clearotron 0.4.0-beta.2 → 0.4.0-beta.3

package/scripts/e2e.mjs

@@ -57,6 +57,7 @@ import { isLiveQueueMarker, isQueueSidecar, liveQueueState, LIVE_QUEUE_STATES, T
 // leave the real one to park tomorrow's re-run as a duplicate. usage-ledger.mjs is a pure leaf too
 // (node:fs + node:path + queue-markers.mjs), so it drags no driver machinery in either.
 import { matterLedgerPath } from "../driver/usage-ledger.mjs";
+import { registerServedLine } from "../driver/register-served.mjs";   // which register a run recorded as having served it
 import { probeWorker } from "../driver/queue-watch-probe.mjs";   // the drain this deployment actually has
 // Teardown asks whether a process is actually producing a run before it rewrites the record that says so.
 import { claimLivenessForCodename, claimForbidsDestruction } from "../driver/claim-liveness.mjs";
@@ -1213,6 +1214,11 @@ export function outboxPackets({ runId = null, runIds = [], queueBase = null } =
   return { packets: [...hit].sort(), unreadable: null };
 }
 
+// WITHHELD UNLESS ASKED, and the default is off so nothing has to remember to turn it on. Set once from
+// argv; `evalAssertion` takes it as an option so a test can drive both paths without touching argv.
+export let REPORT_NAMES = false;
+export const setReportNames = (v) => { REPORT_NAMES = Boolean(v); };
+
 // ── assertions ───────────────────────────────────────────────────────────────────────────────────────
 // Every op is implemented or explicitly reported UNIMPLEMENTED. An op that silently passes because
 // nobody wrote it is the exact failure mode this whole suite exists to prevent.
@@ -1339,7 +1345,70 @@ function bandShapeUnder(full, file, field) {
   return { doc, unread, shallow, verdict };
 }
 
-function evalAssertion(a, runDir) {
+/**
+ * A quotation from a RUN, or where to find it.
+ *
+ * WHY THIS EXISTS. `report` is the cheap instrument — free, re-runnable, and the doctrine tells a lane to
+ * re-run it rather than re-run the clearance — so it is the one most often pointed at a real matter, in a
+ * session that records whatever it prints. Its INVESTIGATE rows earned their usefulness by showing the
+ * sentence they object to, and that sentence is the engine's own words about a client's matter.
+ *
+ * A LOCATION IS AS ACTIONABLE AS A QUOTE AND CARRIES NOTHING. "sentence 14 of knockout-findings.md" sends
+ * a reader to the same words, in the file that already holds them, without copying them anywhere else.
+ * The one job that needs them on the page — reading a surprising row against the text — asks with
+ * `--names`, the same flag the scorer takes for the same reason.
+ *
+ * The count is never withheld. How many claims exceeded their evidence is the finding; which words they
+ * used is the detail.
+ */
+/**
+ * One door's refusal line.
+ *
+ * A DOOR'S REFUSAL TEXT IS THE DOOR'S, NOT OURS, and that is the reason to gate it rather than a reason
+ * not to. Measured across every receipt on this box — 397 door answers, 213 refusals, 113 distinct
+ * reasons — not one echoes the order: they carry an HTTP status and the server's own error envelope, or
+ * a socket error. So this guards a case that has not happened, and it is worth one line, because the
+ * half of these that CAN echo is structural: an `initialize` refusal is sent before any order exists and
+ * cannot carry one, a `tools/call` refusal is sent after and can. Which it does is the door's own
+ * error-message discipline, which nothing here governs and no clipping saves — an echoing server puts
+ * the mark near the front, well inside the 160 characters this used to print.
+ *
+ * A MISSING REASON IS NOT A WITHHELD ONE. "(no reason recorded)" is a fact about the receipt and says so
+ * plainly; offering to print it with `--names` would promise words that do not exist.
+ */
+export function doorReasonLine(r, names = REPORT_NAMES) {
+  if (r?.reason == null || String(r.reason).trim() === "") return "(no reason recorded)";
+  return fromTheRun({ names, quotes: [String(r.reason)],
+    where: "the door's own words are in the round receipt, at rounds[].cases[].answers[].reason" });
+}
+
+function fromTheRun({ names, quotes, where }) {
+  // THE LOCATION IS KEPT WHEN THE WORDS ARE SHOWN. It costs one clause beside the quotation it stands in
+  // for, and a reader chasing a surprising row wants to go and read around it rather than only at it.
+  if (names) return `${quotes.map((q) => `"${String(q).slice(0, 160)}"`).join(" · ")} (${where})`;
+  return `${where} — run again with --names to read them here`;
+}
+
+/**
+ * The row that fires when a listing does not hold the mark an assertion asked for.
+ *
+ * It is the WIDEST row in either floor op: it printed the name asked for and every name the listing did
+ * hold, in clear, with no flag involved, and it fires precisely when somebody is investigating — a mark
+ * is absent, so a reader is reading the report. It exists twice, once per floor op, with one verb each.
+ *
+ * The COUNT is never withheld. A listing that held nothing is a different defect from one that held four
+ * other marks, and that distinction is the finding.
+ */
+function noSuchMark({ names, field, marks, file, verb }) {
+  const listed = (marks ?? []).map((x) => x?.name).filter((x) => typeof x === "string");
+  return { ok: false, saw: `the asked-for mark is not in ${file}, which ${verb} ${listed.length} mark(s)`
+    + (listed.length
+      ? ` — ${fromTheRun({ names, quotes: [field, ...listed],
+          where: `the name asked for is the field of this assertion's path, and the names ${verb} are the "marks" array of ${file}` })}`
+      : "") };
+}
+
+function evalAssertion(a, runDir, { names = REPORT_NAMES } = {}) {
   const [file, field] = String(a.path ?? "").split(":");
   const full = join(runDir, file || "");
 
@@ -1566,13 +1635,19 @@ function evalAssertion(a, runDir) {
     const held = recordsFile
       ? (recordsFile.marks ?? []).reduce((n, m) => n + (m.records ?? []).length, 0)
       : null;
-    const bad = sentences.filter((s) => aboutRegister.test(s) && !staysInside.test(s)
+    // Carried WITH ITS POSITION, because the index is what a withheld row prints instead of the words.
+    // `indexOf` on the sentence would be wrong the moment a document repeats one: both rows would send
+    // the reader to the first copy, and a run that says the same thing twice is exactly the run somebody
+    // is reading the report about.
+    const badAt = sentences.map((s, i) => ({ s, i })).filter(({ s }) => aboutRegister.test(s) && !staysInside.test(s)
       && (exceedsACount.test(s) || (singularAbsence.test(s) && !(held > 0))));
+    const bad = badAt.map(({ s }) => s);
     const basis = held === null
       ? "_driver/register-records.json is absent or unreadable, so this is as strict as a run holding zero records — identical verdict, different reason: one is a fact about the search, this is a fact about the check's own evidence"
       : `the run holds ${held} register record(s), so a status read off one is supported and only a claim over the field is not`;
     return { ok: bad.length === 0,
-      saw: bad.length ? `${bad.length} register claim(s) wider than the records this run holds — ${bad.slice(0, 2).map((s) => `"${s.slice(0, 120)}"`).join(" · ")} (${basis})`
+      saw: bad.length ? `${bad.length} register claim(s) wider than the records this run holds — `
+        + `${fromTheRun({ names, quotes: bad.slice(0, 2), where: `sentence ${badAt.slice(0, 2).map(({ i }) => i + 1).join(" and ")} of ${file}` })} (${basis})`
         : `${sentences.filter((s) => aboutRegister.test(s)).length} register sentence(s), each a count, a labelled expectation, or a status the records support — ${basis}` };
   }
   // `survivor-not-clear` — a mark this lane did not knock out is a SURVIVOR, never a clear. The two words
@@ -1712,7 +1787,7 @@ function evalAssertion(a, runDir) {
     const want = field ? String(field).trim().toLowerCase() : null;
     if (!want) return { ok: false, saw: "no mark given (path must be <file>:<MARK NAME>)" };
     const m = (doc.marks ?? []).find((x) => String(x?.name ?? "").trim().toLowerCase() === want);
-    if (!m) return { ok: false, saw: `no mark ${JSON.stringify(field)} in ${file} — it counted ${(doc.marks ?? []).map((x) => JSON.stringify(x?.name)).join(", ") || "nothing"}` };
+    if (!m) return noSuchMark({ names, field, marks: doc.marks, file, verb: "counted" });
     const floors = a.value && typeof a.value === "object" ? a.value : null;
     if (!floors) return { ok: false, saw: "value must be an object of predicate floors, e.g. {\"identical\": 45}" };
     const saw = [], short = [], untaken = [];
@@ -1720,7 +1795,12 @@ function evalAssertion(a, runDir) {
       const cell = m.counts?.[pred];
       if (!cell) { untaken.push(`${pred}: no such predicate on this run's sidecar`); continue; }
       if (!Number.isFinite(cell.total)) {
-        untaken.push(`${pred}: NOT TAKEN — ${String(cell.unavailable ?? "no reason recorded").slice(0, 160)}`);
+        // THE SAME FIELD AND THE SAME PROVENANCE as the `unavailable` twenty lines below, which is
+        // withheld — this one is the engine's own prose about why a count could not be taken, out of the
+        // run's sidecar. Withheld with it, and located by the predicate it belongs to.
+        untaken.push(`${pred}: NOT TAKEN — ${cell.unavailable === undefined || cell.unavailable === null
+          ? "no reason recorded"
+          : fromTheRun({ names, quotes: [String(cell.unavailable)], where: `the reason is counts.${pred}.unavailable of ${file}` })}`);
         continue;
       }
       saw.push(`${pred}=${cell.total} (floor ${floor})`);
@@ -1744,11 +1824,14 @@ function evalAssertion(a, runDir) {
     if (!existsSync(full)) return { ok: false, saw: `${file} absent — the filings lane wrote nothing, not even its refusal` };
     const doc = readJson(full);
     if (!doc) return { ok: false, saw: `${file} present but unparseable` };
-    if (doc.unavailable) return { ok: false, saw: `the filings were never listed — ${String(doc.unavailable).slice(0, 200)}. A listing that was refused is not a register that holds nothing.` };
+    if (doc.unavailable) return { ok: false, saw: `the filings were never listed — `
+      + `${fromTheRun({ names, quotes: [String(doc.unavailable)], where: `the reason is the "unavailable" field of ${file}` })}. `
+      + `A listing that was refused is not a register that holds nothing.` };
     const want = field ? String(field).trim().toLowerCase() : null;
     if (!want) return { ok: false, saw: "no mark given (path must be <file>:<MARK NAME>)" };
-    const m = (doc.marks ?? []).find((x) => String(x?.name ?? "").trim().toLowerCase() === want);
-    if (!m) return { ok: false, saw: `no mark ${JSON.stringify(field)} in ${file} — it listed ${(doc.marks ?? []).map((x) => JSON.stringify(x?.name)).join(", ") || "nothing"}` };
+    const markIndex = (doc.marks ?? []).findIndex((x) => String(x?.name ?? "").trim().toLowerCase() === want);
+    const m = markIndex === -1 ? null : doc.marks[markIndex];
+    if (!m) return noSuchMark({ names, field, marks: doc.marks, file, verb: "listed" });
     const floors = a.value && typeof a.value === "object" ? a.value : {};
     const minRecords = Number.isFinite(floors.records) ? floors.records : 1;
     const minOffices = Number.isFinite(floors.offices) ? floors.offices : 1;
@@ -1756,8 +1839,15 @@ function evalAssertion(a, runDir) {
     const offices = [...new Set(records.map((r) => String(r?.territory ?? "").trim().toLowerCase()).filter(Boolean))];
     // A term the register refused is REDUCED COVERAGE, and it is named whichever way the floor goes: met,
     // it qualifies what was proved; missed, it says the shortfall may be the fetch rather than the register.
-    const failed = (m.terms ?? []).filter((t) => t?.ok !== true)
-      .map((t) => `${t?.term ?? "?"}: ${String(t?.reason ?? "no reason recorded").slice(0, 120)}`);
+    // A TERM IS A SPELLING OF A MARK and the reason is the engine's own prose, so both are withheld by
+    // default; the INDEX still says which of the run's terms to go and read.
+    const failedRows = (m.terms ?? []).map((t, i) => ({ t, i })).filter(({ t }) => t?.ok !== true);
+    const failed = names
+      ? failedRows.map(({ t }) => `${t?.term ?? "?"}: ${String(t?.reason ?? "no reason recorded").slice(0, 120)}`)
+      // NAMED BY POSITION IN THE FILE, both coordinates. `term 2 of knockout-filings.json` is ambiguous
+      // the moment the listing holds more than one mark, and it always does — so the row would send a
+      // reader to a term belonging to a different mark and read just as confidently.
+      : failedRows.map(({ i }) => `term ${i + 1} of mark ${markIndex + 1} of ${file}`);
     const met = records.length >= minRecords && offices.length >= minOffices;
     const body = `${records.length} record(s) (floor ${minRecords}) across ${offices.length} office(s) [${offices.join(", ") || "none"}] (floor ${minOffices})`;
     if (met) return { ok: true, saw: failed.length ? `${body} — floor met, but ${failed.length} term(s) were refused and this run covered less than it asked for: ${failed.join(" · ")}` : body };
@@ -3091,6 +3181,10 @@ async function cmdReport(id, { round: requestedToken = null } = {}) {
       // — the handover's "commit SHA on test" field, READ rather than reconstructed. An absence
       // is printed as itself: a run that predates the stamp has none, and inventing one from a reflog
       // is the reconstruction this replaces.
+      // — WHICH REGISTER SERVED IT, beside the engine build because it is the same class of fact: what
+      // this run actually ran against, read as a field rather than searched for as a substring. An absence
+      // prints as itself, because "not recorded" is not "none served" and a reader must not have to guess.
+      console.log(`         register: ${registerServedLine(readJson(join(run.runDir, "status.json")))}`);
       const eb = engineBuildOf(run.runDir);
       if (!eb) console.log(`         engine build: NOT RECORDED — this run predates the run-start stamp (#1423); any attribution for it is a reflog reconstruction`);
       else {
@@ -3177,7 +3271,7 @@ async function cmdReport(id, { round: requestedToken = null } = {}) {
           notProbed.push(`${ref}: the doors refused, but this receipt records no REASON — re-run with the current e2e.mjs to check expect.reasonMatches`);
           console.log(`  reason: NOT RECORDED by the round that wrote this receipt — not a pass`);
         } else {
-          for (const r of refusal.reasons) console.log(`      [${r.door}] ${String(r.reason ?? "(no reason recorded)").slice(0, 160)}`);
+          for (const r of refusal.reasons) console.log(`      [${r.door}] ${doorReasonLine(r)}`);
           if (refusal.wantReason && refusal.missed.length)
             toInvestigate.push(`${ref}: refused, but ${refusal.missed.join(", ")} did not say "${refusal.wantReason}" — a refusal for the wrong reason reads exactly like the right one`);
           else if (refusal.wantReason) console.log(`  [ ok ] every door's reason carries "${refusal.wantReason}"`);
@@ -4040,7 +4134,7 @@ function cmdTeardown(id) {
 // stamp can never disagree about whether a round is done.
 // adds `SCENARIO_FILE` — the ONE filename pattern, exported so the test that pins the widening
 // reads the same regex `list` and the sweep read, rather than a copy that agrees today.
-export { evalAssertion, OPS, queueDrainState, DOORS, runLedger, investigate, brief, secs, queueOutcomes,
+export { evalAssertion, fromTheRun, OPS, queueDrainState, DOORS, runLedger, investigate, brief, secs, queueOutcomes,
   TERMINAL_BY_SUFFIX, TERMINAL_BY_SUFFIX_RAN, SCENARIO_FILE };
 
 // ── main ─────────────────────────────────────────────────────────────────────────────────────────────
@@ -4064,6 +4158,10 @@ if (invokedDirectly) {
     if (a === "--round") {
       requestedRound = raw[++i] ?? null;
       if (!requestedRound || requestedRound.startsWith("--")) die("--round needs a round TOKEN: e2e.mjs report <ID> --round <token>\n  The token is on `run`'s output and in the ROUNDS block of any report.");
+    } else if (a === "--names") {
+      // The words the run wrote, on the page. Off by default because `report` is the cheap instrument and
+      // is pointed at real matters in sessions that record what they print.
+      setReportNames(true);
     } else if (a.startsWith("--round=")) {
       requestedRound = a.slice("--round=".length);
       if (!requestedRound) die("--round= needs a round TOKEN: e2e.mjs report <ID> --round=<token>");
@@ -4071,13 +4169,13 @@ if (invokedDirectly) {
   }
   const [cmd, arg, ...extra] = positional;
   if (extra.length) die(`unexpected argument "${extra[0]}"\n`
-    + "usage: e2e.mjs list | run <ID> [--stale] | status | report <ID> [--round <token>] | teardown <ID> [--waive-unread]");
+    + "usage: e2e.mjs list | run <ID> [--stale] | status | report <ID> [--round <token>] [--names] | teardown <ID> [--waive-unread]");
   switch (cmd) {
     case "list": cmdList(); break;
     case "run": if (!arg) die("usage: e2e.mjs run <ID> [--stale]"); await cmdRun(arg); break;
     case "status": cmdStatus(); break;
-    case "report": if (!arg) die("usage: e2e.mjs report <ID> [--round <token>]"); await cmdReport(arg, { round: requestedRound }); break;
+    case "report": if (!arg) die("usage: e2e.mjs report <ID> [--round <token>] [--names]"); await cmdReport(arg, { round: requestedRound }); break;
     case "teardown": if (!arg) die("usage: e2e.mjs teardown <ID> [--waive-unread]"); cmdTeardown(arg); break;
-    default: die("usage: e2e.mjs list | run <ID> [--stale] | status | report <ID> [--round <token>] | teardown <ID> [--waive-unread]");
+    default: die("usage: e2e.mjs list | run <ID> [--stale] | status | report <ID> [--round <token>] [--names] | teardown <ID> [--waive-unread]");
   }
 }

package/scripts/mint-reference-strip-backlog.mjs

@@ -36,17 +36,51 @@ if (p.laid) console.log(`mint-reference-strip-backlog: ${p.laid} tracked path(s)
 const tracked = p.files;
 const minted = censusOf(ROOT, tracked, publishedReader(ROOT, (f) => readFileSync(join(ROOT, f), "utf8")));
 
+// ── EVERY ROW IS EXPLAINED, OR THE TABLE IS A NUMBER NOBODY CAN ACT ON ────────────────────────────
+//
+// A count on its own tells a reader a file has residue in it. It does not tell them whether the line is
+// residue at all — and once the table reached zero, the next row to appear is either a regression to
+// repair or a known-good the scanner cannot tell from one. The first `.js` row is the second kind: an
+// adapter header names a list separator as `(, ; / etc)`, which matches the third signature and is also
+// correct English about punctuation. Without a sentence beside it that row is a number that will never
+// fall, and a floor with one of those in it stops being read.
+//
+// So notes are carried by the minter rather than typed into the artifact: a re-mint keeps the note for a
+// file that still has rows, drops it for a file that no longer does (a repair takes its explanation with
+// it), and says which rows are still unexplained. It never invents one — an unexplained row is reported,
+// and the arm that reads this table refuses it.
+const NOTES = {
+  "providers/clarivate/src/core.js":
+    "NOT residue — the header names a list separator as `(, ; / etc)`. It matches the third signature "
+    + "and is correct English about punctuation, so it is recorded rather than repaired.",
+};
+const notesFor = (files) => Object.fromEntries(
+  Object.keys(files).filter((f) => NOTES[f]).map((f) => [f, NOTES[f]]).sort(([a], [b]) => a < b ? -1 : 1));
+const unexplained = (files) => Object.keys(files).filter((f) => !NOTES[f]).sort();
+
 if (process.argv.includes("--check")) {
   const have = JSON.parse(readFileSync(TABLE, "utf8"));
   const a = JSON.stringify(have.files), b = JSON.stringify(minted.files);
+  if (JSON.stringify(have.notes ?? {}) !== JSON.stringify(notesFor(minted.files))) {
+    console.error("reference-strip backlog: the committed notes do not match this tree's rows.");
+    console.error("  re-mint with: node scripts/mint-reference-strip-backlog.mjs");
+    process.exit(1);
+  }
   if (a !== b || have.total !== minted.total) {
     console.error("reference-strip backlog is STALE against the tree.");
     console.error(`  committed total ${have.total}, tree has ${minted.total}`);
     console.error("  re-mint with: node scripts/mint-reference-strip-backlog.mjs");
     process.exit(1);
   }
-  console.log(`reference-strip backlog: current — ${minted.total} line(s) still to repair`);
+  const open = unexplained(minted.files);
+  const held = Object.keys(minted.files).length - open.length;
+  console.log(`reference-strip backlog: current — ${minted.total} matching line(s); `
+    + `${open.length} file(s) to repair, ${held} recorded as not residue`);
 } else {
-  writeFileSync(TABLE, JSON.stringify({ signatures: SIGNATURES.map((s) => s.name), ...minted }, null, 2) + "\n");
+  writeFileSync(TABLE, JSON.stringify({ signatures: SIGNATURES.map((s) => s.name), ...minted,
+    notes: notesFor(minted.files) }, null, 2) + "\n");
   console.log(`minted ${TABLE}: ${minted.total} line(s) across ${Object.keys(minted.files).length} file(s)`);
+  const open = unexplained(minted.files);
+  if (open.length) console.log(`mint-reference-strip-backlog: ${open.length} file(s) carry rows with no note — `
+    + `each is a line to repair, or a note to add here if it is not residue:\n  ${open.join("\n  ")}`);
 }

package/scripts/score.mjs

@@ -64,7 +64,7 @@ import { recordQids } from "../driver/named-band.mjs";
 import { previousRunDir, scenarioRefs } from "../driver/e2e-rounds.mjs";
 // The names rule, kept out of this file so it is testable without a run directory — the same reason
 // reference-score.mjs holds the scoring rules rather than this script.
-import { protectedStrings, redactor, installRedaction, unclassifiedNotice, REDACTION_NOTICE } from "../driver/score-redaction.mjs";
+import { protectedStrings, redactor, authoredRedactor, printAuthored, printPreRedacted, redactDeep, installRedaction, unclassifiedNotice, REDACTION_NOTICE } from "../driver/score-redaction.mjs";
 import { readSettleStamp } from "../driver/settle-stamp.mjs";   
 import { envFrom } from "../shared/env-aliases.mjs";   // — resolves EITHER spelling; names the retired one because that is the live-writable half
 
@@ -517,8 +517,20 @@ function print(id, ref, run, s, delta, refPath) {
   const B = s.buckets;
   const scored = B.found.length + B.withheld.length + B.lost.length;
 
-  console.log(`\n${"═".repeat(78)}`);
+  // A RULE IS A RULE. Nothing in it came from anywhere; routed so a party's ordinary long word cannot
+  // rewrite the page's own furniture.
+  printAuthored(`\n${"═".repeat(78)}`);
   console.log(`${id} — ${ref.mark ?? "(mark unnamed in the reference)"}`);
+  // NOT ROUTED, AND THIS IS THE ONE THAT PROVED WHY. A path looks authored — the config repository's
+  // name and the working directory's name are furniture, and the derived layer was tokenising them, so
+  // a reader was shown a path they could not use. Routing it put a real client name on the page on the
+  // first run measured after the change: a run directory is NAMED AFTER THE MATTER, and that segment is
+  // a distinctive word of a party rather than a whole name, so it is exactly what the derived layer
+  // catches and exactly what the authored path drops.
+  //
+  // A path is not authored text. It is furniture with a data-derived segment in the middle of it, and
+  // the two cannot be separated by choosing an instrument for the whole line. Both stay on the full
+  // layer until the run directories themselves stop carrying matter.
   console.log(`reference: ${refPath}`);
   console.log(`           ${ref.source}`);
   console.log(`run:       ${run.dir}`);
@@ -534,7 +546,9 @@ function print(id, ref, run, s, delta, refPath) {
   // 28). The tool already had the honest pattern four lines down — `withheld` names what it could not
   // read and declines to answer — and the delivery line invented a verdict from the same kind of
   // absence. This is that asymmetry closed, in the direction of the honest half.
-  console.log(deliveryLine(run));
+  // `deliveryLine` composes authored words, a state token and a timestamp, read at its producer in
+  // reference-score.mjs — no part of it comes from the matter.
+  printAuthored(deliveryLine(run));
   // — THE INSTRUMENT, BESIDE THE NUMBER. `--json` has carried `scorer_version` since this file
   // shipped; the human path did not, and the human path is the one whose numbers get pasted into an
   // issue. That body states 6/9 for a run that re-scores 5/2/2 today across two scorer changes
@@ -547,13 +561,17 @@ function print(id, ref, run, s, delta, refPath) {
   console.log(`engine:    ${run.engineCommit
     ? `${run.engineCommit.slice(0, 12)}${run.engineCommitFrom === "meta.json" ? "   (from the pool's meta.json — this dir has no status.json)" : ""}`
     : "(not recorded — no status.json engine stamp and no pool meta.json carrying one)"}`);
-  console.log(`scorer:    v${SCORER_VERSION}   (a score with no version predates this stamp and is not comparable to one)`);
-  console.log(`lane:      ${run.lane}${run.hasDriver ? "" : "   (no _driver/ — pool dir, not a workspace archive)"}`);
-  console.log(`scope:     classes ${run.scopeClasses.join(", ") || "(none recorded)"}   territories ${run.scopeTerritories.join(", ") || "(none recorded)"}`);
+  printAuthored(`scorer:    v${SCORER_VERSION}   (a score with no version predates this stamp and is not comparable to one)`);
+  printAuthored(`lane:      ${run.lane}${run.hasDriver ? "" : "   (no _driver/ — pool dir, not a workspace archive)"}`);
+  // Class numbers and territory codes. Neither is a name, and both were being broken up by the derived
+  // layer on references whose parties carry an ordinary long word.
+  printAuthored(`scope:     classes ${run.scopeClasses.join(", ") || "(none recorded)"}   territories ${run.scopeTerritories.join(", ") || "(none recorded)"}`);
   // — WHICH SUBJECT MARKS THIS REFERENCE ANSWERS, on the line beside the classes and territories it
   // already scopes by, because it is the same kind of fact. Never silent: a gold set that declares
   // nothing says NOT DECLARED and names the marks the run searched.
-  console.log(`coverage:  ${s.coverage.state} — ${s.coverage.why}`);
+  // `coverage.why` is the SCORER's own sentence about what it could measure, not a sentence about
+  // anybody — the same reading that put `coverage` in the safe key set.
+  printAuthored(`coverage:  ${s.coverage.state} — ${s.coverage.why}`);
   // Never a bare "(unreadable)". An unread verdict is an absence, and an absence that prints as an empty
   // parenthesis is the one a reader skims past — so it states the reason, and where a reading DID come
   // from it names the artifact, because the two lanes answer this from different files.
@@ -616,7 +634,9 @@ function print(id, ref, run, s, delta, refPath) {
     console.log(`  entries are unreachable by construction. The counts axis above is this scenario's score.`);
     console.log(`  What follows folds over the run's OWN findings only.\n`);
   }
-  console.log(row("bucket", "n", "of the marks the lawyer named"));
+  // CLASS: THE TABLE'S OWN COLUMNS. "marks" is this tool's word for its own header, and on a reference
+  // whose parties carry it as a distinctive word the header read `of the «name N» the lawyer named`.
+  printAuthored(row("bucket", "n", "of the marks the lawyer named"));
   console.log(row("found", B.found.length, `${pct(B.found.length, scored)} of ${scored} in-scope reference marks`));
   if (s.registerOnly) {
     // ONE source for the reason, so the summary and the rows can never name different causes. Missing
@@ -745,11 +765,11 @@ function print(id, ref, run, s, delta, refPath) {
   for (const note of M.notes) console.log(`  ${note}`);
 
   console.log(`\n── axis B · field ${"─".repeat(59)}`);
-  if (!s.field.length) console.log("  the reference flags no entry as on-field — not scored, not passed");
+  if (!s.field.length) printAuthored("  the reference flags no entry as on-field — not scored, not passed");
   for (const f of s.field) console.log(`  ${String(f.state).padEnd(12)} ${f.mark}  —  ${f.detail}`);
 
   console.log(`\n── axis C · sources ${"─".repeat(57)}`);
-  if (!s.sources.length) console.log("  the reference names no channels — not scored, not passed");
+  if (!s.sources.length) printAuthored("  the reference names no channels — not scored, not passed");
   for (const c of s.sources) console.log(`  ${(c.searched ? "searched" : "ABSENT").padEnd(12)} ${c.channel}`);
 
   console.log(`\n── axis D · gap discipline ${"─".repeat(50)}`);
@@ -761,9 +781,13 @@ function print(id, ref, run, s, delta, refPath) {
   // instructed territory, or does the lane thin out as the count rises. Read `sub-query` first, then
   // `returned` — a sub-query that ran and came back over the provider's ceiling is not depth holding.
   const T = s.territories;
-  console.log(`\n── axis E · per-territory depth ${"─".repeat(45)}`);
+  // AUTHORED, not data: this heading and the column ruler below it carry the words "territory" and
+  // "depth", which a party name can put into the protected set. Measured before this change: a reference
+  // whose proprietor was "Depth Charge" printed `per-territory «name 2»`, and one called "Territory
+  // Holdings" printed `per-«name 1» depth` — a reader cannot tell a redaction from a word.
+  printAuthored(`\n── axis E · per-territory depth ${"─".repeat(45)}`);
   if (!T.subQueriesResolved) console.log(`  sub-queries NOT MEASURABLE — ${T.why}`);
-  console.log(`  ${"territory".padEnd(10)} ${"sub-query".padEnd(22)} ${"own".padEnd(4)} ${"grouped".padEnd(8)} ${"returned".padEnd(9)} ${"recall".padEnd(7)} reference entries`);
+  printAuthored(`  ${"territory".padEnd(10)} ${"sub-query".padEnd(22)} ${"own".padEnd(4)} ${"grouped".padEnd(8)} ${"returned".padEnd(9)} ${"recall".padEnd(7)} reference entries`);
   for (const r of T.rows) {
     // `—` for recall is deliberate and is the whole design point of this row: a territory whose
     // reference carries nothing to score prints NEITHER 0% (which reads as total failure) NOR 100%
@@ -899,15 +923,18 @@ function print(id, ref, run, s, delta, refPath) {
   else for (const d of delta) console.log(`  ${d.mark}: ${d.from} → ${d.to}`);
 
   console.log(`\n${"═".repeat(78)}`);
-  console.log(`This is a measurement, not a verdict. There is no PASS here and the exit code is always 0.`);
-  console.log(`Reproducing the reference proves nothing — it is a regression tripwire, never a target.`);
-  console.log(`What to read: every WITHHELD row is a gather-to-judgment seam defect, not a recall one.`);
-  console.log(`Axis E: "own" counts sub-queries naming ONE territory and nothing else — the deep-dive itself.`);
-  console.log(`A territory with no reference entry prints "—", never 0% and never 100%. Both are conclusions.`);
+  // CLASS: THE CLOSING LEGEND. Eight lines, every one a literal of this file's own with nothing
+  // interpolated from a reference or a run — the class most obviously ours and the least defensible to
+  // leave on the data path, because a party's ordinary long word rewrites the page's own instructions.
+  printAuthored(`This is a measurement, not a verdict. There is no PASS here and the exit code is always 0.`);
+  printAuthored(`Reproducing the reference proves nothing — it is a regression tripwire, never a target.`);
+  printAuthored(`What to read: every WITHHELD row is a gather-to-judgment seam defect, not a recall one.`);
+  printAuthored(`Axis E: "own" counts sub-queries naming ONE territory and nothing else — the deep-dive itself.`);
+  printAuthored(`A territory with no reference entry prints "—", never 0% and never 100%. Both are conclusions.`);
   // The instrument changed. A round comparing its noise against a round scored before `uncovered`
   // existed is comparing two different measurements, and the drop will otherwise read as an improvement.
-  console.log(`"uncovered" is a finding of a mark this reference does not answer — a noise count from before`);
-  console.log(`that bucket existed is not comparable with one after it. The gold set must declare covers_marks.\n`);
+  printAuthored(`"uncovered" is a finding of a mark this reference does not answer — a noise count from before`);
+  printAuthored(`that bucket existed is not comparable with one after it. The gold set must declare covers_marks.\n`);
 }
 
 // ── main ─────────────────────────────────────────────────────────────────────────────────────────────
@@ -977,17 +1004,40 @@ const delta = prev ? bucketDelta(scored.buckets, prev.buckets) : null;
 // that adds a print. Here `renderCarryThrough`'s lines and anything added after this was written are
 // covered without anyone remembering to.
 //
-// The two inputs are the reference AND the scored buckets: a proprietor this run surfaced that the
-// lawyer never named is still somebody's name, and it reaches the page through `noise`.
+// THE INPUTS ARE THE REFERENCE, THE SCORED BUCKETS **AND THE RUN'S OWN FINDINGS**, and the third was
+// missing. A proprietor this run surfaced that the lawyer never named is still somebody's name; the
+// buckets carry the ones the scorer could join to a reference entry, and the FINDINGS carry every other.
+//
+// Measured on R18 `f5764a2f`: the `verdict:` line printed a proprietor in clear while tokenising the mark
+// beside it. The name sits at `findings[0].owner.name` — a key already in the protected set — and was
+// simply never walked, because the findings were not handed over. It also appears inside five prose
+// fields of the same document (`net`, `practical_position`, `read`, `condition`, `text`), so collecting it
+// as a name substitutes it in all of them rather than needing each one withheld whole. That matters:
+// `text` carries the reviewer's verdict word, and withholding it entire would blank a value the reader
+// came for.
 let unclassifiedKeys = [];
+// The two instruments the JSON payload needs, live only when names are withheld. With `--names` they
+// stay identity, which is the same "nothing to withhold" case `printAuthored` already has.
+let redactValue = (x) => x, redactKey = (x) => x;
 if (!opts.names) {
-  const { names, prose, unclassified } = protectedStrings({ reference: ref, scored });
+  const { names, prose, derived, unclassified } = protectedStrings({ reference: ref, scored, run: run.findings ?? null });
   unclassifiedKeys = unclassified;
-  installRedaction(redactor({ names, prose }));
+  // The second redactor is for lines this tool WROTE. It drops the derived-word layer
+  // only, so a party's ordinary long word stops rewriting our own headings while its full name is still
+  // taken out of them. A structural line nobody routed through `printAuthored` is redacted as before,
+  // which is the old behaviour and the safe side.
+  redactValue = redactor({ names, prose });
+  redactKey = authoredRedactor({ names, prose, derived });
+  installRedaction(redactValue, undefined, redactKey);
 }
 
 if (opts.json) {
-  console.log(JSON.stringify({
+  // REDACTED AS A STRUCTURE, THEN WRITTEN RAW. Stringifying first and sending the text through the
+  // boundary redacts a document with no prose in it: every string is either a field NAME this file
+  // wrote or a VALUE out of the data, and they need opposite treatment. On one real score that turned
+  // the keys `owner` and `additional` into tokens, because both are distinctive words of multi-word
+  // parties in that reference — two fields no consumer could address, or discover the new name of.
+  printPreRedacted(`${JSON.stringify(redactDeep({
     // — the instrument that produced these numbers, so a reader comparing two archived scores can
     // tell whether the comparison is valid. A score with no `scorer_version` predates this stamp.
     scorer_version: SCORER_VERSION,
@@ -1012,14 +1062,19 @@ if (opts.json) {
     // so leaving it out would hide it from exactly the readers most likely to automate on it, and a
     // consumer would have no way to tell an absent measure from a clean one.
     carry_through: (() => { const ct = carryThrough(run.dir); return { ...ct, coverage: coverageConflicts(run.dir, ct.lost) }; })(),
-  }, null, 2));
+  }, { redactValue, redactKey }), null, 2)}\n`);
 } else {
   // Said before the first number, not after the last: a reader who stops at the top screen must know
   // which of the two readings they are holding.
-  if (!opts.names) console.log(`\n  ${REDACTION_NOTICE}`);
+  // THE NOTICE THAT EXPLAINS THE TOKENS HAD TOKENS IN IT. A party's distinctive word collided with
+  // "marks", so the sentence defining «name N» was itself redacted — useless exactly where it matters.
+  if (!opts.names) printAuthored(`\n  ${REDACTION_NOTICE}`);
   // A reference that has grown a field this module does not classify is unprotected in exactly that
   // field, so the reader learns it before anything below, not after.
-  if (unclassifiedKeys.length) console.log(`  ${unclassifiedNotice(unclassifiedKeys)}`);
+  // AND THE WARNING PRINTED ONE OF ITS OWN KEY NAMES AS A TOKEN, so it could not name the key it
+  // exists to name. It fires when a new reference field is unclassified, which is the one moment it has
+  // to be readable.
+  if (unclassifiedKeys.length) printAuthored(`  ${unclassifiedNotice(unclassifiedKeys)}`);
   print(String(id).toUpperCase(), ref, run, scored, delta, refPath);
   // — THE LAWYER'S OWN STATEMENTS OF WHAT THE RUN MUST DEMONSTRATE. The buckets cannot carry
   // these: an assertion says WHY a mark matters, and that reasoning is what tells a reader which lane to
@@ -1028,11 +1083,29 @@ if (opts.json) {
   if (statements.length) {
     console.log(`\n  THE REFERENCE'S OWN ASSERTIONS AND CONTROLS (${statements.length}) — the scorer does not read English, so`);
     console.log("  these are the run's own facts about the marks each one names, never a verdict on the sentence:");
+    // A MARK LIFTED OUT OF A WITHHELD SENTENCE IS STILL A MARK.
+    //
+    // `st.text` is a reference sentence, so it is in the prose set and prints as withheld. These rows are
+    // the SAME sentence, parsed: `scoreStatements` runs the mark extractor over it and reports each mark
+    // it names with the bucket that mark landed in. A mark that appears nowhere but inside that sentence
+    // was never a value of a name field, so it is in no name set, and the boundary redactor has nothing
+    // to match — it printed in clear, beside a mark that was correctly withheld, on a real score.
+    //
+    // WITHHELD AT THE PRINT SITE RATHER THAN BY WIDENING THE PROTECTED SET. Collecting what the extractor
+    // finds into the protected set was tried first and measured: that extractor is a floor, not a sound
+    // extraction — it reads capitals, lawyers emphasise in capitals, and the redactor is case-insensitive,
+    // so an emphasised `REFERENCE` in one gold sentence tokenised every lowercase "reference" on the
+    // page. 34 more tokens, 17 from that one word, and a bucket table reading `88% of 8 in-scope «name»
+    // marks`. The cure was worse than the leak, so it is not there; the state is the finding, and the
+    // mark's identity is the detail that belongs behind the flag.
+    const markShown = (mark) => (opts.names ? mark : "[withheld — run again with --names to read it]");
     for (const st of statements) {
       console.log(`\n    [${st.kind}] ${st.text}`);
       if (st.halves.length)
-        for (const h of st.halves) console.log(`        ${h.mark} — ${h.state}`);
-      if (st.why) console.log(`        UNEVALUATED: ${st.why}`);
+        for (const h of st.halves) console.log(`        ${markShown(h.mark)} — ${h.state}`);
+      // `why` names the same marks in a sentence of its own, so it is withheld the same way or it is a
+      // second door onto the first defect.
+      if (st.why) console.log(`        UNEVALUATED: ${opts.names ? st.why : st.why.replace(/names .*?, none of which/, "names marks this reference holds, none of which")}`);
     }
   } else if (ref) {
     // Absence, stated. A reference with no assertions and a reference the scorer failed to read are

package/shared/identifier-scan.mjs

@@ -129,7 +129,37 @@ export const ALLOWED_CONTEXT =
  *     The escaped form (`C:\\`) is not a raw path, so an escape beside a path in a string is still read.
  */
 const BACKSLASH_ESCAPE = /\\(?:[\\nrtfv0]|u[0-9a-fA-F]{4}|x[0-9a-fA-F]{2})/g;
-const RAW_WINDOWS_PATH = /(?<![A-Za-z0-9])[A-Za-z]:\\(?!\\)[^"'`<>|?*\r\n]*/g;
+
+// A RAW PATH IS NOT ONLY AN ABSOLUTE ONE. The drive-letter form was the only one recognised, so the same
+// misreading came back on the relative forms: `.\node_modules\.bin` and `<prefix>\node_modules` were read
+// as holding an escaped newline, which ate the `n` and left the three letters after it standing at the
+// front of a word. Three occurrences on the public tip, in a CI workflow and a test.
+//
+// The anchors below are what makes a backslash a separator rather than an escape, and each is a shape a
+// path is written in and a string literal is not. A backslash after a LETTER is deliberately not an anchor:
+// that is the escape the rule exists for, and the arms pin it.
+//
+// EACH ANCHOR MATCHES ONLY THE SHAPE ITS COMMENT CLAIMS, and the first version of this did not. `[>%]` alone
+// read ANY closing angle or percent before an escape as a path — `rose to 50%\nNorvale`, `cmd >\nNorvale` —
+// and `\.{1,2}` read the last two dots of an ellipsis as `..\`. In each of those the escape was left
+// unescaped, the `n` stayed glued to the name, and A REAL NAME WENT UNFOUND. That is the worse of this
+// rule's two failure directions, and it is the one a widened anchor buys.
+//
+// THE RESIDUE, said here so it is not a surprise: `a<b>\nNorvale` still reads as a path, because `<b>` is
+// indistinguishable by shape from `<root>`. A closing HTML tag immediately before an escape, with a name
+// straight after it, is not caught. A minimum length inside the angles would be an arbitrary line through
+// real stand-ins, so this is recorded rather than fixed.
+const PATH_TAIL = "[^\"'`<>|?*\\r\\n]*";
+const RAW_WINDOWS_PATH = new RegExp([
+  // C:\… — a drive letter
+  "(?<![A-Za-z0-9])[A-Za-z]:\\\\(?!\\\\)",
+  // .\… and ..\… — relative. The dot in the lookbehind is what stops an ellipsis reading as `..\`.
+  "(?<![A-Za-z0-9.])\\.{1,2}\\\\(?!\\\\)",
+  // <prefix>\… — a stand-in for the first segment, as a comment or a doc writes it
+  "(?<=<[A-Za-z_][A-Za-z0-9_]*>)\\\\(?!\\\\)",
+  // %TEMP%\… — an environment variable, as a script writes it
+  "(?<=%[A-Za-z_][A-Za-z0-9_]*%)\\\\(?!\\\\)",
+].map((anchor) => anchor + PATH_TAIL).join("|"), "g");
 
 export const unescapeBoundaries = (line) => {
   let out = "", at = 0;