clearotron 0.2.4 → 0.3.0-beta.1

package/driver/publish/render.mjs

@@ -66,7 +66,7 @@ let ENFORCER_SIGNALS = new Map();  // E6: registration uri (lowercase) → {aggr
 // inference and no receipt line renders ⇒ archived output stays byte-identical.
 let RECORD_ORIGIN = null;
 let RECORD_ORIGINS = null;   // — the run's ALLOW-LIST, not one origin
-let RECORD_CITATION = null;  // — what a card shows where a link cannot go (provider table)
+let RECORD_CITATION = null, RECORD_LINKS = null;  // — what a card shows where a link cannot go (provider table); the office's own page per fetched record (office-record-links.mjs)
 let PROVIDER_LABEL = null;
 // WP-receipts W3/W4 — senior-right rows by finding ordinal (from _driver/senior-rights.json via
 // publish). The open item is CODE-OWNED: a verdict-driving card whose senior right went unverified
@@ -872,7 +872,7 @@ function scopeSection(ranBucket, coverage, coverageJudgment, methodologyText, co
   // page had a register-index entry on it — a definition of a label the reader could not see. It renders
   // now only where such an entry does, and the remaining two say what "inferred" means in the words a
   // reader would use for it rather than in the renderer's.
-  if (hasRecordSet || hasCards) parts.push(`<p class="scoperead" style="margin:0 0 4px;font-weight:600">Record provenance</p><p class="provnote" style="margin:0 0 6px;font-size:13px">${hasRecordSet ? 'Registration numbers on the cards were read from the register records. ' : ''}${hasIndexEntry ? 'A registration shown as a register-index entry was seen in the register index; its full record was not pulled. ' : ''}“Inferred” beside an owner’s likelihood to object means we judged it from what the owner sells and holds; we had no enforcement history to read.</p>`);
+  if (hasRecordSet || hasCards) parts.push(`<p class="scoperead" style="margin:0 0 4px;font-weight:600">Record provenance</p><p class="provnote" style="margin:0 0 6px;font-size:13px">${hasRecordSet ? 'Registration numbers on the cards were read from the register records. ' : ''}${officeLinkNote()}${hasIndexEntry ? 'A registration shown as a register-index entry was seen in the register index; its full record was not pulled. ' : ''}“Inferred” beside an owner’s likelihood to object means we judged it from what the owner sells and holds; we had no enforcement history to read.</p>`);
   // — this is the one part of §4 that does NOT fold. Same markup, same heading, same marker; it is
   // emitted beside the <details> instead of inside it, wrapped in the panel the only-you section already
   // uses so it reads as a region of the page rather than a stray heading.
@@ -1298,7 +1298,7 @@ function fullDetail(f, card, recordsByUri = new Map()) {
       // "file exists on disk" inference. Absent receipt (archived runs) renders nothing.
       const receiptTail = rec._receipt?.fetched_at
         ? ` · <i class="receipt">verified — ${esc(PROVIDER_LABEL || 'register')} record fetched ${esc(String(rec._receipt.fetched_at).slice(0, 10))}</i>` : '';
-      return `<li><b>${regUri(r.uri)}</b>${cls ? ` · Cl.${esc(cls)}` : ''}${status ? ` · ${esc(status)}` : ''}${tail ? ` (${esc(tail)})` : ''}${jur ? ` · ${esc(jur)}${sys ? ` <i class="jsys">(${sys})</i>` : ''}` : ''}${desigHtml}${prio}${receiptTail}</li>`;
+      return `<li><b>${officeRecordCell(r.uri, regUri, RECORD_CITATION ? NO_LINK_NOTE[RECORD_CITATION] : null)}</b>${cls ? ` · Cl.${esc(cls)}` : ''}${status ? ` · ${esc(status)}` : ''}${tail ? ` (${esc(tail)})` : ''}${jur ? ` · ${esc(jur)}${sys ? ` <i class="jsys">(${sys})</i>` : ''}` : ''}${desigHtml}${prio}${receiptTail}</li>`;
     }
     // (2)+(3): a cited record with NO fetched body. NEVER-INVENT when the run has a record set (this URI was
     // not fetched ⇒ the model's fields are unconfirmed); also when there are no findings.json facts to show.
@@ -2072,7 +2072,7 @@ export function renderHtml(parsed, findings = [], coverage = [], opts = {}) {
   // The provider table's own answer, not a branch on a vendor name here: `workbook` (no register UI
   // exists — point at the artifact that carries the record) or `placeholder` (a UI exists, its
   // per-record URL is unknown — say so, and say it is unfinished). Unset ⇒ plain text, as before.
-  RECORD_CITATION = typeof opts.recordCitation === "string" ? opts.recordCitation : null;
+  RECORD_CITATION = typeof opts.recordCitation === "string" ? opts.recordCitation : null; RECORD_LINKS = opts.recordLinks instanceof Map ? opts.recordLinks : null;
   PROVIDER_LABEL = opts.providerLabel ?? null;     // WP-receipts W2
   SENIOR_RIGHTS = new Map((Array.isArray(opts.seniorRights) ? opts.seniorRights : []).map((r) => [r.ordinal, r]));   // WP-receipts W3/W4
   // A1 — a review-KILLED finding (disposition "withdrawn") renders NOWHERE: not in the
@@ -2411,3 +2411,28 @@ if (isEntrypoint(import.meta.url)) {
   writeFileSync(out, renderHtml(parsed, findings, coverage, { runId: basename(reportPath), contextNotes, markAssessment, fourAnswers }));
   console.log(`rendered ${findings.length} findings + ${coverage.length} coverage areas + ${contextNotes.length} context notes -> ${out}`);
 }
+
+// ── The office's own page for a fetched record, where the run's register publishes none of its own ─────
+// publish addresses each fetched record from its own numbers (office-record-links.mjs) and hands the map
+// in as `recordLinks`. Kept down here, below every line the rest of the tree cites by number.
+import { officeReasonSentences } from './office-record-links.mjs';
+
+// The label is the office and the number, linked where the office has a page. The handle names the
+// vendor's record, not the office's, and a reader can look it up nowhere. With no link the number stands
+// on its own beside the workbook note, and Scope says once, per office, why it is not a link.
+function officeRecordCell(uri, regUri, note) {
+  const l = RECORD_LINKS?.get(String(uri || '').toLowerCase());
+  if (!l?.label) return regUri(uri);
+  if (l.href) return `<a href="${esc(l.href)}" target="_blank" rel="noopener noreferrer">${esc(l.label)}</a>`;
+  return note ? `${esc(l.label)}<span class="reg-nolink">${note}</span>` : esc(l.label);
+}
+
+// What a linked registration number opens and, once per office, why the rest are cited by number. Said
+// in Scope rather than beside every registration, for the reason the placeholder note was removed: a
+// note repeated on every line reads as a broken report. Empty on every other run.
+function officeLinkNote() {
+  if (!RECORD_LINKS) return '';
+  const linked = [...RECORD_LINKS.values()].some((l) => l?.href);
+  return (linked ? 'A registration number shown as a link opens the office’s own page for that record. ' : '')
+    + officeReasonSentences(RECORD_LINKS).map((s) => `${esc(s)} `).join('');
+}

package/driver/publish/report-data.mjs

@@ -7,7 +7,7 @@
 // Two readers, one file (the knockout doctrine, as it stood): the assistant drafts client-facing mail
 // from it, and the portal's native-render path reads it instead of iframing baked HTML.
 //
-// THE TWO LANES DIVERGED ON 2026-09-07 AND THIS FILE DID NOT MOVE. The owner ruled (tracker issue 274)
+// THE TWO LANES DIVERGED ON 2026-09-07 AND THIS FILE DID NOT MOVE. The owner ruled
 // that the KNOCKOUT report carries the reviewer's notes, on the ground that one report is read by the
 // person who ran Clearotron and holding material back confuses where data went; render-knockout.mjs
 // projects them under `reviewerNotes`. That ruling was about those notes on that lane. It did not touch
@@ -187,7 +187,7 @@ export function clearanceReportData({
     // filing-routine "(ordinary mechanics are not an ask) — same rule as the code-built only-you
     // section", and that cross-reference was accurate: the only-you section dropped it too, through
     // ADVISORY_TAG rather than a named filter. then wrote a watch group for "monitoring and
-    // filing-routine" and neither copy was told. Owner ruling 2026-08-19: the kind renders.
+    // filing-routine" and neither copy was told. Ruling 2026-08-19: the kind renders.
     //
     // This surface is the one that matters most for it. Legacy runs are served as baked bytes, but NEW
     // runs render component-native from report-data.json — so a fix that reached only the markdown

package/driver/publish/seed-pool.mjs

@@ -105,7 +105,7 @@ export function frozenSamples(examplesDir) {
  */
 export async function seedPool({ pool, examplesDir, republish }) {
   const existing = poolRunIds(pool);
-  // ── A POOL THAT ALREADY HOLDS SOMETHING IS TOPPED UP, NOT SKIPPED (tracker issue 277) ──────────────
+  // ── A POOL THAT ALREADY HOLDS SOMETHING IS TOPPED UP, NOT SKIPPED ──────────────────────────────────
   //
   // This used to return early on any non-empty pool. That was invisible while `demo/` shipped one child:
   // seeding one and seeding all were the same act. When the other three landed, every box seeded before

package/driver/publish/templates/report.css

@@ -37,7 +37,7 @@
   h1.mark{font-weight:900;font-size:58px;line-height:1.0;letter-spacing:-.022em;margin:0 0 14px}
   .sub{font-size:17.5px;color:var(--slate);max-width:700px;line-height:1.5;margin:0 0 30px}
   .sub b{color:var(--ink);font-weight:700}
-  /* tracker issue 470 — the hero caption folds to its first sentence; the remainder sits behind this disclosure.
+  /* the hero caption folds to its first sentence; the remainder sits behind this disclosure.
      The visible sentence loses its bottom margin (the fold row carries the spacing instead) so a folded
      caption occupies the same vertical run as an unfolded one. `details.sub-more` is styled here and NOT
      in the frozen renderer, and the existing @media print rule that forces every <details> open already
@@ -56,7 +56,7 @@
   .panel{background:var(--card);border:1px solid var(--line);border-radius:18px;box-shadow:var(--shadow)}
   .gauge{padding:22px 24px}
   .gauge .label{margin-bottom:18px}
-  /* tracker issue 761 — the framework that owns the ticks, named where they are read. Normal case and un-tracked on
+  /* the framework that owns the ticks, named where they are read. Normal case and un-tracked on
      purpose: `.label` is an uppercase eyebrow, and a proper name in the eyebrow's own letterforms reads
      as a second heading rather than as the thing being cited. */
   .gauge .label .gauge-fw{display:block;margin-top:5px;font-size:11px;font-weight:600;letter-spacing:0;
@@ -167,7 +167,7 @@
   .pips.l3 i:nth-child(-n+3){background:var(--high)} .pips.l2 i:nth-child(-n+2){background:var(--med)} .pips.l1 i:nth-child(-n+1){background:var(--low)}
   .pips.g3 i{background:var(--clear)} .pips.g2 i:nth-child(-n+2){background:var(--clear)}
   .mv{font-size:11px;color:var(--slate);margin-top:6px;font-weight:500;line-height:1.3}
-  /* tracker issue 762 D4 — the meter's SECOND position: how well the fact above it is evidenced. It is subordinate
+  /* D4 — the meter's SECOND position: how well the fact above it is evidenced. It is subordinate
      to .mv on purpose (lighter, smaller): the finding is the fact, the receipt is the footnote. It
      wraps inside its own 1fr grid track, so a long evidence clause costs height, never overflow. */
   .mev{font-size:10px;color:var(--faint);margin-top:3px;font-weight:500;line-height:1.3}
@@ -214,7 +214,7 @@
   details.method[open]>summary::after{content:"▴"}
   .method .mbody{padding:0 22px 20px;font-size:13px;color:var(--slate);line-height:1.62}
 
-  /* Ask-your-AI launcher (PR tracker issue 207 addendum) */
+  /* Ask-your-AI launcher */
   .askai{position:relative;display:inline-block}
   .askai-pop{position:absolute;z-index:30;top:calc(100% + 8px);left:0;width:340px;max-width:88vw;background:var(--card);
     border:1px solid var(--line2);border-radius:14px;box-shadow:var(--shadow);padding:14px}
@@ -272,7 +272,7 @@
   .jchip.ww{font-family:inherit;letter-spacing:.03em;color:var(--clear-tx,#2e6b32);background:var(--clear-soft,#EAF3E6);border-color:transparent}
   .jnote{font-size:10.5px;color:var(--faint);line-height:1.4}
 
-  /* spec-49 T4 retired the review-notes caveat body; tracker issue 265 retired the slim internal toolbar that
+  /* spec-49 T4 retired the review-notes caveat body; a later change retired the slim internal toolbar that
      survived it, because the Flag/Etch capture controls it hosted are gone. The .review rules stay:
      reports ALREADY DELIVERED are frozen bytes carrying that markup, and portal-report.mjs strips
      it at serve time against these selectors. */
@@ -320,7 +320,7 @@
   .gbody{padding:0 12px 8px}
   .rgroup .card{margin:0 0 10px} .rgroup .card:last-child{margin-bottom:4px}
 
-  /* tracker issue 242 — a grouped reasoned negative. The shared ground is in the .fold-lead above the run of rows;
+  /* a grouped reasoned negative. The shared ground is in the .fold-lead above the run of rows;
      each row carries only what is its own, so the line has to stay ONE line's worth of weight: the mark
      and owner anchor it, the jurisdictions/classes sit quiet, and the finding's own sentence takes the
      remaining width and wraps rather than truncating. Denser than .rgroup because these are cleared
@@ -349,7 +349,7 @@
        own content was carried correctly and only the control leaked, which is why the commit that added
        the fold could check the half it thought about and ship the half it did not. */
     details.drill>summary,details.method>summary,details.sub-more>summary{display:none!important}
-    /* tracker issue 470 made this line load-bearing for the document's CONTENT, not just its completeness. The
+    /* The caption fold made this line load-bearing for the document's CONTENT, not just its completeness. The
        legal/practical reads now live inside .drillbody, so without this rule the exported PDF would
        carry the one-line verdicts and none of the reasoning behind them. The export prints everything a
        reader could open — ruled on #470, deliberately unchanged. Ticked-card selection (.print-hidden)
@@ -412,7 +412,7 @@
   .fourans ul.fa-obstacles li{margin:0 0 4px;font-size:13px}
   @media (max-width:640px){.fourans .fa-row{flex-direction:column;gap:2px}.fourans .fa-k{flex:auto}}
 
-  /* ── tracker issue 763 — the coverage ledger stops being the page's smallest print ─────────────────────────────
+  /* ── the coverage ledger stops being the page's smallest print ─────────────────────────────
      `details.scope` had NO screen rule at all: its summary rendered at the browser default, in the
      browser's default weight, under the browser's default triangle, at the foot of a document whose
      every other section carries a numbered spine header. The section that states what the search did

package/driver/publish/xlsx.mjs

@@ -179,7 +179,7 @@ const FINDING_COLS = ['#', 'Conflicting mark', 'Owner', 'Country', 'Source', 'Cl
   'Status & key dates', 'Record retrieved?', 'Risk band', 'How we treated it',
   'Mark similarity', 'Goods proximity', 'Use', 'Enforcer', 'Link'];
 
-function findingRows(findings, fetchState) {
+function findingRows(findings, fetchState, recordLinks = null) {
   return (findings || []).map(f => {
     const regs = f?.owner?.registrations || [];
     const ctx = !!f.isContextNote;
@@ -190,7 +190,7 @@ function findingRows(findings, fetchState) {
       'Country': f.owner?.country || '',
       'Source': sourceWord(f.source?.source_type || ''),
       'Class': classCell(f),
-      'Registration(s)': regs.length ? regs.map(r => regLabel(r.uri)).join('; ') : (ctx ? '—' : '— (common-law)'),
+      'Registration(s)': regs.length ? regs.map(r => recordLinks?.get(String(r.uri || '').toLowerCase())?.label || regLabel(r.uri)).join('; ') : (ctx ? '—' : '— (common-law)'),
       'Status & key dates': statusDatesCell(f),
       'Record retrieved?': ctx ? 'n/a — noted only' : retrievedCell(f, fetchState),
       'Risk band': f.band || '—',
@@ -200,7 +200,7 @@ function findingRows(findings, fetchState) {
       'Goods proximity': ctx ? 'n/a' : meterCell(f.meters?.goods_proximity),
       'Use': ctx ? 'n/a' : meterCell(f.meters?.use),
       'Enforcer': ctx ? 'n/a' : meterCell(f.meters?.enforcer),
-      'Link': f.source?.resolved_link || '',
+      'Link': f.source?.resolved_link || linkCellFor(regs, recordLinks),   // the office's own page, or why there is none
     };
   });
 }
@@ -598,7 +598,7 @@ export async function buildAudit(contract, auditParsed, outPath, mark = '', fm =
     (row, _d, kept) => { if (kept.has('Field')) row.getCell('Field').font = { bold: true }; });
 
   // 2 · Findings — one row per conflict; registrations joined; provenance folded into the driver tags.
-  addSheet(wb, 'Findings', FINDING_COLS, findingRows(findings, fetchState), (row, _d, kept) => {
+  addSheet(wb, 'Findings', FINDING_COLS, findingRows(findings, fetchState, contract?.recordLinks instanceof Map ? contract.recordLinks : null), (row, _d, kept) => {
     if (kept.has('Link')) {
       const link = row.getCell('Link');
       const url = String(link.value || '').trim();
@@ -629,7 +629,8 @@ export async function buildAudit(contract, auditParsed, outPath, mark = '', fm =
   // never a reason to drop the Excel. (A gate that deletes the artifact it was meant to protect is the bug
   // this replaced: a legitimately-sparse run — e.g. no bound Class — must still ship its workbook.)
   await wb.xlsx.writeFile(outPath);
-  const gate = validateAudit(wb, { findings, coverage, coverageJudgment, verdict, registerOnly });
+  const gate = validateAudit(wb, { findings, coverage, coverageJudgment, verdict, registerOnly,
+    registerPublishesRecordPages: contract?.registerPublishesRecordPages ?? null });
   return {
     sheets: wb.worksheets.map(w => w.name),
     findings: findings.length,
@@ -643,7 +644,8 @@ export async function buildAudit(contract, auditParsed, outPath, mark = '', fm =
  * validateAudit — the build gate. Reads the assembled workbook back and asserts the spec's MUST-BE-TRUE list.
  * Returns { ok, violations[] }. Exported so tests assert the same contract the build enforces.
  */
-export function validateAudit(wb, { findings = [], coverage = [], coverageJudgment = null, verdict = null, registerOnly = false } = {}) {
+export function validateAudit(wb, { findings = [], coverage = [], coverageJudgment = null, verdict = null, registerOnly = false,
+  registerPublishesRecordPages = null } = {}) {
   const v = [];
   const sheets = wb.worksheets.map(w => w.name);
 
@@ -722,6 +724,13 @@ export function validateAudit(wb, { findings = [], coverage = [], coverageJudgme
       if (!textAt(findWs.getRow(r), cMark0).trim()) ghost++;
     }
     if (ghost) v.push(`Findings has ${ghost} ghost/continuation row(s) with no mark (multi-registration owners must stay on one row)`);
+    // the ordinal joins a row back to its finding's typed source; the record identity is office + number
+    const cOrd = col(findWs, '#'), cReg = col(findWs, 'Registration(s)'), cCountry = col(findWs, 'Country');
+    // ordinal → the finding's OWN typed source_type. Never pattern-matched off the Source cell, which is
+    // display text: `sourceCell` composes it and a register row can read "EUIPO" or a vendor label.
+    const srcTypeByOrdinal = new Map((Array.isArray(findings) ? findings : [])
+      .filter((f) => f?.ordinal != null)
+      .map((f) => [String(f.ordinal), String(f?.source?.source_type ?? '')]));
     const cMark = col(findWs, 'Conflicting mark'), cSrc = col(findWs, 'Source'), cTreat = col(findWs, 'How we treated it'),
       cLink = col(findWs, 'Link'), cRet = col(findWs, 'Record retrieved?'),
       cMs = col(findWs, 'Mark similarity'), cGp = col(findWs, 'Goods proximity'), cUse = col(findWs, 'Use'), cEnf = col(findWs, 'Enforcer'),
@@ -737,9 +746,37 @@ export function validateAudit(wb, { findings = [], coverage = [], coverageJudgme
       if (!cellText(cBand).trim()) v.push(`Findings "${mark}": no band/treatment marker`);
       // link resolves — but a famous-neighbour context note is knowledge-cited with no fetched record, so it
       // legitimately carries no link (its row is exempt, exactly as it is from the four-driver check below).
+      //
+      // WHAT A READER CAN DO WITH THE CITATION, not whether a URL is present. Some registers publish no
+      // per-record page at all (`hasPublicRecordUrl: false`), and for those the engine's own publish step
+      // EMPTIES any absolute record link a model wrote, because constructing a per-record URL for a
+      // register that publishes none would be a fabricated citation on a legal deliverable. Demanding an
+      // http(s) link of such a row asked for the one thing the engine is forbidden to supply, and reported
+      // the whole register layer of a delivered workbook as defective: every register finding, every run,
+      // scaling with how many register hits the matter had. So on such a run the record's IDENTITY is the
+      // citation — the registration number and the office — and a row carrying it is followable.
+      //
+      // FAIL-CLOSED IN BOTH DIRECTIONS OF DOUBT. The exemption needs a register that positively declares
+      // it has no record pages (`false`, never `null` — a legacy run with no fetch receipts cannot say
+      // what its register publishes), the row's source type to come back `register*` from the findings
+      // themselves, AND the row to actually carry the record identity. If the ordinal join misses, or the
+      // identity columns are absent from this workbook, nothing is exempt and the row is reported exactly
+      // as before.
       const linkVal = cLink ? row.getCell(cLink).value : null;
       const href = linkVal && typeof linkVal === 'object' ? linkVal.hyperlink : linkVal;
-      if (!isCtx && !/^https?:\/\//i.test(String(href ?? ''))) v.push(`Findings "${mark}": link does not resolve to http(s)`);
+      if (!isCtx && !/^https?:\/\//i.test(String(href ?? ''))) {
+        const isRegisterRow = String(srcTypeByOrdinal.get(cellText(cOrd).trim()) ?? '').startsWith('register');
+        // The identity has to be a real one. `Registration(s)` is never blank — findingRows writes the
+        // placeholder `— (common-law)` for a finding with no registrations at all — so a bare non-empty
+        // test would have exempted exactly the register row that cites nothing.
+        const regCell = cellText(cReg).trim();
+        const citesRecord = Boolean(regCell && !regCell.startsWith('—') && cellText(cCountry).trim());
+        if (registerPublishesRecordPages === false && isRegisterRow) {
+          // The register has no record page. The number and the office ARE the citation; without them the
+          // row cites nothing at all, which is a worse defect than a missing link and is named as itself.
+          if (!citesRecord) v.push(`Findings "${mark}": no record link, and no registration number + office either — nothing identifies the record`);
+        } else v.push(`Findings "${mark}": link does not resolve to http(s)`);
+      }
       // fetch-failed visibly unverified
       const ret = cellText(cRet);
       if (/not retrieved/i.test(ret) && !/unverified/i.test(ret) && !/n\/a/i.test(ret) && !/read/i.test(ret)) {
@@ -812,3 +849,8 @@ export function validateAudit(wb, { findings = [], coverage = [], coverageJudgme
 
   return { ok: v.length === 0, violations: v };
 }
+
+// Where the run's register publishes no record pages of its own, the Findings sheet shows each
+// registration's office and number and links the office's own page (office-record-links.mjs). Kept down
+// here, below every line the rest of the tree cites by number.
+import { linkCellFor } from './office-record-links.mjs';

package/driver/queue-watch-verdict.mjs

@@ -66,7 +66,7 @@ import { drainPosture, CONTINUOUS } from "./drain-posture.mjs";   // one rule ab
  */
 export function queueWatchVerdict({ queueDirs, watched, unitPath, unitError = null, resolveError = null, timer = null, worker = null } = {}) {
   // ── THE POSTURE QUESTION COMES FIRST, because after the retirement it decides whether the rest of
-  // this function is even asking about anything (; owner ruling 2026-08-26, restated
+  // this function is even asking about anything (; ruling 2026-08-26, restated
   // 2026-08-31). The arrival trigger and the timer were two halves of ONE posture. The worker drains
   // continuously under --watch, so on a box in that posture there is no arrival to trigger and no
   // schedule to wait for, and every finding below would be describing the absence of machinery this
@@ -77,7 +77,7 @@ export function queueWatchVerdict({ queueDirs, watched, unitPath, unitError = nu
   // permission error still skips — a privilege-limited read that answers "fine" is the exact failure
   // this family of checks exists to refuse, and letting a worker unit talk it into a pass would put
   // that failure back one door along.
-  // ONE RULE, NOT A SECOND COPY OF IT (tracker issue 206). This predicate used to be spelled out here
+  // ONE RULE, NOT A SECOND COPY OF IT. This predicate used to be spelled out here
   // and nowhere else, and the drainer arm — deciding the same question about the same box — did not
   // read the units at all and applied the timer-era rule instead. Both arms now consult
   // drain-posture.mjs, so a box cannot be continuous for one of them and timer-shaped for the other.

package/driver/recipe-service.mjs

@@ -250,7 +250,7 @@ const PORT = PORT_CHOICE.port;
   //
   // `makeAccessVerifier` has ALWAYS accepted issuer/jwksUrl/emailClaim — this service simply never
   // passed them, which is how one product shipped a provider-agnostic API face and three single-vendor
-  // services beside it. Owner ruling 2026-08-23: "we can't launch with an identity vendor, they bring
+  // services beside it. Ruling 2026-08-23: "we can't launch with an identity vendor, they bring
   // their own… they pick their own."
   const OIDC_ISSUER = process.env.RECIPE_OIDC_ISSUER || "";
   const JWKS_URL = process.env.RECIPE_JWKS_URL || "";

package/driver/record-carry.mjs

@@ -829,7 +829,7 @@ export function silentlyLostFindings({ reconciliation = null, carryRows = null,
 /**
  * Positions the DIGEST ended as findings that did not reach the findings, dropped WITH a stated reason.
  *
- * ── THE SIBLING'S BLIND SPOT, AND IT IS THE ONE THAT REACHED A CLIENT (tracker issue 248) ──────────
+ * ── THE SIBLING'S BLIND SPOT, AND IT IS THE ONE THAT REACHED A CLIENT ──────────────────────────────
  *
  * `silentlyLostFindings` above is correct and must not be widened to cover this. Its population is
  * `step-silent` — a finding-ending followed by silence — and its own header records why that boundary

package/driver/reference-score.mjs

@@ -667,7 +667,7 @@ export function scoreRecall({ reference, findings = [], retrieved = [], scopeCla
   // what it saw. Auto-promoting a collision to `found` would be the scorer manufacturing recall from
   // its own confusion, which is the defect one layer up from the one being fixed. score.mjs prints
   // these; a reader adjudicates.
-  // ── THE PREDICATE WAS THE OWNER, AND THE HEADING ABOVE SAYS RECORD (tracker issue 249) ──────────
+  // ── THE PREDICATE WAS THE OWNER, AND THE HEADING ABOVE SAYS RECORD ──────────────────────────────
   //
   // The only condition used to be `ownersMatch`. That implements a different class from the one the
   // paragraph above states, and the justification — "they cannot both be true" — does not hold for any

package/driver/reference-strip-signatures.mjs

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 //
-// THE TWO SIGNATURES THE REFERENCE STRIP LEFT BEHIND (tracker issue 185).
+// THE TWO SIGNATURES THE REFERENCE STRIP LEFT BEHIND.
 //
 // The strip's job was to remove internal references from this repository before it went public, and it
 // did that. Where the reference was the SUBJECT of the sentence, it took the subject with it:

package/driver/register-availability.mjs

@@ -28,7 +28,7 @@
 //     store-wide veto's GRANULARITY (refuse the scenario that does not fit, not every scenario beside
 //     it) and the door not narrowing declared coverage. Whether a matter whose ENTIRE ordered scope is
 //     unreachable on this box should start is a separate question and  did not answer it. The
-//     owner ruling of 2026-08-12 does: partial coverage discloses, empty coverage refuses by name
+//     ruling of 2026-08-12 does: partial coverage discloses, empty coverage refuses by name
 //     before spend (reachableRegions below, and the two Depth 2 preflights that read it).
 //   · resolveRegions would then classify the US as "outside the provider's coverage", which is a false
 //     sentence about the product. The free tier covers the US. This install is not configured for it.
@@ -49,8 +49,9 @@
 // read it: coverage-form.mjs seeded its deferred rows from skeleton qids alone, so an EU+US matter on a
 // box with no index shipped an EU-only clean with no row saying the US was never searched. A false
 // clean, reached through the disclosure that was supposed to prevent one, and this sentence is what
-// made it look already-handled. driver.config.mjs:789 cited it as the reason preflight could stop
-// requiring USPTO_LOCAL_DB.
+// made it look already-handled. driver.config.mjs freeTierMissing cited it as the reason preflight
+// could stop requiring USPTO_LOCAL_DB. Cited by SYMBOL and no line: the number was 84 lines above that
+// comment before anything moved, and a line citation into a file this size stales on the next edit.
 //
 // The split is still right and is unchanged. What had to be built is the consumer: coverage-form.mjs
 // now reads `plan.deferred_coverage` directly and emits an `open` row per active axis. The disclosure

package/driver/register-count.mjs

@@ -19,7 +19,7 @@
 // 2. A COUNT WE COULD NOT TAKE IS NEVER ZERO. Every failure path carries `total: null` plus a reason,
 //    and the surfaces render "not available". A provider that cannot count at all
 //    (capabilities.countProbe "none") does not degrade to zeroes: the lane REFUSES before spending
-//    anything (see countPreflight) — that is the owner ruling, and it is the difference between a
+//    anything (see countPreflight) — that is the ruling, and it is the difference between a
 //    degraded answer and a wrong one.
 //
 // 3. THE NUMBER IS NEVER BANDED. No colour, no threshold, no "high/low". The moment a count carries a
@@ -187,7 +187,7 @@ export function countPreflight({ capabilities, jurisdictions, credentialPresent
         + `read as though it covered the ones ordered. Name a territory ${id} covers, or switch the register provider.`;
     }
   }
-  // — EMPTY COVERAGE REFUSES EARLY; PARTIAL COVERAGE DISCLOSES (owner ruling, 2026-08-12).
+  // — EMPTY COVERAGE REFUSES EARLY; PARTIAL COVERAGE DISCLOSES (ruling, 2026-08-12).
   //
   // The check above is about the CONTRACT: territories the provider does not cover. This one is about
   // the BOX: territories it covers and this deployment cannot reach, because a member is unconfigured.
@@ -442,7 +442,7 @@ export async function countRegisterHits({
       // report of exactly that.
       ...(deferred.length ? { deferredScope: deferred.map((d) => d.jurisdiction) } : {}),
       // The generated set, recorded whether or not the aggregate landed: the report prints WHICH forms
-      // were checked, and a number whose forms are not on the page is unauditable (owner ruling).
+      // were checked, and a number whose forms are not on the page is unauditable (ruling).
       variants: { cap: variantCap, generated: variants.generated, truncated: variants.truncated, forms: variants.forms.map((f) => f.form) },
       ...(reusedCells === COUNT_PREDICATES.length ? { reused: true } : {}),
     };

package/driver/register-records.mjs

@@ -72,7 +72,7 @@ import { variantForms, VARIANT_CAP } from "./register-variants.mjs";
 import { recordOriginsFor } from "./record-origins.mjs";           // — provider-derived, never CLEAROTRON_DATABASE
 
 /** Records per MARK, across every listed term. A bound on cost, on artifact size and on what a reader
- *  can usefully hold — and it is stated wherever the list renders, per the owner ruling. */
+ *  can usefully hold — and it is stated wherever the list renders, per the ruling. */
 export const RECORD_CAP = 100;
 
 /** The floor on a single term's share of the cap. Without it a name generating twelve forms would give

package/driver/repair-composers.mjs

@@ -165,7 +165,7 @@ export const REPAIR_COMPOSERS = [
         `If applying a flag genuinely REQUIRES changing a finding outside that list — a knock-on the reviewer did not see — make the change and say which one and why in the "corrections" note. A silent edit outside the scope is the one thing this instruction forbids; a reasoned one is not.`,
       ) : "";
       return lines(
-        // — OWNER RULING 2026-08-09: "add caveat" is DELETED, not softened. A repair has exactly
+        // — RULING 2026-08-09: "add caveat" is DELETED, not softened. A repair has exactly
         // four moves and there is no fifth. The standing outward-language rule governs the REPAIR path
         // exactly as it governs a first draft, and this instruction was the one place the engine invited
         // a hedge into a deliverable. It fired on 4 of 4 delivered clearances in the 2026-08-09 round.

package/driver/repairs.mjs

@@ -26,7 +26,7 @@ import { driverDir } from "../shared/driver-dir.mjs";   //
 // ── the terminal kind that is not a failure ───────────────────────────────────────────────
 //
 // A REFUSAL THE PRODUCT IS DESIGNED TO MAKE. The engine did not break: an order arrived that this
-// deployment does not serve, a preflight said so before any spend, and the run stopped. Owner ruling
+// deployment does not serve, a preflight said so before any spend, and the run stopped. Ruling
 // 2026-08-13 — such a refusal must be distinguishable from a failure IN EVERY SINK IT REACHES, must
 // never feed failure statistics, and must never trigger recovery machinery.
 //
@@ -216,7 +216,7 @@ export function classifyFailureReason(reason) {
 // and a second derivation is a second answer waiting to disagree with the first.
 // ── BUILD A — WHERE THE CLASSIFICATION CAME FROM ────────────────────────────────────────────
 //
-// Owner ruling 2026-08-19: `classSource` becomes `validator-token` for a token the validator already
+// Ruling 2026-08-19: `classSource` becomes `validator-token` for a token the validator already
 // named. Budgets identical, no new class value, no lane change — `decideRecovery` takes no
 // `classSource` argument at all, so this cannot reach a budget branch even by mistake.
 //
@@ -553,7 +553,7 @@ export function countRecoveryLanes(history, { total = 0 } = {}) {
   return { weather, defect: defect + shortfall };
 }
 
-// ── CAP PARKS: A PROVIDER SAYING "NOT YET" IS NOT A STAGE FAILING (tracker issue 103) ──────────────
+// ── CAP PARKS: A PROVIDER SAYING "NOT YET" IS NOT A STAGE FAILING ──────────────────────────────────
 //
 // Owner, watching a run spend 4 of its 6 recovery parks against one subscription cap:
 //

package/driver/replay-archive.mjs

@@ -218,7 +218,7 @@ export function diffSnapshots(prev, curr) {
 function main() {
   const args = new Set(process.argv.slice(2));
   // ON-DISK NAME, NOT A PRODUCT NAME: an install that never set the variable already has this file, so
-  // renaming the default points the reader at one that does not exist. Owner ruling, tracker issue 308.
+  // renaming the default points the reader at one that does not exist. Ruling.
   const snapshotPath = process.env.CLEAROTRON_REPLAY_SNAPSHOT || join(homedir(), ".prelim-replay-snapshot.json");
   const roots = process.env.CLEAROTRON_REPLAY_ROOTS
     ? process.env.CLEAROTRON_REPLAY_ROOTS.split(":").filter(Boolean)

package/driver/report-card-record.mjs

@@ -15,7 +15,7 @@
 //
 // ── WHAT MOVES, AND THE LINE THIS CONVERSION MUST NOT CROSS ────────────────────────────────────────
 //
-// OWNER RULING S2 (2026-08-13) re-scoped rather than adopting it: "the mechanical card fields
+// RULING S2 (2026-08-13) re-scoped rather than adopting it: "the mechanical card fields
 // (headings, ids, links, driver-stamped values) move to code NOW — uncontested. The prose half is
 // decided by EVIDENCE: after config #40 lands, build one matter both ways and the owner reads the two
 // cards side by side. If the rendered card reads worse, the model pass stays, on typed inputs."

package/driver/result-noun-fields.mjs

@@ -61,6 +61,11 @@ export const RESULT_NOUN_FIELDS = Object.freeze([
     why: "counts read off the coverage/placement unions" },
   { file: "driver/pipeline-knockout.mjs", noun: "recovered", sites: 1, atWriteSite: 1, verdict: "result",
     why: "written after the chunk files were actually removed" },
+  { file: "driver/pipeline-knockout.mjs", noun: "outcome", sites: 3, atWriteSite: 3, verdict: "result",
+    why: "the reviewing pass's own verdict on itself, read at each writing site: `nothing-flagged` after "
+      + "the measurement came back empty, `applied` after the rewrite passed the merged gate and was "
+      + "written, and the `keep()` forms after the artifact or the gate refused it. Every one is a fact "
+      + "about what already happened to the record, never the return of the call being logged" },
   { file: "driver/pipeline.mjs", noun: "closed", sites: 6, atWriteSite: 4, verdict: "result",
     why: "closure counts derived from the landed set (`qids.filter(q => landed.has(q)).length`) and from the receipt" },
   { file: "driver/pipeline.mjs", noun: "executed", sites: 4, atWriteSite: 3, verdict: "result",

package/driver/roster-verdict.mjs

@@ -29,9 +29,13 @@
  * @param {string[]|null} o.onDisk   keys in the configured store, sorted — null when none is configured
  * @param {string[]} o.bundledDemos  the roster shipped in the product repo, sorted
  * @param {boolean} o.expectDemos    CLEAROTRON_E2E_EXPECT_DEMO_ROSTER=1 — "this instance is allowed to break"
+ * @param {{readable: boolean, accounts: string[]|null}} [o.caller]
+ *                                   the claims of the key the door was asked with, in opsTokenPosture's
+ *                                   shape. ABSENT, or `accounts: null`, means uncapped — every account — the
+ *                                   way triggerCapGap reads a null cap. Never an empty one.
  * @returns {{state: "pass"|"fail"|"skip", message: string}}
  */
-export function rosterVerdict({ keys, onDisk, bundledDemos, expectDemos }) {
+export function rosterVerdict({ keys, onDisk, bundledDemos, expectDemos, caller }) {
   const sameSet = (a, b) => a.length === b.length && a.every((k, i) => k === b[i]);
   const isBundled = sameSet(keys, bundledDemos);
 
@@ -40,17 +44,56 @@ export function rosterVerdict({ keys, onDisk, bundledDemos, expectDemos }) {
     return { state: "skip", message: "the session resolved zero accounts — this probe is unscoped for this door, so the roster is NOT probed rather than failed" };
 
   if (onDisk) {
-    if (!sameSet(keys, onDisk))
-      return { state: "fail", message: `the door sees ${keys.length} customer(s), the configured store holds ${onDisk.length} — they disagree`
-        + (isBundled ? ". The door resolved exactly the bundled demo roster, so this is #83: CLEAROTRON_CUSTOMERS_DIR is not reaching the service" : "") };
+    // THE DOOR ANSWERS FOR THE KEY THAT ASKED. `list_profiles` is narrowed to the caller's account cap,
+    // so a key minted before a company existed does not list it, and correctly. Compared with the whole
+    // store, that read as the door and the store disagreeing, and the message below then pointed at a
+    // stale roster (measured in testing, 2026-09-10). So the store is narrowed by the same cap before the
+    // two are compared; a company outside the cap is the key's gap, which the caller reports on its own line.
+    const unreadable = caller?.readable === false;
+    const cap = !unreadable && Array.isArray(caller?.accounts) ? caller.accounts : null;
+    const expected = cap ? onDisk.filter((k) => cap.includes(k)) : onDisk;
+    if (!sameSet(keys, expected) && unreadable)
+      // A KEY WHOSE CLAIMS CANNOT BE READ may be narrowing the answer, and a narrowing looks exactly like a
+      // door that disagrees with its store. Neither passed nor failed: not compared, and said so.
+      return { state: "skip", message: `the door sees ${keys.length} customer(s) (${keys.join(", ")}), `
+        + `the configured store holds ${onDisk.length} (${onDisk.join(", ")}), and the claims of the key this `
+        + "check asked with could not be read — so a narrowing by that key cannot be told from a door that "
+        + "disagrees with its store. NOT compared" };
+    if (!sameSet(keys, expected))
+      return { state: "fail", message: `the door sees ${keys.length} customer(s) (${keys.join(", ")}), `
+        + `the configured store holds ${onDisk.length} (${onDisk.join(", ")})`
+        + (cap ? `, ${expected.length} of them within the cap of the key this check asked with` : "")
+        + " — they disagree"
+        // THE CAUSE IS NOT DERIVABLE FROM THIS COMPARISON, and it used to be asserted anyway. `isBundled`
+        // is a set equality over NAMES, and a configured store ordinarily CONTAINS the bundled demo
+        // names — so "the door resolved exactly the bundled roster" is equally true of a door with no
+        // store and of a door whose store simply has not gained the newest company yet. Measured
+        // 2026-09-09: a company added to the configured store minutes earlier, a door still holding the
+        // roster it read at boot, and this line reporting a variable that was reaching the service
+        // perfectly well. What the check can see is the two lists; which of the two causes produced them
+        // is a question for whoever reads it.
+        + (isBundled
+          ? ". The door's set is name-identical to the bundled demo roster, which this comparison cannot "
+            + "tell apart from a configured store carrying those same names: it is consistent BOTH with "
+            + "CLEAROTRON_CUSTOMERS_DIR not reaching the service AND with the door still holding a roster "
+            + "it read before the store changed. Check the door's environment and when it last read the store."
+          : "") };
     return { state: "pass", message: `${keys.length} customer(s), matching the configured store`
+      + (cap && expected.length < onDisk.length
+        ? ` within the cap of the key this check asked with (${expected.length} of ${onDisk.length})` : "")
       + (expectDemos ? " — and this instance declares itself a test box, which the store's own CI keeps free of real client bundles" : "") };
   }
 
   if (isBundled && expectDemos)
     return { state: "pass", message: `the bundled demo roster (${keys.join(", ")}) — correct for a test instance with no configured store, which must never see real client bundles` };
   if (isBundled)
-    return { state: "fail", message: `the door resolved exactly the bundled demo roster (${keys.join(", ")}) — this is #83: CLEAROTRON_CUSTOMERS_DIR is not reaching the service, and every real customer will be refused` };
+    // NO STORE IS VISIBLE TO THIS PROCESS, so unlike the branch above there is no second list to print
+    // and the fallback reading is the likeliest one. It is still a reading: this process not holding
+    // CLEAROTRON_CUSTOMERS_DIR is not proof the service does not, and the comparison is over names a
+    // configured store would also carry. Named as the probable cause rather than the established one.
+    return { state: "fail", message: `the door resolved ${keys.length} account(s) name-identical to the bundled demo roster (${keys.join(", ")}), `
+      + `and no configured store is visible from here to compare against — most likely CLEAROTRON_CUSTOMERS_DIR is not reaching the service, `
+      + `in which case every real customer will be refused. Confirm at the door's own environment before acting: a store holding these same names would look identical here` };
   if (expectDemos)
     return { state: "fail", message: `CLEAROTRON_E2E_EXPECT_DEMO_ROSTER=1 says this is a test instance with no configured store, but the door resolved ${keys.length} NON-demo customers — real client config has reached an instance that must not have it` };
   return { state: "pass", message: `${keys.length} customers (no CLEAROTRON_CUSTOMERS_DIR in THIS process to compare against)` };

package/driver/run-activity.mjs

@@ -52,7 +52,7 @@ export function readActivity(ledgerPath, { limit = 50, now = Date.now(), staleAf
     if (!Number.isFinite(tsMs) || nowMs - tsMs <= staleAfterMs) return r;     // fresh (or undatable) → leave as-is
     return { ...r, state: "failed", stale: true, note: r.note || "no terminal record — presumed interrupted (stale)" };
   };
-  // Presentation retire (2026-07-06 owner steer — same reversible pattern as run rows /): the
+  // Presentation retire (2026-07-06 steer — same reversible pattern as run rows /): the
   // ledger stays append-only — APPEND a record with the same id carrying `retired: true` to hide the
   // row from every activity surface; append another without it to resurface. Forensics untouched.
   return [...byId.values()].filter((r) => r.retired !== true).map(reap).sort((a, b) => String(b.ts || "").localeCompare(String(a.ts || ""))).slice(0, limit);