clearotron 0.3.1-beta.2 → 0.3.1-beta.4

package/bin/grant.mjs

@@ -64,7 +64,7 @@
 import "../shared/env-local.mjs";
 import { readFileSync, existsSync } from "node:fs";
 import { assertGrantsShape } from "../shared/scope.mjs";   // — one shape check, not a second opinion
-import { withPerson, withOrganisation, withCompany } from "../shared/grants-edit.mjs";   // — the People page's own editors
+import { withPerson, withoutPerson, personPoints, withOrganisation, withCompany } from "../shared/grants-edit.mjs";   // — the People page's own editors
 import { basename } from "node:path";
 import { atomicWrite } from "../driver/progress.mjs";
 import { accessView } from "../driver/portal-config-view.mjs";
@@ -287,27 +287,26 @@ if (cmd === "remove") {
   const email = String(argv[1] ?? "").trim().toLowerCase();
   const only = flag("tenant");
   if (!email) usage();
-  let removed = 0;
-  for (const [name, t] of Object.entries(grants.tenants)) {
-    if (only && name !== only) continue;
-    if (t?.users && email in t.users) { delete t.users[email]; removed++; }
-    // AN EMPTY `users` MAP IS NOT A DELETED TENANT, and this writes the former deliberately: the tenant
-    // still exists and still holds its accounts, it simply has nobody on its guest list. Deleting the
-    // tenant here would destroy configuration the operator never asked to remove, and it round-trips —
-    // `remove-tenant` is the other verb, and it is explicit.
-  }
-  // AND THE PERSON'S OWN ENTRY, when they are removed from everywhere. Their permissions and their access
-  // to everything live under `people`, not in any tenant, so a removal that left that entry would leave a
-  // person who sees everything still seeing everything. Removed from one tenant, they may still hold
-  // access elsewhere, and their entry stays.
-  const peopleKey = only ? undefined : Object.keys(grants.people ?? {}).find((k) => k.toLowerCase() === email);
-  if (peopleKey !== undefined) delete grants.people[peopleKey];
-  if (!removed && peopleKey === undefined) die(`${email} is not on the guest list${only ? ` for "${only}"` : ""}. Nothing written.`);
-  atomicWrite(FILE, JSON.stringify(grants, null, 2) + "\n");
-  out(`Removed ${email} from ${removed} tenant(s)${peopleKey !== undefined ? ", and their permissions under people" : ""}. Written to ${basename(FILE)}.`);
-  const kept = Object.entries(grants.people ?? {}).find(([k]) => k.toLowerCase() === email)?.[1];
-  if (kept?.everything === true)
-    out(`${email} still has access to everything through their entry under people. \`grant remove ${email}\` without --tenant takes that away too.`);
+  // THROUGH THE SAME EDITOR THE PORTAL USES. This command used to delete the keys itself, and the two
+  // paths had drifted: `people` was matched without regard to case here and the tenant guest lists were
+  // matched exactly, so a hand-edited file holding `Dana@x` under an organisation kept that row through a
+  // removal that reported success. One function now answers for both faces.
+  const held = personPoints(grants, email);
+  const points = only ? held.points.filter((p) => p.tenant === only) : [];
+  if (!held.listed && !held.points.length)
+    die(`${email} is not on the guest list. Nothing written.`);
+  if (only && !points.length)
+    die(`${email} is not on the guest list for "${only}". Nothing written.`);
+  let after;
+  // A TENANT-SCOPED REMOVAL OF SOMEBODY WHO HOLDS EVERYTHING IS REFUSED, where it used to be done and
+  // then warned about. Access to everything lives under `people` and in no organisation, so striking one
+  // organisation's row changed nothing the person could see — and the sentence saying they had been
+  // removed was printed first, with the correction below it.
+  try { after = withoutPerson(grants, { email, points, all: !only }); }
+  catch (e) { die(`${String(e?.message ?? e)} Nothing written.`); }
+  const orgs = only ? 1 : new Set(held.points.map((p) => p.tenant)).size;
+  atomicWrite(FILE, JSON.stringify(after, null, 2) + "\n");
+  out(`Removed ${email} from ${orgs} tenant(s)${only ? "" : held.listed ? ", and their permissions under people" : ""}. Written to ${basename(FILE)}.`);
   process.exit(0);
 }
 

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "3e6266f5960e7990e767edbdb95ca50831156b55",
-  "version": "0.3.1-beta.2"
+  "commit": "770229d7131d7aee6f8fb32e2f90c02b44e08d2a",
+  "version": "0.3.1-beta.4"
 }

package/driver/CHANGELOG.md

@@ -1,5 +1,38 @@
 # clearotron-driver
 
+## 0.3.1-beta.4
+
+### Patch Changes
+
+- 6d0c8f5: Fixed: The portal now tells your browser not to store the data its screens read. Those responses carry people's names, company access and run lists, and nothing previously said how long a browser could keep them.
+  
+  For operators: every JSON response from the portal now sends `Cache-Control: no-store` and `Vary: Accept`. A route that sets a stricter policy of its own keeps it.
+
+## 0.3.1-beta.3
+
+### Patch Changes
+
+- d0d42f7: Fixed: A name in a knockout batch is no longer rated above every conflict found against it. Its rating now follows from the conflicts on its own page.
+  
+  Fixed: Before, a rule forced any name made of everyday words off the lowest band, whatever the search found. That rule is gone for every client.
+- 56a760f: Fixed: Giving somebody access to everything on the installation now works from the access form. It used to refuse. The message it refused with said you can only give access to what you hold yourself, which was not true of the person seeing it.
+- 8c3bc3b: New: Ask AI on a report now opens Claude or ChatGPT with a question about that report already typed in. One press, in a new tab, and nothing is sent until you send it.
+  
+  The button used to hand over a connector address and a question carrying the run's internal code, with no indication of which one you needed. The address belongs on the Use your own AI page, where you set the connector up once. It is no longer shown on reports at all.
+  
+  If you have not connected an assistant yet, the button explains that in a line and offers to take you there.
+  
+  For operators: the report's own "Ask your AI" band is gone, so there is one Ask AI control rather than two. Reports rendered before this upgrade keep the band in their own file, and it is hidden when the portal serves them.
+- 56a760f: Fixed: `clearotron grant remove --tenant` now refuses when the person has access to everything on the installation. It used to remove the organisation and then warn that nothing they could see had changed.
+  
+  Fixed: Removing somebody whose address is spelled with different capitalisation in different parts of the access file now removes all of them. Half of the entry used to survive, and the command reported success.
+- 56a760f: New: Access can now be narrowed and taken away, not only added to. Somebody who manages one organisation removes that organisation alone. Somebody who can see all of a person removes their access to the installation, and withdraws the keys their AI assistant was using.
+  
+  Fixed: A removal now says plainly when the connector cannot be told about it yet, instead of implying the assistant lost access too.
+- f1c5925: Fixed: Where a search covers two ratified forms of a name, the report now reasons each form and says which conflicts differ between them.
+  
+  Fixed: Before, both forms were searched but one combined read came back. When the forms read alike the report now says so, rather than leaving it unsaid.
+
 ## 0.3.1-beta.2
 
 ### Patch Changes

package/driver/citation-census.json

@@ -1,5 +1,5 @@
 {
-  "citations": 621,
-  "files": 1892,
-  "checkable": 102
+  "citations": 545,
+  "files": 3878,
+  "checkable": 105
 }

package/driver/common-law-receipts.mjs

@@ -21,7 +21,17 @@ import { driverDir } from "../shared/driver-dir.mjs";   // — one definition of
 
 export const MIN_CELLS_PER_VARIANT = 7;
 
-const norm = (s) => (s || "").trim().replace(/^["'`]+|["'`]+$/g, "").toLowerCase();
+// THE GRID CELL KEY, and it is the same class as the connotation join: one side is a term and platform
+// WE dictated, the other is what a provider echoed into the ledger. It already stripped wrapping quotes
+// and lowercased; it did not fold a CURLY quote, an em dash, a non-breaking space or a compatibility
+// form, so the failure that stopped a production clearance on 2026-09-16 was available here too — one
+// gate over, with the same shape and no arm on it.
+//
+// It composes `queryKey`, which is the one author of what "the same text" means across a provider
+// boundary, and keeps its own wrapping-quote strip because a term arrives quoted here and does not there.
+import { queryKey } from "./connotation-search.mjs";
+
+const norm = (s) => queryKey(String(s || "").trim().replace(/^["'`\u2018\u2019\u201c\u201d]+|["'`\u2018\u2019\u201c\u201d]+$/g, ""));
 
 // A table data row's cells, or null if the line isn't one.
 function rowCells(ln) {

package/driver/connotation-search.mjs

@@ -45,7 +45,10 @@ export function pickConnotationTerms(terms, maxTerms = 6) {
   for (const t of (terms ?? [])) {
     const v = String(t ?? "").trim();
     if (!v) continue;
-    const k = v.toLowerCase();
+    // KEYED THE SAME WAY THE GATES COMPARE. A producer that folds less than its consumer dictates two
+    // terms the gate can only see as one, and a seat recording either satisfies it for both — the gate
+    // then passes a query that never ran, which is the fault it exists to catch, inverted.
+    const k = queryKey(v);
     if (seen.has(k)) continue;
     seen.add(k);
     picked.push(v);
@@ -83,7 +86,7 @@ const NON_LATIN_LETTER_RE = /(?![\p{Script=Latin}])\p{L}/u;
  * Returns ["<form> <shape>", …] like buildConnotationQueries. PURE.
  */
 export function buildTranslitConnotationQueries(modelVariants, { shapes = CONNOTATION_SHAPES_TRANSLIT, maxTerms = 8, coreTerms = [] } = {}) {
-  const seen = new Set((coreTerms ?? []).map((t) => String(t ?? "").trim().toLowerCase()).filter(Boolean));
+  const seen = new Set((coreTerms ?? []).map((t) => queryKey(t)).filter(Boolean));
   const picked = [];
   for (const v of (modelVariants ?? [])) {
     const value = String(v?.value ?? "").trim();
@@ -93,7 +96,7 @@ export function buildTranslitConnotationQueries(modelVariants, { shapes = CONNOT
     for (const form of value.split(" / ")) {
       const f = form.trim();
       if (!f) continue;
-      const k = f.toLowerCase();
+      const k = queryKey(f);
       if (seen.has(k)) continue;
       seen.add(k);
       picked.push(f);
@@ -177,7 +180,7 @@ export function meaningAnglesFromMatterContext(md, { alreadyQueried = [], maxAng
   if (!m) return [];
   const value = m[1].trim();
   if (/^none\b/i.test(value)) return [];
-  const seen = new Set((alreadyQueried ?? []).map((q) => String(q ?? "").trim().toLowerCase()).filter(Boolean));
+  const seen = new Set((alreadyQueried ?? []).map((q) => queryKey(q)).filter(Boolean));
   const picked = [];
   for (const part of value.split(";")) {
     const q = sanitizeMeaningAngle(part);
@@ -186,7 +189,7 @@ export function meaningAnglesFromMatterContext(md, { alreadyQueried = [], maxAng
     // keeps it, and a lone `"` dictated as a query is a search nobody asked for that no receipt can ever
     // match — the failure this change exists to stop. Dropped explicitly rather than as a side effect.
     if (!q || !/[\p{L}\p{N}]/u.test(q) || q.length > maxLen) continue;
-    const k = q.toLowerCase();
+    const k = queryKey(q);
     if (seen.has(k)) continue;
     seen.add(k);
     picked.push(q);
@@ -225,6 +228,54 @@ const SECTION_RE = /reputational|connotation/i;
  * in common-law-receipts.mjs (parsePrRiskQueries); this entries parser lives here so the P2-A-owned file is
  * untouched. Never throws; an unparseable ledger reads as no recorded entries. PURE.
  */
+/**
+ * The key two spellings of one meaning query are compared on. ONE AUTHOR, here, beside the parser that
+ * reads the ledger — the gate in verify.mjs imports it rather than carrying a second copy.
+ *
+ * WHY THE RAW STRINGS CANNOT BE COMPARED. The dictated queries are written by the driver; the recorded
+ * ones come back through a provider, which returns the text it echoes with typographic punctuation. On a
+ * production clearance, 2026-09-16, exactly one of sixty-one queries differed — a single character, a
+ * right single quotation mark where the driver wrote an apostrophe, at the same length. The grid had run
+ * every query and recorded every one. The join said a query was unrecorded, the stage failed four times
+ * byte-identically, and the clearance stopped.
+ *
+ * THE ORIGINAL TEXT IS NOT TOUCHED. This is a comparison key and nothing else: the ledger keeps what the
+ * provider returned and the refusal quotes what the driver dictated, because a reader chasing a genuinely
+ * missing query needs the spelling that was asked for, not a flattened one.
+ *
+ * WHAT IS FOLDED, and nothing beyond it: the four curly quotes to their straight forms, a non-breaking
+ * space to a space, runs of whitespace to one, and case. Deliberately NOT accents or punctuation in
+ * general — two queries differing by a letter are two queries, and a key that folded them would hide the
+ * skipped-query fault this gate exists to catch.
+ *
+ * ONE HALF OF THAT SENTENCE NEEDS SAYING OUT LOUD, because omitting it cost a fail-open. NFKC folds the
+ * two ENCODINGS of one accented letter — composed U+00E9 and decomposed e + U+0301 — while leaving the
+ * accented letter distinct from its unaccented form. Mixed-source transliterations are exactly where
+ * both encodings arrive, so two producer rows that look different fold to one key here. EVERY producer
+ * that dedups a dictated list must therefore key on THIS function: a producer folding less than the gate
+ * dictates queries the gate cannot tell apart, and the gate then passes on a seat recording one of them.
+ */
+export const queryKey = (s) => String(s ?? "")
+  // NFKC FIRST, and it does the largest share of the work: it folds the compatibility forms a provider
+  // can return for characters we wrote plainly — full-width Latin, ligatures, the non-breaking space in
+  // some sources, composed accents to a single canonical form. Doing it first also means the explicit
+  // folds below only have to name what Unicode does NOT unify, which is the punctuation classes.
+  .normalize("NFKC")
+  .replace(/[\u2018\u2019\u201a\u201b\u2032\u00b4\u0060]/g, "'")   // single quotes, primes, backtick
+  .replace(/[\u201c\u201d\u201e\u201f\u2033\u00ab\u00bb]/g, '"')   // double quotes and guillemets
+  .replace(/[\u2010-\u2015\u2212\u2043]/g, "-")                       // every dash and minus form
+  .replace(/\u2026/g, "...")                                           // an ellipsis is three dots
+  .replace(/[\u200b\u200c\u200d\u2060\ufeff]/g, "")                  // zero-width: invisible, never meaning
+  .replace(/[\u00a0\u2000-\u200a\u202f\u205f\u3000]/g, " ")         // every space form NFKC left alone
+  .replace(/\s+/g, " ")
+  .trim()
+  // TRAILING PUNCTUATION ONLY, never leading and never internal. A provider commonly returns a question
+  // it was handed with a full stop or question mark appended; it does not commonly remove one from the
+  // front, and stripping internal punctuation would fold two genuinely different queries together.
+  .replace(/[.,;:!?]+$/, "")
+  .trim()
+  .toLowerCase();
+
 export function parsePrRiskResults(ledgerRaw) {
   let parsed;
   try { parsed = JSON.parse(ledgerRaw); } catch { return []; }

package/driver/contract-e3-backlog.mjs

@@ -185,7 +185,7 @@ export const E3_BACKLOG = [
     // it one: authored once in renderConnotationObligations, and reaching the seat through the perplexity
     // MCP server (driver/engine/mcp/perplexity-server.mjs:111) rather than a stage message. Three rows
     // pointing at one block would fabricate two authored sites the surface does not have.
-    where: "driver/connotation-search.mjs:1384-1397 (renderConnotationObligations; delivered to the seat via driver/engine/mcp/perplexity-server.mjs:111 — a TOOL RESPONSE, no longer a stage message)",
+    where: "driver/connotation-search.mjs:1435-1448 (renderConnotationObligations; delivered to the seat via driver/engine/mcp/perplexity-server.mjs:111 — a TOOL RESPONSE, no longer a stage message)",
     surface: "tool-response",
     // ── (a) THE ORIGINAL SUBJECT WAS DELETED BY DESIGN — DISCHARGED, NOT FAILED ────────────────────
     // The old rows dictated `receipt_id` (an 8-char token the seat copied) and `quote`. Both are gone:
@@ -256,7 +256,7 @@ export const E3_BACKLOG = [
   {
     stage: "register-unit",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:2243 (the non-supplemental-lane branch)",
+    where: "driver/stages.mjs:2253 (the non-supplemental-lane branch)",
     surface: "stage-message",
     evidence: "BAND ARTIFACT (MANDATORY): ALSO write the COMPLETE NAMED BAND for this axis to <path> — a JSON ARRAY, one block per register_enumerate / count-probe call, in the named-band contract: {\"state\":\"enumerated\",\"query\":\"<what was searched>\",\"total_hits\":N,\"records\":[{record_id, mark_text, classes, status,",
     reparsedBy: "driver/named-band.mjs parseNamedBand / bandRecords / bandCrowds / mergeNamedBands (named in driver/skills/prelim-register/unit.md:60-62); validators.registerUnit",
@@ -265,7 +265,7 @@ export const E3_BACKLOG = [
   {
     stage: "register-unit",
     kind: "exactly-these-keys",
-    where: "driver/stages.mjs:2207",
+    where: "driver/stages.mjs:2217",
     surface: "stage-message",
     evidence: "Every block you append MUST carry \"state\":\"enumerated\" (ONLY if you paged it to has_more:false) or \"state\":\"incomplete\" — EXACTLY those two strings; there is no \"verified\"/\"checked\"/\"complete\"/\"clean\" state, and any other value fails the stage.",
     reparsedBy: "driver/named-band.mjs parseNamedBand (off-enum state fails validators.registerUnit)",
@@ -283,7 +283,7 @@ export const E3_BACKLOG = [
   {
     stage: "register-unit",
     kind: "exactly-these-keys",
-    where: "driver/stages.mjs:4177 (the frame-reopen / scoped-retry message builder). A second number stood here and had been stale for some time: it pointed at a contract-element description rather than a builder, at its old line and at every mechanical shift of it. Two candidate builders sit beside 4157 and picking one would be a guess, so the wrong pointer is removed rather than moved a third time — one accurate citation beats one accurate and one invented.",
+    where: "driver/stages.mjs:4191 (the frame-reopen / scoped-retry message builder). A second number stood here and had been stale for some time: it pointed at a contract-element description rather than a builder, at its old line and at every mechanical shift of it. Two candidate builders sit beside 4157 and picking one would be a guess, so the wrong pointer is removed rather than moved a third time — one accurate citation beats one accurate and one invented.",
     surface: "stage-message",
     evidence: "Every block you append MUST carry \"state\":\"enumerated\" (ONLY if paged to has_more:false) or \"state\":\"incomplete\" — EXACTLY those two strings … (re-dispatch builders, which REPLACE def.message)",
     reparsedBy: "driver/named-band.mjs parseNamedBand. Scope warning: these builders replace def.message on every escalation / envelope-close / frame-reopen dispatch, so an E3 lint that walks STAGES[*].message only never sees them",
@@ -301,7 +301,7 @@ export const E3_BACKLOG = [
   {
     stage: "placement-inquiry",
     kind: "exactly-these-keys",
-    where: "driver/stages.mjs:2403",
+    where: "driver/stages.mjs:2413",
     surface: "stage-message",
     evidence: "· tier EXACTLY one of headline-candidate / sheet-2 / watchlist-annex / out-of-scope-filtered.",
     reparsedBy: "driver/placement-form.mjs / driver/placement-model.mjs via validators.placement",
@@ -346,7 +346,7 @@ export const E3_BACKLOG = [
     // (coverage-form.mjs coverageFormBrief) and the tool schema, with every row receiver-validated at
     // call time. Same dictated vocabulary, same authored site, new route — this row's evidence follows
     // the dictation so the row keeps describing something that exists.
-    where: "driver/stages.mjs:2608 (the digest message) + driver/coverage-form.mjs (coverageFormBrief — the dispatch block carrying the enum and the row shape)",
+    where: "driver/stages.mjs:2618 (the digest message) + driver/coverage-form.mjs (coverageFormBrief — the dispatch block carrying the enum and the row shape)",
     surface: "stage-message",
     evidence: "Record a \"status\" and a \"reason\" on EVERY row ONLY by calling the … tool — the driver validates each row as it arrives, holds the record itself, and renders both the ## Coverage ledger table and the coverage JSON from it",
     reparsedBy: "driver/coverage-call.mjs validateCoverageCall (receiver-validated at call time, the same predicates the gate judges with) + driver/coverage-form.mjs rowIsSettled via validators.registerFindings over the _driver/ accumulator",
@@ -429,7 +429,7 @@ export const E3_BACKLOG = [
   {
     stage: "frame-diff",
     kind: "exactly-these-keys",
-    where: "driver/stages.mjs:2788",
+    where: "driver/stages.mjs:2798",
     surface: "stage-message",
     evidence: "For each blind-model variant / field / source the run did NOT scope or search, emit one directive {layer, item, observation, severity} … severity = dominant-element (the omission is ON the spine) | material (a real omission worth a targeted sweep) | minor (already covered, or presentation only).",
     reparsedBy: "driver/verify.mjs validators.frameDiff + driver/pipeline.mjs runSupplementalSweeps (the parser REFUSES a firing variant directive that dictates nothing dispatchable)",
@@ -453,7 +453,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3164",
+    where: "driver/stages.mjs:3178",
     surface: "stage-message",
     evidence: "MACHINE FINDINGS (MANDATORY): … a JSON OBJECT {\"schema_version\":<FINDINGS_SCHEMA_VERSION>,\"rated_under_framework\":\"…\",\"findings\":[...],\"coverage\":[...],\"context_notes\":[...],\"actions\":[...],\"ask_answers\":[...]} … Each finding object has EXACTLY these keys: {\"ordinal\",\"mark\",\"owner\",\"band\",\"net\",\"bor",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson via validators.narrative",
@@ -467,7 +467,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "exactly-these-keys",
-    where: "driver/stages.mjs:3200",
+    where: "driver/stages.mjs:3214",
     surface: "stage-message",
     evidence: "- off_field_ground (MANDATORY on every off-field finding, FORBIDDEN on every other disposition): EXACTLY one bare token of: ${OFF_FIELD_GROUNDS.join(\" / \")}",
     reparsedBy: "driver/findings-model.mjs validateOffFieldGround — the enum is imported from findings-model.mjs and interpolated back into the prompt, so code already holds the list it asks the model to type",
@@ -476,7 +476,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3201",
+    where: "driver/stages.mjs:3215",
     surface: "stage-message",
     evidence: "- manageable …: {\"category\":\"<EXACTLY one of large-competitor / commercial-partner / troll / well-known-enforcer>\",\"reason\":\"<one-two lines…>\"}",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
@@ -485,16 +485,16 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3217",
+    where: "driver/stages.mjs:3231",
     surface: "stage-message",
     evidence: "- meters: {\"mark_similarity\":{...},\"goods_proximity\":{...},\"use\":{...},\"enforcer\":{...}} — all four present, each {\"token\",\"basis\",\"source\"}. … mark_similarity = high | medium | low. goods_proximity = high | medium | low. enforcer = high | medium | low | unknown. use = confirmed | not-confirmed | un",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; driver/verify.mjs:1066 checkFindingsSibling gates meters.*.source; finding_basis_source_missing",
+    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; driver/verify.mjs:1108 checkFindingsSibling gates meters.*.source; finding_basis_source_missing",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3218",
+    where: "driver/stages.mjs:3232",
     surface: "stage-message",
     evidence: "- quadrant: {\"x\",\"y\"} numbers in [0,1]. x = goods/services proximity (0 = distant, 1 = identical). y = mark similarity (0 = distinct, 1 = identical).",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
@@ -503,7 +503,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3219",
+    where: "driver/stages.mjs:3233",
     surface: "stage-message",
     evidence: "- source: {\"source_type\",\"resolved_link\"}. source_type EXACTLY one of: register-vendor / register-euipo / common-law-marketplace / common-law-web / case-law",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
@@ -512,7 +512,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "exactly-these-keys",
-    where: "driver/stages.mjs:3220",
+    where: "driver/stages.mjs:3234",
     surface: "stage-message",
     evidence: "coverage[]: ONE object per coverage AREA, EXACTLY {\"area\",\"state\",\"note\"}. … state EXACTLY one of: confirmed-clean / coverage-limited / open / not-searched / note.",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; the render owns the coverage panel from these typed states",
@@ -521,7 +521,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3229",
+    where: "driver/stages.mjs:3243",
     surface: "stage-message",
     evidence: "use_check = {\"source\",\"quality\"}: … quality: OPTIONAL, EXACTLY one of owner-site / independent / register-mirror … own_rights = {\"source\"}",
     reparsedBy: "driver/verify.mjs:988 checkFindingsSibling (finding_use_check_missing); driver/own-rights.mjs:19-22",
@@ -530,7 +530,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3286",
+    where: "driver/stages.mjs:3300",
     surface: "stage-message",
     evidence: "MARK ASSESSMENT … STRUCTURED FORM …: either field may instead be an OBJECT {\"read\":\"…\",\"spectrum\":\"…\",\"per_class\":[{\"class\":\"5\",\"note\":\"…\"}],\"per_market\":[{\"market\":\"CN\",\"note\":\"…\"}],\"counter_registrations\":[{\"mark\":\"…\",\"uri\":\"/mark/…\",\"note\":\"…\"}],\"acquired\":\"<optional>\",\"note\":\"<optional residual>",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; the report collapses the rows behind toggles and the audit workbook renders them",
@@ -539,7 +539,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3292",
+    where: "driver/stages.mjs:3306",
     surface: "stage-message",
     evidence: "FOUR ANSWERS …: \"four_answers\": {\"third_party_rights\":{...},\"objection_likelihood\":{...},\"registrability\":{...},\"client_enforceability\":{...}} … Each answer … is {\"read\":\"…\",\"token\":\"…\",\"basis\":\"…\",\"ordinals\":[…]}. Tokens (closed enums …): third_party_rights = strong|moderate|weak; objection_likelih",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
@@ -557,7 +557,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "exactly-these-keys",
-    where: "driver/stages.mjs:3299",
+    where: "driver/stages.mjs:3313",
     surface: "stage-message",
     evidence: "COVERAGE JUDGMENT …: emit \"coverage_judgment\": {\"sufficient\":<bool>, \"reason\":\"<one line…>\"} — EXACTLY those two keys. Do NOT emit \"rows\": the driver writes that register itself … anything you type there is replaced wholesale.",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson. The \"Do NOT emit rows\" clause is the purest E3 case in the tree — the prompt names a field, dictates its shape and states in the same breath that code overwrites it",
@@ -566,7 +566,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3142",
+    where: "driver/stages.mjs:3156",
     surface: "stage-message",
     // RE-QUOTED, NOT PARKED. The writer's conversion reworded this dictation — the
     // ask answers ride the findings RECORD now and the driver renders the labelled line into both the
@@ -590,7 +590,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "dictated-line-shape",
-    where: "driver/stages.mjs:3063 (restated at driver/skills/prelim-search/synthesis-rules.md:428)",
+    where: "driver/stages.mjs:3077 (restated at driver/skills/prelim-search/synthesis-rules.md:428)",
     surface: "stage-message",
     evidence: "END that finding's actual-use line with a literal \"- **Use-check source:** <result URL | \"perplexity_research — no result\">\" line",
     reparsedBy: "driver/verify.mjs validators.narrative (spec-11 hard reject); the repair hint re-dictates the literal at driver/gateway.mjs:2153",
@@ -599,7 +599,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "dictated-line-shape",
-    where: "driver/stages.mjs:3076 (restated at driver/skills/prelim-search/synthesis-rules.md:475)",
+    where: "driver/stages.mjs:3090 (restated at driver/skills/prelim-search/synthesis-rules.md:475)",
     surface: "stage-message",
     evidence: "END that finding's reasoning with a literal \"- **Own-rights source:** <record URI(s) | \"no applicant-owned registrations in the searched register material\">\" line",
     reparsedBy: "driver/own-rights.mjs:19-22 — \"This module only requires the 'Own-rights source:' line to exist\"; repair hint at driver/gateway.mjs:2361 (the `own_rights_missing` branch; re-verified 2026-08-29 — the old :1736 predated this branch and pointed into the A4 repeat-signature block)",
@@ -608,7 +608,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "exactly-these-keys",
-    where: "driver/stages.mjs:3278",
+    where: "driver/stages.mjs:3292",
     surface: "stage-message",
     evidence: "add it to the top-level \"context_notes\" array — each object EXACTLY {\"type\":\"famous-neighbour-ungrounded\",\"mark\",\"owner\",\"context\"}",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
@@ -617,7 +617,7 @@ export const E3_BACKLOG = [
   {
     stage: "synthesis",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3166",
+    where: "driver/stages.mjs:3180",
     surface: "stage-message",
     evidence: "- owner: {\"name\",\"country\",\"registrations\":[...]}. … Each registration: {\"uri\", optionally \"classes\":[\"9\",\"41\"],\"status\",\"filed\",\"expiry\",\"jurisdiction\"}. The \"uri\" is the ONLY field that matters: the driver BINDS classes/status/filed/expiry/jurisdiction AND the owner name from the FETCHED record ke",
     reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson + the record-binding join. Six of the seven keys are stated in the prompt and overwritten by code in the same sentence",
@@ -626,16 +626,16 @@ export const E3_BACKLOG = [
   {
     stage: "case-law",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3448",
+    where: "driver/stages.mjs:3462",
     surface: "stage-message",
     evidence: "ALSO write the RETRIEVAL RECORD to <path> — a JSON OBJECT with EXACTLY these keys: {\"schema_version\":1,\"queries\":[{\"query\":\"<the search you dispatched, verbatim>\",\"jurisdiction\":\"…\",\"results\":<how many hits it returned>}, …],\"citations\":[{\"proceeding\":\"…\",\"forum\":\"…\",\"jurisdiction\":\"…\",\"decided\":\"…\"",
-    reparsedBy: "driver/verify.mjs validators.caseLaw — the ledger arm, armed by the stage-contract marker `citations` (stages.mjs:1810)",
+    reparsedBy: "driver/verify.mjs validators.caseLaw — the ledger arm, armed by the stage-contract marker `citations` (stages.mjs:1820)",
     removedByMove: "M5 moves `queries[]` to the call log (and is itself blocked: tool-calls.jsonl records no arguments); the envelope, schema_version, `read` enum and `citations[]` skeleton survive M5 entirely",
   },
   {
     stage: "case-law",
     kind: "dictated-line-shape",
-    where: "driver/stages.mjs:3456",
+    where: "driver/stages.mjs:3470",
     surface: "stage-message",
     evidence: "EVERY \"Grounded profile\" section MUST start its body with the line \"- ord: <N>\" naming which finding it grounds (use the ordinal from this list; a profile that grounds no listed finding omits the line)",
     reparsedBy: "driver/publish/parse.mjs:339 parseCaseLawProfiles (\"the optional '- ord: <N>' first body line … gives an EXACT join\"); driver/findings-model.mjs:273 /^-\\s*ord:\\s*(\\d+)\\s*$/m; driver/publish/index.mjs:776",
@@ -669,7 +669,7 @@ export const E3_BACKLOG = [
   {
     stage: "narrative-refutation",
     kind: "dictated-line-shape",
-    where: "driver/stages.mjs:3588",
+    where: "driver/stages.mjs:3602",
     surface: "stage-message",
     // RE-QUOTED BY CONVERSION 9. The LINE-TOKEN half is gone — no "anywhere on the line", no "[kind: …]
     // token", no "a line with no token is treated as fact", because a kind is a typed field now and an
@@ -684,7 +684,7 @@ export const E3_BACKLOG = [
     // because an un-anchorable row lands in the NOT-CHECKED slice, and that is coverage lost rather than
     // a pass.
     evidence: "is ONE of coverage-disposition | fact | rating | narrative — pick the one your own legal read says the correction IS: coverage-disposition (a coverage row / disposition placement is wrong or dishonest)",
-    reparsedBy: "driver/verify.mjs:742 CORRECTION_KIND_RE = /\\[kind:\\s*([a-z][a-z-]*)\\s*\\]/i → parseCorrectionKinds (verify.mjs:965), consumed in pipelineInner() in pipeline.mjs for the run.jsonl `correction-kinds` histogram, which since #1558 also carries `kindChannelOk` — the counts are DERIVED from the parsed rows, and that key states whether the reviewer's kind channel produced anything at all rather than leaving a reader to infer it by comparing untyped against total. Telemetry only today",
+    reparsedBy: "driver/verify.mjs:784 CORRECTION_KIND_RE = /\\[kind:\\s*([a-z][a-z-]*)\\s*\\]/i → parseCorrectionKinds (verify.mjs:1007), consumed in pipelineInner() in pipeline.mjs for the run.jsonl `correction-kinds` histogram, which since #1558 also carries `kindChannelOk` — the counts are DERIVED from the parsed rows, and that key states whether the reviewer's kind channel produced anything at all rather than leaving a reader to infer it by comparing untyped against total. Telemetry only today",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -697,7 +697,7 @@ export const E3_BACKLOG = [
     // `[on: -]` case went from a value to an ABSENCE — you omit the field — which is the one part a
     // reader could get wrong from the old wording, since there is no value meaning "no finding".
     evidence: "**AND EVERY FLAG CARRIES WHICH FINDING IT IS ABOUT** — the `on` field, an array of ordinals. Same rule as `kind`: you send the values, the driver renders the token.",
-    reparsedBy: "driver/verify.mjs:759 CORRECTION_ON_RE = /\\[on:\\s*([0-9,\\s-]*?)\\s*\\]/i. SKILL-FILE ONLY — the stage message at stages.mjs:1842-1877 never mentions `[on:]`. This is #850's \"the element shape is in the skill file, not the stage message\" in its purest form: an E3 lint reading stages.mjs alone sees the [kind:] token and misses its twin",
+    reparsedBy: "driver/verify.mjs:801 CORRECTION_ON_RE = /\\[on:\\s*([0-9,\\s-]*?)\\s*\\]/i. SKILL-FILE ONLY — the stage message at stages.mjs:1842-1877 never mentions `[on:]`. This is #850's \"the element shape is in the skill file, not the stage message\" in its purest form: an E3 lint reading stages.mjs alone sees the [kind:] token and misses its twin",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -768,7 +768,7 @@ export const E3_BACKLOG = [
   {
     stage: "report-card",
     kind: "literal-json-skeleton",
-    where: "driver/stages.mjs:3897",
+    where: "driver/stages.mjs:3911",
     surface: "stage-message",
     evidence: "The finding's OWN record — the ONLY source for this card …:\\n```json\\n<JSON.stringify(finding, null, 2)>\\n```",
     reparsedBy: "none — this is the INPUT side, and that is why it belongs in the survey: a full JSON object rendered into the prompt is exactly the mechanism #850 proves produced R-RECEIPT (the model pattern-matches a shown shape). E3's clause 1 as written (\"a code fence or inline example showing the exact object shape the model must emit\") does not reach an injected record, so the lint needs an explicit rule for shown-but-not-owed structure",