clearotron 0.4.0-beta.2 → 0.4.0

package/THIRD-PARTY-NOTICES.md

@@ -110,7 +110,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## @modelcontextprotocol/sdk@1.30.0
+## @modelcontextprotocol/sdk@1.30.1
 
 - **Licence declared:** `MIT`
 - **Repository:** https://github.com/modelcontextprotocol/typescript-sdk
@@ -566,7 +566,7 @@ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## brace-expansion@1.1.18
+## brace-expansion@1.1.21
 
 - **Licence declared:** `MIT`
 - **Repository:** git://github.com/juliangruber/brace-expansion
@@ -596,7 +596,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## brace-expansion@2.1.4
+## brace-expansion@2.1.7
 
 - **Licence declared:** `MIT`
 - **Repository:** git://github.com/juliangruber/brace-expansion
@@ -1968,7 +1968,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## fast-uri@3.1.7
+## fast-uri@3.1.8
 
 - **Licence declared:** `BSD-3-Clause`
 - **Repository:** https://github.com/fastify/fast-uri
@@ -2626,7 +2626,7 @@ OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 PERFORMANCE OF THIS SOFTWARE.
 ```
 
-## ip-address@10.5.0
+## ip-address@10.7.2
 
 - **Licence declared:** `MIT`
 - **Repository:** https://github.com/beaugunderson/ip-address

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "9724d686ef597055a7d7f205632ca7b77bc4efef",
-  "version": "0.4.0-beta.2"
+  "commit": "9b8ab0f275a16e9b586425c3574c94b5974e225b",
+  "version": "0.4.0"
 }

package/driver/CHANGELOG.md

@@ -1,5 +1,95 @@
 # clearotron-driver
 
+## 0.4.0
+
+### Minor Changes
+
+- New: A knockout search now also asks whether each name is already in use in the client's field, such as a game character or a drink.
+- Before you upgrade: a new operator key must now name the tools it may use, for example `--verbs start_run,stop_run`. Keys already issued keep working.
+  
+  For operators: a revoked key stops working even where no revocation list was set up, because every connector now reads the install's own list.
+  
+  Fixed: over the network, an operator key can no longer start a what-if that its assistant is not shown.
+  
+  Fixed: the portal refuses a change sent from another website, or from another app on the same computer, including a sign-in.
+- New: Searching by judgment.
+  
+  This release changes how a clearance decides what to search. Until now the engine followed fixed rules: a set number of spellings, a fixed list of stores, a stop after the first identical mark. Fixed rules are fast and cheap, but they miss things. On a recent matter, a lawyer's review found marks the engine had counted but never read, and others it had raised that did not matter.
+  
+  So the approach changes. Wherever the engine holds a pile of results, it now looks at what is there and decides what a lawyer would raise. It carries that forward and writes down what it set aside, and why. Nothing is dropped silently. Every wider search, every spelling set aside and every store left out appears in the audit workbook with its reason.
+  
+  What you will notice:
+  - Searches widen where it could change the advice, and narrow where it cannot.
+  - Near spellings no buyer would confuse with the mark are set aside, with the reason recorded.
+  - Searches in other scripts run only in markets that file marks in that script.
+  - A large company's register is read for the marks that share the searched name. The rest is counted, not fetched.
+  - Marketplace searches cover the stores that sell the client's goods, and say which stores were left out and why.
+  - The report no longer opens with the internal reviewer's notes. They reach the reviewing lawyer separately.
+  - A large marketplace search no longer fails because its results were too big to return in one piece.
+  - Where a company's framework rates through named inputs, the report shows them beside each band.
+  
+  A word on regressions. While testing this line we found two. A crowded search failed before delivering its report, and a knockout's ratings moved one step away from the lawyer's. Both were caught by running the same matters against a lawyer's answers, and both are fixed here. Every build is now tested that way before it ships. We are tuning for three things at once: a report that is right the first time, delivered fast, at a sensible cost. They pull against each other, and each release is our best current balance.
+
+### Patch Changes
+
+- For operators: a run now records the version of the engine program that served it, and whether that version is older than this release asks for. A search that ran on an old copy can be identified afterwards.
+- Fixed: reports and their cover emails no longer carry the open-question rows or the internal review note. Both were written for the lawyer checking a run rather than the client reading the result, and they stay with the run record.
+- For operators: on the Anthropic engine, a search can no longer read the install's settings or other private files.
+- For operators: stages on the Anthropic engine can no longer run commands on the server; every tool that runs a command is removed from them.
+- Fixed: In a crowded field, the search now reads the spellings a lawyer would raise, rather than the ones that fit under a record limit.
+- Fixed: When a knockout's search for filings fails, the report and the audit workbook no longer show the raw error.
+- Fixed: On Windows, a failed finding card no longer shows as covered in the audit workbook.
+- Fixed: When a search could not be made, the report says so instead of giving a wrong reason.
+- Fixed: A register search limited to the client's goods now searches every other office when one office cannot filter by goods.
+- Fixed: a right the report keeps is no longer dropped because other registrations of the same right were ruled out.
+- Fixed: A knockout search no longer drops a store listing or fan wiki page its web search found; the rating now reads every result.
+- Fixed: A knockout's audit workbook also lists a part that failed as a whole, such as its filings listing or plain-language review. A filing shown without its link now says why.
+- Fixed: on a Mac, `clearotron start` no longer offers to run in the background, which only works on Linux.
+- Fixed: on a Mac, a search step could write into Clearotron's own protected folders by naming them in a different letter case. Those writes are now refused.
+- Fixed: A register search that times out across many countries is asked again in smaller parts; one that still times out is reported as incomplete.
+- Fixed: on the OpenAI engine, Codex's own sandbox no longer refuses the register searches a clearance runs.
+- Fixed: Reports no longer show a gap in coverage when a search was skipped because an identical one had already run.
+- For operators: on the OpenAI engine with Codex's sandbox on, the commands a search runs can no longer read the install's settings or other private files.
+- Fixed: the audit workbook's What was searched tab no longer shows a web or marketplace search that found similar listings as clean.
+- Fixed: Worldwide searches are no longer narrowed to an account's default territories, and results too crowded to read in full are no longer reported clean.
+- Fixed: A report no longer offers a native-language investigation to a client who ordered one, and says when that investigation was not completed.
+- Fixed: When a knockout's lookup of a filing owner fails, its read now says the lookup did not answer, instead of saying it found nothing.
+- Fixed: Clarivate clearances no longer count look-alike spellings that mix Latin with Greek or Cyrillic letters as searches that could not be completed.
+- For operators: Clarivate clearances no longer fetch a record, or repeat a count, search or owner lookup, that the same run already made.
+- New: Clearotron runs natively on Windows, from PowerShell: no WSL2, no Git and no administrator rights.
+- Fixed: closing the window that runs `clearotron start` now stops Clearotron. Before, it kept running in the background.
+- Fixed: Creating a company in the portal no longer stops with a request to run a git command.
+- Fixed: a full country search's report no longer says court decisions were searched when that search failed or its source was down.
+- New: Global preliminary, multi-country and full country searches now search the web in more depth and keep more results from each search.
+- For operators: Knockouts on Signa and Clarivate take their name and close-variation counts from the listing, so each is asked of the register once.
+- Fixed: A new company starts with no marketplaces. The company page offers the usual ones to add, and a company with none is still searched on the general web.
+- Fixed: Opposition windows appear again on register records, and renewal dates are read from where the register now publishes them.
+- Fixed: opening a report no longer contacts any font service; the report carries its typeface, now Plus Jakarta Sans, inside itself.
+- Fixed: searches no longer reuse earlier results.
+- Before you upgrade: setup and `clearotron doctor` now ask for a newer Claude Code, because the older one quietly serves an earlier model generation.
+- Fixed: Knockouts on the Signa register now say how many register hits the listed filings were drawn from.
+- Fixed: Clearances on the Signa register no longer search look-alike spellings that mix Latin with Greek or Cyrillic letters; those searches found only unrelated marks.
+- Fixed: skipped searches are no longer shown as unfinished in the report.
+- For operators: each stage's AI program now receives only the settings it needs, and never the key that signs access keys.
+- Fixed: The audit workbook now lists, on Coverage & gaps, any part of a report that could not be completed on the run. A knockout's Audit Trail also lists an owner lookup that got no answer.
+- Fixed: on the OpenAI engine, a Full country search now reads case law from CourtListener and Legal Data Hunter, not EUR-Lex alone.
+- Fixed: setup, `clearotron doctor` and the start of every search now check that the engine can write a file where a search writes its results.
+- New: The meaning and reputation search now asks the questions the matter's framing names, in the languages whose markets matter. Where the framing names none, the report says no meaning search ran.
+- For operators: the old default agent name is gone from the product. An install upgrading from a version before 0.2.2 must set its own agent name to keep seeing its earlier runs.
+- Fixed: The operator tool no longer accepts instructions, which never reached the run; a call sending them is refused.
+- Fixed: on the OpenAI engine, the tool that reads web pages now refuses addresses on the server's own network, such as cloud metadata addresses.
+- For operators: the background worker no longer receives the key that signs access keys. Run `clearotron start --background` once to update an installed worker.
+- Fixed: Expiry dates appear again on US trademark records, which had been left blank since the register moved where it publishes them.
+
+## 0.4.0-beta.3
+
+### Patch Changes
+
+- Fixed: Reports no longer show a gap in coverage when a search was skipped because an identical one had already run.
+- Fixed: Opposition windows appear again on register records, and renewal dates are read from where the register now publishes them.
+- Before you upgrade: setup and `clearotron doctor` now ask for a newer Claude Code, because the older one quietly serves an earlier model generation.
+- Fixed: Expiry dates appear again on US trademark records, which had been left blank since the register moved where it publishes them.
+
 ## 0.4.0-beta.2
 
 ### Minor Changes

package/driver/ask-ledger.mjs

@@ -583,8 +583,8 @@ export function parseAskClosureLines(text) {
  * could-not-look, and the caller below fails toward leaving the ask OPEN rather than closing it on a
  * file it could not read.
  *
- * ✕ NEVER a substring search of the serialized document. `"DELFIN" in JSON.stringify(findings)` is true
- * when the findings name DELFIN TECHNOLOGIES OY and nothing else — a membership test that matches every
+ * ✕ NEVER a substring search of the serialized document. `"KORFIN" in JSON.stringify(findings)` is true
+ * when the findings name KORFIN TECHNOLOGIES OY and nothing else — a membership test that matches every
  * longer name inflates whatever it is counting and reads as a clean result. The field, or nothing.
  * PURE.
  */

package/driver/coverage-form.mjs

@@ -1005,6 +1005,12 @@ export function renderCoverageLedgerJsonFromForm(rows, classTokens) {
       axis: String(r.axis ?? "").trim().toLowerCase(),
       scope, status: String(r.status).trim().toLowerCase(), reason,
       ...(classes.length ? { classes } : {}),
+      // THE COUNT AND THE PLAN KEY THE SOURCE ROW ALREADY HOLDS (ruling 551). The table two functions up
+      // prints `total_hits` as "N hits" and this render dropped it, so the two renders of one form
+      // disagreed about whether the run knew the size of what it left. A row without either — a seat-added
+      // row — emits neither, which says "this row has no count" rather than "the count was lost here".
+      ...(Number.isInteger(r.total_hits) ? { total_hits: r.total_hits } : {}),
+      ...(r.qid ? { qid: String(r.qid) } : {}),
     };
   }));
 }

package/driver/coverage-ledger.mjs

@@ -450,7 +450,19 @@ export function parseCoverageLedger(md) {
 // OPTIONAL structured column: the Nice classes a row is about, as an array of class-number strings — the
 // join key scope-facts.mjs uses to attribute a coverage gap to an instructed class without re-parsing
 // prose. Archived ledgers (no classes key) parse byte-identically to before.
-const ROW_KEYS = ["axis", "scope", "status", "reason", "classes"];
+// TWO MORE OPTIONAL COLUMNS, AND THEY CLOSE A DRIFT THE RENDERER'S OWN DOCTRINE FORBIDS. The form is the
+// source and the prose table and this JSON are both renders of it, "so they agree by construction and
+// neither can be the thing that drifts" — and they did not agree: a form row carries `total_hits` and the
+// table prints it as "N hits", while this JSON dropped it. Measured on R18 of 2026-09-27: 50 rows of four
+// fields, and not one of the 49 coverage-limited rows carried a count, so a reader could not tell a slice
+// holding 200 records from one holding 300,000. Ruling 551 puts the count on the row in as many words.
+//
+// `qid` rides for the same reason the form keeps it in its own column: it is what joins a coverage row to
+// the plan's question, and without it the count can only be re-attached by matching prose. A seat-added
+// row has no qid and no count, which is a fact about that row rather than a gap in this contract.
+//
+// Archived ledgers parse byte-identically: both are optional and absence is unchanged behaviour.
+const ROW_KEYS = ["axis", "scope", "status", "reason", "classes", "total_hits", "qid"];
 
 // Extract Nice-class tokens from a ledger row's free-text scope/reason cell ("[cl 5,32]", "Class 30 leg",
 // "nice classes 5/32"). DETERMINISTIC + conservative: only numbers 1–45 introduced by an explicit
@@ -494,7 +506,7 @@ export function parseCoverageLedgerJson(raw, { allowedAxes = REGISTER_AXES, acti
     if (!r || typeof r !== "object" || Array.isArray(r))
       throw new Error("coverage_ledger_unparseable: every row must be a plain object");
     for (const k of Object.keys(r)) {
-      if (!ROW_KEYS.includes(k)) throw new Error(`coverage_key_unknown:${short(k)} (keys are EXACTLY: axis, scope, status, reason — plus OPTIONAL classes)`);
+      if (!ROW_KEYS.includes(k)) throw new Error(`coverage_key_unknown:${short(k)} (keys are EXACTLY: axis, scope, status, reason — plus OPTIONAL classes, total_hits, qid)`);
     }
     // normalize-then-validate (B): coerce cosmetic formatting (markdown/qualifier/transposition) to the
     // canonical token, but keep the guard STRICT — an unknown axis still fails, with the ORIGINAL token in

package/driver/driver.config.mjs

@@ -2057,17 +2057,34 @@ export const ENGINE_BINARIES = {
     // newer", with no ceiling. Setup installs it into the engines folder (enginesFolder, below the table)
     // when the reader picks this engine, and the resolver uses it only when the machine has no copy of its
     // own. The package's own `bin` field names the program, so no path inside it is written down here.
-    // 2.1.280 is the floor because it is the oldest release that can run the current generation of this
-    // vendor's top tier: below it the API refuses the model id outright ("version 2.1.280 or newer is
-    // required"), and the tier alias quietly goes on serving the previous generation. Measured 2026-09-22
-    // on 2.1.263 — the alias returned the older model and the pinned id was refused — so a floor that
-    // only asks for a program that starts is a floor that passes a machine this engine cannot run on.
-    package: "@anthropic-ai/claude-code", floor: "2.1.280",
+    // THE FLOOR IS THE OLDEST RELEASE WHOSE TIER ALIASES REACH THE CURRENT MODEL GENERATION, and each
+    // tier crossed on its own release rather than together. Measured 2026-09-30 by driving each version's
+    // `-p` turn at a local recorder and reading the `model` it put on the wire:
+    //
+    //     version   --model opus        --model sonnet
+    //     2.1.277    claude-opus-5       claude-sonnet-5
+    //     2.1.278    claude-opus-5       claude-sonnet-5
+    //     2.1.280    claude-opus-5-5     claude-sonnet-5
+    //     2.1.281    claude-opus-5-5     claude-sonnet-5
+    //     2.1.282    claude-opus-5-5     claude-sonnet-5
+    //     2.1.283    claude-opus-5-5     claude-sonnet-5
+    //     2.1.284    claude-opus-5-5     claude-sonnet-5-5
+    //
+    // So the old floor of 2.1.280 was exactly right for the top tier and left the sonnet tier a
+    // generation behind for four releases, silently: the alias resolves inside the program, the request
+    // is well formed either way, and nothing refuses. The floor moves to the release where the SECOND
+    // tier crosses, because a stage that asks for sonnet is asking for the current sonnet.
+    //
+    // Below the floor the previous behaviour still holds: on 2.1.263 the alias returned the older model
+    // and a pinned id was refused outright ("version 2.1.280 or newer is required"), measured 2026-09-22.
+    // A floor that only asks for a program that starts is a floor that passes a machine this engine
+    // cannot run the current generation on.
+    package: "@anthropic-ai/claude-code", floor: "2.1.284",
     // WHAT THE INSTALL TAKES ON DISK, in MB, which setup states before it asks to install. MEASURED, not
     // declared by the vendor: the engines folder after a fresh install of this package into an empty
     // folder, on npm 10.9.8 and on 11.19.1, 2026-09-14. A later release can be larger or smaller, so setup
     // says "about". Re-measure when the floor moves.
-    installMB: 214,
+    installMB: 233,
     // The licence setup states wherever it tells a reader what they are about to install or use, as the
     // vendor's package declares it: "SEE LICENSE IN README.md", Anthropic's own terms.
     licence: "proprietary third-party software",

package/driver/engine/mcp/band-server.mjs

@@ -159,9 +159,9 @@ const recordUriFile = (uri) => String(uri ?? "").toLowerCase().replace(/^\/mark\
 //   /mark/ae/229552                       the bare uri (the only form that resolved) → ae-229552.json
 //   https://tm.corsearch.com/mark/ae/229552   a provider URL (the VENZY join defect's shape)
 //   `/mark/ae/229552`, "…/mark/ae/229552."    a cite carrying markdown/punctuation
-//   /mark/ch/57860  vs  ch-57860-2014.json    the store holds the registration-INSTANCE uri while
-//                                             judgment cites the record (screen-gate.mjs:99 — the
-//                                             DELPHINOL false hard-halt, same fact at a different
+//   /mark/ch/30419  vs  ch-30419-2014.json    the store holds the registration-INSTANCE uri while
+//                                             judgment cites the record (`findScreenGateViolations` in screen-gate.mjs — a
+//                                             false hard-halt, the same fact at a different
 //                                             granularity)
 // So: canonicalise the CITE through normalizeRecordUri (registry-fidelity.mjs) — the canonical form
 // pipeline, recall-reconciliation and presence-reconciliation already join on, and the

package/driver/engine/mcp/stdio-server.mjs

@@ -156,7 +156,18 @@ export function serve({ name, version = "0.1.0", tools = [] }) {
         // a seat can act on it in the turn it happens.
         const unmet = requiredFieldViolations(tool.inputSchema, params?.arguments);
         if (unmet.length) {
-          logToolEvent({ event: "settled", seq, server: name, tool: tool.name, ...(axis ? { axis } : {}), ok: false });
+          // THE REASON THE ROW HAD IN SCOPE AND THREW AWAY. A settled row with
+          // `ok: false` and nothing else asserts a failure and withholds everything that would let a
+          // reader weigh it — and a verdict turns on that, because a failed tool call counts against a
+          // run's cleanliness. Measured on the round of 2026-09-26: this gate settled a frame call in the
+          // SAME MILLISECOND it started, wrote no call file, and the record could not say why.
+          //
+          // THE FIELD NAMES, NEVER THE MESSAGE. `unmet` is a list of schema keys, so it carries no matter
+          // content; the sentence below carries none today either, but a tool's refusal text is free to
+          // interpolate a mark, and this row's own contract is the call and never its content. A row that
+          // copied the message would leak the day one of them does; a row that copies `unmet` cannot.
+          logToolEvent({ event: "settled", seq, server: name, tool: tool.name, ...(axis ? { axis } : {}), ok: false,
+            reason: `missing_required:${unmet.join(",")}` });
           return ok(id, { isError: true, content: [{ type: "text", text:
             `${tool.name}_missing_required:${unmet.join(",")} — the schema you were handed declares `
             + `${unmet.length === 1 ? "this field" : "these fields"} REQUIRED and the call did not carry `

package/driver/gateway.mjs

@@ -13,7 +13,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, wri
 import { join, dirname, basename } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
 import { tmpdir } from "node:os";
-import { config, resolveModel, modelFamily, modelSnapshotKind, envOn, envGateOn, preflightEngineBinary } from "./driver.config.mjs";
+import { config, resolveModel, modelFamily, modelSnapshotKind, envOn, envGateOn, preflightEngineBinary, olderThanFloor, ENGINE_BINARIES } from "./driver.config.mjs";
 import { probeCliVersion } from "./engine/cli-version.mjs";
 import { stageLog, runLog, note, outputMeta } from "./log.mjs";
 // — the closed disposition set has ONE author; this file dictates it and must not retype it.
@@ -1185,8 +1185,30 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     const cli = (() => {
       try {
         const pre = preflightEngineBinary(process.env);
-        return { ...probeCliVersion(pre?.resolved ?? null), source: pre?.source ?? null };
-      } catch (e) { return { version: null, probe: "unreadable", why: String(e?.message ?? e).slice(0, 160), source: null }; }
+        const probed = probeCliVersion(pre?.resolved ?? null);
+        // ── THE FLOOR, COMPARED WHERE THE RUN CAN SEE IT ────────────────────────────────────────
+        //
+        // The build declares a minimum version for each engine's program, and until now nothing
+        // compared a running copy against it. The floor was passed to the installer, so a copy this
+        // product installs cannot land beneath it — but resolution walks PATH first and takes the
+        // first hit, so a copy already on the machine wins and was never measured against anything.
+        // That is the common case, not the edge one: most machines have their own copy. A stage then
+        // runs on a program below the floor and is served whatever that program serves, silently.
+        //
+        // RECORDED, NOT REFUSED. Refusing here would stop every run on any machine whose copy is
+        // behind — including ones already deployed and working — and that is a decision about those
+        // deployments rather than a defect fix. What was missing is the fact, so the fact is what is
+        // written: an operator, and anyone reading the run afterwards, can now see it. Whether it
+        // should also refuse is a separate question and is not answered here.
+        //
+        // THREE-VALUED and written unconditionally, like the model fields below: true, false, or null
+        // when either side names no version this build can compare — an unknown is an unknown, never
+        // an all-clear. The floor itself rides along so the record says what it was measured against
+        // rather than leaving a later reader to guess which build's floor applied.
+        const floor = ENGINE_BINARIES[pre?.engine]?.floor ?? null;
+        const belowFloor = floor ? olderThanFloor(probed?.version ?? null, floor) : null;
+        return { ...probed, source: pre?.source ?? null, floor, belowFloor };
+      } catch (e) { return { version: null, probe: "unreadable", why: String(e?.message ?? e).slice(0, 160), source: null, floor: null, belowFloor: null }; }
     })();
     if (modelActual) lastModelWire = modelActual;                       // — never overwritten with null
     // The comparison is by FAMILY (driver.config modelFamily), because `--model haiku` legitimately comes
@@ -1658,6 +1680,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         // different from "this record predates the gauge".
         modelActual, modelBasis, modelSnapshot, modelMismatch, providerReported,
         cliVersion: cli.version, cliVersionProbe: cli.probe, ...(cli.why ? { cliVersionWhy: cli.why } : {}), cliSource: cli.source,
+        cliFloor: cli.floor ?? null, cliBelowFloor: cli.belowFloor ?? null,
         // W3 billing telemetry: which engine ran + the RESOLVED billing mode (subscription vs api-key). This
         // records INTENT (the mode the engine was configured to bill under), not independent billing evidence
         // — the actual proof is the provider console (claude's stream also reports apiKeySource; codex does
@@ -1797,6 +1820,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           // ran. `model` stays the requested resolution (its existing readers); `modelActual` is the wire.
           model: modelRequested, modelActual, modelBasis, modelSnapshot, modelMismatch, providerReported,
           cliVersion: cli.version, cliVersionProbe: cli.probe, ...(cli.why ? { cliVersionWhy: cli.why } : {}), cliSource: cli.source,
+        cliFloor: cli.floor ?? null, cliBelowFloor: cli.belowFloor ?? null,
           wrote, warm: warm || undefined, warmEscalated: attempt === warmEscalatedAt || undefined,
           rescued: rescued ?? undefined, killed: killed || undefined,
           quiescentMs: Number.isFinite(quiescentMs) ? Math.round(quiescentMs) : undefined,   // — see the per-stage row

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.4.0-beta.2",
+  "version": "0.4.0",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline-knockout.mjs

@@ -47,7 +47,7 @@ import {
 import { RunCancelled, assertNotCancelledBeforePublish } from "./cancel.mjs";   // stop-by-user: never the failure lane below
 import { loadFrameworkManifest, parseFrameworkManifest, frameworkFor, DEFAULT_FRAMEWORK } from "./framework.mjs";
 import { attachFrameworkMethod, methodPathFor, FROZEN_METHOD_FILE } from "./framework-method.mjs";
-import { KO_STAGES, KO_STEPS, KO_STEP_REGISTER_COUNT, koSteps, koPaths, kebab, knockoutGridSpec, KNOCKOUT_WEB, KNOCKOUT_MINUTES_BAR, koChunks } from "./stages-knockout.mjs";
+import { KO_STAGES, KO_STEPS, KO_STEP_REGISTER_COUNT, koSteps, koPaths, kebab, knockoutGridSpec, KNOCKOUT_WEB, KNOCKOUT_MINUTES_BAR, knockoutBarVerdict, koChunks } from "./stages-knockout.mjs";
 import { kebabCollisions, reportIdentityFor, CAPABILITY_SKIPPED_CAUSE, CAPABILITY_SKIPPED_NOTE } from "./search-policy.mjs";
 import { countPreflight, countRegisterHits, countedMarks, resolveCountExecutor } from "./register-count.mjs";
 import { recordsPreflight, listRegisterRecords, listedMarks, resolveRecordExecutor } from "./register-records.mjs";
@@ -60,7 +60,7 @@ import { validators as koValidators, validateMergedFindings, worstBand, register
 import { reviewAbout, reviewEvidence, reviewEvidenceLines, applyKnockoutReview, knockoutReviewFile } from "./knockout-review-record.mjs";
 import { stripNextStepSections } from "./knockout-next-step.mjs";
 import { publishKnockout, composeKnockoutEmail } from "./publish/knockout.mjs";
-import { writeRunStatus, rollupStatus, atomicWrite, identitySeed } from "./progress.mjs";   // — the identity seed is shared; the stepper is not
+import { writeRunStatus, readRunStatus, rollupStatus, atomicWrite, identitySeed } from "./progress.mjs";   // — the identity seed is shared; the stepper is not
 import { batchMarkName } from "./mark-name.mjs";
 import { runLog, note, outputMeta } from "./log.mjs";
 import { defaultTerritoryState } from "./effective-scope.mjs";   // the stored-defaults reading — one producer, shared with the clearance lane
@@ -70,7 +70,6 @@ import { rollupTokens, stampTokenRollup } from "./tokens.mjs";
 import { recordRunConsumption } from "./consumption-ledger.mjs";
 import { writeSettleStamp } from "./settle-stamp.mjs";   // — the pool copy's own terminal state
 import { stopReason } from "../shared/stop-reason.mjs";   //
-import { envFrom } from "../shared/env-aliases.mjs";   // — resolves EITHER spelling; names the retired one because that is the live-writable half
 // The scoped owner lookup a promoted register filing is owed. Bounded, deduplicated
 // per owner, and structurally unable to withhold a report.
 import { ownersOwedACheck, runOwnerChecks } from "./owner-use-check.mjs";
@@ -994,13 +993,16 @@ export async function knockoutInner(ctx, job, opts = {}) {
       const rows = readFileSync(K.sweepLedger, "utf8").split("\n").filter(Boolean).map((l) => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
       const cells = rows.reduce((n, r) => n + (Number.isFinite(r?.cells) ? r.cells : 0), 0);
       const places = rows.reduce((n, r) => Math.max(n, Array.isArray(r?.places) ? r.places.length : 0), 0);
-      const minutes = Number(((Date.now() - sweepStartedAt) / 60000).toFixed(1));
+      // THE SWEEP'S OWN ELAPSED TIME, UNDER A NAME THAT SAYS SO, and the bar is no longer asserted here.
+      // The bar is about the RUN (ruling 591) and this span is one stage of it: both knockouts of
+      // 2026-09-26 recorded `overBar: false` at 0.6 and 0.8 minutes while the runs took 14.4 minutes
+      // wall, which e2e scored as over. A bar recorded against the wrong quantity is worse than an
+      // unrecorded one, because the field's name says it answered the question. It is recorded at
+      // delivery instead, where the run's own start is readable.
+      const sweepMinutes = Number(((Date.now() - sweepStartedAt) / 60000).toFixed(1));
       runLog(run.runDir, { event: "knockout-sweep-total", marks: planMarks.length, calls: rows.length,
-        cells, mostPlacesForOneName: places, minutes, barMinutes: KNOCKOUT_MINUTES_BAR,
-        // Stated so a reader does not have to do the comparison, and so "over" is a fact about this run
-        // rather than a judgment about the build. It changes nothing this run did.
-        overBar: minutes > KNOCKOUT_MINUTES_BAR });
-      note(`knockout sweep: ${cells} cell(s) across ${rows.length} call(s) in ${minutes} min (the bar is ${KNOCKOUT_MINUTES_BAR})`);
+        cells, mostPlacesForOneName: places, sweepMinutes });
+      note(`knockout sweep: ${cells} cell(s) across ${rows.length} call(s) in ${sweepMinutes} min`);
     } catch { /* the receipts are the record; a summary that could not be read never fails a sweep */ }
     }
 
@@ -1153,7 +1155,18 @@ export async function knockoutInner(ctx, job, opts = {}) {
     const published = await publishKnockout({
       runId, codename: run.codename, runDir: run.runDir,
       findings: merged, plan, framework: ctx.framework, overall,
-      poolRoot: config.poolRoot, poolUrl: config.poolUrl ?? envFrom(process.env, "CLEAROTRON_REPORTS_URL") ?? null,
+      poolRoot: config.poolRoot,
+      // THE FALLBACK HERE COULD NOT FIRE, AND COULD NOT HAVE HELPED IF IT HAD. It read
+      // `config.poolUrl ?? envFrom(process.env, "CLEAROTRON_REPORTS_URL") ?? null`. Two things were wrong
+      // with it and both were invisible: the getter returns "" when the variable is unset, and `??` only
+      // falls through on null or undefined — so the second operand was unreachable — and that second
+      // operand read the same `process.env` the getter had just read, so reaching it would have returned
+      // the same empty answer. A reader saw a safety net twice over where there was none.
+      //
+      // `|| null` instead, which says the one true thing: no base URL configured, so no link. That is the
+      // state `reportUrlFor` already handles by returning null per report rather than an empty string, and
+      // a null link is what the delivery packet is specified to carry when no pool URL is set.
+      poolUrl: config.poolUrl || null,
       customerKey: ctx.profile?.profileKey ?? "generic",
       // — the frozen profile's delivery overlay decides the confidentiality marking, exactly as it
       // does on the clearance lane. Absent (an unbound run, or a profile silent on the field) is the
@@ -1216,6 +1229,24 @@ export async function knockoutInner(ctx, job, opts = {}) {
       writeFileSync(join(config.outboxDir, `${packet.runId}.pending`), `${agent}\n`);
     } catch (e) { note(`delivery: outbox marker write skipped (${String(e.message).slice(0, 100)})`); }
     const deliveredAt = new Date().toISOString();
+    // ── THE TEN-MINUTE BAR, AGAINST THE RUN (ruling 591) ────────────────────────────────────────────
+    //
+    // Recorded here because this is the first point at which the run's own span is known: `startedAt` is
+    // in the run's status and `deliveredAt` is the line above. It used to be recorded at the web sweep,
+    // against the sweep's own elapsed time, so both knockouts of 2026-09-26 stated `overBar: false` at
+    // 0.6 and 0.8 minutes while their runs took 14.4 minutes wall — the number beside the bar was not the
+    // number the bar is about.
+    //
+    // RECORDED, NEVER APPLIED, exactly as before: nothing reads `overBar` and nothing about this run
+    // changes on it.
+    //
+    // AND AN UNREADABLE START SAYS SO RATHER THAN VANISHING. `readRunStatus` answers `{}` when it cannot
+    // read, and a bar quietly omitted because a file was unreadable is an absence that reads as "not
+    // over". So the event always carries the field, and names the reason when it has no span.
+    try {
+      const verdict = knockoutBarVerdict({ startedAt: readRunStatus(run.runDir)?.startedAt, deliveredAt });
+      runLog(run.runDir, { event: "knockout-run-total", barMinutes: KNOCKOUT_MINUTES_BAR, ...verdict });
+    } catch { /* the bar is a record, never a gate: a summary that could not be written never fails a delivery */ }
     // `tier` beside `verdict` — the same band word under the name the clearance lane records it by, so a
     // reader of either lane's status finds the rating in one place. `verdict` stays as it was.
     writeRunStatus(ctx, { state: "delivered", tier: overall, statement: published.statement, url: published.url, reports: published.reports.map((r) => ({ mark: r.mark, url: r.url })), deliveredAt, sendPending: true, stepIndex: STEPS.length - 1, stepLabel: STEPS[STEPS.length - 1], stepN: STEPS.length, stepTotal: STEPS.length });