clearotron 0.2.4 → 0.3.0-beta.1

package/driver/profile-service.mjs

@@ -32,6 +32,8 @@ import { resolvePort } from "../shared/listen.mjs";   // — the port SOURCE, de
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 import { storeInRepo, storeOutsideRepoMessage, makeCommittableAudit, commitWithAuditRow, makeStoreCommit } from "../shared/store-in-repo.mjs";   //
+import { resolveFramework, resolvePlatforms, buildProfile, assertRosterAccepts, companyKeyFrom } from "./company-bundle.mjs";
+import { defaultTerritoryState } from "./effective-scope.mjs";   // one reading of which stored territories the engine can search
 import { customerStoreDir, customerStoreLine } from "../shared/customer-store.mjs";   // — one store for the surface and the runs
 import {
   loadProfiles as loadProfilesDefault, validateProfileEdit as validateProfileEditDefault,
@@ -39,7 +41,7 @@ import {
   assertProfileKey, derivedFloor, derivedBatchSize, CONTEXT_PACK_FILE, DEFAULT_DELIVERY_TEMPLATE,
 } from "./profiles.mjs";
 
-import { DEFAULT_FRAMEWORK, DEFAULT_WORKED_EXAMPLES, loadFrameworkManifest } from "./framework.mjs";
+import { DEFAULT_FRAMEWORK, DEFAULT_WORKED_EXAMPLES, loadFrameworkManifest, manifestPathFor } from "./framework.mjs";
 import { config } from "./driver.config.mjs";
 import { productRows } from "./product-rows.mjs";   // the offering, so the editor never hand-types a menu
 import { dirname as pathDirname } from "node:path";
@@ -57,7 +59,34 @@ import { accessAudience, audienceLabel } from "../shared/access-audience.mjs";
 // at the wrong tree looked, from every log, exactly like a customer who simply has no custom framework.
 // The page said "could not be read" and nothing anywhere said why. Log it once, at the point of loss.
 const DRIVER_DIR = pathDirname(toPath(import.meta.url));
+
+/**
+ * SAY IT ONCE WHEN A FRAMEWORK COMES OUT OF THE SHIPPED TREE INSTEAD OF THE STORE.
+ *
+ * Skill resolution falls back from the config store to the repo, and for a generic methodology file that
+ * fallback is the migration working as designed. A FRAMEWORK is the exception, because the shipped tree
+ * carries decks under the same filenames customers use for their own — take a customer's deck out of the
+ * store and the repo's copy answers. It is readable, it is valid, and it is somebody else's rubric, and
+ * the matter is rated under it with nothing raised anywhere.
+ *
+ * WARNED ONCE PER PATH, DELIBERATELY. These run on every profile view. A line per view on a healthy
+ * install is a log flood, and a log flood is silenced, which would reproduce the silence this exists to
+ * break. The set is per-process and never cleared: the fact does not change while the process runs.
+ */
+const substitutionsSaid = new Set();
+function sayIfSubstituted(rel) {
+  try {
+    const r = config.resolveSkillPathReport(rel);
+    if (r.layer !== "base" || substitutionsSaid.has(r.path)) return;
+    substitutionsSaid.add(r.path);
+    console.error(`[profile-service] framework served from the shipped tree, not the configured store: ${rel} `
+      + `is not in the store, so ${r.path} answered. If a customer's own deck was removed from the store, `
+      + `the shipped file of the same name is now rating their matters.`);
+  } catch { /* an unreadable overlay is reported by the resolution the caller is about to make */ }
+}
+
 function manifestFor(fwPath) {
+  sayIfSubstituted(manifestPathFor(fwPath));
   try { return loadFrameworkManifest((rel) => config.resolveSkillPath(rel), fwPath); }
   catch (e) {
     console.error(`[profile-service] framework manifest unreadable for ${fwPath}: ${String(e?.message ?? e)} `
@@ -78,23 +107,18 @@ const stripMd = (s) => String(s ?? "").replace(/\*+/g, "").trim();
 // matrix-shaped decks: the deck's "Band meanings" table is the only table whose FIRST cell is
 // exactly the band label (the matrix table suffixes its labels with the deck's internal indices, e.g.
 // "**Very High** *(5)*") — take that row's cells as { band, meaning, response }.
-function matrixBandMeanings(deck, manifest) {
+function matrixBandRows(deck, manifest) {
   const tableRows = deck.split("\n").filter((l) => /^\s*\|.*\|\s*$/.test(l));
-  const out = [];
-  for (const b of manifest.bands) {
+  return manifest.bands.map((b) => {
     const want = b.label.trim().toLowerCase();
-    let hit = null;
     for (const line of tableRows) {
       const cells = line.trim().replace(/^\|/, "").replace(/\|$/, "").split("|").map(stripMd);
-      if (cells.length >= 3 && cells[0].toLowerCase() === want && cells[1] && cells[2]) {
-        hit = { band: b.label, meaning: cells[1], response: cells[2] };
-        break;
-      }
+      if (cells.length >= 3 && cells[0].toLowerCase() === want && cells[1] && cells[2])
+        return { band: b.label, meaning: cells[1], response: cells[2] };
     }
-    if (!hit) return null;   // ANY miss ⇒ no partial box
-    out.push(hit);
-  }
-  return out;
+    return { band: b.label, miss: "no table row starts with this band label and then states a meaning and a response — "
+      + "a matrix-shaped deck defines its bands in a three-column table" };
+  });
 }
 
 // bands-shaped decks (the house default among them): each band lives under its own heading ("## VERY HIGH RISK") — find
@@ -120,7 +144,7 @@ function matrixBandMeanings(deck, manifest) {
 // design is the protection it was actually for: a band whose section is missing, or whose section
 // states no rungs at all, is a GARBLED deck and still returns null, because a half-shown framework
 // misleads worse than an absent one. A merely renamed rung is not that case.
-function bandsBandMeanings(deck, manifest) {
+function bandsBandRows(deck, manifest) {
   const re = /^#{1,6}[ \t]*([^\n]+)$/gm;
   const heads = [];
   for (let m; (m = re.exec(deck)); ) heads.push({ text: stripMd(m[1]), start: m.index, end: m.index + m[0].length });
@@ -129,7 +153,7 @@ function bandsBandMeanings(deck, manifest) {
   for (const b of manifest.bands) {
     const want = b.label.trim().toLowerCase();
     const sec = sections.find((s) => s.head === want || (s.head.startsWith(want) && !/[a-z0-9]/i.test(s.head.charAt(want.length))));
-    if (!sec) return null;
+    if (!sec) { out.push({ band: b.label, miss: "no heading whose text is this band label, or begins with it" }); continue; }
     // Every top-level "- **Label.** text" bullet the band states, in the deck's order. The label is the
     // deck's own word for the rung; nothing here decides which rungs exist or what they may be called.
     const rungs = [];
@@ -138,7 +162,11 @@ function bandsBandMeanings(deck, manifest) {
       const text = stripMd(m[2]).trim();
       if (label && text) rungs.push({ label, text });
     }
-    if (!rungs.length) return null;   // a section stating no rungs is a garbled deck — see above
+    if (!rungs.length) {
+      out.push({ band: b.label, miss: "the section under this band's heading states no rungs — a bands-shaped deck "
+        + "writes each rung as a top-level `- **Label.** text` bullet" });
+      continue;   // a section stating no rungs is a garbled deck — see above
+    }
     // `meaning` IS KEPT, and it is not vestigial: `driver/profile-page.html` renders these rows too and
     // reads exactly this field, so dropping it would blank a second surface that nobody asked me to
     // change. It carries the LAST rung — the consequences one in both the shipped deck and the completed
@@ -148,19 +176,79 @@ function bandsBandMeanings(deck, manifest) {
   return out;
 }
 
-/** Pure extraction (exported for the tests): deck text + validated manifest → [{ band, meaning, response? }]
- *  in manifest band order, or null on ANY miss. Never throws. */
-export function extractBandMeanings(deckText, manifest) {
+/**
+ * A refusal, worded for the person in the browser.
+ *
+ * THE SAME FACTS, A DIFFERENT READER. The shared create path's own sentences are written for somebody who
+ * typed a command: they name the flag that was missing and the directory that was written to, which is
+ * exactly what that reader needs. The person on the New company page typed neither. A sentence about
+ * `--platforms` and a filesystem path does not tell them what to do; it tells them they are in the wrong
+ * product.
+ *
+ * So the code is worded here and the facts ride alongside, which is what lets the screen offer a link to
+ * the company that already holds a key rather than printing its slug. An unrecognised code falls back to
+ * the original message: wrong for this reader, but never blank — an unworded refusal must not become a
+ * silent one.
+ */
+export function browserRefusal(e) {
+  const d = e?.detail ?? {};
+  switch (e?.code) {
+    case "key_exists":
+      return { error: "refused", code: "key_exists", key: d.key,
+        message: `A company is already filed under "${d.key}". Open it to make changes, or choose a different name.` };
+    case "domain_claimed":
+      return { error: "refused", code: "domain_claimed", domain: d.domain, heldBy: d.heldBy,
+        message: `${d.domain} is already used by another company. An address can only belong to one, `
+          + `because the engine uses it to tell them apart. Remove it here, or take it off the other company first.` };
+    case "no_marketplaces":
+      return { error: "refused", code: "no_marketplaces",
+        message: "This installation has no default marketplaces set up, so there is nothing to search. "
+          + "Add at least one marketplace for this company, or ask an administrator to set the defaults." };
+    case "framework_missing":
+      return { error: "refused", code: "framework_missing",
+        message: "The risk framework this company was pointed at is not on this installation, so nothing "
+          + "was created. Rating a company under a framework nobody chose is worse than refusing." };
+    case "invalid_bundle":
+      // The validator collects, so these are already per-field sentences written for a reader.
+      return { error: "refused", code: "invalid_bundle", errors: d.errors ?? [],
+        message: (d.errors ?? []).join(" ") || String(e.message) };
+    default:
+      return { error: "refused", message: String(e.message) };
+  }
+}
+
+/**
+ * Every band's row, hit or miss — deck text + validated manifest → one entry per manifest band, in the
+ * manifest's order, each either a rendered row or `{ band, miss }` saying what the deck did not do.
+ *
+ * ONE PREMISE, TWO READERS. `extractBandMeanings` below is the renderer's verdict and collapses to null
+ * on any miss, because a half-shown framework misleads worse than an absent one. The pre-flight needs the
+ * opposite of a verdict: an author staring at an empty box has to be told WHICH band and WHY. Writing
+ * that as a second walk of the same deck would put two matchers on one property, and the day they drift
+ * the pre-flight blesses a deck the renderer drops. So the walk happens once, here, and the null is a
+ * collapse of this result rather than a separate decision.
+ *
+ * Never throws: a deck is a customer's file and may be anything at all.
+ */
+export function bandMeaningRows(deckText, manifest) {
   try {
     if (!deckText || !manifest || !Array.isArray(manifest.bands) || !manifest.bands.length) return null;
     return manifest.structure?.kind === "matrix"
-      ? matrixBandMeanings(String(deckText), manifest)
-      : bandsBandMeanings(String(deckText), manifest);
+      ? matrixBandRows(String(deckText), manifest)
+      : bandsBandRows(String(deckText), manifest);
   } catch { return null; }
 }
 
+/** Pure extraction (exported for the tests): deck text + validated manifest → [{ band, meaning, response? }]
+ *  in manifest band order, or null on ANY miss. Never throws. */
+export function extractBandMeanings(deckText, manifest) {
+  const rows = bandMeaningRows(deckText, manifest);
+  return rows && !rows.some((r) => r.miss) ? rows : null;
+}
+
 function bandMeaningsFor(fwPath, manifest) {
   if (!manifest) return null;
+  sayIfSubstituted(fwPath);
   try { return extractBandMeanings(readFileSync(config.resolveSkillPath(fwPath), "utf8"), manifest); }
   catch (e) {
     // Same reasoning as manifestFor: a silent null here blanks the "What the bands mean" box while the
@@ -194,7 +282,7 @@ function normalizeDefaultProduct(incoming, existing) {
   }
   return incoming;
 }
-// marketplaceDensity has NO CONTROL ON ANY SURFACE since the owner ruling of 2026-08-29 ("get rid of it
+// marketplaceDensity has NO CONTROL ON ANY SURFACE since the ruling of 2026-08-29 ("get rid of it
 // completely. there is no such thing as staff only"), and it is NOT code-owned — so without this it would
 // be stripped on the next save of any profile that has one.
 //
@@ -210,7 +298,7 @@ function normalizeDefaultProduct(incoming, existing) {
 // NO CONTROL ON ANY SURFACE, and profile-page.html reconstructs its payload from the inputs it has — so
 // each one would be stripped on the next staff save of any profile carrying it.
 //
-//   marketplaceDensity  the control was removed by owner ruling; the value sizes
+//   marketplaceDensity  the control was removed by ruling; the value sizes
 //                       the grid batch and losing it re-arms a measured truncation crash.
 //   demoData            never had a control; losing it turns a demo account into
 //                       one indistinguishable from a client, which is the exact failure the marker
@@ -283,7 +371,15 @@ export function makeProfileService({
       key: profile.key,
       profile: stripDerived(profile),
       contextPack: readPack(profile.key),
-      derived: { minCellsPerVariant: derivedFloor(profile), batchSize: derivedBatchSize(profile) },
+      derived: { minCellsPerVariant: derivedFloor(profile), batchSize: derivedBatchSize(profile),
+        // The stored default territories the engine cannot search, NAMED. Without this the profile
+        // screen shows the entries back exactly as typed and the engine quietly ignores them — which is
+        // what a person saw before: a setting that reads as in force and does nothing.
+        //
+        // It is computed here rather than read off a run, because it is a fact about the PROFILE. A
+        // reader who only hears about it on the runs where it happened to apply learns about a broken
+        // setting at random.
+        unrecognizedTerritories: defaultTerritoryState(profile).unrecognized },
       framework: {
         path: fwPath,
         // CUSTOM MEANS "NOT THE GENERIC DEFAULT", which is what the word means to the lawyer reading the
@@ -318,6 +414,80 @@ export function makeProfileService({
     const parts = path.replace(/\/+$/, "").split("/").filter(Boolean);   // ["profiles", key?, action?]
     if (parts[0] !== "profiles") return { status: 404, json: { error: "not_found" } };
 
+    // POST /profiles — CREATE, which is not the same act as save and must not route through it.
+    //
+    // `save` is an upsert and looks like it would do: it would not. `preserveCodeOwned` takes the
+    // on-disk value of every code-owned field and DELETES the field when there is none, and a company
+    // being created has nothing on disk — so a create through save writes no `frameworkPath`, silently,
+    // and the company is rated under the house default from then on. That is live today through the
+    // staff page and it is what this route exists not to repeat.
+    //
+    // Every question below is asked of `driver/company-bundle.mjs`, which the command line asks too.
+    // There is no second opinion here about what a valid company is.
+    if (parts.length === 1 && method === "POST") {
+      const name = isStr(body?.name) ? body.name.trim() : "";
+      if (!name) return { status: 400, json: { error: "needs_name", message: "A company needs a name." } };
+
+      // The key is derived from the name unless one was asked for, and it is REFUSED rather than
+      // repaired: a name of punctuation alone derives nothing, and inventing a key there would file a
+      // company under something nobody chose.
+      const wanted = isStr(body?.key) && body.key.trim() ? body.key.trim().toLowerCase() : companyKeyFrom(name);
+      if (!wanted) {
+        return { status: 400, json: { error: "needs_key",
+          message: `No key could be made from "${name}". Type one — lowercase letters, digits and hyphens.` } };
+      }
+      try { assertProfileKey(wanted); }
+      catch (e) { return { status: 400, json: { error: "bad_key", message: String(e.message) } }; }
+
+      const existing = resolveExisting();
+      let framework, platforms, profile;
+      try {
+        // ALWAYS SET, NEVER ABSENT — the company's own when one is supplied, the house default named
+        // otherwise. This is the whole reason a create does not go through save.
+        framework = resolveFramework(isStr(body?.frameworkPath) ? body.frameworkPath : null);
+        platforms = resolvePlatforms(Array.isArray(body?.platforms) ? body.platforms : null, existing);
+        profile = buildProfile({
+          key: wanted, name,
+          domains: Array.isArray(body?.matchDomains) ? body.matchDomains : [],
+          platforms: platforms.platforms,
+          // The whole resolution, not its path: buildProfile reads `.path` off it, and handing it the
+          // string writes `frameworkPath: undefined` — which is precisely the silent-absence defect this
+          // route exists to prevent, arriving through the route that prevents it.
+          framework,
+          industry: isStr(body?.industry) && body.industry.trim() ? body.industry.trim() : null,
+          // Carried, not dropped. A form that offers a field and a route that ignores it is the silent
+          // data loss this whole route exists to stop, arriving one layer further in. Arrays only —
+          // anything else is left absent rather than guessed at, and the validator then rules on it.
+          tradingNames: Array.isArray(body?.selfExclusionOwners) ? body.selfExclusionOwners : [],
+          classes: Array.isArray(body?.defaultClasses) ? body.defaultClasses : [],
+          territories: Array.isArray(body?.defaultJurisdictions) ? body.defaultJurisdictions : [],
+        });
+        // The proposed roster, validated whole. A colliding domain does not fail this company — it
+        // stops the deployment resolving ANY of them at the next start, so it is caught before a write
+        // rather than discovered by the next process to read profiles.
+        assertRosterAccepts({ store: profileDir, key: wanted, profile, loadProfiles });
+      } catch (e) {
+        if (e?.name === "Refusal") return { status: 400, json: browserRefusal(e) };
+        throw e;
+      }
+
+      const { files } = writeProfile({ profileDir, key: wanted, profile, contextPack: "" });
+      // WRITTEN AND RECORDED ARE TWO EVENTS. The write is live the instant it renames; the commit can
+      // fail on its own. Reporting them as one is how somebody is told nothing happened about a company
+      // that is already governing runs.
+      const message = `chore(clearotron): create company ${wanted} (via portal, by ${by})`;
+      const { commit, commitError } = commitWithAuditRow({ audit, gitCommit, files, message, by,
+        row: { event: "profile-create", key: wanted, by, fields: Object.keys(profile) } });
+      return { status: 201, json: {
+        key: wanted, name, written: true, created: true, commit,
+        // The receipt reads off THESE, so it can say which framework and how many marketplaces, and
+        // whether each was chosen or defaulted, rather than restating what was typed.
+        framework: { path: framework.path, defaulted: framework.source === "default" },
+        marketplaces: { count: platforms.platforms.length, defaulted: platforms.source !== "supplied" },
+        ...(commitError ? { commitError: `created and LIVE, but the git commit failed (${commitError}) — the audit line records the gap` } : {}),
+      } };
+    }
+
     // GET /profiles — roster
     if (parts.length === 1) {
       if (method !== "GET") return { status: 405, json: { error: "method_not_allowed" } };
@@ -333,6 +503,7 @@ export function makeProfileService({
       } };
     }
 
+
     const key = parts[1];
     const action = parts[2];
 
@@ -409,7 +580,7 @@ export function makeProfileService({
       if (overlayBody.defaultProduct === undefined && priorOverlay?.defaultProduct !== undefined)
         overlayBody.defaultProduct = priorOverlay.defaultProduct;
       // marketplaceDensity: same rule, and now permanent rather than "yet" — the control was removed from
-      // both surfaces by owner ruling, so an overlay's value can only ever come from the file it is in.
+      // both surfaces by ruling, so an overlay's value can only ever come from the file it is in.
       preserveUncontrolled(overlayBody, priorOverlay);
       // ARCHIVE STATE IS STICKY AGAINST OMISSION — recipe-service.mjs's discipline verbatim: un-archiving
       // takes an EXPLICIT archived:false, never a body that simply lacks the key. This is not theoretical:
@@ -627,7 +798,7 @@ const PORT = PORT_CHOICE.port;
   //
   // `makeAccessVerifier` has ALWAYS accepted issuer/jwksUrl/emailClaim — this service simply never
   // passed them, which is how one product shipped a provider-agnostic API face and three single-vendor
-  // services beside it. Owner ruling 2026-08-23: "we can't launch with an identity vendor, they bring
+  // services beside it. Ruling 2026-08-23: "we can't launch with an identity vendor, they bring
   // their own… they pick their own."
   const OIDC_ISSUER = process.env.PROFILE_OIDC_ISSUER || "";
   const JWKS_URL = process.env.PROFILE_JWKS_URL || "";

package/driver/profiles.mjs

@@ -20,6 +20,7 @@ import { readFileSync, readdirSync, existsSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { ORDERABLE_PRODUCTS } from "./search-policy.mjs";
+import { recognizedTerritories } from "./territory-tiers.mjs";   // which stored territories the engine can actually search
 import { envFrom } from "../shared/env-aliases.mjs";   // — a refusal names the name in force
 
 // CLEAROTRON_CUSTOMERS_DIR selects the customer config STORE; the bundled driver/profiles is the
@@ -216,6 +217,31 @@ export function withRunPlatforms(profile, jobPlatforms) {
   return { profile: { ...profile, platforms: [...(profile?.platforms ?? []), ...added] }, added };
 }
 
+// The three facts that tell one company from another at a glance, for the surfaces a person picks on.
+//
+// ONE SHAPE, TWO ROUTES. The staff roster and a client's own /me both answer this, and they answered
+// different questions before: the roster carried key and name, /me carried names alone. A picker that
+// renders a facts line from one and a bare name from the other shows the same company two ways
+// depending on who signed in — the exact defect ownerNames.mjs was written to end for the NAME.
+//
+// THE COUNT, NEVER THE LIST. `platformCount` is what a reader sees ("6 marketplaces"); the platform
+// list is which marketplaces this account has us sweep, and no surface here asks for it. Sending the
+// array so the browser can call `.length` would put that on the wire for every granted identity.
+//
+// Absent industry reads as null and the caller omits the segment: "Generic default" carries no
+// industry and no territories, and a line reading "· 3 marketplaces ·" with empty ends is worse than
+// a shorter line.
+export function companyFactsOf(profile) {
+  const industry = typeof profile?.industry === "string" && profile.industry.trim() ? profile.industry.trim() : null;
+  return {
+    industry,
+    platformCount: Array.isArray(profile?.platforms) ? profile.platforms.length : 0,
+    territories: Array.isArray(profile?.defaultJurisdictions)
+      ? profile.defaultJurisdictions.filter((t) => typeof t === "string" && t.trim()).map((t) => t.trim())
+      : [],
+  };
+}
+
 // F7 — the closed set of profile-file keys (deny-unknown-key). Every key here has a live consumer
 // recorded in FIELD_CONSUMERS; an unknown key is a dead knob or a typo and hard-fails at load (the
 // loader silently tolerated unknowns before). `minCellsPerVariant`/`batchSize` are intentionally
@@ -620,6 +646,27 @@ export function validateProfileEdit(key, profileObj, contextPack = "", { sparse
   if (contextPack && String(contextPack).trim()) {
     try { assertContextPackShape(String(contextPack), "context pack"); } catch (e) { errors.push(String(e.message)); }
   }
+  // A DEFAULT TERRITORY THE ENGINE CANNOT SEARCH IS REFUSED WHERE IT IS WRITTEN.
+  //
+  // HERE AND NOT IN validateProfileShape, and the difference is a roster-wide outage. That function runs
+  // on the LOAD path, so a refusal there would stop every profile already holding such an entry from
+  // loading — and when the loader throws, it does not fail that one bundle, it fails the deployment's
+  // whole roster and every customer's clearance with it. This wrapper is the WRITE path: the two doors
+  // that create, the two that save, and the repository lint. Nothing here can refuse a profile that is
+  // already on disk.
+  //
+  // It does not narrow what a REQUEST may name. That tolerance is deliberate and is a decision about what
+  // a client receives; this is the stored default, which is the opposite case — it is set once, by
+  // somebody who then stops watching, and its failure is silent by construction.
+  if (!sparse || profileObj?.defaultJurisdictions !== undefined) {
+    const { dropped } = recognizedTerritories(profileObj?.defaultJurisdictions ?? []);
+    if (dropped.length) {
+      errors.push(`profiles/${key}.json: ${dropped.map((d) => JSON.stringify(d)).join(", ")} `
+        + `${dropped.length === 1 ? "is not a territory" : "are not territories"} the engine can search, `
+        + `so storing ${dropped.length === 1 ? "it" : "them"} would be a default that silently does `
+        + `nothing. Use a country name, or a two-letter code such as US, GB or EU.`);
+    }
+  }
   return { ok: errors.length === 0, errors };
 }
 
@@ -742,7 +789,7 @@ export function loadProfiles({ dir, force = false, includeTestFixtures, includeD
     : String(process.env.CLEAROTRON_TEST_FIXTURE_PROFILES ?? "").trim() === "1";
   if (!asked) for (const [k, p] of [...profiles]) if (p?.testFixture === true) profiles.delete(k);
 
-  // THE DEMO ACCOUNT IS NOT PART OF A FRESH INSTALL EITHER — owner ruling, 2026-09-08: a clean install
+  // THE DEMO ACCOUNT IS NOT PART OF A FRESH INSTALL EITHER — ruling, 2026-09-08: a clean install
   // resolves `generic` and nothing else, and the demo brings its own account when somebody runs it.
   // Nobody should have to clean demo material out of an environment they just created.
   //

package/driver/publish/index.mjs

@@ -14,7 +14,7 @@ import { parseReport, parseAudit, parseSections, parseBlocks, stripInternal, par
 import { renderHtml, parseActionBuckets, actYouConditions } from './render.mjs';
 import { buildAudit } from './xlsx.mjs';
 import { parseFindingsJson, parseFindingsJsonLenient, deriveDisplayVerdict, joinFindingToBlock, CLIENT_TIER_BY_COMPOSITE, projectCoverageJudgment } from '../findings-model.mjs';
-import { readStore, requiredAbsent } from './publish-inputs.mjs';
+import { readStore, requiredAbsent, nonClosingAbsences } from './publish-inputs.mjs';   // — and why an absence did not close
 import { clearanceReportData } from './report-data.mjs';
 import { parseFrameworkManifest } from '../framework.mjs';
 import { rollupTokens } from '../tokens.mjs';
@@ -132,7 +132,7 @@ export function evaluateClientGate({ coverage = [], lintFailingIds = [], escalat
   const closing = requiredAbsent(inputsAbsent);
   if (closing.length)
     push('publish-input-absent', `a required input to this report was not there (${closing.join(', ')}) — the report was built without it, which is not the same as a search that found nothing`);
-  return { released: reasons.length === 0, reasons, reasonCodes, inputsAbsent: [...(Array.isArray(inputsAbsent) ? inputsAbsent : [])] };
+  return { released: reasons.length === 0, reasons, reasonCodes, inputsAbsent: [...(Array.isArray(inputsAbsent) ? inputsAbsent : [])], notClosing: nonClosingAbsences(inputsAbsent) };   // `notClosing` EXPLAINS a recorded absence that did not hold the release (publish-inputs.mjs nonClosingAbsences) — it decides nothing
 }
 
 // T3 (H3) — the machine-QC INPUT assembly. Mirrors publishReport's own reads exactly (the
@@ -201,7 +201,7 @@ const INDEX_CSS = `
  .b{display:inline-block;color:#fff;font-weight:700;font-size:12px;padding:2px 9px;border-radius:999px}
  .b-mh,.b-l3{background:var(--h-amber)}.b-l4{background:var(--crimson)}.b-l2{background:var(--h-green)}.b-l1{background:var(--h-grey)}
  .stmt{display:block;margin-top:3px;font-size:11.5px;color:var(--muted,#6b5d50);max-width:340px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
- .hold{display:inline-block;background:var(--crimson);color:#fff;font-weight:700;font-size:11px;padding:1px 7px;border-radius:999px;margin-left:6px}
+ .hold{display:inline-block;background:var(--crimson);color:#fff;font-weight:700;font-size:11px;padding:1px 7px;border-radius:999px;margin-left:6px} .disc{display:inline-block;border:1px solid var(--line);color:var(--muted);font-size:11px;padding:1px 7px;border-radius:999px;margin-left:6px}
  .hpill{display:inline-block;color:#fff;font-weight:700;font-size:11.5px;padding:3px 11px;border-radius:999px;white-space:nowrap}
  .filterbar{display:flex;flex-wrap:wrap;align-items:center;gap:10px;margin:0 0 12px}
  .filterbar .flbl{font-size:11px;letter-spacing:.14em;text-transform:uppercase;color:var(--crimson-mid);font-weight:700}
@@ -247,7 +247,7 @@ function indexRows(runs, { reportFile, linkPrefix = '', showAudit = true, client
       <td>${matterCell}</td>
       <td>${anonMark(r.title, { key: ck, run: r.runId })}</td>
       <td>${anonClient(r.client, ck)}</td>
-      <td><span class="b b-${esc(r.badge)}">${esc(r.overall)}</span>${qcFailed ? ' <span class="hold" title="machine QC checks failed — see the audit workbook">⚠ QC</span>' : ''}${
+      <td><span class="b b-${esc(r.badge)}">${esc(r.overall)}</span>${qcFailed ? ' <span class="hold" title="machine QC checks failed — see the audit workbook">⚠ QC</span>' : ''}${!client && !qcFailed && r.clientGate?.inputsAbsent?.length ? ` <span class="disc" title="${escAttr(`published without ${r.clientGate.inputsAbsent.join(', ')} — each declared optional, so the release stands; the report was built without it`)}">◦ built without an input</span>` : ''}${
         // spec 64 — the stance clause of THE one risk statement beside the (labelled) band pill, so the
         // index can never show a bare severity word that reads as the whole answer. The tier word leads
         // the statement; the pill already shows it, so the cell carries the clause after the first " — ".
@@ -859,7 +859,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
     const esPath = driverDir(runDir ?? dirname(reportMd), 'enforcer-signals.json');
     if (existsSync(esPath)) { const es = JSON.parse(readFileSync(esPath, 'utf8')); if (Array.isArray(es)) enforcerSignals = es; }
   } catch { /* absent — no telemetry lines */ }
-  bindFindingsToRecords(findings, recordsByUri);
+  const officeLinks = officeLinksFor(findings, recordsByUri, fetchReceipts); bindFindingsToRecords(findings, recordsByUri);
   // 404-card caveat (2026-07-22): the V4-2 closure pass persisted every cited record its targeted
   // fetch definitively could not retrieve (predelivery-lint.json artifactSet.recordFetchFailures);
   // the evidence join stamps `_recordFetchFailure` from it so the card render carries the
@@ -1030,7 +1030,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
       // the same rule (the workbook's own BANNED gate had already started firing on the raw detail —
       // advisory, so CI stayed green). reviewReceipts.lint keeps its raw detail for the internal
       // readers above (fetchState reads registry-record-coverage's URIs out of it).
-      counts = await buildAudit({ findings, coverage, contextNotes, coverageJudgment, markAssessment, corrections: correctionsDoc, fetchState, verdict: verdictInfo, jurisdiction, commonLawJoinedTerms, registerOnly, clientGate, lintFailures: deliveryFlagLines(reviewReceipts.lint), productName }, auditParsed, join(poolRunDir, auditFile), fm.title, fm);
+      counts = await buildAudit({ findings, coverage, contextNotes, coverageJudgment, markAssessment, corrections: correctionsDoc, fetchState, verdict: verdictInfo, jurisdiction, commonLawJoinedTerms, registerOnly, clientGate, lintFailures: deliveryFlagLines(reviewReceipts.lint), productName, registerPublishesRecordPages: runOrigins == null ? null : runOrigins.length > 0, recordLinks: officeLinks?.byUri ?? null }, auditParsed, join(poolRunDir, auditFile), fm.title, fm);
       grpRead(join(poolRunDir, auditFile), 0o640);
       if (counts?.gateViolations?.length) console.warn(`[audit-workbook] advisory: ${counts.gateViolations.join(' | ')}`);
     } catch (e) {
@@ -1052,7 +1052,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   // worse demo than no toggle.
   const reportNav = siteNav(poolRoot, 'report', null, '../', { anon: false });
   // `demoData` is resolved above the report.md write — one answer, every surface.
-  writeRO('report.html', renderHtml(parsed, findings, coverage, { demoData, productName, depthNote, scopeBasis, auditFile: auditFile || undefined, runId, delivery: deliv, recordsByUri, contextNotes, coverageJudgment: coverageJudgmentDisplay, markAssessment, fourAnswers, homeHref: '../index.html', nav: reportNav, chromeHref: '../assets/chrome.css', issued, asOf, verdictInfo, framework, searchedJurisdictions, caseLawByOrdinal, caseLawNotice, enforcerSignals, recordOrigin, recordOrigins: runOrigins, recordCitation: runProviderConf?.recordCitation ?? null, providerLabel, seniorRights, findingsSchemaVersion }));
+  writeRO('report.html', renderHtml(parsed, findings, coverage, { demoData, productName, depthNote, scopeBasis, auditFile: auditFile || undefined, runId, delivery: deliv, recordsByUri, contextNotes, coverageJudgment: coverageJudgmentDisplay, markAssessment, fourAnswers, homeHref: '../index.html', nav: reportNav, chromeHref: '../assets/chrome.css', issued, asOf, verdictInfo, framework, searchedJurisdictions, caseLawByOrdinal, caseLawNotice, enforcerSignals, recordOrigin, recordOrigins: runOrigins, recordCitation: runProviderConf?.recordCitation ?? null, recordLinks: officeLinks?.byUri ?? null, providerLabel, seniorRights, findingsSchemaVersion }));
   // ONE report (spec 2026-07-30 §5): report.client.html is no longer written. The knockout lane's own
   // collapse note is the precedent: "two renderings of one run is how the wrong link gets sent". The
   // client host serves the same report.html through the portal's readReport() (cleaning built in) — its
@@ -1102,9 +1102,11 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   // carry neither field and consumers null-guard, exactly as they do for markName — a delivered run does
   // not gain a project retroactively, it gains one on republish or not at all.
   let project = null;
+  let organisation = null;
   try {
     const frozen = runDir ? JSON.parse(readFileSync(driverDir(runDir, 'profile.json'), 'utf8')) : null;
     if (frozen?.projectKey) project = { key: String(frozen.projectKey), name: String(frozen.projectName ?? frozen.projectKey) };
+    if (typeof frozen?.organisation === 'string' && frozen.organisation) organisation = frozen.organisation;
   } catch { /* no frozen profile — pre-WS-B run, or a republish with no workspace */ }
   let tokenRollup;
   try { tokenRollup = runDir ? rollupTokens(runDir) : undefined; } catch { tokenRollup = undefined; }
@@ -1142,10 +1144,14 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
     projectKey: project?.key ?? undefined,
     projectName: project?.name ?? undefined,
     customerKey: customerKey || 'generic',
+    // WHICH ORGANISATION'S GENERIC this run was filed under, read from the frozen sidecar like the
+    // project. Absent on a company's run and on one filed before organisations existed, so such a meta
+    // stays byte-identical to a pre-stamp one.
+    organisation: organisation ?? undefined,
     issuedAt,
     // WHICH BUILD produced this. null off a git checkout — a provenance stamp never fails a publish.
     engineCommit: engineCommit(),
-    kind: 'clearance',
+    kind: 'clearance', recordLinks: officeLinks?.tally ?? undefined,   // per office: linked, or cited by number and why; only where the register has no record pages
     searchLevel: searchPolicy?.level ?? undefined,
     // Display-only face of the level ("Depth 4"), frozen alongside it so the list can show which reads
     // have run on a name without the browser having to know the level registry.
@@ -1180,7 +1186,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
     // re-rendered without its meta changing shape. When it IS present it is the durable record that
     // this report was assembled without those stores, which the run previously kept nowhere at all.
     clientGate: { released: clientGate.released, reasons: clientGate.reasons,
-      inputsAbsent: clientGate.inputsAbsent?.length ? clientGate.inputsAbsent : undefined },
+      inputsAbsent: clientGate.inputsAbsent?.length ? clientGate.inputsAbsent : undefined, notClosing: clientGate.notClosing?.length ? clientGate.notClosing : undefined },
     // PR-9 — present ⇒ report-data.json is beside the report and the portal can render natively (the
     // same stamp the knockout lane writes; the consumer branch had readers before it had a writer).
     // undefined on a producer miss, so the meta never advertises a file that is not there.
@@ -1189,7 +1195,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
 
   const total = skipRegen ? null : regenIndex(poolRoot);
   if (!skipRegen) await regenSurfaces(poolRoot);
-  // THE PORTAL ROUTE, not the pool's directory layout (tracker issue 289). This was
+  // THE PORTAL ROUTE, not the pool's directory layout. This was
   // `<origin>/<runId>/report.html` — where the documents sit on disk, which is not an application route.
   // Composed rather than spelled here so the report link is built the same way the audit link always was.
   const url = reportRouteFor(poolUrl, runId);
@@ -1244,7 +1250,7 @@ export function accessNoteHtml(font, domain = config.accessDomain) {
  * the edge's own legacy-report regexp character for character, so this function admits exactly the URLs the
  * deployment admits and no others.
  */
-// ── TWO SHAPES, AND THE SECOND ONE IS HISTORY (tracker issue 289) ────────────────────────────────────
+// ── TWO SHAPES, AND THE SECOND ONE IS HISTORY ────────────────────────────────────────────────────────
 //
 // The block quoted above describes an edge rewrite that IS NOT IN FORCE ON PRODUCTION. Settled by the
 // account owner against the live deployment, signed in as a delivered run's own owner: the emailed link
@@ -1279,7 +1285,7 @@ export function auditRouteFor(origin, runId) {
 }
 
 /**
- * THE REPORT'S ROUTE, from an origin and a run id (tracker issue 289).
+ * THE REPORT'S ROUTE, from an origin and a run id.
  *
  * The delivered link used to be the pool's directory layout pasted behind the public origin —
  * `<origin>/<runId>/report.html` — which is where the documents sit on disk and is not an application
@@ -1387,7 +1393,7 @@ export function composeEmailBody(reportMdPath, url, auditFile, productName = nul
     // section "already renders every open floor in plain language" — it was never built, and the pointer
     // had been promising it since.
     //
-    // OWNER RULING 2026-08-19 (relayed): drop the claim; no Coverage section is being designed. So the
+    // RULING 2026-08-19 (relayed): drop the claim; no Coverage section is being designed. So the
     // sentence states the fact and stops. It is deliberately not replaced with a different pointer — the
     // failure mode here was a pointer written before its target, and one true sentence beats two where
     // the second is a promise. When a surface exists that renders open floors in client language, this is
@@ -1612,3 +1618,15 @@ export function composeEmailHtml(reportMdPath, url, auditFile, names = [], deliv
 
   return `<div style="${FONT}">${reviewHeadline}${footerNote}</div>`;
 }
+
+// ── The office's own page for each fetched record, where the run's register publishes none of its own ──
+// Addressed from the record's numbers (office-record-links.mjs), never from the model or the handle, and
+// null on every other register, so those runs publish exactly as before. The tally goes to meta.json and
+// the log, so a register whose numbers never fit shows up as a count rather than as silence. Kept down
+// here, below every line the rest of the tree cites by number.
+import { recordLinksFor } from './office-record-links.mjs';
+function officeLinksFor(findings, recordsByUri, fetchReceipts) {
+  const links = recordLinksFor(findings, recordsByUri, fetchReceipts?.[0]?.provider);
+  if (links) console.log(`[record-links] ${links.summary}`);
+  return links;
+}

package/driver/publish/knockout.mjs

@@ -70,7 +70,7 @@ export const knockoutStatement = (framework, marks) =>
 // renders through publish/render-knockout.mjs in the product's own design language, off the same shared
 // stylesheet and brand tokens as the clearance report.
 //
-// THE REVIEWER'S NOTES ARE ON THE REPORT SINCE 2026-09-07 (owner ruling, tracker issue 274). This
+// THE REVIEWER'S NOTES ARE ON THE REPORT SINCE 2026-09-07 (ruling). This
 // paragraph used to end "internal working material (the purple staff notes, the model's registerEstimate)
 // is not IN the report; it lives in the audit workbook". That is now true of `registerEstimate` only: the
 // notes render on the page, labelled, and the workbook keeps its copy. See render-knockout.mjs's header
@@ -364,14 +364,14 @@ export async function publishKnockout({ runId, codename, runDir, findings, plan,
   let registerRecords = null;
   try { registerRecords = JSON.parse(readFileSync(driverDir(runDir, 'register-records.json'), 'utf8')); }
   catch { registerRecords = null; }
-  // The owner lookups this run made (tracker issue 276), read the same tolerant way as the records above:
+  // The owner lookups this run made, read the same tolerant way as the records above:
   // an archived run that predates the lane has no file, and its cards then render exactly as they were
   // delivered. The source line the report prints comes from HERE, not from anything the seat typed.
   let ownerChecks = [];
   try { ownerChecks = JSON.parse(readFileSync(driverDir(runDir, 'owner-checks.json'), 'utf8')).checks ?? []; }
   catch { ownerChecks = []; }
   // The request the run was given, read the same tolerant way as the sidecars above and for the same
-  // reason (tracker issue 331 A.1). It is what "About this request" states; a run archived before the
+  // reason (A.1). It is what "About this request" states; a run archived before the
   // sidecar existed has none, and its page renders exactly as it was delivered.
   let instructedScope = null;
   try { instructedScope = JSON.parse(readFileSync(driverDir(runDir, 'instructed-scope.json'), 'utf8')); }
@@ -492,7 +492,7 @@ export async function publishKnockout({ runId, codename, runDir, findings, plan,
   // once as string surgery on the report URL, once as this function, and both spelled a pool path.
   //
   // A SINGLE MARK USED TO KEEP THE LEGACY SHAPE, on the reasoning that `<runId>/report.html` is what the
-  // rewrite exists for and that it resolves. THAT IS FALSE ON PRODUCTION (tracker issue 289) and the
+  // rewrite exists for and that it resolves. THAT IS FALSE ON PRODUCTION and the
   // paragraph is kept, corrected, because its warning is still the right instinct and only its premise
   // was wrong.
   //
@@ -526,7 +526,7 @@ export async function publishKnockout({ runId, codename, runDir, findings, plan,
       // paragraph names every mark in the batch, and a reader who ordered one name must not be handed a
       // summary about other clients' marks. What it left behind was a page opening with nothing.
       //
-      // The assess stage writes a model-authored paragraph per mark now (owner ruling, full length), so
+      // The assess stage writes a model-authored paragraph per mark now (ruling, full length), so
       // the blank has a replacement rather than being merely correct. Substituting it HERE, into the
       // per-mark COPY, is what makes one line serve both surfaces: the rendered `<div class="sub">` and
       // `report-data-<slug>.json`'s `.summary` both read `batch.executiveSummary`, so neither the
@@ -619,6 +619,10 @@ export async function publishKnockout({ runId, codename, runDir, findings, plan,
     markName: batchMarkName(markNames) ?? undefined,
     engineCommit: engineCommit(),
     client: null, customerKey: customerKey || 'generic',
+    // WHICH ORGANISATION'S GENERIC this batch was filed under, read from the frozen sidecar exactly as
+    // the clearance publisher reads it. Absent on a company's batch and on one filed before
+    // organisations existed.
+    organisation: (() => { try { const f = JSON.parse(readFileSync(driverDir(runDir, 'profile.json'), 'utf8')); return typeof f?.organisation === 'string' && f.organisation ? f.organisation : undefined; } catch { return undefined; } })(),
     issuedAt: (() => { try { const prev = JSON.parse(readFileSync(join(poolRunDir, 'meta.json'), 'utf8')); return prev?.issuedAt ?? new Date().toISOString(); } catch { return new Date().toISOString(); } })(),
     kind: 'knockout-batch',
     marks: (findings.marks ?? []).map((m) => ({ name: m.name, band: m.rating })),