champollion 0.3.3 → 0.3.4

package/README.md

@@ -16,9 +16,9 @@ npx champollion sync
 
 Champollion auto-detects your locale files, their format, and the target languages. It translates missing keys, skips what's already done, and writes the results. That's it.
 
-> **Part of Champollion** — infrastructure for trustworthy machine translation
-> across every language, source-available and free for noncommercial use (the
-> evaluation harness and shared registries are open source). This CLI is the
+> **Part of Champollion** — infrastructure for trustworthy machine-translation
+> evaluation across every language, source-available and free for noncommercial
+> use (the evaluation harness and shared registries are open source). This CLI is the
 > deployment end of a larger
 > project that builds the test sets and the map showing who can translate what,
 > how good each method is on each kind of text, and where the gaps still are. It
@@ -26,8 +26,8 @@ Champollion auto-detects your locale files, their format, and the target languag
 > every method welcome) and sovereign benchmarks — secret test sets that
 > communities create, own, and control, and that we never see. The infrastructure
 > is source-available and singly stewarded; the test sets and the methods for a
-> community's language belong to that community. Built with communities, never
-> scraped from them — they hold the keys. Every method is welcome, human and
+> community's language belong to that community. Designed to work with communities,
+> never hosting their corpora — the design puts the keys in their hands. Every method is welcome, human and
 > machine. Explore the network at
 > [champollion.dev/docs/network](https://champollion.dev/docs/network/).
 
@@ -37,7 +37,7 @@ You could write a quick script that loops through your English keys and calls Go
 
 - **No change detection.** When you update an English string, the translation stays stale forever. Champollion tracks every source value with SHA-256 hashes and re-translates only what changed.
 - **No batching.** One API call per key means 200 keys = 200 round trips. Champollion batches intelligently (configurable, default 80 keys/batch for LLM, 128 for Google).
-- **No quality gate.** Machine translation hallucinates, echoes the source back, or outputs in the wrong script. Champollion validates every translation before writing it — wrong-script, length inflation, and source echoes are caught and rejected.
+- **No quality gate.** Machine translation hallucinates, echoes the source back, or outputs in the wrong script. Champollion checks every translation before writing it — empty output, source echoes, repetition loops, length inflation, deleted content and wrong script are caught and rejected. The gate catches broken output, not wrong meaning.
 - **No format awareness.** Hardcoded to JSON? Champollion handles JSON, TOML, YAML, and Hugo Markdown (frontmatter + body) with auto-detection.
 - **No safety.** Champollion guards against prototype pollution, path traversal via crafted locale codes, and code block corruption during Markdown translation.
 
@@ -118,17 +118,17 @@ You handle the i18n framework (next-intl, i18next, Hugo). Champollion handles th
 - **Multi-format** — JSON, TOML, YAML, Hugo Markdown (front matter + body), and XLIFF 1.2
 - **Incremental** — Only translates what changed (SHA-256 hash tracking)
 - **Cached** — Translation Memory stores previous results; re-running sync costs nothing for unchanged keys
-- **Quality-gated** — Validates every translation: catches hallucinations, wrong-script output, source echoes, and length inflation
+- **Quality-gated** — Checks every translation for broken output: repetition loops, wrong-script output, source echoes, length inflation and deleted content (it does not check meaning)
 - **Content-aware** — LLM methods shield code blocks, shortcodes, links, and interpolation variables during Markdown translation
 - **Pipeline tools** — `lint`, `audit`, `integrity`, `seo` for CI gates
 - **XLIFF interop** — Export translations for professional review in CAT tools (memoQ, SDL Trados, Phrase), import them back
-- **Minimal dependencies** — two runtime dependencies (better-sqlite3 for the bundled language database, CLDR locale names); no provider SDKs. Requires Node 20+
+- **Minimal dependencies** — two runtime dependencies: `@translated/lara` (the Lara provider SDK) and `cree-sro-syllabics` (ALTLab/NRC's Plains Cree SRO ⇄ syllabics converter). Requires Node 20+
 
 ## Beyond Google Translate
 
 The quick start gets you running with an LLM or Google Translate. But Google Translate supports ~130 languages. There are over 7,000.
 
-**Champollion's core idea: the translation method is configurable per language pair.** Use Google Translate for French, an LLM with morphological coaching for Plains Cree, and a community-hosted API for Quechua — all in the same project, all with the same CLI.
+**Champollion's core idea: the translation method is configurable per language pair.** Use Google Translate for French, an LLM coached with your own grammar notes and dictionary for Plains Cree, and an API you host for a language no service covers — all in the same project, all with the same CLI.
 
 ```json
 {
@@ -136,7 +136,7 @@ The quick start gets you running with an LLM or Google Translate. But Google Tra
   "pairs": {
     "en:fr": { "method": "google-translate" },
     "en:ja": { "method": "llm" },
-    "en:crk": { "methodPlugin": "crk-coached-v1" }
+    "en:crk": { "method": "llm-coached" }
   }
 }
 ```
@@ -188,7 +188,7 @@ champollion sync --method deepl
   "pairs": {
     "en:fr": { "method": "deepl" },
     "en:ja": { "method": "openai", "model": "gpt-4o" },
-    "en:crk": { "methodPlugin": "crk-coached-v1" }
+    "en:crk": { "method": "llm-coached" }
   }
 }
 ```

package/lib/cards/reader.js

@@ -386,10 +386,24 @@ export function normalizeCard(card) {
     if (scales) {
       const claims = attributions(out.endangerment);
       for (const source of scales.authorityOrder) {
-        const hit = claims.find((c) => String(c.source ?? '').startsWith(source));
+        // One source can hold several assessments (ELCat keeps one per
+        // record, each with its own certainty). The projector stores them
+        // alphabetically, which says nothing about confidence — reading the
+        // first one showed Plains Cree as "endangered" from a 0.2-certainty,
+        // BC-only record over ELCat's 0.8-certainty "threatened". Take the
+        // assessment the source is most certain of; ties keep stored order.
+        let hit = null;
+        let tier = null;
+        let best = -Infinity;
+        for (const c of claims) {
+          if (!String(c.source ?? '').startsWith(source)) continue;
+          const t = scales.scales[source]?.map?.[String(c.value).trim()];
+          if (!t) continue;
+          const m = /Certainty:\s*([0-9.]+)/.exec(String(c.note ?? ''));
+          const certainty = m ? Number(m[1]) : -1;
+          if (certainty > best) { best = certainty; hit = c; tier = t; }
+        }
         if (!hit) continue;
-        const tier = scales.scales[source]?.map?.[String(hit.value).trim()];
-        if (!tier) continue;
         out.vitality = {
           unescoStatus: tier,
           assessedBy: hit.source,

package/lib/command-help.js

@@ -195,9 +195,9 @@ const COMMAND_HELP = {
       '               your text is never uploaded or hosted; you keep custody.',
       '  public     — publish a metadata card + fetch-from-source pointer; text never',
       '               hosted by us, and gated to redistribution-cleared licenses.',
-      '  sealed     — encrypt the corpus ON YOUR DEVICE under the custodian group’s',
-      '               threshold key; we receive ciphertext + a content-free card only',
-      '               and cannot decrypt it. Paired with a public qualifier a method',
+      '  sealed     — encrypt the corpus ON YOUR DEVICE to the custodian group’s',
+      '               key; the ciphertext stays with you and we receive only a',
+      '               content-free card. Paired with a public qualifier a method',
       '               must clear before any sealed run can be proposed.',
       '',
       'Champollion never reads, uploads, or hosts your corpus plaintext in ANY tier.',

package/lib/commands/register-corpus.js

@@ -218,7 +218,7 @@ async function runInteractive(rl, args) {
     builder = await ask(rl, 'Builder adapter id (rebuilds from source, e.g. tatoeba-challenge)', builder || '');
   }
 
-  // Sealed tier — encrypt on this device, hand us ciphertext + a content-free card.
+  // Sealed tier — encrypt on this device; the ciphertext stays local, we get a content-free card.
   let custodianGroupId = args['custodian-group'] || null;
   let thresholdPubkey = args['threshold-pubkey'] || null;
   let sealInput = args['seal-input'] || null;
@@ -228,8 +228,8 @@ async function runInteractive(rl, args) {
   const keyScheme = args['key-scheme'] || null;
   if (tier.key === 'sealed') {
     console.log('');
-    console.log('  Sealed sets are encrypted ON THIS DEVICE before anything leaves.');
-    console.log('  We receive ciphertext + a content-free card only — we cannot read it.');
+    console.log('  Sealed sets are encrypted ON THIS DEVICE, and the ciphertext stays');
+    console.log('  where you write it. We receive only a content-free card.');
     console.log('');
     sealInput = await ask(rl, 'Path to the corpus file to seal (your plaintext, stays local)', sealInput || '');
     thresholdPubkey = await ask(rl, 'Custodian group threshold public key (path or PEM/base64)', thresholdPubkey || '');
@@ -307,7 +307,7 @@ function fromFlags(args) {
  * the custodian group's threshold PUBLIC key, write a ciphertext-ONLY artifact,
  * and return the content-free `sealed` card block. The plaintext never leaves
  * this machine in readable form; we hold only ciphertext + metadata, and we
- * cannot decrypt it (no single party can — see docs/governance/OCAP_MULTISIG_PLAN.md).
+ * cannot decrypt it (no single party can — see the community-custodian multisig plan in docs/governance).
  *
  * @returns {{cardBlock:object, artifactPath:string}|{error:string}}
  */
@@ -582,14 +582,14 @@ async function run(args, cwd) {
     console.log('  the public queue/leaderboard (custodian-controlled, WMT-style held-out).');
     console.log('');
     console.log('  Next: rebuild the registry, then evaluate privately:');
-    console.log('    npm run generate:registries          # from the repo root (arena)');
+    for (const line of REGISTRY_REBUILD_HINT) console.log(line);
     console.log(`    mt-eval run --corpus ${id} --private  # publish scores without exposing text`);
   } else {
     console.log('  A metadata card + fetch-from-source pointer is registered — your corpus');
     console.log('  TEXT is never hosted by Champollion; it is fetched from source on demand.');
     console.log('');
     console.log('  Next: rebuild the registry so the pair enters the public queue:');
-    console.log('    npm run generate:registries          # from the repo root (arena)');
+    for (const line of REGISTRY_REBUILD_HINT) console.log(line);
   }
   console.log('');
   return 0;
@@ -616,9 +616,9 @@ function showHelp() {
                  text never uploaded or hosted; you keep custody.
     public       Publish a metadata card + fetch-from-source pointer; text never
                  hosted by us. Requires a redistribution-cleared license (gated).
-    sealed       Encrypt the corpus ON YOUR DEVICE under the custodian group's
-                 threshold key; we receive ciphertext + a content-free card only
-                 and cannot decrypt it. Catalogued + quarantined; paired with a
+    sealed       Encrypt the corpus ON YOUR DEVICE to the custodian group's
+                 key; the ciphertext stays with you and we receive only a
+                 content-free card. Catalogued + quarantined; paired with a
                  public qualifier a method must clear before any sealed run.
 
   LICENSES  (--license)
@@ -675,4 +675,16 @@ function showHelp() {
   `);
 }
 
+/**
+ * The registry-rebuild step a registrant runs after a card lands. The registry
+ * (arena/datasets/registry*.json + the wheel's bundled copy) is BUILT from the
+ * cards by the Python builder — there is no npm script for it, and a printed
+ * next-step that does not exist is a broken door. Tested against the builder's
+ * real path in test/corpus-registration.test.js.
+ */
+export const REGISTRY_REBUILD_HINT = Object.freeze([
+  '    python3 arena/scripts/build_registry.py --diff   # from the monorepo root: preview the registry change',
+  '    python3 arena/scripts/build_registry.py          # rebuild arena/datasets/registry*.json (+ the bundled wheel copy)',
+]);
+
 export { run };

package/lib/commands/tm.js

@@ -438,7 +438,7 @@ async function runPrune(args, cwd) {
     }
     try {
       // Case-sensitive, no flags: banned-term patterns are usually
-      // case-shaped ("OCAP" vs a word that merely contains "ocap").
+      // case-shaped ("NASA" vs a word that merely contains "nasa").
       // Encode any case-insensitivity in the pattern itself ([Cc]…).
       matching = new RegExp(matchingRaw);
     } catch (err) {

package/lib/corpus-registration.mjs

@@ -191,7 +191,7 @@ export const EXPOSURE_TIERS = [
     uploadsCiphertext: true,    // an encrypted, content-free artifact MAY be produced
     tracked: true,
     explanation:
-      'Encrypts your corpus ON YOUR DEVICE under the custodian group’s threshold key BEFORE a single byte leaves. Champollion receives ciphertext + a content-free card only and CANNOT decrypt it (no single party can — it takes M-of-N custodians). Catalogued but quarantined; pair it with a public qualifier that methods must clear before any sealed run can be proposed.',
+      'Encrypts your corpus ON YOUR DEVICE to the custodian group’s key. The ciphertext is written where you choose and stays with you; Champollion receives only a content-free card and CANNOT decrypt anything. Catalogued but quarantined; pair it with a public qualifier that methods must clear before any sealed run can be proposed.',
   },
 ];
 
@@ -448,7 +448,7 @@ export function buildCorpusCard(o) {
     (isPublic
       ? 'Author-asserted at registration. Public fetch-from-source corpus; review upstream exposure before relying on this rating.'
       : isSealed
-        ? 'Sealed at registration — corpus encrypted client-side under the custodian group’s threshold key; only ciphertext + a content-free card exist on our side, so the plaintext is not present in any training set via this project.'
+        ? 'Sealed at registration — corpus encrypted client-side to the custodian group’s key; the ciphertext stays with the holder and only a content-free card reaches this project, so the plaintext is not present in any training set via this project.'
         : 'Private/unpublished at registration — text never uploaded or hosted, so not present in any training set via this project.');
 
   // source block — a fetch-from-source pointer ONLY for the public tier.
@@ -530,7 +530,7 @@ export function buildCorpusCard(o) {
   if (isSealed) {
     card.quarantine = true;
     card.quarantineReason =
-      'Sealed / community-controlled secret test set — corpus encrypted client-side under the custodian group’s threshold key (exposureTier=sealed). Only ciphertext + this content-free card exist on our side; no single party can decrypt. Catalogued but never publicly runnable; a sealed run requires M-of-N custodian approval (see OCAP multisig plan).';
+      'Sealed / community-controlled secret test set — corpus encrypted client-side under the custodian group’s threshold key (exposureTier=sealed). Only this content-free card reaches our side; the ciphertext stays with the holder, and no single party can decrypt it. Catalogued but never publicly runnable; a sealed run requires M-of-N custodian approval (see the community-custodian multisig plan).';
     if (o.sealed) card.sealed = o.sealed;
   }
 

package/lib/scripts.js

@@ -12,9 +12,11 @@
  *   - Japanese: Romaji → Hiragana/Katakana
  *   - Hindi: Romanized → Devanagari
  *
- * All converters here are DETERMINISTIC — no LLM needed, pure lookup tables.
- * They run as a post-translation hook: translate in working script, then
- * convert to display script.
+ * All converters here are DETERMINISTIC — no LLM needed: lookup tables, or a
+ * community-maintained converter where one exists (Plains Cree). They run as a
+ * post-translation hook: translate in working script, then convert to display
+ * script — and only over the spans of a string that are language, never over
+ * placeholders, ICU syntax, tags or URLs (see splitConvertible).
  *
  * ADDING A NEW CONVERTER:
  *   1. Add the conversion map below
@@ -23,115 +25,53 @@
  *   4. Add the `scripts` field to the language's register entry in registers.js
  */
 
+import creeSroSyllabics from 'cree-sro-syllabics';
+
 // -----------------------------------------------------------------
 // Plains Cree: SRO → Syllabics
 // -----------------------------------------------------------------
 
 /**
- * SRO to Cree Syllabics conversion table.
- *
- * This is the standard mapping used by the University of Alberta's
- * ALTLab and documented in Wolvengrey's Cree: Words dictionary.
+ * Plains Cree SRO ⇄ syllabics is delegated to `cree-sro-syllabics` (MIT;
+ * Eddie Antonio Santos, NRC — the converter ALTLab's itwêwina uses). The
+ * hand-written table this replaced mapped 62 of the 64 consonant+w+vowel
+ * syllables to the wrong glyph and had no bare w-series at all, so
+ * "nêhiyawêwin" came out as ᓀᐦᐃᔭᐤᐁᐤᐃᐣ instead of ᓀᐦᐃᔭᐍᐏᐣ, and no test
+ * checked a single real spelling. Cree spelling is the community converter's
+ * call; this module only decides which spans of a UI string it may touch
+ * (see splitConvertible / convertScript).
  *
- * The mapping is context-sensitive: consonant+vowel combinations map
- * to specific syllabic characters, while standalone consonants use
- * finals (small superscript forms).
- *
- * ORDER MATTERS: Longer sequences must be matched before shorter ones
- * (e.g., "twê" before "tw" before "t").
+ * Library conventions are kept as they are: a hyphen between preverb and
+ * verb becomes U+202F NARROW NO-BREAK SPACE, and a full stop after a syllabic
+ * becomes ᙮ (U+166E CANADIAN SYLLABICS FULL STOP).
  */
-const SRO_TO_SYLLABICS_MAP = [
-  // Long vowels with w-glide (must come before short vowel w-glide)
-  ['pwê', 'ᐻ'], ['pwî', 'ᐽ'], ['pwô', 'ᐿ'], ['pwâ', 'ᑁ'],
-  ['twê', 'ᑗ'], ['twî', 'ᑙ'], ['twô', 'ᑛ'], ['twâ', 'ᑝ'],
-  ['kwê', 'ᑵ'], ['kwî', 'ᑷ'], ['kwô', 'ᑹ'], ['kwâ', 'ᑻ'],
-  ['cwê', 'ᒑ'], ['cwî', 'ᒓ'], ['cwô', 'ᒕ'], ['cwâ', 'ᒗ'],
-  ['mwê', 'ᒫ'], ['mwî', 'ᒭ'], ['mwô', 'ᒯ'], ['mwâ', 'ᒱ'],
-  ['nwê', 'ᓇ'], ['nwî', 'ᓉ'], ['nwô', 'ᓋ'], ['nwâ', 'ᓍ'],
-  ['swê', 'ᓭ'], ['swî', 'ᓯ'], ['swô', 'ᓱ'], ['swâ', 'ᓳ'],
-  ['ywê', 'ᔋ'], ['ywî', 'ᔍ'], ['ywô', 'ᔏ'], ['ywâ', 'ᔑ'],
-
-  // Short vowels with w-glide
-  ['pwe', 'ᐺ'], ['pwi', 'ᐼ'], ['pwo', 'ᐾ'], ['pwa', 'ᑀ'],
-  ['twe', 'ᑖ'], ['twi', 'ᑘ'], ['two', 'ᑚ'], ['twa', 'ᑜ'],
-  ['kwe', 'ᑴ'], ['kwi', 'ᑶ'], ['kwo', 'ᑸ'], ['kwa', 'ᑺ'],
-  ['cwe', 'ᒐ'], ['cwi', 'ᒒ'], ['cwo', 'ᒔ'], ['cwa', 'ᒖ'],
-  ['mwe', 'ᒪ'], ['mwi', 'ᒬ'], ['mwo', 'ᒮ'], ['mwa', 'ᒰ'],
-  ['nwe', 'ᓈ'], ['nwi', 'ᓊ'], ['nwo', 'ᓌ'], ['nwa', 'ᓎ'],
-  ['swe', 'ᓬ'], ['swi', 'ᓮ'], ['swo', 'ᓰ'], ['swa', 'ᓲ'],
-  ['ywe', 'ᔊ'], ['ywi', 'ᔌ'], ['ywo', 'ᔎ'], ['ywa', 'ᔐ'],
-
-  // Long vowels (macron forms — these must come before short vowels)
-  ['pê', 'ᐯ'], ['pî', 'ᐲ'], ['pô', 'ᐴ'], ['pâ', 'ᐹ'],
-  ['tê', 'ᑌ'], ['tî', 'ᑏ'], ['tô', 'ᑑ'], ['tâ', 'ᑖ'],
-  ['kê', 'ᑫ'], ['kî', 'ᑮ'], ['kô', 'ᑰ'], ['kâ', 'ᑳ'],
-  ['cê', 'ᒉ'], ['cî', 'ᒌ'], ['cô', 'ᒎ'], ['câ', 'ᒑ'],
-  ['mê', 'ᒣ'], ['mî', 'ᒦ'], ['mô', 'ᒨ'], ['mâ', 'ᒫ'],
-  ['nê', 'ᓀ'], ['nî', 'ᓃ'], ['nô', 'ᓅ'], ['nâ', 'ᓈ'],
-  ['sê', 'ᓭ'], ['sî', 'ᓰ'], ['sô', 'ᓲ'], ['sâ', 'ᓵ'],
-  ['yê', 'ᔦ'], ['yî', 'ᔩ'], ['yô', 'ᔫ'], ['yâ', 'ᔮ'],
-
-  // Short vowels (consonant+vowel)
-  ['pe', 'ᐯ'], ['pi', 'ᐱ'], ['po', 'ᐳ'], ['pa', 'ᐸ'],
-  ['te', 'ᑌ'], ['ti', 'ᑎ'], ['to', 'ᑐ'], ['ta', 'ᑕ'],
-  ['ke', 'ᑫ'], ['ki', 'ᑭ'], ['ko', 'ᑯ'], ['ka', 'ᑲ'],
-  ['ce', 'ᒉ'], ['ci', 'ᒋ'], ['co', 'ᒍ'], ['ca', 'ᒐ'],
-  ['me', 'ᒣ'], ['mi', 'ᒥ'], ['mo', 'ᒧ'], ['ma', 'ᒪ'],
-  ['ne', 'ᓀ'], ['ni', 'ᓂ'], ['no', 'ᓄ'], ['na', 'ᓇ'],
-  ['se', 'ᓭ'], ['si', 'ᓯ'], ['so', 'ᓱ'], ['sa', 'ᓴ'],
-  ['ye', 'ᔦ'], ['yi', 'ᔨ'], ['yo', 'ᔪ'], ['ya', 'ᔭ'],
-
-  // Standalone vowels (long first)
-  ['ê', 'ᐁ'], ['î', 'ᐄ'], ['ô', 'ᐆ'], ['â', 'ᐋ'],
-  ['e', 'ᐁ'], ['i', 'ᐃ'], ['o', 'ᐅ'], ['a', 'ᐊ'],
-
-  // Digraphs (must come before single-char finals)
-  ['th', 'ᖧ'],
-
-  // Finals (standalone consonants — no following vowel)
-  ['p', 'ᑊ'], ['t', 'ᐟ'], ['k', 'ᐠ'], ['c', 'ᐨ'],
-  ['m', 'ᒼ'], ['n', 'ᐣ'], ['s', 'ᐢ'], ['y', 'ᐩ'],
-
-  // Special characters
-  ['h', 'ᐦ'], ['w', 'ᐤ'], ['l', 'ᓬ'], ['r', 'ᕒ'],
-];
+const { sro2syllabics, syllabics2sro } = creeSroSyllabics;
 
 /**
- * Convert SRO text to Cree Syllabics.
- *
- * This is a greedy left-to-right scan: at each position, try the longest
- * possible match first. Characters that don't match any pattern (spaces,
- * punctuation, numbers) pass through unchanged.
+ * Convert SRO text to Cree Syllabics. Letters the library does not recognise
+ * as SRO pass through unchanged; creeLeftoverLetters() reports them.
  *
  * @param {string} sro - SRO text to convert
  * @returns {string} Syllabics text
  */
 function sroToSyllabics(sro) {
-  const input = sro.toLowerCase();
-  let result = '';
-  let i = 0;
+  return sro2syllabics(sro);
+}
 
-  while (i < input.length) {
-    let matched = false;
+/** The Unified Canadian Aboriginal Syllabics blocks (base and extended). */
+const SYLLABICS_CHAR = /[\u1400-\u167F\u18B0-\u18FF]/u;
 
-    // Try longest matches first (up to 3 characters)
-    for (const [from, to] of SRO_TO_SYLLABICS_MAP) {
-      if (input.startsWith(from, i)) {
-        result += to;
-        i += from.length;
-        matched = true;
-        break;
-      }
-    }
-
-    // No match — pass character through (space, punctuation, etc.)
-    if (!matched) {
-      result += input[i];
-      i++;
-    }
+/**
+ * Letters the Cree converter left unconverted, derived from its behaviour:
+ * convert, then report every letter in the output that is not syllabics.
+ * Coverage therefore cannot drift from what the library actually does.
+ */
+function creeLeftoverLetters(text) {
+  const out = [];
+  for (const ch of sroToSyllabics(text)) {
+    if (/\p{L}/u.test(ch) && !SYLLABICS_CHAR.test(ch) && !out.includes(ch)) out.push(ch);
   }
-
-  return result;
+  return out;
 }
 
 // -----------------------------------------------------------------
@@ -456,9 +396,13 @@ const SCRIPT_CONVERTERS = {
     fromScript: 'Latn',
     toScript: 'Cans',
     type: 'deterministic',
-    map: SRO_TO_SYLLABICS_MAP,
+    // No table of our own: conversion, coverage and reversal all come from
+    // the cree-sro-syllabics library (see the Plains Cree section above).
+    map: null,
     puaRange: null,
     converter: sroToSyllabics,
+    leftoverLetters: creeLeftoverLetters,
+    reverse: syllabics2sro,
   },
   sr: {
     from: 'Latin',
@@ -815,6 +759,9 @@ function unmappedLetters(text, converterKey) {
   const conv = SCRIPT_CONVERTERS[converterKey];
   if (!conv || typeof text !== 'string' || text === '') return [];
 
+  // Library-backed converters report their own leftovers.
+  if (conv.leftoverLetters) return conv.leftoverLetters(text);
+
   // Kryptonian is arithmetic over A–Z with no table; every letter outside
   // the basic Latin alphabet is unmapped.
   if (!conv.map) {
@@ -830,9 +777,7 @@ function unmappedLetters(text, converterKey) {
   const sequences = mappedSequences(converterKey);
   // Converters that lowercase (or uppercase) their input before matching must
   // be probed in that same normalised form, or every capital reads as unmapped.
-  const probe = conv.converter === latinToTengwar || conv.converter === sroToSyllabics
-    ? text.toLowerCase()
-    : text;
+  const probe = conv.converter === latinToTengwar ? text.toLowerCase() : text;
 
   const out = [];
   let i = 0;
@@ -871,6 +816,11 @@ function reverseScript(text, converterKey) {
 
   const caseLossy = conv.converter !== romanizationToPiqad;
 
+  // Library-backed converters bring their own inverse (Cree: syllabics2sro).
+  if (conv.reverse) {
+    return { reversed: conv.reverse(text), caseLossy, unreversed: [] };
+  }
+
   if (!conv.map) {
     // Kryptonian: U+E100–E119 → A–Z.
     const [lo, hi] = conv.puaRange;
@@ -916,13 +866,136 @@ function isPrivateUse(codePoint) {
     || (codePoint >= 0x100000 && codePoint <= 0x10FFFD);
 }
 
+// Tokens inside ordinary message text that are code, not language: double-
+// brace and ${…} placeholders, printf tokens, HTML/XML tags, URLs, e-mail.
+const FLAT_PROTECTED = new RegExp([
+  String.raw`\{\{[^{}]*\}\}`,
+  String.raw`\$\{[^{}]*\}`,
+  String.raw`%(?:\d+\$)?[-+ #0]*\d*(?:\.\d+)?[sdifuxXoeEgGc@]`,
+  String.raw`%\([A-Za-z_][A-Za-z0-9_]*\)[sd]`,
+  String.raw`<\/?[A-Za-z][^<>]*>`,
+  String.raw`(?:https?:\/\/|www\.)[^\s<>{}"']+`,
+  String.raw`[\w.+-]+@[\w-]+\.[\w.-]+`,
+].join('|'), 'g');
+
+const ICU_BRANCHING = new Set(['plural', 'select', 'selectordinal']);
+
+/**
+ * Split a UI string into the spans a script converter may touch and the spans
+ * it must leave byte-for-byte.
+ *
+ * WHY: converters used to run over the whole value, so "tânisi, {name}!"
+ * became "ᑖᓂᓯ, {ᓇᒣ}!" and Serbian "{name}" became "{наме}" — a broken
+ * placeholder that crashes the app at render time and that nothing caught.
+ *
+ * Protected: ICU argument names, types, styles and plural/select selectors
+ * (the TEXT of each branch stays convertible, recursively), `#` in plural
+ * branches, and the FLAT_PROTECTED tokens. Concatenating the segments'
+ * `text` always reproduces the input exactly.
+ *
+ * @param {string} text
+ * @returns {{ text: string, convert: boolean }[]}
+ */
+function splitConvertible(text) {
+  const segments = [];
+  const push = (s, convert) => {
+    if (!s) return;
+    const last = segments[segments.length - 1];
+    if (last && last.convert === convert) last.text += s;
+    else segments.push({ text: s, convert });
+  };
+  const pushText = (s) => {
+    let at = 0;
+    for (const m of s.matchAll(FLAT_PROTECTED)) {
+      push(s.slice(at, m.index), true);
+      push(m[0], false);
+      at = m.index + m[0].length;
+    }
+    push(s.slice(at), true);
+  };
+  // Index of the brace that closes the one at `i`, or -1.
+  const matchingBrace = (i) => {
+    let depth = 0;
+    for (let k = i; k < text.length; k++) {
+      if (text[k] === '{') depth++;
+      else if (text[k] === '}' && --depth === 0) return k;
+    }
+    return -1;
+  };
+
+  // Message text from `i` until the end or (inBranch) the branch's closing
+  // brace; returns the index of that brace, or text.length.
+  function message(i, inBranch) {
+    let chunk = '';
+    while (i < text.length) {
+      const ch = text[i];
+      if (ch === '}' && inBranch) break;
+      if (ch === '{') {
+        pushText(chunk); chunk = '';
+        i = argument(i);
+        continue;
+      }
+      if (ch === '#' && inBranch) {
+        pushText(chunk); chunk = '';
+        push('#', false); i++;
+        continue;
+      }
+      chunk += ch; i++;
+    }
+    pushText(chunk);
+    return i;
+  }
+
+  // An ICU argument starting at the brace at `i`; returns the index after it.
+  function argument(i) {
+    const close = matchingBrace(i);
+    if (close === -1) { push(text[i], false); return i + 1; } // stray brace
+    // {{mustache}} and ${…} (the "$" was already pushed as text) stay whole.
+    if (text[i + 1] === '{' || text[i - 1] === '$') {
+      push(text.slice(i, close + 1), false);
+      return close + 1;
+    }
+    // Greedy name: a lazy one lets the optional ", plural," group match nothing.
+    const head = /^\{[^,{}]*(?:,\s*([A-Za-z]+)\s*,?)?/.exec(text.slice(i, close + 1));
+    const type = head?.[1];
+    if (!type || !ICU_BRANCHING.has(type)) {
+      push(text.slice(i, close + 1), false); // {name}, {n, number}, {d, date, short}
+      return close + 1;
+    }
+    // plural / select: protect the header and every selector, convert branches.
+    let k = i + head[0].length;
+    push(text.slice(i, k), false);
+    while (k < close) {
+      const sel = /^\s*[^\s{}]*\s*/.exec(text.slice(k, close))[0]; // "one ", "=0", "offset:1 "
+      push(sel, false); k += sel.length;
+      if (text[k] === '{') {
+        push('{', false);
+        k = message(k + 1, true);
+        push('}', false);
+        k += 1;
+      } else if (sel === '') {
+        break; // malformed; the remainder is protected below
+      }
+    }
+    push(text.slice(k, close + 1), false);
+    return close + 1;
+  }
+
+  message(0, false);
+  return segments;
+}
+
 /**
  * Convert text using the registered converter for a locale.
  *
+ * Only the spans splitConvertible() marks as language are converted;
+ * placeholders, ICU syntax, tags and URLs come back byte-for-byte.
+ *
  * `unmapped` lists letters the converter could not translate and passed
- * through as-is. A non-empty `unmapped` means the input was not valid text in
- * the converter's working script, and the output is a mix of both scripts —
- * callers must treat it as a failure rather than writing it out.
+ * through as-is, counted over the converted spans only. A non-empty
+ * `unmapped` means the input was not valid text in the converter's working
+ * script, and the output is a mix of both scripts — callers must treat it as
+ * a failure rather than writing it out.
  *
  * @param {string} text - Text in the source script
  * @param {string} localeCode - Locale code (e.g., "crk", "sr")
@@ -933,11 +1006,19 @@ function convertScript(text, localeCode) {
   if (!converter) {
     return { converted: text, converterUsed: null, unmapped: [] };
   }
+  const converterUsed = `${converter.from} → ${converter.to}`;
+  if (typeof text !== 'string' || text === '') {
+    return { converted: converter.converter(text ?? ''), converterUsed, unmapped: [] };
+  }
 
+  const segments = splitConvertible(text);
   return {
-    converted: converter.converter(text),
-    converterUsed: `${converter.from} → ${converter.to}`,
-    unmapped: unmappedLetters(text, localeCode),
+    converted: segments.map((s) => (s.convert ? converter.converter(s.text) : s.text)).join(''),
+    converterUsed,
+    unmapped: unmappedLetters(
+      segments.filter((s) => s.convert).map((s) => s.text).join(' '),
+      localeCode,
+    ),
   };
 }
 
@@ -990,5 +1071,6 @@ export {
   unmappedLetters,
   reverseScript,
   isPrivateUse,
+  splitConvertible,
   SCRIPT_CONVERTERS,
 };

package/lib/seal.mjs

@@ -2,7 +2,7 @@
  * seal.mjs — CLIENT-SIDE encryption for the SEALED exposure tier.
  *
  * This is the cryptographic front door for the zero-knowledge sovereign-eval
- * PoC (docs/governance/OCAP_MULTISIG_PLAN.md, mechanism M1). A community that
+ * PoC (community-custodian multisig plan, docs/governance, mechanism M1). A community that
  * chooses to make a held-out set centrally evaluable-on-demand encrypts it
  * **on their own machine, before a single byte leaves**, under a *threshold
  * public key* the platform cannot decrypt alone. Champollion ever only receives
@@ -47,7 +47,7 @@
  * format and the card block do NOT change under either model; that is the
  * whole point of the seam. Historical note: earlier docs named FROST here —
  * FROST is threshold *signing*, the wrong primitive for this decryption path;
- * see docs/governance/OCAP_MULTISIG_PLAN.md for the corrected framing.
+ * see the community-custodian multisig plan (docs/governance) for the corrected framing.
  *
  * @module seal
  */

package/lib/sealed-qualifier.mjs

@@ -3,7 +3,7 @@
  *
  * A sealed (community-controlled secret) test set is precious: every evaluation
  * against it leaks a little signal, and custodian approval is a real,
- * low-frequency act (M-of-N, docs/governance/OCAP_MULTISIG_PLAN.md M2). So a
+ * low-frequency act (M-of-N, community-custodian multisig plan M2, docs/governance). So a
  * method must EARN the right to even *propose* a sealed run by first clearing a
  * disjoint, fully public twin — the **qualifier**.
  *