clearotron 0.3.1-beta.1 → 0.3.1-beta.2

package/driver/portal-mcp-client.mjs

@@ -21,12 +21,54 @@ const PROTOCOL_VERSION = "2025-03-26";
 // dev-portal test convention), and the SSE answer needs early-close handling a streamed fetch text()
 // can wedge on. Collects the body until the server ends the response OR the wanted JSON-RPC id has
 // arrived on an SSE frame (whichever first — the transport may hold streams open).
-function post(urlStr, { headers = {}, body = "", wantId = null, timeoutMs = 30000 } = {}) {
+// ── AN ADDRESS IS EITHER A NETWORK ORIGIN OR A LOCAL SOCKET ─────────────────────────────────────────
+//
+// `unix:/run/clearotron/engine.sock` names the engine's local key door. The engine can serve a key door
+// on a socket and an identity door on a port from ONE process, which is the whole point — a deployment
+// that needed both used to run the process twice, and the last attempt to collapse that by switching
+// modes instead of adding a transport cost an outage.
+//
+// THE SOCKET PATH AND THE REQUEST PATH ARE DIFFERENT THINGS, which is the trap this shape exists to
+// avoid. For a network origin the request path is what `/mcp` is appended to; for a socket the whole
+// value IS a filesystem path and the request path is `/mcp` alone. Composing one string for both gives
+// `unix:/run/x.sock/mcp`, which is a file that does not exist — and the failure arrives as a connect
+// error naming a path nobody configured.
+//
+// THE HOST HEADER IS EXPLICIT, AND THE REASON IS NARROWER THAN THE FIRST DRAFT CLAIMED. That draft said
+// Node sends no Host over a socket. It does: measured on this runtime, a request with `socketPath` and
+// no `host` option arrives carrying `Host: localhost` already. So the header is NOT what makes the
+// request work today, and an arm asserting the server saw a Host would pass with this line deleted.
+//
+// It stays because the value is then OURS rather than a runtime default — HTTP/1.1 requires a Host, a
+// socket has no hostname to derive one from, and a default that is currently convenient is not a
+// contract. It names no machine and resolves nothing either way.
+export function dialTarget(urlStr, requestPath) {
+  const raw = String(urlStr ?? "").trim();
+  // ── ONE SPELLING, AND THE OTHERS NORMALISE RATHER THAN ALMOST-WORK ───────────────────────────────
+  //
+  // `unix:/run/x.sock` is the documented form. `unix://` and `unix:///` are what somebody types who has
+  // seen a URL before, and taking everything after the colon verbatim made those produce `//run/x.sock`
+  // and `///run/x.sock`. Both CONNECT, because POSIX collapses leading slashes — so the wrong spelling
+  // works on this platform, is recorded in a settings file, and is a defect waiting for a reader who
+  // compares the configured path to the one the engine prints and finds they differ.
+  //
+  // Collapsed to a single leading slash rather than refused: refusing a spelling that demonstrably
+  // connects would be a new failure for deployments that already use it, and the value is unambiguous
+  // either way — a socket address is always absolute.
+  const m = /^unix:(.+)$/i.exec(raw);
+  if (m) return { socketPath: m[1].replace(/^\/+/, "/"), path: requestPath, headers: { host: "localhost" }, https: false };
+  const u = new URL(`${raw.replace(/\/$/, "")}${requestPath}`);
+  return { socketPath: null, host: u.hostname, port: u.port || (u.protocol === "https:" ? 443 : 80),
+    path: u.pathname + u.search, headers: {}, https: u.protocol === "https:" };
+}
+
+function post(urlStr, { headers = {}, body = "", wantId = null, timeoutMs = 30000, target = null } = {}) {
   return new Promise((resolve, reject) => {
-    const u = new URL(urlStr);
-    const req = (u.protocol === "https:" ? httpsRequest : httpRequest)({
-      host: u.hostname, port: u.port || (u.protocol === "https:" ? 443 : 80), path: u.pathname + u.search,
-      method: "POST", headers: { ...headers, "content-length": Buffer.byteLength(body) },
+    const t = target ?? dialTarget(urlStr, "");
+    const req = (t.https ? httpsRequest : httpRequest)({
+      ...(t.socketPath ? { socketPath: t.socketPath } : { host: t.host, port: t.port }),
+      path: t.path,
+      method: "POST", headers: { ...t.headers, ...headers, "content-length": Buffer.byteLength(body) },
     }, (res) => {
       let data = "";
       const done = () => resolve({ status: res.statusCode ?? 0, headers: res.headers, text: data });
@@ -103,7 +145,10 @@ export const SOCKET_FAILURE_CODES = Object.freeze([
 export const isSocketFailure = (e) => SOCKET_FAILURE_CODES.includes(e?.code);
 
 export async function mcpToolCall({ url, token, tool, args, timeoutMs = 30000 }) {
-  const endpoint = `${String(url).replace(/\/$/, "")}/mcp`;
+  // Resolved ONCE, so all three requests of the handshake dial the same place. Composed per call, the
+  // socket form would have to be re-parsed three times and a divergence would show up as a session that
+  // initializes and then cannot be found.
+  const endpoint = dialTarget(url, "/mcp");
   const headers = (extra = {}) => ({
     "content-type": "application/json",
     "accept": "application/json, text/event-stream",
@@ -112,7 +157,7 @@ export async function mcpToolCall({ url, token, tool, args, timeoutMs = 30000 })
   });
 
   // 1 — initialize (the transport refuses everything else without a session)
-  const initRes = await post(endpoint, { headers: headers(), wantId: 1, timeoutMs,
+  const initRes = await post(null, { target: endpoint, headers: headers(), wantId: 1, timeoutMs,
     body: JSON.stringify({ jsonrpc: JSONRPC, id: 1, method: "initialize", params: {
       protocolVersion: PROTOCOL_VERSION, capabilities: {},
       clientInfo: { name: "trademark-portal", version: "poc" } } }) });
@@ -122,11 +167,11 @@ export async function mcpToolCall({ url, token, tool, args, timeoutMs = 30000 })
   parseRpcText(initRes, 1);   // surfaces JSON-RPC-level init errors
 
   // 2 — initialized notification (the spec's handshake close; some transports require it)
-  await post(endpoint, { headers: headers({ "mcp-session-id": sessionId }), timeoutMs,
+  await post(null, { target: endpoint, headers: headers({ "mcp-session-id": sessionId }), timeoutMs,
     body: JSON.stringify({ jsonrpc: JSONRPC, method: "notifications/initialized" }) }).catch(() => { /* best-effort */ });
 
   // 3 — the one tool call
-  const callRes = await post(endpoint, { headers: headers({ "mcp-session-id": sessionId }), wantId: 2, timeoutMs,
+  const callRes = await post(null, { target: endpoint, headers: headers({ "mcp-session-id": sessionId }), wantId: 2, timeoutMs,
     body: JSON.stringify({ jsonrpc: JSONRPC, id: 2, method: "tools/call", params: { name: tool, arguments: args } }) });
   if (callRes.status >= 400) throw transportError(`MCP tools/call refused (${callRes.status}): ${callRes.text.slice(0, 200)}`, callRes.status);
   const msg = parseRpcText(callRes, 2);

package/driver/portal-service.mjs

@@ -35,12 +35,20 @@
 import "../shared/env-local.mjs";   // — FIRST: applies the CLEAROTRON_* translation before any module-top
 // capture evaluates. Reads no `.env` here — that load is gated on isCliEntry(argv[1]).
 import { readFileSync, existsSync, readdirSync, statSync } from "node:fs";
+import { hostname as osHostname } from "node:os";   // — the address a refusal page names when nothing else identifies this instance
+
+// The port this service listens on when nobody says otherwise. Declared here rather than at the
+// listener, because the refusal page names the address too and it is composed on IMPORT-side code: the
+// listener's own constants live inside the entry-point branch and do not exist when another module
+// calls in. One definition, two readers, no second literal to drift.
+const PORTAL_PORT_DEFAULT = 18802;
 import { storeInRepo, storeOutsideRepoMessage, makeCommittableAudit, resolveStoreRepoRoot, makeStoreCommit } from "../shared/store-in-repo.mjs";   //,
 import { customerStoreDir, customerStoreLine } from "../shared/customer-store.mjs";   // — one store for the surface and the runs
 import { clientFailureNote } from "../shared/client-failure-note.mjs";   // — one sentence, three surfaces
 import { bareInvocation, browserCommand, invocationPrefix, installRoute, npxVersionOf } from "../shared/invocation.mjs";   // — and why this one surface is by NAME
 import { stdioConnectOffer, stdioConnectFor, STDIO_SHAPES } from "../shared/stdio-connect.mjs";   // — ONE author for the connect route
-import { isWsl } from "../shared/wsl.mjs";   // — on WSL, the connect lines say where they run
+import { isWsl, wslTarget } from "../shared/wsl.mjs";   // — on WSL, the connect lines say where they run and cross the boundary themselves
+import { doorKind } from "../shared/mcp-challenge.mjs";   // — one reading of what a connector asks for, shared with doctor
 import { connectOffers, offersForWire } from "../shared/connect-clients.mjs";                 // — ONE table, resolved server-side
 
 /**
@@ -80,7 +88,7 @@ export function opsTokenFor({ bootToken, roster, mint }) {
 // `EnvironmentFile=%h/.env`, and `childEnv` passes the same value to the portal child — so this process
 // has held the signing secret on both start paths for as long as both have existed. The comment has been
 // corrected in place rather than left to be trusted.
-import { mintToken, loadGrants, resolvePerson } from "../shared/scope.mjs";
+import { mintToken, loadGrants, resolvePerson, addressesInGrants } from "../shared/scope.mjs";
 import { withPerson, withCompany } from "../shared/grants-edit.mjs";
 import { resolvePort } from "../shared/listen.mjs";   // — the port SOURCE, decided once
 import { fileURLToPath } from "node:url";
@@ -2301,6 +2309,30 @@ export function makePortalService({
       // every multi-account client was told the connector did not exist yet, while single-account clients
       // saw it. `door:true` is the mode for exactly this question — may this identity enter — and it is what
       // /portal/api/me already uses.
+// ── ONE READING OF THE CONNECTOR'S OWN DOOR, CACHED ────────────────────────────────────────────────
+//
+// The same unauthenticated probe `doctor` makes, asked here so the connector steps follow what the door
+// actually answers. Bounded three ways, because this sits on a page load: a short timeout, a one-minute
+// cache, and a failure that answers `null` rather than throwing — a page that cannot read its door says
+// so, which is the honest half of this change.
+let doorKindCache = { at: 0, url: null, kind: null };
+const DOOR_KIND_TTL_MS = 60_000;
+async function connectorDoorKind(url) {
+  if (!url) return null;
+  const now = Date.now();
+  if (doorKindCache.url === url && now - doorKindCache.at < DOOR_KIND_TTL_MS) return doorKindCache.kind;
+  let probe = null;
+  try {
+    const res = await fetch(url, { method: "GET", redirect: "manual", signal: AbortSignal.timeout(2000) });
+    let body = null;
+    if (res.status === 401) { try { body = (await res.text()).slice(0, 400); } catch { body = null; } }
+    probe = { ok: res.status < 500, status: res.status, error: null, challenge: res.headers.get("www-authenticate"), body };
+  } catch (e) { probe = { ok: false, status: null, error: String(e?.cause?.code ?? e?.name ?? e?.message ?? e) }; }
+  const kind = doorKind(probe);
+  doorKindCache = { at: now, url, kind };
+  return kind;
+}
+
       if (parts[1] === "api" && parts[2] === "mcp-access" && method === "GET") {
         assertPrincipal(principal, { door: true });   // throws PortalDeny(403) for an unmapped identity
         const url = process.env.CLEAROTRON_CLIENT_MCP_URL || null;
@@ -2347,7 +2379,7 @@ export function makePortalService({
         const offers = connectOffers({
           stdioRoutes: stdio
             ? Object.fromEntries(Object.keys(STDIO_SHAPES).map((shape) =>
-                [shape, stdioConnectFor(shape, { workDir: process.env.CLEAROTRON_WORK_DIR || null, reportsDir: process.env.CLEAROTRON_REPORTS_DIR || null })]))
+                [shape, stdioConnectFor(shape, { workDir: process.env.CLEAROTRON_WORK_DIR || null, reportsDir: process.env.CLEAROTRON_REPORTS_DIR || null, wsl: wslTarget() })]))
             : {},
           wsl: isWsl(),
           // ONE ADDRESS, and it is the publicly reachable one ( §5). The
@@ -2356,6 +2388,13 @@ export function makePortalService({
           // a question the moment it auto-started with the product.
           publicAddress: url,
           operator: principal.email ?? null,
+          // WHAT THE DOOR ANSWERS, read from the door rather than assumed by the row. The steps used to
+          // be fixed: Claude's said to paste a key and set authentication to None, which is right for a
+          // self-hosted door and cannot work on any deployment behind an identity provider — the key is
+          // minted for nothing and the warning the reader is told to ignore IS the sign-in. Cached
+          // because this is a page load, not a check: one reading serves every reader for a minute, and
+          // a door that could not be read leaves this null so the page says so instead of guessing.
+          door: await connectorDoorKind(url),
         });
         return { status: 200, json: {
           url,                                   // null ⇒ the UI keeps its honest empty state
@@ -3385,7 +3424,20 @@ async function readJsonBody(req, limitBytes = 131072) {
 /**
  * The instance a refusal page names: its organisation when one is configured, otherwise the host of the
  * sign-in service it sends people to (the OIDC issuer, or the Access team's own domain, derived as the
- * verifier derives it). `null` when neither is set. Read from the environment at call time.
+ * verifier derives it), and failing both the address this process is answering on.
+ *
+ * NEVER NULL, AND THAT IS THE CHANGE. It used to return null with neither configured, and a page that
+ * says nothing about which instance it is defeats the whole point of the sentence — the reader who met
+ * this through a forwarded port could not tell somebody else's refusal from their own, which is the
+ * defect the line exists for. The unconfigured instance is the one most likely to be reached by
+ * accident, so it is the last case that should stay silent.
+ *
+ * THE HOSTNAME IS THE LAST RESORT, not the first, and the note that used to say "never by this
+ * server's own hostname" was right about the order and wrong about the floor. An organisation name and
+ * a sign-in service are public by nature and mean something to a reader; a machine name is neither, and
+ * it is disclosed only where the alternative is a page that identifies nothing at all — an instance
+ * with no organisation and no sign-in service, which is a local one whose reader is the person running
+ * it. Read from the environment at call time.
  */
 function instanceIdentity(env = process.env) {
   if (ORGANISATION_NAME) return `This is ${ORGANISATION_NAME}'s ${BRAND.name} portal`;
@@ -3394,7 +3446,13 @@ function instanceIdentity(env = process.env) {
   let host = null;
   try { host = issuer ? new URL(issuer).host : null; } catch { host = null; }
   if (!host && team) host = `${team}.cloudflareaccess.com`;
-  return host ? `This ${BRAND.name} portal signs people in through ${host}` : null;
+  if (host) return `This ${BRAND.name} portal signs people in through ${host}`;
+  // The address this process answers on: what a reader can compare against the one they typed. The port
+  // is the half that matters where a forward is in play, since the machine name will often be the same.
+  const port = String(env.PORTAL_SERVICE_PORT ?? "").trim() || String(PORTAL_PORT_DEFAULT);
+  const machine = (() => { try { return osHostname(); } catch { return ""; } })();
+  const at = [machine, port].filter(Boolean).join(":");
+  return at ? `This ${BRAND.name} portal is the one running on ${at}` : `This is a ${BRAND.name} portal`;
 }
 
 /**
@@ -4058,7 +4116,7 @@ if (isMain) {
   // — resolved through the shared helper so the SOURCE travels with the number. "18802" and
 // "18802 because nobody said otherwise" are different addresses to an operator, and only the
 // second one is a guess at which instance this is.
-const PORT_CHOICE = resolvePort({ value: process.env.PORTAL_SERVICE_PORT, name: "PORTAL_SERVICE_PORT", fallback: 18802 });
+const PORT_CHOICE = resolvePort({ value: process.env.PORTAL_SERVICE_PORT, name: "PORTAL_SERVICE_PORT", fallback: PORTAL_PORT_DEFAULT });
 const PORT = PORT_CHOICE.port;
   const HOST = process.env.PORTAL_SERVICE_HOST || "127.0.0.1";
   // ──: THE IDENTITY SOURCE IS A MODE, AND IT IS NAMED, NOT INFERRED ─────────────────────────
@@ -4177,7 +4235,12 @@ const PORT = PORT_CHOICE.port;
     // within one domain, and catastrophic here: staff would fail the email list while clients failed the
     // domain list, refusing everyone. That is not hypothetical; it happened in production and locked out
     // every identity including the one the domain rule exists for.
+    // AND THE PEOPLE ADDED SINCE THIS LINE RAN. The two lists above are the environment's, read once —
+    // they mirror a sign-in configuration that lives off this box, and they are the fail-closed floor.
+    // The guest list is this deployment's own, written by the People page, and it is asked at verify
+    // time so somebody added on the page can sign in without a restart. It can only ADD.
     verify = makeAccessVerifier({ team: TEAM, aud: AUD, allowedDomains: DOMAINS, allowedEmails: EMAILS, identityMode: "union",
+      allowedNow: () => addressesInGrants(),
       issuer: OIDC_ISSUER || undefined, jwksUrl: JWKS_URL || undefined, emailClaim: EMAIL_CLAIM });
     // THE BANNER NAMES THE HEADER AND THE CLAIM, because a mis-set header is otherwise indistinguishable
     // from a blanket 401 — the operator reads it here instead of discovering it as "nobody can log in".

package/driver/profile-page.html

@@ -299,8 +299,30 @@ function clearFieldErrors() {
   [...$("editor").querySelectorAll(".invalid")].forEach(el => el.classList.remove("invalid"));
   [...$("editor").querySelectorAll(".fielderr")].forEach(el => el.remove());
 }
+// ── ONE REFUSAL, WHICHEVER VIEW IS RENDERED ─────────────────────────────────────────────────────────
+//
+// The customer editor and the project overlay both write into #editor, so they REPLACE each other and
+// at most one input for a given concept is ever in the document. They name the same concepts under
+// different prefixes: f_juris and p_juris, f_platforms and p_platforms, ten of the thirteen in all.
+//
+// The server-error table names the customer editor's id. On the overlay that id resolves to nothing,
+// markField's guard correctly returns, and the refusal reaches the panel with no field marked — the
+// reader is told WHAT is wrong and not WHERE, which is the half the main editor already fixes.
+//
+// RESOLVED HERE, IN THE ONE FUNCTION EVERY CALLER GOES THROUGH, rather than by giving the table a
+// second column. A column covers the rows somebody remembered; this covers every row by construction,
+// including the three concepts that have no overlay counterpart today and any row added later. Those
+// three resolve to nothing and markField's guard handles them exactly as before.
+//
+// It never crosses views: the alternate is consulted ONLY when the named id is absent, so a customer
+// editor on screen always marks its own field even though the overlay names the same concept.
+function onScreenField(id) {
+  if ($(id)) return id;
+  const alt = String(id).replace(/^f_/, "p_");
+  return alt !== id && $(alt) ? alt : id;
+}
 function markField(id, message) {
-  const el = $(id); if (!el) return;
+  const el = $(onScreenField(id)); if (!el) return;
   el.classList.add("invalid");
   const det = el.closest("details"); if (det) det.open = true;   // surface a highlight hidden under More options
   const field = el.closest(".field") || el.parentElement;

package/driver/profiles.mjs

@@ -664,7 +664,11 @@ export function validateProfileEdit(key, profileObj, contextPack = "", { sparse
       errors.push(`profiles/${key}.json: ${dropped.map((d) => JSON.stringify(d)).join(", ")} `
         + `${dropped.length === 1 ? "is not a territory" : "are not territories"} the engine can search, `
         + `so storing ${dropped.length === 1 ? "it" : "them"} would be a default that silently does `
-        + `nothing. Use a country name, or a two-letter code such as US, GB or EU.`);
+        // NAME THE RULE THAT FIRED, and this is the sentence a person actually reads — the panel renders
+        // THIS, not the field contract's wording, so correcting that one and not this one left the
+        // refusal telling a reader to do what they had just done. The rule is not the shape of the entry:
+        // an unknown two-letter code is refused by a sentence that used to ask for a two-letter code.
+        + `nothing. Use a country name, or one of the two-letter codes the engine holds, such as US, GB or EU.`);
     }
   }
   return { ok: errors.length === 0, errors };

package/driver/register-availability.mjs

@@ -41,9 +41,9 @@
 // CORRECTED 2026-08-11 — THIS PARAGRAPH USED TO SAY "one qid per office … which is the shape
 // joinPlanToBands already has", AND THAT WAS FALSE ABOUT THE COMPILER IT DOCUMENTS. There is no
 // per-office qid. compileRegisterPlan narrows ONE shared `regions` array and hands it to every entry
-// (register-plan.mjs:550); the unreachable office produces no entry, so no qid, so no band block, so
+// (register-plan.mjs:572 compileRegisterPlan); the unreachable office produces no entry, so no qid, so no band block, so
 // nothing ever reaches joinPlanToBands' deferred bucket — whose only source is a block stamped
-// `error:true && deferred:true` (register-plan.mjs:1093).
+// `error:true && deferred:true` (register-plan.mjs:1115 extendRegisterPlan).
 //
 // The consequence was not academic. `deferred_coverage` rode the plan and nothing that a reader sees
 // read it: coverage-form.mjs seeded its deferred rows from skeleton qids alone, so an EU+US matter on a

package/driver/register-plan.mjs

@@ -260,6 +260,28 @@ export const planMaxOrWidth = (capabilities) =>
 // The plan emits ONE `wildcard` predicate; the provider contract splits it into three sub-capabilities.
 // Mirrors the executor's planPredicateParams anchoring exactly (trailing * → prefix/starts-with,
 // leading * → suffix/ends-with, both/neither → infix over the raw pattern).
+//
+// ── WHICH ANCHOR, NEVER WHETHER THE TERM IS A PATTERN ────────────────────────────────────────────────
+//
+// This function and `termPredicateIssue` (providers/_shared/term-shape.mjs) were read as contradicting
+// each other: this one maps an unanchored term to `wildcardInfix` — a real, dispatchable capability —
+// while that one calls a wildcard term carrying no pattern syntax a compiler bug. They are not in
+// conflict, because they are keyed on different things and answer different questions:
+//
+//   this function      keys on `*` ALONE, because `*` is what the executor anchors on, and answers
+//                      WHICH of the three sub-capabilities a provider must declare.
+//   termPredicateIssue keys on `[*?]`, and answers WHETHER the term is a pattern at all.
+//
+// `?` is the case that shows the two apart rather than merely asserting they differ. The
+// form-neighbourhood generator mints vowel-slot patterns like `sk?` and `v?ltr?n`: starless, so this
+// function correctly calls them infix, and full of pattern syntax, so termPredicateIssue correctly
+// passes them. They are dispatched, and they must stay dispatchable. Keying this function on `[*?]`
+// to make the two "agree" would desync it from planPredicateParams and misroute every `?` pattern.
+//
+// A term carrying NEITHER `*` NOR `?` is the only string both functions see, and it is one that must
+// never reach the compiler at all: skeletonPatterns no longer emits one (see the note there). This
+// function keeps no opinion about it, which is correct — asking an anchoring mirror to police
+// well-formedness is what would put the two definitions in genuine conflict.
 export function wildcardCapabilityKey(term) {
   const t = String(term ?? "");
   if (t.endsWith("*") && !t.startsWith("*")) return "wildcardPrefix";

package/driver/scope-ledger.mjs

@@ -305,3 +305,36 @@ export function channelsDiagnosis(md) {
   // empty `offered` — which is honest, because the seat did write the line.
   return { state: channels.length ? "named" : "all-rejected", channels, offered, rejected };
 }
+
+/**
+ * THE CHANNELS THE OFF-REGISTER GRID ACTUALLY RUNS, for any profile.
+ *
+ * The grid used to search the customer profile's storefronts whatever the matter was about. A delivered
+ * global preliminary carried 45 terms across 8 platforms, and the 8 were the profile's list; the matter
+ * frame had named the matter's own ecosystem — server hosts, a plugin repository, a competing platform —
+ * and none of it reached the grid, because nothing carried a frame-named channel into it. The reviewing
+ * lawyer graded a plugin published on a repository the run never queried.
+ *
+ * THE FRAME'S CHANNELS ARE ADDED, NOT SUBSTITUTED, for a named profile. That profile's platform list is
+ * the client's own mandate — it is what they told us to sweep — so it stands, and what the frame names
+ * about this matter runs beside it.
+ *
+ * THE GENERIC PROFILE STILL REPLACES, and that is a decision rather than an inconsistency. Generic's
+ * platforms are a house default, not anybody's mandate, and the reason the replacement exists is that a
+ * regulated or B2B matter must not be forced onto consumer storefronts and then read as swept. A union
+ * there would put the storefronts back into exactly the runs that branch was written to keep them out of.
+ *
+ * Order is profile-first so an existing run's cells keep their place in the spec, and the frame's
+ * additions follow. Deduplicated on the normalised value: a frame naming a platform the profile already
+ * carries adds a sentence, never a second cell. PURE.
+ *
+ * @returns {{channels: string[], added: string[], diag: object}}
+ */
+export function gridChannels({ profilePlatforms = [], profileKey = null, matterMd = "" } = {}) {
+  const diag = channelsDiagnosis(matterMd);
+  const base = (profilePlatforms ?? []).filter(Boolean);
+  if (profileKey === "generic") return { channels: diag.channels.length ? diag.channels : base, added: [], diag };
+  const seen = new Set(base.map((p) => String(p).trim().toLowerCase()));
+  const added = diag.channels.filter((c) => !seen.has(String(c).trim().toLowerCase()));
+  return { channels: [...base, ...added], added, diag };
+}

package/driver/skills/prelim-common-law/SKILL.md

@@ -498,9 +498,11 @@ For every Consumer-confusion-risks row that is a **game title** (Steam game, Mic
 
 **Extraction sources, in priority order:**
 1. The Perplexity result's explicit "developed by X" / "published by Y" statement, when present
-2. The platform store page's developer / publisher metadata (Steam, Microsoft Store, App Store all expose these as structured fields)
+2. **The platform's own record of the thing** — whatever that platform publishes about who made it, when it appeared and how large it is. A store's developer / publisher metadata is the familiar case (Steam, Microsoft Store and the app stores expose these as structured fields), and it is an EXAMPLE rather than the set: a platform that is not a store still keeps a record, in page metadata or on a public endpoint of its own, and it is read the same way. Open it before writing that the owner is unknown.
 3. The game's Wikipedia article's infobox developer / publisher row, when the platform page is ambiguous
 
+**"Not extracted" is written with the source OPEN and the field genuinely absent.** A delivered run held a competing platform's own page address for a title, wrote that no creator account behind it could be identified, and carried no launch date and no scale — while that platform published the creator, the creation date and the visit count, unauthenticated, to anyone who asked. The reviewing lawyer named the studio, the month and the visit count, and rated the game inactive on them. The pass had treated a non-store platform as unreadable because this list named only stores. Record what you read, including the reading that came back empty; `not extracted` after a look is a finding, and `not extracted` instead of a look is a gap the reader has to close by hand.
+
 **When the attribution cannot be extracted:**
 - Write **`not extracted`** as the field value
 - Add the candidate to the Open verification flags section with the specific gap

package/driver/skills/prelim-search/synthesis-rules.md

@@ -205,7 +205,7 @@ For each material finding, document (in the Findings sheet's Key Factors column)
 1. **Factual basis:** what was found, on which layer(s), how significant
 2. **The LEGAL read — the claim's strength net of credible merits defences.** It answers one question — *if this party sued us, would they win?* — so it is the probability the claim **prevails**, assessed **net of the client's credible merits defences** and stated **with its bounds**. **State that probability in plain words, in the vocabulary THE FRAMEWORK IN FORCE uses** — read its Legal position definitions and answer in their terms, whether that is a likelihood-of-winning ladder, a probability band or a lettered level. These words are what that framework's band definitions key on, and the read and the band are one judgment that may not disagree (Reasoning posture 4: *the band follows the words*). If your reasoning reaches "better-than-even is not reached" / "distinguishable as wholes" / "confusion is unlikely", the read is the client-favoured one — and a crowded field is a ceiling that lets you reach it, never a floor that parks you above it. Start from the whole-mark confusion read (marks compared *as wholes*, centred on the dominant element, × G&S proximity — see *The consumer confusion test* below); element-overlap alone is not a legal read. Then **price in, by name, the merits defences that bear on whether the claim prevails** — descriptiveness / weak distinctiveness of the senior mark, the opponent's own undermining conduct (their own descriptive or off-field use of the term — from the Step 3.6 workup), **no real commercial / manner-of-use overlap between our actual use and theirs** (judged against the senior right's own scope — a registered senior meets us on its mark and G&S **as registered**, a common-law senior on its **actual trade**: our use is an in-product / descriptive label vs their standalone brand, or the two sit in genuinely different commercial fields — the goods-half of the confusion test, so it lowers the read; the senior's *current presentation / trade dress* never narrows its registered scope — that is Stage-2 enforcement reality), the client's descriptive / fair-use defence, and relative priority. The **gross identity read** ("identical mark, identical class, prior filing — direct identity on the register") is stated *inside* the finding as the starting observation; it is **not** the headline read. The headline carries the **net** strength **plus its bounds** — the jurisdiction and time it holds in, and the named triggers that would move it (e.g. "more likely than not to prevail — Germany only, only while the application remains live; rises if [named trigger]"). This **replaces** a gross-identity assignment — it does not footnote the defences under a maximal headline. **Practical** factors (actual use, revocability, enforcement appetite, coexistence, the senior's own market presentation / trade dress) are *not* merits — they sit in the business read (item 4) and enter the band through the framework's own **Practical position** definitions (or its matrix inputs where it states one); they never move the legal read directly. **Name the theory setting the read.** If the mark is distinguished by its own distinctive matter (a house mark or distinctive prefix), that distinguished read is the ceiling — any escalation above it must be a named consumer-confusion theory (e.g. evidence of actual confusion). Optics, PR, partner-sensitivity, audience overlap, and owner size are **not** confusion theories: they annotate (Reasoning posture 3), they never raise the read.
 3. **Business / practical read (separate from the legal read):** actual use, revocation-vulnerability, owner enforcement appetite, coexistence likelihood, channels, commercial-relationship / partnership context — the practical exposure stated *beside* the legal read, never folded into it. **For high-risk findings, this read must carry a practical-likelihood statement — how likely this owner is to actually create a problem — grounded in the Step 3.6 owner workup (their own use of the term, portfolio under owner-name variants, enforcement posture), not inferred from the register row alone.**
-4. **The BAND — reasoned through the framework in force.** Take the legal read (item 2) and the practical read (item 3) through the framework's own band definitions — its Legal position / Practical position / Potential outcomes per band, or its Level × Dispute Type matrix where it states one — and state the band **word**, verbatim from that framework. The two reads move the framework's *inputs*; its stated method yields the band, honouring any ceilings it states — a practical or optics factor never lifts the band past what the framework's method produces. A clear win with no material risk yields **no band** (not a rated conflict — Reasoning posture 4).
+4. **The BAND — reasoned through the framework in force.** Take the legal read (item 2) and the practical read (item 3) through the framework's own band definitions — its Legal position / Practical position / Potential outcomes per band, or its Level × Dispute Type matrix where it states one — and state the band **word**, verbatim from that framework. The two reads move the framework's *inputs*; its stated method yields the band, honouring any ceilings it states — a practical or optics factor never lifts the band past what the framework's method produces. A clear win with no material risk yields **no band** (not a rated conflict — Reasoning posture 4), and so does a conflict whose proprietor you could not identify on the record searched: with no party there is no legal read to take through the framework, so it is carried as an open item naming the identification step, never rated.
 5. **Elevation / mitigation factors observed** (if any) — tag each as bearing on the legal read or the business read (the factor lists live under *Firm-wide reasoning discipline* below).
 6. **Source-layer note:** which layer(s) surfaced this; whether cross-pollination ran for it
 7. **Client prior-use adjacency check:** examine the request form's "Manner of Use" and "Additional Information" fields for evidence of prior use of the proposed mark by the client. If found, apply the *client prior-use rule* (under Firm-wide reasoning discipline below; adjacency tiers — same/adjacent-goods/adjacent-industry/none) to weigh the applicant's prior-use defence on the **business** read. When same-goods or adjacent-goods prior use exists, headline-frame it in the narrative summary's scope statement (not just in the per-finding Key Factors). Example framing: "the applicant may own common-law rights in the mark for [its prior goods], or at least a right to continued use for those goods and highly similar ones." **When a senior conflict makes priority live, resolve the *filing* branch instead of punting it:** consume the applicant own-rights sweep (`prelim-register/digest.md` Step 4 — rows tagged `applicant_own_rights`) and state the client's own filing/footprint position as a **separate "client's own prior rights" note** (e.g. "no prior client filing predating [conflict] was found" or "the client holds earlier filing [X] covering [Y]"). This note is **never a conflict / Findings-sheet row, never gates or down-rates the conflict sweep, and never feeds the rating** — it surfaces as an own-rights note / `# Actions` line (per `delivery-contract.md`). The *internal / undocumented-use* branch is invisible to any external search, so leave it as a one-line client question, framed as such ("confirm any unregistered prior use of the mark by the client").
@@ -569,6 +569,8 @@ For every common-law game-title finding (Steam title, Microsoft Store title, App
 
 The `narrative-refutation` gate (Phase 2 Step 4.7) blocks delivery if the narrative contains a named publisher / developer not traceable to `common-law-findings.md`'s extraction.
 
+**A conflict whose proprietor cannot be identified on the record searched has no band at all.** Not a low one: the framework rates a legal read, and a legal read needs a party — who holds the right, what they have done with it, whether they would act. With the owner unknown none of that can be reasoned, so a band placed anyway is a number standing in for the work of finding out, and it reads to the client as though somebody had looked. A delivered run rated such a conflict Low as "distinguished on the mark itself" while its own off-register pass had met the title four times without ever looking it up, and the pending family behind it was found later by the reviewing lawyer. Carry it in the actions as an open item that names the identification step — who the proprietor is, and what is pleaded — and leave it out of the rated findings and out of the reasoned negatives, which are the two places a reader takes as settled.
+
 ## Registration metadata — copy, never restate
 
 Same anti-laundering discipline as common-law attribution above, applied to **register records**: a registration fact is **copied verbatim from the fetched record, never restated from memory.** This covers the **registration number, application/serial number, filing date, registration date, expiry date, Nice classes, and live/dead status.**

package/driver/stages.mjs

@@ -1359,7 +1359,7 @@ export const STAGES = {
       // EACH FIELD CARRIES ITS OWN IMPERATIVE IN ITS OWN SENTENCE (: a field phrased outside one was
       // written 0 of 9 times against 74 of 74 when imperative-carried).
       `Hand the frame back by calling the \`record_matter_frame\` tool. Send \`prose_body\` — the commercial read of the matter in full prose: client, sector, product description, customer base, channels of trade, off-field sectors, sector-convergence flags, watchlist-owner seeds, your scope reasoning, the class scope and adjacency call with a one-line reason per class, the applicant's own and affiliated marks, and the campaign shape where you are inferring one (label an inference as an inference).`,
-      `Send \`scope_basis\` as "instructed" or "derived", with \`scope_jurisdictions\` and \`excluded_jurisdictions\` as arrays of territories.`,
+      `Send \`scope_basis\` as "instructed" or "derived", with \`scope_jurisdictions\` and \`excluded_jurisdictions\` as arrays of territories. Send \`identified_classes\` — the Nice classes you judge NECESSARY that the request did NOT instruct, each as {class, reason}, the class a whole number 1-45 and the reason one line. These are searched for every variant, not only the exact name, so name a class only where you would defend charging for it; omit the field or send an empty array where the instructed classes are the whole scope, which is the ordinary answer and adds nothing.`,
       // The driver STAMPS the instructed-scope section from _driver/instructed-scope.json, so the seat is
       // not asked to quote back values the driver wrote at intake. That retyping was the stage's
       // `frame_scope_missing` loop and it is gone; see matter-frame-record.mjs.
@@ -4613,6 +4613,15 @@ export function whatsappRouting(job, agentId) {
   const who = email || handle || "the requester";
   return {
     whatsappTo: to,
+    // THE CHANNEL, BESIDE THE NUMBER, because a courier's messaging tool refuses a send that does not
+    // name one as soon as the assistant has more than one channel configured — "Channel is required
+    // when multiple channels are configured: msteams, whatsapp" — and the notice is then composed,
+    // addressed and discarded on one log line. The courier sheet said "send it there" and named no
+    // channel, so the instruction was correct for an assistant with exactly one and silently wrong for
+    // any other. A field is harder to lose than a sentence: the packet now states which channel this
+    // route is on, and the sheet tells the courier to pass it. It rides into the delivery packet by
+    // construction — pipeline.mjs and pipeline-knockout.mjs both spread this object into it.
+    whatsappChannel: "whatsapp",
     whatsappToReason: to ? null : `no chat number is held for ${who} — set one in CLEAROTRON_REQUESTER_WHATSAPP to notify them`,
     whatsappCcOperator: OPERATOR_WHATSAPP_COPY ? (AGENT_WHATSAPP[agentId] ?? null) : null,
   };