clearotron 0.3.2-beta.6 → 0.3.2-beta.7

package/driver/suite-census.json

@@ -651,6 +651,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-refusal-names-the-collection-it-searched.test.mjs": {
+          "tests": 5,
+          "asserts": 13,
+          "skips": 0,
+          "todos": 0
+        },
         "a-refusal-names-the-file-when-the-command-it-offers-cannot-be-run.test.mjs": {
           "tests": 8,
           "asserts": 16,
@@ -677,7 +683,7 @@
         },
         "a-refused-query-says-whether-the-provider-declined-it.test.mjs": {
           "tests": 3,
-          "asserts": 11,
+          "asserts": 12,
           "skips": 0,
           "todos": 0
         },
@@ -699,6 +705,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-release-note-cannot-be-counted-twice.test.mjs": {
+          "tests": 12,
+          "asserts": 33,
+          "skips": 0,
+          "todos": 0
+        },
         "a-release-note-is-written-for-its-reader.test.mjs": {
           "tests": 9,
           "asserts": 66,
@@ -3070,8 +3082,8 @@
           "todos": 0
         },
         "pipeline.mock.test.mjs": {
-          "tests": 94,
-          "asserts": 795,
+          "tests": 97,
+          "asserts": 806,
           "skips": 0,
           "todos": 0
         },
@@ -3706,8 +3718,8 @@
           "todos": 0
         },
         "release-pipeline.test.mjs": {
-          "tests": 99,
-          "asserts": 376,
+          "tests": 101,
+          "asserts": 384,
           "skips": 0,
           "todos": 0
         },
@@ -5386,8 +5398,8 @@
           "todos": 0
         },
         "update-refuses-on-a-packaged-install.test.mjs": {
-          "tests": 6,
-          "asserts": 21,
+          "tests": 8,
+          "asserts": 26,
           "skips": 0,
           "todos": 0
         },
@@ -5733,8 +5745,8 @@
           "todos": 0
         },
         "http-handler.test.mjs": {
-          "tests": 17,
-          "asserts": 40,
+          "tests": 20,
+          "asserts": 47,
           "skips": 0,
           "todos": 0
         },
@@ -5872,7 +5884,7 @@
         },
         "the-portal-can-tell-who-has-connected-an-assistant.test.mjs": {
           "tests": 12,
-          "asserts": 33,
+          "asserts": 35,
           "skips": 0,
           "todos": 0
         },

package/driver/verify.mjs

@@ -13,7 +13,8 @@ import { driverDir } from "../shared/driver-dir.mjs";   //
 import { findReceiptViolations, findGridLedgerViolations, findPlatformIdentityViolations, parsePrRiskQueries, MEANING_SEAT, erroredConnotationQueriesAmong } from "./common-law-receipts.mjs";
 // Conversion 2 — the discriminator the two rulings above key on. PURE-ish: one existsSync-shaped read.
 import { matterFrameWasRecorded, frameRatifiedForms } from "./matter-frame-record.mjs";
-import { findConnotationViolations, parsePrRiskResults, MEANING_ANGLES_RE,
+import { findConnotationViolations, parsePrRiskResults, prRiskPopulation,
+  CONNOTATION_UNMATCHED_MARK, CONNOTATION_NO_RESEMBLANCE_MARK, MEANING_ANGLES_RE,
   parseDispositionForm, CONNOTATION_UNRULED_REASONS, queryKey } from "./connotation-search.mjs";
 import { formSidecarName, formSidecarPath } from "./disposition-union.mjs";
 // B — the transport's own four failure states. The audit reads the run's records; this file locates them.
@@ -365,6 +366,13 @@ function commonLawMeaningSeat(p, c) {
   let recordedRaw;
   try { recordedRaw = parsePrRiskResults(ledgerRaw).map((e) => String(e?.query ?? "")); }
   catch (e) { return fail(`grid_ledger_unparseable:${String(e.message).slice(0, 80)}`); }
+  // THE REFUSAL NAMES THE FILE IT JOINED AGAINST, because "recorded" is not one question in a run.
+  // A run answers "what did this half record" in four places that each mean something different — this
+  // results ledger, its gap rows, the obligations sidecar, and the final-state receipts audit — and a
+  // sentence that says only "recorded" invites a reader to answer from whichever they happen to open.
+  // Two readers did exactly that on one clearance and reached three different wrong mechanisms, each
+  // from a true measurement of a real record.
+  const LEDGER = `common-law-grid.half-${MEANING_SEAT}.json`;
   const recordedQ = new Set(recordedRaw.map(queryKey));
   const dropped = dictated.filter((q) => !recordedQ.has(queryKey(q)));
   if (dropped.length) {
@@ -435,17 +443,27 @@ function commonLawMeaningSeat(p, c) {
       .flatMap((b) => (Array.isArray(b?.gaps) ? b.gaps : []));
     const reportedError = new Map(
       erroredConnotationQueriesAmong(dropped, { gaps: gapRows }).map((e) => [e.query, e.error]));
+    // AND IT SAYS WHEN THE READER REDUCED WHAT IT READ. `parsePrRiskResults` folds rows onto the raw
+    // query text, so its output is smaller than the ledger whenever a query was recorded twice. Every
+    // count taken during one evening's diagnosis was post-fold and nobody had named the raw population,
+    // which made "the seat wrote 59 rows" and "59 survived the fold" the same number and different
+    // facts: one query recorded twice while another was skipped reads exactly like one simply skipped.
+    const pop = prRiskPopulation(ledgerRaw);
+    const foldNote = pop.repeated > 0
+      ? ` (${LEDGER} carries ${pop.rows} row(s) that fold to ${pop.distinct} distinct query(ies): `
+        + `${pop.repeated} repeat a query already counted, so a repeat here may stand where a dictated query is missing)`
+      : "";
     const parts = dropped.slice(0, 3).map((q) => {
       const reported = reportedError.get(q);
       // Named separately because the remedy is different: the search was attempted and the provider
       // declined it, so re-running it unchanged is the one repair that cannot work.
-      if (reported) return `${abbrev(q, 40)} [the provider REPORTED an error on this query: ${abbrev(reported, 60)}]`;
+      if (reported) return `${abbrev(q, 40)} [not recorded in ${LEDGER} because the provider REPORTED an error on it: ${abbrev(reported, 60)}]`;
       const n = nearest(q);
       return n
-        ? `${abbrev(q, 40)} [unmatched; nearest recorded: ${abbrev(n, 40)}]`
-        : `${abbrev(q, 40)} [no recorded query resembles this one]`;
+        ? `${abbrev(q, 40)} ${CONNOTATION_UNMATCHED_MARK} ${abbrev(n, 40)}] in ${LEDGER} — that is evidence a query LIKE it was recorded there, not that these two are the same query`
+        : `${abbrev(q, 40)} ${CONNOTATION_NO_RESEMBLANCE_MARK} in ${LEDGER}, which is the only file this gate joins against`;
     });
-    return fail(`connotation_query_unrecorded:${parts.join(",")}${dropped.length > 3 ? ` (+${dropped.length - 3} more)` : ""}`);
+    return fail(`connotation_query_unrecorded:${parts.join(",")}${dropped.length > 3 ? ` (+${dropped.length - 3} more)` : ""}${foldNote}`);
   }
   if (spec?.connotation?.disposition_required === true) {
     const recorded = parsePrRiskResults(ledgerRaw);

package/mcp-server/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-artifacts-mcp
 
+## 0.3.2-beta.7
+
+No changes in this release.
+
 ## 0.3.2-beta.6
 
 No changes in this release.

package/mcp-server/http-server.mjs

@@ -362,6 +362,10 @@ if (isMain) {
       // read inside it, so the factory keeps one rule and the caller names which door it is.
       createSession: (sessions, scope, owner) => createSession(sessions, scope, owner, { networkDoor: false }),
       authHeader: AUTH_HEADER, firmDomains: ALLOWED_DOMAINS, log,
+      // THE THIRD DOOR, and it has to name itself. It is not the staff surface and it is not the network
+      // client surface; a key presented here arrives over a local socket. Until this was passed, every
+      // audit line this door wrote carried no door at all and read as the staff surface by elimination.
+      door: "key",
     });
     openKeyDoor({ handler: keyHandler, path: KEY_SOCKET, log })
       .catch((e) => { log(`FATAL: could not open the key socket at ${KEY_SOCKET} — ${e.message}`); process.exit(1); });

package/mcp-server/lib/audit.mjs

@@ -40,6 +40,16 @@ export function summarize(body) {
   return out;
 }
 
+/**
+ * The value written when a caller names no door. A door-less line USED TO BE POSSIBLE and one writer
+ * produced them: the key door built its handler without saying which surface it was, so every line it
+ * wrote omitted the field while the lines either side of it carried it. Absence then read as the staff
+ * surface, because that was the only other thing it could have been, so the trail quietly attributed a
+ * client's calls to staff. The field is now always written and an unnamed door is loud rather than
+ * missing — a reader can search for this value, which is not true of a key that is not there.
+ */
+export const UNNAMED_DOOR = "unnamed";
+
 export function appendAudit({ email, sub, body, status, transport, door, path = DEFAULT_AUDIT_PATH }) {
   // `sub` = the inner-token PRINCIPAL (ops-token issuance, INSTALL.md §8) — distinguishes
   // two automations sharing a transport identity. null for internal/user sessions without a sub claim.
@@ -59,7 +69,7 @@ export function appendAudit({ email, sub, body, status, transport, door, path =
   // WRITTEN ONLY WHEN GIVEN, the same rule as `transport` and for the same reason: the existing log
   // shape must not move for records that have no answer to this. A door that does not name itself is a
   // record with no `door` key, not a record claiming to be from nowhere.
-  const line = JSON.stringify({ ts: new Date().toISOString(), email: email ?? null, sub: sub ?? null, ...summarize(body), status: status ?? null, ...(transport ? { transport } : {}), ...(door ? { door } : {}) }) + "\n";
+  const line = JSON.stringify({ ts: new Date().toISOString(), email: email ?? null, sub: sub ?? null, ...summarize(body), status: status ?? null, ...(transport ? { transport } : {}), door: door || UNNAMED_DOOR }) + "\n";
   try { mkdirSync(dirname(path), { recursive: true }); appendFileSync(path, line); } catch { /* best-effort */ }
 }
 

package/mcp-server/lib/http-handler.mjs

@@ -69,7 +69,7 @@ export function evictOldest(sessions) {
  * presents another identity's mcp-session-id is refused (403) — a leaked/guessed session id must never
  * let one CF-authed person attach to another's session (which may carry an ops-scoped inner token).
  */
-export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions, createSession, ns = "trademark-artifacts", sessionMax = 500, maxBody = 4 * 1024 * 1024, authHeader = "cf-access-jwt-assertion", firmDomains = [], clientSurface = false, devMode = false, tokenOnly = false, keyDoorPath = null,
+export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions, createSession, ns = "trademark-artifacts", sessionMax = 500, maxBody = 4 * 1024 * 1024, authHeader = "cf-access-jwt-assertion", firmDomains = [], clientSurface = false, door: doorName = null, devMode = false, tokenOnly = false, keyDoorPath = null,
   // Is this identity still on the guest list? ASKED PER REQUEST on an ACCOUNT session, cached on the
   // grants file's mtime, so it costs a stat between edits. Injected so an arm can move the answer
   // without a file; the default is the real read, because a door composed without this seam would
@@ -96,7 +96,11 @@ export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions,
   // caller who does not exist. Those lines carry no email and no principal, and say a call was refused
   // at this door at this time — which is true, and is the shape the local route already uses for the
   // same reason: a synthesized identity would match somebody who did nothing.
-  const door = clientSurface ? "client" : undefined;
+  // WHICH SURFACE THIS HANDLER IS, named rather than inferred. `clientSurface` answers a scope question
+  // and was doing double duty as the door's name, which left the key door — built with neither
+  // `clientSurface` nor a name — writing lines with no door at all. A caller that knows it is a third
+  // thing passes `door`; the two that do not get the surface they already declare.
+  const door = doorName ?? (clientSurface ? "client" : "portal");
   const refuse = (res, status, obj, who = {}) => {
     try { appendAudit({ email: who.email ?? null, sub: who.sub ?? null, body: who.body ?? null, status: "refused", door }); }
     catch { /* best-effort: a write failure must never change what the caller is told */ }

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.3.2-beta.6",
+  "version": "0.3.2-beta.7",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/mcp-server/server.mjs

@@ -1096,7 +1096,7 @@ if (isMain) {
       // route. On an install with no hosted client door the reader IS the operator, which is the same
       // split `stdioConnectOffer` already trusts, so that fact answers the question by itself; on a
       // hosted install it answers for nobody and the portal ignores it.
-      appendAudit({ email: null, sub: null, body: { method: "initialize" }, status: "connected", transport: "stdio" });
+      appendAudit({ email: null, sub: null, body: { method: "initialize" }, status: "connected", transport: "stdio", door: "local" });
     })
     .catch((e) => { log(`fatal: ${e?.stack ?? e}`); process.exit(1); });
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clearotron",
   "type": "module",
-  "version": "0.3.2-beta.6",
+  "version": "0.3.2-beta.7",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.3.2-beta.6",
+  "version": "0.3.2-beta.7",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/clarivate/src/capabilities.js

@@ -217,11 +217,11 @@ export const CAPABILITIES = Object.freeze({
   // ── WHICH FORM OF A NON-LATIN MARK DOES THE INDEX HOLD? ──────────────────────────────────────────
   // `false` = the TRANSLITERATION ONLY. The characters are not indexed, so searching them returns 0
   // with no error — the exact false-clean shape a reader calls CLEAN:
-  //   华威豹 → 0    HUA WEI BAO → 32 (and the 32 CONTAIN 华威豹)
-  //   小米   → 0    XIAOMI      → 57632
-  //   스타벅스 → 0
+  //   Searching the characters of a non-Latin mark returns nothing; searching its transliteration
+  //   returns records, and those records carry the characters. Both halves are needed to see it —
+  //   the empty answer alone is indistinguishable from a mark nobody has filed.
   // Universal, not a CJK-specific behaviour: non-Latin records across CN/TW/JP/KR/TH/GR/UA/EG/IL/SA
-  // carried a populated markTransliteration.
+  // carry a populated markTransliteration.
   //
   // This declaration is what makes the refusal a CONTRACT rather than one vendor file's hand-written
   // check: the shared executor (providers/_shared/execute-plan.mjs, via script-form.mjs) reads it and
@@ -250,7 +250,7 @@ export const CAPABILITIES = Object.freeze({
   // makeEnumerate({ capabilities: {...CAPABILITIES.kernel} }) — these values are the LIVE seam settings,
   // no longer a design note. pageGuard is 1 because /search is single-shot: there is no page 2 to
   // fetch, so the guard can only ever be a backstop. namesChunkDefault = maxOrWidth (500): the kernel
-  // chunks a wide OR-stack to the parser's probed nesting bound before it reaches the wire.
+  // chunks a wide OR-stack to the parser's nesting bound before it reaches the wire.
   kernel: Object.freeze({
     countProbe: "endpoint",
     screenSource: "billed-record-fetch",

package/providers/clarivate/src/core.js

@@ -1211,7 +1211,7 @@ export async function doBatchScreen(apiKey, base, params, tctx) {
         // judgment was shown a native-script mark beside its own romanised query with no reading on
         // either and concluded they were different marks. A delivered report told a client a
         // jurisdiction had not been searched in its own script while the run held both the query and
-        // this value. On the measured round 558 of 1,937 records had one to carry.
+        // this value. A large share of records carry one, so a dropped reading is not a rare edge.
         //
         // Null where the office records none, which is most Latin-script filings: this says what the
         // register says, and inventing a romanisation here would be this row certifying a reading

package/providers/corsearch/src/core.js

@@ -192,7 +192,7 @@ export const DEFAULT_SEARCH_FIELDS = [
 // ONE JSON envelope away: a 200 whose body is `{"message":"upstream search cluster unavailable"}`
 // is valid JSON, so parseError never fires — and the old fallback coerced "an object with no
 // totalHitCount" to 0, on a comment claiming a present body is "the provider answering". It is not.
-// A SEARCH RESPONSE is a body that carries the search-response shape this endpoint was probed to
+// A SEARCH RESPONSE is a body that carries the search-response shape this endpoint is documented to
 // return: totalHitCount (the count), rows (the records) or nextRequest (the paging cursor). A
 // parseable body with none of the three — an error envelope, a gateway stub — is the provider
 // saying something OTHER than an answer, and it rides out as a non-answer (null total, an error
@@ -435,7 +435,7 @@ export async function doExpandPhoneme(sessionKey, params, tctx) {
 // provider); they are RE-EXPORTED here unchanged so every existing importer — engine/mcp/corsearch-server.mjs,
 // register-plan.mjs, the driver — keeps resolving them from this module with identical semantics.
 // classifyStatus carries brand-json's vocabulary (Valid/Pending/GracePeriod live; Invalid/Expired dead;
-// anything else AMBIGUOUS → never auto-drop). BATCH_SCREEN_CHUNK = 100 = the observed brand-json page size.
+// anything else AMBIGUOUS → never auto-drop). BATCH_SCREEN_CHUNK = 100 matches the brand-json page size.
 export { BATCH_SCREEN_CHUNK, chunk, classifyStatus, isAllClass, normalizeBrandRow, screenVerdict };
 
 export async function doBatchScreen(sessionKey, params, tctx) {

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-oauth-mcp-bridge
 
+## 0.3.2-beta.7
+
+No changes in this release.
+
 ## 0.3.2-beta.6
 
 No changes in this release.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.3.2-beta.6",
+  "version": "0.3.2-beta.7",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/providers/perplexity/src/core.js

@@ -523,9 +523,9 @@ export function reconcileGridLedger(stdoutStr, spec) {
  *
  * Why identity and not a count: the sandbox program TRANSCRIBES the dictated queries into its own source,
  * and a mutated string is a DIFFERENT SEARCH. The count stays right while the dictated query never ran, so
- * every count-based check upstream and downstream reads clean. Observed: the dictated
- * `提基斯拉什 offensive meaning` came back as `提基斯ラッシュ offensive meaning` — the katakana of the
- * sibling Japanese row fused into the Chinese transliteration. 27 dictated, 27 recorded, one never searched.
+ * every count-based check upstream and downstream reads clean. The substitution this catches fuses one
+ * row's script into another row's transliteration: the two strings differ, the dictated and recorded
+ * counts still match exactly, and one dictated query is never searched by anybody.
  *
  * A query that THREW and said so is not this defect — it owns a gap row (`<query> | connotation | <error>`,
  * or the reconciled object form) and the driver's merge gate weighs it separately. Only a silent

package/providers/signa/src/capabilities.js

@@ -34,7 +34,7 @@
 //     it beats a number that is right for one shape and wrong for the other. See
 //     OWNER_SCOPED_WINDOW below, which is the machine-readable half.
 //
-//     What IS observed about the total is separate: it saturates at 10000 and flags itself
+//     The total is a separate matter: it saturates at 10000 and flags itself
 //     approximate there — a fact about the count, not about the window.
 //
 // PURE: no node imports, no vendor HTTP.
@@ -129,7 +129,7 @@ export const CAPABILITIES = Object.freeze({
   classFilter: "native",
   // Search rows already carry status / nice_classes / owner_name → screening is inline, zero extra calls.
   screenSource: "search-row",
-  // No documented or observed hard result ceiling, and no total to compare one against.
+  // No hard result ceiling, and no total to compare one against.
   resultCeiling: null,
 
   // ── the predicates, and WHICH REQUEST SHAPE each one rides ──────────────────────────────────────
@@ -247,10 +247,9 @@ export const CAPABILITIES = Object.freeze({
   // `legacy_code`. asks for `code` to be primary, and it now is, in the one place it decides
   // anything: `SIGNA_OFFICE_CODES` is what a reader and a future translate() should reach for.
   //
-  // THE MIGRATION IS NOT URGENT AND THE REASON IS MEASURED, not assumed. All eleven legacy keys were
-  // sent to the live wire beside their ISO codes, and every pair returned an identical
-  // total (cipo/CA 83, euipo/EM 80, inpi-fr/FR 19, ipau/AU 72, ipi/CH 46, ipos/SG 58, nipo/NO 42,
-  // prv/SE 22, ukipo/GB 96, uspto/US 169, wipo/WO 68). Nothing on the wire moves if `translate` keeps
+  // THE MIGRATION IS NOT URGENT, AND THE REASON IS A PROPERTY OF THE REGISTER rather than a guess:
+  // each legacy key and its ISO code address the same office, so the two spellings are interchangeable
+  // for every office this deployment reaches. Nothing on the wire moves if `translate` keeps
   // emitting keys, so it does — a vocabulary swap under the executor buys nothing and risks a live
   // office lookup.
   //

package/providers/signa/src/core.js

@@ -316,7 +316,7 @@ export function isSearchResponseBody(body) {
 // 21, 101, 18) and — the case that matters — an empty band answered `total_count: 0, approximate:
 // false`, an EXACT zero, which is the only kind this repository is allowed to render.
 //
-// Every approximate answer came back as exactly 10000: it is a saturation marker, not an estimate.
+// An approximate total of exactly 10000 is a saturation marker rather than an estimate.
 // The vendor is saying "at least ten thousand", and it says so on the broad sweeps (a bare owner
 // filter, `match: similar`, an unanchored `contains`) — precisely the bands a clearance cannot
 // enumerate anyway.