clearotron 0.3.2-beta.6 → 0.3.2-beta.8

package/driver/pipeline.mjs

@@ -10,7 +10,7 @@ import { readFileSync, existsSync, mkdirSync, writeFileSync, renameSync, copyFil
 import { createHash } from "node:crypto";
 import { join, dirname, basename, resolve } from "node:path";   // resolve: the resume line must work from any cwd
 import { driverDir, driverRel, ensureDriverDir } from "../shared/driver-dir.mjs";   // — one definition of where `_driver/` is
-import { terminalClampDecision, orderClausesForLede, clientConditions } from "./terminal-clamp.mjs";   // — deliver and clamp, never withhold
+import { terminalClampDecision, orderClausesForLede, clientConditions, clauseForDefect } from "./terminal-clamp.mjs";   // — deliver and clamp, never withhold
 import { recordSpan } from "./attributed-span.mjs";   // — driver work the decomposition can attribute
 import { fileURLToPath } from "node:url";
 import { runStage, correctionHint, gridLedgerNameFor, draftCarryEligible, toolWrittenArtifact, selectEngine } from "./gateway.mjs";
@@ -31,7 +31,7 @@ import { buildRunContext, deriveSlug, kebab } from "./phase0.mjs";
 import { paths, STAGES, axisTier, decideAxes, assertTierSanity, assertEffectiveTier, lines, AGENT_WHATSAPP, whatsappRouting,
   chainEntries, stageOrdinal, stageInputs, stageOutputs, dependencyOrder, REGISTER_AXES, REGISTER_ENUMERATE_TOOL,
   buildEscalationFollowup, buildEnvelopeCloseFollowup, buildFrameReopenFollowup,
-  buildFrameReopenRetryMessage, thinkingFor, composeFollowup, stampDispatchBlocks, recordEmptyReturn, nothingFound, nothingToRead, PROVIDER_META, proseRungDirective, inquiryRungDirective } from "./stages.mjs"; import { bandSizeForStage } from "./band-size.mjs";
+  buildFrameReopenRetryMessage, thinkingFor, composeFollowup, stampDispatchBlocks, recordEmptyReturn, nothingFound, nothingToRead, PROVIDER_META, proseRungDirective, inquiryRungDirective } from "./stages.mjs"; import { bandSizeForStage, derivedLimitSec, limitExceedsCeiling, ceilingRefusal } from "./band-size.mjs";
 import { IDENTITY_FILE as REPORT_IDENTITY_FILE } from "./report-overview-record.mjs";
 import { dispatchRows, clearedSignatures } from "./seat-attempts.mjs";
 import { CONTEXT_DERIVATIONS, DISPATCH_EXTRAS, INLINE_CONTEXT, sandboxManifest, sandboxGaps, derivationsFor } from "./stage-context.mjs";   // — what a stage is actually handed
@@ -45,7 +45,8 @@ import { readRegisterTaint, readActiveTaintAxes } from "./register-taint.mjs";
 import { parseNamedBand, mergeNamedBands, findCollapsedBands, quarantineUnknownStates, taintQuarantineCleanBlocks, bandRecords } from "./named-band.mjs";
 import { recordOriginsFor } from "./record-origins.mjs";
 import { REGISTER_PROVIDER } from "./driver.config.mjs";
-import { FACTS_FILE as DIGEST_FACTS_FILE, ACCOUNTING_STAMP as DIGEST_ACCOUNTING_STAMP, recordedFindingUris } from "./register-digest-record.mjs";   // conversion 11 — the render's facts sidecar and the accounting era stamp
+import { FACTS_FILE as DIGEST_FACTS_FILE, ACCOUNTING_STAMP as DIGEST_ACCOUNTING_STAMP, recordedFindingUris,
+  digestAccountingGap, digestBatchBrief, batchesOf } from "./register-digest-record.mjs";   // conversion 11 — the render's facts sidecar and the accounting era stamp
 import { buildBandShape, dominantElementComposites, deriveRegisterPositions, floorTierByMark, floorMarkKey } from "./band-shape.mjs";   // PR-8 — the deterministic reading layer; P2-A — candidates + positions
 import { deriveOwnerScreen, ownerScreenNegative } from "./owner-screen.mjs";   // P2-B — the owner×element screen's own receipt
 import { reconcileRecall, parseFindingsEndings, parseCrowdRulings, readOkRecordUris,
@@ -96,8 +97,10 @@ import { publishReport, composeEmailHtml, deliverySubject } from "./publish/inde
 import { parseCaseLawProfiles, joinCaseLawProfiles } from "./publish/parse.mjs";
 import { buildAuditMd, parseSpineFindingBlocks } from "./publish/audit-from-spine.mjs";
 import { deriveRegisterPresence } from "./publish/register-presence.mjs";   // — the audit stores every live in-scope record
-import { lastAcceptedMatterFrame, frameIdentifiedClasses } from "./matter-frame-record.mjs";   // — the frame's inferred scope, when nothing was instructed; and the classes it judged necessary beyond the instructed ones, which the plan compile unions in
-import { romanizedTermsFromPlan, mintSupplementalQid } from "./register-plan.mjs";   // — the stamp the late lanes never met
+import { lastAcceptedMatterFrame, frameIdentifiedClasses, frameHouseElementCandidate } from "./matter-frame-record.mjs";   // — the frame's inferred scope, when nothing was instructed; and the classes it judged necessary beyond the instructed ones, which the plan compile unions in
+import { romanizedTermsFromPlan, mintSupplementalQid } from "./register-plan.mjs";
+import { excludeHouseElement, verifyHouseElementOwnership, resolveRegions as resolvePlanRegions, HOUSE_ELEMENT_RECEIPT } from "./register-plan.mjs";   // 647 — the client's own element leaves the conflict analysis only on a verified receipt
+import { resolveRecordExecutor } from "./register-records.mjs";   // — the stamp the late lanes never met
 import { slimLine, crowdLine } from "./hit-list.mjs";   // — the list the run works from; crowds ride it as a sibling array
 import { mintCrossCheckDoubts, mintContradictionDoubts, stitchDoubts, applyClosure } from "./doubt-ledger.mjs";   // doubt-stitch + doubt-closure (2026-07-22)
 // Conversion 6: the two line-form parsers are no longer on the live path — the seat sends typed
@@ -201,6 +204,39 @@ async function defaultRecordFetcher(uri, ctx) {
   return activeProvider().recordFetch(uri, ctx);
 }
 
+/**
+ * THE ENGINE RE-ISSUES A DICTATED MEANING SEARCH ITSELF, without asking the assessing model to redo the
+ * sweep — the same shape as `defaultRecordFetcher` above, which fetches a register record in code when
+ * one was dropped unexamined rather than sending the model back for it.
+ *
+ * "Through the same tool" is literal and costs no new machinery: the research provider's grid functions
+ * are a plain module with no listener, so the component the model calls and this one call the SAME
+ * functions on the same provider. There is no second implementation to drift.
+ *
+ * NARROW BY CONSTRUCTION. The spec handed over carries only the queries that are missing, so this buys
+ * those cells rather than re-running a sweep that already cost real money and real minutes.
+ *
+ * It DECIDES nothing. The caller re-merges and the gate judges, so a re-issue that comes back empty is
+ * simply a re-merge that still fails, and is disclosed as such rather than counted as searched.
+ */
+async function defaultConnotationReissuer(queries, { spec, modelOverride = null } = {}) {
+  const apiKey = process.env.PERPLEXITY_API_KEY || "";
+  if (!apiKey) return { ok: false, cause: "no research credential in the driver environment", rows: [] };
+  const core = await import("../providers/perplexity/src/core.js");
+  const narrow = { ...spec, connotation: { ...(spec.connotation ?? {}), queries: queries.slice() } };
+  try {
+    const task = core.buildGridProgramTask(narrow);
+    const data = await core.callAgentAPI(apiKey,
+      core.buildRequestBody({ task, preset: "pro-search", modelOverride, enableSandbox: true }));
+    const cap = core.captureGridFromResponse(data, narrow);
+    if (!cap?.ok) return { ok: false, cause: String(cap?.error ?? "capture failed").slice(0, 160), rows: [] };
+    const rows = parsePrRiskResults(cap.ledgerJson).filter((r) => queries.includes(r.query));
+    return { ok: true, rows, requested: queries.length };
+  } catch (e) {
+    return { ok: false, cause: String(e?.message ?? e).slice(0, 160), rows: [] };
+  }
+}
+
 // The ACTIVE provider's capability contract and the offices this DEPLOYMENT cannot reach both moved to
 // register-unreachable.mjs, unchanged, because Depth 2's count and record lanes need the same
 // two answers and a second binding of the member→variable lookup is how two lanes come to disagree
@@ -2225,6 +2261,69 @@ function logFullyDeferredAxes(plan, P, source) {
 // `frozenOnly` (item): read the FROZEN plan or nothing. reconstructCtx is an introspection path —
 // it must never compile and freeze a plan into an existing run as a side effect of being asked what the
 // run already holds. (attachProfile / attachFramework take the same posture via `write:false`.)
+/**
+ * Ask the register whether the client owns the element the frame proposed, and record the answer.
+ *
+ * ASYNC AND SEPARATE FROM THE COMPILE, which is why it is its own step rather than a branch inside
+ * `attachRegisterPlan`: that function is synchronous and is called on the resume path too. The shape is
+ * the digest's — an async driver step writes a receipt, a synchronous consumer reads it — and it buys
+ * the property that matters here: the compile cannot accidentally exclude anything by reaching for a
+ * promise it does not await.
+ *
+ * NOT A REGISTERED CONTEXT DERIVATION, and the reason is worth stating because the obvious reading is
+ * that it should be. `stage-context.mjs` declares the derivations a sandbox can REPLAY, and its runners
+ * are synchronous. This one asks a live register a question; there is no offline re-derivation of that,
+ * and declaring it would promise the `--experiment` rig something no runner can deliver — which the
+ * guard catches by name, loudly, as it should. A sandbox instead inherits the receipt with the rest of
+ * `_driver/`, and a sandbox that has none excludes nothing, which is the same answer every other
+ * unverified run gets.
+ *
+ * NEVER-KILL. Every failure writes an unverified receipt and the run plans exactly as it does today.
+ * The element being searched in full is the safe direction and the status quo; the only thing that can
+ * narrow a client's search is a register answer naming their own live registration.
+ */
+async function verifyAndRecordHouseElement(ctx, opts = {}) {
+  const P = ctx.paths;
+  try {
+    const proposed = frameHouseElementCandidate(P.runDir);
+    if (!proposed) return;   // the ordinary case: the frame proposed nothing and there is no question
+
+    const classes = [...new Set([...inScopeClassList(ctx.job, ctx.profile).map(String), ...frameIdentifiedClasses(P.runDir)])];
+    // THE CLIENT'S OWN NAMES. The profile's trading names are the curated list; the matter's customer is
+    // the free-text one. Both, because a profile may be absent on a one-off matter and a customer string
+    // may be a person where the filings are held by a company.
+    const owners = [...new Set([...(ctx.profile?.selfExclusionOwners ?? []), ctx.job?.customer].map((o) => String(o ?? "").trim()).filter(Boolean))];
+    const caps = registerCapabilities();
+    const { regions } = resolvePlanRegions(registerJurisdictions(ctx.job, ctx.profile), caps);
+    const rec = resolveRecordExecutor({
+      lister: opts?.recordLister ?? null, adapter: activeProvider(),
+      agentId: ctx.agentId ?? null, sessionKey: `prelim-${ctx.run.slug}-${ctx.run.codename}`,
+      recordLog: runRecordLogPath(P.runDir),
+      fixtureDir: ctx.job?.registerFixtures?.records ?? null,
+    });
+    // AN EXACT-NAME LISTING OF THE ELEMENT, filtered to the client's own live in-class registrations by
+    // the verifier. The owner join is done on REAL RECORDS the register returned, which is what
+    // "verified by owner, not asserted" means — there is no owner-predicate listing on this interface
+    // and inventing one would be a second way to ask the same question.
+    const lookup = typeof rec.list !== "function" ? null : async ({ element, classes: cls }) => {
+      const r = await rec.list(element, { classes: cls, regions, limit: 50 });
+      if (!r || r.ok === false) return { ok: false, reason: String(r?.reason ?? "the register listing did not answer") };
+      return { ok: true, records: Array.isArray(r.records) ? r.records : [] };
+    };
+
+    const receipt = await verifyHouseElementOwnership({ element: proposed.element, classes, owners, lookup });
+    receipt.remainder = proposed.remainder;   // carried so the compile needs only this one file
+    ensureDriverDir(P.runDir);
+    atomicWrite(driverDir(P.runDir, HOUSE_ELEMENT_RECEIPT), JSON.stringify(receipt, null, 2) + "\n");
+    runLog(P.runDir, { event: "house-element-ownership", verified: receipt.verified, reason: receipt.reason,
+      records: receipt.records.length, owners: owners.length, executor: rec.source });
+    if (!receipt.verified) note(`house element: ${proposed.element} stays in the search — ${receipt.reason}`);
+  } catch (e) {
+    // A THROW HERE MUST NOT COST A REPORT. No receipt means no exclusion, which is today's plan.
+    runLog(P.runDir, { event: "house-element-ownership-failed", reason: String(e?.message ?? e).slice(0, 160) });
+  }
+}
+
 function attachRegisterPlan(ctx, { frozenOnly = false } = {}) {
   const P = ctx.paths;
   if (frozenOnly) {
@@ -2248,7 +2347,30 @@ function attachRegisterPlan(ctx, { frozenOnly = false } = {}) {
   ctx.registerPlan = null;
   let compiled;
   try {
-    const manifest = parseVariantManifestModel(readFileSync(P.variantManifestModel, "utf8"));
+    let manifest = parseVariantManifestModel(readFileSync(P.variantManifestModel, "utf8"));
+    // ── 647 — THE CLIENT'S OWN ELEMENT LEAVES THE CONFLICT ANALYSIS, ON EVIDENCE OR NOT AT ALL ─────
+    //
+    // The receipt is the ONLY thing that arms this. An absent, unreadable or unverified receipt plans
+    // exactly as this compile did before the rule existed, which is the element searched in full — the
+    // safe direction, and the one a client is never harmed by.
+    let houseConfirmation = null;
+    let houseReceipt = null;
+    try { houseReceipt = JSON.parse(readFileSync(driverDir(P.runDir, HOUSE_ELEMENT_RECEIPT), "utf8")); }
+    catch { houseReceipt = null; }
+    if (houseReceipt?.verified === true) {
+      const r = excludeHouseElement(manifest, { element: houseReceipt.element, remainder: houseReceipt.remainder });
+      if (r.refused) {
+        // VERIFIED OWNERSHIP AND STILL NOT APPLIED. The receipt answers who owns the element; the
+        // transform answers whether this manifest's mark can survive the cut. Both must hold.
+        runLog(P.runDir, { event: "house-element-not-applied", reason: r.refused, element: houseReceipt.element });
+      } else {
+        manifest = r.manifest;
+        houseConfirmation = r.confirmation;
+        runLog(P.runDir, { event: "house-element-excluded", element: houseReceipt.element,
+          remainder: houseReceipt.remainder, dominant_element: manifest.dominant_element,
+          evidence: (houseReceipt.records ?? []).length });
+      }
+    }
     let form = null;
     try { form = JSON.parse(readFileSync(P.formNeighbourhood, "utf8")); } catch { /* form band optional */ }
     compiled = compileRegisterPlan({
@@ -2275,6 +2397,19 @@ function attachRegisterPlan(ctx, { frozenOnly = false } = {}) {
       // rides the plan as a disclosed deferral, never as a silently narrower search.
       unavailableOffices: registerUnavailableOffices(),
     });
+    // REQUIREMENT 3 — the element is still checked ONCE, as a confirmation of the client's own live
+    // registrations rather than as a conflict sweep, so the exclusion is evidenced on the report by a
+    // query that ran. Appended after the compile because it is not derived from the manifest: it is the
+    // one question about the element the plan still owes.
+    if (houseConfirmation && compiled?.entries) {
+      const used = new Set(compiled.entries.map((e) => e.qid));
+      compiled.entries.push({
+        ...houseConfirmation,
+        qid: mintSupplementalQid({ prefix: "house", term: houseConfirmation.term, used }),
+        nice_classes: compiled.nice_classes ?? [],
+        regions: compiled.regions ?? [],
+      });
+    }
   } catch (e) {
     // NEVER-KILL at mint time: no/malformed sibling or a class-less matter degrades to the legacy
     // path with a logged reason — the plan improves the run, it never turns delivery off.
@@ -3615,6 +3750,27 @@ export function digestDispatchExtra(ctx, { trigger = "fresh", willRun = true, ex
       }
     }
   } catch (e) { note(`coverage-form brief skipped (non-fatal — the form is in _driver/ and the validator refuses an unsettled row): ${String(e.message).slice(0, 80)}`); }
+  // — THE BATCH BLOCK: how the driver split this run's band, and which batches are still outstanding.
+  //
+  // The seat is told the split HERE rather than in the stage's dictation because the numbers are the
+  // run's, not the contract's: a band of 40 records is one batch and a band of 1,161 is twelve, and on a
+  // resume the outstanding set is what the killed attempt did not reach. The dictation says the rule;
+  // this says the arithmetic.
+  //
+  // BEST-EFFORT, AND SAFE BY CONSTRUCTION rather than by argument — the coverage brief's precedent above,
+  // for its reason. Nothing here enforces anything: a call naming a batch is judged against the driver's
+  // own split whether or not this block composed, the tool's refusal re-states what is outstanding, and
+  // the stage's exit gate refuses a document that ends fewer records than the run carried in. A brief
+  // that fails to compose costs a corrective round; it cannot cost a record.
+  try {
+    const gap = digestAccountingGap(P.runDir);
+    const block = digestBatchBrief(gap);
+    if (block) {
+      out = out ? `${out}\n\n${block}` : block;
+      runLog(P.runDir, { event: "digest-batch-brief", trigger, owed: gap.owed.length,
+        batches: batchesOf(gap.owed).length, unaccounted: gap.unaccounted.length });
+    }
+  } catch (e) { note(`digest batch brief skipped (non-fatal — the tool judges every batch against the driver's own split regardless): ${String(e.message).slice(0, 80)}`); }
   // AD-2 A9 (E2E-R2) + the P5 review (2026-07-31): a corrective/repair pass is told NOT to re-read the
   // whole placement file — the per-candidate tiers are in placements.json — but the RULINGS TAIL (band
   // reconciliation, disagreements, coverage rulings, open questions) lives ONLY in the md. Leaving it to
@@ -4309,6 +4465,25 @@ async function stageOnce(name, ctx, opts = {}) {
   // Evaluated on `effThinking`, not `thinking`: the anthropic gate above nulls the tier for a
   // cross-provider model, and a guard that reads the nulled value would go blind on the same overrides.
   assertEffectiveTier(label, { model, thinking: effThinking });
+  // ── THE TIME LIMIT IS DERIVED FROM THE BAND THIS DISPATCH IS HANDED ─────────────────────────────
+  //
+  // `def.timeoutSec` was a constant chosen once against a band nobody recorded beside it, and on a
+  // dense matter the two band-reading stages died AT their walls having written nothing. The base is
+  // still the stage's own number; what the band decides is how far above it this dispatch may go. A
+  // band at or under the reference returns the base untouched, so nothing already verified moves.
+  const dispatchBand = bandSizeForStage(name, P);
+  const derivedLimit = derivedLimitSec(def.timeoutSec, dispatchBand);
+  // REFUSED BEFORE A SEAT IS DISPATCHED, not after the wall. A limit past the ceiling is a prediction
+  // that this stage will be killed; starting it spends the whole prediction to arrive where the refusal
+  // already is, and the refusal NAMES the band size, which is the finding a killed attempt never gives.
+  if (limitExceedsCeiling(derivedLimit.sec)) {
+    const reason = ceilingRefusal(name, derivedLimit);
+    runLog(P.runDir, { event: "stage-input-over-ceiling", stage: name,
+      inputBytes: derivedLimit.inputBytes, derivedLimitSec: derivedLimit.sec });
+    throw new StageFailure(name, reason, undefined, { failClass: "deterministic" });
+  }
+  runLog(P.runDir, { event: "stage-limit-derived", stage: name, base: def.timeoutSec,
+    inputBytes: derivedLimit.inputBytes, derivedLimitSec: derivedLimit.sec, basis: derivedLimit.basis });
   const r = await runStage(label, {
     agent: execAgent,
     message,
@@ -4317,11 +4492,12 @@ async function stageOnce(name, ctx, opts = {}) {
     // opts.sessionKey lets a followup RESUME the exact key a prior run won on (winning-key hardening); else
     // the canonical base key. (A followup with a stale base key would resume a failed attempt — see runStage.)
     sessionKey: opts.sessionKey ?? `prelim-${ctx.run.slug}-${ctx.run.codename}-${name}${keyAxis}`,
-    timeoutSec: def.timeoutSec,
+    timeoutSec: derivedLimit.sec ?? def.timeoutSec,
+    derivedLimit,               // recorded on every attempt row: the size it was derived from, and the number
     stallSec: def.stallSec,     // per-stage stall override (heavy stages); undefined → global CLEAROTRON_STALL_MS
     expectFile: out,
     validate: def.validate,
-    runDir: P.runDir, bandSize: bandSizeForStage(name, P),
+    runDir: P.runDir, bandSize: dispatchBand,
     // ── — THE PRESENTING SIDE, RECOMPOSED PER ATTEMPT ────────────────────────────────────────
     //
     // A stage that declares `refreshCtx` is saying its dispatch text depends on state the run CHANGES
@@ -7296,7 +7472,7 @@ export function fullProseOrdinals(findings) {
     .filter((o) => o != null);
 }
 // ASSEMBLE report.md = the overview shell (front-matter + Actions/Coverage/Methodology) + `# Marks` + the
-// per-card files in render order (composite desc, ordinal asc — mirrors render.mjs:502), `open: true` on the
+// per-card files in render order (composite desc, ordinal asc — mirrors render.mjs `sortedAll`), `open: true` on the
 // single top card. Findings with no card file (a failed report-card, or a secondary finding) are NOT emitted —
 // render.mjs synthesizes them structured-only from findings.json, so nothing is silently dropped. Pure file IO.
 // spec 64 — "### Only you can close these" is CODE-BUILT from the typed actions register (the report-
@@ -8816,6 +8992,7 @@ async function pipelineInner(job, opts = {}) {
     must(await stage("prelim-variants", ctx), "prelim-variants");
     deriveScopeLedgerJson(ctx);   // frame-omission design: code-derive scope-ledger.json from the validated prose (never-kill)
     deriveFormNeighbourhood(ctx); // mechanical FORM band: code-derive form-neighbourhood.json from the manifest's distinctive element(s) — the model-free form floor the register funnel searches (never-kill)
+    await verifyAndRecordHouseElement(ctx, opts);   // ask the register who owns the frame's proposed house element, BEFORE the plan is compiled from it
     attachRegisterPlan(ctx);      // WS2 (B3): compile/freeze/reuse the deterministic register plan (flag-gated; frozen plan wins on resume; never-kill on mint)
 
     // spec 64 (B2) — proactive recall probes: prior-confirmed conflicts for THIS mark (the workspace
@@ -9170,6 +9347,64 @@ async function pipelineInner(job, opts = {}) {
         runLog(run.runDir, { event: "common-law-half-quarantined", half: h, fail: String(clHalves[h].fail).slice(0, 140) });
       }
     }
+    // The engine's own re-issue, spent at most once per run — the bound spans BOTH the half-stage
+    // hook below and the merge gate's disclosure, so a run never buys the same search twice.
+    let clConnotationReissueSpent = false;
+    // ── THE MEANING HALF FELL SHORT BY A SEARCH OR TWO: RE-ISSUE, THEN DELIVER ───────────────────
+    //
+    // This is where the clearance actually died. The half's own validator refuses when a dictated
+    // meaning search is missing from its receipts, and every attempt refused identically — eight of
+    // them — so the run was thrown away with fifty-nine of sixty searches done and recorded.
+    //
+    // Quarantine above cannot help here: that is for a half that failed wholesale on transient
+    // infrastructure, where re-running the half converges. This half SUCCEEDED at almost everything.
+    // So the engine re-issues the missing searches itself, through the same provider, and re-judges the
+    // half on its own artifact. If they landed, the half is simply valid and nothing is disclosed.
+    //
+    // If they did not, the half is accepted WITH THE SHORTFALL RECORDED — an honest gap per unfinished
+    // search, carrying its term, which the merge gate then discloses and the coverage row reads. That is
+    // the owner's ruling of 2026-09-17 and it is not the false-clean the gates guard: false-clean is
+    // silence, and this says on the client's own page which search did not complete.
+    if (clSplit && !clHalves[MEANING_SEAT].ok && /connotation_query_unrecorded/.test(String(clHalves[MEANING_SEAT].fail ?? ""))) {
+      const h = MEANING_SEAT;
+      let short = [];
+      try {
+        const spec = JSON.parse(readFileSync(P.gridSpecHalf(h), "utf8"));
+        const halfLedger = JSON.parse(readFileSync(P.commonLawGridHalf(h), "utf8"));
+        short = findDroppedConnotationQueries(spec, halfLedger);
+        if (short.length) {
+          runLog(run.runDir, { event: "connotation-reissue", half: h, count: short.length });
+          note(`the meaning half recorded all but ${short.length} of its dictated searches — the engine re-issues `
+            + `${short.length === 1 ? "it" : "them"} itself rather than asking for the sweep again`);
+          clConnotationReissueSpent = true;
+          const reissuer = opts.connotationReissuer ?? defaultConnotationReissuer;
+          const r = await reissuer(short, { spec });
+          runLog(run.runDir, { event: "connotation-reissue-result", ok: !!r?.ok,
+            recovered: Array.isArray(r?.rows) ? r.rows.length : 0,
+            cause: r?.ok ? null : String(r?.cause ?? "").slice(0, 160) });
+          const rows = (r?.ok && Array.isArray(r.rows)) ? r.rows : [];
+          halfLedger.extras = halfLedger.extras ?? {};
+          halfLedger.extras.pr_risk = [...(Array.isArray(halfLedger.extras.pr_risk) ? halfLedger.extras.pr_risk : []), ...rows];
+          const stillShort = findDroppedConnotationQueries(spec, halfLedger);
+          if (stillShort.length) {
+            halfLedger.gaps = Array.isArray(halfLedger.gaps) ? halfLedger.gaps : [];
+            for (const q of stillShort)
+              halfLedger.gaps.push({ term: q, platform: "connotation",
+                error: "the search did not complete after a re-ask and a re-issue by the engine" });
+            runLog(run.runDir, { event: "connotation-unfinished-disclosed", count: stillShort.length, half: h });
+            note(`${stillShort.length} dictated meaning quer${stillShort.length === 1 ? "y" : "ies"} did not complete — `
+              + "recorded as honest gaps and DISCLOSED on the coverage row; the run delivers the rest");
+          }
+          atomicWrite(P.commonLawGridHalf(h), JSON.stringify(halfLedger, null, 2) + "\n");
+          // The half is accepted on its re-judged artifact. Same shape as quarantine above: the stage is
+          // not re-run and the model is not asked again.
+          clHalves[h].ok = true;
+          gatherResults[clHalves[h].i] = { ...gatherResults[clHalves[h].i], ok: true, fail: null, clHalfShortfall: stillShort.length };
+        }
+      } catch (err) {
+        runLog(run.runDir, { event: "connotation-reissue-failed", error: String(err?.message ?? err).slice(0, 160) });
+      }
+    }
     gather.forEach((g, i) => must(gatherResults[i], g.name + (g.axis ? `:${g.axis}` : "")));
     // winning session key per axis → a later escalation resumes the EXACT key the unit succeeded on.
     // (register units only — a common-law half's axis is its half id, tracked in clHalves, never here.)
@@ -9184,7 +9419,7 @@ async function pipelineInner(job, opts = {}) {
     // synthesis, replay) reads exactly the artifacts a single-member run would have written. Re-run after
     // every routed half followup (closure / frame-reopen) — the half files stay the source of truth and
     // the canonical pair is always derived, which also makes the merge resume-idempotent.
-    const mergeCommonLawArtifacts = !clSplit ? null : () => {
+    const mergeCommonLawArtifacts = !clSplit ? null : ({ discloseUnfinished = false } = {}) => {
       // Each half's coverage truth = its plugin-written main ledger FOLDED with any plugin-written
       // supplementary sibling(s) the closure lane produced. Returns the batches as an ARRAY (mergeGrids'
       // batchesOf flattens it, cells union across all of them); a missing/corrupt main leaves its cells to
@@ -9355,6 +9590,40 @@ async function pipelineInner(job, opts = {}) {
       // behaviour was zero retries after full spend, with a re-run that failed identically; the new
       // behaviour is one retry, then the same honest death.
       const dropped = findDroppedConnotationQueries(fullSpec, mergedGrid);
+      if (dropped.length && discloseUnfinished) {
+        // ── THE LAST STEP OF THE OWNER'S RULING: a run that completed 59 of 60 dictated searches
+        // DELIVERS, and says on the client's own page that it was partial and for which term.
+        //
+        // This is NOT the false-clean the note below guards against, and the difference is the whole
+        // reason it is allowed here. False-clean is SILENCE — a hole counted as searched, nobody able to
+        // see what was not done. This records each unfinished query as an honest gap carrying its own
+        // term, which is the vocabulary the note above says dictated queries did not have, and that gap
+        // is what the coverage row reads. A reader is told the investigation was partial and which term
+        // did not complete.
+        //
+        // It is reached ONLY after the bounded attempts are spent: the model's single routed remedy and
+        // the engine's own re-issue of the search. On the first pass this branch does not exist — the
+        // gate throws exactly as before and the park loop gets its retries. Disclosure is the last
+        // resort, never the first answer.
+        const errored = findErroredConnotationQueries(fullSpec, mergedGrid);
+        const explained = new Set(errored.map((e) => e.query));
+        const gaps = Array.isArray(mergedGrid.gaps) ? mergedGrid.gaps : (mergedGrid.gaps = []);
+        for (const q of dropped) {
+          if (explained.has(q)) continue;          // the provider already said why; its row stands
+          gaps.push({ term: q, platform: "connotation",
+            error: "the search did not complete after a re-ask and a re-issue by the engine" });
+        }
+        // THE CANONICAL LEDGER IS WRITTEN ABOVE, BEFORE THIS GATE RUNS, so mutating the merged object
+        // here reaches nothing: the report reads the file. Re-write it with the gaps in place, or the
+        // disclosure exists only in memory and the coverage row has nothing to read — which is the
+        // silent half of the very defect this branch exists to prevent.
+        atomicWrite(P.commonLawGrid, JSON.stringify(mergedGrid, null, 2) + "\n");
+        runLog(run.runDir, { event: "connotation-unfinished-disclosed", count: dropped.length,
+          explained: errored.length, terms: dropped.length });
+        note(`${dropped.length} dictated meaning quer${dropped.length === 1 ? "y" : "ies"} did not complete after `
+          + "the bounded attempts — recorded as honest gaps and DISCLOSED on the coverage row; the run delivers");
+        return { mergedGrid, fullSpec, connotationUnfinished: dropped.slice() };
+      }
       if (dropped.length) {
         const errored = findErroredConnotationQueries(fullSpec, mergedGrid);
         const allExplained = errored.length === dropped.length;
@@ -9385,6 +9654,54 @@ async function pipelineInner(job, opts = {}) {
     // retrying a defect buys nothing; this is one dictated repair, not a retry). Quarantined-half shapes
     // keep their transient park path untouched (the remedy never runs for them).
     let clConnotationRemedySpent = false;
+    /**
+     * THE ENGINE'S OWN ATTEMPT, THEN DELIVERY WITH THE GAP DISCLOSED.
+     *
+     * Reached only after the model has had its single routed repair turn. The engine re-issues the
+     * missing searches itself through the same provider, appends whatever comes back to the half's own
+     * ledger, and re-merges. If the searches are there now, the run is simply clean and nothing is
+     * disclosed. If they are still missing, the run DELIVERS and the coverage row says the investigation
+     * was partial and which term did not complete.
+     *
+     * A clearance that completed 59 of 60 dictated searches used to throw the whole report away. The
+     * failure it is replacing is not a quality gate doing its job: the work was done, one search of
+     * sixty did not land, and the client lost everything including the 59.
+     */
+    const reissueThenDisclose = async (e) => {
+      if (!clConnotationReissueSpent) {
+        clConnotationReissueSpent = true;
+        let missing = [];
+        try {
+          const spec = JSON.parse(readFileSync(P.gridSpecHalf(MEANING_SEAT), "utf8"));
+          const merged = JSON.parse(readFileSync(P.commonLawGrid, "utf8"));
+          missing = findDroppedConnotationQueries(spec, merged);
+          if (missing.length) {
+            runLog(run.runDir, { event: "connotation-reissue", count: missing.length });
+            note(`${missing.length} dictated meaning quer${missing.length === 1 ? "y" : "ies"} missing after the `
+              + "model's one repair turn — the engine re-issues them itself through the same tool");
+            const reissuer = opts.connotationReissuer ?? defaultConnotationReissuer;
+            const r = await reissuer(missing, { spec });
+            runLog(run.runDir, { event: "connotation-reissue-result", ok: !!r?.ok,
+              recovered: Array.isArray(r?.rows) ? r.rows.length : 0,
+              cause: r?.ok ? null : String(r?.cause ?? "").slice(0, 160) });
+            if (r?.ok && r.rows?.length) {
+              // Append into the half's OWN ledger, so the ordinary re-merge picks them up and nothing
+              // downstream needs to know this call happened.
+              const half = JSON.parse(readFileSync(P.commonLawGridHalf(MEANING_SEAT), "utf8"));
+              half.extras = half.extras ?? {};
+              half.extras.pr_risk = [...(Array.isArray(half.extras.pr_risk) ? half.extras.pr_risk : []), ...r.rows];
+              atomicWrite(P.commonLawGridHalf(MEANING_SEAT), JSON.stringify(half, null, 2) + "\n");
+            }
+          }
+        } catch (err) {
+          // Never fatal: a re-issue that cannot even be attempted leaves the run exactly where it was,
+          // and the disclosure below is what the ruling actually guarantees.
+          runLog(run.runDir, { event: "connotation-reissue-failed", error: String(err?.message ?? err).slice(0, 160) });
+        }
+        try { return mergeCommonLawArtifacts(); } catch { /* still short — disclose below */ }
+      }
+      return mergeCommonLawArtifacts({ discloseUnfinished: true });
+    };
     const mergeWithConnotationRemedy = !clSplit ? null : async () => {
       try { return mergeCommonLawArtifacts(); }
       catch (e) {
@@ -9408,7 +9725,21 @@ async function pipelineInner(job, opts = {}) {
         // the token inline must keep opening this channel.
         const tok = connotationRemedyToken(e);
         const anyQuarantined = GRID_SEATS.some((h) => clHalves[h].quarantined);
-        if (!tok || anyQuarantined || clConnotationRemedySpent) throw e;
+        // A quarantined half keeps its transient park path: that half is re-run whole and the re-merge
+        // converges, so there is nothing here to disclose yet.
+        // THE DROPPED-QUERY FAILURE CARRIES NO FORM TOKEN, and matching on the form tokens alone is why
+        // this channel never opened for it: `connotationRemedyToken` reads the connotation FORM
+        // vocabulary, and "merged half-grids dropped N dictated connotation queries" is not in it. The
+        // run therefore died at the merge with the recovery path sitting unused beside it.
+        const droppedQueries = /dropped \d+ dictated connotation quer/i.test(String(e?.message ?? ""));
+        if (anyQuarantined) throw e;
+        if (droppedQueries) return await reissueThenDisclose(e);
+        if (!tok) throw e;
+        // ── ONE RE-ASK OF THE MODEL, THEN THE ENGINE TAKES OVER ──────────────────────────────────
+        // The loop stops being a loop. The model gets exactly one routed repair turn; after that the
+        // engine re-issues the search itself and, failing that, the run delivers with the gap disclosed.
+        // Before this, a second arrival here re-threw and the clearance died after a full paid gather.
+        if (clConnotationRemedySpent) return await reissueThenDisclose(e);
         clConnotationRemedySpent = true;
         runLog(run.runDir, { event: "connotation-remedy", detail: tok.slice(0, 200) });
         // — WHICH HALVES OWE ROWS, READ FROM THE FORM. This used to re-derive the violation set here,
@@ -9442,7 +9773,8 @@ async function pipelineInner(job, opts = {}) {
           const r = await stage("common-law-half", { ...ctx, axis: h }, { force: true, followup, sessionKey: clHalves[h].sessionKey, trigger: "connotation-remedy" });
           if (!r.ok) note(`connotation remedy (half ${h}) failed mechanically (${r.fail}) — the re-merge below decides`);
         });
-        return mergeCommonLawArtifacts();
+        try { return mergeCommonLawArtifacts(); }
+        catch (e2) { return await reissueThenDisclose(e2); }
       }
     };
     if (clSplit) await mergeWithConnotationRemedy();
@@ -12684,7 +13016,11 @@ async function pipelineInner(job, opts = {}) {
           reason: `synthesis_unaccounted_delivered:${duty.unaccounted.length} of ${duty.totals.owed} record(s) reached the findings surface and the delivered document accounts for none of them — neither a finding that names them nor a declination with a ground: ${sample}${duty.unaccounted.length > 4 ? " …" : ""}. The report ships with this named rather than being withheld; these records are open points a reader must weigh.`,
           // — the READER's sentence: what is open, in a lawyer's nouns. Counts survive;
           // the token, the record ids and the engine's nouns stay in `reason` and the run record.
-          clause: `${duty.unaccounted.length} of the ${duty.totals.owed} register records this search surfaced are neither addressed as findings nor expressly set aside in this report — they remain open points a reader must weigh`,
+          // COMPOSED BY THE AUTHORITY, NOT SPELLED HERE. The same sentence has to be reachable from a
+          // run that stored no clause, where these two objects are long gone and only the reason's own
+          // counts survive; `terminal-clamp.mjs` composes it from the counts either way, so the fresh
+          // run and the republished archive cannot drift apart.
+          clause: clauseForDefect("synthesis_unaccounted_delivered", duty.unaccounted.length, duty.totals.owed),
         });
       }
     }
@@ -12710,7 +13046,9 @@ async function pipelineInner(job, opts = {}) {
           // — the READER's sentence. "Floor row" is an engine noun; what the fact IS for a
           // lawyer: live registrations identical or near-identical to the mark that the report does not
           // individually address. Counts survive; token, ids and engine nouns stay in `reason`.
-          clause: `${block.undischarged} of the ${block.floors} live registrations identical or near-identical to the mark are not individually addressed in this report — each remains an open point a reader must weigh`,
+          // Composed by the authority in `terminal-clamp.mjs` for the reason the sibling site above
+          // gives: a republished pre-split run has to reach the same sentence from the counts alone.
+          clause: clauseForDefect("floor_duty_undischarged", block.undischarged, block.floors),
         });
       }
     }
@@ -12752,7 +13090,7 @@ async function pipelineInner(job, opts = {}) {
           for (const c of fresh) clampClauses.push(conditionClauses[conditions.indexOf(c)] ?? c);
           clampReasons.push(...fresh);
           if (verdict === "CLEAR") {
-            runLog(run.runDir, { event: "coverage-floor-clamp", from: "CLEAR", to: "CONDITIONAL", legalActions: conditions.length });
+            runLog(run.runDir, { event: "coverage-floor-clamp", cause: "forward-actions", from: "CLEAR", to: "CONDITIONAL", legalActions: conditions.length });
             note(`deliver-conditional floor: the opinion names ${conditions.length} forward legal action(s) a human must take (${conditions[0].slice(0, 140)}${conditions.length > 1 ? `; +${conditions.length - 1} more` : ""}) — clamping CLEAR→CONDITIONAL (spec 64: the disposition is derived from the findings' named actions).`);
             verdict = "CONDITIONAL";
             writeRunStatus(ctx, { verdict });
@@ -12791,7 +13129,7 @@ async function pipelineInner(job, opts = {}) {
         // The CLAMP is outside that guard on purpose: a re-ask can flip a clamped verdict back to CLEAR,
         // and it must meet this floor again with the reason already recorded.
         if (droppedConditions.length && verdict === "CLEAR") {
-          runLog(run.runDir, { event: "coverage-floor-clamp", from: "CLEAR", to: "CONDITIONAL", actionsDropped: droppedConditions.length });
+          runLog(run.runDir, { event: "coverage-floor-clamp", cause: "dropped-actions", from: "CLEAR", to: "CONDITIONAL", actionsDropped: droppedConditions.length });
           verdict = "CONDITIONAL";
           writeRunStatus(ctx, { verdict });
         }
@@ -12882,22 +13220,49 @@ async function pipelineInner(job, opts = {}) {
       // could-not-examine record, and an unfinished register slice — CONDITIONAL carries
       // lawyer-judged/disclosed residue only.
       if (coverageInsufficient || frameResidual || screenGateGap || seniorGap || registerGap || deadlineGap) {
+        // THESE SENTENCES REACH A CLIENT AND THEY ARE NOT OURS TO WRITE (owner, 2026-09-17). One of
+        // them — the screen-gate line, which says a mark "could not be record_fetched" — carries an
+        // engine identifier into the list a client reads as the conditions on their result, by a route
+        // `terminalClampDecision` guards and this one does not. A reader's sentence for it was written
+        // here and refused: the objection was the class, not the wording. It is on the owner's design
+        // table as audit item 25, and until he rules, this stays exactly as it was rather than carrying
+        // a caveat a developer composed.
         const reasons = [];
-        if (coverageInsufficient) reasons.push(`the lawyer judged a material slice not fully cleared: ${coverageJudgment.reason || "register coverage gap"}`);
-        if (frameGap) reasons.push("the blind frame-diff flagged a dominant-element omission the reopen pass did not close");
-        else if (frameDeferrals.length) reasons.push(`follow-ups left open this run: ${frameDeferrals.map((d) => plainDirective(d.directive)).slice(0, 3).join(", ")}`);
-        if (screenGateGap) reasons.push(`${sgUnresolved.length} in-scope mark(s) dropped on goods could not be record_fetched (unverified): ${sgUnresolved.map((g) => g.mark).join(", ")}`);
-        if (seniorGap) reasons.push(`the oldest registration in a verdict-driving family could not be retrieved (policy: clamp): ${(ctx.seniorRights?.rows ?? []).filter((r) => r.applicable && !r.verified).map((r) => r.mark).join(", ")}`);
+        const machinery = (reason) => reasons.push(reason);
+        if (coverageInsufficient) machinery(`the lawyer judged a material slice not fully cleared: ${coverageJudgment.reason || "register coverage gap"}`);
+        if (frameGap) machinery("the blind frame-diff flagged a dominant-element omission the reopen pass did not close");
+        else if (frameDeferrals.length) machinery(`follow-ups left open this run: ${frameDeferrals.map((d) => plainDirective(d.directive)).slice(0, 3).join(", ")}`);
+        if (screenGateGap) machinery(`${sgUnresolved.length} in-scope mark(s) dropped on goods could not be record_fetched (unverified): ${sgUnresolved.map((g) => g.mark).join(", ")}`);
+        if (seniorGap) machinery(`the oldest registration in a verdict-driving family could not be retrieved (policy: clamp): ${(ctx.seniorRights?.rows ?? []).filter((r) => r.applicable && !r.verified).map((r) => r.mark).join(", ")}`);
         if (registerGap) {
-          if (regGap.deferred.length) reasons.push(`register coverage deferred on ${[...new Set(regGap.deferred.map((g) => g.axis))].join(", ")} — the search did not finish and must be re-run before this can be relied on`);
-          if (regGap.taintAxes.length) reasons.push(`the ${regGap.taintAxes.join(", ")} register pass was cut down at the timeout wall and its self-reported coverage is unverified`);
+          if (regGap.deferred.length) machinery(`register coverage deferred on ${[...new Set(regGap.deferred.map((g) => g.axis))].join(", ")} — the search did not finish and must be re-run before this can be relied on`);
+          if (regGap.taintAxes.length) machinery(`the ${regGap.taintAxes.join(", ")} register pass was cut down at the timeout wall and its self-reported coverage is unverified`);
           // Named regressions (2026-07-22): `<MARK> (<owner> — <canonical uri>)` — a bare mark name
           // shipped "ION, ION, ION" (three indistinguishable strings); the identity is front-loaded
           // because the delivered statement truncates from the tail.
-          if (regGap.recallRegressions.length) reasons.push(`a prior-confirmed live conflict was neither carried nor justified this run: ${regGap.recallRegressions.slice(0, 3).map(formatRecallRegression).join(", ")}`);
+          if (regGap.recallRegressions.length) machinery(`a prior-confirmed live conflict was neither carried nor justified this run: ${regGap.recallRegressions.slice(0, 3).map(formatRecallRegression).join(", ")}`);
         }
-        if (deadlineGap) reasons.push(`a recorded opposition deadline was delivered without its date: ${ctx.deadlineCarryMaterial.map((v) => `${v.mark_text ?? v.uri} (window closes ${v.opposition_end})`).slice(0, 3).join(", ")}`);
-        runLog(run.runDir, { event: "coverage-floor-clamp", from: "CLEAR", to: "CONDITIONAL", coverageInsufficient: coverageInsufficient || undefined, frameGap: frameGap || undefined, frameDeferred: frameDeferrals.length || undefined, screenGate: screenGateGap ? sgUnresolved.length : undefined, seniorRight: seniorGap || undefined, registerGap: registerGap ? { deferred: regGap.deferred.length, taint: regGap.taintAxes.length, recall: regGap.recallRegressions.length } : undefined, deadlineCarry: deadlineGap ? ctx.deadlineCarryMaterial.length : undefined });
+        if (deadlineGap) machinery(`a recorded opposition deadline was delivered without its date: ${ctx.deadlineCarryMaterial.map((v) => `${v.mark_text ?? v.uri} (window closes ${v.opposition_end})`).slice(0, 3).join(", ")}`);
+        // ── THE THIRD CLAMP SITE NAMES ITSELF, AND NAMES WHICH OF ITS SEVEN INPUTS FIRED ────────────────
+        //
+        // All three clamp sites emitted this event under one name with the same from/to, distinguishable
+        // only by which optional payload key happened to be present. Two of them fired three milliseconds
+        // apart on a production run — the first without `frameDeferred`, the second with it — which reads
+        // as one decision logged twice. It was two different decisions wearing one name, and the test lane
+        // reasonably discounted one of them. `cause` makes the event self-describing.
+        //
+        // THE EVENT NAME IS DELIBERATELY NOT SPLIT. It is a true statement about the effect — the verdict
+        // was clamped — and something downstream may already count clamps in aggregate. A discriminator is
+        // additive; three names would not be.
+        //
+        // This site is itself seven causes under one name, so it also lists WHICH fired rather than
+        // leaving a reader to key on field presence and guess.
+        const clampInputs = Object.entries({
+          coverageInsufficient, frameGap, frameDeferred: frameDeferrals.length,
+          screenGate: screenGateGap ? sgUnresolved.length : 0, seniorRight: seniorGap,
+          registerGap, deadlineCarry: deadlineGap ? ctx.deadlineCarryMaterial.length : 0,
+        }).filter(([, v]) => Boolean(v)).map(([k]) => k);
+        runLog(run.runDir, { event: "coverage-floor-clamp", cause: "coverage", causes: clampInputs, from: "CLEAR", to: "CONDITIONAL", coverageInsufficient: coverageInsufficient || undefined, frameGap: frameGap || undefined, frameDeferred: frameDeferrals.length || undefined, screenGate: screenGateGap ? sgUnresolved.length : undefined, seniorRight: seniorGap || undefined, registerGap: registerGap ? { deferred: regGap.deferred.length, taint: regGap.taintAxes.length, recall: regGap.recallRegressions.length } : undefined, deadlineCarry: deadlineGap ? ctx.deadlineCarryMaterial.length : undefined });
         note(`deliver-conditional floor: ${reasons.join("; ")} — clamping CLEAR→CONDITIONAL so the delivered status carries the gap (never withheld, never halted).`);
         verdict = "CONDITIONAL";
         // APPEND (dedup by exact text) — the legalActions arm may already have recorded conditions,