clearotron 0.2.2 → 0.2.3

package/driver/portal-report.mjs

@@ -21,7 +21,7 @@ import { SUMMARY_BLOCK_LINE } from "../shared/summary-blocks.mjs";
 // a brand lockup, links to the pool index, status, profiles, and a "Clients" dropdown listing
 // EVERY customer by key:
 //
-//     <a href="../customer/zephyr/">…  <a href="../customer/aurora/">…
+//     <a href="../customer/coastline/">…  <a href="../customer/foxglade/">…
 //
 // That is correct for a file a lawyer opens from the archive, and it is a disclosure of the client list
 // to anybody else. It has to come out before the document is embedded, and not because the nav is ugly:

package/driver/portal-service.mjs

@@ -38,7 +38,7 @@ import { readFileSync, existsSync, readdirSync, statSync } from "node:fs";
 import { storeInRepo, storeOutsideRepoMessage, makeCommittableAudit, resolveStoreRepoRoot, makeStoreCommit } from "../shared/store-in-repo.mjs";   //,
 import { customerStoreDir, customerStoreLine } from "../shared/customer-store.mjs";   // — one store for the surface and the runs
 import { clientFailureNote } from "../shared/client-failure-note.mjs";   // — one sentence, three surfaces
-import { bareInvocation, invocationPrefix } from "../shared/invocation.mjs";   // — and why this one surface is by NAME
+import { bareInvocation, invocationPrefix, installRoute } from "../shared/invocation.mjs";   // — and why this one surface is by NAME
 import { stdioConnectOffer, stdioConnectFor, STDIO_SHAPES } from "../shared/stdio-connect.mjs";   // — ONE author for the connect route
 import { connectOffers, offersForWire } from "../shared/connect-clients.mjs";                 // — ONE table, resolved server-side
 // — the portal became an ISSUANCE PATH here, deliberately and by owner ruling.
@@ -92,7 +92,7 @@ import { readFlagSnapshot, builtFor, registerCanCountFor, registerTerritoriesFor
 import { isDemo, demoPostureLine } from "./demo-posture.mjs";   
 import { triggerCapGap, triggerCapWarning } from "./trigger-cap.mjs";   // F51 — one answer, three surfaces
 import { makeUpstream } from "./portal-upstream.mjs";
-import { flagView, accessView, observedView, authView } from "./portal-config-view.mjs";
+import { flagView, accessView, observedView, authView, staffRuleSource } from "./portal-config-view.mjs";
 import { livePosture } from "./flag-snapshot.mjs";   // — for the capture-vs-box comparison only, never for a value
 import { familiesView, groupRuns, ungroupRuns } from "./portal-families.mjs";
 import { validateJob } from "./enqueue-schema.mjs";
@@ -1029,6 +1029,11 @@ function outcomeRow({ event = "request-refused", method, path, email = null, sta
 export function makePortalService({
   poolRoot, workspaceRoot, recipesDir = undefined, secret,
   staffDomains = [], grants = null,
+  // Where the staff-domain rule is written, for the People & access page to name. INJECTED, because
+  // the answer is a fact about the PROCESS — which file, if any, it took its configuration from — and
+  // this constructor is deliberately pure over its inputs. Null means "no rule, or could not tell",
+  // and the page then says nothing rather than guessing at a path.
+  staffRule = null,
   // The queue directories the RUNNER drains — the same list it hands checkRunCaps. The allowance counter
   // and the quota pre-check read their ledger beside these, so they count what the wall counts (:
   // they used to reconstruct a workspace-relative path that resolved to nothing once the queue moved out
@@ -1338,7 +1343,7 @@ export function makePortalService({
         assertPrincipal(principal, { door: true });   // door check only — a multi-account client enters and gets the picker list
         // `accountNames` — the DISPLAY name of each account this identity holds, and nothing else.
         //
-        // Every profile carries a name ("Vantor Labs", "Aurora Interactive"); the account KEY is a
+        // Every profile carries a name ("Vantor Labs", "Foxglade Interactive"); the account KEY is a
         // slug ("vantor"). Staff read names because the account picker fetches the staff-only
         // roster; a client had no name source at all, so the identical screen printed the slug at them.
         // The same brand owner therefore read two different ways depending on who signed in, which is
@@ -1386,6 +1391,12 @@ export function makePortalService({
         // must leave the button alone rather than infer demo from an absent file.
         return { status: 200, json: { role: principal.role, email: principal.email, accounts: principal.accounts, accountNames,
           concurrentRuns: concurrentRunsCap(), brand: BRAND.name, engineMode: flagView(poolRoot).engineMode,
+          // HOW THIS INSTALL ARRIVED, so a screen can name the setup command the reader can actually
+          // type. `npm run setup` and `npx clearotron install` are the same wizard and each one is
+          // unrunnable on the other route; the no-engine notice named one of them and was wrong for
+          // half its readers. A WORD, never a command line and never a prefix: `invocationForm` can
+          // answer with this machine's absolute path, and this value is rendered in a browser.
+          setupRoute: installRoute(),
           // — a button that always fails must not render as available. The reason is
           // operator-shaped and staff-only; a client reads the generic sentence the button carries.
           controls: { stop: { available: stopControl.available !== false,
@@ -2822,7 +2833,7 @@ export function makePortalService({
             const p = envFrom(process.env, "CLEAROTRON_ACCESS_FILE");
             if (p) grantsFile = { name: basename(p), modifiedAt: new Date(statSync(p).mtimeMs).toISOString() };
           } catch { /* reported as unknown; a failed stat must not take down the page that explains access */ }
-          return { status: 200, json: accessView({ grants: grantsNow(), staffDomains, knownAccounts, grantsFile }) };
+          return { status: 200, json: accessView({ grants: grantsNow(), staffDomains, knownAccounts, grantsFile, staffRule }) };
         }
         // /portal/admin/observed — who has actually USED this instance lately, from the audit log.
         //
@@ -3506,7 +3517,7 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
       // local-auth block, so calling it from here threw ReferenceError and this route answered 500 —
       // worse than the dead link it replaced, because a dead link looks like a dead link and a 500
       // looks like the server broke. Found by `npm run lint:driver`, which says it in one line
-      // (`'redirect' is not defined`), and by role-dev/Grogu driving the route rather than reading it.
+      // (`'redirect' is not defined`), and by driving the route rather than reading it (review, 2026-08).
       // Hoisting that helper would move it away from the comment explaining its own no-`?next=` rule,
       // so the four lines live here instead.
       if (!localAuth && url.pathname === "/portal/sign-out") {
@@ -3915,6 +3926,14 @@ const PORT = PORT_CHOICE.port;
   const grants = () => loadGrants({});
   const staffDomains = (process.env.PORTAL_STAFF_DOMAINS || "").split(",").map((s) => s.trim()).filter(Boolean);
   if (!staffDomains.length && !grants()) { log(`FATAL: neither PORTAL_STAFF_DOMAINS nor CLEAROTRON_ACCESS_FILE configured — nobody could ever sign in (fail-closed).`); process.exit(1); }
+  // WHERE THAT RULE IS WRITTEN, resolved once at boot and handed to the service. `loaded` is this
+  // process's own report of which file configured it — never a path composed here, which would answer
+  // for a process that read nothing (see `envFileRead`'s note in shared/env-local.mjs).
+  const { loaded, unitEnvPath, envLocalPath } = await import("../shared/env-local.mjs");
+  const staffRule = staffRuleSource({
+    value: process.env.PORTAL_STAFF_DOMAINS, envLoad: loaded,
+    unitEnvFile: unitEnvPath(), cliEnvFile: envLocalPath(),
+  });
 
   const { config } = await import("./driver.config.mjs");
   const { appendFileSync: append } = await import("node:fs");
@@ -4188,7 +4207,7 @@ const PORT = PORT_CHOICE.port;
       // The result was not a failure. It was worse. With the overlay unset, resolveSkillPath falls back
       // to the PRODUCT REPO's own driver/skills — where the customer frameworks either do not exist
       // (a config-store-only customer → the page's fail-loud "could not be read" card) or exist as the SYNTHETIC
-      // DEMO fixtures the sellable codebase ships (Aurora, Zephyr → "Aurora Interactive risk framework
+      // DEMO fixtures the repository carries for the suite (a framework titled "… risk framework
       // (synthetic demo)", source_deck "content invented"). The second case renders with a title, a band
       // ladder and band meanings, and is indistinguishable on screen from the client's real framework.
       // A lawyer read invented risk definitions as their client's own for as long as this was live.
@@ -4356,7 +4375,7 @@ const PORT = PORT_CHOICE.port;
   const service = makePortalService({ poolRoot: config.poolRoot, workspaceRoot: config.workspaceRoot,
     // Re-read per request (a getter that rescans), so a workspace created after boot is counted.
     queueDirs: () => config.queueDirs,
-    secret, staffDomains, grants, trigger, stopRun, audit, auditPath, upstream, composeRead, stopControl,
+    secret, staffDomains, staffRule, grants, trigger, stopRun, audit, auditPath, upstream, composeRead, stopControl,
     // — the ONLY place the environment is read for this. `bin/start.mjs` is the
     // only thing that sets it, and it sets it explicitly rather than passing the operator's inherited
     // environment through, so a stray `.env` can neither put a live install into demo mode nor take a

package/driver/portal-upstream.mjs

@@ -96,7 +96,7 @@ export const PATH_FIELDS = ["frameworkPath", "workedExamplesPath"];
 /**
  * The code-owned values, READ-ONLY, for display. The page shows them badged; it cannot send them.
  *
- * Two of them are PATHS INSIDE THE ENGINE — `skills/prelim-search/risk-framework-zephyr.md` — and they
+ * Two of them are PATHS INSIDE THE ENGINE — `skills/prelim-search/risk-framework-<customer>.md` — and they
  * are withheld from a client here, on the server, where the role is already in hand. The React page has
  * filtered them out of its own render since the rebuild, but a filter in the browser is a display
  * convenience and not a wall: the value still crossed the wire and was one devtools tab away.
@@ -129,7 +129,7 @@ export function readOnlyFields(profile, { staff = false } = {}) {
  *
  *   house    "…IP Risk Assessment Framework.pptx (Privileged & Confidential), transcribed 2026-07-05
  *             (doc 50); supersedes the client-transposed neutral default"
- *   aurora   "Synthetic demo transposition of a customer risk deck (structure faithful, content
+ *   demo     "Synthetic demo transposition of a customer risk deck (structure faithful, content
  *             invented), doc 50 shape"
  *   triage   "Ported from the interactive knockout-searches skill's 5-tier rating system (SKILL.md
  *             rating table + calibration rules), doc 50 shape"

package/driver/predelivery-lint.mjs

@@ -31,6 +31,7 @@ import { writeUpViolations, writeUpMessage } from "./narrative-write-ups.mjs";
 import { findRegistryArithmeticIssues, findRegistryViolations, splitBlocks } from "./registry-fidelity.mjs";
 import { CLIENT_TIER_BY_COMPOSITE, joinFindingToBlock, parseBlockOrd, worstLiveBand, NO_RATED_CONFLICTS, deriveActionConditions, isUnconditionalProceed, verdictStance, joinAskToAnswer, projectAssessmentField, POSITION_REQUIRED_DISPOSITIONS, OFF_FIELD_GROUNDS, FINDINGS_SCHEMA_VERSION, netChainMarkers, STATEMENT_CLAUSE_MAX } from "./findings-model.mjs";
 import { normalizeBand } from "./framework.mjs";
+import { knockoutNoteView, REQUEST_NOTE_WORDS, REQUEST_SUBJECT_WORDS } from "./findings-model.mjs";   // one reader for where a note prints
 
 // V4-3: diacritics FOLD (NFD strip) instead of being deleted — "Televisión" must normalize to
 // "television" (deletion made it "televisin", so a diacritic mention never matched its introduction).
@@ -60,7 +61,7 @@ const REF_ALLOWLIST = new Set([
   // marketplace-platform vocabulary (the common-law sweep's standing surfaces, not entities to introduce).
   // LOAD-BEARING — do NOT delete to "de-gaming" the lint: the per-run profile-platform union (runLint
   // `extraVocab`) is DOMAIN-derived, so a single-label domain yields the bare brand ("walmart.com" →
-  // "walmart", so Zephyr Beverages' Walmart/Target/GNC are already covered with no static) but a MULTI-part domain
+  // "walmart", so a drinks account's Walmart/Target/GNC are already covered with no static) but a MULTI-part domain
   // does NOT ("store.steampowered.com" → "store steampowered", never "steam"), and "xbox"/"playstation"/
   // "nintendo" appear in NO platform domain at all. Removing these would fire false orphan flags on every
   // gaming report. The structural de-gaming fix is per-customer marketplace ALIASES in the bundle data
@@ -2352,6 +2353,122 @@ const knockoutSurfaces = (findings) => {
   return { report: report.filter(Boolean).join("\n\n"), working: working.filter(Boolean).join("\n\n") };
 };
 
+// ── PLAIN LANGUAGE ON WHAT A READER SEES FIRST (tracker issue 333) ─────────────────────────────────
+//
+// The report goes to a lawyer who layers advice on top, and that lawyer's client reads the same page.
+// The band, the summary, the basis line and the one-liners are the whole product for the second reader,
+// and they were the hardest lines on it: "a prior owner is likely to prevail on the marks-and-goods
+// comparison", "subsisting European rights", "the confusion comparison meets on every limb".
+//
+// THE PARTITION IS DEFAULT-VISIBLE vs FOLDED, WHICH IS NOT THE report/working SPLIT ABOVE. Since the
+// page folds each card's argument (tracker issue 331 A.3), a finding's `basis` is now behind a click,
+// and 333 rule 2 allows the lawyer's vocabulary there where a plain word would lose precision. The same
+// is true of the long `assessment`. So this check reads exactly the fields the renderer DRAWS without
+// a click, and reads nothing else — a check whose population is "the report" would flag the very
+// paragraphs the design deliberately moved out of the reader's way.
+//
+// THE WORD LIST IS A TRIPWIRE, NOT THE RULE. 333 rejects a banned-word list as the mechanism, and it is
+// right to: the rule is "does the reader already own this word?", which no list bounds. The list is what
+// a machine can check, seeded from the terms actually found on the two delivered pages. The teaching is
+// in the skill, where a writer reads it.
+//
+// FLAG-ONLY, AND NEVER PROJECTED. 333: "A hit is a rewrite of that line, never a disclosure and never a
+// run failure." These carry surface "findings", which runKnockoutLint's caller does not project onto
+// the cover note or the workbook — so a flag reaches whoever is fixing the run and nobody else.
+const LAWYER_VOCAB = [
+  ["proprietor", /\bproprietors?\b/i],
+  ["subsisting", /\bsubsisting\b/i],
+  ["senior right", /\bsenior (?:right|mark|position)/i],
+  ["specification", /\bspecifications?\b/i],
+  ["formative", /\bformatives?\b/i],
+  ["prevail", /\bprevails?\b|\bprevailing\b/i],
+  ["citable", /\bcitable\b/i],
+  ["limb", /\bon every limb\b|\ball limbs\b/i],
+  ["non-use attack", /\bnon-?use attack\b/i],
+  ["belt-and-braces", /\bbelt-?and-?braces\b/i],
+  ["dispatch", /\bdispatch(?:ed|es)?\b/i],
+  ["lane", /\blanes?\b/i],
+  ["on the record as it stands", /\bon the record as it stands\b/i],
+  ["the marks-and-goods comparison", /\bmarks-and-goods comparison\b/i],
+  ["chunk", /\bchunks?\b/i],
+];
+
+/** The longest a default-visible sentence may run before it stops being one idea (333 rule 1). */
+const PLAIN_SENTENCE_WORDS = 25;
+
+/**
+ * The fields a reader of the knockout meets before opening anything, named one by one rather than
+ * derived, so adding a field to the page is a deliberate addition here too.
+ */
+function knockoutVisibleProse(findings) {
+  const out = [];
+  const add = (where, v) => { const t = String(v ?? "").trim(); if (t) out.push({ where, text: t }); };
+  add("the batch summary", findings?.batch?.executiveSummary);
+  for (const c of findings?.batch?.standardCaveats ?? []) add("a standing caveat", c);
+  for (const m of findings?.marks ?? []) {
+    const n = String(m?.name ?? "a mark");
+    add(`${n}'s basis line`, m?.basis);
+    for (const f of m?.factors ?? []) add(`${n}'s "why this band" list`, f);
+    for (const f of m?.counterFactors ?? []) add(`${n}'s "why not the next band" list`, f);
+    add(`${n}'s mitigation line`, m?.mitigation);
+    for (const p of m?.purpleNotes ?? []) add(`${n}'s note to the reviewing lawyer`, p?.text ?? p);
+    for (const r of m?.registerReads ?? []) add(`${n}'s read of a filing`, r?.read);
+    // The finding's ONE sentence. Its `basis` is folded and is deliberately not read here.
+    for (const f of m?.findings ?? []) add(`${n} conflict ${f?.ordinal ?? ""}`.trim(), f?.net);
+  }
+  return out;
+}
+
+/**
+ * plainLanguageChecks — two flags over the default-visible prose: the lawyer's vocabulary, and a
+ * sentence carrying more than one idea. Each names the field, so a hit is a line somebody can rewrite
+ * rather than a score.
+ */
+export function plainLanguageChecks({ findings, surface = "findings" } = {}) {
+  const fields = knockoutVisibleProse(findings);
+  const vocab = [];
+  const longSentences = [];
+  for (const { where, text } of fields) {
+    for (const [name, re] of LAWYER_VOCAB) if (re.test(text)) vocab.push(`${where}: "${name}"`);
+    for (const sentence of text.split(/(?<=[.!?])\s+|\n+/)) {
+      const n = sentence.trim().split(/\s+/).filter(Boolean).length;
+      if (n > PLAIN_SENTENCE_WORDS) longSentences.push(`${where}: ${n} words`);
+    }
+  }
+  // ── A NOTE THAT WILL PRINT IN THE PLACE ITS WRITER DID NOT MEAN ────────────────────────────────────
+  //
+  // The page files a reviewer's note by what it TALKS ABOUT: name the request and it prints at the top,
+  // above the conflicts; otherwise it prints under that name's cards. That is what lets an archived run
+  // put its mis-scoping flag where the owner asked for it without a new field.
+  //
+  // THE COST OF THAT CHOICE IS EXACTLY THIS FLAG. A note plainly about the asking — the client's stated
+  // industry, its own prior use, whether the goods are the right ones — that never says "the request"
+  // sorts as a note about the NAME and prints at the bottom, which is the defect the move exists to fix.
+  // Nothing about the page would look wrong; the line would simply be in the last place read.
+  //
+  // So the reviewer says so, to the one person who can fix it, in the one place a fix belongs: the note.
+  // The page never guesses. Adding a clause naming the request is the whole remedy.
+  const misfiled = [];
+  for (const m of findings?.marks ?? []) {
+    for (const raw of m?.purpleNotes ?? []) {
+      const v = knockoutNoteView(raw);
+      if (!v.text || v.about) continue;              // the rater said which; nothing is inferred
+      if (REQUEST_NOTE_WORDS.test(v.text)) continue; // it names the request and will print at the top
+      if (!REQUEST_SUBJECT_WORDS.test(v.text)) continue;
+      misfiled.push(`${m?.name ?? "a mark"}: "${v.text.trim().replace(/\s+/g, " ").slice(0, 70)}…"`);
+    }
+  }
+  const say = (hits) => `${hits.slice(0, 5).join("; ")}${hits.length > 5 ? `; +${hits.length - 5} more` : ""}`;
+  return [
+    check("reviewer-note-subject", "voice", surface, misfiled.length === 0,
+      misfiled.length ? `a note about what was asked that never names the request — it will print under this name's conflicts rather than at the top of the page, where a question about the request belongs. Name the request in the note: ${say(misfiled)}` : ""),
+    check("plain-language-vocabulary", "voice", surface, vocab.length === 0,
+      vocab.length ? `the lawyer's vocabulary on lines a reader meets before opening anything — rewrite the line in the words the reader already owns (the skill carries the swaps): ${say(vocab)}` : ""),
+    check("plain-language-sentence-length", "voice", surface, longSentences.length === 0,
+      longSentences.length ? `a default-visible sentence carrying more than one idea (over ${PLAIN_SENTENCE_WORDS} words) — split it, conclusion first: ${say(longSentences)}` : ""),
+  ];
+}
+
 /**
  * KNOCKOUT_ABSENT_BY_DESIGN — the clearance checks this lane does NOT run, each with the reason its
  * input does not exist here. This is the third state (/'s rule, in the lint's own vocabulary):
@@ -2423,6 +2540,9 @@ export function runKnockoutLint({ findings }) {
   // (publish/report-registry.mjs re-renders archived findings without re-running the merged validator)
   // this scan is the only permission-prose coverage there is.
   if (working.trim()) checks.push(...permissionProseChecks({ text: working, surface: "findings", idSuffix: ":knockout-working", structural: true, cards: false }));
+  // tracker issue 333 — the plain-language reviewer, over the fields a reader meets before opening a
+  // fold. Internal by surface, so a hit reaches whoever is fixing the run and never a delivery surface.
+  checks.push(...plainLanguageChecks({ findings }));
   const failures = checks.filter((c) => !c.pass);
   return { checks, failures, notApplicable: KNOCKOUT_ABSENT_BY_DESIGN };
 }

package/driver/profile-page.html

@@ -35,7 +35,7 @@ ul.roster{list-style:none;margin:0;padding:0}
 ul.roster li{padding:8px 10px;border-radius:8px;cursor:pointer;font-size:14px;border:1px solid transparent}
 ul.roster li:hover{background:var(--bg)}
 ul.roster li.sel{background:var(--bg);border-color:var(--line);font-weight:700}
-/* the sub-line truncates (2-line clamp) — a long industry string (aurora's is ~110 chars) must never
+/* the sub-line truncates (2-line clamp) — a long industry string (one profile's is ~110 chars) must never
    stretch the 240px roster column into an overflowing wall of text */
 ul.roster li .ind{display:-webkit-box;-webkit-line-clamp:2;line-clamp:2;-webkit-box-orient:vertical;overflow:hidden;font-size:11.5px;color:var(--muted);font-weight:400}
 ul.roster li .ind code.slug{font-size:10.5px;letter-spacing:.02em}
@@ -136,7 +136,15 @@ const csv = (s) => String(s||"").split(",").map(x=>x.trim()).filter(Boolean);
 const fwName = (path) => { const m = String(path||"").match(/risk-framework-([a-z0-9-]+)\.md/i); return m ? (m[1].charAt(0).toUpperCase() + m[1].slice(1) + " framework") : "Generic default framework"; };
 // doc 50 — the band ladder preview, from the manifest the service serves (tones map to the page palette).
 const TONE_BG = {severe:"#b3261e", high:"#c75b13", medium:"#9a8400", low:"#4e7a31", minimal:"#2f55a4"};
-const bandLadder = (m) => m && m.bands ? `<div style="margin:6px 0 2px">${m.bands.map(b=>`<span style="display:inline-block;margin:0 6px 4px 0;padding:2px 9px;border-radius:999px;background:${TONE_BG[b.tone]||"#666"};color:#fff;font-size:11px;font-weight:700">${esc(b.label)}</span>`).join("")}</div>` : "";
+// LABELLED, for the same reason as the portal's copy of this row. Four coloured pills with nothing
+// saying what they are, sitting under a heading that reads "Risk framework in force", were read by an
+// outside user as four frameworks: "how do I have FOUR risk frameworks live at the same time?" He had
+// one. The label names the framework's ownership of the scale — "its ratings" — because the sentence
+// immediately above names the framework and the only ambiguity is whether these belong to it.
+//
+// The two editors say the same words on purpose. This one is the staff page and the portal has its own;
+// a reader who sees both should not have to work out whether they are describing the same thing.
+const bandLadder = (m) => m && m.bands ? `<div style="font-size:12px;color:var(--slate);margin:10px 0 0">Its ratings, strongest concern first:</div><div style="margin:6px 0 2px">${m.bands.map(b=>`<span style="display:inline-block;margin:0 6px 4px 0;padding:2px 9px;border-radius:999px;background:${TONE_BG[b.tone]||"#666"};color:#fff;font-size:11px;font-weight:700">${esc(b.label)}</span>`).join("")}</div>` : "";
 // doc 50 — "What the bands mean": deck-native prose the service lifts from the framework .md at view time
 // (display-only; omitted whenever extraction missed). The decks are Privileged & Confidential, so the prose
 // is wrapped in data-anon="mark" — the demo privacy blur must cover it.

package/driver/profile-service.mjs

@@ -75,7 +75,7 @@ function manifestFor(fwPath) {
 // shipped decks, so a deck edit that breaks extraction fails CI instead of silently blanking the box.
 const stripMd = (s) => String(s ?? "").replace(/\*+/g, "").trim();
 
-// matrix-shaped decks (aurora): the deck's "Band meanings" table is the only table whose FIRST cell is
+// matrix-shaped decks: the deck's "Band meanings" table is the only table whose FIRST cell is
 // exactly the band label (the matrix table suffixes its labels with the deck's internal indices, e.g.
 // "**Very High** *(5)*") — take that row's cells as { band, meaning, response }.
 function matrixBandMeanings(deck, manifest) {
@@ -97,7 +97,7 @@ function matrixBandMeanings(deck, manifest) {
   return out;
 }
 
-// bands-shaped decks (house, zephyr): each band lives under its own heading ("## VERY HIGH RISK") — find
+// bands-shaped decks (the house default among them): each band lives under its own heading ("## VERY HIGH RISK") — find
 // the section whose heading STARTS WITH the band label ("High" must never steal "VERY HIGH RISK") and lift
 // EVERY rung the band states, in the deck's own order.
 //
@@ -172,8 +172,8 @@ function bandMeaningsFor(fwPath, manifest) {
 
 // CODE-OWNED fields — the framework SELECTION. The editor page has no form fields for these, so a save
 // assembled from the form omits them, and defaultWriteProfile rewrites the whole file: the 2026-07-04/05 UI
-// saves (587324ab, cea0ca2f, c59030a1) silently stripped frameworkPath/workedExamplesPath from zephyr and
-// aurora, flipping both customers to the house-default framework. The on-disk value ALWAYS wins here — a
+// saves (587324ab, cea0ca2f, c59030a1) silently stripped frameworkPath/workedExamplesPath from two
+// profiles, flipping both customers to the house-default framework. The on-disk value ALWAYS wins here — a
 // client body can neither drop, change, nor introduce a framework selection (git + review gated, per the
 // header rules). Applied to validate AND save so the dry run judges exactly what a save would write.
 // Search-depth spine: allowedRecipes/jxPolicy/runCaps have NO form fields on the editor page — without

package/driver/profiles/README.md

@@ -21,8 +21,8 @@ With no key, `resolveProfile(job)` matches `job.forwarderDomain` against each
 profile's `matchDomains[]` (exact host or dot-suffix — the original `selectCustomer` semantics),
 else `generic.json`. The applicant named in the request (`job.customer`) NEVER selects a profile —
 it only activates `selfExclusionOwners[]` when it matches the profile's `name`
-(`applicantMatchesProfile`: word-boundary containment, so an aurora-interactive.example-forwarded
-search for a third-party applicant never buries genuine Aurora Interactive-owned conflicts as
+(`applicantMatchesProfile`: word-boundary containment, so a search forwarded from a customer's own
+domain but asking about a third-party applicant never buries that customer's own conflicts as
 "own rights").
 
 Resolution happens ONCE at run start and is frozen into the run's sidecar
@@ -52,7 +52,7 @@ consumes it; a unit test greps each symbol, so a field with no live consumer fai
 | `selfExclusionOwners[]` | structural | the customer's own/affiliate names — own-rights classification seed, applicant-gated as above |
 | `delivery` | delivery | `{ email: "summary", privileged: bool }` — the "Privileged & Confidential" header. Two further optional sub-keys are accepted: `style` (a prose string, guarded by the same anti-rule check as a context pack, dictated into the `report-overview` and `report-card` stages as presentation tone and never to `synthesis`, the rating stage) and `template` (a report-template name; `"standard"` is the only one that exists, and it is the default). **Absent ⇒ neutral default** (`{email:"summary"}` — deliberately SILENT on `privileged`, which is three-state on every surface that reads it (`confPosture`): `true` extends the marking to "Attorney Work Product", `false` is a deliberate OFF, and absent is no opinion, which gets the plain "Privileged & Confidential" every legal deliverable carries. Saying `false` in the neutral overlay read as an instruction to strip the marking, and a Generic-default clearance shipped with no line at all). `email` no longer selects anything: every run's mail is a COVER NOTE pointing at the one report. The old `"table"` value — a full review table inlined into the mail body — is **retired**; it is still accepted at load so stored profiles keep validating, and folded to `"summary"` by `normalizeDelivery`. A customer who wants their own house format gets it drafted by the assistant from the run's `report-data.json`, where a person reads it before it goes |
 | `riskAppetite` | context | a PROSE-POSTURE string (optional) that flavours **emphasis + recommended follow-up** in delivery curation — the two stages that are dictated it, `report-overview` and `report-card` — **never the Level/Composite**. A load-time anti-threshold guard rejects numeric/threshold phrasing (`>50%`, `Level C or above`, `threshold`); the "never decides" invariance itself is gated by review |
-| `marketplaceDensity` | structural | `"sparse"` (default) \| `"dense"` — selects the per-profile grid cell budget so a byte-heavy marketplace's verbatim stdout fits the worker output channel (sparse ⇒ 98-cell budget; dense ⇒ 16). Dense fits long retail listings (Zephyr beverages/supplements); gaming stores stay sparse |
+| `marketplaceDensity` | structural | `"sparse"` (default) \| `"dense"` — selects the per-profile grid cell budget so a byte-heavy marketplace's verbatim stdout fits the worker output channel (sparse ⇒ 98-cell budget; dense ⇒ 16). Dense fits long retail listings (beverages and supplements); gaming stores stay sparse |
 | `frameworkPath` | rating authority | optional path to the customer's OWN risk framework (`skills/prelim-search/<file>.md`, path-escape-blocked). **The framework in force RATES the matter** — the customer's own if on file, else the Generic default `risk-framework.md`; nothing in between. Each framework is a prose deck (the client's own rubric, reasoned WITH) plus a `.manifest.json` sidecar carrying its band vocabulary (`test/framework-lint.test.mjs` guards the pair). Git + legal-team gated; the config UI shows which is in force, read-only |
 | `workedExamplesPath` | context | optional path to a per-customer worked-examples set (`skills/prelim-search/<file>.md`). The analysis DEPTH TARGET in `synthesis`, calibrated under that customer's framework; **absent ⇒ the Generic default `worked-examples.md`** |
 | `defaultProduct` | entitlement | which of the four searches runs when a request names none (`search-policy.mjs`). May be left unset, and that is not a gap — a clearance that names no product is then named by its own resolved territories |

package/driver/profiles.mjs

@@ -4,7 +4,7 @@
 //
 // One git-owned JSON file per customer under profiles/ — hand-authored, PR-reviewed, onboarded one
 // customer at a time. generic.json is the universal fallback and MUST exist;
-// aurora.json reproduces today's behavior exactly (the regression anchor). Every field shipped
+// one test-suite profile reproduces today's behavior exactly (the regression anchor). Every field shipped
 // here has working machinery behind it — parked knobs live in profiles/README.md, not in the files.
 //
 // Resolution is FORWARDER-DOMAIN ONLY: the profile describes WHO ASKS US (the
@@ -143,10 +143,10 @@ export const SAFE_GRID_CELLS = 98;
 // A DENSE marketplace profile (long retail URLs + many listings per cell — e.g. beverages/supplements on
 // Amazon/GNC/iHerb) makes each grid cell ~5-10x heavier in OUTPUT BYTES than a sparse gaming-store cell, so
 // the cell-count budget above (calibrated on sparse stores) overflows the worker's output channel and the
-// verbatim stdout transcription truncates mid-JSON (Zephyr KINETIC, 2026-06-14: ~21 dense cells ≈ 20KB cut
+// verbatim stdout transcription truncates mid-JSON (measured on a dense beverages profile, 2026-06-14: ~21 dense cells ≈ 20KB cut
 // the ledger unparseable). A dense profile gets a much smaller cell budget so each grid call's stdout stays
 // well under that ceiling (a 7-platform dense profile ⇒ floor 8 ⇒ batchSize 2 ⇒ ≤16 cells/call). The
-// gaming/Aurora budget is unchanged (default density = sparse).
+// gaming budget is unchanged (default density = sparse).
 export const DENSE_GRID_CELLS = 16;
 
 // The two values a profile may hold, as a LIST rather than as a phrase repeated at each site.
@@ -238,6 +238,9 @@ export const KNOWN_PROFILE_KEYS = [
   // queue was a cost bomb the run-slot cap doesn't stop. Visible, git-tracked profile config (never a
   // hidden env var); enforced at the runner's admission chokepoint for BOTH doors (email + portal).
   "runCaps",
+  // AN ACCOUNT THE SUITE USES AND NO INSTALL OFFERS. `testFixture: true` keeps a profile in the tree,
+  // under its own name, and out of every roster this module resolves — see loadProfiles.
+  "testFixture",
   // THIS RECORD IS FICTION. `demoData: true` marks a profile as demo data, and a
   // real clearance refuses to start under it — at the runner's admission wall, so no door can miss it.
   //
@@ -276,6 +279,12 @@ export const CUSTOMER_ONLY_KEYS = [
   // may trigger (allowedRecipes) nor re-declare its jx deepening policy — both are the same
   // rating-authority-adjacent discipline as frameworkPath, one notch out.
   "allowedRecipes", "jxPolicy",
+  // WHETHER AN ACCOUNT IS OFFERED AT ALL is the account's own fact, and a project overlay must not touch
+  // it in either direction. Un-marking would put a test account into a customer's picker through an
+  // overlay nobody reviewed as identity; marking would hide a real account from its own owner. Same
+  // reasoning as `demoData` one notch out — that one decides whether fiction may spend money, this one
+  // decides whether it is visible, and neither is a project's to decide.
+  "testFixture",
   // Admission caps bind the ACCOUNT: a project widening its own caps would hollow the customer's.
   "runCaps",
   // Provenance binds the ACCOUNT and cannot be overlaid in either direction: a project marking a real
@@ -305,6 +314,7 @@ export const FIELD_CONSUMERS = {
   allowedRecipes:       { file: "search-policy.mjs", symbol: "allowedRecipes" },                // entitlement gate on the resolved search selection
   jxPolicy:             { file: "pipeline.mjs",      symbol: "jxPolicy" },                      // frozen into the run sidecar for the Stage-1.5 lanes (resume-safe)
   demoData:             { file: "runner.mjs",        symbol: "demoData" },                      // the admission wall refuses a real clearance on demo data
+  testFixture:          { file: "profiles.mjs",      symbol: "loadProfiles" },                  // never offered by a resolved roster; the suite asks for it by name
   runCaps:              { file: "runner.mjs",        symbol: "runCaps" },                       // admission caps at claimAndPrep (queued + monthly, both doors)
 };
 
@@ -644,7 +654,7 @@ function readProfilesLayer(dir) {
  *
  *  `dir` names the OVERLAY, not the whole store: passing it keeps the bundled set underneath, which is
  *  what makes an empty store a working install. Pass `dir: null` for the bundled set alone. */
-export function loadProfiles({ dir, force = false } = {}) {
+export function loadProfiles({ dir, force = false, includeTestFixtures, includeDemo } = {}) {
   // — LAYERING APPLIES ONLY TO THE ENV-RESOLVED STORE, and that boundary is deliberate.
   //
   // `dir` OMITTED => resolve the deployment's store, overlay over base. `dir` PASSED => that directory
@@ -659,7 +669,10 @@ export function loadProfiles({ dir, force = false } = {}) {
   const explicit = dir !== undefined;
   const overlay = explicit ? null : PROFILES_OVERLAY_DIR;
   const baseDir = explicit ? (dir || PROFILES_BASE_DIR) : PROFILES_BASE_DIR;
-  const cacheKey = `${overlay ?? ""} :: ${baseDir}`;
+  // EVERY DIMENSION THAT CHANGES THE ANSWER IS IN THE KEY. A cache keyed on the directory alone
+  // serves the demo's roster to the next caller that did not ask for it, which is the defect this
+  // gate exists to prevent, arriving from inside.
+  const cacheKey = `${overlay ?? ""} :: ${baseDir} :: ${includeTestFixtures ?? "env"} :: ${process.env.CLEAROTRON_TEST_FIXTURE_PROFILES ?? ""} :: ${includeDemo ?? "env"} :: ${process.env.CLEAROTRON_DEMO_PROFILES ?? ""}`;
   if (cache && !force && cache.key === cacheKey) return cache.profiles;
 
   // FAIL LOUD ON AN UNREADABLE OVERLAY, the same ruling as the doctrine tree's. existsSync() answers
@@ -675,7 +688,7 @@ export function loadProfiles({ dir, force = false } = {}) {
   // chosen. driver/test/pool-admin-reassign.test.mjs asserts "with CLEAROTRON_CUSTOMERS_DIR unset it REFUSES
   // rather than validating against the demo roster", and mcp-server's roster boot check counts the
   // configured roster exactly. Layering the whole bundled set underneath a configured store would put
-  // aurora/petcary/zephyr into every deployment's roster: a typo'd customer key would be checked
+  // the three test accounts into every deployment's roster: a typo'd customer key would be checked
   // against demo fixtures, and a boot check that says "N customers" would count ours among theirs.
   //
   // `generic` is different in kind from the rest of that directory. It is not a demo customer — it is
@@ -683,6 +696,84 @@ export function loadProfiles({ dir, force = false } = {}) {
   // is the one file whose absence makes an empty store a refusal, so that is the only one that falls
   // through. Everything else in a deployment's roster is the deployment's own.
   const profiles = overlay ? readProfilesLayer(overlay) : readProfilesLayer(baseDir);
+
+  // ── A TEST FIXTURE IS PRESENT AND NEVER OFFERED ─────────────────────────────────────────────────
+  //
+  // An outside user installed this product and their brand-owner picker offered three of our test
+  // accounts. The picker was not wrong: it listed the roster, and the roster was the bundled directory.
+  //
+  // `package.json` already excludes those files, and that exclusion works — the published tarball
+  // carries two profiles. It protects ONE route. `INSTALL.md` documents `git clone && npm install` as a
+  // first-class way in, and on that route nothing is excluded, the checkout IS the bundled directory,
+  // and every fixture loads. A packaging rule cannot answer a question the loader is asked.
+  //
+  // So the loader answers it. A profile marked `testFixture` is refused from the roster this returns, on
+  // every route, whether it was excluded from a tarball or not — and the suite asks for it by name.
+  //
+  // TWO FLAGS, TWO QUESTIONS, AND THE SECOND ONE'S ANSWER CHANGED. `testFixture` marks visibility:
+  // a suite fixture is never offered. `demoData` marks provenance: the account is fiction and the
+  // admission wall refuses a real clearance under it. This file argued that `demoData` must leave its
+  // account LISTABLE, because the demo needed to show it — true until the owner ruled otherwise on
+  // 2026-09-08. A fresh install now resolves `generic` alone, and the demo asks for its own account
+  // when it runs, so the demo account is refused here too. The flags stay separate because the
+  // questions are: a fixture is never shown to anybody, a demo account is shown to the demo.
+  //
+  // ONE ROSTER, NOT TWO. The tested set and the resolvable set are now the same files with a flag,
+  // rather than five profiles the suite exercises against two a customer receives. That disjoint pair is
+  // the defect this module's own header narrates from 2026-07-19, and a packaging-only fix recreates it.
+  //
+  // THE SUITE ASKS ONCE, BY ENVIRONMENT, RATHER THAN AT NINETY-FOUR CALL SITES. Most of the checks that
+  // need a fixture do not call this function — they exercise code that calls it, so there is no argument
+  // to pass. `scripts/test-run.mjs` sets the variable for every child, which keeps the ask visible in
+  // one place and OFF everywhere else, including any process that merely imports this module.
+  //
+  // That leaves the tested roster larger than the resolved one, which is the disjoint-roster shape this
+  // module's header narrates and the reason a packaging-only fix was refused. What makes it one roster
+  // rather than two is `a-clean-install-offers-generic-alone`: it names both sides — every file
+  // in the directory, and exactly what a resolved roster returns — so the difference between them is
+  // asserted rather than assumed, and adding a fixture without marking it reds that check.
+  //
+  // AN EXPLICIT ARGUMENT BEATS THE ENVIRONMENT, and the distinction is `undefined` rather than falsiness.
+  // The suite sets the variable for every child, so a check asking for the RESOLVED roster — the one a
+  // customer gets — would otherwise be handed the suite's own. Two of this change's own arms failed that
+  // way before this line: they asked for what an install offers and were told what the suite runs with.
+  const asked = includeTestFixtures !== undefined
+    ? includeTestFixtures
+    : String(process.env.CLEAROTRON_TEST_FIXTURE_PROFILES ?? "").trim() === "1";
+  if (!asked) for (const [k, p] of [...profiles]) if (p?.testFixture === true) profiles.delete(k);
+
+  // THE DEMO ACCOUNT IS NOT PART OF A FRESH INSTALL EITHER — owner ruling, 2026-09-08: a clean install
+  // resolves `generic` and nothing else, and the demo brings its own account when somebody runs it.
+  // Nobody should have to clean demo material out of an environment they just created.
+  //
+  // Same shape as the gate above and for the same reason: the packaging exclusion cannot answer this,
+  // because `git clone && npm install` is a documented route on which the checkout IS the bundled
+  // directory. The loader answers it on every route.
+  const askedDemo = includeDemo !== undefined
+    ? includeDemo
+    : String(process.env.CLEAROTRON_DEMO_PROFILES ?? "").trim() === "1";
+
+  // — AND IT GATES THE LAYER, NOT THE FLAG. The ruling is about the demo account this PRODUCT bundles.
+  // A deployment that put a `demoData` account in its OWN configured store chose to have it: that is an
+  // operator's decision about their own roster, and the admission wall still refuses a real clearance
+  // under it, so nothing is spent. Gating on the flag alone would have reached into a configured store
+  // and deleted an account nobody asked us to hide — the test deployment has one. When an overlay is
+  // configured this loader reads that store and not the bundled directory, so the question is which
+  // directory was actually read — NOT whether an overlay was set. An explicit `dir` pointing at a
+  // configured store leaves `overlay` null while reading somebody's own roster, and `!overlay` would
+  // have called that bundled and gated it.
+  const bundled = (overlay ?? baseDir) === PROFILES_BASE_DIR;
+  //
+  // THE MORE SPECIFIC FLAG DECIDES. Every shipped profile but `generic` carries `demoData`, the three
+  // suite fixtures included, so a demo gate applied to all of them would swallow a roster somebody had
+  // explicitly asked for: `includeTestFixtures: true` would return `generic` alone, silently, and a
+  // check that asks for its own fixtures would pass having exercised nothing. That is the same vacuous
+  // green two of this loader's own checks produced before the argument beat the environment. A fixture's
+  // visibility is answered by its own gate above; this one answers only for accounts that are demo data
+  // and nothing more specific.
+  if (!askedDemo && bundled) {
+    for (const [k, p] of [...profiles]) if (p?.demoData === true && p?.testFixture !== true) profiles.delete(k);
+  }
   if (overlay && !profiles.has("generic")) {
     const base = readProfilesLayer(baseDir);
     if (base.has("generic")) profiles.set("generic", base.get("generic"));
@@ -742,6 +833,32 @@ export function resolveProfile(job, { profiles = loadProfiles() } = {}) {
 const PROJECTS_SUBDIR = "projects";
 let projectCache = null;
 
+
+/**
+ * Is `key` a profile that exists in one of these roots and is marked as a test fixture?
+ *
+ * Read from the FILE rather than from the roster, deliberately: the roster handed to the projects walk
+ * is the resolved one, which has already dropped every fixture — so asking it cannot tell "a fixture
+ * whose projects are beside it" from "a project directory whose customer is gone". Those want different
+ * answers and the file is the only place that still holds the difference.
+ */
+function readProfileFlag(roots, key, flag) {
+  for (const root of roots) {
+    const f = join(root, `${key}.json`);
+    if (!existsSync(f)) continue;
+    try { return JSON.parse(readFileSync(f, "utf8"))?.[flag] === true; } catch { return false; }
+  }
+  return false;
+}
+
+const isTestFixtureKey = (roots, key) => readProfileFlag(roots, key, "testFixture");
+
+/** Is this project directory's customer an account the DEMO brings, rather than one this install has?
+ *  Read from the FILE for the same reason as the fixture check beside it: the roster handed to this walk
+ *  has already dropped the account, so asking the roster cannot tell "the demo's, and hidden" from "the
+ *  customer is gone", and the second is an authoring error that must still hard-fail. */
+const isDemoKey = (roots, key) => readProfileFlag(roots, key, "demoData");
+
 /** Load every profiles/projects/<customer>/<slug>.json → Map("<customer>/<slug>" → overlay). Each overlay is
  *  validated in SPARSE mode (PROJECT_KEYS optional, customer-only keys rejected) and carries its lifted-out
  *  `projectName` (default = slug) + optional sibling `<slug>.context.md`. A project directory under an unknown
@@ -778,8 +895,22 @@ export function loadProjects({ dir, profiles, force = false } = {}) {
   for (const ent of readdirSync(projDir, { withFileTypes: true })) {
     if (!ent.isDirectory()) continue;   // only <customer>/ subdirs participate; a stray file is ignored
     const ck = ent.name;
-    if (!roster.has(ck))
+    // A PROJECT UNDER A TEST FIXTURE IS SKIPPED, NOT A FAULT. The refusal below is right and stays: a
+    // project directory with no customer is a typo or a half-deleted account, and resolving it silently
+    // would attach an overlay to nothing. But a fixture's own projects are in the same checkout as the
+    // fixture, and the roster no longer offers the fixture — so on a clone install this refusal would
+    // fire on the product's own files and stop the process at load. Skipped by reading the fixture
+    // marker from the file, because the roster this walk was handed is the one that already dropped it.
+    if (!roster.has(ck)) {
+      if (isTestFixtureKey(roots, ck)) continue;
+      // AND THE DEMO'S OWN PROJECTS, for the identical reason. `profiles/projects/demo-brand-owner/`
+      // ships, and since a fresh install stopped resolving that account this walk met a project whose
+      // customer it could not see — a HARD startup failure, from the product's own files, on every
+      // clean install. Caught by the arm below, not by review; it is the third time this shape has been
+      // found in this loader.
+      if (isDemoKey(roots, ck)) continue;
       throw new Error(`profiles/projects/${ck}/: no customer profile "${ck}" — a project must live under a known customer (add profiles/${ck}.json first)`);
+    }
     const cdir = join(projDir, ck);
     for (const f of readdirSync(cdir).filter((n) => n.endsWith(".json")).sort()) {
       const slug = f.replace(/\.json$/, "");
@@ -845,7 +976,7 @@ export function resolveEffectiveProfile(job, { profiles = loadProfiles(), projec
       //
       // The customer's platforms are CLIENT-MANDATED — the account asked for those marketplaces to be
       // searched, and a project may add to that instruction but never revoke it. Replace semantics meant a
-      // project that stated its own marketplaces silently DELETED the customer's: the Aurora Interactive account
+      // project that stated its own marketplaces silently DELETED the customer's: one test account
       // names 7 games storefronts, its console-ecosystem project names 9 mostly-retail sites, and every run
       // of that project searched the 9 — dropping store.epicgames.com, itch.io, apps.microsoft.com and
       // mobygames.com. The report still read as clean coverage, because the sweep faithfully covered the
@@ -888,10 +1019,11 @@ export function resolveEffectiveProfile(job, { profiles = loadProfiles(), projec
 }
 
 /** The self-exclusion gate: a profile's selfExclusionOwners[]
- *  may only inject when the job's APPLICANT is the profile's customer — an aurora-interactive.example-forwarded
- *  search for a third-party applicant must NOT classify Aurora-owned conflicts as own rights
- *  (that would delete true conflicts from a delivered clearance). Word-boundary containment of the
- *  profile name in the applicant string ("Aurora Interactive" ⊂ "Aurora Interactive Ltd"), never fuzzy. */
+ *  may only inject when the job's APPLICANT is the profile's customer — a search forwarded from a
+ *  customer's own domain, but asking about a THIRD-PARTY applicant, must not classify that
+ *  customer's conflicts as own rights (that would delete true conflicts from a delivered
+ *  clearance). Word-boundary containment of the profile name in the applicant string
+ *  ("Foxglade Interactive" ⊂ "Foxglade Interactive Ltd"), never fuzzy. */
 export function applicantMatchesProfile(profile, customer) {
   const n = (s) => String(s ?? "").toLowerCase().replace(/[^a-z0-9 ]+/g, " ").replace(/\s+/g, " ").trim();
   const c = n(customer);