clearotron 0.3.2-beta.7 → 0.3.2-beta.9

package/driver/publish/knockout.mjs

@@ -7,20 +7,21 @@
 // self-reported trail), meta.json batch stamps, and the email composer. Deliberately separate from publishReport (single-clearance-shaped); shares the exported
 // palette (TONE_TIER, resolved against the run's FROZEN framework) so driver and interactive output
 // can never drift and a knockout never reads the clearance composer's module state.
-import { readFileSync, writeFileSync, mkdirSync, chmodSync, existsSync } from 'node:fs';
+import { readFileSync, writeFileSync, copyFileSync, mkdirSync, chmodSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { driverDir, ensureDriverDir } from '../../shared/driver-dir.mjs';   //
 import { riskTier, TONE_TIER, regenIndex, regenSurfaces, auditRouteFor, markReportRouteFor, reportRouteFor } from './index.mjs';
 import { runKnockoutLint, deliveryFlagLines } from '../predelivery-lint.mjs';
 import { note } from '../log.mjs';
 import { addSheet } from './xlsx.mjs';
-import { COUNT_PREDICATES, COUNT_BASIS, countsForMark, countLine, countedMarks, variantFormsLine } from '../register-count.mjs';
+import { COUNT_PREDICATES, COUNT_BASIS, countsForMark, countLine, countedMarks, variantFormsLine, disclosedFloor, moreThan } from '../register-count.mjs';
 import { RECORD_BASIS, recordsForMark, recordsLine, listedMarks, normalizeRegisterRecordLinks } from '../register-records.mjs';
 import { reportIdentityFor, productCoverageNote, kebab } from '../search-policy.mjs';
 import { batchMarkName } from '../mark-name.mjs';
 import { renderKnockoutHtml, knockoutReportData } from './render-knockout.mjs';
 import { resolveDemoData, demoBannerMd } from './demo-marking.mjs';   //
 import { engineCommit } from '../engine-build.mjs';
+import { servedModels } from '../tokens.mjs';
 import { knockoutFindingViews, knockoutFindingRange } from '../findings-model.mjs';
 import { knockoutReceipts, worstBand } from '../verify-knockout.mjs';
 
@@ -142,7 +143,8 @@ export async function buildKnockoutWorkbook(findings, receipts, outPath, registe
   if (noteRows.length) addSheet(wb, 'Working Notes', ['Mark', 'Type', 'Note'], noteRows);
 
   if (registerCounts?.marks?.length) {
-    const cell = (c) => (Number.isFinite(c?.total) ? c.total : 'not available');
+    // A floor the register disclosed is its own figure, printed as the report prints it.
+    const cell = (c) => (Number.isFinite(c?.total) ? c.total : disclosedFloor(c) !== null ? moreThan(disclosedFloor(c)) : 'not available');
     const countRows = (findings.marks ?? []).map((m) => {
       const e = countsForMark(registerCounts, m.name);
       const row = {
@@ -160,7 +162,7 @@ export async function buildKnockoutWorkbook(findings, receipts, outPath, registe
       row['Basis'] = COUNT_BASIS;
       // The verbatim provider reason for anything missing — the auditable half of "not available".
       row['Notes'] = COUNT_PREDICATES
-        .filter((p) => !Number.isFinite(e?.counts?.[p.key]?.total))
+        .filter((p) => !Number.isFinite(e?.counts?.[p.key]?.total) && disclosedFloor(e?.counts?.[p.key]) === null)
         .map((p) => `${p.label}: ${e?.counts?.[p.key]?.unavailable ?? 'no count recorded'}`)
         .join(' · ');
       return row;
@@ -334,6 +336,30 @@ export async function publishKnockout({ runId, codename, runDir, findings, plan,
   const poolRunDir = join(poolRoot, runId);
   mkdirSync(poolRunDir, { recursive: true });
   const writeRO = (name, data) => { const p = join(poolRunDir, name); writeFileSync(p, data); grpRead(p, 0o640); };
+
+  // ── THE RUN'S WORKING RECORD TRAVELS WITH THE REPORT ──────────────────────────────────────────────
+  //
+  // The delivered directory held the report, its data and the workbook, and nothing the engine itself
+  // wrote. That is what the acceptance read needs to tell a line the ENGINE wrote from a line the
+  // RENDERER invented: without it the check can still place a line as report text or as a sanctioned
+  // label, so it passes — and cannot fail in the way it exists to fail. A clearance run's record is
+  // `audit.md` and `findings.json`; this lane's own names are these two, and they are copied rather
+  // than rebuilt so the pool carries the bytes the stages wrote.
+  //
+  // AN ABSENT ONE IS SAID, NOT SKIPPED. A run whose stage never wrote its assessment is a different
+  // thing from a run that wrote one, and a publisher that copies what it finds and says nothing about
+  // what it does not makes the two look identical to the next reader — which is the whole defect this
+  // closes, one directory along.
+  for (const name of ['knockout-findings.json', 'knockout-assessment.md']) {
+    const src = join(runDir, name);
+    if (existsSync(src)) {
+      const dest = join(poolRunDir, name);
+      copyFileSync(src, dest);
+      grpRead(dest, 0o640);
+    } else {
+      note(`knockout working record: ${name} is not in the run directory, so the delivered report has no engine text to be checked against`);
+    }
+  }
   const issued = (() => {
     try {
       const d = new Date();
@@ -518,6 +544,10 @@ export async function publishKnockout({ runId, codename, runDir, findings, plan,
   // — resolved once for the whole publish, off the same two sources the clearance
   // publisher uses (frozen sidecar, then roster; either marks, neither un-marks).
   const demoData = resolveDemoData({ runDir, customerKey });
+  // The models that served this batch, named as a client may read them — read once, like the demo answer,
+  // because it is a property of the run. A read that throws records nothing rather than failing a publish.
+  let served = null;
+  try { served = runDir ? servedModels(runDir) : null; } catch { served = null; }
   const reports = markRows.map((m) => {
     const slug = kebab(m.name);
     const file = single ? 'report.html' : `report-${slug}.html`;
@@ -558,12 +588,13 @@ export async function publishKnockout({ runId, codename, runDir, findings, plan,
       // document says it did not search is what the run was instructed not to search.
       searchPolicy: searchPolicy ?? null,
       delivery,
+      servedModels: served,
     }));
     // The run as data — what the assistant drafts client-facing mail from, and the shape the portal's
     // native-render path has been reading for since before anything wrote it. One per report, so the
     // native render of a per-mark document is that mark's data and not the batch's.
     writeRO(dataFile, JSON.stringify(knockoutReportData(one, framework, {
-      runId, codename, overall: markBand, issued, registerCounts, registerRecords, ownerChecks, auditFile, customerKey, matter: runId,
+      runId, codename, overall: markBand, issued, registerCounts, registerRecords, ownerChecks, auditFile, customerKey, matter: runId, servedModels: served,
       identity: { ...identity, level: searchPolicy?.level ?? null },
       url: reportUrlFor(slug),
     }), null, 2));
@@ -625,6 +656,9 @@ export async function publishKnockout({ runId, codename, runDir, findings, plan,
       .filter(Boolean).join(' — '),
     markName: batchMarkName(markNames) ?? undefined,
     engineCommit: engineCommit(),
+    // The models that served the batch, named as a client may read them (tokens.mjs servedModels). Absent when
+    // nothing was read, so a meta from before the record keeps its shape; [] when turns ran and named none a client may read.
+    servedModels: served ?? undefined,
     client: null, customerKey: customerKey || 'generic',
     // WHICH ORGANISATION'S GENERIC this batch was filed under, read from the frozen sidecar exactly as
     // the clearance publisher reads it. Absent on a company's batch and on one filed before

package/driver/publish/pool-admin.mjs

@@ -116,7 +116,7 @@ function linkHome(poolDir) {
 
 // Locate an archived run's WORKSPACE dir (the publishReport input set: raw report.md, findings.json,
 // _driver/ sidecars) across every agent workspace. Layout (pipeline archive step):
-//   <workspaceRoot>/<workspacePrefix><agent>/studio/prelim-search/archive/<month|legacy-*>/<matter-slug>/<date-codename>/
+//   <workspaceRoot>/<workspacePrefix><agent>/studio/clearance-search/archive/<month|legacy-*>/<matter-slug>/<date-codename>/
 // where `<matter-slug>-<date-codename>` === runId. Returns every match (ambiguity is the caller's error).
 // The roots route through driver.config.mjs's workspace helpers (never inline the `workspace-` literal —
 // a deployment picks its own prefix via CLEAROTRON_WORKSPACE_PREFIX / CLEAROTRON_WORK_DIR).

package/driver/publish/publish-inputs.mjs

@@ -17,7 +17,7 @@
 // contract the publication gate held before it was retired into tests at — pass, fail, and COULD
 // NOT RUN, never folded into two — carried to the seam where a run becomes a client artifact.
 //
-// Modelled on mcp-server/lib/coverage.mjs:65-75 (assertValidatorCoverage): a closed partition asserted
+// Modelled on assertValidatorCoverage() in mcp-server/lib/coverage.mjs (lines 65-75): a closed partition asserted
 // at LOAD, so a new store cannot be added without consciously choosing its gating. The failure that
 // mechanism exists to prevent is the — a hand-copied mirror that silently stopped covering an
 // artifact and still answered "complete: yes" about a file it never checked.
@@ -57,10 +57,26 @@ export const PUBLISH_INPUTS = {
   "_driver/verdict.json": "optional",
   // doc 50 — the frozen band vocabulary. Present on band-doctrine runs only, by design.
   "_driver/framework.json": "optional",
+  // The recall net's receipt. Its overflow[] carries the probes the run minted and did not dispatch,
+  // one row each on the workbook's gaps sheet. `optional`, and the reason is the recall net's own
+  // switches: the lane is env-gated for rollback and mints nothing when a matter has no remembered
+  // conflict, so an absent receipt is a run that had nothing to record rather than one that lost it.
+  // `required` would close the gate on every knockout and every matter with a clean history.
+  "_driver/register-recall.json": "optional",
   // T6 (D4) — the frozen register plan; the render falls back to the coverage prose without it.
   "_driver/register-plan.json": "optional",
+  // The band the register returned, read ONLY where the run has no `_records/` archive, to count what was
+  // read and where. Optional: a knockout, a legacy run and a register-less run have none, and an absent
+  // band leaves the count as "cannot say" exactly as before.
+  "register-named-band.json": "optional",
   // The instructed scope, read only as the register plan's fallback for the searched-jurisdiction set.
   "_driver/instructed-scope.json": "optional",
+  // The frozen local-language lane decision, and the units the fold wrote. Read to derive how deep that
+  // investigation went against what the matter configured — through the engine's own asked-versus-ran
+  // reader, not by re-deciding it here. Optional and genuinely so: a plain clearance never runs the
+  // component and carries neither file, which is the state that folds to not-in-scope.
+  "_driver/jx-lanes.json": "optional",
+  "_driver/jx/units.json": "optional",
   // T7 (E5) — the grounded case-law profiles. A run with no case-law layer legitimately has none.
   "case-law-findings.md": "optional",
   // T7 (E6) — Corsearch enforcement telemetry; presentation-only, absent ⇒ no lines.
@@ -104,7 +120,7 @@ export const CALLER_SUPPLIED = {
 };
 
 /**
- * Load-time gate, on the assertValidatorCoverage model (mcp-server/lib/coverage.mjs:64-73).
+ * Load-time gate, modelled on assertValidatorCoverage() in mcp-server/lib/coverage.mjs (lines 64-73).
  *
  * Asserts the table is a well-formed closed partition: every gating is one of the two words, no store
  * is declared in more than one table, and no declaration is blank. It deliberately does NOT scan

package/driver/publish/render-knockout.mjs

@@ -40,14 +40,22 @@ import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import {
   REPORT_ROOT, REPORT_ROOT_DARK_EXPLICIT, THEME_INIT_EXPLICIT, themeButton,
-  THEME_BTN_CSS, CHROME_CSS, FAVICON_LINK, logoLockup, BRAND, confPosture,
+  THEME_BTN_CSS, CHROME_CSS, FAVICON_LINK, logoLockup, BRAND, confPosture, sectionStrip,
 } from '../../shared/brand.mjs';
 import { SUMMARY_BLOCK_LINE, parseSummaryBlocks } from '../../shared/summary-blocks.mjs';
-import { COUNT_BASIS, COUNT_PREDICATES, countsForMark, countLine, variantFormsLine } from '../register-count.mjs';
+
+// THIS BOARD'S FOUR ENTRIES, in its order. Its third reads "Also considered" and resolves at the filings
+// section, which is what that section is; the rule that filters them against the finished document lives
+// in shared/brand.mjs, beside the clearance report's own five.
+const STRIP = Object.freeze([
+  ['summary', 'Summary'], ['findings', 'Findings'], ['filings', 'Also considered'], ['next', 'Next steps'],
+]);
+import { COUNT_BASIS, COUNT_PREDICATES, countsForMark, countLine, variantFormsLine, disclosedFloor, moreThan } from '../register-count.mjs';
 import { RECORD_BASIS, recordsForMark, recordsLine } from '../register-records.mjs';
 import { officeLinkSentences } from './office-record-links.mjs';
 import { knockoutFindingViews, splitKnockoutNotes } from '../findings-model.mjs';
-import { demoBannerHtml } from './render.mjs';   // — the SAME banner the clearance template renders, not a second wording
+import { demoBannerHtml, servedModelsLine } from './render.mjs';   // — the SAME banner the clearance template renders, not a second wording
+import { EXPORT_TOGGLE, exportPopover, EXPORT_MENU_JS } from './report-topbar.mjs';   // — the export menu's shell and behaviour, shared with the clearance template   // — the SAME banner the clearance template renders, not a second wording
 // — the two facts the register card is allowed to read off a raw record, and NEITHER is minted
 // here. `makeClassifyStatus` and `isAllClass` are the screening lane's own, already shipped, already
 // fail-open; re-deriving either in a renderer would be this file starting a second status vocabulary,
@@ -163,6 +171,39 @@ function qualifierHtml(q) {
 // The layout this report adds on top of report.css. Additive and `ko-`prefixed: report.css is shared with
 // the frozen clearance renderer, and a selector that is inert there cannot regress it.
 const KO_CSS = `
+  /* THE BOARD'S SECTION STRIP AND ITS SECTION FURNITURE, lifted from the approved knockout board rather
+     than written here. Four entries; the third reads "Also considered" and resolves at the filings
+     section. Marked not to print, because the board marks it so: a strip that follows the reader down
+     the page is a control, and paper has nothing for it to follow.
+     NO BACKTICK BELOW, and none in this comment — one closes the template literal this sits inside, and
+     it has cost this file two silent breakages already.
+     The number span is drawn and then hidden, which is the board's own doing: it emits the span on every
+     section and sets it to none further down its own stylesheet. Carried so the delivered document holds
+     the same elements as the approved one; no pixel moves. */
+  /* THE BREADCRUMB IS A ROW OF THE HEADER, not a bar under it (owner, 2026-09-18).
+     It used to be a SIBLING of .rep-stickyhead, pinned on its own at top:var(--tb-h,52px) — and
+     --tb-h is set nowhere in this product, so the fallback was a guess at a bar that measures ~46px:
+     content showed through the slit between the two, and z-index:20 put the strip UNDER the header's
+     100 whenever the guess was wrong. The strip is now emitted inside .rep-stickyhead, so the header
+     and the breadcrumb are one sticky surface that pins and unpins together and can never gap or
+     overlap, whatever the bar measures or how it wraps.
+     No background and no bottom hairline of its own: the wrapper carries the blurred surface and the
+     single edge, and the border-top here is the divider between the two rows. It is on .strip rather
+     than on any wrapper because sectionStrip() emits NOTHING when fewer than two of its sections are
+     live — a wrapper would leave a stray line on those reports.
+     The gutter matches the topbar's, so the first entry lines up under the back button. */
+  .strip{display:flex;gap:4px;align-items:center;padding:4px max(26px,calc((100% - 1120px)/2)) 6px;
+    border-top:1px solid var(--line);font:600 12px/1 'Satoshi','Helvetica Neue',Arial,sans-serif;
+    letter-spacing:.04em;overflow-x:auto;scrollbar-width:none}
+  .strip::-webkit-scrollbar{display:none}
+  .strip a{display:inline-flex;align-items:center;gap:7px;padding:7px 10px;border-radius:999px;color:#6b5d50;text-decoration:none;white-space:nowrap}
+  .strip a i{width:8px;height:8px;border-radius:50%;border:1.5px solid currentColor;box-sizing:border-box}
+  .strip a.done{color:#4c7a4c}
+  .strip a.done i{background:#4c7a4c;border-color:#4c7a4c}
+  .strip a.now{color:#250902;background:rgba(0,0,0,.06)}
+  .strip a.now i{border-color:#860F09;border-width:3px}
+  .sec .num{display:none}
+  .sec .note{display:inline;margin-left:10px;font-size:12px;color:var(--faint)}
   .ko-glance{padding:6px 0 2px}
   /* — framework attribution, captioning the rows. Same gutter and hairline as.ko-row so it reads
      as the table's head, not a floating note. */
@@ -263,14 +304,55 @@ const KO_CSS = `
   .ko-scope{font-size:13.5px;color:var(--slate);line-height:1.65;margin:0;padding:18px 24px}
   .ko-scope b{color:var(--ink)}
   /* A wide counts table must scroll inside its own panel, never push the page sideways. */
+  /* AND IT SHOWS THAT IT SCROLLS. A panel that continues off its right edge and says nothing leaves a
+     reader who never drags it believing they have seen the whole table; the columns past the edge are
+     reachable and invisible at the same time. Ruled 2026-09-17: a scrollbar, always visible, and no text.
+     The -webkit-appearance:none is the part that does the work — without it the platform draws an OVERLAY
+     scrollbar that appears only once a scroll is already under way, which is the state this rule ends.
+     scrollbar-width and scrollbar-color are the same instruction for the engines that take the standard
+     properties. (NO BACKTICK IN THIS COMMENT: it sits inside the stylesheet's own template literal, and
+     one closes it. That is written above the export menu block too, and I still did it — so it is here
+     as well, beside the second rule anyone adds.) The colours are tokens, not fixed values, for the reason the ladder below this block
+     records: a fixed colour here reads on one ground and goes invisible on the other. */
   .ko-scroll{overflow-x:auto}
-  @media(max-width:700px){.ko-row{grid-template-columns:1fr;gap:10px}}
+  .ko-scroll::-webkit-scrollbar{height:9px;-webkit-appearance:none}
+  .ko-scroll::-webkit-scrollbar-track{background:transparent}
+  .ko-scroll::-webkit-scrollbar-thumb{background:var(--faint);border-radius:5px}
+  /* THE TWO INSTRUCTIONS CANNOT SIT TOGETHER, and this was measured rather than reasoned. Setting the
+     standard scrollbar-width alongside the pseudo-elements makes the engine take the standard path and
+     ignore them, and on this one the standard path draws an overlay bar with no layout height at all.
+     Driven three ways on a delivered report at 390px, reading the height the bar takes out of the panel:
+     both together 0px, the pseudo-elements alone 9px, the standard properties alone 0px. So the standard
+     ones go behind a support query that the engines carrying the pseudo-elements never enter, which
+     leaves each engine exactly one instruction. */
+  @supports not selector(::-webkit-scrollbar){
+    .ko-scroll{scrollbar-width:thin;scrollbar-color:var(--faint) transparent}}
+  /* A finding's bullets carry bare source URLs, and a URL offers a line no place to break. On a phone
+     that unbreakable run becomes the minimum width of the grid item, so the single column floors at
+     443px inside a 360px viewport and the whole page scrolls sideways -- 135px of it, measured
+     2026-09-17. Only the value "anywhere" lowers that minimum: "break-word" breaks the line but
+     leaves the minimum where it was, which is why the blocks beside this one that already set
+     word-break were never the cause. Phone widths only: nothing at or above 700px changes.
+     NO BACKTICK IN THIS COMMENT -- it sits inside the stylesheet's own template literal. */
+  @media(max-width:700px){.ko-row{grid-template-columns:1fr;gap:10px}
+    .ko-bul{overflow-wrap:anywhere}}
 
   /* The band ladder, the territories fold and the run's own caveats (the 2026-09-16 report redesign). Ported from
      the design's stylesheet with its fixed colours replaced by this page's tokens, so the ladder reads
      in both themes: the tick row was #a89a8a on white and the fold's summary and prose a brown pair,
      all three of which go invisible on the dark ground this report also renders on. */
-  .kscale{position:relative;margin:10px 8px 34px}
+  /* THE BAND PILL HANGS ABOVE THE BAR, so the space above the bar is what keeps it off the heading.
+     NO BACKTICK IN THIS COMMENT — it sits inside the stylesheet's own template literal.
+     .kmarker sits at top:-30px and the pill is ~23px tall (5+5 padding on a 13px line), so it starts
+     30px above the bar and ends 7px above it. At the LEFTMOST band the pill is also drawn flush left
+     (translateX(-12px) at left:0%) — directly under the left-aligned "Overall risk" — so that is the
+     rung where the two touch, and the house ladder's leftmost rung is Low.
+     THE ROOM IS ONE MARGIN, NOT TWO, and that is what made the arithmetic wrong twice. This margin and
+     .gauge .label's 18px bottom margin are ADJACENT SIBLINGS, so they collapse to the larger of the two
+     rather than adding: 10px here gave 18px of room against a pill that needs 30, and the first attempt
+     at 24 still left 6. Measured in a browser at every rung (scripts/report-header-render-check.mjs),
+     not reasoned: 44 gives 14px of daylight under the heading at every band. */
+  .kscale{position:relative;margin:44px 8px 34px}
   .kbar{position:relative;height:8px;border-radius:4px}
   .kmarker{position:absolute;top:-30px;text-align:center}
   .kpill{display:inline-block;padding:5px 12px;border-radius:999px;color:#fff;
@@ -433,9 +515,9 @@ function territoriesLine(registerCounts) {
   return `Counted on ${regions.length} registers, listed on the workbook's Register Counts sheet, on ${provider}.`;
 }
 
-/** What the counts do and do not say — the one line that replaces the count-basis paragraph on the page. */
-const COUNTS_READER_LINE = 'Counts include live, pending and dead filings. '
-  + 'A count is not a conflict; the cards above say which filings matter.';
+// The reader line that used to sit under the counts table ("a count is not a conflict…") is off the page:
+// the approved knockout board carries no caveat under the table, and the writing standard lists it among
+// the caveat sentences a page does not print. The column headers say what each count is.
 
 function countsSection(marks, registerCounts, positions = '') {
   // ── THE DEFINITION MOVES INTO THE COLUMN HEADER ──────────────────────────────────────────────────
@@ -470,9 +552,10 @@ function countsSection(marks, registerCounts, positions = '') {
       const why = c?.unavailable ?? (c
         ? 'no count recorded'
         : 'not counted on this run — it predates this column, and an archived report re-renders as what it was');
-      return Number.isFinite(c?.total)
-        ? `<td class="num">${esc(String(c.total))}</td>`
-        : `<td class="na" title="${escAttr(why)}">not available</td>`;
+      if (Number.isFinite(c?.total)) return `<td class="num">${esc(String(c.total))}</td>`;
+      // The register answered with its own floor: that is a figure, and it is printed as one.
+      if (disclosedFloor(c) !== null) return `<td class="num">${esc(moreThan(disclosedFloor(c)))}</td>`;
+      return `<td class="na" title="${escAttr(why)}">not available</td>`;
     }).join('');
     const scoped = e?.classScope !== 'all-classes' && (e?.classes?.length > 0);
     const scope = scoped
@@ -490,7 +573,7 @@ function countsSection(marks, registerCounts, positions = '') {
   // thing in three words each.
   return `<div class="panel">
   <div class="ko-counts ko-scroll"><table><thead><tr><th>Name</th>${head}</tr></thead><tbody>${rows}</tbody></table></div>
-  <p class="ko-basis">${esc(COUNTS_READER_LINE)}<br>${esc(territoriesLine(registerCounts))}${
+  <p class="ko-basis">${esc(territoriesLine(registerCounts))}${
     positions ? `<br>${esc(positions)}` : ''}</p>
 </div>`;
 }
@@ -1156,16 +1239,16 @@ function aboutRequestBlock(scope, requestNotes, depthNote = '', productContext =
   const cut = note.lastIndexOf(' \u2014 ');
   const stage = cut > 0 ? note.slice(0, cut).trim() : note;
   const context = String(productContext ?? '').trim();
-  // REGISTERS COUNTED IS A ROW, AND THE TERRITORY LIST HIDES BEHIND IT (the 2026-09-16 report redesign). A line of
-  // country names running through the middle of the panel is the thing a reader skips; the count and
-  // its source are what they read, and the list is one click away when they want it.
+  // REGISTERS COUNTED IS A ROW (the 2026-09-16 report redesign). A line of country names running through
+  // the middle of the panel is the thing a reader skips; the count and its source are what they read.
   const regions = (registerCounts?.scope?.regions ?? []).filter(Boolean);
   const provider = registerCounts?.providerLabel ?? registerCounts?.provider ?? '';
-  const named = regions.map(territoryName).filter(Boolean);
+  // THE BOARD'S OWN ROW: "186 registers, on Clarivate Compumark." — registers, because that is what was
+  // counted, and no fold: the board lists no territories here, and the workbook's counts sheet carries
+  // every register a figure was taken over.
   const counted = regions.length
-    ? `${regions.length} ${regions.length === 1 ? 'territory' : 'territories'}${provider ? `, on ${provider}` : ''}`
+    ? `${regions.length} ${regions.length === 1 ? 'register' : 'registers'}${provider ? `, on ${provider}` : ''}.`
     : (registerCounts ? `Counted worldwide${provider ? `, on ${provider}` : ''}` : '');
-  const territories = named.length ? listWords(named) : '';
   if (!asked && !where && !classLine && !stage && !context && !counted) return '';
   // ONE PANEL, THE SAME ON BOTH REPORTS (the 2026-09-16 report redesign). The rows carry what was asked for; the
   // counts row says what was counted and hides the territory list behind a fold rather than running a
@@ -1178,7 +1261,7 @@ function aboutRequestBlock(scope, requestNotes, depthNote = '', productContext =
       ${row('Classes', classLine)}
       ${row('Where searched', where)}
       ${row('Context', context)}
-      ${row('Registers counted', counted, territories ? `<details class="terr"><summary>View territories</summary><p>${esc(territories)}</p></details>` : '')}
+      ${row('Registers counted', counted)}
       ${row('Searched on', searched)}
       ${/* item 18 — a note for the reviewing lawyer does not reach the delivered page */''}
     </div>`;
@@ -1335,7 +1418,8 @@ function coverageClause(mark, registerCounts, probeRan) {
       ? 'Register: hit-counts are part of this search and none could be taken for this name — the reason is in the audit workbook.'
       : 'Register: not included in this product tier — no register was counted for this name.';
   }
-  const anyFigure = COUNT_PREDICATES.some((p) => Number.isFinite(entry.counts[p.key]?.total));
+  // A floor the register disclosed is a figure it gave, so a name counted only that way was counted.
+  const anyFigure = COUNT_PREDICATES.some((p) => Number.isFinite(entry.counts[p.key]?.total) || disclosedFloor(entry.counts[p.key]) !== null);
   if (!anyFigure) return 'Register: no count could be taken for this name — the reason is in the audit workbook.';
   // COVERAGE, NOT THE FIGURES. asks the renderer to own the register-tier caveat, and the numbers
   // are already on this page twice — in the glance line at the top and in the counts table above this
@@ -1658,6 +1742,10 @@ export function renderKnockoutHtml(findings, framework, {
   // renders the same plain "Privileged & Confidential" this template always printed — so the ~15 unit
   // fixtures and both render-check scripts, none of which pass one, are unchanged by its arrival.
   delivery = null,
+  // The models that served the batch, as tokens.mjs servedModels names them for a client: the scope
+  // section's closing line. Defaults to null, so a fixture or an archived run that passes none renders
+  // as it always did.
+  servedModels = null,
   // — IS THIS AN INVENTED MARK? This template had no demo handling of any kind, so
   // every demo knockout shipped looking real: an invented mark, a real register basis, a real-looking
   // risk assessment, a published URL, and nothing saying the matter is fiction. The clearance template
@@ -1668,6 +1756,11 @@ export function renderKnockoutHtml(findings, framework, {
   const marks = findings?.marks ?? [];
   const title = batchTitle(marks);
   const productName = identity?.identity ?? null;
+  // A DATE, NOT A TIMESTAMP. `issued` is composed as `<date> · <time>` at publish, and the time is the
+  // minute the file was written — it tells a reader nothing and implies a precision the work does not
+  // have. Every mock issues the date alone. Taken by pattern rather than by splitting on the
+  // separator, so a format that changes falls through whole instead of being cut in the wrong place.
+  const issuedDate = (String(issued ?? '').match(/^\d{4}-\d{2}-\d{2}/) || [])[0] ?? issued;
   const overallStop = bandStop(framework, overall);
   const summary = findings?.batch?.executiveSummary ?? '';
   const caveats = findings?.batch?.standardCaveats ?? [];
@@ -1748,11 +1841,11 @@ export function renderKnockoutHtml(findings, framework, {
     n + registerCardsOnPage(registerCardViews(m, framework, registerRecords).cards, m, framework).length, 0);
   const hasRecords = Boolean(registerRecords && (registerRecords.marks?.length || registerRecords.unavailable));
   const filings = hasRecords ? filingsSection(marks, registerRecords) : '';
-  const onFieldSec = `<div class="sec" id="findings"><h2>Conflicts</h2></div>
+  const onFieldSec = `<div class="sec" id="findings"><span class="num"></span><h2>Conflicts</h2></div>
 ${counts}
 ${analysis}`;
   const filingsSec = filings
-    ? `<div class="sec" id="filings"><h2>Also considered</h2></div>
+    ? `<div class="sec" id="filings"><span class="num"></span><h2>Also considered</h2><span class="note">the filings behind the counts</span></div>
 ${filings}`
     : '';
 
@@ -1764,7 +1857,7 @@ ${filings}`
   const cssInline = REPORT_BASE + '\n' + CHROME_CSS + '\n' + THEME_BTN_CSS + '\n' + KO_CSS;
   const chromeLinkTag = chromeHref ? `<link rel="stylesheet" href="${escAttr(chromeHref)}">` : '';
 
-  return `<!DOCTYPE html>
+  const doc = `<!DOCTYPE html>
 <html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 <title>${productName ? `${esc(productName)} — ` : ''}${esc(title)} · ${esc(BRAND.name)}</title>
 <link rel="preconnect" href="https://api.fontshare.com" crossorigin>
@@ -1776,10 +1869,46 @@ ${filings}`
   ${homeHref ? `<a class="homebtn tb-back no-print" href="${escAttr(homeHref)}" title="All reports"><span aria-hidden="true">←</span> <span class="tb-back-lbl">All reports</span></a>` : ''}
   ${logoLockup({ mark: 20, tag: '' })}<span class="sp"></span>
   <span class="tb-risk" style="background:var(${overallStop})">${esc(overall ?? '—')}</span>
-  <span class="mono tb-matter" style="font-size:11px;color:var(--faint)">${esc(matter || runId || '')}</span>
-  ${issued ? `<span class="mono tb-issued"><span aria-hidden="true">🗓 </span>Issued on ${esc(issued)}</span>` : ''}
-  <button type="button" class="tbbtn tb-ask no-print">\u2726 <span class="tb-lbl">Ask AI</span></button>
+  ${/* THE IDENTITY LINE NAMES THE MARK AND THE SEARCH, NOT THE RUN. It printed `matter || runId`,
+       and the caller passes the runId AS the matter, so what a client read was the engine's own run
+       identifier — on a real run a temporary-directory name carrying a capture suffix. It is ours, it
+       means nothing to them, and it is the one string on the page that could not be shown to anyone.
+       The mock reads mark then search type, and both are already in hand here.
+       There is NO fall back to the identifier: with no product name the mark stands alone, and with
+       neither the line does not render. A run whose registry identity is missing is exactly the case
+       that used to print the raw name, so falling back would keep the defect for the runs that have
+       it. */''}
+  ${title || productName ? `<span class="mono tb-matter" style="font-size:11px;color:var(--faint)">${
+    [title, productName].filter(Boolean).map(esc).join(' / ')}</span>` : ''}
+  ${issuedDate ? `<span class="mono tb-issued"><span aria-hidden="true">🗓 </span>Issued on ${esc(issuedDate)}</span>` : ''}
+  ${/* THE EXPORT CONTROL, which this template had never emitted. The approved header carries it and the
+       clearance report has it; the knockout offered a reader who opens the file no route to a PDF at
+       all, while its own stylesheet still described the utility buttons as "used by the topbar Export
+       popover" — the styling for a control that was not there.
+       NO TICK WORDING AND NO SELECT-ALL. The clearance's entry reads "Export PDF (ticked findings)"
+       and its popover offers Select all / Select none, because its exportPDF filters to the ticked
+       ones. This template has no pickbox anywhere, so `pickAll` is deliberately not defined here and a
+       tick verb would name a control that cannot exist. What prints is the whole document.
+       EVERY WORD IN IT IS ALREADY THE PRODUCT'S. The board draws the Export button and its caret and
+       stops there — it does not draw what the menu contains — so the entries are the clearance
+       report's own, verbatim, minus the tick wording that names a control this template does not have.
+       The heading this first carried ("Export") was written here and is gone: a word on a page a
+       client reads is the owner's to choose, and the board does not ask for one.
+       THE MARKUP IS THE CLEARANCE'S, RE-EMITTED RATHER THAN SHARED, and that is a debt this change
+       takes on knowingly: `render.mjs` is frozen at a content hash, and extracting its top bar is its
+       own change with its own byte-comparison against a real archived run. Filed as a follow-up. The
+       class names are the shared vocabulary this file already emits, so report.css styles both. */''}
+  <div class="tb-menu">
+    <button type="button" class="tbbtn tb-ask no-print">\u2726 <span class="tb-lbl">Ask AI</span></button>
+    ${EXPORT_TOGGLE}
+    ${exportPopover(`
+      <button class="util primary" onclick="exportPDF()">\u2b07 Export PDF</button>
+      <div class="tb-sep"></div>
+      <div class="tb-row"><button class="util" onclick="openAll(true)">Expand all</button><button class="util" onclick="openAll(false)">Collapse all</button></div>
+    `)}
+  </div>
 </div>
+<!--SECTION-STRIP-->
 </div>
 <div class="fab-stack">${themeButton()}</div>
 <script>
@@ -1799,9 +1928,12 @@ function openAll(v){document.querySelectorAll('details.ko-full').forEach(functio
 function exportPDF(){window.print();}
 (function(){var o=function(){openAll(true);};
 if(window.matchMedia){var m=window.matchMedia('print');if(m.addEventListener)m.addEventListener('change',function(e){if(e.matches)o();});}
-window.addEventListener('beforeprint',o);})();</script>
+window.addEventListener('beforeprint',o);})();
+/* The popover opens on its own button, closes on a click outside it and on Escape. Same two listeners
+   the clearance template carries, for the same markup; they move together when the top bar is shared. */
+${EXPORT_MENU_JS}</script>
 <div class="wrap">
-  <header class="hero">
+  <header class="hero" id="summary">
     ${demoBannerHtml(demoData === true)}
     ${confLineHtml(delivery, productName)}
     <h1 class="mark">${esc(title)}</h1>
@@ -1818,7 +1950,7 @@ window.addEventListener('beforeprint',o);})();</script>
     if (!outs.length) return '';
     const label = outs.length > 1;
     const body = outs.map((o) => (label && o.name ? `<h3>${esc(o.name)}</h3>` : '') + mdParagraphs(o.text)).join('');
-    return `<div class="sec" id="next"><h2>What happens next</h2></div>
+    return `<div class="sec" id="next"><span class="num"></span><h2>What happens next</h2></div>
   <div class="panel actions"><div class="actgrp act-you">${body}</div></div>`;
   })()}
 
@@ -1839,11 +1971,23 @@ window.addEventListener('beforeprint',o);})();</script>
     newCaveats.map((c) => inlineMd(c)).join('<br>')}</p></div>` : ''}
 
   <footer>
-    <span>${productName ? `${esc(productName)}. ` : ''}<br>Matter ${esc(matter || runId || '')}.${issued ? ` Issued ${esc(issued)}.` : ''}</span>
+    ${/* THE FOOTER NAMES THE SAME THREE THINGS THE HEADER DOES. It read "<product>. / Matter
+         <runId>. Issued <date · time>." — the identifier again, under a label that calls it the
+         client's matter when it is the engine's run directory, and the publish clock again. The mock
+         reads mark · search · issued on date. Built from the same parts as the identity line so the
+         two cannot drift, and with the same rule: no part of it falls back to the identifier. */''}
+    <!-- WHICH MODELS SERVED THIS RUN — the same line, from the same function, as the clearance
+         report's footer. It used to ride the end of the scope block, which the 2026-09-16 redesign took
+         off this page; the line is provenance rather than the narration that was ruled out, so it moved
+         here. Owner ruling, 2026-09-17. Adjacent on purpose, as on the clearance side. -->${servedModelsLine(servedModels)}
+    <span>${[title, productName].filter(Boolean).map(esc).join(' \u00b7 ')}${
+      issuedDate ? `${title || productName ? ' \u00b7 ' : ''}issued on ${esc(issuedDate)}` : ''}${
+      title || productName || issuedDate ? '.' : ''}</span>
     ${logoLockup({ mark: 16 })}
   </footer>
 </div>
 </body></html>`;
+  return doc.replace('<!--SECTION-STRIP-->', sectionStrip(doc, STRIP));
 }
 
 /**
@@ -1859,7 +2003,7 @@ window.addEventListener('beforeprint',o);})();</script>
  * where the working notes live, and a data file that quietly re-admitted them would reopen exactly the
  * leak this series closed.
  */
-export function knockoutReportData(findings, framework, { runId, codename, overall, issued, identity, registerCounts, registerRecords = null, ownerChecks = [], url, auditFile, customerKey, matter }) {
+export function knockoutReportData(findings, framework, { runId, codename, overall, issued, identity, registerCounts, registerRecords = null, ownerChecks = [], url, auditFile, customerKey, matter, servedModels = null }) {
   const marks = findings?.marks ?? [];
   return {
     schema: 'report-data/1',
@@ -1870,6 +2014,9 @@ export function knockoutReportData(findings, framework, { runId, codename, overa
     issued: issued || null,
     url: url || null,
     auditFile: auditFile || null,
+    // The models that served the run, in first-use order, as tokens.mjs servedModels names them for a
+    // client: a deployment's own name never, its tier instead. null when nothing was read.
+    servedModels: Array.isArray(servedModels) ? servedModels : null,
     level: {
       searchLevel: identity?.level ?? null,
       stageLabel: identity?.stageLabel ?? null,
@@ -1991,6 +2138,12 @@ export function knockoutReportData(findings, framework, { runId, codename, overa
             classScope: counted.classScope ?? null,
             classes: counted.classes ?? [],
             ...Object.fromEntries(COUNT_PREDICATES.map((p) => [p.key, Number.isFinite(counted.counts[p.key]?.total) ? counted.counts[p.key].total : null])),
+            // The figure stays null for a floor — a floor is never a count to be summed — and the floor
+            // rides beside it, so a reader of this file has the register's own figure and not only a null.
+            ...(COUNT_PREDICATES.some((p) => disclosedFloor(counted.counts[p.key]) !== null)
+              ? { floors: Object.fromEntries(COUNT_PREDICATES.filter((p) => disclosedFloor(counted.counts[p.key]) !== null)
+                .map((p) => [p.key, disclosedFloor(counted.counts[p.key])])) }
+              : {}),
             // The close column is an aggregate, so the forms under it ride with it — a consumer that
             // got the number and not the forms could restate the figure but never explain it, and this
             // file is what the assistant drafts client mail from.