clearotron 0.5.0-beta.2 → 0.5.0-beta.3

package/.env.example

@@ -184,6 +184,13 @@ CLEAROTRON_DATABASE=clarivate
 #   CLEAROTRON_GATHER_SESSION_KEY, CLEAROTRON_GATHER_SESSION_ID, CLEAROTRON_GATHER_AGENT,
 #   CLEAROTRON_REGISTER_CALL_LOG, CLEAROTRON_REGISTER_RECORD_LOG
 #
+# The time, in epoch milliseconds, at which a turn's register tools stop sending new questions, so the
+# unit can write what it holds inside its own time. The driver writes it per turn into each register
+# tool server's env, a quarter of the turn (at most five minutes) ahead of the turn's deadline. Leave it
+# empty: a value set here would be read by the driver's own code-side executor as a fixed time.
+# effect: tuning
+CLEAROTRON_GATHER_SEND_UNTIL_MS=
+#
 # THERE IS NO RETENTION SETTING AND NO CLEANUP JOB. CLEAROTRON_REGISTER_LEDGER_MAX_BYTES,
 # CLEAROTRON_REGISTER_LEDGER_KEEP and `npm run prune:ledger` are gone with the rotation tool, because the
 # thing they bounded no longer grows: RECORD BODIES ARE WRITTEN INTO THE RUN'S OWN DIRECTORY

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "bdb15f0c3974c46ccb0db2a2020779e65f0b4e21",
-  "version": "0.5.0-beta.2"
+  "commit": "9a5ba90756f37ddefaee2a21ab79e9f7a374667a",
+  "version": "0.5.0-beta.3"
 }

package/docs/architecture/04-configuration-reference.md

@@ -373,6 +373,7 @@ cannot be read as one list.
 | `CLEAROTRON_DUMP_JSON` | unset | Dump each attempt's raw engine envelope to `_driver/<stage>.attempt<N>.rawjson.json`. Opt-in: any value except `0`/`off`/`false`/`no`/empty arms it. |
 | `CLEAROTRON_DISPATCH_RECORD` | **on** | Write the verbatim message of every stage dispatch to `_driver/<stage>.attempt<N>[.repair<M>].dispatch.txt`, with `{file, sha, bytes, chars, kind}` on the attempt row. **Default ON** — `0`/`off`/`false`/`no` disarms it. Unlike `CLEAROTRON_DUMP_JSON` beside it, this is opt-OUT: the question it answers ("was the model given this?") is asked *after* the run that raised it, so a flag someone had to remember would be off on exactly the run that needed it. The files carry the company's identity verbatim and are deliberately not in the artifact table. |
 | `CLEAROTRON_GATHER_SESSION_KEY` / `CLEAROTRON_GATHER_AGENT` / `CLEAROTRON_GATHER_SESSION_ID` | set per stage | Telemetry attribution into the provider-call ledger (set by the gather config; not operator-set). |
+| `CLEAROTRON_GATHER_SEND_UNTIL_MS` | set per turn | When a turn's register tools stop sending new questions: a quarter of the turn, at most five minutes, ahead of its deadline (set by the gather config; not operator-set). |
 | `CLEAROTRON_RECORD_AXIS` | set per dispatch (unset ⇒ the stage is not fanned out) | Binds one fan-out turn of a recording stage to the single member it may write. `stageOnce` suffixes a fan-out stage's label with its axis, the gather config resolves `<stage>:<axis>` back to the base stage's tool group, and this carries the axis to the recording server. A call whose payload names a different member than the turn is bound to is REFUSED, so a seat cannot write into a sibling's file — without the binding every turn of the fan-out would record over member one. Set by the driver; not operator-set. |
 | `PORTAL_READ_MODEL` | `sonnet` | The model the portal's own compose-read turn uses. Distinct from the pipeline's tiers: this is a portal surface, not a stage. |
 | `CLEAROTRON_ORDER_PROBE_SEED` | unset | Seed for `scripts/band-shape-probe.mjs`, so an ordering probe can be replayed. A diagnostic script's knob, not a run's. |

package/docs/architecture/05-config-governance.md

@@ -282,7 +282,7 @@ edited — that box runs pre-rebuild code and genuinely still sets it.
 `CLEAROTRON_OUTBOX_BACKOFF_MAX_RETRIES` (5) / `CLEAROTRON_OUTBOX_GIVEUP_COOLDOWN_SEC` (3600 — note this one
 drops BACKOFF from the prefix, which the elided spelling this row used to carry actively misled about),
 `CLEAROTRON_OUTBOX_NOPROGRESS_MAX`, `TRADEMARK_MSGID_DOMAIN` (enqueue.local).
-Code-set per stage (not operator-set): `CLEAROTRON_GATHER_AGENT` / `CLEAROTRON_GATHER_SESSION_KEY` / `CLEAROTRON_GATHER_SESSION_ID`.
+Code-set per stage (not operator-set): `CLEAROTRON_GATHER_AGENT` / `CLEAROTRON_GATHER_SESSION_KEY` / `CLEAROTRON_GATHER_SESSION_ID`; per turn: `CLEAROTRON_GATHER_SEND_UNTIL_MS`.
 
 **Who the completion notice reaches** — `CLEAROTRON_REQUESTER_WHATSAPP` (empty; effect: deployment) is a
 JSON map of requester email or handle → number, and `CLEAROTRON_WHATSAPP_OPERATOR_COPY` (on unless `0`,

package/driver/CHANGELOG.md

@@ -1,5 +1,16 @@
 # clearotron-driver
 
+## 0.5.0-beta.3
+
+### Patch Changes
+
+- Fixed: The delivery email for a result the review could not sign off now lists the report's "Only you can close these" items.
+- Fixed: When a clearance fails, its chat notice now goes to the person who asked for it, with a copy to the operator.
+- Fixed: A clearance no longer repeats a finished step because a web lookup inside it timed out.
+- Fixed: A clearance whose register search cannot finish, such as one that keeps timing out, now delivers its report instead of ending with none.
+- Fixed: A search that cannot be shown to have run is now listed as not searched, and the report is still delivered.
+- Fixed: Reports can set aside an identical mark registered for unrelated goods, recording the reason in the audit workbook instead of listing it as a finding.
+
 ## 0.5.0-beta.2
 
 ### Patch Changes

package/driver/band-shape.mjs

@@ -1129,8 +1129,8 @@ export const FLOORS_BY_NAME_HERE = "Every floor here is placed or set aside by n
 export const A_CROWDS_ONE_ROW = "Read the first page, carry forward any line a lawyer would raise, and set the rest aside in this group's one row with the count: the client is told the field is crowded.";
 export const A_CROWDS_ROW_COVERS_A_READ_FLOOR = "This row covers a floor only once you have read its line and its goods are not the client's goods.";
 export const AN_UNREAD_CROWDS_ONE_ROW = "Carry forward any line a lawyer would raise, and set the rest aside in this list's one row with the count, on the ground that their goods are unreadable and the field is crowded.";
-export const AN_UNREAD_CROWDS_FLOOR = "A floor here is placed or set aside by name on its status or its territory; this row never covers it.";
-export const AN_UNREAD_LISTS_FLOOR = "A floor here is placed, or set aside by name on its status or its territory; any other line may be set aside on the ground that its goods are unknown.";
+export const AN_UNREAD_CROWDS_FLOOR = "This row never covers a floor. Place each floor here, or set it aside by name; a goods ground needs the floor's goods read in full.";
+export const AN_UNREAD_LISTS_FLOOR = "Place each floor here, or set it aside by name; a goods ground needs the floor's goods read in full. Any other line here may be set aside because its goods are unknown.";
 // What placement does with a line of that list before its fate, by its marker (approved wording, 2026-10-19). Placement's
 // alone, as its other orders are: every other stage keeps the markers as evidence and is not told of a fate.
 export const AN_UNREAD_LINE_IS_CHECKED = 'A line marked "on file, not readable", "cut by the register, no goods word found", "goods held; completeness not established" or "no goods text held; completeness not established" must be checked with band_record before its fate. Read the evidence held for it, keeping its source and goods completeness clear. A line marked "no goods on file", "fetch failed, no goods on file" or "the register\'s record lists no goods" has no goods text on file. Missing goods do not establish that the goods are unrelated.';
@@ -1231,8 +1231,8 @@ function renderGroupsMd(md, groups, rows = []) {
   if (groups.no_goods.lines) {
     // The lines the goods test could not place, read by the same size rule (ruled 2026-10-12): under a thousand
     // records, a fate per line by name, opened where goods are on file; at a thousand or more, the first page,
-    // and one row on the rest whose goods are unreadable in a crowded field. A floor is never set aside on
-    // its goods, so a floor here is placed or set aside on its status or territory.
+    // and one row on the rest whose goods are unreadable in a crowded field. A floor is set aside on its goods only
+    // once they are read in full, which unknown goods never are, so a floor here is placed or set aside by name.
     const ng = groups.no_goods;
     const crowded = ng.records >= groups.crowded_at;
     const lead = tested.source === "none"

package/driver/contract-vocabulary.mjs

@@ -530,9 +530,9 @@ export const INNER_CODES = Object.freeze([
   // ONE CODE, TWO TOKENS, and the split is by `cause` rather than by code: verify.mjs peels the
   // `axis_invalid` cause into its own family before counting the rest. A ruling naming only
   // `coverage_no_status` would be true of most `no_status` records and false of the ones that matter most.
-  { code: "no_status", mints: ["driver/coverage-form.mjs:920"], rollsUpTo: ["coverage_no_status", "coverage_form_axis_invalid"],
+  { code: "no_status", mints: ["driver/coverage-form.mjs:939"], rollsUpTo: ["coverage_no_status", "coverage_form_axis_invalid"],
     why: "Two composites, split on the record's `cause`: coverageFormFail() in verify.mjs for cause `axis_invalid`, and the same function for the rest. NOT the `@returns` annotation of findCoverageFormViolations() in coverage-form.mjs — that is the annotation, not the mint." },
-  { code: "engine_vocabulary", mints: ["driver/coverage-form.mjs:910"], rollsUpTo: ["coverage_form_engine_vocabulary"],
+  { code: "engine_vocabulary", mints: ["driver/coverage-form.mjs:929"], rollsUpTo: ["coverage_form_engine_vocabulary"],
     why: "#669 — the seat wrote an engine token into the `reason` sentence that reaches the reader's page. Checked on settled rows too, because a row the seat considers finished is exactly the one whose sentence gets printed. Namespaced by coverageFormFail() in verify.mjs; the bare code names a row, never a stage." },
 
   // ── ONE CODE, TWO MODULES ────────────────────────────────────────────────────────────────────────
@@ -544,7 +544,7 @@ export const INNER_CODES = Object.freeze([
   // failure tokens" already states the rule this row records: `coverage_form_damaged`, never a bare
   // `form_damaged`.
   { code: "form_damaged",
-    mints: ["driver/connotation-search.mjs:2002", "driver/connotation-search.mjs:2078", "driver/coverage-form.mjs:902"],
+    mints: ["driver/connotation-search.mjs:2002", "driver/connotation-search.mjs:2078", "driver/coverage-form.mjs:921"],
     rollsUpTo: ["connotation_form_damaged", "coverage_form_damaged"],
     why: "Minted in two lanes and namespaced per lane: connotationDispositionFail() in verify.mjs for the meaning sweep, coverageFormFail() in verify.mjs for the register digest. The namespacing is what keeps them apart — see verify.mjs's block headed \"the register coverage-form failure tokens\"." },
 ]);

package/driver/coverage-form-io.mjs

@@ -32,6 +32,7 @@ import { COVERAGE_STATUSES, COVERAGE_FORM_NAME, REGISTER_AXES } from "./coverage
 import { coverageFormSidecarName, parseCoverageForm } from "./coverage-form.mjs";
 import { capabilitiesFor } from "./register-capabilities.mjs";
 import { readWithheldFamilies, splitWaitingFamilies } from "./withheld-families.mjs";
+import { slicesTakenOutByAxis } from "../shared/slices-taken-out.mjs";   // the slices the searches record took out of the band
 
 export { COVERAGE_FORM_NAME };
 
@@ -150,7 +151,8 @@ export function coverageFormInput(runDir) {
   return { input: { skeleton: exec.skeleton, plan, bandBlocksByAxis, deferredReasons, activeAxes,
     bandsUnreadable, orderedTerritories, capabilities, unknownAxisUnits,
     awaiting: Array.isArray(exec.awaiting) ? exec.awaiting : [], withheld: readWithheldFamilies(runDir),
-    mainMarkets: Array.isArray(exec.main_markets) ? exec.main_markets : [] }, absent: null };
+    mainMarkets: Array.isArray(exec.main_markets) ? exec.main_markets : [],
+    takenOut: Object.fromEntries(slicesTakenOutByAxis(runDir)) }, absent: null };
 }
 
 /**

package/driver/coverage-form.mjs

@@ -353,10 +353,14 @@ export const DEFERRED_OPEN_BECAUSE = Object.freeze({
 });
 const deferredOpenBecause = (block, receiptReason) => block?.gateway_timeout === true ? DEFERRED_OPEN_BECAUSE.timeout
   : isProviderHardErrorReason(receiptReason) ? DEFERRED_OPEN_BECAUSE.hardError : DEFERRED_OPEN_BECAUSE.capability;
+// A SLICE THE RUN TOOK OUT OF THE BAND (the searches not completed, parts-not-completed.mjs) is open for the reason its
+// record gives, which is the shipped line the reader gets for it (ruled 2026-10-27): the provider could express it, and
+// what is missing is the evidence that it ran. A taken-out slice with no qid has no plan row to defer it, so it gets a
+// row of its own, keyed on its query.
 
 export function coverageFormRows({ skeleton = [], activeAxes = null, plan = null,
   bandBlocksByAxis = {}, deferredReasons = {}, bandsUnreadable = [],
-  orderedTerritories = [], capabilities = null, awaiting = [], withheld = {}, mainMarkets = [] } = {}) {
+  orderedTerritories = [], capabilities = null, awaiting = [], withheld = {}, mainMarkets = [], takenOut = {} } = {}) {
   const skel = Array.isArray(skeleton) ? skeleton.filter((s) => s && typeof s === "object") : [];
   // WHAT WAS RETRIEVED UNDER EACH CROWD (register-plan.mjs, crowdNarrowing), worked out from the same blocks these rows
   // are built from and carried on its row as data: a narrowed list retrieved in full (and which), none, or for the
@@ -423,6 +427,8 @@ export function coverageFormRows({ skeleton = [], activeAxes = null, plan = null
         status: null, reason: null,
       });
     }
+    const out = Array.isArray(takenOut?.[axis]) ? takenOut[axis] : [];
+    const takenReason = new Map(out.filter((x) => x?.qid && x?.reason).map((x) => [String(x.qid), String(x.reason)]));
     for (const qid of deferredQids) {
       rows.push({
         row_id: shortId("CD", `deferred:${qid}`),
@@ -433,7 +439,20 @@ export function coverageFormRows({ skeleton = [], activeAxes = null, plan = null
         // It was never searched, or it was asked and never answered, and nothing in this run asks it again, so a clean
         // claim over it is not a judgment the seat gets to make.
         open: true,
-        open_because: deferredOpenBecause(blockByQid.get(qid), deferredReasons?.[qid]),
+        open_because: takenReason.get(qid) ?? deferredOpenBecause(blockByQid.get(qid), deferredReasons?.[qid]),
+        status: null, reason: null,
+      });
+    }
+    for (const x of out) {
+      if (x?.qid || !x?.query || !x?.reason) continue;
+      rows.push({
+        row_id: shortId("CD", `deferred:${axis}:query:${x.query}`),
+        axis, kind: "deferred",
+        unit: unitLabel(axis, { term: String(x.query) }),
+        qid: null, query: String(x.query),
+        receipt_reason: String(x.reason),
+        open: true,
+        open_because: String(x.reason),
         status: null, reason: null,
       });
     }

package/driver/coverage-ledger.mjs

@@ -23,6 +23,7 @@
 // `validators` at module scope, so verify importing stages would TDZ-crash whenever verify loads
 // first; stages.mjs re-exports both names, keeping every existing import site working).
 
+import { plainDeferralReason } from "./deferral-row.mjs";
 export const REGISTER_AXES = ["saturation-probe", "primary-sweep", "transliteration-numeric", "incumbent-class"];
 
 // ── — THE READER'S NAME FOR AN AXIS, EMITTED AT SOURCE ──────────────────────────────────────────
@@ -347,13 +348,18 @@ export function coverageLedgerTableRows(rows, { reasonMax = 180 } = {}) {
 // confirmed-clean rows on tainted material axes move; coverage-limited/deferred rows and non-material
 // axes (saturation-probe) are untouched; an empty taint set is a no-op. PURE; the caller pre-reads the
 // taint verdicts (pipeline loadCoverageLedger → readRegisterTaint).
+// The reason a tainted axis's withdrawn clean claim carries: the shipped gap sentence (deferral-row.mjs).
+export const TAINTED_CLEAN_REASON = plainDeferralReason("unfinished");
+
 export function applyTaintDeferred(rows, taintedAxes) {
   const tainted = new Set((taintedAxes ?? []).map((a) => String(a).toLowerCase()));
   if (!tainted.size) return rows ?? [];
   const material = (a) => !NON_MATERIAL_AXES.includes(String(a ?? "").toLowerCase());
+  // The pass that claimed clean was killed before it finished reading, so the claim is withdrawn whole: the row is open,
+  // with the shipped reason a reader gets for a part not completed, and none of the claim's words.
   return (rows ?? []).map((r) =>
     (r && r.status === "confirmed-clean" && tainted.has(String(r.axis ?? "").toLowerCase()) && material(r.axis))
-      ? { ...r, status: "deferred", reason: `${String(r.reason ?? "").trim()}${r.reason ? " — " : ""}timeout-tainted pass: self-reported clean downgraded pending re-run`.trim() }
+      ? { ...r, status: "deferred", reason: TAINTED_CLEAN_REASON }
       : r);
 }
 

package/driver/declination-call.mjs

@@ -117,6 +117,13 @@ export const DECLINATION_REASONS = Object.freeze({
     gloss: "an off-field name that is not a major brand, an active dispute or proceeding, or a "
       + "well-known enforcer — omitted, never listed for completeness",
   },
+  // A COMPARISON OF MARKS (ruled 2026-10-27): the writer may set aside a near spelling on its sign, as the write-up
+  // may, with the write-up's own gloss. It is refused on the applied-for mark itself, which no comparison sets aside.
+  sign: {
+    discretionary: true,
+    rules: 'synthesis-rules.md, "The consumer confusion test — the governing gate"',
+    gloss: "a near spelling a buyer in this market could not take for the mark, by sound, by look or by meaning",
+  },
   "not-worth-the-line": {
     discretionary: true,
     rules: 'synthesis-rules.md, "Promote-or-omit"',
@@ -206,7 +213,7 @@ export function contradictionFor(reason, row, scope) {
   // class is closed to the entry that holds it. Each record is judged on its own mark, status and classes.
   if (Array.isArray(row?.members) && row.members.length) {
     for (const m of row.members) {
-      const clash = contradictionFor(reason, { mark: m?.mark ?? row.mark, status: m?.status ?? null, classes: m?.classes ?? [] }, scope);
+      const clash = contradictionFor(reason, { mark: m?.mark ?? row.mark, status: m?.status ?? null, classes: m?.classes ?? [], goods: m?.goods ?? null }, scope);
       if (clash) return clash;
     }
     return "";
@@ -218,14 +225,26 @@ export function contradictionFor(reason, row, scope) {
   // it switched the identical-mark refusal below off on exactly those runs.
   const marks = Array.isArray(scope?.marks) ? scope.marks : (scope?.marks ? [scope.marks] : []);
 
+  // ── AN IDENTICAL MARK IN A FILED CLASS MAY BE DECLINED ON ITS GOODS, AND ON NOTHING ELSE DISCRETIONARY ──
+  //
+  // Ruled 2026-10-27: identical spelling and a shared class no longer bar a supported judgment that the registered
+  // goods are unrelated. This refused every discretionary token on such a record, so on a test run 29 goods
+  // decisions were refused and every one came back as a finding. A goods decision now stands where the run holds the
+  // record's goods complete (goods-evidence.mjs), because cut, unknown or missing goods establish nothing. The
+  // record's field, the report's length and a comparison with the applied-for mark itself are still refused.
   if (isIdenticalToAppliedMark(row?.mark, marks) && isLive(row?.status) && shared.length) {
-    return `this record's mark is IDENTICAL to the applied-for mark under the house normalizer, its `
-      + `status is ${String(row?.status ?? "").trim() || "live"}, and it sits in class ${shared.join(", ")} `
-      + `— one of the matter's own filed classes. synthesis-rules.md:167 orders that an on-point `
-      + `identical mark in the relevant class is never dropped, and says so "regardless of filer `
-      + `profile". Deliver it and rate it; a Stage-2 mitigant is a rating input, never a reason to omit. `
-      + `If it is the applicant's own right or already delivered under another record, say so with `
-      + `own-right or duplicate-of-delivered.`;
+    const facts = `this record's mark is IDENTICAL to the applied-for mark, its status is `
+      + `${String(row?.status ?? "").trim() || "live"}, and it is in filed class ${shared.join(", ")}`;
+    if (reason === "unrelated-goods") {
+      if (row?.goods === "complete") return "";
+      return `${facts}. The run holds its goods as ${String(row?.goods ?? "").trim() || "not recorded"}, not in full, `
+        + `and incomplete goods cannot show the goods are unrelated. Deliver and rate it, or use own-right or `
+        + `duplicate-of-delivered if one is true.`;
+    }
+    return `${facts}. Such a mark is never declined for its field, for want of room, or on its sign. Deliver and `
+      + `rate it; a Stage-2 mitigant goes into the rating. If its registered goods, read in full, do not meet the `
+      + `matter's goods, decline it as unrelated-goods and say so in the ground. If it is the applicant's own right `
+      + `or already delivered, use own-right or duplicate-of-delivered.`;
   }
 
   // ── ECONOMY IS NOT A REASON ABOUT A LIVE IN-CLASS MARK (ruling 2026-09-07) ─────────────────
@@ -250,14 +269,12 @@ export function contradictionFor(reason, row, scope) {
   // It does effectively retire this token for live in-class records, because the sweep is already scoped
   // to the instructed classes. That was put to the owner as the consequence and ruled anyway.
   if (reason === "not-worth-the-line" && isLive(row?.status) && shared.length) {
-    return `this record is ${String(row?.status ?? "").trim() || "live"} and sits in class `
-      + `${shared.join(", ")} — one of the matter's own instructed classes. "not worth the line" is a `
-      + `statement about the report's budget, not about this mark, and a live registration in an `
-      + `instructed class is never omitted for want of room. Either carry it, or decline it on something `
-      + `true of THIS MARK: unrelated-goods if its goods do not meet the matter's, off-field-not-major `
-      + `if it is off-field and not a major brand, an active dispute or a well-known enforcer, `
-      + `own-right if it belongs to the applicant, duplicate-of-delivered if the same right is already `
-      + `reported. Say what makes this mark distant, or give it its line.`;
+    return `this record is ${String(row?.status ?? "").trim() || "live"} in instructed class ${shared.join(", ")}. `
+      + `A live mark in an instructed class is never declined for want of room. Deliver it, or decline it on a fact `
+      + `about this mark: unrelated-goods if its goods do not meet the matter's; off-field-not-major if it is `
+      + `off-field and not a major brand, an active dispute or a well-known enforcer; sign if a buyer in this market `
+      + `could not take its spelling for the mark; own-right if it belongs to the applicant; duplicate-of-delivered `
+      + `if the same right is already reported.`;
   }
 
   // THERE IS NO CLASS-OVERLAP REFUSAL, AND THE FIRST DRAFT HAD ONE. It refused `unrelated-goods` and

package/driver/degraded-parts.mjs

@@ -171,6 +171,12 @@ function register(runDir, log) {
   const open = readPartNotCompleted(runDir, "assessment");
   if (open && ["placement-inquiry", "register-digest"].includes(open.stage))
     failed.push([{ fail: `${open.stage} did not complete: ${open.reason ?? "no cause recorded"}` }, "the register write-up"]);
+  // The searches a check could not prove ran, taken out of the band and delivered as open rows (parts-not-completed.mjs).
+  const searches = readPartNotCompleted(runDir, "searches");
+  if (searches) failed.push([{ fail: [
+    (searches.slices ?? []).length ? `${searches.slices.length} slice(s) taken out of the band` : "",
+    (searches.disclosed_axes ?? []).length ? `the pass on ${searches.disclosed_axes.join(", ")} timed out, read as it stands with its clean claims open` : "",
+  ].filter(Boolean).join("; ") + `: ${searches.reason ?? "no cause recorded"}` }, "the searches"]);
   let reopen = null;
   try { reopen = JSON.parse(readFileSync(driverDir(runDir, "frame-reopen.json"), "utf8")); } catch { reopen = null; }
   if (reopen?.dominant_element_gap === true && reopen?.domClosed !== true)

package/driver/engine/mcp/clarivate-server.mjs

@@ -29,6 +29,7 @@
 // `match_mode: "phonetic"` on register_search / register_enumerate remains fully available; it is the
 // PREVIEW of the expansion that this provider cannot give, not phonetic search itself.
 import { serve } from "./stdio-server.mjs";
+import { sendUntilFromEnv } from "../../../providers/_shared/send-until.mjs";
 import { crowdNoteFor } from "./crowd-note.mjs";   // how the unit decides on a crowd, beside an answer that carries one
 import {
   CAPABILITIES, doSearch, doRecordFetch, doImageFetch, doBatchScreen, doEnumerate, doExecutePlan, DEFAULT_BASE,
@@ -43,6 +44,7 @@ const tctx = (kind) => ({
   agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",   // run session key — telemetry attribution
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
+  sendUntilMs: sendUntilFromEnv(),   // this turn's time to stop sending (providers/_shared/send-until.mjs)
 });
 const passthrough = (r) => (r && typeof r === "object" ? (r.text ?? JSON.stringify(r)) : String(r));
 const guard = (fn) => async (args) => {

package/driver/engine/mcp/corsearch-server.mjs

@@ -7,6 +7,7 @@
 // session key (tctx.sessionKey) — we thread the run's session key via CLEAROTRON_GATHER_SESSION_KEY so the
 // $0 provider-usage diff still attributes calls to the run.
 import { serve } from "./stdio-server.mjs";
+import { sendUntilFromEnv } from "../../../providers/_shared/send-until.mjs";
 import { crowdNoteFor } from "./crowd-note.mjs";   // how the unit decides on a crowd, beside an answer that carries one
 import { CAPABILITIES, doSearch, doRecordFetch, doImageFetch, doExpandPhoneme, doBatchScreen, doEnumerate, doExecutePlan } from "../../../providers/corsearch/src/core.js";
 import { proposeSupplemental } from "./supplemental.mjs";
@@ -18,6 +19,7 @@ const tctx = (kind) => ({
   agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",   // run session key — telemetry attribution
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
+  sendUntilMs: sendUntilFromEnv(),   // this turn's time to stop sending (providers/_shared/send-until.mjs)
 });
 const passthrough = (r) => (r && typeof r === "object" ? (r.text ?? JSON.stringify(r)) : String(r));
 const guard = (fn) => async (args) => {

package/driver/engine/mcp/declination-server.mjs

@@ -83,12 +83,11 @@ serve({
     description:
       "Record, per position or page, your decision NOT to deliver something that reached your findings surface. " +
       "Every position the digest carried to you, and every page the web notes marked as a candidate or conflict, " +
-      "either becomes a finding " +
-      "or carries a stated reason it did not — there is no third way out, and one left silent is reported as " +
-      "a defect of this run. One call carries a batch; the answer tells you what was accepted, " +
+      "ends as a finding or as a declination with its reason. One left with neither is reported as a defect " +
+      "of this run. One call carries a batch; the answer tells you what was accepted, " +
       "what was refused and why, and WHICH ROWS STILL CARRY NO DECISION, so you can finish inside this " +
-      "turn. A refusal is about bookkeeping, never about your legal judgment: a reason is refused only " +
-      "where it contradicts a fact the job recorded before this run started.",
+      "turn. A refusal is about the record's facts, never your legal judgment: a reason is refused only when it " +
+      "contradicts the matter's instructions or the record's mark, status, classes or goods as the run holds them.",
     inputSchema: { type: "object", required: ["declinations"], properties: {
       declinations: {
         type: "array",

package/driver/engine/mcp/euipo-server.mjs

@@ -28,6 +28,7 @@
 //   `GET /trademarks/{n}/image` answers 200 with real image bytes. The tool returns metadata + the
 //   Vienna figurative-element codes rather than the bytes; see the core for why.
 import { serve } from "./stdio-server.mjs";
+import { sendUntilFromEnv } from "../../../providers/_shared/send-until.mjs";
 import { crowdNoteFor } from "./crowd-note.mjs";   // how the unit decides on a crowd, beside an answer that carries one
 import {
   CAPABILITIES, CRED_ENV, doSearch, doRecordFetch, doBatchScreen, doImageFetch,
@@ -51,6 +52,7 @@ const tctx = (kind) => ({
   agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
+  sendUntilMs: sendUntilFromEnv(),   // this turn's time to stop sending (providers/_shared/send-until.mjs)
 });
 const passthrough = (r) => (r && typeof r === "object" ? (r.text ?? JSON.stringify(r)) : String(r));
 const guard = (fn) => async (args) => {

package/driver/engine/mcp/free-tier-server.mjs

@@ -30,6 +30,7 @@
 // Telemetry: the core writes CLEAROTRON_REGISTER_CALL_LOG / CLEAROTRON_REGISTER_RECORD_LOG (the SHARED register
 // ledger) under the provider id `free-tier`, keyed by the gateway session key.
 import { serve } from "./stdio-server.mjs";
+import { sendUntilFromEnv } from "../../../providers/_shared/send-until.mjs";
 import { crowdNoteFor } from "./crowd-note.mjs";   // how the unit decides on a crowd, beside an answer that carries one
 import {
   CAPABILITIES, doSearch, doRecordFetch, doBatchScreen, doImageFetch, doEnumerate, doExecutePlan,
@@ -47,6 +48,7 @@ const tctx = (kind) => ({
   agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
+  sendUntilMs: sendUntilFromEnv(),   // this turn's time to stop sending (providers/_shared/send-until.mjs)
 });
 const passthrough = (r) => (r && typeof r === "object" ? (r.text ?? JSON.stringify(r)) : String(r));
 const CAPABILITY_OFFICES = CAPABILITIES.offices.covered.join("+");

package/driver/engine/mcp/gather-config.mjs

@@ -900,6 +900,21 @@ function serverEnv({ sessionKey, agent, runDir, recordAxis, bandGroups = false }
 
 // Build the mcp-config object for a set of groups. Returns { config: <object>, servers: [...] } or null if
 // the groups need no MCP server (e.g. caselaw-only EUR-Lex via WebFetch needs no server but the bridges do).
+/**
+ * The stage's tool config for ONE turn, with that turn's time to stop sending handed to every server
+ * (providers/_shared/send-until.mjs). Built per turn, because each attempt has its own deadline. The config
+ * is the JSON string the engines take; anything that is not one is returned as it came. PURE.
+ */
+export function withSendUntil(mcpConfigJson, sendUntilMs) {
+  if (typeof mcpConfigJson !== "string" || !Number.isFinite(Number(sendUntilMs))) return mcpConfigJson;
+  let cfg;
+  try { cfg = JSON.parse(mcpConfigJson); } catch { return mcpConfigJson; }
+  if (!cfg?.mcpServers || typeof cfg.mcpServers !== "object") return mcpConfigJson;
+  for (const server of Object.values(cfg.mcpServers))
+    if (server && typeof server === "object") server.env = { ...(server.env ?? {}), CLEAROTRON_GATHER_SEND_UNTIL_MS: String(Math.floor(Number(sendUntilMs))) };
+  return JSON.stringify(cfg);
+}
+
 export function buildGatherMcpConfig(groups = [], { sessionKey, agent, runDir, recordAxis, bandGroups = false } = {}) {
   const localKeys = new Set(), bridgeKeys = new Set();
   for (const g of groups) { const r = resolveGroup(g); r.local.forEach((k) => localKeys.add(k)); r.bridges.forEach((k) => bridgeKeys.add(k)); }

package/driver/engine/mcp/held-answers.mjs

@@ -15,7 +15,8 @@
 // is the same as one naming them. Owner names are compared as written, never merged. A different scope is a
 // different question, and an earlier answer that failed is no answer: both are asked again. A question that timed out
 // at the gateway is the one failure held, by the executor rather than here: its timeout stands until the envelope
-// close asks it once more (execute-plan.mjs, timedOutBefore).
+// close asks it once more (execute-plan.mjs, timedOutBefore). An answer in a slice the run took out of its band
+// because a check could not prove it ran is asked again too, whatever wrote the band since.
 
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";
@@ -23,6 +24,7 @@ import { driverDir } from "../../../shared/driver-dir.mjs";
 import { OUTSTANDING_REASON } from "../../../providers/_shared/follow-up-searches.mjs";
 import { awaitsReadingTurn } from "../../../providers/_shared/plan-guards.mjs";
 import { releasedFamilyQids } from "../../withheld-families.mjs";
+import { bandWithSlicesOut, slicesTakenOutByAxis } from "../../../shared/slices-taken-out.mjs";
 
 const QUESTION_FIELDS = ["predicate", "term", "terms", "romanizedTerms", "term_literal", "nice_classes", "regions", "goods_text", "owner", "expected_kind"];
 const sorted = (v) => [...v].map((x) => String(x)).sort();
@@ -88,7 +90,9 @@ export function refuseHeldQuestions(entries, held, planRegions = []) {
 }
 
 // The run's questions and answers as its files hold them: the frozen plan, each worker's supplemental plan, and every
-// band's blocks by qid. IMPURE.
+// band's blocks by qid, with the slices the searches record took out read as the open slices they were delivered as
+// (shared/slices-taken-out.mjs). They are read out after the cache, which knows a band's size and time and not the
+// record's. IMPURE.
 function readRunQuestions(runDir) {
   const units = join(runDir, "register-units");
   const blocksByQid = new Map();
@@ -96,8 +100,12 @@ function readRunQuestions(runDir) {
   try { plans.push({ axis: null, plan: JSON.parse(readFileSync(driverDir(runDir, "register-plan.json"), "utf8")) }); } catch { /* no frozen plan */ }
   let files = [];
   try { files = readdirSync(units); } catch { files = []; }
+  const takenOut = slicesTakenOutByAxis(runDir);
   for (const f of files) {
-    if (f.endsWith("-band.json")) for (const b of readBlocks(join(units, f))) if (b?.qid) blocksByQid.set(String(b.qid), b);
+    if (f.endsWith("-band.json")) {
+      const { blocks } = bandWithSlicesOut(readBlocks(join(units, f)), takenOut.get(f.slice(0, -"-band.json".length)));
+      for (const b of blocks) if (b?.qid) blocksByQid.set(String(b.qid), b);
+    }
     if (f.endsWith("-supplemental-plan.json")) {
       try { plans.push({ axis: f.slice(0, -"-supplemental-plan.json".length), plan: JSON.parse(readFileSync(join(units, f), "utf8")) }); } catch { /* torn: skipped */ }
     }

package/driver/engine/mcp/signa-server.mjs

@@ -9,6 +9,7 @@
 // keyed by the GATEWAY session key (tctx.sessionKey) — we thread the run's session key via
 // CLEAROTRON_GATHER_SESSION_KEY so the $0 provider-usage diff still attributes calls to the run.
 import { serve } from "./stdio-server.mjs";
+import { sendUntilFromEnv } from "../../../providers/_shared/send-until.mjs";
 import { crowdNoteFor } from "./crowd-note.mjs";   // how the unit decides on a crowd, beside an answer that carries one
 import { doSearch, doRecordFetch, doEnumerate, doExecutePlan, DEFAULT_BASE } from "../../../providers/signa/src/core.js";
 import { proposeSupplemental } from "./supplemental.mjs";
@@ -22,6 +23,7 @@ const tctx = (kind) => ({
   agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",   // run session key — telemetry attribution
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
+  sendUntilMs: sendUntilFromEnv(),   // this turn's time to stop sending (providers/_shared/send-until.mjs)
 });
 const passthrough = (r) => (r && typeof r === "object" ? (r.text ?? JSON.stringify(r)) : String(r));
 const guard = (fn) => async (args) => {

package/driver/engine/mcp/supplemental.mjs

@@ -36,6 +36,7 @@ import { PLAN_PREDICATES, PLAN_MAX_OR_WIDTH, PLAN_MAX_NAME_LENGTH, planExactOrWi
 import { entryTermIssues } from "../../../providers/_shared/term-shape.mjs";
 import { OUTSTANDING_REASON } from "../../../providers/_shared/follow-up-searches.mjs";
 import { heldAnswers, questionKey } from "./held-answers.mjs";
+import { bandWithSlicesOut, slicesTakenOutByAxis } from "../../../shared/slices-taken-out.mjs";
 import { readWithheldFamilies } from "../../withheld-families.mjs";
 import { addedClassBound, boundAddedClasses } from "../../frame-diff-model.mjs";   // an added class takes one question, the identical mark
 import { scriptQuestionsByMarket } from "../../registration-scripts.mjs";   // one script question per market on the plan's list
@@ -573,11 +574,13 @@ export async function proposeSupplemental(params, tctx, deps) {
   }
 
   // A question this worker re-proposes that already holds an answer is not run again: the answer stands. One with no
-  // answer, a failed one, or one this call enriched or gave its markets runs as before.
+  // answer, a failed one, one whose slice the run took out of the band because a check could not prove it ran
+  // (shared/slices-taken-out.mjs), or one this call enriched or gave its markets runs as before.
   let reusedHeld = [];
   try {
     const own = new Map();
-    for (const b of JSON.parse(readFileSync(outPath, "utf8"))) if (b?.qid) own.set(String(b.qid), b);
+    const { blocks } = bandWithSlicesOut(JSON.parse(readFileSync(outPath, "utf8")), slicesTakenOutByAxis(dirname(dirname(outPath))).get(axis));
+    for (const b of blocks) if (b?.qid) own.set(String(b.qid), b);
     reusedHeld = reused.filter((q) => { const b = own.get(String(q)); return b && b.error !== true && !enrichedQids.includes(q) && !staleOnDisk; });
   } catch { reusedHeld = []; }
   const qids = [...minted.map((e) => e.qid), ...reused.filter((q) => !reusedHeld.includes(q))];

package/driver/engine/mcp/uspto-local-server.mjs

@@ -32,6 +32,7 @@
 // visible where a spawn and a reviewer each actually look — the tool list here, the REGISTER_SERVERS
 // filter in gather-config.mjs, and the exact-six pin in driver/test/engine.gather.test.mjs.
 import { serve } from "./stdio-server.mjs";
+import { sendUntilFromEnv } from "../../../providers/_shared/send-until.mjs";
 import { crowdNoteFor } from "./crowd-note.mjs";   // how the unit decides on a crowd, beside an answer that carries one
 import {
   CAPABILITIES, DEFAULT_DB_ENV, doSearch, doRecordFetch, doBatchScreen, doEnumerate, doExecutePlan,
@@ -48,6 +49,7 @@ const tctx = (kind) => ({
   agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",   // run session key — telemetry attribution
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
+  sendUntilMs: sendUntilFromEnv(),   // this turn's time to stop sending (providers/_shared/send-until.mjs)
 });
 const passthrough = (r) => (r && typeof r === "object" ? (r.text ?? JSON.stringify(r)) : String(r));
 const guard = (fn) => async (args) => {

package/driver/envelope-settle.mjs

@@ -37,6 +37,7 @@
 import { existsSync, readFileSync, writeFileSync, renameSync } from "node:fs";
 import { isCapabilityGapReason } from "./coverage-ledger.mjs";
 import { fullyDeferredAxes } from "./register-plan.mjs";
+import { readPartNotCompleted } from "./parts-not-completed.mjs";
 
 export const SETTLE_SCHEMA_VERSION = 1;
 
@@ -194,9 +195,18 @@ export function settleTriedAfter(prior, dispatched, planVersion) {
   return [...out.values()];
 }
 
-/** The run's sticky capability gaps, by qid → row. Absent or unreadable decision ⇒ none. */
+/**
+ * The run's sticky gaps, by qid → row: the capability gaps it accepted, and the slices a check could not prove ran,
+ * which the searches' record took out of the band once their recovery was spent (parts-not-completed.mjs). Neither is
+ * sent to the provider again, settled again or re-run to close. Absent or unreadable decision and record ⇒ none.
+ */
 export function readStickyGaps(P) {
-  return new Map((readEnvelopeDecision(P)?.sticky_gaps ?? []).map((g) => [String(g?.qid ?? ""), g]).filter(([q]) => q));
+  const out = new Map((readEnvelopeDecision(P)?.sticky_gaps ?? []).map((g) => [String(g?.qid ?? ""), g]).filter(([q]) => q));
+  for (const s of (P?.runDir ? readPartNotCompleted(P.runDir, "searches")?.slices : null) ?? []) {
+    const qid = String(s?.qid ?? "");
+    if (qid && !out.has(qid)) out.set(qid, { qid, axis: String(s.axis ?? ""), reason: String(s.reason ?? "").slice(0, 400) });
+  }
+  return out;
 }
 
 /** One history entry per superseded decision. Returns the prior history with the old decision appended. */
@@ -225,7 +235,7 @@ export function supersede(prior, source) {
 export async function settleReceipt({ P, plan, receipt, dispatch = null, rejoin = null, now = null }) {
   const deferred = receipt?.deferred ?? [];
   const prior = readEnvelopeDecision(P);
-  const sticky = new Set((prior?.sticky_gaps ?? []).map((g) => String(g?.qid ?? "")));
+  const sticky = new Set(readStickyGaps(P).keys());
   let { accepted, suspect } = partitionReceiptDeferrals(plan, receipt, { sticky });
   const closed = [], closeFailed = [];
   const tried = new Map((prior?.settle_tried ?? []).map((t) => [String(t?.qid ?? ""), t]));