clearotron 0.3.3 → 0.4.0-beta.1

package/driver/portal-request-origin.mjs

@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// A STATE CHANGE MUST COME FROM THIS PORTAL'S OWN PAGES. The portal checked nothing about where a POST
+// came from: the session cookie's SameSite attribute was the whole defence in local mode, and behind a
+// proxy it was the proxy's cookie. A page on another site, or another app on this machine on another
+// port (a browser treats every port on one host as the same site), could make a signed-in browser change
+// state here. So every state-changing request is checked against this portal's own host, in both modes.
+//
+// THE HOST IS THE REQUEST'S OWN, NOT A LIST. `Host` is what the browser addressed. A proxy in front can
+// rewrite it, and then says the original in `X-Forwarded-Host`, which Caddy sets by default. A page on
+// another site cannot set either header on a victim's browser (a custom header forces a preflight the
+// portal never grants), so accepting a match on either is still a match on this portal's own name.
+// Compared with its port: another app on this machine differs only in the port.
+//
+// A DEFAULT PORT IS NO PORT. `https://portal.example` and `https://portal.example:443` are one origin, and
+// so are `http://h` and `http://h:80`. A browser's Origin never writes the default port, but a proxy or a
+// tunnel in front may write it into `Host`, and a plain comparison would then refuse every save the
+// portal's own pages make. So the port the Origin's scheme implies is taken off both sides before they are
+// compared, and only that one: `:443` beside an `http` Origin is still another port.
+//
+// A REQUEST WITH NEITHER `Origin` NOR `Sec-Fetch-Site` IS NOT FROM A BROWSER. Every current browser sends
+// one of them on a POST, and a script or `curl` sends neither. A script cannot be tricked into carrying
+// someone else's session, so there is nothing to refuse, and its own credential still has to pass.
+
+const STATE_CHANGING = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+const first = (v) => String(Array.isArray(v) ? v[0] : (v ?? "")).split(",")[0].trim();
+
+const DEFAULT_PORT = { "https:": "443", "http:": "80" };
+
+/** `host` without the port `protocol` implies, when it carries exactly that one. */
+function withoutDefaultPort(host, protocol) {
+  const port = DEFAULT_PORT[protocol];
+  return port && host.endsWith(`:${port}`) ? host.slice(0, -(port.length + 1)) : host;
+}
+
+/** The hosts this request says it was addressed to, lower-case, with their ports, less the default one. */
+function ownHosts(headers, protocol) {
+  return new Set([first(headers?.host), first(headers?.["x-forwarded-host"])].filter(Boolean)
+    .map((h) => withoutDefaultPort(h.toLowerCase(), protocol)));
+}
+
+/**
+ * Why this request is refused as coming from somewhere other than this portal, or null to let it through.
+ * @param {{ method?: string, headers?: Record<string, string|string[]|undefined> }} req
+ * @returns {string|null}
+ */
+export function crossSiteReason(req) {
+  if (!STATE_CHANGING.has(String(req?.method ?? "GET").toUpperCase())) return null;
+  const headers = req?.headers ?? {};
+  const origin = first(headers.origin);
+  if (origin) {
+    if (origin === "null") return "Origin is null";
+    let host, protocol;
+    try { ({ host, protocol } = new URL(origin)); } catch { return "Origin is not an address"; }
+    host = withoutDefaultPort(host.toLowerCase(), protocol);
+    const own = ownHosts(headers, protocol);
+    return own.has(host) ? null : `Origin ${host} is not this portal (${[...own].join(", ") || "no Host"})`;
+  }
+  const site = first(headers["sec-fetch-site"]).toLowerCase();
+  if (site) return site === "same-origin" || site === "none" ? null : `Sec-Fetch-Site is ${site}`;
+  return null;
+}
+
+/**
+ * Whether a state-changing request carries a body that is not declared as JSON. The API reads every body as
+ * JSON; a form post (`text/plain`, `application/x-www-form-urlencoded`) is the shape a page on another site
+ * can send without a preflight, so it is refused here rather than parsed. A request with no body is not
+ * asked for a type: the portal's own pages send none on a POST that carries nothing.
+ */
+export function bodyNotJson(req) {
+  if (!STATE_CHANGING.has(String(req?.method ?? "GET").toUpperCase())) return false;
+  const headers = req?.headers ?? {};
+  const length = Number(first(headers["content-length"]) || 0);
+  const hasBody = length > 0 || Boolean(first(headers["transfer-encoding"]));
+  if (!hasBody) return false;
+  const type = first(headers["content-type"]).split(";")[0].trim().toLowerCase();
+  return type !== "application/json";
+}

package/driver/portal-service.mjs

@@ -168,6 +168,7 @@ import { engineCommit } from "./engine-build.mjs";                  // — the S
 import { engineCommitDate, engineProvenance } from "./engine-build.mjs";
 import { classifySkillsStore } from "./skills-store-provenance.mjs";
 import { makeStaticHandler, reportCsp, docCsp } from "./portal-static.mjs";
+import { crossSiteReason, bodyNotJson } from "./portal-request-origin.mjs";
 import { bundleVerdict, healthUi } from "../shared/bundle-freshness.mjs";   // one definition of a usable bundle, shared with `doctor`
 import { readReport, reportsOf, resolveReportFile, batchSummaryOf } from "./portal-report.mjs";
 import { readArchivedSet, updateArchived } from "./publish/archive-tags.mjs";
@@ -915,10 +916,10 @@ export const PORTAL_JOB_FIELDS = Object.freeze({
       + "which exists because the hand-emitting email-loop agent can only `write` files. The portal composer "
       + "sends structured fields and writes no sidecars, so a job it built is never in that shape — carrying "
       + "the flag would have it claim an intake it did not use, and the door's own check would then look for "
-      + "files nobody wrote (#1085).",
+      + "files nobody wrote.",
     msgId: "the email door's message id. This door has no message: the composer IS the request, and there "
       + "is no thread to thread it into. It was declared carried and reached the job as a hardcoded null "
-      + "that the trigger hop then stripped, which is a declaration measuring nothing (#497).",
+      + "that the trigger hop then stripped, which is a declaration measuring nothing.",
     conversationId: "the email door's thread id, and the portal has no thread. Same story as `msgId`: "
       + "declared carried, written null, stripped again. A reply lands in the portal, not in a mailbox.",
     customer: "the APPLICANT, and the account already resolved it — see the jobFor header. Letting a body "
@@ -1142,7 +1143,7 @@ export function makeConnectorKeyRevoker({ env = process.env, home = null } = {})
     const base = home ?? homedir();
     const recorded = recordedKeysFor(g, email);
     const plan = disablePlan({ env, unitDir: join(base, ".config", "systemd", "user"), exists: existsSync,
-      identity: email, recorded, denylistPath: denylistPathFor(env, base) });
+      identity: email, recorded, denylistPath: denylistPathFor(env, base), home: base });
     if (!plan.possible) return { grants: g, revoked: 0, jtis: [], lateArm: false, says: plan.says };
     if (plan.lateArm) return { grants: g, revoked: 0, jtis: plan.jtis, lateArm: true, says: plan.says ?? [] };
     // THE RECORD IS NEVER STRUCK FROM HERE, and the ledger step is dropped rather than no-opped.
@@ -1614,6 +1615,7 @@ export function makePortalService({
         // identity gets {} here exactly as it does for names and keeps reading the staff-only roster.
         let accountNames = {};
         let accountFacts = {};
+        let meRoster = null;   // read once for this answer: the names below and the house marketplaces
         // GENERIC IS NAMED TOO when the person sees an organisation's Generic. It is not a company, so it is
         // never in `accounts`, and without a name here the switcher printed the raw key at everyone below
         // everything. An organisation with no company yet is the case with an empty `accounts`, so the
@@ -1623,7 +1625,7 @@ export function makePortalService({
         if (named.length) {
           try {
             const { companyFactsOf } = await import("./profiles.mjs");
-            const profiles = await loadProfilesImpl();
+            const profiles = meRoster = await loadProfilesImpl();
             for (const key of named) {
               const profile = profiles.get(key);
               const name = profile?.name;
@@ -1662,9 +1664,19 @@ export function makePortalService({
         // READ ONCE. The payload names it and the program reading below is gated on it; two calls to
         // `flagView` here would be two reads of the same file that could disagree with each other.
         const meEngineMode = flagView(poolRoot).engineMode;
+        // THE HOUSE MARKETPLACES, offered as suggestions wherever a company's marketplaces are edited. A new
+        // company starts with none (the owner's ruling of 2026-09-23) and somebody picks; these are the
+        // Generic default's own list, read from the store so an install that changed it offers its own.
+        // Deployment-wide and the same for everyone, like concurrentRuns. [] when the store cannot be read:
+        // the box still takes any marketplace typed into it.
+        let houseMarketplaces = [];
+        try {
+          const house = (meRoster ?? await loadProfilesImpl()).get("generic")?.platforms;
+          if (Array.isArray(house)) houseMarketplaces = house.filter((d) => typeof d === "string" && d.trim());
+        } catch { /* a suggestion list is a nicety; the door is not */ }
         return { status: 200, json: { email: principal.email, ...principalView(principal, grantsHere, accountNames),
           accounts: principal.accounts, accountNames, accountFacts,
-          concurrentRuns: concurrentRunsCap(), brand: ORGANISATION_NAME, engineMode: meEngineMode,
+          concurrentRuns: concurrentRunsCap(), brand: ORGANISATION_NAME, engineMode: meEngineMode, houseMarketplaces,
           // WHERE A PERSON ASKS FOR A CHANGE TO THEIR SIGN-IN, beside the brand and read where it is read:
           // an href Preferences links "Clearotron administrator" to, or null, and then the words are plain.
           administratorContact: ADMINISTRATOR_CONTACT,
@@ -3267,15 +3279,12 @@ async function connectorDoorKind(url) {
             const p = envFrom(process.env, "CLEAROTRON_ACCESS_FILE");
             if (p) grantsFile = { name: basename(p), modifiedAt: new Date(statSync(p).mtimeMs).toISOString() };
           } catch { /* reported as unknown; a failed stat must not take down the page that explains access */ }
-          // WHETHER AN ISSUED KEY CAN BE WITHDRAWN AT ALL, read the same way `disablePlan` reads it: the
-          // door loaded a revocation list at start, or it did not and never will for the keys already
-          // out. The variable's PRESENCE is the whole question — its value is a path, and this route
-          // must not say where.
-          // WHETHER A REVOCATION LIST IS NAMED FOR THIS PROCESS AT ALL — which is not the same question
-          // as whether the connector loaded one, and the page's words are careful about the difference.
-          // The connector is a separate unit with its own environment; this answers only for here.
-          const keysRevocable = Boolean(revokeConnectorKeys)
-            && String(process.env.TRADEMARK_MCP_TOKEN_DENYLIST ?? "").trim() !== "";
+          // WHETHER AN ISSUED KEY CAN BE WITHDRAWN AT ALL. This used to be whether a revocation list was
+          // named in this process's environment, because a door with none named checked no list. Every door
+          // now reads the install's default list when none is named (isRevoked, shared/scope.mjs), and that
+          // is where a revocation from here is written, so keys can be withdrawn whenever this process has
+          // a revoker at all.
+          const keysRevocable = Boolean(revokeConnectorKeys);
           return { status: 200, json: accessView({ grants: grantsHere, viewer: principal, companies, grantsFile, localSignIn, keysRevocable }) };
         }
         // /portal/admin/people — give someone access. Manage-gated above; everything else is decided here.
@@ -3641,9 +3650,10 @@ export function accountCapAdvice(posture) {
   }
   return "Re-mint with `mcp-server/mint-token.mjs --scope ops"
     + `${posture.sub ? ` --sub ${posture.sub}` : ""}`
-    // NO `--verbs` FLAG AT ALL when the token is full-ops: `verbs: null` means EVERY verb, and naming a
-    // list there would be the narrowing this whole function exists to stop.
-    + `${posture.verbs ? ` --verbs ${posture.verbs.join(",")}` : ""}`
+    // A FULL-OPS TOKEN (`verbs: null`) IS RE-ISSUED WITH THE PORTAL'S OWN VERBS. It used to get no
+    // `--verbs` at all, so as not to narrow it; mint-token now refuses an ops token that names none, so that
+    // command would fail, and re-issuing verb-less tokens with verbs is the point. The portal calls these two.
+    + ` --verbs ${(posture.verbs ?? ["start_run", "stop_run"]).join(",")}`
     + " --accounts <keys>` to make it two walls.";
 }
 
@@ -4288,6 +4298,18 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
         });
       }
 
+      // ── A STATE CHANGE FROM ANOTHER SITE IS REFUSED BEFORE ANYTHING ELSE LOOKS AT IT ────────────────
+      //
+      // Before identity, so the sign-in and sign-out forms are covered as well as the API: a page elsewhere
+      // that signs a browser in to an account of its choosing is the same attack as one that acts under the
+      // browser's own session. The rule and why it compares hosts is in portal-request-origin.mjs.
+      const crossSite = crossSiteReason(req);
+      if (crossSite) {
+        log(`refused a ${req.method} to ${url.pathname} from another site: ${crossSite}`);
+        journal(403, "cross-site request");
+        return send(res, 403, { error: "cross_site" });
+      }
+
       // ──: THE LOCAL SIGN-IN DOOR — before identity, because it is how identity is obtained ─────
       //
       // Mounted only when the local identity provider is running. On a Cloudflare-fronted instance
@@ -4420,6 +4442,12 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
         journal(429, "rate_limited", identity?.email);
         return send(res, 429, { error: "rate_limited" });
       }
+      // A BODY THAT DOES NOT SAY IT IS JSON IS NOT READ AS JSON. A form post is the one body another site
+      // can send without asking first; the portal's own pages always declare JSON when they send a body.
+      if (bodyNotJson(req)) {
+        journal(415, "body is not JSON", identity?.email);
+        return send(res, 415, { error: "unsupported_media_type" });
+      }
       // A FIXED reason, not `e.message`. The parser's message is about the bytes it was given, and this
       // row must not become a place a caller can write into by sending a body that fails to parse.
       let body;

package/driver/predelivery-lint.mjs

@@ -490,7 +490,7 @@ export function candidateSelfChecks({ reportMd }) {
 
 // B2 (report confabulation backstop) — per-card record provenance. The single-pass report renderer once
 // pasted one finding's body (its record link, owner, filing dates) into ANOTHER finding's card (the
-// ashen-lattice confabulation: BePharBel's body landed in cards #2 and #5). registry-record-match cannot
+// ashen-lattice confabulation: DuPharVel's body landed in cards #2 and #5). registry-record-match cannot
 // catch it: a card carrying finding-M's whole body also cites finding-M's URI, so its claims agree with the
 // cited record — but the card sits under finding-N's identity. This check binds each card to ITS finding (by
 // the hidden `- ord: N` line the per-card renderer emits, else owner-name containment for a legacy/monolithic
@@ -595,7 +595,7 @@ export function recordVerificationClaimChecks({ text, recordsByUri, surface = "r
 // Two failures, one owner set, one paragraph scan.
 //
 // (1) THE UNVERIFIED "REPORTEDLY". A delivered card said a named incumbent's registration "has
-//     reportedly been used by the USPTO to refuse other TIKI-formative marks". The record that
+//     reportedly been used by the USPTO to refuse other WAVO-formative marks". The record that
 //     settles it was on disk the whole time (its refusalInformation lists six refused applications) —
 //     so the claim had two honest endings available, a verified finding citing the record or a stated
 //     open question, and it took neither. Second sighting: the same shape reached an animal-health
@@ -819,7 +819,7 @@ const OWNER_NEGATIVE_RE = /\bno\s+(?:[\w'-]+[,]?\s+){0,6}?(?:marks?|registration
 //    Class 5."                                            ← the negative is about the APPLICANT
 // The check cannot block delivery, so the cost is a warm redo whose instruction invites rewriting
 // correct prose — a doomed redo, the TONICA lesson. The real delivered true positive keeps both
-// halves in ONE sentence ("General sweeps for Kestrel Beverages and Hochland Energie … found no TIKI-initial …
+// halves in ONE sentence ("General sweeps for Kestrel Beverages and Hochland Energie … found no WAVO-initial …
 // register mark in Classes 5 or 32"), so the narrowing costs nothing it was catching.
 // The ESCAPES stay paragraph-scoped on purpose: disclosing the gap anywhere in the claim unit is an
 // honest ending for the whole unit, and narrowing an exemption is how a false NEGATIVE gets made.
@@ -827,9 +827,9 @@ const OWNER_NEGATIVE_RE = /\bno\s+(?:[\w'-]+[,]?\s+){0,6}?(?:marks?|registration
 // THE SPLIT IS NOT wipoLanguageChecks' SPLIT, and the difference is a corporate abbreviation. A bare
 // `(?<=[.!?])\s+` boundary cuts owner names in half — and register owners are FULL of periods:
 //   "Fairmile Snack Foods Corp. holds no filings in Class 5."
-//   "Marumi Foods Inc. found no TIKI-formative marks in Class 32."
+//   "Marumi Foods Inc. found no WAVO-formative marks in Class 32."
 //   "Yamagata Holdings Co., Ltd. has no registrations in the searched classes."
-//   "Harbourline Pte. Ltd. owns no TIKI mark in Class 32."
+//   "Harbourline Pte. Ltd. owns no WAVO mark in Class 32."
 // Every one of those is the exact claim this check exists to catch, and every one of them splits
 // after the suffix — owner in segment 1, negative in segment 2, no flag. Narrowing to the sentence
 // would have bought two false positives at the price of a whole class of false NEGATIVES, on the
@@ -845,7 +845,7 @@ const OWNER_NEGATIVE_RE = /\bno\s+(?:[\w'-]+[,]?\s+){0,6}?(?:marks?|registration
 // clean negative shipped over an owner nobody enumerated.
 //
 // One case the follower rule cannot see, and it is the commonest Asian register form: a legal-form
-// abbreviation followed by ANOTHER one — "Harbourline Pte. Ltd. owns no TIKI mark" splits at
+// abbreviation followed by ANOTHER one — "Harbourline Pte. Ltd. owns no WAVO mark" splits at
 // "Pte." because "Ltd." is capitalised. That pair is NOT ambiguous (no sentence ends in "Pte." and
 // begins with "Ltd."), so it gets a named list rather than a heuristic, and the list is deliberately
 // only the STACKED pair: "Inc. There are no filings…" stays two sentences, because there the capital
@@ -858,10 +858,10 @@ const OWNER_NEGATIVE_RE = /\bno\s+(?:[\w'-]+[,]?\s+){0,6}?(?:marks?|registration
 // legal form that is ordinary in this domain, so the misses are recall loss in the guard whose whole
 // purpose is catching an unverified negative about a named owner:
 //   N1a  "Bahlsen GmbH & Co. KG holds no filings…"        KG/KGaA were absent from LEGAL_FORM, so
-//        "Henkel AG & Co. KGaA found no TIKI-formative…"  "Co." got no sentinel and the capitalised
-//        "Ritter Sport Co. KG owns no TIKI mark…"         follower split owner from negative.
+//        "Henkel AG & Co. KGaA found no WAVO-formative…"  "Co." got no sentinel and the capitalised
+//        "Ritter Sport Co. KG owns no WAVO mark…"         follower split owner from negative.
 //   N1b  "Dr. Oetker AG holds no filings…"                the follower rule only ever handled a
-//        "St. Michel Biscuits found no TIKI-formative…"   TRAILING legal form. A LEADING abbreviation
+//        "St. Michel Biscuits found no WAVO-formative…"   TRAILING legal form. A LEADING abbreviation
 //        (and "Cia. Hering Ltda.", "Warner Bros. Entertainment", "Mt. Franklin Beverages") splits the
 //        owner's own name in half before the negative is ever reached.
 // Three rules close them, each doing something the other two cannot:
@@ -1312,7 +1312,7 @@ export function correctionConsistencyChecks({ reportMd, clientSummaryMd, auditMd
 // finding's `band` (the framework in force's own word, via the run's frozen manifest); on legacy runs
 // from the canonical composite→tier table. Pure rewriter (the autoCorrectRegistry pattern): joins each
 // `## ` Marks block to a live finding DETERMINISTICALLY (wp50: ord line → exact mark → unique
-// containment; the old first-match containment join bound "DEMVENZY — Novartis" to the VENZY finding and
+// containment; the old first-match containment join bound "DEMVENZY — Norvanta" to the VENZY finding and
 // would have ENFORCED the wrong tier) and overwrites its `- risk:` value; the exec-summary `- risk:` is
 // overwritten from the worst live band (v4) / max composite (legacy). Returns { text, corrections }.
 export function applyClientTierCorrections(csMd, findings, manifest = null) {

package/driver/profile-page.html

@@ -214,7 +214,7 @@ function renderEditor(key, p, contextPack, derived, framework, isNew) {
   $("editor").innerHTML = `
     ${isNew ? f("Customer key"+REQ, "f_key", "", `<span class="reqtag">Required.</span> A short lowercase id — letters, numbers and hyphens only. It becomes the customer's filename and can't be changed later.`, "e.g. acme-health") : `<div class="ro">Editing <b><span data-anon="mark" data-anon-key="${esc(key)}">${esc(key)}</span></b></div>`}
     ${f("Customer name"+REQ, "f_name", p.name||"", `<span class="reqtag">Required.</span> The customer's name. We use it to recognise their own marks so we never flag the customer against itself.`, undefined, true)}
-    ${ta("Marketplaces and registers to search"+REQ, "f_platforms", (p.platforms||[]).join("\n"), `<span class="reqtag">Required — at least one.</span> One website per line (e.g. amazon.com). These are where we look for real-world use of a mark. Don't add 'web' — the general web is always searched.`, "", true)}
+    ${ta("Marketplaces and registers to search", "f_platforms", (p.platforms||[]).join("\n"), `One website per line (e.g. amazon.com). These are where we look for real-world use of a mark. Don't add 'web' — the general web is always searched.`, "", true)}
     ${coverageNote}
     <details class="more"${advancedSet?" open":""}>
       <summary>More options</summary>
@@ -344,18 +344,15 @@ function clientValidate({ key, profile }) {
     else if (!KEY_RE.test(key)) problems.push({ id:"f_key", message:"The customer key can only use lowercase letters, numbers and hyphens (2–39 characters)." });
   }
   if (!profile.name) problems.push({ id:"f_name", message:"Enter the customer’s name." });
+  // An empty list is valid: a company may pick no marketplaces (the owner's ruling of 2026-09-23).
   const plats = profile.platforms || [];
-  if (!plats.length) {
-    problems.push({ id:"f_platforms", message:"Add at least one marketplace or register to search — a website like amazon.com, one per line." });
-  } else {
-    const seen = new Set();
-    for (const x of plats) {
-      const dom = x.toLowerCase();
-      if (dom === "web") { problems.push({ id:"f_platforms", message:"Don’t list “web” — the general web is always searched. Remove it." }); continue; }
-      if (!DOMAIN_RE.test(dom) || /\s/.test(dom)) { problems.push({ id:"f_platforms", message:`“${x}” doesn’t look like a website address — use a domain like amazon.com.` }); continue; }
-      if (seen.has(dom)) { problems.push({ id:"f_platforms", message:`“${x}” is listed twice.` }); continue; }
-      seen.add(dom);
-    }
+  const seen = new Set();
+  for (const x of plats) {
+    const dom = x.toLowerCase();
+    if (dom === "web") { problems.push({ id:"f_platforms", message:"Don’t list “web” — the general web is always searched. Remove it." }); continue; }
+    if (!DOMAIN_RE.test(dom) || /\s/.test(dom)) { problems.push({ id:"f_platforms", message:`“${x}” doesn’t look like a website address — use a domain like amazon.com.` }); continue; }
+    if (seen.has(dom)) { problems.push({ id:"f_platforms", message:`“${x}” is listed twice.` }); continue; }
+    seen.add(dom);
   }
   return problems;
 }
@@ -366,7 +363,6 @@ function prettyServerError(msg) {
   const M = String(msg||"");
   const MAP = [
     [/name \(string\) is required/i,                    "f_name",      "Enter the customer’s name."],
-    [/platforms must be a non-empty array/i,            "f_platforms", "Add at least one marketplace or register to search — a website like amazon.com, one per line."],
     [/must not list "web"/i,                            "f_platforms", "Don’t list “web” — the general web is always searched. Remove it."],
     [/must be a bare store DOMAIN/i,                     "f_platforms", "One of the marketplaces isn’t a website address — use domains like amazon.com, one per line."],
     [/is duplicated/i,                                  "f_platforms", "A marketplace is listed twice — remove the duplicate."],

package/driver/profile-service.mjs

@@ -176,6 +176,22 @@ function bandsBandRows(deck, manifest) {
   return out;
 }
 
+// NO STORE PATH AND NO LOAD-LOG WORDING REACHES A BROWSER. The profile validator opens every sentence with
+// the file it judged (`profiles/<key>.json: `), which is right in a terminal and in the load log and is a
+// server path on the company page, so the door takes the prefix off. The three marketplace-entry refusals
+// are then worded for the browser too: their load-log words ("the grid program domain-restricts to it",
+// "inflates the floor") are engine vocabulary, and the staff profile editor already carries a sentence for
+// each (profile-page.html's MAP), copied here unchanged. Every other sentence passes as the validator wrote it.
+const BROWSER_WORDING = [
+  [/^platforms must not list "web"/, "Don’t list “web” — the general web is always searched. Remove it."],
+  [/^platforms entry .* must be a bare store DOMAIN/, "One of the marketplaces isn’t a website address — use domains like amazon.com, one per line."],
+  [/^platforms entry .* is duplicated/, "A marketplace is listed twice — remove the duplicate."],
+];
+export const forBrowser = (errors) => (errors ?? []).map((e) => {
+  const bare = String(e).replace(/^profiles\/[^\s:]*\.json: /, "");
+  return BROWSER_WORDING.find(([re]) => re.test(bare))?.[1] ?? bare;
+});
+
 /**
  * A refusal, worded for the person in the browser.
  *
@@ -200,18 +216,14 @@ export function browserRefusal(e) {
       return { error: "refused", code: "domain_claimed", domain: d.domain, heldBy: d.heldBy,
         message: `${d.domain} is already used by another company. An address can only belong to one, `
           + `because the engine uses it to tell them apart. Remove it here, or take it off the other company first.` };
-    case "no_marketplaces":
-      return { error: "refused", code: "no_marketplaces",
-        message: "This installation has no default marketplaces set up, so there is nothing to search. "
-          + "Add at least one marketplace for this company, or ask an administrator to set the defaults." };
     case "framework_missing":
       return { error: "refused", code: "framework_missing",
         message: "The risk framework this company was pointed at is not on this installation, so nothing "
           + "was created. Rating a company under a framework nobody chose is worse than refusing." };
     case "invalid_bundle":
       // The validator collects, so these are already per-field sentences written for a reader.
-      return { error: "refused", code: "invalid_bundle", errors: d.errors ?? [],
-        message: (d.errors ?? []).join(" ") || String(e.message) };
+      return { error: "refused", code: "invalid_bundle", errors: forBrowser(d.errors),
+        message: forBrowser(d.errors).join(" ") || String(e.message) };
     default:
       return { error: "refused", message: String(e.message) };
   }
@@ -439,13 +451,12 @@ export function makeProfileService({
       try { assertProfileKey(wanted); }
       catch (e) { return { status: 400, json: { error: "bad_key", message: String(e.message) } }; }
 
-      const existing = resolveExisting();
       let framework, platforms, profile;
       try {
         // ALWAYS SET, NEVER ABSENT — the company's own when one is supplied, the house default named
         // otherwise. This is the whole reason a create does not go through save.
         framework = resolveFramework(isStr(body?.frameworkPath) ? body.frameworkPath : null);
-        platforms = resolvePlatforms(Array.isArray(body?.platforms) ? body.platforms : null, existing);
+        platforms = resolvePlatforms(Array.isArray(body?.platforms) ? body.platforms : null);
         profile = buildProfile({
           key: wanted, name,
           domains: Array.isArray(body?.matchDomains) ? body.matchDomains : [],
@@ -511,7 +522,8 @@ export function makeProfileService({
         // The receipt reads off THESE, so it can say which framework and how many marketplaces, and
         // whether each was chosen or defaulted, rather than restating what was typed.
         framework: { path: framework.path, defaulted: framework.source === "default" },
-        marketplaces: { count: platforms.platforms.length, defaulted: platforms.source !== "supplied" },
+        // Never defaulted any more: a company created without marketplaces has none (resolvePlatforms).
+        marketplaces: { count: platforms.platforms.length, defaulted: false },
         ...(commitError ? { commitError: `created and LIVE, but the git commit failed (${commitError}) — the audit line records the gap` } : {}),
       } };
     }
@@ -621,14 +633,14 @@ export function makeProfileService({
         const v = validateProfileEdit(errKey, overlayBody, ctx, { sparse: true });
         let keyError = null;
         if (!exists) { try { assertProfileKey(project); } catch (e) { keyError = String(e.message); } }
-        const errors = keyError ? [keyError, ...v.errors] : v.errors;
+        const errors = forBrowser(keyError ? [keyError, ...v.errors] : v.errors);
         return { status: 200, json: { ok: errors.length === 0, errors, isNew: !exists } };
       }
 
       // save — the validated AUTO-COMMIT write (sparse validators; customer-only keys 400 here)
       if (!exists) { try { assertProfileKey(project); } catch (e) { return { status: 400, json: { error: String(e.message) } }; } }
       const v = validateProfileEdit(errKey, overlayBody, ctx, { sparse: true });
-      if (!v.ok) return { status: 400, json: { error: "validation_failed", errors: v.errors } };
+      if (!v.ok) return { status: 400, json: { error: "validation_failed", errors: forBrowser(v.errors) } };
       // The write lands FIRST (atomic temp+rename); a git failure after it must never hide the mutation
       // behind a 500 — the overlay is LIVE the moment it is renamed (every loadProjects door reads
       // force-fresh), so the response says written:true with the commit error named, and the audit line
@@ -670,7 +682,7 @@ export function makeProfileService({
       // a brand-new key must also be a safe slug (it becomes a filename); surface that in the dry run
       let keyError = null;
       if (!exists) { try { assertProfileKey(key); } catch (e) { keyError = String(e.message); } }
-      const errors = keyError ? [keyError, ...v.errors] : v.errors;
+      const errors = forBrowser(keyError ? [keyError, ...v.errors] : v.errors);
       return { status: 200, json: { ok: errors.length === 0, errors, isNew: !exists } };
     }
 
@@ -684,7 +696,7 @@ export function makeProfileService({
     preserveUncontrolled(profile, exists ? profiles.get(key) : null);
     const effective = preserveCodeOwned(profile, exists ? profiles.get(key) : null);
     const v = validateProfileEdit(key, effective, contextPack);
-    if (!v.ok) return { status: 400, json: { error: "validation_failed", errors: v.errors } };
+    if (!v.ok) return { status: 400, json: { error: "validation_failed", errors: forBrowser(v.errors) } };
 
     const { files } = writeProfile({ profileDir, key, profile: effective, contextPack });
     // The write is atomic and LIVE the instant it renames — the next run freezes THIS file. An

package/driver/profiles.mjs

@@ -175,13 +175,22 @@ export function derivedBatchSize(profile) {
   return Math.max(1, Math.floor(gridCellBudget(profile) / derivedFloor(profile)));
 }
 
+// THE TERMS ONE GRID CALL MAY CARRY when each term runs `cellsPerTerm` cells: the cell budget divided by the
+// cells the grid actually runs, never more than the profile's own figure. The profile's figure assumes its
+// own stores plus the web cell, so it is too large for a grid that runs more per term: a matter frame's
+// channels, or a closure over a store the matter chose for a company that picked no marketplaces, whose
+// figure is the whole budget in terms. One oversized call truncates (the 224-cell note above).
+export function gridBatchFor(profile, cellsPerTerm) {
+  return Math.max(1, Math.min(profile?.batchSize ?? 14, Math.floor(gridCellBudget(profile) / Math.max(1, cellsPerTerm))));
+}
+
 // The per-entry platform rules as DATA rather than as throws, so every door applies the identical checks
 // and phrases the failure in its own register: a profile load DIES (a broken profile bricks every run
 // under it), a job CLARIFIES (one request, answerable by asking). Same rules either way — a domain that is
 // a foot-gun in a profile is the same foot-gun arriving on a job.
 //
-// SHAPE stays with the caller deliberately: a profile REQUIRES a non-empty platforms array, while a job's
-// platforms are optional and additive. Only the per-entry vocabulary is shared.
+// SHAPE stays with the caller deliberately: a profile REQUIRES a platforms array (possibly empty), while a
+// job's platforms are optional and additive. Only the per-entry vocabulary is shared.
 export function platformEntryErrors(list, { label = "platforms" } = {}) {
   const errs = [];
   const seen = new Set();
@@ -518,9 +527,13 @@ function validateProfileShape(key, p, { sparse = false } = {}) {
   }
   // platforms is REQUIRED on a whole profile but OPTIONAL on an overlay; the foot-gun guards below run whenever
   // it is present (a project that re-states its marketplaces must state them just as carefully).
+  //
+  // AN EMPTY LIST IS VALID, by the owner's ruling of 2026-09-23: a company may pick no marketplaces, and a
+  // new one starts that way. What stays required is the ARRAY — an absent key is not "none", it is a
+  // profile nobody finished (derivedFloor reads absent as the historical default of six).
   if (!sparse || p.platforms != null) {
-    if (!Array.isArray(p.platforms) || !p.platforms.length || !p.platforms.every((x) => typeof x === "string" && x.trim()))
-      die("platforms must be a non-empty array of store-domain strings");
+    if (!Array.isArray(p.platforms) || !p.platforms.every((x) => typeof x === "string" && x.trim()))
+      die("platforms must be an array of store-domain strings");
     // a one-character authoring slip here bricks every run under the profile (the floor counts entries
     // verbatim while the grid dedupes) — reject the known foot-guns at load time. Shared with the job
     // doors via platformEntryErrors so a domain rule can never drift between where it is stored and

package/driver/progress.mjs

@@ -224,7 +224,7 @@ export function writeRunStatus(ctx, patch = {}, runDirOverride = null, { critica
       try {
         note(`[status] NO RUN DIRECTORY — the state write to ${JSON.stringify(patch.state)} did not happen. `
           + `The run's status.json still says whatever it said last, which for a park or a terminal means it `
-          + `says "running". Caller passed neither a runDirOverride nor a ctx.run.runDir (#1159).`);
+          + `says "running". Caller passed neither a runDirOverride nor a ctx.run.runDir.`);
       } catch { /* the note sink is best-effort too — never let reporting a lost write lose the run */ }
     }
     return;

package/driver/provider-usage.mjs

@@ -134,7 +134,8 @@ function emptyTally() {
     ledger: { configured: false, present: false, readable: false, rowsScanned: 0 },
     retries: 0,            // Σ max(0, attempts-1) — wasted retry calls
     errors: 0,             // calls that returned ok:false (incl. transport throws → http_status 0)
-    cache_hits: 0,         // calls served from a dedup cache (0 until Workstream B ships)
+    cache_hits: 0,         // calls served from the run memory instead of the register (providers/_shared/answer-memory.mjs)
+    records_reused: 0,     // records a call took from the run's own store rather than fetching again
     bytes: 0,              // total response bytes (proxy for payload cost)
     // The dedup opportunity, split so Workstream B's scope is decided from data, not guessed:
     duplicate_fetches: 0,               // record_fetch on a URI already fetched this run (real network ones)
@@ -183,6 +184,28 @@ export function tallyRegisterCalls(ledgerPath = DEFAULT_LEDGER_PATH, runPrefix)
     if (KINDS.includes(row.tool)) out[row.tool]++;
     else out.unclassified++;
 
+    // A ROW THAT NAMES ITS RECORDS IS COUNTED BY RECORD, whatever tool it rode. A register that hydrates
+    // records in batches (Clarivate's /text) logs one row for up to 100 records, under whichever tool asked
+    // — a screen, a plan execution, a listing — so the `record_fetch`-and-one-URI test below never saw
+    // them, and the count read 0 on every such run whatever was fetched twice. Records served from the
+    // run's own store ride a cache-hit row and count as reused, never as fetched.
+    if (Array.isArray(row.records)) {
+      if (isCacheHit) { out.records_reused += row.records.length; continue; }
+      const sess = rowSession(row);
+      for (const id of row.records) {
+        const target = String(id ?? "").toLowerCase();
+        if (!target) continue;
+        if (firstFetchSession.has(target)) {
+          out.duplicate_fetches++;
+          if (firstFetchSession.get(target) === sess) out.duplicate_fetches_same_session++;
+          else out.duplicate_fetches_cross_session++;
+        } else {
+          firstFetchSession.set(target, sess);
+        }
+      }
+      continue;
+    }
+
     // Duplicate detail-fetches = the Workstream-B opportunity. Count only REAL network fetches (a cache
     // hit is already a saved duplicate, not a new one). First network fetch of a URI seeds the map; any
     // later network fetch of the same URI is a duplicate, attributed same- vs cross-session.

package/driver/publish/index.mjs

@@ -9,12 +9,12 @@
 // (not via runStage). Run identity (runId/codename) comes from the driver's ctx.run; do NOT regenerate it.
 import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, copyFileSync, chmodSync } from 'node:fs';
 import { join, dirname } from 'node:path';
-import { driverDir } from '../../shared/driver-dir.mjs';   //
+import { driverDir, RUN_DIR_MODE } from '../../shared/driver-dir.mjs';   //
 import { parseReport, parseAudit, parseSections, parseBlocks, stripInternal, parseCaseLawProfiles, parseCaseLawPreamble, joinCaseLawProfiles } from './parse.mjs';
 import { renderHtml, parseActionBuckets, actYouConditions } from './render.mjs';
 import { buildAudit } from './xlsx.mjs';
 import { parseFindingsJson, parseFindingsJsonLenient, deriveDisplayVerdict, joinFindingToBlock, CLIENT_TIER_BY_COMPOSITE, projectCoverageJudgment } from '../findings-model.mjs';
-import { readStore, requiredAbsent, nonClosingAbsences } from './publish-inputs.mjs'; import { coverageFormStamp, readCoverageForm } from '../coverage-form-io.mjs'; import { coverageUnitLabel } from '../coverage-ledger.mjs';   // — and why an absence did not close
+import { readStore, requiredAbsent, nonClosingAbsences } from './publish-inputs.mjs'; import { coverageFormStamp, readCoverageForm } from '../coverage-form-io.mjs'; import { coverageUnitLabel } from '../coverage-ledger.mjs'; import { recallReceiptForOwnCompany } from '../known-conflicts.mjs';   // — and why an absence did not close; whose recall checks an audit lists
 import { clearanceReportData } from './report-data.mjs';
 import { searchDepthRecord, planTerritoriesOf } from './search-depth.mjs'; import { bandRecords } from '../named-band.mjs';   // how much was read to reach the answer, as counts and tokens
 import { parseFrameworkManifest } from '../framework.mjs';
@@ -667,7 +667,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   })();
   const asOf = new Date().toISOString();   // C2 — publish-time clock for the priority-window flag (render stays pure)
   const poolRunDir = join(poolRoot, runId);
-  mkdirSync(poolRunDir, { recursive: true });
+  mkdirSync(poolRunDir, { recursive: true, mode: RUN_DIR_MODE });   // owner and group only; mkdir keeps the pool root's set-GID
   // The run dir inherits the web-server group + the set-GID bit AUTOMATICALLY from the set-GID pool root
   // (mode 2750, web-server group) — so files written inside take that group and the web server (Caddy in
   // the reference deployment, mode 0640) can read them. Do NOT chmod this dir: the service account is not
@@ -852,7 +852,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   // which publishes without one: the throw left publishReport at `published → null` and the runner
   // exited 1. Reading from the report's own directory is also the right answer for a republish.
   const recallStore = readStore(runDir ?? dirname(reportMd), '_driver/register-recall.json');
-  const undispatchedProbes = (recallStore.value?.overflow ?? [])
+  const undispatchedProbes = (recallReceiptForOwnCompany(recallStore.value)?.overflow ?? [])   // never another company's remembered conflict
     .filter((o) => o && (o.term || o.qid))
     .map((o) => ({
       area: String(o.term ?? o.qid),
@@ -1071,12 +1071,23 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   // the copy. The register-only LEVEL is retired, so no new run reaches this true; a run that already
   // did still must, or its workbook would claim a sweep that never ran.
   const registerOnly = isRegisterOnly(searchPolicy);
+  // A RUN WHOSE COMPANY PICKED NO MARKETPLACES (the owner's ruling of 2026-09-23). Marketplaces were still
+  // covered by the general web search, and by any stores the engine chose for the matter, so the lines that
+  // describe the common-law layer say that instead of naming a marketplace search nobody picked. Read from
+  // the frozen profile, which is the list the run actually searched; absent (a legacy run) reads as picked.
+  let noMarketplacesPicked = false;
+  try {
+    const frozenProfile = runDir ? JSON.parse(readFileSync(driverDir(runDir, 'profile.json'), 'utf8')) : null;
+    noMarketplacesPicked = Array.isArray(frozenProfile?.platforms) && frozenProfile.platforms.length === 0;
+  } catch { /* no frozen profile — a legacy run keeps its wording */ }
 
   // Jurisdiction line for the Summary — searched register scope + the common-law surface layer.
   const regScope = (searchedJurisdictions && searchedJurisdictions.length) ? searchedJurisdictions.join('/') : 'Worldwide';
   const jurisdiction = registerOnly
     ? `${regScope} (register only — no common-law / marketplace search)`
-    : `${regScope} (register) + common-law (Western web / marketplace / social)`;
+    : noMarketplacesPicked
+      ? `${regScope} (register) + common-law (Western web / social, plus any stores chosen for this matter)`
+      : `${regScope} (register) + common-law (Western web / marketplace / social)`;
 
   // Common-law URL-join: a grid hit whose candidate URL resolves to a finding's own link PROVES that search
   // term became a finding (rescues an anchor term whose finding wears a different name). Best-effort; absent
@@ -1224,6 +1235,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
       caseLawText: rdText(join(dirname(reportMd), 'case-law-findings.md')),
       registerPlan: rdJson(driverDir(runBase, 'register-plan.json')),
       laneDepthVerdicts,
+      noMarketplacesPicked,
     });
     writeRO('search-depth.json', JSON.stringify(searchDepth, null, 2));
   } catch { /* the depth record is additive — a publish never fails for want of it */ }