clearotron 0.3.2-beta.12 → 0.3.2-beta.14

package/docs/decisions/0002-no-dark-functionality.md

@@ -60,7 +60,7 @@ Every `CLEAROTRON_*` name read by shipping code declares an effect class, and an
   whatever the declaration test enforces. Do not re-derive it by hand; that is how 172, 159 and 352 all
   came to describe the same repository.
 
-## Addendum — 2026-08-20, on implementation ( item 8)
+## Addendum — 2026-08-20, on implementation
 
 All four switches are deleted, as ruled. One consequence above is narrowed by what the code turned out
 to be, and it is recorded here rather than in a pull request body, because this document is what the

package/docs/decisions/0006-what-the-public-repository-carries.md

@@ -1,6 +1,6 @@
 # 0006 — What the public repository carries
 
-**Accepted 2026-08-17, by the owner.**
+**Accepted 2026-08-17.**
 
 ## Context
 
@@ -74,7 +74,7 @@ announces which mode it is in, once, so a reader of any run can tell which colum
 "change the code" is the clause it answers to and this repository's working practice is that agents change
 the code. `CLAUDE.md` is not carried: it was only ever a one-line pointer at `AGENTS.md`, a second copy of
 one subject is a future contradiction ([ADR-0004](0004-documentation-structure.md)), and the de-identified
-public cut names that file specifically. Ruled by the owner 2026-08-19, on the question raised against the
+public cut names that file specifically. Decided 2026-08-19, on the question raised against the
 recovery — where the two files had been held back because the revert that stripped them recorded no
 decision either way, and `shared/withheld-paths.mjs` did not cover them.
 
@@ -89,7 +89,7 @@ vendor-branded duplicate of it does not, however small.
   citations across code, comments, env examples and docs; all but six were rewritten, and the six declared
   are this record's own, where naming what is dropped is the content.
 - **A binding to a withheld document is retired.** `driver/doc-constants.mjs` pinned four prose figures in
-  `docs/KNOCKOUT.md` and `docs/REGISTER-HIT-COUNTS.md`; those rows are gone, and the test pinning 's
+  `docs/KNOCKOUT.md` and `docs/REGISTER-HIT-COUNTS.md`; those rows are gone, and the test pinning the
   one-file-states-it-twice case now anchors to the shape rather than to a named document.
 - **Withholding is reversible**, which is why this is a list rather than a `git rm`. This repository keeps
   every word.

package/driver/CHANGELOG.md

@@ -1,5 +1,26 @@
 # clearotron-driver
 
+## 0.3.2-beta.14
+
+### Patch Changes
+
+- Fixed: The lines for connecting an AI assistant now work when a folder name contains spaces, and the Codex settings block now works on Windows.
+- Fixed: The demo now opens by saying what it shows, without internal diagnostics or a Node warning, and its knockout sample states the rating it reached.
+- Fixed: A knockout report ordered for named countries now lists those countries under Registers counted, instead of a count of the provider's registers.
+
+## 0.3.2-beta.13
+
+### Patch Changes
+
+- Fixed: A conditional verdict whose conditions are all kept in the run record no longer shows an empty "conditional on" line. The rating word stands alone.
+- Fixed: A running clearance's card and row show the stage it is in now, including a step back during a correction pass.
+- Fixed: The portal's health check no longer includes an internal error message when the instructions store cannot be read. The message goes to the service log instead.
+- Fixed: `doctor` no longer describes another program on the client door's port as this install's door. It says only that a process holds the port.
+- Fixed: The connect lines name the exact Node your install runs on, and an older Node gets one plain line instead of a crash.
+- Fixed: The demo no longer leaves copies of its samples in your temp directory, including when it is stopped mid-way.
+- Fixed: Running the test suite no longer leaves demo copies in the machine's temporary directory.
+- Fixed: On WSL, the Windows connect line names your Linux distribution, or says plainly to fill it in, instead of leaving it out.
+
 ## 0.3.2-beta.12
 
 ### Patch Changes

package/driver/ask-ledger.mjs

@@ -170,7 +170,7 @@ function endingForQids(qids, join, ts) {
   return null;
 }
 
-/** The {ending, handoff} pair for one cross-check directive. Only `recall` is subject to 's
+/** The {ending, handoff} pair for one cross-check directive. Only `recall` is subject to the
  *  discharge rule; every other net keeps the ending it always had. PURE. */
 function recallEnding(name, qid, join, ts) {
   const ending = endingForQids([qid], join, ts);

package/driver/band-shape.mjs

@@ -769,7 +769,7 @@ export function buildBandShape(band, { targets = [], inScopeClasses = [], crowdC
 }
 
 const fmtN = (n) => Number(n ?? 0).toLocaleString("en-US");
-const cell = (v) => String(v ?? "").replace(/\|/g, "\\|").replace(/\s+/g, " ").trim() || "—";
+const cell = (v) => String(v ?? "").replace(/\\/g, "\\\\").replace(/\|/g, "\\|").replace(/\s+/g, " ").trim() || "—";
 
 // Bounded aggregate table: top rows by count, one honest remainder line — never for the floors.
 function topTable(md, title, cols, entries, cap = 30) {

package/driver/bundled-demos.mjs

@@ -3,8 +3,8 @@
 // bundled-demos.mjs — WHICH client bundles this repo ships, read from the directory that ships them.
 //
 // This was a hand-maintained triple. The directory grew a fourth bundle, the triple did not, and the
-// set-equality it feeds could no longer match anything — so the #83 detector, whose whole job is to
-// notice a door that has silently fallen back to the bundled roster, returned PASS on the #83
+// set-equality it feeds could no longer match anything — so the roster-fallback detector, whose whole job is to
+// notice a door that has silently fallen back to the bundled roster, returned PASS on exactly that
 // condition. A guard that cannot match reports that it found nothing wrong.
 //
 // The same shape had already produced two FALSE REFUSALS on this check, both from an exact match

package/driver/card-budget.mjs

@@ -74,13 +74,13 @@ function insertBulletAtSectionHead(text, headingRe, headingLine, bullet, { paren
   const m = text.match(headingRe);
   if (m) {
     const at = m.index + m[0].length;
-    return `${text.slice(0, at)}\n${bullet}\n${text.slice(at).replace(/^\n/, "\n")}`;
+    return `${text.slice(0, at)}\n${bullet}\n${text.slice(at)}`;
   }
   if (parentHeadingRe) {
     const p = text.match(parentHeadingRe);
     if (p) {
       const at = p.index + p[0].length;
-      return `${text.slice(0, at)}\n${headingLine}\n\n${bullet}\n${text.slice(at).replace(/^\n/, "\n")}`;
+      return `${text.slice(0, at)}\n${headingLine}\n\n${bullet}\n${text.slice(at)}`;
     }
     return `${text.replace(/\s*$/, "")}\n\n${parentHeadingLine}\n\n${headingLine}\n\n${bullet}\n`;
   }

package/driver/case-law-ledger.mjs

@@ -114,8 +114,8 @@ export function parseCaseLawLedger(raw) {
 /**
  * The census a reader (and a scenario) asks the ledger for. PURE, and it never judges.
  *
- * `readByTerritory` is the one that answers the depth-dive condition: a dive names ONE territory
- * (/), so "did this dive read anything in its own territory" is a lookup, not an inference.
+ * `readByTerritory` is the one that answers the depth-dive condition: a dive names ONE territory,
+ * so "did this dive read anything in its own territory" is a lookup, not an inference.
  */
 export function caseLawRetrievalCensus(ledger) {
   const queries = ledger?.queries ?? [];

package/driver/connotation-search.mjs

@@ -1363,7 +1363,7 @@ export function parseDispositionForm(raw) {
 // EVERY OBLIGATION SHIPS. No head(), no slice(), no "…and N more". The register-digest sibling
 // (gateway.mjs deferredSlicesRequiredRows) printed the first six qids per axis and elided the rest, and its
 // own doc block records what that cost: "Under advice that is an economy; under a requirement it makes
-// compliance impossible." Same rule here, and 's: a value a model must copy is complete, or it is
+// compliance impossible." Same rule here: a value a model must copy is complete, or it is
 // visibly marked as cut. Nothing below is cut, so nothing below is marked.
 /**
  * The obligation set as the seat's own to-do list, for the tool result. Returns "" when nothing is owed —
@@ -1375,7 +1375,7 @@ export function renderConnotationObligations(ob, { ledgerPath = "your half ledge
   // ── — THE PAGE IS NUMBERED OFF THE SAME FUNCTION THAT RESOLVES THE NUMBER ─────────────────
   //
   // `obligationRows` is the driver's row list, and a `row_index` is a position into it. Numbering this
-  // page with its own counter would be two derivations of one ordering, which is the mistake 's
+  // page with its own counter would be two derivations of one ordering, which is the mistake the
   // segment display already names in its own comment: "the display and the check cannot disagree, which
   // they would the moment either recomputed its own split". So the numbers come from the list itself.
   //
@@ -1610,7 +1610,7 @@ export function renderDispositionTable(rows, ob) {
   for (const e of ob?.queries ?? []) for (const r of e.results) if (r.id) byId.set(normId(r.id), r);
   // — the rows are the FORM's, and a row the seat never ruled on has nothing to render: it is
   // outstanding work, which the gate reports as a count, not a table row reading "—".
-  const cell = (s) => String(s ?? "").replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
+  const cell = (s) => String(s ?? "").replace(/\\/g, "\\\\").replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
   const usable = (rows ?? []).filter((d) => d?.receipt_id && d?.ruling);
   // ── — A PARKED ROW IS NOT AN OUTSTANDING ROW, AND THE FILTER ABOVE STOPPED BEING SAFE ─────────
   //
@@ -1683,7 +1683,7 @@ const NO_POLICED_SECTION = "(no PR / reputational / connotation section)";
 //     id that is not among THAT row's own candidates — the driver wrote those ids, so this is a damaged
 //     form, not outstanding work, and its remedy is different.
 //   undisposed_cite_too_short   deleted — cannot occur; nothing is retyped.
-//   recurrent_uncited_form      deleted — the form has no shape for the seat to get wrong. 's
+//   recurrent_uncited_form      deleted — the form has no shape for the seat to get wrong. The old
 //     cited-but-unbound state was a property of PROSE (right page, wrong query string on the line); a
 //     form row IS its binding, so the state has no representative.
 //   no_source_cite              deleted — advisory, prose-only, never reached a token.
@@ -1786,7 +1786,7 @@ export const CONNOTATION_FORM_REASONS = Object.freeze(
  *
  * `quote_unbound` and `form_damaged` are deliberately absent: those rows ARE ruled.
  *
- * `parked` (/) is absent for the opposite reason and it is the load-bearing one: a parked row
+ * `parked` is absent for the opposite reason and it is the load-bearing one: a parked row
  * is NOT ruled, and it is not outstanding either. Outstanding means "the seat still owes this", and the
  * whole point of the park is that the seat has been told to stop — leaving it here would keep the stage
  * failing forever on a row nobody may re-send, which is the deterministic death the park introduced.

package/driver/contract-e3-backlog.mjs

@@ -456,7 +456,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3182",
     surface: "stage-message",
     evidence: "MACHINE FINDINGS (MANDATORY): … a JSON OBJECT {\"schema_version\":<FINDINGS_SCHEMA_VERSION>,\"rated_under_framework\":\"…\",\"findings\":[...],\"coverage\":[...],\"context_notes\":[...],\"actions\":[...],\"ask_answers\":[...]} … Each finding object has EXACTLY these keys: {\"ordinal\",\"mark\",\"owner\",\"band\",\"net\",\"bor",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson via validators.narrative",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson via validators.narrative",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   // RETIRED 2026-08-16 — synthesis's dictated disposition list, and I am the one who left it standing.
@@ -479,7 +479,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3219",
     surface: "stage-message",
     evidence: "- manageable …: {\"category\":\"<EXACTLY one of large-competitor / commercial-partner / troll / well-known-enforcer>\",\"reason\":\"<one-two lines…>\"}",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -488,7 +488,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3235",
     surface: "stage-message",
     evidence: "- meters: {\"mark_similarity\":{...},\"goods_proximity\":{...},\"use\":{...},\"enforcer\":{...}} — all four present, each {\"token\",\"basis\",\"source\"}. … mark_similarity = high | medium | low. goods_proximity = high | medium | low. enforcer = high | medium | low | unknown. use = confirmed | not-confirmed | un",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; driver/verify.mjs:1171 checkFindingsSibling gates meters.*.source; finding_basis_source_missing",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson; driver/verify.mjs:1171 checkFindingsSibling gates meters.*.source; finding_basis_source_missing",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -497,7 +497,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3236",
     surface: "stage-message",
     evidence: "- quadrant: {\"x\",\"y\"} numbers in [0,1]. x = goods/services proximity (0 = distant, 1 = identical). y = mark similarity (0 = distinct, 1 = identical).",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -506,7 +506,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3237",
     surface: "stage-message",
     evidence: "- source: {\"source_type\",\"resolved_link\"}. source_type EXACTLY one of: register-vendor / register-euipo / common-law-marketplace / common-law-web / case-law",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson",
     removedByMove: "M1 removes the opaque `resolved_link` URI (ordinal / record-handle selection); the object shape and the source_type enum survive",
   },
   {
@@ -515,7 +515,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3238",
     surface: "stage-message",
     evidence: "coverage[]: ONE object per coverage AREA, EXACTLY {\"area\",\"state\",\"note\"}. … state EXACTLY one of: confirmed-clean / coverage-limited / open / not-searched / note.",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; the render owns the coverage panel from these typed states",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson; the render owns the coverage panel from these typed states",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -533,7 +533,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3304",
     surface: "stage-message",
     evidence: "MARK ASSESSMENT … STRUCTURED FORM …: either field may instead be an OBJECT {\"read\":\"…\",\"spectrum\":\"…\",\"per_class\":[{\"class\":\"5\",\"note\":\"…\"}],\"per_market\":[{\"market\":\"CN\",\"note\":\"…\"}],\"counter_registrations\":[{\"mark\":\"…\",\"uri\":\"/mark/…\",\"note\":\"…\"}],\"acquired\":\"<optional>\",\"note\":\"<optional residual>",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; the report collapses the rows behind toggles and the audit workbook renders them",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson; the report collapses the rows behind toggles and the audit workbook renders them",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -542,7 +542,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3310",
     surface: "stage-message",
     evidence: "FOUR ANSWERS …: \"four_answers\": {\"third_party_rights\":{...},\"objection_likelihood\":{...},\"registrability\":{...},\"client_enforceability\":{...}} … Each answer … is {\"read\":\"…\",\"token\":\"…\",\"basis\":\"…\",\"ordinals\":[…]}. Tokens (closed enums …): third_party_rights = strong|moderate|weak; objection_likelih",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -551,7 +551,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3221",
     surface: "stage-message",
     evidence: "ACTIONS REGISTER …: emit \"actions\": [...] — ONE object per forward step …, each EXACTLY {\"id\",\"kind\",\"text\",\"ordinals\"} plus an OPTIONAL \"deadline\" and an OPTIONAL \"condition\". … kind: EXACTLY one of — consent / coexistence-agreement / territorial-delimitation / goods-amendment / mark-modification /",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; pipeline applyCoverageFloor legalActions arm derives the delivered disposition from the closed kind enum",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson; pipeline applyCoverageFloor legalActions arm derives the delivered disposition from the closed kind enum",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -560,7 +560,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3317",
     surface: "stage-message",
     evidence: "COVERAGE JUDGMENT …: emit \"coverage_judgment\": {\"sufficient\":<bool>, \"reason\":\"<one line…>\"} — EXACTLY those two keys. Do NOT emit \"rows\": the driver writes that register itself … anything you type there is replaced wholesale.",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson. The \"Do NOT emit rows\" clause is the purest E3 case in the tree — the prompt names a field, dictates its shape and states in the same breath that code overwrites it",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson. The \"Do NOT emit rows\" clause is the purest E3 case in the tree — the prompt names a field, dictates its shape and states in the same breath that code overwrites it",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -575,7 +575,7 @@ export const E3_BACKLOG = [
     // in E3_EVIDENCE_UNRESOLVED instead would have grown the not-checked slice for a row that is
     // perfectly checkable, which is the avoidable coverage loss conversion 9's note names one row up.
     evidence: "SEND ONE \"ask_answers\" ENTRY PER ASK, as a TOP-LEVEL field of the findings record you hand to the call (never as a narrative section — the driver renders the labelled line",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson (finding_ask_answer_answer_missing); assembleReportMd · buildAskAnswersSection joins on the retyped ask string",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson (finding_ask_answer_answer_missing); assembleReportMd · buildAskAnswersSection joins on the retyped ask string",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   // DELETED at conversion 10, recorded rather than absorbed — E3's own rule for a
@@ -611,7 +611,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3296",
     surface: "stage-message",
     evidence: "add it to the top-level \"context_notes\" array — each object EXACTLY {\"type\":\"famous-neighbour-ungrounded\",\"mark\",\"owner\",\"context\"}",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -620,7 +620,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3184",
     surface: "stage-message",
     evidence: "- owner: {\"name\",\"country\",\"registrations\":[...]}. … Each registration: {\"uri\", optionally \"classes\":[\"9\",\"41\"],\"status\",\"filed\",\"expiry\",\"jurisdiction\"}. The \"uri\" is the ONLY field that matters: the driver BINDS classes/status/filed/expiry/jurisdiction AND the owner name from the FETCHED record ke",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson + the record-binding join. Six of the seven keys are stated in the prompt and overwritten by code in the same sentence",
+    reparsedBy: "driver/findings-model.mjs:844 parseFindingsJson + the record-binding join. Six of the seven keys are stated in the prompt and overwritten by code in the same sentence",
     removedByMove: "M1 removes the opaque `uri` (ordinal / record-handle selection against the band); the object skeleton and the five overwritten keys survive",
   },
   {

package/driver/coverage-form.mjs

@@ -13,7 +13,7 @@
 // PASS; ~86% of emitted tokens landed in no artifact, and the attempt that passed is the one that
 // PATCHED). A cold ladder never patches.
 //
-// THE CURE IS 's, one gate over: the driver writes the row and the model fills in the judgment. The
+// THE CURE IS THE ONE APPLIED ONE GATE OVER: the driver writes the row and the model fills in the judgment. The
 // axis, the coverage unit, the open crowd blocks with their qids and hit counts, and the deferred slices
 // with their per-qid receipt reasons are all facts the driver holds BEFORE the stage dispatches. It
 // writes them. The seat sets `status` and `reason`, and nothing else in the file is the seat's to write.
@@ -856,7 +856,7 @@ export function findCoverageFormViolations(rows, formError = null) {
 // kind and nothing in it is a string the model had to copy. parseCoverageLedgerFull survives, but only as
 // the ARCHIVED-RUN reader (loadCoverageLedger's prose fallback): no gate parses this table any more.
 
-const cell = (s) => String(s ?? "").replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
+const cell = (s) => String(s ?? "").replace(/\\/g, "\\\\").replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
 
 /** The `## Coverage ledger` section, rendered from the form's rows. "" when nothing is settled. PURE. */
 export function renderCoverageLedgerSection(rows) {

package/driver/demo-container.mjs

@@ -97,6 +97,30 @@ export function prepareSample(dir, { repoRoot, tmp } = {}) {
 }
 
 
+/**
+ * THE COPIES GO WHEN THEIR PUBLISH IS DONE, AND AT EXIT WHATEVER HAPPENED.
+ *
+ * Every copy below is made in the system temp directory and nothing removed it: four per `demo --once`,
+ * one per demo start, some a full replayed run of about 1,850 files, and 36 GB of them on one machine
+ * (measured 2026-09-19). Each root is recorded as it is made. A caller releases them the moment its
+ * publish is done, and an exit hook removes whatever is left, on success and on failure. A caller that
+ * can be stopped by a signal turns the signal into an exit, so the hook runs then too.
+ */
+const copies = new Set();
+let exitHooked = false;
+function tracked(root) {
+  copies.add(root);
+  if (!exitHooked) { exitHooked = true; process.once("exit", releaseDemoCopies); }
+  return root;
+}
+/** Remove every copy made so far. Safe to call more than once. */
+export function releaseDemoCopies() {
+  for (const d of [...copies]) {
+    try { rmSync(d, { recursive: true, force: true }); } catch { /* going anyway; the exit hook tries again */ }
+    copies.delete(d);
+  }
+}
+
 /**
  * The directory a frozen demo should be PUBLISHED from — itself, or a copy when it is part of this tree.
  *
@@ -117,7 +141,7 @@ export function publishSource(dir, { repoRoot, tmp = tmpdir() } = {}) {
   const root = resolve(repoRoot ?? "");
   const here = resolve(dir);
   if (!root || !(here === root || here.startsWith(root + sep))) return dir;
-  const copy = join(mkdtempSync(join(tmp, "clearotron-demo-")), "sample");
+  const copy = join(tracked(mkdtempSync(join(tmp, "clearotron-demo-"))), "sample");
   cpSync(here, copy, { recursive: true });
   return copy;
 }
@@ -135,7 +159,7 @@ export function publishContainer(root, { repoRoot, tmp = tmpdir() } = {}) {
   const repo = resolve(repoRoot ?? "");
   const here = resolve(root);
   if (!repo || !(here === repo || here.startsWith(repo + sep))) return { dir: root, unusable: demoInventory(root).unusable };
-  const copy = join(mkdtempSync(join(tmp, "clearotron-demo-")), "sample");
+  const copy = join(tracked(mkdtempSync(join(tmp, "clearotron-demo-"))), "sample");
   mkdirSync(copy, { recursive: true });
   const { children, unusable } = demoInventory(here);
   const left = [...unusable];

package/driver/disposition-tool.mjs

@@ -288,8 +288,8 @@ export function callsSoFar(dispositionsPath) {
 export { PARK_AFTER_REFUSALS };
 
 /**
- * Which rows have been refused past the bound. PURE, and counted PER ROW ACROSS CALLS — the unit 's
- * own banner records an earlier investigation dying on, when it joined per-row-final-state instead.
+ * Which rows have been refused past the bound. PURE, and counted PER ROW ACROSS CALLS — the unit this
+ * module's own banner records an earlier investigation dying on, when it joined per-row-final-state instead.
  *
  * A row that is ruled later is never re-parked, because the union only parks rows that are not ruled.
  * @returns {string[]} row_ids, sorted, so the same ledger always yields the same answer.

package/driver/engine/CONTRACT.md

@@ -145,7 +145,7 @@ Stages must name **abstract tiers**, not provider aliases. Per-engine maps:
 | `sweep` | register-unit, case-law, skeptic, report-overview, report-card | `sonnet` | `$CLEAROTRON_OPENAI_MODEL_SWEEP` |
 | `cheap` | saturation-probe | `haiku` | `$CLEAROTRON_OPENAI_MODEL_CHEAP` |
 
-**AN UNHONOURED OVERRIDE IS AN ERROR, NOT A SUBSTITUTION** ( corruption 3, 2026-08-03). This
+**AN UNHONOURED OVERRIDE IS AN ERROR, NOT A SUBSTITUTION** (2026-08-03). This
 section used to declare two further tiers — `skeptic` → `google/gemini-3-flash-preview` and
 `refutation` → `together/deepseek-ai/DeepSeek-V4-Pro` — each substituting an anthropic model on the
 anthropic engine, "grade-moving, validated only in the paid A/B". The substitution never was validated
@@ -191,7 +191,7 @@ disarms the refusal and never the record.
 | `max` | `max` | `xhigh` |
 
 `off` used to map to `minimal` on codex and `low` on claude — a whole rung apart at the bottom, so a
-cross-engine effort comparison at `off` was off by one ( corruption 4a).`low` is the anthropic
+cross-engine effort comparison at `off` was off by one. `low` is the anthropic
 floor, so codex came up to it and codex's `minimal` is deliberately unreachable from the driver's tier
 vocabulary. `max` is the one sanctioned divergence: it means "this engine's top rung", and codex has no
 `max`. `engine.anthropic.test.mjs` pins the two tables together and asserts that single exception.
@@ -200,7 +200,7 @@ vocabulary. `max` is the one sanctioned divergence: it means "this engine's top
 (`assertEffectiveTier`), on the EFFECTIVE tier rather than the declared one: Haiku 4.5 rejects adaptive
 thinking and the request bounces to sonnet, so the pairing measures sonnet and records haiku. Both ways
 it can arise are runtime overrides that never touch the stage table (`CLEAROTRON_STAGE_THINKING`, an
-`--experiment --model`), which is why the start-of-run scan alone could not see it ( corruption 4b).
+`--experiment --model`), which is why the start-of-run scan alone could not see it.
 
 ## 4. `claude -p` invocation (anthropic-agent)
 

package/driver/engine/mcp/codex-config.mjs

@@ -5,6 +5,7 @@
 // exact server/tool wiring. Two inputs, both produced today by the gateway gather block:
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
+import { tomlString } from "../../../shared/toml-string.mjs";
 
 //   • mcpConfig     — the claude-shaped JSON string `{mcpServers:{name:{command,args,env,connectionTimeoutMs?}}}`
 //                     (buildGatherMcpConfig → JSON.stringify)
@@ -36,17 +37,8 @@ export const CRED_ENV_FORWARD = [
 ];
 
 // ── TOML value escaping (basic strings) ──────────────────────────────────────────────────────────────
-export function tomlString(s) {
-  const str = String(s ?? "");
-  // TOML basic-string escapes: backslash, double-quote, and the C0 controls TOML names (\b \t \n \f \r).
-  const esc = str
-    .replace(/\\/g, "\\\\").replace(/"/g, '\\"')
-    .replace(/\x08/g, "\\b").replace(/\t/g, "\\t").replace(/\n/g, "\\n")
-    .replace(/\f/g, "\\f").replace(/\r/g, "\\r")
-    // any remaining control char → \uXXXX (TOML-legal)
-    .replace(/[\x00-\x1f]/g, (c) => "\\u" + c.charCodeAt(0).toString(16).padStart(4, "0"));
-  return `"${esc}"`;
-}
+// One encoder for every TOML block the product writes; re-exported so this module's callers keep their import.
+export { tomlString };
 function tomlStringArray(arr) {
   return "[" + (arr || []).map(tomlString).join(", ") + "]";
 }

package/driver/engine/mcp/gather-config.mjs

@@ -212,7 +212,7 @@ const RECORDING = Object.freeze({
   // SECOND — skeptic, same shape ( is the template). Its OWN key, so blind-frame's seat is never
   // handed record_skeptic and skeptic is never handed record_blind_frame.
   //
-  // skeptic's key carries a SECOND tool: search_run_artifacts, the sanctioned read surface ('s
+  // skeptic's key carries a SECOND tool: search_run_artifacts, the sanctioned read surface (the
   // ratification hold, unlock path 1). A READ over the run's own tree, not retrieval — it dials nothing,
   // writes nothing, and is bounded to CLEAROTRON_BAND_RUN_DIR by construction (skeptic-search.mjs). It
   // replaces the artifact half of the Bash reads O3c measured; the skill-doc half was already the seeded

package/driver/engine/openai-agent.mjs

@@ -60,8 +60,8 @@ const codexBin = () => { const r = resolveEngineProgram("openai-agent"); return
 // 3 stage families, and BYTE-IDENTICALLY on retry. That was true of that code and that CLI.
 //
 // What has changed is not the measurement but everything around it: three weeks of stage-contract
-// work, and a codex CLI that has moved several minor versions. The ruling above supersedes 's
-// conclusion; it does not erase its evidence. A reader who finds first must be able to get here.
+// work, and a codex CLI that has moved several minor versions. The ruling above supersedes the measurement's
+// conclusion; it does not erase its evidence. A reader who finds the measurement first must be able to get here.
 //
 // ── HOW A REGRESSION ANNOUNCES ITSELF — no experiment is scheduled, and none is needed ────────────
 //

package/driver/findings-model.mjs

@@ -578,6 +578,18 @@ const clipClause = (s, max) => {
  * count authority and the fallback. Returns null when either axis is missing (legacy sidecars —
  * callers fall back to today's bare word). PURE.
  */
+/**
+ * The conditions a client is actually told a CONDITIONAL verdict rests on: the client-voice clauses, and
+ * the reasons as their fallback. A clause stored as explicit null is a condition ruled to the run record
+ * alone, so its reason is not stated either; `undefined` (legacy/short) is not null. PURE.
+ */
+export function statedConditions({ reasons, clauses } = {}) {
+  const cs = Array.isArray(clauses) ? clauses : [];
+  const conds = (Array.isArray(reasons) ? reasons : []).filter((r, i) => cs[i] !== null).map((r) => String(r ?? "").trim()).filter(Boolean);
+  const cls = cs.map((c) => String(c ?? "").trim()).filter(Boolean);
+  return { conds, cls };
+}
+
 export function riskStatement({ tier, verdict, reasons, basis, clauses } = {}) {
   const v = String(verdict || "").toUpperCase();
   const t = String(tier || "").trim();
@@ -592,10 +604,13 @@ export function riskStatement({ tier, verdict, reasons, basis, clauses } = {}) {
   if (v === "CONDITIONAL") {
     // A clause stored as explicit null is a condition ruled to the run record alone: it is not the lede,
     // it is not counted, and its reason is never the fallback text. `undefined` (legacy/short) is not null.
-    const cs = Array.isArray(clauses) ? clauses : [];
-    const conds = (Array.isArray(reasons) ? reasons : []).filter((r, i) => cs[i] !== null).map((r) => String(r ?? "").trim()).filter(Boolean);
-    const cls = cs.map((c) => String(c ?? "").trim()).filter(Boolean);
-    const lede = cls[0] ?? conds[0] ?? "the open conditions carried in the report";
+    const { conds, cls } = statedConditions({ reasons, clauses });
+    // NOTHING STATED, NO "CONDITIONAL ON:" LINE (owner, 2026-09-19). When every condition is ruled to
+    // the run record, the line had nothing behind it and fell back to "the open conditions carried in the
+    // report": a conditional with no condition. The band word stands alone, and `stance` still says
+    // conditional to every consumer that keys on it.
+    if (!cls.length && !conds.length) return `${t}${basisNote ? `.${basisNote}` : ""}`;
+    const lede = cls[0] ?? conds[0];
     const first = clipClause(sentenceCaseLead(lede), STATEMENT_CLAUSE_MAX);
     const n = conds.length || cls.length;
     const more = n > 1 ? ` (and ${n - 1} more)` : "";
@@ -1228,7 +1243,7 @@ export function parseFindingsJsonLenient(raw, opts = {}) {
 // and drops the others, so a run's entire non-Latin field can collapse into one finding whose prose
 // describes one of them.
 //
-// The fix is 's, at a third site: keep the Latin normalisation exactly as it was where it produces
+// The fix, at a third site: keep the Latin normalisation exactly as it was where it produces
 // anything, and fall back to the RAW value (NFKC-folded, so full-width and compatibility forms of the
 // same characters still key alike) where it does not. Latin keys are byte-identical to before — pinned
 // by test, because a consolidation key that moved would re-merge every archived finding differently.
@@ -1721,7 +1736,7 @@ function validateNet(f, ord, mode) {
 // (publish/index.mjs strict-parses the archived findings.json), and a delivered matter would stop
 // republishing. So it engages at v7 and archived records parse byte-identically, forever.
 //
-// THE LENIENT PATH IS EXEMPT, for validateNetRequired's reason (/) and one of its own. Dropping a
+// THE LENIENT PATH IS EXEMPT, for validateNetRequired's reason and one of its own. Dropping a
 // finding because its sentence is shaped wrong would delete a real conflict over a punctuation mark —
 // silence arrived at by enforcing a rule about clarity. It also keeps the token out of pipeline.mjs's A3
 // per-finding salvage lane, which has nothing to salvage here (see the token's own note below).

package/driver/gateway.mjs

@@ -1146,7 +1146,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     // `resolveModel(model)` / `engine.resolveModelId(model)`, computed here without ever looking at the
     // provider's answer. So `--model gemini` logged `google/gemini-3.1-pro-preview` and ran sonnet (the
     // engine's alias table substituted, silently), a haiku stage that bounced to sonnet logged haiku,
-    // and every attribution downstream — the A/B arm's manifest, tokens.mjs' per-model rollup, 's
+    // and every attribution downstream — the A/B arm's manifest, tokens.mjs' per-model rollup, the
     // billing classes — was keyed to a model that had not run. Patching the log would not have fixed
     // it; the log was already saying what the code believed.
     //

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.2-beta.12",
+  "version": "0.3.2-beta.14",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline-knockout.mjs

@@ -540,7 +540,7 @@ export async function knockoutInner(ctx, job, opts = {}) {
       //
       // ONLY when the counter is the real provider. On fixtures or an injected counter the offices this
       // deployment can reach are not what the lane is talking to, and splitting on them would defer a
-      // register the fixture holds — a $0 lane reporting a gap it does not have (the shape 's
+      // register the fixture holds — a $0 lane reporting a gap it does not have (the shape a
       // sibling defect had, and the reason `missing` carries the same guard).
       const unreachable = countExec.source === "provider" ? registerUnavailableOffices(caps) : [];
       ctx.registerUnreachable = unreachable;

package/driver/pipeline.mjs

@@ -4818,7 +4818,7 @@ export function terminalReasonFields(reason, { cap = 200, fullCap = 4000 } = {})
 // `_driver/failure.json` carried reason/reasonVerbatim/failClass/terminalKind and no payload at all, so the
 // operator was told one query had dropped and never which one — E2E had to replay
 // findDroppedConnotationQueries against the preserved artifacts to name it. `reasonDetail` already reached
-// status.json (/); `reasonQuantity` reached neither file.
+// status.json; `reasonQuantity` reached neither file.
 //
 // Both are written UNCONDITIONALLY as string|null and number|null. Never omitted, never 0: "no key" and
 // "this failure carries no count" are different facts, the same distinction `reasonTruncated` is written on
@@ -7929,7 +7929,7 @@ export function buildAskAnswersSection(askAnswers, intakeAsks) {   // @internal
  * change to the delivered report nobody asked for. So the divergence is now one-country-only and owned,
  * rather than general and deferred.
  *
- * This section itself is untouched by the ladder: the grouping is not extended and not re-keyed. 's
+ * This section itself is untouched by the ladder: the grouping is not extended and not re-keyed. The
  * graded entries render in a SIBLING section (buildGradedEntriesSection) using the same line grammar.
  */
 export function buildReasonedNegativesSection(findings) {   // @internal
@@ -15696,8 +15696,8 @@ async function pipelineInner(job, opts = {}) {
     // — `reasonDetail` rides beside `reason`, never inside it. abbrev, not a bare slice: a cut that
     // reads as a word is worse than one that reads as a cut, and this one is read by an engineer
     // chasing a defect.
-    // — one spelling of the payload for BOTH sinks. status.json already carried `reasonDetail`
-    // (/); `_driver/failure.json` carried neither it nor the count, and `reasonQuantity` reached
+    // — one spelling of the payload for BOTH sinks. status.json already carried `reasonDetail`;
+    // `_driver/failure.json` carried neither it nor the count, and `reasonQuantity` reached
     // no file at all — so the operator read "dropped 1 dictated connotation query" and had to replay the
     // gate against the preserved artifacts to learn which one. Derived once here and passed to both
     // writers, so the notice and the status file can never disagree about the payload.

package/driver/placement-union.mjs

@@ -68,7 +68,7 @@ function indexRows(rows, { bySelection = true, uriLeg = true } = {}) {
 /**
  * Union the seat's tiers into what the driver already holds.
  *
- * THE RULE, and why it is that way round — identical to 's, for identical reasons:
+ * THE RULE, and why it is that way round — identical to coverage-union.mjs and disposition-union.mjs, for identical reasons:
  *   · a SUBMITTED row the gate would accept wins, so the seat can CORRECT itself;
  *   · otherwise a PRIOR row the gate would accept is kept, so a killed or cold attempt cannot destroy
  *     work already done;

package/driver/portal-mcp-client.mjs

@@ -76,7 +76,7 @@ function post(urlStr, { headers = {}, body = "", wantId = null, timeoutMs = 3000
         data += c;
         // SSE early-exit: once the frame with our id is complete, we have the answer — stop reading
         if (wantId != null && String(res.headers["content-type"] ?? "").includes("text/event-stream")
-            && new RegExp(`"id"\s*:\s*${wantId}`).test(data) && /\n\n/.test(data)) { res.destroy(); done(); }
+            && new RegExp(`"id"\\s*:\\s*${wantId}`).test(data) && /\n\n/.test(data)) { res.destroy(); done(); }
       });
       res.on("end", done);
       res.on("close", done);

package/driver/portal-report.mjs

@@ -850,7 +850,10 @@ export function sectionsOf(html) {
   if (!nav) return [];
   const out = [];
   for (const m of nav[1].matchAll(STRIP_LINK_RE)) {
-    const label = m[2].replace(/<[^>]*>/g, "").replace(/\s+/g, " ").trim();
+    // Stripped until nothing changes, so a tag that a first pass reassembles cannot survive into the label.
+    let label = m[2];
+    for (let prev = null; prev !== label;) { prev = label; label = label.replace(/<[^>]*>/g, ""); }
+    label = label.replace(/\s+/g, " ").trim();
     if (m[1] && label) out.push({ id: m[1], label });
   }
   return out;