clearotron 0.3.2-beta.11 → 0.3.2-beta.12

package/portal-ui/dist/assets/{index-DXSRxPV_.js → index-w8GFZftk.js}

@@ -18201,11 +18201,15 @@ function readFrameSections(data, sameSource) {
 	const out = [];
 	for (const raw of msg.sections) {
 		if (typeof raw !== "object" || raw === null) continue;
-		const { id, label } = raw;
+		const { id, label, top } = raw;
 		if (typeof id !== "string" || typeof label !== "string") continue;
 		const trimmed = label.trim().slice(0, 40);
 		if (!id.trim() || !trimmed) continue;
-		out.push({
+		out.push(typeof top === "number" && Number.isFinite(top) && top >= 0 ? {
+			id,
+			label: trimmed,
+			top: Math.round(top)
+		} : {
 			id,
 			label: trimmed
 		});
@@ -18213,6 +18217,16 @@ function readFrameSections(data, sameSource) {
 	}
 	return out;
 }
+function sectionsReached(sections, line, where) {
+	if (where.atTop) return 0;
+	if (where.atFoot) return sections.length;
+	let n = 0;
+	for (const s of sections) {
+		if (typeof s.top !== "number" || s.top > line) break;
+		n += 1;
+	}
+	return n;
+}
 function readFrameTheme(data, sameSource) {
 	if (!sameSource) return null;
 	if (typeof data !== "object" || data === null) return null;
@@ -18243,6 +18257,8 @@ function usePortalTheme() {
 	}, []);
 	return theme;
 }
+var TOPBAR_PX = 56;
+var LANDING_PX = 10;
 function useReportFrame() {
 	const ref = (0, import_react.useRef)(null);
 	const [height, setHeight] = (0, import_react.useState)(FIRST_PAINT);
@@ -18276,7 +18292,7 @@ function useReportFrame() {
 			if (jump !== null) {
 				if (frame) {
 					const head = document.querySelector(".report-head");
-					const chrome = 56 + (head instanceof HTMLElement ? head.offsetHeight : 48) + 10;
+					const chrome = TOPBAR_PX + (head instanceof HTMLElement ? head.offsetHeight : 48) + LANDING_PX;
 					const y = frame.getBoundingClientRect().top + window.scrollY + jump - chrome;
 					window.scrollTo({
 						top: Math.max(0, y),
@@ -18478,10 +18494,45 @@ function Result({ ctx, runId, markSlug }) {
 	const run = (0, import_react.useMemo)(() => runs.find((r) => r.runId === runId) ?? null, [runs, runId]);
 	const reads = (0, import_react.useMemo)(() => run ? readsFor(runs, run) : [], [runs, run]);
 	const frame = useReportFrame();
-	const [atSection, setAtSection] = (0, import_react.useState)(null);
+	const [reached, setReached] = (0, import_react.useState)(0);
+	const sectionList = frame.sections;
+	const frameRef = frame.ref;
 	(0, import_react.useEffect)(() => {
-		setAtSection(null);
-	}, [runId, markSlug]);
+		if (!sectionList || sectionList.length < 2) {
+			setReached(0);
+			return;
+		}
+		let queued = false;
+		const measure = () => {
+			queued = false;
+			const el = frameRef.current;
+			if (!el) return;
+			const head = document.querySelector(".report-head");
+			const lineOnScreen = (head instanceof HTMLElement ? head.getBoundingClientRect().bottom : TOPBAR_PX) + LANDING_PX + 2;
+			const where = {
+				atTop: document.documentElement.scrollHeight > window.innerHeight + 2 && window.scrollY <= 0,
+				atFoot: window.innerHeight + window.scrollY >= document.documentElement.scrollHeight - 2
+			};
+			setReached(sectionsReached(sectionList, lineOnScreen - el.getBoundingClientRect().top, where));
+		};
+		const later = () => {
+			if (!queued) {
+				queued = true;
+				requestAnimationFrame(measure);
+			}
+		};
+		measure();
+		window.addEventListener("scroll", later, { passive: true });
+		window.addEventListener("resize", later);
+		return () => {
+			window.removeEventListener("scroll", later);
+			window.removeEventListener("resize", later);
+		};
+	}, [
+		sectionList,
+		frame.height,
+		frameRef
+	]);
 	const grouped = run !== null && showsAssessment(run, markSlug);
 	const { result: summaryResult } = useLoad(() => grouped ? api.runSummary(runId) : Promise.resolve({ kind: "notFound" }), [runId, grouped]);
 	const assessment = summaryResult?.kind === "ok" ? summaryResult.value : [];
@@ -18612,70 +18663,60 @@ function Result({ ctx, runId, markSlug }) {
 					]
 				}), hasThread(reads) || (frame.sections?.length ?? 0) > 1 ? (0, import_jsx_runtime.jsxs)("div", {
 					className: "report-nav",
-					children: [
-						hasThread(reads) ? (0, import_jsx_runtime.jsxs)("div", {
-							style: {
-								display: "flex",
-								gap: 8,
-								flexWrap: "wrap",
-								alignItems: "center"
-							},
-							children: [(0, import_jsx_runtime.jsx)("span", {
-								className: "eyebrow",
-								style: { alignSelf: "center" },
-								children: "Reads"
-							}), reads.map((r) => {
-								const active = r.runId === run.runId;
-								return (0, import_jsx_runtime.jsxs)("button", {
-									type: "button",
-									className: "pill",
-									"aria-current": active ? "true" : void 0,
-									onClick: () => ctx.go(resultPath(r.runId)),
+					children: [hasThread(reads) ? (0, import_jsx_runtime.jsxs)("div", {
+						style: {
+							display: "flex",
+							gap: 8,
+							flexWrap: "wrap",
+							alignItems: "center"
+						},
+						children: [(0, import_jsx_runtime.jsx)("span", {
+							className: "eyebrow",
+							style: { alignSelf: "center" },
+							children: "Reads"
+						}), reads.map((r) => {
+							const active = r.runId === run.runId;
+							return (0, import_jsx_runtime.jsxs)("button", {
+								type: "button",
+								className: "pill",
+								"aria-current": active ? "true" : void 0,
+								onClick: () => ctx.go(resultPath(r.runId)),
+								style: {
+									cursor: "pointer",
+									display: "inline-flex",
+									alignItems: "center",
+									gap: 7,
+									background: active ? "var(--accent-wash)" : "var(--surface-sunken)",
+									borderColor: active ? "var(--accent)" : "var(--border-hairline)",
+									color: active ? "var(--text-accent)" : "var(--text-muted)"
+								},
+								children: [r.tone ? (0, import_jsx_runtime.jsx)("span", {
+									className: "dot",
 									style: {
-										cursor: "pointer",
-										display: "inline-flex",
-										alignItems: "center",
-										gap: 7,
-										background: active ? "var(--accent-wash)" : "var(--surface-sunken)",
-										borderColor: active ? "var(--accent)" : "var(--border-hairline)",
-										color: active ? "var(--text-accent)" : "var(--text-muted)"
-									},
-									children: [r.tone ? (0, import_jsx_runtime.jsx)("span", {
-										className: "dot",
-										style: {
-											background: `var(--tone-${r.tone})`,
-											width: 7,
-											height: 7
-										}
-									}) : null, readLabel(r)]
-								}, r.runId);
-							})]
-						}) : null,
-						hasThread(reads) && (frame.sections?.length ?? 0) > 1 ? (0, import_jsx_runtime.jsx)("span", {
-							className: "report-nav-sep",
-							"aria-hidden": "true"
-						}) : null,
-						(frame.sections?.length ?? 0) > 1 ? (0, import_jsx_runtime.jsx)("nav", {
-							className: "report-sections",
-							"aria-label": "Sections of this report",
-							children: (frame.sections ?? []).map((sec, i) => {
-								const now = atSection === null ? i === 0 : atSection === sec.id;
-								return (0, import_jsx_runtime.jsxs)("button", {
-									type: "button",
-									className: "report-section",
-									"aria-current": now ? "true" : void 0,
-									onClick: () => {
-										setAtSection(sec.id);
-										frame.send("section", sec.id);
-									},
-									children: [(0, import_jsx_runtime.jsx)("span", {
-										className: "report-section-dot",
-										"aria-hidden": "true"
-									}), sec.label]
-								}, sec.id);
-							})
-						}) : null
-					]
+										background: `var(--tone-${r.tone})`,
+										width: 7,
+										height: 7
+									}
+								}) : null, readLabel(r)]
+							}, r.runId);
+						})]
+					}) : null, (frame.sections?.length ?? 0) > 1 ? (0, import_jsx_runtime.jsx)("nav", {
+						className: "report-sections",
+						"aria-label": "Sections of this report",
+						children: (frame.sections ?? []).map((sec, i) => {
+							return (0, import_jsx_runtime.jsxs)("button", {
+								type: "button",
+								className: "report-section",
+								"data-reached": i < reached ? "true" : void 0,
+								"aria-current": i === reached - 1 ? "true" : void 0,
+								onClick: () => frame.send("section", sec.id),
+								children: [(0, import_jsx_runtime.jsx)("span", {
+									className: "report-section-dot",
+									"aria-hidden": "true"
+								}), sec.label]
+							}, sec.id);
+						})
+					}) : null]
 				}) : null]
 			}),
 			frame.failed ? (0, import_jsx_runtime.jsxs)("div", {

package/portal-ui/dist/index.html

@@ -49,8 +49,8 @@
     -->
     <link rel="preconnect" href="https://api.fontshare.com" crossorigin />
     <link href="https://api.fontshare.com/v2/css?f[]=satoshi@400,500,700,900&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/portal/assets/index-DXSRxPV_.js"></script>
-    <link rel="stylesheet" crossorigin href="/portal/assets/index-CtvwLCti.css">
+    <script type="module" crossorigin src="/portal/assets/index-w8GFZftk.js"></script>
+    <link rel="stylesheet" crossorigin href="/portal/assets/index-7Lq-dXDV.css">
   </head>
   <body>
     <div id="root"></div>

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.3.2-beta.11",
+  "version": "0.3.2-beta.12",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-oauth-mcp-bridge
 
+## 0.3.2-beta.12
+
+No changes in this release.
+
 ## 0.3.2-beta.11
 
 No changes in this release.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.3.2-beta.11",
+  "version": "0.3.2-beta.12",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/scripts/ask-ai-render-check.mjs

@@ -133,6 +133,10 @@ let deck = 'connected'
 // travels the real injected script to the real listener. Two cards at fixed places: a numbered finding,
 // and an "Also considered" card, which carries the button and no number.
 let reportDoc = 'stub'
+// A SLOW RUNNER, ON DEMAND. The finding's document is held back this long before it is served, which is
+// how a CI runner that loaded it late is reproduced: the press below has to wait for the document, not
+// for a fixed time. Zero, the default, serves it at once.
+const FRAME_DELAY_MS = Number(process.env.ASK_AI_CHECK_FRAME_DELAY_MS ?? 0) || 0
 const FINDING_DOC = () => prepareReportForEmbed(`<!doctype html><html><head><meta charset="utf-8"><title>report</title></head>
 <body style="margin:0;font-family:sans-serif;background:#fff;height:400px">
 <div class="card" id="c3" style="position:absolute;top:40px;left:20px"><div class="cardhead"><span class="fnum">3</span>
@@ -159,7 +163,8 @@ const server = createServer((req, res) => {
   // the height a published report's bridge announces, so the header draws the Export menu a reader meets.
   if (p.startsWith('/portal/report/') && reportDoc === 'finding') {
     res.writeHead(200, { 'content-type': 'text/html' })
-    return res.end(FINDING_DOC())
+    const doc = FINDING_DOC()
+    return FRAME_DELAY_MS ? setTimeout(() => res.end(doc), FRAME_DELAY_MS) : res.end(doc)
   }
   if (p.startsWith('/portal/report/')) {
     res.writeHead(200, { 'content-type': 'text/html' })
@@ -433,9 +438,29 @@ const arrived = await value(PROBE)
 // null origin and the point is the whole path — the injected script hears the press, posts it, and the
 // report screen opens its control. The cards sit at fixed places in the document, so the frame's own
 // position on the page is all that has to be measured.
+// READY, NOT A FIXED WAIT. The press lands on a finding's button, and it does something only once the
+// document in the frame has loaded and its bridge is listening. A fixed pause after navigating was not
+// always that on a CI runner: the press arrived first and opened nothing (measured on beta-12, 2026-09-19,
+// with no change to the portal or the bridge since a green run). The bridge posts the document's height
+// from the same script that listens for the press, so a frame that has left its first-paint height has a
+// listener. The Ask AI control must be on the header too, since the press opens it. Both are waited for,
+// and the frame's place must hold still across two reads, so the press is aimed where the button is.
+const FIRST_PAINT = Number(/export const FIRST_PAINT = (\d+)/.exec(readFileSync(join(DIST, '..', 'src', 'contract', 'reportFrame.ts'), 'utf8'))?.[1] ?? NaN)
+const frameReady = async () => {
+  let last = null
+  for (let i = 0; i < 200; i++) {
+    const now = await value(`(() => { const f = document.querySelector('iframe'); if (!f || !document.querySelector('[data-ask-ai] > button')) return null;
+      const r = f.getBoundingClientRect(); return Math.round(r.top) + ':' + Math.round(r.height) })()`)
+    if (now && now === last && !now.endsWith(`:${FIRST_PAINT}`)) return true
+    last = now
+    await new Promise((r) => setTimeout(r, 100))
+  }
+  return false
+}
 const pressInFrame = async (top) => {
   await value('(() => { window.scrollTo(0, 0); return true })()')
   await new Promise((r) => setTimeout(r, 200))
+  if (!(await frameReady())) return false
   const at = await value(`(() => { const f = document.querySelector('iframe'); if (!f) return null; const r = f.getBoundingClientRect(); return { x: r.left, y: r.top } })()`)
   if (!at) return false
   const x = Math.round(at.x + 140), y = Math.round(at.y + top + 16)

package/scripts/dead-names.mjs

@@ -6,8 +6,8 @@
 //   node scripts/dead-names.mjs            report; exit 1 if a dead name is back
 //   node scripts/dead-names.mjs --json     the same, as JSON
 //
-// ruled Lore and Aughra dead names that may appear nowhere, and the purge is done: the issue's
-// own pattern returned 58 files when it was written and returns ONE now, which is a dictionary snippet
+// The owner ruled Lore and Aughra dead names that may appear nowhere, and the purge is done: the issue's
+// own pattern returned 58 files when it was written and ONE when this guard landed, a dictionary snippet
 // about hunting inside captured search results. What does not exist is anything to keep it that way. A
 // name published once stays published, so the cost of a re-introduction is not a revert — it is a name
 // in the history of a repository that is about to be cut in public.
@@ -42,37 +42,38 @@ export const GUARD = "dead-names (#853)";
 // the issue names as deployed surfaces, and `_` is a word character, so a trailing `\b` would miss the
 // environment variable while catching the prose. No English word begins with those six letters, so the
 // leading boundary is all the protection the arm needs — measured: zero hits in the tree either way.
-// `clawdi-lisa` and `clawdi-lidia` are 's, not 's, and they are here rather than in a second
-// scanner because the mechanism is identical: a name that must never reappear. They were per-person
-// agent identities for individuals at this firm, shipped in an operator script's default roster, in a
-// systemd unit watching their queues, and in two test fixtures. That out-of-scope note ruled `alex`
-// and `sam` INVENTED, which is why those stay; these two were never covered by that ruling.
-export const DEAD_NAME_RE = /lorestar|lore_(pool|url|flags)|clearance_lore|lorectl|loreurl|lorecontrols|trademark-lore|\blore\b|\baughra|clawdi-(lisa|lidia)/i;
+// A PER-PERSON IDENTITY IS THE SAME KIND OF NAME, AND IT IS NOT WRITTEN HERE. An agent identity named
+// after a real person must never reappear either, and the mechanism is identical. But a public guard
+// that spells out a person's name publishes the name it exists to keep out, so no such arm is written
+// into this file: `deadNameHits` takes its pattern as an argument, and the test drives the mechanism
+// with an invented identity. The names the tests give agents and requesters are invented too.
+export const DEAD_NAME_RE = /lorestar|lore_(pool|url|flags)|clearance_lore|lorectl|loreurl|lorecontrols|trademark-lore|\blore\b|\baughra/i;
 
 /**
  * Where a true match is somebody else's word rather than our dead name. NAMED, with the reason, and
  * scoped to the file — never a blanket pattern, because a blanket would re-admit the name everywhere.
+ * The first exemption was a dictionary snippet in the demo's captured common-law results; the demo was
+ * re-captured without it, so that exemption was deleted rather than carried.
  */
 export const EXEMPTIONS = [
   {
-    file: "demo/multi-country-focus-search/run/common-law-grid.json",
-    why: "captured third-party search results. The hit is a Collins English Dictionary definition of "
-      + "hunting — \"the art, sport, lore, or practice of hunting\" — inside a snippet the common-law "
-      + "sweep fetched and the driver saved VERBATIM. Editing it would corrupt a machine receipt to "
-      + "satisfy a lint, which is the one thing a receipt may never be.",
+    file: "driver/wordlists/en.txt",
+    why: "the engine's list of ordinary English words, the dictionary of the one-letter neighbourhood "
+      + "filter. `lore` is an ordinary English word and sits on it. The list only ever removes queries, "
+      + "so taking the word out would change which searches a run makes, to satisfy a lint.",
   },
 ];
 
 const exemptionFor = (file) => EXEMPTIONS.find((e) => e.file === file) ?? null;
 
-/** Every dead-name hit in a corpus of {file, text}. PURE. */
-export function deadNameHits(corpus) {
+/** Every dead-name hit in a corpus of {file, text}, against DEAD_NAME_RE unless a pattern is given. PURE. */
+export function deadNameHits(corpus, pattern = DEAD_NAME_RE) {
   const out = [];
   for (const { file, text } of corpus ?? []) {
     if (exemptionFor(file)) continue;
     const lines = String(text ?? "").split("\n");
     for (let i = 0; i < lines.length; i++) {
-      if (DEAD_NAME_RE.test(lines[i])) out.push({ file, line: i + 1, text: lines[i].trim().slice(0, 160) });
+      if (pattern.test(lines[i])) out.push({ file, line: i + 1, text: lines[i].trim().slice(0, 160) });
     }
   }
   return out;

package/scripts/env-audit.mjs

@@ -310,6 +310,12 @@ export function isProductFile(rel) {
   if (/\.test\.mjs$/.test(rel)) return false;
   if (/^e2e\//.test(rel)) return false;
   if (/^scripts\/(e2e|test-run|ci-)/.test(rel)) return false;
+  // THE BROWSER CHECKS. CI and a developer run them against a fixture portal; no install runs one. A switch
+  // one of them reads, such as the delay that reproduces a slow runner, belongs to the check, and a row
+  // for it in `.env.example` would hand an operator a setting that changes nothing they run. Measured
+  // when this was added: HOME, PATH, TMPDIR and that delay were all the checks read, and the first three
+  // stay product, because shipping code reads them too.
+  if (/^scripts\/[a-z0-9-]+-render-check\.mjs$/.test(rel)) return false;
   return true;
 }
 

package/scripts/repo-writes.mjs

@@ -119,3 +119,45 @@ export function explainRepoWrites(rows) {
     "  touching the tree to tell the two apart.)",
   ];
 }
+
+// ── the home the run executes as ────────────────────────────────────────────────────────────────────
+//
+// THE SAME RULE, ONE FOLDER OUT. The suite is documented as offline with no side effects, and a fresh
+// clone's run left `~/trademark/telemetry/trademark-mcp-access.jsonl` behind (measured 2026-09-19, one
+// line per run): a test spawned the stdio server with the real home, and `doctor` on that machine then
+// reported the client door's access log as being written. These are the product's own folders under a
+// home: the pool, workspace, queue and telemetry, and the settings, records and revocation list. A run
+// leaves them as it found them. The rest of a home — npm's cache, a browser's profile — belongs to the
+// tools a run uses, and is theirs to write.
+
+/** The product's own folders under a home, relative to it. */
+export const HOME_DATA = Object.freeze(["trademark", join(".config", "clearotron")]);
+
+/** Every path under the home's product folders, stamped. A folder that does not exist is not walked. */
+export function snapshotHome(home) {
+  const out = new Map();
+  for (const rel of HOME_DATA) {
+    const p = join(resolve(home), rel);
+    let isDir = false;
+    try { isDir = lstatSync(p).isDirectory(); } catch { continue; }
+    if (!isDir) { out.set(p, "not-a-directory"); continue; }
+    out.set(p, "dir");
+    for (const [k, v] of snapshotRepo(p)) out.set(k, v);
+  }
+  return out;
+}
+
+/** What a reader is told when a run wrote under the home's product folders. */
+export function explainHomeWrites(rows, home) {
+  return [
+    "",
+    `[test-run] THIS RUN WROTE UNDER THE HOME IT RAN AS (${home}), in the product's own folders:`,
+    ...rows,
+    "",
+    "  A test that starts a product command hands it a HOME under its own temp directory. Without one, the",
+    "  command reads and writes the pool, queue, telemetry and settings of whoever runs the suite.",
+    "",
+    "  (A service of this account writing there while the run was in flight prints this too. Run again",
+    "  with HOME set to an empty temp directory to tell the two apart.)",
+  ];
+}