clearotron 0.5.0-beta.2 → 0.5.0-beta.4

package/driver/placement-decisions.mjs

@@ -13,9 +13,9 @@
 import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 import { createHash } from "node:crypto";
-import { buildSelectionIndex, setAsideGrounds, isSetAsideGroupRow, lineKey, groupName, servedLines } from "./placement-form.mjs";
+import { buildSelectionIndex, setAsideGrounds, isSetAsideGroupRow, lineKey, groupName, servedLines, FLOOR_GROUND_ON } from "./placement-form.mjs";
 import { unionPlacementForm } from "./placement-union.mjs";
-import { readPlacementForm, readPlacementFormInput } from "./placement-form-io.mjs";
+import { readPlacementForm, readPlacementFormInput, placementFormStamp, placementFormPaths } from "./placement-form-io.mjs";
 import { parsePlacementsJson } from "./placement-model.mjs";
 
 const safeReadJson = (p) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return null; } };
@@ -78,7 +78,7 @@ export function placementSetAsideGrounds(P) {   // @internal — driven by its t
 
 /**
  * THE FLOORS PLACEMENT SET ASIDE, AS THE REVIEW IS TOLD THEM: one line per standing decision on the shape now on disk,
- * with placement's ground once. A set-aside by name, on its status or its territory, covers one floor and names it. A
+ * with placement's ground once. A set-aside by name, on its status, territory, goods or mark, covers one floor and names it. A
  * crowd's row names its ground once and then every floor it covers, by record: the ground is the group's, so it was
  * never the floors' to repeat, and on a test run of a crowded matter repeating it on each of 1,177 floors made the
  * review's opening message 866 KB of its 899. Only decisions that stand on the current shape are listed
@@ -99,7 +99,7 @@ export function placementFloorDecisionLines(P) {   // @internal — driven by it
         const key = `${g.group}\u0000${g.ground}`;
         if (!rows.has(key)) { rows.set(key, { group: g.group, ground: g.ground, ids: [] }); out.push(rows.get(key)); }
         rows.get(key).ids.push(f.record_id);
-      } else if (g.on === "status" || g.on === "territory") {
+      } else if (FLOOR_GROUND_ON.includes(g.on)) {
         out.push(`- ${f.mark_text ?? "(unnamed)"}${f.owner_name ? ` — ${f.owner_name}` : ""} (${f.record_id}): set aside on its ${g.on}: ${g.ground}`);
       }
     }
@@ -118,9 +118,20 @@ export function placementFloorDecisionLines(P) {   // @internal — driven by it
  * enough for a stage to open. [] when nothing stands or nothing can be read. IMPURE (reads the run).
  */
 export function standingPlacementDecisions(P) {   // @internal — driven by its test with a run's own files
+  // A FORM THAT IS NOT THERE IS NOT "NOTHING SET ASIDE". Every failure here used to read as an empty list, so a writer in
+  // the experiment sandbox, which held no form, was told of no set-aside at all on a run whose placement had set 178
+  // aside. Where this run's placement records its decisions on a form (the era stamp), a missing or unreadable form is
+  // refused by name, and so is a failure reading what stands. A run from before the form had none, and its empty list
+  // is true.
+  const form = readPlacementForm(P.runDir);
+  if (form.error) throw new Error(`placement_form_unreadable: ${form.error} — placement's set-asides cannot be read, and an unread form is not "none set aside"`);
+  if (!form.present) {
+    if (placementFormStamp(P.runDir).required)
+      throw new Error(`placement_form_missing: this run's placement records its decisions on a form, and ${placementFormPaths(P.runDir).sidecar} is not there — refusing to read its absence as "none set aside"`);
+    return [];
+  }
+  if (!form.set_aside?.length) return [];
   try {
-    const form = readPlacementForm(P.runDir);
-    if (!form.set_aside?.length) return [];
     const input = readPlacementFormInput(P.runDir);
     const index = buildSelectionIndex(input);
     return standingSetAside(form.set_aside, input, { placedUris: placedUriRows(P).map((r) => r.uri), rows: form.rows }).flatMap((e) => {
@@ -130,9 +141,9 @@ export function standingPlacementDecisions(P) {   // @internal — driven by its
         covered_lines_hash: createHash("sha256").update((e.covered_lines ?? []).join("\n")).digest("hex").slice(0, 16) }];
       const c = index.resolve(e.set_aside);
       return [{ kind: "name", record: e.set_aside, mark: c?.mark ?? null, owner: c?.owner ?? null, ground: e.ground,
-        ...(e.on === "status" || e.on === "territory" ? { on: e.on } : {}) }];
+        ...(FLOOR_GROUND_ON.includes(e.on) ? { on: e.on } : {}) }];
     });
-  } catch { return []; }
+  } catch (e) { throw new Error(`placement_decisions_unreadable: ${String(e?.message ?? e).slice(0, 200)} — what placement set aside could not be worked out from its form`); }
 }
 
 /**
@@ -144,7 +155,11 @@ export function rankingNow(P) {   // @internal — driven by its test with a run
   const records = new Map();
   for (const r of placedUriRows(P)) records.set(String(r.uri).toLowerCase(), `placed:${r.tier ?? ""}`);
   const groups = new Map();
-  for (const d of standingPlacementDecisions(P)) {
+  // The re-rank count runs inside the delivery loop, and a run always delivers: here a refusal counts no decision, and
+  // the writer's own message, which reads the same decisions, is where it is refused.
+  let decisions = [];
+  try { decisions = standingPlacementDecisions(P); } catch { decisions = []; }
+  for (const d of decisions) {
     if (d.kind === "group") groups.set(d.group, { key: `${d.ground}|${d.covers_lines}|${d.covered_lines_hash}`, records: d.records });
     else records.set(String(d.record).toLowerCase(), `set aside${d.on ? ` on its ${d.on}` : ""}: ${d.ground}`);
   }

package/driver/placement-form-io.mjs

@@ -25,6 +25,7 @@ import { join, dirname, basename } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
 import { PLACEMENT_FORM_NAME, placementFormSidecarName, parsePlacementForm, renderPlacementsJson } from "./placement-form.mjs";
 import { parsePlacementsJson } from "./placement-model.mjs";
+import { normalizeRecordUri } from "./registry-fidelity.mjs";
 import { atomicWrite } from "./progress.mjs";
 
 export { PLACEMENT_FORM_NAME };
@@ -54,13 +55,32 @@ export function placementFormStamp(runDir) {
 export function readPlacementFormInput(runDir) {
   const shape = readJson(driverDir(runDir, "band-shape.json"));
   const pos = readJson(driverDir(runDir, "register-positions.json"));
-  return {
+  const scope = readJson(driverDir(runDir, "instructed-scope.json"));
+  const input = {
     floors: Array.isArray(shape?.floors?.in_class_identical_or_near) ? shape.floors.in_class_identical_or_near : null,
     positions: Array.isArray(pos?.positions) ? pos.positions : null,
     // The shape's groups, which a group row names and is checked against; null on a shape that has none.
     groups: shape?.groups && typeof shape.groups === "object" ? shape.groups : null,
     served: readServed(runDir),
+    // The applied-for marks, written by the job before any model ran: a ground on a floor's mark is refused on the
+    // client's own mark. A scope that names one mark as a string names it all the same.
+    marks: Array.isArray(scope?.marks) ? scope.marks : (typeof scope?.marks === "string" && scope.marks ? [scope.marks] : []),
   };
+  // What each record's goods rest on (goods-evidence.mjs), which a ground on a floor's goods is checked against. Read
+  // only when a ground needs it: the record runs to megabytes and the form is judged on every pass. null where the
+  // run wrote none, which establishes no goods.
+  let evidence;
+  Object.defineProperty(input, "evidence", { enumerable: false, get: () => (evidence === undefined ? (evidence = readGoodsStates(runDir)) : evidence) });
+  return input;
+}
+
+/** canonical uri → the state goods-evidence.mjs recorded for that record's goods; null with no record. */
+export function readGoodsStates(runDir) {
+  const doc = readJson(driverDir(runDir, "goods-evidence.json"));
+  if (!Array.isArray(doc?.records)) return null;
+  const out = new Map();
+  for (const r of doc.records) { const k = normalizeRecordUri(r?.uri); if (k && typeof r?.state === "string") out.set(k, r.state); }
+  return out;
 }
 
 /**

package/driver/placement-form.mjs

@@ -112,11 +112,15 @@ export const SELECT_ROW_CONTRACT = Object.freeze({
 // (ruled 2026-10-12). It is not a candidate, it renders into no placement, and nothing bounds how many there are.
 export const SET_ASIDE_ROW_FIELDS = ["set_aside", "ground", "on"];
 /**
- * What a ground setting a floor aside by name may be about (ruled 2026-10-12): its status or its territory.
- * Never its goods, which decide whether it sits in (a) or (b), and in a crowd (b)'s row is the goods ground;
- * never its owner's customers or field, whatever `on` says, so the form reads the ground's words too.
+ * What a ground setting a floor aside by name may be about: its status, its territory, its registered goods or a
+ * reasoned comparison of its mark with the client's (ruled 2026-10-27, superseding the status-or-territory rule of
+ * 2026-10-12). Never its owner's customers or field. The union checks each against the run's own evidence: a goods
+ * ground needs the line read and every floor's goods held complete, and a mark ground is refused on the client's
+ * own mark. The words of a ground on status or territory are read too, for customers, field and goods.
  */
-export const FLOOR_GROUND_ON = Object.freeze(["status", "territory"]);
+export const FLOOR_GROUND_ON = Object.freeze(["status", "territory", "goods", "mark"]);
+/** The grounds whose words the form reads for customers, field and goods: the two that are about neither. */
+export const FLOOR_GROUND_WORDS_READ = Object.freeze(["status", "territory"]);
 export const FLOOR_GROUND_REFUSED = /\b(?:customers?|consumers?|clients|clientele|users?|audiences?|buyers?|purchasers?|patients?|professionals?|channels?|markets?|marketplaces?|sectors?|fields?|industr(?:y|ies|ial)|business(?:es)?|activit(?:y|ies)|commerce|commercial|trad(?:e|es|ing)(?!\s*-?\s*marks?)|distribution|wholesale|retail(?:ers?)?|sells?|sold|selling|b2b|b2c|off[- ]field|goods|products?|services?(?!\s*-?\s*marks?)|merchandise)\b/i;
 /** The lists a group row may name: the shape's groups, the rest, and the lines the goods test could not place. */
 export const ROW_GROUPS = Object.freeze([...BAND_GROUPS, "no_goods"]);
@@ -124,24 +128,30 @@ export const SET_ASIDE_ROW_CONTRACT = Object.freeze({
   when: "a line the shape lists, one mark of one owner, whose records you do not carry. One row gives that "
     + "line its ground.",
   fields: SET_ASIDE_ROW_FIELDS,
-  set_aside: "one record id of that line, from the band. The driver finds the line on the register's own "
-    + "projection; the ground covers every record of that mark of that owner the form does not place, and "
-    + "never another mark of the owner, which needs its own fate. A record that names no owner stands for its "
-    + "own position only.",
+  set_aside: "One record id of the line, from the band, or a list of record ids, one per line, that share one ground. "
+    + "The ground covers every unplaced record of that mark of that owner. Another mark of the same owner needs its "
+    + "own fate. A record that names no owner stands for its own position only.",
   ground: "why this line's records are not carried, in a lawyer's words.",
-  on: "where the line holds a floor, a live identical or near-identical mark in an ordered class: what the "
-    + "ground is about, status or territory. A floor is never set aside on its goods, which decide its group, "
-    + "nor on its owner, its customers or its field; a ground in those terms is refused.",
+  on: "Required when the line holds a floor (a live identical or near-identical mark in an ordered class): one of "
+    + "status, territory, goods, mark. Use goods when the registered goods, read in full, do not meet the client's "
+    + "particular goods. Use mark when a reasoned comparison with the client's mark shows the two do not conflict. "
+    + "The owner, its customers and its field are never a ground.",
   not_a_candidate: "It places nothing. A record of the same line you do place stays placed.",
   latest: "A later row for the same line replaces the earlier ground. To remove one, hand back "
     + "{\"retract\":\"<its set_aside id>\"}.",
-  unresolved: "A `set_aside` the band does not hold, one with no ground, or a floor's row whose `on` is not "
-    + "status or territory or whose ground speaks of customers, channels, markets or field, is reported back "
-    + "to you by id.",
+  unresolved: "The driver says a row back by id when: its record is not in the band; it has no ground; a floor's "
+    + "`on` is missing or not one of the four; a status or territory ground speaks of goods, customers, channels, "
+    + "markets or field; a goods ground rests on a line not read, or on goods the run does not hold in full; a mark "
+    + "ground names the client's own mark, or the run holds no applied-for mark to compare with. In a list, each "
+    + "line is judged on its own.",
 });
 
+/** The record ids a set-aside row names: one, or the list of lines one ground covers. PURE. */
+export const setAsideMembers = (row) => (Array.isArray(row?.set_aside) ? row.set_aside : [row?.set_aside])
+  .filter((id) => typeof id === "string" && id.trim() !== "").map((id) => id.trim());
+
 /** Is this submitted row an owner's set-aside? PURE. */
-export const isSetAsideRow = (row) => typeof row?.set_aside === "string" && row.set_aside.trim() !== "";
+export const isSetAsideRow = (row) => setAsideMembers(row).length > 0;
 
 // ONE ROW PER GROUP. The band shape lists the band in the lawyer's order, one line per mark of an owner,
 // the rest last. A listed line gets a fate, not a row: it is placed, or set aside by name, or covered

package/driver/placement-union.mjs

@@ -27,9 +27,11 @@ import { buildSelectionIndex, selectionOf, rowIsSettled, seatFields, formRowKey,
   SEAT_ROW_CONTRACT, SELECT_ROW_CONTRACT, PLACEMENT_FORM_PROVENANCE,
   SET_ASIDE_ROW_CONTRACT, isSetAsideRow,
   SET_ASIDE_GROUP_CONTRACT, isSetAsideGroupRow, groupName, groupOfKeys, namedKey, lineKey, servedLines,
-  groupRowCoversFloors, groupRowCoversFloorLine, FLOOR_GROUND_ON, FLOOR_GROUND_REFUSED, ROW_GROUPS, renderPlacementsJson, setAsideGrounds } from "./placement-form.mjs";
+  groupRowCoversFloors, groupRowCoversFloorLine, FLOOR_GROUND_ON, FLOOR_GROUND_WORDS_READ, FLOOR_GROUND_REFUSED, ROW_GROUPS, renderPlacementsJson,
+  setAsideGrounds, setAsideMembers } from "./placement-form.mjs";
 import { groupPageCall } from "./band-shape.mjs";
 import { normalizeRecordUri } from "./registry-fidelity.mjs";
+import { formKey } from "../providers/_shared/script-form.mjs";   // — the one fold for "is this the same form of the mark"
 import { reconcileFloorDuty } from "./floor-duty.mjs";
 
 /** Why a `select` the fold does not hold is refused, said back with it. */
@@ -162,8 +164,8 @@ export function unionPlacementForm(prior, submitted, input, { covered = false }
   // placements.json. Prior first, so a later row for the same owner replaces the earlier ground, and a
   // retraction names the record id the row set aside. A row the band cannot resolve, or one with no
   // ground, is reported back by id, never dropped in silence.
-  // A ground by name covers the named line only. On a line holding a floor it is about the mark, its goods,
-  // its status or its territory, and says which in `on`; a ground about the owner never sets a floor aside.
+  // A ground by name covers the named line only. On a line holding a floor it is about its status, its territory,
+  // its registered goods or its mark, and says which in `on`; a ground about the owner never sets a floor aside.
   const groups = input?.groups ?? null;
   const floorUris = new Set((Array.isArray(input?.floors) ? input.floors : []).map((f) => normalizeRecordUri(f?.record_id) || String(f?.record_id ?? "")).filter(Boolean));
   const holdsFloor = (canonical) => (canonical?.records ?? []).some((u) => floorUris.has(normalizeRecordUri(u) || String(u ?? "")));
@@ -174,10 +176,52 @@ export function unionPlacementForm(prior, submitted, input, { covered = false }
     ...["a", "b", "c", "d", "no_goods"].flatMap((g) => (Array.isArray(groups?.[g]?.list) ? groups[g].list : []).filter((l) => l?.floors > 0).map((l) => l.key)),
   ]);
   const lineHoldsFloor = (canonical) => holdsFloor(canonical) || floorLines.has(namedKey(canonical));
+  // THE FLOORS OF EACH LINE, which a ground on a floor's goods or mark is checked against record by record.
+  const floorsOfLine = new Map();
+  for (const f of (Array.isArray(input?.floors) ? input.floors : [])) {
+    const u = normalizeRecordUri(f?.record_id) || String(f?.record_id ?? "");
+    const k = u ? namedKey(index.resolve(u)) : null;
+    if (k) floorsOfLine.set(k, [...(floorsOfLine.get(k) ?? []), { uri: u, mark: f?.mark_text ?? null }]);
+  }
+  // The records a ground on a line's goods or mark must hold for: the line's floors and the records of the position
+  // the row names, so a line the projection keys apart from its floors is still checked on the records it names.
+  const checkedRecords = (canonical) => {
+    const byUri = new Map((floorsOfLine.get(namedKey(canonical)) ?? []).map((f) => [f.uri, f]));
+    for (const u of canonical?.records ?? []) { const k = normalizeRecordUri(u) || String(u ?? ""); if (k && !byUri.has(k)) byUri.set(k, { uri: k, mark: canonical?.mark ?? null }); }
+    return [...byUri.values()];
+  };
+  const servedSet = servedLines(groups, input?.served, index);
+  const clientMarks = new Set((Array.isArray(input?.marks) ? input.marks : []).map((m) => formKey(String(m ?? ""))).filter(Boolean));
+  // WHY A GROUND ON A FLOOR'S GOODS OR MARK DOES NOT HOLD, or "" where it does (ruled 2026-10-27). Identical spelling
+  // and a shared class no longer bar the judgment; what bars it is the evidence. A goods ground stands on a line the
+  // step read and on goods the run holds complete for every floor of it: cut, unknown or missing goods establish
+  // nothing. A mark ground is a comparison with the client's mark, so it cannot set aside the client's mark itself.
+  const evidenceProblem = (on, canonical) => {
+    const records = checkedRecords(canonical);
+    if (on === "goods") {
+      if (!servedSet.has(namedKey(canonical)))
+        return "this line has not been read. Read it in band_shape or its group's page, or open its record with band_record, before you set it aside on its goods";
+      const states = input?.evidence instanceof Map ? input.evidence : null;
+      if (!states) return "the run has no record of this line's goods, so a goods ground cannot be checked. Place the line, or set it aside on its status, territory or mark";
+      const short = records.filter((r) => states.get(r.uri) !== "complete");
+      if (short.length)
+        return `the run does not hold the goods of ${short.slice(0, 3).map((r) => `${r.uri} (${states.get(r.uri) ?? "not recorded"})`).join(", ")}${short.length > 3 ? `, and ${short.length - 3} more` : ""} in full, so a goods ground cannot stand. Place the line, or set it aside on its status, territory or mark`;
+    }
+    if (on === "mark") {
+      if (!clientMarks.size) return "the run has no applied-for mark to compare with. Place the line, or set it aside on its status, territory or goods";
+      const own = records.find((r) => clientMarks.has(formKey(String(r.mark ?? ""))));
+      if (own) return `${own.uri} carries the client's own mark, so a mark ground cannot set it aside. Place the line, or set it aside on its status, territory or goods`;
+    }
+    return "";
+  };
   const setAside = new Map();
   const setAsideRefused = [];
   const takeSetAside = (row) => {
-    const id = String(row.set_aside).trim();
+    // A LIST UNDER ONE GROUND is taken line by line: each member stands or is reported back on its own evidence, so a
+    // shared ground covers only the lines it holds for, and the exceptions are said back by id.
+    const members = setAsideMembers(row);
+    if (members.length > 1) { for (const m of members) takeSetAside({ ...row, set_aside: m }); return; }
+    const id = members[0];
     const ground = typeof row.ground === "string" ? row.ground.trim() : "";
     const canonical = index.resolve(id);
     const refuse = (why) => { if (!setAsideRefused.some((x) => x.set_aside === id && x.why === why)) setAsideRefused.push({ set_aside: id, why }); };
@@ -185,8 +229,10 @@ export function unionPlacementForm(prior, submitted, input, { covered = false }
     if (!ground) { refuse("no ground"); return; }
     const on = typeof row.on === "string" ? row.on.trim().toLowerCase() : "";
     if (lineHoldsFloor(canonical)) {
-      if (!FLOOR_GROUND_ON.includes(on)) { refuse(`a floor is set aside by name only on its status or its territory: give "on" as one of ${FLOOR_GROUND_ON.join(", ")}`); return; }
-      if (FLOOR_GROUND_REFUSED.test(ground)) { refuse("a floor is never set aside on its owner's customers, channels, markets or field: write a ground about its status or its territory"); return; }
+      if (!FLOOR_GROUND_ON.includes(on)) { refuse(`a floor's set-aside needs "on": one of ${FLOOR_GROUND_ON.join(", ")}`); return; }
+      if (FLOOR_GROUND_WORDS_READ.includes(on) && FLOOR_GROUND_REFUSED.test(ground)) { refuse(`a ${on} ground is about the ${on} only, and this one speaks of goods, customers, channels, markets or field. Rewrite it about the ${on}, or send a ground about the registered goods with "on": "goods"`); return; }
+      const problem = evidenceProblem(on, canonical);
+      if (problem) { refuse(problem); return; }
     }
     const key = namedKey(canonical);
     setAside.delete(key);
@@ -217,7 +263,6 @@ export function unionPlacementForm(prior, submitted, input, { covered = false }
   // does not list, a count that is not the shape's, or a row with no ground is reported back, never dropped.
   const setAsideGroups = new Map();
   const groupRefused = [];
-  const servedSet = servedLines(groups, input?.served, index);
   const takeGroup = (row) => {
     const written = String(row.set_aside_group).trim();
     const refuse = (why) => { if (!groupRefused.some((x) => x.set_aside_group === written && x.why === why)) groupRefused.push({ set_aside_group: written, why }); };
@@ -289,7 +334,7 @@ export function unionPlacementForm(prior, submitted, input, { covered = false }
     // AN IDENTICAL MARK LIVE IN AN ORDERED OR FRAME-ADDED CLASS IS NEVER OUT-OF-SCOPE-FILTERED. The tier is
     // refused, said back, and the row left open, so the floor duty still owes it a fate.
     if (row.tier === "out-of-scope-filtered" && holdsFloor(row)) {
-      tierRefused.push({ select: row.select ?? null, why: "an identical mark live in an ordered or frame-added class is never out-of-scope-filtered: place it, sheet-2 at the least, or set it aside by name on its status or its territory" });
+      tierRefused.push({ select: row.select ?? null, why: "a floor never takes out-of-scope-filtered. Place it at headline-candidate or sheet-2, or set its line aside by name" });
       row.tier = null;
     }
     // JUDGED ON THE MERGED ROW, not on either input — a tier written on one pass and its reason on the

package/driver/predelivery-lint.mjs

@@ -1256,11 +1256,18 @@ export function correctionConsistencyChecks({ reportMd, clientSummaryMd, auditMd
   const report = String(reportMd ?? "");
   const cs = String(clientSummaryMd ?? "");
   const audit = String(auditMd ?? "");
+  // A CARD THAT CARRIES ITS OWN `- ord:` LINE IS THE FINDING THAT LINE NAMES. One owner can hold the same mark in
+  // several records, each its own finding, and a live one keeps its card under the same head when another is
+  // withdrawn: read by its head, it was the withdrawn finding back, and that one false failure closed the client
+  // export of a crowded test run (2026-10-28). The ord line already answers for such a card, so the head match is
+  // for a card with none, the older card shape.
+  const unnumberedHeads = [...report.matchAll(/^##\s+([^\n]+)\n?((?:- [^\n]*\n?)*)/gm)]
+    .filter(([, , meta]) => !/^-\s*ord:/m.test(meta)).map(([, h]) => h);
   for (const f of withdrawn) {
     const ord = f.ordinal;
     const markN = norm(f.mark), ownerN = norm(f.owner?.name);
     const ordHit = ord != null && new RegExp(`^-\\s*ord:\\s*${ord}\\s*$`, "m").test(report);
-    const headHit = [...report.matchAll(/^##\s+([^\n]+)$/gm)].some(([, h]) => {
+    const headHit = unnumberedHeads.some((h) => {
       const hN = norm(h);
       return markN && ownerN && hN.includes(markN) && hN.includes(ownerN);
     });

package/driver/publish/index.mjs

@@ -1823,15 +1823,19 @@ export function composeEmailHtml(reportMdPath, url, auditFile, names = [], deliv
   // doc-52 — the cover banner speaks the SAME plain "Only you can close these" wording as the report, never
   // the engine clamp reasons (opts.conditions = verdict.json reasons). Machinery-only clamps (no client
   // item authored) degrade to one generic plain line — never raw engine jargon, never truncated mid-sentence.
-  const emailConditions = opts?.verdict === 'CONDITIONAL' ? actYouConditions(parseActionBuckets(secs['Actions']).you) : [];
+  // A BLOCKING RESULT KEEPS THE REPORT'S ITEMS TOO (ruled 2026-10-27). The box showed only on a CONDITIONAL result, so
+  // a blocking one lost the client's own actions the report lists. It shows them under the report's heading in the
+  // report's words, and only where the report names any: no empty box, no fallback line.
+  const emailConditions = opts?.verdict === 'CONDITIONAL' || opts?.verdict === 'BLOCKING' ? actYouConditions(parseActionBuckets(secs['Actions']).you) : [];
   // THE REPORT IS THE MASTER (ruled 2026-09-22). The banner used to print a second summary composed
   // beside the report — "On hold — …" on a run the report called conditional, although nothing is ever
   // held — and before that the delivery gate's word. It now quotes the report: the rating, then the
   // report's own conclusion (below), and where the report names what only the client can close, those
   // items under the report's own heading. Nothing here composes a sentence of its own.
+  const closeBox = (items) => `<p style="margin:0 0 8px;padding:8px 10px;background:#fdeeee;border:1px solid #c98a86;color:#6e1512"><b>Only you can close these</b><br>${items.map((r) => `• ${cell(String(r))}`).join('<br>')}</p>`;
   const verdictBound = opts?.verdict === 'CONDITIONAL'
-    ? `<p style="margin:0 0 8px;padding:8px 10px;background:#fdeeee;border:1px solid #c98a86;color:#6e1512"><b>Only you can close these</b><br>${(emailConditions.length ? emailConditions : ['the open items set out in the report, before relying on a clean result']).map((r) => `• ${cell(String(r))}`).join('<br>')}</p>`
-    : '';
+    ? closeBox(emailConditions.length ? emailConditions : ['the open items set out in the report, before relying on a clean result'])
+    : opts?.verdict === 'BLOCKING' && emailConditions.length ? closeBox(emailConditions) : '';
 
   const reviewHeadline = `<div style="${FONT};font-size:11pt;color:#1a1a2e;margin:0 0 14px">`
     + flagBanner

package/driver/register-digest-record.mjs

@@ -146,13 +146,16 @@ export function accountedUris(model, owed = []) {
  * THE SHEET-2 ROWS THE DRIVER WRITES. A sheet-2 entry is adopted as placement placed it: one row, on the entry's first
  * live record (else its first), carrying placement's reason word for word, with verify "yes" because nothing has checked
  * it against the live register. An entry the write-up overrode gets none: any row of its own naming any of the entry's
- * records, or a disagreement resolution naming one, is its ending instead. An entry whose record the band does not
- * hold gets none. PURE.
+ * records, or an OVERRODE resolution naming one, is its ending instead. An ADOPTED resolution keeps placement's
+ * placement, so the entry keeps its row: counting it as an ending rendered an adoption exactly as an override, and
+ * kept entries vanished from the table the writer is owed from. An entry whose record the band does not hold gets
+ * none. PURE.
  */
 export function adoptedRows(model, facts = emptyFacts()) {
   const adopt = Array.isArray(facts?.adopt) ? facts.adopt : [];
   if (!adopt.length) return [];
-  const named = accountedUris(model, adopt.flatMap((e) => e.uris));
+  const overrides = { ...model, disagreement_resolutions: (model?.disagreement_resolutions ?? []).filter((d) => d?.decision !== "ADOPTED") };
+  const named = accountedUris(overrides, adopt.flatMap((e) => e.uris));
   const out = [];
   for (const e of adopt) {
     if (e.uris.some((u) => named.has(u))) continue;

package/driver/research-answers.mjs

@@ -25,7 +25,7 @@
 // A first attempt has none, and its message is unchanged.
 //
 // A pure leaf: node:fs, node:path and shared/driver-dir.mjs only, so the research server can import it.
-import { appendFileSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";
 
@@ -51,9 +51,13 @@ export function keepResearchAnswer(runDir, { session = null, agent = null, task,
 /**
  * The research answers the session `sessionKey` and its retries got, oldest first, one per question: the latest answer
  * to each exact question. [] when there are none, or no record. A torn line is skipped. IMPURE (reads the record).
+ *
+ * `ofRun` widens it to every stage of this run: the writer is told to use an answer this run already holds, from an
+ * earlier stage as from an earlier attempt, and it cannot open `_driver/` itself. The record is the run's own file, so
+ * nothing another run asked can be in it.
  * @returns {{ task: string, text: string, ts: string }[]}
  */
-export function researchAnswersFor(runDir, sessionKey) {
+export function researchAnswersFor(runDir, sessionKey, { ofRun = false } = {}) {
   if (!runDir || !sessionKey) return [];
   let raw = "";
   try { raw = readFileSync(driverDir(runDir, RESEARCH_ANSWERS_FILE), "utf8"); } catch { return []; }
@@ -63,7 +67,7 @@ export function researchAnswersFor(runDir, sessionKey) {
     if (!line.trim()) continue;
     let row;
     try { row = JSON.parse(line); } catch { continue; }
-    if (!own(row?.session) || typeof row.task !== "string" || !row.task.trim() || !isResearchAnswer(row.text)) continue;
+    if ((!ofRun && !own(row?.session)) || typeof row.task !== "string" || !row.task.trim() || !isResearchAnswer(row.text)) continue;
     byTask.delete(row.task);   // the latest answer to a question takes the place of an earlier one
     byTask.set(row.task, { task: row.task, text: row.text, ts: String(row.ts ?? "") });
   }
@@ -83,8 +87,8 @@ export const researchAnswerLine = (n, { task, text }) => `Question ${n}: ${oneLi
  * folder, one question and its answer per line, and return how many. Nothing is written when there are none, and 0 is
  * returned when the file could not be written: a message must never name a file that is not there. IMPURE.
  */
-export function handResearchAnswers(runDir, sessionKey) {
-  const answers = researchAnswersFor(runDir, sessionKey);
+export function handResearchAnswers(runDir, sessionKey, opts = {}) {
+  const answers = researchAnswersFor(runDir, sessionKey, opts);
   if (!answers.length) return 0;
   try {
     const p = join(runDir, RESEARCH_ANSWERS_MD);
@@ -101,8 +105,51 @@ export function handResearchAnswers(runDir, sessionKey) {
 export function researchAnsweredBlock(n) {
   if (!(n > 0)) return "";
   const asked = n === 1 ? "asked 1 question and got its answer" : `asked ${n} questions and got their answers`;
-  return `RESEARCH THIS RUN HAS ALREADY ANSWERED: an earlier attempt of this stage ${asked}. They are in ${RESEARCH_ANSWERS_MD}, `
+  return `RESEARCH THIS RUN HAS ALREADY ANSWERED: earlier stages or attempts of this run ${asked}. They are in ${RESEARCH_ANSWERS_MD}, `
     + "one question and its answer per line. Before you ask about a finding's owner and mark, search that file for the owner's name "
-    + "with search_run_artifacts. Where one of them asked about that owner and mark for the same field and country, use its answer as "
+    + "with search_run_artifacts. Where one of them answers the same owner, mark, goods, territory and material time question, use its answer as "
     + "that finding's check, cite its URL and record it as you would a fresh one; ask only what none of them covers.";
 }
+
+// ── A REPLAY ANSWERS FROM THE RUN'S OWN RESEARCH, AND ASKS NOTHING NEW ────────────────────────────────────────────────
+//
+// A stage replayed offline in the experiment sandbox would send its research questions out again: a cost, and an
+// answer that is not the one the run got. With `--research replay` the sandbox holds the run's own answers and says so
+// in this marker, and the research server answers a question the run already asked from what the run got, and refuses
+// a question it did not ask, sending nothing out. Only the sandbox writes the marker; a run never does.
+export const RESEARCH_REPLAY_FILE = "research-replay.json";
+
+/** True when this run folder is a replay of a run's research. IMPURE (reads the marker). */
+export const researchReplayOn = (runDir) => Boolean(runDir) && existsSync(driverDir(runDir, RESEARCH_REPLAY_FILE));
+
+/**
+ * The run's latest answer to exactly this question, whichever of its stages asked it, or null. The question is
+ * matched as written, trimmed at its ends: a question worded differently is a new question. IMPURE (reads the record).
+ */
+export function savedResearchAnswer(runDir, task) {
+  const want = typeof task === "string" ? task.trim() : "";
+  if (!runDir || !want) return null;
+  let raw = "";
+  try { raw = readFileSync(driverDir(runDir, RESEARCH_ANSWERS_FILE), "utf8"); } catch { return null; }
+  let found = null;
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    let row;
+    try { row = JSON.parse(line); } catch { continue; }
+    if (typeof row?.task !== "string" || row.task.trim() !== want || !isResearchAnswer(row.text)) continue;
+    if (!found || String(row.ts ?? "") >= String(found.ts ?? "")) found = { task: row.task, text: row.text, ts: String(row.ts ?? ""), session: row.session ?? null };
+  }
+  return found;
+}
+
+/** How many questions the run's record answers: the experiment refuses a replay with nothing to replay. IMPURE. */
+export function savedResearchCount(runDir) {
+  let raw = "";
+  try { raw = readFileSync(driverDir(runDir, RESEARCH_ANSWERS_FILE), "utf8"); } catch { return 0; }
+  const tasks = new Set();
+  for (const line of raw.split("\n")) {
+    try { const row = JSON.parse(line); if (typeof row?.task === "string" && row.task.trim() && isResearchAnswer(row.text)) tasks.add(row.task.trim()); }
+    catch { /* a torn line answers nothing */ }
+  }
+  return tasks.size;
+}

package/driver/runner.mjs

@@ -43,7 +43,7 @@ import { checkResolvedProduct } from "./scope-rules.mjs";   // every resolved-pr
 import { freeSlots } from "./slot-lock.mjs";   // admission arithmetic — see drainQueue
 import { orderedQueueFiles } from "./queue-order.mjs";   // the order jobs are admitted in (shared with the portal)
 import { isCancelled } from "./cancel.mjs";   // a stopped run must not come back through any resume path
-import { AGENT_WHATSAPP } from "./stages.mjs";
+import { whatsappRouting } from "./stages.mjs";
 import { writeOutboxPacket } from "./outbox.mjs";
 import { writeRunStatus, terminalRunState } from "./progress.mjs";   // A5 — grace-exit park + reclaim-bound terminal go through the guarded status writer; terminalRunState is the run record's own terminal vocabulary (2155)
 import { identitySeed } from "./progress.mjs";   // — the same stamp a run seeds, for the process that runs them
@@ -702,7 +702,7 @@ function preRunFailNotify(agentId, base, job, reason) {
     jobId: job?.id ?? null, msgId: job?.msgId ?? null,
     forwarder: job?.forwarder ?? null, forwarderEmail: job?.forwarderEmail ?? null,
     markName: (job?.markName ?? job?.name ?? job?.marks?.[0]?.name) || null,
-    whatsappTo: AGENT_WHATSAPP[agentId] ?? null,
+    ...whatsappRouting(job, agentId),   // to whoever asked, as every other notice (the-notice-goes-to-whoever-asked)
     reason: terminalReasonFields(reason).reason, text,
   });
   note(`[runner] pre-run failure ${p ? `packet \u2192 ${p}` : "packet write FAILED"} for ${base}`);
@@ -739,7 +739,7 @@ async function backstopFailureNotice({ res, job, agentId, base, codename, studio
       // canonical runId form (charter P1 §3): `<slug>-<date>-<codename>` — owned.dir's leaf IS
       // "<date>-<codename>", so the dated id is derivable even here (matches status.runId + rescan).
       runId: `${slug}-${basename(owned.dir)}`, agent: agentId, job, failedStage: "pre-run",
-      shortReason, reasonVerbatim: reason.slice(0, 1000), whatsappTo: AGENT_WHATSAPP[agentId] ?? null,
+      shortReason, reasonVerbatim: reason.slice(0, 1000),
     });
     // same per-send invariant as the pipeline's failure path: a fresh notice supersedes an older .sent
     // and its per-channel receipts (B4 — stale receipts would make clearotron-deliver skip this notice)
@@ -2089,7 +2089,7 @@ function reclaimOrphanedClaims(qdir, agentId) {
               // comment above calls out for NAMING THE ARTIFACT DIRECTORY at its end: the status field
               // was repaired by and the notice a human actually reads was left cutting it blind.
               shortReason: rt.reason, reasonVerbatim: reasonText, terminalKind: "reclaim-exhausted",
-              priorAttempts: priorReclaims, whatsappTo: AGENT_WHATSAPP[agentId] ?? null,
+              priorAttempts: priorReclaims,
             });
             try { rmSync(join(owned.dir, ".sent"), { force: true }); } catch { /* none */ }
             try { rmSync(driverDir(owned.dir, "send-receipts.json"), { force: true }); } catch { /* none */ }

package/driver/saved-findings-block.mjs

@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// saved-findings-block.mjs — what a later attempt of the writer is told about the findings this run already saved.
+//
+// The writer saves each finding as it completes it (synthesis-record.mjs, `saveFindings`), and an attempt that is
+// stopped keeps them. A later attempt is handed them as a file, never in its message: a saved finding carries its
+// evidence, and a few hundred of them would swamp the message. The message says how many there are, where they are,
+// that they stand, and which positions are still to settle. A first attempt has none, and its message is unchanged.
+// The model reads this block, so its words change only as model-facing wording does.
+//
+// A pure leaf, so the stage table can import it.
+
+/** The file in the run folder a later attempt is handed its run's saved findings in. */
+export const SAVED_FINDINGS_FILE = "synthesis-saved.json";
+
+/**
+ * The block a later attempt's message ends with, or "" when nothing is saved. `h` is what
+ * synthesis-record.mjs's `handSavedFindings` returned: `{ findings, declined, outstanding }`, where `outstanding` is
+ * null when the run cannot say which positions are still owed. PURE.
+ */
+export function savedFindingsBlock(h) {
+  if (!h || !(h.findings > 0)) return "";
+  const saved = h.findings === 1 ? "saved 1 finding" : `saved ${h.findings} findings`;
+  const declined = h.declined > 0 ? ` and declined ${h.declined === 1 ? "1 record" : `${h.declined} records`} through record_declination` : "";
+  const shown = Array.isArray(h.outstanding) ? h.outstanding.slice(0, 40) : [];
+  const more = Array.isArray(h.outstanding) && h.outstanding.length > shown.length ? `, and ${h.outstanding.length - shown.length} more` : "";
+  const owed = !Array.isArray(h.outstanding) ? ""
+    : h.outstanding.length ? ` Still to settle: ${h.outstanding.length === 1 ? "1 position" : `${h.outstanding.length} positions`}: ${shown.join(", ")}${more}.`
+      : " Every position you were handed is already settled by a saved finding or a declination.";
+  return `SAVED IN THIS RUN: an earlier attempt of this stage ${saved} through record_synthesis${declined}. The saved findings are in ${SAVED_FINDINGS_FILE}, `
+    + "each as it was accepted, with its evidence. They stand: save one again only for identified contrary evidence, a reasoning error "
+    + `or an applicable change in the instructions.${owed} Save each remaining finding as you complete it. Then send the whole record, `
+    + "`narrative` with `findings`: it takes every saved finding for a position its `findings[]` does not carry, so that list need hold "
+    + "only the findings not saved yet, and the overall conclusions answer for the complete set.";
+}

package/driver/skills/clearance-register/digest.md

@@ -396,7 +396,7 @@ Every judgment below spans the band and/or needs data a single unit cannot have,
 **Consume `placement-recommendations.md` (from Touchpoint 2 `placement-inquiry`).** The per-candidate tiers ALSO arrive structured in `placements.json` beside the md — `{mark, owner, jurisdiction, records[], tier, reason}` per candidate (plus an optional `borderline: true` — see below), `reason` carrying placement's stated reasoning. When present, the JSON is the authoritative tier record: adopt or override each tier BY ENGAGING ITS `reason` (an override quotes the reason it contradicts — never a silent re-tier; a kept tier may tighten a label while reusing the reason). The md remains the home of the rulings tail (Disagreements, Coverage rulings, Open questions), which you carry forward exactly as below. On a corrective/repair pass do NOT re-read the whole md — the tiers are in the JSON, and the driver hands you the md's rulings tail verbatim in the dispatch (a `PLACEMENT RULINGS TAIL` block): adjudicate against it there, adopting or counter-reasoning each ruling. For each candidate `placement-inquiry` placed:
 - Find the matching entry in `placements.json` (mark text + owner + jurisdiction match; fall back to the md's tier sections on runs that predate the JSON)
 - Adopt the graduated outcome (`headline-candidate` / `sheet-2` / `watchlist-annex` / `out-of-scope-filtered`) as the placement
-- A sheet-2 placement is adopted as it stands — the driver writes its Sheet-2 row with placement's reason — unless you override it; you send rows for the headline positions and for the placements you override.
+- Keep each placement decision that its evidence supports, with its reason. Before an entry goes to the writer, decide its relevance from the evidence you hold. Carry plausible conflicts and the questions the evidence leaves open. Drop every other entry once, with a substantive reason. The length of the report, thin use, a small owner and possible revocation are never substantive reasons. On its own, a sheet-2 tier, a class match or the words “completes the record” is no reason to carry an entry. Change a placement decision only by naming the evidence or the error that changes it.
 - **Between `headline-candidate` and `sheet-2`, what you are adopting is an ANSWER, not a label.** Those two tiers are placement-inquiry's written answer to one question — *does this conflict change the advice, or only complete the record?* (a headline entry names what it changes; a sheet-2 entry states why the advice reads the same either way). Adopting means adopting that answer. **Overriding means answering the SAME question the other way, in writing**, in your `### Disagreement resolutions` row — never re-labelling the tier and never substituting a risk-tier argument for the question. An override that does not say what the conflict does (or does not do) to the advice has not engaged the placement
 - **A `"borderline": true` entry in `placements.json` is placement declaring that its own answer could be argued either way on this record.** That is the expected place for your judgment to differ, and it is a correct declaration rather than a defect — but it must be **resolved either way, explicitly**, in a `### Disagreement resolutions` row (`ADOPTED placement-inquiry — <the reading you took, and why>` / `OVERRODE — <the other reading, and why>`), never silently carried and never left as a shrug. **The declaration is internal adjudication only**: it belongs in your audit trail beside the other open verification flags, and no borderline mark, no "arguably", no "either way" derived from it goes into the findings prose the client reads — you resolve it here so the report does not have to hedge it there
 - The "Disagreements / flags surfaced to downstream" section names cases where placement-inquiry deviated from class-match — read those reasonings carefully

package/driver/skills/clearance-search/phase2-execution.md

@@ -155,9 +155,9 @@ is not a reason to skip it, and "the rule said so" is not an answer.
   headline.)
 - **Dominant-element spine / calibration:** is each finding ranked by the *dominant element* + whole-mark confusion
   test? Is a distinguished mark (house-mark-prefixed) **over-rated**, or a
-  bare-dominant-element-in-field conflict **under-rated or dropped**? Did any **on-point identical /
-  near-identical-in-class** hit fall out of the deliverable (it must not — even if revocable, and regardless
-  of filer size)? Is any escalation of a distinguished mark resting on optics/PR/partner rather than a
+  bare-dominant-element-in-field conflict **under-rated or dropped**? Did an **on-point identical or
+  near-identical mark in the class** fall out of the report? It must not, even if revocable and whatever its
+  owner's size. Is any escalation of a distinguished mark resting on optics/PR/partner rather than a
   named confusion theory? Is the headline risk driven by the top on-point conflicts, not a distinguished
   mark or unrelated-field noise?
 - **Coverage ledger:** is any `deferred` / `coverage-limited` row being narrated (or about to be narrated) as a
@@ -218,7 +218,9 @@ Every cross-check (including "checked, found nothing") logged in the unified aud
 
 ## Step 3.5 — Actual-use and enforcement check (mandatory for register hits rated medium risk or higher)
 
-Before synthesis, for **every register finding** advisory-rated on a rung **the framework rates medium risk or higher** (the stage message names those rungs; a rung below that is not checked, on any client's ladder), run a marketplace check via `perplexity_research` to determine whether the registered mark is **actually being used in the marketplace within the scope of the current search** (i.e. for the goods/services and field this clearance targets). **The same query also asks for the owner's enforcement record:** whether the owner has opposed, disputed or sued over this mark or a similar one.
+For **every register finding** advisory-rated on a rung **the framework rates medium risk or higher** (the stage message names those rungs; a rung below that is not checked, on any client's ladder), run a marketplace check via `perplexity_research` to determine whether the registered mark is **actually being used in the marketplace within the scope of the current search** (i.e. for the goods/services and field this clearance targets). **The same query also asks for the owner's enforcement record:** whether the owner has opposed, disputed or sued over this mark or a similar one.
+
+Apply the existing triggers for actual-use, enforcement, and owner checks after the relevant legal assessment. First use a suitable answer already held by this run, including an earlier stage or attempt, where it answers the same owner, mark, goods, territory, and material time question. A source requirement is not a requirement for a new call. One answer may support several findings only where it answers each finding's question. Ask only what remains unanswered and record the result against every finding it supports.
 
 Example: a JELLY register hit owned by Jellycat (a toy company) for Class 9 video game software — check whether Jellycat actually sells or markets video games under JELLY. If they don't (their commercial use is toys), note the filed-vs-used distinction in Key Factors and weigh it as a Stage-2 factor together with revocation-vulnerability — no automatic downgrade (see `synthesis-rules.md` → *Actual-use assessment results*).
 
@@ -245,7 +247,7 @@ If the marketplace query genuinely returned nothing, write the honest value verb
 
 The driver's `narrative` validator (`verify.mjs` → `findUseCheckViolations`) **rejects the whole narrative** if a
 Composite 3+ use-negative finding lacks this line, so the synthesis stage cannot ship an *inferred* "no use" —
-it must actually run the scoped query (owner + mark + goods/field) and cite the result, or state the honest
+it must actually run the scoped query (owner + mark + goods/field), unless an answer this run already holds answers that question, and cite the result, or state the honest
 "no result". Never dress an un-run check as a clean negative. Also mirror the result into the matching `# Actions`
 item: "confirm the owner's actual use" becomes the stated result, not a task handed onward (this is what fills
 spec 09's "Checks we ran — what we found" bucket). On a perplexity outage the "no result" value is the accepted