clearotron 0.3.2-beta.10 → 0.3.2-beta.11

package/driver/engine/mcp/recording-server.mjs

@@ -826,6 +826,26 @@ serve({
             },
           },
         },
+        // OFFERED HERE, OR NEVER SENT. The acceptor took this field for a beta and the plan acted on it,
+        // and no frame ever proposed one, because the schema a model is given did not offer it. Worded as
+        // the owner approved it; it is model-facing prose, so its wording is his.
+        house_element_candidate: {
+          type: "object",
+          description:
+            "Only when an element of the mark is one the CLIENT already owns as a registered mark in the " +
+            "instructed classes (a house mark before a tagline, for instance): name that element, the remainder " +
+            "the analysis should be limited to, and why you read it as the client's own. Ownership is checked " +
+            "on the register, by owner, before anything is excluded; if it cannot be verified, nothing is. Omit " +
+            "the field when no element is the client's own.",
+          required: ["element", "remainder", "owner_basis"],
+          properties: {
+            element: { type: "string", description: "The client's own element, exactly as it appears in the mark." },
+            remainder: { type: "string",
+              description: "The rest of the mark: the part the analysis is limited to. Never empty, never the element itself." },
+            owner_basis: { type: "string",
+              description: "Why you read the element as the client's own — what in the matter says so." },
+          },
+        },
       },
     },
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.2-beta.10",
+  "version": "0.3.2-beta.11",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/phase0.mjs

@@ -5,7 +5,7 @@
 
 import { existsSync, appendFileSync, readFileSync, mkdirSync } from "node:fs";
 import { join, dirname } from "node:path";
-import { createHash, randomUUID } from "node:crypto";
+import { createHash, randomUUID, randomInt } from "node:crypto";
 import { ledgerPath } from "../providers/_shared/ledger-path.mjs";
 import { config } from "./driver.config.mjs";
 import { resolveProfile } from "./profiles.mjs";
@@ -26,7 +26,15 @@ const NOUN = [
   "warren", "beacon", "quarry", "willow", "kestrel", "monolith", "estuary", "bramble", "compass", "drift",
 ];
 
-export function genCodename(rand = Math.random) {
+// THE CODENAME IS DRAWN FROM THE OPERATING SYSTEM'S RANDOM SOURCE, not Math.random. It is a label, not a
+// secret: it names a run's directory and appears in its reports, and the keys built from it name a run's
+// attempts and ledgers — nothing is authorised by knowing one. But it is the first thing the run identifier
+// is made of, and a label that is also unpredictable costs nothing here, while a predictable one invites
+// every later reader to wonder what else leans on it. Same [0, 1) shape as Math.random, so the injected
+// `rand` the tests pass for determinism works unchanged.
+const cryptoRand = () => randomInt(0, 2 ** 32) / 2 ** 32;
+
+export function genCodename(rand = cryptoRand) {
   return `${ADJ[Math.floor(rand() * ADJ.length)]}-${NOUN[Math.floor(rand() * NOUN.length)]}`;
 }
 
@@ -186,7 +194,7 @@ export function claimRunCodename({ slug, date, codename, registryPath = codename
 // a pre-mint through raw genCodename would silently lose this collision protection.
 // 20 straight collisions ⇒ the 400-name space is exhausted for this slug+date — suffix for freshness.
 export function mintFreshCodename({ slug, date, studioRoot = config.studioRoot, archiveRoot = config.archiveRoot,
-  rand = Math.random, claim = claimRunCodename }) {
+  rand = cryptoRand, claim = claimRunCodename }) {
   for (let i = 0; i < 20; i++) {
     const c = genCodename(rand);
     if (!existsSync(runDirFor({ slug, date, codename: c, studioRoot }))
@@ -198,22 +206,23 @@ export function mintFreshCodename({ slug, date, studioRoot = config.studioRoot,
   return `${genCodename(rand)}-${Date.now().toString(36)}`;
 }
 
-// Assemble the immutable run identity for a job. rand is injectable for tests. studioRoot/archiveRoot are the
+// Assemble the immutable run identity for a job. rand and claim are injectable for tests — claim so a test's
+// mints go to a registry of its own rather than the box-wide one every run on this account shares. studioRoot/archiveRoot are the
 // FORWARDING agent's (derived from its queue dir by the runner); they default to clawdi's for back-compat.
 // `codename`/`date` overrides exist for RESUME: re-driving a failed run must rebuild the SAME run identity
 // (slug/date/codename → the same run-dir) so the idempotency skip reuses the prior stages instead of minting
 // a fresh codename and re-spending everything (the "pearl-keystone" trap). A bare new run leaves both unset.
 export function buildRunContext(
   job,
-  { rand = Math.random, now = new Date(), studioRoot = config.studioRoot, archiveRoot = config.archiveRoot,
-    codename: codenameOverride, date: dateOverride } = {},
+  { rand = cryptoRand, now = new Date(), studioRoot = config.studioRoot, archiveRoot = config.archiveRoot,
+    codename: codenameOverride, date: dateOverride, claim = claimRunCodename } = {},
 ) {
   const slug = deriveSlug(job);
   const date = dateOverride ?? todayISO(now);
   // Fresh mints go through mintFreshCodename (above) so they never land in a dir another run already owns.
   // Overrides skip the check: RESUME (and the runner's dispatch pre-mint, which already minted freshly)
   // wants the identity verbatim.
-  const codename = codenameOverride ?? mintFreshCodename({ slug, date, studioRoot, archiveRoot, rand });
+  const codename = codenameOverride ?? mintFreshCodename({ slug, date, studioRoot, archiveRoot, rand, claim });
   return {
     slug,
     codename,

package/driver/pipeline.mjs

@@ -13518,7 +13518,7 @@ async function pipelineInner(job, opts = {}) {
     // structured-only). Each stage is file-gated/resumable; per-card sessions feed the lint repair below.
     // C2 — fold same-owner+same-mark duplicate filings into one finding BEFORE the overview + cards read
     // findings.json, so the whole delivery phase (and the published copy) sees the single consolidated set.
-    injectDeferralCoverage(P, run.runDir, note);   // A3: unclosed reopen directives become reader-visible coverage rows first
+    injectDeferralCoverage(P, run.runDir, note); injectMeaningGapCoverage(P, run.runDir, note);   // A3: unclosed reopen directives, and meaning searches that did not complete, become reader-visible coverage rows first
     // qw/cn-scope-honesty — the sibling injection: a CN-family-scope run whose zh lane did not run
     // discloses what the native-language investigation would have searched, and where it is offered
     // (coverage-limited: never clamps, never gates).
@@ -16831,3 +16831,50 @@ export function registerGapConditions(regGap) {   // @internal
   });
   return out;
 }
+
+// ── A MEANING SEARCH THAT DID NOT COMPLETE REACHES THE CLIENT'S OWN PAGE, NOT ONLY THE AUDIT ────────────
+//
+// The connotation gate delivers a run whose dictated meaning searches did not all complete, and records
+// each unfinished one as a gap carrying its term — a gap the engine wrote for a search that never came
+// back, or the provider's own row for one it refused. The audit read those gaps; the report was never
+// handed the grid, so whether a client learned a meaning search was missing was up to the synthesis
+// model. This puts each on the coverage the report renders, the way an unclosed follow-up already is:
+// the same row, `deferralCoverageRow`, and an approved reader sentence that says it is left open — true
+// of a drop and of a refusal alike. Telling the two apart on the page
+// would need a sentence nobody has approved, and is not attempted here.
+//
+// The same guard as `injectDeferralCoverage`: a gap synthesis already weighed in is not added twice, and
+// a findings.json that fails its own schema after the push is left as it was.
+// THE WORDS ARE CHOSEN, NOT THE CAUSE: of the approved reasons, "nothing in the run's own record confirms it
+// was searched" is true of a search that never came back AND of one the provider refused, and does not
+// repeat the row's own "not completed this run" the way the generic fallback does. It borrows that arm's
+// sentence only; if the arm is ever reworded for its own case, re-read this row against it.
+const MEANING_SEARCH_UNFINISHED = "not-verified-closed";
+export function injectMeaningGapCoverage(P, runDir, note) {   // @internal — exported so the refusal shape is testable without a run
+  try {
+    if (!existsSync(P.commonLawGrid) || !existsSync(P.findings)) return;
+    const grid = JSON.parse(readFileSync(P.commonLawGrid, "utf8"));
+    const terms = [...new Set((Array.isArray(grid?.gaps) ? grid.gaps : [])
+      .filter((g) => String(g?.platform ?? "").toLowerCase() === "connotation")
+      .map((g) => String(g?.term ?? "").trim()).filter(Boolean))];
+    if (!terms.length) return;
+    const doc = JSON.parse(readFileSync(P.findings, "utf8"));
+    if (!Array.isArray(doc.coverage)) doc.coverage = [];
+    const normTxt = (s) => String(s ?? "").toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+    const covText = normTxt(doc.coverage.map((c) => `${c.area} ${c.note ?? ""}`).join(" "));
+    let added = 0;
+    for (const term of terms) {
+      const slice = normTxt(term).split(" ").filter((w) => w.length >= 4).slice(0, 4).join(" ");
+      if (slice && covText.includes(slice)) continue;          // synthesis already weighed it in
+      doc.coverage.push(deferralCoverageRow(term, MEANING_SEARCH_UNFINISHED));
+      added++;
+    }
+    if (!added) return;
+    parseFindingsJson(JSON.stringify(doc));                    // re-validate the shape (throws → catch keeps original)
+    atomicWrite(P.findings, `${JSON.stringify(doc, null, 2)}\n`);
+    note(`[common-law] ${added} meaning search(es) that did not complete now reach the report's coverage`);
+    runLog(runDir, { event: "meaning-gap-coverage", added });
+  } catch (e) {
+    note(`[common-law] meaning-gap coverage skipped: ${String(e?.message || e).replace(/\s+/g, " ").slice(0, 100)}`);
+  }
+}

package/driver/portal-local-auth.mjs

@@ -422,10 +422,20 @@ export function firstRunCredentialLines({ handoff, credentialPath, email, passph
     return [head, `  PASSPHRASE: ${passphrase}`,
       "  Write it down now. It is not stored anywhere in a form that can be read back, and this line will not be printed again."];
   }
-  return [head,
-    "  The passphrase is NOT printed here: stderr is not a terminal, so this line would outlive the moment \u2014 a journal, a CI log, or a test's captured output.",
-    "  Nothing holds it now, this process included: what is on disk is a digest. To get one you can sign in with, run:",
-    `    ${resetCommand}`];
+  return [head, ...passphraseWithheldLines({ stream: "stderr", resetCommand }).map((line) => `  ${line}`)];
+}
+
+/**
+ * What stands where the passphrase would, on an output that is not a terminal. ONE composer for the two
+ * places a first run can hand the passphrase over \u2014 the portal's standard error and the launcher's closing
+ * box on standard output \u2014 so they give one reason and one way back in. It is never handed the
+ * passphrase, so no caller can wire the value through it.
+ */
+export function passphraseWithheldLines({ stream, resetCommand = "" }) {
+  return [
+    `The passphrase is NOT printed here: ${stream} is not a terminal, so this line would outlive the moment \u2014 a journal, a CI log, or a test's captured output.`,
+    "Nothing holds it now, this process included: what is on disk is a digest. To get one you can sign in with, run:",
+    `  ${resetCommand}`];
 }
 
 export const SESSION_DOMAIN = "portal-session.v1|";

package/driver/portal-service.mjs

@@ -968,6 +968,15 @@ const DENIAL_REASON = Object.freeze({
   429: "rate limited",
 });
 
+/**
+ * WHAT A REFUSED CLIENT IS TOLD — a closed set, keyed on the status, never the error's message. The message
+ * can come out of a third-party token check with a claim value, an address or a fragment of the rejected
+ * token in it, and some of our own refusals put the caller's address in theirs. A 401 keeps the words the
+ * browser contract already decodes ("not signed in"); every other status says the journal's code-owned
+ * reason. The message itself is still journalled nowhere a client reads. PURE.
+ */
+export const refusalWords = (status) => (status === 401 ? "not signed in" : DENIAL_REASON[status] ?? "refused at the door");
+
 /**
  * — THE ROW A REFUSAL FILES. One shape, one sink, whichever side of `route` decided the answer.
  *
@@ -4399,7 +4408,7 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
       // row must not become a place a caller can write into by sending a body that fails to parse.
       let body;
       try { body = await readJsonBody(req); }
-      catch (e) { journal(400, "unreadable body", identity?.email); return send(res, 400, { error: String(e.message) }); }
+      catch { journal(400, "unreadable body", identity?.email); return send(res, 400, { error: "unreadable body" }); }   // the parser's own message describes the bytes it was sent, and a response is not where a parse error is read back
       const query = Object.fromEntries(url.searchParams.entries());
       const r = await service.route(req.method, url.pathname, identity, body, query);
       // A PLAIN DOCUMENT this server renders itself. Escaped into a `<pre>`, so nothing in the file can
@@ -4466,11 +4475,11 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
         // person who typed the address gets a door.
         const wantsHtml = String(req.headers.accept ?? "").includes("text/html");
         if (wantsHtml) {
-          const html = denialPage(e.status, e.message);
+          const html = denialPage(e.status, refusalWords(e.status));
           res.writeHead(e.status, { "content-type": "text/html; charset=utf-8", "content-length": Buffer.byteLength(html), "x-content-type-options": "nosniff" });
           return res.end(html);
         }
-        return send(res, e.status, { error: e.message });
+        return send(res, e.status, { error: refusalWords(e.status) });
       }
       log(`500 ${String(e?.message || e)}`);
       if (!alreadyFiled(e)) journal(500, e?.message ?? String(e), identity?.email);

package/driver/publish/attr.mjs

@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+// attr.mjs — a value placed inside a quoted HTML attribute, and a URL placed inside an href.
+//
+// Every renderer here has its own `esc`, and each escapes `&`, `<` and `>` — which is right for text and
+// wrong inside an attribute: a `"` in the value closes the attribute and whatever follows is markup. So a
+// value that sits between quotes goes through `attrValue`, which also encodes both quote characters.
+//
+// An href needs one more guard, because a correctly escaped `javascript:` URL is still a link that runs
+// code when clicked, and the same for `data:` and `vbscript:`. So an href is built by `hrefAttr` or not at
+// all: http(s) only — or, when the caller says so, a reference with no scheme (the audit download is a file
+// beside the report). A browser drops tabs, newlines and other control characters from a URL before it
+// reads the scheme, so the scheme is read with those removed: `java` + newline + `script:` is `javascript:`.
+
+// Every C0 control character, space and DEL — what a URL parser strips or ignores before the scheme.
+const IGNORED_BEFORE_SCHEME = /[\x00-\x20\x7f]/g;
+
+/** A value safe between the quotes of an HTML attribute: & < > " and ' all encoded. PURE. */
+export const attrValue = (s) => String(s ?? "")
+  .replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")
+  .replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+
+/**
+ * An href value, attribute-safe, or null when it must not be a link — the caller then renders its text
+ * with no anchor. `relative: true` also admits a reference with no scheme, never a protocol-relative one
+ * (`//host/…` is an external address by another spelling). PURE.
+ */
+export function hrefAttr(u, { relative = false } = {}) {
+  const s = String(u ?? "").trim();
+  if (!s) return null;
+  const probe = s.replace(IGNORED_BEFORE_SCHEME, "");
+  const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(probe)?.[1];
+  if (scheme) { if (!/^https?$/i.test(scheme)) return null; }
+  else if (!relative || probe.startsWith("//") || probe.startsWith("\\\\")) return null;
+  return attrValue(s);
+}

package/driver/publish/index.mjs

@@ -239,25 +239,25 @@ function indexRows(runs, { reportFile, linkPrefix = '', showAudit = true, client
     // anchors are neutralised; the client column → aliased. Keyed by customerKey + runId so a demo run is
     // exempt and shows real.
     const ck = r.customerKey || '';
-    const runAttrs = `data-anon-href data-anon-key="${esc(ck)}" data-anon-run="${esc(r.runId)}"`;
+    const runAttrs = `data-anon-href data-anon-key="${attrValue(ck)}" data-anon-run="${attrValue(r.runId)}"`;
     const mark = anonMark(r.matter, { key: ck, run: r.runId });
-    const matterCell = `<a ${runAttrs} href="${linkPrefix}${esc(r.runId)}/${reportFile}">${mark}</a>`;
+    const matterCell = `<a ${runAttrs} href="${linkPrefix}${attrValue(r.runId)}/${reportFile}">${mark}</a>`;
     // Run cell: staff surfaces show date · HH:mm (Zurich, same-day issuedAt only) · codename; the
     // customer-facing per-customer index shows the date ONLY — codenames and timestamps are internal.
     const t = client ? '' : issuedTime(r);
     const runCell = client ? esc(r.date) : `${esc(r.date)}${t ? ` · ${esc(t)}` : ''} · <code>${esc(r.codename || '')}</code>`;
-    return `    <tr data-client="${esc(ck)}">
+    return `    <tr data-client="${attrValue(ck)}">
       <td>${matterCell}</td>
       <td>${anonMark(r.title, { key: ck, run: r.runId })}</td>
       <td>${anonClient(r.client, ck)}</td>
-      <td><span class="b b-${esc(r.badge)}">${esc(r.overall)}</span>${qcFailed ? ' <span class="hold" title="machine QC checks failed — see the audit workbook">⚠ QC</span>' : ''}${!client && !qcFailed && r.clientGate?.inputsAbsent?.length ? ` <span class="disc" title="${escAttr(`published without ${r.clientGate.inputsAbsent.join(', ')} — each declared optional, so the release stands; the report was built without it`)}">◦ built without an input</span>` : ''}${
+      <td><span class="b b-${attrValue(r.badge)}">${esc(r.overall)}</span>${qcFailed ? ' <span class="hold" title="machine QC checks failed — see the audit workbook">⚠ QC</span>' : ''}${!client && !qcFailed && r.clientGate?.inputsAbsent?.length ? ` <span class="disc" title="${escAttr(`published without ${r.clientGate.inputsAbsent.join(', ')} — each declared optional, so the release stands; the report was built without it`)}">◦ built without an input</span>` : ''}${
         // spec 64 — the stance clause of THE one risk statement beside the (labelled) band pill, so the
         // index can never show a bare severity word that reads as the whole answer. The tier word leads
         // the statement; the pill already shows it, so the cell carries the clause after the first " — ".
         // Legacy meta.json (no statement) renders this cell byte-identically.
         r.statement ? `<span class="stmt" title="${escAttr(r.statement)}">${esc(String(r.statement).split(' — ').slice(1).join(' — ') || r.statement)}</span>` : ''}</td>
       <td>${runCell}</td>${showAudit ? `
-      <td>${r.auditFile ? `<a ${runAttrs} href="${linkPrefix}${esc(r.runId)}/${esc(r.auditFile)}">audit.xlsx</a>` : '—'}</td>` : ''}
+      <td>${r.auditFile ? `<a ${runAttrs} href="${linkPrefix}${attrValue(r.runId)}/${attrValue(r.auditFile)}">audit.xlsx</a>` : '—'}</td>` : ''}
     </tr>`;
   }).join('\n');
 }
@@ -275,7 +275,7 @@ function clientFilterBar(clients) {
   if (!clients || clients.length < 2) return '';
   // data-anon="client" goes on the <option> itself (a span inside <option> is invalid) so the demo overlay
   // aliases the visible label in privacy mode; the value stays the raw customerKey that data-client matches.
-  const opts = clients.map(c => `<option value="${esc(c.key)}" data-anon="client" data-anon-key="${esc(c.key)}">${esc(c.label)}</option>`).join('');
+  const opts = clients.map(c => `<option value="${attrValue(c.key)}" data-anon="client" data-anon-key="${attrValue(c.key)}">${esc(c.label)}</option>`).join('');
   return `<div class="filterbar"><label class="flbl" for="clientFilter">Client</label>` +
     `<select id="clientFilter"><option value="">All clients</option>${opts}</select></div>`;
 }
@@ -377,7 +377,7 @@ ${rows}
 // sidecar without importing this renderer. Imported as well as re-exported — `export ... from` re-exports
 // without binding the name in this module's scope, and regenIndex below calls readArchivedSet directly.
 export { ARCHIVE_TAGS_FILE, readArchivedSet, updateArchived } from './archive-tags.mjs';
-import { readArchivedSet } from './archive-tags.mjs';
+import { readArchivedSet } from './archive-tags.mjs'; import { attrValue, hrefAttr } from './attr.mjs';   // a quoted attribute, and an href
 
 // Collapsible "Older / retired runs" fold for the STAFF index: a count in the summary (so viewers see how many
 // runs we've done) with the names hidden until expanded. Named distinctly from the "Clearance reports" tab so
@@ -1665,9 +1665,9 @@ export function composeEmailHtml(reportMdPath, url, auditFile, names = [], deliv
   // Heading-neutral match: accept the new "Reviewer's open questions" and the legacy "Open questions for the reviewer".
   const oq = (secs['Summary'] || '').match(/\*\*(?:Reviewer's open questions|Open questions for the reviewer)[\s\S]*?(?=\n\n[^*\d])/i);
   // The report link rides HIGH — right under the bottom line in the headline, not buried below the table.
-  const reportLink = url
-    ? `<p style="margin:0 0 10px"><a href="${esc(url)}" style="color:#1a4fd6;font-weight:bold;font-size:12pt;text-decoration:none">▶ Open the full report</a>`
-      + (auditUrl ? ` &nbsp;·&nbsp; <a href="${esc(auditUrl)}" style="color:#3b4fd6;text-decoration:none">Download audit (Excel)</a>` : '')
+  const reportLink = hrefAttr(url)
+    ? `<p style="margin:0 0 10px"><a href="${hrefAttr(url)}" style="color:#1a4fd6;font-weight:bold;font-size:12pt;text-decoration:none">▶ Open the full report</a>`
+      + (hrefAttr(auditUrl) ? ` &nbsp;·&nbsp; <a href="${hrefAttr(auditUrl)}" style="color:#3b4fd6;text-decoration:none">Download audit (Excel)</a>` : '')
       + `</p>`
     : '';
   // The search-scope signal leads the email. The 2026-06-12 "lint flags do not render on the email" rule

package/driver/publish/parse.mjs

@@ -99,7 +99,7 @@ export function stripInternal(s, { client = false } = {}) {
   const out = [];
   for (let line of lines) {
     // normalize wrapped markers ("**::p:: x**", "*::p:: x*") so the marker is match-stable
-    line = line.replace(/(\*{1,2})\s*::p::\s*([\s\S]*?)\1/g, '::p:: $2');
+    line = line.replace(/(\*{1,2})\s*::p::([\s\S]*?)\1/g, (_, _star, x) => `::p:: ${x.replace(/^\s+/, '')}`);   // no `\s*` before the capture: overlapping it with the lazy body backtracked quadratically on an unclosed marker
     if (!line.includes('::p::')) { out.push(line); continue; }
     if (client) {
       const head = line.slice(0, line.indexOf('::p::')).replace(/[\s*_]+$/, '').trim();

package/driver/publish/render.mjs

@@ -25,7 +25,7 @@ import { fileURLToPath } from 'node:url';
 // its own split, which is how the two rules diverged. It calls stripTelemetry now, so the renderer holds
 // no copy of the RULE either, only a call to it.
 import { parseReport, stripInternal, stripTelemetry } from './parse.mjs';
-import { clientConditions } from '../terminal-clamp.mjs';
+import { clientConditions } from '../terminal-clamp.mjs'; import { hrefAttr } from './attr.mjs';   // an href is attribute-safe and http(s), or not a link
 import { EXPORT_TOGGLE, exportPopover, EXPORT_MENU_JS } from './report-topbar.mjs';   // the export menu's shell and behaviour, shared with the knockout template   // the reader's clause per condition, shared with the cover note
 import { COMMON_LAW, normRegion, regionName, REGION_NAMES } from './regions.mjs';
 import { parseFindingsJson, bindRecommendation, sentenceCaseLead, CLIENT_TIER_BY_COMPOSITE, bandOf, compareBlockingPower, inDispositionMode, reasonedNegativeGroups } from '../findings-model.mjs';
@@ -995,7 +995,7 @@ const NAMES_CAP = 8;
 function clearedGroupsHtml(searchDepth, auditFile) {
   const reg = (searchDepth && searchDepth.cleared && searchDepth.cleared.register) || [];
   if (!reg.length) return '';
-  const link = (n) => auditFile ? `<div class="cmore"><a class="wb" href="${escAttr(auditFile)}">All ${n.toLocaleString('en-GB')} in the audit workbook</a></div>` : '';
+  const link = (n) => hrefAttr(auditFile, { relative: true }) ? `<div class="cmore"><a class="wb" href="${hrefAttr(auditFile, { relative: true })}">All ${n.toLocaleString('en-GB')} in the audit workbook</a></div>` : '';
   return CLEARED_GROUP_ORDER.map((g) => {
     const items = reg.filter((c) => c.group === g);
     if (!items.length) return '';
@@ -1229,8 +1229,8 @@ function whatWasSearchedSection(opts, coverage = [], findings = [], recordsByUri
     : '';
   // THE BOARDS END THE SECTION WITH THE WORKBOOK: every search and its result are in the audit workbook,
   // which is where a reader who wants the record goes.
-  const more = opts?.auditFile
-    ? `<div class="cmore"><a class="wb" href="${escAttr(opts.auditFile)}">Every search and result, in the audit workbook</a></div>` : '';
+  const more = hrefAttr(opts?.auditFile, { relative: true })
+    ? `<div class="cmore"><a class="wb" href="${hrefAttr(opts.auditFile, { relative: true })}">Every search and result, in the audit workbook</a></div>` : '';
   if (!rows.length && !openHtml && !prov) return '';
   return `<div class="sec" id="searched"><span class="num"></span><h2>What was searched</h2></div>
   <details class="searched"><summary><span class="gname">Counts for this search</span></summary><div class="gbody">${
@@ -1631,7 +1631,7 @@ function fullDetail(f, card, recordsByUri = new Map()) {
   const regUri = (u, fb) => {
     const h = regHref(u);
     const label = esc(u || fb || 'registration');
-    if (h) return `<a href="${esc(h)}" target="_blank" rel="noopener noreferrer">${label}</a>`;
+    if (hrefAttr(h)) return `<a href="${hrefAttr(h)}" target="_blank" rel="noopener noreferrer">${label}</a>`;
     const note = RECORD_CITATION ? NO_LINK_NOTE[RECORD_CITATION] : null;
     return note ? `${label}<span class="reg-nolink">${note}</span>` : label;
   };
@@ -1744,7 +1744,7 @@ function fullDetail(f, card, recordsByUri = new Map()) {
     const stat = status ? ` <i class="evstat">Evidence: ${esc(status)}</i>` : '';
     const urls = (String(src).match(/https?:\/\/[^\s,|]+/g) || []).map(u => u.replace(/[).,;:]+$/, ''));
     if (!urls.length) return `<li><b>${label}</b> ${esc(src)}${stat}</li>`;
-    const links = urls.map(u => `<a href="${esc(u)}" target="_blank" rel="noopener noreferrer">${esc(u.replace(/^https?:\/\//, '').slice(0, 48))}</a>`).join(' · ');
+    const links = urls.map(u => (hrefAttr(u) ? `<a href="${hrefAttr(u)}" target="_blank" rel="noopener noreferrer">${esc(u.replace(/^https?:\/\//, '').slice(0, 48))}</a>` : esc(u))).join(' · ');
     const rest = String(src).replace(/https?:\/\/[^\s,|]+/g, ' ').replace(/[\s,|]+/g, ' ').trim().replace(/^[—–-]\s*/, '');
     return `<li><b>${label}</b> ${links}${rest ? ` — ${esc(rest)}` : ''}${stat}</li>`;
   };
@@ -1796,7 +1796,7 @@ function fullDetail(f, card, recordsByUri = new Map()) {
   // such line. The SOURCE LINK stays: it is the only address a reader has for the record on this card
   // until the workbook row lands beside it, and dropping both would take a fact away rather than a
   // label. With no link there is nothing left to say, so the row does not render at all.
-  const prov = link ? `<div class="prov"><a href="${esc(link)}" target="_blank" rel="noopener noreferrer">${esc(link.replace(/^https?:\/\//, '').slice(0, 48))}</a></div>` : '';
+  const prov = hrefAttr(link) ? `<div class="prov"><a href="${hrefAttr(link)}" target="_blank" rel="noopener noreferrer">${esc(link.replace(/^https?:\/\//, '').slice(0, 48))}</a></div>` : '';
   // WP-receipts W4 — the code-owned senior-right line (Owner decision 2026-07-05: VERY SIMPLE CLEAR ENGLISH,
   // stated qualification, verdict untouched). Verified senior → nothing extra (the W2 receipt line on
   // the fetched leg is the proof). Unverified → the open item, plainly, where the finding lives.
@@ -2551,7 +2551,7 @@ export function renderHtml(parsed, findings = [], coverage = [], opts = {}) {
   const riskLabel = VERDICT_INFO ? (VERDICT_INFO.tier || TIER_STOP_PILL[i]) : RISK_STOPS[i].toUpperCase();
 
   // Excel/audit download — lives inside the topbar Export popover (portal-report strips the link at serve time for non-staff).
-  const excelBtn2 = !opts.auditFile ? '' : `<a class="util" href="${esc(opts.auditFile)}" download>⬇ Download full audit (Excel)</a>`;
+  const excelBtn2 = !hrefAttr(opts.auditFile, { relative: true }) ? '' : `<a class="util" href="${hrefAttr(opts.auditFile, { relative: true })}" download>⬇ Download full audit (Excel)</a>`;
 
   const cardFor = f => matchCard(f, cards);
   const recordsByUri = opts.recordsByUri || new Map();   // Instance #6 — the run's _records/ set (publishReport loads it)
@@ -2854,7 +2854,7 @@ import { officeReasonSentences } from './office-record-links.mjs';
 function officeRecordCell(uri, regUri, note) {
   const l = RECORD_LINKS?.get(String(uri || '').toLowerCase());
   if (!l?.label) return regUri(uri);
-  if (l.href) return `<a href="${esc(l.href)}" target="_blank" rel="noopener noreferrer">${esc(l.label)}</a>`;
+  if (hrefAttr(l.href)) return `<a href="${hrefAttr(l.href)}" target="_blank" rel="noopener noreferrer">${esc(l.label)}</a>`;
   return note ? `${esc(l.label)}<span class="reg-nolink">${note}</span>` : esc(l.label);
 }
 

package/driver/publish/xlsx.mjs

@@ -706,7 +706,13 @@ export function validateAudit(wb, { findings = [], coverage = [], coverageJudgme
   for (const name of EXPECT) if (!sheets.includes(name)) v.push(`missing tab "${name}"`);
 
   // 3 — banned internal vocabulary anywhere a lawyer can see (tab name, header, or any cell).
-  const scan = (txt, where) => { if (txt != null && BANNED.test(String(txt))) v.push(`banned vocab "${String(txt).match(BANNED)[0]}" in ${where}`); };
+  // A LINK IS A CITATION, NOT VOCABULARY. The sources a finding cites are URLs a lawyer clicks, and `https`
+  // inside one matched the list, so every published example workbook printed an advisory about its own
+  // links. The address is taken out before the scan; "HTTP 404" written as prose is still found.
+  const scan = (txt, where) => {
+    const words = txt == null ? null : String(txt).replace(/\bhttps?:\/\/[^\s<>"')\]]+/gi, " ");
+    if (words != null && BANNED.test(words)) v.push(`banned vocab "${words.match(BANNED)[0]}" in ${where}`);
+  };
   for (const name of sheets) scan(name, `tab name "${name}"`);
   for (const ws of wb.worksheets) {
     ws.eachRow((row, rn) => row.eachCell(cell => {

package/driver/queue-watch-verdict.mjs

@@ -104,7 +104,7 @@ export function queueWatchVerdict({ queueDirs, watched, unitPath, unitError = nu
       message: `this deployment resolves NO queue directory at all, so nothing enqueued to it can ever be drained (${unitPath} watches ${w.length})` };
   }
 
-  const norm = (p) => String(p ?? "").replace(/\/+$/, "");
+  const norm = (p) => { const s = String(p ?? ""); let e = s.length; while (e > 0 && s.charCodeAt(e - 1) === 47) e--; return s.slice(0, e); };   // trailing slashes, in one pass: `/\/+$/` retried every run of slashes that was not at the end
   const watchedSet = new Set(w.map(norm));
   const unwatched = q.map(norm).filter((d) => !watchedSet.has(d));
   const where = `${q.length} queue dir(s) resolved; ${unitPath} watches ${w.length}`;