clearotron 0.4.1-beta.0 → 0.4.1-beta.2

package/driver/pipeline.mjs

@@ -45,7 +45,7 @@ import { parseCoverageLedgerJson, parseCoverageLedgerFull, deriveCoverageStatus,
 import { receiptSettled, readEnvelopeDecision, settleReceipt, settledDeferralsSection, readStickyGaps } from "./envelope-settle.mjs";
 import { readRegisterTaint, readActiveTaintAxes } from "./register-taint.mjs";
 import { parseNamedBand, mergeNamedBands, findCollapsedBands, quarantineUnknownStates, taintQuarantineCleanBlocks, bandRecords } from "./named-band.mjs";
-import { recordOriginsFor } from "./record-origins.mjs";
+import { recordOriginsFor, activeRecordOrigins } from "./record-origins.mjs"; import { recordBlanking, FOREIGN_HOST_TOKEN } from "./foreign-record-links.mjs";
 import { REGISTER_PROVIDER } from "./driver.config.mjs";
 import { noteRegisterServed, registersServedFrom, providerUsageCaveat } from "./register-served.mjs";   // which registers actually served this run — noted eagerly from the dispatch's own resolver, and reconciled at publish against the ledger rows, which carry the vendor per call
 import { FACTS_FILE as DIGEST_FACTS_FILE, ACCOUNTING_STAMP as DIGEST_ACCOUNTING_STAMP, recordedFindingUris,
@@ -72,7 +72,7 @@ import { classifyGroundsNote } from "./grounds-grammar.mjs";   // — a charged
 // — the register coverage form: the driver writes it before the digest dispatches, renders the
 // `## Coverage ledger` table and the machine ledger FROM it after the pass, and unions it across passes.
 import { documentCoverage, renderDocumentCoverageSection, spliceDocumentCoverage } from "./document-coverage.mjs";   //
-import { buildCoverageAbsenceForm, coverageAbsenceGaps, coverageFormAbsence, coverageFormBrief, renderCoverageAbsenceSection, renderCoverageLedgerSection, spliceCoverageLedger, renderCoverageLedgerJsonFromForm } from "./coverage-form.mjs";
+import { buildCoverageAbsenceForm, coverageAbsenceGaps, coverageFormAbsence, coverageFormBrief, renderCoverageAbsenceSection, renderCoverageLedgerSection, spliceCoverageLedger, renderCoverageLedgerJsonFromForm, unitLabel } from "./coverage-form.mjs";
 import { unionCoverageForm } from "./coverage-union.mjs";
 import { armCoverageForm, coverageFormInput, coverageFormPaths, coverageFormStamp, readCoverageForm, readCoverageFormInput, waitingFamilyStates, writeCoverageForm } from "./coverage-form-io.mjs";
 import { releasedFamilyQids, readWithheldFamilies } from "./withheld-families.mjs";   // the waiting families the reading turn released join as dictated entries
@@ -163,7 +163,7 @@ import { parsePlacementsJson } from "./placement-model.mjs";   // B2 — the str
 import { readAnchors } from "./anchor-reader.mjs";
 import { findEngagementReceipts } from "./engagement-receipt.mjs";
 import { plainRegisterFlags } from "./plain-register.mjs";
-import { parseFindingsJson, parseFindingsJsonLenient, consolidateFindings, deriveDisplayVerdict, bindRecommendation, compareBlockingPower, inDispositionMode, DISPOSITION_GROUP, deriveActionConditions, cardedParties, actionPartyReferences, quarantinedConditionRows, salvageRepairTargets, riskStatement, verdictStance, remapActionOrdinals, joinAskToAnswer, stripAskLabel, bandBorderlineDeclarations, reasonedNegativeGroups } from "./findings-model.mjs";
+import { parseFindingsJson, parseFindingsJsonLenient, consolidateFindings, deriveDisplayVerdict, bindRecommendation, compareBlockingPower, inDispositionMode, DISPOSITION_GROUP, deriveActionConditions, cardedParties, actionPartyReferences, quarantinedConditionRows, salvageRepairTargets, riskStatement, verdictStance, remapActionOrdinals, joinAskToAnswer, stripAskLabel, bandBorderlineDeclarations, reasonedNegativeGroups, blankForeignRecordLinks } from "./findings-model.mjs";
 import { foldCaption, foldCardRead } from "./card-budget.mjs";
 // S2 — the report card's mechanical frame, composed from the record instead of dictated (see below).
 import { carriesOwnFrame, composeCard } from "./card-frame.mjs";
@@ -3934,7 +3934,7 @@ export function findFloorBreaches(ledger, floorAxes) {   // @internal
  * `[]`: no manifest, unreadable, unparseable. That is the honest default here and not an absence read as
  * a pass, because the whole mechanism is opt-in — a run with no designation owes no floor, and a run whose
  * manifest cannot be read has no designation to honour. The refusal for an absent or unparseable manifest
- * belongs to the stage that writes it and already exists there — verify.mjs:1335 CALL_REASON_SET runs the same parser
+ * belongs to the stage that writes it and already exists there — validators.variantManifest in verify.mjs runs the same parser
  * through `checkSiblingJson` and fails clearance-variants with `variantmodel_missing`. Checked, because
  * "something else refuses it" is exactly the assumption that turns a swallowed error into a silent pass.
  */
@@ -4803,7 +4803,7 @@ async function stage(name, ctx, opts = {}) {
   let wedgeCycles = 0;
   for (;;) {
     const r = await stageWithChain(name, ctx, opts);
-    if (r.ok || r.fail !== "lane_wedge" || wedgeCycles >= LANE_WEDGE_CHAIN_RETRIES) { sweepStrayArtifacts(ctx, name); return r; }
+    if (r.ok || r.fail !== "lane_wedge" || wedgeCycles >= LANE_WEDGE_CHAIN_RETRIES) { sweepStrayArtifacts(ctx, name); await afterLateSynthesisSave(name, ctx, r); return r; }
     wedgeCycles++;
     note(`[${name}] command-lane wedge — the stage timed out with zero progress (saturated lane). Waiting ${Math.round(LANE_WEDGE_BACKOFF_MS / 1000)}s for it to clear, then re-dispatching (${wedgeCycles}/${LANE_WEDGE_CHAIN_RETRIES}); full per-attempt timeouts preserved.`);
     try { runLog(ctx.paths.runDir, { event: "lane-wedge-retry", stage: name + (ctx.axis ? `:${ctx.axis}` : ""), cycle: wedgeCycles, max: LANE_WEDGE_CHAIN_RETRIES }); } catch { /* telemetry best-effort */ }
@@ -5035,7 +5035,7 @@ export function buildFailurePacket({ runId, agent, job = {}, failedStage, shortR
 // a top-level defect, or nothing salvageable — fails the run exactly as before. One bad object never silently
 // suppresses a real conflict, and never silently kills a ~$40 run.
 async function quarantineSynth(r, ctx, name) {
-  if (r.ok) return r;
+  if (r.ok) return r; if (foreignRecordLinksBlanked(r, ctx, name)) return { ...r, ok: true, fail: undefined, repaired: "foreign-record-links-blanked" };
   // A6: a max_tokens-named content fault wraps the underlying validator token — strip the wrapper so a
   // per-finding shape defect on a ceiling-cut turn still reaches the lenient-salvage lane.
   const fail = String(r.fail || "").replace(/^max_tokens_no_output:/, "");
@@ -7028,7 +7028,7 @@ export function coverageRowAreaLabel(axis, unit) {   // @internal
   return coverageRowAreaFrom(axis, unit, labelled, "(all of it)");
 }
 
-export function coverageJudgmentRows(ledgerRows, planExecution) {   // @internal
+export function coverageJudgmentRows(ledgerRows, planExecution, plan = null) {   // @internal
   const open = [];
   for (const r of ledgerRows ?? []) {
     // `withheld-by-judgment` joins `confirmed-clean` in NOT reaching the reader, and for the opposite
@@ -7054,13 +7054,13 @@ export function coverageJudgmentRows(ledgerRows, planExecution) {   // @internal
     const host = axisOf.has(q) ? open.find((o) => o.axis === axisOf.get(q)) : null;
     if (host) { host.qids.push(q); claimed.add(q); }
   }
-  // The qid rides VERBATIM wherever it lands. It is the identifier the plan, the receipt and every gate
-  // join on, and a shortened one is a row nobody can match back to the query that did not run.
+  // A claimed qid is printed nowhere: the plan-execution receipt keeps it for every gate to join on, and a
+  // row a lawyer reads names its slice, never an engine identifier (ruled 2026-10-01). One row per slice.
   const rows = open.map((o) => ({ area: o.area, ...(o.areaLabel ? { areaLabel: o.areaLabel } : {}),
-    note: o.qids.length ? `${o.note} (no band block for: ${o.qids.join(", ")})` : o.note }));
+    note: o.note }));
   for (const qid of Array.isArray(planExecution?.missing) ? planExecution.missing : []) {
     const q = String(qid ?? "").trim();
-    if (q && !claimed.has(q)) rows.push({ area: q, note: "planned and not executed this run — the funnel produced no band block for this query" });
+    if (q && !claimed.has(q)) rows.push({ area: q, ...orphanAreaLabel(q, axisOf.get(q), plan), note: "planned and not executed this run" });
   }
   return rows.filter((r) => r.area && r.note);
 }
@@ -7074,7 +7074,7 @@ export function stampCoverageJudgmentRows(P, runDir, note, ctx) {   // @internal
       runLog(runDir, { event: "coverage-judgment-rows", judgment: false, reason: "synthesis emitted no coverage_judgment — none is invented here" });
       return;
     }
-    const rows = coverageJudgmentRows(loadCoverageLedger(runDir).rows, readPlanExecution(ctx));
+    const rows = coverageJudgmentRows(loadCoverageLedger(runDir).rows, readPlanExecution(ctx), ctx?.registerPlan ?? null);
     const discarded = Array.isArray(cj.rows) ? cj.rows.length : 0;
     const next = { ...doc, coverage_judgment: { ...cj } };
     if (rows.length) next.coverage_judgment.rows = rows;
@@ -7150,7 +7150,7 @@ function injectDeferralCoverage(P, runDir, note) {
 // the two constants below BYTE-FOR-BYTE, which is why they stay exported and are asserted against the
 // derivation in the tests.
 //
-// SERP_LANES is deliberately untouched: zh-only there is the shipped design (jx-lanes.mjs:72-74), not
+// SERP_LANES is deliberately untouched: zh-only there is the shipped design (SERP_LANES declared in jx-lanes.mjs), not
 // drift, and generalising the platform grid is a different piece of work.
 //
 // ── THE REMEDY CLAUSE NAMES A PRODUCT, AND FOR A WHILE IT NAMED A DELETED ONE ───────────────────────
@@ -7245,7 +7245,7 @@ export function scriptLaneRanOnRun(runDir, lane, { searchPolicy = null, env = pr
   //   zh  — shipped the full Phase-4 deepening: the SERP platform grid and the native read. Either
   //         unit running IS the lane running (they gate independently; one on and one off still
   //         searched in Chinese), so the legs stay exactly as they were.
-  //   ja/ko — shipped as slice-1 CANDIDATE lanes only (jx-lanes.mjs:32-35): no SERP_LANES entry, so
+  //   ja/ko — shipped as slice-1 CANDIDATE lanes only (LANGUAGE_LANES declared in jx-lanes.mjs): no SERP_LANES entry, so
   //         runJxSerpGrid hard-refuses them and neither unit flag can ever describe them. The only
   //         work these lanes do is the candidate fold, so "ran" is the fold having ACCEPTED
   //         candidates — a frozen lane decision with an empty fold searched nothing and owes the row.
@@ -8498,9 +8498,15 @@ function postponeRun(e, run, meta = {}) {
  * PURE: a job in, a plain object out, no IO.
  */
 export function instructedScopeOf(job) {
-  const markNames = Array.isArray(job?.marks)
-    ? job.marks.map((m) => (typeof m === "string" ? m : m?.name)).filter(Boolean)
-    : (job?.markName ?? job?.name ?? null);
+  // THE MARKS ARE ALWAYS A LIST. A job that names its mark only as `markName` — a queue file written by
+  // hand or by a forwarding agent, a resume rebuilt from status.json — recorded the bare string, and the
+  // declination tool's identical-mark refusal reads a list, so on those runs it saw no mark and never
+  // fired. An array that names no mark falls back the same way the intake gate does; null when nothing
+  // names one.
+  const named = Array.isArray(job?.marks)
+    ? job.marks.map((m) => (typeof m === "string" ? m : m?.name)).filter(Boolean) : [];
+  const single = job?.markName ?? job?.name ?? null;
+  const markNames = named.length ? named : (single ? [single] : null);
   return {
     marks: markNames,
     classes: job?.classes ?? null,
@@ -8941,7 +8947,7 @@ async function pipelineInner(job, opts = {}) {
   // frame validator compares against THIS file, never against the frame's own paraphrase) —
   // paraphrase drift between the request and the frame is a defect, not a style choice.
   try {
-    writeFileSync(P.instructedScope, JSON.stringify(instructedScopeOf(job), null, 2) + "\n");
+    const scope = instructedScopeToWrite(job, { jobRebuiltFromStatus: opts.jobRebuiltFromStatus, scopeOnDisk: existsSync(P.instructedScope) }); if (scope) writeFileSync(P.instructedScope, JSON.stringify(scope, null, 2) + "\n");
   } catch (e) { note(`instructed-scope write failed (non-fatal): ${e.message}`); }
   // THE STORED DEFAULTS THE ENGINE CANNOT SEARCH — recorded by the run, not only by the plan preview.
   //
@@ -9430,7 +9436,7 @@ async function pipelineInner(job, opts = {}) {
       //
       // The prior channel is the TRUSTED one and already carries everything needed. Half forms are
       // driver-written, `seatFields(p, row)` carries their rulings by the same `pOk` path, and
-      // gateway.mjs:630 selectEngine already unions this exact shape — prior-only, `{ rows: null }` submitted — on
+      // syncDispositionForm() in gateway.mjs already unions this exact shape — prior-only, `{ rows: null }` submitted — on
       // every attempt. So this is that mode, not a new one.
       //
       // ONE METRIC MOVES, deliberately: with no submission, `carried` counts every ruled row, because
@@ -13479,6 +13485,9 @@ async function pipelineInner(job, opts = {}) {
     // structured-only). Each stage is file-gated/resumable; per-card sessions feed the lint repair below.
     // C2 — fold same-owner+same-mark duplicate filings into one finding BEFORE the overview + cards read
     // findings.json, so the whole delivery phase (and the published copy) sees the single consolidated set.
+    // THE SEAM'S WRITES ARE ONE CLOSURE, so they can run again: a synthesis save after this point rewrites
+    // findings.json from the seat's own call, and every write below went with it (`stage()` re-runs them).
+    const seamWrites = async () => {
     injectDeferralCoverage(P, run.runDir, note); injectMeaningGapCoverage(P, run.runDir, note);   // A3: unclosed reopen directives, and meaning searches that did not complete, become reader-visible coverage rows first
     // qw/cn-scope-honesty — the sibling injection: a CN-family-scope run whose zh lane did not run
     // discloses what the native-language investigation would have searched, and where it is offered
@@ -13534,6 +13543,15 @@ async function pipelineInner(job, opts = {}) {
       try { writeVerdictSidecar(); }
       catch (e2) { throw new StageFailure("verdict", `verdict sidecar refresh failed after consolidation: ${String(e2.message).slice(0, 120)}`); }
     }
+    };
+    await seamWrites();
+    // Every write above is idempotent: each injection skips a row the record already carries, the stamp
+    // replaces its rows, and the fold leaves a folded record as it is.
+    ctx.afterSynthesisSave = async () => {
+      note(`[seam] a synthesis save after the seam rewrote findings.json — re-applying the seam's writes`);
+      runLog(run.runDir, { event: "seam-reapplied", after: "synthesis-save" });
+      await seamWrites();
+    };
     // wp50/wi2 — the overview PROSE must speak the derived tier (VENZY: caption said "High risk" while
     // every code surface said VERY HIGH). Thread the just-refreshed sidecar into the stage prompt; the
     // deterministic backstop is predelivery-lint's overallTierChecks.
@@ -16015,6 +16033,20 @@ export function reconstructCtx(job, opts) {   // @internal
   return ctx;
 }
 
+/**
+ * The aim count the cold pass sets before synthesis (`ctx.jxAim`), set on a reconstructed context from the
+ * same function and behind the same gate. It lives here rather than in reconstructCtx because the lane
+ * module is only ever imported lazily and reconstructCtx is synchronous. Without it a synthesis arm on a run
+ * whose pass carried the Chinese-evidence block dispatched without it. Returns the count it set, or null.
+ */
+export async function attachJxAim(ctx) {   // @internal
+  if (!ctx?.searchPolicy?.components?.jxLanes) return null;
+  const { jxAimForSynthesis } = await import("./jx-units.mjs");
+  const aim = jxAimForSynthesis(ctx.paths.runDir);
+  if (aim) ctx.jxAim = aim.count;
+  return aim ? aim.count : null;
+}
+
 // Copy a stage's about-to-be-overwritten output (+ its per-stage telemetry) into _history/<ts>-<reason>/ so a
 // prior result is NEVER lost and stays comparable. Returns the snapshot dir (or null if there was no output).
 //
@@ -16068,6 +16100,7 @@ export async function repairStale(job, opts = {}) {   // @internal
   const labels = Array.isArray(rec?.labels) ? rec.labels : [];
   if (!labels.length) return null;
   attachFramework(ctx, { write: true });
+  await attachJxAim(ctx);   // the aim count the cold pass sets, as --experiment sets it on its rebuilt context
   // RE-DERIVE THE ORDER rather than trusting the file's. The recorded order was right when it was
   // written, and a code change since could have moved an edge — the file names WHAT, the live graph says
   // WHEN. (the file names WHAT, the live graph says WHEN)
@@ -16211,6 +16244,7 @@ async function runExperimentInner(job, opts) {
   if (opts.dispatchTrigger != null && !DISPATCH_TRIGGERS.includes(opts.dispatchTrigger))
     throw new Error(`--dispatch-trigger: unknown value "${opts.dispatchTrigger}" — it decides which production pass the arm reproduces, so a typo would compose a quietly different prompt. One of: ${DISPATCH_TRIGGERS.join(", ")}`);
   const ctx = reconstructCtx(job, opts);
+  await attachJxAim(ctx);   // read off the canonical run, as the cold pass reads it; the file itself is a sandbox edge
   const model = opts.model ?? (axis ? axisTier(axis).model : STAGES[name].model);
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const tag = [name, axis, opts.label ? kebab(opts.label) : null].filter(Boolean).join("-");
@@ -16742,7 +16776,7 @@ if (isEntrypoint(import.meta.url)) void (async () => {
   // rate-limit catch already finds the run to postpone; the same hook lets a THROWN exit name the run.
   const opts = a.experiment
     ? { ...base, codename: a.codename, experiment: a.experiment, model: a.model, instructions: a.instructions, axis: a.axis, label: a.label, dispatchTrigger: a.dispatchTrigger }
-    : { ...base, codename: a.codename, fromStage: a.fromStage };
+    : { ...base, codename: a.codename, fromStage: a.fromStage, ...(a.job ? {} : { jobRebuiltFromStatus: true }) };
   const script = resolve(fileURLToPath(import.meta.url));
   // `jobPath` is null on a rebuilt resume, so the advice composes a command that does not name a file
   // the box does not have — which is the whole defect this path exists to close, and printing it again
@@ -16922,3 +16956,67 @@ export function injectMeaningGapCoverage(P, runDir, note) {   // @internal — e
     note(`[common-law] meaning-gap coverage skipped: ${String(e?.message || e).replace(/\s+/g, " ").slice(0, 100)}`);
   }
 }
+
+/**
+ * A SYNTHESIS SAVE AFTER THE SEAM (the pre-delivery narrative redo, the in-pass stale repair) rewrites
+ * findings.json from the seat's own call, and the seam's writes go with it: the coverage-judgment rows, the
+ * injected coverage rows, the fold. The seam leaves them on the run's context, and they run again here,
+ * before anything downstream reads the record. Before the seam there is nothing on the context, so nothing
+ * runs. It sits at the end of this file so that adding it moved no line another file cites.
+ */
+async function afterLateSynthesisSave(name, ctx, r) {
+  if (r?.ok && !r.skipped && name === "synthesis" && typeof ctx?.afterSynthesisSave === "function") await ctx.afterSynthesisSave();
+}
+
+/**
+ * The reader's name for a planned search that never ran and that no open ledger row on its axis claims —
+ * the orphan row of `coverageJudgmentRows`. Its area is the plan's qid, which a lawyer cannot read; the
+ * label is composed the way the workbook's released-family rows compose theirs (publish/index.mjs
+ * releasedFamilyRows): the plan entry's unit in the coverage form's grammar, its axis head in the reader's
+ * words. `{}` when the frozen plan does not carry the entry, so the row keeps the identifier and nothing is
+ * invented in its place. PURE.
+ */
+function orphanAreaLabel(qid, axis, plan) {
+  const entry = (Array.isArray(plan?.entries) ? plan.entries : []).find((e) => e?.qid === qid);
+  if (!entry) return {};
+  const label = coverageUnitLabel(unitLabel(axis || entry.axis, entry));
+  return label && label !== qid ? { areaLabel: label } : {};
+}
+
+/**
+ * The instructed scope this run writes, or null to keep the one already on disk. A resume that rebuilt its
+ * job from status.json holds only the job's identity (id, reference, mark, classes, forwarder), so writing
+ * the scope from it would replace the order's goods, customer and territories with nothing, and every
+ * later reader of the scope would see a narrower matter than was ordered. Such a resume keeps the scope the
+ * run started with. A job read from a file, or a run with no scope yet, writes as before. PURE.
+ */
+export function instructedScopeToWrite(job, { jobRebuiltFromStatus = false, scopeOnDisk = false } = {}) {   // @internal
+  return jobRebuiltFromStatus && scopeOnDisk ? null : instructedScopeOf(job);
+}
+
+// ── THE SALVAGE FOR A FOREIGN RECORD LINK: BLANK IT, RE-CHECK, DELIVER ──────────────────────────────────
+//
+// A seat that writes an office's page, or another register's, into a record link is refused by the
+// findings gate (`finding_record_url_foreign_host`). The salvage lane below takes that token, because it is
+// a `finding_…` token, but its lenient re-parse does not judge hosts, so it found nothing to repair and
+// failed the run: R2 on 0.4.1-beta.1 delivered no report over eleven copied office links. Here the driver
+// blanks every foreign link itself (blankForeignRecordLinks says how), keeps what it changed beside the run,
+// and re-checks the file with the stage's own validator. A pass delivers; anything still refused falls
+// through to the lanes below exactly as before, with fewer defects in the file.
+export function foreignRecordLinksBlanked(r, ctx, name) {   // exported for its test
+  const fail = String(r?.fail || "").replace(/^max_tokens_no_output:/, "");
+  if (!fail.includes(FOREIGN_HOST_TOKEN) || !existsSync(ctx.paths.findings)) return false;
+  let doc;
+  try { doc = JSON.parse(readFileSync(ctx.paths.findings, "utf8")); } catch { return false; }
+  const { doc: repaired, blanked, kept } = blankForeignRecordLinks(doc, activeRecordOrigins());
+  if (!blanked.length) return false;
+  atomicWrite(ctx.paths.findings, JSON.stringify(repaired, null, 2) + "\n");
+  recordBlanking(ctx.paths.runDir, { stage: name, layer: "salvage", blanked, kept, fail });
+  note(`[${name}] ${blanked.length} record link(s) on a host this register does not publish were blanked by the driver; the originals are in _driver/foreign-record-links.json`);
+  const def = STAGES[name];
+  const out = def?.out ? def.out(ctx.paths, ctx.axis) : null;
+  const v = out && existsSync(out) && def.validate ? def.validate(out, readFileSync(out, "utf8")) : null;
+  if (v?.ok) return true;
+  runLog(ctx.paths.runDir, { event: "foreign-record-links-recheck", stage: name, ok: false, fail: String(v?.reason ?? "no validator").slice(0, 200) });
+  return false;
+}

package/driver/portal-service.mjs

@@ -131,7 +131,7 @@ const INSTALL_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
 const READ_OFF_NOTE = "Reading a brief is not available on this instance — set the search up below.";
 import { basename, dirname, join, resolve as pathResolve } from "node:path"; import { studioDirFor } from "../shared/pre-rename-spellings.mjs";
 import { driverDir } from "../shared/driver-dir.mjs";   //
-import { createHmac, timingSafeEqual } from "node:crypto";
+import { createHmac, timingSafeEqual, randomBytes } from "node:crypto";
 import { makePrincipal, assertPrincipal, genericOrgOf, mayReadRun, reachCovers, principalView, seesEverything, mayRun,
   PortalDeny } from "./portal-access.mjs";
 // — the THIRD identity source (after the CF Access edge and, until, the deleted bypass). It
@@ -220,7 +220,7 @@ export function jobHashOf(job) {
   })).digest("base64url");
 }
 export function mintConfirmation({ secret, account, email, jobHash, now = Date.now(), ttlMs = 10 * 60 * 1000 }) {
-  const jti = createHmac("sha256", secret).update(`${account}|${jobHash}|${now}|${Math.random()}`).digest("base64url").slice(0, 24);
+  const jti = createHmac("sha256", secret).update(`${account}|${jobHash}|${now}|${randomBytes(16).toString("hex")}`).digest("base64url").slice(0, 24);
   const payload = { account, email, jobHash, jti, exp: now + ttlMs };
   const body = Buffer.from(canonical(payload)).toString("base64url");
   const sig = createHmac("sha256", secret).update(body).digest("base64url");
@@ -1395,7 +1395,7 @@ export function makePortalService({
       //
       // DISPLAY NAMES, computed server-side, because five vocabularies sit between a name on the form
       // and an office code (display → normalizeTerritory → canonicalJurisdictionCode → offices.translate
-      // → covered.has) and register-plan.mjs:206-216 records what re-implementing that chain cost.
+      // → covered.has) and resolveRegions() in register-plan.mjs records what re-implementing that chain cost.
       //
       // THE FIELD IS OMITTED, not nulled, when the snapshot does not say. `null` is a real answer here
       // ("no declared restriction") and the browser must be able to tell it from "this deployment has
@@ -4620,7 +4620,8 @@ const PORT = PORT_CHOICE.port;
   // stays fail-closed — an empty array would be truthy and open it.
   const AUD = accessAudience(envFrom(process.env, "CLEAROTRON_OIDC_AUDIENCE"));
   // item 1 — THE SAME FOUR VALUES THE STAFF MCP FACE ALREADY READS, under portal-side names
-  // (mcp-server/http-server.mjs:92-95). `makeAccessVerifier` has always accepted them; the portal simply
+  // (OIDC_ISSUER declared in http-server.mjs, and the three read beside it). `makeAccessVerifier` has
+  // always accepted them; the portal simply
   // never passed them, which is how one product shipped a provider-agnostic API face and a
   // Cloudflare-only web portal. Unset ⇒ the CF Access shapes derived from CF_ACCESS_TEAM, exactly as
   // before.

package/driver/products.mjs

@@ -344,7 +344,7 @@ export const CASE_LAW_NOT_A_REQUEST = Object.freeze({
 /**
  * `searchLevel` — THE SELECTOR ITSELF, AND THE ONE FIELD DELETED WITHOUT REFUSING.
  *
- * `search-policy.mjs:22` says the wire field is "DELETED — not deprecated, not hidden behind the product
+ * `search-policy.mjs` says the wire field is "DELETED — not deprecated, not hidden behind the product
  * name." The code made it deprecated: nothing on any door read it, nothing refused it, and there is no
  * generic unknown-field rejection — so a request naming a depth was accepted, the field dropped, and the
  * run went out at whatever product the SCOPE happened to imply.

package/driver/profiles.mjs

@@ -1107,9 +1107,10 @@ export function resolveEffectiveProfile(job, { profiles = loadProfiles(), projec
   //
   // `resolveEffectiveScope` decides whether to tell an approver "this project" or "the account's default
   // classes" by reading `profile.origins`. It was returned HERE as a sibling and no caller bridged the
-  // two — checked on origin/main: run-quote.mjs:59, resolve-request.mjs:44,47 and scope-rules.mjs:107
-  // all pass the profile alone. So both `=== "project"` tests were permanently false and the whole
-  // FROM.project branch was dead code: a project that REPLACES its customer's classes ran on the
+  // two — checked on origin/main: quoteForJob() in run-quote.mjs, resolveRequest() in resolve-request.mjs
+  // (twice) and checkClearanceScopeRules() in scope-rules.mjs all pass the profile alone. So both
+  // `=== "project"` tests were permanently false and the whole FROM.project branch was dead code: a
+  // project that REPLACES its customer's classes ran on the
   // project's list and told the approver those were the account's defaults. The number was right; the
   // reason given for it was wrong, and it pointed at the wrong place to go and change it.
   //

package/driver/publish/publish-inputs.mjs

@@ -121,8 +121,8 @@ export const NOT_READ_BY_NAME = {
 // absent one is the caller's error and already throws. Declared so the source scan can tell "argument"
 // from "undeclared store" instead of demanding a gating for something that has none.
 export const CALLER_SUPPLIED = {
-  "report.md": "the reportMd ARGUMENT — read unconditionally at index.mjs:653; an unreadable one throws, which is correct (there is no report to publish)",
-  "audit.md": "the auditMd ARGUMENT — existence-gated at index.mjs:942-943; a run with no audit markdown legitimately publishes without a workbook",
+  "report.md": "the reportMd ARGUMENT — read unconditionally by publishReport() in index.mjs; an unreadable one throws, which is correct (there is no report to publish)",
+  "audit.md": "the auditMd ARGUMENT — existence-gated in publishReport() in index.mjs; a run with no audit markdown legitimately publishes without a workbook",
 };
 
 /**

package/driver/publish/xlsx.mjs

@@ -574,7 +574,7 @@ function coverageJudgmentSummaryRows(cj) {
   const rows = Array.isArray(cj?.rows) ? cj.rows : [];
   if (!rows.length) return [];
   return [{ Field: '', Value: '' }, { Field: 'Coverage judgment — slices considered', Value: '', _head: true },
-    ...rows.map((r) => ({ Field: `   ${plainNote(r.area)}`, Value: plainNote(r.note) }))];
+    ...rows.map((r) => ({ Field: `   ${plainNote(r.areaLabel || r.area)}`, Value: plainNote(r.note) }))];
 }
 function correctionsSummaryRows(c) {
   const entries = Array.isArray(c?.entries) ? c.entries : [];

package/driver/register-count.mjs

@@ -90,7 +90,7 @@
 import { existsSync, readFileSync, appendFileSync } from "node:fs";
 import { join } from "node:path";
 
-import { kebab } from "./search-policy.mjs";
+import { kebab } from "./search-policy.mjs"; import { moreThan } from "../shared/register-floor.mjs";
 import { resolveRegions } from "./register-plan.mjs";
 import { reachableRegions } from "./register-availability.mjs";   // — pure; the env binding is injected
 import { variantForms, VARIANT_RULES, VARIANT_CAP } from "./register-variants.mjs";
@@ -592,7 +592,7 @@ export function disclosedFloor(c) {
 }
 
 /** A floor as every page prints it: the register's own figure, and no sentence around it. */
-export const moreThan = (floor) => `more than ${floor.toLocaleString("en-US")}`;
+export { moreThan } from "../shared/register-floor.mjs";
 
 /**
  * THE READER'S LINE FOR A COUNT THAT DID NOT LAND. A count's `unavailable` text is the counts record's: it

package/driver/register-coverage.mjs

@@ -32,7 +32,7 @@
 // ── AND WHY IT DELEGATES TO resolveRegions RATHER THAN RE-IMPLEMENTING IT ───────────────────────────
 //
 // Five vocabularies sit between a display name and a covered office: display → `normalizeTerritory` →
-// `canonicalJurisdictionCode` → `offices.translate` → `covered.has`. `register-plan.mjs:206-216` records
+// `canonicalJurisdictionCode` → `offices.translate` → `covered.has`. resolveRegions() in register-plan.mjs records
 // the copper-bastion incident from re-implementing that chain — the composer submitted display names,
 // corsearch's ISO-passthrough translate sent them to the wire verbatim, the vendor answered 500 rather
 // than 400, and recovery burned its park budget re-sending a query that could never succeed.

package/driver/register-plan.mjs

@@ -375,6 +375,11 @@ export const planExactOrWidth = (capabilities) =>
   Number.isFinite(capabilities?.exactOrWidth) && capabilities.exactOrWidth >= 1
     ? Math.floor(capabilities.exactOrWidth) : planMaxOrWidth(capabilities);
 
+/** The OR-stack width for a SOUND-ALIKE band, by the same rule: `phoneticOrWidth` where a provider declares one. */
+export const planPhoneticOrWidth = (capabilities) =>
+  Number.isFinite(capabilities?.phoneticOrWidth) && capabilities.phoneticOrWidth >= 1
+    ? Math.floor(capabilities.phoneticOrWidth) : planMaxOrWidth(capabilities);
+
 // The plan emits ONE `wildcard` predicate; the provider contract splits it into three sub-capabilities.
 // Mirrors the executor's planPredicateParams anchoring exactly (trailing * → prefix/starts-with,
 // leading * → suffix/ends-with, both/neither → infix over the raw pattern).
@@ -2190,7 +2195,9 @@ export function validatePlanFeasibility(plan, { capabilities = null, maxOrWidth
     if (!PLAN_PREDICATES.includes(e?.predicate)) add("unexecutable", `unknown predicate "${e?.predicate}"`);
     const names = Array.isArray(e?.terms) ? e.terms : e?.term != null ? [e.term] : [];
     if (!names.length || names.some((t) => !String(t ?? "").trim())) add("unexecutable", "empty term(s)");
-    const width = e?.predicate === "exact" && capabilities ? Math.max(maxOrWidth, planExactOrWidth(capabilities)) : maxOrWidth;
+    const width = !capabilities ? maxOrWidth
+      : e?.predicate === "exact" ? Math.max(maxOrWidth, planExactOrWidth(capabilities))
+        : e?.predicate === "phonetic" ? Math.max(maxOrWidth, planPhoneticOrWidth(capabilities)) : maxOrWidth;
     if (Array.isArray(e?.terms) && e.terms.length > width) add("repairable", `OR-stack of ${e.terms.length} names exceeds the executor bound (${width}) — the executor runs it chunked`);
     for (const t of names) if (String(t).length > maxNameLength) add("repairable", `name exceeds ${maxNameLength} chars ("${String(t).slice(0, 40)}…") — provider-side truncation risk only`);
     if ((e?.nice_classes ?? []).some((c) => !Number.isFinite(Number(c)))) add("unexecutable", "non-numeric nice_class");
@@ -2433,6 +2440,8 @@ export function joinPlanToBands(plan, bandBlocksByAxis, { released = new Set() }
       // WHAT THE TOTAL COUNTS, when the register said: `records`, one per country a mark covers. Every
       // reader of this row reads the count as the register's own number (ruled 2026-10-02).
       ...(typeof b.total_counts === "string" ? { total_counts: b.total_counts } : {}),
+      // The register's floor when it answered "at least N" instead of a count: total_hits stays null beside it.
+      ...(Number.isFinite(b.total_floor) ? { total_floor: b.total_floor } : {}),
     });
   }
   const planQids = new Set(plan.entries.map((e) => e.qid));
@@ -2831,8 +2840,10 @@ export function openBlocksByAxis(skeleton, bandBlocksByAxis, plan) {
       // under the deleted prose join (the qid, or this number standalone). Both are now written INTO the
       // form's row by the driver, so the equivalence the join had to test for is structural — see
       // coverage-form.mjs. The field stays because the row, the render and the failure token all carry it.
+      // A null total stays off the row: `Number(null)` is 0, which printed "(0 counted)" for a register's floor
+      // ("at least 10,000") and for a count the register refused to give.
       unverified.push({ qid: e.qid,
-        ...(Number.isInteger(Number(b.total_hits)) ? { total_hits: Number(b.total_hits) } : {}),
+        ...(b.total_hits != null && Number.isInteger(Number(b.total_hits)) ? { total_hits: Number(b.total_hits) } : {}),
         ...(unaccounted.length ? { unaccounted: unaccounted.slice(0, 8) } : {}),
         ...(unaccountedClasses.length ? { unaccounted_classes: unaccountedClasses.slice(0, 8) } : {}) });
     }

package/driver/result-noun-fields.mjs

@@ -44,7 +44,7 @@
 // `verdict` is one of:
 //   "result"      — the value states what happened. The name is honest.
 //   "invocation"  — the value states that something was CALLED. Fix by renaming, or by adding a sibling
-//                   that carries the result (the remedy `repairs.mjs:724` already uses, keeping
+//                   that carries the result (the remedy createRepairLedger() in repairs.mjs already uses, keeping
 //                   `outcome` for existing readers beside `dispatch` and `verdict`).
 //   "out-of-scope" — never reaches `_driver/*.json` or `run.jsonl`; `atWriteSite` is 0.
 
@@ -62,8 +62,8 @@ export const RESULT_NOUN_FIELDS = Object.freeze([
   { file: "driver/pipeline-knockout.mjs", noun: "recovered", sites: 1, atWriteSite: 1, verdict: "result",
     why: "written after the chunk files were actually removed" },
   { file: "driver/pipeline-knockout.mjs", noun: "outcome", sites: 3, atWriteSite: 3, verdict: "result",
-    why: "the reviewing pass's own verdict on itself, read at each writing site: `nothing-flagged` after "
-      + "the measurement came back empty, `applied` after the rewrite passed the merged gate and was "
+    why: "the reviewing pass's own verdict on itself, read at each writing site: `nothing-flagged` when "
+      + "the record had no line a reader meets first, `applied` after the rewrite passed the merged gate and was "
       + "written, and the `keep()` forms after the artifact or the gate refused it. Every one is a fact "
       + "about what already happened to the record, never the return of the call being logged" },
   { file: "driver/pipeline.mjs", noun: "closed", sites: 6, atWriteSite: 4, verdict: "result",

package/driver/scope-rules.mjs

@@ -99,7 +99,7 @@ export function checkClearanceScopeRules({ job = null, profile = null, resolved
   //
   // Everything a CLIENT reads quotes `named`. This module was the one caller that discarded the
   // originals, so the wall refused a two-country Full country search naming "GB", "FR" while the door
-  // refused the identical request naming "United Kingdom", "France" — products.mjs:141 states exactly
+  // refused the identical request naming "United Kingdom", "France" — tally() in products.mjs states exactly
   // that failure ("a refusal that quotes \"EU\" at someone who typed \"European Union\" sends them
   // hunting for a value they never used") and territory-tiers.mjs restates it for partitionTerritories.
   // The COUNT is the same either way: canonicalize dedups on code and products.mjs `tally` dedups on
@@ -131,7 +131,7 @@ export function checkClearanceScopeRules({ job = null, profile = null, resolved
   // `nativeLanguage: true` over a knockout base) and through any account whose defaultProduct does not
   // carry it.
   //
-  // That is the shape products.mjs:293 refuses `caseLaw` for in as many words — "a flag accepted and
+  // That is the shape CASE_LAW_NOT_A_REQUEST declared in products.mjs refuses `caseLaw` for in as many words — "a flag accepted and
   // dropped is the worst available shape: whoever sent it believes they bought the deep reading, and
   // nothing anywhere disagrees" — and it was this build's own doctrine broken by this build's own code.
   //

package/driver/stage-context.mjs

@@ -233,6 +233,15 @@ const UNDECLARED = {
   synthesis: (P) => [
     { path: P.enforcerSignals, kind: "conditional",
       why: "named in the prompt only when ctx.enforcerSignals > 0; aim-attention telemetry, deliberately outside the freshness map" },
+    // The job's own scope. The prompt never names it, so nothing declared it, and the sandbox rebuilt the
+    // declination spec without it: no marks and no classes, so both of the tool's refusals were off in every
+    // synthesis arm while the canonical pass had them on.
+    { path: P.instructedScope, kind: "driver-side",
+      why: "prepareDeclinationSpec writes the declination spec's scope from it; without it the tool's refusals rest on nothing and accept what the canonical pass refused" },
+    // The Chinese-evidence flags, named in the prompt only when ctx.jxAim is set (stages.mjs synthesis
+    // message). Undeclared, an arm on a run that had them dispatched without the block.
+    { path: driverDir(P.runDir, "jx", "aim-attention.json"), kind: "conditional",
+      why: "named in the prompt only when ctx.jxAim > 0 — the zh lane's aim-attention flags; aim-attention only, deliberately outside the freshness map" },
   ],
 };
 

package/driver/stages-knockout.mjs

@@ -560,9 +560,10 @@ export const KO_STAGES = {
     // be composed by anything except the production call site, which is how a dispatch goes unexamined
     // — and the promise has to branch. A stage message that says "the lines are below" and then lists
     // none has handed the seat an absence dressed as a pass, which is the reading this whole rule
-    // exists to stop. The driver does not dispatch on an empty measurement; the branch is here because
-    // "it cannot happen" is not a property a message should depend on.
-    message: ({ K, evidenceLines = [], exclusionNote = "" }) => lines(
+    // exists to stop. A record the driver's read flags nowhere is handed its first-read lines instead,
+    // by the owner's ruling of 2026-10-10, so both branches have rows under them; a record with no such
+    // line is not dispatched at all.
+    message: ({ K, evidenceLines = [], firstReadLines = [], exclusionNote = "" }) => lines(
       // THE CLIENT'S QUESTION LEADS, in the owner's words (ruling 2026-09-24), ahead of the rewrite job.
       `Does the report answer the client's question: who could object, how strong they are, what the client should do? Are the marks a lawyer would list present, and is each position written from the record that matters? Answer that before any check on wording.`,
       reads(["skills/clearance-search/report-prose.md"]),
@@ -571,8 +572,8 @@ export const KO_STAGES = {
       `The rated record: ${K.findings}. Read it — the lines named below are quoted from it and you are rewriting them in place.`,
       evidenceLines.length
         ? `THE DRIVER MEASURED THESE LINES. Each row is the line, the ADDRESS that names it, and what a deterministic read found. THIS IS EVIDENCE, NOT A VERDICT: judge each in context and pass over any where the word is the subject rather than the profession's shorthand. ${exclusionNote}`
-        : `THE DRIVER'S READ FLAGGED NO LINE ON THIS RECORD, so there is no table below and nothing here is evidence of a fault. Read the record yourself against the rule above; if it is already plain, send one \`declined\` row saying so rather than inventing a rewrite to fill the call.`,
-      ...evidenceLines,
+        : `THE DRIVER'S READ FLAGGED NO LINE ON THIS RECORD, so nothing below is evidence of a fault. These are the lines a reader meets first, each with the ADDRESS that names it. Rewrite one only where it would answer the client's question more plainly; if every line already does, send one \`declined\` row at one of these addresses saying so, rather than inventing a rewrite to fill the call.`,
+      ...(evidenceLines.length ? evidenceLines : firstReadLines),
       // ── THE DICTATION NAMES THE FIELD, NOT AN EFFECT ────────────────────────────────
       //
       // "Make the report plainer" is read and not applied, and nothing refuses — it simply does not