feat(tr,db,web): регистрово доказателство вместо отличителност на името (#279)

.github/workflows/deploy.yml

@@ -145,6 +145,26 @@ jobs:
           pnpm --filter @sigma/web exec wrangler d1 execute "${SIGMA_D1_NAME:-sigma}" \
             --config wrangler.deploy.jsonc --remote --yes \
             --file ../../packages/db/migrations/0003_related_persons_foundation.sql
+          # 0009 attaches the Trade Register evidence seal (#279, ADR-0033). Both migrations are
+          # applied by name here because wrangler's migration ledger is empty on this D1 (the base
+          # schema was created out-of-band), so `d1 migrations apply` would collide on 0000.
+          pnpm --filter @sigma/web exec wrangler d1 execute "${SIGMA_D1_NAME:-sigma}" \
+            --config wrangler.deploy.jsonc --remote --yes \
+            --file ../../packages/db/migrations/0009_interest_link_evidence.sql
+          # 0010 owns the publishing-gate enforcement for EVERY database (#279 §2) — fresh and already
+          # deployed alike. It is deliberately NOT declared in 0003: that migration is already applied
+          # everywhere, `CREATE TABLE IF NOT EXISTS` never revisits an existing table, and the ship step
+          # wipes ROWS, not definitions — so an in-place CHECK would exist only on databases built after
+          # the edit, and be absent on exactly the database that serves the site. Enforced with BEFORE
+          # INSERT/UPDATE triggers, NOT a table rebuild: the create-copy-drop-rename route would expose
+          # the foreign keys and strip every evidence seal, emptying the public surface until the next
+          # monthly run (see the migration header). `control_hash` stays NULLABLE by design — the register
+          # omits it on some declarations; the natural-key index folds those with COALESCE instead.
+          # Idempotent: every statement is `IF NOT EXISTS` over a converging definition, so re-applying it
+          # on each deploy is a no-op. Verified by three consecutive applications, gate still enforcing.
+          pnpm --filter @sigma/web exec wrangler d1 execute "${SIGMA_D1_NAME:-sigma}" \
+            --config wrangler.deploy.jsonc --remote --yes \
+            --file ../../packages/db/migrations/0010_publishing_gate_constraints.sql
       # The base schema was created out-of-band with `d1 execute --file`, so wrangler's migration
       # ledger is empty and `d1 migrations apply` would collide on 0000. Probe the actual table
       # instead. SQLite has no `ADD COLUMN IF NOT EXISTS`; a completion-marker table is created only

.github/workflows/scripts-test.yml

@@ -30,10 +30,11 @@ jobs:
       # ubuntu-latest image, and the test fails loudly (never skips) if it is ever absent.
       - run: node --test scripts/*.test.mjs
 
-  # свързани-лица CACBG pipeline tests (parse/classify/load/audit/tr-census/extract). These use
-  # node:sqlite (DatabaseSync) and import the shared companyNameKey .ts via the register-ts resolve
-  # hook, so they need Node 24 (node:sqlite + native TS type-stripping, no experimental flag) rather
-  # than the Node 22 above. The libel-critical resolution logic gates merges here.
+  # свързани-лица pipeline tests — the CACBG leg (parse/classify/load/audit/extract) and the
+  # Търговски регистър leg (scripts/tr: ЕИК checksum, HTTP client, deed cache). These use node:sqlite
+  # (DatabaseSync) and import the shared companyNameKey .ts via the register-ts resolve hook, so they
+  # need Node 24 (node:sqlite + native TS type-stripping, no experimental flag) rather than the Node 22
+  # above. The libel-critical resolution logic gates merges here.
   cacbg:
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -49,4 +50,6 @@ jobs:
       # parse.mjs imports fast-xml-parser (a workspace dep), so this job needs node_modules — unlike
       # the plain-node scripts above. Install before the scraper tests run.
       - run: pnpm install --frozen-lockfile
-      - run: node --import ./scripts/cacbg/register-ts.mjs --test scripts/cacbg/*.test.mjs
+      # Both legs, or the glob silently excludes a whole module: scripts/tr/*.test.mjs matched NO job
+      # until this line existed, so every test in it would have been decorative.
+      - run: node --import ./scripts/cacbg/register-ts.mjs --test scripts/cacbg/*.test.mjs scripts/tr/*.test.mjs

apps/web/app/components/ConflictCards.tsx

@@ -20,6 +20,7 @@ import {
   officialHref,
   partitionContracts,
   relationLabel,
+  registryEvidenceLabel,
   temporalLabel,
 } from '../lib/conflicts';
 
@@ -181,6 +182,26 @@ function ConflictCard({
               )}
             </dd>
           </div>
+          {/* The Trade Register fact the link's identity rests on (#279, ADR-0033). This is what makes
+              „every shown link explains itself" true rather than a promise: a reader can open the same act
+              we read and check it. The wording is careful — the register records a ROLE, it does not
+              certify the ownership claim, which comes from the official's own declaration. */}
+          <div className="cc-stat">
+            <dt>Регистър</dt>
+            <dd>
+              <ExternalEikLink eik={l.eik} />
+              <span className="small muted cc-evidence">
+                {registryEvidenceLabel(l)}
+                {l.registryEntryDate ? ` · вписване ${l.registryEntryDate}` : ''}
+                {/* The entry NUMBER, not just its date: a date does not identify a record, and this is
+                    what a reader types to find the same act we read. Rendered only when present —
+                    a seat/ЕИК confirmation cites no act entry, and an empty „№" would read as missing
+                    data rather than as an inapplicable field. */}
+                {l.registryEntryNumber ? ` · № ${l.registryEntryNumber}` : ''}
+                {l.registryLookupDate ? ` · справка ${l.registryLookupDate}` : ''}
+              </span>
+            </dd>
+          </div>
         </dl>
 
         {l.contractCount > 0 && (

apps/web/app/lib/conflicts.test.ts

@@ -21,6 +21,7 @@ import {
   partitionContracts,
   relationLabel,
   temporalLabel,
+  registryEvidenceLabel,
 } from './conflicts';
 
 function link(over: Partial<ConflictLink> = {}): ConflictLink {
@@ -43,7 +44,13 @@ function link(over: Partial<ConflictLink> = {}): ConflictLink {
     contemporaneousValueEur: 40_000_000,
     firstContractYear: '2021',
     lastContractYear: '2024',
-    sourceUrl: 'https://register.cacbg.bg/2024/i.xml',
+    sourceUrl: 'https://register.cacbg.bg/2024/x.xml',
+    // #279: a link only reaches the DTO when its identity rests on a Trade Register fact.
+    evidenceKind: 'document',
+    registryRole: 'owner',
+    registryEntryNumber: '20110502101007',
+    registryEntryDate: '2011-05-02',
+    registryLookupDate: '2026-08-05',
     ...over,
   };
 }
@@ -523,3 +530,31 @@ describe('authorityShareDisplay', () => {
     });
   });
 });
+
+describe('registryEvidenceLabel', () => {
+  // The wording is load-bearing. The register records a ROLE; it does not certify that the official owns
+  // anything — that claim comes from their own declaration and is rendered separately. A label that said
+  // „собственик според ТР" would assert something the evidence does not support (ADR-0033 decision 2).
+  it('reports what the act records, never an ownership conclusion', () => {
+    expect(registryEvidenceLabel({ evidenceKind: 'document', registryRole: 'owner' })).toBe(
+      'лицето е вписано като съдружник/собственик',
+    );
+    expect(registryEvidenceLabel({ evidenceKind: 'document', registryRole: 'manager' })).toBe(
+      'лицето е вписано като управител',
+    );
+  });
+
+  it('a seat/ЕИК confirmation claims identity, not a registry role', () => {
+    // „Потвърдено" means the COMPANY was identified from something the official declared — nobody was
+    // found in the act, so the label must not imply anyone was.
+    const label = registryEvidenceLabel({ evidenceKind: 'confirmed', registryRole: null });
+    expect(label).toBe('самоличност, потвърдена по декларирани данни');
+    expect(label).not.toMatch(/вписан/);
+  });
+
+  it('never renders the word „собственик" for a mere confirmation', () => {
+    expect(registryEvidenceLabel({ evidenceKind: 'confirmed', registryRole: 'owner' })).not.toMatch(
+      /собственик/,
+    );
+  });
+});

apps/web/app/lib/conflicts.ts

@@ -24,10 +24,45 @@ const RELATION_LABEL: Record<string, string> = {
 };
 
 /** Bulgarian label for a declared relation. Unknown values pass through — never invent a stronger claim. */
+/**
+ * How the company's identity was established, in the register's own terms (#279, ADR-0033).
+ *
+ * Deliberately does NOT say the official owns anything: „вписан съдружник/собственик" reports what the
+ * act RECORDS, while the ownership claim itself comes from the official's own declaration and is
+ * rendered separately as „дялово участие". „Потвърдено" means the company was identified by a fact the
+ * official declared — the seat or the ЕИК — not that anybody was found in the act.
+ */
+export function registryEvidenceLabel(l: {
+  evidenceKind: 'document' | 'confirmed';
+  registryRole: 'owner' | 'manager' | null;
+}): string {
+  if (l.evidenceKind === 'confirmed') return 'самоличност, потвърдена по декларирани данни';
+  return l.registryRole === 'manager'
+    ? 'лицето е вписано като управител'
+    : 'лицето е вписано като съдружник/собственик';
+}
+
 export function relationLabel(relation: string): string {
   return RELATION_LABEL[relation] ?? relation;
 }
 
+/**
+ * How to describe a PAGE's set of links in prose (#279 §2.6). The card labels above are already
+ * family-aware; the surrounding page copy was not, and asserted „собствен дял" — an OWN stake — above
+ * cards that correctly read „свързано лице". On a family-only page that is a false claim about the named
+ * official, and it is the second source of truth the card-label fix set out to remove.
+ *
+ * Derived from the links themselves rather than passed in, so a page cannot describe a set it isn't
+ * rendering. Mixed sets get the neutral wording: it is the only phrasing true of every card.
+ */
+export function declaredStakeNoun(links: { relation: string }[]): string {
+  const anyFamily = links.some((l) => l.relation === 'related');
+  const anySelf = links.some((l) => l.relation !== 'related');
+  if (anyFamily && !anySelf) return 'дял на свързано лице';
+  if (anyFamily && anySelf) return 'деклариран дял — собствен или на свързано лице';
+  return 'собствен дял';
+}
+
 // Defense in depth: the slug is base64url and the ЕИК numeric today (so encoding is a no-op), but if either
 // assumption ever drifts, an un-escaped `/`, `?` or `#` would break routing and the cache key. Escape the
 // dynamic segments unconditionally (ydimitrof #226, conflicts.ts).

apps/web/app/routes/conflict.company.tsx

@@ -9,7 +9,7 @@ import { ConflictCards } from '../components/ConflictCards';
 import { publicCache } from '../lib/cache';
 import { withDbRetry } from '../lib/retry';
 import { seoMeta } from '../lib/meta';
-import { companyProfileHref } from '../lib/conflicts';
+import { companyProfileHref, declaredStakeNoun } from '../lib/conflicts';
 
 // Officials with a published declared interest in one winner (by ЕИК). Reads interest_links only. 404 when
 // no official has a published link to this company — never an empty page under a company's name.
@@ -59,7 +59,7 @@ export default function ConflictCompany({ loaderData }: Route.ComponentProps) {
             </>
           }
           title={company}
-          lede={`Длъжностни лица, декларирали собствен дял в това дружество пред КПКОНПИ. ${count(links.length)} ${plural(links.length, 'връзка', 'връзки')} — всяка е точно съвпадение по фирмено име.`}
+          lede={`Длъжностни лица, декларирали ${declaredStakeNoun(links)} в това дружество пред КПКОНПИ. ${count(links.length)} ${plural(links.length, 'връзка', 'връзки')} — всяка почива на проверим факт от Търговския регистър.`}
         />
 
         <Callout titleAs="h2" title="Източник и обхват">