clearotron 0.3.3-beta.1 → 0.4.0-beta.0

package/driver/portal-service.mjs

@@ -168,6 +168,7 @@ import { engineCommit } from "./engine-build.mjs";                  // — the S
 import { engineCommitDate, engineProvenance } from "./engine-build.mjs";
 import { classifySkillsStore } from "./skills-store-provenance.mjs";
 import { makeStaticHandler, reportCsp, docCsp } from "./portal-static.mjs";
+import { crossSiteReason, bodyNotJson } from "./portal-request-origin.mjs";
 import { bundleVerdict, healthUi } from "../shared/bundle-freshness.mjs";   // one definition of a usable bundle, shared with `doctor`
 import { readReport, reportsOf, resolveReportFile, batchSummaryOf } from "./portal-report.mjs";
 import { readArchivedSet, updateArchived } from "./publish/archive-tags.mjs";
@@ -1142,7 +1143,7 @@ export function makeConnectorKeyRevoker({ env = process.env, home = null } = {})
     const base = home ?? homedir();
     const recorded = recordedKeysFor(g, email);
     const plan = disablePlan({ env, unitDir: join(base, ".config", "systemd", "user"), exists: existsSync,
-      identity: email, recorded, denylistPath: denylistPathFor(env, base) });
+      identity: email, recorded, denylistPath: denylistPathFor(env, base), home: base });
     if (!plan.possible) return { grants: g, revoked: 0, jtis: [], lateArm: false, says: plan.says };
     if (plan.lateArm) return { grants: g, revoked: 0, jtis: plan.jtis, lateArm: true, says: plan.says ?? [] };
     // THE RECORD IS NEVER STRUCK FROM HERE, and the ledger step is dropped rather than no-opped.
@@ -1614,6 +1615,7 @@ export function makePortalService({
         // identity gets {} here exactly as it does for names and keeps reading the staff-only roster.
         let accountNames = {};
         let accountFacts = {};
+        let meRoster = null;   // read once for this answer: the names below and the house marketplaces
         // GENERIC IS NAMED TOO when the person sees an organisation's Generic. It is not a company, so it is
         // never in `accounts`, and without a name here the switcher printed the raw key at everyone below
         // everything. An organisation with no company yet is the case with an empty `accounts`, so the
@@ -1623,7 +1625,7 @@ export function makePortalService({
         if (named.length) {
           try {
             const { companyFactsOf } = await import("./profiles.mjs");
-            const profiles = await loadProfilesImpl();
+            const profiles = meRoster = await loadProfilesImpl();
             for (const key of named) {
               const profile = profiles.get(key);
               const name = profile?.name;
@@ -1662,9 +1664,19 @@ export function makePortalService({
         // READ ONCE. The payload names it and the program reading below is gated on it; two calls to
         // `flagView` here would be two reads of the same file that could disagree with each other.
         const meEngineMode = flagView(poolRoot).engineMode;
+        // THE HOUSE MARKETPLACES, offered as suggestions wherever a company's marketplaces are edited. A new
+        // company starts with none (the owner's ruling of 2026-09-23) and somebody picks; these are the
+        // Generic default's own list, read from the store so an install that changed it offers its own.
+        // Deployment-wide and the same for everyone, like concurrentRuns. [] when the store cannot be read:
+        // the box still takes any marketplace typed into it.
+        let houseMarketplaces = [];
+        try {
+          const house = (meRoster ?? await loadProfilesImpl()).get("generic")?.platforms;
+          if (Array.isArray(house)) houseMarketplaces = house.filter((d) => typeof d === "string" && d.trim());
+        } catch { /* a suggestion list is a nicety; the door is not */ }
         return { status: 200, json: { email: principal.email, ...principalView(principal, grantsHere, accountNames),
           accounts: principal.accounts, accountNames, accountFacts,
-          concurrentRuns: concurrentRunsCap(), brand: ORGANISATION_NAME, engineMode: meEngineMode,
+          concurrentRuns: concurrentRunsCap(), brand: ORGANISATION_NAME, engineMode: meEngineMode, houseMarketplaces,
           // WHERE A PERSON ASKS FOR A CHANGE TO THEIR SIGN-IN, beside the brand and read where it is read:
           // an href Preferences links "Clearotron administrator" to, or null, and then the words are plain.
           administratorContact: ADMINISTRATOR_CONTACT,
@@ -3267,15 +3279,12 @@ async function connectorDoorKind(url) {
             const p = envFrom(process.env, "CLEAROTRON_ACCESS_FILE");
             if (p) grantsFile = { name: basename(p), modifiedAt: new Date(statSync(p).mtimeMs).toISOString() };
           } catch { /* reported as unknown; a failed stat must not take down the page that explains access */ }
-          // WHETHER AN ISSUED KEY CAN BE WITHDRAWN AT ALL, read the same way `disablePlan` reads it: the
-          // door loaded a revocation list at start, or it did not and never will for the keys already
-          // out. The variable's PRESENCE is the whole question — its value is a path, and this route
-          // must not say where.
-          // WHETHER A REVOCATION LIST IS NAMED FOR THIS PROCESS AT ALL — which is not the same question
-          // as whether the connector loaded one, and the page's words are careful about the difference.
-          // The connector is a separate unit with its own environment; this answers only for here.
-          const keysRevocable = Boolean(revokeConnectorKeys)
-            && String(process.env.TRADEMARK_MCP_TOKEN_DENYLIST ?? "").trim() !== "";
+          // WHETHER AN ISSUED KEY CAN BE WITHDRAWN AT ALL. This used to be whether a revocation list was
+          // named in this process's environment, because a door with none named checked no list. Every door
+          // now reads the install's default list when none is named (isRevoked, shared/scope.mjs), and that
+          // is where a revocation from here is written, so keys can be withdrawn whenever this process has
+          // a revoker at all.
+          const keysRevocable = Boolean(revokeConnectorKeys);
           return { status: 200, json: accessView({ grants: grantsHere, viewer: principal, companies, grantsFile, localSignIn, keysRevocable }) };
         }
         // /portal/admin/people — give someone access. Manage-gated above; everything else is decided here.
@@ -3641,9 +3650,10 @@ export function accountCapAdvice(posture) {
   }
   return "Re-mint with `mcp-server/mint-token.mjs --scope ops"
     + `${posture.sub ? ` --sub ${posture.sub}` : ""}`
-    // NO `--verbs` FLAG AT ALL when the token is full-ops: `verbs: null` means EVERY verb, and naming a
-    // list there would be the narrowing this whole function exists to stop.
-    + `${posture.verbs ? ` --verbs ${posture.verbs.join(",")}` : ""}`
+    // A FULL-OPS TOKEN (`verbs: null`) IS RE-ISSUED WITH THE PORTAL'S OWN VERBS. It used to get no
+    // `--verbs` at all, so as not to narrow it; mint-token now refuses an ops token that names none, so that
+    // command would fail, and re-issuing verb-less tokens with verbs is the point. The portal calls these two.
+    + ` --verbs ${(posture.verbs ?? ["start_run", "stop_run"]).join(",")}`
     + " --accounts <keys>` to make it two walls.";
 }
 
@@ -4288,6 +4298,18 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
         });
       }
 
+      // ── A STATE CHANGE FROM ANOTHER SITE IS REFUSED BEFORE ANYTHING ELSE LOOKS AT IT ────────────────
+      //
+      // Before identity, so the sign-in and sign-out forms are covered as well as the API: a page elsewhere
+      // that signs a browser in to an account of its choosing is the same attack as one that acts under the
+      // browser's own session. The rule and why it compares hosts is in portal-request-origin.mjs.
+      const crossSite = crossSiteReason(req);
+      if (crossSite) {
+        log(`refused a ${req.method} to ${url.pathname} from another site: ${crossSite}`);
+        journal(403, "cross-site request");
+        return send(res, 403, { error: "cross_site" });
+      }
+
       // ──: THE LOCAL SIGN-IN DOOR — before identity, because it is how identity is obtained ─────
       //
       // Mounted only when the local identity provider is running. On a Cloudflare-fronted instance
@@ -4420,6 +4442,12 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
         journal(429, "rate_limited", identity?.email);
         return send(res, 429, { error: "rate_limited" });
       }
+      // A BODY THAT DOES NOT SAY IT IS JSON IS NOT READ AS JSON. A form post is the one body another site
+      // can send without asking first; the portal's own pages always declare JSON when they send a body.
+      if (bodyNotJson(req)) {
+        journal(415, "body is not JSON", identity?.email);
+        return send(res, 415, { error: "unsupported_media_type" });
+      }
       // A FIXED reason, not `e.message`. The parser's message is about the bytes it was given, and this
       // row must not become a place a caller can write into by sending a body that fails to parse.
       let body;

package/driver/profile-page.html

@@ -214,7 +214,7 @@ function renderEditor(key, p, contextPack, derived, framework, isNew) {
   $("editor").innerHTML = `
     ${isNew ? f("Customer key"+REQ, "f_key", "", `<span class="reqtag">Required.</span> A short lowercase id — letters, numbers and hyphens only. It becomes the customer's filename and can't be changed later.`, "e.g. acme-health") : `<div class="ro">Editing <b><span data-anon="mark" data-anon-key="${esc(key)}">${esc(key)}</span></b></div>`}
     ${f("Customer name"+REQ, "f_name", p.name||"", `<span class="reqtag">Required.</span> The customer's name. We use it to recognise their own marks so we never flag the customer against itself.`, undefined, true)}
-    ${ta("Marketplaces and registers to search"+REQ, "f_platforms", (p.platforms||[]).join("\n"), `<span class="reqtag">Required — at least one.</span> One website per line (e.g. amazon.com). These are where we look for real-world use of a mark. Don't add 'web' — the general web is always searched.`, "", true)}
+    ${ta("Marketplaces and registers to search", "f_platforms", (p.platforms||[]).join("\n"), `One website per line (e.g. amazon.com). These are where we look for real-world use of a mark. Don't add 'web' — the general web is always searched.`, "", true)}
     ${coverageNote}
     <details class="more"${advancedSet?" open":""}>
       <summary>More options</summary>
@@ -344,18 +344,15 @@ function clientValidate({ key, profile }) {
     else if (!KEY_RE.test(key)) problems.push({ id:"f_key", message:"The customer key can only use lowercase letters, numbers and hyphens (2–39 characters)." });
   }
   if (!profile.name) problems.push({ id:"f_name", message:"Enter the customer’s name." });
+  // An empty list is valid: a company may pick no marketplaces (the owner's ruling of 2026-09-23).
   const plats = profile.platforms || [];
-  if (!plats.length) {
-    problems.push({ id:"f_platforms", message:"Add at least one marketplace or register to search — a website like amazon.com, one per line." });
-  } else {
-    const seen = new Set();
-    for (const x of plats) {
-      const dom = x.toLowerCase();
-      if (dom === "web") { problems.push({ id:"f_platforms", message:"Don’t list “web” — the general web is always searched. Remove it." }); continue; }
-      if (!DOMAIN_RE.test(dom) || /\s/.test(dom)) { problems.push({ id:"f_platforms", message:`“${x}” doesn’t look like a website address — use a domain like amazon.com.` }); continue; }
-      if (seen.has(dom)) { problems.push({ id:"f_platforms", message:`“${x}” is listed twice.` }); continue; }
-      seen.add(dom);
-    }
+  const seen = new Set();
+  for (const x of plats) {
+    const dom = x.toLowerCase();
+    if (dom === "web") { problems.push({ id:"f_platforms", message:"Don’t list “web” — the general web is always searched. Remove it." }); continue; }
+    if (!DOMAIN_RE.test(dom) || /\s/.test(dom)) { problems.push({ id:"f_platforms", message:`“${x}” doesn’t look like a website address — use a domain like amazon.com.` }); continue; }
+    if (seen.has(dom)) { problems.push({ id:"f_platforms", message:`“${x}” is listed twice.` }); continue; }
+    seen.add(dom);
   }
   return problems;
 }
@@ -366,7 +363,6 @@ function prettyServerError(msg) {
   const M = String(msg||"");
   const MAP = [
     [/name \(string\) is required/i,                    "f_name",      "Enter the customer’s name."],
-    [/platforms must be a non-empty array/i,            "f_platforms", "Add at least one marketplace or register to search — a website like amazon.com, one per line."],
     [/must not list "web"/i,                            "f_platforms", "Don’t list “web” — the general web is always searched. Remove it."],
     [/must be a bare store DOMAIN/i,                     "f_platforms", "One of the marketplaces isn’t a website address — use domains like amazon.com, one per line."],
     [/is duplicated/i,                                  "f_platforms", "A marketplace is listed twice — remove the duplicate."],

package/driver/profile-service.mjs

@@ -176,6 +176,22 @@ function bandsBandRows(deck, manifest) {
   return out;
 }
 
+// NO STORE PATH AND NO LOAD-LOG WORDING REACHES A BROWSER. The profile validator opens every sentence with
+// the file it judged (`profiles/<key>.json: `), which is right in a terminal and in the load log and is a
+// server path on the company page, so the door takes the prefix off. The three marketplace-entry refusals
+// are then worded for the browser too: their load-log words ("the grid program domain-restricts to it",
+// "inflates the floor") are engine vocabulary, and the staff profile editor already carries a sentence for
+// each (profile-page.html's MAP), copied here unchanged. Every other sentence passes as the validator wrote it.
+const BROWSER_WORDING = [
+  [/^platforms must not list "web"/, "Don’t list “web” — the general web is always searched. Remove it."],
+  [/^platforms entry .* must be a bare store DOMAIN/, "One of the marketplaces isn’t a website address — use domains like amazon.com, one per line."],
+  [/^platforms entry .* is duplicated/, "A marketplace is listed twice — remove the duplicate."],
+];
+export const forBrowser = (errors) => (errors ?? []).map((e) => {
+  const bare = String(e).replace(/^profiles\/[^\s:]*\.json: /, "");
+  return BROWSER_WORDING.find(([re]) => re.test(bare))?.[1] ?? bare;
+});
+
 /**
  * A refusal, worded for the person in the browser.
  *
@@ -200,18 +216,14 @@ export function browserRefusal(e) {
       return { error: "refused", code: "domain_claimed", domain: d.domain, heldBy: d.heldBy,
         message: `${d.domain} is already used by another company. An address can only belong to one, `
           + `because the engine uses it to tell them apart. Remove it here, or take it off the other company first.` };
-    case "no_marketplaces":
-      return { error: "refused", code: "no_marketplaces",
-        message: "This installation has no default marketplaces set up, so there is nothing to search. "
-          + "Add at least one marketplace for this company, or ask an administrator to set the defaults." };
     case "framework_missing":
       return { error: "refused", code: "framework_missing",
         message: "The risk framework this company was pointed at is not on this installation, so nothing "
           + "was created. Rating a company under a framework nobody chose is worse than refusing." };
     case "invalid_bundle":
       // The validator collects, so these are already per-field sentences written for a reader.
-      return { error: "refused", code: "invalid_bundle", errors: d.errors ?? [],
-        message: (d.errors ?? []).join(" ") || String(e.message) };
+      return { error: "refused", code: "invalid_bundle", errors: forBrowser(d.errors),
+        message: forBrowser(d.errors).join(" ") || String(e.message) };
     default:
       return { error: "refused", message: String(e.message) };
   }
@@ -439,13 +451,12 @@ export function makeProfileService({
       try { assertProfileKey(wanted); }
       catch (e) { return { status: 400, json: { error: "bad_key", message: String(e.message) } }; }
 
-      const existing = resolveExisting();
       let framework, platforms, profile;
       try {
         // ALWAYS SET, NEVER ABSENT — the company's own when one is supplied, the house default named
         // otherwise. This is the whole reason a create does not go through save.
         framework = resolveFramework(isStr(body?.frameworkPath) ? body.frameworkPath : null);
-        platforms = resolvePlatforms(Array.isArray(body?.platforms) ? body.platforms : null, existing);
+        platforms = resolvePlatforms(Array.isArray(body?.platforms) ? body.platforms : null);
         profile = buildProfile({
           key: wanted, name,
           domains: Array.isArray(body?.matchDomains) ? body.matchDomains : [],
@@ -511,7 +522,8 @@ export function makeProfileService({
         // The receipt reads off THESE, so it can say which framework and how many marketplaces, and
         // whether each was chosen or defaulted, rather than restating what was typed.
         framework: { path: framework.path, defaulted: framework.source === "default" },
-        marketplaces: { count: platforms.platforms.length, defaulted: platforms.source !== "supplied" },
+        // Never defaulted any more: a company created without marketplaces has none (resolvePlatforms).
+        marketplaces: { count: platforms.platforms.length, defaulted: false },
         ...(commitError ? { commitError: `created and LIVE, but the git commit failed (${commitError}) — the audit line records the gap` } : {}),
       } };
     }
@@ -621,14 +633,14 @@ export function makeProfileService({
         const v = validateProfileEdit(errKey, overlayBody, ctx, { sparse: true });
         let keyError = null;
         if (!exists) { try { assertProfileKey(project); } catch (e) { keyError = String(e.message); } }
-        const errors = keyError ? [keyError, ...v.errors] : v.errors;
+        const errors = forBrowser(keyError ? [keyError, ...v.errors] : v.errors);
         return { status: 200, json: { ok: errors.length === 0, errors, isNew: !exists } };
       }
 
       // save — the validated AUTO-COMMIT write (sparse validators; customer-only keys 400 here)
       if (!exists) { try { assertProfileKey(project); } catch (e) { return { status: 400, json: { error: String(e.message) } }; } }
       const v = validateProfileEdit(errKey, overlayBody, ctx, { sparse: true });
-      if (!v.ok) return { status: 400, json: { error: "validation_failed", errors: v.errors } };
+      if (!v.ok) return { status: 400, json: { error: "validation_failed", errors: forBrowser(v.errors) } };
       // The write lands FIRST (atomic temp+rename); a git failure after it must never hide the mutation
       // behind a 500 — the overlay is LIVE the moment it is renamed (every loadProjects door reads
       // force-fresh), so the response says written:true with the commit error named, and the audit line
@@ -670,7 +682,7 @@ export function makeProfileService({
       // a brand-new key must also be a safe slug (it becomes a filename); surface that in the dry run
       let keyError = null;
       if (!exists) { try { assertProfileKey(key); } catch (e) { keyError = String(e.message); } }
-      const errors = keyError ? [keyError, ...v.errors] : v.errors;
+      const errors = forBrowser(keyError ? [keyError, ...v.errors] : v.errors);
       return { status: 200, json: { ok: errors.length === 0, errors, isNew: !exists } };
     }
 
@@ -684,7 +696,7 @@ export function makeProfileService({
     preserveUncontrolled(profile, exists ? profiles.get(key) : null);
     const effective = preserveCodeOwned(profile, exists ? profiles.get(key) : null);
     const v = validateProfileEdit(key, effective, contextPack);
-    if (!v.ok) return { status: 400, json: { error: "validation_failed", errors: v.errors } };
+    if (!v.ok) return { status: 400, json: { error: "validation_failed", errors: forBrowser(v.errors) } };
 
     const { files } = writeProfile({ profileDir, key, profile: effective, contextPack });
     // The write is atomic and LIVE the instant it renames — the next run freezes THIS file. An

package/driver/profiles.mjs

@@ -175,13 +175,22 @@ export function derivedBatchSize(profile) {
   return Math.max(1, Math.floor(gridCellBudget(profile) / derivedFloor(profile)));
 }
 
+// THE TERMS ONE GRID CALL MAY CARRY when each term runs `cellsPerTerm` cells: the cell budget divided by the
+// cells the grid actually runs, never more than the profile's own figure. The profile's figure assumes its
+// own stores plus the web cell, so it is too large for a grid that runs more per term: a matter frame's
+// channels, or a closure over a store the matter chose for a company that picked no marketplaces, whose
+// figure is the whole budget in terms. One oversized call truncates (the 224-cell note above).
+export function gridBatchFor(profile, cellsPerTerm) {
+  return Math.max(1, Math.min(profile?.batchSize ?? 14, Math.floor(gridCellBudget(profile) / Math.max(1, cellsPerTerm))));
+}
+
 // The per-entry platform rules as DATA rather than as throws, so every door applies the identical checks
 // and phrases the failure in its own register: a profile load DIES (a broken profile bricks every run
 // under it), a job CLARIFIES (one request, answerable by asking). Same rules either way — a domain that is
 // a foot-gun in a profile is the same foot-gun arriving on a job.
 //
-// SHAPE stays with the caller deliberately: a profile REQUIRES a non-empty platforms array, while a job's
-// platforms are optional and additive. Only the per-entry vocabulary is shared.
+// SHAPE stays with the caller deliberately: a profile REQUIRES a platforms array (possibly empty), while a
+// job's platforms are optional and additive. Only the per-entry vocabulary is shared.
 export function platformEntryErrors(list, { label = "platforms" } = {}) {
   const errs = [];
   const seen = new Set();
@@ -518,9 +527,13 @@ function validateProfileShape(key, p, { sparse = false } = {}) {
   }
   // platforms is REQUIRED on a whole profile but OPTIONAL on an overlay; the foot-gun guards below run whenever
   // it is present (a project that re-states its marketplaces must state them just as carefully).
+  //
+  // AN EMPTY LIST IS VALID, by the owner's ruling of 2026-09-23: a company may pick no marketplaces, and a
+  // new one starts that way. What stays required is the ARRAY — an absent key is not "none", it is a
+  // profile nobody finished (derivedFloor reads absent as the historical default of six).
   if (!sparse || p.platforms != null) {
-    if (!Array.isArray(p.platforms) || !p.platforms.length || !p.platforms.every((x) => typeof x === "string" && x.trim()))
-      die("platforms must be a non-empty array of store-domain strings");
+    if (!Array.isArray(p.platforms) || !p.platforms.every((x) => typeof x === "string" && x.trim()))
+      die("platforms must be an array of store-domain strings");
     // a one-character authoring slip here bricks every run under the profile (the floor counts entries
     // verbatim while the grid dedupes) — reject the known foot-guns at load time. Shared with the job
     // doors via platformEntryErrors so a domain rule can never drift between where it is stored and

package/driver/publish/index.mjs

@@ -1071,12 +1071,23 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   // the copy. The register-only LEVEL is retired, so no new run reaches this true; a run that already
   // did still must, or its workbook would claim a sweep that never ran.
   const registerOnly = isRegisterOnly(searchPolicy);
+  // A RUN WHOSE COMPANY PICKED NO MARKETPLACES (the owner's ruling of 2026-09-23). Marketplaces were still
+  // covered by the general web search, and by any stores the engine chose for the matter, so the lines that
+  // describe the common-law layer say that instead of naming a marketplace search nobody picked. Read from
+  // the frozen profile, which is the list the run actually searched; absent (a legacy run) reads as picked.
+  let noMarketplacesPicked = false;
+  try {
+    const frozenProfile = runDir ? JSON.parse(readFileSync(driverDir(runDir, 'profile.json'), 'utf8')) : null;
+    noMarketplacesPicked = Array.isArray(frozenProfile?.platforms) && frozenProfile.platforms.length === 0;
+  } catch { /* no frozen profile — a legacy run keeps its wording */ }
 
   // Jurisdiction line for the Summary — searched register scope + the common-law surface layer.
   const regScope = (searchedJurisdictions && searchedJurisdictions.length) ? searchedJurisdictions.join('/') : 'Worldwide';
   const jurisdiction = registerOnly
     ? `${regScope} (register only — no common-law / marketplace search)`
-    : `${regScope} (register) + common-law (Western web / marketplace / social)`;
+    : noMarketplacesPicked
+      ? `${regScope} (register) + common-law (Western web / social, plus any stores chosen for this matter)`
+      : `${regScope} (register) + common-law (Western web / marketplace / social)`;
 
   // Common-law URL-join: a grid hit whose candidate URL resolves to a finding's own link PROVES that search
   // term became a finding (rescues an anchor term whose finding wears a different name). Best-effort; absent
@@ -1224,6 +1235,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
       caseLawText: rdText(join(dirname(reportMd), 'case-law-findings.md')),
       registerPlan: rdJson(driverDir(runBase, 'register-plan.json')),
       laneDepthVerdicts,
+      noMarketplacesPicked,
     });
     writeRO('search-depth.json', JSON.stringify(searchDepth, null, 2));
   } catch { /* the depth record is additive — a publish never fails for want of it */ }

package/driver/publish/render.mjs

@@ -70,6 +70,9 @@ let CASE_LAW_BY_ORD = new Map();   // E5: ordinal → grounded case-law profile
 // is full-country only), so suppressing there would take case-law off the page with nothing left
 // saying so. Absence of a state is not a statement that nothing was found.
 let COURT_DECISIONS = null;
+// The company picked no marketplaces (search-depth counts.sweep): the use-check's nothing-found line names the
+// general web and the stores chosen for the matter instead of a marketplace search. Set per render.
+let NO_MARKETPLACES_PICKED = false;
 let ENFORCER_SIGNALS = new Map();  // E6: registration uri (lowercase) → {aggression, oppositions, owner}
 // WP-receipts W2 — per-render provider record-link origin + label, resolved by publish from the run's
 // OWN _driver/receipts.json provider (never the currently-configured provider — a re-published archive
@@ -552,6 +555,9 @@ const useEvidence = (m) => [USE_EVIDENCE_LABEL[m?._status], USE_SOURCE_LABEL[m?.
 // runs carry the old value forever and a fourth spelling of it would have to be accepted everywhere.
 const USE_CHECK_NO_RESULT = 'perplexity_research — no result';
 const USE_CHECK_NO_RESULT_CITE = 'Nothing found in the marketplaces searched.';
+// The same "searched, nothing found" line for a run whose company picked no marketplaces (the owner's
+// ruling of 2026-09-23): there was no marketplace search to name, and the general web still ran.
+const USE_CHECK_NO_RESULT_CITE_NO_MARKETPLACES = 'Nothing found in the general web search or in any store chosen for this matter.';
 // — MATCHED ON NORMALISED PUNCTUATION, NOT ONE SPELLING. The constant itself does not
 // move (archived runs carry it forever, the validators name it), but the SEAT emitted a hyphen where
 // the doctrine writes an em dash, and exact equality let the raw tool name through to a delivered
@@ -1222,7 +1228,9 @@ function whatWasSearchedSection(opts, coverage = [], findings = [], recordsByUri
   }
   const sw = c.sweep || {};
   if (sw.spellings) rows.push(['Spellings searched', String(sw.spellings)]);
-  if (sw.checks) rows.push(['Marketplace and web', `${sw.checks.toLocaleString('en-GB')} checks on ${sw.platforms} platforms`]);
+  if (sw.checks) rows.push(['Marketplace and web', sw.noMarketplacesPicked
+    ? `${sw.checks.toLocaleString('en-GB')} checks: the general web, plus any stores chosen for this matter.`
+    : `${sw.checks.toLocaleString('en-GB')} checks on ${sw.platforms} platforms`]);
   if (sw.reputation) rows.push(['Reputation and meaning', `${sw.reputation.toLocaleString('en-GB')} checks`]);
   rows.push(['Local-script spellings', c.localScriptSearched ? 'Searched' : 'Not searched']);
   // HOW DEEP THE LOCAL-LANGUAGE INVESTIGATION WENT, which is a different question from the row above it.
@@ -1803,7 +1811,9 @@ function fullDetail(f, card, recordsByUri = new Map()) {
   const useStatus = useEvidence(f.meters?.use);
   // D7 — the code-owned "searched, nothing found" sentinel becomes client words HERE, by exact
   // equality against the one constant. Any other value is a source string and rides through untouched.
-  const useSrc = isUseCheckNoResult(f.use_check?.source) ? USE_CHECK_NO_RESULT_CITE : f.use_check?.source;
+  const useSrc = isUseCheckNoResult(f.use_check?.source)
+    ? (NO_MARKETPLACES_PICKED ? USE_CHECK_NO_RESULT_CITE_NO_MARKETPLACES : USE_CHECK_NO_RESULT_CITE)
+    : f.use_check?.source;
   // NO EVIDENCE TAG ON AN EMPTY RESULT. The line read "Use checked. Marketplace search run — no result
   // found. Evidence: inferred", and "inferred" beside "no result" reads as a contradiction: it qualifies
   // how a FINDING was established, and there is no finding here. Nothing was found, and that is the
@@ -2511,6 +2521,7 @@ export function renderHtml(parsed, findings = [], coverage = [], opts = {}) {
   SCOPE_WORLDWIDE = opts.scopeBasis === 'worldwide' ? true : null;   // the plan's scope_basis; null ⇒ fall back to the ledger-prose sniff
   CASE_LAW_BY_ORD = opts.caseLawByOrdinal instanceof Map ? opts.caseLawByOrdinal : new Map();   // T7 (E5)
   COURT_DECISIONS = opts.searchDepth?.counts?.courtDecisions ?? null;   // gates the card's case-law strand
+  NO_MARKETPLACES_PICKED = opts.searchDepth?.counts?.sweep?.noMarketplacesPicked === true;
   ENFORCER_SIGNALS = new Map((Array.isArray(opts.enforcerSignals) ? opts.enforcerSignals : []).map((e) => [String(e.uri ?? '').toLowerCase(), e]));   // T7 (E6)
   RECORD_ORIGIN = opts.recordOrigin ?? null;       // WP-receipts W2
   // — `null` and `` mean DIFFERENT things and the render must not collapse them. `` is an

package/driver/publish/search-depth.mjs

@@ -275,7 +275,7 @@ export function localScriptSearched(registerPlan) {
  *
  * @returns {{schemaVersion: number, cleared: object, counts: object}}
  */
-export function searchDepthRecord({ auditMd = "", recordIndex = {}, recordFileNames = [], bandRecordIds = null, commonLawGrid = null, caseLawText = "", registerPlan = null, laneDepthVerdicts = null } = {}) {
+export function searchDepthRecord({ auditMd = "", recordIndex = {}, recordFileNames = [], bandRecordIds = null, commonLawGrid = null, caseLawText = "", registerPlan = null, laneDepthVerdicts = null, noMarketplacesPicked = false } = {}) {
   // `recordFileNames: null` travels all the way to the page — see recordsByCountry. The default stays `[]`
   // because that is "the caller said nothing", not "the store is absent"; only the publish path knows the
   // difference and it is the one producer.
@@ -295,7 +295,9 @@ export function searchDepthRecord({ auditMd = "", recordIndex = {}, recordFileNa
     counts: {
       recordsByCountry: recordsByCountry(recordFileNames),
       recordsRead: recordFileNames === null ? null : recordFileNames.length,
-      sweep: sweepCounts(commonLawGrid, auditMd),
+      // The company picked no marketplaces: the report says the general web ran plus any stores chosen for
+      // the matter. Stamped only when true, so every other run's record is unchanged.
+      sweep: { ...sweepCounts(commonLawGrid, auditMd), ...(noMarketplacesPicked ? { noMarketplacesPicked: true } : {}) },
       localScriptSearched: localScriptSearched(registerPlan),
       courtDecisions: courtDecisionsState(caseLawText),
       // `localScriptSearched` above answers whether the spellings were searched; this answers how deep

package/driver/run-economics.mjs

@@ -106,7 +106,7 @@ import { runLog, note } from "./log.mjs";
 import { writeRunStatus } from "./progress.mjs";
 // tokens.mjs imports this module too (isCodeSide, stampRunEconomics). The cycle is safe because each side
 // reads the other's bindings only inside functions, never while the module is loading.
-import { isAttemptRow } from "./tokens.mjs";
+import { isAttemptRow, modelKey } from "./tokens.mjs";
 
 /**
  * The provider's separately-priced token kinds, in the driver's own `usage` vocabulary (gateway.mjs /
@@ -185,23 +185,12 @@ function billingKeyOf(rec) {
   // is rather than dragged into "unknown" beside genuinely unstamped legacy rows.
   const engine = isCodeSide(rec) ? "code" : String(rec.engine ?? "unknown");
   const authMode = isCodeSide(rec) ? "not-provider-billed" : String(rec.authMode ?? "unknown");
-  // A TURN THAT NAMED NO MODEL (a jx row with `modelActual: null` and no `model`) is keyed the way the
-  // token rollup keys it (modelKey in tokens.mjs): `<engine>/no-model-reported`, a name that says the
-  // model is missing. Read through the old `?? "unknown"` it landed beside legacy rows nobody stamped,
-  // and its byBilling bucket named a different model from the rollup's byModel for the same turn.
-  //
-  // A COPY OF modelKey's RULE, NOT A SHARED ONE: tokens.mjs does not export it. So the test for "no stamp"
-  // is modelKey's own, a non-empty string `modelUsed`, and not `modelUsed == null`: under that looser test
-  // a row stamped `modelUsed: ""` keyed its bucket as the empty string while the rollup keyed the same
-  // turn `<engine>/no-model-reported`. Two copies of one rule drifting apart is how the census and the
-  // rollup came to disagree about what an attempt is, so the tests hold these two copies to each other on
-  // the rows the engine writes. They still part on a row no writer produces: no model and no engine, or
-  // engine `anthropic-agent`. This key names the missing model there, while modelKey resolves the absent
-  // model through the catalog before it asks whether one exists, and buckets the row as `undefined`.
-  const stamped = typeof rec.modelUsed === "string" && rec.modelUsed;
-  const model = !stamped && typeof rec.model !== "string"
-    ? `${typeof rec.engine === "string" && rec.engine ? rec.engine : "unknown"}/no-model-reported`
-    : String(rec.modelUsed ?? rec.model ?? "unknown");
+  // THE MODEL IS NAMED BY THE TOKEN ROLLUP'S OWN RULE (modelKey in tokens.mjs), not a copy of it. A copy
+  // lived here while tokens.mjs did not export the rule, and the two drifted: a native-language turn that
+  // named its model was billed under the raw served id while the rollup keyed it `anthropic/unstamped:<id>`,
+  // so one turn had two names in the same run's figures. A code-side row comes back as its own name
+  // (`code:<step>`), which says no model ran.
+  const model = modelKey(rec);
   return { engine, authMode, model, key: `${engine}|${authMode}|${model}` };
 }
 

package/driver/stages.mjs

@@ -2527,7 +2527,7 @@ export const STAGES = {
       },
       "adopt-or-override each placement by engaging its reason, and the `### Disagreement resolutions` rows (one per surfaced disagreement and per borderline:true, each ADOPTED/OVERRODE in writing)": {
         class: "judgment", tokens: ["registerdigest_adjudication_invalid", "registerdigest_adjudication_incomplete"],
-        why: "Answering the promotion question the other way, in writing, against a reason another stage authored. #850 keeps it J. The row's SUBJECT is handed over as data (the driver appends the PLACEMENT RULINGS TAIL block, pipeline.mjs:3584), so nothing here is a fetch. [citation unverified]",
+        why: "Answering the promotion question the other way, in writing, against a reason another stage authored. #850 keeps it J. The row's SUBJECT is handed over as data (the driver appends the PLACEMENT RULINGS TAIL block, digestDispatchExtra() in pipeline.mjs), so nothing here is a fetch.",
       },
       // ── REWRITTEN, NEVER DELETED (the ruling) — AND THE ROW THAT COST THIS CONVERSION A DESIGN ──
       //