clearotron 0.2.1 → 0.2.3

package/driver/predelivery-lint.mjs

@@ -23,14 +23,15 @@
 // report-derived cover text alone, because a gate that simply stops running is not a gate that passes.
 
 import { REGION_NAMES } from "./publish/regions.mjs";
-import { canonicalJurisdictionCode } from "./jurisdiction-codes.mjs";   // tracker issue 134 — one spelling of a territory code
-import { searchedCovers } from "./frame-diff-model.mjs";                // tracker issue 134 — one copy of the EU-reach rule
+import { canonicalJurisdictionCode } from "./jurisdiction-codes.mjs";   // one spelling of a territory code
+import { searchedCovers } from "./frame-diff-model.mjs";                // one copy of the EU-reach rule
 import { partyFactSources, partyFactViolations, partyFactMessage, canJudgePartyFacts } from "./party-facts.mjs";   //
 import { writeUpViolations, writeUpMessage } from "./narrative-write-ups.mjs";   //
 
 import { findRegistryArithmeticIssues, findRegistryViolations, splitBlocks } from "./registry-fidelity.mjs";
 import { CLIENT_TIER_BY_COMPOSITE, joinFindingToBlock, parseBlockOrd, worstLiveBand, NO_RATED_CONFLICTS, deriveActionConditions, isUnconditionalProceed, verdictStance, joinAskToAnswer, projectAssessmentField, POSITION_REQUIRED_DISPOSITIONS, OFF_FIELD_GROUNDS, FINDINGS_SCHEMA_VERSION, netChainMarkers, STATEMENT_CLAUSE_MAX } from "./findings-model.mjs";
 import { normalizeBand } from "./framework.mjs";
+import { knockoutNoteView, REQUEST_NOTE_WORDS, REQUEST_SUBJECT_WORDS } from "./findings-model.mjs";   // one reader for where a note prints
 
 // V4-3: diacritics FOLD (NFD strip) instead of being deleted — "Televisión" must normalize to
 // "television" (deletion made it "televisin", so a diacritic mention never matched its introduction).
@@ -60,7 +61,7 @@ const REF_ALLOWLIST = new Set([
   // marketplace-platform vocabulary (the common-law sweep's standing surfaces, not entities to introduce).
   // LOAD-BEARING — do NOT delete to "de-gaming" the lint: the per-run profile-platform union (runLint
   // `extraVocab`) is DOMAIN-derived, so a single-label domain yields the bare brand ("walmart.com" →
-  // "walmart", so Zephyr Beverages' Walmart/Target/GNC are already covered with no static) but a MULTI-part domain
+  // "walmart", so a drinks account's Walmart/Target/GNC are already covered with no static) but a MULTI-part domain
   // does NOT ("store.steampowered.com" → "store steampowered", never "steam"), and "xbox"/"playstation"/
   // "nintendo" appear in NO platform domain at all. Removing these would fire false orphan flags on every
   // gaming report. The structural de-gaming fix is per-customer marketplace ALIASES in the bundle data
@@ -72,7 +73,7 @@ const REF_ALLOWLIST = new Set([
 // ── — A TERRITORY IS NOT A PARTY, AND A MARK IS NOT A PARTY ────────────────────────────────────
 // Two production clearances flagged six "parties the action list names that no finding identifies".
 // FOUR were not parties: "European Union", "United Kingdom", "United Arab Emirates" and a mark. The
-// check then emitted that into the report, which is 's other half.
+// check then emitted that into the report, which is the other half.
 //
 // Territory names come from `publish/regions.mjs` — the ONE naming source every render surface already
 // uses — rather than from the run's own jurisdiction list. Broader, and deliberately: a bare country
@@ -1547,7 +1548,7 @@ export function markAssessmentChecks({ markAssessment, expected }) {
 }
 
 /**
- * The DECLARED CONTRACT VERSION (, moved out of contentModelChecks by).
+ * The DECLARED CONTRACT VERSION (moved out of contentModelChecks by).
  *
  * It used to live inside contentModelChecks, whose first line is `if (!expected) return []`, where
  * `expected` is derived as `schema_version >= 5`. So the one check written to report a down-level
@@ -2237,7 +2238,7 @@ export function runLint({ depth, commonLawGrid, matterContext, clientPartyName,
       checks.push(...ownerScreenNegativeChecks({ text: clientSummaryMd, ownerScreen, markVocab, surface: "client-summary" }));
     }
   }
-  // tracker issue 134 — the delivered prose's coverage claims against what the run actually searched.
+  // the delivered prose's coverage claims against what the run actually searched.
   // Top-level, NOT inside the owner-screen guard above: a coverage claim has nothing to do with whether
   // this run has an owner screen, and nesting it there would have silently switched the check off for
   // every run without one. Both prose surfaces: the narrative is where the issue measured the
@@ -2305,7 +2306,7 @@ export function runLint({ depth, commonLawGrid, matterContext, clientPartyName,
 // The knockout (Stage 0/0.5) lane wrote NO predelivery-lint.json at all, by a decision recorded in
 // docs/DELIVERY.md (2026-07-28). That decision rested on two premises this tranche has since moved:
 // the lint artifact is now the WORKBOOK's QC record (/), so a lane that writes none produces an
-// EMPTY QC record rather than a deliberately-absent one; and 's A10 projects recorded defects onto
+// EMPTY QC record rather than a deliberately-absent one; and the A10 projects recorded defects onto
 // the cover note that reaches the reviewing lawyer, so a knockout defect reached nobody. What has NOT
 // moved is the other half of the memo: this lane's deliverable is store-rendered, and most clearance
 // checks read surfaces it does not produce. So the extension is a SUBSET, derived from what the lane
@@ -2352,6 +2353,122 @@ const knockoutSurfaces = (findings) => {
   return { report: report.filter(Boolean).join("\n\n"), working: working.filter(Boolean).join("\n\n") };
 };
 
+// ── PLAIN LANGUAGE ON WHAT A READER SEES FIRST (tracker issue 333) ─────────────────────────────────
+//
+// The report goes to a lawyer who layers advice on top, and that lawyer's client reads the same page.
+// The band, the summary, the basis line and the one-liners are the whole product for the second reader,
+// and they were the hardest lines on it: "a prior owner is likely to prevail on the marks-and-goods
+// comparison", "subsisting European rights", "the confusion comparison meets on every limb".
+//
+// THE PARTITION IS DEFAULT-VISIBLE vs FOLDED, WHICH IS NOT THE report/working SPLIT ABOVE. Since the
+// page folds each card's argument (tracker issue 331 A.3), a finding's `basis` is now behind a click,
+// and 333 rule 2 allows the lawyer's vocabulary there where a plain word would lose precision. The same
+// is true of the long `assessment`. So this check reads exactly the fields the renderer DRAWS without
+// a click, and reads nothing else — a check whose population is "the report" would flag the very
+// paragraphs the design deliberately moved out of the reader's way.
+//
+// THE WORD LIST IS A TRIPWIRE, NOT THE RULE. 333 rejects a banned-word list as the mechanism, and it is
+// right to: the rule is "does the reader already own this word?", which no list bounds. The list is what
+// a machine can check, seeded from the terms actually found on the two delivered pages. The teaching is
+// in the skill, where a writer reads it.
+//
+// FLAG-ONLY, AND NEVER PROJECTED. 333: "A hit is a rewrite of that line, never a disclosure and never a
+// run failure." These carry surface "findings", which runKnockoutLint's caller does not project onto
+// the cover note or the workbook — so a flag reaches whoever is fixing the run and nobody else.
+const LAWYER_VOCAB = [
+  ["proprietor", /\bproprietors?\b/i],
+  ["subsisting", /\bsubsisting\b/i],
+  ["senior right", /\bsenior (?:right|mark|position)/i],
+  ["specification", /\bspecifications?\b/i],
+  ["formative", /\bformatives?\b/i],
+  ["prevail", /\bprevails?\b|\bprevailing\b/i],
+  ["citable", /\bcitable\b/i],
+  ["limb", /\bon every limb\b|\ball limbs\b/i],
+  ["non-use attack", /\bnon-?use attack\b/i],
+  ["belt-and-braces", /\bbelt-?and-?braces\b/i],
+  ["dispatch", /\bdispatch(?:ed|es)?\b/i],
+  ["lane", /\blanes?\b/i],
+  ["on the record as it stands", /\bon the record as it stands\b/i],
+  ["the marks-and-goods comparison", /\bmarks-and-goods comparison\b/i],
+  ["chunk", /\bchunks?\b/i],
+];
+
+/** The longest a default-visible sentence may run before it stops being one idea (333 rule 1). */
+const PLAIN_SENTENCE_WORDS = 25;
+
+/**
+ * The fields a reader of the knockout meets before opening anything, named one by one rather than
+ * derived, so adding a field to the page is a deliberate addition here too.
+ */
+function knockoutVisibleProse(findings) {
+  const out = [];
+  const add = (where, v) => { const t = String(v ?? "").trim(); if (t) out.push({ where, text: t }); };
+  add("the batch summary", findings?.batch?.executiveSummary);
+  for (const c of findings?.batch?.standardCaveats ?? []) add("a standing caveat", c);
+  for (const m of findings?.marks ?? []) {
+    const n = String(m?.name ?? "a mark");
+    add(`${n}'s basis line`, m?.basis);
+    for (const f of m?.factors ?? []) add(`${n}'s "why this band" list`, f);
+    for (const f of m?.counterFactors ?? []) add(`${n}'s "why not the next band" list`, f);
+    add(`${n}'s mitigation line`, m?.mitigation);
+    for (const p of m?.purpleNotes ?? []) add(`${n}'s note to the reviewing lawyer`, p?.text ?? p);
+    for (const r of m?.registerReads ?? []) add(`${n}'s read of a filing`, r?.read);
+    // The finding's ONE sentence. Its `basis` is folded and is deliberately not read here.
+    for (const f of m?.findings ?? []) add(`${n} conflict ${f?.ordinal ?? ""}`.trim(), f?.net);
+  }
+  return out;
+}
+
+/**
+ * plainLanguageChecks — two flags over the default-visible prose: the lawyer's vocabulary, and a
+ * sentence carrying more than one idea. Each names the field, so a hit is a line somebody can rewrite
+ * rather than a score.
+ */
+export function plainLanguageChecks({ findings, surface = "findings" } = {}) {
+  const fields = knockoutVisibleProse(findings);
+  const vocab = [];
+  const longSentences = [];
+  for (const { where, text } of fields) {
+    for (const [name, re] of LAWYER_VOCAB) if (re.test(text)) vocab.push(`${where}: "${name}"`);
+    for (const sentence of text.split(/(?<=[.!?])\s+|\n+/)) {
+      const n = sentence.trim().split(/\s+/).filter(Boolean).length;
+      if (n > PLAIN_SENTENCE_WORDS) longSentences.push(`${where}: ${n} words`);
+    }
+  }
+  // ── A NOTE THAT WILL PRINT IN THE PLACE ITS WRITER DID NOT MEAN ────────────────────────────────────
+  //
+  // The page files a reviewer's note by what it TALKS ABOUT: name the request and it prints at the top,
+  // above the conflicts; otherwise it prints under that name's cards. That is what lets an archived run
+  // put its mis-scoping flag where the owner asked for it without a new field.
+  //
+  // THE COST OF THAT CHOICE IS EXACTLY THIS FLAG. A note plainly about the asking — the client's stated
+  // industry, its own prior use, whether the goods are the right ones — that never says "the request"
+  // sorts as a note about the NAME and prints at the bottom, which is the defect the move exists to fix.
+  // Nothing about the page would look wrong; the line would simply be in the last place read.
+  //
+  // So the reviewer says so, to the one person who can fix it, in the one place a fix belongs: the note.
+  // The page never guesses. Adding a clause naming the request is the whole remedy.
+  const misfiled = [];
+  for (const m of findings?.marks ?? []) {
+    for (const raw of m?.purpleNotes ?? []) {
+      const v = knockoutNoteView(raw);
+      if (!v.text || v.about) continue;              // the rater said which; nothing is inferred
+      if (REQUEST_NOTE_WORDS.test(v.text)) continue; // it names the request and will print at the top
+      if (!REQUEST_SUBJECT_WORDS.test(v.text)) continue;
+      misfiled.push(`${m?.name ?? "a mark"}: "${v.text.trim().replace(/\s+/g, " ").slice(0, 70)}…"`);
+    }
+  }
+  const say = (hits) => `${hits.slice(0, 5).join("; ")}${hits.length > 5 ? `; +${hits.length - 5} more` : ""}`;
+  return [
+    check("reviewer-note-subject", "voice", surface, misfiled.length === 0,
+      misfiled.length ? `a note about what was asked that never names the request — it will print under this name's conflicts rather than at the top of the page, where a question about the request belongs. Name the request in the note: ${say(misfiled)}` : ""),
+    check("plain-language-vocabulary", "voice", surface, vocab.length === 0,
+      vocab.length ? `the lawyer's vocabulary on lines a reader meets before opening anything — rewrite the line in the words the reader already owns (the skill carries the swaps): ${say(vocab)}` : ""),
+    check("plain-language-sentence-length", "voice", surface, longSentences.length === 0,
+      longSentences.length ? `a default-visible sentence carrying more than one idea (over ${PLAIN_SENTENCE_WORDS} words) — split it, conclusion first: ${say(longSentences)}` : ""),
+  ];
+}
+
 /**
  * KNOCKOUT_ABSENT_BY_DESIGN — the clearance checks this lane does NOT run, each with the reason its
  * input does not exist here. This is the third state (/'s rule, in the lint's own vocabulary):
@@ -2423,6 +2540,9 @@ export function runKnockoutLint({ findings }) {
   // (publish/report-registry.mjs re-renders archived findings without re-running the merged validator)
   // this scan is the only permission-prose coverage there is.
   if (working.trim()) checks.push(...permissionProseChecks({ text: working, surface: "findings", idSuffix: ":knockout-working", structural: true, cards: false }));
+  // tracker issue 333 — the plain-language reviewer, over the fields a reader meets before opening a
+  // fold. Internal by surface, so a hit reaches whoever is fixing the run and never a delivery surface.
+  checks.push(...plainLanguageChecks({ findings }));
   const failures = checks.filter((c) => !c.pass);
   return { checks, failures, notApplicable: KNOCKOUT_ABSENT_BY_DESIGN };
 }
@@ -2454,6 +2574,13 @@ export function flagLines(failures) {
 // vendor vocabulary, no ids, no paths, no field names, no instructions to whoever regenerates the run,
 // never "certified"/"signed". deliveryVocabViolations() below enforces that mechanically.
 const DELIVERY_LINES = {
+  // Keyed on the FULL check id, which deliveryFlagLines resolves before the base — see the note there.
+  // The sentence states the CONSEQUENCE, in the receipt's own terms: not "a check failed" but "the rule
+  // was applied to nothing". Eleven graded runs delivered carrying this, two of them orderable product
+  // demos, and the only place it was written was one row of a fifty-odd-row receipt nobody routes.
+  "narrative-write-ups:could-not-read":
+    "The depth rules for the written-up findings were applied to nothing on this run — the narrative "
+    + "carries no block this check can read, so neither the ranking cut nor the length cap was verified.",
   // template — the summary table against the names actually searched
   "names-cell-populated": "The summary table does not name the mark that was searched.",
   "assessment-row": "A searched name has no assessment of its own in the summary table.",
@@ -2555,15 +2682,26 @@ export function deliveryVocabViolations(line) {
 export function deliveryFlagLines(failures) {
   const groups = new Map();
   for (const f of failures ?? []) {
-    const base = String(f?.id ?? "").split(":")[0];
+    const id = String(f?.id ?? "");
+    const base = id.split(":")[0];
     const family = String(f?.family ?? "");
-    const key = base || `family/${family}`;
-    const g = groups.get(key) ?? { base, family, n: 0 };
+    // A CHECK WHOSE DISTINCTION LIVES IN ITS SUFFIX COULD NOT BE SAID HERE (tracker issue 267).
+    //
+    // Grouping on `base` alone is right for the common case — a word-cap violation on nine write-ups is
+    // one delivery line, not nine. But it also collapsed `narrative-write-ups:could-not-read` into the
+    // same bucket as an ordinary depth violation, and those are different facts: one says a rule was
+    // broken, the other says the rule was ENFORCED ON NOTHING. The second had no sentence of its own to
+    // reach, so it degraded to the generic "a machine check did not pass" and became invisible.
+    //
+    // So: an entry keyed on the FULL id wins where one exists, and everything else groups by base
+    // exactly as before. This adds no line to any run that did not already produce one.
+    const key = DELIVERY_LINES[id] ? id : (base || `family/${family}`);
+    const g = groups.get(key) ?? { base, family, id: DELIVERY_LINES[id] ? id : null, n: 0 };
     g.n += 1;
     groups.set(key, g);
   }
   return [...groups.values()].map((g) => {
-    const sentence = DELIVERY_LINES[g.base] ?? DELIVERY_FAMILY_LINES[g.family] ?? DELIVERY_GENERIC;
+    const sentence = (g.id && DELIVERY_LINES[g.id]) ?? DELIVERY_LINES[g.base] ?? DELIVERY_FAMILY_LINES[g.family] ?? DELIVERY_GENERIC;
     // Belt and braces: a table entry that trips the house rules degrades to the generic instead of
     // shipping. This is what makes "no engine vocabulary reaches a reader" structural rather than a
     // matter of everyone remembering the rule when they add a check.

package/driver/prelim-variants-record.mjs

@@ -55,7 +55,7 @@ export function prelimVariantsCallPaths(runDir) {
 // The first cut of this file declared its own copy of the layer vocabulary — field, jurisdiction,
 // variant, source — under a comment saying "taken from the shipped parser, never re-chosen here", while
 // re-choosing it: the shipped parser orders the same four as variant, field, source, jurisdiction. The
-// comment asserted the exact property it broke, which is why a reader could not catch it and 's scan
+// comment asserted the exact property it broke, which is why a reader could not catch it and the scan
 // could. That check binds every parsed declaration of a closed set to the live import, found two
 // declarations of one name, and reported the disagreement.
 //
@@ -112,7 +112,7 @@ export function renderPrelimVariants(model, scopeRows) {
   //
   // `variantsManifestAudit` (common-law-receipts.mjs) arms a term collector on any heading matching
   // /variants\b/i and closes it on the next heading AT THE SAME DEPTH OR SHALLOWER. Deeper headings are
-  // sub-groups INSIDE the section and deliberately keep it armed — that is 's fix, for a real
+  // sub-groups INSIDE the section and deliberately keep it armed — that is the fix, for a real
   // manifest whose 84 variants sat under seven `####` sub-headings and parsed as zero.
   //
   // So a `## Variants` section followed by a `### Scope ledger` NEVER CLOSES, and every ledger row is

package/driver/profile-page.html

@@ -35,7 +35,7 @@ ul.roster{list-style:none;margin:0;padding:0}
 ul.roster li{padding:8px 10px;border-radius:8px;cursor:pointer;font-size:14px;border:1px solid transparent}
 ul.roster li:hover{background:var(--bg)}
 ul.roster li.sel{background:var(--bg);border-color:var(--line);font-weight:700}
-/* the sub-line truncates (2-line clamp) — a long industry string (aurora's is ~110 chars) must never
+/* the sub-line truncates (2-line clamp) — a long industry string (one profile's is ~110 chars) must never
    stretch the 240px roster column into an overflowing wall of text */
 ul.roster li .ind{display:-webkit-box;-webkit-line-clamp:2;line-clamp:2;-webkit-box-orient:vertical;overflow:hidden;font-size:11.5px;color:var(--muted);font-weight:400}
 ul.roster li .ind code.slug{font-size:10.5px;letter-spacing:.02em}
@@ -136,7 +136,15 @@ const csv = (s) => String(s||"").split(",").map(x=>x.trim()).filter(Boolean);
 const fwName = (path) => { const m = String(path||"").match(/risk-framework-([a-z0-9-]+)\.md/i); return m ? (m[1].charAt(0).toUpperCase() + m[1].slice(1) + " framework") : "Generic default framework"; };
 // doc 50 — the band ladder preview, from the manifest the service serves (tones map to the page palette).
 const TONE_BG = {severe:"#b3261e", high:"#c75b13", medium:"#9a8400", low:"#4e7a31", minimal:"#2f55a4"};
-const bandLadder = (m) => m && m.bands ? `<div style="margin:6px 0 2px">${m.bands.map(b=>`<span style="display:inline-block;margin:0 6px 4px 0;padding:2px 9px;border-radius:999px;background:${TONE_BG[b.tone]||"#666"};color:#fff;font-size:11px;font-weight:700">${esc(b.label)}</span>`).join("")}</div>` : "";
+// LABELLED, for the same reason as the portal's copy of this row. Four coloured pills with nothing
+// saying what they are, sitting under a heading that reads "Risk framework in force", were read by an
+// outside user as four frameworks: "how do I have FOUR risk frameworks live at the same time?" He had
+// one. The label names the framework's ownership of the scale — "its ratings" — because the sentence
+// immediately above names the framework and the only ambiguity is whether these belong to it.
+//
+// The two editors say the same words on purpose. This one is the staff page and the portal has its own;
+// a reader who sees both should not have to work out whether they are describing the same thing.
+const bandLadder = (m) => m && m.bands ? `<div style="font-size:12px;color:var(--slate);margin:10px 0 0">Its ratings, strongest concern first:</div><div style="margin:6px 0 2px">${m.bands.map(b=>`<span style="display:inline-block;margin:0 6px 4px 0;padding:2px 9px;border-radius:999px;background:${TONE_BG[b.tone]||"#666"};color:#fff;font-size:11px;font-weight:700">${esc(b.label)}</span>`).join("")}</div>` : "";
 // doc 50 — "What the bands mean": deck-native prose the service lifts from the framework .md at view time
 // (display-only; omitted whenever extraction missed). The decks are Privileged & Confidential, so the prose
 // is wrapped in data-anon="mark" — the demo privacy blur must cover it.
@@ -256,7 +264,7 @@ function collect() {
   // writes ABSENCE and never `false` (tracker issue 1991). It was a checkbox, which rendered absent and
   // `false` identically and wrote a boolean on every save — so a customer who had given no instruction
   // was recorded as "strip the line" the first time anybody pressed Save on an unrelated field, and
-  // their next report shipped with no confidentiality line. That is tracker issue 761's incident on this door.
+  // their next report shipped with no confidentiality line. That is the incident this door has already had.
   // `true` is retired and renders as the default (shared/brand.mjs confPosture), so it folds to the same
   // option and saves as absence rather than storing a distinction the output can no longer carry.
   if ($("f_priv").value === "no") delivery.privileged = false; else delete delivery.privileged;

package/driver/profile-selection.mjs

@@ -2,7 +2,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // profile-selection.mjs — which findings the refutation seat is asked to profile, chosen by the DRIVER.
 //
-// 's architecture: "prefer driver selection wherever the key precedes the dispatch." The band is
+// That architecture: "prefer driver selection wherever the key precedes the dispatch." The band is
 // on findings.json before narrative-refutation is dispatched, so there is nothing for a directive to
 // ask the seat to judge — the driver lists the ordinals and unlisted work is never requested.
 //

package/driver/profile-service.mjs

@@ -75,7 +75,7 @@ function manifestFor(fwPath) {
 // shipped decks, so a deck edit that breaks extraction fails CI instead of silently blanking the box.
 const stripMd = (s) => String(s ?? "").replace(/\*+/g, "").trim();
 
-// matrix-shaped decks (aurora): the deck's "Band meanings" table is the only table whose FIRST cell is
+// matrix-shaped decks: the deck's "Band meanings" table is the only table whose FIRST cell is
 // exactly the band label (the matrix table suffixes its labels with the deck's internal indices, e.g.
 // "**Very High** *(5)*") — take that row's cells as { band, meaning, response }.
 function matrixBandMeanings(deck, manifest) {
@@ -97,7 +97,7 @@ function matrixBandMeanings(deck, manifest) {
   return out;
 }
 
-// bands-shaped decks (house, zephyr): each band lives under its own heading ("## VERY HIGH RISK") — find
+// bands-shaped decks (the house default among them): each band lives under its own heading ("## VERY HIGH RISK") — find
 // the section whose heading STARTS WITH the band label ("High" must never steal "VERY HIGH RISK") and lift
 // EVERY rung the band states, in the deck's own order.
 //
@@ -172,8 +172,8 @@ function bandMeaningsFor(fwPath, manifest) {
 
 // CODE-OWNED fields — the framework SELECTION. The editor page has no form fields for these, so a save
 // assembled from the form omits them, and defaultWriteProfile rewrites the whole file: the 2026-07-04/05 UI
-// saves (587324ab, cea0ca2f, c59030a1) silently stripped frameworkPath/workedExamplesPath from zephyr and
-// aurora, flipping both customers to the house-default framework. The on-disk value ALWAYS wins here — a
+// saves (587324ab, cea0ca2f, c59030a1) silently stripped frameworkPath/workedExamplesPath from two
+// profiles, flipping both customers to the house-default framework. The on-disk value ALWAYS wins here — a
 // client body can neither drop, change, nor introduce a framework selection (git + review gated, per the
 // header rules). Applied to validate AND save so the dry run judges exactly what a save would write.
 // Search-depth spine: allowedRecipes/jxPolicy/runCaps have NO form fields on the editor page — without
@@ -441,7 +441,7 @@ export function makeProfileService({
       // The transition is encoded in the message so the config store's git log reads as an audit trail —
       // the same three words saved searches emit (an un-archive reads as "update" there too).
       const transition = exists ? (overlayBody.archived && !priorOverlay?.archived ? "archive" : "update") : "create";
-      const message = `chore(prelim): ${transition} project ${customer}/${project} (via config UI, by ${by})`;
+      const message = `chore(clearotron): ${transition} project ${customer}/${project} (via config UI, by ${by})`;
       // — the row rides IN the commit, so it no longer names a sha. shared/store-in-repo.mjs says why.
       const { commit, commitError } = commitWithAuditRow({ audit, gitCommit, files, message, by,
         row: { event: exists ? "project-update" : "project-create", key: fq, by, fields: Object.keys(overlayBody),
@@ -494,7 +494,7 @@ export function makeProfileService({
     // fault) threw out of the handler, so the user was told "Nothing was written. Try again shortly."
     // about a profile that was already governing production, and the audit() call below was skipped —
     // leaving no record of who changed it. Same guard the project branch above already carries.
-    const message = `chore(prelim): ${exists ? "update" : "create"} customer profile ${key} (via config UI, by ${by})`;
+    const message = `chore(clearotron): ${exists ? "update" : "create"} customer profile ${key} (via config UI, by ${by})`;
     // — the row rides IN the commit, so it no longer names a sha. shared/store-in-repo.mjs says why.
     const { commit, commitError } = commitWithAuditRow({ audit, gitCommit, files, message, by,
       row: { event: exists ? "profile-update" : "profile-create", key, by, fields: Object.keys(effective) } });

package/driver/profiles/README.md

@@ -21,8 +21,8 @@ With no key, `resolveProfile(job)` matches `job.forwarderDomain` against each
 profile's `matchDomains[]` (exact host or dot-suffix — the original `selectCustomer` semantics),
 else `generic.json`. The applicant named in the request (`job.customer`) NEVER selects a profile —
 it only activates `selfExclusionOwners[]` when it matches the profile's `name`
-(`applicantMatchesProfile`: word-boundary containment, so an aurora-interactive.example-forwarded
-search for a third-party applicant never buries genuine Aurora Interactive-owned conflicts as
+(`applicantMatchesProfile`: word-boundary containment, so a search forwarded from a customer's own
+domain but asking about a third-party applicant never buries that customer's own conflicts as
 "own rights").
 
 Resolution happens ONCE at run start and is frozen into the run's sidecar
@@ -52,7 +52,7 @@ consumes it; a unit test greps each symbol, so a field with no live consumer fai
 | `selfExclusionOwners[]` | structural | the customer's own/affiliate names — own-rights classification seed, applicant-gated as above |
 | `delivery` | delivery | `{ email: "summary", privileged: bool }` — the "Privileged & Confidential" header. Two further optional sub-keys are accepted: `style` (a prose string, guarded by the same anti-rule check as a context pack, dictated into the `report-overview` and `report-card` stages as presentation tone and never to `synthesis`, the rating stage) and `template` (a report-template name; `"standard"` is the only one that exists, and it is the default). **Absent ⇒ neutral default** (`{email:"summary"}` — deliberately SILENT on `privileged`, which is three-state on every surface that reads it (`confPosture`): `true` extends the marking to "Attorney Work Product", `false` is a deliberate OFF, and absent is no opinion, which gets the plain "Privileged & Confidential" every legal deliverable carries. Saying `false` in the neutral overlay read as an instruction to strip the marking, and a Generic-default clearance shipped with no line at all). `email` no longer selects anything: every run's mail is a COVER NOTE pointing at the one report. The old `"table"` value — a full review table inlined into the mail body — is **retired**; it is still accepted at load so stored profiles keep validating, and folded to `"summary"` by `normalizeDelivery`. A customer who wants their own house format gets it drafted by the assistant from the run's `report-data.json`, where a person reads it before it goes |
 | `riskAppetite` | context | a PROSE-POSTURE string (optional) that flavours **emphasis + recommended follow-up** in delivery curation — the two stages that are dictated it, `report-overview` and `report-card` — **never the Level/Composite**. A load-time anti-threshold guard rejects numeric/threshold phrasing (`>50%`, `Level C or above`, `threshold`); the "never decides" invariance itself is gated by review |
-| `marketplaceDensity` | structural | `"sparse"` (default) \| `"dense"` — selects the per-profile grid cell budget so a byte-heavy marketplace's verbatim stdout fits the worker output channel (sparse ⇒ 98-cell budget; dense ⇒ 16). Dense fits long retail listings (Zephyr beverages/supplements); gaming stores stay sparse |
+| `marketplaceDensity` | structural | `"sparse"` (default) \| `"dense"` — selects the per-profile grid cell budget so a byte-heavy marketplace's verbatim stdout fits the worker output channel (sparse ⇒ 98-cell budget; dense ⇒ 16). Dense fits long retail listings (beverages and supplements); gaming stores stay sparse |
 | `frameworkPath` | rating authority | optional path to the customer's OWN risk framework (`skills/prelim-search/<file>.md`, path-escape-blocked). **The framework in force RATES the matter** — the customer's own if on file, else the Generic default `risk-framework.md`; nothing in between. Each framework is a prose deck (the client's own rubric, reasoned WITH) plus a `.manifest.json` sidecar carrying its band vocabulary (`test/framework-lint.test.mjs` guards the pair). Git + legal-team gated; the config UI shows which is in force, read-only |
 | `workedExamplesPath` | context | optional path to a per-customer worked-examples set (`skills/prelim-search/<file>.md`). The analysis DEPTH TARGET in `synthesis`, calibrated under that customer's framework; **absent ⇒ the Generic default `worked-examples.md`** |
 | `defaultProduct` | entitlement | which of the four searches runs when a request names none (`search-policy.mjs`). May be left unset, and that is not a gap — a clearance that names no product is then named by its own resolved territories |