clearotron 0.2.3 → 0.2.4

package/driver/plain-register.mjs

@@ -49,6 +49,21 @@ export const PLAIN_FORMS = Object.freeze([
 /** The longest visible sentence a reader should meet. The issue's number, not a derived one. */
 export const SENTENCE_WORD_LIMIT = 25;
 
+/**
+ * How a term in `PLAIN_FORMS` is looked for in prose — ONE definition, because two of them drift.
+ *
+ * THE INFLECTIONS ARE THE POINT, and they were the reason a second copy of this rule survived. The
+ * pre-delivery lint carried its own hand-tuned patterns — `\bproprietors?\b`, `\bprevails?\b|\bprevailing\b`
+ * — while this file built `\bproprietor\b` and matched neither plural. So the pinned source was the
+ * WEAKER of the two, and reading terms from it without this would have quietly narrowed what the live
+ * check catches: a consolidation that loses coverage is a regression wearing a tidy-up's clothes.
+ *
+ * A trailing `s`, `es`, `ed` or `ing` after the term, and a hyphen matching a space, which is how the
+ * same phrase is written in two documents by two people.
+ */
+export const termMatcher = (term) => new RegExp(
+  `\\b${term.replace(/[-]/g, "[- ]").replace(/\s+/g, "\\s+")}(?:e?s|ed|ing)?\\b`, "i");
+
 /** Everything the run is ABOUT — the mark, its variants, the owners named. Never flagged. */
 const ownTerms = (about = {}) => {
   const out = [];
@@ -85,8 +100,7 @@ export function plainRegisterFlags(text, about = {}) {
 
   const flags = [];
   for (const [term, plain] of PLAIN_FORMS) {
-    const re = new RegExp(`\\b${term.replace(/[-]/g, "[- ]").replace(/\s+/g, "\\s+")}\\b`, "i");
-    if (!re.test(scan)) continue;
+    if (!termMatcher(term).test(scan)) continue;
     flags.push({
       kind: "vocabulary",
       term,

package/driver/portal-config-view.mjs

@@ -49,6 +49,11 @@ import { readFlagSnapshot, engineFor, providersFor, postureDisagreement } from "
 // reading is, because the question it was standing in for — does this still describe the box — now has
 // a direct answer in `lastRun.disagrees`.
 import { engineMode } from "./config-inventory.mjs";   // — the mode is DERIVED at read time, never stored
+// THE ENGINE TABLE, READ FOR TWO WORDS. A row saying an engine cannot run has to name the program it
+// could not find and the command that installs it, or the reader is told they have a problem and not
+// what to do about it — and this table is already where the wizard and the run-door preflight read
+// both of those, so naming them here adds no second description of an engine.
+import { ENGINE_BINARIES } from "./driver.config.mjs";
 
 /**
  * The flag view.
@@ -60,6 +65,30 @@ import { engineMode } from "./config-inventory.mjs";   // — the mode is DERIVE
 // One projection, used for whichever posture is the answer. Extracted when the live posture became that
 // answer, so the LIVE reading and the LAST-RUN capture cannot be shaped differently and quietly invite a
 // reader to compare two things that were built by two rules.
+/**
+ * The engine block, plus the two words a reader needs when it cannot run.
+ *
+ * DERIVED FROM THE ID AT READ TIME, never stored in the capture. A capture written by an older build
+ * carries neither field, and a page that read them out of the capture would go quiet about the engine
+ * on exactly the deployments most likely to be misconfigured. The id is in every capture there has
+ * ever been, and the table is in this build.
+ *
+ * NULL FOR AN ENGINE THIS BUILD DOES NOT SHIP, which the row already has its own sentence for. Naming
+ * a program for an engine that does not exist here would be an invented fact.
+ */
+function withProgram(engine) {
+  if (!engine) return engine;
+  const spec = ENGINE_BINARIES[engine.id] ?? null;
+  return {
+    ...engine,
+    // A BARE NAME, NEVER A RESOLVED PATH. `fallback` is what the table calls the program when nothing
+    // overrides it — "claude" — and it is what a reader types. The resolved path is this machine's
+    // layout and is deliberately kept out of anything a browser renders.
+    program: spec?.fallback ?? null,
+    install: spec?.install ?? null,
+  };
+}
+
 function postureView(snap) {
   return {
     flags: Object.entries(snap.flags ?? {}).map(([name, f]) => ({
@@ -72,7 +101,7 @@ function postureView(snap) {
       killSwitch: (snap.killSwitches ?? []).includes(name),
     })),
     built: snap.built ?? null,
-    engine: engineFor(snap),
+    engine: withProgram(engineFor(snap)),
     engineMode: engineFor(snap) ? engineMode(engineFor(snap)) : null,
     providers: providersFor(snap),
   };

package/driver/portal-local-auth.mjs

@@ -47,6 +47,7 @@ import { randomBytes, scryptSync, timingSafeEqual, createHmac } from "node:crypt
 import { readFileSync, writeFileSync, mkdirSync, chmodSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
+import { envPrefix } from "../shared/os-advice.mjs";
 
 // ── the credential record ────────────────────────────────────────────────────────────────────────
 //
@@ -164,7 +165,10 @@ export function passphraseResetCommand({ prefix = "", credentialPath = null, env
   const base = `${prefix}clearotron passphrase --reset`;
   const path = credentialPath ?? env.PORTAL_LOCAL_CREDENTIAL ?? null;
   if (!path || path === credentialPathFor({}, home)) return base;
-  return `PORTAL_LOCAL_CREDENTIAL=${path} ${base}`;
+  // `VAR=value cmd` IS POSIX-ONLY. PowerShell has no such juxtaposition — the assignment is its own
+  // statement there — so this line told a Windows reader their variable name was not a cmdlet, naming
+  // the wrong half of the command as the fault. Reported from a real run.
+  return `${envPrefix("PORTAL_LOCAL_CREDENTIAL", path)}${base}`;
 }
 
 /**

package/driver/portal-service.mjs

@@ -1333,6 +1333,48 @@ export function makePortalService({
   };
   const selectorOf = (body) => (body.recipeKey ? `recipe:${body.recipeKey}` : `product:${body.product || "the account's default"}`);
 
+  // ── The engine program, read once, for every surface that reports it ───────────────────────────
+  //
+  // WHY /me NEEDS THIS AT ALL. The settings page can ask `/portal/admin/config`, which already computes
+  // the live-versus-capture comparison. New clearance cannot: that route is staff-only, and the reader
+  // who gets stuck here is as often a client. A screen that asked it would get a 404 and fall back to
+  // the generic advice — which is the exact defect this exists to end, delivered to the exact reader
+  // who reported it.
+  //
+  // WHAT IT COSTS ON A NORMAL PAGE VIEW: NOTHING, and that is structural rather than a promise. The
+  // question only has a wrong answer in one state — the capture says there is no engine program — so
+  // the live reading is taken only in that state. An install with a working engine never reaches the
+  // probe, and /me is the hottest endpoint in the portal.
+  //
+  // AND IT IS THE SAME MECHANISM THE SETTINGS PAGE USES, deliberately: `flagView` with a live posture,
+  // and the same `engine program` row out of `lastRun.disagrees`. Two surfaces answering this question
+  // by two routes is how they came to contradict each other in the first place.
+  //
+  // NOT CACHED, AND THAT IS THE POINT OF THE CHANGE. A held reading was written first and removed: it
+  // would have meant a reader who restarted the engine service went on being told to restart it for
+  // as long as the window lasted — the staleness this whole change exists to end, in miniature, in
+  // the one place a reader is standing when they act on it. Measured in testing, 2026-09-08: 0.28ms
+  // for a reading taken cold with the imports warm, and a 0.29ms median over 50 requests in the state
+  // that takes one on every request, against 0.04ms in the state that takes none. It is taken only
+  // where a search is already refusing, so there is nothing here worth trading a wrong answer for.
+  async function engineProgramDisputed(mode) {
+    // NOT DEMO, NOTHING TO DISPUTE. The capture already sees the program, so the only disagreement
+    // left is the mirror — this box cannot see what the engine could — and that one does not change
+    // what this screen says: the screen is not refusing a search in that state.
+    if (mode !== "demo") return false;
+    try {
+      const live = await livePosture();
+      // `disagrees` is [] on agreement, rows on disagreement, and null when there is no capture to
+      // compare against — three facts, and only the middle one is this. A null must not read as false.
+      const rows = flagView(poolRoot, { live }).lastRun?.disagrees;
+      return Array.isArray(rows) ? rows.some((d) => d.what === "engine program") : null;
+    } catch {
+      // COULD NOT LOOK, AND IT SAYS SO. Null travels to the screen as "unknown" and the screen prints
+      // the general advice, which is what it printed before this existed.
+      return null;
+    }
+  }
+
   async function route(method, path, identity, body = {}, query = {}) {
     const principal = makePrincipal({ email: identity?.email, grants: grantsNow(), staffDomains });
     const parts = path.replace(/\/+$/, "").split("/").filter(Boolean);   // ["portal", ...]
@@ -1389,8 +1431,17 @@ export function makePortalService({
         // writes at boot and derives the mode from `binaryPresent`, which that snapshot already
         // carries. NULL when there is no snapshot to read, and null means THIS CANNOT ANSWER — the UI
         // must leave the button alone rather than infer demo from an absent file.
+        // READ ONCE. The payload names it and the program reading below is gated on it; two calls to
+        // `flagView` here would be two reads of the same file that could disagree with each other.
+        const meEngineMode = flagView(poolRoot).engineMode;
         return { status: 200, json: { role: principal.role, email: principal.email, accounts: principal.accounts, accountNames,
-          concurrentRuns: concurrentRunsCap(), brand: BRAND.name, engineMode: flagView(poolRoot).engineMode,
+          concurrentRuns: concurrentRunsCap(), brand: BRAND.name, engineMode: meEngineMode,
+          // WHETHER THE PROGRAM IS ON THIS BOX WHILE THE ENGINE CANNOT SEE IT — true, false, or null
+          // for "this could not be checked". The screen above renders one of three remedies from it,
+          // and they are different remedies: install the CLI, restart the service that cannot see it,
+          // or the general advice when nothing could be read. Only `engineMode: "demo"` can make this
+          // anything but false; see `engineProgramDisputed`.
+          engineProgramDisputed: await engineProgramDisputed(meEngineMode),
           // HOW THIS INSTALL ARRIVED, so a screen can name the setup command the reader can actually
           // type. `npm run setup` and `npx clearotron install` are the same wizard and each one is
           // unrunnable on the other route; the no-engine notice named one of them and was wrong for
@@ -2142,7 +2193,7 @@ export function makePortalService({
         // command is a true fact about THIS INSTALL'S OWN DISK, useful to anyone with a shell on the
         // box and useless to a hosted client who has no checkout. On a local install the reader IS the
         // operator, which is why the split that already exists does the work an "is this deployment
-        // local" inference would have done badly. Agreed with overwatch before building, because it
+        // local" inference would have done badly. Agreed before building, because it
         // changes what a signed-in staff user is shown.
         //
         // COMPOSED IN ONE PLACE and handed over as a string. The browser cannot know this install's

package/driver/predelivery-lint.mjs

@@ -23,6 +23,7 @@
 // report-derived cover text alone, because a gate that simply stops running is not a gate that passes.
 
 import { REGION_NAMES } from "./publish/regions.mjs";
+import { PLAIN_FORMS, SENTENCE_WORD_LIMIT, termMatcher } from "./plain-register.mjs";   // the pinned rule, not a fourth copy
 import { canonicalJurisdictionCode } from "./jurisdiction-codes.mjs";   // one spelling of a territory code
 import { searchedCovers } from "./frame-diff-model.mjs";                // one copy of the EU-reach rule
 import { partyFactSources, partyFactViolations, partyFactMessage, canJudgePartyFacts } from "./party-facts.mjs";   //
@@ -2375,26 +2376,25 @@ const knockoutSurfaces = (findings) => {
 // FLAG-ONLY, AND NEVER PROJECTED. 333: "A hit is a rewrite of that line, never a disclosure and never a
 // run failure." These carry surface "findings", which runKnockoutLint's caller does not project onto
 // the cover note or the workbook — so a flag reaches whoever is fixing the run and nobody else.
-const LAWYER_VOCAB = [
-  ["proprietor", /\bproprietors?\b/i],
-  ["subsisting", /\bsubsisting\b/i],
-  ["senior right", /\bsenior (?:right|mark|position)/i],
-  ["specification", /\bspecifications?\b/i],
-  ["formative", /\bformatives?\b/i],
-  ["prevail", /\bprevails?\b|\bprevailing\b/i],
-  ["citable", /\bcitable\b/i],
-  ["limb", /\bon every limb\b|\ball limbs\b/i],
-  ["non-use attack", /\bnon-?use attack\b/i],
-  ["belt-and-braces", /\bbelt-?and-?braces\b/i],
-  ["dispatch", /\bdispatch(?:ed|es)?\b/i],
-  ["lane", /\blanes?\b/i],
-  ["on the record as it stands", /\bon the record as it stands\b/i],
-  ["the marks-and-goods comparison", /\bmarks-and-goods comparison\b/i],
-  ["chunk", /\bchunks?\b/i],
-];
-
-/** The longest a default-visible sentence may run before it stops being one idea (333 rule 1). */
-const PLAIN_SENTENCE_WORDS = 25;
+// ── THE RULE IS NOT WRITTEN HERE ANY MORE ───────────────────────────────────────────────────────────
+//
+// This file carried its own vocabulary list and its own sentence limit, imported nothing, and was the
+// copy that actually ran on every knockout delivery — a fourth copy of a rule the other three are pinned
+// to each other by a test. It had already drifted: it flagged `senior right`, `limb` and `lane`, which
+// appear in no pinned copy, so a seat was corrected against a rule it was never taught; and it did not
+// flag `instructed`, which the doctrine does teach. It also carried no plain form at all, naming the
+// term and deferring the replacement to a skill — and the replacement is the half the doctrine calls
+// load-bearing.
+//
+// It reads the pinned source now. The three untaught terms go with it: teaching a term is a doctrine
+// change, and `PLAIN_FORMS` is pinned to both documents by
+// `the-two-register-rule-says-the-same-thing-to-both-products.test.mjs`, so a term added here without
+// its worked swap in both would red that test rather than silently widening what a seat is corrected on.
+//
+// WHAT WAS NOT LOST IN THE CONSOLIDATION. The patterns here handled inflections and the pinned source
+// did not — `proprietors`, `prevailing`. Reading terms from the weaker matcher would have narrowed the
+// live check while looking like a tidy-up, so the inflections moved INTO the pinned source as
+// `termMatcher`, and both sides use it.
 
 /**
  * The fields a reader of the knockout meets before opening anything, named one by one rather than
@@ -2424,15 +2424,39 @@ function knockoutVisibleProse(findings) {
  * sentence carrying more than one idea. Each names the field, so a hit is a line somebody can rewrite
  * rather than a score.
  */
-export function plainLanguageChecks({ findings, surface = "findings" } = {}) {
+/**
+ * The checks that are internal BY DESIGN, named once so the rule lives beside the thing it governs.
+ *
+ * A hit on any of these is a line for whoever is fixing the run to rewrite. It is never something a
+ * client is shown and it never fails a run — see the header above and the doctrine these implement.
+ * Every other check on this lane is relabelled `report` as it is pushed, one line at a time, and these
+ * three sit in the middle of that list: making them projectable is a one-line edit that looks exactly
+ * like its neighbours and that no test would have caught, because the arms enumerating failure ids
+ * filter these three out before asserting — correctly, for what those arms check.
+ */
+export const NEVER_PROJECTED = Object.freeze(new Set([
+  "reviewer-note-subject", "plain-language-vocabulary", "plain-language-sentence-length",
+]));
+
+/** The surface a check that must never reach a reader carries. Not `report`, and not a caller's choice. */
+export const INTERNAL_SURFACE = "findings";
+
+/**
+ * THE SURFACE IS NOT THE CALLER'S TO CHOOSE. It used to be a parameter with a default, so the property
+ * held because every caller happened to pass nothing — a run that satisfies a rule rather than a rule.
+ * A future caller passing `report` would have put a plain-language hit on the page a client reads, with
+ * nothing going red.
+ */
+export function plainLanguageChecks({ findings } = {}) {
+  const surface = INTERNAL_SURFACE;
   const fields = knockoutVisibleProse(findings);
   const vocab = [];
   const longSentences = [];
   for (const { where, text } of fields) {
-    for (const [name, re] of LAWYER_VOCAB) if (re.test(text)) vocab.push(`${where}: "${name}"`);
+    for (const [term] of PLAIN_FORMS) if (termMatcher(term).test(text)) vocab.push(`${where}: "${term}"`);
     for (const sentence of text.split(/(?<=[.!?])\s+|\n+/)) {
       const n = sentence.trim().split(/\s+/).filter(Boolean).length;
-      if (n > PLAIN_SENTENCE_WORDS) longSentences.push(`${where}: ${n} words`);
+      if (n > SENTENCE_WORD_LIMIT) longSentences.push(`${where}: ${n} words`);
     }
   }
   // ── A NOTE THAT WILL PRINT IN THE PLACE ITS WRITER DID NOT MEAN ────────────────────────────────────
@@ -2465,7 +2489,7 @@ export function plainLanguageChecks({ findings, surface = "findings" } = {}) {
     check("plain-language-vocabulary", "voice", surface, vocab.length === 0,
       vocab.length ? `the lawyer's vocabulary on lines a reader meets before opening anything — rewrite the line in the words the reader already owns (the skill carries the swaps): ${say(vocab)}` : ""),
     check("plain-language-sentence-length", "voice", surface, longSentences.length === 0,
-      longSentences.length ? `a default-visible sentence carrying more than one idea (over ${PLAIN_SENTENCE_WORDS} words) — split it, conclusion first: ${say(longSentences)}` : ""),
+      longSentences.length ? `a default-visible sentence carrying more than one idea (over ${SENTENCE_WORD_LIMIT} words) — split it, conclusion first: ${say(longSentences)}` : ""),
   ];
 }
 
@@ -2529,7 +2553,12 @@ export function runKnockoutLint({ findings }) {
   // "all", because on the clearance lane it asserts agreement BETWEEN surfaces. This lane has one
   // surface, so "report" is also the truer label here. The filter is deliberately not `!== "findings"`:
   // that would default a check added next year to PROJECTING onto a surface a client principal reads.
-  const onReport = (list) => list.map((c) => ({ ...c, surface: "report" }));
+  // AND IT REFUSES TO PROMOTE THE THREE THAT ARE INTERNAL BY DESIGN. Pinning the surface inside
+  // `plainLanguageChecks` stops a caller ASKING for a projectable one; it does not stop this line
+  // relabelling the answer afterwards, which is the same edit one step later and looks like every other
+  // line around it. So the rule is enforced where the surface is actually chosen. Anything added to
+  // NEVER_PROJECTED is covered here by construction rather than by whoever adds it remembering.
+  const onReport = (list) => list.map((c) => (NEVER_PROJECTED.has(c.id) ? c : { ...c, surface: "report" }));
   checks.push(...permissionProseChecks({ text: report, surface: "report", idSuffix: ":knockout", structural: true, cards: false }));
   checks.push(...onReport(scopeNumberProseChecks({ reportMd: report })));
   checks.push(...onReport(countingChecks({ report })));

package/driver/publish/render.mjs

@@ -416,7 +416,7 @@ const useEvidence = (m) => [USE_EVIDENCE_LABEL[m?._status], USE_SOURCE_LABEL[m?.
 // EXACT EQUALITY, exactly as EVIDENCE_LABEL maps `_status`. The sentinel itself does not move: archived
 // runs carry the old value forever and a fourth spelling of it would have to be accepted everywhere.
 const USE_CHECK_NO_RESULT = 'perplexity_research — no result';
-const USE_CHECK_NO_RESULT_CITE = 'Marketplace search run — no result found.';
+const USE_CHECK_NO_RESULT_CITE = 'Nothing found in the marketplaces searched.';
 const USE_CHECK_NO_RESULT_SHORT = 'marketplace search — no result found';
 // — MATCHED ON NORMALISED PUNCTUATION, NOT ONE SPELLING. The constant itself does not
 // move (archived runs carry it forever, the validators name it), but the SEAT emitted a hyphen where
@@ -852,7 +852,7 @@ function plainScopeNote(text) {
   if (!t) return '';
   return stripTelemetry(t).trim();   // trim: an all-telemetry note leaves only newlines, and '' is falsy
 }
-function scopeSection(ranBucket, coverage, coverageJudgment, methodologyText, contextNotes, fm = {}, hasRecordSet = false, hasCards = false) {
+function scopeSection(ranBucket, coverage, coverageJudgment, methodologyText, contextNotes, fm = {}, hasRecordSet = false, hasCards = false, hasIndexEntry = false) {
   const parts = [];
   // B3 (spec 2026-07-30 §4) — record provenance, stated ONCE, here, instead of a hedge stamped on
   // every card. This is the single home of what "fetched", "register-index entry" and "inferred"
@@ -868,7 +868,11 @@ function scopeSection(ranBucket, coverage, coverageJudgment, methodologyText, co
   // conditions: a copy is a thing that drifts, and over-including costs one explanatory paragraph in a
   // collapsed section while under-including costs a reader an unexplained label. The fetched-records
   // sentence stays conditional on hasRecordSet, so a run WITH a record set is byte-identical to B3.
-  if (hasRecordSet || hasCards) parts.push(`<p class="scoperead" style="margin:0 0 4px;font-weight:600">Record provenance</p><p class="provnote" style="margin:0 0 6px;font-size:13px">${hasRecordSet ? 'Registry identifiers on the finding cards are read from the official register records fetched this run. ' : ''}A registration shown as a register-index entry was seen in the register index; its full record was not pulled. An enforcer appetite marked “inferred” rests on reputation or profile signals rather than a fetched record.</p>`);
+  // THREE SENTENCES EXPLAINING ONE WORD, and the middle one printed on every report whether or not the
+  // page had a register-index entry on it — a definition of a label the reader could not see. It renders
+  // now only where such an entry does, and the remaining two say what "inferred" means in the words a
+  // reader would use for it rather than in the renderer's.
+  if (hasRecordSet || hasCards) parts.push(`<p class="scoperead" style="margin:0 0 4px;font-weight:600">Record provenance</p><p class="provnote" style="margin:0 0 6px;font-size:13px">${hasRecordSet ? 'Registration numbers on the cards were read from the register records. ' : ''}${hasIndexEntry ? 'A registration shown as a register-index entry was seen in the register index; its full record was not pulled. ' : ''}“Inferred” beside an owner’s likelihood to object means we judged it from what the owner sells and holds; we had no enforcement history to read.</p>`);
   // — this is the one part of §4 that does NOT fold. Same markup, same heading, same marker; it is
   // emitted beside the <details> instead of inside it, wrapped in the panel the only-you section already
   // uses so it reads as a region of the page rather than a stray heading.
@@ -896,7 +900,11 @@ function scopeSection(ranBucket, coverage, coverageJudgment, methodologyText, co
       + `<p class="covnone" style="margin:0 0 6px;font-size:13px">No coverage record was produced for this run. `
       + `This section normally lists what each search covered and what is still open; its absence here is a gap `
       + `in the record, not a finding that nothing is open. Ask us before relying on it.</p>`);
-  if (coverageJudgment && coverageJudgment.reason) parts.push(`<p class="cov-read" style="margin:8px 0 0;font-size:13px;color:var(--faint)"><b>Coverage read (internal):</b> ${esc(String(coverageJudgment.reason))}</p>`);
+  // THE INTERNAL COVERAGE READ IS NOT RENDERED. It concatenated the engine's own search-unit names into
+  // about a thousand characters of prose — and on the measured run it ended mid-word, because it is a
+  // machine's working note and nothing was reading it as a sentence. Every fact in it is already in the
+  // coverage cells directly above, in plain words. It stays in the run's artifacts and in the workbook,
+  // where the reader is someone who wants it.
   const meth = plainScopeNote(methodologyText);
   if (meth) parts.push(`<p class="scoperead" style="margin:10px 0 4px;font-weight:600">How this search was run</p><div class="methnote" style="font-size:13px">${renderProse(meth)}</div>`);
   const cn = contextNotesBlock(contextNotes);
@@ -1230,11 +1238,16 @@ function fullDetail(f, card, recordsByUri = new Map()) {
   //                 ("Download full audit (Excel)"), because that is the string the reader hunts for on
   //                 the page. NOT an inline .xlsx link: portal-report.mjs strips those, correctly — the
   //                 portal REPLACES them with its own download control (portal-ui Result.tsx).
-  //   placeholder — a register UI exists and we do not know its per-record address. Labelled as a
-  //                 placeholder so it reads as unfinished rather than as a citation a reader can check.
+  //   placeholder — a register UI exists and we do not know its per-record address. It CARRIES NO NOTE:
+  //                 the number stands on its own, because "(placeholder)" beside twenty-four
+  //                 registrations reads to a client as a broken report rather than as a missing link.
+  // THE PLACEHOLDER NOTE IS GONE. It printed " — no record link available yet (placeholder)" beside
+  // every registration a register UI has no per-record address for — twenty-four times on the measured
+  // page — and a client reads "placeholder" as a broken report. The number is the fact; when there is a
+  // link the number IS the link, and when there is not, the number still stands on its own. The
+  // workbook note stays: it tells a reader where the full record actually is.
   const NO_LINK_NOTE = {
     workbook: ' — full record in the audit workbook (“Download full audit (Excel)”)',
-    placeholder: ' — no record link available yet (placeholder)',
   };
   const regUri = (u, fb) => {
     const h = regHref(u);
@@ -1350,7 +1363,11 @@ function fullDetail(f, card, recordsByUri = new Map()) {
   // D7 — the code-owned "searched, nothing found" sentinel becomes client words HERE, by exact
   // equality against the one constant. Any other value is a source string and rides through untouched.
   const useSrc = isUseCheckNoResult(f.use_check?.source) ? USE_CHECK_NO_RESULT_CITE : f.use_check?.source;
-  const useChk = cite(useSrc, 'Use checked.', useStatus);
+  // NO EVIDENCE TAG ON AN EMPTY RESULT. The line read "Use checked. Marketplace search run — no result
+  // found. Evidence: inferred", and "inferred" beside "no result" reads as a contradiction: it qualifies
+  // how a FINDING was established, and there is no finding here. Nothing was found, and that is the
+  // whole of what the line has to say.
+  const useChk = cite(useSrc, 'Use checked.', isUseCheckNoResult(f.use_check?.source) ? null : useStatus);
   const ownR = cite(f.own_rights?.source, 'Own-portfolio sweep.', EVIDENCE_LABEL[f.own_rights?._status]);
   const proseFull = cardBlock(card, /^full detail/i);
   const proseFullShown = proseFull;   // one report: the full prose; portal-report strips serve-time chrome, never analysis
@@ -1627,7 +1644,67 @@ const COV_STATE = {
   'not-searched': { cls: 'todo', ic: '→', word: 'Not run this run' },
   note: { cls: 'info', ic: 'i', word: 'Note' },
 };
+/**
+ * ONE ROW PER GAP, where the driver's follow-up row and the model's own row are the same search.
+ *
+ * A run deferred the English word DOLPHIN and the page said so twice: once as the model wrote it — "the
+ * English word DOLPHIN as a dedicated exact search · Open item" — and once as the driver composes it
+ * from the envelope, "Follow-up / dolphin · Open item: dolphin — not completed this run — the search for
+ * it was planned and never reached the register…". The run's own reviewer flagged the duplicate and it
+ * shipped anyway, because the second row is composed HERE and the reviewer reads what the model wrote.
+ *
+ * RENDER-SIDE ONLY. Both rows stay in the record and in the workbook; this decides what the page draws.
+ * Dropping the driver's row from `coverage[]` would change what the run recorded, and this issue is
+ * presentation.
+ *
+ * IT ERRS TOWARD KEEPING BOTH. A surplus row is today's behaviour; a wrongly-suppressed one hides a gap
+ * from the reader, which is the failure worth avoiding. So the driver's row goes only when another row
+ * carries EVERY significant word of the directive it names — a near-match keeps both.
+ */
+const FOLLOW_UP_PREFIX = 'Follow-up / ';
+const COV_STOPWORDS = new Set(['the', 'a', 'an', 'as', 'for', 'of', 'in', 'on', 'and', 'or', 'to', 'is',
+  'was', 'it', 'its', 'this', 'that', 'with', 'by', 'at', 'be', 'been', 'run', 'search', 'searched']);
+const covWords = (t) => new Set(String(t || '').toLowerCase().match(/[a-z0-9]+/g)?.filter((w) => !COV_STOPWORDS.has(w)) ?? []);
+
+function dedupeFollowUps(coverage) {
+  const composed = (c) => String(c?.area || '').startsWith(FOLLOW_UP_PREFIX);
+  const written = coverage.filter((c) => !composed(c));
+  if (!written.length) return coverage;
+  return coverage.filter((c) => {
+    if (!composed(c)) return true;
+    // The directive is the note's opening clause — the same string the area was clipped from, unclipped.
+    const directive = covWords(String(c.note || '').split('—')[0]);
+    if (!directive.size) return true;
+    // A COMPLETED SEARCH NEVER STANDS IN FOR AN UNCOMPLETED ONE. This is the discriminator the first
+    // version lacked, and it hid a real gap from a client on a delivered page.
+    //
+    // The composed row exists to say a planned search never ran. Suppressing it requires another row
+    // saying THE SAME THING about the same search — so the row that suppresses must itself be open. A
+    // row reporting a search that RAN is reporting the opposite, and the two are not interchangeable
+    // however many words they share.
+    //
+    // Found on a real run, driven on the shipped renderer: a completed saturation probe into
+    // third-party dolphin-word rights suppressed the uncompleted exact-word register search for DOLPHIN,
+    // because both areas contain "dolphin". The client then read a coverage section that mentioned the
+    // word and disclosed nothing left undone, and the suppressed row was the page's only disclosure of
+    // it. That is exactly the failure this function's header calls the one worth avoiding, and the
+    // header was right while the code was not.
+    //
+    // WHAT THIS STILL CANNOT DO, said rather than implied: it is word containment, so two genuinely
+    // different OPEN searches sharing every word of a short directive would still collapse to one. The
+    // discriminator a reader would want is which search a row names, and the rows carry no identity to
+    // join on — that is why the issue's own wording is "name the same search" rather than a rule. The
+    // narrowing here is the strongest one the data supports, and it errs toward keeping both.
+    return !written.some((w) => {
+      if (COV_STATE[w?.state]?.cls === 'ok') return false;   // a searched-and-clean row reports the opposite
+      const theirs = covWords(w.area);
+      return [...directive].every((word) => theirs.has(word));
+    });
+  });
+}
+
 function coverageGrid(coverage) {
+  coverage = dedupeFollowUps(coverage);
   if (!coverage.length) return '';
   const cell = (c) => {
     const s = COV_STATE[c.state] || COV_STATE.note;
@@ -1753,7 +1830,7 @@ document.addEventListener('keydown',function(e){if(e.key==='Escape'){var pop=doc
 function markAssessmentBlock(ma) {
   if (ma == null) return '';
   const structured = typeof ma.distinctiveness === 'object' || typeof ma.connotation === 'object';
-  const SEC = `<div class="sec"><span class="num">✦</span><h2>The mark itself</h2><span class="note">standing read of the applicant's own mark — advisory, carries no rating</span></div>`;
+  const SEC = `<div class="sec"><span class="num">✦</span><h2>The mark itself</h2><span class="note">how strong the name is on its own</span></div>`;
   if (!structured) {
     const dist = String(ma?.distinctiveness ?? '').trim(), conn = String(ma?.connotation ?? '').trim();
     if (!dist && !conn) return '';
@@ -2130,7 +2207,7 @@ export function renderHtml(parsed, findings = [], coverage = [], opts = {}) {
   const clNotice = (clNoticeText && CASE_LAW_BY_ORD.size)
     ? `<div class="panel" style="padding:12px 16px;margin:0 0 12px"><p style="margin:0 0 4px;font-weight:700;font-size:13px">Session-wide notice</p><div style="font-size:13px">${renderProse(clNoticeText)}</div></div>`
     : '';
-  const CL_SEC = (n) => `<div class="sec" id="common-law"><span class="num">${n}</span><h2>Common-law &amp; marketplace</h2><span class="note">unregistered-use signals — not register rights</span></div>
+  const CL_SEC = (n) => `<div class="sec" id="common-law"><span class="num">${n}</span><h2>Common-law &amp; marketplace</h2><span class="note">who is using similar names, registered or not</span></div>
   ${clNotice}${clBody}`;
   const hasCL = Boolean(clBody || clNotice);
   let findingsSections, covNum;
@@ -2269,7 +2346,7 @@ ${opts.nav || ''}
   ${ruledOutSection(ruledOut, recordsByUri)}
 
   <!-- doc-52 §3 WHAT ONLY YOU CAN CLOSE — forward decisions, plain English, after the findings. -->
-  ${buckets.you ? `<div class="sec" id="only-you"><span class="num">✔</span><h2>What only you can close</h2><span class="note">forward decisions only you can make — each tied to a finding above</span></div>
+  ${buckets.you ? `<div class="sec" id="only-you"><span class="num">✔</span><h2>What only you can close</h2><span class="note">decisions that need you</span></div>
   <div class="panel actions"><div class="actgrp act-you">${renderProse(buckets.you.body)
     .replace(/\[Time-critical\]\s*/gi, '<span class="src cl" style="margin-right:6px">Time-critical</span> ')
     .replace(/\[Open question\]\s*/gi, '<span class="src" style="margin-right:6px">Open question</span> ')
@@ -2287,14 +2364,32 @@ ${opts.nav || ''}
 
   <!-- doc-52 §4 SCOPE & WHAT WE DIDN'T SEARCH — one collapsible section, last; replaces "Checks we ran"
        + "Methodology" + the coverage grid. Nothing here leads. -->
-  ${scopeSection(buckets.ran, coverage, opts.coverageJudgment, secs['Methodology'], DISPOSITION_MODE ? [] : contextNotes, fm, recordsByUri.size > 0, findings.length > 0)}
+  ${scopeSection(buckets.ran, coverage, opts.coverageJudgment, secs['Methodology'], DISPOSITION_MODE ? [] : contextNotes, fm, recordsByUri.size > 0, findings.length > 0,
+    // WHETHER A REGISTER-INDEX ENTRY IS ACTUALLY ON THIS PAGE, mirroring the registration render's own
+    // second disjunct rather than restating it loosely: a cited registration with no fetched body, which
+    // is the state that draws the "(register-index entry)" label. The provenance paragraph explains that
+    // label, so it renders where the label can and stays off every page where it cannot.
+    findings.some((f) => (f?.owner?.registrations ?? []).some((r) => r?.uri
+      && (recordsByUri.size > 0 || !(r.status || r.filed || r.expiry || (r.classes && r.classes.length))))))}
 
   ${askAiHtml}
 
   <footer>
     <span>${productName ? `${esc(productName)}. ` : ''}${FRAMEWORK
-        ? `Working draft for legal review. Risk bands (${esc(FRAMEWORK.title)}): <span class="mono">${esc(FRAMEWORK.bands.map(b => b.label).join(' / '))}</span> — the framework in force's own vocabulary, one word per finding on every surface. Internal notes are review-only and removed on export.`
-        : 'Working draft for legal review. Risk levels: <span class="mono">LOW / MANAGEABLE / MEDIUM / HIGH / VERY HIGH</span> (one vocabulary on every surface); the <span class="mono">Level A–E</span> · <span class="mono">Composite 1–5</span> codes beside them are the internal legal shorthand. Internal notes are review-only and removed on export.'}<br>Matter ${esc(fm.matter || '')}${fm.run ? ` · ${esc(fm.run)}` : ''}.${fm.rated_under ? `<br>Rated under: <span class="mono">${esc(fm.rated_under)}</span>.` : ''}${fm.run_under_project ? `<br>Run under project: <span class="mono">${esc(fm.run_under_project)}</span>.` : ''}</span>
+        // TWO SENTENCES, and that count is the ruled shape rather than a consequence of trimming.
+        //
+        // Two things left. The band note — "the framework in force's own vocabulary, one word per
+        // finding on every surface" — is a note about how the renderer works, printed on every report a
+        // client receives; the framework's NAME is on the "Rated under" line below, once, which is
+        // where a reader who wants it will look.
+        //
+        // AND "Working draft for legal review.", which is a separate decision and is recorded as one.
+        // A delivered clearance is not a draft, and a document that calls itself one on every page is
+        // describing its own status inaccurately to the person paying for it. Raised in review because
+        // the first version of this comment argued only the band note and left the reader to infer that
+        // the status line had gone along for the ride.
+        ? `Risk bands: <span class="mono">${esc(FRAMEWORK.bands.map(b => b.label).join(' / '))}</span>. Purple notes are for the reviewing lawyer and are removed on export.`
+        : 'Risk bands: <span class="mono">LOW / MANAGEABLE / MEDIUM / HIGH / VERY HIGH</span>. Purple notes are for the reviewing lawyer and are removed on export.'}<br>Matter ${esc(fm.matter || '')}${fm.run ? ` · ${esc(fm.run)}` : ''}.${fm.rated_under ? `<br>Rated under: <span class="mono">${esc(fm.rated_under)}</span>.` : ''}${fm.run_under_project ? `<br>Run under project: <span class="mono">${esc(fm.run_under_project)}</span>.` : ''}</span>
     ${logoLockup({ mark: 16 })}
   </footer>
 </div>

package/driver/search-policy.mjs

@@ -207,7 +207,7 @@ export const PRODUCT_POLICIES = {
       // 199 of those same 420 carry one. The driver now reads this row and can cut on that tier
       // (doubt-selection.mjs).
       //
-      //, owner-ruled 2026-08-23, product by product (reached this branch as an overwatch relay on
+      //, owner-ruled 2026-08-23, product by product (reached this branch on
       // that thread, not as a comment from the owner's own hand — the box has one `gh` identity).
       // It is the P2 column of that table's `placement-inquiry trace` row — the row whose typed key is
       // the placement tier. This stage's OWN row reads `bands 1+2 / band 1` on FINDING CLASS, which is

package/driver/stage-context.mjs

@@ -369,6 +369,19 @@ export const DISPATCH_EXTRAS = [
       { path: join(P.runDir, "_records"), dir: true, why: "assembleRunRecords — the fetched official records each claimed field is checked against; without them the check finds zero mismatches and the block silently vanishes" },
     ],
   },
+  {
+    // Rule 1 of the two-register rule, measured over the record's default-visible lines and handed to
+    // the pass that already rewrites. Advisory by construction: it reaches the writer, never the reader.
+    //
+    // It reads the RECORD rather than the narrative, and that is the point — the lines a client meets
+    // first are typed fields (each conflict's one sentence, the coverage notes, the actions, the mark
+    // assessment's two reads), not prose to be re-parsed out of a document. A sandbox without this file
+    // composes no block, which is correct and visible: the composer stamps what it built.
+    id: "refute-plain-register", stage: "narrative-refutation",
+    reads: (P) => [
+      { path: P.findings, why: "plainRegisterExtra reads the typed default-visible fields — net, coverage notes, actions, mark assessment — and the owners it must blank before reading" },
+    ],
+  },
   // ── — synthesis's two, and the asymmetry they close ─────────────────────────────────────────
   //
   // The reviewer received the plan-execution receipt as a code-derived table; the stage it reviews