clearotron 0.3.2 → 0.3.3-beta.1

package/driver/synthesis-record.mjs

@@ -181,7 +181,13 @@ export function uncarriedCoverageLimits(rows, ledger) {
   if (!Array.isArray(ledger) || !ledger.length) return null;
   const limited = ledger.filter((r) => {
     const st = String(r?.status ?? "").trim();
-    return st !== "" && st !== "confirmed-clean" && st !== "note";
+    // `withheld-by-judgment` sits beside `confirmed-clean` here, and the reason is the opposite one.
+    // A clean row has nothing to carry. A withheld row is a family the reading turn chose NOT to open,
+    // having read the identical question as a list and found what it needed — that is where the work
+    // was spent, not a slice the run could not clear, and the rule that nothing is added to the report keeps it out
+    // entirely. Demanding it be carried would put a "we did not search this" line in front of a lawyer
+    // about a decision that made the search better.
+    return st !== "" && st !== "confirmed-clean" && st !== "note" && st !== "withheld-by-judgment";
   });
   if (!limited.length) return null;                       // the run records no limit: nothing to carry
   const carried = (rows ?? []).some((r) => {
@@ -201,6 +207,66 @@ export function uncarriedCoverageLimits(rows, ledger) {
  * could assert either could waive its own contract — the same reason the reviewer's transport takes
  * `receiptPresent` from the driver rather than from the call.
  */
+/**
+ * The coverage rows a client may see, with every withheld family's row removed. PURE.
+ *
+ * `withheld-by-judgment` is the reading turn saying it chose not to open a family — it read the
+ * identical question as a list, found what it needed, and spent the work there. That is a decision
+ * about where effort went, not a gap in the client's search, and the rule that nothing is added to the report (2026-09-18) keeps it in the run record
+ * and the coverage ledger alone.
+ *
+ * Applied here rather than trusted to the model, because the model is the surface that can get it
+ * wrong: it authors these rows, it has been told the family was withheld, and a row reading "we did
+ * not search this" in front of a lawyer is the sentence that rule forbids — about a decision that
+ * made the search better. The LEDGER is the authority on which families were withheld.
+ *
+ * A row for a family the ledger holds as anything else is untouched, and that direction matters more
+ * than this one: a documented limit dropped by accident is a disclosure the reader is owed and does
+ * not get.
+ */
+export function withoutWithheldRows(rows, ledger) {
+  // A FAMILY IS ONLY WITHHELD IF THE LEDGER HOLDS NOTHING ELSE ABOUT IT. A family can be withheld at
+  // the axis level AND still carry a documented limit on one of its slices — measured: an axis whose
+  // whole-axis row is withheld while `primary-sweep (exact: <mark> [cl 25])` is a disclosed limit the
+  // synthesis gate then demands be carried. Dropping by family name alone deleted the carrying row and
+  // the run failed, which is the worse error stated twice over: a disclosure the reader is owed, gone,
+  // and a run that does not deliver.
+  //
+  // So a family qualifies only when EVERY ledger row for it is withheld. One row saying anything else
+  // keeps the whole family's rows, and that is the direction to fail in.
+  const byFamily = new Map();
+  for (const r of (Array.isArray(ledger) ? ledger : [])) {
+    const axis = String(r?.axis ?? "").trim().toLowerCase();
+    if (!axis) continue;
+    const isWithheld = String(r?.status ?? "").trim() === "withheld-by-judgment";
+    byFamily.set(axis, (byFamily.get(axis) ?? true) && isWithheld);
+  }
+  const withheld = new Set([...byFamily.entries()].filter(([, only]) => only).map(([axis]) => axis));
+  if (!withheld.size) return Array.isArray(rows) ? rows : [];
+
+  // ── THE AXIS IS NAMED IN A SEGMENT, NOT ALWAYS THE FIRST ONE ──────────────────────────────────
+  //
+  // This read `area.split("/")[0]` and was inert for the two shapes that matter most, failing OPEN —
+  // toward the client, which is the wrong direction for a gate whose whole job is to keep a row off
+  // the page. Measured against the real strings:
+  //
+  //   `incumbent-class (entire axis)`         no slash at all — the whole-axis row a client reads
+  //   `Register / incumbent-class`            the axis is the SECOND segment; the first is a layer
+  //   `incumbent-class / extra script group`  the only shape the first read caught
+  //
+  // So every `/`-separated segment is considered, with a trailing parenthetical stripped, and each is
+  // compared by EQUALITY against the axis names the ledger actually holds.
+  //
+  // Equality on a segment, never `includes`: a substring test over an open vocabulary is how one axis
+  // name once matched two unrelated areas, and here a false match DROPS a row — a documented limit the
+  // reader is owed, gone silently. The failure this gate prevents is a withheld row appearing; the
+  // failure it must not cause is a disclosure disappearing, and that one is worse.
+  const namesIn = (area) => String(area ?? "").toLowerCase().split("/")
+    .map((seg) => seg.replace(/\([^)]*\)/g, " ").trim())
+    .filter(Boolean);
+  return (Array.isArray(rows) ? rows : []).filter((r) => !namesIn(r?.area).some((n) => withheld.has(n)));
+}
+
 export function acceptSynthesis(params, { asks = [], ledger = null, manifest = null, owed = null, declined = null } = {}) {
   const doc = params?.findings;
   if (!doc || typeof doc !== "object" || Array.isArray(doc)) {
@@ -228,7 +294,19 @@ export function acceptSynthesis(params, { asks = [], ledger = null, manifest = n
   // Two copies that must agree is a second-authoring defect, so there are not two. The record is the
   // machine contract and the narrative's coverage list is RENDERED from it. Disagreement is not detected;
   // it is impossible.
-  const rows = Array.isArray(doc.coverage) ? doc.coverage : [];
+  // ── NOTHING ADDED TO THE REPORT: A FAMILY THE READING TURN DID NOT OPEN STAYS OFF IT, WHATEVER THE MODEL WROTE ──
+  //
+  // `withheld-by-judgment` is the reading turn saying it chose not to open a family — it read the
+  // identical question as a list, found what it needed, and spent the work there instead. That is a
+  // decision about where effort went, not a gap in the client's search, and it belongs to the run
+  // record and the coverage ledger alone.
+  //
+  // Dropped HERE rather than trusted to the model, because the model is the one surface that can get
+  // it wrong: it writes the coverage rows, it has been told the family was withheld, and a row saying
+  // "we did not search this" in front of a lawyer is exactly the sentence that rule forbids — about a
+  // decision that made the search better. The ledger is the authority on which families were withheld,
+  // so a row whose family it holds as withheld goes, however the row was authored.
+  const rows = withoutWithheldRows(Array.isArray(doc.coverage) ? doc.coverage : [], ledger);
   if (n.coverage?.rows !== undefined) {
     return { ok: false, reason: "synthesis_coverage_rows_misplaced: coverage rows belong in `findings.coverage`, not on the narrative — the driver renders the narrative's coverage list from the record, so there is one authored set and no way for the client's readable statement and the machine record to disagree. Send `narrative.coverage.read` for the prose" };
   }

package/driver/unit-file-drift.mjs

@@ -63,7 +63,7 @@ export function unitBody(text) {
  *                driver/unit-files.mjs wherever it sits, or null when the repo tracks none
  *     dropIns  — array of drop-in paths (may be empty)
  * @param {{ok: boolean, why?: string}} probe — could the caller enumerate at all?
- * @returns {{state: "pass"|"fail"|"skip", message: string, drifted: string[], templated: string[]}}
+ * @returns {{state: "pass"|"fail"|"skip", blocked?: true, message: string, drifted: string[], templated: string[]}}
  *
  * THREE OUTCOMES, and the third is the one this file exists for. "Could not look" is never "nothing is
  * wrong" — the lesson, applied to the arm that has the same failure mode one layer down: a unit
@@ -72,7 +72,7 @@ export function unitBody(text) {
  */
 export function unitFileDriftVerdict({ units = [], probe = { ok: true } } = {}) {
   if (!probe.ok) {
-    return { state: "skip", drifted: [],
+    return { state: "skip", blocked: true, drifted: [],
       message: `could not enumerate systemd units, so no unit file was COMPARED — ${probe.why ?? "no reason given"}. `
         + "This is a failure to look, not a finding about the deployment" };
   }
@@ -80,7 +80,7 @@ export function unitFileDriftVerdict({ units = [], probe = { ok: true } } = {})
   const unreadable = units.filter((u) => u && u.live == null);
   const untracked = units.filter((u) => u && u.live != null && u.tracked == null);
   if (!comparable.length) {
-    return { state: "skip", drifted: [],
+    return { state: "skip", blocked: true, drifted: [],
       message: `systemd answered and no unit could be compared to a tracked file (${units.length} unit(s) seen, `
         + `${unreadable.length} with no readable fragment, ${untracked.length} with no tracked unit file `
         + "anywhere in the tree) — nothing was checked" };

package/driver/unit-inventory.mjs

@@ -676,7 +676,7 @@ export const CHECKED_TIMERS = Object.freeze(
  * that reports on the service keeps saying `inactive`, which is what it says when the timer is working.
  */
 export function timerVerdict(timers, { probeFailed = null } = {}) {
-  if (probeFailed) return { state: "unknown", stopped: [], absent: [], message: `could not ask systemd about the timers: ${probeFailed}. That is this check failing to look, not a report about them.` };
+  if (probeFailed) return { state: "skip", blocked: true, stopped: [], absent: [], message: `could not ask systemd about the timers: ${probeFailed}. That is this check failing to look, not a report about them.` };
   const rows = timers ?? [];
   if (!rows.length) return { state: "pass", stopped: [], absent: [], message: "no timer is declared for this box" };
   const absent = rows.filter((t) => t.load === "not-found").map((t) => t.unit).sort();
@@ -726,7 +726,7 @@ export function unitInventoryVerdict({
   inventory = UNIT_INVENTORY,
 } = {}) {
   if (!probe.ok) {
-    return { state: "skip", undeclared: [], orphaned: [], absent: [], misdeclared: [],
+    return { state: "skip", blocked: true, undeclared: [], orphaned: [], absent: [], misdeclared: [],
       message: `could not enumerate systemd units, so the inventory was NOT checked — ${probe.why ?? "no reason given"}. `
         + "A failure to look is not a finding about the deployment." };
   }

package/driver/unit-state-verdict.mjs

@@ -100,7 +100,7 @@ export function classifyActiveState(active) {
 export function unitsActiveVerdict({ units, probe }) {
   // — a failure to look is never a finding about the deployment.
   if (!probe?.ok)
-    return { state: "skip", message: `could not enumerate systemd --user units — ${probe?.why ?? "no reason reported"}` };
+    return { state: "skip", blocked: true, message: `could not enumerate systemd --user units — ${probe?.why ?? "no reason reported"}` };
 
   const label = (u) => `${u.unit}=${u.active}`
     + (u.type ? ` (${u.type}${u.since ? `, since ${u.since}` : ""})` : (u.since ? ` (since ${u.since})` : ""));

package/driver/updater-identity.mjs

@@ -111,8 +111,7 @@ export function updaterVerdict({ stamp, now = null, deployClone = null, maxAgeSe
     return { state: "fail", message:
       `no updater identity stamp at ${UPDATER_STAMP_BASENAME}: the copy of the updater that deploys this `
       + "box did NOT say what it is, so whether it is the current one was not established. A copy old "
-      + "enough to predate the stamp writes none, which is itself the stale-updater case. This is a "
-      + "failure to look, never a pass." };
+      + "enough to predate the stamp writes none, which is itself the stale-updater case." };
   }
 
   // — AN UNREADABLE SIDE IS NOT A MISMATCH. A digest that could not be taken arrives as null, and
@@ -128,7 +127,7 @@ export function updaterVerdict({ stamp, now = null, deployClone = null, maxAgeSe
       : !wsha ? "the running copy of the updater could NOT be read as a digest"
       : "the master could NOT be read as a digest";
     const why = stamp.masterCommitError ? ` The updater reported: ${stamp.masterCommitError}` : "";
-    return { state: "fail", message:
+    return { state: "skip", blocked: true, message:
       `the updater stamp is present but ${which}, so the running copy was NOT `
       + `compared against its master.${why} This is a failure to look, never a pass.` };
   }

package/driver/variant-manifest-model.mjs

@@ -176,8 +176,18 @@ export function parseVariantManifestModel(raw) {
   // and refuses it. Each says so in its own capability contract, and the compiler declines to build an
   // entry a register cannot express. Deciding it here would freeze one register's behaviour into a
   // rule about every register.
-  let goods_words = [];
+  // ── AN ABSENT KEY AND AN EMPTY LIST ARE DIFFERENT ANSWERS ───────────────────────────────────────
+  //
+  // `null` means the stage was asked and did not answer. `[]` means it answered: it considered the
+  // goods and there are no words worth narrowing by. They are the same value to a reader who only
+  // checks emptiness, and that is how a production run shipped a narrowing that never ran — the model
+  // could not send the key at all, the manifest carried an empty list, the compiler minted nothing,
+  // and the run looked exactly like a matter that genuinely had no goods words.
+  //
+  // Nothing downstream may treat the two the same. A skipped question is a fact about the run.
+  let goods_words = null;
   if (m.goods_words != null) {
+    goods_words = [];
     if (!Array.isArray(m.goods_words) || !m.goods_words.every((w) => typeof w === "string"))
       throw new Error("variantmodel_goods_words_invalid (an array of single-word strings, or omitted)");
     const seen = new Set();

package/driver/verify.mjs

@@ -16,7 +16,7 @@ import { matterFrameWasRecorded, frameRatifiedForms } from "./matter-frame-recor
 import { findConnotationViolations, parsePrRiskResults, prRiskPopulation,
   CONNOTATION_UNMATCHED_MARK, CONNOTATION_NO_RESEMBLANCE_MARK, MEANING_ANGLES_RE,
   parseDispositionForm, CONNOTATION_UNRULED_REASONS, queryKey } from "./connotation-search.mjs";
-import { formSidecarName, formSidecarPath } from "./disposition-union.mjs";
+import { formSidecarName, formSidecarPath } from "./disposition-union.mjs"; import { coverageStatusAsData } from "./common-law-coverage-status.mjs";
 // B — the transport's own four failure states. The audit reads the run's records; this file locates them.
 import { auditDispositionCalls, CALL_FAILURE_REASONS } from "./disposition-call-audit.mjs";
 import { callRecordPaths } from "./disposition-tool.mjs";
@@ -481,7 +481,7 @@ function commonLawMeaningSeat(p, c) {
 // — the EVIDENCE chain for `validators.commonLaw`, lifted out verbatim so the unavailability
 // veto can wrap it instead of pre-empting it. Every return token is unchanged.
 function commonLawEvidence(p, c) {
-    const structural = commonLawStructural(c);
+    const structural = commonLawStructural(c, p);
     if (!structural.ok) return structural;
     // The dictated grid spec is the SINGLE source of the grid contract when present (the driver wrote it,
     // the plugin ran it, the plugin wrote the ledger from it): the receipts gate joins the ledger against
@@ -596,7 +596,7 @@ function commonLawHalfEvidence(p, c) {
     if (!half) return fail("half_path_unrecognized");
     // — the meaning seat is judged on the meaning work, because that is all it was dictated.
     if (half === MEANING_SEAT) return commonLawMeaningSeat(p, c);
-    const structural = commonLawStructural(c);
+    const structural = commonLawStructural(c, p);
     if (!structural.ok) return structural;
     const gs = readGridSpecHalf(p, half);
     if (gs.invalid) return fail(`grid_spec_unreadable:_driver/grid-spec.half-${half}.json is corrupt or misshapen (driver-written — this is a bug, not a model defect)`);
@@ -664,7 +664,7 @@ function commonLawHalfEvidence(p, c) {
 // adjacent with exactly one separator between them; it stops rejecting a document that HAS the section
 // under the hyphenated compound the skill itself uses. The failure this removes is a false negative, and
 // its cost was a clearance that had already spent an hour.
-function commonLawStructural(c) {
+function commonLawStructural(c, p = null) {
   return all(
     nonEmpty(c),
     needsSection(c, "findings", [/^#{1,4}\s+[^\n]*\bfindings\b/im], "findings-heading"),
@@ -672,7 +672,7 @@ function commonLawStructural(c) {
     needsSection(c, "coverage-ledger", [/coverage[\s-]ledger/i], "coverage-ledger"),
     needsSection(c, "audit-trail", [/audit[\s-]trail/i], "audit-trail"),
     needs(c, [/\|/], "platform matrix"),
-    hasCoverageLedgerRow(c) ? ok() : fail("no_coverage_status_row"),
+    coverageStatusAsData(p) || hasCoverageLedgerRow(c) ? ok() : fail("no_coverage_status_row"),   // the recorded status first, the word as fallback: coverageStatusAsData() in common-law-coverage-status.mjs
   );
 }
 

package/driver/withheld-families.mjs

@@ -0,0 +1,104 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+// withheld-families.mjs — the reading turn's record of the waiting families it chose not to ask.
+//
+// On a crowded field the wider register families wait in the plan for the reading turn, which asks the
+// ones worth asking. A family it does not ask was never searched, and until this record nothing said
+// so: the turn's reason, when it gave one, sat in its prose note, where nothing reads it. So the turn
+// records each family it leaves unasked as `withheld-by-judgment` with its reason, the coverage form
+// carries a row per waiting family pre-settled from this record, and a family nobody judged is an
+// unsettled row the digest's gate refuses to pass.
+//
+// The reason is the run's record and the audit workbook's, never the report's: the coverage form keeps
+// these rows out of the ledger the report is built from (coverage-form.mjs, `family`).
+//
+// One file per axis, because the reading turn fans out one seat per axis and two seats writing one file
+// would lose each other's calls. The axis is bound by the server, never taken from the payload.
+import { readFileSync, writeFileSync, renameSync, existsSync, readdirSync, mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { driverDir } from "../shared/driver-dir.mjs";
+import { awaitsReadingTurn } from "../providers/_shared/plan-guards.mjs";
+import { entryQuestionKey } from "./register-plan.mjs";
+import { seatBannedTokens } from "./coverage-form.mjs";
+
+export const WITHHELD_REASON_MAX = 600;
+const FILE_RE = /^withheld-families-(.+)\.json$/;
+
+export const withheldFamiliesPath = (runDir, axis) => driverDir(runDir, `withheld-families-${axis}.json`);
+
+const readJson = (p) => { try { return existsSync(p) ? JSON.parse(readFileSync(p, "utf8")) : null; } catch { return null; } };
+
+/** Every axis's record, merged: `{ [qid]: { axis, reason } }`. An unreadable file contributes nothing. */
+export function readWithheldFamilies(runDir) {
+  const out = {};
+  let names = [];
+  try { names = readdirSync(driverDir(runDir)); } catch { return out; }
+  for (const name of names) {
+    const m = FILE_RE.exec(name);
+    if (!m) continue;
+    const doc = readJson(driverDir(runDir, name));
+    for (const [qid, v] of Object.entries(doc?.families ?? {})) {
+      const reason = String(v?.reason ?? "").trim();
+      if (qid && reason) out[qid] = { axis: String(doc?.axis ?? m[1]), reason };
+    }
+  }
+  return out;
+}
+
+/**
+ * The waiting families on one axis, and which of them the reading turn has asked: a waiting row is asked
+ * when a question it did not wait for — a plan entry or one of this axis's supplementals — carries the
+ * same question key. PURE over its inputs.
+ */
+export function waitingFamiliesOn(plan, axis, supplementals = []) {
+  const entries = Array.isArray(plan?.entries) ? plan.entries : [];
+  const askedKeys = new Set([...entries.filter((e) => !awaitsReadingTurn(e?.when)), ...supplementals]
+    .filter((e) => e && !e.unsupported).map((e) => entryQuestionKey(e, plan)).filter(Boolean));
+  const waiting = entries.filter((e) => e?.axis === axis && awaitsReadingTurn(e?.when));
+  return {
+    waiting,
+    unasked: waiting.filter((e) => !askedKeys.has(entryQuestionKey(e, plan))),
+  };
+}
+
+/**
+ * Record families withheld on the bound axis. `families` is `[{ qids: [qid…] | qid, reason }]` — one
+ * reason may cover several families. Each qid must be a waiting family of this axis in the frozen plan;
+ * a reason must be the reader's words, since the audit workbook prints it. Accepts what is valid, names
+ * what it refused, and never throws.
+ */
+export function recordWithheldFamilies(runDir, { axis, families } = {}) {
+  const plan = readJson(driverDir(runDir, "register-plan.json"));
+  if (!plan || !Array.isArray(plan.entries)) return { refused: "no frozen register plan in this run — there are no waiting families to record against" };
+  if (!Array.isArray(families) || !families.length) return { refused: "families must list at least one { qids, reason }" };
+  const supp = readJson(join(runDir, "register-units", `${axis}-supplemental-plan.json`));
+  const { waiting, unasked } = waitingFamiliesOn(plan, axis, Array.isArray(supp?.entries) ? supp.entries : []);
+  const waitingQids = new Set(waiting.map((e) => e.qid));
+  const path = withheldFamiliesPath(runDir, axis);
+  const doc = readJson(path) ?? { axis, families: {} };
+  const recorded = [], rejected = [];
+  for (const item of families) {
+    const qids = (Array.isArray(item?.qids) ? item.qids : [item?.qids ?? item?.qid]).map((q) => String(q ?? "").trim()).filter(Boolean);
+    const reason = String(item?.reason ?? "").replace(/\s+/g, " ").trim();
+    if (!qids.length) { rejected.push({ qid: "", issue: "an item names no qid" }); continue; }
+    if (!reason) { for (const qid of qids) rejected.push({ qid, issue: "no reason — a withheld family is recorded with why it was not asked" }); continue; }
+    if (reason.length > WITHHELD_REASON_MAX) { for (const qid of qids) rejected.push({ qid, issue: `the reason runs to ${reason.length} characters; at most ${WITHHELD_REASON_MAX}` }); continue; }
+    const banned = seatBannedTokens(reason);
+    if (banned.length) { for (const qid of qids) rejected.push({ qid, issue: `the reason names ${banned.join(", ")} — the audit workbook prints it; say it in a lawyer's words` }); continue; }
+    for (const qid of qids) {
+      if (!waitingQids.has(qid)) { rejected.push({ qid, issue: `not a waiting family on axis "${axis}" in the frozen plan` }); continue; }
+      doc.families[qid] = { reason };
+      recorded.push(qid);
+    }
+  }
+  if (recorded.length) {
+    try {
+      mkdirSync(dirname(path), { recursive: true });
+      const tmp = `${path}.${process.pid}.tmp`;
+      writeFileSync(tmp, JSON.stringify({ axis, families: doc.families }, null, 2) + "\n");
+      renameSync(tmp, path);
+    } catch (e) { return { write_failed: String(e?.message ?? e).slice(0, 200) }; }
+  }
+  const still = unasked.filter((e) => !doc.families[e.qid]).map((e) => e.qid);
+  return { axis, recorded, rejected, still_to_judge: still, waiting: waiting.length };
+}

package/mcp-server/CHANGELOG.md

@@ -1,5 +1,13 @@
 # trademark-artifacts-mcp
 
+## 0.3.3-beta.1
+
+No changes in this release.
+
+## 0.3.3-beta.0
+
+No changes in this release.
+
 ## 0.3.2
 
 ### Patch Changes

package/mcp-server/lib/brief.mjs

@@ -44,6 +44,11 @@ function plainClause(s) {
 }
 
 const titleCase = (w) => (w ? w.charAt(0) + w.slice(1).toLowerCase() : w);
+// A band arrives as its word ("High") or as the derived record publish writes for the run's verdict
+// ({ label, rankFromTop, scale }). Stringifying the record printed "Overall risk: [object object]."
+// on the assistant's summary; every band read here goes through this, so either shape gives the word.
+const bandLabel = (b) => (b && typeof b === "object" ? (typeof b.label === "string" && b.label.trim() ? b.label : null)
+  : (b == null || String(b).trim() === "" ? null : String(b)));
 
 // One clearance finding → one line. NO SECOND FILTER: report-data.json already carries only the live
 // findings (a withdrawn one is not in the file), so the brief's conflicts and the report's findings are
@@ -51,7 +56,7 @@ const titleCase = (w) => (w ? w.charAt(0) + w.slice(1).toLowerCase() : w);
 // shorter list than the document the client was holding.
 function clearanceLine(f) {
   const who = [f.mark, f.owner?.name].filter(Boolean).join(" — ") || "(unnamed finding)";
-  const band = f.band ? ` — ${titleCase(String(f.band))} risk.` : "";
+  const band = bandLabel(f.band) ? ` — ${titleCase(bandLabel(f.band))} risk.` : "";
   return `- **${who}**${band}${f.net ? ` ${f.net}` : ""}`.trimEnd();
 }
 
@@ -77,7 +82,8 @@ export function buildBrief(run) {
   // THE BAND, AND NEVER THE GATE'S WORD. This chain used to fall through to the delivery verdict — the
   // sidecar's `verdict`, then the run's — so a run whose report reads Medium could be briefed as BLOCKING.
   // The band is what the report shows; where no band is recorded the line is not drawn at all.
-  const overall = clearance?.verdict?.band ?? clearance?.verdict?.tier
+  const rating = clearance?.rating ?? clearance?.verdict ?? null;   // `verdict` on a report-data file written before the rename
+  const overall = bandLabel(rating?.band) ?? rating?.tier
     ?? (koDocs.length === 1 ? (koDocs[0].overall ?? null) : null)
     ?? fm.overall_label ?? run.tier ?? null;
 
@@ -92,9 +98,8 @@ export function buildBrief(run) {
   const tail = [product, dateStr ? `run ${dateStr}` : null].filter(Boolean).join(", ");
   lines.push(`**${subject}**${tail ? ` — ${tail}` : ""}.`);
 
-  const caption = clearance
-    ? (clearance.verdict?.statement ?? clearance.caption ?? "")
-    : plainClause(fm.overall_caption ?? "");
+  // The report's own conclusion, verbatim, after the rating (ruled 2026-09-22: the report is the master).
+  const caption = clearance ? (clearance.caption ?? "") : plainClause(fm.overall_caption ?? "");
   if (overall) lines.push(`**Overall risk: ${titleCase(String(overall))}.** ${caption}`.trim());
   if (run.state) {
     // a park is paused, not finished — say so plainly, and name the clock only where one exists
@@ -104,9 +109,8 @@ export function buildBrief(run) {
       : run.state === "recovering" ? ` — auto-recovery backoff, resumes ${run.recoveryResumesAt ? `at ${String(run.recoveryResumesAt).replace("T", " ").slice(0, 16)} UTC` : "on its own"}`
       : run.state === "parked-for-human" ? ` — parked by a runner stop (deploy/restart), resumes on the next runner activation` : "";
     lines.push(`Status: ${run.state}${paused}.`);
-    // The run's own sentence, composed once by the driver and rendered on every client surface. It says
-    // what the gate word used to be reached for, in the words the report itself uses.
-    if (run.statement) lines.push(String(run.statement));
+    // No second summary here: the rating and the report's conclusion above are the run's answer. The
+    // composed statement said "on hold" on runs nothing held.
   }
 
   let source = "none";
@@ -120,7 +124,7 @@ export function buildBrief(run) {
     }
     // Conditions gate a clean result; advisories never do, so only the conditions ride the briefing.
     const conditions = [
-      ...(clearance.verdict?.conditions ?? []),
+      ...(rating?.conditions ?? []),
       ...(clearance.actions?.conditions ?? []).map((a) => a?.text),
     ].filter(Boolean);
     if (conditions.length) {
@@ -137,7 +141,7 @@ export function buildBrief(run) {
     lines.push("", "**Each name screened:**");
     for (const d of koDocs) {
       for (const m of (d.marks ?? [])) {
-        const band = m.band ? `${titleCase(String(m.band))}${m.qualifier ? ` (${m.qualifier})` : ""}` : "unrated";
+        const band = bandLabel(m.band) ? `${titleCase(bandLabel(m.band))}${m.qualifier ? ` (${m.qualifier})` : ""}` : "unrated";
         lines.push(`- **${m.name}** — ${band}.${d.url ? ` Report: ${d.url}` : ""}`);
         for (const f of (m.findings ?? [])) {
           const who = [f.name, f.owner].filter(Boolean).join(" — ");
@@ -151,7 +155,7 @@ export function buildBrief(run) {
           // was: a typed conflict already leads with its own band on the report, and widening this to all
           // findings would change what this briefing says about runs that have no register layer at all.
           if (f.shape === "register") {
-            const rating = f.band ? ` — ${titleCase(String(f.band))} risk.` : "";
+            const rating = bandLabel(f.band) ? ` — ${titleCase(bandLabel(f.band))} risk.` : "";
             const read = f.basis && f.basis !== f.net ? ` ${f.basis}` : "";
             lines.push(`  - ${who}${rating}${f.net ? ` ${f.net}` : ""}${read}`.trimEnd());
             continue;
@@ -204,7 +208,7 @@ export function buildBrief(run) {
   return {
     runId: run.runId, markName: run.markName ?? clearance?.markName ?? fm.title ?? null,
     product,
-    overall, tier: run.tier ?? null, statement: run.statement ?? null, state: run.state ?? null, date: run.date ?? null,
+    overall, tier: run.tier ?? null, caption: run.caption ?? null, state: run.state ?? null, date: run.date ?? null,
     source, brief: lines.join("\n"),
   };
 }

package/mcp-server/lib/runs.mjs

@@ -102,7 +102,7 @@ function runFromStatusFile(statusFile, agent) {
     // assistant saw the gate's word and nothing beside it, which is the shape this whole item is about.
     // The verdict record holds the band for those runs, so it is read from there.
     state: s.state ?? null,
-    tier: s.tier ?? bandWord(s.verdict) ?? tierFromRecord(runDir), statement: s.statement ?? null, url: s.url ?? null,
+    tier: s.tier ?? bandWord(s.verdict) ?? tierFromRecord(runDir), caption: s.caption ?? null, url: s.url ?? null,   // the report's own conclusion, never a second summary (ruled 2026-09-22)
     markName: s.markName ?? null, ref: s.ref ?? null, classes: s.classes ?? null,
     stepN: s.stepN ?? null, stepLabel: s.stepLabel ?? null, stepTotal: s.stepTotal ?? null,
     failedStage: s.failedStage ?? null, reason: s.reason ?? null,

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.3.2",
+  "version": "0.3.3-beta.1",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/mcp-server/server.mjs

@@ -207,8 +207,9 @@ function runSummary(run) {
     // once. null where the registry cannot name it — the row says nothing rather than guessing, because
     // a hardcoded fallback is how a knockout once announced itself as a product it provably was not.
     product: productIdentityFor(run),
-    // The band and the run's own sentence; the gate's word stays in the run record (824).
-    state: run.state, location: run.location, tier: run.tier, statement: run.statement, url: run.url,
+    // The band and the report's own conclusion; the gate's word stays in the run record (824), and no
+    // second summary rides beside them (ruled 2026-09-22).
+    state: run.state, location: run.location, tier: run.tier, caption: run.caption, url: run.url,
     markName: run.markName, ref: run.ref, classes: run.classes,
     step: s.stepN ? `${s.stepN}/${s.stepTotal} ${s.stepLabel ?? ""}`.trim() : null,
     startedAt: run.startedAt, updatedAt: run.updatedAt, deliveredAt: run.deliveredAt,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clearotron",
   "type": "module",
-  "version": "0.3.2",
+  "version": "0.3.3-beta.1",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",
@@ -66,7 +66,7 @@
     "assert-census": "node scripts/unexecuted-asserts.mjs"
   },
   "devDependencies": {
-    "@changesets/cli": "3.0.2",
+    "@changesets/cli": "3.0.3",
     "@types/node": "^26",
     "acorn": "^8.18.0",
     "eslint": "^10.8.1",

package/portal-ui/dist/assets/{index-DMthc7PQ.js → index-GBbbyQxc.js}

@@ -12751,7 +12751,18 @@ function Logo({ markOnly = false }) {
 var ACTIVE_MS = 5e3;
 var IDLE_MS = 3e4;
 var BACKOFF_MS = 6e4;
-function useLoad(fetcher, deps) {
+var startedEarly = new Map();
+function startEarly(key, fetcher) {
+	if (!startedEarly.has(key)) startedEarly.set(key, fetcher());
+}
+function claimEarly(key) {
+	if (!key) return null;
+	const p = startedEarly.get(key);
+	if (!p) return null;
+	startedEarly.delete(key);
+	return p;
+}
+function useLoad(fetcher, deps, early) {
 	const [result, setResult] = (0, import_react.useState)(null);
 	const [loading, setLoading] = (0, import_react.useState)(true);
 	const [nonce, setNonce] = (0, import_react.useState)(0);
@@ -12764,7 +12775,7 @@ function useLoad(fetcher, deps) {
 		if (seenKey.current !== null && seenKey.current !== depsKey) setResult(null);
 		seenKey.current = depsKey;
 		setLoading(true);
-		fetcherRef.current().then((r) => {
+		(claimEarly(early) ?? fetcherRef.current()).then((r) => {
 			if (!live) return;
 			setResult(r);
 			setLoading(false);
@@ -15487,7 +15498,7 @@ function lastFinishedOf(row) {
 }
 var COMPACT_FROM = 5;
 function Home({ ctx }) {
-	const { result, reload } = useLoad(() => api.runsMine(), []);
+	const { result, reload } = useLoad(() => api.runsMine(), [], "runs:mine");
 	const allowanceOwner = ctx.owner ?? (ctx.me.accounts.length === 1 ? ctx.me.accounts[0] : null);
 	const { result: usageRes } = useLoad(() => allowanceOwner ? api.usage(allowanceOwner) : Promise.resolve({ kind: "pickAccount" }), [allowanceOwner]);
 	const allRuns = result?.kind === "ok" ? result.value : [];
@@ -16920,7 +16931,7 @@ function Clearances({ ctx }) {
 	const [query, setQuery] = (0, import_react.useState)("");
 	const [open, setOpen] = (0, import_react.useState)(new Set());
 	const [page, setPage] = (0, import_react.useState)(0);
-	const { result, reload } = useLoad(() => api.runsMine(), []);
+	const { result, reload } = useLoad(() => api.runsMine(), [], "runs:mine");
 	const allRuns = result?.kind === "ok" ? result.value : [];
 	const ownerFilter = ctx.owner;
 	const runs = (0, import_react.useMemo)(() => ownerFilter ? allRuns.filter((r) => runKey(r) === ownerFilter) : allRuns, [allRuns, ownerFilter]);
@@ -26744,6 +26755,13 @@ function screen(id, ctx) {
 		});
 	}
 }
+var EARLY_RUNS_PATHS = [
+	"/portal/home",
+	"/portal/clearances",
+	"/portal"
+];
+var here = window.location.pathname.replace(/[?#].*$/, "").replace(/\/+$/, "") || "/portal";
+if (EARLY_RUNS_PATHS.includes(here)) startEarly("runs:mine", () => api.runsMine());
 var root = document.getElementById("root");
 if (!root) throw new Error("#root is missing from index.html");
 (0, import_client.createRoot)(root).render((0, import_jsx_runtime.jsx)(import_react.StrictMode, { children: (0, import_jsx_runtime.jsx)(AppShell, { render: screen }) }));

package/portal-ui/dist/index.html

@@ -49,7 +49,7 @@
     -->
     <link rel="preconnect" href="https://api.fontshare.com" crossorigin />
     <link href="https://api.fontshare.com/v2/css?f[]=satoshi@400,500,700,900&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/portal/assets/index-DMthc7PQ.js"></script>
+    <script type="module" crossorigin src="/portal/assets/index-GBbbyQxc.js"></script>
     <link rel="stylesheet" crossorigin href="/portal/assets/index-5CCwiJG7.css">
   </head>
   <body>

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.3.2",
+  "version": "0.3.3-beta.1",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/_shared/count.mjs

@@ -13,8 +13,8 @@
 //
 // SEAM (capabilities.countProbe) — WHERE the number comes from. Same three values enumerate.mjs
 // documents, same meanings:
-//   "endpoint" Clarivate. A real POST /count: cheap, works at ANY magnitude (209012 returned without
-//              complaint), fetches nothing. A true count-only call.
+//   "endpoint" Clarivate. A real POST /count: cheap, works at ANY magnitude, fetches nothing. A true
+//              count-only call.
 //   "cheap"    Corsearch. The count rides page 0 of a normal search (totalHitCount) — so it is one
 //              BILLABLE search with `limit:1 fields:["uri"]`, the smallest response the API will give.
 //              Cheap, not free: every count here is a metered call.