clearotron 0.5.0-beta.2 → 0.5.0-beta.4

package/.env.example

@@ -184,6 +184,13 @@ CLEAROTRON_DATABASE=clarivate
 #   CLEAROTRON_GATHER_SESSION_KEY, CLEAROTRON_GATHER_SESSION_ID, CLEAROTRON_GATHER_AGENT,
 #   CLEAROTRON_REGISTER_CALL_LOG, CLEAROTRON_REGISTER_RECORD_LOG
 #
+# The time, in epoch milliseconds, at which a turn's register tools stop sending new questions, so the
+# unit can write what it holds inside its own time. The driver writes it per turn into each register
+# tool server's env, a quarter of the turn (at most five minutes) ahead of the turn's deadline. Leave it
+# empty: a value set here would be read by the driver's own code-side executor as a fixed time.
+# effect: tuning
+CLEAROTRON_GATHER_SEND_UNTIL_MS=
+#
 # THERE IS NO RETENTION SETTING AND NO CLEANUP JOB. CLEAROTRON_REGISTER_LEDGER_MAX_BYTES,
 # CLEAROTRON_REGISTER_LEDGER_KEEP and `npm run prune:ledger` are gone with the rotation tool, because the
 # thing they bounded no longer grows: RECORD BODIES ARE WRITTEN INTO THE RUN'S OWN DIRECTORY

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "bdb15f0c3974c46ccb0db2a2020779e65f0b4e21",
-  "version": "0.5.0-beta.2"
+  "commit": "7c6882de2e3c147992a6667bbce24de9fffb5206",
+  "version": "0.5.0-beta.4"
 }

package/docs/architecture/03-run-lifecycle.md

@@ -438,6 +438,7 @@ node pipeline.mjs --job <file.json> [--agent <id>]        # cold run (still take
 node pipeline.mjs --resume <codename>                     # idempotent resume: valid outputs skip
 node pipeline.mjs --resume <codename> --from <stage>      # force re-run from a stage ordinal
 node pipeline.mjs --resume <codename> --experiment <stage> [--label <t>]                  # shadow dir
+node pipeline.mjs --resume <codename> --experiment synthesis --research replay           # research from the run's own answers
 ```
 
 - **Resume** refuses a delivered run (any of the three delivered markers above — re-handing off a
@@ -448,6 +449,11 @@ node pipeline.mjs --resume <codename> --experiment <stage> [--label <t>]
 - **`--experiment`** runs one stage in a shadow dir (`_experiments/<ts>-<tag>/`) on copies of its
   inputs, under a `clearance-exp-…` session key that is excluded from the run's provider-usage
   attribution. The canonical run is untouched.
+- **`--research replay`** answers the arm's research from the answers the run saved
+  (`_driver/research-answers.jsonl`, copied into the shadow dir). A question the run asked gets the
+  run's latest answer to it; a question it did not ask, and any grid, is refused, and nothing is sent
+  to the research service. It is refused for a stage that holds no research tool, or a run that saved
+  no answers. The arm's `experiment-context.json` records `research: {mode, answers}`.
 - **Orphan self-resume**: a manually resumed run that parks has no queue sidecars; the runner scans
   run dirs for due, payload-complete `.postponed` sentinels not owned by any queue and resumes them
   (claim = atomic rename to `.resuming`).

package/docs/architecture/04-configuration-reference.md

@@ -373,6 +373,7 @@ cannot be read as one list.
 | `CLEAROTRON_DUMP_JSON` | unset | Dump each attempt's raw engine envelope to `_driver/<stage>.attempt<N>.rawjson.json`. Opt-in: any value except `0`/`off`/`false`/`no`/empty arms it. |
 | `CLEAROTRON_DISPATCH_RECORD` | **on** | Write the verbatim message of every stage dispatch to `_driver/<stage>.attempt<N>[.repair<M>].dispatch.txt`, with `{file, sha, bytes, chars, kind}` on the attempt row. **Default ON** — `0`/`off`/`false`/`no` disarms it. Unlike `CLEAROTRON_DUMP_JSON` beside it, this is opt-OUT: the question it answers ("was the model given this?") is asked *after* the run that raised it, so a flag someone had to remember would be off on exactly the run that needed it. The files carry the company's identity verbatim and are deliberately not in the artifact table. |
 | `CLEAROTRON_GATHER_SESSION_KEY` / `CLEAROTRON_GATHER_AGENT` / `CLEAROTRON_GATHER_SESSION_ID` | set per stage | Telemetry attribution into the provider-call ledger (set by the gather config; not operator-set). |
+| `CLEAROTRON_GATHER_SEND_UNTIL_MS` | set per turn | When a turn's register tools stop sending new questions: a quarter of the turn, at most five minutes, ahead of its deadline (set by the gather config; not operator-set). |
 | `CLEAROTRON_RECORD_AXIS` | set per dispatch (unset ⇒ the stage is not fanned out) | Binds one fan-out turn of a recording stage to the single member it may write. `stageOnce` suffixes a fan-out stage's label with its axis, the gather config resolves `<stage>:<axis>` back to the base stage's tool group, and this carries the axis to the recording server. A call whose payload names a different member than the turn is bound to is REFUSED, so a seat cannot write into a sibling's file — without the binding every turn of the fan-out would record over member one. Set by the driver; not operator-set. |
 | `PORTAL_READ_MODEL` | `sonnet` | The model the portal's own compose-read turn uses. Distinct from the pipeline's tiers: this is a portal surface, not a stage. |
 | `CLEAROTRON_ORDER_PROBE_SEED` | unset | Seed for `scripts/band-shape-probe.mjs`, so an ordering probe can be replayed. A diagnostic script's knob, not a run's. |

package/docs/architecture/05-config-governance.md

@@ -282,7 +282,7 @@ edited — that box runs pre-rebuild code and genuinely still sets it.
 `CLEAROTRON_OUTBOX_BACKOFF_MAX_RETRIES` (5) / `CLEAROTRON_OUTBOX_GIVEUP_COOLDOWN_SEC` (3600 — note this one
 drops BACKOFF from the prefix, which the elided spelling this row used to carry actively misled about),
 `CLEAROTRON_OUTBOX_NOPROGRESS_MAX`, `TRADEMARK_MSGID_DOMAIN` (enqueue.local).
-Code-set per stage (not operator-set): `CLEAROTRON_GATHER_AGENT` / `CLEAROTRON_GATHER_SESSION_KEY` / `CLEAROTRON_GATHER_SESSION_ID`.
+Code-set per stage (not operator-set): `CLEAROTRON_GATHER_AGENT` / `CLEAROTRON_GATHER_SESSION_KEY` / `CLEAROTRON_GATHER_SESSION_ID`; per turn: `CLEAROTRON_GATHER_SEND_UNTIL_MS`.
 
 **Who the completion notice reaches** — `CLEAROTRON_REQUESTER_WHATSAPP` (empty; effect: deployment) is a
 JSON map of requester email or handle → number, and `CLEAROTRON_WHATSAPP_OPERATOR_COPY` (on unless `0`,

package/driver/CHANGELOG.md

@@ -1,5 +1,26 @@
 # clearotron-driver
 
+## 0.5.0-beta.4
+
+### Patch Changes
+
+- Fixed: On the Codex engine, a clearance no longer sees temporary files that another clearance left on the same machine.
+- Fixed: A report's copy for the client is no longer held back when a live finding shares its mark and owner with a finding the review withdrew.
+- Fixed: A register entry the engine decided to keep as background now appears in the report's context table, instead of being left out of it.
+- Fixed: When the report's writing step is interrupted, the next attempt continues from the findings it had already finished instead of starting again.
+- Fixed: On a crowded field, the report is written from the work the clearance has already done, without reading every register result again.
+
+## 0.5.0-beta.3
+
+### Patch Changes
+
+- Fixed: The delivery email for a result the review could not sign off now lists the report's "Only you can close these" items.
+- Fixed: When a clearance fails, its chat notice now goes to the person who asked for it, with a copy to the operator.
+- Fixed: A clearance no longer repeats a finished step because a web lookup inside it timed out.
+- Fixed: A clearance whose register search cannot finish, such as one that keeps timing out, now delivers its report instead of ending with none.
+- Fixed: A search that cannot be shown to have run is now listed as not searched, and the report is still delivered.
+- Fixed: Reports can set aside an identical mark registered for unrelated goods, recording the reason in the audit workbook instead of listing it as a finding.
+
 ## 0.5.0-beta.2
 
 ### Patch Changes

package/driver/band-shape.mjs

@@ -1129,24 +1129,32 @@ export const FLOORS_BY_NAME_HERE = "Every floor here is placed or set aside by n
 export const A_CROWDS_ONE_ROW = "Read the first page, carry forward any line a lawyer would raise, and set the rest aside in this group's one row with the count: the client is told the field is crowded.";
 export const A_CROWDS_ROW_COVERS_A_READ_FLOOR = "This row covers a floor only once you have read its line and its goods are not the client's goods.";
 export const AN_UNREAD_CROWDS_ONE_ROW = "Carry forward any line a lawyer would raise, and set the rest aside in this list's one row with the count, on the ground that their goods are unreadable and the field is crowded.";
-export const AN_UNREAD_CROWDS_FLOOR = "A floor here is placed or set aside by name on its status or its territory; this row never covers it.";
-export const AN_UNREAD_LISTS_FLOOR = "A floor here is placed, or set aside by name on its status or its territory; any other line may be set aside on the ground that its goods are unknown.";
+export const AN_UNREAD_CROWDS_FLOOR = "This row never covers a floor. Place each floor here, or set it aside by name; a goods ground needs the floor's goods read in full.";
+export const AN_UNREAD_LISTS_FLOOR = "Place each floor here, or set it aside by name; a goods ground needs the floor's goods read in full. Any other line here may be set aside because its goods are unknown.";
 // What placement does with a line of that list before its fate, by its marker (approved wording, 2026-10-19). Placement's
 // alone, as its other orders are: every other stage keeps the markers as evidence and is not told of a fate.
 export const AN_UNREAD_LINE_IS_CHECKED = 'A line marked "on file, not readable", "cut by the register, no goods word found", "goods held; completeness not established" or "no goods text held; completeness not established" must be checked with band_record before its fate. Read the evidence held for it, keeping its source and goods completeness clear. A line marked "no goods on file", "fetch failed, no goods on file" or "the register\'s record lists no goods" has no goods text on file. Missing goods do not establish that the goods are unrelated.';
 export const PLACEMENT_LINE_ORDERS = Object.freeze([FLOORS_BY_NAME_HERE, A_CROWDS_ONE_ROW, A_CROWDS_ROW_COVERS_A_READ_FLOOR, AN_UNREAD_CROWDS_ONE_ROW, AN_UNREAD_CROWDS_FLOOR, AN_UNREAD_LISTS_FLOOR, AN_UNREAD_LINE_IS_CHECKED]);
+// AND THE SIZE RULE'S ORDERS TO READ (ruled 2026-10-27). A list's size sentence tells placement how much of it to read,
+// and only placement owes the lines that read. Every other stage is served the shape without these orders too: the
+// writer is told the groups are a way to find evidence, never a list it must read to completion. Each list's count,
+// what it holds and the fact that a crowded one prints its first page stay.
+export const READ_THEM_ALL = "Fifty? Read them all.";
+export const READ_EVERY_LINE = ": read every line.";
+export const READ_THE_LIVE_ONES_FIRST = "A few hundred? Read the live ones in the ordered classes first.";
 const SHAPE_LISTS = ["a", "b", "c", "d", "rest", "no_goods"];
 const pageEveryOtherLine = (g) => `; page every other line with ${groupPageCall(g)}`;
 const pageWhereALineNeedsIt = (g) => `; page with ${groupPageCall(g)} only where a line needs reading`;
 const pageTheFloorsLeft = (g) => `Where more floors are counted than this page shows, page the rest with ${groupPageCall(g)}; they come first.`;
 /**
- * The shape as every stage but placement is served it: placement's orders and its group-page commands removed,
+ * The shape as every stage but placement is served it: placement's orders, its size rule's orders to read and its group-page commands removed,
  * each with the space before it, inside its line, so no line moves and the line each listed mark is printed on
  * still holds. A crowded group's "The first N lines are below" stays, as a fact about what is printed. PURE.
  */
 export function withoutPlacementOrders(text) {
   let t = String(text ?? "");
-  for (const order of [...PLACEMENT_GROUP_ORDERS, ...PLACEMENT_LINE_ORDERS, ...SHAPE_LISTS.map(pageTheFloorsLeft)]) t = t.split(` ${order}`).join("").split(order).join("");
+  for (const order of [...PLACEMENT_GROUP_ORDERS, ...PLACEMENT_LINE_ORDERS, ...SHAPE_LISTS.map(pageTheFloorsLeft), READ_THEM_ALL, READ_THE_LIVE_ONES_FIRST]) t = t.split(` ${order}`).join("").split(order).join("");
+  t = t.split(READ_EVERY_LINE).join(".");
   for (const g of SHAPE_LISTS) t = t.split(pageEveryOtherLine(g)).join("").split(pageWhereALineNeedsIt(g)).join("");
   return t;
 }
@@ -1200,16 +1208,16 @@ function renderGroupsMd(md, groups, rows = []) {
     md.push(`### ${heading(g)}`, "");
     if (!grp.lines) { md.push("(none)", ""); continue; }
     const crowded = grp.records >= groups.crowded_at;
-    const readA = "These are the identical and near-identical marks live in the ordered classes for the client's goods: read every line.";
+    const readA = `These are the identical and near-identical marks live in the ordered classes for the client's goods${READ_EVERY_LINE}`;
     md.push(g === "a"
       ? (crowded
         ? `${count(grp)}. ${readA} ${firstPage}${pageEveryOtherLine(g)}. ${FLOORS_BY_NAME_HERE}`
-        : grp.lines <= READ_ALL_LINES ? `${count(grp)}. Fifty? Read them all.` : `${count(grp)}. ${readA}`)
+        : grp.lines <= READ_ALL_LINES ? `${count(grp)}. ${READ_THEM_ALL}` : `${count(grp)}. ${readA}`)
       : crowded
         ? `${count(grp)}. A thousand or more? The field is crowded. These are ${crowd[g]}. ${A_CROWDS_ONE_ROW} ${firstPage}${pageWhereALineNeedsIt(g)}.${
           g === "b" ? ` ${A_CROWDS_ROW_COVERS_A_READ_FLOOR} ${pageTheFloorsLeft(g)}` : ""}`
         : grp.lines <= READ_ALL_LINES
-          ? `${count(grp)}. Fifty? Read them all.`
+          ? `${count(grp)}. ${READ_THEM_ALL}`
           : `${count(grp)}. ${SORT_THE_NEAR_ONES}`, "");
     md.push(...head);
     for (const l of crowded ? grp.list.slice(0, groups.first_page) : grp.list) { rows.push([md.length, l.key]); md.push(row(l)); }
@@ -1223,7 +1231,7 @@ function renderGroupsMd(md, groups, rows = []) {
   md.push(`**The rest: ${count(rest)}${outside}** — every record in none of (a) to (d) above. ${!rest.lines ? ONE_SET_ASIDE_ROW
     : restCrowded
       ? `A thousand or more? The field is crowded. ${A_CROWDS_ONE_ROW} ${firstPage}${pageWhereALineNeedsIt("rest")}.`
-      : `${rest.lines <= READ_ALL_LINES ? "Fifty? Read them all." : SORT_THE_NEAR_ONES} ${ONE_SET_ASIDE_ROW}`}`);
+      : `${rest.lines <= READ_ALL_LINES ? READ_THEM_ALL : SORT_THE_NEAR_ONES} ${ONE_SET_ASIDE_ROW}`}`);
   if (rest.lines) {
     md.push("", ...head);
     for (const l of restCrowded ? rest.list.slice(0, groups.first_page) : rest.list) { rows.push([md.length, l.key]); md.push(row(l)); }
@@ -1231,8 +1239,8 @@ function renderGroupsMd(md, groups, rows = []) {
   if (groups.no_goods.lines) {
     // The lines the goods test could not place, read by the same size rule (ruled 2026-10-12): under a thousand
     // records, a fate per line by name, opened where goods are on file; at a thousand or more, the first page,
-    // and one row on the rest whose goods are unreadable in a crowded field. A floor is never set aside on
-    // its goods, so a floor here is placed or set aside on its status or territory.
+    // and one row on the rest whose goods are unreadable in a crowded field. A floor is set aside on its goods only
+    // once they are read in full, which unknown goods never are, so a floor here is placed or set aside by name.
     const ng = groups.no_goods;
     const crowded = ng.records >= groups.crowded_at;
     const lead = tested.source === "none"
@@ -1240,7 +1248,7 @@ function renderGroupsMd(md, groups, rows = []) {
       : `**Goods the test could not read: ${count(ng)}.**`;
     md.push("", crowded
       ? `${lead} A thousand or more? ${firstPage}, the floors first, then the live ones in the ordered classes. ${AN_UNREAD_CROWDS_ONE_ROW} ${AN_UNREAD_CROWDS_FLOOR} ${pageTheFloorsLeft("no_goods")}`
-      : `${lead} ${ng.lines <= READ_ALL_LINES ? "Fifty? Read them all." : "A few hundred? Read the live ones in the ordered classes first."} ${A_FATE_BY_NAME}${tested.source === "none" ? "" : ` ${AN_UNREAD_LINE_IS_CHECKED}`} ${AN_UNREAD_LISTS_FLOOR}`, "");
+      : `${lead} ${ng.lines <= READ_ALL_LINES ? READ_THEM_ALL : READ_THE_LIVE_ONES_FIRST} ${A_FATE_BY_NAME}${tested.source === "none" ? "" : ` ${AN_UNREAD_LINE_IS_CHECKED}`} ${AN_UNREAD_LISTS_FLOOR}`, "");
     md.push(...head);
     for (const l of crowded ? ng.list.slice(0, groups.first_page) : ng.list) { rows.push([md.length, l.key]); md.push(row(l)); }
   }

package/driver/contract-vocabulary.mjs

@@ -530,9 +530,9 @@ export const INNER_CODES = Object.freeze([
   // ONE CODE, TWO TOKENS, and the split is by `cause` rather than by code: verify.mjs peels the
   // `axis_invalid` cause into its own family before counting the rest. A ruling naming only
   // `coverage_no_status` would be true of most `no_status` records and false of the ones that matter most.
-  { code: "no_status", mints: ["driver/coverage-form.mjs:920"], rollsUpTo: ["coverage_no_status", "coverage_form_axis_invalid"],
+  { code: "no_status", mints: ["driver/coverage-form.mjs:939"], rollsUpTo: ["coverage_no_status", "coverage_form_axis_invalid"],
     why: "Two composites, split on the record's `cause`: coverageFormFail() in verify.mjs for cause `axis_invalid`, and the same function for the rest. NOT the `@returns` annotation of findCoverageFormViolations() in coverage-form.mjs — that is the annotation, not the mint." },
-  { code: "engine_vocabulary", mints: ["driver/coverage-form.mjs:910"], rollsUpTo: ["coverage_form_engine_vocabulary"],
+  { code: "engine_vocabulary", mints: ["driver/coverage-form.mjs:929"], rollsUpTo: ["coverage_form_engine_vocabulary"],
     why: "#669 — the seat wrote an engine token into the `reason` sentence that reaches the reader's page. Checked on settled rows too, because a row the seat considers finished is exactly the one whose sentence gets printed. Namespaced by coverageFormFail() in verify.mjs; the bare code names a row, never a stage." },
 
   // ── ONE CODE, TWO MODULES ────────────────────────────────────────────────────────────────────────
@@ -544,7 +544,7 @@ export const INNER_CODES = Object.freeze([
   // failure tokens" already states the rule this row records: `coverage_form_damaged`, never a bare
   // `form_damaged`.
   { code: "form_damaged",
-    mints: ["driver/connotation-search.mjs:2002", "driver/connotation-search.mjs:2078", "driver/coverage-form.mjs:902"],
+    mints: ["driver/connotation-search.mjs:2002", "driver/connotation-search.mjs:2078", "driver/coverage-form.mjs:921"],
     rollsUpTo: ["connotation_form_damaged", "coverage_form_damaged"],
     why: "Minted in two lanes and namespaced per lane: connotationDispositionFail() in verify.mjs for the meaning sweep, coverageFormFail() in verify.mjs for the register digest. The namespacing is what keeps them apart — see verify.mjs's block headed \"the register coverage-form failure tokens\"." },
 ]);

package/driver/coverage-form-io.mjs

@@ -32,6 +32,7 @@ import { COVERAGE_STATUSES, COVERAGE_FORM_NAME, REGISTER_AXES } from "./coverage
 import { coverageFormSidecarName, parseCoverageForm } from "./coverage-form.mjs";
 import { capabilitiesFor } from "./register-capabilities.mjs";
 import { readWithheldFamilies, splitWaitingFamilies } from "./withheld-families.mjs";
+import { slicesTakenOutByAxis } from "../shared/slices-taken-out.mjs";   // the slices the searches record took out of the band
 
 export { COVERAGE_FORM_NAME };
 
@@ -150,7 +151,8 @@ export function coverageFormInput(runDir) {
   return { input: { skeleton: exec.skeleton, plan, bandBlocksByAxis, deferredReasons, activeAxes,
     bandsUnreadable, orderedTerritories, capabilities, unknownAxisUnits,
     awaiting: Array.isArray(exec.awaiting) ? exec.awaiting : [], withheld: readWithheldFamilies(runDir),
-    mainMarkets: Array.isArray(exec.main_markets) ? exec.main_markets : [] }, absent: null };
+    mainMarkets: Array.isArray(exec.main_markets) ? exec.main_markets : [],
+    takenOut: Object.fromEntries(slicesTakenOutByAxis(runDir)) }, absent: null };
 }
 
 /**

package/driver/coverage-form.mjs

@@ -353,10 +353,14 @@ export const DEFERRED_OPEN_BECAUSE = Object.freeze({
 });
 const deferredOpenBecause = (block, receiptReason) => block?.gateway_timeout === true ? DEFERRED_OPEN_BECAUSE.timeout
   : isProviderHardErrorReason(receiptReason) ? DEFERRED_OPEN_BECAUSE.hardError : DEFERRED_OPEN_BECAUSE.capability;
+// A SLICE THE RUN TOOK OUT OF THE BAND (the searches not completed, parts-not-completed.mjs) is open for the reason its
+// record gives, which is the shipped line the reader gets for it (ruled 2026-10-27): the provider could express it, and
+// what is missing is the evidence that it ran. A taken-out slice with no qid has no plan row to defer it, so it gets a
+// row of its own, keyed on its query.
 
 export function coverageFormRows({ skeleton = [], activeAxes = null, plan = null,
   bandBlocksByAxis = {}, deferredReasons = {}, bandsUnreadable = [],
-  orderedTerritories = [], capabilities = null, awaiting = [], withheld = {}, mainMarkets = [] } = {}) {
+  orderedTerritories = [], capabilities = null, awaiting = [], withheld = {}, mainMarkets = [], takenOut = {} } = {}) {
   const skel = Array.isArray(skeleton) ? skeleton.filter((s) => s && typeof s === "object") : [];
   // WHAT WAS RETRIEVED UNDER EACH CROWD (register-plan.mjs, crowdNarrowing), worked out from the same blocks these rows
   // are built from and carried on its row as data: a narrowed list retrieved in full (and which), none, or for the
@@ -423,6 +427,8 @@ export function coverageFormRows({ skeleton = [], activeAxes = null, plan = null
         status: null, reason: null,
       });
     }
+    const out = Array.isArray(takenOut?.[axis]) ? takenOut[axis] : [];
+    const takenReason = new Map(out.filter((x) => x?.qid && x?.reason).map((x) => [String(x.qid), String(x.reason)]));
     for (const qid of deferredQids) {
       rows.push({
         row_id: shortId("CD", `deferred:${qid}`),
@@ -433,7 +439,20 @@ export function coverageFormRows({ skeleton = [], activeAxes = null, plan = null
         // It was never searched, or it was asked and never answered, and nothing in this run asks it again, so a clean
         // claim over it is not a judgment the seat gets to make.
         open: true,
-        open_because: deferredOpenBecause(blockByQid.get(qid), deferredReasons?.[qid]),
+        open_because: takenReason.get(qid) ?? deferredOpenBecause(blockByQid.get(qid), deferredReasons?.[qid]),
+        status: null, reason: null,
+      });
+    }
+    for (const x of out) {
+      if (x?.qid || !x?.query || !x?.reason) continue;
+      rows.push({
+        row_id: shortId("CD", `deferred:${axis}:query:${x.query}`),
+        axis, kind: "deferred",
+        unit: unitLabel(axis, { term: String(x.query) }),
+        qid: null, query: String(x.query),
+        receipt_reason: String(x.reason),
+        open: true,
+        open_because: String(x.reason),
         status: null, reason: null,
       });
     }

package/driver/coverage-ledger.mjs

@@ -23,6 +23,7 @@
 // `validators` at module scope, so verify importing stages would TDZ-crash whenever verify loads
 // first; stages.mjs re-exports both names, keeping every existing import site working).
 
+import { plainDeferralReason } from "./deferral-row.mjs";
 export const REGISTER_AXES = ["saturation-probe", "primary-sweep", "transliteration-numeric", "incumbent-class"];
 
 // ── — THE READER'S NAME FOR AN AXIS, EMITTED AT SOURCE ──────────────────────────────────────────
@@ -347,13 +348,18 @@ export function coverageLedgerTableRows(rows, { reasonMax = 180 } = {}) {
 // confirmed-clean rows on tainted material axes move; coverage-limited/deferred rows and non-material
 // axes (saturation-probe) are untouched; an empty taint set is a no-op. PURE; the caller pre-reads the
 // taint verdicts (pipeline loadCoverageLedger → readRegisterTaint).
+// The reason a tainted axis's withdrawn clean claim carries: the shipped gap sentence (deferral-row.mjs).
+export const TAINTED_CLEAN_REASON = plainDeferralReason("unfinished");
+
 export function applyTaintDeferred(rows, taintedAxes) {
   const tainted = new Set((taintedAxes ?? []).map((a) => String(a).toLowerCase()));
   if (!tainted.size) return rows ?? [];
   const material = (a) => !NON_MATERIAL_AXES.includes(String(a ?? "").toLowerCase());
+  // The pass that claimed clean was killed before it finished reading, so the claim is withdrawn whole: the row is open,
+  // with the shipped reason a reader gets for a part not completed, and none of the claim's words.
   return (rows ?? []).map((r) =>
     (r && r.status === "confirmed-clean" && tainted.has(String(r.axis ?? "").toLowerCase()) && material(r.axis))
-      ? { ...r, status: "deferred", reason: `${String(r.reason ?? "").trim()}${r.reason ? " — " : ""}timeout-tainted pass: self-reported clean downgraded pending re-run`.trim() }
+      ? { ...r, status: "deferred", reason: TAINTED_CLEAN_REASON }
       : r);
 }
 

package/driver/declination-call.mjs

@@ -117,6 +117,13 @@ export const DECLINATION_REASONS = Object.freeze({
     gloss: "an off-field name that is not a major brand, an active dispute or proceeding, or a "
       + "well-known enforcer — omitted, never listed for completeness",
   },
+  // A COMPARISON OF MARKS (ruled 2026-10-27): the writer may set aside a near spelling on its sign, as the write-up
+  // may, with the write-up's own gloss. It is refused on the applied-for mark itself, which no comparison sets aside.
+  sign: {
+    discretionary: true,
+    rules: 'synthesis-rules.md, "The consumer confusion test — the governing gate"',
+    gloss: "a near spelling a buyer in this market could not take for the mark, by sound, by look or by meaning",
+  },
   "not-worth-the-line": {
     discretionary: true,
     rules: 'synthesis-rules.md, "Promote-or-omit"',
@@ -206,7 +213,7 @@ export function contradictionFor(reason, row, scope) {
   // class is closed to the entry that holds it. Each record is judged on its own mark, status and classes.
   if (Array.isArray(row?.members) && row.members.length) {
     for (const m of row.members) {
-      const clash = contradictionFor(reason, { mark: m?.mark ?? row.mark, status: m?.status ?? null, classes: m?.classes ?? [] }, scope);
+      const clash = contradictionFor(reason, { mark: m?.mark ?? row.mark, status: m?.status ?? null, classes: m?.classes ?? [], goods: m?.goods ?? null }, scope);
       if (clash) return clash;
     }
     return "";
@@ -218,14 +225,26 @@ export function contradictionFor(reason, row, scope) {
   // it switched the identical-mark refusal below off on exactly those runs.
   const marks = Array.isArray(scope?.marks) ? scope.marks : (scope?.marks ? [scope.marks] : []);
 
+  // ── AN IDENTICAL MARK IN A FILED CLASS MAY BE DECLINED ON ITS GOODS, AND ON NOTHING ELSE DISCRETIONARY ──
+  //
+  // Ruled 2026-10-27: identical spelling and a shared class no longer bar a supported judgment that the registered
+  // goods are unrelated. This refused every discretionary token on such a record, so on a test run 29 goods
+  // decisions were refused and every one came back as a finding. A goods decision now stands where the run holds the
+  // record's goods complete (goods-evidence.mjs), because cut, unknown or missing goods establish nothing. The
+  // record's field, the report's length and a comparison with the applied-for mark itself are still refused.
   if (isIdenticalToAppliedMark(row?.mark, marks) && isLive(row?.status) && shared.length) {
-    return `this record's mark is IDENTICAL to the applied-for mark under the house normalizer, its `
-      + `status is ${String(row?.status ?? "").trim() || "live"}, and it sits in class ${shared.join(", ")} `
-      + `— one of the matter's own filed classes. synthesis-rules.md:167 orders that an on-point `
-      + `identical mark in the relevant class is never dropped, and says so "regardless of filer `
-      + `profile". Deliver it and rate it; a Stage-2 mitigant is a rating input, never a reason to omit. `
-      + `If it is the applicant's own right or already delivered under another record, say so with `
-      + `own-right or duplicate-of-delivered.`;
+    const facts = `this record's mark is IDENTICAL to the applied-for mark, its status is `
+      + `${String(row?.status ?? "").trim() || "live"}, and it is in filed class ${shared.join(", ")}`;
+    if (reason === "unrelated-goods") {
+      if (row?.goods === "complete") return "";
+      return `${facts}. The run holds its goods as ${String(row?.goods ?? "").trim() || "not recorded"}, not in full, `
+        + `and incomplete goods cannot show the goods are unrelated. Deliver and rate it, or use own-right or `
+        + `duplicate-of-delivered if one is true.`;
+    }
+    return `${facts}. Such a mark is never declined for its field, for want of room, or on its sign. Deliver and `
+      + `rate it; a Stage-2 mitigant goes into the rating. If its registered goods, read in full, do not meet the `
+      + `matter's goods, decline it as unrelated-goods and say so in the ground. If it is the applicant's own right `
+      + `or already delivered, use own-right or duplicate-of-delivered.`;
   }
 
   // ── ECONOMY IS NOT A REASON ABOUT A LIVE IN-CLASS MARK (ruling 2026-09-07) ─────────────────
@@ -250,14 +269,12 @@ export function contradictionFor(reason, row, scope) {
   // It does effectively retire this token for live in-class records, because the sweep is already scoped
   // to the instructed classes. That was put to the owner as the consequence and ruled anyway.
   if (reason === "not-worth-the-line" && isLive(row?.status) && shared.length) {
-    return `this record is ${String(row?.status ?? "").trim() || "live"} and sits in class `
-      + `${shared.join(", ")} — one of the matter's own instructed classes. "not worth the line" is a `
-      + `statement about the report's budget, not about this mark, and a live registration in an `
-      + `instructed class is never omitted for want of room. Either carry it, or decline it on something `
-      + `true of THIS MARK: unrelated-goods if its goods do not meet the matter's, off-field-not-major `
-      + `if it is off-field and not a major brand, an active dispute or a well-known enforcer, `
-      + `own-right if it belongs to the applicant, duplicate-of-delivered if the same right is already `
-      + `reported. Say what makes this mark distant, or give it its line.`;
+    return `this record is ${String(row?.status ?? "").trim() || "live"} in instructed class ${shared.join(", ")}. `
+      + `A live mark in an instructed class is never declined for want of room. Deliver it, or decline it on a fact `
+      + `about this mark: unrelated-goods if its goods do not meet the matter's; off-field-not-major if it is `
+      + `off-field and not a major brand, an active dispute or a well-known enforcer; sign if a buyer in this market `
+      + `could not take its spelling for the mark; own-right if it belongs to the applicant; duplicate-of-delivered `
+      + `if the same right is already reported.`;
   }
 
   // THERE IS NO CLASS-OVERLAP REFUSAL, AND THE FIRST DRAFT HAD ONE. It refused `unrelated-goods` and

package/driver/degraded-parts.mjs

@@ -171,6 +171,12 @@ function register(runDir, log) {
   const open = readPartNotCompleted(runDir, "assessment");
   if (open && ["placement-inquiry", "register-digest"].includes(open.stage))
     failed.push([{ fail: `${open.stage} did not complete: ${open.reason ?? "no cause recorded"}` }, "the register write-up"]);
+  // The searches a check could not prove ran, taken out of the band and delivered as open rows (parts-not-completed.mjs).
+  const searches = readPartNotCompleted(runDir, "searches");
+  if (searches) failed.push([{ fail: [
+    (searches.slices ?? []).length ? `${searches.slices.length} slice(s) taken out of the band` : "",
+    (searches.disclosed_axes ?? []).length ? `the pass on ${searches.disclosed_axes.join(", ")} timed out, read as it stands with its clean claims open` : "",
+  ].filter(Boolean).join("; ") + `: ${searches.reason ?? "no cause recorded"}` }, "the searches"]);
   let reopen = null;
   try { reopen = JSON.parse(readFileSync(driverDir(runDir, "frame-reopen.json"), "utf8")); } catch { reopen = null; }
   if (reopen?.dominant_element_gap === true && reopen?.domClosed !== true)

package/driver/engine/mcp/band-server.mjs

@@ -280,9 +280,9 @@ function bandShape(params) {
     ...(read ? { served_lines: read.keys[part - 1], group_parts: read.groupParts } : {}) });
   const head = format === "json"
     ? `[band_shape part ${part}/${total} of the json; concatenate the parts before parsing it.]`
-    : `[band_shape part ${part}/${total}. Read each group by the size sentence at its head; the next part continues the groups.]`;
+    : `[band_shape part ${part}/${total}. ${GROUP_PAGES ? "Read each group by the size sentence at its head; the next part continues the groups." : "The next part continues the groups."}]`;
   const tail = part < total
-    ? `\n[end of part ${part}/${total} — call band_shape again with {"part": ${part + 1}} for the next part]`
+    ? `\n[end of part ${part}/${total} — part ${part + 1} is available with {"part": ${part + 1}}]`
     : `\n[end of the shape]`;
   return head + "\n" + parts[part - 1] + tail;
 }
@@ -351,7 +351,7 @@ function groupLookup(params) {
   const body = () => JSON.stringify({
     group: g, lines_total: lines.length, returned: page.length, ...(offset ? { offset } : {}),
     ...(lines.length > offset + page.length ? { next_offset: offset + page.length,
-      note: `call again with offset: ${offset + page.length} for the next lines of group ${g}` } : {}),
+      note: `the next lines of group ${g} are available with offset: ${offset + page.length}` } : {}),
     lines: page.map(({ _key, ...l }) => l),
   }, null, 2);
   let out = body();
@@ -440,8 +440,8 @@ function bandLookup(params = {}) {
   const body = () => JSON.stringify({
     matched, returned: hits.length, ...(offset ? { offset } : {}),
     ...(matched > offset + hits.length ? { next_offset: offset + hits.length } : {}),
-    ...(matched > offset + hits.length ? { note: `capped at ${hits.length} — call again with offset: ${offset + hits.length} for the next page; the count above is the full match` } : {}),
-    ...(byteCapped ? { byte_cap_note: `${byteCapped} matched record(s) withheld to fit one tool response — call again with offset: ${offset + hits.length} for the rest` } : {}),
+    ...(matched > offset + hits.length ? { note: `capped at ${hits.length} — the next page is available with offset: ${offset + hits.length}; the count above is the full match` } : {}),
+    ...(byteCapped ? { byte_cap_note: `${byteCapped} matched record(s) withheld to fit one tool response — the rest are available with offset: ${offset + hits.length}` } : {}),
     records: hits,
     ...(crowds.length ? { matching_crowds: crowds, crowd_note: "these matching slices were NOT enumerated — records under them may exist that no lookup can return; weigh the descriptor, never treat this result as their clean"
       + (refusedCrowds ? ` — and ${refusedCrowds} of them was/were NEVER ANSWERED at all (see "refusal"): no count exists for those, so they are unsearched rather than empty, and nothing about them can be read off a zero` : "")
@@ -515,7 +515,7 @@ function bandRecord(params = {}) {
     logRead("band_record", { record_id: uri, part, parts: total }, { ok: true, bytes: parts[part - 1].length, total_bytes: text.length, ...resolution, ...served.audit });
     const head = `[band_record part ${part}/${total}. This record is served in ${total} parts; the next part continues it.]`;
     const tail = part < total
-      ? `\n[end of part ${part}/${total} — call band_record again with {"record_id": "${uri}", "part": ${part + 1}} for the next part]`
+      ? `\n[end of part ${part}/${total} — part ${part + 1} is available with {"record_id": "${uri}", "part": ${part + 1}}]`
       : `\n[end of the record]`;
     return head + "\n" + parts[part - 1] + tail;
   }
@@ -537,7 +537,7 @@ function bandRecord(params = {}) {
     const part = Number.isInteger(wanted) && wanted >= 1 && wanted <= parts.length ? wanted : 1;
     logRead("band_record", { record_id: uri }, { ok: true, bytes: text.length, via: "ledger", part, parts: parts.length, ...served.audit });
     return { type: "text", text: `[record ${uri} — part ${part}/${parts.length}]\n` + parts[part - 1]
-      + (part < parts.length ? `\n[end of part ${part}/${parts.length} — call band_record again with {"record_id": "${uri}", "part": ${part + 1}}]` : "") };
+      + (part < parts.length ? `\n[end of part ${part}/${parts.length} — part ${part + 1} is available with {"record_id": "${uri}", "part": ${part + 1}}]` : "") };
   }
 
   // A GENUINE miss — neither materialised NOR in this run's ledger. Now the sentence below is true.
@@ -581,7 +581,7 @@ function bandRecord(params = {}) {
     ...(parts.length > 1 ? { part, parts: parts.length } : {}), ...(failed ? { fetch_failed: true } : {}) });
   if (parts.length === 1) return { isError: true, text };
   return { isError: true, text: `[record ${uri} — part ${part}/${parts.length}]\n` + parts[part - 1]
-    + (part < parts.length ? `\n[end of part ${part}/${parts.length} — call band_record again with {"record_id": "${uri}", "part": ${part + 1}}]` : "") };
+    + (part < parts.length ? `\n[end of part ${part}/${parts.length} — part ${part + 1} is available with {"record_id": "${uri}", "part": ${part + 1}}]` : "") };
 }
 
 // The band row a record id names, from the band file, read once per server. null where the band holds none.
@@ -610,10 +610,10 @@ const GROUP_PAGES = process.env.CLEAROTRON_BAND_GROUPS === "1";
 // served the shape without them (the owner's ruling, 2026-10-14). Each is removed with the space before it, inside
 // its line, so no line moves and the line each listed mark is printed on, which `linesByPart` reads, still holds.
 // (band-shape.mjs `withoutPlacementOrders` removes them, with the shape's other placement-only orders and its group-page commands.)
-const LOOKUP_DESCRIPTION = "Look up enumerated records in this run's frozen register band (read-only; logged to the reading audit). Filters AND together: record_id (exact uri), owner (substring), nice_class, tier (identical|near-identical|same-family|other|unclassifiable — classified against the shape's frozen targets), qid (exact plan-entry id — the plan-execution ledger join; a record surfaced by several slices matches under EVERY one of them), query (the _query slice that surfaced the record), text (substring of mark_text), status (substring), live_only, goods (words: records whose goods contain any of them, as whole words, singular or plural; a record with no goods on file matches too), group (a, b, c, d, rest or no_goods: that list's lines in the shape's order, one per mark of an owner), limit (default 20, max 100), offset (default 0: where in the matching records or lines to start — a capped answer names the next offset, so a large band or group is read page by page). On each record served, `goods_words` gives the client's goods words its goods hold, as the shape tests them (k of N: the words), or null where its goods cannot be read; `goods_from` says what those goods rest on: official record; official record, cut by the register; official record, completeness not established; official record, no goods listed; search answer; search answer, cut by the register; search answer, completeness not established; fetch failed; or nothing held. The goods text is in band_record. Matching un-enumerated crowd descriptors ride along so a lookup can never mistake a counted-only zone for a clean.";
+const LOOKUP_DESCRIPTION = "Look up enumerated records in this run's frozen register band (read-only; logged to the reading audit). Filters AND together: record_id (exact uri), owner (substring), nice_class, tier (identical|near-identical|same-family|other|unclassifiable — classified against the shape's frozen targets), qid (exact plan-entry id — the plan-execution ledger join; a record surfaced by several slices matches under EVERY one of them), query (the _query slice that surfaced the record), text (substring of mark_text), status (substring), live_only, goods (words: records whose goods contain any of them, as whole words, singular or plural; a record with no goods on file matches too), group (a, b, c, d, rest or no_goods: that list's lines in the shape's order, one per mark of an owner), limit (default 20, max 100), offset (default 0: where in the matching records or lines to start — a capped answer names the offset where the next page starts). On each record served, `goods_words` gives the client's goods words its goods hold, as the shape tests them (k of N: the words), or null where its goods cannot be read; `goods_from` says what those goods rest on: official record; official record, cut by the register; official record, completeness not established; official record, no goods listed; search answer; search answer, cut by the register; search answer, completeness not established; fetch failed; or nothing held. The goods text is in band_record. Matching un-enumerated crowd descriptors ride along so a lookup can never mistake a counted-only zone for a clean.";
 const LOOKUP_GROUP_CLAUSE = "group (a, b, c, d, rest or no_goods: that list's lines in the shape's order, one per mark of an owner), ";
-const LOOKUP_OFFSET_GROUPS = "offset (default 0: where in the matching records or lines to start — a capped answer names the next offset, so a large band or group is read page by page)";
-const LOOKUP_OFFSET_BAND = "offset (default 0: where in the matching records to start — a capped answer names the next offset, so a large band is read page by page)";
+const LOOKUP_OFFSET_GROUPS = "offset (default 0: where in the matching records or lines to start — a capped answer names the offset where the next page starts)";
+const LOOKUP_OFFSET_BAND = "offset (default 0: where in the matching records to start — a capped answer names the offset where the next page starts)";
 /** The lookup's description as a stage is offered it: whole where it reads the groups, without them elsewhere. PURE. */
 const lookupDescription = (groupPages) => (groupPages ? LOOKUP_DESCRIPTION
   : LOOKUP_DESCRIPTION.replace(LOOKUP_GROUP_CLAUSE, "").replace(LOOKUP_OFFSET_GROUPS, LOOKUP_OFFSET_BAND));
@@ -623,7 +623,7 @@ serve({
   tools: [
     {
       name: "band_shape",
-      description: "The deterministic shape of this run's merged register band: totals, mechanical tiers, the floors (every live in-class identical/near-identical record), each marked on its line in the band in the lawyer's order, class/status/registry/recency census, owner concentrations, crowd descriptors (with crowd-context joins) and blind spots. Read this FIRST, then pull what it names via band_lookup/band_record. A large shape is served in parts, each naming the next call. Every call is logged to the run's reading audit.",
+      description: "The deterministic shape of this run's merged register band: totals, mechanical tiers, the floors (every live in-class identical/near-identical record), each marked on its line in the band in the lawyer's order, class/status/registry/recency census, owner concentrations, crowd descriptors (with crowd-context joins) and blind spots. What it names can be looked up with band_lookup and band_record. A large shape is served in parts, and the end of each part names the next one. Every call is logged to the run's reading audit.",
       inputSchema: { type: "object", properties: { format: { type: "string", enum: ["md", "json"], description: "md (default, readable) or json (machine shape)" }, part: { type: "number", description: "1-based part number when the shape is served in parts (default 1)" } } },
       annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
       handler: bandShape,

package/driver/engine/mcp/clarivate-server.mjs

@@ -29,6 +29,7 @@
 // `match_mode: "phonetic"` on register_search / register_enumerate remains fully available; it is the
 // PREVIEW of the expansion that this provider cannot give, not phonetic search itself.
 import { serve } from "./stdio-server.mjs";
+import { sendUntilFromEnv } from "../../../providers/_shared/send-until.mjs";
 import { crowdNoteFor } from "./crowd-note.mjs";   // how the unit decides on a crowd, beside an answer that carries one
 import {
   CAPABILITIES, doSearch, doRecordFetch, doImageFetch, doBatchScreen, doEnumerate, doExecutePlan, DEFAULT_BASE,
@@ -43,6 +44,7 @@ const tctx = (kind) => ({
   agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",   // run session key — telemetry attribution
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
+  sendUntilMs: sendUntilFromEnv(),   // this turn's time to stop sending (providers/_shared/send-until.mjs)
 });
 const passthrough = (r) => (r && typeof r === "object" ? (r.text ?? JSON.stringify(r)) : String(r));
 const guard = (fn) => async (args) => {

package/driver/engine/mcp/codex-config.mjs

@@ -275,10 +275,15 @@ export function featuresToml(withheld = []) {
 // codex's `workspace-write` sandbox confines where a command WRITES and lets it read the whole disk, the
 // install's settings files and the program's own sign-in included. A permission profile confines reading
 // too (the vendor's Permissions guide, a beta feature since 0.138.0; the floor was 0.154.0 when this was written and is 0.159.0 now, for the judgment tier's model — driver.config.mjs): a stage's
-// commands read the platform's own paths, the instruction trees and the temp folders, and write the run
-// folder, their working folder and the temp folders. Nothing else is readable, so a page a stage fetched
-// cannot get a command to print the account's files. The temp folders stay writable because
-// `workspace-write` let commands use them and stages write their output through the shell.
+// commands read the platform's own paths and the instruction trees, and write the run folder, their
+// working folder and their Codex home's working folder. Nothing else is readable, so a page a stage
+// fetched cannot get a command to print the account's files.
+//
+// NO SHARED TEMP FOLDER. The profile granted `:tmpdir` and `:slash_tmp`, which every stage of every run on
+// the machine shares, and a later run's commands read what an earlier run left in `/tmp` (measured on codex
+// 0.162.0 with that profile: a command read a file planted in `/tmp` and wrote another beside it). The
+// turn's TMPDIR, TMP and TEMP now name its home's working folder (openai-agent.mjs, `withWorkFolder`), and
+// this grants that folder, named, in their place.
 //
 // ONLY WITH THE SANDBOX ON. Under the bypass codex builds no sandbox, so a profile would enforce nothing;
 // the caller passes no `fence` then, and the file stays what it was. With the sandbox on the command line
@@ -297,10 +302,10 @@ export function featuresToml(withheld = []) {
 // wins over the run folder's: measured on codex 0.162.0 with this profile, a write into the run folder
 // succeeded, a read of `_driver/` succeeded, and a write or an append there was refused.
 export const FENCE_PROFILE = "clearotron-stage";
-export function fenceToml({ runDir = null, readRoots = [] } = {}) {
+export function fenceToml({ runDir = null, workDir = null, readRoots = [] } = {}) {
   const key = (p) => tomlString(p);
-  const out = [`[permissions.${FENCE_PROFILE}.filesystem]`,
-    `":minimal" = "read"`, `":tmpdir" = "write"`, `":slash_tmp" = "write"`];
+  const out = [`[permissions.${FENCE_PROFILE}.filesystem]`, `":minimal" = "read"`];
+  if (workDir) out.push(`${key(workDir)} = "write"`);
   for (const r of [...new Set(readRoots.filter(Boolean))]) out.push(`${key(r)} = "read"`);
   if (runDir) out.push(`${key(runDir)} = "write"`, `${key(driverDir(runDir))} = "read"`);
   out.push("", `[permissions.${FENCE_PROFILE}.filesystem.":workspace_roots"]`, `"." = "write"`, "");

package/driver/engine/mcp/corsearch-server.mjs

@@ -7,6 +7,7 @@
 // session key (tctx.sessionKey) — we thread the run's session key via CLEAROTRON_GATHER_SESSION_KEY so the
 // $0 provider-usage diff still attributes calls to the run.
 import { serve } from "./stdio-server.mjs";
+import { sendUntilFromEnv } from "../../../providers/_shared/send-until.mjs";
 import { crowdNoteFor } from "./crowd-note.mjs";   // how the unit decides on a crowd, beside an answer that carries one
 import { CAPABILITIES, doSearch, doRecordFetch, doImageFetch, doExpandPhoneme, doBatchScreen, doEnumerate, doExecutePlan } from "../../../providers/corsearch/src/core.js";
 import { proposeSupplemental } from "./supplemental.mjs";
@@ -18,6 +19,7 @@ const tctx = (kind) => ({
   agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",   // run session key — telemetry attribution
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
+  sendUntilMs: sendUntilFromEnv(),   // this turn's time to stop sending (providers/_shared/send-until.mjs)
 });
 const passthrough = (r) => (r && typeof r === "object" ? (r.text ?? JSON.stringify(r)) : String(r));
 const guard = (fn) => async (args) => {

package/driver/engine/mcp/declination-server.mjs

@@ -83,12 +83,11 @@ serve({
     description:
       "Record, per position or page, your decision NOT to deliver something that reached your findings surface. " +
       "Every position the digest carried to you, and every page the web notes marked as a candidate or conflict, " +
-      "either becomes a finding " +
-      "or carries a stated reason it did not — there is no third way out, and one left silent is reported as " +
-      "a defect of this run. One call carries a batch; the answer tells you what was accepted, " +
+      "ends as a finding or as a declination with its reason. One left with neither is reported as a defect " +
+      "of this run. One call carries a batch; the answer tells you what was accepted, " +
       "what was refused and why, and WHICH ROWS STILL CARRY NO DECISION, so you can finish inside this " +
-      "turn. A refusal is about bookkeeping, never about your legal judgment: a reason is refused only " +
-      "where it contradicts a fact the job recorded before this run started.",
+      "turn. A refusal is about the record's facts, never your legal judgment: a reason is refused only when it " +
+      "contradicts the matter's instructions or the record's mark, status, classes or goods as the run holds them.",
     inputSchema: { type: "object", required: ["declinations"], properties: {
       declinations: {
         type: "array",