clearotron 0.3.0-beta.2 → 0.3.0-beta.3

package/INSTALL.md

@@ -491,6 +491,25 @@ matches, the neutral Generic default applies.
 - **Your real customers live outside the repo.** Point `CLEAROTRON_CUSTOMERS_DIR` at your own private
   config store and the engine loads *those* accounts instead. **Same engine, different config path** —
   the code carries no customer identities.
+
+  Two things go with it, and both are refusals rather than preferences:
+
+  - **`PROFILE_REPO_ROOT` moves too.** The customer directory has to sit inside the repository that
+    variable names, because editing a profile is a commit. Point one somewhere new and leave the other
+    behind and the portal and the profile service both refuse to start, naming both variables.
+  - **That repository needs a `user.name` and a `user.email` of its own.** Saves are committed under
+    the name of whoever asked for them, but git also records who *made* the commit, and it will not
+    commit at all without one. A service account usually has no global git identity, so a store created
+    by hand needs its own:
+
+    ```bash
+    git init -b main /srv/clearotron-store
+    git -C /srv/clearotron-store config user.name  "clearotron local install"
+    git -C /srv/clearotron-store config user.email "clearotron@example.com"
+    ```
+
+    `clearotron start` does this for the store it creates. A store you make yourself does not get it,
+    and the symptom is the first save failing at a commit rather than anything about profiles.
 - **Run data is external too.** Published reports, audits, and per-run state go to the archive pool at
   `CLEAROTRON_REPORTS_DIR`. Nothing customer-specific is committed to the repository.
 

package/bin/onboard.mjs

@@ -97,7 +97,7 @@ import { processTable } from "../shared/process-table.mjs";   // — /proc is no
 import { programsFromAnotherCheckout } from "../shared/checkout-move.mjs";
 import { entrypointOf } from "../driver/systemd/install-census.mjs";         // one ExecStart parser
 import { overlayReport, renderOverlayReport } from "../shared/doctrine-overlay.mjs";   // — the doctor reports the overlay
-import { whereSavesGo } from "../shared/store-in-repo.mjs";   // — doctor says where a portal save goes once it is committed
+import { whereSavesGo, storeCommitRefusal, storeInRepo, storeOutsideRepoMessage, resolveStoreRepoRoot } from "../shared/store-in-repo.mjs";   // — doctor says where a portal save goes once it is committed, and why saved searches are off
 import { engineInventory, engineMode, ENGINE_MODES } from "../driver/config-inventory.mjs";   //
 import { probeEngineTurn, probeFailureText, PROBE_MODEL, PROBE_TIMEOUT_SEC, engineEnvKeys } from "../driver/engine/probe.mjs";
 import { runRequiredNames, missingRequirements, REGISTER_ENV, ENGINE_ENV } from "../driver/run-requirements.mjs";   // the order-time gate's own question, asked here rather than restated
@@ -1799,6 +1799,41 @@ export async function runCheck() {
     }
   }
 
+  // — SAVED SEARCHES, JUDGED BY THE RULE THE PORTAL APPLIES WHEN IT STARTS. The portal switches them off,
+  // and answers every saved-search route "not found", when the store is unset or sits outside the
+  // repository its saves are committed in. Its boot log said so and nothing an operator runs did, so an
+  // install whose Custom searches could never load passed this command. Same resolver, same containment
+  // check, read from the services' environment for the reason the roster lines give; when that could not
+  // be read, the lines above already said so and nothing is judged here. A store that is configured but
+  // holds a file that cannot be read fails every company's saved searches, in the portal and the
+  // connector alike, so that is read here too.
+  if (!hosted || serviceKnown) {
+    const recipesSet = hosted ? effectiveForService("CLEAROTRON_RECIPES_DIR") : effective("CLEAROTRON_RECIPES_DIR");
+    const recipesDir = recipesSet?.v || null;
+    if (!recipesDir) {
+      info("saved searches are off: CLEAROTRON_RECIPES_DIR is not set, so Custom searches in the portal and the "
+        + "connector offer none. Name a directory inside a git repository to switch them on");
+    } else {
+      // Layered as effectiveForService layers it — this command's environment over the services' file — so
+      // the repository root is read from the same place the store directory above was.
+      const storeEnv = { ...(serviceFileEnv ?? {}), ...process.env };
+      const resolved = resolveStoreRepoRoot({ names: ["RECIPE_REPO_ROOT", "PROFILE_REPO_ROOT"], fallback: REPO, env: storeEnv });
+      const reach = storeInRepo(recipesDir, resolved.root);
+      if (!reach.ok) {
+        warn(`saved searches are OFF: ${storeOutsideRepoMessage({ storeVar: "CLEAROTRON_RECIPES_DIR", storeDir: reach.store, repoVar: "RECIPE_REPO_ROOT", repoRoot: reach.repo })} `
+          + `The repository came from ${resolved.from}. Until this is fixed the portal answers every saved-search request as not found`);
+      } else {
+        const { loadRecipes } = await import("../driver/search-policy.mjs");
+        let unreadable = null;
+        try { loadRecipes({ dir: recipesDir, force: true }); } catch (e) { unreadable = String(e?.message ?? e).split("\n")[0]; }
+        if (unreadable) {
+          warn(`saved searches cannot be read from ${recipesDir}: ${unreadable}. Every company's saved searches fail `
+            + "to load, in the portal and the connector, until that file is fixed");
+        } else ok(`saved searches are read from ${recipesDir}, and saves are committed in ${reach.repo}`);
+      }
+    }
+  }
+
   // — WHICH DOCTRINE FILES THIS INSTALL OVERRIDES, AND WHETHER OURS HAVE MOVED UNDER THEM.
   //
   // The report itself shipped in and worked, reachable only as `npm run doctrine-report` — a name
@@ -1846,7 +1881,21 @@ export async function runCheck() {
   }
 
   say("\n  Register provider");
-  const prov = effective("CLEAROTRON_DATABASE");
+  // WHAT THE SERVICES WILL SEARCH, READ AS THE ORDER-TIME CHECK BELOW READS IT. This section asked the
+  // shell and this command's .env, so in a fresh terminal on a hosted box it told a working install that
+  // no register was selected, one screen above "nothing a search is refused for is missing from the units'
+  // environment": one install, two answers, and the fix it named was already set. effectiveForService is
+  // the reader that check asks, so the two lines cannot disagree; where it cannot read the units, this
+  // says it could not look rather than reporting the register absent.
+  // Only a HOSTED box has a second environment to read; with no units, the services are started from
+  // this command's own file, and `effective` has always read and labelled exactly that.
+  const serviceValue = hosted ? effectiveForService : effective;
+  const prov = serviceKnown ? serviceValue("CLEAROTRON_DATABASE") : null;
+  if (!serviceKnown) {
+    info(`the units are installed but their environment could not be read (${unitEnv?.why ?? "no reason given"}) — `
+      + "which register the services search, and whether its keys are set, is not judged here: a failure to look, not a finding");
+  }
+  else
   // `blocking`, not `warn` and not `problem`. The exit status is a CONTRACT — an absence reports and
   // exits 0, a misconfiguration exits 1, and onboard-wizard.test.mjs holds it — so this cannot become a
   // `problem` however much it stops the reader: an install that has not chosen a register yet is
@@ -1865,7 +1914,7 @@ export async function runCheck() {
     else {
       ok(`${spec.id} — ${spec.label} (${prov.from})`);
       for (const k of spec.credentials) {
-        const c = effective(k);
+        const c = serviceValue(k);
         // issue 1871 — SET, not WORKING, and the line now says which. An operator reads a tick as "this
         // works"; this one is equally true of a valid key, an expired key, a key scoped to the wrong
         // account and forty characters of nonsense. --probe-providers is what settles it.
@@ -1876,7 +1925,7 @@ export async function runCheck() {
       // and never as a problem, but never silently either: the reader has to know which offices this
       // box will not reach before they read a report that says nothing was found there.
       for (const k of spec.optionalCredentials ?? []) {
-        const c = effective(k);
+        const c = serviceValue(k);
         if (c) ok(`${k} present (${c.from}) — presence only; add --probe-providers to prove it retrieves`);
         else info(`${k} is NOT set — ${spec.id} will run without it and DISCLOSE the offices it cannot reach as deferred coverage. Set it to search them.`);
       }
@@ -1884,8 +1933,10 @@ export async function runCheck() {
   }
 
   say("\n  Research provider");
-  const px = effective("PERPLEXITY_API_KEY");
-  if (px) ok(`PERPLEXITY_API_KEY present (${px.from}) — presence only; add --probe-providers to prove it answers`);
+  // The same reader as the register, for the same reason: this is a key the services use.
+  const px = serviceKnown ? serviceValue("PERPLEXITY_API_KEY") : null;
+  if (!serviceKnown) info("the units' environment could not be read, so whether the services hold PERPLEXITY_API_KEY is not judged here — a failure to look, not a finding");
+  else if (px) ok(`PERPLEXITY_API_KEY present (${px.from}) — presence only; add --probe-providers to prove it answers`);
   else info("PERPLEXITY_API_KEY is not set — the three clearance searches carry the common-law grid and cannot switch it off, so a clearance stops before it starts, and names the missing key; a Knockout search still runs and discloses the half it skipped");
 
   // ── — THE LANES A PRODUCT DECLARES IT NEEDS, BEFORE A REPORT NAMES THEM ──
@@ -3644,6 +3695,14 @@ try {
   candidate["CLEAROTRON_CUSTOMERS_DIR"] = join(cfg, "profiles");
   candidate.PROFILE_REPO_ROOT = cfg;   // no alias row — this name is current
   for (const k of ["CLEAROTRON_CUSTOMERS_DIR", "PROFILE_REPO_ROOT"]) ok(`${k}=${candidate[k]}`);
+  // A REPOSITORY ALREADY THERE IS ASKED NOW, while the operator is still here, whether it can record a
+  // save. `clearotron start` gives a store it creates an identity of its own; one made by hand has none
+  // unless somebody set it, and on a machine with no global identity the first company created in the
+  // portal is refused. Said here, with the command, rather than discovered on that first company.
+  if (existsSync(join(cfgAbs, ".git"))) {
+    const cannot = storeCommitRefusal(cfgAbs);
+    if (cannot) warn(`${cannot.message}. Until then, creating a company in the portal is refused.`);
+  }
 
   // CLEAROTRON_INSTRUCTIONS_DIR IS DELIBERATELY NOT WRITTEN (found in review).
   //

package/bin/start.mjs

@@ -109,7 +109,7 @@ async function runTables() {
   return { registers: PROVIDERS, engines: ENGINE_BINARIES, defaultEngine: RUN_DEFAULT_ENGINE };
 }
 import { spawn, spawnSync, execFileSync } from "node:child_process";
-import { storeInRepo, storeOutsideRepoMessage } from "../shared/store-in-repo.mjs";   //
+import { storeInRepo, storeOutsideRepoMessage, storeCommitRefusal } from "../shared/store-in-repo.mjs";   //
 import { stdioConnectOffer } from "../shared/stdio-connect.mjs";
 import { mergeEnvFile } from "../shared/env-file-merge.mjs";
 import { mcpOriginFor } from "../shared/lane-address.mjs";   // — one author for the origin
@@ -1252,6 +1252,12 @@ if (isMain) {
       // search is what will fail.
       err(`  WARNING: could not initialise the saved-search store at ${paths.configStore} (${String(e?.message ?? e)}). Searches will list and run; SAVING one will fail until this is a git repository.`);
     }
+  } else {
+    // AN ADOPTED STORE IS ASKED WHETHER IT CAN RECORD A SAVE, HERE, not at the first save. A repository
+    // made by hand has no identity unless somebody gave it one, and on a machine with no global identity
+    // the first company created in the portal is then refused. The one created above sets its own.
+    const cannot = storeCommitRefusal(paths.configStore);
+    if (cannot) err(`  WARNING: ${cannot.message}. Until then, creating a company or saving a search is refused.`);
   }
 
   // ── THE DEMO'S OWN STORE, WITH ITS COMPANY IN IT ────────────────────────────────────────────────

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "f24d87c471bd3073f3a56dbf0edff39d1a640175",
-  "version": "0.3.0-beta.2"
+  "commit": "5c5342ab541f8240732467dfc8bbf3c065ef13f6",
+  "version": "0.3.0-beta.3"
 }

package/driver/CHANGELOG.md

@@ -1,5 +1,27 @@
 # clearotron-driver
 
+## 0.3.0-beta.3
+
+### Patch Changes
+
+- a782aad: Fixed: Creating a company is refused, with nothing left behind, when the configuration store cannot record it. The company used to be created anyway, with no record of who made it or when, and its organisation was given access to it.
+  
+  A store with no git identity is the usual cause on a new machine, and the refusal names the command that fixes it. Setup and `clearotron start` now check a store they adopt for this straight away.
+- d1ef225: Fixed: A stage stopped at its time limit now records the output it actually produced. It used to record a small fraction, so a stage that was working read as one that had stalled.
+  
+  The token totals `clearotron tokens` reports for runs with a stopped stage now include that output.
+- 0ff42d1: Fixed: `clearotron doctor` now says when saved searches are switched off and why, and when a saved search file cannot be read.
+  
+  An assistant asking for saved searches is told when they could not be read, instead of being told there are none.
+- a782aad: Fixed: `clearotron doctor` reports the register and the research key the background services will use, read from the file they read. Run from a new terminal, it used to say no register was selected on an install whose searches were running.
+- 0ff42d1: Fixed: Global config appears in the account menu only for people who can open it. Someone managing one organisation used to be offered it, and the page then said it was not available.
+  
+  Clearances and People no longer ask for installation-wide data that a manager of one organisation cannot see.
+- a782aad: Fixed: A clearance or knockout searched through Compumark now links each register record to the trade mark office's own page for it. Those records used to show an internal reference nobody could open.
+  
+  The offices linked are the United States, the European Union, the United Kingdom, Canada, Australia, Switzerland, France, Norway, Sweden and WIPO. A record from any other office is cited by its number, and the report says why once, under the findings.
+- a782aad: Fixed: Saved searches work on a fresh install and in the demo, for every company, Generic included. They used to fail to load for every company, with a message saying to try again shortly.
+
 ## 0.3.0-beta.2
 
 ### Minor Changes

package/driver/driver.config.mjs

@@ -1110,6 +1110,11 @@ export const PROVIDERS = {
           office: row?.office ?? null,
           application_date: row?.application_date ?? null,
           registration_date: row?.registration_date ?? null,
+          // The office's own numbers: publish addresses the filing at the office's page from these, the
+          // way it does for this register's clearance findings. Compumark states no filing route or IR
+          // number of its own, so a Madrid designation is addressed as the national filing it is listed as.
+          application_number: row?.application_number ?? null,
+          registration_number: row?.registration_number ?? null,
           // hasPublicRecordUrl:false on this provider — there is no per-record page to link, and a
           // fabricated one would be worse than none.
           record_url: null,

package/driver/engine/anthropic-agent.mjs

@@ -467,19 +467,32 @@ export const anthropicAgentEngine = {
       let rateLimitEvent = null;   // a 429 session-cap rejection rides a `rate_limit_event` (status:"rejected" + resetsAt)
       // Streamed-usage accumulator: what the turn PROVABLY moved, observed from the stream itself, so a
       // killed turn is never journalled as usage:null when millions of tokens moved (the "137 + usage:null
-      // ⇒ mislabelled transient/lane-wedge" class). Per completed API call the `assistant` event's usage is
-      // authoritative (summed); an in-flight call contributes its `message_start` usage + the latest
-      // `message_delta` output count until its own assistant event supersedes them (no double count).
-      const streamTotals = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
-      let pendingStart = null, pendingDeltaOut = 0;
+      // ⇒ mislabelled transient/lane-wedge" class).
+      //
+      // KEYED BY MESSAGE, AND EACH FIELD IS THE LARGEST READING SEEN FOR THAT MESSAGE. One API call's usage
+      // reaches the stream several times: on `message_start`, on every `assistant` event (one per content
+      // block), and on its `message_delta`, whose output count is the call's own running total. Summing the
+      // assistant events counted a call's input and cache once per block and its output at whatever it
+      // was when the block went out, and dropping the delta lost the rest: a turn killed after 75 calls
+      // journalled 810 output tokens. Which event carries the final count need not be known here, and the
+      // order is inferred rather than recorded, so every reading is kept and the largest wins. A delta names
+      // no message, so it belongs to the one its last `message_start` opened; an assistant event with no id
+      // and no open message is a call of its own, as it always was.
+      const perMessage = new Map();
+      let openMessage = null, anonMessages = 0;
+      const foldUsage = (key, u) => {
+        if (!u) return;
+        const was = perMessage.get(key);
+        perMessage.set(key, was
+          ? { input: Math.max(was.input, u.input), output: Math.max(was.output, u.output),
+              cacheRead: Math.max(was.cacheRead, u.cacheRead), cacheWrite: Math.max(was.cacheWrite, u.cacheWrite) }
+          : { input: u.input, output: u.output, cacheRead: u.cacheRead, cacheWrite: u.cacheWrite });
+      };
       const streamedUsage = () => {
-        const p = mapUsage(pendingStart) ?? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
-        const u = {
-          input: streamTotals.input + p.input,
-          output: streamTotals.output + p.output + pendingDeltaOut,
-          cacheRead: streamTotals.cacheRead + p.cacheRead,
-          cacheWrite: streamTotals.cacheWrite + p.cacheWrite,
-        };
+        const u = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
+        for (const m of perMessage.values()) {
+          u.input += m.input; u.output += m.output; u.cacheRead += m.cacheRead; u.cacheWrite += m.cacheWrite;
+        }
         u.total = u.input + u.output + u.cacheRead + u.cacheWrite;
         return u.total > 0 ? u : null;   // zero observed movement stays null — a never-admitted turn must keep classifying as a lane wedge
       };
@@ -703,9 +716,9 @@ export const anthropicAgentEngine = {
             periodStart = now; periodChunk = chunkSeq;
           }
           syncOpenAsk();
-          const u = mapUsage(ev.message?.usage);
-          if (u) { streamTotals.input += u.input; streamTotals.output += u.output; streamTotals.cacheRead += u.cacheRead; streamTotals.cacheWrite += u.cacheWrite; }
-          pendingStart = null; pendingDeltaOut = 0;   // this call's usage is now authoritative — drop its partials
+          // This block's usage, folded into its own call: the largest reading wins, so a block's early count
+          // never replaces the delta's running total, and a second block of the same call adds nothing twice.
+          foldUsage(ev.message?.id ?? openMessage ?? `__assistant_${++anonMessages}`, mapUsage(ev.message?.usage));
           progress();
         }
         else if (ev.type === "user") {
@@ -737,8 +750,12 @@ export const anthropicAgentEngine = {
         }
         else if (ev.type === "stream_event") {
           const t = ev.event?.type;
-          if (t === "message_start") { pendingStart = ev.event.message?.usage ?? null; progress(); }
-          else if (t === "message_delta") { const o = Number(ev.event?.usage?.output_tokens); if (o > 0) pendingDeltaOut = o; progress(); }
+          if (t === "message_start") {
+            openMessage = ev.event.message?.id ?? `__start_${++anonMessages}`;
+            foldUsage(openMessage, mapUsage(ev.event.message?.usage));
+            progress();
+          }
+          else if (t === "message_delta") { foldUsage(openMessage ?? "__delta_without_start", mapUsage(ev.event?.usage)); progress(); }
           else if (t === "content_block_delta" || t === "content_block_start") progress();
           // THINKING GAUGE (partials): the earliest tells. Any one is sufficient; belt-and-braces so a
           // display-mode or CLI-version change cannot silently blind the gauge.

package/driver/gateway.mjs

@@ -1052,6 +1052,10 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         grant: gatherAllowedTools,
       })
       : null;
+    // The start of this attempt's window in the per-run refusal journals. Taken before the witness and
+    // the snapshot, which only widens the window by their own time: an earlier attempt's refusals all
+    // precede its own settle, so they stay outside it.
+    const dispatchedAt = Date.now();
     for (const line of describeMethodologyDrift(witnessStageMethodology(runDir, name, effMessage, engineResolveSkill)))
       note(`[${name}] ${line}`);
     // — the frozen judged-by set, hashed into THIS PROCESS'S MEMORY before the seat runs. Never
@@ -1368,7 +1372,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     // ONE artifact judgement, shared by both rescues below (the rule: never a second, drifting copy of
     // the contract). Present + written by THIS attempt (the per-attempt snapshot — an inherited file and
     // equally an earlier attempt's file never rescue a failed turn) + passes the stage's own validator.
-    const attemptWroteTruth = () => {
+    const attemptWroteTruth = (why = null) => {
       // — the rescues judge with `validate` directly rather than through judgeArtifacts, so the union
       // has to run here too or a rescued turn would be refused for rows the form already holds. Idempotent,
       // so the double call on the normal path costs a regeneration and changes nothing.
@@ -1381,16 +1385,21 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
       // answer for a killed-in-the-gap attempt is no. Idempotent, so the double call costs a regeneration.
       const pu = syncPlacementForm(files);
       if (pu) lastPlacementUnion = pu;
+      // `why`, when a caller passes one, is told WHICH file failed and on what, so a refusal can name both.
       return files.every((f) => {
         const now = statOf(f);
-        if (now === null || now === preArtifact.get(f)) return false;   // absent, or not written by this attempt
-        if (validate) { const v = validate(f, readFileSync(f, "utf8")); if (!v.ok) return false; }
+        const no = (cause, reason) => { if (why) Object.assign(why, { file: rel(f), cause, ...(reason ? { reason } : {}) }); return false; };
+        if (now === null) return no("absent");
+        if (now === preArtifact.get(f)) return no("not-written-by-this-attempt");
+        if (validate) { const v = validate(f, readFileSync(f, "utf8")); if (!v.ok) return no("invalid", v.reason ? String(v.reason) : undefined); }
         return true;
       });
     };
     let rescued = null;
     let quiescentMs = null;   //: how long the artifact had been untouched when the turn settled
-    let rescueRefused = null; //: WHICH of the rescue's three causes refused — on the row, not only in a note
+    let rescueRefused = null; //: WHICH of the rescue's four causes refused — on the row, not only in a note
+    let rescueRefusedFile = null, rescueRefusedReason = null;   //: and which file, and on what
+    let attemptRefusals = null;   //: this dispatch's refusals of a tool-written artifact, on a timeout
     if (fail && /^nonzero_exit_/.test(fail) && files.length) {
       if (killClass || killSeen) {
         note(`[${name}] ${fail} with a kill-class attempt in this ladder — the exit-1 rescue stays CLOSED (a killed turn's artifact may be torn mid-write and a validator cannot prove it whole); failing honestly instead`);
@@ -1427,16 +1436,28 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     //
     // A stage with no validator, or whose artifact fails it, or which never wrote, is untouched.
     else if (fail === "timeout" && turn.signals?.hardWall && files.length && validate && wallRescueEnabled()) {
-      // — `unreadable` is tracked as its own fact rather than inferred from the -1 sentinel. The
-      // sentinel is not the only way this goes negative: an artifact written in the same instant the turn
-      // settled yields a small NEGATIVE elapsed, and the refusal message read that as "artifact
-      // unreadable" — a diagnosis about the filesystem for a file that was perfectly readable and simply
-      // still being written. That is the under-quiescence case, and it is now named as one.
-      let unreadable = false;
-      const quiet = files.map((f) => { try { return settledAt - statSync(f).mtimeMs; } catch { unreadable = true; return -1; } });
-      quiescentMs = quiet.length ? Math.min(...quiet) : null;
+      // — A FILE THAT COULD NOT BE STAT'ED IS NAMED, WITH WHY, rather than folded into a number. It
+      // used to be a -1 in `quiescentMs` and the cause `artifact-unreadable`, and the commonest way to get
+      // there is not a filesystem fault at all: the turn was killed before it wrote. Measured on two
+      // stages of one run, 2026-09-10: both rows read `wrote: false`, `quiescentMs: -1`,
+      // `artifact-unreadable`, for files that did not exist. An ABSENT file (ENOENT) is its own cause now;
+      // `artifact-unreadable` stays for a stat that fails any other way, with its error code. Rows
+      // written before this change say `artifact-unreadable` for both.
+      //
+      // `quiescentMs` IS A MEASUREMENT OR IT IS ABSENT. With a file unstat'able there is no quiescence of
+      // the set to measure, so it stays null and the row omits it: a -1 reads as a number to anything that
+      // averages or compares it. An mtime that lands after the settle instant (written in that same
+      // instant, or a clock step) measures 0 rather than a negative; it is the under-quiescence case.
+      let missing = null;
+      const quiet = [];
+      for (const f of files) {
+        try { quiet.push(Math.max(0, settledAt - statSync(f).mtimeMs)); }
+        catch (e) { if (!missing) missing = { file: rel(f), code: String(e?.code ?? "unknown") }; }
+      }
+      quiescentMs = missing || !quiet.length ? null : Math.min(...quiet);
       const bar = wallRescueQuiesceMs();
-      if (quiescentMs >= bar && attemptWroteTruth()) {
+      const why = {};
+      if (quiescentMs !== null && quiescentMs >= bar && attemptWroteTruth(why)) {
         rescued = fail;
         fail = null;
         note(`[${name}] hard-wall kill at ${Math.round(wall)}s, but every expected artifact was written by this attempt, passes its validator and had been untouched for ${Math.round(quiescentMs / 1000)}s when the turn settled — the stage FINISHED and the wall is a fact about the dispatch, not a failure of the stage (the resume's skip path would accept these same bytes)`);
@@ -1451,12 +1472,24 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         // rescue was refused on the third cause, its validator — and 31 minutes of finished work were
         // discarded and re-run cold. `grep -c rescue run.jsonl` on that run returns 0. Nothing in the
         // record said why, and reconstructing it took a file-mtime comparison against a preserved run dir.
-        rescueRefused = unreadable ? "artifact-unreadable"
+        rescueRefused = missing ? (missing.code === "ENOENT" ? "artifact-absent" : "artifact-unreadable")
           : quiescentMs < bar ? "under-quiescence"
           : "not-written-by-this-attempt-or-invalid";
-        note(`[${name}] hard-wall kill at ${Math.round(wall)}s — wall rescue REFUSED (${unreadable ? "artifact unreadable" : quiescentMs < bar ? `artifact touched ${Math.round(quiescentMs / 1000)}s before the kill, under the ${Math.round(bar / 1000)}s quiescence bar` : "not written by this attempt, or fails its validator"}); failing honestly as timeout`);
+        // — AND WHICH FILE, AND ON WHAT: an unstat'able file with its error code; under the bar, the file
+        // touched last (`quiescentMs` carries the number); otherwise the first file the artifact judgement
+        // failed, with its cause — `absent`, `not-written-by-this-attempt`, or the validator's own reason.
+        if (missing) { rescueRefusedFile = missing.file; rescueRefusedReason = missing.code; }
+        else if (quiescentMs < bar) rescueRefusedFile = rel(files[quiet.indexOf(quiescentMs)]);
+        else { rescueRefusedFile = why.file ?? null; rescueRefusedReason = why.reason ?? why.cause ?? null; }
+        note(`[${name}] hard-wall kill at ${Math.round(wall)}s — wall rescue REFUSED (${rescueRefused}: ${rescueRefusedFile ?? "no file named"}${rescueRefusedReason ? `, ${rescueRefusedReason}` : quiescentMs < bar ? `, touched ${Math.round(quiescentMs / 1000)}s before the kill, under the ${Math.round(bar / 1000)}s bar` : ""}); failing honestly as timeout`);
       }
     }
+    // — WHAT A KILLED ATTEMPT WAS DOING, where its transport kept a record. A tool-written artifact's
+    // refusal journal says how many times this attempt sent its record and was told no, and the reason the
+    // last time. The missing-file row has carried that last reason since the journal existed; a timeout row
+    // carried nothing, so an attempt that spent forty minutes being refused read the same as one that never
+    // called. Counted from THIS dispatch only: the journal is per run, and every attempt appends to it.
+    if (fail === "timeout" && files.length) attemptRefusals = refusalsInWindow(files, runDir, dispatchedAt, settledAt);
     // Arm the ladder-wide refusal for every LATER attempt. Read before `classifyWedge` below only because
     // the rescue above needs it; the two can never disagree in reach — isTaintRow excludes lane_wedge, and
     // a wedge is a `timeout` fail that breaks the ladder immediately, so no later attempt exists to judge.
@@ -1675,6 +1708,8 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         // arm did not apply (no wall, no validator, no declared file).
         quiescentMs: Number.isFinite(quiescentMs) ? Math.round(quiescentMs) : undefined,
         rescueRefused: rescueRefused ?? undefined,   // — the cause, when the rescue looked and refused
+        rescueRefusedFile: rescueRefusedFile ?? undefined, rescueRefusedReason: rescueRefusedReason ?? undefined,
+        refusedCalls: attemptRefusals ?? undefined,   // — {count, last}: this dispatch's refusals, on a timeout
         //: the verbatim message this attempt was dispatched with — {file, sha, bytes, chars, kind}.
         // null when the run has no directory or the gate is off; {present:false, error} when the write
         // failed. An absence is a record here, never a silence.
@@ -1740,6 +1775,8 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           rescued: rescued ?? undefined, killed: killed || undefined,
           quiescentMs: Number.isFinite(quiescentMs) ? Math.round(quiescentMs) : undefined,   // — see the per-stage row
           rescueRefused: rescueRefused ?? undefined,   // — the cause, when the rescue looked and refused
+          rescueRefusedFile: rescueRefusedFile ?? undefined, rescueRefusedReason: rescueRefusedReason ?? undefined,
+          refusedCalls: attemptRefusals ?? undefined,   // — see the per-stage row
           // — AND THE BILLING PAIR, by the same argument makes for the model pair one field up:
           // the spine carries it or the two logs disagree about what ran. This is the row a sweep across
           // archived runs actually reads, and the question "has this box ever billed API" could not be
@@ -2007,6 +2044,30 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
   return { ok: false, attempts: attempt, fail: lastFail, sessionKey: lastKey, modelWire: lastModelWire, modelUsed: lastModelUsed, attemptFails: [...attemptFails], warmEscalated: warmEscalatedAt > 0 || undefined, quantity: lastQuantity, reads: lastReads, readsTruncated: lastReadsTruncated, warm: lastWarm, wrote: lastWrote, formRepairs: formRepairsUsed };
 }
 
+/**
+ * One dispatch's refusals, read from the refusal journals of the tool-written artifacts in `files`.
+ * An entry is placed by its `at`; one with no readable `at` cannot be placed in a dispatch, so it is
+ * counted apart rather than guessed into this one.
+ * @returns {{ count: number, last: string|null, unattributed?: number } | null}  null when no file in
+ *   `files` has a refusal journal, so "this stage keeps no journal" never reads as "nothing was refused".
+ */
+function refusalsInWindow(files, runDir, from, to) {
+  let journals = 0, count = 0, unattributed = 0, last = null, lastAt = -Infinity;
+  for (const f of files) {
+    const reader = toolWrittenArtifact(f)?.refusals;
+    if (!reader) continue;
+    journals++;
+    for (const r of reader(runDir, f) ?? []) {
+      const at = Date.parse(String(r?.at ?? ""));
+      if (!Number.isFinite(at)) { unattributed++; continue; }
+      if (at < from || at > to) continue;
+      count++;
+      if (at >= lastAt) { lastAt = at; last = String(r?.reason ?? ""); }
+    }
+  }
+  return journals ? { count, last, ...(unattributed ? { unattributed } : {}) } : null;
+}
+
 function rel(p) {
   const i = p.indexOf("/prelim-search/");
   return i >= 0 ? p.slice(i + 1) : p;

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.0-beta.2",
+  "version": "0.3.0-beta.3",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/portal-service.mjs

@@ -4589,7 +4589,7 @@ const PORT = PORT_CHOICE.port;
         const recipeCommit = committing(recipeRepoRoot, "saved-search");
         // — same, against the RECIPE repo root, which may differ from the profile one.
         const recAudit = makeCommittableAudit({ auditPath: recipeAuditPath, repoRoot: recipeRepoRoot });
-        const recipes = makeRecipeService({ recipesDir, profileDir, gitCommit: recipeCommit, audit: recAudit });
+        const recipes = makeRecipeService({ recipesDir, profileDir, readLayered: true, gitCommit: recipeCommit, audit: recAudit });
         callRecipes = (method, path, body, identity) => recipes.route(method, path, { email: identity?.email }, body ?? {});
         log(`saved searches ON — store=${recipesDir} repo=${recipeRepoRoot}`);
       } else {

package/driver/profile-service.mjs

@@ -471,13 +471,41 @@ export function makeProfileService({
         throw e;
       }
 
+      // A CREATE THE STORE CANNOT RECORD IS REFUSED, NOT REPORTED AS DONE. This answered 201 with the
+      // company live and a `commitError` beside it, so a machine with no git identity got a company with no
+      // record of who made it or when, on its first company, and the store move had been made to close
+      // exactly that gap. The store is asked first, and a refusal writes nothing: no profile, no audit row
+      // and, since the organisation's grant is filed only on a 201, no grant.
+      const cannot = typeof gitCommit?.refusal === "function" ? gitCommit.refusal() : null;
+      if (cannot) {
+        return { status: 409, json: { error: `No company was created: ${cannot.message}, then try again.`, code: `store_${cannot.code.replace(/-/g, "_")}` } };
+      }
       const { files } = writeProfile({ profileDir, key: wanted, profile, contextPack: "" });
-      // WRITTEN AND RECORDED ARE TWO EVENTS. The write is live the instant it renames; the commit can
-      // fail on its own. Reporting them as one is how somebody is told nothing happened about a company
-      // that is already governing runs.
       const message = `chore(clearotron): create company ${wanted} (via portal, by ${by})`;
       const { commit, commitError } = commitWithAuditRow({ audit, gitCommit, files, message, by,
         row: { event: "profile-create", key: wanted, by, fields: Object.keys(profile) } });
+      // AND ONE THAT FAILS ANYWAY IS WITHDRAWN. A hook or a full disk can refuse the commit after the store
+      // said it could record. The paths this create wrote were absent before it, so they are returned to
+      // absent, and a third audit row says so after the two the failed commit left.
+      if (commitError) {
+        // GIT'S LAST WORD, NOT ITS ECHO. The error opens with the whole command line it ran, message and
+        // author included, and ends with the refusal itself: a hook's own sentence, "No space left on
+        // device". The operator acts on the last line.
+        const cause = String(commitError).trim().split("\n").map((l) => l.trim()).filter(Boolean).pop() ?? String(commitError);
+        let left = null;
+        try {
+          if (typeof gitCommit?.withdraw !== "function") throw new Error("this store cannot withdraw what it wrote");
+          gitCommit.withdraw(files);
+        } catch (e) { left = String(e?.message ?? e).slice(0, 200); }
+        try {
+          audit({ event: "profile-create-withdrawn", of: "profile-create", key: wanted, by,
+            note: left ? `the create could not be recorded and its files could not be removed (${left})` : "the create could not be recorded, so its files were removed" });
+        } catch { /* the refusal below is the report; a journal failure must not mask it */ }
+        if (left) {
+          return { status: 500, json: { key: wanted, error: `The company could not be recorded (${cause}), and its file could not be removed afterwards (${left}). It is on disk with no record behind it — tell an administrator.` } };
+        }
+        return { status: 409, json: { error: `No company was created: the store could not record it (${cause}). Nothing was left behind.`, code: "store_commit_failed" } };
+      }
       return { status: 201, json: {
         key: wanted, name, written: true, created: true, commit,
         // The receipt reads off THESE, so it can say which framework and how many marketplaces, and

package/driver/publish/index.mjs

@@ -22,7 +22,7 @@ import { reportIdentityFor, productCoverageNote, isRegisterOnly } from '../searc
 import { readRecordArtifacts, bindFindingsToRecords, joinEvidenceStatus } from '../registry-fidelity.mjs';
 import { deliveryFlagLines } from '../predelivery-lint.mjs';
 import { PROVIDERS, config } from '../driver.config.mjs';
-import { recordOriginsFor } from '../record-origins.mjs';
+import { declaredRecordOrigins } from '../record-origins.mjs';
 import { NEUTRAL_DELIVERY, loadProfiles } from '../profiles.mjs';
 import { resolveDemoData, demoBannerMd } from './demo-marking.mjs';   // — one demo question, every product; 2134 — every SURFACE
 import { engineCommit } from '../engine-build.mjs';
@@ -546,7 +546,7 @@ export async function regenSurfaces(poolRoot) {}
  *                             all three client surfaces state the same link. That agreement is the point:
  *                             a repair that reached the report and not the workbook would put two
  *                             different registers in one delivery.
- * @param {string[]|null} origins  recordOriginsFor(the run's own provider). `null` = the run has no fetch
+ * @param {string[]|null} origins  declaredRecordOrigins(the run's own provider). `null` = the run has no fetch
  *                             receipts (legacy/archived): a NO-OP, byte-identical output, because a run
  *                             that never named its register cannot be judged against one. `[]` is a
  *                             different answer — this provider publishes no per-record page at all, so no
@@ -773,7 +773,8 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   //
   // So this REPAIRS rather than refuses, keyed on the RUN's own provider (the receipts above), never on
   // today's CLEAROTRON_DATABASE — a republished archive keeps its own register.
-  const runOrigins = fetchReceipts ? recordOriginsFor(String(fetchReceipts[0]?.provider ?? '').toLowerCase()) : null;
+  // Receipts that name no provider are read as no receipts: the gate is off, as it is for a legacy run.
+  const runOrigins = fetchReceipts ? declaredRecordOrigins(fetchReceipts[0]?.provider) : null;
   const foreignRecordLinks = normalizeRecordLinks(findings, runOrigins);
   // — the SAME list reaches the renderer. normalizeRecordLinks repairs foreign ABSOLUTE links on
   // register-sourced findings; render.mjs separately CONSTRUCTS links from bare record paths, and until
@@ -859,7 +860,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
     const esPath = driverDir(runDir ?? dirname(reportMd), 'enforcer-signals.json');
     if (existsSync(esPath)) { const es = JSON.parse(readFileSync(esPath, 'utf8')); if (Array.isArray(es)) enforcerSignals = es; }
   } catch { /* absent — no telemetry lines */ }
-  const officeLinks = officeLinksFor(findings, recordsByUri, fetchReceipts); bindFindingsToRecords(findings, recordsByUri);
+  const officeLinks = officeLinksFor(findings, recordsByUri, runOrigins); bindFindingsToRecords(findings, recordsByUri);
   // 404-card caveat (2026-07-22): the V4-2 closure pass persisted every cited record its targeted
   // fetch definitively could not retrieve (predelivery-lint.json artifactSet.recordFetchFailures);
   // the evidence join stamps `_recordFetchFailure` from it so the card render carries the
@@ -1621,12 +1622,14 @@ export function composeEmailHtml(reportMdPath, url, auditFile, names = [], deliv
 
 // ── The office's own page for each fetched record, where the run's register publishes none of its own ──
 // Addressed from the record's numbers (office-record-links.mjs), never from the model or the handle, and
-// null on every other register, so those runs publish exactly as before. The tally goes to meta.json and
-// the log, so a register whose numbers never fit shows up as a count rather than as silence. Kept down
-// here, below every line the rest of the tree cites by number.
+// null on every register that publishes pages of its own, so those runs publish exactly as before. Which
+// registers those are is `runOrigins`, the same answer the record-URL normalisation above keys on, so the
+// two cannot disagree about one register. The tally goes to meta.json and the log, so a register whose
+// numbers never fit shows up as a count rather than as silence. Kept down here, below every line the rest
+// of the tree cites by number.
 import { recordLinksFor } from './office-record-links.mjs';
-function officeLinksFor(findings, recordsByUri, fetchReceipts) {
-  const links = recordLinksFor(findings, recordsByUri, fetchReceipts?.[0]?.provider);
+function officeLinksFor(findings, recordsByUri, runOrigins) {
+  const links = recordLinksFor(findings, recordsByUri, runOrigins);
   if (links) console.log(`[record-links] ${links.summary}`);
   return links;
 }

package/driver/publish/knockout.mjs

@@ -401,8 +401,9 @@ export async function publishKnockout({ runId, codename, runDir, findings, plan,
   // THE OFFICE'S OWN PAGE FOR EACH LISTED FILING, where the run's register publishes none of its own:
   // the addressing the clearance gives its register findings (office-record-links.mjs), set on the
   // sidecar here for the same reason the normalisation above is. Keyed on the run's own provider, and
-  // the tally goes to meta.json, so numbers that never fit show as a count rather than as silence.
-  const officeLinks = addressListedFilings(registerRecords);
+  // the tally goes to meta.json, so numbers that never fit show as a count rather than as silence. A
+  // sidecar that names no provider is left as it was, as the normalisation above leaves it.
+  const officeLinks = addressListedFilings(registerRecords, declaredRecordOrigins(registerRecords?.provider));
   if (officeLinks) note(`[record-links] ${officeLinks.summary}`);
 
   // ── Predelivery lint — the APPLICABLE subset, FLAGS not FAILS (2026-07-31) ─────────────────────────
@@ -753,3 +754,4 @@ export function knockoutDocumentRoutes(reports, { auditFile = null } = {}) {
 // The office's own page for each listed filing (office-record-links.mjs). Kept down here, below every
 // line the rest of the tree cites by number.
 import { addressListedFilings, reasonCellFor } from './office-record-links.mjs';
+import { declaredRecordOrigins } from '../record-origins.mjs';