clearotron 0.3.2-beta.4 → 0.3.2-beta.5

package/driver/publish/templates/report.css

@@ -313,8 +313,13 @@
        rows (.rrow), secondary groups (.rgroup), the scope section title (details.scope) — print as static
        headers; the old blanket details>summary hide deleted every region/group header and the scope title
        from the exported PDF.
-       EVERY <details> THE RENDERERS EMIT MUST BE IN ONE LIST OR THE OTHER, and render-css.test.mjs walks
-       a rendered page to say so. `details.sub-more` (#470) was in NEITHER, so the exported PDF — the
+       EVERY <details> THE RENDERERS EMIT MUST BE IN ONE LIST OR THE OTHER. The instrument that says so
+       is a browser under print media, and it is NOT in this repository: `render-css.test.mjs`, named
+       here until 2026-09-16, exists in no tree. Nothing in the public suite can see this — the frozen
+       hash pins the renderer's bytes and the render arms grep its HTML, and on screen a mis-ruled
+       disclosure is correct. It is the private print control that walks a rendered page on both lanes
+       and refuses a disclosure ruled by neither mechanism, and it runs by hand. Two folds have now
+       shipped mis-ruled and been caught there rather than in CI. `details.sub-more` (#470) was in NEITHER, so the exported PDF — the
        client-facing legal document — printed an inert "MORE" label and a right-pointing COLLAPSED marker
        in the hero, directly above text that was already fully expanded. Measured in Chrome: the caption's
        own content was carried correctly and only the control leaked, which is why the commit that added
@@ -327,7 +332,14 @@
        and internal notes (.int-note, hidden above) are the only two things print ever drops. */
     details>*:not(summary){display:block!important}
     details>summary{list-style:none;cursor:default}
-    .rrow>summary::before,.rgroup>summary::before,details.scope>summary::before{content:""!important}
+    /* `details.searched` is a SECTION TITLE, so it keeps its summary in print like the region rows and
+       the secondary groups — a printed report that drops "What was searched" loses the heading over the
+       counts, not just a control. What it must not print is the ▸/▾ toggle, which on paper is a
+       right-pointing arrow over content that is already fully expanded. Found by the print check, which
+       walks a rendered page and refuses any disclosure that is in neither list; the public suite does
+       not run it, so the commit that added this fold could ship the half it did not think about. */
+    .rrow>summary::before,.rgroup>summary::before,details.scope>summary::before,
+    details.searched>summary::before{content:""!important}
     details{border-top:1px solid var(--line)}
     /* …AND THE HERO'S FOLD IS NOT A SECTION. The rule above separates the disclosures that ARE sections
        of the document; `details.sub-more` is one paragraph of the verdict caption folded away from
@@ -404,3 +416,91 @@
   .panel.actions.scope-ran{margin-top:22px}
   .panel.actions.scope-ran h4{margin:0 0 6px;font-size:14px;letter-spacing:-.01em;
     display:flex;align-items:center;gap:9px}
+
+  /* ── The 2026-09-16 report redesign — the approved report presentation ─────────────────────────────────────────
+     Ported from the design's own stylesheet, with its literal colours mapped onto this sheet's tokens
+     so the page follows the theme rather than carrying a second palette. Layout only: every string on
+     the page is the delivered file's own, a label from the specification, or a count. */
+  .panel.about{margin:10px 0 18px;padding:12px 18px;max-width:900px}
+  .panel.about .label{font-size:10.5px;letter-spacing:.14em;text-transform:uppercase;color:var(--faint);margin-bottom:6px}
+  .panel.about .row{display:grid;grid-template-columns:170px 1fr;gap:12px;padding:5px 0;border-top:1px solid var(--line);font-size:13.5px;line-height:1.5}
+  /* The goods as registered and the record's own dates, inside a finding's Full detail fold on a full
+     country search (the 2026-09-16 report redesign). Ported from the design with its fixed greys replaced by tokens.
+     `word-break` is load-bearing and not cosmetic: the goods are the register's own wording, which on a
+     Japanese or Korean record is one unbroken run of characters with no spaces to wrap at, and without
+     it that row sets the width of the whole fold. */
+  .record{margin:6px 0 2px}
+  .record .row{display:grid;grid-template-columns:150px 1fr;gap:12px;padding:4px 0;border-top:1px solid var(--line);font-size:13px;line-height:1.5}
+  .record .k{font-size:10.5px;letter-spacing:.1em;text-transform:uppercase;color:var(--faint);padding-top:3px}
+  .record .v{overflow-wrap:anywhere;word-break:break-word}
+  @media(max-width:700px){.record .row{grid-template-columns:1fr;gap:2px}}
+  .panel.about .row:first-of-type{border-top:0}
+  .panel.about .k{font-size:10.5px;letter-spacing:.12em;text-transform:uppercase;color:var(--faint);padding-top:3px}
+  .panel.about .v{color:var(--ink)}
+  header.hero p.sub .fmark{font-weight:800;color:var(--ink)}
+
+  .heroGrid{display:block}.panel.gauge{max-width:none}
+  .gconc .grow{display:grid;grid-template-columns:150px 1fr;gap:14px;align-items:start}
+  .gconc .gv{text-align:left;display:block}
+  .gconds-wrap{display:grid;grid-template-columns:150px 1fr;gap:14px;align-items:start;margin-top:10px}
+  .gconds-wrap .gk{font-size:10.5px;letter-spacing:.12em;text-transform:uppercase;color:var(--faint);padding-top:3px}
+  .gconds{margin:0;padding-left:18px;font-size:13px;line-height:1.45;font-weight:500}
+  .gconds li{margin:3px 0}
+  .gwhy{border-top:1px solid var(--line);margin:12px 0 0;padding:12px 0 0}
+  .gwhy .label{font-size:10.5px;letter-spacing:.14em;text-transform:uppercase;color:var(--faint);margin-bottom:8px}
+  .gwhy .fa-row{display:grid;grid-template-columns:150px 1fr;gap:14px;align-items:start;padding:7px 0;font-size:13.5px;line-height:1.5}
+  .gwhy .fa-k{font-size:10.5px;letter-spacing:.12em;text-transform:uppercase;color:var(--faint);padding-top:3px}
+  .fa-token{padding:2px 8px;border-radius:999px;color:#fff;font-weight:700}
+  .fa-token.tone-good{background:var(--clear)}.fa-token.tone-mid{background:var(--med)}.fa-token.tone-bad{background:var(--high)}
+  .fa-based{margin:4px 0 2px;font-size:12.5px;line-height:1.45;color:var(--slate)}
+  .fa-bk{font-size:10px;letter-spacing:.12em;text-transform:uppercase;color:var(--faint);margin-right:6px}
+  .gexp,.gconf{display:grid;grid-template-columns:150px 1fr;gap:14px;border-top:1px solid var(--line);margin-top:12px;padding-top:10px;font-size:13px;line-height:1.5}
+  .gexp .gk,.gconf .gk{font-size:10.5px;letter-spacing:.12em;text-transform:uppercase;color:var(--faint);padding-top:3px}
+  .gexp .gv,.gconf .gv{text-align:left}
+  .gframe{margin-top:10px;font-size:11.5px;color:var(--faint)}
+
+  .panel.where{padding:10px 18px}
+  .wrow{display:grid;grid-template-columns:44px 1fr auto;gap:14px;align-items:center;padding:8px 0;border-bottom:1px solid var(--line);font-size:13.5px}
+  .wrow .wname{font-weight:600}.wrow .rcode{font-weight:700;color:var(--faint);font-size:12px}
+  .wclean{display:flex;flex-wrap:wrap;gap:6px;align-items:center;padding:10px 0 4px}
+  .wk{font-size:10.5px;letter-spacing:.12em;text-transform:uppercase;color:var(--clear);margin-right:8px}
+  .wchip{padding:3px 9px;border-radius:999px;background:var(--clear-soft);color:var(--clear-tx);font:600 12px/1.4 var(--font)}
+  .panel.courtp{padding:14px 18px}.panel.courtp p{margin:0;font-size:14px;line-height:1.5}
+
+  .ask-fi{margin-left:auto;font:600 12px/1 var(--font);padding:7px 10px;border-radius:999px;border:1px solid var(--line2);background:transparent;color:var(--ink);cursor:pointer;white-space:nowrap}
+  .tb-ask{margin-right:8px}
+  .cardhead .who.mark-first{font-size:17px;font-weight:800}
+  .cardhead .who .where{font-weight:500;color:var(--slate);font-size:14px}
+  .owner-line{padding:0 16px 6px 16px;margin-top:-4px;font-size:13px;color:var(--slate)}
+  .owner-line .ok{font-size:10.5px;letter-spacing:.12em;text-transform:uppercase;color:var(--faint);margin-right:6px}
+
+  .panel.alsocons{padding:12px 18px}
+  .card.ruled .rail{background:var(--tan)}.tier.ruled{background:var(--bg2);color:var(--slate)}
+  .ruled-cards .card{margin-bottom:10px}
+  .card.ruled .roff{margin:6px 16px 12px;font-size:13px}
+  .card.ruled .roff summary{cursor:pointer;color:var(--slate);font-size:12px;letter-spacing:.06em;text-transform:uppercase}
+  .card.ruled .roff p{margin:6px 0;line-height:1.5}
+  .cgroups{margin:8px 0 0}
+  .cgroup{margin:6px 0;background:var(--card);border-radius:12px;box-shadow:0 1px 2px rgba(37,9,2,.06)}
+  .cgroup>summary{display:flex;align-items:center;gap:10px;padding:12px 18px;cursor:pointer;font:600 14px/1.3 var(--font);list-style:none}
+  .cgroup>summary::before{content:'▸';color:var(--faint);font-size:12px}
+  .cgroup[open]>summary::before{content:'▾'}
+  .cgroup .gcount{margin-left:auto;color:var(--slate);font-weight:500;font-size:12.5px}
+  .cgroup .gbody{padding:0 18px 12px}
+  .crow{display:grid;grid-template-columns:200px 1fr;gap:12px;align-items:start;padding:8px 0;border-top:1px solid var(--line);font-size:13px}
+  .crow .cm-mark{font-weight:700}.crow .cwho{color:var(--slate);line-height:1.45}
+  .crow .curl{color:var(--crimson);text-decoration:none;font-size:12.5px;word-break:break-all}
+  .cmore{padding:10px 0 2px;font-size:12.5px}.wb{color:var(--crimson);text-decoration:none;font-weight:600}
+
+  details.searched{margin:14px 0;background:var(--card);border-radius:12px;box-shadow:var(--shadow)}
+  details.searched>summary{display:flex;align-items:center;gap:10px;padding:12px 18px;cursor:pointer;font:600 14px/1.3 var(--font);list-style:none}
+  details.searched>summary::before{content:'▸';color:var(--faint);font-size:12px}
+  details.searched[open]>summary::before{content:'▾'}
+  details.searched .gcount{margin-left:auto;color:var(--slate);font-weight:500;font-size:12.5px}
+  details.searched .gbody{padding:0 18px 12px}
+  details.searched .row{display:grid;grid-template-columns:200px 1fr;gap:12px;padding:7px 0;border-top:1px solid var(--line);font-size:13.5px}
+  details.searched .k{font-size:10.5px;letter-spacing:.12em;text-transform:uppercase;color:var(--faint);padding-top:3px}
+  .openrows,.provwrap{margin-top:12px;border-top:1px solid var(--line);padding-top:10px}
+  .openrows .rk,.provwrap .rk{font-size:10.5px;letter-spacing:.12em;text-transform:uppercase;color:var(--faint);margin-bottom:6px}
+  .provnote{margin:0;font-size:12.5px;line-height:1.5;color:var(--slate)}
+  .topbar .tb-lockup{margin-right:10px;flex:0 0 auto}

package/driver/registry-fidelity.mjs

@@ -478,6 +478,34 @@ export const REC = {
   // designated countries; never imply "international = global". Corsearch bodies carry the
   // per-designated-country statuses as `onomaticsJurisdictionsStatuses` (array of strings or of
   // {jurisdiction,status} objects — fail-open on either shape; null when the record lacks it).
+  // The 2026-09-16 report redesign — the goods the mark is REGISTERED for, in the register's own words. A finding
+  // argues about goods, and until now the only goods on the page were the class numbers; the record
+  // carried the wording all along. NOTHING IS TRANSLATED HERE. Where a record holds an English entry
+  // the display picks it (the register wrote it); where it holds only the local language, the local
+  // language is what "as registered" means, and a translation composed at render time would be this
+  // renderer asserting the scope of somebody's right in words no register ever granted.
+  goods: (r) => {
+    const gs = Array.isArray(r.goodsServices) ? r.goodsServices : [];
+    const rows = gs.map((g) => ({
+      classes: (Array.isArray(g?.classes) ? g.classes : []).map(Number).filter((x) => !Number.isNaN(x)),
+      language: String(g?.language ?? "").trim().toLowerCase(),
+      description: String(g?.description ?? "").trim(),
+    })).filter((g) => g.description);
+    if (!rows.length) return null;
+    const en = rows.filter((g) => g.language === "en" || g.language === "eng");
+    return (en.length ? en : rows).map((g) => ({ classes: g.classes, description: g.description }));
+  },
+  // The three dates a reader acts on, as the record holds them and never re-derived. `filingYear` and
+  // `regYear` above answer a different question — the one-line summary — and a year cannot say whether
+  // a registration lapses this month.
+  dates: (r) => {
+    const out = [];
+    const add = (label, v) => { const s = String(v ?? "").trim(); if (/^\d{4}-\d{2}-\d{2}/.test(s)) out.push([label, s.slice(0, 10)]); };
+    add("filed", r.applicationDate);
+    add("registered", r.registrationDate);
+    add("expires", r.expiryDate ?? r.renewalDate);
+    return out.length ? out : null;
+  },
   designations: (r) => {
     const j = r.onomaticsJurisdictionsStatuses ?? r.jurisdictions ?? null;
     if (!Array.isArray(j) || !j.length) return null;

package/driver/suite-census.json

@@ -1912,8 +1912,8 @@
           "todos": 0
         },
         "doctor-reads-the-units-not-the-shell.test.mjs": {
-          "tests": 37,
-          "asserts": 111,
+          "tests": 40,
+          "asserts": 115,
           "skips": 1,
           "todos": 0
         },
@@ -2669,7 +2669,7 @@
         },
         "knockout-structured-read.test.mjs": {
           "tests": 11,
-          "asserts": 53,
+          "asserts": 55,
           "skips": 0,
           "todos": 0
         },
@@ -3059,7 +3059,7 @@
         },
         "pipeline.mock.test.mjs": {
           "tests": 94,
-          "asserts": 792,
+          "asserts": 795,
           "skips": 0,
           "todos": 0
         },
@@ -3718,8 +3718,8 @@
           "todos": 0
         },
         "render.test.mjs": {
-          "tests": 154,
-          "asserts": 632,
+          "tests": 144,
+          "asserts": 572,
           "skips": 0,
           "todos": 0
         },
@@ -3802,8 +3802,8 @@
           "todos": 0
         },
         "report-record-link-host.test.mjs": {
-          "tests": 3,
-          "asserts": 27,
+          "tests": 4,
+          "asserts": 28,
           "skips": 0,
           "todos": 0
         },
@@ -4822,8 +4822,8 @@
           "todos": 0
         },
         "the-knockout-page-leads-with-the-read.test.mjs": {
-          "tests": 28,
-          "asserts": 69,
+          "tests": 30,
+          "asserts": 81,
           "skips": 0,
           "todos": 0
         },
@@ -5033,7 +5033,7 @@
         },
         "the-report-carries-what-the-assessment-wrote.test.mjs": {
           "tests": 10,
-          "asserts": 41,
+          "asserts": 39,
           "skips": 0,
           "todos": 0
         },
@@ -5189,13 +5189,13 @@
         },
         "the-writing-standard-backlog-is-a-floor.test.mjs": {
           "tests": 3,
-          "asserts": 8,
+          "asserts": 9,
           "skips": 2,
           "todos": 0
         },
         "the-writing-standard-check-refuses-five-classes.test.mjs": {
           "tests": 15,
-          "asserts": 60,
+          "asserts": 61,
           "skips": 0,
           "todos": 0
         },
@@ -5721,8 +5721,8 @@
           "todos": 0
         },
         "http-handler.test.mjs": {
-          "tests": 14,
-          "asserts": 26,
+          "tests": 17,
+          "asserts": 40,
           "skips": 0,
           "todos": 0
         },
@@ -5859,8 +5859,8 @@
           "todos": 0
         },
         "the-portal-can-tell-who-has-connected-an-assistant.test.mjs": {
-          "tests": 10,
-          "asserts": 28,
+          "tests": 12,
+          "asserts": 33,
           "skips": 0,
           "todos": 0
         },

package/mcp-server/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-artifacts-mcp
 
+## 0.3.2-beta.5
+
+No changes in this release.
+
 ## 0.3.2-beta.4
 
 No changes in this release.

package/mcp-server/lib/audit.mjs

@@ -40,14 +40,26 @@ export function summarize(body) {
   return out;
 }
 
-export function appendAudit({ email, sub, body, status, transport, path = DEFAULT_AUDIT_PATH }) {
+export function appendAudit({ email, sub, body, status, transport, door, path = DEFAULT_AUDIT_PATH }) {
   // `sub` = the inner-token PRINCIPAL (ops-token issuance, INSTALL.md §8) — distinguishes
   // two automations sharing a transport identity. null for internal/user sessions without a sub claim.
   //
   // `transport` is written only where it changes an answer: "stdio" marks a call that arrived over the
   // local route, which has no signed-in identity to record and therefore no email. Omitted on the HTTP
   // doors, whose records are identified by the email they already carry.
-  const line = JSON.stringify({ ts: new Date().toISOString(), email: email ?? null, sub: sub ?? null, ...summarize(body), status: status ?? null, ...(transport ? { transport } : {}) }) + "\n";
+  //
+  // `door` NAMES WHICH SURFACE TOOK THE CALL, and it is a separate field from `transport` on purpose.
+  // `transport` answers "how did this arrive" and the reader tests it for exactly one value, `"stdio"`,
+  // to mean the local route. Two HTTP doors write to this one file — the staff surface and the client
+  // surface a customer's own assistant connects through — and "which door" is a different question from
+  // "which route". Folding the second into the first would make a client-key call read as a new kind of
+  // transport, and any reader that tested `transport` for the local route would keep working while
+  // meaning something it was never asked.
+  //
+  // WRITTEN ONLY WHEN GIVEN, the same rule as `transport` and for the same reason: the existing log
+  // shape must not move for records that have no answer to this. A door that does not name itself is a
+  // record with no `door` key, not a record claiming to be from nowhere.
+  const line = JSON.stringify({ ts: new Date().toISOString(), email: email ?? null, sub: sub ?? null, ...summarize(body), status: status ?? null, ...(transport ? { transport } : {}), ...(door ? { door } : {}) }) + "\n";
   try { mkdirSync(dirname(path), { recursive: true }); appendFileSync(path, line); } catch { /* best-effort */ }
 }
 

package/mcp-server/lib/http-handler.mjs

@@ -83,6 +83,26 @@ export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions,
   if (tokenOnly && devMode) throw new Error("makeHttpHandler: tokenOnly and devMode are mutually exclusive (devMode's synthetic identity would defeat the mandatory key)");
   if (tokenOnly && verify) throw new Error("makeHttpHandler: tokenOnly is for a door with no auth proxy in front — pass verify:null");
 
+  // ── A TURNED-AWAY CALL IS A RECORD, NOT A GAP ─────────────────────────────────────────────────────
+  //
+  // Every refusal below used to return without writing anything, so this log held calls that SUCCEEDED
+  // and nothing else. An absent line then meant either "never asked" or "asked and was turned away",
+  // and nobody reading it back can tell those apart — which is the one question the log exists to
+  // answer. Measured on the production access log, 2026-09-16: zero lines in its most recent five
+  // thousand carry a refused or error status, which is what never being able to write one looks like.
+  //
+  // IT INVENTS NO IDENTITY. The key refusals fire BEFORE any identity is established. `user` is in
+  // scope there, but only as the placeholder this function starts with, and writing that would name a
+  // caller who does not exist. Those lines carry no email and no principal, and say a call was refused
+  // at this door at this time — which is true, and is the shape the local route already uses for the
+  // same reason: a synthesized identity would match somebody who did nothing.
+  const door = clientSurface ? "client" : undefined;
+  const refuse = (res, status, obj, who = {}) => {
+    try { appendAudit({ email: who.email ?? null, sub: who.sub ?? null, body: who.body ?? null, status: "refused", door }); }
+    catch { /* best-effort: a write failure must never change what the caller is told */ }
+    return send(res, status, obj);
+  };
+
   /**
    * Has this identity been taken off the guest list since its session was opened? Null when it has not,
    * or when the question does not apply — and the body to send back when it has.
@@ -182,7 +202,7 @@ export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions,
             // reach it — the protection is the filesystem — so it is disclosure rather than exposure,
             // and it buys nothing: an operator needs to know a local socket is where to look, and
             // already has the path in the boot line and the unit file. A stranger gets nothing usable.
-            return send(res, 401, { error: "this listener takes an auth-proxy JWT and never an access key — a key has no door here"
+            return refuse(res, 401, { error: "this listener takes an auth-proxy JWT and never an access key — a key has no door here"
               + (keyDoorPath ? ". A key is taken on this deployment's local socket; the engine's boot line names it" : ". This deployment has no key door configured") });
           }
           log(`auth reject ${status}: ${e.message}`);
@@ -197,7 +217,7 @@ export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions,
         const tok = readInnerToken(url, req.headers, { allowAuthorization: true });
         if (!tok) {
           log("auth reject 401: no key presented on the token-only door");
-          return send(res, 401, { error: "this address needs an access key — put it in your assistant's API-key field, or add ?token=<key> to the URL" });
+          return refuse(res, 401, { error: "this address needs an access key — put it in your assistant's API-key field, or add ?token=<key> to the URL" });
         }
         let t;
         try { t = verifyToken(tok); }
@@ -209,26 +229,26 @@ export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions,
           // the original defect survived, silently, on every default install.
           if (e.code === "REVOCATION_UNCHECKABLE") {
             log(`DOOR FAULT — refusing every key: ${e.message} Create it, or point TRADEMARK_MCP_TOKEN_DENYLIST at the list this install actually uses; \`clearotron doctor\` reports the state.`);
-            return send(res, 401, { error: `this install cannot check whether keys have been revoked, so it is refusing all of them: ${e.message}` });
+            return refuse(res, 401, { error: `this install cannot check whether keys have been revoked, so it is refusing all of them: ${e.message}` });
           }
           log(`auth reject 401: ${e.message}`);
-          return send(res, 401, { error: `invalid access key: ${e.message}` });
+          return refuse(res, 401, { error: `invalid access key: ${e.message}` });
         }
         user = { email: t.sub || t.runId || t.jti || "unnamed-key" };
       }
-      if (!limiter.take(user.email)) return send(res, 429, { error: "rate limit exceeded — retry shortly" });
+      if (!limiter.take(user.email)) return refuse(res, 429, { error: "rate limit exceeded — retry shortly" }, { email: user.email });
 
       if (req.method === "POST") {
         let body;
         try { body = await readJsonBody(req, maxBody); }
-        catch (e) { return send(res, 400, { error: `bad request body: ${e.message}` }); }
+        catch (e) { return refuse(res, 400, { error: `bad request body: ${e.message}` }, { email: user.email }); }
 
         const sid = hdr(req.headers["mcp-session-id"]);
         let entry = sid ? sessions.get(sid) : null;
         let stampScope = null;
         if (!entry) {
-          if (sid) return send(res, 404, { error: "unknown or expired session" });
-          if (!isInitializeRequest(body)) return send(res, 400, { error: "no session — the first request must be an MCP initialize" });
+          if (sid) return refuse(res, 404, { error: "unknown or expired session" }, { email: user.email, body });
+          if (!isInitializeRequest(body)) return refuse(res, 400, { error: "no session — the first request must be an MCP initialize" }, { email: user.email, body });
           if (sessions.size >= sessionMax) evictOldest(sessions);
           // INNER authz token (rides the /mcp?token= query or the X-Trademark-Token header) → the session's
           // scope: ops (full), run-bound user (read-only one run), or — no token but firm staff — internal
@@ -274,20 +294,39 @@ export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions,
         } else {
           if (entry.email && entry.email !== user.email) {
             log(`session owner mismatch: ${user.email} presented a session created by another identity`);
-            return send(res, 403, { error: "session belongs to another identity" });
+            return refuse(res, 403, { error: "session belongs to another identity" }, { email: user.email, sub: entry.sub ?? null, body });
           }
           const gone = revokedMidSession(entry);
-          if (gone) return send(res, 403, gone);
+          if (gone) return refuse(res, 403, gone, { email: user.email, sub: entry.sub ?? null, body });
           entry.lastSeen = Date.now();
         }
         // OPS-TOKENS item 6 — automation principals get their own (lower) bucket, keyed by the token's
         // sub, ON TOP of the transport-identity limit above: a runaway connector throttles itself, not
         // the interactive staff sharing the proxy identity.
         if (opsLimiter && entry.kind === "ops" && !opsLimiter.take(`ops:${entry.sub ?? "unnamed"}`))
-          return send(res, 429, { error: "ops principal rate limit exceeded — retry shortly" });
+          return refuse(res, 429, { error: "ops principal rate limit exceeded — retry shortly" }, { email: user.email, sub: entry.sub ?? null, body });
         // Audit AFTER scope resolution so the line names the PRINCIPAL (token sub), not just the
-        // transport identity — still strictly before any tool dispatch. Best-effort, never blocks.
-        try { appendAudit({ email: user.email, sub: entry.sub ?? null, body }); } catch { /* best-effort */ }
+        // transport identity. Best-effort, never blocks.
+        //
+        // ── ONE LINE, WRITTEN WHEN THE OUTCOME IS KNOWN ────────────────────────────────────────────
+        //
+        // This used to be written here, before dispatch, and therefore with `status: null` — a record
+        // that a call was made and no record of what happened to it. On a deployed log every one of the
+        // five thousand most recent lines carries a null status, so "did this key read that report" was
+        // answerable only as "it asked".
+        //
+        // THE TRADE MADE, SAID PLAINLY: writing before dispatch survives a crash mid-call, and writing
+        // on `finish` does not. One line carrying the outcome is what a reader needs and what this was
+        // asked for, and a crash that loses the line also loses the response, so the caller is not left
+        // believing a lost call succeeded. The refusals above are recorded at their own sites and do not
+        // depend on this hook at all, which is the case a review actually asks about.
+        //
+        // `finish` fires once the response is fully sent, which is when `res.statusCode` is the answer
+        // the caller got rather than the default it started as.
+        res.once("finish", () => {
+          try { appendAudit({ email: user.email, sub: entry.sub ?? null, body, status: res.statusCode, door }); }
+          catch { /* best-effort */ }
+        });
         const answered = entry.transport.handleRequest(req, res, body);
         if (stampScope) { try { await answered; } finally { stampScope(); } }
         return answered;

package/mcp-server/lib/scrub.mjs

@@ -13,7 +13,7 @@
 // because a lawyer defending a filing decision needs the records, and it is bounded by a different
 // mechanism (a structured-field projection, never prose) in lib/evidence.mjs. Read that file's header
 // before widening anything here; the line it draws is evidence vs METHOD, and method stays sealed.
-// publish/render.mjs renders the Methodology section to the client (scopeSection → plainScopeNote) and
+// publish/render.mjs no longer renders a Methodology section to the client (the 2026-09-16 report redesign) and
 // deliberately names the register provider (provenance honesty, receipts, enforcement telemetry). A scrubber
 // stricter than the report would delete content the client was already sent, and would quietly make the MCP
 // a different product from the PDF in their inbox.

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.3.2-beta.4",
+  "version": "0.3.2-beta.5",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clearotron",
   "type": "module",
-  "version": "0.3.2-beta.4",
+  "version": "0.3.2-beta.5",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.3.2-beta.4",
+  "version": "0.3.2-beta.5",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-oauth-mcp-bridge
 
+## 0.3.2-beta.5
+
+No changes in this release.
+
 ## 0.3.2-beta.4
 
 No changes in this release.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.3.2-beta.4",
+  "version": "0.3.2-beta.5",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/shared/driver-dir.mjs

@@ -35,7 +35,7 @@
 // its own population needs an exception list — which would rebuild this issue's defect inside its fix:
 //
 //   · `driver/stage-freshness.mjs` creates a CHILD, `join(runDir, "_driver", STAMP_DIR)`.
-//   · `driver/pipeline.mjs:15755 shadowDir` passes a shadow dispatch sandbox under `_experiments/`, not a run
+//   · `driver/pipeline.mjs:15757 shadowDir` passes a shadow dispatch sandbox under `_experiments/`, not a run
 //     directory. It is a run-dir-SHAPED base, which is why the parameter is `base` and not `runDir`.
 //
 // ── WHAT THIS DELIBERATELY DOES NOT DO ────────────────────────────────────────────────────────────