clearotron 0.4.1-beta.0 → 0.4.1-beta.2

package/driver/stages.mjs

@@ -1206,7 +1206,7 @@ export const VARIANT_CATEGORY_BRIEF =
 // on an element a move was supposed to discharge is indistinguishable from a relabel.
 //
 // `tokens` lists the validator failure tokens that SPEAK ABOUT that element. PER STAGE, never global:
-// `too_short` and `missing` come from the shared nonEmpty()/needs() helpers (verify.mjs:123-133) and are
+// `too_short` and `missing` come from the shared helpers nonEmpty() and needs() in verify.mjs, and are
 // legitimately owned by DIFFERENT elements in matter-frame, clearance-variants and frame-diff. A global
 // token→element map sees several owners for one token and "fixes" a partition that was never violated.
 //
@@ -1287,7 +1287,7 @@ export const STAGES = {
       },
       "Applicant's own & affiliated marks — the self-exclusion set (mandatory)": {
         class: "judgment", tokens: [],
-        why: "naming affiliates beyond the seed is judgment; the profile half is already pre-bound — stages.mjs:844 hands the model exclusionSeed verbatim and _driver/instructed-scope.json carries job.customer [citation unverified]",
+        why: "naming affiliates beyond the seed is judgment; the profile half is already pre-bound — this stage's `message` hands the model exclusionSeed verbatim and _driver/instructed-scope.json carries job.customer",
       },
       "Campaign shape (stated) — the intake's campaign facts retyped from the `Stated campaign shape` line the dispatch already carries": {
         class: "mechanical:code-rendered", tokens: [],
@@ -1436,7 +1436,7 @@ export const STAGES = {
       },
       "mark — \"<the mark verbatim>\"": {
         class: "mechanical:pre-bound", tokens: ["variantmodel_mark_missing"],
-        why: "_driver/instructed-scope.json.marks holds it and stage-context.mjs:175 TOOL_GROUP_EDGES binds that file to this stage. variant-manifest-model.mjs:225-231 parseVariantManifestModel already concedes the field is not the model's: it is excluded from the term-shape gate because \"the stage is told to emit it VERBATIM, and it arrives from the job… a value this stage CANNOT restate\" [citation unverified]",
+        why: "_driver/instructed-scope.json.marks holds it and VALIDATOR_SIDECARS declared in stage-context.mjs binds that file to this stage. variantTermShapeGaps() in variant-manifest-model.mjs already concedes the field is not the model's: it is excluded from the term-shape gate because \"the stage is told to emit it VERBATIM, and it arrives from the job… a value this stage CANNOT restate\"",
       },
       "dominant_element — the distinctive anchor the sweep enumerates": {
         class: "judgment", tokens: ["variantmodel_dominant_element_missing"],
@@ -1456,7 +1456,7 @@ export const STAGES = {
       },
       "variants[].value — the search terms themselves": {
         class: "judgment", tokens: ["variantmodel_term_markup"],
-        why: "the repo forbids code from minting a search term twice over — stages.mjs:771-773 and variant-manifest-model.mjs:387 (\"VALIDATES, NEVER GENERATES… the moment code mints a search term, judgment has moved into the funnel\"). variantmodel_term_markup is therefore a shape rule that stays model-facing BY DESIGN; do not reclassify it mechanical to satisfy E6. It also walks dominant_element and elements[].value (variantTermShapeGaps), which is why they carry no token of their own [citation unverified]",
+        why: "the repo forbids code from minting a search term twice over — scriptFloorDirective() in stages.mjs and variantCompletenessGaps() in variant-manifest-model.mjs (\"VALIDATES, NEVER GENERATES… the moment code mints a search term, judgment has moved into the funnel\"). variantmodel_term_markup is therefore a shape rule that stays model-facing BY DESIGN; do not reclassify it mechanical to satisfy E6. It also walks dominant_element and elements[].value (variantTermShapeGaps), which is why they carry no token of their own",
       },
       "variants[].category — one of core|phonetic|visual|transliteration|numeric|composite|other": {
         class: "judgment", tokens: [],
@@ -1472,7 +1472,7 @@ export const STAGES = {
       },
       "Family completeness — at minimum one core, one phonetic and one visual variant, plus a transliteration variant when the mark, the dominant element or any elements[] value is non-Latin": {
         class: "judgment", tokens: ["variantmodel_family_incomplete", "variantmodel_variants_empty"],
-        why: "structural completeness of the family the plan compiles from; code refuses but must never mint the missing member (variant-manifest-model.mjs:387). variantmodel_family_incomplete carries THREE arms — category:<cat>, script:<term> and script-coverage:<script>:<territories> — and owns all three here, including the per-script arm declared below [citation unverified]",
+        why: "structural completeness of the family the plan compiles from; code refuses but must never mint the missing member (variantCompletenessGaps() in variant-manifest-model.mjs). variantmodel_family_incomplete carries THREE arms — category:<cat>, script:<term> and script-coverage:<script>:<territories> — and owns all three here, including the per-script arm declared below",
       },
       "Per-script coverage — at least one rendering of the mark in each script the in-scope territories register marks in, as a transliteration variant carrying its romanization": {
         class: "judgment", tokens: [],
@@ -1516,7 +1516,7 @@ export const STAGES = {
       },
       "### Scope ledger rows — {Layer, Item, Status: applied|dropped, Reason, Reopen trigger} across variant / field / source / jurisdiction": {
         class: "judgment", tokens: [],
-        why: "defending an omission with the concrete observation that should reopen it is the whole judgment, and frame-diff diffs it against the blind re-derivation. The ROW SHAPE is mechanical — scope-ledger.mjs:123-126 renderScopeLedgerJson parses the table into scope-ledger.json — and the jurisdiction rows are largely a re-carry of the matter frame's own Scope-jurisdictions line [citation unverified]",
+        why: "defending an omission with the concrete observation that should reopen it is the whole judgment, and frame-diff diffs it against the blind re-derivation. The ROW SHAPE is mechanical — renderScopeLedgerJson() in scope-ledger.mjs parses the table into scope-ledger.json — and the jurisdiction rows are largely a re-carry of the matter frame's own Scope-jurisdictions line",
       },
       "Prose variant-table category token — translit-<script>, and for Chinese translit-zh-meaning vs translit-zh-phonetic": {
         class: "judgment", tokens: [],
@@ -1531,7 +1531,7 @@ export const STAGES = {
       },
       "Per-jurisdiction sub-queries": {
         class: "judgment", tokens: [],
-        why: "a per-territory search decision no artifact holds — the dispatch names the deliverable and no file the model reads says what one looks like. coverage-ledger.mjs:139-140 shows a downstream consumer that expects them (\"the per-jurisdiction sub-query belongs to primary-sweep\") [citation unverified]",
+        why: "a per-territory search decision no artifact holds — the dispatch names the deliverable and no file the model reads says what one looks like. normalizeAxis() in coverage-ledger.mjs shows a downstream consumer that expects them (\"the per-jurisdiction sub-query belongs to primary-sweep\")",
       },
       "Verify? ✅ column on every transliteration row of the prose Variants table": {
         class: "mechanical:code-rendered", tokens: [],
@@ -1807,7 +1807,7 @@ export const STAGES = {
       },
       "PR / reputational section — the readings the meaning sweep surfaced, per form, each labelled benign or loaded": {
         class: "judgment", tokens: ["connotation_search_missing"],
-        why: "The semantic read of a surfaced passage is the model's. `connotation_search_missing` (verify.mjs:362) fires when the ledger recorded no meaning query at all. [citation unverified]",
+        why: "The semantic read of a surfaced passage is the model's. `connotation_search_missing` (commonLawEvidence() in verify.mjs) fires when the ledger recorded no meaning query at all.",
       },
       "`Connotation-search source: <URL | \"perplexity_research — no result\">` line on a clean PR row": {
         class: "mechanical:code-extracted", tokens: ["connotation_search_missing"],
@@ -1970,7 +1970,7 @@ export const STAGES = {
       },
       "disposition form `note` — one line saying what the receipt says and why it reads that way": {
         class: "judgment", tokens: ["connotation_no_ruling"],
-        why: "#850 keeps it. The empty-note state lands in the `no_ruling` residual (connotation-search.mjs:2129-2133). [citation unverified]",
+        why: "#850 keeps it. The empty-note state lands in the `no_ruling` residual (findConnotationViolations() in connotation-search.mjs).",
       },
       "disposition form `receipt_index` — the 1-based POSITION of the candidate you ruled on, in that row's own list": {
         class: "mechanical:pre-bound", tokens: ["connotation_form_damaged", "connotation_cite_absent"],
@@ -2102,7 +2102,7 @@ export const STAGES = {
     contractElements: {
       "execute the frozen plan — ONE register_execute_plan call with {plan_path, axis, output_path}": {
         class: "mechanical:tool-written", tokens: ["named_band_missing", "tool_timeout"],
-        why: "All three args are driver values interpolated into the message; the tool writes every band block. #850 calls this already right. Note #793: `named_band_missing` and `tool_timeout` are one evidence state with two causes, and registerPlanCallKilled (verify.mjs:1291) separates them from the call log, not from the model. [citation unverified]",
+        why: "All three args are driver values interpolated into the message; the tool writes every band block. #850 calls this already right. Note #793: `named_band_missing` and `tool_timeout` are one evidence state with two causes, and registerPlanCallKilled() in tool-calls.mjs separates them from the call log, not from the model.",
       },
       "the dictated entry list — qid, predicate, terms, owner, nice_classes, regions, when-guard, expected_kind, covered_by": {
         class: "mechanical:pre-bound", tokens: [],
@@ -2126,11 +2126,11 @@ export const STAGES = {
       },
       "named-band block envelope — {state: enumerated|incomplete, query, total_hits, records|fetched+sample+reason}": {
         class: "mechanical:tool-written", tokens: ["named_band_unparseable", "named_band_block_invalid", "named_band_state_invalid", "band_block_unplanned", "named_band_invalid"],
-        why: "#850: M (envelope), tool-written blocks. `band_block_unplanned` (verify.mjs:1297) is the backstop that kills a hand-authored qid-less block — a token that exists only because the legacy lane still offers the duty in the same message. [citation unverified]",
+        why: "#850: M (envelope), tool-written blocks. `band_block_unplanned` (validators.registerUnit in verify.mjs) is the backstop that kills a hand-authored qid-less block — a token that exists only because the legacy lane still offers the duty in the same message.",
       },
       "enumerated block records carried verbatim — record_id, mark_text, classes, status, owner_name, owner_country, application_date, registration_date, expiry_date, jurisdictions, screen_verdict": {
         class: "mechanical:tool-written", tokens: ["named_band_collapsed"],
-        why: "register_enumerate already returns each record batch-screened; carrying it is transcription. `named_band_collapsed` (verify.mjs:1325, findCollapsedBands) is exactly the recall loss that transcription produces — a slice claiming total_hits with zero records reaching the band. [citation unverified]",
+        why: "register_enumerate already returns each record batch-screened; carrying it is transcription. `named_band_collapsed` (validators.registerUnit in verify.mjs, findCollapsedBands) is exactly the recall loss that transcription produces — a slice claiming total_hits with zero records reaching the band.",
       },
       "per-axis prose digest — the SHORT AUDIT NOTE at register-units/<axis>.md": {
         class: "judgment", tokens: ["too_short"],
@@ -2142,7 +2142,7 @@ export const STAGES = {
       },
       "axis applicability — decide the axis has no work in this manifest and write a one-line \"not applicable\" band block": {
         class: "judgment", tokens: ["band_block_unplanned"],
-        why: "The applicability call is the model's; the block is not. Under the supplemental lane a seat obeying unit.md:89-91 writes exactly the qid-less block verify.mjs:1297 kills. The skill file and the stage message contradict each other on the one path the skill offers for an empty axis. [citation unverified]",
+        why: "The applicability call is the model's; the block is not. Under the supplemental lane a seat obeying unit.md's \"not applicable\" rule ('write a single block … so the file always lands') writes exactly the qid-less block validators.registerUnit in verify.mjs kills. The skill file and the stage message contradict each other on the one path the skill offers for an empty axis.",
       },
       "reading the band back and judging it — keep proposing until the axis's dangerous named band is covered": {
         class: "judgment", tokens: [],
@@ -2150,7 +2150,7 @@ export const STAGES = {
       },
       "layer-execution declaration — whether the prose says the register layer / provider tools were not executed or not bound": {
         class: "mechanical:code-extracted", tokens: ["declared_not_executed"],
-        why: "_driver/plan-execution.json and the tool-call log already hold whether the call ran — registerPlanCallKilled (verify.mjs:1291) reads exactly that to settle the same question one arm below. This arm still decides it from the model's sentence. [citation unverified]",
+        why: "_driver/plan-execution.json and the tool-call log already hold whether the call ran — registerPlanCallKilled() in tool-calls.mjs reads exactly that to settle the same question one arm below. This arm still decides it from the model's sentence.",
       },
       "`CROSS-CHECK REQUIRED: <what> — <why>` — the check that is needed and why": {
         class: "judgment", tokens: [],
@@ -2364,7 +2364,7 @@ export const STAGES = {
       },
       "reason — the short paragraph carrying the stated ground for the tier (owner characterisation, customer/channel read, decisive ground, Stage-2 mitigant)": {
         class: "judgment", tokens: ["placement_reason_missing", "placement_reason_bare"],
-        why: "Four downstream stages adopt or counter-reason BY ARGUING WITH THIS TEXT (stages.mjs:2485-2489). It is authored reasoning, not a value any artifact holds. [citation unverified]",
+        why: "Four downstream stages adopt or counter-reason BY ARGUING WITH THIS TEXT (the B2 comment in this stage's `message` says so). It is authored reasoning, not a value any artifact holds.",
       },
       "borderline: true — the declaration that the promotion question could be argued either way on this record": {
         class: "judgment", tokens: ["placement_borderline_invalid"],
@@ -2372,7 +2372,7 @@ export const STAGES = {
       },
       "select — one record URI of the register candidate being placed": {
         class: "mechanical:code-extracted", tokens: [],
-        why: "buildSelectionIndex() in placement-form.mjs already holds every selectable record, built from _driver/register-positions.json plus the band shape's floors, and resolves any URI of a family to the canonical row. #850 M1: the model should return the 1-based index into that driver-written list; code resolves index→id. WHICH candidate to place stays judgment — the row existing at all is the judgment; only the pointing token is mechanical. NO VALIDATOR TOKEN speaks about it: an unresolved select is recorded on the form as `unresolved[]` (placement-union.mjs:134 pushSelection) and handed back in the next dispatch, never a fail. [citation unverified]",
+        why: "buildSelectionIndex() in placement-form.mjs already holds every selectable record, built from _driver/register-positions.json plus the band shape's floors, and resolves any URI of a family to the canonical row. #850 M1: the model should return the 1-based index into that driver-written list; code resolves index→id. WHICH candidate to place stays judgment — the row existing at all is the judgment; only the pointing token is mechanical. NO VALIDATOR TOKEN speaks about it: an unresolved select is recorded on the form as `unresolved[]` (pushSelection() in placement-union.mjs) and handed back in the next dispatch, never a fail.",
       },
       "seat rows for candidates the register does not hold — mark / owner / jurisdiction / records: [] written in full": {
         class: "judgment", tokens: ["placement_mark_missing", "placement_owner_missing", "placement_jurisdiction_invalid", "placement_records_invalid"],
@@ -2404,7 +2404,7 @@ export const STAGES = {
       },
       "retract: <row_id> — withdrawing a seat row already on the form": {
         class: "judgment", tokens: [],
-        why: "Whether a placed candidate should come off is a call only the model makes. The row_id it names is driver-assigned (shortId 'PS'/'PR', placement-form.mjs:205 renderEntry/273), so the HANDLE is code-assigned even though the act is judgment. [citation unverified]",
+        why: "Whether a placed candidate should come off is a call only the model makes. The row_id it names is driver-assigned (shortId 'PS'/'PR', in seatRows() and buildSelectionIndex() in placement-form.mjs), so the HANDLE is code-assigned even though the act is judgment.",
       },
       "return payload — the absolute output path plus a 2-3 line summary": {
         class: "mechanical:pre-bound", tokens: [],
@@ -2490,7 +2490,7 @@ export const STAGES = {
       },
       "seat-added coverage rows — the decision to add one, and the axis it is filed under (expressed in the `unit` label)": {
         class: "judgment", tokens: ["coverage_form_axis_invalid"],
-        why: "The shipped code rules it judgment in its own words: 'THE AXIS IS PART OF THE JUDGMENT, and on a SEAT row it is the one identifier the seat still supplies' and normalizeAxis 'repair[s] formatting, never invent[s] an axis' (coverage-form.mjs:519-524 coverageFormRows). The driver cannot know which axis a coverage unit it never planned belongs under. [citation unverified]",
+        why: "The shipped code rules it judgment in its own words: 'THE AXIS IS PART OF THE JUDGMENT, and on a SEAT row it is the one identifier the seat still supplies' and normalizeAxis 'repair[s] formatting, never invent[s] an axis' (rowIsSettled() in coverage-form.mjs). The driver cannot know which axis a coverage unit it never planned belongs under.",
       },
       "the seat row's duplicate `axis` cell (the same token already typed as the leading segment of `unit`)": {
         class: "mechanical:code-extracted", tokens: ["coverage_form_axis_invalid"],
@@ -2703,11 +2703,11 @@ export const STAGES = {
       },
       "the escalation decision — which register axes carry a material, unresolved, genuinely closeable gap, and the one-line reason for each": {
         class: "judgment", tokens: [],
-        why: "Whether a documented coverage-limited row, a capability-gap deferral or a fresh concern on a confirmed-clean row warrants spending a re-run. The driver hands the coverage/execution truth in as a computed table (stages.mjs:1479; skepticDeferralExtra) precisely so this is a call over data rather than a re-derivation — but the call itself is nobody else's. [citation unverified]",
+        why: "Whether a documented coverage-limited row, a capability-gap deferral or a fresh concern on a confirmed-clean row warrants spending a re-run. The driver hands the coverage/execution truth in as a computed table (skepticDeferralExtra() in pipeline.mjs) precisely so this is a call over data rather than a re-derivation — but the call itself is nobody else's.",
       },
       "escalation decisions — one {axis, reason} per axis that must be re-run, sent through record_skeptic": {
         class: "mechanical:code-rendered", tokens: [],
-        why: "#850 rules the line shape M: typed rows, code renders. The axis is one of the closed list the driver wrote into the same message (`Valid axes: ${axes}`, stages.mjs:2628), and the parse at skeptic-record.mjs:49-53 recognises only /ESCALATE:\\s*<axis>\\b/i per known axis — the em-dash, the reason, the section title and the literal 'none' are parsed by nothing. NO TOKEN: skepticFlags never inspects these lines, so a malformed ESCALATE line is a silent no-escalation, not a failure. [citation unverified]",
+        why: "#850 rules the line shape M: typed rows, code renders. The axis is one of the closed list the driver wrote into the same message (`Valid axes: ${axes}`), and the parse in escalatedAxes() in skeptic-record.mjs recognises only /ESCALATE:\\s*<axis>\\b/i per known axis — the em-dash, the reason, the section title and the literal 'none' are parsed by nothing. NO TOKEN: skepticFlags never inspects these lines, so a malformed ESCALATE line is a silent no-escalation, not a failure.",
       },
       "the verbatim ESCALATE string dictated for a `translit-too-generic` unit digest": {
         class: "mechanical:code-rendered", tokens: [],
@@ -2715,7 +2715,7 @@ export const STAGES = {
       },
       "the `risk: <category>` field inside that dictated ESCALATE line": {
         class: "mechanical:code-rendered", tokens: [],
-        why: "IT HAS NO CONSUMER AT ALL. stages.mjs:333-336 records that the risk-category filter was deleted, and pipeline.mjs states 'spec-48 D3 — the escalation-risk SHADOW loop (risk-tag parse + would-skip telemetry for the never-enabled CLEAROTRON_ESCALATION_FILTER) is DELETED' at the parse site (envelopeDecision() in pipeline.mjs). The doc block at envelopeDecision() in pipeline.mjs that describes reading the field is a stale header left standing over envelopeDecision — the function it documented is gone. Classed code-rendered because it is not judgment; the correct move is deletion from the skill file. [citation unverified]",
+        why: "IT HAS NO CONSUMER AT ALL. The D3 note in stages.mjs (\"the escalation-risk SHADOW apparatus … is DELETED\") records that the risk-category filter was deleted, and pipeline.mjs states 'spec-48 D3 — the escalation-risk SHADOW loop (risk-tag parse + would-skip telemetry for the never-enabled CLEAROTRON_ESCALATION_FILTER) is DELETED' at the parse site (envelopeDecision() in pipeline.mjs). The doc block at envelopeDecision() in pipeline.mjs that describes reading the field is a stale header left standing over envelopeDecision — the function it documented is gone. Classed code-rendered because it is not judgment; the correct move is deletion from the skill file.",
       },
       "return payload — a 2-3 line summary; the audit itself rides record_skeptic": {
         class: "mechanical:tool-written", tokens: ["skeptic_"],
@@ -3707,7 +3707,7 @@ export const STAGES = {
       },
       "actions.checks_we_ran[].source_link (the `([source](<url>))` URL in each bullet)": {
         class: "mechanical:code-rendered", tokens: [],
-        why: "A URL the run already fetched, retyped by hand: the same 127-URI transcription class #850 rules M for synthesis. findings.json carries the typed source.resolved_link (findings-model.mjs:616, render.mjs:1858 fullDetail) and the coverage rows carry theirs; code can render the link once the model names the check. [citation unverified]",
+        why: "A URL the run already fetched, retyped by hand: the same 127-URI transcription class #850 rules M for synthesis. findings.json carries the typed source.resolved_link (validateSource() in findings-model.mjs, fullDetail() in render.mjs) and the coverage rows carry theirs; code can render the link once the model names the check.",
       },
       // RETIRED BY CONVERSION 4 — `actions.only_you_can_close_these[]`. buildOnlyYouSection already
       // replaced any authored section wholesale, so this row described an ask the driver overwrote. The
@@ -3724,7 +3724,7 @@ export const STAGES = {
       },
       "lint_contracts.withdrawn_findings_excluded (a withdrawn finding 'DOES NOT EXIST for this report')": {
         class: "mechanical:pre-bound", tokens: [],
-        why: "`withdrawn` is a typed disposition (findings-model.mjs:61 DISPOSITIONS) and fullProseOrdinals already filters it (fullProseOrdinals in pipeline.mjs). The driver can hand a filtered findings view instead of handing the whole file plus a prohibition. [citation unverified]",
+        why: "`withdrawn` is a typed disposition (DISPOSITIONS declared in findings-model.mjs) and fullProseOrdinals already filters it (fullProseOrdinals in pipeline.mjs). The driver can hand a filtered findings view instead of handing the whole file plus a prohibition.",
       },
       // RETIRED BY CONVERSION 4 — the `::p::` MARKER. Which note is internal is still the model's call
       // and rides `internal: true` on the entry; the marker itself is a rendering instruction the driver

package/driver/suite-census.json

@@ -52,8 +52,8 @@
           "todos": 0
         },
         "a-batch-of-names-is-one-question-per-name-without-or.test.mjs": {
-          "tests": 4,
-          "asserts": 20,
+          "tests": 6,
+          "asserts": 28,
           "skips": 0,
           "todos": 0
         },
@@ -195,9 +195,15 @@
           "skips": 0,
           "todos": 0
         },
+        "a-clean-knockout-hands-the-reviewer-its-first-read-lines.test.mjs": {
+          "tests": 6,
+          "asserts": 25,
+          "skips": 0,
+          "todos": 0
+        },
         "a-client-cell-carries-no-raw-engine-words.test.mjs": {
-          "tests": 4,
-          "asserts": 13,
+          "tests": 5,
+          "asserts": 18,
           "skips": 0,
           "todos": 0
         },
@@ -532,8 +538,8 @@
           "todos": 0
         },
         "a-failed-run-resumes-from-the-command-line.test.mjs": {
-          "tests": 3,
-          "asserts": 9,
+          "tests": 4,
+          "asserts": 14,
           "skips": 0,
           "todos": 0
         },
@@ -579,6 +585,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-foreign-record-link-is-named-once-and-blanked-at-salvage.test.mjs": {
+          "tests": 8,
+          "asserts": 31,
+          "skips": 0,
+          "todos": 0
+        },
         "a-frame-call-with-places-per-name-passes-the-gate.test.mjs": {
           "tests": 2,
           "asserts": 7,
@@ -664,8 +676,8 @@
           "todos": 0
         },
         "a-job-on-the-older-goods-spelling-scopes-the-same.test.mjs": {
-          "tests": 10,
-          "asserts": 23,
+          "tests": 11,
+          "asserts": 28,
           "skips": 0,
           "todos": 0
         },
@@ -765,6 +777,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-late-synthesis-save-keeps-the-seams-writes.test.mjs": {
+          "tests": 2,
+          "asserts": 16,
+          "skips": 0,
+          "todos": 0
+        },
         "a-link-in-the-workbook-is-not-banned-vocabulary.test.mjs": {
           "tests": 2,
           "asserts": 5,
@@ -1173,6 +1191,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-register-floor-is-carried-and-never-a-zero.test.mjs": {
+          "tests": 7,
+          "asserts": 19,
+          "skips": 0,
+          "todos": 0
+        },
         "a-register-manual-states-what-its-provider-declares.test.mjs": {
           "tests": 6,
           "asserts": 13,
@@ -1314,7 +1338,7 @@
         "a-screenshot-of-an-error-page-is-not-a-report.test.mjs": {
           "tests": 21,
           "asserts": 55,
-          "skips": 4,
+          "skips": 5,
           "todos": 0
         },
         "a-script-is-asked-once-per-market-that-files-in-it.test.mjs": {
@@ -1360,8 +1384,8 @@
           "todos": 0
         },
         "a-session-the-classifier-cut-is-not-recorded-as-clean.test.mjs": {
-          "tests": 12,
-          "asserts": 77,
+          "tests": 13,
+          "asserts": 80,
           "skips": 0,
           "todos": 0
         },
@@ -1419,6 +1443,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-stable-cut-moves-the-plugin-pin.test.mjs": {
+          "tests": 4,
+          "asserts": 13,
+          "skips": 0,
+          "todos": 0
+        },
         "a-stable-is-published-only-over-a-clean-code-scan.test.mjs": {
           "tests": 9,
           "asserts": 19,
@@ -1829,7 +1859,7 @@
         },
         "an-exact-spelling-band-stacks-at-the-register-s-exact-width.test.mjs": {
           "tests": 3,
-          "asserts": 7,
+          "asserts": 11,
           "skips": 0,
           "todos": 0
         },
@@ -2068,8 +2098,8 @@
           "todos": 0
         },
         "both-doors-start-on-both-paths.test.mjs": {
-          "tests": 26,
-          "asserts": 61,
+          "tests": 27,
+          "asserts": 64,
           "skips": 0,
           "todos": 0
         },
@@ -2130,7 +2160,7 @@
         "case-law-credential-state.test.mjs": {
           "tests": 8,
           "asserts": 26,
-          "skips": 0,
+          "skips": 1,
           "todos": 0
         },
         "case-law-join.test.mjs": {
@@ -2519,7 +2549,7 @@
         },
         "coverage-judgment-rows.test.mjs": {
           "tests": 9,
-          "asserts": 40,
+          "asserts": 45,
           "skips": 0,
           "todos": 0
         },
@@ -2578,8 +2608,8 @@
           "todos": 0
         },
         "declination-is-stated-not-inferred.test.mjs": {
-          "tests": 24,
-          "asserts": 69,
+          "tests": 25,
+          "asserts": 73,
           "skips": 0,
           "todos": 0
         },
@@ -2991,6 +3021,12 @@
           "skips": 0,
           "todos": 0
         },
+        "each-stable-npm-serves-is-listed-in-the-mcp-registry.test.mjs": {
+          "tests": 11,
+          "asserts": 61,
+          "skips": 0,
+          "todos": 0
+        },
         "effective-scope.test.mjs": {
           "tests": 15,
           "asserts": 44,
@@ -3250,8 +3286,8 @@
           "todos": 0
         },
         "experiment-context.test.mjs": {
-          "tests": 24,
-          "asserts": 80,
+          "tests": 26,
+          "asserts": 86,
           "skips": 0,
           "todos": 0
         },
@@ -3808,8 +3844,8 @@
           "todos": 0
         },
         "no-stage-is-offered-a-command-tool.test.mjs": {
-          "tests": 6,
-          "asserts": 17,
+          "tests": 7,
+          "asserts": 19,
           "skips": 0,
           "todos": 0
         },
@@ -4162,8 +4198,8 @@
           "todos": 0
         },
         "portal-service.test.mjs": {
-          "tests": 132,
-          "asserts": 715,
+          "tests": 133,
+          "asserts": 718,
           "skips": 1,
           "todos": 0
         },
@@ -4614,7 +4650,7 @@
         "register-record-log-run-scoped.test.mjs": {
           "tests": 9,
           "asserts": 21,
-          "skips": 0,
+          "skips": 1,
           "todos": 0
         },
         "register-review-fixes.test.mjs": {
@@ -4661,7 +4697,7 @@
         },
         "release-pipeline.test.mjs": {
           "tests": 124,
-          "asserts": 479,
+          "asserts": 480,
           "skips": 2,
           "todos": 0
         },
@@ -5410,8 +5446,8 @@
           "todos": 0
         },
         "synthesis-structural-input.test.mjs": {
-          "tests": 10,
-          "asserts": 67,
+          "tests": 11,
+          "asserts": 69,
           "skips": 0,
           "todos": 0
         },
@@ -7166,6 +7202,30 @@
           "skips": 0,
           "todos": 0
         },
+        "the-handshake-reports-the-package-version.test.mjs": {
+          "tests": 1,
+          "asserts": 3,
+          "skips": 0,
+          "todos": 0
+        },
+        "the-package-starts-the-mcp-server.test.mjs": {
+          "tests": 6,
+          "asserts": 22,
+          "skips": 0,
+          "todos": 0
+        },
+        "the-plugin-folder-is-what-the-directory-installs.test.mjs": {
+          "tests": 3,
+          "asserts": 18,
+          "skips": 0,
+          "todos": 0
+        },
+        "the-plugin-starts-npx-through-the-shell-on-windows.test.mjs": {
+          "tests": 8,
+          "asserts": 24,
+          "skips": 1,
+          "todos": 0
+        },
         "the-portal-can-tell-who-has-connected-an-assistant.test.mjs": {
           "tests": 12,
           "asserts": 35,
@@ -7661,6 +7721,12 @@
           "skips": 0,
           "todos": 0
         },
+        "providers/_shared/test/a-register-floor-is-too-many-to-read.test.mjs": {
+          "tests": 8,
+          "asserts": 47,
+          "skips": 0,
+          "todos": 0
+        },
         "providers/_shared/test/a-slow-question-is-asked-again-in-region-halves.test.mjs": {
           "tests": 9,
           "asserts": 38,
@@ -7723,7 +7789,7 @@
         },
         "providers/_shared/test/owner-count-verification.test.mjs": {
           "tests": 13,
-          "asserts": 51,
+          "asserts": 52,
           "skips": 0,
           "todos": 0
         },
@@ -7884,8 +7950,8 @@
           "todos": 0
         },
         "providers/signa/test/exact-spellings-go-as-one-ranked-list.test.mjs": {
-          "tests": 5,
-          "asserts": 18,
+          "tests": 11,
+          "asserts": 39,
           "skips": 0,
           "todos": 0
         },

package/driver/synthesis-record.mjs

@@ -53,7 +53,7 @@ import { declinationCallPaths, readDeclinations } from "./declination-tool.mjs";
 import { reconcileDeclinationDuty, declinationDutyRefusal } from "./declination-duty.mjs";
 import { findingUris } from "./record-carry.mjs";   // one derivation of "which records did the findings name", called not copied
 import { foldAfterSave } from "./record-fold.mjs";   // once the delivery seam is passed, the saved record is folded again
-
+import { recordOriginsOr, blankOnRepeat, recordBlanking, FOREIGN_HOST_TOKEN } from "./foreign-record-links.mjs";   // a foreign record link: refused once, then blanked
 export const NARRATIVE_FILE = "narrative.md";
 export const FINDINGS_FILE = "findings.json";
 
@@ -269,7 +269,7 @@ export function withoutWithheldRows(rows, ledger) {
   return (Array.isArray(rows) ? rows : []).filter((r) => !namesIn(r?.area).some((n) => withheld.has(n)));
 }
 
-export function acceptSynthesis(params, { asks = [], ledger = null, manifest = null, method = undefined, methodInvalid = null, owed = null, declined = null } = {}) {
+export function acceptSynthesis(params, { asks = [], ledger = null, manifest = null, method = undefined, methodInvalid = null, owed = null, declined = null, recordOrigins = null } = {}) {
   const doc = params?.findings;
   if (!doc || typeof doc !== "object" || Array.isArray(doc)) {
     return { ok: false, reason: "synthesis_findings_missing: `findings` must be the findings document object { schema_version, rated_under_framework, findings, coverage, … } — this is the record the report and the workbook are built from, and there is no path that renders without it" };
@@ -383,7 +383,7 @@ export function acceptSynthesis(params, { asks = [], ledger = null, manifest = n
   // own file gone wrong, and the seat cannot fix it — so it is refused by name, never read as "no method".
   if (methodInvalid) return { ok: false, reason: `framework_method_unreadable: _driver/${FROZEN_METHOD_FILE} does not read back (${String(methodInvalid).slice(0, 160)}) — a driver fault, not the writer's` };
   let parsedDoc;
-  try { parsedDoc = parseFindingsJson(findings, manifest ? { manifest, ...(method !== undefined ? { method } : {}) } : {}); }
+  try { parsedDoc = parseFindingsJson(findings, { ...(manifest ? { manifest, ...(method !== undefined ? { method } : {}) } : {}), ...(Array.isArray(recordOrigins) ? { recordOrigins } : {}) }); }
   catch (e) {
     return { ok: false, reason: `synthesis_findings_invalid: ${String(e?.message ?? e).slice(0, 300)}` };
   }
@@ -608,7 +608,7 @@ export function recordSynthesis(runDir, received, opts = {}) {
   const auto = driverReadsFor(dir0);
   const { asks = auto.asks, ledger = auto.ledger, manifest = auto.manifest,
     method = auto.method, methodInvalid = auto.methodInvalid ?? null,
-    owed = auto.owed, declined = auto.declined,
+    owed = auto.owed, declined = auto.declined, recordOrigins = undefined,
     now = () => new Date().toISOString() } = opts;
   const { dir, payload, accepted, refusals } = synthesisCallPaths(dir0);
   // Its sibling rule — ONE FILE PER CALL, refusals included. This used to
@@ -644,7 +644,16 @@ export function recordSynthesis(runDir, received, opts = {}) {
     call = merged.merged;
   }
 
-  const v = acceptSynthesis(call, { asks, ledger, manifest, method, methodInvalid, owed, declined });
+  // A RECORD LINK ON A HOST THIS REGISTER DOES NOT PUBLISH is gated here as verify.mjs gates the saved
+  // file. The run's first such call is refused, naming every finding, so the seat can fix them in this
+  // turn; a repeat is accepted with those links blanked and the originals kept (foreign-record-links.mjs).
+  const origins = recordOriginsOr(recordOrigins);
+  const repeat = blankOnRepeat(call, origins, refusalsFor(dir0).some((r) => String(r?.reason ?? "").includes(FOREIGN_HOST_TOKEN)));
+  if (repeat.blanked.length) {
+    call = repeat.call;
+    recordBlanking(dir0, { stage: "synthesis", layer: "call", blanked: repeat.blanked, kept: repeat.kept });
+  }
+  const v = acceptSynthesis(call, { asks, ledger, manifest, method, methodInvalid, owed, declined, recordOrigins: origins });
   if (!v.ok) {
     noteRefusal(v.reason);
     return { written: null, refused: v.reason,

package/driver/verify.mjs

@@ -158,7 +158,7 @@ function nonEmpty(content, min = MIN) {
  * true for only one lane, and put back. Appending keeps every existing matcher matching — they all test
  * substrings — and gives the seat the one word it was missing.
  *
- * It also sharpens `noChange` (`gateway.mjs:1220`, "this attempt's token equals the previous attempt's"):
+ * It also sharpens `noChange` (in runStageLadder() in gateway.mjs, "this attempt's token equals the previous attempt's"):
  * a file that starts failing a DIFFERENT member now reads as changed instead of as a stalled retry.
  *
  * `names` is positional against `markers` and optional; a call site that omits it emits exactly the token

package/mcp-server/CHANGELOG.md

@@ -1,5 +1,13 @@
 # trademark-artifacts-mcp
 
+## 0.4.1-beta.2
+
+No changes in this release.
+
+## 0.4.1-beta.1
+
+No changes in this release.
+
 ## 0.4.1-beta.0
 
 No changes in this release.

package/mcp-server/CONNECT.md

@@ -21,9 +21,9 @@ It reads run directories off your disk. So:
 
 - **It shows you runs you have already produced.** `CLEAROTRON_WORK_DIR` is where the engine writes
   them, and that is the one variable the server needs.
-- **`npx clearotron demo` runs are not visible to it.** The demo publishes a *report* into a pool; it does not
-  create a run directory. There is nothing dishonest happening if `list_runs` comes back empty — you have
-  no runs yet.
+- **With no install, it shows you the demo.** `npx clearotron mcp` starts this server from the npm package.
+  On a machine with no install it answers from the four sample runs `npx clearotron demo` replays, and every
+  row says it is the demo. On a machine with an install it reads that install's runs.
 - **Nothing here spends money on its own,** with two exceptions that are gated and named: `start_run`
   enqueues a real clearance, and `what_if_run` re-runs one pipeline stage. Both are refused by default on
   a sensible allowlist — see "Hold two tools back" below.
@@ -51,6 +51,12 @@ claude mcp add trademark-artifacts --scope user \
 
 Check it: `claude mcp list` prints `trademark-artifacts: … - √ Connected`.
 
+With no clone, start it from the npm package instead, naming the version:
+
+```sh
+claude mcp add trademark-artifacts --scope user -- npx -y clearotron@<version> mcp
+```
+
 `--scope user` makes it available in every project, not only the directory you ran it in. In Windows
 PowerShell 5.1, write the separator as `"--"`: that shell drops a bare `--`. Remove it with
 `claude mcp remove trademark-artifacts`.

package/mcp-server/demo-mode.mjs

@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// demo-mode.mjs — whether this server is serving the demo's sample runs.
+//
+// `clearotron mcp` decides it and the server reads it, in one process: bin/mcp.mjs sets it before it
+// loads the server, and the server reads it as it answers. It is a module and not an environment
+// variable because nothing outside this process sets it or reads it, and every environment variable the
+// product reads is a setting an operator is told about.
+export const demoMode = { on: false };