clearotron 0.3.1-beta.3 → 0.3.1

package/portal-ui/dist/assets/{index-C-QysgZM.js → index-ChIQsMYp.js}

@@ -11629,6 +11629,11 @@ function decodeStatus(status, body) {
 				errors: errorsOf(body),
 				detail: refused
 			};
+			if (refused) return {
+				kind: "gate",
+				message: "That could not be done. Nothing was changed.",
+				detail: refused
+			};
 			const msg = errorsOf(body)[0] ?? "This action could not be completed.";
 			return /version|conflict/i.test(msg) && !/confirmation|plan again|re-confirm/i.test(msg) ? {
 				kind: "conflict",
@@ -11794,6 +11799,33 @@ function decodeAccess(b) {
 		}];
 	});
 }
+var decodeSteps = (raw) => asArray(raw).flatMap((x) => {
+	const s = asRecord(x);
+	const text = asString(s["text"]);
+	if (!text) return [];
+	const hint = asString(s["hint"]);
+	const c = s["copy"] == null ? null : asRecord(s["copy"]);
+	let copy;
+	if (c) {
+		const kind = asString(c["kind"]);
+		if (kind === "block" && asString(c["text"])) copy = {
+			kind,
+			text: asString(c["text"])
+		};
+		else if (kind === "secret" && asString(c["label"]) && asString(c["template"]) && asString(c["slot"]) && asString(c["template"]).includes(asString(c["slot"]))) copy = {
+			kind,
+			label: asString(c["label"]),
+			template: asString(c["template"]),
+			slot: asString(c["slot"])
+		};
+		else return [];
+	}
+	return [{
+		text,
+		...hint ? { hint } : {},
+		...copy ? { copy } : {}
+	}];
+});
 function decodePerson(r) {
 	return {
 		email: asString(r["email"]) ?? "",
@@ -12089,33 +12121,12 @@ var api = {
 				...asString(r["sub"]) ? { sub: asString(r["sub"]) } : {},
 				...asString(r["verifiedOn"]) ? { verifiedOn: asString(r["verifiedOn"]) } : {},
 				...asString(r["by"]) ? { by: asString(r["by"]) } : {},
-				steps: asArray(r["steps"]).flatMap((x) => {
-					const s = asRecord(x);
-					const text = asString(s["text"]);
-					if (!text) return [];
-					const hint = asString(s["hint"]);
-					const c = s["copy"] == null ? null : asRecord(s["copy"]);
-					let copy;
-					if (c) {
-						const kind = asString(c["kind"]);
-						if (kind === "block" && asString(c["text"])) copy = {
-							kind,
-							text: asString(c["text"])
-						};
-						else if (kind === "secret" && asString(c["label"]) && asString(c["template"]) && asString(c["slot"]) && asString(c["template"]).includes(asString(c["slot"]))) copy = {
-							kind,
-							label: asString(c["label"]),
-							template: asString(c["template"]),
-							slot: asString(c["slot"])
-						};
-						else return [];
-					}
-					return [{
-						text,
-						...hint ? { hint } : {},
-						...copy ? { copy } : {}
-					}];
-				}),
+				steps: decodeSteps(r["steps"]),
+				...r["door"] === "sign-in" || r["door"] === "key" ? { door: r["door"] } : Object.hasOwn(r, "door") ? { door: null } : {},
+				...!(r["door"] === "sign-in" || r["door"] === "key") && Object.hasOwn(r, "altSteps") ? (() => {
+					const a = decodeSteps(r["altSteps"]);
+					return a.length ? { altSteps: a } : {};
+				})() : {},
 				launch: (() => {
 					const u = asString(asRecord(r["launch"])["url"]);
 					return u && /^https:\/\//.test(u) ? { url: u } : null;
@@ -13714,11 +13725,34 @@ var RANK = {
 	paused: 2,
 	queued: 3
 };
+var STOPPED = new Set(["failed", "cancelled"]);
+var whenOf = (r) => {
+	for (const raw of [r.issuedAt, r.date]) {
+		if (!raw) continue;
+		const t = new Date(raw).getTime();
+		if (!Number.isNaN(t)) return t;
+	}
+	return null;
+};
+var withinWindow = (r, now, days) => {
+	const at = whenOf(r);
+	return at === null || now - at <= days * 24 * 60 * 60 * 1e3;
+};
+var failuresNewestFirst = (a, b) => {
+	const at = whenOf(a), bt = whenOf(b);
+	if (at === null && bt === null) return 0;
+	if (at === null) return -1;
+	if (bt === null) return 1;
+	return newestFirst(a, b);
+};
 function inFlight(runs) {
-	return runs.filter((r) => r.state !== "delivered" && !r.acked).slice().sort((a, b) => (RANK[a.state] ?? 9) - (RANK[b.state] ?? 9));
+	return runs.filter((r) => r.state !== "delivered" && !STOPPED.has(r.state)).slice().sort((a, b) => (RANK[a.state] ?? 9) - (RANK[b.state] ?? 9));
+}
+function recentFailures(runs, { now = Date.now(), days = 7 } = {}) {
+	return runs.filter((r) => STOPPED.has(r.state) && !r.acked && withinWindow(r, now, days)).slice().sort(failuresNewestFirst);
 }
-function acknowledged(runs) {
-	return runs.filter((r) => r.state !== "delivered" && r.acked).slice().sort((a, b) => (RANK[a.state] ?? 9) - (RANK[b.state] ?? 9));
+function acknowledged(runs, { now = Date.now(), days = 7 } = {}) {
+	return runs.filter((r) => STOPPED.has(r.state) && r.acked === true && withinWindow(r, now, days)).slice().sort(failuresNewestFirst);
 }
 function readStamps(rows) {
 	const identity = (r) => [
@@ -13877,11 +13911,14 @@ function Home({ ctx }) {
 	const allRuns = result?.kind === "ok" ? result.value : [];
 	const runs = (0, import_react.useMemo)(() => runsFor(allRuns, ctx.owner), [allRuns, ctx.owner]);
 	const rows = (0, import_react.useMemo)(() => inFlight(runs), [runs]);
+	const stopped = (0, import_react.useMemo)(() => recentFailures(runs), [runs]);
+	const [showStopped, setShowStopped] = (0, import_react.useState)(false);
 	const acked = (0, import_react.useMemo)(() => acknowledged(runs), [runs]);
 	const [showAcked, setShowAcked] = (0, import_react.useState)(false);
 	const cards = (0, import_react.useMemo)(() => active(rows), [rows]);
 	const queue = (0, import_react.useMemo)(() => waiting(rows), [rows]);
 	const stamps = (0, import_react.useMemo)(() => readStamps(rows), [rows]);
+	const stoppedStamps = (0, import_react.useMemo)(() => readStamps(stopped), [stopped]);
 	const ackedStamps = (0, import_react.useMemo)(() => readStamps(acked), [acked]);
 	const done = (0, import_react.useMemo)(() => recentlyFinished(runs, void 0, 3), [runs]);
 	const recent = (0, import_react.useMemo)(() => done.map(lastFinishedOf).filter((r) => r !== null), [done]);
@@ -13933,6 +13970,28 @@ function Home({ ctx }) {
 				onChanged: reload,
 				stamps
 			}) : null,
+			stopped.length ? (0, import_jsx_runtime.jsxs)("div", {
+				className: "home2-stopped",
+				children: [(0, import_jsx_runtime.jsxs)("button", {
+					type: "button",
+					className: "home2-stopped-toggle",
+					"aria-expanded": showStopped,
+					onClick: () => setShowStopped((v) => !v),
+					children: [
+						stopped.length,
+						" stopped recently",
+						showStopped ? "" : " — show"
+					]
+				}), showStopped ? (0, import_jsx_runtime.jsx)("div", {
+					className: "home2-cards",
+					children: stopped.map((r) => (0, import_jsx_runtime.jsx)(Card, {
+						run: r,
+						ctx,
+						onChanged: reload,
+						stamp: stoppedStamps.get(r.runId) ?? null
+					}, r.runId))
+				}) : null]
+			}) : null,
 			acked.length ? (0, import_jsx_runtime.jsxs)("div", {
 				className: "home2-acked",
 				children: [(0, import_jsx_runtime.jsxs)("button", {
@@ -13972,7 +14031,7 @@ function Home({ ctx }) {
 				total: finishedCount,
 				ctx
 			}) : null,
-			answer === "ok" && !cards.length && !queue.length && !recent.length ? (0, import_jsx_runtime.jsx)(FirstRun$1, { onNew: canRun(ctx.me) ? () => ctx.go("/portal/new") : null }) : null,
+			answer === "ok" && !cards.length && !queue.length && !recent.length && !stopped.length && !acked.length ? (0, import_jsx_runtime.jsx)(FirstRun$1, { onNew: canRun(ctx.me) ? () => ctx.go("/portal/new") : null }) : null,
 			usageRes?.kind === "ok" ? (0, import_jsx_runtime.jsx)("p", {
 				className: "home2-limits mono",
 				children: limitLine(usageRes.value.today, usageRes.value.dailyRuns)
@@ -21521,74 +21580,103 @@ function StepsPanel({ offer, measuring = false, state = AT_REST, onBlock, onSecr
 				className: "steps-name",
 				children: offer.name
 			}),
-			(0, import_jsx_runtime.jsx)("ol", {
-				className: "steps",
-				children: offer.steps.map((s, i) => {
-					const c = s.copy;
-					const flashed = !measuring && state.copiedAt === i;
-					const landed = measuring && c?.kind === "secret" ? fill(c, mask("")) : state.landedAt === i ? state.landed : null;
-					return (0, import_jsx_runtime.jsx)("li", { children: (0, import_jsx_runtime.jsxs)("div", { children: [
-						(0, import_jsx_runtime.jsx)("div", {
-							className: "step-text",
-							children: (0, import_jsx_runtime.jsx)(Marked, { text: s.text })
-						}),
-						c?.kind === "block" ? (0, import_jsx_runtime.jsxs)("div", {
-							className: "codeblock",
-							children: [(0, import_jsx_runtime.jsx)("pre", { children: c.text }), (0, import_jsx_runtime.jsx)("button", {
-								type: "button",
-								className: `btn-ghost${flashed ? " is-copied" : ""}`,
-								"data-step": i,
-								tabIndex: measuring ? -1 : void 0,
-								onClick: () => onBlock?.(i, c.text),
-								children: flashed ? "✓ Copied" : "Copy"
-							})]
-						}) : null,
-						c?.kind === "secret" ? (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
-							(0, import_jsx_runtime.jsx)("div", {
-								className: "secret-btn",
-								children: (0, import_jsx_runtime.jsx)("button", {
-									type: "button",
-									className: `btn-primary${flashed ? " is-copied" : ""}`,
-									"data-step": i,
-									tabIndex: measuring ? -1 : void 0,
-									onClick: () => onSecret?.(i, c),
-									children: flashed ? (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [(0, import_jsx_runtime.jsx)(Icon, {
-										name: "check",
-										size: 15
-									}), "Copied"] }) : landed ? "Copy again" : c.label
-								})
-							}),
-							landed ? (0, import_jsx_runtime.jsxs)("div", {
-								className: "landed",
-								children: [(0, import_jsx_runtime.jsx)("div", {
-									className: "landed-label",
-									children: "On your clipboard now"
-								}), landed.split("\n").map((line, n) => (0, import_jsx_runtime.jsx)("div", {
-									className: "mono",
-									children: line
-								}, n))]
-							}) : null,
-							!measuring && state.revealedAt === i && state.revealed ? (0, import_jsx_runtime.jsxs)("div", {
-								className: "landed",
-								children: [(0, import_jsx_runtime.jsx)("p", {
-									className: "ai-said",
-									children: "Your browser would not let us copy it. Copy this by hand — it is yours, and it will not be shown again."
-								}), (0, import_jsx_runtime.jsx)("pre", {
-									className: "ai-pre",
-									children: state.revealed
-								})]
-							}) : null
-						] }) : null,
-						s.hint ? (0, import_jsx_runtime.jsx)("div", {
-							className: "step-hint",
-							children: (0, import_jsx_runtime.jsx)(Marked, { text: s.hint })
-						}) : null
-					] }) }, i);
-				})
-			})
+			offer.door === null && offer.altSteps?.length ? (0, import_jsx_runtime.jsx)("p", {
+				className: "steps-unknown",
+				children: "We could not check how this Clearotron lets an assistant in, so both ways are below. Try the first — your assistant will tell you if it needs the other."
+			}) : null,
+			(0, import_jsx_runtime.jsx)(StepList, {
+				steps: offer.steps,
+				offset: 0,
+				measuring,
+				state,
+				onBlock,
+				onSecret
+			}),
+			offer.door === null && offer.altSteps?.length ? (0, import_jsx_runtime.jsxs)("div", {
+				className: "steps-alt",
+				children: [(0, import_jsx_runtime.jsx)("h4", {
+					className: "steps-alt-head",
+					children: "If your assistant asks to be let in another way"
+				}), (0, import_jsx_runtime.jsx)(StepList, {
+					steps: offer.altSteps,
+					offset: offer.steps.length,
+					measuring,
+					state,
+					onBlock,
+					onSecret
+				})]
+			}) : null
 		]
 	});
 }
+function StepList({ steps, offset, measuring = false, state = AT_REST, onBlock, onSecret }) {
+	return (0, import_jsx_runtime.jsx)("ol", {
+		className: "steps",
+		children: steps.map((s, n) => {
+			const i = n + offset;
+			const c = s.copy;
+			const flashed = !measuring && state.copiedAt === i;
+			const landed = measuring && c?.kind === "secret" ? fill(c, mask("")) : state.landedAt === i ? state.landed : null;
+			return (0, import_jsx_runtime.jsx)("li", { children: (0, import_jsx_runtime.jsxs)("div", { children: [
+				(0, import_jsx_runtime.jsx)("div", {
+					className: "step-text",
+					children: (0, import_jsx_runtime.jsx)(Marked, { text: s.text })
+				}),
+				c?.kind === "block" ? (0, import_jsx_runtime.jsxs)("div", {
+					className: "codeblock",
+					children: [(0, import_jsx_runtime.jsx)("pre", { children: c.text }), (0, import_jsx_runtime.jsx)("button", {
+						type: "button",
+						className: `btn-ghost${flashed ? " is-copied" : ""}`,
+						"data-step": i,
+						tabIndex: measuring ? -1 : void 0,
+						onClick: () => onBlock?.(i, c.text),
+						children: flashed ? "✓ Copied" : "Copy"
+					})]
+				}) : null,
+				c?.kind === "secret" ? (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+					(0, import_jsx_runtime.jsx)("div", {
+						className: "secret-btn",
+						children: (0, import_jsx_runtime.jsx)("button", {
+							type: "button",
+							className: `btn-primary${flashed ? " is-copied" : ""}`,
+							"data-step": i,
+							tabIndex: measuring ? -1 : void 0,
+							onClick: () => onSecret?.(i, c),
+							children: flashed ? (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [(0, import_jsx_runtime.jsx)(Icon, {
+								name: "check",
+								size: 15
+							}), "Copied"] }) : landed ? "Copy again" : c.label
+						})
+					}),
+					landed ? (0, import_jsx_runtime.jsxs)("div", {
+						className: "landed",
+						children: [(0, import_jsx_runtime.jsx)("div", {
+							className: "landed-label",
+							children: "On your clipboard now"
+						}), landed.split("\n").map((line, n) => (0, import_jsx_runtime.jsx)("div", {
+							className: "mono",
+							children: line
+						}, n))]
+					}) : null,
+					!measuring && state.revealedAt === i && state.revealed ? (0, import_jsx_runtime.jsxs)("div", {
+						className: "landed",
+						children: [(0, import_jsx_runtime.jsx)("p", {
+							className: "ai-said",
+							children: "Your browser would not let us copy it. Copy this by hand — it is yours, and it will not be shown again."
+						}), (0, import_jsx_runtime.jsx)("pre", {
+							className: "ai-pre",
+							children: state.revealed
+						})]
+					}) : null
+				] }) : null,
+				s.hint ? (0, import_jsx_runtime.jsx)("div", {
+					className: "step-hint",
+					children: (0, import_jsx_runtime.jsx)(Marked, { text: s.hint })
+				}) : null
+			] }) }, i);
+		})
+	});
+}
 function NotOnline() {
 	return (0, import_jsx_runtime.jsxs)("div", {
 		className: "notice ai-none",
@@ -23807,6 +23895,7 @@ function PeopleAccess({ ctx }) {
 						}) }) : v.people.map((p) => (0, import_jsx_runtime.jsx)(Row, {
 							person: p,
 							you: p.email.toLowerCase() === ctx.me.email.toLowerCase(),
+							canModify: !v.localSignIn,
 							onModify: () => ctx.go(`${MODIFY_PERSON.path}?email=${encodeURIComponent(p.email)}`)
 						}, p.email)) })]
 					})
@@ -23937,7 +24026,7 @@ function Observed({ result }) {
 		]
 	});
 }
-function Row({ person, you, onModify }) {
+function Row({ person, you, canModify, onModify }) {
 	const chips = accessChips(person.access);
 	const viewOnly = !person.permissions.run && !person.permissions.manage;
 	return (0, import_jsx_runtime.jsxs)("tr", { children: [
@@ -23988,8 +24077,9 @@ function Row({ person, you, onModify }) {
 			children: you ? null : (0, import_jsx_runtime.jsx)("button", {
 				type: "button",
 				className: "pill",
+				disabled: !canModify,
 				style: {
-					cursor: "pointer",
+					cursor: canModify ? "pointer" : "default",
 					fontSize: 12
 				},
 				onClick: onModify,
@@ -24103,7 +24193,7 @@ function GiveAccess({ ctx }) {
 			setBusy(false);
 		}
 	};
-	const failure = result && !isOk(result) ? result.kind === "conflict" ? "This Clearotron now signs in one person, so nobody can be added. Nothing was saved." : result.kind === "notFound" ? "You can only give access to what you have access to yourself. Nothing was saved." : result.kind === "reject" ? result.errors.join(" ") : saveFailureText(result, "That could not be saved. Nothing was changed.") : null;
+	const failure = result && !isOk(result) ? result.kind === "gate" && result.detail?.code === "local_sign_in" ? "This Clearotron now signs in one person, so nobody can be added. Nothing was saved." : result.kind === "conflict" ? "This Clearotron now signs in one person, so nobody can be added. Nothing was saved." : result.kind === "notFound" ? "You can only give access to what you have access to yourself. Nothing was saved." : result.kind === "reject" ? result.errors.join(" ") : saveFailureText(result, "That could not be saved. Nothing was changed.") : null;
 	return (0, import_jsx_runtime.jsx)("div", {
 		className: "screen",
 		children: (0, import_jsx_runtime.jsxs)("div", {
@@ -24408,6 +24498,7 @@ function ModifyAccess({ ctx }) {
 	}, person.email);
 }
 function Form({ ctx, person, view }) {
+	const readOnlyPeople = view.localSignIn;
 	const held = heldBy(person);
 	const [permissions, setPermissions] = (0, import_react.useState)(person.permissions);
 	const [chosen, setChosen] = (0, import_react.useState)(held);
@@ -24476,7 +24567,7 @@ function Form({ ctx, person, view }) {
 			setBusy(false);
 		}
 	};
-	const failure = (r) => r === null || isOk(r) ? null : r.kind === "conflict" ? "This Clearotron now signs in one person, so nobody else can be changed. Nothing was saved." : r.kind === "notFound" ? "That is not access you can change. Nothing was saved." : r.kind === "reject" ? r.errors.join(" ") : saveFailureText(r, "That could not be saved. Nothing was changed.");
+	const failure = (r) => r === null || isOk(r) ? null : r.kind === "gate" && r.detail?.code === "local_sign_in" ? "This Clearotron now signs in one person, so nobody else can be changed. Nothing was saved." : r.kind === "conflict" ? "This Clearotron now signs in one person, so nobody else can be changed. Nothing was saved." : r.kind === "notFound" ? "That is not access you can change. Nothing was saved." : r.kind === "reject" ? r.errors.join(" ") : saveFailureText(r, "That could not be saved. Nothing was changed.");
 	const problem = failure(saved) ?? failure(gone);
 	const loses = person.access.length ? person.access.map((a) => a.kind === "everything" ? "everything on this Clearotron" : a.name ?? a.key) : [];
 	const holdsKey = (person.keys ?? 0) > 0;
@@ -24640,6 +24731,21 @@ function Form({ ctx, person, view }) {
 						] })]
 					})
 				}) : null,
+				readOnlyPeople ? (0, import_jsx_runtime.jsx)("div", {
+					className: "notice quiet",
+					style: { marginBottom: 14 },
+					children: (0, import_jsx_runtime.jsxs)("p", {
+						style: {
+							margin: 0,
+							fontSize: 13.5,
+							color: "var(--text-muted)"
+						},
+						children: [(0, import_jsx_runtime.jsx)("b", {
+							style: { color: "var(--text-strong)" },
+							children: "This Clearotron signs in one person: you."
+						}), " Nobody else can be changed or removed here. To hold more than one person, put it behind a login system such as your company single sign-on."]
+					})
+				}) : null,
 				(0, import_jsx_runtime.jsxs)("div", {
 					style: {
 						display: "flex",
@@ -24650,7 +24756,7 @@ function Form({ ctx, person, view }) {
 						(0, import_jsx_runtime.jsx)("button", {
 							type: "button",
 							className: "btn-primary",
-							disabled: !dirty || busy || leftWithNothing,
+							disabled: !dirty || busy || leftWithNothing || readOnlyPeople,
 							onClick: () => void save(),
 							children: busy && !confirming ? "Saving…" : "Save changes"
 						}),
@@ -24768,10 +24874,10 @@ function Form({ ctx, person, view }) {
 						type: "button",
 						className: "pill",
 						style: {
-							cursor: "pointer",
+							cursor: readOnlyPeople ? "default" : "pointer",
 							fontSize: 12
 						},
-						disabled: busy,
+						disabled: busy || readOnlyPeople,
 						onClick: () => setConfirming(true),
 						children: whole ? domain ? `Remove everyone at ${domain}` : "Remove from Clearotron" : `Remove from ${[...held.orgs].map(orgName).join(", ") || "here"}`
 					}), whole ? null : (0, import_jsx_runtime.jsx)("p", {

package/portal-ui/dist/assets/{index-CaSZbEMb.css → index-DBIs21e4.css}

@@ -2082,6 +2082,28 @@ input.filter {
    Quiet on purpose. These are runs the reader has already dealt with, and the whole point of the
    feature is that they stop competing with live work for attention — a panel styled like the queue
    would put them back in the fight it just took them out of. */
+/* WHAT STOPPED RECENTLY — louder than acknowledged, quieter than live work.
+   The count carries the page's only standing signal that something failed, so it is readable rather
+   than faint; the fold below it is the part that keeps the dashboard about what is happening now. */
+.home2-stopped { margin-top: 18px; }
+.home2-stopped-toggle {
+  padding: 0; background: none; border: 0; cursor: pointer; font: inherit; font-size: 13.5px;
+  font-weight: 600; color: var(--text-strong); text-decoration: underline;
+}
+.home2-stopped-toggle:hover { color: var(--text-accent); }
+.home2-stopped .home2-cards { margin-top: 11px; }
+
+/* THE UNKNOWN DOOR — a sentence the reader must not skip, and the alternative under its own heading.
+   Both are quiet relative to the steps themselves: the primary set is still what to try first. */
+.steps-unknown {
+  margin: 0 0 12px; font-size: 12.5px; line-height: 1.5; color: var(--text-muted);
+  border-left: 2px solid var(--border-hairline); padding-left: 10px;
+}
+.steps-alt { margin-top: 20px; padding-top: 14px; border-top: 1px solid var(--border-hairline); }
+.steps-alt-head {
+  margin: 0 0 10px; font-size: 12.5px; font-weight: 600; letter-spacing: .02em; color: var(--text-muted);
+}
+
 .home2-acked { margin-top: 13px; }
 .home2-acked-toggle {
   padding: 0; background: none; border: 0; cursor: pointer; font: inherit; font-size: 12.5px;

package/portal-ui/dist/index.html

@@ -49,8 +49,8 @@
     -->
     <link rel="preconnect" href="https://api.fontshare.com" crossorigin />
     <link href="https://api.fontshare.com/v2/css?f[]=satoshi@400,500,700,900&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/portal/assets/index-C-QysgZM.js"></script>
-    <link rel="stylesheet" crossorigin href="/portal/assets/index-CaSZbEMb.css">
+    <script type="module" crossorigin src="/portal/assets/index-ChIQsMYp.js"></script>
+    <link rel="stylesheet" crossorigin href="/portal/assets/index-DBIs21e4.css">
   </head>
   <body>
     <div id="root"></div>

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.3.1-beta.3",
+  "version": "0.3.1",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,13 @@
 # trademark-oauth-mcp-bridge
 
+## 0.3.1
+
+No changes in this release.
+
+## 0.3.1-beta.4
+
+No changes in this release.
+
 ## 0.3.1-beta.3
 
 No changes in this release.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.3.1-beta.3",
+  "version": "0.3.1",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/scripts/citation-line-check.mjs

@@ -713,12 +713,63 @@ const OWN_NUMBER = /^\s*(?:at\s+\d|:\d)/;
 // The cost of naming a file is that a REAL bare citation added there also escapes. That is the same trade
 // the reference-strip signatures make for the same reason, and it is preferable to a pattern, which would
 // quietly widen to files nobody considered.
-export const RATCHET_EXEMPT = ["driver/test/a-new-citation-carries-something-that-can-be-checked.test.mjs"];
+// ── EXEMPT FROM THE RATCHET, AND ONLY WHERE SOMETHING STRONGER CHECKS THE SAME CITATIONS ───────────
+//
+// The ratchet refuses a NEW bare citation, which is right everywhere it is the only check. It is not the
+// only check on `contract-e3-backlog.mjs`: `contract-audit.test.mjs` reads each backlog row's own
+// evidence, finds where that dictation now starts, and refuses a row whose number points away from it.
+// That is a stronger guarantee than "a symbol sits beside the number" — it verifies the number itself.
+//
+// THE TWO ARE IN DIRECT CONFLICT ON THAT FILE, and the conflict is not hypothetical: an edit to
+// `stages.mjs` moves those rows, the evidence guard then DEMANDS they be repointed, and every repointed
+// row reads to the ratchet as a newly added bare citation. Under both rules at once the only permitted
+// change to that file is no change at all. Measured on the change that found this: 31 rows repointed at
+// the evidence guard's own instruction, 31 refused by the ratchet.
+//
+// So the file is exempt from the weaker check and stays under the stronger one. Anything NOT covered by
+// an evidence guard does not belong on this list — the exemption is earned by being checked better, not
+// by being inconvenient.
+//
+// `contract-vocabulary.mjs` is the same conflict one file over, and it arrives by the same route. Each
+// INNER_CODES row carries a `mints` array naming the line that WRITES its code, and
+// `contract-audit.test.mjs` re-reads every one of them on every run: it checks the cited line still
+// mints that code, and when it does not it prints where the code is NOW and refuses. That arm's own
+// message says "Do not delete the citation: it is what makes the ruling checkable rather than merely
+// written down" — so the ratchet's remedy, dropping the number, is the one repair that file forbids.
+//
+// Measured on the change that added this: a 41-line insertion into `connotation-search.mjs` moved 12
+// mint sites, the audit demanded all 12 be repointed, and the ratchet then read all 12 as newly added
+// bare citations. Under both rules at once the only permitted change is no change at all.
+//
+// The alternative considered and rejected: teach the audit's `m.split(":")` to accept `file:line symbol`
+// and tag the 12. It widens a parser every INNER_CODES row depends on, to buy a weaker guarantee than
+// the one already in place — the audit verifies the NUMBER, which is what a symbol only approximates.
+//
+// SO THE EXEMPTION IS SCOPED TO THE LINES THE AUDIT ACTUALLY COVERS, not to the file. Measured on this
+// tree: `contract-vocabulary.mjs` carries 117 numbered citations, 21 of them inside `mints` arrays and 96
+// outside. A file-wide entry would have taken the ratchet off all 117 to protect 21 — and the 96 are
+// precisely the prose and `site:` citations nothing else checks. Every `mints` array is written on one
+// line, so a `when` pattern matching that line is exact rather than approximate.
+//
+// An entry is either a bare path (the whole file, for the two cases where the whole file earns it) or
+// `{ file, when }`, where `when` must match the LINE the citation sits on. A `when` that stops matching
+// re-arms the ratchet over those lines, which is the failure direction worth having.
+export const RATCHET_EXEMPT = [
+  "driver/test/a-new-citation-carries-something-that-can-be-checked.test.mjs",
+  "driver/contract-e3-backlog.mjs",
+  // The `mints` lines only: `contract-audit.test.mjs` verifies each of those numbers against the line
+  // that writes the code. Everything else in this file stays under the ratchet.
+  { file: "driver/contract-vocabulary.mjs", when: /mints:\s*\[/ },
+];
+
+/** Whether a citation on `text` in `file` is exempt from the ratchet. PURE. */
+export const ratchetExempt = (file, text) => RATCHET_EXEMPT.some((e) =>
+  (typeof e === "string" ? e === file : e.file === file && e.when.test(String(text ?? ""))));
 
 export function newBareCitations(addedLines) {
   const out = [];
   for (const { file, line, text } of addedLines ?? []) {
-    if (RATCHET_EXEMPT.includes(file)) continue;
+    if (ratchetExempt(file, text)) continue;
     for (const m of String(text ?? "").matchAll(CITE_RE)) {
       // The same discriminator the corpus scan uses: a second `:number` closing a paren is a V8 stack
       // frame, not a citation. Reading them as citations would refuse a fixture that captured a trace.