clearotron 0.2.0 → 0.3.0-beta.0

package/driver/publish/render-knockout.mjs

@@ -21,10 +21,20 @@
 // ~60 lines of duplicated document shell, and it is the right price: the alternative is exporting the
 // shell out of the frozen file, which is a bigger break than the duplication saves.
 //
-// ONE report. There is no client variant and no internal variant. What used
-// to render purple — the staff notes and the model's register estimate — is not stripped here, it is
-// simply NOT PART OF THE REPORT; it lives in the audit workbook, which is where internal working material
-// belongs. That removes the whole class of "the wrong link got sent".
+// ONE report. There is no client variant and no internal variant, and that is
+// still the rule — it is what removes the whole class of "the wrong link got sent".
+//
+// WHAT CHANGED, 2026-09-07 (owner ruling, tracker issue 274): the one report now CARRIES the reviewer's
+// notes rather than routing them to the audit workbook alone. The earlier reading of "one report" was
+// that internal working material is simply not part of it; the ruling is that there is one report and the
+// person who ran Clearotron reads it, so holding material back "just adds confusion for where data is
+// lost". Six notes written for the reviewing lawyer on a delivered run reached the spreadsheet and
+// nothing else, which is the measurement behind the ruling.
+//
+// So: the notes render, LABELLED, in report.css's existing `.internal` purple convention (see
+// reviewerNotesBlock) — never merged into the client-voiced body. The workbook keeps them as well; this
+// added a surface and moved none. The model's `registerEstimate` is NOT covered by the ruling and stays
+// off the page.
 import { readFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -176,6 +186,14 @@ const KO_CSS = `
   .ko-findev{margin:0;font-size:12.5px;line-height:1.6;word-break:break-word}
   .ko-count{font-family:var(--mono);font-size:13px;color:var(--ink);margin:0}
   .ko-degraded{font-size:13px;color:var(--med-tx,#82550A);margin:8px 0 0;font-style:italic}
+  /* The reviewer-notes legend. NOT .ko-legend — that name is taken by the framework attribution row
+     above, and reusing it would restyle the caption. It names the purple convention report.css already
+     draws for .internal, so the colour is stated once and never re-specified. */
+  .ko-refnote{margin:0;padding:11px 24px 0;font-size:12px;color:#6a2b6e;font-style:italic}
+  /* The notes sit inside a mark's column, so the shared .internal block's bullets keep the column's
+     own list indent and do not fight the paragraph above them. */
+  .ko-row .internal .ko-bul{margin:0 0 4px}
+  .ko-row .internal .ko-bul:last-child{margin-bottom:0}
   .ko-counts table{width:100%;border-collapse:collapse;font-size:14px}
   .ko-counts th{text-align:left;font-size:10.5px;letter-spacing:.06em;text-transform:uppercase;color:var(--faint);
     font-weight:700;padding:14px 24px 8px;border-bottom:1px solid var(--line)}
@@ -728,9 +746,13 @@ function registerCardViews(mark, framework, registerRecords) {
  * is gone; what tells the two apart on the page is where the finding came from, which is the vocabulary
  * the clearance reports already use for exactly this.
  *
- * NO BAND CHIP AND NO `bandStop`, still, and for the reason the old note gave: a rung of the run's ladder
- * here would be a rating nobody performed. The rail takes --faint so the card reads off the risk ramp
- * rather than on it.
+ * THE BAND CHIP IS DRAWN ONLY WHEN THE RATER SENT ONE, and that condition is the whole rule. The old note
+ * here said "no band chip and no `bandStop`, ever: a rung of the run's ladder would be a rating nobody
+ * performed" — which was true for as long as nothing could carry the rater's rating of an individual
+ * filing. `registerReads[].band` now can (tracker issue 274), so the objection is answered where it was
+ * raised: with a band, the rating WAS performed, by the seat, in the framework's own words, and the chip
+ * states it. With no band the old rule stands unchanged — --faint rail, no chip, nothing claimed — and
+ * that is still what every archived run renders.
  *
  * THE LINE UNDER THE STATEMENT DESCRIBES THE CARD, NOT THE RATING. It used to deny
  * that the rating turned on this filing, which this function has no way to know and which a delivered
@@ -759,24 +781,56 @@ function sourceChips(v) {
   return `${commonLaw ? '<span class="src cl">Common law</span>' : ''}${register ? '<span class="src reg">Register</span>' : ''}`;
 }
 
-function registerFindingBlock(v, markIndex, reads = null) {
+// ── THE REVIEWER'S NOTES, ON THE REPORT ─────────────────────────────────────────────────
+//
+// OWNER RULING, 2026-09-07: there is one report and the person who ran Clearotron reads it — keeping
+// this material off the page "just adds confusion for where data is lost". This replaces the earlier
+// split under which the notes went to the audit workbook alone (the header of this file and
+// publish/knockout.mjs carried that rule; both now say what replaced it). The workbook keeps them too:
+// this adds a surface, it does not move one.
+//
+// LABELLED, NEVER MERGED. They render in the established `.internal` purple convention report.css
+// already defines — the same one the clearance report uses for this material — so a reader can see whose
+// voice a line is in. Merging them into the client-voiced body would make the reviewer's asides read as
+// findings about the mark, which is the one way this ruling could produce a worse document.
+const REVIEWER_NOTES_LEGEND = 'Information for your reference/context that likely does not need to be shared with the business is shown in purple.';
+
+function reviewerNotesBlock(m) {
+  const notes = (Array.isArray(m?.purpleNotes) ? m.purpleNotes : [])
+    .map((n) => String(n ?? '').trim()).filter(Boolean);
+  if (!notes.length) return '';
+  return `<div class="internal">
+            <span class="tag">For your reference</span>
+            ${notes.map((n) => `<p class="ko-bul">${inlineMd(n)}</p>`).join('')}
+          </div>`;
+}
+
+function registerFindingBlock(v, markIndex, reads = null, framework = null) {
   const r = v.record;
   // — THE RATER'S OWN READ OF THIS FILING, when it recorded one. `registerReads` is
   // joined to the record store by the validator, so a row that reaches here names a filing this run
   // actually holds. With no row the neutral line stands, and the neutral line is TRUE: it describes the
   // card. That is why the field can be optional without the page ever asserting something false.
-  const read = (Array.isArray(reads) ? reads : [])
-    .map((x) => ({ id: String(x?.recordId ?? '').trim(), text: String(x?.read ?? '').trim() }))
-    .find((x) => x.id && x.id === String(r?.recordId ?? '').trim())?.text;
+  const row = (Array.isArray(reads) ? reads : [])
+    .map((x) => ({ id: String(x?.recordId ?? '').trim(), text: String(x?.read ?? '').trim(), band: String(x?.band ?? '').trim() }))
+    .find((x) => x.id && x.id === String(r?.recordId ?? '').trim());
+  const read = row?.text;
+  // The band rides the SAME row as the read and is independently optional: a read with no band prints
+  // exactly as it did before this field existed. The validator has already checked the word against the
+  // frozen ladder, so `bandStop` resolves a real stop rather than falling through to a default that would
+  // colour an unknown word as though it were rated.
+  const band = row?.band || null;
+  const stop = band ? bandStop(framework, band) : null;
   const meta = [r.owner ? esc(r.owner) : 'proprietor not stated', r.territory ? esc(r.territory) : null]
     .filter(Boolean).join(' · ');
   const receipt = isHttpUrl(r.url) ? linkOrText(r.url) : esc(r.recordId ?? 'no record address supplied');
   return `<div class="card ko-find" data-ko-mark="${Number(markIndex)}" data-ko-ord="${Number(v.ordinal)}">
         <div class="top">
-          <div class="rail" style="background:var(--faint)"></div>
+          <div class="rail" style="background:var(${stop ?? '--faint'})"></div>
           <div class="body">
             <div class="cardhead">
-              <span class="fnum">${esc(v.ref)}</span><span class="who">${esc(r.mark ?? 'Unnamed filing')}</span><span class="src reg">Register</span>
+              <span class="fnum">${esc(v.ref)}</span><span class="who">${esc(r.mark ?? 'Unnamed filing')}</span>${
+    band ? `<span class="ko-findband" style="background:var(${stop})">${esc(band)}</span>` : ''}<span class="src reg">Register</span>
             </div>
             <p class="ko-findmeta">${meta}</p>
             <p class="ko-findnet">${esc(v.statement)}</p>
@@ -925,7 +979,7 @@ function analysisSection(marks, framework, { registerCounts = null, probeRan = f
     // under compareKnockoutBlockingPower, so appending them is the ladder's own rule applied to a row
     // that has no rung, not a new one invented for the register.
     const reg = registerCardViews(m, framework, registerRecords);
-    const regBlocks = reg.cards.map((v) => registerFindingBlock(v, markIndex, m?.registerReads)).join('');
+    const regBlocks = reg.cards.map((v) => registerFindingBlock(v, markIndex, m?.registerReads, framework)).join('');
     const overflow = reg.promoted > reg.cards.length
       ? `<p class="ko-bul">${esc(`${reg.promoted - reg.cards.length} further filing${reg.promoted - reg.cards.length === 1 ? '' : 's'} for this name met the same test — every one of them is in the filings section below.`)}</p>`
       : '';
@@ -950,11 +1004,17 @@ function analysisSection(marks, framework, { registerCounts = null, probeRan = f
       <div>
         ${body || '<p class="ko-bul">No adverse signals recorded for this name on this screen.</p>'}
         ${m.degraded ? `<p class="ko-degraded">${esc(DEGRADED_NOTE)}</p>` : ''}
+        ${reviewerNotesBlock(m)}
         <p class="ko-reg">${esc(registerLine(m, registerCounts, probeRan, registerRecords, reg.cards))}</p>
       </div>
     </div>`;
   }).join('');
-  return `<div class="panel ko-glance">${cards}</div>`;
+  // The legend rides the panel and only when a note is actually on it — a standing sentence explaining a
+  // colour no reader can see would be the report describing a convention it did not use.
+  const anyNotes = marks.some((m) => (Array.isArray(m?.purpleNotes) ? m.purpleNotes : [])
+    .some((n) => String(n ?? '').trim()));
+  const legend = anyNotes ? `<p class="ko-refnote">${esc(REVIEWER_NOTES_LEGEND)}</p>` : '';
+  return `<div class="panel ko-glance">${legend}${cards}</div>`;
 }
 
 // The method line names EXACTLY what ran, and its wording is doctrine — with counts on the page, "register
@@ -1324,6 +1384,39 @@ export function knockoutReportData(findings, framework, { runId, codename, overa
         classesDriving: m.classesDriving ?? [],
         degraded: Boolean(m.degraded),
         points: m.bullets ?? [],
+        // ── THE ASSESSMENT THE RUN ALREADY WROTE (tracker issue 274) ──────────────────────────────
+        //
+        // Seven keys the assess stage writes into knockout-findings.json reached this file as nothing.
+        // They were not withheld by a rule — no code decided against them; this projection is an explicit
+        // whitelist and nobody had added them, so an assistant drafting from this file could not see the
+        // reasoning behind a rating it was drafting about.
+        //
+        // `assessment` is the sharpest case: publish substitutes it into `batch.executiveSummary` ONLY on
+        // a multi-mark batch, so on a single-mark run — the common knockout — the mark's own opening read
+        // was written, validated, and then dropped by both surfaces at once.
+        //
+        // `purpleNotes` is the reviewer's notes, and it is here by the owner's ruling of 2026-09-07: one
+        // report, read by the person who ran Clearotron, because keeping material off it "just adds
+        // confusion for where data is lost". They are LABELLED on the page rather than merged into the
+        // client-voiced body — see reviewerNotesBlock — so a reader can tell whose voice they are in.
+        assessment: (() => { const t = String(m.assessment ?? '').trim(); return t || null; })(),
+        counterFactors: m.counterFactors ?? [],
+        mitigation: (() => { const t = String(m.mitigation ?? '').trim(); return t || null; })(),
+        // `null`, not `false`, when the rater said nothing: a crowded field is a mitigant the reasoning
+        // turns on, and an unstated one must not read as a stated "no".
+        crowdedField: typeof m.crowdedField === 'boolean' ? m.crowdedField : null,
+        reviewerNotes: m.purpleNotes ?? [],
+        // The proof-of-search rows — the same defensibility record list_searches answers from.
+        negatives: (m.negatives ?? []).map((n) => ({
+          term: n?.term ?? null, source: n?.source ?? null, note: n?.note ?? null,
+        })),
+        // The rater's read of a filing it weighed, keyed by the record id the card prints, so a consumer
+        // can join a read to its filing without matching on prose.
+        registerReads: (m.registerReads ?? []).map((x) => ({
+          recordId: x?.recordId ?? null,
+          read: x?.read ?? null,
+          band: String(x?.band ?? '').trim() || null,
+        })),
         // — the typed finding, ranked, with the reference the report prints. The old key was
         // `evidence[]` and it was `(m.findings ?? []).filter((f) => f?.url)`: a typed finding has no
         // `url`, so this file — the one the assistant drafts client mail from — silently carried zero
@@ -1345,14 +1438,31 @@ export function knockoutReportData(findings, framework, { runId, codename, overa
           //     A promoted filing the brief omitted would be the report and the brief disagreeing about
           //     what the run found.
           //
-          // `band: null` and `shape: 'register'` are the load-bearing fields: a consumer can tell a
-          // weighed conflict from a pointed-at filing without parsing prose, and `net` carries the
-          // not-weighed sentence so a consumer that reads only `net` still cannot overstate it.
-          ...registerCardViews(m, framework, registerRecords).cards.map((v) => ({
-            ref: v.ref, ordinal: v.ordinal, name: v.record.mark, owner: v.record.owner, band: null,
-            type: 'Register filing', net: `${v.statement} It was ${NOT_WEIGHED}.`, basis: NOT_WEIGHED,
-            evidence: v.evidence, shape: 'register',
-          })),
+          // `shape: 'register'` is the load-bearing field: a consumer can tell a weighed conflict from a
+          // pointed-at filing without parsing prose.
+          //
+          // `band` AND `basis` NOW CARRY THE RATER'S READ WHEN IT SENT ONE (tracker issue 274). Before
+          // this, both were constants — `band: null` and the not-weighed sentence — on every filing of
+          // every run, including runs where the seat had written a full read of that exact filing and the
+          // HTML card was already printing it. The page and this file disagreed, and this file is the one
+          // the MCP brief answers from, so the surface a reader asks "what did you make of that
+          // registration?" was the surface that had dropped the answer.
+          //
+          // The unmatched case is unchanged and must stay that way: no row for this recordId ⇒ `band:
+          // null` and the not-weighed line, which describes the card and claims nothing.
+          ...registerCardViews(m, framework, registerRecords).cards.map((v) => {
+            const row = (Array.isArray(m?.registerReads) ? m.registerReads : [])
+              .find((x) => String(x?.recordId ?? '').trim() && String(x?.recordId ?? '').trim() === String(v.record?.recordId ?? '').trim());
+            const read = String(row?.read ?? '').trim() || null;
+            const band = String(row?.band ?? '').trim() || null;
+            return {
+              ref: v.ref, ordinal: v.ordinal, name: v.record.mark, owner: v.record.owner, band,
+              type: 'Register filing',
+              net: read ? v.statement : `${v.statement} It was ${NOT_WEIGHED}.`,
+              basis: read ?? NOT_WEIGHED,
+              evidence: v.evidence, shape: 'register',
+            };
+          }),
         ],
         registerCounts: counted?.counts
           ? {

package/driver/publish/report-data.mjs

@@ -4,9 +4,19 @@
 // report-data.json since the one-report collapse; the clearance lane's native-render branch existed in
 // the portal with NO producer anywhere (B3's "the aspirational path") — this is that producer.
 //
-// Two readers, one file (the knockout doctrine, verbatim): the assistant drafts client-facing mail from
-// it, and the portal's native-render path reads it instead of iframing baked HTML. It is the CLIENT CUT
-// by construction, not by serve-time stripping:
+// Two readers, one file (the knockout doctrine, as it stood): the assistant drafts client-facing mail
+// from it, and the portal's native-render path reads it instead of iframing baked HTML.
+//
+// THE TWO LANES DIVERGED ON 2026-09-07 AND THIS FILE DID NOT MOVE. The owner ruled (tracker issue 274)
+// that the KNOCKOUT report carries the reviewer's notes, on the ground that one report is read by the
+// person who ran Clearotron and holding material back confuses where data went; render-knockout.mjs
+// projects them under `reviewerNotes`. That ruling was about those notes on that lane. It did not touch
+// what this producer strips — withdrawn findings, verification receipts, `::p::` tails, `[internal]`
+// labels and engine-internal narration are all still cut here, and the guard test still polices them.
+// Do not read the knockout change as licence to relax this list; if the ruling is meant to extend, it
+// extends by being asked, not by inference.
+//
+// It remains the CLIENT CUT by construction, not by serve-time stripping:
 //   • only LIVE findings (a withdrawn finding renders nowhere — it does not exist here either);
 //   • no verification receipts (use_check / own_rights / bears_on — those are the reviewer's evidence
 //     trail and live in the audit workbook), no withdrawn_reason, no quarantine records;

package/driver/publish/seed-pool.mjs

@@ -105,12 +105,20 @@ export function frozenSamples(examplesDir) {
  */
 export async function seedPool({ pool, examplesDir, republish }) {
   const existing = poolRunIds(pool);
-  if (existing.length) {
-    // Named with the count, not just refused. "It did not seed" and "it did not seed BECAUSE there are
-    // already 14 runs here" are the same non-event to the code and different facts to a reader.
-    return { seeded: [], skipped: `the pool already holds ${existing.length} run(s)`, problems: [] };
-  }
-
+  // ── A POOL THAT ALREADY HOLDS SOMETHING IS TOPPED UP, NOT SKIPPED (tracker issue 277) ──────────────
+  //
+  // This used to return early on any non-empty pool. That was invisible while `demo/` shipped one child:
+  // seeding one and seeding all were the same act. When the other three landed, every box seeded before
+  // that day kept its single demo through every upgrade, because the pool was no longer empty and this
+  // returned without looking at what the package now carried.
+  //
+  // DEMOS ARE PACKAGE CONTENT, NOT USER DATA, so the package's set is the one that should be there. What
+  // is already published is left exactly as it is — this adds what is missing and removes nothing, so a
+  // pool holding a run this package does not ship keeps it.
+  //
+  // AND IT IS ONLY EVER A DEMO POOL. `bin/start.mjs` calls this inside its `--demo` branch alone; a real
+  // install is told its archive is empty and pointed at the demo command. Nothing here can put an example
+  // into a pool holding a customer's work, and that gate is the reason this can top up safely at all.
   const { samples, problems } = frozenSamples(examplesDir);
   if (!samples.length) {
     // The empty archive is now the SYMPTOM of something, and this is where the something is named.
@@ -118,11 +126,13 @@ export async function seedPool({ pool, examplesDir, republish }) {
   }
 
   const seeded = [];
+  const already = [];
   const failures = [];
   for (const s of samples) {
-    // Belt and braces against a partial pool: the emptiness check above already means nothing is here,
-    // but a sample list carrying the same runId twice would otherwise overwrite silently.
+    // A sample list carrying the same runId twice would otherwise overwrite silently.
     if (seeded.includes(s.meta.runId)) { failures.push(`${s.name}: runId ${s.meta.runId} appears twice under ${examplesDir}`); continue; }
+    // Already published: left alone, and NAMED. Silence here is what the old early return produced.
+    if (existing.includes(s.meta.runId)) { already.push(s.meta.runId); continue; }
     try {
       // poolUrl "" for the same reason the demo passes it: the report's link block addresses a
       // deployment that serves the pool at a public URL, and this one is served from this machine.
@@ -133,5 +143,10 @@ export async function seedPool({ pool, examplesDir, republish }) {
       failures.push(`${s.name}: ${String(e?.message ?? e)}`);
     }
   }
-  return { seeded, skipped: null, problems: [...problems, ...failures] };
+  // `skipped` still carries a sentence when there was nothing to add, because "seeded 0" and "seeded 0
+  // BECAUSE all four were already here" are the same number and different facts.
+  const skipped = !seeded.length && already.length
+    ? `the pool already holds all ${already.length} example(s) this package ships`
+    : null;
+  return { seeded, already, skipped, problems: [...problems, ...failures] };
 }

package/driver/record-carry.mjs

@@ -825,3 +825,142 @@ export function silentlyLostFindings({ reconciliation = null, carryRows = null,
     population_empty: false, cross_checked: crossChecked,
     checked: ended.length, matched: seen.length, lost };
 }
+
+/**
+ * Positions the DIGEST ended as findings that did not reach the findings, dropped WITH a stated reason.
+ *
+ * ── THE SIBLING'S BLIND SPOT, AND IT IS THE ONE THAT REACHED A CLIENT (tracker issue 248) ──────────
+ *
+ * `silentlyLostFindings` above is correct and must not be widened to cover this. Its population is
+ * `step-silent` — a finding-ending followed by silence — and its own header records why that boundary
+ * exists: silent drops are the norm (690 of 741 records on the evidence run), so a rule flagging them
+ * broadly would flag almost everything, and the defect it targets is the CONJUNCTION of silence after a
+ * finding-ending.
+ *
+ * It also anticipated this gap in writing: "nine divergences from a digest finding-ending, every one of
+ * them `step-stated`". Nine of the shape nothing checked.
+ *
+ * MEASURED ON A DELIVERED R2 RUN, 2026-09-06. The sibling ran and reported
+ * `{checked:5, matched:5, lost:0}` — correctly. On that same delivery two marks from the lawyer's final
+ * list, `OSLER DELPHI` and `DELFITY`, one rated HIGH, are absent from `findings.json`. They were dropped
+ * WITH a reason, so they sat outside the sibling's population by design:
+ *
+ *   IMMATERIAL ask:recall:recall-osler-delphi: … — OSLER DELPHI / Osler Diagnostics Limited is
+ *   already reasoned on the incumbent sheet in register-findings.md.
+ *
+ * WHY THE STATED CASE IS THE MORE DANGEROUS ONE. A silent drop leaves a hole. A stated drop leaves a
+ * SENTENCE, and the sentence reads as diligence. On that one delivery `doubt-closure.md` carries 92
+ * recall asks and 66 rulings of IMMATERIAL. A drop with a reason nobody verifies is not accounted for;
+ * it is unexamined with a paper trail.
+ *
+ * `step-structural` is deliberately NOT in this population: it is a mechanical screen verdict
+ * (`the in-line record screen returned "…"`), not a judgment sentence a reader would take on trust.
+ * `absent` belongs to the sibling's family, not this one.
+ *
+ * WHAT THIS DOES NOT DECIDE. Whether any given stated reason is RIGHT. That is a change to what the
+ * client receives and is the owner's call; this makes the class visible, which is worth having whichever
+ * way that lands, because today nobody would know the closures happened.
+ *
+ * Same contract as the sibling, deliberately: `computable:false` with a named reason rather than a clean
+ * `[]`; `population_empty` as its own state; `cross_checked` so a caller can tell "could not look" from
+ * "looked and found nothing"; and `matched` returned so a caller can insist the join actually joined —
+ * that field exists because a case-sensitive URI join once matched zero rows on every run and read as
+ * zero divergences. PURE.
+ */
+export function statedDivergenceFindings({ reconciliation = null, carryRows = null, digestFindingUris = null } = {}) {
+  const no = (reason, crossChecked = false) => ({ computable: false, reason, population_empty: false,
+    cross_checked: crossChecked, checked: 0, matched: 0, diverged: [] });
+  if (!reconciliation || reconciliation.computable !== true) {
+    return no("no computable recall-reconciliation — the digest's own endings are the population and there is none");
+  }
+  if (!Array.isArray(carryRows)) {
+    return no("no record-carry rows — the knockout lane writes none, so this join cannot look at that product");
+  }
+  // ── THE POPULATION IS THE CARRY ROWS, NOT THE RECONCILIATION (corrected 2026-09-07) ─────────────
+  //
+  // The first cut of this function gated on the reconciliation's finding-ended positions, mirroring the
+  // sibling. That inherited the sibling's BLIND SPOT along with its shape, and the check was inert on
+  // the very delivery it was written for. Replayed against that delivery:
+  //
+  //   silentlyLostFindings       checked=5 matched=5 lost=0
+  //   statedDivergenceFindings   checked=5 matched=5 diverged=0   ← should have named two marks
+  //
+  // The reconciliation names five finding-ended positions and they are five OTHER marks — DELPHIS
+  // bioenergetische Kosmetik, DELPHIC HSE, DELPHI, DELPHIN & EMERENCE, DELPHI DIAGNOSTICS. The two that
+  // were lost sit in the CARRY rows and the reconciliation never mentions them:
+  //
+  //   OSLER DELPHI  reach=placed stopped_at=digest reason_source=step-stated reason=digest:reasoned-negative
+  //   DELFITY       reach=placed stopped_at=digest reason_source=step-stated reason=digest:reasoned-negative
+  //
+  // The unit arms all passed because their fixtures put the mark in BOTH populations, which the real run
+  // does not. That is the lesson worth keeping: a fixture that satisfies two joins at once cannot tell
+  // you the joins disagree.
+  //
+  // So the carry rows are the population — they are where a stated drop is RECORDED — and the
+  // reconciliation is demoted to optional corroboration. Measured on that delivery, the correct
+  // population is 70 rows over 34 distinct marks, all `digest:reasoned-negative`, and it contains both.
+  const arrived = new Set(["finding", "findings-surface"]);
+  const population = carryRows.filter((r) => r?.uri
+    && r.reason_source === "step-stated"           // the sibling owns step-silent; step-structural is mechanical
+    && !arrived.has(r.reach));                     // arrived, or arrived somewhere visible, is not a divergence
+
+  // Kept for corroboration only. `ended` no longer gates anything; where the reconciliation DOES name a
+  // position it agrees with, that is recorded on the row so a reader can weigh it.
+  const ended = [];
+  for (const bucket of ["top_slice", "residual"]) {
+    for (const row of reconciliation[bucket] ?? []) {
+      if (row?.ending !== "finding") continue;
+      for (const uri of row.position_records ?? []) ended.push({ uri: lc(uri), mark: row.mark_text ?? null });
+    }
+  }
+  const endedUris = new Set(ended.map((e) => e.uri));
+  const byUri = new Map();
+  for (const r of carryRows) if (r?.uri) byUri.set(lc(r.uri), r);
+
+  // The disjoint-population guard, for the sibling's reason: overlap is the signal, a shortfall is not.
+  if (Array.isArray(digestFindingUris) && digestFindingUris.length && ended.length) {
+    const digest = new Set(digestFindingUris.map(lc));
+    if (!ended.some((e) => digest.has(e.uri))) {
+      return no(`the reconciliation's ${ended.length} finding-ended position(s) share NOTHING with the `
+        + `${digest.size} finding row(s) the digest's own typed calls recorded — the two populations are `
+        + "disjoint, so this join is examining a different set and its answer cannot be trusted", true);
+    }
+  }
+  // A ZERO POPULATION IS ITS OWN STATE. No stated drop recorded is a real answer on a healthy run, and
+  // it must not be reported in the same shape as "there were some and none diverged".
+  if (!population.length) {
+    return { computable: true, reason: "no record-carry row records a stated drop on this run — there is "
+      + "no population here, which is the healthy answer and not a comparison that found nothing",
+      population_empty: true, cross_checked: false, checked: 0, matched: 0, diverged: [] };
+  }
+
+  const diverged = [];
+  for (const row of population) {
+    const e = { uri: lc(row.uri), mark: row.mark ?? null };
+    // NAME THE ARTIFACT THE REASON POINTS AT. The defect this check exists for is an absence discharged
+    // by the WRONG artifact — "already reasoned in register-findings.md" answers a question nobody asked,
+    // because the ask was about the findings. Surfacing the cited artifact is what lets a reader see the
+    // substitution rather than read the sentence as diligence.
+    const reason = row.reason ?? null;
+    const cites = typeof reason === "string" ? (reason.match(/[a-z0-9._-]+\.(?:md|json)\b/gi) ?? []) : [];
+    diverged.push({ uri: e.uri, mark: e.mark ?? row.mark ?? null, reach: row.reach ?? null,
+      stopped_at: row.stopped_at ?? null, reason,
+      cites_artifact: cites.length ? [...new Set(cites.map(String))] : null,
+      // CORROBORATION, NOT A GATE. The reconciliation naming this position is worth a reader knowing;
+      // its SILENCE is not evidence of anything, which is exactly what the first cut got wrong.
+      reconciliation_agrees: endedUris.has(e.uri),
+      why: "this position was dropped with a stated reason and never reached the findings, and the reason "
+        + "given points at a different artifact than the one the absence is about" });
+  }
+  const crossChecked = Array.isArray(digestFindingUris) && digestFindingUris.length > 0;
+  return { computable: true,
+    reason: crossChecked ? null
+      : "no cross-check was possible — this run recorded no typed digest finding rows, so the "
+        + "population was not verified against an independent one",
+    population_empty: false, cross_checked: crossChecked,
+    // `checked` is the population this check actually walked, and `matched` how many of them the
+    // reconciliation ALSO named. On the delivery this was written for those are 70 and 0 — which is the
+    // whole point: a `matched` of zero used to mean "report nothing" and now means "the reconciliation
+    // saw none of them", a fact about the reconciliation rather than about the run.
+    checked: population.length, matched: diverged.filter((d) => d.reconciliation_agrees).length, diverged };
+}

package/driver/reference-score.mjs

@@ -667,14 +667,64 @@ export function scoreRecall({ reference, findings = [], retrieved = [], scopeCla
   // what it saw. Auto-promoting a collision to `found` would be the scorer manufacturing recall from
   // its own confusion, which is the defect one layer up from the one being fixed. score.mjs prints
   // these; a reader adjudicates.
+  // ── THE PREDICATE WAS THE OWNER, AND THE HEADING ABOVE SAYS RECORD (tracker issue 249) ──────────
+  //
+  // The only condition used to be `ownersMatch`. That implements a different class from the one the
+  // paragraph above states, and the justification — "they cannot both be true" — does not hold for any
+  // proprietor with more than one mark. A large filer can perfectly well have one mark the run withheld
+  // and a DIFFERENT mark, not in the reference, that it surfaced. Both rows are true.
+  //
+  // It fired on a delivered R2 run: `<large filer>: reference "DELFITY" is withheld, surfaced "DELPHINA"
+  // is noise`. Different marks, different records, one proprietor that files a great many. And because
+  // score.mjs prints a collision as "do not read the recall numbers above", ONE such proprietor
+  // suppressed the whole run's recall measurement — a real 88% → 63% movement went unquoted on the
+  // regression issue because of a warning that was spurious.
+  //
+  // WHY NOT A RECORD JOIN, WHICH IS WHAT THE ISSUE ASKED FOR. Measured on the delivered artifact: a
+  // finding carries `{band, disposition, mark, meters, net, ordinal, owner, quadrant, source, …}` and
+  // NO record identity — `source.resolved_link` is empty on every row. Noise rows are built from
+  // findings, so there is nothing on that side to join a record URI to. Stating it here so the next
+  // reader does not re-derive it: the acceptance criterion is unmeetable on this side until a finding
+  // carries its record, and that is a change to the findings contract, not to the scorer.
+  //
+  // WHY NOT `matchesReference`, WHICH IS THE FILE'S OWN MARK MATCHER. It would make this check VACUOUS.
+  // The noise loop above already skips any finding that matches a reference entry, so by construction
+  // no noise row matches one — the collision would always be empty. This check exists precisely to
+  // catch the case where THE MATCHER DISAGREED WITH ITSELF, so it cannot be built out of the matcher.
+  //
+  // So the predicate is deliberately weaker than the matcher and stronger than the owner: same owner
+  // AND one mark contained in the other once normalised. That is the shape of the case this check was
+  // built for — `DELPHI GENETICS` in LOST beside `DG DELPHI GENETICS` in NOISE — and it is not the
+  // shape of `DELFITY` beside `DELPHINA`.
+  const collisionKey = (s) => String(s ?? "").normalize("NFKC").toUpperCase().replace(/[^A-Z0-9]/g, "");
+  // A FLOOR, because containment on a short string matches everything. `DEL` inside `DELPHINA` is not
+  // evidence of a shared record; four characters is the shortest reference mark shape worth trusting
+  // here, and a pair below it drops to the advisory rather than being dropped entirely.
+  const CONTAIN_FLOOR = 4;
   buckets.collisions = [];
+  buckets.ownerEchoes = [];
   for (const bucket of ["lost", "withheld"]) {
     for (const e of buckets[bucket]) {
       for (const n of buckets.noise) {
         if (!ownersMatch(e.owner, n.owner)) continue;
-        buckets.collisions.push({ bucket, entry: e.mark ?? e.name ?? null, noise: n.mark,
-          owner: ownerName(n.owner) ?? ownerName(e.owner),
-          why: `the reference entry is reported ${bucket} while a surfaced record of the SAME owner is reported noise — one record cannot be both` });
+        const a = collisionKey(e.mark ?? e.name);
+        const b = collisionKey(n.mark);
+        const row = { bucket, entry: e.mark ?? e.name ?? null, noise: n.mark,
+          owner: ownerName(n.owner) ?? ownerName(e.owner) };
+        const sameRecord = a && b
+          && Math.min(a.length, b.length) >= CONTAIN_FLOOR
+          && (a === b || a.includes(b) || b.includes(a));
+        if (sameRecord) {
+          buckets.collisions.push({ ...row,
+            why: `the reference entry is reported ${bucket} while a surfaced record of the SAME owner whose `
+              + "mark contains or is contained by it is reported noise — these are one record in two buckets" });
+        } else {
+          // REPORTABLE, NEVER SUPPRESSING. A reader may still want to see that a proprietor appears on
+          // both sides; what they must not be told is that the recall numbers are unreadable.
+          buckets.ownerEchoes.push({ ...row,
+            why: `same proprietor on both sides with different marks — not a contradiction: a filer may hold `
+              + `a reference mark this run ${bucket} and another, outside the reference, that it surfaced` });
+        }
       }
     }
   }

package/driver/reference-strip-signatures.mjs

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// THE TWO SIGNATURES THE REFERENCE STRIP LEFT BEHIND (tracker issue 185).
+//
+// The strip's job was to remove internal references from this repository before it went public, and it
+// did that. Where the reference was the SUBJECT of the sentence, it took the subject with it:
+//
+//     "[ref]'s design ruling — above any fold, only a statement…"   became   "'s design ruling — …"
+//     "renders the pre-[ref] section"                              became   "renders the pre- section"
+//
+// Neither construction occurs in written English, which is the whole reason they can be counted rather
+// than judged. A reader of a public repository meets them as sentences that do not finish, and one of
+// them is in user-facing configuration documentation rather than in a comment.
+//
+// WHAT THIS MODULE IS AND IS NOT. It finds them. It does not repair them: the repair is per-sentence and
+// needs somebody reading the surrounding code, because "the pre- section" means "the section as it was
+// before the findings contract changed" and only that reader can say so. The finding is mechanical and
+// costs nothing, so it is the part that ships as a check.
+export const SIGNATURES = [
+  {
+    name: "a comment beginning with a bare possessive",
+    // Anchored at the comment leader, so `it's` and `the run's` mid-sentence are untouched — only the
+    // case where the possessive has nothing in front of it to possess.
+    re: /^\s*(?:\/\/|#|\*)\s*'s\b/,
+  },
+  {
+    name: "`pre- ` followed by a lowercase word",
+    // The hyphen is left dangling by a stripped number. `pre-flight` and `pre-delivery` do not match:
+    // the strip's residue always leaves whitespace after the hyphen.
+    re: /\bpre-\s+[a-z]/,
+  },
+];
+
+// THE RULE'S OWN DEFINITION IS THE ONLY EXEMPTION, and it is named rather than pattern-matched.
+//
+// These three files QUOTE the residue in order to define it: the specimens in the arm, the examples in
+// the header above. Scanning them counts the definition as an instance, which puts the guard's own text
+// into the backlog it polices and makes every re-mint grow the number it exists to shrink. Caught by a
+// plant, not by review — they were untracked when the table was first minted, so `git ls-files` did not
+// list them and the census read a tree that did not include them yet.
+export const RULE_DEFINITIONS = [
+  "driver/reference-strip-signatures.mjs",
+  "driver/test/the-reference-strip-left-sentences-unfinished.test.mjs",
+  "scripts/mint-reference-strip-backlog.mjs",
+];
+
+/** Files worth scanning: prose-bearing, tracked, not generated, and not this rule's own definition. */
+export const isScannable = (f) =>
+  /\.(mjs|md|yml|ts)$/.test(f) && !f.startsWith("portal-ui/dist/") && !RULE_DEFINITIONS.includes(f);
+
+/**
+ * Count both signatures per file across `files`.
+ * `read` is injected so an arm can drive this over a synthetic tree — a census helper that can only
+ * read the real repository cannot be planted, and a plant is the only thing that proves it still counts.
+ */
+export function censusOf(root, files, read) {
+  const out = {};
+  let total = 0;
+  for (const f of files.filter(isScannable)) {
+    let text;
+    try { text = read(f); } catch { continue; }          // binary or unreadable — nothing to count
+    const counts = SIGNATURES.map((s) => text.split("\n").filter((l) => s.re.test(l)).length);
+    if (counts.some((n) => n > 0)) { out[f] = counts; total += counts.reduce((a, b) => a + b, 0); }
+  }
+  // Sorted, so a re-mint produces a reviewable diff instead of a reordered file.
+  return { total, files: Object.fromEntries(Object.entries(out).sort(([a], [b]) => a < b ? -1 : 1)) };
+}