clearotron 0.3.2-beta.7 → 0.3.2-beta.8

package/driver/matter-frame-record.mjs

@@ -141,6 +141,16 @@ export function renderMatterFrame(model) {
   // is owed against — so the frame states it where a reader can see it rather than only in a field.
   if ((model.ratified_forms ?? []).length > 1)
     out.push(`- **Ratified forms:** ${model.ratified_forms.join(", ")}`);
+  // THE EXCLUSION IS EVIDENCED ON THE DOCUMENT A READER SEES, and it is stated as a PROPOSAL because
+  // that is what it is at this point in the run. A reader meeting "excluded" here would believe the
+  // search was narrowed on the frame's authority; the driver's verification has not run yet, and if it
+  // cannot confirm the client's ownership the element is searched in full and this line is the only
+  // place the question was ever raised.
+  if (model.house_element_candidate)
+    out.push(`- **Client's own element, proposed for exclusion:** ${model.house_element_candidate.element}`
+      + ` — the analysis would be limited to ${model.house_element_candidate.remainder}.`
+      + ` Basis: ${model.house_element_candidate.owner_basis}.`
+      + " Excluded only if the driver confirms the client's own registrations on the register; otherwise searched in full.");
   out.push("");
 
   // `Search channels:` — domains only; the grid site-restricts to them and the general web is always
@@ -172,9 +182,10 @@ export function renderMatterFrame(model) {
  */
 /** The shape this tool declares, at every depth — what the ACCEPTOR enforces. */
 const DECLARED = Object.freeze({
-  "": ["prose_body", "scope_basis", "scope_jurisdictions", "excluded_jurisdictions", "search_channels", "meaning_angles", "meaning_angles_none", "intake_asks", "identified_classes", "ratified_forms"],
+  "": ["prose_body", "scope_basis", "scope_jurisdictions", "excluded_jurisdictions", "search_channels", "meaning_angles", "meaning_angles_none", "intake_asks", "identified_classes", "ratified_forms", "house_element_candidate"],
   intake_asks: ["ask", "owner"],
   identified_classes: ["class", "reason"],
+  house_element_candidate: ["element", "remainder", "owner_basis"],
 });
 
 /** Refuse an undeclared key by path, at depth. Shared walk; the table above is what is this tool's. */
@@ -218,6 +229,26 @@ export function frameRatifiedForms(runDir) {
   return (Array.isArray(rows) ? rows : []).map((r) => String(r ?? "").trim()).filter(Boolean);
 }
 
+/**
+ * The house element this run's frame PROPOSED, or null. IMPURE (reads the run's own accepted call).
+ *
+ * A PROPOSAL, AND THE CALLER MUST TREAT IT AS ONE. Nothing here has been checked against the register:
+ * the frame runs before the plan, holds no band tool, and is reporting how it reads the matter. The
+ * caller verifies ownership by owner-scoped lookup and writes its own receipt; the plan excludes on
+ * that receipt. A caller that excluded on this return would be dropping an element from the search on a
+ * model's say-so, which is the one direction that reaches a client as a clean answer over unswept
+ * ground rather than as a visible failure.
+ *
+ * Null on every archived and replayed run whose accepted call predates the field, so none of them moves.
+ */
+export function frameHouseElementCandidate(runDir) {
+  const h = lastAcceptedMatterFrame(runDir)?.house_element_candidate;
+  const element = String(h?.element ?? "").trim();
+  const remainder = String(h?.remainder ?? "").trim();
+  if (!element || !remainder) return null;
+  return { element, remainder, owner_basis: String(h?.owner_basis ?? "").trim() };
+}
+
 /** The last ACCEPTED call for this run, or null. */
 export function lastAcceptedMatterFrame(runDir) {
   return lastAccepted(matterFrameCallPaths(String(runDir ?? "")).accepted, readFileSync);
@@ -252,6 +283,15 @@ export function mergeMatterFrameCall(stored, received) {
     // omission here is a repair that did not mention them, never a decision to withdraw them.
     identified_classes: keepIfAbsent(received?.identified_classes, base.identified_classes),
     ratified_forms: keepIfAbsent(received?.ratified_forms, base.ratified_forms),
+    // KEEP-IF-ABSENT, and the direction of its failure is the OPPOSITE of the two above — which is
+    // worth saying, because the reasoning that protects them does not transfer and a reader who assumed
+    // it did would mis-rank this key. Dropping the identified classes NARROWS the next compile, towards
+    // missing rights. Dropping this one WIDENS it: the house element goes back to being searched as a
+    // conflict axis, which is the band this field exists to shrink, so a partial call that lost it costs
+    // a slower run and the report's one sentence explaining what was excluded and why — never coverage.
+    // It is kept because a repair turn that did not mention the element is not a withdrawal of it, which
+    // is the same rule, reached by a different road.
+    house_element_candidate: keepIfAbsent(received?.house_element_candidate, base.house_element_candidate),
   };
 }
 
@@ -346,6 +386,54 @@ export function acceptMatterFrame(params, { instructedScope = null } = {}) {
     ratified_forms.push(form);
   }
 
+  // ── THE CLIENT'S OWN HOUSE ELEMENT — A CANDIDATE, NEVER A DECISION ───────────────────────────────
+  //
+  // THE DEFECT (production run, 2026-09-16). The mark was the client's own famous house mark followed by
+  // a tagline, and the plan treated the house element as a conflict axis: exact, variants, one-letter
+  // mutations, transliterations, incumbent checks. Over half the band came from that element. The
+  // reviewing lawyer's method for the same matter was three queries — the whole phrase, the shorter
+  // phrase, the last word alone — because an element the client already owns outright is not what the
+  // analysis is about. The engine planned thirty-six.
+  //
+  // WHY THE FIELD IS NAMED `candidate`, AND WHY THE NAME IS LOAD-BEARING. This frame CANNOT verify
+  // ownership: `BAND_READING_STAGES` is placement-inquiry, register-digest and synthesis, and the band
+  // does not exist yet when the frame runs. So everything here is the seat's reading of the matter, and
+  // an exclusion taken on a seat's say-so is an unsearched element justified by an assertion — a clean
+  // report over ground nobody swept, which is the one failure that reaches a client as a wrong answer
+  // rather than as no answer. The driver verifies against the register by owner and writes the receipt;
+  // the plan excludes on the RECEIPT and never on this field. Requirement 4 ("when the frame cannot
+  // verify, it does not exclude, and says so") is then the write order rather than a branch someone has
+  // to remember: no receipt, no exclusion.
+  //
+  // TYPED RATHER THAN PARSED, for the reason `identified_classes` gives and measures: a list derived
+  // from judgment prose dropped the primary entry in 19 of 21 runs.
+  let house_element_candidate = null;
+  if (params?.house_element_candidate !== undefined && params?.house_element_candidate !== null) {
+    const h = params.house_element_candidate;
+    const element = str(h?.element), remainder = str(h?.remainder), owner_basis = str(h?.owner_basis);
+    if (!element)
+      return { ok: false, reason: "matterframe_house_element_empty: name the element of the mark the client already owns, or omit the field entirely — a blank row is not an answer" };
+    if (!owner_basis)
+      return { ok: false, reason: `matterframe_house_element_basis_missing:${element} — say why you read this as the client's own registered element. It is not taken on your word (the driver verifies it against the register by owner), but the reader of the report is owed the ground, and an unverifiable basis is how a wrong exclusion would be argued for` };
+    // ── THE FLOOR, AND IT IS ON THE POPULATION RATHER THAN ON THE RULE ────────────────────────────
+    //
+    // The catastrophic direction here is naming too MUCH as the house element: mark "ACME WIDGETS",
+    // element "ACME WIDGETS", remainder nothing — and the plan becomes three queries that do not exist.
+    // Ownership can verify perfectly in that case, so requirement 4 does not catch it and no refusal
+    // downstream would either: "queries on the house element: 0" is satisfied by a plan with no queries
+    // at all. So the remainder is checked for being something a search can be built on, here, where the
+    // claim is made.
+    if (!remainder)
+      return { ok: false, reason: `matterframe_house_element_no_remainder:${element} — excluding it would leave nothing to search. The remainder is what the analysis is about; if the mark IS the client's own element with nothing distinctive after it, there is no exclusion to make and the field is omitted` };
+    if (remainder.toLowerCase() === element.toLowerCase())
+      return { ok: false, reason: `matterframe_house_element_remainder_same:${element} — the remainder must be the part of the mark that is NOT the house element` };
+    // The whole mark cannot be the house element by another spelling: an element that swallows the
+    // remainder leaves the same empty plan, arriving as two fields that merely look different.
+    if (element.toLowerCase().includes(remainder.toLowerCase()))
+      return { ok: false, reason: `matterframe_house_element_swallows_remainder:${element} — the element you named contains the remainder, so excluding it excludes the whole mark` };
+    house_element_candidate = { element, remainder, owner_basis };
+  }
+
   const model = {
     schema_version: SCHEMA_VERSION,
     instructed_scope: instructedScope ?? null,
@@ -358,6 +446,7 @@ export function acceptMatterFrame(params, { instructedScope = null } = {}) {
     intake_asks,
     identified_classes,
     ratified_forms,
+    house_element_candidate,
   };
   return { ok: true, model, content: renderMatterFrame(model) };
 }

package/driver/named-band.mjs

@@ -29,6 +29,23 @@ import { abbrev } from "./repair-contract.mjs";
 
 export const BAND_STATES = ["enumerated", "incomplete"];
 
+// ── WHAT ONE QUERY MAY PUT INTO THE BAND ─────────────────────────────────────────────────────────
+//
+// THE DEFECT (production run, 2026-09-16). A 2,146-record band, of which 1,154 — 54% — were reachable
+// from two queries and nothing else. Both were machine-built forms of an ordinary short word, so they
+// matched every mark containing that word across four registers. Measured on the preserved band: the
+// three biggest queries returned 589, 583 and 271 records; the fourth returned 185. A ceiling at 200
+// therefore bites exactly those three and leaves the rest of that plan untouched, which is why it is
+// the number rather than a rounder one.
+//
+// AN OVER-CAP QUERY IS NOT TRUNCATED, IT IS RECLASSIFIED. The band already has a word for "this query
+// matched more than we carried": `incomplete`, which produces a crowd descriptor carrying the full
+// count. So the excess is DISCLOSED with its number rather than dropped — judgment reads the crowd and
+// can say the ground was too broad to enumerate, which is a true statement about the search. Silently
+// keeping the first two hundred would be the one outcome worse than the flood: a narrower band that
+// reads as complete.
+export const BAND_QUERY_CAP = 200;
+
 /**
  * Parse + lightly validate the named-band artifact. Returns { enumerated:[…records], crowds:[…descriptors] }.
  * Throws `named_band_*` tokens (token FIRST) so the stage validator + corrective-retry can key on the defect,
@@ -95,7 +112,22 @@ export function parseNamedBand(raw) {
       // at band-shape.mjs's `record_id` filter — the same loss, one step further from anything that
       // could name it.
       const recs = Array.isArray(b.records) ? b.records : [];
-      for (const r of recs) { if (r && typeof r === "object" && !Array.isArray(r)) enumerated.push({ ...r, ...prov }); }
+      const kept = [];
+      for (const r of recs) { if (r && typeof r === "object" && !Array.isArray(r)) kept.push({ ...r, ...prov }); }
+      if (kept.length > BAND_QUERY_CAP) {
+        // The count the provider reported is the truth about the ground; `kept.length` is only what this
+        // block carried. Prefer the reported total and fall back to what we hold, so the descriptor never
+        // claims a smaller crowd than it can prove.
+        const total = countOrNull(b.total_hits) ?? kept.length;
+        for (const r of kept.slice(0, BAND_QUERY_CAP)) enumerated.push(r);
+        crowds.push({
+          query, total_hits: total, fetched: BAND_QUERY_CAP, sample: [],
+          reason: `one query returned ${kept.length} record(s), over the ${BAND_QUERY_CAP}-record ceiling any single query may add to this band; the first ${BAND_QUERY_CAP} are carried and the rest are disclosed here as a crowd rather than enumerated`,
+          ...(typeof b.qid === "string" && b.qid ? { qid: b.qid } : {}),
+        });
+      } else {
+        for (const r of kept) enumerated.push(r);
+      }
     } else {
       // count-first rescue (2026-07-10, copper-lattice): a crowd descriptor may carry per-term truth —
       // `term_counts` (each term's tool-derived count + disposition) and the fully-enumerated tractable
@@ -137,7 +169,7 @@ export function parseNamedBand(raw) {
         // byte-identical to a slice the plan deliberately counted without fetching. Measured on a real
         // run: four capability-gap blocks carried `error:true, deferred:true` into this function and
         // reached record-carry.json with both fields gone and a sentence claiming the run "has a hit
-        // COUNT for this slice". register-plan.mjs:1439 validatePlanFeasibility already enforces the same rule one layer up
+        // COUNT for this slice". register-plan.mjs:1594 validatePlanFeasibility already enforces the same rule one layer up
         // ("a transient must not ship indistinguishable from a sanctioned descriptor") — it reads the
         // RAW blocks, which is why it could. Every consumer that reads THIS projection could not.
         // Conditional like the four keys above, so old bands carry neither key and nothing shifts.

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.2-beta.7",
+  "version": "0.3.2-beta.8",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline.mjs

@@ -10,7 +10,7 @@ import { readFileSync, existsSync, mkdirSync, writeFileSync, renameSync, copyFil
 import { createHash } from "node:crypto";
 import { join, dirname, basename, resolve } from "node:path";   // resolve: the resume line must work from any cwd
 import { driverDir, driverRel, ensureDriverDir } from "../shared/driver-dir.mjs";   // — one definition of where `_driver/` is
-import { terminalClampDecision, orderClausesForLede, clientConditions } from "./terminal-clamp.mjs";   // — deliver and clamp, never withhold
+import { terminalClampDecision, orderClausesForLede, clientConditions, clauseForDefect } from "./terminal-clamp.mjs";   // — deliver and clamp, never withhold
 import { recordSpan } from "./attributed-span.mjs";   // — driver work the decomposition can attribute
 import { fileURLToPath } from "node:url";
 import { runStage, correctionHint, gridLedgerNameFor, draftCarryEligible, toolWrittenArtifact, selectEngine } from "./gateway.mjs";
@@ -31,7 +31,7 @@ import { buildRunContext, deriveSlug, kebab } from "./phase0.mjs";
 import { paths, STAGES, axisTier, decideAxes, assertTierSanity, assertEffectiveTier, lines, AGENT_WHATSAPP, whatsappRouting,
   chainEntries, stageOrdinal, stageInputs, stageOutputs, dependencyOrder, REGISTER_AXES, REGISTER_ENUMERATE_TOOL,
   buildEscalationFollowup, buildEnvelopeCloseFollowup, buildFrameReopenFollowup,
-  buildFrameReopenRetryMessage, thinkingFor, composeFollowup, stampDispatchBlocks, recordEmptyReturn, nothingFound, nothingToRead, PROVIDER_META, proseRungDirective, inquiryRungDirective } from "./stages.mjs"; import { bandSizeForStage } from "./band-size.mjs";
+  buildFrameReopenRetryMessage, thinkingFor, composeFollowup, stampDispatchBlocks, recordEmptyReturn, nothingFound, nothingToRead, PROVIDER_META, proseRungDirective, inquiryRungDirective } from "./stages.mjs"; import { bandSizeForStage, derivedLimitSec, limitExceedsCeiling, ceilingRefusal } from "./band-size.mjs";
 import { IDENTITY_FILE as REPORT_IDENTITY_FILE } from "./report-overview-record.mjs";
 import { dispatchRows, clearedSignatures } from "./seat-attempts.mjs";
 import { CONTEXT_DERIVATIONS, DISPATCH_EXTRAS, INLINE_CONTEXT, sandboxManifest, sandboxGaps, derivationsFor } from "./stage-context.mjs";   // — what a stage is actually handed
@@ -45,7 +45,8 @@ import { readRegisterTaint, readActiveTaintAxes } from "./register-taint.mjs";
 import { parseNamedBand, mergeNamedBands, findCollapsedBands, quarantineUnknownStates, taintQuarantineCleanBlocks, bandRecords } from "./named-band.mjs";
 import { recordOriginsFor } from "./record-origins.mjs";
 import { REGISTER_PROVIDER } from "./driver.config.mjs";
-import { FACTS_FILE as DIGEST_FACTS_FILE, ACCOUNTING_STAMP as DIGEST_ACCOUNTING_STAMP, recordedFindingUris } from "./register-digest-record.mjs";   // conversion 11 — the render's facts sidecar and the accounting era stamp
+import { FACTS_FILE as DIGEST_FACTS_FILE, ACCOUNTING_STAMP as DIGEST_ACCOUNTING_STAMP, recordedFindingUris,
+  digestAccountingGap, digestBatchBrief, batchesOf } from "./register-digest-record.mjs";   // conversion 11 — the render's facts sidecar and the accounting era stamp
 import { buildBandShape, dominantElementComposites, deriveRegisterPositions, floorTierByMark, floorMarkKey } from "./band-shape.mjs";   // PR-8 — the deterministic reading layer; P2-A — candidates + positions
 import { deriveOwnerScreen, ownerScreenNegative } from "./owner-screen.mjs";   // P2-B — the owner×element screen's own receipt
 import { reconcileRecall, parseFindingsEndings, parseCrowdRulings, readOkRecordUris,
@@ -96,8 +97,10 @@ import { publishReport, composeEmailHtml, deliverySubject } from "./publish/inde
 import { parseCaseLawProfiles, joinCaseLawProfiles } from "./publish/parse.mjs";
 import { buildAuditMd, parseSpineFindingBlocks } from "./publish/audit-from-spine.mjs";
 import { deriveRegisterPresence } from "./publish/register-presence.mjs";   // — the audit stores every live in-scope record
-import { lastAcceptedMatterFrame, frameIdentifiedClasses } from "./matter-frame-record.mjs";   // — the frame's inferred scope, when nothing was instructed; and the classes it judged necessary beyond the instructed ones, which the plan compile unions in
-import { romanizedTermsFromPlan, mintSupplementalQid } from "./register-plan.mjs";   // — the stamp the late lanes never met
+import { lastAcceptedMatterFrame, frameIdentifiedClasses, frameHouseElementCandidate } from "./matter-frame-record.mjs";   // — the frame's inferred scope, when nothing was instructed; and the classes it judged necessary beyond the instructed ones, which the plan compile unions in
+import { romanizedTermsFromPlan, mintSupplementalQid } from "./register-plan.mjs";
+import { excludeHouseElement, verifyHouseElementOwnership, resolveRegions as resolvePlanRegions, HOUSE_ELEMENT_RECEIPT } from "./register-plan.mjs";   // 647 — the client's own element leaves the conflict analysis only on a verified receipt
+import { resolveRecordExecutor } from "./register-records.mjs";   // — the stamp the late lanes never met
 import { slimLine, crowdLine } from "./hit-list.mjs";   // — the list the run works from; crowds ride it as a sibling array
 import { mintCrossCheckDoubts, mintContradictionDoubts, stitchDoubts, applyClosure } from "./doubt-ledger.mjs";   // doubt-stitch + doubt-closure (2026-07-22)
 // Conversion 6: the two line-form parsers are no longer on the live path — the seat sends typed
@@ -2258,6 +2261,69 @@ function logFullyDeferredAxes(plan, P, source) {
 // `frozenOnly` (item): read the FROZEN plan or nothing. reconstructCtx is an introspection path —
 // it must never compile and freeze a plan into an existing run as a side effect of being asked what the
 // run already holds. (attachProfile / attachFramework take the same posture via `write:false`.)
+/**
+ * Ask the register whether the client owns the element the frame proposed, and record the answer.
+ *
+ * ASYNC AND SEPARATE FROM THE COMPILE, which is why it is its own step rather than a branch inside
+ * `attachRegisterPlan`: that function is synchronous and is called on the resume path too. The shape is
+ * the digest's — an async driver step writes a receipt, a synchronous consumer reads it — and it buys
+ * the property that matters here: the compile cannot accidentally exclude anything by reaching for a
+ * promise it does not await.
+ *
+ * NOT A REGISTERED CONTEXT DERIVATION, and the reason is worth stating because the obvious reading is
+ * that it should be. `stage-context.mjs` declares the derivations a sandbox can REPLAY, and its runners
+ * are synchronous. This one asks a live register a question; there is no offline re-derivation of that,
+ * and declaring it would promise the `--experiment` rig something no runner can deliver — which the
+ * guard catches by name, loudly, as it should. A sandbox instead inherits the receipt with the rest of
+ * `_driver/`, and a sandbox that has none excludes nothing, which is the same answer every other
+ * unverified run gets.
+ *
+ * NEVER-KILL. Every failure writes an unverified receipt and the run plans exactly as it does today.
+ * The element being searched in full is the safe direction and the status quo; the only thing that can
+ * narrow a client's search is a register answer naming their own live registration.
+ */
+async function verifyAndRecordHouseElement(ctx, opts = {}) {
+  const P = ctx.paths;
+  try {
+    const proposed = frameHouseElementCandidate(P.runDir);
+    if (!proposed) return;   // the ordinary case: the frame proposed nothing and there is no question
+
+    const classes = [...new Set([...inScopeClassList(ctx.job, ctx.profile).map(String), ...frameIdentifiedClasses(P.runDir)])];
+    // THE CLIENT'S OWN NAMES. The profile's trading names are the curated list; the matter's customer is
+    // the free-text one. Both, because a profile may be absent on a one-off matter and a customer string
+    // may be a person where the filings are held by a company.
+    const owners = [...new Set([...(ctx.profile?.selfExclusionOwners ?? []), ctx.job?.customer].map((o) => String(o ?? "").trim()).filter(Boolean))];
+    const caps = registerCapabilities();
+    const { regions } = resolvePlanRegions(registerJurisdictions(ctx.job, ctx.profile), caps);
+    const rec = resolveRecordExecutor({
+      lister: opts?.recordLister ?? null, adapter: activeProvider(),
+      agentId: ctx.agentId ?? null, sessionKey: `prelim-${ctx.run.slug}-${ctx.run.codename}`,
+      recordLog: runRecordLogPath(P.runDir),
+      fixtureDir: ctx.job?.registerFixtures?.records ?? null,
+    });
+    // AN EXACT-NAME LISTING OF THE ELEMENT, filtered to the client's own live in-class registrations by
+    // the verifier. The owner join is done on REAL RECORDS the register returned, which is what
+    // "verified by owner, not asserted" means — there is no owner-predicate listing on this interface
+    // and inventing one would be a second way to ask the same question.
+    const lookup = typeof rec.list !== "function" ? null : async ({ element, classes: cls }) => {
+      const r = await rec.list(element, { classes: cls, regions, limit: 50 });
+      if (!r || r.ok === false) return { ok: false, reason: String(r?.reason ?? "the register listing did not answer") };
+      return { ok: true, records: Array.isArray(r.records) ? r.records : [] };
+    };
+
+    const receipt = await verifyHouseElementOwnership({ element: proposed.element, classes, owners, lookup });
+    receipt.remainder = proposed.remainder;   // carried so the compile needs only this one file
+    ensureDriverDir(P.runDir);
+    atomicWrite(driverDir(P.runDir, HOUSE_ELEMENT_RECEIPT), JSON.stringify(receipt, null, 2) + "\n");
+    runLog(P.runDir, { event: "house-element-ownership", verified: receipt.verified, reason: receipt.reason,
+      records: receipt.records.length, owners: owners.length, executor: rec.source });
+    if (!receipt.verified) note(`house element: ${proposed.element} stays in the search — ${receipt.reason}`);
+  } catch (e) {
+    // A THROW HERE MUST NOT COST A REPORT. No receipt means no exclusion, which is today's plan.
+    runLog(P.runDir, { event: "house-element-ownership-failed", reason: String(e?.message ?? e).slice(0, 160) });
+  }
+}
+
 function attachRegisterPlan(ctx, { frozenOnly = false } = {}) {
   const P = ctx.paths;
   if (frozenOnly) {
@@ -2281,7 +2347,30 @@ function attachRegisterPlan(ctx, { frozenOnly = false } = {}) {
   ctx.registerPlan = null;
   let compiled;
   try {
-    const manifest = parseVariantManifestModel(readFileSync(P.variantManifestModel, "utf8"));
+    let manifest = parseVariantManifestModel(readFileSync(P.variantManifestModel, "utf8"));
+    // ── 647 — THE CLIENT'S OWN ELEMENT LEAVES THE CONFLICT ANALYSIS, ON EVIDENCE OR NOT AT ALL ─────
+    //
+    // The receipt is the ONLY thing that arms this. An absent, unreadable or unverified receipt plans
+    // exactly as this compile did before the rule existed, which is the element searched in full — the
+    // safe direction, and the one a client is never harmed by.
+    let houseConfirmation = null;
+    let houseReceipt = null;
+    try { houseReceipt = JSON.parse(readFileSync(driverDir(P.runDir, HOUSE_ELEMENT_RECEIPT), "utf8")); }
+    catch { houseReceipt = null; }
+    if (houseReceipt?.verified === true) {
+      const r = excludeHouseElement(manifest, { element: houseReceipt.element, remainder: houseReceipt.remainder });
+      if (r.refused) {
+        // VERIFIED OWNERSHIP AND STILL NOT APPLIED. The receipt answers who owns the element; the
+        // transform answers whether this manifest's mark can survive the cut. Both must hold.
+        runLog(P.runDir, { event: "house-element-not-applied", reason: r.refused, element: houseReceipt.element });
+      } else {
+        manifest = r.manifest;
+        houseConfirmation = r.confirmation;
+        runLog(P.runDir, { event: "house-element-excluded", element: houseReceipt.element,
+          remainder: houseReceipt.remainder, dominant_element: manifest.dominant_element,
+          evidence: (houseReceipt.records ?? []).length });
+      }
+    }
     let form = null;
     try { form = JSON.parse(readFileSync(P.formNeighbourhood, "utf8")); } catch { /* form band optional */ }
     compiled = compileRegisterPlan({
@@ -2308,6 +2397,19 @@ function attachRegisterPlan(ctx, { frozenOnly = false } = {}) {
       // rides the plan as a disclosed deferral, never as a silently narrower search.
       unavailableOffices: registerUnavailableOffices(),
     });
+    // REQUIREMENT 3 — the element is still checked ONCE, as a confirmation of the client's own live
+    // registrations rather than as a conflict sweep, so the exclusion is evidenced on the report by a
+    // query that ran. Appended after the compile because it is not derived from the manifest: it is the
+    // one question about the element the plan still owes.
+    if (houseConfirmation && compiled?.entries) {
+      const used = new Set(compiled.entries.map((e) => e.qid));
+      compiled.entries.push({
+        ...houseConfirmation,
+        qid: mintSupplementalQid({ prefix: "house", term: houseConfirmation.term, used }),
+        nice_classes: compiled.nice_classes ?? [],
+        regions: compiled.regions ?? [],
+      });
+    }
   } catch (e) {
     // NEVER-KILL at mint time: no/malformed sibling or a class-less matter degrades to the legacy
     // path with a logged reason — the plan improves the run, it never turns delivery off.
@@ -3648,6 +3750,27 @@ export function digestDispatchExtra(ctx, { trigger = "fresh", willRun = true, ex
       }
     }
   } catch (e) { note(`coverage-form brief skipped (non-fatal — the form is in _driver/ and the validator refuses an unsettled row): ${String(e.message).slice(0, 80)}`); }
+  // — THE BATCH BLOCK: how the driver split this run's band, and which batches are still outstanding.
+  //
+  // The seat is told the split HERE rather than in the stage's dictation because the numbers are the
+  // run's, not the contract's: a band of 40 records is one batch and a band of 1,161 is twelve, and on a
+  // resume the outstanding set is what the killed attempt did not reach. The dictation says the rule;
+  // this says the arithmetic.
+  //
+  // BEST-EFFORT, AND SAFE BY CONSTRUCTION rather than by argument — the coverage brief's precedent above,
+  // for its reason. Nothing here enforces anything: a call naming a batch is judged against the driver's
+  // own split whether or not this block composed, the tool's refusal re-states what is outstanding, and
+  // the stage's exit gate refuses a document that ends fewer records than the run carried in. A brief
+  // that fails to compose costs a corrective round; it cannot cost a record.
+  try {
+    const gap = digestAccountingGap(P.runDir);
+    const block = digestBatchBrief(gap);
+    if (block) {
+      out = out ? `${out}\n\n${block}` : block;
+      runLog(P.runDir, { event: "digest-batch-brief", trigger, owed: gap.owed.length,
+        batches: batchesOf(gap.owed).length, unaccounted: gap.unaccounted.length });
+    }
+  } catch (e) { note(`digest batch brief skipped (non-fatal — the tool judges every batch against the driver's own split regardless): ${String(e.message).slice(0, 80)}`); }
   // AD-2 A9 (E2E-R2) + the P5 review (2026-07-31): a corrective/repair pass is told NOT to re-read the
   // whole placement file — the per-candidate tiers are in placements.json — but the RULINGS TAIL (band
   // reconciliation, disagreements, coverage rulings, open questions) lives ONLY in the md. Leaving it to
@@ -4342,6 +4465,25 @@ async function stageOnce(name, ctx, opts = {}) {
   // Evaluated on `effThinking`, not `thinking`: the anthropic gate above nulls the tier for a
   // cross-provider model, and a guard that reads the nulled value would go blind on the same overrides.
   assertEffectiveTier(label, { model, thinking: effThinking });
+  // ── THE TIME LIMIT IS DERIVED FROM THE BAND THIS DISPATCH IS HANDED ─────────────────────────────
+  //
+  // `def.timeoutSec` was a constant chosen once against a band nobody recorded beside it, and on a
+  // dense matter the two band-reading stages died AT their walls having written nothing. The base is
+  // still the stage's own number; what the band decides is how far above it this dispatch may go. A
+  // band at or under the reference returns the base untouched, so nothing already verified moves.
+  const dispatchBand = bandSizeForStage(name, P);
+  const derivedLimit = derivedLimitSec(def.timeoutSec, dispatchBand);
+  // REFUSED BEFORE A SEAT IS DISPATCHED, not after the wall. A limit past the ceiling is a prediction
+  // that this stage will be killed; starting it spends the whole prediction to arrive where the refusal
+  // already is, and the refusal NAMES the band size, which is the finding a killed attempt never gives.
+  if (limitExceedsCeiling(derivedLimit.sec)) {
+    const reason = ceilingRefusal(name, derivedLimit);
+    runLog(P.runDir, { event: "stage-input-over-ceiling", stage: name,
+      inputBytes: derivedLimit.inputBytes, derivedLimitSec: derivedLimit.sec });
+    throw new StageFailure(name, reason, undefined, { failClass: "deterministic" });
+  }
+  runLog(P.runDir, { event: "stage-limit-derived", stage: name, base: def.timeoutSec,
+    inputBytes: derivedLimit.inputBytes, derivedLimitSec: derivedLimit.sec, basis: derivedLimit.basis });
   const r = await runStage(label, {
     agent: execAgent,
     message,
@@ -4350,11 +4492,12 @@ async function stageOnce(name, ctx, opts = {}) {
     // opts.sessionKey lets a followup RESUME the exact key a prior run won on (winning-key hardening); else
     // the canonical base key. (A followup with a stale base key would resume a failed attempt — see runStage.)
     sessionKey: opts.sessionKey ?? `prelim-${ctx.run.slug}-${ctx.run.codename}-${name}${keyAxis}`,
-    timeoutSec: def.timeoutSec,
+    timeoutSec: derivedLimit.sec ?? def.timeoutSec,
+    derivedLimit,               // recorded on every attempt row: the size it was derived from, and the number
     stallSec: def.stallSec,     // per-stage stall override (heavy stages); undefined → global CLEAROTRON_STALL_MS
     expectFile: out,
     validate: def.validate,
-    runDir: P.runDir, bandSize: bandSizeForStage(name, P),
+    runDir: P.runDir, bandSize: dispatchBand,
     // ── — THE PRESENTING SIDE, RECOMPOSED PER ATTEMPT ────────────────────────────────────────
     //
     // A stage that declares `refreshCtx` is saying its dispatch text depends on state the run CHANGES
@@ -7329,7 +7472,7 @@ export function fullProseOrdinals(findings) {
     .filter((o) => o != null);
 }
 // ASSEMBLE report.md = the overview shell (front-matter + Actions/Coverage/Methodology) + `# Marks` + the
-// per-card files in render order (composite desc, ordinal asc — mirrors render.mjs:502), `open: true` on the
+// per-card files in render order (composite desc, ordinal asc — mirrors render.mjs `sortedAll`), `open: true` on the
 // single top card. Findings with no card file (a failed report-card, or a secondary finding) are NOT emitted —
 // render.mjs synthesizes them structured-only from findings.json, so nothing is silently dropped. Pure file IO.
 // spec 64 — "### Only you can close these" is CODE-BUILT from the typed actions register (the report-
@@ -8849,6 +8992,7 @@ async function pipelineInner(job, opts = {}) {
     must(await stage("prelim-variants", ctx), "prelim-variants");
     deriveScopeLedgerJson(ctx);   // frame-omission design: code-derive scope-ledger.json from the validated prose (never-kill)
     deriveFormNeighbourhood(ctx); // mechanical FORM band: code-derive form-neighbourhood.json from the manifest's distinctive element(s) — the model-free form floor the register funnel searches (never-kill)
+    await verifyAndRecordHouseElement(ctx, opts);   // ask the register who owns the frame's proposed house element, BEFORE the plan is compiled from it
     attachRegisterPlan(ctx);      // WS2 (B3): compile/freeze/reuse the deterministic register plan (flag-gated; frozen plan wins on resume; never-kill on mint)
 
     // spec 64 (B2) — proactive recall probes: prior-confirmed conflicts for THIS mark (the workspace
@@ -12872,7 +13016,11 @@ async function pipelineInner(job, opts = {}) {
           reason: `synthesis_unaccounted_delivered:${duty.unaccounted.length} of ${duty.totals.owed} record(s) reached the findings surface and the delivered document accounts for none of them — neither a finding that names them nor a declination with a ground: ${sample}${duty.unaccounted.length > 4 ? " …" : ""}. The report ships with this named rather than being withheld; these records are open points a reader must weigh.`,
           // — the READER's sentence: what is open, in a lawyer's nouns. Counts survive;
           // the token, the record ids and the engine's nouns stay in `reason` and the run record.
-          clause: `${duty.unaccounted.length} of the ${duty.totals.owed} register records this search surfaced are neither addressed as findings nor expressly set aside in this report — they remain open points a reader must weigh`,
+          // COMPOSED BY THE AUTHORITY, NOT SPELLED HERE. The same sentence has to be reachable from a
+          // run that stored no clause, where these two objects are long gone and only the reason's own
+          // counts survive; `terminal-clamp.mjs` composes it from the counts either way, so the fresh
+          // run and the republished archive cannot drift apart.
+          clause: clauseForDefect("synthesis_unaccounted_delivered", duty.unaccounted.length, duty.totals.owed),
         });
       }
     }
@@ -12898,7 +13046,9 @@ async function pipelineInner(job, opts = {}) {
           // — the READER's sentence. "Floor row" is an engine noun; what the fact IS for a
           // lawyer: live registrations identical or near-identical to the mark that the report does not
           // individually address. Counts survive; token, ids and engine nouns stay in `reason`.
-          clause: `${block.undischarged} of the ${block.floors} live registrations identical or near-identical to the mark are not individually addressed in this report — each remains an open point a reader must weigh`,
+          // Composed by the authority in `terminal-clamp.mjs` for the reason the sibling site above
+          // gives: a republished pre-split run has to reach the same sentence from the counts alone.
+          clause: clauseForDefect("floor_duty_undischarged", block.undischarged, block.floors),
         });
       }
     }
@@ -12940,7 +13090,7 @@ async function pipelineInner(job, opts = {}) {
           for (const c of fresh) clampClauses.push(conditionClauses[conditions.indexOf(c)] ?? c);
           clampReasons.push(...fresh);
           if (verdict === "CLEAR") {
-            runLog(run.runDir, { event: "coverage-floor-clamp", from: "CLEAR", to: "CONDITIONAL", legalActions: conditions.length });
+            runLog(run.runDir, { event: "coverage-floor-clamp", cause: "forward-actions", from: "CLEAR", to: "CONDITIONAL", legalActions: conditions.length });
             note(`deliver-conditional floor: the opinion names ${conditions.length} forward legal action(s) a human must take (${conditions[0].slice(0, 140)}${conditions.length > 1 ? `; +${conditions.length - 1} more` : ""}) — clamping CLEAR→CONDITIONAL (spec 64: the disposition is derived from the findings' named actions).`);
             verdict = "CONDITIONAL";
             writeRunStatus(ctx, { verdict });
@@ -12979,7 +13129,7 @@ async function pipelineInner(job, opts = {}) {
         // The CLAMP is outside that guard on purpose: a re-ask can flip a clamped verdict back to CLEAR,
         // and it must meet this floor again with the reason already recorded.
         if (droppedConditions.length && verdict === "CLEAR") {
-          runLog(run.runDir, { event: "coverage-floor-clamp", from: "CLEAR", to: "CONDITIONAL", actionsDropped: droppedConditions.length });
+          runLog(run.runDir, { event: "coverage-floor-clamp", cause: "dropped-actions", from: "CLEAR", to: "CONDITIONAL", actionsDropped: droppedConditions.length });
           verdict = "CONDITIONAL";
           writeRunStatus(ctx, { verdict });
         }
@@ -13070,22 +13220,49 @@ async function pipelineInner(job, opts = {}) {
       // could-not-examine record, and an unfinished register slice — CONDITIONAL carries
       // lawyer-judged/disclosed residue only.
       if (coverageInsufficient || frameResidual || screenGateGap || seniorGap || registerGap || deadlineGap) {
+        // THESE SENTENCES REACH A CLIENT AND THEY ARE NOT OURS TO WRITE (owner, 2026-09-17). One of
+        // them — the screen-gate line, which says a mark "could not be record_fetched" — carries an
+        // engine identifier into the list a client reads as the conditions on their result, by a route
+        // `terminalClampDecision` guards and this one does not. A reader's sentence for it was written
+        // here and refused: the objection was the class, not the wording. It is on the owner's design
+        // table as audit item 25, and until he rules, this stays exactly as it was rather than carrying
+        // a caveat a developer composed.
         const reasons = [];
-        if (coverageInsufficient) reasons.push(`the lawyer judged a material slice not fully cleared: ${coverageJudgment.reason || "register coverage gap"}`);
-        if (frameGap) reasons.push("the blind frame-diff flagged a dominant-element omission the reopen pass did not close");
-        else if (frameDeferrals.length) reasons.push(`follow-ups left open this run: ${frameDeferrals.map((d) => plainDirective(d.directive)).slice(0, 3).join(", ")}`);
-        if (screenGateGap) reasons.push(`${sgUnresolved.length} in-scope mark(s) dropped on goods could not be record_fetched (unverified): ${sgUnresolved.map((g) => g.mark).join(", ")}`);
-        if (seniorGap) reasons.push(`the oldest registration in a verdict-driving family could not be retrieved (policy: clamp): ${(ctx.seniorRights?.rows ?? []).filter((r) => r.applicable && !r.verified).map((r) => r.mark).join(", ")}`);
+        const machinery = (reason) => reasons.push(reason);
+        if (coverageInsufficient) machinery(`the lawyer judged a material slice not fully cleared: ${coverageJudgment.reason || "register coverage gap"}`);
+        if (frameGap) machinery("the blind frame-diff flagged a dominant-element omission the reopen pass did not close");
+        else if (frameDeferrals.length) machinery(`follow-ups left open this run: ${frameDeferrals.map((d) => plainDirective(d.directive)).slice(0, 3).join(", ")}`);
+        if (screenGateGap) machinery(`${sgUnresolved.length} in-scope mark(s) dropped on goods could not be record_fetched (unverified): ${sgUnresolved.map((g) => g.mark).join(", ")}`);
+        if (seniorGap) machinery(`the oldest registration in a verdict-driving family could not be retrieved (policy: clamp): ${(ctx.seniorRights?.rows ?? []).filter((r) => r.applicable && !r.verified).map((r) => r.mark).join(", ")}`);
         if (registerGap) {
-          if (regGap.deferred.length) reasons.push(`register coverage deferred on ${[...new Set(regGap.deferred.map((g) => g.axis))].join(", ")} — the search did not finish and must be re-run before this can be relied on`);
-          if (regGap.taintAxes.length) reasons.push(`the ${regGap.taintAxes.join(", ")} register pass was cut down at the timeout wall and its self-reported coverage is unverified`);
+          if (regGap.deferred.length) machinery(`register coverage deferred on ${[...new Set(regGap.deferred.map((g) => g.axis))].join(", ")} — the search did not finish and must be re-run before this can be relied on`);
+          if (regGap.taintAxes.length) machinery(`the ${regGap.taintAxes.join(", ")} register pass was cut down at the timeout wall and its self-reported coverage is unverified`);
           // Named regressions (2026-07-22): `<MARK> (<owner> — <canonical uri>)` — a bare mark name
           // shipped "ION, ION, ION" (three indistinguishable strings); the identity is front-loaded
           // because the delivered statement truncates from the tail.
-          if (regGap.recallRegressions.length) reasons.push(`a prior-confirmed live conflict was neither carried nor justified this run: ${regGap.recallRegressions.slice(0, 3).map(formatRecallRegression).join(", ")}`);
+          if (regGap.recallRegressions.length) machinery(`a prior-confirmed live conflict was neither carried nor justified this run: ${regGap.recallRegressions.slice(0, 3).map(formatRecallRegression).join(", ")}`);
         }
-        if (deadlineGap) reasons.push(`a recorded opposition deadline was delivered without its date: ${ctx.deadlineCarryMaterial.map((v) => `${v.mark_text ?? v.uri} (window closes ${v.opposition_end})`).slice(0, 3).join(", ")}`);
-        runLog(run.runDir, { event: "coverage-floor-clamp", from: "CLEAR", to: "CONDITIONAL", coverageInsufficient: coverageInsufficient || undefined, frameGap: frameGap || undefined, frameDeferred: frameDeferrals.length || undefined, screenGate: screenGateGap ? sgUnresolved.length : undefined, seniorRight: seniorGap || undefined, registerGap: registerGap ? { deferred: regGap.deferred.length, taint: regGap.taintAxes.length, recall: regGap.recallRegressions.length } : undefined, deadlineCarry: deadlineGap ? ctx.deadlineCarryMaterial.length : undefined });
+        if (deadlineGap) machinery(`a recorded opposition deadline was delivered without its date: ${ctx.deadlineCarryMaterial.map((v) => `${v.mark_text ?? v.uri} (window closes ${v.opposition_end})`).slice(0, 3).join(", ")}`);
+        // ── THE THIRD CLAMP SITE NAMES ITSELF, AND NAMES WHICH OF ITS SEVEN INPUTS FIRED ────────────────
+        //
+        // All three clamp sites emitted this event under one name with the same from/to, distinguishable
+        // only by which optional payload key happened to be present. Two of them fired three milliseconds
+        // apart on a production run — the first without `frameDeferred`, the second with it — which reads
+        // as one decision logged twice. It was two different decisions wearing one name, and the test lane
+        // reasonably discounted one of them. `cause` makes the event self-describing.
+        //
+        // THE EVENT NAME IS DELIBERATELY NOT SPLIT. It is a true statement about the effect — the verdict
+        // was clamped — and something downstream may already count clamps in aggregate. A discriminator is
+        // additive; three names would not be.
+        //
+        // This site is itself seven causes under one name, so it also lists WHICH fired rather than
+        // leaving a reader to key on field presence and guess.
+        const clampInputs = Object.entries({
+          coverageInsufficient, frameGap, frameDeferred: frameDeferrals.length,
+          screenGate: screenGateGap ? sgUnresolved.length : 0, seniorRight: seniorGap,
+          registerGap, deadlineCarry: deadlineGap ? ctx.deadlineCarryMaterial.length : 0,
+        }).filter(([, v]) => Boolean(v)).map(([k]) => k);
+        runLog(run.runDir, { event: "coverage-floor-clamp", cause: "coverage", causes: clampInputs, from: "CLEAR", to: "CONDITIONAL", coverageInsufficient: coverageInsufficient || undefined, frameGap: frameGap || undefined, frameDeferred: frameDeferrals.length || undefined, screenGate: screenGateGap ? sgUnresolved.length : undefined, seniorRight: seniorGap || undefined, registerGap: registerGap ? { deferred: regGap.deferred.length, taint: regGap.taintAxes.length, recall: regGap.recallRegressions.length } : undefined, deadlineCarry: deadlineGap ? ctx.deadlineCarryMaterial.length : undefined });
         note(`deliver-conditional floor: ${reasons.join("; ")} — clamping CLEAR→CONDITIONAL so the delivered status carries the gap (never withheld, never halted).`);
         verdict = "CONDITIONAL";
         // APPEND (dedup by exact text) — the legalActions arm may already have recorded conditions,

package/driver/portal-config-view.mjs

@@ -51,11 +51,15 @@ import { readFlagSnapshot, engineFor, providersFor, postureDisagreement } from "
 // reading is, because the question it was standing in for — does this still describe the box — now has
 // a direct answer in `lastRun.disagrees`.
 import { engineMode } from "./config-inventory.mjs";   // — the mode is DERIVED at read time, never stored
+import { BILLING_MODES } from "./engine/auth.mjs";   // — the three words a capture's billing mode may be shown as
 // THE ENGINE TABLE, READ FOR TWO WORDS. A row saying an engine cannot run has to name the program it
 // could not find and the command that installs it, or the reader is told they have a problem and not
 // what to do about it — and this table is already where the wizard and the run-door preflight read
 // both of those, so naming them here adds no second description of an engine.
 import { ENGINE_BINARIES } from "./driver.config.mjs";
+// WHICH SETUP COMMAND THIS READER CAN TYPE, as a word and never a path: the same answer `/me` sends the
+// search screen, so the two pages name the same command for the same install.
+import { installRoute } from "../shared/invocation.mjs";
 
 /**
  * The flag view.
@@ -88,6 +92,12 @@ function withProgram(engine) {
     // layout and is deliberately kept out of anything a browser renders.
     program: spec?.fallback ?? null,
     install: spec?.install ?? null,
+    // The setting that names the program's full path, which is what an administrator sets when the
+    // services cannot find a program this machine has. A name, never its value.
+    programSetting: spec?.env ?? null,
+    // SETUP INSTALLS THE PROGRAM NOW, so a row saying it cannot be found names setup, the way this reader
+    // can run it: `packaged` or `checkout`.
+    setupRoute: installRoute(),
   };
 }
 
@@ -135,8 +145,27 @@ function postureView(snap) {
  * The capture does not go away; it stops being the answer. It becomes "what the last run saw", and its
  * job is to name any field on which it disagrees with the live reading.
  */
+/**
+ * A CAPTURE'S BILLING WORD, SHOWN ONLY WHEN IT IS ONE OF THE MODES.
+ *
+ * The inventory records a billing word that is not a mode as `unknown`, because whatever was typed into
+ * the setting that decides who pays can be a key pasted there by mistake. A capture written before it
+ * did holds the typed word itself, as its mode and inside its refusal's sentence, and this page would
+ * print it twice: in the last-run comparison, whose live side now reads `unknown`, and under a capture
+ * shown in place of a live reading. So such a capture is read as `unknown`, with no refusal sentence,
+ * which the page does not read anyway (it words the refusal from `reason`). Until the engine service
+ * restarts and writes its capture again, that is the only copy of the word the page could reach.
+ */
+function withKnownBillingWord(snap) {
+  const billing = snap?.engine?.billing;
+  if (!billing || typeof billing !== "object") return snap;
+  if (billing.mode == null || billing.mode === "unknown" || BILLING_MODES.includes(billing.mode)) return snap;
+  const { refusal: _typed, ...rest } = billing;
+  return { ...snap, engine: { ...snap.engine, billing: { ...rest, mode: "unknown" } } };
+}
+
 export function flagView(poolRoot, { live = null } = {}) {
-  const snap = readFlagSnapshot(poolRoot);
+  const snap = withKnownBillingWord(readFlagSnapshot(poolRoot));
 
   // NO LIVE POSTURE IS A DIFFERENT PAGE, NOT A DEGRADED ONE. A caller that supplied none cannot be
   // answered "live" at all, so this says which reading it is showing rather than presenting a capture