clearotron 0.4.0-beta.0 → 0.4.0-beta.2

package/docs/architecture/05-config-governance.md

@@ -164,7 +164,7 @@ structural, or dev seam); [dev] = dev/test seam, never set in prod.
 `CLEAROTRON_OPENAI_MODEL_CHEAP` (all gpt-5.6-sol),
 `CLEAROTRON_CLAUDE_PATH` (claude on PATH, then the copy Clearotron installed),
 `CLEAROTRON_SYNTHESIS_MODEL` (opus), `CLEAROTRON_KNOCKOUT_MODEL` (opus),
-`CLEAROTRON_KNOCKOUT_PRESET` (pro-search), `CLEAROTRON_MAX_BUDGET_USD` (unset).
+`CLEAROTRON_MAX_BUDGET_USD` (unset).
 
 The Claude program's own cloud settings — `CLAUDE_CODE_USE_FOUNDRY`, `CLAUDE_CODE_USE_VERTEX` and
 `CLAUDE_CODE_USE_BEDROCK`, each cloud's own settings, the gateway pair and the model pins — are the
@@ -206,7 +206,7 @@ move once the same window has been read across more runs.
 `CLEAROTRON_PLAN_DISPATCH`, `CLEAROTRON_SATPROBE_CODESIDE`,
 `CLEAROTRON_BAND_TRUTH_GATE` (**never disable in prod — restores the fabrication**),
 `CLEAROTRON_FRAME_REOPEN` (+`CLEAROTRON_FRAME_REOPEN_MAX`=1, `CLEAROTRON_REOPEN_MAX_FETCH`=150),
-`CLEAROTRON_REGISTER_GAP_CLAMP`, `CLEAROTRON_RECALL_PROBES`, `CLEAROTRON_RECALL_TRIPWIRE`, `CLEAROTRON_WARM_RETRY`,
+`CLEAROTRON_REGISTER_GAP_CLAMP`, `CLEAROTRON_WARM_RETRY`,
 `CLEAROTRON_MODEL_WIRE_CHECK` (fails a turn whose
 provider reports a different model FAMILY than the driver asked for; disarming it silences the refusal
 and never the record: `modelActual`/`modelMismatch` keep landing on every dispatch row), `CLEAROTRON_FORM_REPAIR`
@@ -277,8 +277,8 @@ edited — that box runs pre-rebuild code and genuinely still sets it.
 
 ### 5.7 Delivery & comms — T3/T4
 
-`CLEAROTRON_DEFAULT_AGENT` (clawdi), `CLEAROTRON_SEND_TOOL_PREFIX`
-(clawdi_send_), `CLEAROTRON_AGENT_WHATSAPP`, `CLEAROTRON_OUTBOX_BACKOFF_BASE_SEC` (60) / `CLEAROTRON_OUTBOX_BACKOFF_CAP_SEC` (900) /
+`CLEAROTRON_DEFAULT_AGENT` (localagent),
+`CLEAROTRON_AGENT_WHATSAPP`, `CLEAROTRON_OUTBOX_BACKOFF_BASE_SEC` (60) / `CLEAROTRON_OUTBOX_BACKOFF_CAP_SEC` (900) /
 `CLEAROTRON_OUTBOX_BACKOFF_MAX_RETRIES` (5) / `CLEAROTRON_OUTBOX_GIVEUP_COOLDOWN_SEC` (3600 — note this one
 drops BACKOFF from the prefix, which the elided spelling this row used to carry actively misled about),
 `CLEAROTRON_OUTBOX_NOPROGRESS_MAX`, `TRADEMARK_MSGID_DOMAIN` (enqueue.local).
@@ -456,9 +456,7 @@ Dev cockpit: `PORTAL_PORT`, `PORTAL_HOST`.
 
 Diagnostics and fixtures: `CLEAROTRON_DUMP_JSON`,
 `CLEAROTRON_REPLAY_SNAPSHOT`, `CLEAROTRON_REPLAY_ROOTS`, `CLEAROTRON_JX_FIXTURES`,
-`CLEAROTRON_KNOCKOUT_SWEEP_FIXTURES`, `SIGNA_FIXTURES_DIR` (and its accepted alias
-`CLAWDI_SIGNA_FIXTURES_DIR` — `providers/signa/src/core.js` reads the plain name first and falls back
-to the prefixed one, so an operator who sets only the alias must be able to find it here),
+`CLEAROTRON_KNOCKOUT_SWEEP_FIXTURES`, `SIGNA_FIXTURES_DIR`,
 `PORT` (smoke test), and the `MOCK_*` fixture vars. Those are part of
 the harness-only set `scripts/env-audit.mjs` counts separately and this register deliberately omits.
 

package/docs/architecture/06-operations-runbook.md

@@ -110,18 +110,6 @@ and the environment file holding the secrets.
 - **A scheduled gateway restart** (chat-channel session and plugin-loader hygiene) should *defer*
   off live work rather than skip: wait while a run is live, up to a bound, then restart anyway.
   `XDG_RUNTIME_DIR` must be set for `systemctl --user` to work from cron.
-- **Pin the agent id before upgrading an install made before 0.2.2.** The default agent id changed
-  from `clawdi` to `localagent`, and that id is a path segment: runs live under
-  `<workspaceRoot>/workspace-<agent>/studio/clearance-search/`. An install that never set one starts
-  reading an empty workspace, and empty reads as "no runs" rather than as an error. Set **both**
-  variables in the environment file — the gather servers read their own:
-
-  ```
-  CLEAROTRON_DEFAULT_AGENT=clawdi
-  CLEAROTRON_GATHER_AGENT=clawdi
-  ```
-
-  An install that already sets them is unaffected, and a fresh install needs neither.
 - **Integrator-platform upgrades** go through that platform's own guarded upgrade path — dry-run,
   exact-version confirm, stop → update → start. Never `npm i -g` / `pnpm add -g` directly.
 

package/docs/architecture/07-quality-and-audit.md

@@ -92,9 +92,15 @@ under-grading ships a wrong CLEAR. The reviewer's context includes code-computed
 and a mandatory plan-execution check. CONDITIONAL/BLOCKING triggers corrective re-synthesis, a
 freshness gate proving the named corrections actually reached `findings.json`, and a warm verdict
 re-check that can only fall back to the *entry* verdict. A terminal BLOCKING first gets the
-degenerate-artifact refusal (a "BLOCKING" with zero cited defects is re-asked fresh, once), then
-fails the run — a report the reviewer won't stand behind never ships looking finished
-("delivered with open questions" is retired). The reviewer's verdict is treated as documented-noisy;
+degenerate-artifact refusal (a "BLOCKING" with zero cited defects is re-asked fresh, once), and
+then the run **delivers**. Ruling 2026-08-26, verbatim: "Deliver always, with open points printed.
+The refusal on a blocking review goes." The corrective ladder is still the fix arm and still runs
+first; what changed is only what happens once it is exhausted. "Never ships" and "never ships
+*looking finished*" were treated as one requirement and are two — only the second was ever
+load-bearing, and it is met by the open-points section being code-built from the review. Ruling
+2026-09-24 settled where that section goes: reviewer notes never reach the client page, and a
+report the reviewer still refuses ships with its rating and nothing added, the points recorded
+beside the review for the reviewing lawyer. The reviewer's verdict is treated as documented-noisy;
 that is precisely why every *honesty* signal below derives from ledgers and receipts, not review
 prose.
 
@@ -138,16 +144,10 @@ What makes the coverage statement trustworthy:
 - **The clamps** (`applyCoverageFloor`) only ever raise CLEAR → CONDITIONAL, never lower, never
   manufacture BLOCKING: live condition actions, the lawyer's own `coverage_judgment.sufficient:
   false` (sufficiency is judgment's call — code only carries it), frame residuals, register gaps
-  (deferred rows ∪ taint axes ∪ material recall regressions — independent of the model's
-  self-report), and in-window deadlines delivered without their dates. The verdict sidecar
+  (deferred rows ∪ taint axes — independent of the model's self-report). The verdict sidecar
   (`_driver/verdict.json`) is then the single label authority for every surface; one shared
   predicate keeps the validator and the auto-correct judging "unconditional proceed" with the same
   eyes.
-- **Recall memory**: confirmed conflicts persist per mark in a workspace store
-  (`_known-conflicts/`, rows are only added — never deleted or rewritten, save the machine-provenance
-  `terminal` a delivered run may upgrade — human edits always win, non-Latin marks handled); the next run
-  folds them in as deterministic plan probes, and a prior-confirmed conflict that neither resurfaces
-  nor gets a recorded justification is a *material regression* that clamps.
 
 Register budgets deserve one honest sentence: the per-worker call budgets in the skill prose
 (enumerates, phoneme ≤ 5, image ≤ 10) are **observed, prompt-level budgets, not code-enforced
@@ -194,9 +194,8 @@ pass over inherited artifacts is visible as such.
 `reasoning-tripwires.mjs` is the mechanical net under principles held holistically in the skills:
 recall floor (a live identical registration dropped in the noise rows but not carried), seed
 neutrality (upstream artifacts must state facts, never grades), probative grading, matrix ceilings
-(legacy scale only), status honesty (clean headline over material gaps), deadline urgency and
-deadline carry, unresolved disagreements, orphan register findings, uncross-checked demotions,
-recall regression. All of it lands in `_driver/reasoning-integrity.json` and surfaces on the audit
+(legacy scale only), status honesty (clean headline over material gaps), deadline urgency,
+unresolved disagreements, orphan register findings, uncross-checked demotions. All of it lands in `_driver/reasoning-integrity.json` and surfaces on the audit
 workbook and quality pages — never as a banner on the rendered report.
 Two of these pure functions *also* feed the verdict clamps (register gap, deadline gap) — but via
 the clamp path on ledger facts, never as a tripwire "failure". `rule-shape.mjs` (rating decided by

package/docs/architecture/09-security-and-data.md

@@ -3,10 +3,15 @@
 > Part of the architecture pack (`docs/architecture/`). The driver's module tree and the headless
 > integrator contract are in [`driver/README.md`](../../driver/README.md).
 
-The security posture in one sentence: **nothing listens on the network except loopback services
-behind an authenticated tunnel; agents that touch the outside world cannot execute anything; the
-process that executes everything is not an agent; and secrets reach exactly the processes that need
-them, by inheritance, never by file-copy into configs.**
+The security posture in brief: **nothing listens on the network except loopback services behind an
+authenticated tunnel. A stage on Claude is offered no tool that runs a command. A stage on Codex runs its
+commands inside Codex's own sandbox, or with the permissions of the account Clearotron runs as where a
+machine sets the bypass. The process that runs everything else is ordinary code, not an agent. Each
+stage's AI program starts with a named list of settings, and the key that signs access keys is handed
+only to the portal and the two doors. On Claude, a stage's file tools can read nothing outside its run folder, its
+instruction folders and any folder the machine's own Claude settings add. On Codex with its sandbox on,
+a stage's commands can read nothing outside its run folder, its instruction folders, the temporary
+folders, and the system and program files a command needs to run.**
 
 ## Trust boundaries
 

package/driver/CHANGELOG.md

@@ -1,5 +1,75 @@
 # clearotron-driver
 
+## 0.4.0-beta.2
+
+### Minor Changes
+
+- New: A knockout search now also asks whether each name is already in use in the client's field, such as a game character or a drink.
+- New: Searching by judgment.
+  
+  This release changes how a clearance decides what to search. Until now the engine followed fixed rules: a set number of spellings, a fixed list of stores, a stop after the first identical mark. Fixed rules are fast and cheap, but they miss things. On a recent matter, a lawyer's review found marks the engine had counted but never read, and others it had raised that did not matter.
+  
+  So the approach changes. Wherever the engine holds a pile of results, it now looks at what is there and decides what a lawyer would raise. It carries that forward and writes down what it set aside, and why. Nothing is dropped silently. Every wider search, every spelling set aside and every store left out appears in the audit workbook with its reason.
+  
+  What you will notice:
+  - Searches widen where it could change the advice, and narrow where it cannot.
+  - Near spellings no buyer would confuse with the mark are set aside, with the reason recorded.
+  - Searches in other scripts run only in markets that file marks in that script.
+  - A large company's register is read for the marks that share the searched name. The rest is counted, not fetched.
+  - Marketplace searches cover the stores that sell the client's goods, and say which stores were left out and why.
+  - The report no longer opens with the internal reviewer's notes. They reach the reviewing lawyer separately.
+  - A large marketplace search no longer fails because its results were too big to return in one piece.
+  - Where a company's framework rates through named inputs, the report shows them beside each band.
+  
+  A word on regressions. While testing this line we found two. A crowded search failed before delivering its report, and a knockout's ratings moved one step away from the lawyer's. Both were caught by running the same matters against a lawyer's answers, and both are fixed here. Every build is now tested that way before it ships. We are tuning for three things at once: a report that is right the first time, delivered fast, at a sensible cost. They pull against each other, and each release is our best current balance.
+
+### Patch Changes
+
+- For operators: on the Anthropic engine, a search can no longer read the install's settings or other private files.
+- For operators: stages on the Anthropic engine can no longer run commands on the server; every tool that runs a command is removed from them.
+- Fixed: In a crowded field, the search now reads the spellings a lawyer would raise, rather than the ones that fit under a record limit.
+- Fixed: When a knockout's search for filings fails, the report and the audit workbook no longer show the raw error.
+- Fixed: On Windows, a failed finding card no longer shows as covered in the audit workbook.
+- Fixed: When a search could not be made, the report says so instead of giving a wrong reason.
+- Fixed: A register search limited to the client's goods now searches every other office when one office cannot filter by goods.
+- Fixed: a right the report keeps is no longer dropped because other registrations of the same right were ruled out.
+- Fixed: A knockout search no longer drops a store listing or fan wiki page its web search found; the rating now reads every result.
+- Fixed: A knockout's audit workbook also lists a part that failed as a whole, such as its filings listing or plain-language review. A filing shown without its link now says why.
+- Fixed: on a Mac, `clearotron start` no longer offers to run in the background, which only works on Linux.
+- Fixed: on a Mac, a search step could write into Clearotron's own protected folders by naming them in a different letter case. Those writes are now refused.
+- Fixed: A register search that times out across many countries is asked again in smaller parts; one that still times out is reported as incomplete.
+- Fixed: on the OpenAI engine, Codex's own sandbox no longer refuses the register searches a clearance runs.
+- For operators: on the OpenAI engine with Codex's sandbox on, the commands a search runs can no longer read the install's settings or other private files.
+- Fixed: the audit workbook's What was searched tab no longer shows a web or marketplace search that found similar listings as clean.
+- Fixed: Worldwide searches are no longer narrowed to an account's default territories, and results too crowded to read in full are no longer reported clean.
+- Fixed: A report no longer offers a native-language investigation to a client who ordered one, and says when that investigation was not completed.
+- Fixed: When a knockout's lookup of a filing owner fails, its read now says the lookup did not answer, instead of saying it found nothing.
+- New: Clearotron runs natively on Windows, from PowerShell: no WSL2, no Git and no administrator rights.
+- Fixed: a full country search's report no longer says court decisions were searched when that search failed or its source was down.
+- New: Global preliminary, multi-country and full country searches now search the web in more depth and keep more results from each search.
+- Fixed: opening a report no longer contacts any font service; the report carries its typeface, now Plus Jakarta Sans, inside itself.
+- Fixed: searches no longer reuse earlier results.
+- Fixed: skipped searches are no longer shown as unfinished in the report.
+- For operators: each stage's AI program now receives only the settings it needs, and never the key that signs access keys.
+- Fixed: The audit workbook now lists, on Coverage & gaps, any part of a report that could not be completed on the run. A knockout's Audit Trail also lists an owner lookup that got no answer.
+- Fixed: on the OpenAI engine, a Full country search now reads case law from CourtListener and Legal Data Hunter, not EUR-Lex alone.
+- Fixed: setup, `clearotron doctor` and the start of every search now check that the engine can write a file where a search writes its results.
+- New: The meaning and reputation search now asks the questions the matter's framing names, in the languages whose markets matter. Where the framing names none, the report says no meaning search ran.
+- For operators: the old default agent name is gone from the product. An install upgrading from a version before 0.2.2 must set its own agent name to keep seeing its earlier runs.
+- Fixed: The operator tool no longer accepts instructions, which never reached the run; a call sending them is refused.
+- Fixed: on the OpenAI engine, the tool that reads web pages now refuses addresses on the server's own network, such as cloud metadata addresses.
+- For operators: the background worker no longer receives the key that signs access keys. Run `clearotron start --background` once to update an installed worker.
+
+## 0.4.0-beta.1
+
+### Patch Changes
+
+- Fixed: Clarivate clearances no longer count look-alike spellings that mix Latin with Greek or Cyrillic letters as searches that could not be completed.
+- For operators: Clarivate clearances no longer fetch a record, or repeat a count, search or owner lookup, that the same run already made.
+- For operators: Knockouts on Signa and Clarivate take their name and close-variation counts from the listing, so each is asked of the register once.
+- Fixed: Knockouts on the Signa register now say how many register hits the listed filings were drawn from.
+- Fixed: Clearances on the Signa register no longer search look-alike spellings that mix Latin with Greek or Cyrillic letters; those searches found only unrelated marks.
+
 ## 0.4.0-beta.0
 
 ### Minor Changes

package/driver/ask-ledger.mjs

@@ -179,7 +179,7 @@ function recallEnding(name, qid, join, ts) {
   if (discharges) return { ending, handoff: null };
   return {
     ending: null,
-    handoff: `the probe ran and ${why} — a recall probe discharges on what came back, not on having run (#1349). `
+    handoff: `the probe ran and ${why} — a recall probe discharges on what came back, not on having run. `
       + `Ships OPEN in the audit's ask ledger for the reviewing lawyer.`,
   };
 }
@@ -428,6 +428,8 @@ export function deriveAsks({
   }
 
   // 9 ── cross-checks: the common-law→register recovery nets (xcheck + recall) — directives carry
+  // (the recall receipt exists only on runs from before the recall store's removal, 2026-09-24;
+  // on a newer run `recall` is null and this family lists the cross-checks alone)
   // qids (computed executed); over-cap rows are real unanswered questions (OPEN → closure/lawyer).
   for (const [name, doc] of [["xcheck", xcheck], ["recall", recall]]) {
     for (const d of doc?.directives ?? []) {
@@ -601,7 +603,7 @@ const normMark = (s) => String(s ?? "").toLowerCase().replace(/[^a-z0-9]/g, "");
  * as immaterial only when the mark it went looking for is in the client's findings. Otherwise the mark
  * is owed a finding and the ask stays open.
  *
- * The defect this answers: a recall probe found OSLER DELPHI, the closure stage pointed at
+ * The defect this answers: a recall probe found HALVER KORPHI, the closure stage pointed at
  * `register-findings.md` — the run's own working sheet, where the mark genuinely IS reasoned — and the
  * ask closed. The sheet is a citable file and the citation was true. It is simply not the document the
  * client reads, and nothing checked that.

package/driver/authority-trees.mjs

@@ -44,17 +44,97 @@
 // set-GID scar on the pool root). The existing detect-and-journal sweep STAYS as corroboration; its
 // never-kill-a-run property is sound and survives.
 
-import { resolve, sep } from "node:path";
+import { realpathSync, statSync } from "node:fs";
+import { resolve, win32, posix } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
 
-/** Is `child` inside `root` — by path segment, never by string prefix? PURE. */
-export function isInside(root, child) {
-  const r = resolve(String(root ?? ""));
-  const c = resolve(String(child ?? ""));
+/**
+ * Is `child` inside `root` — by path segment, never by string prefix? PURE.
+ *
+ * ON WINDOWS BY WINDOWS RULES. There a path may use either separator and a name matches in any case, so
+ * `c:/users/x/SKILLS/a.md` is a file inside `C:\Users\x\skills`. Compared as Linux compares, the
+ * write lands in the protected tree and the boundary lets it through. `platform` is a parameter so that
+ * branch runs on a Linux CI. `foldCase` says whether to ignore letter case: always on Windows, and
+ * elsewhere as foldsCaseAt finds the protected folder's disk, which denyReason asks for each tree.
+ */
+export function isInside(root, child, { platform = process.platform, foldCase = platform === "win32" } = {}) {
+  const P = platform === "win32" ? win32 : posix;
+  const fold = foldCase ? (s) => s.toLowerCase() : (s) => s;
+  const r = fold(P.resolve(String(root ?? "")));
+  const c = fold(P.resolve(String(child ?? "")));
   if (!r || r === "." || !c) return false;
   // `/a/skills-backup` is NOT inside `/a/skills`. A `startsWith` without the separator says it is, and
   // that is the classic form of this check being wrong in the direction that blocks real work.
-  return c === r || c.startsWith(r.endsWith(sep) ? r : r + sep);
+  return c === r || c.startsWith(r.endsWith(P.sep) ? r : r + P.sep);
+}
+
+/**
+ * The one spelling of a Windows path: no device prefix, and the long names Windows itself reports.
+ *
+ * WINDOWS REACHES ONE FILE BY SEVERAL NAMES, and the boundary compared the one it was handed. Measured on
+ * a Windows runner, 2026-09-23: a write spelled `\\?\C:\…\skills\x.md`, and a write spelled with the
+ * long name of a folder the policy had recorded by its 8.3 short name (`RUNNER~1` against
+ * `runneradmin`), both reached the protected folder and were allowed. The device prefix (`\\?\`,
+ * `\\.\`) is taken off, and the longest part of the path that exists is asked of Windows itself, which
+ * answers with the long names and follows a junction, so a junction pointing into a protected folder is
+ * inside it too. The part that does not exist yet is joined back as written. `realpath` is injected so
+ * this runs on Linux.
+ */
+export function canonicalWindowsPath(p, { realpath = realpathSync.native } = {}) {
+  const bare = String(p ?? "").replace(/^[\\/]{2}[?.][\\/]UNC[\\/]/i, "\\\\").replace(/^[\\/]{2}[?.][\\/]/, "");
+  const abs = win32.resolve(bare);
+  const rest = [];
+  for (let cur = abs; ;) {
+    try { return win32.join(realpath(cur), ...rest); }
+    catch {
+      const parent = win32.dirname(cur);
+      if (parent === cur) return abs;
+      rest.unshift(win32.basename(cur));
+      cur = parent;
+    }
+  }
+}
+
+const swapCase = (s) => [...s].map((ch) => (ch === ch.toLowerCase() ? ch.toUpperCase() : ch.toLowerCase())).join("");
+const foldMemo = new Map();
+
+/**
+ * Does the disk holding `root` ignore letter case? Asked of THAT folder, never of the platform.
+ *
+ * A Mac's default volume ignores case, so `P/SKILLS/x.md` is a file inside `P/skills`, and a boundary
+ * comparing letter for letter let the write through: measured on the macOS runner, 2026-09-23. But a Mac
+ * volume can be formatted to mind case, and a Linux folder can be set to ignore it, so the platform does
+ * not answer. The folder is stat'ed under its own name and under that name with every letter's case
+ * swapped: the same file under both means this disk ignores case. It writes nothing, so it adds nothing to
+ * a protected tree.
+ *
+ * WINDOWS ALWAYS FOLDS, as it did before this was asked, because NTFS ignores case unless a folder is set
+ * otherwise. Where the question cannot be put (the folder does not exist yet, or its name has no letters)
+ * the answer is the platform's default disk, Windows and macOS folding, so a Mac errs toward refusing. The
+ * answer is kept per folder for the life of the process. `stat` is injected so every branch runs on Linux.
+ */
+export function foldsCaseAt(root, { platform = process.platform, stat = statSync } = {}) {
+  if (platform === "win32") return true;
+  const abs = posix.resolve(String(root ?? ""));
+  const key = `${platform}|${abs}`;
+  if (foldMemo.has(key) && stat === statSync) return foldMemo.get(key);
+  const byDefault = platform === "darwin";
+  const name = posix.basename(abs);
+  let answer = byDefault;
+  const other = swapCase(name);
+  if (name && other !== name) {
+    try {
+      const own = stat(abs);
+      try {
+        const swapped = stat(posix.join(posix.dirname(abs), other));
+        answer = own.dev === swapped.dev && own.ino === swapped.ino;
+      } catch (e) {
+        answer = e?.code === "ENOENT" || e?.code === "ENOTDIR" ? false : byDefault;
+      }
+    } catch { answer = byDefault; }
+  }
+  if (stat === statSync) foldMemo.set(key, answer);
+  return answer;
 }
 
 /**
@@ -87,11 +167,13 @@ export function authorityTrees({ skillsRoots = [], profilesDir = null, runDir =
  * why it is refused, that a retry gets the same answer, and where stage output lives. No second person, no
  * imperative. The seat decides what to do with a fact, which is the whole difference.
  */
-export function denyReason(targetPath, trees) {
+export function denyReason(targetPath, trees, { platform = process.platform, foldsCase = (root) => foldsCaseAt(root, { platform }),
+  canonical = platform === "win32" ? (p) => canonicalWindowsPath(p) : (p) => p } = {}) {
   const t = String(targetPath ?? "").trim();
   if (!t) return null;
+  const target = canonical(t);
   for (const tree of trees ?? []) {
-    if (!isInside(tree.path, t)) continue;
+    if (!isInside(canonical(tree.path), target, { platform, foldCase: foldsCase(tree.path) })) continue;
     return `REFUSED by the driver's write boundary: ${t} is inside ${tree.why} (${tree.path}). `
       + `That tree is authored at deploy time and never by a running stage, so the refusal is configuration `
       + `rather than a permission prompt, and a retry of the same path returns this same answer. Stage `

package/driver/band-shape.mjs

@@ -65,7 +65,7 @@ const tokensOf = (s) => String(s ?? "").split(/[^\p{L}\p{N}]+/u).map((t) => norm
 
 /**
  * The ALTERNATIVE NAMES a label carries — `VENZAL / VENZALMONO / VENZALKOMB` is one relabelled entry,
- * `CHROMA & Device` is one mark plus a device note.
+ * `LUMIVANE & Device` is one mark plus a device note.
  *
  * The separator class is reference-score's `labelAliases`, character for character, and the two are
  * meant to stay that way: the scorer and the engine must agree about what a relabelling is, or a record
@@ -130,7 +130,7 @@ export function classifyRecord(markText, targets) {
   if (!norm) {
     // ── — A MARK WITH NO LATIN SKELETON CAN STILL BE IDENTICAL, AND IT WAS (2026-08-14) ──────────
     //
-    // R1 retrieved TEN exact-match 色度 registrations — four REGISTERED, three in class 9, all in the
+    // R1 retrieved TEN exact-match 澜珀 registrations — four REGISTERED, three in class 9, all in the
     // matter's own classes — and the delivered report did not mention the token once. This line is
     // where they went. `normalizeElement` keeps only Latin characters, so a Han mark normalises to the
     // empty string, fell straight to `unclassifiable`, and `unclassifiable` is not one of the two tiers
@@ -139,7 +139,7 @@ export function classifyRecord(markText, targets) {
     // weighed. Retrieved, banded, positioned, and never an obligation.
     //
     // The classifier could not COMPARE them; that is true, and it is not the same as could not MATCH
-    // them. 色度 equals 色度 by inspection. The precedent is in this repo already: reference-score's
+    // them. 澜珀 equals 澜珀 by inspection. The precedent is in this repo already: reference-score's
     // matchesReference makes RAW comparison its rule 1 for exactly this case, because normalizeElement
     // keeps only [a-z0-9] and a CJK mark folds to the empty string that every Latin rule would match
     // against everything. The scorer has had that rule since R1's Chinese registration was specced. The
@@ -147,13 +147,13 @@ export function classifyRecord(markText, targets) {
     //
     // EQUALITY ONLY, DELIBERATELY. The floors are mechanical obligations a lawyer must answer row by
     // row, so every member has to be defensible without judgment: raw-equal after NFKC (which folds
-    // full-width and compatibility forms of the same characters) is that. Containment is not — 色度計
-    // contains 色度 and is a different mark — and whether it matters is judgment's call, reached
+    // full-width and compatibility forms of the same characters) is that. Containment is not — 澜珀計
+    // contains 澜珀 and is a different mark — and whether it matters is judgment's call, reached
     // through the same-family tiers and the crowd descriptors, not by widening a floor.
     //
     // THIS PARAGRAPH USED TO SAY "narrower than the scorer's rule", and it was right when it was
     // written: matchesReference's script rule was unowned containment in both directions until,
-    // which scored gold 色度 as retrieved off a different proprietor's 色度花间. The scorer now takes
+    // which scored gold 澜珀 as retrieved off a different proprietor's longer mark that contains it. The scorer now takes
     // equality too, with one owner-gated containment escape the floors deliberately do not have. The
     // two agree; neither is the looser one any more.
     const raw = text.normalize("NFKC").trim();
@@ -175,7 +175,7 @@ export function classifyRecord(markText, targets) {
 
   // ── member 2 — A RELABELLED RECORD IS THE SAME MARK, AND IT WAS TIERING BELOW THE FLOOR ────────
   //
-  // Measured against the scorer on `origin/main`: `VENZAL / VENZALMONO / VENZALKOMB` and `CHROMA &
+  // Measured against the scorer on `origin/main`: `VENZAL / VENZALMONO / VENZALKOMB` and `LUMIVANE &
   // Device` are `alias` to reference-score and `same-family / token-identical` here. Not dropped —
   // tiered BELOW the line. The floors take `identical` and `near-identical` only, so a register record
   // that IS the mark under a relabelling never became a row a lawyer had to answer. Same consequence as
@@ -184,7 +184,7 @@ export function classifyRecord(markText, targets) {
   // ALIAS SEPARATORS ONLY, and the distinction is reference-score's, kept deliberately identical
   // because the two must agree about what a relabelling IS: `/ , · & |` separate ALTERNATIVE NAMES for
   // one record; whitespace and hyphens separate WORDS WITHIN one name. Conflating them makes every
-  // multi-word mark match its own first word — `TIKI TWIST` would become `TIKI`, which is a different
+  // multi-word mark match its own first word — `WAVO TWIST` would become `WAVO`, which is a different
   // proprietor's different mark and the collision the scorer's own doc block warns about. Whitespace is
   // NOT in the class here for exactly that reason.
   //
@@ -213,7 +213,7 @@ export function classifyRecord(markText, targets) {
 // The candidate set of the retrieved→judgment reconciliation: every LIVE, in-scope, SCREEN-SURFACED
 // record whose mark carries the manifest's dominant element — as a standalone token
 // (`token-identical`), a token one edit away (`token-edit-1`), or CONCATENATED inside a longer
-// squashed word (`concatenation` — the TIKITONK class: same-family in substance, "other" to the
+// squashed word (`concatenation` — the WAVOTONK class: same-family in substance, "other" to the
 // token classifier, and the proven silent-death seam). Screen-surfaced only (screen_verdict
 // surface:*): the obligation this feeds is "everything the screen surfaced ends somewhere a reader
 // can see"; drop:* records were already ended by the screen with a policed drop row.
@@ -227,7 +227,7 @@ export function classifyRecord(markText, targets) {
 // itself never spells. They rank last so they never reached the top slice, but they inflate the
 // residual a declared crowd count must cover — a count written one short blocks the run (the
 // reviewer reproduced 378 declared vs 379 residual → blocked). A concatenation is a SQUASHED WORD
-// (TIKITONK), which is a property of one token.
+// (WAVOTONK), which is a property of one token.
 export const MIN_CONCAT_LEN = 4;
 
 /**
@@ -323,8 +323,8 @@ export function dominantElementComposites(band, { dominantElement, inScopeClasse
 //       identity, and the arithmetic becomes a cross-reference instead.
 //   (2) owner identity is compared on a CORE + LEGAL-FORM pair, not on the suffix-stripped core
 //       alone. Stripping entity words is what makes "Fairmile Snack Foods Corp." = "Fairmile Snack Foods
-//       Corporation" work, but on the same band it also collapsed "Tiki Group Limited", "Tiki AG"
-//       and "Tiki Corporation" to the bare core "tiki" and merged three distinct registrants on the
+//       Corporation" work, but on the same band it also collapsed "Wavo Group Limited", "Wavo AG"
+//       and "Wavo Corporation" to the bare core "wavo" and merged three distinct registrants on the
 //       mark-owner edge alone. So: same core AND compatible legal forms (one side's form set a
 //       SUBSET of the other's — a register that simply omits the form still matches, two different
 //       stated forms never do).
@@ -359,7 +359,7 @@ export function ownerIdentical(a, b) {
 }
 
 /** The union-find bucket key for the mark+owner edge — core + the SORTED form set, so
- *  "Tiki AG" and "Tiki Corporation" land in different buckets while "X Corp."/"X Corporation" share
+ *  "Wavo AG" and "Wavo Corporation" land in different buckets while "X Corp."/"X Corporation" share
  *  one. The subset relaxation (a register omitting the form) is applied by the second pass below. */
 const ownerKey = (s) => { const { core, forms } = ownerIdentity(s); return core ? `${core}|${[...forms].sort().join("+")}` : ""; };
 const normOwner = (s) => ownerIdentity(s).core;

package/driver/blind-frame-model.mjs

@@ -13,7 +13,7 @@
 // PURE (no node imports) → tests offline. Mirrors coverage-ledger.mjs / findings-model.mjs.
 
 // add/drop = the both-directions element neighbours (VELTRIN→VELTRI is "drop"); phonetic/homophone =
-// sound-alikes; neighbour = a one-keystroke real-word / famous-mark neighbour (CHROME on NOVAPULSE);
+// sound-alikes; neighbour = a one-keystroke real-word / famous-mark neighbour (NOVAPULSO on NOVAPULSE);
 // composite = the element inside a larger mark (VELTRI-composite cluster).
 export const VARIANT_DIRECTIONS = ["add", "drop", "phonetic", "homophone", "neighbour", "composite"];
 // the spine is ranked by goods-overlap with the actual product, not by class number + registration status.

package/driver/case-law-ledger.mjs

@@ -36,7 +36,18 @@
 // "no node imports → tests offline" invariant, exactly as connotation-search.mjs already does.
 import { abbrev } from "./repair-contract.mjs";
 
-export const CASE_LAW_LEDGER_SCHEMA_VERSION = 1;
+// Version 2 is the one whose instruction tells the model to write `null` for a query it could not send,
+// and never 0. At version 1 a 0 could mean either, so a reader may not count one as a search that ran.
+export const CASE_LAW_LEDGER_SCHEMA_VERSION = 2;
+
+// WHAT A RECORD THAT NAMES NO VERSION IS. The oldest, never the newest. Defaulting an unversioned record
+// to whatever this build happens to be at hands it every promise the current instruction makes, which is
+// exactly backwards: the records that name no version are the ones written before the field was asked
+// for, and their zeros are the ambiguous kind. Read low, and a record only gains a promise by claiming it.
+export const CASE_LAW_LEDGER_OLDEST_SCHEMA = 1;
+
+/** Version 2 and up separate "sent and returned nothing" (0) from "never sent" (null). */
+export const ledgerSeparatesUnsentQueries = (ledger) => Number(ledger?.schema_version) >= 2;
 
 /**
  * How far a proceeding got. `read` is the only state that discharges a depth dive, and the distinction
@@ -91,11 +102,16 @@ export function parseCaseLawLedger(raw) {
   return {
     error: null,
     ledger: {
-      schema_version: Number(parsed.schema_version) || CASE_LAW_LEDGER_SCHEMA_VERSION,
+      schema_version: Number(parsed.schema_version) || CASE_LAW_LEDGER_OLDEST_SCHEMA,
       queries: queries.filter((q) => q && typeof q === "object").map((q) => ({
         query: str(q.query),
         jurisdiction: str(q.jurisdiction),
-        results: Number.isFinite(Number(q.results)) ? Number(q.results) : null,
+        // NULL STAYS NULL, and this is load-bearing from version 2 on. `Number(null)` is 0 and
+        // `Number("")` is 0, both finite, so the obvious coercion turns the record's "I could not send
+        // this query" into "I sent it and got nothing" — the very two the version exists to separate,
+        // collapsed by the parser before any reader sees them. Only a value that genuinely is a number
+        // becomes one; everything else is null, which is the record declining to give a count.
+        results: q.results == null || q.results === "" || Number.isNaN(Number(q.results)) ? null : Number(q.results),
       })),
       citations: citations.filter((c) => c && typeof c === "object").map((c) => ({
         proceeding: str(c.proceeding),

package/driver/claim-liveness.mjs

@@ -35,6 +35,7 @@ import { readFileSync, readdirSync, statSync } from "node:fs";
 import { spawnSync } from "node:child_process";   // — the birth stamp where there is no /proc
 import { join } from "node:path";
 import { config } from "./driver.config.mjs";
+import { windowsProcessScript, parseWindowsRows, defaultRunPowerShell } from "../shared/process-table.mjs";   // the birth stamp on Windows
 
 // ── B2 — fail-safe claim liveness ────────────────────────────────────────────────────────────────────
 // The .pid sidecar records "<pid>:<starttime>" (starttime = field 22 of /proc/<pid>/stat, the kernel's
@@ -42,7 +43,7 @@ import { config } from "./driver.config.mjs";
 // impersonate a dead claimer and rot its `.processing` forever. Legacy bare-pid sidecars still parse
 // (starttime null → pid-aliveness is all we have, today's behavior). All exported for unit tests.
 export function procStarttime(pid, readStat = undefined,
-  { platform = process.platform, readPsStart = defaultReadPsStart } = {}) {
+  { platform = process.platform, readPsStart = defaultReadPsStart, runPowerShell = defaultRunPowerShell } = {}) {
   // AN INJECTED READER IS THE CALLER'S STATEMENT ABOUT HOW TO READ, and it outranks the platform.
   //
   // Measured on macOS (the verification run): the arm that pins the field-22
@@ -61,6 +62,7 @@ export function procStarttime(pid, readStat = undefined,
       return stat.slice(stat.lastIndexOf(")") + 2).trim().split(/\s+/)[19] ?? null;
     } catch { return null; }
   }
+  if (platform === "win32") return windowsStarttime(pid, runPowerShell);
   // ── — THE SAME DEFENCE WHERE THERE IS NO /proc ─────────────────────────
   //
   // Returning null here was not a neutral degradation. `claimToken` announces it and falls back to a
@@ -82,6 +84,33 @@ export function procStarttime(pid, readStat = undefined,
   } catch { return null; }
 }
 
+// ── WINDOWS: NEITHER /proc NOR ps ────────────────────────────────────────────────────────────────────
+//
+// Without a stamp on Windows the portal said nothing was draining the queue while the worker ran, which
+// is the false alarm described above, and a claim held by a dead runner stayed held until the max-claim-age
+// ceiling. That second cost is larger on Windows than anywhere else, because Windows hands a freed pid to
+// the next process soon after. So the stamp is read from the system's process list, through PowerShell:
+// the creation time as epoch milliseconds, the same reader `processTable` uses, so a stamp written from
+// one is compared with a stamp read by the same code.
+//
+// ONE PROCESS IS REMEMBERED: this one. Its start cannot change while it runs, and the heartbeat and the
+// status stamp ask for it on every tick, each a PowerShell start. Every other pid is read afresh, for the
+// reason above: a remembered stamp is the dead process's, handed to whatever now wears its number.
+let ownWindowsStamp;
+function windowsStarttime(pid, runPowerShell) {
+  if (!Number.isInteger(pid) || pid <= 0) return null;
+  const own = pid === process.pid && runPowerShell === defaultRunPowerShell;
+  if (own && ownWindowsStamp) return ownWindowsStamp;
+  let row = null;
+  try {
+    const r = runPowerShell(windowsProcessScript(pid));
+    if (r && r.status === 0) row = parseWindowsRows(r.stdout).find((p) => p.pid === pid) ?? null;
+  } catch { return null; }
+  const stamp = row && Number.isFinite(row.startedAt) ? String(row.startedAt) : null;
+  if (own && stamp) ownWindowsStamp = stamp;
+  return stamp;
+}
+
 /** `ps` is POSIX and is on macOS. Empty stdout (no such pid) parses to NaN above, which is `null`. */
 function defaultReadPsStart(pid) {
   const r = spawnSync("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8" });

package/driver/clearance-variants-record.mjs

@@ -130,8 +130,15 @@ export function renderClearanceVariants(model, scopeRows) {
   const out = ["# Variant manifest", ""];
   out.push(`## Mark: ${model.mark}`, "", `Dominant element: ${model.dominant_element}`, "");
 
-  out.push("### Elements", "", "| Value | Kind |", "|---|---|");
-  for (const e of model.elements) out.push(`| ${e.value} | ${e.kind} |`);
+  // The famous-mark column appears only when an element carries the flag, so a manifest with none reads
+  // exactly as it did before the flag existed.
+  if (model.elements.some((e) => e.famous_mark_flag)) {
+    out.push("### Elements", "", "| Value | Kind | Famous-mark check |", "|---|---|---|");
+    for (const e of model.elements) out.push(`| ${e.value} | ${e.kind} | ${e.famous_mark_flag ? "yes" : ""} |`);
+  } else {
+    out.push("### Elements", "", "| Value | Kind |", "|---|---|");
+    for (const e of model.elements) out.push(`| ${e.value} | ${e.kind} |`);
+  }
   out.push("");
 
   out.push(`### Variants (${model.variants.length})`, "", "| Value | Category | Romanisation | Rationale |", "|---|---|---|---|");
@@ -172,7 +179,7 @@ export function renderClearanceVariants(model, scopeRows) {
 /** The shape this tool declares, at every depth — what the ACCEPTOR enforces. */
 const DECLARED = Object.freeze({
   "": ["mark", "dominant_element", "elements", "variants", "incumbent_classes", "search_floor", "watchlist_owners", "goods_words", "scope_ledger"],
-  elements: ["value", "kind"],
+  elements: ["value", "kind", "famous_mark_flag"],
   variants: ["value", "category", "rationale", "romanization"],
   scope_ledger: ["layer", "item", "status", "reason", "reopen_trigger"],
 });