clearotron 0.4.1-beta.0 → 0.4.1-beta.2

package/THIRD-PARTY-NOTICES.md

@@ -110,7 +110,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## @modelcontextprotocol/sdk@1.31.0
+## @modelcontextprotocol/sdk@1.32.1
 
 - **Licence declared:** `MIT`
 - **Repository:** https://github.com/modelcontextprotocol/typescript-sdk

package/bin/README.md

@@ -20,7 +20,7 @@ and is what you want when you are working in this tree.
 | `signa-sync.mjs` | — | `node bin/signa-sync.mjs` | One vendor read (`GET /v1/offices`, paged). Needs `SIGNA_API_KEY`. |
 
 `example.mjs` replays `demo` through the ordinary publisher into `~/trademark-demo/pool` and
-serves it on `127.0.0.1:18900`. Every path the demo pool could collide with is checked by realpath and by
+serves it on `127.0.0.1:18860`. Every path the demo pool could collide with is checked by realpath and by
 containment before anything is written, because a demo runs on deployed machines too.
 
 `onboard.mjs` validates each answer through the door the engine itself uses before it persists anything,

package/bin/clearotron.mjs

@@ -65,6 +65,7 @@ export const VERBS = {
   passphrase: ["bin/passphrase.mjs"],
   sync:    ["bin/uspto-sync.mjs"],
   update:  ["bin/update.mjs"],
+  mcp:     ["bin/mcp.mjs"],
 };
 
 export const SUMMARY = {
@@ -87,6 +88,7 @@ export const SUMMARY = {
   passphrase: "report or RESET the portal's local sign-in — the recovery for a lost passphrase",
   sync:    "build or update the free US register index (a large download, and hours of ingest)",
   update:  "bring this install up to date — and REFUSE to do it over the top of your own configuration",
+  mcp:     "serve this install's searches to an assistant over MCP, or the demo's where there is no install",
 };
 
 /**

package/bin/mcp.mjs

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// mcp.mjs — `clearotron mcp`: the MCP server over stdio, started from the package itself.
+//
+// An install's own connect lines run the server from that install's copy (shared/stdio-connect.mjs), so
+// an assistant never keeps an old server after an upgrade, and they stay as they are. This verb is for a
+// machine with no install, and for a listing that launches the published package with `npx`.
+//
+// WHICH RUNS IT READS. An install's, wherever one is found; the demo's four sample runs where none is.
+// Standard output belongs to the protocol from its first byte, so nothing here prints to it.
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { parseEnv } from "node:util";
+import { isEntrypoint } from "../shared/is-entrypoint.mjs";
+import { demoMode } from "../mcp-server/demo-mode.mjs";
+
+/** The two settings the install's own connect lines hand the server: where runs are, and where reports are. */
+export const INSTALL_FOLDERS = Object.freeze(["CLEAROTRON_WORK_DIR", "CLEAROTRON_REPORTS_DIR"]);
+
+/** The demo's own base, and where it keeps its runs and its access log: the layout `installPaths` gives it. */
+export const demoBase = (home = homedir()) => join(home, "trademark-demo");
+export const demoWorkspace = (home = homedir()) => join(demoBase(home), "workspace");
+
+/**
+ * WHAT COUNTS AS AN INSTALL, and so whether this server reads an install's runs or the demo's. PURE.
+ *
+ * An install is any one of these:
+ *   - a work folder or a reports folder named in this process's environment, in the settings file a
+ *     packaged install writes (`~/.config/clearotron/.env`), or in the file a background install's
+ *     services read (`~/.env`);
+ *   - either of those files carrying any Clearotron setting at all, which is an install configured and
+ *     not yet pointed at its folders: the server then reads its default and names what is missing;
+ *   - the default workspace, `~/trademark/workspace`, on disk.
+ * The demo writes neither file and keeps its runs under its own base, so a machine that has only run the
+ * demo still reads as no install. An install never gets the demo: a misconfigured one is refused by name.
+ *
+ * Returns the folders to hand the server (only what is set, and never over the environment's own value),
+ * or `demo: true` where there is no install.
+ */
+export function mcpTarget({ env = process.env, home = homedir(), exists = existsSync, read = (p) => readFileSync(p, "utf8") } = {}) {
+  const parsed = (p) => { try { return parseEnv(read(p)); } catch { return null; } };
+  const settings = parsed(join(home, ".config", "clearotron", ".env"));
+  const services = parsed(join(home, ".env"));
+  const set = (v) => (typeof v === "string" && v.trim() ? v.trim() : null);
+  const folders = {};
+  for (const k of INSTALL_FOLDERS) {
+    const v = set(env[k]) ?? set(settings?.[k]) ?? set(services?.[k]);
+    if (v) folders[k] = v;
+  }
+  const configures = (file) => Boolean(file) && Object.keys(file).some((k) => /^(CLEAROTRON|TRADEMARK|PORTAL)_/.test(k));
+  const install = Object.keys(folders).length > 0 || configures(settings) || configures(services)
+    || exists(join(home, "trademark", "workspace"));
+  return install ? { demo: false, env: folders } : { demo: true, env: {} };
+}
+
+async function main() {
+  const target = mcpTarget();
+  if (target.demo) {
+    // The four sample runs, copied where the connector walks, under the demo's own base: nothing is
+    // written anywhere an install reads (driver/demo-container.mjs).
+    const { seedDemoRuns } = await import("../driver/demo-container.mjs");
+    const workspace = demoWorkspace();
+    seedDemoRuns({ workspace, examplesDir: join(import.meta.dirname, "..", "demo") });
+    process.env.CLEAROTRON_WORK_DIR = workspace;
+    // The door's access log too, which would otherwise open the install's own telemetry folder.
+    if (!set(process.env.TRADEMARK_MCP_AUDIT_LOG)) process.env.TRADEMARK_MCP_AUDIT_LOG = join(demoBase(), "telemetry", "trademark-mcp-access.jsonl");
+    demoMode.on = true;
+  } else {
+    for (const [k, v] of Object.entries(target.env)) if (!set(process.env[k])) process.env[k] = v;
+  }
+  // The server starts through the entry that refuses an old Node in one plain line before it loads.
+  await import("../mcp-server/serve.mjs");
+}
+
+const set = (v) => typeof v === "string" && v.trim() !== "";
+
+if (isEntrypoint(import.meta.url)) await main();

package/bin/start.mjs

@@ -2445,6 +2445,18 @@ if (isMain) {
   const clientDoor = adoptedClientDoor
     ? null
     : start("the client door", "mcp-server/http-server-client.mjs", envs.client, { fatal: false });
+  // ── THE BANNER NAMES THIS DOOR ONLY ONCE IT ANSWERS ─────────────────────────────────────────────────
+  //
+  // The engine door and the portal are each awaited above before anything is printed. This door was
+  // not: the banner below was composed the moment it was spawned, while it was still loading, and
+  // announced an address that refused connections. Measured 2026-10-09, in a container with no network
+  // running as root and on a host as a normal user: a request sent as the banner printed got no
+  // connection, and the door's first answer came about half a second later. Its own output said nothing
+  // was wrong, because nothing was; it had not finished starting.
+  //
+  // Same probe and same budget as the other two, and non-fatal like the door itself. A door that exits,
+  // or does not answer within the budget, takes the NOT RUNNING branch below and the portal keeps serving.
+  const clientDoorAnswered = clientDoor ? await healthy(`http://${HOST}:${ports.client}/healthz`, clientDoor) : false;
 
   // ── 6. one URL ─────────────────────────────────────────────────────────────────────────────────────
 
@@ -2471,7 +2483,8 @@ if (isMain) {
   // AN ADOPTED DOOR IS RUNNING. Without this the banner reported "NOT RUNNING …
   // its output above says why" about a door that is up and serving, and pointed the reader at output
   // that does not exist — the one sentence on this screen a reader would act on, and false.
-  const doorRunning = adoptedClientDoor || clientDoor?.child?.exitCode === null;
+  // AND A SPAWNED DOOR IS RUNNING ONLY ONCE IT HAS ANSWERED: alive is not listening (see the probe above).
+  const doorRunning = adoptedClientDoor || (clientDoor?.child?.exitCode === null && clientDoorAnswered);
   if (doorRunning) {
     say(`  Client door  http://${HOST}:${ports.client}/mcp   — a client's assistant connects here.`);
     if (adoptedClientDoor)

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "4f2133e937195c6875d4be055c76383ceaca0138",
-  "version": "0.4.1-beta.0"
+  "commit": "08583753fbde693fdecdc8e16f11781dae789f55",
+  "version": "0.4.1-beta.2"
 }

package/demo/README.md

@@ -16,7 +16,7 @@ carries no `report.md` at all, because for that lane the markdown is an output o
 an input to it.
 
 Each directory is named by the product that produced it — the id in the run's own frozen search policy,
-not a label chosen afterwards. `clearotron demo` replays the first; `clearotron demo --product <id>`
+not a label chosen afterwards. `clearotron demo` replays all four; `clearotron demo --product <id>`
 replays a named one; `clearotron demo --run-dir <dir>` replays any frozen run from anywhere.
 
 ## The marks are invented; the data behind them is real

package/docs/architecture/04-configuration-reference.md

@@ -301,7 +301,6 @@ because the rule is about what PRODUCT CODE reads, not about what a run reads.
 
 | Var | Default | Meaning |
 |---|---|---|
-| `DEMO_PORT` | `18900` | Port `npx clearotron demo` serves the replayed report on. `--port` overrides it. |
 | `CLEAROTRON_DEMO` | unset | `1` puts this install in the DEMO posture. **Ordering is real**: the four products are listed and orderable, the form, the plan and the confirmation are the product's own, and the confirmation resolves to a finished report that already exists rather than dispatching — no engine turn, no register call, no queue entry, no run directory (ruling 2026-08-31, superseding the greyed-control ruling of the same day). A product the demo carries no finished report for refuses and names which one. It also re-aims two boot warnings written for an operator of a real deployment at the visitor who is not one, from one place (`driver/demo-posture.mjs`). **Set by `npx clearotron demo`, not by an operator** — it is passed explicitly to the two processes that have a reason to know (the portal and the MCP door; the worker is not told, because a demo never queues anything for it to drain), and those run with `CLEAROTRON_NO_ENV_FILE=1`, so a stray `.env` can neither put a live install into demo mode nor take a demo out of one. Anything but the literal `1` is not a demo. Replaces `PORTAL_DEMO`, which named only one of the processes that has to know. |
 | `CLEAROTRON_TEST_FIXTURE_PROFILES` | unset | `1` makes the profile loader return the three suite fixtures, which are refused from every roster otherwise. Set by `scripts/test-run.mjs`, never by an operator; an explicit `includeTestFixtures` argument beats it. Effect class `harness`; the full contract is its row in `.env.example`. |
 | `CLEAROTRON_DEMO_PROFILES` | unset | `1` makes the profile loader return the bundled demo company, which a fresh install does not resolve (ruling 2026-09-08). Set by `clearotron demo`, `start --demo` and the suite runner, never by an operator. The gate is on the bundled layer, so a deployment's own configured store keeps its `demoData` companies either way. Effect class `harness`; the full contract is its row in `.env.example`. |

package/docs/architecture/06-operations-runbook.md

@@ -301,9 +301,10 @@ node mcp-server/mint-token.mjs --scope ops --sub <principal-name> \
 - The token is printed once and stored nowhere. Losing it means minting another.
 
 **Revoking one.** Every mint prints a `jti`. Write that line into the file named by
-`TRADEMARK_MCP_TOKEN_DENYLIST` (one `jti` per line, `#` comments allowed) and the next verification
-refuses the token. A **missing** denylist file means nothing is revoked, never everything — a denylist
-must not be able to take all authentication down.
+`TRADEMARK_MCP_TOKEN_DENYLIST`, or into `~/.config/clearotron/token-denylist` when the setting is unset
+(one `jti` per line, `#` comments allowed), and the next verification refuses the token. A named list
+that is missing or unreadable refuses every key, and so does a default list that exists but cannot be
+read. An absent default list means nothing has been revoked.
 
 **Rotating the signing secret.** Verification accepts `TRADEMARK_MCP_TOKEN_SECRET` or
 `TRADEMARK_MCP_TOKEN_SECRET_PREVIOUS`; minting always signs with the current one. Move the old value

package/docs/architecture/08-development-guide.md

@@ -10,7 +10,9 @@ How to work on the driver without breaking the properties that make it trustwort
 
 - **Node ≥ 22** (every workspace `package.json` declares it; CI pins 22.23.2). The repo is an npm
   workspace — `npm ci` at the root installs `driver`, `mcp-server`, `providers/oauth-mcp-bridge`
-  and `portal-ui` together. Production deploys install with `--omit=dev --ignore-scripts`.
+  and `portal-ui` together. An install from a git checkout updates with `npm ci --ignore-scripts` and
+  keeps development packages, because the portal is rebuilt from them. A packaged install updates
+  through `npm install --global`.
 - **Tests**: `npm test` in the driver dir runs the *contributor* tier
   (`scripts/test-run.mjs` → `scripts/test-fast.mjs` over `test/*.test.mjs`), which leaves out the
   slowest end-to-end files so a first run finishes in minutes. `npm run test:full` is the

package/driver/CHANGELOG.md

@@ -1,5 +1,22 @@
 # clearotron-driver
 
+## 0.4.1-beta.2
+
+### Patch Changes
+
+- Fixed: A clearance no longer stops before its report when findings link to an office's own page instead of the register record.
+
+## 0.4.1-beta.1
+
+### Patch Changes
+
+- Fixed: A report repaired just before delivery keeps its coverage notes, such as a script that was not searched, in the report and the audit workbook.
+- Fixed: A search too broad for the register to count is no longer reported as one that could not be run. The report shows it as too large to read, with the register's own figure.
+- Fixed: On Signa, a crowded search over several spellings now counts each spelling alone, so a rare spelling is no longer reported as crowded.
+- New: `npx clearotron mcp` starts Clearotron's MCP server for an assistant; with no install it answers from the demo's sample runs, and says so.
+- Fixed: The address `clearotron start` and `clearotron demo` print for a client's assistant now answers as soon as it is printed.
+- Fixed: The audit workbook's coverage summary names each area in words, not the engine's identifiers.
+
 ## 0.4.1-beta.0
 
 ### Patch Changes

package/driver/citation-census.json

@@ -1,5 +1,5 @@
 {
-  "citations": 415,
-  "files": 3437,
-  "checkable": 186
+  "citations": 257,
+  "files": 3469,
+  "checkable": 245
 }

package/driver/compare.mjs

@@ -212,7 +212,7 @@ export function compareCmd(opts) {
 if (isEntrypoint(import.meta.url)) {
   let a;
   //: the refusal must print the usage, or "unknown flag --experiement" leaves the reader guessing
-  // which spelling was wanted. Same wiring as enqueue.mjs:155.
+  // which spelling was wanted. Same wiring as main() in enqueue.mjs.
   try { a = parseArgv(process.argv.slice(2)); }
   catch (e) { console.error(`error: ${e.message}\n\n${USAGE}`); process.exit(2); }
   try {

package/driver/contract-audit.mjs

@@ -158,14 +158,14 @@ const ARROW_TOKEN_RE = /=>\s*[`"']([a-z][a-z0-9]*(?:_[a-z0-9]+)+)/g;
 const REASON_TOKEN_RE = /reason:\s*[`"']([a-z][a-z0-9]*(?:_[a-z0-9]+)+)/g;
 
 // A CITED SITE MUST BE A MINT. The extractor records the FIRST line a pattern matched, and the
-// patterns read comment text as readily as code: `no_status` was cited at coverage-form.mjs:802, the
-// JSDoc `@returns {Array<{reason:"no_status"|"form_damaged", …` annotation seventeen lines above the line
-// that writes it. Every such ruling cites its mint, so a citation drawn from a sentence about the code
-// is a ruling about a sentence.
+// patterns read comment text as readily as code: `no_status` was cited at the JSDoc `@returns
+// {Array<{reason:"no_status"|"form_damaged", …` annotation of findCoverageFormViolations() in coverage-form.mjs,
+// seventeen lines above the line that writes it. Every such ruling cites its mint, so a citation drawn
+// from a sentence about the code is a ruling about a sentence.
 //
 // Comment-ONLY lines, never a trailing `//` after code — a token minted on a line that also carries a
 // comment is still minted there. Measured before it was trusted: across all 30 covered sources this moves
-// exactly one citation (coverage-form.mjs:802 -> :828) and loses NO token, so the census does not shrink.
+// exactly one citation (`no_status`'s, annotation -> mint) and loses NO token, so the census does not shrink.
 // That measurement is the load-bearing half: a filter that quietly dropped a comment-only token would
 // take its coverage obligation with it, and the tripwire would read the absence as clean.
 const COMMENT_ONLY_LINE = /^\s*(?:\/\/|\*|\/\*)/;
@@ -265,7 +265,7 @@ export const E3_KINDS = ["literal-json-skeleton", "exactly-these-keys", "dictate
  *
  *   other — the dictate is not in the text being linted. Two shapes found: a stage message that
  *           DELEGATES its whole envelope to a skill file ("dictated keys + closed enums per the skill",
- *           stages.mjs:974 for blind-frame — a lint reading the message sees nothing and the skeleton
+ *           blind-frame's message until 2026-08-17 — a lint reading the message sees nothing and the skeleton
  *           escapes); and a field DICTATED THEN OVERWRITTEN, where the instruction annotates its own
  *           fields as driver-replaced in the model's own reading (delivery-contract.md:34-37).
  *

package/driver/contract-dictation-registry.mjs

@@ -131,7 +131,7 @@ export const TOOL_ORDER_BACKLOG = [
     closes: "#865 — same shared file, same split grant." },
   { stage: "register-digest", tool: "register_batch_screen", site: "driver/skills/clearance-register/digest.md",
     closes: "#865 — the digest's OWN doctrine, not a shared file: this one is the stage being told to "
-      + "batch-screen with a tool its grant does not carry. gather-config.mjs:196 RECORDING already records that "
+      + "batch-screen with a tool its grant does not carry. toolGroupsForStage() in gather-config.mjs already records that "
       + "this stage's prompt once ordered live register checks; the order outlived the note." },
   { stage: "register-unit", tool: "band_record", site: "driver/skills/clearance-register/SKILL.md",
     closes: "#865 — same shared file, same split grant." },

package/driver/contract-e3-backlog.mjs

@@ -106,11 +106,11 @@ export const E3_BACKLOG = [
   // Two `literal-json-skeleton` and two `exactly-these-keys`, all four stamped "NOTHING ON THE PLAN
   // REMOVES THIS". The conversion removed them:
   //
-  //   stages.mjs:926            the dispatch dictated variant-manifest.json key by key and enum by enum;
+  //   stages.mjs (message)      the dispatch dictated variant-manifest.json key by key and enum by enum;
   //                             `record_clearance_variants`'s schema IS that shape now, so the key-set and
   //                             enum families are unreachable from a typed call rather than caught after
   //                             the file is written.
-  //   stages.mjs:774-808        the same skeleton's category enum, same fate.
+  //   stages.mjs (message)      the same skeleton's category enum, same fate.
   //   clearance-variants SKILL.md  the `### Scope ledger` markdown table and its column contract. The rows
   //                             arrive typed; the driver renders the table AND serialises
   //                             scope-ledger.json from them through one shared function.
@@ -152,7 +152,7 @@ export const E3_BACKLOG = [
     where: "driver/skills/blind-frame/SKILL.md:62-83",
     surface: "skill-file",
     evidence: "A JSON OBJECT with EXACTLY these keys:\\n```json\\n{\\n \"schema_version\": 1,\\n \"dominant_element\": \"the spine, verbatim\",\\n \"variants\": [{\"value\": \"KORPHI\", \"direction\": \"drop\", \"rationale\": \"…\"}],\\n \"fields\": […],\\n \"sources\": […],\\n \"ranking_basis\": \"goods-overlap\"\\n}\\n``` … `direction` is EXACTLY on",
-    reparsedBy: "driver/verify.mjs validators.blindFrame — emits invalid_file:…:blindframe_* on an off-enum or missing key (stages.mjs:952-957 doc block)",
+    reparsedBy: "driver/verify.mjs validators.blindFrame — emits invalid_file:…:blindframe_* on an off-enum or missing key (the blind-frame stage's doc block in stages.mjs)",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   // ── DISCHARGED 2026-08-17 by, and the row said this could not happen ──────────────────────────
@@ -180,8 +180,8 @@ export const E3_BACKLOG = [
   {
     stage: "common-law-half",
     kind: "dictated-line-shape",
-    // CONSOLIDATED 2026-08-16 from THREE rows (common-law stages.mjs:1031, common-law-half :1112 and
-    // :1146). Those three existed because the dictation was AUTHORED at three sites in stages.mjs. M1 made
+    // CONSOLIDATED 2026-08-16 from THREE rows (one in common-law's message in stages.mjs, two in
+    // common-law-half's). Those three existed because the dictation was AUTHORED at three sites in stages.mjs. M1 made
     // it one: authored once in renderConnotationObligations, and reaching the seat through the perplexity
     // MCP server (`tellObligations` in driver/engine/mcp/perplexity-server.mjs) rather than a stage message. Three rows
     // pointing at one block would fabricate two authored sites the surface does not have.
@@ -295,7 +295,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:2351-2353",
     surface: "stage-message",
     evidence: "PLACEMENT FORM (MANDATORY): record every placement in <path> — {\"rows\":[…]} … · A REGISTER candidate: {\"select\":\"<one record URI it holds>\",\"tier\":\"…\",\"reason\":\"…\"} (+ optional \"borderline\":true) … · A COMMON-LAW candidate …: {\"kind\":\"seat\",\"mark\",\"owner\",\"jurisdiction\",\"records\":[],\"tier\",\"reason\"}",
-    reparsedBy: "driver/placement-form.mjs (SELECT_ROW_FIELDS at placement-form.mjs:93, the seat-row contract at 97-105, formRowKey/rowIsSettled/renderEntry at 117-141) via validators.placement. The same field list is ALSO carried in the driver-written form's own seat_row_contract, so the shape exists twice",
+    reparsedBy: "driver/placement-form.mjs (SELECT_ROW_FIELDS at placement-form.mjs:93, the seat-row contract SEAT_ROW_CONTRACT, formRowKey/rowIsSettled/renderEntry) via validators.placement. The same field list is ALSO carried in the driver-written form's own seat_row_contract, so the shape exists twice",
     removedByMove: "M1 removes the opaque `select` URI (ordinal selection) — it does not remove the JSON skeleton, the retract shape, or the kind:\"seat\" row",
   },
   {
@@ -313,7 +313,7 @@ export const E3_BACKLOG = [
     where: "driver/skills/placement-inquiry/SKILL.md:58-66",
     surface: "skill-file",
     evidence: "**2. The structured mirror** `…/placements.json` … `{\"schema_version\":1,\"placements\":[...]}`, ONE object per placed candidate, keys EXACTLY `{\"mark\",\"owner\",\"jurisdiction\",\"records\",\"tier\",\"reason\"}` plus the optional `\"borderline\"` … `tier` — EXACTLY one of `headline-candidate` / `sheet-2` / `watch",
-    reparsedBy: "driver/placement-model.mjs. AND IT IS STALE: #562 made placements.json driver-rendered, and stages.mjs:2409 says \"DO NOT WRITE placements.json (the driver renders it from this form)\" — the skill file the stage is ordered to \"read and follow exactly\" dictates the key set of a file the message forbids it to write. Two contracts in one dispatch",
+    reparsedBy: "driver/placement-model.mjs. AND IT IS STALE: #562 made placements.json driver-rendered, and placement-inquiry's message in stages.mjs says \"DO NOT WRITE placements.json (the driver renders it from this form)\" — the skill file the stage is ordered to \"read and follow exactly\" dictates the key set of a file the message forbids it to write. Two contracts in one dispatch",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -322,13 +322,14 @@ export const E3_BACKLOG = [
     where: "driver/skills/placement-inquiry/SKILL.md:42",
     surface: "skill-file",
     evidence: "Use these section headings, in this order: **Band reconciliation** …, the four placement tiers (**Headline candidates**, **Sheet 2 / register watch**, **Watchlist annex**, **Out-of-scope / filtered**), **Disagreements / flags surfaced to downstream**, **Coverage rulings & open questions** …, and **O",
-    reparsedBy: "driver/pipeline.mjs — the PLACEMENT RULINGS TAIL block handed to register-digest is lifted from these named sections (stages.mjs:2561 references it); driver/skills/clearance-register/digest.md:342-352 re-parses the Disagreements section into its own table",
+    reparsedBy: "driver/pipeline.mjs — the PLACEMENT RULINGS TAIL block handed to register-digest is lifted from these named sections (register-digest's message in stages.mjs references it); driver/skills/clearance-register/digest.md:342-352 re-parses the Disagreements section into its own table",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   // RETIRED 2026-08-16 — register-digest's no-form arm. M6 DELETED THE DICTATION ON 2026-08-14 AND THIS
   // ROW OUTLIVED IT BY TWO DAYS. Verified at source rather than from the epitaph: the arm is absent from
   // the composed message, `git grep "NO coverage form"` on origin/main returns exactly ONE hit and it is
-  // the COMMENT recording the deletion (stages.mjs:2195), and skill-contract-enumerations.test.mjs
+  // the COMMENT recording the deletion ("A NO-FORM arm stood here until M6", in register-digest's message in
+  // stages.mjs), and skill-contract-enumerations.test.mjs
   // composes the dispatch under both stamp states and asserts the two texts are equal.
   //
   // The surviving prose arms in verify.mjs are NOT dead code and must not be tidied away with it: they
@@ -447,7 +448,7 @@ export const E3_BACKLOG = [
     where: "driver/skills/frame-diff/SKILL.md:44-48",
     surface: "skill-file",
     evidence: "A directive may carry a structured `remedy`:\\n```json\\n\"remedy\": { \"terms\": [\"TROPICAL WAVO\", \"ISLAND WAVO\"], \"nice_classes\": [\"5\", \"32\"], \"regions\": [] }\\n```",
-    reparsedBy: "driver/pipeline.mjs runSupplementalSweeps — the remedy lint refuses a label-shaped term; stages.mjs:2827 restates the same shape in the message (\"THE ASK CONTRACT, stated at BOTH levels\")",
+    reparsedBy: "driver/pipeline.mjs runSupplementalSweeps — the remedy lint refuses a label-shaped term; frame-diff's message in stages.mjs restates the same shape (\"THE ASK CONTRACT, stated at BOTH levels\")",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -524,7 +525,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3283",
     surface: "stage-message",
     evidence: "use_check = {\"source\",\"quality\"}: … quality: OPTIONAL, EXACTLY one of owner-site / independent / register-mirror … own_rights = {\"source\"}",
-    reparsedBy: "driver/verify.mjs:988 checkFindingsSibling (finding_use_check_missing); driver/own-rights.mjs:19-22",
+    reparsedBy: "driver/verify.mjs checkFindingsSibling (finding_use_check_missing); driver/own-rights.mjs:19-22",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -593,7 +594,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3115 (restated at driver/skills/clearance-search/synthesis-rules.md:428)",
     surface: "stage-message",
     evidence: "END that finding's actual-use line with a literal \"- **Use-check source:** <result URL | \"perplexity_research — no result\">\" line",
-    reparsedBy: "driver/verify.mjs validators.narrative (spec-11 hard reject); the repair hint re-dictates the literal at driver/gateway.mjs:2153",
+    reparsedBy: "driver/verify.mjs validators.narrative (spec-11 hard reject); the repair hint re-dictates the literal in correctionHint() in gateway.mjs",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -602,7 +603,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3128 (restated at driver/skills/clearance-search/synthesis-rules.md:475)",
     surface: "stage-message",
     evidence: "END that finding's reasoning with a literal \"- **Own-rights source:** <record URI(s) | \"no applicant-owned registrations in the searched register material\">\" line",
-    reparsedBy: "driver/own-rights.mjs:19-22 — \"This module only requires the 'Own-rights source:' line to exist\"; repair hint at driver/gateway.mjs:2370 (the `own_rights_missing` branch; re-verified 2026-08-29 — the old :1736 predated this branch and pointed into the A4 repeat-signature block)",
+    reparsedBy: "driver/own-rights.mjs, in its header — \"This module only requires the 'Own-rights source:' line to exist\"; repair hint in correctionHint() in gateway.mjs (the `own_rights_missing` branch; re-verified 2026-08-29 — the old :1736 predated this branch and pointed into the A4 repeat-signature block)",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -629,7 +630,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3502",
     surface: "stage-message",
     evidence: "ALSO write the RETRIEVAL RECORD to <path> — a JSON OBJECT with EXACTLY these keys: {\"schema_version\":2,\"queries\":[{\"query\":\"<the search you dispatched, verbatim>\",\"jurisdiction\":\"…\",\"results\":<how many hits it returned, or null when the query never reached a source — never 0 for a query you could not send>}, …],\"citations\":[{\"proceeding\":\"…\",\"forum\":\"…\",\"jurisdiction\":\"…\",\"decided\":\"…\"",
-    reparsedBy: "driver/verify.mjs validators.caseLaw — the ledger arm, armed by the stage-contract marker `citations` (stages.mjs:1822)",
+    reparsedBy: "driver/verify.mjs validators.caseLaw — the ledger arm, armed by the stage-contract marker `citations` (the case-law stage's `contract: { citations: 1 }` in stages.mjs)",
     removedByMove: "M5 moves `queries[]` to the call log (and is itself blocked: tool-calls.jsonl records no arguments); the envelope, schema_version, `read` enum and `citations[]` skeleton survive M5 entirely",
   },
   {
@@ -638,7 +639,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3510",
     surface: "stage-message",
     evidence: "EVERY \"Grounded profile\" section MUST start its body with the line \"- ord: <N>\" naming which finding it grounds (use the ordinal from this list; a profile that grounds no listed finding omits the line)",
-    reparsedBy: "driver/publish/parse.mjs:339, parseCaseLawProfiles() in parse.mjs (\"the optional '- ord: <N>' first body line … gives an EXACT join\"); driver/findings-model.mjs:274 /^-\\s*ord:\\s*(\\d+)\\s*$/m; driver/publish/index.mjs:778 runOrigins",
+    reparsedBy: "driver/publish/parse.mjs:339, parseCaseLawProfiles() in parse.mjs (\"the optional '- ord: <N>' first body line … gives an EXACT join\"); driver/findings-model.mjs:274 /^-\\s*ord:\\s*(\\d+)\\s*$/m; driver/publish/index.mjs publishReport (joinCaseLawProfiles)",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -697,7 +698,7 @@ export const E3_BACKLOG = [
     // `[on: -]` case went from a value to an ABSENCE — you omit the field — which is the one part a
     // reader could get wrong from the old wording, since there is no value meaning "no finding".
     evidence: "**AND EVERY FLAG CARRIES WHICH FINDING IT IS ABOUT** — the `on` field, an array of ordinals. Same rule as `kind`: you send the values, the driver renders the token.",
-    reparsedBy: "driver/verify.mjs:864 CORRECTION_ON_RE = /\\[on:\\s*([0-9,\\s-]*?)\\s*\\]/i. SKILL-FILE ONLY — the stage message at stages.mjs:1844-1877 never mentions `[on:]`. This is #850's \"the element shape is in the skill file, not the stage message\" in its purest form: an E3 lint reading stages.mjs alone sees the [kind:] token and misses its twin",
+    reparsedBy: "driver/verify.mjs:864 CORRECTION_ON_RE = /\\[on:\\s*([0-9,\\s-]*?)\\s*\\]/i. SKILL-FILE ONLY — the stage message (narrative-refutation's, in stages.mjs) never mentions `[on:]`. This is #850's \"the element shape is in the skill file, not the stage message\" in its purest form: an E3 lint reading stages.mjs alone sees the [kind:] token and misses its twin",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {