clearotron 0.4.0-beta.1 → 0.4.0-beta.2

package/docs/architecture/06-operations-runbook.md

@@ -110,18 +110,6 @@ and the environment file holding the secrets.
 - **A scheduled gateway restart** (chat-channel session and plugin-loader hygiene) should *defer*
   off live work rather than skip: wait while a run is live, up to a bound, then restart anyway.
   `XDG_RUNTIME_DIR` must be set for `systemctl --user` to work from cron.
-- **Pin the agent id before upgrading an install made before 0.2.2.** The default agent id changed
-  from `clawdi` to `localagent`, and that id is a path segment: runs live under
-  `<workspaceRoot>/workspace-<agent>/studio/clearance-search/`. An install that never set one starts
-  reading an empty workspace, and empty reads as "no runs" rather than as an error. Set **both**
-  variables in the environment file — the gather servers read their own:
-
-  ```
-  CLEAROTRON_DEFAULT_AGENT=clawdi
-  CLEAROTRON_GATHER_AGENT=clawdi
-  ```
-
-  An install that already sets them is unaffected, and a fresh install needs neither.
 - **Integrator-platform upgrades** go through that platform's own guarded upgrade path — dry-run,
   exact-version confirm, stop → update → start. Never `npm i -g` / `pnpm add -g` directly.
 

package/docs/architecture/07-quality-and-audit.md

@@ -92,9 +92,15 @@ under-grading ships a wrong CLEAR. The reviewer's context includes code-computed
 and a mandatory plan-execution check. CONDITIONAL/BLOCKING triggers corrective re-synthesis, a
 freshness gate proving the named corrections actually reached `findings.json`, and a warm verdict
 re-check that can only fall back to the *entry* verdict. A terminal BLOCKING first gets the
-degenerate-artifact refusal (a "BLOCKING" with zero cited defects is re-asked fresh, once), then
-fails the run — a report the reviewer won't stand behind never ships looking finished
-("delivered with open questions" is retired). The reviewer's verdict is treated as documented-noisy;
+degenerate-artifact refusal (a "BLOCKING" with zero cited defects is re-asked fresh, once), and
+then the run **delivers**. Ruling 2026-08-26, verbatim: "Deliver always, with open points printed.
+The refusal on a blocking review goes." The corrective ladder is still the fix arm and still runs
+first; what changed is only what happens once it is exhausted. "Never ships" and "never ships
+*looking finished*" were treated as one requirement and are two — only the second was ever
+load-bearing, and it is met by the open-points section being code-built from the review. Ruling
+2026-09-24 settled where that section goes: reviewer notes never reach the client page, and a
+report the reviewer still refuses ships with its rating and nothing added, the points recorded
+beside the review for the reviewing lawyer. The reviewer's verdict is treated as documented-noisy;
 that is precisely why every *honesty* signal below derives from ledgers and receipts, not review
 prose.
 
@@ -138,16 +144,10 @@ What makes the coverage statement trustworthy:
 - **The clamps** (`applyCoverageFloor`) only ever raise CLEAR → CONDITIONAL, never lower, never
   manufacture BLOCKING: live condition actions, the lawyer's own `coverage_judgment.sufficient:
   false` (sufficiency is judgment's call — code only carries it), frame residuals, register gaps
-  (deferred rows ∪ taint axes ∪ material recall regressions — independent of the model's
-  self-report), and in-window deadlines delivered without their dates. The verdict sidecar
+  (deferred rows ∪ taint axes — independent of the model's self-report). The verdict sidecar
   (`_driver/verdict.json`) is then the single label authority for every surface; one shared
   predicate keeps the validator and the auto-correct judging "unconditional proceed" with the same
   eyes.
-- **Recall memory**: confirmed conflicts persist per mark in a workspace store
-  (`_known-conflicts/`, rows are only added — never deleted or rewritten, save the machine-provenance
-  `terminal` a delivered run may upgrade — human edits always win, non-Latin marks handled); the next run
-  folds them in as deterministic plan probes, and a prior-confirmed conflict that neither resurfaces
-  nor gets a recorded justification is a *material regression* that clamps.
 
 Register budgets deserve one honest sentence: the per-worker call budgets in the skill prose
 (enumerates, phoneme ≤ 5, image ≤ 10) are **observed, prompt-level budgets, not code-enforced
@@ -194,9 +194,8 @@ pass over inherited artifacts is visible as such.
 `reasoning-tripwires.mjs` is the mechanical net under principles held holistically in the skills:
 recall floor (a live identical registration dropped in the noise rows but not carried), seed
 neutrality (upstream artifacts must state facts, never grades), probative grading, matrix ceilings
-(legacy scale only), status honesty (clean headline over material gaps), deadline urgency and
-deadline carry, unresolved disagreements, orphan register findings, uncross-checked demotions,
-recall regression. All of it lands in `_driver/reasoning-integrity.json` and surfaces on the audit
+(legacy scale only), status honesty (clean headline over material gaps), deadline urgency,
+unresolved disagreements, orphan register findings, uncross-checked demotions. All of it lands in `_driver/reasoning-integrity.json` and surfaces on the audit
 workbook and quality pages — never as a banner on the rendered report.
 Two of these pure functions *also* feed the verdict clamps (register gap, deadline gap) — but via
 the clamp path on ledger facts, never as a tripwire "failure". `rule-shape.mjs` (rating decided by

package/docs/architecture/09-security-and-data.md

@@ -3,10 +3,15 @@
 > Part of the architecture pack (`docs/architecture/`). The driver's module tree and the headless
 > integrator contract are in [`driver/README.md`](../../driver/README.md).
 
-The security posture in one sentence: **nothing listens on the network except loopback services
-behind an authenticated tunnel; agents that touch the outside world cannot execute anything; the
-process that executes everything is not an agent; and secrets reach exactly the processes that need
-them, by inheritance, never by file-copy into configs.**
+The security posture in brief: **nothing listens on the network except loopback services behind an
+authenticated tunnel. A stage on Claude is offered no tool that runs a command. A stage on Codex runs its
+commands inside Codex's own sandbox, or with the permissions of the account Clearotron runs as where a
+machine sets the bypass. The process that runs everything else is ordinary code, not an agent. Each
+stage's AI program starts with a named list of settings, and the key that signs access keys is handed
+only to the portal and the two doors. On Claude, a stage's file tools can read nothing outside its run folder, its
+instruction folders and any folder the machine's own Claude settings add. On Codex with its sandbox on,
+a stage's commands can read nothing outside its run folder, its instruction folders, the temporary
+folders, and the system and program files a command needs to run.**
 
 ## Trust boundaries
 

package/driver/CHANGELOG.md

@@ -1,5 +1,65 @@
 # clearotron-driver
 
+## 0.4.0-beta.2
+
+### Minor Changes
+
+- New: A knockout search now also asks whether each name is already in use in the client's field, such as a game character or a drink.
+- New: Searching by judgment.
+  
+  This release changes how a clearance decides what to search. Until now the engine followed fixed rules: a set number of spellings, a fixed list of stores, a stop after the first identical mark. Fixed rules are fast and cheap, but they miss things. On a recent matter, a lawyer's review found marks the engine had counted but never read, and others it had raised that did not matter.
+  
+  So the approach changes. Wherever the engine holds a pile of results, it now looks at what is there and decides what a lawyer would raise. It carries that forward and writes down what it set aside, and why. Nothing is dropped silently. Every wider search, every spelling set aside and every store left out appears in the audit workbook with its reason.
+  
+  What you will notice:
+  - Searches widen where it could change the advice, and narrow where it cannot.
+  - Near spellings no buyer would confuse with the mark are set aside, with the reason recorded.
+  - Searches in other scripts run only in markets that file marks in that script.
+  - A large company's register is read for the marks that share the searched name. The rest is counted, not fetched.
+  - Marketplace searches cover the stores that sell the client's goods, and say which stores were left out and why.
+  - The report no longer opens with the internal reviewer's notes. They reach the reviewing lawyer separately.
+  - A large marketplace search no longer fails because its results were too big to return in one piece.
+  - Where a company's framework rates through named inputs, the report shows them beside each band.
+  
+  A word on regressions. While testing this line we found two. A crowded search failed before delivering its report, and a knockout's ratings moved one step away from the lawyer's. Both were caught by running the same matters against a lawyer's answers, and both are fixed here. Every build is now tested that way before it ships. We are tuning for three things at once: a report that is right the first time, delivered fast, at a sensible cost. They pull against each other, and each release is our best current balance.
+
+### Patch Changes
+
+- For operators: on the Anthropic engine, a search can no longer read the install's settings or other private files.
+- For operators: stages on the Anthropic engine can no longer run commands on the server; every tool that runs a command is removed from them.
+- Fixed: In a crowded field, the search now reads the spellings a lawyer would raise, rather than the ones that fit under a record limit.
+- Fixed: When a knockout's search for filings fails, the report and the audit workbook no longer show the raw error.
+- Fixed: On Windows, a failed finding card no longer shows as covered in the audit workbook.
+- Fixed: When a search could not be made, the report says so instead of giving a wrong reason.
+- Fixed: A register search limited to the client's goods now searches every other office when one office cannot filter by goods.
+- Fixed: a right the report keeps is no longer dropped because other registrations of the same right were ruled out.
+- Fixed: A knockout search no longer drops a store listing or fan wiki page its web search found; the rating now reads every result.
+- Fixed: A knockout's audit workbook also lists a part that failed as a whole, such as its filings listing or plain-language review. A filing shown without its link now says why.
+- Fixed: on a Mac, `clearotron start` no longer offers to run in the background, which only works on Linux.
+- Fixed: on a Mac, a search step could write into Clearotron's own protected folders by naming them in a different letter case. Those writes are now refused.
+- Fixed: A register search that times out across many countries is asked again in smaller parts; one that still times out is reported as incomplete.
+- Fixed: on the OpenAI engine, Codex's own sandbox no longer refuses the register searches a clearance runs.
+- For operators: on the OpenAI engine with Codex's sandbox on, the commands a search runs can no longer read the install's settings or other private files.
+- Fixed: the audit workbook's What was searched tab no longer shows a web or marketplace search that found similar listings as clean.
+- Fixed: Worldwide searches are no longer narrowed to an account's default territories, and results too crowded to read in full are no longer reported clean.
+- Fixed: A report no longer offers a native-language investigation to a client who ordered one, and says when that investigation was not completed.
+- Fixed: When a knockout's lookup of a filing owner fails, its read now says the lookup did not answer, instead of saying it found nothing.
+- New: Clearotron runs natively on Windows, from PowerShell: no WSL2, no Git and no administrator rights.
+- Fixed: a full country search's report no longer says court decisions were searched when that search failed or its source was down.
+- New: Global preliminary, multi-country and full country searches now search the web in more depth and keep more results from each search.
+- Fixed: opening a report no longer contacts any font service; the report carries its typeface, now Plus Jakarta Sans, inside itself.
+- Fixed: searches no longer reuse earlier results.
+- Fixed: skipped searches are no longer shown as unfinished in the report.
+- For operators: each stage's AI program now receives only the settings it needs, and never the key that signs access keys.
+- Fixed: The audit workbook now lists, on Coverage & gaps, any part of a report that could not be completed on the run. A knockout's Audit Trail also lists an owner lookup that got no answer.
+- Fixed: on the OpenAI engine, a Full country search now reads case law from CourtListener and Legal Data Hunter, not EUR-Lex alone.
+- Fixed: setup, `clearotron doctor` and the start of every search now check that the engine can write a file where a search writes its results.
+- New: The meaning and reputation search now asks the questions the matter's framing names, in the languages whose markets matter. Where the framing names none, the report says no meaning search ran.
+- For operators: the old default agent name is gone from the product. An install upgrading from a version before 0.2.2 must set its own agent name to keep seeing its earlier runs.
+- Fixed: The operator tool no longer accepts instructions, which never reached the run; a call sending them is refused.
+- Fixed: on the OpenAI engine, the tool that reads web pages now refuses addresses on the server's own network, such as cloud metadata addresses.
+- For operators: the background worker no longer receives the key that signs access keys. Run `clearotron start --background` once to update an installed worker.
+
 ## 0.4.0-beta.1
 
 ### Patch Changes

package/driver/ask-ledger.mjs

@@ -428,6 +428,8 @@ export function deriveAsks({
   }
 
   // 9 ── cross-checks: the common-law→register recovery nets (xcheck + recall) — directives carry
+  // (the recall receipt exists only on runs from before the recall store's removal, 2026-09-24;
+  // on a newer run `recall` is null and this family lists the cross-checks alone)
   // qids (computed executed); over-cap rows are real unanswered questions (OPEN → closure/lawyer).
   for (const [name, doc] of [["xcheck", xcheck], ["recall", recall]]) {
     for (const d of doc?.directives ?? []) {

package/driver/authority-trees.mjs

@@ -44,17 +44,97 @@
 // set-GID scar on the pool root). The existing detect-and-journal sweep STAYS as corroboration; its
 // never-kill-a-run property is sound and survives.
 
-import { resolve, sep } from "node:path";
+import { realpathSync, statSync } from "node:fs";
+import { resolve, win32, posix } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
 
-/** Is `child` inside `root` — by path segment, never by string prefix? PURE. */
-export function isInside(root, child) {
-  const r = resolve(String(root ?? ""));
-  const c = resolve(String(child ?? ""));
+/**
+ * Is `child` inside `root` — by path segment, never by string prefix? PURE.
+ *
+ * ON WINDOWS BY WINDOWS RULES. There a path may use either separator and a name matches in any case, so
+ * `c:/users/x/SKILLS/a.md` is a file inside `C:\Users\x\skills`. Compared as Linux compares, the
+ * write lands in the protected tree and the boundary lets it through. `platform` is a parameter so that
+ * branch runs on a Linux CI. `foldCase` says whether to ignore letter case: always on Windows, and
+ * elsewhere as foldsCaseAt finds the protected folder's disk, which denyReason asks for each tree.
+ */
+export function isInside(root, child, { platform = process.platform, foldCase = platform === "win32" } = {}) {
+  const P = platform === "win32" ? win32 : posix;
+  const fold = foldCase ? (s) => s.toLowerCase() : (s) => s;
+  const r = fold(P.resolve(String(root ?? "")));
+  const c = fold(P.resolve(String(child ?? "")));
   if (!r || r === "." || !c) return false;
   // `/a/skills-backup` is NOT inside `/a/skills`. A `startsWith` without the separator says it is, and
   // that is the classic form of this check being wrong in the direction that blocks real work.
-  return c === r || c.startsWith(r.endsWith(sep) ? r : r + sep);
+  return c === r || c.startsWith(r.endsWith(P.sep) ? r : r + P.sep);
+}
+
+/**
+ * The one spelling of a Windows path: no device prefix, and the long names Windows itself reports.
+ *
+ * WINDOWS REACHES ONE FILE BY SEVERAL NAMES, and the boundary compared the one it was handed. Measured on
+ * a Windows runner, 2026-09-23: a write spelled `\\?\C:\…\skills\x.md`, and a write spelled with the
+ * long name of a folder the policy had recorded by its 8.3 short name (`RUNNER~1` against
+ * `runneradmin`), both reached the protected folder and were allowed. The device prefix (`\\?\`,
+ * `\\.\`) is taken off, and the longest part of the path that exists is asked of Windows itself, which
+ * answers with the long names and follows a junction, so a junction pointing into a protected folder is
+ * inside it too. The part that does not exist yet is joined back as written. `realpath` is injected so
+ * this runs on Linux.
+ */
+export function canonicalWindowsPath(p, { realpath = realpathSync.native } = {}) {
+  const bare = String(p ?? "").replace(/^[\\/]{2}[?.][\\/]UNC[\\/]/i, "\\\\").replace(/^[\\/]{2}[?.][\\/]/, "");
+  const abs = win32.resolve(bare);
+  const rest = [];
+  for (let cur = abs; ;) {
+    try { return win32.join(realpath(cur), ...rest); }
+    catch {
+      const parent = win32.dirname(cur);
+      if (parent === cur) return abs;
+      rest.unshift(win32.basename(cur));
+      cur = parent;
+    }
+  }
+}
+
+const swapCase = (s) => [...s].map((ch) => (ch === ch.toLowerCase() ? ch.toUpperCase() : ch.toLowerCase())).join("");
+const foldMemo = new Map();
+
+/**
+ * Does the disk holding `root` ignore letter case? Asked of THAT folder, never of the platform.
+ *
+ * A Mac's default volume ignores case, so `P/SKILLS/x.md` is a file inside `P/skills`, and a boundary
+ * comparing letter for letter let the write through: measured on the macOS runner, 2026-09-23. But a Mac
+ * volume can be formatted to mind case, and a Linux folder can be set to ignore it, so the platform does
+ * not answer. The folder is stat'ed under its own name and under that name with every letter's case
+ * swapped: the same file under both means this disk ignores case. It writes nothing, so it adds nothing to
+ * a protected tree.
+ *
+ * WINDOWS ALWAYS FOLDS, as it did before this was asked, because NTFS ignores case unless a folder is set
+ * otherwise. Where the question cannot be put (the folder does not exist yet, or its name has no letters)
+ * the answer is the platform's default disk, Windows and macOS folding, so a Mac errs toward refusing. The
+ * answer is kept per folder for the life of the process. `stat` is injected so every branch runs on Linux.
+ */
+export function foldsCaseAt(root, { platform = process.platform, stat = statSync } = {}) {
+  if (platform === "win32") return true;
+  const abs = posix.resolve(String(root ?? ""));
+  const key = `${platform}|${abs}`;
+  if (foldMemo.has(key) && stat === statSync) return foldMemo.get(key);
+  const byDefault = platform === "darwin";
+  const name = posix.basename(abs);
+  let answer = byDefault;
+  const other = swapCase(name);
+  if (name && other !== name) {
+    try {
+      const own = stat(abs);
+      try {
+        const swapped = stat(posix.join(posix.dirname(abs), other));
+        answer = own.dev === swapped.dev && own.ino === swapped.ino;
+      } catch (e) {
+        answer = e?.code === "ENOENT" || e?.code === "ENOTDIR" ? false : byDefault;
+      }
+    } catch { answer = byDefault; }
+  }
+  if (stat === statSync) foldMemo.set(key, answer);
+  return answer;
 }
 
 /**
@@ -87,11 +167,13 @@ export function authorityTrees({ skillsRoots = [], profilesDir = null, runDir =
  * why it is refused, that a retry gets the same answer, and where stage output lives. No second person, no
  * imperative. The seat decides what to do with a fact, which is the whole difference.
  */
-export function denyReason(targetPath, trees) {
+export function denyReason(targetPath, trees, { platform = process.platform, foldsCase = (root) => foldsCaseAt(root, { platform }),
+  canonical = platform === "win32" ? (p) => canonicalWindowsPath(p) : (p) => p } = {}) {
   const t = String(targetPath ?? "").trim();
   if (!t) return null;
+  const target = canonical(t);
   for (const tree of trees ?? []) {
-    if (!isInside(tree.path, t)) continue;
+    if (!isInside(canonical(tree.path), target, { platform, foldCase: foldsCase(tree.path) })) continue;
     return `REFUSED by the driver's write boundary: ${t} is inside ${tree.why} (${tree.path}). `
       + `That tree is authored at deploy time and never by a running stage, so the refusal is configuration `
       + `rather than a permission prompt, and a retry of the same path returns this same answer. Stage `

package/driver/band-shape.mjs

@@ -130,7 +130,7 @@ export function classifyRecord(markText, targets) {
   if (!norm) {
     // ── — A MARK WITH NO LATIN SKELETON CAN STILL BE IDENTICAL, AND IT WAS (2026-08-14) ──────────
     //
-    // R1 retrieved TEN exact-match 色度 registrations — four REGISTERED, three in class 9, all in the
+    // R1 retrieved TEN exact-match 澜珀 registrations — four REGISTERED, three in class 9, all in the
     // matter's own classes — and the delivered report did not mention the token once. This line is
     // where they went. `normalizeElement` keeps only Latin characters, so a Han mark normalises to the
     // empty string, fell straight to `unclassifiable`, and `unclassifiable` is not one of the two tiers
@@ -139,7 +139,7 @@ export function classifyRecord(markText, targets) {
     // weighed. Retrieved, banded, positioned, and never an obligation.
     //
     // The classifier could not COMPARE them; that is true, and it is not the same as could not MATCH
-    // them. 色度 equals 色度 by inspection. The precedent is in this repo already: reference-score's
+    // them. 澜珀 equals 澜珀 by inspection. The precedent is in this repo already: reference-score's
     // matchesReference makes RAW comparison its rule 1 for exactly this case, because normalizeElement
     // keeps only [a-z0-9] and a CJK mark folds to the empty string that every Latin rule would match
     // against everything. The scorer has had that rule since R1's Chinese registration was specced. The
@@ -147,13 +147,13 @@ export function classifyRecord(markText, targets) {
     //
     // EQUALITY ONLY, DELIBERATELY. The floors are mechanical obligations a lawyer must answer row by
     // row, so every member has to be defensible without judgment: raw-equal after NFKC (which folds
-    // full-width and compatibility forms of the same characters) is that. Containment is not — 色度計
-    // contains 色度 and is a different mark — and whether it matters is judgment's call, reached
+    // full-width and compatibility forms of the same characters) is that. Containment is not — 澜珀計
+    // contains 澜珀 and is a different mark — and whether it matters is judgment's call, reached
     // through the same-family tiers and the crowd descriptors, not by widening a floor.
     //
     // THIS PARAGRAPH USED TO SAY "narrower than the scorer's rule", and it was right when it was
     // written: matchesReference's script rule was unowned containment in both directions until,
-    // which scored gold 色度 as retrieved off a different proprietor's 色度花间. The scorer now takes
+    // which scored gold 澜珀 as retrieved off a different proprietor's longer mark that contains it. The scorer now takes
     // equality too, with one owner-gated containment escape the floors deliberately do not have. The
     // two agree; neither is the looser one any more.
     const raw = text.normalize("NFKC").trim();

package/driver/case-law-ledger.mjs

@@ -36,7 +36,18 @@
 // "no node imports → tests offline" invariant, exactly as connotation-search.mjs already does.
 import { abbrev } from "./repair-contract.mjs";
 
-export const CASE_LAW_LEDGER_SCHEMA_VERSION = 1;
+// Version 2 is the one whose instruction tells the model to write `null` for a query it could not send,
+// and never 0. At version 1 a 0 could mean either, so a reader may not count one as a search that ran.
+export const CASE_LAW_LEDGER_SCHEMA_VERSION = 2;
+
+// WHAT A RECORD THAT NAMES NO VERSION IS. The oldest, never the newest. Defaulting an unversioned record
+// to whatever this build happens to be at hands it every promise the current instruction makes, which is
+// exactly backwards: the records that name no version are the ones written before the field was asked
+// for, and their zeros are the ambiguous kind. Read low, and a record only gains a promise by claiming it.
+export const CASE_LAW_LEDGER_OLDEST_SCHEMA = 1;
+
+/** Version 2 and up separate "sent and returned nothing" (0) from "never sent" (null). */
+export const ledgerSeparatesUnsentQueries = (ledger) => Number(ledger?.schema_version) >= 2;
 
 /**
  * How far a proceeding got. `read` is the only state that discharges a depth dive, and the distinction
@@ -91,11 +102,16 @@ export function parseCaseLawLedger(raw) {
   return {
     error: null,
     ledger: {
-      schema_version: Number(parsed.schema_version) || CASE_LAW_LEDGER_SCHEMA_VERSION,
+      schema_version: Number(parsed.schema_version) || CASE_LAW_LEDGER_OLDEST_SCHEMA,
       queries: queries.filter((q) => q && typeof q === "object").map((q) => ({
         query: str(q.query),
         jurisdiction: str(q.jurisdiction),
-        results: Number.isFinite(Number(q.results)) ? Number(q.results) : null,
+        // NULL STAYS NULL, and this is load-bearing from version 2 on. `Number(null)` is 0 and
+        // `Number("")` is 0, both finite, so the obvious coercion turns the record's "I could not send
+        // this query" into "I sent it and got nothing" — the very two the version exists to separate,
+        // collapsed by the parser before any reader sees them. Only a value that genuinely is a number
+        // becomes one; everything else is null, which is the record declining to give a count.
+        results: q.results == null || q.results === "" || Number.isNaN(Number(q.results)) ? null : Number(q.results),
       })),
       citations: citations.filter((c) => c && typeof c === "object").map((c) => ({
         proceeding: str(c.proceeding),

package/driver/claim-liveness.mjs

@@ -35,6 +35,7 @@ import { readFileSync, readdirSync, statSync } from "node:fs";
 import { spawnSync } from "node:child_process";   // — the birth stamp where there is no /proc
 import { join } from "node:path";
 import { config } from "./driver.config.mjs";
+import { windowsProcessScript, parseWindowsRows, defaultRunPowerShell } from "../shared/process-table.mjs";   // the birth stamp on Windows
 
 // ── B2 — fail-safe claim liveness ────────────────────────────────────────────────────────────────────
 // The .pid sidecar records "<pid>:<starttime>" (starttime = field 22 of /proc/<pid>/stat, the kernel's
@@ -42,7 +43,7 @@ import { config } from "./driver.config.mjs";
 // impersonate a dead claimer and rot its `.processing` forever. Legacy bare-pid sidecars still parse
 // (starttime null → pid-aliveness is all we have, today's behavior). All exported for unit tests.
 export function procStarttime(pid, readStat = undefined,
-  { platform = process.platform, readPsStart = defaultReadPsStart } = {}) {
+  { platform = process.platform, readPsStart = defaultReadPsStart, runPowerShell = defaultRunPowerShell } = {}) {
   // AN INJECTED READER IS THE CALLER'S STATEMENT ABOUT HOW TO READ, and it outranks the platform.
   //
   // Measured on macOS (the verification run): the arm that pins the field-22
@@ -61,6 +62,7 @@ export function procStarttime(pid, readStat = undefined,
       return stat.slice(stat.lastIndexOf(")") + 2).trim().split(/\s+/)[19] ?? null;
     } catch { return null; }
   }
+  if (platform === "win32") return windowsStarttime(pid, runPowerShell);
   // ── — THE SAME DEFENCE WHERE THERE IS NO /proc ─────────────────────────
   //
   // Returning null here was not a neutral degradation. `claimToken` announces it and falls back to a
@@ -82,6 +84,33 @@ export function procStarttime(pid, readStat = undefined,
   } catch { return null; }
 }
 
+// ── WINDOWS: NEITHER /proc NOR ps ────────────────────────────────────────────────────────────────────
+//
+// Without a stamp on Windows the portal said nothing was draining the queue while the worker ran, which
+// is the false alarm described above, and a claim held by a dead runner stayed held until the max-claim-age
+// ceiling. That second cost is larger on Windows than anywhere else, because Windows hands a freed pid to
+// the next process soon after. So the stamp is read from the system's process list, through PowerShell:
+// the creation time as epoch milliseconds, the same reader `processTable` uses, so a stamp written from
+// one is compared with a stamp read by the same code.
+//
+// ONE PROCESS IS REMEMBERED: this one. Its start cannot change while it runs, and the heartbeat and the
+// status stamp ask for it on every tick, each a PowerShell start. Every other pid is read afresh, for the
+// reason above: a remembered stamp is the dead process's, handed to whatever now wears its number.
+let ownWindowsStamp;
+function windowsStarttime(pid, runPowerShell) {
+  if (!Number.isInteger(pid) || pid <= 0) return null;
+  const own = pid === process.pid && runPowerShell === defaultRunPowerShell;
+  if (own && ownWindowsStamp) return ownWindowsStamp;
+  let row = null;
+  try {
+    const r = runPowerShell(windowsProcessScript(pid));
+    if (r && r.status === 0) row = parseWindowsRows(r.stdout).find((p) => p.pid === pid) ?? null;
+  } catch { return null; }
+  const stamp = row && Number.isFinite(row.startedAt) ? String(row.startedAt) : null;
+  if (own && stamp) ownWindowsStamp = stamp;
+  return stamp;
+}
+
 /** `ps` is POSIX and is on macOS. Empty stdout (no such pid) parses to NaN above, which is `null`. */
 function defaultReadPsStart(pid) {
   const r = spawnSync("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8" });

package/driver/clearance-variants-record.mjs

@@ -130,8 +130,15 @@ export function renderClearanceVariants(model, scopeRows) {
   const out = ["# Variant manifest", ""];
   out.push(`## Mark: ${model.mark}`, "", `Dominant element: ${model.dominant_element}`, "");
 
-  out.push("### Elements", "", "| Value | Kind |", "|---|---|");
-  for (const e of model.elements) out.push(`| ${e.value} | ${e.kind} |`);
+  // The famous-mark column appears only when an element carries the flag, so a manifest with none reads
+  // exactly as it did before the flag existed.
+  if (model.elements.some((e) => e.famous_mark_flag)) {
+    out.push("### Elements", "", "| Value | Kind | Famous-mark check |", "|---|---|---|");
+    for (const e of model.elements) out.push(`| ${e.value} | ${e.kind} | ${e.famous_mark_flag ? "yes" : ""} |`);
+  } else {
+    out.push("### Elements", "", "| Value | Kind |", "|---|---|");
+    for (const e of model.elements) out.push(`| ${e.value} | ${e.kind} |`);
+  }
   out.push("");
 
   out.push(`### Variants (${model.variants.length})`, "", "| Value | Category | Romanisation | Rationale |", "|---|---|---|---|");
@@ -172,7 +179,7 @@ export function renderClearanceVariants(model, scopeRows) {
 /** The shape this tool declares, at every depth — what the ACCEPTOR enforces. */
 const DECLARED = Object.freeze({
   "": ["mark", "dominant_element", "elements", "variants", "incumbent_classes", "search_floor", "watchlist_owners", "goods_words", "scope_ledger"],
-  elements: ["value", "kind"],
+  elements: ["value", "kind", "famous_mark_flag"],
   variants: ["value", "category", "rationale", "romanization"],
   scope_ledger: ["layer", "item", "status", "reason", "reopen_trigger"],
 });

package/driver/common-law-receipts.mjs

@@ -30,6 +30,7 @@ export const MIN_CELLS_PER_VARIANT = 7;
 // It composes `queryKey`, which is the one author of what "the same text" means across a provider
 // boundary, and keeps its own wrapping-quote strip because a term arrives quoted here and does not there.
 import { queryKey } from "./connotation-search.mjs";
+import { dictatedCells } from "../providers/perplexity/src/core.js";   // what the spec asks, product or blocks
 
 const norm = (s) => queryKey(String(s || "").trim().replace(/^["'`\u2018\u2019\u201c\u201d]+|["'`\u2018\u2019\u201c\u201d]+$/g, ""));
 
@@ -285,6 +286,30 @@ export function findGridLedgerViolations(manifestOrTerms, ledgerRaw, { minCellsP
   return shortVariants(variants, (term) => platforms.get(norm(term))?.size || 0, minCellsPerVariant);
 }
 
+/**
+ * — THE RECEIPTS JOIN FOR A GRID IN BLOCKS: every cell the spec dictated ran — a cell or a recorded gap in
+ * the ledger — judged cell by cell. The count and identity joins below assume every term owes every
+ * platform, which a grid the matter frame decided does not ask. Same {variant, cells, expected} shape as
+ * findGridLedgerViolations, plus the platforms still owed, so the `grid_join_missing` token is unchanged.
+ * Throws on an unparseable ledger.
+ *
+ * @returns {Array<{variant:string, cells:number, expected:number, missing:string[]}>}
+ */
+export function findUnranDictatedCells(spec, ledgerRaw) {
+  const map = parseGridLedger(ledgerRaw);
+  const owed = new Map();   // term → [platform, ran?]
+  for (const [term, platform] of dictatedCells(spec)) {
+    if (!owed.has(term)) owed.set(term, []);
+    owed.get(term).push([platform, map.get(norm(term))?.has(norm(platform)) === true]);
+  }
+  const out = [];
+  for (const [variant, rows] of owed) {
+    const missing = rows.filter(([, ran]) => !ran).map(([p]) => p);
+    if (missing.length) out.push({ variant, cells: rows.length - missing.length, expected: rows.length, missing });
+  }
+  return out;
+}
+
 // ── WS-B: platform-identity join (per-customer profiles) ────────────────────────────────────────────────
 // The count floor proves HOW MANY distinct platforms each variant accounted for — never WHICH. With a
 // dictated per-customer platform list, a worker on gaming habit could sweep the wrong marketplaces and
@@ -674,6 +699,10 @@ export function splitGridSpec(spec, { outputPaths = {}, dispositionsPaths = {} }
       // The meaning seat sweeps no cells. `terms: []` is what makes its dispatch the meaning work and
       // nothing else, and it is why the grid halves keep an untouched 50/50 parity split.
       terms: isMeaning ? [] : terms[h],
+      // A grid in blocks keeps its blocks, each cut to this half's terms (a term owns all its cells in one half).
+      ...(Array.isArray(spec.grids) ? { grids: spec.grids.map((g) => ({ terms: g.terms.filter((t) => !isMeaning && terms[h].includes(t)), platforms: g.platforms })).filter((g) => g.terms.length) } : {}),
+      // The famous-mark record names only the cells this seat runs.
+      ...(Array.isArray(spec.famous) ? { famous: spec.famous.filter((t) => !isMeaning && terms[h].includes(t)) } : {}),
       output_path: outputPaths[h] ?? spec.output_path,
       // The disposition_required stamp still rides BOTH halves: it is the receipt-presence arm, and a
       // stray pr_risk block in the non-owning half must still be judged rather than waved through.
@@ -714,7 +743,8 @@ export function splitGridSpec(spec, { outputPaths = {}, dispositionsPaths = {} }
  *     batch has since closed is dropped). This is the never-thinner guarantee: every dictated cell is
  *     accounted as a real cell or an HONEST gap, so a half failure can never yield a ledger that is
  *     thinner but still valid. A half's honestly-recorded gap for a cell OUTSIDE the spec (a re-keyed
- *     variant / an extra swept platform) is UNIONED in too — the spec-only recompute would erase it.
+ *     variant / an extra swept platform) is UNIONED in too — the spec-only recompute would erase it,
+ *     except a meaning query's gap row when the merged receipts answer that query.
  *   - extras.pr_risk[]: concatenated (a then b), deduped by trimmed query — restores the full dictated
  *     meaning-receipt set from the per-half partitions. Other extras keys: arrays concatenate,
  *     anything else first-defined wins.
@@ -773,23 +803,32 @@ export function mergeGrids(a, b, { spec, halfErrors = {} } = {}) {
   // gaps: recomputed against the FULL spec
   const halfTerms = splitGridTerms(spec?.terms ?? []);
   const gaps = [];
-  for (const term of spec?.terms ?? []) {
-    for (const platform of spec?.platforms ?? []) {
-      if (seen.has(key(term, platform))) continue;
-      const owner = halfOfTerm(halfTerms, term);
-      const error = gapErr.get(key(term, platform))?.error
-        || (owner && halfErrors[owner]) || "cell not accounted by either half-grid";
-      gaps.push({ term, platform, error });
-    }
+  // Over the cells the spec DICTATES, never terms × platforms: a grid the frame decided is blocks, and the
+  // product of its unions would make a gap of every cell nobody asked for, which the closure pass would run.
+  for (const [term, platform] of spec ? dictatedCells(spec) : []) {
+    if (seen.has(key(term, platform))) continue;
+    const owner = halfOfTerm(halfTerms, term);
+    const error = gapErr.get(key(term, platform))?.error
+      || (owner && halfErrors[owner]) || "cell not accounted by either half-grid";
+    gaps.push({ term, platform, error });
   }
   // UNION honestly-recorded NON-SPEC gap rows: a half may record a gap for a cell OUTSIDE the canonical
   // spec (a legitimately re-keyed variant / an extra platform a half swept). The spec-only recompute above
   // never emits those, silently erasing an honestly-recorded coverage gap — union them so an honest gap
   // survives the merge. A cell present in cells[] still wins (a stale gap a supplementary batch has since
   // closed is dropped exactly as for spec cells), and a gap already emitted by the spec loop is not doubled.
+  //
+  // A MEANING QUERY THE MERGED RECEIPTS ANSWER KEEPS NO GAP ROW. The grid tool records one for each dictated
+  // query its program did not return, and the engine's re-issue can answer that query later in the same
+  // ledger. Kept beside the answer, the row says a search did not complete when it did, and the closure pass
+  // takes every gap row for a store cell, so it searches the query again on a site called "connotation".
+  // Queries are matched as the receipts are (norm).
+  const answered = new Set((Array.isArray(extras.pr_risk) ? extras.pr_risk : [])
+    .map((e) => (typeof e?.query === "string" ? norm(e.query) : "")).filter(Boolean));
   const gappedKeys = new Set(gaps.map((g) => key(g.term, g.platform)));
   for (const [k, g] of gapErr) {
     if (seen.has(k) || gappedKeys.has(k)) continue;
+    if (String(g.platform).toLowerCase() === "connotation" && answered.has(norm(g.term))) continue;
     gaps.push({ term: g.term, platform: g.platform, error: g.error || "cell not accounted by either half-grid" });
   }
   return { cells, extras, gaps };
@@ -926,7 +965,16 @@ export function findSimilarListingSignals(findingsContent) {
   const signals = [];
   const OWNER_RE = /(?:developer|publisher|seller|owner)(?:\s+|_)of(?:\s+|_)record\W{0,5}([^\n|]+)/i;
   const OWNER_SKIP_RE = /not extracted|unknown|n\/a|none|^[\s—–-]*$/i;
+  // A table whose header lists the of-record fields matches OWNER_RE on its first label and captures the
+  // next one, so a label reached the register as an owner's name ("publisherofrecord", once its
+  // underscores were stripped). A label is never a name.
+  const OWNER_LABEL_RE = /^(?:developer|publisher|seller|owner)[\s_]*of[\s_]*record\b/i;
   const URL_RE = /https?:\/\/[^\s)|\]">]+/;
+  // A TABLE'S HEADER ROW NAMES COLUMNS, NEVER AN OWNER, whatever column follows an of-record label ("URL",
+  // "Store"). It is the row a separator row follows, and both are table rows: a bare "---" under an owner's
+  // line is a rule, not a separator, and the owner stands.
+  const SEPARATOR_RE = /^\s*\|?\s*:?-{3,}:?\s*(?:\|\s*:?-{3,}:?\s*)*\|?\s*$/;
+  const headerRow = (ln, next) => ln.includes("|") && String(next ?? "").includes("|") && SEPARATOR_RE.test(next);
   let inMatrix = false, inFindings = false;
   let block = null;   // { markText, owner, url }
   const flush = () => {
@@ -935,7 +983,9 @@ export function findSimilarListingSignals(findingsContent) {
     }
     block = null;
   };
-  for (const ln of (findingsContent || "").split("\n")) {
+  const lines = (findingsContent || "").split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const ln = lines[i];
     const h = ln.match(/^(#{1,6})\s+(.*)/);
     if (h) {
       const title = h[2];
@@ -958,10 +1008,10 @@ export function findSimilarListingSignals(findingsContent) {
       continue;
     }
     if (inFindings && block) {
-      const om = ln.match(OWNER_RE);
+      const om = headerRow(ln, lines[i + 1]) ? null : ln.match(OWNER_RE);
       if (om && !block.owner) {
         const owner = om[1].replace(/[*_`]/g, "").trim();
-        if (owner && !OWNER_SKIP_RE.test(owner)) block.owner = owner.slice(0, 120);
+        if (owner && !OWNER_SKIP_RE.test(owner) && !OWNER_LABEL_RE.test(om[1].trim())) block.owner = owner.slice(0, 120);
       }
       const um = ln.match(URL_RE);
       if (um && !block.url) block.url = um[0];

package/driver/commonlaw-carry.mjs

@@ -39,7 +39,7 @@
 // ── THE NON-LATIN TRAP IS ANSWERED, NOT AVOIDED ──────────────────────────────────────────────────────
 //
 // `normalizeJoinText` folds every non-[A-Za-z0-9] run to a space, so it returns the EMPTY STRING for
-// 色度, 冰沙, 瓦波冰沙, ワボスラッシュ and 와보 슬러시. A mark-keyed trace is structurally blind to
+// 澜珀, 冰沙, 瓦波冰沙, ワボスラッシュ and 와보 슬러시. A mark-keyed trace is structurally blind to
 // every one of them.
 //
 // NOTHING HERE TOUCHES IT. A Han-script candidate joins on its ASCII/percent-encoded URL. A Han-script