clearotron 0.2.4 → 0.3.0-beta.1

package/driver/run-requirements.mjs

@@ -57,7 +57,7 @@
 //
 // ── AND WHEN EACH ONE IS ASKED FOR, WHICH IS A SECOND AXIS AND NOT THE SAME ONE ─────────────────────
 //
-// Owner ruling 2026-09-06, in session: "someone can install and select key later so it should still
+// Ruling 2026-09-06, in session: "someone can install and select key later so it should still
 // start." So a hosted install comes up with no register configured — the doors answer, the portal
 // answers, and the box is a working install waiting for one value.
 //
@@ -186,13 +186,26 @@ export function missingRequirements(env = {}, tables = {}) {
  *
  * Returns null when nothing blocks, so a caller cannot mistake "configured" for "could not look".
  */
-export function orderTimeRefusal(env = {}, tables = {}, { envFile = null } = {}) {
+export function orderTimeRefusal(env = {}, tables = {}, { envFile = null, readFile = null } = {}) {
   const missing = missingRequirements(env, tables).atOrder;
   if (!missing.length) return null;
   const names = missing.map((r) => r.name);
-  const where = envFile
-    ? ` Set them in ${envFile} and restart, or run \`clearotron install\` in a terminal, which writes them for you.`
-    : " Run `clearotron install` in a terminal to configure them, or set them in the file this install's units read.";
+  // EVERY FILE THAT REACHES THIS RUN, EACH NAMED BY WHAT READS IT — the rule `bin/start.mjs` already
+  // follows, for the reason it gives: two copies of this sentence is how one of them comes to name a file
+  // the reader cannot use. This copy named only `envFile`, the file background units read. A runner
+  // started from a terminal on a box with no units reads the install's own file instead, so its operator
+  // was told to create a file nothing on that box reads — and the one actually read went unnamed.
+  // `readFile` is the file THIS process loaded at start; it is null under a unit, where the unit's own
+  // EnvironmentFile is the only configuration and `envFile` alone is the true answer.
+  const cmd = "`clearotron install` in a terminal, which writes them for you";
+  const both = readFile && envFile && readFile !== envFile;
+  const one = readFile || envFile;
+  const where = both
+    ? ` Set them in either of these — both reach a run:\n      ${readFile} — the file this runner read when it started\n`
+      + `      ${envFile} — the file background units read\n  then restart, or run ${cmd}.`
+    : one
+      ? ` Set them in ${one} and restart, or run ${cmd}.`
+      : " Run `clearotron install` in a terminal to configure them, or set them in the file this install's units read.";
   return {
     names,
     operator: `this installation cannot run a search yet — it is installed but not configured:\n`

package/driver/runner.mjs

@@ -29,7 +29,7 @@ import { driverDir, ensureDriverDir } from "../shared/driver-dir.mjs";   // —
 import { isLiveQueueMarker, PROSE_PARTS, CLAIM_SIDECAR_SUFFIXES, TERMINAL_QUEUE_SUFFIXES } from "./queue-markers.mjs";
 import { matterLedgerPath } from "./usage-ledger.mjs";   // ONE ledger-path calculation, shared with the portal pre-check
 import { orderTimeRefusal } from "./run-requirements.mjs";   // one authority for what a run needs, and when it is asked for
-import { unitEnvPath } from "../shared/env-local.mjs";   // the file the units read, named by its one author
+import { unitEnvPath, envFileRead } from "../shared/env-local.mjs";   // the file the units read, named by its one author
 import { fileURLToPath } from "node:url";
 import { config, preflightDeploymentUrls } from "./driver.config.mjs";
 import { deriveSlug, todayISO, mintFreshCodename } from "./phase0.mjs";
@@ -237,10 +237,15 @@ function recordMatter(qdir, entry) {
 // any account that needs a different number says so in its own runCaps block.
 export const DEFAULT_CLIENT_DAILY_RUNS = 20;
 
-export function checkRunCaps({ account, caps, queueDirs, inHandTagged = true, now = Date.now(), clientRun = false }) {
-  // `generic` is the neutral no-customer profile and stays exempt: it is not a brand owner, and capping it
-  // would put a ceiling on staff/email work that was never client-attributed.
-  if (!account || account === "generic") return null;
+export function checkRunCaps({ account, caps, queueDirs, inHandTagged = true, now = Date.now(), clientRun = false, organisation = null }) {
+  // GENERIC IS CAPPED LIKE ANY COMPANY, one lane per organisation (ruling 2026-09-10: "every
+  // organisation's Generic lane carries the daily cap; the exemption goes"). A Generic run counts in the
+  // lane of the organisation it was filed under and nowhere else, so one organisation's day cannot use up
+  // another's. What stays uncapped is what was never client-attributed — a job with no `clientRun` stamp:
+  // a person with access to everything, the email door, the CLI — exactly as for a company.
+  if (!account) return null;
+  const inLane = (key, org) => (key ?? null) === account && (account !== "generic" || (org ?? null) === organisation);
+  const lane = account === "generic" ? (organisation ? `Generic for ${organisation}` : "Generic") : account;
   // The default applies to the DAILY allowance only. maxQueued/monthlyRuns stay opt-in per profile.
   const eff = Number.isInteger(caps?.dailyRuns) ? caps : { ...(caps ?? {}), dailyRuns: DEFAULT_CLIENT_DAILY_RUNS };
   caps = eff;
@@ -252,7 +257,7 @@ export function checkRunCaps({ account, caps, queueDirs, inHandTagged = true, no
       let files = [];
       try { files = readdirSync(qd).filter(isLiveQueueMarker); } catch { continue; }
       for (const f of files) {
-        try { if ((JSON.parse(readFileSync(join(qd, f), "utf8")).profileKey ?? null) === account) queued++; }
+        try { const j = JSON.parse(readFileSync(join(qd, f), "utf8")); if (inLane(j.profileKey, j.tenant)) queued++; }
         catch { /* mid-rename / prose sidecar — skip */ }
       }
     }
@@ -261,7 +266,7 @@ export function checkRunCaps({ account, caps, queueDirs, inHandTagged = true, no
     // the uniform +1 admitted untagged jobs one over the cap).
     const inFlight = queued + (inHandTagged ? 0 : 1);
     if (inFlight > caps.maxQueued) {
-      return `admission cap: ${account} already has ${inFlight - 1} run(s) queued/in-flight (runCaps.maxQueued=${caps.maxQueued}) — wait for the backlog to drain or cancel one (stop_run), then re-send`;
+      return `admission cap: ${lane} already has ${inFlight - 1} run(s) queued/in-flight (runCaps.maxQueued=${caps.maxQueued}) — wait for the backlog to drain or cancel one (stop_run), then re-send`;
     }
   }
   // dailyRuns — the beta allowance, and the ONLY cap that counts a subset of runs rather than all of
@@ -292,23 +297,23 @@ export function checkRunCaps({ account, caps, queueDirs, inHandTagged = true, no
         // So a client whose runs keep failing is bounded by the MONTHLY cap, not the daily one — which
         // is why a monthlyRuns value is worth setting on any account this matters for.
         if (e.failed === true) continue;
-        if (e.profileKey === account && e.clientPrincipal === true
+        if (inLane(e.profileKey, e.organisation) && e.clientPrincipal === true
           && typeof e.ts === "number" && new Date(e.ts).toISOString().slice(0, 10) === dayKey) today++;
       }
     }
     if (today + 1 > caps.dailyRuns) {
-      return `daily allowance: ${account} has started ${today} search(es) today (runCaps.dailyRuns=${caps.dailyRuns}) — the allowance resets at midnight UTC, or ask your ${BRAND.name} contact to run this one for you`;
+      return `daily allowance: ${lane} has started ${today} search(es) today (runCaps.dailyRuns=${caps.dailyRuns}) — the allowance resets at midnight UTC, or ask your ${BRAND.name} contact to run this one for you`;
     }
   }
   if (Number.isInteger(caps.monthlyRuns)) {
     let month = 0;
     for (const qd of queueDirs) {
       for (const e of readMatterLedger(qd)) {
-        if (e.profileKey === account && typeof e.ts === "number" && new Date(e.ts).toISOString().slice(0, 7) === monthKey) month++;
+        if (inLane(e.profileKey, e.organisation) && typeof e.ts === "number" && new Date(e.ts).toISOString().slice(0, 7) === monthKey) month++;
       }
     }
     if (month + 1 > caps.monthlyRuns) {
-      return `admission cap: ${account} has started ${month} run(s) this month (runCaps.monthlyRuns=${caps.monthlyRuns}) — the cap resets at month end; raise it in the customer profile if this is intended growth`;
+      return `admission cap: ${lane} has started ${month} run(s) this month (runCaps.monthlyRuns=${caps.monthlyRuns}) — the cap resets at month end; raise it in the customer profile if this is intended growth`;
     }
   }
   return null;
@@ -742,7 +747,7 @@ async function backstopFailureNotice({ res, job, agentId, base, codename, studio
 // parked/failed-at-intake, or the claim was lost.
 // ── THE ORDER-TIME REFUSAL, AND WHY IT IS HERE ──────────────────────────────────
 //
-// A hosted install now STARTS with no register configured (owner ruling 2026-09-06: "someone can install
+// A hosted install now STARTS with no register configured (ruling 2026-09-06: "someone can install
 // and select key later so it should still start"). The protection that used to live in
 // `clearotron start --background` moves here — it does not go away.
 //
@@ -851,7 +856,7 @@ async function claimAndPrep(jsonFile, qdir, agentId) {
   }
   // ── IS THIS BOX CONFIGURED TO SEARCH AT ALL? See the header above claimAndPrep.
   {
-    const refusal = orderTimeRefusal(process.env, await runTables(), { envFile: unitEnvPath() });
+    const refusal = orderTimeRefusal(process.env, await runTables(), { envFile: unitEnvPath(), readFile: envFileRead() });
     if (refusal) {
       note(`[runner] ${base} REFUSED at order time — this install is not configured to run a search: ${refusal.names.join(", ")}`);
       await failAtIntake(procPath, qdir, base, agentId, job,
@@ -977,7 +982,8 @@ async function claimAndPrep(jsonFile, qdir, agentId) {
   // clarifies before any spend and before the matter is recorded.
   if (!effProfile) note(`[runner] ${base} run-caps skipped — profile resolution errored, caps not evaluable for this admission (fail-open by doctrine, logged for visibility)`);
   const capMsg = checkRunCaps({ account: effProfile?.key ?? null, caps: effProfile?.runCaps, queueDirs: config.queueDirs,
-    inHandTagged: Boolean(job.profileKey), clientRun: job.clientPrincipal === true });
+    inHandTagged: Boolean(job.profileKey), clientRun: job.clientPrincipal === true,
+    organisation: typeof job.tenant === "string" && job.tenant ? job.tenant : null });
   if (capMsg) {
     note(`[runner] ${base} ${capMsg}`);
     await failAtIntake(procPath, qdir, base, agentId, job, { classify: "clarify", errors: [capMsg] }, [capMsg]);
@@ -1005,7 +1011,10 @@ async function claimAndPrep(jsonFile, qdir, agentId) {
     }
   }
   recordMatter(qdir, { sig, conversationId, msgId: job.msgId, id: job.id, ts: dupNow,
-    ...(effProfile?.key && effProfile.key !== "generic" ? { profileKey: effProfile.key } : {}),
+    // Generic is tagged too, with the organisation whose lane it counts in. An untagged Generic row
+    // counted towards nothing, which was the exemption the owner's 2026-09-10 ruling removed.
+    ...(effProfile?.key ? { profileKey: effProfile.key } : {}),
+    ...(effProfile?.key === "generic" && typeof job.tenant === "string" && job.tenant ? { organisation: job.tenant } : {}),
     // positive-only, and it is what tomorrow's daily count reads. A run that omits it is a staff,
     // email or CLI run and never consumes a client's allowance.
     ...(job.clientPrincipal === true ? { clientPrincipal: true } : {}),

package/driver/search-policy.mjs

@@ -263,8 +263,8 @@ export const PRODUCT_POLICIES = {
       // not run is a search that did not happen, and this row was the shortest of the three.
       //
       // WORLDWIDE (global-preliminary-search) IS DELIBERATELY LEFT AT 1 and that is now an inversion: the
-      // broader product gets the weaker recall follow-up. The ruling named this product, and widening an
-      // owner ruling to the most expensive product is not mine to do. Raised as a question rather than
+      // broader product gets the weaker recall follow-up. The ruling named this product, and widening a
+      // ruling to the most expensive product is not mine to do. Raised as a question rather than
       // assumed —.
       recallFollowupMax: 2,
       envelopeRounds: "as-today",
@@ -584,7 +584,7 @@ export function gateResolvedPolicy(resolved, { built = BUILT, registerTerritorie
  */
 export function productAvailability(policy, { built = BUILT, registerCanCount = null, registerTerritories = undefined, geography = null, demo = false } = {}) {
   if (!policy) return "unbuilt";
-  // ── — A DEMO NO LONGER REFUSES A PRODUCT (owner ruling, 2026-08-31) ──────
+  // ── — A DEMO NO LONGER REFUSES A PRODUCT (ruling, 2026-08-31) ──────
   //
   // `demo` used to return FIRST, before every other cause, and greyed all four products with a sentence
   // about credentials. That implemented the ruling of 14:44 that day, which the owner superseded at
@@ -615,7 +615,7 @@ export function productAvailability(policy, { built = BUILT, registerCanCount =
   // or unrestricted coverage returns null there — this arm cannot fire on a snapshot that says nothing.
   if (geography) {
     const cause = registerCoverageCause(geography, registerTerritories);
-    // ── — COVERAGE IS DISCLOSED, NEVER REFUSED (owner ruling, 2026-08-31) ──
+    // ── — COVERAGE IS DISCLOSED, NEVER REFUSED (ruling, 2026-08-31) ──
     //
     // "A user could still run global and just be aware of the limitations — I prefer that than switch
     // it off." The gate removed the product instead, and it was the ONE place in this system that
@@ -632,7 +632,7 @@ export function productAvailability(policy, { built = BUILT, registerCanCount =
     //
     // `register-cannot-count` is ruled explicitly out of scope on that issue: a register that cannot
     // return counts cannot produce the search's core output, which is a capability gap.
-    // ── D6 (owner ruling, 2026-09-02) — AND THE OTHER COVERAGE CAUSE TOO ────
+    // ── D6 (ruling, 2026-09-02) — AND THE OTHER COVERAGE CAUSE TOO ────
     //
     // "Disclosure yes, in line with the picker." The picker offers a territory the register cannot
     // reach and says so at the control; a product refused for the same fact was the last place the two
@@ -678,7 +678,7 @@ export function productAvailability(policy, { built = BUILT, registerCanCount =
  */
 export const UNAVAILABLE_NOTE = {
   unbuilt: "Not part of the current release.",
-  // `demo` IS DELETED FROM THIS MAP (owner ruling 2026-08-31 14:47), and
+  // `demo` IS DELETED FROM THIS MAP (ruling 2026-08-31 14:47), and
   // deleting it is what makes the reversal structural rather than a filter somebody can undo by
   // accident. Every client-facing surface renders a product's refusal as `UNAVAILABLE_NOTE[cause]`;
   // while a sentence sat here for a demo, the greyed control was one `return "demo"` away from coming
@@ -692,7 +692,7 @@ export const UNAVAILABLE_NOTE = {
   // a baked-in provider name, no CLEAROTRON_* string in scope here, and it says the one thing a reader can
   // act on — this is a coverage limit, so a newer version will not fix it.
   //
-  // `register-not-worldwide` IS DELETED FROM THIS MAP (owner ruling
+  // `register-not-worldwide` IS DELETED FROM THIS MAP (ruling
   // 2026-08-31), and deleting it is what makes the ruling structural rather than a filter somebody can
   // reverse by accident. Every client-facing surface renders a product's refusal as
   // `UNAVAILABLE_NOTE[cause]`; while a sentence sat here for that cause, the ruling held only as long as
@@ -701,7 +701,7 @@ export const UNAVAILABLE_NOTE = {
   // visible edit to a map with this paragraph above it. The cause itself still exists and is still
   // computed: `coverageDisclosure` below keys on it, and says what the register DOES reach.
   //
-  // `register-coverage` IS DELETED TOO (owner ruling D6, 2026-09-02: "disclosure yes, in line with the
+  // `register-coverage` IS DELETED TOO (ruling D6, 2026-09-02: "disclosure yes, in line with the
   // picker"). It was the last place a coverage fact could still refuse a product, which is the
   // disagreement between the two controls that the ruling on this issue forbids. Same structural move
   // as its sibling and for the same reason: with no sentence here there is nothing for a door to

package/driver/senior-rights.mjs

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
-// senior-rights.mjs — "verify the right that matters" (WP-receipts, 2026-07-05 owner steer).
+// senior-rights.mjs — "verify the right that matters" (WP-receipts, 2026-07-05 steer).
 //
 // The VENZY reference case: the lead conflict was ONE finding backed by NINE registrations of the same
 // mark (Türkiye, UAE, Saudi, …). The run fetched exactly one leg — the top-scoring UAE 2015 filing —

package/driver/skills/prelim-search/delivery-contract.md

@@ -44,7 +44,7 @@ never even given. The card's FRAME (the head, `- ord:`, `- group:`, `- source:`,
 already the driver's from the 2026-08-16 frame conversion, and the entries above described it for a
 reader rather than ordering anyone to type it.
 
-**What did NOT move, and must not be finished by a later reader:** the card's PROSE. Owner ruling S2
+**What did NOT move, and must not be finished by a later reader:** the card's PROSE. Ruling S2
 (2026-08-13) re-scoped the proposal rather than adopting it — the mechanical fields move now, and whether the
 analysis itself should be rendered is decided by EVIDENCE, one matter built both ways and read side by
 side. The transport carries the seat's sentences; it does not write them.

package/driver/skills/prelim-search/risk-framework-triage.md

@@ -10,21 +10,24 @@
 ## Band meanings (triage grain)
 
 ### Very High
-Obvious major blocker.
+
+- **Triage read.** Obvious major blocker.
 
 ### High
-Significant conflicts — same format as Medium, more urgent. Reserved for dominant, well-resourced,
-known-to-enforce rights holders.
+
+- **Triage read.** Significant conflicts — same format as Medium, more urgent. Reserved for dominant, well-resourced, known-to-enforce rights holders.
 
 ### Medium
-Material findings that need attention. List adverse parties with dispute context.
+
+- **Triage read.** Material findings that need attention. List adverse parties with dispute context.
 
 ### Manageable
-Minor findings, no strong claims. Flag major competitors/brand owners if relevant. The floor for any
-common English phrase.
+
+- **Triage read.** Minor findings, no strong claims. Flag major competitors/brand owners if relevant. The floor for any common English phrase.
 
 ### Low
-No issues found. Available only for coined/fanciful terms (calibration rule 3).
+
+- **Triage read.** No issues found. Available only for coined/fanciful terms (calibration rule 3).
 
 ## Calibration rules (they override gut instinct — reviewer-derived)
 

package/driver/stages-knockout.mjs

@@ -14,13 +14,14 @@ import { kebab } from "./search-policy.mjs";
 // re-deriving it. A third copy is what put the knockout frame a class behind the intake.
 import { requestNamesClasses } from "./enqueue-schema.mjs";
 import { knockoutAssessChunkFile } from "./knockout-assess-record.mjs";
+import { knockoutReviewFile, validateKnockoutReviewFile } from "./knockout-review-record.mjs";
 export { kebab };   // one definition (search-policy) — re-exported for the lane's existing imports
 
 const lines = (...xs) => xs.filter(Boolean).join("\n");
 const reads = (skillReads) => `First, read and follow exactly: ${skillReads.join(", ")}.`;
 
 /**
- * One line per owner the driver looked up, for the assess dispatch (tracker issue 276).
+ * One line per owner the driver looked up, for the assess dispatch.
  *
  * BOTH OUTCOMES ARE NAMED, and that is the point. A row whose search answered gets its payload path; a
  * row whose search did NOT answer says so in the dispatch itself. Listing only the answered ones would
@@ -51,6 +52,9 @@ export function koPaths(runDir) {
     plan: join(runDir, "knockout-plan.json"),
     findings: join(runDir, "knockout-findings.json"),
     assessment: join(runDir, "knockout-assessment.md"),
+    // The reviewing pass's record of what it rewrote and what it let stand. At the RUN ROOT, like the
+    // assess chunks and for the same reason: it is a model output, and `_driver/` is behind a deny hook.
+    review: knockoutReviewFile(runDir),
     // Depth 2: the code-authoritative count sidecar + its per-call receipts. Both live under
     // _driver/ — they are the driver's own measurements, never a model's output.
     registerCounts: driverDir(runDir, "register-counts.json"),
@@ -63,8 +67,7 @@ export function koPaths(runDir) {
     // rows were left exactly as they were rather than gaining a matching marker: their shape is pinned
     // byte-for-byte by register-count.test.mjs, and a discriminator only one side needs is enough.
     registerRecords: driverDir(runDir, "register-records.json"),
-    // The scoped owner lookups this run owes its promoted filings, and their receipts (tracker issue
-    // 276). Both under `_driver/` because both are the DRIVER's own measurement of a call it made — the
+    // The scoped owner lookups this run owes its promoted filings, and their receipts. Both under `_driver/` because both are the DRIVER's own measurement of a call it made — the
     // rule stated fourteen lines above. The seat reads the payloads under research/, never these.
     ownerChecks: driverDir(runDir, "owner-checks.json"),
     ownerCheckLedger: driverDir(runDir, "owner-check.jsonl"),
@@ -98,6 +101,9 @@ export function koPaths(runDir) {
     // back to this and nothing ever writes it again. Delete once no resumable run predates the move.
     assessChunkLegacy: (n) => driverDir(runDir, `knockout-assess-${n}.json`),
     instructedScope: driverDir(runDir, "instructed-scope.json"),
+    // as on the clearance lane, and apart from instructed-scope.json for the same reason: the frame
+    // quotes that file's values verbatim. Written at intake, read by no stage.
+    defaultTerritories: driverDir(runDir, "default-territories.json"),
     emailBody: join(runDir, "email-body.md"),
   };
 }
@@ -318,7 +324,7 @@ export const KO_STAGES = {
       existsSync(K.registerRecords)
         ? `THE REGISTER FILINGS THIS RUN ALREADY FETCHED — ${K.registerRecords}. Real records, retrieved before you started: owner, jurisdiction, status, classes, dates. Read them and WEIGH them for the marks you are rating. A registration on this list is evidence about the name it names — treat its owner, its scope and its vulnerability the way the firm-wide reasoning tells you to (revocability above the lowest band; an enforcer's portfolio profile; a crowd as a mitigant under its gating precondition). What you may NOT do is describe the lane that fetched them — see the coverage rule below.`
         : "",
-      // ── WHAT THE OWNER ACTUALLY SELLS, ALREADY SEARCHED (tracker issue 276) ────────────────────────
+      // ── WHAT THE OWNER ACTUALLY SELLS, ALREADY SEARCHED ────────────────────────────────────────────
       //
       // The defect this closes is not that the seat lacked an instruction — it is that the seat had no
       // way to know. It was handed an owner's NAME and its class numbers and nothing else, so a read
@@ -386,7 +392,7 @@ export const KO_STAGES = {
       // source, never a regex over rendered prose.
       // ── THE PER-MARK OPENING ASSESSMENT ──────────────────────────────────────
       //
-      // Owner ruling, 2026-08-26: a batch client gets the same kind of opening paragraph a single-mark
+      // Ruling, 2026-08-26: a batch client gets the same kind of opening paragraph a single-mark
       // client gets, MODEL-AUTHORED and at full length — "the most useful piece of pre-triage; I don't
       // see why we constrain it; 4× longer like the single mark seems fine."
       //
@@ -397,7 +403,7 @@ export const KO_STAGES = {
       // ADDITIONAL TO `chunkSummary`, NOT A REPLACEMENT. The cross-mark paragraph still exists and still
       // owns the grouped page — the two are different documents for different readers, and collapsing
       // them is what produced the blank.
-      // ── STRUCTURE, AND A SCALE THAT HOLDS (tracker issues 1934 and 2056) ──────────────────────────
+      // ── STRUCTURE, AND A SCALE THAT HOLDS ─────────────────────────────────────────────────────────
       //
       // Owner, 2026-08-31, reading a delivered run: the per-mark opening was "now HUGE and formatted
       // even worse — no newlines, borderline not a summary". Measured on that run: 2,875 characters,
@@ -485,4 +491,64 @@ export const KO_STAGES = {
         : `As a CONTINUATION chunk you send \`marks\` and \`chunkSummary\` only — batch and framework came from chunk 1.`,
     ),
   },
+
+  // ── THE REVIEWING PASS ──────────────────────────────────────────────────────
+  //
+  // The third stage, after assess. It rewrites the lines a reader meets before opening anything, in the
+  // words that reader already owns, and it does nothing else.
+  //
+  // SMALLER THAN THE STAGE IT COPIES, DELIBERATELY. The clearance lane's refutation stage re-derives the
+  // headline, audits the plan and grades corrections; this one is handed a list of lines and returns
+  // replacements for the ones it agrees are wrong. It has no verdict, no band, no evidence and no
+  // decision. Copying that stage's SHAPE was the design; copying its size would have made a rewrite pass
+  // into a second reviewer, on a product that screens rather than clears.
+  //
+  // NOT THE PRE-DELIVERY LINT, AND THIS IS THE REASON. That lint is deterministic and its own header
+  // states what happens to a failing check: it ships as a visible flag at the top of the client's report.
+  // That is a disclosure, and putting a note about the lawyer's vocabulary on the client's own page is
+  // the opposite of the intent, on the surface the rule exists to protect. The lint is the right
+  // instrument for a mechanical defect and the wrong one for a rewrite.
+  //
+  // MODEL AND EFFORT. Opus at high, like the two stages before it. A rewrite that keeps every fact while
+  // changing the register is the same judgment the rating seats make, and the whole value of the pass is
+  // that the replacement reads better than what it replaced. A cheaper rung would produce replacements
+  // nobody would ship, which is a pass that runs and achieves nothing.
+  "knockout-review": {
+    model: "opus", thinking: "high", timeoutSec: 600, stallSec: 420,
+    // DECLARATIVE ONLY on this lane, exactly as the assess stage records: nothing in koStage reads
+    // `skillReads`, and the effective read is the `reads([...])` call in the message below. The two are
+    // edited together and the asymmetry is written down rather than left to be discovered.
+    skillReads: ["skills/prelim-search/report-prose.md"],
+    out: (K) => K.review,
+    validate: validateKnockoutReviewFile,
+    // ── THE MESSAGE PROMISES A TABLE ONLY WHEN IT HAS ONE ──────────────────────────
+    //
+    // `evidenceLines` is the driver's measurement, passed at dispatch. Two things follow, and the arms
+    // found both: the defaults must not be absent — a message that throws on a ctx without them cannot
+    // be composed by anything except the production call site, which is how a dispatch goes unexamined
+    // — and the promise has to branch. A stage message that says "the lines are below" and then lists
+    // none has handed the seat an absence dressed as a pass, which is the reading this whole rule
+    // exists to stop. The driver does not dispatch on an empty measurement; the branch is here because
+    // "it cannot happen" is not a property a message should depend on.
+    message: ({ K, evidenceLines = [], exclusionNote = "" }) => lines(
+      reads(["skills/prelim-search/report-prose.md"]),
+      `You are the REVIEWING PASS on a knockout screen. The batch is already rated and nothing about that rating is yours to change. Your job is the words.`,
+      `THE RULE. A line a reader meets before opening anything carries no legal or engine vocabulary and no sentence longer than 25 words. Inside a fold the lawyer's words are allowed where a plain one would lose precision; on a default-visible line they are not. The reader here is the client of the lawyer who ordered this screen, and they read the same page.`,
+      `The rated record: ${K.findings}. Read it — the lines named below are quoted from it and you are rewriting them in place.`,
+      evidenceLines.length
+        ? `THE DRIVER MEASURED THESE LINES. Each row is the line, the ADDRESS that names it, and what a deterministic read found. THIS IS EVIDENCE, NOT A VERDICT: judge each in context and pass over any where the word is the subject rather than the profession's shorthand. ${exclusionNote}`
+        : `THE DRIVER'S READ FLAGGED NO LINE ON THIS RECORD, so there is no table below and nothing here is evidence of a fault. Read the record yourself against the rule above; if it is already plain, send one \`declined\` row saying so rather than inventing a rewrite to fill the call.`,
+      ...evidenceLines,
+      // ── THE DICTATION NAMES THE FIELD, NOT AN EFFECT ────────────────────────────────
+      //
+      // "Make the report plainer" is read and not applied, and nothing refuses — it simply does not
+      // happen. The address IS the field, so every rewrite this stage returns names the exact line it
+      // replaces and the driver writes it there.
+      `HAND YOUR REWRITES BACK BY CALLING \`record_knockout_review\`. THERE IS NO FILE FOR YOU TO WRITE and this dispatch names none for you to write to. Send \`rewrites\`: one row per line you are replacing, each carrying the \`at\` address COPIED VERBATIM from the row above and \`text\`, the replacement prose. The driver writes your text into that field exactly as you send it.`,
+      `A REWRITE KEEPS EVERY FACT. You are changing the register, never the content: the same band, the same names, the same reasons, the same conclusion, in the words the reader already owns. Splitting one long sentence into two short ones is the commonest right answer. Dropping the reason to make a line shorter is the commonest wrong one.`,
+      `SEND \`declined\` FOR A LINE YOU ARE LEAVING ALONE, with \`why\`. A word that is a mark being screened, a client's own product name, or a term with no plainer form that keeps the meaning — say so and leave it. A line you neither rewrite nor decline is indistinguishable afterwards from a line nobody read.`,
+      `YOU MOVE NOTHING ELSE. No band, no finding, no ordinal, no count, no piece of evidence and no caveat the engine wrote. There is no field for any of them and a payload naming one is refused.`,
+      `IF YOU CALL AGAIN, SEND ONLY WHAT YOU ARE CORRECTING. The driver merges BY ADDRESS onto what it already accepted, so a row you omit keeps what you sent for it before.`,
+    ),
+  },
 };

package/driver/stages.mjs

@@ -279,7 +279,7 @@ export function paths(runDir) {
     // What was DECIDED about the receipt's deferrals, and when — kept apart from plan-execution.json,
     // which is an execution-FACTS receipt several validators fail-closed on. See envelope-settle.mjs.
     envelopeDecision: p(driverRel("envelope-decision.json")),
-    instructedScope: p(driverRel("instructed-scope.json")),
+    instructedScope: p(driverRel("instructed-scope.json")), defaultTerritories: p(driverRel("default-territories.json")),   // the stored account defaults the engine cannot search — written at intake, read by no stage (pipeline.mjs writes it)
     // compute-don't-author — the per-class scope truth (scope-facts.mjs): instructed × frozen plan ×
     // band states × coverage ledger. The masthead classes/coverage_line are stamped FROM this sidecar.
     scopeFacts: p(driverRel("scope-facts.json")),
@@ -991,7 +991,7 @@ export const pharmaMatter = (job) =>
 // The reach is pinned by report-prose-standard.test.mjs, because nothing FAILS if these rules never
 // arrive: the stage simply writes to model defaults and every other test still passes.
 const REPORT_PROSE = "skills/prelim-search/report-prose.md";
-// THE SPINE RIDES WITH synthesis-rules.md EVERYWHERE IT IS READ (tracker issue 1926). 412 lines MOVED
+// THE SPINE RIDES WITH synthesis-rules.md EVERYWHERE IT IS READ. 412 lines MOVED
 // out of that file into `firm-wide-reasoning.md` so the knockout lane can read the same copy instead of
 // carrying its own retired transcription. A move, not a copy — which means every stage that read
 // synthesis-rules.md for that material must now read both, or it silently LOSES doctrine it has had all
@@ -2093,7 +2093,7 @@ export const STAGES = {
       },
       "per-axis prose digest — the SHORT AUDIT NOTE at register-units/<axis>.md": {
         class: "judgment", tokens: ["too_short"],
-        why: "#850 rules the per-axis prose digest J (keep) and I do not re-litigate. The only arm that speaks about it is nonEmpty at 40 or 80 chars, in validators.registerUnit — the branch reading `return /not applicable|n\\/a|no .*(hits|results)/i.test(c) ? nonEmpty(c, 40) : nonEmpty(c, 80)`. CONVERTED at tracker issue 1893 and the ruling STANDS: the judgment half — is this axis a null result, and the one observation the counts cannot carry — is still the seat's, sent as values through `record_unit_note`. What left is the part that was never judgment: the three COUNTS (queries enumerated, incomplete blocks, records carried forward) are aggregates over the tool-written band, so the driver derives them and the note cannot disagree with the material it describes. The floor is checked at the call now as well as by the validator, so a short note surfaces as a refusal the seat can act on rather than as a stage failure.",
+        why: "#850 rules the per-axis prose digest J (keep) and I do not re-litigate. The only arm that speaks about it is nonEmpty at 40 or 80 chars, in validators.registerUnit — the branch reading `return /not applicable|n\\/a|no .*(hits|results)/i.test(c) ? nonEmpty(c, 40) : nonEmpty(c, 80)`. CONVERTED, and the ruling STANDS: the judgment half — is this axis a null result, and the one observation the counts cannot carry — is still the seat's, sent as values through `record_unit_note`. What left is the part that was never judgment: the three COUNTS (queries enumerated, incomplete blocks, records carried forward) are aggregates over the tool-written band, so the driver derives them and the note cannot disagree with the material it describes. The floor is checked at the call now as well as by the validator, so a short note surfaces as a refusal the seat can act on rather than as a stage failure.",
       },
       "escalation judgement — the CROWD BOUND: attempt each dangerous-category slice once class-scoped, gate on the RESULT, stop terminal on a crowd, and write a block only for the distinctive anchor": {
         class: "judgment", tokens: [],
@@ -2474,7 +2474,7 @@ export const STAGES = {
       },
       "the Sheet-1 findings row's identifier cells — URI, Mark, Owner, Country, Classes, Status, Filed, Expiry": {
         class: "mechanical:tool-written", tokens: ["registerdigest_uri_missing", "registerdigest_uri_unknown"],
-        why: "CONVERTED (conversion 11, tracker issue 1893): the seat sends the position's `uri` and the driver renders every cell from the band record it names — record_id, mark_text, classes, status, owner_name, owner_country, application_date, registration_date, expiry_date. The join is now the check: a uri no band record carries is refused AT THE CALL, where restating it costs nothing, instead of producing a plausible row of retyped cells that fails downstream or nowhere. The DECISION that a position earns a row stays judgment (element above); the cells were never anything but transcription.",
+        why: "CONVERTED (conversion 11): the seat sends the position's `uri` and the driver renders every cell from the band record it names — record_id, mark_text, classes, status, owner_name, owner_country, application_date, registration_date, expiry_date. The join is now the check: a uri no band record carries is refused AT THE CALL, where restating it costs nothing, instead of producing a plausible row of retyped cells that fails downstream or nowhere. The DECISION that a position earns a row stays judgment (element above); the cells were never anything but transcription.",
       },
       "the full clickable record URL, composed from providers/<name>.md 'Record base host' plus the record `uri`": {
         class: "mechanical:tool-written", tokens: [],
@@ -2618,8 +2618,8 @@ export const STAGES = {
       `YOU DO NOT SEND — AND MUST NOT RETYPE — any record's Mark, Owner, Country, Classes, Status, Filed or Expiry, the clickable record URL, the register name, the summary counts, the audit trail or the record ids you read. Every one of those is rendered from the band record your \`uri\` names or from this run's own receipts. The uri IS the join: a uri no band record carries is refused on the call, naming it, rather than rendered as a row of blank cells.`,
       // ── — THE SEAT MARKS THE LIST, AND THE RULE NAMES THE FIELD IT SENDS ─────────
       //
-      // Stated as a FIELD ON THE CALL, deliberately. The failure this avoids is measured: tracker issue
-      // 1955 ruled a rule that described a downstream effect — "the string you sweep" — the seat opened
+      // Stated as a FIELD ON THE CALL, deliberately. The failure this avoids is measured: an earlier
+      // ruling covered a rule that described a downstream effect — "the string you sweep" — the seat opened
       // the file, and it reached one variant of thirty-six, because the seat authors rows and had no
       // field to put the effect in. A rule the seat cannot map onto something it sends produces nothing
       // and no refusal.
@@ -3222,7 +3222,7 @@ export const STAGES = {
       // lane's own prose contract. Two of the four longest sentences in the delivered report were
       // coverage/gap prose, and NOTHING governed it: the code-stamped `coverage_line:` front-matter
       // (scope-facts.mjs,) is EXCLUDED from predelivery-lint's prose scan by design
-      // (stripFrontMatterBlock, predelivery-lint.mjs:376), so a coverage number re-typed into prose
+      // (stripFrontMatterBlock in predelivery-lint.mjs), so a coverage number re-typed into prose
       // beside it is caught only if the prose form itself trips SCOPE_NUMBER_RE — which the narrative's
       // own phrasings routinely dodge. Prompt-only per §7; the fix is to stop authoring the duplicate.
       `COVERAGE PROSE (the lane that runs longest — hold it to the house budgets): the register coverage line a reader sees is COMPUTED from this run's own record and STAMPED BY CODE as front-matter (the proportion, the class states, the searched registers). Do NOT re-type its numbers anywhere in prose — not in a coverage[] note, not in the coverage_judgment reason, not in the narrative. Nothing catches the duplicate for you (the code-stamped line sits outside the prose checks precisely because ITS numbers are the authoritative ones), so a re-typed count does not disagree with the record — it silently drifts from it a redelivery later. Carry the SUBSTANCE and drop the number: "the remaining forms are non-Latin script" says the useful half; the code says how many. State each coverage fact ONCE, in ONE place — an area's state belongs in its coverage[] row, the sufficiency read belongs in coverage_judgment.reason, and neither is re-narrated in the other or in the findings. And say WHICH KIND of negative you hold every time: a source this run actually queried and got nothing from reads "searched — none found"; a source it did not reach reads "not searched this run" or "could not be searched — <the reason>". The same source must never wear both readings in one report.`,
@@ -3870,7 +3870,7 @@ export const STAGES = {
       reads(reportCardSkillReads({ profile })),
       // ── CONVERSION 5. THE FIRST FAN-OUT TRANSPORT ────────────────────────────────────
       //
-      // What moves is the SHAPE, not the analysis. Owner ruling S2 (2026-08-13) keeps the prose the
+      // What moves is the SHAPE, not the analysis. Ruling S2 (2026-08-13) keeps the prose the
       // model's pending a side-by-side reading of one matter built both ways — so this dispatch still
       // asks for the seat's judgment, bullet by bullet, and stops asking it to hit line templates a
       // parser then re-reads.
@@ -4561,11 +4561,11 @@ export function assertTierSanity() {
   return true;
 }
 
-// ── WHO THE COMPLETION NOTICE IS FOR (tracker issue 289) ─────────────────────────────────────────────
+// ── WHO THE COMPLETION NOTICE IS FOR ─────────────────────────────────────────────────────────────────
 //
 // It went to whoever runs the agent, never to whoever asked. `AGENT_WHATSAPP` is keyed by AGENT ID, and
 // every user of this deployment shares the one agent, so on every run the operator was paged for work
-// somebody else ordered and the person who ordered it was told nothing. Owner ruling, 2026-09-07: route
+// somebody else ordered and the person who ordered it was told nothing. Ruling, 2026-09-07: route
 // to the requester where a number is held for them, and keep the operator's number as a copy the
 // operator can switch off.
 //