clearotron 0.3.2 → 0.3.3-beta.1

package/providers/_shared/enumerate.mjs

@@ -288,7 +288,18 @@ export function makeEnumerate(deps) {
     const tally = { "verified-zero": 0, enumerated: 0, crowd: 0, unenumerated: 0, error: 0 };
     for (const v of Object.values(term_counts)) tally[v.disposition] += 1;
     const unresolved = tally.crowd + tally.unenumerated + tally.error;
-    if (unresolved === 0 && records.length > 0) {
+    // A FULLY RESOLVED STACK IS A COMPLETE BAND, INCLUDING WHEN THE ANSWER IS ZERO. The comment below
+    // states the rule and the code then demanded a record anyway: `records.length > 0`. So a stack in
+    // which EVERY term resolved to verified-zero — nobody has filed any of these names — fell through
+    // to `incomplete`, which says nobody answered the question. The opposite is true: every term was
+    // asked and every one came back empty.
+    //
+    // It matters beyond the label. An `incomplete` parent is terminal for its when-guarded children, so
+    // a clean zero here held back everything waiting on it — and with the wider families now waiting on
+    // the identical question, that is the best case a matter can have (a mark nobody has registered)
+    // producing a run that searches almost nothing. The ordinary search path has always returned
+    // `enumerated` for a zero-record answer; this rescue path was the one place that did not.
+    if (unresolved === 0) {
       // every term resolved to verified-zero or fully-enumerated ⇒ the union of per-term enumerations IS
       // the complete stack (every record matching ≥1 name sits in some term's enumeration) — a true band.
       return { type: "text", text: JSON.stringify({ state: "enumerated", total_hits: stackTotal, count: records.length, records, term_counts }, null, 2) };
@@ -344,7 +355,9 @@ export function makeEnumerate(deps) {
     const tally = { "verified-zero": 0, enumerated: 0, crowd: 0, unenumerated: 0, error: 0 };
     for (const v of Object.values(class_counts)) tally[v.disposition] += 1;
     const unresolved = tally.crowd + tally.unenumerated + tally.error;
-    if (unresolved === 0 && records.length > 0) {
+    // Same rule, same reason, same correction as the OR-stack rescue above: a stack in which every class
+    // came back a verified zero is a complete band whose answer is zero, not a question nobody answered.
+    if (unresolved === 0) {
       // every class resolved to verified-zero or fully-enumerated ⇒ the union of per-class enumerations
       // IS the complete stack (every record carries ≥1 in-filter class) — a true band, the class rescue.
       return { type: "text", text: JSON.stringify({ state: "enumerated", total_hits: stackTotal, count: records.length, records, class_counts }, null, 2) };

package/providers/_shared/execute-plan.mjs

@@ -18,6 +18,7 @@ import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { nativeScriptIndexGap } from "./script-form.mjs";
 import { entryTermIssues, goodsTermsList } from "./term-shape.mjs";
+import { awaitsReadingTurn } from "./plan-guards.mjs";
 import { faultText, guardToolCall } from "./transport-guard.mjs";
 import { clipProviderText } from "./provider-text.mjs";   // — keep the discriminator
 
@@ -210,10 +211,13 @@ export function queryMarkTerms(e, query) {
   return Array.isArray(e?.terms) ? e.terms : e?.term != null ? [e.term] : [];
 }
 
+// The goods words ride after the class tag (close-verify reads that tag): a goods-narrowed question shares
+// predicate, term and classes with the identical one, and without them the two read as the same question.
 export const describePlanEntry = (e) =>
   `${e.predicate} ${e.terms ? e.terms.join(" OR ") : e.term}`
   + `${typeof e.owner === "string" && e.owner.trim() && String(e.predicate ?? "") !== "owner" ? ` owner:${e.owner.trim()}` : ""}`
-  + ` [cl ${(e.nice_classes ?? []).join(",")}]`;
+  + ` [cl ${(e.nice_classes ?? []).join(",")}]`
+  + `${goodsTermsList(e).length ? ` goods:${goodsTermsList(e).join(" OR ")}` : ""}`;
 
 // Compile one plan entry + its predicate params into the provider's query params (corsearch shapes by
 // default: names/name/owners/owner + nice_classes + regions).
@@ -576,6 +580,20 @@ export function makeExecutePlan(deps) {
     for (const e of targeted.filter((x) => !x.when)) await runEntry(e);
     const skipped = [];
     for (const e of targeted.filter((x) => x.when)) {
+      // A CROWD IS WHAT HOLDS A CHILD BACK, and only a crowd. `enumerated` is the state of a question
+      // that was answered — with records or with none: the ordinary search path returns it for a
+      // zero-record answer too, so a clean zero has always released its children here.
+      //
+      // Where that stopped being true was the RESCUE paths, and it is fixed there rather than here: a
+      // per-term or per-class stack in which every member came back a verified zero was falling through
+      // to `incomplete`, which says nobody answered. See enumerate.mjs — a fully resolved stack is a
+      // complete band whose answer is zero. `verified-zero` is a per-term DISPOSITION and never a band
+      // state (named-band.mjs BAND_STATES), so a guard testing for it here could never fire.
+      // THE READING-TURN WAIT: a family awaiting the reading turn is never released by a RESULT, so there is no
+      // state to read here and no seeded prior state that could release it on a warm followup either.
+      // The reading turn asks for it by minting a supplemental entry, which arrives as its own
+      // ungated entry — this one stands in the plan as the record of a question not asked.
+      if (awaitsReadingTurn(e.when)) { skipped.push(e.qid); continue; }
       if (stateByQid.get(e.when.runs_if_enumerated) === "enumerated") await runEntry(e);
       else skipped.push(e.qid);   // crowd/failed parent is TERMINAL for the fringe — by design, never an error
     }

package/providers/_shared/plan-guards.mjs

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// plan-guards.mjs — what a register plan entry's `when` guard means, read from one place.
+//
+// THE TWO WAITS A PLAN ENTRY CAN CARRY, and they are different questions.
+//
+//   `runs_if_enumerated: <parent qid>` is a fact about a RESULT: this slice runs if its parent question
+//   came back as a list rather than a crowd. A crowd parent is terminal for it.
+//
+//   `awaits_reading_turn: true` is a fact about JUDGMENT NOT YET MADE (ruled 2026-09-21): this family runs
+//   when the reading turn asks for it, having read the identical mark's own list and found it thin. No
+//   result releases it — not the identical question coming back as a comfortable list, not a clean
+//   zero, nothing. The ask arrives as a supplemental entry, so the guarded entry itself never runs: it
+//   stands in the plan as the record of a question deliberately not asked.
+//
+// WHY THIS IS ITS OWN MODULE, on the provider side, rather than a constant in the compiler. Both the
+// COMPILER (driver/register-plan.mjs, which writes the guard and joins it back to the band) and the
+// EXECUTOR (providers/_shared/execute-plan.mjs, which decides what to dispatch) must agree on what a
+// guard means, and a guard the executor does not recognise is not a guard at all — the entry runs as
+// though it were ungated, which is silently the opposite of what was asked for. The executor cannot
+// import the compiler: nothing under providers/ imports driver/, and inverting that for one predicate
+// would invert it for the whole provider tree. So the meaning lives here, where both sides can read
+// it, and neither side carries a second copy to drift.
+
+/** The guard a decision-10 family carries while it waits for the reading turn. Frozen: entries spread a copy. */
+export const AWAITS_READING_TURN = Object.freeze({ awaits_reading_turn: true });
+
+/** Is this guard the ruling-204 wait — the one no result can release? */
+export const awaitsReadingTurn = (when) => when?.awaits_reading_turn === true;
+
+/**
+ * The parent qid a guard waits on, or null where it waits on no question at all.
+ *
+ * Every caller that resolves a guard against a band, validates it against the plan's qids, or reports
+ * which question held an entry back goes through this. A ruling-204 wait names no qid, and a caller
+ * reading `when.runs_if_enumerated` directly would get `undefined` and then decide something about it
+ * — orphan it, look it up and miss, or print it.
+ */
+export const guardParentQid = (when) => (awaitsReadingTurn(when) ? null : when?.runs_if_enumerated ?? null);

package/providers/clarivate/src/capabilities.js

@@ -97,8 +97,7 @@ export const CAPABILITIES = Object.freeze({
   // fails loud with tooManyResults past 30000. There is no partial mode and no cursor.
   pagination: "single-shot",
   // …which is exactly why the enumerate ceiling must be tested BEFORE the search, via the cheap
-  // POST /count — it works at ANY magnitude (209012 returned without complaint) and returns per-office
-  // counts in one call.
+  // POST /count — it works at ANY magnitude and returns per-office counts in one call.
   countProbe: "endpoint",
   // A count CAN be narrowed to live filings here — queryOptions.activeOnly (buildSearchRequest's
   // `active_only`). Declared because it diverges from corsearch, which has no status clause at all;
@@ -107,7 +106,8 @@ export const CAPABILITIES = Object.freeze({
   countStatusFilter: "live",
   // JSON body, not a URI: the bound is the parser's own document-nesting cap, which the vendor names in
   // the refusal it answers a stack wider than this with. Not a URI length, so widening is not the fix.
-  maxOrWidth: 500,
+  // A 498-term stack is refused at that cap and a 496-term stack is not, so 496 is the declared width.
+  maxOrWidth: 496,
   // ONE call: INT_CLASS_NUMBER value "9 OR 28 OR 41 OR 42" (or "9,28,41,42") = the deduplicated union.
   classFilter: "native",
   // POST /text, EXACTLY 100 ids per call — a longer list is refused — and the call is BILLED: screening an
@@ -239,6 +239,16 @@ export const CAPABILITIES = Object.freeze({
   goodsTextMultiWord: "ordered-phrase",
   // Several goods terms ride ONE clause joined by OR — this register expresses a list natively.
   goodsTextListOr: true,
+  // ── THE SHORTEST TERM THE CONTAINS FORM ACCEPTS: none known, so none declared ───────────────────
+  //
+  // No vendor document available to this repository states one: the vendor publishes no public
+  // reference for this search API, and none was found on 2026-09-22. What is measured is narrower and is
+  // handled in core.js: a ONE-character first or last token inside a phrase chain is refused (HTTP
+  // 500), and two characters are answered. A two-letter `*TERM*` on its own is not recorded either way.
+  //
+  // `null` means the compiler keeps asking the contains form at every length, which is what this
+  // register has always been sent. A declared number must come from the vendor, not from a guess.
+  containsMinLength: null,
   // The operator the goods clause rides. `EQUALS` on WHOLE WORDS: `CONTAINS` is a hard 400 here
   // exactly as it is on APPLICANT_NAME, and so is a mid-word wildcard. Several words are asked for
   // with `OR` inside the value.
@@ -285,7 +295,7 @@ export const CAPABILITIES = Object.freeze({
   // WIRED: providers/clarivate/src/core.js builds its enumerate from
   // makeEnumerate({ capabilities: {...CAPABILITIES.kernel} }) — these values are the LIVE seam settings,
   // no longer a design note. pageGuard is 1 because /search is single-shot: there is no page 2 to
-  // fetch, so the guard can only ever be a backstop. namesChunkDefault = maxOrWidth (500): the kernel
+  // fetch, so the guard can only ever be a backstop. namesChunkDefault = maxOrWidth (496): the kernel
   // chunks a wide OR-stack to the parser's nesting bound before it reaches the wire.
   kernel: Object.freeze({
     countProbe: "endpoint",
@@ -293,7 +303,7 @@ export const CAPABILITIES = Object.freeze({
     pageSize: 100,
     pageGuard: 1,                          // single-shot: there is no page 2
     ceilingDefault: 600,
-    namesChunkDefault: 500,
+    namesChunkDefault: 496,
     providerWindow: "30000-result hard ceiling (tooManyResults, fails loud)",
     // POST /search returns BARE GUIDS — the search row carries no mark text, classes, status or owner.
     // POST /text (the screen call) is therefore the SOLE content source for an enumerated band, which

package/providers/clarivate/src/core.js

@@ -90,6 +90,9 @@ export async function clarivateFetch(apiKey, base, path, { body = null, method =
       attempts = i + 1;
       resp = await fetch(url, init);
       if (resp.ok || resp.status < 500 || i === retries) break;
+      // A 500 wrapping the search service's 400 is a refusal of the query as written, not weather: the
+      // same request is refused the same way, so it is not sent again (countFailureReason below).
+      if (WRAPPED_REFUSAL.test(await resp.clone().text().catch(() => ""))) break;
       await new Promise((r) => setTimeout(r, 1500 * (i + 1)));
     }
   } catch (err) {
@@ -1113,13 +1116,45 @@ export async function doSearch(apiKey, base, params, tctx) {
 }
 
 // ── Count ─────────────────────────────────────────────────────────────────────────────────────────
-// POST /count takes the SAME SearchRequest body as /search, is cheap, works at ANY magnitude (209012
-// returned without complaint) and returns PER-OFFICE counts in one call. This is the enumerate
+// POST /count takes the SAME SearchRequest body as /search, is cheap, works at ANY magnitude and
+// returns PER-OFFICE counts in one call. This is the enumerate
 // kernel's countProbe:"endpoint" dependency, so it returns the kernel's plain probe shape
 // { ok, total, reason } — plus `per_office`, which is richer than corsearch can offer and rides into
 // the crowd descriptor for judgment.
 
 /** ONE /count round trip over already-resolved params. Returns the kernel's plain probe shape. */
+// ── A REFUSED QUERY IS NAMED AS ONE, with the size of what was sent ─────────────────────────────────
+//
+// The vendor answers a query its search service cannot take with that service's 400, delivered inside
+// its own 500: `INTERNAL_SERVER_ERROR - 400 on POST request for "…/search"`. Passed on as a bare HTTP 500
+// it reads as an outage and names nothing an operator can act on. A query that is too wide is the common
+// case: the service's bound is the number of OR terms in one field, which is about 496, not the query's
+// length.
+// The reason says so: the widest OR stack's term count and characters, and this provider's declared
+// width. It avoids the words `HTTP 400`, which providerRejectedTheQuery reads as a cue to retry an owner
+// stack on the caller's own term; that behaviour is unchanged.
+//
+// AND IT IS A CAPABILITY GAP. The service refused the query as written and will refuse the identical query
+// every time, so the reason carries CAPABILITY_GAP_MARKER: the plan executor defers the slice as a
+// disclosed gap at once, as it does a query buildSearchRequest refuses before sending, instead of sending
+// it round the recovery ladder. On production that ladder re-sent a refused 500-term query and spent a
+// recovery park each time. Every other HTTP failure keeps the transient reading.
+const WRAPPED_REFUSAL = /\b400\s+on\s+POST\s+request\b/;
+const widestOrStack = (body) => (body?.searchFields ?? []).reduce((best, f) => {
+  const v = String(f?.value ?? "");
+  const terms = v ? v.split(" OR ").length : 0;
+  return terms > best.terms ? { terms, chars: v.length } : best;
+}, { terms: 0, chars: 0 });
+export function countFailureReason(status, words, body) {
+  if (status !== 500 || !WRAPPED_REFUSAL.test(String(words ?? ""))) return `HTTP ${status}${words ? `: ${words}` : ""}`;
+  const w = widestOrStack(body);
+  // THE NUMBERS COME LAST. The executor clips a failed slice's reason to its head and tail, and its own
+  // prefixes fill the head, so a count placed early is elided; the tail is what a run's record keeps.
+  return `${CAPABILITY_GAP_MARKER} register_refused_query: the register refused this query as malformed (a 400 inside its `
+    + `HTTP 500). Provider's words: ${words}. Sent ${w.terms} OR terms (${w.chars} characters); this provider's declared `
+    + `width is ${CAPABILITIES.maxOrWidth} terms.`;
+}
+
 async function countOnce(apiKey, base, p, tctx) {
   let body;
   try { body = buildSearchRequest(p); }
@@ -1129,11 +1164,12 @@ async function countOnce(apiKey, base, p, tctx) {
   // Marked as a capability gap so the plan executor DEFERS the slice — a disclosed coverage row the
   // lawyer reads — instead of stamping a transient error and grinding the whole run to a fan-in
   // StageFailure over an answer that will never differ. A real HTTP failure below keeps the transient
-  // reading and rides the repair ladder, exactly as before.
+  // reading and rides the repair ladder, exactly as before, except a query the service refused as written
+  // (countFailureReason above).
   catch (e) { return { ok: false, total: null, per_office: null, reason: `${CAPABILITY_GAP_MARKER} ${e.message}` }; }
 
   const r = await clarivateFetch(apiKey, base, "/count", { body, tctx: { ...tctx, target: String(echoOf(p)).slice(0, 200) } });
-  if (!r.ok) return { ok: false, total: null, per_office: null, reason: `HTTP ${r.status}${errText(r) ? `: ${errText(r)}` : ""}` };
+  if (!r.ok) return { ok: false, total: null, per_office: null, reason: countFailureReason(r.status, errText(r), body) };
   // Named rather than folded into the "no counts{}" branch below: both refuse (total null, never 0),
   // but someone repairing a run needs to know the response was CUT, not that the provider answered in
   // a shape we did not expect.
@@ -1734,7 +1770,7 @@ export async function doEnumerate(apiKey, base, params, tctx) {
 //     dictated a count instead of an enumerate. POST /search FAILS LOUD past 30000 (tooManyResults),
 //     so routing the count probe through it would return an ERROR string, the executor would stamp the
 //     block error:true, and a SANCTIONED CROWD would be counted MISSING — doctrine 5 inverted. POST
-//     /count never fails on magnitude (209012 returned without complaint) and carries per-office truth.
+//     /count never fails on magnitude and carries per-office truth.
 //     `countParams` is therefore {}: buildSearchRequest has no `limit` knob to honour, and passing a
 //     dead parameter would only imply one exists.
 //

package/providers/corsearch/src/capabilities.js

@@ -133,6 +133,10 @@ export const CAPABILITIES = Object.freeze({
   // Several goods terms become several `product:` clauses, and within one field this query language
   // ORs them implicitly — the same "any of these words" the explicit OR writes elsewhere.
   goodsTextListOr: true,
+  // The shortest term the contains form accepts: none known, so none declared. The vendor publishes no
+  // public reference for this API (none was found on 2026-09-22), and no short-term refusal has been
+  // measured here. `null` keeps the contains form at every length; see clarivate/capabilities.js.
+  containsMinLength: null,
   // ── WHICH FORM OF A NON-LATIN MARK DOES THE INDEX HOLD? ──────────────────────────────────────────
   // `true` = the CHARACTERS. A native-script term is a legitimate, productive query here and MUST be
   // sent — the shared executor's script-form refusal (providers/_shared/script-form.mjs) is switched

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,13 @@
 # trademark-oauth-mcp-bridge
 
+## 0.3.3-beta.1
+
+No changes in this release.
+
+## 0.3.3-beta.0
+
+No changes in this release.
+
 ## 0.3.2
 
 No changes in this release.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.3.2",
+  "version": "0.3.3-beta.1",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/providers/signa/src/capabilities.js

@@ -154,6 +154,23 @@ export const CAPABILITIES = Object.freeze({
   // So the compiler does not build a multi-term goods entry for this provider, and it must never fall
   // back to a space-joined string. No coverage is lost: the broad class-wide sweep still runs.
   goodsTextListOr: false,
+  // ── THE SHORTEST TERM THE CONTAINS FORM ACCEPTS: 3 folded characters, documented ────────────────
+  //
+  // Signa's API reference, "Search trademarks", section "Match modes" (docs.signa.so/api-reference/
+  // trademarks/search-trademarks, read 2026-09-22): "Deterministic modes accept a single-character `q`
+  // (one non-empty folded char), whereas `similar` requires at least 2 folded chars and `contains`
+  // requires at least 3." The same page's validation rules repeat it. A shorter term on `contains` is a
+  // hard 400 ("match=contains requires q to be at least 3 characters (after case/accent folding) to
+  // avoid an over-broad substring scan").
+  //
+  // The compiler reads this: a goods-narrowed question or a saturation probe whose term is shorter is
+  // asked on the exact form instead, with the same class and goods filters, and the plan entry says so.
+  // Exact goes out as the ranked `strategies: ["exact"]`, which `similar`'s 2-character floor governs,
+  // so a two-letter mark is answered; a one-letter mark is below both floors and stays refused.
+  containsMinLength: 3,
+  // The ranked shape's floor: "`similar` requires at least 2 folded chars" (same page). An exact question
+  // shorter than this goes out on the deterministic `match`, which takes one; from here up it stays ranked.
+  rankedMinLength: 2,
   // Search rows already carry status / nice_classes / owner_name → screening is inline, zero extra calls.
   screenSource: "search-row",
   // No hard result ceiling, and no total to compare one against.
@@ -168,8 +185,6 @@ export const CAPABILITIES = Object.freeze({
   //
   //   strategies[]  exact | phonetic | fuzzy | prefix                        — ranked, several per call
   //   match         similar | exact | starts_with | ends_with | contains     — deterministic, one only
-  //
-  // Every value below was run against the live API with the resulting total recorded.
   predicates: Object.freeze({
     exact:          "exact",        // strategies[] — the deterministic shape, the ranked one for audit continuity
     // `contains` IS the unanchored mode this contract said did not exist. The old header
@@ -177,12 +192,11 @@ export const CAPABILITIES = Object.freeze({
     // contains slice is a substring sweep, and they return different sets. It never needed to be
     // fuzzy; it needed the deterministic shape, which nothing here had.
     //
-    // ONE LIVE CONSTRAINT NOT IN THE PUBLISHED SPECIFICATION: deterministic modes take a
-    // query of 1 character or more. `contains` in fact demands THREE — "match=contains requires q to
-    // be at least 3 characters (after case/accent folding) to avoid an over-broad substring scan."
-    // A one- or two-character element therefore cannot ride this predicate, and it fails loud (400)
-    // rather than quietly returning a narrower set. Recorded because it is the second place in this
-    // file where the document and the wire disagree, and the wire is the one that answers queries.
+    // A LENGTH FLOOR THE VENDOR DOCUMENTS: deterministic modes take a query of 1 character or more,
+    // and `contains` demands THREE — "match=contains requires q to be at least 3 characters (after
+    // case/accent folding) to avoid an over-broad substring scan." A one- or two-character element
+    // therefore cannot ride this predicate, and it fails loud (400) rather than quietly returning a
+    // narrower set. `containsMinLength` above declares it, and the compiler asks such a term exactly.
     default:        "contains",
     // `starts_with`, NOT the `prefix` strategy. Both exist and the executor uses this one:
     // planPredicateParams emits `match_mode: "starts_with"` for a trailing-`*` entry and never emits

package/providers/signa/src/core.js

@@ -30,6 +30,9 @@ import { nonAnswerBodyError, parseJsonBody, unparsedBodyError } from "../../_sha
 import { makeEnumerate, isOwnerScoped } from "../../_shared/enumerate.mjs";
 import { makeExecutePlan } from "../../_shared/execute-plan.mjs";
 import CAPABILITIES, { SIGNA_OFFICE_KEYS, OWNER_SCOPED_WINDOW } from "./capabilities.js";
+// The register's own measure of a term's length: case and accents folded, spaces not counted — the same
+// measure its documented floors are stated in (the compiler's foldedTermLength counts the same way).
+const foldedLength = (q) => [...String(q ?? "").normalize("NFKD").replace(/\p{M}/gu, "").toLowerCase().replace(/\s+/g, "")].length;
 import { SIGNA_OFFICE_SNAPSHOT } from "./offices.generated.js";
 
 export const DEFAULT_BASE = "https://api.signa.so";
@@ -660,8 +663,16 @@ export function toSignaParams(p = {}) {
   // `match`. exact/phonetic stay on strategies, which is what this provider has always sent and what
   // its fixtures were captured with; the anchored and unanchored modes can only be expressed by
   // `match`, so they select that shape and drop strategies.
+  //
+  // EXACT BELOW THE RANKED FLOOR ONLY. The ranked shape takes `similar`'s floor of two folded
+  // characters, so a one-letter exact question is refused there. The deterministic `match: "exact"`
+  // takes one, but it asks a narrower question: "`exact` requires the whole mark to equal `q`", where
+  // the ranked `exact` strategy also returns longer marks that contain the term, which is the recall an
+  // identical question relies on. So exact stays ranked from the floor up, and only a term below it
+  // goes deterministic, where it is answered rather than refused.
   const mode = String(p.match_mode ?? "").trim();
-  if (mode === "exact" || mode === "phonetic" || mode === "prefix") out.strategies = [mode];
+  if (mode === "exact" && foldedLength(out.query) < CAPABILITIES.rankedMinLength) out.match = "exact";
+  else if (mode === "exact" || mode === "phonetic" || mode === "prefix") out.strategies = [mode];
   else if (mode === "starts_with" || mode === "ends_with" || mode === "contains") out.match = mode;
   // ── `default` IS THE COUNT LANE'S WORD FOR THE SAME UNANCHORED QUERY THE PLAN LANE CALLS `{}` ────
   //

package/scripts/demo-evidence.mjs

@@ -0,0 +1,114 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+// demo-evidence.mjs — THE HAND-WRITTEN DIFF MUST BE REVIEWABLE ON ITS OWN.
+//
+// One integration branch carried 37 commits, 2,490 files, 221,105 additions and 410,984 deletions, and
+// most of it was regenerated demo evidence. A reviewer cannot find the source changes inside that, so
+// in practice nobody reads them — the review happens, and it reviews nothing. The evidence is not the
+// problem: it is generated output, it is meant to change wholesale, and it is right that it ships.
+// Mixing it into the same commits as hand-written code is the problem.
+//
+// TWO HALVES, because a convention nobody checks is a convention that lasts one beta:
+//
+//   --check    a commit that touches `demo/` touches nothing else, across a range
+//   --apply    re-record `demo/MANIFEST.json` — generator, tree, and the run each product replays
+//
+// The manifest is what makes the regeneration commit self-explaining: without it a reviewer skipping
+// the demo diff is taking on trust that it IS regenerated output rather than a hand edit hidden in
+// 200,000 lines. With it, the thing they are skipping says what produced it.
+
+import { execFileSync } from "node:child_process";
+import { readFileSync, writeFileSync, readdirSync, existsSync, statSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
+export const MANIFEST = join(ROOT, "demo", "MANIFEST.json");
+export const GENERATOR = "scripts/freeze-example-run.mjs";
+
+const git = (...args) => execFileSync("git", args, { cwd: ROOT, encoding: "utf8" }).trim();
+
+/** Every product directory under `demo/`, with the run it replays. */
+export function products({ root = ROOT } = {}) {
+  const dir = join(root, "demo");
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir)
+    .filter((name) => statSync(join(dir, name)).isDirectory())
+    .sort()
+    .map((name) => {
+      let meta = {};
+      try { meta = JSON.parse(readFileSync(join(dir, name, "meta.json"), "utf8")); } catch { /* absent is an answer */ }
+      return { product: name, runId: meta.runId ?? null, template: meta.template ?? null };
+    });
+}
+
+/**
+ * Is this a commit that mixes generated evidence with hand-written source?
+ * Returns the offending paths, or an empty array. PURE given the file list.
+ */
+export function mixedPaths(files) {
+  const demo = files.filter((f) => f.startsWith("demo/"));
+  if (!demo.length) return [];                       // touches no evidence — nothing to say
+  return files.filter((f) => !f.startsWith("demo/"));
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const apply = process.argv.includes("--apply");
+
+  if (apply) {
+    writeFileSync(MANIFEST, `${JSON.stringify({
+      note: "What produced the evidence under demo/. Re-recorded by scripts/demo-evidence.mjs --apply in the same commit that regenerates it.",
+      generator: GENERATOR,
+      recordedFromTree: git("rev-parse", "HEAD"),
+      products: products(),
+    }, null, 2)}\n`);
+    console.log(`recorded ${products().length} demo product(s) against ${git("rev-parse", "--short", "HEAD")}`);
+    process.exit(0);
+  }
+
+  // --check: every commit in the range keeps its evidence to itself.
+  const base = process.argv[process.argv.indexOf("--base") + 1] || "origin/main";
+
+  // ── A BASE THIS CHECKOUT CANNOT RESOLVE IS A FAILURE TO LOOK, AND IT SAYS SO ────────────────────
+  //
+  // A shallow clone fetches one branch, so `origin/main` is not a ref in it and `rev-list base..HEAD`
+  // dies on an ambiguous argument — a stack trace naming a line of this file, which reads as a broken
+  // script rather than as a checkout that cannot answer the question. It is neither a clean range nor
+  // a mixed one: nothing was compared. Falling back to another base would be worse, because a range
+  // measured against something the caller did not ask for reports a clean result for a population it
+  // never examined.
+  try { git("rev-parse", "--verify", "--quiet", `${base}^{commit}`); }
+  catch {
+    console.error(`demo-evidence: this checkout has no "${base}", so no commit was compared.`);
+    console.error("");
+    console.error("Nothing is known about the range either way — this is not a clean result. A shallow");
+    console.error("checkout carries only the branch it fetched; fetch the base ref, or name one this");
+    console.error("clone holds with --base.");
+    process.exit(2);
+  }
+
+  const shas = git("rev-list", `${base}..HEAD`).split("\n").filter(Boolean);
+  const bad = [];
+  for (const sha of shas) {
+    const files = git("show", "--name-only", "--pretty=format:", sha).split("\n").filter(Boolean);
+    const mixed = mixedPaths(files);
+    if (mixed.length) bad.push({ sha, mixed });
+  }
+
+  if (!bad.length) {
+    console.log(`demo-evidence: ${shas.length} commit(s) against ${base}; none mixes generated evidence with source.`);
+    process.exit(0);
+  }
+
+  console.error("demo-evidence: generated evidence is mixed with hand-written source.\n");
+  console.error("A reviewer cannot find the source diff inside a regeneration, so in practice nobody reads it.\n");
+  for (const { sha, mixed } of bad) {
+    console.error(`  ${sha.slice(0, 9)} also touches ${mixed.length} non-demo path(s):`);
+    for (const f of mixed.slice(0, 5)) console.error(`      ${f}`);
+    if (mixed.length > 5) console.error(`      …and ${mixed.length - 5} more`);
+  }
+  console.error("\nSplit the regeneration into its own commit:");
+  console.error("  git reset HEAD~ && git add demo && git commit && git add -A && git commit");
+  process.exit(1);
+}

package/scripts/e2e.mjs

@@ -3207,7 +3207,7 @@ async function cmdReport(id, { round: requestedToken = null } = {}) {
     // Five test runs did exactly this in the seven days to 2026-08-25. The answer to "was this
     // delivered" is therefore its own line, above, in the words used for a failed order.
     console.log(`  ${deliveryLine(st)}`);
-    console.log(`  state=${st.state ?? "?"} verdict=${st.verdict ?? "-"} sendPending=${st.sendPending}`);
+    console.log(`  state=${st.state ?? "?"} tier=${st.tier ?? "-"} signoff=${st.review?.signoff ?? st.verdict ?? "-"} sendPending=${st.sendPending}`);
 
     // Which skills changed since this run started — the resume question, stated as fact not as a rule.
     // — THE THREE ANSWERS THIS CHECK CAN GIVE, and it used to give one of them silently.

package/scripts/engine-probe.mjs

@@ -10,9 +10,9 @@
 // ── WHY THIS EXISTS ─────────────────────────────────────────────────────────────────────────────────
 //
 // `probeEngineTurn` is the smallest thing that genuinely exercises an engine: one Haiku-tier turn at low
-// effort on a six-word prompt, through the adapter's own spawn path, with no MCP config, no tools, no
-// skills dir and no run dir. It answers the one question an operator asks before spending anything —
-// CAN this box run a turn, and under the billing mode it thinks it is using.
+// effort, through the adapter's own spawn path, asked to call the one tool on the probe's own server, with
+// no skills dir and no run dir. It answers the one question an operator asks before spending anything —
+// CAN this box run a turn that uses a tool, and under the billing mode it thinks it is using.
 //
 // It had no way to be asked. Its only callers were `bin/onboard.mjs` (the setup wizard, which asks it
 // once, inside a flow) and `preflightEngineTurn` in `pipeline.mjs` (which asks it at the start of a run,
@@ -28,8 +28,9 @@
 // ── WHAT A GREEN PROBE DOES NOT PROVE, from the module's own header ─────────────────────────────────
 //
 // The cheap tier only. Both tiers ride one credential, so AUTH is proven for all of them — a per-tier
-// model entitlement or per-tier quota is not. And it sets up no tools, no gather MCP, no skills and no
-// run dir, so none of that path is touched. A probe that says `ok` says the door opens.
+// model entitlement or per-tier quota is not. It calls one tool on its own server, so the tool path is
+// proven and no stage's tool server is; it sets up no skills and no run dir. A probe that says `ok` says
+// the door opens.
 
 // FIRST IMPORT, AND IT HAS TO BE. This entry statically reaches driver.config.mjs, which captures
 // env at module top — and every static import evaluates before this file's own body runs, so applying the

package/scripts/env-audit.mjs

@@ -557,7 +557,7 @@ export function auditEnv(root = ROOT) {
 //                         4  read RIGHT NOW through an idiom no `env`-prefixed regex can reach —
 //                            envValue("CLEAROTRON_MAX_RETRIES") and
 //                            envValue("CLEAROTRON_RATE_LIMIT_DEFAULT_BACKOFF_MS") (driver.config.mjs:486,
-//                            :494), envOn("CLEAROTRON_DUMP_JSON") (gateway.mjs:1423), and
+//                            :494), envOn("CLEAROTRON_DUMP_JSON") (runStageLadder() in gateway.mjs), and
 //                            `export const API_KEY_ENV = "USPTO_API_KEY"` (providers/uspto-local/src/sync.js:77).
 //                            The name is a STRING LITERAL in every one; it just never sits beside an
 //                            `env` token. USPTO_API_KEY is a credential.

package/scripts/freeze-example-run.mjs

@@ -69,8 +69,8 @@ const FROZEN_FILES = [
   { path: "_driver/senior-rights.json", why: "publish/index.mjs:787 seniorRights" },
   { path: "_driver/verdict.json", why: "publish/index.mjs:792 verdictInfo" },
   { path: "_driver/framework.json", why: "publish/index.mjs, the frozen band vocabulary the run was rated under" },
-  { path: "_driver/register-plan.json", why: "publish/index.mjs:901 scopeBasis" },
-  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:902 searchedJurisdictions, the fallback for register-plan" },
+  { path: "_driver/register-plan.json", why: "publish/index.mjs:910 scopeBasis" },
+  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:911 searchedJurisdictions, the fallback for register-plan" },
   { path: "_driver/enforcer-signals.json", why: "`esPath` declared in index.mjs" },
   { path: "_driver/predelivery-lint.json", why: "publish/index.mjs:172 lintSink" },
   { path: "_driver/escalation-state.json", why: "publish/index.mjs:173 escSink" },
@@ -118,7 +118,7 @@ const KNOCKOUT_FILES = [
   // knockout report render empty (publish/knockout.mjs:140-155). Named by stages-knockout.mjs:32,41.
   { path: "_driver/register-counts.json", why: "publish/knockout.mjs:140-155 counted figures + the Register column" },
   { path: "_driver/register-records.json", why: "stages-knockout.mjs:41 the terms behind the close-variation axis" },
-  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:902 searchedJurisdictions, the fallback for register-plan" },
+  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:911 searchedJurisdictions, the fallback for register-plan" },
 ];
 
 /** The allowlist for a template. One place, so a new template cannot half-exist. */