clearotron 0.4.1 → 0.5.0-beta.1

package/README.md

@@ -9,6 +9,7 @@
   <a href="LICENSE"><img src="https://img.shields.io/badge/licence-AGPL--3.0--only-860F09?style=flat-square" alt="Licence: AGPL-3.0-only"></a>
   <a href=".nvmrc"><img src="https://img.shields.io/badge/node-%E2%89%A5%2022.13-250902?style=flat-square" alt="Node 22.13+"></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/CordilleraSarl/clearotron"><img src="https://img.shields.io/ossf-scorecard/github.com/CordilleraSarl/clearotron?label=openssf%20scorecard&style=flat-square" alt="OpenSSF Scorecard"></a>
+  <a href="https://www.bestpractices.dev/projects/15666"><img src="https://img.shields.io/cii/level/15666?label=openssf%20best%20practices&style=flat-square" alt="OpenSSF Best Practices"></a>
 </p>
 
 Before your company commits to a name, find out what stands in its way. Give Clearotron the name, the

package/THIRD-PARTY-NOTICES.md

@@ -2439,7 +2439,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## hono@4.13.8
+## hono@4.13.13
 
 - **Licence declared:** `MIT`
 - **Repository:** https://github.com/honojs/hono

package/bin/start.mjs

@@ -379,6 +379,32 @@ function liveClientDoor(unitEnvFile = unitEnvPath(), run = execFileSync) {
 }
 
 /** The two ports, from the environment or the shipped defaults. Throws on a value that is not a port. */
+// ── WHAT `start` SAYS ABOUT A CLIENT DOOR THAT IS NOT UP (the owner's words, 2026-10-18) ──────────────
+//
+// The client door is non-fatal: the portal and the engine door serve without it. It drains no queue, so its
+// exit is not the queue worker's, whose line tells the reader to start one with `--watch`. And a door still
+// up when the 30-second wait ran out has printed nothing, so it does not send the reader to look at its
+// output for a reason. Each line says what is true of the client door.
+
+/** The line printed when a non-fatal child exits: the client door's own, else the queue worker's. PURE. */
+export function nonFatalExitLine({ name, script, code, signal, clientDoor = false }) {
+  const how = signal ? `on ${signal}` : `with code ${code}`;
+  return clientDoor
+    ? `\nstart: ${name} (${script}) exited ${how} — the portal and the engine door are unaffected; a client assistant cannot connect until it is up.\n`
+    : `\nstart: ${name} (${script}) exited ${how} — the portal is still up, but nothing is draining the queue now. Start one with:\n    node ${script} --watch\n`;
+}
+
+/**
+ * The summary's two lines for a client door that is not running. A door that exited printed why before it
+ * went; a door still up when the wait ran out did not answer. PURE.
+ */
+export function clientDoorDownLines({ host, port, exited }) {
+  return [
+    `  Client door  NOT RUNNING on ${host}:${port} — ${exited ? "its output above says why" : "it did not answer within 30s"}. The portal and`,
+    "               the engine door are unaffected; a client assistant cannot connect until it is up.",
+  ];
+}
+
 export function resolvePorts(env = {}) {
   const one = (name, dflt) => {
     const raw = String(env[name] ?? "").trim();
@@ -2208,7 +2234,7 @@ if (isMain) {
   const children = [];
   let stopping = false;
 
-  const start = (name, script, env, { args = [], fatal = true } = {}) => {
+  const start = (name, script, env, { args = [], fatal = true, clientDoor = false } = {}) => {
     const child = spawn(process.execPath, [join(REPO, script), ...args], {
       cwd: REPO,
       // Its OWN process group, so Ctrl-C reaches this supervisor alone and teardown is one ordered
@@ -2256,10 +2282,9 @@ if (isMain) {
       if (stopping) return;
       // REPORTED. Not absorbed into a panel that says a service is unreachable.
       if (!fatal) {
-        // Loudly, because the queue stops draining the instant this goes — but the portal keeps serving,
-        // which is the whole point of a child this install is supported without.
-        err(`\nstart: ${name} (${script}) exited ${signal ? `on ${signal}` : `with code ${code}`} — the portal is still up,`
-          + ` but nothing is draining the queue now. Start one with:\n    node ${script} --watch\n`);
+        // Loudly, because what this child did stops the instant it goes — but the portal keeps serving, which
+        // is the whole point of a child this install is supported without. The client door says its own line.
+        err(nonFatalExitLine({ name, script, code, signal, clientDoor }));
         return;
       }
       err(childExitReport({ name, script, code, signal, tail }));
@@ -2444,7 +2469,7 @@ if (isMain) {
   // assistant is correctly connected to. The unit IS the door; this path just does not add another.
   const clientDoor = adoptedClientDoor
     ? null
-    : start("the client door", "mcp-server/http-server-client.mjs", envs.client, { fatal: false });
+    : start("the client door", "mcp-server/http-server-client.mjs", envs.client, { fatal: false, clientDoor: true });
   // ── THE BANNER NAMES THIS DOOR ONLY ONCE IT ANSWERS ─────────────────────────────────────────────────
   //
   // The engine door and the portal are each awaited above before anything is printed. This door was
@@ -2492,8 +2517,8 @@ if (isMain) {
     else
       say(`               It refuses every caller until a key is issued: ${DEMO ? demoConnectCommand({ prefix: invocationPrefix(), base: paths.base }) : keyIssueCommand({ prefix: invocationPrefix(), demo: DEMO, user, base: paths.base, defaultBase: join(homedir(), "trademark") })}`);
   } else {
-    say(`  Client door  NOT RUNNING on ${HOST}:${ports.client} — its output above says why. The portal and`);
-    say("               the engine door are unaffected; a client assistant cannot connect until it is up.");
+    // A door that exited printed why; one still up when the wait ran out printed nothing, and is not sent there.
+    for (const line of clientDoorDownLines({ host: HOST, port: ports.client, exited: clientDoor?.child?.exitCode !== null })) say(line);
   }
   say(`  Engine door  http://${HOST}:${ports.mcp}/mcp   — the portal's Start button calls this. Staff.`);
   say("");

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "e482d42d8937293290be77fc35633fd956d4bf10",
-  "version": "0.4.1"
+  "commit": "39f3bdc47543630a4f206ac667aa0fd923a2b32b",
+  "version": "0.5.0-beta.1"
 }

package/driver/CHANGELOG.md

@@ -1,5 +1,37 @@
 # clearotron-driver
 
+## 0.5.0-beta.1
+
+### Patch Changes
+
+- Fixed: A search with more similar marks than can be read now narrows step by step, and stops once the lists it has read answer it. Before, it could keep searching far past what the advice needed.
+- Fixed: A crowded search that the lists already read have answered no longer appears among the report's coverage limits. Its count is still recorded.
+- For operators: A clearance now stops asking further follow-up searches after 120, and delivers its report with what it has read.
+- For operators: On the Signa register, follow-up searches now send spellings as lists, so a clearance makes fewer requests.
+
+## 0.5.0-beta.0
+
+### Minor Changes
+
+- Fixed: Faults the final checks find in a finding's own summary sentence, a short entry or a grouped line are now corrected before delivery. Before, they shipped as found.
+
+### Patch Changes
+
+- Fixed: A record whose register lookup failed, or came back empty, no longer counts as retrieved. The clearance now fetches it again, or says it could not.
+- Fixed: A finding added by a late correction now appears with its own card in the delivered report.
+- Fixed: A repeated search can change the ranking after the report was written, too late to rewrite the report. The report now says how many register records were re-ranked, and that the audit trail gives their final ranking. A clear result becomes conditional.
+- Fixed: The report and the audit workbook now say a record was "retrieved from the register" rather than "read". The workbook's summary explains what that means.
+- Fixed: A clearance that resumes after a pause is now held to the same standard as one that never paused. The conditions on its result are those that apply to the report it delivers. A live registration identical or near-identical to the mark that the report leaves unaddressed makes the result conditional, and the report says so. One the clearance's own final pass answers no longer does.
+- Fixed: A result is no longer held at conditional just because a wider search that was rightly withheld was asked for again. Such a result can now read clear, and its goods category reads as searched.
+- Fixed: Knockout ratings now weigh the earlier filings found for the mark itself. The register review follows the same ranking of results as the step before it, so some ratings change.
+- Fixed: Knockout reports no longer carry two standing caveats. The caveat on a conditional result stays.
+- Fixed: A resumed clearance no longer shows the false line "A machine check on the report did not pass".
+- Fixed: A register record that a repeated search finds after the results were ranked is now ranked and reviewed before the report is written. If that cannot be done, the report is still delivered, and it counts the record among those left open. Before, such a record could be left out of the ranking, the review and the report.
+- Fixed: A clearance no longer stops without a report when register records it retrieved are still unaddressed at the end. The report is delivered, a clear result becomes conditional, and the report states once how many records remain open.
+- For operators: When a client door is not up, `clearotron start` now says what is true of it. Before, it gave the queue worker's advice, or pointed to output it never printed.
+- Fixed: After a late correction, the Audit Trail delivered with the report describes the corrected result, and its open questions agree with it. If it cannot be rebuilt, the earlier Audit Trail is withheld rather than shown as current. The audit workbook is still built from the current findings.
+- Fixed: The Audit Trail now lists each register record set aside while the results were ranked, with the reason given.
+
 ## 0.4.1
 
 ### Patch Changes

package/driver/ask-ledger.mjs

@@ -54,6 +54,7 @@
 // DRIVER's instructed values appear in the model's frame, where this checks the MODEL's quote
 // appears in a driver-held file. Same expression, different question; it stays separate.
 import { squash } from "./doubt-ledger.mjs";
+import { OUTSTANDING_REASON } from "../providers/_shared/follow-up-searches.mjs";
 //
 // Ask record shape (frozen — _driver/asks.json and the audit's Ask Ledger both render it):
 //   {
@@ -63,10 +64,16 @@ import { squash } from "./doubt-ledger.mjs";
 //     qids:   [ ... ],                           // the plan qids that would answer it (may be [])
 //     ending: { kind, by, evidence, reasons, ts } | null,
 //     handoff: "<the surface a human reads an un-ended/handed-over ask on>" | null,
+//     part, family,                              // only on a request kept as parts: "ran" or "family", and that family's qid
+//     short_id,                                  // every part of a frame request: the request's short id from before its hash
+//     legacy_id,                                 // the one part an old closure of that short id may settle: the ran part
 //   }
 
 const clip = (s, n = 200) => { const t = String(s ?? "").replace(/\s+/g, " ").trim(); return t.length > n ? `${t.slice(0, n - 1)}…` : t; };
 const slug = (s) => String(s ?? "").toLowerCase().normalize("NFKD").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48) || "x";
+// A short, stable hash of an exact string (FNV-1a, 32 bits), beside a slug, so two qids the slug folds or cuts to
+// one spelling still give two ids. PURE: no import, no clock.
+const fnv32 = (s) => { let h = 0x811c9dc5; for (const c of String(s ?? "")) { h ^= c.codePointAt(0); h = Math.imul(h, 0x01000193) >>> 0; } return h.toString(16).padStart(8, "0"); };
 
 export const ASK_ENDINGS = ["executed", "judged-immaterial", "recovery"];
 
@@ -170,6 +177,21 @@ function endingForQids(qids, join, ts) {
   return null;
 }
 
+/** The ending for a frame directive whose every slice repeated a family the reading turn withheld: that
+ *  judgment, in the turn's own recorded words, and nothing else — never `executed`, since nothing ran. A
+ *  family whose record cannot be read leaves the ask OPEN: there is no judgment to show, and an ending
+ *  without one would be invented. `withheld` is the record as readWithheldFamilies returns it. PURE. */
+function withheldEnding(families, withheld, ts) {
+  const reasons = families.map((f) => String(withheld?.[f]?.reason ?? "").trim());
+  if (!families.length || reasons.some((r) => !r)) return null;
+  const axes = [...new Set(families.map((f) => String(withheld?.[f]?.axis ?? "").trim()).filter(Boolean))];
+  return mkEnding("judged-immaterial", "reading-turn", {
+    reasons: [...new Set(reasons)],
+    evidence: axes.length ? axes.map((a) => `_driver/withheld-families-${a}.json`).join(", ") : "_driver/withheld-families",
+    ts,
+  });
+}
+
 /** The {ending, handoff} pair for one cross-check directive. Only `recall` is subject to the
  *  discharge rule; every other net keeps the ending it always had. PURE. */
 function recallEnding(name, qid, join, ts) {
@@ -195,7 +217,8 @@ function recallEnding(name, qid, join, ts) {
  *   3. escalation-skip      run.jsonl `escalation-skipped` events
  *   4. envelope             run.jsonl `envelope-decision` / `envelope-closed` events (+ state.failed)
  *   5. screen-gate          run.jsonl `screen-gate-violation` events + the unresolved sidecar
- *   6. frame-diff           _driver/frame-reopen.json (requested/swept/deferrals + directive_qids)
+ *   6. frame-diff           _driver/frame-reopen.json (requested/swept/deferrals + directive_qids), and the
+ *                           reading turn's withheld-family record for a slice its judgment settled
  *   7. form-neighbourhood   same receipt, rows the receipt's `born` map marks form-oracle-injected
  *   8. supplemental-proposal register-units/<axis>-supplemental-plan.json entries[] + rejected[]
  *   9. cross-check          _driver/register-xcheck.json + _driver/register-recall.json (+ overflow)
@@ -207,7 +230,7 @@ export function deriveAsks({
   escalationState = null, events = null,
   frameReopen = null, screenGateUnresolved = null,
   supplementalPlans = null, xcheck = null, recall = null,
-  planExecution = null,
+  planExecution = null, withheldFamilies = null,
 } = {}, { ts = null } = {}) {
   const join = planJoinFrom(planExecution);
   const evs = Array.isArray(events) ? events.filter((e) => e && typeof e === "object") : [];
@@ -346,25 +369,56 @@ export function deriveAsks({
     const twinOf = new Map((Array.isArray(fr.answered_elsewhere) ? fr.answered_elsewhere : [])
       .filter((x) => typeof x?.directive === "string")
       .map((x) => [x.directive, new Map((Array.isArray(x.slices) ? x.slices : []).filter((t) => t?.qid && t?.twin).map((t) => [t.qid, t.twin]))]));
+    // A slice refused as a family the reading turn withheld never ran either, and nothing answered it: the turn
+    // decided not to ask that family, and its record keeps why. The receipt names such slices
+    // (`withheld_by_judgment`). They are left out of the computed ending, which rests on the slices that ran,
+    // and a directive with no other slice ends on the turn's recorded judgment.
+    //
+    // EACH SLICE ENDS ON WHAT HAPPENED TO IT. A slice that ran ends on the execution record, through its twin
+    // where the fold refused it as already asked. A slice whose family the turn still withholds ends on the
+    // turn's recorded reason. A slice whose family the turn released after the fold is no longer withheld on
+    // record, so it ends on what the execution record says of the family itself: it ran, it was deferred, or it
+    // stays open; so does a slice whose record cannot be read, which has no judgment to end on.
+    //
+    // ONE RECORD PER PART, AND A PART KEEPS ITS ID. The slices that ran are one part, under the directive's own
+    // id. Each family the settled slices repeat is a part of its own, under an id made from that family, so its
+    // id never moves when the family's disposition changes (withheld, then released and run) or a sibling part
+    // disappears. A closure names one part, and settles only that part; an id no part carries settles nothing.
+    const withheldOf = new Map((Array.isArray(fr.withheld_by_judgment) ? fr.withheld_by_judgment : [])
+      .filter((x) => typeof x?.directive === "string")
+      .map((x) => [x.directive, new Map((Array.isArray(x.slices) ? x.slices : []).filter((t) => t?.qid && t?.family).map((t) => [t.qid, t.family]))]));
     for (const key of requested) {
       const qids = (Array.isArray(qidsByKey[key]) ? qidsByKey[key] : []).filter(Boolean);
       const place = bornByKey[key] === "form-neighbourhood" ? "form-neighbourhood" : "frame-diff";
-      let ending = null, handoff = null;
+      const born = { place, artifact: "_driver/frame-reopen.json", ref: key, ts: fr.ts ?? null };
+      const ask = { text: `${place === "form-neighbourhood" ? "mechanical form-oracle gap" : "blind frame-diff omission"}: ${key} — sweep it or say why not`, owner: "register", structured: null };
+      // THE ID CARRIES A HASH OF THE WHOLE KEY. The slug cuts at 48 characters and folds punctuation, so two
+      // requests that differ only after the cut, or only in punctuation, gave one id, and the second was dropped.
+      // The short id stays on the ran part as `legacy_id`, for a closure written before the hash (applyAskClosure).
+      const id = `ask:frame:${slug(key)}-${fnv32(key)}`;
+      const legacy = `ask:frame:${slug(key)}`;
+      let parts = [{ id, qids, ending: null, handoff: null, legacy }];
       const d = deferrals.get(key);
       if (d) {
-        ending = mkEnding("recovery", "frame-reopen", { reasons: [String(d.reason ?? "deferred")], evidence: "_driver/frame-reopen.json deferrals", ts });
-        handoff = "open coverage row (frame-gap) + the CLEAR→CONDITIONAL clamp — the report states the unswept omission";
+        parts = [{ id, qids, ending: mkEnding("recovery", "frame-reopen", { reasons: [String(d.reason ?? "deferred")], evidence: "_driver/frame-reopen.json deferrals", ts }),
+          handoff: "open coverage row (frame-gap) + the CLEAR→CONDITIONAL clamp — the report states the unswept omission", legacy }];
+      } else if (swept.has(key) && !qids.length) {
+        parts = [{ id, qids, ending: mkEnding("executed", "frame-reopen-receipt", { evidence: "swept per the frame-reopen receipt (warm-resume arm — axis-level verification)", ts }), legacy }];
       } else if (swept.has(key)) {
-        ending = qids.length
-          ? endingForQids(qids.map((q) => twinOf.get(key)?.get(q) ?? q), join, ts)   // computed — null (open) when the execution record disagrees
-          : mkEnding("executed", "frame-reopen-receipt", { evidence: "swept per the frame-reopen receipt (warm-resume arm — axis-level verification)", ts });
+        const settled = withheldOf.get(key) ?? new Map();
+        const ran = qids.filter((q) => !settled.has(q));
+        const families = [...new Set(qids.filter((q) => settled.has(q)).map((q) => settled.get(q)))];
+        parts = [
+          ran.length && { id, qids: ran, ending: endingForQids(ran.map((q) => twinOf.get(key)?.get(q) ?? q), join, ts),   // null (open) when the execution record disagrees
+            ...(families.length ? { part: "ran" } : {}), legacy },
+          ...families.map((fam) => ({
+            id: `${id}:family:${slug(fam)}-${fnv32(fam)}`, qids: qids.filter((q) => settled.get(q) === fam), part: "family", family: fam,
+            ending: String(withheldFamilies?.[fam]?.reason ?? "").trim() ? withheldEnding([fam], withheldFamilies, ts) : endingForQids([fam], join, ts),
+          })),
+        ].filter(Boolean);
       }
-      push({
-        ask_id: `ask:frame:${slug(key)}`,
-        born: { place, artifact: "_driver/frame-reopen.json", ref: key, ts: fr.ts ?? null },
-        ask: { text: `${place === "form-neighbourhood" ? "mechanical form-oracle gap" : "blind frame-diff omission"}: ${key} — sweep it or say why not`, owner: "register", structured: null },
-        qids, ending, handoff,
-      });
+      for (const p of parts) push({ ask_id: p.id, born, ask, qids: p.qids, ending: p.ending, handoff: p.handoff ?? null,
+        ...(p.part ? { part: p.part } : {}), ...(p.family ? { family: p.family } : {}), short_id: legacy, ...(p.legacy ? { legacy_id: p.legacy } : {}) });
     }
   }
 
@@ -416,7 +470,9 @@ export function deriveAsks({
       // must show it working. So EVERY rejection attempts the join, and one that did not mint later
       // ends OPEN — a real unanswered question the closure stage settles with a citation or that ships
       // visibly. "judged-immaterial" is reserved for a materiality judgment somebody actually made.
-      const supersededBy = mintedByIdentity.get(proposalIdentity(r?.proposal)) ?? null;
+      // A follow-up the run's safety net did not send is never superseded: the identity join ignores the regions, so a
+      // question minted for one market would otherwise bury the same question refused for another.
+      const supersededBy = issue === OUTSTANDING_REASON ? null : (mintedByIdentity.get(proposalIdentity(r?.proposal)) ?? null);
       push({
         ask_id: `ask:supplemental-rejected:${slug(axis)}:${i + 1}`,
         born: { place: "supplemental-proposal", artifact: `register-units/${axis}-supplemental-plan.json`, ref: `rejected[${i}]`, ts: r?.ts ?? null },
@@ -651,12 +707,30 @@ export function applyAskClosure(asks, closureLines, fileTexts = {}, { ts = null
   const byId = new Map();
   for (const l of closureLines ?? []) if (l?.id && !byId.has(l.id)) byId.set(l.id, l);
   const unverified = [];
+  // A CLOSURE WRITTEN BEFORE FRAME IDS CARRIED THEIR HASH names a request by its short id. Every request that had that
+  // short id could be the one it meant, a request now kept only as family parts included. It settles the ran part of
+  // the one request that had it, and nothing where two did: settling either could end an obligation it never judged.
+  // An ambiguous citation is reported with the parts it could have meant, while any of them is still open.
+  const requestsOf = new Map(), partsOf = new Map();
+  for (const a of asks ?? []) {
+    const short = a?.short_id ?? a?.legacy_id;
+    if (!short || short === a.ask_id) continue;
+    requestsOf.set(short, new Set([...(requestsOf.get(short) ?? []), a.born?.ref ?? a.ask_id]));
+    partsOf.set(short, [...(partsOf.get(short) ?? []), a]);
+  }
+  for (const [short, requests] of requestsOf) {
+    const l = byId.get(short);
+    const parts = partsOf.get(short) ?? [];
+    if (l && requests.size > 1 && parts.some((a) => !a.ending)) unverified.push({ ask_id: short, file: l.file, quote: l.quote, ambiguous: parts.map((a) => a.ask_id) });
+  }
+  const lineFor = (a) => byId.get(a.ask_id)
+    ?? (a.legacy_id && requestsOf.get(a.legacy_id)?.size === 1 ? byId.get(a.legacy_id) : undefined);
   const carryIntoFindings = [];
   let immaterialByStage = 0;
   const delivered = deliveredMarks(fileTexts?.["findings.json"]);
   const out = (asks ?? []).map((a) => {
     if (a?.ending) return a;                                    // the stage may never touch an ended ask
-    const l = byId.get(a.ask_id);
+    const l = lineFor(a);
     if (!l) return a;
     if (l.verdict === "OPEN") return { ...a, handoff: clip(l.reason, 300) || a.handoff };
     const hay = squash(fileTexts?.[l.file]);

package/driver/band-shape.mjs

@@ -708,7 +708,7 @@ function bindingOffices(territories, code) {
   return out;
 }
 
-export function bandGroups(records, { classify, inScope, goods = null, dominantTerm = "", keysOf = null, markets = [], territories = [] } = {}) {
+export function bandGroups(records, { classify, inScope, goods = null, dominantTerm = "", keysOf = null, markets = [], territories = [], evidenceOf = null } = {}) {
   const fold = (x) => foldDiacritics(String(x ?? "")).toLowerCase();
   const dom = fold(dominantTerm).trim();
   const domRe = dom ? new RegExp(`(^|[^\\p{L}\\p{N}])${dom.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}($|[^\\p{L}\\p{N}])`, "u") : null;
@@ -744,7 +744,9 @@ export function bandGroups(records, { classify, inScope, goods = null, dominantT
     // A floor is never counted in the rest (ruled 2026-10-12): held only outside the order's territories, it
     // is still listed, in (a) or (b), where the step reads it and may set it aside by name on its territory.
     const group = outside && !floor ? "rest" : recordGroup({ tier, live, inScope: s, hits, dominant });
-    const rec = { r, tier, hits, words, live, inScope: s, group, outside, floor, onFile: Boolean(g), territories: ts, inMarket: ts.some((t) => market.has(t)) };
+    // "On file" is a body `band_record` can open: goods read off the band row decide the group, never that.
+    const onFile = goods?.held ? goods.held(r) : Boolean(g);
+    const rec = { r, tier, hits, words, live, inScope: s, group, outside, floor, onFile, territories: ts, inMarket: ts.some((t) => market.has(t)) };
     const keys = typeof keysOf === "function" ? keysOf(r) : null;
     const ownerKey = keys?.owner ?? (normKey(r?.owner_name) ? `owner:${normKey(r?.owner_name)}` : `record:${String(r?.record_id ?? "").trim().toLowerCase()}`);
     const key = keys?.line ?? `line:${ownerKey}|${normMark(r?.mark_text) || String(r?.record_id ?? "").trim().toLowerCase()}`;
@@ -778,6 +780,13 @@ export function bandGroups(records, { classify, inScope, goods = null, dominantT
       // A line the goods test could not place shows a record whose goods are on file where it has one, so
       // `band_record` opens the record the line names; `goods_on_file` says so of that record.
       record_id: (known ? best : (inGroup.find((x) => x.onFile) ?? best)).r?.record_id ?? null,
+      // What the goods of the record the line names rest on (goods-evidence.mjs), where the run recorded it, and, where
+      // their completeness is not established, whether any goods text is held at all (`goods_text: false` where none is,
+      // as for a held record with no goods field).
+      ...(typeof evidenceOf === "function" ? (() => {
+        const ev = evidenceOf((known ? best : (inGroup.find((x) => x.onFile) ?? best)).r);
+        return { goods_evidence: ev?.state ?? null, ...(ev?.state === "unknown" && ev?.readable == null ? { goods_text: false } : {}) };
+      })() : {}),
       floors: l.recs.filter((x) => x.floor).length,
       ...(known ? {} : { goods_on_file: inGroup.some((x) => x.onFile) }),
       ...(offices.size && l.recs.every((x) => x.outside) ? { outside: true } : {}),
@@ -821,7 +830,7 @@ export function bandGroups(records, { classify, inScope, goods = null, dominantT
  *                             (charter P2d); the band itself stays per-registration
  * @returns { shape, md }      deterministic — same band + inputs ⇒ same bytes (no timestamps)
  */
-export function buildBandShape(band, { targets = [], inScopeClasses = [], crowdContext = null, caps = {}, positions = null, goods = null, goodsTest = null, goodsWordCount = 0, dominantTerm = "", manifestDominant = "", keysOf = null, markets = [], territories = [] } = {}) {
+export function buildBandShape(band, { crowdNarrowing = [], targets = [], inScopeClasses = [], crowdContext = null, caps = {}, positions = null, goods = null, goodsTest = null, goodsWordCount = 0, dominantTerm = "", manifestDominant = "", keysOf = null, markets = [], territories = [], evidenceOf = null } = {}) {
   const prepared = prepareTargets(Array.isArray(targets) && targets.every(isPrepared) ? targets.map((t) => t.text) : targets);
   const records = Array.isArray(band?.enumerated) ? band.enumerated : [];
   const crowds = Array.isArray(band?.crowds) ? band.crowds : [];
@@ -879,7 +888,7 @@ export function buildBandShape(band, { targets = [], inScopeClasses = [], crowdC
   const floorsOrdered = probeOrder(floors, "floors");
 
   const ownerCap = Number.isFinite(caps.owners) ? caps.owners : 40;
-  const grouped = bandGroups(records, { classify: (r) => classified.get(r), inScope, goods, dominantTerm, keysOf, markets, territories });
+  const grouped = bandGroups(records, { classify: (r) => classified.get(r), inScope, goods, dominantTerm, keysOf, markets, territories, evidenceOf });
   const ownersIn = (ls) => new Set(ls.map((l) => l.owner_key)).size;
   const groupOf = (g) => {
     const ls = grouped.by_group[g].lines;
@@ -905,8 +914,11 @@ export function buildBandShape(band, { targets = [], inScopeClasses = [], crowdC
   // context slice joins a crowd when one of its terms appears in the crowd's query (case-folded).
   const ccSlices = Array.isArray(crowdContext?.slices) ? crowdContext.slices : [];
   const fold = (s) => foldDiacritics(String(s ?? "")).toLowerCase();
+  // what was retrieved under each crowd (register-plan.mjs, crowdNarrowing): data on the descriptor, by its qid
+  const endingByQid = new Map((Array.isArray(crowdNarrowing) ? crowdNarrowing : []).filter((r) => r?.qid && r?.narrowing).map((r) => [String(r.qid), r]));
   const shapeCrowds = crowds.map((c) => {
     const q = fold(c.query);
+    const end = c.qid ? endingByQid.get(String(c.qid)) : null;
     const joined = ccSlices
       .filter((s) => (Array.isArray(s.terms) ? s.terms : []).some((t) => fold(t) && q.includes(fold(t))))
       .map((s) => ({ unit: s.unit ?? null, axis: s.axis ?? null, terms: s.terms ?? [],
@@ -920,6 +932,7 @@ export function buildBandShape(band, { targets = [], inScopeClasses = [], crowdC
       // executor and judgment, and dropping them here would undo the first carry silently.
       ...(c.error === true ? { error: true } : {}),
       ...(c.deferred === true ? { deferred: true } : {}),
+      ...(end ? { narrowing: end.narrowing, ...(end.lists?.length ? { lists: end.lists } : {}), ...(end.not_covered?.length ? { not_covered: end.not_covered } : {}) } : {}),
       crowd_context_slice: joined.length ? joined : null,
     };
   });
@@ -1084,12 +1097,41 @@ export const groupPageCall = (g) => `band_lookup {"group":"${g}"}`;
 
 // PLACEMENT'S ORDERS IN THE SHAPE. Three sentences under the groups tell the reader to give every line a fate,
 // and only placement owes the groups that. The band server serves the shape without them to every other
-// stage (Krzys's ruling, 2026-10-14), so they are declared once here and removed there by these same strings.
+// stage (the owner's ruling, 2026-10-14), so they are declared once here and removed there by these same strings.
 export const SORT_THE_NEAR_ONES = "A few hundred? Sort by the client's goods and markets, read the near ones first, list the rest.";
 export const ONE_SET_ASIDE_ROW = "Write down what you set aside and why: one row, with this count.";
 export const A_FATE_BY_NAME = "Each line takes its own fate by name; no group row covers these lines.";
 export const PLACEMENT_GROUP_ORDERS = Object.freeze([SORT_THE_NEAR_ONES, ONE_SET_ASIDE_ROW, A_FATE_BY_NAME]);
 
+// AND THE FATES THE GROUPS' SIZE SENTENCES ORDER (ruled 2026-10-18). Five more of placement's orders sit inside the
+// groups' size sentences, and the shape's commands to page a group name a lookup only placement is offered. Every
+// other stage is served the shape without them, removed by these same strings (`withoutPlacementOrders`); each
+// group's identity, members and count stay, and so does the fact that a crowded group prints only its first page.
+export const FLOORS_BY_NAME_HERE = "Every floor here is placed or set aside by name; this group's row covers only its other lines.";
+export const A_CROWDS_ONE_ROW = "Read the first page, carry forward any line a lawyer would raise, and set the rest aside in this group's one row with the count: the client is told the field is crowded.";
+export const AN_UNREAD_CROWDS_ONE_ROW = "Carry forward any line a lawyer would raise, and set the rest aside in this list's one row with the count, on the ground that their goods are unreadable and the field is crowded.";
+export const AN_UNREAD_CROWDS_FLOOR = "A floor here is placed or set aside by name on its status or its territory; this row never covers it.";
+export const AN_UNREAD_LISTS_FLOOR = "A floor here is placed, or set aside by name on its status or its territory; any other line may be set aside on the ground that its goods are unknown.";
+// What placement does with a line of that list before its fate, by its marker (approved wording, 2026-10-19). Placement's
+// alone, as its other orders are: every other stage keeps the markers as evidence and is not told of a fate.
+export const AN_UNREAD_LINE_IS_CHECKED = 'A line marked "on file, not readable", "cut by the register, no goods word found", "goods held; completeness not established" or "no goods text held; completeness not established" must be checked with band_record before its fate. Read the evidence held for it, keeping its source and goods completeness clear. A line marked "no goods on file", "fetch failed, no goods on file" or "the register\'s record lists no goods" has no goods text on file. Missing goods do not establish that the goods are unrelated.';
+export const PLACEMENT_LINE_ORDERS = Object.freeze([FLOORS_BY_NAME_HERE, A_CROWDS_ONE_ROW, AN_UNREAD_CROWDS_ONE_ROW, AN_UNREAD_CROWDS_FLOOR, AN_UNREAD_LISTS_FLOOR, AN_UNREAD_LINE_IS_CHECKED]);
+const SHAPE_LISTS = ["a", "b", "c", "d", "rest", "no_goods"];
+const pageEveryOtherLine = (g) => `; page every other line with ${groupPageCall(g)}`;
+const pageWhereALineNeedsIt = (g) => `; page with ${groupPageCall(g)} only where a line needs reading`;
+const pageTheFloorsLeft = (g) => `Where more floors are counted than this page shows, page the rest with ${groupPageCall(g)}; they come first.`;
+/**
+ * The shape as every stage but placement is served it: placement's orders and its group-page commands removed,
+ * each with the space before it, inside its line, so no line moves and the line each listed mark is printed on
+ * still holds. A crowded group's "The first N lines are below" stays, as a fact about what is printed. PURE.
+ */
+export function withoutPlacementOrders(text) {
+  let t = String(text ?? "");
+  for (const order of [...PLACEMENT_GROUP_ORDERS, ...PLACEMENT_LINE_ORDERS, ...SHAPE_LISTS.map(pageTheFloorsLeft)]) t = t.split(` ${order}`).join("").split(order).join("");
+  for (const g of SHAPE_LISTS) t = t.split(pageEveryOtherLine(g)).join("").split(pageWhereALineNeedsIt(g)).join("");
+  return t;
+}
+
 function renderGroupsMd(md, groups, rows = []) {
   md.push("", "## The band in the lawyer's order — for the client's goods first", "");
   if (groups.dominant_term && groups.manifest_dominant && normKey(groups.dominant_term) !== normKey(groups.manifest_dominant))
@@ -1111,7 +1153,19 @@ function renderGroupsMd(md, groups, rows = []) {
   const word = groups.dominant_term || groups.manifest_dominant;
   const carrying = word ? `carrying «${cell(word)}»` : "carrying the searched word";
   const heading = (g) => (g === "c" ? `(c) The same family as the mark, or ${carrying}, for the client's goods` : GROUP_HEADINGS[g]);
-  const unread = (l) => (tested.source === "none" ? "—" : l.goods_on_file ? "on file, not readable" : "no goods on file");
+  // A line the goods test could not place says why, from what its goods rest on: cut by the register, held but not
+  // established whole (with goods text, or with none, as a held record with no goods field is), the register's
+  // record listing none, a fetch that failed, or nothing held. Goods held whole that the test still could not read
+  // are in a language it cannot use. A shape derived with no record of the goods evidence reads as it always did.
+  const unread = (l) => {
+    if (tested.source === "none") return "—";
+    if (l.goods_evidence === "cut") return "cut by the register, no goods word found";
+    if (l.goods_evidence === "unknown") return l.goods_text === false ? "no goods text held; completeness not established" : "goods held; completeness not established";
+    if (l.goods_evidence === "absent") return "the register's record lists no goods";
+    if (l.goods_evidence === "unavailable") return "fetch failed, no goods on file";
+    if (l.goods_evidence === "complete") return "on file, not readable";
+    return l.goods_on_file ? "on file, not readable" : "no goods on file";
+  };
   const words = (l) => (l.goods_words == null ? unread(l) : `${fmtN(l.goods_words.length)} of ${fmtN(total)}${l.goods_words.length ? `: ${l.goods_words.join(", ")}` : ""}`);
   const count = (grp) => `${fmtN(grp.records)} records in ${fmtN(grp.lines)} lines from ${fmtN(grp.owners)} owners`;
   const where = (l) => `${l.territories.join(",")}${l.outside ? " (outside the order)" : ""}`;
@@ -1129,10 +1183,10 @@ function renderGroupsMd(md, groups, rows = []) {
     const readA = "These are the identical and near-identical marks live in the ordered classes for the client's goods: read every line.";
     md.push(g === "a"
       ? (crowded
-        ? `${count(grp)}. ${readA} ${firstPage}; page every other line with ${groupPageCall(g)}. Every floor here is placed or set aside by name; this group's row covers only its other lines.`
+        ? `${count(grp)}. ${readA} ${firstPage}${pageEveryOtherLine(g)}. ${FLOORS_BY_NAME_HERE}`
         : grp.lines <= READ_ALL_LINES ? `${count(grp)}. Fifty? Read them all.` : `${count(grp)}. ${readA}`)
       : crowded
-        ? `${count(grp)}. A thousand or more? The field is crowded. These are ${crowd[g]}. Read the first page, carry forward any line a lawyer would raise, and set the rest aside in this group's one row with the count: the client is told the field is crowded. ${firstPage}; page with ${groupPageCall(g)} only where a line needs reading.`
+        ? `${count(grp)}. A thousand or more? The field is crowded. These are ${crowd[g]}. ${A_CROWDS_ONE_ROW} ${firstPage}${pageWhereALineNeedsIt(g)}.`
         : grp.lines <= READ_ALL_LINES
           ? `${count(grp)}. Fifty? Read them all.`
           : `${count(grp)}. ${SORT_THE_NEAR_ONES}`, "");
@@ -1147,7 +1201,7 @@ function renderGroupsMd(md, groups, rows = []) {
   const restCrowded = rest.records >= groups.crowded_at;
   md.push(`**The rest: ${count(rest)}${outside}** — every record in none of (a) to (d) above. ${!rest.lines ? ONE_SET_ASIDE_ROW
     : restCrowded
-      ? `A thousand or more? The field is crowded. Read the first page, carry forward any line a lawyer would raise, and set the rest aside in this group's one row with the count: the client is told the field is crowded. ${firstPage}; page with ${groupPageCall("rest")} only where a line needs reading.`
+      ? `A thousand or more? The field is crowded. ${A_CROWDS_ONE_ROW} ${firstPage}${pageWhereALineNeedsIt("rest")}.`
       : `${rest.lines <= READ_ALL_LINES ? "Fifty? Read them all." : SORT_THE_NEAR_ONES} ${ONE_SET_ASIDE_ROW}`}`);
   if (rest.lines) {
     md.push("", ...head);
@@ -1164,8 +1218,8 @@ function renderGroupsMd(md, groups, rows = []) {
       ? `**Not tested on goods: ${count(ng)}.** No goods words were given, so the goods test could not place them.`
       : `**Goods the test could not read: ${count(ng)}.**`;
     md.push("", crowded
-      ? `${lead} A thousand or more? ${firstPage}, the floors first, then the live ones in the ordered classes. Carry forward any line a lawyer would raise, and set the rest aside in this list's one row with the count, on the ground that their goods are unreadable and the field is crowded. A floor here is placed or set aside by name on its status or its territory; this row never covers it. Where more floors are counted than this page shows, page the rest with ${groupPageCall("no_goods")}; they come first.`
-      : `${lead} ${ng.lines <= READ_ALL_LINES ? "Fifty? Read them all." : "A few hundred? Read the live ones in the ordered classes first."} ${A_FATE_BY_NAME}${tested.source === "none" ? "" : ' A line marked "on file, not readable" has goods on file: open its record with band_record before its fate. A line marked "no goods on file" has nothing to open.'} A floor here is placed, or set aside by name on its status or its territory; any other line may be set aside on the ground that its goods are unknown.`, "");
+      ? `${lead} A thousand or more? ${firstPage}, the floors first, then the live ones in the ordered classes. ${AN_UNREAD_CROWDS_ONE_ROW} ${AN_UNREAD_CROWDS_FLOOR} ${pageTheFloorsLeft("no_goods")}`
+      : `${lead} ${ng.lines <= READ_ALL_LINES ? "Fifty? Read them all." : "A few hundred? Read the live ones in the ordered classes first."} ${A_FATE_BY_NAME}${tested.source === "none" ? "" : ` ${AN_UNREAD_LINE_IS_CHECKED}`} ${AN_UNREAD_LISTS_FLOOR}`, "");
     md.push(...head);
     for (const l of crowded ? ng.list.slice(0, groups.first_page) : ng.list) { rows.push([md.length, l.key]); md.push(row(l)); }
   }

package/driver/band-size.mjs

@@ -118,6 +118,16 @@ export function limitExceedsCeiling(sec) {
   return Number.isFinite(sec) && sec > LIMIT_CEILING_SEC;
 }
 
+/**
+ * The band-reading stages whose dispatch would refuse a band of `bytes`: each stage's own base, derived from the band's
+ * bytes as `stageOnce` derives it, against the same ceiling. `baseOf` gives a stage's base (the stage table's
+ * `timeoutSec`). A band that cannot be measured refuses nothing, as its dispatch returns the base. PURE.
+ */
+export function stagesRefusingBand(bytes, baseOf) {
+  if (!Number.isFinite(bytes)) return [];
+  return [...BAND_READING_STAGES].filter((s) => limitExceedsCeiling(derivedLimitSec(baseOf(s), { bytes }).sec));
+}
+
 /** The refusal a dispatch past the ceiling carries — it NAMES the size, which is the finding. PURE. */
 export function ceilingRefusal(stage, derived) {
   const mb = Number.isFinite(derived?.inputBytes) ? (derived.inputBytes / (1024 * 1024)).toFixed(1) : "an unmeasured";

package/driver/close-verify.mjs

@@ -71,6 +71,24 @@ export function answeredAs(qid, foldRefusals) {
   return r && r.kind === "duplicate-question" && r.twin ? String(r.twin) : qid;
 }
 
+/**
+ * The reading turn's judgment that settles a minted slice, or null. The frame reopen's re-sweep refuses a slice
+ * that repeats exactly a waiting family the reading turn WITHHELD (register-plan.mjs, refuseWithheldFamilies), and
+ * its twin is that family. The twin never ran, by the turn's decision, so nothing answers the slice: it is settled
+ * by the turn's recorded reason instead, and it is never read as a question that ran, was answered or came back
+ * clean. `answeredAs` above stays the duplicate rule alone, and resolves such a slice to nothing.
+ *
+ * ONLY THE WHOLE RECORD SETTLES: the `withheld-by-judgment` kind, the family it repeats, and the reason on the
+ * family's record. Anything less is a slice nobody judged, and it stays a slice that never ran. One rule for the
+ * directive below and the remedy term ledger, so the two cannot read a slice apart. PURE.
+ * @returns {{family: string, reason: string}|null}
+ */
+export function withheldAs(qid, foldRefusals) {
+  const r = foldRefusals?.get?.(qid);
+  const reason = String(r?.reason ?? "").trim();
+  return r && r.kind === "withheld-by-judgment" && r.twin && reason ? { family: String(r.twin), reason } : null;
+}
+
 /**
  * Verify a register frame-reopen directive was actually SEARCHED as intended (Part B, arm #1). A directive
  * is closed ONLY if EVERY minted qid clears three checks:
@@ -85,7 +103,12 @@ export function answeredAs(qid, foldRefusals) {
  *
  * A slice the fold refused as already-asked is checked on the row that answered it (`answeredAs`), on the same
  * three checks, and a directive closed that way names each such row in `answered_by`.
- * @returns {{closed: boolean, reason: string|null, answered_by?: {qid: string, twin: string}[]}}
+ *
+ * A slice refused as a family the reading turn withheld (`withheldAs`) is not checked at all, because nothing ran
+ * for it: it is settled by that judgment, and a directive closed with one names it, and the family, in
+ * `withheld_by_judgment`, never in `answered_by`. It settles only itself. Every other slice must still clear the
+ * three checks, so a search that failed is never excused by a withheld sibling.
+ * @returns {{closed: boolean, reason: string|null, answered_by?: {qid: string, twin: string}[], withheld_by_judgment?: {qid: string, family: string}[]}}
  */
 export function verifyRegisterDirectiveClose({ qids, intendedClasses = [], executedQids, blocksByQid, foldRefusals = new Map() } = {}) {
   const list = qids ?? [];
@@ -94,7 +117,10 @@ export function verifyRegisterDirectiveClose({ qids, intendedClasses = [], execu
   const executed = executedQids ?? new Set();
   const byQid = blocksByQid ?? new Map();
   const answeredBy = [];
+  const withheld = [];
   for (const qid of list) {
+    const settled = withheldAs(qid, foldRefusals);
+    if (settled) { withheld.push({ qid, family: settled.family }); continue; }
     const q = answeredAs(qid, foldRefusals);
     const as = q === qid ? qid : `${qid} (answered by ${q})`;
     if (!executed.has(q)) return { closed: false, reason: `slice-not-landed:${as}` };
@@ -106,5 +132,6 @@ export function verifyRegisterDirectiveClose({ qids, intendedClasses = [], execu
       return { closed: false, reason: `wrong-scope:${as} searched[${searched.join(",")}]⊉intended[${want.join(",")}]` };
     if (q !== qid) answeredBy.push({ qid, twin: q });
   }
-  return { closed: true, reason: null, ...(answeredBy.length ? { answered_by: answeredBy } : {}) };
+  return { closed: true, reason: null, ...(answeredBy.length ? { answered_by: answeredBy } : {}),
+    ...(withheld.length ? { withheld_by_judgment: withheld } : {}) };
 }

package/driver/common-law-coverage-status.mjs

@@ -116,7 +116,7 @@ export function recordCoverageStatus(spec, received, { now = () => new Date().to
 export const NOT_STATED = "not stated";
 
 /**
- * THE STATUSES A FINDINGS FILE STATES, RECORDED BY CODE (Krzys, 2026-10-01). A seat whose findings carry
+ * THE STATUSES A FINDINGS FILE STATES, RECORDED BY CODE (the owner, 2026-10-01). A seat whose findings carry
  * a coverage ledger but made no `record_coverage_status` call is accepted, not re-run: a re-run for this
  * was a full stage re-run, and nothing is added to what the model reads. Each ledger row's status is read
  * from the row as the findings wrote it — one of the three words, else "not stated" — and recorded in the