eliziff turns Beaver into a legal-AI testing lab

Measurement-first scoping of the external plan against what the repo
already owns: extend contextManifest into a common eval trace first,
CanLegalRAGBench retrieval-stage second, LongMemEval when a second
context strategy exists. LegalBench-RAG-mini deferred (no chunk-RAG
exists to measure) and the maximal brief's four-arm portfolio rejected
as infrastructure-in-the-dark. OpenAI prompt caching recorded as already
measured (2,304-token stable prefix reuse across the conditional
spreadsheet splice).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QUsMXzBsEJ27DjJVPSfW5o

Eval plan Issues 1-4: strict run-trace contract with git/config/token/
cost provenance; Beaver-CAN task+gold schemas with a three-task dev
slice whose pinpoints are validated by the production source compiler;
deterministic validator primitives (quotations, packet-only sources,
seeded-identifier leakage, headings, provenance IDs, filenames, DOCX
revision/comment structure); and a four-arm runner (bare_model,
oracle_sources, beaver_baseline, beaver_candidate) producing per-arm
validated traces and a comparison report. Unscored criteria are
explicit nulls, never faked. streamResponsesApi now reports provider
token usage so traces carry real tokens and cost. Verified with a live
two-arm gpt-5-mini run on CAN-RETRIEVAL-001.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016yXxuitxX5h4wm1v88hnga

Pinned reproducible setup (mini.manifest.json: upstream MIT repo/URL,
deterministic 194-tests-per-source derivation, sha256 of all 73 derived
files; corpus stays git-ignored), char-span precision/recall@k metrics
per the upstream formulas, and an end-to-end run of the product's
existing retrieval plane (FTS5 bm25 searchLocalA2AJ + snippet window via
the existing import_a2aj_bulk.py) emitting a validated Issue-1 run trace
with retrieved-token volume. No model calls, no new dependencies.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016yXxuitxX5h4wm1v88hnga

task_type gains citation_mechanics and synthetic_review for the Issue 6
expansion (schema JSON regenerated); the dev-set test pins the original
vertical slice as a subset instead of an exact list. CAN-CITE-001 is the
first citation/document-mechanics task: verbatim quotation of s
231(5)(e) and Latimer's para 24 exemption reversal, pinpoints, required
Table of Authorities heading, closed three-source packet reusing
verified fixtures. Gold is provisional pending human review.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016yXxuitxX5h4wm1v88hnga

Synthetic-review task (MSA draft-vs-executed with seeded identifiers) and a
second long-thread task (superseded employment summary), both validating end
to end through loadBeaverCanTaskDir and checkBeaverCanGold.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016yXxuitxX5h4wm1v88hnga

Nine Stanford LegalBench tasks (arXiv:2308.11462, HF nguha/legalbench)
covering claimed capabilities: rule application/QA (abercrombie, hearsay,
personal_jurisdiction, ucc_v_common_law), issue spotting
(corporate_lobbying), contract/merger clause understanding (contract_qa,
cuad_anti-assignment, maud_specific_performance), and citation support
(citation_prediction_classification). All CC BY 4.0; Learned Hands
excluded (CC BY-NC-SA), rule_qa excluded (manual eval only).

Official test splits and upstream base_prompt.txt files are downloaded to
git-ignored benchmarks/legalbench/data/ and pinned byte-for-byte in the
committed manifest, which also records per-task license and the paper's
GPT-4 balanced accuracy with table citation. Scoring ports evaluation.py
normalize() + sklearn balanced accuracy; chat-style label extraction is
deterministic and scores ambiguity as wrong. Limited runs use a
class-stratified prefix of the official split (several splits group rows
by gold label).

First live gate, gpt-5-mini, 25 stratified examples/task:
abercrombie balanced acc 88.0 (GPT-4 paper: 85.3),
cuad_anti-assignment 96.2 (GPT-4 paper: 91.4), 0 unparsed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016yXxuitxX5h4wm1v88hnga

Chat models bold their verdict inside verbose analyses; the whole-text
fallback saw both labels and refused. Bold spans now count when they map to
exactly one label. Rescoring the saved codex sweep flips
citation_prediction_classification from 31.7 (16 unparsed) to 88.1 (2).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016yXxuitxX5h4wm1v88hnga

Two arms on identical tasks and judge: LAB reference agent harness vs
Beaver production pipeline, both driving gpt-5.6-sol over the codex
subscription route. Documents forced deviations from official LAB
(codex judge, temperature stripped, docker sandbox).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016yXxuitxX5h4wm1v88hnga

lab-beaver-arm.ts drives the real /chat transport (anonymous local mode,
same recipe as eval-beaver-arm.ts) on a LAB task and writes LAB-layout
results so harvey-labs evaluation.run_eval judges both arms identically.
lab-select-tasks.ts picks a seeded, practice-area-stratified pilot set
restricted to deliverables the beaver arm can export (docx/md/txt).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016yXxuitxX5h4wm1v88hnga

Attempt-01 showed Beaver answers document tasks by calling
library_create_docx and confirming in 148 chars of chat text; exporting
that text as the deliverable graded the confirmation, not the memo. Now
doc_created SSE events are collected, the created files are downloaded
through the real /single-documents API, and answer-text export is the
fallback only. Per-deliverable provenance is recorded in receipts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016yXxuitxX5h4wm1v88hnga

The manifest entries carry provider-reported usage per
streamChatWithTools call; sum that instead of the bytes/4 estimate
(which also lived under a field name this script had wrong, yielding
input_tokens 0). Estimate remains the fallback per entry.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016yXxuitxX5h4wm1v88hnga

Headline judge is now claude-code/claude-sonnet-4-6 (LAB official judge
model via headless Claude Code, flat rate); codex judge kept for bulk
iteration with the measured 110/112 smoke calibration quoted.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016yXxuitxX5h4wm1v88hnga

Runner parity fixes: explicit reasoning_effort (medium) on the /chat
body matching Arm A, and Beaver online research tools (CourtListener,
A2AJ, public-legal) stripped from the advertised list so information
access matches Arm A sealed --network=none sandbox; removal recorded in
receipts. PROTOCOL.md gains the verified held-constant list,
harness-intrinsic differences, and residual disclosures.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016yXxuitxX5h4wm1v88hnga

The flag removes CourtListener/A2AJ/public-legal tools AND their
system-prompt sections from the local assistant in one switch (flag off
is byte-identical to before). LAB arm-B runner now uses it instead of
splicing the tool array, saves every Beaver-authored document under its
own filename so LAB fuzzy deliverable matching applies (multi-deliverable
tasks), synthesizes answer text only for extension classes with no
created document, and fails loudly on ask_inputs pauses. Durability test
mock gains the new export.

Verified: flag off 29 tools, flag on 17 and system prompt 7173->3422
bytes served; durability suite 32/32.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016yXxuitxX5h4wm1v88hnga

User ruling: the mid-run docker-exec/python-docx failure is our
Docker-on-Windows infra fault, so pilot-a-01's 0/95 is not a fair
Arm A number. Record it as an incident only; a clean rerun
(pilot-a-01r) supplies the comparable number if run. Pilot paused
after task 03.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018bhP89cYSdEEjHNPnxacns

Arm C: headless Claude Code (claude -p, subscription flat rate) as the
agent harness on one LAB task, writing LAB-layout results so
evaluation.run_eval judges it identically to the other arms. Tool
inventory pinned to Arm A's six workspace tools (+TodoWrite); web tools
disallowed; API key stripped in favor of subscription auth.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018bhP89cYSdEEjHNPnxacns

The LAB reference adapter reports input = raw + cache_read +
cache_creation; the Beaver runner was summing raw inputTokens only,
which would understate the Beaver arm several-fold on the
cache-heavy claude-p transport. The context manifest already
carries the cache fields; sum them.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018bhP89cYSdEEjHNPnxacns

The arm wrapped .eml as .docx with content unchanged, on the premise that
Beaver had no ingester. It does now, and the wrap is not neutral: wrapping
a quoted-printable message verbatim splits numbers mid-digit, so the
benchmark was scoring every arm against facts the sender never wrote
($85,0 for $85,000). Old runs are not comparable to new ones; correct
inputs are worth more than that comparability.

UPLOADABLE is now derived from ALLOWED_DOCUMENT_TYPES minus images rather
than hand-mirrored - the stale copy is precisely how .eml stayed wrapped
after Beaver learned to read it.

Also proves the whole path end to end: an .eml created in the library
reads back through extractLocalDocument with "$85,000" intact and its
Subject header present, not just parsed correctly in isolation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018bhP89cYSdEEjHNPnxacns

Contamination control for the harness claims: seeded stratified split
into dev (60, includes all 14 already-exposed tasks) / validation (150,
scores-only) / sealed (997, upstream-only). Per-task SHA-256 manifest so
a restored sealed tier verifies byte-for-byte; every practice area keeps
a sealed majority. Protocol records the rules of engagement.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012AgUm5EcRKbT3duVFMbrQD

benchmarks/harvey-labs carries the 210 visible tasks, the grading
harness with its 13 integration patches (provenance and upstream HEAD in
PROVENANCE.md), and our run results; the 997 sealed tasks exist only
upstream. benchmarks/legal-generalization-corpus is the held-out gold
corpus the scanners validate against. Local venv and caches stay
untracked.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012AgUm5EcRKbT3duVFMbrQD

Fixture DOCX numbered purely via w:numPr: mammoth drops numbers entirely
(bare nested ol/li); pandoc emits markdown ordinals that restart per
level, so the rendered label a cross-reference names never appears in
either output. Label synthesis from numbering.xml is ours to build.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012AgUm5EcRKbT3duVFMbrQD

Parallel judging produced exit-1-empty-stderr spawn failures that
consumed the whole retry budget; spawn-level failures now get extra
backed-off attempts while unparseable-but-successful runs keep the
tight budget.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012AgUm5EcRKbT3duVFMbrQD

The Aider/Codex/pi/opencode/goose/Cline-Continue survey workflow output
(8 ranked recommendations, do-not-adopt and missed lists, three
adversarial critique passes) lived only in a temp task file. It is the
provenance for the tool-result floor and the edit-failure teaching, and
three of its recommendations remain unabsorbed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012AgUm5EcRKbT3duVFMbrQD

Replaces the four measured defects of the doc-level search path:
boundary-aware offset-preserving chunker (RCTS family), OR-semantics
weighted-bm25 over a derived sidecar FTS5 passage index (source db
never written), doc name/citation columns on every passage row so
document-naming queries boost their passages, per-doc diversity cap,
and rrfFuse as the standing hybrid fusion point for a dense lane.
Every hit returns exact char offsets with a verbatim-slice invariant
(unit-tested, 7 vectors). Ablation harness sweeps chunk/weight
configs against the 776-test human gold deterministically at zero
model cost.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012AgUm5EcRKbT3duVFMbrQD

Both grounding harnesses did `writeFileSync(output, "", "utf8")` on any
non-resume run, and legalbench-rag-grounding's default --output is a FIXED
path (stage14-lbrag.jsonl). That is the mechanism that destroyed
`stage18-retrieval-arms.jsonl`, whose sha256 is pinned in the experiment
log.

The guard added to legalbench-retrieval-ablate in d6813dd7 now lives in
src/lib/experimentReceipts and all three harnesses call it: --output is
honoured in every mode, and an existing file throws unless --force (or
--resume, which appends and skips done cells and is the one
non-destructive way to reopen a receipt). Resolved AFTER the --dry-run
return so a dry run is never refused, and before any model call.

Two holes closed while porting: --output was ignored entirely by ablate's
--rerank-arms mode (it built its path inline and truncated it), and
`--output` with no following path silently fell back to the default
instead of erroring.

Smoke-checked live: the grounding harness now exits with "refusing to
overwrite an existing receipt: ...stage14-lbrag.jsonl" before any model
call, and that receipt's bytes and mtime are untouched.

Tests: src/lib/__tests__/experimentReceipts.test.ts (default, --output,
clobber refusal on both paths, --force, --resume, malformed --output).
No scoring or retrieval semantics touched.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9ToHYJVDxfeJcJwdzrP2H

`legalbench-rag-grounding.ts` set `perDocCap: 24` ONLY when a rerank model
was configured. Without one the lexical path fell through to
searchPassages' default of 2, and an injected pool (--pool-jsonl) took
`slice(0, k)` with no cap at all. The registered Tier C comparison runs
plain lexical / ctx / ctx+rerank / injected fused pool, so three of the
four arms would have run at three different caps, none of them declared.

Now one flag, `--per-doc-cap`, applied to the lexical path and the
injected-pool path alike (`capHitsPerDoc` in passageRetrieval applies the
same rule searchPassages applies internally - unit-tested for equivalence),
printed at startup and written to every row as `per_doc_cap` (null on the
product path, which has no cap).

SHIPPED DEFAULT 24, deliberately:
- it is the crowned config's value everywhere else - the ablation sweeps,
  legalbench-rerank-eval, and legalbench-dense-dump, which BUILT the
  injected pool sidecars, all use 24; a2ajPassageSearch uses it too;
- any cap >= k is equivalent to uncapped, so at the composed k (4 or 6) it
  is INERT: it changes nothing for the injected-pool arm, which was
  uncapped, and reproduces the uncapped behaviour for the lexical arms;
- at the k=48 rerank pool, where a cap does bind, 24 is exactly the value
  the crowned rerank config was measured on.
So the cap is now identical across arms while both registered behaviours
are preserved in the place each was registered.

Measured, deterministic, no receipt written (96 cells, t1600/o120/w16, LF
instrument, lexical char recall):

  k=6   cap 2  R=0.2123   cap 24  R=0.4524   cap 48  R=0.4524
  k=4   cap 2  R=0.2019   cap 24  R=0.3330   cap 48  R=0.3330
  k=48  cap 2  R=0.2332   cap 24  R=0.8332   cap 48  R=0.8937

maud alone moves 0.0210 -> 0.1672 at k=6 (8x): exactly the "gold
concentrates inside one 300 KB agreement" mechanism, and ~16x the +-0.015
composer band. This is the one fix in P0 that MOVES a number, and it moves
it in the arms that were silently mis-capped. Honest disclosure: an
injected pool drawn at k=48 for reranking is now capped at 24/doc where it
was uncapped, so a fused+rerank arm is not byte-identical to Stage 18's;
at k<=24 the injected path is unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9ToHYJVDxfeJcJwdzrP2H

legalCrossReference compiles a contract's own pointers into a typed graph:
nodes are skeleton provisions, edges carry the reference span, the
normalized locator, the target span, and a status of resolved / external /
unresolved / abstained. Zero model calls. Nothing is wired into retrieval.

Refusals, each with the corpus number that motivated it:
  ambiguous_label      a table of contents repeats every heading, so the
                       label claims two spans and createSourceDoc dropped
                       it; refuse rather than pick (161 references)
  depth_not_numbered   the document does not number this FAMILY - a merger
                       agreement anchors sec4.2 and art6 but never a bare
                       "sec16", so its 1,357 bare-integer references (all
                       external statute cites) must abstain (2,081)
  no_containing_section  "clause (ii)" outside any numbered section (98)
  document_abstained   the integrity gate below

Integrity gate: per-document resolution is sharply bimodal on maud (0.24
-0.40 for eight documents whose sections the skeleton largely misses, then
0.58-1.00 for nine), so a document whose accepted references mostly miss
refuses wholesale - what is unreliable there is our view of the numbering,
not the document. Gate at 0.5, in the widest gap; a calibration, re-derive
it when the structural detector changes.

MEASUREMENT 1 (resolver, no gold needed), 9,234 references over 69 docs:
gated, 2,428 resolved / 307 unresolved / 1,720 external / 4,779 refused -
3.3% of accepted references miss. Ungated the same census is 3,341 / 1,812
/ 1,720 / 2,361. The instrument is sound on the documents it accepts, and
its ceiling is the skeleton's section inventory: maud documents with 97-111
detected sections resolve 96-97% of accepted references, those with 13-33
resolve 24-40%.

MEASUREMENT 2 (gold n graph alignment) is the negative half and is why no
arm is registered here. Standing on a gold fragment and following outgoing
literal edges reaches OTHER gold fragments at 2.28% precision on maud vs
1.44% for the same budget spent contiguously (1.6x better), but 1.15% vs
6.99% on cuad and 4.06% vs 5.06% on contractnli. Coverage is the harder
limit: 31 of 227 fragmented maud gold fragments have any outgoing edge,
14/153 on cuad, 0/384 on privacy_qa. Both weak layers lose to contiguous
context everywhere (defined-term 0.12-1.29%, lexical 0.81-4.57%).

Also in legalReferenceGrammar: isExternalReferenceInContext, a both-flanks
external test the one-flank isExternalReference is structurally blind to
("Code Section 59A", "Treasury Regulation Section 1.482", "Sections 302 and
906 of the Sarbanes-Oxley Act", "Section 262 thereof"). +313 external
references on the mini corpus at a cost of 2, both verified genuinely
external by hand. isExternalReference itself is untouched, so the three
shipping consumers keep their behaviour.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9ToHYJVDxfeJcJwdzrP2H

Both deterministic measurements ran before any model-side arm, as registered.
The resolver works (9,234 references detected, 2,428 resolved, 3.3% unresolved,
24/69 documents refused by the integrity gate) and its ceiling is provably the
skeleton's section inventory - maud docs with 97-111 sections resolve 96-97%,
docs with 13-33 resolve 24-40%.

But the edges do not point at gold. Against a contiguous same-budget control,
graph precision loses on contractnli (4.06 vs 5.06) and loses 6x on cuad (1.15
vs 6.99); maud is the only win at 1.6x, and reaches just 13.7% of its fragmented
gold. Same shape as the C1 coverage arms.

So retrieval-time edge following - argued in session as the cheapest and
strongest version of the idea - is DEAD on this bed and gets no arm. The weak
layers are retired on evidence: defined-term 0.12-1.29% and lexical 0.81-4.57%,
below the contiguous control everywhere. The surviving hypothesis is narrower:
the graph as a map a composer corrects, i.e. orientation rather than evidence,
to be registered and gated on its own terms.

Zero model calls spent reaching this.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9ToHYJVDxfeJcJwdzrP2H

MIKE_NAV_SHAPE selects the surface the model sees. "legacy" is what shipped
before today -- read by section or offset, unscoped find, no page addressing,
no graph. "address" is one grammar: `at` everywhere, head/tail, both page
schemes, library_links, and edit scopes that name a provision.

No shims in either direction. The address arm drops `section`/`page`/`pages`/
`offset` outright rather than accepting them as deprecated aliases: an arm
that still answers to the other arm's vocabulary is not a separate condition,
and a model that finds `section=` quietly working has not been asked the
question.

  arm A  read(document_id, mode, section, offset, max_chars)
         find(query, regex, case_insensitive, max_results, context_chars)
         2,809 chars over 3 tools

  arm B  read(document_id, mode, at, from, max_chars)
         find(query, regex, case_insensitive, at, follow, depth, ...)
         links(document_id, at, max_results)
         5,006 chars over 4 tools

Arm B is larger, and that is the honest starting position rather than a
problem to hide: it carries a tool arm A does not have and two scope
dimensions arm A cannot express. Whether that buys anything is the question,
and Eli has already said an obvious regression disqualifies it.

Default stays legacy, so nothing about the shipped product changes until a
measurement says it should.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9ToHYJVDxfeJcJwdzrP2H

Registered before the first arm call. Compares MIKE_NAV_SHAPE=legacy
(3 tools, 2,809 schema chars, 544 measured input tokens) against
=address (4 tools, 5,006 chars, 1,027 tokens) on AGENTIC retrieval:
no injected passages, the model navigates the document itself.

Bed soundness proved before any model call, both oracles 100%:
gold-coordinate oracle 1362/1362 on the normalized corpus load, and a
new surface-fidelity oracle showing the text the library surface hands
the model is byte-identical to the corpus text gold indexes into
(69/69 documents; the surface has no .txt parser, so corpus files are
ingested as DOCX with one w:p per LF line).

Two facts recorded in advance because they bound what the result can
mean. (1) The arms are separated at the SCHEMA level only: a direct
handler probe shows arm A executes at="off:N", from="end" and
library_links, and arm B executes section= and offset=. Every tool call
therefore records off-schema argument names, and a materially nonzero
rate is reported as contamination. That is a finding about backend/src,
which this stage does not touch. (2) The DOCX bed has no fixed
pagination, so arm B's page schemes are structurally inert here and
part of its +2,197 chars cannot pay for itself on this corpus.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9ToHYJVDxfeJcJwdzrP2H

Registered after the asis rep-1 arms started but before any aggregate
score was read (disclosed in the doc). Prompted by an agentic-benchmark
audit; three reporting additions, no change to arms, prompt, sample,
model or scorer.

A cell counts as solved at f1_best >= 0.5. Cells no arm ever solves are
counted and printed as their own number, and every paired difference is
reported twice: over all sampled cells, and over the subset at least
one arm solved. Zero-in-both cells pull a paired difference toward zero
and would otherwise read as arm equality when they are signal absence.

The read-it-whole shortcut is measured, and it is large and confounded
with source: against library_read's 24,000-char default and the 64,000
tool-result ceiling, 39.4% of the n=160 sample fits one default read
and another 28.1% fits one deliberate read, so 67.5% of cells have a
whole-document shortcut available. contractnli is 38/40 in the smallest
band; maud is 40/40 above 200k. Paired differences are therefore
reported stratified by document-size band, with the shortcut-TAKEN rate
(one read covering >=95% of the document) beside it.

Differences smaller than the measured within-arm replicate floor are
labelled undecided rather than null.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9ToHYJVDxfeJcJwdzrP2H

The Codex backend 429s under six concurrent harness processes, and the
per-cell catch wrote an error row that resume then treated as done -
baking a scored zero into the arm mean for a cell the model never got
to answer. Resume now keys on completed rows only, and since receipts
are append-only the retry appends a second row: the report keeps the
completed one, counts the error rows separately as an instrument
failure rate, and reports how many cells were de-duplicated.

Adds reached_by_read, derived from stored traces with no re-run.
reached_any counts library_find's context window either side of every
hit, which a couple of finds can blanket on a 10k document - it
saturates at 1.000 and stops discriminating. reached_by_read asks
whether a library_read, the model committing to a location, landed on
gold. On the partial asis pairing it separates the arms where
reached_any cannot.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9ToHYJVDxfeJcJwdzrP2H

The sample is stratified but sorted by test id, so a condition that
stopped early left a source-ORDERED prefix - all contractnli, no
privacy_qa - which is no longer a stratified sample. Work is now
round-robined across the four sources, so every prefix stays balanced
and an interrupted condition remains usable.

Report gains an arm-B affordance uptake table with the denominators
that make a zero meaningful (offered and declined, not absent), plus
reached_by_read in the per-source and per-size-band breakdowns.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9ToHYJVDxfeJcJwdzrP2H

A cell whose only receipt row is a 429 was being scored as f1=0, so a
rate limit was masquerading as the arm failing the cell and was moving
the arm mean by however many cells the network happened to drop. Error
rows now leave the scored set entirely and are reported as a count.

Adds two paired controls for the navigation claim: chars_exposed (union
of every document character a cell put in front of the model) and
mean_read_width. reached_by_read would otherwise be cheap to win by
reading wider windows rather than by targeting better.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9ToHYJVDxfeJcJwdzrP2H

Three places were leaking one arm's affordances into the other, so "the model
only sees one set of tools" was true of the tool list and false everywhere
else.

  EDIT SCOPE. `scope: {kind:"at"}` was on library_apply_text_ops in BOTH
  arms. Legacy is supposed to name an edit site by retyping document text;
  handing it structural addressing gave it the exact affordance the edit
  benchmark exists to measure. Gated.

  SYSTEM PROMPT. It told every non-coding session to "read only the needed
  span with library_read section=" -- a parameter the address arm does not
  have. The prompt is part of the surface; it now follows the arm.

  HANDLER. Schema gating alone is not isolation: the handlers still read
  args.section / args.page / args.pages whatever the arm, so a leaked
  parameter would have been honoured while the tool list looked clean. Each
  handler now reads only its own arm's vocabulary.

Also closed a hole Eli found by asking what read and find are for: `follow`
and `depth` expand an ADDRESS, not a search, so they belonged wherever `at`
does. They were on find and on edit scopes but not on read, for no reason
beyond the order I built things -- "read this clause and what it depends on"
was the one composition that could not be expressed. library_read now takes
them, sharing one budget across the seed and its neighbourhood so following
cannot multiply what a read costs.

Deduplication continued: `follow`/`depth` prose was written three times and
now sits once in library_outline beside the address grammar.

  nav cluster  legacy   700   address 1,341
  whole schema legacy 10,130  address 10,953

67 tests green across five suites, both arms.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9ToHYJVDxfeJcJwdzrP2H

Without backoff a rate-limit burst is worse than slowness: every queued
cell fails in milliseconds, so one storm consumes an entire pass and
leaves a receipt full of error rows instead of answers. Three storms
were observed, each triggered by raising harness concurrency (12 and 18
concurrent requests; six ran clean).

Transport now retries up to five times with exponential backoff and
jitter, and only on 429/rate-limit - a scoring failure is never
retried. Each attempt resets the trace buffer and turn counter, or a
cell that 429'd mid-loop would report one navigation as two.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9ToHYJVDxfeJcJwdzrP2H

Eli: "none of the existing stuff is really tested. I am not afraid about
testing multiple things at once. Make B our best guess at combining all of
our ideas." So B stops being a naming change and becomes the full vision,
measured against a frozen A.

PROGRESSIVE DISCLOSURE. Tool-selection accuracy is measured to degrade past
roughly 20-25 tools and this surface carries 44, which is very likely a
larger effect than any wording I have been trimming. B keeps the eleven verbs
a task starts with -- list, outline, read, find, links, lookup, evidence,
apply_text_ops, ask, submit, describe_tools -- and defers 34 behind one
discovery call, grouped by how a task arrives (research, drafting, review,
amendment, authorities, deadlines, workflow) rather than by module.

  resident schema   A 10,130 tokens   B 4,004 tokens   -60.5%

That is the answer to Eli's "shouldn't the new one be SHORTER?" -- it is,
once the lever is the tool count rather than the prose. Trimming descriptions
was worth ~80 tokens; this is worth 6,126.

CAPABILITY ON CONTACT. A schema can only describe addressing in the abstract,
identically for a paginated PDF and a DOCX with no pages. The document knows.
The opening read now reports what THIS document affords -- sections, page
count and which schemes address them, resolved cross-references, contents
outline, or a note saying there is no numbering -- so the model asks for
things that exist. Only on the opening read: it costs a skeleton compile, and
repeating it per windowed read would pay that every turn for information that
has not changed.

The known risk, to be measured rather than assumed: a model does not call
what it cannot see, and the prompt currently PUSHES the deterministic organs.
If B under-calls them, that is a quality regression a token count will not
show, and it disqualifies the arm regardless of the saving.

partitionTools/toolsForDomains are exported because the harness owns the
conversation loop and has to add revealed tools to the next request.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9ToHYJVDxfeJcJwdzrP2H

A concurrent session edited backend/src/lib/chat/localAssistantTools.ts
three times between my registration commit (19:30:42) and my result
(19:57:34). The harness starts a fresh process per condition, so each
condition picked up whatever the file said at its start: the receipts
hold FOUR distinct arm B schemas and TWO distinct arm A schemas, and
the published n=215 table averaged all of them. Arm A was supposed to
be frozen and was not.

schema_chars was recorded on every row, which is the only reason this
was detectable rather than silently averaged. The report now prints a
schema-identity census that shouts when an arm drifted, and takes
--pin-schema to score one frozen pairing.

Scored on the registered arms alone (legacy=2809ch, address=5006ch,
paired n=100 asis / n=34 stripped), two headline claims are withdrawn:
the disqualification trigger does NOT fire (reached_any is 1.0000 in
both arms, difference exactly 0, against -0.0977 [-0.1404, -0.0591] in
the mixed set), and the 48% document-exposure reduction disappears
(-352 [-1122, 461] against -5,312). Every remaining point estimate
favours arm B and every one sits inside its own within-arm replicate
floor: undecided, leaning positive, resolvable only with more
replicates.

Unchanged because they are counts, not contrasts: on the registered
arm B, library_links was called 0 times in 849 tool calls, follow
walked the graph 0 times in 534 find calls, page addressing 0 times,
and off-schema parameter usage was 0 across 1,560 calls.

Lesson: verifying the arms once before a run is not enough on a shared
tree. Pin the arm by content hash at process start and refuse to append
a row whose hash differs from the registered one.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9ToHYJVDxfeJcJwdzrP2H

Registered before any Stage 22 model call. Arm B is no longer a naming
change: it adds progressive tool disclosure and capability-on-contact,
so Stage 21 measured a strictly smaller thing (four nav tools sent
alone) and its result does not carry over.

Deterministic half is done and verified by probe rather than taken on
trust. Provider-measured input tokens on codex:gpt-5.6-sol, same system
prompt, tools attached vs not: arm A 43 tools / 38,936 chars / 6,709
tokens; arm B 11 resident tools / 15,290 chars / 2,888 tokens, with 34
tools deferred behind describe_tools. That is -3,821 tokens, -57.0% on
the first request. The brief quoted 10,130 -> 4,004 (-60.5%); both are
recorded, and the measured pair is the one this stage will use because
it is what this model is actually billed.

Model runs are blocked. Progressive disclosure needs the tool list to
grow after describe_tools fires, and it cannot through the public API:
openai.ts:268 snapshots toResponseTools(tools) before the loop at 298
and sends that snapshot every iteration, and LlmMessage has no
tool-call or tool-result role, so a harness cannot drive its own
turn-by-turn loop either. The fix is one line in backend/src/lib/llm -
move toResponseTools inside the iteration and read a mutable ref - or a
duplicate provider loop in scripts, which the one-implementation rule
forbids. Reported, not fixed: this stage does not touch backend/src.

Also enforces the Stage 21 lesson. navSchemas() now hashes the exact
schemas about to be sent, --expect-hash refuses to start when they
differ (verified: it aborts with ARM DRIFT), and every row records
schema_hash.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9ToHYJVDxfeJcJwdzrP2H

`routes/chat.ts` hard-coded "read only the needed span with library_read
section=" into the live system prompt for every non-coding session. In the
address arm that instructs the model to use a parameter the arm does not
have. The prompt is part of the surface under test, so it now follows the arm
-- the same fix already applied to buildLeanLibraryBlock and missed here.

The library_read parameters that belong to LEGACY were described as
"Deprecated: use at='pdf:N'", and library_links / library_outline told the
model about `library_read section=`. Each arm strips the other's parameters,
so a deprecation pointer is both pointless and a leak: it teaches arm A about
a parameter arm A cannot call. Every parameter now describes itself.

Verified per arm rather than by eye: no resident tool in either arm carries
the other arm's parameter names, and no description matches the other arm's
vocabulary. The single hit is library_lookup.page, which is the citation
organ's own locator API -- identical in both arms, so it cannot confound the
comparison.

1,251 tests pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9ToHYJVDxfeJcJwdzrP2H

One document covering the three connected pieces of work, what is verified,
what is not, and where every artifact lives. Written for a reader who was not
here.

Marked explicitly as unverified: the sidecar key fix (bakes were unreachable
from the tool layer because the key included the caller's id; fixed, but the
confirming run did not complete), and the sidecar read path end to end
through library_read / library_links.

Marked explicitly as wrong and unfixed: the citator join, where evidence_ids
carry paragraph pinpoints so keys like rvtak2005bcca293para4 match nothing.
The C4 conclusion that citator witnesses are "unjoinable on this bed" is a
defect in our key normalisation, not a fact about the data.

Also records the claim that reversed: the address grammar alone costs 14.6%
MORE than the surface it replaces, and progressive disclosure is what pays
for it. An earlier "23% cheaper" came from a partial run with three changes
bundled.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9ToHYJVDxfeJcJwdzrP2H

Consumers-only experiment on the markdown-e2e surface: derive the .docx
section tree at ingest with existing detectors (extractDocxBodyStructure ->
compileAgreementSkeleton) and prepend a compact SECT-INDEX to the served
markdown so the model can orient and read selectively instead of whole-reading.

Design (measured): the markdown already states top-level section numbers in
its headings and pandoc does not flatten subsections ((a) items are literal
docx text); the only identity the markdown lacks is the COMPOSED subsection
label (Section 2.01(a)), which the skeleton derives. Inline markers would
duplicate headings and add tokens without reducing reads; the index carries
the derived tree once (~5.2k tokens on a 146k-char credit agreement, 310
sections) and is the only form that enables targeted reads.

Silo: one flag (MIKE_STRUCTURE_INDEX), one new module (structureIndexExperiment),
one gated branch in the docx read path, one prompt const + delta, one arm entry.
No detector or write-grammar changes; markdown body byte-identical off-arm.
localAssistantTools.ts staged hunks only (concurrent citator session edits in
that file left unstaged).

Co-Authored-By: Claude <noreply@anthropic.com>

The index arm's surface conformance reads surface.structure_index from the
backend's benchmark_surface event; the field was only on the harness's own
report, so mike_markdown_e2e_index_v1 failed conformance with undefined!==true.
Co-Authored-By: Claude <noreply@anthropic.com>

The index arm's scoped read_document/fetch_documents variants were only in
the harness's surface.tools; the backend derives activeTools from
LOCAL_ASSISTANT_TOOLS, which selected the frozen upstream schemas for the
markdown arms. The model therefore saw whole-read-only tools, hit the 64k
tool-result cap on a 146k-char agreement with no offset to continue, and
could not draft. Register MARKDOWN_INDEX_LAB_TOOLS when STRUCTURE_INDEX_ENABLED.

Co-Authored-By: Claude <noreply@anthropic.com>

The backend LAB preflight (chat.ts:1156) compares active tool names in exact
order. MARKDOWN_INDEX_LAB_TOOLS built via filter-then-append placed
read_document/fetch_documents after find/list, failing the preflight with
'Mike LAB surface leaked or drifted'. Replace in place instead.

Co-Authored-By: Claude <noreply@anthropic.com>

The trial showed the model whole-reads and then gets cut mid-analysis by the
per-response output cap before drafting. Enforce the scoped workflow:
- read_document/fetch_documents in the index arm refuse non-scoped calls
  (typed refusal: provide offset/max_chars or head/tail; head shows the index).
- deepseek: pass low/medium reasoning_effort through (was high/max only) and
  make the per-response output cap configurable via MIKE_DEEPSEEK_MAX_TOKENS
  (index arm sets 65536 so heavy section analysis finishes before drafting).

Co-Authored-By: Claude <noreply@anthropic.com>

- structureIndexExperiment: index lines anchor into the served markdown and
  emit @N body offsets (line-anchored display for article/section/schedule,
  parent-relative enum token for subsections). Verified on the covenants docx:
  309/310 spine lines anchored, 0 bad slices.
- localAssistantTools: servedDraftingText shares one served-text computation
  between read_document and find_in_document (find-plane change gated on the
  index flag only, so e2e/markdown-swap arms keep the plaintext find surface);
  offset/max_chars windows are body-relative under the index arm; scoped-only
  refusals harmonized to head:20 + @N.
- upstreamMikeBenchmarkSurface: orient-first prompt is now batching-aware and
  points at the @N offsets.
- deepseek: snapshot the tool list once per tool-loop so the serialized prefix
  stays byte-stable across rounds (prefix-cache identity).

Co-Authored-By: Claude <noreply@anthropic.com>

Adversarial-audit fixes for the derived-section-index LAB arm.

F1 deepseek: restore per-round resolveTools (was snapshot-once, which broke
   the reveal-on-next-round contract every other adapter honors). Prefix-cache
   identity is on serialized bytes, so per-round resolution is cache-neutral.
F2 structureIndexExperiment: enum tokens and the heading-fragment fallback are
   now LINE-ANCHORED, so an unescaped (x) in body prose can never win over the
   real heading. Covenants docx: 5/174 bad subsection anchors -> 0; 8.01(e)(i)
   now anchored.
F3 localAssistantTools: read_document evidence segments are now body-relative
   (subtract bodyOffset), matching find_in_document's body plane so the harness
   unions one coordinate space instead of inflating exposure ~2x.
F4 prompts/schema/refusals: drop the unsatisfiable "read head: 20" guidance;
   orient by reading the WHOLE index (head: 200-400); index-arm read_document/
   fetch_documents schemas no longer claim unscoped reads return full text;
   the scoped-read refusal is conditional on an index actually being present.
F5 localAssistantTools: memoize servedDraftingText per (documentId, versionId)
   within a turn to avoid re-running docx extraction + skeleton + index render
   on every read/find call.
F6 structureIndexExperiment: require a heading-ish continuation after a
   top-level display, so "Section 2.01(a) provides..." never anchors the parent.
F7 structureIndexExperiment: per-display cursor so duplicate displays in
   amended/restated docs anchor at distinct occurrences.

No detector touched. Flag-gated on MIKE_STRUCTURE_INDEX=1; body byte-identical
with the flag off. tsc clean; deepseek 4/4, structureIndexExperiment 10/10,
localToolWiring pass; covenants anchor probe PASS.

Co-Authored-By: Claude <noreply@anthropic.com>

The SECT-INDEX arm's entire first wave served the plain upstream prompt:
MARKDOWN_E2E_INDEX_LAB_SYSTEM_PROMPT was only referenced from the
--preflight-only branch, and chat.ts had no STRUCTURE_INDEX_ENABLED prompt
branch (receipt system_prompt_sha256 byte-identical across index/e2e/control
on every task). Wire the prompt into the chat.ts LAB prompt selection, factor
armExpectedSurface()/inventoryPromptFor() out of the preflight, and make the
markdown-arm conformance block assert the receipt's system_prompt_sha256
against sha256(expected prompt + inventory) - a hard throw on any future
prompt miswiring. Sha reproduction verified byte-for-byte against two real
run receipts (EMP control 4d8c68ce, HSR index 2d6b4973 - the latter equal to
the upstream sha, re-confirming the defect).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Audit fix wave A2, four defects from the triple audit:

- head/tail sliced the SERVED plane (index included), so the SECT-INDEX ate
  the head budget - a head:120 fetch once returned 10,723 index chars and 0
  body chars. head/tail now slice the body below the index.
- New index=true scoped mode on read_document/fetch_documents returns exactly
  the SECT-INDEX block (orientation-only, no body evidence); the prompt and
  refusal strings now direct orientation there instead of head:200-400.
- Scoped-only enforcement is now address-aware (indexIsAddressable: >=5
  anchored entries AND >=25% anchored), replacing bodyOffset>0 which forced
  scoped reads on documents with 0-7% usable anchors (4 of 5 HSR docs, the
  EMP redline). fetch_documents gates per document instead of refusing the
  whole batch. Probe on 4 real corpora: memos/playbooks/low-anchor redlines
  read free, well-anchored agreements (77-100%) gate.
- already_read refusal is interval-coverage-based (union over the body span),
  replacing the char-count sum that refused a read while a real 1,000-char
  hole stayed unread (EMP doc-2 [38000,39000)).

MARKDOWN_E2E_INDEX_DELTA bumped to derived-section-index-orient-first-v2.
New bodyPlaneReads.test.ts; 50 tests green across the three suites.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Audit fix wave A3:
- exposedDocumentIds.add moved after the zero-length span guards in both
  exposureMetrics branches - a degenerate (0,0) evidence segment counted a
  document as read (CoC reported 10/19 docs read; true coverage was 9/19).
- unique_source_exposure_ratio denominator now measures the served BODY plane
  per document (pandoc markdown for markdown arms via servedDraftingText, now
  exported; SECT-INDEX excluded) instead of the plaintext extraction plane.
  The cross-plane ratio shipped impossible values (1.021, 1.017); numerator
  and denominator now share one coordinate space, so ratio <= 1 by
  construction. Per-doc served_body_chars added to source receipts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Judge/scoring/adapter spawned `claude -p` with the parent env intact, so a
run launched from a `deepclaude` shell inherited ANTHROPIC_BASE_URL +
ANTHROPIC_AUTH_TOKEN and left the flat-rate subscription entirely: DeepSeek
mapped the unknown id `claude-opus-5` onto its flagship and billed
deepseek-v4-pro. Measured on the Aug 3-4 rounds: ~3,074 calls, ~110M input
tokens, cache_read=0 (every `claude -p` is a fresh process, so nothing
cached). The deepclaude flash pins never applied - ANTHROPIC_DEFAULT_*_MODEL
remaps aliases, and these call sites pass explicit full model ids.

- utils/claude_cli.py: new. auth_isolated_env() (mirrors claudeP.ts),
  resolve_cli(), run()/run_json(), and verify_served_model() - which fails
  loudly when a non-Anthropic model appears in the result envelope's
  modelUsage, catching the next leak whatever its mechanism.
- judge.py, scoring.py: spawn via claude_cli; verify every envelope.
  ForeignModelError is a RuntimeError so the ValueError retry loops cannot
  swallow it and retry at the proxy's expense; scoring.py re-raises it past
  its broad except rather than degrading it to "matching failed".
- adapters/claude_code.py: was stripping only ANTHROPIC_API_KEY, which left
  the routing vars intact; now uses the shared isolated env and verifies the
  streamed result envelope.

Verified: with a full deepclaude-style env poisoned in the parent, both
claude_cli.run_json and Judge(claude-code/...) are served by
claude-sonnet-4-6 / provider=firstParty.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvZhii5uiXxeUbJHxcdfd8

Audit fix wave A6:
- run_eval gains --judge-samples K (writes scores.k1..kK.json, skips
  existing samples), --out-suffix, and --force; an existing scores file is
  never overwritten without --force. Re-judging used to clobber scores.json
  in place, which destroyed the prior sample and made judge-only variance
  unmeasurable.
- New evaluation/aggregate_judgments.py: per-criterion majority verdicts
  across samples + flip telemetry (n_flipping_criteria, criterion_flip_rate
  - the judge noise floor). Refuses cross-judge aggregation.
- scoring.py records deliverable resolution method per deliverable
  ("exact" / "sole_extension" / "fuzzy:<overlap>" / "llm" / "unmatched")
  into scores.json - an unmatched deliverable mass-fails every criterion
  tied to it and was previously invisible.
- Env hygiene was already handled by utils/claude_cli.py (auth-isolated
  spawns + served-model verification); no change needed there.

tests/test_scoring.py updated for the tuple return; 29 pass (6 prior errors
are a machine-local pytest basetemp permission issue, green with --basetemp).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Phase C cells: {whole-e2e, scoped-index} x {current prompt, +completeness
floor}. New arms mike_markdown_e2e_floor_v1 and
mike_markdown_e2e_index_floor_v1 - ONE delta vs their parent arms: the
COMPLETENESS block appended to the system prompt, verbatim from
LEAN_BATCH_LAB_SYSTEM_PROMPT (the only arm ever carrying a completeness
clause; best-ever 59/65 on covenants). Mechanism-only, no task enumeration.

Wiring: MIKE_COMPLETENESS_FLOOR flag + two prompt consts in the surface
module; chat.ts prompt ternary handles both floor cells; surface receipt
gains completeness_floor and the markdown conformance block asserts it (plus
the A1 prompt-sha gate, which covers the new prompts automatically);
armEnvironment entries, armExpectedSurface entries, singleInvocationArms,
DOCX gate, unknown-arm message, prompt_variant tags, and floor delta fields
at all three receipt sites. Both arms preflight with distinct prompt shas.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Never compare score totals again: per-criterion majority verdicts across
replicates, McNemar exact binomial per task + pooled (with the
pseudo-replication caveat printed), per-run metrics rows, price-weighted
cost C = uncached + 0.1*cache_read + r*output at r in {1,2,4,6}, and the
deliverable-length/pass-rate correlation (the verbosity confound). Refuses
cross-judge comparisons. Prefers scores.majority.json over scores.json.
Verified against the existing HSR deepseek runs (reproduces the audit's
b=1/c=4, p=0.375 e2e-vs-index contrast).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

One flag (MIKE_UPSTREAM_NATIVE=1) selects the 2266446b project-chat
surface end to end: pinned system prompt (Phase-1 strip-list, hashes in
the surface file), the nine-tool native array in upstream order, the
native AVAILABLE DOCUMENTS block with read-once trailer, native
tool-result envelopes (citationReminder prefix, find {index,excerpt,
context} hits, native already_read payload), maxIterations=10 from the
chat.ts call site, and native ask_inputs turn termination recorded as a
typed receipt (ask_inputs_terminated) instead of being suppressed.

upstreamNativeDocxRenderer.ts ports the pinned sections[]->OOXML
renderer (2266446b documentOps.ts:83-582) and the pinned DOCX read
plane, so read_document, find_in_document, and edit_document all serve
the same characters upstream serves (including upstream's numeric w:t
coercion defect - the arm measures what an upstream user receives).
Native edit_document applies partial-success tracked edits as author
"Mike" and clears the read guard for post-edit verification reads.

Conformance: prompt-sha gate plus a full isolation predicate for the
arm; before/after tool-selection sweep identical across all 14 arms
(zero drift with the flag off); tsc clean at 0 errors.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

- wings-study-design: band-split thesis (output wings on fit, read
  wings/guards on no-fit), signal-gated deployment policy with measured
  thresholds, staged plan (offline replay validation before any quota),
  falsification criteria
- deterministic-wings-inventory: build-state of 10+1 wings, three
  composite gap assessments, doc-vs-code mismatches
- run-mining-signals: 14-task signal table, defect census (verbatim
  omission 31, unresolved xrefs 29, usage-without-definition 71 terms),
  derivation-error rate ~0%, find_in_document quote-grammar failure 7/7
- toy-math-date-tools: accuracy null at ceiling, cost sign flips by
  family (dates 3.5x saving, arithmetic negative), convention-encoding
  lesson

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

- criteria-forensics: 106-miss taxonomy across 11 cells (exposure-gap
  31, synthesis 30, depth 23, judge-strict 20, read-gap 2), DPA
  exposure-gap deep dive, floor mechanism verdicts, two rubric defects
- upstream-mike-native-surface-spec-2266446b: implementation-grade spec
  of the pinned upstream chat surface (verbatim prompts with hashes,
  tool schemas, envelopes, loop mechanics, D1-D12 deviations, build
  plan) backing the mike_upstream_native_v1 arm

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Three wings validated by deterministic replay over the 21 judged cells,
zero model calls:
- legalNegativeAssertionGuard (W4): negative assertions citing unserved
  anchors; 2 firings, both true (banking C-011/C-012 on index_v1),
  silent on all 11 whole-read cells; precision 1.00
- legalFigureReconciliation (W5): competing-base detection; 4/4 true
  findings separating DPA floor/index_floor FAIL cells from PASS cells,
  0 false positives across 3,052 figures (naive signal fires 289 -
  the mechanism ladder is in the report)
- W7 find normalization probe: 7/7 quoted-defined-term queries
  recovered; corpus zero-hit census 16.0% -> 11.7%; second defect
  found: the pandoc markdown plane bolds terms inside quotes, breaking
  the same grammar (fold-both-sides matcher recovers 12/45)

Replay substrate proven byte-exact (131/131 planes, exposure ratios to
4 decimals). Design doc: corrected $210M case attribution (white-collar
DPA, not banking) and folded Stage 0 verdicts + W4 addressability
caveat into §1.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Audit blocker (docs/upstream-native-arm-audit-2026-08-05.md): edit
anchors ran on Beaver's un-coerced parse while reads served the pinned
coerced plane, so a find string copied verbatim from served text failed
(applied=0) wherever upstream succeeds. Fix vendors the pin's own
tracked-edit chain (generator-sliced from git show 2266446b, 31
declarations byte-identical under normalization) into
upstreamNativeDocxRenderer.ts sharing the pinned parser; Beaver's
applyTrackedEdits is untouched for the other arms.

ask_inputs_terminated is now reachable: four blocking throws (two
beyond the audit's list - the askPause guard and the content_reset
isolation term) are exempted for a real native termination, which lands
typed metrics instead of crashing the runner.

Gate hardening: single nativeMaxIterations binding witnessed by both
the receipt and the provider call site; tool_result_max_chars and five
more measured env-derived fields asserted in the isolation predicate.

E1: the three dispatcher-level edit_document validations emit the pin's
bare {error} envelope (no ok key), decided from metadata with the docx
test before the byte load, matching pin order; runEditDocument-stage
failures keep {ok:false,error}. Probe-verified against the pin's own
serialized expressions.

tsc 0 errors; 14-arm preflight identical to pre-build baselines.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Auditor B REFUTE-stance audit of mike_upstream_native_v1 at 010454ea:
10/13 confirmed, 1 blocker (mixed read/edit plane, fixed in b2986cb1),
run-config rule (native cells run --effort high per pin claude.ts:143).
Referenced by the wings design doc and upstream-mike-potential-prs.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Two independent, individually-flagged mechanisms on the e2e chassis:

- MIKE_REQUIREMENTS_ECHO=1: fetch_requirements tool re-serves the task's
  own user message VERBATIM (harness-authored, never model paraphrase)
  plus a read/unread document split from the turn read-state; one prompt
  line instructs one echo before drafting; authoring backstop refuses
  generate_docx/library_create_docx with a typed error until the echo has
  served (before createLocalDocument, so no bytes, no mutation receipt,
  no terminal-authoring exit). Outcome receipt benchmark_requirements_echo
  {echo_call_count, documents_unread_at_echo} emitted post-turn.
- MIKE_CITATION_CONTRACT=1: prompt-only GROUNDING block; self-limiting
  (drafted-instrument deliverables exempt from citation markers).

Composition order lives in ONE helper (withLabTreatmentPromptAdditions)
called by both chat.ts and the lab-beaver-arm reproducer, so the
prompt-sha gate holds by construction. Treatment arm env = e2e env +
the two flags; completeness floor deliberately OFF (echo supersedes it;
revival = ablation arm if the echo underperforms).

Own conformance block (family-strictness + echo/citation true +
echo_call_count>=1 hard failure); three delta tags at all receipt sites;
singleInvocationArms + deliverable matrix membership.

Probes: surface 16/16 (both-off byte-identical to e2e base; fixed
echo->GROUNDING order; no benchmark/rubric terms), behavior 22/22
(pre-echo refusal, byte-identical re-serve, real read/unread split,
post-echo authoring, flag-off catalog unchanged), gate probe passes
under the arm's exact merged env, zero-drift sweep across all 15
existing arms, tsc --noEmit clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

C@r previously dropped the cache-write term (uncached + 0.1*reads +
r*output), silently flattering big-prefix arms. Now consumes the metrics'
cache_adjusted_input_token_equivalent (true-uncached + 1.25*writes +
0.1*reads, null unless both cache reporting streams are complete), with a
component-level fallback of the same formula; missing write stream = null
cost, never an estimate. Per-run line prints cacheW.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Showdown forensics (docs/lab-treatment-v2-design-2026-08-06.md) falsified
'echo supersedes floor' (floor recovered 7/11 of v1's banking/employment
criterion losses) and exposed a reported-vs-recomputed figures defect plus
in-quote alteration residue. v2 = e2e chassis + completeness floor + echo +
amended GROUNDING (stated-vs-computed figures both labeled, exact in-quote
reproduction with ellipses, title-or-filename attribution, soft-25/hard-40
quote length). Same tool list as v1; contract v1 and v2 mutually exclusive
in the compose helper; own conformance block (floor+contractV2 true, v1
false); delta tags at all three receipt sites. v1 prompt byte-unchanged
(asserted). Preflight green; run at effort high per 2026-08-06 policy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

A provider failure (e.g. claude -p 'Prompt is too long' at the 200K
wall) ends the SSE stream with a typed error event; the route logs and
swallows the exception. The runner ignored that event and died later at
whichever conformance gate tripped first (0 deliverables / no echo), so
main()'s catch classified an untyped gate error instead of recording
context_overflow in run-state.json. Phase D burned 6 cells before this
surfaced; rows retro-typed from their own raw-sse error events with
provenance.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

The CoC index_floor pilot (43/57, the only completion ever on a no-fit
task inside 200K) lost 6 of its 14 misses to explicit deferral language
('recommend full text review of Section 15.4') over unread addressable
sections while holding 55k tokens of headroom. New arm composes the
index_floor chassis with the three treatment mechanisms plus a fourth:
MIKE_NO_DEFERRAL=1 adds a conduct-norm block up top (do not recommend
material for further review; read and analyze it now) and restates it at
draft time inside the fetch_requirements echo payload, beside the
documents_unread list. Prompt composed by the shared helper (sha gate by
construction); tools = index list + fetch_requirements appended last
(server order); own conformance block asserting all six surface flags +
echo-ran; receipts carry no_deferral / index-treatment / chassis deltas
at all three sites. Composition probe 11/11, preflight surface clean,
suites 39/39, tsc clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Two fixes to the arm under development, per Eli 2026-08-06. (1) The
upstream read-once clause inherited by every mike arm fights the scoped
design - trace mining caught a model widening a window specifically to
honor it - so the treatment prompt replaces it with a scoped norm (never
re-request the same bytes; several different windows per document are
normal; size windows to the section). Byte-exact replacement with a
loud module-load assert if upstream rewording ever orphans it; frozen
index arms keep the original clause untouched. (2) Completes the 'no
empty indexes' design: MIKE_INDEX_ATTACH_GATED=1 serves a document as
bare markdown when its derived index carries entries but no usable @N
addresses (20.6% of index bytes corpus-wide were such dead weight);
index=true on gated docs answers with the existing typed no-index note;
read gating unchanged. Surface receipt + conformance carry
index_attach_gated (true for the treatment arm, asserted false across
the frozen index family). Probe 13/13, tsc clean, suites 39/39.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

find_in_document on the served-markdown plane missed 89.4% of
defined-term queries (9,095-query replay over the five no-fit corpora;
92.7% of misses were emphasis asterisks inside the phrase - the corpus
pattern is **"Affiliate"** means, so the model's natural query breaks
on the adjacent bold). MIKE_FIND_QUERY_NORM=1 adds a literal-first
folded pass (emphasis asterisks + pandoc escape backslashes + smart
quotes - the three measured classes and nothing else; dash/invisible
folds recovered zero on 4.46M chars) with hits re-anchored to raw
offsets so at stays composable with read_document windows, labeled
match_mode folded. A residual zero-hit carries the H16' closest-excerpt
suggestion (quoteRepairSuggestion over bounded overlapping body chunks,
per Eli's pointer to the existing did-you-mean) plus retry guidance -
a miss becomes retryable instead of a silent 'term not in document'.
Probe on real apex-msa queries: 8/8 literal misses, 8/8 folded
recoveries, 8/8 raw offsets slice-verified, literal hits byte-identical,
suggestion fires on a garbled query. Receipt find_query_norm asserted
true on the treatment arm, false across the frozen family. 42/42 suites,
tsc clean, preflight sha stable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Fixes #2/#3 of the no-duh list, both flag-gated to the treatment arm
with frozen-family false-asserts. MIKE_TYPED_RANGE=1: a scoped read
whose offset is at/past the body end returns a typed out_of_range
refusal naming the body length instead of an empty payload with ok:true
(a silent lost round in mined traces). MIKE_INDEX_COMPACT_HEADINGS=1:
SECT-INDEX heading tails cut at the first sentence/clause boundary
capped at 40 chars instead of 64 chars of truncated prose - entries are
labels, not quotable summaries; 37% smaller index on the measured doc
with anchors byte-identical. Ungated render byte-identical (frozen
arms). Probe 5/5, tsc clean, suites 39/39.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

The 17-31-54 CoC re-pilot burned its full provider run and then failed the
A1 prompt-sha gate: c709ba6b applied withScopedRereadClause only to the arm
constant (module-private wrapper), while chat.ts composes the served prompt
from env flags and never swapped the clause. The swap is now an option of
withLabTreatmentPromptAdditions - the single helper both the route and the
expectation call - gated on MIKE_SCOPED_REREAD, with a scoped_reread receipt
field asserted true on the treatment arm and false across the frozen index
family. Served-path proof: .tmp-probe-served-prompt-sha.ts boots the real
app with the arm env, forces a free provider failure after benchmark_surface
emission, and matches the served sha to sha256(constant + inventory); the
frozen index_floor arm still hashes to its judged run's receipt.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

A completed two-call indenture envelope (126KB) was discarded because the
model hallucinated {"tool_results":...} + citations after its calls and
first-{..last-} spanned the concatenation. String-aware balanced-prefix
scan recovers the first complete object; accepted only on strict parse +
shape, so truncated and defective-string classes keep their paths.
Probe: real bad reply -> both calls recovered; truncation + dominant-string
regressions unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

MIKE_EXPOSURE_ECHO: fetch_requirements splits allowed docs on the BODY
EXPOSURE plane (delivered intervals past the SECT-INDEX), adds a
documents_oriented_only bucket + explanatory note, and a one-shot
coverage_check refusal at the first authoring call naming unexposed docs.
Motivated by Phase D rows acq 30/64 (12/31 docs index-only at draft,
echo said 2 unread) and tax 39/77 (14/25 unexposed, echo said 0 unread).

v2 arm = frozen v1 env + the flag; same prompt + tool list (payload-only
mechanism, sha gate expects equality). Conformance asserts exposure_echo
per arm (v2 true, frozen family false); receipts gain
documents_oriented_only_at_echo + exposure-echo-v1 delta. Probes: 15/15
behavior checks in both flag states; served-sha gate passes v1 and v2
modes with frozen-floor historical receipt equality intact.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Per Eli: no random/artificial caps. The 300k markdown cap was token policy
at the extraction layer; its throw was swallowed into a silent plaintext
whole-read fallback that cost MORE tokens than the markdown it refused
(antitrust market-data, ~84k tok). Removed - memory stays bounded by the
real package guards (input bytes, entry count, inflated XML bounds); token
exposure is a serving policy. The report now extracts (351k chars, 3.3s)
with an addressable 5.4k index.

Also: pandoc-missing ENOENT no longer misreported as malformed XML
(conversion failures keep naming the part); whole-read budget projects on
the plane actually served (markdown drafting surface when present, not
plaintext); MIKE_SERVE_CONVERSION_NOTES (OFF in all frozen arms) rides
extraction warnings on the FIRST read as a CONVERSION NOTES line at the
citation-reminder layer - coordinates and evidence segments untouched.

Proof: docx conformance 20/20; index+wiring suites 39/39; exposure probe
both flag states; notes probe both flag states on the real warnings doc.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Eli 2026-08-06: assume the coding-agent toolset is strongest if built
right; don't reinvent the wheel. The arm is the frozen lean-batch chassis
(list_documents/Grep/Read/generate_docx - the tool shapes the models were
RL'd on, executors reused verbatim) with exactly two attributable deltas:

1. MIKE_READ_DOCX_MARKDOWN now reaches the coding executors: Glob/Read/
   Grep list, search, and read the pandoc markdown drafting plane (the
   proven token lever), via codingDocument() sharing the per-turn
   drafting cache. file:line coordinates agree arm-wide; slices start
   past any attached SECT-INDEX; non-docx keeps plaintext. No frozen arm
   combines this flag with a coding shape, so the reach is inert there
   (conformance now asserts it per arm).
2. MIKE_CODING_NEUTRAL_PROMPT: the SOURCE WORK navigation prescriptions
   are REMOVED (no read-once, no batch-vs-grep guidance) - run 1 observes
   the model's native pathway choices. Write-side discipline stays:
   grounding/clean-reads, one completeness check, terminal authoring.

Motivation: the v2 exposure-forcing null (acq 26/64, tax 42/77; pooled ~0
vs v1 at +30-50% input) - breadth forcing reshuffles criteria under a
fixed synthesis budget; the live lever is evidence-driven selection.

Proof: plane probe both states (Glob markdown vs plaintext plane; grep
hit -> Read round-trip at the same file:line; hit text verbatim in
pandoc markdown); served-surface probe coding mode 4/4 (sha, flags,
no-prescription assert) + treatment-mode regression 9/9; tsc clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

The child env now resets every treatment/serving mechanism flag ahead of
the per-arm spread (structure index family, floor, echo, contracts,
no-deferral, scoped-reread, exposure echo, markdown plane, neutral
prompt): each is an explicit per-arm opt-in, and an ambient value would
silently change a frozen arm's prompt or serving plane. The lean-family
conformance block gains the system_prompt_sha256 gate (prompt-only
additions leave no tool-list trace) and false-asserts for the six
mechanisms that must stay off across the family - a leaked
STRUCTURE_INDEX turns lean unbounded Reads into scoped_read_required
dead-ends naming tools those arms do not serve.

tsc clean; plane probe (frozen lean plaintext) and coding served-surface
probe (4/4) unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Per Eli: don't defer known-coming work. One flag (MIKE_CODING_PARITY, v2
arm = v1 env + it), frozen surfaces untouched (lean schema byte-equality
suite still green):

- Serves the Claude-Code-shaped surface: Glob (pattern-matched files on
  the served plane), a single file_path Read (always cat -n, 2000-line
  default, CC's read-only-the-part-you-need cue), Grep with -A/-B and
  the trained files_with_matches default - descriptions carry the CC
  efficiency cues the audit found missing; the anti-native batch-read
  invitation is gone (audit F3/F4/F6 + axis 3).
- Executor parity behind the flag: the lean paths[] Read intercept is
  bypassed; ripgrep-legal patterns the JS u-flag rejects retry without
  unicode strictness (F5); -A/-B honored per side in both grep loops
  (F6); provider-materialized {offset:1, limit:1} minima read the
  default window, not one line (F7); route surface-drift guard expects
  the swapped tool list.
- Exposure metrics (all arms, future runs): kind=candidate segments -
  grep/find hits, inventory opening lines - no longer count as exposure
  (F1/F10, the saturated documents_read); tracked separately as
  documents_candidate_only + candidate_span_chars.

Proof: plane probe md/plain/parity all green incl. files_with_matches
default, -A context rows, u-flag fallback match, minima guard (369
lines); served-surface probe v2 6/6 (sha, flags, CC tool list) with v1
5/5 and treatment 9/9 regressions intact; localToolWiring +
structureIndex suites 39/39; tsc clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

v3 (one flag, MIKE_GREP_SECTION_CONTEXT): content-mode grep hits are
preceded by their enclosing SECTION lead rendered as an rg context row
at its real line number - document-true text, quotable, Read-able at
that coordinate. The legal analog of the enclosing symbol a coding
model expects near a hit, made explicit because legal sections outrun
context windows. Resolver is deliberately two-plane (docx detector
nodes anchored into served markdown via new anchoredSectionStarts):
probed 2026-08-06 - the skeleton compiler finds 0 nodes on pandoc
markdown, so a served-plane resolver would silently annotate nothing.
Version-memoized per document; non-docx and failures degrade soft.
Subsections excluded: a hit's own subsection is its neighborhood
already. v3 Grep description documents the rows CC-style; arm =
v2 env + flag; conformance asserts grep_section_context per arm;
fail-closed reset adds MIKE_GREP_SECTION_CONTEXT and the previously
missing MIKE_CODING_PARITY.

Compaction guard (Eli: "make sure that doesn't loop forever"): rounds
are unbounded on non-native arms and each CLI auto-compaction re-opens
window headroom, so thrash is structurally possible. Typed stop at 3
compactions (ClaudePFatalError "compaction_limit", never retried;
runner classifies the terminal status). Real-degradation bound: one
compaction is tolerable lossiness (tax pilot: 1 compaction, completed),
two produced summaries-of-summaries (v1 acq pilot).

Live validation same day: the tax v2 pilot's compaction was detected,
warned, and recorded end-to-end (iteration 6, preTokens 167,683,
context_compaction_count 1 in metrics).

Probes: plane sect 14/14 + parity 14/14 (v2 emits no lead rows -
byte-frozen), served-surface coding3 7/7 / coding2 7/7 / treatment 9/9,
suites 57/57, tsc clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Two pilots (acq v1, tax v2) whole-read into auto-compaction with zero
Grep calls: the surface mechanics work, but nothing marks whole-read
infeasible from where the model sits (no felt cost - compaction rescues
silently) and nothing teaches the strategy switch. v4 makes both
visible, one flag (MIKE_CODING_TOC_FILES):

- Companion .toc virtual files: every docx with an anchorable spine gets
  "<name>.toc" - grep -n convention rows ("LINE:verbatim section lead",
  colon-no-space, document-true text) with a one-line header. Listed by
  Glob with sizes ("*.toc" lists only indexes), served by Read cat-n,
  round-trips (toc 147: -> Read offset=147 -> the same lead). Derived
  metadata: no evidence segments, no body-exposure counting. Orientation
  is demand-paged files, not prompt injection - tool results are not
  sha-gated and body line numbers stay pure. Two-plane resolver
  (anchoredSectionSpine) - skeleton-on-markdown finds 0 nodes.
- CONTEXT BUDGET prompt block (v4 serves the budget variant of the
  neutral prompt): bare-filename file_path, start with Glob (sizes +
  .toc files are in-band), overflow/compaction stated as a true
  environment fact, scoped-read strategy, batch related calls per turn.
  Deliberately window-agnostic - no 200K constants anywhere - so the
  same arm transfers to the Opus 5 A/B (one task) unchanged.
- Route leak-guard: under CC parity "Glob" is a served tool, not a leak
  term; frozen arms keep the original list.

Arm = v3 env + flag; per-arm conformance (coding_toc_files), fail-closed
reset += MIKE_CODING_TOC_FILES, delta tags/clusters wired. Proofs: toc
plane probe 18/18 (round-trip, *.toc filter, v2/v3 emit no .toc),
coding4/3/2 surface probes 8/8, suites 45/45, tsc clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

head_limit was a single corpus-global row accumulator spent in document
order, so one verbose early file drained the whole allowance and every
later file emitted nothing. Measured on the 2026-08-06 CoC run: the model
worked around the starvation by re-issuing one fixed pattern 14 times, one
path= per file, across 4 rounds - 469.5k logical input where the same bytes
in one round cost 258.2k. Round count is the multiplier (confirmed twice:
opus-5 did 32 calls in the same 8 rounds for the same logical input), so
fair allocation here is a round-trip lever, not formatting.

MIKE_GREP_PER_FILE_BUDGET renders each file into its own bucket and splits
head_limit max-min fair after the sweep, once the matching-file count is
known: files wanting less than an even share release the surplus, so a
corpus where only three files match still spends the full budget on those
three. The corpus sweep is never cut short, and truncated buckets are
trimmed back to their last real content row so a dangling section-lead
never reads as a match with no body.

The v5 Grep description states the new semantics - a model that still reads
head_limit as a first-come cap keeps paying for the per-path greps the
mechanism removes. v5 = v4 + this one flag; system-prompt sha is identical
to v4 and only tool_schema_sha256 moves, so the contrast has one lever.
Frozen arms clear the flag explicitly and assert it in conformance.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

v5 prompt = v4 budget block + one routing bullet: corpus-wide Greps early
when facts are scattered, scope Reads to hits. Gated on the existing
MIKE_GREP_PER_FILE_BUDGET flag (no new arm - levers accrete in v5 and get
ablated by analysis). v4-and-below byte-identical (preflight sha 4c5a5353
unchanged); v5 prompt sha now a384a1b3, receipts carry
grep-routing-prompt-v1 delta.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

T1 (coding_markdown_v5 gen-3): one unified CORPUS WORKFLOW block replaces
the budget block + conditional routing line. Each bullet traces to a
measured failure: survey-first unconditional corpus grep (acq + antitrust
+ both pilots ran ZERO greps); cover-everything triage floor (acq left
12/31 docs wholly unexamined with ~70k headroom unused and the missed
criteria's evidence absent from every tool result); full-read-central
past truncation (Pinnacle negative pledge windowed past); note
corpus-gaps (C-058/59 absence misses); verify-at-source (Meridian
90-vs-60-day second-hand assertion error); interactions presented
together (C-027/C-032); anti-anxiety close damps the skip response
without promising compaction (deepseek lane has no compaction valve -
providerForModel(deepseek-*) never arms MIKE_OPENAI_COMPACT_THRESHOLD).

T2 (coding_markdown_v5_echo): identical serving + MIKE_EXPOSURE_ECHO=1 -
the one-shot exposure-accounted unexamined-list echo at generate_docx.
Philosophy contrast (harness measurement vs prompt suggestion) under the
max-3-significantly-different-treatments allowance (2026-08-06).

Freeze: v4-and-below serving untouched (appends only in the surface
file; ternary gated behind MIKE_TRIAGE_WORKFLOW which no frozen arm
sets). Preflight: v5/v5_echo prompt sha 6542264f, tool sha c8859b8e
(tools unchanged); tsc clean. Receipts: triage-workflow-prompt-v1 +
exposure-echo-v1 delta tags; grep-routing tag retired with gen-2.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

deepseek-* judge models ride openai.OpenAI(base_url=DEEPSEEK_BASE_URL
or https://api.deepseek.com, key=DEEPSEEK_API_KEY) with a dedicated
chat-completions evaluator (deepseek has no Responses API): JSON mode
on all attempts but the last, shared _parse_json verdict extraction.
Judge lane directive (Eli, 2026-08-06): judge with deepseek-v4-flash
from here on; claude-judged legacy rows stay as their own stratum.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Correction from Eli: the exposure echo was always meant to live IN the
consolidated arm - testing it as a standalone contrast arm was exactly
the trivial single-lever A/B the no-multiplicative-arms doctrine bans.
coding_markdown_v5_echo is deleted; coding_markdown_v5 now carries
MIKE_EXPOSURE_ECHO=1 (ablation happens via the exposure_echo receipt
flag over run strata, not via forked arms).

Prompt gen-4: the CORPUS WORKFLOW block compressed 5 bullets -> 3
(~40% shorter) keeping every measured directive (survey-first corpus
grep, fair split, scoped reads, bare filenames, batching, coverage
floor, full-central-past-truncation, corpus-gap noting, verify-at-
source, interactions-together, anti-skip damping). Dropped only the
scarcity exposition - foregrounding the budget fed the documented
context-anxiety skip response the block exists to prevent.

Preflight: gen-4 prompt sha 645ef951, tool sha c8859b8e unchanged;
tsc clean. In-flight gen-3 flash rows remain valid no-echo/long-prompt
strata, disambiguated by prompt sha + exposure_echo flag.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

The ambient env carries DEEPSEEK_OCR_KEY, not DEEPSEEK_API_KEY;
deepseek.ts resolves either, so the judge now mirrors that order.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Measured motivation (gen-4 acq/antitrust/tax, 2026-08-07): the exposure
echo refuses the first generate_docx and the only revision path was
re-emitting the entire deliverable - the draft is composed twice (acq:
65k vs gen-3's 41k output tokens), and a full redraft can compress
detail out of draft #1 (tax gen-4: coverage fixed at 25/25 read yet
42/77 - the misses are output-side synthesis, not read-gaps).

MIKE_DRAFT_EDIT=1 (default off, nothing changes when off - flag-off
paths return the identical tool arrays and byte-identical strings):
- A generate_docx refused by the coverage check saves its body as
  "draft.md" (LocalAssistantRequirementsState.draftMarkdown/Title/
  Filename); the refusal text teaches the revision path just-in-time.
- New Edit tool with Claude Code's exact contract (file_path/old_string/
  new_string/replace_all; unique-match or typed refusal). applyDraftEdit
  uses index splicing, never String.replace with a string pattern, so
  $-tokens in legal text stay literal (probed 7/7).
- generate_docx served with markdown optional under the flag: omitting
  it renders the saved draft as edited; re-sending a full body keeps the
  buffer in sync. Same appended-tool pattern as the requirements echo,
  so every existing arm's tool_schema_sha256 is untouched by
  construction. No system-prompt change - the gen-4 prompt sha stands.
- chat.ts flags record gains draft_edit; DRAFT_EDIT_DELTA reserved for
  the arm wiring (separate commit when the gen-4 wave lands, keeping the
  running stratum clean).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Second undici "TypeError: terminated" death tonight (employment gen-4)
happened mid-generation, where the adapter's zero-progress round retry
correctly rethrows (a post-emission retry would duplicate streamed
text into the persisted turn). Cover that gap at the run level: when
the child exits non-zero and its run-state.json carries status
"failed" with a transport-class error, the parent re-execs itself once
with the same --run-id (results dir reused, fresh isolated data home
via the normal env-building path). A marker env caps it at one
relaunch; typed outcomes (context_overflow / quota_exhausted /
compaction_limit) and timeout kills never relaunch. Also: MIKE_DRAFT_EDIT
joins the fail-closed env block (audit F8 doctrine - ambient flags must
not leak into frozen arms), and deepseek.ts joins the harness source
fingerprints beside openai.ts now that it carries retry behavior.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

The first live firing of the relaunch (insurance gen-4, 2026-08-07)
classified the transport death correctly, then hit main's own
refusing-to-reuse-existing-run-directory guard: run dirs are
append-only evidence, so pinning --run-id was wrong by the script's own
doctrine. The relaunch now strips any --run-id and lets the re-execed
parent mint a fresh timestamp; the dead attempt's partial artifacts
stay behind as forensics.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

MIKE_DRAFT_EDIT=1 joins the coding_markdown_v5 env: the echo-refused
generate_docx body persists as draft.md, Edit revises it, and a
markdown-less generate_docx renders the buffer. Motivated by the landed
gen-4 wave: coverage saturated everywhere (tax 12->25 docs) while pooled
quality stayed flat (307/365 vs 308/365) - the residual misses are
output-side synthesis, and redraft-by-re-emission burns ~24k tokens per
run while compressing the deliverable.

Receipts: draft_edit_delta at all three receipt sites; conformance
asserts surface.draft_edit per arm (true on v5, false across the frozen
e2e/index treatment branches) and the v5 resident tool list gains Edit.
Frozen arms are byte-identical: flag-off serves the same array object,
and the child env fail-closed zero still covers every non-v5 arm.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

The gen-5 smoke tripped the chat.ts tool-list guard: it models the
requirements-echo one-tool append but not draft-edit, so the served
[Glob, Grep, Read, generate_docx, Edit] list read as drift. Extend the
expectation the same way the echo does - Edit appended, generate_docx
swapped in place keeping name and position. Flag-off arms unaffected
(guard expectation unchanged when MIKE_DRAFT_EDIT is unset).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Corrects the stratum map from receipts: the 03:15-03:20 cluster is the
gen-3 battery (exposure_echo_delta null, 7 tasks, tax at FULL 25/25
coverage), gen-4 echo rows exist for exactly 5 tasks, DPA/closing have
none. Echo verdict on the pairs: score parity (256/307 vs 257/307),
second-emission output cost on every leg. Records the five-death
transport burst + the three backstop commits and their same-night live
validation, the indenture claude-p 200K-wall death, and the draft-edit
build/flip/leak-guard sequence.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Gen-5 measured Edit 0-for-7: the v1 note induced serial full-reads of
every listed doc followed by a byte-identical buffer render (+277k
cacheadj on tax, +128k on acq vs gen-3). v2 rewords only the
DRAFT_EDIT_ENABLED note - grep/skim for contradictions, Edit to
incorporate, render legitimate without further reads. Shared echo
refusal text byte-identical; receipt delta bumps to draft-edit-v2.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

Eli (2026-08-07): the target loop is draft -> keep -> selective reads
-> precise edits -> render. v2's 'render without further reads is
fine' tail optimized away reads instead of fixing the missing
incorporation; killed before any judged row (its 3 in-flight runs are
killed artifacts). v3 frames the post-draft phase as refinement: check
listed docs selectively, fold each finding in with Edit, render when
the draft reflects the full record. Receipt delta -> draft-edit-v3 so
killed v2 receipts never alias live bytes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

The coding-family Read served body text but never wrote turnReadState,
so splitReadExposure at the generate_docx gate always saw an empty map:
every echo firing tonight was a false refusal listing ALL documents as
'never opened' (verified in tax g5 + acq v3 raw SSE - 25/25 and 31/31
listed with 24 and 31 actually read). The model believed the list and
serially re-read everything: +277k/+128k cacheadj on tax/acq.

Fix: runCodingShapeCall gains turnReadState; the four Read success
paths record served spans as merged intervals (coding plane is
body-only, bodyStart 0). Grep hits and .toc reads stay non-exposure by
doctrine. Echo now fires only on genuine shortfall with a true list;
argless probes at full coverage fall through to the existing typed
invalid-input refusal. Receipt: exposure-echo-v2.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

v3 replicates: acq 58+60 (both above the 56-57 pre-refinement
ceiling) vs tax 48+51 (edits cannot rescue partial-coverage
composition). The acq gains depended on the FALSE refusal capturing
the draft at full coverage - the honest gate would have removed the
checkpoint from exactly those runs. v4 decouples them: the first
bodied generate_docx always pauses once, saving the draft and
reporting coverage honestly (true unread list when short, all-read
confirmation when complete), then the next call renders. Echo-only
arms (no draft-edit) keep pure shortfall-refusal semantics. Gen-7
smoke (employment, pre-v4): honest gate stayed silent at full
coverage, single emission, cacheadj 67.5k = cheapest employment row
of the night.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6

- closing gen-7 30/32 @70.5k (up from g5 27/32@99k, cheaper AND higher)
- insurance gen-7 55/57 @119.4k - column flat across g3->g7 (saturated)
- acq gen-7 rep2 588.4k cacheadj, judge in flight
- cost reporting ON: score @ cacheadj | out | uncached | cache_read
- data-room job retracted (Eli); diligence stays excluded
- whole-read baselines paired onto the 8 fit-band breadth cells

Co-Authored-By: Claude <noreply@anthropic.com>

- real-estate/extract-psa-key-terms/scenario-01 lean 67/75 @78.0k (checkpoint route clean)
- CORRECT: paired baseline arm is mike_upstream_native_v1 (Eli: "more upstream mike baseline, not e2e"); one accidental e2e row kept and labeled as such
- acq gen-7 rep2 59/64 judged - {60,59} mean 59.5, +3-linkage claim on n=2

Co-Authored-By: Claude <noreply@anthropic.com>

- banking-extract (16-40-10): 60/65 @124.5k cacheadj, 3/3 docs
- arbitration (16-51-59): 66/69 @69.5k cacheadj, 5/5 docs, lean plane
- mike_upstream_native_v1 on deepseek flash FAILED (0 tool calls, text-only;
  harness gate refused) - native control unavailable on flash lane
- standing caveat: cacheadj columns use weight 0.1; deepseek true weight 0.02;
  g7-vs-g3 cost ratios @0.02/0.1/0.5 recorded

- eu-ai-act (17-06-56): 63/66 @149.9k cacheadj, 7/7 docs, first 7-doc regulatory-gap cell
- breadth read-out: shape holds across 5 genres (real-estate 67/75, banking 60/65,
  arbitration 66/69, eu-ai 63/66, closing 30/32, insurance 55/57); tax 48/77 is the
  lone genre outlier (quantification criteria, not shape failure)

- mike_upstream_native_v1: raise MIKE_DEEPSEEK_MAX_TOKENS to 65536 (was 32768
  default). Measured 16-42-55: flash + reasoning-max consumed the entire
  32768 per-response budget as reasoning_content and truncated before any
  tool_use, authoring 0/1 deliverables. Headroom makes the native control
  drivable on flash at all; reasoning effort stays max for parity.
- chat.ts sseWrite: append each SSE event line to MIKE_LLM_RAW_SSE_PATH when
  set (per-response append stream, inert otherwise), so a running run's
  raw-sse.txt is tailed live instead of appearing only at the end.
- lab-beaver-arm.ts: set MIKE_LLM_RAW_SSE_PATH = runId/raw-sse.txt in the run
  child-process env (canonical writeFileSync record unchanged).
- scripts/lab-sse-live.ts: tail viewer (reasoning dim/italic, tool calls/results
  labeled, final content plain; --replay for finished runs; --task/--arm pick
  the newest matching run). Verified against an 08-03 closing trace.

First paired native-vs-lean result on flash (same judge): native mike_upstream_native_v1
67/75 @152.2k cacheadj vs lean coding_markdown_v5 67/75 @78.0k. Lean is ~2.1x cheaper
on first-touch (44.4k vs 92.8k uncached) and ~1.95x cheaper on cacheadj at identical
criteria. Cap fix made native drivable on flash; reasoning effort stays max for parity.

- Default mode now auto-attaches to the newest RUNNING run under
  benchmarks/harvey-labs/results/ (raw-sse.txt touched in the last 30s and no
  metrics.json yet) and switches to newer runs as they start, so one viewer
  stays glued to a batch. --once restores the old single-run stop-on-idle
  behavior; --arm/--task filters now work WITH auto-follow (path-separator fix:
  Windows backslashes vs forward-slash task paths).
- --dir <capture-dir> adds a second viewer mode that tails the newest raw-SSE
  file in a non-results capture directory (one file per chat), auto-following
  across files - the 'all other runs' viewer for when the backend is pointed at
  a live SSE capture dir.
- --replay unchanged.

Co-Authored-By: Claude <noreply@anthropic.com>

First two upstream-mike-native controls on the deepseek-v4-flash lane (judged
deepseek-v4-flash). capital-closing first attempt failed the harness gate
(0/1 DOCX - model answered in text without generate_docx); flagged, re-run
queued, judge artifacts removed.

Co-Authored-By: Claude <noreply@anthropic.com>

Record banking-finance/extract-credit-agreement-covenants 55/65 and
capital-markets/compare-closing-documents-against-closing-checklist 29/32
(retry after 0/1 DOCX first attempt) for mike_upstream_native_v1 on
deepseek-v4-flash; mark the capital-closing failure as recovered/stochastic.

Co-Authored-By: Claude <noreply@anthropic.com>

A run-dir timestamp folder being created/deleted between readdir and stat
would throw an uncaught statSync and kill the auto-follow viewer; skip it
instead (the rescan loop picks it up next tick).

Co-Authored-By: Claude <noreply@anthropic.com>

The CODING_TOOL_SHAPE dispatch sent EVERY Edit to runCodingShapeCall,
whose FS resolver cannot see the in-memory draft buffer (draft.md exists
only in requirementsState.draftMarkdown, never on disk). Every gen-7
Edit call therefore returned "File does not exist: draft.md" while the
DRAFT_EDIT handler sat shadowed behind the dispatch's early return -
dead code since the lever commit (6e841c9e) never touched the routing.
Real-path edits keep the FS text-ops surface; draft.md falls through to
the in-memory handler.

Regression test proves the full loop: a bodied generate_docx captures
the draft, Edit("draft.md") mutates it (ok:true, replacements:1), and
generate_docx without markdown renders the edited buffer.

Co-Authored-By: Claude <noreply@anthropic.com>

tax/draft-transfer-pricing-documentation mike_upstream_native_v1 on
deepseek-v4-flash: 40/77 @1.28M tok, 25/25 docs, judged once by
deepseek-v4-flash. Low draw consistent with the tax quantification-criteria
finding (gen-7 48/77), not a new failure mode.

Co-Authored-By: Claude <noreply@anthropic.com>

white-collar-defense-investigations/analyze-counterparty-markup-of-deferred-
prosecution-agreement mike_upstream_native_v1 on deepseek-v4-flash: 43/58
@282.4k tok, 6/6 docs, judged once by deepseek-v4-flash.

Co-Authored-By: Claude <noreply@anthropic.com>

employment-labor/analyze-counterparty-markup-of-executive-employment-agreement
cannot emit exactly one DOCX on mike_upstream_native_v1/deepseek-v4-flash
(harness gate refusal x3). Flagged task-specific blocker; no native baseline
available on flash for this cell. Clean (no judge artifacts).

Co-Authored-By: Claude <noreply@anthropic.com>

The in-memory draft-edit handler was dead from day one: the lever commit
added it without touching the CODING_TOOL_SHAPE dispatch, so every Edit
answered ok:true with "File does not exist: draft.md" and renders used
the un-edited draft. All gen-7 "substantive edits" rows (acq 2, HSR 5,
tax 3, real-estate 3) are false on the edit axis; gains are checkpoint-
only. Fix is 68cce2b4 (route Edit by target); post-fix smoke queued.

Co-Authored-By: Claude <noreply@anthropic.com>

antitrust-competition/analyze-counterparty-markup-of-protective-order recovered
on attempt 2: 43/49 @238.3k tok, 6/6 docs, judged by deepseek-v4-flash. First
stochastic-refusal task to recover, confirming the capital-closing precedent.

Co-Authored-By: Claude <noreply@anthropic.com>

antitrust-competition/prepare-antitrust-risk-assessment mike_upstream_native_v1
on deepseek-v4-flash: 36/95 @355.5k cacheadj-total, 25/25 docs, judged by
deepseek-v4-flash. Native-only (no treatment run exists for this task).

Co-Authored-By: Claude <noreply@anthropic.com>

The gen-7 draft-edit shadowing fix (68cce2b4) made Edit(draft.md) reach the
in-memory handler, but the surface stayed asymmetric: the schema only
advertised "draft.md", multi-draft was impossible, and real-file edits were
reachable but unadvertised. Redesign per Eli:

- requirementsState.draftMarkdown → drafts: Record<string,string> keyed by
  lowercased filename; "draft.md" canonical + per-title aliases
  (draftKeyFor(title)). A second generate_docx refusal preserves earlier
  drafts under their own names.
- Read/Edit/Glob treat drafts exactly like any other file: no in-memory
  backstory in the tool descriptions, draft.md addressable by any name it
  has been saved under. draftTarget computed at the top of the dispatch
  chain so the lean-batch Read handler can't intercept a draft path first.
- Real-file (source) edits go through the normal FS text-ops surface and are
  counted in sourceEditCount - observable behavior, never a hidden path.
- CODING_EDIT_TOOL rewritten dead-simple (plain Claude Code semantics, both
  targets); DRAFT_EDIT_DELTA bumped draft-edit-v4 → draft-edit-v8 (gen-8;
  receipt deltas mark generations, arms don't fork).

Regression test drives the real dispatch end-to-end: bodied generate_docx
captures draft → Read(draft.md) returns buffer → Edit applies (draftEditCount
up, sourceEditCount stays 0) → per-title alias is its own buffer → render
without markdown uses the edited draft → Glob lists canonical + alias and
invents no phantom drafts. tsc --noEmit clean; localAssistantTools 48/49
(the one failure, "keeps oversized research results", is a stale mock broken
at HEAD, confirmed via stash-independent isolation run); libraryApplyTextOps
+ localPdfLookup green.

Co-Authored-By: Claude <noreply@anthropic.com>

tax 19-20-25 (echo-v2 + draft-edit-v8) = 42/77 @634k cacheadj, inside
the g7 fixed-treatment band {38,48}. The 5/5 Edit calls on draft.md all
returned ok=true replacements=1 (vs gen-7's dead chars=29), all 5 edit
bodies probe-verified verbatim in the rendered memo.docx (F-15 initial
probe-miss was the en-dash encoding artifact, not absence). Coverage
gate worked end-to-end: first generate_docx refused naming 9 unread
docs → model read exactly those 9 → 5 Edits → bare re-render via
saved draft.md. Mechanism FIXED AND VERIFIED on a second, harder task;
score verdict score-neutral (consistent with HSR) - the lever still
needs an edit-addressable-miss task (acq-style) to show value.

New evaluation/receipt.py: merges scores.json + metrics.json +
beaver-receipts.json into one receipt; `uv run python -m
evaluation.receipt --run-id <id>` prints it (and writes
receipt.json/txt), `--task <t> [--arm a]` prints the stratum table
with base v5 levers filtered so draft_edit/exposure_echo deltas stand
out. run_eval.py now auto-emits the receipt after every judge (both
K=1 and K>1 majority paths).

Co-Authored-By: Claude <noreply@anthropic.com>

When both MIKE_REQUIREMENTS_ECHO and MIKE_EXPOSURE_ECHO are live, the first
generate_docx refusal now re-serves the verbatim task prompt alongside the
unread-coverage list - one checkpoint serves both "what you haven't read"
and "what the deliverable must contain". The separate requirements pre-refusal
steps aside under the exposure gate so the combo can't double-block the first
authoring call; echoCallCount 0->1 on that first serve records how much
remained unread at it (receipt documentsUnreadAtEcho). A fetch_requirements
call that already ran this turn is never double-paid.

Target: tax's 35 misses are rubric-shaped (quantified risk table, action-item
matrix) - composition choices the model only revisits if the requirements sit
in front of it at the refine checkpoint, not just the record coverage.

Co-Authored-By: Claude <noreply@anthropic.com>

v5 chassis + MIKE_REQUIREMENTS_ECHO=1: fetch_requirements joins the
resident tool set (Glob,Grep,Read,generate_docx,fetch_requirements,Edit),
and under the exposure gate the first generate_docx refusal re-serves the
verbatim task prompt alongside the unread-coverage list (requirements echo
rides the coverage echo). echo_call_count>=1 is asserted post-run so a
completed run with a non-firing gate is typed as a failure, not silently
treated as the mechanism having run.

Delta wiring: coding_markdown_v5_reqecho_v1 joins lean_batch/coding_*/
v5-specific receipt deltas and the requirements_echo_delta include list in
all three receipt blocks (differential lever vs the 8 no-echo v5 tax
strata). tsc --noEmit clean.

The viewer attached to a single pinned run, replayed the full raw-sse (88k
events for a tax run), eagerly built every payload <pre> (including the raw
event JSON whose evidence_spans offset-pair arrays rendered as meaningless
[3335]-style bracket noise on recent treatment arms), and forced one text node
per reasoning_delta (43k nodes). Autoscroll fought the slow load and lost.

- Auto-follow (TUI parity): attach to the newest RUNNING run, switch when it
  finishes/goes quiet; --no-follow pins a historical run.
- Bounded replay: last N events (default 3000) within the last M minutes
  (default 30), both tunable. Attaching to a long/old run never floods the
  client; a finished run past the window shows "no recent events".
- No raw-payload dumps anywhere; tool results are ok/fail + size line with
  lazily expandable content. Kills the evidence_spans bracket-number noise.
- Lazy payload bodies (built on click), coalesced reasoning/content deltas
  (one text node per 150ms, empty deltas skipped), fixed autoscroll.

Interim tool per repo convention; migration path remains Langfuse/OTel.

T2 reqecho contrast arm (coding_markdown_v5_reqecho_v1 @ 20-01-25)
judged deepseek-v4-flash. Mechanism verified: fetch_requirements
re-served the verbatim 202-char task prompt once (echo_call_count 1),
coverage gate fired (9 unread). Score 47/77 = +1.1 vs no-echo v5
deepseek {45,42,53,48,51,38,48,42} - under the ~10-criterion tax
judge-spread floor (d153d596), so a draw. Criteria profile is a
different 47 (+7 wins incl C-001 risk table, -6 losses incl C-030
8/8->fail): run-to-run variance, not a mechanism signature, since
the echoed prompt carries no structural content. Cost +10% cacheadj.
Echo only testable on a requirements-rich prompt; draft-mode stays
parked.

Fix A (the 47/77 reqecho run's failure): fetch_requirements was a tool call the
model could make before the authoring boundary, bumping echo_call_count to 1
and silently suppressing the coverage gate's automatic verbatim echo (the
first generate_docx refusal carried only the unread list, not the task prompt).
Now the tool is served ONLY when the echo is tool-served (the frozen markdown
treatment arms: REQUIREMENTS on, EXPOSURE off). Under the exposure gate (both
live) the echo rides the first generate_docx refusal automatically and the
prompt line describes that mechanism - no roundtrip, no way to pre-empt it.

Fix B: new coding_markdown_v5_reqecho_draft_v1 arm (MIKE_REQECHO_DRAFT_MODE=1).
Same v5 chassis + exposure echo, but the first authoring call serves the
requirements echo BEFORE any draft body is captured - nothing saved, no
refine checkpoint - so the model drafts clean against the verbatim prompt.
echo_call_count 0->1 there, so the normal coverage/refine gate runs un-echoed
on the model's next call. Contrast vs fixed-reqecho isolates echo timing.

Conformance: reqecho arms' expected resident tools drop fetch_requirements
(Glob/Grep/Read/generate_docx/Edit); armExpectedSurface uses the automatic
echo line (exposureEcho:true) and v5 tools; reqecho_draft_mode surface field;
echo_call_count>=1 gate covers both reqecho arms; receipt delta include-lists,
singleInvocationArms, and the docx-authoring list gain the draft arm.

Co-Authored-By: Claude <noreply@anthropic.com>

Fix A (auto-echo, no fetch_requirements roundtrip) and Fix B
(drafting mode, echo before any body captured) both verified live
(echo_call_count=1 each) and judged concurrently on deepseek-v4-flash:
48/77 and 42/77, both inside the no-echo band {38..53}. Roundtrip
was never the problem; the 202-char generic payload has nothing to
steer. Reqecho thread closed on tax.

Co-Authored-By: Claude <noreply@anthropic.com>

The create contract ("a successful call ends the turn", "Create the
requested Word deliverable once") taught single-and-done, which made the
4-DOCX prepare-antitrust task structurally fail the deliverable gate
(authored 1/4). The enforcement layer was never the cap: chat.ts
terminalCreateBatch marks a whole round of create-calls terminal when
every call commits action:created, so N generate_docx calls in one final
response already yield N deliverables. This is a capability fix, not a
treatment arm - levers accrete in place per 2026-08-06.

- CODING_MARKDOWN_LAB_SYSTEM_PROMPT + LEAN_BATCH_LAB_SYSTEM_PROMPT:
  "emit one generate_docx call per requested deliverable - a single
  response may carry several calls - and the turn ends after the batch
  is committed"
- DOMAIN_PROMPTS.output_document: drop "once" -> "each requested
  Word deliverable"
- refine note (draft-edit-v4): single-deliverable requests render the
  saved draft without re-sending; multi-deliverable requests must
  re-send each complete body (the draft buffer holds one document -
  without this, all N docs would clone the last body)
- receipt delta multi_deliverable (multi-deliverable-authoring-v1) on
  the three coding arms; conformance re-derives the expected prompt sha
  from the same constants so the prompt-hash gate stays honest

Co-Authored-By: Claude <noreply@anthropic.com>

DeepSeek charges cache hits at 2% of the miss rate ($0.0028/M vs
$0.14/M - 50x discount), not the Anthropic-style 10% the harness
assumed. Coding arms carry ~3x the cache_read of native (round
re-serving), so the 0.1x rate inflated their cost premium ~5x.

- lab-beaver-arm: lane-aware cacheReadMultiplier (0.02 deepseek,
  0.1 else) in cache_adjusted* and cached_read_multiplier metadata
- lab-compare: recompute deepseek cost from components at 0.02x
  (stored field still bakes old 0.1x into historical runs); model
  derived from run dir slug

Pooled reqecho vs native (5 tasks, 334 criteria): +7 at 1.42x
reported -> 1.20x at the real rate (C@1 729k vs 605k). Score and
wall-clock rows unchanged.

Co-Authored-By: Claude <noreply@anthropic.com>

T1 coding_markdown_v5 now serves CODING_MARKDOWN_TRIAGE_FLOOR_LAB_SYSTEM_PROMPT
= triage prompt + the verbatim LEAN_BATCH completeness clause (one internal
check for issues/parties/dates/numbers/exceptions/conflicts before drafting).
The floor joins the consolidated arm per "levers accrete, analysis ablates";
the completeness_floor receipt flag is the ablation boundary.

Wiring is sha-gate-safe by construction:
- chat.ts triage branch consults COMPLETENESS_FLOOR_ENABLED and serves the
  floor variant when set; the receipt sha covers systemPrompt + inventory.
- armExpectedSurface returns the same floor const, so the preflight/conformance
  sha expectation matches the served prompt exactly.
- conformance: completenessFloorCoding = arm === coding_markdown_v5 replaces
  the hard completeness_floor !== false; T2 (reqecho) stays floor-off so the
  echo contrast is unconfounded.

Verified: tsc --noEmit clean; preflight-only for coding_markdown_v5 registers
with a new floor-wired sha; floor const is exactly base + COMPLETENESS_FLOOR_BLOCK
(243 chars) and differs from the base prompt sha.

Co-Authored-By: Claude <noreply@anthropic.com>
@

coding_markdown_v5_comp: consolidated v5 chassis MINUS the completeness
floor, PLUS MIKE_COMPOSITION_CHECK=1. At the first authoring refine gate,
reconcileFigures() runs over the served evidence plane (turnReadState
intervals sliced from servedDraftingText) vs the captured draft; up to 5
precision-1.00 competingBases findings are appended to the existing
refusal as a COMPOSITION CHECK block. Receipt: composition_check=true on
the surface + post-turn benchmark_composition_check event; conformance
asserts count>=1. Arm registered in armExpectedSurface (non-floor triage
prompt), coding-family gates, delta tags, single-invocation list.

Co-Authored-By: Claude <noreply@anthropic.com>

Correction of the 2026-08-08 arm build: coding_markdown_v5_comp serves the
same floor triage prompt as v5 (MIKE_COMPLETENESS_FLOOR=1 restored in the
arm env; armExpectedSurface now returns CODING_MARKDOWN_TRIAGE_FLOOR_LAB_SYSTEM_PROMPT;
conformance asserts completeness_floor=true for the arm). "No new floor"
meant no separate floor contrast arm - the floor is IN the treatment arm.
Preflight sha for comp now equals v5's floor sha (8ca25bbe...); the wave
runs that served the non-floor prompt are moved aside as contaminated.

Co-Authored-By: Claude <noreply@anthropic.com>

Two concurrent cells dying to TLS resets in the same second both mint the
same 1-second timestamp relaunch dir; the loser threw "refusing to reuse"
and the run was lost (hit 2-for-2 on banking at 8-worker concurrency).
A relaunched run now bumps a -2/-3 suffix until a fresh dir frees up.
Operator-pinned runs keep the strict refuse-to-reuse guard.

Co-Authored-By: Claude <noreply@anthropic.com>