clearotron 0.3.3 → 0.4.0-beta.0

package/driver/profile-service.mjs

@@ -176,6 +176,22 @@ function bandsBandRows(deck, manifest) {
   return out;
 }
 
+// NO STORE PATH AND NO LOAD-LOG WORDING REACHES A BROWSER. The profile validator opens every sentence with
+// the file it judged (`profiles/<key>.json: `), which is right in a terminal and in the load log and is a
+// server path on the company page, so the door takes the prefix off. The three marketplace-entry refusals
+// are then worded for the browser too: their load-log words ("the grid program domain-restricts to it",
+// "inflates the floor") are engine vocabulary, and the staff profile editor already carries a sentence for
+// each (profile-page.html's MAP), copied here unchanged. Every other sentence passes as the validator wrote it.
+const BROWSER_WORDING = [
+  [/^platforms must not list "web"/, "Don’t list “web” — the general web is always searched. Remove it."],
+  [/^platforms entry .* must be a bare store DOMAIN/, "One of the marketplaces isn’t a website address — use domains like amazon.com, one per line."],
+  [/^platforms entry .* is duplicated/, "A marketplace is listed twice — remove the duplicate."],
+];
+export const forBrowser = (errors) => (errors ?? []).map((e) => {
+  const bare = String(e).replace(/^profiles\/[^\s:]*\.json: /, "");
+  return BROWSER_WORDING.find(([re]) => re.test(bare))?.[1] ?? bare;
+});
+
 /**
  * A refusal, worded for the person in the browser.
  *
@@ -200,18 +216,14 @@ export function browserRefusal(e) {
       return { error: "refused", code: "domain_claimed", domain: d.domain, heldBy: d.heldBy,
         message: `${d.domain} is already used by another company. An address can only belong to one, `
           + `because the engine uses it to tell them apart. Remove it here, or take it off the other company first.` };
-    case "no_marketplaces":
-      return { error: "refused", code: "no_marketplaces",
-        message: "This installation has no default marketplaces set up, so there is nothing to search. "
-          + "Add at least one marketplace for this company, or ask an administrator to set the defaults." };
     case "framework_missing":
       return { error: "refused", code: "framework_missing",
         message: "The risk framework this company was pointed at is not on this installation, so nothing "
           + "was created. Rating a company under a framework nobody chose is worse than refusing." };
     case "invalid_bundle":
       // The validator collects, so these are already per-field sentences written for a reader.
-      return { error: "refused", code: "invalid_bundle", errors: d.errors ?? [],
-        message: (d.errors ?? []).join(" ") || String(e.message) };
+      return { error: "refused", code: "invalid_bundle", errors: forBrowser(d.errors),
+        message: forBrowser(d.errors).join(" ") || String(e.message) };
     default:
       return { error: "refused", message: String(e.message) };
   }
@@ -439,13 +451,12 @@ export function makeProfileService({
       try { assertProfileKey(wanted); }
       catch (e) { return { status: 400, json: { error: "bad_key", message: String(e.message) } }; }
 
-      const existing = resolveExisting();
       let framework, platforms, profile;
       try {
         // ALWAYS SET, NEVER ABSENT — the company's own when one is supplied, the house default named
         // otherwise. This is the whole reason a create does not go through save.
         framework = resolveFramework(isStr(body?.frameworkPath) ? body.frameworkPath : null);
-        platforms = resolvePlatforms(Array.isArray(body?.platforms) ? body.platforms : null, existing);
+        platforms = resolvePlatforms(Array.isArray(body?.platforms) ? body.platforms : null);
         profile = buildProfile({
           key: wanted, name,
           domains: Array.isArray(body?.matchDomains) ? body.matchDomains : [],
@@ -511,7 +522,8 @@ export function makeProfileService({
         // The receipt reads off THESE, so it can say which framework and how many marketplaces, and
         // whether each was chosen or defaulted, rather than restating what was typed.
         framework: { path: framework.path, defaulted: framework.source === "default" },
-        marketplaces: { count: platforms.platforms.length, defaulted: platforms.source !== "supplied" },
+        // Never defaulted any more: a company created without marketplaces has none (resolvePlatforms).
+        marketplaces: { count: platforms.platforms.length, defaulted: false },
         ...(commitError ? { commitError: `created and LIVE, but the git commit failed (${commitError}) — the audit line records the gap` } : {}),
       } };
     }
@@ -621,14 +633,14 @@ export function makeProfileService({
         const v = validateProfileEdit(errKey, overlayBody, ctx, { sparse: true });
         let keyError = null;
         if (!exists) { try { assertProfileKey(project); } catch (e) { keyError = String(e.message); } }
-        const errors = keyError ? [keyError, ...v.errors] : v.errors;
+        const errors = forBrowser(keyError ? [keyError, ...v.errors] : v.errors);
         return { status: 200, json: { ok: errors.length === 0, errors, isNew: !exists } };
       }
 
       // save — the validated AUTO-COMMIT write (sparse validators; customer-only keys 400 here)
       if (!exists) { try { assertProfileKey(project); } catch (e) { return { status: 400, json: { error: String(e.message) } }; } }
       const v = validateProfileEdit(errKey, overlayBody, ctx, { sparse: true });
-      if (!v.ok) return { status: 400, json: { error: "validation_failed", errors: v.errors } };
+      if (!v.ok) return { status: 400, json: { error: "validation_failed", errors: forBrowser(v.errors) } };
       // The write lands FIRST (atomic temp+rename); a git failure after it must never hide the mutation
       // behind a 500 — the overlay is LIVE the moment it is renamed (every loadProjects door reads
       // force-fresh), so the response says written:true with the commit error named, and the audit line
@@ -670,7 +682,7 @@ export function makeProfileService({
       // a brand-new key must also be a safe slug (it becomes a filename); surface that in the dry run
       let keyError = null;
       if (!exists) { try { assertProfileKey(key); } catch (e) { keyError = String(e.message); } }
-      const errors = keyError ? [keyError, ...v.errors] : v.errors;
+      const errors = forBrowser(keyError ? [keyError, ...v.errors] : v.errors);
       return { status: 200, json: { ok: errors.length === 0, errors, isNew: !exists } };
     }
 
@@ -684,7 +696,7 @@ export function makeProfileService({
     preserveUncontrolled(profile, exists ? profiles.get(key) : null);
     const effective = preserveCodeOwned(profile, exists ? profiles.get(key) : null);
     const v = validateProfileEdit(key, effective, contextPack);
-    if (!v.ok) return { status: 400, json: { error: "validation_failed", errors: v.errors } };
+    if (!v.ok) return { status: 400, json: { error: "validation_failed", errors: forBrowser(v.errors) } };
 
     const { files } = writeProfile({ profileDir, key, profile: effective, contextPack });
     // The write is atomic and LIVE the instant it renames — the next run freezes THIS file. An

package/driver/profiles.mjs

@@ -175,13 +175,22 @@ export function derivedBatchSize(profile) {
   return Math.max(1, Math.floor(gridCellBudget(profile) / derivedFloor(profile)));
 }
 
+// THE TERMS ONE GRID CALL MAY CARRY when each term runs `cellsPerTerm` cells: the cell budget divided by the
+// cells the grid actually runs, never more than the profile's own figure. The profile's figure assumes its
+// own stores plus the web cell, so it is too large for a grid that runs more per term: a matter frame's
+// channels, or a closure over a store the matter chose for a company that picked no marketplaces, whose
+// figure is the whole budget in terms. One oversized call truncates (the 224-cell note above).
+export function gridBatchFor(profile, cellsPerTerm) {
+  return Math.max(1, Math.min(profile?.batchSize ?? 14, Math.floor(gridCellBudget(profile) / Math.max(1, cellsPerTerm))));
+}
+
 // The per-entry platform rules as DATA rather than as throws, so every door applies the identical checks
 // and phrases the failure in its own register: a profile load DIES (a broken profile bricks every run
 // under it), a job CLARIFIES (one request, answerable by asking). Same rules either way — a domain that is
 // a foot-gun in a profile is the same foot-gun arriving on a job.
 //
-// SHAPE stays with the caller deliberately: a profile REQUIRES a non-empty platforms array, while a job's
-// platforms are optional and additive. Only the per-entry vocabulary is shared.
+// SHAPE stays with the caller deliberately: a profile REQUIRES a platforms array (possibly empty), while a
+// job's platforms are optional and additive. Only the per-entry vocabulary is shared.
 export function platformEntryErrors(list, { label = "platforms" } = {}) {
   const errs = [];
   const seen = new Set();
@@ -518,9 +527,13 @@ function validateProfileShape(key, p, { sparse = false } = {}) {
   }
   // platforms is REQUIRED on a whole profile but OPTIONAL on an overlay; the foot-gun guards below run whenever
   // it is present (a project that re-states its marketplaces must state them just as carefully).
+  //
+  // AN EMPTY LIST IS VALID, by the owner's ruling of 2026-09-23: a company may pick no marketplaces, and a
+  // new one starts that way. What stays required is the ARRAY — an absent key is not "none", it is a
+  // profile nobody finished (derivedFloor reads absent as the historical default of six).
   if (!sparse || p.platforms != null) {
-    if (!Array.isArray(p.platforms) || !p.platforms.length || !p.platforms.every((x) => typeof x === "string" && x.trim()))
-      die("platforms must be a non-empty array of store-domain strings");
+    if (!Array.isArray(p.platforms) || !p.platforms.every((x) => typeof x === "string" && x.trim()))
+      die("platforms must be an array of store-domain strings");
     // a one-character authoring slip here bricks every run under the profile (the floor counts entries
     // verbatim while the grid dedupes) — reject the known foot-guns at load time. Shared with the job
     // doors via platformEntryErrors so a domain rule can never drift between where it is stored and

package/driver/publish/index.mjs

@@ -1071,12 +1071,23 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   // the copy. The register-only LEVEL is retired, so no new run reaches this true; a run that already
   // did still must, or its workbook would claim a sweep that never ran.
   const registerOnly = isRegisterOnly(searchPolicy);
+  // A RUN WHOSE COMPANY PICKED NO MARKETPLACES (the owner's ruling of 2026-09-23). Marketplaces were still
+  // covered by the general web search, and by any stores the engine chose for the matter, so the lines that
+  // describe the common-law layer say that instead of naming a marketplace search nobody picked. Read from
+  // the frozen profile, which is the list the run actually searched; absent (a legacy run) reads as picked.
+  let noMarketplacesPicked = false;
+  try {
+    const frozenProfile = runDir ? JSON.parse(readFileSync(driverDir(runDir, 'profile.json'), 'utf8')) : null;
+    noMarketplacesPicked = Array.isArray(frozenProfile?.platforms) && frozenProfile.platforms.length === 0;
+  } catch { /* no frozen profile — a legacy run keeps its wording */ }
 
   // Jurisdiction line for the Summary — searched register scope + the common-law surface layer.
   const regScope = (searchedJurisdictions && searchedJurisdictions.length) ? searchedJurisdictions.join('/') : 'Worldwide';
   const jurisdiction = registerOnly
     ? `${regScope} (register only — no common-law / marketplace search)`
-    : `${regScope} (register) + common-law (Western web / marketplace / social)`;
+    : noMarketplacesPicked
+      ? `${regScope} (register) + common-law (Western web / social, plus any stores chosen for this matter)`
+      : `${regScope} (register) + common-law (Western web / marketplace / social)`;
 
   // Common-law URL-join: a grid hit whose candidate URL resolves to a finding's own link PROVES that search
   // term became a finding (rescues an anchor term whose finding wears a different name). Best-effort; absent
@@ -1224,6 +1235,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
       caseLawText: rdText(join(dirname(reportMd), 'case-law-findings.md')),
       registerPlan: rdJson(driverDir(runBase, 'register-plan.json')),
       laneDepthVerdicts,
+      noMarketplacesPicked,
     });
     writeRO('search-depth.json', JSON.stringify(searchDepth, null, 2));
   } catch { /* the depth record is additive — a publish never fails for want of it */ }

package/driver/publish/render.mjs

@@ -70,6 +70,9 @@ let CASE_LAW_BY_ORD = new Map();   // E5: ordinal → grounded case-law profile
 // is full-country only), so suppressing there would take case-law off the page with nothing left
 // saying so. Absence of a state is not a statement that nothing was found.
 let COURT_DECISIONS = null;
+// The company picked no marketplaces (search-depth counts.sweep): the use-check's nothing-found line names the
+// general web and the stores chosen for the matter instead of a marketplace search. Set per render.
+let NO_MARKETPLACES_PICKED = false;
 let ENFORCER_SIGNALS = new Map();  // E6: registration uri (lowercase) → {aggression, oppositions, owner}
 // WP-receipts W2 — per-render provider record-link origin + label, resolved by publish from the run's
 // OWN _driver/receipts.json provider (never the currently-configured provider — a re-published archive
@@ -552,6 +555,9 @@ const useEvidence = (m) => [USE_EVIDENCE_LABEL[m?._status], USE_SOURCE_LABEL[m?.
 // runs carry the old value forever and a fourth spelling of it would have to be accepted everywhere.
 const USE_CHECK_NO_RESULT = 'perplexity_research — no result';
 const USE_CHECK_NO_RESULT_CITE = 'Nothing found in the marketplaces searched.';
+// The same "searched, nothing found" line for a run whose company picked no marketplaces (the owner's
+// ruling of 2026-09-23): there was no marketplace search to name, and the general web still ran.
+const USE_CHECK_NO_RESULT_CITE_NO_MARKETPLACES = 'Nothing found in the general web search or in any store chosen for this matter.';
 // — MATCHED ON NORMALISED PUNCTUATION, NOT ONE SPELLING. The constant itself does not
 // move (archived runs carry it forever, the validators name it), but the SEAT emitted a hyphen where
 // the doctrine writes an em dash, and exact equality let the raw tool name through to a delivered
@@ -1222,7 +1228,9 @@ function whatWasSearchedSection(opts, coverage = [], findings = [], recordsByUri
   }
   const sw = c.sweep || {};
   if (sw.spellings) rows.push(['Spellings searched', String(sw.spellings)]);
-  if (sw.checks) rows.push(['Marketplace and web', `${sw.checks.toLocaleString('en-GB')} checks on ${sw.platforms} platforms`]);
+  if (sw.checks) rows.push(['Marketplace and web', sw.noMarketplacesPicked
+    ? `${sw.checks.toLocaleString('en-GB')} checks: the general web, plus any stores chosen for this matter.`
+    : `${sw.checks.toLocaleString('en-GB')} checks on ${sw.platforms} platforms`]);
   if (sw.reputation) rows.push(['Reputation and meaning', `${sw.reputation.toLocaleString('en-GB')} checks`]);
   rows.push(['Local-script spellings', c.localScriptSearched ? 'Searched' : 'Not searched']);
   // HOW DEEP THE LOCAL-LANGUAGE INVESTIGATION WENT, which is a different question from the row above it.
@@ -1803,7 +1811,9 @@ function fullDetail(f, card, recordsByUri = new Map()) {
   const useStatus = useEvidence(f.meters?.use);
   // D7 — the code-owned "searched, nothing found" sentinel becomes client words HERE, by exact
   // equality against the one constant. Any other value is a source string and rides through untouched.
-  const useSrc = isUseCheckNoResult(f.use_check?.source) ? USE_CHECK_NO_RESULT_CITE : f.use_check?.source;
+  const useSrc = isUseCheckNoResult(f.use_check?.source)
+    ? (NO_MARKETPLACES_PICKED ? USE_CHECK_NO_RESULT_CITE_NO_MARKETPLACES : USE_CHECK_NO_RESULT_CITE)
+    : f.use_check?.source;
   // NO EVIDENCE TAG ON AN EMPTY RESULT. The line read "Use checked. Marketplace search run — no result
   // found. Evidence: inferred", and "inferred" beside "no result" reads as a contradiction: it qualifies
   // how a FINDING was established, and there is no finding here. Nothing was found, and that is the
@@ -2511,6 +2521,7 @@ export function renderHtml(parsed, findings = [], coverage = [], opts = {}) {
   SCOPE_WORLDWIDE = opts.scopeBasis === 'worldwide' ? true : null;   // the plan's scope_basis; null ⇒ fall back to the ledger-prose sniff
   CASE_LAW_BY_ORD = opts.caseLawByOrdinal instanceof Map ? opts.caseLawByOrdinal : new Map();   // T7 (E5)
   COURT_DECISIONS = opts.searchDepth?.counts?.courtDecisions ?? null;   // gates the card's case-law strand
+  NO_MARKETPLACES_PICKED = opts.searchDepth?.counts?.sweep?.noMarketplacesPicked === true;
   ENFORCER_SIGNALS = new Map((Array.isArray(opts.enforcerSignals) ? opts.enforcerSignals : []).map((e) => [String(e.uri ?? '').toLowerCase(), e]));   // T7 (E6)
   RECORD_ORIGIN = opts.recordOrigin ?? null;       // WP-receipts W2
   // — `null` and `` mean DIFFERENT things and the render must not collapse them. `` is an

package/driver/publish/search-depth.mjs

@@ -275,7 +275,7 @@ export function localScriptSearched(registerPlan) {
  *
  * @returns {{schemaVersion: number, cleared: object, counts: object}}
  */
-export function searchDepthRecord({ auditMd = "", recordIndex = {}, recordFileNames = [], bandRecordIds = null, commonLawGrid = null, caseLawText = "", registerPlan = null, laneDepthVerdicts = null } = {}) {
+export function searchDepthRecord({ auditMd = "", recordIndex = {}, recordFileNames = [], bandRecordIds = null, commonLawGrid = null, caseLawText = "", registerPlan = null, laneDepthVerdicts = null, noMarketplacesPicked = false } = {}) {
   // `recordFileNames: null` travels all the way to the page — see recordsByCountry. The default stays `[]`
   // because that is "the caller said nothing", not "the store is absent"; only the publish path knows the
   // difference and it is the one producer.
@@ -295,7 +295,9 @@ export function searchDepthRecord({ auditMd = "", recordIndex = {}, recordFileNa
     counts: {
       recordsByCountry: recordsByCountry(recordFileNames),
       recordsRead: recordFileNames === null ? null : recordFileNames.length,
-      sweep: sweepCounts(commonLawGrid, auditMd),
+      // The company picked no marketplaces: the report says the general web ran plus any stores chosen for
+      // the matter. Stamped only when true, so every other run's record is unchanged.
+      sweep: { ...sweepCounts(commonLawGrid, auditMd), ...(noMarketplacesPicked ? { noMarketplacesPicked: true } : {}) },
       localScriptSearched: localScriptSearched(registerPlan),
       courtDecisions: courtDecisionsState(caseLawText),
       // `localScriptSearched` above answers whether the spellings were searched; this answers how deep

package/driver/run-economics.mjs

@@ -106,7 +106,7 @@ import { runLog, note } from "./log.mjs";
 import { writeRunStatus } from "./progress.mjs";
 // tokens.mjs imports this module too (isCodeSide, stampRunEconomics). The cycle is safe because each side
 // reads the other's bindings only inside functions, never while the module is loading.
-import { isAttemptRow } from "./tokens.mjs";
+import { isAttemptRow, modelKey } from "./tokens.mjs";
 
 /**
  * The provider's separately-priced token kinds, in the driver's own `usage` vocabulary (gateway.mjs /
@@ -185,23 +185,12 @@ function billingKeyOf(rec) {
   // is rather than dragged into "unknown" beside genuinely unstamped legacy rows.
   const engine = isCodeSide(rec) ? "code" : String(rec.engine ?? "unknown");
   const authMode = isCodeSide(rec) ? "not-provider-billed" : String(rec.authMode ?? "unknown");
-  // A TURN THAT NAMED NO MODEL (a jx row with `modelActual: null` and no `model`) is keyed the way the
-  // token rollup keys it (modelKey in tokens.mjs): `<engine>/no-model-reported`, a name that says the
-  // model is missing. Read through the old `?? "unknown"` it landed beside legacy rows nobody stamped,
-  // and its byBilling bucket named a different model from the rollup's byModel for the same turn.
-  //
-  // A COPY OF modelKey's RULE, NOT A SHARED ONE: tokens.mjs does not export it. So the test for "no stamp"
-  // is modelKey's own, a non-empty string `modelUsed`, and not `modelUsed == null`: under that looser test
-  // a row stamped `modelUsed: ""` keyed its bucket as the empty string while the rollup keyed the same
-  // turn `<engine>/no-model-reported`. Two copies of one rule drifting apart is how the census and the
-  // rollup came to disagree about what an attempt is, so the tests hold these two copies to each other on
-  // the rows the engine writes. They still part on a row no writer produces: no model and no engine, or
-  // engine `anthropic-agent`. This key names the missing model there, while modelKey resolves the absent
-  // model through the catalog before it asks whether one exists, and buckets the row as `undefined`.
-  const stamped = typeof rec.modelUsed === "string" && rec.modelUsed;
-  const model = !stamped && typeof rec.model !== "string"
-    ? `${typeof rec.engine === "string" && rec.engine ? rec.engine : "unknown"}/no-model-reported`
-    : String(rec.modelUsed ?? rec.model ?? "unknown");
+  // THE MODEL IS NAMED BY THE TOKEN ROLLUP'S OWN RULE (modelKey in tokens.mjs), not a copy of it. A copy
+  // lived here while tokens.mjs did not export the rule, and the two drifted: a native-language turn that
+  // named its model was billed under the raw served id while the rollup keyed it `anthropic/unstamped:<id>`,
+  // so one turn had two names in the same run's figures. A code-side row comes back as its own name
+  // (`code:<step>`), which says no model ran.
+  const model = modelKey(rec);
   return { engine, authMode, model, key: `${engine}|${authMode}|${model}` };
 }
 

package/driver/stages.mjs

@@ -2527,7 +2527,7 @@ export const STAGES = {
       },
       "adopt-or-override each placement by engaging its reason, and the `### Disagreement resolutions` rows (one per surfaced disagreement and per borderline:true, each ADOPTED/OVERRODE in writing)": {
         class: "judgment", tokens: ["registerdigest_adjudication_invalid", "registerdigest_adjudication_incomplete"],
-        why: "Answering the promotion question the other way, in writing, against a reason another stage authored. #850 keeps it J. The row's SUBJECT is handed over as data (the driver appends the PLACEMENT RULINGS TAIL block, pipeline.mjs:3584), so nothing here is a fetch. [citation unverified]",
+        why: "Answering the promotion question the other way, in writing, against a reason another stage authored. #850 keeps it J. The row's SUBJECT is handed over as data (the driver appends the PLACEMENT RULINGS TAIL block, digestDispatchExtra() in pipeline.mjs), so nothing here is a fetch.",
       },
       // ── REWRITTEN, NEVER DELETED (the ruling) — AND THE ROW THAT COST THIS CONVERSION A DESIGN ──
       //

package/driver/suite-census.json

@@ -142,8 +142,8 @@
           "todos": 0
         },
         "a-check-that-could-not-look-does-not-report-a-drift.test.mjs": {
-          "tests": 10,
-          "asserts": 26,
+          "tests": 13,
+          "asserts": 37,
           "skips": 0,
           "todos": 0
         },
@@ -220,8 +220,14 @@
           "todos": 0
         },
         "a-company-created-in-the-browser-is-a-whole-company.test.mjs": {
-          "tests": 11,
-          "asserts": 61,
+          "tests": 14,
+          "asserts": 75,
+          "skips": 0,
+          "todos": 0
+        },
+        "a-company-with-no-marketplaces-is-described-as-searched.test.mjs": {
+          "tests": 2,
+          "asserts": 4,
           "skips": 0,
           "todos": 0
         },
@@ -1077,6 +1083,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-state-change-from-another-site-is-refused.test.mjs": {
+          "tests": 15,
+          "asserts": 70,
+          "skips": 0,
+          "todos": 0
+        },
         "a-stop-is-read-once-more-before-anything-is-published.test.mjs": {
           "tests": 4,
           "asserts": 12,
@@ -1197,6 +1209,12 @@
           "skips": 2,
           "todos": 0
         },
+        "a-version-npm-is-still-validating-gets-its-entry-once-served.test.mjs": {
+          "tests": 14,
+          "asserts": 47,
+          "skips": 0,
+          "todos": 0
+        },
         "a-visible-line-is-written-for-the-client.test.mjs": {
           "tests": 11,
           "asserts": 24,
@@ -1708,8 +1726,8 @@
           "todos": 0
         },
         "client-door.test.mjs": {
-          "tests": 39,
-          "asserts": 168,
+          "tests": 40,
+          "asserts": 173,
           "skips": 1,
           "todos": 0
         },
@@ -1725,6 +1743,12 @@
           "skips": 0,
           "todos": 0
         },
+        "closing-the-terminal-stops-what-start-started.test.mjs": {
+          "tests": 2,
+          "asserts": 6,
+          "skips": 1,
+          "todos": 0
+        },
         "cn-scope-honesty.test.mjs": {
           "tests": 22,
           "asserts": 96,
@@ -3442,8 +3466,8 @@
           "todos": 0
         },
         "pipeline.mock.test.mjs": {
-          "tests": 99,
-          "asserts": 827,
+          "tests": 101,
+          "asserts": 842,
           "skips": 0,
           "todos": 0
         },
@@ -3580,8 +3604,8 @@
           "todos": 0
         },
         "portal-service.test.mjs": {
-          "tests": 131,
-          "asserts": 712,
+          "tests": 132,
+          "asserts": 715,
           "skips": 1,
           "todos": 0
         },
@@ -3688,8 +3712,8 @@
           "todos": 0
         },
         "profiles.test.mjs": {
-          "tests": 48,
-          "asserts": 263,
+          "tests": 49,
+          "asserts": 272,
           "skips": 0,
           "todos": 0
         },
@@ -4078,8 +4102,8 @@
           "todos": 0
         },
         "release-pipeline.test.mjs": {
-          "tests": 121,
-          "asserts": 456,
+          "tests": 122,
+          "asserts": 462,
           "skips": 0,
           "todos": 0
         },
@@ -4102,8 +4126,8 @@
           "todos": 0
         },
         "render.test.mjs": {
-          "tests": 162,
-          "asserts": 675,
+          "tests": 163,
+          "asserts": 681,
           "skips": 0,
           "todos": 0
         },
@@ -4276,8 +4300,8 @@
           "todos": 0
         },
         "run-economics.test.mjs": {
-          "tests": 25,
-          "asserts": 158,
+          "tests": 26,
+          "asserts": 161,
           "skips": 0,
           "todos": 0
         },
@@ -4379,7 +4403,7 @@
         },
         "runner.knockout-e2e.test.mjs": {
           "tests": 3,
-          "asserts": 115,
+          "asserts": 118,
           "skips": 0,
           "todos": 0
         },
@@ -5380,8 +5404,8 @@
           "todos": 0
         },
         "the-people-page-can-change-and-remove-a-person.test.mjs": {
-          "tests": 16,
-          "asserts": 80,
+          "tests": 17,
+          "asserts": 85,
           "skips": 0,
           "todos": 0
         },
@@ -5483,7 +5507,7 @@
         },
         "the-record-half-of-an-add-must-reach-git.test.mjs": {
           "tests": 11,
-          "asserts": 39,
+          "asserts": 40,
           "skips": 0,
           "todos": 0
         },
@@ -6134,6 +6158,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-tool-the-listing-hides-cannot-be-called-by-name.test.mjs": {
+          "tests": 4,
+          "asserts": 10,
+          "skips": 0,
+          "todos": 0
+        },
         "account-audit-chain.test.mjs": {
           "tests": 10,
           "asserts": 48,
@@ -6267,8 +6297,8 @@
           "todos": 0
         },
         "http-handler.test.mjs": {
-          "tests": 20,
-          "asserts": 47,
+          "tests": 23,
+          "asserts": 58,
           "skips": 0,
           "todos": 0
         },
@@ -6316,7 +6346,7 @@
         },
         "ops-token.test.mjs": {
           "tests": 8,
-          "asserts": 39,
+          "asserts": 41,
           "skips": 0,
           "todos": 0
         },
@@ -6345,8 +6375,8 @@
           "todos": 0
         },
         "portal-trigger-wire.test.mjs": {
-          "tests": 1,
-          "asserts": 7,
+          "tests": 2,
+          "asserts": 11,
           "skips": 0,
           "todos": 0
         },
@@ -6375,8 +6405,8 @@
           "todos": 0
         },
         "scope.test.mjs": {
-          "tests": 27,
-          "asserts": 114,
+          "tests": 30,
+          "asserts": 121,
           "skips": 0,
           "todos": 0
         },
@@ -6734,8 +6764,8 @@
           "todos": 0
         },
         "profileFields.test.ts": {
-          "tests": 54,
-          "asserts": 173,
+          "tests": 55,
+          "asserts": 176,
           "skips": 0,
           "todos": 0
         },

package/driver/tokens.mjs

@@ -68,27 +68,35 @@ function emptyAcc() {
  * turn (`engine.resolveModelId ?? resolveModel`) and stamps the answer on the row as `modelUsed`. So
  * this reads the stamp rather than re-deriving it — one resolution, at the point that knows.
  */
-function modelKey(rec) {
+export function modelKey(rec) {
   if (typeof rec.modelUsed === "string" && rec.modelUsed) return rec.modelUsed;
 
   // NO STAMP. Two different situations, and guessing the same way for both is what caused the bug.
   const engine = typeof rec.engine === "string" ? rec.engine : "";
 
-  // Rows predating the stamp, and the direct-API jx lanes, are Anthropic — that was the only engine
-  // when they were written, and the jx lanes name a bare claude id that resolveModel exists to
-  // normalise. Resolving keeps every historical rollup keyed exactly as it was.
-  if (!engine || engine === "anthropic-agent") return resolveModel(rec.model);
+  // A TURN THAT NAMED NO MODEL, a native-language row recording `modelActual: null` (see isAttemptRow),
+  // has no id at all. Its tokens still account, under a key that says the model is missing rather than
+  // one built from the absent field. Asked FIRST, so no row keys as `undefined` because the catalog was
+  // handed nothing to resolve.
+  if (typeof rec.model !== "string") return `${engine || "unknown"}/no-model-reported`;
+
+  // Rows predating the stamp are Anthropic — that was the only engine when they were written — and
+  // resolving keeps every historical rollup keyed exactly as it was.
+  //
+  // A NATIVE-LANGUAGE ROW IS STAMPED WITH ITS VENDOR, NOT AN ENGINE (jxBillingStamp in jx-lanes.mjs), and
+  // its `model` is the id that served the turn. An Anthropic one is normalised through the catalog like
+  // any served Claude id, so it keys as `anthropic/claude-haiku-4-5`, apart from a stage's
+  // `anthropic/claude-haiku` — the split ruled on and accepted with recording the tier. It used to fall
+  // to the branch below and key as `anthropic/unstamped:<id>`, a name for a missing stamp on a row that
+  // carries one. An OpenAI one keys as its served id, which is what an openai-agent stage row carries.
+  if (!engine || engine === "anthropic-agent" || engine === "anthropic") return resolveModel(rec.model);
+  if (engine === "openai") return rec.model;
 
   // Any OTHER engine with no stamp. The tier is not a model id and this catalog is not that engine's,
   // so there is no honest id to key under. Name the gap instead: the tokens still account (dropping
   // them would break byModel summing to total, and an invisible gap is the failure this file already
   // fixed once for byEngine), and the key says what is missing rather than asserting an Anthropic
   // model produced them.
-  //
-  // A TURN THAT NAMED NO MODEL, a native-language row recording `modelActual: null` (see isAttemptRow),
-  // has no id at all. Its tokens still account, under a key that says the model is missing rather than
-  // one built from the absent field. Such a row always carries its vendor's stamp, so it reaches here.
-  if (typeof rec.model !== "string") return `${engine || "unknown"}/no-model-reported`;
   return `${engine}/unstamped:${rec.model}`;
 }
 

package/mcp-server/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-artifacts-mcp
 
+## 0.4.0-beta.0
+
+No changes in this release.
+
 ## 0.3.3
 
 No changes in this release.

package/mcp-server/lib/audit.mjs

@@ -50,7 +50,7 @@ export function summarize(body) {
  */
 export const UNNAMED_DOOR = "unnamed";
 
-export function appendAudit({ email, sub, body, status, transport, door, path = DEFAULT_AUDIT_PATH }) {
+export function appendAudit({ email, sub, kind = null, namesVerbs = null, body, status, transport, door, path = DEFAULT_AUDIT_PATH }) {
   // `sub` = the inner-token PRINCIPAL (ops-token issuance, INSTALL.md §8) — distinguishes
   // two automations sharing a transport identity. null for internal/user sessions without a sub claim.
   //
@@ -69,7 +69,14 @@ export function appendAudit({ email, sub, body, status, transport, door, path =
   // WRITTEN ONLY WHEN GIVEN, the same rule as `transport` and for the same reason: the existing log
   // shape must not move for records that have no answer to this. A door that does not name itself is a
   // record with no `door` key, not a record claiming to be from nowhere.
-  const line = JSON.stringify({ ts: new Date().toISOString(), email: email ?? null, sub: sub ?? null, ...summarize(body), status: status ?? null, ...(transport ? { transport } : {}), door: door || UNNAMED_DOOR }) + "\n";
+  //
+  // `kind` is the principal's kind (ops, user, account, internal), and `namesVerbs` says, for an ops token
+  // only, whether it names its write verbs. An ops token that names none is being retired: re-issued with
+  // verbs, then refused once this log shows none in use. So the log must be able to count them. Written
+  // only when given, by the same rule as `transport`: a caller that never knew writes no claim.
+  const line = JSON.stringify({ ts: new Date().toISOString(), email: email ?? null, sub: sub ?? null,
+    ...(kind ? { kind } : {}), ...(typeof namesVerbs === "boolean" ? { namesVerbs } : {}),
+    ...summarize(body), status: status ?? null, ...(transport ? { transport } : {}), door: door || UNNAMED_DOOR }) + "\n";
   try { mkdirSync(dirname(path), { recursive: true }); appendFileSync(path, line); } catch { /* best-effort */ }
 }