clearotron 0.2.4 → 0.3.0-beta.1

package/driver/portal-upstream.mjs

@@ -21,9 +21,11 @@
 //
 // Three rules follow, and each is enforced here rather than trusted to a caller:
 //
-//   1. THE ACCOUNT COMES FROM THE PRINCIPAL, NEVER FROM THE PATH OR THE BODY. A client cannot name an
-//      account at all — theirs is substituted. Staff must name one, and it is checked against the
-//      roster. There is no code path where a body field or a URL segment picks the tenant.
+//   1. THE ACCOUNT COMES FROM THE PRINCIPAL, NEVER FROM THE PATH OR THE BODY. A named account must be
+//      inside the person's access, and a person with one company has it substituted. A person who sees
+//      everything must name one, and whether it EXISTS is answered downstream: the profile service 404s
+//      an unknown key and this wall passes that 404 through unchanged. There is no code path where a
+//      body field or a URL segment picks the tenant.
 //
 //   2. A FOREIGN ACCOUNT IS 404, byte-identical to a nonexistent one. Never 403. A 403 confirms the
 //      account exists, which is exactly the fact a competitor would be probing for.
@@ -40,7 +42,7 @@
 //      the archived ones. Tenancy is untouched: it lives in resolveAccount and rule 2, as it always did.
 
 import { KNOWN_PROFILE_KEYS, PROJECT_KEYS } from "./profiles.mjs";
-import { assertPrincipal, PortalDeny } from "./portal-access.mjs";
+import { assertPrincipal, PortalDeny, seesEverything, mayManage } from "./portal-access.mjs";
 
 /**
  * The five fields the UI must never write.
@@ -172,11 +174,15 @@ export function frameworkView(framework, { staff = false } = {}) {
  * account — the same shape portal-service already turns into a 404 body — so a caller cannot forget to
  * check a return value and proceed with an unresolved account.
  */
-export function resolveAccount(principal, requested) {
-  // assertPrincipal is the existing chokepoint: it forces a client to their own grant and 404s a
-  // foreign one. Reusing it means tenancy has ONE implementation, not two that must agree.
-  const account = assertPrincipal(principal, { account: requested ?? null });
-  if (!account) throw new PortalDeny(400, "name an account — staff must pick who they act for");
+export function resolveAccount(principal, requested, gates = {}) {
+  // assertPrincipal is the existing chokepoint: it holds a person to their own access and 404s a
+  // foreign account. Reusing it means tenancy has ONE implementation, not two that must agree. `gates`
+  // carries the permission a write needs — `manage` for settings, `run` for saved searches.
+  const account = assertPrincipal(principal, { account: requested ?? null, ...gates });
+  if (!account) throw new PortalDeny(400, "name an account (?account=)");
+  // Generic's settings are one file for the whole install, whichever organisation's Generic is open, so
+  // changing them is a change at the top of the tree.
+  if (account === "generic" && gates.manage && !seesEverything(principal)) throw new PortalDeny(404, "not found");
   return account;
 }
 
@@ -193,7 +199,7 @@ export function resolveAccount(principal, requested) {
  * there, and this is the channel that respects it. What must never happen is the reverse: a body field
  * that looks like an author and is quietly trusted by some future reader.
  */
-export function makeUpstream({ callUpstream, callRecipes = null, roster = async () => [] }) {
+export function makeUpstream({ callUpstream, callRecipes = null, recipesOff = null, roster = async () => [], fileCompany = null }) {
   const call = async (method, path, body, identity) => {
     const r = await callUpstream(method, path, body, identity);
     // Upstream 404s (unknown profile) and ours (not yours) are deliberately the same answer.
@@ -204,7 +210,20 @@ export function makeUpstream({ callUpstream, callRecipes = null, roster = async
   // owns a different store and a different validator. Absent ⇒ every saved-search route answers 404,
   // which is what a deployment with no recipe store configured should say: the feature is not here.
   const callRec = async (method, path, body, identity) => {
-    if (!callRecipes) return { status: 404, json: { error: "not_found" } };
+    // A CONFIGURED-OFF FEATURE IS NOT A MISSING PAGE. Both answer 404 — the route genuinely is not
+    // there — but a bare `not_found` is what let the screen say "try again shortly" about a permanent
+    // state the portal had already diagnosed at boot. The code names it and the detail carries the
+    // diagnosis, so the surface can say what must change instead of advising a retry that cannot work.
+    //
+    // THE DETAIL IS FOR A PERSON WITH ACCESS TO EVERYTHING, as a company's file paths are. It names
+    // environment variables and filesystem paths on the server, and this screen is company-scoped — a
+    // person holding one company can reach it. The CODE travels to everyone, because "this installation
+    // does not have saved searches" is true and useful for them and gives away nothing; only the
+    // sentence saying which variable to change is held back.
+    if (!callRecipes) {
+      return { status: 404, json: { error: recipesOff?.code ?? "not_found",
+        ...(seesEverything(identity) && recipesOff?.detail ? { detail: recipesOff.detail } : {}) } };
+    }
     const r = await callRecipes(method, path, body, identity);
     if (r.status === 404) return { status: 404, json: { error: "not_found" } };
     return r;
@@ -223,7 +242,7 @@ export function makeUpstream({ callUpstream, callRecipes = null, roster = async
       const r = await call("GET", `/profiles/${encodeURIComponent(account)}`, undefined, principal);
       if (r.status !== 200) return r;
       const p = r.json?.profile ?? r.json ?? {};
-      const staff = principal?.role === "staff";
+      const staff = seesEverything(principal);
       return { status: 200, json: {
         account,
         profile: serializeProfile(p),
@@ -242,7 +261,8 @@ export function makeUpstream({ callUpstream, callRecipes = null, roster = async
      */
     async writeProfile(principal, requested, action, body) {
       if (action !== "validate" && action !== "save") return { status: 404, json: { error: "not_found" } };
-      const account = resolveAccount(principal, requested);
+      // A company's settings are Manage's to change.
+      const account = resolveAccount(principal, requested, { manage: true });
       const profile = stripCodeOwned(body?.profile);
       if (!profile || typeof profile !== "object" || Array.isArray(profile))
         return { status: 400, json: { error: "a profile object is required" } };
@@ -284,7 +304,8 @@ export function makeUpstream({ callUpstream, callRecipes = null, roster = async
 
     async writeProject(principal, requested, project, action, body) {
       if (action !== "validate" && action !== "save") return { status: 404, json: { error: "not_found" } };
-      const account = resolveAccount(principal, requested);
+      // A project sits in the tree under its company, so adding or changing one is Manage's.
+      const account = resolveAccount(principal, requested, { manage: true });
       if (!isSlug(project)) return { status: 404, json: { error: "not_found" } };
       // A project overlay may only carry PROJECT_KEYS. Customer-only keys are rejected upstream with a
       // real 400, but the same stripping discipline applies one level down: identity and rating
@@ -335,7 +356,8 @@ export function makeUpstream({ callUpstream, callRecipes = null, roster = async
      */
     async writeSearch(principal, requested, slug, action, body) {
       if (action !== "validate" && action !== "save") return { status: 404, json: { error: "not_found" } };
-      const account = resolveAccount(principal, requested);
+      // A saved search is how a clearance is ordered again, so it is Run's.
+      const account = resolveAccount(principal, requested, { run: true });
       if (!isSlug(slug)) return { status: 404, json: { error: "not_found" } };
       const recipe = body?.recipe;
       if (!recipe || typeof recipe !== "object" || Array.isArray(recipe))
@@ -346,14 +368,80 @@ export function makeUpstream({ callUpstream, callRecipes = null, roster = async
       }, principal);
     },
 
-    /** Staff-only: the customer roster, for the account picker. Clients never reach this. */
+    /** Every company on the install, for the switcher of a person who sees everything. Nobody else reaches this. */
     async listRoster(principal) {
-      if (principal?.role !== "staff") return { status: 404, json: { error: "not_found" } };
+      if (!seesEverything(principal)) return { status: 404, json: { error: "not_found" } };
       return { status: 200, json: { customers: await roster() } };
     },
+
+    /**
+     * Create a company. The ONE method here that does not resolve an account, because the account is
+     * what it is making.
+     *
+     * THE RULE THIS LOOKS LIKE IT BREAKS. Rule 1 at the top of this file says the account comes from
+     * the principal and never from the path or the body — and a create's key IS a body field. The rule
+     * is about REACHING an account: substituting the caller's own so nobody can name someone else's. A
+     * create names no existing account, so there is nothing to substitute and nothing to reach. What
+     * takes its place is the permission test on the line below, and the roster check further upstream,
+     * which refuses a key that already exists rather than opening it.
+     *
+     * That makes this the second account-less method, after the roster, and it is gated the same way
+     * and for the same reason. The browser's own Manage check decides whether the control is drawn; it
+     * is not a boundary and cannot be one. This line is the boundary.
+     *
+     * 404 rather than 403, per rule 2: a refusal that distinguishes "you may not" from "there is no
+     * such endpoint" tells a stranger which endpoints exist.
+     *
+     * THE FIELDS ARE NAMED, not forwarded. Two reasons, and the second is the load-bearing one. A body
+     * passed through whole hands the upstream route whatever a future caller invents. And
+     * `frameworkPath` is a real input on that route — so forwarding the body would put a framework
+     * chooser one fetch away from any browser, which the design rejected outright: no browser path sets
+     * a framework, the create resolves the house default and the receipt names it. Leaving the field
+     * out here is what makes that true by construction rather than by the screen's good manners.
+     */
+    async createCompany(principal, body) {
+      if (!mayManage(principal)) return { status: 404, json: { error: "not_found" } };
+      if (!body || typeof body !== "object" || Array.isArray(body))
+        return { status: 400, json: { error: "a company is required" } };
+      // WHICH ORGANISATION IT BELONGS TO. A company belongs to exactly one, and the person creating it
+      // must hold that organisation whole: Manage on one company cannot add a sibling beside it. Named by
+      // `tenant`, or implied when the person holds exactly one organisation. A person who sees everything
+      // on an install with no organisation yet creates it under none, and sees it because they see
+      // everything.
+      const orgs = principal.genericOrgs ?? [];
+      const named = typeof body.tenant === "string" && body.tenant.trim() ? body.tenant.trim() : null;
+      let org = null;
+      if (named != null) {
+        if (!orgs.includes(named)) return { status: 404, json: { error: "not_found" } };
+        org = named;
+      } else if (orgs.length === 1) org = orgs[0];
+      else if (orgs.length > 1) return { status: 400, json: { error: "name the organisation this company belongs to (tenant)" } };
+      else if (!seesEverything(principal)) return { status: 404, json: { error: "not_found" } };
+      const draft = {};
+      for (const k of CREATABLE_FIELDS) if (body[k] !== undefined) draft[k] = body[k];
+      const r = await call("POST", "/profiles", draft, principal);
+      if (r.status !== 201 || org == null || !fileCompany) return r;
+      const key = r.json?.key ?? r.json?.profile?.key ?? draft.key;
+      try { await fileCompany({ tenant: org, account: key }); }
+      catch (e) {
+        return { status: 500, json: { error: `The company was created, but it could not be filed under its organisation (${String(e?.message ?? e).slice(0, 200)}). A person with access to everything can see it and file it.`, key } };
+      }
+      return { ...r, json: { ...r.json, tenant: org } };
+    },
   };
 }
 
+/**
+ * What a browser may state when creating a company.
+ *
+ * Everything else the profile carries has a default the create path resolves, or is code-owned and set
+ * there. `frameworkPath` is deliberately absent — see `createCompany`.
+ */
+export const CREATABLE_FIELDS = Object.freeze([
+  "name", "key", "industry", "matchDomains", "platforms",
+  "selfExclusionOwners", "defaultClasses", "defaultJurisdictions",
+]);
+
 /**
  * A project key must be a plain slug.
  *

package/driver/predelivery-lint.mjs

@@ -33,6 +33,7 @@ import { findRegistryArithmeticIssues, findRegistryViolations, splitBlocks } fro
 import { CLIENT_TIER_BY_COMPOSITE, joinFindingToBlock, parseBlockOrd, worstLiveBand, NO_RATED_CONFLICTS, deriveActionConditions, isUnconditionalProceed, verdictStance, joinAskToAnswer, projectAssessmentField, POSITION_REQUIRED_DISPOSITIONS, OFF_FIELD_GROUNDS, FINDINGS_SCHEMA_VERSION, netChainMarkers, STATEMENT_CLAUSE_MAX } from "./findings-model.mjs";
 import { normalizeBand } from "./framework.mjs";
 import { knockoutNoteView, REQUEST_NOTE_WORDS, REQUEST_SUBJECT_WORDS } from "./findings-model.mjs";   // one reader for where a note prints
+import { isEngineAppendedCaveat } from "./verify-knockout.mjs";   // ONE derivation for "the engine appended this caveat, not a seat"
 
 // V4-3: diacritics FOLD (NFD strip) instead of being deleted — "Televisión" must normalize to
 // "television" (deletion made it "televisin", so a diacritic mention never matched its introduction).
@@ -700,7 +701,7 @@ export function competitorClaimChecks({ text, ownerScreen, recordsByUri, markVoc
   return failures.length ? failures : [check("competitor-claim-verification", "registry", surface, true, "")];
 }
 
-// ── COVERAGE CLAIMS IN PROSE vs WHAT THE RUN ACTUALLY SEARCHED (tracker issue 134) ──────────────────
+// ── COVERAGE CLAIMS IN PROSE vs WHAT THE RUN ACTUALLY SEARCHED ──────────────────────────────────────
 //
 // THE DEFECT. `coverage_line:` is code-stamped from scope-facts.json; the narrative is model-written
 // prose. Nothing bound them to one searched-territory set. On one recorded run the masthead read
@@ -2354,7 +2355,7 @@ const knockoutSurfaces = (findings) => {
   return { report: report.filter(Boolean).join("\n\n"), working: working.filter(Boolean).join("\n\n") };
 };
 
-// ── PLAIN LANGUAGE ON WHAT A READER SEES FIRST (tracker issue 333) ─────────────────────────────────
+// ── PLAIN LANGUAGE ON WHAT A READER SEES FIRST ─────────────────────────────────────────────────────
 //
 // The report goes to a lawyer who layers advice on top, and that lawyer's client reads the same page.
 // The band, the summary, the basis line and the one-liners are the whole product for the second reader,
@@ -2362,7 +2363,7 @@ const knockoutSurfaces = (findings) => {
 // comparison", "subsisting European rights", "the confusion comparison meets on every limb".
 //
 // THE PARTITION IS DEFAULT-VISIBLE vs FOLDED, WHICH IS NOT THE report/working SPLIT ABOVE. Since the
-// page folds each card's argument (tracker issue 331 A.3), a finding's `basis` is now behind a click,
+// page folds each card's argument, a finding's `basis` is now behind a click,
 // and 333 rule 2 allows the lawyer's vocabulary there where a plain word would lose precision. The same
 // is true of the long `assessment`. So this check reads exactly the fields the renderer DRAWS without
 // a click, and reads nothing else — a check whose population is "the report" would flag the very
@@ -2399,22 +2400,39 @@ const knockoutSurfaces = (findings) => {
 /**
  * The fields a reader of the knockout meets before opening anything, named one by one rather than
  * derived, so adding a field to the page is a deliberate addition here too.
+ *
+ * EVERY ENTRY CARRIES A TYPED ADDRESS as well as its human label, and the reviewing pass binds its
+ * rewrites to that address rather than to the label. The label is prose for a person; two marks whose
+ * names differ only in case produce two different labels for one field, and a rewrite matched on prose
+ * would land on whichever the seat quoted. `at` is {field, mark?, index?, ordinal?} and is what the
+ * merge joins on — the knockout has no correction cycle to inherit a join key from, so this lane
+ * defines its own rather than resolving prose after the fact.
+ *
+ * `at.engineOwned` marks the sentences the ENGINE appends, not a seat: the survivor-boundary note and
+ * the skipped-capability note. They stay in the walk because the internal lint should still read
+ * them — an over-long engine caveat is a real defect, for whoever edits the code that emits it. They
+ * are not offered to the reviewing pass: a rewrite there would either break `SURVIVOR_BOUNDARY_RE` at
+ * delivery or append a second copy of the note, and both are silent. `isEngineAppendedCaveat` is the
+ * derivation that already tells them apart; this does not write a second one.
  */
-function knockoutVisibleProse(findings) {
+export function knockoutVisibleProse(findings) {
   const out = [];
-  const add = (where, v) => { const t = String(v ?? "").trim(); if (t) out.push({ where, text: t }); };
-  add("the batch summary", findings?.batch?.executiveSummary);
-  for (const c of findings?.batch?.standardCaveats ?? []) add("a standing caveat", c);
+  const add = (where, v, at) => { const t = String(v ?? "").trim(); if (t) out.push({ where, text: t, at }); };
+  add("the batch summary", findings?.batch?.executiveSummary, { field: "batch.executiveSummary" });
+  (findings?.batch?.standardCaveats ?? []).forEach((c, i) =>
+    add("a standing caveat", c, { field: "batch.standardCaveats", index: i, engineOwned: isEngineAppendedCaveat(c) }));
   for (const m of findings?.marks ?? []) {
     const n = String(m?.name ?? "a mark");
-    add(`${n}'s basis line`, m?.basis);
-    for (const f of m?.factors ?? []) add(`${n}'s "why this band" list`, f);
-    for (const f of m?.counterFactors ?? []) add(`${n}'s "why not the next band" list`, f);
-    add(`${n}'s mitigation line`, m?.mitigation);
-    for (const p of m?.purpleNotes ?? []) add(`${n}'s note to the reviewing lawyer`, p?.text ?? p);
-    for (const r of m?.registerReads ?? []) add(`${n}'s read of a filing`, r?.read);
+    add(`${n}'s basis line`, m?.basis, { field: "basis", mark: n });
+    (m?.factors ?? []).forEach((f, i) => add(`${n}'s "why this band" list`, f, { field: "factors", mark: n, index: i }));
+    (m?.counterFactors ?? []).forEach((f, i) => add(`${n}'s "why not the next band" list`, f, { field: "counterFactors", mark: n, index: i }));
+    add(`${n}'s mitigation line`, m?.mitigation, { field: "mitigation", mark: n });
+    (m?.purpleNotes ?? []).forEach((p, i) => add(`${n}'s note to the reviewing lawyer`, p?.text ?? p, { field: "purpleNotes", mark: n, index: i }));
+    (m?.registerReads ?? []).forEach((r, i) => add(`${n}'s read of a filing`, r?.read, { field: "registerReads", mark: n, index: i }));
     // The finding's ONE sentence. Its `basis` is folded and is deliberately not read here.
-    for (const f of m?.findings ?? []) add(`${n} conflict ${f?.ordinal ?? ""}`.trim(), f?.net);
+    // BOUND BY ORDINAL, NOT BY POSITION: the merged gate re-ranks and renumbers findings on the band,
+    // so an index into this array is a different row after normalisation and the ordinal is not.
+    for (const f of m?.findings ?? []) add(`${n} conflict ${f?.ordinal ?? ""}`.trim(), f?.net, { field: "findings.net", mark: n, ordinal: f?.ordinal });
   }
   return out;
 }
@@ -2453,7 +2471,14 @@ export function plainLanguageChecks({ findings } = {}) {
   const vocab = [];
   const longSentences = [];
   for (const { where, text } of fields) {
-    for (const [term] of PLAIN_FORMS) if (termMatcher(term).test(text)) vocab.push(`${where}: "${term}"`);
+    // THE REPLACEMENT TRAVELS WITH THE FLAG. Naming the term and pointing at a document for the swap is
+    // the half the doctrine calls load-bearing, left out — and it is the half a pass that REWRITES the
+    // line needs in hand. The pinned source already carries a worked plain form for every term; there
+    // was no reason for this flag to name only the fault.
+    for (const [term, plain] of PLAIN_FORMS) {
+      if (!termMatcher(term).test(text)) continue;
+      vocab.push(plain ? `${where}: "${term}" → "${plain}"` : `${where}: "${term}" (an engine word — cut it)`);
+    }
     for (const sentence of text.split(/(?<=[.!?])\s+|\n+/)) {
       const n = sentence.trim().split(/\s+/).filter(Boolean).length;
       if (n > SENTENCE_WORD_LIMIT) longSentences.push(`${where}: ${n} words`);
@@ -2487,7 +2512,7 @@ export function plainLanguageChecks({ findings } = {}) {
     check("reviewer-note-subject", "voice", surface, misfiled.length === 0,
       misfiled.length ? `a note about what was asked that never names the request — it will print under this name's conflicts rather than at the top of the page, where a question about the request belongs. Name the request in the note: ${say(misfiled)}` : ""),
     check("plain-language-vocabulary", "voice", surface, vocab.length === 0,
-      vocab.length ? `the lawyer's vocabulary on lines a reader meets before opening anything — rewrite the line in the words the reader already owns (the skill carries the swaps): ${say(vocab)}` : ""),
+      vocab.length ? `the lawyer's vocabulary on lines a reader meets before opening anything — rewrite the sentence in the words the reader already owns, do not swap the word: ${say(vocab)}` : ""),
     check("plain-language-sentence-length", "voice", surface, longSentences.length === 0,
       longSentences.length ? `a default-visible sentence carrying more than one idea (over ${SENTENCE_WORD_LIMIT} words) — split it, conclusion first: ${say(longSentences)}` : ""),
   ];
@@ -2569,7 +2594,7 @@ export function runKnockoutLint({ findings }) {
   // (publish/report-registry.mjs re-renders archived findings without re-running the merged validator)
   // this scan is the only permission-prose coverage there is.
   if (working.trim()) checks.push(...permissionProseChecks({ text: working, surface: "findings", idSuffix: ":knockout-working", structural: true, cards: false }));
-  // tracker issue 333 — the plain-language reviewer, over the fields a reader meets before opening a
+  // the plain-language reviewer, over the fields a reader meets before opening a
   // fold. Internal by surface, so a hit reaches whoever is fixing the run and never a delivery surface.
   checks.push(...plainLanguageChecks({ findings }));
   const failures = checks.filter((c) => !c.pass);
@@ -2714,7 +2739,7 @@ export function deliveryFlagLines(failures) {
     const id = String(f?.id ?? "");
     const base = id.split(":")[0];
     const family = String(f?.family ?? "");
-    // A CHECK WHOSE DISTINCTION LIVES IN ITS SUFFIX COULD NOT BE SAID HERE (tracker issue 267).
+    // A CHECK WHOSE DISTINCTION LIVES IN ITS SUFFIX COULD NOT BE SAID HERE.
     //
     // Grouping on `base` alone is right for the common case — a word-cap violation on nine write-ups is
     // one delivery line, not nine. But it also collapsed `narrative-write-ups:could-not-read` into the

package/driver/product-rows.mjs

@@ -54,7 +54,7 @@ import { leversFromResolved, turnaround, turnaroundHours } from "./effort-model.
  *     multi-country-focus-search   2.5h    1.5–2.5 hours
  *     full-country-search          2.5h    1.5–2.5 hours
  *
- * ALL THREE CLEARANCES ARE IDENTICAL HERE and that is the owner ruling, not a flattening to fix.
+ * ALL THREE CLEARANCES ARE IDENTICAL HERE and that is the ruling, not a flattening to fix.
  * The table above used to separate them with lane adders (+0.5 case law, +0.5 native, +0.5 single
  * territory). Eight delivered runs refuted that: the full-country run — the only one carrying every lane,
  * quoted 3.0h — came in at 2.33h, SHORTER than five of the other seven, which carried fewer lanes and were

package/driver/products.mjs

@@ -2,7 +2,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // products.mjs — THE OFFERING. Which of the four products a request is, and what that product carries.
 //
-// Owner ruling, 2026-08-06. There are four products and a client buys one of them:
+// Ruling, 2026-08-06. There are four products and a client buys one of them:
 //
 //   Knockout search              worldwide or a chosen set; up to 8 names; no case law; no native language
 //   Global preliminary search    WORLDWIDE, nothing else; no case law; no native language

package/driver/profile-page.html

@@ -261,7 +261,7 @@ function collect() {
   // (set outside this page) must survive a save round-trip instead of being silently rewritten
   const delivery = { ...((current.profile && current.profile.delivery) || {}), email: $("f_email").value };
   // THE MARKING IS THREE-STATE ON THE WIRE and this control has two live options, so the default one
-  // writes ABSENCE and never `false` (tracker issue 1991). It was a checkbox, which rendered absent and
+  // writes ABSENCE and never `false`. It was a checkbox, which rendered absent and
   // `false` identically and wrote a boolean on every save — so a customer who had given no instruction
   // was recorded as "strip the line" the first time anybody pressed Save on an unrelated field, and
   // their next report shipped with no confidentiality line. That is the incident this door has already had.
@@ -379,18 +379,43 @@ async function submit(write) {
     }
     showMsg("", write ? "Saving…" : "Checking…");
     const action = write ? "save" : "validate";
-    const r = await jpost(`${API}${encodeURIComponent(key)}/${action}`, { profile, contextPack });
+    // CREATING IS ITS OWN ROUTE, and this is the whole of the defect it fixes. `save` is an upsert: its
+    // preserve step takes the on-disk value of every code-owned field and DELETES the field when there is
+    // nothing on disk. A customer being created has nothing on disk, so creating through `save` wrote no
+    // risk framework at all, silently, and every matter for that customer was rated under the general
+    // default from then on with nothing on any screen saying so.
+    //
+    // The create route asks the same questions the command line asks, always sets the framework, and
+    // refuses a colliding email domain before writing rather than leaving the next start unable to
+    // resolve ANY customer. Its body is FLAT; `save` takes a nested profile.
+    const r = (write && current.isNew)
+      ? await jpost(API.replace(/\/$/, ""), {
+          name: profile.name, key,
+          industry: profile.industry,
+          matchDomains: profile.matchDomains,
+          platforms: profile.platforms,
+        })
+      : await jpost(`${API}${encodeURIComponent(key)}/${action}`, { profile, contextPack });
     if (!write) {
       if (r.json.ok) showMsg("ok", r.json.isNew ? "Looks good — ready to create this customer." : "Looks good — ready to save.");
       else showServerErrors("Almost there — please fix:", r.json.errors);
       return;
     }
-    if (r.status === 200 && r.json.written) {
-      showMsg("ok", `Saved — ${r.json.created?"created":"updated"} ${key} · commit ${String(r.json.commit||"").slice(0,9)}`);
+    if ((r.status === 200 || r.status === 201) && r.json.written) {
+      // 201 from the create route, 200 from a save. Testing only for 200 would report a successful
+      // creation as a failure, which is the one answer that sends somebody to make the customer twice.
+      const fw = r.json.framework
+        ? ` · ${r.json.framework.defaulted ? "general default rating" : "its own rating framework"}`
+        : "";
+      showMsg("ok", `Saved — ${r.json.created?"created":"updated"} ${key}${fw} · commit ${String(r.json.commit||"").slice(0,9)}`);
       await loadRoster(key);
       if (current.isNew) openCustomer(key);
     } else if (r.json.error === "validation_failed") {
       showServerErrors("Couldn’t save — please fix:", r.json.errors);
+    } else if (r.json.message) {
+      // The create route names its refusals in a sentence and puts a machine token beside it. Showing
+      // the token is showing engine vocabulary to a lawyer.
+      showMsg("err", r.json.message);
     } else {
       showMsg("err", `Couldn’t save (${r.status}). ${r.json.error||"Please try again."}`);
     }
@@ -492,7 +517,7 @@ function collectProject() {
   // delivery is merged as a WHOLE field (project → customer): overriding it here intentionally replaces the
   // customer's delivery, so a project's delivery carries only email + privileged (style/template are the
   // customer's presentation defaults; a project that needs its own sets them via a code change, like the framework).
-  // Same three-state rule as the customer form (tracker issue 1991): the default option writes NO key, so
+  // Same three-state rule as the customer form: the default option writes NO key, so
   // an overlay never invents "strip the marking" for a project that gave no instruction.
   const email = $("p_email").value; if (email) { o.delivery = { email }; if ($("p_priv").value === "no") o.delivery.privileged = false; }
   const app = ($("p_appetite").value||"").trim(); if (app) o.riskAppetite = app;