clearotron 0.3.2 → 0.3.3-beta.0

package/driver/crowd-context.mjs

@@ -36,6 +36,7 @@
 // and the axis bands are never touched — this pass mutates no existing artifact.
 
 import { NON_MATERIAL_AXES } from "./coverage-ledger.mjs";
+import { containsFormSubstitution } from "./register-plan.mjs";
 
 // ── caps — these bound SPEND, never sufficiency ─────────────────────────────────────────────────────
 // Each cap limits how many provider calls / how many fetched records one evidence pass may buy. They
@@ -180,14 +181,22 @@ export function selectCrowdSlices(ledgerRows, planContext = {}) {
 // the counts describe the SAME crowd the ledger row is about. An owner-scoped slice carries its
 // `owner` onto EVERY minted entry for the same reason — un-owned counts would describe the wider
 // formative crowd while claiming to describe the owner's slice.
-export function mintSliceCountEntries(slice, i, { maxTerms = CROWD_MAX_TERMS_PER_SLICE } = {}) {
+//
+// A TERM SHORTER THAN THE REGISTER'S CONTAINS FLOOR is counted on the exact form instead, the same
+// rule the frozen plan's goods-narrowed questions and saturation probes follow: a register that
+// refuses the contains form for a term that short answers no count at all, so the crowd this pass
+// exists to describe would read "count unavailable". Same classes, same two counts per term, and the
+// entry carries `contains_substituted` so the figure is never taken for a containing count.
+export function mintSliceCountEntries(slice, i, { maxTerms = CROWD_MAX_TERMS_PER_SLICE, capabilities = null } = {}) {
   const terms = slice.terms.slice(0, maxTerms);
   const base = { axis: CROWD_CONTEXT_AXIS, regions: slice.regions ?? [], expected_kind: "count",
     ...(typeof slice.owner === "string" && slice.owner ? { owner: slice.owner } : {}) };
   const out = [];
   terms.forEach((t, j) => {
-    out.push({ ...base, qid: `crowdctx:s${i}-t${j}-${slug(t)}-all`, predicate: "default", term: t, nice_classes: [] });
-    out.push({ ...base, qid: `crowdctx:s${i}-t${j}-${slug(t)}-cls`, predicate: "default", term: t, nice_classes: slice.nice_classes ?? [] });
+    const sub = containsFormSubstitution(t, capabilities);
+    const form = sub ? { predicate: "exact", contains_substituted: sub } : { predicate: "default" };
+    out.push({ ...base, qid: `crowdctx:s${i}-t${j}-${slug(t)}-all`, ...form, term: t, nice_classes: [] });
+    out.push({ ...base, qid: `crowdctx:s${i}-t${j}-${slug(t)}-cls`, ...form, term: t, nice_classes: slice.nice_classes ?? [] });
   });
   out.push({
     ...base, qid: `crowdctx:s${i}-exact-count`, predicate: "exact",
@@ -325,10 +334,12 @@ const compactRecord = (r) => ({
  * @param opts.executor     INJECTED: async (entries) => band blocks (tests stub it; the pipeline passes
  *                          the planExec-lane adapter). Null/absent ⇒ no lane ⇒ null (logged, non-fatal).
  * @param opts.caps         { maxSlices?, maxTermsPerSlice?, enumCap? } — spend bounds only.
+ * @param opts.capabilities the active register's declared capabilities, read for the contains floor
+ *                          only (containsMinLength). Absent ⇒ every term is counted on the contains form.
  * @param opts.note / opts.log  observability hooks (default no-ops; pipeline wires note()/runLog).
  * @returns { json, md, stats } | null
  */
-export async function buildCrowdContext({ ledger, planContext = {}, executor, caps = {}, note = () => {}, log = () => {} } = {}) {
+export async function buildCrowdContext({ ledger, planContext = {}, executor, caps = {}, capabilities = null, note = () => {}, log = () => {} } = {}) {
   const maxSlices = caps.maxSlices ?? CROWD_MAX_SLICES;
   const maxTermsPerSlice = caps.maxTermsPerSlice ?? CROWD_MAX_TERMS_PER_SLICE;
   const enumCap = caps.enumCap ?? CROWD_ENUM_CAP;
@@ -344,7 +355,7 @@ export async function buildCrowdContext({ ledger, planContext = {}, executor, ca
   if (selected.length > slices.length) note(`crowd-context: ${selected.length} qualifying slice(s), gathering the first ${slices.length} (spend cap — the rest keep their ledger disclosure unchanged)`);
   try {
     // ── phase 1: one batched executor call for every count probe ─────────────────────────────────
-    const countEntries = slices.flatMap((s, i) => mintSliceCountEntries(s, i, { maxTerms: maxTermsPerSlice }));
+    const countEntries = slices.flatMap((s, i) => mintSliceCountEntries(s, i, { maxTerms: maxTermsPerSlice, capabilities }));
     const byQid = new Map((await executor(countEntries) ?? []).filter((b) => b && b.qid).map((b) => [b.qid, b]));
     // ── phase 2: enumerate each exact subset the count proved tractable (0 < hits ≤ cap) ─────────
     // A verified-zero count needs no call (enumerating an empty subset returns the empty subset);
@@ -366,7 +377,9 @@ export async function buildCrowdContext({ ledger, planContext = {}, executor, ca
         const all = byQid.get(`crowdctx:s${i}-t${j}-${slug(t)}-all`);
         const cls = byQid.get(`crowdctx:s${i}-t${j}-${slug(t)}-cls`);
         const bad = !all || all.error || !cls || cls.error;
-        return { term: t, all_classes: Number(all?.total_hits) || 0, in_scope: Number(cls?.total_hits) || 0, ...(bad ? { error: true } : {}) };
+        const sub = containsFormSubstitution(t, capabilities);
+        return { term: t, all_classes: Number(all?.total_hits) || 0, in_scope: Number(cls?.total_hits) || 0,
+          ...(bad ? { error: true } : {}), ...(sub ? { contains_substituted: sub } : {}) };
       });
       const c = byQid.get(`crowdctx:s${i}-exact-count`);
       const hits = Number(c?.total_hits) || 0;

package/driver/drainer-identity.mjs

@@ -190,7 +190,7 @@ export function drainerVerdict({ stamp, headCommit, isAlive, processes, ppidOf =
   }
 
   if (!head) {
-    return { state: "fail", message: `drainer pid ${pid} is alive on ${short(held)}${via}, but the checkout's own HEAD `
+    return { state: "skip", blocked: true, message: `drainer pid ${pid} is alive on ${short(held)}${via}, but the checkout's own HEAD `
       + `could not be read, so the two could not be compared.${strayNote}` };
   }
 

package/driver/engine/mcp/clarivate-server.mjs

@@ -33,6 +33,7 @@ import {
   CAPABILITIES, doSearch, doRecordFetch, doImageFetch, doBatchScreen, doEnumerate, doExecutePlan, DEFAULT_BASE,
 } from "../../../providers/clarivate/src/core.js";
 import { proposeSupplemental } from "./supplemental.mjs";
+import { narrowingFields } from "./proposal-fields.mjs";
 
 const API_KEY = process.env.CLARIVATE_API_KEY || "";
 const BASE = process.env.CLARIVATE_API_BASE || DEFAULT_BASE;
@@ -136,8 +137,9 @@ serve({
           romanization: { type: "string", description: "The Latin-script form of a NON-LATIN term — plain ASCII letters/digits, syllable-separated by single spaces, no tone marks or diacritics (华威豹 → \"HUA WEI BAO\", ティキスラッシュ → \"TIKI SURASSHU\"). MANDATORY beside a non-Latin term: without it this register cannot answer the characters and the slice defers. Single-term proposals only (never an OR-stack, never predicate:owner), and never on a term that is already Latin." },
           owner: { type: "string", description: "OPTIONAL owner scope field on a MARK-TEXT proposal: the query is the owner×term intersection (the owner's filings within the term band). Not allowed on predicate:owner (there the owner name IS the term)." },
           nice_classes: { type: "array", items: {} },
-          regions: { type: "array", items: { type: "string" },
-            description: "OPTIONAL. Omit to inherit the frozen plan's regions (the matter's territorial scope) — this provider REQUIRES at least one office on every request, so an omitted list is backfilled from the plan, never treated as a worldwide sweep. Supply it only to search a NARROWER set than the matter's scope." },
+          // The narrowing fields every register serves (proposal-fields.mjs); this register's two facts ride in.
+          ...narrowingFields({ regions: "OPTIONAL. Omit to inherit the frozen plan's regions (the matter's territorial scope) — this provider REQUIRES at least one office on every request, so an omitted list is backfilled from the plan, never treated as a worldwide sweep. Supply it only to search a NARROWER set than the matter's scope.",
+            goodsNote: "One office in this provider's vocabulary refuses the field and fails the whole call, so it is left out of that office's request and recorded as asked-without-goods rather than dropped in silence." }),
           rationale: { type: "string" },
           term_literal: { type: "boolean", description: "TRUE only when the term genuinely IS the mark verbatim (a multi-word slogan mark, a mark carrying an anchored star) — it bypasses the term-shape lint. Never use it to push a label through." },
         } } },

package/driver/engine/mcp/corsearch-server.mjs

@@ -9,6 +9,7 @@
 import { serve } from "./stdio-server.mjs";
 import { CAPABILITIES, doSearch, doRecordFetch, doImageFetch, doExpandPhoneme, doBatchScreen, doEnumerate, doExecutePlan } from "../../../providers/corsearch/src/core.js";
 import { proposeSupplemental } from "./supplemental.mjs";
+import { narrowingFields } from "./proposal-fields.mjs";
 
 const COOKIE = process.env.CORSEARCH_SESSION_KEY || "";
 const tctx = (kind) => ({
@@ -118,7 +119,8 @@ serve({
           term: { type: "string" }, terms: { type: "array", items: { type: "string" } },
           romanization: { type: "string", description: "OPTIONAL on this provider (its index holds the characters and answers them directly), but STATE IT anyway for a non-Latin term — the plan is provider-neutral and the entry carries both forms for whichever register expresses it. Latin-script form only: plain ASCII letters/digits, syllable-separated by single spaces, no tone marks or diacritics. Single-term proposals only; never on an already-Latin term." },
           owner: { type: "string", description: "OPTIONAL owner scope field on a MARK-TEXT proposal: the query is the owner×term intersection (the owner's filings within the term band). Not allowed on predicate:owner (there the owner name IS the term)." },
-          nice_classes: { type: "array", items: {} }, regions: { type: "array", items: { type: "string" }, description: "UPPERCASE 2-letter region codes, e.g. ['US','EU','CH'] — never spelled-out names (recognized display names are normalized; unknown values are rejected)" },
+          nice_classes: { type: "array", items: {} },
+          ...narrowingFields(),   // the narrowing fields every register serves (proposal-fields.mjs)
           rationale: { type: "string" },
           term_literal: { type: "boolean", description: "TRUE only when the term genuinely IS the mark verbatim (a multi-word slogan mark, a mark carrying an anchored star) — it bypasses the term-shape lint. Never use it to push a label through." },
         } } },

package/driver/engine/mcp/coverage-server.mjs

@@ -55,7 +55,7 @@ serve({
         description: `Up to ${MAX_ROWS_PER_CALL} rows per call. Send more in a further call; the answer tells you what is left.`,
         items: { type: "object", properties: {
           row_id: { type: "string", description: "A driver row's id, exactly as the dispatch's obligations block lists it. Omit on a seat row you are adding — the driver mints seat row ids." },
-          status: { type: "string", description: "EXACTLY one bare token of confirmed-clean / coverage-limited / deferred. Qualifiers go in the reason." },
+          status: { type: "string", description: "EXACTLY one bare token of confirmed-clean / coverage-limited / deferred / withheld-by-judgment. Qualifiers go in the reason." },
           reason: { type: "string", description: "The sentence the lawyer reads — say what was searched and what was not, in a lawyer's words, never the engine's." },
           kind: { type: "string", description: "\"seat\" on a row you add for a coverage unit the plan does not contain. Never anything else." },
           axis: { type: "string", description: "Seat rows only: EXACTLY one bare token of the closed register-axis vocabulary the dispatch lists." },

package/driver/engine/mcp/dispositions-server.mjs

@@ -56,6 +56,9 @@ import { validateGridSpec } from "../../../providers/perplexity/src/core.js";
 // the disk work and disposition-call.mjs owns the decision. One direction of import, no second opinion.
 import { recordDispositions } from "../../disposition-tool.mjs";
 import { MAX_ROWS_PER_CALL } from "../../disposition-call.mjs";
+// The lane's second statement, and a different one: which coverage units were searched to what end. Its
+// own module and its own file, never a row in the disposition form — see record_coverage_status below.
+import { recordCoverageStatus, COMMON_LAW_COVERAGE_STATUSES } from "../../common-law-coverage-status.mjs";
 
 // ── B — THE TYPED DISPOSITION TRANSPORT ─────────────────────────────────────────────────────────────
 //
@@ -68,15 +71,21 @@ import { MAX_ROWS_PER_CALL } from "../../disposition-call.mjs";
 // THE SPEC PATH IS THE SEAT'S ONLY PATH ARGUMENT, and it is the same driver-written file the grid tool
 // was given. That rule: the path is the DRIVER'S, taken from the spec it wrote. Two derivations of one
 // filename is the drift that cost weeks.
-async function record_dispositions(params) {
-  const { grid_spec_path, rows } = params ?? {};
+function specFrom(params) {
+  const { grid_spec_path } = params ?? {};
   if (!grid_spec_path)
-    return { isError: true, text: "ERROR: grid_spec_path is required — it is the same driver-written spec path the grid tool was given. Do not compose a path." };
+    return { error: "ERROR: grid_spec_path is required — it is the same driver-written spec path the grid tool was given. Do not compose a path." };
   let spec;
   try { spec = validateGridSpec(JSON.parse(readFileSync(grid_spec_path, "utf8"))); }
-  catch (err) { return { isError: true, text: `ERROR: grid_spec_path unreadable/invalid (${err.message}). The driver writes this file; do not hand-author it.` }; }
+  catch (err) { return { error: `ERROR: grid_spec_path unreadable/invalid (${err.message}). The driver writes this file; do not hand-author it.` }; }
   if (!/\/studio\/(?:prelim|clearance)-search\//.test(spec.output_path))   // either spelling: an install keeps the studio segment it has
-    return { isError: true, text: `ERROR: grid spec.output_path must be within a studio/clearance-search run dir; got ${spec.output_path}` };
+    return { error: `ERROR: grid spec.output_path must be within a studio/clearance-search run dir; got ${spec.output_path}` };
+  return { spec };
+}
+
+async function record_dispositions(params) {
+  const { spec, error } = specFrom(params);
+  if (error) return { isError: true, text: error };
   // NEVER THROWN PAST THIS POINT. An exception surfaces to the seat as a tool error naming no row, which
   // tells it nothing about what to fix — the failure mode this transport exists to end.
   try {
@@ -97,6 +106,23 @@ async function record_dispositions(params) {
   }
 }
 
+// ── THE COVERAGE STATUS, THE LANE'S SECOND TOOL ON ITS OWN KEY ───────────────────────────────────────
+//
+// A sibling of record_dispositions, not a field on it. A meaning ruling is addressed by an obligation's
+// number; a coverage status by a coverage unit. `record_coverage` and `record_register_digest` stay two
+// tools for the same reason. The key is still granted by exactly one lane's group list, so no other seat
+// gains a writer. Both tools resolve the spec through specFrom() above, one resolution for both.
+async function record_coverage_status(params) {
+  const { spec, error } = specFrom(params);
+  if (error) return { isError: true, text: error };
+  try {
+    const r = recordCoverageStatus(spec, params);
+    return { isError: !r.ok, text: r.text };
+  } catch (e) {
+    return { isError: true, text: `ERROR: the driver could not record this call (${String(e?.message ?? e).slice(0, 200)}). This is a driver fault, not a fault in your statuses — do not re-type them.` };
+  }
+}
+
 serve({
   name: "dispositions", version: "0.1.0",
   tools: [{
@@ -135,5 +161,21 @@ serve({
     } },
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
     handler: record_dispositions,
+  }, {
+    name: "record_coverage_status",
+    description: "Record the status of each row of your coverage ledger. Send VALUES, not a file: one entry per ledger row, and the driver writes the record. Entries that validate are kept even when others in the same call are refused, and a later entry for the same unit replaces the earlier one.",
+    inputSchema: { type: "object", required: ["grid_spec_path", "rows"], properties: {
+      grid_spec_path: { type: "string", description: "Absolute path to the driver-written grid spec — the same one the grid tool was given." },
+      rows: {
+        type: "array",
+        description: "One entry per coverage ledger row.",
+        items: { type: "object", required: ["unit", "status"], properties: {
+          unit: { type: "string", description: "The coverage unit, exactly as your ledger row names it." },
+          status: { type: "string", enum: [...COMMON_LAW_COVERAGE_STATUSES], description: `EXACTLY one bare token of ${COMMON_LAW_COVERAGE_STATUSES.join(" / ")}. Qualifiers go in the ledger row.` },
+        } },
+      },
+    } },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    handler: record_coverage_status,
   }],
 });

package/driver/engine/mcp/euipo-server.mjs

@@ -33,6 +33,7 @@ import {
   doEnumerate, doExecutePlan,
 } from "../../../providers/euipo/src/core.js";
 import { proposeSupplemental } from "./supplemental.mjs";
+import { narrowingFields } from "./proposal-fields.mjs";
 
 // The core resolves credentials from the environment; AUTH stays an object so a future knob (a pinned
 // environment, a second subscription) does not change every call site.
@@ -154,6 +155,7 @@ serve({
           romanization: { type: "string", description: "The Latin-script form of a NON-LATIN term. On THIS source it is NOT used to rescue the slice — nativeScriptIndex is true, so the characters are sent as themselves and the romanisation is carried for the reader only." },
           owner: { type: "string", description: "OPTIONAL owner scope field on a MARK-TEXT proposal: the owner×term intersection. Not allowed on predicate:owner (there the owner name IS the term)." },
           nice_classes: { type: "array", items: {} },
+          ...narrowingFields(),   // the narrowing fields every register serves (proposal-fields.mjs)
           rationale: { type: "string" },
           term_literal: { type: "boolean", description: "TRUE only when the term genuinely IS the mark verbatim (a multi-word slogan mark, a mark carrying an anchored star) — it bypasses the term-shape lint. Never use it to push a label through." },
         } } },

package/driver/engine/mcp/free-tier-server.mjs

@@ -34,6 +34,7 @@ import {
   CAPABILITIES, doSearch, doRecordFetch, doBatchScreen, doImageFetch, doEnumerate, doExecutePlan,
 } from "../../../providers/free-tier/src/core.js";
 import { proposeSupplemental } from "./supplemental.mjs";
+import { narrowingFields } from "./proposal-fields.mjs";
 
 // NULL, and it is not a placeholder. Each member core resolves its OWN credentials from the environment
 // — EUIPO its OAuth pair, the index its file path — so there is no single auth object a composite could
@@ -167,6 +168,7 @@ serve({
           romanization: { type: "string" },
           owner: { type: "string" },
           nice_classes: { type: "array", items: {} },
+          ...narrowingFields(),   // the narrowing fields every register serves (proposal-fields.mjs)
           rationale: { type: "string" },
           term_literal: { type: "boolean" },
         } } },

package/driver/engine/mcp/gather-config.mjs

@@ -678,7 +678,13 @@ const LOCAL = {
   // `mcp__dispositions__record_dispositions`). That is a real argv-surface change on four stages, so it
   // ships status:merged-awaiting-e2e — the byte pins in recording-grant-preservation.test.mjs move with
   // it and no live run has exercised the new name.
-  dispositions: { script: "dispositions-server.mjs", tools: ["record_dispositions"] },
+  //
+  // ── AND ITS SECOND TOOL, `record_coverage_status` — an allowlist growing by one token on an
+  // ALREADY-TOOLED key that exactly one lane holds, so no other seat gains a writer and no argv-surface
+  // transition fires. It is not a field on `record_dispositions`: a meaning ruling and a coverage status are
+  // two statements, addressed two ways, as `record_coverage` and `record_register_digest` are. Ordered by
+  // driver/skills/clearance-common-law/SKILL.md beside the coverage ledger.
+  dispositions: { script: "dispositions-server.mjs", tools: ["record_dispositions", "record_coverage_status"] },
   // ── UNIT-NOTE: the register unit's audit note, and the first own-key transport that MOVES an artifact ─
   //
   // `coverage`'s and `declination`'s shape, chosen for a reason those two did not have. Those stages keep
@@ -700,7 +706,7 @@ const LOCAL = {
   // ONE TOOL ON ITS OWN KEY, not on `register` — that key is the funnel's and a record tool added to it
   // would be enumerated into every register-unit seat's grant AND every other holder's. Same rule the
   // three entries above follow.
-  "unit-note": { script: "unit-note-server.mjs", tools: ["record_unit_note"] },
+  "unit-note": { script: "unit-note-server.mjs", tools: ["record_unit_note", "record_withheld_families"] },
   // ── RECORDING — DERIVED from the registry above, one entry per stage, in registry order ──────────
   //
   // These rows were hand-written here until the collapse. They are LAST in this object on purpose:

package/driver/engine/mcp/probe-server.mjs

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+// engine/mcp/probe-server.mjs — the one tool the engine probe asks the engine to call.
+//
+// A turn with no tools proves the credential and the model, and nothing about whether the engine can use
+// the tools every search stage is given. On some hosts codex's own sandbox refuses every tool call while
+// the turn reports success, and a probe with no tool passed there. So the probe hands the engine this
+// server, asks it to call `ping` once, and passes only when the reply carries what `ping` returned.
+//
+// WHAT IT RETURNS IS THE PROOF. Its one argument is a random word the probe mints for each
+// turn and gives only to this process, so a reply that carries it cannot be the model guessing. Read-only;
+// it touches no file, no network and no run.
+import { serve } from "./stdio-server.mjs";
+
+serve({
+  name: "probe", version: "0.1.0",
+  tools: [{
+    name: "ping",
+    description: "Return the word this check is waiting for.",
+    inputSchema: { type: "object", properties: {}, additionalProperties: false },
+    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    handler: async () => {
+      const word = String(process.argv[2] ?? "").trim();
+      return word ? word : { isError: true, text: "ping: this server was started without a word to return" };
+    },
+  }],
+});

package/driver/engine/mcp/proposal-fields.mjs

@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+// proposal-fields.mjs — the narrowing fields of `register_propose_supplemental`, ONE definition for every
+// register's server.
+//
+// The reading turn narrows a crowded identical question through this tool: by goods words, by market
+// (`regions`), and it names the crowd it replaces (`narrows`). The shared mint (supplemental.mjs) has
+// handled all three for every register, but only the Clarivate server declared them, and Corsearch
+// declared `regions` alone. A model reads the schema it is served, so on Signa the reading turn could
+// narrow only by class. The product is register-agnostic: every server now spreads these same
+// properties into its proposal schema, and what differs by register is a capability fact the server
+// passes in, never a missing field.
+//
+// The words are the shipped words, moved rather than rewritten: the goods and `narrows` text is what the
+// Clarivate server already served, and each server keeps the `regions` sentence it (or its sibling
+// register) already carried. A register that cannot search goods text, or cannot offer alternatives in
+// one goods clause, is handled in the mint, the same way the compiler handles it.
+
+const GOODS_WORDS = "OPTIONAL goods narrowing on a MARK-TEXT proposal: the same question, limited to filings whose "
+  + "goods and services description carries one of these words. This is the FIRST move when the identical mark comes "
+  + "back as a count instead of a list — the words are the ones the variants stage already wrote for this matter, the "
+  + "client's own wording plus the synonyms. Single words or short phrases as a specification would write them, no "
+  + "wildcards. Not allowed on predicate:owner.";
+
+const NARROWS = "OPTIONAL: the qid of the CROWDED question this proposal replaces. Put it on a narrowing — the same "
+  + "question limited by goods, by market, by the dominant word or to one class — so the record shows the crowd and the "
+  + "question that answered it side by side, each with its own count. A narrowing that does not name what it replaced "
+  + "leaves the crowd looking unanswered.";
+
+/** The `regions` sentence a register whose requests need no office carries (shipped on Corsearch). */
+export const REGIONS_CODES = "UPPERCASE 2-letter region codes, e.g. ['US','EU','CH'] — never spelled-out names "
+  + "(recognized display names are normalized; unknown values are rejected)";
+
+/**
+ * The three narrowing properties, for a proposal item's `properties`.
+ * @param opts.regions   the register's `regions` description (REGIONS_CODES unless the register states more)
+ * @param opts.goodsNote a sentence appended to the goods description, for a register fact the model must know
+ */
+export function narrowingFields({ regions = REGIONS_CODES, goodsNote = "" } = {}) {
+  return {
+    goods_words: { type: "array", items: { type: "string" }, description: goodsNote ? `${GOODS_WORDS} ${goodsNote}` : GOODS_WORDS },
+    regions: { type: "array", items: { type: "string" }, description: regions },
+    narrows: { type: "string", description: NARROWS },
+  };
+}

package/driver/engine/mcp/recording-server.mjs

@@ -497,6 +497,19 @@ serve({
         },
         watchlist_owners: { type: "array", items: { type: "string" },
           description: "Real register owners the plan compiles owner lanes from — never sectors or descriptions." },
+        goods_words: { type: "array", items: { type: "string" },
+          description:
+            "The words the register search is narrowed to: the client's own goods and services wording " +
+            "first, then the words other filings use for the same goods that it does not already " +
+            "contain. Single words or short phrases as a specification would write them, no wildcards, " +
+            "at most 24. Each is matched against the goods and services description of registered " +
+            "marks, so use words a specification would contain; a word broader than the goods widens " +
+            "the search instead of narrowing it. The register cannot read the words and, or, not, adj " +
+            "or near inside an item — an item containing one is searched without it. Send an EMPTY " +
+            "LIST when you have considered the goods and no word is worth narrowing by; omit the " +
+            "field only when the matter states no goods at all. Those are different answers and the " +
+            "run records which one you gave.",
+        },
         scope_ledger: {
           type: "array",
           description:
@@ -826,6 +839,23 @@ serve({
             },
           },
         },
+        // THE SAME DEFECT TWICE MORE, and the same fix. The dispatch asks for both of these in its own
+        // imperative, the acceptor validates and records them, and the plan compile reads the classes —
+        // and until now neither was a property here, so a frame following its schema could send neither.
+        // A real run's frame carried no added class although the goods reached one. Shape only: the
+        // dispatch already says what to send and why, so no sentence the model reads is added here.
+        identified_classes: {
+          type: "array",
+          items: {
+            type: "object",
+            required: ["class", "reason"],
+            properties: {
+              class: { type: "integer", minimum: 1, maximum: 45 },
+              reason: { type: "string" },
+            },
+          },
+        },
+        ratified_forms: { type: "array", items: { type: "string" } },
         // OFFERED HERE, OR NEVER SENT. The acceptor took this field for a beta and the plan acted on it,
         // and no frame ever proposed one, because the schema a model is given did not offer it. Worded as
         // the owner approved it; it is model-facing prose, so its wording is his.

package/driver/engine/mcp/signa-server.mjs

@@ -11,6 +11,7 @@
 import { serve } from "./stdio-server.mjs";
 import { doSearch, doRecordFetch, doEnumerate, doExecutePlan, DEFAULT_BASE } from "../../../providers/signa/src/core.js";
 import { proposeSupplemental } from "./supplemental.mjs";
+import { narrowingFields } from "./proposal-fields.mjs";
 import { CAPABILITIES } from "../../../providers/signa/src/capabilities.js";
 
 const API_KEY = process.env.SIGNA_API_KEY || "";
@@ -101,6 +102,7 @@ serve({
           romanization: { type: "string", description: "The Latin-script form of a NON-LATIN term. On THIS source it is NOT used to rescue the slice — nativeScriptIndex is true, so the characters are sent as themselves and the romanisation is carried for the reader only." },
           owner: { type: "string", description: "OPTIONAL owner scope field on a MARK-TEXT proposal: the owner×term intersection, served by filters.owner_name in the same request. Not allowed on predicate:owner (there the owner name IS the term)." },
           nice_classes: { type: "array", items: {} },
+          ...narrowingFields(),   // the narrowing fields every register serves (proposal-fields.mjs)
           rationale: { type: "string" },
           term_literal: { type: "boolean", description: "TRUE only when the term genuinely IS the mark verbatim (a multi-word slogan mark, a mark carrying an anchored star) — it bypasses the term-shape lint. Never use it to push a label through." },
         } } },

package/driver/engine/mcp/supplemental.mjs

@@ -30,7 +30,7 @@
 import { readFileSync, writeFileSync, renameSync, existsSync, mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { driverDir } from "../../../shared/driver-dir.mjs";   //
-import { PLAN_PREDICATES, PLAN_MAX_OR_WIDTH, PLAN_MAX_NAME_LENGTH, fingerprint, ownerIntersectionGap, resolveRegions, houseElementOf, withoutHouseElementTerms } from "../../register-plan.mjs";
+import { PLAN_PREDICATES, PLAN_MAX_OR_WIDTH, PLAN_MAX_NAME_LENGTH, fingerprint, ownerIntersectionGap, goodsTextGap, resolveRegions, houseElementOf, withoutHouseElementTerms, containsFormSubstitution } from "../../register-plan.mjs";
 import { entryTermIssues } from "../../../providers/_shared/term-shape.mjs";
 import { isNonLatinTerm, romanizationRefusal, romanizationSpellings, nativeScriptIndexGap } from "../../../providers/_shared/script-form.mjs";
 
@@ -64,13 +64,37 @@ export function mintSupplementalEntries(axis, proposals, { existingQids = new Se
   // first, non-priority ones keep their relative order behind them. The cap VALUES are unchanged
   // (no count threshold moves), and with no priorityClasses the order is byte-identical to before.
   const prio = new Set((priorityClasses ?? []).map((c) => String(c).trim()).filter(Boolean));
-  const indexed = (proposals ?? []).map((p, i) => ({ p: p ?? {}, i }));
+  // ONE QUESTION PER GOODS WORD where the register cannot offer alternatives in one goods clause — the
+  // compiler's own rule for such a register (register-plan.mjs, goodsTextListOr). Joined, the words would
+  // be intersected and the answer would narrow as the list grew; the connector refuses that shape
+  // outright. Each word keeps the proposal's index, so a refusal still names the proposal it came from.
+  const perWord = capabilities?.goodsTextSearch === true && capabilities?.goodsTextListOr === false;
+  // ONE QUESTION PER NAME where the register has no OR at all (maxOrWidth 1) — the compiler's own width
+  // for such a register. A batch of names went out as windows of one name each under ONE question, and
+  // the enumerate kernel stopped the whole batch at the first name that crowded or failed, so every name
+  // after it was never sent. Split, each name is its own question: its own count, its own crowd decision
+  // and its own receipt row. The names of one batch still spend ONE slot of the per-call and per-axis
+  // caps between them, as the batch did; `split_of` names the batch so the next call counts it once.
+  const perName = Number(capabilities?.maxOrWidth) === 1;
+  const indexed = (proposals ?? []).flatMap((p, i) => {
+    const names = perName && Array.isArray(p?.terms) ? p.terms.map((t) => String(t ?? "").trim()).filter(Boolean) : [];
+    const splitOf = names.length > 1 && names.length <= PLAN_MAX_OR_WIDTH
+      ? fingerprint({ axis, predicate: String(p?.predicate ?? "default"), names: [...names].sort(), i }) : null;
+    const byName = splitOf ? names.map((t) => { const { terms: _batch, ...rest } = p; return { ...rest, term: t }; }) : [p ?? {}];
+    return byName.flatMap((q) => {
+      const words = perWord && Array.isArray(q?.goods_words) ? q.goods_words.map((w) => String(w ?? "").trim()).filter(Boolean) : [];
+      return words.length > 1
+        ? words.map((w, k) => ({ p: { ...q, goods_words: [w] }, i, slot: `${i}:${k}`, splitOf }))
+        : [{ p: q, i, slot: `${i}:0`, splitOf }];
+    });
+  });
+  const slots = new Set();
   const ordered = prio.size
     ? [...indexed.filter(({ p }) => inPriority(p, prio)), ...indexed.filter(({ p }) => !inPriority(p, prio))]
     : indexed;
-  for (const { p, i } of ordered) {
+  for (const { p, i, slot, splitOf } of ordered) {
     const issue = (msg) => rejected.push({ index: i, issue: msg, proposal: compactProposal(p) });
-    if (minted.length >= perCall) { issue(`per-call cap ${perCall} reached`); continue; }
+    if (!slots.has(slot) && slots.size >= perCall) { issue(`per-call cap ${perCall} reached`); continue; }
     const predicate = String(p.predicate ?? "default");
     if (!PLAN_PREDICATES.includes(predicate)) { issue(`unknown predicate "${predicate.slice(0, 20)}" (one of: ${PLAN_PREDICATES.join(", ")})`); continue; }
     const terms = Array.isArray(p.terms) ? p.terms.map((t) => String(t ?? "").trim()).filter(Boolean) : null;
@@ -107,6 +131,15 @@ export function mintSupplementalEntries(axis, proposals, { existingQids = new Se
       if (!isNonLatinTerm(term)) { issue(`a romanization belongs ONLY on a non-Latin term — "${term.slice(0, 40)}" is already Latin script, so this romanization transliterates a DIFFERENT string; drop it or fix the term`); continue; }
       romanizedTerms = romanizationSpellings(romanRaw);
     }
+    // THE GOODS NARROWING, validated where every other field is. Whole words or short phrases as a
+    // specification writes them; a wildcard is a hard refusal on this field at the register, and an
+    // operator word inside an item is stripped downstream by the shared reader, so nothing here needs
+    // to invent a second rule for either.
+    const goodsWords = (Array.isArray(p.goods_words) ? p.goods_words : (typeof p.goods_words === "string" ? [p.goods_words] : []))
+      .map((w) => String(w ?? "").trim()).filter(Boolean);
+    if (p.goods_words != null && !goodsWords.length) { issue("goods_words, when present, must carry at least one word"); continue; }
+    if (goodsWords.some((w) => /[*?]/.test(w))) { issue("a goods word carries a wildcard, which this register refuses on that field"); continue; }
+    if (goodsWords.length && predicate === "owner") { issue("goods_words narrows a MARK-TEXT question; on predicate:owner the owner name is the term"); continue; }
     const term_literal = p.term_literal === true;
     // A1 — the same term-shape/term-predicate lint the plan freeze enforces, at the PROPOSAL seam:
     // the model gets the reason IN-TURN (rejected[]) and can re-propose the mark-shaped term — a
@@ -205,6 +238,19 @@ export function mintSupplementalEntries(axis, proposals, { existingQids = new Se
         for (const r of covered) regions.push(r);
       }
     }
+    // A CONTAINS-FORM PROPOSAL ON A TERM SHORTER THAN THE REGISTER'S FLOOR is asked on the exact form,
+    // the rule the compiler applies to its own goods-narrowed questions and saturation probes: the
+    // register refuses the contains form for a term that short, so the question as proposed would come
+    // back as an error rather than an answer. Same classes, goods words and scope, one entry for one,
+    // and the entry says so. Decided BEFORE the fingerprint, so the qid names the question actually
+    // asked. A stack is switched only when every member is below the floor; a mixed stack keeps the
+    // form the model chose, and its short members are refused and disclosed on their own.
+    let askedPredicate = predicate;
+    let substituted = null;
+    if (predicate === "default") {
+      const subs = (terms ?? [term]).map((t) => containsFormSubstitution(t, capabilities));
+      if (subs.length && subs.every(Boolean)) { askedPredicate = "exact"; substituted = subs[0]; }
+    }
     const anchor = terms ? terms[0] : term;
     // The fingerprint (⇒ the qid) deliberately EXCLUDES the romanization: the qid names the QUESTION
     // (which term, which predicate, which scope) and the romanisation is carriage, not a different
@@ -212,37 +258,68 @@ export function mintSupplementalEntries(axis, proposals, { existingQids = new Se
     // with the Latin form added — the exact wedge shape the regions inheritance above exists to kill.
     // Instead a re-proposal that adds a romanisation to a stored bare qid ENRICHES it (below), the
     // same field-level, never-term-changing merge extendRegisterPlan applies to the dictated plan.
-    const fp = String(fingerprint({ predicate, term: term || null, terms: terms || null, nice_classes: nice, regions, ...(owner ? { owner } : {}) })).replace(/^fnv1a:/, "");
-    const qid = `supp:${axis}:${predicate}:${slug(anchor)}:${fp.slice(0, 8)}`;
+    // …and it deliberately INCLUDES the goods narrowing, for the opposite reason. A goods-limited
+    // re-ask of a crowded question is the same term, predicate, classes and scope — it differs only by
+    // what the filings must cover. Excluded, it would mint the crowd's own qid and be read as a
+    // re-proposal of the question it exists to replace, so the first move against a crowd would
+    // silently become no move at all.
+    const fp = String(fingerprint({ predicate: askedPredicate, term: term || null, terms: terms || null, nice_classes: nice, regions,
+      ...(owner ? { owner } : {}), ...(goodsWords.length ? { goods: [...goodsWords].sort() } : {}) })).replace(/^fnv1a:/, "");
+    const qid = `supp:${axis}:${askedPredicate}:${slug(anchor)}:${fp.slice(0, 8)}`;
     if (existingQids.has(qid) || minted.some((e) => e.qid === qid)) {
       reused.push(qid);
       if (romanizedTerms && existingQids.has(qid)) enriched.push({ qid, term, romanizedTerms });
       continue;
     }
-    if (budget <= 0) { issue(`per-axis cap ${axisMax} reached — assess whether an existing supplemental already covers this`); continue; }
-    budget -= 1;
+    if (!slots.has(slot)) {
+      if (budget <= 0) { issue(`per-axis cap ${axisMax} reached — assess whether an existing supplemental already covers this`); continue; }
+      budget -= 1;
+    }
+    slots.add(slot);
     const entry = {
-      qid, axis, predicate,
+      qid, axis, predicate: askedPredicate,
+      ...(substituted ? { contains_substituted: substituted } : {}),
       ...(terms ? { terms } : { term }),
       ...(romanizedTerms ? { romanizedTerms } : {}),
       ...(owner ? { owner } : {}),
+      // Carried as `goods_text`, the field the plan and every connector already speak — the tool calls
+      // it `goods_words` because that is what the manual and the manifest call it to the model.
+      ...(goodsWords.length ? { goods_text: goodsWords } : {}),
+      // What this question REPLACED. The ledger shows the crowd and its narrowing together, each with
+      // its own count, so a crowd never reads as a question nobody answered.
+      ...(typeof p.narrows === "string" && p.narrows.trim() ? { narrows: p.narrows.trim().slice(0, 200) } : {}),
       ...(term_literal ? { term_literal: true } : {}),
       nice_classes: nice, regions,
       expected_kind: "enumerate",
       origin: "supplemental",
+      ...(splitOf ? { split_of: splitOf } : {}),
       ...(typeof p.rationale === "string" && p.rationale.trim() ? { rationale: p.rationale.trim().slice(0, 200) } : {}),
     };
     // F1 — an owner×term slice on a provider that cannot intersect them is minted as an UNSUPPORTED
     // entry (→ the executor's deferred lane → a disclosed coverage row), exactly like a missing
     // predicate at compile time. Never rejected (the gap belongs on the record) and never silently
     // widened into an owner-less sweep.
-    const ownerGap = ownerIntersectionGap(entry, capabilities);
-    if (ownerGap) { entry.unsupported = true; entry.unsupported_reason = ownerGap; }
+    // …and a goods narrowing on a register that cannot search goods text is the same kind of gap, with
+    // the compiler's own reason (goodsTextGap): recorded, never run on the class alone, which would ask the
+    // crowd the narrowing exists to cut.
+    const gap = ownerIntersectionGap(entry, capabilities) ?? goodsTextGap(entry, capabilities);
+    if (gap) { entry.unsupported = true; entry.unsupported_reason = gap; }
     minted.push(entry);
   }
   return { minted, reused, rejected, enriched, narrowed };
 }
 
+/** The per-axis cap's count of what is already on file: the names of one split batch are one slot. PURE. */
+export function supplementalSlots(entries) {
+  const batches = new Set();
+  let n = 0;
+  for (const e of (entries ?? [])) {
+    if (e?.split_of) { if (!batches.has(e.split_of)) { batches.add(e.split_of); n += 1; } }
+    else n += 1;
+  }
+  return n;
+}
+
 /**
  * Append mint-rejection rows to a supplemental-plan doc's `rejected[]` (append-only, beside
  * entries[] — one sidecar per axis holds BOTH what folded into the plan and what died at the seam,
@@ -326,7 +403,7 @@ export async function proposeSupplemental(params, tctx, deps) {
     return { type: "text", text: JSON.stringify({ minted: [], reused: [], rejected: [], excluded_house_element: excludedHouse, executed: false }, null, 2) };
   const existingQids = new Set(supp.entries.map((e) => e.qid));
   const { minted, reused, rejected, enriched, narrowed } = mintSupplementalEntries(axis, offered,
-    { existingQids, perCall, axisMax, existingCount: supp.entries.length, capabilities: deps.capabilities ?? null, priorityClasses: planClasses });
+    { existingQids, perCall, axisMax, existingCount: supplementalSlots(supp.entries), capabilities: deps.capabilities ?? null, priorityClasses: planClasses });
 
   // Field-level romanisation enrichment of a REUSED qid (2026-07-30 review round): the natural retry —
   // a bare non-Latin proposal deferred at the wire, the model re-proposes it WITH the romanisation —