clearotron 0.3.2-beta.10 → 0.3.2-beta.12

package/driver/contract-vocabulary.mjs

@@ -21,7 +21,7 @@
 //   D4 verify.mjs  parseCoverageLedgerJson, same shape
 //   D5 verify.mjs:1504  fail(`${unaccounted[0].token}:…`)    — token minted in a DATA ROW
 //   D6 verify.mjs:1567  fail(`${violations[0].token}…`)      — validatePlanFeasibility in register-plan.mjs
-//   D7 verify.mjs:1558  fail(`${v2[0].token}${detail}…`)     — register-plan.mjs:2183 disclosureTextByAxis
+//   D7 verify.mjs:1558  fail(`${v2[0].token}${detail}…`)     — register-plan.mjs:2270 disclosureTextByAxis
 //   D8 verify.mjs:2470 caseLawLedgerFail  fail(caseLawLedgerFail(…))  — token built in case-law-ledger.mjs:195 caseLawLedgerFail
 //
 // A partition built on the 60 tokens a regex CAN see would run green while blind to the rest, which is
@@ -139,10 +139,10 @@ export const VOCABULARY = [
   { token: "coverage_form_missing", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_form_empty", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_status_offenum", stages: ["register-digest"], site: "driver/verify.mjs:2050" },
-  { token: "coverage_deferred_unaccounted", stages: ["register-digest"], site: "driver/verify.mjs coverageFormFail", family: "driver/register-plan.mjs:1860 PROVIDER_HARD_ERROR_PREFIX — token on a data row", dynamic: "D5" },
-  { token: "coverage_clean_unexecuted", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1594 validatePlanFeasibility", dynamic: "D6" },
-  { token: "coverage_clean_skipped", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1955 searchedJurisdictionsFromPlan", dynamic: "D6" },
-  { token: "coverage_clean_unverified_incomplete", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:2183 disclosureTextByAxis", dynamic: "D7" },
+  { token: "coverage_deferred_unaccounted", stages: ["register-digest"], site: "driver/verify.mjs coverageFormFail", family: "driver/register-plan.mjs:1947 PROVIDER_HARD_ERROR_PREFIX — token on a data row", dynamic: "D5" },
+  { token: "coverage_clean_unexecuted", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1681 validatePlanFeasibility", dynamic: "D6" },
+  { token: "coverage_clean_skipped", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:2042 searchedJurisdictionsFromPlan", dynamic: "D6" },
+  { token: "coverage_clean_unverified_incomplete", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:2270 disclosureTextByAxis", dynamic: "D7" },
   { token: "coverage_clean_tainted", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_ledger_", stages: ["register-digest"], site: "driver/verify.mjs", family: "driver/coverage-ledger.mjs (parseCoverageLedgerJson token-first throws)", dynamic: "D4" },
   { token: "coverage_key_unknown", stages: ["register-digest"], site: "driver/verify.mjs", family: "driver/coverage-ledger.mjs", dynamic: "D4" },

package/driver/engine/mcp/recording-server.mjs

@@ -826,6 +826,26 @@ serve({
             },
           },
         },
+        // OFFERED HERE, OR NEVER SENT. The acceptor took this field for a beta and the plan acted on it,
+        // and no frame ever proposed one, because the schema a model is given did not offer it. Worded as
+        // the owner approved it; it is model-facing prose, so its wording is his.
+        house_element_candidate: {
+          type: "object",
+          description:
+            "Only when an element of the mark is one the CLIENT already owns as a registered mark in the " +
+            "instructed classes (a house mark before a tagline, for instance): name that element, the remainder " +
+            "the analysis should be limited to, and why you read it as the client's own. Ownership is checked " +
+            "on the register, by owner, before anything is excluded; if it cannot be verified, nothing is. Omit " +
+            "the field when no element is the client's own.",
+          required: ["element", "remainder", "owner_basis"],
+          properties: {
+            element: { type: "string", description: "The client's own element, exactly as it appears in the mark." },
+            remainder: { type: "string",
+              description: "The rest of the mark: the part the analysis is limited to. Never empty, never the element itself." },
+            owner_basis: { type: "string",
+              description: "Why you read the element as the client's own — what in the matter says so." },
+          },
+        },
       },
     },
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
@@ -1112,7 +1132,7 @@ serve({
               factors: { type: "array", minItems: 2, maxItems: 4, items: { type: "string" }, description: "2–4 one-line load-bearing observations behind the band." },
               counterFactors: { type: "array", minItems: 1, maxItems: 3, items: { type: "string" }, description: "1–3 one-line statements of what holds this name at this band rather than the next, either way." },
               mitigation: { type: "string", description: "May be \"\" when nothing would move the band — but SEND THE KEY, so a considered \"none\" is not confusable with an omission." },
-              assessment: { type: "string", description: "The opening paragraph a reader of THIS MARK'S own report sees first: what the name is, what the landscape looks like, what drives the rating, what to do with it." },
+              assessment: { type: "string", description: "The opening paragraph a reader of THIS MARK'S own report sees first: what the name is, what the landscape looks like, what drives the rating." },
               contextFraming: { type: "string" },
               registerEstimate: { type: "string" },
               parodyNote: { type: ["string", "null"] },

package/driver/engine/mcp/supplemental.mjs

@@ -30,7 +30,7 @@
 import { readFileSync, writeFileSync, renameSync, existsSync, mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { driverDir } from "../../../shared/driver-dir.mjs";   //
-import { PLAN_PREDICATES, PLAN_MAX_OR_WIDTH, PLAN_MAX_NAME_LENGTH, fingerprint, ownerIntersectionGap, resolveRegions } from "../../register-plan.mjs";
+import { PLAN_PREDICATES, PLAN_MAX_OR_WIDTH, PLAN_MAX_NAME_LENGTH, fingerprint, ownerIntersectionGap, resolveRegions, houseElementOf, withoutHouseElementTerms } from "../../register-plan.mjs";
 import { entryTermIssues } from "../../../providers/_shared/term-shape.mjs";
 import { isNonLatinTerm, romanizationRefusal, romanizationSpellings, nativeScriptIndexGap } from "../../../providers/_shared/script-form.mjs";
 
@@ -289,9 +289,10 @@ export async function proposeSupplemental(params, tctx, deps) {
   // execute-plan kernel hands it to the provider's buildEntryQuery, which backfills only entries that
   // declare none (makeRegionRequiredBuildEntryQuery). A proposal that DOES declare regions is
   // untouched, qid fingerprints are unchanged, and providers that do not require regions ignore it.
-  let planRegions = [], planClasses = [];
+  let planRegions = [], planClasses = [], house = null;
   try {
     const frozen = JSON.parse(readFileSync(driverDir(dirname(dirname(outPath)), "register-plan.json"), "utf8"));
+    house = houseElementOf(frozen);
     planRegions = (Array.isArray(frozen?.regions) ? frozen.regions : []).map((r) => String(r).trim()).filter(Boolean);
     // C3 — the frozen plan's own class list is the priority set: proposals intersecting it compete
     // for the per-call/per-axis caps first (mintSupplementalEntries stable-sorts; values unchanged).
@@ -307,8 +308,24 @@ export async function proposeSupplemental(params, tctx, deps) {
   }
   const perCall = 12;   // step 3 — was a knob; no environment ever set it
   const axisMax = 24;   // step 3 — was a knob; no environment ever set it
+  // ── THE CLIENT'S OWN ELEMENT IS LEFT OUT BEFORE ANYTHING RUNS ───────────────────────────────────
+  //
+  // This tool EXECUTES what it mints, before the fold adds it to the plan, so the fold's own exclusion
+  // (`houseElementOf` in register-plan.mjs) comes too late here: the query would already have run. On
+  // the first live run that proposed an exclusion, this session proposed an exact search on the bare
+  // house element the compile had set aside. The same rule is applied here, before the mint. Not a
+  // rejection: rejected[] becomes an OPEN ask on the report, and the element is not an open question.
+  const excludedHouse = [];
+  const offered = [];
+  for (const p of proposals) {
+    const kept = house ? withoutHouseElementTerms({ ...(p ?? {}), predicate: String(p?.predicate ?? "default") }, house) : p;
+    if (!kept) { excludedHouse.push(String(p?.term ?? p?.terms?.[0] ?? "")); continue; }
+    offered.push(kept === p || !Array.isArray(kept.terms) ? p : { ...p, terms: kept.terms });
+  }
+  if (!offered.length)
+    return { type: "text", text: JSON.stringify({ minted: [], reused: [], rejected: [], excluded_house_element: excludedHouse, executed: false }, null, 2) };
   const existingQids = new Set(supp.entries.map((e) => e.qid));
-  const { minted, reused, rejected, enriched, narrowed } = mintSupplementalEntries(axis, proposals,
+  const { minted, reused, rejected, enriched, narrowed } = mintSupplementalEntries(axis, offered,
     { existingQids, perCall, axisMax, existingCount: supp.entries.length, capabilities: deps.capabilities ?? null, priorityClasses: planClasses });
 
   // Field-level romanisation enrichment of a REUSED qid (2026-07-30 review round): the natural retry —
@@ -373,7 +390,7 @@ export async function proposeSupplemental(params, tctx, deps) {
     const r = await executePlan({ plan_path: suppPath, axis, output_path: outPath, qids }, tctx);
     const text = r && typeof r === "object" ? (r.text ?? "") : String(r ?? "");
     if (!text || text.startsWith("ERROR")) {
-      return { type: "text", text: JSON.stringify({ minted: minted.map((e) => e.qid), reused, ...(enrichedQids.length ? { enriched: enrichedQids } : {}), ...(conflicts.length ? { conflict: conflicts } : {}), rejected, ...(narrowed.length ? { narrowed } : {}), executed: false, error: text.slice(0, 300) || "executor returned nothing" }, null, 2) };
+      return { type: "text", text: JSON.stringify({ minted: minted.map((e) => e.qid), reused, ...(enrichedQids.length ? { enriched: enrichedQids } : {}), ...(conflicts.length ? { conflict: conflicts } : {}), rejected, ...(excludedHouse.length ? { excluded_house_element: excludedHouse } : {}), ...(narrowed.length ? { narrowed } : {}), executed: false, error: text.slice(0, 300) || "executor returned nothing" }, null, 2) };
     }
     try { summary = JSON.parse(text); } catch { summary = { raw: text.slice(0, 300) }; }
   }
@@ -398,5 +415,5 @@ export async function proposeSupplemental(params, tctx, deps) {
     }
   } catch { /* band unreadable — the executor summary still crosses */ }
 
-  return { type: "text", text: JSON.stringify({ minted: minted.map((e) => e.qid), reused, ...(enrichedQids.length ? { enriched: enrichedQids } : {}), ...(conflicts.length ? { conflict: conflicts } : {}), rejected, ...(narrowed.length ? { narrowed } : {}), executed: qids.length > 0, summary, results }, null, 2) };
+  return { type: "text", text: JSON.stringify({ minted: minted.map((e) => e.qid), reused, ...(enrichedQids.length ? { enriched: enrichedQids } : {}), ...(conflicts.length ? { conflict: conflicts } : {}), rejected, ...(excludedHouse.length ? { excluded_house_element: excludedHouse } : {}), ...(narrowed.length ? { narrowed } : {}), executed: qids.length > 0, summary, results }, null, 2) };
 }

package/driver/knockout-next-step.mjs

@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+// knockout-next-step.mjs — a next-step section the assessing model wrote into a name's read comes off
+// before the report is published.
+//
+// A knockout states findings and a rating; what to do with the name is the reading lawyer's. The assessing
+// instructions stopped asking for a next step, and the model still writes one now and then, under a heading
+// of its own: "What to do with it", "Practical next step". Refusing the turn and re-asking cost a full
+// re-dispatch each time, and the owner ruled for delivery over the loop (2026-09-19). So the section is
+// removed here, in code, with no model call, and the run record names every heading removed.
+//
+// WHAT COMES OFF: a heading whose own words are a next step, and the section under it — nothing else. A
+// hashed heading's section runs to the next heading at its level or above; a line that is only bold text
+// runs to the next heading of either kind; a bold label opening a paragraph ("**Practical next step** —
+// …") takes that paragraph. Position does not matter: removing a section cannot reorder what is left.
+//
+// WHAT STAYS, BY DESIGN: the same advice written as an ordinary sentence with no heading over it. Nothing
+// bounds that sentence but judgement, and cutting a guess out of the client's read is worse than leaving
+// it. The instruction not to write one is the only thing that reaches it.
+
+// A heading's own words that make it a next step. Whole-heading: "What drives the rating" and "What is
+// still open" are not next steps, and a word appearing somewhere inside a heading proves nothing.
+export const NEXT_STEP_HEADING_RE =
+  /^(?:(?:practical|immediate|suggested|recommended|possible)\s+)?(?:next\s+steps?\b.*|what\s+to\s+do\b.*|what\s+happens\s+next|recommendations?\b.*|our\s+recommendations?\b.*|(?:the\s+)?way\s+forward)$/i;
+
+const label = (s) => String(s).replace(/[*_`]/g, "").replace(/[\s:.–—-]+$/, "").trim();
+
+/** What kind of heading this line is, and its words — or null for a line that heads nothing. PURE. */
+function headingAt(line) {
+  const atx = /^\s{0,3}(#{1,6})\s+(.*?)\s*#*\s*$/.exec(line);
+  if (atx) return { kind: "atx", level: atx[1].length, text: label(atx[2]) };
+  const bold = /^\s*(\*\*|__)(.+?)\1\s*:?\s*$/.exec(line);
+  if (bold) return { kind: "bold", text: label(bold[2]) };
+  const lead = /^\s*(\*\*|__)(.+?)\1\s*[:.–—-]?\s+\S/.exec(line);
+  if (lead) return { kind: "lead", text: label(lead[2]) };
+  return null;
+}
+
+/** Is this whole line a heading over a next step? PURE. */
+export function isNextStepHeading(line) {
+  const h = headingAt(String(line ?? ""));
+  return Boolean(h && NEXT_STEP_HEADING_RE.test(h.text));
+}
+
+/**
+ * The text with every next-step section removed, and what was removed: `{ text, removed: [{ heading,
+ * chars }] }`. Text with nothing to remove comes back byte-identical. PURE.
+ */
+export function stripNextStepSections(text) {
+  const src = String(text ?? "");
+  const lines = src.split("\n");
+  const keep = [];
+  const removed = [];
+  for (let i = 0; i < lines.length;) {
+    const h = headingAt(lines[i]);
+    if (!h || !NEXT_STEP_HEADING_RE.test(h.text)) { keep.push(lines[i]); i++; continue; }
+    let j = i + 1;
+    if (h.kind === "lead") {
+      while (j < lines.length && lines[j].trim() !== "") j++;
+    } else {
+      for (; j < lines.length; j++) {
+        const n = headingAt(lines[j]);
+        if (!n || n.kind === "lead") continue;
+        if (h.kind === "atx" ? n.kind === "atx" && n.level <= h.level : true) break;
+      }
+    }
+    removed.push({ heading: h.text, chars: lines.slice(i, j).join("\n").trim().length });
+    i = j;
+  }
+  if (!removed.length) return { text: src, removed };
+  return { text: keep.join("\n").replace(/\n[ \t]*\n(?:[ \t]*\n)+/g, "\n\n").trim(), removed };
+}

package/driver/named-band.mjs

@@ -137,7 +137,7 @@ export function parseNamedBand(raw) {
         // byte-identical to a slice the plan deliberately counted without fetching. Measured on a real
         // run: four capability-gap blocks carried `error:true, deferred:true` into this function and
         // reached record-carry.json with both fields gone and a sentence claiming the run "has a hit
-        // COUNT for this slice". register-plan.mjs:1594 validatePlanFeasibility already enforces the same rule one layer up
+        // COUNT for this slice". register-plan.mjs:1681 validatePlanFeasibility already enforces the same rule one layer up
         // ("a transient must not ship indistinguishable from a sanctioned descriptor") — it reads the
         // RAW blocks, which is why it could. Every consumer that reads THIS projection could not.
         // Conditional like the four keys above, so old bands carry neither key and nothing shifts.

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.2-beta.10",
+  "version": "0.3.2-beta.12",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/phase0.mjs

@@ -5,7 +5,7 @@
 
 import { existsSync, appendFileSync, readFileSync, mkdirSync } from "node:fs";
 import { join, dirname } from "node:path";
-import { createHash, randomUUID } from "node:crypto";
+import { createHash, randomUUID, randomInt } from "node:crypto";
 import { ledgerPath } from "../providers/_shared/ledger-path.mjs";
 import { config } from "./driver.config.mjs";
 import { resolveProfile } from "./profiles.mjs";
@@ -26,7 +26,15 @@ const NOUN = [
   "warren", "beacon", "quarry", "willow", "kestrel", "monolith", "estuary", "bramble", "compass", "drift",
 ];
 
-export function genCodename(rand = Math.random) {
+// THE CODENAME IS DRAWN FROM THE OPERATING SYSTEM'S RANDOM SOURCE, not Math.random. It is a label, not a
+// secret: it names a run's directory and appears in its reports, and the keys built from it name a run's
+// attempts and ledgers — nothing is authorised by knowing one. But it is the first thing the run identifier
+// is made of, and a label that is also unpredictable costs nothing here, while a predictable one invites
+// every later reader to wonder what else leans on it. Same [0, 1) shape as Math.random, so the injected
+// `rand` the tests pass for determinism works unchanged.
+const cryptoRand = () => randomInt(0, 2 ** 32) / 2 ** 32;
+
+export function genCodename(rand = cryptoRand) {
   return `${ADJ[Math.floor(rand() * ADJ.length)]}-${NOUN[Math.floor(rand() * NOUN.length)]}`;
 }
 
@@ -186,7 +194,7 @@ export function claimRunCodename({ slug, date, codename, registryPath = codename
 // a pre-mint through raw genCodename would silently lose this collision protection.
 // 20 straight collisions ⇒ the 400-name space is exhausted for this slug+date — suffix for freshness.
 export function mintFreshCodename({ slug, date, studioRoot = config.studioRoot, archiveRoot = config.archiveRoot,
-  rand = Math.random, claim = claimRunCodename }) {
+  rand = cryptoRand, claim = claimRunCodename }) {
   for (let i = 0; i < 20; i++) {
     const c = genCodename(rand);
     if (!existsSync(runDirFor({ slug, date, codename: c, studioRoot }))
@@ -198,22 +206,23 @@ export function mintFreshCodename({ slug, date, studioRoot = config.studioRoot,
   return `${genCodename(rand)}-${Date.now().toString(36)}`;
 }
 
-// Assemble the immutable run identity for a job. rand is injectable for tests. studioRoot/archiveRoot are the
+// Assemble the immutable run identity for a job. rand and claim are injectable for tests — claim so a test's
+// mints go to a registry of its own rather than the box-wide one every run on this account shares. studioRoot/archiveRoot are the
 // FORWARDING agent's (derived from its queue dir by the runner); they default to clawdi's for back-compat.
 // `codename`/`date` overrides exist for RESUME: re-driving a failed run must rebuild the SAME run identity
 // (slug/date/codename → the same run-dir) so the idempotency skip reuses the prior stages instead of minting
 // a fresh codename and re-spending everything (the "pearl-keystone" trap). A bare new run leaves both unset.
 export function buildRunContext(
   job,
-  { rand = Math.random, now = new Date(), studioRoot = config.studioRoot, archiveRoot = config.archiveRoot,
-    codename: codenameOverride, date: dateOverride } = {},
+  { rand = cryptoRand, now = new Date(), studioRoot = config.studioRoot, archiveRoot = config.archiveRoot,
+    codename: codenameOverride, date: dateOverride, claim = claimRunCodename } = {},
 ) {
   const slug = deriveSlug(job);
   const date = dateOverride ?? todayISO(now);
   // Fresh mints go through mintFreshCodename (above) so they never land in a dir another run already owns.
   // Overrides skip the check: RESUME (and the runner's dispatch pre-mint, which already minted freshly)
   // wants the identity verbatim.
-  const codename = codenameOverride ?? mintFreshCodename({ slug, date, studioRoot, archiveRoot, rand });
+  const codename = codenameOverride ?? mintFreshCodename({ slug, date, studioRoot, archiveRoot, rand, claim });
   return {
     slug,
     codename,

package/driver/pipeline-knockout.mjs

@@ -56,6 +56,7 @@ import { registerUnavailableOffices } from "./register-unreachable.mjs";
 import { runRecordLogPath } from "../providers/_shared/ledger-path.mjs";   // — this run's record log
 import { validators as koValidators, validateMergedFindings, worstBand, registerSurfacedFilings, raterCaveats, SURVIVOR_BOUNDARY_RE } from "./verify-knockout.mjs";
 import { reviewAbout, reviewEvidence, reviewEvidenceLines, applyKnockoutReview, knockoutReviewFile } from "./knockout-review-record.mjs";
+import { stripNextStepSections } from "./knockout-next-step.mjs";
 import { publishKnockout, composeKnockoutEmail } from "./publish/knockout.mjs";
 import { writeRunStatus, rollupStatus, atomicWrite, identitySeed } from "./progress.mjs";   // — the identity seed is shared; the stepper is not
 import { batchMarkName } from "./mark-name.mjs";
@@ -349,6 +350,28 @@ export function survivorBoundaryNote(policy) {
   return `This is ${screenName}, not a clearance. A mark not knocked out here is not clear — it is not knocked out at this screen's depth, and proceeds to clearance. Nothing above is a finding of availability.`;
 }
 
+// ── a next-step section the model wrote comes off, in code ──────────────────────────────────────────
+//
+// Each name's read is published as its own report, and the screen states findings and a rating — what to
+// do with the name is the reading lawyer's. A heading the model wrote over a next step, and the section
+// under it, are removed here and named in the run record; `knockout-next-step.mjs` says what counts. This
+// replaced a pre-delivery refusal that re-asked the whole chunk for the same edit (owner, 2026-09-19).
+// EXPORTED so the record line is driven directly, not only through a whole pipeline.
+export function removeNextStepSections(runDir, marks) {
+  const out = [];
+  for (const m of marks ?? []) {
+    if (typeof m?.assessment !== "string") continue;
+    const { text, removed } = stripNextStepSections(m.assessment);
+    if (!removed.length) continue;
+    m.assessment = text;
+    const row = { event: "knockout-next-step-removed", mark: m.name, headings: removed.map((r) => r.heading),
+      chars: removed.reduce((n, r) => n + r.chars, 0), lane: "knockout" };
+    runLog(runDir, row);
+    out.push(row);
+  }
+  return out;
+}
+
 // ── — the knockout lane's recovery park ───────────────────────────────────────
 //
 // EXPORTED so it can be armed directly. The clearance lane's equivalent is inline in a 6,000-line catch
@@ -964,6 +987,9 @@ export async function knockoutInner(ctx, job, opts = {}) {
     // it runs BEFORE the artifact is written, not after. The counts are logged because a receipts pass
     // over zero citations is a different fact from a receipts pass, and only the count can tell them
     // apart afterwards.
+    // BEFORE THE GATE AND THE WRITE, so the record on disk is the record that ships, and the reviewing
+    // pass never addresses a line inside a section that is about to go.
+    removeNextStepSections(run.runDir, merged.marks);
     const mv = validateMergedFindings(run.runDir, merged, plan);
     if (!mv.ok) throw new StageFailure("knockout-assess", `merged findings failed the lint: ${mv.failures.join("; ")}`, null);
     runLog(run.runDir, { event: "knockout-receipts", ...mv.receipts });

package/driver/pipeline.mjs

@@ -13518,7 +13518,7 @@ async function pipelineInner(job, opts = {}) {
     // structured-only). Each stage is file-gated/resumable; per-card sessions feed the lint repair below.
     // C2 — fold same-owner+same-mark duplicate filings into one finding BEFORE the overview + cards read
     // findings.json, so the whole delivery phase (and the published copy) sees the single consolidated set.
-    injectDeferralCoverage(P, run.runDir, note);   // A3: unclosed reopen directives become reader-visible coverage rows first
+    injectDeferralCoverage(P, run.runDir, note); injectMeaningGapCoverage(P, run.runDir, note);   // A3: unclosed reopen directives, and meaning searches that did not complete, become reader-visible coverage rows first
     // qw/cn-scope-honesty — the sibling injection: a CN-family-scope run whose zh lane did not run
     // discloses what the native-language investigation would have searched, and where it is offered
     // (coverage-limited: never clamps, never gates).
@@ -16831,3 +16831,50 @@ export function registerGapConditions(regGap) {   // @internal
   });
   return out;
 }
+
+// ── A MEANING SEARCH THAT DID NOT COMPLETE REACHES THE CLIENT'S OWN PAGE, NOT ONLY THE AUDIT ────────────
+//
+// The connotation gate delivers a run whose dictated meaning searches did not all complete, and records
+// each unfinished one as a gap carrying its term — a gap the engine wrote for a search that never came
+// back, or the provider's own row for one it refused. The audit read those gaps; the report was never
+// handed the grid, so whether a client learned a meaning search was missing was up to the synthesis
+// model. This puts each on the coverage the report renders, the way an unclosed follow-up already is:
+// the same row, `deferralCoverageRow`, and an approved reader sentence that says it is left open — true
+// of a drop and of a refusal alike. Telling the two apart on the page
+// would need a sentence nobody has approved, and is not attempted here.
+//
+// The same guard as `injectDeferralCoverage`: a gap synthesis already weighed in is not added twice, and
+// a findings.json that fails its own schema after the push is left as it was.
+// THE WORDS ARE CHOSEN, NOT THE CAUSE: of the approved reasons, "nothing in the run's own record confirms it
+// was searched" is true of a search that never came back AND of one the provider refused, and does not
+// repeat the row's own "not completed this run" the way the generic fallback does. It borrows that arm's
+// sentence only; if the arm is ever reworded for its own case, re-read this row against it.
+const MEANING_SEARCH_UNFINISHED = "not-verified-closed";
+export function injectMeaningGapCoverage(P, runDir, note) {   // @internal — exported so the refusal shape is testable without a run
+  try {
+    if (!existsSync(P.commonLawGrid) || !existsSync(P.findings)) return;
+    const grid = JSON.parse(readFileSync(P.commonLawGrid, "utf8"));
+    const terms = [...new Set((Array.isArray(grid?.gaps) ? grid.gaps : [])
+      .filter((g) => String(g?.platform ?? "").toLowerCase() === "connotation")
+      .map((g) => String(g?.term ?? "").trim()).filter(Boolean))];
+    if (!terms.length) return;
+    const doc = JSON.parse(readFileSync(P.findings, "utf8"));
+    if (!Array.isArray(doc.coverage)) doc.coverage = [];
+    const normTxt = (s) => String(s ?? "").toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+    const covText = normTxt(doc.coverage.map((c) => `${c.area} ${c.note ?? ""}`).join(" "));
+    let added = 0;
+    for (const term of terms) {
+      const slice = normTxt(term).split(" ").filter((w) => w.length >= 4).slice(0, 4).join(" ");
+      if (slice && covText.includes(slice)) continue;          // synthesis already weighed it in
+      doc.coverage.push(deferralCoverageRow(term, MEANING_SEARCH_UNFINISHED));
+      added++;
+    }
+    if (!added) return;
+    parseFindingsJson(JSON.stringify(doc));                    // re-validate the shape (throws → catch keeps original)
+    atomicWrite(P.findings, `${JSON.stringify(doc, null, 2)}\n`);
+    note(`[common-law] ${added} meaning search(es) that did not complete now reach the report's coverage`);
+    runLog(runDir, { event: "meaning-gap-coverage", added });
+  } catch (e) {
+    note(`[common-law] meaning-gap coverage skipped: ${String(e?.message || e).replace(/\s+/g, " ").slice(0, 100)}`);
+  }
+}

package/driver/portal-local-auth.mjs

@@ -422,10 +422,20 @@ export function firstRunCredentialLines({ handoff, credentialPath, email, passph
     return [head, `  PASSPHRASE: ${passphrase}`,
       "  Write it down now. It is not stored anywhere in a form that can be read back, and this line will not be printed again."];
   }
-  return [head,
-    "  The passphrase is NOT printed here: stderr is not a terminal, so this line would outlive the moment \u2014 a journal, a CI log, or a test's captured output.",
-    "  Nothing holds it now, this process included: what is on disk is a digest. To get one you can sign in with, run:",
-    `    ${resetCommand}`];
+  return [head, ...passphraseWithheldLines({ stream: "stderr", resetCommand }).map((line) => `  ${line}`)];
+}
+
+/**
+ * What stands where the passphrase would, on an output that is not a terminal. ONE composer for the two
+ * places a first run can hand the passphrase over \u2014 the portal's standard error and the launcher's closing
+ * box on standard output \u2014 so they give one reason and one way back in. It is never handed the
+ * passphrase, so no caller can wire the value through it.
+ */
+export function passphraseWithheldLines({ stream, resetCommand = "" }) {
+  return [
+    `The passphrase is NOT printed here: ${stream} is not a terminal, so this line would outlive the moment \u2014 a journal, a CI log, or a test's captured output.`,
+    "Nothing holds it now, this process included: what is on disk is a digest. To get one you can sign in with, run:",
+    `  ${resetCommand}`];
 }
 
 export const SESSION_DOMAIN = "portal-session.v1|";

package/driver/portal-report.mjs

@@ -122,6 +122,13 @@ const CHROME_RES = [
   // has stopped matching. Removing the wrapper first would take the nav with it, drive the count to
   // zero, and turn a security assertion into a permanent false alarm.
   { tag: "div", open: /<div class="[^"]*\brep-stickyhead\b[^"]*"[^>]*>/ },
+  // THE SECTION MENU, WHEREVER THE RENDERER PUT IT. A report rendered today carries it inside the header
+  // above, and it goes with that. A report rendered before 2026-09-18 carries it just AFTER the header, so
+  // stripping the header alone left it in the frame: a second copy of the menu the portal draws, pinned
+  // over the report's title band, its current item red on red in the dark theme. Measured on an archived
+  // global preliminary report served by a published beta. Archived reports are served from their baked
+  // bytes, so this has to happen here rather than in the renderer. `sectionsOf` has already read it.
+  { tag: "nav", open: /<nav class="[^"]*\bstrip\b[^"]*"[^>]*>/ },
   // the "Internal review copy — stripped on export" bar, which hosted the quality-capture controls
   { tag: "div", open: /<div class="[^"]*\breview\b[^"]*\binternal\b[^"]*"[^>]*>/ },
   // per-finding flag buttons and their popovers
@@ -529,7 +536,7 @@ const EMBED_JS = `
   function schedule(){
     if(queued)return;
     queued=true;
-    requestAnimationFrame(function(){queued=false;post();});
+    requestAnimationFrame(function(){queued=false;post();sections();});
   }
   // WHICH CONTROLS THIS DOCUMENT ACTUALLY HAS.
   //
@@ -559,12 +566,24 @@ const EMBED_JS = `
   // script) and the shell draws it in its own header. Only the ids that are really in the document are
   // announced: a report whose renderer named a section it did not draw would otherwise offer the reader
   // a breadcrumb entry that jumps nowhere.
+  //
+  // AND WHERE EACH ONE STARTS, so the shell can show how far the reader has got (owner, 2026-09-19): every
+  // section reached so far is marked, the rest are not. The page scrolls, not this frame, so only the shell
+  // knows where the reader is. It needs each section's top in this document to compare. Said again whenever
+  // the layout moves: a panel opening pushes every section below it down.
+  var saidSections='';
   function sections(){
     try{
       var list=window.__CORD_SECTIONS;
       if(!list||!list.length)return;
       var live=[];
-      for(var i=0;i<list.length;i++) if(document.getElementById(list[i].id)) live.push(list[i]);
+      for(var i=0;i<list.length;i++){
+        var el=document.getElementById(list[i].id);
+        if(el) live.push({id:list[i].id,label:list[i].label,top:Math.max(0,Math.round(el.getBoundingClientRect().top+window.scrollY))});
+      }
+      var said=JSON.stringify(live);
+      if(said===saidSections)return;
+      saidSections=said;
       parent.postMessage({source:TAG,type:'sections',sections:live},'*');
     }catch(e){}
   }

package/driver/portal-service.mjs

@@ -968,6 +968,15 @@ const DENIAL_REASON = Object.freeze({
   429: "rate limited",
 });
 
+/**
+ * WHAT A REFUSED CLIENT IS TOLD — a closed set, keyed on the status, never the error's message. The message
+ * can come out of a third-party token check with a claim value, an address or a fragment of the rejected
+ * token in it, and some of our own refusals put the caller's address in theirs. A 401 keeps the words the
+ * browser contract already decodes ("not signed in"); every other status says the journal's code-owned
+ * reason. The message itself is still journalled nowhere a client reads. PURE.
+ */
+export const refusalWords = (status) => (status === 401 ? "not signed in" : DENIAL_REASON[status] ?? "refused at the door");
+
 /**
  * — THE ROW A REFUSAL FILES. One shape, one sink, whichever side of `route` decided the answer.
  *
@@ -3922,7 +3931,9 @@ const escHtml = (t) => String(t).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<"
 // and brand pack §01 fixes dark at #0f0e0c near-black + #f0e8d8 parchment. The pack wins.
 // ── THE PLAIN LINE LEADS; THE ADMINISTRATOR'S TWO LINES STEP BACK INTO A FOLD ────────────────────────
 //
-// A person arriving here needs the field, the button, and one fact: this install signs in one person.
+// A person arriving here needs the field, the button, and one fact: this install has one user, and which
+// address that is. The owner's words, 2026-09-19: "Clearotron portal, as <address>." read as "you are
+// <address>", and a person who found `key issue` first minted a key and could not get in.
 // The reset command and the way to add people are an administrator's business, so they sit in a closed
 // "Administrator help" fold, word for word as they were, with the same link People gives to putting a
 // login system in front. A `<details>` needs no script, which this door must render without.
@@ -3967,9 +3978,7 @@ ${DOOR_THEME_INIT}
   .hint { margin-top:18px; font-size:13px; }
   code { font-family:var(--mono); font-size:12.5px; background:var(--code-bg);
          padding:1px 5px; border-radius:4px; overflow-wrap:anywhere; }
-  .lead { margin:18px 0 0; padding-top:14px; border-top:1px solid var(--line); font-size:13.5px; color:var(--ink); }
-  .lead b { font-weight:600; }
-  .fold { margin-top:10px; }
+  .fold { margin-top:18px; padding-top:14px; border-top:1px solid var(--line); }
   .fold > summary { display:inline-flex; align-items:center; gap:6px; list-style:none; cursor:pointer;
                     font-size:13px; color:var(--link); }
   .fold > summary::-webkit-details-marker { display:none; }
@@ -3984,7 +3993,7 @@ ${signedIn
     ? `<p>You are signed in as <span class="who">${escHtml(email)}</span>.</p>
 <div><a href="/portal">Go to the portal</a></div>
 <form method="post" action="/portal/logout"><button type="submit">Sign out</button></form>`
-    : `<p>${escHtml(BRAND.name)} portal, as <span class="who">${escHtml(email)}</span>.</p>
+    : `<p>This ${escHtml(BRAND.name)} has one user: <b class="who">${escHtml(email)}</b>. Enter its passphrase.</p>
 ${discarded ? `<p class="hint">A session this portal did not start, from another ${escHtml(BRAND.name)} on this address or an expired one, was set aside. Sign in below.</p>` : ""}
 ${error ? `<p class="err">${escHtml(error)}</p>` : ""}
 <form method="post" action="/portal/login">
@@ -3992,10 +4001,10 @@ ${error ? `<p class="err">${escHtml(error)}</p>` : ""}
   <input id="passphrase" name="passphrase" type="password" autocomplete="new-password" autofocus>
   <button type="submit">Sign in</button>
 </form>
-<p class="lead"><b>This ${escHtml(BRAND.name)} signs in one person: you.</b></p>
 <details class="fold"><summary><span>Administrator help</span><svg class="chev" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" focusable="false"><path d="m9 18 6-6-6-6"/></svg></summary>
-<p class="hint">Lost the passphrase? Run <code>${escHtml(reset)}</code> on the machine
-running this portal. It mints a new one and prints it once.</p>
+<p class="hint">The passphrase was printed once when this ${escHtml(BRAND.name)} first started. Lost it? Run
+<code>${escHtml(reset)}</code> on the machine running this portal. It prints a new one, once, for the same user.</p>
+<p class="hint">A key from <code>${escHtml(bareInvocation("key"))} issue</code> is for an AI assistant, not for this page.</p>
 <p class="hint">To add people, put it behind a login system such as your company single sign-on. <a href="${escHtml(LOGIN_IN_FRONT_DOC)}" target="_blank" rel="noreferrer">How to set that up</a></p>
 </details>`}
 </div></body></html>`;
@@ -4399,7 +4408,7 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
       // row must not become a place a caller can write into by sending a body that fails to parse.
       let body;
       try { body = await readJsonBody(req); }
-      catch (e) { journal(400, "unreadable body", identity?.email); return send(res, 400, { error: String(e.message) }); }
+      catch { journal(400, "unreadable body", identity?.email); return send(res, 400, { error: "unreadable body" }); }   // the parser's own message describes the bytes it was sent, and a response is not where a parse error is read back
       const query = Object.fromEntries(url.searchParams.entries());
       const r = await service.route(req.method, url.pathname, identity, body, query);
       // A PLAIN DOCUMENT this server renders itself. Escaped into a `<pre>`, so nothing in the file can
@@ -4466,11 +4475,11 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
         // person who typed the address gets a door.
         const wantsHtml = String(req.headers.accept ?? "").includes("text/html");
         if (wantsHtml) {
-          const html = denialPage(e.status, e.message);
+          const html = denialPage(e.status, refusalWords(e.status));
           res.writeHead(e.status, { "content-type": "text/html; charset=utf-8", "content-length": Buffer.byteLength(html), "x-content-type-options": "nosniff" });
           return res.end(html);
         }
-        return send(res, e.status, { error: e.message });
+        return send(res, e.status, { error: refusalWords(e.status) });
       }
       log(`500 ${String(e?.message || e)}`);
       if (!alreadyFiled(e)) journal(500, e?.message ?? String(e), identity?.email);

package/driver/publish/attr.mjs

@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+// attr.mjs — a value placed inside a quoted HTML attribute, and a URL placed inside an href.
+//
+// Every renderer here has its own `esc`, and each escapes `&`, `<` and `>` — which is right for text and
+// wrong inside an attribute: a `"` in the value closes the attribute and whatever follows is markup. So a
+// value that sits between quotes goes through `attrValue`, which also encodes both quote characters.
+//
+// An href needs one more guard, because a correctly escaped `javascript:` URL is still a link that runs
+// code when clicked, and the same for `data:` and `vbscript:`. So an href is built by `hrefAttr` or not at
+// all: http(s) only — or, when the caller says so, a reference with no scheme (the audit download is a file
+// beside the report). A browser drops tabs, newlines and other control characters from a URL before it
+// reads the scheme, so the scheme is read with those removed: `java` + newline + `script:` is `javascript:`.
+
+// Every C0 control character, space and DEL — what a URL parser strips or ignores before the scheme.
+const IGNORED_BEFORE_SCHEME = /[\x00-\x20\x7f]/g;
+
+/** A value safe between the quotes of an HTML attribute: & < > " and ' all encoded. PURE. */
+export const attrValue = (s) => String(s ?? "")
+  .replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")
+  .replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+
+/**
+ * An href value, attribute-safe, or null when it must not be a link — the caller then renders its text
+ * with no anchor. `relative: true` also admits a reference with no scheme, never a protocol-relative one
+ * (`//host/…` is an external address by another spelling). PURE.
+ */
+export function hrefAttr(u, { relative = false } = {}) {
+  const s = String(u ?? "").trim();
+  if (!s) return null;
+  const probe = s.replace(IGNORED_BEFORE_SCHEME, "");
+  const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(probe)?.[1];
+  if (scheme) { if (!/^https?$/i.test(scheme)) return null; }
+  else if (!relative || probe.startsWith("//") || probe.startsWith("\\\\")) return null;
+  return attrValue(s);
+}