clearotron 0.4.0 → 0.4.1-beta.1

package/driver/degraded-parts.mjs

@@ -69,7 +69,14 @@ const readJsonl = (p) => {
   } catch { return []; }
 };
 
-/** The stage's own last attempt row, or null when the stage wrote none. */
+/**
+ * The stage's own last attempt row, or null when the stage wrote none.
+ *
+ * A PART IS DEGRADED WHEN ITS STAGE FAILED, and that is the row's `fail`, never its `ok`. The two said the
+ * same thing until the attempt row learned to record a session that reached an error result and was
+ * recovered (engine/session-record.mjs): such an attempt is not ok, and its stage still delivered. Whether
+ * that should reach a client's report is a ruling nobody has made, so this reads what it always meant.
+ */
 export function lastAttempt(runDir, stage) {
   const rows = readJsonl(driverDir(runDir, `${stage}.jsonl`))
     .filter((r) => Number.isFinite(Number(r?.attempt)) && typeof r.ok === "boolean");
@@ -93,7 +100,7 @@ function courtDecisions(runDir, log) {
   if (lastEvent(log, ["case-law-decision"])?.run !== true) return null;
   const last = lastAttempt(runDir, "case-law");
   const part = { part: "court-decisions", name: PART_NAMES.courtDecisions };
-  if (last?.ok === false) return { ...part, reason: reasonFor(last.fail), cause: `the case-law stage ended failed: ${last.fail ?? "no cause recorded"}` };
+  if (last?.fail) return { ...part, reason: reasonFor(last.fail), cause: `the case-law stage ended failed: ${last.fail}` };
   let text;
   try { text = readFileSync(join(runDir, "case-law-findings.md"), "utf8"); } catch { text = null; }
   if (text === null) return { ...part, reason: NOT_COMPLETED, cause: "case-law-findings.md is absent" };
@@ -119,7 +126,7 @@ const failedStep = (log, ok, failed) => {
 };
 const stageEnded = (runDir, stage) => {
   const last = lastAttempt(runDir, stage);
-  return last?.ok === false ? last : null;
+  return last?.fail ? last : null;
 };
 
 // The register's own steps, each of which the run survives without: the band's shape (the floors and the

package/driver/dev-portal.mjs

@@ -380,7 +380,8 @@ export function startPortal({ poolRoot = null, port = 18899, host = "127.0.0.1",
         // "knockout" enqueued a job naming no product at all and ran whatever the account default or the
         // request's own territories named — a silent product substitution at a live door, from a control
         // that said otherwise. The menu is gone; refusing the field as well is what stops a stale tab, a
-        // bookmarked script or a copied curl from doing it quietly. products.mjs:293 states the rule.
+        // bookmarked script or a copied curl from doing it quietly.
+        // SEARCH_LEVEL_NOT_A_REQUEST declared in products.mjs states the rule.
         //
         // THE SENTENCE IS NO LONGER WRITTEN HERE. This door had the only searchLevel refusal in the
         // system, in its own words — so the same request was refused here and accepted at the other

package/driver/dispatch-record.mjs

@@ -46,6 +46,25 @@ export function dispatchFileName(stage, attempt, repair = 0) {
   return `${stage}.attempt${attempt}${repair ? `.repair${repair}` : ""}.${DISPATCH_SUFFIX}`;
 }
 
+export const STREAMS_DIR = "streams";
+
+/**
+ * `_driver/streams/<label>.attempt<N>.jsonl` (or `…repair<M>…`): the raw stream of the session that
+ * dispatch started, named as its dispatch record is. The engines write it (engine/session-record.mjs,
+ * `streamSink`); this is the one place the name is made. Absolute, through `driverDir`, so a label's
+ * colon is written the way the platform can hold it.
+ *
+ * IN ITS OWN FOLDER, NEVER BESIDE THE JOURNALS. Every `*.jsonl` directly under `_driver/` is read as a
+ * stage's attempt journal by name: the token rollup sums its usage rows, the degraded-parts check reads
+ * its label off the file name, the integrity check leaves it out as append-only. A raw stream there
+ * would be counted as a stage and its usage summed twice. One folder down, no reader of `_driver/`
+ * lists it, and the integrity snapshot reads files only.
+ */
+export function streamFilePath(runDir, stage, attempt, repair = 0) {
+  if (!runDir) return null;
+  return join(driverDir(runDir), STREAMS_DIR, driverFileName(`${stage}.attempt${attempt}${repair ? `.repair${repair}` : ""}.jsonl`));
+}
+
 const shaOf = (buf) => createHash("sha256").update(buf).digest("hex").slice(0, 12);
 
 // ── — WHAT THE STAGE WAS GRANTED, BESIDE THE SHA THAT PROVES WHAT IT WAS ASKED ────────────────

package/driver/doubt-closure-tool.mjs

@@ -119,8 +119,8 @@ export function captureCall(runDir, seq, received, { now = () => new Date().toIS
 //
 // THAT PREMISE IS WHY THIS IS SAFE, SO CHECK IT BEFORE MOVING THE SPEC WRITE. Five of the six
 // doubt-minting sites build an id from an ordinal over a FILTERED list
-// (`presence-reconciliation.mjs:182` mints `doubt:presence:<sheet>:<n>` after three `continue` filters,
-// with `status: "open"` hardcoded beside it); `doubt-ledger.mjs:232` is the exception and the template,
+// (`presence-reconciliation.mjs:182 mintPresenceDoubts` mints `doubt:presence:<sheet>:<n>` after three `continue` filters,
+// with `status: "open"` hardcoded beside it); `doubt-ledger.mjs:232 mintContradictionDoubts` is the exception and the template,
 // putting the candidate name in the id and using the ordinal only as a tiebreaker. If the spec is ever
 // minted per attempt instead of per stage, those ordinals can shift between attempts and this serve
 // starts handing back a verdict about a different subject. Nothing else in this file would notice.

package/driver/driver.config.mjs

@@ -1337,6 +1337,10 @@ export const PROVIDERS = {
         return { ok: true,
           total: Number.isFinite(p.total_hits) ? p.total_hits : null,
           ...(p.total_approximate === true ? { approximate: true, floor: Number.isFinite(p.total_floor) ? p.total_floor : null } : {}),
+          // The register's own notes on this answer, carried whole as the clearance sweep carries them —
+          // `expanded_fallback` among them, which says the total counts records rather than marks. The
+          // knockout listing dropped them, so a knockout run could not show what a clearance run shows.
+          ...(Array.isArray(p.warnings) && p.warnings.length ? { warnings: p.warnings } : {}),
           records: (Array.isArray(p.results) ? p.results : []).map((row) => {
           const rec = row?.raw && typeof row.raw === "object" ? core.normalizeRecord(row.raw, row.office || null) : null;
           return {
@@ -1355,6 +1359,9 @@ export const PROVIDERS = {
             filing_route: rec?.filingRoute ?? null,
             // No page per record at Signa (hasPublicRecordUrl: false above), and none is made up here.
             record_url: null,
+            // The office's own page as the register gives it, for publish to fall back on where it cannot
+            // address the office's page from the numbers above (office-record-links.mjs).
+            office_url: rec?.officeUrl ?? null,
           };
         }) };
       } catch (e) { return { ok: false, records: null, reason: `listRecords threw: ${e.message}` }; }
@@ -2079,12 +2086,31 @@ export const ENGINE_BINARIES = {
     // and a pinned id was refused outright ("version 2.1.280 or newer is required"), measured 2026-09-22.
     // A floor that only asks for a program that starts is a floor that passes a machine this engine
     // cannot run the current generation on.
-    package: "@anthropic-ai/claude-code", floor: "2.1.284",
+    //
+    // THE HAIKU TIER CROSSED LATER, when Claude Haiku 5.5 joined the generation. Measured 2026-10-09 by a
+    // one-word `-p` turn per version on the test box's own sign-in, reading the model the turn reports in
+    // `modelUsage`:
+    //
+    //     version   --model haiku
+    //     2.1.285    claude-haiku-4-5-20251001
+    //     2.1.287    claude-haiku-4-5-20251001
+    //     2.1.288    claude-haiku-4-5-20251001
+    //     2.1.289    claude-haiku-4-5-20251001
+    //     2.1.290    claude-haiku-4-5-20251001
+    //     2.1.292    claude-haiku-4-5-20251001
+    //     2.1.293    claude-haiku-5-5
+    //     2.1.294    claude-haiku-5-5
+    //     2.1.295    claude-haiku-5-5
+    //
+    // 2.1.295 still serves claude-opus-5-5 and claude-sonnet-5-5. The floor moves to 2.1.293 for the reason
+    // it moved to 2.1.284: a stage that asks for haiku is asking for the current haiku.
+    package: "@anthropic-ai/claude-code", floor: "2.1.293",
     // WHAT THE INSTALL TAKES ON DISK, in MB, which setup states before it asks to install. MEASURED, not
     // declared by the vendor: the engines folder after a fresh install of this package into an empty
-    // folder, on npm 10.9.8 and on 11.19.1, 2026-09-14. A later release can be larger or smaller, so setup
-    // says "about". Re-measure when the floor moves.
-    installMB: 233,
+    // folder. Re-measured when the floor moved to 2.1.293: 242 MB for a fresh install of 2.1.293 itself,
+    // on npm 10.9.9, 2026-10-09. A later release can be larger or smaller, so setup says "about".
+    // Re-measure when the floor moves.
+    installMB: 242,
     // The licence setup states wherever it tells a reader what they are about to install or use, as the
     // vendor's package declares it: "SEE LICENSE IN README.md", Anthropic's own terms.
     licence: "proprietary third-party software",
@@ -2110,8 +2136,15 @@ export const ENGINE_BINARIES = {
     vendor: "OpenAI",
     product: "Codex",
     env: "CLEAROTRON_CODEX_PATH", fallback: "codex",
-    package: "@openai/codex", floor: "0.154.0",
-    installMB: 324,   // measured the same way and on the same day as Claude's, above
+    // THE FLOOR IS THE OLDEST RELEASE THAT ACCEPTS THE JUDGMENT TIER'S MODEL on a ChatGPT sign-in, which
+    // is how a subscription bills. Measured 2026-10-09 with a one-word `codex exec` turn per version on the
+    // test box: `gpt-6.1-sol` is refused with a 400 on 0.156.1, 0.157.0 and 0.158.0 ("not supported when
+    // using Codex with a ChatGPT account") and accepted on 0.159.0, 0.160.0, 0.161.0 and 0.162.0;
+    // `gpt-6-luna` is accepted from 0.156.1. Below the floor every clearance stops at its first
+    // judgment-tier stage (the tiers are in engine/openai-agent.mjs). The old floor, 0.154.0, was the
+    // permissions feature's (engine/mcp/codex-config.mjs).
+    package: "@openai/codex", floor: "0.159.0",
+    installMB: 424,   // re-measured the same way as Claude's, above: a fresh install of 0.159.0 itself, 2026-10-09
     licence: "third-party software under the Apache-2.0 licence",   // the package's own "license" field
     label: "OpenAI — each stage runs as a headless `codex exec` turn",
     module: "engine/openai-agent.mjs", adapter: "openaiAgentEngine",

package/driver/engagement-receipt.mjs

@@ -37,7 +37,7 @@ export function isFinding(heading, block) {
 
 // Distinctive word anchors (length ≥4, non-stopword) from the owner / element / goods / sector /
 // jurisdiction / mark vocabulary; multi-word anchors contribute their significant words (so a finding
-// mentioning "Plesner" anchors against owner "Plesner Advokatpartnerselskab").
+// mentioning "Varnholt" anchors against owner "Varnholt Advokatpartnerselskab").
 function anchorTerms(anchors = {}) {
   const raw = [
     ...(anchors.owners ?? []), ...(anchors.dominantElements ?? []), ...(anchors.goodsServices ?? []),

package/driver/engine/CONTRACT.md

@@ -36,7 +36,9 @@ ladder consumes it without knowing which engine produced it ([gateway.mjs](../ga
   laneWaitMs: number,
   json:       object | null,         // synthesized envelope in the classifier's shape; every downstream
                                      // classifier (payloadText, status, embedded-fallback, timeout,
-                                     // lane-wedge) reads this and works unchanged across engines
+                                     // lane-wedge) reads this and works unchanged across engines.
+                                     // It also carries how the session ended: terminalReason,
+                                     // apiErrorStatus and errorText (see `session` below)
   usage:      Usage | null,          // canonical shape below; null = no tokens accounted (e.g. stall)
   sessionRef: string | null,         // opaque resume handle (claude session_id | codex thread_id)
   modelWire:  string | null,         // MODEL GAUGE — the served model id this turn observed (§3);
@@ -57,9 +59,47 @@ ladder consumes it without knowing which engine produced it ([gateway.mjs](../ga
                                      // opened; [] = recorded "read nothing"; key absent = engine cannot
                                      // observe reads (openai-agent) → gateway journals `reads: null`
   readsTruncated: boolean | absent,  // true = the path cap dropped at least one further distinct file
+  toolCallsByName: object | null,    // the turn's tool calls by tool name; an MCP call is
+                                     // `mcp__<server>__<tool>` on both engines; null = no session ran
+  session:    Session | null,        // what the session went through (below); null = no session ran
+  stream:     { file, present, bytes, reason? } | null,
+                                     // the raw stream, written to the file the caller named
+                                     // (the gateway names _driver/streams/<label>.attempt<N>.jsonl)
 }
 ```
 
+### `session` — what the session went through
+
+Both engines used to keep only the LAST result of a session, so a session the vendor's classifier cut
+off mid-answer, or refused and a restart recovered, ended in a successful result and was recorded as
+clean. `session` keeps every event of that kind, as the program wrote it, with milliseconds since the
+spawn ([engine/session-record.mjs](session-record.mjs)):
+
+```
+Session { interrupted, starts, results: [{atMs, index, subtype, isError, stopReason, terminalReason, origin}],
+          classifierCuts: [{atMs, synthetic}], refusals: [{atMs, category, model}], refusalStops }
+```
+
+It carries kinds, codes and times, never the program's words. The retry ladder still reads the last
+result alone; the gateway journals the attempt as `ok: false` when any result carried `is_error`, while
+`fail` — what every reader of "did the stage fail" reads — is unchanged. Codex states no cut or refusal
+on its stream, so on that engine `results` lists every `turn.completed`, `turn.failed` and `error`.
+
+How the session ended rides the envelope, and the gateway writes it on every attempt and repair row,
+null where the engine said nothing:
+
+```
+terminalReason   the kind of ending as the program states it (claude `terminal_reason`); null on codex
+apiErrorStatus   the vendor's status when it gave one (claude `api_error_status`); null on codex
+errorText        the program's own words for the error, only when the session ended in one, cut to
+                 300 characters: claude's result text when that result has `is_error`; codex's
+                 `turn.failed` message, or its stream error when the turn never completed
+```
+
+These are the one place the record holds the program's words: an expired sign-in otherwise reads as
+`stop_sequence` and nothing else. `stopReason` stays verbatim beside them, and none of the three moves a
+verdict.
+
 `runStage()` folds that into what the pipeline consumes — `{ok, json, attempts, text, sessionKey, …}` —
 and journals usage/wall/status on the way past.
 

package/driver/engine/anthropic-agent.mjs

@@ -26,6 +26,7 @@ import { authorityTrees } from "../authority-trees.mjs";
 import { recordEngineChild, clearEngineChild } from "./child-record.mjs";   //
 import { engineEnv } from "./engine-env.mjs";   // — the program's environment, by list (see spawnEnv)
 import { engineSpawn, spawnsDetached, killWindowsTreeNow } from "./engine-spawn.mjs";   // one answer to how a turn starts and ends, on every platform
+import { newSessionRecord, noteClaudeEvent, sessionSummary, countTool, streamSink, claudeEnding } from "./session-record.mjs";   // what the session went through, beside how it ended
 
 // Read per-call (not module-level) so tests can drive a short stall timeout / a mock binary.
 // ONE place knows how to find the program (driver.config.mjs resolveEngineProgram): the explicit setting,
@@ -514,6 +515,9 @@ export function synthesizeEnvelope({ resultEvent, usage, killed }) {
     status: ok ? "ok" : (killed ? "timeout" : "error"),
     result: { meta: { agentMeta: { usage } }, payloads: [{ text }] },
     summary: r?.subtype, runId: r?.session_id, stopReason: r?.stop_reason,
+    // …and beside the stop reason, what ended the session and, on an error, the program's own words for it
+    // (session-record.mjs, claudeEnding). Recorded only: `ok` above reads exactly what it read before.
+    ...claudeEnding(r),
   };
 }
 
@@ -524,7 +528,7 @@ export const anthropicAgentEngine = {
   // doctrine tree, the profile store and `<runDir>/_driver/` at the moment of the write. That is a real
   // boundary and this engine has it.
   writeBoundary: "enforced",
-  async runTurn({ message, model, thinking, timeoutSec, resumeRef, mcpConfig, allowedTools, cwd, skillsDir, skillsGrantRoots, profilesDir, resolveSkill, runDir, seatWrites = null, grantDispatch = null, stallSec, progressFiles } = {}) {
+  async runTurn({ message, model, thinking, timeoutSec, resumeRef, mcpConfig, allowedTools, cwd, skillsDir, skillsGrantRoots, profilesDir, resolveSkill, runDir, seatWrites = null, grantDispatch = null, stallSec, progressFiles, streamFile = null } = {}) {
     if (!message) throw new Error("anthropic-agent.runTurn: message is required");
     const { args, input, grantNote } = buildClaudeArgs({ message, model, thinking, resumeRef, mcpConfig, allowedTools, cwd, skillsDir, skillsGrantRoots, profilesDir, resolveSkill, runDir, seatWrites, grantDispatch });
     // the cross-check speaks. Driver stderr is what an operator reads, and it is where the other
@@ -690,6 +694,24 @@ export const anthropicAgentEngine = {
       // ("a completed tool result = the agent loop advanced", below). The gap between them is the turn
       // waiting on tools rather than generating.
       let toolCalls = 0;
+      // …AND THE SAME CALLS BY TOOL NAME, so a tool server's own log can be set against what the model
+      // asked for. A name is the program's identifier for a tool (`Read`, `mcp__band__band_lookup`), never
+      // an input, so it carries no client text. The values sum to `toolCalls` by construction: one fold
+      // per tool_use block, at the one site that counts them.
+      const toolCallsByName = Object.create(null);
+      // …AND WHICH OF THEM A TOOL SERVER ANSWERED WITH AN ERROR. A refused call the model then re-made used to
+      // leave the stage row reading ok on one attempt, as though nothing had happened. Each ask's id names its
+      // tool, and its result says whether it came back as an error; nothing else is kept.
+      const toolNameById = new Map();
+      const toolErrorIds = new Set();
+      // WHAT THE SESSION WENT THROUGH, beside how it ended: every result event, every classifier cut,
+      // every refusal and every restart, each with when it arrived. See session-record.mjs; the retry
+      // policy below still reads the LAST result alone, so this records and decides nothing.
+      const session = newSessionRecord();
+      // The raw stream, one file per session beside its dispatch (the caller names it). Opened before the
+      // first byte can arrive; closed in settle(). A sink that could not open is a null writer whose
+      // close() says why.
+      const sink = streamSink(streamFile);
       // HOW MANY OF THOSE ASKED FOR A COMMAND TOOL. The command tools are removed from every stage
       // (COMMAND_TOOLS), so the number a test round expects here is zero, and a count is what proves it: a
       // flag in the argv shows what was asked of the program, this shows what the model did. Still a count
@@ -814,6 +836,7 @@ export const anthropicAgentEngine = {
         let ev;
         try { ev = JSON.parse(line); } catch { return; /* partial/non-json line */ }
         sawAnyEvent = true;
+        noteClaudeEvent(session, ev, Date.now() - t0);
         if (ev.type === "result") resultEvent = ev;
         else if (ev.type === "rate_limit_event") rateLimitEvent = ev;
         else if (ev.type === "system" && ev.subtype === "init") {
@@ -839,7 +862,8 @@ export const anthropicAgentEngine = {
           // classification and no recovery park, or the turn never settles with its watchdog already gone.
           // Same belt-and-braces as the thinking gauge's `?.some?.()` on the line above.
           for (const b of Array.isArray(ev.message?.content) ? ev.message.content : []) {
-            if (b?.type === "tool_use") toolCalls++;   // #1111 — every tool, not only Read; a COUNT, never a name
+            if (b?.type === "tool_use") { toolCalls++; countTool(toolCallsByName, b?.name); }   // #1111 — every tool, not only Read; the count and its split by name
+            if (b?.type === "tool_use" && b?.id != null) toolNameById.set(String(b.id), String(b?.name ?? "?"));
             if (b?.type === "tool_use" && COMMAND_TOOLS.includes(b?.name)) commandToolCalls++;
             if (b?.type === "tool_use" && FILE_WRITE_TOOLS.includes(b?.name) && b?.id != null) writeAsks.add(String(b.id));
             if (b?.type === "tool_use" && b?.name === "Read" && typeof b?.input?.file_path === "string") {
@@ -873,8 +897,10 @@ export const anthropicAgentEngine = {
           progress();
         }
         else if (ev.type === "user") {
-          for (const b of Array.isArray(ev.message?.content) ? ev.message.content : [])
+          for (const b of Array.isArray(ev.message?.content) ? ev.message.content : []) {
             if (b?.type === "tool_result" && b?.is_error === true && writeAsks.has(String(b?.tool_use_id))) writesFailed++;
+            if (b?.type === "tool_result" && b?.is_error === true && b?.tool_use_id != null) toolErrorIds.add(String(b.tool_use_id));
+          }
           // the result of the ask above. Only counted when an ask is outstanding, so a `user`
           // event with no preceding tool_use adds nothing rather than charging the turn for a gap it
           // never spent waiting.
@@ -1052,6 +1078,7 @@ export const anthropicAgentEngine = {
         chunkGapMs = prevChunkAt === null ? 0 : Date.now() - prevChunkAt;
         prevChunkAt = Date.now();
         lastMove = Date.now();   // ANY streamed byte = liveness → resets the stall clock
+        sink.write(d);           // the raw stream, byte for byte, before anything parses it
         buf += d.toString();
         let nl;
         while ((nl = buf.indexOf("\n")) >= 0) { parseLine(buf.slice(0, nl)); buf = buf.slice(nl + 1); }
@@ -1074,7 +1101,7 @@ export const anthropicAgentEngine = {
         if (stderr.length > maxBuffer) { stderr = stderr.slice(0, maxBuffer); overflowKill(); }
       });
       // error + close can BOTH fire for a single failure (Node) → settle EXACTLY once (no double clearInterval/resolve).
-      child.on("error", (e) => { if (settled) return; settled = true; clearInterval(watchdog); resolve(errResult(t0, e, resumeRef)); });
+      child.on("error", (e) => { if (settled) return; settled = true; clearInterval(watchdog); sink.close(); resolve(errResult(t0, e, resumeRef)); });
       child.on("close", (code) => settle(code));
       function settle(code) {
         // the turn is over; the record must not outlive it, and is cleared only if
@@ -1087,6 +1114,7 @@ export const anthropicAgentEngine = {
         try { child.stdout.destroy(); } catch { /* stream gone */ }
         try { child.stderr.destroy(); } catch { /* stream gone */ }
         if (!overflow) { parseLine(buf); }   // B1: flush the final, un-terminated line (the result event) — but NEVER the truncated overflow tail
+        const stream = sink.close();   // after the flush: every byte the program wrote is in it, or the record says why not
         buf = "";
         // ONE SAMPLE OF THE CLOCK, and both quantities below are derived from it. Two `Date.now()` calls
         // a few milliseconds apart are enough to break the identity on the very turn it matters for: on a
@@ -1176,11 +1204,18 @@ export const anthropicAgentEngine = {
           // from this list is unreliable and the consumer must downgrade it to "not observed").
           reads: [...reads], readsTruncated,
           toolCalls, toolWaitMs: settledToolWaitMs,   // #1111 — two integers, no content
+          // The same calls by tool name (values sum to toolCalls), and what the session went through: every
+          // result, cut, refusal and restart (session-record.mjs). `stream` is the raw stream's file and size,
+          // or why it was not kept. Recording only — `failed` above still reads the last result alone.
+          toolCallsByName: { ...toolCallsByName }, session: sessionSummary(session), stream,
           // The two counts a test round reads per stage: calls to a command tool, and calls the program
           // refused. The refusals are the result event's own `permission_denials`, counted; null when the
           // turn settled with no result event, so "not reported" never reads as "none refused".
           commandToolCalls, writesFailed,
           toolCallsRefused: Array.isArray(resultEvent?.permission_denials) ? resultEvent.permission_denials.length : null,
+          // The tool-server calls that came back as an error, by tool name: the program sent them and the
+          // server refused or failed them. A call the program itself refused is counted above and not here.
+          toolCallsErroredByName: toolServerErrors(toolErrorIds, toolNameById, resultEvent?.permission_denials),
           // ms from spawn to the child's FIRST byte, or null when it never spoke. RECORDING
           // ONLY: nothing branches on it. A recording field is protected by a test or by nothing, so
           // engine.anthropic.test.mjs pins it — deleting it must red something.
@@ -1253,9 +1288,26 @@ function errResult(t0, e, resumeRef) {
     // modelWire: null for the opposite reason — no turn ran, so the wire said nothing about a model, and
     // the record must say UNKNOWN rather than inherit the alias that was asked for.
     json: null, usage: null, reads: [], readsTruncated: false, modelWire: null, providerWire: null, sessionRef: resumeRef ?? null,
+    // No session ran, so there is nothing to have been interrupted and no stream: null, never an empty record.
+    toolCallsByName: null, toolCallsErroredByName: null, session: null, stream: null,
   };
 }
 
+/**
+ * The tool-server calls of one turn that came back as an error, by tool name: every `mcp__` ask whose
+ * result carried `is_error`, less the asks the program refused itself (`permission_denials`, which
+ * `toolCallsRefused` counts). An OBJECT is a measurement (`{}`: none). PURE.
+ */
+export function toolServerErrors(errorIds, nameById, denials) {
+  const denied = new Set((Array.isArray(denials) ? denials : []).map((d) => String(d?.tool_use_id ?? "")).filter(Boolean));
+  const byName = Object.create(null);
+  for (const id of errorIds ?? []) {
+    const name = nameById?.get(id);
+    if (typeof name === "string" && name.startsWith("mcp__") && !denied.has(id)) countTool(byName, name);
+  }
+  return { ...byName };
+}
+
 /**
  * The program's own word for which provider served a turn, from the result event's per-model usage:
  * `modelUsage[<model>].provider`, "firstParty" on Anthropic's own API and "foundry" on Azure Foundry

package/driver/engine/mcp/codex-config.mjs

@@ -5,7 +5,7 @@
 // exact server/tool wiring. Two inputs, both produced today by the gateway gather block:
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
-import { tomlString } from "../../../shared/toml-string.mjs";
+import { tomlString } from "../../../shared/toml-string.mjs"; import { driverDir } from "../../../shared/driver-dir.mjs";
 
 //   • mcpConfig     — the claude-shaped JSON string `{mcpServers:{name:{command,args,env,connectionTimeoutMs?}}}`
 //                     (buildGatherMcpConfig → JSON.stringify)
@@ -218,7 +218,7 @@ export function commandEnvToml(withheld = []) {
 // ── the stage's permission profile: what its shell commands may read and write ──────────────────────
 // codex's `workspace-write` sandbox confines where a command WRITES and lets it read the whole disk, the
 // install's settings files and the program's own sign-in included. A permission profile confines reading
-// too (the vendor's Permissions guide, a beta feature since 0.138.0; the floor is 0.154.0): a stage's
+// too (the vendor's Permissions guide, a beta feature since 0.138.0; the floor was 0.154.0 when this was written and is 0.159.0 now, for the judgment tier's model — driver.config.mjs): a stage's
 // commands read the platform's own paths, the instruction trees and the temp folders, and write the run
 // folder, their working folder and the temp folders. Nothing else is readable, so a page a stage fetched
 // cannot get a command to print the account's files. The temp folders stay writable because
@@ -235,13 +235,18 @@ export function commandEnvToml(withheld = []) {
 // this profile never names. Not a refusal of their names inside the temp folder: codex scans a folder
 // before it applies a wildcard refusal there, and in a shared temp folder one entry the account cannot
 // read fails the whole turn (measured, 0.156.1).
+//
+// THE DRIVER'S OWN RECORDS INSIDE THE RUN FOLDER ARE READ-ONLY. `_driver/` holds the run's trace and the
+// files the gates judge from, so a stage's command may read them and never write them. The narrower line
+// wins over the run folder's: measured on codex 0.162.0 with this profile, a write into the run folder
+// succeeded, a read of `_driver/` succeeded, and a write or an append there was refused.
 export const FENCE_PROFILE = "clearotron-stage";
 export function fenceToml({ runDir = null, readRoots = [] } = {}) {
   const key = (p) => tomlString(p);
   const out = [`[permissions.${FENCE_PROFILE}.filesystem]`,
     `":minimal" = "read"`, `":tmpdir" = "write"`, `":slash_tmp" = "write"`];
   for (const r of [...new Set(readRoots.filter(Boolean))]) out.push(`${key(r)} = "read"`);
-  if (runDir) out.push(`${key(runDir)} = "write"`);
+  if (runDir) out.push(`${key(runDir)} = "write"`, `${key(driverDir(runDir))} = "read"`);
   out.push("", `[permissions.${FENCE_PROFILE}.filesystem.":workspace_roots"]`, `"." = "write"`, "");
   return out;
 }

package/driver/engine/mcp/coverage-server.mjs

@@ -19,7 +19,7 @@
 // wired per run by the driver; there is no parameter for it and this tool never guesses one
 // (recording-server.mjs's record_doubt_closure records why the parameter must not exist). The form name comes off the run's own
 // era stamp, the row ids are the driver's, and every other identifier is computed. Read at CALL TIME,
-// never captured at module load (stdio-server.mjs:29-33 states why for exactly this variable).
+// never captured at module load (stdio-server.mjs:29-33 toolLogPath states why for exactly this variable).
 import { serve } from "./stdio-server.mjs";
 import { recordCoverage } from "../../coverage-tool.mjs";
 import { MAX_ROWS_PER_CALL } from "../../coverage-call.mjs";

package/driver/engine/mcp/gather-config.mjs

@@ -107,7 +107,7 @@ export const REGISTER_SERVERS = {
   //     public page, and this provider publishes neither. Read 2026-08-22 across providers/signa/src: no
   //     vienna or figurative field anywhere in the core, the normaliser carries `imageAvailable`
   //     (`rec.has_media`) and nothing else about the mark's figure, `hasPublicRecordUrl: false` and
-  //     `resolved_link: null` with "Signa exposes no per-record public URL". Serving it would return a
+  //     `resolved_link: null` (no page per record of its own). Serving it would return a
   //     bare boolean under a name that promises comparable figurative data. NOT A PROBE: this is a read of
   //     the code and the vendor doc in this repo, and whether the live API has an image endpoint nobody
   //     wired is UNTESTED from here — euipo's `markImage` looked equally absent until `GET

package/driver/engine/mcp/recording-server.mjs

@@ -5,7 +5,7 @@
 // ── WHAT THIS CATEGORY IS FOR, AND WHY IT IS NOT A RETRIEVAL GRANT ──────────────────────────────────
 //
 // The two-box model conflates "may reach the outside world" with "may hand back structure"
-// (gather-config.mjs:246-268). A stage converted to a typed return needs the second and not the first.
+// (gather-config.mjs:246-268 RECORDING). A stage converted to a typed return needs the second and not the first.
 // This server carries ONLY the second: it writes the calling stage's own artifact into the calling
 // stage's own run directory, and it dials nothing.
 //
@@ -22,7 +22,7 @@
 //
 // ── THE RUN IS NOT THE SEAT'S TO NAME ───────────────────────────────────────────────────────────────
 //
-// `CLEAROTRON_BAND_RUN_DIR`, read at CALL TIME. `serverEnv()` (gather-config.mjs:162) sets it for every local
+// `CLEAROTRON_BAND_RUN_DIR`, read at CALL TIME. serverEnv() in gather-config.mjs sets it for every local
 // server, not only band. There is no `run_dir` parameter and there must not be one — the lesson is
 // the earlier one, where an invented `CLEAROTRON_RUN_DIR` fallback sat two lines under a sentence promising the tool
 // never guesses a run. Call time rather than module load: stdio-server.mjs:29-33 states why for this
@@ -55,7 +55,7 @@ import { PROVIDERS, REGISTER_PROVIDER } from "../../driver.config.mjs";
 // already written against them; this conversion is the consumption their headers said was still owed.
 import { recordClosures } from "../../doubt-closure-tool.mjs";
 import { MAX_CLOSURES_PER_CALL, CLOSURE_KINDS } from "../../doubt-closure-call.mjs";
-import { readFileSync } from "node:fs";
+import { readFileSync, existsSync } from "node:fs"; import { FROZEN_METHOD_FILE } from "../../framework-method.mjs";
 import { join } from "node:path";
 import { driverDir } from "../../../shared/driver-dir.mjs";   //
 import { VARIANT_CATEGORIES } from "../../variant-manifest-model.mjs";
@@ -398,7 +398,7 @@ serve({
               item: {
                 type: "string",
                 description:
-                  "For a FIRING variant directive this must be a mark-shaped search term (TAKIS, CORAL " +
+                  "For a FIRING variant directive this must be a mark-shaped search term (WAVA, CORAL " +
                   "MAGIC) or carry a remedy. A label — a parenthetical, an enumeration, more than about " +
                   "four words — dispatches as a nil search that reads CLEAN, and is refused here.",
               },
@@ -1134,6 +1134,9 @@ serve({
     handler: record_synthesis,
   }, {
     name: "record_knockout_assess",
+    // The framework's `inputs` fields are offered only on a run whose framework states a method: a session
+    // offered a field it may not use can fill it, and the check that refuses it runs after the whole step.
+    schemaNow: (schema) => knockoutAssessSchemaFor(schema, process.env.CLEAROTRON_BAND_RUN_DIR),
     description:
       "Hand back THIS CHUNK's rated assessment as VALUES. The driver serializes knockout-assess-<n>.json, " +
       "so you never format JSON and never write the file. WHICH CHUNK IS NOT YOURS TO SAY — the driver " +
@@ -1392,7 +1395,7 @@ serve({
         },
         batch: {
           type: "object",
-          required: ["productContext", "inUseAs", "places"],
+          required: ["productContext", "inUseAs"],   // places are per name (ruling 570): the batch list is optional, as in the acceptor and the manual
           properties: {
             productContext: { type: "string", description: "One sentence: what the batch is for. Every mark's contextFraming is read against it." },
             inUseAs: { type: "string", description: "The kinds of use off the register that could conflict in this client's field, as one phrase completing \"Is this name already in use as …?\". The places the batch is searched on include the sites where these uses are listed." },
@@ -1439,3 +1442,27 @@ serve({
     handler: record_knockout_frame,
   }],
 });
+
+/**
+ * The knockout save tool's schema for the run this server serves. The framework's `inputs` fields are
+ * offered only where the run's framework states a method, which is when its frozen copy
+ * (`_driver/framework-method.json`) exists: a run with no method has none, since the mint removes it. A
+ * session offered a field it may not use can fill it, and the check that refuses it runs only after the
+ * whole step. With no run to read, the schema is the one declared. Read when the tools are listed.
+ */
+export function knockoutAssessSchemaFor(schema, runDir) {
+  if (!runDir || existsSync(driverDir(String(runDir), FROZEN_METHOD_FILE))) return schema;
+  const strip = (s) => {
+    if (Array.isArray(s)) return s.map(strip);
+    if (!s || typeof s !== "object") return s;
+    const out = {};
+    for (const [k, v] of Object.entries(s)) {
+      if (k === "properties" && v && typeof v === "object" && !Array.isArray(v)) {
+        out.properties = Object.fromEntries(Object.entries(v).filter(([name]) => name !== "inputs").map(([name, sub]) => [name, strip(sub)]));
+      } else if (k === "required" && Array.isArray(v)) out.required = v.filter((name) => name !== "inputs");
+      else out[k] = strip(v);
+    }
+    return out;
+  };
+  return strip(schema);
+}

package/driver/engine/mcp/stdio-server.mjs

@@ -115,8 +115,11 @@ export function serve({ name, version = "0.1.0", tools = [] }) {
   // it must be read-only. Nothing here needs to claim a write is a read to get called, and a
   // `readOnlyHint: true` on a tool that writes a ledger would be a lie told to a sandbox for
   // convenience — the exact thing annotations exist to prevent.
-  const list = tools.map((t) => ({
-    name: t.name, description: t.description, inputSchema: t.inputSchema,
+  // Listed when asked, not at start: a tool may give the schema for the run it serves (`schemaNow`), read
+  // at call time like every per-run read here. A tool without one lists its declared schema, as before.
+  const list = () => tools.map((t) => ({
+    name: t.name, description: t.description,
+    inputSchema: typeof t.schemaNow === "function" ? t.schemaNow(t.inputSchema) : t.inputSchema,
     ...(t.annotations ? { annotations: t.annotations } : {}),
   }));
   const send = (m) => process.stdout.write(JSON.stringify(m) + "\n");
@@ -137,7 +140,7 @@ export function serve({ name, version = "0.1.0", tools = [] }) {
       } else if (method === "ping") {
         ok(id, {});
       } else if (method === "tools/list") {
-        ok(id, { tools: list });
+        ok(id, { tools: list() });
       } else if (method === "tools/call") {
         const tool = byName.get(params?.name);
         if (!tool) return ok(id, { isError: true, content: [{ type: "text", text: `unknown tool: ${params?.name}` }] });
@@ -167,7 +170,7 @@ export function serve({ name, version = "0.1.0", tools = [] }) {
           // interpolate a mark, and this row's own contract is the call and never its content. A row that
           // copied the message would leak the day one of them does; a row that copies `unmet` cannot.
           logToolEvent({ event: "settled", seq, server: name, tool: tool.name, ...(axis ? { axis } : {}), ok: false,
-            reason: `missing_required:${unmet.join(",")}` });
+            failure: "schema", reason: `missing_required:${unmet.join(",")}` });
           return ok(id, { isError: true, content: [{ type: "text", text:
             `${tool.name}_missing_required:${unmet.join(",")} — the schema you were handed declares `
             + `${unmet.length === 1 ? "this field" : "these fields"} REQUIRED and the call did not carry `
@@ -177,13 +180,19 @@ export function serve({ name, version = "0.1.0", tools = [] }) {
         try { out = await tool.handler(params?.arguments || {}); }
         catch (e) {
           // A THROWN tool error SETTLES. It returned an answer — a wrong one, but the model saw it and
-          // could act on it. Recording it as unsettled would attribute a live failure to a timeout.
-          logToolEvent({ event: "settled", seq, server: name, tool: tool.name, ...(axis ? { axis } : {}), ok: false });
+          // could act on it. Recording it as unsettled would attribute a live failure to a timeout. The
+          // row names the error's class and never its message, which can carry whatever the tool was given.
+          logToolEvent({ event: "settled", seq, server: name, tool: tool.name, ...(axis ? { axis } : {}), ok: false,
+            failure: "threw", reason: `threw:${errorClass(e)}` });
           return ok(id, { isError: true, content: [{ type: "text", text: `${tool.name} error: ${e?.message ?? e}` }] });
         }
         const isError = typeof out === "object" && out?.isError === true;
         const text = typeof out === "string" ? out : (out?.text ?? JSON.stringify(out));
-        logToolEvent({ event: "settled", seq, server: name, tool: tool.name, ...(axis ? { axis } : {}), ok: !isError });
+        // A tool that answered with an error rejected the call itself, after the schema let it past. The row
+        // says so, and carries the complaint's own code when the text opens with one, never the text.
+        const code = isError ? complaintCode(text) : null;
+        logToolEvent({ event: "settled", seq, server: name, tool: tool.name, ...(axis ? { axis } : {}), ok: !isError,
+          ...(isError ? { failure: "server", ...(code ? { reason: code } : {}) } : {}) });
         ok(id, { isError: isError || undefined, content: [{ type: "text", text }] });
       } else if (id != null) {
         err(id, -32601, `method not found: ${method}`);
@@ -205,3 +214,32 @@ export function serve({ name, version = "0.1.0", tools = [] }) {
   // so `claude --mcp-config` reports a connected server whose tool calls return a clear isError.
   process.on("uncaughtException", (e) => { process.stderr.write(`[mcp:${name}] ${e?.stack ?? e}\n`); });
 }
+
+// ── WHAT REFUSED A CALL, as the settled row names it ───────────────────────────────────────────────────
+//
+// (At the end of this file so that adding it moved no line another file cites.)
+//
+// A settled row with `ok: false` carries `failure`, one of three words for where the call stopped:
+//   schema   the call did not carry a field the tool's schema requires; refused before the tool ran
+//   threw    the tool ran and threw
+//   server   the tool ran and answered with an error of its own
+// So a call refused before its tool ever ran is told apart from one the tool rejected without knowing
+// that the first leaves no call file behind. `reason` is never the message: a message can quote what the
+// tool was given. It is the missing fields, the error's class, or the complaint's own code.
+
+/** An error's class name, never its message. PURE. */
+export function errorClass(e) {
+  const n = typeof e?.name === "string" && /^[A-Za-z][A-Za-z0-9]*$/.test(e.name) ? e.name : "";
+  return n || "Error";
+}
+
+/**
+ * The code a tool's complaint opens with, as the acceptors write them (`knockoutframe_classes_plain: …`,
+ * `judgment_record_not_held:1:…`): a lower-case word with at least one underscore, read up to the first
+ * character that is not part of it. `null` when the text opens any other way, so prose never reaches the
+ * row. PURE.
+ */
+export function complaintCode(text) {
+  const m = /^([a-z][a-z0-9]*(?:_[a-z0-9]+)+)(?=$|[^a-z0-9_])/.exec(String(text ?? ""));
+  return m ? m[1] : null;
+}