clearotron 0.3.2-beta.11 → 0.3.2-beta.13

package/driver/engine/mcp/supplemental.mjs

@@ -30,7 +30,7 @@
 import { readFileSync, writeFileSync, renameSync, existsSync, mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { driverDir } from "../../../shared/driver-dir.mjs";   //
-import { PLAN_PREDICATES, PLAN_MAX_OR_WIDTH, PLAN_MAX_NAME_LENGTH, fingerprint, ownerIntersectionGap, resolveRegions } from "../../register-plan.mjs";
+import { PLAN_PREDICATES, PLAN_MAX_OR_WIDTH, PLAN_MAX_NAME_LENGTH, fingerprint, ownerIntersectionGap, resolveRegions, houseElementOf, withoutHouseElementTerms } from "../../register-plan.mjs";
 import { entryTermIssues } from "../../../providers/_shared/term-shape.mjs";
 import { isNonLatinTerm, romanizationRefusal, romanizationSpellings, nativeScriptIndexGap } from "../../../providers/_shared/script-form.mjs";
 
@@ -289,9 +289,10 @@ export async function proposeSupplemental(params, tctx, deps) {
   // execute-plan kernel hands it to the provider's buildEntryQuery, which backfills only entries that
   // declare none (makeRegionRequiredBuildEntryQuery). A proposal that DOES declare regions is
   // untouched, qid fingerprints are unchanged, and providers that do not require regions ignore it.
-  let planRegions = [], planClasses = [];
+  let planRegions = [], planClasses = [], house = null;
   try {
     const frozen = JSON.parse(readFileSync(driverDir(dirname(dirname(outPath)), "register-plan.json"), "utf8"));
+    house = houseElementOf(frozen);
     planRegions = (Array.isArray(frozen?.regions) ? frozen.regions : []).map((r) => String(r).trim()).filter(Boolean);
     // C3 — the frozen plan's own class list is the priority set: proposals intersecting it compete
     // for the per-call/per-axis caps first (mintSupplementalEntries stable-sorts; values unchanged).
@@ -307,8 +308,24 @@ export async function proposeSupplemental(params, tctx, deps) {
   }
   const perCall = 12;   // step 3 — was a knob; no environment ever set it
   const axisMax = 24;   // step 3 — was a knob; no environment ever set it
+  // ── THE CLIENT'S OWN ELEMENT IS LEFT OUT BEFORE ANYTHING RUNS ───────────────────────────────────
+  //
+  // This tool EXECUTES what it mints, before the fold adds it to the plan, so the fold's own exclusion
+  // (`houseElementOf` in register-plan.mjs) comes too late here: the query would already have run. On
+  // the first live run that proposed an exclusion, this session proposed an exact search on the bare
+  // house element the compile had set aside. The same rule is applied here, before the mint. Not a
+  // rejection: rejected[] becomes an OPEN ask on the report, and the element is not an open question.
+  const excludedHouse = [];
+  const offered = [];
+  for (const p of proposals) {
+    const kept = house ? withoutHouseElementTerms({ ...(p ?? {}), predicate: String(p?.predicate ?? "default") }, house) : p;
+    if (!kept) { excludedHouse.push(String(p?.term ?? p?.terms?.[0] ?? "")); continue; }
+    offered.push(kept === p || !Array.isArray(kept.terms) ? p : { ...p, terms: kept.terms });
+  }
+  if (!offered.length)
+    return { type: "text", text: JSON.stringify({ minted: [], reused: [], rejected: [], excluded_house_element: excludedHouse, executed: false }, null, 2) };
   const existingQids = new Set(supp.entries.map((e) => e.qid));
-  const { minted, reused, rejected, enriched, narrowed } = mintSupplementalEntries(axis, proposals,
+  const { minted, reused, rejected, enriched, narrowed } = mintSupplementalEntries(axis, offered,
     { existingQids, perCall, axisMax, existingCount: supp.entries.length, capabilities: deps.capabilities ?? null, priorityClasses: planClasses });
 
   // Field-level romanisation enrichment of a REUSED qid (2026-07-30 review round): the natural retry —
@@ -373,7 +390,7 @@ export async function proposeSupplemental(params, tctx, deps) {
     const r = await executePlan({ plan_path: suppPath, axis, output_path: outPath, qids }, tctx);
     const text = r && typeof r === "object" ? (r.text ?? "") : String(r ?? "");
     if (!text || text.startsWith("ERROR")) {
-      return { type: "text", text: JSON.stringify({ minted: minted.map((e) => e.qid), reused, ...(enrichedQids.length ? { enriched: enrichedQids } : {}), ...(conflicts.length ? { conflict: conflicts } : {}), rejected, ...(narrowed.length ? { narrowed } : {}), executed: false, error: text.slice(0, 300) || "executor returned nothing" }, null, 2) };
+      return { type: "text", text: JSON.stringify({ minted: minted.map((e) => e.qid), reused, ...(enrichedQids.length ? { enriched: enrichedQids } : {}), ...(conflicts.length ? { conflict: conflicts } : {}), rejected, ...(excludedHouse.length ? { excluded_house_element: excludedHouse } : {}), ...(narrowed.length ? { narrowed } : {}), executed: false, error: text.slice(0, 300) || "executor returned nothing" }, null, 2) };
     }
     try { summary = JSON.parse(text); } catch { summary = { raw: text.slice(0, 300) }; }
   }
@@ -398,5 +415,5 @@ export async function proposeSupplemental(params, tctx, deps) {
     }
   } catch { /* band unreadable — the executor summary still crosses */ }
 
-  return { type: "text", text: JSON.stringify({ minted: minted.map((e) => e.qid), reused, ...(enrichedQids.length ? { enriched: enrichedQids } : {}), ...(conflicts.length ? { conflict: conflicts } : {}), rejected, ...(narrowed.length ? { narrowed } : {}), executed: qids.length > 0, summary, results }, null, 2) };
+  return { type: "text", text: JSON.stringify({ minted: minted.map((e) => e.qid), reused, ...(enrichedQids.length ? { enriched: enrichedQids } : {}), ...(conflicts.length ? { conflict: conflicts } : {}), rejected, ...(excludedHouse.length ? { excluded_house_element: excludedHouse } : {}), ...(narrowed.length ? { narrowed } : {}), executed: qids.length > 0, summary, results }, null, 2) };
 }

package/driver/engine/openai-agent.mjs

@@ -60,8 +60,8 @@ const codexBin = () => { const r = resolveEngineProgram("openai-agent"); return
 // 3 stage families, and BYTE-IDENTICALLY on retry. That was true of that code and that CLI.
 //
 // What has changed is not the measurement but everything around it: three weeks of stage-contract
-// work, and a codex CLI that has moved several minor versions. The ruling above supersedes 's
-// conclusion; it does not erase its evidence. A reader who finds first must be able to get here.
+// work, and a codex CLI that has moved several minor versions. The ruling above supersedes the measurement's
+// conclusion; it does not erase its evidence. A reader who finds the measurement first must be able to get here.
 //
 // ── HOW A REGRESSION ANNOUNCES ITSELF — no experiment is scheduled, and none is needed ────────────
 //

package/driver/findings-model.mjs

@@ -578,6 +578,18 @@ const clipClause = (s, max) => {
  * count authority and the fallback. Returns null when either axis is missing (legacy sidecars —
  * callers fall back to today's bare word). PURE.
  */
+/**
+ * The conditions a client is actually told a CONDITIONAL verdict rests on: the client-voice clauses, and
+ * the reasons as their fallback. A clause stored as explicit null is a condition ruled to the run record
+ * alone, so its reason is not stated either; `undefined` (legacy/short) is not null. PURE.
+ */
+export function statedConditions({ reasons, clauses } = {}) {
+  const cs = Array.isArray(clauses) ? clauses : [];
+  const conds = (Array.isArray(reasons) ? reasons : []).filter((r, i) => cs[i] !== null).map((r) => String(r ?? "").trim()).filter(Boolean);
+  const cls = cs.map((c) => String(c ?? "").trim()).filter(Boolean);
+  return { conds, cls };
+}
+
 export function riskStatement({ tier, verdict, reasons, basis, clauses } = {}) {
   const v = String(verdict || "").toUpperCase();
   const t = String(tier || "").trim();
@@ -592,10 +604,13 @@ export function riskStatement({ tier, verdict, reasons, basis, clauses } = {}) {
   if (v === "CONDITIONAL") {
     // A clause stored as explicit null is a condition ruled to the run record alone: it is not the lede,
     // it is not counted, and its reason is never the fallback text. `undefined` (legacy/short) is not null.
-    const cs = Array.isArray(clauses) ? clauses : [];
-    const conds = (Array.isArray(reasons) ? reasons : []).filter((r, i) => cs[i] !== null).map((r) => String(r ?? "").trim()).filter(Boolean);
-    const cls = cs.map((c) => String(c ?? "").trim()).filter(Boolean);
-    const lede = cls[0] ?? conds[0] ?? "the open conditions carried in the report";
+    const { conds, cls } = statedConditions({ reasons, clauses });
+    // NOTHING STATED, NO "CONDITIONAL ON:" LINE (owner, 2026-09-19). When every condition is ruled to
+    // the run record, the line had nothing behind it and fell back to "the open conditions carried in the
+    // report": a conditional with no condition. The band word stands alone, and `stance` still says
+    // conditional to every consumer that keys on it.
+    if (!cls.length && !conds.length) return `${t}${basisNote ? `.${basisNote}` : ""}`;
+    const lede = cls[0] ?? conds[0];
     const first = clipClause(sentenceCaseLead(lede), STATEMENT_CLAUSE_MAX);
     const n = conds.length || cls.length;
     const more = n > 1 ? ` (and ${n - 1} more)` : "";
@@ -1228,7 +1243,7 @@ export function parseFindingsJsonLenient(raw, opts = {}) {
 // and drops the others, so a run's entire non-Latin field can collapse into one finding whose prose
 // describes one of them.
 //
-// The fix is 's, at a third site: keep the Latin normalisation exactly as it was where it produces
+// The fix, at a third site: keep the Latin normalisation exactly as it was where it produces
 // anything, and fall back to the RAW value (NFKC-folded, so full-width and compatibility forms of the
 // same characters still key alike) where it does not. Latin keys are byte-identical to before — pinned
 // by test, because a consolidation key that moved would re-merge every archived finding differently.
@@ -1721,7 +1736,7 @@ function validateNet(f, ord, mode) {
 // (publish/index.mjs strict-parses the archived findings.json), and a delivered matter would stop
 // republishing. So it engages at v7 and archived records parse byte-identically, forever.
 //
-// THE LENIENT PATH IS EXEMPT, for validateNetRequired's reason (/) and one of its own. Dropping a
+// THE LENIENT PATH IS EXEMPT, for validateNetRequired's reason and one of its own. Dropping a
 // finding because its sentence is shaped wrong would delete a real conflict over a punctuation mark —
 // silence arrived at by enforcing a rule about clarity. It also keeps the token out of pipeline.mjs's A3
 // per-finding salvage lane, which has nothing to salvage here (see the token's own note below).

package/driver/gateway.mjs

@@ -1146,7 +1146,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     // `resolveModel(model)` / `engine.resolveModelId(model)`, computed here without ever looking at the
     // provider's answer. So `--model gemini` logged `google/gemini-3.1-pro-preview` and ran sonnet (the
     // engine's alias table substituted, silently), a haiku stage that bounced to sonnet logged haiku,
-    // and every attribution downstream — the A/B arm's manifest, tokens.mjs' per-model rollup, 's
+    // and every attribution downstream — the A/B arm's manifest, tokens.mjs' per-model rollup, the
     // billing classes — was keyed to a model that had not run. Patching the log would not have fixed
     // it; the log was already saying what the code believed.
     //

package/driver/knockout-next-step.mjs

@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+// knockout-next-step.mjs — a next-step section the assessing model wrote into a name's read comes off
+// before the report is published.
+//
+// A knockout states findings and a rating; what to do with the name is the reading lawyer's. The assessing
+// instructions stopped asking for a next step, and the model still writes one now and then, under a heading
+// of its own: "What to do with it", "Practical next step". Refusing the turn and re-asking cost a full
+// re-dispatch each time, and the owner ruled for delivery over the loop (2026-09-19). So the section is
+// removed here, in code, with no model call, and the run record names every heading removed.
+//
+// WHAT COMES OFF: a heading whose own words are a next step, and the section under it — nothing else. A
+// hashed heading's section runs to the next heading at its level or above; a line that is only bold text
+// runs to the next heading of either kind; a bold label opening a paragraph ("**Practical next step** —
+// …") takes that paragraph. Position does not matter: removing a section cannot reorder what is left.
+//
+// WHAT STAYS, BY DESIGN: the same advice written as an ordinary sentence with no heading over it. Nothing
+// bounds that sentence but judgement, and cutting a guess out of the client's read is worse than leaving
+// it. The instruction not to write one is the only thing that reaches it.
+
+// A heading's own words that make it a next step. Whole-heading: "What drives the rating" and "What is
+// still open" are not next steps, and a word appearing somewhere inside a heading proves nothing.
+export const NEXT_STEP_HEADING_RE =
+  /^(?:(?:practical|immediate|suggested|recommended|possible)\s+)?(?:next\s+steps?\b.*|what\s+to\s+do\b.*|what\s+happens\s+next|recommendations?\b.*|our\s+recommendations?\b.*|(?:the\s+)?way\s+forward)$/i;
+
+const label = (s) => String(s).replace(/[*_`]/g, "").replace(/[\s:.–—-]+$/, "").trim();
+
+/** What kind of heading this line is, and its words — or null for a line that heads nothing. PURE. */
+function headingAt(line) {
+  const atx = /^\s{0,3}(#{1,6})\s+(.*?)\s*#*\s*$/.exec(line);
+  if (atx) return { kind: "atx", level: atx[1].length, text: label(atx[2]) };
+  const bold = /^\s*(\*\*|__)(.+?)\1\s*:?\s*$/.exec(line);
+  if (bold) return { kind: "bold", text: label(bold[2]) };
+  const lead = /^\s*(\*\*|__)(.+?)\1\s*[:.–—-]?\s+\S/.exec(line);
+  if (lead) return { kind: "lead", text: label(lead[2]) };
+  return null;
+}
+
+/** Is this whole line a heading over a next step? PURE. */
+export function isNextStepHeading(line) {
+  const h = headingAt(String(line ?? ""));
+  return Boolean(h && NEXT_STEP_HEADING_RE.test(h.text));
+}
+
+/**
+ * The text with every next-step section removed, and what was removed: `{ text, removed: [{ heading,
+ * chars }] }`. Text with nothing to remove comes back byte-identical. PURE.
+ */
+export function stripNextStepSections(text) {
+  const src = String(text ?? "");
+  const lines = src.split("\n");
+  const keep = [];
+  const removed = [];
+  for (let i = 0; i < lines.length;) {
+    const h = headingAt(lines[i]);
+    if (!h || !NEXT_STEP_HEADING_RE.test(h.text)) { keep.push(lines[i]); i++; continue; }
+    let j = i + 1;
+    if (h.kind === "lead") {
+      while (j < lines.length && lines[j].trim() !== "") j++;
+    } else {
+      for (; j < lines.length; j++) {
+        const n = headingAt(lines[j]);
+        if (!n || n.kind === "lead") continue;
+        if (h.kind === "atx" ? n.kind === "atx" && n.level <= h.level : true) break;
+      }
+    }
+    removed.push({ heading: h.text, chars: lines.slice(i, j).join("\n").trim().length });
+    i = j;
+  }
+  if (!removed.length) return { text: src, removed };
+  return { text: keep.join("\n").replace(/\n[ \t]*\n(?:[ \t]*\n)+/g, "\n\n").trim(), removed };
+}

package/driver/named-band.mjs

@@ -137,7 +137,7 @@ export function parseNamedBand(raw) {
         // byte-identical to a slice the plan deliberately counted without fetching. Measured on a real
         // run: four capability-gap blocks carried `error:true, deferred:true` into this function and
         // reached record-carry.json with both fields gone and a sentence claiming the run "has a hit
-        // COUNT for this slice". register-plan.mjs:1594 validatePlanFeasibility already enforces the same rule one layer up
+        // COUNT for this slice". register-plan.mjs:1681 validatePlanFeasibility already enforces the same rule one layer up
         // ("a transient must not ship indistinguishable from a sanctioned descriptor") — it reads the
         // RAW blocks, which is why it could. Every consumer that reads THIS projection could not.
         // Conditional like the four keys above, so old bands carry neither key and nothing shifts.

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.2-beta.11",
+  "version": "0.3.2-beta.13",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline-knockout.mjs

@@ -56,6 +56,7 @@ import { registerUnavailableOffices } from "./register-unreachable.mjs";
 import { runRecordLogPath } from "../providers/_shared/ledger-path.mjs";   // — this run's record log
 import { validators as koValidators, validateMergedFindings, worstBand, registerSurfacedFilings, raterCaveats, SURVIVOR_BOUNDARY_RE } from "./verify-knockout.mjs";
 import { reviewAbout, reviewEvidence, reviewEvidenceLines, applyKnockoutReview, knockoutReviewFile } from "./knockout-review-record.mjs";
+import { stripNextStepSections } from "./knockout-next-step.mjs";
 import { publishKnockout, composeKnockoutEmail } from "./publish/knockout.mjs";
 import { writeRunStatus, rollupStatus, atomicWrite, identitySeed } from "./progress.mjs";   // — the identity seed is shared; the stepper is not
 import { batchMarkName } from "./mark-name.mjs";
@@ -349,6 +350,28 @@ export function survivorBoundaryNote(policy) {
   return `This is ${screenName}, not a clearance. A mark not knocked out here is not clear — it is not knocked out at this screen's depth, and proceeds to clearance. Nothing above is a finding of availability.`;
 }
 
+// ── a next-step section the model wrote comes off, in code ──────────────────────────────────────────
+//
+// Each name's read is published as its own report, and the screen states findings and a rating — what to
+// do with the name is the reading lawyer's. A heading the model wrote over a next step, and the section
+// under it, are removed here and named in the run record; `knockout-next-step.mjs` says what counts. This
+// replaced a pre-delivery refusal that re-asked the whole chunk for the same edit (owner, 2026-09-19).
+// EXPORTED so the record line is driven directly, not only through a whole pipeline.
+export function removeNextStepSections(runDir, marks) {
+  const out = [];
+  for (const m of marks ?? []) {
+    if (typeof m?.assessment !== "string") continue;
+    const { text, removed } = stripNextStepSections(m.assessment);
+    if (!removed.length) continue;
+    m.assessment = text;
+    const row = { event: "knockout-next-step-removed", mark: m.name, headings: removed.map((r) => r.heading),
+      chars: removed.reduce((n, r) => n + r.chars, 0), lane: "knockout" };
+    runLog(runDir, row);
+    out.push(row);
+  }
+  return out;
+}
+
 // ── — the knockout lane's recovery park ───────────────────────────────────────
 //
 // EXPORTED so it can be armed directly. The clearance lane's equivalent is inline in a 6,000-line catch
@@ -517,7 +540,7 @@ export async function knockoutInner(ctx, job, opts = {}) {
       //
       // ONLY when the counter is the real provider. On fixtures or an injected counter the offices this
       // deployment can reach are not what the lane is talking to, and splitting on them would defer a
-      // register the fixture holds — a $0 lane reporting a gap it does not have (the shape 's
+      // register the fixture holds — a $0 lane reporting a gap it does not have (the shape a
       // sibling defect had, and the reason `missing` carries the same guard).
       const unreachable = countExec.source === "provider" ? registerUnavailableOffices(caps) : [];
       ctx.registerUnreachable = unreachable;
@@ -964,6 +987,9 @@ export async function knockoutInner(ctx, job, opts = {}) {
     // it runs BEFORE the artifact is written, not after. The counts are logged because a receipts pass
     // over zero citations is a different fact from a receipts pass, and only the count can tell them
     // apart afterwards.
+    // BEFORE THE GATE AND THE WRITE, so the record on disk is the record that ships, and the reviewing
+    // pass never addresses a line inside a section that is about to go.
+    removeNextStepSections(run.runDir, merged.marks);
     const mv = validateMergedFindings(run.runDir, merged, plan);
     if (!mv.ok) throw new StageFailure("knockout-assess", `merged findings failed the lint: ${mv.failures.join("; ")}`, null);
     runLog(run.runDir, { event: "knockout-receipts", ...mv.receipts });

package/driver/pipeline.mjs

@@ -4818,7 +4818,7 @@ export function terminalReasonFields(reason, { cap = 200, fullCap = 4000 } = {})
 // `_driver/failure.json` carried reason/reasonVerbatim/failClass/terminalKind and no payload at all, so the
 // operator was told one query had dropped and never which one — E2E had to replay
 // findDroppedConnotationQueries against the preserved artifacts to name it. `reasonDetail` already reached
-// status.json (/); `reasonQuantity` reached neither file.
+// status.json; `reasonQuantity` reached neither file.
 //
 // Both are written UNCONDITIONALLY as string|null and number|null. Never omitted, never 0: "no key" and
 // "this failure carries no count" are different facts, the same distinction `reasonTruncated` is written on
@@ -7929,7 +7929,7 @@ export function buildAskAnswersSection(askAnswers, intakeAsks) {   // @internal
  * change to the delivered report nobody asked for. So the divergence is now one-country-only and owned,
  * rather than general and deferred.
  *
- * This section itself is untouched by the ladder: the grouping is not extended and not re-keyed. 's
+ * This section itself is untouched by the ladder: the grouping is not extended and not re-keyed. The
  * graded entries render in a SIBLING section (buildGradedEntriesSection) using the same line grammar.
  */
 export function buildReasonedNegativesSection(findings) {   // @internal
@@ -15696,8 +15696,8 @@ async function pipelineInner(job, opts = {}) {
     // — `reasonDetail` rides beside `reason`, never inside it. abbrev, not a bare slice: a cut that
     // reads as a word is worse than one that reads as a cut, and this one is read by an engineer
     // chasing a defect.
-    // — one spelling of the payload for BOTH sinks. status.json already carried `reasonDetail`
-    // (/); `_driver/failure.json` carried neither it nor the count, and `reasonQuantity` reached
+    // — one spelling of the payload for BOTH sinks. status.json already carried `reasonDetail`;
+    // `_driver/failure.json` carried neither it nor the count, and `reasonQuantity` reached
     // no file at all — so the operator read "dropped 1 dictated connotation query" and had to replay the
     // gate against the preserved artifacts to learn which one. Derived once here and passed to both
     // writers, so the notice and the status file can never disagree about the payload.

package/driver/placement-union.mjs

@@ -68,7 +68,7 @@ function indexRows(rows, { bySelection = true, uriLeg = true } = {}) {
 /**
  * Union the seat's tiers into what the driver already holds.
  *
- * THE RULE, and why it is that way round — identical to 's, for identical reasons:
+ * THE RULE, and why it is that way round — identical to coverage-union.mjs and disposition-union.mjs, for identical reasons:
  *   · a SUBMITTED row the gate would accept wins, so the seat can CORRECT itself;
  *   · otherwise a PRIOR row the gate would accept is kept, so a killed or cold attempt cannot destroy
  *     work already done;

package/driver/portal-mcp-client.mjs

@@ -76,7 +76,7 @@ function post(urlStr, { headers = {}, body = "", wantId = null, timeoutMs = 3000
         data += c;
         // SSE early-exit: once the frame with our id is complete, we have the answer — stop reading
         if (wantId != null && String(res.headers["content-type"] ?? "").includes("text/event-stream")
-            && new RegExp(`"id"\s*:\s*${wantId}`).test(data) && /\n\n/.test(data)) { res.destroy(); done(); }
+            && new RegExp(`"id"\\s*:\\s*${wantId}`).test(data) && /\n\n/.test(data)) { res.destroy(); done(); }
       });
       res.on("end", done);
       res.on("close", done);

package/driver/portal-report.mjs

@@ -122,6 +122,13 @@ const CHROME_RES = [
   // has stopped matching. Removing the wrapper first would take the nav with it, drive the count to
   // zero, and turn a security assertion into a permanent false alarm.
   { tag: "div", open: /<div class="[^"]*\brep-stickyhead\b[^"]*"[^>]*>/ },
+  // THE SECTION MENU, WHEREVER THE RENDERER PUT IT. A report rendered today carries it inside the header
+  // above, and it goes with that. A report rendered before 2026-09-18 carries it just AFTER the header, so
+  // stripping the header alone left it in the frame: a second copy of the menu the portal draws, pinned
+  // over the report's title band, its current item red on red in the dark theme. Measured on an archived
+  // global preliminary report served by a published beta. Archived reports are served from their baked
+  // bytes, so this has to happen here rather than in the renderer. `sectionsOf` has already read it.
+  { tag: "nav", open: /<nav class="[^"]*\bstrip\b[^"]*"[^>]*>/ },
   // the "Internal review copy — stripped on export" bar, which hosted the quality-capture controls
   { tag: "div", open: /<div class="[^"]*\breview\b[^"]*\binternal\b[^"]*"[^>]*>/ },
   // per-finding flag buttons and their popovers
@@ -529,7 +536,7 @@ const EMBED_JS = `
   function schedule(){
     if(queued)return;
     queued=true;
-    requestAnimationFrame(function(){queued=false;post();});
+    requestAnimationFrame(function(){queued=false;post();sections();});
   }
   // WHICH CONTROLS THIS DOCUMENT ACTUALLY HAS.
   //
@@ -559,12 +566,24 @@ const EMBED_JS = `
   // script) and the shell draws it in its own header. Only the ids that are really in the document are
   // announced: a report whose renderer named a section it did not draw would otherwise offer the reader
   // a breadcrumb entry that jumps nowhere.
+  //
+  // AND WHERE EACH ONE STARTS, so the shell can show how far the reader has got (owner, 2026-09-19): every
+  // section reached so far is marked, the rest are not. The page scrolls, not this frame, so only the shell
+  // knows where the reader is. It needs each section's top in this document to compare. Said again whenever
+  // the layout moves: a panel opening pushes every section below it down.
+  var saidSections='';
   function sections(){
     try{
       var list=window.__CORD_SECTIONS;
       if(!list||!list.length)return;
       var live=[];
-      for(var i=0;i<list.length;i++) if(document.getElementById(list[i].id)) live.push(list[i]);
+      for(var i=0;i<list.length;i++){
+        var el=document.getElementById(list[i].id);
+        if(el) live.push({id:list[i].id,label:list[i].label,top:Math.max(0,Math.round(el.getBoundingClientRect().top+window.scrollY))});
+      }
+      var said=JSON.stringify(live);
+      if(said===saidSections)return;
+      saidSections=said;
       parent.postMessage({source:TAG,type:'sections',sections:live},'*');
     }catch(e){}
   }
@@ -831,7 +850,10 @@ export function sectionsOf(html) {
   if (!nav) return [];
   const out = [];
   for (const m of nav[1].matchAll(STRIP_LINK_RE)) {
-    const label = m[2].replace(/<[^>]*>/g, "").replace(/\s+/g, " ").trim();
+    // Stripped until nothing changes, so a tag that a first pass reassembles cannot survive into the label.
+    let label = m[2];
+    for (let prev = null; prev !== label;) { prev = label; label = label.replace(/<[^>]*>/g, ""); }
+    label = label.replace(/\s+/g, " ").trim();
     if (m[1] && label) out.push({ id: m[1], label });
   }
   return out;

package/driver/portal-service.mjs

@@ -179,6 +179,9 @@ import { accessAudience, audienceLabel } from "../shared/access-audience.mjs";
 import { resolveNumericSetting } from "./numeric-setting.mjs";   // — the same table the engine enforces, without the throw a rendering surface must not take
 import { isEntrypoint } from "../shared/is-entrypoint.mjs";   // — one entry-point test, all spellings
 import { deploymentBox } from "../shared/deployment-box.mjs";   // — the box names itself; one rule
+import { stageNow } from "./progress.mjs";   // the stage a live run is in now, for the card and the row
+// A run in one of these has finished; its step is the one its terminal write set, not the stage it last entered.
+const TERMINAL_STATES = new Set(["delivered", "failed", "cancelled"]);
 
 // The offering the portal menus build from — product-rows.mjs's row, unchanged.
 //
@@ -384,7 +387,7 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, gener
           stageLabel: stageLabelOf(meta.searchLevel) ?? meta.stageLabel ?? null,
           productName: productNameOf(meta.searchLevel),
           state: "delivered", date: meta.date ?? null,
-          // WHEN IT FINISHED, to the second (/). `date` is DAY precision and always was — it is
+          // WHEN IT FINISHED, to the second. `date` is DAY precision and always was — it is
           // parsed out of the run directory name. Two reads of one mark delivered on the same day
           // therefore TIE, Array.prototype.sort is stable, and which one the parent row spoke for was
           // decided by readdirSync order rather than by recency.
@@ -515,7 +518,11 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, gener
         resetsAt: typeof s.resetsAt === "string" ? s.resetsAt : null,
         // Elapsed, so a card can say how long this has been going without inventing a finish time.
         startedAt: typeof s.startedAt === "string" ? s.startedAt : null,
-        step: s.stepLabel ?? null, stepN: s.stepN ?? null, stepTotal: s.stepTotal ?? null,
+        // THE STAGE IT IS IN NOW, a step back into an earlier stage included (owner, 2026-09-19): see
+        // stageNow. Only while it is live; a run that has finished keeps the step its terminal write set.
+        ...(TERMINAL_STATES.has(s.state)
+          ? { step: s.stepLabel ?? null, stepN: s.stepN ?? null, stepTotal: s.stepTotal ?? null }
+          : stageNow(s)),
         // — a requested stop is a state the screen shows. Stamped by stop_run,
         // preserved by writeRunStatus's spread-merge, replaced by the terminal when the honour check
         // fires. The UI derives "Stopping…" from this beside a non-terminal state.
@@ -867,7 +874,7 @@ export const SERVER_ROUTE_HEADS = Object.freeze(["api", "report", "admin", "heal
  * `msgId` and `conversationId` sat in this list while `jobFor` hardcoded both to null and the trigger
  * hop stripped them off again. The totality test beside it could not see that: it asks whether every
  * declared field is classified, which a declared-and-nulled field satisfies perfectly. So the sentence
- * above asserted a behaviour and the test next to it checked a different one — the same shape as 's
+ * above asserted a behaviour and the test next to it checked a different one — the same shape as
  * "an invitation nothing honours", one level up.
  *
  * `stamped` exists so the new guard can be DERIVED rather than hand-listed. It splits `carries` into the
@@ -2928,7 +2935,7 @@ async function connectorDoorKind(url) {
         // row, and a retired-endpoint row is a different fact from a not-yours row. If an old open tab is
         // still clicking Flag, that is a thing worth being able to count.
         //
-        // WHAT IS DELIBERATELY STILL BELOW THIS LINE: the whole resolver — the two-lane shape, 's
+        // WHAT IS DELIBERATELY STILL BELOW THIS LINE: the whole resolver — the two-lane shape, the
         // disposition read, the server-side-locator rule. The owner ruled "disable services and any code",
         // and the acceptance criterion says re-enabling must be a switch and not a rebuild. Deleting 130
         // lines of hard-won doctrine would have made it a rebuild.
@@ -3759,7 +3766,12 @@ function doctrineStore(now = Date.now) {
   } catch (e) {
     // NOT `{head: null}` alone. A null head with no reason reads as "no store", which is a legal and
     // healthy state (`no-overlay`); this is a different thing and has to say so.
-    value = { head: null, situation: "unreadable", outcome: "blocked", detail: String(e?.message ?? e).slice(0, 120) };
+    //
+    // THE ERROR'S OWN WORDS GO TO THE SERVICE LOG, NOT THE WIRE. This answer is served by the health
+    // route, and an error message can carry the store's filesystem path. `unreadable` says what the
+    // caller needs; the operator reads why in the log.
+    console.error(`[portal] the instructions store could not be read: ${String(e?.message ?? e).slice(0, 200)}`);
+    value = { head: null, situation: "unreadable", outcome: "blocked" };
   }
   storeCache = { at: t, value };
   return value;
@@ -3931,7 +3943,9 @@ const escHtml = (t) => String(t).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<"
 // and brand pack §01 fixes dark at #0f0e0c near-black + #f0e8d8 parchment. The pack wins.
 // ── THE PLAIN LINE LEADS; THE ADMINISTRATOR'S TWO LINES STEP BACK INTO A FOLD ────────────────────────
 //
-// A person arriving here needs the field, the button, and one fact: this install signs in one person.
+// A person arriving here needs the field, the button, and one fact: this install has one user, and which
+// address that is. The owner's words, 2026-09-19: "Clearotron portal, as <address>." read as "you are
+// <address>", and a person who found `key issue` first minted a key and could not get in.
 // The reset command and the way to add people are an administrator's business, so they sit in a closed
 // "Administrator help" fold, word for word as they were, with the same link People gives to putting a
 // login system in front. A `<details>` needs no script, which this door must render without.
@@ -3976,9 +3990,7 @@ ${DOOR_THEME_INIT}
   .hint { margin-top:18px; font-size:13px; }
   code { font-family:var(--mono); font-size:12.5px; background:var(--code-bg);
          padding:1px 5px; border-radius:4px; overflow-wrap:anywhere; }
-  .lead { margin:18px 0 0; padding-top:14px; border-top:1px solid var(--line); font-size:13.5px; color:var(--ink); }
-  .lead b { font-weight:600; }
-  .fold { margin-top:10px; }
+  .fold { margin-top:18px; padding-top:14px; border-top:1px solid var(--line); }
   .fold > summary { display:inline-flex; align-items:center; gap:6px; list-style:none; cursor:pointer;
                     font-size:13px; color:var(--link); }
   .fold > summary::-webkit-details-marker { display:none; }
@@ -3993,7 +4005,7 @@ ${signedIn
     ? `<p>You are signed in as <span class="who">${escHtml(email)}</span>.</p>
 <div><a href="/portal">Go to the portal</a></div>
 <form method="post" action="/portal/logout"><button type="submit">Sign out</button></form>`
-    : `<p>${escHtml(BRAND.name)} portal, as <span class="who">${escHtml(email)}</span>.</p>
+    : `<p>This ${escHtml(BRAND.name)} has one user: <b class="who">${escHtml(email)}</b>. Enter its passphrase.</p>
 ${discarded ? `<p class="hint">A session this portal did not start, from another ${escHtml(BRAND.name)} on this address or an expired one, was set aside. Sign in below.</p>` : ""}
 ${error ? `<p class="err">${escHtml(error)}</p>` : ""}
 <form method="post" action="/portal/login">
@@ -4001,10 +4013,10 @@ ${error ? `<p class="err">${escHtml(error)}</p>` : ""}
   <input id="passphrase" name="passphrase" type="password" autocomplete="new-password" autofocus>
   <button type="submit">Sign in</button>
 </form>
-<p class="lead"><b>This ${escHtml(BRAND.name)} signs in one person: you.</b></p>
 <details class="fold"><summary><span>Administrator help</span><svg class="chev" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" focusable="false"><path d="m9 18 6-6-6-6"/></svg></summary>
-<p class="hint">Lost the passphrase? Run <code>${escHtml(reset)}</code> on the machine
-running this portal. It mints a new one and prints it once.</p>
+<p class="hint">The passphrase was printed once when this ${escHtml(BRAND.name)} first started. Lost it? Run
+<code>${escHtml(reset)}</code> on the machine running this portal. It prints a new one, once, for the same user.</p>
+<p class="hint">A key from <code>${escHtml(bareInvocation("key"))} issue</code> is for an AI assistant, not for this page.</p>
 <p class="hint">To add people, put it behind a login system such as your company single sign-on. <a href="${escHtml(LOGIN_IN_FRONT_DOC)}" target="_blank" rel="noreferrer">How to set that up</a></p>
 </details>`}
 </div></body></html>`;

package/driver/predelivery-lint.mjs

@@ -30,7 +30,7 @@ import { partyFactSources, partyFactViolations, partyFactMessage, canJudgePartyF
 import { writeUpViolations, writeUpMessage } from "./narrative-write-ups.mjs";   //
 
 import { findRegistryArithmeticIssues, findRegistryViolations, splitBlocks } from "./registry-fidelity.mjs";
-import { CLIENT_TIER_BY_COMPOSITE, joinFindingToBlock, parseBlockOrd, worstLiveBand, NO_RATED_CONFLICTS, deriveActionConditions, isUnconditionalProceed, verdictStance, joinAskToAnswer, projectAssessmentField, POSITION_REQUIRED_DISPOSITIONS, OFF_FIELD_GROUNDS, FINDINGS_SCHEMA_VERSION, netChainMarkers, STATEMENT_CLAUSE_MAX } from "./findings-model.mjs";
+import { CLIENT_TIER_BY_COMPOSITE, joinFindingToBlock, parseBlockOrd, worstLiveBand, NO_RATED_CONFLICTS, deriveActionConditions, isUnconditionalProceed, verdictStance, statedConditions, joinAskToAnswer, projectAssessmentField, POSITION_REQUIRED_DISPOSITIONS, OFF_FIELD_GROUNDS, FINDINGS_SCHEMA_VERSION, netChainMarkers, STATEMENT_CLAUSE_MAX } from "./findings-model.mjs";
 import { normalizeBand } from "./framework.mjs";
 import { clientConditions, unrenderableConditions, ENGINE_TOKEN_RE } from "./terminal-clamp.mjs";   // the reader's clause per condition, and the token shape it may never carry
 import { knockoutNoteView, REQUEST_NOTE_WORDS, REQUEST_SUBJECT_WORDS } from "./findings-model.mjs";   // one reader for where a note prints
@@ -87,7 +87,7 @@ const REF_ALLOWLIST = new Set([
 const TERRITORY_VOCAB = new Set(Object.values(REGION_NAMES).map((n) => norm(n)));
 
 function stripHtml(s) {
-  return String(s ?? "").replace(/<[^>]+>/g, " ").replace(/&amp;/g, "&").replace(/&nbsp;/g, " ");
+  return String(s ?? "").replace(/<[^>]+>/g, " ").replace(/&nbsp;/g, " ").replace(/&amp;/g, "&");
 }
 
 // "April 2014", "MAY 2026" — dates pass the Title-Case-multi-word shape but are never entities.
@@ -2023,7 +2023,12 @@ export function statementCoherenceChecks({ verdictDoc }) {
       stanceOk ? "" : `verdict.json stance "${verdictDoc.stance}" does not match the verdict ${v || "(missing)"} (expected "${expected ?? "?"}") — the sidecar fields diverged; re-derive it (writeVerdictSidecar composes both from one record)`);
     if (!c3.pass) c3.structural = true;
     out.push(c3);
-    const formOk = verdictDoc.stance !== "conditional" || /—\s*conditional on:/.test(st);
+    // The form is owed only where something is stated: a conditional whose every condition was ruled to
+    // the run record carries the band word alone (riskStatement), and a "conditional on:" there would be
+    // the empty line the owner ruled off the page.
+    const stated = statedConditions({ reasons: verdictDoc.reasons, clauses: verdictDoc.clauses });
+    const nothingStated = !stated.cls.length && !stated.conds.length;
+    const formOk = verdictDoc.stance !== "conditional" || nothingStated || /—\s*conditional on:/.test(st);
     const c4 = check("statement-conditional-form", "verdict", "report", formOk,
       formOk ? "" : `a conditional-stance statement must state what conditions reliance ("<Tier> — conditional on: <facts>"), but reads "${st.slice(0, 80)}" — re-derive the sidecar`);
     if (!c4.pass) c4.structural = true;
@@ -2339,7 +2344,7 @@ export function runLint({ depth, commonLawGrid, matterContext, clientPartyName,
 // ── The KNOCKOUT lane's applicable subset (2026-07-31) ──────────────────────────────────────────────
 // The knockout (Stage 0/0.5) lane wrote NO predelivery-lint.json at all, by a decision recorded in
 // docs/DELIVERY.md (2026-07-28). That decision rested on two premises this tranche has since moved:
-// the lint artifact is now the WORKBOOK's QC record (/), so a lane that writes none produces an
+// the lint artifact is now the WORKBOOK's QC record, so a lane that writes none produces an
 // EMPTY QC record rather than a deliberately-absent one; and the A10 projects recorded defects onto
 // the cover note that reaches the reviewing lawyer, so a knockout defect reached nobody. What has NOT
 // moved is the other half of the memo: this lane's deliverable is store-rendered, and most clearance