clearotron 0.3.3 → 0.4.0-beta.0

package/mcp-server/lib/http-handler.mjs

@@ -278,7 +278,11 @@ export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions,
               : send(res, 401, { error: `invalid trademark token: ${e.message}` });
           }
           const transport = await createSession(sessions, scope, user.email);
-          entry = { transport, sub: scope.sub ?? null, kind: scope.kind ?? null };
+          // `namesVerbs` rides with the session so EVERY call it makes is audited with it, not only the
+          // first: an ops token that names no verbs is being retired (re-issued with verbs, then refused),
+          // and the audit is how the live ones are found. Whether it names verbs, never which, never the token.
+          const namesVerbs = scope.kind === "ops" ? Array.isArray(scope.verbs) && scope.verbs.length > 0 : null;
+          entry = { transport, sub: scope.sub ?? null, kind: scope.kind ?? null, namesVerbs };
           // STAMP THE SCOPE'S OWN FACTS ONTO THE STORED ENTRY, HERE, AND AFTER THE HANDSHAKE.
           //
           // `createSession` is injected, and every caller carries its own copy of the entry shape — two
@@ -293,7 +297,7 @@ export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions,
           // and left the gate reading a field nobody had set — green, and doing nothing.
           stampScope = () => {
             const stored = transport.sessionId ? sessions.get(transport.sessionId) : null;
-            if (stored) { stored.sub = scope.sub ?? null; stored.kind = scope.kind ?? null; }
+            if (stored) { stored.sub = scope.sub ?? null; stored.kind = scope.kind ?? null; stored.namesVerbs = namesVerbs; }
           };
         } else {
           if (entry.email && entry.email !== user.email) {
@@ -328,7 +332,7 @@ export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions,
         // `finish` fires once the response is fully sent, which is when `res.statusCode` is the answer
         // the caller got rather than the default it started as.
         res.once("finish", () => {
-          try { appendAudit({ email: user.email, sub: entry.sub ?? null, body, status: res.statusCode, door }); }
+          try { appendAudit({ email: user.email, sub: entry.sub ?? null, kind: entry.kind ?? null, namesVerbs: entry.namesVerbs ?? null, body, status: res.statusCode, door }); }
           catch { /* best-effort */ }
         });
         const answered = entry.transport.handleRequest(req, res, body);

package/mcp-server/mint-token.mjs

@@ -15,7 +15,7 @@
 // intake connector never needs stop_run.
 
 import { fileURLToPath } from "node:url";
-import { mintToken, verifyToken, TOOL_SCOPES } from "../shared/scope.mjs";
+import { mintToken, verifyToken } from "../shared/scope.mjs";
 import { homedir } from "node:os";
 import { defaultDenylistPath } from "../shared/client-door.mjs";   // — one owner for the path
 import { isEntrypoint } from "../shared/is-entrypoint.mjs";   // — one entry-point test, all spellings
@@ -25,7 +25,7 @@ function fail(msg, code = 1) { process.stderr.write(`mint-token: ${msg}\n`); pro
 const USAGE = `usage: node mint-token.mjs --scope ops|user|account [options]
   --scope ops        an automation/operator principal (write verbs allowed)
     --sub <name>       REQUIRED for ops: the principal name (rides into the audit log)
-    --verbs a,b        least-privilege write-verb allowlist (recommended; omit = full ops)
+    --verbs a,b        REQUIRED for ops: the write tools this token may call
     --accounts a,b     GRANTS cap: the account keys (profileKeys) this token may see/start (omit = all)
     --ttl-days <n>     default 30
   --scope user       a run-bound report-link token (read-only client layer)
@@ -76,6 +76,12 @@ export function mintFromOptions({ scope, sub = null, runId = null, ttlDays, verb
   // They belong here rather than at either caller for exactly the reason the extraction existed: a rule
   // enforced by one of two callers is a rule the other one does not have.
   if (scope === "ops" && !sub) throw new Error("--sub is required for an ops token — the audit log must name the principal");
+  // AN OPS TOKEN NAMES ITS VERBS. One that named none held every write verb, and over the network that
+  // included starting a what-if; it is the most valuable credential the product issues, so it is no longer
+  // issued. Tokens already out keep working: the door records their use (the audit line's `namesVerbs`) so
+  // they can be found, re-issued with verbs and then refused, in that order.
+  if (scope === "ops" && !(Array.isArray(verbs) && verbs.length))
+    throw new Error("--verbs is required for an ops token — name the write tools it may call, for example --verbs start_run,stop_run");
   if (scope === "user" && !runId) throw new Error("--run is required for a user token (it is bound to exactly one run)");
   if (scope === "account" && !sub) throw new Error("--sub is required for an account key — it names the grants-file identity the key reads its accounts from");
   if (!Number.isFinite(ttlDays) || ttlDays <= 0) throw new Error("--ttl-days must be a positive number");
@@ -110,10 +116,6 @@ export function mintFromOptions({ scope, sub = null, runId = null, ttlDays, verb
   notes.push(`revoke this TOKEN specifically: add "${t.jti}" as a line in ${denylistFile()}`);
   if (scope === "account")
     notes.push(`the grants row IS the reach — an account key reads its accounts from the grants file on every request`);
-  if (scope === "ops" && !verbs) {
-    const writable = Object.keys(TOOL_SCOPES).filter((k) => TOOL_SCOPES[k].write);
-    notes.push(`note: FULL ops authority (${writable.join(", ")}) — consider --verbs for automation principals`);
-  }
   return { token, claims: t, notes };
 }
 

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.3.3",
+  "version": "0.4.0-beta.0",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/mcp-server/server.mjs

@@ -851,6 +851,16 @@ export function attachHandlers(server, { scope = { kind: "ops", runId: null }, l
     let authedArgs;
     try { authedArgs = authorize(scope, name, args); }
     catch (e) { log(`authz deny ${name} [${scope.kind}]: ${e.message}`); return { isError: true, content: [{ type: "text", text: `FORBIDDEN (${name}): ${e.message}` }] }; }
+    // THE LISTING IS THE WALL. A tool this session's audience is not shown is one it cannot call: this
+    // used to filter only the listing, and a hidden tool called by name ran anyway once authorize()
+    // passed it. That is how an ops token reached what_if_run over HTTP, where the listing hides it and
+    // the engine starts. After authorize(), so a caller it already refuses keeps the refusal it names;
+    // this catches only what it lets through. Same answer as a name that does not exist, because to this
+    // session it does not.
+    if (!allow(name)) {
+      log(`listing deny ${name} [${scope.kind}${local ? "" : ", http"}]: not offered to this session`);
+      return { isError: true, content: [{ type: "text", text: `unknown tool "${name}"` }] };
+    }
     // ACCOUNT GATE (GRANTS, INSTALL.md §8): a run-addressed call from an account-scoped session must
     // target a run inside the grant. Enforced BEFORE dispatch so a denied run leaks nothing — not even
     // its existence (the deny message names the account, never the run's contents).

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clearotron",
   "type": "module",
-  "version": "0.3.3",
+  "version": "0.4.0-beta.0",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/portal-ui/dist/assets/{index-GBbbyQxc.js → index-DVtz44vH.js}

@@ -11865,6 +11865,7 @@ var api = {
 		accountNames: Object.fromEntries(Object.entries(asRecord(b["accountNames"])).filter(([, v]) => typeof v === "string" && v)),
 		accountFacts: Object.fromEntries(Object.entries(asRecord(b["accountFacts"])).map(([k, v]) => [k, asCompanyFacts(v)])),
 		concurrentRuns: asNumber(b["concurrentRuns"]),
+		houseMarketplaces: asStrings(b["houseMarketplaces"]),
 		engineMode: b["engineMode"] === "demo" ? "demo" : b["engineMode"] === "engine-unproven" ? "engine-unproven" : null,
 		engineProgramDisputed: b["engineProgramDisputed"] === true ? true : b["engineProgramDisputed"] === false ? false : null,
 		setupRoute: b["setupRoute"] === "packaged" ? "packaged" : b["setupRoute"] === "checkout" ? "checkout" : null,
@@ -21701,6 +21702,8 @@ var PROFILE_FIELDS = [
 		label: "Marketplaces",
 		kind: "lines",
 		group: "defaults",
+		picker: "marketplaces",
+		clearToEmptyList: true,
 		item: {
 			ok: (e) => {
 				const d = e.trim().toLowerCase();
@@ -21752,7 +21755,10 @@ var PROJECT_EDITABLE = new Set([
 	"industry",
 	"defaultProduct"
 ]);
-var projectFields = () => PROFILE_FIELDS.filter((f) => PROJECT_EDITABLE.has(rootKey(f)) && !f.customerOnly);
+var projectFields = () => PROFILE_FIELDS.filter((f) => PROJECT_EDITABLE.has(rootKey(f)) && !f.customerOnly).map((f) => f.clearToEmptyList ? {
+	...f,
+	clearToEmptyList: false
+} : f);
 var choiceLabel = (spec, value) => spec.choices?.find((c) => c.value === value)?.label ?? null;
 function depthChoices(products) {
 	return products.map((l) => {
@@ -21800,6 +21806,10 @@ function applyField(draft, spec, raw) {
 	const next = { ...draft };
 	const trimmed = raw.trim();
 	if (!trimmed) {
+		if (spec.clearToEmptyList) {
+			next[spec.key] = [];
+			return next;
+		}
 		if (spec.clearWith !== void 0) {
 			next[spec.key] = spec.clearWith;
 			return next;
@@ -21947,7 +21957,7 @@ var suggestionStyle = {
 	background: "var(--surface-raised)",
 	color: "var(--text-muted)"
 };
-function FieldPicker({ spec, value, onChange }) {
+function FieldPicker({ spec, value, onChange, suggestions = [] }) {
 	const [query, setQuery] = (0, import_react.useState)("");
 	const addId = (0, import_react.useId)();
 	const addBox = (0, import_react.useRef)(null);
@@ -22026,7 +22036,43 @@ function FieldPicker({ spec, value, onChange }) {
 			})]
 		});
 	}
-	const suggestions = matchTerritoriesIn(TERRITORIES, query, chosen, 8);
+	if (spec.picker === "marketplaces") {
+		const have = new Set(chosen.map((c) => c.trim().toLowerCase()));
+		const offered = suggestions.filter((d) => !have.has(d.trim().toLowerCase()));
+		return (0, import_jsx_runtime.jsxs)("div", {
+			style: { marginTop: 6 },
+			children: [offered.length ? (0, import_jsx_runtime.jsx)("div", {
+				style: {
+					display: "flex",
+					flexWrap: "wrap",
+					gap: 4
+				},
+				children: offered.map((d) => (0, import_jsx_runtime.jsxs)("button", {
+					type: "button",
+					onClick: () => toggle(d),
+					style: suggestionStyle,
+					children: ["+ ", d]
+				}, d))
+			}) : null, chosen.length ? (0, import_jsx_runtime.jsx)("div", {
+				className: "chip-row",
+				style: { marginTop: 8 },
+				children: chosen.map((d) => (0, import_jsx_runtime.jsxs)("span", {
+					className: "chip chip-own",
+					children: [d, (0, import_jsx_runtime.jsx)("button", {
+						type: "button",
+						className: "chip-x",
+						onClick: () => toggle(d),
+						"aria-label": `Remove ${d}`,
+						children: (0, import_jsx_runtime.jsx)(Icon, {
+							name: "x",
+							size: 13
+						})
+					})]
+				}, d))
+			}) : null]
+		});
+	}
+	const found = matchTerritoriesIn(TERRITORIES, query, chosen, 8);
 	return (0, import_jsx_runtime.jsxs)("div", {
 		style: { marginTop: 6 },
 		children: [
@@ -22046,14 +22092,14 @@ function FieldPicker({ spec, value, onChange }) {
 					fontFamily: "inherit"
 				}
 			}),
-			suggestions.length ? (0, import_jsx_runtime.jsx)("div", {
+			found.length ? (0, import_jsx_runtime.jsx)("div", {
 				style: {
 					display: "flex",
 					flexWrap: "wrap",
 					gap: 4,
 					marginTop: 5
 				},
-				children: suggestions.map((t) => (0, import_jsx_runtime.jsxs)("button", {
+				children: found.map((t) => (0, import_jsx_runtime.jsxs)("button", {
 					type: "button",
 					onClick: () => {
 						toggle(t);
@@ -22092,7 +22138,7 @@ function FieldTag({ tag }) {
 		children: tag
 	});
 }
-function Field({ spec, value, choices, onChange }) {
+function Field({ spec, value, choices, onChange, suggestions }) {
 	const picker = spec.kind === "choice" || spec.kind === "boolean";
 	const multi = spec.kind === "lines" || spec.kind === "prose";
 	const classes = spec.picker === "classes";
@@ -22138,7 +22184,8 @@ function Field({ spec, value, choices, onChange }) {
 			(0, import_jsx_runtime.jsx)(FieldPicker, {
 				spec,
 				value,
-				onChange
+				onChange,
+				...suggestions ? { suggestions } : {}
 			})
 		]
 	});
@@ -22319,6 +22366,7 @@ function NewCompany({ ctx }) {
 								spec,
 								value: spec.key === "selfExclusionOwners" && !namesTouched ? typedName : boxValue(state, spec),
 								choices: null,
+								suggestions: ctx.me.houseMarketplaces,
 								onChange: (v) => {
 									if (spec.key === "selfExclusionOwners") setNamesTouched(true);
 									setState((st) => typeField(st, spec, v));
@@ -23629,7 +23677,8 @@ function Profile({ ctx }) {
 										edits
 									}, spec),
 									choices: spec.key === "defaultProduct" ? productChoices : spec.choices ?? null,
-									onChange: (v) => edit(spec, v)
+									onChange: (v) => edit(spec, v),
+									suggestions: ctx.me.houseMarketplaces
 								}),
 								spec.key === "defaultJurisdictions" ? (0, import_jsx_runtime.jsx)(UnsearchableTerritories, { derived: loaded.derived }) : null,
 								spec.key === "defaultProduct" && coverageOf(loaded.derived) ? (0, import_jsx_runtime.jsxs)("details", {

package/portal-ui/dist/index.html

@@ -49,7 +49,7 @@
     -->
     <link rel="preconnect" href="https://api.fontshare.com" crossorigin />
     <link href="https://api.fontshare.com/v2/css?f[]=satoshi@400,500,700,900&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/portal/assets/index-GBbbyQxc.js"></script>
+    <script type="module" crossorigin src="/portal/assets/index-DVtz44vH.js"></script>
     <link rel="stylesheet" crossorigin href="/portal/assets/index-5CCwiJG7.css">
   </head>
   <body>

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.3.3",
+  "version": "0.4.0-beta.0",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-oauth-mcp-bridge
 
+## 0.4.0-beta.0
+
+No changes in this release.
+
 ## 0.3.3
 
 No changes in this release.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.3.3",
+  "version": "0.4.0-beta.0",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/scripts/freeze-example-run.mjs

@@ -237,7 +237,7 @@ const substituteVendorKey = (key) => {
 
 // meta.json keys the freeze is EXPECTED to change, with the reason. Anything else differing is a finding.
 const EXPECTED_META_DELTA = {
-  tokens: "telemetry pruned — _driver/*.jsonl is the only source (driver/tokens.mjs:82)",
+  tokens: "telemetry pruned — _driver/*.jsonl is the only source (rollupTokens in driver/tokens.mjs)",
   servedModels: "telemetry pruned — the attempt rows in _driver/*.jsonl are the only source (servedModels in driver/tokens.mjs)",
 };
 

package/scripts/live-surface-check.mjs

@@ -107,6 +107,7 @@ import { envFrom } from "../shared/env-aliases.mjs";
 import { gitTry, treeOf } from "../shared/tree-commit.mjs";   // — a packaged install has no git, and says its commit in build-info.json
 import { exitFor } from "../driver/surface-exit-verdict.mjs";   // — a check that could not look is not a drift, and they want different things done   // — the name a reader is told to set is the one in force
 import { planRunAgreementVerdict } from "../driver/plan-run-agreement-verdict.mjs";
+import { doorCallVerdict } from "../driver/door-call-verdict.mjs";   // — a refused or unanswered door call compared nothing
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const asJson = process.argv.includes("--json");
@@ -605,7 +606,11 @@ try {
   }
 } catch (e) {
   if (e?.message === "__door_unset__") skip("roster resolves", "this instance does not say where its ops-MCP is, so the roster was NOT PROBED");
-  else fail("roster resolves", `list_profiles failed: ${e.message}`);
+  else {
+    const v = doorCallVerdict(e, { asked: "list_profiles", notCompared: "the roster was not compared" });
+    if (v) record("roster resolves", v.state, v.message, v.blocked === true);
+    else fail("roster resolves", `list_profiles failed: ${e.message}`);
+  }
 }
 
 // 3. THE LOAD-BEARING CHECK — every door's availability answer vs the engine's own, recomputed here
@@ -644,7 +649,11 @@ try {
   }
 } catch (e) {
   if (e?.message === "__door_unset__") skip("ops-MCP reachable", "this instance does not say where its ops-MCP is — NOT PROBED");
-  else fail("ops-MCP reachable", `${MCP_URL}: ${e.message}`);
+  else {
+    const v = doorCallVerdict(e, { asked: `${MCP_URL} for describe_options`, notCompared: "the door's answers were not compared" });
+    if (v) record("ops-MCP reachable", v.state, v.message, v.blocked === true);
+    else fail("ops-MCP reachable", `${MCP_URL}: ${e.message}`);
+  }
 }
 
 // ── 3b. THE TRIGGER LANE, AS ITS OWN SURFACE ─────────────────────────────────────────────────────────

package/scripts/release-entry-catch-up.mjs

@@ -0,0 +1,142 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// release-entry-catch-up.mjs — finish a release npm was still validating when the publish job stopped waiting.
+//
+//   node scripts/release-entry-catch-up.mjs [--repo owner/name] [--bound-hours 6] [--dry-run]
+//
+// WHY THIS EXISTS. npm now accepts a publish before it serves it ("Your package is being processed and may
+// take a few minutes to become available"), and the processing is not bounded. The publish job waits for
+// an unauthenticated client to get the exact bytes it uploaded before it creates the release entry, and
+// that wait has to end somewhere. Measured 2026-09-23: 0.3.3-beta.1 was served eleven minutes after npm
+// accepted it; the 0.3.3 stable was still "Validating" on npmjs.com more than fifty minutes after, the
+// job gave up at its bound, and no entry was ever created. GitHub went on naming 0.3.2 as the latest
+// release while the stable was already published. Nothing ran again to finish it.
+//
+// So a tagged version with no entry is PENDING, not failed, and the scheduled run finishes it: once the
+// registry serves the bytes the publish job kept, the entry is created from the changelog, exactly as the
+// publish job would have created it. Past a bound with the version still not served, it says so in red.
+//
+// THE SAME CHECK, ON THE SAME BYTES. The publish job keeps the tarball it uploaded as an artifact named
+// `published-<version>`, and this hands that file to release-visible-check.mjs, so an entry is only ever
+// created over bytes the registry serves and this pipeline published. A tagged version with no kept bytes
+// (one published before this existed) is reported, never guessed at.
+//
+// Exit 0: nothing to do, the entry was created, or the version is pending inside the bound.
+// Exit 1: the version is still not served past the bound, or its bytes cannot be found to check against.
+// Exit 2: could not look.
+import { execFileSync, spawnSync } from "node:child_process";
+import { mkdtempSync, readFileSync, readdirSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { isEntrypoint } from "../shared/is-entrypoint.mjs";
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
+
+/**
+ * What to do about the version at main's head. PURE, so every branch is driven without a registry.
+ * @param {{ tagged: boolean, entryExists: boolean, keptBytes: boolean, visibleExit: number|null,
+ *           ageSec: number|null, boundSec: number }} s
+ * @returns {{ action: "none"|"create"|"wait"|"report", exit: 0|1|2, why: string }}
+ */
+export function decide(s) {
+  if (!s.tagged) return { action: "none", exit: 0, why: "not tagged: nothing has been published to finish" };
+  if (s.entryExists) return { action: "none", exit: 0, why: "the release entry already exists" };
+  if (!s.keptBytes) {
+    return { action: "report", exit: 1,
+      why: "tagged with no release entry, and no kept bytes to check the registry against: create the entry by hand after checking what the registry serves" };
+  }
+  if (s.visibleExit === 0) return { action: "create", exit: 0, why: "the registry serves the published bytes" };
+  if (s.visibleExit === 1) {
+    if (s.ageSec != null && s.ageSec > s.boundSec) {
+      return { action: "report", exit: 1,
+        why: `tagged ${Math.round(s.ageSec / 3600)} h ago and the registry still does not serve these bytes` };
+    }
+    return { action: "wait", exit: 0, why: "npm has not served it yet; the next scheduled run looks again" };
+  }
+  return { action: "report", exit: 2, why: "the registry check could not look" };
+}
+
+const arg = (argv, flag, dflt = null) => { const i = argv.indexOf(flag); return i === -1 ? dflt : argv[i + 1]; };
+const gh = (args, opts = {}) => execFileSync("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], ...opts });
+
+// Whether the entry exists. Only GitHub's own "release not found" is a no; any other failure throws.
+function entryFor(tag, repo) {
+  const r = spawnSync("gh", ["release", "view", tag, "--repo", repo, "--json", "tagName"], { encoding: "utf8" });
+  if (r.status === 0) return true;
+  if (/release not found/i.test(r.stderr ?? "")) return false;
+  throw Object.assign(new Error(`could not read the release entry for ${tag}`), { stderr: r.stderr || r.error?.message });
+}
+
+function main() {
+  try { return catchUp(process.argv.slice(2)); }
+  catch (e) {
+    // A GitHub call that failed is a check that could not look, never the verdict "past the bound".
+    console.log(`::error::release-entry-catch-up could not finish: ${String(e.stderr || e.message).trim().split("\n")[0]}`);
+    return 2;
+  }
+}
+
+function catchUp(argv) {
+  const repo = arg(argv, "--repo", process.env.GITHUB_REPOSITORY);
+  const boundSec = Number(arg(argv, "--bound-hours", "6")) * 3600;
+  const dry = argv.includes("--dry-run");
+  if (!repo || !(boundSec > 0)) { console.error("release-entry-catch-up: needs --repo (or GITHUB_REPOSITORY) and a positive --bound-hours. Could not look."); return 2; }
+
+  const version = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8")).version;
+  const tag = `v${version}`;
+  const prerelease = version.includes("-");
+
+  // THE EXACT REF, as the publish job asks it: a prefix read would take v0.3.1 for v0.3.1-beta.0.
+  let tagged;
+  try { tagged = gh(["api", `repos/${repo}/git/ref/tags/${tag}`, "--jq", ".ref"]).trim() === `refs/tags/${tag}`; }
+  catch (e) { if (/HTTP 404/.test(String(e.stderr))) tagged = false; else { console.error(`release-entry-catch-up: could not read the tag ${tag}: ${String(e.stderr || e.message).trim()}`); return 2; } }
+  const entryExists = tagged ? entryFor(tag, repo) : false;
+
+  let keptBytes = false, visibleExit = null, ageSec = null, work = null;
+  if (tagged && !entryExists) {
+    const art = JSON.parse(gh(["api", `repos/${repo}/actions/artifacts?name=published-${version}&per_page=1`]));
+    const a = (art.artifacts ?? []).find((x) => !x.expired);
+    if (a) {
+      work = mkdtempSync(join(tmpdir(), "entry-catch-up-"));
+      writeFileSync(join(work, "kept.zip"), execFileSync("gh", ["api", `repos/${repo}/actions/artifacts/${a.id}/zip`],
+        { maxBuffer: 256 * 1024 * 1024, stdio: ["ignore", "pipe", "pipe"] }));
+      execFileSync("unzip", ["-q", "-o", join(work, "kept.zip"), "-d", join(work, "kept")]);
+      const tgz = readdirSync(join(work, "kept")).find((f) => f.endsWith(".tgz"));
+      if (tgz) {
+        keptBytes = true;
+        const r = spawnSync(process.execPath, [join(ROOT, "scripts", "release-visible-check.mjs"), "--version", version,
+          "--tag", prerelease ? "beta" : "latest", "--tarball", join(work, "kept", tgz), "--timeout", "60", "--interval", "15"],
+        { encoding: "utf8" });
+        process.stdout.write(r.stdout ?? ""); process.stderr.write(r.stderr ?? "");
+        visibleExit = r.status;
+      }
+    }
+    const when = gh(["api", `repos/${repo}/commits/${tag}`, "--jq", ".commit.committer.date"]).trim();
+    ageSec = Math.max(0, (Date.now() - Date.parse(when)) / 1000);
+  }
+
+  const d = decide({ tagged, entryExists, keptBytes, visibleExit, ageSec, boundSec });
+  console.log(`release-entry-catch-up: ${tag}: ${d.why}.`);
+  if (d.action === "create") {
+    if (dry) { console.log(`release-entry-catch-up: --dry-run, so no entry is created for ${tag}.`); }
+    else {
+      // THE SAME ENTRY THE PUBLISH JOB WRITES: the changelog's section for this version, flagged as a
+      // pre-release for a beta, and GitHub's own notes only when the changelog has no section.
+      const notes = spawnSync(process.execPath, [join(ROOT, "scripts", "release-notes-for.mjs"), version], { encoding: "utf8" }).stdout ?? "";
+      const args = ["release", "create", tag, "--repo", repo, "--verify-tag", "--title", tag];
+      if (notes.trim()) { const f = join(work ?? mkdtempSync(join(tmpdir(), "entry-notes-")), "notes.md"); writeFileSync(f, notes); args.push("--notes-file", f); }
+      else args.push("--generate-notes");
+      if (prerelease) args.push("--prerelease");
+      gh(args);
+      console.log(`release-entry-catch-up: created the release entry for ${tag}${prerelease ? " as a pre-release" : ""}.`);
+    }
+  }
+  if (d.exit === 1) console.log(`::error::${tag}: ${d.why}.`);
+  else if (d.action === "wait") console.log(`::notice::${tag}: ${d.why}.`);
+  if (work) rmSync(work, { recursive: true, force: true });
+  return d.exit;
+}
+
+if (isEntrypoint(import.meta.url)) process.exitCode = main();

package/shared/client-door.mjs

@@ -40,8 +40,10 @@
 // a door — which is now the difference between a box that installs and a box that crash-loops one.
 
 import { join } from "node:path";
+import { homedir } from "node:os";
 import { challengeVerdict, blockedByAccessChallenge, challengeNote } from "./mcp-challenge.mjs";   // — F57
 import { whatHoldsPort } from "./os-advice.mjs";
+import { defaultDenylistPath } from "./scope.mjs";   // — the verifier owns the path; see the re-export below
 
 /** The unit that runs the client door. Installed like any other; started only by this module. */
 export const CLIENT_DOOR_UNIT = "clearotron-client-mcp.service";
@@ -59,7 +61,9 @@ export const CLIENT_DOOR_UNIT = "clearotron-client-mcp.service";
  * file no verifier could read, and a revoked key kept answering 200. The guard existed; one of the two
  * doors was outside it.
  */
-export const defaultDenylistPath = (home) => join(home, ".config", "clearotron", "token-denylist");
+// ONE definition, owned by the verifier (scope.mjs): the file a door reads when the setting is unset is,
+// by construction, the file every revoker here writes.
+export { defaultDenylistPath } from "./scope.mjs";
 
 /**
  * The denylist path a door should be given — the operator's, if they set one.
@@ -617,9 +621,10 @@ export function enablePlan({ env = {}, address, identity, accessFile = null, por
   // ── THE DENYLIST PATH IS NAMED AND CREATED HERE, NEVER ASSUMED ───────────
   //
   // Measured on production, owner 2026-08-31: no denylist is configured anywhere — the variable is
-  // empty in one example env and commented out in the other, and `isRevoked()` returns false when the
-  // path is unset. So a key minted by a connect that assumed a denylist would be UNREVOKABLE, silently:
-  // `disconnect` would write a jti into a file no verifier reads, and every check would look done.
+  // empty in one example env and commented out in the other, and `isRevoked()` then returned false for
+  // every token. So a key minted by a connect that assumed a denylist was UNREVOKABLE, silently:
+  // `disconnect` wrote a jti into a file no verifier read, and every check looked done. `isRevoked()`
+  // now reads the default list when the path is unset; naming it here still pins every door to one file.
   //
   // Armed AT CONNECT TIME, deliberately, not at disconnect: a process reads its environment once, at
   // start. A variable first written when someone disconnects is one the already-running door never
@@ -917,7 +922,7 @@ export function connectKeyReport(grants, { now = Date.now(), revoked = () => fal
  * were recorded".
  */
 export function disablePlan({ env = {}, unitDir, exists, identity = null, recorded = [],
-  denylistPath = null } = {}) {
+  denylistPath = null, home = homedir() } = {}) {
   const door = clientDoorState({ env, unitDir, exists });
   const jtis = (recorded ?? []).map((r) => r.jti).filter(Boolean);
   // The path the running verifiers were BORN with wins; the caller's default only covers the install
@@ -926,7 +931,9 @@ export function disablePlan({ env = {}, unitDir, exists, identity = null, record
   // a revocation the environment cannot deliver retroactively.
   const existing = String(env.TRADEMARK_MCP_TOKEN_DENYLIST ?? "").trim();
   const armedPath = existing || (jtis.length && denylistPath ? String(denylistPath) : null);
-  const lateArm = Boolean(jtis.length && !existing && armedPath);
+  // NOT LATE WHEN IT IS THE DEFAULT LIST: a door with the setting unset reads the install's default list
+  // (isRevoked, shared/scope.mjs), so writing there reaches the running doors now, not from their next start.
+  const lateArm = Boolean(jtis.length && !existing && armedPath && armedPath !== defaultDenylistPath(home));
 
   if (!jtis.length) {
     return { possible: false, nothingOpen: true, door,
@@ -965,7 +972,7 @@ export function disablePlan({ env = {}, unitDir, exists, identity = null, record
  * everything. Stopping the unit would additionally break the stdio-free local route for readers who
  * hold no key at all, and would be undone by the next install.
  */
-export function revokeEveryonePlan({ env = {}, grants = null, denylistPath = null } = {}) {
+export function revokeEveryonePlan({ env = {}, grants = null, denylistPath = null, home = homedir() } = {}) {
   const rows = Object.entries(grants?.connectKeys ?? {}).map(([jti, r]) => ({ jti, sub: r?.sub ?? null }));
   const jtis = rows.map((r) => r.jti);
   const people = [...new Set(rows.map((r) => r.sub).filter(Boolean))];
@@ -980,7 +987,7 @@ export function revokeEveryonePlan({ env = {}, grants = null, denylistPath = nul
   return {
     possible: true, nothingOpen: false, jtis, people,
     denylistPath: armedPath,
-    lateArm: Boolean(!existing && armedPath),
+    lateArm: Boolean(!existing && armedPath && armedPath !== defaultDenylistPath(home)),   // see disablePlan
     // THE COUNT IS THE FIRST THING SAID, and it names both dimensions: five keys held by one person and
     // five keys held by five people are the same number and not the same act.
     says: [`This revokes ${jtis.length} issued key(s) held by ${people.length} ${people.length === 1 ? "person" : "people"}`

package/shared/scope.mjs

@@ -19,6 +19,8 @@
 
 import { createHmac, timingSafeEqual, randomBytes } from "node:crypto";
 import { readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
 import { envFrom } from "./env-aliases.mjs";   // — resolves EITHER spelling; names the retired one because that is the live-writable half
 
 const SECRET = () => process.env.TRADEMARK_MCP_TOKEN_SECRET || "";
@@ -29,16 +31,29 @@ const SECRETS = () => [process.env.TRADEMARK_MCP_TOKEN_SECRET, process.env.TRADE
   .filter((s) => typeof s === "string" && s.length > 0);
 const b64u = (buf) => Buffer.from(buf).toString("base64url");
 
-// Emergency revocation: a plain-text denylist file (one `jti` per line, `#` comments), path in
-// TRADEMARK_MCP_TOKEN_DENYLIST. Checked on every token verification. Short TTLs remain the primary
-// control; a missing/unreadable file means "nothing revoked yet" (the denylist must never be able
-// to take ALL token auth down on an fs blip). Legacy tokens carry no jti and are killed by secret
-// rotation instead.
-export function isRevoked(jti, { denylistPath = process.env.TRADEMARK_MCP_TOKEN_DENYLIST } = {}) {
-  if (!jti || !denylistPath) return false;
+// Emergency revocation: a plain-text denylist file (one `jti` per line, `#` comments). Checked on every
+// token verification, ALWAYS: the path is TRADEMARK_MCP_TOKEN_DENYLIST when it is set, and otherwise the
+// install's default below, the same file every revoker writes when the setting is unset (connect,
+// disconnect, `key`, mint-token's own note). Short TTLs remain the primary control. Legacy tokens carry
+// no jti and are killed by secret rotation instead.
+//
+// REVOCATION USED TO BE OFF WHEN THE SETTING WAS UNSET: this returned "not revoked" for every token, so a
+// door started without the variable (by hand, or by a unit that never loaded it) ignored a revocation
+// written to the default file. Now:
+//   - a NAMED list that cannot be read refuses every token (below), as it already did;
+//   - a list that EXISTS and cannot be read refuses every token, named or default;
+//   - the DEFAULT list being ABSENT means nothing has been revoked. Every revocation creates the file
+//     it writes to, and with the setting unset that is this file, so its absence is the proof, not a
+//     gap. It is the one absence read as a negative here, and only for that reason.
+export const defaultDenylistPath = (home) => join(home, ".config", "clearotron", "token-denylist");
+export function isRevoked(jti, { denylistPath = undefined, env = process.env, home = homedir() } = {}) {
+  if (!jti) return false;
+  const named = String(denylistPath ?? env.TRADEMARK_MCP_TOKEN_DENYLIST ?? "").trim();
+  const path = named || defaultDenylistPath(home);
   let text;
-  try { text = readFileSync(denylistPath, "utf8"); }
+  try { text = readFileSync(path, "utf8"); }
   catch (e) {
+    if (!named && e?.code === "ENOENT") return false;   // the default list, never written: nothing revoked
     // FAIL CLOSED (found in review; ruled and recorded for the owner's
     // review with the reversal path, which is this function).
     //
@@ -50,10 +65,10 @@ export function isRevoked(jti, { denylistPath = process.env.TRADEMARK_MCP_TOKEN_
     // The cost is now a VISIBLE outage that names its own cause, rather than an invisible hole. `start`
     // creates this file before any door starts, so reaching this branch means someone removed or
     // unreadable-ified it while the door was running — rare, and worth stopping for.
-    const err = new Error(`revocation could not be checked: the denylist at ${denylistPath} is unreadable `
+    const err = new Error(`revocation could not be checked: the denylist at ${path} is unreadable `
       + `(${e.code ?? e.message}). Refusing the token rather than assuming it was never revoked.`);
     err.code = "REVOCATION_UNCHECKABLE";
-    err.denylistPath = denylistPath;
+    err.denylistPath = path;
     throw err;
   }
   return text.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#")).includes(jti);