clearotron 0.4.0-beta.0 → 0.4.0-beta.2

package/scripts/score.mjs

@@ -3,7 +3,13 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // score.mjs — score a completed run against the lawyer's reference answer for its scenario.
 //
-//   node scripts/score.mjs <ID> --run <runDir> [--previous <runDir>|auto] [--json]
+//   node scripts/score.mjs <ID> --run <runDir> [--previous <runDir>|auto] [--json] [--names]
+//
+// `--names` prints the reference's marks, proprietors and sentences. WITHOUT it they are withheld and
+// each is shown as a stable `«name N»` token, because scoring a run is routine work done in sessions
+// that record everything they print, and a reference answer is a real lawyer's answer to a real matter.
+// Every number, axis and bucket is unaffected: an entry's index answers every question this tool asks.
+// The flag is for the one job that needs the words, reading a surprising result against the finding text.
 //
 // `--previous auto` resolves the OTHER HALF OF A PAIR: the run of the round immediately before
 // this one, same scenario, same door. It reads the scenario's declared refs from the config store and
@@ -56,6 +62,9 @@ import { recordQids } from "../driver/named-band.mjs";
 // reason it is not in scripts/e2e.mjs: this scorer is deliberately offline, and importing the harness
 // would drag portal-mcp-client, enqueue-schema and door-gates in behind it.
 import { previousRunDir, scenarioRefs } from "../driver/e2e-rounds.mjs";
+// The names rule, kept out of this file so it is testable without a run directory — the same reason
+// reference-score.mjs holds the scoring rules rather than this script.
+import { protectedStrings, redactor, installRedaction, unclassifiedNotice, REDACTION_NOTICE } from "../driver/score-redaction.mjs";
 import { readSettleStamp } from "../driver/settle-stamp.mjs";   
 import { envFrom } from "../shared/env-aliases.mjs";   // — resolves EITHER spelling; names the retired one because that is the live-writable half
 
@@ -133,6 +142,9 @@ function findingsOf(runDir) {
         // layer is load-bearing alone.
         ordinal: Number.isInteger(f.ordinal) ? f.ordinal : null,
         mark: f.mark ?? "", owner: ownerName(f.owner), band: f.band?.label ?? null,
+        // The offices the finding's records are filed in, for the owner-or-country join: the office
+        // segment of each registration's `/mark/<office>/…` uri, else the owner's country.
+        territories: officesOf(f.owner),
         disposition: f.disposition ?? null, ruled_out: f.ruled_out === true,
         ruled_out_reason: f.ruled_out_reason ?? null,
         // — the EVIDENCE CLASS, derived at the artifact boundary so the scorer stays pure and
@@ -204,6 +216,18 @@ function findingsOf(runDir) {
   return { lane: null, rows: [], subjects: null };
 }
 
+/** The office a record id names: `/mark/<office>/…` → `<office>`, else null. */
+function officeOfRecord(recordId) {
+  const m = /^\/mark\/([a-z]{2,3})\//i.exec(String(recordId ?? ""));
+  return m ? m[1] : null;
+}
+
+/** The offices a finding's owner is filed in, from its registration uris; else the owner's country. */
+function officesOf(owner) {
+  const offices = [...new Set((owner?.registrations ?? []).map((r) => officeOfRecord(r?.uri)).filter(Boolean))];
+  return offices.length ? offices : (owner?.country ? [owner.country] : []);
+}
+
 /**
  * Every label the run RETRIEVED — the corpus `withheld` is measured against.
  *
@@ -227,7 +251,7 @@ function retrievedOf(runDir) {
     const k = `${mark} ${record_id ?? ""}`;
     if (!mark) return;
     const prior = out.get(k);
-    if (!prior) { out.set(k, { mark, record_id: record_id ?? null, owner: owner ?? null, qids: [...new Set(qids ?? [])] }); return; }
+    if (!prior) { out.set(k, { mark, record_id: record_id ?? null, owner: owner ?? null, territory: officeOfRecord(record_id), qids: [...new Set(qids ?? [])] }); return; }
     for (const q of qids ?? []) if (!prior.qids.includes(q)) prior.qids.push(q);   // union across both sources
   };
 
@@ -271,6 +295,17 @@ function searchedTextOf(runDir) {
     const d = driverDir(runDir);
     for (const f of readdirSync(d)) if (/^grid-spec.*\.json$/.test(f)) parts.push(readText(join(d, f)));
   } catch { /* no _driver — reported by the caller */ }
+  // THE KNOCKOUT LANE WRITES NONE OF THE ABOVE. It keeps no plan-execution record and no grid ledger:
+  // where it looked is recorded in what it cites, the evidence addresses on each finding in
+  // knockout-findings.json and the pages its research notes name, one file per mark under research/.
+  // Read only the files above, a knockout printed every channel ABSENT while its findings cited the
+  // very store the reference names. Neither file exists on the clearance lane, so its reading is
+  // unchanged.
+  parts.push(readText(join(runDir, "knockout-findings.json")));
+  try {
+    const r = join(runDir, "research");
+    for (const f of readdirSync(r)) if (/\.md$/.test(f)) parts.push(readText(join(r, f)));
+  } catch { /* no research/ — a clearance run, or a knockout that wrote no notes */ }
   return parts.join("\n");
 }
 
@@ -435,7 +470,7 @@ function scoreOne(run, ref) {
   //
   // Refusing the unshaped pairing was only half of it. A gold set that gains a `counts` block usually
   // KEEPS its lawyer sheet — it is a real answer to a real matter and deleting it loses history — and
-  // scoring both prints `LOST · TIKI PUNCH` beside the count that measures the product. That is the same
+  // scoring both prints `LOST · WAVO PUNCH` beside the count that measures the product. That is the same
   // structural zero the issue is about, one row smaller, and it lands in the bucket table a reader
   // scans first.
   //
@@ -446,7 +481,7 @@ function scoreOne(run, ref) {
   const buckets = scoreRecall({
     reference: countShaped ? [] : ref.register, findings: run.findings, retrieved: run.retrieved,
     scopeClasses: run.scopeClasses, scopeTerritories: run.scopeTerritories, registerOnly, collapseReason, preAccepted: ref.pre_accepted ?? [],
-    coverage,
+    coverage, searchedMarks: [...(ref.covers_marks ?? []), ref.mark].filter(Boolean),
   });
   return {
     registerOnly, collapseReason, coverage, buckets, countShaped,
@@ -644,7 +679,7 @@ function print(id, ref, run, s, delta, refPath) {
   console.log(renderCarryThrough(run.dir, { indent: "  " }).lines.join("\n"));
 
   // — a record in two buckets is a defect in THIS TOOL, and it is printed as loudly as any score.
-  // Silence here is what let `DELPHI GENETICS` sit in LOST and `DG DELPHI GENETICS` in NOISE on the same
+  // Silence here is what let `KORPHI GENETICS` sit in LOST and `DG KORPHI GENETICS` in NOISE on the same
   // page, and the recall number that reached the round handover was wrong for a week because nobody
   // reads two lists against each other.
   if (B.collisions?.length) {
@@ -656,7 +691,7 @@ function print(id, ref, run, s, delta, refPath) {
   //
   // These used to print under the line above, which tells the reader not to read the recall numbers.
   // One large filer anywhere in a matter therefore suppressed a whole run's measurement, and did: R2's
-  // real 88% → 63% recall movement went unquoted on the regression issue because `Novartis AG` held one
+  // real 88% → 63% recall movement went unquoted on the regression issue because `Norvanta AG` held one
   // withheld reference mark and one surfaced non-reference mark. Those two rows are both true.
   //
   // Kept visible because a reader may still want the pairing, and deliberately WITHOUT a verdict: this
@@ -877,7 +912,7 @@ function print(id, ref, run, s, delta, refPath) {
 
 // ── main ─────────────────────────────────────────────────────────────────────────────────────────────
 
-const USAGE = `usage: score.mjs <ID> --run <runDir> [--previous <runDir>|auto] [--json]`;
+const USAGE = `usage: score.mjs <ID> --run <runDir> [--previous <runDir>|auto] [--json] [--names]`;
 
 /**
  * `--previous auto` — the other half of the pair, resolved rather than typed.
@@ -907,9 +942,10 @@ function resolvePreviousAuto(id, runDir) {
 }
 
 // One pass, so a directory named like a flag's value can never be mistaken for the scenario id.
-const opts = { json: false, run: null, previous: null, id: null };
+const opts = { json: false, run: null, previous: null, id: null, names: false };
 for (let i = 0, a = process.argv.slice(2); i < a.length; i++) {
   if (a[i] === "--json") opts.json = true;
+  else if (a[i] === "--names") opts.names = true;
   else if (a[i] === "--run") opts.run = a[++i];
   else if (a[i] === "--previous") opts.previous = a[++i];
   else if (a[i].startsWith("--")) die(`unknown flag ${a[i]}\n${USAGE}`);
@@ -929,11 +965,40 @@ const previousDir = opts.previous === "auto" ? resolvePreviousAuto(id, runDir) :
 const prev = previousDir ? scoreOne(readRun(previousDir, ref), ref) : null;
 const delta = prev ? bucketDelta(scored.buckets, prev.buckets) : null;
 
+// ── NAMES ARE WITHHELD UNLESS SOMEBODY ASKS FOR THEM ─────────────────────────────────────────────────
+//
+// A reference answer is a real lawyer's answer to a real matter, and scoring a run is routine work done
+// inside sessions that record everything they print. So the default output carries the axes, the buckets
+// and which entry fell in which, with every mark, proprietor and reference sentence swapped for a stable
+// token; `--names` prints them as before.
+//
+// INSTALLED OVER THE STREAM, not at each of the twenty-odd sites that interpolate a name. Redacting
+// per-site is the shape that leaves one site out, and it would have to be revisited by every later edit
+// that adds a print. Here `renderCarryThrough`'s lines and anything added after this was written are
+// covered without anyone remembering to.
+//
+// The two inputs are the reference AND the scored buckets: a proprietor this run surfaced that the
+// lawyer never named is still somebody's name, and it reaches the page through `noise`.
+let unclassifiedKeys = [];
+if (!opts.names) {
+  const { names, prose, unclassified } = protectedStrings({ reference: ref, scored });
+  unclassifiedKeys = unclassified;
+  installRedaction(redactor({ names, prose }));
+}
+
 if (opts.json) {
   console.log(JSON.stringify({
     // — the instrument that produced these numbers, so a reader comparing two archived scores can
     // tell whether the comparison is valid. A score with no `scorer_version` predates this stamp.
     scorer_version: SCORER_VERSION,
+    // — WHETHER THE NAMES IN THIS PAYLOAD ARE THE REAL ONES. `--json` goes to the same terminal the
+    // human path does, so it is redacted on the same rule; stamped rather than left to be inferred,
+    // because a consumer that cannot tell a redacted score from a named one will compare the two.
+    names: opts.names ? "printed" : "redacted",
+    // THE SAME WARNING THE HUMAN PATH PRINTS, AS A FIELD RATHER THAN A LINE. It cannot be printed here:
+    // this payload is parsed, and a sentence above it makes the whole document unreadable — which is how
+    // it first went wrong. Keys only, never their values.
+    names_unclassified: unclassifiedKeys,
     // — the OTHER half of the same question. A consumer comparing two archived scores needs
     // both instruments: which scorer read the run, and which engine produced it.
     engine_commit: run.engineCommit,
@@ -949,6 +1014,12 @@ if (opts.json) {
     carry_through: (() => { const ct = carryThrough(run.dir); return { ...ct, coverage: coverageConflicts(run.dir, ct.lost) }; })(),
   }, null, 2));
 } else {
+  // Said before the first number, not after the last: a reader who stops at the top screen must know
+  // which of the two readings they are holding.
+  if (!opts.names) console.log(`\n  ${REDACTION_NOTICE}`);
+  // A reference that has grown a field this module does not classify is unprotected in exactly that
+  // field, so the reader learns it before anything below, not after.
+  if (unclassifiedKeys.length) console.log(`  ${unclassifiedNotice(unclassifiedKeys)}`);
   print(String(id).toUpperCase(), ref, run, scored, delta, refPath);
   // — THE LAWYER'S OWN STATEMENTS OF WHAT THE RUN MUST DEMONSTRATE. The buckets cannot carry
   // these: an assertion says WHY a mark matters, and that reasoning is what tells a reader which lane to

package/scripts/strip-titles-and-attributions.mjs

@@ -63,6 +63,7 @@ import { fileURLToPath } from "node:url";
 import { isScannable, EXCLUDED } from "./strip-tracker-citations.mjs";
 import { publishedOf } from "../shared/reference-guard-classes.mjs";
 import { newBareCitations } from "./citation-line-check.mjs";
+import { isEntrypoint } from "../shared/is-entrypoint.mjs";
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
 const APPLY = process.argv.includes("--apply");
@@ -357,7 +358,7 @@ export function surveyOf(files, read) {
 
 const total = (o) => Object.values(o).reduce((a, n) => a + n, 0);
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isEntrypoint(import.meta.url)) {
   // THE PUBLISHED POPULATION, NOT THE INDEX — the same helper, for the same reason, as the opener sweep.
   const all = execFileSync("git", ["-C", ROOT, "ls-files"], { encoding: "utf8", maxBuffer: 1 << 28 }).split("\n").filter(Boolean);
   const pub = publishedOf(all, ROOT);

package/scripts/strip-tracker-citations.mjs

@@ -61,6 +61,7 @@ import { execFileSync } from "node:child_process";
 import { publishedOf, wrapsInto } from "../shared/reference-guard-classes.mjs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
+import { isEntrypoint } from "../shared/is-entrypoint.mjs";
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
 const APPLY = process.argv.includes("--apply");
@@ -239,7 +240,7 @@ export function surveyOf(files, read) {
   return { strippedTotal, remainingTotal, stripped, handoff, unreadable };
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isEntrypoint(import.meta.url)) {
   // THE PUBLISHED POPULATION, NOT THE INDEX. The counts this prints are read as a statement about the
   // public tree, and under an overlay `git ls-files` would have made them a statement about the
   // withheld corpus instead. Same helper as the residue floor and the backlog minter.

package/scripts/test-full.mjs

@@ -43,6 +43,7 @@ import { spawnSync } from "node:child_process";
 import { readFileSync, readdirSync, existsSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
+import { isEntrypoint } from "../shared/is-entrypoint.mjs";
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -316,4 +317,4 @@ function main() {
   if (bad.length) process.exit(1);
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) main();
+if (isEntrypoint(import.meta.url)) main();

package/scripts/test-run.mjs

@@ -399,8 +399,11 @@ const isContained = (value) => {
 // The acceptance asks the refusal to name the value's ROOT, because that is the part that says "this is
 // somebody's live estate" at a glance, where a long path does not.
 const rootOf = (value) => {
-  const parts = resolve(value).split(sep).filter(Boolean);
-  return parts.length ? sep + parts[0] : sep;
+  // From the path's own root, so a Windows path names its drive and first folder (D:\a), not "\D:".
+  const p = resolve(value);
+  const { root } = parsePath(p);
+  const first = p.slice(root.length).split(sep).find(Boolean);
+  return first ? root + first : root;
 };
 
 // A guard with no way through gets deleted the first time somebody genuinely needs it, and then nothing
@@ -436,7 +439,7 @@ if (escaped.length) {
 // ── WHAT THE NEXT TWENTY MINUTES OF OUTPUT IS, SAID BEFORE IT STARTS ───────────────────────
 //
 // The suites print thousands of lines shaped like
-//   [register-unit:primary-sweep] attempt 1/1 (engine=anthropic-agent agent=clawdi model=opus … timeout=1500s)
+//   [register-unit:primary-sweep] attempt 1/1 (engine=anthropic-agent agent=mailagent model=opus … timeout=1500s)
 // and to somebody who cloned this repo ten minutes ago that is their subscription being spent, at
 // speed, for reasons nobody explained. It is the mock engine's dispatch record. Nothing here can tell
 // them that except a line that says it, and it has to come FIRST — an explanation after the scroll is
@@ -791,6 +794,10 @@ child = spawn(argv[0], argv.slice(1), {
   env: {
     ...process.env,
     TMPDIR: root,
+    // Windows' os.tmpdir() reads TEMP and TMP, not TMPDIR, so without these a Windows run's fixtures
+    // landed in the machine's own temp folder.
+    TEMP: root,
+    TMP: root,
     // AND THE REAL BASE, so a NESTED run does not root itself inside this one. The line above hands the
     // child a TMPDIR pointing at this run's own root; `os.tmpdir()` honours it, so a child that starts
     // its own runner would put its root INSIDE the parent's and the parent's cleanup — or its sweep of

package/scripts/third-party-notices.mjs

@@ -23,6 +23,7 @@ import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { isEntrypoint } from "../shared/is-entrypoint.mjs";   // — realpath both sides, or a symlinked invocation exits 0 silently
 import { nonEmpty } from "../shared/vacuous-pass.mjs";        // — an empty row set would confirm compliance over nothing
+import { npmInvocation } from "../shared/npm-cli.mjs";
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
 export const OUTPUT = join(ROOT, "THIRD-PARTY-NOTICES.md");
@@ -80,7 +81,8 @@ export function npmTree(root = ROOT, run = execFileSync) {
   const opts = { cwd: root, encoding: "utf8", maxBuffer: 128 * 1024 * 1024 };
   let out;
   try {
-    out = run("npm", ["ls", "--omit=dev", "--all", "--json"], opts);
+    const npm = npmInvocation(["ls", "--omit=dev", "--all", "--json"]);   // npm.cmd on Windows needs a shell; npm-cli.js does not
+    out = run(npm.command, npm.args, opts);
   } catch (e) {
     out = e?.stdout;
     if (typeof out !== "string" || !out.trim()) throw e;

package/scripts/travelling-predicates.mjs

@@ -102,7 +102,7 @@ function isPlumbing(node, child) {
   // This was the whole of the unresolved bucket — three sites, all one shape:
   //
   //     const wrote   = files.length ? files.some(…) : null;              gateway.mjs (by name)
-  //     const inScope = scope.size   ? tokens.some(…) : (…);              reasoning-tripwires.mjs:82
+  //     const inScope = scope.size   ? tokens.some(…) : (…);              findRecallFloorViolations() in reasoning-tripwires.mjs
   //     const reached = b.layer === "national" ? (…) : regions.some(…);   resolveRegions() in register-plan.mjs
   //
   // The climb stopped at the ternary and reported "unresolved", which reads as a limit of the pattern

package/scripts/writing-standard-check.mjs

@@ -42,6 +42,7 @@
 import { execFileSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { CLASSES, fileOffences, isExempt } from "../shared/writing-standard-classes.mjs";
+import { isEntrypoint } from "../shared/is-entrypoint.mjs";
 
 const baseArg = () => {
   const i = process.argv.indexOf("--base");
@@ -119,4 +120,4 @@ function main() {
   process.exit(1);
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) main();
+if (isEntrypoint(import.meta.url)) main();

package/shared/brand-fonts.mjs

@@ -0,0 +1,59 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// THE FONTS TRAVEL WITH THE PAGE. A report used to link its typefaces from two font services, so opening
+// one told those services the reader's address and that a report had been opened, from the portal, from
+// disk or from an email alike. Every page this product writes now carries its fonts inside itself, as
+// data, and fetches nothing to draw its text.
+//
+// ONE PLACE. The files are shared/fonts/*.woff2 (their provenance is in shared/fonts/README.md), and every
+// surface that sets text takes its @font-face rules from here: the report renderers, the pool index pages,
+// the portal's own sign-in pages and the staff profile page. The portal's browser bundle is the one
+// exception: it imports the same files through its own stylesheet, because a bundle serves files rather
+// than inlining them.
+//
+// EACH LICENCE RIDES BESIDE ITS FONT. Both are under the SIL Open Font License 1.1, which asks that every
+// copy of the font carry its copyright notice and the licence. The font files carry both in their name
+// records, and the full licence text goes into the page as a stylesheet comment right before the rules
+// that embed the font, so a copy saved out of a report still has it.
+//
+// NOT FOR EMAIL. A mail client strips web fonts, and the embedded face would add tens of kilobytes to
+// every message. Email keeps its font stack by name only.
+
+import { readFileSync } from "node:fs";
+
+const at = (name) => new URL(`./fonts/${name}`, import.meta.url);
+
+/** The text face, as every stylesheet names it. */
+export const TEXT_FACE = "Plus Jakarta Sans";
+/** The code face, as every stylesheet names it. */
+export const CODE_FACE = "Fira Code";
+
+// The code points each file holds, from shared/fonts/README.md. Stated so a browser never asks a face for
+// a character it does not have: Japanese, Greek and the rest go straight to the reader's system fonts.
+export const FONT_UNICODE_RANGE = "U+0000-00FF,U+0131,U+0152-0153,U+02BB-02BC,U+02C6,U+02DA,U+02DC,U+0304,"
+  + "U+0308,U+0329,U+2000-206F,U+20AC,U+2122,U+2190-2193,U+2212,U+2215,U+FEFF,U+FFFD,U+0100-02BA,U+02BD-02C5,"
+  + "U+02C7-02CC,U+02CE-02D7,U+02DD-02FF,U+1D00-1DBF,U+1E00-1E9F,U+1EF2-1EFF,U+2020,U+20A0-20AB,U+20AD-20C0,"
+  + "U+2113,U+2C60-2C7F,U+A720-A7FF";
+
+export const FONT_FILES = [
+  { family: TEXT_FACE, file: "plus-jakarta-sans.woff2", licence: "OFL-plus-jakarta-sans.txt", weight: "200 800" },
+  { family: CODE_FACE, file: "fira-code.woff2", licence: "OFL-fira-code.txt", weight: "300 700" },
+];
+
+function faceCss({ family, file, licence, weight }) {
+  const licenceText = readFileSync(at(licence), "utf8").trim();
+  // A licence containing the comment terminator would end the comment early and spill into the stylesheet.
+  if (licenceText.includes("*/")) throw new Error(`${licence} contains "*/" and cannot be carried in a stylesheet comment`);
+  const data = readFileSync(at(file)).toString("base64");
+  return `/*\n${family}\n\n${licenceText}\n*/\n`
+    + `@font-face{font-family:'${family}';font-style:normal;font-weight:${weight};font-display:swap;`
+    + `src:url(data:font/woff2;base64,${data}) format('woff2');unicode-range:${FONT_UNICODE_RANGE}}\n`;
+}
+
+const [TEXT, CODE] = FONT_FILES.map(faceCss);
+
+/** The text face alone, for pages that set no code: the pool index, the sign-in pages, the profile page. */
+export const TEXT_FONT_STYLE = `<style>${TEXT}</style>`;
+/** Both faces, for a report, which sets identifiers and dates in the code face. */
+export const REPORT_FONT_STYLE = `<style>${TEXT}${CODE}</style>`;

package/shared/brand.mjs

@@ -7,7 +7,7 @@
 //   • the Run status page  (writer retired with the quality subsystem in)
 //
 // Built on the Cordillera brand package (v3, legacy — the values below are the record): limestone-cream + crimson,
-// Satoshi. Crimson is the ONLY strong accent; warm health/risk tones replace traffic-light colours.
+// Plus Jakarta Sans. Crimson is the ONLY strong accent; warm health/risk tones replace traffic-light colours.
 // Hex values are canonical here; CSS is case-insensitive, so casing in any rendered :root is irrelevant.
 //
 // Two ready-made :root blocks are exported because the two surface families use different token names:
@@ -253,8 +253,8 @@ export const PALETTE_DARK = {
   codeBg:     'rgba(236,229,216,.08)',// parchment at 8%
 };
 
-// Satoshi via Fontshare. Used by index + staff pages (the report head loads its own weights incl. 900 inline).
-export const FONT_LINK = `<link href="https://api.fontshare.com/v2/css?f[]=satoshi@400,500,700&display=swap" rel="stylesheet">`;
+// The typefaces themselves are not linked from anywhere: brand-fonts.mjs embeds them in each page that
+// sets text, and this module only names them, so it stays free of file reads for the tools that import it.
 
 // The canonical Cordillera ridge mark — the exact path from the v3 brand package (legacy; this constant IS the record now),
 // — THE RIDGE IS GONE FROM EVERY SURFACE THIS PRODUCT RENDERS, and the constants went with it.
@@ -434,7 +434,7 @@ export const REPORT_ROOT =
   // The mark-itself disclosure toggles. A DEDICATED token: --crimson has no dark variant, and
   // reusing it left the toggles barely legible on the dark ground.
   `--ma-toggle:#860F09;` +
-  `--font:'Satoshi','Helvetica Neue',system-ui,sans-serif;` +
+  `--font:'Plus Jakarta Sans','Helvetica Neue',system-ui,sans-serif;` +
   `--mono:'Fira Code',ui-monospace,monospace;` +
   `--shadow:0 1px 2px rgba(37,9,2,.05), 0 10px 30px rgba(37,9,2,.07);` +
   `}`;
@@ -575,7 +575,7 @@ export const DOOR_ROOT =
   `--code-bg:${P.codeBg};` +
   // The doors' own font stack, not brand's: they must render with no bundle and no webfont, so the
   // fallbacks are the platform's rather than Helvetica Neue / Fira Code.
-  `--font:"Satoshi",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;` +
+  `--font:"Plus Jakarta Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;` +
   `--mono:ui-monospace,SFMono-Regular,Menlo,monospace}`;
 
 // Same token names, dark values. Nothing here is a scoped rule override: every value the dark scheme
@@ -718,7 +718,7 @@ export const CHROME_CSS = `
    thing. The three body elements that carried the class drop it too, and --wm-alpha goes with them:
    a token nothing reads is a knob somebody re-wires.
    NOTE FOR ANY FUTURE DECORATION ON body: the rule here pinned right:0 and never a negative inset,
-   because right:-2% put 26px of horizontal scrollbar on a 1280px report (#485) and pointer-events:none
+   because right:-2% put 26px of horizontal scrollbar on a 1280px report and pointer-events:none
    does not exempt a box from scrollable overflow. That is a property of the position, not of this
    rule, and scripts/report-overflow-check.mjs still measures it. */
 /* Floating settings stack (theme + privacy) — pinned bottom-right, OUT of the nav bar. Icon-only: the toggle keeps its .tt-lbl/.anon-lbl text for screen readers but clips it visually.

package/shared/browser-temp-root.mjs

@@ -75,9 +75,10 @@ export const ROOT_PREFIX = "ctb-";
  * Returned rather than thrown so a caller can decide: a check that has already produced a result
  * should say this and exit, not lose the result to an exception.
  */
-export function rootRefusal(dir) {
+export function rootRefusal(dir, { platform = process.platform } = {}) {
   if (typeof dir !== "string" || dir === "") return "a browser temp root must be a non-empty path";
-  if (dir.length <= MAX_ROOT_LENGTH) return null;
+  // On Windows the browser's singleton is a named pipe, not a socket at a file path, so no length binds.
+  if (platform === "win32" || dir.length <= MAX_ROOT_LENGTH) return null;
   return (
     `browser temp root is ${dir.length} characters and the limit is ${MAX_ROOT_LENGTH}: ${dir}\n` +
     `  A browser writes its process-singleton socket at <root>${LOCK_SUFFIX}, and a unix socket ` +

package/shared/doctrine-overlay.mjs

@@ -6,7 +6,7 @@
 // is explicit that an edit for brevity changes what a clearance concludes. So an override that has
 // silently gone stale is a run answering from old doctrine with nothing to say so.
 //
-// WE RAN THIS EXPERIMENT ON OURSELVES. `driver/driver.config.mjs:170` records the repo split forking
+// WE RAN THIS EXPERIMENT ON OURSELVES. the SKILL RESOLUTION note above `skillsBaseDir` in `driver/driver.config.mjs` records the repo split forking
 // the whole tree: **30 of 37 shared files had silently drifted apart, in BOTH directions**. The
 // overlay fixed the mechanism for us and fixes nothing for a self-hoster, whose copies win and whose
 // upstream moves underneath them with nothing comparing the two.

package/shared/driver-dir.mjs

@@ -40,15 +40,23 @@
 //
 // ── WHAT THIS DELIBERATELY DOES NOT DO ────────────────────────────────────────────────────────────
 //
-// IT DOES NOT SET A MODE, and this change alters no behaviour on disk. Pinning 0o750 here in the same
-// commit would be a semantic change riding inside a seam, and the seam is the part that has to be
-// reviewable by reading nineteen call sites and agreeing they still mean what they meant. The mode is
-// That business, and when it is taken it is one line in this file.
+// ── THE MODE, TAKEN HERE ONCE (2026-09-23) ────────────────────────────────────────────────────────
 //
-// IT WOULD NOT RESTRAIN THE SEAT IF IT DID. The agent runs as the same account that owns these
-// directories, so owner bits apply whatever the group bits say. A tighter mode removes GROUP write,
-// which is worth having on a box with a shared pool group, and nothing more. Said here because a module
-// named for a boundary invites the stronger reading.
+// A new run folder is created 0750: its owner, and the group the deployment reads reports through, and
+// no other account. It used to take whatever the umask gave, 775 on a real run, so on a machine whose
+// home or data folder other accounts can enter, any of them could read client matter. The folder that
+// holds a run is created by the call below (measured by tracing a whole clearance: `ensureDriverDir` is
+// the first write into a new run folder, and the archive is a rename that keeps the mode), so this one
+// line closes the live run and its archived copy. The published copy takes the same constant.
+//
+// A MODE GIVEN TO mkdir, NEVER A chmod. The kernel sets a new folder's set-GID bit from its parent
+// whatever mode is asked for, which is what the set-GID pool root relies on; a chmod by an account
+// outside that group strips the bit silently and every report then answers 403. So nothing here ever
+// changes an existing folder: a folder that already exists keeps the mode it has.
+//
+// IT DOES NOT RESTRAIN THE SEAT. The agent runs as the same account that owns these directories, so owner
+// bits apply whatever the group bits say. Said here because a module named for a boundary invites the
+// stronger reading.
 //
 // IT IS NOT `driverDirs`. `scripts/seat-retry-report.mjs` exports `driverDirs(root)`, which WALKS a tree
 // to find every `_driver` beneath it. Discovery, not construction — a different concern that happens to
@@ -60,6 +68,34 @@ import { join } from "node:path";
 /** The directory's name. The one place the string lives, so renaming it is an edit rather than a sweep. */
 export const DRIVER_DIR = "_driver";
 
+/** The mode a new run folder is created with: owner and group, no other account. See the header. */
+export const RUN_DIR_MODE = 0o750;
+
+/**
+ * A name inside `_driver/` as it is written on `platform`.
+ *
+ * ON WINDOWS A COLON CANNOT BE IN A FILE NAME, and a stage's label carries one (`register-unit:primary-
+ * sweep`, `common-law-half:a`, `report-card:1`), which names its attempt log, its dispatch record and its
+ * input stamp. NTFS does not refuse the name: it reads `register-unit:primary-sweep.jsonl` as a hidden
+ * stream of a file called `register-unit`, so every register unit's log lands in that one file, reading it
+ * back by the same name appears to work, and the copy into an experiment's sandbox fails with EINVAL.
+ * Measured on a Windows runner, 2026-09-23. There the colon is written `%3A`, which no label contains, so
+ * the name still reads back to its label. Everywhere else the name is left exactly as it was.
+ */
+export function driverFileName(name, platform = process.platform) {
+  return platform === "win32" ? String(name).replaceAll(":", "%3A") : name;
+}
+
+/**
+ * The stage label a `_driver/` file was written for: `register-unit%3Aprimary-sweep.jsonl` →
+ * `register-unit:primary-sweep`. Every platform decodes, because no label holds `%`, so a record written
+ * on Windows reads back under its label wherever it is read. `ext` is the suffix to take off.
+ */
+export function labelOfDriverFile(name, ext = ".jsonl") {
+  const base = String(name ?? "");
+  return (base.endsWith(ext) ? base.slice(0, -ext.length) : base).replaceAll("%3A", ":");
+}
+
 /**
  * The path to a run's `_driver/`, or to something inside it.
  *
@@ -67,7 +103,7 @@ export const DRIVER_DIR = "_driver";
  * @param {...string} parts  optional path segments beneath it
  */
 export function driverDir(base, ...parts) {
-  return join(base, DRIVER_DIR, ...parts);
+  return join(base, DRIVER_DIR, ...parts.map((part) => driverFileName(part)));
 }
 
 /**
@@ -79,7 +115,7 @@ export function driverDir(base, ...parts) {
  * reaching this directory by one.
  */
 export function driverRel(...parts) {
-  return join(DRIVER_DIR, ...parts);
+  return join(DRIVER_DIR, ...parts.map((part) => driverFileName(part)));
 }
 
 /**
@@ -91,6 +127,6 @@ export function driverRel(...parts) {
  */
 export function ensureDriverDir(base, ...parts) {
   const dir = driverDir(base, ...parts);
-  mkdirSync(dir, { recursive: true });
+  mkdirSync(dir, { recursive: true, mode: RUN_DIR_MODE });
   return dir;
 }

package/shared/fonts/OFL-fira-code.txt

@@ -0,0 +1,93 @@
+Copyright 2014-2020 The Fira Code Project Authors (https://github.com/tonsky/FiraCode)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.