clearotron 0.4.1-beta.1 → 0.4.1-beta.2

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "0ac7d328864dbb4446ea2dd472f64acff14b7a4f",
-  "version": "0.4.1-beta.1"
+  "commit": "08583753fbde693fdecdc8e16f11781dae789f55",
+  "version": "0.4.1-beta.2"
 }

package/driver/CHANGELOG.md

@@ -1,5 +1,11 @@
 # clearotron-driver
 
+## 0.4.1-beta.2
+
+### Patch Changes
+
+- Fixed: A clearance no longer stops before its report when findings link to an office's own page instead of the register record.
+
 ## 0.4.1-beta.1
 
 ### Patch Changes

package/driver/engine/mcp/gather-config.mjs

@@ -849,6 +849,10 @@ function serverEnv({ sessionKey, agent, runDir, recordAxis }) {
   // the server per turn so the acceptance boundary can refuse a payload naming any other index, which
   // turns O3c's measured 224/0 habit into a structure. Absent for every non-fan-out stage.
   if (recordAxis) e.CLEAROTRON_RECORD_AXIS = String(recordAxis);
+  // — THE RUN'S REGISTER, so a recording tool gates a record link at the call as verify.mjs gates the
+  // saved file (record-origins.mjs). Handed over explicitly: Codex gives a server only its own `env` and
+  // the names it forwards, so a value left to inheritance reaches a Claude server and never a Codex one.
+  if (process.env.CLEAROTRON_DATABASE) e.CLEAROTRON_DATABASE = process.env.CLEAROTRON_DATABASE;
   // — the ledger paths are RESOLVED HERE and handed to the child explicitly, not forwarded as raw
   // env. Two reasons, and the second is the one that kept this rename parked for months:
   //   · the old line was `if (process.env[v]) e[v] = …`, and NO box sets those vars — prod, test and dev

package/driver/findings-model.mjs

@@ -858,7 +858,7 @@ export function parseFindingsJson(raw, opts = {}) {
     method: "method" in opts ? (opts.method ?? null) : undefined,
     // — null means the caller named no provider, and the record-URL gate stays inactive. An empty
     // ARRAY is a real answer ("this provider publishes no per-record page") and is not the same thing.
-    recordOrigins: Array.isArray(opts.recordOrigins) ? opts.recordOrigins : null };
+    recordOrigins: Array.isArray(opts.recordOrigins) ? opts.recordOrigins : null, foreignLinks: Array.isArray(opts.recordOrigins) ? [] : null };
   onlyKeys(doc, topKeysFor(mode), (k) => `findings_key_unknown:${short(k)}`);
   if (mode.v4) {
     if (typeof doc.rated_under_framework !== "string" || !doc.rated_under_framework.trim())
@@ -879,7 +879,7 @@ export function parseFindingsJson(raw, opts = {}) {
     throw new Error("findings_empty: the record carries no findings AND no coverage areas — at least one is required");
 
   const seenOrdinals = new Set();
-  const outFindings = findings.map((f, idx) => validateFinding(f, idx, seenOrdinals, mode));
+  const outFindings = findings.map((f, idx) => validateFinding(f, idx, seenOrdinals, mode)); throwForeignLinks(mode);
   const outCoverage = coverage.map((c) => validateCoverage(c));
   const outContextNotes = contextNotes.map((n) => validateContextNote(n));
   const outActions = validateActionsList(doc.actions, outFindings);
@@ -1381,10 +1381,10 @@ function validateFinding(f, idx, seenOrdinals, mode = { v4: false, manifest: nul
   if (f.withdrawn_reason != null && f.disposition !== "withdrawn")
     throw new Error(`finding_withdrawn_reason_orphan:${ord} (withdrawn_reason is only valid when disposition is "withdrawn")`);
 
-  validateOwner(f.owner, ord, mode?.recordOrigins ?? null);
+  validateOwner(f.owner, ord, mode?.recordOrigins ?? null, mode?.foreignLinks ?? null);
   validateMeters(f.meters);
   validateQuadrant(f.quadrant);
-  validateSource(f.source, ord, mode?.recordOrigins ?? null);
+  validateSource(f.source, ord, mode?.recordOrigins ?? null, mode?.foreignLinks ?? null);
 
   // Instance #5 — per-finding use-check / own-rights cite. SHAPE-ONLY here (present ⇒ a { source } object
   // whose source is a string). The composite>=3 NON-EMPTY-source enforcement lives in verify.mjs
@@ -1969,13 +1969,13 @@ export function isDeadRecordLink(value) {
   return t === "" || t.startsWith("#") || t.startsWith("/");
 }
 
-function checkRecordUrlHost(value, origins, ord, what) {
+function checkRecordUrlHost(value, origins, ord, what, collect = null) {
   if (origins == null) return;                        // gate inactive — see the header
   const origin = recordUrlOrigin(value);
-  if (origin == null) return;
-  if (origins.includes(origin)) return;
+  if (origin == null || origins.includes(origin)) return;
+  if (collect) { collect.push({ ord, what, value }); return; }   // the strict parse names EVERY offender in one refusal
   throw new Error(
-    `finding_record_url_foreign_host:${ord} (${what} points at ${origin}, which is not a register this run searched — `
+    `finding_record_url_foreign_host:${Array.isArray(ord) ? ord.join(",") : ord} (${what} points at ${origin}, which is not a register this run searched — `
     + (origins.length
       ? `this provider's record host is ${origins.join(" or ")}. Compose the URL from the record's own uri and THIS provider's base host, per providers/<name>.md.`
       : "this provider publishes no per-record page at all — cite the office register in the text and leave the URL as the record's own uri path.")
@@ -1983,7 +1983,7 @@ function checkRecordUrlHost(value, origins, ord, what) {
   );
 }
 
-function validateOwner(owner, ord, origins = null) {
+function validateOwner(owner, ord, origins = null, collect = null) {
   if (!isPlainObject(owner)) throw new Error(`finding_owner_invalid:${ord} (owner must be an object { name, country, registrations })`);
   onlyKeys(owner, OWNER_KEYS, (k) => `finding_owner_key_unknown:${short(k)}`);
   if (typeof owner.name !== "string" || !owner.name.trim()) throw new Error(`finding_owner_invalid:${ord} (owner.name must be a non-empty string)`);
@@ -1999,7 +1999,7 @@ function validateOwner(owner, ord, origins = null) {
     if (!isPlainObject(r)) throw new Error(`finding_registration_invalid:${ord} (each registration must be a plain object)`);
     onlyKeys(r, REGISTRATION_KEYS, (k) => `finding_registration_key_unknown:${short(k)}`);
     if (typeof r.uri !== "string" || !r.uri.trim()) throw new Error(`finding_registration_invalid:${short(r.uri)} (registration.uri must be a non-empty string)`);
-    checkRecordUrlHost(r.uri, origins, ord, `registration.uri "${short(r.uri)}"`);
+    checkRecordUrlHost(r.uri, origins, ord, `registration.uri "${short(r.uri)}"`, collect);
     if (r.classes != null && !(Array.isArray(r.classes) && r.classes.every((c) => typeof c === "string")))
       throw new Error(`finding_registration_invalid:${short(r.uri)} (registration.classes must be an array of strings)`);
   }
@@ -2042,7 +2042,7 @@ function validateQuadrant(q) {
   }
 }
 
-function validateSource(source, ord, origins = null) {
+function validateSource(source, ord, origins = null, collect = null) {
   if (!isPlainObject(source)) throw new Error(`finding_source_invalid:${ord} (source must be { source_type, resolved_link })`);
   onlyKeys(source, SOURCE_KEYS, (k) => `finding_source_key_unknown:${short(k)}`);
   if (!SOURCE_TYPES.includes(source.source_type))
@@ -2061,7 +2061,7 @@ function validateSource(source, ord, origins = null) {
         + "dead anchor in the report. Give the record's real URL, or — if this provider publishes no "
         + 'per-record page — leave it "" and cite the office register in the text.)',
       );
-    checkRecordUrlHost(source.resolved_link, origins, ord, "source.resolved_link");
+    checkRecordUrlHost(source.resolved_link, origins, ord, "source.resolved_link", collect);
   }
 }
 
@@ -2571,3 +2571,70 @@ export function knockoutFindingRange(mark) {
   if (!ords.length || !markName) return "";
   return ords.length === 1 ? `${markName} #${ords[0]}` : `${markName} #${ords[0]}–#${ords[ords.length - 1]}`;
 }
+
+/**
+ * ONE REFUSAL FOR EVERY FOREIGN RECORD LINK the strict parse collected.
+ *
+ * The gate used to throw at the first offending link, so each refusal named one finding and a corrective
+ * attempt fixed one. A seat that had copied an office's page into eleven findings ran out of attempts at
+ * the third. The token now carries every offending ordinal; the sentence after it is the gate's own,
+ * unchanged, about the first offender.
+ */
+function throwForeignLinks(mode) {
+  const found = mode?.foreignLinks ?? [];
+  if (!found.length) return;
+  const ords = [...new Set(found.map((f) => f.ord))];
+  checkRecordUrlHost(found[0].value, mode.recordOrigins, ords.length === 1 ? ords[0] : ords, found[0].what);
+}
+
+/** The canonical record path inside an absolute URL (`/mark/<cc>/<rest>`), or null. PURE. */
+function canonicalRecordPath(value) {
+  try {
+    const path = new URL(String(value)).pathname;
+    return /^\/mark\/[a-z]{2}\/[^/]+/i.test(path) ? path : null;
+  } catch { return null; }
+}
+
+/**
+ * THE SALVAGE FOR A FOREIGN RECORD LINK: blank it, and deliver. PURE.
+ *
+ * A record link on a host the run's register does not publish is refused by the gate above. When a seat
+ * keeps writing one, the report still goes out: a register-sourced `resolved_link` on a foreign host
+ * becomes `""`, the value the findings model already reads as "this register publishes no page for the
+ * record", and publish still links a register that publishes no pages to the office's own page from the
+ * record itself. A `registration.uri` written as a foreign URL keeps the record's canonical path when
+ * the URL carries one, since the path is the record's identity. One that does not is left as written and
+ * returned in `kept`, because no identity can be read from it.
+ *
+ * `origins` is the gate's own list (recordOriginsFor); null turns this off, as it turns the gate off.
+ * Returns the repaired document, every value it changed (`blanked`, with what it was), and `kept`.
+ */
+export function blankForeignRecordLinks(doc, origins) {
+  const blanked = [], kept = [];
+  if (origins == null || !isPlainObject(doc) || !Array.isArray(doc.findings)) return { doc, blanked, kept };
+  const foreign = (value) => { const o = recordUrlOrigin(value); return o != null && !origins.includes(o); };
+  const findings = doc.findings.map((f) => {
+    if (!isPlainObject(f)) return f;
+    let out = f;
+    const s = f.source;
+    if (isPlainObject(s) && String(s.source_type ?? "").startsWith("register") && typeof s.resolved_link === "string" && foreign(s.resolved_link)) {
+      out = { ...out, source: { ...s, resolved_link: "" } };
+      blanked.push({ ordinal: f.ordinal ?? null, field: "source.resolved_link", was: s.resolved_link, now: "" });
+    }
+    const regs = isPlainObject(f.owner) && Array.isArray(f.owner.registrations) ? f.owner.registrations : null;
+    if (regs) {
+      let changed = false;
+      const next = regs.map((r, index) => {
+        if (!isPlainObject(r) || typeof r.uri !== "string" || !foreign(r.uri)) return r;
+        const path = canonicalRecordPath(r.uri);
+        if (!path) { kept.push({ ordinal: f.ordinal ?? null, field: "registration.uri", index, was: r.uri }); return r; }
+        changed = true;
+        blanked.push({ ordinal: f.ordinal ?? null, field: "registration.uri", index, was: r.uri, now: path });
+        return { ...r, uri: path };
+      });
+      if (changed) out = { ...out, owner: { ...out.owner, registrations: next } };
+    }
+    return out;
+  });
+  return { doc: { ...doc, findings }, blanked, kept };
+}

package/driver/foreign-record-links.mjs

@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// foreign-record-links.mjs — a record link on a host the run's register does not publish: refused once, then
+// blanked, and the run delivers.
+//
+// The findings gate refuses such a link (`finding_record_url_foreign_host`, findings-model.mjs). R2 on
+// 0.4.1-beta.1 delivered no report over eleven of them: the seat copied each office's own page into a
+// record link, every attempt was refused, and nothing could repair it. Two layers now act on it, and both
+// record what they did under one event name and in one file, so a reader meets one fact however it arose:
+//   · the synthesis transport, at the call (synthesis-record.mjs): the first offending call in a run is
+//     refused, naming every finding, so the seat can fix them in the same turn; a repeat is accepted with
+//     the foreign links blanked;
+//   · the synthesis salvage lane (pipeline.mjs), for a findings file the transport did not write.
+// Blanking is blankForeignRecordLinks (findings-model.mjs): a register link becomes "", the value that
+// already means "this register publishes no page for the record".
+import { writeFileSync } from "node:fs";
+import { driverDir } from "../shared/driver-dir.mjs";
+import { blankForeignRecordLinks } from "./findings-model.mjs";
+import { activeRecordOrigins } from "./record-origins.mjs";
+import { runLog } from "./log.mjs";
+
+export const FOREIGN_HOST_TOKEN = "finding_record_url_foreign_host";
+export const BLANKED_FILE = "foreign-record-links.json";
+
+/** The gate's list of record hosts: the caller's when it names one, else the run's register. */
+export const recordOriginsOr = (given) => (given === undefined ? activeRecordOrigins() : given);
+
+/**
+ * The synthesis call, refused once and then blanked. PURE. `refusedBefore` is whether this run's transport
+ * already refused a call for a foreign record link; until it has, the call is returned unchanged and the
+ * gate refuses it.
+ */
+export function blankOnRepeat(call, origins, refusedBefore) {
+  if (!refusedBefore || !Array.isArray(origins) || !call?.findings) return { call, blanked: [], kept: [] };
+  const { doc, blanked, kept } = blankForeignRecordLinks(call.findings, origins);
+  return { call: blanked.length ? { ...call, findings: doc } : call, blanked, kept };
+}
+
+/** What a blanking changed: the originals kept beside the run, and one run-log row. Never throws. */
+export function recordBlanking(runDir, { stage, layer, blanked, kept, fail = null }) {
+  try {
+    writeFileSync(driverDir(runDir, BLANKED_FILE),
+      JSON.stringify({ stage, layer, ...(fail ? { fail: String(fail).slice(0, 300) } : {}), blanked, kept }, null, 2) + "\n");
+  } catch { /* the file is forensics; the run-log row below is the record */ }
+  try {
+    runLog(runDir, { event: "foreign-record-links-blanked", stage, layer, blanked: blanked.length, kept: kept.length,
+      ordinals: [...new Set(blanked.map((b) => b.ordinal))] });
+  } catch { /* a log that cannot be written must not stop the record it describes */ }
+}

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.4.1-beta.1",
+  "version": "0.4.1-beta.2",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline.mjs

@@ -45,7 +45,7 @@ import { parseCoverageLedgerJson, parseCoverageLedgerFull, deriveCoverageStatus,
 import { receiptSettled, readEnvelopeDecision, settleReceipt, settledDeferralsSection, readStickyGaps } from "./envelope-settle.mjs";
 import { readRegisterTaint, readActiveTaintAxes } from "./register-taint.mjs";
 import { parseNamedBand, mergeNamedBands, findCollapsedBands, quarantineUnknownStates, taintQuarantineCleanBlocks, bandRecords } from "./named-band.mjs";
-import { recordOriginsFor } from "./record-origins.mjs";
+import { recordOriginsFor, activeRecordOrigins } from "./record-origins.mjs"; import { recordBlanking, FOREIGN_HOST_TOKEN } from "./foreign-record-links.mjs";
 import { REGISTER_PROVIDER } from "./driver.config.mjs";
 import { noteRegisterServed, registersServedFrom, providerUsageCaveat } from "./register-served.mjs";   // which registers actually served this run — noted eagerly from the dispatch's own resolver, and reconciled at publish against the ledger rows, which carry the vendor per call
 import { FACTS_FILE as DIGEST_FACTS_FILE, ACCOUNTING_STAMP as DIGEST_ACCOUNTING_STAMP, recordedFindingUris,
@@ -163,7 +163,7 @@ import { parsePlacementsJson } from "./placement-model.mjs";   // B2 — the str
 import { readAnchors } from "./anchor-reader.mjs";
 import { findEngagementReceipts } from "./engagement-receipt.mjs";
 import { plainRegisterFlags } from "./plain-register.mjs";
-import { parseFindingsJson, parseFindingsJsonLenient, consolidateFindings, deriveDisplayVerdict, bindRecommendation, compareBlockingPower, inDispositionMode, DISPOSITION_GROUP, deriveActionConditions, cardedParties, actionPartyReferences, quarantinedConditionRows, salvageRepairTargets, riskStatement, verdictStance, remapActionOrdinals, joinAskToAnswer, stripAskLabel, bandBorderlineDeclarations, reasonedNegativeGroups } from "./findings-model.mjs";
+import { parseFindingsJson, parseFindingsJsonLenient, consolidateFindings, deriveDisplayVerdict, bindRecommendation, compareBlockingPower, inDispositionMode, DISPOSITION_GROUP, deriveActionConditions, cardedParties, actionPartyReferences, quarantinedConditionRows, salvageRepairTargets, riskStatement, verdictStance, remapActionOrdinals, joinAskToAnswer, stripAskLabel, bandBorderlineDeclarations, reasonedNegativeGroups, blankForeignRecordLinks } from "./findings-model.mjs";
 import { foldCaption, foldCardRead } from "./card-budget.mjs";
 // S2 — the report card's mechanical frame, composed from the record instead of dictated (see below).
 import { carriesOwnFrame, composeCard } from "./card-frame.mjs";
@@ -5035,7 +5035,7 @@ export function buildFailurePacket({ runId, agent, job = {}, failedStage, shortR
 // a top-level defect, or nothing salvageable — fails the run exactly as before. One bad object never silently
 // suppresses a real conflict, and never silently kills a ~$40 run.
 async function quarantineSynth(r, ctx, name) {
-  if (r.ok) return r;
+  if (r.ok) return r; if (foreignRecordLinksBlanked(r, ctx, name)) return { ...r, ok: true, fail: undefined, repaired: "foreign-record-links-blanked" };
   // A6: a max_tokens-named content fault wraps the underlying validator token — strip the wrapper so a
   // per-finding shape defect on a ceiling-cut turn still reaches the lenient-salvage lane.
   const fail = String(r.fail || "").replace(/^max_tokens_no_output:/, "");
@@ -16993,3 +16993,30 @@ function orphanAreaLabel(qid, axis, plan) {
 export function instructedScopeToWrite(job, { jobRebuiltFromStatus = false, scopeOnDisk = false } = {}) {   // @internal
   return jobRebuiltFromStatus && scopeOnDisk ? null : instructedScopeOf(job);
 }
+
+// ── THE SALVAGE FOR A FOREIGN RECORD LINK: BLANK IT, RE-CHECK, DELIVER ──────────────────────────────────
+//
+// A seat that writes an office's page, or another register's, into a record link is refused by the
+// findings gate (`finding_record_url_foreign_host`). The salvage lane below takes that token, because it is
+// a `finding_…` token, but its lenient re-parse does not judge hosts, so it found nothing to repair and
+// failed the run: R2 on 0.4.1-beta.1 delivered no report over eleven copied office links. Here the driver
+// blanks every foreign link itself (blankForeignRecordLinks says how), keeps what it changed beside the run,
+// and re-checks the file with the stage's own validator. A pass delivers; anything still refused falls
+// through to the lanes below exactly as before, with fewer defects in the file.
+export function foreignRecordLinksBlanked(r, ctx, name) {   // exported for its test
+  const fail = String(r?.fail || "").replace(/^max_tokens_no_output:/, "");
+  if (!fail.includes(FOREIGN_HOST_TOKEN) || !existsSync(ctx.paths.findings)) return false;
+  let doc;
+  try { doc = JSON.parse(readFileSync(ctx.paths.findings, "utf8")); } catch { return false; }
+  const { doc: repaired, blanked, kept } = blankForeignRecordLinks(doc, activeRecordOrigins());
+  if (!blanked.length) return false;
+  atomicWrite(ctx.paths.findings, JSON.stringify(repaired, null, 2) + "\n");
+  recordBlanking(ctx.paths.runDir, { stage: name, layer: "salvage", blanked, kept, fail });
+  note(`[${name}] ${blanked.length} record link(s) on a host this register does not publish were blanked by the driver; the originals are in _driver/foreign-record-links.json`);
+  const def = STAGES[name];
+  const out = def?.out ? def.out(ctx.paths, ctx.axis) : null;
+  const v = out && existsSync(out) && def.validate ? def.validate(out, readFileSync(out, "utf8")) : null;
+  if (v?.ok) return true;
+  runLog(ctx.paths.runDir, { event: "foreign-record-links-recheck", stage: name, ok: false, fail: String(v?.reason ?? "no validator").slice(0, 200) });
+  return false;
+}

package/driver/suite-census.json

@@ -585,6 +585,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-foreign-record-link-is-named-once-and-blanked-at-salvage.test.mjs": {
+          "tests": 8,
+          "asserts": 31,
+          "skips": 0,
+          "todos": 0
+        },
         "a-frame-call-with-places-per-name-passes-the-gate.test.mjs": {
           "tests": 2,
           "asserts": 7,

package/driver/synthesis-record.mjs

@@ -53,7 +53,7 @@ import { declinationCallPaths, readDeclinations } from "./declination-tool.mjs";
 import { reconcileDeclinationDuty, declinationDutyRefusal } from "./declination-duty.mjs";
 import { findingUris } from "./record-carry.mjs";   // one derivation of "which records did the findings name", called not copied
 import { foldAfterSave } from "./record-fold.mjs";   // once the delivery seam is passed, the saved record is folded again
-
+import { recordOriginsOr, blankOnRepeat, recordBlanking, FOREIGN_HOST_TOKEN } from "./foreign-record-links.mjs";   // a foreign record link: refused once, then blanked
 export const NARRATIVE_FILE = "narrative.md";
 export const FINDINGS_FILE = "findings.json";
 
@@ -269,7 +269,7 @@ export function withoutWithheldRows(rows, ledger) {
   return (Array.isArray(rows) ? rows : []).filter((r) => !namesIn(r?.area).some((n) => withheld.has(n)));
 }
 
-export function acceptSynthesis(params, { asks = [], ledger = null, manifest = null, method = undefined, methodInvalid = null, owed = null, declined = null } = {}) {
+export function acceptSynthesis(params, { asks = [], ledger = null, manifest = null, method = undefined, methodInvalid = null, owed = null, declined = null, recordOrigins = null } = {}) {
   const doc = params?.findings;
   if (!doc || typeof doc !== "object" || Array.isArray(doc)) {
     return { ok: false, reason: "synthesis_findings_missing: `findings` must be the findings document object { schema_version, rated_under_framework, findings, coverage, … } — this is the record the report and the workbook are built from, and there is no path that renders without it" };
@@ -383,7 +383,7 @@ export function acceptSynthesis(params, { asks = [], ledger = null, manifest = n
   // own file gone wrong, and the seat cannot fix it — so it is refused by name, never read as "no method".
   if (methodInvalid) return { ok: false, reason: `framework_method_unreadable: _driver/${FROZEN_METHOD_FILE} does not read back (${String(methodInvalid).slice(0, 160)}) — a driver fault, not the writer's` };
   let parsedDoc;
-  try { parsedDoc = parseFindingsJson(findings, manifest ? { manifest, ...(method !== undefined ? { method } : {}) } : {}); }
+  try { parsedDoc = parseFindingsJson(findings, { ...(manifest ? { manifest, ...(method !== undefined ? { method } : {}) } : {}), ...(Array.isArray(recordOrigins) ? { recordOrigins } : {}) }); }
   catch (e) {
     return { ok: false, reason: `synthesis_findings_invalid: ${String(e?.message ?? e).slice(0, 300)}` };
   }
@@ -608,7 +608,7 @@ export function recordSynthesis(runDir, received, opts = {}) {
   const auto = driverReadsFor(dir0);
   const { asks = auto.asks, ledger = auto.ledger, manifest = auto.manifest,
     method = auto.method, methodInvalid = auto.methodInvalid ?? null,
-    owed = auto.owed, declined = auto.declined,
+    owed = auto.owed, declined = auto.declined, recordOrigins = undefined,
     now = () => new Date().toISOString() } = opts;
   const { dir, payload, accepted, refusals } = synthesisCallPaths(dir0);
   // Its sibling rule — ONE FILE PER CALL, refusals included. This used to
@@ -644,7 +644,16 @@ export function recordSynthesis(runDir, received, opts = {}) {
     call = merged.merged;
   }
 
-  const v = acceptSynthesis(call, { asks, ledger, manifest, method, methodInvalid, owed, declined });
+  // A RECORD LINK ON A HOST THIS REGISTER DOES NOT PUBLISH is gated here as verify.mjs gates the saved
+  // file. The run's first such call is refused, naming every finding, so the seat can fix them in this
+  // turn; a repeat is accepted with those links blanked and the originals kept (foreign-record-links.mjs).
+  const origins = recordOriginsOr(recordOrigins);
+  const repeat = blankOnRepeat(call, origins, refusalsFor(dir0).some((r) => String(r?.reason ?? "").includes(FOREIGN_HOST_TOKEN)));
+  if (repeat.blanked.length) {
+    call = repeat.call;
+    recordBlanking(dir0, { stage: "synthesis", layer: "call", blanked: repeat.blanked, kept: repeat.kept });
+  }
+  const v = acceptSynthesis(call, { asks, ledger, manifest, method, methodInvalid, owed, declined, recordOrigins: origins });
   if (!v.ok) {
     noteRefusal(v.reason);
     return { written: null, refused: v.reason,

package/mcp-server/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-artifacts-mcp
 
+## 0.4.1-beta.2
+
+No changes in this release.
+
 ## 0.4.1-beta.1
 
 No changes in this release.

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.4.1-beta.1",
+  "version": "0.4.1-beta.2",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron",
   "mcpName": "io.github.CordilleraSarl/clearotron",
   "type": "module",
-  "version": "0.4.1-beta.1",
+  "version": "0.4.1-beta.2",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.4.1-beta.1",
+  "version": "0.4.1-beta.2",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-oauth-mcp-bridge
 
+## 0.4.1-beta.2
+
+No changes in this release.
+
 ## 0.4.1-beta.1
 
 No changes in this release.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.4.1-beta.1",
+  "version": "0.4.1-beta.2",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/scripts/e2e-first-time.mjs

@@ -86,7 +86,7 @@ export const COUNTED_EVENTS = {
   "record-carry-failed": FAILED, "record-discard-failed": FAILED, "register-digest-facts-failed": FAILED,
   "register-plan-infeasible": FAILED, "register-positions-failed": FAILED, "register-presence-failed": FAILED,
   "remedy-accounting-failed": FAILED, "report-cards-rate-limited": FAILED, "restamp-miss": FAILED,
-  "reviewer-degenerate": FAILED, "salvage-lane-no-target": FAILED, "searched-jurisdictions-unresolved": FAILED,
+  "reviewer-degenerate": FAILED, "salvage-lane-no-target": FAILED, "searched-jurisdictions-unresolved": FAILED, "foreign-record-links-recheck": FAILED,
   "skeptic-skipped": FAILED, "stage-input-over-ceiling": FAILED, "status-write-failed": FAILED,
   "stale-repair-entry-done": { kind: FAILED, when: (e) => (Array.isArray(e.failed) ? e.failed.length : Number(e.failed)) > 0 },
   // written only where the step threw
@@ -138,7 +138,7 @@ export const COUNTED_EVENTS = {
   "commonlaw-channels-unstated": REPAIR, "commonlaw-channels-unusable": REPAIR,
   "corrective-unnamed-removal-repaired": REPAIR, "coverage-floor-clamp": REPAIR, "jx-receipt-repaired": REPAIR,
   "knockout-next-step-removed": REPAIR, "recall-reconciliation-positions-rederived": REPAIR, "registry-auto-correct": REPAIR,
-  "repair-attempted": REPAIR, "terminal-guard-clamp": REPAIR, "verdict-conditions-dropped": REPAIR,
+  "repair-attempted": REPAIR, "terminal-guard-clamp": REPAIR, "verdict-conditions-dropped": REPAIR, "foreign-record-links-blanked": REPAIR,
   "verdict-hardened-by-repair": REPAIR, "verdict-rederive-repair": REPAIR,
   "common-law-half-quarantined": QUARANTINE, "coverage-ledger-quarantined": QUARANTINE,
   "findings-actions-quarantined": QUARANTINE, "named-band-state-quarantined": QUARANTINE, "quarantine": QUARANTINE,