clearotron 0.3.2-beta.7 → 0.3.2-beta.9

package/providers/jx/README.md

@@ -9,7 +9,8 @@ validated at parse.
 **One vendor, one billing mode, decided by the run and not by this directory.** The lanes go through
 `engine.runTurn()` — the same door all fourteen agentic stages use — via
 [`../../driver/engine/jx-turn.mjs`](../../driver/engine/jx-turn.mjs). Whatever program the customer configured
-(`CLEAROTRON_AI`) and whatever billing mode the run is on (API key or subscription) carries these calls too.
+(`CLEAROTRON_AI`) and whatever billing mode the run is on (subscription, API key or, for Claude, a cloud account)
+carries these calls too.
 That is the owner's standing rule — *one LLM provider only ever, API or auth, no mix* — and until 2026-08-20
 these three lanes were the one place in the product that broke it: they POSTed to the Anthropic Messages API on
 `ANTHROPIC_API_KEY` at a hardcoded cheap tier no matter what the rest of the run was doing.

package/providers/jx/src/turn-envelope.mjs

@@ -106,15 +106,20 @@ export function envelopeFromTurnText(text, toolName) {
  * so the ORDER of those checks lives here once rather than three times.
  *
  * `turn` is supplied by the driver and is injectable for tests:
- *   async ({prompt, kind}) => { ok, text, truncated, usage:{input,output}, model, vendor, authMode, cause }
+ *   async ({prompt, kind}) => { ok, text, truncated, usage:{input,output}, model, vendor, authMode, cloud, cause }
  *
  * ATTRIBUTION RIDES EVERY RETURN, including the failures. A degrade still spent tokens, and without the
  * model, vendor and billing mode beside them they cannot be attributed in the run's rollup — which is
  * the half of that says a run must be able to state who did the work.
+ *
+ * `cloud` is part of that attribution: under the cloud billing mode it names the account that paid
+ * ("foundry", "vertex", "bedrock", "gateway"), and it is null under every other mode. The ledger stamp
+ * reads it from THIS return, so a field left off here reached every native-language record as
+ * `cloud: null` while the main steps of the same run said which cloud paid.
  */
 export async function runJxTurn({ body, turn, kind, started, truncatedCause, parse }) {
   const t0 = Number.isFinite(started) ? started : Date.now();
-  const blank = { tookMs: 0, model: null, vendor: null, authMode: null, usage: null };
+  const blank = { tookMs: 0, model: null, vendor: null, authMode: null, cloud: null, usage: null };
   if (typeof turn !== "function") return { ok: false, cause: `${kind}: no turn runner was supplied`, ...blank };
 
   const { prompt, toolName } = promptFromRequest(body);
@@ -124,7 +129,7 @@ export async function runJxTurn({ body, turn, kind, started, truncatedCause, par
 
   const attribution = {
     tookMs: Date.now() - t0,
-    model: r?.model ?? null, vendor: r?.vendor ?? null, authMode: r?.authMode ?? null,
+    model: r?.model ?? null, vendor: r?.vendor ?? null, authMode: r?.authMode ?? null, cloud: r?.cloud ?? null,
     // Passed through WHOLE, and `null` stays null. The driver hands over the engine contract's canonical
     // Usage ({input, output, cacheRead, cacheWrite, total}); re-shaping it to two fields here would drop
     // cache and total tokens from the rollup, and a zeroed object in place of null would report a

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,13 @@
 # trademark-oauth-mcp-bridge
 
+## 0.3.2-beta.9
+
+No changes in this release.
+
+## 0.3.2-beta.8
+
+No changes in this release.
+
 ## 0.3.2-beta.7
 
 No changes in this release.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.3.2-beta.7",
+  "version": "0.3.2-beta.9",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/providers/perplexity/src/core.js

@@ -384,7 +384,7 @@ export function connotationQueriesOf(spec) {
  * Build the sandbox task from the DICTATED spec — the term and platform keys reach Perplexity's program
  * from code, never re-typed by the calling model (this is what kills re-typed-key corruption (VIBRANTE→VIBRNTE-class typos)).
  * CRITICAL: this carries the PINNED pplx_sdk access idiom (the same one in
- * skills/prelim-common-law/perplexity-prompts.md). Without it the sandbox agent free-styles the SDK and
+ * skills/clearance-common-law/perplexity-prompts.md). Without it the sandbox agent free-styles the SDK and
  * dies with "TypeError: 'pplx_sdk.WebHit' object is not iterable" on every cell (the teal-vault /
  * a 1-of-154 fold failure). The result object supports ITERATION + ATTRIBUTE
  * access only. The per-cell try/except keeps one bad cell from aborting the whole grid.

package/providers/signa/README.md

@@ -56,4 +56,4 @@ past `OWNER_SCOPED_WINDOW` (400 rows). Approximate totals saturate at 10000 and
 on which date, and what is still `null` on purpose. Then `src/core.js` for how a declared predicate
 reaches the wire — `toSignaParams` → `buildSearchRequest` — because "the vendor supports it" and "our
 executor sends it" are two different claims. The model-facing operator vocabulary lives in
-[`../../driver/skills/prelim-register/providers/signa.md`](../../driver/skills/prelim-register/providers/signa.md).
+[`../../driver/skills/clearance-register/providers/signa.md`](../../driver/skills/clearance-register/providers/signa.md).

package/providers/signa/src/capabilities.js

@@ -22,17 +22,16 @@
 //     punctuation. Declaring it would be declaring a capability the executor cannot serve, which is
 //     the one thing 's criteria forbid. Stays null; the slice defers, disclosed.
 //   * resultCeiling — there is no single number to put here, and the reason is worth the paragraph.
-//     A plain term exhausts 685 rows, a class-filtered one 539, an
-//     unanchored `contains` 2047 — no ceiling. But add `filters.owner_name` and the SAME term stops
-//     dead at 400: "This cursor points beyond the 400 result pagination window." The bound is in ROWS
-//     rather than pages (at limit 25 it stopped after 375, before the page that would cross 400), and
-//     it applies to the owner-scoped shape only.
+//     An unscoped term pages to exhaustion whatever its size, on every predicate — no ceiling. But add
+//     `filters.owner_name` and the SAME term stops dead at the owner-scoped window (400), which the
+//     vendor's own cursor refusal names. The bound is in ROWS rather than pages — the loop stops
+//     mid-page, before the page that would cross it — and it applies to the owner-scoped shape only.
 //
 //     So the ceiling is a property of the QUERY SHAPE, not of the provider, and this field can hold
 //     only one number for both. `null` with the fact written down beats 400, which would turn every
-//     tractable band over 400 into a crowd and throw away the 2047 this vendor will happily page; and
-//     it beats a number that is right for one shape and wrong for the other. See
-//     OWNER_SCOPED_WINDOW below, which is the machine-readable half.
+//     tractable band over that window into a crowd and throw away the bands this vendor will happily
+//     page to exhaustion; and it beats a number that is right for one shape and wrong for the other.
+//     See OWNER_SCOPED_WINDOW below, which is the machine-readable half.
 //
 //     The total is a separate matter: it saturates at 10000 and flags itself
 //     approximate there — a fact about the count, not about the window.
@@ -107,10 +106,9 @@ export const CAPABILITIES = Object.freeze({
   // was none — the flag is now set by buildSearchRequest on EVERY call, where no call site can forget
   // it, because under this seam a response without a total cannot support a completeness claim.
   //
-  // Nine queries return exact totals throughout (685, 220, 363, 830, 2047, 21, 101, 18),
-  // and an empty band answering `total_count: 0, approximate: false` — an exact zero, the only kind
-  // this repository may render. `limit: 1` returns the same total as the paged query, which is what
-  // makes the cheap probe cheap.
+  // Every narrow band answers an exact total, and an empty band answers `total_count: 0,
+  // approximate: false` — an exact zero, the only kind this repository may render. `limit: 1` returns
+  // the same total as the paged query, which is what makes the cheap probe cheap.
   //
   // The vendor also flags some totals `total_count_approximate` — always at exactly 10000, so it is a
   // saturation marker rather than an estimate. normalizeSearchResponse reports those as UNKNOWN, never
@@ -175,10 +173,11 @@ export const CAPABILITIES = Object.freeze({
     // portfolio": that is `filters.owner_id`, which takes a resolved `own_…` id and 400s on an unknown
     // one rather than answering zero.
     //
-    // A zero here is a real zero and not a filter failing silently. Verified by the case that looked
-    // like one: `query: NIKE` × owner "Nike Innovate" × USPTO returns 0 while the bare owner returns
-    // 1984 and the bare term 169 — because the exactly-NIKE USPTO marks are held by "NIKE, Inc.",
-    // which does intersect (131). Both clauses are applied; the empty set is the answer.
+    // A zero here is a real zero and not a filter failing silently. Verified on the case that looked
+    // like one: a term × owner × territory intersection came back empty while the bare owner and the
+    // bare term each answered — because the register holds those marks under a differently styled
+    // applicant name, which the owner clause does reach. Both clauses are applied; the empty set is
+    // the answer.
     owner:          "owner_name",
   }),
 
@@ -195,38 +194,32 @@ export const CAPABILITIES = Object.freeze({
 
     // ── WHICH BINDING LAYERS DOES A SEARCH SCOPED TO THIS OFFICE ACTUALLY RETURN? ──────────
     //
-    // 's first task, answered for this provider by measurement rather than by reading. Same
-    // query, same limit, three scopings of France:
+    // 's first task, answered for this provider by driving the three scopings against each other rather
+    // than by reading the documentation. One term, one limit, France:
     //
-    //   filters.offices: ["FR"]                              19 rows — ALL FR/direct_national
-    //   filters.jurisdictions: ["FR"], territory_match direct 21 rows — FR national + WO/madrid_ir
-    //   filters.jurisdictions: ["FR"], territory_match protection
-    //                                                       101 rows — FR national + EM/direct_regional + WO
+    //   filters.offices                              the national register ALONE
+    //   filters.jurisdictions + territory_match direct       national + the territory's Madrid legs
+    //   filters.jurisdictions + territory_match protection   national + REGIONAL + Madrid
     //
-    // and the control that proves `protection` adds a REGIONAL layer rather than simply more rows:
-    // Switzerland, which sits under no regional register, returns 47 either way.
+    // and the control that proves `protection` adds a LAYER rather than simply more rows: a territory
+    // that sits under no regional register answers the same either way.
     //
     // STAGE 2 MOVED THE TABLE, BECAUSE IT MOVED THE QUERY. `toSignaParams` now sends
     // `filters.jurisdictions` + `territory_match: "protection"` instead of `filters.offices`, so a
-    // territory's whole stack of rights comes back in ONE call. The per-territory breakdown that
-    // justifies every cell below — same term, `filing_route` asked directly rather than sampled:
+    // territory's whole stack of rights comes back in ONE call. Every cell below was then asked
+    // directly — `filing_route` per territory rather than sampled — and what that walk established is:
     //
-    //          national   regional   madrid          national   regional   madrid
-    //   US      10000+       0        2263      FR      6898     10000+     2708
-    //   GB      10000+       0         523      SE      1994     10000+     2622
-    //   CH       2694        0        2254      EU         0     10000+     2196
-    //   CA       9894        0         814      WO         0        0       9150
-    //   AU      10000+       0        1734      SG      2899        0       1323
-    //   NO       1354        0        1149
+    //   · every territory reaches its Madrid layer;
+    //   · every EU member reaches the EU register, and no non-member does;
+    //   · a `regional` absence is not a gap — no regional register binds Switzerland or Canada, so
+    //     there is no regional layer for `bindingLayersFor` to ask about.
     //
-    // A `regional` zero is not a gap: no regional register binds Switzerland or Canada, so there is no
-    // regional layer for `bindingLayersFor` to ask about. Every territory reaches its Madrid layer, and
-    // every EU member reaches the EU register — which is the whole of what Stage 2 asked for.
+    // Which is the whole of what Stage 2 asked for.
     //
     // WHAT THE OFFICE FILTER DID, kept because it is why the change was necessary and because the day
-    // someone reverts the query shape this table becomes false rather than merely stale:
-    //   filters.offices: ["inpi-fr"] → national 6898, regional 0, MADRID 0. France's national register
-    //   alone, with the EU trade mark that blocks use in France sitting in a register nobody queried.
+    // someone reverts the query shape this table becomes false rather than merely stale: scoped to a
+    // national office, a France search returns that national register alone — with the EU trade mark
+    // that blocks use in France sitting in a register nobody queried.
     //
     // (The office filter is not uniform either — `uspto` and `ipi` return madrid-derived rows because
     // those registers hold the national legs of IRs themselves, while `inpi-fr` and `ukipo` return
@@ -267,12 +260,12 @@ export const CAPABILITIES = Object.freeze({
   // The owner surface exists (predicates.owner above) and composes with a text query in ONE request,
   // so the intersection is the vendor's rather than something reassembled here from two sweeps.
   //
-  // EVIDENCED ON THE DETERMINISTIC SHAPE, AND ONLY THERE, on purpose. `match: contains` for a term
-  // returned 2047; the same term with `filters.owner_name` returned 689 — a proper subset, which is
-  // what an intersection has to be. The ranked shape does NOT show that: the same term under
-  // `strategies` returned 238 alone and 1054 with an owner filter applied, i.e. MORE with the extra
-  // clause. Recall under `similar` is not fixed, so ranked totals are not comparable across two
-  // different requests and cannot evidence a set relation in either direction.
+  // EVIDENCED ON THE DETERMINISTIC SHAPE, AND ONLY THERE, on purpose. Under `match: contains`, adding
+  // `filters.owner_name` to a term returns a PROPER SUBSET of that term alone — which is what an
+  // intersection has to be. The ranked shape does NOT show that: under `strategies` the same pair
+  // answers MORE with the extra clause than without it. Recall under `similar` is not fixed, so ranked
+  // totals are not comparable across two requests and cannot evidence a set relation in either
+  // direction.
   //
   // Recorded because the ranked pair is the measurement a reader would take first, and taken alone it
   // would look like the filter being ignored — a wrong conclusion, reached from real numbers.
@@ -283,9 +276,9 @@ export const CAPABILITIES = Object.freeze({
   // reason it is a value and not still a null: fetch a record whose script is non-Latin, read its
   // mark text verbatim, search those exact characters back.
   //
-  //   record  Singapore, `mark_text_script: "Hans"`, `mark_text_language: "zh"`, 8 characters
-  //   query   the record's own mark_text, `match: "exact"`
-  //   result  total_count 1, and the recalled id is the SAME record
+  //   record  one whose `mark_text_script` is non-Latin, read verbatim
+  //   query   that record's own mark_text, `match: "exact"`
+  //   result  it recalls itself — the same id comes back, and nothing else
   //
   // The characters are the index key, so `true`. providers/_shared/script-form.mjs may now send a
   // native-script slice here instead of deferring it.
@@ -297,7 +290,7 @@ export const CAPABILITIES = Object.freeze({
   // guessing at it here would put the shrug back in a different field.
   //
   // The blind spot to note for the reader who comes to widen this: the search ROW carries no script
-  // field at all (38 keys); `mark_text_script` is a FULL-RECORD field (60 keys). A sweep over
+  // field at all; `mark_text_script` is a FULL-RECORD field. A sweep over
   // search rows therefore finds no scripts anywhere and reads as "the index holds none" — which is
   // how this probe failed on its first attempt, and it failed by returning an empty set, not an error.
   nativeScriptIndex: true,

package/providers/signa/src/core.js

@@ -117,8 +117,8 @@ const DETERMINISTIC_MATCH = new Set(["similar", "exact", "starts_with", "ends_wi
 // filter keys outright — `HTTP 400 Unrecognized key: status` — so every status-filtered Signa search
 // failed on the wire, and it survived review because the kernel does not pass one and no fixture
 // carried one. The real names are `status_primary` (pending|active|inactive|unknown) and
-// `status_stage`. `status_primary:["active"]` narrows 685 → 375; the bogus-key
-// control 400s identically, which is what proves the rejection is about the NAME and not the value.
+// `status_stage`. `status_primary:["active"]` narrows a band as a status filter should; the bogus-key
+// control is refused identically, which is what proves the rejection is about the NAME and not the value.
 //
 // Two branches building the same object by hand is what let one of them be wrong for two months, so
 // there is now one function and both branches call it.
@@ -136,7 +136,11 @@ function buildFilters(p) {
 }
 
 export function buildSearchRequest(p) {
-  const body = { query: p.query };
+  // `query` is OMITTED, not sent undefined, when the entry is owner-only: an explicit `query: undefined`
+  // serializes away anyway, but writing it conditionally is what makes the owner-only shape legible here
+  // rather than an accident of JSON.stringify.
+  const body = {};
+  if (String(p.query ?? "").trim()) body.query = p.query;
   const match = typeof p.match === "string" ? p.match.trim() : "";
   if (match && DETERMINISTIC_MATCH.has(match)) {
     body.match = match;   // sending strategies alongside is a 4xx, not a preference
@@ -240,7 +244,7 @@ export function normalizeRecord(rec, officeHint = null) {
     imageAvailable: rec.has_media ?? null,
     resolved_link: null, // Signa exposes no per-record public URL; renderer shows "verify at office"
     // ── WHICH LAYER THIS RIGHT SITS ON, carried as data ( →) ──────────────────────────
-    // The normalizer read 18 of the 38 fields a search row carries. Among the 20 it dropped were the
+    // The normalizer read under half the fields a search row carries. Among the ones it dropped were the
     // four that say what KIND of right a record is — and those are not extras, they are the whole
     // vocabulary the binding-layer disclosure is written in. A France search that returns an EUTM and
     // a Madrid IR alongside French national marks could not say so, because the three arrived
@@ -281,7 +285,23 @@ export function normalizeRecord(rec, officeHint = null) {
 
 // Light search row (record_id + display fields). Signa returns FULL records on search, but we project a
 // lean row here and let record_fetch return the full normalized record (mirrors corsearch/clarivate).
+//
+// THIS ROW IS ALSO THE BAND ROW, so it carries the band contract's key names. `screenSource: "search-row"`
+// means the kernel lands these rows in the named band as they are — there is no screen call to lift
+// fields across — and every band consumer (band-shape, named-band, the digest, the placement form, the
+// house-mark ownership check) reads `owner_name`, `classes` and `application_date`. This row used to carry
+// only `owner`, `nice_classes` and `filing_date`, and `owner` read a flat `owner_name` the vendor does not
+// send: the owner is `owners[].name`, exactly as normalizeRecord above already reads it. Every Signa
+// record therefore reached the fold with no owner, every register placement failed
+// `placement_owner_missing` in the render, and a pass that had tiered 141 in-class identical and
+// near-identical records delivered none of them while reporting success.
+//
+// The signa-named keys stay: rowScreen and the search tool's own output read them.
 function normalizeSearchRow(rec) {
+  const owner0 = Array.isArray(rec.owners) ? rec.owners[0] : null;
+  const owner = rec.owner_name ?? owner0?.name ?? null;
+  const classes = normalizeClasses(rec);
+  const filed = toIso(rec.filing_date);
   return {
     record_id: rec.id ? makeRef(rec.jurisdiction_code || rec.office_code, rec.id) : null,
     id: rec.id,
@@ -289,9 +309,13 @@ function normalizeSearchRow(rec) {
     mark_text: rec.mark_text ?? null,
     status: pickStatusText(rec),
     status_class: statusClassOf(rec),
-    nice_classes: normalizeClasses(rec),
-    owner: rec.owner_name ?? null,
-    filing_date: toIso(rec.filing_date),
+    nice_classes: classes,
+    classes,
+    owner,
+    owner_name: owner,
+    owner_country: owner0?.country_code ?? owner0?.country ?? null,
+    filing_date: filed,
+    application_date: filed,
     registration_date: toIso(rec.registration_date),
     relevance_score: Number.isInteger(rec.relevance_score) ? rec.relevance_score : null,
     raw: rec,
@@ -312,9 +336,9 @@ export function isSearchResponseBody(body) {
 // ── THE TOTAL, AND THE ONE CASE WHERE THE VENDOR'S NUMBER IS NOT A COUNT ───────────────────────────
 //
 // `options.include_total` returns `pagination.total_count` AND `pagination.total_count_approximate`.
-// Across nine queries every narrow band answers exact (685, 220, 363, 830, 2047,
-// 21, 101, 18) and — the case that matters — an empty band answered `total_count: 0, approximate:
-// false`, an EXACT zero, which is the only kind this repository is allowed to render.
+// Every narrow band answers an exact total and — the case that matters — an empty band answers
+// `total_count: 0, approximate: false`, an EXACT zero, which is the only kind this repository is
+// allowed to render.
 //
 // An approximate total of exactly 10000 is a saturation marker rather than an estimate.
 // The vendor is saying "at least ten thousand", and it says so on the broad sweeps (a bare owner
@@ -419,8 +443,16 @@ function loadFixture(name) {
 // the roster unwidened, which is the direction to err in before an open-source cut. Hence a fallback
 // LIST rather than one hardcoded term.
 const DETERMINISTIC_FALLBACK_TERMS = ["nike", "swoosh"];
-function resolveSearchFixture({ query, strategies, match }) {
+function resolveSearchFixture({ query, strategies, match, owner }) {
   const q = String(query || "").toLowerCase();
+  // AN OWNER-ONLY SEARCH HAS NO QUERY, so every lookup below — which keys on the term — would miss and
+  // the mock would answer "no fixture for query=". That is not a harmless gap: it is the reason the
+  // owner-only path could not be driven offline, and a test that cannot reach `doSearch` gets closed by
+  // asserting the element predicate instead, which passes while the request gate still refuses.
+  if (!q && String(owner || "").trim()) {
+    const o = String(owner).trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+    return loadFixture(`signa-search-owner-${o}`) || loadFixture("signa-search-owner");
+  }
   const det = typeof match === "string" ? match.trim() : "";
   if (det) {
     return loadFixture(`signa-search-match-${det}-${q}`)
@@ -432,16 +464,54 @@ function resolveSearchFixture({ query, strategies, match }) {
   return null;
 }
 
+// ── WHAT COUNTS AS SOMETHING TO SEARCH ────────────────────────────────────────────────────────────
+//
+// THE DEFECT THIS CLOSES. Two gates decided whether a plan entry had anything to search, and both
+// answered on a free-text query or a names list alone. Neither counted an OWNER. An owner portfolio
+// sweep carries an owner and no query by definition — that is what the shape is — so every one was
+// refused before it was ever dispatched: `doSearch` returned "query is required", and the kernel's
+// element gate returned the enumerate contract's missing-element error without calling the provider.
+// The run continued and disclosed the slices as unsearched, so nothing failed and a client's report
+// said the incumbent portfolios "could not be reached" when nothing had asked for them.
+//
+// It was never a capability gap. `buildFilters` already maps `owner` to this vendor's owner filter and
+// its note names the three populations — term alone, OWNER ALONE, both — as genuinely different from
+// each other. `ownerWindowCeiling` exists solely to cap paging for owner-scoped searches, which is not
+// something written for a shape that cannot be dispatched, and it defers to `isOwnerScoped`, the
+// KERNEL's own predicate, whose note names a bare-owner sweep as one of the two shapes it serves.
+// Only the two element gates were never taught that an owner is an element.
+//
+// ONE DEFINITION, because this file already carries the lesson: `buildFilters` exists because two
+// hand-written copies of the same object let one of them be wrong for two months. Two hand-written
+// copies of "does this carry an element" would drift the same way, and the drift would be silent in
+// the same direction — a shape one gate admits and the other refuses reads as a provider error.
+export const hasSearchElement = (p) => Boolean(
+  String(p?.query ?? "").trim()
+  || (Array.isArray(p?.names) && p.names.filter(Boolean).length)
+  || (typeof p?.owner === "string" && p.owner.trim()));
+
+/**
+ * What this request was FOR, for a log line and an error message. An owner-only search has no query,
+ * and "query=undefined" in a refusal is how a reader concludes the caller forgot one.
+ */
+export const searchTargetLabel = (p = {}) => (String(p.query ?? "").trim()
+  ? `query=${p.query}`
+  : (typeof p.owner === "string" && p.owner.trim() ? `owner=${p.owner.trim()}` : "no element"));
+
+/** The refusal, naming every element that would have been accepted. */
+export const MISSING_ELEMENT_ERROR = "ERROR: signa_enumerate — a query, names[] or owner is required.";
+
 // ── Search ─────────────────────────────────────────────────────────────────────────────────────────
 export async function doSearch(apiKey, base, params, tctx, { mock = false } = {}) {
-  if (!params.query) return { type: "text", text: "ERROR: query is required." };
+  // Refuses only when there is NOTHING to search. An owner alone is a search (see hasSearchElement).
+  if (!hasSearchElement(params)) return { type: "text", text: MISSING_ELEMENT_ERROR };
   if (mock) {
     const fx = resolveSearchFixture(params);
-    if (!fx) return { type: "text", text: `ERROR (mock): no fixture for query=${params.query} strategy=${(params.strategies || ["exact"])[0]}` };
+    if (!fx) return { type: "text", text: `ERROR (mock): no fixture for ${searchTargetLabel(params)} strategy=${(params.strategies || ["exact"])[0]}` };
     return { type: "text", text: JSON.stringify({ mock: true, ...normalizeSearchResponse(fx, params.query) }, null, 2) };
   }
   const body = buildSearchRequest(params);
-  const r = await signaFetch(apiKey, base, "/v1/trademarks", { method: "POST", body, tctx: { ...tctx, target: String(params.query).slice(0, 120) } });
+  const r = await signaFetch(apiKey, base, "/v1/trademarks", { method: "POST", body, tctx: { ...tctx, target: searchTargetLabel(params).slice(0, 120) } });
   if (!r.ok) {
     const msg = r.body?.error?.detail ?? r.body?.message ?? (r.raw ? r.raw.slice(0, 200) : "");
     return { type: "text", text: `ERROR: signa_search HTTP ${r.status}: ${msg}` };
@@ -451,11 +521,11 @@ export async function doSearch(apiKey, base, params, tctx, { mock = false } = {}
   // in exactly this case there is no second net. An unparsed 200 was the shortest path in the codebase
   // from a cut connection to `state:"enumerated"` with zero records. The guard is unchanged; its reason
   // is corrected — it used to rest on this provider having no count at all, which retired.
-  if (r.parseError) return { type: "text", text: unparsedBodyError("signa_search", r, ` query=${String(params.query).slice(0, 120)}`) };
+  if (r.parseError) return { type: "text", text: unparsedBodyError("signa_search", r, ` ${searchTargetLabel(params).slice(0, 120)}`) };
   // Parsing is not answering: a 200 carrying an error envelope is the same shortest path one JSON
   // envelope away — no data[], zero rows, the loop ends, enumerated. See isSearchResponseBody.
   if (!isSearchResponseBody(r.body)) {
-    return { type: "text", text: nonAnswerBodyError("signa_search", r, "a search response (no data[] — the key every /v1/trademarks answer carries)", ` query=${String(params.query).slice(0, 120)}`) };
+    return { type: "text", text: nonAnswerBodyError("signa_search", r, "a search response (no data[] — the key every /v1/trademarks answer carries)", ` ${searchTargetLabel(params).slice(0, 120)}`) };
   }
   return { type: "text", text: JSON.stringify(normalizeSearchResponse(r.body, params.query), null, 2) };
 }
@@ -528,14 +598,14 @@ export function toSignaParams(p = {}) {
   // in the French register, and was never searched.
   //
   // `filters.jurisdictions` + `territory_match: "protection"` asks the territory question instead:
-  // every right with effect there, whatever register it sits on. Same term:
-  //
-  //   filters.offices: ["inpi-fr"]                        national 6898, regional 0,     madrid 0
-  //   filters.jurisdictions: ["FR"], protection           national 6898, regional 10000+, madrid 2708
+  // every right with effect there, whatever register it sits on. On the same term, an office-scoped
+  // France search returns the national register and NOTHING else — no EU right, no Madrid leg — while
+  // the protection-scoped one returns the national rows unchanged plus both of the layers the first
+  // never saw.
   //
-  // and the control that shows `protection` adds a layer rather than merely more rows: Switzerland,
-  // under no regional register, returns regional 0 either way while its madrid layer arrives all the
-  // same. Every one of the eleven covered territories reaches its Madrid layer this way; the EU
+  // and the control that shows `protection` adds a LAYER rather than merely more rows: a territory
+  // under no regional register gains no regional rows either way, while its Madrid layer arrives all
+  // the same. Every one of the eleven covered territories reaches its Madrid layer this way; the EU
   // members additionally reach the EU register.
   //
   // IT IS ONE CALL, NOT THREE. No extra queries, no extra spend — which is why this half of Stage 2
@@ -552,7 +622,7 @@ export function toSignaParams(p = {}) {
   // caller that translates before handing params in — the shape a probe or a driver adapter naturally
   // takes — gets it applied twice. On the second pass `regions` is still present, so an earlier draft
   // re-added `offices` beside the `jurisdictions` it had just produced. The API accepts both and the
-  // office filter WINS: a France order went back to 19 national rows from 101, with `territory_match:
+  // office filter WINS: a France order went back to the national rows alone, with `territory_match:
   // "protection"` sitting in the body doing nothing. The expansion silently undid itself and the run
   // reported `state: "enumerated"` either way. Caught by comparing before/after on a live call and
   // finding them identical — the one check that could see it.
@@ -662,9 +732,9 @@ export function toSignaParams(p = {}) {
 /**
  * THE ONE QUERY SHAPE WITH A NARROWER RESULT WINDOW.
  *
- * `filters.owner_name` caps paging at 400 ROWS on this vendor; nothing else does. Same term,
- * same term and limit: `exact` exhausted at 685, `contains` at 2047, and the owner-scoped one stopped
- * dead — "This cursor points beyond the 400 result pagination window."
+ * `filters.owner_name` caps paging at 400 ROWS on this vendor; nothing else does. On one term at one
+ * limit, both unscoped predicates paged to exhaustion and the owner-scoped one stopped dead at the
+ * window, which the vendor's own cursor refusal names.
  *
  * `null` for every other shape, and that is the load-bearing half. Returning 400 across the board would
  * turn every tractable band over 400 into a sanctioned crowd — an UNDER-SEARCH wearing a crowd
@@ -684,8 +754,10 @@ const { enumerate: __enumerate } = makeEnumerate({
   // own count/search reconciliation exists to adjudicate on the "endpoint" seam. One source, one
   // number. (`makeCountProbe` throws unless "endpoint" supplies one, so this is asserted, not assumed.)
   count: null,
-  hasAnyElement: (p) => Boolean(String(p?.query ?? "").trim() || (Array.isArray(p?.names) && p.names.length)),
-  missingElementError: "ERROR: signa_enumerate — a query (or names[]) is required.",
+  // The SAME predicate `doSearch` uses, not a second copy of it. An owner is an element here: see
+  // hasSearchElement for the defect this closes and why one definition rather than two.
+  hasAnyElement: hasSearchElement,
+  missingElementError: MISSING_ELEMENT_ERROR,
   capabilities: { ...CAPABILITIES.kernel },
   ceilingFor: ownerWindowCeiling,
   // The kernel's default cheap-probe params are CORSEARCH'S — `{limit:1, fields:["uri"]}` — and `uri`
@@ -807,6 +879,11 @@ export async function doCountHits(apiKey, base, params, tctx, { mock = false } =
     text: JSON.stringify({
       total_hits: exact ? parsed.total_hits : null,
       total_approximate: parsed.total_approximate === true,
+      // THE FLOOR TRAVELS AS DATA, not only inside the note below. The normalizer already keeps it —
+      // `total_floor` on the parsed body — and it was reaching the driver in prose only, so the one
+      // number that makes a saturated band answerable had to be read back out of a sentence to be used.
+      // A reader that parses it out of the note is a reader that breaks when the note is reworded.
+      total_floor: Number.isFinite(parsed.total_floor) ? parsed.total_floor : null,
       present: exact ? parsed.total_hits > 0 : ((parsed.results?.length ?? 0) > 0 || parsed.has_more === true),
       seen: parsed.results?.length ?? 0,
       note: exact

package/providers/uspto-local/README.md

@@ -155,7 +155,7 @@ what an index actually holds, including whether the 1884 backfile is in it (a da
 identical on every other number and is missing a century).
 
 This replaces only the *register* half of a clearance
-— the reasoning engine still needs its own subscription or API key, and the unregistered-use half
+— the reasoning engine still needs its own subscription, API key or cloud account, and the unregistered-use half
 still wants `PERPLEXITY_API_KEY`.
 
 **It refuses rather than answering zero.** An absent index, a schema with no rows, or an index whose

package/providers/uspto-local/src/sync.js

@@ -4,7 +4,7 @@
 //
 // ── THE CONTRACT, AND HOW MUCH OF IT IS VERIFIED ─────────────────────────────────────────────────
 // The endpoints, the auth header and the product id below are NOT inherited by analogy from another
-// provider (see skills/prelim-register/providers/README.md on why that rule exists). They come from
+// provider (see skills/clearance-register/providers/README.md on why that rule exists). They come from
 // USPTO's own OpenAPI description of the Open Data Portal, cross-checked against live probes from this
 // machine:
 //

package/scripts/README.md

@@ -20,6 +20,7 @@ The axis is *what the script assumes exists*, not where it happens to be run.
 | `report-print-check.mjs` | Shows what the exported PDF actually renders under print media. Run by CI. |
 | `report-overflow-check.mjs` | The same two report lanes SIDEWAYS, under screen media — the print check cannot see a width, because print sets the watermark to `display:none` and the watermark was the overflow. Run by CI. |
 | `portal-lifecycle-check.mjs` | Asks whether the portal names a brand owner and whether a person can manage their searches. Run by CI. |
+| `portal-strings.mjs` | Reads every string the portal can show out of its source, as a reader meets it. `--check <approved list>` refuses a string on a screen that is neither approved nor in `portal-ui/strings-backlog.json`; `--backlog-shrinks --base <ref>` refuses a backlog line the base did not have. The approved list is kept with the designs, outside this repository. CI runs the backlog half. |
 | `validate-profiles.mjs` | Validates a customer-config store's profile bundles. Read-only. |
 | `record-carry-probe.mjs` | Traces retrieval → findings over any finished run dir. Read-only. |
 | `placement-diff.mjs` | Shows what the placement tier did between two runs of one matter. |