clearotron 0.3.2-beta.7 → 0.3.2-beta.8

package/driver/run-economics.mjs

@@ -14,11 +14,14 @@
 // the provider's four separately-priced token kinds.)
 //
 // ── WHAT A "DISPATCH" IS ──────────────────────────────────────────────────────────────────────────
-// One model invocation: one row in `_driver/<stage>.jsonl` carrying a `model` (gateway.mjs writes one
-// per ATTEMPT, so retries are separate dispatches and retry waste is counted, not averaged away). The
-// direct-API jx lanes bypass the gateway and write `_driver/jx-completions.jsonl` in the same
-// {model, usage} shape; they are dispatches too, under stage `jx-completions`. `run.jsonl` is skipped
-// (run events, not dispatches) — same file selection as tokens.mjs, deliberately.
+// One model invocation: one row in `_driver/<stage>.jsonl` that tokens.mjs's `isAttemptRow` counts as
+// a provider attempt (gateway.mjs writes one per ATTEMPT, so retries are separate dispatches and retry
+// waste is counted, not averaged away). The direct-API jx lanes bypass the gateway and write
+// `_driver/jx-completions.jsonl` in the same {model, usage} shape; they are dispatches too, under stage
+// `jx-completions`. `run.jsonl` is skipped (run events, not dispatches) — same file selection as
+// tokens.mjs, deliberately, and the SAME ROW TEST as tokens.mjs, imported rather than copied: a jx row
+// whose turn ran and named no model carries no `model`, only `modelActual: null`, and a census that still
+// asked for a `model` counted no dispatch and no tokens for a turn the token rollup counted with both.
 //
 // ── ZERO SEMANTICS: THE THING THIS MODULE EXISTS TO GET RIGHT ─────────────────────────────────────
 // tokens.mjs sums `usage` with `u.output || 0`, so a dispatch whose usage is null contributes zero AND
@@ -32,7 +35,7 @@
 //   measured   — the dispatch journalled a usage object (from the provider's own result envelope)
 //   streamed   — usage present but RECONSTRUCTED from the stream (`signals.usageStreamed`), because the
 //                turn died before its result event. A real measurement, a weaker one, counted apart.
-//   unmeasured — the row is a dispatch (it has a model) and carries no usage at all. THE KILLED TURNS.
+//   unmeasured — the row is a dispatch and carries no usage at all. THE KILLED TURNS.
 // `tokensComplete` is false whenever `unmeasured > 0`, at run level and per stage, and
 // `unmeasuredDispatches[]` names which ones so a reader can see what the total is missing.
 //
@@ -92,14 +95,18 @@
 // so a per-record basis is the only honest shape. `tokens.mjs` keys its rollup on the requested alias
 // for the same reason and is likewise untouched.
 //
-// Pure by contract: `runEconomics()` reads the run dir and nothing else — no env, no config, no network,
-// no driver imports. `stampRunEconomics()` is the only part that writes.
+// Pure by contract: `runEconomics()` reads the run dir and nothing else — no env, no config, no network.
+// Its only driver import is the attempt-row test it shares with tokens.mjs; the log and status writers
+// serve `stampRunEconomics()`, the only part that writes.
 
 import { readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
 import { runLog, note } from "./log.mjs";
 import { writeRunStatus } from "./progress.mjs";
+// tokens.mjs imports this module too (isCodeSide, stampRunEconomics). The cycle is safe because each side
+// reads the other's bindings only inside functions, never while the module is loading.
+import { isAttemptRow } from "./tokens.mjs";
 
 /**
  * The provider's separately-priced token kinds, in the driver's own `usage` vocabulary (gateway.mjs /
@@ -178,7 +185,23 @@ function billingKeyOf(rec) {
   // is rather than dragged into "unknown" beside genuinely unstamped legacy rows.
   const engine = isCodeSide(rec) ? "code" : String(rec.engine ?? "unknown");
   const authMode = isCodeSide(rec) ? "not-provider-billed" : String(rec.authMode ?? "unknown");
-  const model = String(rec.modelUsed ?? rec.model ?? "unknown");
+  // A TURN THAT NAMED NO MODEL (a jx row with `modelActual: null` and no `model`) is keyed the way the
+  // token rollup keys it (modelKey in tokens.mjs): `<engine>/no-model-reported`, a name that says the
+  // model is missing. Read through the old `?? "unknown"` it landed beside legacy rows nobody stamped,
+  // and its byBilling bucket named a different model from the rollup's byModel for the same turn.
+  //
+  // A COPY OF modelKey's RULE, NOT A SHARED ONE: tokens.mjs does not export it. So the test for "no stamp"
+  // is modelKey's own, a non-empty string `modelUsed`, and not `modelUsed == null`: under that looser test
+  // a row stamped `modelUsed: ""` keyed its bucket as the empty string while the rollup keyed the same
+  // turn `<engine>/no-model-reported`. Two copies of one rule drifting apart is how the census and the
+  // rollup came to disagree about what an attempt is, so the tests hold these two copies to each other on
+  // the rows the engine writes. They still part on a row no writer produces: no model and no engine, or
+  // engine `anthropic-agent`. This key names the missing model there, while modelKey resolves the absent
+  // model through the catalog before it asks whether one exists, and buckets the row as `undefined`.
+  const stamped = typeof rec.modelUsed === "string" && rec.modelUsed;
+  const model = !stamped && typeof rec.model !== "string"
+    ? `${typeof rec.engine === "string" && rec.engine ? rec.engine : "unknown"}/no-model-reported`
+    : String(rec.modelUsed ?? rec.model ?? "unknown");
   return { engine, authMode, model, key: `${engine}|${authMode}|${model}` };
 }
 
@@ -223,11 +246,19 @@ function foldBilling(bucketMap, rec, cls) {
 // future engine whose name began that way, which is how a vendor claim becomes a guess. An engine this
 // table does not know is reported BY NAME and blocks the single-vendor claim, because "I do not know who
 // billed this" and "one vendor" are different answers and only one of them is safe to print.
+//
+// THE NATIVE-LANGUAGE ROWS STAMP THE VENDOR ITSELF. jxBillingStamp (jx-lanes.mjs) writes as the row's
+// engine the provider the engine door resolved, `anthropic` or `openai` (engine/auth.mjs), so those two
+// names are engines this table must place. Without them an Anthropic-only run with a native-language turn
+// named `anthropic` as an engine that bills to no vendor, in the same sentence that named anthropic as its
+// one vendor. Two exact names, still a closed table.
 export const ENGINE_VENDORS = Object.freeze({
   "anthropic-agent": "anthropic",
   "anthropic-direct": "anthropic",
   "anthropic-completions": "anthropic",
   "openai-agent": "openai",
+  "anthropic": "anthropic",
+  "openai": "openai",
 });
 /** The vendor an engine bills to, or null when the table does not name one. */
 export const vendorOf = (engine) => ENGINE_VENDORS[String(engine ?? "")] ?? null;
@@ -469,7 +500,7 @@ export function runEconomics(runDir, { now = null, bytesPerOutputToken = BYTES_P
     let sawDeclaredNoOutput = false;
 
     for (const rec of rows) {
-      if (!rec || typeof rec.model !== "string") continue;   // only dispatch rows carry a model
+      if (!isAttemptRow(rec)) continue;   // only provider attempts are dispatches (tokens.mjs, isAttemptRow)
       const cls = classesOf(rec.usage);
       const streamed = cls != null && rec.signals?.usageStreamed === true;
 

package/driver/run-requirements.mjs

@@ -44,6 +44,9 @@
 //   BLOCKING — without these nothing runs at all, in any product. The register and its credential (the
 //     driver throws by name at the first stage), the engine and the binary it drives, and the pool the
 //     report is written into. This is the set whose absence produced the outcome at the top of this file.
+//     And what the billing word needs, because the run door refuses without it before any turn: under
+//     `cloud` the switch of the cloud it pays through (or the gateway address), under `api-key` the
+//     engine's key; and the billing word itself, whenever the run door refuses the way it is set.
 //
 //   NARROWING — `PERPLEXITY_API_KEY`. Its absence does NOT crash a run and does not deliver a false
 //     notice: the three clearance searches carry the common-law grid and cannot switch it off, so they
@@ -71,13 +74,16 @@
 //     Refusing here is refusing over OUR bug, and there is nothing for a reader to go and set.
 //
 //   at:"order"   the value an OPERATOR supplies — the register, its credential, the engine and the
-//     binary it drives. Absent, the install is not finished. The doors come up and every run is refused
-//     AT ORDER TIME, before a stage dispatches and before anything is spent, naming what is missing.
+//     binary it drives, and what the billing word needs (above). Absent, the install is not finished.
+//     The doors come up and every run is refused AT ORDER TIME, before a stage dispatches and before
+//     anything is spent, naming what is missing.
 //
 // The axis is on the ROW, not in the caller, for the reason the whole module exists: a start that
 // decides for itself which names are its own and a runner that decides separately are two opinions
 // about one list, and they drift in the direction where the second asks for less.
 
+import { BILLING_MODES, CLOUD_SWITCH, CLOUD_SETTINGS, CLOUD_CREDENTIAL_CHECK, billingMode, cloudsSwitchedOn, resolveAuthMode } from "./engine/auth.mjs";   // — the billing row asks the one resolver which ways an engine can be paid for, and the cloud rows read its own lists
+
 /** The pool a report is written into. Named once; the supervisor already writes it. */
 export const POOL_ENV = "CLEAROTRON_REPORTS_DIR";
 /** The register selection, and the engine selection. */
@@ -85,6 +91,9 @@ export const REGISTER_ENV = "CLEAROTRON_DATABASE";
 export const ENGINE_ENV = "CLEAROTRON_AI";
 /** Narrowing, never blocking — see the header. */
 export const RESEARCH_ENV = "PERPLEXITY_API_KEY";
+/** The settings that decide WHICH cloud a Claude turn goes to: each cloud's switch, and the gateway address.
+ *  Any one of them answers the cloud billing word; start compares all of them against the services' file. */
+export const CLOUD_ROUTES = Object.freeze([...Object.values(CLOUD_SWITCH), "ANTHROPIC_BASE_URL"]);
 
 /** WHEN a blocking value is asked for. `START` is what `clearotron start` writes itself; `ORDER` is what
  *  an operator configures, and its absence refuses a RUN rather than an install. See the header. */
@@ -93,6 +102,35 @@ export const ORDER = "order";
 
 const val = (env, name) => String(env?.[name] ?? "").trim();
 
+// THE WAYS AN ENGINE CAN BE PAID FOR, AS THE BILLING ROW SAYS THEM. The row named all three for every engine,
+// and Codex refuses a cloud account (engine/auth.mjs, resolveAuthMode), so a Codex install was offered a way
+// to pay its run door refuses.
+const PAY_WORDS = Object.freeze({ subscription: "subscription", "api-key": "API key", cloud: "cloud account" });
+
+/**
+ * The billing words `engineId` can be paid by, in BILLING_MODES order: each one asked of the resolver, the
+ * one authority on it, with what that word needs set (the engine's key for `api-key`, a cloud's switch for
+ * `cloud`), so a word the resolver accepts only when its settings are present is not read as refused. An
+ * import of a leaf with no imports of its own, so this module stays pure.
+ */
+export function payWays(engineId, engine = {}) {
+  return BILLING_MODES.filter((mode) => {
+    const env = { [engine.authEnv ?? "CLEAROTRON_AI_BILLING"]: mode,
+      ...(mode === "api-key" && engine.apiKeyEnv ? { [engine.apiKeyEnv]: "set" } : {}),
+      ...(mode === "cloud" ? { [CLOUD_SWITCH.vertex]: "1" } : {}) };
+    try { resolveAuthMode({ engineName: engineId, env }); return true; } catch { return false; }
+  });
+}
+
+/**
+ * A billing refusal from the run door, in words that carry no value. Every refusal names settings and the
+ * billing word, except the one for a word that is not a billing mode, which quotes the word as it is set;
+ * that quote is replaced by the setting's name. PURE. Any other message comes back unchanged.
+ */
+export function billingRefusalWords(message) {
+  return String(message ?? "").replace(/^([A-Z][A-Z0-9_]*)=[\s\S]*? is not a billing mode/, "$1 is set to a word that is not a billing mode");
+}
+
 /**
  * Every environment name this box's configuration says a clearance needs, with the reason each one is
  * there and whether its absence blocks or narrows.
@@ -101,9 +139,9 @@ const val = (env, name) => String(env?.[name] ?? "").trim();
  * environment in hand: the composer has the supervisor's, and the guard has the one it just wrote into
  * the unit file. A function that read the ambient environment would answer about neither.
  *
- * PURE.
+ * PURE, apart from the engine resolver a caller passes in `tables.resolveEngine` (see the engine row).
  */
-export function runRequirements(env = {}, { registers = [], engines = {}, defaultEngine = null } = {}) {
+export function runRequirements(env = {}, { registers = [], engines = {}, defaultEngine = null, resolveEngine = null } = {}) {
   const out = [];
   const push = (name, blocking, why, at = ORDER) =>
     out.push({ name, blocking, why, at, present: Boolean(val(env, name)) });
@@ -128,11 +166,135 @@ export function runRequirements(env = {}, { registers = [], engines = {}, defaul
 
   // ── THE ENGINE, AND THE BINARY IT DRIVES ─────────────────────────────────────────────────────────
   push(ENGINE_ENV, true, "which reasoning engine runs the stages");
-  const engine = (engines ?? {})[val(env, ENGINE_ENV) || defaultEngine || ""];
-  if (engine?.env)
+  const engineId = val(env, ENGINE_ENV) || defaultEngine || "";
+  const engine = (engines ?? {})[engineId];
+  if (engine?.env) {
     push(engine.env, true, `the path to the ${engine.vendor} CLI this engine drives — a stage cannot dispatch without it`);
-  if (engine?.authEnv)
-    push(engine.authEnv, false, "how the engine bills — subscription or key; the adapter refuses before spending if the sign-in it names is absent");
+    // FOUND IS WHAT COUNTS, NOT SET. A program on this environment's PATH, or the copy installed with
+    // Clearotron, needs no path written anywhere, and asking only whether the variable was set refused an
+    // install whose engine the run door would have started. The resolver arrives through the tables, like
+    // everything else this module knows about the install; a caller that passes no resolver gets the
+    // variable's own answer, which is all it can see. The module's one import is engine/auth.mjs, for the
+    // billing row below: a driver leaf with no imports of its own, pure, and the one authority on which
+    // billing words an engine takes, so importing it keeps this module pure and reaches nothing in `bin/`.
+    const row = out[out.length - 1];
+    if (!row.present && typeof resolveEngine === "function") {
+      try { row.present = Boolean(resolveEngine(engineId, { env })?.resolved); } catch { /* not found is not present */ }
+    }
+  }
+  if (engine?.authEnv) {
+    const ways = payWays(engineId, engine);
+    const said = ways.map((m) => PAY_WORDS[m]);
+    push(engine.authEnv, false, `how the engine is paid for — ${said.length > 1 ? `${said.slice(0, -1).join(", ")} or ${said.at(-1)}` : said[0]}; `
+      + `unset means the subscription, and the adapter refuses before spending if the ${ways.includes("cloud") ? "key or cloud account" : "key"} it names is absent`);
+    const billingRow = out[out.length - 1];
+    const billingRows = out.length;
+    const word = billingMode(env);
+    const refused = "without it the engine refuses every search before spending";
+    // ── THE KEY, WHEN THE WORD IS `api-key` ──────────────────────────────────────────────────────────
+    //
+    // The same defect as the cloud below, one billing word over: the word travelled to the services' file
+    // and the key did not, so the run door refused every search after intake ("api-key but
+    // ANTHROPIC_API_KEY is not set"), while start and doctor reported nothing. Blocking at order time, like
+    // the switch: an operator's value, and the run door's own refusal without it.
+    if (word === "api-key" && engine.apiKeyEnv && ways.includes("api-key"))
+      push(engine.apiKeyEnv, true, `the key ${engine.authEnv}=api-key bills every turn to — ${refused}`);
+    // ── THE LONG-LIVED SIGN-IN, WHEN THE WORD IS THE SUBSCRIPTION ────────────────────────────────────
+    //
+    // Setup captures it on a machine that cannot complete a sign-in, which is the server a background
+    // install runs on, and the program reads it from its environment. Carried when set and never asked
+    // for: a machine signed in through the program itself needs none.
+    const tokenEnv = engine.headless?.tokenEnv;
+    if (word === "subscription" && tokenEnv && val(env, tokenEnv))
+      push(tokenEnv, false, `the long-lived sign-in the ${engine.vendor} CLI uses for the subscription on a machine it cannot sign in on; carried as set, and not asked for`);
+    // ── A CLOUD ACCOUNT, AND THE SETTINGS THAT REACH IT ──────────────────────────────────────────────
+    //
+    // The billing word travelled and the cloud did not. A machine set up to pay through a cloud account and
+    // started as background services wrote CLEAROTRON_AI_BILLING=cloud into the services' file and none of
+    // the cloud's own settings, so the run door refused every search: "none of CLAUDE_CODE_USE_VERTEX, …
+    // is set". Measured 2026-09-15 on a Microsoft Foundry configuration.
+    //
+    // ONLY WHEN THE WORD IS `cloud` AND THE ENGINE TAKES ONE — the resolver's answer through `payWays`, not
+    // a list of engines here. Under subscription or api-key nothing of a cloud is carried: a switch left on
+    // in a shell and written into the services' file sends Claude to that cloud, and the run door refuses
+    // a switch beside either word. Codex refuses a cloud account outright, so its rows do not change.
+    if (word === "cloud" && ways.includes("cloud")) {
+      const on = cloudsSwitchedOn(env);
+      const payWord = `${engine.authEnv}=cloud`;
+      // BLOCKING, AT ORDER TIME. Without the switch the run door refuses (engine/auth.mjs), so this is the
+      // same class as the engine and its program: an operator's value, whose absence refuses a run at
+      // intake and never a start.
+      for (const c of on)
+        push(CLOUD_SWITCH[c], true, `sends Claude to ${CLOUD_CREDENTIAL_CHECK[c].who}, the account ${payWord} pays through — ${refused}`);
+      if (!on.length && val(env, "ANTHROPIC_BASE_URL"))
+        push("ANTHROPIC_BASE_URL", true, `the gateway ${payWord} pays through — ${refused}`);
+      if (!on.length && !val(env, "ANTHROPIC_BASE_URL")) {
+        // NOTHING SAYS WHICH CLOUD, and a row has one name. Any one of four settings satisfies it. The row is
+        // NAMED by one real setting, Google's switch, the representative `payWays` above already uses for "a
+        // cloud account", because every reader of a row treats its name as a variable: start and doctor print
+        // it, the runner logs it, and a composite name read as four more items in doctor's list of what is
+        // missing. The REASON names all four, with whose each is. And the row carries all four as `anyOf`,
+        // which `runRequiredNames` hands out as names to read: doctor fills its view of the services by name,
+        // and reading only Google's switch reported a Microsoft machine's switch, held by its services, as
+        // missing.
+        //
+        // A SWITCH THAT IS SET AND NOT ON IS SAID, because it reads as on to a person and as off to the
+        // program: `CLAUDE_CODE_USE_FOUNDRY=0` on a Microsoft machine was answered with Google's switch
+        // and nothing else, and the reader was left to work out why the one they set did not count.
+        // And it is not an alternative to read or carry: `anyOf` is handed to the composer too, and the
+        // set-and-off line would travel through it.
+        const off = Object.values(CLOUD_SWITCH).filter((k) => val(env, k));
+        out.push({ name: CLOUD_SWITCH.vertex, anyOf: CLOUD_ROUTES.filter((k) => !off.includes(k)), blocking: true, at: ORDER, present: false,
+          why: `${payWord} pays through a cloud account and nothing names which one — set `
+            + `${["vertex", "foundry", "bedrock"].map((c) => `${CLOUD_SWITCH[c]}=1 for ${CLOUD_CREDENTIAL_CHECK[c].who}`).join(", ")}, `
+            + `or ANTHROPIC_BASE_URL for a gateway`
+            + (off.length ? ` (${off.join(" and ")} ${off.length > 1 ? "are" : "is"} set, but not on: a switch is on at 1, true, yes or on)` : "")
+            + `; ${refused}` });
+      }
+      // EVERY OTHER CLOUD SETTING THAT IS SET, CARRIED AND NEVER ASKED FOR. Which of them a cloud needs
+      // depends on how the machine signs in to it — an Azure key or the Azure sign-in, an AWS profile, an
+      // instance role or keys, gcloud or a key file — and the model pins are optional everywhere. The run
+      // door asks for none of them; the cloud refuses a missing one at the first turn. So a row is made
+      // only for a name that is set: present by construction, it can never be reported missing or refuse
+      // anything, and exists so the composer carries it. Names on CLOUD_SETTINGS only — never the rest of
+      // the environment, which would put every secret in a shell into the services' file.
+      //
+      // NEVER A SWITCH. One that is on is a row above. One that is set and not on switches nothing, and
+      // carried into the services' file it held that line there, where the add-only merge kept a later
+      // `=1` out of it for good.
+      const who = on.length === 1 ? CLOUD_CREDENTIAL_CHECK[on[0]].who : !on.length && val(env, "ANTHROPIC_BASE_URL") ? "the gateway" : "the cloud account";
+      const named = new Set(out.flatMap((r) => r.anyOf ?? [r.name]));
+      for (const k of CLOUD_SETTINGS)
+        if (!named.has(k) && !Object.values(CLOUD_SWITCH).includes(k) && val(env, k))
+          push(k, false, `one of the settings Claude reads to reach and pay ${who}; carried as set, and not asked for, because which ones a cloud needs depends on how this machine signs in to it`);
+    }
+    // ── AND ANY OTHER WAY THE RUN DOOR REFUSES HOW THIS IS PAID FOR ──────────────────────────────────
+    //
+    // The rows above name what is MISSING. The run door also refuses what is set wrongly: two clouds
+    // switched on, a switch left on beside `subscription` or `api-key`, a word that is not a billing mode,
+    // a cloud account on Codex. Each passed start's guard, the order wall and doctor, and the run was then
+    // refused after intake. Measured 2026-09-15: a services' file holding Microsoft's switch from one start
+    // and Google's from the next read clean everywhere and refused every search.
+    //
+    // ASKED OF THE RUN DOOR ITSELF, `resolveAuthMode`, over the environment being judged, and its refusal
+    // is the reason: one authority, so this check can be neither stricter nor laxer than the door. Its
+    // words carry names and the billing word, never a key. The row that turns blocking is the billing
+    // word's own, so no new name is handed to the composer: a switch beside `subscription` stays out of
+    // the services' file, as the cloud rows above intend. `present` on a row means SATISFIED, which is
+    // what every reader of it asks; for this row, set is not enough. When a row above already names what
+    // is missing, that row is the answer and this adds nothing, because the door's refusal is the same one.
+    //
+    // ONE OF THE DOOR'S REFUSALS QUOTES A VALUE: the word that is not a billing mode. A key pasted into the
+    // billing word by mistake is that value, and this reason is printed by start, by doctor and in the
+    // runner's log. So it is said by name, through billingRefusalWords below.
+    if (!out.slice(billingRows).some((r) => r.blocking && !r.present)) {
+      try { resolveAuthMode({ engineName: engineId, env }); } catch (e) {
+        if (e?.billingRefusal)
+          Object.assign(billingRow, { blocking: true, present: false, at: ORDER,
+            why: `every search is refused before spending, over how this machine is set to pay: ${billingRefusalWords(e.message)}` });
+      }
+    }
+  }
 
   push(RESEARCH_ENV, false, "the three clearance searches carry the common-law grid and refuse at preflight without it; a Knockout search still runs and discloses the half it skipped");
 
@@ -147,7 +309,9 @@ export function runRequirements(env = {}, { registers = [], engines = {}, defaul
  * a box whose operator configured them, which is the same shape of defect one size down.
  */
 export function runRequiredNames(env = {}, tables = {}) {
-  return runRequirements(env, tables).map((r) => r.name);
+  // A row any one of several settings satisfies names them in `anyOf`, and each is a name to carry or read.
+  // Each name once: a name handed out twice is read twice and reported twice.
+  return [...new Set(runRequirements(env, tables).flatMap((r) => r.anyOf ?? [r.name]))];
 }
 
 /**

package/driver/runner.mjs

@@ -774,15 +774,15 @@ async function backstopFailureNotice({ res, job, agentId, base, codename, studio
 // starts, so nothing is spent and nothing is promised.
 
 let __runTables = null;
-async function runTables() {
+export async function runTables() {   // exported for the requirement-check wiring test
   // AT CALL TIME, never a static import. `driver/run-requirements.mjs`'s header states the reason and it
   // is load-bearing: the register SELECTION table lives in `bin/onboard.mjs`, a CLI entry point, and a
   // static import from `driver/` would point the driver at `bin/` — the cycle that makes `clearotron
   // doctor` exit 13 after printing most of a report.
   if (!__runTables) {
     const { PROVIDERS } = await import("../bin/onboard.mjs");
-    const { ENGINE_BINARIES, DEFAULT_ENGINE_ID } = await import("./driver.config.mjs");
-    __runTables = { registers: PROVIDERS, engines: ENGINE_BINARIES, defaultEngine: DEFAULT_ENGINE_ID };
+    const { ENGINE_BINARIES, DEFAULT_ENGINE_ID, resolveEngineProgram } = await import("./driver.config.mjs");
+    __runTables = { registers: PROVIDERS, engines: ENGINE_BINARIES, defaultEngine: DEFAULT_ENGINE_ID, resolveEngine: resolveEngineProgram };
   }
   return __runTables;
 }

package/driver/stages.mjs

@@ -1260,7 +1260,7 @@ export const STAGES = {
       },
       "scope_jurisdictions / excluded_jurisdictions / scope_basis — typed fields the driver renders": {
         class: "mechanical:code-rendered", tokens: ["frame_scope_missing"],
-        why: "CLASS ALIGNED WITH `## Instructed scope` in this same stage — #850 rules that row \"Code stamps the section from _driver/instructed-scope.json\", and the instructed jurisdictions are in that same file. Not pre-bound: no form carries them. On the instructed branch the driver already holds the list and hands it over; the model retypes it into a shape the driver dictates. verify.mjs:1171 string-compares it back — `add(\"jurisdictions\", scope.jurisdictions)` — failing frame_scope_missing:jurisdictions, so this half IS policed, unlike the campaign-shape twin above. [citation unverified]",
+        why: "CLASS ALIGNED WITH `## Instructed scope` in this same stage — #850 rules that row \"Code stamps the section from _driver/instructed-scope.json\", and the instructed jurisdictions are in that same file. Not pre-bound: no form carries them. On the instructed branch the driver already holds the list and hands it over; the model retypes it into a shape the driver dictates. verify.mjs checkFindingsSibling string-compares it back — `add(\"jurisdictions\", scope.jurisdictions)` — failing frame_scope_missing:jurisdictions, so this half IS policed, unlike the campaign-shape twin above.",
       },
       "Scope reasoning — search-wide/cite-narrow, the in-scope-by-reach routes, and the reopen trigger behind each exclusion": {
         class: "judgment", tokens: [],
@@ -2482,8 +2482,12 @@ export const STAGES = {
         class: "judgment", tokens: ["too_short", "missing"],
         why: "'The only relevance judge' — the funnel pre-gated nothing (prelim-register SKILL.md, `## Coverage = the band blocks`). #850 keeps findings prose / relevance gate / opposition / Option-D / position rows as J.",
       },
+      "every record the run carried into this stage ends somewhere — a findings row, a Negative-results drop, or a Disagreement resolution": {
+        class: "judgment", tokens: ["registerdigest_unaccounted_records", "registerdigest_nothing_judged", "registerdigest_accounting_unreadable", "registerdigest_model_missing", "registerdigest_batch_unknown", "registerdigest_double_counted", "registerdigest_model_write_failed"],
+        why: "A record that simply goes unmentioned is a silent recall loss — the one failure this stage's output exists to prevent, and the one no reader of the document can see, because a band judged in part looks exactly like a band judged in full. Armed by an era stamp, so archived runs replay to the verdicts they always had. It is checked at the CALL, scoped to the batch that call was handed, and again at the EXIT over the union: the call-time scope is what lets a dense band be recorded at all, and the exit is where that concession is paid for. Four of these are driver-written and say so — a run stamped for accounting whose own facts or stored model are missing is this driver's bug, not a model defect, and telling a seat to re-state cannot fix it.",
+      },
       "the Sheet-1 findings row's identifier cells — URI, Mark, Owner, Country, Classes, Status, Filed, Expiry": {
-        class: "mechanical:tool-written", tokens: ["registerdigest_uri_missing", "registerdigest_uri_unknown"],
+        class: "mechanical:tool-written", tokens: ["registerdigest_uri_missing", "registerdigest_uri_unknown", "registerdigest_flag_reason_missing", "registerdigest_verify_invalid"],
         why: "CONVERTED (conversion 11): the seat sends the position's `uri` and the driver renders every cell from the band record it names — record_id, mark_text, classes, status, owner_name, owner_country, application_date, registration_date, expiry_date. The join is now the check: a uri no band record carries is refused AT THE CALL, where restating it costs nothing, instead of producing a plausible row of retyped cells that fails downstream or nowhere. The DECISION that a position earns a row stays judgment (element above); the cells were never anything but transcription.",
       },
       "the full clickable record URL, composed from providers/<name>.md 'Record base host' plus the record `uri`": {
@@ -2495,7 +2499,7 @@ export const STAGES = {
         why: "CONVERTED (conversion 11): the driver stamps the provider and its environment word into the rendered document from the run config it already holds, and the tool takes no field for either. 'Exactly one register per run' (prelim-register SKILL.md, `## Provider`) and digest.md's `## Provider` note conceded 'the tag is constant across the findings file' — a constant the seat was retyping onto every record.",
       },
       "Negative-results drop rows — the Notes cell carrying URI, screen_verdict, class and status": {
-        class: "mechanical:tool-written", tokens: ["registerdigest_uri_unknown", "registerdigest_drop_reason_missing"],
+        class: "mechanical:tool-written", tokens: ["registerdigest_uri_unknown", "registerdigest_drop_reason_missing", "registerdigest_drop_ground_invalid", "registerdigest_drop_ground_contradicted"],
         why: "CONVERTED (conversion 11): the seat sends the dropped record's `uri` and its one-line reason; the driver renders the Notes cell's four provenance fields from the band record. This is the element the conversion most clearly repays — the acceptance gate used to parse those fields back out to check the model's retyping against material the driver already held, which is a guard comparing a value with a copy of itself. The DROP DECISION and its why stay judgment (the findings-prose element), and a drop with no stated reason is refused: a batch-dropped candidate with no row is a silent recall loss.",
       },
       "## Summary counts — total queries executed (search + detail-fetch), enumerated records across N axes, crowd-descriptor count, candidates past the gate, surfaced count, open-verification-flag count": {
@@ -2507,7 +2511,7 @@ export const STAGES = {
         why: "CONVERTED (conversion 11): the driver renders the Audit trail table from the same artifacts as the Summary counts, plus `_query` which digest.md:388 says 'the driver stamps at merge' — carrying that forward was transcription of a driver stamp. The judgment half — flagging a unit that shortcut its axis — stays in the findings-prose element.",
       },
       "INSTRUCTED CHECKS — the answer to each requester ask the register owns": {
-        class: "judgment", tokens: [],
+        class: "judgment", tokens: ["registerdigest_instructed_incomplete"],
         why: "Answering a lawyer's question from the frozen band, including the honest 'the frozen material cannot answer this' that becomes an open coverage row. No artifact holds it. (No token here: intake_ask_unanswered lives on validators.narrative, not registerFindings.)",
       },
       "the record ids read while answering each instructed check": {
@@ -2515,7 +2519,7 @@ export const STAGES = {
         why: "CONVERTED (conversion 11): the driver renders the ids beneath each instructed check from its own reading audit, and the tool takes {ask, answer} only. Every band_shape / band_lookup / band_record call lands in reading-log.jsonl with its args (the pattern #850 names as already existing for the band tools), so the driver held this list the whole time the seat was being asked to reproduce it.",
       },
       "adopt-or-override each placement by engaging its reason, and the `### Disagreement resolutions` rows (one per surfaced disagreement and per borderline:true, each ADOPTED/OVERRODE in writing)": {
-        class: "judgment", tokens: [],
+        class: "judgment", tokens: ["registerdigest_adjudication_invalid", "registerdigest_adjudication_incomplete"],
         why: "Answering the promotion question the other way, in writing, against a reason another stage authored. #850 keeps it J. The row's SUBJECT is handed over as data (the driver appends the PLACEMENT RULINGS TAIL block, pipeline.mjs:3584), so nothing here is a fetch. [citation unverified]",
       },
       // ── REWRITTEN, NEVER DELETED (the ruling) — AND THE ROW THAT COST THIS CONVERSION A DESIGN ──
@@ -2843,8 +2847,8 @@ export const STAGES = {
     // 20-min override on the VELTRIPHEN run). NOTE 2026-06-17: Opus fast mode was REMOVED here and everywhere
     // (it ~2.5x'd subscription usage → 5h-cap 429s); HIGH effort retained.
     // CLEAROTRON_SYNTHESIS_MODEL (2026-07-10): stage-specific override for a live A/B test (Fable vs Opus 4.8) on
-    // just this stage — the driver's only other env override (CLEAROTRON_AZURE_MODEL, driver.config.mjs) is
-    // tier-wide, which would retarget all 6 opus stages. Unset ⇒ unchanged default "opus". Toggled live in
+    // just this stage — stage-specific because a tier-wide override would retarget all 6 opus stages.
+    // Unset ⇒ unchanged default "opus". Toggled live in
     // the service's EnvironmentFile (a oneshot unit — no restart needed, takes effect on the next
     // queue-triggered run), never hardcoded here.
     model: process.env.CLEAROTRON_SYNTHESIS_MODEL || "opus", thinking: "high", timeoutSec: 2500, stallSec: 900,
@@ -3516,7 +3520,7 @@ export const STAGES = {
       },
       "the `[on: N, M]` flag ordinals — which findings each flag names": {
         class: "mechanical:code-extracted", tokens: [],
-        why: "#850: selection against the finding index the driver already holds; targetsOf's normalised prose join is the fallback that already fails (6 of 9 flags resolved to nothing on a delivered run). NO TOKEN: parseOn exists at verify.mjs:583 and validators.seniorEyeReview never calls it — the skill file itself says \"either every flag has one or none of them do any work\", and nothing checks which state a review is in [citation unverified]",
+        why: "#850: selection against the finding index the driver already holds; targetsOf's normalised prose join is the fallback that already fails (6 of 9 flags resolved to nothing on a delivered run). NO TOKEN: parseOn exists at verify.mjs commonLawHalfEvidence and validators.seniorEyeReview never calls it — the skill file itself says \"either every flag has one or none of them do any work\", and nothing checks which state a review is in",
       },
       "the section titled exactly \"PLAN-EXECUTION CHECK\"": {
         class: "mechanical:code-rendered", tokens: ["plan_audit_missing"],