clearotron 0.4.0 → 0.4.1-beta.1

package/driver/synthesis-record.mjs

@@ -52,6 +52,7 @@ import { findCoverageRecommendations } from "./verify.mjs";
 import { declinationCallPaths, readDeclinations } from "./declination-tool.mjs";   // — the seat's own declines, read by the driver never asserted by the seat
 import { reconcileDeclinationDuty, declinationDutyRefusal } from "./declination-duty.mjs";
 import { findingUris } from "./record-carry.mjs";   // one derivation of "which records did the findings name", called not copied
+import { foldAfterSave } from "./record-fold.mjs";   // once the delivery seam is passed, the saved record is folded again
 
 export const NARRATIVE_FILE = "narrative.md";
 export const FINDINGS_FILE = "findings.json";
@@ -670,6 +671,10 @@ export function recordSynthesis(runDir, received, opts = {}) {
       captured: closeCapture({ ok: true }), capture_failed: captureFailed,
     };
   }
+  // ONCE THE DELIVERY SEAM IS PASSED, THE RECORD IS FOLDED AGAIN ON ACCEPTANCE (design, 2026-10-03). The
+  // call records above stay the model's own, the base for its next patch; findings.json becomes the folded
+  // record the reviewer, the cards and the delivery read. Before the seam this leaves the record as written.
+  foldAfterSave(dir0, findingsAt);
 
   return {
     written: [findingsAt, narrativeAt], refused: null,

package/driver/unit-inventory.mjs

@@ -159,7 +159,7 @@ export const UNIT_INVENTORY = Object.freeze([
     // stamped and says where its verdict lives, and driver/updater-identity.mjs makes that verdict from
     // the digests the updater records about itself.
     attribution: "stamp",
-      measured: "2026-09-08, read on the test deployment: the timer and its service are installed, the timer is enabled and ACTIVE, and it last fired within the hour — `systemctl --user list-timers`. The service's own state says nothing about this: it is `inactive` between runs and `inactive` when the timer has been stopped. The timer's ActiveState says the timer itself is still up. It is NOT a next elapse and does not promise one: `active` means UP, never SCHEDULED. Proving something will still fire takes a real next elapse, which `systemctl list-timers --all` supplies and `show -p ActiveState` cannot. Measured in testing 2026-09-09: a timer reading `ActiveState=active` whose `OnCalendar` names a date already past, so `list-timers` reports its next fire as null and it will never run again.",
+      measured: "2026-09-08. The service's own state says nothing about the timer: it is `inactive` between runs and `inactive` when the timer has been stopped. The timer's ActiveState says the timer itself is still up. It is NOT a next elapse and does not promise one: `active` means UP, never SCHEDULED. Proving something will still fire takes a real next elapse, which `systemctl list-timers --all` supplies and `show -p ActiveState` cannot. Measured in testing 2026-09-09: a timer reading `ActiveState=active` whose `OnCalendar` names a date already past, so `list-timers` reports its next fire as null and it will never run again.",
     tracked: ["clearotron-deploy.service", "clearotron-deploy.timer"],
     note: "the install's own updater.",
     // IT WAS AN ORPHAN, AND THE CONDITION IT NAMED HAS BEEN MET. This entry carried an `orphanReason`
@@ -212,8 +212,7 @@ export const UNIT_INVENTORY = Object.freeze([
     // prose references in driver/systemd/render-units.mjs also describe this file as though it were in
     // the tree; they are stale today either way.
     unit: "profile-service", runsOn: [],
-      measured: "2026-09-08, read on production: no unit of this name is present. Names and enable state only; "
-      + "no unit contents were read.",
+      measured: "2026-09-08",
     tracked: null,
     untrackedReason: "the repository has never carried this file — `git log --all` on the path is empty. "
       + "It was described as deploying from a copy held on the deployment itself, in the same "
@@ -243,11 +242,8 @@ export const UNIT_INVENTORY = Object.freeze([
     // REPORTED, never a fault, for exactly this case. It becomes `["prod"]` in the change that DEPLOYS
     // it, against a fresh enumeration, which is the ratchet working rather than being edited around.
     unit: "clearotron-portal", runsOn: ["test"], tracked: ["clearotron-portal.service"],
-      measured: "2026-09-07, read on the test deployment with a working user bus: ActiveState=active, UnitFileState=enabled, its fragment under the account's own unit directory.",
-    note: "NEW, SHIPPED BUT NOT YET DEPLOYED. The portal had NO unit at all — it "
-      + "and the MCP face are the two children bin/start.mjs supervises, and neither ran under systemd, "
-      + "so a hosted deployment kept them alive with a hand launcher and `clearotron start` had nothing "
-      + "to refuse in favour of.",
+      measured: "2026-09-07",
+    note: "The portal had NO unit at all — it and the MCP face are the two children bin/start.mjs supervises, and neither ran under systemd.",
     orphanReason: "THE WEB PORTAL, SHIPPED WITH NO BOX CARRYING IT YET — the same KIND of orphan as "
       + "clearotron-deploy (never installed), a different unit and a different install path. It is not "
       + "courtlistener-mcp, which runs on production under another name, and not feedback-mint, which "
@@ -260,9 +256,8 @@ export const UNIT_INVENTORY = Object.freeze([
     // Same as clearotron-portal above: shipped, running nowhere, declared as an orphan rather than
     // asserting a production state no enumeration has ever shown.
     unit: "clearotron-mcp-face", runsOn: ["test"], tracked: ["clearotron-mcp-face.service"],
-      measured: "2026-09-07, read on the test deployment with a working user bus: ActiveState=active, UnitFileState=enabled, its fragment under the account's own unit directory.",
-    note: "NEW, SHIPPED BUT NOT YET DEPLOYED. The engine door the portal calls over "
-      + "MCP; the other of the two processes that had no unit.",
+      measured: "2026-09-07",
+    note: "The engine door the portal calls over MCP; the other of the two processes that had no unit.",
     orphanReason: "THE ENGINE DOOR THE PORTAL CALLS, shipped with no box carrying it yet. Same kind as "
       + "clearotron-portal beside it and as clearotron-deploy — never installed — and distinct from "
       + "both other kinds in this list. It arrives with the PRODUCTION REBUILD and then `systemctl "
@@ -289,7 +284,7 @@ export const UNIT_INVENTORY = Object.freeze([
     // door beside it: it is in SERVER_INSTALL_SET, and it leaves this list on the day a measured
     // enumeration of a box shows it running.
     unit: "clearotron-client-mcp", runsOn: ["test"], tracked: ["clearotron-client-mcp.service"],
-      measured: "2026-09-07, read on the test deployment with a working user bus: ActiveState=active, UnitFileState=enabled, its fragment under the account's own unit directory.",
+      measured: "2026-09-07",
     note: "INSTALLED WITH THE PRODUCT since 2026-09-03. The client door "
       + "— the one surface that accepts an account-scoped key, and a separate process from the engine "
       + "door, which refuses one outright.",
@@ -307,9 +302,8 @@ export const UNIT_INVENTORY = Object.freeze([
     // Written as part of retiring the path-watcher posture, because retiring `prelim-driver.*` without
     // it leaves a hosted box healthy-looking and draining nothing.
     unit: "clearotron-worker", runsOn: ["test"], tracked: ["clearotron-worker.service"],
-      measured: "2026-09-07, read on the test deployment with a working user bus: ActiveState=active, UnitFileState=enabled, its fragment under the account's own unit directory.",
-    note: "NEW. The drain, as one plain service unit invoking the entrypoint "
-      + "directly (owner ruling 2026-08-31). Ships tracked and runs nowhere yet.",
+      measured: "2026-09-07",
+    note: "The drain, as one plain service unit invoking the entrypoint directly.",
     orphanReason: "AWAITING A BOX, not an orphan by design. It is the hosted posture's drainer, and the "
       + "hosted posture is an opt-in step no install performs. It must NOT be "
       + "started beside `clearotron start`, which supervises its own worker — the two postures are "
@@ -320,7 +314,7 @@ export const UNIT_INVENTORY = Object.freeze([
       orphanReason: "THE PRE-RENAME PORTAL. Production runs `clearotron-portal`; this name is "
       + "what that service used to be called, and the 2026-09-08 reading finds no unit of this name under "
       + "any account. It ran on production until the rename and the entry was never re-measured after it.",
-      measured: "2026-09-08, read on production: no unit of this name is present. Names and enable state only. This line previously carried a 2026-09-07 reading of the test deployment — LoadState=not-found there, with the production claim left alone because production had not been measured. It has been now, and this is that reading.", tracked: null,
+      measured: "2026-09-08", tracked: null,
     untrackedReason: "the deployed copy carries real Cloudflare Access team/AUD/domain values inline. "
       + "A tracked file would be the placeholder TEMPLATE, merged by hand after a "
       + "diff — writing one carelessly replaces working auth with placeholders that look configured.",
@@ -335,7 +329,7 @@ export const UNIT_INVENTORY = Object.freeze([
       orphanReason: "THE PRE-RENAME OPERATOR DOOR. Production runs `clearotron-mcp-face`; the "
       + "2026-09-08 reading finds no unit of this name under any account. Same rename as the portal it "
       + "serves, and the same claim carried across it unmeasured.",
-      measured: "2026-09-08, read on production: no unit of this name is present. Names and enable state only. This line previously carried a 2026-09-07 reading of the test deployment — LoadState=not-found there, with the production claim left alone because production had not been measured. It has been now, and this is that reading.", tracked: null,
+      measured: "2026-09-08", tracked: null,
     untrackedReason: "same CF Access inline-values shape as the portal it serves.",
   },
   {
@@ -343,7 +337,7 @@ export const UNIT_INVENTORY = Object.freeze([
       orphanReason: "THE PRE-RENAME CLIENT DOOR. `clearotron-client-mcp` runs on both the production and "
       + "the test deployments; the 2026-09-08 reading finds no unit of THIS name under any account. The "
       + "tracked template stays because the repository still ships it — see the note.",
-      measured: "2026-09-08, read on production: no unit of this name is present. Names and enable state only. This line previously carried a 2026-09-07 reading of the test deployment — LoadState=not-found there, with the production claim left alone because production had not been measured. It has been now, and this is that reading.", tracked: ["client-mcp.service"],
+      measured: "2026-09-08", tracked: ["client-mcp.service"],
     note: "TRACKED, in mcp-server/remote/ — this entry said it had no file, and the file was there. It is "
       + "a banner-marked TEMPLATE, so the live copy differing from it is the arrangement, not drift. "
       + "It was reported as shipping no unit; a unit did ship, in mcp-server/remote/ rather than "
@@ -353,10 +347,7 @@ export const UNIT_INVENTORY = Object.freeze([
   },
   {
     unit: "client-mcp-apikey", runsOn: ["test"],
-      measured: "2026-09-08, read on the test deployment: enabled and present, beside the renamed "
-      + "`clearotron-client-mcp`, and INACTIVE — enabled with no running process. Absent from "
-      + "production. The entry declared production and the reading puts it on the other deployment "
-      + "— the claim was not stale, it named the wrong machine.",
+      measured: "2026-09-08",
       tracked: ["client-mcp-apikey.service"],
     // THE SEPARATE QUESTION, ANSWERED. The line above used to end by saying that why it runs beside the
     // renamed door was a question for somebody else. It is a survivor of the rename, not a posture
@@ -396,7 +387,7 @@ export const UNIT_INVENTORY = Object.freeze([
       orphanReason: "A PRE-RENAME NAME OF THE RETIRED DEPLOYMENT, and the one of them whose tracked file "
       + "is GENERIC rather than a template — so the file is ready to be compared against a live copy the "
       + "day something runs it, and nothing does. Read as absent under every account on 2026-09-08.",
-      measured: "2026-09-08, read on production: no unit of this name is present. Names and enable state only; no unit contents were read.", tracked: ["trademark-artifacts-http.service"],
+      measured: "2026-09-08", tracked: ["trademark-artifacts-http.service"],
     note: "TRACKED, in mcp-server/remote/. GENERIC, not a template: it carries no banner and no "
       + "placeholder, and defers its CF Access values to the EnvironmentFile — so its live copy is "
       + "expected to MATCH the tracked file, and a difference is real drift.",
@@ -453,8 +444,7 @@ export const UNIT_INVENTORY = Object.freeze([
       orphanReason: "NOT THIS REPOSITORY'S SERVICE, and no longer running under this name: production holds it "
       + "only under a retired-suffixed filename, a suffix systemd never reads. "
       + "Declared here so a unit sharing a machine with ours is not invisible, and now declared as gone.",
-      measured: "2026-09-08, read on production: present ONLY as a retired-suffixed filename, which systemd "
-      + "does not load. No loadable unit of this name.", tracked: null,
+      measured: "2026-09-08", tracked: null,
     untrackedReason: "it is not this repo's service. Its ExecStart runs a script from a different "
       + "product's checkout on the same box, not under this clone — so there is no code here to "
       + "template, and the old reason (CF Access values inline) would send the next reader hunting for a "
@@ -519,8 +509,7 @@ export const UNIT_INVENTORY = Object.freeze([
       + "flag was ever captured, so stopping it dropped nothing. The decision owed, if any, is whether the "
       + "feedback machinery is removed rather than parked; driver/run-activity.mjs still carries a note "
       + "addressed to whoever picks that up, and it is still unclaimed.",
-    note: "STOPPED against an input nothing writes to any more; the owner's word came 2026-08-20 "
-      + "and it was disabled the same evening.",
+    note: "STOPPED against an input nothing writes to any more.",
   },
   // ── ANOTHER PRODUCT'S UNITS ARE NOT DECLARED HERE, AND THAT IS THE RULE (ruling 594, 2026-09-27) ──
   //
@@ -544,7 +533,7 @@ export const UNIT_INVENTORY = Object.freeze([
   // deployments. Not here. This file ships.
   {
     unit: "trademark-test-deploy", runsOn: [],
-      measured: "2026-09-07, read on the test deployment: LoadState=not-found. The hourly deploy runs as clearotron-deploy.timer, which has its own entry; this name is what that one used to be called.", tracked: null,
+      measured: "2026-09-07. The hourly deploy runs as clearotron-deploy.timer, which has its own entry; this name is what that one used to be called.", tracked: null,
     // AN EMPTY runsOn OWES A REASON, and this one is a supersession rather than an orphan: the hourly
     // deploy still runs on the test deployment, under the name `clearotron-deploy`, which has its own entry
     // its own measurement. This name is what that unit used to be called. It is kept rather than deleted

package/driver/verify.mjs

@@ -16,7 +16,7 @@ import { matterFrameWasRecorded, frameRatifiedForms } from "./matter-frame-recor
 import { findConnotationViolations, parsePrRiskResults, prRiskPopulation,
   CONNOTATION_UNMATCHED_MARK, CONNOTATION_NO_RESEMBLANCE_MARK, MEANING_ANGLES_RE,
   parseDispositionForm, CONNOTATION_UNRULED_REASONS, queryKey } from "./connotation-search.mjs";
-import { formSidecarName, formSidecarPath } from "./disposition-union.mjs"; import { coverageStatusAsData } from "./common-law-coverage-status.mjs";
+import { formSidecarName, formSidecarPath } from "./disposition-union.mjs";
 // B — the transport's own four failure states. The audit reads the run's records; this file locates them.
 import { auditDispositionCalls, CALL_FAILURE_REASONS } from "./disposition-call-audit.mjs";
 import { callRecordPaths } from "./disposition-tool.mjs";
@@ -37,7 +37,7 @@ import { registerPlanCallKilled } from "./tool-calls.mjs";   // — did the dict
 import { parseFindingsJson, parseFindingsJsonLenient, CLIENT_TIER_BY_COMPOSITE, isUnconditionalProceed, joinFindingToBlock, parseBlockOrd } from "./findings-model.mjs";
 import { parsePlacementsJson } from "./placement-model.mjs"; import { placementFormSidecarName, parsePlacementForm, placementRenderAccount } from "./placement-form.mjs";
 import { parseCaseLawLedger, findCaseLawLedgerViolations, caseLawLedgerFail } from "./case-law-ledger.mjs";
-import { parseFrameworkManifest, aboveLowestBand, normalizeBand } from "./framework.mjs"; import { readFrozenMethod, FROZEN_METHOD_FILE } from "./framework-method.mjs";
+import { parseFrameworkManifest, materialBand, normalizeBand } from "./framework.mjs"; import { readFrozenMethod, FROZEN_METHOD_FILE } from "./framework-method.mjs";
 import { parseNamedBand, findCollapsedBands } from "./named-band.mjs";
 import { parseBlindFrameModel } from "./blind-frame-model.mjs";
 import { parseFrameDiff } from "./frame-diff-model.mjs";
@@ -158,7 +158,7 @@ function nonEmpty(content, min = MIN) {
  * true for only one lane, and put back. Appending keeps every existing matcher matching — they all test
  * substrings — and gives the seat the one word it was missing.
  *
- * It also sharpens `noChange` (`gateway.mjs:1220`, "this attempt's token equals the previous attempt's"):
+ * It also sharpens `noChange` (in runStageLadder() in gateway.mjs, "this attempt's token equals the previous attempt's"):
  * a file that starts failing a DIFFERENT member now reads as changed instead of as a stalled retry.
  *
  * `names` is positional against `markers` and optional; a call site that omits it emits exactly the token
@@ -681,7 +681,7 @@ function commonLawStructural(c, p = null) {
     needsSection(c, "coverage-ledger", [/coverage[\s-]ledger/i], "coverage-ledger"),
     needsSection(c, "audit-trail", [/audit[\s-]trail/i], "audit-trail"),
     needs(c, [/\|/], "platform matrix"),
-    coverageStatusAsData(p) || hasCoverageLedgerRow(c) ? ok() : fail("no_coverage_status_row"),   // the recorded status first, the word as fallback: coverageStatusAsData() in common-law-coverage-status.mjs
+    // no status check here (ruling 2026-10-01): a ledger with no status word and no record passes, and code records what it states — recordStatusesFromFindings() in common-law-coverage-status.mjs
   );
 }
 
@@ -1203,9 +1203,9 @@ function checkFindingsSibling(p, c) {
   const v4 = (parsed.schemaVersion ?? 1) >= 4;
   if (v4 && !fw.manifest) return fail("framework_manifest_missing_for_v4: schema_version 4 findings need the frozen _driver/framework.json to judge band words");
   const v3 = (parsed.schemaVersion ?? 1) >= 3;   // gates key on schema_version — v2/archived runs and replay never flip
-  // "material finding" — the line the receipt gates key on: composite>=3 on the legacy scale; on v4,
-  // banded ABOVE the framework's lowest band (judgment-free re-expression of the same line).
-  const material = (f) => v4 ? (f.band != null && aboveLowestBand(fw.manifest, f.band)) : f.composite >= 3;
+  // "material finding" — the line the receipt gates key on: composite>=3 on the legacy scale; on v4, banded on
+  // a rung whose own tone is medium risk or higher (materialBand — by tone, never by position on the ladder).
+  const material = (f) => v4 ? (f.band != null && materialBand(fw.manifest, f.band)) : f.composite >= 3;
   for (const f of parsed.findings) {
     if (material(f) && f.use_check != null && !String(f.use_check.source ?? "").trim())
       return fail(`finding_use_check_source_missing:${f.ordinal}`);

package/mcp-server/CHANGELOG.md

@@ -1,5 +1,13 @@
 # trademark-artifacts-mcp
 
+## 0.4.1-beta.1
+
+No changes in this release.
+
+## 0.4.1-beta.0
+
+No changes in this release.
+
 ## 0.4.0
 
 No changes in this release.

package/mcp-server/CONNECT.md

@@ -21,9 +21,9 @@ It reads run directories off your disk. So:
 
 - **It shows you runs you have already produced.** `CLEAROTRON_WORK_DIR` is where the engine writes
   them, and that is the one variable the server needs.
-- **`npx clearotron demo` runs are not visible to it.** The demo publishes a *report* into a pool; it does not
-  create a run directory. There is nothing dishonest happening if `list_runs` comes back empty — you have
-  no runs yet.
+- **With no install, it shows you the demo.** `npx clearotron mcp` starts this server from the npm package.
+  On a machine with no install it answers from the four sample runs `npx clearotron demo` replays, and every
+  row says it is the demo. On a machine with an install it reads that install's runs.
 - **Nothing here spends money on its own,** with two exceptions that are gated and named: `start_run`
   enqueues a real clearance, and `what_if_run` re-runs one pipeline stage. Both are refused by default on
   a sensible allowlist — see "Hold two tools back" below.
@@ -51,6 +51,12 @@ claude mcp add trademark-artifacts --scope user \
 
 Check it: `claude mcp list` prints `trademark-artifacts: … - √ Connected`.
 
+With no clone, start it from the npm package instead, naming the version:
+
+```sh
+claude mcp add trademark-artifacts --scope user -- npx -y clearotron@<version> mcp
+```
+
 `--scope user` makes it available in every project, not only the directory you ran it in. In Windows
 PowerShell 5.1, write the separator as `"--"`: that shell drops a bare `--`. Remove it with
 `claude mcp remove trademark-artifacts`.

package/mcp-server/demo-mode.mjs

@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// demo-mode.mjs — whether this server is serving the demo's sample runs.
+//
+// `clearotron mcp` decides it and the server reads it, in one process: bin/mcp.mjs sets it before it
+// loads the server, and the server reads it as it answers. It is a module and not an environment
+// variable because nothing outside this process sets it or reads it, and every environment variable the
+// product reads is a setting an operator is told about.
+export const demoMode = { on: false };

package/mcp-server/lib/evidence.mjs

@@ -294,7 +294,7 @@ const MATCH_SHAPES = [
 // `*` wildcard, and the term extractor must see the word, not the markup.
 const deMarkup = (s) => String(s ?? "").replace(/\*\*|__/g, "");
 
-// Record COUNTS ride along in parentheses — `PARADISE (424)`, `パラダイス (34) / 파라다이스 (20)`. They are
+// Record COUNTS ride along in parentheses — `HAVEN (424)`, `ヘイヴン (34) / 헤이븐 (20)`. They are
 // process exhaust rather than the query, and dropping them first is what lets the rest of the string be
 // recognised as the bare term it is.
 const deCount = (s) => String(s ?? "").replace(/\s*\(\s*~?\s*[\d,]+\s*\)/g, "");
@@ -302,26 +302,26 @@ const deCount = (s) => String(s ?? "").replace(/\s*\(\s*~?\s*[\d,]+\s*\)/g, "");
 // A searched term is recognised three ways, in order, and NOT recognised otherwise:
 //   1. explicitly quoted — `exact "Drivers Haven" (default)`
 //   2. the whole string, when it carries no query scaffolding at all. This is how the common-law sweep
-//      writes them and it is the bulk of the corpus: `레이서스 파라다이스`, `赛车天堂`, `RACERZ`,
-//      `PARADISE WORLD`. Those scripts are caseless, so a capitals rule cannot see them at all.
+//      writes them and it is the bulk of the corpus: `드라이버스 헤이븐`, `车手港湾`, `DRIVERZ`,
+//      `HAVEN WORLD`. Those scripts are caseless, so a capitals rule cannot see them at all.
 //      "No scaffolding" is checked positively: no match-shape keyword, no residual parenthetical, and
 //      none of the structural punctuation the audit uses for anything OTHER than a query (a record path,
 //      a bracketed class list, an em-dash clause, a key: value tail).
-//   3. an ALL-CAPS token — `exact PARADISE`, `*PARADISE / fuzzy`. Two-letter tokens (ZH, JP, DE) are
+//   3. an ALL-CAPS token — `exact HAVEN`, `*HAVEN / fuzzy`. Two-letter tokens (ZH, JP, DE) are
 //      language/jurisdiction codes, not marks, and the register offices above are offices, not marks.
 const SCAFFOLD = /[[\]`:—]|\/mark\//;
 
 // "Does this read as a NAME?" — the property that separates a searched mark from a description of a
 // search. Every alphabetic token must start upper-case or be in a caseless script (CJK, Hangul, Kana,
-// Arabic); a token that is entirely lower-case Latin is prose. So `Racer's Paradise`, `PARADISE WORLD`,
-// `Вензи` and `레이서스 파라다이스` qualify and `national register`, `formative phrases` and
+// Arabic); a token that is entirely lower-case Latin is prose. So `Driver's Haven`, `HAVEN WORLD`,
+// `Вензи` and `드라이버스 헤이븐` qualify and `national register`, `formative phrases` and
 // `one-swap lead-noun neighbours` do not. A property, not a list of banned words — a description nobody
 // anticipated still fails it.
 function looksLikeName(s) {
   const tokens = String(s).split(/\s+/).filter((t) => /\p{L}/u.test(t));
   if (!tokens.length || tokens.length > 5) return false;
   // A lone two-letter capital is a language or jurisdiction code (ZH, DE, JP), never a mark. Caseless
-  // scripts are exempt from the length floor — 天堂 is a whole word in two characters.
+  // scripts are exempt from the length floor — 港湾 is a whole word in two characters.
   const cased = tokens.filter((t) => /\p{Lu}|\p{Ll}/u.test(t));
   if (cased.length && cased.every((t) => t.replace(/[^\p{L}]/gu, "").length <= 2)) return false;
   return tokens.every((t) => !/^\p{Ll}/u.test(t.replace(/^[^\p{L}\p{N}]+/u, "")));
@@ -361,7 +361,7 @@ function extractTerm(raw) {
 const asClasses = (nums) => [...new Set(nums.map(Number).filter((n) => Number.isInteger(n) && n >= 1 && n <= 45))];
 
 // In a SEARCH TERM, classes are read only where they are LABELLED ("cl 9/28/41/42", "cl.25", "class 35") —
-// never from a bare parenthesised number, which in this corpus is a record COUNT ("PARADISE (424)").
+// never from a bare parenthesised number, which in this corpus is a record COUNT ("HAVEN (424)").
 function extractClasses(s) {
   const m = String(s ?? "").match(/\bcl(?:ass(?:es)?)?\.?\s*([\d]{1,2}(?:\s*[/,]\s*\d{1,2})*)/i);
   return m ? asClasses(m[1].split(/[/,]/)) : [];

package/mcp-server/lib/knockout.mjs

@@ -388,7 +388,7 @@ export function traceKnockout(run, target, events = []) {
     kind: "verdict",
     verdict: doc?.batch?.overall ?? runVerdictFromEvents(events) ?? null,
     marks: marksOf(doc).map((m) => ({ mark: m.name, band: m.rating ?? null, basis: m.basis ?? null })),
-    note: "A Knockout verdict is the batch's worst band across its marks; each mark's own band and the "
+    note: "A Knockout verdict is the highest rating across the batch's marks; each mark's own rating and the "
       + "one-sentence ground for it are listed here.",
   });
 

package/mcp-server/lib/runs.mjs

@@ -58,7 +58,13 @@ export function tierFromRecord(runDir) {
   } catch { return null; }
 }
 
-export function unreadableRunsReason({ workSet, workRoot, workExists, poolSet }) {
+export function unreadableRunsReason({ workSet, workRoot, workExists, poolSet, workReadError = null }) {
+  // A work folder that was named and is not there, or cannot be read, is said, never listed as empty.
+  if (workSet && workReadError) {
+    return `no searches can be read here: CLEAROTRON_WORK_DIR is ${workRoot}, which `
+      + (workReadError === "ENOENT" ? "does not exist. " : `cannot be read (${workReadError}). `)
+      + "`npx clearotron doctor` prints where an install keeps them.";
+  }
   if (workSet || workExists || poolSet) return null;
   return `no searches can be read here: CLEAROTRON_WORK_DIR is unset and ${workRoot} does not exist, `
     + "and CLEAROTRON_REPORTS_DIR is unset. Set them to the install's directories — `npx clearotron doctor` "

package/mcp-server/lib/scrub.mjs

@@ -158,7 +158,7 @@ export function scrubMarkdown(text) {
 // at least announced itself as internal.
 //
 // The ruling needed no new product decision, because the product had already made it:
-// `publish/report-data.mjs:74` (`const live`) filters to live findings, "a withdrawn finding renders nowhere — it does
+// clearanceReportData() in report-data.mjs (`const live`) filters to live findings, "a withdrawn finding renders nowhere — it does
 // not exist here either". Two client surfaces, one question, two answers. So the block is DROPPED, and
 // the two agree by construction rather than key by key — which is the thing asked not to repeat.
 //

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.4.0",
+  "version": "0.4.1-beta.1",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",
@@ -13,7 +13,7 @@
     "test:full": "npm run test"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
     "jose": "^6.2.3"
   },
   "engines": {

package/mcp-server/packs/README.md

@@ -37,7 +37,7 @@ saying the same thing.
 
 The `SKILL.md` (and for ops, `COURIER.md`) is portable prompt text: paste it into Claude project
 instructions, a ChatGPT GPT/system prompt, or any agent's system context — or, in Claude Code, install
-the whole thing at once by opening this repository as a plugin (`.claude-plugin/plugin.json`).
+the whole thing at once as the plugin in `plugin/`, which carries copies of the three skills.
 `CONNECT.md` is for the human doing the wiring. `manifest.json` names the pack version, the files that
 stayed here, and the `skill.directory` its prompt text moved to, so an integrator can pin + diff
 upgrades.

package/mcp-server/server.mjs

@@ -26,13 +26,14 @@ import {
   ListResourcesRequestSchema, ReadResourceRequestSchema, ListResourceTemplatesRequestSchema,
   ListPromptsRequestSchema, GetPromptRequestSchema,
 } from "@modelcontextprotocol/sdk/types.js";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join, basename } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
 import { fileURLToPath } from "node:url";
 
 import { enumerateRuns, resolveRun, runAccountKey, runOrganisation, runProfileFacts, productIdentityFor, unreadableRunsReason } from "./lib/runs.mjs";
 import { ORDERABLE_PRODUCTS } from "../driver/search-policy.mjs";
+import { demoMode } from "./demo-mode.mjs";
 import { PRODUCTS } from "../driver/products.mjs";
 
 // The offering writes its own schema prose. A hand-typed "up to 20 names" beside a wall that refuses at
@@ -178,6 +179,17 @@ function getStages(runDir) {
   return { stages, failover };
 }
 
+// THE DEMO SAYS IT IS THE DEMO, on every row, in the demo's own two sentences (bin/example.mjs prints both
+// before anything else). `clearotron mcp` serves the demo's sample runs where a machine has no install,
+// and an assistant reading a row must not take a sample for one of the person's own searches.
+export const DEMO_LABEL = "Real engine output for the fictional mark VENQORI, captured against Clarivate Compumark. "
+  + "It is an example, not advice.";
+
+/** The code a folder's read fails with, or null where it reads. */
+function readError(dir) {
+  try { readdirSync(dir); return null; } catch (e) { return e?.code ?? "unreadable"; }
+}
+
 function runSummary(run) {
   const s = run.status ?? {};
   // WHO THE SEARCH WAS FOR, on every row. A session that holds several clients was handed eight rows
@@ -188,6 +200,7 @@ function runSummary(run) {
   // field is what made the list unanswerable in the first place.
   const facts = runProfileFacts(run);
   return {
+    ...(demoMode.on ? { demo: DEMO_LABEL } : {}),
     runId: run.runId, slug: run.slug, codename: run.codename, date: run.date, agent: run.agent,
     client: facts.known
       ? { key: facts.account, name: facts.clientName }
@@ -272,6 +285,7 @@ const tools = {
     const unreadable = unreadableRunsReason({
       workSet: !!config.envValue("CLEAROTRON_WORK_DIR"), workRoot: config.workspaceRoot,
       workExists: existsSync(config.workspaceRoot), poolSet: !!config.poolRootOrNull,
+      workReadError: readError(config.workspaceRoot),
     });
     if (unreadable) throw new Error(unreadable);
     let out = enumerateRuns({ agent, state, slug, mark }).map(runSummary);
@@ -1102,7 +1116,7 @@ export function makeServer({ scope = null, local = null, readonly = false } = {}
   // pack was previously a file no connecting client ever saw. Guidance only; never a substitute for the
   // authorize()/scrub gates. Staff and ops get no instructions (see lib/instructions.mjs).
   const server = new Server(
-    { name: NS, version: "0.1.0" },
+    { name: NS, version: productIdentity().version ?? "unknown" },   // the package's own version, the one server_info reports
     // `prompts` is declared for every kind; promptsFor() returns [] for the audiences that get none, so
     // an ops client sees an empty list rather than a protocol error on a capability we did not announce.
     { capabilities: { tools: {}, resources: {}, prompts: {} }, instructions: instructionsFor(eff) },

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "clearotron",
+  "mcpName": "io.github.CordilleraSarl/clearotron",
   "type": "module",
-  "version": "0.4.0",
+  "version": "0.4.1-beta.1",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",
@@ -58,7 +59,7 @@
     "sync:uspto": "node bin/uspto-sync.mjs",
     "bench:uspto": "node providers/uspto-local/bench/bench.mjs",
     "verify:uspto": "node providers/uspto-local/bin/verify-index.mjs",
-    "lint:driver": "eslint --no-error-on-unmatched-pattern --max-warnings 0 --config eslint.driver.config.mjs \"driver/**/*.mjs\" \"bin/**/*.mjs\" \"shared/**/*.mjs\" \"mcp-server/**/*.mjs\" \"scripts/**/*.mjs\" \"cut/**/*.mjs\"",
+    "lint:driver": "eslint --no-error-on-unmatched-pattern --max-warnings 0 --config eslint.driver.config.mjs \"driver/**/*.mjs\" \"bin/**/*.mjs\" \"shared/**/*.mjs\" \"mcp-server/**/*.mjs\" \"scripts/**/*.mjs\" \"cut/**/*.mjs\" \"plugin/**/*.mjs\"",
     "doctrine-report": "node scripts/doctrine-report.mjs",
     "notices": "node scripts/third-party-notices.mjs",
     "notices:check": "node scripts/third-party-notices.mjs --check",
@@ -73,7 +74,7 @@
     "globals": "^17.11.0"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
     "buffers": "file:vendor/buffers",
     "exceljs": "^4.4.0",
     "jose": "^6.2.3",

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.4.0",
+  "version": "0.4.1-beta.1",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {
@@ -22,8 +22,8 @@
   "devDependencies": {
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
-    "@vitejs/plugin-react": "^6.1.1",
+    "@vitejs/plugin-react": "^6.1.2",
     "typescript": "^7.0.2",
-    "vite": "^8.3.1"
+    "vite": "^8.3.3"
   }
 }

package/providers/_shared/count.mjs

@@ -47,6 +47,7 @@
 
 import { guardCountCall, guardToolCall } from "./transport-guard.mjs";
 import { clipProviderText } from "./provider-text.mjs";   // — keep the discriminator
+import { floorOf } from "../../shared/register-floor.mjs";
 
 export const parseToolText = (r) => { try { return JSON.parse(r?.text ?? ""); } catch { return null; } };
 export const isToolError = (r) => !!(r?.isError) || (typeof r?.text === "string" && r.text.startsWith("ERROR"));
@@ -109,9 +110,15 @@ export function makeCountProbe(deps) {
     // ("a provider that cannot count must never read as zero") broken from the inside, by its own
     // comment. The number now has to BE a number; nothing else is an answer.
     if (!Number.isFinite(parsed.total_hits)) {
-      return { ok: false, total: null, probe: "cheap",
+      // A register's floor ("at least 10,000") is still no count, so the probe stays not-ok; the figure
+      // rides beside it for a caller that can carry one (enumerate.mjs's rescues: a crowd, never an error).
+      const floor = floorOf(parsed);
+      return { ok: false, total: null, probe: "cheap", ...(floor !== null ? { floor } : {}),
         reason: "the search response carried no usable total_hits, so nothing was counted — the number is UNKNOWN, which is not the same as none" };
     }
-    return { ok: true, total: parsed.total_hits, probe: "cheap", reason: null };
+    // What the total counts rides with it when the register said (a provider's `total_counts`, see
+    // enumerate.mjs): a per-class or per-spelling count keeps the register's number and says so.
+    return { ok: true, total: parsed.total_hits, probe: "cheap", reason: null,
+      ...(typeof parsed.total_counts === "string" ? { total_counts: parsed.total_counts } : {}) };
   };
 }