clearotron 0.4.1-beta.5 → 0.4.1

package/.env.example

@@ -106,6 +106,13 @@ CLEAROTRON_CODEX_PATH=codex
 # effect: tuning
 CLEAROTRON_TOOL_ANSWER_BYTES=
 
+# Runtime-injected — do NOT set this by hand. The driver sets it to 1 in the band tool server's env for the
+# placement step alone (driver/stages.mjs GROUP_READING_STAGES): that step is offered band_lookup's group
+# filter and reads the band shape with the orders written for it. Every other step is served both without
+# them. Set by hand, it would offer every step the group pages, and nothing in a run records that it did.
+# effect: silent-output-change
+# CLEAROTRON_BAND_GROUPS=
+
 CLEAROTRON_WORK_DIR=
 # Customer/project config store (loadProfiles). Unset ⇒ driver's built-in profiles dir.
 CLEAROTRON_CUSTOMERS_DIR=

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "d407cad37cded0141194ed22bbcaf698232202c8",
-  "version": "0.4.1-beta.5"
+  "commit": "e482d42d8937293290be77fc35633fd956d4bf10",
+  "version": "0.4.1"
 }

package/docs/architecture/04-configuration-reference.md

@@ -221,6 +221,7 @@ deployment may override (verify live values per deployment).
 | `CLEAROTRON_REGISTER_RECORD_LOG` | **runtime-injected per run**: `<runDir>/_driver/register-record-bodies.jsonl` | Citation-fidelity log: the BODY of every fetched official record. ** moved it INTO the run** — created with the run, unioned into the run's`_records/`, archived and purged with it. There is no retention setting and no cleanup job, because it no longer grows on the box: held globally it reached 432 MB in 61 days on production and needed a rotation timer on every install. **Do not set this by hand** — a fixed value pins every run's bodies to one file and restores the problem. A box upgraded across still holds its old global file; nothing writes or reads it, the driver names it once per process on stderr, and archiving it is one`mv`. An empty log cannot read as verified: the run's successful `record_fetch` rows in the (still global) call ledger are compared against the assembled record set, and a gap is reported as a failure. |
 | `CORSEARCH_CALL_LOG` / `CORSEARCH_RECORD_LOG` | — | **Deprecated, honoured for one release.** These are the names these two variables carried before the rename. Unset on every deployed box (all three ran the homedir default), so what actually protects an upgrade is the filename fallback: a`corsearch-calls.jsonl` / `corsearch-records.jsonl` already on disk keeps being read where it sits. Resolution order is in `providers/_shared/ledger-path.mjs`. |
 | `CLEAROTRON_BAND_RUN_DIR` | set per dispatch | The run dir the band MCP server writes into, injected per stage — unset means the server has no run to write to and says so rather than guessing one. |
+| `CLEAROTRON_BAND_GROUPS` | set per dispatch: `1` for the placement step alone, unset for every other | Whether the band MCP server offers `band_lookup`'s group filter and serves the band shape with the placement step's orders under its groups. Driver-set from `GROUP_READING_STAGES` in `driver/stages.mjs`; not operator configuration. |
 | `CLEAROTRON_FEEDBACK_DIR` | `<poolRoot>/_feedback` | Where report feedback flags are stored. Beside the pool by default so a deployment that moves the pool moves the flags with it. |
 | `USPTO_LOCAL_DB` | **none — set it to use `uspto-local`** | The local USPTO index (`node:sqlite` + FTS5) that `bin/uspto-sync.mjs` builds and the free US register reads. Named in `.env.example`; this is the reference row. |
 | `CLEAROTRON_JX_SUBCLASS_DB` | unset ⇒ the lane refuses by name | Path to the built similar-group database the JX subclass lane reads, produced by `providers/jx-subclass/load-public.mjs` from the committed public tables. It names WHERE the table lives; what the table says is the build's. Absence is a refusal rather than an empty answer — a clearance that silently found no similar groups is indistinguishable from one where the file was missing. |

package/driver/CHANGELOG.md

@@ -1,5 +1,47 @@
 # clearotron-driver
 
+## 0.4.1
+
+### Patch Changes
+
+- Fixed: On a crowded register search, the step that writes the findings no longer runs out of time and stops the search without a report.
+- Fixed: A connection library is updated to close a reported weakness in how sign-in details could be sent.
+- Fixed: A clearance started from a connected assistant under the Generic default now appears on Clearances when you choose Generic. Before, it showed only under All companies.
+- Fixed: A crowded clearance on the Codex engine no longer stops before its report.
+- Fixed: A register count or record that could not be fetched no longer shows the program's error message to a client. This covers the knockout workbook's count notes, the knockout report and a clearance finding card. Each shows the line the report already uses for something left open.
+- Fixed: A knockout's completion message and email now give its rating, or the highest rating when several names were screened. They no longer use the term 'worst band'.
+- Fixed: A client whose mark is written in another script, such as Greek, Cyrillic or Chinese, now receives the link to the report. Before, the email arrived without one.
+- Fixed: In rare cases, a report repaired just before delivery listed one conflict as two findings. Its last finding also lost its full write-up. The conflict now stays one finding, and every finding keeps its write-up.
+- Fixed: A clearance no longer stops before its report when findings link to an office's own page instead of the register record.
+- Fixed: A report repaired just before delivery keeps its coverage notes, such as a script that was not searched, in the report and the audit workbook.
+- Fixed: A report's conditions no longer include an internal note about the search's own checking steps.
+- Fixed: A clearance no longer reports a search as missing, or lowers a clear result, when the same search had already run under another entry.
+- Fixed: A search too broad for the register to count is no longer reported as one that could not be run. The report shows it as too large to read, with the register's own figure.
+- Fixed: Reports no longer say a search "did not finish and must be re-run" when a name's non-Latin form was in fact searched. They no longer make a conclusion depend on reviewing records the search had already read in full. Knockout reports now list every territory you ordered.
+- Fixed: The audit workbook no longer warns that the depth rules were applied to nothing on a clearance whose narrative is written in sections. Those rules govern per-finding write-ups, and such a narrative has none.
+- For operators: A stopped run no longer leaves behind a working folder linked to the Codex sign-in; leftovers are removed the next time Codex runs.
+- Fixed: An order for the European Union now also searches each member state's own trade mark register, at no extra search cost. A national registration — in France, for example — is now found by an EU search.
+- Before you upgrade: if you installed Codex yourself, update it to 0.159.0 or newer first. Older copies cannot use GPT-6.1 Sol, and searches on the OpenAI engine would stop at their first step.
+- Fixed: On Signa, a crowded search over several spellings now counts each spelling alone, so a rare spelling is no longer reported as crowded.
+- Fixed: Every clearance uses the same web search whichever engine runs it; the engines' own web search is switched off.
+- Fixed: Every live identical or near-identical mark a register search finds is now placed in the report or set aside with its reason.
+- New: `npx clearotron mcp` starts Clearotron's MCP server for an assistant; with no install it answers from the demo's sample runs, and says so.
+- New: Searches now use the latest models: Claude Haiku 5.5, Sonnet 5.5 and Opus 5.5, and OpenAI's GPT-6.1 Sol and GPT-6 Luna. Installing or updating Clearotron brings the Claude and Codex programs up to versions that can use them.
+- Fixed: The account connector's decision timeline no longer lists the engine's internal bookkeeping events.
+- Fixed: The address `clearotron start` and `clearotron demo` print for a client's assistant now answers as soon as it is printed.
+- Fixed: The account connector now lists a knockout search's review step, and no longer says the search makes two research calls per name.
+- Fixed: The audit workbook's coverage summary names each area in words, not the engine's identifiers.
+- Fixed: Two different names written in Greek, Cyrillic or Chinese characters, or differing only in an accented letter, can now be screened in one knockout. Before, they were refused as duplicates.
+- Fixed: Findings rated medium risk or higher are now checked for the owner's actual use in the same way on every company's risk ladder. That same search looks for the owner's record of oppositions and disputes, so "Likely to enforce" carries a rating instead of "not checked".
+
+## 0.4.1-beta.6
+
+### Patch Changes
+
+- Fixed: A clearance no longer reports a search as missing, or lowers a clear result, when the same search had already run under another entry.
+- Fixed: The account connector's decision timeline no longer lists the engine's internal bookkeeping events.
+- Fixed: The account connector now lists a knockout search's review step, and no longer says the search makes two research calls per name.
+
 ## 0.4.1-beta.5
 
 ### Patch Changes

package/driver/ask-ledger.mjs

@@ -341,6 +341,11 @@ export function deriveAsks({
     const deferrals = new Map((fr.deferrals ?? []).filter((d) => d?.directive).map((d) => [d.directive, d]));
     const qidsByKey = fr.directive_qids && typeof fr.directive_qids === "object" ? fr.directive_qids : {};
     const bornByKey = fr.born && typeof fr.born === "object" ? fr.born : {};
+    // A slice the fold refused as already-asked never ran: the plan row that asked its question did. The receipt
+    // names that row where the directive closed through it (`answered_elsewhere`), and its execution ends the ask.
+    const twinOf = new Map((Array.isArray(fr.answered_elsewhere) ? fr.answered_elsewhere : [])
+      .filter((x) => typeof x?.directive === "string")
+      .map((x) => [x.directive, new Map((Array.isArray(x.slices) ? x.slices : []).filter((t) => t?.qid && t?.twin).map((t) => [t.qid, t.twin]))]));
     for (const key of requested) {
       const qids = (Array.isArray(qidsByKey[key]) ? qidsByKey[key] : []).filter(Boolean);
       const place = bornByKey[key] === "form-neighbourhood" ? "form-neighbourhood" : "frame-diff";
@@ -351,7 +356,7 @@ export function deriveAsks({
         handoff = "open coverage row (frame-gap) + the CLEAR→CONDITIONAL clamp — the report states the unswept omission";
       } else if (swept.has(key)) {
         ending = qids.length
-          ? endingForQids(qids, join, ts)   // computed — null (open) when the execution record disagrees
+          ? endingForQids(qids.map((q) => twinOf.get(key)?.get(q) ?? q), join, ts)   // computed — null (open) when the execution record disagrees
           : mkEnding("executed", "frame-reopen-receipt", { evidence: "swept per the frame-reopen receipt (warm-resume arm — axis-level verification)", ts });
       }
       push({

package/driver/band-shape.mjs

@@ -1082,6 +1082,14 @@ const floorLineCount = (groups) => ["a", "b", "c", "d", "no_goods"].reduce((n, g
 /** The lookup that pages a group, as the shape and the form's refusal both name it, so the two cannot drift. */
 export const groupPageCall = (g) => `band_lookup {"group":"${g}"}`;
 
+// PLACEMENT'S ORDERS IN THE SHAPE. Three sentences under the groups tell the reader to give every line a fate,
+// and only placement owes the groups that. The band server serves the shape without them to every other
+// stage (Krzys's ruling, 2026-10-14), so they are declared once here and removed there by these same strings.
+export const SORT_THE_NEAR_ONES = "A few hundred? Sort by the client's goods and markets, read the near ones first, list the rest.";
+export const ONE_SET_ASIDE_ROW = "Write down what you set aside and why: one row, with this count.";
+export const A_FATE_BY_NAME = "Each line takes its own fate by name; no group row covers these lines.";
+export const PLACEMENT_GROUP_ORDERS = Object.freeze([SORT_THE_NEAR_ONES, ONE_SET_ASIDE_ROW, A_FATE_BY_NAME]);
+
 function renderGroupsMd(md, groups, rows = []) {
   md.push("", "## The band in the lawyer's order — for the client's goods first", "");
   if (groups.dominant_term && groups.manifest_dominant && normKey(groups.dominant_term) !== normKey(groups.manifest_dominant))
@@ -1127,7 +1135,7 @@ function renderGroupsMd(md, groups, rows = []) {
         ? `${count(grp)}. A thousand or more? The field is crowded. These are ${crowd[g]}. Read the first page, carry forward any line a lawyer would raise, and set the rest aside in this group's one row with the count: the client is told the field is crowded. ${firstPage}; page with ${groupPageCall(g)} only where a line needs reading.`
         : grp.lines <= READ_ALL_LINES
           ? `${count(grp)}. Fifty? Read them all.`
-          : `${count(grp)}. A few hundred? Sort by the client's goods and markets, read the near ones first, list the rest.`, "");
+          : `${count(grp)}. ${SORT_THE_NEAR_ONES}`, "");
     md.push(...head);
     for (const l of crowded ? grp.list.slice(0, groups.first_page) : grp.list) { rows.push([md.length, l.key]); md.push(row(l)); }
     md.push("");
@@ -1137,10 +1145,10 @@ function renderGroupsMd(md, groups, rows = []) {
   // more, where its one row stands on that page read and the count.
   const rest = groups.rest;
   const restCrowded = rest.records >= groups.crowded_at;
-  md.push(`**The rest: ${count(rest)}${outside}** — every record in none of (a) to (d) above. ${!rest.lines ? "Write down what you set aside and why: one row, with this count."
+  md.push(`**The rest: ${count(rest)}${outside}** — every record in none of (a) to (d) above. ${!rest.lines ? ONE_SET_ASIDE_ROW
     : restCrowded
       ? `A thousand or more? The field is crowded. Read the first page, carry forward any line a lawyer would raise, and set the rest aside in this group's one row with the count: the client is told the field is crowded. ${firstPage}; page with ${groupPageCall("rest")} only where a line needs reading.`
-      : `${rest.lines <= READ_ALL_LINES ? "Fifty? Read them all." : "A few hundred? Sort by the client's goods and markets, read the near ones first, list the rest."} Write down what you set aside and why: one row, with this count.`}`);
+      : `${rest.lines <= READ_ALL_LINES ? "Fifty? Read them all." : SORT_THE_NEAR_ONES} ${ONE_SET_ASIDE_ROW}`}`);
   if (rest.lines) {
     md.push("", ...head);
     for (const l of restCrowded ? rest.list.slice(0, groups.first_page) : rest.list) { rows.push([md.length, l.key]); md.push(row(l)); }
@@ -1157,7 +1165,7 @@ function renderGroupsMd(md, groups, rows = []) {
       : `**Goods the test could not read: ${count(ng)}.**`;
     md.push("", crowded
       ? `${lead} A thousand or more? ${firstPage}, the floors first, then the live ones in the ordered classes. Carry forward any line a lawyer would raise, and set the rest aside in this list's one row with the count, on the ground that their goods are unreadable and the field is crowded. A floor here is placed or set aside by name on its status or its territory; this row never covers it. Where more floors are counted than this page shows, page the rest with ${groupPageCall("no_goods")}; they come first.`
-      : `${lead} ${ng.lines <= READ_ALL_LINES ? "Fifty? Read them all." : "A few hundred? Read the live ones in the ordered classes first."} Each line takes its own fate by name; no group row covers these lines.${tested.source === "none" ? "" : ' A line marked "on file, not readable" has goods on file: open its record with band_record before its fate. A line marked "no goods on file" has nothing to open.'} A floor here is placed, or set aside by name on its status or its territory; any other line may be set aside on the ground that its goods are unknown.`, "");
+      : `${lead} ${ng.lines <= READ_ALL_LINES ? "Fifty? Read them all." : "A few hundred? Read the live ones in the ordered classes first."} ${A_FATE_BY_NAME}${tested.source === "none" ? "" : ' A line marked "on file, not readable" has goods on file: open its record with band_record before its fate. A line marked "no goods on file" has nothing to open.'} A floor here is placed, or set aside by name on its status or its territory; any other line may be set aside on the ground that its goods are unknown.`, "");
     md.push(...head);
     for (const l of crowded ? ng.list.slice(0, groups.first_page) : ng.list) { rows.push([md.length, l.key]); md.push(row(l)); }
   }

package/driver/close-verify.mjs

@@ -59,6 +59,18 @@ export function blockCollapsed(block) {
   return state === "enumerated" && Number.isFinite(total) && total > 0 && recs === 0;
 }
 
+/**
+ * The plan row that answers a minted slice: the slice itself, or, where the fold refused it as already-asked, the
+ * row it duplicates. Such a slice is never frozen into the plan and never runs; its question was asked by the twin.
+ * ONLY THE DUPLICATE KIND RESOLVES: an identity collision or a malformed term asked a question nothing else asked.
+ * `foldRefusals` maps a refused qid to `{kind, twin}`, as `foldSupplementalEntries` records it. One rule for the
+ * directive below and the remedy term ledger (remedy-accounting.mjs), so the two cannot read a slice apart. PURE.
+ */
+export function answeredAs(qid, foldRefusals) {
+  const r = foldRefusals?.get?.(qid);
+  return r && r.kind === "duplicate-question" && r.twin ? String(r.twin) : qid;
+}
+
 /**
  * Verify a register frame-reopen directive was actually SEARCHED as intended (Part B, arm #1). A directive
  * is closed ONLY if EVERY minted qid clears three checks:
@@ -70,22 +82,29 @@ export function blockCollapsed(block) {
  *      wrong-scope 0/0). Indeterminate pins fall through to 1+2 — a strict tightening over byte-diff, never
  *      a new false deferral.
  * PURE. `executedQids` is a Set of joinPlanToBands.executed qids; `blocksByQid` maps qid → band block.
- * @returns {{closed: boolean, reason: string|null}}
+ *
+ * A slice the fold refused as already-asked is checked on the row that answered it (`answeredAs`), on the same
+ * three checks, and a directive closed that way names each such row in `answered_by`.
+ * @returns {{closed: boolean, reason: string|null, answered_by?: {qid: string, twin: string}[]}}
  */
-export function verifyRegisterDirectiveClose({ qids, intendedClasses = [], executedQids, blocksByQid } = {}) {
+export function verifyRegisterDirectiveClose({ qids, intendedClasses = [], executedQids, blocksByQid, foldRefusals = new Map() } = {}) {
   const list = qids ?? [];
   if (!list.length) return { closed: false, reason: "no-slice-dispatched" };
   const want = [...new Set((intendedClasses ?? []).map(String))];
   const executed = executedQids ?? new Set();
   const byQid = blocksByQid ?? new Map();
+  const answeredBy = [];
   for (const qid of list) {
-    if (!executed.has(qid)) return { closed: false, reason: `slice-not-landed:${qid}` };
-    const b = byQid.get(qid);
-    if (!b) return { closed: false, reason: `no-band-block:${qid}` };
-    if (blockCollapsed(b)) return { closed: false, reason: `collapsed-slice:${qid}` };
+    const q = answeredAs(qid, foldRefusals);
+    const as = q === qid ? qid : `${qid} (answered by ${q})`;
+    if (!executed.has(q)) return { closed: false, reason: `slice-not-landed:${as}` };
+    const b = byQid.get(q);
+    if (!b) return { closed: false, reason: `no-band-block:${as}` };
+    if (blockCollapsed(b)) return { closed: false, reason: `collapsed-slice:${as}` };
     const searched = blockSearchedClasses(b);
     if (want.length && searched.length && !want.every((c) => searched.includes(c)))
-      return { closed: false, reason: `wrong-scope:${qid} searched[${searched.join(",")}]⊉intended[${want.join(",")}]` };
+      return { closed: false, reason: `wrong-scope:${as} searched[${searched.join(",")}]⊉intended[${want.join(",")}]` };
+    if (q !== qid) answeredBy.push({ qid, twin: q });
   }
-  return { closed: true, reason: null };
+  return { closed: true, reason: null, ...(answeredBy.length ? { answered_by: answeredBy } : {}) };
 }

package/driver/engine/anthropic-agent.mjs

@@ -16,6 +16,7 @@
 // watchdog heartbeat (--include-partial-messages).
 
 import { spawn } from "node:child_process";
+import { StringDecoder } from "node:string_decoder";
 import { statSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, dirname } from "node:path";
@@ -594,6 +595,9 @@ export const anthropicAgentEngine = {
       child.stdin.on("error", () => {});
       try { child.stdin.write(input); child.stdin.end(); } catch { /* child gone — handled by close/error */ }
       let buf = "", stderr = "", resultEvent = null, killed = false, stallKill = false, settled = false;
+      // A CHUNK IS NOT A CHARACTER: a character split across two chunks of a pipe is held by its stream's decoder
+      // until the rest arrives (common.mjs `runStreamingChild` says why). The raw sink still takes the bytes.
+      const outText = new StringDecoder("utf8"), errText = new StringDecoder("utf8");
       let noProgressKill = false;               // the no-progress ceiling fired (a stall discriminator, see noProgressMs)
       let trickleKill = false;                  // the token-rate floor fired (a stall discriminator, see minTokensPerSec)
       let overflow = false;                     // A3: stdout/stderr exceeded maxBuffer — force a nonzero fail, never parse the truncated tail
@@ -1091,7 +1095,7 @@ export const anthropicAgentEngine = {
         prevChunkAt = Date.now();
         lastMove = Date.now();   // ANY streamed byte = liveness → resets the stall clock
         sink.write(d);           // the raw stream, byte for byte, before anything parses it
-        buf += d.toString();
+        buf += outText.write(d);
         let nl;
         while ((nl = buf.indexOf("\n")) >= 0) { parseLine(buf.slice(0, nl)); buf = buf.slice(nl + 1); }
         if (buf.length > maxBuffer) { buf = buf.slice(0, maxBuffer); overflowKill(); }
@@ -1109,7 +1113,7 @@ export const anthropicAgentEngine = {
         // The diagnostic follows the same rule deliberately. `firstByteMs=NEVER` now means "never spoke
         // its protocol", which is the question the no-progress specimen is actually asking — a number
         // that came from a stderr line would have answered a different one.
-        stderr += d.toString();
+        stderr += errText.write(d);
         if (stderr.length > maxBuffer) { stderr = stderr.slice(0, maxBuffer); overflowKill(); }
       });
       // error + close can BOTH fire for a single failure (Node) → settle EXACTLY once (no double clearInterval/resolve).
@@ -1125,7 +1129,7 @@ export const anthropicAgentEngine = {
         // settlement must never wait on a pipe some straggler keeps open (the group SIGKILL reaps the tree).
         try { child.stdout.destroy(); } catch { /* stream gone */ }
         try { child.stderr.destroy(); } catch { /* stream gone */ }
-        if (!overflow) { parseLine(buf); }   // B1: flush the final, un-terminated line (the result event) — but NEVER the truncated overflow tail
+        if (!overflow) { buf += outText.end(); stderr += errText.end(); parseLine(buf); }   // B1: flush the final, un-terminated line (the result event) — but NEVER the truncated overflow tail
         const stream = sink.close();   // after the flush: every byte the program wrote is in it, or the record says why not
         buf = "";
         // ONE SAMPLE OF THE CLOCK, and both quantities below are derived from it. Two `Date.now()` calls

package/driver/engine/common.mjs

@@ -19,6 +19,7 @@
 // the engines it serves.
 
 import { spawn } from "node:child_process";
+import { StringDecoder } from "node:string_decoder";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { recordEngineChild, clearEngineChild } from "./child-record.mjs";   //
@@ -190,6 +191,10 @@ export function runStreamingChild({
     try { child.stdin.write(input ?? ""); child.stdin.end(); } catch { /* child gone — handled by close/error */ }
 
     let buf = "", stdoutAll = "", stderr = "";
+    // A CHUNK IS NOT A CHARACTER. A pipe hands the output over in chunks, and a character of two or more bytes can
+    // straddle two of them: decoded one chunk at a time, its halves read as replacement characters. One decoder per
+    // stream holds a split character's first bytes until the rest arrive.
+    const outText = new StringDecoder("utf8"), errText = new StringDecoder("utf8");
     let killed = false, stallKill = false, overflow = false, settled = false;
     let lastMove = Date.now();
     // — false until the child's FIRST byte on EITHER stream. Not "first liveness byte": a
@@ -248,7 +253,7 @@ export function runStreamingChild({
       if (settled || overflow) return;
       sawOutput = true; firstOutputAt ||= Date.now();        // — the child has spoken; startup is over
       lastMove = Date.now();   // ANY streamed byte = liveness → resets the stall clock
-      const s = d.toString();
+      const s = outText.write(d);
       buf += s; stdoutAll += s;
       let nl;
       while ((nl = buf.indexOf("\n")) >= 0) { emitLine(buf.slice(0, nl)); buf = buf.slice(nl + 1); }
@@ -258,7 +263,7 @@ export function runStreamingChild({
       if (settled || overflow) return;
       sawOutput = true; firstOutputAt ||= Date.now();        // — spoken is spoken, whether or not this stream counts as liveness
       if (stderrIsLiveness) lastMove = Date.now();   // codex progress lives on stderr → it is liveness too
-      stderr += d.toString();
+      stderr += errText.write(d);
       if (stderr.length > maxBuffer) { stderr = stderr.slice(0, maxBuffer); overflowKill(); }
     });
 
@@ -282,7 +287,9 @@ export function runStreamingChild({
       // settlement must never wait on a pipe some straggler keeps open (the group SIGKILL reaps the tree).
       try { child.stdout.destroy(); } catch { /* stream gone */ }
       try { child.stderr.destroy(); } catch { /* stream gone */ }
-      if (!overflow) emitLine(buf);   // B1: flush the final, un-terminated line — but NEVER the truncated overflow tail
+      // B1: flush the final, un-terminated line — but NEVER the truncated overflow tail. The decoders give up
+      // what they held: a character the program never finished reads as a replacement character, once.
+      if (!overflow) { const tail = outText.end(); buf += tail; stdoutAll += tail; stderr += errText.end(); emitLine(buf); }
       buf = "";
       resolve({
         rawCode: typeof code === "number" ? code : null,

package/driver/engine/mcp/band-server.mjs

@@ -21,10 +21,10 @@ import { join, dirname } from "node:path";
 import { driverDir } from "../../../shared/driver-dir.mjs";   //
 import { serve } from "./stdio-server.mjs";
 import { answerBudget, quotedBytes } from "../../../shared/answer-parts.mjs";
-import { classifyRecord, prepareTargets, SHAPE_TIERS, isLiveRecord, niceClassKey } from "../../band-shape.mjs";
+import { classifyRecord, prepareTargets, SHAPE_TIERS, isLiveRecord, niceClassKey, PLACEMENT_GROUP_ORDERS } from "../../band-shape.mjs";
 import { recordQids } from "../../named-band.mjs";
 import { normalizeRecordUri } from "../../registry-fidelity.mjs";
-import { bandGoodsIndex, goodsFor, goodsWordCounter, goodsWordsMatched, untaggedIsEnglish } from "../../record-goods.mjs";
+import { bandGoodsIndex, goodsFor, goodsWordCounter, goodsWordsMatched, rawGoodsCarried, untaggedIsEnglish } from "../../record-goods.mjs";
 
 const RUN_DIR = process.env.CLEAROTRON_BAND_RUN_DIR || "";
 const SESSION = process.env.CLEAROTRON_GATHER_SESSION_KEY || "";
@@ -108,7 +108,8 @@ const SHAPE_PART_CHARS = 70000;   // step 3 — was a knob; no environment ever
 // band_lookup of 100 fat records or a pathological official record could exceed the engine's
 // per-tool-output token cap and error the call — killing the reading path exactly where the record
 // volume is highest. band_lookup TRIMS records (the full match count always survives, with an
-// honest note); band_record serves PARTS like band_shape (a record is a document — never trimmed).
+// honest note); band_record serves PARTS like band_shape (a record is a document — never trimmed of anything it
+// says; a goods list it says twice is served once, at `recordAsServed`).
 // Given an answer size and no band size of its own, the band answers in five sixths of it: the rest is room
 // for the quotes and line breaks a printout adds (up to 13% on band answers) and for a banner, so a band
 // answer is never split a second time (shared/answer-parts.mjs). 37,500 on Claude, 30,000 on codex.
@@ -264,7 +265,7 @@ function bandShape(params) {
   const p = format === "json" ? shapeJsonPath() : shapeMdPath();
   if (!RUN_DIR) { logRead("band_shape", { format }, { ok: false }); return { isError: true, text: "ERROR: CLEAROTRON_BAND_RUN_DIR not set — band tools are wired per run by the driver." }; }
   if (!existsSync(p)) { logRead("band_shape", { format }, { ok: false }); return { isError: true, text: `ERROR: ${p} not found — the driver derives it after the register fan-in; if the band exists but the shape does not, report this as a driver defect (do NOT slice the raw band instead).` }; }
-  const text = readFileSync(p, "utf8");
+  const text = format === "md" && !GROUP_PAGES ? withoutPlacementOrders(readFileSync(p, "utf8")) : readFileSync(p, "utf8");
   const parts = splitAtLines(text, SHAPE_PART_SERVED);
   const total = parts.length;
   const read = format === "md" ? linesByPart(parts) : null;
@@ -434,6 +435,26 @@ function bandLookup(params = {}) {
   return out;
 }
 
+// A RECORD'S GOODS ARE SERVED ONCE. A Clarivate record carries the register's raw goods list beside the
+// normalised goods the provider maps from it item for item (record-goods.mjs `rawGoodsCarried`), so every goods
+// statement was read twice. On a crowded test run, 2026-10-13, one synthesis attempt read 10.79 MB of record
+// text in 549 calls; served this way, the same records come to 6.04 MB in 398. Where the normalised goods carry
+// the raw list, the record is served without that list, in the file's own layout and field order, and anything
+// else in the raw goods block stays; where they do not, or the text is not a record, it is served as it
+// stands. The file on disk is never touched, and the reading audit says how much was left out.
+function recordAsServed(text) {
+  let body;
+  try { body = JSON.parse(text); } catch { return { text, audit: {} }; }
+  if (!rawGoodsCarried(body)) return { text, audit: {} };
+  const goods = { ...body._raw.goodsServices };
+  delete goods.intClassDescriptions;
+  const raw = { ...body._raw, goodsServices: goods };
+  if (!Object.keys(goods).length) delete raw.goodsServices;
+  const indent = /^\{\n( +)"/.exec(text)?.[1]?.length ?? 0;
+  const served = JSON.stringify({ ...body, _raw: raw }, null, indent) + (text.endsWith("\n") ? "\n" : "");
+  return { text: served, audit: { raw_goods_left_out: text.length - served.length } };
+}
+
 function bandRecord(params = {}) {
   if (!RUN_DIR) return { isError: true, text: "ERROR: CLEAROTRON_BAND_RUN_DIR not set — band tools are wired per run by the driver." };
   const uri = String(params.record_id ?? "").trim();
@@ -461,16 +482,18 @@ function bandRecord(params = {}) {
     // How the cite resolved rides the log: an `exact` hit is the model quoting the store's own key; any
     // other value is this ladder doing work, and the reading audit says which and to what.
     const resolution = hit.via === "exact" ? {} : { via: hit.via, ...(hit.resolved ? { resolved: hit.resolved } : {}) };
+    const served = recordAsServed(text);
+    text = served.text;
     const parts = splitAtLines(text, RESPONSE_CHARS);
     const total = parts.length;
-    if (total === 1) {                                  // the common case — served verbatim, no banner
-      logRead("band_record", { record_id: uri }, { ok: true, bytes: text.length, ...resolution });
+    if (total === 1) {                                  // the common case — one part, no banner
+      logRead("band_record", { record_id: uri }, { ok: true, bytes: text.length, ...resolution, ...served.audit });
       return text;
     }
     // An oversize official record serves in PARTS, as band_shape does: line-boundary splits, byte-identical
     // concatenation, and a banner that says the next part continues it.
     const part = Math.min(Math.max(1, Math.floor(Number(params.part)) || 1), total);
-    logRead("band_record", { record_id: uri, part, parts: total }, { ok: true, bytes: parts[part - 1].length, total_bytes: text.length, ...resolution });
+    logRead("band_record", { record_id: uri, part, parts: total }, { ok: true, bytes: parts[part - 1].length, total_bytes: text.length, ...resolution, ...served.audit });
     const head = `[band_record part ${part}/${total}. This record is served in ${total} parts; the next part continues it.]`;
     const tail = part < total
       ? `\n[end of part ${part}/${total} — call band_record again with {"record_id": "${uri}", "part": ${part + 1}} for the next part]`
@@ -484,15 +507,16 @@ function bandRecord(params = {}) {
   // fetched this run", which is a different claim and was false four times on a delivered round.
   const fromLedger = recordFromLedger(uri);
   if (fromLedger) {
-    const text = JSON.stringify(fromLedger, null, 2);
+    const served = recordAsServed(JSON.stringify(fromLedger, null, 2));
+    const text = served.text;
     const parts = splitAtLines(text, RESPONSE_CHARS);
     if (parts.length === 1) {
-      logRead("band_record", { record_id: uri }, { ok: true, bytes: text.length, via: "ledger" });
+      logRead("band_record", { record_id: uri }, { ok: true, bytes: text.length, via: "ledger", ...served.audit });
       return { type: "text", text };
     }
     const wanted = Number(params.part ?? 1);
     const part = Number.isInteger(wanted) && wanted >= 1 && wanted <= parts.length ? wanted : 1;
-    logRead("band_record", { record_id: uri }, { ok: true, bytes: text.length, via: "ledger", part, parts: parts.length });
+    logRead("band_record", { record_id: uri }, { ok: true, bytes: text.length, via: "ledger", part, parts: parts.length, ...served.audit });
     return { type: "text", text: `[record ${uri} — part ${part}/${parts.length}]\n` + parts[part - 1]
       + (part < parts.length ? `\n[end of part ${part}/${parts.length} — call band_record again with {"record_id": "${uri}", "part": ${part + 1}}]` : "") };
   }
@@ -511,6 +535,25 @@ function bandRecord(params = {}) {
   return { isError: true, text: `${why} ${available.length ? `Records on file (${available.length}): ${available.slice(0, 40).join(", ")}${available.length > 40 ? ", …" : ""}.` : "No records fetched yet."} This tool is read-only — it never fetches; a record you need but do not have is an honest gap to state, not a reason to guess.` };
 }
 
+// THE SHAPE'S GROUP PAGES ARE PLACEMENT'S. Placement owes every line a group lists a fate, so it is offered the
+// group filter and told that a group is read page by page. No other stage owes the band a read, and a synthesis
+// offered the same paged an exhausted group 2,498 times (measured on a test run, 2026-10-13). The driver sets
+// CLEAROTRON_BAND_GROUPS for placement alone (stages.mjs GROUP_READING_STAGES); every other stage is offered
+// the lookup without `group`, in the words every stage had before group pages existed. A group argument that
+// arrives anyway is served as before: the offer changes, not what the tool answers.
+const GROUP_PAGES = process.env.CLEAROTRON_BAND_GROUPS === "1";
+// The same holds for the shape's own orders under the groups: placement reads them, and every other stage is
+// served the shape without them (Krzys's ruling, 2026-10-14). Each is removed with the space before it, inside
+// its line, so no line moves and the line each listed mark is printed on, which `linesByPart` reads, still holds.
+const withoutPlacementOrders = (text) => PLACEMENT_GROUP_ORDERS.reduce((t, order) => t.split(` ${order}`).join("").split(order).join(""), text);
+const LOOKUP_DESCRIPTION = "Look up enumerated records in this run's frozen register band (read-only; logged to the reading audit). Filters AND together: record_id (exact uri), owner (substring), nice_class, tier (identical|near-identical|same-family|other|unclassifiable — classified against the shape's frozen targets), qid (exact plan-entry id — the plan-execution ledger join; a record surfaced by several slices matches under EVERY one of them), query (the _query slice that surfaced the record), text (substring of mark_text), status (substring), live_only, goods (words: records whose goods contain any of them, as whole words, singular or plural; a record with no goods on file matches too), group (a, b, c, d, rest or no_goods: that list's lines in the shape's order, one per mark of an owner), limit (default 20, max 100), offset (default 0: where in the matching records or lines to start — a capped answer names the next offset, so a large band or group is read page by page). On each record served, `goods_words` gives the client's goods words its goods hold, as the shape tests them (k of N: the words), or null where its goods cannot be read; the goods text is in band_record. Matching un-enumerated crowd descriptors ride along so a lookup can never mistake a counted-only zone for a clean.";
+const LOOKUP_GROUP_CLAUSE = "group (a, b, c, d, rest or no_goods: that list's lines in the shape's order, one per mark of an owner), ";
+const LOOKUP_OFFSET_GROUPS = "offset (default 0: where in the matching records or lines to start — a capped answer names the next offset, so a large band or group is read page by page)";
+const LOOKUP_OFFSET_BAND = "offset (default 0: where in the matching records to start — a capped answer names the next offset, so a large band is read page by page)";
+/** The lookup's description as a stage is offered it: whole where it reads the groups, without them elsewhere. PURE. */
+const lookupDescription = (groupPages) => (groupPages ? LOOKUP_DESCRIPTION
+  : LOOKUP_DESCRIPTION.replace(LOOKUP_GROUP_CLAUSE, "").replace(LOOKUP_OFFSET_GROUPS, LOOKUP_OFFSET_BAND));
+
 serve({
   name: "band", version: "0.1.0",
   tools: [
@@ -523,12 +566,12 @@ serve({
     },
     {
       name: "band_lookup",
-      description: "Look up enumerated records in this run's frozen register band (read-only; logged to the reading audit). Filters AND together: record_id (exact uri), owner (substring), nice_class, tier (identical|near-identical|same-family|other|unclassifiable — classified against the shape's frozen targets), qid (exact plan-entry id — the plan-execution ledger join; a record surfaced by several slices matches under EVERY one of them), query (the _query slice that surfaced the record), text (substring of mark_text), status (substring), live_only, goods (words: records whose goods contain any of them, as whole words, singular or plural; a record with no goods on file matches too), group (a, b, c, d, rest or no_goods: that list's lines in the shape's order, one per mark of an owner), limit (default 20, max 100), offset (default 0: where in the matching records or lines to start — a capped answer names the next offset, so a large band or group is read page by page). On each record served, `goods_words` gives the client's goods words its goods hold, as the shape tests them (k of N: the words), or null where its goods cannot be read; the goods text is in band_record. Matching un-enumerated crowd descriptors ride along so a lookup can never mistake a counted-only zone for a clean.",
+      description: lookupDescription(GROUP_PAGES),
       inputSchema: { type: "object", properties: {
         record_id: { type: "string" }, owner: { type: "string" }, nice_class: { type: "string" },
         tier: { type: "string", enum: SHAPE_TIERS }, qid: { type: "string" }, query: { type: "string" }, text: { type: "string" },
         status: { type: "string" }, live_only: { type: "boolean" }, goods: { type: "array", items: { type: "string" } },
-        group: { type: "string", enum: ["a", "b", "c", "d", "rest", "no_goods"] },
+        ...(GROUP_PAGES ? { group: { type: "string", enum: ["a", "b", "c", "d", "rest", "no_goods"] } } : {}),
         limit: { type: "number" }, offset: { type: "number" },
       } },
       annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },

package/driver/engine/mcp/codex-config.mjs

@@ -161,6 +161,7 @@ export function renderCodexConfigToml({ mcpConfig, allowedTools, developerInstru
   // recorded search returned (observed in testing, 2026-10). The Claude engine removes its own the same way
   // (OWN_SEARCH_TOOLS, anthropic-agent.mjs). The case-law step's page fetcher is a tool server, not this.
   lines.push(`web_search = "disabled"`, "");
+  lines.push(...featuresToml(withheldFromCommands));
   lines.push(...commandEnvToml(withheldFromCommands));
 
   const emitServer = (name, s, { forwardCreds } = {}) => {
@@ -244,11 +245,30 @@ export function renderCodexConfigToml({ mcpConfig, allowedTools, developerInstru
 // Filter names are matched without regard to case, and codex refuses the whole file if two of them are
 // the same name in different case, so each name is written once whatever its case.
 export function commandEnvToml(withheld = []) {
-  const seen = new Set();
-  const names = (withheld ?? []).filter((n) => n && !seen.has(n.toUpperCase()) && seen.add(n.toUpperCase()));
+  const names = withheldNames(withheld);
   if (!names.length) return [];
-  return ["[features]", "shell_snapshot = false", "",
-    "[shell_environment_policy.filters]", ...names.map((n) => `${tomlString(n)} = "exclude"`), ""];
+  return ["[shell_environment_policy.filters]", ...names.map((n) => `${tomlString(n)} = "exclude"`), ""];
+}
+const withheldNames = (withheld) => {
+  const seen = new Set();
+  return (withheld ?? []).filter((n) => n && !seen.has(n.toUpperCase()) && seen.add(n.toUpperCase()));
+};
+
+// ── the program's own features: what is off on every stage ──────────────────────────────────────
+// ONE TABLE, WRITTEN ON EVERY STAGE: TOML refuses a table defined twice, so everything under `[features]`
+// is written here.
+//
+// THE SIGN-IN'S APPS ARE OFF. A ChatGPT sign-in brings the program's apps (connectors) into every session
+// as a tool server of its own, `codex_apps`, beside the servers a stage is given. Its search service opened
+// live web pages on a knockout stage once the program's own web search was off (measured on 0.162.0,
+// 2026-10-13). `apps = false` switches the integration off (the vendor's configuration reference,
+// `features.apps`: "Enable app (connector) integrations (stable; on by default)"), in every safety setting.
+// The web-search setting above never reached it: its filters "do not restrict connectors or MCP servers"
+// (`tools.web_search`, the same reference).
+//
+// The shell snapshot is off wherever names are withheld from commands (`commandEnvToml` says why).
+export function featuresToml(withheld = []) {
+  return ["[features]", "apps = false", ...(withheldNames(withheld).length ? ["shell_snapshot = false"] : []), ""];
 }
 
 // ── the stage's permission profile: what its shell commands may read and write ──────────────────────

package/driver/engine/mcp/gather-config.mjs

@@ -849,13 +849,14 @@ export const claudeToolAnswerBytes = (env = process.env) =>
 // The mcp-config server env carries ONLY the per-run, non-secret values (session key + ledger paths +
 // agent + the run dir the band tools serve, and the answer size above). Creds (CORSEARCH_SESSION_KEY /
 // PERPLEXITY_API_KEY / EUIPO_*) are inherited from the engine env.
-function serverEnv({ sessionKey, agent, runDir, recordAxis }) {
+function serverEnv({ sessionKey, agent, runDir, recordAxis, bandGroups = false }) {
   const e = {};
   // — see buildGatherMcpConfig: a register server without a run is refused there, so by the time
   // the record-log line below runs, `runDir` is present for every config that could use it.
   if (sessionKey) e.CLEAROTRON_GATHER_SESSION_KEY = sessionKey;
   if (agent) e.CLEAROTRON_GATHER_AGENT = agent;
   if (runDir) e.CLEAROTRON_BAND_RUN_DIR = runDir;   // band-server: which run's band/shape/_records to serve + where the reading log lands
+  if (bandGroups) e.CLEAROTRON_BAND_GROUPS = "1";   // band-server: offer the shape's group pages (stages.mjs GROUP_READING_STAGES)
   // conversion 5 — THE BOUND CARD INDEX. A fan-out recording stage writes ONE member of a
   // per-ordinal artifact, and which one is the DRIVER's answer: it knows what it fanned out. Handed to
   // the server per turn so the acceptance boundary can refuse a payload naming any other index, which
@@ -899,7 +900,7 @@ function serverEnv({ sessionKey, agent, runDir, recordAxis }) {
 
 // Build the mcp-config object for a set of groups. Returns { config: <object>, servers: [...] } or null if
 // the groups need no MCP server (e.g. caselaw-only EUR-Lex via WebFetch needs no server but the bridges do).
-export function buildGatherMcpConfig(groups = [], { sessionKey, agent, runDir, recordAxis } = {}) {
+export function buildGatherMcpConfig(groups = [], { sessionKey, agent, runDir, recordAxis, bandGroups = false } = {}) {
   const localKeys = new Set(), bridgeKeys = new Set();
   for (const g of groups) { const r = resolveGroup(g); r.local.forEach((k) => localKeys.add(k)); r.bridges.forEach((k) => bridgeKeys.add(k)); }
   const mcpServers = {};
@@ -929,7 +930,7 @@ export function buildGatherMcpConfig(groups = [], { sessionKey, agent, runDir, r
         + "belong to their run, and the box-global ledger is retired. Pass runDir.");
     }
   }
-  const env = serverEnv({ sessionKey, agent, runDir, recordAxis });
+  const env = serverEnv({ sessionKey, agent, runDir, recordAxis, bandGroups });
   for (const k of localKeys) mcpServers[k] = { command: NODE, args: [join(MCP_DIR, localEntry(k).script)], env };
   // — THE BRIDGES GET THE AUDIT ENV, AND ONLY THAT. Until now they were spawned with no env at
   // all, so a case-law tool call had nowhere to log: `tool-calls.jsonl` recorded server/tool/ok and the

package/driver/gateway.mjs

@@ -240,7 +240,7 @@ import { knockoutReviewRefusalsFor } from "./knockout-review-record.mjs";
 import { profilesStoreDir } from "./profiles.mjs";
 // The supplemental lane's single source (stages.mjs). The import is acyclic — stages.mjs reads
 // verify/coverage-ledger/config/framework and never reaches back here.
-import { REGISTER_ENUMERATE_TOOL, SUPPLEMENTAL_LANE_STEERING } from "./stages.mjs";
+import { REGISTER_ENUMERATE_TOOL, SUPPLEMENTAL_LANE_STEERING, GROUP_READING_STAGES } from "./stages.mjs";
 // The ONE kill-class discriminator (timeout/status_timeout fails, exit 137, killed, hard-wall/stall
 // signals; lane_wedge and rate_limited deliberately excluded). Reused verbatim so "a kill" means the
 // same thing to the exit-1 rescue below as it does to the register taint chain that reads the very
@@ -927,7 +927,8 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     if (groups.length) {
       // The bound card index rides the same label the grant was resolved from — derived by the SAME
       // declared rule (`perAxis`), never by a second string-sniff that could disagree with it.
-      const cfg = buildGatherMcpConfig(groups, { sessionKey, agent, runDir, recordAxis: recordAxisFor(name)?.axis });
+      const cfg = buildGatherMcpConfig(groups, { sessionKey, agent, runDir, recordAxis: recordAxisFor(name)?.axis,
+        bandGroups: GROUP_READING_STAGES.has(name) });
       gatherMcpConfig = cfg ? JSON.stringify(cfg) : undefined;
       gatherAllowedTools = allowedToolsFor(groups);
       gatherSeatWrites = seatWritesForGroups(groups);   // — the SAME derivation allowedToolsFor uses
@@ -2354,6 +2355,13 @@ export function frameDiffUndispatchable(expectFile, lastFail = "framediff_direct
  * — the routing was already correct, the prose was not. So the closing clause is the one part of a hint
  * that has to know, and it is passed rather than guessed.
  */
+// THE CLEARANCE WRITER'S FINDINGS CONTRACT, AND ONLY IT. A knockout finding's refusals carry `knockout_finding_*`
+// and `knockoutassess_finding_*` tokens (findings-model.mjs), prefixed so that no clearance branch would take
+// them; a bare `findings?_` matched the `finding_` inside them anyway, named findings.json, a file a knockout
+// run never has, and handed the model the clearance contract's keys. `synthesis_findings_*` stays the
+// clearance writer's.
+const CLEARANCE_FINDINGS_TOKEN_RE = /(?<!knockout_|knockoutassess_)findings?_/;
+
 export function correctionHint(lastFail, { gridLedgerName = "common-law-grid.json", supplementalLane = false, undispatchable = [], toolWritten = null } = {}) {
   // The repair act, for the hints that name one. Kept to a single sentence and a single decision so a
   // new hint has one thing to append rather than a branch to reproduce.
@@ -2361,11 +2369,11 @@ export function correctionHint(lastFail, { gridLedgerName = "common-law-grid.jso
     ? `Fix exactly that and send the corrected values — the driver re-derives this file and the prose table together from your \`${toolWritten}\` call, so there is nothing here for you to save`
     : `Fix exactly that, re-save the COMPLETE JSON file, and leave the prose table unchanged`;
   let hint = "the required output file is actually written and contains every required section IN FULL";
-  if (/findings?_/.test(lastFail)) {
+  if (CLEARANCE_FINDINGS_TOKEN_RE.test(lastFail)) {
     // The per-finding machine contract (findings-model.mjs). MUST sit ABOVE the coverage_ branch — a
     // findings_coverage_* token would otherwise route to the (wrong) coverage-ledger hint. The structural
     // "findings-heading" token has no underscore after "findings", so it never matches this branch.
-    const tok = (lastFail.match(/findings?_[a-z_]+(?::[^\s)]*)?/) || ["findings contract defect"])[0];
+    const tok = (lastFail.match(new RegExp(`${CLEARANCE_FINDINGS_TOKEN_RE.source}[a-z_]+(?::[^\\s)]*)?`)) || ["findings contract defect"])[0];
     // A2 (teal-bastion) — the specific repair the blind generic hint was missing: the famous-neighbour
     // empty-uri crash. Without naming the fix (registrations:[] / route to context_notes), three retries each
     // re-emitted a different malformed shape and never converged. These addenda close that loop.
@@ -3480,7 +3488,7 @@ function repairSiblingName(lastFail, expectFile) {
     // era: the seat writes no dispositions file, so there is no sibling a repair could aim at. The
     // remedy is a `record_dispositions` call, which warmPatchMessage's own connotation branch orders;
     // the graded artifact falls back to the stage's own.md exactly as it did before.
-    : /findings?_/.test(f) ? "findings.json"   // Phase-0 contract sibling (dormant until Phase 1)
+    : CLEARANCE_FINDINGS_TOKEN_RE.test(f) ? "findings.json"   // Phase-0 contract sibling (dormant until Phase 1)
     // blindframe_ is deliberately ABSENT: blind-frame-model.json is no longer a sibling, it is the
     // stage's expectFile. Routing it here would hand the model a message that forbids rewriting the very
     // file it then orders re-saved. The generic invalid_file branch aims the patch correctly.

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.4.1-beta.5",
+  "version": "0.4.1",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {