clearotron 0.2.4 → 0.3.0-beta.1

package/driver/pipeline-knockout.mjs

@@ -44,7 +44,7 @@ import {
   // implementation; a second copy here would be a second thing to keep true.
   decideRecovery, failureSignature, classifyFailureReason, countRecoveryLanes, weatherCeilingFor,
 } from "./repairs.mjs";
-import { RunCancelled } from "./cancel.mjs";   // stop-by-user: never the failure lane below
+import { RunCancelled, assertNotCancelledBeforePublish } from "./cancel.mjs";   // stop-by-user: never the failure lane below
 import { loadFrameworkManifest, parseFrameworkManifest, frameworkFor, DEFAULT_FRAMEWORK } from "./framework.mjs";
 import { KO_STAGES, KO_STEPS, KO_STEP_REGISTER_COUNT, koSteps, koPaths, kebab, knockoutPrompt, koChunks } from "./stages-knockout.mjs";
 import { kebabCollisions, reportIdentityFor, CAPABILITY_SKIPPED_CAUSE, CAPABILITY_SKIPPED_NOTE } from "./search-policy.mjs";
@@ -55,10 +55,12 @@ import { capabilitiesFor } from "./register-capabilities.mjs";
 import { registerUnavailableOffices } from "./register-unreachable.mjs";
 import { runRecordLogPath } from "../providers/_shared/ledger-path.mjs";   // — this run's record log
 import { validators as koValidators, validateMergedFindings, worstBand, registerSurfacedFilings, raterCaveats, SURVIVOR_BOUNDARY_RE } from "./verify-knockout.mjs";
+import { reviewAbout, reviewEvidence, reviewEvidenceLines, applyKnockoutReview, knockoutReviewFile } from "./knockout-review-record.mjs";
 import { publishKnockout, composeKnockoutEmail } from "./publish/knockout.mjs";
 import { writeRunStatus, rollupStatus, atomicWrite, identitySeed } from "./progress.mjs";   // — the identity seed is shared; the stepper is not
 import { batchMarkName } from "./mark-name.mjs";
 import { runLog, note, outputMeta } from "./log.mjs";
+import { defaultTerritoryState } from "./effective-scope.mjs";   // the stored-defaults reading — one producer, shared with the clearance lane
 import { AGENT_WHATSAPP, whatsappRouting } from "./stages.mjs";
 import { writeOutboxPacket } from "./outbox.mjs";
 import { rollupTokens, stampTokenRollup } from "./tokens.mjs";
@@ -66,7 +68,7 @@ import { recordRunConsumption } from "./consumption-ledger.mjs";
 import { writeSettleStamp } from "./settle-stamp.mjs";   // — the pool copy's own terminal state
 import { stopReason } from "../shared/stop-reason.mjs";   //
 import { envFrom } from "../shared/env-aliases.mjs";   // — resolves EITHER spelling; names the retired one because that is the live-writable half
-// The scoped owner lookup a promoted register filing is owed (tracker issue 276). Bounded, deduplicated
+// The scoped owner lookup a promoted register filing is owed. Bounded, deduplicated
 // per owner, and structurally unable to withhold a report.
 import { ownersOwedACheck, runOwnerChecks } from "./owner-use-check.mjs";
 
@@ -164,6 +166,62 @@ export function readBackLadder(ctx, sidecarPath, { minted }) {   // exported for
 
 // ── koStage: the slim lane's stage runner — skip-if-output-valid (the stageOnce pattern), one
 // runStage call, StageFailure on exhaustion (rate_limited rides to pipeline()'s postpone catch).
+/**
+ * Rewrite the lines a reader meets first, and NEVER cost a client a report doing it.
+ *
+ * Every failure path returns the record it was handed. A stage that fails, times out, returns nothing,
+ * returns something that will not parse, or produces a rewrite the merged gate then refuses, all end the
+ * same way: the rated record ships, unrewritten, exactly as it shipped before this stage existed. This
+ * pass is presentation. A refusal is never a pass, and "no report" is a product failure — so the last
+ * thing added to the delivery path is the last thing that should be able to stop it.
+ *
+ * THE EMPTY CASE IS NOT A FAILURE AND IS NOT SILENT. A batch whose default-visible lines are all already
+ * plain has nothing to dispatch, and paying for a turn to be told so is waste. It is logged with the
+ * count, so "nothing was flagged" and "the pass never ran" are different rows in the journal rather than
+ * one absent one.
+ */
+async function knockoutReviewingPass({ ctx, run, K, merged, plan }) {
+  const about = reviewAbout(merged, plan);
+  const evidence = reviewEvidence(merged, about);
+  if (!evidence.rows.length) {
+    runLog(run.runDir, { event: "knockout-review", outcome: "nothing-flagged", flagged: 0,
+      marks: merged.marks.length, excludedMarks: about.marks.length, excludedOwners: about.owners.length });
+    return merged;
+  }
+
+  const keep = (outcome, detail) => {
+    runLog(run.runDir, { event: "knockout-review", outcome, flagged: evidence.rows.length, applied: 0,
+      delivered: "the rated record, unrewritten", ...detail });
+    note(`reviewing pass: ${outcome} — the rated record ships unrewritten`);
+    return merged;
+  };
+
+  try {
+    await koStage("knockout-review", ctx, {
+      msgCtx: { evidenceLines: reviewEvidenceLines(evidence), exclusionNote: evidence.exclusionNote },
+    });
+  } catch (e) {
+    return keep("stage-failed", { reason: String(e?.message ?? e).slice(0, 200) });
+  }
+
+  let review;
+  try { review = JSON.parse(readFileSync(knockoutReviewFile(run.runDir), "utf8")); }
+  catch (e) { return keep("artifact-unreadable", { reason: String(e?.message ?? e).slice(0, 200) }); }
+
+  const { doc, receipt } = applyKnockoutReview(merged, review);
+  // THE REWRITTEN RECORD GOES THROUGH THE SAME GATE. Not a lighter one and not none: this is the record
+  // a client receives, and the only reason it is trusted is that it passed what the rated one passed.
+  const mv = validateMergedFindings(run.runDir, doc, plan);
+  if (!mv.ok) return keep("rewrite-refused-by-the-merged-gate", { failures: mv.failures.slice(0, 5) });
+
+  atomicWrite(K.findings, JSON.stringify(doc, null, 2) + "\n");
+  runLog(run.runDir, { event: "knockout-review", outcome: "applied", flagged: evidence.rows.length,
+    applied: receipt.applied, declined: receipt.declined,
+    unresolved: receipt.unresolved.length, refused: receipt.refused.length,
+    excludedMarks: about.marks.length, excludedOwners: about.owners.length });
+  return doc;
+}
+
 async function koStage(name, ctx, { chunkNo = null, msgCtx = {} } = {}) {
   // — the stage's own start, captured before ANY work: before the existsSync, before the validator
   // read, before the message composition. states why on the spine — capture it after the await and
@@ -478,8 +536,8 @@ export async function knockoutInner(ctx, job, opts = {}) {
       //
       // `failClass: "deterministic"` says the same thing to the OTHER reader: repairs.mjs's ladder. It
       // was stamped when this lane had no ladder for it to reach — "so the fact travels with the throw
-      // rather than being re-guessed from prose by whichever catch the throw ends up in." As of tracker
-      // issue 1889 that catch is this lane's own, the stamp is LIVE, and it is what buys this refusal
+      // rather than being re-guessed from prose by whichever catch the throw ends up in." That catch is
+      // now this lane's own, the stamp is LIVE, and it is what buys this refusal
       // zero parks without the ladder having to read a word of the prose.
       if (refusal) throw new StageFailure("knockout-register-count", refusal, null,
         { refusal: true, failClass: "deterministic" });
@@ -521,6 +579,18 @@ export async function knockoutInner(ctx, job, opts = {}) {
         marksDetailed: markRows.map((m) => ({ name: String(m.name), ...(Array.isArray(m.classes) && m.classes.length ? { classes: m.classes } : {}), ...(m.ref ? { ref: m.ref } : {}) })),
       }, null, 2) + "\n");
     } catch (e) { note(`instructed-scope write failed (non-fatal): ${e.message}`); }
+    // The stored defaults the engine cannot search — the clearance lane's record, on this lane too. A
+    // knockout reads the same account profile and dropped the same entries in the same silence.
+    try {
+      const dts = defaultTerritoryState(ctx.profile);
+      // two records of one fact, so each has its own try: a fault in one must not take the other
+      try { if (dts.unrecognized.length) runLog(run.runDir, { event: "default-territory-unrecognized", count: dts.unrecognized.length, entries: dts.unrecognized, lane: "knockout" }); } catch (e) { note(`default-territory-unrecognized log failed (non-fatal): ${e.message}`); }
+      writeFileSync(K.defaultTerritories, JSON.stringify({
+        profileKey: ctx.profile?.profileKey ?? null,
+        searchable: dts.kept,
+        unrecognized: dts.unrecognized,
+      }, null, 2) + "\n");
+    } catch (e) { note(`default-territories write failed (non-fatal): ${e.message}`); }
 
     // status seed — knockout's OWN step flow (never seedRunStatus's clearance stepper). Depth 2
     // walks one more step than a plain knockout, so the list is resolved once and frozen on ctx.
@@ -658,7 +728,7 @@ export async function knockoutInner(ctx, job, opts = {}) {
           runLog(run.runDir, { event: "knockout-register-records", provider: REGISTER_PROVIDER, executor: recExec.source,
             marks: recDoc.marks.length, listed: listedMarks(recDoc), records: recDoc.marks.reduce((n, m) => n + m.records.length, 0) });
 
-          // ── THE OWNER LOOKUP, HERE BECAUSE HERE IS WHERE THE OWNER BECOMES KNOWN (tracker issue 276) ──
+          // ── THE OWNER LOOKUP, HERE BECAUSE HERE IS WHERE THE OWNER BECOMES KNOWN ──────────────────────
           //
           // On the run that produced the issue, the owner's name was on disk 48 seconds before the sweep
           // started and no pass ever searched it: every sweep keys on the TERM, and nothing re-swept on an
@@ -667,7 +737,7 @@ export async function knockoutInner(ctx, job, opts = {}) {
           //
           // Bounded to promoted filings and deduplicated per owner — on the issue's own run that is ONE
           // extra query. Never throws: a failure produces rows saying the lookup did not answer, and the
-          // run publishes (owner ruling A, 2026-09-07).
+          // run publishes (ruling A, 2026-09-07).
           try {
             const owed = ownersOwedACheck(recDoc);
             if (owed.length) {
@@ -811,7 +881,9 @@ export async function knockoutInner(ctx, job, opts = {}) {
     for (let c = 0; c < chunks.length; c++) {
       await koStage("knockout-assess", ctx, { chunkNo: c, msgCtx: { chunkMarks: chunks[c], chunkTotal: chunks.length, framework: ctx.framework } });
     }
-    const merged = { schema_version: 1, framework: null, batch: null, marks: [] };
+    // `let`, because the reviewing pass below returns a REWRITTEN record rather than editing this one:
+    // the original has to survive intact as the thing that ships if the pass cannot finish cleanly.
+    let merged = { schema_version: 1, framework: null, batch: null, marks: [] };
     const summaries = [];
     for (let c = 0; c < chunks.length; c++) {
       // READ prefers the new location and falls back to the pre-relocation one, so a run whose chunks
@@ -896,9 +968,34 @@ export async function knockoutInner(ctx, job, opts = {}) {
     if (!mv.ok) throw new StageFailure("knockout-assess", `merged findings failed the lint: ${mv.failures.join("; ")}`, null);
     runLog(run.runDir, { event: "knockout-receipts", ...mv.receipts });
     atomicWrite(K.findings, JSON.stringify(merged, null, 2) + "\n");
+    // ── THE REVIEWING PASS, AFTER THE RECORD IS ON DISK AND BEFORE ANYTHING READS IT ─────────────────
+    //
+    // ORDER MATTERS THREE WAYS. The record is written FIRST so the stage's validator has something to
+    // join every address against — an address that names no line is refused while the seat can still
+    // send a repair turn, rather than reported as unresolved after the stage was declared good. It also
+    // means a run that dies inside the pass has already left a complete, valid, deliverable record: the
+    // rated one, unrewritten, which is exactly what shipped before this stage existed. And the rewritten
+    // record goes back through `validateMergedFindings` before it replaces that one, so nothing reaches
+    // a client that has not been through the same gate.
+    //
+    // NO NEW STEP LABEL. `stepTotal` is derived from `koSteps()`, so adding one would renumber the
+    // progress screen a client watches for a pass that takes a minute. It runs inside "Knockout
+    // assessment", which is what it is part of.
+    merged = await knockoutReviewingPass({ ctx, run, K, merged, plan });
     try { writeFileSync(K.assessment, String(merged.batch.executiveSummary ?? "")); } catch { /* prose mirror, best-effort */ }
 
     // 4 — publish (report + workbook + meta + index)
+    //
+    // THE LAST READ OF THE STOP FLAG. Everything above dispatches through the gateway, which reads it
+    // before a turn — so on this lane, where publication follows the final stage directly, a stop
+    // pressed during that stage was never seen and the report went out anyway.
+    assertNotCancelledBeforePublish(run.runDir, "knockout");
+    // PAST THE LAST STOPPABLE POINT, RECORDED WHERE IT BECOMES TRUE. The read above is the final one, so
+    // from this line on a stop cannot prevent delivery — and the screen must stop promising it will.
+    // Written here rather than derived on the screen from a step number: "Report & publish" is step 4 of
+    // 5 on this lane, not the last, so any arithmetic over stepN would name the wrong step and go stale
+    // the day a lane's list changes.
+    writeRunStatus(ctx, { stoppable: false });
     koStep(ctx, "Report & publish");
     const overall = worstBand(ctx.framework, merged.marks);
     const published = await publishKnockout({
@@ -934,7 +1031,7 @@ export async function knockoutInner(ctx, job, opts = {}) {
       conversationId: job.conversationId ?? null,
       subject: `Knockout trademark review — ${job.ref ?? markNames[0] ?? "batch"} (${nMarks} mark${nMarks === 1 ? "" : "s"})`,
       emailBodyHtml: emailHtml,
-      // THE SAME ROUTING AS THE CLEARANCE PACKET (tracker issue 289 part b). This read
+      // THE SAME ROUTING AS THE CLEARANCE PACKET (part b). This read
       // `AGENT_WHATSAPP[agent]`, and every user of a deployment shares one agent id, so every knockout
       // completion paged the operator and told the person who ordered it nothing. The clearance packet
       // was moved off that and this one was not, which is the half that shipped: one call site fixed,

package/driver/pipeline.mjs

@@ -81,7 +81,7 @@ import { profileOrdinals } from "./profile-selection.mjs";   // lever 3 — driv
 // CLIENT REPORT through the script-scope coverage row, which is why it is imported rather than typed:
 // the row used to name "Depth 5 (prelim-jx)" — a retired key on a retired ladder — as its remedy.
 import { NATIVE_LANGUAGE_REMEDY } from "./products.mjs";
-import { resolveTerritories } from "./effective-scope.mjs";   // the ONE territory ladder (the geography stamp included)
+import { resolveTerritories, defaultTerritoryState } from "./effective-scope.mjs";   // the ONE territory ladder (the geography stamp included) + the stored-defaults reading
 import { acquireSlot, releaseSlot } from "./slot-lock.mjs";
 import { mintSupplementalEntries, withRejected } from "./engine/mcp/supplemental.mjs";
 import { runLog, note, fileMeta, outputMeta, stageLog } from "./log.mjs"; import { armProduced, readArmSurfaces, producedNothingLine } from "./experiment-honesty.mjs"; import { correctiveReadiness, correctiveRefusalLine, correctivePassState } from "./corrective-arm.mjs";
@@ -98,7 +98,7 @@ import { buildAuditMd, parseSpineFindingBlocks } from "./publish/audit-from-spin
 import { deriveRegisterPresence } from "./publish/register-presence.mjs";   // — the audit stores every live in-scope record
 import { lastAcceptedMatterFrame } from "./matter-frame-record.mjs";   // — the frame's inferred scope, when nothing was instructed
 import { romanizedTermsFromPlan, mintSupplementalQid } from "./register-plan.mjs";   // — the stamp the late lanes never met
-import { slimLine, crowdLine } from "./hit-list.mjs";   // — the list the run works from; crowds ride it as a sibling array (tracker issue 95)
+import { slimLine, crowdLine } from "./hit-list.mjs";   // — the list the run works from; crowds ride it as a sibling array
 import { mintCrossCheckDoubts, mintContradictionDoubts, stitchDoubts, applyClosure } from "./doubt-ledger.mjs";   // doubt-stitch + doubt-closure (2026-07-22)
 // Conversion 6: the two line-form parsers are no longer on the live path — the seat sends typed
 // rows and the driver applies THOSE. `parseClosureLines`/`parseAskClosureLines` are still exported and
@@ -178,7 +178,7 @@ import { caseLawInventory } from "./config-inventory.mjs";   // — the deployme
 import { caseLawSourceRows } from "./case-law-sources.mjs";  // one author for the shape the stage is handed
 import { writeSettleStamp } from "./settle-stamp.mjs";   // — the pool copy's own terminal state
 import { isEntrypoint } from "../shared/is-entrypoint.mjs";   // — one entry-point test, all spellings
-import { RunCancelled, isCancelled } from "./cancel.mjs";   // stop-by-user: a distinct class, never classified as a failure; isCancelled is the resume door's own refusal (2155)
+import { RunCancelled, isCancelled, assertNotCancelledBeforePublish } from "./cancel.mjs";   // stop-by-user: a distinct class, never classified as a failure; isCancelled is the resume door's own refusal (2155)
 import { BRAND } from "../shared/brand.mjs";   // — the operator name a client is told to expect, from the tenant seam
 import { CLIENT_ACTION } from "../shared/client-failure-note.mjs";   // — the action, worded once; this surface names the mark itself
 import { stopReason } from "../shared/stop-reason.mjs";   // — one builder, four cancel sites
@@ -699,7 +699,7 @@ function deriveHitList(ctx, band) {
     // as a fallback so a provider that promotes the field is not silently ignored.
     const lines = (band?.enumerated ?? []).map((r) =>
       slimLine(r, r?.screen?.mark_transliteration ?? r?.mark_transliteration ?? null));
-    // ── CROWDS RIDE BESIDE THE LINES (Option A, ruled on tracker issue 95) ────────────────────────
+    // ── CROWDS RIDE BESIDE THE LINES (Option A, as ruled) ─────────────────────────────────────────
     //
     // A crowd is a zone that could NOT be enumerated. Without it on the list, `band_lookup` answering
     // from the list returns nothing for a crowded zone — and nothing is indistinguishable from
@@ -1568,6 +1568,10 @@ function attachProfile(ctx, job, { write = true } = {}) {
   // job-derived field in that subset would make it unrecomputable. The swept set is visible in the frozen
   // platforms; where the extras came from is run telemetry, logged below.
   ctx.profile.profileSha = profileShaOf(ctx.profile);   // T9 (K3)
+  // WHICH ORGANISATION'S GENERIC this run is filed under — the door stamps it on a Generic job, from the
+  // verified principal. Set AFTER the hash for the reason the provenance note above gives: it is job-
+  // derived, and `profileSha` must stay recomputable from profiles/<key>.json. Absent on a company's run.
+  if (typeof job?.tenant === "string" && job.tenant && ctx.profile.profileKey === "generic") ctx.profile.organisation = job.tenant;
   const tmp = `${sidecarPath}.tmp`;
   writeFileSync(tmp, JSON.stringify(ctx.profile, null, 2) + "\n");
   renameSync(tmp, sidecarPath);
@@ -2633,7 +2637,7 @@ const safeReadText = (p) => { try { return readFileSync(p, "utf8"); } catch { re
 // a named reason, never a silent skip.
 // ── — THE FLOOR DUTY, checked ────────────────────────────────────────────────────────────────
 //
-// The floors are placement-inquiry's one uncapped obligation and nothing verified them. The owner ruling
+// The floors are placement-inquiry's one uncapped obligation and nothing verified them. The ruling
 // of 2026-08-20 made the duty machine-checkable — placed, or named by record id with a one-line ground —
 // and this is the check that ruling ordered. The dictation that tells the seat to name the ids ships in
 // the same commit, so a run predating it reports its WHOLE floor unmet, correctly.
@@ -4653,7 +4657,7 @@ export function buildFailurePacket({ runId, agent, job = {}, failedStage, shortR
     // verbatim reason below this line names which.
     [REFUSAL_TERMINAL_KIND]: "Nothing failed. This deployment does not serve the search that was ordered, and said so before any work was done — the reason below names what is missing and what to change. Re-running it unchanged returns the same answer.",
   };
-  // ── A CAP DEATH IS A SUBSCRIPTION OUTCOME, NOT AN OUTAGE (tracker issue 103, the fourth ask) ──────
+  // ── A CAP DEATH IS A SUBSCRIPTION OUTCOME, NOT AN OUTAGE (the fourth ask) ─────────────────────────
   //
   // The weather lane carries BOTH an overloaded provider and a usage cap, and its one sentence
   // described the first: "stayed overloaded or unreachable … Re-trigger once the provider is healthy."
@@ -5885,7 +5889,7 @@ async function enforceCorrectionsReachFindings(ctx, P, pre, resume) {
   }
 }
 
-// (T3a, owner ruling 2026-08-26 — "Deliver always, with open points printed. The refusal on a blocking
+// (T3a, ruling 2026-08-26 — "Deliver always, with open points printed. The refusal on a blocking
 // review goes." That REVERSES T3, which had retired "delivered-with-open-questions" and deleted
 // the extra this comment used to be a tombstone for. Both decisions are the owner's; this is the standing
 // one. The open points are no longer a dispatch extra a seat writes up: `buildReviewerOpenPointsSection`
@@ -6034,13 +6038,20 @@ function refuteRegistryCheckExtra(ctx) {
  * the one report where it matters most — the same defect one level in that turned "AXIS Bank filed in
  * class 36" into "group Bank filed in class 36" on a report clearing AXIS.
  *
- * WHY THE FIELDS ARE THE RECORD'S OWN KEYS AND NOT `DEFAULT_VISIBLE_FIELDS.clearance`. That list's
- * clearance half names five fields nothing in this tree reads — `oneLiner`, `freedomToOperate`,
- * `thirdPartyRights`, `ownRights` and `batchOpener`, in either casing. Iterating it would open nothing
- * and report a clean result over text it never read, which is the absence-as-pass this block exists to
- * avoid. The keys below are the ones the record actually carries, and they are the surfaces the
- * READER-OWNED NOUNS directive already names as reaching the client. Reconciling that list is its own
- * change because it is shared with the knockout half, which IS real.
+ * WHY THE FIELDS ARE THE RECORD'S OWN KEYS, AND WHAT THAT USED TO SAY. This block could not use
+ * `DEFAULT_VISIBLE_FIELDS.clearance`, because that list named fields no record carried — iterating it
+ * would have opened nothing and reported a clean result over text it never read, which is the
+ * absence-as-pass this block exists to avoid.
+ *
+ * That list is repaired now: every entry is a path that resolves against a delivered record, and an arm
+ * resolves each one. The keys below are still written out rather than read from it, because this block
+ * needs the `where` label it puts in front of each hit and the list carries paths and not labels. The
+ * two agree on the surfaces, and the arm that resolves the list is what keeps that true.
+ *
+ * The old wording here also stated the defect slightly wrong, and said so about the field it was most
+ * likely to mislead on: `thirdPartyRights` was called dead "in either casing" when the record carries
+ * `four_answers.third_party_rights`, in fourteen files. Checking a name in one casing and reporting it
+ * absent in both is the same error one level down from the one this paragraph is about.
  *
  * An absent or malformed findings.json yields no block, and the composer records the id as not built —
  * so "nothing to say" and "could not look" are told apart on the dispatch receipt rather than inferred.
@@ -6249,7 +6260,7 @@ function sentinel(runDir, name, obj) {
 }
 
 /**
- * Settle every queued what-if BEFORE the run dir moves into the archive — tracker issue 240.
+ * Settle every queued what-if BEFORE the run dir moves into the archive.
  *
  * A queued job lives under the run directory, and the worker enumerates candidates with `liveRunDirs`,
  * which skips `archive` outright. So archiving carried a pending job out of the worker's reach: not
@@ -7044,7 +7055,7 @@ export function injectZhScopeCoverage(P, runDir, note, opts = {}) {   // @intern
  *  returns nothing the moment `laneRan` is true, so a `full`-configured lane that ran candidates only
  *  fell through every disclosure this pipeline had.
  *
- *  OWNER RULING (2026-08-17), and it decides the shape rather than just authorising the work: "if we
+ *  RULING (2026-08-17), and it decides the shape rather than just authorising the work: "if we
  *  can't run deep dive on serpAPI we need to flag it" — FLAG, NOT GATE. So nothing here changes what a
  *  run executes or what it retrieves; it changes what the delivered document admits. `coverage-limited`
  *  is the state for exactly that: a disclosed limit, never a verdict clamp.
@@ -7230,7 +7241,7 @@ export function fullProseOrdinals(findings) {
 // ADVISORY_KINDS member could never reach a client document at all. The 2026-07-16 comment described the
 // behaviour it shipped with and became stale prose sitting next to code that contradicted it.
 //
-// Owner ruling 2026-08-19 (relayed), on a renewal-deadline example: it renders. That intent is the
+// Ruling 2026-08-19 (relayed), on a renewal-deadline example: it renders. That intent is the
 // ruled behaviour. The tag is REQUIRED, not decoration — `advisoryLine` interpolates ADVISORY_TAG[a.kind]
 // directly, so a kind that passes the filter without an entry here renders "- **undefined** …" into a
 // client document. Whoever adds a fifth kind adds it in both places, and render.mjs needs the matching
@@ -7327,8 +7338,8 @@ export function buildOnlyYouSection(actions, findings, { nowMs = Date.now(), wit
   // Terminal punctuation on the ask BEFORE the subject join. This was written to work around a cut —
   // actYouConditions ended its bound line at the first '.' or ':' before whitespace, and the subject's
   // own "(re:" qualified, so a period-less ask (the synthesis prompt demands one sentence but nothing
-  // enforces terminal punctuation) delivered as a mangled "…terms (re". THAT CUT IS GONE (owner
-  // ruling 2026-08-10): the conditions box now renders the ask and its subject whole. The punctuation
+  // enforces terminal punctuation) delivered as a mangled "…terms (re". THAT CUT IS GONE (ruling
+  // 2026-08-10): the conditions box now renders the ask and its subject whole. The punctuation
   // stays because it was always the right output — "Instruct counsel on the joined-script forms (re: X)"
   // reads as one run-on sentence, and the period is what separates the ask from the driver's own note.
   // Asks with no subject are untouched.
@@ -7419,7 +7430,7 @@ export function buildOnlyYouSection(actions, findings, { nowMs = Date.now(), wit
 
 // ── T3a — THE REVIEWER'S OPEN POINTS, CODE-BUILT FROM THE REVIEW ────────────────────────────────────
 //
-// Owner ruling 2026-08-26, verbatim: "Deliver always, with open points printed. The refusal on a
+// Ruling 2026-08-26, verbatim: "Deliver always, with open points printed. The refusal on a
 // blocking review goes." That REVERSES T3, which retired "delivered-with-open-questions" and
 // is itself recorded as an owner-approved decision — both are his, and this is the standing one.
 //
@@ -8450,7 +8461,7 @@ async function pipelineInner(job, opts = {}) {
   // and carries the measured reason it cannot be queued (queueing it would orphan the mint the last
   // flush's own pass makes). That list is censused by an arm, so this sentence cannot go stale
   // silently again — it read "the ONLY path" while one mechanism had always fired its own pass, and an
-  // invariant with an undeclared violation teaches the next reader the wrong rule (tracker issue 116).
+  // invariant with an undeclared violation teaches the next reader the wrong rule.
   // Everything else: escalation/envelope/screen-gate keep
   // their unit-level work but MINT durable queue items instead of firing their own opus digest pass, and
   // the queue settles in ONE consolidated flush at the frame-reopen seam (pre-synthesis), plus at most
@@ -8603,6 +8614,25 @@ async function pipelineInner(job, opts = {}) {
       geography: job.geography ?? null,
     }, null, 2) + "\n");
   } catch (e) { note(`instructed-scope write failed (non-fatal): ${e.message}`); }
+  // THE STORED DEFAULTS THE ENGINE CANNOT SEARCH — recorded by the run, not only by the plan preview.
+  //
+  // `defaultTerritoryState` is the ONE producer of this reading (effective-scope.mjs) and it is CALLED
+  // here rather than re-derived: the run's own territory ladder (`resolveTerritories`) passes an
+  // unrecognised account default straight through, so before this the only surfaces that named one were
+  // the plan response and the profile screen — both intake-side. A firm whose stored default is
+  // misspelled got a narrower search than the configuration says, and no run artifact said so.
+  // Written for EVERY run, empty list included: an empty array is the asserted zero, and a reader who
+  // only ever sees this file on the runs that had a bad entry cannot tell it from a run nothing checked.
+  try {
+    const dts = defaultTerritoryState(ctx.profile);
+    // two records of one fact, so each has its own try: a fault in one must not take the other
+    try { if (dts.unrecognized.length) runLog(run.runDir, { event: "default-territory-unrecognized", count: dts.unrecognized.length, entries: dts.unrecognized }); } catch (e) { note(`default-territory-unrecognized log failed (non-fatal): ${e.message}`); }
+    writeFileSync(P.defaultTerritories, JSON.stringify({
+      profileKey: ctx.profile?.profileKey ?? null,
+      searchable: dts.kept,
+      unrecognized: dts.unrecognized,
+    }, null, 2) + "\n");
+  } catch (e) { note(`default-territories write failed (non-fatal): ${e.message}`); }
   // Change B5 — unknown-customer state + the late-bind consumer. The intake gate sets
   // job.customerUnknown when the applicant is neither stated nor forwarder-implied; the forwarding agent
   // may later drop customer-bind.json into this run dir when a thread reply names the applicant (B5b).
@@ -12010,7 +12040,7 @@ async function pipelineInner(job, opts = {}) {
     // an inventory that cannot be read hands the stage nothing, and the dictation then says nothing about
     // sources rather than asserting a readiness nobody measured.
     try {
-      // COMPOSED BY THE MODULE THAT READS IT (tracker issue 173). This mapping used to be inline here
+      // COMPOSED BY THE MODULE THAT READS IT. This mapping used to be inline here
       // and rebuilt by hand in an arm — two authors for one shape, and the arm's copy went stale the
       // moment this one gained a field, while still passing. `caseLawSourceRows` is now the only place
       // it is written, and it carries `checked` so an UNREADABLE credential reaches the composer as a
@@ -12472,7 +12502,7 @@ async function pipelineInner(job, opts = {}) {
 
     // ── — THE TERMINAL GUARDS DELIVER AND CLAMP; THEY DO NOT WITHHOLD ───────────
     //
-    // Owner ruling, 2026-08-27, verbatim intent: **reports always ship**. When a terminal guard finds
+    // Ruling, 2026-08-27, verbatim intent: **reports always ship**. When a terminal guard finds
     // the report incomplete at delivery, the engine sends it with the gap patched conservatively and
     // the defect named in the run record. It never withholds.
     //
@@ -12543,7 +12573,7 @@ async function pipelineInner(job, opts = {}) {
     // not an oversight: if the unanswerable count is ever the large one, it wants its own issue against
     // the band rather than a wider floor here.
     //
-    // NO REPAIR RUNG, deliberately and on a measurement (owner ruling relayed 2026-08-27). Every
+    // NO REPAIR RUNG, deliberately and on a measurement (ruling relayed 2026-08-27). Every
     // registered repair composer belongs to another stage; placement has none, and building one is a
     // larger piece of work than this floor. The blast radius said it could wait: on the day this was
     // written today's run discharged all 60 of its floors, and the only two runs with undischarged rows
@@ -12556,7 +12586,7 @@ async function pipelineInner(job, opts = {}) {
     // argument was that nothing could then reach delivery unaccounted. The corrective pass is the state
     // that enumeration missed: `prepareDeclinationSpec` runs again before it over a surface that can
     // have grown, so it is ordered against a LARGER owed set; if that call is refused,
-    // `rollbackCorrectivePass` restores the pre-corrective findings and — by T3b's owner ruling,
+    // `rollbackCorrectivePass` restores the pre-corrective findings and — by T3b's ruling,
     // deliberately — the run DELIVERS. What ships then satisfied the OLD owed set, and no acceptance
     // boundary ever saw a call about the records added since, because the only call ordered against them
     // was the one that was refused.
@@ -12910,7 +12940,7 @@ async function pipelineInner(job, opts = {}) {
     try { writeVerdictSidecar(); }
     catch (e) { throw new StageFailure("verdict", `verdict sidecar write failed (the single label authority): ${String(e.message).slice(0, 120)}`); }
 
-    // T3a, owner ruling 2026-08-26 — "Deliver always, with open points printed. The refusal on a blocking
+    // T3a, ruling 2026-08-26 — "Deliver always, with open points printed. The refusal on a blocking
     // review goes." This REVERSES T3 (H3/H5), whose flip to fail-on-BLOCKING is itself recorded
     // itself an owner-approved decision. Both are his; this is the standing one, and the
     // history is kept here rather than deleted because a reader who finds only one of them will conclude
@@ -12979,7 +13009,7 @@ async function pipelineInner(job, opts = {}) {
         }
       }
       if (verdict === "BLOCKING") {
-        // ── T3a — THE RUN DELIVERS. Owner ruling 2026-08-26, verbatim: "Deliver always, with open
+        // ── T3a — THE RUN DELIVERS. Ruling 2026-08-26, verbatim: "Deliver always, with open
         // points printed. The refusal on a blocking review goes." ──────────────────────────────────
         //
         // What stood here threw, and its reasoning was T3: "a report the reviewer will not
@@ -13390,7 +13420,7 @@ async function pipelineInner(job, opts = {}) {
           note(`recall: ${silent.lost.length} position(s) the digest ended as FINDINGS reached no client `
             + `surface and no step said why — ${silent.lost.map((l) => `${l.mark ?? l.uri} (${l.reason})`).join("; ")}`);
         }
-        // ── AND THE STATED CASE, WHICH IS THE ONE THAT REACHED A CLIENT (tracker issue 248) ────────
+        // ── AND THE STATED CASE, WHICH IS THE ONE THAT REACHED A CLIENT ────────────────────────────
         //
         // Same inputs, same seam, same best-effort contract — a second call rather than a widened first
         // one, because the sibling's population boundary is deliberate and correct. It covers a
@@ -13685,7 +13715,7 @@ async function pipelineInner(job, opts = {}) {
                 const askApplied = applyAskClosure(runAsks, acc.ask, fileTexts, { ts: askTs });
                 runAsks = askApplied.asks;
                 for (const u of askApplied.unverified) runLog(run.runDir, { event: "ask-closure-unverified", ...u });
-                // Option A (tracker issue 246): a recall ask whose mark is not in the delivered findings
+                // Option A: a recall ask whose mark is not in the delivered findings
                 // did NOT close. Each one is a mark the run found and the client was not shown, so it is
                 // recorded by name rather than left to be inferred from an ask that merely stayed open.
                 // ✕ NOT written into findings.json here. See the sidecar's own note: a row appended after
@@ -13695,7 +13725,7 @@ async function pipelineInner(job, opts = {}) {
                 if (askApplied.carryIntoFindings?.length)
                   writeFileSync(driverDir(run.runDir, "marks-owed-a-finding.json"),
                     JSON.stringify({
-                      _provenance: "recall asks that could not close because the mark they found is absent from findings.json — owner ruling 2026-09-07, tracker issue 246 Option A, worded about the MARK",
+                      _provenance: "recall asks that could not close because the mark they found is absent from findings.json — owner ruling 2026-09-07, Option A, worded about the MARK",
                       _notWritten: "these are NOT appended to findings.json: a finding carries a band, a net line and a legal position, and a row minted here would carry none of them. The repair belongs where the findings are authored.",
                       count: askApplied.carryIntoFindings.length,
                       marks: askApplied.carryIntoFindings,
@@ -14647,6 +14677,13 @@ async function pipelineInner(job, opts = {}) {
       published = JSON.parse(readFileSync(join(run.runDir, ".published"), "utf8"));
       note(`publish skip — already published → ${published.url}`);
     } else {
+      // THE LAST READ OF THE STOP FLAG, and it sits HERE rather than above the branch: a run that has
+      // already published has delivered, and refusing at that point would record a delivered run as
+      // cancelled — the same defect pointed the other way.
+      assertNotCancelledBeforePublish(run.runDir, "clearance");
+      // Same fact, same moment, same words as the knockout lane: past this line a stop cannot prevent
+      // delivery, and the screen is told so rather than working it out.
+      writeRunStatus(ctx, { stoppable: false });
       published = await publishReport({
         runId: `${run.slug}-${run.date}-${run.codename}`, codename: run.codename,
         reportMd: P.report, auditMd: P.audit, findingsJson: P.findings, poolRoot: config.poolRoot, poolUrl: config.poolUrl,
@@ -14659,6 +14696,20 @@ async function pipelineInner(job, opts = {}) {
       });
       sentinel(run.runDir, ".published", { runId: published.runId, url: published.url, counts: published.counts,
         clientGate: published.clientGate });   // machine-QC record (observability) — decides nothing
+      // WHAT THE TWO GATES EACH SAID, in the run's own log, under names that say whose they are.
+      // `.published` carries `clientGate.released` beside `counts.gateViolations`, which are the verdicts
+      // of DIFFERENT gates: the first is the client-export refusal (evaluateClientGate), the second is the
+      // audit workbook's own build check (validateAudit), which is advisory by design and decides nothing
+      // about the release. Read as one gate they contradict each other — released, with a list of
+      // violations beside it — and a delivered run shipped looking exactly like that. Named separately
+      // here, with the advisory COUNT and the absences the gate did not close on, so the log a person
+      // reads after a run answers "what did the checks say" without opening the sentinel and knowing
+      // which field belongs to which gate.
+      runLog(run.runDir, { event: "publish-gates",
+        clientExport: published.clientGate?.released === false ? "closed" : "released",
+        clientExportReasons: published.clientGate?.reasons ?? [],
+        releasedDespiteAbsentInputs: (published.clientGate?.notClosing ?? []).map((n) => n.input),
+        auditWorkbookAdvisory: published.counts?.gateViolations?.length ?? 0 });
       note(`published → ${published.url}`);
     }
     // Lifecycle honesty (charter P1 §4): publish is CODE, not a stage() call, so nothing ever advanced the

package/driver/plain-register.mjs

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 //
-// THE TWO-REGISTER RULE, AS THE REVIEWER READS IT — tracker issue 333.
+// THE TWO-REGISTER RULE, AS THE REVIEWER READS IT.
 //
 // The report goes to a lawyer who layers advice on top, and that lawyer's client reads the same page.
 // The band, the summary, the basis line and the one-liners are the whole product for the second reader,
@@ -127,8 +127,82 @@ export function plainRegisterFlags(text, about = {}) {
 /**
  * The fields a reader meets before opening anything. Named here rather than at each call site so the
  * two products answer to one list — the knockout and the clearance drifted apart once already.
+ *
+ * EVERY ENTRY IS A PATH INTO A DELIVERED RECORD, and an arm resolves each one against the runs under
+ * `demo/`. That is the whole repair. The clearance half named eight fields of which six did not exist
+ * in any casing, and the reason nobody noticed is that a list of names is only ever read BY a person:
+ * `thirdPartyRights` beside a record carrying `four_answers.third_party_rights` reads as correct, and a
+ * loop over it opens nothing and reports a clean result over text it never read. A path either resolves
+ * or the arm says so.
+ *
+ * THE PATHS ARE THE SURFACES THE LIVE CHECK ALREADY READS. `plainRegisterExtra` in pipeline.mjs walks
+ * the clearance record's own keys and had a comment explaining that it could not use this list. The list
+ * is now what that walk reads, plus the four answers, which render on the report as prose and were
+ * missing from both. One definition, and the walk is the thing that made it checkable.
+ *
+ * `[]` MARKS A LIST and `*` an object's own values: `findings[].net` is one sentence per finding, and
+ * `four_answers.*.read` one per answer — that register is keyed by answer name and is not an array.
+ *
+ * WHAT CAME OFF, AND WHY EACH. `oneLiner` and `freedomToOperate` exist in no record in either casing and
+ * name no surface anybody could point at — they are gone rather than renamed, because inventing a target
+ * for them would be a guess in the one place a guess reads as a fact. `ownRights` resolves to
+ * `findings[].own_rights.source`, which is a record URI and not prose: a citation has no register, and
+ * running a plain-words check over one would flag the profession's vocabulary inside a machine
+ * identifier. `batchOpener` was in the KNOCKOUT half and is dead in both casings there.
+ *
+ * KNOWN INCOMPLETE, DELIBERATELY. `marks[].registerReads[].read` is walked as knockout-visible prose by
+ * `knockoutVisibleProse` and is not on the knockout list here. Adding it would widen what the reviewing
+ * pass rewrites on a delivered report, which is a change to what a client receives and not this repair's
+ * to make. The acceptance here is that every entry names something real, not that the list is complete;
+ * the completeness question is recorded on the issue rather than settled in passing.
  */
 export const DEFAULT_VISIBLE_FIELDS = Object.freeze({
-  knockout: ["summary", "batchOpener", "basis", "net", "factors", "counterFactors", "mitigation", "standardCaveats", "reviewerNotes"],
-  clearance: ["summary", "oneLiner", "registrability", "thirdPartyRights", "ownRights", "freedomToOperate", "reviewerNotes", "coverage"],
+  knockout: [
+    "batch.executiveSummary", "batch.standardCaveats[]",
+    "marks[].basis", "marks[].factors[]", "marks[].counterFactors[]", "marks[].mitigation",
+    "marks[].purpleNotes[]", "marks[].findings[].net",
+  ],
+  clearance: [
+    "mark_assessment.distinctiveness", "mark_assessment.connotation",
+    "four_answers.*.read", "findings[].net", "coverage[].note", "actions[].text",
+  ],
 });
+
+/**
+ * Every string a path in `DEFAULT_VISIBLE_FIELDS` reaches in one delivered record.
+ *
+ * THIS IS WHAT MAKES THE LIST CHECKABLE, and its absence is why six dead names sat there for months. A
+ * list of bare names can only be read by a person; a path can be resolved, so an arm can say which
+ * entries open nothing.
+ *
+ * `[]` walks a list, `*` walks an object's own values — `four_answers` is keyed by answer name rather
+ * than being an array, and a path that assumed a list there resolved to nothing while looking right.
+ *
+ * TWO FIELDS ARRIVE AS EITHER A STRING OR AN OBJECT, and this reads both because the code that renders
+ * them does. A reviewer's note is `p?.text ?? p` in `knockoutVisibleProse`; an assessment field is
+ * `typeof v === "string" ? v : v?.read` where the structured form carries typed rows beside the prose.
+ * Resolving only the string form would have reported both as dead on a record that carries them, which
+ * is the same absence-dressed-as-a-fact this repair exists to remove — measured, on the delivered runs.
+ *
+ * A missing key yields NOTHING rather than throwing. An absent optional field is a fact about that
+ * record, and the arm decides what an absence means across several of them.
+ */
+export function resolveVisiblePath(record, path) {
+  let nodes = [record];
+  for (const seg of String(path).split(".")) {
+    const list = seg.endsWith("[]");
+    const key = list ? seg.slice(0, -2) : seg;
+    const next = [];
+    for (const n of nodes) {
+      if (n == null || typeof n !== "object") continue;
+      if (key === "*") { next.push(...Object.values(n)); continue; }
+      const v = key ? n[key] : n;
+      if (v == null) continue;
+      if (list && Array.isArray(v)) next.push(...v); else next.push(v);
+    }
+    nodes = next;
+  }
+  return nodes
+    .map((n) => (typeof n === "string" ? n : (typeof n?.text === "string" ? n.text : n?.read)))
+    .filter((s) => typeof s === "string" && s.trim());
+}