diff --git a/CLAUDE.md b/CLAUDE.md
index cb269871..da8686a1 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -18,7 +18,7 @@ Experimental package — breaking all the time and loving the learning curve. St
 **Facts not worth re-deriving:**
 - **One run_uid, more than one link SHA.** In `log`, 239 groups stamp `ee21eb13` and KITR and UPET `a17e9177`, the fix for the two bugs that failed them, re-run on m1 under the same run_uid. In `log_recompute`, all 241 stamp `a17e9177`, so the shipped `streams_access` / `streams_mapping_code` were written at it. UPET was recomputed again after `91a968ab` (the mapping-code fix, below), from a clean tree at `eb93f343`; one stray row between those is `link_dirty` TRUE (an uncommitted review file), and the clean re-run follows it.
 - **The driver read completeness from log text, and it missed 18 finished groups that way** (#347): an R warning put the `done` marker mid-line, the driver consolidated only what it counted, and its burn would have destroyed the rest; the operator held it with `kill -STOP` and consolidated by hand. Since #347 the count is each host's database, a cypher is held from dispatch until no `streams` rows are left on it after consolidate, and a kept host is listed in `<TS>_kept_hosts.tsv` (RUNBOOK §8d, "Which host may be burned").
-- **A failed group with no earlier rows skips the recompute for every group** (#348): the coverage gate exits before it. A failed group that still has an earlier run's rows passes the gate, and its stale rows go unnoticed there.
+- **A failed group no longer skips the recompute for every group** (#348). Until then the coverage gate exited before the recompute, and a failed group holding an earlier run's rows passed it unnoticed. Coverage now reads which groups have rows from a build this run finished, the recompute and compare run over those, and the rest are named with a non-zero exit. `--recompute-only --run-uid=<uid>` finishes a run once they are re-modelled under that uid (RUNBOOK §8d, "A missing group costs only itself").
 - **The recompute takes 154 min at 241 groups and `-j4`** (median 2.0 min per group, longest 16 min), not the ~1 h the plan assumed.
 - **A present species with no barrier in a group is accessible** (`access_<sp>` 1 or 2) **and has `has_barriers_<sp>_dnstr` FALSE**, so its mapping code is built. Zero barrier rows mean NA ("no data") only when nothing says the species is present. Before `91a968ab` the flag stayed NA and UPET RB shipped with `mapping_code_rb` "" on every segment; UPET RB is the only such case in the 241.
 - **`fresh_default` is 31 GB** (14 GB tables, 17 GB indexes; 11.39 M segments), up from 7.3 GB. Summing `pg_total_relation_size()` over every `pg_class` row counts each index twice (48 GB). The fwapg volume is 600 GiB with 253 G free after the run.
diff --git a/RUNBOOK.md b/RUNBOOK.md
index 5f8cf83d..55e16afd 100644
--- a/RUNBOOK.md
+++ b/RUNBOOK.md
@@ -1209,11 +1209,85 @@ that DELETE, so a group's log history survives it; link#354.) So:
 - before consolidate, every host must account for its whole bucket, read from
   its **database**: `<schema>.log` rows for the run_uid with `date_end` set,
   plus `SKIP` markers from the log, which write no row (link#347);
-- after consolidate, every run WSG must have rows in `<persist>.streams`.
+- after consolidate, every run WSG must have rows in `<persist>.streams` from a
+  build **this run finished**.
 
 The second is detection rather than prevention, and it is the one that would
 have caught link#246 on day one regardless of cause.
 
+### A missing group costs only itself (link#348)
+
+The coverage check used to `exit 1` on the first run group with no rows,
+before the recompute. One failed group then left every other group's access
+computed against an incomplete barrier set, with no recompute rows at all.
+It also asked only whether rows existed, so a failed group holding an earlier
+run's rows passed and was recomputed as this run's.
+
+Now `run_coverage` (`data-raw/study_area_finish.sh`) splits the run's groups
+(every bucket, less SKIPs) into four classes, read on the dispatcher after
+consolidate:
+
+| class | rows in `streams` | finished this run | what happens |
+|---|---|---|---|
+| recompute | yes | yes | recomputed and compared |
+| no rows | no | no | named at the end |
+| earlier or partial | yes | no | named; its rows are left as they are |
+| lost at consolidate | no | yes | named |
+
+"Finished this run" means the group's **newest** `<schema>.log` row (max
+`date_start`, the rule `schema_consolidate.R` uses for which build a group's
+persist rows hold) is the run_uid's and has `date_end` set. Consolidate
+copies a group's log rows home (link#354), and the driver adds the
+dispatcher's `done` markers and each cypher's consolidated bucket. A failed
+build leaves its row open (`.lnk_log_run_fail` sets only `notes`), and its
+pre-persist can leave `streams` rows, so rows alone do not make a group
+"this run's". "Newest" matters for a `--recompute-only` days later: a group a
+later run rebuilt, or a hand re-run under the same uid that failed after its
+pre-persist, has a closed row for the uid that no longer names its rows. The
+classes are written to `<TS>_coverage.tsv`, beside the compare CSV, which
+covers the first class only. The recompute and the compare run over the first class only. If
+that class is empty, neither runs and the report says why. Any other class
+makes the run exit non-zero, and the report names the groups and the recovery:
+
+```bash
+LNK_RUN_UID=<uid> [LNK_RUN_LABEL=<label>] LNK_SCHEMA=<schema> \
+  LNK_GUARD_DOWNSTREAM=warn LNK_LOAD=loadall \
+  Rscript data-raw/wsg_run_one.R <WSG> <config>          # each missing group
+bash data-raw/study_area_run.sh --recompute-only --run-uid=<uid> \
+  --config=<config> --schema=<schema> [--run-label=<label>] [--wsgs=<the run's groups>]
+```
+
+`--recompute-only` runs the driver's tail and nothing else: no droplet, no
+pre-flight, no consolidate. It recomputes every group of the run, not just
+the re-modelled ones, because a re-modelled group's barriers change access
+upstream of it. Without `--wsgs=`, the expected set is the groups with any log row
+for the run_uid on the dispatcher. A group that failed on a cloud host and was
+never re-run here has no such row, so only `--wsgs=` gets it named. A
+`--wsgs=` that leaves out logged groups warns. It refuses a `--config` other
+than the one the run's log rows name, since a forgotten `--config` would
+recompute every group under `bcfishpass` and stamp the rows with the run's
+uid. It skips the discharge resolution as well as the pre-flight, but still
+checks for `fresh.streams_vw_bcfp`, which the compare reads.
+
+It also cannot rescue a group whose build finished but whose `date_end`
+UPDATE failed (`.lnk_log_run_finish` is soft). A full run counts that group
+through its `done` marker, but `--recompute-only` has only the log, so it
+reports the group as "earlier or partial" every time. Re-model it.
+A missing group in a kept host's bucket is listed apart in the report, which
+defers to `kept_hosts.tsv`: settle it there first (consolidate only `groups`
+where `groups_measured` is `yes`, never `groups_partial`), and re-model only
+what is still missing. `--recompute-only` warns when a `kept_hosts.tsv` names
+the run_uid.
+
+Two things it does not do. It takes no lock, so do not run it while another
+driver on the same schema can resume: a driver paused with `kill -STOP`, as in
+#347's recovery, would run a second barrier-view build and pool on the schema.
+And `study_area_verify.sql` stays red for a group whose failed attempt left an
+open log row **on the dispatcher**. That row is never closed, so verify reports
+the group as started and never finished, even after the re-run succeeds. In
+#246 the open rows were on the cloud hosts, so it did not show.
+Tests: `tests/testthat/test-study_area_finish.R`, on a scratch schema.
+
 ### Which host may be burned (link#347)
 
 The count used to be `[wsg_run_one] … done` lines, anchored at line start. R
@@ -1288,8 +1362,8 @@ older build. A group with persist rows but **no** log row on the dispatcher
 no longer holds it, not replaced. Where it says `no`, find out what is left first. If the
 run's recompute ran, it ran without the kept groups: recompute each one and
 each run group upstream of it (`wsg_recompute_one.R`). If it did not run
-(consolidate failed, coverage FATAL), recompute every group of the run; the
-banner says which. A missing
+(consolidate failed, or no run group had rows from this run), recompute every
+group of the run; the banner says which. A missing
 `<schema>.streams` or `streams_mapping_code` on a host reads as unknown, not
 empty: every dispatched cypher has both. Tests: `tests/testthat/test-study_area_hosts.R` runs the lib
 in bash with stubbed ssh, psql, tofu and doctl.
diff --git a/data-raw/study_area_finish.sh b/data-raw/study_area_finish.sh
new file mode 100644
index 00000000..b995bbce
--- /dev/null
+++ b/data-raw/study_area_finish.sh
@@ -0,0 +1,466 @@
+# data-raw/study_area_finish.sh — finishing a run once its groups are on the
+# dispatcher: which groups have rows from this run, the post-consolidate
+# recompute over those, the compare, and the final report (link#348). Sourced
+# by study_area_run.sh after study_area_hosts.sh, and by
+# tests/testthat/test-study_area_finish.R. Sourcing defines functions and
+# declares CY_BUCKET_DONE (re-declaring keeps its contents), nothing else.
+#
+# The rule (link#348): one failed group does not cost the others their
+# recompute. Coverage used to `exit 1` on the first run group with no
+# <schema>.streams rows, before the recompute, so one failure left every other
+# group's access computed against an incomplete barrier set. It also asked
+# only "are there rows", so a failed group holding an EARLIER run's rows
+# passed and was recomputed as if it were this run's.
+#
+# Now coverage splits the run's groups by what the dispatcher's database says
+# about THIS run_uid, and the recompute and compare run over the groups whose
+# rows a build of this run wrote. The rest are named at the end and the run
+# exits non-zero; their rows, earlier or partial, are left as they are.
+#
+# Globals read: SCHEMA RUN_UID CONFIG TS LOG_DIR REPO_ROOT RECOMPUTE_JOBS
+#   RUN_INCOMPLETE RECOMPUTE_FAIL RECOMPUTE_FAIL_STAGE (initialised by the
+#   driver); with a default: KEPT_CAUSE_N RUN_LABEL KEPT_TSV_GROUPS; run_expected_from_hosts
+#   also reads DISP_BUCKET CY_WS_ARR CY_BUCKET CY_BUCKET_DONE ACC_FINISHED
+#   ACC_DONE_LOG ACC_SKIP
+# Functions read: .hosts_query host_finished .hosts_* (study_area_hosts.sh);
+#   csv_count recompute_order run_recompute_pool (study_area_run.sh)
+# Globals written: COV_STATE COV_RECOMPUTE COV_NOROWS COV_STALE COV_LOST
+#   COV_MISSING RUN_WSGS ALL_WSGS COMPARE_CSV COMPARE_FAIL RUN_INCOMPLETE
+#   RECOMPUTE_FAIL RECOMPUTE_FAIL_STAGE RECOMPUTE_RAN; run_expected_from_hosts
+#   writes RUN_EXPECT RUN_SIGNALS RUN_SKIP
+#
+# Needs bash >= 4, as the driver does.
+
+declare -A CY_BUCKET_DONE
+
+# run_expected_from_hosts: what a full run expects, and what it already knows
+# finished, from the per-host accounting (study_area_hosts.sh). Sets:
+#   RUN_EXPECT   every host's bucket, less RUN_SKIP;
+#   RUN_SKIP     groups a host SKIPped (no modelled species: wsg_run_one.R
+#                writes no row for them) and no host finished. Buckets come
+#                from the same species filter, so one here means a host's
+#                config or overrides disagree with the dispatcher's: a WARN;
+#   RUN_SIGNALS  finish signals beyond the dispatcher's log rows: its `done`
+#                markers and each cypher's consolidated bucket (database ∪
+#                log done), which is what consolidate took. They only add.
+run_expected_from_hosts() {
+  local ws all skip
+  all="${DISP_BUCKET:-}"
+  skip="${ACC_SKIP[dispatcher]:-}"
+  RUN_SIGNALS=$(.hosts_union "${ACC_FINISHED[dispatcher]:-}" "${ACC_DONE_LOG[dispatcher]:-}")
+  for ws in "${CY_WS_ARR[@]}"; do
+    all=$(.hosts_union "$all" "${CY_BUCKET[$ws]:-}")
+    skip=$(.hosts_union "$skip" "${ACC_SKIP[$ws]:-}")
+    RUN_SIGNALS=$(.hosts_union "$RUN_SIGNALS" "${CY_BUCKET_DONE[$ws]:-}")
+  done
+  RUN_SKIP=$(.hosts_minus "$skip" "$RUN_SIGNALS")
+  RUN_EXPECT=$(.hosts_minus "$all" "$RUN_SKIP")
+  [ -z "$RUN_SKIP" ] || \
+    echo "  WARN: SKIPped by a host (no modelled species) though its bucket expected them; not expected to have rows: $RUN_SKIP"
+  return 0
+}
+
+# run_config_check: the run's log rows on the dispatcher name exactly one
+# config, and it is $CONFIG. --recompute-only with a forgotten --config would
+# otherwise recompute every group under another bundle and stamp the rows with
+# the run's uid. Returns 1, saying why, otherwise.
+run_config_check() {
+  local out
+  out=$(PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d fwapg \
+    -X -q -t -A -v ON_ERROR_STOP=1 -c "
+    SELECT coalesce(string_agg(DISTINCT coalesce(config_name, '<none>'), ','
+                               ORDER BY coalesce(config_name, '<none>')), '')
+    FROM ${SCHEMA}.log WHERE run_uid = '${RUN_UID}'" 2>/dev/null) || {
+    echo "  ✗ could not read config_name from $SCHEMA.log"; return 1; }
+  if [ "$out" = "$CONFIG" ]; then
+    echo "  ✓ run_uid $RUN_UID was built with --config=$CONFIG"
+    return 0
+  fi
+  echo "  ✗ run_uid $RUN_UID was built with config '${out:-<no log rows>}', not --config=$CONFIG"
+  return 1
+}
+
+# run_coverage <expected csv> [signals csv]: split the expected groups by what
+# the dispatcher's database holds for this run.
+#
+#   COV_RECOMPUTE  rows in <schema>.streams, and finished this run: the
+#                  group's NEWEST log row (max date_start, the rule
+#                  schema_consolidate.R uses for which build the persist rows
+#                  hold) is RUN_UID's and has date_end set, or the driver
+#                  passes a signal (a host's `done` marker, a consolidated
+#                  bucket). The log's date_end is a soft UPDATE that can fail
+#                  (.lnk_log_run_finish), so signals only ever add. Newest,
+#                  not any: a group a later run rebuilt, or a hand re-run under
+#                  this uid that failed after its pre-persist, holds rows that
+#                  are not this run's finished build.
+#   COV_NOROWS     no rows at all.
+#   COV_STALE      rows, but no finish signal of this run: an earlier run's
+#                  rows, or this run's pre-persist of a build that then failed.
+#   COV_LOST       finished this run, no rows here: consolidate lost them.
+#
+# Returns 1, with COV_STATE=unknown and every set empty, when the database
+# does not answer or has no <schema>.streams (strict, as the hosts are): an
+# unknown must never read as "nothing has rows".
+run_coverage() {
+  local expected signals in rows closed fin
+  expected=$(.hosts_union "${1:-}")
+  signals="${2:-}"
+  COV_STATE=unknown
+  COV_RECOMPUTE=""; COV_NOROWS=""; COV_STALE=""; COV_LOST=""; COV_MISSING=""
+  in=$(.hosts_lines "$expected" | sed "s/.*/'&'/" | paste -sd, -)
+  rows=$(.hosts_query local streams "watershed_group_code IN (${in:-NULL})" 1) \
+    || return 1
+  closed=$(.hosts_query local log "run_uid = '${RUN_UID}' AND date_end IS NOT NULL
+    AND (watershed_group_code, date_start) IN (
+      SELECT watershed_group_code, max(date_start) FROM ${SCHEMA}.log
+      GROUP BY watershed_group_code)") || return 1
+  COV_STATE=known
+  rows=$(printf '%s\n' "$rows" | .hosts_csv)
+  fin=$(.hosts_union "$(printf '%s\n' "$closed" | .hosts_csv)" "$signals")
+  fin=$(.hosts_inter "$fin" "$expected")
+  COV_RECOMPUTE=$(.hosts_inter "$rows" "$fin")
+  COV_LOST=$(.hosts_minus "$fin" "$rows")
+  COV_STALE=$(.hosts_minus "$rows" "$fin")
+  COV_NOROWS=$(.hosts_minus "$(.hosts_minus "$expected" "$rows")" "$COV_LOST")
+  COV_MISSING=$(.hosts_union "$COV_NOROWS" "$COV_STALE" "$COV_LOST")
+  echo "  $(.hosts_n "$COV_RECOMPUTE")/$(.hosts_n "$expected") run WSGs have rows from a build this run finished"
+  [ -z "$COV_NOROWS" ] || echo "  ✗ no rows in $SCHEMA.streams: $COV_NOROWS"
+  [ -z "$COV_STALE" ]  || echo "  ✗ rows NOT from a build this run finished (an earlier run's, or this run's partial build): $COV_STALE"
+  [ -z "$COV_LOST" ]   || echo "  ✗ finished this run, but no rows in $SCHEMA.streams (lost at consolidate): $COV_LOST"
+  return 0
+}
+
+# run_expected_from_log: the groups with ANY <schema>.log row for RUN_UID on
+# the dispatcher, open or closed, as CSV. The --recompute-only expected set
+# when --wsgs= is not given. A group that failed on a cloud host and was never
+# re-run here has no row here (consolidate copies finished groups only), so it
+# cannot be seen this way. Strict: a missing log table returns 1.
+run_expected_from_log() {
+  local out
+  out=$(.hosts_query local log "run_uid = '${RUN_UID}'" 1) || return 1
+  printf '%s\n' "$out" | .hosts_csv
+}
+
+# run_finish <expected csv> [signals csv]: coverage, recompute, compare and the
+# final report. EXITS the shell on an incomplete or failed run, as the driver
+# always has, and returns 0 only for a complete one. Call it bare: under
+# `set -e`, a function called in an `if` or `||` runs with errexit off.
+run_finish() {
+  RUN_WSGS=$(.hosts_union "${1:-}")
+  local signals="${2:-}" w
+  COMPARE_CSV="$LOG_DIR/${TS}_compare.csv"
+  COMPARE_FAIL=0
+
+  # --- coverage post-condition (link#246, link#348) -------------------------
+  # Detection rather than prevention: this fires whatever the cause. In a full
+  # run it sits AFTER the burn so a failure cannot leak spend, and BEFORE the
+  # recompute so the recompute covers only what this run built.
+  #
+  # Necessary because schema_consolidate DELETEs the destination bucket from
+  # every persist table (its step 3.5) and then COPYs (step 4). A source that
+  # produced nothing therefore removes the destination's prior rows for those
+  # WSGs and still returns ok = TRUE (COV_LOST). The log tables keep their
+  # rows (#354), so rows are read from streams and finishing from the log.
+  #
+  # A gap no longer exits here (link#348): it would take every other group's
+  # recompute with it. It is named at the end, with an exit status to match.
+  echo "=== verify WSG coverage in $SCHEMA (run_uid $RUN_UID) ==="
+  if ! run_coverage "$RUN_WSGS" "$signals"; then
+    echo "FATAL: could not verify WSG coverage in $SCHEMA"; exit 1
+  fi
+  # One row per run group and its class: the compare CSV covers only the
+  # first class, so this is what says what it leaves out.
+  {
+    printf 'wsg\tclass\n'
+    for w in $(.hosts_lines "$COV_RECOMPUTE"); do printf '%s\trecompute\n' "$w"; done
+    for w in $(.hosts_lines "$COV_NOROWS"); do printf '%s\tno_rows\n' "$w"; done
+    for w in $(.hosts_lines "$COV_STALE"); do printf '%s\tnot_this_run\n' "$w"; done
+    for w in $(.hosts_lines "$COV_LOST"); do printf '%s\tlost_at_consolidate\n' "$w"; done
+  } > "$LOG_DIR/${TS}_coverage.tsv"
+  echo "  classes: $LOG_DIR/${TS}_coverage.tsv"
+  if [ -n "$COV_MISSING" ]; then
+    RUN_INCOMPLETE=1
+    echo "  NOTE: recomputing only the $(.hosts_n "$COV_RECOMPUTE") WSGs above; the rest keep"
+    echo "        whatever rows they hold, and the run will exit non-zero."
+  fi
+  ALL_WSGS="$COV_RECOMPUTE"
+
+  if [ -z "$ALL_WSGS" ]; then
+    echo "=== post-consolidate recompute: SKIPPED ==="
+    echo "  No run group has rows from a build this run finished, so there is"
+    echo "  nothing the recompute could settle and nothing valid to compare."
+  else
+    run_finish_recompute
+    run_finish_compare
+  fi
+  run_finish_report
+}
+
+# --- post-consolidate recompute: settle cross-WSG access (link#205) ---
+# Drainage-closed + DS-first per-host is NOT sufficient: a WSG's downstream
+# barriers can be cross-bucket or arrive late in DS-first order, so its access
+# (hence token1/token2) is computed against an incomplete barrier set.
+# Caught 2026-05-25: FINA 75% / PARA 69% per-host -> both 99% only after
+# re-modelling on the full consolidated barrier set. The recompute is the
+# correctness guarantee REGARDLESS of bucketing. We use lnk_access(merge=TRUE)
+# — the cheap access-only recompute that reuses the persisted streams /
+# habitat / barriers / barrier_overrides (link#205, ~10 s/WSG vs ~1.5 min for
+# a full pipeline rebuild). Because it is cheap, we recompute ALL run WSGs
+# this run built unconditionally rather than threshold-filtering by parity —
+# bucketing is now a speed knob, not a correctness lever.
+#
+# Parallel since link#250. Two things previously made the serial loop
+# mandatory, and both are now gone:
+#
+#   1. lnk_access() rebuilt the SCHEMA-scoped barrier views on every call --
+#      38 DDL statements against names every sibling WSG reads. CREATE OR
+#      REPLACE VIEW takes an AccessExclusiveLock, and a QUEUED exclusive
+#      request blocks every AccessShareLock behind it, so one job's DDL would
+#      stall every sibling's read until lock_timeout killed someone. The build
+#      is now hoisted below and each job runs LNK_VIEWS_PREBUILT=1. Everything
+#      else a job touches is WSG-scoped (zz_lnk_streams_<wsg>,
+#      zz_lnk_access_scratch_<wsg>, zz_lnk_mc_scratch_<wsg>) or row-scoped
+#      (UPDATE ... WHERE watershed_group_code; DELETE+INSERT in a transaction).
+#
+#   2. A failed WSG was invisible. `|| echo` sat INSIDE the loop, so the
+#      subshell always exited 0 and the success line below was unconditional;
+#      RUN_INCOMPLETE is assigned BEFORE this block and nothing after raised
+#      it. A run in which every recompute failed exited 0 and wrote a compare
+#      CSV. The .rc files + lnk_fanout_judge() are what fix that.
+run_finish_recompute() {
+  RECOMPUTE_LOG="$LOG_DIR/${TS}_recompute.log"
+  RC_DIR="$LOG_DIR/${TS}_recompute.d"
+  RC_TSV="$LOG_DIR/${TS}_recompute.tsv"
+  N_RECOMPUTE=$(csv_count "$ALL_WSGS")
+
+  echo "=== post-consolidate recompute (lnk_access, ${N_RECOMPUTE} WSGs, -j${RECOMPUTE_JOBS}) ==="
+
+  # Ensure the log tables exist ONCE, single-threaded, before any job starts
+  # (link#262). wsg_recompute_one.R deliberately refuses to run DDL — it runs
+  # inside this pool, and schema DDL belongs at init, not in N concurrent jobs.
+  # That leaves one edge case with the worst possible timing: if every focal WSG
+  # on the dispatcher species-skips (wsg_run_one.R exits 0 without calling
+  # lnk_pipeline_run), nothing ever creates log_recompute, and the pool would
+  # then hard-stop on all N WSGs — at the end of a paid multi-host run, after
+  # consolidate. One idempotent call here removes the class for nothing.
+  if ( cd "$REPO_ROOT" && LNK_LOAD=loadall Rscript -e '
+suppressPackageStartupMessages(pkgload::load_all(quiet = TRUE))
+cfg <- lnk_config(commandArgs(TRUE)[1])
+s <- Sys.getenv("LNK_SCHEMA"); if (nzchar(s)) cfg$pipeline$schema <- s
+conn <- lnk_db_conn(dbname = "fwapg", host = "localhost", port = 5432L,
+                    user = "postgres", password = "postgres")
+on.exit(try(DBI::dbDisconnect(conn), silent = TRUE), add = TRUE)
+link:::.lnk_log_create_tables(conn, cfg$pipeline$schema)
+' "$CONFIG" ) > "$LOG_DIR/${TS}_recompute_logtables.log" 2>&1; then
+    echo "  ✓ log tables present in $SCHEMA"
+  else
+    echo "  ✗ could not ensure log tables; see $LOG_DIR/${TS}_recompute_logtables.log"
+    echo "    the recompute would fail per-WSG on a missing log_recompute"
+    RECOMPUTE_FAIL=1
+    # Its OWN stage token. Reusing "views" made the final gate print "the barrier
+    # views could not be built" and point at ${TS}_recompute_views.log -- a file
+    # the views step never wrote, because it is gated on RECOMPUTE_FAIL=0 and
+    # never ran. Two prep steps, two names, two pieces of evidence.
+    RECOMPUTE_FAIL_STAGE="logtables"
+  fi
+
+  # Build the barrier views ONCE, single-threaded, before any job starts.
+  # Nested rather than `[ "$RECOMPUTE_FAIL" = "0" ] && ( build )`: with the
+  # short-circuit form, an already-failed log-table step would fall into this
+  # else and report "barrier view build failed", naming a log file that was
+  # never written. Two prep steps, two diagnoses.
+  if [ "$RECOMPUTE_FAIL" = "0" ]; then
+    if ( cd "$REPO_ROOT" && LNK_LOAD=loadall \
+           Rscript data-raw/barriers_views_build.R "$CONFIG" ) \
+         > "$LOG_DIR/${TS}_recompute_views.log" 2>&1; then
+      echo "  ✓ barrier views built once for $SCHEMA"
+    else
+      # Deliberately NOT falling back to per-WSG builds. At -j>1 that is exactly
+      # the race the hoist removes, and it would turn one loud pre-build failure
+      # into N quiet lock_timeouts attributed to individual WSGs.
+      echo "  ✗ barrier view build failed; see $LOG_DIR/${TS}_recompute_views.log"
+      echo "    skipping the recompute — the run will exit non-zero"
+      RECOMPUTE_FAIL=1
+      # Which stage failed decides which evidence exists. The pool never ran, so
+      # RECOMPUTE_LOG and RC_TSV were never created -- naming them at the final
+      # gate would send the operator to two absent files.
+      RECOMPUTE_FAIL_STAGE="views"
+    fi
+  fi
+
+  if [ "$RECOMPUTE_FAIL" = "0" ]; then
+    rm -rf "$RC_DIR"; mkdir -p "$RC_DIR"
+    # Longest-first. Ordering is the CALLER's business -- run_recompute_pool
+    # consumes ALL_WSGS as given, which keeps it testable by pool_probe.sh and
+    # lets recompute_parity.sh shuffle deliberately for its invariance pass.
+    ALL_WSGS=$(recompute_order "$ALL_WSGS" | paste -sd, -)
+    run_recompute_pool "$RECOMPUTE_JOBS"
+    # Read by the kept-hosts report: whether a recovery must recompute only the
+    # kept groups and those upstream, or every group of the run (link#347).
+    RECOMPUTE_RAN=1
+
+    # Never `cat "$RC_DIR"/*` — ARG_MAX at provincial scope. `find -exec ... +`
+    # also exits 0 on zero matches, leaving an EMPTY tsv rather than aborting;
+    # that empty case is a real branch and is judged in R, not here.
+    : > "$RC_TSV"
+    find "$RC_DIR" -maxdepth 1 -name '*.rc'  -exec cat {} + >> "$RC_TSV"
+    : > "$RECOMPUTE_LOG"
+    find "$RC_DIR" -maxdepth 1 -name '*.log' -exec cat {} + >> "$RECOMPUTE_LOG"
+
+    if ( cd "$REPO_ROOT" && LNK_LOAD=loadall \
+           Rscript data-raw/fanout_judge.R "$RC_TSV" "$ALL_WSGS" recompute ); then
+      echo "  ✓ recompute: ${N_RECOMPUTE}/${N_RECOMPUTE} WSGs"
+      rm -rf "$RC_DIR"
+    else
+      echo "  ✗ recompute incomplete; see $RECOMPUTE_LOG and $RC_DIR/"
+      RECOMPUTE_FAIL_STAGE="pool"
+      # Per-job logs KEPT on failure: the concatenation is the artifact, the
+      # per-job files are what you actually grep.
+      RECOMPUTE_FAIL=1
+    fi
+  fi
+}
+
+# --- compare (tunnel-free) -> CSV ---
+# Over the recomputed groups only: a group this run did not build has nothing
+# of this run's to compare (link#348). A failure no longer exits here: it
+# would hide the report, which names the groups that are missing.
+run_finish_compare() {
+  echo "=== compare (tunnel-free) ==="
+  if ( cd "$REPO_ROOT" && LNK_LOAD=loadall Rscript data-raw/study_area_compare.R \
+      "$COMPARE_CSV" "$ALL_WSGS" "$CONFIG" ) > "$LOG_DIR/${TS}_compare.log" 2>&1; then
+    echo "  ✓ compare CSV: $COMPARE_CSV"
+  else
+    echo "  ✗ compare failed; see $LOG_DIR/${TS}_compare.log"
+    COMPARE_FAIL=1
+  fi
+}
+
+run_finish_report() {
+  echo "=== summary ==="
+  echo "  run WSGs:        ${RUN_WSGS:-<none>}"
+  echo "  recomputed WSGs: ${ALL_WSGS:-<none>}"
+  if [ -n "$ALL_WSGS" ] && [ "${COMPARE_FAIL:-0}" = "0" ]; then
+    echo "  compare CSV: $COMPARE_CSV"
+    tail -40 "$LOG_DIR/${TS}_compare.log" || true
+  fi
+
+  # An incomplete run must not exit 0. The failure is reported HERE rather than
+  # at the point of detection so that everything already computed is
+  # consolidated, recomputed, compared and written out first — the operator gets
+  # the artifacts AND an accurate exit status, instead of one at the cost of the
+  # other. A caller that only checks the exit code still learns the truth.
+  # Two independent causes, reported separately. Merging them into one flag
+  # would print "some host did not account for its bucket" over a recompute
+  # failure, which is the wrong diagnosis and sends the operator to the wrong
+  # host. They are also different KINDS of failure: an incomplete bucket means
+  # output is missing, an incomplete recompute means output is silently WRONG.
+  # A third cause (link#347): a cypher still up because it may hold work that
+  # was not consolidated, or whose burn did not complete. --keep-cyphers alone is
+  # a choice, not a failure; a host it keeps that is ALSO held for cause still
+  # counts, so the flag cannot turn an unconsolidated host into an exit 0.
+  local hosts_kept=0
+  [ "${KEPT_CAUSE_N:-0}" -gt 0 ] && hosts_kept=1
+  if [ "${RUN_INCOMPLETE:-0}" != "0" ] || [ "${RECOMPUTE_FAIL:-0}" != "0" ] \
+     || [ "$hosts_kept" != "0" ] || [ "${COMPARE_FAIL:-0}" != "0" ]; then
+    echo "=== study_area_run INCOMPLETE ==="
+    if [ "$hosts_kept" != "0" ]; then
+      echo "  $KEPT_CAUSE_N cypher(s) were NOT burned for cause: each may hold groups"
+      echo "  that are not on the dispatcher, and is still running and billed."
+      echo "  Consolidate only each host's groups column, and only where"
+      echo "  groups_measured = yes; never groups_partial (consolidating a group the"
+      echo "  host no longer holds, or holds in part, deletes the dispatcher's copy)."
+      if [ "${RECOMPUTE_RAN:-0}" = "1" ]; then
+        echo "  The recompute above ran WITHOUT those groups, so recompute each one and"
+        echo "  each run group upstream of it afterwards. Then burn the host."
+      else
+        echo "  The recompute did not run, so recompute every group of the run"
+        echo "  afterwards. Then burn the host."
+      fi
+      echo "  Every group of the run, once consolidated:"
+      echo "    bash data-raw/study_area_run.sh --recompute-only --run-uid=$RUN_UID \\"
+      echo "      --config=$CONFIG --schema=$SCHEMA${RUN_LABEL:+ --run-label=$RUN_LABEL} --wsgs=$RUN_WSGS"
+      echo "  Hosts, reasons and commands: $LOG_DIR/${TS}_kept_hosts.tsv"
+    fi
+    if [ "${RUN_INCOMPLETE:-0}" != "0" ]; then
+      if [ -n "${COV_MISSING:-}" ]; then
+        echo "  These run WSGs have no rows from a build this run finished, so they"
+        echo "  were NOT recomputed or compared: $COV_MISSING"
+        [ -z "${COV_NOROWS:-}" ] || echo "    no rows:                         $COV_NOROWS"
+        [ -z "${COV_STALE:-}" ]  || echo "    an earlier run's or partial rows: $COV_STALE"
+        [ -z "${COV_LOST:-}" ]   || echo "    lost at consolidate:             $COV_LOST"
+        # A held cypher may hold this run's finished work, unconsolidated. What
+        # to do with each of its groups depends on whether the host could be
+        # measured and whether it was settled, which only hosts_kept_report
+        # knows, and it has written that to kept_hosts.tsv. So this names the
+        # groups in a held host's bucket and defers to that file, rather than
+        # re-deriving its advice from sets whose meaning depends on state it
+        # cannot see (code-check rounds 1-3, #348).
+        local ws held="" on_kept remodel
+        for ws in ${CY_WS_ARR[@]+"${CY_WS_ARR[@]}"}; do
+          if [ "${CY_HOLD[$ws]:-0}" = "1" ]; then
+            held=$(.hosts_union "$held" "${CY_BUCKET[$ws]:-}")
+          fi
+        done
+        # --recompute-only has no hosts of its own; it reads the groups an
+        # earlier session's kept_hosts.tsv listed for this run_uid.
+        held=$(.hosts_union "$held" "${KEPT_TSV_GROUPS:-}")
+        on_kept=$(.hosts_inter "$COV_MISSING" "$held")
+        remodel=$(.hosts_minus "$COV_MISSING" "$held")
+        if [ -n "$on_kept" ]; then
+          echo "  In a kept host's bucket: settle these per ${TS}_kept_hosts.tsv first"
+          echo "  (consolidate only its groups column where groups_measured = yes, never"
+          echo "  groups_partial), and re-model only what is still missing: $on_kept"
+        fi
+        if [ -n "$remodel" ]; then
+          echo "  Re-model each of these under this run_uid: $remodel"
+          # warn, as the driver runs it: a group whose downstream neighbour is
+          # missing too would otherwise stop at the guard (error by default),
+          # and the recompute re-runs it in error mode once all are back.
+          echo "    LNK_RUN_UID=$RUN_UID ${RUN_LABEL:+LNK_RUN_LABEL=$RUN_LABEL }LNK_SCHEMA=$SCHEMA \\"
+          echo "      LNK_GUARD_DOWNSTREAM=warn LNK_LOAD=loadall \\"
+          echo "      Rscript data-raw/wsg_run_one.R <WSG> $CONFIG"
+        fi
+        echo "  Then recompute the whole run (every group: a re-modelled group's"
+        echo "  barriers change access upstream of it):"
+        echo "    bash data-raw/study_area_run.sh --recompute-only --run-uid=$RUN_UID \\"
+        echo "      --config=$CONFIG --schema=$SCHEMA${RUN_LABEL:+ --run-label=$RUN_LABEL} --wsgs=$RUN_WSGS"
+      else
+        # Accounting reads only closed log rows; coverage also counts done
+        # markers and consolidated buckets, and it found every group.
+        echo "  A host's accounting (closed log rows) did not cover its whole bucket,"
+        echo "  but every run WSG has rows from a build this run finished (a done"
+        echo "  marker or a consolidated bucket counted), so the recompute and the"
+        echo "  compare above cover them all. Most likely a log row whose date_end"
+        echo "  was not set; see the per-host completeness lines above."
+      fi
+    fi
+    if [ "${COMPARE_FAIL:-0}" != "0" ]; then
+      echo "  The compare failed (see $LOG_DIR/${TS}_compare.log); the recompute"
+      echo "  above stands. Re-run it alone:"
+      echo "    LNK_SCHEMA=$SCHEMA LNK_LOAD=loadall Rscript data-raw/study_area_compare.R \\"
+      echo "      $COMPARE_CSV ${ALL_WSGS:-<WSGs>} $CONFIG"
+    fi
+    if [ "${RECOMPUTE_FAIL:-0}" != "0" ]; then
+      echo "  The post-consolidate recompute did not complete for every WSG."
+      echo "  Those WSGs' streams_access / streams_mapping_code still hold their"
+      echo "  PRE-consolidate values, so cross-WSG access — hence token1/token2"
+      echo "  and ;DAM — is WRONG for them. This is bad output, not missing"
+      echo "  output: the compare CSV above will look complete."
+      if [ "${RECOMPUTE_FAIL_STAGE:-pool}" = "logtables" ]; then
+        echo "  The provenance log tables could not be created, so NO WSG was"
+        echo "  recomputed. See $LOG_DIR/${TS}_recompute_logtables.log."
+      elif [ "${RECOMPUTE_FAIL_STAGE:-pool}" = "views" ]; then
+        echo "  The barrier views could not be built, so NO WSG was recomputed."
+        echo "  See $LOG_DIR/${TS}_recompute_views.log."
+      else
+        echo "  See $RECOMPUTE_LOG (and ${RC_TSV} for per-WSG exit status)."
+      fi
+      echo "  Re-run just those, no full run needed:"
+      echo "    LNK_RUN_UID=$RUN_UID ${RUN_LABEL:+LNK_RUN_LABEL=$RUN_LABEL }LNK_SCHEMA=$SCHEMA \\"
+      echo "      LNK_LOAD=loadall Rscript data-raw/wsg_recompute_one.R <WSG> $CONFIG"
+    fi
+    exit 1
+  fi
+  echo "=== study_area_run done ==="
+}
diff --git a/data-raw/study_area_hosts.sh b/data-raw/study_area_hosts.sh
index dffccca9..284ef264 100644
--- a/data-raw/study_area_hosts.sh
+++ b/data-raw/study_area_hosts.sh
@@ -534,7 +534,10 @@ hosts_kept_report() {
     echo "  The run's recompute did NOT run: after consolidating, recompute EVERY"
     echo "  group of the run, not only these"
   fi
-  echo "  (LNK_SCHEMA=$SCHEMA LNK_LOAD=loadall Rscript data-raw/wsg_recompute_one.R <WSG> <config>)."
+  echo "  (every group: bash data-raw/study_area_run.sh --recompute-only"
+  echo "   --run-uid=$RUN_UID --config=<config> --schema=$SCHEMA${RUN_LABEL:+ --run-label=$RUN_LABEL}"
+  echo "   --wsgs=<the run's groups>; one group: LNK_RUN_UID=$RUN_UID ${RUN_LABEL:+LNK_RUN_LABEL=$RUN_LABEL }LNK_SCHEMA=$SCHEMA"
+  echo "   LNK_LOAD=loadall Rscript data-raw/wsg_recompute_one.R <WSG> <config>)."
   echo "  Then burn:"
   for ws in "$@"; do echo "    cd $CYPHER_DIR && ./cypher_down.sh --workspace $ws"; done
   echo "  Recorded in $tsv"
diff --git a/data-raw/study_area_run.sh b/data-raw/study_area_run.sh
index 5a751e5f..c68b7b02 100755
--- a/data-raw/study_area_run.sh
+++ b/data-raw/study_area_run.sh
@@ -52,7 +52,9 @@
 #
 # Post-conditions: every host must account for its whole bucket before
 # consolidate (read from its database, not its log), and every run WSG must
-# have rows in the persist afterwards.
+# have rows from a build this run finished in the persist afterwards. A group
+# that does not is named and the run exits non-zero, but the recompute and the
+# compare still run over the rest (link#348; data-raw/study_area_finish.sh).
 #
 # Extra flags:
 #   --preflight-only        run the local gates and exit (no spend)
@@ -77,6 +79,15 @@
 #   --preflight-note="why"  downgrade ONLY vintage + parity to warnings,
 #                           and only with a written reason. There is no
 #                           global bypass on purpose.
+#   --recompute-only --run-uid=<uid> [--wsgs=A,B]
+#                           finish an existing run on the dispatcher: coverage
+#                           for that run_uid, the recompute over every group
+#                           with rows from a finished build of it, the compare
+#                           and the report. No droplet, no pre-flight. For a
+#                           run whose missing groups were re-modelled by hand
+#                           under the same run_uid (link#348). Without --wsgs=
+#                           the expected groups are those with a log row for
+#                           the run_uid on the dispatcher.
 #
 # Run identity (link#262). Three levels, and only the middle one is new:
 #
@@ -132,6 +143,14 @@ RECOMPUTE_JOBS=4
 # at the recompute, so `set -u` cannot bite on any earlier exit path.
 RECOMPUTE_FAIL=0
 RECOMPUTE_FAIL_STAGE=""
+# Set when a run group has no rows from a build this run finished, or a host
+# did not account for its bucket (link#348). Read by the final report.
+RUN_INCOMPLETE=0
+# --recompute-only finishes an EXISTING run: its run_uid, and optionally the
+# run's groups (link#348).
+RECOMPUTE_ONLY=0
+RUN_UID_ARG=""
+WSGS_ARG=""
 FOCAL_ARR=()
 for arg in "$@"; do
   case "$arg" in
@@ -144,6 +163,15 @@ for arg in "$@"; do
     --preflight-only)  PREFLIGHT_ONLY=1 ;;
     --refresh-primitives) REFRESH_PRIMITIVES=1 ;;
     --auto-install)    AUTO_INSTALL=1 ;;
+    --recompute-only)  RECOMPUTE_ONLY=1 ;;
+    # Interpolated into SQL (the coverage and log queries), so the format the
+    # driver mints is the only one accepted.
+    --run-uid=*)       RUN_UID_ARG="${arg#--run-uid=}"
+                       [[ "$RUN_UID_ARG" =~ ^[0-9]{8}_[0-9]{6}-[0-9a-f]{8}$ ]] \
+                         || { echo "FATAL: --run-uid= must look like 20261017_004619-3f4c713b (got '$RUN_UID_ARG')" >&2; exit 1; } ;;
+    --wsgs=*)          WSGS_ARG="${arg#--wsgs=}"
+                       [[ "$WSGS_ARG" =~ ^[A-Z]{4}(,[A-Z]{4})*$ ]] \
+                         || { echo "FATAL: --wsgs= takes comma-separated four-letter group codes (got '$WSGS_ARG')" >&2; exit 1; } ;;
     --prep-ssh-wait=*) PREP_SSH_WAIT_S="${arg#--prep-ssh-wait=}"
                        case "$PREP_SSH_WAIT_S" in
                          ''|*[!0-9]*) echo "FATAL: --prep-ssh-wait= needs a positive integer (got '$PREP_SSH_WAIT_S')" >&2; exit 1 ;;
@@ -203,6 +231,25 @@ for arg in "$@"; do
   esac
 done
 
+# --recompute-only finishes one existing run on the dispatcher, so it needs
+# that run's uid and takes nothing that dispatches. --run-uid and --wsgs
+# without it would be silently ignored, so they are refused instead.
+if [ "$RECOMPUTE_ONLY" = "1" ]; then
+  [ -n "$RUN_UID_ARG" ] || {
+    echo "FATAL: --recompute-only needs --run-uid=<uid> of the run to finish" >&2; exit 1; }
+  if [ "${#FOCAL_ARR[@]}" -gt 0 ] || [ -n "$CY_WS" ] || [ "$PREFLIGHT_ONLY" = "1" ] \
+     || [ "$REFRESH_PRIMITIVES" = "1" ] || [ "$AUTO_INSTALL" = "1" ]; then
+    echo "FATAL: --recompute-only takes no --focal, --cy-workspaces, --preflight-only," >&2
+    echo "  --refresh-primitives or --auto-install: it dispatches nothing." >&2
+    exit 1
+  fi
+else
+  [ -z "$RUN_UID_ARG" ] || {
+    echo "FATAL: --run-uid= is for --recompute-only; a run mints its own" >&2; exit 1; }
+  [ -z "$WSGS_ARG" ] || {
+    echo "FATAL: --wsgs= is for --recompute-only; a run's groups come from --focal" >&2; exit 1; }
+fi
+
 # --config and --schema are interpolated into the cypher ssh command strings
 # inside '...', like --run-label: refuse anything that could close the quote
 # (link#246 code-check).
@@ -215,7 +262,7 @@ done
 # --preflight-only needs no --focal set: it exits before the buckets are
 # resolved, and demanding them would make the cheap dry check as awkward as
 # the real thing.
-if [ "$PREFLIGHT_ONLY" = "0" ]; then
+if [ "$PREFLIGHT_ONLY" = "0" ] && [ "$RECOMPUTE_ONLY" = "0" ]; then
   IFS=',' read -ra CY_WS_ARR <<< "$CY_WS"
   [ -n "$CY_WS" ] || CY_WS_ARR=()
   N_CY=${#CY_WS_ARR[@]}
@@ -288,6 +335,11 @@ export LNK_SCHEMA="$SCHEMA"
 # Where the config reads discharge (link#331): every host needs that table,
 # because prepare joins discharge for every group. The dispatcher's gate
 # checks its own database; cypher_prep loads wet's on each cypher.
+# --recompute-only models nothing and reads no discharge (wsg_recompute_one.R),
+# so it resolves neither and cannot be stopped by them (link#348).
+DISCHARGE=""
+WET_LOAD=""
+if [ "$RECOMPUTE_ONLY" = "0" ]; then
 DISCHARGE=$(cd "$REPO_ROOT" && LNK_LOAD=loadall Rscript -e '
 suppressPackageStartupMessages(pkgload::load_all(quiet = TRUE))
 cat(link:::.lnk_discharge_source(lnk_config(commandArgs(TRUE)[1])))' "$CONFIG" 2>/dev/null || true)
@@ -298,7 +350,6 @@ esac
 # The wet load the dispatcher holds; every cypher must hold the same one
 # (cypher_prep.sh), or hosts classify on different discharge. Empty when the
 # dispatcher has none, which its discharge gate then fails.
-WET_LOAD=""
 if [ "$DISCHARGE" = "wet" ]; then
   WET_LOAD=$(cd "$REPO_ROOT" && LNK_LOAD=loadall Rscript -e '
 suppressPackageStartupMessages(pkgload::load_all(quiet = TRUE))
@@ -315,6 +366,7 @@ if (res$ok) cat(link:::.lnk_discharge_wet_load_id(res$comment))' \
     *"'"*) echo "FATAL: the wet table comment holds a quote: $WET_LOAD"; exit 1 ;;
   esac
 fi
+fi
 
 # --- run identity (link#262) ---
 # Minted ONCE, here, before anything forks. $TS is already the run's own
@@ -327,7 +379,13 @@ fi
 #
 # $RANDOM is fine for that job (collision avoidance within a second, not
 # secrecy). Padded to a fixed width so the ids sort and eyeball consistently.
-RUN_UID="${TS}-$(printf '%04x%04x' "$RANDOM" "$RANDOM")"
+# --recompute-only takes the uid of the run it finishes, so its recompute rows
+# land under that run (link#348).
+if [ "$RECOMPUTE_ONLY" = "1" ]; then
+  RUN_UID="$RUN_UID_ARG"
+else
+  RUN_UID="${TS}-$(printf '%04x%04x' "$RANDOM" "$RANDOM")"
+fi
 export LNK_RUN_UID="$RUN_UID"
 export LNK_RUN_LABEL="$RUN_LABEL"
 
@@ -342,6 +400,7 @@ echo "  log dir:      $LOG_DIR"
 echo "  vintage max:  ${VINTAGE_MAX_DAYS} d"
 echo "  recompute -j: $RECOMPUTE_JOBS"
 [ "$PREFLIGHT_ONLY" = "0" ] || echo "  MODE:         --preflight-only (no spend, no writes)"
+[ "$RECOMPUTE_ONLY" = "0" ] || echo "  MODE:         --recompute-only (finish run_uid $RUN_UID; no spend)"
 [ -z "$PREFLIGHT_NOTE" ] || echo "  OVERRIDE:     vintage+parity downgraded to warnings — $PREFLIGHT_NOTE"
 
 # --- trap: burn cyphers on exit (safety net; explicit burn after consolidate) ---
@@ -352,6 +411,9 @@ echo "  recompute -j: $RECOMPUTE_JOBS"
 # and is listed in ${TS}_kept_hosts.tsv with the command that burns it.
 # shellcheck source=study_area_hosts.sh
 source "$REPO_ROOT/data-raw/study_area_hosts.sh"
+# Coverage, recompute, compare and the final report (link#348).
+# shellcheck source=study_area_finish.sh
+source "$REPO_ROOT/data-raw/study_area_finish.sh"
 CYPHERS_UP=0
 KEPT_N=0
 KEPT_CAUSE_N=0
@@ -398,6 +460,230 @@ on_exit() {
 }
 trap on_exit EXIT
 
+# Split a CSV into lines, dropping blanks. `sed` deleting every line still
+# exits 0, where `grep -v '^$'` exits 1 — and under `set -euo pipefail` that
+# aborts the script from inside a plain assignment. That trap has now bitten
+# this diff twice (cypher_prep's ~/.Renviron filter, then the consolidate
+# bucket builder below), so the safe form lives in one helper rather than
+# being remembered at each call site.
+#
+# `printf '%s\n'`, not `printf '%s'`: without the trailing newline `wc -l`
+# counts separators rather than items and reports one fewer than there is, so
+# a host that completed its whole bucket would be reported incomplete. The
+# empty case still yields 0, because sed drops the resulting blank line.
+csv_lines() { printf '%s\n' "${1:-}" | tr ',' '\n' | sed '/^[[:space:]]*$/d'; }
+csv_count() { csv_lines "${1:-}" | wc -l | tr -d ' '; }
+
+# --- post-consolidate recompute pool (link#250) ----------------------------
+# recompute_one runs ONE WSG and never returns non-zero: the pool must not be
+# able to abort under `set -e`, and the exit status is carried by the .rc file
+# rather than by this function's return.
+#
+# One log per job, not a shared fd. Parallel appends to one file interleave
+# mid-record once a record exceeds the stdio buffer (~64 KB), which a full R
+# traceback comfortably does.
+#
+# The .rc file holds the finished TSV ROW, not a bare number, so collection is
+# one `find -exec cat` with no basename loop. It is also written LAST, so a
+# job killed partway leaves no row and is judged "never reported" rather than
+# silently counted as fine.
+recompute_one() {   # $1 = WSG
+  local w="$1" rc=0
+  ( cd "$REPO_ROOT"
+    LNK_LOAD=loadall LNK_VIEWS_PREBUILT=1 \
+      Rscript data-raw/wsg_recompute_one.R "$w" "$CONFIG"
+  ) > "$RC_DIR/$w.log" 2>&1 || rc=$?
+  [ "$rc" = "0" ] || echo "[WARN] recompute WSG $w failed (rc=$rc; continuing)" \
+    >> "$RC_DIR/$w.log"
+  printf '%s\t%s\n' "$w" "$rc" > "$RC_DIR/$w.rc"
+  return 0
+}
+
+# Order the pool's work list LONGEST-FIRST from previously recorded times.
+#
+# A pool's makespan is bounded below by its slowest single job, so a long job
+# that starts last extends the whole phase. Measured 2026-09-01: CHWK is 226 s
+# against 11 s for SALR, and one WSG was 74% of a four-WSG set. LPT is already
+# this repo's answer for packing components onto hosts (study_area_buckets.R,
+# wsgs_dispatch.sh); this is the same rule one level down, inside one host.
+#
+# Ordered on prior RECOMPUTE times, never on segment count. Segments are a
+# reasonable proxy for modelling work (R^2 0.64 over 104 WSGs) and a bad one
+# here: SALR has 20% MORE segments than CHWK and finishes 20x faster, so a
+# segment ordering would actively run the cheap job first.
+#
+# Times come from previous runs' committed ${TS}_recompute.log files, newest
+# wins. A WSG with no recorded time gets the MEDIAN of those that have one --
+# the same rule study_area_buckets.R uses for a WSG missing from the network
+# table, so an unknown never sorts as free.
+#
+# With NO prior times at all this returns the input order and SAYS SO. The
+# ops-hardening record (planning/archive/2026-05-ops-hardening-20260514) has
+# the precedent: an LPT fallback that silently degraded to a naive split and
+# ignored host speeds went unnoticed across a 217-WSG run.
+recompute_order() {   # $1 = csv of WSGs -> prints WSGs, longest-first
+  local wsgs="$1" tf med n
+  tf=$(mktemp "${TMPDIR:-/tmp}/lnk_rc_times.XXXXXX") || { csv_lines "$wsgs"; return 0; }
+  # sort -r on TS-prefixed names is newest-first; awk keeps the first sighting
+  # of each WSG, so a later run's time wins.
+  find "$LOG_DIR" -maxdepth 1 -name '*_recompute.log' -type f 2>/dev/null \
+    | sort -r \
+    | while IFS= read -r f; do
+        sed -nE 's/^\[wsg_recompute_one\] ([A-Z]{4}) recomputed in ([0-9.]+) min.*/\1 \2/p' "$f"
+      done | awk '!seen[$1]++' > "$tf"
+  n=$(wc -l < "$tf" | tr -d ' ')
+  if [ "${n:-0}" -eq 0 ]; then
+    echo "  note: no prior recompute times in $LOG_DIR — running in input order" >&2
+    rm -f "$tf"; csv_lines "$wsgs"; return 0
+  fi
+  med=$(cut -d' ' -f2 "$tf" | sort -n \
+        | awk '{a[NR]=$1} END{print (NR%2) ? a[(NR+1)/2] : (a[NR/2]+a[NR/2+1])/2}')
+  echo "  ordering ${n} known WSG time(s) longest-first (median ${med} min for the rest)" >&2
+  csv_lines "$wsgs" \
+    | awk -v tf="$tf" -v med="$med" '
+        BEGIN { while ((getline l < tf) > 0) { split(l, a, " "); t[a[1]] = a[2] } }
+        { printf "%s %s\n", ($1 in t ? t[$1] : med), $1 }' \
+    | sort -k1,1nr -k2,2 \
+    | cut -d' ' -f2
+  rm -f "$tf"
+}
+
+# Bounded-width pool. `wait -n` is bash 4.3+ and /bin/bash on macOS is 3.2.57,
+# so a free slot is found by polling liveness with `kill -0` and reaping the
+# finished child with `wait <pid>` (which returns immediately for a child that
+# has already exited). We deliberately do NOT read the rc from `wait`: the .rc
+# file is the single source of truth, which also means the evidence survives a
+# killed dispatcher.
+run_recompute_pool() {   # $1 = width
+  local width="$1" slot pid w all_pids=""
+  local SLOT_PID
+  # Width must be a positive integer or this HANGS rather than failing:
+  # `seq 0 -1` is empty, so the slot scan never runs, `break 2` is
+  # unreachable, and the outer `while :; sleep 1` spins forever.
+  # --recompute-jobs validates its own input, but recompute_parity.sh and
+  # recompute_sweep.sh pass a width straight through, so the guard belongs
+  # HERE where all three callers meet it.
+  #
+  # SHAPE FIRST, then value. `[ abc -lt 1 ]` exits 2 ("integer expression
+  # expected") rather than returning true, so a numeric-only guard treats a
+  # non-numeric width as "condition false", falls through, and hangs -- which
+  # is the exact failure it was written to prevent. Measured: 0 and -1 were
+  # refused while abc and 2x still hung.
+  case "${width:-}" in
+    ''|*[!0-9]*)
+      echo "FATAL: run_recompute_pool needs a positive integer width (got '${width:-}')" >&2
+      return 1 ;;
+  esac
+  # NORMALISE THE BASE ONCE, before anything consumes it. `test` and `case`
+  # read base 10; `$(( ))` reads a leading zero as OCTAL. So "08" passes both
+  # validators and then dies in `$((width - 1))` with "value too great for
+  # base" -> empty seq -> the same hang; and "010" quietly becomes 8, giving
+  # a pool two slots narrower than the operator asked for and than the banner
+  # reports. Three rounds of this bug were three predicates disagreeing about
+  # the grammar; one normalisation ends the class.
+  width=$((10#$width))
+  # Upper bound HERE, not only on the CLI flag. `10#` wraps silently on
+  # overflow -- 10#99999999999999999999 is 7766279631452241919, which passes
+  # the shape check and the >= 1 test and then sends `seq` off for the rest of
+  # the afternoon. --recompute-jobs is saved by its own <= 16, but
+  # recompute_parity.sh and recompute_sweep.sh pass an operator width straight
+  # through, and this function is what all three callers meet.
+  if [ "$width" -lt 1 ] || [ "$width" -gt 64 ]; then
+    echo "FATAL: run_recompute_pool needs 1 <= width <= 64 (got '$width')" >&2
+    return 1
+  fi
+  # Pre-seed every slot. Referencing an unset array element under `set -u` is
+  # an unbound-variable error on bash 3.2.
+  SLOT_PID=()
+  for slot in $(seq 0 $((width - 1))); do SLOT_PID[$slot]=0; done
+
+  for w in $(csv_lines "$ALL_WSGS"); do
+    while :; do
+      for slot in $(seq 0 $((width - 1))); do
+        pid=${SLOT_PID[$slot]}
+        [ "$pid" = "0" ] && break 2
+        if ! kill -0 "$pid" 2>/dev/null; then
+          wait "$pid" 2>/dev/null || true
+          SLOT_PID[$slot]=0
+          break 2
+        fi
+      done
+      sleep 1
+    done
+    recompute_one "$w" &
+    SLOT_PID[$slot]=$!
+    all_pids="$all_pids ${SLOT_PID[$slot]}"
+  done
+  # Drain the last partial wave, waiting on OUR children only.
+  #
+  # A bare `wait` waits for every background job in the calling shell, not
+  # just the ones this pool started -- so it silently couples the pool to
+  # whatever else the caller has backgrounded, and hangs outright if any of
+  # those is long-lived. Measured 2026-09-01: a 2-second sampler loop
+  # backgrounded by data-raw/recompute_sweep.sh wedged the pool indefinitely,
+  # with every job already finished and nothing to show for it.
+  #
+  # An empty WSG list means zero iterations and no pids -- that emptiness is
+  # NOT judged here, it is judged in R by lnk_fanout_judge(), where the
+  # branch can be tested.
+  for pid in $all_pids; do wait "$pid" 2>/dev/null || true; done
+}
+
+# --- --recompute-only: finish a run whose gaps were filled by hand (link#348)
+# A run that ends with groups missing names them; once each is re-modelled
+# under the same run_uid (LNK_RUN_UID=<uid> ... wsg_run_one.R), this runs the
+# rest of a run's tail and nothing else: coverage for that run_uid, the
+# recompute over every group with rows from a finished build of it, the
+# compare and the report. No droplet, no pre-flight (the recompute reads only
+# the persisted tables), no consolidate.
+if [ "$RECOMPUTE_ONLY" = "1" ]; then
+  echo "=== --recompute-only: run_uid $RUN_UID ==="
+  echo "  pre-flight, dispatch and consolidate SKIPPED: this reads only the"
+  echo "  persisted tables in $SCHEMA, and spins up nothing."
+  pg_isready -h localhost -p 5432 >/dev/null 2>&1 \
+    || { echo "FATAL: local fwapg down (:5432)"; exit 1; }
+  # The compare reads the local bcfp snapshot, as in a full run.
+  [ "$(PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d fwapg -t -A -c \
+      "SELECT 1 FROM information_schema.tables WHERE table_schema='fresh' AND table_name='streams_vw_bcfp'" 2>/dev/null || true)" = "1" ] \
+    || { echo "FATAL: fresh.streams_vw_bcfp missing (run snapshot_bcfp.sh --with-bcfp-views)"; exit 1; }
+  run_config_check || { echo "FATAL: refusing to recompute run_uid $RUN_UID under another config"; exit 1; }
+  # A host kept by the run may still hold groups to consolidate; this run
+  # cannot see its state, only the file that recorded it.
+  RO_KEPT=$(grep -l -F "$RUN_UID" "$LOG_DIR"/*_kept_hosts.tsv 2>/dev/null || true)
+  KEPT_TSV_GROUPS=""
+  if [ -n "$RO_KEPT" ]; then
+    echo "  WARN: hosts were kept for this run_uid; settle their groups per these"
+    echo "        files first, and re-model only what is still missing:"
+    printf '        %s\n' $RO_KEPT
+    # groups, groups_partial, groups_unknown of this run's rows: the report
+    # lists those apart from the groups to re-model.
+    KEPT_TSV_GROUPS=$(awk -F'\t' -v u="$RUN_UID" '$4 == u { print $6 "," $7 "," $8 }' \
+      $RO_KEPT | .hosts_csv)
+  fi
+  RO_LOGGED=$(run_expected_from_log) \
+    || { echo "FATAL: could not read $SCHEMA.log"; exit 1; }
+  if [ -n "$WSGS_ARG" ]; then
+    RO_EXPECT=$(csv_lines "$WSGS_ARG" | sort -u | paste -sd, -)
+    echo "  expected WSGs: $(csv_count "$RO_EXPECT"), from --wsgs="
+    # A subset leaves the groups upstream of a re-modelled one on access
+    # computed before its barriers changed.
+    RO_LEFT=$(.hosts_minus "$RO_LOGGED" "$RO_EXPECT")
+    [ -z "$RO_LEFT" ] || {
+      echo "  WARN: --wsgs= leaves out $(csv_count "$RO_LEFT") group(s) with log rows for this run_uid;"
+      echo "        those upstream of a re-modelled group keep stale access: $RO_LEFT"; }
+  else
+    RO_EXPECT="$RO_LOGGED"
+    echo "  expected WSGs: the $(csv_count "$RO_EXPECT") with a $SCHEMA.log row for this run_uid."
+    echo "  A group that failed on a cloud host and was not re-run here has no row"
+    echo "  here; pass the run's groups with --wsgs= to have it named."
+  fi
+  [ -n "$RO_EXPECT" ] || {
+    echo "FATAL: no $SCHEMA.log row for run_uid $RUN_UID, and no --wsgs=: nothing to recompute"
+    exit 1; }
+  run_finish "$RO_EXPECT" ""
+  exit 0
+fi
+
 # --- pre-flight, local: everything answerable before a droplet exists ------
 #
 # A cypher's software is PREDICTABLE from here: its link comes from
@@ -1113,174 +1399,6 @@ echo "  ✓ host runs finished (per-WSG soft-fail; gaps surface in compare)"
 # about to be re-COPYed cannot delete anything it does not replace. The gap
 # then surfaces at the coverage post-condition after the burn, by which point
 # the successful work is safely on the dispatcher.
-# Split a CSV into lines, dropping blanks. `sed` deleting every line still
-# exits 0, where `grep -v '^$'` exits 1 — and under `set -euo pipefail` that
-# aborts the script from inside a plain assignment. That trap has now bitten
-# this diff twice (cypher_prep's ~/.Renviron filter, then the consolidate
-# bucket builder below), so the safe form lives in one helper rather than
-# being remembered at each call site.
-#
-# `printf '%s\n'`, not `printf '%s'`: without the trailing newline `wc -l`
-# counts separators rather than items and reports one fewer than there is, so
-# a host that completed its whole bucket would be reported incomplete. The
-# empty case still yields 0, because sed drops the resulting blank line.
-csv_lines() { printf '%s\n' "${1:-}" | tr ',' '\n' | sed '/^[[:space:]]*$/d'; }
-csv_count() { csv_lines "${1:-}" | wc -l | tr -d ' '; }
-
-# --- post-consolidate recompute pool (link#250) ----------------------------
-# recompute_one runs ONE WSG and never returns non-zero: the pool must not be
-# able to abort under `set -e`, and the exit status is carried by the .rc file
-# rather than by this function's return.
-#
-# One log per job, not a shared fd. Parallel appends to one file interleave
-# mid-record once a record exceeds the stdio buffer (~64 KB), which a full R
-# traceback comfortably does.
-#
-# The .rc file holds the finished TSV ROW, not a bare number, so collection is
-# one `find -exec cat` with no basename loop. It is also written LAST, so a
-# job killed partway leaves no row and is judged "never reported" rather than
-# silently counted as fine.
-recompute_one() {   # $1 = WSG
-  local w="$1" rc=0
-  ( cd "$REPO_ROOT"
-    LNK_LOAD=loadall LNK_VIEWS_PREBUILT=1 \
-      Rscript data-raw/wsg_recompute_one.R "$w" "$CONFIG"
-  ) > "$RC_DIR/$w.log" 2>&1 || rc=$?
-  [ "$rc" = "0" ] || echo "[WARN] recompute WSG $w failed (rc=$rc; continuing)" \
-    >> "$RC_DIR/$w.log"
-  printf '%s\t%s\n' "$w" "$rc" > "$RC_DIR/$w.rc"
-  return 0
-}
-
-# Order the pool's work list LONGEST-FIRST from previously recorded times.
-#
-# A pool's makespan is bounded below by its slowest single job, so a long job
-# that starts last extends the whole phase. Measured 2026-09-01: CHWK is 226 s
-# against 11 s for SALR, and one WSG was 74% of a four-WSG set. LPT is already
-# this repo's answer for packing components onto hosts (study_area_buckets.R,
-# wsgs_dispatch.sh); this is the same rule one level down, inside one host.
-#
-# Ordered on prior RECOMPUTE times, never on segment count. Segments are a
-# reasonable proxy for modelling work (R^2 0.64 over 104 WSGs) and a bad one
-# here: SALR has 20% MORE segments than CHWK and finishes 20x faster, so a
-# segment ordering would actively run the cheap job first.
-#
-# Times come from previous runs' committed ${TS}_recompute.log files, newest
-# wins. A WSG with no recorded time gets the MEDIAN of those that have one --
-# the same rule study_area_buckets.R uses for a WSG missing from the network
-# table, so an unknown never sorts as free.
-#
-# With NO prior times at all this returns the input order and SAYS SO. The
-# ops-hardening record (planning/archive/2026-05-ops-hardening-20260514) has
-# the precedent: an LPT fallback that silently degraded to a naive split and
-# ignored host speeds went unnoticed across a 217-WSG run.
-recompute_order() {   # $1 = csv of WSGs -> prints WSGs, longest-first
-  local wsgs="$1" tf med n
-  tf=$(mktemp "${TMPDIR:-/tmp}/lnk_rc_times.XXXXXX") || { csv_lines "$wsgs"; return 0; }
-  # sort -r on TS-prefixed names is newest-first; awk keeps the first sighting
-  # of each WSG, so a later run's time wins.
-  find "$LOG_DIR" -maxdepth 1 -name '*_recompute.log' -type f 2>/dev/null \
-    | sort -r \
-    | while IFS= read -r f; do
-        sed -nE 's/^\[wsg_recompute_one\] ([A-Z]{4}) recomputed in ([0-9.]+) min.*/\1 \2/p' "$f"
-      done | awk '!seen[$1]++' > "$tf"
-  n=$(wc -l < "$tf" | tr -d ' ')
-  if [ "${n:-0}" -eq 0 ]; then
-    echo "  note: no prior recompute times in $LOG_DIR — running in input order" >&2
-    rm -f "$tf"; csv_lines "$wsgs"; return 0
-  fi
-  med=$(cut -d' ' -f2 "$tf" | sort -n \
-        | awk '{a[NR]=$1} END{print (NR%2) ? a[(NR+1)/2] : (a[NR/2]+a[NR/2+1])/2}')
-  echo "  ordering ${n} known WSG time(s) longest-first (median ${med} min for the rest)" >&2
-  csv_lines "$wsgs" \
-    | awk -v tf="$tf" -v med="$med" '
-        BEGIN { while ((getline l < tf) > 0) { split(l, a, " "); t[a[1]] = a[2] } }
-        { printf "%s %s\n", ($1 in t ? t[$1] : med), $1 }' \
-    | sort -k1,1nr -k2,2 \
-    | cut -d' ' -f2
-  rm -f "$tf"
-}
-
-# Bounded-width pool. `wait -n` is bash 4.3+ and /bin/bash on macOS is 3.2.57,
-# so a free slot is found by polling liveness with `kill -0` and reaping the
-# finished child with `wait <pid>` (which returns immediately for a child that
-# has already exited). We deliberately do NOT read the rc from `wait`: the .rc
-# file is the single source of truth, which also means the evidence survives a
-# killed dispatcher.
-run_recompute_pool() {   # $1 = width
-  local width="$1" slot pid w all_pids=""
-  local SLOT_PID
-  # Width must be a positive integer or this HANGS rather than failing:
-  # `seq 0 -1` is empty, so the slot scan never runs, `break 2` is
-  # unreachable, and the outer `while :; sleep 1` spins forever.
-  # --recompute-jobs validates its own input, but recompute_parity.sh and
-  # recompute_sweep.sh pass a width straight through, so the guard belongs
-  # HERE where all three callers meet it.
-  #
-  # SHAPE FIRST, then value. `[ abc -lt 1 ]` exits 2 ("integer expression
-  # expected") rather than returning true, so a numeric-only guard treats a
-  # non-numeric width as "condition false", falls through, and hangs -- which
-  # is the exact failure it was written to prevent. Measured: 0 and -1 were
-  # refused while abc and 2x still hung.
-  case "${width:-}" in
-    ''|*[!0-9]*)
-      echo "FATAL: run_recompute_pool needs a positive integer width (got '${width:-}')" >&2
-      return 1 ;;
-  esac
-  # NORMALISE THE BASE ONCE, before anything consumes it. `test` and `case`
-  # read base 10; `$(( ))` reads a leading zero as OCTAL. So "08" passes both
-  # validators and then dies in `$((width - 1))` with "value too great for
-  # base" -> empty seq -> the same hang; and "010" quietly becomes 8, giving
-  # a pool two slots narrower than the operator asked for and than the banner
-  # reports. Three rounds of this bug were three predicates disagreeing about
-  # the grammar; one normalisation ends the class.
-  width=$((10#$width))
-  # Upper bound HERE, not only on the CLI flag. `10#` wraps silently on
-  # overflow -- 10#99999999999999999999 is 7766279631452241919, which passes
-  # the shape check and the >= 1 test and then sends `seq` off for the rest of
-  # the afternoon. --recompute-jobs is saved by its own <= 16, but
-  # recompute_parity.sh and recompute_sweep.sh pass an operator width straight
-  # through, and this function is what all three callers meet.
-  if [ "$width" -lt 1 ] || [ "$width" -gt 64 ]; then
-    echo "FATAL: run_recompute_pool needs 1 <= width <= 64 (got '$width')" >&2
-    return 1
-  fi
-  # Pre-seed every slot. Referencing an unset array element under `set -u` is
-  # an unbound-variable error on bash 3.2.
-  SLOT_PID=()
-  for slot in $(seq 0 $((width - 1))); do SLOT_PID[$slot]=0; done
-
-  for w in $(csv_lines "$ALL_WSGS"); do
-    while :; do
-      for slot in $(seq 0 $((width - 1))); do
-        pid=${SLOT_PID[$slot]}
-        [ "$pid" = "0" ] && break 2
-        if ! kill -0 "$pid" 2>/dev/null; then
-          wait "$pid" 2>/dev/null || true
-          SLOT_PID[$slot]=0
-          break 2
-        fi
-      done
-      sleep 1
-    done
-    recompute_one "$w" &
-    SLOT_PID[$slot]=$!
-    all_pids="$all_pids ${SLOT_PID[$slot]}"
-  done
-  # Drain the last partial wave, waiting on OUR children only.
-  #
-  # A bare `wait` waits for every background job in the calling shell, not
-  # just the ones this pool started -- so it silently couples the pool to
-  # whatever else the caller has backgrounded, and hangs outright if any of
-  # those is long-lived. Measured 2026-09-01: a 2-second sampler loop
-  # backgrounded by data-raw/recompute_sweep.sh wedged the pool indefinitely,
-  # with every job already finished and nothing to show for it.
-  #
-  # An empty WSG list means zero iterations and no pids -- that emptiness is
-  # NOT judged here, it is judged in R by lnk_fanout_judge(), where the
-  # branch can be tested.
-  for pid in $all_pids; do wait "$pid" 2>/dev/null || true; done
-}
 
 # What each host finished comes from its DATABASE (host_account, in
 # study_area_hosts.sh): <schema>.log rows for this run_uid with date_end set,
@@ -1355,7 +1473,13 @@ quit(status = if (ok) 0 else 1)
 " ) > "$LOG_DIR/${TS}_consolidate.log" 2>&1 || crc=$?
     CONSOLIDATING=0
     [ "$crc" = "0" ] \
-      || { echo "  ✗ consolidate failed; see $LOG_DIR/${TS}_consolidate.log — cyphers KEPT"; exit 1; }
+      || { echo "  ✗ consolidate failed; see $LOG_DIR/${TS}_consolidate.log — cyphers KEPT"
+           run_expected_from_hosts
+           echo "    No group was recomputed. Once the hosts' groups are consolidated:"
+           echo "      bash data-raw/study_area_run.sh --recompute-only --run-uid=$RUN_UID \\"
+           echo "        --config=$CONFIG --schema=$SCHEMA${RUN_LABEL:+ --run-label=$RUN_LABEL} \\"
+           echo "        --wsgs=$RUN_EXPECT"
+           exit 1; }
     echo "  ✓ consolidated $n_src/$N_CY cypher(s) (see $LOG_DIR/${TS}_consolidate.log)"
   fi
 
@@ -1374,248 +1498,14 @@ fi
 # --- burn cyphers now (released hosts only; minimise idle) ---
 burn_cyphers || true
 
-# WSG set across all hosts.
-ALL_WSGS=$( { echo "$DISP_BUCKET" | tr ',' '\n'
-  for WS in "${CY_WS_ARR[@]}"; do echo "${CY_BUCKET[$WS]}" | tr ',' '\n'; done
-} | sed '/^[[:space:]]*$/d' | sort -u | paste -sd, - )
-COMPARE_CSV="$LOG_DIR/${TS}_compare.csv"
+# The run's groups, less SKIPs, and the finish signals the per-host accounting
+# already holds (run_expected_from_hosts, study_area_finish.sh).
+run_expected_from_hosts
 
-# --- coverage post-condition (link#246) ------------------------------------
-# Detection rather than prevention: this fires whatever the cause, including
-# causes nobody has thought of yet. Placed AFTER the burn so a failure cannot
-# leak spend, and BEFORE the recompute so a partial result is never painted
-# as complete.
-#
-# Necessary because schema_consolidate DELETEs the destination bucket from
-# every persist table (its step 3.5) and then COPYs (step 4). A source that
-# produced nothing therefore removes the destination's prior rows for those
-# WSGs and still returns ok = TRUE. The log tables keep their rows (#354), so
-# this check reads streams, never the log.
-echo "=== verify WSG coverage in $SCHEMA ==="
-if MISSING=$(PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d fwapg -t -A -c "
-  WITH expect(w) AS (SELECT unnest(string_to_array('$ALL_WSGS', ',')))
-  SELECT coalesce(string_agg(e.w, ',' ORDER BY e.w), '')
-  FROM expect e
-  LEFT JOIN (SELECT DISTINCT watershed_group_code w FROM ${SCHEMA}.streams) g
-    ON g.w = e.w
-  WHERE g.w IS NULL")
-then
-  # coalesce(...,'') so zero missing returns an empty string rather than
-  # NULL — and the empty string is only trusted on this success branch.
-  [ -z "$MISSING" ] || {
-    echo "FATAL: consolidate left $SCHEMA with no rows for: $MISSING"; exit 1; }
-  echo "  ✓ every run WSG has rows in $SCHEMA.streams"
-else
-  echo "FATAL: could not verify WSG coverage in $SCHEMA"; exit 1
-fi
-
-# This check asks "are there rows", NOT "are they from this run". The persist
-# accumulates across runs and consolidate's DELETE is bucket-scoped, so a WSG
-# that was excluded from a narrowed bucket keeps its PREVIOUS run's rows and
-# passes here. It is a guard against consolidate destroying data, not a
-# substitute for the completeness accounting — an earlier revision of this
-# script leaned on it as the backstop for an incomplete run, and it cannot
-# carry that. `$RUN_INCOMPLETE` is what carries it, at the very end.
+# A host that did not account for its whole bucket. Coverage can only add to
+# it: a group with no rows from this run sets it too (link#348).
 RUN_INCOMPLETE="$complete_fail"
-if [ "$RUN_INCOMPLETE" != "0" ]; then
-  echo "  NOTE: some WSGs were excluded from consolidate this run; any rows"
-  echo "        they show above are from an EARLIER run, not this one."
-fi
-
-# --- post-consolidate recompute: settle cross-WSG access (link#205) ---
-# Drainage-closed + DS-first per-host is NOT sufficient: a WSG's downstream
-# barriers can be cross-bucket or arrive late in DS-first order, so its access
-# (hence token1/token2) is computed against an incomplete barrier set.
-# Caught 2026-05-25: FINA 75% / PARA 69% per-host -> both 99% only after
-# re-modelling on the full consolidated barrier set. The recompute is the
-# correctness guarantee REGARDLESS of bucketing. We use lnk_access(merge=TRUE)
-# — the cheap access-only recompute that reuses the persisted streams /
-# habitat / barriers / barrier_overrides (link#205, ~10 s/WSG vs ~1.5 min for
-# a full pipeline rebuild). Because it is cheap, we recompute ALL run WSGs
-# unconditionally rather than threshold-filtering by parity — bucketing is
-# now a speed knob, not a correctness lever.
-#
-# Parallel since link#250. Two things previously made the serial loop
-# mandatory, and both are now gone:
-#
-#   1. lnk_access() rebuilt the SCHEMA-scoped barrier views on every call --
-#      38 DDL statements against names every sibling WSG reads. CREATE OR
-#      REPLACE VIEW takes an AccessExclusiveLock, and a QUEUED exclusive
-#      request blocks every AccessShareLock behind it, so one job's DDL would
-#      stall every sibling's read until lock_timeout killed someone. The build
-#      is now hoisted below and each job runs LNK_VIEWS_PREBUILT=1. Everything
-#      else a job touches is WSG-scoped (zz_lnk_streams_<wsg>,
-#      zz_lnk_access_scratch_<wsg>, zz_lnk_mc_scratch_<wsg>) or row-scoped
-#      (UPDATE ... WHERE watershed_group_code; DELETE+INSERT in a transaction).
-#
-#   2. A failed WSG was invisible. `|| echo` sat INSIDE the loop, so the
-#      subshell always exited 0 and the success line below was unconditional;
-#      RUN_INCOMPLETE is assigned BEFORE this block and nothing after raised
-#      it. A run in which every recompute failed exited 0 and wrote a compare
-#      CSV. The .rc files + lnk_fanout_judge() are what fix that.
-RECOMPUTE_LOG="$LOG_DIR/${TS}_recompute.log"
-RC_DIR="$LOG_DIR/${TS}_recompute.d"
-RC_TSV="$LOG_DIR/${TS}_recompute.tsv"
-N_RECOMPUTE=$(csv_count "$ALL_WSGS")
-
-echo "=== post-consolidate recompute (lnk_access, ${N_RECOMPUTE} WSGs, -j${RECOMPUTE_JOBS}) ==="
 
-# Ensure the log tables exist ONCE, single-threaded, before any job starts
-# (link#262). wsg_recompute_one.R deliberately refuses to run DDL — it runs
-# inside this pool, and schema DDL belongs at init, not in N concurrent jobs.
-# That leaves one edge case with the worst possible timing: if every focal WSG
-# on the dispatcher species-skips (wsg_run_one.R exits 0 without calling
-# lnk_pipeline_run), nothing ever creates log_recompute, and the pool would
-# then hard-stop on all N WSGs — at the end of a paid multi-host run, after
-# consolidate. One idempotent call here removes the class for nothing.
-if ( cd "$REPO_ROOT" && LNK_LOAD=loadall Rscript -e '
-suppressPackageStartupMessages(pkgload::load_all(quiet = TRUE))
-cfg <- lnk_config(commandArgs(TRUE)[1])
-s <- Sys.getenv("LNK_SCHEMA"); if (nzchar(s)) cfg$pipeline$schema <- s
-conn <- lnk_db_conn(dbname = "fwapg", host = "localhost", port = 5432L,
-                    user = "postgres", password = "postgres")
-on.exit(try(DBI::dbDisconnect(conn), silent = TRUE), add = TRUE)
-link:::.lnk_log_create_tables(conn, cfg$pipeline$schema)
-' "$CONFIG" ) > "$LOG_DIR/${TS}_recompute_logtables.log" 2>&1; then
-  echo "  ✓ log tables present in $SCHEMA"
-else
-  echo "  ✗ could not ensure log tables; see $LOG_DIR/${TS}_recompute_logtables.log"
-  echo "    the recompute would fail per-WSG on a missing log_recompute"
-  RECOMPUTE_FAIL=1
-  # Its OWN stage token. Reusing "views" made the final gate print "the barrier
-  # views could not be built" and point at ${TS}_recompute_views.log -- a file
-  # the views step never wrote, because it is gated on RECOMPUTE_FAIL=0 and
-  # never ran. Two prep steps, two names, two pieces of evidence.
-  RECOMPUTE_FAIL_STAGE="logtables"
-fi
-
-# Build the barrier views ONCE, single-threaded, before any job starts.
-# Nested rather than `[ "$RECOMPUTE_FAIL" = "0" ] && ( build )`: with the
-# short-circuit form, an already-failed log-table step would fall into this
-# else and report "barrier view build failed", naming a log file that was
-# never written. Two prep steps, two diagnoses.
-if [ "$RECOMPUTE_FAIL" = "0" ]; then
-  if ( cd "$REPO_ROOT" && LNK_LOAD=loadall \
-         Rscript data-raw/barriers_views_build.R "$CONFIG" ) \
-       > "$LOG_DIR/${TS}_recompute_views.log" 2>&1; then
-    echo "  ✓ barrier views built once for $SCHEMA"
-  else
-    # Deliberately NOT falling back to per-WSG builds. At -j>1 that is exactly
-    # the race the hoist removes, and it would turn one loud pre-build failure
-    # into N quiet lock_timeouts attributed to individual WSGs.
-    echo "  ✗ barrier view build failed; see $LOG_DIR/${TS}_recompute_views.log"
-    echo "    skipping the recompute — the run will exit non-zero"
-    RECOMPUTE_FAIL=1
-    # Which stage failed decides which evidence exists. The pool never ran, so
-    # RECOMPUTE_LOG and RC_TSV were never created -- naming them at the final
-    # gate would send the operator to two absent files.
-    RECOMPUTE_FAIL_STAGE="views"
-  fi
-fi
-
-if [ "$RECOMPUTE_FAIL" = "0" ]; then
-  rm -rf "$RC_DIR"; mkdir -p "$RC_DIR"
-  # Longest-first. Ordering is the CALLER's business -- run_recompute_pool
-  # consumes ALL_WSGS as given, which keeps it testable by pool_probe.sh and
-  # lets recompute_parity.sh shuffle deliberately for its invariance pass.
-  ALL_WSGS=$(recompute_order "$ALL_WSGS" | paste -sd, -)
-  run_recompute_pool "$RECOMPUTE_JOBS"
-  # Read by the kept-hosts report: whether a recovery must recompute only the
-  # kept groups and those upstream, or every group of the run (link#347).
-  RECOMPUTE_RAN=1
-
-  # Never `cat "$RC_DIR"/*` — ARG_MAX at provincial scope. `find -exec ... +`
-  # also exits 0 on zero matches, leaving an EMPTY tsv rather than aborting;
-  # that empty case is a real branch and is judged in R, not here.
-  : > "$RC_TSV"
-  find "$RC_DIR" -maxdepth 1 -name '*.rc'  -exec cat {} + >> "$RC_TSV"
-  : > "$RECOMPUTE_LOG"
-  find "$RC_DIR" -maxdepth 1 -name '*.log' -exec cat {} + >> "$RECOMPUTE_LOG"
-
-  if ( cd "$REPO_ROOT" && LNK_LOAD=loadall \
-         Rscript data-raw/fanout_judge.R "$RC_TSV" "$ALL_WSGS" recompute ); then
-    echo "  ✓ recompute: ${N_RECOMPUTE}/${N_RECOMPUTE} WSGs"
-    rm -rf "$RC_DIR"
-  else
-    echo "  ✗ recompute incomplete; see $RECOMPUTE_LOG and $RC_DIR/"
-    RECOMPUTE_FAIL_STAGE="pool"
-    # Per-job logs KEPT on failure: the concatenation is the artifact, the
-    # per-job files are what you actually grep.
-    RECOMPUTE_FAIL=1
-  fi
-fi
-
-# --- compare (tunnel-free) -> CSV ---
-echo "=== compare (tunnel-free) ==="
-( cd "$REPO_ROOT" && LNK_LOAD=loadall Rscript data-raw/study_area_compare.R \
-    "$COMPARE_CSV" "$ALL_WSGS" "$CONFIG" ) > "$LOG_DIR/${TS}_compare.log" 2>&1 \
-  || { echo "  ✗ compare failed; see $LOG_DIR/${TS}_compare.log"; exit 1; }
-echo "  ✓ compare CSV: $COMPARE_CSV"
-
-# --- report ---
-echo "=== summary ==="
-echo "  run WSGs: $ALL_WSGS"
-echo "  compare CSV: $COMPARE_CSV"
-tail -40 "$LOG_DIR/${TS}_compare.log" || true
-
-# An incomplete run must not exit 0. The failure is reported HERE rather than
-# at the point of detection so that everything already computed is
-# consolidated, recomputed, compared and written out first — the operator gets
-# the artifacts AND an accurate exit status, instead of one at the cost of the
-# other. A caller that only checks the exit code still learns the truth.
-# Two independent causes, reported separately. Merging them into one flag
-# would print "some host did not account for its bucket" over a recompute
-# failure, which is the wrong diagnosis and sends the operator to the wrong
-# host. They are also different KINDS of failure: an incomplete bucket means
-# output is missing, an incomplete recompute means output is silently WRONG.
-# A third cause (link#347): a cypher still up because it may hold work that
-# was not consolidated, or whose burn did not complete. --keep-cyphers alone is
-# a choice, not a failure; a host it keeps that is ALSO held for cause still
-# counts, so the flag cannot turn an unconsolidated host into an exit 0.
-HOSTS_KEPT=0
-[ "${KEPT_CAUSE_N:-0}" -gt 0 ] && HOSTS_KEPT=1
-if [ "${RUN_INCOMPLETE:-0}" != "0" ] || [ "${RECOMPUTE_FAIL:-0}" != "0" ] \
-   || [ "$HOSTS_KEPT" != "0" ]; then
-  echo "=== study_area_run INCOMPLETE ==="
-  if [ "$HOSTS_KEPT" != "0" ]; then
-    echo "  $KEPT_CAUSE_N cypher(s) were NOT burned for cause: each may hold groups"
-    echo "  that are not on the dispatcher, and is still running and billed."
-    echo "  Consolidate only each host's groups column, and only where"
-    echo "  groups_measured = yes; never groups_partial (consolidating a group the"
-    echo "  host no longer holds, or holds in part, deletes the dispatcher's copy)."
-    if [ "${RECOMPUTE_RAN:-0}" = "1" ]; then
-      echo "  The recompute above ran WITHOUT those groups, so recompute each one and"
-      echo "  each run group upstream of it afterwards. Then burn the host."
-    else
-      echo "  The recompute did not run, so recompute every group of the run"
-      echo "  afterwards. Then burn the host."
-    fi
-    echo "  Hosts, reasons and commands: $LOG_DIR/${TS}_kept_hosts.tsv"
-  fi
-  if [ "${RUN_INCOMPLETE:-0}" != "0" ]; then
-    echo "  At least one host did not account for its whole bucket; only the"
-    echo "  WSGs it finished were consolidated. Artifacts above are valid for"
-    echo "  those WSGs. Re-run the missing ones before trusting the compare."
-  fi
-  if [ "${RECOMPUTE_FAIL:-0}" != "0" ]; then
-    echo "  The post-consolidate recompute did not complete for every WSG."
-    echo "  Those WSGs' streams_access / streams_mapping_code still hold their"
-    echo "  PRE-consolidate values, so cross-WSG access — hence token1/token2"
-    echo "  and ;DAM — is WRONG for them. This is bad output, not missing"
-    echo "  output: the compare CSV above will look complete."
-    if [ "${RECOMPUTE_FAIL_STAGE:-pool}" = "logtables" ]; then
-      echo "  The provenance log tables could not be created, so NO WSG was"
-      echo "  recomputed. See $LOG_DIR/${TS}_recompute_logtables.log."
-    elif [ "${RECOMPUTE_FAIL_STAGE:-pool}" = "views" ]; then
-      echo "  The barrier views could not be built, so NO WSG was recomputed."
-      echo "  See $LOG_DIR/${TS}_recompute_views.log."
-    else
-      echo "  See $RECOMPUTE_LOG (and ${RC_TSV} for per-WSG exit status)."
-    fi
-    echo "  Re-run just those, no full run needed:"
-    echo "    LNK_SCHEMA=$SCHEMA LNK_LOAD=loadall \\"
-    echo "      Rscript data-raw/wsg_recompute_one.R <WSG> $CONFIG"
-  fi
-  exit 1
-fi
-echo "=== study_area_run done ==="
+# Coverage, recompute over the groups this run built, compare, report. Exits
+# non-zero on an incomplete run. Bare call: see study_area_finish.sh.
+run_finish "$RUN_EXPECT" "$RUN_SIGNALS"
diff --git a/planning/archive/2026-10-issue-348-recompute-after-failed-group/README.md b/planning/archive/2026-10-issue-348-recompute-after-failed-group/README.md
new file mode 100644
index 00000000..5fd65e6d
--- /dev/null
+++ b/planning/archive/2026-10-issue-348-recompute-after-failed-group/README.md
@@ -0,0 +1,45 @@
+## Outcome
+
+One failed group no longer costs every other group in a `study_area_run.sh` run its post-consolidate recompute.
+
+- **Coverage splits instead of exiting.** `run_coverage`, in the new `data-raw/study_area_finish.sh`, sorts the run's groups by what the dispatcher's database says about the run_uid. A group counts as finished when its newest `log` row is this run's and closed, the same rule `schema_consolidate.R` uses, plus the driver's own finish signals. The four classes are:
+  - rows from a finished build of this run;
+  - no rows;
+  - an earlier run's or partial rows;
+  - rows lost at consolidate.
+- **The recompute and the compare run over the first class only.** The rest are named, with recovery commands, and the run exits non-zero.
+- **`--recompute-only --run-uid=<uid> [--wsgs=]`** finishes a run once its missing groups have been re-modelled under the same uid. It refuses a `--config` that the run's log rows do not name.
+
+What was learned:
+- **The plan review's blocker was real.** A forgotten `--config` would have recomputed all 241 groups of `fresh_default` under `bcfishpass` and stamped them with the run's uid.
+- **Most of the review effort went into the recovery text.** Code-check rounds 1–3 each found the defect inside the previous round's fix of the kept-host advice. The mechanism: advice was computed from a set after the qualifier that gives the set its meaning had been dropped. The host's measured state lives only in `hosts_kept_report`. The fix was to stop re-deriving that advice and defer to `kept_hosts.tsv`. Round 4's 37-row enumeration of every printed instruction ended the loop.
+
+## Measurement
+
+- `fresh_default`, run_uid `20261017_004619-3f4c713b` (read-only):
+  - The log names 241 groups and one config (`default`).
+  - `run_coverage` puts 241/241 in the recompute class, with the newest-row rule, and 0 missing.
+  - `run_config_check` refuses `bcfishpass`.
+- `tests/testthat/test-study_area_finish.R`: 70 expectations on a scratch schema, with the real pool functions and an `Rscript` stub.
+- **Mutants:**
+  - restoring the exit on a missing group fails acceptance tests 1 and 2;
+  - dropping the newest-row term fails the coverage test;
+  - removing the empty-set skip fails acceptance test 2;
+  - building the kept-host set from the bucket fails the kept-host test.
+- **Other suites:**
+  - `pool_probe.sh`: 37/37.
+  - Hosts tests: 120/120.
+  - Full suite: 3195 pass. The 4 failures are pre-existing: the golden-dams pin, which `CLAUDE.md` records as stale (8 pinned, 7 now), and `lnk_wsg_resolve` closure. No `R/` file changed on this branch.
+
+## Deferred
+
+These items are drafted as a follow-up issue, not filed:
+- persist the run's group list when the buckets resolve, so `--recompute-only` sees groups that failed on cloud hosts;
+- carry on to coverage after a consolidate refusal.
+
+These are documented in RUNBOOK §8d, not fixed:
+- `--recompute-only` takes no lock;
+- `study_area_verify.sql` stays red for an open log row on the dispatcher;
+- a soft-failed `date_end` cannot be rescued by `--recompute-only`.
+
+Closed by: PR for #348 (branch `348-one-failed-group-skips-the-post-consolid`)
diff --git a/planning/archive/2026-10-issue-348-recompute-after-failed-group/findings.md b/planning/archive/2026-10-issue-348-recompute-after-failed-group/findings.md
new file mode 100644
index 00000000..9be257f9
--- /dev/null
+++ b/planning/archive/2026-10-issue-348-recompute-after-failed-group/findings.md
@@ -0,0 +1,57 @@
+# Findings — One failed group skips the post-consolidate recompute for every group (#348)
+
+## Context and design (from plan mode)
+
+
+In `data-raw/study_area_run.sh` the coverage check after consolidate (`:1394-1410`) `exit 1`s on the first run group that has no `<schema>.streams` rows. The recompute (`lnk_access(merge = TRUE)`, `:1425-1545`) and the compare come after it, so one failed group costs every other group its recompute. The check also asks only whether a group has rows, not whether they come from this run, so a failed group that still holds an earlier run's rows passes, the recompute covers it, and nothing at that point says its rows are stale.
+
+What exploration settled:
+- **"Finished this run" is already defined** in `data-raw/study_area_hosts.sh` (#347): `host_finished` = `<schema>.log` row with `run_uid = RUN_UID AND date_end IS NOT NULL`, with log `done` markers only adding. `.lnk_log_run_fail()` (`R/lnk_log.R:1055`) leaves `date_end` NULL, so a failed group has an *open* row. Since #354, consolidate copies each group's log rows to the dispatcher, so after consolidate the dispatcher's `log` names cypher groups too.
+- **Reuse:** `.hosts_query` (sentinel-framed local/remote query; unknown never reads as empty) and the set helpers (`.hosts_union/minus/inter/csv`) in `study_area_hosts.sh`.
+- **The pool functions** (`csv_lines`, `run_recompute_pool`, etc., `:1127-1280`) are pulled out of `study_area_run.sh` by `pool_probe.sh`, `recompute_parity.sh` and `recompute_sweep.sh` with `sed`/`awk` pattern matches. They must stay in the driver. Moving them within the file is safe because the matches do not depend on position.
+- **A fixture schema test already exists:** `test-schema_consolidate.R` uses `skip_if_no_db()` plus `.lnk_log_create_tables()` on a scratch schema. `test-study_area_hosts.R` runs a bash lib with stubs on PATH, and that is the pattern followed here.
+- A cypher group that failed leaves its open log row **on the cypher** (consolidate takes finished groups only). So in `--recompute-only`, reading the expected set from the dispatcher's log cannot see such a group. That is why `--wsgs=` is offered.
+
+## Design
+
+New sourced lib **`data-raw/study_area_finish.sh`** (sourced after `study_area_hosts.sh`; uses its helpers). It holds everything from coverage onwards, so the normal run and `--recompute-only` share one path and tests can reach it:
+
+- `run_coverage <expected csv> <signals csv>`: one strict local `streams` query and one `log` query for `RUN_UID`. Sets:
+  - `COV_RECOMPUTE` = expected ∩ has rows ∩ (closed log row this run ∪ signals);
+  - `COV_NOROWS` = no rows at all;
+  - `COV_STALE` = rows, but not from a build this run finished (an earlier run's, or this run's partial pre-persist);
+  - `COV_LOST` = finished this run, no rows on the dispatcher (consolidate lost them).
+
+  Prints one line per class. Returns 1 when the database does not answer, and the driver then FATALs as before, because it cannot verify.
+- `run_expected_from_log`: the groups with **any** `log` row for `RUN_UID`, open or closed (for `--recompute-only` without `--wsgs=`).
+- `run_finish <expected csv> <signals csv>`: coverage, then the log-tables / barrier-views prep, the pool over `COV_RECOMPUTE`, the judge, the compare over `COV_RECOMPUTE`, and the final report. This is today's `:1383-1620`, moved and changed only as follows:
+  - **Missing groups never exit.** They set `RUN_INCOMPLETE=1`, and the report names each by class.
+  - **An empty `COV_RECOMPUTE` skips the recompute and the compare**, and the run prints why ("no run group has rows from a build this run finished").
+  - The report gives the recovery command: `LNK_RUN_UID=<uid> LNK_SCHEMA=… Rscript data-raw/wsg_run_one.R <WSG> <config>`, then `study_area_run.sh --recompute-only --run-uid=<uid> …`.
+  - It exits 1 on an incomplete run, as the tail always did, so it is called bare (revised in build: a function called under `if` or `||` runs with errexit off).
+
+Driver changes (`study_area_run.sh`):
+- Flags:
+  - `--recompute-only` and `--run-uid=<uid>`, both required together. `<uid>` must match `^[0-9]{8}_[0-9]{6}-[0-9a-f]{8}$`, the format minted at `:330`.
+  - Optional `--wsgs=A,B` (recompute-only only).
+  - `--recompute-only` is refused with `--focal`, `--cy-workspaces`, `--preflight-only`, `--refresh-primitives` or `--auto-install`.
+  - The focal-count check is skipped in recompute-only, as it already is for preflight-only.
+- In recompute-only, `RUN_UID` is the given uid (exported as `LNK_RUN_UID`, so `log_recompute` rows carry it), and the header says `MODE: --recompute-only`.
+- The pool function block moves above the pre-flight. Right after the trap, `--recompute-only` checks `pg_isready`, takes its expected set (`--wsgs=`, or else `run_expected_from_log`), and calls `run_finish "$expected" ""`. It skips the pre-flight, dispatch and consolidate, and says why: it reads persisted tables only. Zero expected groups means a non-zero exit naming the run_uid.
+- Normal path: `RUN_WSGS` = union of buckets minus every host's SKIP set. Signals = dispatcher `ACC_FINISHED ∪ ACC_DONE_LOG` ∪ each cypher's `CY_BUCKET_DONE`. Then `run_finish "$RUN_WSGS" "$signals"`.
+
+
+## Plan review (2026-10-19)
+
+Triage table in `review-plan.md`. Probes before acting:
+- `fresh_default.log` for run `20261017_004619-3f4c713b` names one config (`default`), so the config check passes there and refuses `bcfishpass`.
+- 241 groups have a newest log row that is closed and from that run, so the newest-row rule changes nothing for #246 (live `run_coverage`: 241/241, 0 missing).
+
+## Suite baseline
+
+`devtools::test()` on this branch: 3195 pass, 2 failed and 2 errors in `test-lnk_pipeline_prepare.R` (golden dams pin, known stale per CLAUDE.md: 8 pinned, `cabd.dams` gives 7) and `test-lnk_wsg_resolve.R` (closure). No `R/` file changed on this branch and neither file reads `data-raw/`.
+
+## Errors Encountered
+
+| Error | Resolution |
+|-------|------------|
diff --git a/planning/archive/2026-10-issue-348-recompute-after-failed-group/progress.md b/planning/archive/2026-10-issue-348-recompute-after-failed-group/progress.md
new file mode 100644
index 00000000..1681ff3a
--- /dev/null
+++ b/planning/archive/2026-10-issue-348-recompute-after-failed-group/progress.md
@@ -0,0 +1,23 @@
+# Progress — One failed group skips the post-consolidate recompute for every group (#348)
+
+## Session 2026-10-18
+
+- Plan-mode exploration — phases approved by user ("Go all phases to PR")
+- Created branch `348-one-failed-group-skips-the-post-consolid` off main
+- Scaffolded PWF baseline from issue #348 with approved phases
+- Next: start Phase 1
+- Phase 1: `tests/testthat/test-study_area_finish.R` (8 tests, fixture schema + Rscript stub, real pool functions extracted from the driver); `hosts_bash()` moved to `helper-bash.R`
+- Phase 2: `data-raw/study_area_finish.sh` (`run_coverage`, `run_expected_from_log`, `run_finish`); driver gains `--recompute-only --run-uid= [--wsgs=]`, pool block moved above the pre-flight, tail replaced by `run_finish`
+- Verified: finish tests 8/8 and hosts tests pass; `bash -n` both; `pool_probe.sh` PASS=37 FAIL=0; recompute_parity/sweep extraction still resolves
+- Mutation: a copy of the lib restoring the exit on a missing group fails acceptance tests 1 (6 failures) and 2 (3 failures)
+- Live, read-only: `run_coverage` on `fresh_default` for run_uid `20261017_004619-3f4c713b`: expected 241 (from the log), 241/241 recompute, 0 missing
+- Phase 3: RUNBOOK §8d gains "A missing group costs only itself" (classes table, recovery commands); CLAUDE.md #348 fact and research/study_area_run.md recovery line updated
+- Plan review folded in (`review-plan.md`): run_config_check, newest-row rule, compare failure falls through to the report, run_expected_from_hosts (SKIP minus signals, WARN), `<TS>_coverage.tsv`, discharge skipped in recompute-only, recovery text with LNK_GUARD_DOWNSTREAM=warn, kept-host text points at --recompute-only, consolidate-failure banner prints the recovery
+- Tests 56/56 (11 tests); hosts 120/120; mutants m_exit / m_newest / m_noskip each red; pool_probe PASS=37; live probe on fresh_default 241/241 with the newest rule, config check refuses bcfishpass
+- `hosts_bash()` now lives in `tests/testthat/setup.R` beside `skip_if_no_db()` (helper-bash.R dropped)
+- `/code-check branch`, 4 rounds (findings in `review-round1..4.md`):
+  - R1: 3 fragile (kept-host groups told to re-model; --run-label missing; soft-failed date_end) — fixed / documented
+  - R2: 1 fragile inside R1's fix (held set from the whole bucket) — fixed
+  - R3: 1 bug + 4 fragile inside R2's fix; mechanism named (advice derived from a set without the qualifier that gives it meaning); 25-row enumeration — root fix: the report defers to kept_hosts.tsv; --wsgs on every command; run uid/label on the one-group recompute; accounting-vs-coverage message
+  - R4: terminating enumeration, 37 rows; 2 fragile (recompute-only ignored the kept TSVs it had read; consolidate banner's --wsgs kept SKIPs) — fixed and tested. Every row now agrees; loop ended by enumeration.
+- Tests after: finish 70 pass, hosts 120 pass; pool_probe PASS=37
diff --git a/planning/archive/2026-10-issue-348-recompute-after-failed-group/review-plan.md b/planning/archive/2026-10-issue-348-recompute-after-failed-group/review-plan.md
new file mode 100644
index 00000000..a10cd710
--- /dev/null
+++ b/planning/archive/2026-10-issue-348-recompute-after-failed-group/review-plan.md
@@ -0,0 +1,25 @@
+# Plan review — #348 (Plan agent, 2026-10-19 ~04:00 UTC)
+
+Reviewer read the plan, the issue and the code while Phase 1-2 were being written,
+so it reviewed the draft as well as the plan. The findings and what was done with each:
+
+| # | Finding | Probe | Disposition |
+|---|---|---|---|
+| Blocker 1 | `--recompute-only` never checks that `--config` is the run's config; a forgotten `--config` recomputes 241 groups under `bcfishpass` and stamps them with the run's uid | `fresh_default.log` for the run: `config_name` = `default` only | **Fix:** refuse unless the run's log names exactly `$CONFIG` |
+| A1 | "Closed row for run_uid" ≠ "these rows are this run's" when a later run rebuilt the group, or a hand re-run under the same uid failed after pre-persist | 241 groups in `fresh_default` have a newest row that is closed and from this run | **Fix:** a group counts as finished only if its newest `log` row (max `date_start`, the same rule `schema_consolidate.R` uses) is closed and has this run_uid; signals still add. Fixture cases for both. |
+| Gap 1 | The log-derived expected set misses groups that failed before the log opened, and whole runs that died before `run_finish` | — | Deferred: `--wsgs=` covers it; follow-up issue (persist the run's group list at bucket time) |
+| Gap 2 | A `--wsgs=` subset leaves upstream groups unsettled | — | **Fix:** WARN when `--wsgs=` is a strict subset of the run's log groups |
+| Gap 3 | A compare failure exits before the report, hiding the missing-group names | — | **Fix:** flag it and fall through to the report |
+| Gap 4 | Discharge / wet-load resolution runs before the recompute-only branch and can FATAL a recompute that never reads discharge | `wsg_recompute_one.R` reads no discharge | **Fix:** gate on `RECOMPUTE_ONLY=0` |
+| Gap 5 | Driver glue (expected minus SKIP, signals) is untested inline code | — | **Fix:** `run_expected_from_hosts` in the lib, tested with plain maps. Subtract only SKIPs no host finished; WARN (drift), not note. |
+| Gap 6 | Coverage leaves no artifact | — | **Fix:** `${TS}_coverage.tsv` (wsg, class) |
+| Gap 7 | `study_area_verify.sql` stays red after the recovery for a group whose failed attempt left an open row on the dispatcher | — | **Doc:** RUNBOOK §8d says so |
+| Gap 8 | Recovery command omits `LNK_GUARD_DOWNSTREAM=warn` and `LNK_RUN_LABEL` | `wsg_run_one.R` guard defaults to `error` | **Fix** |
+| Gap 9 | Recompute-only skips all pre-flight | — | Partial: add the `fresh.streams_vw_bcfp` check (the compare needs it). SHA exports fall back to the local checkouts, the same source the pre-flight reads; dirty check not added. |
+| Gap 10 | Nothing stops two finishes on one schema (a paused driver plus `--recompute-only`) | — | **Doc:** RUNBOOK warning; no lock (deferred) |
+| Gap 11 | Kept-host recovery text still says "recompute every group … wsg_recompute_one.R" | — | **Fix:** point at `--recompute-only --run-uid=` (finish lib, hosts lib, RUNBOOK) |
+| Ordering 1 | Plan says run_finish returns the status; it exits | — | Plan text corrected |
+| Ordering 2 | Plan says stubbed pool; tests run the real pool against an Rscript stub | — | Plan text corrected |
+| Ordering 3 | Add mutants: newest-row term, empty-set skip | — | **Done** in Phase 4 |
+| Scope 1 | Consolidate failure still exits before coverage (same failure class) | — | Banner now prints the `--recompute-only` recovery; follow-up issue for the rest |
+| Acceptance 1 | Acceptance says "driver exits"; tests exercise `run_finish` (driver `LOG_DIR` is under the repo) | — | Stated in the plan: the lib-level test stands in for the driver |
diff --git a/planning/archive/2026-10-issue-348-recompute-after-failed-group/review-round1.md b/planning/archive/2026-10-issue-348-recompute-after-failed-group/review-round1.md
new file mode 100644
index 00000000..9b5691d8
--- /dev/null
+++ b/planning/archive/2026-10-issue-348-recompute-after-failed-group/review-round1.md
@@ -0,0 +1,63 @@
+# Code-check round 1 — branch 348 (git diff c902ea97...HEAD)
+
+Reviewer: subagent, 2026-10-18. Read the full diff, the checklist, study_area_finish.sh,
+the changed regions of study_area_run.sh (arg parsing, recompute-only block, moved pool
+functions, consolidate tail), study_area_hosts.sh's query/set helpers, both test files,
+setup.R, RUNBOOK and CLAUDE.md bullets.
+
+Verified by running:
+- `test-study_area_finish.R`: 11/11 pass, 0 skip. `test-study_area_hosts.R`: 120 pass.
+- The extraction patterns in pool_probe.sh / recompute_parity.sh / recompute_sweep.sh
+  (`^csv_lines() {`, `awk '/^recompute_one\(\)/,/^}/'`, `/^run_recompute_pool\(\)/,/^}/`)
+  each match exactly one definition in the new driver, and the awk range still ends at the
+  function's own closing brace.
+- `date_start` is `timestamptz NOT NULL`, and `fresh_default.log` has 0 (group, date_start)
+  ties, so the `(wsg, max(date_start)) IN (...)` newest-row pick is unambiguous.
+- On the real #246 run, the coverage "closed and newest" predicate selects 241/241 groups,
+  and `config_name` is `default` on all 241 rows, so `run_config_check` passes for it.
+- SQL interpolation: RUN_UID regex matches the minted format exactly; SCHEMA and CONFIG are
+  restricted to `[A-Za-z0-9_]`; WSGs come from `[A-Z]{4}`-validated sets.
+- Fail direction: coverage returns 1 (unknown) on a missing streams table; a missing log
+  table reads as "nothing finished" (everything named, nothing recomputed), and
+  run_config_check fails closed. None fail toward pass.
+
+## Findings
+
+- **[severity: fragile]** data-raw/study_area_finish.sh, run_finish_report (the
+  `RUN_INCOMPLETE` / `COV_MISSING` branch): the recovery for a missing group is always
+  "re-model each under this run_uid". When a cypher is kept because its database did not
+  answer at accounting (`ACC_STATE` unknown, so `CY_BUCKET_DONE` is empty and nothing of it
+  was consolidated), its finished groups land in `no rows` / `earlier or partial` and are
+  printed with that advice, directly under the kept-host section that says to consolidate
+  them. An operator who follows the second block re-models groups that are already finished
+  on the kept host (hours of work at provincial scale). If they then consolidate as well, the
+  host's older build replaces the re-model. No data is lost, but the two blocks give opposite
+  instructions for the same groups. Fix: in that branch, list the missing groups that belong
+  to a kept host's bucket separately ("consolidate from the kept host, do not re-model"), or
+  print the re-model advice only for groups outside every kept host's bucket.
+
+- **[severity: fragile]** data-raw/study_area_finish.sh (run_finish_report's printed
+  `--recompute-only` commands, both the kept-host and missing-group blocks),
+  data-raw/study_area_run.sh:1463-1466 (the consolidate-failure message),
+  data-raw/study_area_hosts.sh hosts_kept_report, and RUNBOOK §8d: the printed
+  `bash data-raw/study_area_run.sh --recompute-only --run-uid=... --config=... --schema=...`
+  never carries `--run-label=$RUN_LABEL`. The `wsg_run_one.R` line printed directly above it
+  does carry `LNK_RUN_LABEL`. Following the commands as printed gives the finishing
+  recompute's `log_recompute` rows (the newest per group, which describe what ships)
+  `run_label` empty, while the run's `log` rows and the re-modelled groups keep the label.
+  This is a provenance gap only. Fix: add `${RUN_LABEL:+--run-label=$RUN_LABEL}` to the
+  printed `--recompute-only` lines.
+
+- **[severity: fragile]** data-raw/study_area_finish.sh run_coverage, when called from the
+  `--recompute-only` path with no signals (study_area_run.sh, `run_finish "$RO_EXPECT" ""`):
+  the comment states that the log's `date_end` is a soft UPDATE that can fail, which is why
+  signals only ever add. In a full run, the done marker rescues such a group. In
+  `--recompute-only` nothing can: a group whose build finished and was consolidated, but
+  whose `date_end` UPDATE failed, is reported as "an earlier run's or partial rows" on every
+  `--recompute-only`. It is never recomputed, and the run cannot exit 0 without a full
+  re-model of that group. This fails closed and is rare, but the diagnosis printed for it is
+  wrong. A one-line note in RUNBOOK's recovery paragraph would be enough, or a
+  `--wsgs`-style override for groups the operator has verified.
+
+No bugs found in the classification logic, the set arithmetic, the arg-parsing refusals, the
+moved pool functions, or the exit-status paths.
diff --git a/planning/archive/2026-10-issue-348-recompute-after-failed-group/review-round2.md b/planning/archive/2026-10-issue-348-recompute-after-failed-group/review-round2.md
new file mode 100644
index 00000000..beeaf15a
--- /dev/null
+++ b/planning/archive/2026-10-issue-348-recompute-after-failed-group/review-round2.md
@@ -0,0 +1,53 @@
+# Code-check round 2 — branch 348 (git diff c902ea97...HEAD)
+
+Reviewer: subagent, 2026-10-18. Scope: the round-1 fixes (commit 5709d87b) in every
+path asked about, plus a re-read of study_area_finish.sh, the driver's arg parsing,
+discharge gate, recompute-only branch and tail, and study_area_hosts.sh.
+
+Verified by running:
+- `test-study_area_finish.R`: 12 tests, 0 failed, 0 error, 0 skipped (NOT_CRAN=true).
+- A direct call of `run_finish_report` (bash 5, `set -euo pipefail`, libs sourced, no DB)
+  with one held host whose kept report measured CCCC as finished-on-host and DDDD as
+  partial. Output: `In a kept host's bucket: consolidate these from the host ..., do NOT
+  re-model them: CCCC,DDDD`, and no re-model line at all (see finding).
+- Empty `CY_WS_ARR` under `set -u` (recompute-only, no cyphers): the
+  `${CY_WS_ARR[@]+"${CY_WS_ARR[@]}"}` guard expands to nothing; `CY_HOLD` / `CY_BUCKET`
+  are declared assoc by the hosts lib in both paths, so `${CY_HOLD[$ws]}` is never an
+  indexed-array arithmetic lookup. Everything missing goes to the re-model list. Correct.
+- Partly consolidated held host: groups consolidated are not in `COV_MISSING`, so the
+  intersection only touches the unconsolidated ones. Correct as far as it goes.
+- `--run-label`: `${RUN_LABEL:+ --run-label=$RUN_LABEL}` is well formed in all four printed
+  commands (finish report x2, driver consolidate-failure, hosts_kept_report); the arg
+  parser restricts the label to `[A-Za-z0-9._-]` and refuses empty, so the pasted line
+  needs no quoting and a leading `-` is harmless after `=`. The `LNK_RUN_LABEL=` env form is
+  likewise safe. In --recompute-only the label is exported (`LNK_RUN_LABEL`) before the
+  tail, so it reaches the recompute rows.
+- Ordering: `burn_cyphers` (hence `hosts_kept_report`, which re-measures `CY_UNCONS` /
+  `CY_PARTIAL` / `CY_DOUBT`) runs at driver line 1484, before `run_finish` at 1496, so those
+  maps are current when the report prints.
+
+## Findings
+
+- **[severity: fragile]** data-raw/study_area_finish.sh:395-406 (and the matching sentence
+  in RUNBOOK.md "A missing group costs only itself": "A group in a kept host's bucket ...
+  consolidate it from the host, do not re-model it"). The held set is the held host's whole
+  `CY_BUCKET`, so every missing group in that bucket is told "consolidate these from the
+  host, do NOT re-model them". But a held host's bucket also contains its genuinely failed
+  builds, which `hosts_kept_report` (run just before, same maps) lists as
+  `partial, do NOT consolidate: ...` (`CY_PARTIAL`), or as unknown provenance
+  (`CY_DOUBT`, e.g. a failed group over a warm image's pre-dispatch rows). For those groups
+  the two blocks now say "do not consolidate" and "do not re-model", so the operator is
+  given no valid recovery; consolidating a partial group deletes the dispatcher's copy, per
+  the kept report's own warning. This is reachable in round 1's own scenario: a host whose
+  database did not answer at accounting is held, nothing of it is consolidated, and when it
+  answers at report time `host_split` puts its done-marked groups in `CY_UNCONS` and its
+  failed ones in `CY_PARTIAL` — the failed ones are then mislabelled. Also reachable on any
+  host held for finished-left / doubt reasons that also has a failed group (partial groups
+  do not hold a host, but do not release it either). Reproduced by direct call (above).
+  Fix: build `held` from the measured sets rather than the bucket — union over held hosts
+  of `CY_UNCONS[$ws]` (which `hosts_kept_report` sets to the full candidate set when the
+  host does not answer, `measured=no`), list `CY_DOUBT[$ws]` as "check on the host first",
+  and leave `CY_PARTIAL[$ws]` in the re-model list. Adjust the RUNBOOK sentence to match.
+
+No other issues found in the held/remodel split, the `--run-label` additions, the
+recompute-only path, or the exit-status paths.
diff --git a/planning/archive/2026-10-issue-348-recompute-after-failed-group/review-round3.md b/planning/archive/2026-10-issue-348-recompute-after-failed-group/review-round3.md
new file mode 100644
index 00000000..4073e07d
--- /dev/null
+++ b/planning/archive/2026-10-issue-348-recompute-after-failed-group/review-round3.md
@@ -0,0 +1,155 @@
+# Code-check round 3 — branch 348 (git diff c902ea97...HEAD)
+
+Reviewer: subagent, 2026-10-18. Read the branch diff, study_area_finish.sh,
+study_area_hosts.sh and the driver's arg parsing, discharge gate, recompute-only
+branch, dispatch legs, accounting, consolidate, release and tail, both RUNBOOK
+sections, rounds 1-2 and the plan review.
+
+Verified by running:
+- `test-study_area_finish.R` (NOT_CRAN=true): 12 tests, 0 failed, 0 error, 0 skipped.
+  Working tree clean before and after (nothing was edited in the repo).
+- Two direct calls of `hosts_kept_report` followed by `run_finish_report` (bash 5,
+  `set -euo pipefail`, both libs sourced, `host_split` stubbed to the measured state, no
+  DB). Scripts: `<scratchpad>/r3/unsettled.sh`, `<scratchpad>/r3/unmeasured.sh`. Output is
+  quoted in finding 1.
+
+## Mechanism
+
+The recovery advice is computed from a set **after the qualifier that makes the set mean
+something has been dropped**, or from a set taken at another time or in another process.
+`hosts_kept_report` decides what `CY_UNCONS` / `CY_PARTIAL` / `CY_DOUBT` mean through its
+local `measured` (yes / unsettled / no), and it never publishes that state. So any consumer
+of the three maps reads "finished", "failed" and "unknown" where the producer meant "finished
+when probed, may change", "may still be building", or "every candidate, not measured".
+Round 1 (whole set → re-model), round 2 (the bucket used as a proxy for the measured sets)
+and finding 1 below (measured sets used without their `measured` state) are three steps
+down the same slope. Findings 2-4 are the same shape with other sources: an exit flag from
+the accounting (database-only finished set) read where coverage is the truth, a recompute
+expected set from the dispatcher log printed where the run's own set is in scope, and the
+pool's exported environment absent from a printed command.
+
+The way to end it is to have each printed instruction read the same object as the instruction
+it must agree with: publish `CY_MEASURED[$ws]` from `hosts_kept_report`, and branch the
+report on it.
+
+## Findings
+
+- **[severity: bug]** data-raw/study_area_finish.sh:398-424 (with study_area_hosts.sh:491-519,
+  where `measured` stays local). The consolidate / check / re-model split ignores whether
+  the kept host was measured, and the kept-host block printed just above it (and
+  `hosts_kept_report`, and RUNBOOK §8d) says to act on `groups` **only where
+  `groups_measured = yes`**. Two reproduced cases:
+  - **measured=no** (round 1's scenario: the database did not answer at accounting and
+    still does not at report time). `hosts_kept_report` sets `CY_UNCONS` to the whole
+    candidate set, so every missing group in that bucket is printed as `consolidate these
+    from the host ..., do NOT re-model them: AAAA,BBBB,CCCC,DDDD`, beside `host did not
+    answer; candidates (NOT measured)` and `where it says no, find out what is left first`.
+    The candidate set includes the host's failed builds. For one that is also `COV_STALE`
+    (DDDD: an earlier run's valid rows on the dispatcher), consolidating the host's partial
+    build deletes those rows and copies the partial ones: `dest_log_newer` does not refuse
+    it, because the source's newest log row (this run's, open) is newer than the
+    dispatcher's (the earlier run's). That is a loss of valid data, reached by following
+    the line of the report that names the group.
+  - **measured=unsettled** (the documented case for `host_release`: the ssh session dropped,
+    exit 255, while the remote loop kept building). `CY_PARTIAL` is "NOT finished when
+    probed (may still be building)" and the kept block says "Re-measure once nothing runs
+    there", but the report puts it under `Re-model each of these under this run_uid: CCCC,DDDD`.
+    DDDD, not yet started on the host, gets the same advice. If the operator re-models them
+    and the host then finishes them, consolidating that host's `groups` is refused whole
+    (`dest_log_newer`: the dispatcher's re-model is newer), which also blocks the host's
+    other finished groups. The finished-when-probed groups are printed as "consolidate these"
+    even though the same report says only where `groups_measured = yes`.
+  The RUNBOOK §"A missing group costs only itself" sentence ("or that the host could not be
+  measured for ... consolidate it from the host, do not re-model it") contradicts §8d ("only
+  where `groups_measured` is `yes`") the same way.
+  Fix: have `hosts_kept_report` record `CY_MEASURED[$ws]` (declared with the other maps). In
+  the report, for a held host whose state is not `yes`, list every missing group of its
+  check set (bucket ∪ finished ∪ done ∪ uncons) as "on a kept host that is not measured or
+  not settled: re-measure there first; neither consolidate nor re-model yet", and apply the
+  current consolidate / doubt / re-model split only to hosts with `yes`. Align the RUNBOOK
+  sentence.
+
+- **[severity: fragile]** data-raw/study_area_finish.sh:429-433, the `RUN_INCOMPLETE` branch
+  with an empty `COV_MISSING`. `RUN_INCOMPLETE` starts from `complete_fail`, which
+  `host_account` sets from the database-only finished set, while coverage adds the `done`
+  markers and the consolidated buckets. Scenario: on a cypher the soft `date_end` UPDATE
+  fails for group G (`.lnk_log_run_finish`). Accounting marks G missing (complete_fail=1),
+  the `done` marker puts G in `CY_BUCKET_DONE`, G is consolidated, and coverage counts it
+  (`N/N run WSGs have rows from a build this run finished`). The run then exits 1 with "only
+  the WSGs it finished were consolidated ... Re-run the missing ones", and names none: there
+  are none, and the line contradicts the coverage line printed above it. Also reachable when
+  buckets overlap (`DUP`) and the other host finished the group. It fails closed, but the
+  instruction is wrong, and re-running is the wrong recovery (G is complete; only its log
+  row is open, which `--recompute-only` cannot rescue either, as documented). Fix: when
+  `COV_MISSING` is empty, say that coverage found every group finished and that the host's
+  accounting disagreed (see its `note:` lines: done in the log, not closed in the database),
+  instead of telling the operator to re-run.
+
+- **[severity: fragile]** data-raw/study_area_finish.sh:381-382 (and study_area_hosts.sh:537-538,
+  study_area_run.sh:1465-1466). The kept-host block's `--recompute-only` command has no
+  `--wsgs=`, so its expected set is the dispatcher log's. The missing-group block printed
+  under it in the same report passes `--wsgs=$RUN_WSGS`. A group that failed on a cypher
+  that was released and burned (its `CY_PARTIAL`; the round-2 fix routes it to re-model) has
+  no dispatcher log row. Following the kept-host command before that re-model ends `=== study_area_run done
+  ===`, exit 0, with the group missing; following the other command names it. The general
+  limit of the log-derived set is an accepted tradeoff, but here the report has `RUN_WSGS` in
+  scope and prints the weaker command beside the stronger one. Fix: append
+  `--wsgs=$RUN_WSGS` in run_finish_report's kept-host block. hosts_kept_report and the
+  consolidate-failure banner have no `RUN_WSGS` yet. They could pass
+  `DISP_BUCKET ∪ CY_BUCKET[*]`, or say "add --wsgs=<the run's groups>".
+
+- **[severity: fragile]** data-raw/study_area_finish.sh:457-458 and
+  data-raw/study_area_hosts.sh:539. The one-group recompute command (`LNK_SCHEMA=...
+  LNK_LOAD=loadall Rscript data-raw/wsg_recompute_one.R <WSG> <config>`) carries neither
+  `LNK_RUN_UID` nor `LNK_RUN_LABEL`. The pool's jobs inherit both from the driver's exports
+  (study_area_run.sh:389-390), and `.lnk_log_recompute_start()` defaults them from the
+  environment (R/lnk_log.R:1239), so a recompute done by hand from the printed line writes
+  that group's newest `log_recompute` row with `run_uid` NULL. That row describes what
+  ships. This is the residual instance of round 1's `--run-label` finding: round 1 fixed the
+  `--recompute-only` lines and not these. Fix: prefix `LNK_RUN_UID=$RUN_UID
+  ${RUN_LABEL:+LNK_RUN_LABEL=$RUN_LABEL }` on both.
+
+- **[severity: fragile]** data-raw/study_area_run.sh:639-671 (`--recompute-only`), against
+  `run_finish_report`'s held-host split. In `--recompute-only` `CY_WS_ARR` is empty, so
+  every missing group is printed as "Re-model each of these". Scenario: a full run keeps host
+  `a` with BBBB finished there (its `${TS}_kept_hosts.tsv` says to consolidate BBBB). The
+  operator re-models the report's re-model list and runs the printed `--recompute-only`
+  before consolidating `a`. That run's report says to re-model BBBB. Doing so wastes the
+  build and makes a later consolidate of `a` refused whole (`dest_log_newer`). The earlier
+  TSV survives on disk (`--recompute-only` never calls `hosts_kept_report`). Fix: in
+  `--recompute-only`, grep `$LOG_DIR/*_kept_hosts.tsv` for rows with this run_uid, and list
+  their `groups` apart ("on a host an earlier session of this run kept: consolidate, do not
+  re-model"). At minimum, print one line pointing at those files.
+
+## Enumeration: every recovery instruction, its source, and its source of truth
+
+| # | Where | Instruction | Computed from | Should agree with | Verdict |
+|---|---|---|---|---|---|
+| 1 | finish:367-379 | kept hosts: consolidate `groups` only where measured=yes, never partial | text, `KEPT_CAUSE_N` | TSV / hosts_kept_report / RUNBOOK §8d | agrees |
+| 2 | finish:373-379 | recompute each kept group + upstream (or every group) | `RECOMPUTE_RAN` at report time | hosts_kept_report's text | agrees with the trap re-print; the explicit-burn banner (driver:1484, before the recompute) says "did NOT run: recompute EVERY group". The trap re-prints it with `RECOMPUTE_RAN=1`, so the last banner agrees. Superseded, harmless |
+| 3 | finish:381-382 | `--recompute-only` (no `--wsgs`) | expected = dispatcher log | `RUN_WSGS` / row 9 | **disagrees** (finding 3) |
+| 4 | finish:386-391 | class lists | `COV_*` | coverage | agrees (it is the source) |
+| 5 | finish:408-411 | consolidate from host, do not re-model | `COV_MISSING ∩ ∪held CY_UNCONS` | hosts_kept_report `measured`, RUNBOOK §8d | **disagrees** for measured=no / unsettled (finding 1) |
+| 6 | finish:412-415 | unknown provenance: check first | `∪held CY_DOUBT` | hosts_kept_report | agrees for yes; on unsettled the kept text says it may change (folded into finding 1) |
+| 7 | finish:416-417 | re-model | remainder, incl. `CY_PARTIAL` and groups absent from the host | hosts_kept_report: unsettled partial = "may still be building, re-measure" | **disagrees** on unsettled (finding 1) |
+| 8 | finish:421-423 | re-model command env | `RUN_UID`, `RUN_LABEL`, `SCHEMA`, guard=warn | the dispatch legs' env (driver:1320, 1354) | agrees; SHA / bcfp-version exports fall back (plan review Gap 9, accepted) |
+| 9 | finish:427-428 | `--recompute-only --wsgs=$RUN_WSGS` | `RUN_WSGS` | the run's expected set | agrees |
+| 10 | finish:430-432 | "host did not account ... re-run the missing ones" | `complete_fail` (accounting, DB-only) | coverage | **disagrees** when COV_MISSING is empty (finding 2) |
+| 11 | finish:436-439 | compare re-run | `COMPARE_CSV`, `ALL_WSGS`, `CONFIG`, `LNK_SCHEMA` | run_finish_compare's call | agrees |
+| 12 | finish:456-458 | one-group recompute | `SCHEMA`, `CONFIG` | pool env (`LNK_RUN_UID`/`LABEL` exported) | **disagrees** (finding 4) |
+| 13 | finish:189-191 | recompute SKIPPED: nothing to settle | `ALL_WSGS` empty | coverage | agrees |
+| 14 | hosts:505-519 | per-host measured / unsettled / not-answered text | `measured`, `CY_UNCONS/PARTIAL/DOUBT` | itself (the source of truth) | agrees |
+| 15 | hosts:521-529 | consolidate only `groups`, measured=yes, never partial | text | RUNBOOK §8d | agrees |
+| 16 | hosts:530-536 | recompute kept + upstream / every group | `RECOMPUTE_RAN` at call time | row 2 | agrees per call (see row 2 on timing) |
+| 17 | hosts:537-538 | `--recompute-only` (no `--wsgs`, `--config=<config>`) | dispatcher log | the run's buckets | **disagrees** (finding 3; no `RUN_WSGS` in scope here) |
+| 18 | hosts:539 | one-group recompute | `SCHEMA` | pool env | **disagrees** (finding 4) |
+| 19 | hosts:541 | burn commands | `$@` (kept list) | the TSV | agrees |
+| 20 | hosts:373-375 | preflight: consolidate an earlier kept droplet, then burn | workspace match | `*_kept_hosts.tsv` | agrees |
+| 21 | driver:1463-1467 | consolidate failed: no group recomputed; `--recompute-only` once consolidated | text; dispatcher log | trap's hosts_kept_report ("did NOT run: every group") | agrees with the trap. Lacks `--wsgs` (finding 3); it exits before coverage, which is the accepted follow-up |
+| 22 | driver:657-665 | `--wsgs` subset WARN; "pass --wsgs= to have it named" | `RO_LOGGED` vs `RO_EXPECT` | the run's log groups | agrees |
+| 23 | driver:639-671 → finish:398-424 | the `--recompute-only` report's split | `CY_WS_ARR` empty, so every missing group is re-modelled | an earlier session's `*_kept_hosts.tsv` for this run_uid | **disagrees** (finding 5) |
+| 24 | RUNBOOK 1248-1253 | recovery code block: `LNK_RUN_UID=<uid> LNK_SCHEMA=<schema> ... wsg_run_one.R` | doc | report row 8 (adds guard=warn, run label) | **disagrees** mildly. Without `LNK_GUARD_DOWNSTREAM=warn`, a group whose downstream neighbour is also missing stops at the guard (the default is error). It fails loud, and adding the two env vars to the block fixes it |
+| 25 | RUNBOOK 1276-1280 | "could not be measured for ... consolidate it, do not re-model" | doc | RUNBOOK §8d "only where `groups_measured` is `yes`" | **disagrees** (finding 1) |
+
+No other issues: the coverage SQL and set arithmetic, the arg-parsing refusals, the config
+check, the moved pool functions and the exit-status paths still read correct after round 2.
diff --git a/planning/archive/2026-10-issue-348-recompute-after-failed-group/review-round4.md b/planning/archive/2026-10-issue-348-recompute-after-failed-group/review-round4.md
new file mode 100644
index 00000000..467926a0
--- /dev/null
+++ b/planning/archive/2026-10-issue-348-recompute-after-failed-group/review-round4.md
@@ -0,0 +1,134 @@
+# Code-check round 4 (terminating enumeration): branch 348 (git diff c902ea97...HEAD)
+
+Reviewer: subagent, 2026-10-18, at HEAD `1a5bcdee`. I re-walked round 3's 25-row table
+against the current code and added every printed recovery instruction it missed. Sources:
+every `echo` that prints a command or an instruction to act in `data-raw/study_area_finish.sh`,
+the `--recompute-only` branch, accounting and consolidate banner of `data-raw/study_area_run.sh`,
+`host_release`, `hosts_preflight_droplets` and `hosts_kept_report` in `data-raw/study_area_hosts.sh`,
+the usage header, and the RUNBOOK passages under "A missing group costs only itself".
+
+## Verified by running
+
+- `test-study_area_finish.R` with NOT_CRAN=true: 67 expectations, 0 failed, 0 skipped, no
+  error. `git status --short` was empty before and after.
+- I re-ran round 3's two repro scripts (`unsettled.sh`, `unmeasured.sh`), copied to
+  `<scratchpad>/r4/` with LOG_DIR moved to `<scratchpad>/r4w/`, against the current libs
+  (bash 5, `set -euo pipefail`). In both, the report puts the held host's missing groups under
+  "In a kept host's bucket: settle these per T_kept_hosts.tsv first ...". Neither prints a
+  consolidate or re-model instruction for them, and the TSV row carries `groups_measured`
+  (`unsettled`, `no`). Round 3's finding 1 is closed.
+- I tested the `RO_KEPT` probe (`<scratchpad>/r4/ro.sh`) with no TSV at all (the glob stays
+  literal), with a TSV for another uid, and with a TSV for this uid. On bash 5 and bash 3.2
+  under `set -euo pipefail`, every case exits 0, and only the matching file is printed.
+- The consolidate-failure banner's `cf_wsgs` loop sits inside `if [ "$N_CY" -gt 0 ]`, so
+  `CY_WS_ARR` cannot be empty there. Line 1409 already reads `${CY_BUCKET[$WS]}` unguarded for
+  every `WS`, so the banner adds no new `set -u` exposure. `DISP_BUCKET` is set at
+  driver:1194.
+- Quoting is not a problem. `RUN_LABEL` is restricted to `[A-Za-z0-9._-]`, `CONFIG` and `SCHEMA`
+  to `[A-Za-z0-9_]`, `RUN_UID` and `--wsgs` to fixed formats, and `${RUN_LABEL:+...}` is exempt
+  from nounset. So every printed command pastes as one valid line.
+
+## Findings
+
+- **[severity: fragile]** data-raw/study_area_run.sh:650-656 with data-raw/study_area_finish.sh:399-420.
+  This is what is left of round 3's finding 5; that round's suggested minimum fix was the one
+  applied.
+  - Under `--recompute-only`, `CY_WS_ARR` is empty, so `held` is empty. Every missing group is
+    therefore printed at the bottom of the report as "Re-model each of these under this
+    run_uid", with the ready-to-paste `wsg_run_one.R` command.
+  - The only qualifier is the WARN printed at the top, before coverage: "settle their groups per
+    these files first". The instruction the operator acts on, and the one the WARN must agree
+    with, are now in different parts of the output, and the actionable one is unqualified.
+  - Scenario: host `a` is kept with BBBB finished on it (`groups`, measured `yes`). The operator
+    runs `--recompute-only` before consolidating `a`. BBBB is listed to re-model. Re-modelling it
+    makes a later consolidate of `a` refused whole (`dest_log_newer`), which also blocks `a`'s
+    other finished groups.
+  - The mechanism is the same as rounds 1-3: the split reads a set (`CY_HOLD`/`CY_BUCKET`) that
+    is empty in this process, while the source of truth (`*_kept_hosts.tsv` for this uid) has
+    already been read by the same process (`RO_KEPT`).
+  - Fix: when `RO_KEPT` is non-empty, fill `held` from those files' `groups`, `groups_partial`
+    and `groups_unknown` columns on rows whose `run_uid` column is `$RUN_UID`:
+    `awk -F'\t' -v u="$RUN_UID" '$4 == u { print $6 "," $7 "," $8 }'`. For `measured=no`,
+    `groups` is already the whole candidate set. The existing `on_kept` lines then cover this
+    case too.
+  - Minimum alternative: when `${RO_KEPT:-}` is set, prefix the re-model line with "hosts were
+    kept for this run (see the WARN above): settle per those files first; some of these may be
+    on them".
+
+- **[severity: fragile, narrow]** data-raw/study_area_run.sh:1471-1476. The consolidate-failure
+  banner's `--wsgs=$cf_wsgs` is `DISP_BUCKET ∪ CY_BUCKET[*]`. That still includes `RUN_SKIP`:
+  groups a host SKIPped and no host finished. The full run's report passes `RUN_WSGS =
+  RUN_EXPECT`, which `run_expected_from_hosts` builds with those groups removed.
+  - With the banner's set, `--recompute-only` reports a SKIPped group as `no rows` and says to
+    re-model it. `wsg_run_one.R` SKIPs it again and writes no row, so the run exits 1 on every
+    attempt until the group is dropped from `--wsgs` by hand.
+  - Reachable only when a host's config or overrides disagree with the dispatcher's, which
+    `run_expected_from_hosts` already WARNs about.
+  - Fix: call `run_expected_from_hosts` at the banner and print `--wsgs=$RUN_EXPECT`. Every input
+    it reads (`ACC_*`, `CY_BUCKET_DONE`) is set by the accounting at driver:1403-1417, before
+    consolidate.
+
+No other defects. The round-3 fixes are correct as written: the `.hosts_inter`/`.hosts_minus`
+calls with an empty `held`, the `else` branch for accounting against coverage, the `--wsgs` on
+each `--recompute-only` line, `LNK_RUN_UID`/`LNK_RUN_LABEL` on both one-group recompute lines,
+and the RUNBOOK rewrite.
+
+## Observations (not defects)
+
+- An earlier session's `*_kept_hosts.tsv` is never removed once its host has been settled and
+  burned by hand (`hosts_kept_report` removes only its own `${TS}` file). So every later
+  `--recompute-only` for that uid repeats the WARN. That errs on the safe side (a WARN, exit
+  status unchanged), and the operator can clear it by moving the file.
+- The probe globs only `$LOG_DIR`. If a run's logs are moved into a campaign subdirectory
+  (`data-raw/logs/<campaign>/`, as for #246), the WARN goes silent.
+- `hosts_kept_report` prints `--config=<config>` as a placeholder, although `CONFIG` is in scope
+  when the driver calls it. `${CONFIG:-<config>}` would print the real value. A wrong config
+  is refused by `run_config_check`, so a paste fails loudly.
+
+## Enumeration: every recovery instruction, what it is computed from, and its source of truth
+
+Line numbers are at HEAD `1a5bcdee`. "R3 verdict" is round 3's verdict, and "Verdict now" is
+this round's.
+
+| # | Where | Instruction | Computed from | Source of truth | R3 verdict | Verdict now |
+|---|---|---|---|---|---|---|
+| 1 | finish:367-372 | kept hosts: consolidate `groups` only where measured=yes, never partial | text, `KEPT_CAUSE_N` | TSV / hosts_kept_report / RUNBOOK §8d | agrees | agrees |
+| 2 | finish:373-379 | recompute each kept group + upstream (or every group) | `RECOMPUTE_RAN` at report time | hosts_kept_report text | superseded, harmless (accepted) | unchanged (accepted) |
+| 3 | finish:380-382 | `--recompute-only ... --wsgs=$RUN_WSGS` | `RUN_WSGS` | the run's expected set | **disagreed** (no `--wsgs`) | **agrees**: `--wsgs` added; label carried |
+| 4 | finish:386-391 | class lists | `COV_*` | coverage | agrees | agrees (it is the source) |
+| 5 | finish:407-411 | kept host's bucket: settle per TSV, re-model only what is still missing | `COV_MISSING ∩ ∪held CY_BUCKET` | TSV `groups_measured` | **disagreed** | **agrees**: it defers to the TSV and claims nothing measured-state-dependent. Repro confirmed for unsettled and unmeasured |
+| 6 | (was finish:412-415) | unknown provenance: check first | — | — | agreed for yes | removed; the TSV's `groups_unknown` and the kept block's line hosts:505-506 carry it |
+| 7 | finish:412-413 | re-model the rest | `COV_MISSING − held bucket` | released hosts / dispatcher | **disagreed** on unsettled | **agrees** in a full run: a released host exited 0 and holds nothing finished. **Disagrees** under `--recompute-only` (row 23, finding 1) |
+| 8 | finish:417-419 | re-model command env | `RUN_UID`, `RUN_LABEL`, `SCHEMA`, guard=warn | dispatch legs' env | agrees | agrees (SHA exports fall back: accepted) |
+| 9 | finish:421-424 | `--recompute-only --wsgs=$RUN_WSGS` | `RUN_WSGS` | run's expected set | agrees | agrees |
+| 10 | finish:425-433 | accounting short, coverage complete: nothing to re-run | `RUN_INCOMPLETE` with `COV_MISSING` empty | coverage | **disagreed** | **agrees**: unreachable under `--recompute-only` (RUN_INCOMPLETE starts 0 there); tested |
+| 11 | finish:435-439 | compare re-run alone | `COMPARE_CSV`, `ALL_WSGS`, `CONFIG`, `SCHEMA` | run_finish_compare's call | agrees | agrees |
+| 12 | finish:456-458 | one-group recompute | `RUN_UID`, `RUN_LABEL`, `SCHEMA`, `CONFIG` | pool env (driver:389-390) | **disagreed** | **agrees** |
+| 13 | finish:188-191 | recompute SKIPPED: nothing to settle | `ALL_WSGS` empty | coverage | agrees | agrees |
+| 14 | hosts:504-519 | per-host measured / unsettled / not-answered text | local `measured`, `CY_UNCONS/PARTIAL/DOUBT` | itself | agrees | agrees (source of truth) |
+| 15 | hosts:521-529 | consolidate only `groups`, measured=yes, never partial | text | RUNBOOK §8d | agrees | agrees |
+| 16 | hosts:530-536 | recompute kept + upstream / every group | `RECOMPUTE_RAN` at call time | row 2 | agrees per call | agrees per call |
+| 17 | hosts:537-538 | `--recompute-only ... --wsgs=<the run's groups>` | placeholder (no `RUN_WSGS` in the lib) | the run's buckets | **disagreed** | **agrees**: the placeholder tells the operator to add it, and finish:382 prints the value in the same run |
+| 18 | hosts:539-540 | one-group recompute | `RUN_UID`, `RUN_LABEL`, `SCHEMA` | pool env | **disagreed** | **agrees** |
+| 19 | hosts:541-542 | burn commands | `$@` (kept list) | the TSV | agrees | agrees |
+| 20 | hosts:373-375 | preflight: consolidate an earlier kept droplet, then burn | workspace match | `*_kept_hosts.tsv` | agrees | agrees |
+| 21 | driver:1470-1477 | consolidate failed: `--recompute-only --wsgs=$cf_wsgs` once consolidated | `DISP_BUCKET ∪ CY_BUCKET` | `RUN_EXPECT` (buckets less `RUN_SKIP`) | agreed; lacked `--wsgs` | **agrees**, except that it includes `RUN_SKIP` (finding 2, narrow). Exits before coverage (accepted follow-up) |
+| 22 | driver:664-667 | `--wsgs` subset WARN | `RO_LOGGED − RO_EXPECT` | run's log groups | agrees | agrees |
+| 23 | driver:650-656 → finish:399-420 | the `--recompute-only` report's split | `CY_WS_ARR` empty, so every missing group is re-modelled; WARN at top | the earlier session's `*_kept_hosts.tsv` for this uid | **disagreed** | **partly**: a pointer WARN was added, but the bottom re-model line is unqualified (finding 1) |
+| 24 | RUNBOOK 1252-1258 | recovery code block | doc | report rows 8, 9 | **disagreed** mildly (no guard=warn) | **agrees**: `LNK_RUN_LABEL`, `LNK_GUARD_DOWNSTREAM=warn` added |
+| 25 | RUNBOOK 1276-1280 | missing group in a kept host's bucket: settle per TSV, consolidate only `groups` where measured=yes | doc | RUNBOOK §8d, row 5 | **disagreed** | **agrees** |
+| 26 | driver:650-656 | `--recompute-only` WARN: hosts kept for this uid, settle per files | `grep -l -F $RUN_UID $LOG_DIR/*_kept_hosts.tsv` | the TSVs | (new) | agrees; it can go stale after manual settlement, and is blind to logs moved to a subdirectory (observations) |
+| 27 | driver:670-672 | "pass the run's groups with --wsgs= to have it named" | text | run_expected_from_log's limit | not listed | agrees |
+| 28 | driver:1418-1421 | completeness WARN: run finishes, then exits non-zero | `complete_fail` | `RUN_INCOMPLETE=$complete_fail` at driver:1502 → `exit 1` | not listed | agrees |
+| 29 | finish:181-185 | NOTE: recomputing only the N above, the run will exit non-zero | `COV_MISSING` | `RUN_INCOMPLETE=1` → report `exit 1` | not listed | agrees |
+| 30 | finish:58-59 | WARN: SKIPped by a host, not expected | `RUN_SKIP` | `RUN_EXPECT` | not listed | agrees (row 21 is where `RUN_SKIP` is not applied) |
+| 31 | hosts:347-348 | released host: partial groups left there, "rebuild them" | `CY_PARTIAL` after release | report row 7 (they are `COV_MISSING`, outside `held`) | not listed | agrees: a released host's partials are printed under "Re-model" |
+| 32 | hosts:351 | `KEEPING it (groups: ...)` | `CY_UNCONS` after `host_split` | the TSV, rewritten in the trap | not listed | agrees: informational; the action text is the kept block |
+| 33 | hosts:292 / 311 | completeness ✗ lines "(see $log)" | `ACC_*` | — | not listed | agrees: diagnostic, no action |
+| 34 | driver:1439 / 1452 | nothing to consolidate from a host / from any host | `CY_BUCKET_DONE` | — | not listed | agrees: no action; the hosts stay held through host_release |
+| 35 | RUNBOOK 1272-1275 | `--recompute-only` cannot rescue a soft-failed `date_end`: re-model it | doc | run_coverage newest-row rule | not listed | agrees (accepted) |
+| 36 | RUNBOOK 1282-1288 | no lock; verify red for an open dispatcher row | doc | — | not listed | agrees (accepted) |
+| 37 | driver:82-90 (usage) | `--recompute-only --run-uid=<uid> [--wsgs=A,B]` | doc | arg parsing (237-264, 286-295) | not listed | agrees: `--config`/`--schema` are not in the line, but a missing one is refused loudly (schema guard, `run_config_check`) |
+
+Result: of the 37 rows, 34 agree, row 6 was removed with its instruction, row 21 agrees except for one narrow case, and row 23
+disagrees in part. All 9 rows that disagreed in round 3 now agree, apart from row 23.
diff --git a/planning/archive/2026-10-issue-348-recompute-after-failed-group/task_plan.md b/planning/archive/2026-10-issue-348-recompute-after-failed-group/task_plan.md
new file mode 100644
index 00000000..a43d4b36
--- /dev/null
+++ b/planning/archive/2026-10-issue-348-recompute-after-failed-group/task_plan.md
@@ -0,0 +1,44 @@
+# Task: One failed group skips the post-consolidate recompute for every group (#348)
+
+In `study_area_run.sh`, one failed group skips the post-consolidate recompute for every group in the run. The coverage check after consolidate asks whether every run group has rows in `<schema>.streams`, and `exit 1`s on the first miss. The recompute (`lnk_access(merge = TRUE)`, the correctness guarantee for cross-group access) comes after it. So when one group fails to model, the groups that did model lose their recompute and the compare. The gate also tests for rows, not rows from this run, so a failed group that still holds an earlier run's rows passes it unremarked.
+
+Design: `/Users/airvine/.claude/plans/quiet-hopping-umbrella.md` (approved 2026-10-18), summarised in findings.md.
+
+## Phase 1: Tests first (fixture schema, failing)
+- [x] Move `hosts_bash()` to `tests/testthat/helper-bash.R`, so both shell-lib test files share it; `test-study_area_hosts.R` still passes
+- [x] `tests/testthat/test-study_area_finish.R`: build a scratch schema with `skip_if_no_db()` + `.lnk_log_create_tables()` + a minimal `streams`. Groups:
+  - AAAA, BBBB closed this run, with rows;
+  - CCCC open row this run, no rows;
+  - DDDD rows plus another run's row;
+  - EEEE closed this run, no rows.
+- [x] Test: `run_coverage` splits into recompute / norows / stale / lost exactly
+- [x] Test: a `done` signal admits a group with rows and no closed row
+- [x] Test: a missing `streams` table is unknown (non-zero), never "all missing"
+- [x] Test: `run_expected_from_log` returns AAAA, BBBB, CCCC, EEEE
+- [x] Test (acceptance 1): `run_finish` with one missing group runs the real pool (an Rscript stub records calls) and the compare over exactly the recompute set, exits 1, and names the missing group. The lib-level test stands in for the driver, whose `LOG_DIR` is under the repo.
+- [x] Test (acceptance 2): zero groups with rows: the pool and compare are not called, it returns 1, and it says why
+- [x] Test: the driver refuses `--run-uid` alone, `--recompute-only` alone, a malformed uid, and `--recompute-only --focal=…` (all exit before any Rscript)
+
+## Phase 2: `data-raw/study_area_finish.sh` + driver wiring
+- [x] Write the lib (`run_coverage`, `run_expected_from_log`, `run_finish`) and move the tail into `run_finish` with the changes above
+- [x] Driver: new flags and validation, move the pool function block above the pre-flight, add the `--recompute-only` branch, normal path calls `run_finish`; update the header usage and "Post-conditions" comment
+- [x] `bash -n` both scripts; Phase 1 tests pass; `pool_probe.sh data-raw/study_area_run.sh` still passes (the extraction still works)
+
+## Phase 3: Docs
+- [x] RUNBOOK §8d: the coverage classes, recompute over this run's finished groups, `--recompute-only --run-uid` recovery (replace the "coverage FATAL" wording at ~`:1291`)
+- [x] `CLAUDE.md` #246 status fact on #348: state the new behaviour
+- [x] `research/study_area_run.md`: one line where the run's recovery is described, if it names the coverage exit
+
+## Phase 4: Verification
+- [x] Mutation: restore `exit 1` on missing in a copy of the lib (`LNK_TEST_FINISH_LIB`), and confirm acceptance test 1 goes red
+- [x] Live, read-only: `run_coverage` against `fresh_default` for run_uid `20261017_004619-3f4c713b` with the 241 groups gives 241 recompute and 0 missing (no recompute run)
+- [x] `devtools::test()` full suite (3195 pass; 4 pre-existing failures in prepare golden dams and wsg_resolve closure, no R/ change on this branch), `lintr` on the new test file (only the package-wide object_usage baseline for setup.R helpers)
+- [x] Plan review (`review-plan.md`) folded in: config check, newest-row rule, compare failure reaches the report, `run_expected_from_hosts` (tested), coverage TSV, discharge skipped in recompute-only, recovery text, `--wsgs=` subset warning
+- [x] Extra mutants: dropping the newest-row term, and the empty-set skip, each turn their test red
+
+## Validation
+
+- [x] Tests pass
+- [x] `/code-check` clean (each commit, or once over the branch with `/code-check branch`)
+- [x] PWF checkboxes match landed work
+- [ ] `/planning-archive` on completion
diff --git a/research/study_area_run.md b/research/study_area_run.md
index aaaddadc..197302f0 100644
--- a/research/study_area_run.md
+++ b/research/study_area_run.md
@@ -242,7 +242,9 @@ cloud hosts, `--refresh-primitives`, link `ee21eb13`. Both verifiers pass at
   their only copy. Two groups failed on bugs fixed in `a17e9177` (a duplicate
   PSCIS row from an xref that sets both ids; a logical `access_<sp>` for a
   present species with no barrier). One failed group would have skipped the
-  recompute for all of them (#348). The operator paused the driver, the 18 were
+  recompute for all of them (#348; since fixed: coverage now recomputes the
+  groups the run built and names the rest, and `--recompute-only
+  --run-uid=` finishes the run once those are re-modelled, RUNBOOK §8d). The operator paused the driver, the 18 were
   consolidated by hand, KITR and UPET re-ran on m1 under the same run_uid, and
   the driver resumed. So the run carries more than one link SHA: in `log`, 239
   groups `ee21eb13` and 2 `a17e9177`; in `log_recompute`, all 241 `a17e9177`,
diff --git a/tests/testthat/setup.R b/tests/testthat/setup.R
index 34b8c8ed..b0062926 100644
--- a/tests/testthat/setup.R
+++ b/tests/testthat/setup.R
@@ -72,3 +72,23 @@ capture_write <- function(expr, probe_rows = 0L, query_result = NULL) {
   )
   captured
 }
+
+# Shared by the tests that run data-raw/ bash libs (test-study_area_hosts.R,
+# test-study_area_finish.R).
+# The libs need bash >= 4 (assoc arrays); macOS /bin/bash is 3.2.
+hosts_bash <- function() {
+  cands <- unique(c(
+    "/opt/homebrew/bin/bash", "/usr/local/bin/bash",
+    unname(Sys.which("bash"))
+  ))
+  for (b in cands[nzchar(cands) & file.exists(cands)]) {
+    v <- suppressWarnings(system2(b, c("-c", shQuote("echo ${BASH_VERSINFO[0]}")),
+      stdout = TRUE, stderr = FALSE
+    ))
+    n <- suppressWarnings(as.integer(v))
+    if (length(n) == 1L && !is.na(n) && n >= 4L) {
+      return(b)
+    }
+  }
+  ""
+}
diff --git a/tests/testthat/test-study_area_finish.R b/tests/testthat/test-study_area_finish.R
new file mode 100644
index 00000000..c8fe6a11
--- /dev/null
+++ b/tests/testthat/test-study_area_finish.R
@@ -0,0 +1,370 @@
+# data-raw/study_area_finish.sh: which groups have rows from this run, and the
+# recompute and compare over those (link#348). The lib is bash, so each test
+# runs it in a bash process against a scratch schema on the local docker
+# fwapg, with the driver's own pool functions and an Rscript stub on PATH that
+# records its calls instead of running anything.
+#
+# data-raw/ is .Rbuildignore'd, so under R CMD check the scripts are absent and
+# these skip; devtools::test() from the source tree runs them.
+
+# LNK_TEST_FINISH_LIB points the tests at a mutant copy (proving they fail).
+finish_lib <- function() {
+  p <- Sys.getenv(
+    "LNK_TEST_FINISH_LIB",
+    testthat::test_path("..", "..", "data-raw", "study_area_finish.sh")
+  )
+  normalizePath(p, mustWork = FALSE)
+}
+finish_hosts_lib <- function() {
+  normalizePath(testthat::test_path("..", "..", "data-raw", "study_area_hosts.sh"),
+                mustWork = FALSE)
+}
+finish_driver <- function() {
+  normalizePath(testthat::test_path("..", "..", "data-raw", "study_area_run.sh"),
+                mustWork = FALSE)
+}
+
+skip_if_no_finish_lib <- function() {
+  testthat::skip_if_not(file.exists(finish_lib()), "data-raw/study_area_finish.sh absent")
+  if (!nzchar(hosts_bash())) {
+    testthat::fail("no bash >= 4 found; the study_area_finish.sh tests cannot run")
+  }
+}
+
+finish_uid <- "20261018_000000-0000abcd"
+
+# A scratch persist schema: the log tables, and a streams table holding only
+# what coverage reads. AAAA and BBBB finished this run; CCCC opened a log row
+# this run and failed; DDDD holds an earlier run's rows; EEEE finished this
+# run and its rows are gone (lost at consolidate); HHHH finished this run and
+# a later run rebuilt it; IIII finished this run, then a hand re-run under the
+# same uid failed after its pre-persist.
+finish_fixture <- function(conn, env = parent.frame(), streams = TRUE) {
+  psql <- Sys.which("psql")
+  testthat::skip_if(!nzchar(psql), "psql not on PATH")
+  info <- DBI::dbGetInfo(conn)
+  testthat::skip_if(!identical(as.character(info$port), "5432") ||
+                      !info$host %in% c("localhost", "127.0.0.1"),
+                    "not the local docker fwapg the lib reads")
+  sc <- paste0("lnk_test_finish_", Sys.getpid(), if (streams) "" else "_nostreams")
+  DBI::dbExecute(conn, "SET client_min_messages TO warning")
+  DBI::dbExecute(conn, sprintf("DROP SCHEMA IF EXISTS %s CASCADE", sc))
+  link:::.lnk_log_create_tables(conn, sc)
+  withr::defer(
+    DBI::dbExecute(conn, sprintf("DROP SCHEMA IF EXISTS %s CASCADE", sc)),
+    envir = env
+  )
+  u <- finish_uid
+  later <- "20261101_000000-0000beef"
+  sql_log <- sprintf(paste(
+    "INSERT INTO %s.log",
+    "(run_id, watershed_group_code, date_start, date_end, run_uid, config_name)",
+    "VALUES ('a', 'AAAA', '2026-10-18', '2026-10-18', '%s', 'default'),",
+    "('b', 'BBBB', '2026-10-18', '2026-10-18', '%s', 'default'),",
+    "('c', 'CCCC', '2026-10-18', NULL, '%s', 'default'),",
+    "('d', 'DDDD', '2026-08-01', '2026-08-01', '20260801_000000-00000000', 'default'),",
+    "('e', 'EEEE', '2026-10-18', '2026-10-18', '%s', 'default'),",
+    "('h1', 'HHHH', '2026-10-18', '2026-10-18', '%s', 'default'),",
+    "('h2', 'HHHH', '2026-11-01', '2026-11-01', '%s', 'default'),",
+    "('i1', 'IIII', '2026-10-18', '2026-10-18', '%s', 'default'),",
+    "('i2', 'IIII', '2026-10-19', NULL, '%s', 'default')"
+  ), sc, u, u, u, u, u, later, u, u)
+  DBI::dbExecute(conn, sql_log)
+  if (streams) {
+    DBI::dbExecute(conn, sprintf(
+      "CREATE TABLE %s.streams (watershed_group_code varchar(4) NOT NULL)", sc
+    ))
+    DBI::dbExecute(conn, sprintf(paste(
+      "INSERT INTO %s.streams VALUES",
+      "('AAAA'), ('AAAA'), ('BBBB'), ('DDDD'), ('FFFF'), ('HHHH'), ('IIII')"
+    ), sc))
+  }
+  sc
+}
+
+# A scratch world: an Rscript stub recording every call, and the dirs the
+# driver writes logs and per-job files into.
+finish_world <- function(env = parent.frame()) {
+  d <- withr::local_tempdir(.local_envir = env)
+  for (sub in c("bin", "logs")) dir.create(file.path(d, sub))
+  p <- file.path(d, "bin", "Rscript")
+  writeLines(c("#!/bin/sh", sprintf('echo "$*" >> "%s/rscript_calls"', d), "exit 0"), p)
+  Sys.chmod(p, "755")
+  d
+}
+
+rscript_calls <- function(world) {
+  p <- file.path(world, "rscript_calls")
+  if (file.exists(p)) readLines(p) else character(0)
+}
+
+# Run `body` with both libs sourced, the driver's pool functions extracted
+# from it as pool_probe.sh does, and the driver's globals set.
+run_finish_sh <- function(world, schema, body) {
+  script <- file.path(world, "run.sh")
+  drv <- shQuote(finish_driver())
+  writeLines(c(
+    "set -euo pipefail",
+    sprintf("source %s", shQuote(finish_hosts_lib())),
+    sprintf("source %s", shQuote(finish_lib())),
+    sprintf("eval \"$(sed -n '/^csv_lines() {/p' %s)\"", drv),
+    sprintf("eval \"$(sed -n '/^csv_count() {/p' %s)\"", drv),
+    sprintf("eval \"$(awk '/^recompute_one\\(\\)/,/^}/' %s)\"", drv),
+    sprintf("eval \"$(awk '/^recompute_order\\(\\)/,/^}/' %s)\"", drv),
+    sprintf("eval \"$(awk '/^run_recompute_pool\\(\\)/,/^}/' %s)\"", drv),
+    sprintf("SCHEMA=%s; RUN_UID=%s; CONFIG=default; TS=T0", schema, finish_uid),
+    sprintf("LOG_DIR=%s; REPO_ROOT=%s; RECOMPUTE_JOBS=2",
+            shQuote(file.path(world, "logs")), shQuote(world)),
+    "RECOMPUTE_FAIL=0; RECOMPUTE_FAIL_STAGE=''; RUN_INCOMPLETE=0",
+    body
+  ), script)
+  out <- withr::with_envvar(
+    c(PATH = paste(file.path(world, "bin"), Sys.getenv("PATH"), sep = ":")),
+    suppressWarnings(system2(hosts_bash(), script, stdout = TRUE, stderr = TRUE))
+  )
+  list(out = paste(out, collapse = "\n"), status = attr(out, "status") %||% 0L)
+}
+
+# The value a `name=<csv>` line printed by a test body carries.
+printed <- function(r, name) {
+  m <- regmatches(r$out, regexpr(sprintf("%s=[A-Z,]*", name), r$out))
+  if (length(m) == 0L) NA_character_ else sub("^[^=]*=", "", m)
+}
+
+cov_body <- function(expected, signals = "") {
+  c(
+    sprintf("run_coverage %s %s", shQuote(expected), shQuote(signals)),
+    paste0("echo \"STATE=$COV_STATE\"; echo \"REC=$COV_RECOMPUTE\"; ",
+           "echo \"NOROWS=$COV_NOROWS\"; echo \"STALE=$COV_STALE\"; ",
+           "echo \"LOST=$COV_LOST\"; echo \"MISSING=$COV_MISSING\"")
+  )
+}
+
+test_that("coverage splits the run's groups by what this run built", {
+  skip_if_no_finish_lib()
+  conn <- skip_if_no_db()
+  sc <- finish_fixture(conn)
+  w <- finish_world()
+  r <- run_finish_sh(w, sc, cov_body("AAAA,BBBB,CCCC,DDDD,EEEE,GGGG,HHHH,IIII"))
+  expect_equal(r$status, 0L, info = r$out)
+  expect_identical(printed(r, "REC"), "AAAA,BBBB")
+  expect_identical(printed(r, "NOROWS"), "CCCC,GGGG")
+  # A group's NEWEST log row decides: HHHH was rebuilt by a later run, and
+  # IIII's newest build under this uid never closed.
+  expect_identical(printed(r, "STALE"), "DDDD,HHHH,IIII")
+  expect_identical(printed(r, "LOST"), "EEEE")
+  expect_identical(printed(r, "MISSING"), "CCCC,DDDD,EEEE,GGGG,HHHH,IIII")
+  # FFFF has rows and is not a run group: it is in no class.
+  expect_false(grepl("FFFF", r$out))
+})
+
+test_that("a done signal admits a group with rows and no closed log row", {
+  skip_if_no_finish_lib()
+  conn <- skip_if_no_db()
+  sc <- finish_fixture(conn)
+  w <- finish_world()
+  r <- run_finish_sh(w, sc, cov_body("AAAA,DDDD", "DDDD"))
+  expect_equal(r$status, 0L, info = r$out)
+  expect_identical(printed(r, "REC"), "AAAA,DDDD")
+  expect_identical(printed(r, "MISSING"), "")
+})
+
+test_that("a persist with no streams table is unknown, never 'nothing has rows'", {
+  skip_if_no_finish_lib()
+  conn <- skip_if_no_db()
+  sc <- finish_fixture(conn, streams = FALSE)
+  w <- finish_world()
+  r <- run_finish_sh(w, sc, c(
+    "rc=0; run_coverage AAAA,CCCC '' || rc=$?",
+    "echo \"RC=$rc STATE=$COV_STATE\"; echo \"NOROWS=$COV_NOROWS\""
+  ))
+  expect_match(r$out, "RC=1 STATE=unknown", fixed = TRUE)
+  expect_identical(printed(r, "NOROWS"), "")
+})
+
+test_that("--recompute-only's expected set is every group with a log row for the run", {
+  skip_if_no_finish_lib()
+  conn <- skip_if_no_db()
+  sc <- finish_fixture(conn)
+  w <- finish_world()
+  r <- run_finish_sh(w, sc, "echo \"EXP=$(run_expected_from_log)\"")
+  expect_equal(r$status, 0L, info = r$out)
+  expect_identical(printed(r, "EXP"), "AAAA,BBBB,CCCC,EEEE,HHHH,IIII")
+})
+
+test_that("one missing group: the rest are recomputed and compared, and the run exits non-zero naming it", {
+  skip_if_no_finish_lib()
+  conn <- skip_if_no_db()
+  sc <- finish_fixture(conn)
+  w <- finish_world()
+  r <- run_finish_sh(w, sc, "run_finish AAAA,BBBB,CCCC ''")
+  expect_equal(r$status, 1L, info = r$out)
+  calls <- rscript_calls(w)
+  recomputed <- sort(sub(
+    "^data-raw/wsg_recompute_one\\.R ([A-Z]{4}) default$", "\\1",
+    grep("wsg_recompute_one", calls, value = TRUE)
+  ))
+  expect_identical(recomputed, c("AAAA", "BBBB"))
+  compare <- grep("study_area_compare", calls, value = TRUE)
+  expect_length(compare, 1L)
+  expect_match(compare, " AAAA,BBBB default$")
+  expect_match(r$out, "were NOT recomputed or compared: CCCC", fixed = TRUE)
+  expect_match(r$out, "--recompute-only --run-uid=20261018_000000-0000abcd", fixed = TRUE)
+  expect_match(r$out, "LNK_GUARD_DOWNSTREAM=warn", fixed = TRUE)
+  expect_match(r$out, "study_area_run INCOMPLETE", fixed = TRUE)
+  cov <- utils::read.delim(file.path(w, "logs", "T0_coverage.tsv"), colClasses = "character")
+  expect_identical(cov$class[order(cov$wsg)], c("recompute", "recompute", "no_rows"))
+})
+
+test_that("a missing group in a kept host's bucket defers to kept_hosts.tsv, the rest are re-modelled", {
+  skip_if_no_finish_lib()
+  conn <- skip_if_no_db()
+  sc <- finish_fixture(conn)
+  w <- finish_world()
+  # Host a is held: whatever its measured state, its groups are settled per
+  # kept_hosts.tsv first. Host b was released, so its bucket is re-modelled.
+  r <- run_finish_sh(w, sc, c(
+    "CY_WS_ARR=(a b); CY_BUCKET[a]=CCCC,DDDD; CY_HOLD[a]=1",
+    "CY_BUCKET[b]=GGGG; CY_HOLD[b]=0",
+    "RUN_LABEL=prov-246",
+    "run_finish AAAA,CCCC,DDDD,GGGG ''"
+  ))
+  expect_equal(r$status, 1L, info = r$out)
+  expect_match(r$out, "re-model only what is still missing: CCCC,DDDD", fixed = TRUE)
+  expect_match(r$out, "Re-model each of these under this run_uid: GGGG", fixed = TRUE)
+  expect_false(grepl("do NOT re-model", r$out, fixed = TRUE))
+  expect_match(r$out, "LNK_RUN_LABEL=prov-246", fixed = TRUE)
+  expect_match(r$out, "--run-label=prov-246 --wsgs=", fixed = TRUE)
+})
+
+test_that("--recompute-only lists the groups an earlier kept_hosts.tsv names apart", {
+  skip_if_no_finish_lib()
+  conn <- skip_if_no_db()
+  sc <- finish_fixture(conn)
+  w <- finish_world()
+  r <- run_finish_sh(w, sc, c(
+    "CY_WS_ARR=(); KEPT_TSV_GROUPS=CCCC",
+    "run_finish AAAA,CCCC,GGGG ''"
+  ))
+  expect_equal(r$status, 1L, info = r$out)
+  expect_match(r$out, "re-model only what is still missing: CCCC", fixed = TRUE)
+  expect_match(r$out, "Re-model each of these under this run_uid: GGGG", fixed = TRUE)
+})
+
+test_that("a failed compare still reaches the report, which names the missing groups", {
+  skip_if_no_finish_lib()
+  conn <- skip_if_no_db()
+  sc <- finish_fixture(conn)
+  w <- finish_world()
+  writeLines(c(
+    "#!/bin/sh", sprintf('echo "$*" >> "%s/rscript_calls"', w),
+    'case "$*" in *study_area_compare*) exit 1 ;; esac', "exit 0"
+  ), file.path(w, "bin", "Rscript"))
+  r <- run_finish_sh(w, sc, "run_finish AAAA,BBBB,CCCC ''")
+  expect_equal(r$status, 1L, info = r$out)
+  expect_match(r$out, "compare failed", fixed = TRUE)
+  expect_match(r$out, "LNK_RUN_UID=20261018_000000-0000abcd", fixed = TRUE)
+  expect_match(r$out, "were NOT recomputed or compared: CCCC", fixed = TRUE)
+})
+
+test_that("--recompute-only refuses a config the run was not built with", {
+  skip_if_no_finish_lib()
+  conn <- skip_if_no_db()
+  sc <- finish_fixture(conn)
+  w <- finish_world()
+  ok <- run_finish_sh(w, sc, "run_config_check")
+  expect_equal(ok$status, 0L, info = ok$out)
+  bad <- run_finish_sh(w, sc, "CONFIG=bcfishpass; run_config_check")
+  expect_equal(bad$status, 1L)
+  expect_match(bad$out, "built with config 'default', not --config=bcfishpass", fixed = TRUE)
+  DBI::dbExecute(conn, sprintf(
+    "UPDATE %s.log SET config_name = 'default_tuned' WHERE run_id = 'b'", sc
+  ))
+  mixed <- run_finish_sh(w, sc, "run_config_check")
+  expect_equal(mixed$status, 1L)
+  expect_match(mixed$out, "'default,default_tuned'", fixed = TRUE)
+})
+
+test_that("a full run expects every bucket less SKIPs no host finished, with every host's signals", {
+  skip_if_no_finish_lib()
+  w <- finish_world()
+  r <- run_finish_sh(w, "unused", c(
+    "DISP_BUCKET=AAAA,BBBB,SSSS; CY_WS_ARR=(a b)",
+    "CY_BUCKET[a]=CCCC,DDDD; CY_BUCKET[b]=EEEE,TTTT",
+    "ACC_FINISHED[dispatcher]=AAAA; ACC_DONE_LOG[dispatcher]=BBBB",
+    "ACC_SKIP[dispatcher]=SSSS; ACC_SKIP[a]=EEEE; ACC_SKIP[b]=TTTT",
+    "CY_BUCKET_DONE[a]=CCCC; CY_BUCKET_DONE[b]=EEEE",
+    "run_expected_from_hosts",
+    "echo \"EXP=$RUN_EXPECT\"; echo \"SIG=$RUN_SIGNALS\"; echo \"SKIP=$RUN_SKIP\""
+  ))
+  expect_equal(r$status, 0L, info = r$out)
+  # EEEE was SKIPped by a, which does not run it, and finished by b: kept.
+  expect_identical(printed(r, "EXP"), "AAAA,BBBB,CCCC,DDDD,EEEE")
+  expect_identical(printed(r, "SIG"), "AAAA,BBBB,CCCC,EEEE")
+  expect_identical(printed(r, "SKIP"), "SSSS,TTTT")
+  expect_match(r$out, "WARN: SKIPped by a host", fixed = TRUE)
+})
+
+test_that("no group with rows from this run: no recompute, no compare, and it says why", {
+  skip_if_no_finish_lib()
+  conn <- skip_if_no_db()
+  sc <- finish_fixture(conn)
+  w <- finish_world()
+  r <- run_finish_sh(w, sc, "run_finish CCCC,DDDD ''")
+  expect_equal(r$status, 1L, info = r$out)
+  calls <- rscript_calls(w)
+  expect_length(grep("wsg_recompute_one|study_area_compare|barriers_views_build", calls), 0L)
+  expect_match(r$out, "No run group has rows from a build this run finished", fixed = TRUE)
+  expect_match(r$out, "no rows:                         CCCC", fixed = TRUE)
+  expect_match(r$out, "an earlier run's or partial rows: DDDD", fixed = TRUE)
+})
+
+test_that("accounting short but coverage complete says so, and names no group to re-run", {
+  skip_if_no_finish_lib()
+  conn <- skip_if_no_db()
+  sc <- finish_fixture(conn)
+  w <- finish_world()
+  r <- run_finish_sh(w, sc, "RUN_INCOMPLETE=1; run_finish AAAA,BBBB ''")
+  expect_equal(r$status, 1L, info = r$out)
+  expect_match(r$out, "did not cover its whole bucket", fixed = TRUE)
+  expect_match(r$out, "recompute and the\n  compare above cover them all", info = r$out)
+  expect_length(grep("wsg_recompute_one", rscript_calls(w)), 2L)
+})
+
+test_that("a complete run recomputes every group and exits 0", {
+  skip_if_no_finish_lib()
+  conn <- skip_if_no_db()
+  sc <- finish_fixture(conn)
+  w <- finish_world()
+  r <- run_finish_sh(w, sc, "run_finish AAAA,BBBB ''")
+  expect_equal(r$status, 0L, info = r$out)
+  expect_match(r$out, "study_area_run done", fixed = TRUE)
+  expect_length(grep("wsg_recompute_one", rscript_calls(w)), 2L)
+})
+
+test_that("the driver refuses --run-uid / --wsgs without --recompute-only, and dispatch flags with it", {
+  skip_if_no_finish_lib()
+  run_drv <- function(...) {
+    out <- suppressWarnings(system2(hosts_bash(), c(shQuote(finish_driver()), ...),
+                                    stdout = TRUE, stderr = TRUE))
+    list(out = paste(out, collapse = "\n"), status = attr(out, "status") %||% 0L)
+  }
+  r <- run_drv(paste0("--run-uid=", finish_uid))
+  expect_equal(r$status, 1L)
+  expect_match(r$out, "--run-uid= is for --recompute-only", fixed = TRUE)
+  r <- run_drv("--wsgs=AAAA")
+  expect_equal(r$status, 1L)
+  expect_match(r$out, "--wsgs= is for --recompute-only", fixed = TRUE)
+  r <- run_drv("--recompute-only")
+  expect_equal(r$status, 1L)
+  expect_match(r$out, "needs --run-uid=", fixed = TRUE)
+  r <- run_drv("--recompute-only", "--run-uid=20261018-bad")
+  expect_equal(r$status, 1L)
+  expect_match(r$out, "--run-uid= must look like", fixed = TRUE)
+  r <- run_drv("--recompute-only", paste0("--run-uid=", finish_uid), "--focal=ADMS")
+  expect_equal(r$status, 1L)
+  expect_match(r$out, "--recompute-only takes no --focal", fixed = TRUE)
+  r <- run_drv("--recompute-only", paste0("--run-uid=", finish_uid), "--wsgs=ADMS,bulk")
+  expect_equal(r$status, 1L)
+  expect_match(r$out, "--wsgs= takes comma-separated", fixed = TRUE)
+})
diff --git a/tests/testthat/test-study_area_hosts.R b/tests/testthat/test-study_area_hosts.R
index 2aaaa0f1..6e8c83db 100644
--- a/tests/testthat/test-study_area_hosts.R
+++ b/tests/testthat/test-study_area_hosts.R
@@ -15,24 +15,6 @@ hosts_lib <- function() {
   normalizePath(p, mustWork = FALSE)
 }
 
-# The lib needs bash >= 4 (assoc arrays); macOS /bin/bash is 3.2.
-hosts_bash <- function() {
-  cands <- unique(c(
-    "/opt/homebrew/bin/bash", "/usr/local/bin/bash",
-    unname(Sys.which("bash"))
-  ))
-  for (b in cands[nzchar(cands) & file.exists(cands)]) {
-    v <- suppressWarnings(system2(b, c("-c", shQuote("echo ${BASH_VERSINFO[0]}")),
-      stdout = TRUE, stderr = FALSE
-    ))
-    n <- suppressWarnings(as.integer(v))
-    if (length(n) == 1L && !is.na(n) && n >= 4L) {
-      return(b)
-    }
-  }
-  ""
-}
-
 # Absent lib (R CMD check, installed tests) skips. A present lib with no
 # bash >= 4 FAILS: the driver needs bash >= 4 too, and nothing in CI runs
 # these, so a silent skip would read as coverage.