clearotron 0.3.2 → 0.3.3-beta.1

package/driver/pipeline.mjs

@@ -10,6 +10,7 @@ import { readFileSync, existsSync, mkdirSync, writeFileSync, renameSync, copyFil
 import { createHash } from "node:crypto";
 import { join, dirname, basename, resolve } from "node:path";   // resolve: the resume line must work from any cwd
 import { driverDir, driverRel, ensureDriverDir } from "../shared/driver-dir.mjs";   // — one definition of where `_driver/` is
+import { goodsOf } from "./queue-markers.mjs";   // — one reading of "does this job name goods", shared with the intake gate
 import { terminalClampDecision, orderClausesForLede, clientConditions, clauseForDefect } from "./terminal-clamp.mjs";   // — deliver and clamp, never withhold
 import { recordSpan } from "./attributed-span.mjs";   // — driver work the decomposition can attribute
 import { fileURLToPath } from "node:url";
@@ -39,8 +40,8 @@ import { parseVerdict, countCitedDefects, parseCorrectionKinds, parseCorrections
 import { readAcceptedFlags } from "./narrative-refutation-record.mjs";   // T3b — the typed flags, not the re-parse
 import { evidenceClaimViolations, evidenceClaimTable } from "./evidence-claim-invariant.mjs";   //
 import { buildCorrectionsApplied, correctionsWorklist, correctionsAppliedTable, correctionScope, scopeDrift, unresolvedFlags, reportLines, linesOf, REPORT_LINE_KEY, REPORT_LINE_LABEL } from "./corrections-feedforward.mjs";
-import { parseCoverageLedgerJson, parseCoverageLedgerFull, deriveCoverageStatus, classTokensFromScopeText, coerceToolAbsenceDeferred, applyTaintDeferred, decideRegisterGap, splitDeferredByCloseability, coverageLedgerTableRows, coverageUnitLabel, NON_MATERIAL_AXES, COVERAGE_STATUSES } from "./coverage-ledger.mjs";
-import { receiptSettled, readEnvelopeDecision, settleReceipt, settledDeferralsSection } from "./envelope-settle.mjs";
+import { parseCoverageLedgerJson, parseCoverageLedgerFull, deriveCoverageStatus, classTokensFromScopeText, coerceToolAbsenceDeferred, applyTaintDeferred, decideRegisterGap, splitDeferredByCloseability, formRowUnitKey, coverageLedgerTableRows, coverageUnitLabel, NON_MATERIAL_AXES, COVERAGE_STATUSES } from "./coverage-ledger.mjs";
+import { receiptSettled, readEnvelopeDecision, settleReceipt, settledDeferralsSection, readStickyGaps } from "./envelope-settle.mjs";
 import { readRegisterTaint, readActiveTaintAxes } from "./register-taint.mjs";
 import { parseNamedBand, mergeNamedBands, findCollapsedBands, quarantineUnknownStates, taintQuarantineCleanBlocks, bandRecords } from "./named-band.mjs";
 import { recordOriginsFor } from "./record-origins.mjs";
@@ -90,14 +91,14 @@ import { deriveScopeFacts } from "./scope-facts.mjs";
 import { documentGrowth } from "./gate-metrics.mjs";
 import { editRepairTail, abbrev } from "./repair-contract.mjs";
 import { repairFollowup } from "./repair-composers.mjs";
-import { seedRunStatus, recordTransition, writeRunStatus, rollupStatus, atomicWrite, finalStepFields, terminalRunState } from "./progress.mjs";
+import { seedRunStatus, recordTransition, writeRunStatus, rollupStatus, atomicWrite, finalStepFields, terminalRunState, signoffPatch, readSignoff } from "./progress.mjs";
 import { batchMarkName } from "./mark-name.mjs";
 import { writeOutboxPacket } from "./outbox.mjs";
 import { publishReport, composeEmailHtml, deliverySubject } from "./publish/index.mjs";
 import { parseCaseLawProfiles, joinCaseLawProfiles } from "./publish/parse.mjs";
 import { buildAuditMd, parseSpineFindingBlocks } from "./publish/audit-from-spine.mjs";
 import { deriveRegisterPresence } from "./publish/register-presence.mjs";   // — the audit stores every live in-scope record
-import { lastAcceptedMatterFrame, frameIdentifiedClasses, frameHouseElementCandidate } from "./matter-frame-record.mjs";   // — the frame's inferred scope, when nothing was instructed; and the classes it judged necessary beyond the instructed ones, which the plan compile unions in
+import { lastAcceptedMatterFrame, frameIdentifiedClasses, frameIdentifiedClassRows, frameHouseElementCandidate } from "./matter-frame-record.mjs";   // — the frame's inferred scope, when nothing was instructed; and the classes it judged necessary beyond the instructed ones, each with its reason, which the plan compile gives one identical-mark question apiece (decision 18)
 import { romanizedTermsFromPlan, mintSupplementalQid } from "./register-plan.mjs";
 import { excludeHouseElement, verifyHouseElementOwnership, resolveRegions as resolvePlanRegions, HOUSE_ELEMENT_RECEIPT } from "./register-plan.mjs";   // 647 — the client's own element leaves the conflict analysis only on a verified receipt
 import { resolveRecordExecutor } from "./register-records.mjs";   // — the stamp the late lanes never met
@@ -463,8 +464,35 @@ export function readPlanExecution(ctx) {   // @internal
   const p = ctx?.paths?.planExecution;
   try { return p && existsSync(p) ? JSON.parse(readFileSync(p, "utf8")) : null; } catch { return null; }
 }
+/**
+ * A qid this run has accepted as a capability gap (envelope-settle.mjs stickyGapsAfter) leaves `missing`
+ * for `deferred`, with the reason it was accepted under, so no re-join can put it back on the ladder.
+ * Returns the join unchanged when nothing is held. PURE.
+ */
+export function holdStickyGapsIn(join, sticky) {   // @internal
+  const held = (join?.missing ?? []).filter((q) => sticky?.has(q));
+  if (!held.length) return join;
+  return { ...join, missing: join.missing.filter((q) => !sticky.has(q)),
+    deferred: [...(join.deferred ?? []), ...held.map((q) => ({ qid: q, reason: String(sticky.get(q)?.reason ?? "").slice(0, 300) }))] };
+}
+
+/**
+ * The coverage units of this run's sticky capability gaps, as ledgerUnitKey()s, found through the coverage
+ * form's own deferred rows (the driver writes each with its qid). The envelope, the escalation and the
+ * skeptic's ledger split then hold those rows whatever reason the seat wrote for them. A run with no form,
+ * or no sticky gap, holds nothing extra, exactly as before.
+ */
+export function stickyGapUnits(P) {   // @internal
+  const sticky = readStickyGaps(P);
+  if (!sticky.size) return new Set();
+  const stamp = coverageFormStamp(P.runDir);
+  const rows = stamp.required ? (readCoverageForm(P.runDir, stamp.formName).rows ?? []) : [];
+  return new Set(rows.filter((r) => r?.kind === "deferred" && sticky.has(String(r.qid ?? ""))).map(formRowUnitKey));
+}
+
 export function writePlanExecutionReceipt(ctx, joinRes) {   // @internal
   const P = ctx.paths;
+  joinRes = holdStickyGapsIn(joinRes, readStickyGaps(P));
   // — the ONE place the receipt is written is the one place this decision is taken. The
   // reclassification is keyed off the receipt already on disk (ladderExhaustedQids), so every writer
   // agrees without any of them knowing about it: the fan-in, the envelope's re-join after its close
@@ -2384,7 +2412,12 @@ function attachRegisterPlan(ctx, { frozenOnly = false } = {}) {
       // for the documented normal case. Harmless on corsearch (an absent region clause is a worldwide
       // sweep); fatal on a provider whose regions[] is mandatory, where every entry then errored on its
       // count probe and the whole plan joined MISSING at fan-in (review finding 11).
-      job: { jobKey: ctx.run.slug, classes: [...new Set([...inScopeClassList(ctx.job, ctx.profile).map(String), ...frameIdentifiedClasses(P.runDir)])], jurisdictions: registerJurisdictions(ctx.job, ctx.profile) },
+      // DECISION 18: the frame's added classes are no longer UNIONED into the plan's class scope. They
+      // ride one identical-mark entry each instead, which is what an added class is supposed to cost —
+      // unioning put every added class on every variant and every family. The instructed scope is what
+      // it always was, and `addedClasses` only ever appends.
+      job: { jobKey: ctx.run.slug, classes: inScopeClassList(ctx.job, ctx.profile).map(String), jurisdictions: registerJurisdictions(ctx.job, ctx.profile) },
+      addedClasses: frameIdentifiedClassRows(P.runDir),
       form, skillVersion: "clearance-register@spec48",
       // — WHICH ELEMENT THE EXCLUSION TOOK OUT, so the compile can make its form band unreachable
       // rather than merely unasked-for. Null unless the ownership receipt verified, which is the same
@@ -6219,10 +6252,11 @@ export function skepticDeferralExtra(ctx) {   // @internal
     const gapAxes = capabilityGapAxes(ctx.registerPlan, receipt);
     const fullyDeferred = new Set((ctx.registerPlan ? fullyDeferredAxes(ctx.registerPlan) : []).map((a) => String(a.axis).toLowerCase()));
     const axes = [...new Set(rows.map((r) => String(r.axis ?? "").toLowerCase()).filter(Boolean))];
+    const heldUnits = stickyGapUnits(P);
     const ledgerLines = coverageLedgerTableRows(rows);
     const held = [], closeable = [];
     for (const a of axes) {
-      const s = splitDeferredByCloseability(rows, a, gapAxes, { fullyDeferred: fullyDeferred.has(a) });
+      const s = splitDeferredByCloseability(rows, a, gapAxes, { fullyDeferred: fullyDeferred.has(a), heldUnits });
       for (const r of s.held) held.push(`${a} / ${r.unit} — ${String(r.reason ?? "").replace(/\s+/g, " ").slice(0, 160)}`);
       for (const r of s.closeable) closeable.push(`${a} / ${r.unit} — ${String(r.reason ?? "").replace(/\s+/g, " ").slice(0, 160)}`);
     }
@@ -6230,6 +6264,16 @@ export function skepticDeferralExtra(ctx) {   // @internal
     const deferredQids = deferredList.slice(0, 24)
       .map((d) => `- ${d.qid} — ${String(d.reason ?? "").replace(/\s+/g, " ").slice(0, 200)}`);
     const more = deferredList.length > 24 ? [`- …and ${deferredList.length - 24} more (read ${P.planExecution} for the rest)`] : [];
+    // THE CLASSES THE FRAME ADDED, AND WHAT EACH RETURNED. This block names what was refused and what is
+    // open, and nothing that ran, so a class the frame added beyond the instructed ones — asked and
+    // answered with its records listed — was absent from it, and the skeptic reported it as never swept.
+    const addedClassRows = (ctx.registerPlan?.entries ?? []).filter((e) => e?.added_class_reason).map((e) => {
+      const ran = (receipt?.executed ?? []).find((x) => x.qid === e.qid);
+      const answer = ran ? `${ran.state}${Number.isFinite(ran.records) ? `, ${ran.records} records` : ""}`
+        : (receipt?.deferred ?? []).some((d) => d.qid === e.qid) ? "refused (listed above)"
+        : (receipt?.missing ?? []).includes(e.qid) ? "not run (missing)" : "not in the receipt";
+      return `- ${e.qid} (class ${(e.nice_classes ?? []).join(", ")}) — ${answer}`;
+    });
     const ownerNegative = ownerScreenNegative(readOwnerScreen(P));
     return lines(
       `COVERAGE + EXECUTION, DRIVER-COMPUTED — do NOT re-derive any of this from the findings prose. These rows come from ${P.registerCoverageLedger} and ${P.planExecution}, the machine artifacts the driver wrote; both are also yours to read directly, but the answer to "what is still open, and can a re-run close it" is already below.`,
@@ -6240,6 +6284,7 @@ export function skepticDeferralExtra(ctx) {   // @internal
       deferredQids.length
         ? lines(`Plan-execution receipt — queries the ACTIVE PROVIDER REFUSED deterministically (${deferredList.length} of ${(receipt.executed?.length ?? 0) + deferredList.length + (receipt.missing?.length ?? 0)} planned), with the mechanical reason per query:`, ...deferredQids, ...more)
         : "Plan-execution receipt: no query was deterministically refused by the provider this run.",
+      addedClassRows.length ? lines("", "Classes the frame added beyond the instructed ones — each question, and what it returned:", ...addedClassRows) : "",
       "",
       closeable.length
         ? `CLOSEABLE floor obligations (a warm re-run reaches these — escalate them if they are material): ${closeable.join("; ")}.`
@@ -6401,7 +6446,7 @@ function plainRegisterExtra(ctx) {
   }
 }
 
-// ── THE RECEIPT, AND THE THREE CLASSES, STATED ONCE ────────────────────────────────────────────────
+// ── THE RECEIPT, AND THE GRADED CLASSES, STATED ONCE ────────────────────────────────────────────────
 //
 //. The receipt this block tabulates is the answer to "did that search run", and until now exactly
 // one stage got it: the REVIEWER. `synthesis` — the stage that writes the claim the reviewer then
@@ -6419,7 +6464,7 @@ function plainRegisterExtra(ctx) {
 // out twice, once per seat, is the shape — one rule in two places, drifting from the day the second
 // copy is typed — and the classes are the part that must never drift, because class (1) is the blocking
 // condition.
-// THE HEAD AND THE THREE CLASSES ARE NOT DECLARED HERE. They live in register-plan.mjs, beside the
+// THE HEAD AND THE GRADED CLASSES ARE NOT DECLARED HERE. They live in register-plan.mjs, beside the
 // derivation that assigns the states, because the gateway's corrective hint is a THIRD reader of the
 // same grading and `pipeline.mjs` imports `gateway.mjs` — so a constant declared here could never
 // reach it.
@@ -6447,8 +6492,13 @@ function planAuditExtra(ctx, { stage = "narrative-refutation" } = {}) {
       `- executed: ${exec.executed.length} entr${exec.executed.length === 1 ? "y" : "ies"} (${crowds.length} crowd/incomplete${crowds.length ? `: ${crowds.slice(0, 4).map((x) => x.qid).join("; ")}` : ""})`,
       `- missing (no band block): ${exec.missing.length}${exec.missing.length ? ` — ${exec.missing.slice(0, 4).join("; ")}` : ""}`,
       `- skipped (crowd-gated fringe): ${exec.skipped.length}`,
+      // The families waiting for the reading turn, and those it asked. Without these lines the table's
+      // own buckets summed to the whole plan less the waiting families, and a reviewer read it as
+      // "no family waiting" while the receipt held 156.
+      `- awaiting the reading turn's ask: ${exec.awaiting?.length ?? 0}`,
+      exec.asked?.length ? `- asked by the reading turn (a waiting family's question, asked by another entry): ${exec.asked.length}` : "",
       exec.unplanned?.length ? `- unplanned qid-stamped blocks: ${exec.unplanned.length}` : "",
-      ...(exec.skeleton ?? []).map((s) => `- axis ${s.axis}: ${s.state} (${s.executed}/${s.entries} executed, ${s.crowds} crowd)`),
+      ...(exec.skeleton ?? []).map((s) => `- axis ${s.axis}: ${s.state} (${s.executed}/${s.entries} executed, ${s.crowds} crowd${s.awaiting ? `, ${s.awaiting} awaiting` : ""})`),
     ];
   } catch (e) { rows = [`- (receipt table unavailable — read + audit the receipt file directly: ${P.planExecution})`]; note(`plan-audit receipt table (non-fatal): ${e.message}`); }
   return lines(
@@ -6716,7 +6766,7 @@ export function readFindingsForReport(P) {
 // The matter's FULL in-scope Nice-class set (incl. services 42/44) — declared classes (top-level OR per-mark)
 // else the profile defaults. The dangerous-band floor + its coverage gate must span ALL of these, never a
 // goods-only subset (the VELTRIPHEN services-class miss). Strings, deduped.
-function inScopeClassList(job, profile) {
+export function inScopeClassList(job, profile) {   // @internal — also read by scripts/register-plan-shape.mjs, which must resolve scope exactly as the run did
   const fromMarks = Array.isArray(job?.marks) ? job.marks.flatMap((m) => (Array.isArray(m?.classes) ? m.classes : [])) : [];
   const declared = [...(Array.isArray(job?.classes) ? job.classes : []), ...fromMarks];
   return [...new Set((declared.length ? declared : (profile?.defaultClasses ?? [])).map(String))];
@@ -7035,7 +7085,14 @@ export function coverageRowAreaLabel(axis, unit) {   // @internal
 export function coverageJudgmentRows(ledgerRows, planExecution) {   // @internal
   const open = [];
   for (const r of ledgerRows ?? []) {
-    if (!r || String(r.status ?? "").toLowerCase() === "confirmed-clean") continue;
+    // `withheld-by-judgment` joins `confirmed-clean` in NOT reaching the reader, and for the opposite
+    // reason. A clean row has nothing to disclose. A withheld one has something to say, and it is
+    // ruled to belong in the run record and the coverage ledger only: nothing is added to the report
+    // (owner, 2026-09-18). A family the reading turn chose not to open, having read the identical question as
+    // a list and found what it needed, is not a gap in the client's search — it is where the work was
+    // spent — and a row saying otherwise would read to a lawyer as an incomplete job.
+    const status = String(r?.status ?? "").toLowerCase();
+    if (!r || status === "confirmed-clean" || status === "withheld-by-judgment") continue;
     const reason = String(r.reason ?? "").replace(/\s+/g, " ").trim().slice(0, 160);
     const axis = String(r.axis ?? "").toLowerCase();
     open.push({ axis, area: coverageRowArea(axis, r.unit), areaLabel: coverageRowAreaLabel(axis, r.unit),
@@ -8455,6 +8512,42 @@ function postponeRun(e, run, meta = {}) {
   return { ok: false, postponed: true, resetsAt, codename, fromStage: e.stage, runDir: run?.runDir ?? null };
 }
 
+/**
+ * The instructed scope a job asks for — what the MATTER named, before any model ran.
+ *
+ * Pulled out of the run so it can be driven straight from a job, because the defect it closes lived
+ * exactly in the seam between the intake gate and this object: the gate counts a job as carrying a
+ * goods description under EITHER spelling, and this stamped only the current one. A job written the
+ * older way passed the gate and landed `goods: null` — the scope file saying the matter named no
+ * goods while the request plainly did — and every reader that asks what the matter covers reads this
+ * file. Nothing said so, because nothing compared the two sites.
+ *
+ * PURE: a job in, a plain object out, no IO.
+ */
+export function instructedScopeOf(job) {
+  const markNames = Array.isArray(job?.marks)
+    ? job.marks.map((m) => (typeof m === "string" ? m : m?.name)).filter(Boolean)
+    : (job?.markName ?? job?.name ?? null);
+  return {
+    marks: markNames,
+    classes: job?.classes ?? null,
+    jurisdictions: job?.jurisdictions ?? null,
+    // THE GATE'S OWN READING, imported rather than restated. A run's job is folded onto one field at
+    // assembly, so this is normally reading what is already there; it stays for a job handed to this
+    // function directly, and because the gate and the scope disagreeing is the defect it closes.
+    goods: goodsOf(job),
+    customer: job?.customer ?? null,
+    // the geography stamp (enqueue-schema.mjs, "the GEOGRAPHY STAMP": {mode, origin}) — copied
+    // VERBATIM, never recomputed: foldRecipeScope mutates job.jurisdictions on later passes (and
+    // re-stamps origin "saved-search" when it does), so by read time the stamp is the only surviving
+    // record of where the territories came from. Without it here, the frame reconstructs that
+    // provenance from the request prose — a reconstruction validators.matterContext cannot check.
+    // null = the job predates the stamp ("unrecorded", effective-scope.mjs) — an explicit state,
+    // never a missing key.
+    geography: job?.geography ?? null,
+  };
+}
+
 async function pipelineInner(job, opts = {}) {
   assertTierSanity();
   // The engine binary, first and UNCONDITIONALLY — before the register preflight, which two lanes skip.
@@ -8872,24 +8965,7 @@ async function pipelineInner(job, opts = {}) {
   // frame validator compares against THIS file, never against the frame's own paraphrase) —
   // paraphrase drift between the request and the frame is a defect, not a style choice.
   try {
-    const markNames = Array.isArray(job.marks)
-      ? job.marks.map((m) => (typeof m === "string" ? m : m?.name)).filter(Boolean)
-      : (job.markName ?? job.name ?? null);
-    writeFileSync(P.instructedScope, JSON.stringify({
-      marks: markNames,
-      classes: job.classes ?? null,
-      jurisdictions: job.jurisdictions ?? null,
-      goods: job.goods ?? null,
-      customer: job.customer ?? null,
-      // the geography stamp (enqueue-schema.mjs, "the GEOGRAPHY STAMP": {mode, origin}) — copied
-      // VERBATIM, never recomputed: foldRecipeScope mutates job.jurisdictions on later passes (and
-      // re-stamps origin "saved-search" when it does), so by read time the stamp is the only
-      // surviving record of where the territories came from. Without it here, the frame reconstructs
-      // that provenance from the request prose — a reconstruction validators.matterContext cannot
-      // check. null = the job predates the stamp ("unrecorded", effective-scope.mjs) — an explicit
-      // state, never a missing key.
-      geography: job.geography ?? null,
-    }, null, 2) + "\n");
+    writeFileSync(P.instructedScope, JSON.stringify(instructedScopeOf(job), null, 2) + "\n");
   } catch (e) { note(`instructed-scope write failed (non-fatal): ${e.message}`); }
   // THE STORED DEFAULTS THE ENGINE CANNOT SEARCH — recorded by the run, not only by the plan preview.
   //
@@ -9820,6 +9896,19 @@ async function pipelineInner(job, opts = {}) {
     const fanInRepairs = [];
     const dispatchPlanQids = async (a, qids, repairId, max = 1) => {
       if (!planExec || !ctx.registerPlan) return null;
+      // A qid this run has accepted as a capability gap is never sent to the provider again, under any plan
+      // version (envelope-settle.mjs stickyGapsAfter). A whole-axis dispatch becomes the axis's other qids;
+      // the executor's qid-ownership merge keeps the gap's own block as it stands.
+      const sticky = readStickyGaps(P);
+      if (sticky.size) {
+        const wanted = qids?.length ? qids : (ctx.registerPlan.entries ?? []).filter((e) => e.axis === a).map((e) => e.qid);
+        const held = wanted.filter((q) => sticky.has(q));
+        if (held.length) {
+          runLog(run.runDir, { event: "plan-qids-sticky-gap", axis: a, qids: held, action: repairId });
+          qids = wanted.filter((q) => !sticky.has(q));
+          if (!qids.length) return null;
+        }
+      }
       if (!repairLedger.canAttempt(repairId, a, { max, epoch: repairEpoch })) return null;
       note(`register-unit ${a}: ${repairId} — direct executor dispatch (code, no agent turn) for ${qids?.length ?? "all"} dictated slice(s)`);
       let outcome;
@@ -10280,7 +10369,15 @@ async function pipelineInner(job, opts = {}) {
         // been a log line. Settling here is idempotent and makes the decision durable.
         if (!receiptSettled(P, priorReceipt).settled) await settleEnvelopeAtReceipt("receipt-reuse");
       } else {
-      let joinRes = joinPlanToBands(ctx.registerPlan, readBands());
+      // A qid this run has accepted as a capability gap does not ride the ladder again. It leaves `missing`
+      // for `deferred` with the reason it was accepted under, before any dispatch or followup reads the
+      // join, so neither the direct executor nor the plan-join followup re-dictates it.
+      const holdStickyGaps = (j) => {
+        const held = holdStickyGapsIn(j, readStickyGaps(P));
+        if (held !== j) runLog(run.runDir, { event: "plan-qids-sticky-gap", qids: j.missing.filter((q) => !held.missing.includes(q)), action: "held-from-missing" });
+        return held;
+      };
+      let joinRes = holdStickyGaps(joinPlanToBands(ctx.registerPlan, readBands()));
       const missingEntriesByAxis = () => {
         const byQid = new Map(ctx.registerPlan.entries.map((e) => [e.qid, e]));
         const m = new Map();
@@ -10302,7 +10399,7 @@ async function pipelineInner(job, opts = {}) {
           runLog(run.runDir, { event: "plan-qids-missing", axis: a, qids, action: "plan-direct-execute" });
           await dispatchPlanQids(a, qids, "plan-direct-execute", 2);
         }
-        joinRes = joinPlanToBands(ctx.registerPlan, readBands());
+        joinRes = holdStickyGaps(joinPlanToBands(ctx.registerPlan, readBands()));
         if (!joinRes.missing.length) deriveNamedBand(ctx);   // dispatch landed blocks — re-merge so Layer B reads them
       }
       if (joinRes.missing.length) {
@@ -10327,7 +10424,7 @@ async function pipelineInner(job, opts = {}) {
           const wf = await stage("register-unit", { ...ctx, axis: a }, { force: true, followup, sessionKey: unitKey[a], trigger: "plan-join" });
           if (!wf.ok) note(`register-unit ${a}: warm plan-join followup failed (${wf.fail}) — the plan-unexecuted StageFailure below holds the line`);
         }
-        joinRes = joinPlanToBands(ctx.registerPlan, readBands());
+        joinRes = holdStickyGaps(joinPlanToBands(ctx.registerPlan, readBands()));
         deriveNamedBand(ctx);   // the followup appended band blocks — re-merge so Layer B reads them
       }
       const skeleton = writeExecution(joinRes);
@@ -10402,6 +10499,7 @@ async function pipelineInner(job, opts = {}) {
           { failClass, repairs: fanInRepairs, quantity: joinRes.missing.length });
       }
       runLog(run.runDir, { event: "plan-execution", executed: joinRes.executed.length, skipped: joinRes.skipped.length, unplanned: joinRes.unplanned.length,
+        awaiting: joinRes.awaiting?.length ?? 0, asked: joinRes.asked?.length ?? 0,
         axes: skeleton.map((s) => `${s.axis}:${s.state}`) });
       // Decide the deferrals now — before placement-inquiry, which on the evidence run started one second
       // after this point on inputs the run had just recorded as unfinished.
@@ -11610,7 +11708,7 @@ async function pipelineInner(job, opts = {}) {
       // that designates no floor.
       if (owned.length > 0 && !floorBreachAxes.has(a.toLowerCase())) {
         const split = splitDeferredByCloseability(ledger, a, escalationGapAxes,
-          { fullyDeferred: escalationFullyDeferred.has(a.toLowerCase()) });
+          { fullyDeferred: escalationFullyDeferred.has(a.toLowerCase()), heldUnits: stickyGapUnits(P) });
         const openNonDeferred = owned.some((r) => r.status !== "deferred" && r.status !== "coverage-limited");
         if (split.held.length > 0 && split.closeable.length === 0 && !openNonDeferred) {
           note(`escalation skipped ${a} — capability-gap deferral: the active register provider cannot express those slices, so a re-run re-derives the same refusal (the gap stays open and disclosed)`);
@@ -11686,7 +11784,7 @@ async function pipelineInner(job, opts = {}) {
         // while ALSO carrying held rows — and the resumed unit must not be left to think those are
         // work it failed to do. Name them, exactly as the envelope's close followup does.
         const escHeld = splitDeferredByCloseability(ledger, a, escalationGapAxes,
-          { fullyDeferred: escalationFullyDeferred.has(a.toLowerCase()) }).held;
+          { fullyDeferred: escalationFullyDeferred.has(a.toLowerCase()), heldUnits: stickyGapUnits(P) }).held;
         if (escHeld.length) {
           followup += `\n\nNOT YOURS TO CLOSE — the active register provider cannot express these slices at all, so no re-run can reach them. Leave these Coverage-ledger rows exactly as they are (\`deferred\`, same reason), and do not restate them as searched or clean:\n${escHeld.map((r) => `| ${r.unit} | deferred | ${r.reason} |`).join("\n")}`;
         }
@@ -11762,8 +11860,9 @@ async function pipelineInner(job, opts = {}) {
       // time, still deferred, still an open floor, still disclosed.
       const gapAxes = capabilityGapAxes(ctx.registerPlan, readPlanExecution(ctx));
       const fullyDeferred = new Set((ctx.registerPlan ? fullyDeferredAxes(ctx.registerPlan) : []).map((a) => String(a.axis).toLowerCase()));
+      const stickyUnitsNow = stickyGapUnits(P);   // a gap this run already accepted is held whatever its row's reason says
       const closeabilityByAxis = new Map(deferredAxes.map((a) => [a,
-        splitDeferredByCloseability(ledgerNow, a, gapAxes, { fullyDeferred: fullyDeferred.has(String(a).toLowerCase()) })]));
+        splitDeferredByCloseability(ledgerNow, a, gapAxes, { fullyDeferred: fullyDeferred.has(String(a).toLowerCase()), heldUnits: stickyUnitsNow })]));
       const heldAxes = deferredAxes.filter((a) => {
         const s = closeabilityByAxis.get(a);
         // The `!hasBreach &&` term is retired with the ⭐ floor: it kept an axis carrying a
@@ -11805,6 +11904,10 @@ async function pipelineInner(job, opts = {}) {
             ? `\n\nThese rows on this axis are NOT yours to close and must stay exactly as they are — the active register provider cannot express those slices at all, so no re-run can reach them. Leave them \`deferred\`, keep their reason, and do not restate them as searched or clean:\n${split.held.map((r) => `| ${r.unit} | deferred | ${r.reason} |`).join("\n")}`
             : "";
           note(`envelope: closing deferred coverage on ${a} (deadline permits — ${decision.reason})`);
+          // What the re-opened unit is asked to close, and what it is told to leave: the record of the split
+          // this close acted on, so a gap handed back as work is visible in the run's own log.
+          runLog(run.runDir, { event: "envelope-close-rows", axis: a,
+            closeable: split.closeable.map((r) => String(r.unit ?? "")), held: split.held.map((r) => String(r.unit ?? "")) });
           const followup = repairFollowup("register-unit:envelope-close", { paths: P, axis: a, rows: rows + heldRows,
             supplementalLane: !!ctx.registerPlan?.contract?.supplemental_lane });
           const r = await stage("register-unit", { ...ctx, axis: a }, { force: true, followup, sessionKey: unitKey[a], trigger: "envelope" });
@@ -12241,6 +12344,7 @@ async function pipelineInner(job, opts = {}) {
           ledger: loadCoverageLedger(run.runDir).rows,   // fresh read — post-reopen/re-digest, same source as every gate
           planContext: { entries: ctx.registerPlan.entries ?? [], niceClasses: ctx.registerPlan.nice_classes ?? [], regions: ctx.registerPlan.regions ?? [] },
           executor: ccExecutor,
+          capabilities: registerCapabilities(),   // the contains floor, read the way the plan compile reads it
           note: (m) => note(m),
           log: (row) => runLog(run.runDir, row),   // the orchestrator's own crowd-context-failed row lands in run.jsonl
         });
@@ -12499,7 +12603,7 @@ async function pipelineInner(job, opts = {}) {
         : "failed after retries + fallback (the ladder recorded no condition)");
     let verdict = firstRef.verdict;
     runLog(run.runDir, { event: "verdict", verdict });
-    writeRunStatus(ctx, { verdict });
+    writeRunStatus(ctx, signoffPatch(verdict));
     note(`refutation verdict: ${verdict}`);
     // qw/typed-correction-kinds — TELEMETRY ONLY (data first; the corrective-skip decision is a
     // separate owner-gated build): partition the review's flagged-correction lines by their
@@ -12743,7 +12847,7 @@ async function pipelineInner(job, opts = {}) {
       verdict = rc.ok ? (parseVerdict(readFileSync(P.seniorEyeReview, "utf8")) ?? entryVerdict) : entryVerdict;
       correctiveRecheckOk = rc.ok === true;
       runLog(run.runDir, { event: "verdict-2", verdict });
-      writeRunStatus(ctx, { verdict });
+      writeRunStatus(ctx, signoffPatch(verdict));
     }
     // AD-2 A1 — the completion receipt, written ONLY when the cycle finished with a verified recheck:
     // a fallen-back recheck kept the entry verdict WITHOUT re-verifying, and cementing that would stop
@@ -12985,7 +13089,7 @@ async function pipelineInner(job, opts = {}) {
       if (d.clamped) {
         runLog(run.runDir, { event: "terminal-guard-clamp", defect: d.record.defect, from: verdict, to: d.verdict });
         verdict = d.verdict;
-        writeRunStatus(ctx, { verdict });
+        writeRunStatus(ctx, signoffPatch(verdict));
       }
     };
 
@@ -13119,7 +13223,7 @@ async function pipelineInner(job, opts = {}) {
             runLog(run.runDir, { event: "coverage-floor-clamp", cause: "forward-actions", from: "CLEAR", to: "CONDITIONAL", legalActions: conditions.length });
             note(`deliver-conditional floor: the opinion names ${conditions.length} forward legal action(s) a human must take (${conditions[0].slice(0, 140)}${conditions.length > 1 ? `; +${conditions.length - 1} more` : ""}) — clamping CLEAR→CONDITIONAL (spec 64: the disposition is derived from the findings' named actions).`);
             verdict = "CONDITIONAL";
-            writeRunStatus(ctx, { verdict });
+            writeRunStatus(ctx, signoffPatch(verdict));
           } else if (fresh.length) {
             runLog(run.runDir, { event: "verdict-conditions-recorded", legalActions: fresh.length });
           }
@@ -13157,7 +13261,7 @@ async function pipelineInner(job, opts = {}) {
         if (droppedConditions.length && verdict === "CLEAR") {
           runLog(run.runDir, { event: "coverage-floor-clamp", cause: "dropped-actions", from: "CLEAR", to: "CONDITIONAL", actionsDropped: droppedConditions.length });
           verdict = "CONDITIONAL";
-          writeRunStatus(ctx, { verdict });
+          writeRunStatus(ctx, signoffPatch(verdict));
         }
       }
     } catch (e) { note(`legal-actions floor skipped (${String(e.message).slice(0, 80)}) — never-kill; the predelivery coherence lint is the second net`); }
@@ -13205,7 +13309,7 @@ async function pipelineInner(job, opts = {}) {
         // re-ask can flip a clamped verdict back to CLEAR, and it must meet this floor again with the
         // reason ALREADY recorded. Folding these two into one guard would let the second pass skip on
         // the dedup and deliver CLEAR — the precise defect this issue is about.
-        if (clReason && verdict === "CLEAR") { verdict = "CONDITIONAL"; writeRunStatus(ctx, { verdict }); }
+        if (clReason && verdict === "CLEAR") { verdict = "CONDITIONAL"; writeRunStatus(ctx, signoffPatch(verdict)); }
       }
     } catch (e) { note(`common-law downgrade floor skipped (${String(e.message).slice(0, 80)}) — never-kill`); }
     if (entryVerdict === "CLEAR") {
@@ -13299,7 +13403,7 @@ async function pipelineInner(job, opts = {}) {
         // The reason KINDS distinguish coverage/frame/screen-gate/senior-right/register residue for the
         // report bound line and the client conditions row (merged — legalActions survives).
         clampKinds = { ...clampKinds, coverage: coverageInsufficient || undefined, frame: frameResidual || undefined, screenGate: screenGateGap || undefined, seniorRight: seniorGap || undefined, registerGap: registerGap || undefined, deadlineCarry: deadlineGap || undefined };
-        writeRunStatus(ctx, { verdict });
+        writeRunStatus(ctx, signoffPatch(verdict));
       }
     }
     };
@@ -13487,7 +13591,7 @@ async function pipelineInner(job, opts = {}) {
         if (rr.ok) {
           verdict = parseVerdict(readReview()) ?? "BLOCKING";
           runLog(run.runDir, { event: "verdict-3", verdict, trigger: "degenerate-reask" });
-          writeRunStatus(ctx, { verdict });
+          writeRunStatus(ctx, signoffPatch(verdict));
           applyCoverageFloor();   // a re-asked CLEAR passes the same deliver-conditional floor
           try { writeVerdictSidecar(); }
           catch (e) { throw new StageFailure("verdict", `verdict sidecar write failed (the single label authority): ${String(e.message).slice(0, 120)}`); }
@@ -14512,7 +14616,7 @@ async function pipelineInner(job, opts = {}) {
         applyCoverageFloor();
         try { writeVerdictSidecar(); }
         catch (e) { throw new StageFailure("verdict", `verdict sidecar re-derive failed (spec-64 coherence repair): ${String(e.message).slice(0, 120)}`); }
-        if (verdict !== beforeVerdict) writeRunStatus(ctx, { verdict });
+        if (verdict !== beforeVerdict) writeRunStatus(ctx, signoffPatch(verdict));
         runLog(run.runDir, { event: "verdict-rederive-repair", from: beforeVerdict, to: verdict });
         lint = lintNow();
       }
@@ -14798,7 +14902,7 @@ async function pipelineInner(job, opts = {}) {
                   runLog(run.runDir, { event: "verdict-hardened-by-repair", was: verdict, now: hardened, stage: s2.label, adopted: true });
                   note(`stale-repair: the reviewer returned ${hardened} — adopting it as the run's verdict (the one settled earlier was decided against a review this repair has since rewritten) and rebuilding the label from it`);
                   verdict = hardened;
-                  writeRunStatus(ctx, { verdict });
+                  writeRunStatus(ctx, signoffPatch(verdict));
                   try { writeVerdictSidecar(); }
                   catch (e) { throw new StageFailure("verdict", `verdict sidecar write failed (the single label authority): ${String(e.message).slice(0, 120)}`); }
                   reassemble = true;
@@ -15295,7 +15399,7 @@ async function pipelineInner(job, opts = {}) {
     {
       const mark = job.markName ?? job.name ?? job.ref ?? "the matter";
       const ref = job.ref ? ` (${job.ref})` : "";
-      const vtag = verdict ? ` — verdict ${verdict}` : "";
+      const vtag = emailVerdictOpts.tier ? ` Overall risk: ${emailVerdictOpts.tier}.` : "";   // the rating, never the reviewer's sign-off word (ruled 2026-09-22)
       // self-contained packet (the email body HTML is embedded so the courier needs no path resolution
       // across the archive move). The courier sends EXACTLY this — same subject, text and recipient the
       // deleted send stages composed, now composed in code.
@@ -15317,7 +15421,7 @@ async function pipelineInner(job, opts = {}) {
         // stated reason when no number is held. It used to go to AGENT_WHATSAPP[agent], which is the
         // operator on every run because every user shares one agent id.
         ...whatsappRouting(job, agent),
-        whatsappText: `✅ Clearotron search for ${mark}${ref}${vtag} is done. Report: ${published.url}`,
+        whatsappText: `✅ Clearotron search for ${mark}${ref} is done.${vtag} Report: ${published.url}`,
         url: published.url, verdict, markName: job.markName ?? job.name ?? null,
       };
       // A NEW send supersedes any previous one: .sent is PER-SEND idempotence, not per-run-lifetime.
@@ -15364,13 +15468,13 @@ async function pipelineInner(job, opts = {}) {
     // .published + .delivered on disk must never read "7/9" on any status surface (nothing runs after
     // the packet, so no stage transition would ever finish the display sequence). finalStepFields ⇒ 9/9.
     const deliveredAt = new Date().toISOString();
-    writeRunStatus(ctx, { state: "delivered", verdict, statement: emailVerdictOpts.statement ?? undefined, url: published.url, deliveredAt, sendPending: true, ...finalStepFields() });
+    writeRunStatus(ctx, { state: "delivered", ...signoffPatch(verdict), statement: emailVerdictOpts.statement ?? undefined, caption: published.caption ?? undefined, url: published.url, deliveredAt, sendPending: true, ...finalStepFields() });
     // — THE POOL COPY LEARNS ITS OWN TERMINAL STATE, HERE AND NOWHERE ELSE.
     // `meta.json` cannot carry this: it is composed inside publish, before this line runs, so the state
     // did not exist yet when it was written. This is the one moment where the terminal state and the
     // pool directory are both in hand. Best-effort by construction — the report is already published
     // and the run is already settled, so a failure to stamp is logged and the delivery proceeds.
-    const stamp = writeSettleStamp(published.poolRunDir, { state: "delivered", verdict, deliveredAt, runId: published.runId ?? run.runId, lane: "clearance" });
+    const stamp = writeSettleStamp(published.poolRunDir, { state: "delivered", signoff: verdict, deliveredAt, runId: published.runId ?? run.runId, lane: "clearance" });
     if (!stamp.written) note(`delivery: settle stamp not written (${stamp.reason})`);
     const archived = archive(run);
     rollupStatus(run.studioRoot);
@@ -15939,7 +16043,7 @@ export function reconstructCtx(job, opts) {   // @internal
   } catch { /* no/corrupt frozen plan — prose axes stand, as they always did */ }
   const readJson = (f) => { try { return JSON.parse(readFileSync(join(run.runDir, f), "utf8")); } catch { return null; } };
   const status = readJson("status.json");
-  if (status?.verdict) ctx.verdict = status.verdict;
+  if (readSignoff(status)) ctx.verdict = readSignoff(status);   // `review.signoff`, or `verdict` on a record written before the move
   const pub = readJson(".published");
   if (pub?.url) ctx.publishedUrl = pub.url;
   // ── THE CTX FIELDS THIS USED TO DROP (item) ───────────────────────────────────────────────────

package/driver/plan-run-agreement-verdict.mjs

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sarl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// DO describe_options AND plan_run AGREE ON WHICH PRODUCTS ARE AVAILABLE — the deployment check's arm,
+// extracted so it can be driven without a door to call (the reason surface-exit-verdict.mjs gives).
+//
+// A plan_run that THROWS compared nothing. A 429 from the door's rate limit, a timeout, a refused
+// connection: each means the question was never answered, and the check used to file it beside the real
+// disagreements and exit 1, "drifted". Three runs of the check in two minutes exhausted the ops door's
+// rate limit and the third reported a drift that a redeploy could not have fixed. So an unanswered ask is
+// a marked skip, which exits 3, and only an answer that contradicts describe_options is a drift.
+
+// The blocker wording plan_run uses for a product it will not run.
+const UNAVAILABLE = /not part of the current release|not switched on|unavailable/i;
+
+/**
+ * Ask plan_run about each product describe_options listed, and say whether the two agree.
+ *
+ * @param {{ keys: string[], doorSays: Map<string, boolean>, probeProfileKey: string|null,
+ *           ask: (key: string) => Promise<{blockers?: unknown[]}> }} input
+ *   `ask` is the plan_run call for one product; a throw is a question that was not answered.
+ * @returns {Promise<{state: "pass"|"fail"|"skip", message: string, blocked?: true}>}
+ */
+export async function planRunAgreementVerdict({ keys = [], doorSays = new Map(), probeProfileKey = null, ask }) {
+  if (!probeProfileKey) {
+    return { state: "skip", message: "no customer resolved to plan against — see the roster check" };
+  }
+  const disagreements = [];
+  const unanswered = [];
+  for (const key of keys) {
+    let plan;
+    try { plan = await ask(key); } catch (e) { unanswered.push(`${key}: ${String(e?.message ?? e).slice(0, 120)}`); continue; }
+    const unavailable = (plan?.blockers ?? []).some((b) => UNAVAILABLE.test(String(b)));
+    if (unavailable !== !doorSays.get(key)) {
+      disagreements.push(`${key}: describe_options=${doorSays.get(key) ? "available" : "unavailable"} plan_run=${unavailable ? "unavailable" : "available"}`);
+    }
+  }
+  // A drift outranks an unanswered ask, as in exitFor: the drift is actionable now. The unanswered
+  // products stay on the line so the report does not read as though they were compared.
+  if (disagreements.length) {
+    return { state: "fail", message: disagreements.join(" · ")
+      + (unanswered.length ? ` · and plan_run gave no answer for ${unanswered.length}: ${unanswered.join(" · ")}` : "") };
+  }
+  if (unanswered.length) {
+    return { state: "skip", blocked: true, message: `could not ask plan_run about ${unanswered.length} of ${keys.length} product(s), `
+      + `so those were not compared — ${unanswered.join(" · ")}` };
+  }
+  return { state: "pass", message: `${keys.length} products checked through both code paths` };
+}

package/driver/portal-service.mjs

@@ -350,7 +350,7 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, gener
         const docs = reportsOf(meta).filter((r) => existsSync(join(poolRoot, name, r.file)));
         const hasReport = docs.length > 0;
         const { bands, toneFor } = ladderOf(meta);
-        const band = meta.overall ?? meta.verdict ?? null;
+        const band = meta.overall ?? null;   // the rating; a meta's retired `verdict` held the reviewer's sign-off on the full-search lane
         out.push({ runId: meta.runId ?? name, account: owner, ...(owner === "generic" ? { organisation: meta.organisation ?? null } : {}),
           title: meta.title ?? meta.matter ?? name, kind: meta.kind ?? "clearance",
           // THE MARK, separate from the report's headline.
@@ -540,7 +540,7 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, gener
         // hide this. Staff only: the client redaction below replaces `reason` and must drop this too,
         // or the redaction would be defeated by the field that carries the raw words.
         reasonDetail: s.reasonDetail ?? null,
-        date: (s.updatedAt ?? "").slice(0, 10), overall: s.verdict ?? null,
+        date: (s.updatedAt ?? "").slice(0, 10), overall: s.tier ?? null,   // the rating, never the reviewer's sign-off word
         // A live run has not been issued, so its last progress write is the honest ordering key — the
         // same role issuedAt plays for a delivered one, never presented as a finish time.
         issuedAt: typeof s.updatedAt === "string" ? s.updatedAt : null,
@@ -4006,7 +4006,7 @@ ${signedIn
 <div><a href="/portal">Go to the portal</a></div>
 <form method="post" action="/portal/logout"><button type="submit">Sign out</button></form>`
     : `<p>This ${escHtml(BRAND.name)} has one user: <b class="who">${escHtml(email)}</b>. Enter its passphrase.</p>
-${discarded ? `<p class="hint">A session this portal did not start, from another ${escHtml(BRAND.name)} on this address or an expired one, was set aside. Sign in below.</p>` : ""}
+${discarded ? `<p class="hint">Your earlier sign-in has expired. Sign in again.</p>` : ""}
 ${error ? `<p class="err">${escHtml(error)}</p>` : ""}
 <form method="post" action="/portal/login">
   <label for="passphrase">Passphrase</label>
@@ -4130,6 +4130,10 @@ async function readFormBody(req, limitBytes = 8192) {
   });
 }
 
+// The brief reader's model when PORTAL_READ_MODEL is unset: a TIER, like every stage's. An exact id goes to
+// the program as that model — past a cloud's ANTHROPIC_DEFAULT_SONNET_MODEL — and codex maps tiers only.
+export const PORTAL_READ_MODEL_DEFAULT = "sonnet";
+
 export function makeHttpHandler({ verify, limiter, service, log = () => {}, devIdentity = null, localAuth = null, static: staticHandler = null,
   // item 1 — PASSED IN, because this handler is its own function and the bootstrap that reads
   // the environment is another. The default is the Cloudflare Access header, so a caller that does
@@ -5211,7 +5215,7 @@ const PORT = PORT_CHOICE.port;
       // two are parameters on the shared runner for exactly this reason: `compose-read.mjs` records that
       // Haiku 4.5 refuses a thinking block outright (400), so inheriting the jx constants here would
       // have been a failure on every press.
-      const model = process.env.PORTAL_READ_MODEL || "claude-sonnet-5";
+      const model = process.env.PORTAL_READ_MODEL || PORTAL_READ_MODEL_DEFAULT;
       const runner = await makeJxTurnRunner({ model, thinking: "off", lane: "the brief reader" });
       if (runner?.error) {
         // NAMES THE CONDITION, on the operator's surface. The client-facing note stays client-facing;