clearotron 0.3.0-beta.2 → 0.3.0-beta.4

package/driver/gateway.mjs

@@ -1052,6 +1052,10 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         grant: gatherAllowedTools,
       })
       : null;
+    // The start of this attempt's window in the per-run refusal journals. Taken before the witness and
+    // the snapshot, which only widens the window by their own time: an earlier attempt's refusals all
+    // precede its own settle, so they stay outside it.
+    const dispatchedAt = Date.now();
     for (const line of describeMethodologyDrift(witnessStageMethodology(runDir, name, effMessage, engineResolveSkill)))
       note(`[${name}] ${line}`);
     // — the frozen judged-by set, hashed into THIS PROCESS'S MEMORY before the seat runs. Never
@@ -1368,7 +1372,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     // ONE artifact judgement, shared by both rescues below (the rule: never a second, drifting copy of
     // the contract). Present + written by THIS attempt (the per-attempt snapshot — an inherited file and
     // equally an earlier attempt's file never rescue a failed turn) + passes the stage's own validator.
-    const attemptWroteTruth = () => {
+    const attemptWroteTruth = (why = null) => {
       // — the rescues judge with `validate` directly rather than through judgeArtifacts, so the union
       // has to run here too or a rescued turn would be refused for rows the form already holds. Idempotent,
       // so the double call on the normal path costs a regeneration and changes nothing.
@@ -1381,16 +1385,21 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
       // answer for a killed-in-the-gap attempt is no. Idempotent, so the double call costs a regeneration.
       const pu = syncPlacementForm(files);
       if (pu) lastPlacementUnion = pu;
+      // `why`, when a caller passes one, is told WHICH file failed and on what, so a refusal can name both.
       return files.every((f) => {
         const now = statOf(f);
-        if (now === null || now === preArtifact.get(f)) return false;   // absent, or not written by this attempt
-        if (validate) { const v = validate(f, readFileSync(f, "utf8")); if (!v.ok) return false; }
+        const no = (cause, reason) => { if (why) Object.assign(why, { file: rel(f), cause, ...(reason ? { reason } : {}) }); return false; };
+        if (now === null) return no("absent");
+        if (now === preArtifact.get(f)) return no("not-written-by-this-attempt");
+        if (validate) { const v = validate(f, readFileSync(f, "utf8")); if (!v.ok) return no("invalid", v.reason ? String(v.reason) : undefined); }
         return true;
       });
     };
     let rescued = null;
     let quiescentMs = null;   //: how long the artifact had been untouched when the turn settled
-    let rescueRefused = null; //: WHICH of the rescue's three causes refused — on the row, not only in a note
+    let rescueRefused = null; //: WHICH of the rescue's four causes refused — on the row, not only in a note
+    let rescueRefusedFile = null, rescueRefusedReason = null;   //: and which file, and on what
+    let attemptRefusals = null;   //: this dispatch's refusals of a tool-written artifact, on a timeout
     if (fail && /^nonzero_exit_/.test(fail) && files.length) {
       if (killClass || killSeen) {
         note(`[${name}] ${fail} with a kill-class attempt in this ladder — the exit-1 rescue stays CLOSED (a killed turn's artifact may be torn mid-write and a validator cannot prove it whole); failing honestly instead`);
@@ -1427,16 +1436,28 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     //
     // A stage with no validator, or whose artifact fails it, or which never wrote, is untouched.
     else if (fail === "timeout" && turn.signals?.hardWall && files.length && validate && wallRescueEnabled()) {
-      // — `unreadable` is tracked as its own fact rather than inferred from the -1 sentinel. The
-      // sentinel is not the only way this goes negative: an artifact written in the same instant the turn
-      // settled yields a small NEGATIVE elapsed, and the refusal message read that as "artifact
-      // unreadable" — a diagnosis about the filesystem for a file that was perfectly readable and simply
-      // still being written. That is the under-quiescence case, and it is now named as one.
-      let unreadable = false;
-      const quiet = files.map((f) => { try { return settledAt - statSync(f).mtimeMs; } catch { unreadable = true; return -1; } });
-      quiescentMs = quiet.length ? Math.min(...quiet) : null;
+      // — A FILE THAT COULD NOT BE STAT'ED IS NAMED, WITH WHY, rather than folded into a number. It
+      // used to be a -1 in `quiescentMs` and the cause `artifact-unreadable`, and the commonest way to get
+      // there is not a filesystem fault at all: the turn was killed before it wrote. Measured on two
+      // stages of one run, 2026-09-10: both rows read `wrote: false`, `quiescentMs: -1`,
+      // `artifact-unreadable`, for files that did not exist. An ABSENT file (ENOENT) is its own cause now;
+      // `artifact-unreadable` stays for a stat that fails any other way, with its error code. Rows
+      // written before this change say `artifact-unreadable` for both.
+      //
+      // `quiescentMs` IS A MEASUREMENT OR IT IS ABSENT. With a file unstat'able there is no quiescence of
+      // the set to measure, so it stays null and the row omits it: a -1 reads as a number to anything that
+      // averages or compares it. An mtime that lands after the settle instant (written in that same
+      // instant, or a clock step) measures 0 rather than a negative; it is the under-quiescence case.
+      let missing = null;
+      const quiet = [];
+      for (const f of files) {
+        try { quiet.push(Math.max(0, settledAt - statSync(f).mtimeMs)); }
+        catch (e) { if (!missing) missing = { file: rel(f), code: String(e?.code ?? "unknown") }; }
+      }
+      quiescentMs = missing || !quiet.length ? null : Math.min(...quiet);
       const bar = wallRescueQuiesceMs();
-      if (quiescentMs >= bar && attemptWroteTruth()) {
+      const why = {};
+      if (quiescentMs !== null && quiescentMs >= bar && attemptWroteTruth(why)) {
         rescued = fail;
         fail = null;
         note(`[${name}] hard-wall kill at ${Math.round(wall)}s, but every expected artifact was written by this attempt, passes its validator and had been untouched for ${Math.round(quiescentMs / 1000)}s when the turn settled — the stage FINISHED and the wall is a fact about the dispatch, not a failure of the stage (the resume's skip path would accept these same bytes)`);
@@ -1451,12 +1472,24 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         // rescue was refused on the third cause, its validator — and 31 minutes of finished work were
         // discarded and re-run cold. `grep -c rescue run.jsonl` on that run returns 0. Nothing in the
         // record said why, and reconstructing it took a file-mtime comparison against a preserved run dir.
-        rescueRefused = unreadable ? "artifact-unreadable"
+        rescueRefused = missing ? (missing.code === "ENOENT" ? "artifact-absent" : "artifact-unreadable")
           : quiescentMs < bar ? "under-quiescence"
           : "not-written-by-this-attempt-or-invalid";
-        note(`[${name}] hard-wall kill at ${Math.round(wall)}s — wall rescue REFUSED (${unreadable ? "artifact unreadable" : quiescentMs < bar ? `artifact touched ${Math.round(quiescentMs / 1000)}s before the kill, under the ${Math.round(bar / 1000)}s quiescence bar` : "not written by this attempt, or fails its validator"}); failing honestly as timeout`);
+        // — AND WHICH FILE, AND ON WHAT: an unstat'able file with its error code; under the bar, the file
+        // touched last (`quiescentMs` carries the number); otherwise the first file the artifact judgement
+        // failed, with its cause — `absent`, `not-written-by-this-attempt`, or the validator's own reason.
+        if (missing) { rescueRefusedFile = missing.file; rescueRefusedReason = missing.code; }
+        else if (quiescentMs < bar) rescueRefusedFile = rel(files[quiet.indexOf(quiescentMs)]);
+        else { rescueRefusedFile = why.file ?? null; rescueRefusedReason = why.reason ?? why.cause ?? null; }
+        note(`[${name}] hard-wall kill at ${Math.round(wall)}s — wall rescue REFUSED (${rescueRefused}: ${rescueRefusedFile ?? "no file named"}${rescueRefusedReason ? `, ${rescueRefusedReason}` : quiescentMs < bar ? `, touched ${Math.round(quiescentMs / 1000)}s before the kill, under the ${Math.round(bar / 1000)}s bar` : ""}); failing honestly as timeout`);
       }
     }
+    // — WHAT A KILLED ATTEMPT WAS DOING, where its transport kept a record. A tool-written artifact's
+    // refusal journal says how many times this attempt sent its record and was told no, and the reason the
+    // last time. The missing-file row has carried that last reason since the journal existed; a timeout row
+    // carried nothing, so an attempt that spent forty minutes being refused read the same as one that never
+    // called. Counted from THIS dispatch only: the journal is per run, and every attempt appends to it.
+    if (fail === "timeout" && files.length) attemptRefusals = refusalsInWindow(files, runDir, dispatchedAt, settledAt);
     // Arm the ladder-wide refusal for every LATER attempt. Read before `classifyWedge` below only because
     // the rescue above needs it; the two can never disagree in reach — isTaintRow excludes lane_wedge, and
     // a wedge is a `timeout` fail that breaks the ladder immediately, so no later attempt exists to judge.
@@ -1675,6 +1708,8 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         // arm did not apply (no wall, no validator, no declared file).
         quiescentMs: Number.isFinite(quiescentMs) ? Math.round(quiescentMs) : undefined,
         rescueRefused: rescueRefused ?? undefined,   // — the cause, when the rescue looked and refused
+        rescueRefusedFile: rescueRefusedFile ?? undefined, rescueRefusedReason: rescueRefusedReason ?? undefined,
+        refusedCalls: attemptRefusals ?? undefined,   // — {count, last}: this dispatch's refusals, on a timeout
         //: the verbatim message this attempt was dispatched with — {file, sha, bytes, chars, kind}.
         // null when the run has no directory or the gate is off; {present:false, error} when the write
         // failed. An absence is a record here, never a silence.
@@ -1740,6 +1775,8 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           rescued: rescued ?? undefined, killed: killed || undefined,
           quiescentMs: Number.isFinite(quiescentMs) ? Math.round(quiescentMs) : undefined,   // — see the per-stage row
           rescueRefused: rescueRefused ?? undefined,   // — the cause, when the rescue looked and refused
+          rescueRefusedFile: rescueRefusedFile ?? undefined, rescueRefusedReason: rescueRefusedReason ?? undefined,
+          refusedCalls: attemptRefusals ?? undefined,   // — see the per-stage row
           // — AND THE BILLING PAIR, by the same argument makes for the model pair one field up:
           // the spine carries it or the two logs disagree about what ran. This is the row a sweep across
           // archived runs actually reads, and the question "has this box ever billed API" could not be
@@ -2007,6 +2044,30 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
   return { ok: false, attempts: attempt, fail: lastFail, sessionKey: lastKey, modelWire: lastModelWire, modelUsed: lastModelUsed, attemptFails: [...attemptFails], warmEscalated: warmEscalatedAt > 0 || undefined, quantity: lastQuantity, reads: lastReads, readsTruncated: lastReadsTruncated, warm: lastWarm, wrote: lastWrote, formRepairs: formRepairsUsed };
 }
 
+/**
+ * One dispatch's refusals, read from the refusal journals of the tool-written artifacts in `files`.
+ * An entry is placed by its `at`; one with no readable `at` cannot be placed in a dispatch, so it is
+ * counted apart rather than guessed into this one.
+ * @returns {{ count: number, last: string|null, unattributed?: number } | null}  null when no file in
+ *   `files` has a refusal journal, so "this stage keeps no journal" never reads as "nothing was refused".
+ */
+function refusalsInWindow(files, runDir, from, to) {
+  let journals = 0, count = 0, unattributed = 0, last = null, lastAt = -Infinity;
+  for (const f of files) {
+    const reader = toolWrittenArtifact(f)?.refusals;
+    if (!reader) continue;
+    journals++;
+    for (const r of reader(runDir, f) ?? []) {
+      const at = Date.parse(String(r?.at ?? ""));
+      if (!Number.isFinite(at)) { unattributed++; continue; }
+      if (at < from || at > to) continue;
+      count++;
+      if (at >= lastAt) { lastAt = at; last = String(r?.reason ?? ""); }
+    }
+  }
+  return journals ? { count, last, ...(unattributed ? { unattributed } : {}) } : null;
+}
+
 function rel(p) {
   const i = p.indexOf("/prelim-search/");
   return i >= 0 ? p.slice(i + 1) : p;

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.0-beta.2",
+  "version": "0.3.0-beta.4",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/portal-service.mjs

@@ -4589,7 +4589,7 @@ const PORT = PORT_CHOICE.port;
         const recipeCommit = committing(recipeRepoRoot, "saved-search");
         // — same, against the RECIPE repo root, which may differ from the profile one.
         const recAudit = makeCommittableAudit({ auditPath: recipeAuditPath, repoRoot: recipeRepoRoot });
-        const recipes = makeRecipeService({ recipesDir, profileDir, gitCommit: recipeCommit, audit: recAudit });
+        const recipes = makeRecipeService({ recipesDir, profileDir, readLayered: true, gitCommit: recipeCommit, audit: recAudit });
         callRecipes = (method, path, body, identity) => recipes.route(method, path, { email: identity?.email }, body ?? {});
         log(`saved searches ON — store=${recipesDir} repo=${recipeRepoRoot}`);
       } else {

package/driver/profile-service.mjs

@@ -471,13 +471,41 @@ export function makeProfileService({
         throw e;
       }
 
+      // A CREATE THE STORE CANNOT RECORD IS REFUSED, NOT REPORTED AS DONE. This answered 201 with the
+      // company live and a `commitError` beside it, so a machine with no git identity got a company with no
+      // record of who made it or when, on its first company, and the store move had been made to close
+      // exactly that gap. The store is asked first, and a refusal writes nothing: no profile, no audit row
+      // and, since the organisation's grant is filed only on a 201, no grant.
+      const cannot = typeof gitCommit?.refusal === "function" ? gitCommit.refusal() : null;
+      if (cannot) {
+        return { status: 409, json: { error: `No company was created: ${cannot.message}, then try again.`, code: `store_${cannot.code.replace(/-/g, "_")}` } };
+      }
       const { files } = writeProfile({ profileDir, key: wanted, profile, contextPack: "" });
-      // WRITTEN AND RECORDED ARE TWO EVENTS. The write is live the instant it renames; the commit can
-      // fail on its own. Reporting them as one is how somebody is told nothing happened about a company
-      // that is already governing runs.
       const message = `chore(clearotron): create company ${wanted} (via portal, by ${by})`;
       const { commit, commitError } = commitWithAuditRow({ audit, gitCommit, files, message, by,
         row: { event: "profile-create", key: wanted, by, fields: Object.keys(profile) } });
+      // AND ONE THAT FAILS ANYWAY IS WITHDRAWN. A hook or a full disk can refuse the commit after the store
+      // said it could record. The paths this create wrote were absent before it, so they are returned to
+      // absent, and a third audit row says so after the two the failed commit left.
+      if (commitError) {
+        // GIT'S LAST WORD, NOT ITS ECHO. The error opens with the whole command line it ran, message and
+        // author included, and ends with the refusal itself: a hook's own sentence, "No space left on
+        // device". The operator acts on the last line.
+        const cause = String(commitError).trim().split("\n").map((l) => l.trim()).filter(Boolean).pop() ?? String(commitError);
+        let left = null;
+        try {
+          if (typeof gitCommit?.withdraw !== "function") throw new Error("this store cannot withdraw what it wrote");
+          gitCommit.withdraw(files);
+        } catch (e) { left = String(e?.message ?? e).slice(0, 200); }
+        try {
+          audit({ event: "profile-create-withdrawn", of: "profile-create", key: wanted, by,
+            note: left ? `the create could not be recorded and its files could not be removed (${left})` : "the create could not be recorded, so its files were removed" });
+        } catch { /* the refusal below is the report; a journal failure must not mask it */ }
+        if (left) {
+          return { status: 500, json: { key: wanted, error: `The company could not be recorded (${cause}), and its file could not be removed afterwards (${left}). It is on disk with no record behind it — tell an administrator.` } };
+        }
+        return { status: 409, json: { error: `No company was created: the store could not record it (${cause}). Nothing was left behind.`, code: "store_commit_failed" } };
+      }
       return { status: 201, json: {
         key: wanted, name, written: true, created: true, commit,
         // The receipt reads off THESE, so it can say which framework and how many marketplaces, and

package/driver/publish/index.mjs

@@ -22,7 +22,7 @@ import { reportIdentityFor, productCoverageNote, isRegisterOnly } from '../searc
 import { readRecordArtifacts, bindFindingsToRecords, joinEvidenceStatus } from '../registry-fidelity.mjs';
 import { deliveryFlagLines } from '../predelivery-lint.mjs';
 import { PROVIDERS, config } from '../driver.config.mjs';
-import { recordOriginsFor } from '../record-origins.mjs';
+import { declaredRecordOrigins } from '../record-origins.mjs';
 import { NEUTRAL_DELIVERY, loadProfiles } from '../profiles.mjs';
 import { resolveDemoData, demoBannerMd } from './demo-marking.mjs';   // — one demo question, every product; 2134 — every SURFACE
 import { engineCommit } from '../engine-build.mjs';
@@ -546,7 +546,7 @@ export async function regenSurfaces(poolRoot) {}
  *                             all three client surfaces state the same link. That agreement is the point:
  *                             a repair that reached the report and not the workbook would put two
  *                             different registers in one delivery.
- * @param {string[]|null} origins  recordOriginsFor(the run's own provider). `null` = the run has no fetch
+ * @param {string[]|null} origins  declaredRecordOrigins(the run's own provider). `null` = the run has no fetch
  *                             receipts (legacy/archived): a NO-OP, byte-identical output, because a run
  *                             that never named its register cannot be judged against one. `[]` is a
  *                             different answer — this provider publishes no per-record page at all, so no
@@ -773,7 +773,8 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   //
   // So this REPAIRS rather than refuses, keyed on the RUN's own provider (the receipts above), never on
   // today's CLEAROTRON_DATABASE — a republished archive keeps its own register.
-  const runOrigins = fetchReceipts ? recordOriginsFor(String(fetchReceipts[0]?.provider ?? '').toLowerCase()) : null;
+  // Receipts that name no provider are read as no receipts: the gate is off, as it is for a legacy run.
+  const runOrigins = fetchReceipts ? declaredRecordOrigins(fetchReceipts[0]?.provider) : null;
   const foreignRecordLinks = normalizeRecordLinks(findings, runOrigins);
   // — the SAME list reaches the renderer. normalizeRecordLinks repairs foreign ABSOLUTE links on
   // register-sourced findings; render.mjs separately CONSTRUCTS links from bare record paths, and until
@@ -859,7 +860,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
     const esPath = driverDir(runDir ?? dirname(reportMd), 'enforcer-signals.json');
     if (existsSync(esPath)) { const es = JSON.parse(readFileSync(esPath, 'utf8')); if (Array.isArray(es)) enforcerSignals = es; }
   } catch { /* absent — no telemetry lines */ }
-  const officeLinks = officeLinksFor(findings, recordsByUri, fetchReceipts); bindFindingsToRecords(findings, recordsByUri);
+  const officeLinks = officeLinksFor(findings, recordsByUri, runOrigins); bindFindingsToRecords(findings, recordsByUri);
   // 404-card caveat (2026-07-22): the V4-2 closure pass persisted every cited record its targeted
   // fetch definitively could not retrieve (predelivery-lint.json artifactSet.recordFetchFailures);
   // the evidence join stamps `_recordFetchFailure` from it so the card render carries the
@@ -1621,12 +1622,14 @@ export function composeEmailHtml(reportMdPath, url, auditFile, names = [], deliv
 
 // ── The office's own page for each fetched record, where the run's register publishes none of its own ──
 // Addressed from the record's numbers (office-record-links.mjs), never from the model or the handle, and
-// null on every other register, so those runs publish exactly as before. The tally goes to meta.json and
-// the log, so a register whose numbers never fit shows up as a count rather than as silence. Kept down
-// here, below every line the rest of the tree cites by number.
+// null on every register that publishes pages of its own, so those runs publish exactly as before. Which
+// registers those are is `runOrigins`, the same answer the record-URL normalisation above keys on, so the
+// two cannot disagree about one register. The tally goes to meta.json and the log, so a register whose
+// numbers never fit shows up as a count rather than as silence. Kept down here, below every line the rest
+// of the tree cites by number.
 import { recordLinksFor } from './office-record-links.mjs';
-function officeLinksFor(findings, recordsByUri, fetchReceipts) {
-  const links = recordLinksFor(findings, recordsByUri, fetchReceipts?.[0]?.provider);
+function officeLinksFor(findings, recordsByUri, runOrigins) {
+  const links = recordLinksFor(findings, recordsByUri, runOrigins);
   if (links) console.log(`[record-links] ${links.summary}`);
   return links;
 }

package/driver/publish/knockout.mjs

@@ -401,8 +401,9 @@ export async function publishKnockout({ runId, codename, runDir, findings, plan,
   // THE OFFICE'S OWN PAGE FOR EACH LISTED FILING, where the run's register publishes none of its own:
   // the addressing the clearance gives its register findings (office-record-links.mjs), set on the
   // sidecar here for the same reason the normalisation above is. Keyed on the run's own provider, and
-  // the tally goes to meta.json, so numbers that never fit show as a count rather than as silence.
-  const officeLinks = addressListedFilings(registerRecords);
+  // the tally goes to meta.json, so numbers that never fit show as a count rather than as silence. A
+  // sidecar that names no provider is left as it was, as the normalisation above leaves it.
+  const officeLinks = addressListedFilings(registerRecords, declaredRecordOrigins(registerRecords?.provider));
   if (officeLinks) note(`[record-links] ${officeLinks.summary}`);
 
   // ── Predelivery lint — the APPLICABLE subset, FLAGS not FAILS (2026-07-31) ─────────────────────────
@@ -753,3 +754,4 @@ export function knockoutDocumentRoutes(reports, { auditFile = null } = {}) {
 // The office's own page for each listed filing (office-record-links.mjs). Kept down here, below every
 // line the rest of the tree cites by number.
 import { addressListedFilings, reasonCellFor } from './office-record-links.mjs';
+import { declaredRecordOrigins } from '../record-origins.mjs';

package/driver/publish/office-record-links.mjs

@@ -67,9 +67,13 @@ export const OFFICE_RECORD_PAGES = Object.freeze({
   fr: { name: "France", address: (r) => addressFrom([r.applicationNumber, r.registrationNumber], /^(?:FR)?(\d{7})$/i, (m) => ({
     number: `FR${m[1]}`, href: `https://data.inpi.fr/marques/FR${m[1]}` })) },
   // The office's record address as indexed; it challenges automated fetches, so none was opened from a
-  // server. UK numbers are UK plus eleven digits (UK000..., UK008..., UK009...).
-  gb: { name: "United Kingdom", address: (r) => addressFrom([r.applicationNumber, r.registrationNumber], /^(UK\d{11})$/i, (m) => ({
-    number: m[1].toUpperCase(), href: `https://trademarks.ipo.gov.uk/ipo-tmcase/page/Results/1/${m[1].toUpperCase()}` })) },
+  // server. UK numbers are UK plus eleven digits (UK000..., UK008..., UK009...). A national number given
+  // bare, seven digits as one register hands it over, is the same number under the office's UK0000
+  // prefix: UK00003456789 is national mark 3456789.
+  gb: { name: "United Kingdom", address: (r) => addressFrom([r.applicationNumber, r.registrationNumber], /^(?:(UK\d{11})|(\d{7}))$/i, (m) => {
+    const n = m[1] ? m[1].toUpperCase() : `UK0000${m[2]}`;
+    return { number: n, href: `https://trademarks.ipo.gov.uk/ipo-tmcase/page/Results/1/${n}` };
+  }) },
   // The register's own search opens records at exactly this address: the application number, then the
   // registration number when there is one. Opened a real record. The older search.patentstyret.no
   // addresses now answer 410 Gone.
@@ -91,6 +95,12 @@ export const OFFICE_RECORD_PAGES = Object.freeze({
 
 const handleOffice = (uri) => (/^\/mark\/([a-z]{2,4})\//i.exec(clean(uri))?.[1] ?? "").toLowerCase();
 
+// The same office under another register's code. The EUIPO's WIPO ST.3 code is EM, and a register that
+// keeps it (Compumark does) names the office the table holds as EU. An alias, never a second table entry:
+// the table is keyed by the offices, and one office has one address.
+const OFFICE_ALIASES = Object.freeze({ em: "eu" });
+const officeOf = (code) => OFFICE_ALIASES[code] ?? code;
+
 // A number that already carries its office's letters (FR4123456, UK00003456789) stands alone; a bare
 // one is shown with its office (CH 08133/2025), so the label always says whose number it is.
 const labelOf = (office, number) => (number ? (/^[a-z]{2}/i.test(number) ? number : `${office.toUpperCase()} ${number}`) : null);
@@ -108,7 +118,7 @@ const labelOf = (office, number) => (number ? (/^[a-z]{2}/i.test(number) ? numbe
 export function officeRecordLink(rec, uri = "") {
   if (!rec || typeof rec !== "object") return null;
   const designation = clean(rec.filingRoute) === "madrid_designation";
-  const office = designation ? "wo" : (clean(rec.office).toLowerCase() || handleOffice(uri));
+  const office = designation ? "wo" : officeOf(clean(rec.office).toLowerCase() || handleOffice(uri));
   const page = OFFICE_RECORD_PAGES[office];
   const own = designation ? clean(rec.irNumber) : clean(rec.applicationNumber) || clean(rec.registrationNumber);
   const unlinked = (reason) => ({ office, label: labelOf(office, own), href: null, reason });
@@ -118,17 +128,28 @@ export function officeRecordLink(rec, uri = "") {
   return a ? { office, label: labelOf(office, a.number), href: a.href, reason: null } : unlinked("unaddressable");
 }
 
-/** The registers whose records carry no page of the vendor's own, so the office's page is the link. */
-export const VENDORS_WITHOUT_RECORD_PAGES = Object.freeze(["signa"]);
+/**
+ * Does the run's register publish no page per record, so that the office's page is the only link a reader
+ * can be given? `origins` is `recordOriginsFor`'s answer for the run's register: the hosts it may put in a
+ * record URL. An EMPTY list is that answer, and it is the same one normalizeRecordLinks enforces, which
+ * strips every record URL on such a register, so none of its records reaches publish with a link of its
+ * own. Null means no register was named, and nothing is addressed.
+ *
+ * DECIDED BY THE REGISTER'S DECLARATION, NEVER BY A LIST OF VENDOR NAMES. A list here once named one
+ * vendor, on the premise that every other register's records carry links of their own. Compumark's do
+ * not, and its runs reached the reader with a handle and no reason, while this code knew the address.
+ */
+const publishesNoRecordPages = (origins) => Array.isArray(origins) && origins.length === 0;
 
 /**
- * Every registration the findings cite, keyed by its lower-cased uri, for a run whose register is
- * `provider`. Returns null for any other register, so those runs render exactly as before: their records
- * carry links of their own. `tally` is what publish records, per office, so that a register whose numbers
- * never fit shows up as a count instead of as a report that quietly looks the way it always did.
+ * Every registration the findings cite, keyed by its lower-cased uri, for a run whose register may put a
+ * record URL on `origins` (see publishesNoRecordPages). Returns null for a register that publishes pages
+ * of its own, so those runs render exactly as before. `tally` is what publish records, per office, so
+ * that a register whose numbers never fit shows up as a count instead of as a report that quietly looks
+ * the way it always did.
  */
-export function recordLinksFor(findings, recordsByUri, provider) {
-  if (!VENDORS_WITHOUT_RECORD_PAGES.includes(clean(provider).toLowerCase())) return null;
+export function recordLinksFor(findings, recordsByUri, origins) {
+  if (!publishesNoRecordPages(origins)) return null;
   const byUri = new Map();
   const tally = { linked: {}, cited: {}, notRetrieved: 0 };
   for (const f of Array.isArray(findings) ? findings : []) {
@@ -169,17 +190,30 @@ const nameOf = (office) => OFFICE_RECORD_PAGES[office]?.name ?? office.toUpperCa
  * NO COUNT. The cards list only some findings' registrations (an off-field finding lists none), so a
  * number here could name more registrations than the reader can find on the page. The workbook lists
  * them all, each with its reason.
+ *
+ * ONE SENTENCE FOR EVERY OFFICE THE TABLE HOLDS NO ADDRESS FOR, after the per-office ones. A register
+ * covering the world cites filings from offices this table does not know: one Compumark knockout on the
+ * test instance listed sixteen of them. A sentence each would repeat one caveat sixteen times, which is
+ * the repeated note the owner ruled reads to a client as a broken report.
  */
 export function officeReasonSentences(byUri) {
   const keys = new Set();
-  for (const l of byUri instanceof Map ? byUri.values() : []) if (l && !l.href) keys.add(`${l.office} ${l.reason}`);
-  return [...keys].sort().map((k) => {
+  const unknown = new Set();
+  for (const l of byUri instanceof Map ? byUri.values() : []) {
+    if (!l || l.href) continue;
+    if (l.reason === "unknown-office") unknown.add(l.office);
+    else keys.add(`${l.office} ${l.reason}`);
+  }
+  const each = [...keys].sort().map((k) => {
     const [office, reason] = k.split(" ");
     const name = nameOf(office);
     if (reason === "no-page") return `${name}: the register publishes no page for a single record, so its registrations are cited by number.`;
-    if (reason === "unknown-office") return `${name}: we hold no page address for this register, so its registrations are cited by number.`;
     return `${name}: registrations whose numbers are not in the form the register's page address takes are cited by number, not linked.`;
   });
+  const codes = [...unknown].sort().map(nameOf);
+  if (codes.length === 1) each.push(`${codes[0]}: we hold no page address for this register, so its registrations are cited by number.`);
+  else if (codes.length > 1) each.push(`${codes.join(", ")}: we hold no page address for these registers, so their registrations are cited by number.`);
+  return each;
 }
 
 /**
@@ -215,20 +249,21 @@ export function linkCellFor(registrations, byUri) {
 
 /**
  * A knockout's listed filings, each addressed at its office's page, for a listing taken on a register
- * with no record pages of its own. `doc` is register-records.json, and each filing that carries an office
- * number gains an `officeLink` in place, as normalizeRegisterRecordLinks rewrites links in place, so the
- * report, the workbook and report-data.json all state the same link. Returns null for any other
- * register, whose filings render exactly as before.
+ * with no record pages of its own. `doc` is register-records.json and `origins` is `recordOriginsFor`'s
+ * answer for the register the sidecar names (see publishesNoRecordPages). Each filing that carries an
+ * office number gains an `officeLink` in place, as normalizeRegisterRecordLinks rewrites links in place, so
+ * the report, the workbook and report-data.json all state the same link. Returns null for a register that
+ * publishes pages of its own, whose filings render exactly as before.
  *
  * A FILING WITH NO OFFICE NUMBER IS LEFT AS IT WAS, and shows as it always did. Every listing taken
  * before the numbers were kept is that case, so an archived knockout republishes unchanged. An
  * `officeLink` found already on the sidecar is dropped first: the link is set here, from the numbers, and
  * nowhere else.
  */
-export function addressListedFilings(doc) {
+export function addressListedFilings(doc, origins) {
   const records = (doc?.marks ?? []).flatMap((m) => m?.records ?? []).filter((r) => r && typeof r === "object");
   for (const r of records) delete r.officeLink;
-  if (!VENDORS_WITHOUT_RECORD_PAGES.includes(clean(doc?.provider).toLowerCase())) return null;
+  if (!publishesNoRecordPages(origins)) return null;
   const tally = { linked: {}, cited: {}, noNumber: 0 };
   for (const r of records) {
     const link = officeRecordLink(r, r.recordId);

package/driver/recipe-service.mjs

@@ -24,8 +24,8 @@
 // server-owned (monotonic per save); EVERY write re-runs the SAME load-time validator the driver uses
 // (search-policy.mjs validateRecipe), so the UI can never persist a recipe the driver would later reject;
 // free text gets the profiles.mjs anti-rule prose guards (a recipe must never smuggle a rating rule in as
-// prose — levels select machinery, never rating authority); a recipe belongs to a REAL customer on the
-// profile roster (never "generic"). The routing core (`makeRecipeService`) is fs-only + injected
+// prose — levels select machinery, never rating authority); a recipe belongs to a company on the
+// profile roster, Generic included. The routing core (`makeRecipeService`) is fs-only + injected
 // git/audit so it unit-tests offline; auth + rate-limit are wired in the bootstrap.
 
 import "../shared/env-local.mjs";   // — FIRST: the CLEAROTRON_* translation must land before any
@@ -61,6 +61,13 @@ export const componentCatalog = () =>
 export function makeRecipeService({
   recipesDir,
   profileDir = undefined,                      // undefined ⇒ profiles.mjs default dir
+  // THE ROSTER THE PORTAL SHOWS, read the way profile-service reads it (its `readLayered` note). The
+  // portal passes true: the deployment's store, overlay over base, with `generic` falling through from
+  // the product. Read as an explicit directory instead, a store holding no `generic.json` — every fresh
+  // install and every demo — throws "generic.json is REQUIRED", the catch below turned that into "no
+  // such company", and saved searches answered 404 for every company on the install, one created a
+  // minute earlier included, while the same company's projects answered 200.
+  readLayered = false,
   loadRecipes = loadRecipesDefault,
   loadProfiles = loadProfilesDefault,
   writeRecipe = defaultWriteRecipe,
@@ -69,8 +76,10 @@ export function makeRecipeService({
 } = {}) {
   const rosterHas = (customer) => {
     try {
-      const profiles = profileDir === undefined ? loadProfiles({ force: true }) : loadProfiles({ dir: profileDir, force: true });
-      return profiles.has(customer) && customer !== "generic";
+      const profiles = readLayered || profileDir === undefined ? loadProfiles({ force: true }) : loadProfiles({ dir: profileDir, force: true });
+      // GENERIC OWNS SAVED SEARCHES LIKE ANY COMPANY (owner ruling, 2026-09-11). It was refused here as not a
+      // real customer, and a fresh install, which holds Generic alone, opened Custom searches on an error.
+      return profiles.has(customer);
     } catch { return false; }   // an unreadable roster fails CLOSED here — writes need a verifiable owner
   };
   const listRow = ([key, r]) => {
@@ -122,7 +131,7 @@ export function makeRecipeService({
       return { status: 404, json: { error: "not_found" } };
     if (method !== "POST") return { status: 405, json: { error: "method_not_allowed" } };
     if (!rosterHas(customer))
-      return { status: 400, json: { error: `customer "${customer}" is not on the profile roster — a saved search belongs to a real customer (create the profile first; "generic" cannot own recipes)` } };
+      return { status: 400, json: { error: `customer "${customer}" is not on the profile roster — a saved search belongs to a company on the roster (create the company first)` } };
 
     const incoming = body.recipe;
     if (!incoming || typeof incoming !== "object" || Array.isArray(incoming))

package/driver/record-origins.mjs

@@ -43,3 +43,17 @@ export function activeRecordOrigins(env = process.env) {
   const id = String(env?.CLEAROTRON_DATABASE ?? "").trim().toLowerCase();
   return id ? recordOriginsFor(id) : null;
 }
+
+/**
+ * The record origins of the register a stored artefact NAMES — a knockout's listing, a run's fetch
+ * receipts — or null when it names none.
+ *
+ * EMPTY IS "NOBODY SAID", and it turns the gate off, as normalizeRegisterRecordLinks reads the same
+ * field: an artefact that never recorded its register cannot be judged against one. An id this table
+ * does not know is an answer, and resolves as recordOriginsFor resolves it, to no origins, because no
+ * host of its can be established as legitimate.
+ */
+export function declaredRecordOrigins(provider) {
+  const id = String(provider ?? "").trim().toLowerCase();
+  return id ? recordOriginsFor(id) : null;
+}