clearotron 0.3.1-beta.3 → 0.3.1

package/driver/contract-vocabulary.mjs

@@ -15,9 +15,9 @@
 // several times that, because EIGHT sites build the token dynamically and hand back a string the
 // extractor never sees:
 //
-//   D1 verify.mjs:898   fail(`connotation_${reason}:…`)      — reason iterates the table at line 894
+//   D1 verify.mjs:940   fail(`connotation_${reason}:…`)      — reason iterates the table at line 894
 //   D2 verify.mjs:704   fail(String(e.message))              — parseFindingsJson throws token-first
-//   D3 verify.mjs:1123   checkJson: fail(String(e.message))   — FIVE parsers reach this one site
+//   D3 verify.mjs:1165   checkJson: fail(String(e.message))   — FIVE parsers reach this one site
 //   D4 verify.mjs:1603  parseCoverageLedgerJson, same shape
 //   D5 verify.mjs:1504  fail(`${unaccounted[0].token}:…`)    — token minted in a DATA ROW
 //   D6 verify.mjs:1567  fail(`${violations[0].token}…`)      — validatePlanFeasibility in register-plan.mjs
@@ -68,51 +68,52 @@ export const VOCABULARY = [
   { token: "missing", stages: ["matter-frame", "prelim-variants", "common-law", "common-law-half", "placement-inquiry", "register-digest", "doubt-closure", "report-overview", "report-card"], site: "driver/verify.mjs:164" },
 
   // ── common-law / common-law-half ───────────────────────────────────────────────────────────────────
-  { token: "declared_unavailable", stages: CL, site: "driver/verify.mjs:231" },
+  { token: "declared_unavailable", stages: CL, site: "driver/verify.mjs" },
   { token: "grid_spec_unreadable", stages: CL, site: "driver/verify.mjs:257" },
   { token: "grid_ledger_missing", stages: CL, site: "driver/verify.mjs:297" },
   { token: "grid_ledger_unparseable", stages: CL, site: "driver/verify.mjs:266" },
-  { token: "connotation_query_unrecorded", stages: ["common-law-half"], site: "driver/verify.mjs:269" },
-  { token: "profile_unparseable", stages: ["common-law"], site: "driver/verify.mjs:301" },
+  { token: "connotation_query_unrecorded", stages: ["common-law-half"], site: "driver/verify.mjs" },
+  { token: "profile_unparseable", stages: ["common-law"], site: "driver/verify.mjs" },
   { token: "grid_join_missing", stages: CL, site: "driver/verify.mjs:318" },
   { token: "platform_identity_error", stages: CL, site: "driver/verify.mjs:323" },
   { token: "platforms_missing", stages: CL, site: "driver/verify.mjs:334" },
-  { token: "connotation_search_missing", stages: ["common-law"], site: "driver/verify.mjs:362" },
-  { token: "receipts_short", stages: ["common-law"], site: "driver/verify.mjs:388" },
+  { token: "connotation_search_missing", stages: ["common-law"], site: "driver/verify.mjs" },
+  { token: "receipts_short", stages: ["common-law"], site: "driver/verify.mjs" },
   { token: "half_path_unrecognized", stages: ["common-law-half"], site: "driver/verify.mjs:395" },
   { token: "no_coverage_status_row", stages: [...CL, "register-digest"], site: "driver/verify.mjs:452, 1416" },
   // B — `connotation_form_unparseable` and `connotation_form_untouched` are GONE: they
   // were states only a hand-authored document could be in, and the form path is deleted (ruling
   // 2026-08-17). Their subject matter is carried by the call tokens under the D1 family row below.
-  { token: "connotation_form_damaged", stages: CL, site: "driver/verify.mjs:889" },
-  { token: "connotation_", stages: CL, site: "driver/verify.mjs:898", family: "driver/connotation-search.mjs:894 (CONNOTATION_FORM_REASONS, exported at :819)", dynamic: "D1" },
-  { token: "connotation_quote_unbound", stages: CL, site: "driver/verify.mjs:914" },
+  { token: "connotation_form_damaged", stages: CL, site: "driver/verify.mjs" },
+  { token: "connotation_", stages: CL, site: "driver/verify.mjs", family: "driver/connotation-search.mjs CONNOTATION_FORM_REASONS", dynamic: "D1" },
+  { token: "connotation_quote_unbound", stages: CL, site: "driver/verify.mjs" },
 
   // ── synthesis ──────────────────────────────────────────────────────────────────────────────────────
   { token: "framework_manifest_unreadable", stages: ["synthesis"], site: "driver/verify.mjs:691" },
   { token: "framework_manifest_missing_for_v4", stages: ["synthesis"], site: "driver/verify.mjs:706" },
-  { token: "finding_use_check_source_missing", stages: ["synthesis"], site: "driver/verify.mjs:713" },
-  { token: "finding_own_rights_source_missing", stages: ["synthesis"], site: "driver/verify.mjs:715" },
-  { token: "finding_basis_source_missing", stages: ["synthesis"], site: "driver/verify.mjs:779" },
-  { token: "finding_use_check_missing", stages: ["synthesis"], site: "driver/verify.mjs:729" },
-  { token: "intake_ask_unanswered", stages: ["synthesis"], site: "driver/verify.mjs:1636" },
-  { token: "coverage_recommendation", stages: ["synthesis"], site: "driver/verify.mjs:1648" },
-  { token: "coverage_gap_unexplained", stages: ["synthesis"], site: "driver/verify.mjs:1649" },
+  { token: "finding_use_check_source_missing", stages: ["synthesis"], site: "driver/verify.mjs" },
+  { token: "finding_own_rights_source_missing", stages: ["synthesis"], site: "driver/verify.mjs" },
+  { token: "finding_basis_source_missing", stages: ["synthesis"], site: "driver/verify.mjs" },
+  { token: "finding_use_check_missing", stages: ["synthesis"], site: "driver/verify.mjs" },
+  { token: "intake_ask_unanswered", stages: ["synthesis"], site: "driver/verify.mjs" },
+  { token: "ratified_form_unread", stages: ["synthesis"], site: "driver/verify.mjs" },
+  { token: "coverage_recommendation", stages: ["synthesis"], site: "driver/verify.mjs" },
+  { token: "coverage_gap_unexplained", stages: ["synthesis"], site: "driver/verify.mjs" },
   { token: "finding", stages: ["synthesis"], site: "driver/verify.mjs:704", family: "driver/findings-model.mjs (token-first throws; `finding_*` and `findings_*`)", dynamic: "D2" },
 
   // ── register-digest ────────────────────────────────────────────────────────────────────────────────
-  { token: "coverage_form_damaged", stages: ["register-digest"], site: "driver/verify.mjs:976" },
-  { token: "coverage_form_engine_vocabulary", stages: ["register-digest"], site: "driver/verify.mjs:1021" },
-  { token: "coverage_form_axis_invalid", stages: ["register-digest"], site: "driver/verify.mjs:1029" },
-  { token: "coverage_no_status", stages: ["register-digest"], site: "driver/verify.mjs:1062" },
-  { token: "coverage_form_missing", stages: ["register-digest"], site: "driver/verify.mjs:1445" },
-  { token: "coverage_form_empty", stages: ["register-digest"], site: "driver/verify.mjs:1449" },
+  { token: "coverage_form_damaged", stages: ["register-digest"], site: "driver/verify.mjs" },
+  { token: "coverage_form_engine_vocabulary", stages: ["register-digest"], site: "driver/verify.mjs" },
+  { token: "coverage_form_axis_invalid", stages: ["register-digest"], site: "driver/verify.mjs" },
+  { token: "coverage_no_status", stages: ["register-digest"], site: "driver/verify.mjs" },
+  { token: "coverage_form_missing", stages: ["register-digest"], site: "driver/verify.mjs" },
+  { token: "coverage_form_empty", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_status_offenum", stages: ["register-digest"], site: "driver/verify.mjs:2050" },
   { token: "coverage_deferred_unaccounted", stages: ["register-digest"], site: "driver/verify.mjs:1504 coverageFormFail", family: "driver/register-plan.mjs:1642 PROVIDER_HARD_ERROR_PREFIX — token on a data row", dynamic: "D5" },
   { token: "coverage_clean_unexecuted", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1417 validatePlanFeasibility", dynamic: "D6" },
   { token: "coverage_clean_skipped", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1766 searchedJurisdictionsFromPlan", dynamic: "D6" },
   { token: "coverage_clean_unverified_incomplete", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:2018 disclosureTextByAxis", dynamic: "D7" },
-  { token: "coverage_clean_tainted", stages: ["register-digest"], site: "driver/verify.mjs:1578" },
+  { token: "coverage_clean_tainted", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_ledger_", stages: ["register-digest"], site: "driver/verify.mjs:1603", family: "driver/coverage-ledger.mjs (parseCoverageLedgerJson token-first throws)", dynamic: "D4" },
   { token: "coverage_key_unknown", stages: ["register-digest"], site: "driver/verify.mjs:1603", family: "driver/coverage-ledger.mjs", dynamic: "D4" },
   { token: "coverage_axis_", stages: ["register-digest"], site: "driver/verify.mjs:1603", family: "driver/coverage-ledger.mjs", dynamic: "D4" },
@@ -122,14 +123,14 @@ export const VOCABULARY = [
 
   // ── matter-frame / prelim-variants / blind-frame / frame-diff ──────────────────────────────────────
   { token: "stagecontracts_invalid", stages: ["matter-frame", "prelim-variants", "placement-inquiry", "case-law"], site: "driver/verify.mjs:1539, 1170, 1366, 1677" },
-  { token: "meaning_angles_missing", stages: ["matter-frame"], site: "driver/verify.mjs:1103" },
+  { token: "meaning_angles_missing", stages: ["matter-frame"], site: "driver/verify.mjs" },
   { token: "frame_scope_missing", stages: ["matter-frame"], site: "driver/verify.mjs:1119" },
-  { token: "variantmodel_romanization_missing", stages: ["prelim-variants"], site: "driver/verify.mjs:1237" },
-  { token: "variantmodel_family_incomplete", stages: ["prelim-variants"], site: "driver/verify.mjs:1196" },
-  { token: "variantmodel_term_markup", stages: ["prelim-variants"], site: "driver/verify.mjs:1263" },
+  { token: "variantmodel_romanization_missing", stages: ["prelim-variants"], site: "driver/verify.mjs" },
+  { token: "variantmodel_family_incomplete", stages: ["prelim-variants"], site: "driver/verify.mjs" },
+  { token: "variantmodel_term_markup", stages: ["prelim-variants"], site: "driver/verify.mjs" },
   { token: "variantmodel_missing", stages: ["prelim-variants"], site: "driver/verify.mjs:1153, 1212" },
   // Recovered during E2 authoring, absent from the draft census: variant-manifest.json is strict-parsed
-  // through checkSiblingJson (verify.mjs:1136) → checkJson (:742), so the WHOLE variantmodel_* family
+  // through checkSiblingJson (verify.mjs:1178) → checkJson (:742), so the WHOLE variantmodel_* family
   // reaches prelim-variants, not just the four literal tokens above.
   // CONVERSION 3 widened this family's SOURCE without widening its prefix. `acceptPrelimVariants` raises
   // `variantmodel_scope_layer_invalid`, `_scope_status_invalid`, `_scope_item_missing` and `_scope_pipe`
@@ -142,7 +143,7 @@ export const VOCABULARY = [
   // `{ok: false, reason}` instead — measured, all four extract ZERO tokens. So this row is authored, not
   // extracted, and nothing re-derives it if the module grows a member. Filed as.
   { token: "variantmodel_", stages: ["prelim-variants"], site: "driver/verify.mjs:1153 → 742 (JSON family); driver/prelim-variants-record.mjs acceptPrelimVariants (scope-ledger transport family)", family: "driver/variant-manifest-model.mjs (token-first throws) + driver/prelim-variants-record.mjs", dynamic: "D3" },
-  { token: "blindframe_", stages: ["blind-frame"], site: "driver/verify.mjs:1221 → 742", family: "driver/blind-frame-model.mjs", dynamic: "D3" },
+  { token: "blindframe_", stages: ["blind-frame"], site: "driver/verify.mjs blindFrame → checkJson", family: "driver/blind-frame-model.mjs", dynamic: "D3" },
   // — THE SKEPTIC TRANSPORT FAMILY, WHICH HAD NO ROW AT ALL. Nine tokens minted by acceptSkeptic
   // and not one of them was covered here: the conversion that moved them to the acceptance boundary moved
   // them out of a census that could not read that boundary, so nothing went red. Two of the nine are
@@ -164,16 +165,16 @@ export const VOCABULARY = [
   // the frame never reaches disk. They are declared here for the same reason the two families below are —
   // verify.mjs reaches the module, so a family that could grow a member no row covers must be readable.
   { token: "matterframe_", stages: ["matter-frame"], site: "driver/matter-frame-record.mjs acceptMatterFrame", family: "driver/matter-frame-record.mjs", dynamic: "D3" },
-  { token: "framediff_model_missing", stages: ["frame-diff"], site: "driver/verify.mjs:1224" },
+  { token: "framediff_model_missing", stages: ["frame-diff"], site: "driver/verify.mjs" },
   { token: "framediff_", stages: ["frame-diff"], site: "driver/verify.mjs:1224 → 742", family: "driver/frame-diff-model.mjs", dynamic: "D3" },
 
   // ── register-unit ──────────────────────────────────────────────────────────────────────────────────
-  { token: "declared_not_executed", stages: ["register-unit"], site: "driver/verify.mjs:1236" },
+  { token: "declared_not_executed", stages: ["register-unit"], site: "driver/verify.mjs" },
   { token: "tool_timeout", stages: ["register-unit"], site: "driver/verify.mjs:1788" },
-  { token: "named_band_missing", stages: ["register-unit"], site: "driver/verify.mjs:1731" },
-  { token: "named_band_invalid", stages: ["register-unit"], site: "driver/verify.mjs:1736" },
-  { token: "named_band_collapsed", stages: ["register-unit"], site: "driver/verify.mjs:1747" },
-  { token: "band_block_unplanned", stages: ["register-unit"], site: "driver/verify.mjs:1761" },
+  { token: "named_band_missing", stages: ["register-unit"], site: "driver/verify.mjs" },
+  { token: "named_band_invalid", stages: ["register-unit"], site: "driver/verify.mjs" },
+  { token: "named_band_collapsed", stages: ["register-unit"], site: "driver/verify.mjs" },
+  { token: "band_block_unplanned", stages: ["register-unit"], site: "driver/verify.mjs" },
   { token: "named_band_", stages: ["register-unit"], site: "driver/verify.mjs:1736 → 742", family: "driver/named-band.mjs", dynamic: "D3" },
 
   // ── placement-inquiry ──────────────────────────────────────────────────────────────────────────────
@@ -182,10 +183,10 @@ export const VOCABULARY = [
 
   // ── case-law / narrative-refutation ────────────────────────────────────────────────────────────────
   { token: "caselaw_ledger_missing", stages: ["case-law"], site: "driver/verify.mjs:1682, 1685" },
-  { token: "caselaw_ledger_unparseable", stages: ["case-law"], site: "driver/verify.mjs:1745" },
+  { token: "caselaw_ledger_unparseable", stages: ["case-law"], site: "driver/verify.mjs" },
   { token: "caselaw_ledger", stages: ["case-law"], site: "driver/verify.mjs:1692", family: "driver/case-law-ledger.mjs:204 (census reasons)", dynamic: "D8" },
-  { token: "no_verdict_line", stages: ["narrative-refutation"], site: "driver/verify.mjs:1754" },
-  { token: "plan_audit_missing", stages: ["narrative-refutation"], site: "driver/verify.mjs:1771" },
+  { token: "no_verdict_line", stages: ["narrative-refutation"], site: "driver/verify.mjs" },
+  { token: "plan_audit_missing", stages: ["narrative-refutation"], site: "driver/verify.mjs" },
 
   // ── delivery ───────────────────────────────────────────────────────────────────────────────────────
   // EMPTY SINCE, and that is the finding rather than an omission: the only delivery-side token was
@@ -193,7 +194,7 @@ export const VOCABULARY = [
   // its own send. Delivery is code and a packet now, so there is no stage to emit a delivery token.
 
   // ── the gateway wrapper, emittable by EVERY stage and not in verify.mjs at all ─────────────────────
-  { token: "missing_file", stages: ALL_STAGES, site: "driver/gateway.mjs:1037" },
+  { token: "missing_file", stages: ALL_STAGES, site: "driver/gateway.mjs" },
 ];
 
 /**
@@ -299,9 +300,9 @@ export const ARM1_EXEMPTIONS = [
  * than silently enjoyed, and so a validator that LATER gains a stage is noticed.
  */
 export const STAGE_UNREACHABLE_VALIDATORS = [
-  { validator: "findings", site: "driver/verify.mjs:1661", reason: "no STAGES entry names it; synthesis validates findings.json through validators.narrative's sibling checks instead" },
-  { validator: "report", site: "driver/verify.mjs:1719", reason: "report.md is ASSEMBLED by the driver (assembleReportMd); the validator survives as a post-assembly structural gate outside the stage table" },
-  { validator: "audit", site: "driver/verify.mjs:1728", reason: "reached only through the MCP server's dynamic validators[key] lookup, which declares it required" },
+  { validator: "findings", site: "driver/verify.mjs validators.findings", reason: "no STAGES entry names it; synthesis validates findings.json through validators.narrative's sibling checks instead" },
+  { validator: "report", site: "driver/verify.mjs validators.report", reason: "report.md is ASSEMBLED by the driver (assembleReportMd); the validator survives as a post-assembly structural gate outside the stage table" },
+  { validator: "audit", site: "driver/verify.mjs validators.audit", reason: "reached only through the MCP server's dynamic validators[key] lookup, which declares it required" },
   { validator: "clientSummary", site: "driver/verify.mjs:1736", reason: "the client-summary STAGE was deleted 2026-08-01 (no line to cite: the stage is gone); the validator was not" },
 ];
 
@@ -415,33 +416,33 @@ export const TRIPWIRE_OUT_OF_SCOPE = [
 export const INNER_CODES = Object.freeze([
   // ── connotation-search.mjs — namespaced one-for-one by verify.mjs ────────────────────────────────
   //
-  // `CONNOTATION_FORM_REASONS` (connotation-search.mjs:1599) is `CONNOTATION_REASONS` minus
+  // CONNOTATION_FORM_REASONS at connotation-search.mjs:1731 is `CONNOTATION_REASONS` minus
   // `no_recorded_queries`, and the `connotation_` family row (dynamic D1) is declared against exactly
   // that list. The four call codes are folded by a template — `connotation_${callFail.reason}` at
   // verify.mjs:1013 — so they are namespaced by construction rather than one branch at a time.
-  { code: "call_never_made", mints: ["driver/connotation-search.mjs:1956"], rollsUpTo: ["connotation_call_never_made"],
+  { code: "call_never_made", mints: ["driver/connotation-search.mjs:2007"], rollsUpTo: ["connotation_call_never_made"],
     why: "CALL_AUDIT_ROWS. The typed transport's four call states, handed in by disposition-call-audit.mjs and namespaced at verify.mjs:1013." },
-  { code: "call_truncated", mints: ["driver/connotation-search.mjs:1957"], rollsUpTo: ["connotation_call_truncated"],
+  { code: "call_truncated", mints: ["driver/connotation-search.mjs:2008"], rollsUpTo: ["connotation_call_truncated"],
     why: "As call_never_made — same table, same projection." },
-  { code: "call_schema_violation", mints: ["driver/connotation-search.mjs:1958"], rollsUpTo: ["connotation_call_schema_violation"],
+  { code: "call_schema_violation", mints: ["driver/connotation-search.mjs:2009"], rollsUpTo: ["connotation_call_schema_violation"],
     why: "As call_never_made — same table, same projection." },
-  { code: "call_partial", mints: ["driver/connotation-search.mjs:1959"], rollsUpTo: ["connotation_call_partial"],
+  { code: "call_partial", mints: ["driver/connotation-search.mjs:2010"], rollsUpTo: ["connotation_call_partial"],
     why: "As call_never_made — same table, same projection. This is the pair #1211 cites as its worked example: the composite is covered, the bare form reaches no stage." },
-  { code: "quote_unbound", mints: ["driver/connotation-search.mjs:2090"], rollsUpTo: ["connotation_quote_unbound"],
-    why: "The ruled-but-unbound row. Projected at verify.mjs:1057, and reported only once nothing is unruled." },
-  { code: "token_absent", mints: ["driver/connotation-search.mjs:2117"], rollsUpTo: ["connotation_token_absent"],
+  { code: "quote_unbound", mints: ["driver/connotation-search.mjs:2141"], rollsUpTo: ["connotation_quote_unbound"],
+    why: "The ruled-but-unbound row. Projected at verify.mjs:1099, and reported only once nothing is unruled." },
+  { code: "token_absent", mints: ["driver/connotation-search.mjs:2168"], rollsUpTo: ["connotation_token_absent"],
     why: "#592 split this out of no_ruling. Row-level only — repairs.mjs:352 says so in as many words: `never a top-level token`." },
-  { code: "cite_absent", mints: ["driver/connotation-search.mjs:2126"], rollsUpTo: ["connotation_cite_absent"],
+  { code: "cite_absent", mints: ["driver/connotation-search.mjs:2177"], rollsUpTo: ["connotation_cite_absent"],
     why: "#592, as token_absent. repairs.mjs:353: `row-level only — never a top-level token`." },
-  { code: "no_ruling", mints: ["driver/connotation-search.mjs:2133"], rollsUpTo: ["connotation_no_ruling"],
+  { code: "no_ruling", mints: ["driver/connotation-search.mjs:2184"], rollsUpTo: ["connotation_no_ruling"],
     why: "The residual the other two split off from, and it has representatives — see the mint site. Declared as a corrective token at repairs.mjs:308 and in stages.mjs's E1 rows, always namespaced." },
   // THE ONE THAT IS RENAMED, NOT NAMESPACED — and it is the reason this table stores the composite as
   // data rather than deriving it. Every derivation anyone would write is `connotation_` + the code, and
   // for this row that produces `connotation_no_recorded_queries`, which nothing mints and nothing covers.
   // verify.mjs:912-913 states the ruling: a sweep that did not RUN is a canonical-only decision with its
   // own token and its own remedy, so the projector at verify.mjs:909 deliberately does not handle it.
-  { code: "no_recorded_queries", mints: ["driver/connotation-search.mjs:1974"], rollsUpTo: ["connotation_search_missing"],
-    why: "RENAMED, not namespaced: verify.mjs:398 emits `connotation_search_missing`. It is excluded from CONNOTATION_FORM_REASONS at connotation-search.mjs:1680 for exactly this reason." },
+  { code: "no_recorded_queries", mints: ["driver/connotation-search.mjs:2025"], rollsUpTo: ["connotation_search_missing"],
+    why: "RENAMED, not namespaced: verify.mjs emits `connotation_search_missing`. It is excluded from CONNOTATION_FORM_REASONS at connotation-search.mjs:1731 for exactly this reason." },
 
   // ── case-law-ledger.mjs — ONE token, the codes as census payload ─────────────────────────────────
   //
@@ -471,8 +472,8 @@ export const INNER_CODES = Object.freeze([
 
   // ── coverage-form.mjs ─────────────────────────────────────────────────────────────────────────────
   //
-  // ONE CODE, TWO TOKENS, and the split is by `cause` rather than by code: verify.mjs:1169 peels the
-  // `axis_invalid` cause into its own family before verify.mjs:1236 counts the rest. A ruling naming only
+  // ONE CODE, TWO TOKENS, and the split is by `cause` rather than by code: verify.mjs peels the
+  // `axis_invalid` cause into its own family before counting the rest. A ruling naming only
   // `coverage_no_status` would be true of most `no_status` records and false of the ones that matter most.
   { code: "no_status", mints: ["driver/coverage-form.mjs:836"], rollsUpTo: ["coverage_no_status", "coverage_form_axis_invalid"],
     why: "Two composites, split on the record's `cause`: verify.mjs:1172 for cause `axis_invalid`, verify.mjs:1263 for the rest. NOT cited at coverage-form.mjs:810 — that is the JSDoc @returns annotation, not the mint." },
@@ -487,7 +488,7 @@ export const INNER_CODES = Object.freeze([
   // the census output would have been half a ruling. verify.mjs:1075 already states the rule this row
   // records: `coverage_form_damaged`, never a bare `form_damaged`.
   { code: "form_damaged",
-    mints: ["driver/connotation-search.mjs:1979", "driver/connotation-search.mjs:2055", "driver/coverage-form.mjs:818"],
+    mints: ["driver/connotation-search.mjs:2030", "driver/connotation-search.mjs:2106", "driver/coverage-form.mjs:818"],
     rollsUpTo: ["connotation_form_damaged", "coverage_form_damaged"],
     why: "Minted in two lanes and namespaced per lane: verify.mjs:1019 for the meaning sweep, verify.mjs:1119 for the register digest. The namespacing is what keeps them apart — see verify.mjs:1075." },
 ]);

package/driver/engine/mcp/gather-config.mjs

@@ -89,7 +89,7 @@ export const REGISTER_SERVERS = {
   //     mint is shared (mcp/supplemental.mjs); the only per-provider parts are doExecutePlan, which this
   //     server already binds for the dictated plan, and the capability contract, which the mint reads to
   //     decide what defers. Nothing new reaches the wire. While it was unwired the driver's composed prose
-  //     ordered the mint UNCONDITIONALLY — `stages.mjs:2095` and `:2131` — so a signa deploy was told to
+  //     ordered the mint UNCONDITIONALLY — `stages.mjs` (the unconditional mint the register-units digest orders) — so a signa deploy was told to
   //     make a call no server offered. Measured on  over a real signa run: the order reached three
   //     register-unit stages, no call was recorded against it, and the run still read `delivered`.
   //

package/driver/gateway.mjs

@@ -2571,6 +2571,15 @@ export function correctionHint(lastFail, { gridLedgerName = "common-law-grid.jso
     // — THE TOKEN THAT HAD NO HINT, and the absence is what made the failure
     // permanent rather than merely wrong.
     //
+    // AND IT IS ONLY REACHABLE NOW WHEN A QUERY IS GENUINELY ABSENT. It used to be reachable when the
+    // query was recorded in a different spelling, and then this hint asked for the one thing that could
+    // not help: re-running a query that had already run and been recorded. Measured on a production
+    // clearance, 2026-09-16 — one query of sixty-one carried a typographic apostrophe where the driver
+    // wrote a straight one, the stage failed four times byte-identically, and the clearance stopped. The
+    // join compares on `queryKey` now, so a re-run is the right remedy again; the closing sentence below
+    // asks for the dictated spelling, which is what stops the ledger drifting from the list a second
+    // time.
+    //
     // Measured on the owner's own demo clearance: 61 dictated meaning queries, 60 recorded, ONE dropped
     // — the single query in the whole sweep that found nothing. Four attempts, the same refusal string
     // byte for byte, because a retry with no guidance can only repeat itself.
@@ -2585,13 +2594,31 @@ export function correctionHint(lastFail, { gridLedgerName = "common-law-grid.jso
     // gate cannot tell "ran, found nothing" from "never ran", and it is not being asked to. What
     // changes is that the seat is now told how to say the first one.
     const dropped = (lastFail.match(/connotation_query_unrecorded:(.+)$/s) || [])[1] || "";
-    hint = `every dictated meaning query owes a row, including the ones that find nothing — these are ` +
+    // ── TWO FAULTS, TWO REMEDIES, and sending the wrong one is what made this permanent ────────────
+    //
+    // The gate marks each dropped query `[absent from the ledger]` or `[unmatched; nearest recorded: …]`.
+    // Absent means the search did not run and must. Unmatched means it DID run and the ledger's spelling
+    // differs beyond punctuation — re-running it changes nothing, and telling a seat to re-run is how a
+    // stage fails four times with the same string. Where both appear, both sentences are sent.
+    const anyUnmatched = /\[unmatched; nearest recorded:/.test(dropped);
+    const anyAbsent = /\[absent from the ledger\]/.test(dropped);
+    hint = anyUnmatched && !anyAbsent
+      ? `these dictated meaning queries ARE recorded in ${gridLedgerName} extras.pr_risk[] under a ` +
+        `different wording, which is why the driver cannot match them: ${dropped}. Do NOT re-run them — ` +
+        `the search already ran and its results are already in the ledger. EDIT each row's \`query\` ` +
+        `field to the query text EXACTLY as the task message dictates it, character for character, and ` +
+        `leave its results untouched. The driver matches your rows to its list by that text`
+      : `every dictated meaning query owes a row, including the ones that find nothing — these are ` +
       `missing from ${gridLedgerName} extras.pr_risk[]: ${dropped}. A query that returned NO results is ` +
       `not an excuse to omit it: record it with an empty results array, which is the receipt that the ` +
       `search RAN and came back clean. That is the whole point of the sweep — on an "offensive meaning" ` +
       `query the empty answer IS the good news, and a missing row is indistinguishable from a search ` +
       `nobody performed. Re-run ONLY the listed queries, append a row per query to extras.pr_risk[] ` +
-      `whether or not it has hits, and leave every row already recorded exactly as it is`;
+      `whether or not it has hits, and leave every row already recorded exactly as it is. Record each ` +
+      `query's text EXACTLY as the task message dictates it — the driver matches your rows to its list by ` +
+      `the query text, so a reworded or re-punctuated query reads as one you never ran. Where a query is ` +
+      `marked \`[unmatched; nearest recorded: …]\` it is already in the ledger under that wording: edit ` +
+      `that row's \`query\` to the dictated text rather than running the search again`;
   } else if (/connotation_search_missing/.test(lastFail)) {
     // — was "your PR / reputational section claims a clean meaning … but the ledger recorded ZERO
     // searches", which under the `ensure` prefix instructed the model to make the unbacked claim.

package/driver/matter-frame-record.mjs

@@ -135,6 +135,12 @@ export function renderMatterFrame(model) {
   // to find extra classes, so finding none is the ordinary case and not an answer worth a row.
   for (const c of (model.identified_classes ?? []))
     out.push(`- **Class ${c.class} — identified by the frame:** ${c.reason}`);
+  // THE FORMS THE CLIENT RATIFIED, when there is more than one. One form is the ordinary case and
+  // renders nothing: a row saying the name is itself tells a reader nothing they did not have from the
+  // heading. Two or more is a fact about what was bought, and it is what the per-form read downstream
+  // is owed against — so the frame states it where a reader can see it rather than only in a field.
+  if ((model.ratified_forms ?? []).length > 1)
+    out.push(`- **Ratified forms:** ${model.ratified_forms.join(", ")}`);
   out.push("");
 
   // `Search channels:` — domains only; the grid site-restricts to them and the general web is always
@@ -166,7 +172,7 @@ export function renderMatterFrame(model) {
  */
 /** The shape this tool declares, at every depth — what the ACCEPTOR enforces. */
 const DECLARED = Object.freeze({
-  "": ["prose_body", "scope_basis", "scope_jurisdictions", "excluded_jurisdictions", "search_channels", "meaning_angles", "meaning_angles_none", "intake_asks", "identified_classes"],
+  "": ["prose_body", "scope_basis", "scope_jurisdictions", "excluded_jurisdictions", "search_channels", "meaning_angles", "meaning_angles_none", "intake_asks", "identified_classes", "ratified_forms"],
   intake_asks: ["ask", "owner"],
   identified_classes: ["class", "reason"],
 });
@@ -194,6 +200,24 @@ export function frameIdentifiedClasses(runDir) {
   return (Array.isArray(rows) ? rows : []).map((r) => String(r?.class ?? "").trim()).filter(Boolean);
 }
 
+/**
+ * The forms of the name this run's client ratified, as strings. IMPURE (reads the run's own accepted
+ * call). Empty or one form is the ordinary answer.
+ *
+ * WHAT READS IT IS A FLOOR, NOT A FEATURE. `validators.narrative` uses this to decide whether the
+ * narrative owes a per-form read, and it owes one only when the frame froze MORE THAN ONE. A run with
+ * no frame, a replayed or archived run whose accepted call predates the field, and every ordinary
+ * single-form run all return a list the floor ignores — so none of them changes behaviour and every one
+ * of them re-verifies byte-identically.
+ *
+ * THE TRIM IS NOT COSMETIC. A form is compared against the narrative's own text downstream, so a
+ * trailing space here would be a form the narrative can never be found to have named.
+ */
+export function frameRatifiedForms(runDir) {
+  const rows = lastAcceptedMatterFrame(runDir)?.ratified_forms;
+  return (Array.isArray(rows) ? rows : []).map((r) => String(r ?? "").trim()).filter(Boolean);
+}
+
 /** The last ACCEPTED call for this run, or null. */
 export function lastAcceptedMatterFrame(runDir) {
   return lastAccepted(matterFrameCallPaths(String(runDir ?? "")).accepted, readFileSync);
@@ -227,6 +251,7 @@ export function mergeMatterFrameCall(stored, received) {
     // NARROW THE SEARCH on the next compile, silently and in the direction that misses rights. An
     // omission here is a repair that did not mention them, never a decision to withdraw them.
     identified_classes: keepIfAbsent(received?.identified_classes, base.identified_classes),
+    ratified_forms: keepIfAbsent(received?.ratified_forms, base.ratified_forms),
   };
 }
 
@@ -294,6 +319,33 @@ export function acceptMatterFrame(params, { instructedScope = null } = {}) {
     identified_classes.push({ class: String(n), reason });
   }
 
+  // ── THE RATIFIED FORMS OF THE NAME, TYPED ─────────────────────────────────────────────────────────
+  //
+  // A client ratifies two forms of one candidate — the name and a slight twist on it — and both are
+  // searched. Until now the second form arrived only in the instruction PROSE, and nothing downstream
+  // could tell "two forms of one name" from "one name": `job.marks` with more than one entry means a
+  // BATCH, which is a different product. So the synthesis dictation asking for a per-form read had no
+  // deterministic floor under it: its arms matched the wording, which reds when the prose moves and
+  // cannot red when a model ignores the ask.
+  //
+  // TYPED RATHER THAN PARSED, for the reason the field above states and measures: a list derived from
+  // judgment prose dropped the PRIMARY entry in 19 of 21 runs. A field the frame fills in is a
+  // decision; a name scraped out of a sentence is a guess.
+  //
+  // ABSENT OR ONE FORM IS THE ORDINARY CASE and stays free: the floor that reads this is off unless
+  // there is more than one, so every archived run and every single-form run verifies exactly as before.
+  const ratified_forms = [];
+  for (const f of (Array.isArray(params?.ratified_forms) ? params.ratified_forms : [])) {
+    const form = str(f);
+    if (!form)
+      return { ok: false, reason: "matterframe_ratified_form_empty — a ratified form is the name as the client ratified it, never a blank row" };
+    // CASE-INSENSITIVE, because two rows differing only in case are one form written twice and the
+    // per-form read below would then be asked for a distinction the client never made.
+    if (ratified_forms.some((k) => k.toLowerCase() === form.toLowerCase()))
+      return { ok: false, reason: `matterframe_ratified_form_duplicate:${form} — one row per form` };
+    ratified_forms.push(form);
+  }
+
   const model = {
     schema_version: SCHEMA_VERSION,
     instructed_scope: instructedScope ?? null,
@@ -305,6 +357,7 @@ export function acceptMatterFrame(params, { instructedScope = null } = {}) {
     meaning_angles, meaning_angles_none,
     intake_asks,
     identified_classes,
+    ratified_forms,
   };
   return { ok: true, model, content: renderMatterFrame(model) };
 }

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.1-beta.3",
+  "version": "0.3.1",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/portal-service.mjs

@@ -3198,7 +3198,10 @@ async function connectorDoorKind(url) {
         // as they were, and the answer says which happened. Nobody sets their own switches, and nobody
         // gives Run without holding it.
         if (parts[2] === "people" && parts.length === 3 && method === "POST") {
-          if (localSignIn) return { status: 409, json: { error: "local_sign_in" } };
+          // CODE AS ITS OWN FIELD. `error` carries a sentence on most routes here and a token on a few, so
+          // a client cannot tell the two apart by looking at it — and the one that reached the page as page
+          // copy was a token. A code the client reads as a FIELD is decidable; prose never is.
+          if (localSignIn) return { status: 409, json: { error: "local_sign_in", code: "local_sign_in" } };
           if (!writeGrants) return { status: 503, json: { error: "cannot_write_grants" } };
           const email = String(body?.email ?? "").trim().toLowerCase();
           if (!email || email.indexOf("@") <= 0 || email.indexOf("@") !== email.lastIndexOf("@"))
@@ -3257,7 +3260,10 @@ async function connectorDoorKind(url) {
         // refuses the whole act, because a manager who can take their own Manage away can lock the
         // install's last manager out of it with one press, and the way back is a text editor on the box.
         if (parts[2] === "people" && parts[3] === "change" && parts.length === 4 && method === "POST") {
-          if (localSignIn) return { status: 409, json: { error: "local_sign_in" } };
+          // CODE AS ITS OWN FIELD. `error` carries a sentence on most routes here and a token on a few, so
+          // a client cannot tell the two apart by looking at it — and the one that reached the page as page
+          // copy was a token. A code the client reads as a FIELD is decidable; prose never is.
+          if (localSignIn) return { status: 409, json: { error: "local_sign_in", code: "local_sign_in" } };
           if (!writeGrants) return { status: 503, json: { error: "cannot_write_grants" } };
           const email = String(body?.email ?? "").trim().toLowerCase();
           if (email === principal.email) return { status: 400, json: { error: "You cannot change your own access. Somebody else who manages this install can." } };
@@ -3322,7 +3328,10 @@ async function connectorDoorKind(url) {
         // — it reads the same `covered` the view computes — but the request carries no scope to get
         // wrong, so a stale page cannot ask for more than the person pressing it can see.
         if (parts[2] === "people" && parts[3] === "remove" && parts.length === 4 && method === "POST") {
-          if (localSignIn) return { status: 409, json: { error: "local_sign_in" } };
+          // CODE AS ITS OWN FIELD. `error` carries a sentence on most routes here and a token on a few, so
+          // a client cannot tell the two apart by looking at it — and the one that reached the page as page
+          // copy was a token. A code the client reads as a FIELD is decidable; prose never is.
+          if (localSignIn) return { status: 409, json: { error: "local_sign_in", code: "local_sign_in" } };
           if (!writeGrants) return { status: 503, json: { error: "cannot_write_grants" } };
           const email = String(body?.email ?? "").trim().toLowerCase();
           if (email === principal.email) return { status: 400, json: { error: "You cannot remove your own access. Somebody else who manages this install can." } };
@@ -4029,9 +4038,39 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
   // `extra` exists so a response can carry a CSP. Before this the content-type was hardcoded and there
   // was no way to attach one — which is why the portal shipped without a policy rather than with a
   // permissive one.
+  // ── EVERY JSON RESPONSE SAYS HOW IT MAY BE CACHED, because leaving it unsaid is the defect ────────
+  //
+  // This writer used to send `content-type` and `content-length` and nothing else — no `Cache-Control`,
+  // no `Vary`, no validator — so what a browser did with a signed-in response carrying another
+  // company's material was the browser's decision and not ours. With no `Last-Modified` to work from a
+  // heuristic cache may well store nothing; the defect is not a demonstrated leak, it is that the answer
+  // was never stated for a response behind a session.
+  //
+  // THE ARGUMENT WAS ALREADY MADE HERE, FOR ONE ROUTE. `/portal/api/connect-key` has always set
+  // `no-store` because "a credential sitting in a proxy or a disk cache is the 'outlives the moment'
+  // failure ... arriving by a route the page cannot see". An access list is not a credential and has the
+  // same property, so the rule belongs to the class rather than to the one response that carried a
+  // token.
+  //
+  // `Vary: Accept` IS NOT ABOUT PRIVACY. `/portal/admin/*` is one address served two ways: the app
+  // fetches JSON there, and a browser navigation gets the app document instead (portal-static.mjs
+  // decides on `Accept`, above this router). Nothing told a cache those were different responses, so a
+  // stored JSON body could answer a later navigation and render raw data in a window — with this server
+  // never asked, which is why the negotiation above could not save it.
+  //
+  // A ROUTE'S OWN HEADERS STILL WIN. `extra` is spread last, so connect-key keeps its stricter set
+  // (`no-cache, must-revalidate, private` and the HTTP/1.0 `pragma`) rather than being flattened to this
+  // default. The arm below pins that, because a default that quietly relaxed a stricter route would be
+  // this change making things worse while reading as an improvement.
   const send = (res, status, obj, extra = {}) => {
     const b = JSON.stringify(obj);
-    res.writeHead(status, { "content-type": "application/json", "content-length": Buffer.byteLength(b), ...extra });
+    res.writeHead(status, {
+      "content-type": "application/json",
+      "content-length": Buffer.byteLength(b),
+      "cache-control": "no-store",
+      "vary": "accept",
+      ...extra,
+    });
     res.end(b);
   };
   return async function handler(req, res) {

package/driver/stages.mjs

@@ -1363,6 +1363,16 @@ export const STAGES = {
       // The driver STAMPS the instructed-scope section from _driver/instructed-scope.json, so the seat is
       // not asked to quote back values the driver wrote at intake. That retyping was the stage's
       // `frame_scope_missing` loop and it is gone; see matter-frame-record.mjs.
+      // RATIFIED FORMS CARRY THEIR OWN IMPERATIVE, for the reason stated above this block: a field
+      // phrased outside one was written 0 of 9 times against 74 of 74 when imperative-carried. Without
+      // this sentence the typed field is never filled, and the floor under the per-form read in
+      // validators.narrative is green because it is inert — which is the exact defect that floor exists
+      // to end, arriving one layer up.
+      //
+      // ONLY WHEN THE CLIENT RATIFIED MORE THAN ONE. The ordinary matter is one name and must stay
+      // free: a seat asked to list forms for a single-form matter will invent a second one, and the
+      // floor would then demand a read of a form nobody bought.
+      `Send \`ratified_forms\` ONLY if the instruction ratifies more than one form of the same name — the name and a variant of it, both to be searched as one matter. Send each form exactly as the client wrote it. Omit the field entirely for an ordinary single-name matter; do not invent a second form.`,
       `You are NOT asked to quote the request's marks, classes, territories or goods back — the driver stamps that section from its own intake record, so it cannot drift from what was asked.`,
       `Do NOT write or edit any file. There is no path for you to write to: the driver renders the frame from what you send, and nothing you hand-write is read.`,
       `When the tool accepts your call, return ONLY a 2-3 line summary of the frame.`,
@@ -2089,7 +2099,7 @@ export const STAGES = {
       },
       "enumerated block records carried verbatim — record_id, mark_text, classes, status, owner_name, owner_country, application_date, registration_date, expiry_date, jurisdictions, screen_verdict": {
         class: "mechanical:tool-written", tokens: ["named_band_collapsed"],
-        why: "register_enumerate already returns each record batch-screened; carrying it is transcription. `named_band_collapsed` (verify.mjs:1283, findCollapsedBands) is exactly the recall loss that transcription produces — a slice claiming total_hits with zero records reaching the band. [citation unverified]",
+        why: "register_enumerate already returns each record batch-screened; carrying it is transcription. `named_band_collapsed` (verify.mjs:1325, findCollapsedBands) is exactly the recall loss that transcription produces — a slice claiming total_hits with zero records reaching the band. [citation unverified]",
       },
       "per-axis prose digest — the SHORT AUDIT NOTE at register-units/<axis>.md": {
         class: "judgment", tokens: ["too_short"],
@@ -2655,7 +2665,7 @@ export const STAGES = {
       },
       "the escalation decision — which register axes carry a material, unresolved, genuinely closeable gap, and the one-line reason for each": {
         class: "judgment", tokens: [],
-        why: "Whether a documented coverage-limited row, a capability-gap deferral or a fresh concern on a confirmed-clean row warrants spending a re-run. The driver hands the coverage/execution truth in as a computed table (stages.mjs:1466; skepticDeferralExtra) precisely so this is a call over data rather than a re-derivation — but the call itself is nobody else's. [citation unverified]",
+        why: "Whether a documented coverage-limited row, a capability-gap deferral or a fresh concern on a confirmed-clean row warrants spending a re-run. The driver hands the coverage/execution truth in as a computed table (stages.mjs:1476; skepticDeferralExtra) precisely so this is a call over data rather than a re-derivation — but the call itself is nobody else's. [citation unverified]",
       },
       "escalation decisions — one {axis, reason} per axis that must be re-run, sent through record_skeptic": {
         class: "mechanical:code-rendered", tokens: [],
@@ -2860,6 +2870,10 @@ export const STAGES = {
         class: "mechanical:code-rendered", tokens: ["intake_ask_unanswered"],
         why: "the driver already code-builds the report's section from the ask_answers register (assembleReportMd · buildAskAnswersSection, named in stages.mjs) — the narrative section is a second authoring of a register the driver renders anyway",
       },
+      "narrative per-form read — each ratified form reasoned through the framework, or the reads stated alike": {
+        class: "judgment", tokens: ["ratified_form_unread"],
+        why: "a client who ratified two forms is choosing between them; which conflicts move between the forms is the read they bought, and the token is a floor on whether the question was answered at all rather than on the reasoning",
+      },
       "narrative coverage prose — how a coverage gap is stated": {
         class: "judgment", tokens: ["coverage_recommendation", "coverage_gap_unexplained"],
         why: "what the run could and could not clear is the lawyer's honest statement; the token polices only the forbidden 'commission a re-run' form",
@@ -2886,7 +2900,7 @@ export const STAGES = {
       },
       "findings[].meters.use.token / meters.enforcer.token — the two strengths with no quadrant axis": {
         class: "judgment", tokens: ["finding_meter_missing", "finding_meter_token_invalid", "finding_meter_unknown"],
-        why: "Judgment, and S1 does not reach them: quadrant plots goods proximity and mark similarity only (stages.mjs:1733), so nothing derives use (confirmed/not-confirmed/unknown) or enforcer strength. Deriving these from the quadrant would invent a reading the position does not carry. [citation unverified]",
+        why: "Judgment, and S1 does not reach them: quadrant plots goods proximity and mark similarity only (stages.mjs, the quadrant element), so nothing derives use (confirmed/not-confirmed/unknown) or enforcer strength. Deriving these from the quadrant would invent a reading the position does not carry.",
       },
       "findings[].meters.mark_similarity.token / meters.goods_proximity.token — the coarse 3-pip restatement of the quadrant position": {
         class: "mechanical:code-assigned", tokens: ["finding_meter_missing", "finding_meter_token_invalid", "finding_meter_unknown"],