clearotron 0.4.1-beta.0 → 0.4.1-beta.2

package/driver/engine/mcp/recording-server.mjs

@@ -22,7 +22,7 @@
 //
 // ── THE RUN IS NOT THE SEAT'S TO NAME ───────────────────────────────────────────────────────────────
 //
-// `CLEAROTRON_BAND_RUN_DIR`, read at CALL TIME. `serverEnv()` (gather-config.mjs:162) sets it for every local
+// `CLEAROTRON_BAND_RUN_DIR`, read at CALL TIME. serverEnv() in gather-config.mjs sets it for every local
 // server, not only band. There is no `run_dir` parameter and there must not be one — the lesson is
 // the earlier one, where an invented `CLEAROTRON_RUN_DIR` fallback sat two lines under a sentence promising the tool
 // never guesses a run. Call time rather than module load: stdio-server.mjs:29-33 states why for this

package/driver/engine/mcp/supplemental.mjs

@@ -57,6 +57,31 @@ const compactProposal = (p) => ({
 const inPriority = (p, prio) =>
   (Array.isArray(p?.nice_classes) ? p.nice_classes : []).some((c) => prio.has(String(c).trim()));
 
+// A SOUND-ALIKE BATCH GOES AS LISTS where the register takes one (`phoneticOrWidth`, ruled 2026-10-09): up to
+// that many spellings per question, within its word budget, each long enough for the ranked search. A
+// spelling below that floor is its own question, as every name of a batch was before. Each list is one
+// question with one receipt row, so a list that crowds or fails takes no other list down with it. PURE.
+function splitBatch(p, names, capabilities) {
+  const { terms: _batch, ...rest } = p;
+  const single = (t) => ({ ...rest, term: t });
+  const width = Math.floor(Number(capabilities?.phoneticOrWidth));
+  if (String(p?.predicate ?? "") !== "phonetic" || !(width >= 2)) return names.map(single);
+  const floor = Number(capabilities?.rankedMinLength) || 0;
+  const budget = Number(capabilities?.listWordBudget) || Infinity;
+  const words = (t) => t.split(/\s+/).filter(Boolean).length;
+  const folded = (t) => [...t.normalize("NFKD").replace(/\p{M}/gu, "").toLowerCase().replace(/\s+/g, "")].length;
+  const out = [];
+  let list = [];
+  const close = () => { if (list.length) out.push(list.length === 1 ? single(list[0]) : { ...rest, terms: list }); list = []; };
+  for (const t of names) {
+    if (folded(t) < floor) { out.push(single(t)); continue; }
+    if (list.length >= width || list.reduce((n, x) => n + words(x), 0) + words(t) > budget) close();
+    list.push(t);
+  }
+  close();
+  return out;
+}
+
 export function mintSupplementalEntries(axis, proposals, { existingQids = new Set(), perCall = Infinity, axisMax = Infinity, existingCount = 0, capabilities = null, priorityClasses = [] } = {}) {
   const minted = [], reused = [], rejected = [], enriched = [], narrowed = [];
   let budget = Math.max(0, axisMax - existingCount);
@@ -82,7 +107,7 @@ export function mintSupplementalEntries(axis, proposals, { existingQids = new Se
     const names = perName && Array.isArray(p?.terms) ? p.terms.map((t) => String(t ?? "").trim()).filter(Boolean) : [];
     const splitOf = names.length > 1 && names.length <= PLAN_MAX_OR_WIDTH
       ? fingerprint({ axis, predicate: String(p?.predicate ?? "default"), names: [...names].sort(), i }) : null;
-    const byName = splitOf ? names.map((t) => { const { terms: _batch, ...rest } = p; return { ...rest, term: t }; }) : [p ?? {}];
+    const byName = splitOf ? splitBatch(p, names, capabilities) : [p ?? {}];
     return byName.flatMap((q) => {
       const words = perWord && Array.isArray(q?.goods_words) ? q.goods_words.map((w) => String(w ?? "").trim()).filter(Boolean) : [];
       return words.length > 1

package/driver/engine/openai-agent.mjs

@@ -426,6 +426,16 @@ export function codexToolCallsByName(ev) {
   return { ...byName };
 }
 
+/**
+ * The commands codex ran this turn: its `command_execution` items, counted once per item id, a failed one
+ * included, since a command that exited non-zero still ran. A NUMBER is a measurement (0: none ran). PURE.
+ */
+export function codexCommandCalls(ev) {
+  let n = 0;
+  for (const name of ev?.toolItems?.values() ?? []) if (name === "command_execution") n += 1;
+  return n;
+}
+
 /**
  * The tool-server calls of this turn that came back as an error, by tool name, in the shape
  * anthropic-agent records: a call that reached its server and `failed` there, which codex writes with no
@@ -653,10 +663,10 @@ function settleTuple({ r, ev, resumeRef }) {
     // still cannot report a whole-turn tool count, so `toolCalls` stays null, which is the house rule
     // for "this engine does not report" rather than "it called nothing".
     ...mcpToolGauge(ev),
-    // The refused count under the name the attempt row reads on both engines. Codex keeps its shell, and this
-    // adapter reads its commands only for failures (below), so it reports no command-tool count: null, never zero.
+    // The refused count under the name the attempt row reads on both engines. Codex keeps its shell, and every
+    // command it runs is a `command_execution` item: counted once per item id, failed ones included.
     toolCallsRefused: mcpToolGauge(ev).mcpToolCallsRefused,
-    commandToolCalls: null,
+    commandToolCalls: codexCommandCalls(ev),
     // The per-name split of the calls codex reports (see codexToolCallsByName), what the session went
     // through (session-record.mjs: every turn ending and stream error, in order), and the raw stream.
     toolCallsByName: codexToolCallsByName(ev), toolCallsErroredByName: codexToolServerErrors(ev),

package/driver/findings-model.mjs

@@ -858,7 +858,7 @@ export function parseFindingsJson(raw, opts = {}) {
     method: "method" in opts ? (opts.method ?? null) : undefined,
     // — null means the caller named no provider, and the record-URL gate stays inactive. An empty
     // ARRAY is a real answer ("this provider publishes no per-record page") and is not the same thing.
-    recordOrigins: Array.isArray(opts.recordOrigins) ? opts.recordOrigins : null };
+    recordOrigins: Array.isArray(opts.recordOrigins) ? opts.recordOrigins : null, foreignLinks: Array.isArray(opts.recordOrigins) ? [] : null };
   onlyKeys(doc, topKeysFor(mode), (k) => `findings_key_unknown:${short(k)}`);
   if (mode.v4) {
     if (typeof doc.rated_under_framework !== "string" || !doc.rated_under_framework.trim())
@@ -879,7 +879,7 @@ export function parseFindingsJson(raw, opts = {}) {
     throw new Error("findings_empty: the record carries no findings AND no coverage areas — at least one is required");
 
   const seenOrdinals = new Set();
-  const outFindings = findings.map((f, idx) => validateFinding(f, idx, seenOrdinals, mode));
+  const outFindings = findings.map((f, idx) => validateFinding(f, idx, seenOrdinals, mode)); throwForeignLinks(mode);
   const outCoverage = coverage.map((c) => validateCoverage(c));
   const outContextNotes = contextNotes.map((n) => validateContextNote(n));
   const outActions = validateActionsList(doc.actions, outFindings);
@@ -1381,10 +1381,10 @@ function validateFinding(f, idx, seenOrdinals, mode = { v4: false, manifest: nul
   if (f.withdrawn_reason != null && f.disposition !== "withdrawn")
     throw new Error(`finding_withdrawn_reason_orphan:${ord} (withdrawn_reason is only valid when disposition is "withdrawn")`);
 
-  validateOwner(f.owner, ord, mode?.recordOrigins ?? null);
+  validateOwner(f.owner, ord, mode?.recordOrigins ?? null, mode?.foreignLinks ?? null);
   validateMeters(f.meters);
   validateQuadrant(f.quadrant);
-  validateSource(f.source, ord, mode?.recordOrigins ?? null);
+  validateSource(f.source, ord, mode?.recordOrigins ?? null, mode?.foreignLinks ?? null);
 
   // Instance #5 — per-finding use-check / own-rights cite. SHAPE-ONLY here (present ⇒ a { source } object
   // whose source is a string). The composite>=3 NON-EMPTY-source enforcement lives in verify.mjs
@@ -1969,13 +1969,13 @@ export function isDeadRecordLink(value) {
   return t === "" || t.startsWith("#") || t.startsWith("/");
 }
 
-function checkRecordUrlHost(value, origins, ord, what) {
+function checkRecordUrlHost(value, origins, ord, what, collect = null) {
   if (origins == null) return;                        // gate inactive — see the header
   const origin = recordUrlOrigin(value);
-  if (origin == null) return;
-  if (origins.includes(origin)) return;
+  if (origin == null || origins.includes(origin)) return;
+  if (collect) { collect.push({ ord, what, value }); return; }   // the strict parse names EVERY offender in one refusal
   throw new Error(
-    `finding_record_url_foreign_host:${ord} (${what} points at ${origin}, which is not a register this run searched — `
+    `finding_record_url_foreign_host:${Array.isArray(ord) ? ord.join(",") : ord} (${what} points at ${origin}, which is not a register this run searched — `
     + (origins.length
       ? `this provider's record host is ${origins.join(" or ")}. Compose the URL from the record's own uri and THIS provider's base host, per providers/<name>.md.`
       : "this provider publishes no per-record page at all — cite the office register in the text and leave the URL as the record's own uri path.")
@@ -1983,7 +1983,7 @@ function checkRecordUrlHost(value, origins, ord, what) {
   );
 }
 
-function validateOwner(owner, ord, origins = null) {
+function validateOwner(owner, ord, origins = null, collect = null) {
   if (!isPlainObject(owner)) throw new Error(`finding_owner_invalid:${ord} (owner must be an object { name, country, registrations })`);
   onlyKeys(owner, OWNER_KEYS, (k) => `finding_owner_key_unknown:${short(k)}`);
   if (typeof owner.name !== "string" || !owner.name.trim()) throw new Error(`finding_owner_invalid:${ord} (owner.name must be a non-empty string)`);
@@ -1999,7 +1999,7 @@ function validateOwner(owner, ord, origins = null) {
     if (!isPlainObject(r)) throw new Error(`finding_registration_invalid:${ord} (each registration must be a plain object)`);
     onlyKeys(r, REGISTRATION_KEYS, (k) => `finding_registration_key_unknown:${short(k)}`);
     if (typeof r.uri !== "string" || !r.uri.trim()) throw new Error(`finding_registration_invalid:${short(r.uri)} (registration.uri must be a non-empty string)`);
-    checkRecordUrlHost(r.uri, origins, ord, `registration.uri "${short(r.uri)}"`);
+    checkRecordUrlHost(r.uri, origins, ord, `registration.uri "${short(r.uri)}"`, collect);
     if (r.classes != null && !(Array.isArray(r.classes) && r.classes.every((c) => typeof c === "string")))
       throw new Error(`finding_registration_invalid:${short(r.uri)} (registration.classes must be an array of strings)`);
   }
@@ -2042,7 +2042,7 @@ function validateQuadrant(q) {
   }
 }
 
-function validateSource(source, ord, origins = null) {
+function validateSource(source, ord, origins = null, collect = null) {
   if (!isPlainObject(source)) throw new Error(`finding_source_invalid:${ord} (source must be { source_type, resolved_link })`);
   onlyKeys(source, SOURCE_KEYS, (k) => `finding_source_key_unknown:${short(k)}`);
   if (!SOURCE_TYPES.includes(source.source_type))
@@ -2061,7 +2061,7 @@ function validateSource(source, ord, origins = null) {
         + "dead anchor in the report. Give the record's real URL, or — if this provider publishes no "
         + 'per-record page — leave it "" and cite the office register in the text.)',
       );
-    checkRecordUrlHost(source.resolved_link, origins, ord, "source.resolved_link");
+    checkRecordUrlHost(source.resolved_link, origins, ord, "source.resolved_link", collect);
   }
 }
 
@@ -2179,7 +2179,7 @@ export function projectCoverageJudgment(cj) {
   const rows = Array.isArray(cj.rows) ? cj.rows : [];
   if (!rows.length) return cj;
   // — the READER's name leads, and falls back to the identifier when the driver had nothing to
-  // add. This string is printed on report.html ("Coverage read"), which is why it reads the label.
+  // add. renderHtml receives this string and leaves it off report.html, so no page prints it; the label leads anyway.
   const shown = rows.slice(0, COVERAGE_JUDGMENT_ROW_CAP);
   const hidden = rows.length - shown.length;
   const rowText = shown.map((r) => `${trimDot(r.areaLabel || r.area)}: ${trimDot(r.note)}`).join("; ");
@@ -2571,3 +2571,70 @@ export function knockoutFindingRange(mark) {
   if (!ords.length || !markName) return "";
   return ords.length === 1 ? `${markName} #${ords[0]}` : `${markName} #${ords[0]}–#${ords[ords.length - 1]}`;
 }
+
+/**
+ * ONE REFUSAL FOR EVERY FOREIGN RECORD LINK the strict parse collected.
+ *
+ * The gate used to throw at the first offending link, so each refusal named one finding and a corrective
+ * attempt fixed one. A seat that had copied an office's page into eleven findings ran out of attempts at
+ * the third. The token now carries every offending ordinal; the sentence after it is the gate's own,
+ * unchanged, about the first offender.
+ */
+function throwForeignLinks(mode) {
+  const found = mode?.foreignLinks ?? [];
+  if (!found.length) return;
+  const ords = [...new Set(found.map((f) => f.ord))];
+  checkRecordUrlHost(found[0].value, mode.recordOrigins, ords.length === 1 ? ords[0] : ords, found[0].what);
+}
+
+/** The canonical record path inside an absolute URL (`/mark/<cc>/<rest>`), or null. PURE. */
+function canonicalRecordPath(value) {
+  try {
+    const path = new URL(String(value)).pathname;
+    return /^\/mark\/[a-z]{2}\/[^/]+/i.test(path) ? path : null;
+  } catch { return null; }
+}
+
+/**
+ * THE SALVAGE FOR A FOREIGN RECORD LINK: blank it, and deliver. PURE.
+ *
+ * A record link on a host the run's register does not publish is refused by the gate above. When a seat
+ * keeps writing one, the report still goes out: a register-sourced `resolved_link` on a foreign host
+ * becomes `""`, the value the findings model already reads as "this register publishes no page for the
+ * record", and publish still links a register that publishes no pages to the office's own page from the
+ * record itself. A `registration.uri` written as a foreign URL keeps the record's canonical path when
+ * the URL carries one, since the path is the record's identity. One that does not is left as written and
+ * returned in `kept`, because no identity can be read from it.
+ *
+ * `origins` is the gate's own list (recordOriginsFor); null turns this off, as it turns the gate off.
+ * Returns the repaired document, every value it changed (`blanked`, with what it was), and `kept`.
+ */
+export function blankForeignRecordLinks(doc, origins) {
+  const blanked = [], kept = [];
+  if (origins == null || !isPlainObject(doc) || !Array.isArray(doc.findings)) return { doc, blanked, kept };
+  const foreign = (value) => { const o = recordUrlOrigin(value); return o != null && !origins.includes(o); };
+  const findings = doc.findings.map((f) => {
+    if (!isPlainObject(f)) return f;
+    let out = f;
+    const s = f.source;
+    if (isPlainObject(s) && String(s.source_type ?? "").startsWith("register") && typeof s.resolved_link === "string" && foreign(s.resolved_link)) {
+      out = { ...out, source: { ...s, resolved_link: "" } };
+      blanked.push({ ordinal: f.ordinal ?? null, field: "source.resolved_link", was: s.resolved_link, now: "" });
+    }
+    const regs = isPlainObject(f.owner) && Array.isArray(f.owner.registrations) ? f.owner.registrations : null;
+    if (regs) {
+      let changed = false;
+      const next = regs.map((r, index) => {
+        if (!isPlainObject(r) || typeof r.uri !== "string" || !foreign(r.uri)) return r;
+        const path = canonicalRecordPath(r.uri);
+        if (!path) { kept.push({ ordinal: f.ordinal ?? null, field: "registration.uri", index, was: r.uri }); return r; }
+        changed = true;
+        blanked.push({ ordinal: f.ordinal ?? null, field: "registration.uri", index, was: r.uri, now: path });
+        return { ...r, uri: path };
+      });
+      if (changed) out = { ...out, owner: { ...out.owner, registrations: next } };
+    }
+    return out;
+  });
+  return { doc: { ...doc, findings }, blanked, kept };
+}

package/driver/flag-snapshot.mjs

@@ -425,7 +425,8 @@ export function registerCanCountFor(snapshot) {
  *
  * The trap is `covered ?? []`, which turns both "unrestricted" and "unknown" into "nothing" and offers
  * a client zero territories on a production deployment. It is written down at
- * providers/corsearch/src/capabilities.js:66-68 as well: "Never read as 'covers nothing'".
+ * the `covered` entry of CAPABILITIES in providers/corsearch/src/capabilities.js as well: "Never read as
+ * 'covers nothing'".
  */
 export function registerTerritoriesFor(snapshot) {
   if (!snapshot?.register || !("territories" in snapshot.register)) return undefined;

package/driver/foreign-record-links.mjs

@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// foreign-record-links.mjs — a record link on a host the run's register does not publish: refused once, then
+// blanked, and the run delivers.
+//
+// The findings gate refuses such a link (`finding_record_url_foreign_host`, findings-model.mjs). R2 on
+// 0.4.1-beta.1 delivered no report over eleven of them: the seat copied each office's own page into a
+// record link, every attempt was refused, and nothing could repair it. Two layers now act on it, and both
+// record what they did under one event name and in one file, so a reader meets one fact however it arose:
+//   · the synthesis transport, at the call (synthesis-record.mjs): the first offending call in a run is
+//     refused, naming every finding, so the seat can fix them in the same turn; a repeat is accepted with
+//     the foreign links blanked;
+//   · the synthesis salvage lane (pipeline.mjs), for a findings file the transport did not write.
+// Blanking is blankForeignRecordLinks (findings-model.mjs): a register link becomes "", the value that
+// already means "this register publishes no page for the record".
+import { writeFileSync } from "node:fs";
+import { driverDir } from "../shared/driver-dir.mjs";
+import { blankForeignRecordLinks } from "./findings-model.mjs";
+import { activeRecordOrigins } from "./record-origins.mjs";
+import { runLog } from "./log.mjs";
+
+export const FOREIGN_HOST_TOKEN = "finding_record_url_foreign_host";
+export const BLANKED_FILE = "foreign-record-links.json";
+
+/** The gate's list of record hosts: the caller's when it names one, else the run's register. */
+export const recordOriginsOr = (given) => (given === undefined ? activeRecordOrigins() : given);
+
+/**
+ * The synthesis call, refused once and then blanked. PURE. `refusedBefore` is whether this run's transport
+ * already refused a call for a foreign record link; until it has, the call is returned unchanged and the
+ * gate refuses it.
+ */
+export function blankOnRepeat(call, origins, refusedBefore) {
+  if (!refusedBefore || !Array.isArray(origins) || !call?.findings) return { call, blanked: [], kept: [] };
+  const { doc, blanked, kept } = blankForeignRecordLinks(call.findings, origins);
+  return { call: blanked.length ? { ...call, findings: doc } : call, blanked, kept };
+}
+
+/** What a blanking changed: the originals kept beside the run, and one run-log row. Never throws. */
+export function recordBlanking(runDir, { stage, layer, blanked, kept, fail = null }) {
+  try {
+    writeFileSync(driverDir(runDir, BLANKED_FILE),
+      JSON.stringify({ stage, layer, ...(fail ? { fail: String(fail).slice(0, 300) } : {}), blanked, kept }, null, 2) + "\n");
+  } catch { /* the file is forensics; the run-log row below is the record */ }
+  try {
+    runLog(runDir, { event: "foreign-record-links-blanked", stage, layer, blanked: blanked.length, kept: kept.length,
+      ordinals: [...new Set(blanked.map((b) => b.ordinal))] });
+  } catch { /* a log that cannot be written must not stop the record it describes */ }
+}

package/driver/frame-diff-model.mjs

@@ -143,7 +143,7 @@ export function undispatchableThrow(offenders) {
  * Every FIRING directive in a frame-diff document that cannot be dispatched — read LENIENTLY, from
  * raw text or an already-parsed object. This is the enumeration the gateway hint and the pipeline's
  * exhausted-ladder disclosure both run against the artifact ON DISK, because the fail string they
- * would otherwise scrape is cut at 160 characters (verify.mjs:381 commonLawMeaningSeat) and cannot carry more than the
+ * would otherwise scrape is cut at 160 characters (checkJson() in verify.mjs) and cannot carry more than the
  * first offender. Lenient on purpose: the artifact reaching these two callers has ALREADY failed
  * validation, so it may also carry an unknown key or a bad gap flag — refusing to enumerate then
  * would lose exactly the disclosures this exists to keep. Returns [{item, layer, severity, why}].

package/driver/gateway.mjs

@@ -445,7 +445,7 @@ export function attemptOk(fail, turn) {
 export function streamMeta(runDir, stream) {
   if (!stream || typeof stream !== "object" || !stream.file) return null;
   const dir = String(runDir ?? "");
-  const file = dir && String(stream.file).startsWith(dir) ? String(stream.file).slice(dir.length).replace(/^[\\/]+/, "") : String(stream.file);
+  const file = dir && String(stream.file).startsWith(dir) ? String(stream.file).slice(dir.length).replace(/^[\\/]+/, "").replace(/\\/g, "/") : String(stream.file);   // forward slashes, as every record path is, on Windows too
   return { file, present: stream.present === true, bytes: Number.isFinite(stream.bytes) ? stream.bytes : null,
     ...(stream.reason ? { reason: stream.reason } : {}) };
 }
@@ -3192,8 +3192,8 @@ export function isFormClassFail(fail) {
   return FORM_CLASS_RE.test(fail ?? "");
 }
 // How many in-dispatch repairs one stage run may buy. TWO, and the number has a cause: parseFrameDiff
-// is FAIL-FAST — it throws on the first bad severity (frame-diff-model.mjs:66 parseFrameDiff) before it ever collects
-// the undispatchable directives (:100) — so ONE artifact carrying both defects surfaces them
+// is FAIL-FAST — it throws on the first bad severity (parseFrameDiff() in frame-diff-model.mjs) before it ever collects
+// the undispatchable directives — so ONE artifact carrying both defects surfaces them
 // SEQUENTIALLY. That is exactly what the 08-02 frame-diff ladder did (severity on a1, undispatchable
 // on a2), and a cap of 1 would have handed the second one straight back to the ladder. The codebase
 // already learned this lesson once at directive granularity: undispatchableThrow batches ALL offenders
@@ -3682,7 +3682,7 @@ export function warmPatchMessage(lastFail, expectFile, { supplementalLane = fals
  * THE COUNTS A TEST ROUND READS PER STAGE, on both engines, spread into `toolGauge`. `toolCallsRefused`:
  * calls the program refused (Claude's own denials; Codex's tool-server calls refused before reaching their
  * server). `commandToolCalls`: calls to a tool that runs a command, which no Claude stage is offered, so
- * zero is the expected reading; Codex keeps its shell and reports null. `mcpToolCalls`: the tool-server
+ * zero is the expected reading there; Codex keeps its shell and counts the commands it ran. `mcpToolCalls`: the tool-server
  * calls Codex completed, its only count of calls made, since its `toolCalls` stays null.
  * `toolCallsErroredByName`: the tool-server calls that came back as an error, by tool name, so a stage that
  * had a call refused and made it again says so where its row otherwise reads ok on one attempt. Null, as in

package/driver/jx.mjs

@@ -59,7 +59,7 @@ export const jxFoldLaneRecord = ({ cause = null, ...rest } = {}) => ({
 // silent in the fold. One record spoke and the other could not.
 //
 // TWO FIELDS, BECAUSE ONE CANNOT CARRY BOTH JOBS.
-//   `executes` is a SCALAR STRING, because reference-score.mjs:1103 routes it into the same slot as the
+//   `executes` is a SCALAR STRING, because readJxLanes() in reference-score.mjs routes it into the same slot as the
 //   per-lane `executes` string and scripts/score.mjs interpolates it bare — an object prints
 //   [object Object] there. It names the slices that RAN, "+"-joined, and is NEVER "" (the e2e `exists`
 //   op passes on an empty string, so an all-failed run would have gone green on a statement of nothing).

package/driver/knockout-review-record.mjs

@@ -272,7 +272,7 @@ export function reviewEvidence(merged, about = {}) {
     if (at?.engineOwned || !Object.hasOwn(ADDRESSABLE, at?.field)) continue;
     const flags = plainRegisterFlags(text, about);
     if (!flags.length) continue;
-    rows.push({ at, where, says: flags.map((f) => f.say) });
+    rows.push({ at: offeredAddress(at), where, says: flags.map((f) => f.say) });
   }
   const marks = (about.marks ?? []).filter(Boolean), owners = (about.owners ?? []).filter(Boolean);
   const ownerNote = owners.length ? ` The ${owners.length} owner name(s) from the record were also removed.` : "";
@@ -287,6 +287,60 @@ export function reviewEvidenceLines({ rows }) {
   return rows.map(({ at, where, says }) => `- ${where} — address ${JSON.stringify(at)} — ${says.join(" ")}`);
 }
 
+/**
+ * The lines a reader meets first, each one the pass may write, with the address that names it.
+ *
+ * Handed to the reviewer on a record the driver's read flagged nowhere (owner ruling 2026-10-10). Its
+ * first question is the client's, and it can rewrite toward that answer, or decline, only at an address
+ * it was given: the tool refuses a composed one. The set is the one the flagged table is drawn from,
+ * without the flag, so the engine's own caveats and any field the applier cannot write stay out here too.
+ */
+export function reviewFirstReadRows(merged) {
+  return knockoutVisibleProse(merged)
+    .filter(({ at }) => !at?.engineOwned && Object.hasOwn(ADDRESSABLE, at?.field))
+    .map(({ at, where }) => ({ at: offeredAddress(at), where }));
+}
+
+/**
+ * An address as the seat is told to copy it: the field and the keys that field takes, nothing else.
+ *
+ * The walk marks a standing caveat with `engineOwned`, true or false, to decide what is offered at all.
+ * The grammar refuses any key a field does not take, so an offered address that carried the mark would
+ * be refused when copied verbatim, as the tool tells the seat to copy it.
+ */
+export function offeredAddress(at) {
+  const out = { field: at.field };
+  for (const k of ADDRESSABLE[at.field] ?? []) if (at[k] !== undefined) out[k] = at[k];
+  return out;
+}
+
+/** One line each, the address quoted for the seat to copy back. */
+export function reviewFirstReadLines(rows) {
+  return rows.map(({ at, where }) => `- ${where} — address ${JSON.stringify(at)}`);
+}
+
+/**
+ * What the reviewing pass hands the reviewer, decided before any turn is spent. PURE.
+ *
+ * EVERY KNOCKOUT IS REVIEWED. Flagged lines go as the measured table. A record flagged nowhere hands
+ * over its first-read lines instead, so the client's question is put on every record. Only a record with
+ * no such line at all is not dispatched, because there would be nothing to read and no address to answer.
+ */
+export function reviewDispatch(merged, plan) {
+  const about = reviewAbout(merged, plan);
+  const evidence = reviewEvidence(merged, about);
+  const firstRead = evidence.rows.length ? [] : reviewFirstReadRows(merged);
+  return {
+    about, evidence, flagged: evidence.rows.length, listed: firstRead.length,
+    dispatch: evidence.rows.length > 0 || firstRead.length > 0,
+    msgCtx: {
+      evidenceLines: reviewEvidenceLines(evidence),
+      firstReadLines: reviewFirstReadLines(firstRead),
+      exclusionNote: evidence.exclusionNote,
+    },
+  };
+}
+
 /**
  * The `about` a knockout run is blind to: every name in the batch, and every owner on the record.
  *

package/driver/named-band.mjs

@@ -131,6 +131,8 @@ export function parseNamedBand(raw) {
         ...(Array.isArray(b.covered_by) && b.covered_by.length ? { covered_by: b.covered_by } : {}),
         // what the total counts, when the register said — carried like the counts it qualifies
         ...(typeof b.total_counts === "string" ? { total_counts: b.total_counts } : {}),
+        // the register's floor when it answered "at least N": the total above stays null beside it
+        ...(Number.isFinite(b.total_floor) ? { total_floor: b.total_floor } : {}),
         // — THE REFUSAL STAMP SURVIVES THE PROJECTION. `execute-plan.mjs` writes an errored slice
         // as `{state:"incomplete", total_hits:0, fetched:0, error:true}` and says why in its own header:
         // "the error:true stamp (a provider error is never confusable with a sanctioned crowd)". The

package/driver/owner-screen.mjs

@@ -31,7 +31,7 @@
 //
 // PURE (no node imports) so it tests offline, like coverage-ledger.mjs / named-band.mjs.
 
-import { recordQids } from "./named-band.mjs";
+import { recordQids } from "./named-band.mjs"; import { moreThan } from "../shared/register-floor.mjs";
 
 /** Owner-slice states. `enumerated` is the only one that can carry a negative. */
 export const OWNER_SLICE_STATES = ["enumerated", "crowd", "not-run", "missing"];
@@ -95,7 +95,9 @@ export function deriveOwnerScreen(planEntries, blocks, bandRecords, {
       terms: Array.isArray(e.terms) ? e.terms.map(str) : (e.term != null ? [str(e.term)] : []),
       nice_classes: (e.nice_classes ?? []).map(str),
       state,
-      total_hits: Number(block?.total_hits) || 0,
+      // a register's floor ("at least N") is no count: the total stays null and the floor rides beside it
+      total_hits: Number.isFinite(block?.total_floor) ? null : Number(block?.total_hits) || 0,
+      ...(Number.isFinite(block?.total_floor) ? { total_floor: block.total_floor } : {}),
       records: recs.length,
       record_ids: recs.slice(0, recordCap).map((r) => str(r.record_id)).filter(Boolean),
       reason: sliceReason(e, block, deferred.get(qid) ?? null, capabilities),
@@ -103,7 +105,8 @@ export function deriveOwnerScreen(planEntries, blocks, bandRecords, {
       // executor's own descriptor says so, and the screen keeps them apart on the same row.
       portfolio: countEntry ? {
         qid: str(countEntry.qid),
-        total_hits: Number(countBlock?.total_hits) || 0,
+        total_hits: Number.isFinite(countBlock?.total_floor) ? null : Number(countBlock?.total_hits) || 0,
+        ...(Number.isFinite(countBlock?.total_floor) ? { total_floor: countBlock.total_floor } : {}),
         counted: !!countBlock && countBlock.error !== true,
       } : null,
     });
@@ -173,7 +176,7 @@ export function ownerScreenNegative(screen) {
   ];
   if (hit.length) parts.push(`Enumerated WITH records: ${hit.map((o) => `${name(o)} — ${o.records} record(s)`).join("; ")}.`);
   if (zero.length) parts.push(`Enumerated with zero records — a negative may be stated for these owners and ONLY these: ${zero.map(name).join("; ")}.`);
-  if (crowd.length) parts.push(`Count-only (NOT a clean — the slice was never enumerated): ${crowd.map((o) => `${name(o)} — ${o.total_hits} hit(s)`).join("; ")}.`);
+  if (crowd.length) parts.push(`Count-only (NOT a clean — the slice was never enumerated): ${crowd.map((o) => `${name(o)} — ${Number.isFinite(o.total_floor) ? moreThan(o.total_floor) : o.total_hits} hit(s)`).join("; ")}.`);
   if (notRun.length) parts.push(`NOT RUN — no negative may be stated for these owners; the gap is disclosed, never a clean: ${notRun.map((o) => `${name(o)}: ${o.reason ?? "capability absent"}`).join("; ")}.`);
   if (missing.length) parts.push(`Unaccounted for: ${missing.map(name).join("; ")}.`);
   return parts.join(" ");

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.4.1-beta.0",
+  "version": "0.4.1-beta.2",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline-knockout.mjs

@@ -57,7 +57,7 @@ import { registerUnavailableOffices } from "./register-unreachable.mjs";
 import { runRecordLogPath } from "../providers/_shared/ledger-path.mjs";   // — this run's record log
 import { beginAnswerMemory, endAnswerMemory } from "../providers/_shared/answer-memory.mjs";
 import { validators as koValidators, validateMergedFindings, worstBand, registerSurfacedFilings, raterCaveats, SURVIVOR_BOUNDARY_RE } from "./verify-knockout.mjs";
-import { reviewAbout, reviewEvidence, reviewEvidenceLines, applyKnockoutReview, knockoutReviewFile } from "./knockout-review-record.mjs";
+import { reviewDispatch, applyKnockoutReview, knockoutReviewFile } from "./knockout-review-record.mjs";
 import { stripNextStepSections } from "./knockout-next-step.mjs";
 import { publishKnockout, composeKnockoutEmail } from "./publish/knockout.mjs";
 import { writeRunStatus, readRunStatus, rollupStatus, atomicWrite, identitySeed } from "./progress.mjs";   // — the identity seed is shared; the stepper is not
@@ -188,22 +188,24 @@ export function readBackLadder(ctx, sidecarPath, { minted }) {   // exported for
  * pass is presentation. A refusal is never a pass, and "no report" is a product failure — so the last
  * thing added to the delivery path is the last thing that should be able to stop it.
  *
- * THE EMPTY CASE IS NOT A FAILURE AND IS NOT SILENT. A batch whose default-visible lines are all already
- * plain has nothing to dispatch, and paying for a turn to be told so is waste. It is logged with the
- * count, so "nothing was flagged" and "the pass never ran" are different rows in the journal rather than
- * one absent one.
+ * EVERY KNOCKOUT IS REVIEWED, by the owner's ruling of 2026-10-10. The reviewer's first question is the
+ * client's, and a record whose wording the driver's read flagged nowhere still gets it: the reviewer is
+ * handed the lines a reader meets first, with their addresses, and rewrites toward the client's question
+ * or declines at one of them. Only a record with no such line at all is not dispatched. That is logged
+ * with its counts, so "there was nothing to read" and "the pass never ran" are different rows in the
+ * journal rather than one absent one.
  */
 async function knockoutReviewingPass({ ctx, run, K, merged, plan }) {
-  const about = reviewAbout(merged, plan);
-  const evidence = reviewEvidence(merged, about);
-  if (!evidence.rows.length) {
-    runLog(run.runDir, { event: "knockout-review", outcome: "nothing-flagged", flagged: 0,
+  const d = reviewDispatch(merged, plan);
+  const { about } = d;
+  if (!d.dispatch) {
+    runLog(run.runDir, { event: "knockout-review", outcome: "nothing-flagged", flagged: 0, listed: 0,
       marks: merged.marks.length, excludedMarks: about.marks.length, excludedOwners: about.owners.length });
     return merged;
   }
 
   const keep = (outcome, detail) => {
-    runLog(run.runDir, { event: "knockout-review", outcome, flagged: evidence.rows.length, applied: 0,
+    runLog(run.runDir, { event: "knockout-review", outcome, flagged: d.flagged, listed: d.listed, applied: 0,
       delivered: "the rated record, unrewritten", ...detail });
     note(`reviewing pass: ${outcome} — the rated record ships unrewritten`);
     return merged;
@@ -211,7 +213,7 @@ async function knockoutReviewingPass({ ctx, run, K, merged, plan }) {
 
   try {
     await koStage("knockout-review", ctx, {
-      msgCtx: { evidenceLines: reviewEvidenceLines(evidence), exclusionNote: evidence.exclusionNote },
+      msgCtx: d.msgCtx,
     });
   } catch (e) {
     return keep("stage-failed", { reason: String(e?.message ?? e).slice(0, 200) });
@@ -228,7 +230,7 @@ async function knockoutReviewingPass({ ctx, run, K, merged, plan }) {
   if (!mv.ok) return keep("rewrite-refused-by-the-merged-gate", { failures: mv.failures.slice(0, 5) });
 
   atomicWrite(K.findings, JSON.stringify(doc, null, 2) + "\n");
-  runLog(run.runDir, { event: "knockout-review", outcome: "applied", flagged: evidence.rows.length,
+  runLog(run.runDir, { event: "knockout-review", outcome: "applied", flagged: d.flagged, listed: d.listed,
     applied: receipt.applied, declined: receipt.declined,
     unresolved: receipt.unresolved.length, refused: receipt.refused.length,
     excludedMarks: about.marks.length, excludedOwners: about.owners.length });