clearotron 0.3.2-beta.7 → 0.3.2-beta.9

package/driver/verify-knockout.mjs

@@ -29,6 +29,25 @@ const nameKey = (s) => norm(s).toLowerCase().replace(/\s+/g, " ");
 
 // ── Tone guards (the skill's rules, mechanical subset) ───────────────────────────────────────────────
 export const BANNED_TONE_RE = /\b(extremely difficult|most dangerous|massive|enormous)\b/i;
+
+/**
+ * A RECOMMENDATION IS A SHAPE, AND THIS SCREEN MAY NOT WRITE ONE (owner, 2026-09-18).
+ *
+ * The screen states findings and a rating; what to do with the name is the reading lawyer's. Two
+ * instructions that asked for a conclusion were cut first, and a re-run then wrote one anyway, under a
+ * heading of its own: "Practical next step — <NAME> is not knocked out at this screening depth. Advance
+ * it to clearance…". Cutting an instruction stops the engine asking; only a refusal stops the offer.
+ *
+ * TWO SHAPES, because both reached a reader: a block the writer heads itself, and a closing line that
+ * moves the name on. WHAT THIS CANNOT SEE: the same conclusion as ordinary prose — "the remaining work
+ * here is a full search" — and no pattern can. It is a floor under the doctrine, never a substitute.
+ *
+ * The false positives were measured rather than assumed: the degraded note this lane REQUIRES reads
+ * "Manual verification recommended" and matches neither, and a register record "proceeding to
+ * registration" matches neither — only proceeding *to clearance* does.
+ */
+export const RECOMMENDATION_RE = /^[ \t]*(?:[*_]{0,2}|#{1,6}\s*)(?:practical\s+|immediate\s+|suggested\s+)?(?:next steps?|what to do\b|what happens next|recommendations?|our recommendation)/im;
+export const ADVANCE_RE = /\b(?:advance|move|take|send)\s+(?:it|this|the name|[A-Z][A-Z0-9'’-]{2,})\s+(?:on\s+)?(?:to|into|through)\s+(?:a\s+)?(?:full\s+)?clearance\b|\bproceeds?\s+to\s+(?:a\s+)?(?:full\s+)?clearance\b|\bshould\s+(?:proceed|advance|be advanced|move)\b|\bwe\s+recommend\b/i;
 export const QUANT_CLAIM_RE = /(\b\d[\d,.]*\s*(?:M|million|billion|k|thousand)?\s*(?:streams|downloads|copies sold|units sold)\b)|(\$\s?\d[\d,.]*\s*(?:M|million|billion|k)?\s*(?:in\s+)?(?:annual\s+)?(?:revenue|sales))/i;
 
 // ── URL normalization for the receipts gate ──────────────────────────────────────────────────────────
@@ -486,6 +505,14 @@ export const validators = {
       const claim = [prose, c.chunkSummary].filter(Boolean).join("\n").match(REGISTER_CLAIM_RE);
       if (claim)
         return { ok: false, reason: `knockout_register_claim:${m.name}: "${claim[0].trim()}" — this turn cannot see the register lane and must not describe it. The report states register coverage in code, from the run's own count sidecar; a summary that says the registers were not run, above a table of counts that were, is the contradiction this rule closes. Delete the clause` };
+      // THE PER-NAME READ IS SWEPT TOO, and until now it was not: the checks below read the finding
+      // fields, while `assessment` was validated for length and structure alone — which is exactly the
+      // field the conclusion arrived in. Refused HERE so the stage re-asks with the line quoted, rather
+      // than a reader meeting it.
+      const read = [m.assessment, prose].filter(Boolean).join("\n");
+      const recommended = read.match(RECOMMENDATION_RE) ?? read.match(ADVANCE_RE);
+      if (recommended)
+        return { ok: false, reason: `mark "${m.name}": "${recommended[0].trim()}" — this screen states findings and a rating; what to do with the name, and whether it advances, is the reading lawyer's. Delete the sentence: the report's own closing caveat already says what the screen is` };
       const banned = prose.match(BANNED_TONE_RE);
       if (banned) return { ok: false, reason: `mark "${m.name}": banned tone "${banned[0]}" — measured tone only (the band colour carries urgency)` };
       const quant = prose.match(QUANT_CLAIM_RE);

package/driver/verify.mjs

@@ -35,13 +35,14 @@ import { coverageFormStamp, readCoverageForm } from "./coverage-form-io.mjs";
 import { readUnacknowledgedTaintAxes } from "./register-taint.mjs";
 import { registerPlanCallKilled } from "./tool-calls.mjs";   // — did the dictated call return?
 import { parseFindingsJson, parseFindingsJsonLenient, CLIENT_TIER_BY_COMPOSITE, isUnconditionalProceed, joinFindingToBlock, parseBlockOrd } from "./findings-model.mjs";
-import { parsePlacementsJson } from "./placement-model.mjs";
+import { parsePlacementsJson } from "./placement-model.mjs"; import { placementFormSidecarName, parsePlacementForm, placementRenderAccount } from "./placement-form.mjs";
 import { parseCaseLawLedger, findCaseLawLedgerViolations, caseLawLedgerFail } from "./case-law-ledger.mjs";
 import { parseFrameworkManifest, aboveLowestBand, normalizeBand } from "./framework.mjs";
 import { parseNamedBand, findCollapsedBands } from "./named-band.mjs";
 import { parseBlindFrameModel } from "./blind-frame-model.mjs";
 import { parseFrameDiff } from "./frame-diff-model.mjs";
 import { parseVariantManifestModel, variantRomanizationGaps, variantCompletenessGaps, variantTermShapeGaps } from "./variant-manifest-model.mjs";
+import { digestAccountingGap } from "./register-digest-record.mjs";
 
 // ── WS-B: the run-scoped profile sidecar ────────────────────────────────────────────────────────────
 // _driver/profile.json carries the run's frozen customer values (floor, platform list) for these
@@ -1758,7 +1759,7 @@ export const validators = {
   // HERE, where a miss re-prompts the stage that authors it.
   //
   // The floor's gate is the driver-written stage-contract marker (_driver/stage-contracts.json,
-  // "prelim-variants".romanization — written by pipeline.mjs recordStageContract at DISPATCH), i.e.
+  // "clearance-variants".romanization — written by pipeline.mjs recordStageContract at DISPATCH), i.e.
   // evidence the artifact was MINTED under the romanisation-carriage prompt. It must never be the
   // instructed-scope sentinel: that sentinel is written at INTAKE and present on EVERY current-era
   // run — archived and parked ones included — so gating the new requirement on it (the first cut of
@@ -1787,7 +1788,7 @@ export const validators = {
       let contract = null;
       const marker = driverDir(dir, "stage-contracts.json");
       if (existsSync(marker)) {
-        try { contract = JSON.parse(readFileSync(marker, "utf8"))?.["prelim-variants"] ?? null; }
+        try { contract = variantsStageContract(JSON.parse(readFileSync(marker, "utf8"))); }   // either name: see variantsStageContract
         catch { return fail("stagecontracts_invalid"); }
       }
       if (!contract?.romanization && !contract?.completeness && !contract?.term_shape) return sib;
@@ -2004,8 +2005,8 @@ export const validators = {
     const base = all(nonEmpty(c), needsSection(c, "placement-tiers", [/tier|placement|sheet|level/i], "placement tiers"));
     if (!base.ok) return base;
     const dir = dirname(String(p ?? ""));
-    if (existsSync(join(dir, "placements.json")))
-      return checkSiblingJson(p, "placements.json", parsePlacementsJson, "placement-model", "placementmodel_missing");
+    const sib = existsSync(join(dir, "placements.json")) ? checkSiblingJson(p, "placements.json", parsePlacementsJson, "placement-model", "placementmodel_missing") : null;
+    if (sib) return sib.ok && placementAccountArmed(dir) ? placementAccountVerdict(dir) : sib;   // placementAccount: see the block at the end of this file
     let structured = false;
     let formEra = false;
     const marker = driverDir(dir, "stage-contracts.json");
@@ -2031,7 +2032,7 @@ export const validators = {
     // What replaces the floor is stronger, not weaker: the tiers live in a driver-held accumulator that a
     // kill cannot reach, and the rendered file is parse-then-land through this same strict parser before
     // it is allowed on disk. Archived runs carry no `placementForm` key and keep the old floor exactly.
-    if (formEra) return base;
+    if (formEra) return placementAccountArmed(dir) ? placementAccountVerdict(dir) : base;
     return structured ? fail("placementmodel_missing") : base;
   },
   // The opus digest legitimately splits the section ("## On-field findings" / "## Off-field findings"), so the
@@ -2087,6 +2088,32 @@ export const validators = {
         ], "findings+ledger"),
         hasCoverageLedgerRow(c) ? ok() : fail("no_coverage_status_row"));
     if (!structural.ok) return structural;
+    // ── EVERY RECORD THE RUN CARRIED IN ENDS SOMEWHERE — CHECKED AT THE EXIT, NOT ONLY AT THE CALL ──
+    //
+    // The call-time refusal is scoped to the batch it judges, which is what lets a dense band be
+    // recorded at all: a 1,161-record band does not fit in one turn, and the stage failed on one for 35
+    // minutes without writing a document. It buys that at a price, and this is where the price is paid.
+    // Once batch 1 is accepted the findings document EXISTS, so a seat that stopped after batch 6 no
+    // longer fails as a missing artifact — it ships a document holding half the band, with every call it
+    // made reading as accepted. Nothing else would notice: this stage's other arms read the document's
+    // shape, and half a band is the same shape as a whole one.
+    //
+    // ARMED BY THE SAME ERA STAMP as the call-time rule, so an archived run carries no stamp and replays
+    // to the verdict it always had. A STAMPED run whose transport stored no model is a driver fault and
+    // is named as one, on `coverage_form_missing`'s precedent below and for its reason: an absent
+    // artifact must never read as a satisfied one. A throw fails closed for the same reason — this gate
+    // going quiet is indistinguishable from a complete digest, which is the state it exists to refuse.
+    {
+      let gap;
+      try { gap = digestAccountingGap(dirname(p)); }
+      catch (e) { return fail(`registerdigest_accounting_unreadable:${short(String(e?.message ?? e))} (driver-written — this is a bug, not a model defect)`.slice(0, 200)); }
+      if (gap.armed && gap.unaccounted === null)
+        return fail("registerdigest_accounting_unreadable: stamped for per-record accounting with no owed list in the driver's facts (driver-written — this is a bug, not a model defect)");
+      if (gap.armed && gap.no_model)
+        return fail("registerdigest_model_missing: stamped for per-record accounting and the typed transport stored no model, while the findings document exists (driver-written — this is a bug, not a model defect)");
+      if (gap.armed && gap.unaccounted.length)
+        return fail(`registerdigest_unaccounted_records:${gap.unaccounted.length} of ${gap.owed.length} — ${gap.unaccounted.slice(0, 6).join(",")}${gap.unaccounted.length > 6 ? ` (+${gap.unaccounted.length - 6} more)` : ""}`.slice(0, 200));
+    }
     // ── THE COVERAGE FORM, AND THE FOUR STATES THAT ARE NOT THE SAME FACT ──────────────────────────
     //   not required        — no era stamp: EVERY ARCHIVED RUN, and nothing else since  M6. A run
     //                         whose plan apparatus is out of reach used to land here too; it now gets a
@@ -2591,3 +2618,64 @@ function checkClientSummaryJoin(p, c) {
   return ok("client-summary-join");
 }
 const short = (v) => String(v ?? "").replace(/\s+/g, " ").trim().slice(0, 40);
+
+// ── A PLACEMENT PASS THAT DID NOT RECORD ITS ANSWERS HAS NOT SUCCEEDED ──────────────────────────────────
+//
+// THE DEFECT, measured 2026-09-18. A pass tiered 141 in-class identical and near-identical register records;
+// every tier and reason sat in the driver's form; not one reached placements.json, because every register
+// row was refused on an owner the fold never carried. The render dropped them as it is written to — an
+// unsettled row is OMITTED rather than emitted half-formed — and this validator, which only parsed the file
+// that was left, passed six common-law rows as a completed pass. The client received a report silent on
+// the register over eighty-one identical live registrations.
+//
+// TWO REFUSALS, and the line between them was measured rather than chosen. Replayed over every archived
+// form-era run (25): three carry the discard-all and would refuse; twenty-two healthy runs would not. A
+// stricter "any outstanding row refuses" was measured too and it refuses five of those twenty-two — each
+// over a handful of single records at offices that publish no owner, a real and ordinary register fact
+// that no corrective turn can supply. Those are counted in the run record, not refused.
+//
+//   placement_unjudged=N           a row the SEAT owes is not finished — the corrective turn can finish it.
+//   placement_register_unrendered  register candidates were selected and NONE renders — a lost register.
+//
+// ARMED ON ITS OWN STAMP KEY (`placementAccount: 1`), written at dispatch like every other key in the
+// marker, so an archived run replays to exactly the verdict it was minted under. A marker that will not
+// parse leaves this arm OFF here rather than failing: both call sites already had an answer for that case
+// before this arm existed, and this must not change it.
+function placementAccountArmed(dir) {
+  try {
+    return JSON.parse(readFileSync(driverDir(dir, "stage-contracts.json"), "utf8"))?.["placement-inquiry"]?.placementAccount === 1;
+  } catch { return false; }
+}
+function placementAccountVerdict(dir) {
+  const sidecar = driverDir(dir, placementFormSidecarName());
+  let raw = null;
+  try { raw = readFileSync(sidecar, "utf8"); } catch { raw = null; }
+  // The form is written BEFORE the seat is dispatched and re-unioned before every judgement, so under this
+  // stamp its absence is the recording apparatus failing — the class this arm exists for — never "no rows".
+  if (raw === null) return fail("placement_form_unreadable (the driver's placement form is absent — nothing this pass placed can be accounted for)");
+  const { rows, error } = parsePlacementForm(raw);
+  if (rows === null) return fail(`placement_form_unreadable (the driver's placement form ${error})`);
+  const a = placementRenderAccount(rows);
+  if (a.unjudged.length) {
+    const named = a.unjudged.slice(0, 8).map((u) => `${u.row_id ?? u.select ?? "?"} (${u.cause})`).join(", ");
+    return fail(`placement_unjudged=${a.unjudged.length}: ${named}${a.unjudged.length > 8 ? ", …" : ""} — each of these rows is `
+      + "in placement-form.json and its own judgement will not render: a selected row owes a `tier` from the closed set and a `reason` "
+      + "stating the ground; a row you wrote in full owes mark, owner and jurisdiction too. Finish these rows in the form; "
+      + "every other row stands.");
+  }
+  if (a.register_selected > 0 && a.register_rendered === 0) {
+    const causes = Object.entries(a.register_facts).map(([t, n]) => `${t} ×${n}`).join(", ") || "no cause recorded";
+    return fail(`placement_register_unrendered=${a.register_selected}: every register candidate this pass selected and tiered `
+      + `is refused on a fact the driver copies from the register's own records (${causes}) — not one reaches placements.json. `
+      + "This is not a judgement the seat can repair: those fields are machine-copied and anything typed into them is ignored.");
+  }
+  return ok();
+}
+
+// THE VARIANTS STAGE WAS RENAMED, AND A RUN'S MARKER IS KEYED BY STAGE NAME. A run dispatched on an earlier
+// build stamped its manifest floors under `prelim-variants`; read under the new name alone, a resumed run
+// finds no stamp and skips the romanisation, completeness and term-shape floors it was minted under. The new
+// key wins where both exist, because the stage writes it on every fresh dispatch. PURE.
+export function variantsStageContract(marker) {
+  return marker?.["clearance-variants"] ?? marker?.["prelim-variants"] ?? null;
+}

package/driver/whatif-queue.mjs

@@ -10,7 +10,7 @@
 //
 // ── WHY IT IS NOT IN THE CLEARANCE QUEUE ─────────────────────────────────────────────────────────────
 //
-// studio/prelim-search/queue holds CLEARANCE jobs, and the runner treats every file in it as one: it
+// studio/clearance-search/queue holds CLEARANCE jobs, and the runner treats every file in it as one: it
 // runs validateJob's whole field allowlist, resolves a product and a scope through resolveRequest,
 // checks the matter ledger for duplicates, counts the daily allowance, and takes a slot from the global
 // run-lock pool. A what-if is none of those things — it re-runs ONE stage of a run that already exists,