clearotron 0.4.0 → 0.4.1-beta.1

package/driver/framework.mjs

@@ -139,6 +139,28 @@ export function aboveLowestBand(manifest, label) {
   return i !== -1 && i < manifest.bands.length - 1;
 }
 
+/** The tones of the rungs whose findings are "material": medium risk or higher. A rung's tone is its own
+ *  statement of its risk, so the line holds on any client's ladder. A line drawn by POSITION ("above the
+ *  lowest band") did not: the bottom rung is "low" on a four-rung ladder and "minimal" on a five-rung one,
+ *  so one client's low-risk rung was checked and another's was not (owner's ruling, 2026-10-09). */
+export const MATERIAL_TONES = Object.freeze(["severe", "high", "medium"]);
+
+/** True when the label is a band whose tone is medium risk or higher — the "material finding" predicate. */
+export function materialBand(manifest, label) {
+  return MATERIAL_TONES.includes(bandTone(manifest, label));
+}
+
+/** The material bands' labels, highest first: what a dispatch names when it says which findings a check covers. */
+export const materialBandLabels = (manifest) => (manifest?.bands ?? [])
+  .filter((b) => MATERIAL_TONES.includes(b?.tone)).map((b) => b.label);
+
+/** The material bands as a reader's list — "Very High, High or Moderate" — or null when the ladder names none. */
+export function materialBandPhrase(manifest) {
+  const xs = materialBandLabels(manifest);
+  if (!xs.length) return null;
+  return xs.length === 1 ? xs[0] : `${xs.slice(0, -1).join(", ")} or ${xs[xs.length - 1]}`;
+}
+
 /** The most severe band label among the given labels (unknown labels ignored); null when none are bands. */
 export function worstBand(manifest, labels) {
   let best = -1;

package/driver/gateway.mjs

@@ -246,7 +246,8 @@ import { REGISTER_ENUMERATE_TOOL, SUPPLEMENTAL_LANE_STEERING } from "./stages.mj
 // same thing to the exit-1 rescue below as it does to the register taint chain that reads the very
 // same rows off disk. Acyclic: register-taint.mjs imports node builtins only.
 import { isTaintRow } from "./register-taint.mjs";
-import { recordDispatch } from "./dispatch-record.mjs";
+import { recordDispatch, streamFilePath } from "./dispatch-record.mjs";
+import { anyResultErrored, endingFields } from "./engine/session-record.mjs";   // a session that reached an error result is not an ok attempt, whatever its last result said
 import { recordBestDraft } from "./best-draft.mjs";
 //: the allowlisted progress-quantity extractor. Acyclic — repairs.mjs imports node builtins only
 // (fs/crypto/path). Used only when the validator did not stamp its own count; never a digit hunt.
@@ -309,6 +310,37 @@ export function isTimeout({ killed, code, wall, stderr = "", timeoutSec }) {
 // on a parsed 0-usage object. A slow-but-working model that times out returns a status_timeout envelope WITH
 // usage (admitted) → NOT a wedge. Kept pure + exported so the classifier is unit-tested (it must not misfire on
 // admitted turns, and it MUST fire on the null-usage hard-kill that the production incident actually produced).
+/**
+ * Did this attempt spend its whole derived budget, exit cleanly, and still fail? PURE.
+ *
+ * THE CASE THIS NAMES, measured on one round: an attempt ran 958.6 seconds against a derived limit of 900,
+ * exited 0, wrote nothing, and was recorded as `missing_file` naming its own output. It was working the whole
+ * time — 35,341 output tokens, 119 tool calls, 947.7 seconds of active time. The hard kill is the limit plus
+ * 60, so it finished 1.4 seconds under it.
+ *
+ * WHY THE CLASSIFICATION ABOVE IS RIGHT AND THE RECORD WAS STILL WRONG. `isTimeout`'s third signal needs a
+ * non-zero exit as well as a wall past the budget, and the program exited 0 — so it is not a timeout, and
+ * nothing here argues it should be. The defect is that the row then read `missing_file`, which names an
+ * artifact and sends the next reader to look for a path bug or a race. The two numbers that say otherwise
+ * were both on the row — the wall beside the derived limit — and nobody was pointed at them.
+ *
+ * SO THIS RECORDS A FACT AND MOVES NO POLICY. It does not feed `isTimeout`, it does not change which retry
+ * the attempt earns, and the fail class is untouched. Whether a clean exit at the budget should also earn the
+ * longer retry a timeout earns is a question for the owner, and the issue that asked for this says so
+ * explicitly: it may be right that a clean exit is not a timeout. This is the record it would be decided on.
+ *
+ * Three-valued, like the model fields on the same row: null when the budget is unknown, so "nobody derived a
+ * limit for this stage" stays visibly different from "it did not spend it".
+ */
+export function spentBudgetCleanly({ fail, killed, code, wall, derivedLimitSec }) {
+  if (!fail) return false;                              // a passing attempt is not this shape
+  if (!Number.isFinite(derivedLimitSec) || derivedLimitSec <= 0) return null;
+  if (!Number.isFinite(wall)) return null;
+  if (killed) return false;                             // a kill is the timeout path, not this one
+  if (code !== 0) return false;                         // a dirty exit at the budget IS a timeout already
+  return wall >= derivedLimitSec;
+}
+
 export function isLaneWedge(fail, usage) {
   if (fail !== "timeout") return false;
   const moved = (usage?.input || 0) + (usage?.output || 0) + (usage?.cacheRead || 0) + (usage?.cacheWrite || 0);
@@ -389,9 +421,35 @@ export function toolGauge(turn) {
     // engine cannot report", the same distinction toolWaitByTool draws one line up. RECORDING ONLY:
     // toolWaitMs and the per-tool split are exactly what they were, because the kill clock reads them.
     toolWaitUnmeasurable: Array.isArray(turn?.toolWaitUnmeasurable) ? [...turn.toolWaitUnmeasurable] : null, ...toolCallCounts(turn),
+    // The calls by tool name, beside the total, so a tool server's own log can be set against what the
+    // model asked for. An OBJECT is a measurement (`{}`: none); null is "this engine cannot report".
+    toolCallsByName: turn?.toolCallsByName && typeof turn.toolCallsByName === "object" && !Array.isArray(turn.toolCallsByName)
+      ? { ...turn.toolCallsByName } : null,
   };
 }
 
+/**
+ * Whether the attempt is OK: the driver's verdict (`fail`) AND no result event of the session carried
+ * `is_error`. A session the vendor refused and a restart recovered ends in a successful LAST result, so
+ * the retry ladder (which reads that last result, unchanged) accepts it; the record says what happened.
+ * Readers that ask "did the stage fail" read `fail`, which this does not touch. PURE.
+ */
+export function attemptOk(fail, turn) {
+  return !fail && !anyResultErrored(turn?.session);
+}
+
+/**
+ * The stream record as a row carries it: the file relative to the run, as the dispatch record names its
+ * file, and the size — or why it was not kept. null when the engine kept none or ran no session. PURE.
+ */
+export function streamMeta(runDir, stream) {
+  if (!stream || typeof stream !== "object" || !stream.file) return null;
+  const dir = String(runDir ?? "");
+  const file = dir && String(stream.file).startsWith(dir) ? String(stream.file).slice(dir.length).replace(/^[\\/]+/, "").replace(/\\/g, "/") : String(stream.file);   // forward slashes, as every record path is, on Windows too
+  return { file, present: stream.present === true, bytes: Number.isFinite(stream.bytes) ? stream.bytes : null,
+    ...(stream.reason ? { reason: stream.reason } : {}) };
+}
+
 export function tokensPerSec(usage, wall) {
   const w = Number(wall);
   if (!usage || !Number.isFinite(w) || w <= 0) return null;
@@ -1073,7 +1131,10 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     // run-integrity.mjs for why it is not a manifest file and why the append-only journals are excluded.
     const integrityBefore = frozenSnapshot(runDir);
     const turn = await engine.runTurn({ agent, sessionKey: key, message: effMessage, grantDispatch: base, model, thinking, timeoutSec: effTimeout, resumeRef: warm ? lastSessionRef : undefined, codexHome: stageCodexHome, mcpConfig: gatherMcpConfig, allowedTools: gatherAllowedTools, seatWrites: gatherSeatWrites, skillsDir: engineSkillsDir, skillsGrantRoots: engineSkillsGrantRoots, profilesDir: profilesStoreDir, resolveSkill: engineResolveSkill, runDir, stallSec,
-      progressFiles: files });   // the no-progress watchdog's artifact-advance signal (anthropic-agent; other adapters ignore it)
+      progressFiles: files,   // the no-progress watchdog's artifact-advance signal (anthropic-agent; other adapters ignore it)
+      // The raw stream of this session, beside its dispatch record (engine/session-record.mjs). The engines
+      // keep it while the disk has room and say on the tuple's `stream` what landed.
+      streamFile: streamFilePath(runDir, name, attempt) });
     const settledAt = Date.now();   //: zero point of the wall-rescue quiescence clock, read before anything else
     // LOG-ONLY. Nothing here can fail a turn: the claim that the frozen set does not change across a seat
     // turn is READ from the writers' call sites and not yet MEASURED on a running system, and arming an
@@ -1294,7 +1355,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
       const rt = await engine.runTurn({ agent, sessionKey: key, message: repairMessage, model, thinking,
         timeoutSec: effTimeout, resumeRef: repairRef, codexHome: stageCodexHome, mcpConfig: gatherMcpConfig, allowedTools: gatherAllowedTools,
         skillsDir: engineSkillsDir, skillsGrantRoots: engineSkillsGrantRoots, profilesDir: profilesStoreDir, resolveSkill: engineResolveSkill, runDir, stallSec,
-        progressFiles: files });
+        progressFiles: files, streamFile: streamFilePath(runDir, name, attempt, formRepairsUsed + 1) });
       repairRef = rt.sessionRef ?? repairRef;
       // A KILLED REPAIR TURN'S BYTES ARE NOT STAGE TRUTH. Same doctrine as the exit-1 rescue below: a
       // stage validator is a SHAPE check, not a completeness proof, and a torn draft can pass its own
@@ -1338,8 +1399,9 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           repair: formRepairsUsed, repairOf: MAX_FORM_REPAIRS, repairOutcome: outcome, fail: triggeredBy,
           repairTarget: rel(target),   // the file the repair was AIMED at (often a sibling, not the expectFile)
           dispatch: repairDispatch,    // — the verbatim message this repair turn was given
-          stopReason: rt.json?.stopReason ?? undefined,
+          stopReason: rt.json?.stopReason ?? undefined, ...endingFields(rt.json),   // — and what ended it, in the program's words on an error
           killed: rt.killed || undefined, signals: rt.signals ?? undefined,
+          session: rt.session ?? null, stream: streamMeta(runDir, rt.stream),   // — the repair session's own record, as on the attempt row
           warm: true,   // a repair turn always RESUMES the session that wrote the defect
           runId: rt.json?.runId, engineSummary: rt.json?.summary, usage: rt.usage,
           selfReportContradicted: (outcome !== "repaired" && rt.json?.status === "ok") || undefined,   //
@@ -1707,7 +1769,13 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         // attempt produce what the stage exists to produce". Sixty report-card attempts on round 892dd88e
         // journalled status:"ok", summary:"success", code:0, wrote:true and output.present:true beside a
         // populated `fail`, and a watcher keyed on the headline saw sixty successes.
-        ok: !fail,
+        // — AND NOT WHEN THE SESSION REACHED AN ERROR RESULT, whatever its last result said: a refusal a
+        // restart recovered is a session that was refused (engine/session-record.mjs). `fail` is unchanged,
+        // so the ladder and every reader asking "did the stage fail" read exactly what they read before.
+        ok: attemptOk(fail, turn),
+        // What the session went through — every result, classifier cut, refusal and restart, with when —
+        // and where its raw stream is, or why it was not kept. null where the engine cannot report.
+        session: turn.session ?? null, stream: streamMeta(runDir, turn.stream),
         // The engine's claim about itself, KEPT and renamed to say whose claim it is. A self-report is
         // evidence — deleting it would destroy the only record of what the seat believed it had done — and
         // it is not a verdict. Still three-valued (ok | timeout | error). Nothing in the driver reads either
@@ -1743,7 +1811,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         laneWaitMs,   // WS-C turn-cap queue time — the live overlap validation reads this
         // A6: the provider's stop reason, verbatim — the max_tokens fault line is countable from the
         // rows alone (fail carries the named fault; this field carries the raw discriminator).
-        stopReason: json?.stopReason ?? undefined,
+        stopReason: json?.stopReason ?? undefined, ...endingFields(json),   // — and beside it what ended the session: its kind, the vendor's status, and on an error the program's own words (session-record.mjs)
         // taint durability (copper-lattice): the kill discriminators survive to disk — register-taint.mjs
         // reads these rows across process restarts (--resume), where the in-memory turn object is gone.
         // `followup` matters too: a followup success PATCHES the prior session's output, it never
@@ -1785,6 +1853,11 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         // measure" stays visibly different from "this turn called no tools" — see toolGauge.
         ...toolGauge(turn), band: bandSize ?? undefined,
         inputBytes: derivedLimit?.inputBytes ?? undefined, derivedLimitSec: derivedLimit?.sec ?? undefined,
+        // …and whether this attempt spent that limit and exited cleanly anyway. Written UNCONDITIONALLY and
+        // three-valued, beside the two numbers it is about, so a failure that had used its whole budget is
+        // not left looking like an artifact problem. It names a fact; it moves no retry policy. See
+        // `spentBudgetCleanly`.
+        budgetSpentCleanly: spentBudgetCleanly({ fail, killed, code, wall, derivedLimitSec: derivedLimit?.sec }),
         // AD-4 emitted-vs-landed, UNCONDITIONAL (was success-only, which made a failed attempt's mid-write
         // artifact invisible): `output` = what LANDED on disk after this attempt (null when the stage has no
         // expected file); `wrote` = whether THIS attempt emitted it (see the computation above the runDir
@@ -1815,7 +1888,9 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
       // from "retries not recorded here"). Best-effort like every telemetry write.
       try {
         runLog(runDir, {
-          event: "attempt", stage: name, attempt, of: maxRetries + 1, ok: !fail, fail: fail ?? null,
+          event: "attempt", stage: name, attempt, of: maxRetries + 1, ok: attemptOk(fail, turn), fail: fail ?? null,
+          // The spine carries the one-word answer and the pointer; the per-stage row carries the record.
+          interrupted: turn.session?.interrupted ?? null, stream: streamMeta(runDir, turn.stream)?.file ?? null,
           //: the spine carries the same pair as the per-stage log, or the two disagree about what
           // ran. `model` stays the requested resolution (its existing readers); `modelActual` is the wire.
           model: modelRequested, modelActual, modelBasis, modelSnapshot, modelMismatch, providerReported,
@@ -1850,6 +1925,9 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           // — the spine carries them too, or a round has to join two files to ask why a stage was slow.
           ...toolGauge(turn), band: bandSize ?? undefined,
         inputBytes: derivedLimit?.inputBytes ?? undefined, derivedLimitSec: derivedLimit?.sec ?? undefined,
+        // …and the same fact on this row, because one of the two carrying it records half the runs and
+        // reads as done. Three-valued and beside the numbers it is about. See `spentBudgetCleanly`.
+        budgetSpentCleanly: spentBudgetCleanly({ fail, killed, code, wall, derivedLimitSec: derivedLimit?.sec }),
           formRepairs: formRepairsThisAttempt || undefined,   //, see the stage row above
         });
       } catch { /* telemetry best-effort — never fail a turn over a journal line */ }
@@ -3037,7 +3115,7 @@ export function correctionHint(lastFail, { gridLedgerName = "common-law-grid.jso
     // run the driver stamped as form-required, and the stamp is conditional. On an unstamped run
     // validators.registerFindings demands the table exactly as it did before and emits this label,
     // so dropping the arm left the one lane that can still fire it with a generic hint.
-    hint = "the file has a findings heading plus a Coverage ledger with a status row (confirmed-clean / coverage-limited / deferred)" + (/common-law-findings/.test(lastFail) ? ", or each ledger row's status is recorded by calling `record_coverage_status` with `grid_spec_path`, the same spec path the grid tool was given" : "");
+    hint = "the file has a findings heading plus a Coverage ledger with a status row (confirmed-clean / coverage-limited / deferred)";   // the common-law clause went with that lane's status gate (ruling 2026-10-01)
   } else if (/negative-results|coverage-ledger|audit-trail|findings-heading/.test(lastFail)) {
     hint = "the findings file carries ALL required sections: a findings heading, the Negative results matrix " +
       "(every variant × platform row), the Coverage ledger with a status row, and the Audit trail call log";
@@ -3114,8 +3192,8 @@ export function isFormClassFail(fail) {
   return FORM_CLASS_RE.test(fail ?? "");
 }
 // How many in-dispatch repairs one stage run may buy. TWO, and the number has a cause: parseFrameDiff
-// is FAIL-FAST — it throws on the first bad severity (frame-diff-model.mjs:66) before it ever collects
-// the undispatchable directives (:100) — so ONE artifact carrying both defects surfaces them
+// is FAIL-FAST — it throws on the first bad severity (parseFrameDiff() in frame-diff-model.mjs) before it ever collects
+// the undispatchable directives — so ONE artifact carrying both defects surfaces them
 // SEQUENTIALLY. That is exactly what the 08-02 frame-diff ladder did (severity on a1, undispatchable
 // on a2), and a cap of 1 would have handed the second one straight back to the ladder. The codebase
 // already learned this lesson once at directive granularity: undispatchableThrow batches ALL offenders
@@ -3201,7 +3279,7 @@ const MAX_FORM_REPAIRS = 2;
 // issue. The coverage-judgment family was COLD-ONLY — WARM_ELIGIBLE_RE carried seven coverage STRUCTURE
 // tokens and not one `coverage_clean_*` — so every retry re-dispatched a fresh session that re-read a
 // 1.9 MB band and re-derived a 160 KB document instead of editing it. The stage's own measured profile
-// (repair-contract.mjs:10-18) is 105,747 out FAIL → 137,519 out FAIL → 36,362 out PASS, and the attempt
+// (repair-contract.mjs, 'WHY THIS EXISTS') is 105,747 out FAIL → 137,519 out FAIL → 36,362 out PASS, and the attempt
 // that passed is the one that PATCHED. A cold ladder never patches.
 // WHY THEY ARE SAFE TO WARM, on the same argument made one gate over: findCoverageFormViolations
 // emits both tokens only over rows the DRIVER wrote from the frozen plan and the plan-execution
@@ -3604,12 +3682,16 @@ export function warmPatchMessage(lastFail, expectFile, { supplementalLane = fals
  * THE COUNTS A TEST ROUND READS PER STAGE, on both engines, spread into `toolGauge`. `toolCallsRefused`:
  * calls the program refused (Claude's own denials; Codex's tool-server calls refused before reaching their
  * server). `commandToolCalls`: calls to a tool that runs a command, which no Claude stage is offered, so
- * zero is the expected reading; Codex keeps its shell and reports null. `mcpToolCalls`: the tool-server
- * calls Codex completed, its only count of calls made, since its `toolCalls` stays null. Null, as in
+ * zero is the expected reading there; Codex keeps its shell and counts the commands it ran. `mcpToolCalls`: the tool-server
+ * calls Codex completed, its only count of calls made, since its `toolCalls` stays null.
+ * `toolCallsErroredByName`: the tool-server calls that came back as an error, by tool name, so a stage that
+ * had a call refused and made it again says so where its row otherwise reads ok on one attempt. Null, as in
  * `toolGauge`, is "this engine does not report", never zero. RECORDING ONLY. It sits at the end of this
  * file so that adding it moved no line another file cites.
  */
 function toolCallCounts(turn) {
   const n = (v) => (Number.isFinite(v) && v >= 0 ? v : null);
-  return { toolCallsRefused: n(turn?.toolCallsRefused), commandToolCalls: n(turn?.commandToolCalls), mcpToolCalls: n(turn?.mcpToolCalls) };
+  const errored = turn?.toolCallsErroredByName;
+  return { toolCallsRefused: n(turn?.toolCallsRefused), commandToolCalls: n(turn?.commandToolCalls), mcpToolCalls: n(turn?.mcpToolCalls),
+    toolCallsErroredByName: errored && typeof errored === "object" && !Array.isArray(errored) ? { ...errored } : null };
 }

package/driver/jx.mjs

@@ -59,7 +59,7 @@ export const jxFoldLaneRecord = ({ cause = null, ...rest } = {}) => ({
 // silent in the fold. One record spoke and the other could not.
 //
 // TWO FIELDS, BECAUSE ONE CANNOT CARRY BOTH JOBS.
-//   `executes` is a SCALAR STRING, because reference-score.mjs:1103 routes it into the same slot as the
+//   `executes` is a SCALAR STRING, because readJxLanes() in reference-score.mjs routes it into the same slot as the
 //   per-lane `executes` string and scripts/score.mjs interpolates it bare — an object prints
 //   [object Object] there. It names the slices that RAN, "+"-joined, and is NEVER "" (the e2e `exists`
 //   op passes on an empty string, so an all-failed run would have gone green on a statement of nothing).

package/driver/knockout-review-record.mjs

@@ -272,7 +272,7 @@ export function reviewEvidence(merged, about = {}) {
     if (at?.engineOwned || !Object.hasOwn(ADDRESSABLE, at?.field)) continue;
     const flags = plainRegisterFlags(text, about);
     if (!flags.length) continue;
-    rows.push({ at, where, says: flags.map((f) => f.say) });
+    rows.push({ at: offeredAddress(at), where, says: flags.map((f) => f.say) });
   }
   const marks = (about.marks ?? []).filter(Boolean), owners = (about.owners ?? []).filter(Boolean);
   const ownerNote = owners.length ? ` The ${owners.length} owner name(s) from the record were also removed.` : "";
@@ -287,6 +287,60 @@ export function reviewEvidenceLines({ rows }) {
   return rows.map(({ at, where, says }) => `- ${where} — address ${JSON.stringify(at)} — ${says.join(" ")}`);
 }
 
+/**
+ * The lines a reader meets first, each one the pass may write, with the address that names it.
+ *
+ * Handed to the reviewer on a record the driver's read flagged nowhere (owner ruling 2026-10-10). Its
+ * first question is the client's, and it can rewrite toward that answer, or decline, only at an address
+ * it was given: the tool refuses a composed one. The set is the one the flagged table is drawn from,
+ * without the flag, so the engine's own caveats and any field the applier cannot write stay out here too.
+ */
+export function reviewFirstReadRows(merged) {
+  return knockoutVisibleProse(merged)
+    .filter(({ at }) => !at?.engineOwned && Object.hasOwn(ADDRESSABLE, at?.field))
+    .map(({ at, where }) => ({ at: offeredAddress(at), where }));
+}
+
+/**
+ * An address as the seat is told to copy it: the field and the keys that field takes, nothing else.
+ *
+ * The walk marks a standing caveat with `engineOwned`, true or false, to decide what is offered at all.
+ * The grammar refuses any key a field does not take, so an offered address that carried the mark would
+ * be refused when copied verbatim, as the tool tells the seat to copy it.
+ */
+export function offeredAddress(at) {
+  const out = { field: at.field };
+  for (const k of ADDRESSABLE[at.field] ?? []) if (at[k] !== undefined) out[k] = at[k];
+  return out;
+}
+
+/** One line each, the address quoted for the seat to copy back. */
+export function reviewFirstReadLines(rows) {
+  return rows.map(({ at, where }) => `- ${where} — address ${JSON.stringify(at)}`);
+}
+
+/**
+ * What the reviewing pass hands the reviewer, decided before any turn is spent. PURE.
+ *
+ * EVERY KNOCKOUT IS REVIEWED. Flagged lines go as the measured table. A record flagged nowhere hands
+ * over its first-read lines instead, so the client's question is put on every record. Only a record with
+ * no such line at all is not dispatched, because there would be nothing to read and no address to answer.
+ */
+export function reviewDispatch(merged, plan) {
+  const about = reviewAbout(merged, plan);
+  const evidence = reviewEvidence(merged, about);
+  const firstRead = evidence.rows.length ? [] : reviewFirstReadRows(merged);
+  return {
+    about, evidence, flagged: evidence.rows.length, listed: firstRead.length,
+    dispatch: evidence.rows.length > 0 || firstRead.length > 0,
+    msgCtx: {
+      evidenceLines: reviewEvidenceLines(evidence),
+      firstReadLines: reviewFirstReadLines(firstRead),
+      exclusionNote: evidence.exclusionNote,
+    },
+  };
+}
+
 /**
  * The `about` a knockout run is blind to: every name in the batch, and every owner on the record.
  *

package/driver/named-band.mjs

@@ -129,6 +129,10 @@ export function parseNamedBand(raw) {
         // truncate the covered_by pointers with the reason's 400-char cap. Old bands carry neither key.
         ...(b.class_counts && typeof b.class_counts === "object" && !Array.isArray(b.class_counts) ? { class_counts: b.class_counts } : {}),
         ...(Array.isArray(b.covered_by) && b.covered_by.length ? { covered_by: b.covered_by } : {}),
+        // what the total counts, when the register said — carried like the counts it qualifies
+        ...(typeof b.total_counts === "string" ? { total_counts: b.total_counts } : {}),
+        // the register's floor when it answered "at least N": the total above stays null beside it
+        ...(Number.isFinite(b.total_floor) ? { total_floor: b.total_floor } : {}),
         // — THE REFUSAL STAMP SURVIVES THE PROJECTION. `execute-plan.mjs` writes an errored slice
         // as `{state:"incomplete", total_hits:0, fetched:0, error:true}` and says why in its own header:
         // "the error:true stamp (a provider error is never confusable with a sanctioned crowd)". The

package/driver/owner-screen.mjs

@@ -31,7 +31,7 @@
 //
 // PURE (no node imports) so it tests offline, like coverage-ledger.mjs / named-band.mjs.
 
-import { recordQids } from "./named-band.mjs";
+import { recordQids } from "./named-band.mjs"; import { moreThan } from "../shared/register-floor.mjs";
 
 /** Owner-slice states. `enumerated` is the only one that can carry a negative. */
 export const OWNER_SLICE_STATES = ["enumerated", "crowd", "not-run", "missing"];
@@ -95,7 +95,9 @@ export function deriveOwnerScreen(planEntries, blocks, bandRecords, {
       terms: Array.isArray(e.terms) ? e.terms.map(str) : (e.term != null ? [str(e.term)] : []),
       nice_classes: (e.nice_classes ?? []).map(str),
       state,
-      total_hits: Number(block?.total_hits) || 0,
+      // a register's floor ("at least N") is no count: the total stays null and the floor rides beside it
+      total_hits: Number.isFinite(block?.total_floor) ? null : Number(block?.total_hits) || 0,
+      ...(Number.isFinite(block?.total_floor) ? { total_floor: block.total_floor } : {}),
       records: recs.length,
       record_ids: recs.slice(0, recordCap).map((r) => str(r.record_id)).filter(Boolean),
       reason: sliceReason(e, block, deferred.get(qid) ?? null, capabilities),
@@ -103,7 +105,8 @@ export function deriveOwnerScreen(planEntries, blocks, bandRecords, {
       // executor's own descriptor says so, and the screen keeps them apart on the same row.
       portfolio: countEntry ? {
         qid: str(countEntry.qid),
-        total_hits: Number(countBlock?.total_hits) || 0,
+        total_hits: Number.isFinite(countBlock?.total_floor) ? null : Number(countBlock?.total_hits) || 0,
+        ...(Number.isFinite(countBlock?.total_floor) ? { total_floor: countBlock.total_floor } : {}),
         counted: !!countBlock && countBlock.error !== true,
       } : null,
     });
@@ -173,7 +176,7 @@ export function ownerScreenNegative(screen) {
   ];
   if (hit.length) parts.push(`Enumerated WITH records: ${hit.map((o) => `${name(o)} — ${o.records} record(s)`).join("; ")}.`);
   if (zero.length) parts.push(`Enumerated with zero records — a negative may be stated for these owners and ONLY these: ${zero.map(name).join("; ")}.`);
-  if (crowd.length) parts.push(`Count-only (NOT a clean — the slice was never enumerated): ${crowd.map((o) => `${name(o)} — ${o.total_hits} hit(s)`).join("; ")}.`);
+  if (crowd.length) parts.push(`Count-only (NOT a clean — the slice was never enumerated): ${crowd.map((o) => `${name(o)} — ${Number.isFinite(o.total_floor) ? moreThan(o.total_floor) : o.total_hits} hit(s)`).join("; ")}.`);
   if (notRun.length) parts.push(`NOT RUN — no negative may be stated for these owners; the gap is disclosed, never a clean: ${notRun.map((o) => `${name(o)}: ${o.reason ?? "capability absent"}`).join("; ")}.`);
   if (missing.length) parts.push(`Unaccounted for: ${missing.map(name).join("; ")}.`);
   return parts.join(" ");

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.4.0",
+  "version": "0.4.1-beta.1",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/phase0.mjs

@@ -76,15 +76,26 @@ const boundName = (s) => String(s).slice(0, PLAN_MAX_NAME_LENGTH);
 // Refless jobs (ref/tmp absent — allowed since the intake relaxation) get `noref<6-hex>-<mark>`: the hash is
 // of job.id, the sanitized email message-id and the queue's dedup key, so the slug stays unique across
 // same-name marks AND stable across webhook re-delivery + resume. Refed jobs are byte-identical to before.
+//
+// THE SLUG IS THE FIRST PART OF THE RUN ID, AND THE RUN ID IS A URL PATH SEGMENT IN ASCII. Every route that
+// serves a run, and every link a delivery carries, spells the run id as `[A-Za-z0-9._-]`
+// (publish/index.mjs RUN_SEGMENT_RE, the portal's own gate), and refuses anything else: a link the portal
+// would refuse is not built at all. `kebab` keeps every Unicode letter, so a mark written in Greek,
+// Cyrillic, Han or with a letter such as Ł gave a run id no route accepts, and its run was delivered with
+// no report link on any surface. So the mark's part of the slug keeps only what the routes accept. A name
+// whose kebab is already ASCII is untouched, byte for byte, which is every run id minted before this; a
+// name with nothing ASCII left reads `mark`, the knockout slug's own word for that case. The reference
+// prefix and the codename keep the run id unique, as they always have: the mark only makes it readable.
+const asciiMark = (slug) => slug.replace(/[^a-z0-9-]+/g, "").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "") || "mark";
 export function deriveSlug(job) {
   const raw = boundName(String(job.ref ?? job.tmp ?? "").toLowerCase().replace(/[^a-z0-9]/g, ""));
   const mark = kebab(boundName(job.markName ?? job.name ?? job.marks?.[0]?.name ?? "mark"));
   if (!raw) {
     const h = createHash("sha256").update(String(job.id ?? mark)).digest("hex").slice(0, 6);
-    return `noref${h}-${mark}`;
+    return `noref${h}-${asciiMark(mark)}`;
   }
   const tmp = raw.startsWith("tmp") ? raw : `tmp${raw}`;
-  return `${tmp}-${mark}`;
+  return `${tmp}-${asciiMark(mark)}`;
 }
 
 // Calendar date in Europe/Zurich (the firm's timezone), YYYY-MM-DD.

package/driver/pipeline-knockout.mjs

@@ -57,7 +57,7 @@ import { registerUnavailableOffices } from "./register-unreachable.mjs";
 import { runRecordLogPath } from "../providers/_shared/ledger-path.mjs";   // — this run's record log
 import { beginAnswerMemory, endAnswerMemory } from "../providers/_shared/answer-memory.mjs";
 import { validators as koValidators, validateMergedFindings, worstBand, registerSurfacedFilings, raterCaveats, SURVIVOR_BOUNDARY_RE } from "./verify-knockout.mjs";
-import { reviewAbout, reviewEvidence, reviewEvidenceLines, applyKnockoutReview, knockoutReviewFile } from "./knockout-review-record.mjs";
+import { reviewDispatch, applyKnockoutReview, knockoutReviewFile } from "./knockout-review-record.mjs";
 import { stripNextStepSections } from "./knockout-next-step.mjs";
 import { publishKnockout, composeKnockoutEmail } from "./publish/knockout.mjs";
 import { writeRunStatus, readRunStatus, rollupStatus, atomicWrite, identitySeed } from "./progress.mjs";   // — the identity seed is shared; the stepper is not
@@ -188,22 +188,24 @@ export function readBackLadder(ctx, sidecarPath, { minted }) {   // exported for
  * pass is presentation. A refusal is never a pass, and "no report" is a product failure — so the last
  * thing added to the delivery path is the last thing that should be able to stop it.
  *
- * THE EMPTY CASE IS NOT A FAILURE AND IS NOT SILENT. A batch whose default-visible lines are all already
- * plain has nothing to dispatch, and paying for a turn to be told so is waste. It is logged with the
- * count, so "nothing was flagged" and "the pass never ran" are different rows in the journal rather than
- * one absent one.
+ * EVERY KNOCKOUT IS REVIEWED, by the owner's ruling of 2026-10-10. The reviewer's first question is the
+ * client's, and a record whose wording the driver's read flagged nowhere still gets it: the reviewer is
+ * handed the lines a reader meets first, with their addresses, and rewrites toward the client's question
+ * or declines at one of them. Only a record with no such line at all is not dispatched. That is logged
+ * with its counts, so "there was nothing to read" and "the pass never ran" are different rows in the
+ * journal rather than one absent one.
  */
 async function knockoutReviewingPass({ ctx, run, K, merged, plan }) {
-  const about = reviewAbout(merged, plan);
-  const evidence = reviewEvidence(merged, about);
-  if (!evidence.rows.length) {
-    runLog(run.runDir, { event: "knockout-review", outcome: "nothing-flagged", flagged: 0,
+  const d = reviewDispatch(merged, plan);
+  const { about } = d;
+  if (!d.dispatch) {
+    runLog(run.runDir, { event: "knockout-review", outcome: "nothing-flagged", flagged: 0, listed: 0,
       marks: merged.marks.length, excludedMarks: about.marks.length, excludedOwners: about.owners.length });
     return merged;
   }
 
   const keep = (outcome, detail) => {
-    runLog(run.runDir, { event: "knockout-review", outcome, flagged: evidence.rows.length, applied: 0,
+    runLog(run.runDir, { event: "knockout-review", outcome, flagged: d.flagged, listed: d.listed, applied: 0,
       delivered: "the rated record, unrewritten", ...detail });
     note(`reviewing pass: ${outcome} — the rated record ships unrewritten`);
     return merged;
@@ -211,7 +213,7 @@ async function knockoutReviewingPass({ ctx, run, K, merged, plan }) {
 
   try {
     await koStage("knockout-review", ctx, {
-      msgCtx: { evidenceLines: reviewEvidenceLines(evidence), exclusionNote: evidence.exclusionNote },
+      msgCtx: d.msgCtx,
     });
   } catch (e) {
     return keep("stage-failed", { reason: String(e?.message ?? e).slice(0, 200) });
@@ -228,7 +230,7 @@ async function knockoutReviewingPass({ ctx, run, K, merged, plan }) {
   if (!mv.ok) return keep("rewrite-refused-by-the-merged-gate", { failures: mv.failures.slice(0, 5) });
 
   atomicWrite(K.findings, JSON.stringify(doc, null, 2) + "\n");
-  runLog(run.runDir, { event: "knockout-review", outcome: "applied", flagged: evidence.rows.length,
+  runLog(run.runDir, { event: "knockout-review", outcome: "applied", flagged: d.flagged, listed: d.listed,
     applied: receipt.applied, declined: receipt.declined,
     unresolved: receipt.unresolved.length, refused: receipt.refused.length,
     excludedMarks: about.marks.length, excludedOwners: about.owners.length });
@@ -1209,7 +1211,7 @@ export async function knockoutInner(ctx, job, opts = {}) {
       // ONE LINE, N LINKS. This said "Report: <one url>" and on a batch that url is now null, which would
       // have read "Report: null" — the fail-visible shape doing its job, and still not a line to send. A
       // batch names every report it produced, in the order the names were ordered.
-      whatsappText: `✅ Knockout screen${refTag} of ${nMarks} mark(s) is done — worst band ${overall}. `
+      whatsappText: `✅ Knockout screen${refTag} of ${nMarks} mark(s) is done — ${nMarks === 1 ? "rating" : "highest rating"} ${overall}. `
         + (published.reports.length === 1
           ? `Report: ${published.reports[0].url}`
           : `Reports: ${published.reports.map((r) => `${r.mark} ${r.url}`).join(" · ")}`),