clearotron 0.4.0 → 0.4.1-beta.0

package/THIRD-PARTY-NOTICES.md

@@ -110,7 +110,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## @modelcontextprotocol/sdk@1.30.1
+## @modelcontextprotocol/sdk@1.31.0
 
 - **Licence declared:** `MIT`
 - **Repository:** https://github.com/modelcontextprotocol/typescript-sdk
@@ -4896,7 +4896,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.**
 ```
 
-## proxy-addr@2.0.7
+## proxy-addr@2.0.8
 
 - **Licence declared:** `MIT`
 - **Repository:** jshttp/proxy-addr

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "9b8ab0f275a16e9b586425c3574c94b5974e225b",
-  "version": "0.4.0"
+  "commit": "4f2133e937195c6875d4be055c76383ceaca0138",
+  "version": "0.4.1-beta.0"
 }

package/docs/SECURITY-OWASP.md

@@ -45,10 +45,11 @@ shows the engine's internals to a company's people.
 **What Clearotron does.** Every read passes one authorization check, and a person sees only what their
 grant names. A key bound to one run reads that run and writes nothing. The copy of a report a company
 receives drops the staff-only notes. No real company's data is in this repository; run data lives
-in folders the operator owns. CI scans the tree and the built bundle for secrets.
+in folders the operator owns. CI scans the tree and the built bundle for secrets. A report published
+from 0.4.0 on carries its fonts inside itself, and opening it contacts no other server.
 
 **Where.** [SECURITY.md](SECURITY.md) (the access model), `shared/scope.mjs`, `driver/portal-report.mjs`,
-`.gitleaks.toml`, `.github/workflows/ci.yml`.
+`.gitleaks.toml`, `.github/workflows/ci.yml`, `scripts/report-offline-render-check.mjs`.
 
 **Not covered.** A company's clearances are kept until the operator deletes them: Clearotron sets no
 retention period, because how long they are held is the operator's policy.
@@ -57,14 +58,15 @@ retention period, because how long they are held is the operator's policy.
 
 **Here.** A compromised npm package, GitHub Action or engine program.
 
-**What Clearotron does.** Dependabot updates the npm packages and the GitHub Actions. Each release is
-published to npm through trusted publishing, with provenance that ties the package to the commit and the
-build that produced it. A stable release is not published while a code-scanning alert is open. Setup
+**What Clearotron does.** Dependabot updates the npm packages and the GitHub Actions. Every GitHub Action is pinned to a commit
+hash. Each release is published to npm through trusted publishing, with provenance that ties the package
+to the commit and the build that produced it. Each release carries a software bill of materials. On an install from a git
+checkout, `clearotron update` installs with install scripts off. A stable release is not published while a code-scanning alert is open. Setup
 installs, and `clearotron doctor` accepts, only an engine program at or above the version this release
 needs.
 
-**Where.** `.github/dependabot.yml`, `.github/workflows/release.yml`,
-`scripts/release-code-scanning-check.mjs`, `driver/driver.config.mjs` (`ENGINE_BINARIES`, each program's
+**Where.** `.github/dependabot.yml`, `.github/workflows/`, `.github/workflows/release.yml`,
+`scripts/release-sbom.mjs`, `bin/update.mjs`, `scripts/release-code-scanning-check.mjs`, `driver/driver.config.mjs` (`ENGINE_BINARIES`, each program's
 `floor`).
 
 ### LLM04:2025 Data and Model Poisoning
@@ -99,12 +101,14 @@ The common-law search asks the research service to run a search program, on that
 
 **What Clearotron does.** Tools are granted per stage, by name. The case-law stage is the exception: it is granted every tool its two case-law services offer. A Claude
 stage is offered no command tool.
-Register searches beyond the fixed plan go through a proposal that code checks and runs. A key issued for
-automation can be limited to named actions. A what-if requested by a company's people is queued for a
+Register searches beyond the fixed plan go through a proposal that code checks and runs. A new key issued for
+automation must name the actions it may take; keys issued before that rule keep working, and each use of
+one is recorded. No key for automation reaches a what-if over the network. A what-if requested by a company's people is queued for a
 separate process rather than run by the door that received it.
 
 **Where.** `driver/engine/mcp/gather-config.mjs`, `driver/engine/anthropic-agent.mjs`,
-`driver/engine/mcp/supplemental.mjs`, `shared/scope.mjs`, `driver/whatif-worker.mjs`.
+`driver/engine/mcp/supplemental.mjs`, `shared/scope.mjs`, `driver/whatif-worker.mjs`,
+`mcp-server/mint-token.mjs`, `mcp-server/server.mjs`.
 
 **Not covered.** As ASI02: the Claude program also offers a stage built-in tools that act without asking.
 
@@ -189,7 +193,7 @@ remove them.
 **What Clearotron does.** The AI program starts with a named list of settings, and the key that signs
 access keys is not on it. The worker that starts the AI program does not hold that key either, whether
 the install runs in a terminal or under systemd. Access keys are scoped to a run, a company or named
-actions, and one check enforces the scope. On Claude, a stage's file tools can read nothing outside its run folder, its
+actions, and one check enforces the scope. A new key for automation must name its actions. On Claude, a stage's file tools can read nothing outside its run folder, its
 instruction folders and any folder the machine's own Claude settings add. On Codex with its sandbox on, a stage's commands can read nothing outside its run folder, its instruction folders, the temporary
 folders, and the system and program files a command needs to run.
 
@@ -276,10 +280,12 @@ could not run is listed in the report.
 
 **What Clearotron does.** No agent outlives its stage. Each stage is one process under a watchdog and a
 hard time limit, and the driver stops its whole process group. The driver records every program it
-starts. On the Claude engine a stage cannot write into the instructions it runs from.
+starts. On the Claude engine a stage cannot write into the instructions it runs from. The systemd units
+an install can run in the background start with `NoNewPrivileges`, so nothing a stage starts there can
+gain more than the install's account holds.
 
 **Where.** `driver/engine/anthropic-agent.mjs`, `driver/engine/common.mjs`,
-`driver/engine/child-record.mjs`, `driver/engine/deny-authority-write.mjs`.
+`driver/engine/child-record.mjs`, `driver/engine/deny-authority-write.mjs`, `driver/systemd/`.
 
 **Not covered.** As LLM04: on Codex, no check refuses a stage's write inside its run folder.
 
@@ -296,3 +302,5 @@ Measured on 2026-09-23 with the GitHub API.
 | Private vulnerability reporting | On |
 | npm provenance | Every release, through trusted publishing |
 | Required checks on `main` | Six; force pushes and branch deletion refused |
+| Actions pinned to a commit hash | All 42, read from the workflow files on 2026-09-24 |
+| Software bill of materials | CycloneDX, attached to every release, read from the release workflow on 2026-09-24 |

package/docs/SECURITY.md

@@ -12,7 +12,7 @@ Each risk on OWASP's two lists for AI systems, and what Clearotron does about it
 
 | Surface | Trust | Guard |
 |---|---|---|
-| stdio MCP (`mcp-server/server.mjs`) | local/full ("ops") | OS user boundary — run it AS the operator account; it is the only surface on which `what_if_run` EXECUTES (`visibleTools` keeps what-if out of the HTTP listing for ops, but the CallTool chokepoint gates on `authorize()` alone, which admits it for any ops token not `--verbs`-scoped) |
+| stdio MCP (`mcp-server/server.mjs`) | local/full ("ops") | OS user boundary — run it AS the operator account; it is the only surface on which `what_if_run` EXECUTES (`visibleTools` keeps what-if out of the HTTP listing for ops, and the CallTool chokepoint refuses any tool the listing hides, so no ops token reaches it over HTTP) |
 | Client MCP (`mcp-server/http-server-client.mjs`) | a company's signed-in person / their access key | `what_if_run` from an `account` principal ENQUEUES rather than executes (ruling 2026-08-27) — it never imports the engine, and `driver/whatif-worker.mjs` spawns the sandbox from an OS service process. A confirmation token is unsigned, so the call must ALSO name its `runId`: the grant check keys on it, and `whatIfEnqueue` refuses a token naming a different run. The `model` argument is refused on this face. |
 | HTTP MCP (`mcp-server/http-server.mjs`) | authenticated remote | auth-BEFORE-data; fail-closed construction; inner scoped tokens |
 | Run-bound keys | a report recipient an operator issues one to | a `user` key from `mint-token.mjs`, read-only and bound to one run; the plain-language report tools (`clientSafe`) only |
@@ -98,9 +98,9 @@ with access to everything.
   on (`get_coverage`, `search`, `diff_artifact`, `run_changes`, what-if), which are denied by the
   default that an undecided tool is denied.
 - HMAC-signed tokens (`v1.<payload>.<sig>`, node:crypto only). `authorize()` is the single
-  enforcement point for every tool call; `visibleTools()` additionally hides what a session may not
-  call — but it is hygiene on the tool LISTING, not a second gate, and it is the only thing that
-  reads `local`.
+  enforcement point for every tool call; `visibleTools()` decides what a session is offered, and a
+  tool it hides is refused by name at the call, after `authorize()`. `authorize()` never sees `local`,
+  and `visibleTools()` is the only per-call gate that uses it.
 - **User tokens cannot**: enumerate runs, cross to another run (explicit mismatching runId refused;
   omitted runId pinned), reach any write/spend tool, or read internal artifacts — `read_artifact`
   is name-gated to the report alone (`USER_ARTIFACTS`), and `list_findings` to the curated
@@ -110,13 +110,13 @@ with access to everything.
   rides inside a delivered PDF and can be forwarded to anyone, and the ruling was about people the
   operator enrolled. Both sets are gated at the read_artifact tool AND at the Resources surface
   (`resources/list` / `resources/read`), kind for kind — two doors to the same bytes, one rule.
-- **Ops tokens are least-privilege**: an optional `verbs[]` allowlist restricts write tools per
-  principal (an intake connector physically cannot `stop_run`). `what_if_*` is filtered out of the
-  HTTP tool LISTING for every OPS scope (`visibleTools`, keyed on `local` — the `local` test governs
-  the ops branch only, and an `account` principal returns above it). That is hygiene, not a wall:
-  `authorize()` never sees `local` and treats what-if as an ordinary ops write verb, so an ops token
-  minted without `--verbs` can still call it over HTTP — which is why every HTTP ops token should be
-  minted verb-scoped.
+- **Ops tokens are least-privilege**: a new ops token must name its `verbs[]`, the write tools it may
+  call (an intake connector physically cannot `stop_run`), and `mint-token` refuses one without
+  `--verbs`. Tokens issued before that rule keep working, and the audit line marks every call they
+  make. `what_if_plan` and `what_if_run` are left out of the HTTP tool listing for every ops scope
+  (`visibleTools`, keyed on `local`), and a tool the listing hides is refused at the call, so no ops
+  token plans or runs a what-if over HTTP. An `account` principal returns above that branch: its
+  what-if is queued for a separate process, never run by the door.
 
 ## Token lifecycle
 
@@ -127,15 +127,21 @@ what the mechanism guarantees.*
   principal in every audit line; the `jti` printed at mint time is the revocation handle). Three other callers share the same `mintToken`: `clearotron start` mints the portal's verb-scoped,
 company-capped ops token in memory at every start, and neither prints nor stores it; `clearotron connect`
 and the portal's connect screen each mint a person's key for their own assistant.
-- **Revocation**: denylist file checked on every verification; missing file = nothing revoked (the
-  denylist can never take all auth down). **Rotation**: two-secret window, flag-day-free.
+- **Revocation**: a denylist file is checked on every verification, always. With
+  `TRADEMARK_MCP_TOKEN_DENYLIST` unset it is `~/.config/clearotron/token-denylist`, the file every revoker
+  writes in that case, and that file being absent means nothing has been revoked. A list named in the
+  setting that is missing or unreadable, or a default list that exists but cannot be read, refuses every
+  key. **Rotation**: two-secret window, flag-day-free.
 - **Rate limits**: per-identity bucket on every request plus a separate lower per-principal bucket
   for ops sessions.
 
 ## Audit
 
 Every HTTP tool call appends one line to an append-only JSONL (`TRADEMARK_MCP_AUDIT_LOG`) when the call
-finishes: `{ts, email, sub, method, tool, runId, status, door}`, where `status` is the outcome. It is
+finishes: `{ts, email, sub, kind, method, tool, runId, status, door}`, where `status` is the outcome, plus `query` (its
+first 120 characters) on a search, `uri` on a resource read and `transport` on the local route, and for an
+ops token `namesVerbs`, which says whether the token names its tools (never which tools, and never the
+token). It is
 written after scope resolution, so it names the principal. A request refused before any tool runs is
 written too, with the status `refused`. Writing it is best-effort and never blocks a request.
 

package/docs/architecture/04-configuration-reference.md

@@ -156,7 +156,8 @@ the attempt row records the id the program reports it served.
 **The CLI must be new enough for the model.** Each release carries its own list of accepted models,
 and one that predates a model refuses it outright while the tier alias goes on serving the previous
 generation — a 400 at the first turn, or a run that quietly used an older model. Setup installs
-`2.1.280` or newer for this reason; a copy already on the machine is used as it is, so `doctor`'s
+`2.1.293` or newer for this reason, the first release whose `haiku` reaches Claude Haiku 5.5 (`opus` and
+`sonnet` reached 5.5 from `2.1.284`); a copy already on the machine is used as it is, so `doctor`'s
 version is the one to read before assuming which model a tier reaches.
 
 **Anything else throws.** There is no regex fall-through to sonnet and no cross-provider
@@ -190,7 +191,7 @@ timeout shot, warm patch, backoff), the lane-wedge re-dispatch, and the rate-lim
 | `CLEAROTRON_AI_BILLING` | `subscription` (default) \| `api-key` \| `cloud` | Billing mode for the selected engine. ONE variable for both, and only the LIVE engine's setting is read — it fills each engine's billing knob, and the engine that is not selected is never consulted. **`anthropic-agent`:** subscription **deletes `ANTHROPIC_API_KEY` from the child env** so `claude -p` uses OAuth subscription credentials (a present key would override them); `api-key` keeps the key — the scale setting and standing fallback; **`cloud`** bills Claude per use through the reader's own cloud account, named by the Claude program's own switch — `CLAUDE_CODE_USE_VERTEX`, `CLAUDE_CODE_USE_FOUNDRY` or `CLAUDE_CODE_USE_BEDROCK`, or `ANTHROPIC_BASE_URL` alone for a gateway (see the credentials table below) — and deletes `ANTHROPIC_API_KEY` as subscription does. **`openai-agent`:** subscription seeds `auth.json` into the per-run `CODEX_HOME` from `CLEAROTRON_OPENAI_AUTH_FILE` (default `~/.codex/auth.json`) and strips API keys; `api-key` keeps `CODEX_API_KEY`; `cloud` is refused. **Fail-loud, never a guess, never the subscription in its place:** `api-key` with no `ANTHROPIC_API_KEY` / `CODEX_API_KEY` throws; on `anthropic-agent`, `cloud` with two switches on, or with none and no `ANTHROPIC_BASE_URL`, throws, and so does a switch left on under `subscription` or `api-key`, because the program bills that cloud whatever this says; a value that is none of the three throws on both engines. `clearotron start` and `clearotron doctor` report each refusal against the settings the services read, naming a value that is not a billing mode by its setting and never quoting it, and the runner refuses the search when it is ordered, before anything is spent. The resolved mode is stamped on every stage telemetry row (`engine`, `authMode`, `apiBilled`, and `cloud`, null when no cloud bills), and the attempt row also carries `providerReported`, the program's own word for who served the turn. |
 | `CLEAROTRON_CLAUDE_PATH` · `CLEAROTRON_CODEX_PATH` | `claude` / `codex` on `PATH`, then the copy Clearotron installed | The engine binary to spawn, ONE PER ENGINE: `CLEAROTRON_CLAUDE_PATH` under `anthropic-agent`, `CLEAROTRON_CODEX_PATH` under `openai-agent`. Only the live engine's is read, and a machine that runs both sets both — they were one variable until it met a machine needing two different paths. A path set here must be **absolute**: stage subprocesses run with cwd set to the run directory, so a relative path does not resolve there, and `clearotron doctor` refuses one. **Unset**, or set to the bare word `claude` / `codex` (which means the same), the engine uses the program on `PATH` when the machine has one, and otherwise the copy Clearotron installed in `~/.local/share/clearotron/engines`: `clearotron install` offers to put the chosen engine's program there (`@anthropic-ai/claude-code` or `@openai/codex`, this platform's build only), and `clearotron update` refreshes it. Nothing is bundled into the package. A value naming anything else is used as given and never falls back. `clearotron doctor` says which copy it found, and its version when npm installed that copy. |
 | `CLEAROTRON_OPENAI_AUTH_FILE` | `~/.codex/auth.json` | The credentials file seeded into the per-run `CODEX_HOME` under subscription billing. Was exempted from the August 2026 rename as an `openai-agent` internal rather than an install-surface name; a decision of 2026-09-04 **reversed that exemption** and renamed the whole namespace, so it carries the house prefix like everything else. One spelling, no exceptions. |
-| `CLEAROTRON_OPENAI_MODEL_JUDGMENT` / `CLEAROTRON_OPENAI_MODEL_SWEEP` / `CLEAROTRON_OPENAI_MODEL_CHEAP` | `gpt-5.6-sol` / `gpt-5.6-terra` / `gpt-5.6-luna`. | Maps the driver's abstract `opus`/`sonnet`/`haiku` tiers onto the codex ladder, the way the anthropic engine maps onto its own (ruling 2026-09-02, superseding the single-model mapping). A tier that cannot hold its stage contract announces itself at that stage — `missing:negative-results`, `no_coverage_status_row`, `named_band_missing` in `_driver/<stage>.jsonl` — not at delivery. |
+| `CLEAROTRON_OPENAI_MODEL_JUDGMENT` / `CLEAROTRON_OPENAI_MODEL_SWEEP` / `CLEAROTRON_OPENAI_MODEL_CHEAP` | `gpt-6.1-sol` / `gpt-6.1-sol` / `gpt-6-luna` (from 2026-10-09; before that `gpt-5.6-sol` / `gpt-5.6-terra` / `gpt-5.6-luna`). Codex `0.159.0` or newer is required on a ChatGPT sign-in: older releases refuse `gpt-6.1-sol` with a 400. | Maps the driver's abstract `opus`/`sonnet`/`haiku` tiers onto the codex ladder, the way the anthropic engine maps onto its own (ruling 2026-09-02, superseding the single-model mapping). A tier that cannot hold its stage contract announces itself at that stage — `missing:negative-results`, `no_coverage_status_row`, `named_band_missing` in `_driver/<stage>.jsonl` — not at delivery. |
 | ↳ why they are three, and what the old measurement still says | superseded 2026-09-02, not erased | The three defaulted to `sol` alone on a MEASUREMENT, never a placeholder: on 2026-08-11/12, with `SWEEP=gpt-5.6-terra` / `CHEAP=gpt-5.6-luna`, every codex clearance died on structural-output gates — `missing:negative-results`, `no_coverage_status_row`, `named_band_missing` — over 2 scenarios × 3 stage families, **byte-identically on retry**, so no retry budget rescued it. That measurement stands for the code and the codex CLI **of that date**, and it is why the judgment tier keeps `sol`. Three weeks of stage-contract work and several codex minor versions sit between it and the 2026-09-02 ruling that split the three. **The symptom to match against this cause is unchanged**: those same three gates, as a fail row in`_driver/<stage>.jsonl`, inside the first few dispatches of a clearance and identical on every retry — a model incapable of a contract is not flaky at it. It reads as an engine bug when the only fault is this configuration. A cheap-tier experiment still belongs in the three constants in `driver/engine/openai-agent.mjs` where a reviewer sees it, not in an untraceable env line. |
 | `CLEAROTRON_DATABASE` | **REQUIRED — no default.** `corsearch` \| `clarivate` \| `signa` \| `euipo` \| `uspto-local` \| `free-tier` | Active register provider — one per run, set in the environment the deploy carries, in every environment including production. There is **no default**: unset resolves to `null` and every use of it throws, so a run refuses at start rather than calling a vendor nobody chose (the removed `corsearch` fallback named a vendor the deployment did not choose). Three are paid global sweeps; `euipo` (EU) and `uspto-local` (US) are free single-office sources, and `free-tier` composes those two as one register. Choosing a free value makes every territory outside its coverage a disclosed *deferred* row. Unknown ids throw loudly, and the gather layer throws at stage time for any provider without a built MCP server. |
 | `CLEAROTRON_CODEX_SANDBOX_BYPASS` | unset | `1` runs `codex exec` with its own sandbox bypassed, for hosts where that sandbox cannot run (setup and `doctor --probe-engine` report it). It removes a defence: with it set, a stage's commands run with every permission of the account Clearotron runs as, not only in the run folder. Codex has no guard against a stage writing into the run's `_driver/` folder, with the sandbox or without it. Set it because the host forces it, never for convenience. |

package/docs/architecture/05-config-governance.md

@@ -161,7 +161,7 @@ structural, or dev seam); [dev] = dev/test seam, never set in prod.
 `CLEAROTRON_AI` (anthropic-agent | openai-agent; default anthropic-agent), `CLEAROTRON_AI_BILLING`
 (subscription|api-key|cloud; cloud is Claude only), `CLEAROTRON_CODEX_PATH`,
 `CLEAROTRON_OPENAI_AUTH_FILE`, `CLEAROTRON_OPENAI_MODEL_JUDGMENT` / `CLEAROTRON_OPENAI_MODEL_SWEEP` /
-`CLEAROTRON_OPENAI_MODEL_CHEAP` (all gpt-5.6-sol),
+`CLEAROTRON_OPENAI_MODEL_CHEAP` (gpt-6.1-sol / gpt-6.1-sol / gpt-6-luna),
 `CLEAROTRON_CLAUDE_PATH` (claude on PATH, then the copy Clearotron installed),
 `CLEAROTRON_SYNTHESIS_MODEL` (opus), `CLEAROTRON_KNOCKOUT_MODEL` (opus),
 `CLEAROTRON_MAX_BUDGET_USD` (unset).

package/docs/architecture/06-operations-runbook.md

@@ -294,7 +294,7 @@ node mcp-server/mint-token.mjs --scope ops --sub <principal-name> \
 
 - `--sub` names the principal, and it rides into every audit line. Two integrations holding ops
   tokens are then distinguishable in the log; one shared token makes them permanently indistinguishable.
-- `--verbs` is a least-privilege allowlist of write tools. A connector minted without `stop_run`
+- `--verbs` is required for an ops token: it lists the write tools the token may call. A connector minted without `stop_run`
   cannot call it — the check sits at the one chokepoint every tool call passes, not in each tool.
 - `--accounts` caps the token to a set of company keys, so a trial integration can start demo
   searches and never a real company's.

package/docs/architecture/09-security-and-data.md

@@ -105,9 +105,12 @@ are no root units; everything is `systemd --user`.
     The API-key door is a fourth process (loopback :18812) with **no Access in front** — the trade is
     explicit: a mandatory key replaces the browser sign-in, and the mode refuses to start if anything
     that would weaken that (the dev auth-disable knob, a missing signing secret) is also set.
-  - The staff unit is systemd-hardened (`NoNewPrivileges`, `ProtectSystem=strict` with only the
-    audit-log path writable, `PrivateTmp`); both HTTP faces enforce host allowlists
-    (DNS-rebinding protection), per-identity rate limits, body caps, and auth-before-body-read.
+  - The remote deployment's staff unit (`mcp-server/remote/`) is systemd-hardened (`NoNewPrivileges`,
+    `ProtectSystem=strict` with only the audit-log path writable, `PrivateTmp`). The portal, worker and two
+    assistant-door units an install runs (`driver/systemd/`) set `NoNewPrivileges`, `RestrictSUIDSGID`,
+    `LockPersonality` and `UMask=0007`, and nothing that limits where they write: they can write wherever
+    the install's account can. Both HTTP faces enforce host allowlists (DNS-rebinding protection),
+    per-identity rate limits, body caps, and auth-before-body-read.
 - **Outbound** traffic is enumerated in [What leaves the machine](#what-leaves-the-machine) below.
   No outbound service is given filesystem access: register, research, and case-law calls carry query
   arguments only, and the pool and run dirs are never exposed to them.
@@ -165,17 +168,17 @@ CLI's built-in `WebFetch` (`engine/mcp/gather-config.mjs`), or the driver's stan
 moment of the call, so no list here can be complete, and a deployment that needs one must enforce it at
 the network layer.
 
-**A published report reaches two font CDNs.** The report HTML links stylesheets on `api.fontshare.com`
-and `fonts.googleapis.com`, with the font files on `cdn.fontshare.com` and `fonts.gstatic.com`
-(`publish/render.mjs`, `publish/render-knockout.mjs`; the served CSP admits exactly
-those hosts at `portal-static.mjs`). The reader's browser fetches them when the report
-opens. The request carries no matter data. Registry links in the report resolve only when a reader
+**A report carries its own fonts.** A report published from 0.4.0 on holds Plus Jakarta Sans and Fira
+Code inside itself (`shared/fonts/`), and opening it contacts no other server, from disk, from an email
+or in the portal. CI records every request a rendered report makes and fails on one that leaves
+(`scripts/report-offline-render-check.mjs`). A report published before 0.4.0 still links its two font
+services when opened from disk. The request carries no matter data. Registry links in the report resolve only when a reader
 clicks one.
 
 **The demo contacts nothing.** `bin/example.mjs` re-publishes artifacts already on disk: no `fetch` in its
 module graph, no MCP server, no engine binary. Its two subprocesses are a `git rev-parse` build stamp
-and the browser opener, and the portal binds `127.0.0.1`. The report it opens loads the two font
-stylesheets above.
+and the browser opener, and the portal binds `127.0.0.1`. The report it opens loads nothing from
+another server.
 
 ## Secrets
 
@@ -228,7 +231,9 @@ today — flag for the buyer's compliance review.
   and the engine-local gather MCP servers add none: each is ~130 lines over a shared 120-line stdio
   scaffolding (`driver/engine/mcp/stdio-server.mjs`) with no MCP SDK. The artifacts read layer does
   use the SDK (`@modelcontextprotocol/sdk`, `jose`). Small surface by design.
-- Deploy installs with `--omit=dev --ignore-scripts`. If your deploy then rebuilds a native addon,
+- On an install from a git checkout, `clearotron update` installs with `npm ci --ignore-scripts`, so no
+  package's install script runs on the host. Development packages are kept there, because the portal is
+  rebuilt from them. If your deploy then rebuilds a native addon,
   make that a named, reviewed step: it is the only place a lifecycle script should run on the host.
 - Run a skill scanner over the skills tree at deploy time and abort on high/critical findings. Two
   things to check on any new host: that the scanner is actually installed (a scanner that is absent

package/driver/CHANGELOG.md

@@ -1,5 +1,23 @@
 # clearotron-driver
 
+## 0.4.1-beta.0
+
+### Patch Changes
+
+- Fixed: A connection library is updated to close a reported weakness in how sign-in details could be sent.
+- Fixed: A clearance started from a connected assistant under the Generic default now appears on Clearances when you choose Generic. Before, it showed only under All companies.
+- Fixed: A register count or record that could not be fetched no longer shows the program's error message to a client. This covers the knockout workbook's count notes, the knockout report and a clearance finding card. Each shows the line the report already uses for something left open.
+- Fixed: A knockout's completion message and email now give its rating, or the highest rating when several names were screened. They no longer use the term 'worst band'.
+- Fixed: A client whose mark is written in another script, such as Greek, Cyrillic or Chinese, now receives the link to the report. Before, the email arrived without one.
+- Fixed: In rare cases, a report repaired just before delivery listed one conflict as two findings. Its last finding also lost its full write-up. The conflict now stays one finding, and every finding keeps its write-up.
+- Fixed: Reports no longer say a search "did not finish and must be re-run" when a name's non-Latin form was in fact searched. They no longer make a conclusion depend on reviewing records the search had already read in full. Knockout reports now list every territory you ordered.
+- Fixed: The audit workbook no longer warns that the depth rules were applied to nothing on a clearance whose narrative is written in sections. Those rules govern per-finding write-ups, and such a narrative has none.
+- Fixed: An order for the European Union now also searches each member state's own trade mark register, at no extra search cost. A national registration — in France, for example — is now found by an EU search.
+- Before you upgrade: if you installed Codex yourself, update it to 0.159.0 or newer first. Older copies cannot use GPT-6.1 Sol, and searches on the OpenAI engine would stop at their first step.
+- New: Searches now use the latest models: Claude Haiku 5.5, Sonnet 5.5 and Opus 5.5, and OpenAI's GPT-6.1 Sol and GPT-6 Luna. Installing or updating Clearotron brings the Claude and Codex programs up to versions that can use them.
+- Fixed: Two different names written in Greek, Cyrillic or Chinese characters, or differing only in an accented letter, can now be screened in one knockout. Before, they were refused as duplicates.
+- Fixed: Findings rated medium risk or higher are now checked for the owner's actual use in the same way on every company's risk ladder. That same search looks for the owner's record of oppositions and disputes, so "Likely to enforce" carries a rating instead of "not checked".
+
 ## 0.4.0
 
 ### Minor Changes

package/driver/binding-layers.mjs

@@ -100,19 +100,39 @@ export function bindingLayersFor(territory) {
     layers.push({ layer: "national", office: BX_OFFICE,
       why: `${t} has no separate national register — Benelux (BX) is the national register for it` });
   } else if (t === WO_OFFICE) {
-    // The international register ORDERED AS a territory. Same shape as the EU below: there is no
-    // national layer to miss, because the Madrid register IS the order. Without this a matter listing
+    // The international register ORDERED AS a territory. There is no national layer to miss, because
+    // the Madrid register IS the order. Without this a matter listing
     // "International" (territory-codes.mjs normalizes it to WO) discloses a missing national register
     // that does not exist — a limitation on a register the plan searched, which is the kind a reader
     // learns to skim.
     layers.push({ layer: "international", office: WO_OFFICE, why: "the international register, ordered directly" });
     return Object.freeze(layers.map(Object.freeze));
-  } else if (t === EU_OFFICE || t === "EU") {
-    // The EU ordered AS a territory. There is no national layer to miss; the EU register IS the order.
-    layers.push({ layer: "regional", office: EU_OFFICE, why: "the EU-wide register, ordered directly" });
+  } else if (t === EU_OFFICE) {
+    // The EU-wide register named by its OFFICE code, which is how a plan that is already resolved
+    // carries it. It names that register, not the territory: resolving a France plan's ["FR", "EM",
+    // "WO"] again must not turn it into a search of every member state. An EU ORDER arrives as "EU"
+    // (normalizeTerritory folds "European Union", EUTM and EUIPO there) and takes the branch below.
+    layers.push({ layer: "regional", office: EU_OFFICE, why: "the EU-wide register, named by its office code" });
     layers.push({ layer: "international", office: WO_OFFICE,
       why: "international registrations designating the EU bind it without a separate EU filing" });
     return Object.freeze(layers.map(Object.freeze));
+  } else if (t === "EU") {
+    // The EU ordered AS a territory: the EU-wide register, EVERY member state's national register, and
+    // international registrations designating the EU or a member. A national right blocks use in its own
+    // member state without appearing in the EU-wide register, so an EU order that searched only EUIPO and
+    // Madrid cleared none of the countries inside it — measured 2026-10-09 on both live providers: an
+    // EU-scoped search returns no member state's national filings, and listing the members in the same
+    // request reaches them. The owner's ruling of the same day: an EU order searches the national
+    // registers too, on every provider. Benelux is one national register for three members, listed once.
+    layers.push({ layer: "regional", office: EU_OFFICE, why: "the EU-wide register, ordered directly" });
+    for (const office of new Set(EU_MEMBERS.map((m) => (BENELUX_MEMBERS.includes(m) ? BX_OFFICE : m)))) {
+      layers.push({ layer: "national", office, why: office === BX_OFFICE
+        ? "Benelux (BX) is the national register of three EU members"
+        : `a national right in ${office} blocks use there without appearing in the EU-wide register` });
+    }
+    layers.push({ layer: "international", office: WO_OFFICE,
+      why: "an international registration designating the EU or a member state binds it without a separate filing" });
+    return Object.freeze(layers.map(Object.freeze));
   } else {
     layers.push({ layer: "national", office: t, why: `the national register of ${t}` });
   }
@@ -215,7 +235,9 @@ export function unsearchedLayerReason(report) {
     regional: "EU-wide rights",
     international: "international registrations designating it",
   };
-  const missing = report.unsearched.map((u) => names[u.layer] ?? u.layer);
+  // One name per KIND of register: an EU order carries a national layer per member state, and a provider
+  // that reaches only some of them would otherwise list "the national register" once per member missed.
+  const missing = [...new Set(report.unsearched.map((u) => names[u.layer] ?? u.layer))];
   const list = missing.length === 1 ? missing[0]
     : `${missing.slice(0, -1).join(", ")} and ${missing[missing.length - 1]}`;
   return `Not a complete clearance for ${report.territory}: ${list} ${missing.length === 1 ? "was" : "were"} `

package/driver/citation-census.json

@@ -1,5 +1,5 @@
 {
-  "citations": 465,
-  "files": 3308,
-  "checkable": 129
+  "citations": 415,
+  "files": 3437,
+  "checkable": 186
 }

package/driver/common-law-coverage-status.mjs

@@ -111,3 +111,55 @@ export function recordCoverageStatus(spec, received, { now = () => new Date().to
   if (refused.length) lines.push("Refused — send these again, corrected:", ...refused.map((x) => `- ${x}`));
   return { ok: refused.length === 0, text: lines.join("\n") };
 }
+
+/** The status code records for a ledger row whose findings gave none of the three words. */
+export const NOT_STATED = "not stated";
+
+/**
+ * THE STATUSES A FINDINGS FILE STATES, RECORDED BY CODE (Krzys, 2026-10-01). A seat whose findings carry
+ * a coverage ledger but made no `record_coverage_status` call is accepted, not re-run: a re-run for this
+ * was a full stage re-run, and nothing is added to what the model reads. Each ledger row's status is read
+ * from the row as the findings wrote it — one of the three words, else "not stated" — and recorded in the
+ * same file the tool writes, marked `source: "findings"`. A record the seat made through the tool is never
+ * overwritten; a record code made earlier is replaced, so it follows the latest findings after a re-run.
+ * Returns the record written, or null when nothing was written. Never throws.
+ */
+export function recordStatusesFromFindings(findingsPath, { half = null, now = () => new Date().toISOString() } = {}) {
+  if (!findingsPath) return null;
+  const file = coverageStatusPath(findingsPath);
+  let existing = null;
+  try { existing = JSON.parse(readFileSync(file, "utf8")); } catch { existing = null; }
+  if (existing && existing.source !== "findings") return null;   // the seat recorded its own statuses
+  let text;
+  try { text = readFileSync(String(findingsPath), "utf8"); } catch { return null; }
+  const record = { coverage_status: ledgerStatuses(text), half, source: "findings", recorded_at: now() };
+  try {
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileSync(file, JSON.stringify(record, null, 2) + "\n");
+  } catch { return null; }
+  return record;
+}
+
+/**
+ * Each coverage-ledger row's unit and status, as the findings file wrote them: the first table under the
+ * Coverage ledger heading, its header and separator rows skipped. A row with none of the three words
+ * reads "not stated"; a ledger with no rows reads as one unit, "coverage ledger", not stated. PURE.
+ */
+export function ledgerStatuses(text) {
+  const lines = String(text ?? "").split("\n");
+  const at = lines.findIndex((l) => /^#{1,4}\s+[^\n]*coverage[\s-]ledger/i.test(l));
+  const isSeparator = (l) => /^\|?(\s*:?-{2,}:?\s*\|)+\s*:?-{0,}:?\s*\|?$/.test(String(l ?? "").trim());
+  const out = {};
+  if (at >= 0) {
+    for (let i = at + 1; i < lines.length; i++) {
+      const l = lines[i].trim();
+      if (/^#{1,6}\s/.test(l)) break;
+      if (!l.startsWith("|")) { if (Object.keys(out).length) break; continue; }
+      if (isSeparator(l) || isSeparator(lines[i + 1])) continue;   // the separator, and the header above it
+      const unit = l.replace(/^\|/, "").split("|")[0].trim();
+      if (!unit) continue;
+      out[unit] = COMMON_LAW_COVERAGE_STATUSES.find((s) => new RegExp(`(^|[^a-z-])${s}([^a-z-]|$)`, "i").test(l)) ?? NOT_STATED;
+    }
+  }
+  return Object.keys(out).length ? out : { "coverage ledger": NOT_STATED };
+}

package/driver/common-law-receipts.mjs

@@ -166,7 +166,7 @@ export function countMatrixCells(findingsContent) {
 /**
  * The shared shortfall ladder over a `cellsOf(term) → count` accessor. A variant is satisfied by:
  * its own floor; " / "-packed ALTERNATES each meeting the floor (one manifest cell, two renderings —
- * "丝绸与铁 / 席尔克": each alternate is its own search term with its own grid — the copper-conduit worker
+ * "缎与钢 / 萨汀": each alternate is its own search term with its own grid — the copper-conduit worker
  * keyed the split forms with full receipts while the validator demanded the compound key, 2026-06-12);
  * or WORD-BOUNDARY substring coverage (a fully-receipted variant covers a LONGER variant containing it
  * as a whole-word phrase — "Foxglade Legends II: Oak & Ember" ⊃ "Oak & Ember"; a marketplace phrase

package/driver/connotation-search.mjs

@@ -300,14 +300,14 @@ export const normText = (s) => foldPunct(String(s ?? "").toLowerCase()).replace(
 
 // (2026-08-04, the terminal R2 run of that round) — LANGUAGE EDITIONS OF ONE DOCUMENT ARE ONE RECEIPT.
 // The recurrence floor demanded the model cite the SAME dictionary lemma twice, under two language editions.
-// Attempts 2, 6 and 8 died on https://fr.wiktionary.org/wiki/δελφίς; the model then cited it verbatim; attempt
-// 9 died on https://en.wiktionary.org/wiki/δελφίς and the run went terminal — ~37 minutes of model work, no
+// Attempts 2, 6 and 8 died on https://fr.wiktionary.org/wiki/βελτρίν; the model then cited it verbatim; attempt
+// 9 died on https://en.wiktionary.org/wiki/βελτρίν and the run went terminal — ~37 minutes of model work, no
 // artifact. Both editions cleared the floor independently (en 8 owning queries, fr 5, floor 4) and their
 // titles diverge before TITLE_PREFIX ("Wiktionary, the free dictionary" / "Wiktionnaire, le dictionnaire
 // libre"), so citing one PROVABLY could not satisfy the other and no attempt could have converged.
 // Folding the leading language-edition host label weakens the compare's contract not at all: the contract is
-// "the model quoted something it could only have got by opening the receipt", and fr.wiktionary.org/wiki/δελφίς
-// proves exactly that for en.wiktionary.org/wiki/δελφίς. BOUNDED two ways — only a leading 2-3 letter (or
+// "the model quoted something it could only have got by opening the receipt", and fr.wiktionary.org/wiki/βελτρίν
+// proves exactly that for en.wiktionary.org/wiki/βελτρίν. BOUNDED two ways — only a leading 2-3 letter (or
 // xx-yy) label, and only when a PATH follows, because folding a BARE host would let any URL on the domain
 // satisfy a demand for one specific page. Measured on the evidence receipts: 274 distinct results → 266,
 // and the load-bearing-by-recurrence set is the same 7, only re-keyed.
@@ -438,7 +438,7 @@ const QUOTE_MIN = 24;
 // that it could not have been produced without reading the snippet. 24 Latin characters buy that. 24
 // HANZI buy several times as much, because a Chinese character carries a morpheme where a Latin
 // character carries a letter — so this constant asked the CJK lane for a passage far longer than the
-// rule requires, and a 克罗玛 row failed on exactly that.
+// rule requires, and a 维尔特林 row failed on exactly that.
 //
 // IT CUT BOTH WAYS, which is why both sites move together or neither does. The same constant decides
 // `usableSnippet` — which rows are ELIGIBLE to be quote-required at all — so a CJK snippet under 24

package/driver/contract-dictation-registry.mjs

@@ -131,7 +131,7 @@ export const TOOL_ORDER_BACKLOG = [
     closes: "#865 — same shared file, same split grant." },
   { stage: "register-digest", tool: "register_batch_screen", site: "driver/skills/clearance-register/digest.md",
     closes: "#865 — the digest's OWN doctrine, not a shared file: this one is the stage being told to "
-      + "batch-screen with a tool its grant does not carry. gather-config.mjs:196 already records that "
+      + "batch-screen with a tool its grant does not carry. gather-config.mjs:196 RECORDING already records that "
       + "this stage's prompt once ordered live register checks; the order outlived the note." },
   { stage: "register-unit", tool: "band_record", site: "driver/skills/clearance-register/SKILL.md",
     closes: "#865 — same shared file, same split grant." },

package/driver/contract-e3-backlog.mjs

@@ -211,7 +211,7 @@ export const E3_BACKLOG = [
     kind: "literal-json-skeleton",
     where: "driver/skills/clearance-common-law/SKILL.md:123-170",
     surface: "skill-file",
-    evidence: "### Format\\n```markdown\\n# Common-law findings — Dawn: Legends of Thornmantle (2026-05-11)\\n\\n## Summary\\n\\n- Perplexity calls executed: 4 …",
+    evidence: "### Format\\n```markdown\\n# Common-law findings — Dusk: Tales of Thornmantle (2026-05-11)\\n\\n## Summary\\n\\n- Perplexity calls executed: 4 …",
     reparsedBy: "driver/publish/audit-from-spine.mjs:14 parseTables → parseSpineFindingBlocks (audit-from-spine.mjs:123) re-parses the common-law finding tables into audit.md",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },