clearotron 0.4.0-beta.2 → 0.4.0-beta.3

package/node_modules/brace-expansion/index.js

@@ -23,6 +23,26 @@ var EXPANSION_MAX = 100000
 // characters) so legitimate input is unaffected.
 var EXPANSION_MAX_LENGTH = 4000000
 
+// `expand` recurses once per level of brace *nesting* - both when expanding a
+// set's comma members and when re-wrapping a set whose body is a single part.
+// The CVE-2026-14257 fix made the *tail* iterative (recursion on `m.post`, one
+// level per chained group), which left nesting depth unbounded: about 3,100
+// levels of `{{{...a,b...}}}` - only ~6KB of input - exhausted the native stack
+// and crashed the process. `EXPANSION_MAX_DEPTH` bounds how deep the parser
+// will follow nesting. It sits far above any realistic pattern and well below
+// the depth at which the stack runs out.
+var EXPANSION_MAX_DEPTH = 1000
+
+// Bash keeps a quirk where a brace group followed by a comma set still expands
+// (`{a},b}`). The parser implements it by rewriting the string and restarting
+// the scan, absorbing one `}` per pass. `n` trailing braces therefore cost `n`
+// full passes over a string that itself grows by one `escClose` sentinel each
+// time - quadratic in `n`, with a ~26x constant from the sentinel's length.
+// 128KB of `'{a}' + '}'.repeat(n) + ',z}'` blocked the event loop for 27
+// seconds to produce two results. `EXPANSION_MAX_REWRITES` bounds how many
+// times the scan may restart. Real `{a},b}` input needs a handful.
+var EXPANSION_MAX_REWRITES = 1000
+
 function numeric(str) {
   return parseInt(str, 10) == str
     ? parseInt(str, 10)
@@ -46,34 +66,54 @@ function unescapeBraces(str) {
 }
 
 
+// Like `target.push(...items)` but doesn't overflow the stack
+function pushAll(target, items) {
+  for (var i = 0; i < items.length; i++) {
+    target.push(items[i]);
+  }
+}
+
 // Basically just str.split(","), but handling cases
 // where we have nested braced sections, which should be
 // treated as individual members, like {a,{b,c},d}
 function parseCommaParts(str) {
-  if (!str)
-    return [''];
-
   var parts = [];
-  var m = balanced('{', '}', str);
 
-  if (!m)
-    return str.split(',');
+  // Walk the brace groups iteratively. Recursing on `post` once per group let a
+  // chain of them exhaust the stack - the parsing-side counterpart to
+  // the `expand` overflow fixed for CVE-2026-14257, and not something `max` or
+  // `maxLength` can bound, since it happens before expansion.
+  //
+  // The part the next chunk continues
+  var carry = '';
 
-  var pre = m.pre;
-  var body = m.body;
-  var post = m.post;
-  var p = pre.split(',');
+  for (;;) {
+    var m = balanced('{', '}', str);
 
-  p[p.length-1] += '{' + body + '}';
-  var postParts = parseCommaParts(post);
-  if (post.length) {
-    p[p.length-1] += postParts.shift();
-    p.push.apply(p, postParts);
-  }
+    if (!m) {
+      var tail = str.split(',');
+      tail[0] = carry + tail[0];
+      pushAll(parts, tail);
+      return parts;
+    }
 
-  parts.push.apply(parts, p);
+    var pre = m.pre;
+    var body = m.body;
+    var post = m.post;
+    var p = pre.split(',');
 
-  return parts;
+    p[0] = carry + p[0];
+    p[p.length-1] += '{' + body + '}';
+
+    if (!post.length) {
+      pushAll(parts, p);
+      return parts;
+    }
+
+    carry = p.pop();
+    pushAll(parts, p);
+    str = post;
+  }
 }
 
 function expandTop(str, options) {
@@ -83,6 +123,8 @@ function expandTop(str, options) {
   options = options || {};
   var max = options.max == null ? EXPANSION_MAX : options.max;
   var maxLength = options.maxLength == null ? EXPANSION_MAX_LENGTH : options.maxLength;
+  var maxDepth = options.maxDepth == null ? EXPANSION_MAX_DEPTH : options.maxDepth;
+  var maxRewrites = options.maxRewrites == null ? EXPANSION_MAX_REWRITES : options.maxRewrites;
 
   // I don't know why Bash 4.3 does this, but it does.
   // Anything starting with {} will have the first two bytes preserved
@@ -94,7 +136,7 @@ function expandTop(str, options) {
     str = '\\{\\}' + str.substr(2);
   }
 
-  return expand(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
+  return expand(escapeBraces(str), max, maxLength, maxDepth, 0, maxRewrites, true).map(unescapeBraces);
 }
 
 function identity(e) {
@@ -218,8 +260,18 @@ function expand(
   str,
   max,
   maxLength,
+  maxDepth,
+  depth,
+  maxRewrites,
   isTop
 ) {
+  // Too deeply nested to keep following: treat the rest as literal, the same
+  // way a group that cannot expand is already handled. Truncating rather than
+  // throwing keeps expansion total, matching `max` and `maxLength`.
+  if (depth > maxDepth) {
+    return [str];
+  }
+
   // Consume the string's top-level brace groups left to right, threading a
   // running set of combined prefixes (`acc`). Expanding the tail iteratively -
   // rather than recursing on `m.post` once per group - keeps the native stack
@@ -240,6 +292,9 @@ function expand(
   // `accBase[a]` records how much of `acc[a]` predates the current run;
   // `combine` treats an expansion as empty when it adds nothing past that.
   var accBase = [0]
+  // How many times the `{a},b}` rewrite below has restarted the scan. Each pass
+  // re-reads the whole string, so leaving this unbounded is quadratic.
+  var rewrites = 0
   var dropEmpties = false
   var firstGroup = true
   var nextBase
@@ -271,7 +326,8 @@ function expand(
     var isOptions = m.body.indexOf(',') >= 0;
     if (!isSequence && !isOptions) {
       // {a},b}
-      if (m.post.match(/,(?!,).*\}/)) {
+      if (rewrites < maxRewrites && m.post.match(/,(?!,).*\}/)) {
+        rewrites++;
         str = m.pre + '{' + m.body + escClose + m.post;
         // The rewritten string is expanded as if it were a fresh top-level one,
         // so start a new empty-drop run: anchor the baseline at what `acc`
@@ -310,7 +366,7 @@ function expand(
       var n = parseCommaParts(m.body);
       if (n.length === 1 && n[0] !== undefined) {
         // x{{a,b}}y ==> x{a}y x{b}y
-        n = expand(n[0], max, maxLength, false).map(embrace);
+        n = expand(n[0], max, maxLength, maxDepth, depth + 1, maxRewrites, false).map(embrace);
         //XXX is this necessary? Can't seem to hit it in tests.
         /* c8 ignore start */
         if (n.length === 1) {
@@ -349,7 +405,7 @@ function expand(
       values = []
       var valuesLength = 0
       outer: for (var j = 0; j < n.length; j++) {
-        var expanded = expand(n[j], max, maxLength, false)
+        var expanded = expand(n[j], max, maxLength, maxDepth, depth + 1, maxRewrites, false)
         for (var k = 0; k < expanded.length; k++) {
           var v = expanded[k]
           if (dropsEmpties && !v) continue

package/node_modules/brace-expansion/package.json

@@ -1,7 +1,7 @@
 {
   "name": "brace-expansion",
   "description": "Brace expansion as known from sh/bash",
-  "version": "1.1.18",
+  "version": "1.1.21",
   "repository": {
     "type": "git",
     "url": "git://github.com/juliangruber/brace-expansion.git"

package/node_modules/readdir-glob/node_modules/brace-expansion/index.js

@@ -22,6 +22,26 @@ var EXPANSION_MAX = 100000
 // characters) so legitimate input is unaffected.
 var EXPANSION_MAX_LENGTH = 4000000
 
+// `expand` recurses once per level of brace *nesting* - both when expanding a
+// set's comma members and when re-wrapping a set whose body is a single part.
+// The CVE-2026-14257 fix made the *tail* iterative (recursion on `m.post`, one
+// level per chained group), which left nesting depth unbounded: about 3,100
+// levels of `{{{...a,b...}}}` - only ~6KB of input - exhausted the native stack
+// and crashed the process. `EXPANSION_MAX_DEPTH` bounds how deep the parser
+// will follow nesting. It sits far above any realistic pattern and well below
+// the depth at which the stack runs out.
+var EXPANSION_MAX_DEPTH = 1000
+
+// Bash keeps a quirk where a brace group followed by a comma set still expands
+// (`{a},b}`). The parser implements it by rewriting the string and restarting
+// the scan, absorbing one `}` per pass. `n` trailing braces therefore cost `n`
+// full passes over a string that itself grows by one `escClose` sentinel each
+// time - quadratic in `n`, with a ~26x constant from the sentinel's length.
+// 128KB of `'{a}' + '}'.repeat(n) + ',z}'` blocked the event loop for 27
+// seconds to produce two results. `EXPANSION_MAX_REWRITES` bounds how many
+// times the scan may restart. Real `{a},b}` input needs a handful.
+var EXPANSION_MAX_REWRITES = 1000
+
 function numeric(str) {
   return parseInt(str, 10) == str
     ? parseInt(str, 10)
@@ -45,34 +65,54 @@ function unescapeBraces(str) {
 }
 
 
+// Like `target.push(...items)` but doesn't overflow the stack
+function pushAll(target, items) {
+  for (var i = 0; i < items.length; i++) {
+    target.push(items[i]);
+  }
+}
+
 // Basically just str.split(","), but handling cases
 // where we have nested braced sections, which should be
 // treated as individual members, like {a,{b,c},d}
 function parseCommaParts(str) {
-  if (!str)
-    return [''];
-
   var parts = [];
-  var m = balanced('{', '}', str);
 
-  if (!m)
-    return str.split(',');
+  // Walk the brace groups iteratively. Recursing on `post` once per group let a
+  // chain of them exhaust the stack - the parsing-side counterpart to
+  // the `expand` overflow fixed for CVE-2026-14257, and not something `max` or
+  // `maxLength` can bound, since it happens before expansion.
+  //
+  // The part the next chunk continues
+  var carry = '';
 
-  var pre = m.pre;
-  var body = m.body;
-  var post = m.post;
-  var p = pre.split(',');
+  for (;;) {
+    var m = balanced('{', '}', str);
 
-  p[p.length-1] += '{' + body + '}';
-  var postParts = parseCommaParts(post);
-  if (post.length) {
-    p[p.length-1] += postParts.shift();
-    p.push.apply(p, postParts);
-  }
+    if (!m) {
+      var tail = str.split(',');
+      tail[0] = carry + tail[0];
+      pushAll(parts, tail);
+      return parts;
+    }
+
+    var pre = m.pre;
+    var body = m.body;
+    var post = m.post;
+    var p = pre.split(',');
+
+    p[0] = carry + p[0];
+    p[p.length-1] += '{' + body + '}';
 
-  parts.push.apply(parts, p);
+    if (!post.length) {
+      pushAll(parts, p);
+      return parts;
+    }
 
-  return parts;
+    carry = p.pop();
+    pushAll(parts, p);
+    str = post;
+  }
 }
 
 function expandTop(str, options) {
@@ -82,6 +122,8 @@ function expandTop(str, options) {
   options = options || {};
   var max = options.max == null ? EXPANSION_MAX : options.max;
   var maxLength = options.maxLength == null ? EXPANSION_MAX_LENGTH : options.maxLength;
+  var maxDepth = options.maxDepth == null ? EXPANSION_MAX_DEPTH : options.maxDepth;
+  var maxRewrites = options.maxRewrites == null ? EXPANSION_MAX_REWRITES : options.maxRewrites;
 
   // I don't know why Bash 4.3 does this, but it does.
   // Anything starting with {} will have the first two bytes preserved
@@ -93,7 +135,7 @@ function expandTop(str, options) {
     str = '\\{\\}' + str.substr(2);
   }
 
-  return expand(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
+  return expand(escapeBraces(str), max, maxLength, maxDepth, 0, maxRewrites, true).map(unescapeBraces);
 }
 
 function embrace(str) {
@@ -205,8 +247,18 @@ function expand(
   str,
   max,
   maxLength,
+  maxDepth,
+  depth,
+  maxRewrites,
   isTop
 ) {
+  // Too deeply nested to keep following: treat the rest as literal, the same
+  // way a group that cannot expand is already handled. Truncating rather than
+  // throwing keeps expansion total, matching `max` and `maxLength`.
+  if (depth > maxDepth) {
+    return [str];
+  }
+
   // Consume the string's top-level brace groups left to right, threading a
   // running set of combined prefixes (`acc`). Expanding the tail iteratively -
   // rather than recursing on `m.post` once per group - keeps the native stack
@@ -219,6 +271,9 @@ function expand(
   // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop
   // is on the final strings, so it is applied to whichever `combine` produces
   // them (the one with no brace set left in the tail).
+  // How many times the `{a},b}` rewrite below has restarted the scan. Each pass
+  // re-reads the whole string, so leaving this unbounded is quadratic.
+  var rewrites = 0
   var dropEmpties = false
   var firstGroup = true
 
@@ -254,7 +309,8 @@ function expand(
     var isOptions = m.body.indexOf(',') >= 0;
     if (!isSequence && !isOptions) {
       // {a},b}
-      if (m.post.match(/,(?!,).*\}/)) {
+      if (rewrites < maxRewrites && m.post.match(/,(?!,).*\}/)) {
+        rewrites++;
         str = m.pre + '{' + m.body + escClose + m.post;
         isTop = true;
         continue;
@@ -282,7 +338,7 @@ function expand(
       var n = parseCommaParts(m.body);
       if (n.length === 1 && n[0] !== undefined) {
         // x{{a,b}}y ==> x{a}y x{b}y
-        n = expand(n[0], max, maxLength, false).map(embrace);
+        n = expand(n[0], max, maxLength, maxDepth, depth + 1, maxRewrites, false).map(embrace);
         //XXX is this necessary? Can't seem to hit it in tests.
         /* c8 ignore start */
         if (n.length === 1) {
@@ -316,7 +372,7 @@ function expand(
       values = []
       var valuesLength = 0
       outer: for (var j = 0; j < n.length; j++) {
-        var expanded = expand(n[j], max, maxLength, false)
+        var expanded = expand(n[j], max, maxLength, maxDepth, depth + 1, maxRewrites, false)
         for (var k = 0; k < expanded.length; k++) {
           var v = expanded[k]
           if (dropsEmpties && !v) continue

package/node_modules/readdir-glob/node_modules/brace-expansion/package.json

@@ -1,7 +1,7 @@
 {
   "name": "brace-expansion",
   "description": "Brace expansion as known from sh/bash",
-  "version": "2.1.4",
+  "version": "2.1.7",
   "repository": {
     "type": "git",
     "url": "git://github.com/juliangruber/brace-expansion.git"

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clearotron",
   "type": "module",
-  "version": "0.4.0-beta.2",
+  "version": "0.4.0-beta.3",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.4.0-beta.2",
+  "version": "0.4.0-beta.3",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {
@@ -24,6 +24,6 @@
     "@types/react-dom": "^19.3.0",
     "@vitejs/plugin-react": "^6.1.1",
     "typescript": "^7.0.2",
-    "vite": "^8.3.0"
+    "vite": "^8.3.1"
   }
 }

package/providers/jx/src/core.js

@@ -120,7 +120,6 @@ export function buildCandidateRequest({ mark, productContext = "", lane = "zh",
     model,
     max_tokens: 2048,   // 8 Han candidates + rationales need headroom; truncation is checked either way
     tools: [CANDIDATE_TOOL],
-    tool_choice: { type: "tool", name: CANDIDATE_TOOL.name },   // FORCED tool answer; shape validated at parse
     messages: [{ role: "user", content: promptFor({ mark: String(mark).trim(), productContext: String(productContext ?? "").trim() }) }],
   };
 }

package/providers/jx/src/judge.js

@@ -79,7 +79,6 @@ export function buildJudgeRequest({ mark, hits, model = DEFAULT_MODEL }) {
     model,
     max_tokens: 4096,   // 40 one-clause judgments fit well inside; truncation checked either way
     tools: [JUDGE_TOOL],
-    tool_choice: { type: "tool", name: JUDGE_TOOL.name },   // FORCED tool answer; shape validated at parse
     messages: [{ role: "user", content: prompt }],
   };
 }

package/providers/jx/src/nativeread.js

@@ -81,7 +81,6 @@ export function buildNativereadRequest({ mark, lane = "zh", payload, model = DEF
     model,
     max_tokens: 4096,   // 12 grounded items with grounds quotes need headroom; truncation checked either way
     tools: [NATIVEREAD_TOOL],
-    tool_choice: { type: "tool", name: NATIVEREAD_TOOL.name },   // FORCED tool answer; shape validated at parse
     messages: [{ role: "user", content: prompt }],
   };
 }

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-oauth-mcp-bridge
 
+## 0.4.0-beta.3
+
+No changes in this release.
+
 ## 0.4.0-beta.2
 
 No changes in this release.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.4.0-beta.2",
+  "version": "0.4.0-beta.3",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/providers/signa/src/core.js

@@ -319,7 +319,14 @@ export function normalizeRecord(rec, officeHint = null) {
     registrationNumber: rec.registration_number ?? rec.ir_number ?? null,
     applicationDate: toIso(rec.filing_date),
     registrationDate: toIso(rec.registration_date),
-    expiryDate: toIso(rec.expiry_date),
+    // — THE OFFICE'S DATE FIRST, THEN SIGNA'S OWN (their 27 September release). That release split what
+    // an office published from what Signa computes: `expiry_date` now carries only the published date and
+    // is EMPTY on USPTO records, where the computed one moved to `derived.expiry_date`. Read one and the
+    // field goes quietly null on every US record — measured on the record bodies of the run that
+    // straddled the release: 4 of 9 US records carried it only under `derived`, and all 4 normalised to
+    // null here. Where both are present they are identical (12 of 12 on that run), so the office's value
+    // first costs nothing and keeps the published date authoritative when there is one.
+    expiryDate: toIso(rec.expiry_date ?? rec.derived?.expiry_date),
     statusClass: statusClassOf(rec),   // live | dead | unknown — authoritative for the gates
     statusText: pickStatusText(rec),
     markText: rec.mark_text ?? null,
@@ -353,16 +360,31 @@ export function normalizeRecord(rec, officeHint = null) {
     // "absent from the register", and `nativeScriptIndex` is settled from the record, not from this.
     markTextScript: rec.mark_text_script ?? null,
     markTextLanguage: rec.mark_text_language ?? null,
-    renewalDueDate: toIso(rec.renewal_due_date),
+    // The same split as `expiryDate` above, and the vendor names both fields in it. UNEXERCISED ON THE
+    // DATA WE HOLD: of the 22 record bodies from the run that straddled the release, none carried a
+    // renewal date in either place, so the fallback recovers nothing we can point at. It is here because
+    // the register says this field moved with expiry, and reading one place is how the expiry loss
+    // happened; the arm for it is therefore synthetic and says so.
+    renewalDueDate: toIso(rec.renewal_due_date ?? rec.derived?.renewal_due_date),
     publicationDate: toIso(rec.publication_date),
     priorityDate: toIso(rec.priority_date),
     terminationDate: toIso(rec.termination_date),
-    // Opposition data IS on the record now: `opposition_window` rides every search row and
-    // `proceedings_count` the full record. The per-proceeding detail behind
-    // GET /v1/trademarks/{id}/proceedings is still an unwired tool — so the window and the count are
-    // reported, and the absence of detail is stated rather than left to look like an absence of
-    // proceedings.
-    oppositionWindow: rec.opposition_window ?? null,
+    // Opposition data IS on the record, and NOT where this used to look. The register reports the window
+    // under its computed object, and as an OBJECT rather than a scalar:
+    // `{supported, window_opens, window_closes, …}`, or `{supported: false, reason, rule_id}` where the
+    // stage cannot be opposed. `proceedings_count` is still the office's own, top-level.
+    //
+    // THE OLD READ RETURNED NULL ON EVERY RECORD WE HOLD, and the comment here asserted otherwise — that
+    // the window "rides every search row". Measured over all four saved runs on this register: 0 of 6,
+    // 0 of 5, 0 of 7 and 0 of 22 bodies carried it top-level, and 6, 3, 7 and 22 carried it under the
+    // computed object. So the earliest evidence we have already reads the new place, eleven days before
+    // the release the register attributes the move to. Which of the two dates is right does not change
+    // what to read; it does mean this was not reported missing for as long as it was missing.
+    //
+    // The per-proceeding detail behind GET /v1/trademarks/{id}/proceedings is still an unwired tool, so
+    // the window and the count are reported and the absence of detail is stated rather than left to look
+    // like an absence of proceedings.
+    oppositionWindow: rec.opposition_window ?? rec.derived?.opposition_window ?? null,
     proceedingsCount: rec.proceedings_count ?? null,
     oppositions: null,
     _provenance: { opposition: rec.proceedings_count != null ? `count=${rec.proceedings_count} from the record; per-proceeding detail via /proceedings, tool not wired` : "per-proceeding detail via /proceedings, tool not wired" },
@@ -485,8 +507,8 @@ export function normalizeSearchResponse(body, echoQuery) {
 //
 // THIS HEADER USED TO ADVERTISE AN ENVIRONMENT VARIABLE, `CLAWDI_SIGNA_MOCK`. There was never such a
 // variable: two occurrences in the whole tree, both comments, zero reads. Following the line produced a
-// run that died at preflight in seconds, and it cost a real investigation (, found by e2e looking
-// for a credential-free register lane for fault injection).
+// run that died at preflight in seconds, and it cost a real investigation — found while looking for a
+// register path that needs no credential, to inject faults into.
 //
 // The lane below is real and works. What does not exist is a way to REACH it from a run: `doSearch`,
 // `doRecordFetch` and `doEnumerate` each take `{ mock = false }`, the capability wrappers pass
@@ -494,10 +516,11 @@ export function normalizeSearchResponse(body, echoQuery) {
 // (driver.config.mjs) call these functions with no options object at all. So the only callers that
 // enable it are this provider's own tests, and that is the whole of it.
 //
-// AND IT STAYS THAT WAY DELIBERATELY, rather than for want of wiring. offered to wire it; the
-// acceptance that comes with wiring is "preflightCredentials must not demand SIGNA_API_KEY when the
-// mock lane is on", and that produces a clearance run with no register credential, reaching the
-// register stage, answering from ten in-repo fixtures. ADR-0003's first table row rules exactly that
+// AND IT STAYS THAT WAY DELIBERATELY, rather than for want of wiring. Wiring it was offered and
+// declined; the acceptance that comes with wiring is "preflightCredentials must not demand
+// SIGNA_API_KEY when the mock path is on", and that produces a clearance run with no register
+// credential, reaching the register stage, answering from ten in-repo fixtures. ADR-0003's first
+// table row rules exactly that
 // out: the register REFUSES at preflight, by name, because "an unconfigured register that answered
 // 'no conflicts found' is the most dangerous output this system can produce".
 //

package/scripts/e2e-first-time.mjs

@@ -163,10 +163,18 @@ export const NOT_COUNTED_EVENTS = {
     "jx-aim-consumed", "jx-candidate-fold", "jx-nativeread", 
     "jx-serp-grid", "jx-serp-grid-overflow", "jx-serp-grid-spec", "jx-slices-stated",
     "knockout-published", "knockout-receipts", 
-    "knockout-register-records", "knockout-sweep-skipped", "knockout-sweep-start",
-    // The sweep's cost line: marks, calls, cells, the largest place list any one name carried, the minutes
-    // and the target they are read against. A RECORD, never a failure — nothing about it is a step that
-    // went wrong, a question re-asked or an attempt repeated, so it does not bear on "first time" (515).
+    "knockout-register-records",
+    // The run's own span against the ten-minute target, written at delivery because that is the first
+    // point at which the run's span is known. Same class as the sweep's line below: a RECORD, never a
+    // failure. `overBar: null` on it means the span could not be measured, which is a gap in the record
+    // and still not a retry (515).
+    "knockout-run-total",
+    "knockout-sweep-skipped", "knockout-sweep-start",
+    // The sweep's cost line: marks, calls, cells, the largest place list any one name carried, and the
+    // sweep's own elapsed minutes. A RECORD, never a failure — nothing about it is a step that went
+    // wrong, a question re-asked or an attempt repeated, so it does not bear on "first time" (515).
+    // The target moved off this line to the run's own, above: the bar is about a run and this span is
+    // one stage of it.
     "knockout-sweep-total", "level-scope-note",
     "named-band-merged", "one-shot-stamp-settled", "order-probe", "output-snapshot", "owner-screen-derived",
     "placement-borderline", "placement-form-written", "plan-execution", "plan-execution-census",

package/scripts/e2e-scenario-ops.mjs

@@ -282,17 +282,40 @@ export function narrowingNamesItsCrowd(a, runDir) {
   const exec = readJson(driverDir(runDir, "plan-execution.json"));
   if (!exec) return { ok: false, saw: "_driver/plan-execution.json absent, so no question's count can be read" };
   const counts = executedCounts(exec);
-  const crowdMissing = [], crowdUncounted = [], narrowingUncounted = [];
+  // A QUESTION ASKED OFF THE PLAN IS DISPOSITIONED, NOT OMITTED, and this op had no branch for it.
+  //
+  // The plan record carries an `unplanned` bucket: the engine asked something the plan did not contain
+  // and said so. Such an entry is on the record with a disposition and carries no executed count, and
+  // this check used to render that as "carries no count of its own" — which describes a silent omission.
+  // On the run that surfaced it, that ONE narrowing was the whole failure: 35 of 36 carried their own
+  // count, all 14 crowds were on the record, and neither crowd branch fired.
+  //
+  // IT IS NAMED, NOT COUNTED AGAINST THE ENGINE. The rule this op states is that the crowd a narrowing
+  // replaced is on the record with a count. An off-plan question satisfies the first half and cannot
+  // satisfy the second, because no count exists to read — and whether the engine ought to record one for
+  // a question it asked off-plan is a question about the RECORD, not about this narrowing. That belongs
+  // to the lane that writes the record; this op says what it found and declines to invent a verdict.
+  const offPlanQids = new Set(list(exec.unplanned).map((e) => text(e?.qid)).filter(Boolean));
+  const crowdMissing = [], crowdUncounted = [], narrowingUncounted = [], narrowingOffPlan = [];
   for (const n of narrowings) {
     const crowd = text(n.narrows);
     if (!byQid.has(crowd)) crowdMissing.push(`${n.qid} → ${crowd}`);
     else if (!counts.has(crowd)) crowdUncounted.push(`${n.qid} → ${crowd}`);
-    if (!counts.has(text(n.qid))) narrowingUncounted.push(text(n.qid));
+    if (!counts.has(text(n.qid))) {
+      if (offPlanQids.has(text(n.qid))) narrowingOffPlan.push(text(n.qid));
+      else narrowingUncounted.push(text(n.qid));
+    }
   }
   const parts = [`${plural(narrowings.length, "narrowing")} naming ${new Set(narrowings.map((n) => text(n.narrows))).size} crowd(s)`];
   if (crowdMissing.length) parts.push(`${crowdMissing.length} name a crowd that is not on the record${sample(crowdMissing)}`);
   if (crowdUncounted.length) parts.push(`${crowdUncounted.length} name a crowd with no count${sample(crowdUncounted)}`);
   if (narrowingUncounted.length) parts.push(`${narrowingUncounted.length} carry no count of their own${sample(narrowingUncounted)}`);
+  // Said whether or not anything failed, because it is the difference between a question the engine
+  // never answered and one it asked outside the plan — and a reader cannot tell those apart from a
+  // count's absence alone.
+  if (narrowingOffPlan.length) parts.push(`${narrowingOffPlan.length} asked OFF THE PLAN: on the record`
+    + ` in plan-execution's \`unplanned\` bucket with a disposition and no executed count, so this check`
+    + ` has no count to read rather than a count that is missing${sample(narrowingOffPlan)}`);
   if (parts.length === 1) parts.push("each crowd and each narrowing on the record with its count");
   return { ok: !crowdMissing.length && !crowdUncounted.length && !narrowingUncounted.length, saw: parts.join("; ") };
 }