clearotron 0.3.3 → 0.4.0-beta.1

package/.env.example

@@ -265,6 +265,15 @@ CLARIVATE_API_KEY=changeme
 # Signa.
 SIGNA_API_KEY=changeme
 #
+# The run memory: within one run, reuse an answer the register already gave instead of asking again.
+# Signa's starts off: `watch` still sends every request and records whether a held answer would have
+# matched, and `on` reuses held answers. Clarivate's starts on, and `off` asks every time. Read when a run
+# starts, by providers/_shared/answer-memory.mjs.
+# effect: tuning
+CLEAROTRON_SIGNA_ANSWER_MEMORY=off
+# effect: tuning
+CLEAROTRON_CLARIVATE_ANSWER_MEMORY=on
+#
 # USPTO, local — the free US source, and the only one here that is not a paid vendor. TWO
 # variables, and they are needed at different moments, which is why neither substitutes for the other.
 #

package/INSTALL.md

@@ -647,24 +647,11 @@ matches, the neutral Generic default applies.
   config store and the engine loads *those* companies instead. **Same engine, different config path** —
   the code carries no company identities.
 
-  Two things go with it, and both are refusals rather than preferences:
+  One thing goes with it, and it is a refusal rather than a preference:
 
   - **`PROFILE_REPO_ROOT` moves too.** The company directory has to sit inside the repository that
     variable names, because editing a profile is a commit. Point one somewhere new and leave the other
     behind and the portal and the profile service both refuse to start, naming both variables.
-  - **That repository needs a `user.name` and a `user.email` of its own.** Saves are committed under
-    the name of whoever asked for them, but git also records who *made* the commit, and it will not
-    commit at all without one. A service account usually has no global git identity, so a store created
-    by hand needs its own:
-
-    ```bash
-    git init -b main /srv/clearotron-store
-    git -C /srv/clearotron-store config user.name  "clearotron local install"
-    git -C /srv/clearotron-store config user.email "clearotron@example.com"
-    ```
-
-    `clearotron start` does this for the store it creates. A store you make yourself does not get it,
-    and the symptom is the first save failing at a commit rather than anything about profiles.
 - **Run data is external too.** Published reports, audits, and per-run state go to the archive pool at
   `CLEAROTRON_REPORTS_DIR`. Nothing company-specific is committed to the repository.
 

package/bin/brandowner.mjs

@@ -160,11 +160,10 @@ export async function add(argv, {
     contextPack = readFileSync(packFile, "utf8");
   }
 
-  // THE ROSTER IS READ BEFORE THE CANDIDATE IS BUILT, because the Generic default lives in it. The
-  // candidate is still judged as a member of the roster and not alone — see assertRosterAccepts.
+  // The candidate is judged as a member of the roster and not alone — see assertRosterAccepts.
   const { loadProfiles } = await import("../driver/profiles.mjs");
   const load = loadProfilesFn ?? loadProfiles;
-  const platforms = resolvePlatforms(args.platforms, rosterAsItStands(store, load));
+  const platforms = resolvePlatforms(args.platforms);
 
   const profile = buildProfile({
     key: args.key, name: args.name.trim(), domains: args.domains,
@@ -180,10 +179,11 @@ export async function add(argv, {
     : `framework: ${framework.path} — THE GENERIC DEFAULT, applied because none was supplied. `
       + `Their matters will be rated under it until they give us theirs.`;
 
+  // NONE, when none was supplied (the owner's ruling of 2026-09-23): the brand owner starts with no
+  // marketplaces, and the line says what their searches still cover.
   const platformsLine = platforms.source === "supplied"
     ? `platforms: ${platforms.platforms.join(", ")} — as supplied`
-    : `platforms: ${platforms.platforms.join(", ")} — THE GENERIC DEFAULT, applied because none was supplied. `
-      + `Their searches cover these marketplaces until someone changes them in the portal.`;
+    : `platforms: none — searches use the general web, plus any stores chosen for each matter.`;
 
   if (args.dryRun) {
     out(`would create ${join(store, `${args.key}.json`)}`);

package/bin/connect.mjs

@@ -135,10 +135,10 @@ export function systemdFailure(e, { step, unit = null } = {}) {
 const UNIT_DIR = join(homedir(), ".config", "systemd", "user");
 const ENV_PATH = join(homedir(), ".env");
 // Where the revocation list lives when this install has never named one — created by connect so the
-// door is BORN consulting it (; measured: no denylist is configured on production,
-// and `isRevoked()` returns false on an UNSET path — still true, and deliberately so: a deployment that
-// never asked for a denylist is not taken down by one. It is an unreadable list that now refuses
-//. Assuming a path nobody set still makes every issued key unrevokable).
+// door is BORN consulting it (; measured: no denylist is configured on production).
+// `isRevoked()` now reads this same default when the setting is unset, and an absent default reads as
+// "nothing revoked"; a list that is there and unreadable refuses. Naming the path is still what makes
+// every door, whatever home it runs under, read the file a revocation is written to.
 // — one owner for this path. It was written out here, in disconnect and twice
 // in start; `start` named it and created nothing, which is how a revoked key kept answering 200.
 const DENYLIST_PATH = defaultDenylistPath(homedir());

package/bin/onboard.mjs

@@ -3453,10 +3453,8 @@ export async function runCheck() {
       if (r.state === "valid") ok(line);
       else info(line);
     }
-    if (report.valid && !String(process.env.TRADEMARK_MCP_TOKEN_DENYLIST ?? "").trim()) {
-      problem("a valid key is on record but NO revocation list is configured (TRADEMARK_MCP_TOKEN_DENYLIST unset) "
-        + `— \`${invoke("disconnect")}\` could not actually revoke it. \`${invoke("connect")}\` arms one; set the variable or reconnect.`);
-    }
+    // No "revocation list not configured" problem any more: with TRADEMARK_MCP_TOKEN_DENYLIST unset, every
+    // door reads the install's default list (isRevoked, shared/scope.mjs), which is where disconnect writes.
     // THE PUBLISHED ADDRESS, AND WHETHER IT ANSWERS (acceptance 2). Reported here
     // rather than beside the unit, because the unit running and the address being reachable are
     // different facts and the second is the one a client depends on.
@@ -4496,9 +4494,9 @@ try {
   candidate.PROFILE_REPO_ROOT = cfg;   // no alias row — this name is current
   for (const k of ["CLEAROTRON_CUSTOMERS_DIR", "PROFILE_REPO_ROOT"]) ok(`${k}=${candidate[k]}`);
   // A REPOSITORY ALREADY THERE IS ASKED NOW, while the operator is still here, whether it can record a
-  // save. `clearotron start` gives a store it creates an identity of its own; one made by hand has none
-  // unless somebody set it, and on a machine with no global identity the first company created in the
-  // portal is refused. Said here, with the command, rather than discovered on that first company.
+  // save: one this account cannot use refuses the first company created in the portal. Said here, with
+  // the command, rather than discovered on that first company. A missing git identity is not asked
+  // about, because every save supplies the product's own committer.
   if (existsSync(join(cfgAbs, ".git"))) {
     const cannot = storeCommitRefusal(cfgAbs);
     if (cannot) warn(`${cannot.message}. Until then, creating a company in the portal is refused.`);

package/bin/start.mjs

@@ -111,7 +111,7 @@ export async function runTables() {
   return { registers: PROVIDERS, engines: ENGINE_BINARIES, defaultEngine: RUN_DEFAULT_ENGINE, resolveEngine: resolveEngineProgram };
 }
 import { spawn, spawnSync, execFileSync } from "node:child_process";
-import { storeInRepo, storeOutsideRepoMessage, storeCommitRefusal } from "../shared/store-in-repo.mjs";   //
+import { storeInRepo, storeOutsideRepoMessage, storeCommitRefusal, storeCommitEnv } from "../shared/store-in-repo.mjs";   //
 import { stdioConnectOffer } from "../shared/stdio-connect.mjs";
 import { wslTarget } from "../shared/wsl.mjs";   // — and which distribution a row should start the server in
 import { ensureDemoProgram } from "../shared/permanent-install.mjs";   // — a demo from npx keeps its own copy
@@ -1531,9 +1531,9 @@ if (isMain) {
       err(`  WARNING: could not initialise the saved-search store at ${paths.configStore} (${String(e?.message ?? e)}). Searches will list and run; SAVING one will fail until this is a git repository.`);
     }
   } else {
-    // AN ADOPTED STORE IS ASKED WHETHER IT CAN RECORD A SAVE, HERE, not at the first save. A repository
-    // made by hand has no identity unless somebody gave it one, and on a machine with no global identity
-    // the first company created in the portal is then refused. The one created above sets its own.
+    // AN ADOPTED STORE IS ASKED WHETHER IT CAN RECORD A SAVE, HERE, not at the first save: a directory
+    // that is not a repository this account can use refuses every company created in the portal. A store
+    // with no git identity is not refused; every save supplies the product's own committer.
     const cannot = storeCommitRefusal(paths.configStore);
     if (cannot) err(`  WARNING: ${cannot.message}. Until then, creating a company or saving a search is refused.`);
   }
@@ -1556,7 +1556,7 @@ if (isMain) {
         // and the first save commits them with its own change.
         try {
           execFileSync("git", ["-C", paths.configStore, "add", "-A", "--", "profiles"], { stdio: "ignore" });
-          execFileSync("git", ["-C", paths.configStore, "commit", "-q", "-m", "the demo's company"], { stdio: "ignore" });
+          execFileSync("git", ["-C", paths.configStore, "commit", "-q", "-m", "the demo's company"], { stdio: "ignore", env: storeCommitEnv(paths.configStore) });
         } catch { /* see above */ }
         say(`  demo store     ${paths.profiles} — ${copied.join(", ")}`);
       }
@@ -2298,6 +2298,7 @@ if (isMain) {
   // the `stopping` flag is what stops an orderly stop being reported as a crash.
   process.on("SIGINT", () => { void shutdown(0); });
   process.on("SIGTERM", () => { void shutdown(0); });
+  for (const sig of windowCloseSignals()) process.on(sig, () => { void shutdown(0); });
 
   const healthy = async (url, rec) => {
     const deadline = Date.now() + 30_000;
@@ -2678,6 +2679,20 @@ export function backgroundOfferLines({ demo = false, keep = false, manager = nul
   ];
 }
 
+/**
+ * The signal that means the window was closed, which a foreground start treats as a stop.
+ *
+ * SIGHUP, on every platform. Closing a terminal sends it, and with no handler Node's default ended this
+ * process on the spot: the teardown never ran, and the children, which lead sessions of their own, never
+ * received the hangup. The portal, the door and the worker went on running with nothing supervising them
+ * and a search in flight carried on (measured on Linux, 2026-09-23), while the banner above says closing
+ * the window stops everything this command started. Windows reports closing the console window as SIGHUP
+ * too.
+ */
+export function windowCloseSignals() {
+  return ["SIGHUP"];
+}
+
 /**
  * What a reader is told when a child this install cannot run without exits.
  *

package/bin/update.mjs

@@ -383,7 +383,12 @@ export async function update(argv = process.argv.slice(2)) {
     return pulled;
   }
 
-  const installed = runInCheckout("npm", ["ci"]);
+  // NO INSTALL SCRIPTS. A dependency's install script runs with everything this account can reach, and an
+  // update fetches whatever the registry serves that day. None is needed here: the only dependency that
+  // carries one is optional and macOS-only, and this package's own two are the Node floor, which the CLI
+  // checks at every start, and a contributor's git hooks. Dev dependencies stay, because the portal
+  // bundle below is rebuilt from them.
+  const installed = runInCheckout("npm", ["ci", "--ignore-scripts"]);
   if (installed !== 0) {
     console.error("\n  npm ci failed. The code is updated; its dependencies are not, so this install is");
     console.error("  in a half-updated state and should not be run until that command succeeds.\n");

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "80f14b0925b8052cb70d5173a6f664bd2a2510a0",
-  "version": "0.3.3"
+  "commit": "e60329390d653439053b900cf97b65e082e06622",
+  "version": "0.4.0-beta.1"
 }

package/docs/architecture/04-configuration-reference.md

@@ -138,12 +138,6 @@ id is what a dispatch row and a token-rollup row carry as the model *asked for*;
 the turn is recorded beside it, and the report names that. A version here would be a claim about a
 request nobody made, and wrong the day a newer model of the tier shipped.
 
-One consequence, accepted when this was decided: per-model totals are keyed on what was asked for,
-and the native-language lanes call the API directly, where a model id is required and a tier word is
-not accepted. So one model reached by a stage and by those lanes appears under two keys —
-`anthropic/claude-haiku` and `anthropic/claude-haiku-4-5`. They are different requests, and the split
-says so.
-
 The bottom four are **legacy names that no stage declares and no engine can run** — they resolve at
 level 1 and then throw at level 2 (below). They are catalogue entries, not available tiers.
 
@@ -248,6 +242,8 @@ deployment may override (verify live values per deployment).
 | `CLEAROTRON_MAX_CLAIM_AGE_MS` | 172800000 (48 h; 0 disables) | Hard ceiling on a claim's age (from the `.pid` sidecar mtime) — beyond it, re-claim regardless of liveness. |
 | `CLEAROTRON_KNOCKOUT_VARIANT_CAP` | unset (⇒ the lane's own cap) | Ceiling on variants a knockout screens per name. Set only to bound an unusually wide batch; absent means the lane decides. |
 | `CLEAROTRON_KNOCKOUT_RECORD_CAP` | unset (⇒ the lane's own cap) | Ceiling on records a knockout fetches per hit. Same shape as the variant cap: absent is the normal state. |
+| `CLEAROTRON_SIGNA_ANSWER_MEMORY` | `off` | On the Signa register, whether a run reuses an answer it already holds instead of asking again. `off` asks every time. `watch` also asks every time, and records whether a held answer would have matched. `on` reuses held answers. |
+| `CLEAROTRON_CLARIVATE_ANSWER_MEMORY` | `on` | On the Clarivate register, whether a run reuses a count, a search, an owner lookup or a record it already holds instead of asking again. `off` asks every time. |
 
 ### Retries, timeouts, watchdogs
 

package/driver/CHANGELOG.md

@@ -1,5 +1,33 @@
 # clearotron-driver
 
+## 0.4.0-beta.1
+
+### Patch Changes
+
+- Fixed: Clarivate clearances no longer count look-alike spellings that mix Latin with Greek or Cyrillic letters as searches that could not be completed.
+- For operators: Clarivate clearances no longer fetch a record, or repeat a count, search or owner lookup, that the same run already made.
+- For operators: Knockouts on Signa and Clarivate take their name and close-variation counts from the listing, so each is asked of the register once.
+- Fixed: Knockouts on the Signa register now say how many register hits the listed filings were drawn from.
+- Fixed: Clearances on the Signa register no longer search look-alike spellings that mix Latin with Greek or Cyrillic letters; those searches found only unrelated marks.
+
+## 0.4.0-beta.0
+
+### Minor Changes
+
+- Before you upgrade: a new operator key must now name the tools it may use, for example `--verbs start_run,stop_run`. Keys already issued keep working.
+  
+  For operators: a revoked key stops working even where no revocation list was set up, because every connector now reads the install's own list.
+  
+  Fixed: over the network, an operator key can no longer start a what-if that its assistant is not shown.
+  
+  Fixed: the portal refuses a change sent from another website, or from another app on the same computer, including a sign-in.
+
+### Patch Changes
+
+- Fixed: closing the window that runs `clearotron start` now stops Clearotron. Before, it kept running in the background.
+- Fixed: Creating a company in the portal no longer stops with a request to run a git command.
+- Fixed: A new company starts with no marketplaces. The company page offers the usual ones to add, and a company with none is still searched on the general web.
+
 ## 0.3.3
 
 ### Patch Changes

package/driver/ask-ledger.mjs

@@ -179,7 +179,7 @@ function recallEnding(name, qid, join, ts) {
   if (discharges) return { ending, handoff: null };
   return {
     ending: null,
-    handoff: `the probe ran and ${why} — a recall probe discharges on what came back, not on having run (#1349). `
+    handoff: `the probe ran and ${why} — a recall probe discharges on what came back, not on having run. `
       + `Ships OPEN in the audit's ask ledger for the reviewing lawyer.`,
   };
 }
@@ -601,7 +601,7 @@ const normMark = (s) => String(s ?? "").toLowerCase().replace(/[^a-z0-9]/g, "");
  * as immaterial only when the mark it went looking for is in the client's findings. Otherwise the mark
  * is owed a finding and the ask stays open.
  *
- * The defect this answers: a recall probe found OSLER DELPHI, the closure stage pointed at
+ * The defect this answers: a recall probe found HALVER KORPHI, the closure stage pointed at
  * `register-findings.md` — the run's own working sheet, where the mark genuinely IS reasoned — and the
  * ask closed. The sheet is a citable file and the citation was true. It is simply not the document the
  * client reads, and nothing checked that.

package/driver/band-shape.mjs

@@ -65,7 +65,7 @@ const tokensOf = (s) => String(s ?? "").split(/[^\p{L}\p{N}]+/u).map((t) => norm
 
 /**
  * The ALTERNATIVE NAMES a label carries — `VENZAL / VENZALMONO / VENZALKOMB` is one relabelled entry,
- * `CHROMA & Device` is one mark plus a device note.
+ * `LUMIVANE & Device` is one mark plus a device note.
  *
  * The separator class is reference-score's `labelAliases`, character for character, and the two are
  * meant to stay that way: the scorer and the engine must agree about what a relabelling is, or a record
@@ -175,7 +175,7 @@ export function classifyRecord(markText, targets) {
 
   // ── member 2 — A RELABELLED RECORD IS THE SAME MARK, AND IT WAS TIERING BELOW THE FLOOR ────────
   //
-  // Measured against the scorer on `origin/main`: `VENZAL / VENZALMONO / VENZALKOMB` and `CHROMA &
+  // Measured against the scorer on `origin/main`: `VENZAL / VENZALMONO / VENZALKOMB` and `LUMIVANE &
   // Device` are `alias` to reference-score and `same-family / token-identical` here. Not dropped —
   // tiered BELOW the line. The floors take `identical` and `near-identical` only, so a register record
   // that IS the mark under a relabelling never became a row a lawyer had to answer. Same consequence as
@@ -184,7 +184,7 @@ export function classifyRecord(markText, targets) {
   // ALIAS SEPARATORS ONLY, and the distinction is reference-score's, kept deliberately identical
   // because the two must agree about what a relabelling IS: `/ , · & |` separate ALTERNATIVE NAMES for
   // one record; whitespace and hyphens separate WORDS WITHIN one name. Conflating them makes every
-  // multi-word mark match its own first word — `TIKI TWIST` would become `TIKI`, which is a different
+  // multi-word mark match its own first word — `WAVO TWIST` would become `WAVO`, which is a different
   // proprietor's different mark and the collision the scorer's own doc block warns about. Whitespace is
   // NOT in the class here for exactly that reason.
   //
@@ -213,7 +213,7 @@ export function classifyRecord(markText, targets) {
 // The candidate set of the retrieved→judgment reconciliation: every LIVE, in-scope, SCREEN-SURFACED
 // record whose mark carries the manifest's dominant element — as a standalone token
 // (`token-identical`), a token one edit away (`token-edit-1`), or CONCATENATED inside a longer
-// squashed word (`concatenation` — the TIKITONK class: same-family in substance, "other" to the
+// squashed word (`concatenation` — the WAVOTONK class: same-family in substance, "other" to the
 // token classifier, and the proven silent-death seam). Screen-surfaced only (screen_verdict
 // surface:*): the obligation this feeds is "everything the screen surfaced ends somewhere a reader
 // can see"; drop:* records were already ended by the screen with a policed drop row.
@@ -227,7 +227,7 @@ export function classifyRecord(markText, targets) {
 // itself never spells. They rank last so they never reached the top slice, but they inflate the
 // residual a declared crowd count must cover — a count written one short blocks the run (the
 // reviewer reproduced 378 declared vs 379 residual → blocked). A concatenation is a SQUASHED WORD
-// (TIKITONK), which is a property of one token.
+// (WAVOTONK), which is a property of one token.
 export const MIN_CONCAT_LEN = 4;
 
 /**
@@ -323,8 +323,8 @@ export function dominantElementComposites(band, { dominantElement, inScopeClasse
 //       identity, and the arithmetic becomes a cross-reference instead.
 //   (2) owner identity is compared on a CORE + LEGAL-FORM pair, not on the suffix-stripped core
 //       alone. Stripping entity words is what makes "Fairmile Snack Foods Corp." = "Fairmile Snack Foods
-//       Corporation" work, but on the same band it also collapsed "Tiki Group Limited", "Tiki AG"
-//       and "Tiki Corporation" to the bare core "tiki" and merged three distinct registrants on the
+//       Corporation" work, but on the same band it also collapsed "Wavo Group Limited", "Wavo AG"
+//       and "Wavo Corporation" to the bare core "wavo" and merged three distinct registrants on the
 //       mark-owner edge alone. So: same core AND compatible legal forms (one side's form set a
 //       SUBSET of the other's — a register that simply omits the form still matches, two different
 //       stated forms never do).
@@ -359,7 +359,7 @@ export function ownerIdentical(a, b) {
 }
 
 /** The union-find bucket key for the mark+owner edge — core + the SORTED form set, so
- *  "Tiki AG" and "Tiki Corporation" land in different buckets while "X Corp."/"X Corporation" share
+ *  "Wavo AG" and "Wavo Corporation" land in different buckets while "X Corp."/"X Corporation" share
  *  one. The subset relaxation (a register omitting the form) is applied by the second pass below. */
 const ownerKey = (s) => { const { core, forms } = ownerIdentity(s); return core ? `${core}|${[...forms].sort().join("+")}` : ""; };
 const normOwner = (s) => ownerIdentity(s).core;

package/driver/blind-frame-model.mjs

@@ -13,7 +13,7 @@
 // PURE (no node imports) → tests offline. Mirrors coverage-ledger.mjs / findings-model.mjs.
 
 // add/drop = the both-directions element neighbours (VELTRIN→VELTRI is "drop"); phonetic/homophone =
-// sound-alikes; neighbour = a one-keystroke real-word / famous-mark neighbour (CHROME on NOVAPULSE);
+// sound-alikes; neighbour = a one-keystroke real-word / famous-mark neighbour (NOVAPULSO on NOVAPULSE);
 // composite = the element inside a larger mark (VELTRI-composite cluster).
 export const VARIANT_DIRECTIONS = ["add", "drop", "phonetic", "homophone", "neighbour", "composite"];
 // the spine is ranked by goods-overlap with the actual product, not by class number + registration status.

package/driver/common-law-receipts.mjs

@@ -861,9 +861,9 @@ export function mergeCommonLawFindings(parts) {
 // a present row chose.
 //
 // The join bug is fixed independently, because a census nobody can trust is worse than none:
-//   • TERM match is EXACT after stripping a trailing annotation ("提基冰沙 (ZH: …)"). It used to be
+//   • TERM match is EXACT after stripping a trailing annotation ("瓦波冰沙 (ZH: …)"). It used to be
 //     `rowTerm.includes(cellTerm)`, so the row for "CORAL FREEZE" was credited to the cells for "SLUSH"
-//     and even "TIK", and the row for "提基冰沙" to the cell for "冰沙" — 71 of the 221.
+//     and even "WAV", and the row for "瓦波冰沙" to the cell for "冰沙" — 71 of the 221.
 //   • a platform ROLL-UP row ("Multiple platforms") counts only when the term has no platform-specific
 //     row of its own; combined with the substring bug it used to match every platform at once.
 // `undisposed` (title containment over raw web-search titles) is GONE: it returned 1,986 rows on the

package/driver/commonlaw-carry.mjs

@@ -9,7 +9,7 @@
 //
 // ── the loss this exists to catch ────────────────────────────────────────────────────────────────────
 //
-// TIKI TWIST and TIKI TROPICS. Both sat in R3's own common-law records and reached no findings list, and
+// WAVO TWIST and WAVO TROPICS. Both sat in R3's own common-law records and reached no findings list, and
 // nothing anywhere said why. `common-law-receipts.mjs`'s `findGridCandidateOmissions` already reports one
 // class of this — a hit cell denied by the Negative-results matrix — but it is CELL-granular, and a cell
 // carries up to eight candidates. This is the per-candidate half.
@@ -39,7 +39,7 @@
 // ── THE NON-LATIN TRAP IS ANSWERED, NOT AVOIDED ──────────────────────────────────────────────────────
 //
 // `normalizeJoinText` folds every non-[A-Za-z0-9] run to a space, so it returns the EMPTY STRING for
-// 色度, 冰沙, 提基冰沙, ティキスラッシュ and 티키 슬러시. A mark-keyed trace is structurally blind to
+// 色度, 冰沙, 瓦波冰沙, ワボスラッシュ and 와보 슬러시. A mark-keyed trace is structurally blind to
 // every one of them.
 //
 // NOTHING HERE TOUCHES IT. A Han-script candidate joins on its ASCII/percent-encoded URL. A Han-script

package/driver/company-bundle.mjs

@@ -99,28 +99,21 @@ export function resolveFramework(requested, {
 
 // ── the profile this writes ────────────────────────────────────────────────────────────────────────
 /**
- * Which marketplaces this brand owner's searches cover — supplied, or the Generic default, SAID OUT LOUD.
+ * Which marketplaces this brand owner's searches cover: the ones supplied, or NONE.
  *
- * A customer bundle is a COMPLETE document in this design, not an overlay on generic: every shipped
- * profile carries its own `platforms`, and the loader requires a non-empty array on every file. The
- * command had no way to supply one and set none, so every bundle it wrote failed to load on this field
- * as well as on the `key` field above — two independent invalidities, and onboarding could not produce
- * a loadable brand owner at all.
+ * A customer bundle is a COMPLETE document in this design, not an overlay on generic: every profile
+ * carries its own `platforms` array, and the loader requires one on every file.
  *
- * Defaulting rather than refusing, and naming it, is this command's own established idiom: the same
- * ruling governs the framework one function down. Which marketplaces a client's clearance searches is
- * not a detail to decide silently, so an operator who supplies nothing is TOLD what they got and can
- * refine it in the portal.
+ * NONE, NOT THE GENERIC DEFAULT, by the owner's ruling of 2026-09-23. A company created with only a name
+ * used to be given the Generic default's marketplaces, which no screen listed and which the company page
+ * then refused to let anybody remove. A new company now starts with an empty list and somebody picks
+ * from the Generic default's marketplaces, which the portal offers as suggestions. With an empty list the
+ * general web search and the meaning checks still run, and so do any stores the engine chooses for a matter
+ * (pipeline.mjs deriveGridSpec).
  */
-export function resolvePlatforms(supplied, roster) {
+export function resolvePlatforms(supplied) {
   if (supplied?.length) return { platforms: supplied, source: "supplied" };
-  const house = roster?.get?.("generic")?.platforms ?? [];
-  if (!house.length)
-    throw new Refusal(
-      "no --platforms was given and the Generic default carries none, so there is nothing to onboard this "
-      + "brand owner with. Pass --platforms, or repair the generic profile in the store.",
-      { code: "no_marketplaces" });
-  return { platforms: [...house], source: "house default" };
+  return { platforms: [], source: "none" };
 }
 
 export function buildProfile({ key, name, domains, platforms, framework, industry,

package/driver/connotation-search.mjs

@@ -4,7 +4,7 @@
 // searched-not-asserted enforcement (validator side). Sister of use-check.mjs (spec 11): a "clean" claim
 // is sayable ONLY when a search produced it.
 //
-// The bug this closes (live incident: a mark reading as a benign given name one letter off the Sureño
+// The bug this closes (live incident: a mark reading as a benign given name one letter off the Mara
 // street-gang label): the deterministic grid runs term×platform marketplace cells only — it asks
 // "who SELLS this name?", never "what does this name MEAN?". A marketplace grid that finds no listing for
 // the mark is SILENT on the street-gang association; only a MEANING search surfaces it. With no machine slot
@@ -30,7 +30,7 @@
 
 // The meaning query shapes. NOT a banned-word list — these are SEARCH directions ("what does this name mean,
 // and to whom?"). Perplexity surfaces foreign-language / gang / slang meanings from English query shapes
-// (a benign given name one letter off "Sureño" → the gang label surfaces from "<mark> gang" / "<mark> urban dictionary").
+// (a benign given name one letter off "Mara" → the gang label surfaces from "<mark> gang" / "<mark> urban dictionary").
 
 export const CONNOTATION_SHAPES = ["meaning slang", "gang", "offensive", "urban dictionary", "wikipedia"];
 
@@ -1125,7 +1125,7 @@ const RECURRENT_MIN = 4;
 // ── — THE REASON SCALE IS MEASURED HERE AND DELIBERATELY DOES NOT DECIDE ────────────────────────
 // was ruled "recurrence counts independent reasons, not query strings": a dictated query is
 // "<term> <shape>", the sweep asks every shape of every mark variant, so the seven queries reading
-// BIODELFIN/BIODELFINO/BIODOLPHIN/ΒΙΟΔΕΛΦΙΣ/ΔΕΛΦΙΣ/ΜΠΙΟΔΕΛΦΙΣ/Дельфис + "offensive meaning" that all
+// BIOVELTRYN/BIOVELTRINO/BIOVELTRINE/ΒΙΟΒΕΛΤΡΙΝ/ΒΕΛΤΡΙΝ/ΜΠΙΟΒΕΛΤΡΙΝ/Вельтрин + "offensive meaning" that all
 // return the dictionary definition of the word "offensive" are one reason asked seven ways. That
 // reasoning is sound and the shape is the right way to express it. It is implemented below as
 // connotationReasonKey, and it is RECORDED on every run — but it is NOT what clears the floor.
@@ -1133,7 +1133,7 @@ const RECURRENT_MIN = 4;
 // IT WAS BUILT, MEASURED AGAINST THE THREE PRESERVED RUNS, AND REFUTED BY THEM. Making the floor read
 // the reason scale inverts the signal it exists to read:
 //   - The 2026-07 evidence run (test/fixtures/coral-freeze-pr-risk.json, 54 recorded queries): the floor's
-//     obligation set goes 7 → 0. `punchdrink.com/articles/problem-with-tiki-bars-cultural-appropriation`
+//     obligation set goes 7 → 0. `punchdrink.com/articles/problem-with-wavo-bars-cultural-appropriation`
 //     — THE receipt this floor was invented to force onto the page — is surfaced by four queries that are
 //     all shape "offensive", so it scores ONE reason and drops out. The gate stops firing on the run it
 //     was designed for.

package/driver/contract-e3-backlog.mjs

@@ -151,7 +151,7 @@ export const E3_BACKLOG = [
     kind: "literal-json-skeleton",
     where: "driver/skills/blind-frame/SKILL.md:62-83",
     surface: "skill-file",
-    evidence: "A JSON OBJECT with EXACTLY these keys:\\n```json\\n{\\n \"schema_version\": 1,\\n \"dominant_element\": \"the spine, verbatim\",\\n \"variants\": [{\"value\": \"DELPHI\", \"direction\": \"drop\", \"rationale\": \"…\"}],\\n \"fields\": […],\\n \"sources\": […],\\n \"ranking_basis\": \"goods-overlap\"\\n}\\n``` … `direction` is EXACTLY on",
+    evidence: "A JSON OBJECT with EXACTLY these keys:\\n```json\\n{\\n \"schema_version\": 1,\\n \"dominant_element\": \"the spine, verbatim\",\\n \"variants\": [{\"value\": \"KORPHI\", \"direction\": \"drop\", \"rationale\": \"…\"}],\\n \"fields\": […],\\n \"sources\": […],\\n \"ranking_basis\": \"goods-overlap\"\\n}\\n``` … `direction` is EXACTLY on",
     reparsedBy: "driver/verify.mjs validators.blindFrame — emits invalid_file:…:blindframe_* on an off-enum or missing key (stages.mjs:952-957 doc block)",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
@@ -283,7 +283,7 @@ export const E3_BACKLOG = [
   {
     stage: "register-unit",
     kind: "exactly-these-keys",
-    where: "driver/stages.mjs:4202 (the frame-reopen / scoped-retry message builder). A second number stood here and had been stale for some time: it pointed at a contract-element description rather than a builder, at its old line and at every mechanical shift of it. Two candidate builders sit beside 4157 and picking one would be a guess, so the wrong pointer is removed rather than moved a third time — one accurate citation beats one accurate and one invented.",
+    where: "driver/stages.mjs:4210 (the frame-reopen / scoped-retry message builder). A second number stood here and had been stale for some time: it pointed at a contract-element description rather than a builder, at its old line and at every mechanical shift of it. Two candidate builders sit beside 4157 and picking one would be a guess, so the wrong pointer is removed rather than moved a third time — one accurate citation beats one accurate and one invented.",
     surface: "stage-message",
     evidence: "Every block you append MUST carry \"state\":\"enumerated\" (ONLY if paged to has_more:false) or \"state\":\"incomplete\" — EXACTLY those two strings … (re-dispatch builders, which REPLACE def.message)",
     reparsedBy: "driver/named-band.mjs parseNamedBand. Scope warning: these builders replace def.message on every escalation / envelope-close / frame-reopen dispatch, so an E3 lint that walks STAGES[*].message only never sees them",
@@ -446,7 +446,7 @@ export const E3_BACKLOG = [
     kind: "literal-json-skeleton",
     where: "driver/skills/frame-diff/SKILL.md:44-48",
     surface: "skill-file",
-    evidence: "A directive may carry a structured `remedy`:\\n```json\\n\"remedy\": { \"terms\": [\"TROPICAL TIKI\", \"ISLAND TIKI\"], \"nice_classes\": [\"5\", \"32\"], \"regions\": [] }\\n```",
+    evidence: "A directive may carry a structured `remedy`:\\n```json\\n\"remedy\": { \"terms\": [\"TROPICAL WAVO\", \"ISLAND WAVO\"], \"nice_classes\": [\"5\", \"32\"], \"regions\": [] }\\n```",
     reparsedBy: "driver/pipeline.mjs runSupplementalSweeps — the remedy lint refuses a label-shaped term; stages.mjs:2809 restates the same shape in the message (\"THE ASK CONTRACT, stated at BOTH levels\")",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },

package/driver/declination-call.mjs

@@ -6,7 +6,7 @@
 //
 // `record-carry.json` on a full clearance test run read `unreasoned: 0` and was telling the truth in the weak
 // sense only: every drop had a LABEL, and on 102 of them the label was inferred from where the record
-// stopped rather than stated by the step that stopped it. One of those 102 was DELPHIC — a lawyer-named
+// stopped rather than stated by the step that stopped it. One of those 102 was KORPHIC — a lawyer-named
 // gold mark, REGISTERED, placed on sheet-2, stamped `carry: "carried"`, carried onto the findings
 // surface, and then absent from the delivered report with nothing anywhere saying why.
 //

package/driver/declination-tool.mjs

@@ -116,7 +116,7 @@ export function appendDeclinations(runDir, accepted, { now = () => new Date().to
     }
     ensureDriverDir(runDir);
     writeFileSync(ledger, JSON.stringify({
-      _provenance: "synthesis's own stated decision not to deliver a record that reached the findings surface (#1117). "
+      _provenance: "synthesis's own stated decision not to deliver a record that reached the findings surface. "
         + "Written by the driver from typed calls — never hand-authored, never parsed out of prose.",
       ts: now(), count: byUri.size, declinations: [...byUri.values()],
     }, null, 2) + "\n");

package/driver/dev-portal.mjs

@@ -78,7 +78,7 @@ export const DEV_COCKPIT_JOB_FIELDS = Object.freeze({
       + "is a form for composing REAL dev runs; a fixture run is declared by the job file that wants one, so "
       + "the fact travels with the run rather than with whoever filled in a form.",
     promptParts: "the requester's declaration that the prose rides as SIDECAR files. The cockpit composes a job "
-      + "from its own form and writes no sidecars, so it may not claim that shape (#1085).",
+      + "from its own form and writes no sidecars, so it may not claim that shape.",
     forwarderDomain: "the cockpit's assembler defaults it; a dev form has no forwarding domain to state.",
     provider: "which register vendor answers is the dev instance's own configuration, not a form field.",
     name: "the pre-markName spelling of the search subject. The form posts `mark`.",

package/driver/door-call-verdict.mjs

@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// A CALL TO THE OPS DOOR THAT THE DEPLOYMENT CHECK COULD NOT MAKE — "roster resolves" (list_profiles) and
+// "ops-MCP reachable" (describe_options). Extracted so it can be driven without a door to call, as
+// plan-run-agreement-verdict.mjs was for the third call.
+//
+// Both rows used to FAIL on every error but an unset door, so the check exited 1, "drifted", when nothing
+// had been compared. Measured on pre-prod 0.3.3-beta.0: both rows FAILed on a 401, the door refusing the
+// check's own key. On the test box the same door's rate limit (429) refused the third call of a burst of
+// checks; that was the plan_run call, and these two go to the same door.
+//
+// THREE ANSWERS MEAN THE CHECK DID NOT LOOK: a rate limit (429), a refusal of this check's own key (401,
+// 403), and a request that got no answer in time. Each is a marked skip, which exits 3. Everything else
+// stays a FAIL: a 5xx or a malformed answer is the door answering badly. A door with nothing listening
+// at all stays a FAIL too, because whether that is a finding is not settled, and this does not settle it.
+
+/**
+ * @param {Error & {status?: number|null, timedOut?: boolean}} e  what the call threw
+ * @param {{ asked: string, notCompared: string }} what  the tool asked, and what was therefore not compared
+ * @returns {{state: "skip", blocked: true, message: string} | null}  null: report it as the FAIL it was
+ */
+export function doorCallVerdict(e, { asked, notCompared }) {
+  const refused = e?.status === 429 || e?.status === 401 || e?.status === 403 || e?.timedOut === true;
+  if (!refused) return null;
+  return { state: "skip", blocked: true, message: `could not ask ${asked}, so ${notCompared} — ${String(e?.message ?? e).slice(0, 200)}` };
+}