(s) the reviewer DID name stay removed.` : "")
             + " The reviewer re-reads the repaired document before it ships.");
         }
@@ -15247,9 +15322,9 @@ async function pipelineInner(job, opts = {}) {
     // rides the outbox like every other event (the engine has no message tool; a chat-ping stage on it
     // would burn a turn and fail) — the never-silent guarantee, headless form (docs/DELIVERY.md
     // run-failed packet; the level-triggered *.pending watch keeps it alive until ack_event).
-    // failPingSent records whether the notice is already on its way; the T5 packet lane below
-    // fires ONLY when it is not (its sendPending flag has no failure-side clear in the ack_event loop,
-    // so it must stay a backstop, never the primary).
+    // failPingSent records which lane WROTE the packet. It no longer decides whether the notice is
+    // owed: a failure arms sendPending either way (below), because mark_sent is the only clear and it
+    // settles a failure.json on the same evidence a delivery needs. ONE SEND PATH, ruled 2026-09-12.
     let failPingSent = false;
     {
       try {
@@ -15289,27 +15364,37 @@ async function pipelineInner(job, opts = {}) {
     // no longer silence it ( F9: teal-keystone died silently on exactly that). Best-effort —
     // packet-write trouble must never mask the original failure; the .failed sentinel + status.json
     // remain the durable record either way.
-    if (!failPingSent) {
-      try {
+    //
+    // OWED EITHER WAY, AND EXACTLY ONE MARKER. A failed run used to read sendPending:false whenever the
+    // packet write SUCCEEDED, so the owed-run scan could not see it and the notice waited on a reader of
+    // the outbox instead. Now the flag is armed on both lanes. What is NOT duplicated is the marker: the
+    // primary lane's packet IS one, because writeOutboxPacket("<runId>.failed") lands
+    // `<runId>.failed.pending` and the *.pending watch already matches it. Arming a second
+    // `<runId>.pending` beside it would leave a file mark_sent does not clear — it clears `<id>.pending`
+    // for each id the run was known by, not this suffixed form — and the sweep re-arms off whatever is
+    // on disk, which is how a permanent SEND PENDING was born. So: the flag always, the packet and the
+    // marker only when nothing wrote them.
+    try {
+      if (!failPingSent) {
         const packet = buildFailurePacket({
           runId: `${run.slug}-${run.date}-${run.codename}`, agent, job, failedStage, shortReason,   // canonical runId form (charter P1 §3)
           reasonVerbatim: String(reason).slice(0, 1000), sig: failSig.sig, failClass, terminalKind,
           repairs: attemptedRepairs ?? [], priorAttempts, whatsappTo: AGENT_WHATSAPP[agent] ?? null,
           reasonDetail: reasonDetailField, reasonQuantity: quantity,   // — the BACKSTOP notice carries it too
         });
-        // same per-send invariant as the delivery handoff: a fresh notice supersedes an older send's
-        // .sent marker AND its per-channel receipts (e.g. a resumed run that fails again must still
-        // notify on every channel, not be skip-guarded by the earlier send's receipts).
-        try { rmSync(join(run.runDir, ".sent")); } catch { /* none */ }
-        try { rmSync(driverDir(run.runDir, "send-receipts.json"), { force: true }); } catch { /* none */ }
         writeFileSync(driverDir(run.runDir, "failure.json"), JSON.stringify(packet, null, 2) + "\n");
-        writeRunStatus(ctx, { sendPending: true });
         mkdirSync(config.outboxDir, { recursive: true });
         writeFileSync(join(config.outboxDir, `${packet.runId}.pending`), `${agent}\n`);
-        note(`failure notice: handoff → _driver/failure.json + outbox marker (completion-watch sends it)`);
-      } catch (nfErr) {
-        note(`failure-notice packet write skipped (${String(nfErr?.message ?? nfErr).slice(0, 100)}) — .failed + status.json remain the record`);
       }
+      // same per-send invariant as the delivery handoff: a fresh notice supersedes an older send's
+      // .sent marker AND its per-channel receipts (e.g. a resumed run that fails again must still
+      // notify on every channel, not be skip-guarded by the earlier send's receipts).
+      try { rmSync(join(run.runDir, ".sent")); } catch { /* none */ }
+      try { rmSync(driverDir(run.runDir, "send-receipts.json"), { force: true }); } catch { /* none */ }
+      writeRunStatus(ctx, { sendPending: true });
+      note(`failure notice OWED (${failPingSent ? "event lane wrote the packet" : "handoff wrote the packet"}) — mark_sent is the only clear`);
+    } catch (nfErr) {
+      note(`failure-notice arming skipped (${String(nfErr?.message ?? nfErr).slice(0, 100)}) — .failed + status.json remain the record`);
     }
     note(`=== FAILED ${run.codename} at ${failedStage}: ${reason} ===\n`);
     // `codename` matches the three sibling terminals (postpone, recovery park, cancelled). Without it

package/driver/portal-service.mjs

@@ -4337,8 +4337,15 @@ const PORT = PORT_CHOICE.port;
       try {
         const res = await fetch(new URL("/mcp", MCP_URL), { method: "GET", redirect: "manual",
           signal: AbortSignal.timeout(2500) });
+        // THE BODY IS READ BECAUSE THE HEADER DOES NOT SEPARATE THE TWO DOORS. A proxy-fronted door and
+        // a key door both refuse with 401 and no `www-authenticate`; each names the credential it wants
+        // in the body, and that is the only thing on the wire that tells them apart. Bounded and
+        // best-effort: a door that sends nothing readable leaves this null and the verdict reports
+        // rather than judges.
+        let body = null;
+        if (res.status === 401) { try { body = (await res.text()).slice(0, 400); } catch { body = null; } }
         probe = { ok: res.status < 500, status: res.status, error: null,
-          challenge: res.headers.get("www-authenticate") };
+          challenge: res.headers.get("www-authenticate"), body };
       } catch (e) { probe = { ok: false, status: null, error: String(e?.cause?.code ?? e?.name ?? e?.message ?? e) }; }
       // `verbs` IS DELIBERATELY NOT PASSED. That check short-circuits ahead of the probe, so handing it
       // in would answer a question about the TOKEN where a question about the DOOR was asked — and the

package/driver/repair-composers.mjs

@@ -207,6 +207,14 @@ export const REPAIR_COMPOSERS = [
         `IF YOU REMOVE THE SUPPORT FOR A CLAIM, THE CLAIM GOES WITH IT. Deleting the evidence and leaving the sentence standing does not make it safer, it makes it unsupported and therefore stronger than the record allows. A run was refused for exactly this.`,
         `1. Correct the flagged narrative sections — send back ONLY the sections a flag names, and every section the flags do not name is left out and comes back byte-identical;`,
         `2. mirror every correction into the finding objects the flags name (owner names, levels/composites, meters). A finding the review KILLS is not deleted: keep its object, set "disposition": "withdrawn" and add "withdrawn_reason": "<the review flag that killed it>". Add a top-level "corrections": {"applied": true, "note": "<one line per flagged entity: corrected / withdrawn / no-change-because-…>"}.`,
+        // THE LINES THAT ARE NOT A FINDING. A coverage note, an action and the mark assessment carry no
+        // ordinal, so step 2 cannot reach them, and nothing said where a rewrite of one goes: seven such
+        // flags survived one clearance on the test box, each recorded as naming nothing (2026-09-11). The
+        // channel already existed — a PATCH copies a top-level register of the findings document through
+        // — and this names it. The coverage-account rule above forbids NEW claims about what was searched;
+        // rewording a note keeps its claims, and the text says so, or the seat reads the two as a conflict
+        // and does nothing, which is what it did.
+        `3. A flag about a line the reader sees that is NOT a finding — a coverage row's "note", an action's "text", or the mark assessment's "distinctiveness" or "connotation" — is applied in the same PATCH: send the complete top-level \`coverage\` array (every row, the unflagged ones exactly as you last sent them), the complete \`actions\` array, or the complete \`mark_assessment\`, with the flagged line rewritten. A row left out of the array is a row deleted, so send every row. Rewording a coverage note is NOT reopening the coverage account: keep its area, its state and every fact it states, and change only how it says them. A flagged line you leave as written is named in the "corrections" note with the reason, as the flag names it — for example: the coverage line for "<area>": no-change-because …`,
         // ── CONVERTED. `editRepairTail` stood here and ordered targeted Edits of
         // both files. The seat holds no Edit for either any more — but the ECONOMICS that argued for a
         // targeted edit are preserved rather than lost, which is why the call has a patch shape at all:

package/driver/stages.mjs

@@ -1276,7 +1276,7 @@ export const STAGES = {
       },
       "Campaign shape (stated) — the intake's campaign facts retyped from the `Stated campaign shape` line the dispatch already carries": {
         class: "mechanical:code-rendered", tokens: [],
-        why: "CLASS ALIGNED WITH `## Instructed scope` in this same stage — same mechanism, same job object, same retyping of a driver-held value, so the same discharge: code stamps the line rather than the model retyping it. Not pre-bound: pre-bound means the driver writes the value into a FORM before dispatch, and nothing here does that. The driver holds job.campaignShape and puts it in the dispatch; the model retypes it into the frame. The dispatch itself calls it \"facts, not judgment\". Same shape as `## Instructed scope` eight elements above, which is already mechanical. NOTE FOR E7: this is derivable-and-not-derived, and it is NOT covered by frame_scope_missing — instructed-scope.json carries marks/classes/jurisdictions/goods/customer (pipeline.mjs:6199) and no campaign field, so nothing joins the frame's copy back to the intake value. [citation unverified]",
+        why: "CLASS ALIGNED WITH `## Instructed scope` in this same stage — same mechanism, same job object, same retyping of a driver-held value, so the same discharge: code stamps the line rather than the model retyping it. Not pre-bound: pre-bound means the driver writes the value into a FORM before dispatch, and nothing here does that. The driver holds job.campaignShape and puts it in the dispatch; the model retypes it into the frame. The dispatch itself calls it \"facts, not judgment\". Same shape as `## Instructed scope` eight elements above, which is already mechanical. NOTE FOR E7: this is derivable-and-not-derived, and it is NOT covered by frame_scope_missing — instructed-scope.json carries marks/classes/jurisdictions/goods/customer (written at intake by `pipelineInner()` in `pipeline.mjs`) and no campaign field, so nothing joins the frame's copy back to the intake value.",
       },
       "Campaign shape (inferred) — the inference where intake stated none, and the decision to label the line `(inferred — not stated in the request)`": {
         class: "judgment", tokens: [],
@@ -4664,3 +4664,15 @@ export function recordEmptyReturn(built, id, { parts, ids, empty }) {
 export function dispatchBlockWhy(ctx, stage, id) {
   return ctx?.dispatchBlocks?.[stage]?.empty?.find((x) => x.id === id)?.why ?? null;
 }
+
+// The stages whose dispatch hands the seat the band reading layer. Declared as data so the driver can
+// ask "does this stage read the band" without composing its message, and pinned by a test that DERIVES
+// the same set from which stage functions reference `BAND_READING_CONTRACT` — the declaration is
+// convenience, the derivation is the authority.
+//
+// AT THE FOOT OF THIS FILE ON PURPOSE, not beside the contract it belongs to. Every line inserted above
+// a cited line silently mis-points every citation below it, and this file is cited by line in twenty
+// places; the citation check only fails when a cited span goes entirely blank, so a citation shifted
+// onto a different real line passes while describing the wrong code. Adding below the last cited line
+// is the one placement that cannot do that. See band-size.mjs for what reads this.
+export const BAND_READING_STAGES = new Set(["placement-inquiry", "register-digest", "synthesis"]);

package/driver/suite-census.json

@@ -69,6 +69,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-budget-is-recorded-beside-the-band-it-ran-against.test.mjs": {
+          "tests": 9,
+          "asserts": 30,
+          "skips": 0,
+          "todos": 0
+        },
         "a-cancel-marker-names-its-actor.test.mjs": {
           "tests": 14,
           "asserts": 34,
@@ -171,6 +177,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-correction-to-a-line-that-is-not-a-finding-is-observed.test.mjs": {
+          "tests": 7,
+          "asserts": 33,
+          "skips": 0,
+          "todos": 0
+        },
         "a-credential-file-is-written-one-way.test.mjs": {
           "tests": 4,
           "asserts": 13,
@@ -231,6 +243,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-demo-sample-that-cannot-be-read-is-named.test.mjs": {
+          "tests": 7,
+          "asserts": 35,
+          "skips": 4,
+          "todos": 0
+        },
         "a-demo-says-what-it-is-not-what-it-lacks.test.mjs": {
           "tests": 5,
           "asserts": 32,
@@ -2980,8 +2998,8 @@
           "todos": 0
         },
         "pipeline.mock.test.mjs": {
-          "tests": 93,
-          "asserts": 785,
+          "tests": 94,
+          "asserts": 792,
           "skips": 0,
           "todos": 0
         },
@@ -3335,7 +3353,7 @@
         },
         "reading-the-demo-does-not-edit-the-repository.test.mjs": {
           "tests": 2,
-          "asserts": 8,
+          "asserts": 13,
           "skips": 1,
           "todos": 0
         },
@@ -3616,8 +3634,8 @@
           "todos": 0
         },
         "release-pipeline.test.mjs": {
-          "tests": 91,
-          "asserts": 353,
+          "tests": 93,
+          "asserts": 356,
           "skips": 0,
           "todos": 0
         },
@@ -3887,7 +3905,7 @@
         },
         "runner.failure-backstop.test.mjs": {
           "tests": 3,
-          "asserts": 23,
+          "asserts": 25,
           "skips": 0,
           "todos": 0
         },
@@ -4235,7 +4253,7 @@
         },
         "start-command.test.mjs": {
           "tests": 27,
-          "asserts": 120,
+          "asserts": 121,
           "skips": 0,
           "todos": 0
         },
@@ -4455,6 +4473,12 @@
           "skips": 0,
           "todos": 0
         },
+        "the-boot-line-says-which-door-it-found.test.mjs": {
+          "tests": 5,
+          "asserts": 21,
+          "skips": 0,
+          "todos": 0
+        },
         "the-bundle-ships-no-commentary.test.mjs": {
           "tests": 2,
           "asserts": 3,
@@ -4510,8 +4534,8 @@
           "todos": 0
         },
         "the-corrective-pass-names-what-it-removes.test.mjs": {
-          "tests": 8,
-          "asserts": 33,
+          "tests": 12,
+          "asserts": 48,
           "skips": 0,
           "todos": 0
         },
@@ -5146,8 +5170,8 @@
           "todos": 0
         },
         "under-wsl-the-windows-binary-on-path-is-not-the-engine.test.mjs": {
-          "tests": 8,
-          "asserts": 26,
+          "tests": 9,
+          "asserts": 31,
           "skips": 0,
           "todos": 0
         },
@@ -5505,8 +5529,8 @@
           "todos": 0
         },
         "delivery-state.test.mjs": {
-          "tests": 11,
-          "asserts": 28,
+          "tests": 12,
+          "asserts": 31,
           "skips": 0,
           "todos": 0
         },
@@ -5596,7 +5620,7 @@
         },
         "ops.test.mjs": {
           "tests": 38,
-          "asserts": 161,
+          "asserts": 164,
           "skips": 0,
           "todos": 0
         },

package/mcp-server/CHANGELOG.md

@@ -1,5 +1,11 @@
 # trademark-artifacts-mcp
 
+## 0.3.1-beta.0
+
+### Patch Changes
+
+- d9798db: Fixed: A clearance that stops now always records that its notice is still owed, so a failure cannot be passed over as already handled.
+
 ## 0.3.0
 
 No changes in this release.

package/mcp-server/lib/ops.mjs

@@ -643,8 +643,17 @@ export function markSent(args = {}) {
     const legacy = run.slug && run.codename ? `${run.slug}-${run.codename}` : null;
     const forms = [...new Set([packet.runId, run.runId, args.runId, legacy]
       .filter((id) => id != null && String(id).trim() !== "").map(sanitize))];
+    // BOTH SUFFIXES, because a failure's marker IS its packet. The delivery lane drops `<id>.pending`;
+    // the failure lane writes its packet through the outbox as `<id>.failed.pending`, which the same
+    // *.pending watch matches. Clearing only the first left the failure form on disk after a settle, the
+    // sweep re-armed off it, and the run stayed owed forever — the permanent SEND PENDING the pipelines'
+    // old comment feared, arriving by the one route nobody had named. A missing form is a no-op, as
+    // before. (How many were stranded when this was found is a fact about one box on one day; it lives on
+    // the issue, not here, because a count in a comment rots and the mechanism does not.)
     for (const id of forms) {
-      try { rmSync(join(config.outboxDir, `${id}.pending`), { force: true }); } catch { /* best-effort */ }
+      for (const suffix of [".pending", ".failed.pending"]) {
+        try { rmSync(join(config.outboxDir, `${id}${suffix}`), { force: true }); } catch { /* best-effort */ }
+      }
     }
   };
   const sentPath = join(run.runDir, ".sent");

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.3.0",
+  "version": "0.3.1-beta.0",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/mcp-server/server.mjs

@@ -205,10 +205,21 @@ const tools = {
   brief({ runId }) {
     return { _note: BRIEFING_NOTE, ...buildBrief(mustRun(runId)) };
   },
-  list_runs({ agent, state, slug, mark, sendPending, limit = 50 } = {}) {
+  // ── ASKING FOR OWED RUNS IS A COMPLETENESS QUESTION, NOT A BROWSING ONE ──────────────────────────
+  //
+  // The default cap of 50 is right for "show me the recent runs" and wrong for "which runs still owe
+  // their requester a notice". An integrator polls the second to decide what to send; a cap silently
+  // drops the fifty-first, and the run it dropped is indistinguishable from a run that owes nothing.
+  // Nothing in the reply says a page was cut, so the caller cannot tell the difference either.
+  //
+  // So `sendPending: true` returns ALL of them unless the caller names a limit itself. Every other call
+  // keeps the cap it has always had: an explicit limit is still obeyed, and an unfiltered list is still
+  // 50, so no existing caller changes.
+  list_runs({ agent, state, slug, mark, sendPending, limit } = {}) {
     let out = enumerateRuns({ agent, state, slug, mark }).map(runSummary);
     if (sendPending === true || sendPending === false) out = out.filter((r) => r.sendPending === sendPending);
-    return out.slice(0, limit);
+    const cap = limit ?? (sendPending === true ? out.length : 50);
+    return out.slice(0, cap);
   },
   list_profiles() {
     // Each customer carries its PROJECTS (engagements) so intake can resolve a projectKey too. A bad

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clearotron",
   "type": "module",
-  "version": "0.3.0",
+  "version": "0.3.1-beta.0",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.3.0",
+  "version": "0.3.1-beta.0",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-oauth-mcp-bridge
 
+## 0.3.1-beta.0
+
+No changes in this release.
+
 ## 0.3.0
 
 No changes in this release.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.3.0",
+  "version": "0.3.1-beta.0",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",