clearotron 0.3.2-beta.13 → 0.3.2-beta.15

package/bin/clearotron.mjs

@@ -25,6 +25,7 @@ import { isEntrypoint } from "../shared/is-entrypoint.mjs";
 import { nodeFloorVerdict, nodeFloorRefusal } from "../shared/node-floor.mjs";   // — one floor, read from package.json
 import { invocationPrefix } from "../shared/invocation.mjs";   // — print a command the reader can type
 import { watchParent } from "../shared/parent-watch.mjs";
+import { EXPERIMENTAL_WARNING_OFF } from "../shared/demo-start-args.mjs";
 
 export const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -193,7 +194,12 @@ const [verb, ...rest] = process.argv.slice(2);
   // — tell the child how the READER reached us, so its own advice names a command they can type.
   // Without this every spawned verb sees argv[1] = its own implementation file and would print `npx`
   // even for somebody who typed a bare `clearotron`.
-  const child = spawn(process.execPath, [target, ...builtin, ...rest], {
+  // THE DEMO RUNS WITHOUT NODE'S EXPERIMENTAL-FEATURE WARNING. Node prints one the first time anything loads
+  // its built-in SQLite, and on the demo it landed on the first screen, above the sentence saying what the
+  // demo is. A flag on the demo's own process; `bin/example.mjs` hands it on to the services it starts
+  // (EXPERIMENTAL_WARNING_OFF). Every other warning still prints.
+  const quiet = verb === "demo" ? [EXPERIMENTAL_WARNING_OFF] : [];
+  const child = spawn(process.execPath, [...quiet, target, ...builtin, ...rest], {
     stdio: "inherit",
     env: { ...process.env, CLEAROTRON_INVOKED_AS: process.argv[1] ?? "" },
   });

package/bin/example.mjs

@@ -38,7 +38,7 @@ import "../shared/env-local.mjs";   // step 4 / — FIRST: this program read a
 // handed it nothing and the read fell through to a default. Proven both ways from one
 // environment: without this import the value is invisible, with it the retired spelling is
 // back-filled. Placed above every other import because a side-effecting import runs in order.
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { appendFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { removeDirectory } from "../shared/os-advice.mjs";
 import { invoke } from "../shared/invocation.mjs";   // — the printed command is resolved once, for the reader who is actually standing there
@@ -53,7 +53,7 @@ import { ensureDemoProgram, demoProgramEnv } from "../shared/permanent-install.m
 const REPO = join(dirname(fileURLToPath(import.meta.url)), "..");
 
 import { usageBlock } from "../shared/usage-block.mjs";
-import { demoStartArgs } from "../shared/demo-start-args.mjs";
+import { demoStartArgs, withWarningOff } from "../shared/demo-start-args.mjs";
 import { bundleVerdict } from "../shared/bundle-freshness.mjs";
 const argv = process.argv.slice(2);
 const flag = (n, d = null) => { const i = argv.indexOf(n); return i >= 0 ? argv[i + 1] : d; };
@@ -258,6 +258,14 @@ if (existsSync(poolRoot) && !statSync(poolRoot).isDirectory()) die(`demo: ${pool
 
 // ── 3. replay ────────────────────────────────────────────────────────────────────────────────────────
 console.log(`\n  ${BRAND.name} ${BRAND.product.toLowerCase()} — demo\n`);
+// THE LABEL, FIRST. The reader is about to look at a document that reads like advice about a real mark. It
+// is not, and the demo says so before anything else rather than in a footnote nobody reaches. It printed
+// after the replay, below the engine's own diagnostics and a Node warning, so the first thing a newcomer
+// read was internal tallies (measured on the published beta, 2026-09-19).
+console.log("  Real engine output for the fictional mark VENQORI, captured against Clarivate Compumark.");
+console.log("  Replaying it needs no account, no key and no network.");
+console.log("  Every number, band and citation below was produced by that real run and is being");
+console.log("  re-rendered from its artifacts. It is an example, not advice.\n");
 console.log(samples.length === 1
   ? `  sample:  ${samples[0].dir}`
   : `  samples: ${samples.length}${failures.length ? ` of ${shipped}` : ""} — ${samples.map((x) => x.name).join(", ")}`);
@@ -276,14 +284,33 @@ const { republishRun } = await import(pathToFileURL(join(REPO, "driver", "publis
 // The failures are collected and reported together at the end, and the process exits non-zero, because a
 // demo that came up missing a quarter of itself is not a success however good the three look.
 const results = [];
-for (const s0 of samples) {
-  try {
-    // poolUrl "" on purpose: the report's own link block is for a deployment that serves the pool at a
-    // public URL. This one is served from this process, at a port picked below.
-    results.push({ ...s0, published: await republishRun({ runId: s0.meta.runId, meta: s0.meta, pool: poolRoot, poolUrl: "", runDir: join(s0.publishFrom, "run") }) });
-  } catch (e) {
-    failures.push({ name: s0.name, why: String(e?.message ?? e) });
+// THE PUBLISHER'S OWN DIAGNOSTICS GO TO A FILE. It prints its tallies as it works (`[record-links] …`,
+// `knockout receipts: …`), which is right for an operator watching a delivery and wrong as the first
+// screen a newcomer reads. The replay's output is written to `replay.log` in the folder this demo made,
+// and restored when the replay ends, so everything below prints as before. A failure is not lost: it is
+// collected here and reported after the list.
+const replayLog = join(flag("--pool") ? poolRoot : demoBase, "replay.log");
+const toLog = (chunk, encoding, cb) => {
+  try { appendFileSync(replayLog, chunk, typeof encoding === "string" ? encoding : undefined); } catch { /* a log that cannot be written must not stop the replay */ }
+  if (typeof encoding === "function") encoding(); else if (typeof cb === "function") cb();
+  return true;
+};
+const screen = { out: process.stdout.write, err: process.stderr.write };
+process.stdout.write = toLog;
+process.stderr.write = toLog;
+try {
+  for (const s0 of samples) {
+    try {
+      // poolUrl "" on purpose: the report's own link block is for a deployment that serves the pool at a
+      // public URL. This one is served from this process, at a port picked below.
+      results.push({ ...s0, published: await republishRun({ runId: s0.meta.runId, meta: s0.meta, pool: poolRoot, poolUrl: "", runDir: join(s0.publishFrom, "run") }) });
+    } catch (e) {
+      failures.push({ name: s0.name, why: String(e?.message ?? e) });
+    }
   }
+} finally {
+  process.stdout.write = screen.out;
+  process.stderr.write = screen.err;
 }
 // PUBLISHED, SO THE COPIES THEY WERE PUBLISHED FROM GO NOW, whatever comes next.
 releaseDemoCopies();
@@ -293,12 +320,6 @@ if (!results.length) {
 }
 const published = results[0].published;
 
-// THE LABEL. The reader is about to look at a document that reads like advice about a real mark. It is
-// not, and the demo says so before the browser opens rather than in a footnote nobody reaches.
-console.log("  Real engine output for the fictional mark VENQORI, captured against Clarivate Compumark.");
-console.log("  Replaying it needs no account, no key and no network.");
-console.log("  Every number, band and citation below was produced by that real run and is being");
-console.log("  re-rendered from its artifacts. It is an example, not advice.\n");
 // NAMES THE POPULATION. This printed "13 finding(s)" beside a report showing
 // twelve, in the first sentence a reader meets. The number is not wrong — it comes from the audit
 // spine (`driver/publish/audit-from-spine.mjs`, `counts.findings`), which counts every finding the run
@@ -307,10 +328,8 @@ console.log("  re-rendered from its artifacts. It is an example, not advice.\n")
 // EACH LANE'S PUBLISHER REPORTS ITS OWN NUMBER, AND THEY ARE NOT THE SAME NUMBER.
 //
 // The clearance branch returns `counts.findings` — every finding in the run's audit spine. The knockout
-// branch returns no `counts` at all; it returns `receipts`, whose `findings` counts the findings whose
-// citations the publisher traced to the run's own held evidence. That is a subset by definition, so it
-// is printed in its own words rather than mapped onto the clearance sentence. They happen to agree on
-// the demo in this tree, which is one member of a class and proves nothing about the metric.
+// branch returns no `counts` at all; it returns the names it screened and the rating each was given, so
+// its line states those rather than a count mapped onto the clearance sentence.
 //
 // The third branch is the point: a lane whose publisher reports no count says so. This line printed a
 // bare "?" to the knockout — a could-not-look wearing the costume of a number.
@@ -322,9 +341,13 @@ const spineOf = (pub) =>
   Number.isFinite(pub.counts?.findings)
     ? `${pub.counts.findings} finding(s) recorded in the run's audit trail; the report shows
              the ones it retains`
-    : Number.isFinite(pub.receipts?.findings)
-      ? `${pub.receipts.findings} finding(s) with citations traced to this run's own held
-             evidence, on ${pub.receipts.citing}/${pub.receipts.marks} mark(s)`
+    // A KNOCKOUT STATES WHAT IT SCREENED AND HOW EACH NAME WAS RATED, in the words its own report opens
+    // with ("One name screened: VENQORI, rated Low."). It used to count citations traced to held evidence,
+    // which a knockout's register-only findings never carry, so the line read "0 finding(s)" and a stranger
+    // took it as "the demo found nothing". Chosen 2026-09-19.
+    : Array.isArray(pub.reports) && pub.reports.length
+      ? `${pub.reports.length} name${pub.reports.length === 1 ? "" : "s"} screened: ${pub.reports
+        .map((r) => (r.band ? `${r.mark}, rated ${r.band}` : r.mark)).join("; ")}; the report shows why`
       : `this lane's publisher reported no finding count — the report itself is the record`;
 for (const r of results) console.log(`  published: ${r.published.runId}\n             ${r.name} — ${spineOf(r.published)}`);
 // "ONE PER PRODUCT" ONLY WHEN IT IS TRUE: with a sample missing, the count below says how many of how many.
@@ -418,6 +441,10 @@ console.log("");
 // made, it starts from here as before.
 const programRoot = ensureDemoProgram({ base: demoBase, say: (line) => console.log(line) });
 const startFrom = programRoot ?? REPO;
+// The services inherit the demo's Node flag through NODE_OPTIONS, so none of them prints the SQLite warning
+// either. Set on this process's own environment, which both branches below hand on; the reader's own
+// NODE_OPTIONS is kept.
+process.env.NODE_OPTIONS = withWarningOff(process.env.NODE_OPTIONS);
 const child = spawn(process.execPath, [join(startFrom, "bin", "start.mjs"), ...startArgs], {
   cwd: startFrom, stdio: ["ignore", "inherit", "inherit"],
   env: programRoot ? demoProgramEnv(process.env) : process.env,

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "f107c38f60f6cd5536cd30edb3d2b3ad8a1d1d97",
-  "version": "0.3.2-beta.13"
+  "commit": "a166b8a008f6094b60dc44c6725c68bcbc7327b5",
+  "version": "0.3.2-beta.15"
 }

package/driver/CHANGELOG.md

@@ -1,5 +1,27 @@
 # clearotron-driver
 
+## 0.3.2-beta.15
+
+### Patch Changes
+
+- Fixed: A run's summary and its delivery email now give the rating and the report's own sentence. The internal delivery-check word no longer appears.
+- Fixed: A report's answers to your instructions now show one line each, with the rest of each answer behind a fold.
+- New: a register search can now be narrowed to the goods and services a filing actually covers, not only the numbered grouping it was filed under.
+  
+  A common word in a busy grouping returns more filings than any search can read through. Narrowing by what each filing covers reaches the ones that matter.
+  
+  New: searches no longer spend queries on owner portfolios guessed before any filing had been read. Owners now come from the filings a search returns.
+- Fixed: A delivered report's conditions now carry only the conditions written for the client. The reviewer's own notes stay in the run record.
+- Fixed: the portal now says it is loading while your clearances arrive, instead of showing an empty page that reads as nothing found.
+
+## 0.3.2-beta.14
+
+### Patch Changes
+
+- Fixed: The lines for connecting an AI assistant now work when a folder name contains spaces, and the Codex settings block now works on Windows.
+- Fixed: The demo now opens by saying what it shows, without internal diagnostics or a Node warning, and its knockout sample states the rating it reached.
+- Fixed: A knockout report ordered for named countries now lists those countries under Registers counted, instead of a count of the provider's registers.
+
 ## 0.3.2-beta.13
 
 ### Patch Changes

package/driver/contract-vocabulary.mjs

@@ -21,7 +21,7 @@
 //   D4 verify.mjs  parseCoverageLedgerJson, same shape
 //   D5 verify.mjs:1504  fail(`${unaccounted[0].token}:…`)    — token minted in a DATA ROW
 //   D6 verify.mjs:1567  fail(`${violations[0].token}…`)      — validatePlanFeasibility in register-plan.mjs
-//   D7 verify.mjs:1558  fail(`${v2[0].token}${detail}…`)     — register-plan.mjs:2270 disclosureTextByAxis
+//   D7 verify.mjs:1558  fail(`${v2[0].token}${detail}…`)     — register-plan.mjs:2424 disclosureTextByAxis
 //   D8 verify.mjs:2470 caseLawLedgerFail  fail(caseLawLedgerFail(…))  — token built in case-law-ledger.mjs:195 caseLawLedgerFail
 //
 // A partition built on the 60 tokens a regex CAN see would run green while blind to the rest, which is
@@ -139,10 +139,10 @@ export const VOCABULARY = [
   { token: "coverage_form_missing", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_form_empty", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_status_offenum", stages: ["register-digest"], site: "driver/verify.mjs:2050" },
-  { token: "coverage_deferred_unaccounted", stages: ["register-digest"], site: "driver/verify.mjs coverageFormFail", family: "driver/register-plan.mjs:1947 PROVIDER_HARD_ERROR_PREFIX — token on a data row", dynamic: "D5" },
-  { token: "coverage_clean_unexecuted", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1681 validatePlanFeasibility", dynamic: "D6" },
-  { token: "coverage_clean_skipped", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:2042 searchedJurisdictionsFromPlan", dynamic: "D6" },
-  { token: "coverage_clean_unverified_incomplete", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:2270 disclosureTextByAxis", dynamic: "D7" },
+  { token: "coverage_deferred_unaccounted", stages: ["register-digest"], site: "driver/verify.mjs coverageFormFail", family: "driver/register-plan.mjs:2101 PROVIDER_HARD_ERROR_PREFIX — token on a data row", dynamic: "D5" },
+  { token: "coverage_clean_unexecuted", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1835 validatePlanFeasibility", dynamic: "D6" },
+  { token: "coverage_clean_skipped", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:2196 searchedJurisdictionsFromPlan", dynamic: "D6" },
+  { token: "coverage_clean_unverified_incomplete", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:2424 disclosureTextByAxis", dynamic: "D7" },
   { token: "coverage_clean_tainted", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_ledger_", stages: ["register-digest"], site: "driver/verify.mjs", family: "driver/coverage-ledger.mjs (parseCoverageLedgerJson token-first throws)", dynamic: "D4" },
   { token: "coverage_key_unknown", stages: ["register-digest"], site: "driver/verify.mjs", family: "driver/coverage-ledger.mjs", dynamic: "D4" },

package/driver/engine/mcp/codex-config.mjs

@@ -5,6 +5,7 @@
 // exact server/tool wiring. Two inputs, both produced today by the gateway gather block:
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
+import { tomlString } from "../../../shared/toml-string.mjs";
 
 //   • mcpConfig     — the claude-shaped JSON string `{mcpServers:{name:{command,args,env,connectionTimeoutMs?}}}`
 //                     (buildGatherMcpConfig → JSON.stringify)
@@ -36,17 +37,8 @@ export const CRED_ENV_FORWARD = [
 ];
 
 // ── TOML value escaping (basic strings) ──────────────────────────────────────────────────────────────
-export function tomlString(s) {
-  const str = String(s ?? "");
-  // TOML basic-string escapes: backslash, double-quote, and the C0 controls TOML names (\b \t \n \f \r).
-  const esc = str
-    .replace(/\\/g, "\\\\").replace(/"/g, '\\"')
-    .replace(/\x08/g, "\\b").replace(/\t/g, "\\t").replace(/\n/g, "\\n")
-    .replace(/\f/g, "\\f").replace(/\r/g, "\\r")
-    // any remaining control char → \uXXXX (TOML-legal)
-    .replace(/[\x00-\x1f]/g, (c) => "\\u" + c.charCodeAt(0).toString(16).padStart(4, "0"));
-  return `"${esc}"`;
-}
+// One encoder for every TOML block the product writes; re-exported so this module's callers keep their import.
+export { tomlString };
 function tomlStringArray(arr) {
   return "[" + (arr || []).map(tomlString).join(", ") + "]";
 }

package/driver/named-band.mjs

@@ -137,7 +137,7 @@ export function parseNamedBand(raw) {
         // byte-identical to a slice the plan deliberately counted without fetching. Measured on a real
         // run: four capability-gap blocks carried `error:true, deferred:true` into this function and
         // reached record-carry.json with both fields gone and a sentence claiming the run "has a hit
-        // COUNT for this slice". register-plan.mjs:1681 validatePlanFeasibility already enforces the same rule one layer up
+        // COUNT for this slice". register-plan.mjs:1835 validatePlanFeasibility already enforces the same rule one layer up
         // ("a transient must not ship indistinguishable from a sanctioned descriptor") — it reads the
         // RAW blocks, which is why it could. Every consumer that reads THIS projection could not.
         // Conditional like the four keys above, so old bands carry neither key and nothing shifts.

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.2-beta.13",
+  "version": "0.3.2-beta.15",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline-knockout.mjs

@@ -1090,7 +1090,9 @@ export async function knockoutInner(ctx, job, opts = {}) {
       writeFileSync(join(config.outboxDir, `${packet.runId}.pending`), `${agent}\n`);
     } catch (e) { note(`delivery: outbox marker write skipped (${String(e.message).slice(0, 100)})`); }
     const deliveredAt = new Date().toISOString();
-    writeRunStatus(ctx, { state: "delivered", verdict: overall, statement: published.statement, url: published.url, reports: published.reports.map((r) => ({ mark: r.mark, url: r.url })), deliveredAt, sendPending: true, stepIndex: STEPS.length - 1, stepLabel: STEPS[STEPS.length - 1], stepN: STEPS.length, stepTotal: STEPS.length });
+    // `tier` beside `verdict` — the same band word under the name the clearance lane records it by, so a
+    // reader of either lane's status finds the rating in one place. `verdict` stays as it was.
+    writeRunStatus(ctx, { state: "delivered", verdict: overall, tier: overall, statement: published.statement, url: published.url, reports: published.reports.map((r) => ({ mark: r.mark, url: r.url })), deliveredAt, sendPending: true, stepIndex: STEPS.length - 1, stepLabel: STEPS[STEPS.length - 1], stepN: STEPS.length, stepTotal: STEPS.length });
     // — the knockout lane's pool copy learns its terminal state the same way,
     // for the same reason: publish returns the pool dir, and `state: "delivered"` is decided after it
     // returns. Same seam, same best-effort contract, no lane-specific exception to write down.

package/driver/pipeline.mjs

@@ -13379,6 +13379,17 @@ async function pipelineInner(job, opts = {}) {
       // rationale lives on the function so the arms can DRIVE it rather than pin this call site's text.
       const { clauses: orderedClauses, reasons: orderedReasons } = orderClausesForLede(clampClauses, clampReasons, guardClauses);
       const reasonsOut = blockingGrounds.length ? [...orderedReasons, ...blockingGrounds] : orderedReasons;
+      // — AND EACH APPENDED GROUND CARRIES AN EXPLICIT NULL CLAUSE, which is what puts it in the
+      // run record ALONE. The block above says "no client surface moves", and that was true of the
+      // statement and the bound recommendation, both fixed strings on BLOCKING. It was never true of the
+      // CONDITIONS LIST: `clientConditions` walks the reasons and prints any reason that has no clause
+      // and no engine token, so on a delivered BLOCKING run the reviewer's own cited correction lines
+      // printed to the client as their conditions — 8 of the 13 conditions on the run this was measured
+      // on (2026-09-20). A stored null is the shipped way to say "recorded, not rendered", and the
+      // arrays stay index-aligned because `orderClausesForLede` returns them the same length.
+      const clausesOut = blockingGrounds.length
+        ? [...orderedClauses, ...blockingGrounds.map(() => null)]
+        : orderedClauses;
       const kindsOut = verdict === "BLOCKING" ? { ...clampKinds, reviewerCited } : clampKinds;
       // The invariant itself, stated over the value that is WRITTEN rather than over the branch that fills
       // it — a guard that only holds while the code above is remembered is not a guard. Unreachable today
@@ -13396,13 +13407,19 @@ async function pipelineInner(job, opts = {}) {
       // CONDITIONAL statement reads "<Tier> — conditional on: <factual open-state> (and N more)." —
       // clampClauses carries the fact-voice clauses; the structured `stance` field is what every
       // consumer keys on (never the statement's wording — the magic-string coupling is retired).
-      const statement = riskStatement({ tier: derived.tier, verdict, reasons: reasonsOut, clauses: orderedClauses,
+      const statement = riskStatement({ tier: derived.tier, verdict, reasons: reasonsOut, clauses: clausesOut,
         basis: isRegisterOnly(ctx.searchPolicy) ? "register-only" : null });
       const tmp = driverDir(run.runDir, "verdict.json.tmp");
-      writeFileSync(tmp, JSON.stringify({ ts: new Date().toISOString(), verdict, reasons: reasonsOut, clauses: orderedClauses, kinds: kindsOut,
+      writeFileSync(tmp, JSON.stringify({ ts: new Date().toISOString(), verdict, reasons: reasonsOut, clauses: clausesOut, kinds: kindsOut,
         tier: derived.tier, badge: derived.badge, gaugeIndex: derived.gaugeIndex, maxComposite: derived.maxComposite,
         band: derived.band ?? null, statement, stance: verdictStance(verdict) }, null, 2));
       renameSync(tmp, driverDir(run.runDir, "verdict.json"));
+      // — THE STATUS RECORD CARRIES THE BAND AND THE SENTENCE, so a reader of the run does not
+      // have to reach for `verdict` to say something about the outcome. `verdict` is the gate's decision
+      // (CLEAR / CONDITIONAL / BLOCKING) and is engine vocabulary; the band and the composed statement are
+      // what every client surface already speaks. Measured 2026-09-20: an assistant summarising a run read
+      // `verdict` and told the client "BLOCKING" beside a Medium rating, because status.json held no band.
+      writeRunStatus(ctx, { tier: derived.tier ?? null, statement: statement ?? null });
       return derived;
     };
     try { writeVerdictSidecar(); }
@@ -15902,11 +15919,17 @@ export function reconstructCtx(job, opts) {   // @internal
   // axes drive which register-unit files placement/digest/skeptic/synthesis reference. Mirror the cold path
   // (pipeline) exactly: decideAxes("") defaults ALL axes ON, so a missing manifest never silently UNDER-spawns.
   ctx.axes = decideAxes(existsSync(P.variantManifest) ? readFileSync(P.variantManifest, "utf8") : "");
-  // …including the cold path's axis-from-plan UNION ( B3): the frozen plan is the search
-  // authority, and the F2 owner lane routinely puts entries on an axis prose decideAxes won't activate
-  // (a watchlist-owners-only manifest has no incumbent alert, yet its owner lane lives on
-  // incumbent-class). Without the union a stale-repair/--experiment of register-digest/placement would
-  // exclude the executed lane from the per-axis unit list and the declared inputs/freshness stamps.
+  // …including the cold path's axis-from-plan UNION ( B3), and the reason is now the plainer one:
+  // THE FROZEN PLAN IS THE SEARCH AUTHORITY, and what it carries need not match what prose activation
+  // would have chosen. `decideAxes` reads the manifest; the plan is what actually ran.
+  //
+  // The two diverge in both directions and each has a live case. A plan frozen before the guessed
+  // owner lane was removed still carries its owner entries on incumbent-class, and a resumed run must
+  // execute the plan it froze rather than the axes today's manifest would activate. Going the other
+  // way, any future lane that mints entries on an axis the manifest does not announce lands here too.
+  //
+  // Without the union a stale-repair/--experiment of register-digest/placement would exclude the
+  // executed lane from the per-axis unit list and the declared inputs/freshness stamps.
   // Best-effort read — a legacy run without a frozen plan reconstructs exactly as before.
   try {
     const plan = JSON.parse(readFileSync(P.registerPlan, "utf8"));

package/driver/publish/index.mjs

@@ -1739,8 +1739,17 @@ export function composeEmailHtml(reportMdPath, url, auditFile, names = [], deliv
   // the engine clamp reasons (opts.conditions = verdict.json reasons). Machinery-only clamps (no client
   // item authored) degrade to one generic plain line — never raw engine jargon, never truncated mid-sentence.
   const emailConditions = opts?.verdict === 'CONDITIONAL' ? actYouConditions(parseActionBuckets(secs['Actions']).you) : [];
+  // THE BANNER SPEAKS THE RUN'S OWN SENTENCE. It used to print the delivery gate's word — "Delivered as
+  // BLOCKING" — which is engine vocabulary and, beside a Medium rating on the report, reads as a
+  // contradiction the reader cannot resolve (measured 2026-09-20). The statement is composed once by the
+  // sidecar writer and is what the report and the index already show; a run recorded before statements
+  // were persisted keeps the old line, which is all such a run has.
+  const bound = String(opts?.statement ?? '').trim();
+  const boundHead = bound
+    ? esc(bound)
+    : `Delivered as ${esc(opts?.verdict ?? '')}${opts?.verdict === 'CONDITIONAL' ? ' — subject to:' : '.'}`;
   const verdictBound = (opts?.verdict && opts.verdict !== 'CLEAR')
-    ? `<p style="margin:0 0 8px;padding:8px 10px;background:#fdeeee;border:1px solid #c98a86;color:#6e1512"><b>Delivered as ${esc(opts.verdict)}${opts.verdict === 'CONDITIONAL' ? ' — subject to:' : '.'}</b>${opts.verdict === 'CONDITIONAL' ? `<br>${(emailConditions.length ? emailConditions : ['the open items set out in the report, before relying on a clean result']).map((r) => `• ${cell(String(r))}`).join('<br>')}` : ''}</p>`
+    ? `<p style="margin:0 0 8px;padding:8px 10px;background:#fdeeee;border:1px solid #c98a86;color:#6e1512"><b>${boundHead}</b>${opts.verdict === 'CONDITIONAL' ? `<br>${(emailConditions.length ? emailConditions : ['the open items set out in the report, before relying on a clean result']).map((r) => `• ${cell(String(r))}`).join('<br>')}` : ''}</p>`
     : '';
 
   const reviewHeadline = `<div style="${FONT};font-size:11pt;color:#1a1a2e;margin:0 0 14px">`

package/driver/publish/render-knockout.mjs

@@ -63,6 +63,7 @@ import { EXPORT_TOGGLE, exportPopover, EXPORT_MENU_JS } from './report-topbar.mj
 import { makeClassifyStatus, isAllClass } from '../../providers/_shared/screen.mjs';
 import { saysSomethingNew } from '../../shared/says-something-new.mjs';
 import { isNextStepHeading } from '../knockout-next-step.mjs';
+import OFFERED from '../../shared/offered-territories.json' with { type: 'json' };   // the order form's own territory names
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 
@@ -481,6 +482,14 @@ function territoryName(code, { bare = false } = {}) {
   } catch { return ''; }
 }
 
+/** A territory the order names, in the order form's own words, or '' when that list has no such code. */
+const ORDER_FORM_NAMES = new Map([...OFFERED.regions, ...OFFERED.countries].map((t) => [t.code, t.name]));
+const orderedTerritoryName = (code) => {
+  const c = String(code ?? '').trim().toUpperCase();
+  // EM is the European Union register's own code, and some records carry it for an EU order.
+  return ORDER_FORM_NAMES.get(c === 'EM' ? 'EU' : c) ?? '';
+};
+
 /** "a, b and c" — the reader's list, not a join on commas. */
 function listWords(items) {
   const xs = (items ?? []).filter(Boolean);
@@ -1244,12 +1253,28 @@ function aboutRequestBlock(scope, requestNotes, depthNote = '', productContext =
   // the middle of the panel is the thing a reader skips; the count and its source are what they read.
   const regions = (registerCounts?.scope?.regions ?? []).filter(Boolean);
   const provider = registerCounts?.providerLabel ?? registerCounts?.provider ?? '';
-  // THE BOARD'S OWN ROW: "186 registers, on Clarivate Compumark." — registers, because that is what was
-  // counted, and no fold: the board lists no territories here, and the workbook's counts sheet carries
-  // every register a figure was taken over.
-  const counted = regions.length
-    ? `${regions.length} ${regions.length === 1 ? 'register' : 'registers'}${provider ? `, on ${provider}` : ''}.`
-    : (registerCounts ? `Counted worldwide${provider ? `, on ${provider}` : ''}` : '');
+  // THE ORDER'S TERRITORIES, NOT THE PROVIDER'S REGISTERS (owner, 2026-09-19). The row counted the
+  // registers the provider searched, and for a one-country order that is not one: a United States order is
+  // counted over the United States and the international register, because an international filing can
+  // designate the United States. A client who ordered one country read "2 registers" as a mistake. So an
+  // order that names its territories is stated as it named them, in the order form's own names; the
+  // registers actually counted stay in the line under the counts table. A worldwide order keeps the board's
+  // row, "186 registers, on Clarivate Compumark.", because there the count is the scope (the record says
+  // worldwide by carrying no jurisdictions). A territory the provider does not cover was not counted, so it
+  // is not listed here; it is disclosed where deferrals are. A territory the form's list cannot name, or an
+  // office this install could not reach, falls back to the count rather than printing a code or claiming
+  // a territory nothing was counted in.
+  const on = provider ? `, on ${provider}` : '';
+  const sc = registerCounts?.scope ?? {};
+  const deferred = new Set((sc.deferredJurisdictions ?? []).map((c) => String(c ?? '').trim().toUpperCase()));
+  const ordered = [...new Set((sc.jurisdictions ?? [])
+    .filter((c) => !deferred.has(String(c ?? '').trim().toUpperCase())).map(orderedTerritoryName))];
+  const namesTheOrder = sc.worldwide !== true && !(sc.unreachableOffices ?? []).length
+    && ordered.length > 0 && ordered.every(Boolean);
+  const counted = namesTheOrder ? `${listWords(ordered)}${on}.`
+    : regions.length
+      ? `${regions.length} ${regions.length === 1 ? 'register' : 'registers'}${on}.`
+      : (registerCounts ? `Counted worldwide${on}` : '');
   if (!asked && !where && !classLine && !stage && !context && !counted) return '';
   // ONE PANEL, THE SAME ON BOTH REPORTS (the 2026-09-16 report redesign). The rows carry what was asked for; the
   // counts row says what was counted and hides the territory list behind a fold rather than running a

package/driver/publish/render.mjs

@@ -874,7 +874,7 @@ function actionsPanel(actionsText) {
     if (!body) continue;
     const kind = /answers to your instructions/i.test(label) ? 'ans' : /checks we ran|what we found/i.test(label) ? 'ran' : 'you';
     const ic = kind === 'ans' ? '✎' : kind === 'ran' ? '✓' : '→';
-    parts.push(`<div class="actgrp act-${kind}"><h3><span class="actic">${ic}</span> ${inline(label)}</h3>${renderProse(body)}</div>`);
+    parts.push(`<div class="actgrp act-${kind}"><h3><span class="actic">${ic}</span> ${inline(label)}</h3>${kind === 'ans' ? answersHtml(body) : renderProse(body)}</div>`);
   }
   return parts.length ? `<div class="panel actions" id="actions">${parts.join('')}</div>` : '';
 }
@@ -900,10 +900,62 @@ export function parseActionBuckets(actionsText) {
   }
   return out;
 }
+// ── ONE LINE PER ANSWER, THE REST FOLDED (owner, on the delivered report, 2026-09-20) ────────────────
+//
+// Every answer to a client's instruction printed at full length, one after another, and the section read
+// as a wall of text. The acceptance brief had already ruled the shape — the question and the answer's
+// opening visible, the explanation behind a fold — and it was never built, because no demo run carries
+// intake asks and so no demo and no mock ever rendered this section.
+//
+// NOTHING IS CUT AND NO WORDS ARE WRITTEN. The line is the answer's FIRST SENTENCE, by the same
+// splitFirstSentence the hero caption folds on (one rule, one set of abbreviations), and the remainder is
+// the rest of the same string. `report.md`, `report-data.json` and the workbook are untouched.
+//
+// WHERE THE FOLD MAY NOT GO, and this is the whole care in the function. An internal note runs from its
+// label to the END OF ITS LINE, and a client surface removes it by cutting to the close of the element
+// that contains it (portal-report.mjs). So:
+//   · a wholly internal answer is dropped, exactly as renderProse drops one;
+//   · an answer whose remainder is ONLY an internal tail folds inside a wrapper the client strip takes
+//     whole, so that reader gets the line and no empty disclosure;
+//   · an answer that is internal from its first word takes the whole row with it: the strip would
+//     otherwise leave the question standing over a dangling arrow, which portal-report.mjs names as the
+//     empty-labelled-row defect;
+//   · otherwise the remainder folds, tail included, and the client cut trims it inside the fold's own
+//     paragraph while the public remainder stays.
+// Splitting on the public head alone is what makes that true: the visible line can never carry a label.
+function answersHtml(body) {
+  const lines = stripInternal(String(body ?? ''), { client: false }).split('\n').map((l) => l.trim());
+  const items = [];
+  for (const line of lines) {
+    if (!line) continue;
+    if (/^[-*]\s/.test(line)) items.push(line.replace(/^[-*]\s+/, ''));
+    else if (items.length) items[items.length - 1] += ` ${line}`;
+    else return renderProse(body);   // not the bulleted register — render it as it always was
+  }
+  if (!items.length) return renderProse(body);
+  const rows = [];
+  for (const item of items) {
+    if (isInternalLabelled(item)) continue;
+    const at = item.indexOf('→');
+    const label = at < 0 ? '' : item.slice(0, at + 1).trim();
+    const answer = at < 0 ? item : item.slice(at + 1).trim();
+    const mark = answer.search(/\[internal\]/i);
+    const { first, rest } = splitFirstSentence(mark < 0 ? answer : answer.slice(0, mark));
+    const tail = mark < 0 ? '' : answer.slice(mark).trim();
+    const head = `${label ? `${inline(label)} ` : ''}${inline(first)}`;
+    if (!rest && !tail) { rows.push(`<li>${head}</li>`); continue; }
+    if (!first && !rest) { rows.push(`<li class="int-note">${head}${inline(tail)}</li>`); continue; }
+    const fold = `<details class="ans-more"><summary>More</summary><p>${inline(rest && tail ? `${rest} ${tail}` : rest || tail)}</p></details>`;
+    rows.push(`<li>${head}${rest ? fold : `<div class="int-note">${fold}</div>`}</li>`);
+  }
+  return rows.length ? `<ul class="answers">${rows.join('')}</ul>` : '';
+}
+
 function actionGroup(bucket, kind) {
   if (!bucket || !bucket.body) return '';
   const ic = kind === 'ans' ? '✎' : kind === 'ran' ? '✓' : '→';
-  return `<div class="actgrp act-${kind}"><h3><span class="actic">${ic}</span> ${inline(bucket.label)}</h3>${renderProse(bucket.body)}</div>`;
+  const body = kind === 'ans' ? answersHtml(bucket.body) : renderProse(bucket.body);
+  return `<div class="actgrp act-${kind}"><h3><span class="actic">${ic}</span> ${inline(bucket.label)}</h3>${body}</div>`;
 }
 
 // doc-52 — the "Conditional — subject to:" banner speaks the SAME plain wording as "Only you can close

package/driver/publish/templates/report.css

@@ -112,6 +112,18 @@
   .panel.actions .act-you .actic{background:var(--med-soft);color:var(--med-tx)}
   .panel.actions p,.panel.actions li{font-size:13.5px;color:var(--slate);line-height:1.55}
   .panel.actions ul{margin:0;padding-left:20px} .panel.actions li{margin:3px 0}
+  /* Each answer shows one line; the rest folds. Styled here and not in the frozen renderer, and the
+     @media print rule that forces every <details> open already covers it — an exported PDF carries the
+     whole answer. The disclosure takes the caption fold's look, which is the only other fold of a
+     sentence into its remainder on this page. */
+  .panel.actions ul.answers li{margin:7px 0}
+  .panel.actions details.ans-more{margin:3px 0 0}
+  .panel.actions details.ans-more>summary{cursor:pointer;list-style:none;font-size:11px;font-weight:700;
+    letter-spacing:.06em;text-transform:uppercase;color:var(--faint)}
+  .panel.actions details.ans-more>summary::-webkit-details-marker{display:none}
+  .panel.actions details.ans-more>summary::before{content:"\25b8";margin-right:6px;display:inline-block;transition:.15s;color:var(--rose)}
+  .panel.actions details.ans-more[open]>summary::before{transform:rotate(90deg)}
+  .panel.actions details.ans-more p{margin:5px 0 0}
 
   /* ── THE BOARD'S OWN SECTION STRIP, lifted from the approved mock rather than written here ────────
      Five entries and the board's own labels, marked not to print because the board marks it so: a strip
@@ -388,7 +400,10 @@
        in the hero, directly above text that was already fully expanded. Measured in Chrome: the caption's
        own content was carried correctly and only the control leaked, which is why the commit that added
        the fold could check the half it thought about and ship the half it did not. */
-    details.drill>summary,details.method>summary,details.sub-more>summary{display:none!important}
+    details.drill>summary,details.method>summary,details.sub-more>summary,
+    /* An answer's "More" is a pure toggle: it carries no content of its own, so on paper it would be an
+       inert label over text the rule below has already expanded — the defect #470 shipped. */
+    details.ans-more>summary{display:none!important}
     /* The caption fold made this line load-bearing for the document's CONTENT, not just its completeness. The
        legal/practical reads now live inside .drillbody, so without this rule the exported PDF would
        carry the one-line verdicts and none of the reasoning behind them. The export prints everything a

package/driver/register-availability.mjs

@@ -41,9 +41,9 @@
 // CORRECTED 2026-08-11 — THIS PARAGRAPH USED TO SAY "one qid per office … which is the shape
 // joinPlanToBands already has", AND THAT WAS FALSE ABOUT THE COMPILER IT DOCUMENTS. There is no
 // per-office qid. compileRegisterPlan narrows ONE shared `regions` array and hands it to every entry
-// (register-plan.mjs:805 compileRegisterPlan); the unreachable office produces no entry, so no qid, so no band block, so
+// (register-plan.mjs:846 compileRegisterPlan); the unreachable office produces no entry, so no qid, so no band block, so
 // nothing ever reaches joinPlanToBands' deferred bucket — whose only source is a block stamped
-// `error:true && deferred:true` (register-plan.mjs:1317 extendRegisterPlan).
+// `error:true && deferred:true` (register-plan.mjs:1489 extendRegisterPlan).
 //
 // The consequence was not academic. `deferred_coverage` rode the plan and nothing that a reader sees
 // read it: coverage-form.mjs seeded its deferred rows from skeleton qids alone, so an EU+US matter on a