clearotron 0.4.0 → 0.4.1-beta.0

package/driver/frame-diff-model.mjs

@@ -70,7 +70,7 @@ export function parseFrameDiff(raw) {
     if (d.remedy != null) out.remedy = parseRemedy(d.remedy);
     // ── THE ASK CONTRACT AT ASK-RAISE (charter P2e) ───────────────────────────────────────────────
     // A firing directive is a REQUEST TO SEARCH SOMETHING. Until now the parser accepted one whose
-    // item was a display label ("TAKIS (famous cpg snack, …)") with no remedy, and the refusal came
+    // item was a display label ("WAVA (famous cpg snack, …)") with no remedy, and the refusal came
     // hours later at reopen — by which time the session that could have restated it had exited. Four
     // of the five directives on the 2026-07-29 run died exactly there: loud (coverage rows, the clamp,
     // the audit trail) but terminal, with the head noun of a perfect one-query term sitting in the
@@ -143,7 +143,7 @@ export function undispatchableThrow(offenders) {
  * Every FIRING directive in a frame-diff document that cannot be dispatched — read LENIENTLY, from
  * raw text or an already-parsed object. This is the enumeration the gateway hint and the pipeline's
  * exhausted-ladder disclosure both run against the artifact ON DISK, because the fail string they
- * would otherwise scrape is cut at 160 characters (verify.mjs:381) and cannot carry more than the
+ * would otherwise scrape is cut at 160 characters (verify.mjs:381 commonLawMeaningSeat) and cannot carry more than the
  * first offender. Lenient on purpose: the artifact reaching these two callers has ALREADY failed
  * validation, so it may also carry an unknown key or a bad gap flag — refusing to enumerate then
  * would lose exactly the disclosures this exists to keep. Returns [{item, layer, severity, why}].
@@ -190,7 +190,7 @@ export function firingDirectivesLenient(rawOrDoc) {
  *
  * SCOPE IS DELIBERATELY THE VARIANT LAYER (plus any layer's own remedy):
  *   * VARIANT — the evidenced class. The directive says "search this near-form", so its item stands
- *     where a mark term stands, and a label there ("TAKIS (famous cpg snack, …)") is the whole defect:
+ *     where a mark term stands, and a label there ("WAVA (famous cpg snack, …)") is the whole defect:
  *     it dispatches as a nil search that reads CLEAN, or it dies unasked at reopen.
  *   * FIELD — untouched. A class-gap directive whose item names no parseable class already has a
  *     principled ending: deriveDirectiveRemedy returns null and the directive is DISCLOSED rather

package/driver/framework.mjs

@@ -139,6 +139,28 @@ export function aboveLowestBand(manifest, label) {
   return i !== -1 && i < manifest.bands.length - 1;
 }
 
+/** The tones of the rungs whose findings are "material": medium risk or higher. A rung's tone is its own
+ *  statement of its risk, so the line holds on any client's ladder. A line drawn by POSITION ("above the
+ *  lowest band") did not: the bottom rung is "low" on a four-rung ladder and "minimal" on a five-rung one,
+ *  so one client's low-risk rung was checked and another's was not (owner's ruling, 2026-10-09). */
+export const MATERIAL_TONES = Object.freeze(["severe", "high", "medium"]);
+
+/** True when the label is a band whose tone is medium risk or higher — the "material finding" predicate. */
+export function materialBand(manifest, label) {
+  return MATERIAL_TONES.includes(bandTone(manifest, label));
+}
+
+/** The material bands' labels, highest first: what a dispatch names when it says which findings a check covers. */
+export const materialBandLabels = (manifest) => (manifest?.bands ?? [])
+  .filter((b) => MATERIAL_TONES.includes(b?.tone)).map((b) => b.label);
+
+/** The material bands as a reader's list — "Very High, High or Moderate" — or null when the ladder names none. */
+export function materialBandPhrase(manifest) {
+  const xs = materialBandLabels(manifest);
+  if (!xs.length) return null;
+  return xs.length === 1 ? xs[0] : `${xs.slice(0, -1).join(", ")} or ${xs[xs.length - 1]}`;
+}
+
 /** The most severe band label among the given labels (unknown labels ignored); null when none are bands. */
 export function worstBand(manifest, labels) {
   let best = -1;

package/driver/gateway.mjs

@@ -246,7 +246,8 @@ import { REGISTER_ENUMERATE_TOOL, SUPPLEMENTAL_LANE_STEERING } from "./stages.mj
 // same thing to the exit-1 rescue below as it does to the register taint chain that reads the very
 // same rows off disk. Acyclic: register-taint.mjs imports node builtins only.
 import { isTaintRow } from "./register-taint.mjs";
-import { recordDispatch } from "./dispatch-record.mjs";
+import { recordDispatch, streamFilePath } from "./dispatch-record.mjs";
+import { anyResultErrored, endingFields } from "./engine/session-record.mjs";   // a session that reached an error result is not an ok attempt, whatever its last result said
 import { recordBestDraft } from "./best-draft.mjs";
 //: the allowlisted progress-quantity extractor. Acyclic — repairs.mjs imports node builtins only
 // (fs/crypto/path). Used only when the validator did not stamp its own count; never a digit hunt.
@@ -309,6 +310,37 @@ export function isTimeout({ killed, code, wall, stderr = "", timeoutSec }) {
 // on a parsed 0-usage object. A slow-but-working model that times out returns a status_timeout envelope WITH
 // usage (admitted) → NOT a wedge. Kept pure + exported so the classifier is unit-tested (it must not misfire on
 // admitted turns, and it MUST fire on the null-usage hard-kill that the production incident actually produced).
+/**
+ * Did this attempt spend its whole derived budget, exit cleanly, and still fail? PURE.
+ *
+ * THE CASE THIS NAMES, measured on one round: an attempt ran 958.6 seconds against a derived limit of 900,
+ * exited 0, wrote nothing, and was recorded as `missing_file` naming its own output. It was working the whole
+ * time — 35,341 output tokens, 119 tool calls, 947.7 seconds of active time. The hard kill is the limit plus
+ * 60, so it finished 1.4 seconds under it.
+ *
+ * WHY THE CLASSIFICATION ABOVE IS RIGHT AND THE RECORD WAS STILL WRONG. `isTimeout`'s third signal needs a
+ * non-zero exit as well as a wall past the budget, and the program exited 0 — so it is not a timeout, and
+ * nothing here argues it should be. The defect is that the row then read `missing_file`, which names an
+ * artifact and sends the next reader to look for a path bug or a race. The two numbers that say otherwise
+ * were both on the row — the wall beside the derived limit — and nobody was pointed at them.
+ *
+ * SO THIS RECORDS A FACT AND MOVES NO POLICY. It does not feed `isTimeout`, it does not change which retry
+ * the attempt earns, and the fail class is untouched. Whether a clean exit at the budget should also earn the
+ * longer retry a timeout earns is a question for the owner, and the issue that asked for this says so
+ * explicitly: it may be right that a clean exit is not a timeout. This is the record it would be decided on.
+ *
+ * Three-valued, like the model fields on the same row: null when the budget is unknown, so "nobody derived a
+ * limit for this stage" stays visibly different from "it did not spend it".
+ */
+export function spentBudgetCleanly({ fail, killed, code, wall, derivedLimitSec }) {
+  if (!fail) return false;                              // a passing attempt is not this shape
+  if (!Number.isFinite(derivedLimitSec) || derivedLimitSec <= 0) return null;
+  if (!Number.isFinite(wall)) return null;
+  if (killed) return false;                             // a kill is the timeout path, not this one
+  if (code !== 0) return false;                         // a dirty exit at the budget IS a timeout already
+  return wall >= derivedLimitSec;
+}
+
 export function isLaneWedge(fail, usage) {
   if (fail !== "timeout") return false;
   const moved = (usage?.input || 0) + (usage?.output || 0) + (usage?.cacheRead || 0) + (usage?.cacheWrite || 0);
@@ -389,9 +421,35 @@ export function toolGauge(turn) {
     // engine cannot report", the same distinction toolWaitByTool draws one line up. RECORDING ONLY:
     // toolWaitMs and the per-tool split are exactly what they were, because the kill clock reads them.
     toolWaitUnmeasurable: Array.isArray(turn?.toolWaitUnmeasurable) ? [...turn.toolWaitUnmeasurable] : null, ...toolCallCounts(turn),
+    // The calls by tool name, beside the total, so a tool server's own log can be set against what the
+    // model asked for. An OBJECT is a measurement (`{}`: none); null is "this engine cannot report".
+    toolCallsByName: turn?.toolCallsByName && typeof turn.toolCallsByName === "object" && !Array.isArray(turn.toolCallsByName)
+      ? { ...turn.toolCallsByName } : null,
   };
 }
 
+/**
+ * Whether the attempt is OK: the driver's verdict (`fail`) AND no result event of the session carried
+ * `is_error`. A session the vendor refused and a restart recovered ends in a successful LAST result, so
+ * the retry ladder (which reads that last result, unchanged) accepts it; the record says what happened.
+ * Readers that ask "did the stage fail" read `fail`, which this does not touch. PURE.
+ */
+export function attemptOk(fail, turn) {
+  return !fail && !anyResultErrored(turn?.session);
+}
+
+/**
+ * The stream record as a row carries it: the file relative to the run, as the dispatch record names its
+ * file, and the size — or why it was not kept. null when the engine kept none or ran no session. PURE.
+ */
+export function streamMeta(runDir, stream) {
+  if (!stream || typeof stream !== "object" || !stream.file) return null;
+  const dir = String(runDir ?? "");
+  const file = dir && String(stream.file).startsWith(dir) ? String(stream.file).slice(dir.length).replace(/^[\\/]+/, "") : String(stream.file);
+  return { file, present: stream.present === true, bytes: Number.isFinite(stream.bytes) ? stream.bytes : null,
+    ...(stream.reason ? { reason: stream.reason } : {}) };
+}
+
 export function tokensPerSec(usage, wall) {
   const w = Number(wall);
   if (!usage || !Number.isFinite(w) || w <= 0) return null;
@@ -1073,7 +1131,10 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     // run-integrity.mjs for why it is not a manifest file and why the append-only journals are excluded.
     const integrityBefore = frozenSnapshot(runDir);
     const turn = await engine.runTurn({ agent, sessionKey: key, message: effMessage, grantDispatch: base, model, thinking, timeoutSec: effTimeout, resumeRef: warm ? lastSessionRef : undefined, codexHome: stageCodexHome, mcpConfig: gatherMcpConfig, allowedTools: gatherAllowedTools, seatWrites: gatherSeatWrites, skillsDir: engineSkillsDir, skillsGrantRoots: engineSkillsGrantRoots, profilesDir: profilesStoreDir, resolveSkill: engineResolveSkill, runDir, stallSec,
-      progressFiles: files });   // the no-progress watchdog's artifact-advance signal (anthropic-agent; other adapters ignore it)
+      progressFiles: files,   // the no-progress watchdog's artifact-advance signal (anthropic-agent; other adapters ignore it)
+      // The raw stream of this session, beside its dispatch record (engine/session-record.mjs). The engines
+      // keep it while the disk has room and say on the tuple's `stream` what landed.
+      streamFile: streamFilePath(runDir, name, attempt) });
     const settledAt = Date.now();   //: zero point of the wall-rescue quiescence clock, read before anything else
     // LOG-ONLY. Nothing here can fail a turn: the claim that the frozen set does not change across a seat
     // turn is READ from the writers' call sites and not yet MEASURED on a running system, and arming an
@@ -1294,7 +1355,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
       const rt = await engine.runTurn({ agent, sessionKey: key, message: repairMessage, model, thinking,
         timeoutSec: effTimeout, resumeRef: repairRef, codexHome: stageCodexHome, mcpConfig: gatherMcpConfig, allowedTools: gatherAllowedTools,
         skillsDir: engineSkillsDir, skillsGrantRoots: engineSkillsGrantRoots, profilesDir: profilesStoreDir, resolveSkill: engineResolveSkill, runDir, stallSec,
-        progressFiles: files });
+        progressFiles: files, streamFile: streamFilePath(runDir, name, attempt, formRepairsUsed + 1) });
       repairRef = rt.sessionRef ?? repairRef;
       // A KILLED REPAIR TURN'S BYTES ARE NOT STAGE TRUTH. Same doctrine as the exit-1 rescue below: a
       // stage validator is a SHAPE check, not a completeness proof, and a torn draft can pass its own
@@ -1338,8 +1399,9 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           repair: formRepairsUsed, repairOf: MAX_FORM_REPAIRS, repairOutcome: outcome, fail: triggeredBy,
           repairTarget: rel(target),   // the file the repair was AIMED at (often a sibling, not the expectFile)
           dispatch: repairDispatch,    // — the verbatim message this repair turn was given
-          stopReason: rt.json?.stopReason ?? undefined,
+          stopReason: rt.json?.stopReason ?? undefined, ...endingFields(rt.json),   // — and what ended it, in the program's words on an error
           killed: rt.killed || undefined, signals: rt.signals ?? undefined,
+          session: rt.session ?? null, stream: streamMeta(runDir, rt.stream),   // — the repair session's own record, as on the attempt row
           warm: true,   // a repair turn always RESUMES the session that wrote the defect
           runId: rt.json?.runId, engineSummary: rt.json?.summary, usage: rt.usage,
           selfReportContradicted: (outcome !== "repaired" && rt.json?.status === "ok") || undefined,   //
@@ -1707,7 +1769,13 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         // attempt produce what the stage exists to produce". Sixty report-card attempts on round 892dd88e
         // journalled status:"ok", summary:"success", code:0, wrote:true and output.present:true beside a
         // populated `fail`, and a watcher keyed on the headline saw sixty successes.
-        ok: !fail,
+        // — AND NOT WHEN THE SESSION REACHED AN ERROR RESULT, whatever its last result said: a refusal a
+        // restart recovered is a session that was refused (engine/session-record.mjs). `fail` is unchanged,
+        // so the ladder and every reader asking "did the stage fail" read exactly what they read before.
+        ok: attemptOk(fail, turn),
+        // What the session went through — every result, classifier cut, refusal and restart, with when —
+        // and where its raw stream is, or why it was not kept. null where the engine cannot report.
+        session: turn.session ?? null, stream: streamMeta(runDir, turn.stream),
         // The engine's claim about itself, KEPT and renamed to say whose claim it is. A self-report is
         // evidence — deleting it would destroy the only record of what the seat believed it had done — and
         // it is not a verdict. Still three-valued (ok | timeout | error). Nothing in the driver reads either
@@ -1743,7 +1811,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         laneWaitMs,   // WS-C turn-cap queue time — the live overlap validation reads this
         // A6: the provider's stop reason, verbatim — the max_tokens fault line is countable from the
         // rows alone (fail carries the named fault; this field carries the raw discriminator).
-        stopReason: json?.stopReason ?? undefined,
+        stopReason: json?.stopReason ?? undefined, ...endingFields(json),   // — and beside it what ended the session: its kind, the vendor's status, and on an error the program's own words (session-record.mjs)
         // taint durability (copper-lattice): the kill discriminators survive to disk — register-taint.mjs
         // reads these rows across process restarts (--resume), where the in-memory turn object is gone.
         // `followup` matters too: a followup success PATCHES the prior session's output, it never
@@ -1785,6 +1853,11 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         // measure" stays visibly different from "this turn called no tools" — see toolGauge.
         ...toolGauge(turn), band: bandSize ?? undefined,
         inputBytes: derivedLimit?.inputBytes ?? undefined, derivedLimitSec: derivedLimit?.sec ?? undefined,
+        // …and whether this attempt spent that limit and exited cleanly anyway. Written UNCONDITIONALLY and
+        // three-valued, beside the two numbers it is about, so a failure that had used its whole budget is
+        // not left looking like an artifact problem. It names a fact; it moves no retry policy. See
+        // `spentBudgetCleanly`.
+        budgetSpentCleanly: spentBudgetCleanly({ fail, killed, code, wall, derivedLimitSec: derivedLimit?.sec }),
         // AD-4 emitted-vs-landed, UNCONDITIONAL (was success-only, which made a failed attempt's mid-write
         // artifact invisible): `output` = what LANDED on disk after this attempt (null when the stage has no
         // expected file); `wrote` = whether THIS attempt emitted it (see the computation above the runDir
@@ -1815,7 +1888,9 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
       // from "retries not recorded here"). Best-effort like every telemetry write.
       try {
         runLog(runDir, {
-          event: "attempt", stage: name, attempt, of: maxRetries + 1, ok: !fail, fail: fail ?? null,
+          event: "attempt", stage: name, attempt, of: maxRetries + 1, ok: attemptOk(fail, turn), fail: fail ?? null,
+          // The spine carries the one-word answer and the pointer; the per-stage row carries the record.
+          interrupted: turn.session?.interrupted ?? null, stream: streamMeta(runDir, turn.stream)?.file ?? null,
           //: the spine carries the same pair as the per-stage log, or the two disagree about what
           // ran. `model` stays the requested resolution (its existing readers); `modelActual` is the wire.
           model: modelRequested, modelActual, modelBasis, modelSnapshot, modelMismatch, providerReported,
@@ -1850,6 +1925,9 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           // — the spine carries them too, or a round has to join two files to ask why a stage was slow.
           ...toolGauge(turn), band: bandSize ?? undefined,
         inputBytes: derivedLimit?.inputBytes ?? undefined, derivedLimitSec: derivedLimit?.sec ?? undefined,
+        // …and the same fact on this row, because one of the two carrying it records half the runs and
+        // reads as done. Three-valued and beside the numbers it is about. See `spentBudgetCleanly`.
+        budgetSpentCleanly: spentBudgetCleanly({ fail, killed, code, wall, derivedLimitSec: derivedLimit?.sec }),
           formRepairs: formRepairsThisAttempt || undefined,   //, see the stage row above
         });
       } catch { /* telemetry best-effort — never fail a turn over a journal line */ }
@@ -3037,7 +3115,7 @@ export function correctionHint(lastFail, { gridLedgerName = "common-law-grid.jso
     // run the driver stamped as form-required, and the stamp is conditional. On an unstamped run
     // validators.registerFindings demands the table exactly as it did before and emits this label,
     // so dropping the arm left the one lane that can still fire it with a generic hint.
-    hint = "the file has a findings heading plus a Coverage ledger with a status row (confirmed-clean / coverage-limited / deferred)" + (/common-law-findings/.test(lastFail) ? ", or each ledger row's status is recorded by calling `record_coverage_status` with `grid_spec_path`, the same spec path the grid tool was given" : "");
+    hint = "the file has a findings heading plus a Coverage ledger with a status row (confirmed-clean / coverage-limited / deferred)";   // the common-law clause went with that lane's status gate (ruling 2026-10-01)
   } else if (/negative-results|coverage-ledger|audit-trail|findings-heading/.test(lastFail)) {
     hint = "the findings file carries ALL required sections: a findings heading, the Negative results matrix " +
       "(every variant × platform row), the Coverage ledger with a status row, and the Audit trail call log";
@@ -3114,7 +3192,7 @@ export function isFormClassFail(fail) {
   return FORM_CLASS_RE.test(fail ?? "");
 }
 // How many in-dispatch repairs one stage run may buy. TWO, and the number has a cause: parseFrameDiff
-// is FAIL-FAST — it throws on the first bad severity (frame-diff-model.mjs:66) before it ever collects
+// is FAIL-FAST — it throws on the first bad severity (frame-diff-model.mjs:66 parseFrameDiff) before it ever collects
 // the undispatchable directives (:100) — so ONE artifact carrying both defects surfaces them
 // SEQUENTIALLY. That is exactly what the 08-02 frame-diff ladder did (severity on a1, undispatchable
 // on a2), and a cap of 1 would have handed the second one straight back to the ladder. The codebase
@@ -3201,7 +3279,7 @@ const MAX_FORM_REPAIRS = 2;
 // issue. The coverage-judgment family was COLD-ONLY — WARM_ELIGIBLE_RE carried seven coverage STRUCTURE
 // tokens and not one `coverage_clean_*` — so every retry re-dispatched a fresh session that re-read a
 // 1.9 MB band and re-derived a 160 KB document instead of editing it. The stage's own measured profile
-// (repair-contract.mjs:10-18) is 105,747 out FAIL → 137,519 out FAIL → 36,362 out PASS, and the attempt
+// (repair-contract.mjs, 'WHY THIS EXISTS') is 105,747 out FAIL → 137,519 out FAIL → 36,362 out PASS, and the attempt
 // that passed is the one that PATCHED. A cold ladder never patches.
 // WHY THEY ARE SAFE TO WARM, on the same argument made one gate over: findCoverageFormViolations
 // emits both tokens only over rows the DRIVER wrote from the frozen plan and the plan-execution
@@ -3605,11 +3683,15 @@ export function warmPatchMessage(lastFail, expectFile, { supplementalLane = fals
  * calls the program refused (Claude's own denials; Codex's tool-server calls refused before reaching their
  * server). `commandToolCalls`: calls to a tool that runs a command, which no Claude stage is offered, so
  * zero is the expected reading; Codex keeps its shell and reports null. `mcpToolCalls`: the tool-server
- * calls Codex completed, its only count of calls made, since its `toolCalls` stays null. Null, as in
+ * calls Codex completed, its only count of calls made, since its `toolCalls` stays null.
+ * `toolCallsErroredByName`: the tool-server calls that came back as an error, by tool name, so a stage that
+ * had a call refused and made it again says so where its row otherwise reads ok on one attempt. Null, as in
  * `toolGauge`, is "this engine does not report", never zero. RECORDING ONLY. It sits at the end of this
  * file so that adding it moved no line another file cites.
  */
 function toolCallCounts(turn) {
   const n = (v) => (Number.isFinite(v) && v >= 0 ? v : null);
-  return { toolCallsRefused: n(turn?.toolCallsRefused), commandToolCalls: n(turn?.commandToolCalls), mcpToolCalls: n(turn?.mcpToolCalls) };
+  const errored = turn?.toolCallsErroredByName;
+  return { toolCallsRefused: n(turn?.toolCallsRefused), commandToolCalls: n(turn?.commandToolCalls), mcpToolCalls: n(turn?.mcpToolCalls),
+    toolCallsErroredByName: errored && typeof errored === "object" && !Array.isArray(errored) ? { ...errored } : null };
 }

package/driver/named-band.mjs

@@ -129,6 +129,8 @@ export function parseNamedBand(raw) {
         // truncate the covered_by pointers with the reason's 400-char cap. Old bands carry neither key.
         ...(b.class_counts && typeof b.class_counts === "object" && !Array.isArray(b.class_counts) ? { class_counts: b.class_counts } : {}),
         ...(Array.isArray(b.covered_by) && b.covered_by.length ? { covered_by: b.covered_by } : {}),
+        // what the total counts, when the register said — carried like the counts it qualifies
+        ...(typeof b.total_counts === "string" ? { total_counts: b.total_counts } : {}),
         // — THE REFUSAL STAMP SURVIVES THE PROJECTION. `execute-plan.mjs` writes an errored slice
         // as `{state:"incomplete", total_hits:0, fetched:0, error:true}` and says why in its own header:
         // "the error:true stamp (a provider error is never confusable with a sanctioned crowd)". The

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.4.0",
+  "version": "0.4.1-beta.0",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/phase0.mjs

@@ -76,15 +76,26 @@ const boundName = (s) => String(s).slice(0, PLAN_MAX_NAME_LENGTH);
 // Refless jobs (ref/tmp absent — allowed since the intake relaxation) get `noref<6-hex>-<mark>`: the hash is
 // of job.id, the sanitized email message-id and the queue's dedup key, so the slug stays unique across
 // same-name marks AND stable across webhook re-delivery + resume. Refed jobs are byte-identical to before.
+//
+// THE SLUG IS THE FIRST PART OF THE RUN ID, AND THE RUN ID IS A URL PATH SEGMENT IN ASCII. Every route that
+// serves a run, and every link a delivery carries, spells the run id as `[A-Za-z0-9._-]`
+// (publish/index.mjs RUN_SEGMENT_RE, the portal's own gate), and refuses anything else: a link the portal
+// would refuse is not built at all. `kebab` keeps every Unicode letter, so a mark written in Greek,
+// Cyrillic, Han or with a letter such as Ł gave a run id no route accepts, and its run was delivered with
+// no report link on any surface. So the mark's part of the slug keeps only what the routes accept. A name
+// whose kebab is already ASCII is untouched, byte for byte, which is every run id minted before this; a
+// name with nothing ASCII left reads `mark`, the knockout slug's own word for that case. The reference
+// prefix and the codename keep the run id unique, as they always have: the mark only makes it readable.
+const asciiMark = (slug) => slug.replace(/[^a-z0-9-]+/g, "").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "") || "mark";
 export function deriveSlug(job) {
   const raw = boundName(String(job.ref ?? job.tmp ?? "").toLowerCase().replace(/[^a-z0-9]/g, ""));
   const mark = kebab(boundName(job.markName ?? job.name ?? job.marks?.[0]?.name ?? "mark"));
   if (!raw) {
     const h = createHash("sha256").update(String(job.id ?? mark)).digest("hex").slice(0, 6);
-    return `noref${h}-${mark}`;
+    return `noref${h}-${asciiMark(mark)}`;
   }
   const tmp = raw.startsWith("tmp") ? raw : `tmp${raw}`;
-  return `${tmp}-${mark}`;
+  return `${tmp}-${asciiMark(mark)}`;
 }
 
 // Calendar date in Europe/Zurich (the firm's timezone), YYYY-MM-DD.

package/driver/pipeline-knockout.mjs

@@ -1209,7 +1209,7 @@ export async function knockoutInner(ctx, job, opts = {}) {
       // ONE LINE, N LINKS. This said "Report: <one url>" and on a batch that url is now null, which would
       // have read "Report: null" — the fail-visible shape doing its job, and still not a line to send. A
       // batch names every report it produced, in the order the names were ordered.
-      whatsappText: `✅ Knockout screen${refTag} of ${nMarks} mark(s) is done — worst band ${overall}. `
+      whatsappText: `✅ Knockout screen${refTag} of ${nMarks} mark(s) is done — ${nMarks === 1 ? "rating" : "highest rating"} ${overall}. `
         + (published.reports.length === 1
           ? `Report: ${published.reports[0].url}`
           : `Reports: ${published.reports.map((r) => `${r.mark} ${r.url}`).join(" · ")}`),

package/driver/pipeline.mjs

@@ -5,7 +5,7 @@
 // verdict, and never parks (there is no LLM continuation decision anywhere). CLI: `node pipeline.mjs --job <file.json>`.
 
 import "../shared/env-local.mjs";   // side effect: apply <repo>/.env when THIS file is the CLI entry (never on library import)
-import "./engine/mcp/http-dispatcher.mjs";   // side effect: raise undici headersTimeout (code-side fetches)
+import "./engine/mcp/http-dispatcher.mjs"; import { recordStatusesFromFindings } from "./common-law-coverage-status.mjs";   // side effect: raise undici headersTimeout (code-side fetches); the second records a common-law ledger's statuses in code
 import { readFileSync, existsSync, mkdirSync, writeFileSync, renameSync, copyFileSync, readdirSync, rmSync, statSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { join, dirname, basename, resolve } from "node:path";   // resolve: the resume line must work from any cwd
@@ -148,6 +148,7 @@ import { beginAnswerMemory, endAnswerMemory } from "../providers/_shared/answer-
 import { findScreenGateViolations, findScreenGateParseGaps, screenGateZeroCause } from "./screen-gate.mjs";
 import { emptyQueue, coerceQueue, mintItem, pendingItems, markFlushed, receiptKeyFor,
   buildFlushFollowup, runPostFlushGateRepair } from "./digest-queue.mjs";   // (t1cd) — the digest-trigger funnel
+import { foldFindingsFile, foldAfterSave, openPass, modelRecordPath, snapshotFold, restoreFold } from "./record-fold.mjs";   // the folded record from the delivery seam on
 import { writeStamp, stageStaleness, restamp, restampStage, staleOnPath, reconcileStamps, shaOf } from "./stage-freshness.mjs";
 import { parseManifestVariants, variantsParseFailure, findCoverageLimitedCells, partitionClosableCells, findSimilarListingSignals,
   GRID_HALVES, GRID_SEATS, MEANING_SEAT, splitGridSpec, halfOfTerm, balanceClosureCells, mergeGrids, mergeCommonLawFindings, openChannelRows,
@@ -2280,7 +2281,7 @@ export function deriveFormNeighbourhood(ctx) {   // @internal — exported for i
   } catch { /* scope ledger optional — markets are informational; no ledger ⇒ nothing dropped (fail-open) */ }
   // NOT scoped here: the transliteration SCRIPT set. `markets` is passed through but never narrows
   // SUPPORTED_SCRIPTS, so latin-diacritic/german/nordic/cyrillic/greek run on every matter regardless of the
-  // jurisdictions judgment applied. That is what generated the five PARADISE diacritics — but the fold-dedupe
+  // jurisdictions judgment applied. That is what generated the five Drivers Haven diacritics — but the fold-dedupe
   // in formNeighbourhood removes them at the source, and the surviving cross-script forms (ß→ss, Cyrillic and
   // Greek homoglyphs) are genuinely distinct strings that cost one term each. Deferred deliberately: narrowing
   // scripts by market is a coverage decision, and the harm it was meant to fix is already gone.
@@ -3933,7 +3934,7 @@ export function findFloorBreaches(ledger, floorAxes) {   // @internal
  * `[]`: no manifest, unreadable, unparseable. That is the honest default here and not an absence read as
  * a pass, because the whole mechanism is opt-in — a run with no designation owes no floor, and a run whose
  * manifest cannot be read has no designation to honour. The refusal for an absent or unparseable manifest
- * belongs to the stage that writes it and already exists there — verify.mjs:1335 runs the same parser
+ * belongs to the stage that writes it and already exists there — verify.mjs:1335 CALL_REASON_SET runs the same parser
  * through `checkSiblingJson` and fails clearance-variants with `variantmodel_missing`. Checked, because
  * "something else refuses it" is exactly the assumption that turns a swallowed error into a silent pass.
  */
@@ -5922,6 +5923,14 @@ function snapshotFindingsForCorrections(P, runDir) {
   try { raw = readFileSync(P.findings, "utf8"); } catch { /* legacy / not-yet-populated */ }
   if (raw == null) return null;
   const sha = createHash("sha256").update(raw).digest("hex");
+  // THE RECORD IN THE MODEL'S NUMBERING, beside the one on disk. The review's flags name findings in the
+  // model's numbering, so the corrective body compares the record the model wrote; once the delivered
+  // record is folded the two differ (record-fold.mjs). The fold is held too, for a rollback to put back.
+  const modelAt = modelRecordPath(runDir, P.findings);
+  let modelRaw = raw;
+  if (modelAt !== P.findings) { try { modelRaw = readFileSync(modelAt, "utf8"); } catch { modelRaw = raw; } }
+  const model = { raw: modelRaw, sha: modelRaw === raw ? sha : createHash("sha256").update(modelRaw).digest("hex") };
+  const fold = snapshotFold(runDir);
   try {
     const tmp = driverDir(runDir, "findings-pre-corrective.json.tmp");
     // PR-4 (snapshot-before-overwrite): store the FULL pre-corrective text, not just its sha — a
@@ -5931,7 +5940,7 @@ function snapshotFindingsForCorrections(P, runDir) {
     writeFileSync(tmp, JSON.stringify({ ts: new Date().toISOString(), sha, text: raw }, null, 2));
     renameSync(tmp, driverDir(runDir, "findings-pre-corrective.json"));
   } catch { /* advisory sidecar */ }
-  return { raw, sha };
+  return { raw, sha, model, fold };
 }
 /**
  *, T3b — THE CORRECTIVE PASS FAILED VALIDATION. RESTORE THE LAST GOOD STATE.
@@ -5979,6 +5988,7 @@ export function rollbackCorrectivePass(P, runDir, pre, fail) {   // @internal
     // Atomic, like every other write to this file: a half-restored findings.json is a worse state than
     // either of the two this is choosing between.
     atomicWrite(P.findings, pre.raw);
+    if (pre.fold) restoreFold(runDir, pre.fold);   // the record the model wrote and the map, as they stood
   }
   const record = { ts: new Date().toISOString(), reason: String(fail?.fail ?? "failed").slice(0, 200),
     restored: changed, preSha: pre.sha, failedSha: nowSha };
@@ -6023,9 +6033,11 @@ export function rollbackCorrectivePass(P, runDir, pre, fail) {   // @internal
  */
 export function repairUnnamedRemovals(P, runDir, pre, namedOrdinals, namedMarks, namedLines = []) {   // @internal
   if (!pre?.raw) return null;                                   // nothing held — nothing to compare against
+  // In the model's numbering: the flags name its ordinals, and a folded record renumbers, so a finding
+  // removed from the folded record would shift every ordinal after it (record-fold.mjs).
   let preDoc = null, postDoc = null, postRaw = null;
-  try { preDoc = JSON.parse(pre.raw); } catch { return null; }
-  try { postRaw = readFileSync(P.findings, "utf8"); postDoc = JSON.parse(postRaw); } catch { return null; }
+  try { preDoc = JSON.parse(pre.model?.raw ?? pre.raw); } catch { return null; }
+  try { postRaw = readFileSync(modelRecordPath(runDir, P.findings), "utf8"); postDoc = JSON.parse(postRaw); } catch { return null; }
   if (!preDoc || !postDoc || typeof postDoc !== "object") return null;
 
   const norm = (s) => String(s ?? "").toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
@@ -6095,6 +6107,7 @@ export function repairUnnamedRemovals(P, runDir, pre, namedOrdinals, namedMarks,
     leftRemoved: leftRemoved.map(brief),
   };
   atomicWrite(P.findings, JSON.stringify(merged, null, 2) + "\n");
+  foldAfterSave(runDir, P.findings);   // after the seam the repaired record is folded again, as a save's is
   try { atomicWrite(driverDir(runDir, "corrective-repair.json"), JSON.stringify(record, null, 2) + "\n"); }
   catch { /* sidecar is best-effort; the runLog event is the record that decides */ }
   return record;
@@ -6218,10 +6231,11 @@ async function enforceCorrectionsReachFindings(ctx, P, pre, resume) {
   const named = correctionNamedSet(P);
   const readState = () => {
     let raw = null, corrections = null;
-    try { raw = readFileSync(P.findings, "utf8"); } catch { return { stale: false }; }
+    // the record the model wrote: a change the fold hides is still a change it made (record-fold.mjs)
+    try { raw = readFileSync(modelRecordPath(run.runDir, P.findings), "utf8"); } catch { return { stale: false }; }
     try { corrections = parseFindingsJsonLenient(raw).corrections; } catch { /* shape defects ride the normal ladder */ }
     const sha = createHash("sha256").update(raw).digest("hex");
-    return { stale: named.length > 0 && sha === pre.sha && !(corrections && corrections.applied), sha };
+    return { stale: named.length > 0 && sha === (pre.model?.sha ?? pre.sha) && !(corrections && corrections.applied), sha };
   };
   if (!readState().stale) return;
   note(`[corrections] findings.json unchanged after the corrective pass (review names: ${named.join(", ")}) — demanding the re-emit`);
@@ -7477,26 +7491,15 @@ function enrichFindingDeadlines(P, runDir, note, { nowMs = Date.now(), withinDay
   }
 }
 
+// THE SEAM'S FOLD. From here on every accepted save folds the record again on acceptance, so the record
+// the reviewer, the cards and the delivery read stays folded (record-fold.mjs, design 2026-10-03). doc 50 —
+// on a v4 record the merge base is the WORST BAND by the frozen manifest's order. No duplicates leave the
+// file byte-identical; a folded shape that does not validate keeps the record as written.
 function consolidateFindingsFile(P, note, manifest = null) {
-  try {
-    if (!existsSync(P.findings)) return;
-    const doc = JSON.parse(readFileSync(P.findings, "utf8"));
-    if (!doc || !Array.isArray(doc.findings) || doc.findings.length < 2) return;
-    // doc 50 — on a v4 record the merge base is the WORST BAND by the frozen manifest's order
-    const { findings, merges, ordinalMap } = consolidateFindings(doc.findings, (doc.schema_version ?? 1) >= 4 ? manifest : null);
-    if (!merges.length) return;                                  // no duplicates → leave the file byte-identical
-    const next = { ...doc, findings };
-    // spec 64 — actions follow the renumber: a merged-away ordinal remaps to its kept finding's new
-    // ordinal (the action still applies to the consolidated conflict — dropping the reference would
-    // silently un-condition a live demand).
-    if (Array.isArray(doc.actions)) next.actions = remapActionOrdinals(doc.actions, ordinalMap);
-    parseFindingsJson(JSON.stringify(next));                     // re-validate the consolidated shape (throws → catch keeps original)
-    atomicWrite(P.findings, `${JSON.stringify(next, null, 2)}\n`);   // B5 — a crash mid-write must never leave a truncated findings.json
-    for (const m of merges)
-      note(`[consolidate] ${m.owner} — ${m.mark}: folded ${m.dropped.length} duplicate filing(s) (ord ${m.dropped.join(", ")}) into one card`);
-  } catch (e) {
-    note(`[consolidate] skipped: ${String(e?.message || e).replace(/\s+/g, " ").slice(0, 100)}`);
-  }
+  const { merges, error } = foldFindingsFile(P.runDir, P.findings, manifest, { seam: true });
+  for (const m of merges)
+    note(`[consolidate] ${m.owner} — ${m.mark}: folded ${m.dropped.length} duplicate filing(s) (ord ${m.dropped.join(", ")}) into one card`);
+  if (error) note(`[consolidate] skipped: ${error.slice(0, 100)}`);
 }
 // minor (a): a finding earns a FULL prose card when composite ≥ 3 (on-field) OR level ∈ {A,B} (high legal
 // exposure even at a low practical composite — a mis-rated-low mark must not be reduced to a structured-only row).
@@ -8793,6 +8796,9 @@ async function pipelineInner(job, opts = {}) {
   // BEFORE doc 50 backfills its framework sidecar from the frozen frameworkPath (deploy-boundary case) so
   // the v4 gates always have vocabulary; a run that already has one reads it verbatim (never re-derived).
   attachFramework(ctx);
+  // A pass opens before the delivery seam: until this pass's seam folds the record, a save writes the
+  // model's record as it is (record-fold.mjs).
+  openPass(ctx.paths.runDir);
 
   // ── (t1cd): the digest-trigger FUNNEL ──────────────────────────────────────────────────────
   // The digest-trigger funnel (; flag deleted post-E2E 2026-07-22): the queue
@@ -9217,7 +9223,7 @@ async function pipelineInner(job, opts = {}) {
           : stage(g.name, { ...ctx, axis: g.axis })),
       stage("blind-frame", ctx).catch((e) => ({ ok: false, fail: String(e?.message ?? e) })),
     ]);
-    if (!blindRes.ok) {
+    if (!clSplit && clMember()?.ok) recordStatusesFromFindings(P.commonLaw); if (!blindRes.ok) {
       note(`blind-frame failed (non-fatal — no frame-diff/reopen this run): ${blindRes.fail}`);
       runLog(run.runDir, { event: "blind-frame-skipped", reason: blindRes.fail });
     }
@@ -9345,7 +9351,7 @@ async function pipelineInner(job, opts = {}) {
     // synthesis, replay) reads exactly the artifacts a single-member run would have written. Re-run after
     // every routed half followup (closure / frame-reopen) — the half files stay the source of truth and
     // the canonical pair is always derived, which also makes the merge resume-idempotent.
-    const mergeCommonLawArtifacts = !clSplit ? null : ({ discloseUnfinished = false } = {}) => {
+    const mergeCommonLawArtifacts = !clSplit ? null : ({ discloseUnfinished = false } = {}) => { for (const h of GRID_HALVES) recordStatusesFromFindings(P.commonLawHalf(h), { half: h });   // each half's ledger statuses, recorded by code where the seat made no call (ruling 2026-10-01)
       // Each half's coverage truth = its plugin-written main ledger FOLDED with any plugin-written
       // supplementary sibling(s) the closure lane produced. Returns the batches as an ARRAY (mergeGrids'
       // batchesOf flattens it, cells union across all of them); a missing/corrupt main leaves its cells to
@@ -9424,7 +9430,7 @@ async function pipelineInner(job, opts = {}) {
       //
       // The prior channel is the TRUSTED one and already carries everything needed. Half forms are
       // driver-written, `seatFields(p, row)` carries their rulings by the same `pOk` path, and
-      // gateway.mjs:603 already unions this exact shape — prior-only, `{ rows: null }` submitted — on
+      // gateway.mjs:630 selectEngine already unions this exact shape — prior-only, `{ rows: null }` submitted — on
       // every attempt. So this is that mode, not a new one.
       //
       // ONE METRIC MOVES, deliberately: with no submission, `carried` counts every ruled row, because
@@ -12644,9 +12650,9 @@ async function pipelineInner(job, opts = {}) {
       // always did, which is today's behaviour exactly.
       try {
         const rows = parseCorrections(readFileSync(P.seniorEyeReview, "utf8"));
-        const preDoc = preCorrective ? parseFindingsJsonLenient(preCorrective.raw) : null;
+        const preDoc = preCorrective ? parseFindingsJsonLenient(preCorrective.model?.raw ?? preCorrective.raw) : null;   // the flags name the model's ordinals, so both sides are the record the model wrote (record-fold.mjs)
         let postDoc = null;
-        try { postDoc = parseFindingsJsonLenient(readFileSync(P.findings, "utf8")); } catch { /* shape defects ride the normal ladder */ }
+        try { postDoc = parseFindingsJsonLenient(readFileSync(modelRecordPath(run.runDir, P.findings), "utf8")); } catch { /* shape defects ride the normal ladder */ }
         correctionsApplied = buildCorrectionsApplied(rows, preDoc, postDoc);
         // — A CLAIM MAY NOT OUTLIVE ITS EVIDENCE, AND A DEMOTED STAMP MAY NOT COME BACK.
         //
@@ -14390,6 +14396,13 @@ async function pipelineInner(job, opts = {}) {
             lintActions = soft.actions ?? null; lintAskAnswers = soft.askAnswers ?? null; lintFourAnswers = soft.fourAnswers ?? null;
           } } catch { /* validators.findings owns the unparseable case */ }
         }
+        // The narrative's finding headings are in the model's numbering: once the record is folded, its
+        // write-ups join the record the model wrote (record-fold.mjs).
+        let lintNarrativeFindings = null;
+        const lintModelAt = modelRecordPath(run.runDir, P.findings);
+        if (lintModelAt !== P.findings) {
+          try { lintNarrativeFindings = parseFindingsJsonLenient(readFileSync(lintModelAt, "utf8")).findings; } catch { lintNarrativeFindings = null; }
+        }
         // wp50/wi2 — the sidecar tier joins the lint so overall-level prose can't contradict it.
         let lintVerdict = null;
         try { lintVerdict = JSON.parse(readFileSync(driverDir(run.runDir, "verdict.json"), "utf8")); } catch { /* legacy */ }
@@ -14413,7 +14426,7 @@ async function pipelineInner(job, opts = {}) {
           // is presence-gated and simply emits nothing here; they stay alive for replay-archive.mjs,
           // which passes the archived summary.
           reportMd, narrativeMd, auditMd, recordsByUri: assembled.records, searchedNames,
-          fetchFailures: recordFetchFailures, findings: lintFindings, findingsRaw: lintFindingsRaw, actionsRegister: lintActions, verdictDoc: lintVerdict,
+          fetchFailures: recordFetchFailures, findings: lintFindings, narrativeFindings: lintNarrativeFindings, findingsRaw: lintFindingsRaw, actionsRegister: lintActions, verdictDoc: lintVerdict,
           // WP-56 B2 — fresh v4 runs expect the standing mark-assessment (structural banner flag when
           // absent). The replay harness's runLint call never passes this, so archived runs never flip.
           markAssessment: lintMarkAssessment, markAssessmentExpected: lintSv >= 4,

package/driver/portal-families.mjs

@@ -18,8 +18,8 @@
 // ── the shape ────────────────────────────────────────────────────────────────────────────────────────
 //
 //   { "schema": 1,
-//     "families": { "hydra-range": { "name": "Hydra range", "account": "foxglade" } },
-//     "of":       { "<runId>": "hydra-range" } }
+//     "families": { "aqua-range": { "name": "Aqua range", "account": "foxglade" } },
+//     "of":       { "<runId>": "aqua-range" } }
 //
 // Keyed by RUN rather than by mark. A mark is not a thing the pool stores — it is a grouping the browser
 // derives from run metadata — so a run id is the only stable handle the two sides already agree on. The
@@ -39,7 +39,7 @@ const FILE = "family-tags.json";
 // Caught by a test asserting a malformed file degrades to no families; it degraded to someone else's.
 const empty = () => ({ schema: 1, families: {}, of: {} });
 
-/** Ids are derived from the name so that grouping into "Hydra range" twice MERGES rather than duplicating. */
+/** Ids are derived from the name so that grouping into "Aqua range" twice MERGES rather than duplicating. */
 export function familyId(name) {
   return String(name ?? "")
     .normalize("NFKD")

package/driver/portal-service.mjs

@@ -3147,7 +3147,7 @@ async function connectorDoorKind(url) {
         //
         // STAFF ONLY, and by construction rather than by filtering: it hangs off /portal/admin, which
         // asserted staffOnly above and 404s for everyone else. That is a decision, not an oversight. A
-        // family name is staff shorthand for a brand line — "Hydra range" can name a launch a client has
+        // family name is staff shorthand for a brand line — "Aqua range" can name a launch a client has
         // not announced — and a grouping a client can see but not edit or explain raises more questions
         // than it answers. Revisit when clients have a reason to care; until then the client's list is
         // exactly the mark list, which is what the browser falls back to when this 404s.