clearotron 0.3.2-beta.6 → 0.3.2-beta.7

package/bin/update.mjs

@@ -346,6 +346,30 @@ export async function update(argv = process.argv.slice(2)) {
     return installed;
   }
 
+  // ── AND THE STAMP THE PULL CANNOT MOVE ─────────────────────────────────────────────────────────────
+  //
+  // `build-info.json` names the commit an archive was packed from. It is written by `prepack`, which this
+  // route never runs, and it is untracked, so the pull above cannot bring it forward either. A checkout
+  // that was ever packed by hand keeps whatever that pack wrote, and the file then ages while the tree
+  // moves: measured on the test box 2026-09-16, it named a commit five days and two minor versions behind
+  // the tree it was sitting in.
+  //
+  // NOTHING THE PRODUCT READS IS FOOLED BY IT, which is why this stamps rather than refuses. `engineCommit`
+  // takes git first and never lets a packed stamp override a live checkout, so no run has been
+  // misattributed and no client has seen a wrong version. The reader it misleads is a person — checking on
+  // the box which build is deployed, answered confidently and wrongly, with nothing on the file to say it
+  // is stale. This verb is what moves the commit on this route, so it is the cheapest place to keep the
+  // answer true.
+  //
+  // A failure here does not fail the update. The code and its dependencies are already correct, and
+  // reporting a half-done deploy because a note could not be rewritten would be the louder lie.
+  const stamped = runInCheckout("node", ["scripts/write-build-info.mjs"]);
+  if (stamped !== 0) {
+    console.error("\n  The update succeeded, but build-info.json could not be re-stamped. A reader of that");
+    console.error("  file on this box would be told the commit of an earlier pack rather than this one.");
+    console.error("  What this install RUNS is unaffected — that is named from the checkout itself.\n");
+  }
+
   // ── THE BUNDLE THE PULL COULD NOT UPDATE ─────────────────────────────────────────────────────────
   //
   // `portal-ui/dist` is untracked on the public tree, so `git pull` above can never bring it forward.

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "91905bd9b7ffd04985537f799d2ef49359e3d0e6",
-  "version": "0.3.2-beta.6"
+  "commit": "3783f1439565cab9c10a48fe49d7b24f1c777c25",
+  "version": "0.3.2-beta.7"
 }

package/driver/CHANGELOG.md

@@ -1,5 +1,12 @@
 # clearotron-driver
 
+## 0.3.2-beta.7
+
+### Patch Changes
+
+- 4bde529: Fixed: A clearance that completed all but one or two of its local-language searches now delivers the report. Before, a single search that did not complete threw the whole clearance away, including the fifty-nine that had run. The report says which term's search was short.
+- b5b789c: Fixed: The exported PDF no longer prints a collapsed arrow above sections that are already fully open.
+
 ## 0.3.2-beta.6
 
 ### Patch Changes

package/driver/connotation-search.mjs

@@ -276,6 +276,51 @@ export const queryKey = (s) => String(s ?? "")
   .trim()
   .toLowerCase();
 
+/**
+ * The POPULATION behind `parsePrRiskResults`, because that reader reduces its input and nothing at a
+ * call site said so.
+ *
+ * `parsePrRiskResults` folds rows into a map keyed on the raw query text, so two rows carrying the same
+ * query become one and its output is smaller than the ledger it read. Every count taken during one
+ * evening's diagnosis was post-fold, by two people, and neither had named the raw population — so "the
+ * seat wrote 59 rows" and "59 rows survived the fold" were indistinguishable, and they are different
+ * facts with different causes. A seat that recorded one query twice and skipped another looks identical
+ * to a seat that simply skipped one, from the folded count alone.
+ *
+ * Returns both counts so a caller can say which it means. `rows` is what the ledger carries; `distinct`
+ * is what the fold leaves; the difference is rows that repeat a query already counted.
+ */
+/**
+ * THE TWO LABELS THE MEANING GATE PUTS ON A QUERY IT COULD NOT JOIN, and they are a CONTRACT rather
+ * than prose: `gateway.mjs` reads them back to choose which repair a seat is offered, and the two
+ * repairs are opposite. Re-wording either one in the validator, with the reader matching on its own
+ * copy of the old text, silently collapses that choice — the hint keeps being sent and stops being
+ * the right one. Both sides now build and detect from here, so a wording change is one edit.
+ *
+ * Anything a gate wants to ADD — which file it searched, what a neighbour is evidence of — goes
+ * OUTSIDE these markers, so the sentence can grow without moving the contract.
+ */
+export const CONNOTATION_UNMATCHED_MARK = "[unmatched; nearest recorded:";
+export const CONNOTATION_NO_RESEMBLANCE_MARK = "[no recorded query resembles this one]";
+
+export function prRiskPopulation(ledgerRaw) {
+  let parsed;
+  try { parsed = JSON.parse(ledgerRaw); } catch { return { rows: 0, distinct: 0, repeated: 0 }; }
+  const batches = Array.isArray(parsed) ? parsed : [parsed];
+  let rows = 0;
+  const seen = new Set();
+  for (const b of batches) {
+    const pr = b?.extras?.pr_risk;
+    if (!Array.isArray(pr)) continue;
+    for (const e of pr) {
+      if (!e || typeof e.query !== "string" || !e.query.trim()) continue;
+      rows += 1;
+      seen.add(e.query.trim());
+    }
+  }
+  return { rows, distinct: seen.size, repeated: rows - seen.size };
+}
+
 export function parsePrRiskResults(ledgerRaw) {
   let parsed;
   try { parsed = JSON.parse(ledgerRaw); } catch { return []; }

package/driver/contract-e3-backlog.mjs

@@ -185,7 +185,7 @@ export const E3_BACKLOG = [
     // it one: authored once in renderConnotationObligations, and reaching the seat through the perplexity
     // MCP server (driver/engine/mcp/perplexity-server.mjs:111) rather than a stage message. Three rows
     // pointing at one block would fabricate two authored sites the surface does not have.
-    where: "driver/connotation-search.mjs:1435-1448 (renderConnotationObligations; delivered to the seat via driver/engine/mcp/perplexity-server.mjs:111 — a TOOL RESPONSE, no longer a stage message)",
+    where: "driver/connotation-search.mjs:1480-1493 (renderConnotationObligations; delivered to the seat via driver/engine/mcp/perplexity-server.mjs:111 — a TOOL RESPONSE, no longer a stage message)",
     surface: "tool-response",
     // ── (a) THE ORIGINAL SUBJECT WAS DELETED BY DESIGN — DISCHARGED, NOT FAILED ────────────────────
     // The old rows dictated `receipt_id` (an 8-char token the seat copied) and `quote`. Both are gone:
@@ -488,7 +488,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3231",
     surface: "stage-message",
     evidence: "- meters: {\"mark_similarity\":{...},\"goods_proximity\":{...},\"use\":{...},\"enforcer\":{...}} — all four present, each {\"token\",\"basis\",\"source\"}. … mark_similarity = high | medium | low. goods_proximity = high | medium | low. enforcer = high | medium | low | unknown. use = confirmed | not-confirmed | un",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; driver/verify.mjs:1153 checkFindingsSibling gates meters.*.source; finding_basis_source_missing",
+    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; driver/verify.mjs:1171 checkFindingsSibling gates meters.*.source; finding_basis_source_missing",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -684,7 +684,7 @@ export const E3_BACKLOG = [
     // because an un-anchorable row lands in the NOT-CHECKED slice, and that is coverage lost rather than
     // a pass.
     evidence: "is ONE of coverage-disposition | fact | rating | narrative — pick the one your own legal read says the correction IS: coverage-disposition (a coverage row / disposition placement is wrong or dishonest)",
-    reparsedBy: "driver/verify.mjs:829 CORRECTION_KIND_RE = /\\[kind:\\s*([a-z][a-z-]*)\\s*\\]/i → parseCorrectionKinds (verify.mjs:1052), consumed in pipelineInner() in pipeline.mjs for the run.jsonl `correction-kinds` histogram, which since #1558 also carries `kindChannelOk` — the counts are DERIVED from the parsed rows, and that key states whether the reviewer's kind channel produced anything at all rather than leaving a reader to infer it by comparing untyped against total. Telemetry only today",
+    reparsedBy: "driver/verify.mjs:847 CORRECTION_KIND_RE = /\\[kind:\\s*([a-z][a-z-]*)\\s*\\]/i → parseCorrectionKinds (verify.mjs:1070), consumed in pipelineInner() in pipeline.mjs for the run.jsonl `correction-kinds` histogram, which since #1558 also carries `kindChannelOk` — the counts are DERIVED from the parsed rows, and that key states whether the reviewer's kind channel produced anything at all rather than leaving a reader to infer it by comparing untyped against total. Telemetry only today",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -697,7 +697,7 @@ export const E3_BACKLOG = [
     // `[on: -]` case went from a value to an ABSENCE — you omit the field — which is the one part a
     // reader could get wrong from the old wording, since there is no value meaning "no finding".
     evidence: "**AND EVERY FLAG CARRIES WHICH FINDING IT IS ABOUT** — the `on` field, an array of ordinals. Same rule as `kind`: you send the values, the driver renders the token.",
-    reparsedBy: "driver/verify.mjs:846 CORRECTION_ON_RE = /\\[on:\\s*([0-9,\\s-]*?)\\s*\\]/i. SKILL-FILE ONLY — the stage message at stages.mjs:1842-1877 never mentions `[on:]`. This is #850's \"the element shape is in the skill file, not the stage message\" in its purest form: an E3 lint reading stages.mjs alone sees the [kind:] token and misses its twin",
+    reparsedBy: "driver/verify.mjs:864 CORRECTION_ON_RE = /\\[on:\\s*([0-9,\\s-]*?)\\s*\\]/i. SKILL-FILE ONLY — the stage message at stages.mjs:1842-1877 never mentions `[on:]`. This is #850's \"the element shape is in the skill file, not the stage message\" in its purest form: an E3 lint reading stages.mjs alone sees the [kind:] token and misses its twin",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {

package/driver/contract-vocabulary.mjs

@@ -17,7 +17,7 @@
 //
 //   D1 verify.mjs:940   fail(`connotation_${reason}:…`)      — reason iterates the table at line 894
 //   D2 verify.mjs   fail(String(e.message))              — parseFindingsJson throws token-first
-//   D3 verify.mjs:1210   checkJson: fail(String(e.message))   — FIVE parsers reach this one site
+//   D3 verify.mjs:1228   checkJson: fail(String(e.message))   — FIVE parsers reach this one site
 //   D4 verify.mjs  parseCoverageLedgerJson, same shape
 //   D5 verify.mjs:1504  fail(`${unaccounted[0].token}:…`)    — token minted in a DATA ROW
 //   D6 verify.mjs:1567  fail(`${violations[0].token}…`)      — validatePlanFeasibility in register-plan.mjs
@@ -109,7 +109,7 @@ export const VOCABULARY = [
   { token: "coverage_form_missing", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_form_empty", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_status_offenum", stages: ["register-digest"], site: "driver/verify.mjs:2050" },
-  { token: "coverage_deferred_unaccounted", stages: ["register-digest"], site: "driver/verify.mjs:1536 coverageFormFail", family: "driver/register-plan.mjs:1642 PROVIDER_HARD_ERROR_PREFIX — token on a data row", dynamic: "D5" },
+  { token: "coverage_deferred_unaccounted", stages: ["register-digest"], site: "driver/verify.mjs:1554 coverageFormFail", family: "driver/register-plan.mjs:1642 PROVIDER_HARD_ERROR_PREFIX — token on a data row", dynamic: "D5" },
   { token: "coverage_clean_unexecuted", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1417 validatePlanFeasibility", dynamic: "D6" },
   { token: "coverage_clean_skipped", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1766 searchedJurisdictionsFromPlan", dynamic: "D6" },
   { token: "coverage_clean_unverified_incomplete", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:2018 disclosureTextByAxis", dynamic: "D7" },
@@ -128,9 +128,9 @@ export const VOCABULARY = [
   { token: "variantmodel_romanization_missing", stages: ["prelim-variants"], site: "driver/verify.mjs" },
   { token: "variantmodel_family_incomplete", stages: ["prelim-variants"], site: "driver/verify.mjs" },
   { token: "variantmodel_term_markup", stages: ["prelim-variants"], site: "driver/verify.mjs" },
-  { token: "variantmodel_missing", stages: ["prelim-variants"], site: "driver/verify.mjs:1153, 1212" },
+  { token: "variantmodel_missing", stages: ["prelim-variants"], site: "driver/verify.mjs:1171 checkFindingsSibling, 1230 checkJson" },
   // Recovered during E2 authoring, absent from the draft census: variant-manifest.json is strict-parsed
-  // through checkSiblingJson (verify.mjs:1223) → checkJson (:742), so the WHOLE variantmodel_* family
+  // through checkSiblingJson (verify.mjs:1241) → checkJson (:742), so the WHOLE variantmodel_* family
   // reaches prelim-variants, not just the four literal tokens above.
   // CONVERSION 3 widened this family's SOURCE without widening its prefix. `acceptPrelimVariants` raises
   // `variantmodel_scope_layer_invalid`, `_scope_status_invalid`, `_scope_item_missing` and `_scope_pipe`
@@ -142,7 +142,7 @@ export const VOCABULARY = [
   // `fail(` / `throw new Error(` / `=>` string literals, and every record module returns
   // `{ok: false, reason}` instead — measured, all four extract ZERO tokens. So this row is authored, not
   // extracted, and nothing re-derives it if the module grows a member. Filed as.
-  { token: "variantmodel_", stages: ["prelim-variants"], site: "driver/verify.mjs:1153 → 742 (JSON family); driver/prelim-variants-record.mjs acceptPrelimVariants (scope-ledger transport family)", family: "driver/variant-manifest-model.mjs (token-first throws) + driver/prelim-variants-record.mjs", dynamic: "D3" },
+  { token: "variantmodel_", stages: ["prelim-variants"], site: "driver/verify.mjs:1171 checkFindingsSibling → 742 (JSON family); driver/prelim-variants-record.mjs acceptPrelimVariants (scope-ledger transport family)", family: "driver/variant-manifest-model.mjs (token-first throws) + driver/prelim-variants-record.mjs", dynamic: "D3" },
   { token: "blindframe_", stages: ["blind-frame"], site: "driver/verify.mjs blindFrame → checkJson", family: "driver/blind-frame-model.mjs", dynamic: "D3" },
   // — THE SKEPTIC TRANSPORT FAMILY, WHICH HAD NO ROW AT ALL. Nine tokens minted by acceptSkeptic
   // and not one of them was covered here: the conversion that moved them to the acceptance boundary moved
@@ -417,33 +417,33 @@ export const TRIPWIRE_OUT_OF_SCOPE = [
 export const INNER_CODES = Object.freeze([
   // ── connotation-search.mjs — namespaced one-for-one by verify.mjs ────────────────────────────────
   //
-  // CONNOTATION_FORM_REASONS at connotation-search.mjs:1731 is `CONNOTATION_REASONS` minus
+  // CONNOTATION_FORM_REASONS at connotation-search.mjs:1776 is `CONNOTATION_REASONS` minus
   // `no_recorded_queries`, and the `connotation_` family row (dynamic D1) is declared against exactly
   // that list. The four call codes are folded by a template — `connotation_${callFail.reason}` at
   // verify.mjs — so they are namespaced by construction rather than one branch at a time.
-  { code: "call_never_made", mints: ["driver/connotation-search.mjs:2007"], rollsUpTo: ["connotation_call_never_made"],
+  { code: "call_never_made", mints: ["driver/connotation-search.mjs:2052"], rollsUpTo: ["connotation_call_never_made"],
     why: "CALL_AUDIT_ROWS. The typed transport's four call states, handed in by disposition-call-audit.mjs and namespaced at verify.mjs." },
-  { code: "call_truncated", mints: ["driver/connotation-search.mjs:2008"], rollsUpTo: ["connotation_call_truncated"],
+  { code: "call_truncated", mints: ["driver/connotation-search.mjs:2053"], rollsUpTo: ["connotation_call_truncated"],
     why: "As call_never_made — same table, same projection." },
-  { code: "call_schema_violation", mints: ["driver/connotation-search.mjs:2009"], rollsUpTo: ["connotation_call_schema_violation"],
+  { code: "call_schema_violation", mints: ["driver/connotation-search.mjs:2054"], rollsUpTo: ["connotation_call_schema_violation"],
     why: "As call_never_made — same table, same projection." },
-  { code: "call_partial", mints: ["driver/connotation-search.mjs:2010"], rollsUpTo: ["connotation_call_partial"],
+  { code: "call_partial", mints: ["driver/connotation-search.mjs:2055"], rollsUpTo: ["connotation_call_partial"],
     why: "As call_never_made — same table, same projection. This is the pair #1211 cites as its worked example: the composite is covered, the bare form reaches no stage." },
-  { code: "quote_unbound", mints: ["driver/connotation-search.mjs:2141"], rollsUpTo: ["connotation_quote_unbound"],
+  { code: "quote_unbound", mints: ["driver/connotation-search.mjs:2186"], rollsUpTo: ["connotation_quote_unbound"],
     why: "The ruled-but-unbound row. Projected at verify.mjs:1099, and reported only once nothing is unruled." },
-  { code: "token_absent", mints: ["driver/connotation-search.mjs:2168"], rollsUpTo: ["connotation_token_absent"],
+  { code: "token_absent", mints: ["driver/connotation-search.mjs:2213"], rollsUpTo: ["connotation_token_absent"],
     why: "#592 split this out of no_ruling. Row-level only — repairs.mjs:352 says so in as many words: `never a top-level token`." },
-  { code: "cite_absent", mints: ["driver/connotation-search.mjs:2177"], rollsUpTo: ["connotation_cite_absent"],
+  { code: "cite_absent", mints: ["driver/connotation-search.mjs:2222"], rollsUpTo: ["connotation_cite_absent"],
     why: "#592, as token_absent. repairs.mjs:353: `row-level only — never a top-level token`." },
-  { code: "no_ruling", mints: ["driver/connotation-search.mjs:2184"], rollsUpTo: ["connotation_no_ruling"],
+  { code: "no_ruling", mints: ["driver/connotation-search.mjs:2229"], rollsUpTo: ["connotation_no_ruling"],
     why: "The residual the other two split off from, and it has representatives — see the mint site. Declared as a corrective token at repairs.mjs:308 and in stages.mjs's E1 rows, always namespaced." },
   // THE ONE THAT IS RENAMED, NOT NAMESPACED — and it is the reason this table stores the composite as
   // data rather than deriving it. Every derivation anyone would write is `connotation_` + the code, and
   // for this row that produces `connotation_no_recorded_queries`, which nothing mints and nothing covers.
   // verify.mjs:912-913 states the ruling: a sweep that did not RUN is a canonical-only decision with its
   // own token and its own remedy, so the projector at verify.mjs:909 deliberately does not handle it.
-  { code: "no_recorded_queries", mints: ["driver/connotation-search.mjs:2025"], rollsUpTo: ["connotation_search_missing"],
-    why: "RENAMED, not namespaced: verify.mjs emits `connotation_search_missing`. It is excluded from CONNOTATION_FORM_REASONS at connotation-search.mjs:1731 for exactly this reason." },
+  { code: "no_recorded_queries", mints: ["driver/connotation-search.mjs:2070"], rollsUpTo: ["connotation_search_missing"],
+    why: "RENAMED, not namespaced: verify.mjs emits `connotation_search_missing`. It is excluded from CONNOTATION_FORM_REASONS at connotation-search.mjs:1776 for exactly this reason." },
 
   // ── case-law-ledger.mjs — ONE token, the codes as census payload ─────────────────────────────────
   //
@@ -489,7 +489,7 @@ export const INNER_CODES = Object.freeze([
   // the census output would have been half a ruling. verify.mjs:1075 already states the rule this row
   // records: `coverage_form_damaged`, never a bare `form_damaged`.
   { code: "form_damaged",
-    mints: ["driver/connotation-search.mjs:2030", "driver/connotation-search.mjs:2106", "driver/coverage-form.mjs:818"],
+    mints: ["driver/connotation-search.mjs:2075", "driver/connotation-search.mjs:2151", "driver/coverage-form.mjs:818"],
     rollsUpTo: ["connotation_form_damaged", "coverage_form_damaged"],
     why: "Minted in two lanes and namespaced per lane: verify.mjs:1019 for the meaning sweep, verify.mjs:1119 for the register digest. The namespacing is what keeps them apart — see verify.mjs:1075." },
 ]);

package/driver/gateway.mjs

@@ -255,7 +255,8 @@ import { undispatchableFiringDirectives } from "./frame-diff-model.mjs";
 import { witnessStageMethodology, describeMethodologyDrift } from "./methodology-witness.mjs";
 // — the meaning-sweep form and its accumulator. Both PURE and acyclic: connotation-search.mjs
 // imports nothing, disposition-union.mjs imports only it, and neither reaches back here.
-import { parsePrRiskResults, connotationObligations, parseDispositionForm, rulingsProse, CONNOTATION_FORM_TOKEN_SRC, CONNOTATION_FORM_TOKEN_RE } from "./connotation-search.mjs";
+import { parsePrRiskResults, connotationObligations, parseDispositionForm, rulingsProse, CONNOTATION_FORM_TOKEN_SRC,
+  CONNOTATION_UNMATCHED_MARK, CONNOTATION_NO_RESEMBLANCE_MARK, CONNOTATION_FORM_TOKEN_RE } from "./connotation-search.mjs";
 import { unionDispositionForm, formSidecarPath } from "./disposition-union.mjs";
 import { unionCoverageForm } from "./coverage-union.mjs";
 import { coverageFormStamp, readCoverageForm, readCoverageFormInput, writeCoverageForm } from "./coverage-form-io.mjs";
@@ -2613,8 +2614,10 @@ export function correctionHint(lastFail, { gridLedgerName = "common-law-grid.jso
     // applies by looking at its own ledger, and neither wastes an attempt: if the search did run, fix
     // the row's wording; if it did not, run it and append the row. Where both labels appear, both
     // sentences are sent, as before.
-    const anyUnmatched = /\[unmatched; nearest recorded:/.test(dropped);
-    const anyUnresembled = /\[no recorded query resembles this one\]/.test(dropped);
+    // Detected from the validator's own constants, never a copy of its prose: these two choose between
+    // opposite repairs, and a re-worded label with a stale matcher here keeps sending the wrong one.
+    const anyUnmatched = String(dropped).includes(CONNOTATION_UNMATCHED_MARK);
+    const anyUnresembled = String(dropped).includes(CONNOTATION_NO_RESEMBLANCE_MARK);
     hint = anyUnmatched && !anyUnresembled
       ? `these dictated meaning queries ARE recorded in ${gridLedgerName} extras.pr_risk[] under a ` +
         `different wording, which is why the driver cannot match them: ${dropped}. Do NOT re-run them — ` +

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.2-beta.6",
+  "version": "0.3.2-beta.7",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline.mjs

@@ -201,6 +201,39 @@ async function defaultRecordFetcher(uri, ctx) {
   return activeProvider().recordFetch(uri, ctx);
 }
 
+/**
+ * THE ENGINE RE-ISSUES A DICTATED MEANING SEARCH ITSELF, without asking the assessing model to redo the
+ * sweep — the same shape as `defaultRecordFetcher` above, which fetches a register record in code when
+ * one was dropped unexamined rather than sending the model back for it.
+ *
+ * "Through the same tool" is literal and costs no new machinery: the research provider's grid functions
+ * are a plain module with no listener, so the component the model calls and this one call the SAME
+ * functions on the same provider. There is no second implementation to drift.
+ *
+ * NARROW BY CONSTRUCTION. The spec handed over carries only the queries that are missing, so this buys
+ * those cells rather than re-running a sweep that already cost real money and real minutes.
+ *
+ * It DECIDES nothing. The caller re-merges and the gate judges, so a re-issue that comes back empty is
+ * simply a re-merge that still fails, and is disclosed as such rather than counted as searched.
+ */
+async function defaultConnotationReissuer(queries, { spec, modelOverride = null } = {}) {
+  const apiKey = process.env.PERPLEXITY_API_KEY || "";
+  if (!apiKey) return { ok: false, cause: "no research credential in the driver environment", rows: [] };
+  const core = await import("../providers/perplexity/src/core.js");
+  const narrow = { ...spec, connotation: { ...(spec.connotation ?? {}), queries: queries.slice() } };
+  try {
+    const task = core.buildGridProgramTask(narrow);
+    const data = await core.callAgentAPI(apiKey,
+      core.buildRequestBody({ task, preset: "pro-search", modelOverride, enableSandbox: true }));
+    const cap = core.captureGridFromResponse(data, narrow);
+    if (!cap?.ok) return { ok: false, cause: String(cap?.error ?? "capture failed").slice(0, 160), rows: [] };
+    const rows = parsePrRiskResults(cap.ledgerJson).filter((r) => queries.includes(r.query));
+    return { ok: true, rows, requested: queries.length };
+  } catch (e) {
+    return { ok: false, cause: String(e?.message ?? e).slice(0, 160), rows: [] };
+  }
+}
+
 // The ACTIVE provider's capability contract and the offices this DEPLOYMENT cannot reach both moved to
 // register-unreachable.mjs, unchanged, because Depth 2's count and record lanes need the same
 // two answers and a second binding of the member→variable lookup is how two lanes come to disagree
@@ -9170,6 +9203,64 @@ async function pipelineInner(job, opts = {}) {
         runLog(run.runDir, { event: "common-law-half-quarantined", half: h, fail: String(clHalves[h].fail).slice(0, 140) });
       }
     }
+    // The engine's own re-issue, spent at most once per run — the bound spans BOTH the half-stage
+    // hook below and the merge gate's disclosure, so a run never buys the same search twice.
+    let clConnotationReissueSpent = false;
+    // ── THE MEANING HALF FELL SHORT BY A SEARCH OR TWO: RE-ISSUE, THEN DELIVER ───────────────────
+    //
+    // This is where the clearance actually died. The half's own validator refuses when a dictated
+    // meaning search is missing from its receipts, and every attempt refused identically — eight of
+    // them — so the run was thrown away with fifty-nine of sixty searches done and recorded.
+    //
+    // Quarantine above cannot help here: that is for a half that failed wholesale on transient
+    // infrastructure, where re-running the half converges. This half SUCCEEDED at almost everything.
+    // So the engine re-issues the missing searches itself, through the same provider, and re-judges the
+    // half on its own artifact. If they landed, the half is simply valid and nothing is disclosed.
+    //
+    // If they did not, the half is accepted WITH THE SHORTFALL RECORDED — an honest gap per unfinished
+    // search, carrying its term, which the merge gate then discloses and the coverage row reads. That is
+    // the owner's ruling of 2026-09-17 and it is not the false-clean the gates guard: false-clean is
+    // silence, and this says on the client's own page which search did not complete.
+    if (clSplit && !clHalves[MEANING_SEAT].ok && /connotation_query_unrecorded/.test(String(clHalves[MEANING_SEAT].fail ?? ""))) {
+      const h = MEANING_SEAT;
+      let short = [];
+      try {
+        const spec = JSON.parse(readFileSync(P.gridSpecHalf(h), "utf8"));
+        const halfLedger = JSON.parse(readFileSync(P.commonLawGridHalf(h), "utf8"));
+        short = findDroppedConnotationQueries(spec, halfLedger);
+        if (short.length) {
+          runLog(run.runDir, { event: "connotation-reissue", half: h, count: short.length });
+          note(`the meaning half recorded all but ${short.length} of its dictated searches — the engine re-issues `
+            + `${short.length === 1 ? "it" : "them"} itself rather than asking for the sweep again`);
+          clConnotationReissueSpent = true;
+          const reissuer = opts.connotationReissuer ?? defaultConnotationReissuer;
+          const r = await reissuer(short, { spec });
+          runLog(run.runDir, { event: "connotation-reissue-result", ok: !!r?.ok,
+            recovered: Array.isArray(r?.rows) ? r.rows.length : 0,
+            cause: r?.ok ? null : String(r?.cause ?? "").slice(0, 160) });
+          const rows = (r?.ok && Array.isArray(r.rows)) ? r.rows : [];
+          halfLedger.extras = halfLedger.extras ?? {};
+          halfLedger.extras.pr_risk = [...(Array.isArray(halfLedger.extras.pr_risk) ? halfLedger.extras.pr_risk : []), ...rows];
+          const stillShort = findDroppedConnotationQueries(spec, halfLedger);
+          if (stillShort.length) {
+            halfLedger.gaps = Array.isArray(halfLedger.gaps) ? halfLedger.gaps : [];
+            for (const q of stillShort)
+              halfLedger.gaps.push({ term: q, platform: "connotation",
+                error: "the search did not complete after a re-ask and a re-issue by the engine" });
+            runLog(run.runDir, { event: "connotation-unfinished-disclosed", count: stillShort.length, half: h });
+            note(`${stillShort.length} dictated meaning quer${stillShort.length === 1 ? "y" : "ies"} did not complete — `
+              + "recorded as honest gaps and DISCLOSED on the coverage row; the run delivers the rest");
+          }
+          atomicWrite(P.commonLawGridHalf(h), JSON.stringify(halfLedger, null, 2) + "\n");
+          // The half is accepted on its re-judged artifact. Same shape as quarantine above: the stage is
+          // not re-run and the model is not asked again.
+          clHalves[h].ok = true;
+          gatherResults[clHalves[h].i] = { ...gatherResults[clHalves[h].i], ok: true, fail: null, clHalfShortfall: stillShort.length };
+        }
+      } catch (err) {
+        runLog(run.runDir, { event: "connotation-reissue-failed", error: String(err?.message ?? err).slice(0, 160) });
+      }
+    }
     gather.forEach((g, i) => must(gatherResults[i], g.name + (g.axis ? `:${g.axis}` : "")));
     // winning session key per axis → a later escalation resumes the EXACT key the unit succeeded on.
     // (register units only — a common-law half's axis is its half id, tracked in clHalves, never here.)
@@ -9184,7 +9275,7 @@ async function pipelineInner(job, opts = {}) {
     // synthesis, replay) reads exactly the artifacts a single-member run would have written. Re-run after
     // every routed half followup (closure / frame-reopen) — the half files stay the source of truth and
     // the canonical pair is always derived, which also makes the merge resume-idempotent.
-    const mergeCommonLawArtifacts = !clSplit ? null : () => {
+    const mergeCommonLawArtifacts = !clSplit ? null : ({ discloseUnfinished = false } = {}) => {
       // Each half's coverage truth = its plugin-written main ledger FOLDED with any plugin-written
       // supplementary sibling(s) the closure lane produced. Returns the batches as an ARRAY (mergeGrids'
       // batchesOf flattens it, cells union across all of them); a missing/corrupt main leaves its cells to
@@ -9355,6 +9446,40 @@ async function pipelineInner(job, opts = {}) {
       // behaviour was zero retries after full spend, with a re-run that failed identically; the new
       // behaviour is one retry, then the same honest death.
       const dropped = findDroppedConnotationQueries(fullSpec, mergedGrid);
+      if (dropped.length && discloseUnfinished) {
+        // ── THE LAST STEP OF THE OWNER'S RULING: a run that completed 59 of 60 dictated searches
+        // DELIVERS, and says on the client's own page that it was partial and for which term.
+        //
+        // This is NOT the false-clean the note below guards against, and the difference is the whole
+        // reason it is allowed here. False-clean is SILENCE — a hole counted as searched, nobody able to
+        // see what was not done. This records each unfinished query as an honest gap carrying its own
+        // term, which is the vocabulary the note above says dictated queries did not have, and that gap
+        // is what the coverage row reads. A reader is told the investigation was partial and which term
+        // did not complete.
+        //
+        // It is reached ONLY after the bounded attempts are spent: the model's single routed remedy and
+        // the engine's own re-issue of the search. On the first pass this branch does not exist — the
+        // gate throws exactly as before and the park loop gets its retries. Disclosure is the last
+        // resort, never the first answer.
+        const errored = findErroredConnotationQueries(fullSpec, mergedGrid);
+        const explained = new Set(errored.map((e) => e.query));
+        const gaps = Array.isArray(mergedGrid.gaps) ? mergedGrid.gaps : (mergedGrid.gaps = []);
+        for (const q of dropped) {
+          if (explained.has(q)) continue;          // the provider already said why; its row stands
+          gaps.push({ term: q, platform: "connotation",
+            error: "the search did not complete after a re-ask and a re-issue by the engine" });
+        }
+        // THE CANONICAL LEDGER IS WRITTEN ABOVE, BEFORE THIS GATE RUNS, so mutating the merged object
+        // here reaches nothing: the report reads the file. Re-write it with the gaps in place, or the
+        // disclosure exists only in memory and the coverage row has nothing to read — which is the
+        // silent half of the very defect this branch exists to prevent.
+        atomicWrite(P.commonLawGrid, JSON.stringify(mergedGrid, null, 2) + "\n");
+        runLog(run.runDir, { event: "connotation-unfinished-disclosed", count: dropped.length,
+          explained: errored.length, terms: dropped.length });
+        note(`${dropped.length} dictated meaning quer${dropped.length === 1 ? "y" : "ies"} did not complete after `
+          + "the bounded attempts — recorded as honest gaps and DISCLOSED on the coverage row; the run delivers");
+        return { mergedGrid, fullSpec, connotationUnfinished: dropped.slice() };
+      }
       if (dropped.length) {
         const errored = findErroredConnotationQueries(fullSpec, mergedGrid);
         const allExplained = errored.length === dropped.length;
@@ -9385,6 +9510,54 @@ async function pipelineInner(job, opts = {}) {
     // retrying a defect buys nothing; this is one dictated repair, not a retry). Quarantined-half shapes
     // keep their transient park path untouched (the remedy never runs for them).
     let clConnotationRemedySpent = false;
+    /**
+     * THE ENGINE'S OWN ATTEMPT, THEN DELIVERY WITH THE GAP DISCLOSED.
+     *
+     * Reached only after the model has had its single routed repair turn. The engine re-issues the
+     * missing searches itself through the same provider, appends whatever comes back to the half's own
+     * ledger, and re-merges. If the searches are there now, the run is simply clean and nothing is
+     * disclosed. If they are still missing, the run DELIVERS and the coverage row says the investigation
+     * was partial and which term did not complete.
+     *
+     * A clearance that completed 59 of 60 dictated searches used to throw the whole report away. The
+     * failure it is replacing is not a quality gate doing its job: the work was done, one search of
+     * sixty did not land, and the client lost everything including the 59.
+     */
+    const reissueThenDisclose = async (e) => {
+      if (!clConnotationReissueSpent) {
+        clConnotationReissueSpent = true;
+        let missing = [];
+        try {
+          const spec = JSON.parse(readFileSync(P.gridSpecHalf(MEANING_SEAT), "utf8"));
+          const merged = JSON.parse(readFileSync(P.commonLawGrid, "utf8"));
+          missing = findDroppedConnotationQueries(spec, merged);
+          if (missing.length) {
+            runLog(run.runDir, { event: "connotation-reissue", count: missing.length });
+            note(`${missing.length} dictated meaning quer${missing.length === 1 ? "y" : "ies"} missing after the `
+              + "model's one repair turn — the engine re-issues them itself through the same tool");
+            const reissuer = opts.connotationReissuer ?? defaultConnotationReissuer;
+            const r = await reissuer(missing, { spec });
+            runLog(run.runDir, { event: "connotation-reissue-result", ok: !!r?.ok,
+              recovered: Array.isArray(r?.rows) ? r.rows.length : 0,
+              cause: r?.ok ? null : String(r?.cause ?? "").slice(0, 160) });
+            if (r?.ok && r.rows?.length) {
+              // Append into the half's OWN ledger, so the ordinary re-merge picks them up and nothing
+              // downstream needs to know this call happened.
+              const half = JSON.parse(readFileSync(P.commonLawGridHalf(MEANING_SEAT), "utf8"));
+              half.extras = half.extras ?? {};
+              half.extras.pr_risk = [...(Array.isArray(half.extras.pr_risk) ? half.extras.pr_risk : []), ...r.rows];
+              atomicWrite(P.commonLawGridHalf(MEANING_SEAT), JSON.stringify(half, null, 2) + "\n");
+            }
+          }
+        } catch (err) {
+          // Never fatal: a re-issue that cannot even be attempted leaves the run exactly where it was,
+          // and the disclosure below is what the ruling actually guarantees.
+          runLog(run.runDir, { event: "connotation-reissue-failed", error: String(err?.message ?? err).slice(0, 160) });
+        }
+        try { return mergeCommonLawArtifacts(); } catch { /* still short — disclose below */ }
+      }
+      return mergeCommonLawArtifacts({ discloseUnfinished: true });
+    };
     const mergeWithConnotationRemedy = !clSplit ? null : async () => {
       try { return mergeCommonLawArtifacts(); }
       catch (e) {
@@ -9408,7 +9581,21 @@ async function pipelineInner(job, opts = {}) {
         // the token inline must keep opening this channel.
         const tok = connotationRemedyToken(e);
         const anyQuarantined = GRID_SEATS.some((h) => clHalves[h].quarantined);
-        if (!tok || anyQuarantined || clConnotationRemedySpent) throw e;
+        // A quarantined half keeps its transient park path: that half is re-run whole and the re-merge
+        // converges, so there is nothing here to disclose yet.
+        // THE DROPPED-QUERY FAILURE CARRIES NO FORM TOKEN, and matching on the form tokens alone is why
+        // this channel never opened for it: `connotationRemedyToken` reads the connotation FORM
+        // vocabulary, and "merged half-grids dropped N dictated connotation queries" is not in it. The
+        // run therefore died at the merge with the recovery path sitting unused beside it.
+        const droppedQueries = /dropped \d+ dictated connotation quer/i.test(String(e?.message ?? ""));
+        if (anyQuarantined) throw e;
+        if (droppedQueries) return await reissueThenDisclose(e);
+        if (!tok) throw e;
+        // ── ONE RE-ASK OF THE MODEL, THEN THE ENGINE TAKES OVER ──────────────────────────────────
+        // The loop stops being a loop. The model gets exactly one routed repair turn; after that the
+        // engine re-issues the search itself and, failing that, the run delivers with the gap disclosed.
+        // Before this, a second arrival here re-threw and the clearance died after a full paid gather.
+        if (clConnotationRemedySpent) return await reissueThenDisclose(e);
         clConnotationRemedySpent = true;
         runLog(run.runDir, { event: "connotation-remedy", detail: tok.slice(0, 200) });
         // — WHICH HALVES OWE ROWS, READ FROM THE FORM. This used to re-derive the violation set here,
@@ -9442,7 +9629,8 @@ async function pipelineInner(job, opts = {}) {
           const r = await stage("common-law-half", { ...ctx, axis: h }, { force: true, followup, sessionKey: clHalves[h].sessionKey, trigger: "connotation-remedy" });
           if (!r.ok) note(`connotation remedy (half ${h}) failed mechanically (${r.fail}) — the re-merge below decides`);
         });
-        return mergeCommonLawArtifacts();
+        try { return mergeCommonLawArtifacts(); }
+        catch (e2) { return await reissueThenDisclose(e2); }
       }
     };
     if (clSplit) await mergeWithConnotationRemedy();

package/driver/publish/templates/report.css

@@ -339,7 +339,16 @@
        walks a rendered page and refuses any disclosure that is in neither list; the public suite does
        not run it, so the commit that added this fold could ship the half it did not think about. */
     .rrow>summary::before,.rgroup>summary::before,details.scope>summary::before,
-    details.searched>summary::before{content:""!important}
+    details.searched>summary::before,
+    /* `.cgroup` ("Dead filings — 6 names") and `.ma-more` ("By class and market (3)") are the same kind of
+       thing as the four above: summaries that CARRY content, so they print as static headers rather than
+       vanishing. They were in neither list, so the exported PDF drew their ▸ over content this block has
+       already forced fully open — thirteen of them, eight `.cgroup` and five `.ma-more`, across THREE of
+       the four search types: full country 5, global preliminary 5, multi-country focus 3. The knockout
+       report carries neither class and nothing in it changes. Found by the print check that now runs in
+       CI; the fixture the hand-run control walks carries neither class either, which is why two earlier
+       folds were caught there and these thirteen were not. */
+    .cgroup>summary::before,.markassess details.ma-more>summary::before{content:""!important}
     details{border-top:1px solid var(--line)}
     /* …AND THE HERO'S FOLD IS NOT A SECTION. The rule above separates the disclosures that ARE sections
        of the document; `details.sub-more` is one paragraph of the verdict caption folded away from

package/driver/result-noun-fields.mjs

@@ -74,8 +74,11 @@ export const RESULT_NOUN_FIELDS = Object.freeze([
     why: "the one member that reported an invocation — taint-rerun's `r.ok ? \"ok\" : …`, which travels on a StageFailure packet — now carries a `cleared` sibling read from the taint, the remedy 10/5 -> 11/6 at the profile-store receipt's `outcome: pr.outcome`. Classified by READING ITS WRITING SITE, which is profiles.mjs and not this file: the value is one of three literals chosen by a situation the resolver decided (`overlay` and `bundled-fallback` are `pass`, `env-arrived-late` is `blocked`), never a call's return read as a verdict. `bundled-fallback` being `pass` is the point of the whole receipt — a legitimate install that nobody was told about is what this row says out loud." },
   { file: "driver/pipeline.mjs", noun: "permanent", sites: 1, atWriteSite: 1, verdict: "result",
     why: "`permanent.length` — a count of the classified set" },
-  { file: "driver/pipeline.mjs", noun: "recovered", sites: 3, atWriteSite: 3, verdict: "result",
-    why: "each sits on a branch reached only after the gap was cleared; one follows a `throw` that guarantees the ledger exists" },
+  { file: "driver/pipeline.mjs", noun: "recovered", sites: 5, atWriteSite: 5, verdict: "result",
+    why: "each sits on a branch reached only after the gap was cleared; one follows a `throw` that guarantees the ledger exists. "
+      + "The two newest record what an engine-side re-issue of a missing meaning search actually brought back, counted off the rows "
+      + "in hand at the write site rather than from anything the call promised — an attempt that recovered nothing writes 0, which "
+      + "is the fact the disclosure downstream depends on" },
   { file: "driver/pipeline.mjs", noun: "settled", sites: 5, atWriteSite: 4, verdict: "result",
     why: "counts off the union and the doubt ledger" },
   { file: "driver/pipeline.mjs", noun: "verified", sites: 3, atWriteSite: 1, verdict: "result",