clearotron 0.2.0 → 0.2.2

package/driver/publish/seed-pool.mjs

@@ -105,12 +105,20 @@ export function frozenSamples(examplesDir) {
  */
 export async function seedPool({ pool, examplesDir, republish }) {
   const existing = poolRunIds(pool);
-  if (existing.length) {
-    // Named with the count, not just refused. "It did not seed" and "it did not seed BECAUSE there are
-    // already 14 runs here" are the same non-event to the code and different facts to a reader.
-    return { seeded: [], skipped: `the pool already holds ${existing.length} run(s)`, problems: [] };
-  }
-
+  // ── A POOL THAT ALREADY HOLDS SOMETHING IS TOPPED UP, NOT SKIPPED (tracker issue 277) ──────────────
+  //
+  // This used to return early on any non-empty pool. That was invisible while `demo/` shipped one child:
+  // seeding one and seeding all were the same act. When the other three landed, every box seeded before
+  // that day kept its single demo through every upgrade, because the pool was no longer empty and this
+  // returned without looking at what the package now carried.
+  //
+  // DEMOS ARE PACKAGE CONTENT, NOT USER DATA, so the package's set is the one that should be there. What
+  // is already published is left exactly as it is — this adds what is missing and removes nothing, so a
+  // pool holding a run this package does not ship keeps it.
+  //
+  // AND IT IS ONLY EVER A DEMO POOL. `bin/start.mjs` calls this inside its `--demo` branch alone; a real
+  // install is told its archive is empty and pointed at the demo command. Nothing here can put an example
+  // into a pool holding a customer's work, and that gate is the reason this can top up safely at all.
   const { samples, problems } = frozenSamples(examplesDir);
   if (!samples.length) {
     // The empty archive is now the SYMPTOM of something, and this is where the something is named.
@@ -118,11 +126,13 @@ export async function seedPool({ pool, examplesDir, republish }) {
   }
 
   const seeded = [];
+  const already = [];
   const failures = [];
   for (const s of samples) {
-    // Belt and braces against a partial pool: the emptiness check above already means nothing is here,
-    // but a sample list carrying the same runId twice would otherwise overwrite silently.
+    // A sample list carrying the same runId twice would otherwise overwrite silently.
     if (seeded.includes(s.meta.runId)) { failures.push(`${s.name}: runId ${s.meta.runId} appears twice under ${examplesDir}`); continue; }
+    // Already published: left alone, and NAMED. Silence here is what the old early return produced.
+    if (existing.includes(s.meta.runId)) { already.push(s.meta.runId); continue; }
     try {
       // poolUrl "" for the same reason the demo passes it: the report's link block addresses a
       // deployment that serves the pool at a public URL, and this one is served from this machine.
@@ -133,5 +143,10 @@ export async function seedPool({ pool, examplesDir, republish }) {
       failures.push(`${s.name}: ${String(e?.message ?? e)}`);
     }
   }
-  return { seeded, skipped: null, problems: [...problems, ...failures] };
+  // `skipped` still carries a sentence when there was nothing to add, because "seeded 0" and "seeded 0
+  // BECAUSE all four were already here" are the same number and different facts.
+  const skipped = !seeded.length && already.length
+    ? `the pool already holds all ${already.length} example(s) this package ships`
+    : null;
+  return { seeded, already, skipped, problems: [...problems, ...failures] };
 }

package/driver/queue-watch-probe.mjs

@@ -87,7 +87,7 @@ const statExists = (p) => {
  * drains continuously under `--watch`, so there is no arrival to trigger and no schedule to wait for.
  * This module could not see that posture at all, which is why a box in it produced a permanent
  * "the .path unit could not be read" — honest, correct, and indistinguishable from an open finding
- * forever ('s third criterion, in the consumer that actually printed the line).
+ * forever (the third criterion, in the consumer that actually printed the line).
  *
  * ENABLED, NOT MERELY PRESENT, for the same reason the timer is read that way: an installed unit nobody
  * enabled drains nothing, and answering "present" would license the strongest sentence this module has

package/driver/queue-watch-verdict.mjs

@@ -46,7 +46,7 @@
 // precisely so they cannot come to different conclusions about the same box; they were still reaching
 // two different conclusions about the same *consequence*. This closes that.
 
-import { drainPosture, CONTINUOUS } from "./drain-posture.mjs";   // tracker issue 206 — one rule about the box
+import { drainPosture, CONTINUOUS } from "./drain-posture.mjs";   // one rule about the box
 
 /**
  * @param {object}   a

package/driver/recall-reconciliation.mjs

@@ -62,7 +62,7 @@ export const RECALL_TOP_SLICE = 10;
  * MOVED to coverage-ledger.mjs and re-exported here, so every existing import site is unchanged. It had
  * to move because coverage-form.mjs must carry the same token into the `seat_row_contract` it writes
  * INTO the file the seat edits, and that module is pure by contract while this one is not (it reaches
- * registry-fidelity.mjs, which reads the filesystem). A second copy of the literal is 's defect.
+ * registry-fidelity.mjs, which reads the filesystem). A second copy of the literal is the defect.
  *
  * `crowdRulingCount` moved for the SAME reason and rides the same re-export: the typed coverage
  * call now refuses an uncounted crowd row at call time, and it is pure, so the parser had to sit in the

package/driver/recipe-service.mjs

@@ -168,7 +168,7 @@ export function makeRecipeService({
     // the "reported outcome diverges from disk truth" class).
     if (!v.ok) return { status: 400, json: { error: "validation_failed", errors: v.errors } };
     const { files } = writeRecipe({ recipesDir, customer, slug, recipe: effective });
-    const message = `chore(prelim): ${existing ? (effective.archived && !existing.archived ? "archive" : "update") : "create"} saved search ${customer}/${slug} (via config UI, by ${by})`;
+    const message = `chore(clearotron): ${existing ? (effective.archived && !existing.archived ? "archive" : "update") : "create"} saved search ${customer}/${slug} (via config UI, by ${by})`;
     // — the row rides IN the commit, so it no longer names a sha. shared/store-in-repo.mjs says why.
     const { commit, commitError } = commitWithAuditRow({ audit, gitCommit, files, message, by,
       row: { event: existing ? "recipe-update" : "recipe-create", key: `${customer}/${slug}`, by,

package/driver/record-carry.mjs

@@ -103,7 +103,7 @@ export const TRACE_SCOPE = {
   uninstrumented: [
     { path: "common-law", reason: "common-law-grid.json → findings is not joined here; a candidate lost on that path emits NO row and this trace can say nothing about it either way" },
     { path: "case-law", reason: "case-law findings are not traced to a record at all" },
-    { path: "serp/nativeread", reason: "the #372 slices ARE built and write _driver/jx/zh-grid.json; nothing on them reaches this trace because it traces the register path only. Their carry is #402's, on the common-law tracer, because zh-grid.json carries the common-law cells[]+gaps[] shape and not a register band" },
+    { path: "serp/nativeread", reason: "reason: and write _driver/jx/zh-grid.json; nothing on them reaches this trace because it traces the register path only. Their carry is the common-law tracer's, because zh-grid.json carries the common-law cells[]+gaps[] shape and not a register band" },
     { path: "crowd remainder", reason: "count-only slices have no record bodies — enumerated per slice in untraceable_slices[], never per record" },
   ],
 };
@@ -125,7 +125,7 @@ export const TRACE_SCOPE = {
 // the only direction that also hides the 2 unreasoned drops the common-law trace DID find.
 //
 // So the declaration is derived from which sibling tracers actually produced a computable artifact on
-// THIS run, exactly as 's dictated set is read from the paths factory and 's obligations are one
+// THIS run, exactly as the dictated set is read from the paths factory and the obligations are one
 // calculation. A hand-kept list whose staleness is invisible is not a contract; it is a comment.
 //
 // UNCHANGED IN THE CONSERVATIVE DIRECTION: a path only moves to `instrumented` on positive evidence that
@@ -825,3 +825,142 @@ export function silentlyLostFindings({ reconciliation = null, carryRows = null,
     population_empty: false, cross_checked: crossChecked,
     checked: ended.length, matched: seen.length, lost };
 }
+
+/**
+ * Positions the DIGEST ended as findings that did not reach the findings, dropped WITH a stated reason.
+ *
+ * ── THE SIBLING'S BLIND SPOT, AND IT IS THE ONE THAT REACHED A CLIENT (tracker issue 248) ──────────
+ *
+ * `silentlyLostFindings` above is correct and must not be widened to cover this. Its population is
+ * `step-silent` — a finding-ending followed by silence — and its own header records why that boundary
+ * exists: silent drops are the norm (690 of 741 records on the evidence run), so a rule flagging them
+ * broadly would flag almost everything, and the defect it targets is the CONJUNCTION of silence after a
+ * finding-ending.
+ *
+ * It also anticipated this gap in writing: "nine divergences from a digest finding-ending, every one of
+ * them `step-stated`". Nine of the shape nothing checked.
+ *
+ * MEASURED ON A DELIVERED R2 RUN, 2026-09-06. The sibling ran and reported
+ * `{checked:5, matched:5, lost:0}` — correctly. On that same delivery two marks from the lawyer's final
+ * list, `OSLER DELPHI` and `DELFITY`, one rated HIGH, are absent from `findings.json`. They were dropped
+ * WITH a reason, so they sat outside the sibling's population by design:
+ *
+ *   IMMATERIAL ask:recall:recall-osler-delphi: … — OSLER DELPHI / Osler Diagnostics Limited is
+ *   already reasoned on the incumbent sheet in register-findings.md.
+ *
+ * WHY THE STATED CASE IS THE MORE DANGEROUS ONE. A silent drop leaves a hole. A stated drop leaves a
+ * SENTENCE, and the sentence reads as diligence. On that one delivery `doubt-closure.md` carries 92
+ * recall asks and 66 rulings of IMMATERIAL. A drop with a reason nobody verifies is not accounted for;
+ * it is unexamined with a paper trail.
+ *
+ * `step-structural` is deliberately NOT in this population: it is a mechanical screen verdict
+ * (`the in-line record screen returned "…"`), not a judgment sentence a reader would take on trust.
+ * `absent` belongs to the sibling's family, not this one.
+ *
+ * WHAT THIS DOES NOT DECIDE. Whether any given stated reason is RIGHT. That is a change to what the
+ * client receives and is the owner's call; this makes the class visible, which is worth having whichever
+ * way that lands, because today nobody would know the closures happened.
+ *
+ * Same contract as the sibling, deliberately: `computable:false` with a named reason rather than a clean
+ * `[]`; `population_empty` as its own state; `cross_checked` so a caller can tell "could not look" from
+ * "looked and found nothing"; and `matched` returned so a caller can insist the join actually joined —
+ * that field exists because a case-sensitive URI join once matched zero rows on every run and read as
+ * zero divergences. PURE.
+ */
+export function statedDivergenceFindings({ reconciliation = null, carryRows = null, digestFindingUris = null } = {}) {
+  const no = (reason, crossChecked = false) => ({ computable: false, reason, population_empty: false,
+    cross_checked: crossChecked, checked: 0, matched: 0, diverged: [] });
+  if (!reconciliation || reconciliation.computable !== true) {
+    return no("no computable recall-reconciliation — the digest's own endings are the population and there is none");
+  }
+  if (!Array.isArray(carryRows)) {
+    return no("no record-carry rows — the knockout lane writes none, so this join cannot look at that product");
+  }
+  // ── THE POPULATION IS THE CARRY ROWS, NOT THE RECONCILIATION (corrected 2026-09-07) ─────────────
+  //
+  // The first cut of this function gated on the reconciliation's finding-ended positions, mirroring the
+  // sibling. That inherited the sibling's BLIND SPOT along with its shape, and the check was inert on
+  // the very delivery it was written for. Replayed against that delivery:
+  //
+  //   silentlyLostFindings       checked=5 matched=5 lost=0
+  //   statedDivergenceFindings   checked=5 matched=5 diverged=0   ← should have named two marks
+  //
+  // The reconciliation names five finding-ended positions and they are five OTHER marks — VELTRIN
+  // bioenergetische Kosmetik, DELPHIC HSE, DELPHI, DELPHIN & EMERENCE, DELPHI DIAGNOSTICS. The two that
+  // were lost sit in the CARRY rows and the reconciliation never mentions them:
+  //
+  //   OSLER DELPHI  reach=placed stopped_at=digest reason_source=step-stated reason=digest:reasoned-negative
+  //   DELFITY       reach=placed stopped_at=digest reason_source=step-stated reason=digest:reasoned-negative
+  //
+  // The unit arms all passed because their fixtures put the mark in BOTH populations, which the real run
+  // does not. That is the lesson worth keeping: a fixture that satisfies two joins at once cannot tell
+  // you the joins disagree.
+  //
+  // So the carry rows are the population — they are where a stated drop is RECORDED — and the
+  // reconciliation is demoted to optional corroboration. Measured on that delivery, the correct
+  // population is 70 rows over 34 distinct marks, all `digest:reasoned-negative`, and it contains both.
+  const arrived = new Set(["finding", "findings-surface"]);
+  const population = carryRows.filter((r) => r?.uri
+    && r.reason_source === "step-stated"           // the sibling owns step-silent; step-structural is mechanical
+    && !arrived.has(r.reach));                     // arrived, or arrived somewhere visible, is not a divergence
+
+  // Kept for corroboration only. `ended` no longer gates anything; where the reconciliation DOES name a
+  // position it agrees with, that is recorded on the row so a reader can weigh it.
+  const ended = [];
+  for (const bucket of ["top_slice", "residual"]) {
+    for (const row of reconciliation[bucket] ?? []) {
+      if (row?.ending !== "finding") continue;
+      for (const uri of row.position_records ?? []) ended.push({ uri: lc(uri), mark: row.mark_text ?? null });
+    }
+  }
+  const endedUris = new Set(ended.map((e) => e.uri));
+  const byUri = new Map();
+  for (const r of carryRows) if (r?.uri) byUri.set(lc(r.uri), r);
+
+  // The disjoint-population guard, for the sibling's reason: overlap is the signal, a shortfall is not.
+  if (Array.isArray(digestFindingUris) && digestFindingUris.length && ended.length) {
+    const digest = new Set(digestFindingUris.map(lc));
+    if (!ended.some((e) => digest.has(e.uri))) {
+      return no(`the reconciliation's ${ended.length} finding-ended position(s) share NOTHING with the `
+        + `${digest.size} finding row(s) the digest's own typed calls recorded — the two populations are `
+        + "disjoint, so this join is examining a different set and its answer cannot be trusted", true);
+    }
+  }
+  // A ZERO POPULATION IS ITS OWN STATE. No stated drop recorded is a real answer on a healthy run, and
+  // it must not be reported in the same shape as "there were some and none diverged".
+  if (!population.length) {
+    return { computable: true, reason: "no record-carry row records a stated drop on this run — there is "
+      + "no population here, which is the healthy answer and not a comparison that found nothing",
+      population_empty: true, cross_checked: false, checked: 0, matched: 0, diverged: [] };
+  }
+
+  const diverged = [];
+  for (const row of population) {
+    const e = { uri: lc(row.uri), mark: row.mark ?? null };
+    // NAME THE ARTIFACT THE REASON POINTS AT. The defect this check exists for is an absence discharged
+    // by the WRONG artifact — "already reasoned in register-findings.md" answers a question nobody asked,
+    // because the ask was about the findings. Surfacing the cited artifact is what lets a reader see the
+    // substitution rather than read the sentence as diligence.
+    const reason = row.reason ?? null;
+    const cites = typeof reason === "string" ? (reason.match(/[a-z0-9._-]+\.(?:md|json)\b/gi) ?? []) : [];
+    diverged.push({ uri: e.uri, mark: e.mark ?? row.mark ?? null, reach: row.reach ?? null,
+      stopped_at: row.stopped_at ?? null, reason,
+      cites_artifact: cites.length ? [...new Set(cites.map(String))] : null,
+      // CORROBORATION, NOT A GATE. The reconciliation naming this position is worth a reader knowing;
+      // its SILENCE is not evidence of anything, which is exactly what the first cut got wrong.
+      reconciliation_agrees: endedUris.has(e.uri),
+      why: "this position was dropped with a stated reason and never reached the findings, and the reason "
+        + "given points at a different artifact than the one the absence is about" });
+  }
+  const crossChecked = Array.isArray(digestFindingUris) && digestFindingUris.length > 0;
+  return { computable: true,
+    reason: crossChecked ? null
+      : "no cross-check was possible — this run recorded no typed digest finding rows, so the "
+        + "population was not verified against an independent one",
+    population_empty: false, cross_checked: crossChecked,
+    // `checked` is the population this check actually walked, and `matched` how many of them the
+    // reconciliation ALSO named. On the delivery this was written for those are 70 and 0 — which is the
+    // whole point: a `matched` of zero used to mean "report nothing" and now means "the reconciliation
+    // saw none of them", a fact about the reconciliation rather than about the run.
+    checked: population.length, matched: diverged.filter((d) => d.reconciliation_agrees).length, diverged };
+}

package/driver/recording-agreement.mjs

@@ -25,7 +25,7 @@
 //       owns. Measured consequence, not a hypothesis: on 2e203b75 a blind-frame seat obeyed the prose and
 //       hand-wrote a 17182B model with no call capture beside it, on a box whose grant already carried
 //       the tool. The dictation deletes are; this direction is what keeps them deleted.
-//   (c) ORDERED BUT NOT GRANTED.  's seed direction. E12 owns it for skill docs; here it reaches the
+//   (c) ORDERED BUT NOT GRANTED.  That seed direction. E12 owns it for skill docs; here it reaches the
 //       dispatch and the repair ladder too.
 //
 // ── PURE, AND THAT IS WHAT MAKES THE PLANTS CHEAP ────────────────────────────────────────────────────
@@ -182,7 +182,7 @@ export function bareGrant(granted) {
  *   be silent on whichever repair path it did not happen to hold.
  * @param {Array<{surface:string, kind:string, text:string}>} a.union
  * @param {string[]} a.toolUniverse          every tool name that exists anywhere, for direction (c)
- * @param {Array<{stage:string, tool:string}>} [a.backlog]  's named, excused members — ONE list, read
+ * @param {Array<{stage:string, tool:string}>} [a.backlog]  the named, excused members — ONE list, read
  *   from contract-dictation-registry.mjs. A second excuse list here would be authoring number eight, which
  *   is the failure that registry's own header exists to forbid.
  * @param {Set<string>} [a.providerConditionalSurfaces]  surfaces that are provider-conditional BY
@@ -284,7 +284,7 @@ export function agreementFindings({ stage, granted, artifacts, union, toolUniver
   const excused = new Set(backlog.filter((b) => b.stage === stage).map((b) => b.tool));
   for (const tool of [...toolUniverse].sort()) {
     if (held.has(tool)) continue;
-    if (excused.has(tool)) continue;                 // named on 's backlog; the list can only shrink
+    if (excused.has(tool)) continue;                 // named on the backlog; the list can only shrink
     for (const m of union) {
       if (!namesTool(m.text, tool)) continue;
       // ── — A PROVIDER CANNOT SERVE IT, AND THIS ORDER SAYS SO ──────────────────

package/driver/reference-score.mjs

@@ -235,7 +235,7 @@ export function matchesReference(ref, candidate, { sameOwner = false } = {}) {
     return null;
   }
 
-  // 3 — ALIAS. splits this in two, on the same precedent as rules 1 and 4 (, "the scorer calls
+  // 3 — ALIAS. splits this in two, on the same precedent as rules 1 and 4 ("the scorer calls
   // a different owner's longer mark a hit"). This rule was the one cross-owner escape left open.
   //
   // FULL IDENTITY — one name on each side and they are the same name — is NOT a relaxation and stays
@@ -667,14 +667,64 @@ export function scoreRecall({ reference, findings = [], retrieved = [], scopeCla
   // what it saw. Auto-promoting a collision to `found` would be the scorer manufacturing recall from
   // its own confusion, which is the defect one layer up from the one being fixed. score.mjs prints
   // these; a reader adjudicates.
+  // ── THE PREDICATE WAS THE OWNER, AND THE HEADING ABOVE SAYS RECORD (tracker issue 249) ──────────
+  //
+  // The only condition used to be `ownersMatch`. That implements a different class from the one the
+  // paragraph above states, and the justification — "they cannot both be true" — does not hold for any
+  // proprietor with more than one mark. A large filer can perfectly well have one mark the run withheld
+  // and a DIFFERENT mark, not in the reference, that it surfaced. Both rows are true.
+  //
+  // It fired on a delivered R2 run: `<large filer>: reference "DELFITY" is withheld, surfaced "DELPHINA"
+  // is noise`. Different marks, different records, one proprietor that files a great many. And because
+  // score.mjs prints a collision as "do not read the recall numbers above", ONE such proprietor
+  // suppressed the whole run's recall measurement — a real 88% → 63% movement went unquoted on the
+  // regression issue because of a warning that was spurious.
+  //
+  // WHY NOT A RECORD JOIN, WHICH IS WHAT THE ISSUE ASKED FOR. Measured on the delivered artifact: a
+  // finding carries `{band, disposition, mark, meters, net, ordinal, owner, quadrant, source, …}` and
+  // NO record identity — `source.resolved_link` is empty on every row. Noise rows are built from
+  // findings, so there is nothing on that side to join a record URI to. Stating it here so the next
+  // reader does not re-derive it: the acceptance criterion is unmeetable on this side until a finding
+  // carries its record, and that is a change to the findings contract, not to the scorer.
+  //
+  // WHY NOT `matchesReference`, WHICH IS THE FILE'S OWN MARK MATCHER. It would make this check VACUOUS.
+  // The noise loop above already skips any finding that matches a reference entry, so by construction
+  // no noise row matches one — the collision would always be empty. This check exists precisely to
+  // catch the case where THE MATCHER DISAGREED WITH ITSELF, so it cannot be built out of the matcher.
+  //
+  // So the predicate is deliberately weaker than the matcher and stronger than the owner: same owner
+  // AND one mark contained in the other once normalised. That is the shape of the case this check was
+  // built for — `DELPHI GENETICS` in LOST beside `DG DELPHI GENETICS` in NOISE — and it is not the
+  // shape of `DELFITY` beside `DELPHINA`.
+  const collisionKey = (s) => String(s ?? "").normalize("NFKC").toUpperCase().replace(/[^A-Z0-9]/g, "");
+  // A FLOOR, because containment on a short string matches everything. `DEL` inside `DELPHINA` is not
+  // evidence of a shared record; four characters is the shortest reference mark shape worth trusting
+  // here, and a pair below it drops to the advisory rather than being dropped entirely.
+  const CONTAIN_FLOOR = 4;
   buckets.collisions = [];
+  buckets.ownerEchoes = [];
   for (const bucket of ["lost", "withheld"]) {
     for (const e of buckets[bucket]) {
       for (const n of buckets.noise) {
         if (!ownersMatch(e.owner, n.owner)) continue;
-        buckets.collisions.push({ bucket, entry: e.mark ?? e.name ?? null, noise: n.mark,
-          owner: ownerName(n.owner) ?? ownerName(e.owner),
-          why: `the reference entry is reported ${bucket} while a surfaced record of the SAME owner is reported noise — one record cannot be both` });
+        const a = collisionKey(e.mark ?? e.name);
+        const b = collisionKey(n.mark);
+        const row = { bucket, entry: e.mark ?? e.name ?? null, noise: n.mark,
+          owner: ownerName(n.owner) ?? ownerName(e.owner) };
+        const sameRecord = a && b
+          && Math.min(a.length, b.length) >= CONTAIN_FLOOR
+          && (a === b || a.includes(b) || b.includes(a));
+        if (sameRecord) {
+          buckets.collisions.push({ ...row,
+            why: `the reference entry is reported ${bucket} while a surfaced record of the SAME owner whose `
+              + "mark contains or is contained by it is reported noise — these are one record in two buckets" });
+        } else {
+          // REPORTABLE, NEVER SUPPRESSING. A reader may still want to see that a proprietor appears on
+          // both sides; what they must not be told is that the recall numbers are unreadable.
+          buckets.ownerEchoes.push({ ...row,
+            why: `same proprietor on both sides with different marks — not a contradiction: a filer may hold `
+              + `a reference mark this run ${bucket} and another, outside the reference, that it surfaced` });
+        }
       }
     }
   }
@@ -699,7 +749,7 @@ export function scoreRecall({ reference, findings = [], retrieved = [], scopeCla
  * AND THE DIRECTION IS THE DANGEROUS ONE. A `withheld` that over-counted would be investigated the first
  * round it appeared. This one reads clean.
  *
- * This does NOT compute carry-through — that needs the run's screened set and is 's acceptance 1.
+ * This does NOT compute carry-through — that needs the run's screened set and is the acceptance 1.
  * What it does is stop a bare `0` from reading as "nothing was dropped", by naming on the line how many
  * retrieved marks the number could not have spoken to. The file already refuses a bare `0` for the
  * no-`_driver/` case, in as many words; this is the same refusal for the case that reads clean.
@@ -1588,7 +1638,7 @@ export function ownersMatch(a, b) {
  * derives the same sentence from the delivery-time record instead: slice 1 from its per-lane map
  * (`slices.candidates.lanes[lane]`), slices 2–3 from their own `lane` field. PER LANE, never the
  * run-level join: the SERP grid is zh-only, so `lane ja: executes=candidates+serp-grid` would be a
- * claim about the ja lane that no record supports ('s fix, kept exact here).
+ * claim about the ja lane that no record supports (the fix, kept exact here).
  *
  * THREE ANSWERS, AND THE THIRD IS THE ONE THAT MATTERS:
  *   "candidates+serp-grid"  the named slices ran for this lane
@@ -1660,7 +1710,7 @@ export function readJxLanes(doc) {
       // — DERIVED from fold.slices, with the declaration as a LEGACY fallback only. Two artifact
       // generations reach this line and they are read in this order deliberately:
       //   fold.slices present     → derive. The record of what ran wins, always.
-      //   pre- artifact       → its frozen `lanes.<lane>.executes` string, the only thing that run
+      //   pre-change artifact       → its frozen `lanes.<lane>.executes` string, the only thing that run
       //                             ever recorded (a run minted between  and  carries BOTH, and
       //                             the derived value is the accurate one — hence the order).
       //   neither                 → null ⇒ the scorer prints "(not stated)". Not "none": no statement
@@ -1705,7 +1755,7 @@ export function readJxLanes(doc) {
     why: lanes.length ? null : "_driver/jx-lanes.json is present and declares no lane — the file was written and no jurisdiction lane was built, which is not the same as the file being absent",
     lanes,
     // — the RUN-level statement, three-valued on itself in the same discipline as the rest of this
-    // function: present, or absent with a reason. A pre- artifact and a fold that never ran are both
+    // function: present, or absent with a reason. A pre-change artifact and a fold that never ran are both
     // "the run did not state it", and neither is a pass.
     statement: typeof doc.fold?.executes === "string" ? doc.fold.executes : null,
     slices: doc.fold?.slices ?? null,
@@ -1728,7 +1778,7 @@ export function readJxLanes(doc) {
  *   present, no units    `present:true, units:[]` — its own fact, its own sentence.
  *   present, with units  each unit's own `degraded` / cause / attempts, nothing inferred.
  *
- * `degraded` is TYPEOF-tested, never coerced. A pre- units.json carries the cause STRING in that
+ * `degraded` is TYPEOF-tested, never coerced. A pre-change units.json carries the cause STRING in that
  * field; `Boolean(r.degraded)` would report an old artifact as having stated something it never stated.
  *
  * PURE.

package/driver/reference-strip-signatures.mjs

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// THE TWO SIGNATURES THE REFERENCE STRIP LEFT BEHIND (tracker issue 185).
+//
+// The strip's job was to remove internal references from this repository before it went public, and it
+// did that. Where the reference was the SUBJECT of the sentence, it took the subject with it:
+//
+//     "[ref]'s design ruling — above any fold, only a statement…"   became   "'s design ruling — …"
+//     "renders the pre-[ref] section"                              became   "renders the pre- section"
+//
+// Neither construction occurs in written English, which is the whole reason they can be counted rather
+// than judged. A reader of a public repository meets them as sentences that do not finish, and one of
+// them is in user-facing configuration documentation rather than in a comment.
+//
+// WHAT THIS MODULE IS AND IS NOT. It finds them. It does not repair them: the repair is per-sentence and
+// needs somebody reading the surrounding code, because "the pre- section" means "the section as it was
+// before the findings contract changed" and only that reader can say so. The finding is mechanical and
+// costs nothing, so it is the part that ships as a check.
+export const SIGNATURES = [
+  {
+    name: "a comment beginning with a bare possessive",
+    // Anchored at the comment leader, so `it's` and `the run's` mid-sentence are untouched — only the
+    // case where the possessive has nothing in front of it to possess.
+    re: /^\s*(?:\/\/|#|\*)\s*'s\b/,
+  },
+  {
+    name: "`pre- ` followed by a lowercase word",
+    // The hyphen is left dangling by a stripped number. `pre-flight` and `pre-delivery` do not match:
+    // the strip's residue always leaves whitespace after the hyphen.
+    re: /\bpre-\s+[a-z]/,
+  },
+];
+
+// THE RULE'S OWN DEFINITION IS THE ONLY EXEMPTION, and it is named rather than pattern-matched.
+//
+// These three files QUOTE the residue in order to define it: the specimens in the arm, the examples in
+// the header above. Scanning them counts the definition as an instance, which puts the guard's own text
+// into the backlog it polices and makes every re-mint grow the number it exists to shrink. Caught by a
+// plant, not by review — they were untracked when the table was first minted, so `git ls-files` did not
+// list them and the census read a tree that did not include them yet.
+export const RULE_DEFINITIONS = [
+  "driver/reference-strip-signatures.mjs",
+  "driver/test/the-reference-strip-left-sentences-unfinished.test.mjs",
+  "scripts/mint-reference-strip-backlog.mjs",
+];
+
+/** Files worth scanning: prose-bearing, tracked, not generated, and not this rule's own definition. */
+export const isScannable = (f) =>
+  /\.(mjs|md|yml|ts)$/.test(f) && !f.startsWith("portal-ui/dist/") && !RULE_DEFINITIONS.includes(f);
+
+/**
+ * Count both signatures per file across `files`.
+ * `read` is injected so an arm can drive this over a synthetic tree — a census helper that can only
+ * read the real repository cannot be planted, and a plant is the only thing that proves it still counts.
+ */
+export function censusOf(root, files, read) {
+  const out = {};
+  let total = 0;
+  for (const f of files.filter(isScannable)) {
+    let text;
+    try { text = read(f); } catch { continue; }          // binary or unreadable — nothing to count
+    const counts = SIGNATURES.map((s) => text.split("\n").filter((l) => s.re.test(l)).length);
+    if (counts.some((n) => n > 0)) { out[f] = counts; total += counts.reduce((a, b) => a + b, 0); }
+  }
+  // Sorted, so a re-mint produces a reviewable diff instead of a reordered file.
+  return { total, files: Object.fromEntries(Object.entries(out).sort(([a], [b]) => a < b ? -1 : 1)) };
+}

package/driver/refusal-bound.mjs

@@ -2,7 +2,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // ── ONE REFUSAL BOUND FOR EVERY TRANSPORT THAT LOOPS PER-ITEM OBLIGATIONS ─────────────────────────────
 //
-// 's Part 2. is the incident: one row of a meaning sweep was refused 217 times across three
+// That Part 2. is the incident: one row of a meaning sweep was refused 217 times across three
 // attempts, exhausted the stage's recoveries, and killed a production run that had already ruled 72 of
 // its 73 obligations. Nothing delivered. The cure at that stage was a per-row bound and a park; this
 // module is that cure written once, so the other members of the class do not each grow their own.
@@ -33,7 +33,7 @@
 //                             1,256 rows before this was built: present and distinct in every one.
 
 /**
- * THE BOUND. Thirty, inherited from 's disposition park, where the number was argued from a real
+ * THE BOUND. Thirty, inherited from the disposition park, where the number was argued from a real
  * ledger rather than chosen: twelve is refuted (two rows that were CONVERGING sat at 17), and 30 is still
  * a sevenfold cut from the 217 that killed the run. That argument is about the SHAPE of a live-lock, not
  * about meaning obligations, so it carries to the other members unchanged.
@@ -56,7 +56,7 @@ function* refusals(verdicts) {
 /**
  * How many times each item has been refused so far. PURE — the park's own evidence.
  *
- * COUNTED PER ITEM ACROSS CALLS, which is the unit 's banner records an earlier investigation dying
+ * COUNTED PER ITEM ACROSS CALLS, which is the unit the banner records an earlier investigation dying
  * on when it joined per-item-final-state instead. A row refused on eight calls and ruled on the ninth
  * counts eight; a row refused eight times in ONE call also counts eight, because eight refusals is eight
  * refusals however they were batched.

package/driver/register-availability.mjs

@@ -17,7 +17,7 @@
 // The first cut narrowed the contract's covered list to the configured members and handed that
 // downstream. It is wrong twice over:
 //
-//   · 's admission gate reads `offices.covered` to decide which territories a client may ORDER.
+//   · the admission gate reads `offices.covered` to decide which territories a client may ORDER.
 //     Narrowing it to EU would refuse a US-only matter AT THE DOOR, on a provider that covers the US.
 // is the report of that shape of refusal and its acceptance is that a US-only scenario is
 //     admitted rather than vetoed. A door that refuses is not a disclosure.
@@ -130,7 +130,7 @@ export function unavailableByOffice(unavailable) {
  * against the full declared coverage and hand them straight to the provider adapter. On a composite
  * that is a fan-out to EVERY member, so the unconfigured one is asked, refuses, and the composite
  * correctly declines to return a partial sum — killing a lane whose other half works perfectly. That
- * is 's observed refusal, and 's acceptance ("free-tier starts and ships a disclosed US
+ * is the observed refusal, and the acceptance ("free-tier starts and ships a disclosed US
  * deferral") was never met on these two lanes.
  *
  * @param regions      what resolveRegions produced, against the FULL coverage. `[]` is meaningful.

package/driver/register-count.mjs

@@ -533,7 +533,7 @@ export function countLine(entry) {
   //
   // On the rendered line rather than only in `scope.deferredJurisdictions`, which has been written by
   // both Depth 2 lanes since they were built and which `git grep` finds no reader for. A field nobody
-  // sees is not a disclosure — that is 's defect exactly, where `deferred_coverage` rode the plan
+  // sees is not a disclosure — that is the defect exactly, where `deferred_coverage` rode the plan
   // and the run shipped an EU-only clean with no row saying the US register was never searched.
   const deferred = entry.deferredScope ?? [];
   const oneDeferred = deferred.length === 1;

package/driver/register-digest-record.mjs

@@ -168,6 +168,36 @@ const FINDING_COLUMNS = Object.freeze(
 // finding it there together with screen_verdict / class / status.
 const NEGATIVE_COLUMNS = Object.freeze(["Mark", "Search Term / Variant", "Result", "Notes"]);
 
+/**
+ * The "Mark" cell for one Negative-results row.
+ *
+ * A `duplicate-of-surfaced` row is not a statement about the MARK. It is a statement about one
+ * registration of a mark whose position is already reported above it — the digest's own rule is "one
+ * row per POSITION, never one per registration of the same right". Printing the bare mark under a
+ * column headed "Mark" says the opposite of what the row means, and the document then reads as both
+ * "keep this mark, here is the reasoning" in the incumbent table and "no separate row for this mark"
+ * here. Nine readers scan this file, and one of them is the drafting seat that decides what the client
+ * is shown.
+ *
+ * Naming the record removes the contradiction and changes no judgment the digest made: the row is
+ * still a drop, still on the same ground, still carrying the seat's own reason.
+ *
+ * ✕ EVERY OTHER GROUND IS LEFT ALONE, deliberately. `off-field`, `dead-status` and `out-of-class` are
+ * about the record on its own terms, where the bare mark is what a reader wants and is not ambiguous.
+ * A blanket change to this column would touch every negative row in every report for a defect that
+ * only exists on the duplicate class.
+ *
+ * The office comes from the record uri (`/mark/wo/…` -> `WO`); every uri in the archived corpus carries
+ * a two-letter office in that position. When it cannot be read the BARE MARK is printed rather than a
+ * broken qualifier — a missing qualifier is a smaller defect than "OSLER DELPHI — UNDEFINED record".
+ */
+export function negativeMarkCell(row) {
+  const mark = String(row?.cells?.mark ?? "").trim();
+  if (row?.ground !== "duplicate-of-surfaced" || !mark) return mark;
+  const office = String(row?.cells?.uri ?? "").split("/")[2] ?? "";
+  return /^[a-z]{2}$/i.test(office) ? `${mark} \u2014 ${office.toUpperCase()} record` : mark;
+}
+
 // ── THE FLOOR, AND WHAT ITS ZERO MEANS ────────────────────────────────────────────────────────────
 //
 // `validators.registerFindings` carried `nonEmpty(c)` with no character number, so there is no
@@ -353,7 +383,7 @@ export function renderRegisterFindings(model, facts = emptyFacts()) {
   out.push(DIGEST_SECTIONS.negative, "");
   out.push(model.negative_rows.length
     ? table(NEGATIVE_COLUMNS, model.negative_rows.map((r) => [
-      r.cells.mark, r.variant || r.cells.mark, r.drop_reason,
+      negativeMarkCell(r), r.variant || r.cells.mark, r.drop_reason,
       [`URI ${r.cells.uri}`, r.screen_verdict ? `screen_verdict=${r.screen_verdict}` : "",
         r.cells.classes ? `class=${r.cells.classes}` : "", r.cells.status ? `status=${r.cells.status}` : ""]
         .filter(Boolean).join("; "),

package/driver/register-grant-vocabulary.mjs

@@ -7,7 +7,7 @@
 // `unit.md` is provider-INDEPENDENT doctrine, and it named three provider-DEPENDENT tools flat:
 // "Your register key also carries register_record_fetch, register_image_fetch and register_batch_screen."
 // On a signa deployment two thirds of that sentence is false and the seat is told it holds tools its
-// grant does not carry; the same shape is 's subject across six
+// grant does not carry; the same shape is the subject across six
 // providers. A dispatch that asserts a capability the active provider lacks is the defect, whatever the
 // seat then does with it.
 //
@@ -39,7 +39,7 @@ export const HELD_BUT_NOT_CALLED = Object.freeze([
  * ✕ NULL IS NOT AN EMPTY SENTENCE, and the difference is the defect this exists to fix. Ask
  * `providerUnavailableRegisterTools` on an unresolved provider and it answers with an empty withheld
  * set — deliberately, as a reporting helper that must never throw. Composed into this sentence, an empty
- * withheld set reads as "your grant carries all of them": 's defect, restored
+ * withheld set reads as "your grant carries all of them": the defect, restored
  * silently, on exactly the `--experiment` single-stage path a diagnosis reaches for. So resolution is
  * asked for HERE, and an unresolved provider omits the sentence rather than composing a false one.
  */