clearotron 0.3.2-beta.12 → 0.3.2-beta.13

package/driver/connotation-search.mjs

@@ -1363,7 +1363,7 @@ export function parseDispositionForm(raw) {
 // EVERY OBLIGATION SHIPS. No head(), no slice(), no "…and N more". The register-digest sibling
 // (gateway.mjs deferredSlicesRequiredRows) printed the first six qids per axis and elided the rest, and its
 // own doc block records what that cost: "Under advice that is an economy; under a requirement it makes
-// compliance impossible." Same rule here, and 's: a value a model must copy is complete, or it is
+// compliance impossible." Same rule here: a value a model must copy is complete, or it is
 // visibly marked as cut. Nothing below is cut, so nothing below is marked.
 /**
  * The obligation set as the seat's own to-do list, for the tool result. Returns "" when nothing is owed —
@@ -1375,7 +1375,7 @@ export function renderConnotationObligations(ob, { ledgerPath = "your half ledge
   // ── — THE PAGE IS NUMBERED OFF THE SAME FUNCTION THAT RESOLVES THE NUMBER ─────────────────
   //
   // `obligationRows` is the driver's row list, and a `row_index` is a position into it. Numbering this
-  // page with its own counter would be two derivations of one ordering, which is the mistake 's
+  // page with its own counter would be two derivations of one ordering, which is the mistake the
   // segment display already names in its own comment: "the display and the check cannot disagree, which
   // they would the moment either recomputed its own split". So the numbers come from the list itself.
   //
@@ -1610,7 +1610,7 @@ export function renderDispositionTable(rows, ob) {
   for (const e of ob?.queries ?? []) for (const r of e.results) if (r.id) byId.set(normId(r.id), r);
   // — the rows are the FORM's, and a row the seat never ruled on has nothing to render: it is
   // outstanding work, which the gate reports as a count, not a table row reading "—".
-  const cell = (s) => String(s ?? "").replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
+  const cell = (s) => String(s ?? "").replace(/\\/g, "\\\\").replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
   const usable = (rows ?? []).filter((d) => d?.receipt_id && d?.ruling);
   // ── — A PARKED ROW IS NOT AN OUTSTANDING ROW, AND THE FILTER ABOVE STOPPED BEING SAFE ─────────
   //
@@ -1683,7 +1683,7 @@ const NO_POLICED_SECTION = "(no PR / reputational / connotation section)";
 //     id that is not among THAT row's own candidates — the driver wrote those ids, so this is a damaged
 //     form, not outstanding work, and its remedy is different.
 //   undisposed_cite_too_short   deleted — cannot occur; nothing is retyped.
-//   recurrent_uncited_form      deleted — the form has no shape for the seat to get wrong. 's
+//   recurrent_uncited_form      deleted — the form has no shape for the seat to get wrong. The old
 //     cited-but-unbound state was a property of PROSE (right page, wrong query string on the line); a
 //     form row IS its binding, so the state has no representative.
 //   no_source_cite              deleted — advisory, prose-only, never reached a token.
@@ -1786,7 +1786,7 @@ export const CONNOTATION_FORM_REASONS = Object.freeze(
  *
  * `quote_unbound` and `form_damaged` are deliberately absent: those rows ARE ruled.
  *
- * `parked` (/) is absent for the opposite reason and it is the load-bearing one: a parked row
+ * `parked` is absent for the opposite reason and it is the load-bearing one: a parked row
  * is NOT ruled, and it is not outstanding either. Outstanding means "the seat still owes this", and the
  * whole point of the park is that the seat has been told to stop — leaving it here would keep the stage
  * failing forever on a row nobody may re-send, which is the deterministic death the park introduced.

package/driver/contract-e3-backlog.mjs

@@ -456,7 +456,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3182",
     surface: "stage-message",
     evidence: "MACHINE FINDINGS (MANDATORY): … a JSON OBJECT {\"schema_version\":<FINDINGS_SCHEMA_VERSION>,\"rated_under_framework\":\"…\",\"findings\":[...],\"coverage\":[...],\"context_notes\":[...],\"actions\":[...],\"ask_answers\":[...]} … Each finding object has EXACTLY these keys: {\"ordinal\",\"mark\",\"owner\",\"band\",\"net\",\"bor",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson via validators.narrative",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson via validators.narrative",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   // RETIRED 2026-08-16 — synthesis's dictated disposition list, and I am the one who left it standing.
@@ -479,7 +479,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3219",
     surface: "stage-message",
     evidence: "- manageable …: {\"category\":\"<EXACTLY one of large-competitor / commercial-partner / troll / well-known-enforcer>\",\"reason\":\"<one-two lines…>\"}",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -488,7 +488,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3235",
     surface: "stage-message",
     evidence: "- meters: {\"mark_similarity\":{...},\"goods_proximity\":{...},\"use\":{...},\"enforcer\":{...}} — all four present, each {\"token\",\"basis\",\"source\"}. … mark_similarity = high | medium | low. goods_proximity = high | medium | low. enforcer = high | medium | low | unknown. use = confirmed | not-confirmed | un",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; driver/verify.mjs:1171 checkFindingsSibling gates meters.*.source; finding_basis_source_missing",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson; driver/verify.mjs:1171 checkFindingsSibling gates meters.*.source; finding_basis_source_missing",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -497,7 +497,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3236",
     surface: "stage-message",
     evidence: "- quadrant: {\"x\",\"y\"} numbers in [0,1]. x = goods/services proximity (0 = distant, 1 = identical). y = mark similarity (0 = distinct, 1 = identical).",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -506,7 +506,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3237",
     surface: "stage-message",
     evidence: "- source: {\"source_type\",\"resolved_link\"}. source_type EXACTLY one of: register-vendor / register-euipo / common-law-marketplace / common-law-web / case-law",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson",
     removedByMove: "M1 removes the opaque `resolved_link` URI (ordinal / record-handle selection); the object shape and the source_type enum survive",
   },
   {
@@ -515,7 +515,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3238",
     surface: "stage-message",
     evidence: "coverage[]: ONE object per coverage AREA, EXACTLY {\"area\",\"state\",\"note\"}. … state EXACTLY one of: confirmed-clean / coverage-limited / open / not-searched / note.",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; the render owns the coverage panel from these typed states",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson; the render owns the coverage panel from these typed states",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -533,7 +533,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3304",
     surface: "stage-message",
     evidence: "MARK ASSESSMENT … STRUCTURED FORM …: either field may instead be an OBJECT {\"read\":\"…\",\"spectrum\":\"…\",\"per_class\":[{\"class\":\"5\",\"note\":\"…\"}],\"per_market\":[{\"market\":\"CN\",\"note\":\"…\"}],\"counter_registrations\":[{\"mark\":\"…\",\"uri\":\"/mark/…\",\"note\":\"…\"}],\"acquired\":\"<optional>\",\"note\":\"<optional residual>",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; the report collapses the rows behind toggles and the audit workbook renders them",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson; the report collapses the rows behind toggles and the audit workbook renders them",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -542,7 +542,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3310",
     surface: "stage-message",
     evidence: "FOUR ANSWERS …: \"four_answers\": {\"third_party_rights\":{...},\"objection_likelihood\":{...},\"registrability\":{...},\"client_enforceability\":{...}} … Each answer … is {\"read\":\"…\",\"token\":\"…\",\"basis\":\"…\",\"ordinals\":[…]}. Tokens (closed enums …): third_party_rights = strong|moderate|weak; objection_likelih",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -551,7 +551,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3221",
     surface: "stage-message",
     evidence: "ACTIONS REGISTER …: emit \"actions\": [...] — ONE object per forward step …, each EXACTLY {\"id\",\"kind\",\"text\",\"ordinals\"} plus an OPTIONAL \"deadline\" and an OPTIONAL \"condition\". … kind: EXACTLY one of — consent / coexistence-agreement / territorial-delimitation / goods-amendment / mark-modification /",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; pipeline applyCoverageFloor legalActions arm derives the delivered disposition from the closed kind enum",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson; pipeline applyCoverageFloor legalActions arm derives the delivered disposition from the closed kind enum",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -560,7 +560,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3317",
     surface: "stage-message",
     evidence: "COVERAGE JUDGMENT …: emit \"coverage_judgment\": {\"sufficient\":<bool>, \"reason\":\"<one line…>\"} — EXACTLY those two keys. Do NOT emit \"rows\": the driver writes that register itself … anything you type there is replaced wholesale.",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson. The \"Do NOT emit rows\" clause is the purest E3 case in the tree — the prompt names a field, dictates its shape and states in the same breath that code overwrites it",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson. The \"Do NOT emit rows\" clause is the purest E3 case in the tree — the prompt names a field, dictates its shape and states in the same breath that code overwrites it",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -575,7 +575,7 @@ export const E3_BACKLOG = [
     // in E3_EVIDENCE_UNRESOLVED instead would have grown the not-checked slice for a row that is
     // perfectly checkable, which is the avoidable coverage loss conversion 9's note names one row up.
     evidence: "SEND ONE \"ask_answers\" ENTRY PER ASK, as a TOP-LEVEL field of the findings record you hand to the call (never as a narrative section — the driver renders the labelled line",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson (finding_ask_answer_answer_missing); assembleReportMd · buildAskAnswersSection joins on the retyped ask string",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson (finding_ask_answer_answer_missing); assembleReportMd · buildAskAnswersSection joins on the retyped ask string",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   // DELETED at conversion 10, recorded rather than absorbed — E3's own rule for a
@@ -611,7 +611,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3296",
     surface: "stage-message",
     evidence: "add it to the top-level \"context_notes\" array — each object EXACTLY {\"type\":\"famous-neighbour-ungrounded\",\"mark\",\"owner\",\"context\"}",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -620,7 +620,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3184",
     surface: "stage-message",
     evidence: "- owner: {\"name\",\"country\",\"registrations\":[...]}. … Each registration: {\"uri\", optionally \"classes\":[\"9\",\"41\"],\"status\",\"filed\",\"expiry\",\"jurisdiction\"}. The \"uri\" is the ONLY field that matters: the driver BINDS classes/status/filed/expiry/jurisdiction AND the owner name from the FETCHED record ke",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson + the record-binding join. Six of the seven keys are stated in the prompt and overwritten by code in the same sentence",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson + the record-binding join. Six of the seven keys are stated in the prompt and overwritten by code in the same sentence",
     removedByMove: "M1 removes the opaque `uri` (ordinal / record-handle selection against the band); the object skeleton and the five overwritten keys survive",
   },
   {

package/driver/coverage-form.mjs

@@ -13,7 +13,7 @@
 // PASS; ~86% of emitted tokens landed in no artifact, and the attempt that passed is the one that
 // PATCHED). A cold ladder never patches.
 //
-// THE CURE IS 's, one gate over: the driver writes the row and the model fills in the judgment. The
+// THE CURE IS THE ONE APPLIED ONE GATE OVER: the driver writes the row and the model fills in the judgment. The
 // axis, the coverage unit, the open crowd blocks with their qids and hit counts, and the deferred slices
 // with their per-qid receipt reasons are all facts the driver holds BEFORE the stage dispatches. It
 // writes them. The seat sets `status` and `reason`, and nothing else in the file is the seat's to write.
@@ -856,7 +856,7 @@ export function findCoverageFormViolations(rows, formError = null) {
 // kind and nothing in it is a string the model had to copy. parseCoverageLedgerFull survives, but only as
 // the ARCHIVED-RUN reader (loadCoverageLedger's prose fallback): no gate parses this table any more.
 
-const cell = (s) => String(s ?? "").replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
+const cell = (s) => String(s ?? "").replace(/\\/g, "\\\\").replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
 
 /** The `## Coverage ledger` section, rendered from the form's rows. "" when nothing is settled. PURE. */
 export function renderCoverageLedgerSection(rows) {

package/driver/demo-container.mjs

@@ -97,6 +97,30 @@ export function prepareSample(dir, { repoRoot, tmp } = {}) {
 }
 
 
+/**
+ * THE COPIES GO WHEN THEIR PUBLISH IS DONE, AND AT EXIT WHATEVER HAPPENED.
+ *
+ * Every copy below is made in the system temp directory and nothing removed it: four per `demo --once`,
+ * one per demo start, some a full replayed run of about 1,850 files, and 36 GB of them on one machine
+ * (measured 2026-09-19). Each root is recorded as it is made. A caller releases them the moment its
+ * publish is done, and an exit hook removes whatever is left, on success and on failure. A caller that
+ * can be stopped by a signal turns the signal into an exit, so the hook runs then too.
+ */
+const copies = new Set();
+let exitHooked = false;
+function tracked(root) {
+  copies.add(root);
+  if (!exitHooked) { exitHooked = true; process.once("exit", releaseDemoCopies); }
+  return root;
+}
+/** Remove every copy made so far. Safe to call more than once. */
+export function releaseDemoCopies() {
+  for (const d of [...copies]) {
+    try { rmSync(d, { recursive: true, force: true }); } catch { /* going anyway; the exit hook tries again */ }
+    copies.delete(d);
+  }
+}
+
 /**
  * The directory a frozen demo should be PUBLISHED from — itself, or a copy when it is part of this tree.
  *
@@ -117,7 +141,7 @@ export function publishSource(dir, { repoRoot, tmp = tmpdir() } = {}) {
   const root = resolve(repoRoot ?? "");
   const here = resolve(dir);
   if (!root || !(here === root || here.startsWith(root + sep))) return dir;
-  const copy = join(mkdtempSync(join(tmp, "clearotron-demo-")), "sample");
+  const copy = join(tracked(mkdtempSync(join(tmp, "clearotron-demo-"))), "sample");
   cpSync(here, copy, { recursive: true });
   return copy;
 }
@@ -135,7 +159,7 @@ export function publishContainer(root, { repoRoot, tmp = tmpdir() } = {}) {
   const repo = resolve(repoRoot ?? "");
   const here = resolve(root);
   if (!repo || !(here === repo || here.startsWith(repo + sep))) return { dir: root, unusable: demoInventory(root).unusable };
-  const copy = join(mkdtempSync(join(tmp, "clearotron-demo-")), "sample");
+  const copy = join(tracked(mkdtempSync(join(tmp, "clearotron-demo-"))), "sample");
   mkdirSync(copy, { recursive: true });
   const { children, unusable } = demoInventory(here);
   const left = [...unusable];

package/driver/disposition-tool.mjs

@@ -288,8 +288,8 @@ export function callsSoFar(dispositionsPath) {
 export { PARK_AFTER_REFUSALS };
 
 /**
- * Which rows have been refused past the bound. PURE, and counted PER ROW ACROSS CALLS — the unit 's
- * own banner records an earlier investigation dying on, when it joined per-row-final-state instead.
+ * Which rows have been refused past the bound. PURE, and counted PER ROW ACROSS CALLS — the unit this
+ * module's own banner records an earlier investigation dying on, when it joined per-row-final-state instead.
  *
  * A row that is ruled later is never re-parked, because the union only parks rows that are not ruled.
  * @returns {string[]} row_ids, sorted, so the same ledger always yields the same answer.

package/driver/engine/CONTRACT.md

@@ -145,7 +145,7 @@ Stages must name **abstract tiers**, not provider aliases. Per-engine maps:
 | `sweep` | register-unit, case-law, skeptic, report-overview, report-card | `sonnet` | `$CLEAROTRON_OPENAI_MODEL_SWEEP` |
 | `cheap` | saturation-probe | `haiku` | `$CLEAROTRON_OPENAI_MODEL_CHEAP` |
 
-**AN UNHONOURED OVERRIDE IS AN ERROR, NOT A SUBSTITUTION** ( corruption 3, 2026-08-03). This
+**AN UNHONOURED OVERRIDE IS AN ERROR, NOT A SUBSTITUTION** (2026-08-03). This
 section used to declare two further tiers — `skeptic` → `google/gemini-3-flash-preview` and
 `refutation` → `together/deepseek-ai/DeepSeek-V4-Pro` — each substituting an anthropic model on the
 anthropic engine, "grade-moving, validated only in the paid A/B". The substitution never was validated
@@ -191,7 +191,7 @@ disarms the refusal and never the record.
 | `max` | `max` | `xhigh` |
 
 `off` used to map to `minimal` on codex and `low` on claude — a whole rung apart at the bottom, so a
-cross-engine effort comparison at `off` was off by one ( corruption 4a).`low` is the anthropic
+cross-engine effort comparison at `off` was off by one. `low` is the anthropic
 floor, so codex came up to it and codex's `minimal` is deliberately unreachable from the driver's tier
 vocabulary. `max` is the one sanctioned divergence: it means "this engine's top rung", and codex has no
 `max`. `engine.anthropic.test.mjs` pins the two tables together and asserts that single exception.
@@ -200,7 +200,7 @@ vocabulary. `max` is the one sanctioned divergence: it means "this engine's top
 (`assertEffectiveTier`), on the EFFECTIVE tier rather than the declared one: Haiku 4.5 rejects adaptive
 thinking and the request bounces to sonnet, so the pairing measures sonnet and records haiku. Both ways
 it can arise are runtime overrides that never touch the stage table (`CLEAROTRON_STAGE_THINKING`, an
-`--experiment --model`), which is why the start-of-run scan alone could not see it ( corruption 4b).
+`--experiment --model`), which is why the start-of-run scan alone could not see it.
 
 ## 4. `claude -p` invocation (anthropic-agent)
 

package/driver/engine/mcp/gather-config.mjs

@@ -212,7 +212,7 @@ const RECORDING = Object.freeze({
   // SECOND — skeptic, same shape ( is the template). Its OWN key, so blind-frame's seat is never
   // handed record_skeptic and skeptic is never handed record_blind_frame.
   //
-  // skeptic's key carries a SECOND tool: search_run_artifacts, the sanctioned read surface ('s
+  // skeptic's key carries a SECOND tool: search_run_artifacts, the sanctioned read surface (the
   // ratification hold, unlock path 1). A READ over the run's own tree, not retrieval — it dials nothing,
   // writes nothing, and is bounded to CLEAROTRON_BAND_RUN_DIR by construction (skeptic-search.mjs). It
   // replaces the artifact half of the Bash reads O3c measured; the skill-doc half was already the seeded

package/driver/engine/openai-agent.mjs

@@ -60,8 +60,8 @@ const codexBin = () => { const r = resolveEngineProgram("openai-agent"); return
 // 3 stage families, and BYTE-IDENTICALLY on retry. That was true of that code and that CLI.
 //
 // What has changed is not the measurement but everything around it: three weeks of stage-contract
-// work, and a codex CLI that has moved several minor versions. The ruling above supersedes 's
-// conclusion; it does not erase its evidence. A reader who finds first must be able to get here.
+// work, and a codex CLI that has moved several minor versions. The ruling above supersedes the measurement's
+// conclusion; it does not erase its evidence. A reader who finds the measurement first must be able to get here.
 //
 // ── HOW A REGRESSION ANNOUNCES ITSELF — no experiment is scheduled, and none is needed ────────────
 //

package/driver/findings-model.mjs

@@ -578,6 +578,18 @@ const clipClause = (s, max) => {
  * count authority and the fallback. Returns null when either axis is missing (legacy sidecars —
  * callers fall back to today's bare word). PURE.
  */
+/**
+ * The conditions a client is actually told a CONDITIONAL verdict rests on: the client-voice clauses, and
+ * the reasons as their fallback. A clause stored as explicit null is a condition ruled to the run record
+ * alone, so its reason is not stated either; `undefined` (legacy/short) is not null. PURE.
+ */
+export function statedConditions({ reasons, clauses } = {}) {
+  const cs = Array.isArray(clauses) ? clauses : [];
+  const conds = (Array.isArray(reasons) ? reasons : []).filter((r, i) => cs[i] !== null).map((r) => String(r ?? "").trim()).filter(Boolean);
+  const cls = cs.map((c) => String(c ?? "").trim()).filter(Boolean);
+  return { conds, cls };
+}
+
 export function riskStatement({ tier, verdict, reasons, basis, clauses } = {}) {
   const v = String(verdict || "").toUpperCase();
   const t = String(tier || "").trim();
@@ -592,10 +604,13 @@ export function riskStatement({ tier, verdict, reasons, basis, clauses } = {}) {
   if (v === "CONDITIONAL") {
     // A clause stored as explicit null is a condition ruled to the run record alone: it is not the lede,
     // it is not counted, and its reason is never the fallback text. `undefined` (legacy/short) is not null.
-    const cs = Array.isArray(clauses) ? clauses : [];
-    const conds = (Array.isArray(reasons) ? reasons : []).filter((r, i) => cs[i] !== null).map((r) => String(r ?? "").trim()).filter(Boolean);
-    const cls = cs.map((c) => String(c ?? "").trim()).filter(Boolean);
-    const lede = cls[0] ?? conds[0] ?? "the open conditions carried in the report";
+    const { conds, cls } = statedConditions({ reasons, clauses });
+    // NOTHING STATED, NO "CONDITIONAL ON:" LINE (owner, 2026-09-19). When every condition is ruled to
+    // the run record, the line had nothing behind it and fell back to "the open conditions carried in the
+    // report": a conditional with no condition. The band word stands alone, and `stance` still says
+    // conditional to every consumer that keys on it.
+    if (!cls.length && !conds.length) return `${t}${basisNote ? `.${basisNote}` : ""}`;
+    const lede = cls[0] ?? conds[0];
     const first = clipClause(sentenceCaseLead(lede), STATEMENT_CLAUSE_MAX);
     const n = conds.length || cls.length;
     const more = n > 1 ? ` (and ${n - 1} more)` : "";
@@ -1228,7 +1243,7 @@ export function parseFindingsJsonLenient(raw, opts = {}) {
 // and drops the others, so a run's entire non-Latin field can collapse into one finding whose prose
 // describes one of them.
 //
-// The fix is 's, at a third site: keep the Latin normalisation exactly as it was where it produces
+// The fix, at a third site: keep the Latin normalisation exactly as it was where it produces
 // anything, and fall back to the RAW value (NFKC-folded, so full-width and compatibility forms of the
 // same characters still key alike) where it does not. Latin keys are byte-identical to before — pinned
 // by test, because a consolidation key that moved would re-merge every archived finding differently.
@@ -1721,7 +1736,7 @@ function validateNet(f, ord, mode) {
 // (publish/index.mjs strict-parses the archived findings.json), and a delivered matter would stop
 // republishing. So it engages at v7 and archived records parse byte-identically, forever.
 //
-// THE LENIENT PATH IS EXEMPT, for validateNetRequired's reason (/) and one of its own. Dropping a
+// THE LENIENT PATH IS EXEMPT, for validateNetRequired's reason and one of its own. Dropping a
 // finding because its sentence is shaped wrong would delete a real conflict over a punctuation mark —
 // silence arrived at by enforcing a rule about clarity. It also keeps the token out of pipeline.mjs's A3
 // per-finding salvage lane, which has nothing to salvage here (see the token's own note below).

package/driver/gateway.mjs

@@ -1146,7 +1146,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     // `resolveModel(model)` / `engine.resolveModelId(model)`, computed here without ever looking at the
     // provider's answer. So `--model gemini` logged `google/gemini-3.1-pro-preview` and ran sonnet (the
     // engine's alias table substituted, silently), a haiku stage that bounced to sonnet logged haiku,
-    // and every attribution downstream — the A/B arm's manifest, tokens.mjs' per-model rollup, 's
+    // and every attribution downstream — the A/B arm's manifest, tokens.mjs' per-model rollup, the
     // billing classes — was keyed to a model that had not run. Patching the log would not have fixed
     // it; the log was already saying what the code believed.
     //

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.2-beta.12",
+  "version": "0.3.2-beta.13",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline-knockout.mjs

@@ -540,7 +540,7 @@ export async function knockoutInner(ctx, job, opts = {}) {
       //
       // ONLY when the counter is the real provider. On fixtures or an injected counter the offices this
       // deployment can reach are not what the lane is talking to, and splitting on them would defer a
-      // register the fixture holds — a $0 lane reporting a gap it does not have (the shape 's
+      // register the fixture holds — a $0 lane reporting a gap it does not have (the shape a
       // sibling defect had, and the reason `missing` carries the same guard).
       const unreachable = countExec.source === "provider" ? registerUnavailableOffices(caps) : [];
       ctx.registerUnreachable = unreachable;

package/driver/pipeline.mjs

@@ -4818,7 +4818,7 @@ export function terminalReasonFields(reason, { cap = 200, fullCap = 4000 } = {})
 // `_driver/failure.json` carried reason/reasonVerbatim/failClass/terminalKind and no payload at all, so the
 // operator was told one query had dropped and never which one — E2E had to replay
 // findDroppedConnotationQueries against the preserved artifacts to name it. `reasonDetail` already reached
-// status.json (/); `reasonQuantity` reached neither file.
+// status.json; `reasonQuantity` reached neither file.
 //
 // Both are written UNCONDITIONALLY as string|null and number|null. Never omitted, never 0: "no key" and
 // "this failure carries no count" are different facts, the same distinction `reasonTruncated` is written on
@@ -7929,7 +7929,7 @@ export function buildAskAnswersSection(askAnswers, intakeAsks) {   // @internal
  * change to the delivered report nobody asked for. So the divergence is now one-country-only and owned,
  * rather than general and deferred.
  *
- * This section itself is untouched by the ladder: the grouping is not extended and not re-keyed. 's
+ * This section itself is untouched by the ladder: the grouping is not extended and not re-keyed. The
  * graded entries render in a SIBLING section (buildGradedEntriesSection) using the same line grammar.
  */
 export function buildReasonedNegativesSection(findings) {   // @internal
@@ -15696,8 +15696,8 @@ async function pipelineInner(job, opts = {}) {
     // — `reasonDetail` rides beside `reason`, never inside it. abbrev, not a bare slice: a cut that
     // reads as a word is worse than one that reads as a cut, and this one is read by an engineer
     // chasing a defect.
-    // — one spelling of the payload for BOTH sinks. status.json already carried `reasonDetail`
-    // (/); `_driver/failure.json` carried neither it nor the count, and `reasonQuantity` reached
+    // — one spelling of the payload for BOTH sinks. status.json already carried `reasonDetail`;
+    // `_driver/failure.json` carried neither it nor the count, and `reasonQuantity` reached
     // no file at all — so the operator read "dropped 1 dictated connotation query" and had to replay the
     // gate against the preserved artifacts to learn which one. Derived once here and passed to both
     // writers, so the notice and the status file can never disagree about the payload.

package/driver/placement-union.mjs

@@ -68,7 +68,7 @@ function indexRows(rows, { bySelection = true, uriLeg = true } = {}) {
 /**
  * Union the seat's tiers into what the driver already holds.
  *
- * THE RULE, and why it is that way round — identical to 's, for identical reasons:
+ * THE RULE, and why it is that way round — identical to coverage-union.mjs and disposition-union.mjs, for identical reasons:
  *   · a SUBMITTED row the gate would accept wins, so the seat can CORRECT itself;
  *   · otherwise a PRIOR row the gate would accept is kept, so a killed or cold attempt cannot destroy
  *     work already done;

package/driver/portal-mcp-client.mjs

@@ -76,7 +76,7 @@ function post(urlStr, { headers = {}, body = "", wantId = null, timeoutMs = 3000
         data += c;
         // SSE early-exit: once the frame with our id is complete, we have the answer — stop reading
         if (wantId != null && String(res.headers["content-type"] ?? "").includes("text/event-stream")
-            && new RegExp(`"id"\s*:\s*${wantId}`).test(data) && /\n\n/.test(data)) { res.destroy(); done(); }
+            && new RegExp(`"id"\\s*:\\s*${wantId}`).test(data) && /\n\n/.test(data)) { res.destroy(); done(); }
       });
       res.on("end", done);
       res.on("close", done);

package/driver/portal-report.mjs

@@ -850,7 +850,10 @@ export function sectionsOf(html) {
   if (!nav) return [];
   const out = [];
   for (const m of nav[1].matchAll(STRIP_LINK_RE)) {
-    const label = m[2].replace(/<[^>]*>/g, "").replace(/\s+/g, " ").trim();
+    // Stripped until nothing changes, so a tag that a first pass reassembles cannot survive into the label.
+    let label = m[2];
+    for (let prev = null; prev !== label;) { prev = label; label = label.replace(/<[^>]*>/g, ""); }
+    label = label.replace(/\s+/g, " ").trim();
     if (m[1] && label) out.push({ id: m[1], label });
   }
   return out;

package/driver/portal-service.mjs

@@ -179,6 +179,9 @@ import { accessAudience, audienceLabel } from "../shared/access-audience.mjs";
 import { resolveNumericSetting } from "./numeric-setting.mjs";   // — the same table the engine enforces, without the throw a rendering surface must not take
 import { isEntrypoint } from "../shared/is-entrypoint.mjs";   // — one entry-point test, all spellings
 import { deploymentBox } from "../shared/deployment-box.mjs";   // — the box names itself; one rule
+import { stageNow } from "./progress.mjs";   // the stage a live run is in now, for the card and the row
+// A run in one of these has finished; its step is the one its terminal write set, not the stage it last entered.
+const TERMINAL_STATES = new Set(["delivered", "failed", "cancelled"]);
 
 // The offering the portal menus build from — product-rows.mjs's row, unchanged.
 //
@@ -384,7 +387,7 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, gener
           stageLabel: stageLabelOf(meta.searchLevel) ?? meta.stageLabel ?? null,
           productName: productNameOf(meta.searchLevel),
           state: "delivered", date: meta.date ?? null,
-          // WHEN IT FINISHED, to the second (/). `date` is DAY precision and always was — it is
+          // WHEN IT FINISHED, to the second. `date` is DAY precision and always was — it is
           // parsed out of the run directory name. Two reads of one mark delivered on the same day
           // therefore TIE, Array.prototype.sort is stable, and which one the parent row spoke for was
           // decided by readdirSync order rather than by recency.
@@ -515,7 +518,11 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, gener
         resetsAt: typeof s.resetsAt === "string" ? s.resetsAt : null,
         // Elapsed, so a card can say how long this has been going without inventing a finish time.
         startedAt: typeof s.startedAt === "string" ? s.startedAt : null,
-        step: s.stepLabel ?? null, stepN: s.stepN ?? null, stepTotal: s.stepTotal ?? null,
+        // THE STAGE IT IS IN NOW, a step back into an earlier stage included (owner, 2026-09-19): see
+        // stageNow. Only while it is live; a run that has finished keeps the step its terminal write set.
+        ...(TERMINAL_STATES.has(s.state)
+          ? { step: s.stepLabel ?? null, stepN: s.stepN ?? null, stepTotal: s.stepTotal ?? null }
+          : stageNow(s)),
         // — a requested stop is a state the screen shows. Stamped by stop_run,
         // preserved by writeRunStatus's spread-merge, replaced by the terminal when the honour check
         // fires. The UI derives "Stopping…" from this beside a non-terminal state.
@@ -867,7 +874,7 @@ export const SERVER_ROUTE_HEADS = Object.freeze(["api", "report", "admin", "heal
  * `msgId` and `conversationId` sat in this list while `jobFor` hardcoded both to null and the trigger
  * hop stripped them off again. The totality test beside it could not see that: it asks whether every
  * declared field is classified, which a declared-and-nulled field satisfies perfectly. So the sentence
- * above asserted a behaviour and the test next to it checked a different one — the same shape as 's
+ * above asserted a behaviour and the test next to it checked a different one — the same shape as
  * "an invitation nothing honours", one level up.
  *
  * `stamped` exists so the new guard can be DERIVED rather than hand-listed. It splits `carries` into the
@@ -2928,7 +2935,7 @@ async function connectorDoorKind(url) {
         // row, and a retired-endpoint row is a different fact from a not-yours row. If an old open tab is
         // still clicking Flag, that is a thing worth being able to count.
         //
-        // WHAT IS DELIBERATELY STILL BELOW THIS LINE: the whole resolver — the two-lane shape, 's
+        // WHAT IS DELIBERATELY STILL BELOW THIS LINE: the whole resolver — the two-lane shape, the
         // disposition read, the server-side-locator rule. The owner ruled "disable services and any code",
         // and the acceptance criterion says re-enabling must be a switch and not a rebuild. Deleting 130
         // lines of hard-won doctrine would have made it a rebuild.
@@ -3759,7 +3766,12 @@ function doctrineStore(now = Date.now) {
   } catch (e) {
     // NOT `{head: null}` alone. A null head with no reason reads as "no store", which is a legal and
     // healthy state (`no-overlay`); this is a different thing and has to say so.
-    value = { head: null, situation: "unreadable", outcome: "blocked", detail: String(e?.message ?? e).slice(0, 120) };
+    //
+    // THE ERROR'S OWN WORDS GO TO THE SERVICE LOG, NOT THE WIRE. This answer is served by the health
+    // route, and an error message can carry the store's filesystem path. `unreadable` says what the
+    // caller needs; the operator reads why in the log.
+    console.error(`[portal] the instructions store could not be read: ${String(e?.message ?? e).slice(0, 200)}`);
+    value = { head: null, situation: "unreadable", outcome: "blocked" };
   }
   storeCache = { at: t, value };
   return value;

package/driver/predelivery-lint.mjs

@@ -30,7 +30,7 @@ import { partyFactSources, partyFactViolations, partyFactMessage, canJudgePartyF
 import { writeUpViolations, writeUpMessage } from "./narrative-write-ups.mjs";   //
 
 import { findRegistryArithmeticIssues, findRegistryViolations, splitBlocks } from "./registry-fidelity.mjs";
-import { CLIENT_TIER_BY_COMPOSITE, joinFindingToBlock, parseBlockOrd, worstLiveBand, NO_RATED_CONFLICTS, deriveActionConditions, isUnconditionalProceed, verdictStance, joinAskToAnswer, projectAssessmentField, POSITION_REQUIRED_DISPOSITIONS, OFF_FIELD_GROUNDS, FINDINGS_SCHEMA_VERSION, netChainMarkers, STATEMENT_CLAUSE_MAX } from "./findings-model.mjs";
+import { CLIENT_TIER_BY_COMPOSITE, joinFindingToBlock, parseBlockOrd, worstLiveBand, NO_RATED_CONFLICTS, deriveActionConditions, isUnconditionalProceed, verdictStance, statedConditions, joinAskToAnswer, projectAssessmentField, POSITION_REQUIRED_DISPOSITIONS, OFF_FIELD_GROUNDS, FINDINGS_SCHEMA_VERSION, netChainMarkers, STATEMENT_CLAUSE_MAX } from "./findings-model.mjs";
 import { normalizeBand } from "./framework.mjs";
 import { clientConditions, unrenderableConditions, ENGINE_TOKEN_RE } from "./terminal-clamp.mjs";   // the reader's clause per condition, and the token shape it may never carry
 import { knockoutNoteView, REQUEST_NOTE_WORDS, REQUEST_SUBJECT_WORDS } from "./findings-model.mjs";   // one reader for where a note prints
@@ -87,7 +87,7 @@ const REF_ALLOWLIST = new Set([
 const TERRITORY_VOCAB = new Set(Object.values(REGION_NAMES).map((n) => norm(n)));
 
 function stripHtml(s) {
-  return String(s ?? "").replace(/<[^>]+>/g, " ").replace(/&amp;/g, "&").replace(/&nbsp;/g, " ");
+  return String(s ?? "").replace(/<[^>]+>/g, " ").replace(/&nbsp;/g, " ").replace(/&amp;/g, "&");
 }
 
 // "April 2014", "MAY 2026" — dates pass the Title-Case-multi-word shape but are never entities.
@@ -2023,7 +2023,12 @@ export function statementCoherenceChecks({ verdictDoc }) {
       stanceOk ? "" : `verdict.json stance "${verdictDoc.stance}" does not match the verdict ${v || "(missing)"} (expected "${expected ?? "?"}") — the sidecar fields diverged; re-derive it (writeVerdictSidecar composes both from one record)`);
     if (!c3.pass) c3.structural = true;
     out.push(c3);
-    const formOk = verdictDoc.stance !== "conditional" || /—\s*conditional on:/.test(st);
+    // The form is owed only where something is stated: a conditional whose every condition was ruled to
+    // the run record carries the band word alone (riskStatement), and a "conditional on:" there would be
+    // the empty line the owner ruled off the page.
+    const stated = statedConditions({ reasons: verdictDoc.reasons, clauses: verdictDoc.clauses });
+    const nothingStated = !stated.cls.length && !stated.conds.length;
+    const formOk = verdictDoc.stance !== "conditional" || nothingStated || /—\s*conditional on:/.test(st);
     const c4 = check("statement-conditional-form", "verdict", "report", formOk,
       formOk ? "" : `a conditional-stance statement must state what conditions reliance ("<Tier> — conditional on: <facts>"), but reads "${st.slice(0, 80)}" — re-derive the sidecar`);
     if (!c4.pass) c4.structural = true;
@@ -2339,7 +2344,7 @@ export function runLint({ depth, commonLawGrid, matterContext, clientPartyName,
 // ── The KNOCKOUT lane's applicable subset (2026-07-31) ──────────────────────────────────────────────
 // The knockout (Stage 0/0.5) lane wrote NO predelivery-lint.json at all, by a decision recorded in
 // docs/DELIVERY.md (2026-07-28). That decision rested on two premises this tranche has since moved:
-// the lint artifact is now the WORKBOOK's QC record (/), so a lane that writes none produces an
+// the lint artifact is now the WORKBOOK's QC record, so a lane that writes none produces an
 // EMPTY QC record rather than a deliberately-absent one; and the A10 projects recorded defects onto
 // the cover note that reaches the reviewing lawyer, so a knockout defect reached nobody. What has NOT
 // moved is the other half of the memo: this lane's deliverable is store-rendered, and most clearance