clearotron 0.3.1-beta.2 → 0.3.1-beta.4

package/driver/contract-vocabulary.mjs

@@ -15,9 +15,9 @@
 // several times that, because EIGHT sites build the token dynamically and hand back a string the
 // extractor never sees:
 //
-//   D1 verify.mjs:898   fail(`connotation_${reason}:…`)      — reason iterates the table at line 894
+//   D1 verify.mjs:940   fail(`connotation_${reason}:…`)      — reason iterates the table at line 894
 //   D2 verify.mjs:704   fail(String(e.message))              — parseFindingsJson throws token-first
-//   D3 verify.mjs:1123   checkJson: fail(String(e.message))   — FIVE parsers reach this one site
+//   D3 verify.mjs:1165   checkJson: fail(String(e.message))   — FIVE parsers reach this one site
 //   D4 verify.mjs:1603  parseCoverageLedgerJson, same shape
 //   D5 verify.mjs:1504  fail(`${unaccounted[0].token}:…`)    — token minted in a DATA ROW
 //   D6 verify.mjs:1567  fail(`${violations[0].token}…`)      — validatePlanFeasibility in register-plan.mjs
@@ -68,51 +68,52 @@ export const VOCABULARY = [
   { token: "missing", stages: ["matter-frame", "prelim-variants", "common-law", "common-law-half", "placement-inquiry", "register-digest", "doubt-closure", "report-overview", "report-card"], site: "driver/verify.mjs:164" },
 
   // ── common-law / common-law-half ───────────────────────────────────────────────────────────────────
-  { token: "declared_unavailable", stages: CL, site: "driver/verify.mjs:231" },
+  { token: "declared_unavailable", stages: CL, site: "driver/verify.mjs" },
   { token: "grid_spec_unreadable", stages: CL, site: "driver/verify.mjs:257" },
   { token: "grid_ledger_missing", stages: CL, site: "driver/verify.mjs:297" },
   { token: "grid_ledger_unparseable", stages: CL, site: "driver/verify.mjs:266" },
-  { token: "connotation_query_unrecorded", stages: ["common-law-half"], site: "driver/verify.mjs:269" },
-  { token: "profile_unparseable", stages: ["common-law"], site: "driver/verify.mjs:301" },
+  { token: "connotation_query_unrecorded", stages: ["common-law-half"], site: "driver/verify.mjs" },
+  { token: "profile_unparseable", stages: ["common-law"], site: "driver/verify.mjs" },
   { token: "grid_join_missing", stages: CL, site: "driver/verify.mjs:318" },
   { token: "platform_identity_error", stages: CL, site: "driver/verify.mjs:323" },
   { token: "platforms_missing", stages: CL, site: "driver/verify.mjs:334" },
-  { token: "connotation_search_missing", stages: ["common-law"], site: "driver/verify.mjs:362" },
-  { token: "receipts_short", stages: ["common-law"], site: "driver/verify.mjs:388" },
+  { token: "connotation_search_missing", stages: ["common-law"], site: "driver/verify.mjs" },
+  { token: "receipts_short", stages: ["common-law"], site: "driver/verify.mjs" },
   { token: "half_path_unrecognized", stages: ["common-law-half"], site: "driver/verify.mjs:395" },
   { token: "no_coverage_status_row", stages: [...CL, "register-digest"], site: "driver/verify.mjs:452, 1416" },
   // B — `connotation_form_unparseable` and `connotation_form_untouched` are GONE: they
   // were states only a hand-authored document could be in, and the form path is deleted (ruling
   // 2026-08-17). Their subject matter is carried by the call tokens under the D1 family row below.
-  { token: "connotation_form_damaged", stages: CL, site: "driver/verify.mjs:889" },
-  { token: "connotation_", stages: CL, site: "driver/verify.mjs:898", family: "driver/connotation-search.mjs:894 (CONNOTATION_FORM_REASONS, exported at :819)", dynamic: "D1" },
-  { token: "connotation_quote_unbound", stages: CL, site: "driver/verify.mjs:914" },
+  { token: "connotation_form_damaged", stages: CL, site: "driver/verify.mjs" },
+  { token: "connotation_", stages: CL, site: "driver/verify.mjs", family: "driver/connotation-search.mjs CONNOTATION_FORM_REASONS", dynamic: "D1" },
+  { token: "connotation_quote_unbound", stages: CL, site: "driver/verify.mjs" },
 
   // ── synthesis ──────────────────────────────────────────────────────────────────────────────────────
   { token: "framework_manifest_unreadable", stages: ["synthesis"], site: "driver/verify.mjs:691" },
   { token: "framework_manifest_missing_for_v4", stages: ["synthesis"], site: "driver/verify.mjs:706" },
-  { token: "finding_use_check_source_missing", stages: ["synthesis"], site: "driver/verify.mjs:713" },
-  { token: "finding_own_rights_source_missing", stages: ["synthesis"], site: "driver/verify.mjs:715" },
-  { token: "finding_basis_source_missing", stages: ["synthesis"], site: "driver/verify.mjs:779" },
-  { token: "finding_use_check_missing", stages: ["synthesis"], site: "driver/verify.mjs:729" },
-  { token: "intake_ask_unanswered", stages: ["synthesis"], site: "driver/verify.mjs:1636" },
-  { token: "coverage_recommendation", stages: ["synthesis"], site: "driver/verify.mjs:1648" },
-  { token: "coverage_gap_unexplained", stages: ["synthesis"], site: "driver/verify.mjs:1649" },
+  { token: "finding_use_check_source_missing", stages: ["synthesis"], site: "driver/verify.mjs" },
+  { token: "finding_own_rights_source_missing", stages: ["synthesis"], site: "driver/verify.mjs" },
+  { token: "finding_basis_source_missing", stages: ["synthesis"], site: "driver/verify.mjs" },
+  { token: "finding_use_check_missing", stages: ["synthesis"], site: "driver/verify.mjs" },
+  { token: "intake_ask_unanswered", stages: ["synthesis"], site: "driver/verify.mjs" },
+  { token: "ratified_form_unread", stages: ["synthesis"], site: "driver/verify.mjs" },
+  { token: "coverage_recommendation", stages: ["synthesis"], site: "driver/verify.mjs" },
+  { token: "coverage_gap_unexplained", stages: ["synthesis"], site: "driver/verify.mjs" },
   { token: "finding", stages: ["synthesis"], site: "driver/verify.mjs:704", family: "driver/findings-model.mjs (token-first throws; `finding_*` and `findings_*`)", dynamic: "D2" },
 
   // ── register-digest ────────────────────────────────────────────────────────────────────────────────
-  { token: "coverage_form_damaged", stages: ["register-digest"], site: "driver/verify.mjs:976" },
-  { token: "coverage_form_engine_vocabulary", stages: ["register-digest"], site: "driver/verify.mjs:1021" },
-  { token: "coverage_form_axis_invalid", stages: ["register-digest"], site: "driver/verify.mjs:1029" },
-  { token: "coverage_no_status", stages: ["register-digest"], site: "driver/verify.mjs:1062" },
-  { token: "coverage_form_missing", stages: ["register-digest"], site: "driver/verify.mjs:1445" },
-  { token: "coverage_form_empty", stages: ["register-digest"], site: "driver/verify.mjs:1449" },
+  { token: "coverage_form_damaged", stages: ["register-digest"], site: "driver/verify.mjs" },
+  { token: "coverage_form_engine_vocabulary", stages: ["register-digest"], site: "driver/verify.mjs" },
+  { token: "coverage_form_axis_invalid", stages: ["register-digest"], site: "driver/verify.mjs" },
+  { token: "coverage_no_status", stages: ["register-digest"], site: "driver/verify.mjs" },
+  { token: "coverage_form_missing", stages: ["register-digest"], site: "driver/verify.mjs" },
+  { token: "coverage_form_empty", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_status_offenum", stages: ["register-digest"], site: "driver/verify.mjs:2050" },
   { token: "coverage_deferred_unaccounted", stages: ["register-digest"], site: "driver/verify.mjs:1504 coverageFormFail", family: "driver/register-plan.mjs:1642 PROVIDER_HARD_ERROR_PREFIX — token on a data row", dynamic: "D5" },
   { token: "coverage_clean_unexecuted", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1417 validatePlanFeasibility", dynamic: "D6" },
   { token: "coverage_clean_skipped", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1766 searchedJurisdictionsFromPlan", dynamic: "D6" },
   { token: "coverage_clean_unverified_incomplete", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:2018 disclosureTextByAxis", dynamic: "D7" },
-  { token: "coverage_clean_tainted", stages: ["register-digest"], site: "driver/verify.mjs:1578" },
+  { token: "coverage_clean_tainted", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_ledger_", stages: ["register-digest"], site: "driver/verify.mjs:1603", family: "driver/coverage-ledger.mjs (parseCoverageLedgerJson token-first throws)", dynamic: "D4" },
   { token: "coverage_key_unknown", stages: ["register-digest"], site: "driver/verify.mjs:1603", family: "driver/coverage-ledger.mjs", dynamic: "D4" },
   { token: "coverage_axis_", stages: ["register-digest"], site: "driver/verify.mjs:1603", family: "driver/coverage-ledger.mjs", dynamic: "D4" },
@@ -122,14 +123,14 @@ export const VOCABULARY = [
 
   // ── matter-frame / prelim-variants / blind-frame / frame-diff ──────────────────────────────────────
   { token: "stagecontracts_invalid", stages: ["matter-frame", "prelim-variants", "placement-inquiry", "case-law"], site: "driver/verify.mjs:1539, 1170, 1366, 1677" },
-  { token: "meaning_angles_missing", stages: ["matter-frame"], site: "driver/verify.mjs:1103" },
+  { token: "meaning_angles_missing", stages: ["matter-frame"], site: "driver/verify.mjs" },
   { token: "frame_scope_missing", stages: ["matter-frame"], site: "driver/verify.mjs:1119" },
-  { token: "variantmodel_romanization_missing", stages: ["prelim-variants"], site: "driver/verify.mjs:1237" },
-  { token: "variantmodel_family_incomplete", stages: ["prelim-variants"], site: "driver/verify.mjs:1196" },
-  { token: "variantmodel_term_markup", stages: ["prelim-variants"], site: "driver/verify.mjs:1263" },
+  { token: "variantmodel_romanization_missing", stages: ["prelim-variants"], site: "driver/verify.mjs" },
+  { token: "variantmodel_family_incomplete", stages: ["prelim-variants"], site: "driver/verify.mjs" },
+  { token: "variantmodel_term_markup", stages: ["prelim-variants"], site: "driver/verify.mjs" },
   { token: "variantmodel_missing", stages: ["prelim-variants"], site: "driver/verify.mjs:1153, 1212" },
   // Recovered during E2 authoring, absent from the draft census: variant-manifest.json is strict-parsed
-  // through checkSiblingJson (verify.mjs:1136) → checkJson (:742), so the WHOLE variantmodel_* family
+  // through checkSiblingJson (verify.mjs:1178) → checkJson (:742), so the WHOLE variantmodel_* family
   // reaches prelim-variants, not just the four literal tokens above.
   // CONVERSION 3 widened this family's SOURCE without widening its prefix. `acceptPrelimVariants` raises
   // `variantmodel_scope_layer_invalid`, `_scope_status_invalid`, `_scope_item_missing` and `_scope_pipe`
@@ -142,7 +143,7 @@ export const VOCABULARY = [
   // `{ok: false, reason}` instead — measured, all four extract ZERO tokens. So this row is authored, not
   // extracted, and nothing re-derives it if the module grows a member. Filed as.
   { token: "variantmodel_", stages: ["prelim-variants"], site: "driver/verify.mjs:1153 → 742 (JSON family); driver/prelim-variants-record.mjs acceptPrelimVariants (scope-ledger transport family)", family: "driver/variant-manifest-model.mjs (token-first throws) + driver/prelim-variants-record.mjs", dynamic: "D3" },
-  { token: "blindframe_", stages: ["blind-frame"], site: "driver/verify.mjs:1221 → 742", family: "driver/blind-frame-model.mjs", dynamic: "D3" },
+  { token: "blindframe_", stages: ["blind-frame"], site: "driver/verify.mjs blindFrame → checkJson", family: "driver/blind-frame-model.mjs", dynamic: "D3" },
   // — THE SKEPTIC TRANSPORT FAMILY, WHICH HAD NO ROW AT ALL. Nine tokens minted by acceptSkeptic
   // and not one of them was covered here: the conversion that moved them to the acceptance boundary moved
   // them out of a census that could not read that boundary, so nothing went red. Two of the nine are
@@ -164,16 +165,16 @@ export const VOCABULARY = [
   // the frame never reaches disk. They are declared here for the same reason the two families below are —
   // verify.mjs reaches the module, so a family that could grow a member no row covers must be readable.
   { token: "matterframe_", stages: ["matter-frame"], site: "driver/matter-frame-record.mjs acceptMatterFrame", family: "driver/matter-frame-record.mjs", dynamic: "D3" },
-  { token: "framediff_model_missing", stages: ["frame-diff"], site: "driver/verify.mjs:1224" },
+  { token: "framediff_model_missing", stages: ["frame-diff"], site: "driver/verify.mjs" },
   { token: "framediff_", stages: ["frame-diff"], site: "driver/verify.mjs:1224 → 742", family: "driver/frame-diff-model.mjs", dynamic: "D3" },
 
   // ── register-unit ──────────────────────────────────────────────────────────────────────────────────
-  { token: "declared_not_executed", stages: ["register-unit"], site: "driver/verify.mjs:1236" },
+  { token: "declared_not_executed", stages: ["register-unit"], site: "driver/verify.mjs" },
   { token: "tool_timeout", stages: ["register-unit"], site: "driver/verify.mjs:1788" },
-  { token: "named_band_missing", stages: ["register-unit"], site: "driver/verify.mjs:1731" },
-  { token: "named_band_invalid", stages: ["register-unit"], site: "driver/verify.mjs:1736" },
-  { token: "named_band_collapsed", stages: ["register-unit"], site: "driver/verify.mjs:1747" },
-  { token: "band_block_unplanned", stages: ["register-unit"], site: "driver/verify.mjs:1761" },
+  { token: "named_band_missing", stages: ["register-unit"], site: "driver/verify.mjs" },
+  { token: "named_band_invalid", stages: ["register-unit"], site: "driver/verify.mjs" },
+  { token: "named_band_collapsed", stages: ["register-unit"], site: "driver/verify.mjs" },
+  { token: "band_block_unplanned", stages: ["register-unit"], site: "driver/verify.mjs" },
   { token: "named_band_", stages: ["register-unit"], site: "driver/verify.mjs:1736 → 742", family: "driver/named-band.mjs", dynamic: "D3" },
 
   // ── placement-inquiry ──────────────────────────────────────────────────────────────────────────────
@@ -182,10 +183,10 @@ export const VOCABULARY = [
 
   // ── case-law / narrative-refutation ────────────────────────────────────────────────────────────────
   { token: "caselaw_ledger_missing", stages: ["case-law"], site: "driver/verify.mjs:1682, 1685" },
-  { token: "caselaw_ledger_unparseable", stages: ["case-law"], site: "driver/verify.mjs:1745" },
+  { token: "caselaw_ledger_unparseable", stages: ["case-law"], site: "driver/verify.mjs" },
   { token: "caselaw_ledger", stages: ["case-law"], site: "driver/verify.mjs:1692", family: "driver/case-law-ledger.mjs:204 (census reasons)", dynamic: "D8" },
-  { token: "no_verdict_line", stages: ["narrative-refutation"], site: "driver/verify.mjs:1754" },
-  { token: "plan_audit_missing", stages: ["narrative-refutation"], site: "driver/verify.mjs:1771" },
+  { token: "no_verdict_line", stages: ["narrative-refutation"], site: "driver/verify.mjs" },
+  { token: "plan_audit_missing", stages: ["narrative-refutation"], site: "driver/verify.mjs" },
 
   // ── delivery ───────────────────────────────────────────────────────────────────────────────────────
   // EMPTY SINCE, and that is the finding rather than an omission: the only delivery-side token was
@@ -193,7 +194,7 @@ export const VOCABULARY = [
   // its own send. Delivery is code and a packet now, so there is no stage to emit a delivery token.
 
   // ── the gateway wrapper, emittable by EVERY stage and not in verify.mjs at all ─────────────────────
-  { token: "missing_file", stages: ALL_STAGES, site: "driver/gateway.mjs:1037" },
+  { token: "missing_file", stages: ALL_STAGES, site: "driver/gateway.mjs" },
 ];
 
 /**
@@ -299,9 +300,9 @@ export const ARM1_EXEMPTIONS = [
  * than silently enjoyed, and so a validator that LATER gains a stage is noticed.
  */
 export const STAGE_UNREACHABLE_VALIDATORS = [
-  { validator: "findings", site: "driver/verify.mjs:1661", reason: "no STAGES entry names it; synthesis validates findings.json through validators.narrative's sibling checks instead" },
-  { validator: "report", site: "driver/verify.mjs:1719", reason: "report.md is ASSEMBLED by the driver (assembleReportMd); the validator survives as a post-assembly structural gate outside the stage table" },
-  { validator: "audit", site: "driver/verify.mjs:1728", reason: "reached only through the MCP server's dynamic validators[key] lookup, which declares it required" },
+  { validator: "findings", site: "driver/verify.mjs validators.findings", reason: "no STAGES entry names it; synthesis validates findings.json through validators.narrative's sibling checks instead" },
+  { validator: "report", site: "driver/verify.mjs validators.report", reason: "report.md is ASSEMBLED by the driver (assembleReportMd); the validator survives as a post-assembly structural gate outside the stage table" },
+  { validator: "audit", site: "driver/verify.mjs validators.audit", reason: "reached only through the MCP server's dynamic validators[key] lookup, which declares it required" },
   { validator: "clientSummary", site: "driver/verify.mjs:1736", reason: "the client-summary STAGE was deleted 2026-08-01 (no line to cite: the stage is gone); the validator was not" },
 ];
 
@@ -415,33 +416,33 @@ export const TRIPWIRE_OUT_OF_SCOPE = [
 export const INNER_CODES = Object.freeze([
   // ── connotation-search.mjs — namespaced one-for-one by verify.mjs ────────────────────────────────
   //
-  // `CONNOTATION_FORM_REASONS` (connotation-search.mjs:1599) is `CONNOTATION_REASONS` minus
+  // CONNOTATION_FORM_REASONS at connotation-search.mjs:1731 is `CONNOTATION_REASONS` minus
   // `no_recorded_queries`, and the `connotation_` family row (dynamic D1) is declared against exactly
   // that list. The four call codes are folded by a template — `connotation_${callFail.reason}` at
   // verify.mjs:1013 — so they are namespaced by construction rather than one branch at a time.
-  { code: "call_never_made", mints: ["driver/connotation-search.mjs:1956"], rollsUpTo: ["connotation_call_never_made"],
+  { code: "call_never_made", mints: ["driver/connotation-search.mjs:2007"], rollsUpTo: ["connotation_call_never_made"],
     why: "CALL_AUDIT_ROWS. The typed transport's four call states, handed in by disposition-call-audit.mjs and namespaced at verify.mjs:1013." },
-  { code: "call_truncated", mints: ["driver/connotation-search.mjs:1957"], rollsUpTo: ["connotation_call_truncated"],
+  { code: "call_truncated", mints: ["driver/connotation-search.mjs:2008"], rollsUpTo: ["connotation_call_truncated"],
     why: "As call_never_made — same table, same projection." },
-  { code: "call_schema_violation", mints: ["driver/connotation-search.mjs:1958"], rollsUpTo: ["connotation_call_schema_violation"],
+  { code: "call_schema_violation", mints: ["driver/connotation-search.mjs:2009"], rollsUpTo: ["connotation_call_schema_violation"],
     why: "As call_never_made — same table, same projection." },
-  { code: "call_partial", mints: ["driver/connotation-search.mjs:1959"], rollsUpTo: ["connotation_call_partial"],
+  { code: "call_partial", mints: ["driver/connotation-search.mjs:2010"], rollsUpTo: ["connotation_call_partial"],
     why: "As call_never_made — same table, same projection. This is the pair #1211 cites as its worked example: the composite is covered, the bare form reaches no stage." },
-  { code: "quote_unbound", mints: ["driver/connotation-search.mjs:2090"], rollsUpTo: ["connotation_quote_unbound"],
-    why: "The ruled-but-unbound row. Projected at verify.mjs:1057, and reported only once nothing is unruled." },
-  { code: "token_absent", mints: ["driver/connotation-search.mjs:2117"], rollsUpTo: ["connotation_token_absent"],
+  { code: "quote_unbound", mints: ["driver/connotation-search.mjs:2141"], rollsUpTo: ["connotation_quote_unbound"],
+    why: "The ruled-but-unbound row. Projected at verify.mjs:1099, and reported only once nothing is unruled." },
+  { code: "token_absent", mints: ["driver/connotation-search.mjs:2168"], rollsUpTo: ["connotation_token_absent"],
     why: "#592 split this out of no_ruling. Row-level only — repairs.mjs:352 says so in as many words: `never a top-level token`." },
-  { code: "cite_absent", mints: ["driver/connotation-search.mjs:2126"], rollsUpTo: ["connotation_cite_absent"],
+  { code: "cite_absent", mints: ["driver/connotation-search.mjs:2177"], rollsUpTo: ["connotation_cite_absent"],
     why: "#592, as token_absent. repairs.mjs:353: `row-level only — never a top-level token`." },
-  { code: "no_ruling", mints: ["driver/connotation-search.mjs:2133"], rollsUpTo: ["connotation_no_ruling"],
+  { code: "no_ruling", mints: ["driver/connotation-search.mjs:2184"], rollsUpTo: ["connotation_no_ruling"],
     why: "The residual the other two split off from, and it has representatives — see the mint site. Declared as a corrective token at repairs.mjs:308 and in stages.mjs's E1 rows, always namespaced." },
   // THE ONE THAT IS RENAMED, NOT NAMESPACED — and it is the reason this table stores the composite as
   // data rather than deriving it. Every derivation anyone would write is `connotation_` + the code, and
   // for this row that produces `connotation_no_recorded_queries`, which nothing mints and nothing covers.
   // verify.mjs:912-913 states the ruling: a sweep that did not RUN is a canonical-only decision with its
   // own token and its own remedy, so the projector at verify.mjs:909 deliberately does not handle it.
-  { code: "no_recorded_queries", mints: ["driver/connotation-search.mjs:1974"], rollsUpTo: ["connotation_search_missing"],
-    why: "RENAMED, not namespaced: verify.mjs:398 emits `connotation_search_missing`. It is excluded from CONNOTATION_FORM_REASONS at connotation-search.mjs:1680 for exactly this reason." },
+  { code: "no_recorded_queries", mints: ["driver/connotation-search.mjs:2025"], rollsUpTo: ["connotation_search_missing"],
+    why: "RENAMED, not namespaced: verify.mjs emits `connotation_search_missing`. It is excluded from CONNOTATION_FORM_REASONS at connotation-search.mjs:1731 for exactly this reason." },
 
   // ── case-law-ledger.mjs — ONE token, the codes as census payload ─────────────────────────────────
   //
@@ -471,8 +472,8 @@ export const INNER_CODES = Object.freeze([
 
   // ── coverage-form.mjs ─────────────────────────────────────────────────────────────────────────────
   //
-  // ONE CODE, TWO TOKENS, and the split is by `cause` rather than by code: verify.mjs:1169 peels the
-  // `axis_invalid` cause into its own family before verify.mjs:1236 counts the rest. A ruling naming only
+  // ONE CODE, TWO TOKENS, and the split is by `cause` rather than by code: verify.mjs peels the
+  // `axis_invalid` cause into its own family before counting the rest. A ruling naming only
   // `coverage_no_status` would be true of most `no_status` records and false of the ones that matter most.
   { code: "no_status", mints: ["driver/coverage-form.mjs:836"], rollsUpTo: ["coverage_no_status", "coverage_form_axis_invalid"],
     why: "Two composites, split on the record's `cause`: verify.mjs:1172 for cause `axis_invalid`, verify.mjs:1263 for the rest. NOT cited at coverage-form.mjs:810 — that is the JSDoc @returns annotation, not the mint." },
@@ -487,7 +488,7 @@ export const INNER_CODES = Object.freeze([
   // the census output would have been half a ruling. verify.mjs:1075 already states the rule this row
   // records: `coverage_form_damaged`, never a bare `form_damaged`.
   { code: "form_damaged",
-    mints: ["driver/connotation-search.mjs:1979", "driver/connotation-search.mjs:2055", "driver/coverage-form.mjs:818"],
+    mints: ["driver/connotation-search.mjs:2030", "driver/connotation-search.mjs:2106", "driver/coverage-form.mjs:818"],
     rollsUpTo: ["connotation_form_damaged", "coverage_form_damaged"],
     why: "Minted in two lanes and namespaced per lane: verify.mjs:1019 for the meaning sweep, verify.mjs:1119 for the register digest. The namespacing is what keeps them apart — see verify.mjs:1075." },
 ]);

package/driver/engine/mcp/gather-config.mjs

@@ -89,7 +89,7 @@ export const REGISTER_SERVERS = {
   //     mint is shared (mcp/supplemental.mjs); the only per-provider parts are doExecutePlan, which this
   //     server already binds for the dictated plan, and the capability contract, which the mint reads to
   //     decide what defers. Nothing new reaches the wire. While it was unwired the driver's composed prose
-  //     ordered the mint UNCONDITIONALLY — `stages.mjs:2095` and `:2131` — so a signa deploy was told to
+  //     ordered the mint UNCONDITIONALLY — `stages.mjs` (the unconditional mint the register-units digest orders) — so a signa deploy was told to
   //     make a call no server offered. Measured on  over a real signa run: the order reached three
   //     register-unit stages, no call was recorded against it, and the run still read `delivered`.
   //

package/driver/gateway.mjs

@@ -2571,6 +2571,15 @@ export function correctionHint(lastFail, { gridLedgerName = "common-law-grid.jso
     // — THE TOKEN THAT HAD NO HINT, and the absence is what made the failure
     // permanent rather than merely wrong.
     //
+    // AND IT IS ONLY REACHABLE NOW WHEN A QUERY IS GENUINELY ABSENT. It used to be reachable when the
+    // query was recorded in a different spelling, and then this hint asked for the one thing that could
+    // not help: re-running a query that had already run and been recorded. Measured on a production
+    // clearance, 2026-09-16 — one query of sixty-one carried a typographic apostrophe where the driver
+    // wrote a straight one, the stage failed four times byte-identically, and the clearance stopped. The
+    // join compares on `queryKey` now, so a re-run is the right remedy again; the closing sentence below
+    // asks for the dictated spelling, which is what stops the ledger drifting from the list a second
+    // time.
+    //
     // Measured on the owner's own demo clearance: 61 dictated meaning queries, 60 recorded, ONE dropped
     // — the single query in the whole sweep that found nothing. Four attempts, the same refusal string
     // byte for byte, because a retry with no guidance can only repeat itself.
@@ -2585,13 +2594,31 @@ export function correctionHint(lastFail, { gridLedgerName = "common-law-grid.jso
     // gate cannot tell "ran, found nothing" from "never ran", and it is not being asked to. What
     // changes is that the seat is now told how to say the first one.
     const dropped = (lastFail.match(/connotation_query_unrecorded:(.+)$/s) || [])[1] || "";
-    hint = `every dictated meaning query owes a row, including the ones that find nothing — these are ` +
+    // ── TWO FAULTS, TWO REMEDIES, and sending the wrong one is what made this permanent ────────────
+    //
+    // The gate marks each dropped query `[absent from the ledger]` or `[unmatched; nearest recorded: …]`.
+    // Absent means the search did not run and must. Unmatched means it DID run and the ledger's spelling
+    // differs beyond punctuation — re-running it changes nothing, and telling a seat to re-run is how a
+    // stage fails four times with the same string. Where both appear, both sentences are sent.
+    const anyUnmatched = /\[unmatched; nearest recorded:/.test(dropped);
+    const anyAbsent = /\[absent from the ledger\]/.test(dropped);
+    hint = anyUnmatched && !anyAbsent
+      ? `these dictated meaning queries ARE recorded in ${gridLedgerName} extras.pr_risk[] under a ` +
+        `different wording, which is why the driver cannot match them: ${dropped}. Do NOT re-run them — ` +
+        `the search already ran and its results are already in the ledger. EDIT each row's \`query\` ` +
+        `field to the query text EXACTLY as the task message dictates it, character for character, and ` +
+        `leave its results untouched. The driver matches your rows to its list by that text`
+      : `every dictated meaning query owes a row, including the ones that find nothing — these are ` +
       `missing from ${gridLedgerName} extras.pr_risk[]: ${dropped}. A query that returned NO results is ` +
       `not an excuse to omit it: record it with an empty results array, which is the receipt that the ` +
       `search RAN and came back clean. That is the whole point of the sweep — on an "offensive meaning" ` +
       `query the empty answer IS the good news, and a missing row is indistinguishable from a search ` +
       `nobody performed. Re-run ONLY the listed queries, append a row per query to extras.pr_risk[] ` +
-      `whether or not it has hits, and leave every row already recorded exactly as it is`;
+      `whether or not it has hits, and leave every row already recorded exactly as it is. Record each ` +
+      `query's text EXACTLY as the task message dictates it — the driver matches your rows to its list by ` +
+      `the query text, so a reworded or re-punctuated query reads as one you never ran. Where a query is ` +
+      `marked \`[unmatched; nearest recorded: …]\` it is already in the ledger under that wording: edit ` +
+      `that row's \`query\` to the dictated text rather than running the search again`;
   } else if (/connotation_search_missing/.test(lastFail)) {
     // — was "your PR / reputational section claims a clean meaning … but the ledger recorded ZERO
     // searches", which under the `ensure` prefix instructed the model to make the unbacked claim.

package/driver/matter-frame-record.mjs

@@ -135,6 +135,12 @@ export function renderMatterFrame(model) {
   // to find extra classes, so finding none is the ordinary case and not an answer worth a row.
   for (const c of (model.identified_classes ?? []))
     out.push(`- **Class ${c.class} — identified by the frame:** ${c.reason}`);
+  // THE FORMS THE CLIENT RATIFIED, when there is more than one. One form is the ordinary case and
+  // renders nothing: a row saying the name is itself tells a reader nothing they did not have from the
+  // heading. Two or more is a fact about what was bought, and it is what the per-form read downstream
+  // is owed against — so the frame states it where a reader can see it rather than only in a field.
+  if ((model.ratified_forms ?? []).length > 1)
+    out.push(`- **Ratified forms:** ${model.ratified_forms.join(", ")}`);
   out.push("");
 
   // `Search channels:` — domains only; the grid site-restricts to them and the general web is always
@@ -166,7 +172,7 @@ export function renderMatterFrame(model) {
  */
 /** The shape this tool declares, at every depth — what the ACCEPTOR enforces. */
 const DECLARED = Object.freeze({
-  "": ["prose_body", "scope_basis", "scope_jurisdictions", "excluded_jurisdictions", "search_channels", "meaning_angles", "meaning_angles_none", "intake_asks", "identified_classes"],
+  "": ["prose_body", "scope_basis", "scope_jurisdictions", "excluded_jurisdictions", "search_channels", "meaning_angles", "meaning_angles_none", "intake_asks", "identified_classes", "ratified_forms"],
   intake_asks: ["ask", "owner"],
   identified_classes: ["class", "reason"],
 });
@@ -194,6 +200,24 @@ export function frameIdentifiedClasses(runDir) {
   return (Array.isArray(rows) ? rows : []).map((r) => String(r?.class ?? "").trim()).filter(Boolean);
 }
 
+/**
+ * The forms of the name this run's client ratified, as strings. IMPURE (reads the run's own accepted
+ * call). Empty or one form is the ordinary answer.
+ *
+ * WHAT READS IT IS A FLOOR, NOT A FEATURE. `validators.narrative` uses this to decide whether the
+ * narrative owes a per-form read, and it owes one only when the frame froze MORE THAN ONE. A run with
+ * no frame, a replayed or archived run whose accepted call predates the field, and every ordinary
+ * single-form run all return a list the floor ignores — so none of them changes behaviour and every one
+ * of them re-verifies byte-identically.
+ *
+ * THE TRIM IS NOT COSMETIC. A form is compared against the narrative's own text downstream, so a
+ * trailing space here would be a form the narrative can never be found to have named.
+ */
+export function frameRatifiedForms(runDir) {
+  const rows = lastAcceptedMatterFrame(runDir)?.ratified_forms;
+  return (Array.isArray(rows) ? rows : []).map((r) => String(r ?? "").trim()).filter(Boolean);
+}
+
 /** The last ACCEPTED call for this run, or null. */
 export function lastAcceptedMatterFrame(runDir) {
   return lastAccepted(matterFrameCallPaths(String(runDir ?? "")).accepted, readFileSync);
@@ -227,6 +251,7 @@ export function mergeMatterFrameCall(stored, received) {
     // NARROW THE SEARCH on the next compile, silently and in the direction that misses rights. An
     // omission here is a repair that did not mention them, never a decision to withdraw them.
     identified_classes: keepIfAbsent(received?.identified_classes, base.identified_classes),
+    ratified_forms: keepIfAbsent(received?.ratified_forms, base.ratified_forms),
   };
 }
 
@@ -294,6 +319,33 @@ export function acceptMatterFrame(params, { instructedScope = null } = {}) {
     identified_classes.push({ class: String(n), reason });
   }
 
+  // ── THE RATIFIED FORMS OF THE NAME, TYPED ─────────────────────────────────────────────────────────
+  //
+  // A client ratifies two forms of one candidate — the name and a slight twist on it — and both are
+  // searched. Until now the second form arrived only in the instruction PROSE, and nothing downstream
+  // could tell "two forms of one name" from "one name": `job.marks` with more than one entry means a
+  // BATCH, which is a different product. So the synthesis dictation asking for a per-form read had no
+  // deterministic floor under it: its arms matched the wording, which reds when the prose moves and
+  // cannot red when a model ignores the ask.
+  //
+  // TYPED RATHER THAN PARSED, for the reason the field above states and measures: a list derived from
+  // judgment prose dropped the PRIMARY entry in 19 of 21 runs. A field the frame fills in is a
+  // decision; a name scraped out of a sentence is a guess.
+  //
+  // ABSENT OR ONE FORM IS THE ORDINARY CASE and stays free: the floor that reads this is off unless
+  // there is more than one, so every archived run and every single-form run verifies exactly as before.
+  const ratified_forms = [];
+  for (const f of (Array.isArray(params?.ratified_forms) ? params.ratified_forms : [])) {
+    const form = str(f);
+    if (!form)
+      return { ok: false, reason: "matterframe_ratified_form_empty — a ratified form is the name as the client ratified it, never a blank row" };
+    // CASE-INSENSITIVE, because two rows differing only in case are one form written twice and the
+    // per-form read below would then be asked for a distinction the client never made.
+    if (ratified_forms.some((k) => k.toLowerCase() === form.toLowerCase()))
+      return { ok: false, reason: `matterframe_ratified_form_duplicate:${form} — one row per form` };
+    ratified_forms.push(form);
+  }
+
   const model = {
     schema_version: SCHEMA_VERSION,
     instructed_scope: instructedScope ?? null,
@@ -305,6 +357,7 @@ export function acceptMatterFrame(params, { instructedScope = null } = {}) {
     meaning_angles, meaning_angles_none,
     intake_asks,
     identified_classes,
+    ratified_forms,
   };
   return { ok: true, model, content: renderMatterFrame(model) };
 }

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.1-beta.2",
+  "version": "0.3.1-beta.4",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/portal-config-view.mjs

@@ -43,6 +43,7 @@
 
 import { statSync, openSync, readSync, closeSync } from "node:fs";
 import { namedPoint } from "./portal-access.mjs";
+import { recordedKeysFor } from "../shared/client-door.mjs";   // — how many issued keys a person holds, counted by the module that revokes them
 
 import { readFlagSnapshot, engineFor, providersFor, postureDisagreement } from "./flag-snapshot.mjs";
 // `isStale` is deliberately NOT imported any more: the age banner is retired (ruling,
@@ -282,7 +283,8 @@ export function authView({ mode = "", oidcIssuer = "", team = "", jwksUrl = "",
  * `companies` maps each company key the profile store holds to its name. `localSignIn` says this install
  * cannot hold a second person at all, which is what disables Add.
  */
-export function accessView({ grants, viewer = null, companies = {}, grantsFile = null, localSignIn = false }) {
+export function accessView({ grants, viewer = null, companies = {}, grantsFile = null, localSignIn = false,
+  keysRevocable = false }) {
   const tenants = grants?.tenants ?? {};
   const everything = viewer?.everything === true;
   const viewerOrgs = viewer?.genericOrgs ?? [];
@@ -330,6 +332,23 @@ export function accessView({ grants, viewer = null, companies = {}, grantsFile =
       // whose permissions were considered and set to none.
       listed: key !== undefined,
       access: shown.map((p) => namedPoint(p, grants, companies)),
+      // WHETHER THIS ROW IS THE WHOLE OF THIS PERSON, from where the viewer stands. Every other field
+      // here is narrowed silently — a manager of one organisation sees that organisation's half of
+      // somebody and nothing says it is a half — and that was serviceable while the page could only
+      // ADD. It is not serviceable for a page that changes and removes: permissions belong to the
+      // person and not to a point, so a narrowed viewer must be told they cannot change them, and a
+      // removal they order must say it takes away their organisation rather than the install.
+      //
+      // The same test the write routes apply (`reachCovers`), computed here from the same `inside`
+      // that narrowed the list, so the sentence the page draws and the refusal the server would give
+      // cannot disagree.
+      covered: everything || all.every(inside),
+      // HOW MANY ISSUED KEYS THIS PERSON HOLDS — counted by the module that revokes them rather than by
+      // reading `connectKeys` here, so the count and the revocation cannot come to different answers
+      // about who a key belongs to. The removal confirmation needs it BEFORE the press: what happens to
+      // somebody's assistant is part of what the reader is agreeing to, and a page that found out
+      // afterwards would be telling them about it too late to matter.
+      keys: recordedKeysFor(grants, email).length,
       dangling: r.dangling,
     });
   }
@@ -339,6 +358,12 @@ export function accessView({ grants, viewer = null, companies = {}, grantsFile =
     // Add is offered to a manager, and never where local sign-in holds the install to one person.
     canAdd: viewer?.permissions?.manage === true && !localSignIn,
     localSignIn,
+    // Can an issued key be withdrawn on this installation at all? A connector started without a
+    // revocation list never loaded one, so a key minted through it cannot be called back and dies at its
+    // own expiry — `disablePlan` calls that state `lateArm` and refuses to strike the record for it.
+    // Stated here so the confirmation can say which of the two removals this would be before it happens,
+    // rather than correcting itself in the answer.
+    keysRevocable,
     // Companies named in grants that no profile matches — the other typo direction. Install-wide, so it
     // is shown to a person who sees everything and to nobody else.
     unknownAccounts: everything ? [...unknownAccounts].sort() : [],

package/driver/portal-report.mjs

@@ -799,14 +799,28 @@ export function prepareReportForEmbed(html, { staff = false, poolRoot = null, fe
   let ratedUnderDropped = 0;
   out = out.replace(RATED_UNDER_RE, () => { ratedUnderDropped += 1; return ""; });
 
-  // Staff keep their own connector block; a client must not see the staff host it points at.
+  // ── THE ASK-AI BAND COMES OUT FOR EVERY READER ──────────────────────────────────────────────────
+  //
+  // It used to come out for clients only, on the ground that the band names the STAFF host and staff may
+  // see it. That left two Ask-AI controls on one staff screen — this band with the staff address and its
+  // setup steps, and the shell's own header button — and the owner ruled on 2026-09-15 that there is one.
+  // The renderer stopped drawing it in that same change.
+  //
+  // SO THIS STRIP IS NOT DEAD CODE, AND THAT IS THE REASON IT RUNS UNCONDITIONALLY. Every report
+  // rendered before that commit is served from its baked bytes and still carries a band naming the staff
+  // host. Removing the strip on the argument that nothing emits one any more would put that host back in
+  // front of whoever opens an archived run, staff and client alike, and the archive is where most of the
+  // reports are.
   let mcpLeaks = 0;
   let internalTailsDropped = 0;
   let reviewerCodesDropped = 0;
+  out = stripBalanced(out, ASKAI_RE, "details", note).html;
   if (!staff) {
-    out = stripBalanced(out, ASKAI_RE, "details", note).html;
     // Assert, do not assume. `.askband` markup is nested, so a non-greedy match could stop early and
     // leave the host behind in a sibling node. Anything surviving is redacted and counted.
+    //
+    // CLIENT-ONLY, and deliberately: this catches an MCP host anywhere in the document, not only inside
+    // the band, and the staff bytes elsewhere in a report are the designed rendering rather than a leak.
     out = out.replace(MCP_HOST_RE, () => {
       mcpLeaks += 1;
       return "";