clearotron 0.4.0-beta.3 → 0.4.0

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "c8159f8575f90587b1c78d5151d9acf9235977e1",
-  "version": "0.4.0-beta.3"
+  "commit": "9b8ab0f275a16e9b586425c3574c94b5974e225b",
+  "version": "0.4.0"
 }

package/driver/CHANGELOG.md

@@ -1,5 +1,86 @@
 # clearotron-driver
 
+## 0.4.0
+
+### Minor Changes
+
+- New: A knockout search now also asks whether each name is already in use in the client's field, such as a game character or a drink.
+- Before you upgrade: a new operator key must now name the tools it may use, for example `--verbs start_run,stop_run`. Keys already issued keep working.
+  
+  For operators: a revoked key stops working even where no revocation list was set up, because every connector now reads the install's own list.
+  
+  Fixed: over the network, an operator key can no longer start a what-if that its assistant is not shown.
+  
+  Fixed: the portal refuses a change sent from another website, or from another app on the same computer, including a sign-in.
+- New: Searching by judgment.
+  
+  This release changes how a clearance decides what to search. Until now the engine followed fixed rules: a set number of spellings, a fixed list of stores, a stop after the first identical mark. Fixed rules are fast and cheap, but they miss things. On a recent matter, a lawyer's review found marks the engine had counted but never read, and others it had raised that did not matter.
+  
+  So the approach changes. Wherever the engine holds a pile of results, it now looks at what is there and decides what a lawyer would raise. It carries that forward and writes down what it set aside, and why. Nothing is dropped silently. Every wider search, every spelling set aside and every store left out appears in the audit workbook with its reason.
+  
+  What you will notice:
+  - Searches widen where it could change the advice, and narrow where it cannot.
+  - Near spellings no buyer would confuse with the mark are set aside, with the reason recorded.
+  - Searches in other scripts run only in markets that file marks in that script.
+  - A large company's register is read for the marks that share the searched name. The rest is counted, not fetched.
+  - Marketplace searches cover the stores that sell the client's goods, and say which stores were left out and why.
+  - The report no longer opens with the internal reviewer's notes. They reach the reviewing lawyer separately.
+  - A large marketplace search no longer fails because its results were too big to return in one piece.
+  - Where a company's framework rates through named inputs, the report shows them beside each band.
+  
+  A word on regressions. While testing this line we found two. A crowded search failed before delivering its report, and a knockout's ratings moved one step away from the lawyer's. Both were caught by running the same matters against a lawyer's answers, and both are fixed here. Every build is now tested that way before it ships. We are tuning for three things at once: a report that is right the first time, delivered fast, at a sensible cost. They pull against each other, and each release is our best current balance.
+
+### Patch Changes
+
+- For operators: a run now records the version of the engine program that served it, and whether that version is older than this release asks for. A search that ran on an old copy can be identified afterwards.
+- Fixed: reports and their cover emails no longer carry the open-question rows or the internal review note. Both were written for the lawyer checking a run rather than the client reading the result, and they stay with the run record.
+- For operators: on the Anthropic engine, a search can no longer read the install's settings or other private files.
+- For operators: stages on the Anthropic engine can no longer run commands on the server; every tool that runs a command is removed from them.
+- Fixed: In a crowded field, the search now reads the spellings a lawyer would raise, rather than the ones that fit under a record limit.
+- Fixed: When a knockout's search for filings fails, the report and the audit workbook no longer show the raw error.
+- Fixed: On Windows, a failed finding card no longer shows as covered in the audit workbook.
+- Fixed: When a search could not be made, the report says so instead of giving a wrong reason.
+- Fixed: A register search limited to the client's goods now searches every other office when one office cannot filter by goods.
+- Fixed: a right the report keeps is no longer dropped because other registrations of the same right were ruled out.
+- Fixed: A knockout search no longer drops a store listing or fan wiki page its web search found; the rating now reads every result.
+- Fixed: A knockout's audit workbook also lists a part that failed as a whole, such as its filings listing or plain-language review. A filing shown without its link now says why.
+- Fixed: on a Mac, `clearotron start` no longer offers to run in the background, which only works on Linux.
+- Fixed: on a Mac, a search step could write into Clearotron's own protected folders by naming them in a different letter case. Those writes are now refused.
+- Fixed: A register search that times out across many countries is asked again in smaller parts; one that still times out is reported as incomplete.
+- Fixed: on the OpenAI engine, Codex's own sandbox no longer refuses the register searches a clearance runs.
+- Fixed: Reports no longer show a gap in coverage when a search was skipped because an identical one had already run.
+- For operators: on the OpenAI engine with Codex's sandbox on, the commands a search runs can no longer read the install's settings or other private files.
+- Fixed: the audit workbook's What was searched tab no longer shows a web or marketplace search that found similar listings as clean.
+- Fixed: Worldwide searches are no longer narrowed to an account's default territories, and results too crowded to read in full are no longer reported clean.
+- Fixed: A report no longer offers a native-language investigation to a client who ordered one, and says when that investigation was not completed.
+- Fixed: When a knockout's lookup of a filing owner fails, its read now says the lookup did not answer, instead of saying it found nothing.
+- Fixed: Clarivate clearances no longer count look-alike spellings that mix Latin with Greek or Cyrillic letters as searches that could not be completed.
+- For operators: Clarivate clearances no longer fetch a record, or repeat a count, search or owner lookup, that the same run already made.
+- New: Clearotron runs natively on Windows, from PowerShell: no WSL2, no Git and no administrator rights.
+- Fixed: closing the window that runs `clearotron start` now stops Clearotron. Before, it kept running in the background.
+- Fixed: Creating a company in the portal no longer stops with a request to run a git command.
+- Fixed: a full country search's report no longer says court decisions were searched when that search failed or its source was down.
+- New: Global preliminary, multi-country and full country searches now search the web in more depth and keep more results from each search.
+- For operators: Knockouts on Signa and Clarivate take their name and close-variation counts from the listing, so each is asked of the register once.
+- Fixed: A new company starts with no marketplaces. The company page offers the usual ones to add, and a company with none is still searched on the general web.
+- Fixed: Opposition windows appear again on register records, and renewal dates are read from where the register now publishes them.
+- Fixed: opening a report no longer contacts any font service; the report carries its typeface, now Plus Jakarta Sans, inside itself.
+- Fixed: searches no longer reuse earlier results.
+- Before you upgrade: setup and `clearotron doctor` now ask for a newer Claude Code, because the older one quietly serves an earlier model generation.
+- Fixed: Knockouts on the Signa register now say how many register hits the listed filings were drawn from.
+- Fixed: Clearances on the Signa register no longer search look-alike spellings that mix Latin with Greek or Cyrillic letters; those searches found only unrelated marks.
+- Fixed: skipped searches are no longer shown as unfinished in the report.
+- For operators: each stage's AI program now receives only the settings it needs, and never the key that signs access keys.
+- Fixed: The audit workbook now lists, on Coverage & gaps, any part of a report that could not be completed on the run. A knockout's Audit Trail also lists an owner lookup that got no answer.
+- Fixed: on the OpenAI engine, a Full country search now reads case law from CourtListener and Legal Data Hunter, not EUR-Lex alone.
+- Fixed: setup, `clearotron doctor` and the start of every search now check that the engine can write a file where a search writes its results.
+- New: The meaning and reputation search now asks the questions the matter's framing names, in the languages whose markets matter. Where the framing names none, the report says no meaning search ran.
+- For operators: the old default agent name is gone from the product. An install upgrading from a version before 0.2.2 must set its own agent name to keep seeing its earlier runs.
+- Fixed: The operator tool no longer accepts instructions, which never reached the run; a call sending them is refused.
+- Fixed: on the OpenAI engine, the tool that reads web pages now refuses addresses on the server's own network, such as cloud metadata addresses.
+- For operators: the background worker no longer receives the key that signs access keys. Run `clearotron start --background` once to update an installed worker.
+- Fixed: Expiry dates appear again on US trademark records, which had been left blank since the register moved where it publishes them.
+
 ## 0.4.0-beta.3
 
 ### Patch Changes

package/driver/ask-ledger.mjs

@@ -583,8 +583,8 @@ export function parseAskClosureLines(text) {
  * could-not-look, and the caller below fails toward leaving the ask OPEN rather than closing it on a
  * file it could not read.
  *
- * ✕ NEVER a substring search of the serialized document. `"DELFIN" in JSON.stringify(findings)` is true
- * when the findings name DELFIN TECHNOLOGIES OY and nothing else — a membership test that matches every
+ * ✕ NEVER a substring search of the serialized document. `"KORFIN" in JSON.stringify(findings)` is true
+ * when the findings name KORFIN TECHNOLOGIES OY and nothing else — a membership test that matches every
  * longer name inflates whatever it is counting and reads as a clean result. The field, or nothing.
  * PURE.
  */

package/driver/engine/mcp/band-server.mjs

@@ -159,9 +159,9 @@ const recordUriFile = (uri) => String(uri ?? "").toLowerCase().replace(/^\/mark\
 //   /mark/ae/229552                       the bare uri (the only form that resolved) → ae-229552.json
 //   https://tm.corsearch.com/mark/ae/229552   a provider URL (the VENZY join defect's shape)
 //   `/mark/ae/229552`, "…/mark/ae/229552."    a cite carrying markdown/punctuation
-//   /mark/ch/57860  vs  ch-57860-2014.json    the store holds the registration-INSTANCE uri while
-//                                             judgment cites the record (screen-gate.mjs:99 — the
-//                                             DELPHINOL false hard-halt, same fact at a different
+//   /mark/ch/30419  vs  ch-30419-2014.json    the store holds the registration-INSTANCE uri while
+//                                             judgment cites the record (`findScreenGateViolations` in screen-gate.mjs — a
+//                                             false hard-halt, the same fact at a different
 //                                             granularity)
 // So: canonicalise the CITE through normalizeRecordUri (registry-fidelity.mjs) — the canonical form
 // pipeline, recall-reconciliation and presence-reconciliation already join on, and the

package/driver/gateway.mjs

@@ -13,7 +13,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, wri
 import { join, dirname, basename } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
 import { tmpdir } from "node:os";
-import { config, resolveModel, modelFamily, modelSnapshotKind, envOn, envGateOn, preflightEngineBinary } from "./driver.config.mjs";
+import { config, resolveModel, modelFamily, modelSnapshotKind, envOn, envGateOn, preflightEngineBinary, olderThanFloor, ENGINE_BINARIES } from "./driver.config.mjs";
 import { probeCliVersion } from "./engine/cli-version.mjs";
 import { stageLog, runLog, note, outputMeta } from "./log.mjs";
 // — the closed disposition set has ONE author; this file dictates it and must not retype it.
@@ -1185,8 +1185,30 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     const cli = (() => {
       try {
         const pre = preflightEngineBinary(process.env);
-        return { ...probeCliVersion(pre?.resolved ?? null), source: pre?.source ?? null };
-      } catch (e) { return { version: null, probe: "unreadable", why: String(e?.message ?? e).slice(0, 160), source: null }; }
+        const probed = probeCliVersion(pre?.resolved ?? null);
+        // ── THE FLOOR, COMPARED WHERE THE RUN CAN SEE IT ────────────────────────────────────────
+        //
+        // The build declares a minimum version for each engine's program, and until now nothing
+        // compared a running copy against it. The floor was passed to the installer, so a copy this
+        // product installs cannot land beneath it — but resolution walks PATH first and takes the
+        // first hit, so a copy already on the machine wins and was never measured against anything.
+        // That is the common case, not the edge one: most machines have their own copy. A stage then
+        // runs on a program below the floor and is served whatever that program serves, silently.
+        //
+        // RECORDED, NOT REFUSED. Refusing here would stop every run on any machine whose copy is
+        // behind — including ones already deployed and working — and that is a decision about those
+        // deployments rather than a defect fix. What was missing is the fact, so the fact is what is
+        // written: an operator, and anyone reading the run afterwards, can now see it. Whether it
+        // should also refuse is a separate question and is not answered here.
+        //
+        // THREE-VALUED and written unconditionally, like the model fields below: true, false, or null
+        // when either side names no version this build can compare — an unknown is an unknown, never
+        // an all-clear. The floor itself rides along so the record says what it was measured against
+        // rather than leaving a later reader to guess which build's floor applied.
+        const floor = ENGINE_BINARIES[pre?.engine]?.floor ?? null;
+        const belowFloor = floor ? olderThanFloor(probed?.version ?? null, floor) : null;
+        return { ...probed, source: pre?.source ?? null, floor, belowFloor };
+      } catch (e) { return { version: null, probe: "unreadable", why: String(e?.message ?? e).slice(0, 160), source: null, floor: null, belowFloor: null }; }
     })();
     if (modelActual) lastModelWire = modelActual;                       // — never overwritten with null
     // The comparison is by FAMILY (driver.config modelFamily), because `--model haiku` legitimately comes
@@ -1658,6 +1680,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         // different from "this record predates the gauge".
         modelActual, modelBasis, modelSnapshot, modelMismatch, providerReported,
         cliVersion: cli.version, cliVersionProbe: cli.probe, ...(cli.why ? { cliVersionWhy: cli.why } : {}), cliSource: cli.source,
+        cliFloor: cli.floor ?? null, cliBelowFloor: cli.belowFloor ?? null,
         // W3 billing telemetry: which engine ran + the RESOLVED billing mode (subscription vs api-key). This
         // records INTENT (the mode the engine was configured to bill under), not independent billing evidence
         // — the actual proof is the provider console (claude's stream also reports apiKeySource; codex does
@@ -1797,6 +1820,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           // ran. `model` stays the requested resolution (its existing readers); `modelActual` is the wire.
           model: modelRequested, modelActual, modelBasis, modelSnapshot, modelMismatch, providerReported,
           cliVersion: cli.version, cliVersionProbe: cli.probe, ...(cli.why ? { cliVersionWhy: cli.why } : {}), cliSource: cli.source,
+        cliFloor: cli.floor ?? null, cliBelowFloor: cli.belowFloor ?? null,
           wrote, warm: warm || undefined, warmEscalated: attempt === warmEscalatedAt || undefined,
           rescued: rescued ?? undefined, killed: killed || undefined,
           quiescentMs: Number.isFinite(quiescentMs) ? Math.round(quiescentMs) : undefined,   // — see the per-stage row

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.4.0-beta.3",
+  "version": "0.4.0",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline-knockout.mjs

@@ -70,7 +70,6 @@ import { rollupTokens, stampTokenRollup } from "./tokens.mjs";
 import { recordRunConsumption } from "./consumption-ledger.mjs";
 import { writeSettleStamp } from "./settle-stamp.mjs";   // — the pool copy's own terminal state
 import { stopReason } from "../shared/stop-reason.mjs";   //
-import { envFrom } from "../shared/env-aliases.mjs";   // — resolves EITHER spelling; names the retired one because that is the live-writable half
 // The scoped owner lookup a promoted register filing is owed. Bounded, deduplicated
 // per owner, and structurally unable to withhold a report.
 import { ownersOwedACheck, runOwnerChecks } from "./owner-use-check.mjs";
@@ -1156,7 +1155,18 @@ export async function knockoutInner(ctx, job, opts = {}) {
     const published = await publishKnockout({
       runId, codename: run.codename, runDir: run.runDir,
       findings: merged, plan, framework: ctx.framework, overall,
-      poolRoot: config.poolRoot, poolUrl: config.poolUrl ?? envFrom(process.env, "CLEAROTRON_REPORTS_URL") ?? null,
+      poolRoot: config.poolRoot,
+      // THE FALLBACK HERE COULD NOT FIRE, AND COULD NOT HAVE HELPED IF IT HAD. It read
+      // `config.poolUrl ?? envFrom(process.env, "CLEAROTRON_REPORTS_URL") ?? null`. Two things were wrong
+      // with it and both were invisible: the getter returns "" when the variable is unset, and `??` only
+      // falls through on null or undefined — so the second operand was unreachable — and that second
+      // operand read the same `process.env` the getter had just read, so reaching it would have returned
+      // the same empty answer. A reader saw a safety net twice over where there was none.
+      //
+      // `|| null` instead, which says the one true thing: no base URL configured, so no link. That is the
+      // state `reportUrlFor` already handles by returning null per report rather than an empty string, and
+      // a null link is what the delivery packet is specified to carry when no pool URL is set.
+      poolUrl: config.poolUrl || null,
       customerKey: ctx.profile?.profileKey ?? "generic",
       // — the frozen profile's delivery overlay decides the confidentiality marking, exactly as it
       // does on the clearance lane. Absent (an unbound run, or a profile silent on the field) is the

package/driver/pipeline.mjs

@@ -10,7 +10,7 @@ import { readFileSync, existsSync, mkdirSync, writeFileSync, renameSync, copyFil
 import { createHash } from "node:crypto";
 import { join, dirname, basename, resolve } from "node:path";   // resolve: the resume line must work from any cwd
 import { driverDir, driverRel, ensureDriverDir } from "../shared/driver-dir.mjs";
-import { REVIEWER_OPEN_QUESTIONS_FILE, reviewerOpenPointsForEmail } from "./reviewer-open-points.mjs";   // the run-record file the reviewer's open points go to   // — one definition of where `_driver/` is
+import { REVIEWER_OPEN_QUESTIONS_FILE } from "./reviewer-open-points.mjs";   // the run-record file the reviewer's open points go to, and the only thing that reads them now
 import { goodsOf } from "./queue-markers.mjs";   // — one reading of "does this job name goods", shared with the intake gate
 import { terminalClampDecision, orderClausesForLede, clientConditions, clauseForDefect } from "./terminal-clamp.mjs";   // — deliver and clamp, never withhold
 import { recordSpan } from "./attributed-span.mjs";   // — driver work the decomposition can attribute
@@ -47,7 +47,7 @@ import { readRegisterTaint, readActiveTaintAxes } from "./register-taint.mjs";
 import { parseNamedBand, mergeNamedBands, findCollapsedBands, quarantineUnknownStates, taintQuarantineCleanBlocks, bandRecords } from "./named-band.mjs";
 import { recordOriginsFor } from "./record-origins.mjs";
 import { REGISTER_PROVIDER } from "./driver.config.mjs";
-import { noteRegisterServed, registersServedFrom, providerUsageCaveat } from "./register-served.mjs";   // which register actually served this run, from the resolver the dispatch itself uses
+import { noteRegisterServed, registersServedFrom, providerUsageCaveat } from "./register-served.mjs";   // which registers actually served this run — noted eagerly from the dispatch's own resolver, and reconciled at publish against the ledger rows, which carry the vendor per call
 import { FACTS_FILE as DIGEST_FACTS_FILE, ACCOUNTING_STAMP as DIGEST_ACCOUNTING_STAMP, recordedFindingUris,
   digestAccountingGap, digestBatchBrief, batchesOf } from "./register-digest-record.mjs";   // conversion 11 — the render's facts sidecar and the accounting era stamp
 import { buildBandShape, dominantElementComposites, deriveRegisterPositions, floorTierByMark, floorMarkKey } from "./band-shape.mjs";   // PR-8 — the deterministic reading layer; P2-A — candidates + positions
@@ -7685,9 +7685,27 @@ export function buildOnlyYouSection(actions, findings, { nowMs = Date.now(), wit
   // addressed TO the reader; monitoring and filing-routine are standing items. Same tags as before, so
   // a reader who knows the old list reads the new one unchanged, one level down.
   const ASK_KINDS = new Set(["client-fact", "commercial-decision"]);
+  // ── THE KINDS THAT DO NOT REACH A CLIENT SURFACE ────────────────────────────────────────────────
+  //
+  // Owner ruling, 2026-10-01, on the clearance emails production sent in the preceding day: the
+  // "[Open question]" rows are non-critical and confuse, and they come OUT of the client's report and
+  // email. They are not reworded and nothing replaces them.
+  //
+  // THE FILTER IS HERE AND NOT ON `advisories` ABOVE, which is the whole care in this change. That list
+  // also feeds `actionDates`, so dropping a kind from it would silently take a declared deadline out of
+  // the date set three predelivery checks key on — a client-facing removal quietly changing a date
+  // check. Filtering at the point of RENDERING removes the rows from the document and touches nothing
+  // else: the register in findings.json is unchanged, the kind stays valid, an advisory still never
+  // conditions reliance, and the verdict and its bound read from the register rather than from these
+  // lines.
+  //
+  // So the row is gone from what the client reads and the fact is still on the run, which is what the
+  // ruling asks for.
+  const NOT_FOR_CLIENT = new Set(["client-fact"]);
   const advisoryLine = (a) => `- **${ADVISORY_TAG[a.kind]}** ${askLine(a)}${a.deadline?.date ? ` (by ${a.deadline.date})` : ""}`;
-  const askLines = advisories.filter((a) => ASK_KINDS.has(a.kind)).map(advisoryLine);
-  const watchLines = advisories.filter((a) => !ASK_KINDS.has(a.kind)).map(advisoryLine);
+  const forClient = (a) => !NOT_FOR_CLIENT.has(a.kind);
+  const askLines = advisories.filter((a) => ASK_KINDS.has(a.kind)).filter(forClient).map(advisoryLine);
+  const watchLines = advisories.filter((a) => !ASK_KINDS.has(a.kind)).filter(forClient).map(advisoryLine);
   const groups = [
     ["Before you can rely on this result", conditionLines],
     ["We need an answer from you", askLines],
@@ -15184,6 +15202,23 @@ async function pipelineInner(job, opts = {}) {
       // same record, so the two register fields in one status cannot silently disagree: the served list
       // says two, and this says the tally covers both and could only be filed under one. Splitting the
       // tally by register is a second question and is not answered here.
+      // ── THE LEDGER IS WHAT KNOWS, SO ASK IT BEFORE READING THE RECORD ───────────────────────────
+      //
+      // `registersServed` was written from ONE place: the adapter wrapper the record fetcher, the record
+      // lister and a gated plan executor pass through. A clearance that takes counts and never fetches a
+      // record went through none of them and recorded no register at all — the run could not say which
+      // vendor answered it, and `registersServedFrom` returned [] for a run that had called a register
+      // hundreds of times.
+      //
+      // Every one of those calls wrote a ledger row, and every row carries the vendor that produced it, so
+      // the tally just computed already holds the answer per call. Noting them here is not a second source
+      // of truth competing with the first: it is the same memoised setter, which unions and writes only on
+      // change, so the eager note during the run and this reconciliation at publish cannot disagree.
+      //
+      // WHY NOT `activeProvider()` HERE. That resolves the register active at publish, which is the
+      // confident-and-wrong answer this whole field exists to end — and on a run that changed register it
+      // would name one vendor while the rows name two. The rows are per call; the resolver is per moment.
+      for (const id of usage.providers) noteRegisterServed(run.runDir, id);
       const served = registersServedFrom(readRunStatus(run.runDir));
       const spans = providerUsageCaveat(served);
       runLog(run.runDir, { event: "provider-usage", provider, ...(served.length > 1 ? { spans: served } : {}), ...usage });
@@ -15251,7 +15286,14 @@ async function pipelineInner(job, opts = {}) {
     // rule still forbids is the ENGINE'S OWN WORDS getting there: composeEmailHtml enumerates
     // predelivery-lint's code-owned projection (deliveryFlagLines), never the checks' raw `detail` —
     // this mail is addressed to job.forwarderEmail, which on a client-principal run is the client.
-    emailVerdictOpts.reviewerOpenPointsMd = reviewerOpenPointsForEmail(job, dirname(P.report));   writeFileSync(P.emailBody, composeEmailHtml(P.report, published.url, published.auditFile, emailNames, deliveryForRun(ctx), emailVerdictOpts));
+    // THE REVIEWER'S OPEN POINTS NO LONGER RIDE THE EMAIL (owner ruling, 2026-10-01). This line read them
+    // out of the run record and handed them to the cover, which is how the sentence naming the independent
+    // reviewer reached a client after the 2026-09-24 ruling had already taken it off the report page: the
+    // section stopped being spliced into the body and started being posted to the email instead. Measured
+    // on the last thirty days of production, the report carries neither the heading nor that sentence since
+    // that ruling, and the email carries both. The record is still written beside the report for the
+    // reviewing lawyer; nothing reads it onto a client surface.
+    writeFileSync(P.emailBody, composeEmailHtml(P.report, published.url, published.auditFile, emailNames, deliveryForRun(ctx), emailVerdictOpts));
     // ctx.verdict is set BEFORE the packet is composed, because the packet's copy reads it.
     ctx.verdict = verdict;
     // DELIVERY (Phase 2). The driver writes a self-contained delivery packet and leaves

package/driver/provider-usage.mjs

@@ -115,6 +115,14 @@ function emptyTally() {
     // confused with "the ledger used a name this module doesn't know" again.
     by_tool: {},
     unclassified: 0,
+    // WHICH VENDORS ACTUALLY ANSWERED THIS RUN, read off the rows rather than resolved from the
+    // environment. Every ledger row carries a `provider` discriminator (providers/_shared/ledger.mjs), so
+    // the set of vendors a run used is a fact the ledger already holds — and it is the ONLY place that
+    // holds it per call. A label resolved at publish instead names whichever register happened to be
+    // active then, which is wrong for a run whose register changed part-way; this cannot be, because each
+    // row says who produced it. Empty is a real answer and means the ledger carried no row for this run,
+    // which the four `ledger.*` provenance facts below then explain.
+    providers: [],
     // …and the PROVENANCE of the zeros above. Same house rule, the last place in this module still broken
     // by it: a ledger that is missing, mis-pointed or unreadable returned a clean all-zero tally that was
     // indistinguishable from "the run made no provider calls", and the note line printed `total=0 ((none))`
@@ -163,6 +171,7 @@ export function tallyRegisterCalls(ledgerPath = DEFAULT_LEDGER_PATH, runPrefix)
   out.ledger.readable = true;
 
   const firstFetchSession = new Map(); // record_fetch target → the session that first (network-)fetched it
+  const providersSeen = new Set();     // the vendors this run's rows name, in the order the ledger names them
 
   for (const line of text.split("\n")) {
     if (!line.trim()) continue;
@@ -179,6 +188,11 @@ export function tallyRegisterCalls(ledgerPath = DEFAULT_LEDGER_PATH, runPrefix)
     const isCacheHit = row.cache_hit === true;
     if (isCacheHit) out.cache_hits++;
 
+    // Collected for EVERY matching row, whatever tool it rode — a count-only run rides `count`-shaped
+    // rows and no record fetch, and that is exactly the run whose register went unrecorded before.
+    const rowProvider = typeof row.provider === "string" ? row.provider.trim().toLowerCase() : "";
+    if (rowProvider) providersSeen.add(rowProvider);
+
     const toolName = typeof row.tool === "string" && row.tool ? row.tool : "(none)";
     out.by_tool[toolName] = (out.by_tool[toolName] ?? 0) + 1;
     if (KINDS.includes(row.tool)) out[row.tool]++;
@@ -221,6 +235,8 @@ export function tallyRegisterCalls(ledgerPath = DEFAULT_LEDGER_PATH, runPrefix)
       }
     }
   }
+  // Sorted so two runs with the same vendors compare equal whatever order the ledger happened to append in.
+  out.providers = [...providersSeen].sort();
   return out;
 }
 

package/driver/publish/index.mjs

@@ -1712,9 +1712,13 @@ export function composeEmailHtml(reportMdPath, url, auditFile, names = [], deliv
   const { fm, secs } = parseReport(reportMdPath);
   const auditUrl = auditUrlFor(url, auditFile);
 
-  // 1) internal review headline — short: the bottom line + any "Reviewer's open questions" already in # Summary.
-  // Heading-neutral match: accept the new "Reviewer's open questions" and the legacy "Open questions for the reviewer".
-  const oq = (secs['Summary'] || '').match(/\*\*(?:Reviewer's open questions|Open questions for the reviewer)[\s\S]*?(?=\n\n[^*\d])/i);
+  // 1) internal review headline — short: the bottom line, and nothing of the reviewer's own notes.
+  //
+  // THE SCRAPE THAT STOOD HERE IS GONE (owner ruling, 2026-10-01). It lifted a "Reviewer's open questions"
+  // block out of the report's own # Summary and reprinted it on the cover. Two ways that reached a client:
+  // a report that still carried an authored section of that name, and any archived report re-rendered
+  // later. Removing the producer is not enough while something downstream goes looking for the text, so
+  // this goes with it.
   // The report link rides HIGH — right under the bottom line in the headline, not buried below the table.
   const reportLink = hrefAttr(url)
     ? `<p style="margin:0 0 10px"><a href="${hrefAttr(url)}" style="color:#1a4fd6;font-weight:bold;font-size:12pt;text-decoration:none">▶ Open the full report</a>`
@@ -1826,8 +1830,10 @@ export function composeEmailHtml(reportMdPath, url, auditFile, names = [], deliv
     // second rung on any shipped build. Nothing renders a failover note into a report.
     // B5b checkpoint 4 — a customer named after the analysis was written ships as a delivery note, never silently.
     + (fm.late_bind_note ? `<p style="margin:0 0 8px;color:#7a2b12"><b>Applicant named mid-run:</b> ${cell(fm.late_bind_note)}</p>` : '')
-    + (oq ? `<div style="margin:0 0 8px">${mdBlock(oq[0])}</div>` : '')   // …and the reviewer's open points from the run record (opts.reviewerOpenPointsMd), never from the report
-    + (opts.reviewerOpenPointsMd ? `<div style="margin:0 0 8px">${mdBlock(String(opts.reviewerOpenPointsMd).replace(/^#+\s*(.+)$/m, '**$1**'))}</div>` : '')
+    // The reviewer's open points stood here, from the run record. They do not ride the cover any more
+    // (owner ruling, 2026-10-01): the sentence naming the independent reviewer reads as a human declining
+    // to sign, and the points themselves are the engine's own vocabulary. Both stay on the run, beside the
+    // report, for the reviewing lawyer. Nothing is reworded and nothing replaces them.
     // wp50: the two-bucket # Actions list no longer rides the email — it renders on the report itself
     // (the single master document); the cover keeps only the headline, link, and surviving flags.
     + `</div>`;

package/driver/record-carry.mjs

@@ -902,7 +902,7 @@ export function statedDivergenceFindings({ reconciliation = null, carryRows = nu
   //   statedDivergenceFindings   checked=5 matched=5 diverged=0   ← should have named two marks
   //
   // The reconciliation names five finding-ended positions and they are five OTHER marks — VELTRIN
-  // bioenergetische Kosmetik, KORPHIC HSE, KORPHI, DELPHIN & EMERENCE, KORPHI DIAGNOSTICS. The two that
+  // bioenergetische Kosmetik, KORPHIC HSE, KORPHI, KORPHIN & ACME, KORPHI DIAGNOSTICS. The two that
   // were lost sit in the CARRY rows and the reconciliation never mentions them:
   //
   //   HALVER KORPHI  reach=placed stopped_at=digest reason_source=step-stated reason=digest:reasoned-negative

package/driver/reviewer-open-points.mjs

@@ -3,31 +3,28 @@
 //
 // reviewer-open-points.mjs — where the reviewer's open points are kept, and how the audit workbook reads them.
 //
-// Owner ruling, 2026-09-24: reviewer notes never reach the client page. The pipeline still builds the
-// section from the review and the corrective observation (buildReviewerOpenPointsSection) and writes it to
-// the run record under `_driver/`, for the reviewing lawyer. Nothing a client can open carries it: not the
-// report, and not the audit workbook, whose link rides the cover note a client principal receives.
+// Owner ruling, 2026-09-24: reviewer notes never reach the client page. Owner ruling, 2026-10-01: they do
+// not reach the email either, on any run. The pipeline still builds the section from the review and the
+// corrective observation (buildReviewerOpenPointsSection) and writes it to the run record under `_driver/`,
+// beside the report, for the reviewing lawyer who opens the run. Nothing sends it anywhere.
 //
-// One module owns the file's name and its reading, so the pipeline that writes it and the email that reads
-// it cannot disagree about where it is, and the reader does not import the pipeline to learn a file name.
-
-import { readFileSync, existsSync } from "node:fs";
-import { driverDir } from "../shared/driver-dir.mjs";
+// WHAT THE SECOND RULING REMOVED, and why it is not a narrowing of the first. The first took the section off
+// the report page and left it on the email, gated on whether the run's forwarder was the client. The email
+// then carried the sentence naming the independent reviewer — which reads as a human declining to sign a
+// report — and carried the points in the engine's own vocabulary. Measured over the thirty days to
+// 2026-10-01: the report page carries neither since the first ruling, and the email carried both. So the
+// gate was holding a door open that is now shut: nothing reads this file onto a surface that is sent.
+//
+// One module owns the file's name, so the pipeline that writes it and the workbook reader that skips it
+// cannot disagree about where it is, and a reader does not import the pipeline to learn a file name.
 
 /** The run-record file the reviewer's open points are written to, under the run's `_driver/`. */
 export const REVIEWER_OPEN_QUESTIONS_FILE = "reviewer-open-questions.md";
 
-/**
- * The recorded open points for the email the run sends, or null where that email could reach a client.
- *
- * The run's email goes to the job's forwarder, and on a client-started run (`clientPrincipal`) that address
- * is the client itself. There the open points stay in the run record alone. Everywhere else the recipient
- * is the reviewing lawyer, who reads them in the email's review headline, in the record's own words.
- * Null too when the run recorded none: the reviewer signed and nothing is open.
- */
-export function reviewerOpenPointsForEmail(job, runDir) {
-  if (job?.clientPrincipal === true || !runDir) return null;
-  const file = driverDir(runDir, REVIEWER_OPEN_QUESTIONS_FILE);
-  if (!existsSync(file)) return null;
-  try { return readFileSync(file, "utf8").trim() || null; } catch { return null; }
-}
+// THE EMAIL READER IS GONE (owner ruling, 2026-10-01). It returned this file's text for a run whose
+// forwarder was not the client, and the pipeline handed that to the email cover. Both halves are removed:
+// the reader here, and the hand-off there. A gate on the recipient is not what the ruling asked for — the
+// points leave every surface that is sent, so there is no recipient to test.
+//
+// NOT LEFT IN PLACE UNUSED. An exported reader with no caller is the shape somebody wires back up, and the
+// thing that made this reachable in the first place was a function that existed and looked safe to call.

package/driver/score-redaction.mjs

@@ -524,14 +524,41 @@ let authoredPrint = null;
  * them into strings would change the payload's shape.
  */
 export function redactDeep(value, { redactValue, redactKey }) {
-  const walk = (v) => {
+  const walk = (v, path = "") => {
     if (typeof v === "string") return redactValue(v);
-    if (Array.isArray(v)) return v.map(walk);
+    if (Array.isArray(v)) return v.map((x) => walk(x, path));
     if (v && typeof v === "object") {
       const out = {};
-      // The key through the AUTHORED redactor, the value through the full one, in one pass so the two
-      // can never drift apart by a caller forgetting one of them.
-      for (const [k, x] of Object.entries(v)) out[redactKey(k)] = walk(x);
+      // TWO SIBLING KEYS CAN REDUCE TO ONE TOKEN, and the later write would take the earlier field with
+      // it. The matcher tolerates a trailing plural, so a protected name and that name plus `s` both
+      // match; it is case-insensitive, so two spellings of one name collide too. Rebuilding the object
+      // key by key, the second write wins and the first field is gone — valid JSON, no warning, and a
+      // consumer cannot tell a field ever existed. That is the failure mode this whole module exists to
+      // prevent, so it refuses rather than guessing which field to keep.
+      //
+      // MEASURED BEFORE BEING BUILT: across four real scored payloads, 585 objects and 1634 protected
+      // names, there is no such pair today. The mechanism is real and the path is not reachable on
+      // anything this box produces, which is why this is a guard and not a repair.
+      //
+      // THE REFUSAL NAMES THE TOKEN AND THE PATH, NEVER THE KEYS. Saying which keys collided would print
+      // the very name being withheld — the keys are the protected string, that is why they collided. A
+      // reader who needs them asks with `--names`, where nothing is withheld and the collision cannot
+      // happen.
+      const seen = new Map();
+      for (const [k, x] of Object.entries(v)) {
+        const rk = redactKey(k);
+        if (seen.has(rk)) {
+          const e = new Error(`two sibling keys reduce to the same token ${rk} at ${path || "the payload root"}`
+            + ` — this payload cannot be rendered addressably, so it is refused rather than written with a`
+            + ` field silently dropped. Run again with --names to see which keys they are.`);
+          e.code = "REDACTED_KEY_COLLISION";
+          e.token = rk;
+          e.at = path || "(root)";
+          throw e;
+        }
+        seen.set(rk, true);
+        out[rk] = walk(x, path ? `${path}.${rk}` : rk);
+      }
       return out;
     }
     return v;

package/driver/screen-gate.mjs

@@ -99,9 +99,9 @@ function parseVerdict(notes) {
  */
 export function findScreenGateViolations(findingsContent, fetchedUriSet) {
   // URI-granularity normalization: the record_fetch ledger logs the registration-INSTANCE URI (e.g.
-  // /mark/ch/57860/2014) while the gate parses each Notes URI through URI_RE, which stops at the first
-  // SLASH (→ /mark/ch/57860). Reduce BOTH sides through the SAME regex so a slash-separated /<year> (or
-  // other instance) suffix is not a false-negative on the membership test — the DELPHINOL false hard-halt
+  // /mark/ch/30419/2014) while the gate parses each Notes URI through URI_RE, which stops at the first
+  // SLASH (→ /mark/ch/30419). Reduce BOTH sides through the SAME regex so a slash-separated /<year> (or
+  // other instance) suffix is not a false-negative on the membership test — a false hard-halt
   // that blocked a live pharma matter twice on 2026-06-17 (the record WAS fetched, logged as …/2014).
   //
   // …and CASE-FOLD, for the same reason at a different granularity (2026-07-28). The fetched universe is

package/driver/suite-census.json

@@ -1216,14 +1216,14 @@
           "todos": 0
         },
         "a-run-records-the-tool-that-served-it.test.mjs": {
-          "tests": 13,
-          "asserts": 33,
+          "tests": 16,
+          "asserts": 42,
           "skips": 0,
           "todos": 0
         },
         "a-run-records-which-register-served-it.test.mjs": {
-          "tests": 9,
-          "asserts": 22,
+          "tests": 14,
+          "asserts": 30,
           "skips": 0,
           "todos": 0
         },
@@ -2829,6 +2829,12 @@
           "skips": 1,
           "todos": 0
         },
+        "e2e-a-row-states-what-it-measured.test.mjs": {
+          "tests": 3,
+          "asserts": 7,
+          "skips": 0,
+          "todos": 0
+        },
         "e2e-assertions.test.mjs": {
           "tests": 87,
           "asserts": 251,
@@ -2859,6 +2865,12 @@
           "skips": 0,
           "todos": 0
         },
+        "e2e-scenario-names-its-register.test.mjs": {
+          "tests": 13,
+          "asserts": 28,
+          "skips": 0,
+          "todos": 0
+        },
         "e2e-scenario-ops.test.mjs": {
           "tests": 28,
           "asserts": 94,
@@ -3935,7 +3947,7 @@
         },
         "pipeline.mock.test.mjs": {
           "tests": 103,
-          "asserts": 863,
+          "asserts": 865,
           "skips": 0,
           "todos": 0
         },
@@ -4636,8 +4648,8 @@
           "todos": 0
         },
         "report-assemble.test.mjs": {
-          "tests": 21,
-          "asserts": 109,
+          "tests": 22,
+          "asserts": 115,
           "skips": 0,
           "todos": 0
         },
@@ -5670,7 +5682,7 @@
         "the-engine-sets-no-sampling-and-forces-no-tool.test.mjs": {
           "tests": 6,
           "asserts": 9,
-          "skips": 0,
+          "skips": 2,
           "todos": 0
         },
         "the-engine-step-cannot-loop-on-a-menu-nothing-changed.test.mjs": {
@@ -5944,8 +5956,8 @@
           "todos": 0
         },
         "the-payload-is-redacted-as-a-structure.test.mjs": {
-          "tests": 11,
-          "asserts": 22,
+          "tests": 15,
+          "asserts": 30,
           "skips": 0,
           "todos": 0
         },
@@ -6153,9 +6165,9 @@
           "skips": 0,
           "todos": 0
         },
-        "the-reviewers-open-points-reach-the-reviewing-lawyer-never-a-client.test.mjs": {
+        "the-reviewers-open-points-stay-in-the-run-record.test.mjs": {
           "tests": 6,
-          "asserts": 15,
+          "asserts": 17,
           "skips": 0,
           "todos": 0
         },
@@ -7735,7 +7747,7 @@
         },
         "providers/signa/test/an-owner-portfolio-sweep-is-a-search.test.mjs": {
           "tests": 4,
-          "asserts": 17,
+          "asserts": 18,
           "skips": 0,
           "todos": 0
         },
@@ -7751,6 +7763,18 @@
           "skips": 0,
           "todos": 0
         },
+        "providers/signa/test/the-ranked-lane-asks-for-similarity-channels.test.mjs": {
+          "tests": 9,
+          "asserts": 15,
+          "skips": 0,
+          "todos": 0
+        },
+        "providers/signa/test/the-registers-own-warnings-reach-the-run.test.mjs": {
+          "tests": 7,
+          "asserts": 11,
+          "skips": 0,
+          "todos": 0
+        },
         "providers/signa/test/the-screen-speaks-the-shared-verdicts.test.mjs": {
           "tests": 2,
           "asserts": 4,

package/mcp-server/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-artifacts-mcp
 
+## 0.4.0
+
+No changes in this release.
+
 ## 0.4.0-beta.3
 
 No changes in this release.

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.4.0-beta.3",
+  "version": "0.4.0",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clearotron",
   "type": "module",
-  "version": "0.4.0-beta.3",
+  "version": "0.4.0",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.4.0-beta.3",
+  "version": "0.4.0",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/_shared/term-shape.mjs

@@ -80,7 +80,7 @@ export function termPredicateIssue(term, predicate) {
 // R2b died at fan-in on a plan carrying its own section headings as search terms:
 //
 //   term="**Core (BIOVELTRIN, BIO VELTRIN, BIO-VELTRIN, etc.)**"    predicate=default
-//   term="**Formative root (VELTRIN, DELPHIN, DELPHINUS, etc.)**"   predicate=default
+//   term="**Formative root (VELTRIN, KORPHIN, KORPHINUS, etc.)**"   predicate=default
 //
 // Twenty minutes earlier the same matter on the same commit delivered clean, and the only difference
 // was those two strings. Both happened to be 6 words, so they tripped the >4-word arm below by luck;

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-oauth-mcp-bridge
 
+## 0.4.0
+
+No changes in this release.
+
 ## 0.4.0-beta.3
 
 No changes in this release.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.4.0-beta.3",
+  "version": "0.4.0",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/providers/signa/src/core.js

@@ -182,6 +182,52 @@ export function rememberableAnswer(method, status, body, parseError) {
 // answering as though it were the one requested.
 const DETERMINISTIC_MATCH = new Set(["similar", "exact", "starts_with", "ends_with", "contains"]);
 
+// ── THE RANKED STRATEGIES, AS SIMILARITY CHANNELS ────────────────────────────────────────────────
+//
+// The register retired `strategies` in favour of `similarity` and retired `query` in favour of `q`, both
+// on the same date, and says so in `search_meta.deprecations` on every response that still uses the old
+// names. This is that migration.
+//
+// THE TABLE IS NOT A RENAME, and assuming it was is the way to lose coverage quietly. Each old strategy
+// expands to a SET of channels, and the sets are not the strategy's own name: `fuzzy` alone applies four.
+// Every row below was read off the register's own `similarity_applied` for the old parameter — so the
+// register derived this table, not us — and each was then confirmed by sending the new form and comparing
+// what came back against the old form's answer, on a neutral term, not by reading the names across:
+//
+//   strategy   similarity channels
+//   exact      identical, lookalike
+//   phonetic   identical, phonetic
+//   fuzzy      identical, fuzzy, embedded, lookalike
+//   prefix     identical, embedded
+//
+// For `exact` the comparison was of the returned SETS, paged to exhaustion both ways and compared by
+// record, not of the totals — two totals agreeing is not two sets agreeing. Several strategies in one call
+// UNION their channels, confirmed on a combination the same way. The figures, the date and the term they
+// were taken on are on the tracker: this directory is public and vendor measurements do not live here.
+//
+// `similarity` REFUSES ANYTHING ELSE — "similarity must be one of: identical, fuzzy, embedded, phonetic,
+// lookalike" — which is why `prefix` has no channel of its own and why an unknown strategy must not be
+// forwarded verbatim: it would 4xx the call rather than narrow it, but only at run time and only for the
+// plan that asked. Unknown names map to the exact channels and the caller's word is kept in the request's
+// own record by the plan, not invented here.
+const SIMILARITY_FOR = Object.freeze({
+  exact: ["identical", "lookalike"],
+  phonetic: ["identical", "phonetic"],
+  fuzzy: ["identical", "fuzzy", "embedded", "lookalike"],
+  prefix: ["identical", "embedded"],
+});
+const SIMILARITY_CHANNELS = Object.freeze(["identical", "fuzzy", "embedded", "phonetic", "lookalike"]);
+
+/** The channels a list of ranked strategies asks for: the union of each one's, in the register's own order. */
+export function similarityFor(strategies) {
+  const want = new Set();
+  const list = Array.isArray(strategies) && strategies.length ? strategies : ["exact"];
+  for (const s of list) {
+    for (const c of (SIMILARITY_FOR[String(s ?? "").trim().toLowerCase()] ?? SIMILARITY_FOR.exact)) want.add(c);
+  }
+  return SIMILARITY_CHANNELS.filter((c) => want.has(c));
+}
+
 // ── filters: ONE builder, because the two shapes drifting apart is how `status` survived ───────────
 //
 // `filters.status` was sent by both branches below and NO SUCH KEY EXISTS. The API rejects unknown
@@ -227,12 +273,27 @@ export function buildSearchRequest(p) {
   // serializes away anyway, but writing it conditionally is what makes the owner-only shape legible here
   // rather than an accident of JSON.stringify.
   const body = {};
-  if (String(p.query ?? "").trim()) body.query = p.query;
+  // ── `q` CARRIES ONE TERM, AND AN ARRAY HERE WOULD BE A DIFFERENT SEARCH ────────────────────────
+  //
+  // A scalar `q` is a RANKED query: the similarity channels below apply to it. A LIST in the same field
+  // is not a wider ranked query — it is an exact-text filter, and the register refuses to combine it with
+  // similarity at all ("a list is an exact-text filter, not a ranked query"). Measured: the ranked form
+  // returns a live mark the register itself tiers `identical` via its lookalike channel, and the list form
+  // does not, because that mark's text does not contain the term. So an array reaching this line would
+  // silently drop look-alike coverage while answering 200 — a narrowed query wearing a complete answer,
+  // the failure this connector already refuses a multi-term stack to prevent.
+  //
+  // It is refused rather than joined or first-element-picked, for the same reason the stack is.
+  if (Array.isArray(p.query))
+    throw new Error("[signa] `query` reached the request builder as a list. A list in `q` is an exact-text "
+      + "filter on this register and cannot carry the similarity channels a ranked band asks for, so it "
+      + "would drop look-alike matches while answering 200. Send one term per request.");
+  if (String(p.query ?? "").trim()) body.q = p.query;
   const match = typeof p.match === "string" ? p.match.trim() : "";
   if (match && DETERMINISTIC_MATCH.has(match)) {
-    body.match = match;   // sending strategies alongside is a 4xx, not a preference
+    body.match = match;   // sending similarity alongside is a 4xx, not a preference
   } else {
-    body.strategies = Array.isArray(p.strategies) && p.strategies.length ? p.strategies : ["exact"];
+    body.similarity = similarityFor(p.strategies);
   }
   const filters = buildFilters(p);
   if (Object.keys(filters).length) body.filters = filters;
@@ -488,6 +549,30 @@ export function normalizeSearchResponse(body, echoQuery) {
     strategies_used: meta.strategies_used ?? [],
     match: meta.match ?? null,
     search_id: meta.search_id ?? null,
+    // ── THE REGISTER'S OWN WARNINGS, CARRIED WHOLE ──────────────────────────────────────────────
+    //
+    // Passed through as the register sent them rather than filtered to the codes we happen to know. A
+    // recorder keyed to a fixed list of codes looks like coverage and is an empty column the day the
+    // register adds one, and there is no way to tell those two apart from the outside. An empty array is
+    // the ordinary case: a clean response carries no `warnings` key at all.
+    //
+    // TWO CODES ARE KNOWN TO ARRIVE HERE, and they behave oppositely — which is the reason to keep the
+    // list whole rather than reason about either one.
+    //
+    // `mixed_script` is emitted on the exact-text filter path and NOT on the ranked path, because a
+    // ranked query folds look-alike letters through its own similarity channel and so has nothing to
+    // warn about. Every sweep this connector sends is ranked, so this code will not appear, and an
+    // empty list is NOT evidence that a query carried no mixed-script risk. Whatever guards that on the
+    // ranked path still has to.
+    //
+    // `expanded_fallback` DOES arrive on requests this connector sends. Measured: it fires on
+    // `offices` together with `nice_classes`, and on `goods_services_text`, which rides every
+    // goods-narrowed question. It says the grouped view cannot serve that filter, so the answer comes
+    // back one row per RECORD instead of one row per MARK — and the register's own note says that
+    // inflates the total. The total is what the enumerate ceiling reads to call a band a crowd, so a
+    // band can be declared a crowd on a number that counts designations rather than marks. This field
+    // is what makes that visible; it does not yet make it safe.
+    warnings: Array.isArray(meta.warnings) ? meta.warnings : [],
     // The corpus total when the vendor counted it exactly; null when it did not answer, when the
     // total was not requested, and when the figure it returned is an approximation. NEVER the page
     // size — `data.length` is `count`, and conflating the two is how a page reads as a corpus.

package/scripts/e2e.mjs

@@ -337,6 +337,75 @@ const allScenarios = () => {
     .sort((a, b) => byScenarioNumber(a.id, b.id));
 };
 
+// ── A SCENARIO MAY NAME THE REGISTER ITS NUMBERS WERE MEASURED AGAINST ──────────────────────────────
+//
+// THE DEFECT THIS CLOSES. A scenario's register floors are counts, and a count is an answer one register
+// gave. Run the same scenario against a different register and the floor decides nothing about the
+// engine: measured 2026-09-30 on a knockout whose floors are `identical: 8` and `containing: 300`, the
+// other register answered 2 and 471 for the SAME mark. One floor failed and one passed, in one run, and
+// neither outcome was about the engine. A red like that costs a round: it reads as a regression, it is
+// investigated as one, and the run that produced it is already spent.
+//
+// WHAT THIS DOES NOT DO, deliberately. It does not encode which register returns more. The measurement
+// says the two DISAGREE — 2 against 8 on one predicate and 471 against 300 on another, in opposite
+// directions — and nothing here has established why. A floor per register would need that why, and a
+// harness rule must not smuggle one in. So a scenario states which register its numbers came from, and
+// the harness refuses to spend the run anywhere else.
+//
+// OPTIONAL BY CONSTRUCTION, because the store is a DIFFERENT REPO. A scenario that declares nothing
+// behaves exactly as it does today. There is no ordering problem to manage and no day on which this
+// harness refuses a store that has not caught up.
+//
+// WHY THIS DOES NOT ASK THE DRIVER. `driver.config.mjs` resolves the provider, and this file may not
+// import it — its unset-env defaults are PRODUCTION, which is the rule stated at four points above. The
+// variable is read here directly and with no fallback: unset stays unset, and unset is reported as its
+// own state rather than resolved to anything.
+//
+// CONFIGURED, NOT SERVED, and the difference is a live gap. What a run was configured for is the
+// launch value; what actually served it is a separate record the runs do not yet carry (measured
+// 2026-09-30: absent on all four runs of a round, on both the knockout and the clearance path). When
+// that record exists, an assertion could read what served. Until then this is a PRE-RUN refusal on the
+// configured value, which is the honest instrument available — and it is placed before the spend, where
+// being approximately right still saves the money.
+export const REGISTER_ENV = "CLEAROTRON_DATABASE";
+
+/** The registers a scenario declares its numbers were measured against, lowercased. `[]` when it declares none. PURE. */
+export function registersDeclaredBy(sc) {
+  const v = sc?.register;
+  const list = Array.isArray(v) ? v : v == null ? [] : [v];
+  return list.map((x) => String(x ?? "").trim().toLowerCase()).filter(Boolean);
+}
+
+/** The register this process is configured for, or `null` when the variable names none. No default, ever. PURE apart from the read. */
+export function configuredRegister(env = process.env) {
+  return String(env?.[REGISTER_ENV] ?? "").trim().toLowerCase() || null;
+}
+
+/**
+ * The refusal text for running `sc` here, or `null` when there is nothing to refuse. PURE.
+ *
+ * Three cases, and the middle one is the reason this returns text rather than a boolean: a scenario that
+ * declares a register and an environment that names none is NOT a match and NOT a mismatch. Running it
+ * would spend against whatever the driver defaults to, which this file is not allowed to ask about, so
+ * the refusal says exactly that rather than guessing either way.
+ */
+export function registerRefusal(sc, env = process.env) {
+  const want = registersDeclaredBy(sc);
+  if (!want.length) return null;
+  const have = configuredRegister(env);
+  const declares = want.length === 1 ? want[0] : `one of ${want.join(", ")}`;
+  if (!have) {
+    return `${sc.id} states that its numbers were measured against ${declares}, and ${REGISTER_ENV} names no register `
+      + `on this instance. This harness does not resolve a default — the module that would is the one it may not import. `
+      + `Set ${REGISTER_ENV} to ${declares} and run again.`;
+  }
+  if (want.includes(have)) return null;
+  return `${sc.id} states that its numbers were measured against ${declares}, and this instance is configured for ${have}. `
+    + `What one register answered is not what another answers, so here this scenario would judge the register `
+    + `and not the engine — and a red read as a regression arrives on a run that is already spent. `
+    + `Set ${REGISTER_ENV} to ${declares}, or run a scenario whose numbers were measured against ${have}.`;
+}
+
 // ── — the store is the input to the most expensive thing this repo does ─────────────────────────
 //
 // Every job block in the store, through BOTH admission gates, against the outcome the scenario declares.
@@ -440,6 +509,20 @@ export function lintScenarios(scenarios) {
     for (const f of sc.expect?.artifacts ?? []) {
       if (/^\/|\.\./.test(f)) wrong.push(`${label}: artifact ${JSON.stringify(f)} must be a plain run-relative name`);
     }
+    // ── `register`, IF STATED, MUST BE STATABLE ────────────────────────────────────────────────────
+    //
+    // SHAPE ONLY, AND NOT THE NAME. Checking the value against the known providers would mean importing
+    // `driver.config.mjs`, which this file may not do. That is not a hole worth patching another way: a
+    // misspelled register never runs anywhere, and the refusal it produces prints the scenario's word
+    // and the instance's word side by side, which is a typo shown rather than described. What IS worth
+    // refusing is a value nothing can compare at all — an empty string, a number, an empty list — since
+    // that would declare a register and then silently compare against nothing.
+    if (Object.prototype.hasOwnProperty.call(sc, "register")) {
+      const raw = Array.isArray(sc.register) ? sc.register : [sc.register];
+      const bad = raw.length === 0 || raw.some((x) => typeof x !== "string" || !x.trim());
+      if (bad) wrong.push(`${label}: \`register\` is ${JSON.stringify(sc.register)} — it must be a non-empty register name, or a non-empty list of them. `
+        + `A scenario states this when its numbers are counts one register returned, so that a run against another is refused before it spends.`);
+    }
     const allAsserts = [...(sc.expect?.assert ?? []), ...(sc.cases ?? []).flatMap((c) => c.expect?.assert ?? [])];
     for (const a of allAsserts) {
       if (/^_driver\/scope-ledger\.json/.test(String(a.path ?? ""))) {
@@ -2185,7 +2268,11 @@ export function provenanceLines(cost, today = new Date()) {
 
 function cmdList() {
   console.log("\nE2E scenarios — each is one complete clearance unless marked $0");
-  console.log(`store: ${storeLine(STORE)}\n`);
+  console.log(`store: ${storeLine(STORE)}`);
+  // WHAT THIS INSTANCE IS CONFIGURED FOR, once at the top, because it decides which of the scenarios
+  // below `run` will start. Printed even when nothing declares a register: a reader choosing a scenario
+  // needs to know the variable names none BEFORE the refusal tells them.
+  console.log(`register: ${configuredRegister() ?? `${REGISTER_ENV} names none`}\n`);
   sweepStoreOrDie();
   for (const s of allScenarios()) {
     const cost = s.cost?.measured ? `~${s.cost.wallMinutes} min` : "UNMEASURED";
@@ -2200,6 +2287,16 @@ function cmdList() {
     // all, and an absent benchmark is not a met one.
     for (const l of turnaroundVerdict(bandForScenario(s)).lines) console.log(`      ${l}`);
     for (const l of provenanceLines(s.cost)) console.log(`      ${l}`);
+    // WHETHER `run` WOULD START THIS ONE HERE, at a glance, so the choice is made in the list rather
+    // than discovered one scenario at a time. The refusal's own words, not a second wording of them.
+    {
+      const declared = registersDeclaredBy(s);
+      if (declared.length) {
+        const no = registerRefusal(s);
+        console.log(`      register: measured against ${declared.join(", ")} — ${no ? "WOULD REFUSE HERE" : "runnable here"}`);
+        if (no) console.log(`        ${no}`);
+      }
+    }
     // — which scenarios prove the register HIT path, at a glance. Unconditional, and an
     // unstated label prints as loudly as a stated one.
     {
@@ -2263,6 +2360,13 @@ async function cmdRun(id) {
   // Which store this came from, on the record before the run spends. The synthetic and the real scenario
   // share an ID, so the ledger afterwards cannot tell you which one ran unless the run says so now.
   console.log(`store: ${storeLine(STORE)}`);
+  // BEFORE THE SPEND, because that is the only place this check is worth anything: a scenario whose
+  // floors were measured against another register produces a red that reads as an engine regression,
+  // and by then the run is paid for. `die` rather than a warning — a warning printed above a three-hour
+  // run is a warning nobody reads until the verdict.
+  { const no = registerRefusal(s); if (no) die(`REFUSING: ${no}`); }
+  console.log(`register: ${configuredRegister() ?? `${REGISTER_ENV} names none`}${
+    registersDeclaredBy(s).length ? ` — the scenario states its numbers were measured against ${registersDeclaredBy(s).join(", ")}` : ""}`);
   // Every scenario spends, R0 included — so every scenario refuses on stale code. R0 was exempted here
   // on the belief that it is refused at the door before any model call, which its own `why` also claimed.
   // It is not: R0d's FIRST submission is expected to admit (that is how it produces a duplicate to
@@ -3486,8 +3590,27 @@ async function cmdReport(id, { round: requestedToken = null } = {}) {
       // A multi-name knockout stamps NO single url BY DESIGN: one address would be the first
       // name standing for the batch, so the packet carries `reports[{mark, url}]` instead. Read it —
       // from the run dir, or from the pool meta once the run dir is archived — and probe every per-mark
-      // address exactly as the single-url arm does. Only a delivered run with neither a url nor a
-      // reports[] list is the CLEAROTRON_REPORTS_URL absence this arm was written for.
+      // address exactly as the single-url arm does.
+      //
+      // ── WHAT THE TWO ABSENCE ARMS BELOW MEASURE, AND WHAT THEY CANNOT SEE ───────────────────────────
+      //
+      // They measure one thing: no entry carries a url. They used to REPORT a second thing they never
+      // looked at — that CLEAROTRON_REPORTS_URL is unset — and the row said it flatly, as a fact about
+      // the instance.
+      //
+      // IT IS NOT ALWAYS TRUE, measured on a test instance 2026-09-30: the variable was present and
+      // non-empty both in the instance's env file and in the worker process's own environment, and the
+      // run's eight report entries each carried a `url` KEY WITH AN EMPTY VALUE. The stamp had run and
+      // produced nothing. On that run the stated cause was simply wrong, and the cause of the empty
+      // stamp is still unknown.
+      //
+      // WHAT IT COSTS TO STATE A CAUSE YOU DID NOT MEASURE: acting on the row, the obvious repair is to
+      // restore the variable from a backup — overwriting a working value with an older one and calling
+      // it a fix. That was nearly done here.
+      //
+      // So the row states the measurement and the investigate line keeps the hypothesis, marked as one.
+      // A reader who wants the cause reads the variable on the instance and the stamp's own output; this
+      // check is not in a position to tell them.
       const batchReports = (() => {
         try { return JSON.parse(readFileSync(driverDir(runDir, "delivery.json"), "utf8")).reports ?? []; } catch { /* archived or pre-batch */ }
         try { return JSON.parse(readFileSync(join(poolDir, "meta.json"), "utf8")).reports ?? []; } catch { /* no pool entry */ }
@@ -3505,13 +3628,14 @@ async function cmdReport(id, { round: requestedToken = null } = {}) {
           else if (error) { failures++; toInvestigate.push(`${ref}: could not probe ${r.mark}'s report URL (${error}) — ${r.url}`); }
         }
       } else if (batchReports.length) {
-        console.log(`  [FAIL] the run's stamped URL resolves\n           delivered as a batch of ${batchReports.length}, but no report entry carries a url — CLEAROTRON_REPORTS_URL is unset on this instance`);
-        failures++; toInvestigate.push(`${ref}: batch delivered with no per-report URL stamped (CLEAROTRON_REPORTS_URL unset?)`);
+        console.log(`  [FAIL] the run's stamped URL resolves\n           delivered as a batch of ${batchReports.length}, and not one of those entries carries a url`);
+        failures++; toInvestigate.push(`${ref}: batch delivered with no per-report URL stamped — cause NOT measured here; read CLEAROTRON_REPORTS_URL on the instance AND what the stamp wrote, because a set variable can still stamp empty`);
       } else {
-        // A delivered run with no URL at all is the same absence one step earlier: CLEAROTRON_REPORTS_URL unset
-        // makes publishReport stamp null, and the handoff packet then carries no address for anyone to open.
-        console.log(`  [FAIL] the run's stamped URL resolves\n           delivered, but status.json carries no url — CLEAROTRON_REPORTS_URL is unset on this instance`);
-        failures++; toInvestigate.push(`${ref}: delivered with no report URL stamped (CLEAROTRON_REPORTS_URL unset?)`);
+        // A delivered run with no URL at all is the same absence one step earlier, and the same limit
+        // applies: this arm sees that the record carries no address, never why. The handoff packet then
+        // carries no address for anyone to open, whatever produced that.
+        console.log(`  [FAIL] the run's stamped URL resolves\n           delivered, and status.json carries no url`);
+        failures++; toInvestigate.push(`${ref}: delivered with no report URL stamped — cause NOT measured here; read CLEAROTRON_REPORTS_URL on the instance AND what the stamp wrote, because a set variable can still stamp empty`);
       }
     }