clearotron 0.3.2 → 0.3.3-beta.1

package/driver/runner.mjs

@@ -26,7 +26,7 @@ import { driverDir, ensureDriverDir } from "../shared/driver-dir.mjs";   // —
 // The queue's filename vocabulary, in ONE place — the rule, extended by to the prose-sidecar and
 // claim-sidecar names, because a harness check retyped four of them from memory and false-alarmed on the
 // other nine. Behaviour here is unchanged: the same object and the same three suffixes, sourced.
-import { isLiveQueueMarker, PROSE_PARTS, CLAIM_SIDECAR_SUFFIXES, TERMINAL_QUEUE_SUFFIXES } from "./queue-markers.mjs";
+import { isLiveQueueMarker, PROSE_PARTS, CLAIM_SIDECAR_SUFFIXES, TERMINAL_QUEUE_SUFFIXES, withFoldedGoods } from "./queue-markers.mjs";
 import { matterLedgerPath, DEFAULT_CLIENT_DAILY_RUNS } from "./usage-ledger.mjs";   // ONE ledger-path calculation, shared with the portal pre-check
 import { orderTimeRefusal, START_ENV_FILE_FLAG, startEnvFileOf } from "./run-requirements.mjs";   // one authority for what a run needs, and when it is asked for
 import { unitEnvPath, envFileRead } from "../shared/env-local.mjs";   // the file the units read, named by its one author
@@ -79,7 +79,12 @@ function assembleJob(procPath, qdir, base) {
       if (v.trim()) job[field] = v;
     }
   }
-  return job;
+  // AFTER the sidecars, because a goods description can arrive as one and folding before them would
+  // read a field the job did not have yet. Intake accepts the description under either spelling and
+  // every reader in a run asks for the current field, so it is folded once here rather than at each of
+  // the ten places that ask — the seam that let a job on the older spelling scope no goods at all. The
+  // queue file is not touched: what was filed stays as filed.
+  return withFoldedGoods(job);
 }
 
 // Best-effort sweep of a job's prose sidecars once it reaches a terminal state, so a drained queue leaves no
@@ -2360,6 +2365,20 @@ export async function watch({
   // — injectable for the same reason every other dependency here is: the loop's arms drive it with a
   // fake clock and must not write to a real install.
   heartbeat = () => beat(config.runLockDir),
+  // ── AND IT KEEPS BEATING WHILE THE TICK RUNS ────────────────────────────────────────────────────
+  //
+  // The beat above is written once per tick and the tick then AWAITS a whole run. A clearance takes
+  // hours, so on a busy install the heartbeat was stale for the entire time the worker was healthiest
+  // — measured forty minutes stale on a live run that was writing records throughout. Anything
+  // reading beat age as liveness would call that run dead, and the obvious next act is to restart or
+  // kill it. The file was fresh when the box was IDLE, which is the reading that makes it dangerous:
+  // it looks like a liveness signal precisely when nothing is happening.
+  //
+  // So the beat continues on its own timer for as long as the run is in flight. Injectable because
+  // the arms must drive it on a fake clock; unref'd in the default so a pending beat can never be the
+  // thing keeping this process alive.
+  beatEveryMs = WATCH_TICK_MS,
+  startBeating = (fn, everyMs) => { const t = setInterval(fn, everyMs); t.unref?.(); return () => clearInterval(t); },
 } = {}) {
   note(`[runner] watch: polling every ${Math.round(tickMs / 1000)}s (no systemd here); a due park or an unclaimed job is picked up on the next tick. Ctrl-C to stop.`);
   for (let n = 0; ; n++) {
@@ -2371,8 +2390,13 @@ export async function watch({
     // leave a freshly-started worker looking absent for its whole first tick — which is exactly the window
     // a user watches after pressing Start.
     heartbeat();
+    const stopBeating = startBeating(heartbeat, beatEveryMs);
     try { await run({ once: true }); }
     catch (e) { note(`[runner] watch tick FAILED (isolated — retrying next tick): ${e?.message ?? e}`); }
+    // Reached on every path out of the tick, including the one where the catch above swallows a
+    // failure. A timer left running would go on beating for a worker that had stopped — the one
+    // direction this file's fail-safe rule forbids, because it is the reading nobody checks twice.
+    finally { stopBeating(); }
     if (n + 1 >= ticks) break;
     const due = now() + tickMs;
     for (;;) {

package/driver/settle-stamp.mjs

@@ -55,12 +55,15 @@ export const SETTLE_SCHEMA_VERSION = 1;
  * reads a delivery date (turnaround, an SLA, a client-facing "delivered on") would have inherited it.
  * A backfiller must not compose this value at all: call `backfillSettleStamp`, which reads it.
  */
-export function writeSettleStamp(poolRunDir, { state, verdict = null, deliveredAt = null, runId = null, lane = null } = {}) {
+// The outcome words are named for what they are: the full-search lane's reviewer `signoff` (CLEAR /
+// CONDITIONAL / BLOCKING) and the quick-search lane's rating `tier`. Both once shared one `verdict` field,
+// which read as the clearance's answer and held a different vocabulary on each lane.
+export function writeSettleStamp(poolRunDir, { state, signoff = null, tier = null, deliveredAt = null, runId = null, lane = null } = {}) {
   if (!poolRunDir) return { written: false, reason: "no pool run directory — the run published nowhere" };
   if (!state) return { written: false, reason: "no terminal state given — a stamp with no state is the absence it would be mistaken for" };
   const path = join(poolRunDir, SETTLE_FILE);
   try {
-    writeFileSync(path, `${JSON.stringify({ schema_version: SETTLE_SCHEMA_VERSION, state, verdict, deliveredAt, runId, lane, stampedAt: new Date().toISOString() }, null, 2)}\n`);
+    writeFileSync(path, `${JSON.stringify({ schema_version: SETTLE_SCHEMA_VERSION, state, ...(signoff ? { signoff } : {}), ...(tier ? { tier } : {}), deliveredAt, runId, lane, stampedAt: new Date().toISOString() }, null, 2)}\n`);
     // Group-read like every other pool file. Best-effort on its own: a stamp nobody can chmod is still
     // a stamp, and the set-GID pool already grants the group.
     try { chmodSync(path, 0o640); } catch { /* best-effort, exactly as publish's writeRO does */ }
@@ -116,7 +119,11 @@ export function backfillSettleStamp(poolRunDir, runDir, { readStatus = defaultRe
     return { written: false, reason: "status.json says delivered but carries no deliveredAt — the delivery time this backfill exists to preserve is not recorded" };
   return writeSettleStamp(poolRunDir, {
     state: status.state,
-    verdict: status.verdict ?? null,
+    // A status.json written before the sign-off moved carries it as `verdict`, and on the quick-search
+    // lane that field held the rating; each is read back into the field it always meant.
+    ...((status.lane ?? (status.marks ? "knockout" : "clearance")) === "knockout"
+      ? { tier: status.tier ?? status.verdict ?? null }
+      : { signoff: status.review?.signoff ?? status.verdict ?? null }),
     deliveredAt: status.deliveredAt ?? null,
     runId: status.runId ?? null,
     lane: status.lane ?? (status.marks ? "knockout" : "clearance"),

package/driver/skills/clearance-common-law/SKILL.md

@@ -364,6 +364,8 @@ One row per planned coverage unit (each mandatory platform; the field-scoped gen
 | field-scoped general search (collab / non-gaming goods) | confirmed-clean | run per matter scope |
 | non-Latin platform reach (translit variants) | coverage-limited | marketplace data thin for non-Latin scripts; absence not confirmed clean |
 
+Record the same statuses by calling `record_coverage_status`, passing `grid_spec_path` (the same driver-written spec path the grid tool was given) and one entry per ledger row: its coverage unit, and its status, exactly `confirmed-clean`, `coverage-limited` or `deferred`.
+
 ### Cross-checks suggested (handed to orchestrator for clearance-register dispatch)
 
 | Trigger | Suggested cross-check |

package/driver/skills/clearance-register/SKILL.md

@@ -110,6 +110,45 @@ funnel never converts a resource limit into a clean negative and never re-adds a
 says "searched N, ship clean". (Phoneme at 5 and image at 10 are observed budgets — exceeding them usually
 indicates a worker repeating itself, not finding new content.)
 
+### At every step: look at what you have before you work on it
+
+Fifty? Read them all. A few hundred? Sort by the client's goods and markets, read the near ones first, list
+the rest. A thousand or more? The field is crowded: read the identical and live ones for the client's
+goods, tell the client it is crowded, and do not write up the rest. Carry forward only what a lawyer would
+raise with the client. Write down what you set aside and why. This applies to the register's answer, to the
+list of records, to the placements, to the off-register sweep and to the write-up alike.
+
+### Read the identical mark first. Look at the count before you read anything
+
+On every matter the identical mark, in the instructed classes, is the first thing you read, and nothing
+wider is asked until you have read it. The register tells you how many filings answer a question before it
+hands you any. Take a look: how bad is it? If the list is one you can read record by record, read it in
+full. If it is not, do not read it and do not leave it: narrow the same question, in this order, until it
+is, then read that list in full and decide.
+
+1. Ask again for the identical mark, in the instructed classes, limited to the client's goods words. Read
+   that list.
+2. Still a crowd? Ask again limited to the client's main markets, one question per market. Read those lists.
+3. Still a crowd in a market? Ask again with the dominant goods word alone. Read it.
+4. Still a crowd? Ask one class at a time. Read each list.
+5. When the readable list already holds conflicts in the client's field, stop widening. Do not open scripts,
+   neighbours, compounds or guessed owners for this mark. Write which questions you did not ask and why.
+6. When the readable list is thin, widen one step at a time: close variants first, then the owner families
+   of what you found.
+
+Every question you ask is recorded with its count. A narrowing replaces nothing silently: the crowd it
+replaces stays on the record with its count.
+
+When you stop widening under step 5, the families you did not open are recorded `withheld-by-judgment`
+with your reason — not `confirmed-clean`, which would claim a search nobody ran, and not
+`coverage-limited`, which says the engine tried and could not finish. You chose where the work was best
+spent; say so, and say which questions you did not ask.
+
+When you narrow a crowded question, name the crowd it replaces: put its qid on the proposal as
+`narrows`. The record then shows the crowd and the question that answered it side by side, each with
+its own count. A narrowing that does not name what it replaced leaves the crowd looking unanswered.
+
+
 **The per-major and per-jurisdiction named queries are breadth, not a budgeted sufficiency allowance.** Each
 in-scope major (US/EU/UK/CN/JP) and each material jurisdiction the matter-frame declared is a **named slice
 the funnel COVERS** — and when the region-scoped in-scope sweep (Recipe 1 Step 2) returns `enumerated`
@@ -193,11 +232,11 @@ one hard stop — the driver fails fan-in on it, so a clean can never ship over
 writes no `coverage_judgment` and no clean verdict** — it hands up the complete band + honest `incomplete`s and
 lets judgment decide.
 
-### Coverage ledger — which document you owe, and what the three status tokens mean
+### Coverage ledger — which document you owe, and what the four status tokens mean
 
 **The status vocabulary is CLOSED: EXACTLY one bare token of: `confirmed-clean` / `coverage-limited` /
-`deferred`.** Qualifiers never go in a status cell; they go in the reason. The distinction between the last
-two is doctrine, not wording, and the driver relabels a row that gets it wrong:
+`deferred` / `withheld-by-judgment`.** Qualifiers never go in a status cell; they go in the reason. The distinction between
+`coverage-limited` and `deferred` is doctrine, not wording, and the driver relabels a row that gets it wrong:
 
 - **`coverage-limited`** — the search RAN and could not be exhausted: a crowd over the provider window, a
   count-only saturation descriptor, a volume/pagination ceiling. A re-run cannot close it, so the escalation
@@ -207,6 +246,8 @@ two is doctrine, not wording, and the driver relabels a row that gets it wrong:
   disclose — and it clamps the verdict CLEAR→CONDITIONAL. Mislabel one of these `coverage-limited` and a
   fixable hole disappears into an accepted limit.
 - **`confirmed-clean`** — the slice ran to completion and judgment cleared it.
+- **`withheld-by-judgment`** — a waiting family the reading turn chose not to ask, so it was never searched.
+  Only a `family` row takes it, and its reason goes into the audit workbook, not the report.
 
 **HOW those statuses are recorded is not yours to assume — the dispatch states it, and it is one route,
 the `record_coverage` tool.** The driver computes the form before every digest dispatch and enumerates

package/driver/skills/clearance-register/digest.md

@@ -207,14 +207,14 @@ ledger` table and its JSON mirror from what you record afterwards. A run that ca
 gets a form — one declaring that, and naming its cause from a closed vocabulary — so "there is no form"
 is not a state you will meet.
 
-The dispatch ENUMERATES the form's rows — one per axis, one per unaccounted crowd block and one per
-deferred slice, each with its `row_id` — and every identifier is computed by the driver from the frozen
+The dispatch ENUMERATES the form's rows — one per axis, one per unaccounted crowd block, one per
+deferred slice and one per waiting family the reading turn did not ask, each with its `row_id` — and every identifier is computed by the driver from the frozen
 register plan and the plan-execution receipt: the coverage unit, the query id, the hit count, the
 unaccounted classes and terms, and each deferred slice's own receipt reason. Rule **every** row by
 calling the **`record_coverage` tool**, one entry per row, with two values of yours:
 
-- `status` — EXACTLY one bare token: `confirmed-clean` / `coverage-limited` / `deferred`. Qualifiers
-  never go in the status; they go in the reason.
+- `status` — EXACTLY one bare token: `confirmed-clean` / `coverage-limited` / `deferred` / `withheld-by-judgment`.
+  Qualifiers never go in the status; they go in the reason. A waiting family's row takes only `withheld-by-judgment`, and most arrive already settled with the reading turn's reason.
 - `reason` — the sentence the lawyer reads.
 
 The driver validates each row as it arrives — a refused row names what to change, and the rest of the
@@ -359,7 +359,7 @@ For example: subject `PHINIA — placed at watchlist-annex, class-match said hea
 decision `ADOPTED`, reason `the cl.12 overlap is auto-parts vs the applicant's software; off-field`.
 
 **Coverage ledger → the `coverage_judgment` contract.** You rule every row of the driver's coverage form
-through `record_coverage` (a `confirmed-clean` / `coverage-limited` / `deferred` status and a reason on
+through `record_coverage` (a `confirmed-clean` / `coverage-limited` / `deferred` / `withheld-by-judgment` status and a reason on
 every row — the driver renders both the `## Coverage ledger` table and `register-coverage-ledger.json`
 from what the tool records), plus the rolled-up sufficiency line. The **synthesis stage** lifts the rolled-up line into `findings.json`
 as the top-level `coverage_judgment` field: `{ "sufficient": <bool>, "reason": "<why>" }`. The FORM is the

package/driver/skills/clearance-register/providers/clarivate.md

@@ -82,7 +82,7 @@ An operator word *inside* a phrase is handled for you: "BLACK AND DECKER" goes o
 `*BLACK ADJ A?D ADJ DECKER*` (the `?` stops the parser reading AND as an operator). The one term that
 still defers is a bare two-letter operator word — `OR` alone has no interior character to wildcard.
 
-`names[]` (an OR-stack) becomes ONE value joined with explicit ` OR `. The safe width is **500 terms** —
+`names[]` (an OR-stack) becomes ONE value joined with explicit ` OR `. The safe width is **496 terms** —
 the bound is the JSON parser's document-nesting cap, which the register names in the refusal it answers a
 wider stack with. `register_enumerate` chunks wider stacks for you at that bound.
 

package/driver/skills/clearance-register/unit.md

@@ -45,6 +45,45 @@ You were spawned to run exactly ONE axis named in your task. Read the manifest +
 3. **ENUMERATE the dangerous NAMED band with `register_enumerate` — class-scoped, never manual paginate-then-sample.** For each named query (the exact mark + each specific variant × in-scope class × material/major jurisdiction), call **`register_enumerate`** with the query (`name`/`names`/`match_mode`/`nice_classes`/`regions`/`owner_country`/`in_scope_classes` + the usual `register_search` fields). **MANDATORY: every `register_enumerate` call MUST carry `nice_classes`=<the matter's in-scope Nice set> AND `in_scope_classes`=<the same set>.** An enumerate with `nice_classes` OMITTED runs an all-45-class crowd (the `default` / `starts_with` / `ends_with` / `phonetic` / `fuzzy` modes are unbounded unscoped) — it floods the band and TIMES OUT the stage, and it is **FORBIDDEN**: scope-by-class is breadth the matter instructed, not a "good enough" call. The **only** all-class exception is the exact-IDENTICAL cross-class merch check (`match_mode:exact`, `nice_classes:[25]`). `fuzzy` is **never** an enumerate mode. **The tool owns the page loop and CANNOT return a partial list** — you cannot get a partial result and call it done, and there is no top-N mode. It returns exactly **one of two states**:
    - **`{state:"enumerated", total_hits, count, records:[…]}`** — it paged to `has_more:false`; every named record is carried forward, already batch-screened (each record carries `record_id`, `mark_text`, `classes`, `status`, `owner_name`, `owner_country`, `application_date`, `registration_date`, `expiry_date`, `jurisdictions`, `screen_verdict`). Write this verbatim as an `enumerated` band block.
    - **`{state:"incomplete", total_hits, fetched, sample, reason}`** — it could **not** page to completion (the band is a genuine CROWD over the resource ceiling, the provider 5000-record window was hit, or a provider error occurred). Write this verbatim as an `incomplete` band block. **This is a SIGNAL to judgment, never a clean negative and never something you self-accept.** You do **not** "narrow to tractable and call it clean" — an incomplete result crosses the firewall as an incomplete block; judgment decides whether to command a narrower enumeration or halt.
+
+### At every step: look at what you have before you work on it
+
+Fifty? Read them all. A few hundred? Sort by the client's goods and markets, read the near ones first, list
+the rest. A thousand or more? The field is crowded: read the identical and live ones for the client's
+goods, tell the client it is crowded, and do not write up the rest. Carry forward only what a lawyer would
+raise with the client. Write down what you set aside and why. This applies to the register's answer, to the
+list of records, to the placements, to the off-register sweep and to the write-up alike.
+
+### Read the identical mark first. Look at the count before you read anything
+
+On every matter the identical mark, in the instructed classes, is the first thing you read, and nothing
+wider is asked until you have read it. The register tells you how many filings answer a question before it
+hands you any. Take a look: how bad is it? If the list is one you can read record by record, read it in
+full. If it is not, do not read it and do not leave it: narrow the same question, in this order, until it
+is, then read that list in full and decide.
+
+1. Ask again for the identical mark, in the instructed classes, limited to the client's goods words. Read
+   that list.
+2. Still a crowd? Ask again limited to the client's main markets, one question per market. Read those lists.
+3. Still a crowd in a market? Ask again with the dominant goods word alone. Read it.
+4. Still a crowd? Ask one class at a time. Read each list.
+5. When the readable list already holds conflicts in the client's field, stop widening. Do not open scripts,
+   neighbours, compounds or guessed owners for this mark. Write which questions you did not ask and why.
+6. When the readable list is thin, widen one step at a time: close variants first, then the owner families
+   of what you found.
+
+Every question you ask is recorded with its count. A narrowing replaces nothing silently: the crowd it
+replaces stays on the record with its count.
+
+When you stop widening under step 5, the families you did not open are recorded `withheld-by-judgment`
+with your reason — not `confirmed-clean`, which would claim a search nobody ran, and not
+`coverage-limited`, which says the engine tried and could not finish. You chose where the work was best
+spent; say so, and say which questions you did not ask.
+
+When you narrow a crowded question, name the crowd it replaces: put its qid on the proposal as
+`narrows`. The record then shows the crowd and the question that answered it side by side, each with
+its own count. A narrowing that does not name what it replaced leaves the crowd looking unanswered.
+
    - **Write each call's result as one block in `register-units/<axis>-band.json`** (the named-band array — see *Named-band artifact* below). One block per `register_enumerate` / count-probe call. An `enumerated` block carries its records; an `incomplete` block is carried forward **verbatim — never dropped, never "accepted", never silently re-narrowed-then-cleaned**.
    - **The completeness contract is UNIFORM — it applies to the named band too.** "The exact mark, in-class, every major+material jurisdiction" is *usually* small and `enumerated` — but that is **not load-bearing**. If it ever runs to a few hundred and `register_enumerate` returns `incomplete`, it stays `incomplete` and crosses to judgment, exactly like the wider crowd. There is exactly **one** way to be done with a search: `enumerated`. Everything else is `incomplete` and the lawyer reads it. **Never self-accept "good enough" anywhere — not even the named band.**
 4. **For a SATURATION CROWD (a genuinely unbounded `contains` / character-indexed pile), write a COUNT-ONLY descriptor — do NOT enumerate it.** A saturated element solo (e.g. the everyday-word meaning token alone, the bare common element) is not a named band — it is noise the lawyer needs *described*, not *piled in*. Run `register_search` with `limit:1` (count-only, capturing `total_hits`) and write the result as an `{state:"incomplete", query, total_hits, fetched:0, sample:[], reason:"crowd descriptor — …"}` block. **Do NOT call `register_enumerate` on a saturation crowd, and do NOT call it clean.** The descriptor (count + why) is what crosses the firewall; the raw character-noise pile does not. Judgment reads the count and decides whether to command a narrower named enumeration inside it.

package/driver/skills/clearance-variants/SKILL.md

@@ -429,7 +429,7 @@ Step 5 names none.
 1. Start with the client's goods and services wording: the order's wording if it has one, otherwise the product description in the company profile.
 2. Add the words other filings use for the same goods that the client's wording does not already contain.
 
-Single words or short phrases as a specification would write them, no wildcards, at most 24. Each word is matched against the goods and services description of registered marks, so use words a specification would contain. A word broader than the goods widens the search instead of narrowing it. The register cannot read the words and, or, not, adj or near inside an item. An item containing one is searched without it. Omit the key when the matter has no goods wording.
+Single words or short phrases as a specification would write them, no wildcards, at most 24. Each word is matched against the goods and services description of registered marks, so use words a specification would contain. A word broader than the goods widens the search instead of narrowing it. The register cannot read the words and, or, not, adj or near inside an item. An item containing one is searched without it. Send an empty list when you have considered the goods and no word is worth narrowing by. Omit the key only when the matter states no goods at all — the two are different answers and the run records which one you gave.
 
 ### Step 6 — Cross-mark themes (once, after all marks processed)
 

package/driver/skills/matter-frame/SKILL.md

@@ -69,8 +69,10 @@ You do not write a file. Hand the frame back by calling `record_matter_frame`; t
 - Online platforms / retail / direct sales / partner programmes / developer portals
 - Geographic distribution patterns
 
-### Class scope & adjacency
-- The proposed Nice classes, and — by **reasoning**, not lookup — which *adjacent* classes to search. The test: *"would a consumer encountering both products assume they come from the same or an economically-linked undertaking?"* If yes, that adjacent class is in scope.
+### Which classes to search
+
+Start from the classes the order names. Then look at the client's own goods and business as the order and the company profile describe them. If they plainly reach a class the order did not name, add it, and write one sentence saying why (for example: the franchise sells video game accessories, so class 28). Add a class only for the client's own goods, never for what a competitor might hold. Never remove a class the order named. The added class is searched like every other: the identical mark first, and the count looked at before anything is read.
+
 - Name the classes scoped IN (with a one-line reason each) and any deliberately scoped OUT. Wrong class scope produces a false-clean, so be deliberate — this is a recall lever, not a formality.
 
 ### Scope jurisdictions — search wide, cite narrow (instructed scope honored; worldwide / brand-signalled scope leans wide + discloses)

package/driver/stages.mjs

@@ -16,6 +16,7 @@
 
 import { join, basename } from "node:path";
 import { driverRel } from "../shared/driver-dir.mjs";   //
+import { awaitsReadingTurn } from "../providers/_shared/plan-guards.mjs";   // — a guard the dictation misreads is a question the model never knows it may ask
 import { validators } from "./verify.mjs";
 import { REGISTER_PROVIDER, PROVIDERS } from "./driver.config.mjs";
 import { REGISTER_AXES, decideAxes } from "./coverage-ledger.mjs";
@@ -1359,7 +1360,7 @@ export const STAGES = {
       // EACH FIELD CARRIES ITS OWN IMPERATIVE IN ITS OWN SENTENCE (: a field phrased outside one was
       // written 0 of 9 times against 74 of 74 when imperative-carried).
       `Hand the frame back by calling the \`record_matter_frame\` tool. Send \`prose_body\` — the commercial read of the matter in full prose: client, sector, product description, customer base, channels of trade, off-field sectors, sector-convergence flags, watchlist-owner seeds, your scope reasoning, the class scope and adjacency call with a one-line reason per class, the applicant's own and affiliated marks, and the campaign shape where you are inferring one (label an inference as an inference).`,
-      `Send \`scope_basis\` as "instructed" or "derived", with \`scope_jurisdictions\` and \`excluded_jurisdictions\` as arrays of territories. Send \`identified_classes\` — the Nice classes you judge NECESSARY that the request did NOT instruct, each as {class, reason}, the class a whole number 1-45 and the reason one line. These are searched for every variant, not only the exact name, so name a class only where you would defend charging for it; omit the field or send an empty array where the instructed classes are the whole scope, which is the ordinary answer and adds nothing.`,
+      `Send \`scope_basis\` as "instructed" or "derived", with \`scope_jurisdictions\` and \`excluded_jurisdictions\` as arrays of territories. Send \`identified_classes\` — the Nice classes you judge NECESSARY that the request did NOT instruct, each as {class, reason}, the class a whole number 1-45 and the reason one line. Add a class only for the client's own goods, never for what a competitor might hold, and give one sentence saying why — a class sent without a reason is not searched. The added class is searched like every other: the identical mark first, and the count looked at before anything is read. Omit the field or send an empty array where the instructed classes are the whole scope, which is the ordinary answer and adds nothing.`,
       // The driver STAMPS the instructed-scope section from _driver/instructed-scope.json, so the seat is
       // not asked to quote back values the driver wrote at intake. That retyping was the stage's
       // `frame_scope_missing` loop and it is gone; see matter-frame-record.mjs.
@@ -1410,7 +1411,7 @@ export const STAGES = {
     contractElements: {
       "The prose manifest's Request / Elements / Variants tables and Watchlists section — the same terms already in variant-manifest.json": {
         class: "mechanical:code-rendered", tokens: ["too_short", "missing"],
-        why: "variant-manifest.json holds mark, dominant_element, elements[], variants[], incumbent_classes[], watchlist_owners[]; the prose tables restate exactly those. Both tokens police the PROSE copy (needs /variant/i + /\\|/ = a markdown table exists)",
+        why: "variant-manifest.json holds mark, dominant_element, elements[], variants[], incumbent_classes[], watchlist_owners[], goods_words[]; the prose tables restate exactly those. Both tokens police the PROSE copy (needs /variant/i + /\\|/ = a markdown table exists)",
       },
       "mark — \"<the mark verbatim>\"": {
         class: "mechanical:pre-bound", tokens: ["variantmodel_mark_missing"],
@@ -1588,6 +1589,12 @@ export const STAGES = {
       `Hand the manifest back by calling the \`record_clearance_variants\` tool. Send \`mark\` verbatim, \`dominant_element\`, and \`elements\` — one \`{value, kind}\` per token, kind from the closed set distinctive | common | saturated-common.`,
       `Send \`variants\` — one \`{value, category, rationale, romanization}\` per search term, category from the closed set the skill names, and \`romanization\` on every non-Latin value and only on those.`,
       `Send \`incumbent_classes\` and \`watchlist_owners\` where Step 5 names them, as arrays; omit or send empty where it does not.`,
+      // ITS OWN SENTENCE, BECAUSE A FIELD WITH NO IMPERATIVE IS A FIELD NOBODY FILLS. A production run
+      // proved it: the manual carried the instruction, the order's goods wording was in the dispatch,
+      // the model discussed the goods eighteen times in its prose — and handed back no goods words at
+      // all, because nothing in what it hands back had a slot for them. The manual asked; the contract
+      // did not.
+      `Send \`goods_words\` — the words the register search is narrowed to, from the matter's own goods and services wording plus the words other filings use for the same goods. Single words or short phrases as a specification would write them, no wildcards, at most 24. Send an empty list when you have considered the goods and no word is worth narrowing by. Omit it only when the matter states no goods at all: this is what stops a crowded sweep returning more filings than anyone can read, so leaving it out costs the search its narrowing.`,
       // THE SCOPE LEDGER STOPS BEING A TABLE THE DRIVER RE-READS. It used to be dictated as markdown in
       // the skill doc and recovered by parsing those columns back out of the prose (renderScopeLedgerJson
       // over variant-manifest.md). The rows arrive typed now and the driver renders the table AND
@@ -2188,7 +2195,7 @@ export const STAGES = {
             // message for transparency and so judgment knows what is already covered.
             `EXECUTE THE FROZEN PLAN VIA THE TOOL: call register_execute_plan ONCE with {"plan_path": "${P.registerPlan}", "axis": "${axis}", "output_path": "${P.registerBand(axis)}"}. The tool runs every dictated entry below ITSELF (paged enumerates; count-only crowd descriptors; a "when"-guarded fringe only if its parent enumerated) and WRITES the band file itself with each block's qid stamped. Do NOT run these dictated entries manually and do NOT write their blocks yourself.`,
             `For your audit context, the dictated entries the tool will run:`,
-            ...planEntries.map((e) => `- qid "${e.qid}": ${e.predicate} ${e.terms ? `names ${JSON.stringify(e.terms)} (one OR-stacked call)` : JSON.stringify(e.term)}${e.owner ? ` · owner ${JSON.stringify(e.owner)}` : ""} · nice_classes ${JSON.stringify(e.nice_classes)}${e.regions?.length ? ` · regions ${JSON.stringify(e.regions)}` : ""}${e.when ? ` · when: "${e.when.runs_if_enumerated}" enumerated` : ""} · expected: ${e.expected_kind}${Array.isArray(e.covered_by) && e.covered_by.length ? ` · crowd context — coverage is ${e.covered_by.join(", ")}` : ""}`),
+            ...planEntries.map((e) => `- qid "${e.qid}": ${e.predicate} ${e.terms ? `names ${JSON.stringify(e.terms)} (one OR-stacked call)` : JSON.stringify(e.term)}${e.owner ? ` · owner ${JSON.stringify(e.owner)}` : ""} · nice_classes ${JSON.stringify(e.nice_classes)}${e.regions?.length ? ` · regions ${JSON.stringify(e.regions)}` : ""}${e.when ? (awaitsReadingTurn(e.when) ? ` · WAITING FOR YOU: not asked unless you ask for it after reading the identical mark's list` : ` · when: "${e.when.runs_if_enumerated}" enumerated`) : ""} · expected: ${e.expected_kind}${Array.isArray(e.covered_by) && e.covered_by.length ? ` · crowd context — coverage is ${e.covered_by.join(", ")}` : ""}`),
             // copper-lattice re-route (supplemental_lane contract): judgment additions stay the model's
             // CALL — which queries the manifest/frame warrant beyond the dictated set — but their
             // EXECUTION and their band blocks are code's (register_propose_supplemental mints qid'd
@@ -2263,7 +2270,7 @@ export const STAGES = {
       // is the quiet one: the note says nine enumerated queries, the band holds eight, and nothing compares
       // them. Deriving removes the disagreement rather than detecting it.
       `FILE THIS AXIS'S AUDIT NOTE WITH \`record_unit_note\`. THE DISPATCH NAMES NO PATH FOR IT, deliberately — the driver writes this axis's note from what you send and you never open it, so there is no path here for you to hold. THE COUNTS ARE NOT YOURS TO TYPE: queries enumerated, incomplete blocks and records carried forward are taken from the band, so the note and the band cannot disagree. Send only what the band cannot say — \`null_result\` if this axis genuinely found nothing (refused against a band that carries records), and \`note\`, ONE short observation an auditor would want, in a lawyer's words. Still NO coverage-limited/confirmed-clean/deferred rows and NO clearance verdict: those are judgment's, Layer B. Call it AFTER the band exists — a note over a band that has not been written is refused by name, because an account of a sweep that has not happened is not a short note, it is a wrong one.`,
-      CROSS_CHECK_HANDOFF,
+      CROSS_CHECK_HANDOFF, "WHERE THE PLAN ABOVE HAS WAITING FAMILIES, RECORD EVERY ONE YOU DO NOT ASK with `record_withheld_families`: its qids, as listed above, and why it was not asked. A family you leave unasked was never searched, so it is recorded withheld-by-judgment; one nobody judged holds up delivery. The reason goes into the audit workbook, not the report.",   // withheld-families.mjs
       // THE CLOSING LINE SPLITS WITH THE LANE, because what the seat owes splits with it. Under the
       // supplemental-lane contract the seat writes NOTHING — the band is the tools' and the note is the
       // driver's — so the dispatch names no file and ends the way conversion 9's reviewer does. With the
@@ -2446,7 +2453,7 @@ export const STAGES = {
     // E1 — what this stage asks a model for, and what discharges each element. See THE STAGE-
     // CONTRACT DECLARATION above STAGES for the enum and the rules; contract-audit.mjs enforces them.
     contractElements: {
-      "coverage form `status` per row — EXACTLY one bare token of confirmed-clean / coverage-limited / deferred": {
+      "coverage form `status` per row — EXACTLY one bare token of confirmed-clean / coverage-limited / deferred / withheld-by-judgment": {
         class: "judgment", tokens: ["coverage_no_status", "coverage_clean_unexecuted", "coverage_clean_skipped", "coverage_clean_tainted"],
         why: "'Does this un-enumerated slice matter to whether I can sign' — the sufficiency call the funnel is forbidden to make (clearance-register SKILL.md, `## Coverage = the band blocks`). The obligations are driver-computed with every identifier; the status is a VALUE the seat sends through record_coverage (typed transport), validated per row at call time. #850 keeps it J.",
       },

package/driver/status-snapshot.mjs

@@ -80,7 +80,7 @@ const slimRun = (r) => ({
   markName: r.markName, ref: r.ref, classes: r.classes,
   state: r.state, stepN: r.stepN, stepTotal: r.stepTotal, stepLabel: r.stepLabel,
   lastStage: r.lastStage,   // spec 64 C — the RAW stage key ("register-unit:primary-sweep"): what the run is actually doing
-  verdict: r.verdict, statement: r.statement,   // spec 64 — THE one risk statement (absent on legacy runs)
+  tier: r.tier, statement: r.statement, caption: r.caption,   // the rating, never the reviewer's sign-off; spec 64 — THE one risk statement (absent on legacy runs); caption — the report's own conclusion
   url: r.url, failedStage: r.failedStage, reason: r.reason,
   resetsAt: r.resetsAt,   // rate-limit POSTPONE ONLY: when the cap window clears + the run auto-resumes (ISO)
   recoveryResumesAt: r.recoveryResumesAt ?? null,   // recovery park's backoff clock (A4 split — never conflated with a provider cap)
@@ -100,7 +100,7 @@ export function buildRecentActivity({ reports = [], limit = 12 } = {}) {
     // spec 64 — a delivered run's outcome is THE one risk statement when the run carries it (band +
     // stance in one sentence), never a bare disposition word beside a severity word on another page.
     out.push({ kind: "report", ok, when: r.deliveredAt || r.updatedAt || r.startedAt || "", label: r.markName || r.slug || r.runId,
-      outcome: ok ? (r.statement || r.verdict || "delivered") : `failed${r.failedStage ? " · " + r.failedStage : ""}`,
+      outcome: ok ? (r.caption || r.statement || r.tier || "delivered") : `failed${r.failedStage ? " · " + r.failedStage : ""}`,
       url: r.url || (ok && r.runId ? `${r.runId}/report.html` : "") });
   }
   // ONE explicit time key per row: a report's `when` can come from any of three stamps, and they all sort on