clearotron 0.3.2-beta.7 → 0.3.2-beta.8

package/driver/register-coverage.mjs

@@ -51,7 +51,7 @@
 // once per snapshot, by a writer that is already async. So that import is DYNAMIC, and search-policy
 // never pulls the plan layer in to answer a question about a product menu.
 import { PROMPT_TERRITORIES } from "./compose-read.mjs";
-import { territoryTier } from "./territory-tiers.mjs";
+import { territoryTier, territoryKey } from "./territory-tiers.mjs";
 
 /**
  * The composer display names this register can actually search.
@@ -157,3 +157,96 @@ export function registerCoverageCause(geography, territories, all = PROMPT_TERRI
   if (rule(territories, all)) return null;
   return geography === "worldwide, and nothing else" ? "register-not-worldwide" : "register-coverage";
 }
+
+// ── the REQUEST half ────────────────────────────────────────────────────────────────────────────────
+//
+// The product half above asks whether a PRODUCT can be ordered at all. This asks whether THIS request's
+// territories can be searched. Two questions, two rulings, deliberately not folded together:
+//
+//   · the PRODUCT-level refusal was retired on 2026-08-31 and stays retired — a worldwide search is
+//     orderable on a partial register and the gap is DISCLOSED in the report.
+//     `coverage-is-disclosed-never-refused.test.mjs` pins that, and this function must never make it red.
+//   · the REQUEST-level refusal was ruled on 2026-09-17: a requester who NAMES a territory the wired
+//     register cannot search is told so BEFORE the run. That gap is not disclosable — there is no result
+//     to caveat, only a territory the client asked about and would never hear another word on.
+//
+// AN EMPTY LIST IS THE "NAMES NO TERRITORY" STATE, BY CONSTRUCTION, and that is why no mode string is
+// read here. `effective-scope.mjs`'s ladder answers `[]` for a worldwide stamp — worldwide accepts no
+// narrowing, so the account's defaults are not consulted — and `[]` again when no layer set a territory.
+// So "a search that names no territory always runs" falls out of the empty set passing. A saved account
+// default that DID reach the ladder is in the list and is judged with the rest, which is the ruling of
+// 2026-09-17 on that question: a default counts as named once it reaches the engine.
+//
+// AND A NAME THE SNAPSHOT CANNOT SPEAK TO FAILS OPEN. `registerTerritories` is scoped to the composer's
+// 37 display names. The other doors are not: `normalizeTerritory` passes any two-letter token through, so
+// the CLI and start_run can name `VN`, which is inside clarivate's own 186-office enum and outside those
+// 37. A bare membership test would refuse a search this engine runs today. Only a territory the
+// snapshot's vocabulary can SPEAK TO is judged, and everything else is the pipeline's to defer as now.
+
+/** Composer display name for a canonical key, so a refusal says "China" whether the requester wrote
+ *  "China", "cn" or "CN". Built per call from the same list the covered set is scoped to. */
+function displayByKey(all) {
+  const out = new Map();
+  for (const name of all) out.set(territoryKey(name), name);
+  return out;
+}
+
+/**
+ * The territories this request NAMES that the wired register cannot search, as composer display names.
+ *
+ * @param territories        the resolved territories — `effective-scope.mjs`'s ladder answer
+ * @param registerTerritories what `coveredTerritoryNames` returned: `[...]`, `null` (no declared
+ *                            restriction) or `undefined` (the snapshot does not say)
+ * @returns `[]` — nothing to refuse, INCLUDING on `null` and `undefined`, which fail open exactly as
+ *          they do at every other layer. Never treat an empty return as "the check did not run".
+ *
+ * Both sides are compared through `territoryKey`, which is the identity function this tree already has
+ * for "what makes two spellings the same place" — it folds EM/EUTM/EUIPO to EU and UK to GB. That fold
+ * is the whole of requirement 2: an EU-covering register refusing a request that names "European Union"
+ * was the defect measured on 2026-09-17, and it cannot recur while both sides go through one authority.
+ */
+export function uncoveredTerritories(territories, registerTerritories, all = PROMPT_TERRITORIES) {
+  if (registerTerritories === null || registerTerritories === undefined) return [];
+  const covered = new Set(registerTerritories.map(territoryKey));
+  const display = displayByKey(all);
+  const out = [];
+  const seen = new Set();
+  for (const t of territories ?? []) {
+    const key = territoryKey(t);
+    // Outside the snapshot's vocabulary ⇒ this register's covered list says nothing about it. Fail open.
+    if (!key || !display.has(key) || covered.has(key) || seen.has(key)) continue;
+    seen.add(key);
+    out.push(display.get(key));
+  }
+  return out;
+}
+
+// One-line join rather than an import: this module's header makes its static graph part of the design
+// ("search-policy.mjs imports this file … a cycle is one careless import away"), and the only other
+// spelling of this lives behind scope-facts.mjs, which is not a leaf.
+const joinAnd = (parts) => (parts.length <= 1 ? parts.join("") : `${parts.slice(0, -1).join(", ")} and ${parts[parts.length - 1]}`);
+
+/**
+ * The door's sentence for a request naming territories the wired register cannot search — or null.
+ *
+ * WRITTEN ONCE, FOR EVERY DOOR. Wording approved by the owner on 2026-09-17, including naming the wired
+ * register, which the composer's own design note otherwise forbids on screen. The remedy clause is his
+ * addition of the same day: a caller with no screen — start_run, the CLI — has to be able to act on this
+ * sentence alone, on the next call.
+ *
+ * IT POINTS BACK RATHER THAN REPEATING. The first draft named the territories twice ("remove China and
+ * Japan"); the owner ruled on the plural the same day — "remove them", no need to repeat the countries —
+ * and the singular follows the same reason, since it repeated its one country for no better cause. The
+ * sentence already names them, so a screenless caller still has every territory it must drop.
+ *
+ * @param registerLabel the register's display label. Absent on a snapshot written before it was carried,
+ *                      and the sentence simply does not name it then rather than naming a key.
+ */
+export function registerReachRefusal(uncovered, registerLabel = null) {
+  if (!uncovered?.length) return null;
+  const names = joinAnd(uncovered);
+  const register = String(registerLabel ?? "").trim();
+  const where = register ? `${register}, the register configured here` : "the register configured here";
+  return `${names} ${uncovered.length === 1 ? "is" : "are"} not available with ${where}`
+    + ` — remove ${uncovered.length === 1 ? "it" : "them"} to run this search.`;
+}

package/driver/register-digest-record.mjs

@@ -88,6 +88,153 @@ export function accountingArmed(runDir) {
   return existsSync(driverDir(String(runDir ?? ""), ACCOUNTING_STAMP));
 }
 
+// ── THE BAND REACHES THE SEAT IN BATCHES, AND A BATCH IS THE UNIT OF ACCOUNTING ───────────────────
+//
+// A dense matter carried 1,161 records into one digest turn (2026-09-16). The seat ran out of turn
+// before it had accounted for them all, the call was refused with 902 outstanding, and the ladder
+// re-sent the same shape: 35 minutes and 172,900 output tokens for a document that was never written.
+// Nothing was wrong with the judgment. The stage was handed more records than one turn holds.
+//
+// SO THE DRIVER SPLITS THE OWED SET AND THE SEAT RECORDS ONE CALL PER BATCH. What made that impossible
+// was not the absence of a split — the transport has taken several calls since the patch path was
+// built — but WHERE THE REFUSAL LOOKED. It looked at the whole owed set on every call, and a refused
+// call stores no model, so the accumulator could never start: batch 1 was refused for not being
+// batches 2 to 12, and the work in it was discarded. Driven before this change, three calls of one
+// record each against an owed set of three: every call refused "2 of 3", no model stored, no document
+// written, and the same refusal on call 3 as on call 1.
+//
+// A CALL NAMING A BATCH IS JUDGED ON THAT BATCH. A call naming none is judged on the whole owed set,
+// exactly as before, which is what keeps the existing rungs working unchanged: the re-classify rung
+// sends the COMPLETE set of rows and the recall-reconciliation flush sends a patch of the rows it is
+// ending, and neither names a batch.
+export const DIGEST_BATCH_RECORDS = 100;
+
+/**
+ * The owed set split into batches, in order. PURE, and deterministic across a resume: `owed` is derived
+ * from placements.json, not from anything the run accumulates, so batch 7 holds the same records on the
+ * retry as it did on the attempt that was killed.
+ */
+export function batchesOf(owed, size = DIGEST_BATCH_RECORDS) {
+  const list = [...new Set((Array.isArray(owed) ? owed : []).map(joinKey).filter(Boolean))];
+  const n = Math.max(1, Number(size) || DIGEST_BATCH_RECORDS);
+  const out = [];
+  for (let i = 0; i < list.length; i += n) out.push(list.slice(i, i + n));
+  return out;
+}
+
+/**
+ * The records a model accounts for, by the three exits this seam recognises. PURE.
+ *
+ * ONE READER FOR TWO GATES, and that is the point of exporting it. The call-time refusal and the
+ * stage's exit gate have to be counting the same thing; two implementations of "accounted" would drift
+ * and the drift would show up as a stage that passed with records ended nowhere.
+ */
+export function accountedUris(model, owed = []) {
+  const accounted = new Set();
+  for (const r of [...(model?.findings_rows ?? []), ...(model?.incumbent_rows ?? []), ...(model?.negative_rows ?? [])])
+    accounted.add(joinKey(r?.uri));
+  // A disagreement resolution accounts for a record when its subject names that record's uri — the
+  // third exit, and the one a reader is least likely to expect, so it is joined rather than assumed.
+  for (const d of model?.disagreement_resolutions ?? [])
+    for (const k of (Array.isArray(owed) ? owed : [])) if (k && lc(d?.subject).includes(k)) accounted.add(k);
+  accounted.delete("");
+  return accounted;
+}
+
+/** Every record uri a raw call carries, across the three row lists. PURE. */
+export function callUris(call) {
+  const out = [];
+  for (const r of [...(call?.findings_rows ?? []), ...(call?.incumbent_rows ?? []), ...(call?.negative_rows ?? [])]) {
+    const k = joinKey(r?.uri);
+    if (k) out.push(k);
+  }
+  return out;
+}
+
+/**
+ * Which batch accounted each record, after this call. PURE. Returns `{ batchOf, doubled }`.
+ *
+ * DOUBLE-COUNTING IS A BATCH COLLISION, NEVER A REPEATED URI, and the distinction is the whole reason
+ * this is keyed rather than a membership test. `mergeDigestPatch` replaces a row by uri on purpose —
+ * "refreshing an ending is idempotent" — and the recall-reconciliation flush rung depends on it,
+ * telling the seat to re-send rows it is changing. So a uri arriving again UNDER ITS OWN BATCH is that
+ * legitimate refresh and is kept; the same uri arriving under a DIFFERENT batch is a record ended
+ * twice, which is what inflates a count nobody can reconcile, and it is refused naming both batches.
+ */
+export function batchLedger(storedBatchOf, call) {
+  const batchOf = { ...(storedBatchOf ?? {}) };
+  const doubled = [];
+  const batch = call?.batch;
+  if (!Number.isInteger(batch) || batch < 1) return { batchOf, doubled };
+  for (const k of callUris(call)) {
+    const was = batchOf[k];
+    if (was !== undefined && was !== batch) { doubled.push({ uri: k, was, now: batch }); continue; }
+    batchOf[k] = batch;
+  }
+  return { batchOf, doubled };
+}
+
+/**
+ * The batch block the digest dispatch carries: how the driver split this run's band, which batches are
+ * outstanding, and the one rule that makes a batch call different from a whole-document one. `null` when
+ * the run has no owed population, because a brief that enumerates nothing reads as a rule with no work.
+ *
+ * ON A RESUME IT IS THE RESUME INSTRUCTION, and that is why it is computed rather than fixed: the
+ * batches already accounted for are named as done, so the seat re-reads none of them. A retry that
+ * starts at batch 1 is how the stage burned 35 minutes twice on the same matter.
+ */
+export function digestBatchBrief(gap) {
+  if (!gap?.armed || !Array.isArray(gap.owed) || !gap.owed.length) return null;
+  const plan = batchesOf(gap.owed);
+  const outstanding = new Set(gap.unaccounted ?? []);
+  const todo = [];
+  for (let i = 0; i < plan.length; i++) if (plan[i].some((k) => outstanding.has(k))) todo.push(i + 1);
+  const done = plan.length - todo.length;
+  const lines = [
+    `## Your records, in ${plan.length} batch${plan.length === 1 ? "" : "es"}`,
+    "",
+    `This run carried ${gap.owed.length} record${gap.owed.length === 1 ? "" : "s"} into the digest. The driver has split them into `
+      + `${plan.length} batch${plan.length === 1 ? "" : "es"} of up to ${DIGEST_BATCH_RECORDS}. Record ONE `
+      + "`record_register_digest` call per batch, carrying `batch: <the number>` — not one call for the whole band.",
+    "",
+    "Every record in the batch you name must end in that same call: a findings row, an incumbent row, a "
+      + "Negative-results drop with its ground token, or a Disagreement resolution. The call is refused if "
+      + "one of them ends nowhere, and the refusal lists exactly which — send only those; everything you "
+      + "have already recorded is kept. A record ends in ONE batch: ending it again under a different "
+      + "batch number is refused.",
+    "",
+    `Your prose sections (opposition, merch_sweep, cross_checks, open_flags) ride any batch call and are `
+      + "kept when a later call omits them.",
+    "",
+  ];
+  if (done) lines.push(`${done} of these batches ${done === 1 ? "is" : "are"} already recorded and complete. `
+    + `Outstanding: batch ${todo.join(", ")}. Do not re-read or re-send the batches that are done.`, "");
+  else lines.push(`Outstanding: every batch, 1 to ${plan.length}.`, "");
+  return lines.join("\n");
+}
+
+/**
+ * What this run's digest still owes, read off the stored model. `{ armed, owed, accounted, unaccounted }`.
+ *
+ * THE EXIT GATE'S READ. Before batching, a digest that ended nothing failed because no document was
+ * ever written — the refusal on the last call was the gate. Once a batch call is accepted, the document
+ * EXISTS from batch 1 onwards, so that failure stops firing, and a seat that stopped after batch 6 would
+ * ship a document missing half the band with nothing refusing it. That inversion is what this closes,
+ * and it is armed by the same era stamp as the call-time refusal so archived runs are judged as they
+ * always were.
+ */
+export function digestAccountingGap(runDir) {
+  const armed = accountingArmed(runDir);
+  if (!armed) return { armed: false, owed: [], accounted: [], unaccounted: [] };
+  const facts = readDigestFacts(runDir);
+  if (!Array.isArray(facts.owed)) return { armed: true, owed: null, accounted: [], unaccounted: null };
+  const model = lastAcceptedModel(runDir);
+  if (!model) return { armed: true, owed: facts.owed, accounted: [], unaccounted: facts.owed, no_model: true };
+  const accounted = accountedUris(model, facts.owed);
+  return { armed: true, owed: facts.owed, accounted: [...accounted],
+    unaccounted: facts.owed.filter((k) => !accounted.has(k)) };
+}
+
 /**
  * The document's section headings, EXPORTED because three separate readers key on them and a heading
  * changed here without changing them is the failure this constant exists to make impossible.
@@ -597,6 +744,10 @@ export function acceptRegisterDigest(params, facts = emptyFacts()) {
     open_flags: str(params?.open_flags),
     instructed_checks,
     disagreement_resolutions,
+    // WRITTEN ONLY WHEN THERE IS ONE, so a run that never batched stores the model it always stored and
+    // an archived model replays byte-identical. It is the accumulator's own bookkeeping and no renderer
+    // reads it: `renderRegisterFindings` takes the keys it names and ignores the rest.
+    ...(params?.batch_of && Object.keys(params.batch_of).length ? { batch_of: params.batch_of } : {}),
   };
 
   // ASK WHAT THE ZERO MEANS. A digest that surfaced nothing AND dropped nothing has not judged the
@@ -610,16 +761,39 @@ export function acceptRegisterDigest(params, facts = emptyFacts()) {
   // Disagreement-resolutions row. Nothing new is invented here — the join is over lists this call
   // already carries.
   if (facts.armed) {
-    const accounted = new Set();
-    for (const r of [...model.findings_rows, ...model.incumbent_rows, ...model.negative_rows]) accounted.add(joinKey(r.uri));
-    // A disagreement resolution accounts for a record when its subject names that record's uri — the
-    // third exit, and the one a reader is least likely to expect, so it is joined rather than assumed.
-    for (const d of model.disagreement_resolutions)
-      for (const k of facts.owed) if (k && lc(d.subject).includes(k)) accounted.add(k);
-    const unaccounted = facts.owed.filter((k) => !accounted.has(k));
+    // A RECORD ENDED TWICE IS ANSWERED BEFORE A RECORD ENDED NOWHERE. The ledger is the driver's
+    // (batchLedger, from the raw call), so this reads a decision rather than making one.
+    const doubled = Array.isArray(params?.batch_doubled) ? params.batch_doubled : [];
+    if (doubled.length) {
+      const show = doubled.slice(0, 5).map((d) => `${d.uri} (batch ${d.was}, again in batch ${d.now})`).join("; ");
+      return { ok: false, reason: `registerdigest_double_counted:${doubled.length} record(s) this call ends were already ended by another batch: ${show}${doubled.length > 5 ? ` (+${doubled.length - 5} more)` : ""}. Each record ends exactly once, in its own batch — re-send the batch that owns it if the ending was wrong, and drop it from this one` };
+    }
+    const accounted = accountedUris(model, facts.owed);
+    // ── THE SCOPE IS THE BATCH WHEN THE CALL NAMES ONE, AND THE WHOLE OWED SET WHEN IT DOES NOT ─────
+    //
+    // Both arms use the same accounted set and the same three exits; only the population moves. A call
+    // naming no batch is judged exactly as it was before batching existed, which is what every rung
+    // that re-sends a complete document depends on.
+    const batch = Number.isInteger(params?.batch) && params.batch >= 1 ? params.batch : null;
+    let scope = facts.owed, where = "this run carried into the digest";
+    if (batch !== null) {
+      const plan = batchesOf(facts.owed);
+      const slice = plan[batch - 1];
+      if (!slice) {
+        return { ok: false, reason: `registerdigest_batch_unknown:batch ${batch} — this run's band splits into ${plan.length} batch(es) of up to ${DIGEST_BATCH_RECORDS} records, so there is no batch ${batch} to record. The dispatch names the batch count; send the batches it lists` };
+      }
+      scope = slice;
+      where = `batch ${batch} of ${plan.length} carried`;
+    }
+    const unaccounted = scope.filter((k) => !accounted.has(k));
     if (unaccounted.length) {
-      const show = unaccounted.slice(0, 5).join(", ");
-      return { ok: false, reason: `registerdigest_unaccounted_records:${unaccounted.length} of ${facts.owed.length} record(s) this run carried into the digest end nowhere — neither a findings row, nor a Negative-results drop, nor a Disagreement resolution: ${show}${unaccounted.length > 5 ? ` (+${unaccounted.length - 5} more)` : ""}. Each needs one of the three, and a drop needs its ground token` };
+      // THE REFUSAL IS THE WORK LIST. It used to show five of them and leave the seat to infer the rest,
+      // which is what made "retry the digest" the only move it could read off the refusal. A batch is at
+      // most DIGEST_BATCH_RECORDS records, so its outstanding set is quotable in full and the seat can
+      // act on THIS refusal without re-reading the band.
+      const cap = batch !== null ? DIGEST_BATCH_RECORDS : 5;
+      const show = unaccounted.slice(0, cap).join(", ");
+      return { ok: false, reason: `registerdigest_unaccounted_records:${unaccounted.length} of ${scope.length} record(s) ${where} into the digest end nowhere — neither a findings row, nor a Negative-results drop, nor a Disagreement resolution: ${show}${unaccounted.length > cap ? ` (+${unaccounted.length - cap} more)` : ""}. Each needs one of the three, and a drop needs its ground token. Send ONLY these — everything you have already recorded is kept` };
     }
   }
 
@@ -652,7 +826,20 @@ export function recordRegisterDigest(runDir, received, { facts = null, now = ()
 
   // A PATCH call merges onto the stored model BEFORE acceptance, so the whole document is validated
   // as one thing every time — a patch cannot slip a row past a check by arriving alone.
-  const params = received?.patch === true ? mergeDigestPatch(lastAcceptedModel(runDir), received) : received;
+  //
+  // A BATCH CALL IS A PATCH, AND IT IS NOT OPTIONAL THAT IT IS. Batches accumulate by definition: if
+  // batch 2 replaced the stored model rather than merging onto it, batch 1's rows would leave the
+  // document the moment batch 2 was accepted, and the run would reach delivery a batch short with every
+  // call reading as accepted. The batch ledger travels the same way — read off the stored model, so a
+  // resume that re-enters the stage carries what the killed attempt had already accounted for.
+  const batching = Number.isInteger(received?.batch) && received.batch >= 1;
+  const accumulates = received?.patch === true || batching;
+  const stored = accumulates ? lastAcceptedModel(runDir) : null;
+  const merged = accumulates ? mergeDigestPatch(stored, received) : received;
+  const ledger = batchLedger(stored?.batch_of, received);
+  const params = batching
+    ? { ...merged, batch: received.batch, batch_of: ledger.batchOf, batch_doubled: ledger.doubled }
+    : merged;
   const verdict = acceptRegisterDigest(params, facts ?? readDigestFacts(runDir));
   if (!verdict.ok) {
     try { writeFileSync(paths.refusals, `${JSON.stringify({ at: now(), reason: verdict.reason })}\n`, { flag: "a" }); }
@@ -682,8 +869,46 @@ export function recordRegisterDigest(runDir, received, { facts = null, now = ()
   const at = join(String(runDir ?? ""), FINDINGS_FILE);
   // The model lands BEFORE the document: a later patch merges onto what was accepted, so a write that
   // fails must not leave a stored model describing a document nobody has.
+  //
+  // ── AND UNDER BATCHING THE MODEL IS THE ACCUMULATOR, SO LOSING IT IS FATAL HERE ──────────────────
+  //
+  // Best-effort was right while one call carried the whole document: a lost model cost the next patch
+  // its base and said so by refusing. It is wrong once the batches ARE the document. Lose it after
+  // batch 3 and batch 4 merges onto nothing, batch 3's records stop being accounted, the union never
+  // closes, and the run ends refusing over records the seat accounted for correctly twenty minutes
+  // earlier — a loop with a true-looking refusal at the end of it.
+  let modelWriteFailed = null;
   try { writeFileSync(paths.model, JSON.stringify(verdict.model, null, 2) + "\n"); }
-  catch { /* best-effort; a lost model costs the next patch its base, and it says so by refusing */ }
+  catch (e) { modelWriteFailed = String(e?.message ?? e).slice(0, 200); }
+  if (modelWriteFailed && Number.isInteger(received?.batch)) {
+    const reason = `registerdigest_model_write_failed:this run accounts for its records in batches and the driver could not store what this batch accepted (${modelWriteFailed}), so the next batch would merge onto a base missing these rows and the run would refuse over records you have already accounted for (driver-written: this is a bug, not a model defect, and re-stating the call cannot fix it)`;
+    try { writeFileSync(paths.refusals, `${JSON.stringify({ at: now(), reason })}\n`, { flag: "a" }); }
+    catch { /* the refusal record is best-effort; the refusal itself is returned regardless */ }
+    return { written: null, refused: reason, captured: closeCapture({ ok: false, refused: reason }), capture_failed: captureFailed };
+  }
+
+  // ── THE CLIENT'S DOCUMENT STAYS ALL-OR-NOTHING WHILE BATCHES ARE OUTSTANDING ─────────────────────
+  //
+  // `register-findings.md` is read by nine parsers, by the gateway through `toolWrittenArtifact` to
+  // decide whether this stage produced anything at all, and by a lawyer. Writing it on each accepted
+  // batch puts a page on disk carrying the title, every heading and a third of the records — complete
+  // to every one of those readers. The exit gate in `validators.registerFindings` refuses such a
+  // document, which catches a seat that stops half way; it catches it AFTER the partial page exists.
+  //
+  // So while any owed record is still outstanding the batch accumulates into the MODEL, which is the
+  // driver's own state, and the document is rendered on the call that closes the union. A run that dies
+  // at batch 6 then leaves no document at all — exactly what an unfinished digest has always left, so
+  // the older "no document" stage failure keeps working unchanged and the exit gate becomes the second
+  // lock rather than the only one.
+  const gap = digestAccountingGap(runDir);
+  if (Array.isArray(gap.unaccounted) && gap.unaccounted.length) {
+    return {
+      written: null, refused: null, batch_accepted: received?.batch ?? null, remaining: gap.unaccounted.length,
+      accounted: gap.accounted.length,
+      captured: closeCapture({ ok: true, batch_accepted: received?.batch ?? null, remaining: gap.unaccounted.length }),
+      capture_failed: captureFailed,
+    };
+  }
   try { writeFileSync(at, verdict.content); }
   catch (e) {
     return { written: null, refused: null, write_failed: String(e?.message ?? e).slice(0, 200),

package/driver/register-plan.mjs

@@ -573,6 +573,176 @@ export function mintSupplementalQid({ prefix, term, used }) {
  *                  driver/register-capabilities.mjs). Omitted ⇒ the pre-phase-3 corsearch-shaped
  *                  behaviour, byte-identical (no entry gains a key, no jurisdiction is translated).
  */
+/**
+ * The receipt that ARMS the house-element exclusion, and the only thing that may.
+ *
+ * A SEPARATE FILE FROM THE FRAME'S PROPOSAL, deliberately, and for the reason the digest's accounting
+ * stamp is separate from its facts: the proposal is what a model said, the receipt is what the register
+ * answered, and a reader who cannot tell those apart cannot tell a judgement from evidence. Absent means
+ * the question was never asked, which is the same as unverified and excludes nothing.
+ */
+export const HOUSE_ELEMENT_RECEIPT = "house-element.json";
+
+/**
+ * Verify that the client actually owns the proposed house element, on the register, by owner.
+ *
+ * IT SITS BESIDE THE TRANSFORM IT GATES, for the reason `accountingArmed` sits beside the refusal it
+ * arms: the gate and the thing gated go stale together or not at all, and a reader meeting one finds the
+ * other. Nothing else may arm this exclusion.
+ *
+ * FAIL-CLOSED ON EVERY PATH, and that is the whole design. The frame PROPOSED this element from its
+ * reading of the matter; acting on the proposal alone would drop an element from a client's search on a
+ * model's assertion, and an element nobody swept is a clean report over unswept ground — the one defect
+ * that reaches a client as a confident wrong answer rather than as a visible failure. So every way of
+ * not knowing lands in the same place: not verified, no exclusion, the element searched in full, and a
+ * reason on the receipt saying which way it was. An outage, an unknown client name, a lookup that threw,
+ * a dead registration, a registration in some other class — none of them excludes anything.
+ *
+ * `lookup` is injected, exactly as `runOwnerChecks` takes its `exec` and `countRegisterHits` its
+ * `counter`: the fixture path that makes this product testable at no cost covers this call too, and a
+ * test never reaches a provider. NEVER THROWS and never rejects.
+ *
+ * @param owners  the client's own names — the profile's trading names and the matter's customer. Empty
+ *                is a real answer and it means NOT VERIFIED: with no name to match an owner against,
+ *                "the client owns it" cannot be established by anything this function can see.
+ * @returns the receipt, always. `verified: true` is the only value that may arm an exclusion.
+ */
+export async function verifyHouseElementOwnership({
+  element, classes = [], owners = [], lookup, now = () => new Date().toISOString(),
+}) {
+  const el = String(element ?? "").trim();
+  const wanted = (Array.isArray(classes) ? classes : []).map(String).map((c) => c.trim()).filter(Boolean);
+  const names = (Array.isArray(owners) ? owners : []).map((o) => String(o ?? "").trim()).filter(Boolean);
+  const receipt = (verified, reason, records = []) =>
+    ({ verified, element: el, owners_checked: names, classes: wanted, records, reason, ts: now() });
+
+  if (!el) return receipt(false, "house_element_absent: nothing was proposed");
+  if (!names.length)
+    return receipt(false, "client_owner_unknown: this run holds no trading name for the client, so an owner on the register cannot be matched to it");
+  if (!wanted.length)
+    return receipt(false, "instructed_classes_absent: ownership is only decisive in the classes the matter is instructed in");
+  if (typeof lookup !== "function")
+    return receipt(false, "lookup_unavailable: no register lookup was wired, so ownership was never asked");
+
+  let rows = [];
+  try {
+    const r = await lookup({ element: el, owners: names, classes: wanted });
+    if (!r?.ok) return receipt(false, `lookup_did_not_answer: ${String(r?.reason ?? "no reason given").slice(0, 200)}`);
+    rows = Array.isArray(r.records) ? r.records : [];
+  } catch (e) {
+    return receipt(false, `lookup_threw: ${String(e?.message ?? e).slice(0, 200)}`);
+  }
+
+  // A MATCH IS ALL THREE AT ONCE — the client's own name, alive, in an instructed class. Checking them
+  // separately would let a dead registration in class 9 and a live one in class 25 held by someone else
+  // combine into an ownership nobody has.
+  const norm = (v) => String(v ?? "").toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+  const ours = names.map(norm).filter(Boolean);
+  const live = (st) => { const t = norm(st); return Boolean(t) && !/(dead|expired|cancell?ed|withdrawn|refused|lapsed|abandoned)/.test(t); };
+  const matched = rows.filter((r) => {
+    const owner = norm(r?.owner_name);
+    if (!owner || !ours.some((o) => owner === o || owner.includes(o) || o.includes(owner))) return false;
+    if (!live(r?.status)) return false;
+    const rc = (Array.isArray(r?.classes) ? r.classes : []).map(String).map((c) => c.trim());
+    return rc.some((c) => wanted.includes(c));
+  });
+
+  if (!matched.length)
+    return receipt(false, `no_live_owned_registration: ${rows.length} record(s) came back and none is a live registration held by this client in an instructed class`, []);
+  // The records are the EVIDENCE the report states the exclusion on, so they ride the receipt.
+  return receipt(true, `verified: ${matched.length} live registration(s) held by this client in an instructed class`,
+    matched.map((r) => ({ record_id: String(r?.record_id ?? r?.uri ?? ""), owner_name: String(r?.owner_name ?? ""),
+      status: String(r?.status ?? ""), classes: (Array.isArray(r?.classes) ? r.classes : []).map(String) })));
+}
+
+/**
+ * The manifest with the client's own house element taken out of the conflict analysis. PURE.
+ *
+ * THE DEFECT (production run, 2026-09-16). The mark was the client's own famous house mark followed by
+ * a tagline. `dominant_element` was the house element, so the machine-built one-letter mutation forms
+ * were built from it — and because those mutations are ordinary short words they pull every mark
+ * containing them across four registers. Two such queries put 1,154 records into a 2,146-record band,
+ * 54% of it, reachable from nothing else. The reviewing lawyer's method for the same matter was three
+ * searches: the whole phrase, the shorter phrase, the last word alone.
+ *
+ * WHAT IS NOT DONE HERE, AND IT IS THE POINT. This does not decide that the client owns the element —
+ * it is called only where the driver has already verified ownership on the register by owner and written
+ * its receipt. A `house` argument that arrived from a model's assertion would be an element nobody
+ * searched because a model said it was safe.
+ *
+ * THE WHOLE PHRASE SURVIVES, and that is the lawyer's method rather than a softening of it. `mark` is
+ * untouched, so the exact search for the full phrase still runs. What stops is treating the house
+ * element as an AXIS — its mutations, its forms, its own dominant-element sweep — because that is where
+ * the band came from, not from the one exact query.
+ *
+ * Returns `{ manifest, confirmation, refused }`. `refused` non-null means the exclusion was NOT applied
+ * and the returned manifest is the input: the caller plans as it would have with no receipt at all.
+ */
+export function excludeHouseElement(manifest, house) {
+  const element = String(house?.element ?? "").trim();
+  const remainder = String(house?.remainder ?? "").trim();
+  const keep = (why) => ({ manifest, confirmation: null, refused: why });
+  if (!element || !remainder) return keep("house_element_incomplete");
+
+  const words = remainder.split(/\s+/).filter(Boolean);
+  // ── THE FLOOR IS THE JOIN TO THIS MANIFEST'S OWN MARK ───────────────────────────────────────────
+  //
+  // The direction that reaches a client is naming too MUCH as the house element: ownership verifies
+  // perfectly, nothing distinctive is left, and no count downstream catches it because "queries on the
+  // house element: 0" is satisfied by a plan holding no queries at all. The frame refuses the shapes it
+  // can see — an empty remainder, a remainder equal to the element, an element containing it.
+  //
+  // WHAT THE FRAME CANNOT SEE IS THIS MARK. The proposal is made against the matter, the exclusion is
+  // applied against a compiled manifest, and nothing until here has joined the two. A remainder that is
+  // not part of the mark being planned means the receipt and the manifest are describing different
+  // things — a re-frame, a second ratified form, a resumed run whose manifest moved — and cutting the
+  // dominant element down to a word that is not in the mark would leave the plan searching something
+  // the client never applied for. So the exclusion applies only where both halves are in the mark.
+  const lcMark = String(manifest?.mark ?? "").toLowerCase();
+  if (!lcMark) return keep("house_element_no_mark_to_join");
+  if (!lcMark.includes(remainder.toLowerCase())) return keep("house_element_remainder_not_in_mark");
+  if (!lcMark.includes(element.toLowerCase())) return keep("house_element_not_in_mark");
+
+  const lcEl = element.toLowerCase();
+  const lcWords = words.map((w) => w.toLowerCase());
+  // A word of the remainder, by word boundary rather than by containment: `includes` would count the
+  // remainder word "on" inside an unrelated mutation and keep a query this exists to drop.
+  const namesRemainder = (v) => {
+    const t = String(v ?? "").toLowerCase();
+    return lcWords.some((w) => new RegExp(`(^|[^\\p{L}\\p{N}])${w.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}([^\\p{L}\\p{N}]|$)`, "u").test(t));
+  };
+
+  // THE DOMINANT WORD OF THE REMAINDER: longest, ties broken by the LAST of them. The lawyer's own
+  // phrasing was "the last word alone", and on the matter that produced this the two agree; longest is
+  // the better rule where they do not, because a trailing article is last and carries nothing.
+  let dominant = words[0];
+  for (const w of words) if (w.length >= dominant.length) dominant = w;
+
+  const variants = (Array.isArray(manifest?.variants) ? manifest.variants : []).filter((v) => namesRemainder(v?.value));
+  const next = {
+    ...manifest,
+    // UNTOUCHED: the exact search for the full phrase is the first of the lawyer's three.
+    mark: manifest?.mark,
+    dominant_element: dominant,
+    elements: (Array.isArray(manifest?.elements) ? manifest.elements : []).filter((e) => String(e?.value ?? "").trim().toLowerCase() !== lcEl),
+    // The shorter phrase is the second of the three, and it has to be PUSHED: with `dominant_element`
+    // now a single word and `mark` the full phrase, nothing else in the compile would search the
+    // remainder as a phrase on its own.
+    // `exact-phrase` because that is what it is, and because the category vocabulary is CLOSED —
+    // `parseVariantManifestModel` refuses anything outside it, so a descriptive category invented here
+    // would fail the manifest on its way into the compile.
+    variants: [{ category: "exact-phrase", value: remainder,
+      rationale: "the distinctive remainder once the client's own registered element is set aside" },
+      ...variants],
+  };
+  // REQUIREMENT 3: the element is still checked ONCE, as a confirmation of the client's own live
+  // registrations rather than as a conflict search — so the exclusion is evidenced on the report by a
+  // query that ran, not by a sentence saying one would have.
+  const confirmation = { axis: "incumbent-class", predicate: "owner", term: element,
+    expected_kind: "enumerate", provenance: "mark", house_element_confirmation: true };
+  return { manifest: next, confirmation, refused: null };
+}
+
 export function compileRegisterPlan({ manifest, job, form = null, skillVersion = "", capabilities = null, unavailableOffices = [] }) {
   const classes = (job?.classes ?? []).map(String).filter(Boolean);
   if (!classes.length) throw new Error("register_plan_classes_missing: a plan is always class-scoped — compile with the matter's in-scope Nice classes");

package/driver/result-noun-fields.mjs

@@ -81,8 +81,8 @@ export const RESULT_NOUN_FIELDS = Object.freeze([
       + "is the fact the disclosure downstream depends on" },
   { file: "driver/pipeline.mjs", noun: "settled", sites: 5, atWriteSite: 4, verdict: "result",
     why: "counts off the union and the doubt ledger" },
-  { file: "driver/pipeline.mjs", noun: "verified", sites: 3, atWriteSite: 1, verdict: "result",
-    why: "`rows.filter(r => r.verified).length`, where each row's flag is `srRecords.has(senior.uri)` — a lookup, not a call" },
+  { file: "driver/pipeline.mjs", noun: "verified", sites: 4, atWriteSite: 2, verdict: "result",
+    why: "two sites, both measured states rather than calls returning. (1) `rows.filter(r => r.verified).length`, where each row's flag is `srRecords.has(senior.uri)` — a lookup, not a call. (2) the house-element ownership row's `verified: receipt.verified`, which the verifier sets only where a returned register record matched the client's own name AND was live AND carried an instructed class; the lookup CALL returning is a separate field on the same receipt (`reason`), and an unanswered lookup writes this false" },
   { file: "driver/repairs.mjs", noun: "closed", sites: 2, atWriteSite: 1, verdict: "result",
     why: "`effect.closed`, measured against `effect.asked`" },
   { file: "driver/repairs.mjs", noun: "outcome", sites: 1, atWriteSite: 1, verdict: "result",