clearotron 0.3.2-beta.4 → 0.3.2-beta.6

package/INSTALL.md

@@ -331,6 +331,7 @@ terminal and is rewritten on every start.
 ~/trademark/config/profiles                   the company profiles
 ~/trademark/grants.json                       who may use this install
 ~/trademark/portal-audit.log                  what the portal was asked to do
+~/trademark/telemetry/trademark-mcp-access.jsonl   what a connected assistant asked for, and what it was told
 ~/trademark/portal-local-credential.json      the sign-in this install minted for you
 ```
 

package/bin/onboard.mjs

@@ -2702,6 +2702,71 @@ export async function runCheck() {
         + `Run \`${invoke("start")}\` — it creates the list.`);
     }
   }
+  // ── IS THIS DOOR'S ACCESS LOG BEING WRITTEN, AND WHERE? ───────────────────────────────────────────
+  //
+  // A client's assistant can list runs, read reports and pull artifacts through this door. The record of
+  // what a key did is the only way to answer a client, a lawyer or an incident review afterwards, and a
+  // log nobody can find is a log nobody checks.
+  //
+  // THE OVERRIDE IS READ FROM THE UNIT, NOT FROM THIS PROCESS. `TRADEMARK_MCP_AUDIT_LOG` decides where
+  // the writer appends, and the writer is the service — so this command's own environment is not the
+  // answer and using it would produce a confident report about a file the door never touches. Where the
+  // two disagree, that disagreement is the finding and is said out loud rather than resolved silently.
+  //
+  // WITH NO OVERRIDE THERE ARE TWO CANDIDATES, and which one the writer picked depends on what existed
+  // when IT started — a legacy path is kept if it is already there, so that a compliance trail is not
+  // split in two by a moved default. `auditPaths()` is the module's own reader for exactly this and is
+  // called rather than re-derived; re-deriving that branch here is the defect its source warns about.
+  try {
+    const { auditPaths: auditCandidates } = await import(pathToFileURL(join(REPO, "mcp-server", "lib", "audit.mjs")).href);
+    const seen = hosted ? unitValue(unitEnv, "TRADEMARK_MCP_AUDIT_LOG") : { state: "unset", value: null };
+    if (seen.state === "unknown") {
+      info(couldNotDetermine("TRADEMARK_MCP_AUDIT_LOG", unitEnv) + " The access log's location cannot be named.");
+    } else {
+      const mine = String(process.env.TRADEMARK_MCP_AUDIT_LOG ?? "").trim();
+      if (seen.state === "unset" && mine) {
+        warn(`this shell sets TRADEMARK_MCP_AUDIT_LOG and the units do not, so the door is NOT writing where `
+          + `this command would look. The door's log is at its default; ${mine} is this shell's answer only.`);
+      }
+      const paths = seen.state === "set" ? [seen.value] : auditCandidates();
+      let wrote = null;
+      for (const p of paths) {
+        try { const s = statSync(p); if (s.size > 0) { wrote = p; break; } } catch { /* not this one */ }
+      }
+      if (wrote) {
+        ok(`the client door's access log is being written: ${wrote}`);
+      } else {
+        // NOT-YET-WRITTEN IS NOT UNWRITABLE. A door nobody has called through has no log, and saying it
+        // is broken would be the same lie as calling an unreachable unit inactive.
+        //
+        // NAME THE ONE THE WRITER WOULD PICK, WHICH IS NOT SIMPLY THE FIRST. With no override there are
+        // two candidates and the older is kept only when it is ALREADY THERE, so that a compliance trail
+        // is not split by a moved default. Naming the older one unconditionally would print the
+        // integrator platform's folder at setup on installs that have no such file — a folder this engine
+        // does not require and whose mention was deliberately removed from this command. Where it does
+        // exist it IS the log and is named, because that is then the true answer.
+        const existing = paths.find((c) => { try { statSync(c); return true; } catch { return false; } });
+        const willUse = existing ?? paths[paths.length - 1];
+        const dir = dirname(willUse);
+        let writable = null;
+        try { accessSync(dir, constants.W_OK); writable = true; } catch (e) { writable = e?.code === "ENOENT" ? null : false; }
+        if (writable === false) {
+          blocking(`the client door's access log cannot be written: ${dir} is not writable by this user. `
+            + "Every call through this door would go unrecorded, and an absent record reads as nothing happened.");
+        } else if (writable === null) {
+          info(`no access log yet at ${willUse} and its directory does not exist — the door creates it on the `
+            + "first call. Nothing has come through it, or nothing has since the path last changed.");
+        } else {
+          info(`no access log yet at ${willUse}, and its directory is writable — nothing has come through `
+            + "this door yet. The first call creates it.");
+        }
+      }
+    }
+  } catch (e) {
+    info(`could not check the client door's access log (${e?.code ?? e?.message ?? e}) — this is a report `
+      + "that this command could not look, not that the log is missing.");
+  }
+
   try {
     const { clientDoorState: doorState, describeDoorState, connectKeyReport, CLIENT_DOOR_UNIT: doorUnit } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
     const { loadGrants: readGrantsFile, isRevoked: revokedCheck } = await import(pathToFileURL(join(REPO, "shared", "scope.mjs")).href);

package/bin/start.mjs

@@ -449,6 +449,10 @@ export function installPaths(base) {
     locks: join(base, "locks"),
     grants: join(base, "grants.json"),
     audit: join(base, "portal-audit.log"),
+    // The connector doors' access log — the record of what a client key did, which is what answers a
+    // client or a review afterwards. NAMED IN THE LAYOUT rather than built at the call site, for the
+    // reason the store below gives: a demo's isolation must be a property of where things live.
+    accessLog: join(base, "telemetry", "trademark-mcp-access.jsonl"),
     // The saved-search store is a git repository because recipe-service commits every save through
     // `git add` + `git commit` — that is the product's config-store model, not something invented here.
     // It is its own directory, NOT `base`, so the commit path never sees the pool, the queue or the
@@ -680,6 +684,16 @@ export function childEnv({ ports, paths, user, portalSecret, tokenSecret, opsTok
       "PROFILE_AUDIT": "",
       "RECIPE_AUDIT": "",
       "CLEAROTRON_FEEDBACK_DIR": "",
+      // AN EXPLICIT PATH, NOT "" LIKE THE TWO ABOVE. Empty is unset, and unset is what sends this one to
+      // the REAL install's home: its default is computed from `homedir()`, not from any directory a demo
+      // controls. So a demo left to fall back writes its access lines into the install beside it, and the
+      // demo stops being one directory a reader can delete. Measured as exactly that: a demo run left
+      // `telemetry/trademark-mcp-access.jsonl` in the install it booted next to.
+      //
+      // ONLY IN A DEMO. A real install must NOT have this pinned: with no override the writer keeps an
+      // older log where one already exists, so that moving the default does not split a compliance trail
+      // in two. Pinning the name here would override that and do the splitting.
+      "TRADEMARK_MCP_AUDIT_LOG": paths.accessLog,
     } : {}),
   });
   return {

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "9bb3ab371e736a3b4a80f2d6dbdd71fd719b173e",
-  "version": "0.3.2-beta.4"
+  "commit": "91905bd9b7ffd04985537f799d2ef49359e3d0e6",
+  "version": "0.3.2-beta.6"
 }

package/demo/knockout-search/run/_driver/predelivery-lint.json

@@ -1,5 +1,5 @@
 {
-  "ts": "2026-09-04T21:48:51.264Z",
+  "ts": "2026-09-16T16:48:57.832Z",
   "lane": "knockout",
   "checks": [
     {
@@ -43,9 +43,33 @@
       "surface": "findings",
       "pass": true,
       "detail": ""
+    },
+    {
+      "id": "reviewer-note-subject",
+      "family": "voice",
+      "surface": "findings",
+      "pass": true,
+      "detail": ""
+    },
+    {
+      "id": "plain-language-vocabulary",
+      "family": "voice",
+      "surface": "findings",
+      "pass": false,
+      "detail": "the lawyer's vocabulary on lines a reader meets before opening anything — rewrite the sentence in the words the reader already owns, do not swap the word: the batch summary: \"belt-and-braces\" → \"extra\"; the batch summary: \"chunk\" (an engine word — cut it)"
+    },
+    {
+      "id": "plain-language-sentence-length",
+      "family": "voice",
+      "surface": "findings",
+      "pass": false,
+      "detail": "a default-visible sentence carrying more than one idea (over 25 words) — split it, conclusion first: the batch summary: 28 words; the batch summary: 28 words; the batch summary: 27 words; the batch summary: 39 words; the batch summary: 26 words; +4 more"
     }
   ],
-  "failures": [],
+  "failures": [
+    "plain-language-vocabulary",
+    "plain-language-sentence-length"
+  ],
   "notApplicable": [
     {
       "id": "names-cell-populated",

package/driver/CHANGELOG.md

@@ -1,5 +1,21 @@
 # clearotron-driver
 
+## 0.3.2-beta.6
+
+### Patch Changes
+
+- 911b0b4: New: The report a client opens has been redrawn. It opens with what was asked, then the rating with its reasons, then the conflicts. What a search is and is not is no longer narrated at length.
+  
+  New: A finding's full detail shows the goods as the register recorded them, and the record's own dates. This is on a full country search.
+  
+  New: A knockout report closes with what happens next. The paragraph moves out of the long read rather than being repeated.
+
+## 0.3.2-beta.5
+
+### Patch Changes
+
+- a4ea94d: For operators: The connector access log now records what happened to each call, and records calls that were refused as well as calls that got through. A line also names which door took the call, so a client key and a staff session can be told apart. Before, a call was recorded only as having been made, and a refused one left no line at all. `doctor` now names where that log is being written. It reads that from the service's own settings, not from the shell you are typing in.
+
 ## 0.3.2-beta.4
 
 ### Patch Changes

package/driver/common-law-receipts.mjs

@@ -611,6 +611,32 @@ export function findDroppedConnotationQueries(spec, mergedGrid) {
  * Deliberately NOT counted as searched: laundering an honest error into a clean receipt would be a worse
  * defect than the one being fixed.
  */
+/**
+ * Of a caller's OWN list of missing queries, which ones did the plugin honestly report as having thrown?
+ *
+ * The sibling below derives its missing list itself, from the full spec. This one is handed one, because
+ * the meaning-seat gate computes a different list: it joins per half on `queryKey` where this module
+ * joins the merged grid on `norm`. Two callers, two populations, ONE author of what a gap row means —
+ * which is the point of the split. Reuse the key, not the question.
+ *
+ * Returns the CALLER'S query verbatim, never the gap row's term, so the caller can index what comes back
+ * against the list it passed in. A gap term that matched is by definition the same query under `norm`,
+ * and handing back the other spelling would make the caller join twice on two keys to use the answer.
+ */
+export function erroredConnotationQueriesAmong(missingQueries, mergedGrid) {
+  const gaps = (Array.isArray(mergedGrid?.gaps) ? mergedGrid.gaps : [])
+    .filter((g) => g && String(g.platform ?? "").toLowerCase() === "connotation");
+  if (!gaps.length) return [];
+  const out = [];
+  for (const m of missingQueries ?? []) {
+    const k = norm(String(m ?? ""));
+    if (!k) continue;
+    const hit = gaps.find((g) => norm(String(g.term ?? "").trim()) === k);
+    if (hit) out.push({ query: m, error: String(hit.error ?? "unspecified") });
+  }
+  return out;
+}
+
 export function findErroredConnotationQueries(spec, mergedGrid) {
   const missing = new Set(findDroppedConnotationQueries(spec, mergedGrid).map(norm));
   if (!missing.size) return [];

package/driver/contract-e3-backlog.mjs

@@ -488,7 +488,7 @@ export const E3_BACKLOG = [
     where: "driver/stages.mjs:3231",
     surface: "stage-message",
     evidence: "- meters: {\"mark_similarity\":{...},\"goods_proximity\":{...},\"use\":{...},\"enforcer\":{...}} — all four present, each {\"token\",\"basis\",\"source\"}. … mark_similarity = high | medium | low. goods_proximity = high | medium | low. enforcer = high | medium | low | unknown. use = confirmed | not-confirmed | un",
-    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; driver/verify.mjs:1127 checkFindingsSibling gates meters.*.source; finding_basis_source_missing",
+    reparsedBy: "driver/findings-model.mjs:813 parseFindingsJson; driver/verify.mjs:1153 checkFindingsSibling gates meters.*.source; finding_basis_source_missing",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -684,7 +684,7 @@ export const E3_BACKLOG = [
     // because an un-anchorable row lands in the NOT-CHECKED slice, and that is coverage lost rather than
     // a pass.
     evidence: "is ONE of coverage-disposition | fact | rating | narrative — pick the one your own legal read says the correction IS: coverage-disposition (a coverage row / disposition placement is wrong or dishonest)",
-    reparsedBy: "driver/verify.mjs:803 CORRECTION_KIND_RE = /\\[kind:\\s*([a-z][a-z-]*)\\s*\\]/i → parseCorrectionKinds (verify.mjs:1026), consumed in pipelineInner() in pipeline.mjs for the run.jsonl `correction-kinds` histogram, which since #1558 also carries `kindChannelOk` — the counts are DERIVED from the parsed rows, and that key states whether the reviewer's kind channel produced anything at all rather than leaving a reader to infer it by comparing untyped against total. Telemetry only today",
+    reparsedBy: "driver/verify.mjs:829 CORRECTION_KIND_RE = /\\[kind:\\s*([a-z][a-z-]*)\\s*\\]/i → parseCorrectionKinds (verify.mjs:1052), consumed in pipelineInner() in pipeline.mjs for the run.jsonl `correction-kinds` histogram, which since #1558 also carries `kindChannelOk` — the counts are DERIVED from the parsed rows, and that key states whether the reviewer's kind channel produced anything at all rather than leaving a reader to infer it by comparing untyped against total. Telemetry only today",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {
@@ -697,7 +697,7 @@ export const E3_BACKLOG = [
     // `[on: -]` case went from a value to an ABSENCE — you omit the field — which is the one part a
     // reader could get wrong from the old wording, since there is no value meaning "no finding".
     evidence: "**AND EVERY FLAG CARRIES WHICH FINDING IT IS ABOUT** — the `on` field, an array of ordinals. Same rule as `kind`: you send the values, the driver renders the token.",
-    reparsedBy: "driver/verify.mjs:820 CORRECTION_ON_RE = /\\[on:\\s*([0-9,\\s-]*?)\\s*\\]/i. SKILL-FILE ONLY — the stage message at stages.mjs:1842-1877 never mentions `[on:]`. This is #850's \"the element shape is in the skill file, not the stage message\" in its purest form: an E3 lint reading stages.mjs alone sees the [kind:] token and misses its twin",
+    reparsedBy: "driver/verify.mjs:846 CORRECTION_ON_RE = /\\[on:\\s*([0-9,\\s-]*?)\\s*\\]/i. SKILL-FILE ONLY — the stage message at stages.mjs:1842-1877 never mentions `[on:]`. This is #850's \"the element shape is in the skill file, not the stage message\" in its purest form: an E3 lint reading stages.mjs alone sees the [kind:] token and misses its twin",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {

package/driver/contract-vocabulary.mjs

@@ -17,12 +17,12 @@
 //
 //   D1 verify.mjs:940   fail(`connotation_${reason}:…`)      — reason iterates the table at line 894
 //   D2 verify.mjs   fail(String(e.message))              — parseFindingsJson throws token-first
-//   D3 verify.mjs:1184   checkJson: fail(String(e.message))   — FIVE parsers reach this one site
+//   D3 verify.mjs:1210   checkJson: fail(String(e.message))   — FIVE parsers reach this one site
 //   D4 verify.mjs  parseCoverageLedgerJson, same shape
 //   D5 verify.mjs:1504  fail(`${unaccounted[0].token}:…`)    — token minted in a DATA ROW
 //   D6 verify.mjs:1567  fail(`${violations[0].token}…`)      — validatePlanFeasibility in register-plan.mjs
 //   D7 verify.mjs:1558  fail(`${v2[0].token}${detail}…`)     — register-plan.mjs:2018 disclosureTextByAxis
-//   D8 verify.mjs:1692  fail(caseLawLedgerFail(…))           — token built in case-law-ledger.mjs:204
+//   D8 verify.mjs:2425 caseLawLedgerFail  fail(caseLawLedgerFail(…))           — token built in case-law-ledger.mjs:204 caseLawLedgerFail
 //
 // A partition built on the 60 tokens a regex CAN see would run green while blind to the rest, which is
 // worse than having no E2 at all: it certifies a partition it never checked. So the census is authored
@@ -109,7 +109,7 @@ export const VOCABULARY = [
   { token: "coverage_form_missing", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_form_empty", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_status_offenum", stages: ["register-digest"], site: "driver/verify.mjs:2050" },
-  { token: "coverage_deferred_unaccounted", stages: ["register-digest"], site: "driver/verify.mjs:1510 coverageFormFail", family: "driver/register-plan.mjs:1642 PROVIDER_HARD_ERROR_PREFIX — token on a data row", dynamic: "D5" },
+  { token: "coverage_deferred_unaccounted", stages: ["register-digest"], site: "driver/verify.mjs:1536 coverageFormFail", family: "driver/register-plan.mjs:1642 PROVIDER_HARD_ERROR_PREFIX — token on a data row", dynamic: "D5" },
   { token: "coverage_clean_unexecuted", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1417 validatePlanFeasibility", dynamic: "D6" },
   { token: "coverage_clean_skipped", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1766 searchedJurisdictionsFromPlan", dynamic: "D6" },
   { token: "coverage_clean_unverified_incomplete", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:2018 disclosureTextByAxis", dynamic: "D7" },
@@ -130,7 +130,7 @@ export const VOCABULARY = [
   { token: "variantmodel_term_markup", stages: ["prelim-variants"], site: "driver/verify.mjs" },
   { token: "variantmodel_missing", stages: ["prelim-variants"], site: "driver/verify.mjs:1153, 1212" },
   // Recovered during E2 authoring, absent from the draft census: variant-manifest.json is strict-parsed
-  // through checkSiblingJson (verify.mjs:1197) → checkJson (:742), so the WHOLE variantmodel_* family
+  // through checkSiblingJson (verify.mjs:1223) → checkJson (:742), so the WHOLE variantmodel_* family
   // reaches prelim-variants, not just the four literal tokens above.
   // CONVERSION 3 widened this family's SOURCE without widening its prefix. `acceptPrelimVariants` raises
   // `variantmodel_scope_layer_invalid`, `_scope_status_invalid`, `_scope_item_missing` and `_scope_pipe`
@@ -184,7 +184,7 @@ export const VOCABULARY = [
   // ── case-law / narrative-refutation ────────────────────────────────────────────────────────────────
   { token: "caselaw_ledger_missing", stages: ["case-law"], site: "driver/verify.mjs:1682, 1685" },
   { token: "caselaw_ledger_unparseable", stages: ["case-law"], site: "driver/verify.mjs" },
-  { token: "caselaw_ledger", stages: ["case-law"], site: "driver/verify.mjs:1692", family: "driver/case-law-ledger.mjs:204 (census reasons)", dynamic: "D8" },
+  { token: "caselaw_ledger", stages: ["case-law"], site: "driver/verify.mjs:2425 caseLawLedgerFail", family: "driver/case-law-ledger.mjs caseLawLedgerFail (census reasons)", dynamic: "D8" },
   { token: "no_verdict_line", stages: ["narrative-refutation"], site: "driver/verify.mjs" },
   { token: "plan_audit_missing", stages: ["narrative-refutation"], site: "driver/verify.mjs" },
 
@@ -477,7 +477,7 @@ export const INNER_CODES = Object.freeze([
   // `axis_invalid` cause into its own family before counting the rest. A ruling naming only
   // `coverage_no_status` would be true of most `no_status` records and false of the ones that matter most.
   { code: "no_status", mints: ["driver/coverage-form.mjs:836"], rollsUpTo: ["coverage_no_status", "coverage_form_axis_invalid"],
-    why: "Two composites, split on the record's `cause`: verify.mjs:1172 for cause `axis_invalid`, verify.mjs:1263 for the rest. NOT cited at coverage-form.mjs:810 — that is the JSDoc @returns annotation, not the mint." },
+    why: "Two composites, split on the record's `cause`: `checkFindingsSibling()` in verify.mjs for cause `axis_invalid`, `dispositionForm()` there for the rest. NOT the `@returns` annotation above `COVERAGE_CAUSES` in coverage-form.mjs — that is the annotation, not the mint." },
   { code: "engine_vocabulary", mints: ["driver/coverage-form.mjs:826"], rollsUpTo: ["coverage_form_engine_vocabulary"],
     why: "#669 — the seat wrote an engine token into the `reason` sentence that reaches the reader's page. Checked on settled rows too, because a row the seat considers finished is exactly the one whose sentence gets printed. Namespaced at verify.mjs:1165; the bare code names a row, never a stage." },
 

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.2-beta.4",
+  "version": "0.3.2-beta.6",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline.mjs

@@ -6437,8 +6437,10 @@ function injectFrontMatter(path, fields, runDir = null) {
 // spec 62 — the per-field CONFIGURATION PROVENANCE rows for a project run: for each PROJECT_KEY, its effective
 // value (compact) and where it came from (project | customer | house). Read off the frozen sidecar `pr` (both
 // origins and the effective values live there), serialised to a single-line JSON string for the report
-// front-matter, and rendered INTERNAL-ONLY in the scope fold (never on the client export — provenance, not
-// process-exhaust). Absent origins ⇒ [] ⇒ nothing injected (no-project runs are untouched).
+// front-matter. It was rendered internal-only in the scope fold; the 2026-09-16 redesign takes that fold
+// off the page, and this row set went with it — it was the one block in there labelled internal, which is
+// the class that ruling removed. IT IS STILL RECORDED, here and in the workbook, which is where a reader
+// who wants to know which layer set a knob now finds out. Absent origins ⇒ [] ⇒ nothing injected.
 function originRowsForReport(pr) {
   if (!pr?.origins) return [];
   const short = (s, n = 48) => { const t = String(s ?? "").trim(); return t.length > n ? `${t.slice(0, n - 1)}…` : t; };