clearotron 0.3.2-beta.7 → 0.3.2-beta.8

package/driver/band-size.mjs

@@ -64,3 +64,62 @@ export function bandSizeForStage(stage, paths, io) {
   if (!BAND_READING_STAGES.has(stage)) return undefined;
   return bandSizeAtDispatch(paths, io);
 }
+
+// ── A STAGE'S TIME LIMIT IS DERIVED FROM WHAT IT IS HANDED, NEVER A FIXED CONSTANT ────────────────
+//
+// THE DEFECT. The two stages that read the register band carried per-stage constants — numbers chosen
+// once, against a band nobody recorded beside them. On a dense matter both died at their wall having
+// written nothing: the placement attempt at 2,765s against a 2,700s budget, the digest at 2,470s
+// against 2,400s. Both sat exactly AT the ceiling, so what ended them was the budget expiring rather
+// than any guard firing; the stall guards had half an hour of quiet to fire in and could not, because
+// tokens were still moving. Nothing malfunctioned. The number was simply sized for a different matter.
+//
+// THE TWO MEASUREMENTS THESE CONSTANTS ARE SET AGAINST, named here because a budget without the band
+// it was measured at is the thing being fixed:
+//   · 2026-09-16, the dense matter: an 8 MB merged band; the placement attempt needed more than 2,765s
+//     and was killed at 2,700s. The derived limit at that size must exceed what the attempt took.
+//   · Every ordinary matter before it: a band at or under REFERENCE_MB, where 2,700s was sufficient and
+//     is what those runs are verified at. At or below that size the derivation must return the base
+//     unchanged, so no existing run's budget moves and no archived verdict is re-decided.
+export const LIMIT_REFERENCE_MB = 2;
+export const LIMIT_GROWTH_PER_MB = 0.03;
+// The band size above which a stage is refused at dispatch rather than started. A limit past this is
+// not a budget, it is a prediction that the stage will die: the 177 MB band measured on an earlier
+// round would derive past an hour and a half, and starting it spends that hour and a half to arrive
+// where the refusal already is. Refusing NAMES the size, which is the finding; being killed does not.
+export const LIMIT_CEILING_SEC = 5400;
+
+/**
+ * The time limit for this dispatch, derived from the band it is handed. PURE.
+ *
+ * ABOVE THE REFERENCE SIZE ONLY. A band at or under the reference returns the stage's own base
+ * unchanged — that is what every run before this is verified at, and a derivation that moved those
+ * numbers would re-decide archived verdicts to fix a defect they never had.
+ *
+ * AN UNMEASURABLE BAND RETURNS THE BASE, and says so through `basis`. The alternatives are worse in
+ * both directions: guessing a bigger number spends a client's money on an input nobody measured, and
+ * guessing a smaller one kills a stage for a band that might have been ordinary. The base is what the
+ * run would have used anyway, so an absent measurement changes nothing rather than changing something
+ * arbitrary.
+ */
+export function derivedLimitSec(baseSec, bandSize) {
+  const base = Number.isFinite(baseSec) && baseSec > 0 ? baseSec : null;
+  if (base === null) return { sec: null, inputBytes: null, basis: "no base for this stage" };
+  const bytes = Number.isFinite(bandSize?.bytes) ? bandSize.bytes : null;
+  if (bytes === null) return { sec: base, inputBytes: null, basis: bandSize?.absent ? `band unmeasured: ${bandSize.absent}` : "no band for this stage" };
+  const mb = bytes / (1024 * 1024);
+  const over = Math.max(0, mb - LIMIT_REFERENCE_MB);
+  const sec = Math.round(base * (1 + LIMIT_GROWTH_PER_MB * over));
+  return { sec, inputBytes: bytes, basis: over > 0 ? `derived from ${mb.toFixed(1)} MB` : `at or under the ${LIMIT_REFERENCE_MB} MB reference` };
+}
+
+/** Is this derived limit past the point where starting the stage only buys a later kill? PURE. */
+export function limitExceedsCeiling(sec) {
+  return Number.isFinite(sec) && sec > LIMIT_CEILING_SEC;
+}
+
+/** The refusal a dispatch past the ceiling carries — it NAMES the size, which is the finding. PURE. */
+export function ceilingRefusal(stage, derived) {
+  const mb = Number.isFinite(derived?.inputBytes) ? (derived.inputBytes / (1024 * 1024)).toFixed(1) : "an unmeasured";
+  return `stage_input_over_ceiling:${stage} was handed a ${mb} MB band, which derives a ${derived?.sec}s limit against a ${LIMIT_CEILING_SEC}s ceiling — the stage is refused at dispatch rather than started, because a limit past the ceiling is a prediction that it will be killed and starting it spends the whole budget to arrive at the same place. The band size is the finding: a band this size is the defect, not the budget`;
+}

package/driver/config-inventory.mjs

@@ -42,7 +42,10 @@ import {
   DEFAULT_ENGINE_ID, ENGINE_BINARIES, PROVIDERS, RESEARCH_PROVIDERS, SERP_PROVIDERS,
   missingCredentials, preflightEngineBinary, providerIdFrom,
 } from "./driver.config.mjs";
-import { resolveAuthMode } from "./engine/auth.mjs";
+import {
+  resolveAuthMode, billingMode, cloudsSwitchedOn, BILLING_MODES, CLOUD_SWITCH, CLOUD_CREDENTIAL_CHECK,
+} from "./engine/auth.mjs";
+import { billingRefusalWords } from "./run-requirements.mjs";   // — a refusal that quotes the billing word says it by name
 import { CASELAW_BRIDGES } from "./engine/mcp/gather-config.mjs";   // — the list that decides what is spawned
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
@@ -60,7 +63,9 @@ const shown = (names) => names.map((n) => n);
  * absent, because the alternative is silently billing a subscription the operator thought they had
  * stopped using (engine/auth.mjs's opening argument). A writer that caught that and recorded "unknown"
  * would erase precisely the misconfiguration a staff config page exists to surface, so it is caught and
- * recorded AS ITSELF: mode `api-key`, `apiBilled: false`, and a fault naming the variable to set.
+ * recorded AS ITSELF: mode `api-key`, `apiBilled: false`, and a fault naming the variable to set. The
+ * cloud mode's refusals, and a word that is not a mode at all, are recorded as themselves too, by the
+ * refusal's own sentence.
  *
  * `apiBilled` is what the page should believe over `mode` — the two come apart in exactly this case,
  * and only one of them describes who gets the invoice.
@@ -77,14 +82,38 @@ export function engineInventory(env = process.env) {
   const billing = (() => {
     try {
       const a = resolveAuthMode({ engineName: id, env });
-      return { mode: a.mode, apiBilled: a.apiBilled === true, missing: [] };
-    } catch {
-      // The one state resolveAuthMode throws for. The message carries no value, but it is not copied
-      // either — the two variable names are reconstructed from the table so this cannot drift from it.
+      // `cloud` is the resolver's own answer, never re-derived here: the account a run bills is whatever
+      // the run door resolves, and a page that worked it out a second way could name another.
+      const cloud = a.cloud ?? null;
+      return { mode: a.mode, apiBilled: a.apiBilled === true, missing: [], cloud, cloudName: cloudName(cloud) };
+    } catch (e) {
+      // Recorded AS ITSELF, whichever refusal it was. An API-key mode with no key names the variable to
+      // set, reconstructed from the table so it cannot drift from it. Every other refusal (a cloud mode with
+      // no cloud switched on or with two, a cloud switch beside a mode it contradicts, a word that is not a
+      // mode) leaves `missing` empty, because the page reads `missing` as "set this key" and a key that is
+      // set is not missing, and carries a `reason` the page words itself (billingRefusalReason, below).
+      const mode = billingMode(env);
+      const keyAbsent = Boolean(spec?.apiKeyEnv) && String(env[spec.apiKeyEnv] ?? "") === "";
+      if (mode === "api-key" && keyAbsent) {
+        return { mode, apiBilled: false, missing: shown([spec.apiKeyEnv]), cloud: null, cloudName: null };
+      }
+      const reason = billingRefusalReason(id, env);
+      const notAMode = reason.kind === "not-a-mode";
       return {
-        mode: "api-key",
-        apiBilled: false,
-        missing: spec?.apiKeyEnv ? shown([spec.apiKeyEnv]) : [],
+        // A WORD THAT IS NOT A MODE IS NOT RECORDED. It is whatever was typed into the setting that decides
+        // who pays, and a key pasted there by mistake is that word; this inventory is written to a file and
+        // served to a browser. So the mode reads `unknown`, and the refusal says the setting by name.
+        mode: notAMode ? "unknown" : mode,
+        apiBilled: false, missing: [], cloud: null, cloudName: null,
+        // THAT REFUSAL IS WRITTEN HERE, NOT CLEANED FROM THE RESOLVER'S. The resolver's sentence quotes the
+        // typed word, and removing it by pattern depends on how the word is spelled: a word that itself
+        // contains " is not a billing mode" left its tail behind. Built from names alone, nothing typed can
+        // reach it. Every other refusal quotes only setting names and the three mode words.
+        refusal: notAMode
+          ? `${reason.setting} is set to a word that is not a billing mode — refusing to guess, because the guess `
+            + `would bill the subscription. One of: ${reason.modes.join(", ")}.`
+          : billingRefusalWords(String(e?.message ?? e)),
+        reason,
       };
     }
   })();
@@ -104,6 +133,80 @@ export function engineInventory(env = process.env) {
   return { id, vendor: spec?.vendor ?? null, known: Boolean(spec), billing, binaryPresent };
 }
 
+/**
+ * What a reader calls the account a cloud mode bills: "Google Cloud", "Microsoft Azure", "Amazon Bedrock"
+ * or "Gateway". Null for no cloud.
+ *
+ * ONE TABLE OF CLOUD NAMES, NOT TWO. `CLOUD_CREDENTIAL_CHECK` in engine/auth.mjs already names each cloud
+ * the way a reader knows it, for the advice a refused sign-in prints, and this reads it rather than keeping
+ * a second list that could name a cloud differently on the page. It writes the gateway "the gateway", for
+ * use inside a sentence; a label on a page drops the article and starts with a capital, and that one
+ * adjustment is the whole of what this adds.
+ */
+export function cloudName(cloud) {
+  const who = CLOUD_CREDENTIAL_CHECK[cloud]?.who;
+  if (!who) return null;
+  const bare = who.replace(/^the /, "");
+  return bare.charAt(0).toUpperCase() + bare.slice(1);
+}
+
+/**
+ * WHY A BILLING SETTING REFUSES EVERY SEARCH, as data: which refusal it is and the names involved, so the
+ * config page words it once, in plain English, without reading the resolver's sentence apart.
+ *
+ * `kind` is one of:
+ *   switch-beside-mode  subscription or api-key, and a cloud's switch on beside it (`clouds`)
+ *   two-clouds          cloud, and more than one cloud switched on (`clouds`)
+ *   no-cloud            cloud, and no cloud switched on and no gateway address (`clouds` lists every
+ *                       switch, and `gateway` the gateway's setting, as the choices to make)
+ *   not-a-mode          a word that is not a billing mode (`modes` are the ones this engine takes)
+ *   cloud-on-codex      cloud, on the Codex engine, which a cloud account cannot pay for (`engineSetting`
+ *                       and `engineChoice` name the Claude engine only where it would pay: one cloud
+ *                       switched on, or none and a gateway address; otherwise that move is one more refusal)
+ *   unclassified        a refusal this list does not name; the page says only that searches are refused.
+ *                       Not "other": that is an assistant's id in connect-clients.mjs, and a surface may
+ *                       not name one in code
+ *
+ * `defaulted` says the billing setting is blank, so `subscription` is the default and not a word anybody
+ * wrote: a page that said "payment is set to subscription" would send a reader looking for a line their
+ * settings file does not have. It is the state measured on Foundry, a switch on and the word unset.
+ *
+ * THE SAME PREDICATES AS THE RESOLVER, IN ITS ORDER. `resolveAuthMode` refuses by throwing a sentence and
+ * nothing else, so the kind is read back from the same environment through the same functions it uses
+ * (`billingMode`, `cloudsSwitchedOn`), in the order it checks them. Called only once it has thrown.
+ *
+ * NAMES, NEVER A VALUE. `mode` is sent only when it is one of the three modes; the word in a `not-a-mode`
+ * refusal is whatever was typed, and it is not sent at all.
+ */
+export function billingRefusalReason(id, env = process.env) {
+  const mode = billingMode(env);
+  const setting = "CLEAROTRON_AI_BILLING";
+  const clouds = (ids) => ids.map((c) => ({ name: cloudName(c), setting: CLOUD_SWITCH[c] }));
+  const defaulted = String(env[setting] ?? "").trim() === "";
+  const base = { setting, mode: null, defaulted, clouds: [], modes: [], gateway: null, engineSetting: null, engineChoice: null };
+  if (id === "openai-agent") {
+    if (mode === "cloud") {
+      // The resolver's own test for a cloud the Claude engine would pay through, in its words: one switch,
+      // or no switch and a gateway address.
+      const on = cloudsSwitchedOn(env);
+      const claudeWouldPay = on.length === 1 || (!on.length && Boolean(env.ANTHROPIC_BASE_URL));
+      return { ...base, kind: "cloud-on-codex", mode, modes: ["subscription", "api-key"],
+        ...(claudeWouldPay ? { engineSetting: "CLEAROTRON_AI", engineChoice: "anthropic-agent" } : {}) };
+    }
+    if (mode !== "subscription" && mode !== "api-key") return { ...base, kind: "not-a-mode", modes: ["subscription", "api-key"] };
+  }
+  if (id === "anthropic-agent") {
+    const on = cloudsSwitchedOn(env);
+    if ((mode === "subscription" || mode === "api-key") && on.length) return { ...base, kind: "switch-beside-mode", mode, clouds: clouds(on) };
+    if (mode === "cloud" && on.length > 1) return { ...base, kind: "two-clouds", mode, clouds: clouds(on) };
+    if (mode === "cloud" && !on.length) {
+      return { ...base, kind: "no-cloud", mode, clouds: clouds(Object.keys(CLOUD_SWITCH)), gateway: "ANTHROPIC_BASE_URL" };
+    }
+    if (!BILLING_MODES.includes(mode)) return { ...base, kind: "not-a-mode", modes: [...BILLING_MODES] };
+  }
+  return { ...base, kind: "unclassified", mode: BILLING_MODES.includes(mode) ? mode : null };
+}
+
 /**
  * The three states an install can be in, as far as running a search goes..
  *

package/driver/contract-arm2-baseline.json

@@ -11,7 +11,7 @@
     "the baseline tracks named elements, and a rename is a new name. Regenerate rather than work around it.",
     "Measured 139 of 287 declared elements."
   ],
-  "total": 107,
+  "total": 105,
   "byStage": {
     "matter-frame": [
       "### Intake asks line shape — rendered by the driver from intake_asks[]",
@@ -94,8 +94,6 @@
     "register-digest": [
       "## Summary counts — total queries executed (search + detail-fetch), enumerated records across N axes, crowd-descriptor count, candidates past the gate, surfaced count, open-verification-flag count",
       "Audit trail — per-unit search/detail-fetch counts, per-jurisdiction `_query` attribution",
-      "INSTRUCTED CHECKS — the answer to each requester ask the register owns",
-      "adopt-or-override each placement by engaging its reason, and the `### Disagreement resolutions` rows (one per surfaced disagreement and per borderline:true, each ADOPTED/OVERRODE in writing)",
       "return payload — the absolute output path plus a 2-3 line summary (counts + the path of the file written)",
       "rolled-up coverage judgment — `sufficient: <true|false>`",
       "source attribution — the register name tagged on each record, plus the EUIPO `environment` word",

package/driver/contract-e3-backlog.mjs

@@ -283,7 +283,7 @@ export const E3_BACKLOG = [
   {
     stage: "register-unit",
     kind: "exactly-these-keys",
-    where: "driver/stages.mjs:4191 (the frame-reopen / scoped-retry message builder). A second number stood here and had been stale for some time: it pointed at a contract-element description rather than a builder, at its old line and at every mechanical shift of it. Two candidate builders sit beside 4157 and picking one would be a guess, so the wrong pointer is removed rather than moved a third time — one accurate citation beats one accurate and one invented.",
+    where: "driver/stages.mjs:4195 (the frame-reopen / scoped-retry message builder). A second number stood here and had been stale for some time: it pointed at a contract-element description rather than a builder, at its old line and at every mechanical shift of it. Two candidate builders sit beside 4157 and picking one would be a guess, so the wrong pointer is removed rather than moved a third time — one accurate citation beats one accurate and one invented.",
     surface: "stage-message",
     evidence: "Every block you append MUST carry \"state\":\"enumerated\" (ONLY if paged to has_more:false) or \"state\":\"incomplete\" — EXACTLY those two strings … (re-dispatch builders, which REPLACE def.message)",
     reparsedBy: "driver/named-band.mjs parseNamedBand. Scope warning: these builders replace def.message on every escalation / envelope-close / frame-reopen dispatch, so an E3 lint that walks STAGES[*].message only never sees them",
@@ -346,7 +346,7 @@ export const E3_BACKLOG = [
     // (coverage-form.mjs coverageFormBrief) and the tool schema, with every row receiver-validated at
     // call time. Same dictated vocabulary, same authored site, new route — this row's evidence follows
     // the dictation so the row keeps describing something that exists.
-    where: "driver/stages.mjs:2618 (the digest message) + driver/coverage-form.mjs (coverageFormBrief — the dispatch block carrying the enum and the row shape)",
+    where: "driver/stages.mjs:2622 (the digest message) + driver/coverage-form.mjs (coverageFormBrief — the dispatch block carrying the enum and the row shape)",
     surface: "stage-message",
     evidence: "Record a \"status\" and a \"reason\" on EVERY row ONLY by calling the … tool — the driver validates each row as it arrives, holds the record itself, and renders both the ## Coverage ledger table and the coverage JSON from it",
     reparsedBy: "driver/coverage-call.mjs validateCoverageCall (receiver-validated at call time, the same predicates the gate judges with) + driver/coverage-form.mjs rowIsSettled via validators.registerFindings over the _driver/ accumulator",
@@ -429,7 +429,7 @@ export const E3_BACKLOG = [
   {
     stage: "frame-diff",
     kind: "exactly-these-keys",
-    where: "driver/stages.mjs:2798",
+    where: "driver/stages.mjs:2802",
     surface: "stage-message",
     evidence: "For each blind-model variant / field / source the run did NOT scope or search, emit one directive {layer, item, observation, severity} … severity = dominant-element (the omission is ON the spine) | material (a real omission worth a targeted sweep) | minor (already covered, or presentation only).",
     reparsedBy: "driver/verify.mjs validators.frameDiff + driver/pipeline.mjs runSupplementalSweeps (the parser REFUSES a firing variant directive that dictates nothing dispatchable)",
@@ -453,7 +453,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3178",
+    where: "driver/stages.mjs:3182",
     surface: "stage-message",
     evidence: "MACHINE FINDINGS (MANDATORY): … a JSON OBJECT {\"schema_version\":<FINDINGS_SCHEMA_VERSION>,\"rated_under_framework\":\"…\",\"findings\":[...],\"coverage\":[...],\"context_notes\":[...],\"actions\":[...],\"ask_answers\":[...]} … Each finding object has EXACTLY these keys: {\"ordinal\",\"mark\",\"owner\",\"band\",\"net\",\"bor",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson via validators.narrative",
@@ -467,7 +467,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "exactly-these-keys",
-    where: "driver/stages.mjs:3214",
+    where: "driver/stages.mjs:3218",
     surface: "stage-message",
     evidence: "- off_field_ground (MANDATORY on every off-field finding, FORBIDDEN on every other disposition): EXACTLY one bare token of: ${OFF_FIELD_GROUNDS.join(\" / \")}",
     reparsedBy: "driver/findings-model.mjs validateOffFieldGround — the enum is imported from findings-model.mjs and interpolated back into the prompt, so code already holds the list it asks the model to type",
@@ -476,7 +476,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3215",
+    where: "driver/stages.mjs:3219",
     surface: "stage-message",
     evidence: "- manageable …: {\"category\":\"<EXACTLY one of large-competitor / commercial-partner / troll / well-known-enforcer>\",\"reason\":\"<one-two lines…>\"}",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
@@ -485,7 +485,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3231",
+    where: "driver/stages.mjs:3235",
     surface: "stage-message",
     evidence: "- meters: {\"mark_similarity\":{...},\"goods_proximity\":{...},\"use\":{...},\"enforcer\":{...}} — all four present, each {\"token\",\"basis\",\"source\"}. … mark_similarity = high | medium | low. goods_proximity = high | medium | low. enforcer = high | medium | low | unknown. use = confirmed | not-confirmed | un",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; driver/verify.mjs:1171 checkFindingsSibling gates meters.*.source; finding_basis_source_missing",
@@ -494,7 +494,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3232",
+    where: "driver/stages.mjs:3236",
     surface: "stage-message",
     evidence: "- quadrant: {\"x\",\"y\"} numbers in [0,1]. x = goods/services proximity (0 = distant, 1 = identical). y = mark similarity (0 = distinct, 1 = identical).",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
@@ -503,7 +503,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3233",
+    where: "driver/stages.mjs:3237",
     surface: "stage-message",
     evidence: "- source: {\"source_type\",\"resolved_link\"}. source_type EXACTLY one of: register-vendor / register-euipo / common-law-marketplace / common-law-web / case-law",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
@@ -512,7 +512,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "exactly-these-keys",
-    where: "driver/stages.mjs:3234",
+    where: "driver/stages.mjs:3238",
     surface: "stage-message",
     evidence: "coverage[]: ONE object per coverage AREA, EXACTLY {\"area\",\"state\",\"note\"}. … state EXACTLY one of: confirmed-clean / coverage-limited / open / not-searched / note.",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; the render owns the coverage panel from these typed states",
@@ -521,7 +521,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3243",
+    where: "driver/stages.mjs:3247",
     surface: "stage-message",
     evidence: "use_check = {\"source\",\"quality\"}: … quality: OPTIONAL, EXACTLY one of owner-site / independent / register-mirror … own_rights = {\"source\"}",
     reparsedBy: "driver/verify.mjs:988 checkFindingsSibling (finding_use_check_missing); driver/own-rights.mjs:19-22",
@@ -530,7 +530,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3300",
+    where: "driver/stages.mjs:3304",
     surface: "stage-message",
     evidence: "MARK ASSESSMENT … STRUCTURED FORM …: either field may instead be an OBJECT {\"read\":\"…\",\"spectrum\":\"…\",\"per_class\":[{\"class\":\"5\",\"note\":\"…\"}],\"per_market\":[{\"market\":\"CN\",\"note\":\"…\"}],\"counter_registrations\":[{\"mark\":\"…\",\"uri\":\"/mark/…\",\"note\":\"…\"}],\"acquired\":\"<optional>\",\"note\":\"<optional residual>",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; the report collapses the rows behind toggles and the audit workbook renders them",
@@ -539,7 +539,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3306",
+    where: "driver/stages.mjs:3310",
     surface: "stage-message",
     evidence: "FOUR ANSWERS …: \"four_answers\": {\"third_party_rights\":{...},\"objection_likelihood\":{...},\"registrability\":{...},\"client_enforceability\":{...}} … Each answer … is {\"read\":\"…\",\"token\":\"…\",\"basis\":\"…\",\"ordinals\":[…]}. Tokens (closed enums …): third_party_rights = strong|moderate|weak; objection_likelih",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
@@ -548,7 +548,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3217",
+    where: "driver/stages.mjs:3221",
     surface: "stage-message",
     evidence: "ACTIONS REGISTER …: emit \"actions\": [...] — ONE object per forward step …, each EXACTLY {\"id\",\"kind\",\"text\",\"ordinals\"} plus an OPTIONAL \"deadline\" and an OPTIONAL \"condition\". … kind: EXACTLY one of — consent / coexistence-agreement / territorial-delimitation / goods-amendment / mark-modification /",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; pipeline applyCoverageFloor legalActions arm derives the delivered disposition from the closed kind enum",
@@ -557,7 +557,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "exactly-these-keys",
-    where: "driver/stages.mjs:3313",
+    where: "driver/stages.mjs:3317",
     surface: "stage-message",
     evidence: "COVERAGE JUDGMENT …: emit \"coverage_judgment\": {\"sufficient\":<bool>, \"reason\":\"<one line…>\"} — EXACTLY those two keys. Do NOT emit \"rows\": the driver writes that register itself … anything you type there is replaced wholesale.",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson. The \"Do NOT emit rows\" clause is the purest E3 case in the tree — the prompt names a field, dictates its shape and states in the same breath that code overwrites it",
@@ -566,7 +566,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3156",
+    where: "driver/stages.mjs:3160",
     surface: "stage-message",
     // RE-QUOTED, NOT PARKED. The writer's conversion reworded this dictation — the
     // ask answers ride the findings RECORD now and the driver renders the labelled line into both the
@@ -590,7 +590,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "dictated-line-shape",
-    where: "driver/stages.mjs:3077 (restated at driver/skills/prelim-search/synthesis-rules.md:428)",
+    where: "driver/stages.mjs:3081 (restated at driver/skills/prelim-search/synthesis-rules.md:428)",
     surface: "stage-message",
     evidence: "END that finding's actual-use line with a literal \"- **Use-check source:** <result URL | \"perplexity_research — no result\">\" line",
     reparsedBy: "driver/verify.mjs validators.narrative (spec-11 hard reject); the repair hint re-dictates the literal at driver/gateway.mjs:2153",
@@ -599,7 +599,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "dictated-line-shape",
-    where: "driver/stages.mjs:3090 (restated at driver/skills/prelim-search/synthesis-rules.md:475)",
+    where: "driver/stages.mjs:3094 (restated at driver/skills/prelim-search/synthesis-rules.md:475)",
     surface: "stage-message",
     evidence: "END that finding's reasoning with a literal \"- **Own-rights source:** <record URI(s) | \"no applicant-owned registrations in the searched register material\">\" line",
     reparsedBy: "driver/own-rights.mjs:19-22 — \"This module only requires the 'Own-rights source:' line to exist\"; repair hint at driver/gateway.mjs:2361 (the `own_rights_missing` branch; re-verified 2026-08-29 — the old :1736 predated this branch and pointed into the A4 repeat-signature block)",
@@ -608,7 +608,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "exactly-these-keys",
-    where: "driver/stages.mjs:3292",
+    where: "driver/stages.mjs:3296",
     surface: "stage-message",
     evidence: "add it to the top-level \"context_notes\" array — each object EXACTLY {\"type\":\"famous-neighbour-ungrounded\",\"mark\",\"owner\",\"context\"}",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
@@ -617,7 +617,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3180",
+    where: "driver/stages.mjs:3184",
     surface: "stage-message",
     evidence: "- owner: {\"name\",\"country\",\"registrations\":[...]}. … Each registration: {\"uri\", optionally \"classes\":[\"9\",\"41\"],\"status\",\"filed\",\"expiry\",\"jurisdiction\"}. The \"uri\" is the ONLY field that matters: the driver BINDS classes/status/filed/expiry/jurisdiction AND the owner name from the FETCHED record ke",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson + the record-binding join. Six of the seven keys are stated in the prompt and overwritten by code in the same sentence",
@@ -626,7 +626,7 @@ export const E3_BACKLOG = [
   {
     stage: "case-law",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3462",
+    where: "driver/stages.mjs:3466",
     surface: "stage-message",
     evidence: "ALSO write the RETRIEVAL RECORD to <path> — a JSON OBJECT with EXACTLY these keys: {\"schema_version\":1,\"queries\":[{\"query\":\"<the search you dispatched, verbatim>\",\"jurisdiction\":\"…\",\"results\":<how many hits it returned>}, …],\"citations\":[{\"proceeding\":\"…\",\"forum\":\"…\",\"jurisdiction\":\"…\",\"decided\":\"…\"",
     reparsedBy: "driver/verify.mjs validators.caseLaw — the ledger arm, armed by the stage-contract marker `citations` (stages.mjs:1820)",
@@ -635,7 +635,7 @@ export const E3_BACKLOG = [
   {
     stage: "case-law",
     kind: "dictated-line-shape",
-    where: "driver/stages.mjs:3470",
+    where: "driver/stages.mjs:3474",
     surface: "stage-message",
     evidence: "EVERY \"Grounded profile\" section MUST start its body with the line \"- ord: <N>\" naming which finding it grounds (use the ordinal from this list; a profile that grounds no listed finding omits the line)",
     reparsedBy: "driver/publish/parse.mjs:339 parseCaseLawProfiles (\"the optional '- ord: <N>' first body line … gives an EXACT join\"); driver/findings-model.mjs:273 /^-\\s*ord:\\s*(\\d+)\\s*$/m; driver/publish/index.mjs:778 runOrigins",
@@ -669,7 +669,7 @@ export const E3_BACKLOG = [
   {
     stage: "narrative-refutation",
     kind: "dictated-line-shape",
-    where: "driver/stages.mjs:3602",
+    where: "driver/stages.mjs:3606",
     surface: "stage-message",
     // RE-QUOTED BY CONVERSION 9. The LINE-TOKEN half is gone — no "anywhere on the line", no "[kind: …]
     // token", no "a line with no token is treated as fact", because a kind is a typed field now and an
@@ -684,7 +684,7 @@ export const E3_BACKLOG = [
     // because an un-anchorable row lands in the NOT-CHECKED slice, and that is coverage lost rather than
     // a pass.
     evidence: "is ONE of coverage-disposition | fact | rating | narrative — pick the one your own legal read says the correction IS: coverage-disposition (a coverage row / disposition placement is wrong or dishonest)",
-    reparsedBy: "driver/verify.mjs:847 CORRECTION_KIND_RE = /\\[kind:\\s*([a-z][a-z-]*)\\s*\\]/i → parseCorrectionKinds (verify.mjs:1070), consumed in pipelineInner() in pipeline.mjs for the run.jsonl `correction-kinds` histogram, which since #1558 also carries `kindChannelOk` — the counts are DERIVED from the parsed rows, and that key states whether the reviewer's kind channel produced anything at all rather than leaving a reader to infer it by comparing untyped against total. Telemetry only today",
+    reparsedBy: "driver/verify.mjs CORRECTION_KIND_RE = /\\[kind:\\s*([a-z][a-z-]*)\\s*\\]/i → parseCorrectionKinds (verify.mjs), consumed in pipelineInner() in pipeline.mjs for the run.jsonl `correction-kinds` histogram, which since #1558 also carries `kindChannelOk` — the counts are DERIVED from the parsed rows, and that key states whether the reviewer's kind channel produced anything at all rather than leaving a reader to infer it by comparing untyped against total. Telemetry only today",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -768,7 +768,7 @@ export const E3_BACKLOG = [
   {
     stage: "report-card",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3911",
+    where: "driver/stages.mjs:3915",
     surface: "stage-message",
     evidence: "The finding's OWN record — the ONLY source for this card …:\\n```json\\n<JSON.stringify(finding, null, 2)>\\n```",
     reparsedBy: "none — this is the INPUT side, and that is why it belongs in the survey: a full JSON object rendered into the prompt is exactly the mechanism #850 proves produced R-RECEIPT (the model pattern-matches a shown shape). E3's clause 1 as written (\"a code fence or inline example showing the exact object shape the model must emit\") does not reach an injected record, so the lint needs an explicit rule for shown-but-not-owed structure",
@@ -858,7 +858,7 @@ export const E3_EVIDENCE_UNRESOLVED = [
   // absorbed. It was the narrative "## Answers to your instructions" row deleted above: its dictation is
   // gone, so there is no un-anchorable quote left to be unresolved. The one that REMAINS is a live row
   // whose quote spans a template line. Measured before deleting, not predicted — two rows shared
-  // `where: "driver/stages.mjs:3045"`, so which one occupied this slot could not be read off the strings.
+  // `where: "driver/stages.mjs:3049"`, so which one occupied this slot could not be read off the strings.
   "synthesis|driver/stages.mjs",
 ];
 

package/driver/contract-vocabulary.mjs

@@ -21,8 +21,8 @@
 //   D4 verify.mjs  parseCoverageLedgerJson, same shape
 //   D5 verify.mjs:1504  fail(`${unaccounted[0].token}:…`)    — token minted in a DATA ROW
 //   D6 verify.mjs:1567  fail(`${violations[0].token}…`)      — validatePlanFeasibility in register-plan.mjs
-//   D7 verify.mjs:1558  fail(`${v2[0].token}${detail}…`)     — register-plan.mjs:2018 disclosureTextByAxis
-//   D8 verify.mjs:2425 caseLawLedgerFail  fail(caseLawLedgerFail(…))           — token built in case-law-ledger.mjs:204 caseLawLedgerFail
+//   D7 verify.mjs:1558  fail(`${v2[0].token}${detail}…`)     — register-plan.mjs:2183 disclosureTextByAxis
+//   D8 verify.mjs:2470 caseLawLedgerFail  fail(caseLawLedgerFail(…))  — token built in case-law-ledger.mjs:195 caseLawLedgerFail
 //
 // A partition built on the 60 tokens a regex CAN see would run green while blind to the rest, which is
 // worse than having no E2 at all: it certifies a partition it never checked. So the census is authored
@@ -70,7 +70,7 @@ export const VOCABULARY = [
   // ── common-law / common-law-half ───────────────────────────────────────────────────────────────────
   { token: "declared_unavailable", stages: CL, site: "driver/verify.mjs" },
   { token: "grid_spec_unreadable", stages: CL, site: "driver/verify.mjs:257" },
-  { token: "grid_ledger_missing", stages: CL, site: "driver/verify.mjs:297" },
+  { token: "grid_ledger_missing", stages: CL, site: "driver/verify.mjs commonLawMeaningSeat" },
   { token: "grid_ledger_unparseable", stages: CL, site: "driver/verify.mjs:266" },
   { token: "connotation_query_unrecorded", stages: ["common-law-half"], site: "driver/verify.mjs" },
   { token: "profile_unparseable", stages: ["common-law"], site: "driver/verify.mjs" },
@@ -102,6 +102,36 @@ export const VOCABULARY = [
   { token: "finding", stages: ["synthesis"], site: "driver/verify.mjs", family: "driver/findings-model.mjs (token-first throws; `finding_*` and `findings_*`)", dynamic: "D2" },
 
   // ── register-digest ────────────────────────────────────────────────────────────────────────────────
+  // The per-record accounting family, raised at the EXIT as well as at the call. The call-time refusal
+  // is scoped to the batch it judges, which is what lets a dense band be recorded at all; the exit gate
+  // is where that is paid for, because once any batch is accepted a document exists and half a band is
+  // the same SHAPE as a whole one. All three are armed by the era stamp, so an archived run raises none.
+  { token: "registerdigest_unaccounted_records", stages: ["register-digest"], site: "driver/verify.mjs, and driver/register-digest-record.mjs at the call" },
+  { token: "registerdigest_accounting_unreadable", stages: ["register-digest"], site: "driver/verify.mjs — driver-written, not a model defect" },
+  { token: "registerdigest_model_missing", stages: ["register-digest"], site: "driver/verify.mjs — driver-written, not a model defect" },
+  // ── THE TYPED TRANSPORT'S OWN FAMILY (conversion 11) ──────────────────────────────────────────────
+  //
+  // These are raised by `register-digest-record.mjs` at the ACCEPTANCE BOUNDARY, not by verify.mjs, and
+  // they became visible to this census only when verify.mjs began reaching into that module for the
+  // digest's exit gate. They existed and were emitted for months before that; nothing was wrong with
+  // them, and nothing here changes behaviour. What changes is that the census can now see the family,
+  // which is the point of listing the module: a family the tripwire cannot read can grow a member no
+  // row covers, and nobody finds out.
+  { token: "registerdigest_uri_missing", stages: ["register-digest"], site: "driver/register-digest-record.mjs — every row joins to a band record by its uri" },
+  { token: "registerdigest_uri_unknown", stages: ["register-digest"], site: "driver/register-digest-record.mjs — a uri this run's band does not carry" },
+  { token: "registerdigest_flag_reason_missing", stages: ["register-digest"], site: "driver/register-digest-record.mjs — the judgment the row exists to carry" },
+  { token: "registerdigest_verify_invalid", stages: ["register-digest"], site: "driver/register-digest-record.mjs — one bare token of yes/no" },
+  { token: "registerdigest_drop_reason_missing", stages: ["register-digest"], site: "driver/register-digest-record.mjs — a drop with no stated reason is a silent recall loss" },
+  { token: "registerdigest_drop_ground_invalid", stages: ["register-digest"], site: "driver/register-digest-record.mjs — the closed ground token" },
+  { token: "registerdigest_drop_ground_contradicted", stages: ["register-digest"], site: "driver/register-digest-record.mjs — the ground contradicts this run's own screen verdict" },
+  { token: "registerdigest_instructed_incomplete", stages: ["register-digest"], site: "driver/register-digest-record.mjs — every instructed check carries ask AND answer" },
+  { token: "registerdigest_adjudication_invalid", stages: ["register-digest"], site: "driver/register-digest-record.mjs — one bare token of ADOPTED/OVERRODE" },
+  { token: "registerdigest_adjudication_incomplete", stages: ["register-digest"], site: "driver/register-digest-record.mjs — an override quotes the reason it contradicts" },
+  { token: "registerdigest_nothing_judged", stages: ["register-digest"], site: "driver/register-digest-record.mjs — a digest that ends no record has not read the band" },
+  // The batching members, added with the batched accounting itself.
+  { token: "registerdigest_batch_unknown", stages: ["register-digest"], site: "driver/register-digest-record.mjs — a batch number this run's split does not hold" },
+  { token: "registerdigest_double_counted", stages: ["register-digest"], site: "driver/register-digest-record.mjs — a record ended under one batch cannot be ended under another" },
+  { token: "registerdigest_model_write_failed", stages: ["register-digest"], site: "driver/register-digest-record.mjs — driver-written: the accumulator was lost mid-batch" },
   { token: "coverage_form_damaged", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_form_engine_vocabulary", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_form_axis_invalid", stages: ["register-digest"], site: "driver/verify.mjs" },
@@ -109,10 +139,10 @@ export const VOCABULARY = [
   { token: "coverage_form_missing", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_form_empty", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_status_offenum", stages: ["register-digest"], site: "driver/verify.mjs:2050" },
-  { token: "coverage_deferred_unaccounted", stages: ["register-digest"], site: "driver/verify.mjs:1554 coverageFormFail", family: "driver/register-plan.mjs:1642 PROVIDER_HARD_ERROR_PREFIX — token on a data row", dynamic: "D5" },
-  { token: "coverage_clean_unexecuted", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1417 validatePlanFeasibility", dynamic: "D6" },
-  { token: "coverage_clean_skipped", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1766 searchedJurisdictionsFromPlan", dynamic: "D6" },
-  { token: "coverage_clean_unverified_incomplete", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:2018 disclosureTextByAxis", dynamic: "D7" },
+  { token: "coverage_deferred_unaccounted", stages: ["register-digest"], site: "driver/verify.mjs coverageFormFail", family: "driver/register-plan.mjs:1860 PROVIDER_HARD_ERROR_PREFIX — token on a data row", dynamic: "D5" },
+  { token: "coverage_clean_unexecuted", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1594 validatePlanFeasibility", dynamic: "D6" },
+  { token: "coverage_clean_skipped", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1955 searchedJurisdictionsFromPlan", dynamic: "D6" },
+  { token: "coverage_clean_unverified_incomplete", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:2183 disclosureTextByAxis", dynamic: "D7" },
   { token: "coverage_clean_tainted", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_ledger_", stages: ["register-digest"], site: "driver/verify.mjs", family: "driver/coverage-ledger.mjs (parseCoverageLedgerJson token-first throws)", dynamic: "D4" },
   { token: "coverage_key_unknown", stages: ["register-digest"], site: "driver/verify.mjs", family: "driver/coverage-ledger.mjs", dynamic: "D4" },
@@ -430,7 +460,7 @@ export const INNER_CODES = Object.freeze([
   { code: "call_partial", mints: ["driver/connotation-search.mjs:2055"], rollsUpTo: ["connotation_call_partial"],
     why: "As call_never_made — same table, same projection. This is the pair #1211 cites as its worked example: the composite is covered, the bare form reaches no stage." },
   { code: "quote_unbound", mints: ["driver/connotation-search.mjs:2186"], rollsUpTo: ["connotation_quote_unbound"],
-    why: "The ruled-but-unbound row. Projected at verify.mjs:1099, and reported only once nothing is unruled." },
+    why: "The ruled-but-unbound row. Projected at verify.mjs:1450 unbound, and reported only once nothing is unruled." },
   { code: "token_absent", mints: ["driver/connotation-search.mjs:2213"], rollsUpTo: ["connotation_token_absent"],
     why: "#592 split this out of no_ruling. Row-level only — repairs.mjs:352 says so in as many words: `never a top-level token`." },
   { code: "cite_absent", mints: ["driver/connotation-search.mjs:2222"], rollsUpTo: ["connotation_cite_absent"],
@@ -441,9 +471,9 @@ export const INNER_CODES = Object.freeze([
   // data rather than deriving it. Every derivation anyone would write is `connotation_` + the code, and
   // for this row that produces `connotation_no_recorded_queries`, which nothing mints and nothing covers.
   // verify.mjs:912-913 states the ruling: a sweep that did not RUN is a canonical-only decision with its
-  // own token and its own remedy, so the projector at verify.mjs:909 deliberately does not handle it.
+  // own token and its own remedy, so the projector beside verify.mjs's CORRECTIONS_SECTION_RE deliberately does not handle it.
   { code: "no_recorded_queries", mints: ["driver/connotation-search.mjs:2070"], rollsUpTo: ["connotation_search_missing"],
-    why: "RENAMED, not namespaced: verify.mjs emits `connotation_search_missing`. It is excluded from CONNOTATION_FORM_REASONS at connotation-search.mjs:1776 for exactly this reason." },
+    why: "RENAMED, not namespaced: verify.mjs emits `connotation_search_missing`. It is excluded from CONNOTATION_FORM_REASONS at connotation-search.mjs for exactly this reason." },
 
   // ── case-law-ledger.mjs — ONE token, the codes as census payload ─────────────────────────────────
   //
@@ -526,6 +556,10 @@ export const COVERED_SOURCES = [
   "report-overview-record.mjs",
   // Conversion 5 — the fan-out transport; it mints its own family including the bound-index refusals.
   "report-card-record.mjs",
+  // Conversion 11 — verify.mjs now reaches `digestAccountingGap`, the digest's exit gate, so the
+  // tripwire must read this module's token literals too. Without it the accounting family could grow a
+  // member that no vocabulary row covers and nothing would notice, which is this list's whole subject.
+  "register-digest-record.mjs",
 ];
 
 /**