clearotron 0.3.2-beta.0 → 0.3.2-beta.2

package/portal-ui/dist/assets/{index-DBIs21e4.css → index-DNQpLYZF.css}

@@ -1960,8 +1960,20 @@ input.filter {
   color: var(--text-strong); white-space: nowrap;
 }
 .home2-band-label.faint { color: var(--text-faint); }
-.home2-band-count { font-size: 11.5px; color: var(--text-faint); }
+/* THE SAME SIZE AND COLOUR AS THE CAPACITY LINE OPPOSITE, because the two are one sentence read across
+   the band: what is happening on the left, how much can happen at once on the right. It carried `mono`
+   while it was a single total, which read as a machine's counter rather than as a statement. `nowrap`
+   because it is now a breakdown — "2 running · 1 paused · 2 queued" — and breaking it mid-clause puts
+   a number on its own line. */
+.home2-band-count { font-size: 11.5px; color: var(--text-faint); white-space: nowrap; }
 .home2-band-rule { height: 1px; background: var(--border-hairline); }
+
+/* A RUNNING RUN AS A ROW. The queue's grid, with the two columns a running row has and a waiting one
+   does not. Declared as a modifier rather than a new grid so the narrow-screen rule that hides columns
+   keeps one definition for both. */
+.home2-runrows { display: flex; flex-direction: column; gap: 1px; margin-bottom: 18px; }
+.home2-runrow .home2-qstep { font-size: 11.5px; color: var(--text-muted); white-space: nowrap; }
+.home2-runrow .home2-qreason { font-size: 11.5px; color: var(--text-muted); white-space: nowrap; }
 .home2-band-note {
   font-size: 11.5px; color: var(--text-faint); text-align: right;
   white-space: nowrap; overflow: hidden; text-overflow: ellipsis;
@@ -2045,6 +2057,10 @@ input.filter {
   display: flex; align-items: center; gap: 10px;
 }
 .home2-reason { flex: 1; min-width: 0; font-size: 12.5px; color: var(--text-muted); }
+/* QUIETER THAN THE ELAPSED TIME IT FOLLOWS. The elapsed line is this run's own fact; the quote beside it
+   is the standing one for its pipeline, and a reader who wants to know how long this has been going
+   should meet that first. Same line, one step back in the hierarchy. */
+.home2-expect { font-size: 12.5px; color: var(--text-faint); white-space: nowrap; }
 .home2-reason.paused { color: var(--tone-medium); }
 .home2-reason.failed { color: var(--tone-high); }
 .home2-stop, .home2-cancel, .home2-ack {

package/portal-ui/dist/index.html

@@ -49,8 +49,8 @@
     -->
     <link rel="preconnect" href="https://api.fontshare.com" crossorigin />
     <link href="https://api.fontshare.com/v2/css?f[]=satoshi@400,500,700,900&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/portal/assets/index-ChIQsMYp.js"></script>
-    <link rel="stylesheet" crossorigin href="/portal/assets/index-DBIs21e4.css">
+    <script type="module" crossorigin src="/portal/assets/index-BsbasHjM.js"></script>
+    <link rel="stylesheet" crossorigin href="/portal/assets/index-DNQpLYZF.css">
   </head>
   <body>
     <div id="root"></div>

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.3.2-beta.0",
+  "version": "0.3.2-beta.2",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,13 @@
 # trademark-oauth-mcp-bridge
 
+## 0.3.2-beta.2
+
+No changes in this release.
+
+## 0.3.2-beta.1
+
+No changes in this release.
+
 ## 0.3.2-beta.0
 
 No changes in this release.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.3.2-beta.0",
+  "version": "0.3.2-beta.2",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/providers/signa/src/core.js

@@ -576,7 +576,35 @@ export function toSignaParams(p = {}) {
   const mode = String(p.match_mode ?? "").trim();
   if (mode === "exact" || mode === "phonetic" || mode === "prefix") out.strategies = [mode];
   else if (mode === "starts_with" || mode === "ends_with" || mode === "contains") out.match = mode;
-  else if (!mode && !p.match && !(Array.isArray(p.strategies) && p.strategies.length)) {
+  // ── `default` IS THE COUNT LANE'S WORD FOR THE SAME UNANCHORED QUERY THE PLAN LANE CALLS `{}` ────
+  //
+  // THE DEFECT. The count lane hands `match_mode: "default"` straight through — that is the word
+  // `COUNT_PREDICATES` gives the CONTAINING predicate, the one whose figure a client reads under
+  // "Filings containing the name". `default` matched none of the branches here, so neither request
+  // shape was selected, and `buildSearchRequest`'s else branch sent `strategies: ["exact"]`. The
+  // containing column therefore printed an exact count, on the axis that most signals how crowded a
+  // field is, and a client was told the field was less busy than it is in a number the report states
+  // as fact. Nothing failed and nothing was logged: a narrower query answers perfectly well, it just
+  // answers a different question.
+  //
+  // The branch below already does exactly this for the plan lane, which reaches here with NO mode at
+  // all. The two lanes mean the same thing by different words; they now take the same shape.
+  else if (mode === "default") {
+    if (typeof out.query === "string" && !out.query.includes("*")) out.match = "contains";
+  }
+  // ── AN UNRECOGNISED MODE REFUSES; IT DOES NOT QUIETLY BECOME A NARROWER SEARCH ──────────────────
+  //
+  // THE CLASS, and it has now bitten twice. This function's own header records `starts_with` falling
+  // through to a plain exact search — "a NARROWER query than the plan asked for, answering as though it
+  // were the one requested" — and `default` has just done the same on a client-facing figure. Both were
+  // fixed by adding the missing word. Adding words one defect at a time leaves the next unmapped mode
+  // to do it a third time, silently, in whichever direction happens to be wrong.
+  //
+  // So a mode this provider cannot express is now NAMED rather than approximated. The caller turns it
+  // into a refused cell, and a refused cell is a disclosed gap a reader can see; a wrong number is not
+  // visible at all. This can only fire where a number would otherwise have been silently wrong.
+  else if (mode) out.unsupported_match_mode = mode;
+  if (!mode && !p.match && !(Array.isArray(p.strategies) && p.strategies.length)) {
     // ── THE `default` PREDICATE, WHICH JUST MADE EXECUTABLE ────────────────────────────────
     // `planPredicateParams` returns {} for the plan's `default` predicate — no match_mode at all —
     // and this branch is the only thing standing between that and `strategies: ["exact"]`. With

package/scripts/freeze-example-run.mjs

@@ -29,7 +29,7 @@
 //   _driver/run.jsonl        the event log
 //   _driver/stage-inputs/    what each stage was handed
 //   _history/                pre-reopen snapshots
-// Dropping the telemetry drops `meta.tokens` (driver/publish/index.mjs:971 — the only consumer of
+// Dropping the telemetry drops `meta.tokens` (driver/publish/index.mjs:1136 rollupTokens — the only consumer of
 // rollupTokens). That is the one difference step 5 is told to expect, and it says so out loud rather than
 // normalising it away in silence.
 //
@@ -55,26 +55,26 @@ const REPO = join(dirname(fileURLToPath(import.meta.url)), "..");
 // Every entry cites the read that puts it here. `required` means publish cannot render without it.
 const FROZEN_FILES = [
   // publish/index.mjs — parseReport(reportMd), the one mandatory input
-  { path: "report.md", required: true, why: "publish/index.mjs:649 parseReport" },
-  { path: "audit.md", why: "publish/index.mjs:835 audit workbook source" },
-  { path: "findings.json", why: "publish/index.mjs:555 the per-finding machine contract" },
-  { path: "status.json", why: "publish/index.mjs:730,905 machine ledger note + markName" },
-  { path: "case-law-findings.md", why: "publish/index.mjs:660 case-law section" },
-  { path: "common-law-grid.json", why: "publish/index.mjs:788 common-law coverage" },
+  { path: "report.md", required: true, why: "publish/index.mjs:650 parseReport" },
+  { path: "audit.md", why: "publish/index.mjs:1022 auditMd, the audit workbook source" },
+  { path: "findings.json", why: "publish/index.mjs:715 readStore, the per-finding machine contract" },
+  { path: "status.json", why: "publish/index.mjs:913 machineLedgerNote + markName" },
+  { path: "case-law-findings.md", why: "publish/index.mjs:849 clPath, the case-law section" },
+  { path: "common-law-grid.json", why: "publish/index.mjs:973 commonLawJoinedTerms, common-law coverage" },
   // publish/index.mjs — the _driver sidecars it reads by name
-  { path: "_driver/receipts.json", why: "publish/index.mjs:592" },
-  { path: "_driver/senior-rights.json", why: "publish/index.mjs:599" },
-  { path: "_driver/verdict.json", why: "publish/index.mjs:604" },
-  { path: "_driver/framework.json", why: "publish/index.mjs:608 the bands the run was rated under" },
-  { path: "_driver/register-plan.json", why: "publish/index.mjs:634" },
-  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:641 fallback for register-plan" },
-  { path: "_driver/enforcer-signals.json", why: "publish/index.mjs:672" },
-  { path: "_driver/predelivery-lint.json", why: "publish/index.mjs:699,713" },
-  { path: "_driver/escalation-state.json", why: "publish/index.mjs:714" },
-  { path: "_driver/reasoning-integrity.json", why: "publish/index.mjs:715" },
-  { path: "_driver/corrections-state.json", why: "publish/index.mjs:716" },
-  { path: "_driver/search-policy.json", why: "publish/index.mjs:768,806 level + stage label" },
-  { path: "_driver/profile.json", why: "publish/index.mjs:920 + report-registry.mjs:42 customer key" },
+  { path: "_driver/receipts.json", why: "publish/index.mjs:761 fetchReceipts" },
+  { path: "_driver/senior-rights.json", why: "publish/index.mjs:787 seniorRights" },
+  { path: "_driver/verdict.json", why: "publish/index.mjs:792 verdictInfo" },
+  { path: "_driver/framework.json", why: "publish/index.mjs, the frozen band vocabulary the run was rated under" },
+  { path: "_driver/register-plan.json", why: "publish/index.mjs:820 scopeBasis" },
+  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:821 searchedJurisdictions, the fallback for register-plan" },
+  { path: "_driver/enforcer-signals.json", why: "publish/index.mjs:861 esPath" },
+  { path: "_driver/predelivery-lint.json", why: "publish/index.mjs:170 lintSink" },
+  { path: "_driver/escalation-state.json", why: "publish/index.mjs:171 escSink" },
+  { path: "_driver/reasoning-integrity.json", why: "publish/index.mjs:898 integritySink" },
+  { path: "_driver/corrections-state.json", why: "publish/index.mjs:172 correctionsSink" },
+  { path: "_driver/search-policy.json", why: "publish/index.mjs:955 searchPolicy, level + stage label" },
+  { path: "_driver/profile.json", why: "publish/index.mjs reads the frozen profile; report-registry.mjs:42 republishRun, customer key" },
 ];
 
 // ── THE KNOCKOUT LANE IS A DIFFERENT WORKSPACE, AND report.md IS NOT IN IT ─
@@ -91,22 +91,22 @@ const KNOCKOUT_FILES = [
   { path: "knockout-assessment.md", why: "the merged prose the lane writes (gateway.mjs:184)" },
   { path: "knockout-frame.md", why: "the batch scope note (gateway.mjs:65)" },
   { path: "email-body.md", why: "the delivery prose the lane writes beside the assessment" },
-  { path: "status.json", why: "publish/index.mjs:730,905 machine ledger note + markName" },
-  { path: "audit.md", why: "publish/index.mjs:835 audit workbook source" },
+  { path: "status.json", why: "publish/index.mjs:913 machineLedgerNote + markName" },
+  { path: "audit.md", why: "publish/index.mjs:1022 auditMd, the audit workbook source" },
   // The _driver sidecars publishKnockout reads by name. framework.json is REQUIRED and says so at its
   // call site: a knockout re-rendered under today's bands would silently restate its verdict.
   { path: "_driver/framework.json", required: true, why: "report-registry.mjs:68 the bands it was rated under" },
   { path: "_driver/search-policy.json", why: "report-registry.mjs:71 level + stage label" },
   { path: "_driver/profile.json", why: "report-registry.mjs:72 customer key and the delivery overlay" },
-  { path: "_driver/verdict.json", why: "publish/index.mjs:604" },
-  { path: "_driver/receipts.json", why: "publish/index.mjs:592" },
+  { path: "_driver/verdict.json", why: "publish/index.mjs:792 verdictInfo" },
+  { path: "_driver/receipts.json", why: "publish/index.mjs:761 fetchReceipts" },
   // THE COUNT SIDECARS, AND THE PROOF IS WHAT FOUND THEM. Without register-counts.json the republished
   // meta carries `registerCounts: undefined` where the source carried the provider, the taken-at stamp
   // and the per-mark counts — so the workbook's Register column and every counted figure in the
   // knockout report render empty (publish/knockout.mjs:140-155). Named by stages-knockout.mjs:32,41.
   { path: "_driver/register-counts.json", why: "publish/knockout.mjs:140-155 counted figures + the Register column" },
   { path: "_driver/register-records.json", why: "stages-knockout.mjs:41 the terms behind the close-variation axis" },
-  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:641 fallback for register-plan" },
+  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:821 searchedJurisdictions, the fallback for register-plan" },
 ];
 
 /** The allowlist for a template. One place, so a new template cannot half-exist. */
@@ -161,8 +161,8 @@ const SCRUB = [
 // what varies and why, and step 5 prints them — a normalisation nobody can see is a normalisation that
 // hides the next real difference.
 const VOLATILE = [
-  { id: "issued", re: /\d{4}-\d{2}-\d{2} · \d{2}:\d{2} [A-Z]{2,5}/g, sub: "<issued>", why: "publish/index.mjs:520 generation stamp, firm locale" },
-  { id: "iso-timestamp", re: /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z/g, sub: "<ts>", why: "publish/index.mjs:665 asOf / :1067 issuedAt" },
+  { id: "issued", re: /\d{4}-\d{2}-\d{2} · \d{2}:\d{2} [A-Z]{2,5}/g, sub: "<issued>", why: "publish/index.mjs, the generation stamp in the firm locale" },
+  { id: "iso-timestamp", re: /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z/g, sub: "<ts>", why: "publish/index.mjs:666 asOf" },
 ];
 
 // ── REWRITES — what is CHANGED on the way out, as opposed to what is refused ───────────────────────

package/scripts/release-pre-gate.mjs

@@ -0,0 +1,111 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// release-pre-gate.mjs — let a stable cut reach the version script when every note has already been
+// consumed by a pre-release.
+//
+// THE PROBLEM THIS EXISTS FOR, MEASURED. `changesets/action` decides whether to run `version-script` by
+// counting the release notes it can see, and it does that ONCE, at the top of the run, before it touches
+// the working tree. Its reader is `readChangesetState`:
+//
+//     let preState = await readPreState(cwd);
+//     let changesets = await readChangesets(cwd);
+//     if (preState !== undefined && preState.mode === "pre") {
+//       return { preState, changesets: changesets.filter((c) => !c.id.startsWith("pre/")) };
+//     }
+//     return { preState: undefined, changesets };
+//
+// `readChangesets` DOES enumerate `.changeset/pre/`, giving each note an id beginning `pre/`. The filter
+// that hides them applies only while the tree says `mode: "pre"`.
+//
+// A pre-release consumes a note by MOVING it into `.changeset/pre/`, where it waits so the eventual
+// stable can list every change since the last stable. So the ordinary state after cutting a beta is: no
+// notes at the top level, every note under `pre/`, and the flag still saying `pre`. In that state the
+// action counts zero, skips the version script, emits no pull request number, and the stable cut refuses
+// with "Nothing to cut" — a refusal about the wrong thing, because the tree holds a whole release.
+//
+// WHAT THIS DOES, AND WHY IT IS NOT A TRICK. It writes the channel the dispatch asked for into the file
+// the action reads, before the action reads it. A stable cut IS a tree leaving pre-release mode, and the
+// notes under `pre/` ARE the notes that stable will carry; saying so is a true statement about this cut,
+// not a device to get past a check. `release-version.mjs` already states the same principle for the
+// other reader: "the mode a cut needs is a fact about the channel asked for, not about what the last cut
+// happened to do." There are two readers of that fact and they are reached separately.
+//
+// THE WRITE IS DISCARDED, ON PURPOSE, AND THAT IS THE POINT. The action's own first act inside
+// `runVersion` is `git checkout changeset-release/main` followed by `git reset --hard <the run's
+// commit>`, which puts `pre.json` back to `pre`. The version script then runs in that rebuilt tree, finds
+// the tree still in pre mode, and performs the real transition itself with `changeset pre exit` — which
+// is where the transition has to happen, and the reason it was moved there. So this changes what the
+// action COUNTS and nothing about what the cut DOES. Nothing here versions anything, and a tree this
+// touched still produces the same version it would have produced had the gate never been in the way.
+//
+// WHAT IT REFUSES TO DO. It is silent on a beta, on a tree that is not in pre mode, on a tree whose notes
+// are at the top level where the action can already see them, and on a tree with no notes anywhere. That
+// last one matters most: a cut with genuinely nothing to cut must still refuse, and it still does,
+// because this writes nothing when `.changeset/pre/` is empty.
+import { readFileSync, writeFileSync, existsSync, readdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { isEntrypoint } from "../shared/is-entrypoint.mjs";
+
+const ROOT = join(dirname(dirname(fileURLToPath(import.meta.url))));
+
+/** A note is a `.md` file that is not the directory's own README. */
+export function countNotes(dir) {
+  if (!existsSync(dir)) return 0;
+  return readdirSync(dir).filter((f) => f.endsWith(".md") && f.toLowerCase() !== "readme.md").length;
+}
+
+/**
+ * PURE. Whether this cut has to restate its channel for the action's counter, and nothing else.
+ *
+ * `null` means leave the tree alone, and every `null` here is a case the action already reads correctly
+ * — including the two that must keep refusing. Only the one state the action cannot see returns a write.
+ *
+ * Kept separate from the file it writes so the decision can be driven against every member of the class
+ * rather than only against the tree that happens to be checked out.
+ */
+export function preGateDecision({ cut, mode, topLevelNotes, preNotes }) {
+  // A beta never restates anything. A beta with no pending notes MUST still refuse, and that refusal is
+  // this function returning null.
+  if (cut !== "stable") return null;
+  // Not in pre mode: the action's filter is not engaged, so whatever is there is already counted.
+  if (mode !== "pre") return null;
+  // The action can see these. Touching the flag here would change the pull request's title for a cut
+  // that never needed help.
+  if (topLevelNotes > 0) return null;
+  // Nothing anywhere. "Nothing to cut" is then the truth, and the refusal downstream is correct.
+  if (preNotes === 0) return null;
+  return { mode: "exit" };
+}
+
+export function main(root = ROOT, argv = process.argv.slice(2)) {
+  const cut = (argv.find((a) => a.startsWith("--cut=")) ?? "").slice("--cut=".length);
+  // `--root` exists so this can be driven against a built tree rather than only against the checkout it
+  // happens to live in. The workflow never passes it: there the script sits in the repository being cut,
+  // which is what ROOT already means.
+  const rootFlag = argv.find((a) => a.startsWith("--root="));
+  if (rootFlag) root = rootFlag.slice("--root=".length);
+  const preJson = join(root, ".changeset", "pre.json");
+  const flag = existsSync(preJson) ? JSON.parse(readFileSync(preJson, "utf8")) : null;
+  const mode = flag?.mode ?? "none";
+  const topLevelNotes = countNotes(join(root, ".changeset"));
+  const preNotes = countNotes(join(root, ".changeset", "pre"));
+
+  const decision = preGateDecision({ cut, mode, topLevelNotes, preNotes });
+  const state = `cut=${cut || "none"}, mode=${mode}, ${topLevelNotes} note(s) pending, ${preNotes} already consumed by the pre-release`;
+  if (!decision) {
+    // SAYS SO EITHER WAY. A step that is silent when it does nothing cannot be told from a step that did
+    // not run, and this one is skipped far more often than it acts.
+    console.log(`release-pre-gate: ${state} — leaving the flag alone.`);
+    return 0;
+  }
+  writeFileSync(preJson, `${JSON.stringify({ ...flag, ...decision }, null, 2)}\n`);
+  console.log(`release-pre-gate: ${state} — the notes this stable carries are all under .changeset/pre/,`
+    + " where the action does not count them while the flag says pre. Writing mode=exit so it counts them."
+    + " The version script performs the real transition after the action rebuilds the tree; this write is"
+    + " discarded by that rebuild and changes no version.");
+  return 0;
+}
+
+if (isEntrypoint(import.meta.url)) process.exit(main());