clearotron 0.3.2-beta.11 → 0.3.2-beta.12

package/.env.example

@@ -578,7 +578,7 @@ TRADEMARK_MCP_KEY_SOCKET=
 # names, read by code that ships.
 
 # WHO the chat notice is addressed to: a JSON object of requester email or handle → number, e.g.
-# {"lisa@tenant.example":"+41...","jordan":"+41..."}. Before this, the notice went to a map keyed by
+# {"robin@tenant.example":"+41...","jordan":"+41..."}. Before this, the notice went to a map keyed by
 # AGENT id, and every user of a deployment shares one agent — so the operator was notified about work
 # other people ordered and the requester was told nothing.
 #

package/bin/clearotron.mjs

@@ -24,6 +24,7 @@ import { constants as SIG } from "node:os";
 import { isEntrypoint } from "../shared/is-entrypoint.mjs";
 import { nodeFloorVerdict, nodeFloorRefusal } from "../shared/node-floor.mjs";   // — one floor, read from package.json
 import { invocationPrefix } from "../shared/invocation.mjs";   // — print a command the reader can type
+import { watchParent } from "../shared/parent-watch.mjs";
 
 export const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -229,6 +230,19 @@ const [verb, ...rest] = process.argv.slice(2);
     };
     process.on(sig, forward);
   }
+
+  // ── AND THE DEMO STOPS WHEN WHATEVER STARTED IT IS GONE ─────────────────────────────────────────────
+  //
+  // The forwarding above covers a signal sent to THIS pid. Through npx it is not this pid a reader holds:
+  // npm → `sh -c` → this launcher, and a TERM to npm dies at that `sh` (shared/parent-watch.mjs). This
+  // launcher is then reparented, and the demo runs on holding its three ports while the reader believes
+  // it stopped. So the demo takes its parent's death as a TERM, and stops everything it started.
+  //
+  // THE DEMO ONLY. A foreground `start` or a `run` outliving the shell that started it can be what the
+  // reader meant: `nohup clearotron start &` on a server they are about to log out of, or an hours-long
+  // clearance they will not babysit. The demo is a replay nobody leaves running on purpose, and its own
+  // banner already says it lasts only as long as the command that started it.
+  if (verb === "demo") watchParent(() => { try { child.kill("SIGTERM"); } catch { /* already gone */ } });
 }
 
 // RESOLVE BOTH SIDES THROUGH SYMLINKS. `npm install` puts a symlink at node_modules/.bin/clearotron, so

package/bin/connect.mjs

@@ -40,7 +40,7 @@ import { createInterface } from "node:readline/promises";
 import { requireInteractive } from "../shared/invocation.mjs";   // — a prompt with nobody to answer it
 import { stdin, stdout } from "node:process";
 import { readFileSync, writeFileSync, existsSync, copyFileSync, mkdirSync } from "node:fs";
-import { join, dirname } from "node:path";
+import { join, dirname, resolve } from "node:path";
 import { homedir, userInfo } from "node:os";
 import { fileURLToPath } from "node:url";
 import { execFileSync } from "node:child_process";
@@ -48,7 +48,11 @@ import { createServer } from "node:net";
 import { CONNECT_CLIENTS, WHERE_FLAG, clientById, leadRouteFor, plainStep, whatItNeeds } from "../shared/connect-clients.mjs";
 import { stdioConnectFor, STDIO_SHAPES } from "../shared/stdio-connect.mjs";
 import { isWsl, wslTarget } from "../shared/wsl.mjs";   // — and which distribution a row should start the server in
-import { defaultDenylistPath, clientDoorAddress, clientDoorPort, clientDoorState, enablePlan, applyEnablePlan, describeChange, recordConnectKey, CLIENT_DOOR_UNIT } from "../shared/client-door.mjs";
+import { defaultDenylistPath, clientDoorAddress, clientDoorPort, clientDoorState, enablePlan, applyEnablePlan, describeChange, recordConnectKey, CLIENT_DOOR_UNIT, demoTokenSecretPath, keyPurposeLine, demoConnectCommand } from "../shared/client-door.mjs";
+import { readRunning } from "../shared/running-start.mjs";
+import { readLocalCredential, passphraseResetCommand, INSTALL_CREDENTIAL_FILE } from "../driver/portal-local-auth.mjs";
+import { invocationPrefix } from "../shared/invocation.mjs";
+import { BRAND } from "../shared/brand.mjs";
 import { mintToken, tokenId, resolvePerson, loadGrants } from "../shared/scope.mjs";
 import { envFrom } from "../shared/env-aliases.mjs";
 import { atomicWrite } from "../driver/progress.mjs";
@@ -654,6 +658,59 @@ function printSteps(offer, key) {
   }
 }
 
+/**
+ * ── A RUNNING DEMO, NAMED BY ITS FOLDER (owner, 2026-09-19) ─────────────────────────────────────────
+ *
+ * The demo is how a newcomer meets the product, and the next thing they ask an assistant is to connect.
+ * The route that works is the demo's own client door with an account key, and reaching it took a key
+ * issued by hand and an address read out of the startup log. This does both: it finds the demo that is
+ * running from that folder, mints a key with the demo's own secret for the demo's one user, and prints
+ * the address and the key, and nothing else is changed. No unit is written and no setting touched: the
+ * demo's door is already open, and everything of the demo goes when it stops.
+ *
+ * The address route's steps are not printed. They are written for a door behind a sign-in service,
+ * reached over the web, and a demo's door is on this machine and takes the key instead.
+ */
+async function connectDemo({ base, dryRun, clientName = null, running = readRunning() } = {}) {
+  const at = resolve(base);
+  const prefix = invocationPrefix();
+  say("");
+  if (clientName) { say(`  ${clientName}`); say(""); }
+  const demo = running.find((r) => r.demo && resolve(String(r.base ?? "")) === at);
+  if (!demo) {
+    say(`  Not available here — no demo is running from ${at}.`);
+    say(`  What would change it: start it with \`${prefix}clearotron demo --base ${/\s/.test(at) ? `"${at}"` : at}\`, then run this again.`);
+    return 1;
+  }
+  if (!demo.ports?.client) {
+    say(`  Not available here — the demo running from ${at} has no client door open.`);
+    say("  What would change it: stop the demo and start it again; its output says why the door did not start.");
+    return 1;
+  }
+  const address = `http://${!demo.host || demo.host === "0.0.0.0" ? "127.0.0.1" : demo.host}:${demo.ports.client}/mcp`;
+  const credentialPath = join(at, INSTALL_CREDENTIAL_FILE);
+  let email = "demo@localhost";
+  try { email = readLocalCredential(credentialPath)?.email || email; } catch { /* the demo's own user stands */ }
+  if (dryRun) {
+    say("  (dry run — nothing was changed)");
+    say(`  Address:  ${address}`);
+    return 0;
+  }
+  let secret = "";
+  try { secret = readFileSync(demoTokenSecretPath(at), "utf8").trim(); } catch { /* said below */ }
+  if (!secret) {
+    say(`  Not available here — the demo running from ${at} keeps no key secret this command can read.`);
+    say("  What would change it: run this as the user who started the demo.");
+    return 1;
+  }
+  const key = withSecret(secret, () => mintToken({ scope: "account", sub: email, ttlSec: 90 * 24 * 3600 }));
+  say(`  ${keyPurposeLine({ email, brand: BRAND.name, reset: passphraseResetCommand({ prefix, credentialPath }) })}`);
+  say("");
+  say(`  Address:  ${address}`);
+  say(`  Key:      ${key}`);
+  return 0;
+}
+
 async function main() {
   const argv = process.argv.slice(2);
   // `--help` IS ANSWERED, not rejected. Running this bare drops the reader into a question, so "run it
@@ -674,6 +731,7 @@ async function main() {
     say("                      internet, with a key made for you now");
     say("    --list            the assistants this build knows");
     say("    --dry-run         say what would change, change nothing");
+    say("    --base <dir>      a running demo's folder: mint a key for its client door, and print both");
     say("    --allow-checkout-move");
     say("                      write this checkout's path even though services are running from");
     say("                      another one. Every unit's ExecStart follows that value, so the ones");
@@ -681,7 +739,7 @@ async function main() {
     say("");
     return 0;
   }
-  const known = new Set(["--client", "--where", "--list", "--dry-run", "--allow-checkout-move", "--help", "-h"]);
+  const known = new Set(["--client", "--where", "--list", "--dry-run", "--base", "--allow-checkout-move", "--help", "-h"]);
   const unknown = argv.filter((a) => a.startsWith("--") && !known.has(a));
   if (unknown.length) {
     console.error(`connect: unrecognised flag(s): ${unknown.join(", ")}`);
@@ -689,6 +747,13 @@ async function main() {
     process.exit(2);
   }
   const dryRun = argv.includes("--dry-run");
+  const b = argv.indexOf("--base");
+  if (b >= 0) {
+    const base = argv[b + 1];
+    if (!base || base.startsWith("--")) { console.error("connect: --base needs the demo's folder."); process.exit(2); }
+    const c = argv.indexOf("--client");
+    return await connectDemo({ base, dryRun, clientName: c >= 0 ? clientById(argv[c + 1])?.name ?? null : null });
+  }
   const w = argv.indexOf("--where");
   if (w >= 0 && !Object.hasOwn(WHERE_FLAG, argv[w + 1] ?? "")) {
     console.error(`connect: --where takes one of: ${Object.keys(WHERE_FLAG).join(", ")}`);

package/bin/key.mjs

@@ -28,9 +28,10 @@
 // question would be two answers, and the wrong one would be the one nobody read.
 import "../shared/env-local.mjs";   // side effect: apply the install's .env — FIRST, before anything reads process.env
 import { invocationPrefix } from "../shared/invocation.mjs";
+import { BRAND } from "../shared/brand.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { defaultGrantsPath, installPaths } from "./start.mjs";
-import { demoTokenSecretPath } from "../shared/client-door.mjs";
+import { demoTokenSecretPath, keyPurposeLine } from "../shared/client-door.mjs";
 import { resolvePerson } from "../shared/scope.mjs";   // the door's own reading of the guest list, so one answer serves both
 import { mintFromOptions } from "../mcp-server/mint-token.mjs";
 
@@ -96,6 +97,10 @@ try {
   die(e.message);
 }
 
+// WHAT THIS KEY IS FOR, FIRST, in the owner's words (2026-09-19): a person who found this verb before the
+// passphrase minted a key and could not sign in to the portal with it. Standard error, as every line here
+// is, so the token stays alone on standard output.
+console.error(keyPurposeLine({ email, brand: BRAND.name, reset: `${p}clearotron passphrase --reset` }));
 for (const line of minted.notes) console.error(line);
 
 // — found in review. A KEY FOR AN IDENTITY ON NO LIST IS A KEY THAT 403s. This command

package/bin/onboard.mjs

@@ -2818,6 +2818,9 @@ export async function runCheck() {
       info(`the units are installed but their environment could not be read (${unitEnv?.why ?? "no reason given"}) — `
         + "the door verdicts below are withheld rather than guessed, because a failure to look is not a finding");
     if (door.shape === "local") {
+      // WHO THAT ONE USER IS, in the owner's words (2026-09-19), resolved as `start` resolves it.
+      const oneUser = String(effectiveForService("PORTAL_LOCAL_USER")?.v || `${userInfo().username}@localhost`).trim().toLowerCase();
+      say(`  · Portal sign-in: one user, ${oneUser}, by passphrase.`);
       say(`  · local passphrase door (${typed}) — one operator, one passphrase, no identity provider`);
       info(`a lost passphrase is recoverable: ${invocationPrefix()}clearotron passphrase --reset`);
     } else if (door.shape === "fronted") {
@@ -3194,7 +3197,10 @@ export async function runCheck() {
         try { const s = statSync(p); if (s.size > 0) { wrote = p; break; } } catch { /* not this one */ }
       }
       if (wrote) {
-        ok(`the client door's access log is being written: ${wrote}`);
+        // WHAT WAS READ, AND NOTHING MORE. This said "is being written" from any non-empty file — a claim
+        // about activity made from a file's size, printed over a log whose only line was a test's
+        // (measured 2026-09-19). Reworded as the owner ruled, 2026-09-19.
+        ok(`the client door's access log has entries: ${wrote}`);
       } else {
         // NOT-YET-WRITTEN IS NOT UNWRITABLE. A door nobody has called through has no log, and saying it
         // is broken would be the same lie as calling an unreachable unit inactive.

package/bin/passphrase.mjs

@@ -32,6 +32,7 @@ import { defaultInstallBase, establishCredential, installCredential, readLocalCr
 // rather than hardcoded. A hardcoded `npx ` tells a global installer their install is somehow lesser;
 // a hardcoded bare name sends an npx reader to `command not found`.
 import { invocationPrefix } from "../shared/invocation.mjs";
+import { BRAND } from "../shared/brand.mjs";
 
 const P = invocationPrefix();
 const USAGE = `  ${P}clearotron passphrase — report or reset the portal's local sign-in
@@ -117,8 +118,9 @@ catch (e) {
   process.exit(1);
 }
 
-console.log(`\n  A NEW passphrase has been minted for ${email}.`);
-console.log(`  The previous one no longer works.\n`);
+// THE OWNER'S WORDS, 2026-09-19: what the value is for comes before it, and names the one user it signs in.
+console.log(`\n  New passphrase for this ${BRAND.name}'s one user, ${email}. Paste it on the portal's sign-in page:\n`);
 console.log(`  PASSPHRASE: ${minted.passphrase}\n`);
+console.log(`  The previous one no longer works.`);
 console.log(`  Write it down now. It is stored only as a digest, so this line is the only copy that will`);
 console.log(`  ever exist — re-run this command if you lose it.\n`);

package/bin/start.mjs

@@ -121,7 +121,7 @@ import { SERVER_INSTALL_SET, unitsToRestartOnRefresh, unitHealthVerdict } from "
 // — the door --background now INSTALLS, and the one authority for the settings
 // it refuses to start without. (Until 2026-09-03 this import read "the one unit --background may
 // tolerate and never manage"; settled point 2 superseded that.)
-import { defaultDenylistPath, denylistPathFor, denylistFor, ensureDenylistFile, CLIENT_DOOR_UNIT, enablePlan, clientDoorPort, demoTokenSecret, demoTokenSecretPath, keyIssueCommand } from "../shared/client-door.mjs";   // — one owner for the revocation list's path
+import { defaultDenylistPath, denylistPathFor, denylistFor, ensureDenylistFile, CLIENT_DOOR_UNIT, enablePlan, clientDoorPort, demoTokenSecret, demoTokenSecretPath, keyIssueCommand, demoConnectCommand } from "../shared/client-door.mjs";   // — one owner for the revocation list's path
 import { createServer } from "node:net";
 import { listenErrorMessage, nextFreePort } from "../shared/listen.mjs";
 import { chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
@@ -805,6 +805,10 @@ export function childEnv({ ports, paths, user, portalSecret, tokenSecret, opsTok
       // DNS-rebinding protection is keyed off this list being non-empty, so it is derived from the same
       // port the listener is given rather than left to whoever remembers.
       TRADEMARK_MCP_ALLOWED_HOSTS: `${host}:${ports.mcp},localhost:${ports.mcp}`,
+      // WHERE THE OTHER DOOR IS, so a key refused here is told where it belongs (shared/scope.mjs
+      // otherDoor). Read by nothing else in this process.
+      CLIENT_MCP_HTTP_HOST: host,
+      CLIENT_MCP_HTTP_PORT: String(ports.client),
     },
     // The worker needs the install's PATHS and nothing else — no ports, no secrets, no door config. It
     // talks to the queue and the pool, not to either listener.
@@ -830,6 +834,9 @@ export function childEnv({ ports, paths, user, portalSecret, tokenSecret, opsTok
       // written in one place and an allow-list in another drift into a door that starts and turns every
       // request away, which reads as a dead door rather than as a misconfiguration.
       CLIENT_MCP_ALLOWED_HOSTS: `${host}:${ports.client},localhost:${ports.client}`,
+      // The staff door's place, for the mirror refusal (shared/scope.mjs otherDoor). Read by nothing else here.
+      TRADEMARK_MCP_HTTP_HOST: host,
+      TRADEMARK_MCP_HTTP_PORT: String(ports.mcp),
       CLIENT_MCP_ACCOUNT_ACCESS: String(clientFence ?? "1"),
       // TOKEN-ONLY, AND WITHOUT IT THE DOOR DOES NOT START. Found by driving it rather than by reading
       // the diff: with this unset the door demands an OIDC audience plus a Cloudflare Access team or
@@ -2421,7 +2428,8 @@ if (isMain) {
   // The output used to name neither as a door, so an owner watching one of them start concluded MCP had
   // not come up. Both are printed with who each is for, because "MCP is running" is ambiguous on a box
   // that has two of them and the ambiguity is what cost the leg.
-  say(`  Engine door  http://${HOST}:${ports.mcp}/mcp   — the portal's Start button calls this. Staff.`);
+  // THE CLIENT DOOR LEADS (owner, 2026-09-19). It is the one an assistant uses, and with the engine door
+  // printed first a demo's reader handed the staff address to their assistant, which refused its key.
   // THE SYNCHRONOUS TRUTH, NOT THE ASYNC FLAG ( — F26, review finding).
   //
   // `rec.alive` is flipped by the child's exit handler, which is async: reading it here asks "has the
@@ -2440,11 +2448,12 @@ if (isMain) {
     if (adoptedClientDoor)
       say(`               Already running as ${CLIENT_DOOR_UNIT}; this start kept it, so existing keys still work.`);
     else
-      say(`               It refuses every caller until a key is issued: ${keyIssueCommand({ prefix: invocationPrefix(), demo: DEMO, user, base: paths.base, defaultBase: join(homedir(), "trademark") })}`);
+      say(`               It refuses every caller until a key is issued: ${DEMO ? demoConnectCommand({ prefix: invocationPrefix(), base: paths.base }) : keyIssueCommand({ prefix: invocationPrefix(), demo: DEMO, user, base: paths.base, defaultBase: join(homedir(), "trademark") })}`);
   } else {
     say(`  Client door  NOT RUNNING on ${HOST}:${ports.client} — its output above says why. The portal and`);
     say("               the engine door are unaffected; a client assistant cannot connect until it is up.");
   }
+  say(`  Engine door  http://${HOST}:${ports.mcp}/mcp   — the portal's Start button calls this. Staff.`);
   say("");
   // ── WHAT `status` AND `stop` READ ABOUT THIS START ───────────────────────────────────────────────
   //

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "aa58558b3b09fbf5b1c83010291d340167d438d8",
-  "version": "0.3.2-beta.11"
+  "commit": "92dc979bd176adeedc0dbe2518fbf24388bc6072",
+  "version": "0.3.2-beta.12"
 }

package/driver/CHANGELOG.md

@@ -1,5 +1,21 @@
 # clearotron-driver
 
+## 0.3.2-beta.12
+
+### Patch Changes
+
+- Fixed: A demo started in the background with `npx` now stops completely when that `npx` is stopped, freeing its three ports and removing its folder.
+- Fixed: The demo lists the door an assistant uses first, and a key refused at the wrong door is told the right door's address.
+- Fixed: A knockout no longer asks the model what to do with each name, so each name's read keeps to the findings and the rating.
+- Fixed: A knockout's per-name read no longer carries a next-step section the model wrote. It is removed before delivery instead of the batch being sent back to rewrite it, so knockouts finish sooner.
+- Fixed: A report produced before this version no longer shows a second section menu inside the portal, unreadable in the dark theme.
+- New: `clearotron connect --base <folder>` connects an assistant to a running demo, minting its key and naming its door in one step.
+- Fixed: `doctor` now says the client door's access log has entries, instead of claiming it is being written.
+- Fixed: The sign-in page names the install's one user, and the passphrase reset, key issue and doctor each say what they are for.
+- Fixed: Once the client's own registered element is set aside, searches added later in the run no longer search it again.
+- Fixed: Running the test suite on a clone whose portal build is out of date no longer rebuilds it and fails the first run.
+- Fixed: Running the test suite no longer writes an access-log line under your home folder, and a stopped demo leaves no empty folders behind.
+
 ## 0.3.2-beta.11
 
 ### Patch Changes

package/driver/contract-vocabulary.mjs

@@ -21,7 +21,7 @@
 //   D4 verify.mjs  parseCoverageLedgerJson, same shape
 //   D5 verify.mjs:1504  fail(`${unaccounted[0].token}:…`)    — token minted in a DATA ROW
 //   D6 verify.mjs:1567  fail(`${violations[0].token}…`)      — validatePlanFeasibility in register-plan.mjs
-//   D7 verify.mjs:1558  fail(`${v2[0].token}${detail}…`)     — register-plan.mjs:2183 disclosureTextByAxis
+//   D7 verify.mjs:1558  fail(`${v2[0].token}${detail}…`)     — register-plan.mjs:2270 disclosureTextByAxis
 //   D8 verify.mjs:2470 caseLawLedgerFail  fail(caseLawLedgerFail(…))  — token built in case-law-ledger.mjs:195 caseLawLedgerFail
 //
 // A partition built on the 60 tokens a regex CAN see would run green while blind to the rest, which is
@@ -139,10 +139,10 @@ export const VOCABULARY = [
   { token: "coverage_form_missing", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_form_empty", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_status_offenum", stages: ["register-digest"], site: "driver/verify.mjs:2050" },
-  { token: "coverage_deferred_unaccounted", stages: ["register-digest"], site: "driver/verify.mjs coverageFormFail", family: "driver/register-plan.mjs:1860 PROVIDER_HARD_ERROR_PREFIX — token on a data row", dynamic: "D5" },
-  { token: "coverage_clean_unexecuted", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1594 validatePlanFeasibility", dynamic: "D6" },
-  { token: "coverage_clean_skipped", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1955 searchedJurisdictionsFromPlan", dynamic: "D6" },
-  { token: "coverage_clean_unverified_incomplete", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:2183 disclosureTextByAxis", dynamic: "D7" },
+  { token: "coverage_deferred_unaccounted", stages: ["register-digest"], site: "driver/verify.mjs coverageFormFail", family: "driver/register-plan.mjs:1947 PROVIDER_HARD_ERROR_PREFIX — token on a data row", dynamic: "D5" },
+  { token: "coverage_clean_unexecuted", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1681 validatePlanFeasibility", dynamic: "D6" },
+  { token: "coverage_clean_skipped", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:2042 searchedJurisdictionsFromPlan", dynamic: "D6" },
+  { token: "coverage_clean_unverified_incomplete", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:2270 disclosureTextByAxis", dynamic: "D7" },
   { token: "coverage_clean_tainted", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_ledger_", stages: ["register-digest"], site: "driver/verify.mjs", family: "driver/coverage-ledger.mjs (parseCoverageLedgerJson token-first throws)", dynamic: "D4" },
   { token: "coverage_key_unknown", stages: ["register-digest"], site: "driver/verify.mjs", family: "driver/coverage-ledger.mjs", dynamic: "D4" },

package/driver/engine/mcp/recording-server.mjs

@@ -1132,7 +1132,7 @@ serve({
               factors: { type: "array", minItems: 2, maxItems: 4, items: { type: "string" }, description: "2–4 one-line load-bearing observations behind the band." },
               counterFactors: { type: "array", minItems: 1, maxItems: 3, items: { type: "string" }, description: "1–3 one-line statements of what holds this name at this band rather than the next, either way." },
               mitigation: { type: "string", description: "May be \"\" when nothing would move the band — but SEND THE KEY, so a considered \"none\" is not confusable with an omission." },
-              assessment: { type: "string", description: "The opening paragraph a reader of THIS MARK'S own report sees first: what the name is, what the landscape looks like, what drives the rating, what to do with it." },
+              assessment: { type: "string", description: "The opening paragraph a reader of THIS MARK'S own report sees first: what the name is, what the landscape looks like, what drives the rating." },
               contextFraming: { type: "string" },
               registerEstimate: { type: "string" },
               parodyNote: { type: ["string", "null"] },

package/driver/engine/mcp/supplemental.mjs

@@ -30,7 +30,7 @@
 import { readFileSync, writeFileSync, renameSync, existsSync, mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { driverDir } from "../../../shared/driver-dir.mjs";   //
-import { PLAN_PREDICATES, PLAN_MAX_OR_WIDTH, PLAN_MAX_NAME_LENGTH, fingerprint, ownerIntersectionGap, resolveRegions } from "../../register-plan.mjs";
+import { PLAN_PREDICATES, PLAN_MAX_OR_WIDTH, PLAN_MAX_NAME_LENGTH, fingerprint, ownerIntersectionGap, resolveRegions, houseElementOf, withoutHouseElementTerms } from "../../register-plan.mjs";
 import { entryTermIssues } from "../../../providers/_shared/term-shape.mjs";
 import { isNonLatinTerm, romanizationRefusal, romanizationSpellings, nativeScriptIndexGap } from "../../../providers/_shared/script-form.mjs";
 
@@ -289,9 +289,10 @@ export async function proposeSupplemental(params, tctx, deps) {
   // execute-plan kernel hands it to the provider's buildEntryQuery, which backfills only entries that
   // declare none (makeRegionRequiredBuildEntryQuery). A proposal that DOES declare regions is
   // untouched, qid fingerprints are unchanged, and providers that do not require regions ignore it.
-  let planRegions = [], planClasses = [];
+  let planRegions = [], planClasses = [], house = null;
   try {
     const frozen = JSON.parse(readFileSync(driverDir(dirname(dirname(outPath)), "register-plan.json"), "utf8"));
+    house = houseElementOf(frozen);
     planRegions = (Array.isArray(frozen?.regions) ? frozen.regions : []).map((r) => String(r).trim()).filter(Boolean);
     // C3 — the frozen plan's own class list is the priority set: proposals intersecting it compete
     // for the per-call/per-axis caps first (mintSupplementalEntries stable-sorts; values unchanged).
@@ -307,8 +308,24 @@ export async function proposeSupplemental(params, tctx, deps) {
   }
   const perCall = 12;   // step 3 — was a knob; no environment ever set it
   const axisMax = 24;   // step 3 — was a knob; no environment ever set it
+  // ── THE CLIENT'S OWN ELEMENT IS LEFT OUT BEFORE ANYTHING RUNS ───────────────────────────────────
+  //
+  // This tool EXECUTES what it mints, before the fold adds it to the plan, so the fold's own exclusion
+  // (`houseElementOf` in register-plan.mjs) comes too late here: the query would already have run. On
+  // the first live run that proposed an exclusion, this session proposed an exact search on the bare
+  // house element the compile had set aside. The same rule is applied here, before the mint. Not a
+  // rejection: rejected[] becomes an OPEN ask on the report, and the element is not an open question.
+  const excludedHouse = [];
+  const offered = [];
+  for (const p of proposals) {
+    const kept = house ? withoutHouseElementTerms({ ...(p ?? {}), predicate: String(p?.predicate ?? "default") }, house) : p;
+    if (!kept) { excludedHouse.push(String(p?.term ?? p?.terms?.[0] ?? "")); continue; }
+    offered.push(kept === p || !Array.isArray(kept.terms) ? p : { ...p, terms: kept.terms });
+  }
+  if (!offered.length)
+    return { type: "text", text: JSON.stringify({ minted: [], reused: [], rejected: [], excluded_house_element: excludedHouse, executed: false }, null, 2) };
   const existingQids = new Set(supp.entries.map((e) => e.qid));
-  const { minted, reused, rejected, enriched, narrowed } = mintSupplementalEntries(axis, proposals,
+  const { minted, reused, rejected, enriched, narrowed } = mintSupplementalEntries(axis, offered,
     { existingQids, perCall, axisMax, existingCount: supp.entries.length, capabilities: deps.capabilities ?? null, priorityClasses: planClasses });
 
   // Field-level romanisation enrichment of a REUSED qid (2026-07-30 review round): the natural retry —
@@ -373,7 +390,7 @@ export async function proposeSupplemental(params, tctx, deps) {
     const r = await executePlan({ plan_path: suppPath, axis, output_path: outPath, qids }, tctx);
     const text = r && typeof r === "object" ? (r.text ?? "") : String(r ?? "");
     if (!text || text.startsWith("ERROR")) {
-      return { type: "text", text: JSON.stringify({ minted: minted.map((e) => e.qid), reused, ...(enrichedQids.length ? { enriched: enrichedQids } : {}), ...(conflicts.length ? { conflict: conflicts } : {}), rejected, ...(narrowed.length ? { narrowed } : {}), executed: false, error: text.slice(0, 300) || "executor returned nothing" }, null, 2) };
+      return { type: "text", text: JSON.stringify({ minted: minted.map((e) => e.qid), reused, ...(enrichedQids.length ? { enriched: enrichedQids } : {}), ...(conflicts.length ? { conflict: conflicts } : {}), rejected, ...(excludedHouse.length ? { excluded_house_element: excludedHouse } : {}), ...(narrowed.length ? { narrowed } : {}), executed: false, error: text.slice(0, 300) || "executor returned nothing" }, null, 2) };
     }
     try { summary = JSON.parse(text); } catch { summary = { raw: text.slice(0, 300) }; }
   }
@@ -398,5 +415,5 @@ export async function proposeSupplemental(params, tctx, deps) {
     }
   } catch { /* band unreadable — the executor summary still crosses */ }
 
-  return { type: "text", text: JSON.stringify({ minted: minted.map((e) => e.qid), reused, ...(enrichedQids.length ? { enriched: enrichedQids } : {}), ...(conflicts.length ? { conflict: conflicts } : {}), rejected, ...(narrowed.length ? { narrowed } : {}), executed: qids.length > 0, summary, results }, null, 2) };
+  return { type: "text", text: JSON.stringify({ minted: minted.map((e) => e.qid), reused, ...(enrichedQids.length ? { enriched: enrichedQids } : {}), ...(conflicts.length ? { conflict: conflicts } : {}), rejected, ...(excludedHouse.length ? { excluded_house_element: excludedHouse } : {}), ...(narrowed.length ? { narrowed } : {}), executed: qids.length > 0, summary, results }, null, 2) };
 }

package/driver/knockout-next-step.mjs

@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+// knockout-next-step.mjs — a next-step section the assessing model wrote into a name's read comes off
+// before the report is published.
+//
+// A knockout states findings and a rating; what to do with the name is the reading lawyer's. The assessing
+// instructions stopped asking for a next step, and the model still writes one now and then, under a heading
+// of its own: "What to do with it", "Practical next step". Refusing the turn and re-asking cost a full
+// re-dispatch each time, and the owner ruled for delivery over the loop (2026-09-19). So the section is
+// removed here, in code, with no model call, and the run record names every heading removed.
+//
+// WHAT COMES OFF: a heading whose own words are a next step, and the section under it — nothing else. A
+// hashed heading's section runs to the next heading at its level or above; a line that is only bold text
+// runs to the next heading of either kind; a bold label opening a paragraph ("**Practical next step** —
+// …") takes that paragraph. Position does not matter: removing a section cannot reorder what is left.
+//
+// WHAT STAYS, BY DESIGN: the same advice written as an ordinary sentence with no heading over it. Nothing
+// bounds that sentence but judgement, and cutting a guess out of the client's read is worse than leaving
+// it. The instruction not to write one is the only thing that reaches it.
+
+// A heading's own words that make it a next step. Whole-heading: "What drives the rating" and "What is
+// still open" are not next steps, and a word appearing somewhere inside a heading proves nothing.
+export const NEXT_STEP_HEADING_RE =
+  /^(?:(?:practical|immediate|suggested|recommended|possible)\s+)?(?:next\s+steps?\b.*|what\s+to\s+do\b.*|what\s+happens\s+next|recommendations?\b.*|our\s+recommendations?\b.*|(?:the\s+)?way\s+forward)$/i;
+
+const label = (s) => String(s).replace(/[*_`]/g, "").replace(/[\s:.–—-]+$/, "").trim();
+
+/** What kind of heading this line is, and its words — or null for a line that heads nothing. PURE. */
+function headingAt(line) {
+  const atx = /^\s{0,3}(#{1,6})\s+(.*?)\s*#*\s*$/.exec(line);
+  if (atx) return { kind: "atx", level: atx[1].length, text: label(atx[2]) };
+  const bold = /^\s*(\*\*|__)(.+?)\1\s*:?\s*$/.exec(line);
+  if (bold) return { kind: "bold", text: label(bold[2]) };
+  const lead = /^\s*(\*\*|__)(.+?)\1\s*[:.–—-]?\s+\S/.exec(line);
+  if (lead) return { kind: "lead", text: label(lead[2]) };
+  return null;
+}
+
+/** Is this whole line a heading over a next step? PURE. */
+export function isNextStepHeading(line) {
+  const h = headingAt(String(line ?? ""));
+  return Boolean(h && NEXT_STEP_HEADING_RE.test(h.text));
+}
+
+/**
+ * The text with every next-step section removed, and what was removed: `{ text, removed: [{ heading,
+ * chars }] }`. Text with nothing to remove comes back byte-identical. PURE.
+ */
+export function stripNextStepSections(text) {
+  const src = String(text ?? "");
+  const lines = src.split("\n");
+  const keep = [];
+  const removed = [];
+  for (let i = 0; i < lines.length;) {
+    const h = headingAt(lines[i]);
+    if (!h || !NEXT_STEP_HEADING_RE.test(h.text)) { keep.push(lines[i]); i++; continue; }
+    let j = i + 1;
+    if (h.kind === "lead") {
+      while (j < lines.length && lines[j].trim() !== "") j++;
+    } else {
+      for (; j < lines.length; j++) {
+        const n = headingAt(lines[j]);
+        if (!n || n.kind === "lead") continue;
+        if (h.kind === "atx" ? n.kind === "atx" && n.level <= h.level : true) break;
+      }
+    }
+    removed.push({ heading: h.text, chars: lines.slice(i, j).join("\n").trim().length });
+    i = j;
+  }
+  if (!removed.length) return { text: src, removed };
+  return { text: keep.join("\n").replace(/\n[ \t]*\n(?:[ \t]*\n)+/g, "\n\n").trim(), removed };
+}

package/driver/named-band.mjs

@@ -137,7 +137,7 @@ export function parseNamedBand(raw) {
         // byte-identical to a slice the plan deliberately counted without fetching. Measured on a real
         // run: four capability-gap blocks carried `error:true, deferred:true` into this function and
         // reached record-carry.json with both fields gone and a sentence claiming the run "has a hit
-        // COUNT for this slice". register-plan.mjs:1594 validatePlanFeasibility already enforces the same rule one layer up
+        // COUNT for this slice". register-plan.mjs:1681 validatePlanFeasibility already enforces the same rule one layer up
         // ("a transient must not ship indistinguishable from a sanctioned descriptor") — it reads the
         // RAW blocks, which is why it could. Every consumer that reads THIS projection could not.
         // Conditional like the four keys above, so old bands carry neither key and nothing shifts.

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.2-beta.11",
+  "version": "0.3.2-beta.12",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline-knockout.mjs

@@ -56,6 +56,7 @@ import { registerUnavailableOffices } from "./register-unreachable.mjs";
 import { runRecordLogPath } from "../providers/_shared/ledger-path.mjs";   // — this run's record log
 import { validators as koValidators, validateMergedFindings, worstBand, registerSurfacedFilings, raterCaveats, SURVIVOR_BOUNDARY_RE } from "./verify-knockout.mjs";
 import { reviewAbout, reviewEvidence, reviewEvidenceLines, applyKnockoutReview, knockoutReviewFile } from "./knockout-review-record.mjs";
+import { stripNextStepSections } from "./knockout-next-step.mjs";
 import { publishKnockout, composeKnockoutEmail } from "./publish/knockout.mjs";
 import { writeRunStatus, rollupStatus, atomicWrite, identitySeed } from "./progress.mjs";   // — the identity seed is shared; the stepper is not
 import { batchMarkName } from "./mark-name.mjs";
@@ -349,6 +350,28 @@ export function survivorBoundaryNote(policy) {
   return `This is ${screenName}, not a clearance. A mark not knocked out here is not clear — it is not knocked out at this screen's depth, and proceeds to clearance. Nothing above is a finding of availability.`;
 }
 
+// ── a next-step section the model wrote comes off, in code ──────────────────────────────────────────
+//
+// Each name's read is published as its own report, and the screen states findings and a rating — what to
+// do with the name is the reading lawyer's. A heading the model wrote over a next step, and the section
+// under it, are removed here and named in the run record; `knockout-next-step.mjs` says what counts. This
+// replaced a pre-delivery refusal that re-asked the whole chunk for the same edit (owner, 2026-09-19).
+// EXPORTED so the record line is driven directly, not only through a whole pipeline.
+export function removeNextStepSections(runDir, marks) {
+  const out = [];
+  for (const m of marks ?? []) {
+    if (typeof m?.assessment !== "string") continue;
+    const { text, removed } = stripNextStepSections(m.assessment);
+    if (!removed.length) continue;
+    m.assessment = text;
+    const row = { event: "knockout-next-step-removed", mark: m.name, headings: removed.map((r) => r.heading),
+      chars: removed.reduce((n, r) => n + r.chars, 0), lane: "knockout" };
+    runLog(runDir, row);
+    out.push(row);
+  }
+  return out;
+}
+
 // ── — the knockout lane's recovery park ───────────────────────────────────────
 //
 // EXPORTED so it can be armed directly. The clearance lane's equivalent is inline in a 6,000-line catch
@@ -964,6 +987,9 @@ export async function knockoutInner(ctx, job, opts = {}) {
     // it runs BEFORE the artifact is written, not after. The counts are logged because a receipts pass
     // over zero citations is a different fact from a receipts pass, and only the count can tell them
     // apart afterwards.
+    // BEFORE THE GATE AND THE WRITE, so the record on disk is the record that ships, and the reviewing
+    // pass never addresses a line inside a section that is about to go.
+    removeNextStepSections(run.runDir, merged.marks);
     const mv = validateMergedFindings(run.runDir, merged, plan);
     if (!mv.ok) throw new StageFailure("knockout-assess", `merged findings failed the lint: ${mv.failures.join("; ")}`, null);
     runLog(run.runDir, { event: "knockout-receipts", ...mv.receipts });

package/driver/portal-report.mjs

@@ -122,6 +122,13 @@ const CHROME_RES = [
   // has stopped matching. Removing the wrapper first would take the nav with it, drive the count to
   // zero, and turn a security assertion into a permanent false alarm.
   { tag: "div", open: /<div class="[^"]*\brep-stickyhead\b[^"]*"[^>]*>/ },
+  // THE SECTION MENU, WHEREVER THE RENDERER PUT IT. A report rendered today carries it inside the header
+  // above, and it goes with that. A report rendered before 2026-09-18 carries it just AFTER the header, so
+  // stripping the header alone left it in the frame: a second copy of the menu the portal draws, pinned
+  // over the report's title band, its current item red on red in the dark theme. Measured on an archived
+  // global preliminary report served by a published beta. Archived reports are served from their baked
+  // bytes, so this has to happen here rather than in the renderer. `sectionsOf` has already read it.
+  { tag: "nav", open: /<nav class="[^"]*\bstrip\b[^"]*"[^>]*>/ },
   // the "Internal review copy — stripped on export" bar, which hosted the quality-capture controls
   { tag: "div", open: /<div class="[^"]*\breview\b[^"]*\binternal\b[^"]*"[^>]*>/ },
   // per-finding flag buttons and their popovers
@@ -529,7 +536,7 @@ const EMBED_JS = `
   function schedule(){
     if(queued)return;
     queued=true;
-    requestAnimationFrame(function(){queued=false;post();});
+    requestAnimationFrame(function(){queued=false;post();sections();});
   }
   // WHICH CONTROLS THIS DOCUMENT ACTUALLY HAS.
   //
@@ -559,12 +566,24 @@ const EMBED_JS = `
   // script) and the shell draws it in its own header. Only the ids that are really in the document are
   // announced: a report whose renderer named a section it did not draw would otherwise offer the reader
   // a breadcrumb entry that jumps nowhere.
+  //
+  // AND WHERE EACH ONE STARTS, so the shell can show how far the reader has got (owner, 2026-09-19): every
+  // section reached so far is marked, the rest are not. The page scrolls, not this frame, so only the shell
+  // knows where the reader is. It needs each section's top in this document to compare. Said again whenever
+  // the layout moves: a panel opening pushes every section below it down.
+  var saidSections='';
   function sections(){
     try{
       var list=window.__CORD_SECTIONS;
       if(!list||!list.length)return;
       var live=[];
-      for(var i=0;i<list.length;i++) if(document.getElementById(list[i].id)) live.push(list[i]);
+      for(var i=0;i<list.length;i++){
+        var el=document.getElementById(list[i].id);
+        if(el) live.push({id:list[i].id,label:list[i].label,top:Math.max(0,Math.round(el.getBoundingClientRect().top+window.scrollY))});
+      }
+      var said=JSON.stringify(live);
+      if(said===saidSections)return;
+      saidSections=said;
       parent.postMessage({source:TAG,type:'sections',sections:live},'*');
     }catch(e){}
   }