clearotron 0.5.0-beta.1 → 0.5.0-beta.3

package/.env.example

@@ -184,6 +184,13 @@ CLEAROTRON_DATABASE=clarivate
 #   CLEAROTRON_GATHER_SESSION_KEY, CLEAROTRON_GATHER_SESSION_ID, CLEAROTRON_GATHER_AGENT,
 #   CLEAROTRON_REGISTER_CALL_LOG, CLEAROTRON_REGISTER_RECORD_LOG
 #
+# The time, in epoch milliseconds, at which a turn's register tools stop sending new questions, so the
+# unit can write what it holds inside its own time. The driver writes it per turn into each register
+# tool server's env, a quarter of the turn (at most five minutes) ahead of the turn's deadline. Leave it
+# empty: a value set here would be read by the driver's own code-side executor as a fixed time.
+# effect: tuning
+CLEAROTRON_GATHER_SEND_UNTIL_MS=
+#
 # THERE IS NO RETENTION SETTING AND NO CLEANUP JOB. CLEAROTRON_REGISTER_LEDGER_MAX_BYTES,
 # CLEAROTRON_REGISTER_LEDGER_KEEP and `npm run prune:ledger` are gone with the rotation tool, because the
 # thing they bounded no longer grows: RECORD BODIES ARE WRITTEN INTO THE RUN'S OWN DIRECTORY

package/INSTALL.md

@@ -59,7 +59,7 @@ run is [mcp-server/CONNECT.md](mcp-server/CONNECT.md), and why something is the
   it first. VS Code's Remote-SSH port forwarding is the common case. If the page that opens is not this
   install's sign-in, run the same command again with `--port 28802`, or any free number.
 
-  A *hosted* deployment needs Linux for one further thing, the systemd outbox trigger —
+  A *hosted* deployment runs the product as systemd user units, so it needs Linux —
   [driver/systemd/README.md](driver/systemd/README.md).
 - **Setup installs the reasoning program.** Clearotron runs each step of a clearance as a short,
   unattended session of Claude Code or the Codex CLI. Setup installs the one your engine uses, for this

package/THIRD-PARTY-NOTICES.md

@@ -9,7 +9,7 @@ file rather than a courtesy.
 production tree; `--check` fails when it no longer matches. Development dependencies are excluded:
 they are not distributed, so they carry no obligation for anyone who installs this.
 
-177 packages.
+178 packages.
 
 > **Declared but NOT INSTALLED, so not distributed and not attributed below:** `@cfworker/json-schema`.
 > npm lists these with no version and no path — an unmet or optional peer. Recorded because a name
@@ -534,7 +534,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 ```
 
-## body-parser@2.3.0
+## body-parser@2.4.0
 
 - **Licence declared:** `MIT`
 - **Repository:** expressjs/body-parser
@@ -932,6 +932,37 @@ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
+## content-type@2.1.0
+
+- **Licence declared:** `MIT`
+- **Repository:** jshttp/content-type
+- **Licence file:** `LICENSE`
+
+```
+(The MIT License)
+
+Copyright (c) 2015 Douglas Christopher Wilson
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
+
 ## content-type@2.0.0
 
 - **Licence declared:** `MIT`
@@ -1968,7 +1999,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## fast-uri@3.1.8
+## fast-uri@3.1.9
 
 - **Licence declared:** `BSD-3-Clause`
 - **Repository:** https://github.com/fastify/fast-uri
@@ -2626,7 +2657,7 @@ OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 PERFORMANCE OF THIS SOFTWARE.
 ```
 
-## ip-address@10.7.2
+## ip-address@10.7.5
 
 - **Licence declared:** `MIT`
 - **Repository:** https://github.com/beaugunderson/ip-address
@@ -4927,7 +4958,7 @@ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## qs@6.16.0
+## qs@6.16.1
 
 - **Licence declared:** `BSD-3-Clause`
 - **Repository:** https://github.com/ljharb/qs
@@ -6193,7 +6224,7 @@ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## undici@7.29.1
+## undici@7.30.1
 
 - **Licence declared:** `MIT`
 - **Repository:** https://github.com/nodejs/undici
@@ -6476,7 +6507,7 @@ FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
 OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## zod@4.4.3
+## zod@4.6.7
 
 - **Licence declared:** `MIT`
 - **Repository:** https://github.com/colinhacks/zod

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "39f3bdc47543630a4f206ac667aa0fd923a2b32b",
-  "version": "0.5.0-beta.1"
+  "commit": "9a5ba90756f37ddefaee2a21ab79e9f7a374667a",
+  "version": "0.5.0-beta.3"
 }

package/docs/DELIVERY.md

@@ -142,7 +142,7 @@ drives the whole delivery side over the ops MCP face — mint its token verb-sco
    `sendPending` until a send is confirmed, whichever lane wrote the packet, and `mark_sent` is the only
    thing that clears it. Acknowledging the event instead removes the marker and leaves the run owed, so
    the backstop scan re-arms it and the requester is told again on the next sweep.
-4. For the remaining kinds — `intake-rejected`, `duplicate-skipped`, `late-bind-ack` — route the
+4. For the remaining kinds — `intake-rejected`, `duplicate-skipped`, `pre-run-failed`, `late-bind-ack` — route the
    packet's `text` → **`ack_event(file)`** (idempotent; validated as a bare `*.pending` name). These
    describe something that did not become a run, so there is no run to settle.
 
@@ -188,10 +188,9 @@ double-sends (`.sent` guards it).
 ## Legacy notes
 
 - The `delivered` outbox marker's plain-text body (agent id) predates the JSON packets and is
-  kept for compatibility with the existing watcher (`driver/deliver-trigger.sh` + the
-  `driver/systemd/` reference units, which wake an agent). Those are **one deployment's reference
-  integration**, not part of the headless product contract; the full packet is always in
-  `_driver/delivery.json`.
+  kept for compatibility with `driver/deliver-trigger.sh`, **one deployment's reference wake**. Its units no
+  longer ship, and the packaged install runs no outbox watcher: the integrator wakes itself. The script is not
+  part of the headless product contract; the full packet is always in `_driver/delivery.json`.
 
 ## One report per run
 

package/docs/architecture/03-run-lifecycle.md

@@ -244,8 +244,7 @@ Reading order for the phases, with what code decides at each:
    by receipt; survivors become a front-matter coverage note, not a halt.
 6. **Frame-diff + bounded reopen** — the blind frame is diffed against the run's own framing;
    directives (including deterministic mechanical form-gap directives) can reopen register and
-   source arms once, under a fetch ceiling (`CLEAROTRON_REOPEN_MAX_FETCH`, default 150), with
-   per-directive closure verification. The whole block is non-fatal; unclosed directives demote to
+   source arms once, with per-directive closure verification. The whole block is non-fatal; unclosed directives demote to
    disclosed deferrals that later clamp the verdict.
 7. **Placement → register-digest** — both fatal. Every digest pass (fresh, escalation, envelope,
    late-bind, stale-repair) goes through the single `runDigest` chokepoint, which drops stale ledgers,

package/docs/architecture/04-configuration-reference.md

@@ -282,7 +282,6 @@ unrecognised policy value that leaves the default behaviour standing.
 | `CLEAROTRON_PLAN_DISPATCH` (`0` or `off` disables) | Pure-code provider `executePlan` repairs at fan-in and reopen. **Never silently inert:** every entry in `PROVIDERS` ships an `executePlan` adapter, and `preflightCredentials` refuses the run before any spend under one that does not — a credential is not a capability. §5.4 of [05-config-governance.md](05-config-governance.md) still lists `signa` as the exception to that and has not been updated since its two missing tools were mounted. |
 | `CLEAROTRON_FRAME_REOPEN` (+ `CLEAROTRON_FRAME_REOPEN_MAX`, default 1) | The bounded frame-diff reopen. |
 | `CLEAROTRON_REGISTER_GAP_CLAMP` | The registerGap verdict clamp arm. |
-| `CLEAROTRON_REOPEN_MAX_FETCH` (default 150) | Detail-fetch ceiling inside the reopen closure pass. |
 | `CLEAROTRON_UNREACHABLE_SENIOR` (`open-item` \| `clamp`, default `open-item`) | Policy when a verdict-driving senior right can't be retrieved. |
 
 ### Payload ceilings
@@ -374,6 +373,7 @@ cannot be read as one list.
 | `CLEAROTRON_DUMP_JSON` | unset | Dump each attempt's raw engine envelope to `_driver/<stage>.attempt<N>.rawjson.json`. Opt-in: any value except `0`/`off`/`false`/`no`/empty arms it. |
 | `CLEAROTRON_DISPATCH_RECORD` | **on** | Write the verbatim message of every stage dispatch to `_driver/<stage>.attempt<N>[.repair<M>].dispatch.txt`, with `{file, sha, bytes, chars, kind}` on the attempt row. **Default ON** — `0`/`off`/`false`/`no` disarms it. Unlike `CLEAROTRON_DUMP_JSON` beside it, this is opt-OUT: the question it answers ("was the model given this?") is asked *after* the run that raised it, so a flag someone had to remember would be off on exactly the run that needed it. The files carry the company's identity verbatim and are deliberately not in the artifact table. |
 | `CLEAROTRON_GATHER_SESSION_KEY` / `CLEAROTRON_GATHER_AGENT` / `CLEAROTRON_GATHER_SESSION_ID` | set per stage | Telemetry attribution into the provider-call ledger (set by the gather config; not operator-set). |
+| `CLEAROTRON_GATHER_SEND_UNTIL_MS` | set per turn | When a turn's register tools stop sending new questions: a quarter of the turn, at most five minutes, ahead of its deadline (set by the gather config; not operator-set). |
 | `CLEAROTRON_RECORD_AXIS` | set per dispatch (unset ⇒ the stage is not fanned out) | Binds one fan-out turn of a recording stage to the single member it may write. `stageOnce` suffixes a fan-out stage's label with its axis, the gather config resolves `<stage>:<axis>` back to the base stage's tool group, and this carries the axis to the recording server. A call whose payload names a different member than the turn is bound to is REFUSED, so a seat cannot write into a sibling's file — without the binding every turn of the fan-out would record over member one. Set by the driver; not operator-set. |
 | `PORTAL_READ_MODEL` | `sonnet` | The model the portal's own compose-read turn uses. Distinct from the pipeline's tiers: this is a portal surface, not a stage. |
 | `CLEAROTRON_ORDER_PROBE_SEED` | unset | Seed for `scripts/band-shape-probe.mjs`, so an ordering probe can be replayed. A diagnostic script's knob, not a run's. |

package/docs/architecture/05-config-governance.md

@@ -205,7 +205,7 @@ move once the same window has been read across more runs.
 
 `CLEAROTRON_PLAN_DISPATCH`, `CLEAROTRON_SATPROBE_CODESIDE`,
 `CLEAROTRON_BAND_TRUTH_GATE` (**never disable in prod — restores the fabrication**),
-`CLEAROTRON_FRAME_REOPEN` (+`CLEAROTRON_FRAME_REOPEN_MAX`=1, `CLEAROTRON_REOPEN_MAX_FETCH`=150),
+`CLEAROTRON_FRAME_REOPEN` (+`CLEAROTRON_FRAME_REOPEN_MAX`=1),
 `CLEAROTRON_REGISTER_GAP_CLAMP`, `CLEAROTRON_WARM_RETRY`,
 `CLEAROTRON_MODEL_WIRE_CHECK` (fails a turn whose
 provider reports a different model FAMILY than the driver asked for; disarming it silences the refusal
@@ -282,7 +282,7 @@ edited — that box runs pre-rebuild code and genuinely still sets it.
 `CLEAROTRON_OUTBOX_BACKOFF_MAX_RETRIES` (5) / `CLEAROTRON_OUTBOX_GIVEUP_COOLDOWN_SEC` (3600 — note this one
 drops BACKOFF from the prefix, which the elided spelling this row used to carry actively misled about),
 `CLEAROTRON_OUTBOX_NOPROGRESS_MAX`, `TRADEMARK_MSGID_DOMAIN` (enqueue.local).
-Code-set per stage (not operator-set): `CLEAROTRON_GATHER_AGENT` / `CLEAROTRON_GATHER_SESSION_KEY` / `CLEAROTRON_GATHER_SESSION_ID`.
+Code-set per stage (not operator-set): `CLEAROTRON_GATHER_AGENT` / `CLEAROTRON_GATHER_SESSION_KEY` / `CLEAROTRON_GATHER_SESSION_ID`; per turn: `CLEAROTRON_GATHER_SEND_UNTIL_MS`.
 
 **Who the completion notice reaches** — `CLEAROTRON_REQUESTER_WHATSAPP` (empty; effect: deployment) is a
 JSON map of requester email or handle → number, and `CLEAROTRON_WHATSAPP_OPERATOR_COPY` (on unless `0`,

package/docs/architecture/06-operations-runbook.md

@@ -20,41 +20,37 @@ directives); `%h` is that account's home. The load-bearing operational fact: the
 ```mermaid
 flowchart TB
     subgraph VM["Single VM — systemd --user (service account)"]
-        DP[".path: watches 3 agent queue globs<br/>(inotify, sub-second)"]
-        DT[".timer: 90s fallback re-drain<br/>(covers unwatched queues)"]
-        DS["prelim-driver.service<br/>oneshot: node runner.mjs<br/>TimeoutStartSec=6h"]
-        OP["outbox .path: *.pending markers"]
-        OT["outbox .timer: 50min rescan<br/>(fixed-cadence backstop)"]
-        OS["prelim-outbox.service<br/>oneshot: deliver-trigger.sh<br/>TimeoutStartSec=1500"]
-        PS["profile-service.service<br/>long-running, loopback :18794"]
-        GW["integrator agent-platform gateway<br/>(reference integration; comms plane)"]
-        DP --> DS
+        WK["clearotron-worker.service<br/>simple: node runner.mjs --watch<br/>drains the queue, resumes parked runs"]
+        PT["clearotron-portal.service<br/>simple: node portal-service.mjs"]
+        MF["clearotron-mcp-face.service<br/>simple: node mcp-server/http-server.mjs"]
+        CM["clearotron-client-mcp.service<br/>simple: node mcp-server/http-server-client.mjs"]
+        DT["clearotron-deploy.timer<br/>boot+5min, every 1h (optional)"]
+        DS["clearotron-deploy.service<br/>oneshot: clearotron update"]
         DT --> DS
-        OP --> OS
-        OT --> OS
+        PT --> MF
     end
-    Q[("per-agent queue dirs")] -.watched.-> DP
-    OB[("outbox: runId.pending")] -.watched.-> OP
+    Q[("per-agent queue dirs")] -.polled.-> WK
     POOL[("publish pool — CLEAROTRON_REPORTS_DIR<br/>(web-served, group-readable)")]
-    CF["auth proxy + tunnel<br/>(this deployment: Cloudflare)"] --> CADDY["reverse proxy<br/>(this deployment: Caddy)"] --> PS
+    WK --> POOL
+    CF["auth proxy + tunnel<br/>(this deployment: Cloudflare)"] --> CADDY["reverse proxy<br/>(this deployment: Caddy)"] --> PT
     CADDY --> POOL
-    DS --> POOL
-    OS --> GW
 ```
 
 | Unit | Trigger | Execs | Key settings (why) |
 |---|---|---|---|
-| `prelim-driver.path` | new `*.json` in the **three explicitly listed** agent queues | `prelim-driver.service` | A new agent workspace is only covered by the timer until this unit gains a glob line + deploy |
-| `prelim-driver.timer` | boot+2min, every 90s | same | Self-healing backstop; atomic claims mean a re-drain can never double-run |
-| `prelim-driver.service` | (path/timer only — not `[Install]`ed) | `node runner.mjs` | `Type=oneshot` (single instance guaranteed); `EnvironmentFile=%h/.env`; `StartLimitIntervalSec=0` (a gateway outage must not lock the unit out); **`TimeoutStartSec=6h`** — a ceiling for a *wedged* runner only; honest drains are bounded by the runner's 2h admission budget (`CLEAROTRON_ADMISSION_BUDGET_MS`) + one run's wall. Change the two together: a 6h unit ceiling under a longer admission budget kills honest drains |
-| `prelim-outbox.path` | `*.pending` in the outbox | `prelim-outbox.service` | Level-triggered: re-fires while any marker exists — the script's pacing sleep is load-bearing |
-| `prelim-outbox.service` | (path/timer) | `driver/deliver-trigger.sh` | **`TimeoutStartSec=1500`**: one hung wake once wedged the lane 19h (the CLI finished its turn but never exited); with a real ceiling the unit self-heals. The 1500 s covers the worst legitimate wake end to end — the script's own `timeout 840 --kill-after=30` wall, plus its drain wait (180 s) and its pacing sleep (≤300 s). Change them together |
-| `prelim-outbox.timer` | boot+10min, every 50min | same | Rescan for owed sends (`sendPending` true, no `.sent`); self-defers while the instant lane is busy |
-| `profile-service.service` | long-running | `node profile-service.mjs` | Loopback :18794 behind the reverse proxy and auth gate (this deployment: Caddy + Cloudflare Access); deliberately **no** `EnvironmentFile` (least-privilege; pins its own non-secret audience identifiers) |
-
-**"Activating" for hours is normal** on `prelim-driver.service` during a multi-job drain — oneshot
-semantics put the whole drain inside the activating state. Do not add `Restart=` or a start limit;
-the unit comments and tests pin why.
+| `clearotron-worker.service` | long-running (`[Install]`ed) | `node driver/runner.mjs --watch` | `Type=simple`; polls for queued jobs and for parked runs whose window has passed; `Restart=on-failure`, `RestartSec=10`. The one unit that spends |
+| `clearotron-portal.service` | long-running | `node driver/portal-service.mjs` | The UI, the API, the sign-in and the configuration surface; ordered after the MCP face, which it calls |
+| `clearotron-mcp-face.service` | long-running | `node mcp-server/http-server.mjs` | The engine door the portal calls over MCP |
+| `clearotron-client-mcp.service` | long-running | `node mcp-server/http-server-client.mjs` | The door for a company's signed-in people and their access keys |
+| `clearotron-deploy.timer` | boot+5min, every 1h | `clearotron-deploy.service` | Optional: keeps the checkout on `origin/main` |
+| `clearotron-deploy.service` | (timer only) | `clearotron update` | `Type=oneshot`; refuses while a run is queued or in flight and exits 4, which `SuccessExitStatus=4` counts as success, so a busy box skips that firing; `TimeoutStartSec=30min`, so a hung `npm ci` cannot block later firings |
+
+Every unit loads `EnvironmentFile=%h/.env`, expands `${CLEAROTRON_CHECKOUT_DIR}` in `ExecStart=` and sets
+`CLEAROTRON_NO_ENV_FILE=1`. `clearotron start --background` installs the four services; the deploy pair is copied by
+hand ([`driver/systemd/README.md`](../../driver/systemd/README.md)). The worker's normal state is `active (running)`.
+
+The packaged install runs no outbox watcher: the integrator wakes itself to courier what the outbox holds
+([`docs/DELIVERY.md`](../DELIVERY.md)), and `driver/deliver-trigger.sh` is one agent platform's reference wake.
 
 Delivery truth lives in the run dir, not the marker: `status.sendPending` + the `.sent` sentinel
 make wakes idempotent — a lost marker can delay a send (≤50 min), never lose or double it.
@@ -64,7 +60,7 @@ settle it).
 
 ## Deploy
 
-This repository ships the unit files (`driver/systemd/`, seven of them) and the delivery trigger
+This repository ships the unit files (`driver/systemd/`, six of them) and a reference delivery wake
 (`driver/deliver-trigger.sh`); it does not ship the script that installs them. Whatever plays that
 role on your host — a dispatcher, a config-management run, a hand-written script — owes the
 properties below, each of which was learned the expensive way:
@@ -75,21 +71,20 @@ properties below, each of which was learned the expensive way:
    deployment would drain plus the run-slot locks, and refuse on any of them. `--override
    "<reason>"` is the operator's deliberate exception; the reason is printed into the deploy output, and a
    blank one exits 2 rather than passing. This step used to be a line of prose asking a human to
-   check, which is not a guard on the night it matters. Then **stop the four trigger units** for
-   the deploy window and install an **EXIT trap that restarts them on every exit path**, success or
-   abort — trap *after* stop, or an early abort leaves the machine silent.
+   check, which is not a guard on the night it matters. Then **stop the worker** for the deploy
+   window and install an **EXIT trap that restarts it on every exit path**, success or abort — trap
+   *after* stop, or an early abort leaves the machine silent.
 2. **Skill scanner gate** over `driver/skills/` — the tree the driver actually reads — and over any
    skills tree your integrator carries. Abort on high/critical findings, and if the scanner is
    absent say so loudly rather than passing: a gate that cannot run is not a gate that passed.
 3. **Drift detection on live agent workspaces** — abort on local skill edits rather than promoting
    them; silent auto-promotion twice resurrected intentionally deleted files. A skill relocated into
    the driver tree is relocation, not drift.
-4. **Driver block** — install dependencies, copy the seven unit files + `daemon-reload`,
-   install/enable/restart the sibling services (`profile-service`, `client-access`, `client-mcp`), and
-   **pre-create the queue dirs and the outbox**: an inotify `.path` watch on a directory that does
-   not exist never fires.
-5. **Restart the gateway last**, with no live run and the triggers stopped, then re-enable the four
-   trigger units.
+4. **Driver block** — install dependencies, copy the unit files + `daemon-reload`,
+   install/enable/restart the deployment's sibling services (`client-access`, `client-mcp`), and
+   **pre-create the queue dirs and the outbox**.
+5. **Restart the gateway last**, with no live run and the worker stopped, then start the worker
+   again.
 
 ### Never hand-edit (a deploy overwrites these silently)
 
@@ -117,8 +112,8 @@ and the environment file holding the secrets.
 
 | Surface | What it tells you |
 |---|---|
-| `systemctl --user status prelim-driver.{path,timer,service} clearance-outbox.{path,timer,service} profile-service` | Trigger health; remember "activating = draining" |
-| `journalctl --user -u prelim-driver.service -f` | Runner notes (stderr): claims, dedup parks, preflight failures, orphan reclaims |
+| `systemctl --user status clearotron-worker clearotron-portal clearotron-mcp-face clearotron-client-mcp clearotron-deploy.timer` | Unit health; the four services read `active (running)` |
+| `journalctl --user -u clearotron-worker.service -f` | Runner notes (stderr): claims, dedup parks, preflight failures, orphan reclaims |
 | Run dir `status.json` / `run.jsonl` | Per-run state + the append-only decision trace; grep keys: `axes`, `profile`, `verdict`, `escalation`, `postponed`, `delivered`, `profile-mismatch` |
 | `_driver/<stage>.jsonl` | Per-attempt telemetry: status, fail token, kill signals, wall, tokens |
 | Queue dirs | Marker states at a glance ([03 §2](03-run-lifecycle.md#2--claim-identity-and-crash-safety)): `.json`, `.processing` (+`.skips` — a growing skip tally is the wedge signature), `.postponed`, `.duplicate`, `.done`, `.failed` |
@@ -161,7 +156,7 @@ survive until terminal state.
 | Run parked with `*.tainted-N` artifacts | Timeout-taint convergence loop ([07 §3](07-quality-and-audit.md#3--completed-coverage-honesty-in-code)) | Let it converge; repeated signature goes terminal honestly |
 | Chat failure ping never arrived for a failed run | By design: nothing here sends. The failure packet IS the notice, and an integrator consumes it | Check `_driver/failure.json` + the outbox lane (the guaranteed notice) |
 | Deploy refused because a run is in flight | The in-flight guard above | Wait for the run. A force-restart of the gateway is not the answer — that is for a wedged gateway |
-| Everything quiet after a deploy abort | Should not happen (EXIT trap restarts triggers) — if it does: `systemctl --user start prelim-driver.{path,timer} clearance-outbox.{path,timer}` and file it |
+| Everything quiet after a deploy abort | Should not happen (EXIT trap restarts triggers) — if it does: `systemctl --user start clearotron-worker.service` and file it |
 
 ## Selftest — retired
 

package/docs/architecture/07-quality-and-audit.md

@@ -151,11 +151,7 @@ What makes the coverage statement trustworthy:
 
 Register budgets deserve one honest sentence: the per-worker call budgets in the skill prose
 (enumerates, phoneme ≤ 5, image ≤ 10) are **observed, prompt-level budgets, not code-enforced
-quotas** — and so is the reopen detail-fetch ceiling (`CLEAROTRON_REOPEN_MAX_FETCH`, default 150).
-`reopenFetchCeiling` resolves the figure in code, then the reopen prompt builders
-(`buildFrameReopenFollowup`, `buildFrameReopenRetryMessage`) interpolate it into the instruction the
-model reads; nothing counts a run's detail-fetches and nothing refuses the next one. The bound that
-*is* code is the executor's enumerate resource guard (`CLEAROTRON_ENUMERATE_CEILING`): it owns the page
+quotas**. The bound that *is* code is the executor's enumerate resource guard (`CLEAROTRON_ENUMERATE_CEILING`): it owns the page
 loop and returns an honest `incomplete` descriptor for an over-ceiling band rather than a truncated
 one. Calls are metered per run (billing-grade ledger), never hard-capped.
 

package/driver/CHANGELOG.md

@@ -1,5 +1,23 @@
 # clearotron-driver
 
+## 0.5.0-beta.3
+
+### Patch Changes
+
+- Fixed: The delivery email for a result the review could not sign off now lists the report's "Only you can close these" items.
+- Fixed: When a clearance fails, its chat notice now goes to the person who asked for it, with a copy to the operator.
+- Fixed: A clearance no longer repeats a finished step because a web lookup inside it timed out.
+- Fixed: A clearance whose register search cannot finish, such as one that keeps timing out, now delivers its report instead of ending with none.
+- Fixed: A search that cannot be shown to have run is now listed as not searched, and the report is still delivered.
+- Fixed: Reports can set aside an identical mark registered for unrelated goods, recording the reason in the audit workbook instead of listing it as a finding.
+
+## 0.5.0-beta.2
+
+### Patch Changes
+
+- Fixed: Reports no longer show "Nothing found" in "Where it stands" for a country the register could not search; that country is left out.
+- Fixed: A finding registered in several countries now shows under each of them in "Where it stands". Before, only its first country showed it, and the others could read "Nothing found".
+
 ## 0.5.0-beta.1
 
 ### Patch Changes

package/driver/band-shape.mjs

@@ -664,11 +664,12 @@ export function recordGroup({ tier, live, inScope, hits, dominant = false }) {
  * EACH GROUP RUNS IN THE ORDER THE OWNER RULED (2026-10-12): a line with the client's goods on a live record
  * in the ordered classes first; then more live records in those classes; then more goods words; then a
  * client market; then more records. Code sorts on fields the records carry and judges nothing. A line
- * carries the goods words it matched, never the goods text, which is one lookup away.
+ * carries the goods words it matched, and not the goods text, which is one lookup away, except a floor in (b):
+ * it matched none of the client's words, so it shows the goods the test read, cut short.
  *
  * A line sits in the best group its records in scope reach. `keysOf` gives a record's line and its owner's
  * set-aside key, both read through the positions fold, so a line covers exactly what a row naming one of
- * its records reaches. A line carries the words matched, so nothing on it is cut; the one line that cannot
+ * its records reaches. A line carries the words matched, so nothing on it is cut but a (b) floor's goods; the one line that cannot
  * be judged from itself is one the goods test placed while its records carry no goods on file.
  *
  * @param records    the band's enumerated records
@@ -708,6 +709,19 @@ function bindingOffices(territories, code) {
   return out;
 }
 
+// The goods text the test read for a record: the reader hands it as text, or as one statement per class, each with its
+// text. Then that text cut short for a line.
+const goodsReadText = (g) => (Array.isArray(g) ? g.map((x) => (typeof x === "string" ? x : x?.text)) : [typeof g === "string" ? g : g?.text])
+  .filter((t) => typeof t === "string" && t.trim()).join("; ").replace(/\s+/g, " ").trim() || null;
+export const FLOOR_GOODS_SHOWN = 140;
+function cutGoods(text) {
+  const t = String(text ?? "");
+  if (t.length <= FLOOR_GOODS_SHOWN) return t;
+  const head = t.slice(0, FLOOR_GOODS_SHOWN);
+  const space = head.lastIndexOf(" ");
+  return `${(space > FLOOR_GOODS_SHOWN / 2 ? head.slice(0, space) : head).replace(/[\s,;:.]+$/, "")}…`;
+}
+
 export function bandGroups(records, { classify, inScope, goods = null, dominantTerm = "", keysOf = null, markets = [], territories = [], evidenceOf = null } = {}) {
   const fold = (x) => foldDiacritics(String(x ?? "")).toLowerCase();
   const dom = fold(dominantTerm).trim();
@@ -746,7 +760,8 @@ export function bandGroups(records, { classify, inScope, goods = null, dominantT
     const group = outside && !floor ? "rest" : recordGroup({ tier, live, inScope: s, hits, dominant });
     // "On file" is a body `band_record` can open: goods read off the band row decide the group, never that.
     const onFile = goods?.held ? goods.held(r) : Boolean(g);
-    const rec = { r, tier, hits, words, live, inScope: s, group, outside, floor, onFile, territories: ts, inMarket: ts.some((t) => market.has(t)) };
+    const rec = { r, tier, hits, words, live, inScope: s, group, outside, floor, onFile, territories: ts, inMarket: ts.some((t) => market.has(t)),
+      ...(floor ? { read: goodsReadText(g) } : {}) };
     const keys = typeof keysOf === "function" ? keysOf(r) : null;
     const ownerKey = keys?.owner ?? (normKey(r?.owner_name) ? `owner:${normKey(r?.owner_name)}` : `record:${String(r?.record_id ?? "").trim().toLowerCase()}`);
     const key = keys?.line ?? `line:${ownerKey}|${normMark(r?.mark_text) || String(r?.record_id ?? "").trim().toLowerCase()}`;
@@ -788,6 +803,9 @@ export function bandGroups(records, { classify, inScope, goods = null, dominantT
         return { goods_evidence: ev?.state ?? null, ...(ev?.state === "unknown" && ev?.readable == null ? { goods_text: false } : {}) };
       })() : {}),
       floors: l.recs.filter((x) => x.floor).length,
+      // A FLOOR IN (b) SHOWS THE GOODS THE TEST READ, cut short: a (b) line matched none of the client's words, so
+      // without them a page of floors could not be judged without opening each record.
+      ...(group === "b" && known ? (() => { const read = l.recs.find((x) => x.floor && x.read)?.read; return read ? { floor_goods: cutGoods(read) } : {}; })() : {}),
       ...(known ? {} : { goods_on_file: inGroup.some((x) => x.onFile) }),
       ...(offices.size && l.recs.every((x) => x.outside) ? { outside: true } : {}),
     };
@@ -1109,13 +1127,14 @@ export const PLACEMENT_GROUP_ORDERS = Object.freeze([SORT_THE_NEAR_ONES, ONE_SET
 // group's identity, members and count stay, and so does the fact that a crowded group prints only its first page.
 export const FLOORS_BY_NAME_HERE = "Every floor here is placed or set aside by name; this group's row covers only its other lines.";
 export const A_CROWDS_ONE_ROW = "Read the first page, carry forward any line a lawyer would raise, and set the rest aside in this group's one row with the count: the client is told the field is crowded.";
+export const A_CROWDS_ROW_COVERS_A_READ_FLOOR = "This row covers a floor only once you have read its line and its goods are not the client's goods.";
 export const AN_UNREAD_CROWDS_ONE_ROW = "Carry forward any line a lawyer would raise, and set the rest aside in this list's one row with the count, on the ground that their goods are unreadable and the field is crowded.";
-export const AN_UNREAD_CROWDS_FLOOR = "A floor here is placed or set aside by name on its status or its territory; this row never covers it.";
-export const AN_UNREAD_LISTS_FLOOR = "A floor here is placed, or set aside by name on its status or its territory; any other line may be set aside on the ground that its goods are unknown.";
+export const AN_UNREAD_CROWDS_FLOOR = "This row never covers a floor. Place each floor here, or set it aside by name; a goods ground needs the floor's goods read in full.";
+export const AN_UNREAD_LISTS_FLOOR = "Place each floor here, or set it aside by name; a goods ground needs the floor's goods read in full. Any other line here may be set aside because its goods are unknown.";
 // What placement does with a line of that list before its fate, by its marker (approved wording, 2026-10-19). Placement's
 // alone, as its other orders are: every other stage keeps the markers as evidence and is not told of a fate.
 export const AN_UNREAD_LINE_IS_CHECKED = 'A line marked "on file, not readable", "cut by the register, no goods word found", "goods held; completeness not established" or "no goods text held; completeness not established" must be checked with band_record before its fate. Read the evidence held for it, keeping its source and goods completeness clear. A line marked "no goods on file", "fetch failed, no goods on file" or "the register\'s record lists no goods" has no goods text on file. Missing goods do not establish that the goods are unrelated.';
-export const PLACEMENT_LINE_ORDERS = Object.freeze([FLOORS_BY_NAME_HERE, A_CROWDS_ONE_ROW, AN_UNREAD_CROWDS_ONE_ROW, AN_UNREAD_CROWDS_FLOOR, AN_UNREAD_LISTS_FLOOR, AN_UNREAD_LINE_IS_CHECKED]);
+export const PLACEMENT_LINE_ORDERS = Object.freeze([FLOORS_BY_NAME_HERE, A_CROWDS_ONE_ROW, A_CROWDS_ROW_COVERS_A_READ_FLOOR, AN_UNREAD_CROWDS_ONE_ROW, AN_UNREAD_CROWDS_FLOOR, AN_UNREAD_LISTS_FLOOR, AN_UNREAD_LINE_IS_CHECKED]);
 const SHAPE_LISTS = ["a", "b", "c", "d", "rest", "no_goods"];
 const pageEveryOtherLine = (g) => `; page every other line with ${groupPageCall(g)}`;
 const pageWhereALineNeedsIt = (g) => `; page with ${groupPageCall(g)} only where a line needs reading`;
@@ -1166,13 +1185,14 @@ function renderGroupsMd(md, groups, rows = []) {
     if (l.goods_evidence === "complete") return "on file, not readable";
     return l.goods_on_file ? "on file, not readable" : "no goods on file";
   };
-  const words = (l) => (l.goods_words == null ? unread(l) : `${fmtN(l.goods_words.length)} of ${fmtN(total)}${l.goods_words.length ? `: ${l.goods_words.join(", ")}` : ""}`);
+  const words = (l) => (l.goods_words == null ? unread(l)
+    : `${fmtN(l.goods_words.length)} of ${fmtN(total)}${l.goods_words.length ? `: ${l.goods_words.join(", ")}` : ""}${l.floor_goods ? ` «${l.floor_goods}»` : ""}`);
   const count = (grp) => `${fmtN(grp.records)} records in ${fmtN(grp.lines)} lines from ${fmtN(grp.owners)} owners`;
   const where = (l) => `${l.territories.join(",")}${l.outside ? " (outside the order)" : ""}`;
   const row = (l) => `| ${cell(l.mark)} | ${cell(l.owner_name)} | ${cell(l.classes.join(","))} | ${fmtN(l.live)} of ${fmtN(l.records)} | ${cell(where(l))} | ${cell(words(l))} | ${l.floors > 0 ? "yes" : "no"} | ${cell(l.record_id)} |`;
   const head = ["| mark | owner | classes | live | territories | goods words | floor | record |", "|---|---|---|---|---|---|---|---|"];
   // A crowded group's own words for what it holds, in the crowded-field method's sentence (ruled 2026-10-12).
-  const crowd = { b: "identical marks in the ordered classes for other goods than the client's",
+  const crowd = { b: "identical marks in the ordered classes whose goods name none of the client's product words",
     c: "marks of the same family as the mark, or carrying the searched word, for the client's goods", d: "other marks in the ordered classes for the client's goods" };
   const firstPage = `The first ${fmtN(groups.first_page)} lines are below`;
   for (const g of ["a", "b", "c", "d"]) {
@@ -1186,7 +1206,8 @@ function renderGroupsMd(md, groups, rows = []) {
         ? `${count(grp)}. ${readA} ${firstPage}${pageEveryOtherLine(g)}. ${FLOORS_BY_NAME_HERE}`
         : grp.lines <= READ_ALL_LINES ? `${count(grp)}. Fifty? Read them all.` : `${count(grp)}. ${readA}`)
       : crowded
-        ? `${count(grp)}. A thousand or more? The field is crowded. These are ${crowd[g]}. ${A_CROWDS_ONE_ROW} ${firstPage}${pageWhereALineNeedsIt(g)}.`
+        ? `${count(grp)}. A thousand or more? The field is crowded. These are ${crowd[g]}. ${A_CROWDS_ONE_ROW} ${firstPage}${pageWhereALineNeedsIt(g)}.${
+          g === "b" ? ` ${A_CROWDS_ROW_COVERS_A_READ_FLOOR} ${pageTheFloorsLeft(g)}` : ""}`
         : grp.lines <= READ_ALL_LINES
           ? `${count(grp)}. Fifty? Read them all.`
           : `${count(grp)}. ${SORT_THE_NEAR_ONES}`, "");
@@ -1210,8 +1231,8 @@ function renderGroupsMd(md, groups, rows = []) {
   if (groups.no_goods.lines) {
     // The lines the goods test could not place, read by the same size rule (ruled 2026-10-12): under a thousand
     // records, a fate per line by name, opened where goods are on file; at a thousand or more, the first page,
-    // and one row on the rest whose goods are unreadable in a crowded field. A floor is never set aside on
-    // its goods, so a floor here is placed or set aside on its status or territory.
+    // and one row on the rest whose goods are unreadable in a crowded field. A floor is set aside on its goods only
+    // once they are read in full, which unknown goods never are, so a floor here is placed or set aside by name.
     const ng = groups.no_goods;
     const crowded = ng.records >= groups.crowded_at;
     const lead = tested.source === "none"

package/driver/close-verify.mjs

@@ -62,13 +62,14 @@ export function blockCollapsed(block) {
 /**
  * The plan row that answers a minted slice: the slice itself, or, where the fold refused it as already-asked, the
  * row it duplicates. Such a slice is never frozen into the plan and never runs; its question was asked by the twin.
- * ONLY THE DUPLICATE KIND RESOLVES: an identity collision or a malformed term asked a question nothing else asked.
+ * So does a spelling the re-sweep left on a list the reading turn read (`counted-on-list`): the list's row holds its
+ * count. ONLY THOSE TWO KINDS RESOLVE: an identity collision or a malformed term asked a question nothing else asked.
  * `foldRefusals` maps a refused qid to `{kind, twin}`, as `foldSupplementalEntries` records it. One rule for the
  * directive below and the remedy term ledger (remedy-accounting.mjs), so the two cannot read a slice apart. PURE.
  */
 export function answeredAs(qid, foldRefusals) {
   const r = foldRefusals?.get?.(qid);
-  return r && r.kind === "duplicate-question" && r.twin ? String(r.twin) : qid;
+  return r && (r.kind === "duplicate-question" || r.kind === "counted-on-list") && r.twin ? String(r.twin) : qid;
 }
 
 /**