clearotron 0.4.0-beta.2 → 0.4.0-beta.3

package/THIRD-PARTY-NOTICES.md

@@ -110,7 +110,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## @modelcontextprotocol/sdk@1.30.0
+## @modelcontextprotocol/sdk@1.30.1
 
 - **Licence declared:** `MIT`
 - **Repository:** https://github.com/modelcontextprotocol/typescript-sdk
@@ -566,7 +566,7 @@ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## brace-expansion@1.1.18
+## brace-expansion@1.1.21
 
 - **Licence declared:** `MIT`
 - **Repository:** git://github.com/juliangruber/brace-expansion
@@ -596,7 +596,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## brace-expansion@2.1.4
+## brace-expansion@2.1.7
 
 - **Licence declared:** `MIT`
 - **Repository:** git://github.com/juliangruber/brace-expansion
@@ -1968,7 +1968,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## fast-uri@3.1.7
+## fast-uri@3.1.8
 
 - **Licence declared:** `BSD-3-Clause`
 - **Repository:** https://github.com/fastify/fast-uri
@@ -2626,7 +2626,7 @@ OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 PERFORMANCE OF THIS SOFTWARE.
 ```
 
-## ip-address@10.5.0
+## ip-address@10.7.2
 
 - **Licence declared:** `MIT`
 - **Repository:** https://github.com/beaugunderson/ip-address

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "9724d686ef597055a7d7f205632ca7b77bc4efef",
-  "version": "0.4.0-beta.2"
+  "commit": "c8159f8575f90587b1c78d5151d9acf9235977e1",
+  "version": "0.4.0-beta.3"
 }

package/driver/CHANGELOG.md

@@ -1,5 +1,14 @@
 # clearotron-driver
 
+## 0.4.0-beta.3
+
+### Patch Changes
+
+- Fixed: Reports no longer show a gap in coverage when a search was skipped because an identical one had already run.
+- Fixed: Opposition windows appear again on register records, and renewal dates are read from where the register now publishes them.
+- Before you upgrade: setup and `clearotron doctor` now ask for a newer Claude Code, because the older one quietly serves an earlier model generation.
+- Fixed: Expiry dates appear again on US trademark records, which had been left blank since the register moved where it publishes them.
+
 ## 0.4.0-beta.2
 
 ### Minor Changes

package/driver/coverage-form.mjs

@@ -1005,6 +1005,12 @@ export function renderCoverageLedgerJsonFromForm(rows, classTokens) {
       axis: String(r.axis ?? "").trim().toLowerCase(),
       scope, status: String(r.status).trim().toLowerCase(), reason,
       ...(classes.length ? { classes } : {}),
+      // THE COUNT AND THE PLAN KEY THE SOURCE ROW ALREADY HOLDS (ruling 551). The table two functions up
+      // prints `total_hits` as "N hits" and this render dropped it, so the two renders of one form
+      // disagreed about whether the run knew the size of what it left. A row without either — a seat-added
+      // row — emits neither, which says "this row has no count" rather than "the count was lost here".
+      ...(Number.isInteger(r.total_hits) ? { total_hits: r.total_hits } : {}),
+      ...(r.qid ? { qid: String(r.qid) } : {}),
     };
   }));
 }

package/driver/coverage-ledger.mjs

@@ -450,7 +450,19 @@ export function parseCoverageLedger(md) {
 // OPTIONAL structured column: the Nice classes a row is about, as an array of class-number strings — the
 // join key scope-facts.mjs uses to attribute a coverage gap to an instructed class without re-parsing
 // prose. Archived ledgers (no classes key) parse byte-identically to before.
-const ROW_KEYS = ["axis", "scope", "status", "reason", "classes"];
+// TWO MORE OPTIONAL COLUMNS, AND THEY CLOSE A DRIFT THE RENDERER'S OWN DOCTRINE FORBIDS. The form is the
+// source and the prose table and this JSON are both renders of it, "so they agree by construction and
+// neither can be the thing that drifts" — and they did not agree: a form row carries `total_hits` and the
+// table prints it as "N hits", while this JSON dropped it. Measured on R18 of 2026-09-27: 50 rows of four
+// fields, and not one of the 49 coverage-limited rows carried a count, so a reader could not tell a slice
+// holding 200 records from one holding 300,000. Ruling 551 puts the count on the row in as many words.
+//
+// `qid` rides for the same reason the form keeps it in its own column: it is what joins a coverage row to
+// the plan's question, and without it the count can only be re-attached by matching prose. A seat-added
+// row has no qid and no count, which is a fact about that row rather than a gap in this contract.
+//
+// Archived ledgers parse byte-identically: both are optional and absence is unchanged behaviour.
+const ROW_KEYS = ["axis", "scope", "status", "reason", "classes", "total_hits", "qid"];
 
 // Extract Nice-class tokens from a ledger row's free-text scope/reason cell ("[cl 5,32]", "Class 30 leg",
 // "nice classes 5/32"). DETERMINISTIC + conservative: only numbers 1–45 introduced by an explicit
@@ -494,7 +506,7 @@ export function parseCoverageLedgerJson(raw, { allowedAxes = REGISTER_AXES, acti
     if (!r || typeof r !== "object" || Array.isArray(r))
       throw new Error("coverage_ledger_unparseable: every row must be a plain object");
     for (const k of Object.keys(r)) {
-      if (!ROW_KEYS.includes(k)) throw new Error(`coverage_key_unknown:${short(k)} (keys are EXACTLY: axis, scope, status, reason — plus OPTIONAL classes)`);
+      if (!ROW_KEYS.includes(k)) throw new Error(`coverage_key_unknown:${short(k)} (keys are EXACTLY: axis, scope, status, reason — plus OPTIONAL classes, total_hits, qid)`);
     }
     // normalize-then-validate (B): coerce cosmetic formatting (markdown/qualifier/transposition) to the
     // canonical token, but keep the guard STRICT — an unknown axis still fails, with the ORIGINAL token in

package/driver/driver.config.mjs

@@ -2057,17 +2057,34 @@ export const ENGINE_BINARIES = {
     // newer", with no ceiling. Setup installs it into the engines folder (enginesFolder, below the table)
     // when the reader picks this engine, and the resolver uses it only when the machine has no copy of its
     // own. The package's own `bin` field names the program, so no path inside it is written down here.
-    // 2.1.280 is the floor because it is the oldest release that can run the current generation of this
-    // vendor's top tier: below it the API refuses the model id outright ("version 2.1.280 or newer is
-    // required"), and the tier alias quietly goes on serving the previous generation. Measured 2026-09-22
-    // on 2.1.263 — the alias returned the older model and the pinned id was refused — so a floor that
-    // only asks for a program that starts is a floor that passes a machine this engine cannot run on.
-    package: "@anthropic-ai/claude-code", floor: "2.1.280",
+    // THE FLOOR IS THE OLDEST RELEASE WHOSE TIER ALIASES REACH THE CURRENT MODEL GENERATION, and each
+    // tier crossed on its own release rather than together. Measured 2026-09-30 by driving each version's
+    // `-p` turn at a local recorder and reading the `model` it put on the wire:
+    //
+    //     version   --model opus        --model sonnet
+    //     2.1.277    claude-opus-5       claude-sonnet-5
+    //     2.1.278    claude-opus-5       claude-sonnet-5
+    //     2.1.280    claude-opus-5-5     claude-sonnet-5
+    //     2.1.281    claude-opus-5-5     claude-sonnet-5
+    //     2.1.282    claude-opus-5-5     claude-sonnet-5
+    //     2.1.283    claude-opus-5-5     claude-sonnet-5
+    //     2.1.284    claude-opus-5-5     claude-sonnet-5-5
+    //
+    // So the old floor of 2.1.280 was exactly right for the top tier and left the sonnet tier a
+    // generation behind for four releases, silently: the alias resolves inside the program, the request
+    // is well formed either way, and nothing refuses. The floor moves to the release where the SECOND
+    // tier crosses, because a stage that asks for sonnet is asking for the current sonnet.
+    //
+    // Below the floor the previous behaviour still holds: on 2.1.263 the alias returned the older model
+    // and a pinned id was refused outright ("version 2.1.280 or newer is required"), measured 2026-09-22.
+    // A floor that only asks for a program that starts is a floor that passes a machine this engine
+    // cannot run the current generation on.
+    package: "@anthropic-ai/claude-code", floor: "2.1.284",
     // WHAT THE INSTALL TAKES ON DISK, in MB, which setup states before it asks to install. MEASURED, not
     // declared by the vendor: the engines folder after a fresh install of this package into an empty
     // folder, on npm 10.9.8 and on 11.19.1, 2026-09-14. A later release can be larger or smaller, so setup
     // says "about". Re-measure when the floor moves.
-    installMB: 214,
+    installMB: 233,
     // The licence setup states wherever it tells a reader what they are about to install or use, as the
     // vendor's package declares it: "SEE LICENSE IN README.md", Anthropic's own terms.
     licence: "proprietary third-party software",

package/driver/engine/mcp/stdio-server.mjs

@@ -156,7 +156,18 @@ export function serve({ name, version = "0.1.0", tools = [] }) {
         // a seat can act on it in the turn it happens.
         const unmet = requiredFieldViolations(tool.inputSchema, params?.arguments);
         if (unmet.length) {
-          logToolEvent({ event: "settled", seq, server: name, tool: tool.name, ...(axis ? { axis } : {}), ok: false });
+          // THE REASON THE ROW HAD IN SCOPE AND THREW AWAY. A settled row with
+          // `ok: false` and nothing else asserts a failure and withholds everything that would let a
+          // reader weigh it — and a verdict turns on that, because a failed tool call counts against a
+          // run's cleanliness. Measured on the round of 2026-09-26: this gate settled a frame call in the
+          // SAME MILLISECOND it started, wrote no call file, and the record could not say why.
+          //
+          // THE FIELD NAMES, NEVER THE MESSAGE. `unmet` is a list of schema keys, so it carries no matter
+          // content; the sentence below carries none today either, but a tool's refusal text is free to
+          // interpolate a mark, and this row's own contract is the call and never its content. A row that
+          // copied the message would leak the day one of them does; a row that copies `unmet` cannot.
+          logToolEvent({ event: "settled", seq, server: name, tool: tool.name, ...(axis ? { axis } : {}), ok: false,
+            reason: `missing_required:${unmet.join(",")}` });
           return ok(id, { isError: true, content: [{ type: "text", text:
             `${tool.name}_missing_required:${unmet.join(",")} — the schema you were handed declares `
             + `${unmet.length === 1 ? "this field" : "these fields"} REQUIRED and the call did not carry `

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.4.0-beta.2",
+  "version": "0.4.0-beta.3",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline-knockout.mjs

@@ -47,7 +47,7 @@ import {
 import { RunCancelled, assertNotCancelledBeforePublish } from "./cancel.mjs";   // stop-by-user: never the failure lane below
 import { loadFrameworkManifest, parseFrameworkManifest, frameworkFor, DEFAULT_FRAMEWORK } from "./framework.mjs";
 import { attachFrameworkMethod, methodPathFor, FROZEN_METHOD_FILE } from "./framework-method.mjs";
-import { KO_STAGES, KO_STEPS, KO_STEP_REGISTER_COUNT, koSteps, koPaths, kebab, knockoutGridSpec, KNOCKOUT_WEB, KNOCKOUT_MINUTES_BAR, koChunks } from "./stages-knockout.mjs";
+import { KO_STAGES, KO_STEPS, KO_STEP_REGISTER_COUNT, koSteps, koPaths, kebab, knockoutGridSpec, KNOCKOUT_WEB, KNOCKOUT_MINUTES_BAR, knockoutBarVerdict, koChunks } from "./stages-knockout.mjs";
 import { kebabCollisions, reportIdentityFor, CAPABILITY_SKIPPED_CAUSE, CAPABILITY_SKIPPED_NOTE } from "./search-policy.mjs";
 import { countPreflight, countRegisterHits, countedMarks, resolveCountExecutor } from "./register-count.mjs";
 import { recordsPreflight, listRegisterRecords, listedMarks, resolveRecordExecutor } from "./register-records.mjs";
@@ -60,7 +60,7 @@ import { validators as koValidators, validateMergedFindings, worstBand, register
 import { reviewAbout, reviewEvidence, reviewEvidenceLines, applyKnockoutReview, knockoutReviewFile } from "./knockout-review-record.mjs";
 import { stripNextStepSections } from "./knockout-next-step.mjs";
 import { publishKnockout, composeKnockoutEmail } from "./publish/knockout.mjs";
-import { writeRunStatus, rollupStatus, atomicWrite, identitySeed } from "./progress.mjs";   // — the identity seed is shared; the stepper is not
+import { writeRunStatus, readRunStatus, rollupStatus, atomicWrite, identitySeed } from "./progress.mjs";   // — the identity seed is shared; the stepper is not
 import { batchMarkName } from "./mark-name.mjs";
 import { runLog, note, outputMeta } from "./log.mjs";
 import { defaultTerritoryState } from "./effective-scope.mjs";   // the stored-defaults reading — one producer, shared with the clearance lane
@@ -994,13 +994,16 @@ export async function knockoutInner(ctx, job, opts = {}) {
       const rows = readFileSync(K.sweepLedger, "utf8").split("\n").filter(Boolean).map((l) => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
       const cells = rows.reduce((n, r) => n + (Number.isFinite(r?.cells) ? r.cells : 0), 0);
       const places = rows.reduce((n, r) => Math.max(n, Array.isArray(r?.places) ? r.places.length : 0), 0);
-      const minutes = Number(((Date.now() - sweepStartedAt) / 60000).toFixed(1));
+      // THE SWEEP'S OWN ELAPSED TIME, UNDER A NAME THAT SAYS SO, and the bar is no longer asserted here.
+      // The bar is about the RUN (ruling 591) and this span is one stage of it: both knockouts of
+      // 2026-09-26 recorded `overBar: false` at 0.6 and 0.8 minutes while the runs took 14.4 minutes
+      // wall, which e2e scored as over. A bar recorded against the wrong quantity is worse than an
+      // unrecorded one, because the field's name says it answered the question. It is recorded at
+      // delivery instead, where the run's own start is readable.
+      const sweepMinutes = Number(((Date.now() - sweepStartedAt) / 60000).toFixed(1));
       runLog(run.runDir, { event: "knockout-sweep-total", marks: planMarks.length, calls: rows.length,
-        cells, mostPlacesForOneName: places, minutes, barMinutes: KNOCKOUT_MINUTES_BAR,
-        // Stated so a reader does not have to do the comparison, and so "over" is a fact about this run
-        // rather than a judgment about the build. It changes nothing this run did.
-        overBar: minutes > KNOCKOUT_MINUTES_BAR });
-      note(`knockout sweep: ${cells} cell(s) across ${rows.length} call(s) in ${minutes} min (the bar is ${KNOCKOUT_MINUTES_BAR})`);
+        cells, mostPlacesForOneName: places, sweepMinutes });
+      note(`knockout sweep: ${cells} cell(s) across ${rows.length} call(s) in ${sweepMinutes} min`);
     } catch { /* the receipts are the record; a summary that could not be read never fails a sweep */ }
     }
 
@@ -1216,6 +1219,24 @@ export async function knockoutInner(ctx, job, opts = {}) {
       writeFileSync(join(config.outboxDir, `${packet.runId}.pending`), `${agent}\n`);
     } catch (e) { note(`delivery: outbox marker write skipped (${String(e.message).slice(0, 100)})`); }
     const deliveredAt = new Date().toISOString();
+    // ── THE TEN-MINUTE BAR, AGAINST THE RUN (ruling 591) ────────────────────────────────────────────
+    //
+    // Recorded here because this is the first point at which the run's own span is known: `startedAt` is
+    // in the run's status and `deliveredAt` is the line above. It used to be recorded at the web sweep,
+    // against the sweep's own elapsed time, so both knockouts of 2026-09-26 stated `overBar: false` at
+    // 0.6 and 0.8 minutes while their runs took 14.4 minutes wall — the number beside the bar was not the
+    // number the bar is about.
+    //
+    // RECORDED, NEVER APPLIED, exactly as before: nothing reads `overBar` and nothing about this run
+    // changes on it.
+    //
+    // AND AN UNREADABLE START SAYS SO RATHER THAN VANISHING. `readRunStatus` answers `{}` when it cannot
+    // read, and a bar quietly omitted because a file was unreadable is an absence that reads as "not
+    // over". So the event always carries the field, and names the reason when it has no span.
+    try {
+      const verdict = knockoutBarVerdict({ startedAt: readRunStatus(run.runDir)?.startedAt, deliveredAt });
+      runLog(run.runDir, { event: "knockout-run-total", barMinutes: KNOCKOUT_MINUTES_BAR, ...verdict });
+    } catch { /* the bar is a record, never a gate: a summary that could not be written never fails a delivery */ }
     // `tier` beside `verdict` — the same band word under the name the clearance lane records it by, so a
     // reader of either lane's status finds the rating in one place. `verdict` stays as it was.
     writeRunStatus(ctx, { state: "delivered", tier: overall, statement: published.statement, url: published.url, reports: published.reports.map((r) => ({ mark: r.mark, url: r.url })), deliveredAt, sendPending: true, stepIndex: STEPS.length - 1, stepLabel: STEPS[STEPS.length - 1], stepN: STEPS.length, stepTotal: STEPS.length });

package/driver/pipeline.mjs

@@ -47,6 +47,7 @@ import { readRegisterTaint, readActiveTaintAxes } from "./register-taint.mjs";
 import { parseNamedBand, mergeNamedBands, findCollapsedBands, quarantineUnknownStates, taintQuarantineCleanBlocks, bandRecords } from "./named-band.mjs";
 import { recordOriginsFor } from "./record-origins.mjs";
 import { REGISTER_PROVIDER } from "./driver.config.mjs";
+import { noteRegisterServed, registersServedFrom, providerUsageCaveat } from "./register-served.mjs";   // which register actually served this run, from the resolver the dispatch itself uses
 import { FACTS_FILE as DIGEST_FACTS_FILE, ACCOUNTING_STAMP as DIGEST_ACCOUNTING_STAMP, recordedFindingUris,
   digestAccountingGap, digestBatchBrief, batchesOf } from "./register-digest-record.mjs";   // conversion 11 — the render's facts sidecar and the accounting era stamp
 import { buildBandShape, dominantElementComposites, deriveRegisterPositions, floorTierByMark, floorMarkKey } from "./band-shape.mjs";   // PR-8 — the deterministic reading layer; P2-A — candidates + positions
@@ -94,7 +95,7 @@ import { deriveScopeFacts } from "./scope-facts.mjs";
 import { documentGrowth } from "./gate-metrics.mjs";
 import { editRepairTail, abbrev } from "./repair-contract.mjs";
 import { repairFollowup } from "./repair-composers.mjs";
-import { seedRunStatus, recordTransition, writeRunStatus, rollupStatus, atomicWrite, finalStepFields, terminalRunState, signoffPatch, readSignoff } from "./progress.mjs";
+import { seedRunStatus, recordTransition, writeRunStatus, readRunStatus, rollupStatus, atomicWrite, finalStepFields, terminalRunState, signoffPatch, readSignoff } from "./progress.mjs";
 import { batchMarkName } from "./mark-name.mjs";
 import { writeOutboxPacket } from "./outbox.mjs";
 import { publishReport, composeEmailHtml, deliverySubject } from "./publish/index.mjs";
@@ -208,8 +209,21 @@ const CL_SUPP_TAGS = ["closure"];
 // body) under the un-namespaced sessionKey we pass, so the row prefix-matches this run and the assembled
 // record set picks it up on re-assembly. Credential = the provider's own env var (already in the driver's
 // systemd EnvironmentFile); absence is a named mechanical cause. One provider is active per run.
+/**
+ * Note the adapter's own id against this run, and hand the adapter straight back.
+ *
+ * RECORDED WHERE IT IS RESOLVED, so the run's record says what SERVED it rather than what was configured
+ * at launch. Noting is idempotent per run and writes only when the set changes, so a run fetching a
+ * thousand records pays one write. A null run directory notes nothing: a call outside a run has no record
+ * to carry the field, and inventing one is the guess this field exists to replace.
+ */
+function noteAdapter(ctx, adapter) {
+  noteRegisterServed(ctx?.run?.runDir ?? ctx?.paths?.runDir ?? null, adapter?.id);
+  return adapter;
+}
+
 async function defaultRecordFetcher(uri, ctx) {
-  return activeProvider().recordFetch(uri, ctx);
+  return noteAdapter(ctx, activeProvider()).recordFetch(uri, ctx);
 }
 
 /**
@@ -2399,7 +2413,7 @@ async function verifyAndRecordHouseElement(ctx, opts = {}) {
     const caps = registerCapabilities();
     const { regions } = resolvePlanRegions(registerJurisdictions(ctx.job, ctx.profile), caps);
     const rec = resolveRecordExecutor({
-      lister: opts?.recordLister ?? null, adapter: activeProvider(),
+      lister: opts?.recordLister ?? null, adapter: noteAdapter(ctx, activeProvider()),
       agentId: ctx.agentId ?? null, sessionKey: `clearance-${ctx.run.slug}-${ctx.run.codename}`,
       recordLog: runRecordLogPath(P.runDir),
       fixtureDir: ctx.job?.registerFixtures?.records ?? null,
@@ -9173,7 +9187,7 @@ async function pipelineInner(job, opts = {}) {
     // which is the same bug in the other direction.
     const planExec = opts.planExecutor
       ?? (envGateOn("CLEAROTRON_PLAN_DISPATCH") && activeProvider().executePlan
-        ? (args, c) => activeProvider().executePlan(args, c) : null);
+        ? (args, c) => noteAdapter(c ?? ctx, activeProvider()).executePlan(args, c) : null);
     // Kill switch CLEAROTRON_SATPROBE_CODESIDE=0 (the inline `!== "0"` pattern): legacy mock harnesses
     // opt out — their scenarios pre-date the code-side member and script the AGENT path (and an armed
     // real executor lane would dial the provider from a test). Production default is ON.
@@ -10841,6 +10855,13 @@ async function pipelineInner(job, opts = {}) {
           let regArm = null;
           const regSwept = new Set();
           const regDeferReason = new Map();
+          // — WHAT THE FOLD REFUSED, AND WHICH KIND OF REFUSAL IT WAS. Read by the remedy accounting
+          // below, which otherwise requires every minted qid to land and so records a term as
+          // dispatch-failed when the fold refused its slice as a duplicate of a question the plan had
+          // already asked and answered. A fold-refused qid can never land, by construction — the
+          // re-attempt above deliberately filters it out — so only the accounting was still waiting
+          // for it. qid -> { kind, twin }.
+          const regFoldRefusals = new Map();
           // Partial mints must not read as full sweeps: when SOME of a directive's remedy proposals mint
           // and a sibling is refused by the shape lint, the directive can still verify-closed on the
           // minted subset — the refusal is disclosed per directive (receipt `partials` row on a close,
@@ -10974,9 +10995,25 @@ async function pipelineInner(job, opts = {}) {
               // belief about two screens agreeing, and the day they stop agreeing this is the only place
               // that would say so.
               if (refused.length) {
+                for (const r of refused) if (r?.qid) regFoldRefusals.set(r.qid, { kind: r.kind ?? null, twin: r.twin ?? null });
+                // THE REASON THE FOLD GAVE IS LOGGED, not just the qid it refused. The fold is the only
+                // place that knows WHY, and for a duplicate it knows WHICH plan row already holds the
+                // answer. Logging the qid alone threw that away: recovering it on one run meant
+                // re-deriving the twin from a shared identity hash by hand, and a receipt that cannot
+                // say why a slice is missing reads as an engine fault whatever the cause was.
                 runLog(run.runDir, { event: "frame-reopen-fold-refused", refused: refused.length,
-                  qids: refused.map((r) => r.qid).slice(0, 6) });
-                note(`frame-reopen: ${refused.length} minted entr${refused.length === 1 ? "y" : "ies"} REFUSED at the fold — the mint screen and the fold screen disagree, which is a wiring finding`);
+                  qids: refused.map((r) => r.qid).slice(0, 6),
+                  kinds: refused.reduce((a, r) => { const k = r.kind ?? "unstated"; a[k] = (a[k] ?? 0) + 1; return a; }, {}),
+                  rows: refused.slice(0, 6).map((r) => ({ qid: r.qid, kind: r.kind ?? null, twin: r.twin ?? null, issue: r.issue ?? null })) });
+                // ONE NOTE PER KIND, because they are three different findings and only one of them is a
+                // wiring fault. A duplicate-question refusal is the fold working: the question is already
+                // in the plan and its existing row carries the coverage. An identity collision or a
+                // malformed term IS the mint screen and the fold screen disagreeing, because the mint
+                // runs entryTermIssues and should have caught it.
+                const dupes = refused.filter((r) => r.kind === "duplicate-question");
+                const faults = refused.filter((r) => r.kind !== "duplicate-question");
+                if (dupes.length) note(`frame-reopen: ${dupes.length} minted entr${dupes.length === 1 ? "y" : "ies"} refused at the fold as already-asked — the plan row${dupes.length === 1 ? "" : "s"} ${dupes.map((r) => `"${r.twin ?? "(twin unstated)"}"`).join(", ")} carr${dupes.length === 1 ? "ies" : "y"} that coverage; the term is answered, not unsearched`);
+                if (faults.length) note(`frame-reopen: ${faults.length} minted entr${faults.length === 1 ? "y" : "ies"} REFUSED at the fold (${[...new Set(faults.map((r) => r.kind ?? "unstated"))].join(", ")}) — the mint screen and the fold screen disagree, which is a wiring finding`);
               }
               // Dispatch → derive band → VERIFY per directive (qid-landed + non-collapse + class-scope).
               // A byte-changed band with only a wrong-scope/empty/error block closes NOTHING.
@@ -11306,6 +11343,7 @@ async function pipelineInner(job, opts = {}) {
               terms: termRows,
               blocksByQid: regLastJoin?.blocksByQid ?? new Map(),
               executedQids: regLastJoin?.executedQids ?? new Set(),
+              foldRefusals: regFoldRefusals,
               outOfScope,
             });
           } catch (e) {
@@ -15136,8 +15174,20 @@ async function pipelineInner(job, opts = {}) {
     try {
       const provider = activeProvider().id;
       const usage = tallyRegisterCalls(DEFAULT_LEDGER_PATH, `clearance-${run.slug}-${run.codename}-`);
-      runLog(run.runDir, { event: "provider-usage", provider, ...usage });
-      writeRunStatus(ctx, { providerUsage: { [provider]: usage } });
+      // ── A WHOLE-RUN TALLY FILED UNDER ONE REGISTER SAYS SO WHEN THE RUN SERVED MORE THAN ONE ──────
+      //
+      // This label is resolved HERE, at publish, while the tally it labels spans the whole run. On a run
+      // whose register changed part-way that key is whichever register happened to be active at publish,
+      // and every call is filed under it — the confident-and-wrong shape the served field exists to end.
+      //
+      // The key's SHAPE is untouched because a ledger reads this map. What is added is the caveat, in the
+      // same record, so the two register fields in one status cannot silently disagree: the served list
+      // says two, and this says the tally covers both and could only be filed under one. Splitting the
+      // tally by register is a second question and is not answered here.
+      const served = registersServedFrom(readRunStatus(run.runDir));
+      const spans = providerUsageCaveat(served);
+      runLog(run.runDir, { event: "provider-usage", provider, ...(served.length > 1 ? { spans: served } : {}), ...usage });
+      writeRunStatus(ctx, { providerUsage: { [provider]: usage }, ...spans });
       providerTally = { [provider]: usage };
       // AD-4: the line prints the complete by_tool census, not a hand-picked subset — the R2 run printed
       // "search=0" while 286 execute_plan calls carried the whole register workload, and the subset read

package/driver/progress.mjs

@@ -153,7 +153,12 @@ export function atomicWrite(file, text) {
 
 function statusPath(runDir) { return join(runDir, "status.json"); }
 
-function readRunStatus(runDir) {
+/**
+ * The run's own status as last written. `{}` when it cannot be read, which callers must treat as an
+ * absence rather than as an empty run — exported so a lane can read the run's own `startedAt` without
+ * a second copy of where status.json lives.
+ */
+export function readRunStatus(runDir) {
   try { return JSON.parse(readFileSync(statusPath(runDir), "utf8")); }
   catch { return {}; }
 }

package/driver/publish/knockout.mjs

@@ -475,16 +475,26 @@ export async function publishKnockout({ runId, codename, runDir, findings, plan,
   // Depth 2's sidecar, read from the RUN DIR rather than taken on trust from the caller: the
   // publisher renders what the driver measured and wrote, and a republish of an archived run picks up
   // the same file. An absent sidecar publishes exactly today's knockout.
+  // AN UNREADABLE SIDECAR IS NOT AN ABSENT ONE, and until now both arrived here as null. The
+  // instructed-scope load eight lines down has told the two apart since it was written; these two had
+  // the same catch and neither flag. A run whose counts file is present but corrupt therefore published
+  // the sentence for a run that never took any counts.
+  //
+  // `registerCountsUnreadable` HAS NO CONSUMER YET, deliberately. The page's line for an absent counts
+  // file says none could be taken, and there is no shipped sentence for a file that could not be read —
+  // writing one is a decision about what a client is told, not a defect fix. The distinction is recorded
+  // here so the decision has something to key on when it is made.
+  let registerCountsUnreadable = false;
   if (!registerCounts) {
     try { registerCounts = JSON.parse(readFileSync(driverDir(runDir, 'register-counts.json'), 'utf8')); }
-    catch { registerCounts = null; }
+    catch { registerCounts = null; registerCountsUnreadable = existsSync(driverDir(runDir, 'register-counts.json')); }
   }
   // part 5 — the filings sidecar, read the same way and for the same reason: the publisher renders
   // what the driver measured and wrote, and a republish of an archived run picks up the same file. An
   // absent sidecar publishes exactly the counts-only knockout, with no filings section anywhere.
-  let registerRecords = null;
+  let registerRecords = null, registerRecordsUnreadable = false;
   try { registerRecords = JSON.parse(readFileSync(driverDir(runDir, 'register-records.json'), 'utf8')); }
-  catch { registerRecords = null; }
+  catch { registerRecords = null; registerRecordsUnreadable = existsSync(driverDir(runDir, 'register-records.json')); }
   // The owner lookups this run made, read the same tolerant way as the records above:
   // an archived run that predates the lane has no file, and its cards then render exactly as they were
   // delivered. The source line the report prints comes from HERE, not from anything the seat typed.
@@ -699,6 +709,9 @@ export async function publishKnockout({ runId, codename, runDir, findings, plan,
     const markBand = single ? overall : worstBand(framework, [m]);
     writeRO(file, renderKnockoutHtml(one, framework, {
       runId, overall: markBand, issued, auditFile, probeRan, registerCounts, registerRecords, ownerChecks, instructedScope, identity, matter: runId,
+      // Carried as its own value rather than folded into `registerRecords`, because three sites PRINT
+      // `registerRecords.unavailable` and a marker invented here would become client-facing wording.
+      registerRecordsUnreadable,
       // — an invented mark says so on its own report. Resolved ONCE above the loop:
       // the answer is a property of the run, and asking per mark would let a multi-mark demo mark some
       // documents and not others if the roster moved mid-publish.

package/driver/publish/render-knockout.mjs

@@ -1377,16 +1377,16 @@ function firstRef(marks, framework) {
   return '';
 }
 
-// — THE REGISTER SENTENCE IS THE RENDERER'S, and it is the whole reason this function exists.
+// — THE REGISTER SENTENCE IS THE RENDERER'S, and it is the whole reason the two clauses below exist.
 //
 // A live run printed "the register overlay has not been run" in model prose directly under a table of
 // register counts the same run had taken. The model was not lying: it cannot see the count lane, it is
 // deliberately never shown the figures (register-count.mjs rule 1), and it filled the gap with the only
 // thing it had. The fix is not a better prompt — it is that nobody who cannot see the machinery gets to
-// describe it. The validator forbids the model from saying anything about register coverage; this
-// function says it, from the artifacts.
+// describe it. The validator forbids the model from saying anything about register coverage; these
+// clauses say it, from the artifacts.
 //
-// It reads the SIDECARS, never the prose: the counts entry for this mark, and whether the product bought
+// They read the SIDECARS, never the prose: the counts entry for this mark, and whether the product bought
 // the probe at all. Four states, four sentences, and none of them is a judgment.
 //
 // — AND IT NOW STATES THE POSITION, NOT ONLY THE COVERAGE. Coverage alone ("hit-counts were taken
@@ -1394,10 +1394,12 @@ function firstRef(marks, framework) {
 // STANDS on the register for this name. That sentence is appended by registerPositionClause below and
 // it is present in every state, including the state where the answer is "nothing does" — an absence is
 // a finding and must be said out loud, never left as a silence over a table of numbers.
-function registerLine(mark, registerCounts, probeRan, registerRecords = null, cards = []) {
-  return [coverageClause(mark, registerCounts, probeRan),
-    registerPositionClause(mark, registerCounts, registerRecords, cards)].filter(Boolean).join(' ');
-}
+//
+// THE FUNCTION THAT COMPOSED THE PAIR IS GONE, and removing it was the point rather than tidiness. It
+// was called from nowhere in the tree, and its call to `registerPositionClause` was the one that did NOT
+// pass the unreadable-sidecar flag — so anybody reviving it would have revived exactly the defect that
+// flag closes, silently, with nothing at the call site to say so. The live composition is inline in
+// `renderKnockoutHtml`, which passes it. Found independently twice before being removed once.
 
 /**
  * Where the name STANDS on the register that was searched. Six states, and they are six because
@@ -1421,12 +1423,22 @@ function registerLine(mark, registerCounts, probeRan, registerRecords = null, ca
 // unconditionally, which was true while the clause was drawn under the cards. It is drawn under the
 // COUNTS now — the numbers it qualifies — and the cards are below it, so a fixed word would send a
 // reader the wrong way up the page. The caller knows the order; this function does not guess it.
-function registerPositionClause(mark, registerCounts, registerRecords, cards = [], where = 'above') {
+// The one sentence for a listing whose answer this run cannot state, whether the lister refused or the
+// sidecar itself would not parse. Held once so the two callers below cannot drift: they are the same fact
+// to a reader, and two copies of a sentence are two sentences waiting to differ.
+const FILINGS_NOT_LISTED = 'The filings behind the counts could not be listed on this run, so nothing here says whether one stands.';
+
+function registerPositionClause(mark, registerCounts, registerRecords, cards = [], where = 'above', recordsUnreadable = false) {
   if (!registerRecords) {
+    // AN UNREADABLE SIDECAR IS NOT AN ABSENT ONE. Absent means the listing was never taken, and the page
+    // says so. Unreadable means it WAS taken and this run cannot say what it found. The second sentence
+    // was already written, for the lister's own refusal, and was simply unreachable from a republish:
+    // a file that would not parse arrived as null, and null reads here as absent.
+    if (recordsUnreadable) return FILINGS_NOT_LISTED;
     return registerCounts ? 'The filings behind those counts were not listed on this run.' : '';
   }
   if (registerRecords.unavailable) {
-    return 'The filings behind the counts could not be listed on this run, so nothing here says whether one stands.';
+    return FILINGS_NOT_LISTED;
   }
   const entry = recordsForMark(registerRecords, mark?.name);
   const provider = registerRecords.providerLabel ?? registerRecords.provider ?? 'the register';
@@ -1775,6 +1787,11 @@ const CAVEAT_LEAD = 'This screen also carries the following limits:';
 export function renderKnockoutHtml(findings, framework, {
   runId, overall, issued = null, auditFile = null, probeRan = false, registerCounts = null,
   registerRecords = null,
+  // — was the filings sidecar PRESENT but unreadable? Defaults to false, so every existing caller — the
+  // unit fixtures and both render-check scripts, none of which pass one — renders exactly as it did. It
+  // is its own value rather than a marker on `registerRecords`, because three sites PRINT
+  // `registerRecords.unavailable` and anything invented for it would become client-facing wording.
+  registerRecordsUnreadable = false,
   // The driver's own record of the owner lookups it ran. Defaults to [] so an
   // archived run that predates the lane renders exactly as it was delivered.
   ownerChecks = [],
@@ -1853,7 +1870,7 @@ export function renderKnockoutHtml(findings, framework, {
   // promoted, and the clause would name refs no card carries.
   const cardsByMark = new Map(marks.map((m) => [m?.name, registerCardViews(m, framework, registerRecords).cards]));
   const positions = marks.map((m) => {
-    const clause = registerPositionClause(m, registerCounts, registerRecords, cardsByMark.get(m?.name) ?? [], 'below');
+    const clause = registerPositionClause(m, registerCounts, registerRecords, cardsByMark.get(m?.name) ?? [], 'below', registerRecordsUnreadable);
     if (!clause) return '';
     return marks.length > 1 && m?.name ? `${m.name}: ${clause}` : clause;
   }).filter(Boolean).join(' ');
@@ -2220,6 +2237,16 @@ export function knockoutReportData(findings, framework, { runId, codename, overa
             line: recordsLine(listed),
             fetched: listed.fetched ?? (listed.records ?? []).length,
             capped: Boolean(listed.capped),
+            // THE CAP THE RUN RECORDED, beside the flag that says it bit. `capped: true` on its own cannot
+            // tell a listing truncated at fifty from one a cap of zero stopped before it began: the first
+            // is a register outcome and the second is a configuration, and a consumer reading the flag
+            // alone reports them the same way. The run has always written `cap` per mark; nothing read it.
+            //
+            // NULL IS NOT ZERO and the two are kept apart all the way out, the way the portal's allowance
+            // contract keeps them. Null is a sidecar that recorded no cap at all, which is every run
+            // archived before the field existed; zero is a cap that was set to zero. Folding them together
+            // would put an archived run and a misconfigured one on the same line.
+            cap: Number.isFinite(listed.cap) ? listed.cap : null,
             records: (listed.records ?? []).map((r) => ({
               mark: r.mark, owner: r.owner, status: r.status, classes: r.classes ?? [],
               territory: r.territory, matchedForm: r.matchedForm, matchedBasis: r.matchedBasis,

package/driver/record-carry.mjs

@@ -567,6 +567,21 @@ export function traceRecordCarry({ bandRecords = [], placements = [], registerFi
   // and the one that run shipped without stating, so it is counted separately and never folded
   // into an ordinary drop total.
   const upstreamAbsent = rows.filter((r) => /:stage-incomplete$/.test(String(r.reason ?? "")));
+  // Records the step PASSED OVER: it ran, it reached them, and it recorded no ground of its own, so the
+  // driver's own literal stands as the reason. A reason, so not `unreasoned` — the same distinction
+  // `upstreamAbsent` above is drawn on, and counted separately for the same reason.
+  //
+  // WHY IT HAS TO BE IN `totals` AND NOT ONLY IN `by_reason_source`. This module's own header says a
+  // reader who opens the file and sees `unreasoned: 0` must be able to tell that from "nothing was
+  // dropped anywhere in this run". On R18 of 2026-09-27 the totals block read `unreasoned: 0` beside
+  // 5,760 records the step passed over — the count was in `by_reason_source` and not in the block a
+  // reader opens first, so the loudest fact about that run was one level down from the answer.
+  //
+  // `unreasoned` IS NOT REDEFINED, deliberately. A shipped Machine QC check passes only on
+  // `unreasoned === 0` and that row reaches a client's workbook; folding these in would turn a green
+  // into a red on every run with a silent exit, which is a decision about what a client is told rather
+  // than a correction to a record.
+  const stepSilent = rows.filter((r) => r.reason_source === "step-silent");
   const incompleteStages = Object.values(outcomes ?? {}).filter((o) => o && o.completed !== true).map((o) => o.stage);
   const slices = untraceableSlices({ crowds, planExecution });
   const deliveredFindings = Array.isArray(findings) ? findings.length : 0;
@@ -601,6 +616,7 @@ export function traceRecordCarry({ bandRecords = [], placements = [], registerFi
       finding: byReach.finding ?? 0,
       dropped: rows.length - (byReach.finding ?? 0),
       unreasoned: unreasoned.length,
+      step_silent: stepSilent.length,
       upstream_absent: upstreamAbsent.length,
       untraceable_slices: slices.length,
       // — THE SUM STATES ITS OWN INCOMPLETENESS. `n + s.untraced` coerced a null to 0, so a

package/driver/reference-strip-signatures.mjs

@@ -66,8 +66,18 @@ export const RULE_DEFINITIONS = [
 ];
 
 /** Files worth scanning: prose-bearing, tracked, not generated, and not this rule's own definition. */
+// `.js` IS IN THE LIST BECAUSE IT WAS THE HOLE. The extensions here were the ones the driver is written
+// in, and the register adapters are not: 26 tracked `.js` files, every one carrying the same kind of
+// header prose as the rest of the tree, scanned by nothing. The strip ran over them like everywhere
+// else, and one of its casualties sat in an adapter header for as long as this check has existed,
+// under a table reading zero. A floor that cannot see a whole file extension reports a repaired tree.
+//
+// It costs one row, and the row is NOT residue: an adapter header names a list separator as
+// `(, ; / etc)`, which is a parenthesis opening on a comma and is also correct English about
+// punctuation. `notes` in the backlog table records why that row is there, so the next reader meets an
+// explanation rather than a number that will not fall.
 export const isScannable = (f) =>
-  /\.(mjs|md|yml|ts)$/.test(f) && !f.startsWith("portal-ui/dist/") && !RULE_DEFINITIONS.includes(f);
+  /\.(mjs|js|md|yml|ts)$/.test(f) && !f.startsWith("portal-ui/dist/") && !RULE_DEFINITIONS.includes(f);
 
 /**
  * Count both signatures per file across `files`.