clearotron 0.3.2-beta.7 → 0.3.2-beta.8

package/driver/portal-report.mjs

@@ -362,6 +362,12 @@ const MCP_HOST_RE = /https?:\/\/[A-Za-z0-9.-]+\/mcp/gi;
 // introduces it and the full stop that closes it — leaving either behind puts a stray break or an orphan
 // "." in the footer of every report.
 const RATED_UNDER_RE = /<br\s*\/?>Rated under:\s*<span class="mono">[^<]*<\/span>\./gi;
+// THE PROJECT LINE IS THE SAME CLASS AND WAS MISSING ITS STRIP. "Run under project: <name>" is
+// internal provenance — an end-to-end arm reads it out of the published internal report — and it sat
+// beside "Rated under" in the footer with nothing removing it here, so it reached every embedded
+// reader exactly as written: the engine's phrase for the folder a job was filed in, and the folder's
+// name. Same shape, same removal, one line apart.
+const RUN_UNDER_PROJECT_RE = /<br\s*\/?>Run under project:\s*<span class="mono">[^<]*<\/span>\./gi;
 
 const CONNECTOR_TOKEN_RE = /([?&])token=v1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+(&)?/g;
 
@@ -796,8 +802,16 @@ export function prepareReportForEmbed(html, { staff = false, poolRoot = null, fe
 
   // The footer fingerprint. Counted like the rest so a renderer change that moves it shows up as a zero
   // rather than as a line that quietly starts shipping again.
+  //
+  // ONE COUNTER PER LINE, AND THAT IS THE WHOLE POINT OF COUNTING. These two strips shared a counter, so
+  // the check that exists to catch a renderer moving this markup could not tell WHICH line moved: the
+  // renderer could rename one of them, that strip would match nothing, the other would still fire, and
+  // the count would read 1 exactly as it does when both work. A count that cannot fall to zero for one
+  // of the two things it counts is not a measurement of either.
   let ratedUnderDropped = 0;
+  let runUnderProjectDropped = 0;
   out = out.replace(RATED_UNDER_RE, () => { ratedUnderDropped += 1; return ""; });
+  out = out.replace(RUN_UNDER_PROJECT_RE, () => { runUnderProjectDropped += 1; return ""; });
 
   // ── THE ASK-AI BAND COMES OUT FOR EVERY READER ──────────────────────────────────────────────────
   //
@@ -854,7 +868,7 @@ export function prepareReportForEmbed(html, { staff = false, poolRoot = null, fe
   out = injectEmbedLayer(out, { feedback });
 
   return {
-    html: out, strippedNav, neutralised, mcpLeaks, tokensDropped, ratedUnderDropped,
+    html: out, strippedNav, neutralised, mcpLeaks, tokensDropped, ratedUnderDropped, runUnderProjectDropped,
     internalTailsDropped, reviewerCodesDropped, unbalanced, missingCss,
   };
 }

package/driver/portal-service.mjs

@@ -98,6 +98,24 @@ import { fileURLToPath } from "node:url";
 // re-declared: one number, one count, and every existing importer of this module keeps working.
 export { DEFAULT_CLIENT_DAILY_RUNS, accountUsage };
 
+/**
+ * What a requester is told when the day's allowance is gone.
+ *
+ * ONE SENTENCE, TWO PLACES. The server refuses with it and the screen warns with it, and a reader who
+ * meets both must not meet two different sentences about the same fact. The browser cannot import this
+ * module, so the portal composes its own copy and `portal-ui/test/allowanceParity.test.ts` pins the two
+ * together — the same arrangement the effort model already has.
+ *
+ * NAMED, NOT ADDRESSED. It read "ask your <name> contact", which puts a possessive and a noun around a
+ * name that is already the answer: on a deployment that has configured no brand the portal's fallback is
+ * the words "the operator", and the sentence rendered "ask your the operator contact to run this one for
+ * you". The line beside it on the same screen had always said "ask <name>", and that is the one the
+ * approved design draws.
+ */
+export const allowanceExhaustedLine = (cap, who) =>
+  `You have used all ${cap} of this account's searches for today. `
+  + `The allowance resets at midnight UTC — or ask ${who} to run this one for you.`;
+
 // One sentence, two places (the capability payload and the route that refuses). Never names the
 // missing credential: this reaches a client screen, and our plumbing is not their business.
 //
@@ -130,7 +148,7 @@ import { productRows, productRow, baseTurnaroundFor } from "./product-rows.mjs";
 import { resolveForDoor, gateResolvedRequest } from "./door-gates.mjs";
 import { resolveEffectiveScope } from "./effective-scope.mjs";
 import { quoteForJob } from "./run-quote.mjs";
-import { readFlagSnapshot, builtFor, registerCanCountFor, registerTerritoriesFor, caseLawReadyFor } from "./flag-snapshot.mjs";
+import { readFlagSnapshot, builtFor, registerCanCountFor, registerTerritoriesFor, registerLabelFor, caseLawReadyFor } from "./flag-snapshot.mjs";
 import { isDemo, demoPostureLine } from "./demo-posture.mjs";   
 import { triggerCapGap, triggerCapWarning } from "./trigger-cap.mjs";   // F51 — one answer, three surfaces
 import { makeUpstream } from "./portal-upstream.mjs";
@@ -468,7 +486,16 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, gener
       // zombie face this state exists to end. pausedKind "operator" tells the UI which words to use.
       const paused = s.state === "postponed" || s.state === "recovering" || s.state === "parked-for-human";
       out.push({ ...(liveRetired ? { retired: true } : {}),
-        runId: s.runId, account: owner, ...(owner === "generic" ? { organisation: p.organisation ?? null } : {}), title: s.markName ?? s.slug, kind: s.lane === "knockout" ? "knockout-batch" : "clearance",
+        runId: s.runId, account: owner, ...(owner === "generic" ? { organisation: p.organisation ?? null } : {}), title: s.markName ?? s.slug,
+        // THE RUN’S OWN PIPELINE, off the frozen policy sidecar this branch already reads — the same
+        // source the `product` field two lines down takes, so a row cannot contradict its own product.
+        // `s.lane` is the runner’s queue directory and it is not that: a knockout claimed from any other
+        // lane arrived here as a clearance, and Home then quoted it the clearance turnaround — hours,
+        // against a search that finishes in minutes. The queued rows below were fixed for exactly this
+        // and this row was left on the weaker field. The lane stays as the fallback for a run whose
+        // sidecar predates the stamp, and an unplaceable product stays a clearance, which is what every
+        // listing has always shown for something it could not identify.
+        kind: (policyFor(sp?.level)?.pipeline ?? (s.lane === "knockout" ? "knockout" : null)) === "knockout" ? "knockout-batch" : "clearance",
         markName: typeof s.markName === "string" ? s.markName : null,
         // The project, straight off the frozen sidecar this branch already reads as `p`. A LIVE run needs
         // no publish stamp and no back-fill — the sidecar is right there, and freezeProfile has written
@@ -684,7 +711,7 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, gener
 // A failure `reason` is NOT client-safe, and the listing must not hand it to a browser.
 //
 // The engine writes `reason = String(e?.stack ?? e)` truncated to 200 characters
-// (pipeline.mjs:5366, pipeline-knockout.mjs:311). That is a raw stack trace: absolute filesystem
+// (pipeline.mjs, pipeline-knockout.mjs). That is a raw stack trace: absolute filesystem
 // paths, internal module names, provider error text. Useful to staff, and none of a client's business
 // — and redacting it in the UI would be theatre, because the field still travels over the wire and
 // sits in devtools whatever React chooses to render.
@@ -1230,6 +1257,10 @@ export function makePortalService({
   // THREE answers survive the read: null (unrestricted), an array, or undefined (the snapshot does not
   // say — fail open). registerTerritoriesFor is what keeps them apart.
   readTerritories = () => registerTerritoriesFor(readFlagSnapshot(poolRoot)),
+  // What to CALL the wired register on screen. Beside `readTerritories` and injected for the same
+  // reason: the covered set says a territory cannot be searched, and this says by what — the screen
+  // cannot name the register from the key without printing an engine identifier at a client.
+  readRegisterLabel = () => registerLabelFor(readFlagSnapshot(poolRoot)),
   // — whether this deployment has a case-law source enrolled at all. Same
   // injection and same snapshot as the two above, and the same tri-state: null is "the snapshot does not
   // say", which must not render as a warning on a working box.
@@ -1280,6 +1311,7 @@ export function makePortalService({
     const built = readBuilt();
     const canCount = readCanCount();
     const territories = readTerritories();
+    const registerLabel = readRegisterLabel();
     const caseLawReady = readCaseLaw();
     return {
       // Every product is LISTED whatever its state. A product that vanishes when unavailable leaves a
@@ -1335,6 +1367,16 @@ export function makePortalService({
       // not told me", which fails open. A `covered ?? []` anywhere on this path offers zero territories
       // on a production box.
       ...(territories === undefined ? {} : { territories }),
+      // THE REGISTER'S NAME, sent whenever there is one. The covered set alone lets the screen mark a
+      // territory as unreachable; it cannot say by WHAT, and the sentence the door refuses with names
+      // the register ("China is not available with Signa, the register configured here"). A screen that
+      // marked a chip without naming the register would be a second, vaguer wording for one fact.
+      //
+      // OMITTED, never nulled, exactly as `territories` above: absent means this deployment did not say,
+      // and the screen must then mark the territory without naming a register rather than invent one.
+      // It is the register's own display label, never the provider key — the key is an engine
+      // identifier and has no place on a client's screen.
+      ...(registerLabel ? { registerLabel } : {}),
       // `base` and `nativeLanguage` ride the LIST row, not just the record: the composer has to say what
       // geography a saved search accepts while the row is being clicked, and fetching the record per
       // selection would put that answer one round trip behind the Review button. Only `true` travels for
@@ -1842,9 +1884,7 @@ export function makePortalService({
           return null;
         }
         if (used.today + 1 <= limit) return null;
-        return { status: 429, json: { ok: false, errors: [
-          `You have used all ${limit} of this account's searches for today. The allowance resets at midnight UTC — or ask your ${BRAND.name} contact to run this one for you.`,
-        ] } };
+        return { status: 429, json: { ok: false, errors: [allowanceExhaustedLine(limit, BRAND.name)] } };
       };
 
       // /portal/api/run/plan — the confirmation gate (no spend)

package/driver/predelivery-lint.mjs

@@ -32,7 +32,7 @@ import { writeUpViolations, writeUpMessage } from "./narrative-write-ups.mjs";
 import { findRegistryArithmeticIssues, findRegistryViolations, splitBlocks } from "./registry-fidelity.mjs";
 import { CLIENT_TIER_BY_COMPOSITE, joinFindingToBlock, parseBlockOrd, worstLiveBand, NO_RATED_CONFLICTS, deriveActionConditions, isUnconditionalProceed, verdictStance, joinAskToAnswer, projectAssessmentField, POSITION_REQUIRED_DISPOSITIONS, OFF_FIELD_GROUNDS, FINDINGS_SCHEMA_VERSION, netChainMarkers, STATEMENT_CLAUSE_MAX } from "./findings-model.mjs";
 import { normalizeBand } from "./framework.mjs";
-import { clientConditions, ENGINE_TOKEN_RE } from "./terminal-clamp.mjs";   // the reader's clause per condition, and the token shape it may never carry
+import { clientConditions, unrenderableConditions, ENGINE_TOKEN_RE } from "./terminal-clamp.mjs";   // the reader's clause per condition, and the token shape it may never carry
 import { knockoutNoteView, REQUEST_NOTE_WORDS, REQUEST_SUBJECT_WORDS } from "./findings-model.mjs";   // one reader for where a note prints
 import { isEngineAppendedCaveat } from "./verify-knockout.mjs";   // ONE derivation for "the engine appended this caveat, not a seat"
 
@@ -1976,10 +1976,20 @@ export function clientConditionVoiceChecks({ verdictDoc }) {
   const carrying = clientConditions(verdictDoc)
     .map((c) => ({ c, m: String(c).match(ENGINE_TOKEN_RE) }))
     .filter((x) => x.m);
+  // THE SECOND CHECK IS WHAT KEEPS THE FIRST ONE HONEST. The fallback now composes the reader's
+  // sentence from a pre-split reason's own counts, and DROPS a token-bearing reason it cannot compose
+  // one for. Both outcomes leave the first check passing, and they mean opposite things: one is the
+  // condition reaching the client in a lawyer's nouns, the other is the condition reaching nobody. A
+  // single check reporting a clean page for both would be an absence read as a pass.
+  const dropped = unrenderableConditions(verdictDoc);
   return [check("client-condition-voice", "verdict", "report", carrying.length === 0,
     carrying.length
       ? `${carrying.length} delivered condition${carrying.length === 1 ? "" : "s"} carr${carrying.length === 1 ? "ies" : "y"} an engine identifier, so the client's "conditional on:" list reads the run record rather than the reader's sentence: ${carrying.slice(0, 3).map((x) => `"${x.m[0]}"`).join(", ")}${carrying.length > 3 ? ` (+${carrying.length - 3} more)` : ""}. The clause exists at the clamp site; persist it and this list takes it. A sidecar written before clauses were persisted flags until the run is re-generated.`
-      : "")];
+      : ""),
+    check("client-condition-dropped", "verdict", "report", dropped.length === 0,
+      dropped.length
+        ? `${dropped.length} condition${dropped.length === 1 ? " was" : "s were"} recorded for this run and reach no client surface: the run-record reason carries an engine identifier and no reader's sentence was stored or could be composed from it, so it is dropped rather than printed in engine voice. The report ships without it and the run record keeps it: ${dropped.slice(0, 2).map((r) => `"${r.slice(0, 80)}…"`).join(", ")}${dropped.length > 2 ? ` (+${dropped.length - 2} more)` : ""}. Add the defect's sentence to the clause authority in terminal-clamp.mjs, or persist a clause at the clamp site.`
+        : "")];
 }
 
 export function statementCoherenceChecks({ verdictDoc }) {

package/driver/publish/index.mjs

@@ -18,10 +18,12 @@ import { readStore, requiredAbsent, nonClosingAbsences } from './publish-inputs.
 import { clearanceReportData } from './report-data.mjs';
 import { searchDepthRecord } from './search-depth.mjs';   // how much was read to reach the answer, as counts and tokens
 import { parseFrameworkManifest } from '../framework.mjs';
-import { rollupTokens } from '../tokens.mjs';
+import { rollupTokens, servedModels } from '../tokens.mjs';
 import { reportIdentityFor, productCoverageNote, isRegisterOnly } from '../search-policy.mjs';
 import { readRecordArtifacts, bindFindingsToRecords, joinEvidenceStatus } from '../registry-fidelity.mjs';
 import { deliveryFlagLines } from '../predelivery-lint.mjs';
+import { unrenderableConditions } from '../terminal-clamp.mjs';   // — the conditions that reach no client surface
+import { runLog } from '../log.mjs';   // — one line in the run record when one does
 import { PROVIDERS, config } from '../driver.config.mjs';
 import { declaredRecordOrigins } from '../record-origins.mjs';
 import { NEUTRAL_DELIVERY, loadProfiles } from '../profiles.mjs';
@@ -791,6 +793,30 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   // the narrative, never in a status line). Best-effort; legacy runs have no sidecar.
   let verdictInfo = null;
   try { verdictInfo = JSON.parse(readFileSync(driverDir(runDir, 'verdict.json'), 'utf8')); } catch { /* legacy */ }
+  // ── THE CONDITIONS THAT REACH NO PAGE, RECORDED RATHER THAN LOST ────────────────────────────────
+  //
+  // A condition whose reader-facing sentence was never stored and cannot be composed from the run
+  // record's own counts is dropped instead of printed in the engine's words. That is right for the
+  // reader and it is a silent loss for everyone else, so the drop reports itself twice: an ordinary
+  // row on the workbook's gaps sheet, and one line in the run record here.
+  //
+  // THE WORDS ARE THE RUN RECORD'S OWN. The reason is what the clamp site wrote; the state word and the
+  // column headings are the gaps sheet's. Nothing on this path composes a sentence.
+  //
+  // A FRESH RUN NEVER REACHES THIS. Every clamp site stores its clause, so the list is empty and the
+  // sheet grows no row and the log gains no line. It bites on a republished archive, which is exactly
+  // where the operator has no other way to learn the page is short of a point.
+  const droppedConditions = unrenderableConditions(verdictInfo || {}).map((reason) => ({
+    area: 'Conditions', state: 'open', note: reason,
+  }));
+  // Best-effort, in the house pattern: a publish never fails for want of a log line, and a republish
+  // from a directory this process cannot write is still a publish.
+  if (droppedConditions.length && runDir) {
+    try {
+      runLog(runDir, { event: 'client-condition-dropped', n: droppedConditions.length,
+        reasons: droppedConditions.map((c) => c.note) });
+    } catch { /* the workbook row is the record that matters; this line is the second copy */ }
+  }
   // doc 50 — the run's FROZEN framework manifest (band vocabulary). Present on band-doctrine runs;
   // absent on every archived run (they render byte-identically on the legacy paths).
   let framework = null;
@@ -902,7 +928,14 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   const reviewReceipts = {
     // `family` rides along for deliveryFlagLines' fallback: a check whose id is not in the projection
     // table still projects to its family's sentence rather than to anything the engine wrote.
-    lint: (lintSink?.checks ?? []).filter(c => !c.pass).map(c => ({ id: c.id ?? '', family: c.family ?? '', detail: c.detail ?? '' })),
+    // ONE CHECK IS DELIBERATELY NOT PROJECTED. `client-condition-dropped` has no sentence of its own
+    // in the projection table, so it fell through to its family's — "the delivered outcome and the
+    // report's own text do not agree" — which describes a contradiction. This is an omission: the
+    // outcome and the text agree perfectly and both are short of a point. It says what happened on the
+    // gaps sheet and in the run record now, in the run record's own words, so the borrowed sentence
+    // comes off rather than being replaced by a better one (ruled 2026-09-17).
+    lint: (lintSink?.checks ?? []).filter(c => !c.pass && c.id !== 'client-condition-dropped')
+      .map(c => ({ id: c.id ?? '', family: c.family ?? '', detail: c.detail ?? '' })),
     engagement: integritySink?.engagement ?? null,
     registryCorrections: Array.isArray(integritySink?.registryCorrections)
       ? integritySink.registryCorrections.filter((c) => c && c.from != null && c.to != null) : [],
@@ -1032,7 +1065,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
       // the same rule (the workbook's own BANNED gate had already started firing on the raw detail —
       // advisory, so CI stayed green). reviewReceipts.lint keeps its raw detail for the internal
       // readers above (fetchState reads registry-record-coverage's URIs out of it).
-      counts = await buildAudit({ findings, coverage, contextNotes, coverageJudgment, markAssessment, corrections: correctionsDoc, fetchState, verdict: verdictInfo, jurisdiction, commonLawJoinedTerms, registerOnly, clientGate, lintFailures: deliveryFlagLines(reviewReceipts.lint), productName, registerPublishesRecordPages: runOrigins == null ? null : runOrigins.length > 0, recordLinks: officeLinks?.byUri ?? null }, auditParsed, join(poolRunDir, auditFile), fm.title, fm);
+      counts = await buildAudit({ droppedConditions, findings, coverage, contextNotes, coverageJudgment, markAssessment, corrections: correctionsDoc, fetchState, verdict: verdictInfo, jurisdiction, commonLawJoinedTerms, registerOnly, clientGate, lintFailures: deliveryFlagLines(reviewReceipts.lint), productName, registerPublishesRecordPages: runOrigins == null ? null : runOrigins.length > 0, recordLinks: officeLinks?.byUri ?? null }, auditParsed, join(poolRunDir, auditFile), fm.title, fm);
       grpRead(join(poolRunDir, auditFile), 0o640);
       if (counts?.gateViolations?.length) console.warn(`[audit-workbook] advisory: ${counts.gateViolations.join(' | ')}`);
     } catch (e) {
@@ -1053,6 +1086,11 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   // rather than wire the overlay in: client names saturate privileged report prose — a partial blur is a
   // worse demo than no toggle.
   const reportNav = siteNav(poolRoot, 'report', null, '../', { anon: false });
+  // The models that served this run, named as a client may read them (tokens.mjs servedModels). The closing
+  // line of the report's scope section, the data file and the meta below all take this one read; a read
+  // that throws records nothing rather than failing the publish.
+  let served = null;
+  try { served = runDir ? servedModels(runDir) : null; } catch { served = null; }
   // `demoData` is resolved above the report.md write — one answer, every surface.
   // ── HOW MUCH WAS READ TO REACH THE ANSWER ──────────────────────────────────────────────────────
   // Derived here rather than in a stage so a REPUBLISH of an archived run picks the fields up with no
@@ -1076,7 +1114,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
     writeRO('search-depth.json', JSON.stringify(searchDepth, null, 2));
   } catch { /* the depth record is additive — a publish never fails for want of it */ }
 
-  writeRO('report.html', renderHtml(parsed, findings, coverage, { demoData, productName, depthNote, scopeBasis, auditFile: auditFile || undefined, runId, delivery: deliv, recordsByUri, contextNotes, coverageJudgment: coverageJudgmentDisplay, markAssessment, fourAnswers, homeHref: '../index.html', nav: reportNav, chromeHref: '../assets/chrome.css', issued, asOf, verdictInfo, framework, searchedJurisdictions, caseLawByOrdinal, caseLawNotice, enforcerSignals, recordOrigin, recordOrigins: runOrigins, recordCitation: runProviderConf?.recordCitation ?? null, recordLinks: officeLinks?.byUri ?? null, providerLabel, seniorRights, findingsSchemaVersion, searchDepth }));
+  writeRO('report.html', renderHtml(parsed, findings, coverage, { demoData, servedModels: served, productName, depthNote, scopeBasis, auditFile: auditFile || undefined, runId, delivery: deliv, recordsByUri, contextNotes, coverageJudgment: coverageJudgmentDisplay, markAssessment, fourAnswers, homeHref: '../index.html', nav: reportNav, chromeHref: '../assets/chrome.css', issued, asOf, verdictInfo, framework, searchedJurisdictions, caseLawByOrdinal, caseLawNotice, enforcerSignals, recordOrigin, recordOrigins: runOrigins, recordCitation: runProviderConf?.recordCitation ?? null, recordLinks: officeLinks?.byUri ?? null, providerLabel, seniorRights, findingsSchemaVersion, searchDepth }));
   // ONE report (spec 2026-07-30 §5): report.client.html is no longer written. The knockout lane's own
   // collapse note is the precedent: "two renderings of one run is how the wrong link gets sent". The
   // client host serves the same report.html through the portal's readReport() (cleaning built in) — its
@@ -1150,7 +1188,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
       // is the LAST resort (a level today's registry no longer knows). meta.json below keeps the frozen
       // stamp BY DESIGN — its readers re-derive.
       auditFile, searchLevel: searchPolicy?.level ?? null, stageLabel: stageLabel ?? searchPolicy?.stageLabel ?? null,
-      engineCommit: engineCommit(),
+      engineCommit: engineCommit(), servedModels: served,
       framework, verdictInfo, findings, coverage, contextNotes, markAssessment, fourAnswers, askAnswers,
       actions: actionsRegister, jurisdiction, searchedJurisdictions, scopeBasis, caption: fm.overall_caption ?? null,
     });
@@ -1175,6 +1213,9 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
     issuedAt,
     // WHICH BUILD produced this. null off a git checkout — a provenance stamp never fails a publish.
     engineCommit: engineCommit(),
+    // The models that served the run, named as a client may read them (tokens.mjs servedModels). Absent when
+    // nothing was read, so a meta from before the record keeps its shape; [] when turns ran and named none a client may read.
+    servedModels: served ?? undefined,
     kind: 'clearance', recordLinks: officeLinks?.tally ?? undefined,   // per office: linked, or cited by number and why; only where the register has no record pages
     searchLevel: searchPolicy?.level ?? undefined,
     // Display-only face of the level ("Depth 4"), frozen alongside it so the list can show which reads

package/driver/publish/knockout.mjs

@@ -21,6 +21,7 @@ import { batchMarkName } from '../mark-name.mjs';
 import { renderKnockoutHtml, knockoutReportData } from './render-knockout.mjs';
 import { resolveDemoData, demoBannerMd } from './demo-marking.mjs';   //
 import { engineCommit } from '../engine-build.mjs';
+import { servedModels } from '../tokens.mjs';
 import { knockoutFindingViews, knockoutFindingRange } from '../findings-model.mjs';
 import { knockoutReceipts, worstBand } from '../verify-knockout.mjs';
 
@@ -518,6 +519,10 @@ export async function publishKnockout({ runId, codename, runDir, findings, plan,
   // — resolved once for the whole publish, off the same two sources the clearance
   // publisher uses (frozen sidecar, then roster; either marks, neither un-marks).
   const demoData = resolveDemoData({ runDir, customerKey });
+  // The models that served this batch, named as a client may read them — read once, like the demo answer,
+  // because it is a property of the run. A read that throws records nothing rather than failing a publish.
+  let served = null;
+  try { served = runDir ? servedModels(runDir) : null; } catch { served = null; }
   const reports = markRows.map((m) => {
     const slug = kebab(m.name);
     const file = single ? 'report.html' : `report-${slug}.html`;
@@ -558,12 +563,13 @@ export async function publishKnockout({ runId, codename, runDir, findings, plan,
       // document says it did not search is what the run was instructed not to search.
       searchPolicy: searchPolicy ?? null,
       delivery,
+      servedModels: served,
     }));
     // The run as data — what the assistant drafts client-facing mail from, and the shape the portal's
     // native-render path has been reading for since before anything wrote it. One per report, so the
     // native render of a per-mark document is that mark's data and not the batch's.
     writeRO(dataFile, JSON.stringify(knockoutReportData(one, framework, {
-      runId, codename, overall: markBand, issued, registerCounts, registerRecords, ownerChecks, auditFile, customerKey, matter: runId,
+      runId, codename, overall: markBand, issued, registerCounts, registerRecords, ownerChecks, auditFile, customerKey, matter: runId, servedModels: served,
       identity: { ...identity, level: searchPolicy?.level ?? null },
       url: reportUrlFor(slug),
     }), null, 2));
@@ -625,6 +631,9 @@ export async function publishKnockout({ runId, codename, runDir, findings, plan,
       .filter(Boolean).join(' — '),
     markName: batchMarkName(markNames) ?? undefined,
     engineCommit: engineCommit(),
+    // The models that served the batch, named as a client may read them (tokens.mjs servedModels). Absent when
+    // nothing was read, so a meta from before the record keeps its shape; [] when turns ran and named none a client may read.
+    servedModels: served ?? undefined,
     client: null, customerKey: customerKey || 'generic',
     // WHICH ORGANISATION'S GENERIC this batch was filed under, read from the frozen sidecar exactly as
     // the clearance publisher reads it. Absent on a company's batch and on one filed before

package/driver/publish/render-knockout.mjs

@@ -47,7 +47,8 @@ import { COUNT_BASIS, COUNT_PREDICATES, countsForMark, countLine, variantFormsLi
 import { RECORD_BASIS, recordsForMark, recordsLine } from '../register-records.mjs';
 import { officeLinkSentences } from './office-record-links.mjs';
 import { knockoutFindingViews, splitKnockoutNotes } from '../findings-model.mjs';
-import { demoBannerHtml } from './render.mjs';   // — the SAME banner the clearance template renders, not a second wording
+import { demoBannerHtml, servedModelsLine } from './render.mjs';   // — the SAME banner the clearance template renders, not a second wording
+import { EXPORT_TOGGLE, exportPopover, EXPORT_MENU_JS } from './report-topbar.mjs';   // — the export menu's shell and behaviour, shared with the clearance template   // — the SAME banner the clearance template renders, not a second wording
 // — the two facts the register card is allowed to read off a raw record, and NEITHER is minted
 // here. `makeClassifyStatus` and `isAllClass` are the screening lane's own, already shipped, already
 // fail-open; re-deriving either in a renderer would be this file starting a second status vocabulary,
@@ -1658,6 +1659,10 @@ export function renderKnockoutHtml(findings, framework, {
   // renders the same plain "Privileged & Confidential" this template always printed — so the ~15 unit
   // fixtures and both render-check scripts, none of which pass one, are unchanged by its arrival.
   delivery = null,
+  // The models that served the batch, as tokens.mjs servedModels names them for a client: the scope
+  // section's closing line. Defaults to null, so a fixture or an archived run that passes none renders
+  // as it always did.
+  servedModels = null,
   // — IS THIS AN INVENTED MARK? This template had no demo handling of any kind, so
   // every demo knockout shipped looking real: an invented mark, a real register basis, a real-looking
   // risk assessment, a published URL, and nothing saying the matter is fiction. The clearance template
@@ -1668,6 +1673,11 @@ export function renderKnockoutHtml(findings, framework, {
   const marks = findings?.marks ?? [];
   const title = batchTitle(marks);
   const productName = identity?.identity ?? null;
+  // A DATE, NOT A TIMESTAMP. `issued` is composed as `<date> · <time>` at publish, and the time is the
+  // minute the file was written — it tells a reader nothing and implies a precision the work does not
+  // have. Every mock issues the date alone. Taken by pattern rather than by splitting on the
+  // separator, so a format that changes falls through whole instead of being cut in the wrong place.
+  const issuedDate = (String(issued ?? '').match(/^\d{4}-\d{2}-\d{2}/) || [])[0] ?? issued;
   const overallStop = bandStop(framework, overall);
   const summary = findings?.batch?.executiveSummary ?? '';
   const caveats = findings?.batch?.standardCaveats ?? [];
@@ -1776,9 +1786,44 @@ ${filings}`
   ${homeHref ? `<a class="homebtn tb-back no-print" href="${escAttr(homeHref)}" title="All reports"><span aria-hidden="true">←</span> <span class="tb-back-lbl">All reports</span></a>` : ''}
   ${logoLockup({ mark: 20, tag: '' })}<span class="sp"></span>
   <span class="tb-risk" style="background:var(${overallStop})">${esc(overall ?? '—')}</span>
-  <span class="mono tb-matter" style="font-size:11px;color:var(--faint)">${esc(matter || runId || '')}</span>
-  ${issued ? `<span class="mono tb-issued"><span aria-hidden="true">🗓 </span>Issued on ${esc(issued)}</span>` : ''}
-  <button type="button" class="tbbtn tb-ask no-print">\u2726 <span class="tb-lbl">Ask AI</span></button>
+  ${/* THE IDENTITY LINE NAMES THE MARK AND THE SEARCH, NOT THE RUN. It printed `matter || runId`,
+       and the caller passes the runId AS the matter, so what a client read was the engine's own run
+       identifier — on a real run a temporary-directory name carrying a capture suffix. It is ours, it
+       means nothing to them, and it is the one string on the page that could not be shown to anyone.
+       The mock reads mark then search type, and both are already in hand here.
+       There is NO fall back to the identifier: with no product name the mark stands alone, and with
+       neither the line does not render. A run whose registry identity is missing is exactly the case
+       that used to print the raw name, so falling back would keep the defect for the runs that have
+       it. */''}
+  ${title || productName ? `<span class="mono tb-matter" style="font-size:11px;color:var(--faint)">${
+    [title, productName].filter(Boolean).map(esc).join(' / ')}</span>` : ''}
+  ${issuedDate ? `<span class="mono tb-issued"><span aria-hidden="true">🗓 </span>Issued on ${esc(issuedDate)}</span>` : ''}
+  ${/* THE EXPORT CONTROL, which this template had never emitted. The approved header carries it and the
+       clearance report has it; the knockout offered a reader who opens the file no route to a PDF at
+       all, while its own stylesheet still described the utility buttons as "used by the topbar Export
+       popover" — the styling for a control that was not there.
+       NO TICK WORDING AND NO SELECT-ALL. The clearance's entry reads "Export PDF (ticked findings)"
+       and its popover offers Select all / Select none, because its exportPDF filters to the ticked
+       ones. This template has no pickbox anywhere, so `pickAll` is deliberately not defined here and a
+       tick verb would name a control that cannot exist. What prints is the whole document.
+       EVERY WORD IN IT IS ALREADY THE PRODUCT'S. The board draws the Export button and its caret and
+       stops there — it does not draw what the menu contains — so the entries are the clearance
+       report's own, verbatim, minus the tick wording that names a control this template does not have.
+       The heading this first carried ("Export") was written here and is gone: a word on a page a
+       client reads is the owner's to choose, and the board does not ask for one.
+       THE MARKUP IS THE CLEARANCE'S, RE-EMITTED RATHER THAN SHARED, and that is a debt this change
+       takes on knowingly: `render.mjs` is frozen at a content hash, and extracting its top bar is its
+       own change with its own byte-comparison against a real archived run. Filed as a follow-up. The
+       class names are the shared vocabulary this file already emits, so report.css styles both. */''}
+  <div class="tb-menu">
+    <button type="button" class="tbbtn tb-ask no-print">\u2726 <span class="tb-lbl">Ask AI</span></button>
+    ${EXPORT_TOGGLE}
+    ${exportPopover(`
+      <button class="util primary" onclick="exportPDF()">\u2b07 Export PDF</button>
+      <div class="tb-sep"></div>
+      <div class="tb-row"><button class="util" onclick="openAll(true)">Expand all</button><button class="util" onclick="openAll(false)">Collapse all</button></div>
+    `)}
+  </div>
 </div>
 </div>
 <div class="fab-stack">${themeButton()}</div>
@@ -1799,7 +1844,10 @@ function openAll(v){document.querySelectorAll('details.ko-full').forEach(functio
 function exportPDF(){window.print();}
 (function(){var o=function(){openAll(true);};
 if(window.matchMedia){var m=window.matchMedia('print');if(m.addEventListener)m.addEventListener('change',function(e){if(e.matches)o();});}
-window.addEventListener('beforeprint',o);})();</script>
+window.addEventListener('beforeprint',o);})();
+/* The popover opens on its own button, closes on a click outside it and on Escape. Same two listeners
+   the clearance template carries, for the same markup; they move together when the top bar is shared. */
+${EXPORT_MENU_JS}</script>
 <div class="wrap">
   <header class="hero">
     ${demoBannerHtml(demoData === true)}
@@ -1839,7 +1887,18 @@ window.addEventListener('beforeprint',o);})();</script>
     newCaveats.map((c) => inlineMd(c)).join('<br>')}</p></div>` : ''}
 
   <footer>
-    <span>${productName ? `${esc(productName)}. ` : ''}<br>Matter ${esc(matter || runId || '')}.${issued ? ` Issued ${esc(issued)}.` : ''}</span>
+    ${/* THE FOOTER NAMES THE SAME THREE THINGS THE HEADER DOES. It read "<product>. / Matter
+         <runId>. Issued <date · time>." — the identifier again, under a label that calls it the
+         client's matter when it is the engine's run directory, and the publish clock again. The mock
+         reads mark · search · issued on date. Built from the same parts as the identity line so the
+         two cannot drift, and with the same rule: no part of it falls back to the identifier. */''}
+    <!-- WHICH MODELS SERVED THIS RUN — the same line, from the same function, as the clearance
+         report's footer. It used to ride the end of the scope block, which the 2026-09-16 redesign took
+         off this page; the line is provenance rather than the narration that was ruled out, so it moved
+         here. Owner ruling, 2026-09-17. Adjacent on purpose, as on the clearance side. -->${servedModelsLine(servedModels)}
+    <span>${[title, productName].filter(Boolean).map(esc).join(' \u00b7 ')}${
+      issuedDate ? `${title || productName ? ' \u00b7 ' : ''}issued on ${esc(issuedDate)}` : ''}${
+      title || productName || issuedDate ? '.' : ''}</span>
     ${logoLockup({ mark: 16 })}
   </footer>
 </div>
@@ -1859,7 +1918,7 @@ window.addEventListener('beforeprint',o);})();</script>
  * where the working notes live, and a data file that quietly re-admitted them would reopen exactly the
  * leak this series closed.
  */
-export function knockoutReportData(findings, framework, { runId, codename, overall, issued, identity, registerCounts, registerRecords = null, ownerChecks = [], url, auditFile, customerKey, matter }) {
+export function knockoutReportData(findings, framework, { runId, codename, overall, issued, identity, registerCounts, registerRecords = null, ownerChecks = [], url, auditFile, customerKey, matter, servedModels = null }) {
   const marks = findings?.marks ?? [];
   return {
     schema: 'report-data/1',
@@ -1870,6 +1929,9 @@ export function knockoutReportData(findings, framework, { runId, codename, overa
     issued: issued || null,
     url: url || null,
     auditFile: auditFile || null,
+    // The models that served the run, in first-use order, as tokens.mjs servedModels names them for a
+    // client: a deployment's own name never, its tier instead. null when nothing was read.
+    servedModels: Array.isArray(servedModels) ? servedModels : null,
     level: {
       searchLevel: identity?.level ?? null,
       stageLabel: identity?.stageLabel ?? null,