clearotron 0.3.3-beta.1 → 0.4.0-beta.0

package/INSTALL.md

@@ -647,24 +647,11 @@ matches, the neutral Generic default applies.
   config store and the engine loads *those* companies instead. **Same engine, different config path** —
   the code carries no company identities.
 
-  Two things go with it, and both are refusals rather than preferences:
+  One thing goes with it, and it is a refusal rather than a preference:
 
   - **`PROFILE_REPO_ROOT` moves too.** The company directory has to sit inside the repository that
     variable names, because editing a profile is a commit. Point one somewhere new and leave the other
     behind and the portal and the profile service both refuse to start, naming both variables.
-  - **That repository needs a `user.name` and a `user.email` of its own.** Saves are committed under
-    the name of whoever asked for them, but git also records who *made* the commit, and it will not
-    commit at all without one. A service account usually has no global git identity, so a store created
-    by hand needs its own:
-
-    ```bash
-    git init -b main /srv/clearotron-store
-    git -C /srv/clearotron-store config user.name  "clearotron local install"
-    git -C /srv/clearotron-store config user.email "clearotron@example.com"
-    ```
-
-    `clearotron start` does this for the store it creates. A store you make yourself does not get it,
-    and the symptom is the first save failing at a commit rather than anything about profiles.
 - **Run data is external too.** Published reports, audits, and per-run state go to the archive pool at
   `CLEAROTRON_REPORTS_DIR`. Nothing company-specific is committed to the repository.
 

package/bin/brandowner.mjs

@@ -160,11 +160,10 @@ export async function add(argv, {
     contextPack = readFileSync(packFile, "utf8");
   }
 
-  // THE ROSTER IS READ BEFORE THE CANDIDATE IS BUILT, because the Generic default lives in it. The
-  // candidate is still judged as a member of the roster and not alone — see assertRosterAccepts.
+  // The candidate is judged as a member of the roster and not alone — see assertRosterAccepts.
   const { loadProfiles } = await import("../driver/profiles.mjs");
   const load = loadProfilesFn ?? loadProfiles;
-  const platforms = resolvePlatforms(args.platforms, rosterAsItStands(store, load));
+  const platforms = resolvePlatforms(args.platforms);
 
   const profile = buildProfile({
     key: args.key, name: args.name.trim(), domains: args.domains,
@@ -180,10 +179,11 @@ export async function add(argv, {
     : `framework: ${framework.path} — THE GENERIC DEFAULT, applied because none was supplied. `
       + `Their matters will be rated under it until they give us theirs.`;
 
+  // NONE, when none was supplied (the owner's ruling of 2026-09-23): the brand owner starts with no
+  // marketplaces, and the line says what their searches still cover.
   const platformsLine = platforms.source === "supplied"
     ? `platforms: ${platforms.platforms.join(", ")} — as supplied`
-    : `platforms: ${platforms.platforms.join(", ")} — THE GENERIC DEFAULT, applied because none was supplied. `
-      + `Their searches cover these marketplaces until someone changes them in the portal.`;
+    : `platforms: none — searches use the general web, plus any stores chosen for each matter.`;
 
   if (args.dryRun) {
     out(`would create ${join(store, `${args.key}.json`)}`);

package/bin/connect.mjs

@@ -135,10 +135,10 @@ export function systemdFailure(e, { step, unit = null } = {}) {
 const UNIT_DIR = join(homedir(), ".config", "systemd", "user");
 const ENV_PATH = join(homedir(), ".env");
 // Where the revocation list lives when this install has never named one — created by connect so the
-// door is BORN consulting it (; measured: no denylist is configured on production,
-// and `isRevoked()` returns false on an UNSET path — still true, and deliberately so: a deployment that
-// never asked for a denylist is not taken down by one. It is an unreadable list that now refuses
-//. Assuming a path nobody set still makes every issued key unrevokable).
+// door is BORN consulting it (; measured: no denylist is configured on production).
+// `isRevoked()` now reads this same default when the setting is unset, and an absent default reads as
+// "nothing revoked"; a list that is there and unreadable refuses. Naming the path is still what makes
+// every door, whatever home it runs under, read the file a revocation is written to.
 // — one owner for this path. It was written out here, in disconnect and twice
 // in start; `start` named it and created nothing, which is how a revoked key kept answering 200.
 const DENYLIST_PATH = defaultDenylistPath(homedir());

package/bin/onboard.mjs

@@ -3453,10 +3453,8 @@ export async function runCheck() {
       if (r.state === "valid") ok(line);
       else info(line);
     }
-    if (report.valid && !String(process.env.TRADEMARK_MCP_TOKEN_DENYLIST ?? "").trim()) {
-      problem("a valid key is on record but NO revocation list is configured (TRADEMARK_MCP_TOKEN_DENYLIST unset) "
-        + `— \`${invoke("disconnect")}\` could not actually revoke it. \`${invoke("connect")}\` arms one; set the variable or reconnect.`);
-    }
+    // No "revocation list not configured" problem any more: with TRADEMARK_MCP_TOKEN_DENYLIST unset, every
+    // door reads the install's default list (isRevoked, shared/scope.mjs), which is where disconnect writes.
     // THE PUBLISHED ADDRESS, AND WHETHER IT ANSWERS (acceptance 2). Reported here
     // rather than beside the unit, because the unit running and the address being reachable are
     // different facts and the second is the one a client depends on.
@@ -4496,9 +4494,9 @@ try {
   candidate.PROFILE_REPO_ROOT = cfg;   // no alias row — this name is current
   for (const k of ["CLEAROTRON_CUSTOMERS_DIR", "PROFILE_REPO_ROOT"]) ok(`${k}=${candidate[k]}`);
   // A REPOSITORY ALREADY THERE IS ASKED NOW, while the operator is still here, whether it can record a
-  // save. `clearotron start` gives a store it creates an identity of its own; one made by hand has none
-  // unless somebody set it, and on a machine with no global identity the first company created in the
-  // portal is refused. Said here, with the command, rather than discovered on that first company.
+  // save: one this account cannot use refuses the first company created in the portal. Said here, with
+  // the command, rather than discovered on that first company. A missing git identity is not asked
+  // about, because every save supplies the product's own committer.
   if (existsSync(join(cfgAbs, ".git"))) {
     const cannot = storeCommitRefusal(cfgAbs);
     if (cannot) warn(`${cannot.message}. Until then, creating a company in the portal is refused.`);

package/bin/start.mjs

@@ -111,7 +111,7 @@ export async function runTables() {
   return { registers: PROVIDERS, engines: ENGINE_BINARIES, defaultEngine: RUN_DEFAULT_ENGINE, resolveEngine: resolveEngineProgram };
 }
 import { spawn, spawnSync, execFileSync } from "node:child_process";
-import { storeInRepo, storeOutsideRepoMessage, storeCommitRefusal } from "../shared/store-in-repo.mjs";   //
+import { storeInRepo, storeOutsideRepoMessage, storeCommitRefusal, storeCommitEnv } from "../shared/store-in-repo.mjs";   //
 import { stdioConnectOffer } from "../shared/stdio-connect.mjs";
 import { wslTarget } from "../shared/wsl.mjs";   // — and which distribution a row should start the server in
 import { ensureDemoProgram } from "../shared/permanent-install.mjs";   // — a demo from npx keeps its own copy
@@ -1531,9 +1531,9 @@ if (isMain) {
       err(`  WARNING: could not initialise the saved-search store at ${paths.configStore} (${String(e?.message ?? e)}). Searches will list and run; SAVING one will fail until this is a git repository.`);
     }
   } else {
-    // AN ADOPTED STORE IS ASKED WHETHER IT CAN RECORD A SAVE, HERE, not at the first save. A repository
-    // made by hand has no identity unless somebody gave it one, and on a machine with no global identity
-    // the first company created in the portal is then refused. The one created above sets its own.
+    // AN ADOPTED STORE IS ASKED WHETHER IT CAN RECORD A SAVE, HERE, not at the first save: a directory
+    // that is not a repository this account can use refuses every company created in the portal. A store
+    // with no git identity is not refused; every save supplies the product's own committer.
     const cannot = storeCommitRefusal(paths.configStore);
     if (cannot) err(`  WARNING: ${cannot.message}. Until then, creating a company or saving a search is refused.`);
   }
@@ -1556,7 +1556,7 @@ if (isMain) {
         // and the first save commits them with its own change.
         try {
           execFileSync("git", ["-C", paths.configStore, "add", "-A", "--", "profiles"], { stdio: "ignore" });
-          execFileSync("git", ["-C", paths.configStore, "commit", "-q", "-m", "the demo's company"], { stdio: "ignore" });
+          execFileSync("git", ["-C", paths.configStore, "commit", "-q", "-m", "the demo's company"], { stdio: "ignore", env: storeCommitEnv(paths.configStore) });
         } catch { /* see above */ }
         say(`  demo store     ${paths.profiles} — ${copied.join(", ")}`);
       }
@@ -2298,6 +2298,7 @@ if (isMain) {
   // the `stopping` flag is what stops an orderly stop being reported as a crash.
   process.on("SIGINT", () => { void shutdown(0); });
   process.on("SIGTERM", () => { void shutdown(0); });
+  for (const sig of windowCloseSignals()) process.on(sig, () => { void shutdown(0); });
 
   const healthy = async (url, rec) => {
     const deadline = Date.now() + 30_000;
@@ -2678,6 +2679,20 @@ export function backgroundOfferLines({ demo = false, keep = false, manager = nul
   ];
 }
 
+/**
+ * The signal that means the window was closed, which a foreground start treats as a stop.
+ *
+ * SIGHUP, on every platform. Closing a terminal sends it, and with no handler Node's default ended this
+ * process on the spot: the teardown never ran, and the children, which lead sessions of their own, never
+ * received the hangup. The portal, the door and the worker went on running with nothing supervising them
+ * and a search in flight carried on (measured on Linux, 2026-09-23), while the banner above says closing
+ * the window stops everything this command started. Windows reports closing the console window as SIGHUP
+ * too.
+ */
+export function windowCloseSignals() {
+  return ["SIGHUP"];
+}
+
 /**
  * What a reader is told when a child this install cannot run without exits.
  *

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "d571d0ee20d96c7ce7f9c2c5bee0404db3357467",
-  "version": "0.3.3-beta.1"
+  "commit": "1b114acfd84b91de944063c0f16a99d16652adce",
+  "version": "0.4.0-beta.0"
 }

package/docs/releases/0.3.3.md

@@ -0,0 +1,52 @@
+<!-- SPDX-License-Identifier: AGPL-3.0-only -->
+<!-- Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md -->
+
+# 0.3.3 — what was checked before it was published
+
+Tested with Claude Opus 5.5: faster than Opus 5, and about 30% cheaper. Naming an exact Claude model, Fable
+included, now runs that model; a tier name still follows the newest.
+
+A stable version is published only after a beta has run a real clearance end to end and has been
+installed from scratch by somebody who had not used the product before. This is that record for 0.3.3.
+It names what was run and who ran it by role and date, never by name, and it carries no mark and no
+party to a search.
+
+## The beta it was cut from
+
+0.3.3 was cut from 0.3.3-beta.1, published on 23 September 2026 at commit `d571d0ee`, published to the
+beta channel and installed on the staging deployment before this stable was cut.
+
+| | |
+|---|---|
+| Candidate | `clearotron@0.3.3-beta.1` |
+| Commit | `d571d0ee20d96c7ce7f9c2c5bee0404db3357467` |
+| Registry integrity | `sha512-50rUxdGJcd6zWPAjNosU8MhMIsJKy8AUFO1UF5uLm4fktXsxbqDdebI13PoWC7OMEzubhP9kyWwHH4V4uOirdQ==` |
+
+## A real clearance, end to end
+
+On 23 September 2026 the product's test team ran a full worldwide clearance in four classes against the
+live register service, with Claude Opus 5.5 doing the reasoning, and it ran to a delivered report. It ran
+on the beta's last build before publication, which differs from it only in parts a clearance does not
+run.
+
+## Installs from scratch
+
+- **Install to a delivered report.** On 23 September 2026, on 0.3.3-beta.1 (commit `d571d0ee`, registry
+  integrity as above), the product's test team installed the published beta as a new user with nothing
+  installed, on a Linux machine, following the public instructions and using its own credentials. Setup
+  installed the Claude program for that user alone and proved it with one turn, and `doctor` found nothing
+  a search would be refused for. A one-name knockout search, worldwide, was delivered **2 minutes 19
+  seconds** after it was ordered, with its report and its audit workbook, on Claude Opus 5.5 with no
+  retries.
+- **macOS.** An automated job packs the candidate's own bytes, installs them for a user with nothing
+  installed, and runs `doctor` and the demo. The release runs it on this stable's bytes before publishing
+  them.
+
+## Between the beta and the stable
+
+The code is the code 0.3.3-beta.1 shipped. Two commits separate that beta from this stable tag, and
+neither changes what the product does: this record, and the version number itself.
+
+That is worth saying because every commit between the beta somebody reviewed and the stable everybody
+installs reaches users without having been reviewed as a release. Here that range is a document and a
+version bump, and it is stated so it can be checked rather than taken on trust.

package/driver/CHANGELOG.md

@@ -1,5 +1,67 @@
 # clearotron-driver
 
+## 0.4.0-beta.0
+
+### Minor Changes
+
+- Before you upgrade: a new operator key must now name the tools it may use, for example `--verbs start_run,stop_run`. Keys already issued keep working.
+  
+  For operators: a revoked key stops working even where no revocation list was set up, because every connector now reads the install's own list.
+  
+  Fixed: over the network, an operator key can no longer start a what-if that its assistant is not shown.
+  
+  Fixed: the portal refuses a change sent from another website, or from another app on the same computer, including a sign-in.
+
+### Patch Changes
+
+- Fixed: closing the window that runs `clearotron start` now stops Clearotron. Before, it kept running in the background.
+- Fixed: Creating a company in the portal no longer stops with a request to run a git command.
+- Fixed: A new company starts with no marketplaces. The company page offers the usual ones to add, and a company with none is still searched on the general web.
+
+## 0.3.3
+
+### Patch Changes
+
+- Fixed: a run can name a Fable model by its published id, not only by the tier word, which used to fail outright.
+- Fixed: the coverage table names the goods words of a search narrowed by goods, so it no longer reads the same as the main search.
+- Fixed: the portal's run list shows a run's rating, never the reviewer's sign-off word, while the run is still in progress.
+- Fixed: naming an exact Claude model now runs that model, instead of quietly following the tier to a newer one.
+- Fixed: a list of names searched on Signa is now searched one name at a time, so one crowded name no longer stops the rest.
+- Fixed: a register search the provider refuses as too wide is disclosed at once, with its size, instead of pausing the run to retry it.
+- Fixed: the audit workbook now says when a surface refused a search and why, instead of reading the same as one never run.
+- Fixed: the audit workbook now lists each wider register search the engine chose not to run, with the reason it gave.
+- Fixed: a register search that fails on a provider error is tried once more in the run before it is disclosed as not searched.
+- Fixed: a run now records the tier it asked for, not a model version nobody chose. The report still names the model that ran.
+- Fixed: A two-letter mark's register searches, including those narrowed by the client's goods, now run instead of failing where the register's substring search needs three characters.
+- For operators: the run record now distinguishes a question the search step never answered from one it answered with "nothing applies". They previously looked identical, so a step that could not answer looked like a matter with nothing to say.
+- Fixed: a long list of names searched on Clarivate is now split into searches it accepts, not one it refuses as too wide.
+- Fixed: setup and doctor now report a Claude program too old for the models a search asks for, instead of passing it as fine.
+- Fixed: on the OpenAI engine, setup and `doctor --probe-engine` now catch a machine where codex refuses every tool call, before any search is paid for.
+  
+  A search that meets it stops after one attempt and names the setting that fixes it.
+- Fixed: a common-law search no longer repeats a finished stage because its write-up lacked one exact status word.
+  
+  Each coverage status is now recorded as data rather than read from the wording.
+- New: a search whose identical-mark question returns a count rather than a list now narrows that question until the register gives a list, and reads it.
+  
+  It previously left that question unread and searched the wider families instead — compounds, foreign-script forms, neighbour lists — which is where the reading time went.
+  
+  New: the words a search is narrowed to can now be chosen while the search is running, not only when it is first planned.
+- Fixed: doctor no longer ticks a billing mode on a machine where no engine program resolves; it states it as information.
+- Fixed: the identical mark is now read first on every search, before any wider question is asked.
+  
+  New: a search can cover a further category the client's own goods reach, added with a stated reason.
+- Fixed: a search request that describes the goods using the older wording now records those goods. It previously recorded none, so nothing downstream could narrow by what the matter actually covers.
+- Fixed: a search can now be narrowed by what the goods are, which it could not be before. The step that chooses the search words had no way to hand them back, so every search ran without them.
+- Fixed: the worker now reports itself alive throughout a search, not only between searches. Its liveness file went stale for the whole of a long search. A check reading it would call a healthy search dead, and might stop it.
+- For operators: the published package now has a recorded size budget. Nothing about what ships changes; growth past a margin fails the build and names the largest files.
+- Fixed: setup confirms a pasted key by its length alone, so no part of a key reaches a captured install log.
+- Fixed: setup installs a version of the Claude program new enough to run the current top-tier model, which older versions refuse.
+- Fixed: a territory name that no register can answer is now reported as an uncovered gap instead of being searched.
+- Fixed: the assistant's run summary names the rating again, where it had printed "[object object]" in its place.
+- Fixed: the clearance list is now requested at the same time as your sign-in details, instead of waiting for them.
+- Fixed: the delivery email, run list and assistant now give the rating and the report's own conclusion. None of them says a matter is on hold.
+
 ## 0.3.3-beta.1
 
 ### Patch Changes

package/driver/company-bundle.mjs

@@ -99,28 +99,21 @@ export function resolveFramework(requested, {
 
 // ── the profile this writes ────────────────────────────────────────────────────────────────────────
 /**
- * Which marketplaces this brand owner's searches cover — supplied, or the Generic default, SAID OUT LOUD.
+ * Which marketplaces this brand owner's searches cover: the ones supplied, or NONE.
  *
- * A customer bundle is a COMPLETE document in this design, not an overlay on generic: every shipped
- * profile carries its own `platforms`, and the loader requires a non-empty array on every file. The
- * command had no way to supply one and set none, so every bundle it wrote failed to load on this field
- * as well as on the `key` field above — two independent invalidities, and onboarding could not produce
- * a loadable brand owner at all.
+ * A customer bundle is a COMPLETE document in this design, not an overlay on generic: every profile
+ * carries its own `platforms` array, and the loader requires one on every file.
  *
- * Defaulting rather than refusing, and naming it, is this command's own established idiom: the same
- * ruling governs the framework one function down. Which marketplaces a client's clearance searches is
- * not a detail to decide silently, so an operator who supplies nothing is TOLD what they got and can
- * refine it in the portal.
+ * NONE, NOT THE GENERIC DEFAULT, by the owner's ruling of 2026-09-23. A company created with only a name
+ * used to be given the Generic default's marketplaces, which no screen listed and which the company page
+ * then refused to let anybody remove. A new company now starts with an empty list and somebody picks
+ * from the Generic default's marketplaces, which the portal offers as suggestions. With an empty list the
+ * general web search and the meaning checks still run, and so do any stores the engine chooses for a matter
+ * (pipeline.mjs deriveGridSpec).
  */
-export function resolvePlatforms(supplied, roster) {
+export function resolvePlatforms(supplied) {
   if (supplied?.length) return { platforms: supplied, source: "supplied" };
-  const house = roster?.get?.("generic")?.platforms ?? [];
-  if (!house.length)
-    throw new Refusal(
-      "no --platforms was given and the Generic default carries none, so there is nothing to onboard this "
-      + "brand owner with. Pass --platforms, or repair the generic profile in the store.",
-      { code: "no_marketplaces" });
-  return { platforms: [...house], source: "house default" };
+  return { platforms: [], source: "none" };
 }
 
 export function buildProfile({ key, name, domains, platforms, framework, industry,

package/driver/door-call-verdict.mjs

@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// A CALL TO THE OPS DOOR THAT THE DEPLOYMENT CHECK COULD NOT MAKE — "roster resolves" (list_profiles) and
+// "ops-MCP reachable" (describe_options). Extracted so it can be driven without a door to call, as
+// plan-run-agreement-verdict.mjs was for the third call.
+//
+// Both rows used to FAIL on every error but an unset door, so the check exited 1, "drifted", when nothing
+// had been compared. Measured on pre-prod 0.3.3-beta.0: both rows FAILed on a 401, the door refusing the
+// check's own key. On the test box the same door's rate limit (429) refused the third call of a burst of
+// checks; that was the plan_run call, and these two go to the same door.
+//
+// THREE ANSWERS MEAN THE CHECK DID NOT LOOK: a rate limit (429), a refusal of this check's own key (401,
+// 403), and a request that got no answer in time. Each is a marked skip, which exits 3. Everything else
+// stays a FAIL: a 5xx or a malformed answer is the door answering badly. A door with nothing listening
+// at all stays a FAIL too, because whether that is a finding is not settled, and this does not settle it.
+
+/**
+ * @param {Error & {status?: number|null, timedOut?: boolean}} e  what the call threw
+ * @param {{ asked: string, notCompared: string }} what  the tool asked, and what was therefore not compared
+ * @returns {{state: "skip", blocked: true, message: string} | null}  null: report it as the FAIL it was
+ */
+export function doorCallVerdict(e, { asked, notCompared }) {
+  const refused = e?.status === 429 || e?.status === 401 || e?.status === 403 || e?.timedOut === true;
+  if (!refused) return null;
+  return { state: "skip", blocked: true, message: `could not ask ${asked}, so ${notCompared} — ${String(e?.message ?? e).slice(0, 200)}` };
+}

package/driver/driver.config.mjs

@@ -693,8 +693,7 @@ export const MODELS = {
 // alias → full id; a value that's already a full provider/model id (contains "/") passes through.
 //
 // A BARE Anthropic id (dated or not — "claude-haiku-4-5-20251001", "claude-opus-5") normalises to the
-// catalog form too. The direct-API lanes (jx completions/judge/nativeread, driver.config JX_PROVIDERS)
-// name their model that way because that is what the Messages API takes, so without this one model named
+// catalog form too. Without this, one model named
 // in two spellings — dated and undated — would key apart in a rollup. The date suffix is dropped;
 // anything that does not look like a bare claude id is returned untouched, so a genuinely unknown model
 // still keys as-is rather than being guessed at.

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.3-beta.1",
+  "version": "0.4.0-beta.0",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline.mjs

@@ -76,7 +76,7 @@ import { armCoverageForm, coverageFormInput, coverageFormPaths, coverageFormStam
 import { unionPlacementForm } from "./placement-union.mjs";
 import { readPlacementForm, readPlacementFormInput, writePlacementForm } from "./placement-form-io.mjs";
 import { dictatedPaths, findStrayArtifacts, treeSnapshot, findStrayInTree, matterSiblings, findStrayMatterSiblings } from "./stray-artifacts.mjs";   // — a run dir holds no document no stage dictated; — nor does the doctrine tree
-import { resolveProfile, resolveEffectiveProfile, derivedFloor, derivedBatchSize, applicantMatchesProfile, NEUTRAL_DELIVERY, deliveryForRun, recipeProseGuard, withRunPlatforms, profileStoreResolution } from "./profiles.mjs";   // adds profileStoreResolution — the CONFIG store's identity, beside the doctrine tree's
+import { resolveProfile, resolveEffectiveProfile, derivedFloor, derivedBatchSize, gridBatchFor, applicantMatchesProfile, NEUTRAL_DELIVERY, deliveryForRun, recipeProseGuard, withRunPlatforms, profileStoreResolution } from "./profiles.mjs";   // adds profileStoreResolution — the CONFIG store's identity, beside the doctrine tree's
 import { resolveSearchPolicy, gateResolvedPolicy, loadRecipes, policyFor, isRegisterOnly, reportIdentityFor, depthFor } from "./search-policy.mjs";
 import { profileOrdinals } from "./profile-selection.mjs";   // lever 3 — driver selection
 // THE OFFERING'S own sentence about where the native-language investigation can be bought. It reaches a
@@ -979,7 +979,12 @@ function deriveGridSpec(ctx) {
     terms: null,
     spec_inputs: { registerOnly: Boolean(ctx.registerOnly), gridVariants: ctx.gridVariants?.length ?? 0, profilePlatforms: ctx.profile?.platforms?.length ?? 0 },
   };
-  if (!ctx.registerOnly && ctx.gridVariants?.length && ctx.profile?.platforms?.length) {
+  // AN EMPTY MARKETPLACE LIST STILL WRITES A GRID. A company may pick no marketplaces (the owner's ruling of
+  // 2026-09-23), and the general-web cell and the meaning sweep ride in this spec: gating it on a non-empty
+  // list switched both off with the stores, and the downgrade clamp then read the missing spec as a failed
+  // sweep. The spec below is then the web cell plus whatever channels the matter frame names. Only a profile
+  // with no list at all (legacy) takes the spec-less path.
+  if (!ctx.registerOnly && ctx.gridVariants?.length && Array.isArray(ctx.profile?.platforms)) {
     const gridSpecPath = P.gridSpec;
     // #5 — required channels: a NAMED profile's curated platforms are authoritative. The GENERIC fallback
     // derives the channels from the MATTER FRAME's industry/goods reasoning (its "Search channels:" line) so
@@ -1041,7 +1046,8 @@ function deriveGridSpec(ctx) {
       terms: ctx.gridVariants,
       platforms: [...channels, "web"], // the dictated channels + the general-web cell
       output_path: P.commonLawGrid,
-      batch: ctx.profile?.batchSize ?? 14,
+      // SIZED BY THE CELLS THIS GRID RUNS, never larger than the profile's own figure (gridBatchFor).
+      batch: gridBatchFor(ctx.profile, channels.length + 1),
       // disposition_required (P2-C §8b leg 2): the receipt-presence stamp arming the commonLaw validator's
       // receipts-disposition arm (the D1 ledger_required pattern — every fresh spec carries it; pre-P2-C
       // archived specs lack it, so replay verdicts never flip). splitGridSpec spreads the connotation
@@ -10591,10 +10597,13 @@ async function pipelineInner(job, opts = {}) {
         // back-compat: a pre-doc-35 receipt keyed only on the cell set (no source channels)
         (priorReceipt.sig == null && !sourceChannels.length &&
           JSON.stringify((priorReceipt.requested ?? []).map(cellKey).sort()) === JSON.stringify(closable.map(cellKey).sort())));
+      // SIZED BY THE CELLS A CLOSURE GRID RUNS, as the main grid is (gridBatchFor): its spec carries only the
+      // platforms of the cells it closes.
+      const closureBatch = (cells) => gridBatchFor(ctx.profile, new Set(cells.map((c) => c.platform)).size);
       if ((closable.length || sourceChannels.length) && !alreadyAttempted) {
         const requested = closable;
         const variants = [...new Set(closable.map((c) => c.variant))];
-        const batchSize = ctx.profile?.batchSize ?? 14;   // WS-B: derived from the profile's platform count
+        const batchSize = closureBatch(closable);
         const batches = Math.max(1, Math.ceil(variants.length / batchSize));
         const gridCalls = batches + (sourceChannels.length ? 1 : 0);   // grid call(s) + a channel-sweep call (tokens-only: no $ estimate)
         note(`coverage closure: ${closable.length} machine-closable cell(s)${sourceChannels.length ? ` + ${sourceChannels.length} un-swept in-scope channel(s) [${sourceChannels.join(", ")}]` : ""} — one supplementary grid pass (${gridCalls} grid call(s))`);
@@ -10707,7 +10716,7 @@ async function pipelineInner(job, opts = {}) {
       }
       if (closable.length || exempt.length) {
         // Tokens-only (owner directive 2026-07-11): the offer names the work (grid calls), never a $ figure.
-        const batchesLeft = Math.max(1, Math.ceil([...new Set(closable.map((c) => c.variant))].length / (ctx.profile?.batchSize ?? 14)));
+        const batchesLeft = Math.max(1, Math.ceil([...new Set(closable.map((c) => c.variant))].length / closureBatch(closable)));
         const offer = ` — closable on instruction (${batchesLeft} supplementary grid call(s))`;
         ctx.coverageNote = `marketplace cells not executed: ${[...closable, ...exempt].map(cellKey).join("; ")}` +
           (closable.length ? ` — attempted in-loop and still unreachable${offer}` : "") +

package/driver/portal-mcp-client.mjs

@@ -83,7 +83,7 @@ function post(urlStr, { headers = {}, body = "", wantId = null, timeoutMs = 3000
     });
     // — a timeout got no status and therefore no answer; it is marked at the throw rather than
     // recognised later by its message, so nothing has to keep a regex in step with a sentence.
-    req.setTimeout(timeoutMs, () => { req.destroy(transportError(`MCP request timed out after ${timeoutMs}ms`, null)); });
+    req.setTimeout(timeoutMs, () => { req.destroy(Object.assign(transportError(`MCP request timed out after ${timeoutMs}ms`, null), { timedOut: true })); });
     req.on("error", (e) => reject(isSocketFailure(e) ? transportError(e.message, null) : e));
     req.end(body);
   });

package/driver/portal-request-origin.mjs

@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// A STATE CHANGE MUST COME FROM THIS PORTAL'S OWN PAGES. The portal checked nothing about where a POST
+// came from: the session cookie's SameSite attribute was the whole defence in local mode, and behind a
+// proxy it was the proxy's cookie. A page on another site, or another app on this machine on another
+// port (a browser treats every port on one host as the same site), could make a signed-in browser change
+// state here. So every state-changing request is checked against this portal's own host, in both modes.
+//
+// THE HOST IS THE REQUEST'S OWN, NOT A LIST. `Host` is what the browser addressed. A proxy in front can
+// rewrite it, and then says the original in `X-Forwarded-Host`, which Caddy sets by default. A page on
+// another site cannot set either header on a victim's browser (a custom header forces a preflight the
+// portal never grants), so accepting a match on either is still a match on this portal's own name.
+// Compared with its port: another app on this machine differs only in the port.
+//
+// A DEFAULT PORT IS NO PORT. `https://portal.example` and `https://portal.example:443` are one origin, and
+// so are `http://h` and `http://h:80`. A browser's Origin never writes the default port, but a proxy or a
+// tunnel in front may write it into `Host`, and a plain comparison would then refuse every save the
+// portal's own pages make. So the port the Origin's scheme implies is taken off both sides before they are
+// compared, and only that one: `:443` beside an `http` Origin is still another port.
+//
+// A REQUEST WITH NEITHER `Origin` NOR `Sec-Fetch-Site` IS NOT FROM A BROWSER. Every current browser sends
+// one of them on a POST, and a script or `curl` sends neither. A script cannot be tricked into carrying
+// someone else's session, so there is nothing to refuse, and its own credential still has to pass.
+
+const STATE_CHANGING = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+const first = (v) => String(Array.isArray(v) ? v[0] : (v ?? "")).split(",")[0].trim();
+
+const DEFAULT_PORT = { "https:": "443", "http:": "80" };
+
+/** `host` without the port `protocol` implies, when it carries exactly that one. */
+function withoutDefaultPort(host, protocol) {
+  const port = DEFAULT_PORT[protocol];
+  return port && host.endsWith(`:${port}`) ? host.slice(0, -(port.length + 1)) : host;
+}
+
+/** The hosts this request says it was addressed to, lower-case, with their ports, less the default one. */
+function ownHosts(headers, protocol) {
+  return new Set([first(headers?.host), first(headers?.["x-forwarded-host"])].filter(Boolean)
+    .map((h) => withoutDefaultPort(h.toLowerCase(), protocol)));
+}
+
+/**
+ * Why this request is refused as coming from somewhere other than this portal, or null to let it through.
+ * @param {{ method?: string, headers?: Record<string, string|string[]|undefined> }} req
+ * @returns {string|null}
+ */
+export function crossSiteReason(req) {
+  if (!STATE_CHANGING.has(String(req?.method ?? "GET").toUpperCase())) return null;
+  const headers = req?.headers ?? {};
+  const origin = first(headers.origin);
+  if (origin) {
+    if (origin === "null") return "Origin is null";
+    let host, protocol;
+    try { ({ host, protocol } = new URL(origin)); } catch { return "Origin is not an address"; }
+    host = withoutDefaultPort(host.toLowerCase(), protocol);
+    const own = ownHosts(headers, protocol);
+    return own.has(host) ? null : `Origin ${host} is not this portal (${[...own].join(", ") || "no Host"})`;
+  }
+  const site = first(headers["sec-fetch-site"]).toLowerCase();
+  if (site) return site === "same-origin" || site === "none" ? null : `Sec-Fetch-Site is ${site}`;
+  return null;
+}
+
+/**
+ * Whether a state-changing request carries a body that is not declared as JSON. The API reads every body as
+ * JSON; a form post (`text/plain`, `application/x-www-form-urlencoded`) is the shape a page on another site
+ * can send without a preflight, so it is refused here rather than parsed. A request with no body is not
+ * asked for a type: the portal's own pages send none on a POST that carries nothing.
+ */
+export function bodyNotJson(req) {
+  if (!STATE_CHANGING.has(String(req?.method ?? "GET").toUpperCase())) return false;
+  const headers = req?.headers ?? {};
+  const length = Number(first(headers["content-length"]) || 0);
+  const hasBody = length > 0 || Boolean(first(headers["transfer-encoding"]));
+  if (!hasBody) return false;
+  const type = first(headers["content-type"]).split(";")[0].trim().toLowerCase();
+  return type !== "application/json";
+}