clearotron 0.4.0 → 0.4.1-beta.1

package/driver/pipeline.mjs

@@ -5,7 +5,7 @@
 // verdict, and never parks (there is no LLM continuation decision anywhere). CLI: `node pipeline.mjs --job <file.json>`.
 
 import "../shared/env-local.mjs";   // side effect: apply <repo>/.env when THIS file is the CLI entry (never on library import)
-import "./engine/mcp/http-dispatcher.mjs";   // side effect: raise undici headersTimeout (code-side fetches)
+import "./engine/mcp/http-dispatcher.mjs"; import { recordStatusesFromFindings } from "./common-law-coverage-status.mjs";   // side effect: raise undici headersTimeout (code-side fetches); the second records a common-law ledger's statuses in code
 import { readFileSync, existsSync, mkdirSync, writeFileSync, renameSync, copyFileSync, readdirSync, rmSync, statSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { join, dirname, basename, resolve } from "node:path";   // resolve: the resume line must work from any cwd
@@ -72,7 +72,7 @@ import { classifyGroundsNote } from "./grounds-grammar.mjs";   // — a charged
 // — the register coverage form: the driver writes it before the digest dispatches, renders the
 // `## Coverage ledger` table and the machine ledger FROM it after the pass, and unions it across passes.
 import { documentCoverage, renderDocumentCoverageSection, spliceDocumentCoverage } from "./document-coverage.mjs";   //
-import { buildCoverageAbsenceForm, coverageAbsenceGaps, coverageFormAbsence, coverageFormBrief, renderCoverageAbsenceSection, renderCoverageLedgerSection, spliceCoverageLedger, renderCoverageLedgerJsonFromForm } from "./coverage-form.mjs";
+import { buildCoverageAbsenceForm, coverageAbsenceGaps, coverageFormAbsence, coverageFormBrief, renderCoverageAbsenceSection, renderCoverageLedgerSection, spliceCoverageLedger, renderCoverageLedgerJsonFromForm, unitLabel } from "./coverage-form.mjs";
 import { unionCoverageForm } from "./coverage-union.mjs";
 import { armCoverageForm, coverageFormInput, coverageFormPaths, coverageFormStamp, readCoverageForm, readCoverageFormInput, waitingFamilyStates, writeCoverageForm } from "./coverage-form-io.mjs";
 import { releasedFamilyQids, readWithheldFamilies } from "./withheld-families.mjs";   // the waiting families the reading turn released join as dictated entries
@@ -148,6 +148,7 @@ import { beginAnswerMemory, endAnswerMemory } from "../providers/_shared/answer-
 import { findScreenGateViolations, findScreenGateParseGaps, screenGateZeroCause } from "./screen-gate.mjs";
 import { emptyQueue, coerceQueue, mintItem, pendingItems, markFlushed, receiptKeyFor,
   buildFlushFollowup, runPostFlushGateRepair } from "./digest-queue.mjs";   // (t1cd) — the digest-trigger funnel
+import { foldFindingsFile, foldAfterSave, openPass, modelRecordPath, snapshotFold, restoreFold } from "./record-fold.mjs";   // the folded record from the delivery seam on
 import { writeStamp, stageStaleness, restamp, restampStage, staleOnPath, reconcileStamps, shaOf } from "./stage-freshness.mjs";
 import { parseManifestVariants, variantsParseFailure, findCoverageLimitedCells, partitionClosableCells, findSimilarListingSignals,
   GRID_HALVES, GRID_SEATS, MEANING_SEAT, splitGridSpec, halfOfTerm, balanceClosureCells, mergeGrids, mergeCommonLawFindings, openChannelRows,
@@ -2280,7 +2281,7 @@ export function deriveFormNeighbourhood(ctx) {   // @internal — exported for i
   } catch { /* scope ledger optional — markets are informational; no ledger ⇒ nothing dropped (fail-open) */ }
   // NOT scoped here: the transliteration SCRIPT set. `markets` is passed through but never narrows
   // SUPPORTED_SCRIPTS, so latin-diacritic/german/nordic/cyrillic/greek run on every matter regardless of the
-  // jurisdictions judgment applied. That is what generated the five PARADISE diacritics — but the fold-dedupe
+  // jurisdictions judgment applied. That is what generated the five Drivers Haven diacritics — but the fold-dedupe
   // in formNeighbourhood removes them at the source, and the surviving cross-script forms (ß→ss, Cyrillic and
   // Greek homoglyphs) are genuinely distinct strings that cost one term each. Deferred deliberately: narrowing
   // scripts by market is a coverage decision, and the harm it was meant to fix is already gone.
@@ -3933,7 +3934,7 @@ export function findFloorBreaches(ledger, floorAxes) {   // @internal
  * `[]`: no manifest, unreadable, unparseable. That is the honest default here and not an absence read as
  * a pass, because the whole mechanism is opt-in — a run with no designation owes no floor, and a run whose
  * manifest cannot be read has no designation to honour. The refusal for an absent or unparseable manifest
- * belongs to the stage that writes it and already exists there — verify.mjs:1335 runs the same parser
+ * belongs to the stage that writes it and already exists there — validators.variantManifest in verify.mjs runs the same parser
  * through `checkSiblingJson` and fails clearance-variants with `variantmodel_missing`. Checked, because
  * "something else refuses it" is exactly the assumption that turns a swallowed error into a silent pass.
  */
@@ -4802,7 +4803,7 @@ async function stage(name, ctx, opts = {}) {
   let wedgeCycles = 0;
   for (;;) {
     const r = await stageWithChain(name, ctx, opts);
-    if (r.ok || r.fail !== "lane_wedge" || wedgeCycles >= LANE_WEDGE_CHAIN_RETRIES) { sweepStrayArtifacts(ctx, name); return r; }
+    if (r.ok || r.fail !== "lane_wedge" || wedgeCycles >= LANE_WEDGE_CHAIN_RETRIES) { sweepStrayArtifacts(ctx, name); await afterLateSynthesisSave(name, ctx, r); return r; }
     wedgeCycles++;
     note(`[${name}] command-lane wedge — the stage timed out with zero progress (saturated lane). Waiting ${Math.round(LANE_WEDGE_BACKOFF_MS / 1000)}s for it to clear, then re-dispatching (${wedgeCycles}/${LANE_WEDGE_CHAIN_RETRIES}); full per-attempt timeouts preserved.`);
     try { runLog(ctx.paths.runDir, { event: "lane-wedge-retry", stage: name + (ctx.axis ? `:${ctx.axis}` : ""), cycle: wedgeCycles, max: LANE_WEDGE_CHAIN_RETRIES }); } catch { /* telemetry best-effort */ }
@@ -5922,6 +5923,14 @@ function snapshotFindingsForCorrections(P, runDir) {
   try { raw = readFileSync(P.findings, "utf8"); } catch { /* legacy / not-yet-populated */ }
   if (raw == null) return null;
   const sha = createHash("sha256").update(raw).digest("hex");
+  // THE RECORD IN THE MODEL'S NUMBERING, beside the one on disk. The review's flags name findings in the
+  // model's numbering, so the corrective body compares the record the model wrote; once the delivered
+  // record is folded the two differ (record-fold.mjs). The fold is held too, for a rollback to put back.
+  const modelAt = modelRecordPath(runDir, P.findings);
+  let modelRaw = raw;
+  if (modelAt !== P.findings) { try { modelRaw = readFileSync(modelAt, "utf8"); } catch { modelRaw = raw; } }
+  const model = { raw: modelRaw, sha: modelRaw === raw ? sha : createHash("sha256").update(modelRaw).digest("hex") };
+  const fold = snapshotFold(runDir);
   try {
     const tmp = driverDir(runDir, "findings-pre-corrective.json.tmp");
     // PR-4 (snapshot-before-overwrite): store the FULL pre-corrective text, not just its sha — a
@@ -5931,7 +5940,7 @@ function snapshotFindingsForCorrections(P, runDir) {
     writeFileSync(tmp, JSON.stringify({ ts: new Date().toISOString(), sha, text: raw }, null, 2));
     renameSync(tmp, driverDir(runDir, "findings-pre-corrective.json"));
   } catch { /* advisory sidecar */ }
-  return { raw, sha };
+  return { raw, sha, model, fold };
 }
 /**
  *, T3b — THE CORRECTIVE PASS FAILED VALIDATION. RESTORE THE LAST GOOD STATE.
@@ -5979,6 +5988,7 @@ export function rollbackCorrectivePass(P, runDir, pre, fail) {   // @internal
     // Atomic, like every other write to this file: a half-restored findings.json is a worse state than
     // either of the two this is choosing between.
     atomicWrite(P.findings, pre.raw);
+    if (pre.fold) restoreFold(runDir, pre.fold);   // the record the model wrote and the map, as they stood
   }
   const record = { ts: new Date().toISOString(), reason: String(fail?.fail ?? "failed").slice(0, 200),
     restored: changed, preSha: pre.sha, failedSha: nowSha };
@@ -6023,9 +6033,11 @@ export function rollbackCorrectivePass(P, runDir, pre, fail) {   // @internal
  */
 export function repairUnnamedRemovals(P, runDir, pre, namedOrdinals, namedMarks, namedLines = []) {   // @internal
   if (!pre?.raw) return null;                                   // nothing held — nothing to compare against
+  // In the model's numbering: the flags name its ordinals, and a folded record renumbers, so a finding
+  // removed from the folded record would shift every ordinal after it (record-fold.mjs).
   let preDoc = null, postDoc = null, postRaw = null;
-  try { preDoc = JSON.parse(pre.raw); } catch { return null; }
-  try { postRaw = readFileSync(P.findings, "utf8"); postDoc = JSON.parse(postRaw); } catch { return null; }
+  try { preDoc = JSON.parse(pre.model?.raw ?? pre.raw); } catch { return null; }
+  try { postRaw = readFileSync(modelRecordPath(runDir, P.findings), "utf8"); postDoc = JSON.parse(postRaw); } catch { return null; }
   if (!preDoc || !postDoc || typeof postDoc !== "object") return null;
 
   const norm = (s) => String(s ?? "").toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
@@ -6095,6 +6107,7 @@ export function repairUnnamedRemovals(P, runDir, pre, namedOrdinals, namedMarks,
     leftRemoved: leftRemoved.map(brief),
   };
   atomicWrite(P.findings, JSON.stringify(merged, null, 2) + "\n");
+  foldAfterSave(runDir, P.findings);   // after the seam the repaired record is folded again, as a save's is
   try { atomicWrite(driverDir(runDir, "corrective-repair.json"), JSON.stringify(record, null, 2) + "\n"); }
   catch { /* sidecar is best-effort; the runLog event is the record that decides */ }
   return record;
@@ -6218,10 +6231,11 @@ async function enforceCorrectionsReachFindings(ctx, P, pre, resume) {
   const named = correctionNamedSet(P);
   const readState = () => {
     let raw = null, corrections = null;
-    try { raw = readFileSync(P.findings, "utf8"); } catch { return { stale: false }; }
+    // the record the model wrote: a change the fold hides is still a change it made (record-fold.mjs)
+    try { raw = readFileSync(modelRecordPath(run.runDir, P.findings), "utf8"); } catch { return { stale: false }; }
     try { corrections = parseFindingsJsonLenient(raw).corrections; } catch { /* shape defects ride the normal ladder */ }
     const sha = createHash("sha256").update(raw).digest("hex");
-    return { stale: named.length > 0 && sha === pre.sha && !(corrections && corrections.applied), sha };
+    return { stale: named.length > 0 && sha === (pre.model?.sha ?? pre.sha) && !(corrections && corrections.applied), sha };
   };
   if (!readState().stale) return;
   note(`[corrections] findings.json unchanged after the corrective pass (review names: ${named.join(", ")}) — demanding the re-emit`);
@@ -7014,7 +7028,7 @@ export function coverageRowAreaLabel(axis, unit) {   // @internal
   return coverageRowAreaFrom(axis, unit, labelled, "(all of it)");
 }
 
-export function coverageJudgmentRows(ledgerRows, planExecution) {   // @internal
+export function coverageJudgmentRows(ledgerRows, planExecution, plan = null) {   // @internal
   const open = [];
   for (const r of ledgerRows ?? []) {
     // `withheld-by-judgment` joins `confirmed-clean` in NOT reaching the reader, and for the opposite
@@ -7040,13 +7054,13 @@ export function coverageJudgmentRows(ledgerRows, planExecution) {   // @internal
     const host = axisOf.has(q) ? open.find((o) => o.axis === axisOf.get(q)) : null;
     if (host) { host.qids.push(q); claimed.add(q); }
   }
-  // The qid rides VERBATIM wherever it lands. It is the identifier the plan, the receipt and every gate
-  // join on, and a shortened one is a row nobody can match back to the query that did not run.
+  // A claimed qid is printed nowhere: the plan-execution receipt keeps it for every gate to join on, and a
+  // row a lawyer reads names its slice, never an engine identifier (ruled 2026-10-01). One row per slice.
   const rows = open.map((o) => ({ area: o.area, ...(o.areaLabel ? { areaLabel: o.areaLabel } : {}),
-    note: o.qids.length ? `${o.note} (no band block for: ${o.qids.join(", ")})` : o.note }));
+    note: o.note }));
   for (const qid of Array.isArray(planExecution?.missing) ? planExecution.missing : []) {
     const q = String(qid ?? "").trim();
-    if (q && !claimed.has(q)) rows.push({ area: q, note: "planned and not executed this run — the funnel produced no band block for this query" });
+    if (q && !claimed.has(q)) rows.push({ area: q, ...orphanAreaLabel(q, axisOf.get(q), plan), note: "planned and not executed this run" });
   }
   return rows.filter((r) => r.area && r.note);
 }
@@ -7060,7 +7074,7 @@ export function stampCoverageJudgmentRows(P, runDir, note, ctx) {   // @internal
       runLog(runDir, { event: "coverage-judgment-rows", judgment: false, reason: "synthesis emitted no coverage_judgment — none is invented here" });
       return;
     }
-    const rows = coverageJudgmentRows(loadCoverageLedger(runDir).rows, readPlanExecution(ctx));
+    const rows = coverageJudgmentRows(loadCoverageLedger(runDir).rows, readPlanExecution(ctx), ctx?.registerPlan ?? null);
     const discarded = Array.isArray(cj.rows) ? cj.rows.length : 0;
     const next = { ...doc, coverage_judgment: { ...cj } };
     if (rows.length) next.coverage_judgment.rows = rows;
@@ -7136,7 +7150,7 @@ function injectDeferralCoverage(P, runDir, note) {
 // the two constants below BYTE-FOR-BYTE, which is why they stay exported and are asserted against the
 // derivation in the tests.
 //
-// SERP_LANES is deliberately untouched: zh-only there is the shipped design (jx-lanes.mjs:72-74), not
+// SERP_LANES is deliberately untouched: zh-only there is the shipped design (SERP_LANES declared in jx-lanes.mjs), not
 // drift, and generalising the platform grid is a different piece of work.
 //
 // ── THE REMEDY CLAUSE NAMES A PRODUCT, AND FOR A WHILE IT NAMED A DELETED ONE ───────────────────────
@@ -7231,7 +7245,7 @@ export function scriptLaneRanOnRun(runDir, lane, { searchPolicy = null, env = pr
   //   zh  — shipped the full Phase-4 deepening: the SERP platform grid and the native read. Either
   //         unit running IS the lane running (they gate independently; one on and one off still
   //         searched in Chinese), so the legs stay exactly as they were.
-  //   ja/ko — shipped as slice-1 CANDIDATE lanes only (jx-lanes.mjs:32-35): no SERP_LANES entry, so
+  //   ja/ko — shipped as slice-1 CANDIDATE lanes only (LANGUAGE_LANES declared in jx-lanes.mjs): no SERP_LANES entry, so
   //         runJxSerpGrid hard-refuses them and neither unit flag can ever describe them. The only
   //         work these lanes do is the candidate fold, so "ran" is the fold having ACCEPTED
   //         candidates — a frozen lane decision with an empty fold searched nothing and owes the row.
@@ -7477,26 +7491,15 @@ function enrichFindingDeadlines(P, runDir, note, { nowMs = Date.now(), withinDay
   }
 }
 
+// THE SEAM'S FOLD. From here on every accepted save folds the record again on acceptance, so the record
+// the reviewer, the cards and the delivery read stays folded (record-fold.mjs, design 2026-10-03). doc 50 —
+// on a v4 record the merge base is the WORST BAND by the frozen manifest's order. No duplicates leave the
+// file byte-identical; a folded shape that does not validate keeps the record as written.
 function consolidateFindingsFile(P, note, manifest = null) {
-  try {
-    if (!existsSync(P.findings)) return;
-    const doc = JSON.parse(readFileSync(P.findings, "utf8"));
-    if (!doc || !Array.isArray(doc.findings) || doc.findings.length < 2) return;
-    // doc 50 — on a v4 record the merge base is the WORST BAND by the frozen manifest's order
-    const { findings, merges, ordinalMap } = consolidateFindings(doc.findings, (doc.schema_version ?? 1) >= 4 ? manifest : null);
-    if (!merges.length) return;                                  // no duplicates → leave the file byte-identical
-    const next = { ...doc, findings };
-    // spec 64 — actions follow the renumber: a merged-away ordinal remaps to its kept finding's new
-    // ordinal (the action still applies to the consolidated conflict — dropping the reference would
-    // silently un-condition a live demand).
-    if (Array.isArray(doc.actions)) next.actions = remapActionOrdinals(doc.actions, ordinalMap);
-    parseFindingsJson(JSON.stringify(next));                     // re-validate the consolidated shape (throws → catch keeps original)
-    atomicWrite(P.findings, `${JSON.stringify(next, null, 2)}\n`);   // B5 — a crash mid-write must never leave a truncated findings.json
-    for (const m of merges)
-      note(`[consolidate] ${m.owner} — ${m.mark}: folded ${m.dropped.length} duplicate filing(s) (ord ${m.dropped.join(", ")}) into one card`);
-  } catch (e) {
-    note(`[consolidate] skipped: ${String(e?.message || e).replace(/\s+/g, " ").slice(0, 100)}`);
-  }
+  const { merges, error } = foldFindingsFile(P.runDir, P.findings, manifest, { seam: true });
+  for (const m of merges)
+    note(`[consolidate] ${m.owner} — ${m.mark}: folded ${m.dropped.length} duplicate filing(s) (ord ${m.dropped.join(", ")}) into one card`);
+  if (error) note(`[consolidate] skipped: ${error.slice(0, 100)}`);
 }
 // minor (a): a finding earns a FULL prose card when composite ≥ 3 (on-field) OR level ∈ {A,B} (high legal
 // exposure even at a low practical composite — a mis-rated-low mark must not be reduced to a structured-only row).
@@ -8495,9 +8498,15 @@ function postponeRun(e, run, meta = {}) {
  * PURE: a job in, a plain object out, no IO.
  */
 export function instructedScopeOf(job) {
-  const markNames = Array.isArray(job?.marks)
-    ? job.marks.map((m) => (typeof m === "string" ? m : m?.name)).filter(Boolean)
-    : (job?.markName ?? job?.name ?? null);
+  // THE MARKS ARE ALWAYS A LIST. A job that names its mark only as `markName` — a queue file written by
+  // hand or by a forwarding agent, a resume rebuilt from status.json — recorded the bare string, and the
+  // declination tool's identical-mark refusal reads a list, so on those runs it saw no mark and never
+  // fired. An array that names no mark falls back the same way the intake gate does; null when nothing
+  // names one.
+  const named = Array.isArray(job?.marks)
+    ? job.marks.map((m) => (typeof m === "string" ? m : m?.name)).filter(Boolean) : [];
+  const single = job?.markName ?? job?.name ?? null;
+  const markNames = named.length ? named : (single ? [single] : null);
   return {
     marks: markNames,
     classes: job?.classes ?? null,
@@ -8793,6 +8802,9 @@ async function pipelineInner(job, opts = {}) {
   // BEFORE doc 50 backfills its framework sidecar from the frozen frameworkPath (deploy-boundary case) so
   // the v4 gates always have vocabulary; a run that already has one reads it verbatim (never re-derived).
   attachFramework(ctx);
+  // A pass opens before the delivery seam: until this pass's seam folds the record, a save writes the
+  // model's record as it is (record-fold.mjs).
+  openPass(ctx.paths.runDir);
 
   // ── (t1cd): the digest-trigger FUNNEL ──────────────────────────────────────────────────────
   // The digest-trigger funnel (; flag deleted post-E2E 2026-07-22): the queue
@@ -8935,7 +8947,7 @@ async function pipelineInner(job, opts = {}) {
   // frame validator compares against THIS file, never against the frame's own paraphrase) —
   // paraphrase drift between the request and the frame is a defect, not a style choice.
   try {
-    writeFileSync(P.instructedScope, JSON.stringify(instructedScopeOf(job), null, 2) + "\n");
+    const scope = instructedScopeToWrite(job, { jobRebuiltFromStatus: opts.jobRebuiltFromStatus, scopeOnDisk: existsSync(P.instructedScope) }); if (scope) writeFileSync(P.instructedScope, JSON.stringify(scope, null, 2) + "\n");
   } catch (e) { note(`instructed-scope write failed (non-fatal): ${e.message}`); }
   // THE STORED DEFAULTS THE ENGINE CANNOT SEARCH — recorded by the run, not only by the plan preview.
   //
@@ -9217,7 +9229,7 @@ async function pipelineInner(job, opts = {}) {
           : stage(g.name, { ...ctx, axis: g.axis })),
       stage("blind-frame", ctx).catch((e) => ({ ok: false, fail: String(e?.message ?? e) })),
     ]);
-    if (!blindRes.ok) {
+    if (!clSplit && clMember()?.ok) recordStatusesFromFindings(P.commonLaw); if (!blindRes.ok) {
       note(`blind-frame failed (non-fatal — no frame-diff/reopen this run): ${blindRes.fail}`);
       runLog(run.runDir, { event: "blind-frame-skipped", reason: blindRes.fail });
     }
@@ -9345,7 +9357,7 @@ async function pipelineInner(job, opts = {}) {
     // synthesis, replay) reads exactly the artifacts a single-member run would have written. Re-run after
     // every routed half followup (closure / frame-reopen) — the half files stay the source of truth and
     // the canonical pair is always derived, which also makes the merge resume-idempotent.
-    const mergeCommonLawArtifacts = !clSplit ? null : ({ discloseUnfinished = false } = {}) => {
+    const mergeCommonLawArtifacts = !clSplit ? null : ({ discloseUnfinished = false } = {}) => { for (const h of GRID_HALVES) recordStatusesFromFindings(P.commonLawHalf(h), { half: h });   // each half's ledger statuses, recorded by code where the seat made no call (ruling 2026-10-01)
       // Each half's coverage truth = its plugin-written main ledger FOLDED with any plugin-written
       // supplementary sibling(s) the closure lane produced. Returns the batches as an ARRAY (mergeGrids'
       // batchesOf flattens it, cells union across all of them); a missing/corrupt main leaves its cells to
@@ -9424,7 +9436,7 @@ async function pipelineInner(job, opts = {}) {
       //
       // The prior channel is the TRUSTED one and already carries everything needed. Half forms are
       // driver-written, `seatFields(p, row)` carries their rulings by the same `pOk` path, and
-      // gateway.mjs:603 already unions this exact shape — prior-only, `{ rows: null }` submitted — on
+      // syncDispositionForm() in gateway.mjs already unions this exact shape — prior-only, `{ rows: null }` submitted — on
       // every attempt. So this is that mode, not a new one.
       //
       // ONE METRIC MOVES, deliberately: with no submission, `carried` counts every ruled row, because
@@ -12644,9 +12656,9 @@ async function pipelineInner(job, opts = {}) {
       // always did, which is today's behaviour exactly.
       try {
         const rows = parseCorrections(readFileSync(P.seniorEyeReview, "utf8"));
-        const preDoc = preCorrective ? parseFindingsJsonLenient(preCorrective.raw) : null;
+        const preDoc = preCorrective ? parseFindingsJsonLenient(preCorrective.model?.raw ?? preCorrective.raw) : null;   // the flags name the model's ordinals, so both sides are the record the model wrote (record-fold.mjs)
         let postDoc = null;
-        try { postDoc = parseFindingsJsonLenient(readFileSync(P.findings, "utf8")); } catch { /* shape defects ride the normal ladder */ }
+        try { postDoc = parseFindingsJsonLenient(readFileSync(modelRecordPath(run.runDir, P.findings), "utf8")); } catch { /* shape defects ride the normal ladder */ }
         correctionsApplied = buildCorrectionsApplied(rows, preDoc, postDoc);
         // — A CLAIM MAY NOT OUTLIVE ITS EVIDENCE, AND A DEMOTED STAMP MAY NOT COME BACK.
         //
@@ -13473,6 +13485,9 @@ async function pipelineInner(job, opts = {}) {
     // structured-only). Each stage is file-gated/resumable; per-card sessions feed the lint repair below.
     // C2 — fold same-owner+same-mark duplicate filings into one finding BEFORE the overview + cards read
     // findings.json, so the whole delivery phase (and the published copy) sees the single consolidated set.
+    // THE SEAM'S WRITES ARE ONE CLOSURE, so they can run again: a synthesis save after this point rewrites
+    // findings.json from the seat's own call, and every write below went with it (`stage()` re-runs them).
+    const seamWrites = async () => {
     injectDeferralCoverage(P, run.runDir, note); injectMeaningGapCoverage(P, run.runDir, note);   // A3: unclosed reopen directives, and meaning searches that did not complete, become reader-visible coverage rows first
     // qw/cn-scope-honesty — the sibling injection: a CN-family-scope run whose zh lane did not run
     // discloses what the native-language investigation would have searched, and where it is offered
@@ -13528,6 +13543,15 @@ async function pipelineInner(job, opts = {}) {
       try { writeVerdictSidecar(); }
       catch (e2) { throw new StageFailure("verdict", `verdict sidecar refresh failed after consolidation: ${String(e2.message).slice(0, 120)}`); }
     }
+    };
+    await seamWrites();
+    // Every write above is idempotent: each injection skips a row the record already carries, the stamp
+    // replaces its rows, and the fold leaves a folded record as it is.
+    ctx.afterSynthesisSave = async () => {
+      note(`[seam] a synthesis save after the seam rewrote findings.json — re-applying the seam's writes`);
+      runLog(run.runDir, { event: "seam-reapplied", after: "synthesis-save" });
+      await seamWrites();
+    };
     // wp50/wi2 — the overview PROSE must speak the derived tier (VENZY: caption said "High risk" while
     // every code surface said VERY HIGH). Thread the just-refreshed sidecar into the stage prompt; the
     // deterministic backstop is predelivery-lint's overallTierChecks.
@@ -14390,6 +14414,13 @@ async function pipelineInner(job, opts = {}) {
             lintActions = soft.actions ?? null; lintAskAnswers = soft.askAnswers ?? null; lintFourAnswers = soft.fourAnswers ?? null;
           } } catch { /* validators.findings owns the unparseable case */ }
         }
+        // The narrative's finding headings are in the model's numbering: once the record is folded, its
+        // write-ups join the record the model wrote (record-fold.mjs).
+        let lintNarrativeFindings = null;
+        const lintModelAt = modelRecordPath(run.runDir, P.findings);
+        if (lintModelAt !== P.findings) {
+          try { lintNarrativeFindings = parseFindingsJsonLenient(readFileSync(lintModelAt, "utf8")).findings; } catch { lintNarrativeFindings = null; }
+        }
         // wp50/wi2 — the sidecar tier joins the lint so overall-level prose can't contradict it.
         let lintVerdict = null;
         try { lintVerdict = JSON.parse(readFileSync(driverDir(run.runDir, "verdict.json"), "utf8")); } catch { /* legacy */ }
@@ -14413,7 +14444,7 @@ async function pipelineInner(job, opts = {}) {
           // is presence-gated and simply emits nothing here; they stay alive for replay-archive.mjs,
           // which passes the archived summary.
           reportMd, narrativeMd, auditMd, recordsByUri: assembled.records, searchedNames,
-          fetchFailures: recordFetchFailures, findings: lintFindings, findingsRaw: lintFindingsRaw, actionsRegister: lintActions, verdictDoc: lintVerdict,
+          fetchFailures: recordFetchFailures, findings: lintFindings, narrativeFindings: lintNarrativeFindings, findingsRaw: lintFindingsRaw, actionsRegister: lintActions, verdictDoc: lintVerdict,
           // WP-56 B2 — fresh v4 runs expect the standing mark-assessment (structural banner flag when
           // absent). The replay harness's runLint call never passes this, so archived runs never flip.
           markAssessment: lintMarkAssessment, markAssessmentExpected: lintSv >= 4,
@@ -16002,6 +16033,20 @@ export function reconstructCtx(job, opts) {   // @internal
   return ctx;
 }
 
+/**
+ * The aim count the cold pass sets before synthesis (`ctx.jxAim`), set on a reconstructed context from the
+ * same function and behind the same gate. It lives here rather than in reconstructCtx because the lane
+ * module is only ever imported lazily and reconstructCtx is synchronous. Without it a synthesis arm on a run
+ * whose pass carried the Chinese-evidence block dispatched without it. Returns the count it set, or null.
+ */
+export async function attachJxAim(ctx) {   // @internal
+  if (!ctx?.searchPolicy?.components?.jxLanes) return null;
+  const { jxAimForSynthesis } = await import("./jx-units.mjs");
+  const aim = jxAimForSynthesis(ctx.paths.runDir);
+  if (aim) ctx.jxAim = aim.count;
+  return aim ? aim.count : null;
+}
+
 // Copy a stage's about-to-be-overwritten output (+ its per-stage telemetry) into _history/<ts>-<reason>/ so a
 // prior result is NEVER lost and stays comparable. Returns the snapshot dir (or null if there was no output).
 //
@@ -16055,6 +16100,7 @@ export async function repairStale(job, opts = {}) {   // @internal
   const labels = Array.isArray(rec?.labels) ? rec.labels : [];
   if (!labels.length) return null;
   attachFramework(ctx, { write: true });
+  await attachJxAim(ctx);   // the aim count the cold pass sets, as --experiment sets it on its rebuilt context
   // RE-DERIVE THE ORDER rather than trusting the file's. The recorded order was right when it was
   // written, and a code change since could have moved an edge — the file names WHAT, the live graph says
   // WHEN. (the file names WHAT, the live graph says WHEN)
@@ -16198,6 +16244,7 @@ async function runExperimentInner(job, opts) {
   if (opts.dispatchTrigger != null && !DISPATCH_TRIGGERS.includes(opts.dispatchTrigger))
     throw new Error(`--dispatch-trigger: unknown value "${opts.dispatchTrigger}" — it decides which production pass the arm reproduces, so a typo would compose a quietly different prompt. One of: ${DISPATCH_TRIGGERS.join(", ")}`);
   const ctx = reconstructCtx(job, opts);
+  await attachJxAim(ctx);   // read off the canonical run, as the cold pass reads it; the file itself is a sandbox edge
   const model = opts.model ?? (axis ? axisTier(axis).model : STAGES[name].model);
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const tag = [name, axis, opts.label ? kebab(opts.label) : null].filter(Boolean).join("-");
@@ -16729,7 +16776,7 @@ if (isEntrypoint(import.meta.url)) void (async () => {
   // rate-limit catch already finds the run to postpone; the same hook lets a THROWN exit name the run.
   const opts = a.experiment
     ? { ...base, codename: a.codename, experiment: a.experiment, model: a.model, instructions: a.instructions, axis: a.axis, label: a.label, dispatchTrigger: a.dispatchTrigger }
-    : { ...base, codename: a.codename, fromStage: a.fromStage };
+    : { ...base, codename: a.codename, fromStage: a.fromStage, ...(a.job ? {} : { jobRebuiltFromStatus: true }) };
   const script = resolve(fileURLToPath(import.meta.url));
   // `jobPath` is null on a rebuilt resume, so the advice composes a command that does not name a file
   // the box does not have — which is the whole defect this path exists to close, and printing it again
@@ -16909,3 +16956,40 @@ export function injectMeaningGapCoverage(P, runDir, note) {   // @internal — e
     note(`[common-law] meaning-gap coverage skipped: ${String(e?.message || e).replace(/\s+/g, " ").slice(0, 100)}`);
   }
 }
+
+/**
+ * A SYNTHESIS SAVE AFTER THE SEAM (the pre-delivery narrative redo, the in-pass stale repair) rewrites
+ * findings.json from the seat's own call, and the seam's writes go with it: the coverage-judgment rows, the
+ * injected coverage rows, the fold. The seam leaves them on the run's context, and they run again here,
+ * before anything downstream reads the record. Before the seam there is nothing on the context, so nothing
+ * runs. It sits at the end of this file so that adding it moved no line another file cites.
+ */
+async function afterLateSynthesisSave(name, ctx, r) {
+  if (r?.ok && !r.skipped && name === "synthesis" && typeof ctx?.afterSynthesisSave === "function") await ctx.afterSynthesisSave();
+}
+
+/**
+ * The reader's name for a planned search that never ran and that no open ledger row on its axis claims —
+ * the orphan row of `coverageJudgmentRows`. Its area is the plan's qid, which a lawyer cannot read; the
+ * label is composed the way the workbook's released-family rows compose theirs (publish/index.mjs
+ * releasedFamilyRows): the plan entry's unit in the coverage form's grammar, its axis head in the reader's
+ * words. `{}` when the frozen plan does not carry the entry, so the row keeps the identifier and nothing is
+ * invented in its place. PURE.
+ */
+function orphanAreaLabel(qid, axis, plan) {
+  const entry = (Array.isArray(plan?.entries) ? plan.entries : []).find((e) => e?.qid === qid);
+  if (!entry) return {};
+  const label = coverageUnitLabel(unitLabel(axis || entry.axis, entry));
+  return label && label !== qid ? { areaLabel: label } : {};
+}
+
+/**
+ * The instructed scope this run writes, or null to keep the one already on disk. A resume that rebuilt its
+ * job from status.json holds only the job's identity (id, reference, mark, classes, forwarder), so writing
+ * the scope from it would replace the order's goods, customer and territories with nothing, and every
+ * later reader of the scope would see a narrower matter than was ordered. Such a resume keeps the scope the
+ * run started with. A job read from a file, or a run with no scope yet, writes as before. PURE.
+ */
+export function instructedScopeToWrite(job, { jobRebuiltFromStatus = false, scopeOnDisk = false } = {}) {   // @internal
+  return jobRebuiltFromStatus && scopeOnDisk ? null : instructedScopeOf(job);
+}

package/driver/portal-families.mjs

@@ -18,8 +18,8 @@
 // ── the shape ────────────────────────────────────────────────────────────────────────────────────────
 //
 //   { "schema": 1,
-//     "families": { "hydra-range": { "name": "Hydra range", "account": "foxglade" } },
-//     "of":       { "<runId>": "hydra-range" } }
+//     "families": { "aqua-range": { "name": "Aqua range", "account": "foxglade" } },
+//     "of":       { "<runId>": "aqua-range" } }
 //
 // Keyed by RUN rather than by mark. A mark is not a thing the pool stores — it is a grouping the browser
 // derives from run metadata — so a run id is the only stable handle the two sides already agree on. The
@@ -39,7 +39,7 @@ const FILE = "family-tags.json";
 // Caught by a test asserting a malformed file degrades to no families; it degraded to someone else's.
 const empty = () => ({ schema: 1, families: {}, of: {} });
 
-/** Ids are derived from the name so that grouping into "Hydra range" twice MERGES rather than duplicating. */
+/** Ids are derived from the name so that grouping into "Aqua range" twice MERGES rather than duplicating. */
 export function familyId(name) {
   return String(name ?? "")
     .normalize("NFKD")

package/driver/portal-service.mjs

@@ -131,7 +131,7 @@ const INSTALL_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
 const READ_OFF_NOTE = "Reading a brief is not available on this instance — set the search up below.";
 import { basename, dirname, join, resolve as pathResolve } from "node:path"; import { studioDirFor } from "../shared/pre-rename-spellings.mjs";
 import { driverDir } from "../shared/driver-dir.mjs";   //
-import { createHmac, timingSafeEqual } from "node:crypto";
+import { createHmac, timingSafeEqual, randomBytes } from "node:crypto";
 import { makePrincipal, assertPrincipal, genericOrgOf, mayReadRun, reachCovers, principalView, seesEverything, mayRun,
   PortalDeny } from "./portal-access.mjs";
 // — the THIRD identity source (after the CF Access edge and, until, the deleted bypass). It
@@ -220,7 +220,7 @@ export function jobHashOf(job) {
   })).digest("base64url");
 }
 export function mintConfirmation({ secret, account, email, jobHash, now = Date.now(), ttlMs = 10 * 60 * 1000 }) {
-  const jti = createHmac("sha256", secret).update(`${account}|${jobHash}|${now}|${Math.random()}`).digest("base64url").slice(0, 24);
+  const jti = createHmac("sha256", secret).update(`${account}|${jobHash}|${now}|${randomBytes(16).toString("hex")}`).digest("base64url").slice(0, 24);
   const payload = { account, email, jobHash, jti, exp: now + ttlMs };
   const body = Buffer.from(canonical(payload)).toString("base64url");
   const sig = createHmac("sha256", secret).update(body).digest("base64url");
@@ -1395,7 +1395,7 @@ export function makePortalService({
       //
       // DISPLAY NAMES, computed server-side, because five vocabularies sit between a name on the form
       // and an office code (display → normalizeTerritory → canonicalJurisdictionCode → offices.translate
-      // → covered.has) and register-plan.mjs:206-216 records what re-implementing that chain cost.
+      // → covered.has) and resolveRegions() in register-plan.mjs records what re-implementing that chain cost.
       //
       // THE FIELD IS OMITTED, not nulled, when the snapshot does not say. `null` is a real answer here
       // ("no declared restriction") and the browser must be able to tell it from "this deployment has
@@ -3147,7 +3147,7 @@ async function connectorDoorKind(url) {
         //
         // STAFF ONLY, and by construction rather than by filtering: it hangs off /portal/admin, which
         // asserted staffOnly above and 404s for everyone else. That is a decision, not an oversight. A
-        // family name is staff shorthand for a brand line — "Hydra range" can name a launch a client has
+        // family name is staff shorthand for a brand line — "Aqua range" can name a launch a client has
         // not announced — and a grouping a client can see but not edit or explain raises more questions
         // than it answers. Revisit when clients have a reason to care; until then the client's list is
         // exactly the mark list, which is what the browser falls back to when this 404s.
@@ -4620,7 +4620,8 @@ const PORT = PORT_CHOICE.port;
   // stays fail-closed — an empty array would be truthy and open it.
   const AUD = accessAudience(envFrom(process.env, "CLEAROTRON_OIDC_AUDIENCE"));
   // item 1 — THE SAME FOUR VALUES THE STAFF MCP FACE ALREADY READS, under portal-side names
-  // (mcp-server/http-server.mjs:92-95). `makeAccessVerifier` has always accepted them; the portal simply
+  // (OIDC_ISSUER declared in http-server.mjs, and the three read beside it). `makeAccessVerifier` has
+  // always accepted them; the portal simply
   // never passed them, which is how one product shipped a provider-agnostic API face and a
   // Cloudflare-only web portal. Unset ⇒ the CF Access shapes derived from CF_ACCESS_TEAM, exactly as
   // before.

package/driver/predelivery-lint.mjs

@@ -1205,29 +1205,25 @@ export function narrativeWriteUpChecks({ narrativeMd, findings, depth, manifest,
     maxWords: depth?.narrativeWriteUpWords ?? null });
   // AN UNGRADED PRODUCT EXAMINES NOTHING, AND THAT IS THE ONLY SILENCE THIS CHECK MAY KEEP.
   if (!r.graded) return [];
-  // — A GRADED NARRATIVE THE PARSER CANNOT KEY IS NOT A COMPLIANT ONE. The old line here was
+  // — A GRADED NARRATIVE WITH NO WRITE-UP BLOCK GETS A ROW, NEVER SILENCE. The old line here was
   // `if (!r.total && !r.violations.length) return []`, which returned the SAME empty array for product
-  // 4's correct inertness and for a graded run whose narrative carries no recognisable write-up block.
-  // 6 of 22 graded runs on the box are the second kind, and every one of them read as compliant.
+  // 4's correct inertness and for a graded run whose narrative carries no write-up block at all.
   //
-  // STRUCTURAL, so it reports without sending a seat to fix it. The depth directive tells the seat
-  // WHICH findings get a prose write-up and HOW LONG it may be. It does not ask for the `Finding N —
-  // <mark>` heading this parser keys on, so a narrative without one breaks no rule the seat was given,
-  // and a warm redo would hand it a correction it has no instruction to satisfy. What is wrong here is
-  // that the DEPTH RULES WENT UNVERIFIED — a coverage fact, stated as one.
+  // AND THE ROW SAYS THE RULE DOES NOT APPLY, because it does not (the owner's ruling of 2026-10-01). The
+  // depth rule governs per-finding write-ups: which findings get one, and how long each may be. A
+  // sectional narrative — the spine, the verdict, coverage, calibration — carries none, measured on 36
+  // of 43 saved clearance narratives, so the rule has nothing to govern there. This row used to fail
+  // every such clearance for a heading the directive never asks for, which put an INVESTIGATE line on
+  // nearly every delivery that nobody could act on. Whether the directive should ask for per-finding
+  // write-ups at all is a separate question, held for the synthesis redesign.
   if (!r.total && !r.violations.length) {
     if (!r.findingsTotal)
       return [check("narrative-write-ups", "narrative-depth", surface, true,
         "no findings on this run, so there is nothing to write up")];
-    return [{ ...check("narrative-write-ups:could-not-read", "narrative-depth", surface, false,
-      `this run has ${r.findingsTotal} finding(s) and the narrative carries NO recognisable prose `
-      + "write-up block, so the depth rules were not verified on it — neither the band-rank cut nor the "
-      + "word cap was applied to anything. This is NOT a fault in the narrative: the depth directive "
-      + "states which findings get a prose write-up and how long it may be, and never asks for the "
-      + "heading this check keys on. It means the rule is unenforced on this run."),
-      // The flag rides the FAILURE, as everywhere else here, and it is what stops a warm redo handing
-      // the seat a correction no directive lets it satisfy.
-      structural: true }];
+    return [check("narrative-write-ups", "narrative-depth", surface, true,
+      `the depth rule does not apply to a sectional narrative: this run has ${r.findingsTotal} finding(s) `
+      + "and the narrative carries no per-finding write-up block, so the band-rank cut and the word cap "
+      + "have nothing to govern")];
   }
   const coverage = r.unjoined
     ? ` (${r.examined} of ${r.total} write-ups joined to a finding; ${r.unjoined} could not be, and were not judged for membership)`
@@ -2200,7 +2196,7 @@ export function cardBudgetChecks({ cardFolds }) {
     `assembly folded ${folds.length} surface(s) to the level budgets (moved, never deleted): ${folds.map((f) => `${f.surface} → +${f.movedSentences} sentence(s)/${f.movedWords} word(s) into depth`).join("; ")}`)];
 }
 
-export function runLint({ depth, commonLawGrid, matterContext, clientPartyName, reportMd, clientSummaryMd, narrativeMd, auditMd, recordsByUri, searchedNames, headerName, ratedNames, actionsText, fetchFailures, extraPlatformNames, findings, findingsRaw, actionsRegister, actionsExpected, intakeAsks, askAnswers, cardFolds, verdictDoc, manifest, seniorRights, seniorRightsExpected, markAssessment, markAssessmentExpected, fourAnswers, contentModelExpected, findingsSchemaVersion, placements, ownerScreen, recordCarry, commonLawCarries, searchedJurisdictions = null }) {
+export function runLint({ depth, commonLawGrid, matterContext, clientPartyName, reportMd, clientSummaryMd, narrativeMd, auditMd, recordsByUri, searchedNames, headerName, ratedNames, actionsText, fetchFailures, extraPlatformNames, findings, narrativeFindings = null, findingsRaw, actionsRegister, actionsExpected, intakeAsks, askAnswers, cardFolds, verdictDoc, manifest, seniorRights, seniorRightsExpected, markAssessment, markAssessmentExpected, fourAnswers, contentModelExpected, findingsSchemaVersion, placements, ownerScreen, recordCarry, commonLawCarries, searchedJurisdictions = null }) {
   // WS-B: the run's profile platforms join the vocabulary for this run. Profiles carry store
   // DOMAINS by contract, so derive the name tokens a report would actually print: the raw norm
   // ("thomasnetcom"), the separator-spaced phrase ("thomasnet com" / "made in china com"), and the
@@ -2290,7 +2286,9 @@ export function runLint({ depth, commonLawGrid, matterContext, clientPartyName,
   if (clientSummaryMd) checks.push(...permissionProseChecks({ text: clientSummaryMd, surface: "client-summary", idSuffix: ":client" }));
   if (narrativeMd) checks.push(...permissionProseChecks({ text: narrativeMd, surface: "narrative", idSuffix: ":narrative", structural: true }));
   // — the narrative's own depth rules, on the narrative surface so they route to the synthesis redo.
-  if (narrativeMd) checks.push(...narrativeWriteUpChecks({ narrativeMd, findings, depth, manifest }));
+  // Its finding headings are in the model's numbering, so they join the record the model wrote when the
+  // delivered record is folded (`narrativeFindings`), and the delivered record otherwise.
+  if (narrativeMd) checks.push(...narrativeWriteUpChecks({ narrativeMd, findings: narrativeFindings ?? findings, depth, manifest }));
   // — the same rule on both surfaces the client's words come from. The narrative is where the
   // shipped defect was authored; the report is what a client reads, and a repair to one that left the
   // other standing is how this family's previous cures kept being re-applied by hand.
@@ -2669,6 +2667,8 @@ const DELIVERY_LINES = {
   // The sentence states the CONSEQUENCE, in the receipt's own terms: not "a check failed" but "the rule
   // was applied to nothing". Eleven graded runs delivered carrying this, two of them orderable product
   // demos, and the only place it was written was one row of a fifty-odd-row receipt nobody routes.
+  // No new run emits it now (a sectional narrative is a passing row that says the rule does not apply);
+  // the line stays so a republished receipt from before reads as it did.
   "narrative-write-ups:could-not-read":
     "The depth rules for the written-up findings were applied to nothing on this run — the narrative "
     + "carries no block this check can read, so neither the ranking cut nor the length cap was verified.",

package/driver/products.mjs

@@ -344,7 +344,7 @@ export const CASE_LAW_NOT_A_REQUEST = Object.freeze({
 /**
  * `searchLevel` — THE SELECTOR ITSELF, AND THE ONE FIELD DELETED WITHOUT REFUSING.
  *
- * `search-policy.mjs:22` says the wire field is "DELETED — not deprecated, not hidden behind the product
+ * `search-policy.mjs` says the wire field is "DELETED — not deprecated, not hidden behind the product
  * name." The code made it deprecated: nothing on any door read it, nothing refused it, and there is no
  * generic unknown-field rejection — so a request naming a depth was accepted, the field dropped, and the
  * run went out at whatever product the SCOPE happened to imply.

package/driver/profiles.mjs

@@ -1107,9 +1107,10 @@ export function resolveEffectiveProfile(job, { profiles = loadProfiles(), projec
   //
   // `resolveEffectiveScope` decides whether to tell an approver "this project" or "the account's default
   // classes" by reading `profile.origins`. It was returned HERE as a sibling and no caller bridged the
-  // two — checked on origin/main: run-quote.mjs:59, resolve-request.mjs:44,47 and scope-rules.mjs:107
-  // all pass the profile alone. So both `=== "project"` tests were permanently false and the whole
-  // FROM.project branch was dead code: a project that REPLACES its customer's classes ran on the
+  // two — checked on origin/main: quoteForJob() in run-quote.mjs, resolveRequest() in resolve-request.mjs
+  // (twice) and checkClearanceScopeRules() in scope-rules.mjs all pass the profile alone. So both
+  // `=== "project"` tests were permanently false and the whole FROM.project branch was dead code: a
+  // project that REPLACES its customer's classes ran on the
   // project's list and told the approver those were the account's defaults. The number was right; the
   // reason given for it was wrong, and it pointed at the wrong place to go and change it.
   //

package/driver/publish/index.mjs

@@ -598,7 +598,7 @@ export async function regenSurfaces(poolRoot) {}
  * rather than discovered later.
  *
  * WHAT THIS DOES NOT REACH, so the next reader does not assume it does:
- *   · the run's PROSE. `- Source: [EUIPO · 018575624](https://euipo.europa.eu/…)` is markdown the synthesis
+ *   · the run's PROSE. `- Source: [EUIPO · 099999992](https://euipo.europa.eu/…)` is markdown the synthesis
  *     wrote and renderProse links it like any other markdown. No field distinguishes a prose register
  *     citation from a prose evidence citation, so the only way to catch it is to pattern-match the URL —
  *     which is the move that produced this defect class in the first place.