Merge remote-tracking branch 'hf-mcp-test/main' into fix/blueprint-llm-timeout

chat_interface.py

@@ -55,7 +55,7 @@ def _collect_run_findings(controller, results: dict | None = None) -> list:
     Module-level and getattr-based on purpose: the completion record is built
     for bare controller stubs in tests as well as the real interface.
     """
-    from demoprep_app.quality.findings import Finding
+    from demoprep_app.quality.findings import Finding, dedupe
 
     found = list(
         getattr(controller, "_run_findings", None)
@@ -67,7 +67,9 @@ def _collect_run_findings(controller, results: dict | None = None) -> list:
             found.append(raw if isinstance(raw, Finding) else Finding.from_dict(raw))
         except Exception:
             continue
-    return found
+    # One record per (code, table, measure) whichever stage noticed it; the
+    # post-load record wins (quality.findings.dedupe).
+    return dedupe(found)
 from supabase_client import load_gradio_settings, get_admin_setting, inject_admin_settings_to_env
 from main_research import MultiLLMResearcher, Website
 from demo_personas import (
@@ -3967,6 +3969,7 @@ LegitData will generate realistic, AI-powered data.
             from demoprep_app.integrations.snowflake import (
                 MeasureQualityGateError,
                 apply_measure_omissions,
+                measure_formats,
                 measure_formulas,
                 measure_shares,
                 run_measure_quality_gate,
@@ -3977,6 +3980,10 @@ LegitData will generate realistic, AI-powered data.
             log_progress("Running data-quality gate on measure columns...")
             _dq_formulas = measure_formulas(self._demo_bundle) if self._demo_bundle else {}
             _dq_shares = measure_shares(self._demo_bundle) if self._demo_bundle else {}
+            # The blueprint's declared fmt / signed per measure, so the gate
+            # infers the same bound the blueprint did (a count or an amount is
+            # non-negative, not "unclassified").
+            _dq_formats = measure_formats(self._demo_bundle) if self._demo_bundle else {}
             _dq_required = sorted({
                 i.measure for i in getattr(self._demo_blueprint, "insights", []) or [] if i.measure
             })
@@ -3992,6 +3999,7 @@ LegitData will generate realistic, AI-powered data.
                     progress_callback=log_progress,
                     formulas=_dq_formulas,
                     shares=_dq_shares,
+                    formats=_dq_formats,
                     required_measures=_dq_required,
                     fact_tables=_dq_facts,
                 )
@@ -4011,9 +4019,12 @@ LegitData will generate realistic, AI-powered data.
                     _slog.log("deploy", "data quality gate failed", error=str(e))
                 try:
                     from demoprep_app.quality.findings import Finding as _Finding
-                    _gate_findings = list(getattr(self, "_build_findings", []) or []) + [
-                        _Finding.from_dict(d) for d in e.profile.get("findings", [])
-                    ]
+                    from demoprep_app.quality.findings import dedupe as _dedupe_findings
+                    _gate_findings = _dedupe_findings(
+                        list(getattr(self, "_build_findings", []) or []) + [
+                            _Finding.from_dict(d) for d in e.profile.get("findings", [])
+                        ]
+                    )
                 except Exception:
                     _gate_findings = []
                 self._surface_findings(
@@ -4065,9 +4076,14 @@ LegitData will generate realistic, AI-powered data.
                 from pathlib import Path as _Path
 
                 from demoprep_app.integrations.snowflake.quality_gate import gate_findings
+                from demoprep_app.quality.findings import dedupe as _dedupe_findings
                 from demoprep_app.quality.findings import write_findings
 
-                _all_findings = list(getattr(self, "_build_findings", []) or []) + gate_findings(dq_profile)
+                # One record per (code, table, measure) across the two gates;
+                # the post-load record wins — it carries the observed stats.
+                _all_findings = _dedupe_findings(
+                    list(getattr(self, "_build_findings", []) or []) + gate_findings(dq_profile)
+                )
                 self._run_findings = list(_all_findings)
                 if _all_findings:
                     _fpath = write_findings(
@@ -4285,7 +4301,7 @@ Tables: Created and populated
                 # Auth a deployer so we can pass ts_client to MCP
                 ts_client = ThoughtSpotDeployer(ts_url, ts_user, ts_secret)
                 if not ts_client.authenticate():
-                    raise ValueError("ThoughtSpot authentication failed.")
+                    raise ValueError(ts_client.auth_failure_message())
 
                 llm_model = self.settings.get('model', DEFAULT_LLM_MODEL)
 

demo_builder_class.py

@@ -196,7 +196,9 @@ class DemoBuilder:
                 for remove_word in ["Home", "Welcome", "Official Site", "Website"]:
                     name = name.replace(remove_word, "").strip()
                 if name:  # Only return if we got something useful
-                    return name[:30]  # Limit length
+                    # 30 cut "OMERS Administration Corporation" to "…Corporati"
+                    # on every record of the run (findings triage 2026-10-15, F).
+                    return name[:80].strip()
         
         # Fallback to domain name (user's original input like "Amazon.com" -> "Amazon")
         domain = self.company_url.replace("https://", "").replace("http://", "").replace("www.", "").split("/")[0]

demoprep_app/dataset/contracts.py

@@ -18,6 +18,16 @@ class DatasetColumn:
     #: The measure this one is generated as a fraction of (blueprint share_of),
     #: so PART <= WHOLE by construction. Read by the post-load part/whole check.
     share_of: str | None = None
+    #: The blueprint's declared format ("int" | "currency" | "float" | "pct"),
+    #: whether the measure may legitimately be negative, and "base" | "derived".
+    #: Empty / False for non-measure columns. The post-load quality gate reads
+    #: these (quality_gate.measure_formats) so it infers the same bound the
+    #: blueprint and the engine did: without the format every integer count and
+    #: every money column came back unclassified and was posted as a
+    #: vocabulary gap (~600 of 662 Slack warnings, 2026-10-12..15).
+    fmt: str = ""
+    signed: bool = False
+    measure_kind: str = ""
 
 
 @dataclass(slots=True)

demoprep_app/dataset/engine.py

@@ -77,6 +77,11 @@ class BlueprintEngine:
         #                           finding can state the expected range and the
         #                           suggested fix rather than just a row count
         self._bound_specs: dict[str, MeasureBound] = {}
+        #   _bound_measures[name]   the measure itself, so a pile-up's suggested
+        #                           fix can match its CAUSE (a derived ratio
+        #                           whose numerator is sampled independently of
+        #                           its denominator vs a base level set too high)
+        self._bound_measures: dict[str, BlueprintMeasure] = {}
 
     def formula_warnings(self) -> list[str]:
         """One deduplicated line per distinct formula warning, with row counts."""
@@ -151,10 +156,7 @@ class BlueprintEngine:
                         "That flattens the measure on a chart — its formula or its inputs need "
                         "fixing rather than bounding"
                     ),
-                    suggestion=(
-                        f"lower the declared level (params.mean) for {name} or fix the formula's "
-                        "inputs so the values live inside the bound instead of against it"
-                    ),
+                    suggestion=_pileup_suggestion(name, self._bound_measures.get(name)),
                     measure=name,
                     row_share=round(share, 4),
                     extra={"rows_on_bound": hits, "rows": rows},
@@ -165,6 +167,17 @@ class BlueprintEngine:
         """The printed rendering of bound_findings(). The records are the data."""
         return [f.render_line() for f in self.bound_findings()]
 
+    @staticmethod
+    def rows_per_fact(blueprint: DemoBlueprint, row_count: int | None = None) -> int:
+        """How many rows generate() writes to EACH fact for a row-count guidance.
+
+        Exposed so the pipeline can size a planted insight's segment BEFORE
+        generation (DemoBlueprint.ensure_insight_support) with the number the
+        engine will actually use.
+        """
+        total_target = max(500, int(row_count or 5000))
+        return max(500, total_target // max(1, len(blueprint.facts)))
+
     def generate(self, blueprint: DemoBlueprint, row_count: int | None = None) -> DatasetBundle:
         # Validate formulas before generating a single row: a bad formula is a
         # blueprint defect, and failing here names every offender at once
@@ -181,9 +194,9 @@ class BlueprintEngine:
         self._bound_cap_hits = {}
         self._bound_rows = {}
         self._bound_specs = {}
+        self._bound_measures = {}
         rng = random.Random(blueprint.seed or 1)
-        total_target = max(500, int(row_count or 5000))
-        per_fact = max(500, total_target // max(1, len(blueprint.facts)))
+        per_fact = self.rows_per_fact(blueprint, row_count)
 
         dates = _date_spine(blueprint)
         dim_tables = {d.name: self._dimension_table(d) for d in blueprint.dimensions}
@@ -274,6 +287,11 @@ class BlueprintEngine:
             columns.append(DatasetColumn(
                 m.name, m.name.lower(), _sql_type(m), nullable=False,
                 formula=m.formula or None, share_of=m.share_of or None,
+                # The measure's declared semantics travel with the column, so
+                # the post-load gate infers the SAME bound the blueprint did
+                # (quality_gate.measure_formats).
+                fmt=m.fmt or "", signed=bool(getattr(m, "signed", False)),
+                measure_kind=m.kind or "",
             ))
 
         pickers = []
@@ -301,8 +319,9 @@ class BlueprintEngine:
         # Entries are (insight, effective_multiplier).
         insights_by_measure: dict[str, list[tuple[PlantedInsight, float]]] = {}
         for insight in blueprint.insights:
+            drive = _insight_drive(insight)
             if insight.measure in fact_measure_names:
-                insights_by_measure.setdefault(insight.measure, []).append((insight, insight.magnitude))
+                insights_by_measure.setdefault(insight.measure, []).append((insight, drive))
                 continue
             m = measures_by_name.get(insight.measure)
             if m is None or not m.formula:
@@ -310,7 +329,7 @@ class BlueprintEngine:
             base, sign = _pick_sensitivity_base(m.formula, measures_by_name, fact_measure_names)
             if base is None:
                 continue
-            effmult = insight.magnitude if sign > 0 else (1.0 / insight.magnitude if insight.magnitude else 1.0)
+            effmult = drive if sign > 0 else (1.0 / drive if drive else 1.0)
             insights_by_measure.setdefault(base, []).append((insight, effmult))
 
         rows: list[dict[str, Any]] = []
@@ -480,9 +499,12 @@ class BlueprintEngine:
         bound: MeasureBound | None = getattr(measure, "bound", None)
         name = measure.name
         self._bound_rows[name] = self._bound_rows.get(name, 0) + 1
-        if bound is None or bound.gap:
+        # No class matched, the range could not be inferred, or the measure is
+        # signed and has no range by design: nothing to enforce or count.
+        if bound is None or bound.gap or bound.unbounded:
             return value
         self._bound_specs[name] = bound
+        self._bound_measures[name] = measure
 
         numeric = float(value)
         if bound.violates(numeric):
@@ -626,9 +648,33 @@ def _sample_in_band(measure: BlueprintMeasure, rng: random.Random, drive: float)
     return _format_bounded(measure, low + (high - low) * _position_in_band(rng, drive))
 
 
+def _pileup_suggestion(name: str, measure: BlueprintMeasure | None) -> str:
+    """The fix for rows piled on a bound, by CAUSE. The old text said "lower
+    params.mean" for every pile-up — a derived ratio has no params.mean
+    (FILL_RATE, GROSS_MARGIN_RATE, LAKE_CAPACITY_UTILIZATION_RATE; findings
+    triage 2026-10-15, C2)."""
+    if measure is not None and measure.kind == "derived" and measure.formula:
+        return (
+            f"{name} = '{measure.formula}' is clamped at its cap on these rows because its "
+            "numerator is sampled independently of its denominator: declare the numerator "
+            "share_of the denominator in the blueprint (params.low/high as the fraction range) "
+            "so the ratio is inside the bound by construction"
+        )
+    if measure is not None and measure.share_of:
+        return (
+            f"{name} is a share of {measure.share_of} whose params.high reaches the cap — lower "
+            "params.high (and params.low) so the fraction stays inside the bound"
+        )
+    return (
+        f"lower the declared level (params.mean) for {name} or fix the formula's "
+        "inputs so the values live inside the bound instead of against it"
+    )
+
+
 def _date_spine(blueprint: DemoBlueprint) -> list[date]:
-    end = date.today().replace(day=1) - timedelta(days=1)
-    start = end - timedelta(days=int(blueprint.date.months_of_history * 30.44))
+    # The same span DateSpec.span() reports, so blueprint-time window checks and
+    # the generated dates agree to the day.
+    start, end = blueprint.date.span()
     dates: list[date] = []
     if blueprint.date.grain == "month":
         current = start.replace(day=1)
@@ -671,6 +717,17 @@ def _sample(measure: BlueprintMeasure, rng: random.Random) -> float:
     return rng.lognormvariate(mu, sigma)
 
 
+def _insight_drive(insight: PlantedInsight) -> float:
+    """The multiplier the engine applies for an insight: its magnitude, pushed
+    further by `drive_boost` in the insight's own direction (a laggard is pushed
+    DOWN). drive_boost is 1.0 unless the tuning loop raised it for a bounded
+    measure, where more drive moves the row's position in its band and a
+    bigger magnitude would only have moved the pass bar (B2)."""
+    boost = max(float(getattr(insight, "drive_boost", 1.0) or 1.0), 1e-6)
+    magnitude = float(insight.magnitude or 1.0)
+    return magnitude * boost if magnitude >= 1.0 else magnitude / boost
+
+
 def _insight_multiplier(entries, picked: dict[str, str], d: date) -> float:
     """entries: iterable of (insight, effective_multiplier). The effective
     multiplier may differ from insight.magnitude when the insight targets a

demoprep_app/dataset/formula.py

@@ -240,6 +240,23 @@ def validate(formula: str, allowed_identifiers: Iterable[str], *, measure: str =
     allowed = {str(name) for name in allowed_identifiers}
     prefix = f"Measure {measure}: " if measure else ""
 
+    # A formula that is a COPY of another measure — bare (`X`) or dressed as an
+    # arithmetic identity (`X * 1`, `1 * X`, `X / 1`, `X + 0`) — parses,
+    # evaluates and ships a column identical to its source on every row. It is
+    # reported here, before generation, so the repair loop fixes or demotes it:
+    # Humpty Dump's DAYS_ON_SITE = RENTAL_DAYS * 1 (2026-10-13) sailed through
+    # validation, was caught post-load as a mirror, "repaired" by recomputing
+    # the same identity, and dropped as repair_failed — three builds in 70
+    # minutes for one measure.
+    copied = alias_target(formula)
+    if copied:
+        shape = "a bare alias" if copied == (formula or "").strip() else "an arithmetic identity"
+        problems.append(
+            f"{prefix}formula '{formula}' is {shape} of {copied} — it would store a column "
+            f"identical to {copied} on every row. Compute something different from {copied}, "
+            "or drop this measure."
+        )
+
     for node in ast.walk(tree):
         if isinstance(node, ast.Call):
             func = node.func.id.upper() if isinstance(node.func, ast.Name) else ""
@@ -540,17 +557,66 @@ def alias_target(formula: str) -> str:
     demo whose optimisation produces no change has no story at all.
 
     A redundant clamp around a copy is still a copy, so MIN/MAX/ROUND/COALESCE
-    wrapping a single identifier unwraps to that identifier.
+    wrapping a single identifier unwraps to that identifier. So is an
+    arithmetic identity: `X * 1`, `1 * X`, `X / 1`, `X + 0`, `0 + X`, `X - 0`
+    (and nestings of those) all evaluate to X on every row — see
+    _identity_operand.
     """
     try:
         node = parse(formula)
     except FormulaEvaluationError:
         return ""
-    while (isinstance(node, ast.Call) and isinstance(node.func, ast.Name)
-           and node.func.id.upper() in _SIGN_PRESERVING_FUNCTIONS and node.args):
-        non_constant = [a for a in node.args if not isinstance(a, ast.Constant)
-                        and not (isinstance(a, ast.UnaryOp) and isinstance(a.operand, ast.Constant))]
-        if len(non_constant) != 1:
-            return ""
-        node = non_constant[0]
+    while True:
+        if (isinstance(node, ast.Call) and isinstance(node.func, ast.Name)
+                and node.func.id.upper() in _SIGN_PRESERVING_FUNCTIONS and node.args):
+            non_constant = [a for a in node.args if not isinstance(a, ast.Constant)
+                            and not (isinstance(a, ast.UnaryOp) and isinstance(a.operand, ast.Constant))]
+            if len(non_constant) != 1:
+                return ""
+            node = non_constant[0]
+            continue
+        inner = _identity_operand(node)
+        if inner is None:
+            break
+        node = inner
     return node.id if isinstance(node, ast.Name) else ""
+
+
+def _literal(node: ast.AST) -> float | None:
+    """The value of a bare numeric literal node, else None."""
+    if (isinstance(node, ast.Constant) and isinstance(node.value, (int, float))
+            and not isinstance(node.value, bool)):
+        return float(node.value)
+    return None
+
+
+def _identity_operand(node: ast.AST) -> ast.AST | None:
+    """The operand an arithmetic identity leaves unchanged, else None.
+
+    `X * 1`, `1 * X`, `X / 1`, `X + 0`, `0 + X` and `X - 0` evaluate to X on
+    every row. Humpty Dump's DAYS_ON_SITE = RENTAL_DAYS * 1 (2026-10-13) passed
+    validation because RENTAL_DAYS existed, stored a copy, and cost three
+    builds. Only a bare literal counts — `X * (2 - 1)` is left to the post-load
+    mirror check — and a literal in any other role (`X * 2`, `X / 100`) is a
+    real computation.
+    """
+    if not isinstance(node, ast.BinOp):
+        return None
+    left, right = _literal(node.left), _literal(node.right)
+    if isinstance(node.op, ast.Mult):
+        if right == 1.0:
+            return node.left
+        if left == 1.0:
+            return node.right
+    elif isinstance(node.op, ast.Div):
+        if right == 1.0:
+            return node.left
+    elif isinstance(node.op, ast.Add):
+        if right == 0.0:
+            return node.left
+        if left == 0.0:
+            return node.right
+    elif isinstance(node.op, ast.Sub):
+        if right == 0.0:
+            return node.left
+    return None

demoprep_app/dataset/measure_bounds.py

@@ -72,6 +72,8 @@ from demoprep_app.dataset.formula import ratio_pairs
 from demoprep_app.dataset.measure_names import (
     CURRENCY_TOKENS,
     is_flag_column,
+    is_net_name,
+    is_open_ratio_name,
     is_proportion_column,
     is_quantity_unit_name,
     is_score_column,
@@ -88,6 +90,21 @@ from demoprep_app.dataset.measure_names import (
 SCORE_SCALES = (1.0, 5.0, 10.0, 100.0, 850.0, 1000.0)
 SCORE_SCALE_HEADROOM = 1.05
 
+#: Scores whose scale is fixed by what they ARE, keyed on the token in the
+#: name: (low, high). Consulted after a declared params.low/high (the author's
+#: explicit statement) and before the mean ladder. MEDIAN_SAT_SCORE (mean
+#: 1530) fell off the ladder and AVG_GPA landed on 0-5 (findings triage
+#: 2026-10-15, A4). The level disambiguates: SAT under 200 is a satisfaction
+#: score, CSAT above 5 is on a 0-100 scale, GPA above 4 is weighted (0-5).
+NAMED_SCORE_SCALES = {
+    "NPS": (-100.0, 100.0),
+    "CSAT": (1.0, 5.0),
+    "CES": (1.0, 7.0),
+    "GPA": (0.0, 4.0),
+    "SAT": (400.0, 1600.0),
+    "ACT": (1.0, 36.0),
+}
+
 # --- physical / market unit registry ---------------------------------------
 # Keyed on a UNIT token in the name, not on the column name, so any future
 # column carrying the same unit inherits the same bound. Extend this registry
@@ -132,7 +149,14 @@ class MeasureBound:
     """The legal range of a measure, plus how we know.
 
     low/high are inclusive; None means unbounded on that side.
-    kind:   "rate" | "score" | "non_negative" | "physical" | "market"
+    kind:   "rate" | "score" | "non_negative" | "physical" | "market" | "flag"
+            | "signed" — the last is "unbounded BY DESIGN": a variance, a net
+            change, a margin, an `A - B` difference. Both ends open, no gap,
+            `hard=False`, so nothing is clamped or reported. It exists so a
+            caller can tell "this measure has no legal range" from "no class
+            matched this name" (infer_bound returned None): the post-load gate
+            could not, and posted every NET_/MARGIN/VARIANCE column as a
+            vocabulary gap.
     scale:  for a rate, 1.0 or 100.0 — the convention the column uses.
     hard:   True when a value outside the range is semantically impossible
             (a 177% activation rate, a 53 Hz grid). Hard bounds are enforced;
@@ -161,6 +185,12 @@ class MeasureBound:
     def bounded_both_ends(self) -> bool:
         return self.low is not None and self.high is not None and self.gap == ""
 
+    @property
+    def unbounded(self) -> bool:
+        """True for a bound that constrains nothing (kind "signed"): no value
+        can violate it and nothing can pile up on it."""
+        return self.low is None and self.high is None and self.gap == ""
+
     def violates(self, value: float) -> bool:
         if self.gap:
             return False
@@ -209,6 +239,11 @@ class MeasureBound:
             )
         if self.kind == "flag":
             return f"{name} is a *_FLAG column: generate 0/1 only, or drop the _FLAG suffix"
+        if self.kind == "signed":
+            return (
+                f"{name} is a signed quantity ({self.source}) with no semantic range, so there "
+                "is nothing to bound — rename it if it is really a one-sided amount"
+            )
         return SUGGEST_ADD_VOCABULARY.format(name=name)
 
 
@@ -390,6 +425,30 @@ def _is_count_wearing_a_rate_name(fmt: str, scale: float, params: dict | None) -
     return level is not None and level > scale * SCORE_SCALE_HEADROOM
 
 
+def named_score_scale(name: str, params: dict | None) -> tuple[float, float, str] | None:
+    """(low, high, why) when the NAME fixes the score's scale (NAMED_SCORE_SCALES),
+    else None. The declared level rules out the wrong reading of an ambiguous
+    token (SAT the exam vs SAT a satisfaction score)."""
+    toks = tokens(name)
+    numeric = _numeric_params(params)
+    level = numeric.get("mean")
+    if level is None:
+        level = numeric.get("high")
+    for token, (low, high) in NAMED_SCORE_SCALES.items():
+        if token not in toks:
+            continue
+        if token == "GPA" and level is not None and level > 4.0:
+            return 0.0, 5.0, "a weighted GPA is 0-5"
+        if token == "CSAT" and level is not None and level > high:
+            continue            # a 0-100 CSAT: the ladder reads it
+        if token == "SAT" and level is not None and level < 200:
+            continue            # 'SAT' as satisfaction, not the exam
+        if token == "ACT" and level is not None and level > high:
+            continue
+        return low, high, f"{token} is {low:g}-{high:g} by definition"
+    return None
+
+
 def _score_bound(name: str, params: dict | None) -> MeasureBound:
     numeric = _numeric_params(params)
     toks = tokens(name)
@@ -402,6 +461,11 @@ def _score_bound(name: str, params: dict | None) -> MeasureBound:
     if low is not None and high is not None and high > low:
         return MeasureBound(low, high, "score", "range declared in params.low/high", scale=high)
 
+    named = named_score_scale(name, params)
+    if named is not None:
+        low, high, why = named
+        return MeasureBound(low, high, "score", why, scale=high)
+
     mean = numeric.get("mean")
     if mean is None:
         return MeasureBound(
@@ -423,6 +487,20 @@ def _score_bound(name: str, params: dict | None) -> MeasureBound:
     )
 
 
+def _signed_bound(why: str) -> MeasureBound:
+    """The "unbounded by design" answer for a signed quantity.
+
+    A variance, a net change, a margin or an `A - B` difference has no legal
+    range, and that is a CLASSIFICATION, not a gap. infer_bound used to return
+    None for these — the same None as "no class matched" — so the post-load
+    gate posted NET_CASH_FLOW_USD, GROSS_MARGIN, OPERATING_MARGIN and
+    SPEND_VARIANCE_USD as vocabulary gaps on every build that had them
+    (2026-10-12..15). `hard=False` and both ends open, so no layer clamps,
+    reports or piles up on it; see MeasureBound.unbounded.
+    """
+    return MeasureBound(None, None, "signed", why, hard=False)
+
+
 def infer_bound(
     name: str,
     fmt: str = "float",
@@ -431,7 +509,12 @@ def infer_bound(
     signed: bool = False,
     formula: str = "",
 ) -> MeasureBound | None:
-    """The legal range for a measure, or None when nothing about it is bounded.
+    """The legal range for a measure, or None when NO CLASS MATCHED its name.
+
+    None is the "our vocabulary missed this name" answer, reported as
+    `bound_not_inferable`. A measure that has no range BECAUSE of what it is
+    (a variance, a net change, a margin, a difference formula) is not None: it
+    is a `signed` MeasureBound with both ends open — see _signed_bound.
 
     Precedence: a physical/market unit beats a name class (a SPOT_PRICE_EUR_MWH
     is capped by the market, not merely non-negative), then proportion, then
@@ -463,6 +546,16 @@ def infer_bound(
     # (UNIT_MARKET_SHARE = POS_UNITS_SOLD / CATEGORY_TOTAL_UNITS).
     units_cancel = _ratio_units_cancel(formula)
     is_quantity = is_quantity_unit_name(name) and not units_cancel
+    if is_open_ratio_name(name):
+        # A ratio of two different quantities (coverage, combined, turnover,
+        # leverage, book-to-bill): a floor of 0 and NO ceiling, whatever the
+        # declared fmt says. Reading it as a part over its whole pinned a
+        # pipeline coverage ratio at 99.8% (C1, decision 3). `hard=False`: the
+        # floor is reported, never clamped.
+        return MeasureBound(
+            0.0, None, "non_negative",
+            "an open ratio of two quantities — a floor of 0 and no ceiling", hard=False,
+        )
     if (
         (is_proportion_column(name, units_cancel=units_cancel) and not is_quantity)
         or (fmt == "pct" and not is_quantity)
@@ -482,7 +575,14 @@ def infer_bound(
         return _score_bound(name, params)
 
     if name_signed:
-        return None     # a variance/delta/error has no semantic bound
+        # A variance / delta / error has no semantic bound — by design, which
+        # is an answer, not a gap.
+        return _signed_bound(
+            "declared signed in the blueprint" if signed
+            else "named as a signed quantity (a variance, change, margin, flow or error)"
+        )
+    if is_net_name(name):
+        return _signed_bound("a NET_ quantity is the difference of two amounts")
 
     # An explicit token wins over the formula's shape. REVENUE_LEAKAGE_USD was
     # derived as a difference and went negative in 37% of rows; "leakage" is a
@@ -494,18 +594,24 @@ def infer_bound(
             0.0, None, "non_negative", f"'{named[0].lower()}' cannot be negative"
         )
 
-    # Weak, format-derived non-negativity: a count or an amount of money. This
-    # one DOES yield to a formula that is a genuine difference (a profit, a
-    # net change), because the format alone says nothing about meaning.
-    if fmt in ("int", "currency"):
+    # Weak, format-derived non-negativity: a count or an amount of money — by
+    # the declared fmt, or by a currency code in the name (TOTAL_DOLLARS,
+    # ZORKMIDS_CAD: the currency says it is money even when the noun is
+    # unknown). This one DOES yield to a formula that is a genuine difference
+    # (a profit, a net change), because the format alone says nothing about
+    # meaning.
+    currency = next((t for t in toks if t in CURRENCY_TOKENS), "")
+    if fmt in ("int", "currency") or currency:
         if formula:
             from demoprep_app.dataset.formula import is_signed as _formula_is_signed
 
             if _formula_is_signed(formula):
-                return None
-        return MeasureBound(
-            0.0, None, "non_negative", f"a {fmt} measure cannot be negative", hard=(fmt == "int")
-        )
+                return _signed_bound(f"the formula '{formula}' is a difference")
+        if fmt == "int":
+            return MeasureBound(0.0, None, "non_negative", "an int measure cannot be negative", hard=True)
+        why = (f"a {fmt} measure cannot be negative" if fmt == "currency"
+               else f"an amount in {currency} cannot be negative")
+        return MeasureBound(0.0, None, "non_negative", why, hard=False)
 
     return None
 

demoprep_app/dataset/measure_names.py

@@ -271,12 +271,60 @@ _PROPORTION_TOKENS = frozenset({
     "UTILIZATION", "UTILISATION", "OCCUPANCY", "ADHERENCE", "COMPLIANCE",
     "ATTAINMENT", "PENETRATION", "PROBABILITY", "PROB", "PROPORTION",
     "FILLRATE", "COVERAGE",
+    # findings triage 2026-10-15 (A5): THROUGHPUT_EFFICIENCY,
+    # LEAD_ATTRIBUTION_COMPLETENESS, SEAT_AVAILABILITY, FORECAST_ACCURACY,
+    # CUSTOMER_RETENTION, LEAD_CONVERSION and UPTIME are proportions of a whole
+    # (a magnitude unit next to them still wins: FUEL_EFFICIENCY_MPG).
+    "EFFICIENCY", "COMPLETENESS", "AVAILABILITY", "ACCURACY", "RETENTION",
+    "CONVERSION", "UPTIME",
 })
 
+#: Proportion words that are two tokens long. Matched on the underscored name,
+#: since `name_tokens` cannot see a phrase.
+_PROPORTION_PHRASES = ("LOAD_FACTOR", "SELL_THROUGH", "CLICK_THROUGH")
+
+#: A RATIO that legitimately exceeds 1 — a ratio of two different quantities,
+#: not a part over its whole (findings triage 2026-10-15, C1, decision 3: the
+#: `_RATIO` suffix keeps its 0-1 default and these are the veto). Bruker's
+#: PIPELINE_COVERAGE_RATIO was pinned at 99.8% on a shipped board; an insurance
+#: COMBINED_RATIO over 100% IS the story. Consulted only when the name also
+#: says RATIO / MULTIPLE / TURNS, so TURNOVER_RATE (15% of staff) stays a rate
+#: while INVENTORY_TURNOVER_RATIO (5x) is open.
+_OPEN_RATIO_TOKENS = frozenset({
+    "COVERAGE", "COMBINED", "TURNOVER", "LEVERAGE", "MULTIPLE", "MULTIPLES",
+    "TURNS", "CURRENT", "QUICK", "LOSS", "EXPENSE", "SHARPE", "SORTINO",
+})
+_OPEN_RATIO_PHRASES = (
+    "BOOK_TO_BILL", "LTV_CAC", "LTV_TO_CAC", "DEBT_TO", "PRICE_TO", "LOAN_TO_VALUE",
+    "DEBT_SERVICE_COVERAGE", "INTEREST_COVERAGE", "PIPELINE_COVERAGE", "QUOTA_COVERAGE",
+    "INVENTORY_TURNS", "ASSET_TURNS",
+)
+_RATIO_WORD_TOKENS = frozenset({"RATIO", "RATIOS", "MULTIPLE", "MULTIPLES", "TURNS"})
+
 #: A bounded score/index/rating. The RANGE must be declared or come from a
 #: standard scale (measure_bounds owns the scale ladder); there is no universal
-#: default and we do not invent one.
-_SCORE_TOKENS = frozenset({"SCORE", "INDEX", "RATING", "GRADE", "CSAT", "NPS", "CES"})
+#: default and we do not invent one. An explicitly additive shape is never a
+#: score: CSAT_SCORE_SUM is a SUM of scores, a quantity.
+_SCORE_TOKENS = frozenset({"SCORE", "INDEX", "RATING", "GRADE", "CSAT", "NPS", "CES", "GPA"})
+
+#: ISO-4217 codes and the plain words, for the market-price registry in
+#: measure_bounds and as magnitude units below. Five Canadian prospects in
+#: three days (OMERS, Loblaw, Honda Canada, Islamic Relief Canada, Environics)
+#: had every _CAD column unclassified (findings triage 2026-10-15, A3).
+_CURRENCY_CODES = frozenset({
+    "USD", "EUR", "GBP", "CHF", "SEK", "NOK", "DKK", "PLN",
+    "CAD", "AUD", "NZD", "JPY", "INR", "MXN", "BRL", "SGD", "HKD", "ZAR",
+    "DOLLARS", "EUROS", "POUNDS",
+})
+
+#: Physical units that are also non-negative magnitudes (added to both sets).
+_PHYSICAL_UNIT_TOKENS = frozenset({
+    "FT", "FEET", "CM", "MM", "CM2", "M2", "KM2", "ACRES", "HECTARES",
+    "KG", "KGS", "LB", "LBS", "OZ", "BUSHELS", "BARRELS",
+    "MS", "MSEC", "WEEK", "WEEKS", "MONTH", "MONTHS", "YEAR", "YEARS",
+    "MILLIONS", "THOUSANDS", "BILLIONS",
+    "MPG", "KMPL", "MPGE", "RPM", "PSI", "GB", "TB", "MB", "MBPS", "GBPS",
+})
 
 #: Magnitude UNITS. A name carrying one of these is a QUANTITY, not a
 #: proportion, even when it also carries a proportion word: UTILIZATION_HOURS
@@ -287,7 +335,60 @@ _QUANTITY_UNIT_TOKENS = frozenset({
     "MW", "MWH", "KW", "KWH", "GWH", "TONNE", "TONNES", "TON", "TONS",
     "MILE", "MILES", "KM", "LITRE", "LITRES", "LITER", "LITERS", "GALLON",
     "GALLONS", "BBL", "SQFT", "SQM", "UNIT", "UNITS", "HEADCOUNT", "FTE",
-    "USD", "EUR", "GBP", "CHF", "SEK", "NOK", "DKK", "PLN",
+    # basis points are a scaled proportion with neither a 0-1 nor a 0-100
+    # ceiling; as a unit they are left unbounded rather than clamped wrong
+    "BPS",
+}) | _CURRENCY_CODES | _PHYSICAL_UNIT_TOKENS
+
+#: Counts: plural business nouns and the past participles that name a counted
+#: event (ORDERS_SHIPPED, TICKETS_RESOLVED, CASES_PICKED). Until 2026-10-20
+#: there was no count vocabulary at all, so every one of these came back from
+#: the post-load gate as "no bound class matched" (findings triage, A3).
+_COUNT_NOUN_TOKENS = frozenset({
+    "SESSIONS", "ORDERS", "VISITS", "TICKETS", "CASES", "LEADS", "OPPORTUNITIES",
+    "DEALS", "SHIPMENTS", "LOADS", "TRIPS", "CALLS", "MESSAGES", "EMAILS", "CLICKS",
+    "IMPRESSIONS", "VIEWS", "PAGEVIEWS", "DOWNLOADS", "SIGNUPS", "USERS", "CUSTOMERS",
+    "ACCOUNTS", "PATIENTS", "ENCOUNTERS", "ADMISSIONS", "DISCHARGES", "STUDENTS",
+    "APPLICATIONS", "ENROLLMENTS", "EMPLOYEES", "HIRES", "ITEMS", "PRODUCTS", "SKUS",
+    "TRANSACTIONS", "INVOICES", "REFUNDS", "COMPLAINTS", "ESCALATIONS", "RESERVATIONS",
+    "PASSENGERS", "FLIGHTS", "ROOMS", "NIGHTS", "STAYS", "GUESTS", "DELIVERIES",
+    "PICKUPS", "STOPS", "ROUTES", "VEHICLES", "DRIVERS", "ASSETS", "DEVICES",
+    "MACHINES", "CYCLES", "BATCHES", "LOTS", "PALLETS", "CONTAINERS", "PARCELS",
+    "PACKAGES", "EVENTS", "ALERTS", "TASKS", "JOBS", "PROJECTS", "CONTRACTS",
+    "POLICIES", "QUOTES", "BIDS", "SUBMISSIONS", "APPROVALS", "REJECTIONS",
+    "CANCELLATIONS", "RENEWALS", "ACTIVATIONS", "INSTALLS", "SUBSCRIPTIONS",
+    "MEMBERS", "SUBSCRIBERS", "ATTENDEES", "REGISTRATIONS", "APPOINTMENTS",
+    "PROCEDURES", "SAMPLES", "PIECES", "PARTS", "COMPONENTS", "ERRORS", "ISSUES",
+    "LOANS", "TRADES", "LISTINGS", "LEASES", "TENANTS", "PROPERTIES", "BEDS",
+    "SEATS", "SLOTS", "SEARCHES", "QUERIES", "PROMPTS", "TOKENS", "REQUESTS",
+    "LOGINS", "ATTEMPTS", "FAILURES", "RETRIES", "TIMEOUTS", "RELEASES",
+    "DEPLOYMENTS", "VISITORS", "SHOPPERS", "BUYERS", "SELLERS", "VENDORS",
+    "SUPPLIERS", "CARRIERS", "PICKS", "SCANS", "RETURNS_COUNT",
+})
+_COUNT_EVENT_TOKENS = frozenset({
+    "CREATED", "RESOLVED", "SHIPPED", "PICKED", "PACKED", "OPENED", "CLOSED",
+    "SUBMITTED", "APPROVED", "REJECTED", "RETURNED", "CANCELLED", "CANCELED",
+    "COMPLETED", "DELIVERED", "PROCESSED", "HANDLED", "BOOKED", "FILLED",
+    "CONVERTED", "WON", "LOST", "ESCALATED", "ENROLLED", "HIRED", "TERMINATED",
+    "STARTED", "FINISHED", "PLACED", "RECEIVED", "SENT", "VISITED", "ATTENDED",
+    "REGISTERED", "ACTIVATED", "CHURNED", "RENEWED", "ISSUED", "PAID", "SOLD",
+    "SERVED", "DISPATCHED", "LOADED", "UNLOADED", "INSPECTED", "REPAIRED",
+    "TESTED", "PASSED", "SCHEDULED", "LAUNCHED", "SIGNED", "ONBOARDED",
+    "ANSWERED", "ABANDONED", "FULFILLED", "INSTALLED", "DISCHARGED", "ADMITTED",
+})
+
+#: Amounts of money, by noun. COGS, GMV, AUM, COMMISSION, DISCOUNT, FARE, MSRP,
+#: ASP, BUDGET, PAYROLL ... were all unclassified before 2026-10-20 (A3).
+_MONEY_NOUN_TOKENS = frozenset({
+    "COGS", "GMV", "AUM", "VALUE", "COMMISSION", "COMMISSIONS", "DISCOUNT",
+    "DISCOUNTS", "FARE", "FARES", "INCENTIVE", "INCENTIVES", "MSRP", "ASP",
+    "CAPITAL", "INCOME", "PIPELINE", "RESERVES", "COMPENSATION", "SAVINGS",
+    "AID", "BUDGET", "PAY", "PAYROLL", "SURCHARGE", "SURCHARGES", "TARIFF",
+    "TARIFFS", "TOLL", "TOLLS", "LTV", "CAC", "REIMBURSEMENT", "REIMBURSEMENTS",
+    "WAGES", "SALARY", "SALARIES", "RENT", "DEPOSIT", "DEPOSITS", "DONATIONS",
+    "GRANTS", "FUNDING", "SUBSIDY", "SUBSIDIES", "REBATE", "REBATES", "ROYALTY",
+    "ROYALTIES", "TUITION", "PREMIUMS", "PAYOUT", "PAYOUTS", "DISBURSEMENTS",
+    "PROCEEDS", "EARNINGS", "TURNOVER", "GTV", "TPV",
 })
 
 #: Quantities that cannot be negative: money spent/lost, counts, durations.
@@ -304,7 +405,7 @@ _NON_NEGATIVE_TOKENS = frozenset({
     "REVENUE", "SALES", "BILLINGS", "BOOKINGS", "PAYMENTS", "COLLECTIONS",
     "PRICE", "AMOUNT", "CHARGES", "PREMIUM", "CLAIMS", "HEADCOUNT",
     "CAPACITY", "INVENTORY", "STOCK", "TONNES", "TONS", "KWH", "MWH",
-})
+}) | _COUNT_NOUN_TOKENS | _COUNT_EVENT_TOKENS | _MONEY_NOUN_TOKENS | _PHYSICAL_UNIT_TOKENS
 
 #: A measure that may legitimately go negative: a variance, an error, a net
 #: change. These VETO the non-negative class and widen a proportion to
@@ -316,8 +417,14 @@ _SIGNED_TOKENS = frozenset({
     "PNL", "PL", "BALANCE", "FLOW",
 })
 
+#: A LEADING "NET" makes a quantity a difference by definition — NET_INCOME,
+#: NET_CASH_POSITION, NET_ENROLLMENT — whatever token follows. Position
+#: matters, and it is consulted only for a measure that is neither a proportion
+#: nor a score (NET_COLLECTION_RATE is a 0-1 rate), so it never widens a rate.
+_SIGNED_LEADING_TOKENS = frozenset({"NET"})
+
 #: Currencies, for the market-price registry in measure_bounds.
-CURRENCY_TOKENS = frozenset({"EUR", "USD", "GBP", "CHF", "SEK", "NOK", "DKK", "PLN"})
+CURRENCY_TOKENS = _CURRENCY_CODES
 
 _CAMEL_BOUNDARY = re.compile(r"(?<=[a-z0-9])(?=[A-Z])")
 _NON_ALNUM = re.compile(r"[^A-Za-z0-9]+")
@@ -372,10 +479,15 @@ def is_proportion_column(column_name: str, *, units_cancel: bool = False) -> boo
     UNIT_MARKET_SHARE = POS_UNITS_SOLD / CATEGORY_TOTAL_UNITS is a share of
     units. The price and additive vetoes still apply.
     """
+    if is_open_ratio_name(column_name):
+        return False        # a ratio of two different things has no whole
     if is_rate_column(column_name):
         return True
     toks = name_tokens(column_name)
-    if not _has_token(_PROPORTION_TOKENS, toks):
+    normalized = f"_{_normalize(column_name)}_"
+    if not _has_token(_PROPORTION_TOKENS, toks) and not any(
+        f"_{phrase}_" in normalized for phrase in _PROPORTION_PHRASES
+    ):
         return False
     # The same two vetoes `is_intensive_measure` applies, from the same
     # predicates: a price that happens to contain "rate", and an explicitly
@@ -405,8 +517,31 @@ def rate_scale_for_name(column_name: str) -> float:
     return 1.0
 
 
+def is_open_ratio_name(column_name: str) -> bool:
+    """True for a RATIO of two different quantities, which legitimately exceeds 1.
+
+    PIPELINE_COVERAGE_RATIO (3.2x), COMBINED_RATIO (104%), INVENTORY_TURNOVER_RATIO
+    (5x), BOOK_TO_BILL, LTV_CAC, DEBT_TO_EQUITY_RATIO, CURRENT_RATIO. These keep
+    the `_RATIO` AVERAGE aggregation (is_rate_column is untouched) but take a
+    floor of 0 and no ceiling instead of the 0-1 default — reading them as a
+    part over its whole pinned Bruker's pipeline coverage at 99.8% on a shipped
+    board (findings triage 2026-10-15, C1).
+    """
+    normalized = f"_{_normalize(column_name)}_"
+    if any(f"_{phrase}_" in normalized for phrase in _OPEN_RATIO_PHRASES):
+        return True
+    toks = name_tokens(column_name)
+    return _has_token(_RATIO_WORD_TOKENS, toks) and _has_token(_OPEN_RATIO_TOKENS, toks)
+
+
 def is_score_column(column_name: str) -> bool:
-    """True for a bounded score/index/rating (the RANGE lives elsewhere)."""
+    """True for a bounded score/index/rating (the RANGE lives elsewhere).
+
+    An explicitly additive shape (_SUM, _TOTAL, TOTAL_, _COUNT) is never a
+    score: CSAT_SCORE_SUM is a sum of 1-5 ratings, a quantity with no scale.
+    """
+    if is_explicitly_additive_name(column_name):
+        return False
     return _has_token(_SCORE_TOKENS, name_tokens(column_name))
 
 
@@ -415,6 +550,24 @@ def is_signed_name(column_name: str) -> bool:
     return _has_token(_SIGNED_TOKENS, name_tokens(column_name))
 
 
+def is_net_name(column_name: str) -> bool:
+    """True when the NAME opens with NET: the difference of two amounts, so it
+    may legitimately be negative. Consulted by measure_bounds.infer_bound only
+    for a measure that is neither a proportion nor a score."""
+    toks = name_tokens(column_name)
+    return bool(toks) and toks[0] in _SIGNED_LEADING_TOKENS
+
+
 def non_negative_tokens_in(column_name: str) -> list[str]:
-    """The tokens that say this measure cannot be negative, in name order."""
-    return [t for t in name_tokens(column_name) if t in _NON_NEGATIVE_TOKENS]
+    """The tokens that say this measure cannot be negative, in name order.
+
+    A SUM / TOTAL / COUNT of scores or ratings (CSAT_SCORE_SUM) is a quantity:
+    the additive token is the evidence, unless the score is an NPS, whose sum
+    can be negative.
+    """
+    toks = name_tokens(column_name)
+    found = [t for t in toks if t in _NON_NEGATIVE_TOKENS]
+    if (not found and is_explicitly_additive_name(column_name)
+            and _has_token(_SCORE_TOKENS, toks) and "NPS" not in toks):
+        found = [t for t in toks if t in ("SUM", "TOTAL", "COUNT")] or ["SUM"]
+    return found

demoprep_app/dataset/validator.py

@@ -26,15 +26,30 @@ from demoprep_app.scenario.blueprint import DemoBlueprint, PlantedInsight
 # An effect must realize at least this fraction of its promised magnitude
 # to count as demo-visible (noise eats some of it; that's fine).
 MIN_REALIZED_FRACTION = 0.5
+# Rows needed on EACH side of an insight's comparison before it can be
+# measured at all. Below this the check is not "weak", it is unmeasurable
+# (findings triage 2026-10-15, B3) — the blueprint sizes segments to clear it
+# before generation (DemoBlueprint.ensure_insight_support).
+MIN_ROWS_PER_SIDE = 20
 
 
 @dataclass(slots=True)
 class InsightCheck:
     insight_id: str
     passed: bool
+    #: target / baseline as measured in the generated rows
     observed_ratio: float
+    #: the pass bar: 1 + (promised - 1) x MIN_REALIZED_FRACTION — NOT the promise
     required_ratio: float
     detail: str
+    #: the magnitude the blueprint stated (before any tuning boost)
+    promised_ratio: float = 0.0
+    #: "above baseline" (outlier, > 1) or "below baseline" (laggard, < 1)
+    direction: str = ""
+    #: False when the comparison could not be made at all (too few rows on a
+    #: side, an unknown insight type) — `observed_ratio` is then meaningless
+    #: and the finding is `insight_unmeasurable`, not `insight_weak`
+    measurable: bool = True
 
 
 @dataclass(slots=True)
@@ -89,6 +104,9 @@ class ValidationReport:
     def failed_insights(self) -> list[InsightCheck]:
         return [c for c in self.insight_checks if not c.passed]
 
+    def unmeasurable_insights(self) -> list[InsightCheck]:
+        return [c for c in self.insight_checks if not c.measurable]
+
     def warning_findings(self) -> list[Finding]:
         return [f for f in self.findings if f.severity == "warning"]
 
@@ -98,8 +116,11 @@ class ValidationReport:
         lines += [f"  formula: {e}" for e in self.formula_errors]
         lines += [f"  range: {e}" for e in self.range_errors]
         for c in self.insight_checks:
-            status = "ok" if c.passed else "WEAK"
-            lines.append(f"  insight {c.insight_id}: {status} observed={c.observed_ratio:.2f} required={c.required_ratio:.2f} ({c.detail})")
+            status = "ok" if c.passed else ("UNMEASURABLE" if not c.measurable else "WEAK")
+            lines.append(
+                f"  insight {c.insight_id}: {status} observed={c.observed_ratio:.2f} "
+                f"required={c.required_ratio:.2f} promised={c.promised_ratio:.2f} ({c.detail})"
+            )
         return "\n".join(lines)
 
 
@@ -170,21 +191,59 @@ def _record_findings(report: ValidationReport) -> None:
             ),
         ))
     for check in report.failed_insights():
+        if not check.measurable:
+            # Not a weak effect — no effect could be measured. A distinct code,
+            # with the cause, so it is never read as "the chart is subtle".
+            report.findings.append(Finding(
+                code="insight_unmeasurable",
+                severity="warning",
+                stage="validation",
+                message=f"planted insight {check.insight_id} could not be measured — {check.detail}",
+                suggestion=(
+                    "raise mix_weight for the target dimension value, or move window_start "
+                    "inside the generated history (its last third), so both sides of the "
+                    f"comparison have at least {MIN_ROWS_PER_SIDE} rows"
+                ),
+                observed="not measurable",
+                expected=f">= {MIN_ROWS_PER_SIDE} rows on each side",
+                extra={
+                    "insight_id": check.insight_id,
+                    "promised_ratio": check.promised_ratio,
+                    "direction": check.direction,
+                },
+            ))
+            continue
+        # The message states all four numbers a reader needs, in the right
+        # roles. It used to print required_ratio as "the N it promised", which
+        # for a laggard read backwards: "realized 0.83 of the 0.69 it promised"
+        # meant "needed <= 0.69 (the blueprint promised 0.38), got 0.83" — a
+        # segment 17% below baseline where the story needs 62%. Nine of forty
+        # such lines (2026-10-12..15) looked like false positives and were not.
+        laggard = check.direction == "below baseline"
+        bar = "<=" if laggard else ">="
         report.findings.append(Finding(
             code="insight_weak",
             severity="warning",
             stage="validation",
             message=(
-                f"planted insight {check.insight_id} realized {check.observed_ratio:.2f} of the "
-                f"{check.required_ratio:.2f} it promised ({check.detail})"
+                f"planted insight {check.insight_id} realized {check.observed_ratio:.2f}x "
+                f"baseline; needed {bar} {check.required_ratio:.2f}x to pass, "
+                f"promised {check.promised_ratio:.2f}x ({check.direction or 'direction unknown'}) "
+                f"— {check.detail}"
             ),
             suggestion=(
                 "raise the insight's magnitude or the mix_weight of its target dimension value "
                 "so the chart is visibly different from the baseline"
             ),
-            observed=f"{check.observed_ratio:.2f}",
-            expected=f"{check.required_ratio:.2f}",
-            extra={"insight_id": check.insight_id},
+            observed=f"{check.observed_ratio:.2f}x baseline",
+            expected=f"{bar} {check.required_ratio:.2f}x (promised {check.promised_ratio:.2f}x)",
+            extra={
+                "insight_id": check.insight_id,
+                "observed_ratio": check.observed_ratio,
+                "required_ratio": check.required_ratio,
+                "promised_ratio": check.promised_ratio,
+                "direction": check.direction,
+            },
         ))
 
 
@@ -384,6 +443,16 @@ def _check_insight(
     promised = insight.magnitude
     laggard = promised < 1.0
     required = 1.0 + (promised - 1.0) * MIN_REALIZED_FRACTION  # works for both directions
+    # What the blueprint PROMISED, for the report: the magnitude as authored,
+    # not the figure the tuning loop has boosted it to.
+    authored = insight.authored_magnitude if insight.authored_magnitude is not None else promised
+    direction = "below baseline" if laggard else "above baseline"
+
+    def check(passed: bool, observed: float, detail: str, *, measurable: bool = True) -> InsightCheck:
+        return InsightCheck(
+            insight.id, passed, observed, required, detail,
+            promised_ratio=authored, direction=direction, measurable=measurable,
+        )
 
     start = _safe_date(insight.window_start)
     end = _safe_date(insight.window_end)
@@ -432,15 +501,17 @@ def _check_insight(
         ]
         detail = "window vs rest of history"
     else:
-        return InsightCheck(insight.id, False, 0.0, required, f"unknown insight_type {insight.insight_type}")
-
-    if len(target) < 20 or len(others) < 20:
-        return InsightCheck(
-            insight.id, False, 0.0, required,
-            f"too few rows to demo ({len(target)} target / {len(others)} baseline) — "
-            f"raise mix_weight for {insight.dimension_value} or widen the window",
+        return check(False, 0.0, f"unknown insight_type {insight.insight_type}", measurable=False)
+
+    if len(target) < MIN_ROWS_PER_SIDE or len(others) < MIN_ROWS_PER_SIDE:
+        return check(
+            False, 0.0,
+            f"too few rows to demo ({len(target)} target / {len(others)} baseline; each side "
+            f"needs {MIN_ROWS_PER_SIDE}) — raise mix_weight for {insight.dimension_value} or "
+            "move the window inside the data span",
+            measurable=False,
         )
 
     observed = mean(target) / mean(others) if mean(others) else 0.0
     passed = observed <= required if laggard else observed >= required
-    return InsightCheck(insight.id, passed, observed, required, detail)
+    return check(passed, observed, detail)

demoprep_app/integrations/snowflake/__init__.py

@@ -5,6 +5,7 @@ from demoprep_app.integrations.snowflake.quality_gate import (
     MeasureQualityGateError,
     ZeroMeasureError,
     apply_measure_omissions,
+    measure_formats,
     measure_formulas,
     measure_shares,
     run_measure_quality_gate,
@@ -13,6 +14,7 @@ from demoprep_app.integrations.snowflake.quality_gate import (
 __all__ = [
     "populate_dataset_bundle",
     "run_measure_quality_gate",
+    "measure_formats",
     "measure_formulas",
     "measure_shares",
     "apply_measure_omissions",

demoprep_app/integrations/snowflake/quality_gate.py

@@ -77,6 +77,7 @@ from demoprep_app.dataset.measure_names import (  # noqa: F401  (re-exported)
     default_aggregation,
     is_flag_column,
     is_intensive_measure,
+    is_open_ratio_name,
     is_rate_column,
 )
 
@@ -91,6 +92,7 @@ from demoprep_app.dataset.measure_bounds import (
 from demoprep_app.quality.findings import Finding
 from demoprep_app.dataset.formula import (
     FormulaEvaluationError,
+    alias_target as formula_alias_target,
     identifiers as formula_identifiers,
     to_sql as formula_to_sql,
 )
@@ -222,6 +224,31 @@ def measure_shares(bundle: Any) -> dict[str, str]:
     return shares
 
 
+def measure_formats(bundle: Any) -> dict[str, dict[str, Any]]:
+    """{"TABLE.COLUMN": {"fmt": ..., "signed": ..., "kind": ...}} for every
+    measure column of a DatasetBundle — the blueprint's own declarations, as
+    the engine stamped them on the columns.
+
+    The sibling of measure_formulas / measure_shares. The post-load gate feeds
+    `fmt` and `signed` to infer_bound so a loaded SESSIONS (int) or COGS
+    (currency) is classified non-negative exactly as the blueprint classified
+    it, instead of coming back "no bound class matched".
+    """
+    formats: dict[str, dict[str, Any]] = {}
+    for table in getattr(bundle, "tables", []) or []:
+        for column in table.columns:
+            fmt = getattr(column, "fmt", "") or ""
+            kind = getattr(column, "measure_kind", "") or ""
+            if not fmt and not kind:
+                continue    # a key, a date, an attribute
+            formats[f"{table.name}.{column.name}"] = {
+                "fmt": fmt,
+                "signed": bool(getattr(column, "signed", False)),
+                "kind": kind,
+            }
+    return formats
+
+
 def apply_measure_omissions(bundle: Any, omissions: Iterable[Mapping[str, str]]) -> list[str]:
     """Remove omitted measure columns from an in-memory DatasetBundle.
 
@@ -356,23 +383,50 @@ def _mirror_defects(
     for idx, (col, other, sign) in enumerate(candidates):
         differing = int(row[idx] or 0)
         if differing == 0:
+            formula = formulas.get(f"{table_name}.{col}", "")
+            detail, suggestion = _mirror_explanation(table_name, col, other, sign, formula)
             defects.append({
                 "table": table_name,
                 "column": col,
                 "defect": "mirrors_other_column",
-                "detail": (
-                    f"every row equals {'-' if sign < 0 else ''}{other} — the formula's other "
-                    f"input resolved to nothing"
-                ),
-                "suggestion": (
-                    f"{col}'s formula references an identifier that is not a measure of "
-                    f"{table_name}; fix the formula's inputs in the blueprint so it computes "
-                    "something other than a copy of another column"
-                ),
+                "detail": detail,
+                "suggestion": suggestion,
             })
     return defects
 
 
+def _mirror_explanation(table_name: str, col: str, other: str, sign: int, formula: str) -> tuple[str, str]:
+    """(detail, suggestion) for a mirrored column, by CAUSE.
+
+    Two different mistakes produce a mirror, and the old text ("references an
+    identifier that is not a measure of this table") described only the second
+    — and was wrong for Humpty Dump's DAYS_ON_SITE = RENTAL_DAYS * 1, whose
+    identifier existed:
+
+      identity   the formula IS the other column (X, X * 1, 1 * X, X / 1,
+                 X + 0): nothing to recompute, the measure is a duplicate
+      hollow     the formula's OTHER input(s) contributed nothing — all-zero,
+                 or an identifier the engine resolved to nothing — so
+                 ACTUAL - FORECAST stored -FORECAST
+    """
+    signed_other = f"{'-' if sign < 0 else ''}{other}"
+    if formula_alias_target(formula) == other:
+        return (
+            f"every row equals {other} — the formula '{formula}' is an identity of {other}",
+            f"{col} = '{formula}' is a copy of {other}, so it is a duplicate tile, not a "
+            f"measure: give {col} a formula that computes something different from {other} in "
+            f"the blueprint, or drop {col}",
+        )
+    others = sorted(formula_identifiers(formula) - {other})
+    inputs = ", ".join(others) if others else "its other input"
+    return (
+        f"every row equals {signed_other} — the formula's other input(s) ({inputs}) contributed "
+        "nothing (all-zero, or not a measure of this table)",
+        f"{col} = '{formula}': {inputs} must exist in {table_name} and vary — fix those inputs "
+        f"in the blueprint so {col} computes something other than a copy of {other}, or drop {col}",
+    )
+
+
 def _part_whole_defects(
     cursor: Any,
     schema_name: str,
@@ -380,6 +434,7 @@ def _part_whole_defects(
     stats: dict[str, dict],
     formulas: Mapping[str, str],
     shares: Mapping[str, str],
+    formats: Mapping[str, Mapping[str, Any]] | None = None,
 ) -> list[dict]:
     """part > whole for every PART / WHOLE pair a ratio formula implies.
 
@@ -402,7 +457,11 @@ def _part_whole_defects(
         tbl, _, ratio_col = key.partition(".")
         if tbl != table_name:
             continue
-        ratio_bound = semantic_bound(ratio_col, stats.get(ratio_col, {}), formula)
+        declared = (formats or {}).get(key, {})
+        ratio_bound = semantic_bound(
+            ratio_col, stats.get(ratio_col, {}), formula,
+            fmt=str(declared.get("fmt") or ""), signed=bool(declared.get("signed")),
+        )
         for part, whole in part_whole_pairs(formula, ratio_bound, shares=table_shares):
             if part in stats and whole in stats and (part, whole, ratio_col) not in pairs:
                 pairs.append((part, whole, ratio_col))
@@ -435,22 +494,39 @@ def _part_whole_defects(
     return defects
 
 
-def semantic_bound(column_name: str, stats: dict, formula: str = "") -> MeasureBound | None:
-    """The legal range for a loaded column, inferred from its name + profile.
-
-    Post-load we have no blueprint, so the observed AVG stands in for the
-    declared level: it is what tells a 0-100 percentage from a 0-1 rate, and
-    which standard scale a score sits on. fmt is left unknown on purpose — the
-    format-derived "money cannot be negative" class would flag every legitimate
-    negative margin column in the schema.
+def semantic_bound(
+    column_name: str,
+    stats: dict,
+    formula: str = "",
+    *,
+    fmt: str = "",
+    signed: bool = False,
+) -> MeasureBound | None:
+    """The legal range for a loaded column: its name, its declared format and
+    its observed profile.
+
+    Post-load the observed AVG stands in for the declared level: it is what
+    tells a 0-100 percentage from a 0-1 rate, and which standard scale a score
+    sits on. `fmt` and `signed` are the blueprint's own declarations, carried
+    on the DatasetBundle's columns (measure_formats). They used to be withheld
+    here on the theory that format-derived non-negativity "would flag every
+    legitimate negative margin column" — but infer_bound answers the signed
+    classes (the name, the declared flag, a difference formula) BEFORE it reads
+    the format, so withholding it only meant every integer count and every
+    money column came back None and was posted as a vocabulary gap (~600 of
+    662 Slack warnings, 2026-10-12..15). A caller with no bundle still gets
+    the name-only answer.
     """
-    return infer_bound(column_name, "", {"mean": stats.get("avg")}, formula=formula)
+    return infer_bound(
+        column_name, fmt or "", {"mean": stats.get("avg")}, signed=signed, formula=formula
+    )
 
 
 def _column_defects(
     table_name: str,
     stats: dict[str, dict],
     formulas: Mapping[str, str] | None = None,
+    formats: Mapping[str, Mapping[str, Any]] | None = None,
 ) -> tuple[list[dict], list[str], list[Finding]]:
     """Per-column defects, warnings and structured findings from the profile.
 
@@ -460,6 +536,7 @@ def _column_defects(
     strings are their rendering.
     """
     formulas = formulas or {}
+    formats = formats or {}
     defects: list[dict] = []
     warnings: list[str] = []
     findings: list[Finding] = []
@@ -494,14 +571,20 @@ def _column_defects(
                     f"generate {col} as 0/1 only, or drop the _FLAG suffix if it is really a count"
                 ),
             })
-        semantic = semantic_bound(col, s, formulas.get(f"{table_name}.{col}", ""))
+        declared = formats.get(f"{table_name}.{col}", {})
+        semantic = semantic_bound(
+            col, s, formulas.get(f"{table_name}.{col}", ""),
+            fmt=str(declared.get("fmt") or ""), signed=bool(declared.get("signed")),
+        )
         if semantic is None:
             # No bound class matched this name, so NOTHING could be range-checked.
             # That is the "our inference missed a vocabulary" signal; it is not a
-            # defect in the data, and it is not silently ignored either.
+            # defect in the data, and it is not silently ignored either. Severity
+            # `info` (boone 2026-10-20): recorded, rolled up in Slack, never a
+            # warning per measure.
             findings.append(Finding(
                 code="bound_not_inferable",
-                severity="warning",
+                severity="info",
                 stage="post_load",
                 message=f"no bound class matched {col}, so no range was checked for it",
                 suggestion=suggestion_for_unclassified(col),
@@ -515,7 +598,7 @@ def _column_defects(
             )
             findings.append(Finding(
                 code="bound_not_inferable",
-                severity="warning",
+                severity="info",
                 stage="post_load",
                 message=f"{semantic.gap} — no bound could be checked for this column",
                 suggestion=semantic.suggestion or semantic.suggest_fix(col),
@@ -670,7 +753,14 @@ def _repair_statements(
         ))
         return statements
 
-    # all_zero / constant / mirrors_other_column: only a formula can fix these.
+    if defect["defect"] == "mirrors_other_column":
+        # Never "repair" a mirror by recomputing it: the column IS its formula
+        # over these inputs, so the recompute reproduces the copy, the re-profile
+        # still mirrors, and the run posts repair_failed on top of the mirror
+        # (Humpty Dump, 2026-10-13: three builds in 70 minutes on one measure).
+        # A mirror is a blueprint defect; _OMIT_WORTHY drops the column.
+        return []
+    # all_zero / constant: only a formula can fix these.
     return recompute()
 
 
@@ -761,7 +851,9 @@ def _run_semantic_checks(
     for table_name, column_name, data_type in rows:
         dt = data_type or ""
         rng = bounded_range_for_column(column_name)
-        if rng and is_measure_column(column_name, dt):
+        # An open ratio (coverage, combined, turnover) keeps the _RATIO
+        # aggregation but has no ceiling — never report it "outside [0, 1]".
+        if rng and is_measure_column(column_name, dt) and not is_open_ratio_name(column_name):
             bounded.setdefault(table_name, []).append((column_name, rng[0], rng[1]))
         if is_month_bucket_column(column_name, dt):
             month_cols.setdefault(table_name, []).append(column_name)
@@ -1052,6 +1144,7 @@ def run_measure_quality_gate(
     shares: Optional[Mapping[str, str]] = None,
     required_measures: Optional[Iterable[str]] = None,
     fact_tables: Optional[Iterable[str]] = None,
+    formats: Optional[Mapping[str, Mapping[str, Any]]] = None,
     repair: bool = True,
     drop_unrepairable: bool = True,
 ) -> dict:
@@ -1064,6 +1157,10 @@ def run_measure_quality_gate(
         measure_shares(bundle). The structural half of the part <= whole
         check: a declared part is verified against its whole, and a declared
         part in a ratio's denominator is never read as a part of its numerator.
+    formats: {"TABLE.COLUMN": {"fmt", "signed", "kind"}} — see
+        measure_formats(bundle). The blueprint's declared format and sign for
+        each measure, so the range check classifies a count or an amount the
+        way the blueprint did instead of reporting it as unclassified.
     required_measures: measure names (bare or "TABLE.COLUMN") the brief's core
         claim depends on — the planted insights' measures, the headline of the
         story. The gate hard-fails when ANY of them ends up unusable, or when
@@ -1100,6 +1197,7 @@ def run_measure_quality_gate(
 
     formulas = dict(formulas or {})
     shares = dict(shares or {})
+    formats = dict(formats or {})
     required = {str(m).upper() for m in (required_measures or ())}
 
     cursor = connection.cursor()
@@ -1167,14 +1265,15 @@ def run_measure_quality_gate(
                     "avg": stats["avg"],
                 }
             column_defects, column_warnings, column_findings = _column_defects(
-                table_name, table_profile["columns"], formulas
+                table_name, table_profile["columns"], formulas, formats
             )
             profile["defects"].extend(column_defects)
             profile["warnings"].extend(column_warnings)
             profile["findings"].extend(f.to_dict() for f in column_findings)
             profile["defects"].extend(
                 _part_whole_defects(
-                    cursor, schema_name, table_name, table_profile["columns"], formulas, shares
+                    cursor, schema_name, table_name, table_profile["columns"], formulas, shares,
+                    formats,
                 )
             )
             profile["defects"].extend(
@@ -1260,11 +1359,14 @@ def run_measure_quality_gate(
                     "max": stats["max"],
                     "avg": stats["avg"],
                 }
-            column_defects, _, _ = _column_defects(table_name, table_profile["columns"], formulas)
+            column_defects, _, _ = _column_defects(
+                table_name, table_profile["columns"], formulas, formats
+            )
             remaining.extend(column_defects)
             remaining.extend(
                 _part_whole_defects(
-                    cursor, schema_name, table_name, table_profile["columns"], formulas, shares
+                    cursor, schema_name, table_name, table_profile["columns"], formulas, shares,
+                    formats,
                 )
             )
             remaining.extend(

demoprep_app/pipeline/build_demo.py

@@ -29,11 +29,11 @@ import hashlib
 from dataclasses import dataclass, field
 
 from demoprep_app.dataset.contracts import DatasetBundle
-from demoprep_app.dataset.engine import BlueprintEngine
-from demoprep_app.dataset.formula import FormulaEvaluationError
+from demoprep_app.dataset.engine import POSITION_SWING, BlueprintEngine
+from demoprep_app.dataset.formula import FormulaEvaluationError, ratio_pairs
 from demoprep_app.dataset.validator import ValidationReport, validate_bundle
 from demoprep_app.ddl import DatasetDdlCompiler
-from demoprep_app.quality.findings import Finding, blocking, send_blocking
+from demoprep_app.quality.findings import Finding, blocking, dedupe, send_blocking
 from demoprep_app.scenario.blueprint import DemoBlueprint
 from demoprep_app.scenario.blueprint_author import LLMResponseTruncated, author_blueprint
 from demoprep_app.scenario.contract import ScenarioContract
@@ -43,6 +43,15 @@ from demoprep_app.scenario.contract import ScenarioContract
 MAX_TUNING_ROUNDS = 3
 # When an insight is too weak, multiply its distance-from-1.0 by this.
 BOOST_FACTOR = 1.6
+# A BOUNDED measure (a rate, a score, a share) is pushed in its band instead:
+# PlantedInsight.drive_boost grows by BOOST_FACTOR per round up to this.
+MAX_DRIVE_BOOST = 4.0
+# The share of a band's theoretical delivery (position 0.5 -> 0.5 +/-
+# POSITION_SWING) a promise may claim; grouped means never reach the asymptote.
+BAND_DELIVERY_MARGIN = 0.9
+# Two rounds whose weak insights realized ratios this close are the same
+# round: the boost had no effect, so stop (the rounds are deterministic).
+STALL_TOLERANCE = 0.005
 # How many times we repair a formula the engine refused to compute and try
 # again. Formula validation at blueprint time should make this dead code; it
 # exists so an unforeseen formula failure costs one measure, not the demo.
@@ -182,6 +191,18 @@ def build_demo(
             + (", ".join(directives.prohibited_terms) or "none")
         )
 
+    # A planted insight needs enough rows on each side to be measured. Size
+    # its segment ONCE, from the row count the engine will actually write,
+    # instead of discovering "too few rows" after a full generation and
+    # bumping mix_weight a round at a time (findings triage 2026-10-15, B3).
+    for fix in blueprint.ensure_insight_support(BlueprintEngine.rows_per_fact(blueprint, row_count_guidance)):
+        progress(f"insight support: {fix}")
+        warnings.append(f"insight support: {fix}")
+        findings.append(Finding(
+            code="insight_support_raised", severity="info", stage="blueprint",
+            message=fix, repair="repaired",
+        ))
+
     # ------------------------------------------------------------------
     # 2. Generate + validate loop (deterministic, in-memory, cheap)
     # ------------------------------------------------------------------
@@ -198,6 +219,7 @@ def build_demo(
     # into the demo, so that goes straight to `findings` and accumulates.
     round_findings: list[Finding] = []
     round_warnings: list[str] = []
+    previous_observed: dict[str, float] = {}
     for round_num in range(1, MAX_TUNING_ROUNDS + 1):
         progress(f"Generating dataset (round {round_num})...")
         round_findings, round_warnings = [], []
@@ -251,16 +273,41 @@ def build_demo(
             break
         if report.range_errors and not report.failed_insights():
             break   # deterministic: another identical round cannot fix a range
-        _boost_weak_insights(blueprint, report)
+        observed_now = {
+            c.insight_id: c.observed_ratio for c in report.failed_insights() if c.measurable
+        }
+        if _tuning_stalled(previous_observed, observed_now):
+            progress(
+                "tuning stalled: the weak insights realized the same ratios as last round, so "
+                "another boost would not move them (the rounds are deterministic)"
+            )
+            break
+        previous_observed = observed_now
+        for note in _boost_weak_insights(blueprint, report):
+            progress(f"insight promise capped: {note}")
+            warnings.append(f"insight promise capped: {note}")
+            findings.append(Finding(
+                code="insight_promise_capped",
+                severity="warning",
+                stage="generation",
+                message=note,
+                suggestion=(
+                    "if the original lift is the point of the story, widen the measure's declared "
+                    "band (params.low/high) or plant it on a measure that is not bounded; "
+                    "otherwise the capped promise is what the chart can honestly show"
+                ),
+            ))
 
     findings.extend(round_findings)
     warnings.extend(round_warnings)
     if report is not None and report.failed_insights():
         warnings.append(
-            "Some planted insights are weaker than promised after tuning; "
-            "the demo will work but those charts may be subtle:\n" + report.summary()
+            "Some planted insights are weaker than promised after tuning (or could not be "
+            "measured); the demo will work but those charts may be subtle:\n" + report.summary()
+        )
+        findings.extend(
+            f for f in report.findings if f.code in ("insight_weak", "insight_unmeasurable")
         )
-        findings.extend(f for f in report.findings if f.code == "insight_weak")
 
     # ------------------------------------------------------------------
     # 3. Derive DDL from the generated dataset (unchanged contract)
@@ -308,22 +355,16 @@ def _record(
 
 
 def _dedupe(findings: list[Finding]) -> list[Finding]:
-    """Identical records = one finding.
-
-    The message is part of the key on purpose: two different statements about
-    one measure at one stage can be two defects (two bounds, two facts). The
-    tuning loop's re-measurements of one defect are not collapsed here — the
-    loop keeps only the round that ships (see build_demo, step 2).
+    """One finding per (code, table, measure) — quality.findings.dedupe.
+
+    The same rule chat_interface applies when it merges these with the
+    post-load gate's records, so a measure flagged at two stages is one
+    finding wherever the list is read. A record with no measure keeps its
+    message in the key (two weak insights are two facts). The tuning loop's
+    re-measurements of one defect are not collapsed here — the loop keeps only
+    the round that ships (see build_demo, step 2).
     """
-    seen: set[tuple] = set()
-    unique: list[Finding] = []
-    for finding in findings:
-        key = (finding.code, finding.stage, finding.table, finding.measure, finding.message)
-        if key in seen:
-            continue
-        seen.add(key)
-        unique.append(finding)
-    return unique
+    return dedupe(findings)
 
 
 def _dedupe_strings(lines: list[str]) -> list[str]:
@@ -384,14 +425,105 @@ def _generate_with_formula_repair(
     )
 
 
-def _boost_weak_insights(blueprint: DemoBlueprint, report: ValidationReport) -> None:
-    """Contract-level cleanup: strengthen only what failed, deterministically."""
-    failed = {c.insight_id for c in report.failed_insights()}
+def _tuning_stalled(previous: dict[str, float], current: dict[str, float]) -> bool:
+    """True when every weak insight both rounds measured realized the same
+    ratio — the last boost changed nothing, so the next one will not either."""
+    common = set(previous) & set(current)
+    if not current or not common:
+        return False
+    return all(abs(current[k] - previous[k]) < STALL_TOLERANCE for k in common)
+
+
+def _band_of(measure, by_name: dict) -> tuple[float, float] | None:
+    """The [low, high] band a measure's rows are placed in, when it has one:
+    a bounded base measure's sampling band, a share_of's fraction range, or
+    the fraction range behind a PART / WHOLE ratio whose part is a share of
+    the whole (the ratio IS the fraction)."""
+    if measure.kind == "base":
+        if measure.share_of:
+            return float(measure.params.get("low", 0.05)), float(measure.params.get("high", 0.85))
+        band = getattr(measure, "band", None)
+        return (float(band[0]), float(band[1])) if band else None
+    pairs = ratio_pairs(measure.formula or "")
+    if len(pairs) == 1:
+        part = by_name.get(pairs[0][0])
+        if part is not None and part.kind == "base" and part.share_of == pairs[0][1]:
+            return float(part.params.get("low", 0.05)), float(part.params.get("high", 0.85))
+    return None
+
+
+def _deliverable_band_ratio(blueprint: DemoBlueprint, insight) -> tuple[float, float] | None:
+    """(floor, cap): the target/baseline ratios a BOUNDED measure can deliver.
+
+    The engine places a bounded measure's rows at a POSITION in its band:
+    the baseline sits near the middle, the strongest drive reaches
+    0.5 + POSITION_SWING (engine._position_in_band). So the biggest lift any
+    promise can produce is (low + 0.9 x width) / (low + 0.5 x width) — on a
+    band of 0.60..0.95 that is 1.35x, whatever the magnitude says. Promising
+    1.6x there and boosting it to 3.7x moved only the pass bar (Spendflo,
+    Verizon; findings triage 2026-10-15, B2). None for an unbounded measure.
+    """
+    fact = blueprint.fact_for_measure(insight.measure)
+    if fact is None:
+        return None
+    by_name = {m.name: m for m in fact.measures}
+    measure = by_name.get(insight.measure)
+    band = _band_of(measure, by_name) if measure is not None else None
+    if band is None:
+        return None
+    low, high = band
+    width = high - low
+    centre = low + 0.5 * width
+    if width <= 0 or centre <= 0:
+        return None
+    top = low + (0.5 + POSITION_SWING) * width
+    bottom = low + (0.5 - POSITION_SWING) * width
+    cap = 1.0 + (top / centre - 1.0) * BAND_DELIVERY_MARGIN
+    floor = 1.0 - (1.0 - bottom / centre) * BAND_DELIVERY_MARGIN
+    return round(floor, 4), round(cap, 4)
+
+
+def _boost_weak_insights(blueprint: DemoBlueprint, report: ValidationReport) -> list[str]:
+    """Contract-level cleanup: strengthen only what failed, deterministically.
+
+    An insight on an UNBOUNDED measure gets a bigger magnitude. One on a
+    bounded measure (a rate, a score, a share) gets its promise CAPPED at what
+    the band can deliver and its drive_boost raised instead — more drive moves
+    the rows' position in the band, while a bigger magnitude only raised the
+    pass bar. Returns one note per capped promise, for the run's findings.
+    """
+    notes: list[str] = []
+    failed = {c.insight_id: c for c in report.failed_insights()}
     for insight in blueprint.insights:
-        if insight.id not in failed:
+        check = failed.get(insight.id)
+        if check is None:
             continue
-        distance = insight.magnitude - 1.0
-        insight.magnitude = round(1.0 + distance * BOOST_FACTOR, 3)
+        if getattr(check, "measurable", True):
+            if insight.authored_magnitude is None:
+                # Keep the promise as the blueprint made it: the validator reports
+                # THAT number, not the boosted one (findings triage 2026-10-15, B1).
+                insight.authored_magnitude = insight.magnitude
+            deliverable = _deliverable_band_ratio(blueprint, insight)
+            if deliverable is None:
+                distance = insight.magnitude - 1.0
+                insight.magnitude = round(1.0 + distance * BOOST_FACTOR, 3)
+            else:
+                floor, cap = deliverable
+                laggard = insight.magnitude < 1.0
+                limit = floor if laggard else cap
+                out_of_reach = insight.magnitude < limit if laggard else insight.magnitude > limit
+                if out_of_reach:
+                    old = insight.magnitude
+                    insight.magnitude = round(limit, 3)
+                    notes.append(
+                        f"insight {insight.id} promised {old:g}x on {insight.measure}, whose band can "
+                        f"deliver at most {limit:.2f}x — promise capped at {limit:.2f}x and the rows "
+                        "pushed further in the band instead"
+                    )
+                insight.drive_boost = round(min(insight.drive_boost * BOOST_FACTOR, MAX_DRIVE_BOOST), 3)
+        # An UNMEASURABLE insight (too few rows on a side) is not a magnitude
+        # problem; boosting it only inflates the promise the report prints.
+        # The mix_weight bump below is the part that can help it.
         # Thin segments can't show an effect no matter the magnitude —
         # give the target value more mix share as well.
         for dim in blueprint.dimensions:
@@ -400,6 +532,7 @@ def _boost_weak_insights(blueprint: DemoBlueprint, report: ValidationReport) ->
             for value in dim.values:
                 if value.name == insight.dimension_value:
                     value.mix_weight = min(value.mix_weight * 1.5, 5.0)
+    return notes
 
 
 # ---------------------------------------------------------------------------

demoprep_app/quality/findings.py

@@ -246,6 +246,54 @@ def send_blocking(findings: Iterable[Finding]) -> list[Finding]:
     return [f for f in findings if f.blocks_send]
 
 
+#: Which record survives when two stages flag the same (code, table, measure).
+#: Higher wins: the post-load record carries the observed Snowflake stats, a
+#: blueprint-stage record only the declared mean.
+_STAGE_PRECEDENCE = {
+    "blueprint": 0, "generation": 1, "validation": 2, "liveboard": 3, "post_load": 4, "send": 5,
+}
+
+
+def dedupe_key(finding: Finding) -> tuple:
+    """One measure, one code, one finding — whichever stage noticed it.
+
+    CSAT_SCORE_SUM was posted twice per build (2026-10-13): once by the
+    blueprint stage from its declared mean and once by the post-load gate from
+    its observed mean, with different text, so a message-keyed dedupe kept
+    both. A record that is not measure-scoped (an insight, a formula repair, a
+    dimension) keeps its message in the key: two of those under one code are
+    two different facts.
+    """
+    if finding.measure:
+        return (finding.code, finding.table.upper(), finding.measure.upper())
+    return (finding.code, finding.stage, finding.table.upper(), finding.message)
+
+
+def dedupe(findings: Iterable[Finding]) -> list[Finding]:
+    """Collapse records that describe the same thing (see dedupe_key).
+
+    Across STAGES the later one wins: of everything said about one
+    (code, table, measure), only the records from the highest-precedence
+    stage survive — post-load over blueprint, because it carries the observed
+    stats. Within that stage, two different messages are two facts (piled on
+    the high bound AND on the low bound) and both are kept; an identical
+    repeat is dropped. Order of first appearance is preserved.
+    """
+    groups: dict[tuple, list[Finding]] = {}
+    for finding in findings:
+        groups.setdefault(dedupe_key(finding), []).append(finding)
+    out: list[Finding] = []
+    for members in groups.values():
+        top = max(_STAGE_PRECEDENCE.get(m.stage, -1) for m in members)
+        seen_messages: set[str] = set()
+        for member in members:
+            if _STAGE_PRECEDENCE.get(member.stage, -1) != top or member.message in seen_messages:
+                continue
+            seen_messages.add(member.message)
+            out.append(member)
+    return out
+
+
 def render(findings: Iterable[Finding]) -> list[str]:
     return [f.render_line() for f in findings]
 

demoprep_app/scenario/blueprint.py

@@ -24,6 +24,7 @@ import ast
 import math
 
 from dataclasses import dataclass, field
+from datetime import date, timedelta
 from typing import Any
 
 from demoprep_app.dataset.formula import (
@@ -39,9 +40,11 @@ from demoprep_app.dataset.measure_bounds import (
     MeasureBound,
     infer_bound,
     is_scale_bound,
+    named_score_scale,
     part_whole_pairs,
     sampling_band,
 )
+from demoprep_app.dataset.measure_names import is_open_ratio_name, is_score_column
 from demoprep_app.quality.findings import Finding
 
 VALID_INSIGHT_TYPES = ("segment_outlier", "segment_laggard", "trend_break", "seasonal_spike")
@@ -217,6 +220,35 @@ class PlantedInsight:
     window_end: str = ""
     spotter_question: str = ""          # the question an SE types live
     expected_finding: str = ""          # what the chart should show
+    # The magnitude as the blueprint stated it, recorded the first time the
+    # tuning loop boosts `magnitude` (build_demo._boost_weak_insights). The
+    # validator reports THIS as the promise: the boosted figure (3.7x after
+    # three rounds) is a tuning artefact, not what was authored.
+    authored_magnitude: float | None = None
+    # How hard the engine pushes a BOUNDED measure's position in its band for
+    # this insight, on top of `magnitude`. Never authored: the tuning loop
+    # raises it instead of the magnitude when the measure is a rate / score /
+    # share whose band caps what any promise can deliver — inflating the
+    # promise there only moved the pass bar out of reach (findings triage
+    # 2026-10-15, B2). 1.0 = the magnitude alone.
+    drive_boost: float = 1.0
+
+
+#: An insight window must leave at least this share of the history BEFORE it,
+#: so a trend break has a "before" to compare against (findings triage
+#: 2026-10-15, B3: windows at or before the first generated date gave
+#: "1946 target / 0 baseline").
+WINDOW_MIN_HISTORY_BEFORE = 1.0 / 3.0
+
+
+def _parse_iso(value: str) -> date | None:
+    """An ISO date, or None for anything else (an LLM-invented relative token)."""
+    if not value:
+        return None
+    try:
+        return date.fromisoformat(str(value).strip())
+    except (ValueError, TypeError):
+        return None
 
 
 @dataclass(slots=True)
@@ -228,6 +260,29 @@ class DateSpec:
     include_date_dimension: bool = False
     fiscal_or_custom_calendar: str = "" # non-empty forces include_date_dimension
 
+    def span(self, today: date | None = None) -> tuple[date, date]:
+        """(first, last) generated date. THE definition of the history the
+        engine writes: months_of_history months ending on the last day of last
+        month (engine._date_spine reads it from here), so a window checked at
+        blueprint time and the rows generated later agree to the day."""
+        today = today or date.today()
+        end = today.replace(day=1) - timedelta(days=1)
+        start = end - timedelta(days=int(self.months_of_history * 30.44))
+        return start, end
+
+    def min_window_start(self, today: date | None = None) -> date:
+        """The earliest window_start that still leaves WINDOW_MIN_HISTORY_BEFORE
+        of the history as the 'before' baseline."""
+        start, end = self.span(today)
+        return start + timedelta(days=int((end - start).days * WINDOW_MIN_HISTORY_BEFORE))
+
+    def default_window_start(self, today: date | None = None) -> date:
+        """Where a missing or unusable window opens: the first of the month that
+        begins the last third of the history. Replaces the hard-coded
+        2025-06-01, which with 12 months of history sat before the data began."""
+        start, end = self.span(today)
+        return (start + timedelta(days=(end - start).days * 2 // 3)).replace(day=1)
+
 
 @dataclass(slots=True)
 class DemoBlueprint:
@@ -262,10 +317,13 @@ class DemoBlueprint:
         `[BOUND-WARN]` hardening lines, so each record carries the measure, the
         table and the concrete declaration to add — a log line cannot.
 
-        These are WARNINGS by directive: an uninferable range means our name
-        inference missed a vocabulary, which is a signal to report, not a reason
-        to kill a build. They do NOT reach the structural-abort path (see
-        `problems()`, which never contains bound text).
+        Severity `info` (boone, 2026-10-20): an uninferable range means our
+        name inference missed a vocabulary — a registry gap to fix in code, not
+        a defect in this build's data. The records are kept (demo_findings, the
+        run log) and Slack rolls them into one line per build instead of one
+        warning per measure, which is how ~600 of 662 warnings posted in three
+        days came from this one code. They never reach the structural-abort
+        path (see `problems()`, which never contains bound text).
         """
         from demoprep_app.dataset.measure_bounds import infer_bound
         from demoprep_app.quality.findings import Finding
@@ -280,7 +338,7 @@ class DemoBlueprint:
                     continue
                 findings.append(Finding(
                     code="bound_not_inferable",
-                    severity="warning",
+                    severity="info",
                     stage="blueprint",
                     message=bound.gap,
                     suggestion=bound.suggestion or bound.suggest_fix(m.name),
@@ -489,35 +547,105 @@ class DemoBlueprint:
                     fixes.append(f"{m.name}: flag measure -> fmt 'int'")
                     m.fmt = "int"
 
+            # --- 1b. an open ratio is not a percentage ---
+            # COMBINED_RATIO declared fmt "pct" would be clamped to a 0-1 / 0-100
+            # scale at storage time (engine._pct_bound); a coverage or combined
+            # ratio legitimately exceeds 1 (findings triage 2026-10-15, C1).
+            for m in fact.measures:
+                if m.fmt == "pct" and is_open_ratio_name(m.name):
+                    m.fmt = "float"
+                    fixes.append(
+                        f"{m.name}: fmt 'pct' -> 'float' (an open ratio — coverage, combined, "
+                        "turnover, leverage — legitimately exceeds 1 and must not be clamped to "
+                        "a percentage scale)"
+                    )
+
             # --- 2. infer share_of from PART / WHOLE formulas ---
             # Which `A / B` is a part over its whole is measure_bounds'
             # answer, the same one the post-load gate checks against.
             shares = {m.name: m.share_of for m in fact.measures if m.share_of}
+            unbounded_reasons: list[str] = []
+
+            def _make_share(part, whole, ratio, via: str) -> bool:
+                """PART becomes a share_of WHOLE; False, with the reason recorded,
+                when it cannot (findings triage 2026-10-15, C2: the reason a rate
+                is left to the MIN/MAX wrap — and to pile up on its cap — was
+                invisible before)."""
+                if part is None or whole is None or part is whole:
+                    return False        # cross-fact / unknown: a formula problem, not a bound
+                if part.name.upper().endswith("_FLAG"):
+                    return False        # a flag is already 0/1
+                if part.kind != "base":
+                    unbounded_reasons.append(f"{part.name} is derived ('{part.formula}'), not sampled")
+                    return False
+                if part.share_of:
+                    unbounded_reasons.append(f"{part.name} is already a share of {part.share_of}")
+                    return False
+                if _share_of_cycle(part.name, whole, by_name):
+                    unbounded_reasons.append(f"{part.name} as a share of {whole.name} would be circular")
+                    return False
+                part.share_of = whole.name
+                shares[part.name] = whole.name
+                low, high = _inferred_fraction_range(part, whole)
+                part.params["low"], part.params["high"] = low, high
+                if part.per:
+                    fixes.append(f"{part.name}: dropped per '{part.per}' (now a share of {whole.name})")
+                    part.per = ""
+                fixes.append(
+                    f"{part.name}: inferred share_of {whole.name} from {ratio.name} = '{ratio.formula}'"
+                    f"{via} (fraction {low:.2f}-{high:.2f}) so {ratio.name} stays <= 1"
+                )
+                return True
+
             for m in fact.measures:
                 if m.kind != "derived" or not m.formula:
                     continue
                 ratio_bound = infer_bound(m.name, m.fmt, m.params, signed=m.signed, formula=m.formula)
-                for part_name, whole_name in part_whole_pairs(m.formula, ratio_bound, shares=shares):
-                    part = by_name.get(part_name)
-                    whole = by_name.get(whole_name)
+                unbounded_reasons.clear()
+                bounded = False
+                pairs = part_whole_pairs(m.formula, ratio_bound, shares=shares)
+                for part_name, whole_name in pairs:
+                    part, whole = by_name.get(part_name), by_name.get(whole_name)
                     if part is None or whole is None or part is whole:
-                        continue        # cross-fact / unknown: a formula problem, not a bound
-                    if part.kind != "base" or part.share_of:
-                        continue        # already bounded, or not something we sample
-                    if part.name.upper().endswith("_FLAG"):
-                        continue        # a flag is already 0/1
-                    if _share_of_cycle(part.name, whole, by_name):
                         continue
-                    part.share_of = whole.name
-                    shares[part.name] = whole.name
-                    low, high = _inferred_fraction_range(part, whole)
-                    part.params["low"], part.params["high"] = low, high
-                    if part.per:
-                        fixes.append(f"{part.name}: dropped per '{part.per}' (now a share of {whole.name})")
-                        part.per = ""
+                    if part.kind == "derived" and part.formula:
+                        # GROSS_MARGIN_RATE = GROSS_MARGIN / NET_SALES where
+                        # GROSS_MARGIN = NET_SALES - COGS: bound the difference's
+                        # subtrahend as a share of the whole, so the numerator is
+                        # in [0, whole] by construction and the ratio in [0, 1].
+                        # Loblaw's GROSS_MARGIN_RATE piled up on its cap because
+                        # COGS was sampled independently of NET_SALES (C2).
+                        hit = False
+                        for minuend, subtrahend in formula_difference_pairs(part.formula):
+                            if minuend == whole.name and _make_share(
+                                    by_name.get(subtrahend), whole, m,
+                                    f" via {part.name} = '{part.formula}'"):
+                                hit = True
+                        if hit:
+                            bounded = True
+                        else:
+                            unbounded_reasons.append(
+                                f"{part.name} is derived ('{part.formula}') and not a difference "
+                                f"off {whole.name}"
+                            )
+                        continue
+                    if _make_share(part, whole, m, ""):
+                        bounded = True
+                # The margin written inline: (NET_SALES - COGS) / NET_SALES.
+                if ratio_bound is not None and ratio_bound.kind == "rate":
+                    for whole_name, subtrahend in _margin_pairs(m.formula):
+                        if _make_share(by_name.get(subtrahend), by_name.get(whole_name), m,
+                                       f" (a margin of {whole_name})"):
+                            bounded = True
+                if (ratio_bound is not None and ratio_bound.kind == "rate" and not bounded
+                        and (pairs or formula_ratio_pairs(m.formula) or _margin_pairs(m.formula))):
+                    # Say WHY the rate is left to the wrap: the next pile-up on
+                    # this measure then names its cause instead of "lower
+                    # params.mean" (C2, Turtle / Loblaw / Panama 2026-10).
+                    why = "; ".join(unbounded_reasons) or "no PART / WHOLE pair of sampled measures"
                     fixes.append(
-                        f"{part.name}: inferred share_of {whole.name} from {m.name} = '{m.formula}' "
-                        f"(fraction {low:.2f}-{high:.2f}) so {m.name} stays <= 1"
+                        f"[BOUND-NOTE] {m.name} = '{m.formula}' could not be bounded structurally "
+                        f"({why}); it is wrapped in MIN/MAX and rows on the cap are reported"
                     )
 
         fixes.extend(self._differentiate_dimension_performance())
@@ -801,6 +929,69 @@ class DemoBlueprint:
             self.metadata.setdefault("autorepairs", []).extend(fixes)
         return fixes
 
+    def ensure_insight_support(
+        self, rows_per_fact: int, *, min_rows: int = 20, margin: float = 1.5
+    ) -> list[str]:
+        """Give every planted insight enough rows to be MEASURED, before generation.
+
+        The validator needs `min_rows` rows on each side of a comparison
+        (validator.MIN_ROWS_PER_SIDE). A segment that is one driver in eight on
+        a 500-row fact gets ~60 rows; one with mix_weight 0.3 gets ~20 and the
+        insight comes back "too few rows to demo" — Humpty Dump's driver logs,
+        4 / 51 and 13 / 54 (findings triage 2026-10-15, B3). The tuning loop
+        used to discover this after a full generation and bump mix_weight by
+        1.5x per round. Estimating the rows from the mix share up front sizes
+        the segment once, from the number of rows the engine will write.
+
+        For a trend break the smaller of the in-window and before shares
+        decides; the window itself is placed by autorepair() so the before
+        side is at least a third of the history. A seasonal spike has no
+        segment to resize. Never lets one member take more than 80% of the
+        rows, and caps mix_weight at 5.0 like the tuning loop does.
+        """
+        fixes: list[str] = []
+        start, end = self.date.span()
+        span_days = max((end - start).days, 1)
+        dims = {d.name: d for d in self.dimensions}
+        need = min_rows * margin
+        for insight in self.insights:
+            if insight.insight_type == "seasonal_spike":
+                continue
+            dim = dims.get(insight.dimension)
+            value = next((v for v in (dim.values if dim else []) if v.name == insight.dimension_value), None)
+            if dim is None or value is None:
+                continue
+            weights = {v.name: max(0.01, float(v.mix_weight)) for v in dim.values}
+            others = sum(w for n, w in weights.items() if n != value.name)
+            if others <= 0:
+                continue
+            side = 1.0
+            if insight.insight_type == "trend_break":
+                ws = _parse_iso(insight.window_start)
+                if ws is not None:
+                    in_window = min(max((end - max(ws, start)).days / span_days, 0.0), 1.0)
+                    side = min(in_window, 1.0 - in_window)
+            if side <= 0:
+                continue        # the window is the problem, not the mix — autorepair moves it
+            share = weights[value.name] / (weights[value.name] + others)
+            expected = rows_per_fact * share * side
+            if expected >= need:
+                continue
+            wanted_share = min(need / (rows_per_fact * side), 0.8)
+            new_weight = min(round(wanted_share * others / (1.0 - wanted_share), 3), 5.0)
+            if new_weight <= weights[value.name]:
+                continue
+            old = value.mix_weight
+            value.mix_weight = new_weight
+            fixes.append(
+                f"insight {insight.id}: {insight.dimension_value} would get ~{expected:.0f} rows "
+                f"of {rows_per_fact} (the validator needs {min_rows} on each side) -> "
+                f"mix_weight {old:g} -> {new_weight:g}"
+            )
+        if fixes:
+            self.metadata.setdefault("insight_support", []).extend(fixes)
+        return fixes
+
     def findings(self) -> list[Finding]:
         """Validation report as records: every rule decides its OWN severity.
 
@@ -963,6 +1154,26 @@ class DemoBlueprint:
                     critical("measure_kind_invalid", f"Measure {m.name}: kind must be 'base' or 'derived'.",
                              suggestion="autorepair infers the kind from the formula",
                              table=fact.name, measure=m.name)
+                if (m.kind == "base" and not m.share_of and is_score_column(m.name)
+                        and not {"low", "high"} <= set(m.params)
+                        and named_score_scale(m.name, m.params) is None):
+                    # A score/index/rating is bounded by definition, and the
+                    # scale is the author's to state: a mean alone picks the
+                    # smallest standard ladder step that fits (a guess), and no
+                    # mean at all leaves the range uninferable (findings triage
+                    # 2026-10-15, A4: UPMC's LENGTH_OF_STAY_INDEX, PwC's
+                    # AVG_TRUST_SCORE). The repair round fixes it; a survivor
+                    # ships with this warning.
+                    level = m.params.get("mean")
+                    hint = (f"; a mean of {level:g} alone only guesses the scale"
+                            if isinstance(level, (int, float)) else
+                            "; with no mean either, the range cannot be inferred at all")
+                    warn("measure_score_range_missing",
+                         f"Measure {m.name}: a score / index / rating must declare its scale as "
+                         f"params.low and params.high (e.g. 0-100, 1-5, 0-10){hint}.",
+                         suggestion=(f"declare params.low/high on {m.name}; otherwise the range is "
+                                     "inferred from params.mean or reported as not inferable"),
+                         table=fact.name, measure=m.name)
                 if m.fmt not in VALID_FORMATS:
                     critical("measure_fmt_invalid", f"Measure {m.name}: fmt must be one of {VALID_FORMATS}.",
                              suggestion="autorepair coerces it to float", table=fact.name, measure=m.name)
@@ -985,6 +1196,8 @@ class DemoBlueprint:
         if len(self.insights) < 3:
             warn("insights_too_few", "Provide at least 3 planted insights — these are the demo story.",
                  suggestion="autorepair synthesizes segment_outlier insights from the base measures")
+        span_start, span_end = self.date.span()
+        earliest_window = self.date.min_window_start()
         for i in self.insights:
             if i.insight_type not in VALID_INSIGHT_TYPES:
                 critical("insight_type_invalid",
@@ -1012,10 +1225,52 @@ class DemoBlueprint:
                              f"Insight {i.id}: dimension_value '{i.dimension_value}' is not a value of {i.dimension}.",
                              suggestion="autorepair remaps it to an existing value",
                              table=i.dimension, measure=i.measure)
-            if i.insight_type in ("trend_break", "seasonal_spike") and not i.window_start:
-                warn("insight_window_missing",
-                     f"Insight {i.id}: {i.insight_type} requires window_start (ISO date).",
-                     suggestion="autorepair adds a default window_start", measure=i.measure)
+            # Windows are checked against the SPAN the engine will generate
+            # (findings triage 2026-10-15, B3): a window before the data starts
+            # has no 'before', one after it ends has no rows at all — the
+            # validator then reports "too few rows" (Verizon 1946 / 0, AMD
+            # 0 / 0, BCD 0 / 0).
+            ws = _parse_iso(i.window_start) if i.window_start else None
+            we = _parse_iso(i.window_end) if i.window_end else None
+            if i.insight_type in ("trend_break", "seasonal_spike"):
+                if not i.window_start:
+                    warn("insight_window_missing",
+                         f"Insight {i.id}: {i.insight_type} requires window_start (ISO date).",
+                         suggestion="autorepair adds a default window_start", measure=i.measure)
+                elif ws is None:
+                    warn("insight_window_invalid",
+                         f"Insight {i.id}: window_start '{i.window_start}' is not an ISO date "
+                         "(YYYY-MM-DD).",
+                         suggestion="autorepair moves it to the start of the last third of the history",
+                         measure=i.measure)
+                elif ws > span_end:
+                    warn("insight_window_outside_span",
+                         f"Insight {i.id}: window_start {ws} is after the last generated date "
+                         f"({span_end}); the history spans {span_start}..{span_end}. Use a date "
+                         "inside it.",
+                         suggestion="autorepair moves it to the start of the last third of the history",
+                         measure=i.measure)
+                elif ws < earliest_window:
+                    warn("insight_window_too_early",
+                         f"Insight {i.id}: window_start {ws} leaves less than a third of the history "
+                         f"before it (data starts {span_start}), so there is nothing to compare "
+                         f"against; use a date on or after {earliest_window}.",
+                         suggestion="autorepair moves it to the start of the last third of the history",
+                         measure=i.measure)
+            elif i.window_start or i.window_end:
+                if (i.window_start and (ws is None or ws > span_end)) or (
+                        i.window_end and (we is None or we < span_start)):
+                    warn("insight_window_outside_span",
+                         f"Insight {i.id}: window {i.window_start or '…'}..{i.window_end or '…'} "
+                         f"does not overlap the generated history {span_start}..{span_end}; a "
+                         "segment insight with a window outside it has no rows on either side.",
+                         suggestion="autorepair drops the window so the whole history is compared",
+                         measure=i.measure)
+            if i.window_end and (we is None or (ws is not None and we <= ws)):
+                warn("insight_window_end_invalid",
+                     f"Insight {i.id}: window_end '{i.window_end}' must be an ISO date after "
+                     f"window_start.",
+                     suggestion="autorepair drops window_end", measure=i.measure)
             if not (i.magnitude >= 1.15 or i.magnitude <= 0.85):
                 warn("insight_too_subtle",
                      f"Insight {i.id}: magnitude {i.magnitude} is too subtle to demo. Use >=1.15 or <=0.85.",
@@ -1133,6 +1388,9 @@ class DemoBlueprint:
         # --- insights ---
         all_measure_names = {m.name for f in self.facts for m in f.measures}
         base_measures = [m.name for f in self.facts for m in f.measures if m.kind == "base"]
+        span_start, span_end = self.date.span()
+        earliest_window = self.date.min_window_start()
+        default_window = self.date.default_window_start().isoformat()
         kept: list[PlantedInsight] = []
         for i in self.insights:
             if i.insight_type not in VALID_INSIGHT_TYPES:
@@ -1165,9 +1423,35 @@ class DemoBlueprint:
                     else:
                         fixes.append(f"insight {i.id}: dropped (dimension has no values)")
                         continue
-            if i.insight_type in ("trend_break", "seasonal_spike") and not i.window_start:
-                i.window_start = "2025-06-01"
-                fixes.append(f"insight {i.id}: added window_start")
+            # Windows live inside the history the engine will generate and
+            # leave a 'before' (findings triage 2026-10-15, B3). The old default
+            # was a hard-coded 2025-06-01, which with 12 months of history sat
+            # before the first generated date.
+            ws = _parse_iso(i.window_start) if i.window_start else None
+            we = _parse_iso(i.window_end) if i.window_end else None
+            if i.insight_type in ("trend_break", "seasonal_spike"):
+                if ws is None or ws > span_end or ws < earliest_window:
+                    why = ("missing" if not i.window_start else "unreadable" if ws is None
+                           else "after the data ends" if ws > span_end
+                           else "too early to leave a 'before' baseline")
+                    i.window_start = default_window
+                    ws = _parse_iso(default_window)
+                    fixes.append(
+                        f"insight {i.id}: window_start {why} -> {default_window} (history "
+                        f"{span_start}..{span_end}; the window opens its last third)"
+                    )
+                if i.window_end and (we is None or we <= ws or we > span_end):
+                    fixes.append(f"insight {i.id}: dropped window_end '{i.window_end}' (not after "
+                                 "window_start, or past the data)")
+                    i.window_end = ""
+            elif i.window_start or i.window_end:
+                if (i.window_start and (ws is None or ws > span_end)) or (
+                        i.window_end and (we is None or we < span_start or (ws and we <= ws))):
+                    fixes.append(
+                        f"insight {i.id}: window {i.window_start or '…'}..{i.window_end or '…'} "
+                        f"is outside the history {span_start}..{span_end} -> whole history"
+                    )
+                    i.window_start = i.window_end = ""
             if not (i.magnitude >= 1.15 or i.magnitude <= 0.85):
                 i.magnitude = 1.3
                 fixes.append(f"insight {i.id}: magnitude -> 1.3")
@@ -1270,15 +1554,55 @@ def _ratio_is_structurally_bounded(measure, bound: MeasureBound, by_name: dict)
     if bound.kind != "rate" or abs(bound.scale - 1.0) > 1e-9:
         return False
     pairs = formula_ratio_pairs(measure.formula or "")
-    if not pairs:
+    margins = _margin_pairs(measure.formula or "")
+    if not pairs and not margins:
         return False
     for part_name, whole_name in pairs:
         part = by_name.get(part_name)
-        if part is None or part.share_of != whole_name:
+        if part is None:
+            return False
+        if part.share_of == whole_name:
+            continue
+        # A derived numerator WHOLE - X with X a share of WHOLE sits in
+        # [0, WHOLE] by construction (harden() step 2 installs that share).
+        diffs = formula_difference_pairs(part.formula or "") if part.kind == "derived" else []
+        if diffs and all(
+            minuend == whole_name and getattr(by_name.get(sub), "share_of", "") == whole_name
+            for minuend, sub in diffs
+        ):
+            continue
+        return False
+    for whole_name, subtrahend in margins:
+        if getattr(by_name.get(subtrahend), "share_of", "") != whole_name:
             return False
     return True
 
 
+def _margin_pairs(formula: str) -> list[tuple[str, str]]:
+    """Every `(W - X) / W` in a formula, as (W, X) — the margin shape.
+
+    `ratio_pairs` sees only `A / B` of two bare identifiers; a gross margin
+    rate written inline, `(NET_SALES - COGS) / NET_SALES`, has a difference as
+    its numerator. Bounding X as a share of W keeps the ratio in [0, 1] by
+    construction, so this is the shape harden() looks for next.
+    """
+    try:
+        tree = ast.parse((formula or "").strip() or "0", mode="eval")
+    except SyntaxError:
+        return []
+    pairs: list[tuple[str, str]] = []
+    for node in ast.walk(tree):
+        if (
+            isinstance(node, ast.BinOp) and isinstance(node.op, ast.Div)
+            and isinstance(node.right, ast.Name)
+            and isinstance(node.left, ast.BinOp) and isinstance(node.left.op, ast.Sub)
+            and isinstance(node.left.left, ast.Name) and isinstance(node.left.right, ast.Name)
+            and node.left.left.id == node.right.id
+        ):
+            pairs.append((node.right.id, node.left.right.id))
+    return pairs
+
+
 def _wrap_formula_in_bound(formula: str, bound: MeasureBound) -> str:
     """`f` -> `MIN(MAX(f, low), high)` unless it is already wrapped that way.
 

demoprep_app/scenario/blueprint_author.py

@@ -186,7 +186,12 @@ The demo must let a sales engineer type natural-language questions live and DISC
 interesting, believable findings. You control what those findings are: plant 3-5 insights
 that a {demo_audience_hint} would care about, each with the exact Spotter question that
 reveals it. Insights must be big enough to see on a chart (magnitude >= 1.15 or <= 0.85)
-and grounded in this company's actual world.
+and grounded in this company's actual world. A trend_break or seasonal_spike window_start
+must fall INSIDE the generated history (the last months_of_history months, ending last
+month) and leave at least the first third of it as the "before" baseline — a window that
+starts before the data does has nothing to compare against. A dimension_value that carries
+a planted insight needs enough rows to show (at least 20 on each side of the comparison):
+give it mix_weight 1.0 or more when its dimension has many members.
 
 ## Hard requirements
 1. Dimension values must be concrete domain nouns from THIS company's world (real-sounding
@@ -224,6 +229,12 @@ and grounded in this company's actual world.
    per-transaction draw. Set "per": "<ENTITY_DIMENSION>" (e.g. UNIT_PRICE with "per":"PRODUCT")
    so every row for that product carries the same price. Without it, the same product shows
    wildly varying prices and margins row to row and reads as random noise, not real data.
+3c. Any SCORE / INDEX / RATING measure (a health score, a risk index, CSAT, a trust score)
+   MUST declare its scale as params.low and params.high (0-100, 1-5, 0-10, 0-4 ...). A score
+   with no declared range cannot be range-checked, and no scale is ever guessed. A SUM or
+   COUNT of scores is a quantity, not a score — name it with _SUM / _COUNT. A ratio of two
+   DIFFERENT quantities (pipeline coverage, combined ratio, inventory turns, book-to-bill)
+   legitimately exceeds 1: give it fmt "float", not "pct".
 4. Monthly seasonality multipliers (all 12 months) that fit this business, plus an annual
    trend percentage.
 5. date.include_date_dimension: set true ONLY if the scenario needs custom calendar

docs/PLAN_findings_triage_2026_10_15.md

@@ -0,0 +1,317 @@
+# Findings triage — 47 builds, 2026-10-12 → 10-15 — remediation plan
+
+**Status:** proposal for boone, 2026-10-15. Nothing implemented yet.
+**Source:** the DemoPrep Slack channel for Oct 12 15:40 → Oct 15 12:19 ET (47 build
+messages, 21 SEs), cross-checked against the code and Supabase `session_logs`.
+**Branch:** `plan/findings-triage-2026-10` (cut from `integrate/bounds-gates` @ 56241f3).
+
+---
+
+## 1. What three days of Slack traffic say
+
+| | Count | Share |
+|---|---|---|
+| Build messages | 47 (43 shipped, 4 failed at ThoughtSpot deploy) | |
+| Warnings posted | ≈662 | |
+| `bound_not_inferable` — "no bound class matched X" | ≈600 | **≈91 %** |
+| `bound_not_inferable` — score/index with no scale | 8 (2 duplicate pairs) | 1 % |
+| `insight_weak` | 40 visible, a few more under the fold | 6 % |
+| `measure_bound_pileup` | 6 | 1 % |
+| `repair_failed` + `measure_mirrors_other_column` | 2 (same measure) | <1 % |
+| Deploy failures ("ThoughtSpot authentication failed") | 4 runs | |
+| Builds truncated with "… and N more" | 29 of 47 | |
+
+Median warnings per build ≈15; Slack prints 12. Because the list is sorted
+alphabetically by code inside a severity, `bound_not_inferable` fills the 12
+slots and the findings that actually matter (`insight_weak`, pile-ups, the
+mirrored column) are the ones that fall under "… and N more". The signal is
+there; it is being drowned by one noisy family.
+
+## 2. Where the code that produced these lives
+
+* Prod MCP runs **`hf-mcp/main` @ d139d21** (fetched 10-15). That branch holds
+  `slack_notifier.format_build_findings` (the "build shipped with N warning(s)"
+  post) — this checkout does not.
+* This checkout was **`integrate/bounds-gates` @ 56241f3**. Merge-base with prod
+  is 33512e4; **neither branch contains the other**, and the eight files this
+  plan touches differ by ≈1,400 lines (`engine.py`, `measure_bounds.py`,
+  `measure_names.py`, `quality_gate.py`, `build_demo.py`, `blueprint.py`,
+  `slack_notifier.py`, `thoughtspot_deployer.py`).
+* Every root cause below was verified on **both** branches unless noted.
+
+This is the first decision: see §6.
+
+## 3. Finding families → root cause → fix
+
+### A. `bound_not_inferable` flood (≈600 warnings)
+
+**Root cause 1 — the post-load gate throws the format away.**
+`quality_gate.semantic_bound()` calls
+`infer_bound(column_name, "", {"mean": avg}, formula=formula)` with `fmt=""`
+*on purpose* (its docstring: format-derived non-negativity "would flag every
+legitimate negative margin column"). But `infer_bound` already checks
+`is_signed_name()` and `_formula_is_signed()` *before* the `fmt in ("int",
+"currency")` rule, so that concern is handled — and the blueprint's own
+`signed` flag is available too. Result: every integer count (`SESSIONS`,
+`ORDERS_SHIPPED`, `CASES_PICKED`, …) and every money column (`COGS`,
+`AUM_USD`, `GMV`, …) comes back `None` and is posted as a vocabulary gap.
+The blueprint stage (`DemoBlueprint.bound_findings`) passes `fmt` and is quiet
+for the same columns.
+
+**Root cause 2 — "signed by design" is reported as "unclassified".**
+`infer_bound` returns `None` both for `if name_signed: return None` (a
+variance / net change has no bound, correctly) and for "nothing matched". The
+gate cannot tell them apart, so `NET_CASH_FLOW_USD`, `GROSS_MARGIN`,
+`OPERATING_MARGIN`, `SPEND_VARIANCE_USD`, `NET_ENROLLMENT_CHANGE` are all
+posted as gaps.
+
+**Root cause 3 — real vocabulary gaps** (second line of defence once fmt is
+threaded; still the only line at the blueprint stage):
+* `CURRENCY_TOKENS` / `_QUANTITY_UNIT_TOKENS` lack **CAD** (five Canadian
+  prospects in three days: OMERS, Loblaw, Honda Canada, Islamic Relief
+  Canada, Environics), AUD, DOLLARS.
+* No count vocabulary at all (plural nouns, `_CREATED/_RESOLVED/_SHIPPED/…`).
+* Money nouns missing: COGS, GMV, AUM, VALUE, COMMISSION, DISCOUNT, FARE,
+  INCENTIVE, MSRP, ASP, CAPITAL, INCOME, PIPELINE, RESERVES, COMPENSATION,
+  SAVINGS, AID, BUDGET, PAY, SURCHARGE, TARIFF, TOLL, LTV, REIMBURSEMENT.
+* Physical units missing: FT, CM, CM2, KG, MS, YEARS, MILLIONS, BPS.
+* Proportion words missing: EFFICIENCY (`THROUGHPUT_EFFICIENCY`), COMPLETENESS
+  (`LEAD_ATTRIBUTION_COMPLETENESS`), LOAD_FACTOR, AVAILABILITY.
+
+**Root cause 4 — score/index measures.** `LENGTH_OF_STAY_INDEX` (UPMC),
+`AVG_CSAT` (Verizon), `OIL_PRICE_TRANSIT_CORRELATION_INDEX` (Panama),
+`AVG_TRUST_SCORE` (PwC): the LLM declared no `params.low/high`. Also
+`CSAT_SCORE_SUM` is a *sum* of scores, not a score (the `_SUM` suffix is
+already "explicitly additive" for aggregation but not for the score class);
+`MEDIAN_SAT_SCORE` (1530) and `AVG_GPA` have no entry in `SCORE_SCALES`.
+
+**Root cause 5 — duplicates.** `CSAT_SCORE_SUM` and `MEDIAN_SAT_SCORE` each
+appear twice in one post: once from the blueprint stage (declared mean) and
+once from post-load (observed mean), with different text, so `_dedupe` keeps
+both.
+
+**Fixes**
+1. Thread the blueprint's per-measure `fmt`, `kind`, `signed` into the
+   post-load gate the same way `formulas` already travel
+   (`chat_interface.py:3850` builds `_dq_formulas` keyed `TABLE.COLUMN`; add a
+   sibling map). `semantic_bound` then calls `infer_bound` with the real
+   format. Counts and money → `non_negative`; nothing posted.
+2. Give `infer_bound` a distinguishable "signed, unbounded by design" result
+   (e.g. `MeasureBound(None, None, "signed", …)` with no `gap`) so neither
+   emitter treats it as a gap.
+3. Dedupe on `(code, table, measure)` across stages in `build_demo._dedupe`
+   and in `format_build_findings`; keep the post-load record (it has observed
+   stats).
+4. Reporting (decision, §6): demote `bound_not_inferable` to `info` and post a
+   single roll-up line per build ("7 measures unclassified: A, B, C …") placed
+   *last*; sort visible findings by a code priority (critical → send-blocking →
+   pile-up / mirror / repair_failed → insight_weak → the rest) instead of
+   alphabetically.
+5. Vocabulary (A3) and score registry (A4): add the tokens above; add GPA
+   (0–4, 0–5 weighted), SAT (400–1600), ACT (1–36), CSAT (1–5 default) to the
+   scale ladder; exclude explicitly-additive shapes (`_SUM`, `_TOTAL`,
+   `TOTAL_`) from `is_score_column`; make the blueprint author prompt and
+   `problems()` require `low/high` on any SCORE/INDEX measure.
+
+### B. `insight_weak` (≈45 warnings) — three different things
+
+**B1 — the message is wrong, not the check.** `validator._record_findings`
+prints `check.required_ratio` as "the N it promised". `required` is the pass
+bar (`1 + (promised − 1) × MIN_REALIZED_FRACTION`, fraction = 0.5), not the
+promise. For a laggard it reads backwards: "realized 0.83 of the 0.69 it
+promised" means *needed ≤ 0.69 (the LLM promised 0.38), got 0.83* — the
+segment is 17 % below baseline where the story needs 62 %. Nine of the 40
+lines look like false positives and are not. Fix: print promised (as
+authored), needed, realized and direction.
+
+**B2 — unreachable promises on bounded measures.** `_boost_weak_insights`
+multiplies the distance-from-1 by `BOOST_FACTOR = 1.6` for up to
+`MAX_TUNING_ROUNDS = 3` rounds, and the Slack line shows the *boosted* promise
+(that is where 3.69, 3.71, 4.07 come from). But for `share_of` / rate measures
+the engine deliberately warps *within* the `[low, high]` band ("performance
+moves where in the band this row lands, it does not push past it",
+`engine.py` ≈390). A rate whose band is 0.05–0.85 cannot be 3.7× its baseline,
+so each round inflates the promise and nothing moves. Fix: for proportion /
+score measures cap the promise at what the band can deliver and boost band
+position / `mix_weight` instead of magnitude; stop boosting when realized did
+not change between rounds (the rounds are deterministic); report the authored
+promise.
+
+**B3 — "too few rows to demo"** (7 cases, all pass through the same check in
+`_check_insight`, threshold 20 rows each side):
+* `0 target / 0 baseline` (AMD `Instinct MI300X`, BCD `LHR → JFK`): segment
+  checks drop every row outside the window, so a window outside the generated
+  date span yields nothing on either side.
+* `1946 / 0`, `1465 / 0`, `418 / 1` (Verizon, Fortegra, Turtle): trend-break
+  windows that start at or before the first generated date, so there is no
+  "before". `autorepair()` hard-codes `window_start = "2025-06-01"` when the
+  LLM omitted it (`blueprint.py:969`); with 12 months of history that is before
+  the data starts.
+* `4 / 51`, `13 / 54` (Humpty Dump driver logs): small fact tables where one
+  driver in eight can never reach 20 rows.
+
+`problems()` checks that `dimension_value` exists and that `window_start` is
+present, but not that the window overlaps the date span or leaves a baseline.
+Fix: validate windows against `DateSpec` at blueprint time (inside the span;
+trend-break leaves ≥ ⅓ of history before it; replace the hard-coded date with
+"last third of the span"); estimate rows per side from `row_count × mix share`
+and raise `mix_weight` *before* generation when it is under 20; emit a distinct
+code `insight_unmeasurable` with the cause instead of `insight_weak`.
+
+### C. `measure_bound_pileup` (6) — two different causes
+
+**C1 — open ratios bounded to [0, 1].** `_BOUNDED_SUFFIXES` maps `_RATIO` to
+(0, 1). `PIPELINE_COVERAGE_RATIO` (Bruker, **99.8 %** pinned — a constant
+column on a shipped board), `COMBINED_RATIO` (Frontline, 51.8 %) and
+`LOSS_RATIO` (48 %) are ratios of two quantities and legitimately exceed 1; an
+insurance combined ratio over 100 % *is* the story. Fix: an open-ratio
+vocabulary (COVERAGE, COMBINED, TURNOVER, LEVERAGE, MULTIPLE, TURNS,
+BOOK_TO_BILL, LTV_CAC, CURRENT, QUICK, DEBT_TO …) that makes `_RATIO`
+non-negative with no ceiling; for a derived `A / B`, bound to [0, 1] only when
+`A` is structurally `share_of B`. Keep `is_rate_column` → AVERAGE aggregation
+for these (decision, §6).
+
+**C2 — derived part/whole that is not `share_of`.** `FILL_RATE` (Turtle
+17.7 %), `GROSS_MARGIN_RATE` (Loblaw 23.6 %), `LAKE_CAPACITY_UTILIZATION_RATE`
+(Panama 49.1 %): `_store` clamps a wrapped derived value at its cap
+(`engine.py:65`, ≈480) because the numerator was sampled independently of the
+denominator. `harden()` already has `_inferred_fraction_range` / share_of
+inference for `A / B` — find why it did not apply here (numerator itself
+derived? denominator a sum?) and extend it. The pile-up suggestion text should
+also match the cause: today it says "lower params.mean", which a derived
+measure does not have.
+
+### D. `repair_failed` + `measure_mirrors_other_column` (Humpty Dump run 2)
+
+The LLM wrote `DAYS_ON_SITE = RENTAL_DAYS * 1`. `validate_formula` accepts it
+(the identifier exists), the engine stores a copy, the post-load mirror check
+catches it, the gate "repairs" by recomputing from the same formula, re-profiles,
+still mirrors → `repair_failed` (send-blocking) and the column is dropped. The
+suggestion text ("references an identifier that is not a measure") is wrong
+for this case. Jack built three times in 70 minutes to get past one measure.
+
+Fix: identity-formula guard (`X`, `X * 1`, `1 * X`, `X / 1`, `X + 0`) in
+`validate_formula` so `_repair_one_formula` demotes or drops it *before*
+generation; in the gate, a `mirrors_other_column` defect goes straight to omit
+(`_OMIT_WORTHY` already lists it) and never through a recompute; fix the
+suggestion text.
+
+### E. Four deploy failures — not auth, provisioning
+
+Supabase `session_logs` (event `auth failed`) for the four runs:
+
+| Run | SE | ThoughtSpot response |
+|---|---|---|
+| Lead Forensics 10-13 07:43 UTC | patrick.case | HTTP 400, code 10002 `Specified user does not exist` |
+| Rice University 10-13 20:58 UTC | kris.lefebvre | same |
+| Lead Forensics 10-15 14:08 UTC | patrick.case | same |
+| Lead Forensics 10-15 14:35 UTC | patrick.case | same |
+
+All on `se-thoughtspot-cloud`. The trusted-auth token request is made *as the
+owner*, and these two SEs have no user there. Each run did the whole build
+(research, data, Snowflake load — schemas `LEA_10151433_N6I`,
+`RIC_10132058_S9S` exist) before failing, and the MCP result / Slack post said
+only "ThoughtSpot authentication failed" plus a traceback, so Patrick retried
+twice over two days with the same outcome. Lead Forensics was eventually built
+by max.lough on 10-15; Rice by paul.gilman and martha.miller.
+
+`ThoughtSpotDeployer.authenticate_trusted` already captures
+`last_auth_error` / `last_auth_status_code`; `deploy_all` (≈2862) raises a bare
+`Exception("ThoughtSpot authentication failed")` and the detail goes to the
+session log only. `mcp_server._run_build` has no pre-flight.
+
+Fix:
+1. Pre-flight `authenticate_trusted()` as the owner at the top of `_run_build`
+   (before research) — fail in seconds, not after a Snowflake load.
+2. Carry `last_auth_error` + status + user + env into the exception, the MCP
+   result and the Slack post; map code 10002 to a plain instruction ("user X
+   does not exist on <env> — ask the SE admin to create it, or pass a different
+   `ts_url`").
+3. A `deploy_existing_schema(schema, owner_email, ts_url)` MCP tool so a
+   partial build is deployable after the user is created, without regenerating.
+4. **Ops, now:** get patrick.case and kris.lefebvre created on
+   se-thoughtspot-cloud (or confirm their intended cluster) and tell them why
+   the builds failed.
+
+### F. Small hygiene
+
+* `supabase_client.py:801–903` truncates `company_name` / `use_case` at 100
+  chars and `demo_builder_class.py:199` at 30 — "OMERS Administration Corporati",
+  "…with futu", "…distribution busines". Widen to 255 / text; strip whitespace
+  ("Humpty Dump Roll Off Services ").
+* Board links switched to `/#/insights/pinboard/` from 10-14 17:31 ET
+  (ThoughtSpot UI change). Confirm every link builder and the portal accept
+  both forms.
+* Virtuoso was built on `sebe.thoughtspotstaging.cloud`; the reviewer key
+  cannot export TML there (per `DAILY_RUN_REPORT.md`), so it grades on data
+  only. Not a defect, just a known gap.
+
+## 4. Sequencing
+
+**Wave 1 — stop the noise, show the real failures** (one PR, ≈1 day)
+A1 fmt threading · A2 signed tri-state · A3-dedupe · A4 severity/roll-up/order
+· B1 message · D identity-formula guard · E1 pre-flight · E2 real auth error
+· ops: provision the two users.
+
+**Wave 2 — bounds correctness** (≈2 days)
+A5 vocabulary + score registry + author prompt · C1 open ratios · B3 window
+validation + `insight_unmeasurable` · C2 suggestion text.
+
+**Wave 3 — generation calibration** (≈2–3 days)
+B2 boost/band calibration · C2 share_of inference for derived rates · E3
+redeploy tool · F hygiene.
+
+## 5. How we will know
+
+* Replay the 2026-10 acceptance suite (`tests/` — 4 builds, 9 fix families)
+  plus the Turtle, Frontline, Verizon and Humpty-Dump-2 blueprints:
+  warnings per build ≤ 5; zero `bound_not_inferable` for `fmt` int/currency;
+  zero duplicate `(code, measure)`; every `insight_weak` line shows
+  promised / needed / realized; a pile-up only when a bounded rate truly pins.
+* A build for an unprovisioned owner fails inside 10 s with the user and
+  environment named.
+* Tests to extend: `test_measure_bounds.py`, `test_flat_measure_gate.py`,
+  `test_blueprint_measure_hardening.py`, `test_measure_formula.py`,
+  `test_build_abort_policy.py` (on `hf-mcp/main`), validator tests.
+
+## 6. Decisions — made 2026-10-20 (boone: "I want it all in test asap")
+
+1. **Base branch.** The TEST line: `hf-mcp-test/main` @ c0c09a2 (contains
+   prod d139d21 plus the 10-13 → 10-20 test work). All three waves land on one
+   branch, `feature/findings-triage`, built in the "Wave 1: stop the warning
+   noise" session's worktree, then pushed to `hf-mcp-test` only. Prod is
+   boone's call later.
+2. **`bound_not_inferable` severity.** `info` + one roll-up line per build.
+3. **`_RATIO` default.** Keep (0, 1); add an open-ratio veto list.
+4. **Provisioning.** DemoPrep never auto-creates ThoughtSpot users. The two
+   SE accounts (patrick.case, kris.lefebvre) are an admin task on
+   se-thoughtspot-cloud.
+
+## 7. Status — 2026-10-20: Waves 1–3 implemented, not pushed
+
+Branch `feature/findings-triage` (cut from `hf-mcp-test/main` @ c0c09a2, the test
+line). Commits: ISS-22 login precheck cherry-picked (30d7d85), Wave 1 c6a9e6a,
+Wave 2 1e97c45, Wave 3 (see `git log`). Suite: 1402 passed / 5 skipped / 3 failed — the 3 pre-existing test-line failures (`test_iss12_flat_measures::test_no_pile_up_at_the_band_edges`, `test_kpi_sparkline_comparison::...sparkline_state`, `test_liveboard_creation_context::...matrix_config`), plus the pre-existing collection error in `tests/test_blank_threshold.py` (`pymupdf` is not in `.venv`); baseline on c0c09a2 was 1178 passed. Details per wave in
+`sprint_2026_04.md` (Done → "Findings triage, Waves 1–3").
+
+| Item | State |
+|---|---|
+| A1 fmt threading | done — `DatasetColumn.fmt/signed/measure_kind`, `measure_formats`, gate `formats=` (one call site serves App, Chat and MCP) |
+| A2 signed tri-state | done — `MeasureBound(kind="signed")`, `.unbounded`; `is_net_name` for a leading NET |
+| A3 dedupe | done — `quality.findings.dedupe` (cross-stage, post-load wins; same-stage distinct messages kept) |
+| A4 severity / roll-up / order | done — `info`; `slack_notifier.unclassified_rollup_line`; `_priority` tiers; unclassified alone is no post |
+| A5 vocabulary + scores + prompt | done — Wave 2 commit; `measure_score_range_missing` rule; prompt 3c |
+| B1 insight_weak message | done — realized / needed / promised (authored) / direction |
+| B2 boost calibration | done — promise capped to the band, `drive_boost`, stall detection, `insight_promise_capped` |
+| B3 windows + `insight_unmeasurable` | done — `DateSpec.span()/min_window_start()/default_window_start()`, four window rules, `ensure_insight_support` |
+| C1 open ratios | done — veto list, floor-only bound, `pct`→`float`, semantic probe skipped |
+| C2 pile-up text + share_of inference | done — cause-matched suggestion; margin-shape inference; `[BOUND-NOTE]` reasons |
+| D identity formulas | done — `validate` + `alias_target`; mirror never recomputed; cause-named text |
+| E1 pre-flight | done — ISS-22 precheck (cherry-pick) |
+| E2 real auth error | done — `trusted_auth_failure_message` everywhere the error travels |
+| E3 `deploy_existing_schema` | done in code, **unverified live** (mocked tests only); DDL retained on run records from now on |
+| E4 provision the two SEs | ops, open |
+| F hygiene | strip done; width clip stays at 100 until the Supabase migration (sprint doc); display name 80; URL forms verified by test |
+
+Verification still owed (§5): replay the four blueprints on test-mcp and count
+warnings per build; a refused-at-login run through `deploy_existing_schema`.

docs/handoff_iss22_login_precheck_2026_10_14.md

@@ -0,0 +1,122 @@
+# ISS-22 handoff: login precheck before an MCP build
+
+*2026-10-14. Branch `fix/iss-22-login-precheck`, based on `hf-mcp-test/main` = `6a8d963` (what
+test-mcp runs). **Not pushed anywhere and not deployed.** Nothing was run against either Space.*
+
+## The problem
+
+Some users have no ThoughtSpot account on the target cluster. Patrick Case (run `2a1c7306af2a`),
+Kris Lefebvre (`b58980440961`) and James Ward (`1a69f7ab4c7f`) are examples. Clusters can also be
+in standby: sebe was on 2026-10-06 (runs `b22397c2cfb3`, `c34abed7dddb`). In both cases the build
+spent 2–4 minutes generating data and loading Snowflake, which left an orphan schema. It then
+failed at login with "ThoughtSpot authentication failed". For standby, `session_logs` recorded only
+`Expecting value: line 1 column 1 (char 0)`.
+
+## What changed
+
+| File | Change |
+|---|---|
+| `mcp_server.py` | `_login_precheck()`: one trusted-auth token request for the owner, made after `_resolve_ts_target` / `_resolve_owner` and before the build slot. `_refuse_at_login_precheck()` writes the durable rows for a refused call. One call site in `build_demo_from_brief`. `_run_build`'s result row carries `login_precheck`. One docstring sentence. |
+| `thoughtspot_errors.py` | Pure classification: `classify_trusted_login`, `ts_error_reason`, `is_standby_page`, `LOGIN_BLOCKING`, and the messages (`no_account_message`, `standby_message`, `rejected_login_message`, `non_json_auth_error`). |
+| `thoughtspot_deployer.py` | `TRUSTED_TOKEN_PATH`, `TS_REQUEST_HEADERS` and `trusted_token_request_body()` are shared with the precheck, so it sends exactly the build's own login request. `authenticate_trusted()` now reports the real cause of a non-JSON 200 and does not retry it. `deploy_all` now raises `ThoughtSpot authentication failed for <user> on <url>: <cause>` instead of the bare message. |
+| `supabase_client.py` | `log_mcp_result` stores `login_precheck`. That function lists its keys explicitly, so the new key had to be added there. |
+| `tests/test_iss22_login_precheck.py` | New: 46 tests. Every branch uses mocked HTTP, and an autouse fixture fails any unmocked `requests.post`. |
+| `tests/test_chained_portal_settings.py` | Stubs `_login_precheck`, so the existing tool-level test makes no network call. |
+| `tests/test_portal_url_round_trip.py` | Two source-scan tests now read `_run_build`'s source, not the first `log_mcp_result({` in the module. Before the change, the refusal's call would have become that first match, and the tests would have checked the wrong block. |
+
+## Behaviour
+
+The precheck sends `POST {ts_url}/api/rest/2.0/auth/token/full` with the same body and headers the
+deployer uses. The username is normalised the same way the controller normalises it (lower-cased).
+The timeout is `(3, 7)` seconds (connect, read), so the worst case is 10 s.
+
+| ThoughtSpot answers | outcome | Build? | Caller gets |
+|---|---|---|---|
+| 200 with `token`, or 204 | `ok` | starts | `started` (unchanged) |
+| 400/401/403, TS JSON error, "user does not exist" | `no_account` | **refused** | `failed`: `<email> has no ThoughtSpot account on <host>. Ask a ThoughtSpot admin to add them, or pass ts_url for a cluster where they have one.` |
+| 400/401/403, TS JSON error, any other reason | `rejected` | **refused** | `failed`: `ThoughtSpot on <host> refused a trusted-auth login for <email> (HTTP <code>): <ThoughtSpot's reason>` |
+| Non-JSON page containing "Start Instance" / "standby mode" | `standby` | **refused** | `failed`: `<host> is in standby. Open <url> in a browser and complete the wake-up check, then retry.` |
+| Timeout, connection error, 429, 5xx | `transient` | starts | `started`; logged, and the deployer's own login retries |
+| Anything else (200 with no token, a non-TS 4xx such as nginx 405, HTML 400) | `inconclusive` | starts | `started`; logged |
+
+A refused call returns `{status: "failed", run_id, errors: [message], login_precheck}`. It takes no
+build slot and generates nothing. It also writes the same `mcp_intake` and `mcp_result` rows
+(`demo_history`) a build writes, joined by `run_id`, so "who tried to build without an account"
+can still be answered from those rows.
+
+**Recorded on every run.** `login_precheck = {outcome, blocking, http_status, reason, host,
+elapsed_ms[, message]}` is stored on:
+
+- the intake row, which takes it from the call payload;
+- the result row, from both the refusal path and `_run_build`'s `result()`;
+- the hit log, as `LOGIN_PRECHECK ...` and `REFUSED ...` lines.
+
+The record never contains the key or the token.
+
+**Deployer (App tab and MCP).** A 200 that is not JSON now reports one of:
+
+- the standby message above;
+- `ThoughtSpot returned a non-JSON response to the trusted-auth token request (HTTP 200, content-type X): '<first 200 chars>'`.
+
+Both go to `last_auth_error`, which feeds `session_logs` "auth failed", and into the run's error.
+For a missing account, the run error now quotes ThoughtSpot's own reason
+(`Invalid parameter values: {"username":"Specified user does not exist."}`) instead of the raw JSON.
+
+## Evidence the shapes are real
+
+- **Recorded failures.** `session_logs` "auth failed" rows exist for Kris Lefebvre and Patrick
+  Case (10-13), James Ward (09-28, secloud) and mike.boone (08-26, techpartners). All are
+  `HTTP 400`, `code 10002`, with debug text
+  `Invalid parameter values: {"username":"Specified user does not exist."}`.
+- **Live check.** One read-only check per cluster on 2026-10-14, using the fake username
+  `iss22-precheck-no-such-user@example.invalid` (`scratch/iss22_fake_user_probe.py`). Secloud and
+  sebe both returned `400`, `application/json`, with the identical body. The verbatim body is
+  pinned in the tests. No other call was made to ThoughtSpot.
+- **Why the match is on text, not the code.** Code `10002` is ThoughtSpot's generic "Invalid
+  parameter values". It also comes back for a GUID that is not on the cluster, so the
+  classifier matches "user does not exist" in the text instead.
+- **Standby page.** The markers come from the issue text. No copy of the real page was saved: the
+  old code recorded only the parse error. The page title "ThoughtSpot – Start Instance" and the
+  body "standby mode" each trigger the match on their own.
+
+## Tests
+
+Unit suite: `.venv` python, the agreed ignores, `-k "not e2e and not live and not replay"`. The main
+checkout's `.env` was loaded via `scratch/iss22_run_unit_suite.py`.
+
+| | result |
+|---|---|
+| Baseline `6a8d963` | **2 failed, 1130 passed**, 3 skipped, 28 deselected |
+| This branch | **2 failed, 1176 passed**, 3 skipped, 28 deselected |
+
+The 2 failures are the same tests both times, and both existed before this branch:
+`test_iss12_flat_measures.py::test_no_pile_up_at_the_band_edges` and
+`test_kpi_sparkline_comparison.py::test_every_converted_kpi_on_a_board_has_sparkline_state`.
+The extra 46 passes are the new tests.
+
+## What is left / for boone
+
+1. **Not verified on a Space.** The next step is to push to test-mcp when boone says so. Then run
+   one build with a real account (expect `login_precheck.outcome = ok` on the intake row), and one
+   `build_demo_from_brief` with an `owner_email` that has no account (expect `failed` within
+   seconds and no schema).
+2. **Event-loop stall.** In mcp 1.28.1, FastMCP runs sync tools on the event loop. The precheck
+   therefore blocks other calls, including `status()` polls, for as long as it waits: usually one
+   fast request, at most 10 s. That is why the timeout is `(3, 7)`, not 10/10. Making the tool
+   async would remove the stall, but it is a bigger change in a file four agents are editing.
+3. **`rejected` blocks.** A ThoughtSpot JSON 400/401/403 for any reason other than a missing user
+   also blocks, because the build's login would fail the same way. If the cluster's trusted-auth key
+   were wrong, every build to that cluster would now fail in seconds, with ThoughtSpot's reason,
+   instead of minutes later. That outcome is intended, but it is worth knowing.
+4. **`inconclusive` does not block**, even though some of those cases (a 200 HTML that is not
+   standby, an nginx 405) will also fail the deployer's login. The precheck blocks only causes it
+   can name. One example: the 2026-09-02 Jack Rayner "auth failed" rows show a cluster URL
+   ending in `/#` (`.../thoughtspot.cloud/#`) and an nginx 405 in reply. That is a separate
+   URL-normalisation bug and is not fixed here. (`_resolve_ts_target` strips a trailing `/` but
+   not `/#`; I did not check which path those runs took.)
+5. **No Slack post for a refused call.** The SE sees the reason immediately in AgentSpot, and the
+   `demo_history` rows record it. Say if refusals should also post to the deployment channel.
+6. **The App tab is unchanged** apart from the clearer deployer error. App builds could use the
+   same precheck at GO time.
+7. **Sprint doc not updated.** `sprint_2026_04.md` is shared with parallel agents, so it was left
+   alone; add the ISS-22 line when merging.

mcp_server.py

@@ -211,6 +211,96 @@ def _resolve_ts_target(ts_url: str) -> tuple[str, str]:
         f"TS_ENV_<n>_LABEL/URL/KEY_VAR triplet for this instance."
     )
 
+
+# (connect, read) seconds — 10 s worst case. Short on purpose: FastMCP runs this
+# sync tool on the server's event loop, so the wait stalls status() polls. A
+# precheck that gets no answer in time lets the build go ahead (the deployer's
+# own login has retries), so a tight limit costs nothing but a missed early catch.
+_LOGIN_PRECHECK_TIMEOUT = (3, 7)
+
+
+def _login_precheck(ts_url: str, ts_auth_key: str, owner: str) -> dict:
+    """Can `owner` log in to `ts_url` at all? ISS-22.
+
+    ONE trusted-auth token request — the same one the build's own login sends —
+    made before a build takes a slot or generates anything. A user with no
+    account on the cluster, or a cluster in standby, used to cost 2-4 minutes of
+    data generation and a Snowflake load (an orphan schema) and then fail at
+    login as "ThoughtSpot authentication failed".
+
+      no_account / rejected / standby  blocking; `message` says why and what to do
+      transient (timeout, 429, 5xx)    not blocking; the deployer retries its login
+      ok / inconclusive                not blocking
+
+    Returns the outcome record that rides on the run's intake and result rows.
+    """
+    import requests
+    from chat_interface import require_authenticated_email
+    from thoughtspot_deployer import (
+        TRUSTED_TOKEN_PATH, TS_REQUEST_HEADERS, trusted_token_request_body,
+    )
+    from thoughtspot_errors import (
+        LOGIN_BLOCKING, classify_trusted_login, no_account_message,
+        rejected_login_message, standby_message,
+    )
+
+    # The username the build's deployer will send (the controller normalises it).
+    username = require_authenticated_email(user_email=owner)
+    started = time.time()
+    http_status = None
+    try:
+        resp = requests.post(
+            f"{ts_url}{TRUSTED_TOKEN_PATH}",
+            json=trusted_token_request_body(username, ts_auth_key),
+            headers=TS_REQUEST_HEADERS,
+            timeout=_LOGIN_PRECHECK_TIMEOUT,
+        )
+        http_status = resp.status_code
+        outcome, reason = classify_trusted_login(
+            resp.status_code, resp.headers.get("content-type", ""), resp.text)
+    except requests.RequestException as e:
+        outcome, reason = "transient", f"{type(e).__name__}: {e}"
+
+    record = {
+        "outcome": outcome,
+        "blocking": outcome in LOGIN_BLOCKING,
+        "http_status": http_status,
+        "reason": reason[:300],
+        "host": _host_of(ts_url),
+        "elapsed_ms": round((time.time() - started) * 1000),
+    }
+    if outcome == "no_account":
+        record["message"] = no_account_message(owner, ts_url)
+    elif outcome == "standby":
+        record["message"] = standby_message(ts_url)
+    elif outcome == "rejected":
+        record["message"] = rejected_login_message(owner, ts_url, http_status, reason)
+    _log_hit(f"LOGIN_PRECHECK owner={owner!r} host={record['host']} outcome={outcome} "
+             f"http={http_status} {record['elapsed_ms']}ms reason={reason[:200]!r}")
+    return record
+
+
+def _refuse_at_login_precheck(call_payload: dict, brief: str, company_name: str,
+                              use_case: str, ts_url: str, owner: str) -> dict:
+    """Fail a call the login precheck refused, leaving the same durable intake +
+    result rows a build leaves — "who tried to build without a ThoughtSpot
+    account" was answered from those rows, and must stay answerable."""
+    precheck = call_payload["login_precheck"]
+    run_id = uuid.uuid4().hex[:12]
+    log_mcp_payload({**call_payload, "run_id": run_id, "resolved_ts_url": ts_url,
+                     "resolved_owner_email": owner, "brief": brief})
+    log_mcp_result({
+        **deployment_identity(),
+        "run_id": run_id, "company_name": company_name, "use_case": use_case,
+        "owner_email": owner, "ts_url": ts_url, "status": "failed",
+        "errors": [precheck["message"]], "login_precheck": precheck,
+        "elapsed_seconds": round(precheck["elapsed_ms"] / 1000, 1),
+    })
+    _log_hit(f"REFUSED run_id={run_id} at login precheck: {precheck['message']}")
+    return {"status": "failed", "run_id": run_id, "errors": [precheck["message"]],
+            "login_precheck": precheck}
+
+
 from mcp.server.fastmcp import FastMCP
 from mcp.server.transport_security import TransportSecuritySettings
 
@@ -529,7 +619,9 @@ def status() -> dict:
     with _state_lock:
         active = [dict(b) for b in _active_builds.values()]
         last = dict(_last_build) if _last_build else None
-        recent = [dict(r) for r in _recent_builds.values()]
+        # Without the DDL: it is kept on the record for deploy_existing_schema,
+        # not for a status poll.
+        recent = [{k: v for k, v in r.items() if k != "ddl"} for r in _recent_builds.values()]
         count = _build_count
     for b in active:
         b["elapsed_seconds"] = round(now - b.pop("started_at", now), 1)
@@ -582,8 +674,13 @@ def _run_build(run_id: str, brief: str, company_name: str, use_case: str, compan
                ts_target_url: str, ts_auth_key: str, owner: str,
                with_portal: bool = True, call_payload: dict | None = None,
                portal_options: dict | None = None,
-               salesforce_opportunity_id: str = "") -> dict:
+               salesforce_opportunity_id: str = "",
+               existing_schema: str = "", existing_ddl: str = "") -> dict:
     """Drive the controller headlessly (runs in a BACKGROUND THREAD; the caller has
+    already registered the build in _active_builds and holds a _build_sem slot).
+    With `existing_schema` + `existing_ddl` (deploy_existing_schema) the dataset,
+    DDL and Snowflake steps are skipped and the run continues from the ThoughtSpot
+    deploy against that schema. Otherwise: the caller has
     already registered the build in _active_builds and holds a _build_sem slot (released when this
     returns). Mirrors tests/newvision_sample_runner.py but injects `brief` in place of
     the research phase. Returns a structured dict and never raises — failures come back
@@ -658,11 +755,14 @@ def _run_build(run_id: str, brief: str, company_name: str, use_case: str, compan
                 "ddl": out["ddl"],
                 "finished_at": time.strftime("%H:%M:%S"),
             }
-            # Per-run result (compact, no ddl) so concurrent callers can collect EACH
-            # build by run_id without racing the single _last_build slot.
+            # Per-run result so concurrent callers can collect EACH build by run_id
+            # without racing the single _last_build slot. Carries the DDL so a run
+            # that died at the ThoughtSpot step can be finished from its schema
+            # (deploy_existing_schema); status() leaves the DDL out of its copies.
             _recent_builds[run_id] = {
                 "run_id": out["run_id"], "status": out["status"], "schema": out["schema"],
-                "company_name": company_name,
+                "company_name": company_name, "use_case": use_case, "company_url": company_url,
+                "ddl": out["ddl"],
                 # The portal URL is the deliverable a caller shows a customer, so
                 # it has to travel on EVERY channel that reports a run — not just
                 # the return value. It was in `out` but in neither of these two
@@ -707,6 +807,10 @@ def _run_build(run_id: str, brief: str, company_name: str, use_case: str, compan
             "findings_persisted": out["findings_persisted"],
             "findings_persist_error": out["findings_persist_error"],
             "elapsed_seconds": out["elapsed_seconds"],
+            "login_precheck": (call_payload or {}).get("login_precheck"),
+            # Kept so deploy_existing_schema can finish this run later from its
+            # schema if ThoughtSpot refused it (E3).
+            "ddl": out["ddl"],
         })
         _log_hit(f"RESULT_PERSISTED run_id={run_id} status={out['status']} supabase={_persisted_result}")
         return out
@@ -791,31 +895,44 @@ def _run_build(run_id: str, brief: str, company_name: str, use_case: str, compan
             print(f"[MCP] run logger init failed (continuing without it): {_log_err}",
                   file=sys.stderr)
 
-        # (iv) DDL — returns a (response, ddl) tuple; NOT a generator.
-        _set_progress(run_id, phase="building dataset + DDL", detail="")
-        resp, ddl_text = controller.run_ddl_creation()
-        if not ddl_text or "CREATE TABLE" not in ddl_text.upper():
-            return result("failed", error=f"DDL generation failed: {str(resp)[:500]}")
-        # Surface the DDL immediately — it exists ~5 min in, well before the ~15-min
-        # TS deploy — so a caller polling status() gets the schema as soon as it's ready.
-        with _state_lock:
-            b = _active_builds.get(run_id)
-            if b is not None:
-                b["ddl"] = ddl_text
-
-        # (v) Snowflake load, then ThoughtSpot. Both are generators — draining them
-        # IS what runs the work. Decoupled from validation_mode: drain the Snowflake
-        # generator, read the schema it set, then run the TS deploy ourselves.
-        _set_progress(run_id, phase="loading Snowflake", detail="")
-        for _item in controller.run_deployment_streaming():
-            _apply_progress(run_id, _item)
-        schema = getattr(controller, "_deployed_schema_name", None)
-        if not schema:
-            return result(
-                "failed",
-                schema=getattr(controller, "_last_schema_name", None),
-                error="Snowflake load did not complete (no deployed schema).",
-            )
+        if existing_schema:
+            # (iv-v) REDEPLOY: the schema is already loaded — a build that died at
+            # the ThoughtSpot step (no account on the cluster, a cluster in
+            # standby). Skip generation and the load, hand the controller the DDL
+            # it would have produced, and continue from the ThoughtSpot deploy
+            # (deploy_existing_schema; findings triage 2026-10-15, E3).
+            ddl_text = existing_ddl
+            controller.ddl_code = existing_ddl
+            controller.demo_builder.schema_generation_results = existing_ddl
+            controller._deployed_schema_name = existing_schema
+            schema = existing_schema
+            _log_hit(f"REDEPLOY run_id={run_id} schema={schema} (no generation, no load)")
+        else:
+            # (iv) DDL — returns a (response, ddl) tuple; NOT a generator.
+            _set_progress(run_id, phase="building dataset + DDL", detail="")
+            resp, ddl_text = controller.run_ddl_creation()
+            if not ddl_text or "CREATE TABLE" not in ddl_text.upper():
+                return result("failed", error=f"DDL generation failed: {str(resp)[:500]}")
+            # Surface the DDL immediately — it exists ~5 min in, well before the ~15-min
+            # TS deploy — so a caller polling status() gets the schema as soon as it's ready.
+            with _state_lock:
+                b = _active_builds.get(run_id)
+                if b is not None:
+                    b["ddl"] = ddl_text
+
+            # (v) Snowflake load, then ThoughtSpot. Both are generators — draining them
+            # IS what runs the work. Decoupled from validation_mode: drain the Snowflake
+            # generator, read the schema it set, then run the TS deploy ourselves.
+            _set_progress(run_id, phase="loading Snowflake", detail="")
+            for _item in controller.run_deployment_streaming():
+                _apply_progress(run_id, _item)
+            schema = getattr(controller, "_deployed_schema_name", None)
+            if not schema:
+                return result(
+                    "failed",
+                    schema=getattr(controller, "_last_schema_name", None),
+                    error="Snowflake load did not complete (no deployed schema).",
+                )
 
         _set_progress(run_id, phase="deploying ThoughtSpot model + liveboard", detail="")
         # Real-time status: on_progress fires from the deploy thread for EVERY
@@ -1009,7 +1126,9 @@ def build_demo_from_brief(
         live customer-facing site built from the liveboard, and download_url,
         a zip of its editable source for changing what the interview cannot
         express (both empty when with_portal=False). A portal failure never
-        fails the build; it lands in warnings.
+        fails the build; it lands in warnings. If owner_email cannot log in to
+        the cluster (no account there, or the cluster is in standby) the call
+        fails at once with the reason and nothing is built.
     """
     _log_hit(
         f"CALL build_demo_from_brief company={company_name!r} use_case={use_case!r} "
@@ -1040,6 +1159,13 @@ def build_demo_from_brief(
     except RuntimeError as e:
         return {"status": "failed", "errors": [str(e)]}
 
+    # Can the owner log in there at all? One short request, before a slot is taken
+    # or anything is generated (ISS-22). The outcome rides on the run's records.
+    _payload["login_precheck"] = precheck = _login_precheck(ts_target_url, ts_auth_key, owner)
+    if precheck["blocking"]:
+        return _refuse_at_login_precheck(_payload, brief, company_name, use_case,
+                                         ts_target_url, owner)
+
     # Bounded concurrency: grab a build slot (non-blocking). Only when ALL slots are
     # in use does a call get 'busy' — otherwise it runs alongside the others.
     if not _build_sem.acquire(blocking=False):
@@ -1085,6 +1211,167 @@ def build_demo_from_brief(
     }
 
 
+# ------------------------------------------------------- redeploy a schema
+
+def _run_record(run_id: str) -> tuple[dict, str]:
+    """What is known about a past run: (record, source).
+
+    This server's memory first (_recent_builds / _last_build — everything but
+    the brief), then the durable demo_history rows (fetch_mcp_run: the intake
+    row carries the brief and the call, the result row the schema and, since
+    2026-10-20, the DDL). Source is "memory", "demo_history" or "" when the run
+    is unknown. The brief is always taken from demo_history when it is there,
+    since memory never holds it.
+    """
+    run_id = (run_id or "").strip()
+    if not run_id:
+        return {}, ""
+    with _state_lock:
+        rec = dict(_recent_builds.get(run_id) or {})
+        if not rec and _last_build and _last_build.get("run_id") == run_id:
+            rec = dict(_last_build)
+    from supabase_client import fetch_mcp_run
+
+    rows = fetch_mcp_run(run_id) or {}
+    intake, result = rows.get("intake") or {}, rows.get("result") or {}
+    if rec:
+        rec.setdefault("brief", intake.get("brief") or "")
+        rec.setdefault("use_case", intake.get("use_case") or "")
+        rec.setdefault("company_url", intake.get("company_url") or "")
+        return rec, "memory"
+    if not intake and not result:
+        return {}, ""
+    return {
+        "run_id": run_id,
+        "company_name": result.get("company_name") or intake.get("company_name") or "",
+        "use_case": result.get("use_case") or intake.get("use_case") or "",
+        "company_url": intake.get("company_url") or "",
+        "owner_email": (result.get("owner_email") or intake.get("resolved_owner_email")
+                        or intake.get("owner_email") or ""),
+        "ts_url": result.get("ts_url") or intake.get("resolved_ts_url") or intake.get("ts_url") or "",
+        "schema": result.get("schema") or "",
+        "ddl": result.get("ddl") or "",
+        "brief": intake.get("brief") or "",
+    }, "demo_history"
+
+
+@mcp.tool()
+def deploy_existing_schema(
+    run_id: str = "",
+    schema: str = "",
+    owner_email: str = "",
+    ts_url: str = "",
+    company_name: str = "",
+    use_case: str = "",
+    company_url: str = "",
+    ddl: str = "",
+    brief: str = "",
+    with_portal: bool = True,
+) -> dict:
+    """Finish a build whose data is ALREADY in Snowflake: deploy the ThoughtSpot
+    model + liveboard (and the portal) for an existing schema, without
+    regenerating anything.
+
+    For a build that died at the ThoughtSpot step — the owner had no account on
+    the cluster, or the cluster was in standby — once the account exists, or
+    with a different cluster. Lead Forensics and Rice (2026-10-13..15) were
+    rebuilt from scratch three times for want of this.
+
+    Identify the run by `run_id`: schema, DDL, company, use case, brief,
+    cluster and owner are recovered from its records (this server's memory
+    first, then demo_history). Override what changed — usually `owner_email`
+    (the SE whose account now exists) or `ts_url`. Without `run_id`, pass
+    `schema`, `ddl` (the CREATE TABLE text the build returned) and
+    `company_name` yourself; `brief` improves the liveboard's story.
+
+    Runs in the background like build_demo_from_brief (~3-6 minutes) and
+    returns a NEW run_id at once; poll status() for the model URL, liveboard
+    URL and portal_url. The login precheck runs first, so a user who still has
+    no account is refused in seconds with the reason.
+
+    Returns:
+        dict: {status: "started", run_id, redeploy_of_run_id, schema, message},
+        or {status: "failed"|"busy", errors: [...]}.
+    """
+    _log_hit(f"CALL deploy_existing_schema run_id={run_id!r} schema={schema!r} "
+             f"owner={owner_email!r} ts_url={ts_url!r}")
+    _payload = _call_payload(_inspect.currentframe())
+
+    record, source = _run_record(run_id)
+    if run_id and not record:
+        return {"status": "failed", "errors": [
+            f"run {run_id!r} is not known to this server or to demo_history — pass schema, "
+            "ddl and company_name directly"]}
+    schema = (schema or record.get("schema") or "").strip()
+    ddl = (ddl or record.get("ddl") or "").strip()
+    company_name = (company_name or record.get("company_name") or "").strip()
+    use_case = (use_case or record.get("use_case") or "Custom Analytics").strip()
+    company_url = (company_url or record.get("company_url") or "").strip()
+    brief = (brief or record.get("brief") or "").strip()
+    owner_email = (owner_email or record.get("owner_email") or "").strip()
+    ts_url = (ts_url or record.get("ts_url") or "").strip()
+
+    missing = [name for name, value in (("schema", schema), ("ddl", ddl), ("company_name", company_name))
+               if not value]
+    if missing:
+        why = f"cannot redeploy without {', '.join(missing)}"
+        if run_id:
+            why += (f" — run {run_id}'s records do not carry them (built before DDL was kept on "
+                    "the result row); pass them directly")
+        return {"status": "failed", "errors": [why]}
+    if "CREATE TABLE" not in ddl.upper():
+        return {"status": "failed", "errors": ["ddl must be the CREATE TABLE text of the loaded schema"]}
+
+    try:
+        ts_target_url, ts_auth_key = _resolve_ts_target(ts_url)
+        owner = _resolve_owner(owner_email)
+    except RuntimeError as e:
+        return {"status": "failed", "errors": [str(e)]}
+
+    _payload.update({"redeploy_of_run_id": run_id, "resolved_from": source or "arguments"})
+    # The same precheck a fresh build gets: the whole point of this tool is a
+    # user who could not log in last time, so say at once whether they can now.
+    _payload["login_precheck"] = precheck = _login_precheck(ts_target_url, ts_auth_key, owner)
+    if precheck["blocking"]:
+        return _refuse_at_login_precheck(_payload, brief, company_name, use_case,
+                                         ts_target_url, owner)
+
+    if not _build_sem.acquire(blocking=False):
+        return {
+            "status": "busy",
+            "errors": [f"All {_MAX_CONCURRENT_BUILDS} build slots are in use. Poll status(); retry when one frees."],
+        }
+
+    new_run_id = uuid.uuid4().hex[:12]
+    global _build_count
+    with _state_lock:
+        _build_count += 1
+        _active_builds[new_run_id] = {
+            "run_id": new_run_id, "company_name": company_name, "use_case": use_case,
+            "ts_url": ts_target_url, "schema": schema, "redeploy_of_run_id": run_id,
+            "started_at": time.time(), "phase": "starting (redeploy of an existing schema)",
+        }
+
+    def _worker() -> None:
+        try:
+            _run_build(new_run_id, brief, company_name, use_case, company_url, ts_target_url,
+                       ts_auth_key, owner, with_portal, _payload,
+                       portal_options=_chained_portal_options(),
+                       existing_schema=schema, existing_ddl=ddl)
+        finally:
+            _build_sem.release()
+
+    threading.Thread(target=_worker, daemon=True, name=f"redeploy-{new_run_id}").start()
+    return {
+        "status": "started",
+        "run_id": new_run_id,
+        "redeploy_of_run_id": run_id,
+        "schema": schema,
+        "message": ("ThoughtSpot deploy started in the background for the existing schema "
+                    "(~3-6 min). Poll status() for the model URL, liveboard URL and portal_url."),
+    }
+
+
 # --------------------------------------------------------------------- portal
 
 _portal_sem = threading.Semaphore(2)  # portal builds are cheap; bound them anyway

slack_notifier.py

@@ -159,7 +159,66 @@ def notify_dataset_quality_failure(
 #: How many findings one Slack message spells out. The rest are counted and
 #: live in demo_findings; a 40-line message is one nobody reads.
 MAX_FINDINGS_IN_SLACK = 12
-_SEVERITY_ORDER = {"critical": 0, "warning": 1, "info": 2}
+#: How many unclassified measure names the roll-up line spells out.
+MAX_UNCLASSIFIED_NAMED = 15
+
+#: The one code that is rolled up into a single line per build instead of
+#: being listed: a measure no bound class matched. It is a vocabulary gap in
+#: dataset/measure_names.py, not a defect in the build's data, and it produced
+#: ~600 of the 662 warnings posted over 2026-10-12..15 — filling every visible
+#: slot while the pile-ups, the mirrored column and the weak insights fell
+#: under "… and N more". Severity `info` since 2026-10-20 (boone).
+ROLLUP_CODE = "bound_not_inferable"
+
+#: Post-load / generation data defects: listed right after anything that
+#: blocks the send, before the weak insights and the blueprint blemishes.
+_DATA_DEFECT_CODES = frozenset({
+    "measure_bound_pileup", "measure_mirrors_other_column", "repair_failed",
+    "measure_constant", "part_exceeds_whole", "flag_not_binary", "measure_clamped",
+    "measure_soft_violation", "measure_mostly_zero", "measure_defect",
+})
+
+
+def _priority(f) -> tuple:
+    """Sort key: what would stop the demo first, blueprint blemishes last.
+
+    Alphabetical-by-code inside a severity put `bound_not_inferable` in every
+    one of the 12 visible slots. Tiers: critical → send-blocking → data defect
+    (pile-up, mirror, repair that did not hold) → weak insight → the rest.
+    """
+    if f.severity == "critical":
+        tier = 0
+    elif f.blocks_send:
+        tier = 1
+    elif f.code in _DATA_DEFECT_CODES:
+        tier = 2
+    elif f.code in ("insight_weak", "insight_unmeasurable"):
+        tier = 3
+    else:
+        tier = 4
+    return (tier, f.code, f.target)
+
+
+def unclassified_rollup_line(findings: Iterable) -> str:
+    """One line naming every measure no bound class matched, or "" when none.
+
+    Deduped on the measure: the blueprint stage and the post-load gate both
+    emit the record (one from the declared mean, one from the observed), and
+    the same measure must not be counted twice.
+    """
+    names = sorted({
+        (f.target or f.measure or "?")
+        for f in findings if getattr(f, "code", "") == ROLLUP_CODE
+    })
+    if not names:
+        return ""
+    shown = ", ".join(names[:MAX_UNCLASSIFIED_NAMED])
+    more = f" … +{len(names) - MAX_UNCLASSIFIED_NAMED} more" if len(names) > MAX_UNCLASSIFIED_NAMED else ""
+    return (
+        f"ℹ️ {len(names)} measure(s) unclassified — no bound class matched the name, so no range "
+        f"was checked (a vocabulary gap in dataset/measure_names.py, not a data defect; every "
+        f"record is in demo_findings): {shown}{more}"
+    )
 
 
 def format_build_findings(
@@ -177,13 +236,22 @@ def format_build_findings(
 ) -> str:
     """The Slack text for a build's findings: prospect · SE · severity · what we
     noticed · the board link. `findings` are quality.findings.Finding records;
-    `info` records are left out (they are actions that worked). `persisted`
-    says whether the same records reached demo_findings (None = not attempted);
-    a failed write is stated in the post, never hidden. Returns "" when there
-    is nothing worth a message. Pure, so it is testable without Slack."""
+    `info` records are left out (they are actions that worked), except that the
+    unclassified-measure records (ROLLUP_CODE, whatever their severity) become
+    ONE roll-up line placed last. Records are deduped on (code, table, measure)
+    across stages first, keeping the post-load one. The list is ordered by
+    _priority, not alphabetically. `persisted` says whether the same records
+    reached demo_findings (None = not attempted); a failed write is stated in
+    the post, never hidden. Returns "" when there is nothing worth a message —
+    unclassified measures alone are a registry note, not a post. Pure, so it is
+    testable without Slack."""
+    from demoprep_app.quality.findings import dedupe
+
+    records = dedupe(list(findings))
     visible = sorted(
-        (f for f in findings if getattr(f, "severity", "") in ("critical", "warning")),
-        key=lambda f: (_SEVERITY_ORDER.get(f.severity, 9), 0 if f.blocks_send else 1, f.code),
+        (f for f in records
+         if getattr(f, "severity", "") in ("critical", "warning") and f.code != ROLLUP_CODE),
+        key=_priority,
     )
     if not visible:
         return ""
@@ -218,6 +286,9 @@ def format_build_findings(
         lines.append(f"• [{f.severity.upper()}] {f.code}{where}: {f.message}{fix}"[:600])
     if len(visible) > MAX_FINDINGS_IN_SLACK:
         lines.append(f"… and {len(visible) - MAX_FINDINGS_IN_SLACK} more (every finding is in demo_findings)")
+    rollup = unclassified_rollup_line(records)
+    if rollup:
+        lines.append(rollup)
     return "\n".join(lines)
 
 

sprint_2026_04.md

@@ -607,6 +607,12 @@ implementation keeps:
 
 ### Sprint 4 (this sprint)
 
+- [x] **Findings triage, Waves 1–3 (Oct 20) — on `feature/findings-triage`, cut from the test line `hf-mcp-test/main` c0c09a2; NOT pushed.** Plan: `docs/PLAN_findings_triage_2026_10_15.md` (copy of the parent session's `dev_notes/` original, status section appended to both) (47 SE builds Oct 12–15: ~600 of 662 Slack warnings were `bound_not_inferable`; four deploy failures were unprovisioned users reported as "authentication failed"). Four commits: ISS-22 login precheck cherry-picked (6747616 → 30d7d85), Wave 1 c6a9e6a, Wave 2 1e97c45, Wave 3 (this entry's tip). Decisions (boone 2026-10-20): `bound_not_inferable` = `info` + one roll-up line; `_RATIO` keeps 0-1 with an open-ratio veto; never auto-create ThoughtSpot users.
+  - **Wave 1 — stop the noise, show the real failures.** The post-load gate now reads the blueprint's `fmt`/`signed`/`kind` per measure (`DatasetColumn` carries them, `quality_gate.measure_formats`, threaded from `chat_interface`; the MCP path runs the same controller), so an int count or a currency amount is non-negative, not "unclassified". `infer_bound` returns a `signed` `MeasureBound` (unbounded by design, no gap) for NET_/MARGIN/VARIANCE/FLOW names, declared-signed measures and difference formulas instead of the same `None` as "no class matched". `quality.findings.dedupe`: one record per (code, table, measure) across stages, post-load wins (CSAT_SCORE_SUM was posted twice per build). `bound_not_inferable` is `info` at both emitters; Slack posts one roll-up line last and orders findings critical → send-blocking → data defect → insight_weak → rest. `insight_weak` states realized / needed / promised (as authored — `PlantedInsight.authored_magnitude`) / direction; the old text printed the pass bar as "it promised". `formula.validate` reports a copy (`X`, `X*1`, `1*X`, `X/1`, `X+0`) before generation; the gate never recomputes a mirror (straight to omit) and names the cause. `deploy_all`'s auth error is `thoughtspot_errors.trusted_auth_failure_message`: a missing account is the plain instruction naming user + cluster; the same text reaches the run errors, the MCP result and the Slack "Failed" post.
+  - **Wave 2 — bounds correctness.** Vocabulary: CAD/AUD/… currencies, a count vocabulary (plural nouns + counted events), money nouns (COGS, GMV, AUM, COMMISSION, FARE, MSRP, BUDGET…), physical units, proportion words (EFFICIENCY, COMPLETENESS, AVAILABILITY, ACCURACY, RETENTION, CONVERSION, UPTIME, LOAD_FACTOR…). `NAMED_SCORE_SCALES` (SAT 400-1600, ACT 1-36, CSAT 1-5, CES 1-7, GPA 0-4/0-5); `is_score_column` excludes `_SUM`/`TOTAL_` shapes; `findings()` warns `measure_score_range_missing` and the author prompt requires low/high on a score (3c). Open ratios (COVERAGE, COMBINED, TURNOVER, LEVERAGE, TURNS, CURRENT, QUICK, LOSS…, BOOK_TO_BILL, LTV_CAC, DEBT_TO) get a floor and no ceiling, keep AVERAGE aggregation, skip the post-load [0,1] probe, and `harden()` turns a declared `pct` into `float` (Bruker's 99.8%-pinned PIPELINE_COVERAGE_RATIO). Windows: `DateSpec.span()` is THE history the engine generates; `findings()` warns on a window that is unreadable / after the data / leaves < ⅓ history before it; `autorepair()` moves it to the start of the last third (the hard-coded 2025-06-01 is gone). `ensure_insight_support()` sizes a thin segment's `mix_weight` from `BlueprintEngine.rows_per_fact` before generation; the too-few-rows case is its own code `insight_unmeasurable`. Pile-up suggestions match the cause (derived ratio → declare share_of).
+  - **Wave 3 — calibration, redeploy, hygiene.** B2: a promise on a BOUNDED measure is capped at what the band can deliver (`_deliverable_band_ratio`, `(low+0.9w)/(low+0.5w)` × 0.9 margin) and `PlantedInsight.drive_boost` pushes the rows' position in the band instead of inflating the magnitude; `insight_promise_capped` records it; the tuning loop stops when a round realized the same ratios (`_tuning_stalled`). C2: a margin rate (`GROSS_MARGIN / NET_SALES` with `GROSS_MARGIN = NET_SALES - COGS`, or `(NET_SALES - COGS) / NET_SALES`) bounds COGS as a share of NET_SALES through the difference; `[BOUND-NOTE]` hardening lines say why a rate was left to the MIN/MAX wrap. E3: MCP tool `deploy_existing_schema(run_id | schema+ddl+company_name, owner_email, ts_url…)` finishes a build from its loaded schema — `_run_build(existing_schema=…, existing_ddl=…)` skips generation and the load; the DDL is now kept on `_recent_builds` and the `demo_history` mcp_result row (`results.ddl`); `supabase_client.fetch_mcp_run` recovers older runs' intake/result rows. **Not verified against a live cluster** — mocked tests only; first real use should be a replay of a build refused at login. F: `demo_history` text values stripped (`_history_text`); the clip stays at 100 because the columns are `varchar(100)` — **Supabase migration for boone**: `alter table demo_history alter column company_name type text, alter column use_case type text;` then raise `DEMO_HISTORY_TEXT_WIDTH`. `extract_company_name` clips at 80 not 30. Both pinboard URL forms (`/#/pinboard/`, `/#/insights/pinboard/`) already parse everywhere a GUID is read (test added).
+  - **Tests:** 1402 passed / 5 skipped / 3 failed — the 3 pre-existing test-line failures (`test_iss12_flat_measures::test_no_pile_up_at_the_band_edges`, `test_kpi_sparkline_comparison::...sparkline_state`, `test_liveboard_creation_context::...matrix_config`), plus the pre-existing collection error in `tests/test_blank_threshold.py` (`pymupdf` is not in `.venv`); baseline on c0c09a2 was 1178 passed (`pytest tests --noconftest --continue-on-collection-errors`, `.venv`). Extended: `test_measure_bounds.py`, `test_measure_formula.py`, `test_quality_gate.py`, `test_flat_measure_gate.py`, `test_build_abort_policy.py` (incl. the rule guard for 5 new warning rules), `test_gate_severity.py`, `test_iss22_login_precheck.py`, `test_tuning_round_findings.py`; new `test_deploy_existing_schema.py`.
+  - **Still open from the plan:** ops — provision patrick.case and kris.lefebvre on se-thoughtspot-cloud (admin task); the Supabase column widening above; replay the Turtle / Frontline / Verizon / Humpty-Dump-2 blueprints on test-mcp to confirm warnings per build ≤ 5 (plan §5); Virtuoso/sebe TML-export gap unchanged. Push to `hf-mcp-test` is boone's call.
 - [x] **Test suite collection fix (Oct 14)** — `tests/test_dataset_first_builders.py` deleted. It imported `infer_scenario_type`, which `3993fe3` (Jul 23, single blueprint pipeline) removed along with the keyword router, so `pytest --noconftest tests/` had aborted at collection ever since. All 28 tests asserted template-era routing and table shapes (`scenario_type == "saas_sales"`, fixed table lists, `build is None` for custom prompts, `company_contract_*` metadata, `RetailSalesDatasetGenerator`) that the LLM-authored blueprint path never produces; `build_dataset_first_demo` is now only an alias for `build_demo`, which always calls the LLM, so none were runnable offline. Explicit-table directives are covered by `tests/test_mckesson_regression.py`. Also re-pointed `tests/test_blueprint_pipeline.py`'s `_boost_weak_insights` import from the `dataset_first` shim (which never exported it) to `build_demo`. Suite now collects clean on the test line: 1178 pass / 5 skipped / 3 pre-existing fails (`test_iss12_flat_measures::test_no_pile_up_at_the_band_edges`, `test_kpi_sparkline_comparison::test_every_converted_kpi_on_a_board_has_sparkline_state`, `test_liveboard_creation_context::...uses_model_columns_and_matrix_config` — all fail identically on untouched 6a8d963). The LLM-free smoke script `tests/test_blueprint_pipeline.py` now gets past its boost loop (was ImportError on this line) and exposes a pre-existing WEAK planted insight (`evening_delivery_niche` observed 0.47 vs 1.33 required; same back to 5069b0c) — follow-up. Branch `fix/test-suite-collection`, rebased onto 7ffe729 for the test push ✅
 - [ ] **Sep 28 — Opp ID + ISS-14 (AgentQ integration).** (a) **Opp ID — done on the MCP side, live on test-mcp `a996568`** (Jack's `salesforce_opportunity_id` on `build_demo_from_brief`, merged by the release session; prod `baca424` does not have it). It reaches the log with no further code: `demo_history` mcp_intake `results.salesforce_opportunity_id` (`_call_payload` → `log_mcp_payload` stores the whole call) and `session_logs` `run started` `meta.payload.form.salesforce_opportunity_id` (`controller._run_payload`). (b) **Snowflake quality report** = `DEMOPREP_REPORTING.REPORTING.DEMO_RUNS` (built Sep 28 by the reviewer session as a batch copy Supabase → Snowflake; loader scripts `refresh_runs.py` + `to_snowflake.py` exist only in that session's scratchpad, not the repo). Column `SALESFORCE_OPPORTUNITY_ID VARCHAR` added Sep 28 (survives the loader's TRUNCATE). **Still to do for it to fill:** Supabase `demo_runs` column (SQL-editor DDL), `refresh_runs.py` run dict `'salesforce_opportunity_id': irf.get('salesforce_opportunity_id') or None`, `to_snowflake.py` SPEC `('salesforce_opportunity_id', V)`; then get both scripts into `scripts/`. (c) ISS-14 fixed on `fix/iss-14-portal-date-dimension` (off test tip `925af12`; NOT pushed). **Next:** push to test-mcp (boone), replay a Collegis/General Mills brief, confirm the portal builds, then Jack can point AgentQ at it.
 

supabase_client.py

@@ -769,6 +769,61 @@ def inject_admin_settings_to_env() -> bool:
     return injected > 0
 
 
+#: Width of demo_history's top-level text columns (company_name, use_case):
+#: varchar(100) in the Supabase schema. The full values always travel in the
+#: `results` JSON untruncated; these columns are the index the reporting
+#: queries group on, and "OMERS Administration Corporati" / "…with futu"
+#: (findings triage 2026-10-15, F) is what 100 does to them. Widening is a
+#: Supabase migration (boone):
+#:   alter table demo_history alter column company_name type text,
+#:                            alter column use_case type text;
+#: then raise this constant (or drop the clip). The clip stays until then,
+#: because an oversize value fails the INSERT and loses the whole record.
+DEMO_HISTORY_TEXT_WIDTH = 100
+
+
+def _history_text(value: Any) -> str:
+    """A demo_history text column value: whitespace stripped (a trailing space
+    made "Humpty Dump Roll Off Services " a second prospect), then clipped to
+    the column's width."""
+    return str(value or "").strip()[:DEMO_HISTORY_TEXT_WIDTH]
+
+
+def fetch_mcp_run(run_id: str) -> Optional[Dict[str, Any]]:
+    """The durable records of one MCP run: {"intake": {...}, "result": {...}}.
+
+    Each is the row's `results` JSON merged with its top-level company_name /
+    use_case, or {} when that row does not exist. None when Supabase is off or
+    the lookup fails — never raises (mcp_server.deploy_existing_schema reads
+    this to recover a run's schema, DDL, brief, owner and cluster).
+    """
+    try:
+        client = SupabaseSettings()
+        if not getattr(client, "enabled", False) or not (run_id or "").strip():
+            return None
+        resp = (
+            client.client.table("demo_history")
+            .select("status,company_name,use_case,results,created_at")
+            .eq("results->>run_id", run_id.strip())
+            .in_("status", ["mcp_intake", "mcp_result"])
+            .order("created_at", desc=True)
+            .execute()
+        )
+        out: Dict[str, Any] = {"intake": {}, "result": {}}
+        for row in getattr(resp, "data", None) or []:
+            key = "intake" if row.get("status") == "mcp_intake" else "result"
+            if out[key]:
+                continue        # newest row of each kind wins
+            merged = dict(row.get("results") or {})
+            merged.setdefault("company_name", row.get("company_name") or "")
+            merged.setdefault("use_case", row.get("use_case") or "")
+            out[key] = merged
+        return out
+    except Exception as e:
+        print(f"⚠️  mcp run lookup failed for {run_id!r}: {e}", flush=True)
+        return None
+
+
 def log_mcp_payload(payload: Dict[str, Any]) -> bool:
     """Durably persist a raw MCP intake payload (the full brief + metadata) so real
     research payloads survive container restarts / log rotation — i.e. so you can tell
@@ -805,9 +860,9 @@ def log_mcp_payload(payload: Dict[str, Any]) -> bool:
         row = {
             "user_email": "mcp-intake@system",   # sentinel — keeps MCP rows out of real users' history
             # top-level columns are varchar(100) — long values go in `results` untruncated
-            "company_name": (payload.get("company_name") or "")[:100],
+            "company_name": _history_text(payload.get("company_name")),
             "industry": "",
-            "use_case": (payload.get("use_case") or "")[:100],
+            "use_case": _history_text(payload.get("use_case")),
             "demo_config": {"source": "mcp_intake"},
             "results": results,
             "status": "mcp_intake",
@@ -840,9 +895,9 @@ def log_mcp_result(payload: Dict[str, Any]) -> bool:
             return False
         row = {
             "user_email": "mcp-intake@system",
-            "company_name": (payload.get("company_name") or "")[:100],
+            "company_name": _history_text(payload.get("company_name")),
             "industry": "",
-            "use_case": (payload.get("use_case") or "")[:100],
+            "use_case": _history_text(payload.get("use_case")),
             "demo_config": {"source": "mcp_result"},
             "results": {
                 "run_id": payload.get("run_id"),
@@ -883,6 +938,13 @@ def log_mcp_result(payload: Dict[str, Any]) -> bool:
                 "findings_persist_error": payload.get("findings_persist_error") or "",
                 "errors": payload.get("errors") or [],
                 "elapsed_seconds": payload.get("elapsed_seconds"),
+                # The pre-build login check (mcp_server._login_precheck, ISS-22):
+                # outcome, HTTP status, reason. None for runs from before it existed.
+                "login_precheck": payload.get("login_precheck"),
+                # The CREATE TABLE text the build loaded, so a run that died at
+                # the ThoughtSpot step can be finished later from its schema
+                # (mcp_server.deploy_existing_schema) without regenerating.
+                "ddl": payload.get("ddl") or "",
                 "source": "mcp",
             },
             "status": "mcp_result",
@@ -996,9 +1058,9 @@ def log_mcp_portal_call(payload: Dict[str, Any]) -> bool:
         args = payload.get("args") or {}
         row = {
             "user_email": "mcp-intake@system",
-            "company_name": (str(args.get("company_name") or ""))[:100],
+            "company_name": _history_text(args.get("company_name")),
             "industry": "",
-            "use_case": (str(args.get("use_case") or ""))[:100],
+            "use_case": _history_text(args.get("use_case")),
             "demo_config": {"source": "mcp_portal"},
             "results": {
                 "run_id": args.get("run_id") or "",

tests/test_build_abort_policy.py

@@ -842,6 +842,10 @@ WARNING_RULES = frozenset({
     "measure_params_missing", "measure_formula_missing", "insights_too_few",
     "insight_window_missing", "insight_too_subtle", "insight_question_missing",
     "dashboard_questions_too_few",
+    # findings triage 2026-10-15, Wave 2: a score states its scale; a window
+    # lies inside the history and leaves a 'before'
+    "measure_score_range_missing", "insight_window_invalid", "insight_window_outside_span",
+    "insight_window_too_early", "insight_window_end_invalid",
 })
 
 
@@ -870,6 +874,7 @@ def every_rule_findings():
                 {"name": "NOFORMULA", "fmt": "float", "kind": "derived", "formula": ""},
                 {"name": "KINDBAD", "fmt": "float", "kind": "weird", "params": {"mean": 1}},
                 {"name": "FMTBAD", "fmt": "zzz", "params": {"mean": 1}},
+                {"name": "TRUST_SCORE", "fmt": "float", "params": {"mean": 70}},     # no declared scale
             ]},
             {"name": "RETURNS", "grain": "one row per return", "measures": [
                 {"name": "REVENUE", "fmt": "currency", "params": {"mean": 5}}]},      # duplicate name
@@ -887,6 +892,15 @@ def every_rule_findings():
              "dimension_value": "x", "measure": "NOPE", "magnitude": 1.3, "spotter_question": "q"},
             {"id": "i3", "headline": "h", "insight_type": "trend_break", "dimension": "SHIFT",
              "dimension_value": "Day", "measure": "REVENUE", "magnitude": 1.3, "spotter_question": "q"},
+            {"id": "i6", "headline": "h", "insight_type": "trend_break", "dimension": "SHIFT",
+             "dimension_value": "Day", "measure": "REVENUE", "magnitude": 1.3, "spotter_question": "q",
+             "window_start": "relative_minus_8_months"},                                  # unreadable
+            {"id": "i7", "headline": "h", "insight_type": "trend_break", "dimension": "SHIFT",
+             "dimension_value": "Day", "measure": "REVENUE", "magnitude": 1.3, "spotter_question": "q",
+             "window_start": "2031-01-01"},                                               # after the data
+            {"id": "i8", "headline": "h", "insight_type": "trend_break", "dimension": "SHIFT",
+             "dimension_value": "Day", "measure": "REVENUE", "magnitude": 1.3, "spotter_question": "q",
+             "window_start": "2000-01-01", "window_end": "1999-01-01"},                   # too early; end before start
             {"id": "i4", "headline": "h", "insight_type": "segment_outlier", "dimension": "REGION",
              "dimension_value": "West", "measure": "REVENUE", "magnitude": 1.3, "spotter_question": "q"},
             {"id": "i5", "headline": "h", "insight_type": "segment_outlier", "dimension": "SHIFT",
@@ -944,3 +958,426 @@ def test_the_test_covers_every_rule_the_source_can_emit():
     assert in_source <= covered, f"rules in blueprint.py with no policy line: {in_source - covered}"
     assert covered - {"user_directive_violated"} <= in_source, \
         f"policy lines with no rule in blueprint.py: {covered - in_source - {'user_directive_violated'}}"
+
+
+# --------------------------------------------------------------------------- #
+# T · findings triage 2026-10-15, Wave 1 — one record per measure, the real
+#     failures first, the registry noise rolled up last, messages that read
+#     the right way round, and an auth failure that says what to do.
+# --------------------------------------------------------------------------- #
+def _unclassified(measure: str, stage: str, table: str = "GRID_ENERGY", observed: str = "") -> Finding:
+    return Finding(code="bound_not_inferable", severity="info", stage=stage,
+                   message=f"no bound class matched {measure}", suggestion="add its vocabulary",
+                   measure=measure, table=table, observed=observed)
+
+
+def test_findings_dedupe_keeps_the_post_load_record_for_a_measure_flagged_twice():
+    """CSAT_SCORE_SUM was posted twice per build: blueprint (declared mean) and
+    post-load (observed mean), with different text."""
+    from demoprep_app.quality.findings import dedupe
+
+    blueprint = _unclassified("CSAT_SCORE_SUM", "blueprint")
+    post_load = _unclassified("CSAT_SCORE_SUM", "post_load", observed="min=1 max=5 avg=3.2")
+    weak1 = Finding(code="insight_weak", severity="warning", stage="validation",
+                    message="planted insight i1 ...", suggestion="raise it")
+    weak2 = Finding(code="insight_weak", severity="warning", stage="validation",
+                    message="planted insight i2 ...", suggestion="raise it")
+
+    out = dedupe([blueprint, weak1, post_load, weak2, weak1])
+    assert out == [post_load, weak1, weak2]      # post-load wins, in the first slot; insights stay two
+    assert build_demo_module._dedupe([blueprint, post_load]) == [post_load]
+    assert dedupe([post_load, blueprint]) == [post_load]   # whichever order they arrive
+
+
+def test_slack_lists_what_matters_first_and_rolls_up_the_unclassified_last():
+    findings = [
+        _unclassified("SESSIONS", "post_load"),
+        _unclassified("COGS", "blueprint"), _unclassified("COGS", "post_load"),
+        Finding(code="insight_weak", severity="warning", stage="validation",
+                message="planted insight i1 realized 0.83x baseline", suggestion="raise magnitude"),
+        Finding(code=RULE_DIMENSION_CARDINALITY, severity="warning", stage="blueprint",
+                message="Dimension SHIFT: has only 2 values.", suggestion="fine if it really has 2",
+                table="SHIFT", extra={"rule": RULE_DIMENSION_CARDINALITY}),
+        Finding(code="measure_bound_pileup", severity="warning", stage="generation",
+                message="218 rows on the cap", suggestion="lower the band", measure="FILL_RATE", table="LOADS"),
+        Finding(code="repair_failed", severity="warning", stage="post_load",
+                message="1 repair ran and the re-profile still violates", suggestion="fix the inputs",
+                measure="PIPELINE_COVERAGE_RATIO", table="DEALS", repair="repair_failed"),
+    ]
+    text = format_build_findings(prospect="Turtle", se_email="se@x.com", findings=findings)
+
+    assert text.startswith("*DemoPrep build shipped with 4 warning(s)*"), text   # unclassified are not warnings
+    positions = [text.index(code) for code in
+                 ("repair_failed", "measure_bound_pileup", "insight_weak", "dimension_cardinality")]
+    assert positions == sorted(positions), "send-blocking, data defect, weak insight, blemish — in that order"
+    lines = text.splitlines()
+    assert lines[-1].startswith("ℹ️ 2 measure(s) unclassified"), lines[-1]   # COGS once, SESSIONS once
+    assert "GRID_ENERGY.COGS, GRID_ENERGY.SESSIONS" in lines[-1]
+    assert "bound_not_inferable" not in "\n".join(lines[:-1])
+
+
+def test_unclassified_measures_alone_are_not_a_slack_post():
+    assert format_build_findings(prospect="X", se_email="y",
+                                 findings=[_unclassified("SESSIONS", "post_load")]) == ""
+
+
+def test_the_rollup_comes_after_the_and_n_more_line():
+    many = [Finding(code="measure_clamped", severity="warning", stage="generation",
+                    message=f"clamped {i}", suggestion="widen the band", measure=f"M{i}", table="T")
+            for i in range(15)]
+    text = format_build_findings(prospect="X", se_email="y",
+                                 findings=many + [_unclassified("SESSIONS", "post_load")])
+    lines = text.splitlines()
+    assert lines[-2].startswith("… and 3 more")
+    assert lines[-1].startswith("ℹ️ 1 measure(s) unclassified")
+
+
+def test_the_weak_insight_message_states_promised_needed_realized_and_direction():
+    """It used to print the pass bar as "the N it promised": for a laggard,
+    "realized 0.83 of the 0.69 it promised" meant needed <= 0.69 (promised
+    0.38), got 0.83 — and read as a false positive."""
+    from demoprep_app.dataset.validator import InsightCheck, ValidationReport, _record_findings
+
+    report = ValidationReport()
+    report.insight_checks.append(InsightCheck(
+        "i3", False, 0.83, 0.69, "Prepaid vs rest of SEGMENT",
+        promised_ratio=0.38, direction="below baseline",
+    ))
+    _record_findings(report)
+    weak = [f for f in report.findings if f.code == "insight_weak"]
+    assert len(weak) == 1
+    msg = weak[0].message
+    assert "realized 0.83x" in msg and "needed <= 0.69x" in msg
+    assert "promised 0.38x" in msg and "below baseline" in msg
+    assert "it promised" not in msg
+    assert weak[0].expected.startswith("<= 0.69x") and weak[0].extra["promised_ratio"] == 0.38
+
+
+def test_the_tuning_boost_keeps_the_authored_promise_for_the_report():
+    import types
+
+    from demoprep_app.dataset.engine import BlueprintEngine
+    from demoprep_app.dataset.validator import validate_bundle
+
+    bp = _bp()
+    insight = bp.insights[0]
+    assert insight.authored_magnitude is None and insight.magnitude == 1.3
+    report = types.SimpleNamespace(failed_insights=lambda: [types.SimpleNamespace(insight_id=insight.id)])
+    build_demo_module._boost_weak_insights(bp, report)
+    build_demo_module._boost_weak_insights(bp, report)
+    assert insight.authored_magnitude == 1.3                       # what the blueprint said
+    assert insight.magnitude == pytest.approx(1.768, abs=1e-3)     # what tuning made of it
+
+    checks = validate_bundle(bp, BlueprintEngine().generate(bp, 600)).insight_checks
+    boosted = next(c for c in checks if c.insight_id == insight.id)
+    assert boosted.promised_ratio == 1.3 and boosted.direction == "above baseline"
+    assert all(c.promised_ratio == 1.3 for c in checks)
+
+
+def test_a_missing_account_is_a_plain_instruction_naming_user_and_cluster():
+    from thoughtspot_errors import trusted_auth_failure_message
+
+    body = '{"error": {"message": "Specified user does not exist"}}'
+    msg = trusted_auth_failure_message(
+        "patrick.case@thoughtspot.com", "https://se-thoughtspot-cloud.thoughtspot.cloud", 400, body)
+    assert msg.startswith(
+        "patrick.case@thoughtspot.com has no ThoughtSpot account on se-thoughtspot-cloud.thoughtspot.cloud.")
+    assert "Ask a ThoughtSpot admin" in msg
+    assert msg.endswith("(ThoughtSpot authentication failed, HTTP 400: Specified user does not exist)")
+
+    other = trusted_auth_failure_message(
+        "x@y.com", "https://h.thoughtspot.cloud", 401, '{"error": {"message": "Bad secret key"}}')
+    assert other == ("ThoughtSpot authentication failed for x@y.com on https://h.thoughtspot.cloud "
+                     "(HTTP 401): Bad secret key")
+
+    net = trusted_auth_failure_message("x@y.com", "https://h.thoughtspot.cloud", None, "ConnectionError: boom")
+    assert net == "ThoughtSpot authentication failed for x@y.com on https://h.thoughtspot.cloud: ConnectionError: boom"
+
+
+# --------------------------------------------------------------------------- #
+# U · findings triage 2026-10-15, Wave 2 — windows inside the history, segments
+#     big enough to measure, scores that state their scale, the author prompt.
+# --------------------------------------------------------------------------- #
+from datetime import date as _date, timedelta as _timedelta  # noqa: E402
+
+
+def _trend_insight(**overrides) -> dict:
+    base = {"id": "t1", "headline": "h", "insight_type": "trend_break", "dimension": "SHIFT",
+            "dimension_value": "Day", "measure": "UNITS_PICKED", "magnitude": 1.4,
+            "spotter_question": "q", "expected_finding": "x"}
+    base.update(overrides)
+    return base
+
+
+def test_the_date_span_is_the_engines_and_the_default_window_opens_its_last_third():
+    from demoprep_app.dataset.engine import _date_spine
+    from demoprep_app.scenario.blueprint import DateSpec, WINDOW_MIN_HISTORY_BEFORE
+
+    spec = DateSpec(grain="day", months_of_history=12)
+    start, end = spec.span(today=_date(2026, 10, 20))
+    assert end == _date(2026, 9, 30) and start == end - _timedelta(days=int(12 * 30.44))
+    earliest = spec.min_window_start(today=_date(2026, 10, 20))
+    assert (earliest - start).days == int((end - start).days * WINDOW_MIN_HISTORY_BEFORE)
+    default = spec.default_window_start(today=_date(2026, 10, 20))
+    assert default.day == 1 and earliest <= default <= end
+    assert default != _date(2025, 6, 1), "the hard-coded date is gone"
+
+    bp = _bp()
+    dates = _date_spine(bp)
+    assert (dates[0], dates[-1]) == bp.date.span()
+
+
+def test_a_window_before_the_history_warns_and_autorepair_moves_it_into_the_last_third():
+    """Verizon / Fortegra / Turtle: 1946 target / 0 baseline — the window
+    started at or before the first generated date, so there was no 'before'."""
+    bp = _bp(insights=[_trend_insight(window_start="2025-06-01")])
+    start, end = bp.date.span()
+    assert _date(2025, 6, 1) < bp.date.min_window_start(), "test premise: too early with 12 months of history"
+
+    rules = {f.extra["rule"] for f in bp.findings()}
+    assert "insight_window_too_early" in rules
+    assert not any(f.severity == "critical" and "window" in f.message for f in bp.findings())
+
+    fixes = bp.autorepair()
+    moved = bp.insights[0]
+    assert moved.window_start == bp.date.default_window_start().isoformat()
+    assert any("too early" in fix and moved.window_start in fix for fix in fixes)
+    assert "insight_window_too_early" not in {f.extra["rule"] for f in bp.findings()}
+
+
+def test_a_missing_or_unreadable_or_late_window_lands_in_the_last_third_too():
+    bp = _bp(insights=[
+        _trend_insight(id="missing"),
+        _trend_insight(id="unreadable", window_start="relative_minus_8_months"),
+        _trend_insight(id="late", window_start="2031-01-01"),
+        _trend_insight(id="backwards", window_start="2000-01-01", window_end="1999-01-01"),
+    ])
+    rules = {f.extra["rule"] for f in bp.findings()}
+    assert {"insight_window_missing", "insight_window_invalid", "insight_window_outside_span",
+            "insight_window_too_early", "insight_window_end_invalid"} <= rules
+    bp.autorepair()
+    default = bp.date.default_window_start().isoformat()
+    assert all(i.window_start == default for i in bp.insights)
+    assert all(i.window_end == "" for i in bp.insights)
+
+
+def test_a_segment_insight_with_a_window_outside_the_history_falls_back_to_the_whole_history():
+    """AMD's Instinct MI300X, BCD's LHR -> JFK: 0 target / 0 baseline — a
+    segment window outside the span drops every row on both sides."""
+    bp = _bp(insights=[_trend_insight(id="seg", insight_type="segment_outlier",
+                                      window_start="2031-01-01", window_end="2031-06-30")])
+    assert "insight_window_outside_span" in {f.extra["rule"] for f in bp.findings()}
+    bp.autorepair()
+    assert (bp.insights[0].window_start, bp.insights[0].window_end) == ("", "")
+
+
+def test_insight_support_sizes_a_thin_segment_before_generation():
+    """Humpty Dump's driver logs: one driver in eight on a small fact never
+    reached 20 rows on its side, and the tuning loop found out after a full
+    generation, three times."""
+    from demoprep_app.dataset.engine import BlueprintEngine
+    from demoprep_app.dataset.validator import MIN_ROWS_PER_SIDE, validate_bundle
+
+    drivers = [f"Driver {n}" for n in range(1, 9)]
+    bp = _bp(dimensions=[{"name": "DRIVER", "values": [
+                              {"name": d, "mix_weight": 0.25 if d == "Driver 8" else 1.0} for d in drivers]},
+                         _dim("SITE", ["Wilmington", "Reno", "Atlanta"])],
+             insights=[_trend_insight(id="thin", insight_type="segment_laggard", dimension="DRIVER",
+                                      dimension_value="Driver 8", magnitude=0.7)])
+    thin = next(v for v in bp.dimensions[0].values if v.name == "Driver 8")
+    rows = BlueprintEngine.rows_per_fact(bp, 500)
+    assert rows * 0.25 / 7.25 < MIN_ROWS_PER_SIDE, "test premise: ~17 rows is too thin"
+
+    fixes = bp.ensure_insight_support(rows)
+    assert len(fixes) == 1 and "Driver 8" in fixes[0] and "mix_weight 0.25 ->" in fixes[0]
+    assert thin.mix_weight > 0.25
+    assert bp.metadata["insight_support"] == fixes
+    # idempotent, and a healthy segment is left alone
+    assert bp.ensure_insight_support(rows) == []
+
+    report = validate_bundle(bp, BlueprintEngine().generate(bp, 500))
+    check = next(c for c in report.insight_checks if c.insight_id == "thin")
+    assert check.measurable, check.detail
+
+
+def test_an_unmeasurable_insight_is_its_own_code_and_is_not_boosted():
+    import types
+
+    from demoprep_app.dataset.validator import InsightCheck, ValidationReport, _record_findings
+
+    report = ValidationReport()
+    report.insight_checks.append(InsightCheck(
+        "i9", False, 0.0, 1.15, "too few rows to demo (4 target / 51 baseline; each side needs 20)",
+        promised_ratio=1.3, direction="above baseline", measurable=False,
+    ))
+    _record_findings(report)
+    assert [f.code for f in report.findings] == ["insight_unmeasurable"]
+    finding = report.findings[0]
+    assert "could not be measured" in finding.message and "4 target / 51 baseline" in finding.message
+    assert "mix_weight" in finding.suggestion and finding.blocks_send is False
+    assert "UNMEASURABLE" in report.summary()
+
+    bp = _bp()
+    insight = bp.insights[0]
+    unmeasurable = types.SimpleNamespace(insight_id=insight.id, measurable=False)
+    build_demo_module._boost_weak_insights(bp, types.SimpleNamespace(failed_insights=lambda: [unmeasurable]))
+    assert insight.magnitude == 1.3 and insight.authored_magnitude is None   # magnitude untouched
+    target = next(v for v in bp.dimensions[0].values if v.name == insight.dimension_value)
+    assert target.mix_weight == 1.5                                             # the segment was widened
+
+
+def test_a_score_without_a_declared_scale_is_a_warning_to_the_author():
+    bp = _bp(facts=[{
+        "name": "ASSET_HEALTH", "grain": "one row per asset per day", "dimension_names": ["SHIFT", "SITE"],
+        "measures": [
+            {"name": "HEALTH_SCORE", "fmt": "float", "params": {"mean": 85, "sigma": 0.3}},
+            {"name": "NPS_SCORE", "fmt": "float", "params": {"mean": 40}},            # scale by definition
+            {"name": "RISK_INDEX", "fmt": "float", "params": {"low": 0, "high": 100}}, # declared
+            {"name": "UNITS_PICKED", "fmt": "int", "params": {"mean": 4000, "sigma": 0.3}},
+        ],
+    }])
+    scored = [f for f in bp.findings() if f.extra["rule"] == "measure_score_range_missing"]
+    assert [f.measure for f in scored] == ["HEALTH_SCORE"]
+    assert scored[0].severity == "warning" and "params.low and params.high" in scored[0].message
+    assert "mean of 85" in scored[0].message
+
+
+def test_the_author_prompt_asks_for_score_scales_and_windows_inside_the_history():
+    from demoprep_app.scenario.blueprint_author import PROMPT_TEMPLATE
+
+    assert "MUST declare its scale as params.low and params.high" in PROMPT_TEMPLATE
+    assert "legitimately exceeds 1" in PROMPT_TEMPLATE
+    assert "leave at least the first third of it" in PROMPT_TEMPLATE
+    assert "at least 20 on each side" in PROMPT_TEMPLATE
+
+
+# --------------------------------------------------------------------------- #
+# V · findings triage 2026-10-15, Wave 3 — a promise capped at what the band
+#     can deliver, rows pushed in the band instead; hygiene.
+# --------------------------------------------------------------------------- #
+def test_a_bounded_measures_deliverable_lift_comes_from_its_band():
+    from demoprep_app.pipeline.build_demo import BAND_DELIVERY_MARGIN, _deliverable_band_ratio
+    from demoprep_app.dataset.engine import POSITION_SWING
+
+    bp = _bp(facts=[{
+        "name": "OPS", "grain": "one row per site per day", "dimension_names": ["SHIFT", "SITE"],
+        "measures": [
+            {"name": "UNITS_PICKED", "fmt": "int", "params": {"mean": 4000, "sigma": 0.3}},
+            {"name": "UPTIME_RATE", "fmt": "pct", "params": {"low": 0.6, "high": 0.95}},
+            {"name": "UNITS_ORDERED", "fmt": "int", "params": {"mean": 5000, "sigma": 0.3}},
+            {"name": "UNITS_FILLED", "fmt": "int", "share_of": "UNITS_ORDERED", "params": {"low": 0.5, "high": 0.9}},
+            {"name": "FILL_RATE", "kind": "derived", "fmt": "pct", "formula": "UNITS_FILLED / UNITS_ORDERED"},
+        ],
+    }], insights=[_trend_insight(id="lift", insight_type="segment_outlier", measure="UPTIME_RATE", magnitude=1.6)])
+
+    def lift(measure):
+        return _deliverable_band_ratio(bp, _insight_on(measure))
+
+    assert lift("UNITS_PICKED") is None                                  # a level: unbounded
+    low, high = next(m for m in bp.facts[0].measures if m.name == "UPTIME_RATE").band
+    width, centre = high - low, low + 0.5 * (high - low)
+    expected_cap = round(1 + ((low + (0.5 + POSITION_SWING) * width) / centre - 1) * BAND_DELIVERY_MARGIN, 4)
+    floor, cap = lift("UPTIME_RATE")
+    assert cap == expected_cap and 0.5 < floor < 1 < cap < 1.6
+    assert lift("UNITS_FILLED") == lift("FILL_RATE")                     # the ratio IS the fraction
+
+
+def _insight_on(measure):
+    import types
+    return types.SimpleNamespace(measure=measure)
+
+
+def test_an_unreachable_promise_is_capped_and_the_band_position_pushed_instead():
+    import types
+
+    from demoprep_app.pipeline.build_demo import BOOST_FACTOR, _deliverable_band_ratio
+
+    bp = _bp(facts=[{
+        "name": "OPS", "grain": "g", "dimension_names": ["SHIFT", "SITE"],
+        "measures": [
+            {"name": "UNITS_PICKED", "fmt": "int", "params": {"mean": 4000, "sigma": 0.3}},
+            # a 0.30..0.95 band delivers ~1.37x at most: 1.6x is out of reach, 1.2x is not
+            {"name": "UPTIME_RATE", "fmt": "pct", "params": {"low": 0.3, "high": 0.95}},
+        ],
+    }], insights=[
+        _trend_insight(id="big", insight_type="segment_outlier", measure="UPTIME_RATE", magnitude=1.6),
+        _trend_insight(id="fits", insight_type="segment_outlier", measure="UPTIME_RATE", magnitude=1.2),
+        _trend_insight(id="level", insight_type="segment_outlier", measure="UNITS_PICKED", magnitude=1.3),
+    ])
+    _, cap = _deliverable_band_ratio(bp, bp.insights[0])
+    assert cap < 1.6 and cap > 1.2, "test premise: 1.6x is out of reach, 1.2x is not"
+    failed = [types.SimpleNamespace(insight_id=i.id, measurable=True) for i in bp.insights]
+    notes = build_demo_module._boost_weak_insights(bp, types.SimpleNamespace(failed_insights=lambda: failed))
+
+    big, fits, level = bp.insights
+    assert big.magnitude == round(cap, 3) and big.authored_magnitude == 1.6     # capped, promise kept
+    assert big.drive_boost == BOOST_FACTOR
+    assert fits.magnitude == 1.2 and fits.drive_boost == BOOST_FACTOR             # reachable: push, no cap
+    assert level.magnitude == pytest.approx(1.48) and level.drive_boost == 1.0    # unbounded: magnitude
+    assert len(notes) == 1 and "big promised 1.6x" in notes[0] and f"capped at {cap:.2f}x" in notes[0]
+    # a second round pushes further but never caps again
+    assert build_demo_module._boost_weak_insights(bp, types.SimpleNamespace(failed_insights=lambda: failed)) == []
+    assert big.drive_boost == pytest.approx(BOOST_FACTOR ** 2)
+
+
+def test_more_drive_moves_a_bounded_measure_further_without_touching_the_promise():
+    from demoprep_app.dataset.engine import BlueprintEngine, _insight_drive
+
+    def ratio(drive_boost):
+        bp = _bp(facts=[{
+            "name": "OPS", "grain": "g", "dimension_names": ["SHIFT", "SITE"],
+            "measures": [{"name": "UPTIME_RATE", "fmt": "pct", "params": {"low": 0.6, "high": 0.95}}],
+        }], insights=[_trend_insight(id="u", insight_type="segment_outlier", measure="UPTIME_RATE",
+                                      magnitude=1.2)])
+        bp.insights[0].drive_boost = drive_boost
+        rows = BlueprintEngine().generate(bp, 3000).table_map()["OPS"].rows
+        day = [r["UPTIME_RATE"] for r in rows if r["SHIFT_KEY"] == 1]
+        rest = [r["UPTIME_RATE"] for r in rows if r["SHIFT_KEY"] != 1]
+        return (sum(day) / len(day)) / (sum(rest) / len(rest))
+
+    assert ratio(2.5) > ratio(1.0) > 1.0
+    laggard = _bp().insights[0]
+    laggard.magnitude, laggard.drive_boost = 0.7, 2.0
+    assert _insight_drive(laggard) == pytest.approx(0.35)          # pushed DOWN for a laggard
+
+
+def test_tuning_stops_when_a_round_changed_nothing():
+    from demoprep_app.pipeline.build_demo import _tuning_stalled
+
+    assert not _tuning_stalled({}, {"i1": 1.12})
+    assert not _tuning_stalled({"i1": 1.12}, {"i1": 1.19})
+    assert _tuning_stalled({"i1": 1.12, "i2": 0.9}, {"i1": 1.121, "i2": 0.9})
+    assert not _tuning_stalled({"i1": 1.12}, {"i3": 1.12})          # nothing in common: not a stall
+    src = inspect_source(build_demo_module.build_demo)
+    assert "_tuning_stalled(previous_observed, observed_now)" in src
+    assert 'code="insight_promise_capped"' in src
+
+
+def inspect_source(fn):
+    import inspect
+    return inspect.getsource(fn)
+
+
+def test_history_text_strips_and_clips_and_the_display_name_is_no_longer_cut_at_30():
+    from supabase_client import DEMO_HISTORY_TEXT_WIDTH, _history_text
+    from demo_builder_class import DemoBuilder
+
+    assert _history_text("Humpty Dump Roll Off Services ") == "Humpty Dump Roll Off Services"
+    assert len(_history_text("x" * 300)) == DEMO_HISTORY_TEXT_WIDTH == 100
+    assert _history_text(None) == ""
+
+    import types
+    builder = DemoBuilder.__new__(DemoBuilder)
+    builder.website_data = types.SimpleNamespace(title="OMERS Administration Corporation | Pensions")
+    builder.company_url = "https://omers.com"
+    assert builder.extract_company_name() == "OMERS Administration Corporation"
+
+
+def test_both_pinboard_url_forms_resolve_to_the_same_guid():
+    from mcp_server import _guid_from_url, _liveboard_guid
+
+    guid = "3ac80964-1a2b-4c3d-8e9f-0a1b2c3d4e5f"
+    old = f"https://x.thoughtspot.cloud/#/pinboard/{guid}"
+    new = f"https://x.thoughtspot.cloud/#/insights/pinboard/{guid}"       # ThoughtSpot UI since 2026-10-14
+    assert _guid_from_url(old) == _guid_from_url(new) == guid
+    assert _liveboard_guid(old) == _liveboard_guid(new) == guid

tests/test_chained_portal_settings.py

@@ -112,6 +112,9 @@ def test_tool_hands_the_settings_to_the_build(monkeypatch):
     monkeypatch.setattr(mcp_server, "_run_build", fake_run_build)
     monkeypatch.setattr(mcp_server, "_resolve_ts_target", lambda url: ("https://ts.example", "k"))
     monkeypatch.setattr(mcp_server, "_resolve_owner", lambda e: "se@thoughtspot.com")
+    # No network in unit tests: the ISS-22 login precheck is stubbed as passing.
+    monkeypatch.setattr(mcp_server, "_login_precheck",
+                        lambda url, key, owner: {"outcome": "ok", "blocking": False})
 
     out = mcp_server.build_demo_from_brief(
         brief="A brief.", company_name="Acme", owner_email="se@thoughtspot.com",

tests/test_deploy_existing_schema.py

@@ -0,0 +1,157 @@
+"""deploy_existing_schema: finish a build whose data is already in Snowflake.
+
+Findings triage 2026-10-15, E3. Four builds in three days did the whole
+generation and load, then failed at the ThoughtSpot step because the owner had
+no account on the cluster; the SEs rebuilt from scratch (Lead Forensics three
+times). This tool continues from the loaded schema: the run's records give the
+schema, DDL, company, brief, cluster and owner; the caller overrides what
+changed. Everything here is mocked — no Snowflake, no ThoughtSpot.
+
+Run with: pytest tests/test_deploy_existing_schema.py -q --noconftest
+"""
+
+from __future__ import annotations
+
+import inspect
+import threading
+
+import pytest
+
+import mcp_server
+import supabase_client
+
+DDL = 'CREATE TABLE "LEADS" ("LEADS_KEY" NUMBER, "LEADS_CREATED" NUMBER(38,0));'
+RUN = {
+    "run_id": "lead0001", "status": "partial", "schema": "LEA_10151433_N6I_sch",
+    "company_name": "Lead Forensics", "use_case": "Marketing Attribution",
+    "company_url": "https://leadforensics.com", "owner_email": "patrick.case@thoughtspot.com",
+    "ts_url": "https://se-thoughtspot-cloud.thoughtspot.cloud", "ddl": DDL,
+    "model_url": "", "liveboard_url": "", "warnings": [], "findings": [], "errors": ["auth"],
+    "findings_persisted": None, "findings_persist_error": "", "elapsed_seconds": 180.0,
+    "portal_url": "", "download_url": "", "finished_at": "14:11:00",
+}
+
+
+@pytest.fixture(autouse=True)
+def _quiet_supabase(monkeypatch):
+    monkeypatch.setattr(supabase_client, "fetch_mcp_run", lambda run_id: None)
+    monkeypatch.setattr(mcp_server, "log_mcp_payload", lambda payload: False)
+    monkeypatch.setattr(mcp_server, "log_mcp_result", lambda payload: False)
+    mcp_server._recent_builds.clear()
+    yield
+    mcp_server._recent_builds.clear()
+
+
+def _precheck_ok(*a, **k):
+    return {"outcome": "ok", "blocking": False, "http_status": 200, "reason": "", "host": "h", "elapsed_ms": 3}
+
+
+# --- the run runner continues from the loaded schema -------------------------
+
+def test_the_runner_skips_generation_and_the_load_for_an_existing_schema():
+    src = inspect.getsource(mcp_server._run_build)
+    assert "existing_schema: str = \"\", existing_ddl: str = \"\"" in src
+    assert "controller.demo_builder.schema_generation_results = existing_ddl" in src
+    assert "controller._deployed_schema_name = existing_schema" in src
+    assert "controller.ddl_code = existing_ddl" in src
+    # the generation + load steps only run on the normal path
+    assert src.index("if existing_schema:") < src.index("controller.run_ddl_creation()")
+    assert src.index("if existing_schema:") < src.index("controller.run_deployment_streaming()")
+
+
+def test_the_ddl_is_kept_on_the_run_records_but_left_out_of_status():
+    src = inspect.getsource(mcp_server._run_build)
+    # _last_build (always had it) + _recent_builds + log_mcp_result
+    assert '"ddl": out["ddl"],' in src and src.count('"ddl": out["ddl"]') == 3
+    assert 'if k != "ddl"' in inspect.getsource(mcp_server.status)
+    sb = inspect.getsource(supabase_client.log_mcp_result)
+    assert '"ddl": payload.get("ddl") or ""' in sb
+
+
+# --- resolving a past run ------------------------------------------------------
+
+def test_a_run_is_recovered_from_memory_first_then_from_demo_history(monkeypatch):
+    mcp_server._recent_builds["lead0001"] = dict(RUN)
+    monkeypatch.setattr(supabase_client, "fetch_mcp_run",
+                        lambda run_id: {"intake": {"brief": "B2B lead attribution"}, "result": {}})
+    record, source = mcp_server._run_record("lead0001")
+    assert source == "memory" and record["schema"] == RUN["schema"] and record["ddl"] == DDL
+    assert record["brief"] == "B2B lead attribution"       # memory never holds the brief
+
+    mcp_server._recent_builds.clear()
+    rice = {
+        "intake": {"company_name": "Rice University", "use_case": "Admissions", "brief": "yield",
+                   "resolved_owner_email": "kris.lefebvre@thoughtspot.com",
+                   "resolved_ts_url": "https://se-thoughtspot-cloud.thoughtspot.cloud",
+                   "company_url": "https://rice.edu"},
+        "result": {"schema": "RIC_10132058_S9S_sch", "ddl": DDL, "company_name": "Rice University"},
+    }
+    monkeypatch.setattr(supabase_client, "fetch_mcp_run",
+                        lambda run_id: rice if run_id == "rice0001" else {"intake": {}, "result": {}})
+    record, source = mcp_server._run_record("rice0001")
+    assert source == "demo_history"
+    assert record["schema"] == "RIC_10132058_S9S_sch" and record["ddl"] == DDL
+    assert record["owner_email"] == "kris.lefebvre@thoughtspot.com" and record["brief"] == "yield"
+    assert mcp_server._run_record("nope") == ({}, "")
+
+
+# --- the tool ------------------------------------------------------------------
+
+def test_an_unknown_run_or_missing_pieces_fail_at_once():
+    out = mcp_server.deploy_existing_schema(run_id="nope")
+    assert out["status"] == "failed" and "not known" in out["errors"][0]
+    out = mcp_server.deploy_existing_schema(schema="X_sch", company_name="X")
+    assert out["status"] == "failed" and "without ddl" in out["errors"][0]
+    out = mcp_server.deploy_existing_schema(schema="X_sch", company_name="X", ddl="not ddl")
+    assert out["status"] == "failed" and "CREATE TABLE" in out["errors"][0]
+
+
+def test_a_user_who_still_has_no_account_is_refused_before_a_slot_is_taken(monkeypatch):
+    mcp_server._recent_builds["lead0001"] = dict(RUN)
+    monkeypatch.setattr(mcp_server, "_resolve_ts_target", lambda url: (url, "key"))
+    monkeypatch.setattr(mcp_server, "_login_precheck", lambda url, key, owner: {
+        "outcome": "no_account", "blocking": True, "http_status": 400, "reason": "Specified user does not exist",
+        "host": "se-thoughtspot-cloud.thoughtspot.cloud", "elapsed_ms": 40,
+        "message": f"{owner} has no ThoughtSpot account on se-thoughtspot-cloud.thoughtspot.cloud.",
+    })
+    called = []
+    monkeypatch.setattr(mcp_server, "_run_build", lambda *a, **k: called.append(k))
+    active_before = set(mcp_server._active_builds)      # other tests may leave builds registered
+    out = mcp_server.deploy_existing_schema(run_id="lead0001")
+    assert out["status"] == "failed"
+    assert out["errors"][0].startswith("patrick.case@thoughtspot.com has no ThoughtSpot account")
+    assert called == [] and set(mcp_server._active_builds) == active_before
+
+
+def test_a_redeploy_runs_the_runner_against_the_existing_schema_with_overrides(monkeypatch):
+    mcp_server._recent_builds["lead0001"] = dict(RUN)
+    monkeypatch.setattr(mcp_server, "_resolve_ts_target", lambda url: (url, "key"))
+    monkeypatch.setattr(mcp_server, "_login_precheck", _precheck_ok)
+    done = threading.Event()
+    seen: dict = {}
+
+    def fake_run_build(*args, **kwargs):
+        seen["args"], seen["kwargs"] = args, kwargs
+        with mcp_server._state_lock:
+            mcp_server._active_builds.pop(args[0], None)
+        done.set()
+
+    monkeypatch.setattr(mcp_server, "_run_build", fake_run_build)
+    out = mcp_server.deploy_existing_schema(run_id="lead0001", owner_email="max.lough@thoughtspot.com")
+    assert out["status"] == "started" and out["redeploy_of_run_id"] == "lead0001"
+    assert out["run_id"] != "lead0001" and out["schema"] == RUN["schema"]
+    assert done.wait(5), "the runner thread never started"
+
+    run_id, brief, company, use_case, company_url, ts_url, key, owner, with_portal, payload = seen["args"]
+    assert run_id == out["run_id"] and company == "Lead Forensics" and use_case == "Marketing Attribution"
+    assert owner == "max.lough@thoughtspot.com"                 # the override
+    assert ts_url == RUN["ts_url"] and company_url == RUN["company_url"]
+    assert seen["kwargs"]["existing_schema"] == RUN["schema"] and seen["kwargs"]["existing_ddl"] == DDL
+    assert payload["redeploy_of_run_id"] == "lead0001" and payload["resolved_from"] == "memory"
+    assert payload["login_precheck"]["outcome"] == "ok"
+    # the slot is released once the runner returns
+    assert mcp_server._build_sem.acquire(blocking=False) and (mcp_server._build_sem.release() or True)
+
+
+def test_the_tool_is_registered():
+    assert "deploy_existing_schema" in mcp_server._registered_tool_names()

tests/test_flat_measure_gate.py

@@ -117,3 +117,33 @@ def test_gate_is_a_warning_not_a_blocker():
 def test_gate_is_quiet_on_healthy_data():
     report = validate_dataset_quality(_build())
     assert not [i for i in report.issues if "identical across every dimension" in i.message]
+
+
+# --- the bundle carries each measure's declared semantics (triage 2026-10-15, A1)
+
+def test_the_bundle_carries_fmt_and_sign_so_the_gate_classifies_every_measure():
+    """The post-load gate used to infer bounds from the NAME alone and posted
+    every int count and currency amount as "no bound class matched". The
+    engine now stamps fmt / signed / kind on each measure column, and
+    measure_formats() hands them to the gate."""
+    from demoprep_app.integrations.snowflake.quality_gate import measure_formats, semantic_bound
+
+    bundle = _build()
+    fact = next(t for t in bundle.tables if t.is_fact)
+    formats = measure_formats(bundle)
+
+    assert formats[f"{fact.name}.CLAIMS_SUBMITTED"] == {"fmt": "int", "signed": False, "kind": "base"}
+    assert formats[f"{fact.name}.CHARGE_AMOUNT"]["fmt"] == "currency"
+    assert formats[f"{fact.name}.COLLECTION_RATE"]["kind"] == "derived"
+    assert not any(key.endswith("_KEY") for key in formats), "keys and dates carry no format"
+
+    for key, declared in formats.items():
+        table, _, col = key.partition(".")
+        if table != fact.name:
+            continue
+        column = next(c for c in fact.columns if c.name == col)
+        stats = {"avg": statistics.mean(float(r[col]) for r in fact.rows)}
+        bound = semantic_bound(
+            col, stats, column.formula or "", fmt=declared["fmt"], signed=declared["signed"],
+        )
+        assert bound is not None and not bound.gap, f"{col}: unclassified with its format known"

tests/test_gate_severity.py

@@ -84,7 +84,10 @@ def test_uninferable_score_range_warns_with_the_declaration_to_add():
     assert findings, "an uninferable score range must be reported, not silently defaulted"
     finding = next(f for f in findings if f.measure == "READINESS_SCORE")
 
-    assert finding.severity == "warning"            # NOT critical: the build goes on
+    # `info` since 2026-10-20 (boone): a registry gap, kept for the record and
+    # rolled into one Slack line per build — never critical, never a warning
+    # per measure. The build goes on either way.
+    assert finding.severity == "info"
     assert finding.code == "bound_not_inferable"
     assert not blocking(findings)                    # nothing here aborts
     # It names the measure and the concrete declaration to add.

tests/test_iss22_login_precheck.py

@@ -0,0 +1,409 @@
+"""ISS-22: a build whose owner cannot log in must fail in seconds, saying why.
+
+Patrick Case, Kris Lefebvre and James Ward have no ThoughtSpot account on the
+cluster their builds targeted; on 2026-10-06 sebe was in standby. Each build
+still spent 2-4 minutes generating data and loading Snowflake (an orphan
+schema) and then failed at login as "ThoughtSpot authentication failed" — for
+standby, behind a JSON parse error.
+
+build_demo_from_brief now makes ONE trusted-auth token request before it takes
+a slot or generates anything. These tests drive every branch with mocked HTTP:
+nothing here touches the network.
+"""
+import collections
+import json
+import os
+import threading
+
+import pytest
+import requests
+
+os.environ.setdefault("MCP_TRANSPORT", "stdio")
+
+import thoughtspot_deployer
+from thoughtspot_errors import (
+    LOGIN_BLOCKING,
+    classify_trusted_login,
+    no_account_message,
+    non_json_auth_error,
+    standby_message,
+    ts_error_reason,
+)
+
+SECLOUD = "https://se-thoughtspot-cloud.thoughtspot.cloud"
+SEBE = "https://sebe.thoughtspotstaging.cloud"
+OWNER = "patrick.case@thoughtspot.com"
+
+# Verbatim: the body secloud and sebe returned for a fake username on
+# 2026-10-14, and the body recorded for runs 2a1c7306af2a / b58980440961 /
+# 1a69f7ab4c7f (incident ids differ per call).
+NO_ACCOUNT_BODY = (
+    r'{"error":{"message":{"debug":{"code":10002,"incident_id_guid":'
+    r'"3f8389f9-7dd8-4e69-8b0f-879a07467a89","trace_id_guid":"tracing-disabled",'
+    r'"debug":"[\"Invalid parameter values: {\\\"username\\\":\\\"Specified user '
+    r'does not exist.\\\"}\"]"}}}}'
+)
+# The page sebe served for every API call while in standby (2026-10-06), HTTP 200.
+STANDBY_PAGE = (
+    "<!DOCTYPE html><html><head><title>ThoughtSpot – Start Instance</title></head>"
+    "<body><h1>Your instance entered standby mode</h1><p>Complete the verification "
+    "below to wake up your instance.</p></body></html>"
+)
+BAD_KEY_BODY = json.dumps({"error": {"message": {"debug": {
+    "code": 10003, "debug": json.dumps(["Invalid secret key for trusted authentication."])}}}})
+
+
+class FakeResponse:
+    """Just enough of requests.Response: json() raises on non-JSON like the real one."""
+
+    def __init__(self, status_code, text="", content_type="application/json"):
+        self.status_code = status_code
+        self.text = text
+        self.headers = {"content-type": content_type} if content_type else {}
+
+    def json(self):
+        return json.loads(self.text)
+
+
+def test_the_verbatim_no_account_body_is_its_own_shape():
+    assert json.loads(NO_ACCOUNT_BODY)["error"]["message"]["debug"]["code"] == 10002
+    assert ts_error_reason(NO_ACCOUNT_BODY) == (
+        'Invalid parameter values: {"username":"Specified user does not exist."}')
+
+
+# --- classification: one response shape per outcome ------------------------ #
+@pytest.mark.parametrize("status, text, ctype, outcome", [
+    (200, '{"token": "t-123", "valid_for_user_id": "u"}', "application/json", "ok"),
+    (204, "", "", "ok"),
+    (400, NO_ACCOUNT_BODY, "application/json", "no_account"),
+    (401, BAD_KEY_BODY, "application/json", "rejected"),
+    (403, BAD_KEY_BODY, "application/json", "rejected"),
+    (200, STANDBY_PAGE, "text/html", "standby"),
+    (429, "Too Many Requests", "text/plain", "transient"),
+    (500, "", "text/html", "transient"),
+    (502, "<html>Bad Gateway</html>", "text/html", "transient"),
+    (503, "<html>Service Unavailable</html>", "text/html", "transient"),
+    (504, "", "", "transient"),
+    # Not proof the login fails, so not a refusal:
+    (200, "<html><body>Sign in with Okta</body></html>", "text/html", "inconclusive"),
+    (200, '{"unexpected": true}', "application/json", "inconclusive"),
+    (405, "<html><head><title>405 Not Allowed</title></head></html>", "text/html", "inconclusive"),
+    (400, "<html>Bad Request</html>", "text/html", "inconclusive"),
+    (404, '{"error": "not found"}', "application/json", "inconclusive"),
+])
+def test_classify_trusted_login(status, text, ctype, outcome):
+    got, _reason = classify_trusted_login(status, ctype, text)
+    assert got == outcome
+
+
+def test_only_causes_the_build_would_also_die_of_are_blocking():
+    assert LOGIN_BLOCKING == {"no_account", "rejected", "standby"}
+
+
+def test_messages_name_the_user_the_host_and_the_fix():
+    assert no_account_message(OWNER, SECLOUD) == (
+        "patrick.case@thoughtspot.com has no ThoughtSpot account on "
+        "se-thoughtspot-cloud.thoughtspot.cloud. Ask a ThoughtSpot admin to add them, "
+        "or pass ts_url for a cluster where they have one.")
+    assert standby_message(SEBE) == (
+        "sebe.thoughtspotstaging.cloud is in standby. Open "
+        "https://sebe.thoughtspotstaging.cloud in a browser and complete the wake-up "
+        "check, then retry.")
+
+
+# --- the precheck itself, every branch, mocked HTTP ------------------------- #
+@pytest.fixture(autouse=True)
+def no_network(monkeypatch):
+    """Any request a test did not mock fails loudly instead of leaving the box."""
+    def refuse(url, **_kw):
+        raise AssertionError(f"real network call in a unit test: POST {url}")
+    monkeypatch.setattr(requests, "post", refuse)
+
+
+@pytest.fixture
+def mcp():
+    import mcp_server
+    return mcp_server
+
+
+def _post_returning(monkeypatch, response=None, exc=None):
+    calls = []
+
+    def fake_post(url, **kwargs):
+        calls.append({"url": url, **kwargs})
+        if exc is not None:
+            raise exc
+        return response
+
+    monkeypatch.setattr(requests, "post", fake_post)
+    return calls
+
+
+def test_precheck_sends_exactly_the_builds_own_login_request(mcp, monkeypatch):
+    calls = _post_returning(monkeypatch, FakeResponse(200, '{"token": "t"}'))
+    rec = mcp._login_precheck(SECLOUD, "the-key", OWNER)
+    assert rec["outcome"] == "ok" and rec["blocking"] is False
+    assert len(calls) == 1, "one request, no retries — latency budget is one short call"
+    call = calls[0]
+    assert call["url"] == SECLOUD + "/api/rest/2.0/auth/token/full"
+    assert call["json"] == thoughtspot_deployer.trusted_token_request_body(OWNER, "the-key")
+    assert call["headers"]["X-Requested-By"] == "ThoughtSpot"
+    connect, read = call["timeout"]
+    assert connect + read <= 10, "the precheck may cost one short request, no more"
+
+
+def test_precheck_sends_the_username_the_deployer_will_send(mcp, monkeypatch):
+    """The controller lower-cases the owner before the deployer logs in; the
+    precheck must ask about that same username or it predicts nothing."""
+    calls = _post_returning(monkeypatch, FakeResponse(200, '{"token": "t"}'))
+    mcp._login_precheck(SECLOUD, "k", "  Patrick.Case@ThoughtSpot.com ")
+    assert calls[0]["json"]["username"] == OWNER
+
+
+def test_precheck_no_account_blocks_with_the_real_reason(mcp, monkeypatch):
+    _post_returning(monkeypatch, FakeResponse(400, NO_ACCOUNT_BODY))
+    rec = mcp._login_precheck(SECLOUD, "k", OWNER)
+    assert rec["outcome"] == "no_account" and rec["blocking"] is True
+    assert rec["http_status"] == 400
+    assert rec["message"] == no_account_message(OWNER, SECLOUD)
+    assert "Specified user does not exist" in rec["reason"]
+
+
+def test_precheck_standby_blocks_with_the_wake_up_instruction(mcp, monkeypatch):
+    _post_returning(monkeypatch, FakeResponse(200, STANDBY_PAGE, "text/html; charset=utf-8"))
+    rec = mcp._login_precheck(SEBE, "k", OWNER)
+    assert rec["outcome"] == "standby" and rec["blocking"] is True
+    assert rec["message"] == standby_message(SEBE)
+
+
+def test_precheck_other_rejection_blocks_and_quotes_thoughtspot(mcp, monkeypatch):
+    _post_returning(monkeypatch, FakeResponse(401, BAD_KEY_BODY))
+    rec = mcp._login_precheck(SECLOUD, "k", OWNER)
+    assert rec["outcome"] == "rejected" and rec["blocking"] is True
+    assert "HTTP 401" in rec["message"]
+    assert "Invalid secret key for trusted authentication." in rec["message"]
+    assert "has no ThoughtSpot account" not in rec["message"], "must not guess the cause"
+
+
+@pytest.mark.parametrize("exc", [
+    requests.exceptions.ReadTimeout("Read timed out. (read timeout=10)"),
+    requests.exceptions.ConnectTimeout("Connect timed out"),
+    requests.exceptions.ConnectionError("Connection reset by peer"),
+])
+def test_precheck_network_trouble_does_not_block(mcp, monkeypatch, exc):
+    _post_returning(monkeypatch, exc=exc)
+    rec = mcp._login_precheck(SECLOUD, "k", OWNER)
+    assert rec["outcome"] == "transient" and rec["blocking"] is False
+    assert rec["http_status"] is None
+    assert type(exc).__name__ in rec["reason"]
+    assert "message" not in rec
+
+
+@pytest.mark.parametrize("status", [429, 500, 502, 503, 504])
+def test_precheck_throttling_and_server_errors_do_not_block(mcp, monkeypatch, status):
+    _post_returning(monkeypatch, FakeResponse(status, "busy", "text/plain"))
+    rec = mcp._login_precheck(SECLOUD, "k", OWNER)
+    assert rec["outcome"] == "transient" and rec["blocking"] is False
+    assert rec["http_status"] == status
+
+
+def test_precheck_unrecognised_answer_does_not_block(mcp, monkeypatch):
+    _post_returning(monkeypatch, FakeResponse(200, "<html>Sign in</html>", "text/html"))
+    rec = mcp._login_precheck(SECLOUD, "k", OWNER)
+    assert rec["outcome"] == "inconclusive" and rec["blocking"] is False
+    assert "text/html" in rec["reason"]
+
+
+def test_the_precheck_record_never_carries_the_key(mcp, monkeypatch):
+    _post_returning(monkeypatch, FakeResponse(400, NO_ACCOUNT_BODY))
+    rec = mcp._login_precheck(SECLOUD, "SECRET-KEY-VALUE-123", OWNER)
+    assert "SECRET-KEY-VALUE-123" not in json.dumps(rec)
+
+
+# --- wired into build_demo_from_brief --------------------------------------- #
+class _Sink:
+    """Captures the durable intake/result rows instead of writing Supabase."""
+
+    def __init__(self):
+        self.intake, self.result = [], []
+
+
+@pytest.fixture
+def tool(mcp, monkeypatch):
+    """build_demo_from_brief with the resolvers, sinks and build stubbed out."""
+    sink = _Sink()
+    started = threading.Event()
+    seen = {}
+
+    def fake_run_build(*args, **kwargs):
+        seen["args"], seen["kwargs"] = args, kwargs
+        started.set()
+        return {}
+
+    monkeypatch.setattr(mcp, "_resolve_ts_target", lambda url: (SECLOUD, "k"))
+    monkeypatch.setattr(mcp, "_resolve_owner", lambda e: OWNER)
+    monkeypatch.setattr(mcp, "log_mcp_payload", lambda p: sink.intake.append(p) or True)
+    monkeypatch.setattr(mcp, "log_mcp_result", lambda p: sink.result.append(p) or True)
+    monkeypatch.setattr(mcp, "_run_build", fake_run_build)
+    monkeypatch.setattr(mcp, "_active_builds", {})  # keep the module's live state clean
+
+    def call():
+        return mcp.build_demo_from_brief(
+            brief="Lead Forensics wants to see pipeline by source.",
+            company_name="Lead Forensics", owner_email=OWNER, with_portal=False)
+
+    return call, sink, started, seen
+
+
+@pytest.mark.parametrize("response, message", [
+    (FakeResponse(400, NO_ACCOUNT_BODY), no_account_message(OWNER, SECLOUD)),
+    (FakeResponse(200, STANDBY_PAGE, "text/html"), standby_message(SECLOUD)),
+])
+def test_a_refused_login_fails_the_call_before_any_build_work(tool, mcp, monkeypatch,
+                                                              response, message):
+    call, sink, started, _seen = tool
+    _post_returning(monkeypatch, response)
+    slots_before = mcp._build_sem._value
+
+    out = call()
+
+    assert out["status"] == "failed"
+    assert out["errors"] == [message]
+    assert out["login_precheck"]["blocking"] is True
+    assert not started.wait(0.2), "the build must never start"
+    assert mcp._build_sem._value == slots_before, "no build slot may be taken"
+    # Durable: the refusal leaves the same intake + result rows a build does,
+    # joined by run_id, both carrying the precheck outcome.
+    assert len(sink.intake) == 1 and len(sink.result) == 1
+    intake, result = sink.intake[0], sink.result[0]
+    assert intake["run_id"] == result["run_id"] == out["run_id"]
+    assert intake["login_precheck"] == result["login_precheck"] == out["login_precheck"]
+    assert intake["brief"].startswith("Lead Forensics")
+    assert intake["resolved_owner_email"] == OWNER and intake["resolved_ts_url"] == SECLOUD
+    assert result["status"] == "failed" and result["errors"] == [message]
+    assert result["owner_email"] == OWNER and result["ts_url"] == SECLOUD
+
+
+@pytest.mark.parametrize("response, exc, outcome", [
+    (FakeResponse(200, '{"token": "t"}'), None, "ok"),
+    (None, requests.exceptions.ReadTimeout("Read timed out."), "transient"),
+    (FakeResponse(503, "Service Unavailable", "text/plain"), None, "transient"),
+    (FakeResponse(200, "<html>Sign in</html>", "text/html"), None, "inconclusive"),
+])
+def test_a_passing_or_unknown_login_lets_the_build_start(tool, monkeypatch,
+                                                         response, exc, outcome):
+    call, sink, started, seen = tool
+    _post_returning(monkeypatch, response, exc)
+
+    out = call()
+
+    assert out["status"] == "started", out
+    assert started.wait(5), "worker never called _run_build"
+    # The outcome travels to the build's records on the call payload.
+    handed = list(seen["args"]) + list(seen["kwargs"].values())
+    payloads = [a for a in handed if isinstance(a, dict) and "brief" in a]
+    assert len(payloads) == 1, "the worker should be handed the call payload"
+    assert payloads[0]["login_precheck"]["outcome"] == outcome
+    assert sink.intake == [] and sink.result == [], "the build writes its own rows"
+
+
+def test_the_build_result_row_carries_the_precheck(mcp, monkeypatch):
+    """_run_build's own result row (here: a build that dies at once) keeps it."""
+    rows = []
+    monkeypatch.setattr(mcp, "_recent_builds", collections.OrderedDict())
+    monkeypatch.setattr(mcp, "_last_build", None)
+    monkeypatch.setattr(mcp, "log_mcp_payload", lambda p: True)
+    monkeypatch.setattr(mcp, "log_mcp_result", lambda p: rows.append(p) or True)
+
+    def boom(**_kw):
+        raise RuntimeError("controller unavailable")
+
+    monkeypatch.setattr(mcp, "ChatDemoInterface", boom)
+    precheck = {"outcome": "transient", "blocking": False, "http_status": None,
+                "reason": "ReadTimeout: Read timed out.", "host": "h", "elapsed_ms": 10002}
+    out = mcp._run_build("r1", "brief", "Acme", "Custom Analytics", "", SECLOUD, "k",
+                         OWNER, False, {"brief": "brief", "login_precheck": precheck})
+    assert out["status"] == "failed"
+    assert rows and rows[0]["login_precheck"] == precheck
+
+
+def test_the_stored_result_row_keeps_the_precheck():
+    """log_mcp_result enumerates its keys, so check the row it would insert."""
+    from tests.test_payload_reaches_the_database import captured_result_row
+
+    precheck = {"outcome": "no_account", "blocking": True, "http_status": 400}
+    row = captured_result_row({"run_id": "r1", "status": "failed",
+                               "login_precheck": precheck})
+    assert row["login_precheck"] == precheck
+    assert captured_result_row({"run_id": "r2", "status": "success"})["login_precheck"] is None
+
+
+# --- the deployer's own login reports the real cause ------------------------ #
+def _deployer(response):
+    class FakeSession:
+        def __init__(self):
+            self.headers, self.calls = {}, 0
+
+        def post(self, url, **kwargs):
+            self.calls += 1
+            return response
+
+    d = thoughtspot_deployer.ThoughtSpotDeployer.__new__(thoughtspot_deployer.ThoughtSpotDeployer)
+    d.base_url, d.username, d.secret_key = SEBE, OWNER, "secret-key-value"
+    d.session = FakeSession()
+    d.last_auth_status_code, d.last_auth_error = None, ""
+    return d
+
+
+def test_deployer_names_the_standby_page_not_a_parse_error(monkeypatch):
+    monkeypatch.setattr(thoughtspot_deployer.time, "sleep", lambda s: None)
+    d = _deployer(FakeResponse(200, STANDBY_PAGE, "text/html; charset=utf-8"))
+    assert d.authenticate_trusted() is False
+    assert d.last_auth_error == standby_message(SEBE)
+    assert "Expecting value" not in d.last_auth_error
+    assert d.session.calls == 1, "a standby page does not clear in seconds — no retries"
+
+
+def test_deployer_names_the_content_type_of_any_other_non_json_200(monkeypatch):
+    monkeypatch.setattr(thoughtspot_deployer.time, "sleep", lambda s: None)
+    d = _deployer(FakeResponse(200, "<html><body>Sign in with Okta</body></html>", "text/html"))
+    assert d.authenticate_trusted() is False
+    assert "non-JSON response" in d.last_auth_error
+    assert "content-type text/html" in d.last_auth_error
+    assert d.last_auth_error == non_json_auth_error(
+        SEBE, 200, "text/html", "<html><body>Sign in with Okta</body></html>")
+
+
+def test_deploy_all_carries_the_cause_into_the_run_errors(monkeypatch):
+    """The run's error used to be the bare "ThoughtSpot authentication failed"."""
+    d = _deployer(None)
+    d.last_auth_error = standby_message(SEBE)
+    monkeypatch.setattr(d, "authenticate", lambda: False, raising=False)
+    results = d.deploy_all("CREATE TABLE t (id INT);", "DB", "SCHEMA", "base")
+    assert results["success"] is False
+    assert results["errors"][0] == (
+        f"ThoughtSpot authentication failed for {OWNER} on {SEBE}: {standby_message(SEBE)}")
+
+
+def test_deploy_all_quotes_thoughtspots_reason_for_a_missing_account(monkeypatch):
+    d = _deployer(None)
+    d.last_auth_error = NO_ACCOUNT_BODY
+    monkeypatch.setattr(d, "authenticate", lambda: False, raising=False)
+    results = d.deploy_all("CREATE TABLE t (id INT);", "DB", "SCHEMA", "base")
+    assert "Specified user does not exist." in results["errors"][0]
+    assert "incident_id_guid" not in results["errors"][0]
+
+
+def test_deploy_all_turns_a_missing_account_into_the_plain_instruction(monkeypatch):
+    """Findings triage 2026-10-15, E2: four builds failed at deploy with only
+    "ThoughtSpot authentication failed"; the run error now names the user, the
+    cluster and what to do, and still quotes ThoughtSpot."""
+    from thoughtspot_errors import no_account_message
+
+    d = _deployer(None)
+    d.last_auth_status_code, d.last_auth_error = 400, NO_ACCOUNT_BODY
+    monkeypatch.setattr(d, "authenticate", lambda: False, raising=False)
+    results = d.deploy_all("CREATE TABLE t (id INT);", "DB", "SCHEMA", "base")
+    assert results["errors"][0].startswith(no_account_message(OWNER, SEBE))
+    assert "Specified user does not exist." in results["errors"][0]
+    assert d.auth_failure_message() == results["errors"][0]

tests/test_measure_bounds.py

@@ -86,7 +86,7 @@ def _spread(values):
     ("HEALTH_SCORE", {"mean": 85, "sigma": 0.3}, 0.0, 100.0),
     ("RENEWAL_RISK_SCORE", {"mean": 42, "sigma": 0.5}, 0.0, 100.0),
     ("SUPPLIER_QUALITY_INDEX", {"mean": 7.4}, 0.0, 10.0),
-    ("CSAT_SCORE", {"mean": 4.3}, 0.0, 5.0),
+    ("CSAT_SCORE", {"mean": 4.3}, 1.0, 5.0),     # a 1-5 CSAT by name (NAMED_SCORE_SCALES)
     ("CREDIT_SCORE", {"mean": 715}, 0.0, 850.0),
     ("NPS_SCORE", {"mean": 40}, -100.0, 100.0),
     # rates on the convention their own params imply
@@ -121,7 +121,66 @@ def test_loss_and_cost_measures_are_non_negative(name):
     "FORECAST_ERROR_MW", "BUDGET_VARIANCE_USD", "LOAD_DEVIATION", "NET_CHANGE_MW",
 ])
 def test_signed_measures_are_not_forced_non_negative(name):
-    assert infer_bound(name, "currency", {"mean": 0, "sigma": 500}) is None
+    bound = infer_bound(name, "currency", {"mean": 0, "sigma": 500})
+    assert bound is not None and bound.kind == "signed"
+    assert bound.unbounded and not bound.gap and not bound.hard
+    assert bound.low is None and bound.high is None
+
+
+# --- signed is an ANSWER, not a gap (findings triage 2026-10-15, A2) --------
+#
+# infer_bound used to return None both for "a variance has no bound" and for
+# "nothing matched this name". The post-load gate could not tell them apart and
+# posted NET_CASH_FLOW_USD, GROSS_MARGIN, OPERATING_MARGIN, SPEND_VARIANCE_USD
+# and NET_ENROLLMENT_CHANGE as vocabulary gaps on every build that had them.
+
+
+@pytest.mark.parametrize("name,fmt", [
+    ("NET_CASH_FLOW_USD", "currency"), ("GROSS_MARGIN", "currency"),
+    ("OPERATING_MARGIN", "float"), ("SPEND_VARIANCE_USD", "currency"),
+    ("NET_ENROLLMENT_CHANGE", "int"), ("NET_INCOME", "currency"),
+    # the gate's name-only call: no format at all
+    ("NET_CASH_FLOW_USD", ""), ("GROSS_MARGIN", ""), ("NET_INCOME", ""),
+])
+def test_signed_by_design_is_a_signed_bound_not_none(name, fmt):
+    bound = infer_bound(name, fmt, {"mean": 1200.0})
+    assert bound is not None, f"{name}: a signed quantity must not read as 'no class matched'"
+    assert bound.kind == "signed" and bound.unbounded and bound.gap == ""
+    assert not bound.violates(-5.0) and not bound.violates(1e9)
+
+
+def test_a_declared_signed_flag_and_a_difference_formula_are_signed_too():
+    declared = infer_bound("ADJUSTED_SPEND_USD", "currency", {"mean": 100}, signed=True)
+    assert declared is not None and declared.kind == "signed" and "declared" in declared.source
+    derived = infer_bound("SPOT_FORECAST_SPREAD_USD", "currency", {}, formula="SPOT - FORECAST")
+    assert derived is not None and derived.kind == "signed" and "difference" in derived.source
+    # an explicit non-negative token still wins over the formula's shape
+    assert infer_bound("PRICE_GAP_USD", "currency", {}, formula="SPOT - FORECAST").kind == "non_negative"
+
+
+def test_a_leading_net_never_widens_a_rate_or_a_score():
+    # NET_COLLECTION_RATE is a 0-1 rate; the proportion class answers first.
+    rate = infer_bound("NET_COLLECTION_RATE", "float", {"mean": 0.93})
+    assert (rate.kind, rate.low, rate.high) == ("rate", 0.0, 1.0)
+    nps = infer_bound("NET_PROMOTER_SCORE", "float", {"mean": 40})
+    assert nps.kind == "score"
+
+
+# --- the format is evidence (A1): a count or an amount is non-negative --------
+
+
+@pytest.mark.parametrize("name,fmt", [
+    # names with NO vocabulary at all, so the format is the only evidence
+    ("GIZMOS", "int"), ("WIDGETS_FROBNICATED", "int"), ("THINGAMAJIGS", "int"),
+    ("DOUBLOONS", "currency"), ("GALLEONS_QUIDS", "currency"), ("ZORKMIDS", "currency"),
+])
+def test_an_int_count_or_a_currency_amount_is_non_negative_when_the_format_is_known(name, fmt):
+    bound = infer_bound(name, fmt, {"mean": 4200.0})
+    assert bound is not None and bound.kind == "non_negative" and bound.low == 0.0
+    assert bound.hard is (fmt == "int")
+    # Without the format these names have NO vocabulary: that is the exact
+    # None the post-load gate used to receive for every count and amount.
+    assert infer_bound(name, "", {"mean": 4200.0}) is None
 
 
 def test_a_score_with_no_declared_range_is_a_loud_gap_not_a_guess():
@@ -380,3 +439,164 @@ def test_a_quantity_is_not_mistaken_for_a_rate(name, params):
     bound = infer_bound(name, "float", params)
     assert bound is not None and bound.kind == "non_negative"
     assert bound.high is None
+
+
+# --- Wave 2 of the findings triage (2026-10-15): vocabulary, scores, open ratios
+
+
+@pytest.mark.parametrize("name,kind", [
+    # currencies (five Canadian prospects in three days) and money nouns
+    ("AUM_CAD", "non_negative"), ("GROSS_SALES_AUD", "non_negative"), ("TOTAL_DOLLARS", "non_negative"),
+    ("COGS", "non_negative"), ("GMV", "non_negative"), ("COMMISSION", "non_negative"),
+    ("AVG_FARE", "non_negative"), ("MSRP", "non_negative"), ("ANNUAL_BUDGET", "non_negative"),
+    ("TUITION_PAID", "non_negative"), ("REIMBURSEMENT", "non_negative"),
+    # counts: plural nouns and counted events
+    ("SESSIONS", "non_negative"), ("ORDERS_SHIPPED", "non_negative"), ("CASES_PICKED", "non_negative"),
+    ("TICKETS_RESOLVED", "non_negative"), ("ACCOUNTS_CREATED", "non_negative"), ("PATIENTS", "non_negative"),
+    # physical units
+    ("HAUL_DISTANCE_FT", "non_negative"), ("PAYLOAD_KG", "non_negative"), ("RESPONSE_MS", "non_negative"),
+    ("YEARS_OF_SERVICE", "non_negative"), ("FUEL_EFFICIENCY_MPG", "non_negative"),
+    # proportion words
+    ("THROUGHPUT_EFFICIENCY", "rate"), ("LEAD_ATTRIBUTION_COMPLETENESS", "rate"),
+    ("SEAT_AVAILABILITY", "rate"), ("FORECAST_ACCURACY", "rate"), ("LOAD_FACTOR", "rate"),
+    ("SELL_THROUGH", "rate"),
+])
+def test_the_vocabulary_added_after_the_october_flood_classifies_the_names_that_flooded(name, kind):
+    bound = infer_bound(name, "", {"mean": 0.7 if kind == "rate" else 4200.0})
+    assert bound is not None and bound.kind == kind, f"{name}: {bound and bound.describe()}"
+
+
+def test_a_net_quantity_still_wins_over_a_money_noun():
+    assert infer_bound("NET_INCOME", "", {"mean": 1200.0}).kind == "signed"
+    assert infer_bound("NET_PRESENT_VALUE", "", {"mean": 1200.0}).kind == "signed"
+
+
+@pytest.mark.parametrize("name,params,low,high", [
+    ("MEDIAN_SAT_SCORE", {"mean": 1530}, 400.0, 1600.0),     # fell off the ladder before
+    ("AVG_GPA", {"mean": 3.4}, 0.0, 4.0),
+    ("WEIGHTED_GPA", {"mean": 4.3}, 0.0, 5.0),
+    ("ACT_SCORE", {"mean": 24}, 1.0, 36.0),
+    ("AVG_CSAT", {"mean": 4.1}, 1.0, 5.0),
+    ("CSAT_SCORE", {"mean": 82}, 0.0, 100.0),                  # a 0-100 CSAT reads off the ladder
+    ("CSAT_SCORE", {"low": 0, "high": 10}, 0.0, 10.0),         # a declared range wins
+    ("SAT_SCORE", {"mean": 4.2}, 0.0, 5.0),                    # 'SAT' as satisfaction, not the exam
+])
+def test_named_score_scales(name, params, low, high):
+    bound = infer_bound(name, "float", params)
+    assert bound is not None and bound.kind == "score" and not bound.gap, bound
+    assert (bound.low, bound.high) == (low, high), bound.describe()
+
+
+def test_a_sum_of_scores_is_a_quantity_not_a_score():
+    from demoprep_app.dataset.measure_names import is_score_column
+
+    assert not is_score_column("CSAT_SCORE_SUM") and not is_score_column("TOTAL_RISK_SCORE")
+    bound = infer_bound("CSAT_SCORE_SUM", "float", {"mean": 1200})
+    assert bound is not None and bound.kind == "non_negative" and not bound.gap
+    # an NPS sum can be negative, so it is not forced non-negative
+    nps_sum = infer_bound("NPS_SCORE_SUM", "float", {"mean": 40})
+    assert nps_sum is None or nps_sum.kind != "non_negative"
+
+
+@pytest.mark.parametrize("name", [
+    "PIPELINE_COVERAGE_RATIO", "COMBINED_RATIO", "LOSS_RATIO", "INVENTORY_TURNOVER_RATIO",
+    "INVENTORY_TURNS", "BOOK_TO_BILL", "LTV_CAC_RATIO", "DEBT_TO_EQUITY_RATIO", "CURRENT_RATIO",
+    "PIPELINE_COVERAGE",
+])
+def test_an_open_ratio_has_a_floor_and_no_ceiling(name):
+    from demoprep_app.dataset.measure_names import is_open_ratio_name, is_rate_column
+
+    assert is_open_ratio_name(name)
+    for fmt in ("float", "pct"):
+        bound = infer_bound(name, fmt, {"mean": 1.4})
+        assert bound is not None and (bound.low, bound.high) == (0.0, None), f"{name}/{fmt}: {bound.describe()}"
+        assert bound.kind == "non_negative" and not bound.hard
+    # Bruker's board: a 3.2x coverage must not be "out of bounds"
+    assert not infer_bound(name, "float", {"mean": 1.4}).violates(3.2)
+    # the aggregation is unchanged: a _RATIO still averages
+    if name.endswith("_RATIO"):
+        assert is_rate_column(name)
+
+
+@pytest.mark.parametrize("name", ["TURNOVER_RATE", "EMPLOYEE_TURNOVER_PCT", "LOSS_RATE", "COVERAGE_PCT"])
+def test_a_rate_that_merely_shares_a_word_with_an_open_ratio_stays_bounded(name):
+    from demoprep_app.dataset.measure_names import is_open_ratio_name
+
+    assert not is_open_ratio_name(name)
+    assert infer_bound(name, "float", {"mean": 0.15}).kind == "rate"
+
+
+def test_harden_turns_an_open_ratio_declared_pct_into_a_float():
+    bp = _blueprint([
+        {"name": "PREMIUMS_EARNED", "fmt": "currency", "params": {"mean": 50000}},
+        {"name": "COMBINED_RATIO", "fmt": "pct", "params": {"mean": 0.98, "sigma": 0.1}},
+    ])
+    measure = next(m for m in bp.facts[0].measures if m.name == "COMBINED_RATIO")
+    assert measure.fmt == "float"
+    assert any("COMBINED_RATIO: fmt 'pct' -> 'float'" in fix for fix in bp.metadata.get("hardening", []))
+    values = _series(bp, "COMBINED_RATIO")
+    assert max(values) > 1.0, "an open ratio must be allowed above 1"
+
+
+def test_a_pile_up_on_a_derived_ratio_tells_the_author_to_declare_share_of():
+    from demoprep_app.dataset.engine import CAP_PILEUP_WARN_SHARE
+    from demoprep_app.dataset.measure_bounds import MeasureBound
+    from demoprep_app.scenario.blueprint import BlueprintMeasure
+
+    engine = BlueprintEngine()
+    derived = BlueprintMeasure(name="FILL_RATE", kind="derived", formula="FILLED / ORDERED", fmt="pct",
+                               bound=MeasureBound(0.0, 1.0, "rate", "proportion"))
+    base = BlueprintMeasure(name="UTILIZATION_RATE", kind="base", fmt="pct", params={"mean": 0.9},
+                            bound=MeasureBound(0.0, 1.0, "rate", "proportion"))
+    for _ in range(20):
+        engine._store(derived, 1.0)
+        engine._store(base, 1.0)
+    by_name = {f.measure: f for f in engine.bound_findings() if f.code == "measure_bound_pileup"}
+    assert set(by_name) == {"FILL_RATE", "UTILIZATION_RATE"} and CAP_PILEUP_WARN_SHARE < 1.0
+    assert "share_of" in by_name["FILL_RATE"].suggestion and "FILLED / ORDERED" in by_name["FILL_RATE"].suggestion
+    assert "params.mean" not in by_name["FILL_RATE"].suggestion
+    assert "params.mean" in by_name["UTILIZATION_RATE"].suggestion
+
+
+# --- Wave 3 (C2): a margin rate is bounded through its difference -------------
+
+def _margin_blueprint(rate_formula: str, gross_margin: bool = True):
+    measures = [
+        {"name": "NET_SALES", "fmt": "currency", "params": {"mean": 50000, "sigma": 0.4}},
+        {"name": "COGS", "fmt": "currency", "params": {"mean": 38000, "sigma": 0.4}},
+    ]
+    if gross_margin:
+        measures.append({"name": "GROSS_MARGIN", "kind": "derived", "fmt": "currency",
+                         "formula": "NET_SALES - COGS"})
+    measures.append({"name": "GROSS_MARGIN_RATE", "kind": "derived", "fmt": "pct", "formula": rate_formula})
+    return _blueprint(measures, fact="RETAIL_SALES")
+
+
+@pytest.mark.parametrize("formula,gross_margin", [
+    ("GROSS_MARGIN / NET_SALES", True),             # Loblaw's shape: a derived numerator
+    ("(NET_SALES - COGS) / NET_SALES", False),      # the margin written inline
+])
+def test_a_margin_rate_bounds_the_cost_as_a_share_of_sales_instead_of_clamping(formula, gross_margin):
+    bp = _margin_blueprint(formula, gross_margin)
+    cogs = next(m for m in bp.facts[0].measures if m.name == "COGS")
+    rate = next(m for m in bp.facts[0].measures if m.name == "GROSS_MARGIN_RATE")
+    assert cogs.share_of == "NET_SALES", bp.metadata.get("hardening")
+    assert any("COGS: inferred share_of NET_SALES from GROSS_MARGIN_RATE" in f for f in bp.metadata["hardening"])
+    assert not rate.formula.startswith("MIN(MAX("), "bounded by construction — no wrap needed"
+
+    values = _series(bp, "GROSS_MARGIN_RATE", fact="RETAIL_SALES")
+    assert 0.0 <= min(values) and max(values) <= 1.0
+    at_cap = sum(1 for v in values if v >= 0.999) / len(values)
+    assert at_cap < 0.01, f"{at_cap:.1%} of rows pinned at the cap"
+
+
+def test_a_rate_that_cannot_be_bounded_structurally_says_why():
+    bp = _blueprint([
+        {"name": "UNITS_ORDERED", "fmt": "int", "params": {"mean": 500, "sigma": 0.4}},
+        {"name": "UNITS_SHIPPED", "fmt": "int", "params": {"mean": 450, "sigma": 0.4}},
+        {"name": "UNITS_FILLED", "kind": "derived", "fmt": "int", "formula": "UNITS_SHIPPED * 0.9"},
+        {"name": "FILL_RATE", "kind": "derived", "fmt": "pct", "formula": "UNITS_FILLED / UNITS_ORDERED"},
+    ], fact="ORDERS")
+    notes = [f for f in bp.metadata["hardening"] if f.startswith("[BOUND-NOTE] FILL_RATE")]
+    assert len(notes) == 1
+    assert "UNITS_FILLED is derived" in notes[0] and "wrapped in MIN/MAX" in notes[0]

tests/test_measure_formula.py

@@ -12,6 +12,7 @@ import pytest
 
 from demoprep_app.dataset.formula import (
     FormulaEvaluationError,
+    alias_target,
     evaluate,
     identifiers,
     ratio_pairs,
@@ -107,6 +108,39 @@ def test_validate_rejects_bad_arity():
     assert problems and "ABS()" in problems[0]
 
 
+# --- identity formulas are copies (findings triage 2026-10-15, D) -------------
+#
+# Humpty Dump's DAYS_ON_SITE = RENTAL_DAYS * 1 passed validation (the
+# identifier existed), stored a copy, was caught post-load as a mirror,
+# "repaired" by recomputing the same identity and dropped as repair_failed —
+# three builds in 70 minutes for one measure. The guard belongs BEFORE
+# generation, where the repair loop can demote or drop it.
+
+
+@pytest.mark.parametrize("formula", [
+    "RENTAL_DAYS * 1", "1 * RENTAL_DAYS", "RENTAL_DAYS / 1", "RENTAL_DAYS + 0",
+    "0 + RENTAL_DAYS", "RENTAL_DAYS - 0", "RENTAL_DAYS * 1.0", "(RENTAL_DAYS * 1) / 1",
+    "ROUND(RENTAL_DAYS * 1, 2)", "RENTAL_DAYS",
+])
+def test_an_identity_formula_is_reported_as_a_copy(formula):
+    assert alias_target(formula) == "RENTAL_DAYS"
+    problems = validate(formula, {"RENTAL_DAYS", "IDLE_DAYS"}, measure="DAYS_ON_SITE")
+    assert len(problems) == 1, problems
+    assert "RENTAL_DAYS" in problems[0] and "identical" in problems[0]
+    shape = "bare alias" if formula == "RENTAL_DAYS" else "arithmetic identity"
+    assert shape in problems[0]
+
+
+@pytest.mark.parametrize("formula", [
+    "RENTAL_DAYS * 2", "RENTAL_DAYS / 100", "RENTAL_DAYS * 1.07", "RENTAL_DAYS + IDLE_DAYS",
+    "RENTAL_DAYS - IDLE_DAYS", "1 - RENTAL_DAYS", "1 / RENTAL_DAYS", "RENTAL_DAYS * (2 - 1)",
+    "ABS(RENTAL_DAYS)",
+])
+def test_a_real_computation_is_not_an_identity(formula):
+    assert alias_target(formula) == ""
+    assert validate(formula, {"RENTAL_DAYS", "IDLE_DAYS"}, measure="DAYS_ON_SITE") == []
+
+
 # --- helpers ----------------------------------------------------------------
 
 

tests/test_portal_url_round_trip.py

@@ -19,6 +19,14 @@ def _mcp_source() -> str:
     return inspect.getsource(mcp_server)
 
 
+def _build_result_source() -> str:
+    """_run_build only: the build's result payload. Another log_mcp_result call
+    (the ISS-22 login-precheck refusal, which builds nothing) must not be the
+    block these checks land on."""
+    import mcp_server
+    return inspect.getsource(mcp_server._run_build)
+
+
 def test_status_view_carries_portal_url():
     """_recent_builds is what status() serves; it must include the site."""
     src = _mcp_source()
@@ -28,7 +36,7 @@ def test_status_view_carries_portal_url():
 
 def test_durable_result_payload_carries_portal_url():
     """The payload handed to log_mcp_result must include the site."""
-    src = _mcp_source()
+    src = _build_result_source()
     block = src.split("log_mcp_result({", 1)[1].split("})", 1)[0]
     assert "portal_url" in block, "the durable record would omit the built site"
 
@@ -65,7 +73,7 @@ def test_status_view_carries_download_url():
 
 
 def test_durable_result_payload_carries_download_url():
-    src = _mcp_source()
+    src = _build_result_source()
     block = src.split("log_mcp_result({", 1)[1].split("})", 1)[0]
     assert "download_url" in block, "the durable record would omit the source zip"
 

tests/test_quality_gate.py

@@ -778,3 +778,146 @@ def test_a_score_with_no_inferable_scale_is_warned_not_bounded():
     assert any("READINESS_SCORE" in w and "standard score scale" in w for w in profile["warnings"]), \
         profile["warnings"]
     assert cursor.sql_of_kind("UPDATE") == []
+
+
+# --------------------------------------------------------------------------- #
+# Findings triage 2026-10-15, Wave 1 — the gate reads the blueprint's formats,
+# tells "signed" from "unclassified", and never recomputes a mirror.
+# --------------------------------------------------------------------------- #
+
+# GIZMOS / DOUBLOONS stand in for the SESSIONS / COGS of the 2026-10 flood:
+# names with no vocabulary at all, so the declared format is the only evidence
+# (Wave 2 added count and money vocabulary that now classifies the real ones).
+_SALES_COLUMNS = [
+    ("SALES", "GIZMOS", "NUMBER(38,0)"),
+    ("SALES", "DOUBLOONS", "NUMBER(16,2)"),
+    ("SALES", "NET_CASH_FLOW_USD", "NUMBER(16,2)"),
+    ("SALES", "GROSS_MARGIN", "NUMBER(16,2)"),
+]
+_SALES_STATS = [
+    ("GIZMOS", {"non_zero": 900, "min": 3.0, "max": 410.0, "avg": 88.0}),
+    ("DOUBLOONS", {"non_zero": 900, "min": 12.0, "max": 9800.0, "avg": 1400.0}),
+    ("NET_CASH_FLOW_USD", {"non_zero": 900, "min": -8000.0, "max": 9500.0, "avg": 300.0}),
+    ("GROSS_MARGIN", {"non_zero": 900, "min": -200.0, "max": 4100.0, "avg": 1200.0}),
+]
+_SALES_FORMATS = {
+    "SALES.GIZMOS": {"fmt": "int", "signed": False, "kind": "base"},
+    "SALES.DOUBLOONS": {"fmt": "currency", "signed": False, "kind": "base"},
+    "SALES.NET_CASH_FLOW_USD": {"fmt": "currency", "signed": False, "kind": "derived"},
+    "SALES.GROSS_MARGIN": {"fmt": "currency", "signed": False, "kind": "derived"},
+}
+
+
+def _unclassified(profile):
+    return sorted(f["measure"] for f in profile["findings"] if f["code"] == "bound_not_inferable")
+
+
+def test_name_only_the_gate_leaves_counts_and_amounts_unclassified_but_never_a_signed_name():
+    """The 2026-10-12..15 flood: SESSIONS / COGS came back None from a
+    name-only call. NET_/MARGIN names did too — and no longer do (A2)."""
+    cursor = FakeCursor(columns_rows=_SALES_COLUMNS, profiles={"SALES": [profile_row(900, _SALES_STATS)]})
+    profile = run_measure_quality_gate(FakeConnection(cursor), "X_sch")
+    assert _unclassified(profile) == ["DOUBLOONS", "GIZMOS"]
+    # a registry gap is `info`, kept for the record — not a warning per measure
+    assert {f["severity"] for f in profile["findings"] if f["code"] == "bound_not_inferable"} == {"info"}
+    assert profile["defects"] == []
+
+
+def test_with_the_blueprints_formats_nothing_is_unclassified_and_nothing_is_invented():
+    cursor = FakeCursor(columns_rows=_SALES_COLUMNS, profiles={"SALES": [profile_row(900, _SALES_STATS)]})
+    profile = run_measure_quality_gate(FakeConnection(cursor), "X_sch", formats=_SALES_FORMATS)
+    assert _unclassified(profile) == []
+    # the negatives on the signed pair are legal; a currency amount is a soft
+    # bound; the int count is in range — no defect, no repair
+    assert profile["defects"] == [] and profile["repairs"] == []
+
+
+def test_a_negative_int_count_is_caught_once_the_format_is_known():
+    stats = [("GIZMOS", {"non_zero": 900, "min": -4.0, "max": 410.0, "avg": 88.0})]
+    cursor = FakeCursor(columns_rows=_SALES_COLUMNS[:1], profiles={"SALES": [profile_row(900, stats)] * 2})
+    profile = run_measure_quality_gate(
+        FakeConnection(cursor), "X_sch", formats=_SALES_FORMATS, repair=False,
+    )
+    assert [d["defect"] for d in profile["defects"]] == ["measure_out_of_bounds"]
+    assert profile["defects"][0]["bound_kind"] == "non_negative"
+
+
+def test_measure_formats_reads_the_declared_semantics_off_the_bundle():
+    from demoprep_app.dataset.contracts import DatasetBundle, DatasetColumn, DatasetTable
+    from demoprep_app.integrations.snowflake.quality_gate import measure_formats
+
+    table = DatasetTable("FACT_F", "one row per day", [
+        DatasetColumn("FACT_F_KEY", "fact_key", "NUMBER", nullable=False),
+        DatasetColumn("SESSIONS", "sessions", "NUMBER(38,0)", fmt="int", measure_kind="base"),
+        DatasetColumn("PRICE_ERROR", "price_error", "NUMBER(16,2)", formula="SPOT - FORECAST",
+                      fmt="currency", signed=True, measure_kind="derived"),
+    ], is_fact=True)
+    assert measure_formats(DatasetBundle(scenario=None, tables=[table])) == {
+        "FACT_F.SESSIONS": {"fmt": "int", "signed": False, "kind": "base"},
+        "FACT_F.PRICE_ERROR": {"fmt": "currency", "signed": True, "kind": "derived"},
+    }
+
+
+def test_a_mirror_is_omitted_without_a_recompute_and_names_the_identity():
+    """Humpty Dump run 2 (2026-10-13): DAYS_ON_SITE = RENTAL_DAYS * 1. The gate
+    recomputed it from the same identity, re-profiled, still mirrored, posted
+    repair_failed AND the mirror, and dropped the column — three builds."""
+    days = {"non_zero": 3000, "min": 1.0, "max": 44.0, "avg": 9.2}
+    money = {"non_zero": 3000, "min": 120.0, "max": 9800.0, "avg": 1400.0}
+    # five measures, so one dropped column (20%) stays under the 25% abort line
+    cursor = FakeCursor(
+        columns_rows=[
+            ("RENTAL", "RENTAL_DAYS", "NUMBER(38,0)"),
+            ("RENTAL", "DAYS_ON_SITE", "NUMBER(38,0)"),
+            ("RENTAL", "RENTAL_REVENUE_USD", "NUMBER(16,2)"),
+            ("RENTAL", "HAUL_COST_USD", "NUMBER(16,2)"),
+            ("RENTAL", "DISPOSAL_FEES_USD", "NUMBER(16,2)"),
+        ],
+        profiles={"RENTAL": [profile_row(3000, [
+            ("RENTAL_DAYS", days), ("DAYS_ON_SITE", dict(days)),
+            ("RENTAL_REVENUE_USD", money), ("HAUL_COST_USD", dict(money)),
+            ("DISPOSAL_FEES_USD", {"non_zero": 3000, "min": 20.0, "max": 900.0, "avg": 140.0}),
+        ])]},
+        mirror={"RENTAL": [(0,)]},
+    )
+    profile = run_measure_quality_gate(
+        FakeConnection(cursor), "HUM_sch", formulas={"RENTAL.DAYS_ON_SITE": "RENTAL_DAYS * 1"},
+    )
+
+    assert [d["defect"] for d in profile["defects"]] == ["mirrors_other_column"]
+    assert cursor.sql_of_kind("UPDATE") == [], "a mirror is never recomputed"
+    assert profile["repair_failures"] == [] and profile["repairs"] == []
+    assert [o["column"] for o in profile["omissions"]] == ["DAYS_ON_SITE"]
+    assert [f["code"] for f in profile["findings"]] == ["measure_mirrors_other_column"]
+    defect = profile["defects"][0]
+    assert "identity of RENTAL_DAYS" in defect["detail"] and "RENTAL_DAYS * 1" in defect["detail"]
+    assert "copy of RENTAL_DAYS" in defect["suggestion"]
+    assert "not a measure of" not in defect["suggestion"]
+
+
+def test_a_hollow_difference_names_the_input_that_contributed_nothing():
+    from demoprep_app.integrations.snowflake.quality_gate import _mirror_explanation
+
+    detail, suggestion = _mirror_explanation(
+        "FACT_F", "PRICE_ERROR", "FORECAST_PRICE", -1, "SPOT_PRICE_ACTUAL - FORECAST_PRICE",
+    )
+    assert detail.startswith("every row equals -FORECAST_PRICE")
+    assert "SPOT_PRICE_ACTUAL" in detail and "contributed nothing" in detail
+    assert "SPOT_PRICE_ACTUAL must exist in FACT_F and vary" in suggestion
+
+
+def test_the_semantic_checks_never_probe_an_open_ratio_against_zero_to_one():
+    """PIPELINE_COVERAGE_RATIO at 3.2x is not 'outside [0, 1]' (triage C1)."""
+    cursor = FakeCursor(
+        columns_rows=[("DEALS", "PIPELINE_COVERAGE_RATIO", "NUMBER(16,4)"),
+                      ("DEALS", "WIN_RATE", "NUMBER(16,4)")],
+        profiles={"DEALS": [profile_row(400, [
+            ("PIPELINE_COVERAGE_RATIO", {"non_zero": 400, "min": 0.8, "max": 4.1, "avg": 2.6}),
+            ("WIN_RATE", {"non_zero": 400, "min": 0.1, "max": 0.6, "avg": 0.3}),
+        ])]},
+    )
+    profile = run_measure_quality_gate(FakeConnection(cursor), "BRU_sch")
+    probes = [sql for sql in cursor.executed if sql.startswith("SELECT COUNT(*), MIN(")]
+    assert len(probes) == 1 and '"WIN_RATE"' in probes[0], probes
+    assert profile["defects"] == [], "a coverage ratio above 1 is not out of bounds"
+    assert not any("PIPELINE_COVERAGE_RATIO" in w for w in profile["semantic_warnings"])

tests/test_tuning_round_findings.py

@@ -171,9 +171,11 @@ def test_an_out_of_range_escape_remeasured_every_round_surfaces_once(monkeypatch
 # Guard: the fix is per round, not a looser key
 # --------------------------------------------------------------------------- #
 def test_distinct_messages_for_one_measure_are_still_distinct_findings():
-    """Two different statements about one measure at one stage (say, piled on
-    the high bound AND on a non-zero low bound, or two facts with two bounds)
-    are two defects. Collapsing on (code, stage, table, measure) would hide one."""
+    """Two different statements about one measure at ONE stage (say, piled on
+    the high bound AND on a non-zero low bound) are two defects, and both are
+    kept. The cross-stage collapse (findings triage 2026-10-15, A3: blueprint
+    and post-load both naming CSAT_SCORE_SUM) keeps the later stage's records
+    and never merges two messages from the same stage."""
     common = dict(code="measure_bound_pileup", severity="warning", stage="generation",
                   suggestion="fix the formula's inputs", measure=RATE, table=FACT)
     high = Finding(message="231/3333 row(s) sit ON the high bound", **common)

thoughtspot_deployer.py

@@ -29,13 +29,33 @@ from datetime import datetime
 from typing import Dict, List, Optional, Tuple
 from dotenv import load_dotenv
 from snowflake_auth import get_snowflake_connection_params
-from thoughtspot_errors import friendly_mcp_liveboard_error
+from thoughtspot_errors import (
+    friendly_mcp_liveboard_error,
+    non_json_auth_error,
+    trusted_auth_failure_message,
+    ts_error_reason,
+)
 from demoprep_app.dataset.measure_names import default_aggregation
 
 # Load environment variables
 load_dotenv()
 
 
+# The trusted-auth token request. Shared by ThoughtSpotDeployer.authenticate_trusted()
+# and the MCP login precheck (mcp_server._login_precheck, ISS-22), so the precheck
+# asks ThoughtSpot exactly what the build's own login will ask.
+TRUSTED_TOKEN_PATH = "/api/rest/2.0/auth/token/full"
+TS_REQUEST_HEADERS = {"Content-Type": "application/json", "X-Requested-By": "ThoughtSpot"}
+
+
+def trusted_token_request_body(username: str, secret_key: str) -> dict:
+    return {
+        "username": username,
+        "secret_key": secret_key,
+        "validity_time_in_sec": 3600,  # 1 hour token
+    }
+
+
 def _get_code_version() -> str:
     """Return the deployed code version for run lineage/debugging."""
     for env_name in ("DEMO_PREP_COMMIT", "SPACE_COMMIT_SHA", "GIT_COMMIT", "COMMIT_SHA"):
@@ -338,11 +358,8 @@ class ThoughtSpotDeployer:
         self.sf_role = get_admin_setting('SNOWFLAKE_ROLE')
         self.sf_warehouse = get_admin_setting('SNOWFLAKE_WAREHOUSE')
         
-        self.headers = {
-            'Content-Type': 'application/json',
-            'X-Requested-By': 'ThoughtSpot'
-        }
-        
+        self.headers = dict(TS_REQUEST_HEADERS)
+
         # Use session to maintain cookies between requests
         self.session = requests.Session()
         self.session.headers.update(self.headers)
@@ -409,7 +426,7 @@ class ThoughtSpotDeployer:
         """Authenticate with ThoughtSpot using trusted authentication (secret key)"""
         self.last_auth_status_code = None
         self.last_auth_error = ""
-        auth_url = f"{self.base_url}/api/rest/2.0/auth/token/full"
+        auth_url = f"{self.base_url}{TRUSTED_TOKEN_PATH}"
         max_attempts = max(1, int(os.getenv("TS_AUTH_MAX_ATTEMPTS", "3")))
         base_wait_seconds = max(1, int(os.getenv("TS_AUTH_RETRY_WAIT_SECONDS", "5")))
 
@@ -422,11 +439,7 @@ class ThoughtSpotDeployer:
 
                 response = self.session.post(
                     auth_url,
-                    json={
-                        "username": self.username,
-                        "secret_key": self.secret_key,
-                        "validity_time_in_sec": 3600  # 1 hour token
-                    },
+                    json=trusted_token_request_body(self.username, self.secret_key),
                     timeout=60,
                 )
 
@@ -434,7 +447,22 @@ class ThoughtSpotDeployer:
                 self.last_auth_status_code = response.status_code
 
                 if response.status_code == 200:
-                    result = response.json()
+                    try:
+                        result = response.json()
+                    except ValueError:
+                        # A 200 that is not JSON is a page, not a token: the
+                        # cluster's standby / wake-up page (sebe, 2026-10-06), a
+                        # proxy or an SSO page. Name it — the bare parse error
+                        # ("Expecting value: line 1 column 1") hid the cause.
+                        # Not retried: none of these clear in seconds.
+                        self.last_auth_error = non_json_auth_error(
+                            self.base_url,
+                            response.status_code,
+                            response.headers.get("content-type", ""),
+                            response.text,
+                        )
+                        print(f"   ❌ {self.last_auth_error}")
+                        return False
                     if 'token' in result:
                         # Use the token as bearer auth
                         self.session.headers['Authorization'] = f'Bearer {result["token"]}'
@@ -467,6 +495,14 @@ class ThoughtSpotDeployer:
 
         return False
 
+    def auth_failure_message(self) -> str:
+        """Why the last trusted-auth login failed, as one actionable sentence:
+        the user, the cluster, and the cause (a missing account as a plain
+        instruction). See thoughtspot_errors.trusted_auth_failure_message."""
+        return trusted_auth_failure_message(
+            self.username, self.base_url, self.last_auth_status_code, self.last_auth_error
+        )
+
     def authenticate_oauth(self, timeout: int = 120) -> bool:
         """
         Authenticate with ThoughtSpot using browser-based SSO (Okta, SAML, etc.)
@@ -2952,7 +2988,11 @@ class ThoughtSpotDeployer:
                         ts_url=self.base_url,
                         username=self.username,
                     )
-                raise Exception("ThoughtSpot authentication failed")
+                # Carry the cause into the run's errors: the bare message is all an
+                # MCP caller saw for a missing account or a cluster in standby
+                # (ISS-22). A missing account is stated as the instruction itself
+                # — who, which cluster, what to do (findings triage, E2).
+                raise Exception(self.auth_failure_message())
             auth_time = time.time() - start_time
             log_progress(f"[OK] Auth complete ({auth_time:.1f}s)")
             if _slog:

thoughtspot_errors.py

@@ -1,4 +1,6 @@
+import json
 from typing import Tuple
+from urllib.parse import urlsplit
 
 
 def friendly_mcp_liveboard_error(raw_error: str) -> Tuple[str, str]:
@@ -76,3 +78,170 @@ def friendly_mcp_liveboard_error(raw_error: str) -> Tuple[str, str]:
         f"Raw MCP error: {raw}",
         "mcp_generation",
     )
+
+
+# --- Trusted-auth login responses (ISS-22) -----------------------------------
+#
+# What ThoughtSpot's answer to a trusted-auth token request
+# (POST /api/rest/2.0/auth/token/full) says about a login, so a failure can name
+# its real cause instead of "ThoughtSpot authentication failed". Shapes seen
+# for real:
+#   no account  HTTP 400, application/json, code 10002, debug
+#               'Invalid parameter values: {"username":"Specified user does not exist."}'
+#               (runs 2a1c7306af2a, b58980440961, 1a69f7ab4c7f; fake-user probes
+#               of secloud and sebe 2026-10-14)
+#   standby     HTTP 200, text/html "ThoughtSpot - Start Instance ... Your instance
+#               entered standby mode ... Complete the verification below to wake
+#               up your instance" (sebe 2026-10-06, runs b22397c2cfb3, c34abed7dddb)
+
+# Outcomes that mean the build's own login WILL fail, so refusing up front loses
+# nothing. Every other outcome lets the build go ahead.
+LOGIN_BLOCKING = frozenset({"no_account", "rejected", "standby"})
+
+_STANDBY_MARKERS = ("start instance", "standby mode")
+
+
+def _json_or_none(text):
+    try:
+        return json.loads(text)
+    except (TypeError, ValueError):
+        return None
+
+
+def _host_of_url(url: str) -> str:
+    return urlsplit(url if "://" in url else f"https://{url}").hostname or url
+
+
+def is_standby_page(text: str) -> bool:
+    """True when a ThoughtSpot response is the cluster's standby / wake-up page."""
+    low = (text or "").lower()
+    return any(marker in low for marker in _STANDBY_MARKERS)
+
+
+def ts_error_reason(text: str) -> str:
+    """The reason inside a ThoughtSpot REST v2 error body; "" if `text` is not one.
+
+    v2 nests it as {"error": {"message": {"debug": {"code": ..., "debug":
+    "[\\"<reason>\\"]"}}}} — the innermost debug is a JSON-encoded list of
+    strings. A body that is an error but not in that shape comes back whole.
+    """
+    body = _json_or_none(text)
+    if not isinstance(body, dict) or not isinstance(body.get("error"), dict):
+        return ""
+    node = body["error"].get("message")
+    while isinstance(node, dict):
+        node = node.get("debug", node.get("message"))
+    if isinstance(node, str):
+        parsed = _json_or_none(node)
+        if isinstance(parsed, list):
+            return "; ".join(str(item) for item in parsed)
+        return node
+    return json.dumps(body["error"])[:300]
+
+
+def classify_trusted_login(status_code: int, content_type: str, text: str) -> Tuple[str, str]:
+    """(outcome, reason) for a trusted-auth token response.
+
+    outcome:
+      ok            200 with a token, or 204 (session cookie) — the login works
+      no_account    ThoughtSpot says the user does not exist
+      rejected      400/401/403 with a ThoughtSpot error body, any other reason
+      standby       the cluster served its standby / wake-up page
+      transient     429 or 5xx — says nothing about the user; worth retrying
+      inconclusive  anything else (a 4xx that is not ThoughtSpot's, a 200 with
+                    no token). Not proof the login fails, so not a refusal.
+    """
+    body = _json_or_none(text)
+    shown_type = content_type or "none"
+    if body is None and is_standby_page(text):
+        return "standby", "the cluster served its 'Start Instance' standby page"
+    if status_code == 429 or status_code >= 500:
+        return "transient", f"HTTP {status_code}"
+    if status_code == 204:
+        return "ok", ""
+    if status_code == 200:
+        if isinstance(body, dict) and "token" in body:
+            return "ok", ""
+        return "inconclusive", f"HTTP 200 without a token (content-type {shown_type})"
+    if status_code in (400, 401, 403) and isinstance(body, dict) and "error" in body:
+        reason = ts_error_reason(text)
+        if "user does not exist" in (text or "").lower():
+            return "no_account", reason
+        return "rejected", reason
+    return "inconclusive", f"HTTP {status_code} (content-type {shown_type})"
+
+
+def no_account_message(owner: str, ts_url: str) -> str:
+    return (
+        f"{owner} has no ThoughtSpot account on {_host_of_url(ts_url)}. Ask a ThoughtSpot "
+        f"admin to add them, or pass ts_url for a cluster where they have one."
+    )
+
+
+def standby_message(ts_url: str) -> str:
+    return (
+        f"{_host_of_url(ts_url)} is in standby. Open {ts_url} in a browser and complete "
+        f"the wake-up check, then retry."
+    )
+
+
+def rejected_login_message(owner: str, ts_url: str, status_code: int, reason: str) -> str:
+    return (
+        f"ThoughtSpot on {_host_of_url(ts_url)} refused a trusted-auth login for {owner} "
+        f"(HTTP {status_code}): {reason}"
+    )
+
+
+def trusted_auth_failure_message(username: str, ts_url: str, status_code, body: str) -> str:
+    """One sentence for a failed trusted-auth login that a person can act on.
+
+    Names the user, the cluster and the cause — a missing account as the plain
+    instruction (no_account_message), a standby cluster as its wake-up
+    instruction, anything else as ThoughtSpot's own reason with the HTTP
+    status. deploy_all raises this, so the run's errors, the MCP result and
+    the Slack "Failed" post all say the same thing instead of the bare
+    "ThoughtSpot authentication failed" four SEs retried against for two days
+    (findings triage 2026-10-15, E2).
+    """
+    body = body or ""
+    status = int(status_code or 0)
+    outcome, reason = classify_trusted_login(status, "", body)
+    # The body alone settles the two cases that have a plain instruction, so a
+    # caller that lost the HTTP status (or recorded the deployer's own standby
+    # sentence instead of the page) still gets the right answer.
+    shown = f" (HTTP {status})" if status else ""
+    if outcome == "no_account" or "user does not exist" in body.lower():
+        # The instruction first — who, which cluster, what to do — then
+        # ThoughtSpot's own words, so the run's errors still grep as an auth
+        # failure and still quote the response.
+        said = ts_error_reason(body) or " ".join(body.split())[:300]
+        http = f", HTTP {status}" if status else ""
+        return (
+            f"{no_account_message(username, ts_url)} "
+            f"(ThoughtSpot authentication failed{http}: {said})"
+        )
+    if outcome == "standby" or is_standby_page(body) or body == standby_message(ts_url):
+        return f"ThoughtSpot authentication failed for {username} on {ts_url}: {standby_message(ts_url)}"
+    if outcome in ("rejected", "transient"):
+        cause = reason or ts_error_reason(body) or " ".join(body.split())[:300]
+    else:
+        cause = ts_error_reason(body) or " ".join(body.split())[:300]
+    return (
+        f"ThoughtSpot authentication failed for {username} on {ts_url}{shown}: "
+        f"{cause or 'no detail recorded'}"
+    )
+
+
+def non_json_auth_error(ts_url: str, status_code: int, content_type: str, text: str) -> str:
+    """The real cause behind a trusted-auth response that should have been JSON.
+
+    Replaces the bare parse error ("Expecting value: line 1 column 1 (char 0)"),
+    which is all the 2026-10-06 sebe standby runs recorded.
+    """
+    if is_standby_page(text):
+        return standby_message(ts_url)
+    snippet = " ".join((text or "").split())[:200]
+    return (
+        f"ThoughtSpot returned a non-JSON response to the trusted-auth token request "
+        f"(HTTP {status_code}, content-type {content_type or 'none'}): {snippet!r}"
+    )