clearotron 0.5.0-beta.2 → 0.5.0-beta.4

package/driver/synthesis-record.mjs

@@ -46,13 +46,15 @@ import { writeFileSync, appendFileSync, mkdirSync, readFileSync, existsSync, ren
 import { captureCall, stampVerdict } from "./call-capture.mjs";
 import { join, dirname } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";
-import { parseFindingsJson, COVERAGE_AREA_STATES, topKeysForVersion } from "./findings-model.mjs";
+import { parseFindingsJson, COVERAGE_AREA_STATES, topKeysForVersion, validateFindingForSave } from "./findings-model.mjs";
+import { normalizeRecordUri } from "./registry-fidelity.mjs";   // the duty's own reading of a record uri
 import { readFrozenMethod, FROZEN_METHOD_FILE } from "./framework-method.mjs";
 import { findCoverageRecommendations } from "./verify.mjs";
 import { declinationCallPaths, readDeclinations } from "./declination-tool.mjs";   // — the seat's own declines, read by the driver never asserted by the seat
 import { reconcileDeclinationDuty, declinationDutyRefusal } from "./declination-duty.mjs";
 import { findingUris } from "./record-carry.mjs";   // one derivation of "which records did the findings name", called not copied
 import { foldAfterSave } from "./record-fold.mjs";   // once the delivery seam is passed, the saved record is folded again
+import { SAVED_FINDINGS_FILE } from "./saved-findings-block.mjs";   // the file a later attempt is handed the saved findings in
 import { runLog } from "./log.mjs";   // what the transport read a call as goes to the run's record, never to the model's answer
 import { recordOriginsOr, blankOnRepeat, recordBlanking, FOREIGN_HOST_TOKEN } from "./foreign-record-links.mjs";   // a foreign record link: refused once, then blanked
 export const NARRATIVE_FILE = "narrative.md";
@@ -908,6 +910,19 @@ export function recordSynthesis(runDir, received, opts = {}) {
   // record to patch and the call reads that way (`registerPatchOf`); any other shape is read as it always was.
   // The call is decided on AS READ (`readSynthesisCall`): a marker sent as a JSON string is decoded first. The
   // capture above keeps what arrived; the base written below keeps the call as read.
+  // A SAVE OF COMPLETED FINDINGS is its own call, and writes no report file (see `saveFindings`).
+  if (received && typeof received === "object" && received.save_findings !== undefined) {
+    const others = Object.keys(received).filter((k) => k !== "save_findings");
+    if (others.length) {
+      const reason = `synthesis_save_mixed:${others.join(",").slice(0, 80)} — a save carries \`save_findings\` alone; the whole record arrives on its own call, which takes the saved findings`;
+      noteRefusalAt(dir0, reason, now);
+      return { written: null, refused: reason, captured: closeCapture({ ok: false, refused: reason }), capture_failed: captureFailed };
+    }
+    const r = saveFindings(dir0, received.save_findings, { manifest, method, owed, declined, recordOrigins: recordOriginsOr(recordOrigins), now });
+    for (const x of r.refused) noteRefusalAt(dir0, x.reason, now);
+    closeCapture({ ok: r.saved.length > 0, saved: r.saved.length, refused: r.refused.length });
+    return { written: null, refused: null, saved: r.saved, save_refused: r.refused, held: r.held, ...(r.write_failed ? { write_failed: r.write_failed } : {}), capture_failed: captureFailed };
+  }
   const stored = lastAcceptedCall(dir0);
   const read = readSynthesisCall(received, stored);
   let call = read.call;
@@ -952,6 +967,10 @@ export function recordSynthesis(runDir, received, opts = {}) {
     call = repeat.call;
     recordBlanking(dir0, { stage: "synthesis", layer: "call", blanked: repeat.blanked, kept: repeat.kept });
   }
+  // THE COMPLETING CALL TAKES THE SAVED FINDINGS for every position it does not carry itself, and the record-wide checks
+  // below judge the record that results. A patch repairs an accepted record and takes none.
+  const savedBefore = isPatch ? [] : readSavedFindings(dir0);
+  if (savedBefore.length) call = { ...call, findings: withSavedFindings(call.findings, savedBefore, owed).doc };
   const v = acceptSynthesis(call, { asks, ledger, manifest, method, methodInvalid, owed, declined, recordOrigins: origins });
   if (!v.ok) {
     noteRefusal(v.reason);
@@ -986,6 +1005,11 @@ export function recordSynthesis(runDir, received, opts = {}) {
   // record the reviewer, the cards and the delivery read. Before the seam this leaves the record as written.
   foldAfterSave(dir0, findingsAt);
   recordReading(true);
+  // The parts this record took are consumed; a part saved after it waits for the next completing call.
+  if (savedBefore.length) {
+    try { appendFileSync(savedFindingsPath(dir0), JSON.stringify({ at: now(), consumed: true, findings: savedBefore.length }) + "\n"); }
+    catch { /* best-effort: the accepted record already holds them */ }
+  }
 
   return {
     written: [findingsAt, narrativeAt], refused: null,
@@ -995,6 +1019,148 @@ export function recordSynthesis(runDir, received, opts = {}) {
   };
 }
 
+// ── A COMPLETED FINDING IS KEPT AS IT PASSES, BEFORE THE WHOLE RECORD EXISTS ─────────────────────────────────────────
+//
+// The writer recorded the report in one whole call, and nothing was kept until that call passed: on a test run of a
+// crowded matter, 2026-10-27, two writer attempts were stopped after hundreds of tool calls each and left nothing, so
+// each attempt started again from nothing. A completed finding is now saved as the writer completes it
+// (`save_findings`), checked as the whole record checks a finding, and kept in the run's own record, where a fresh
+// attempt, a fresh recovery ladder or a lost working folder cannot take it. The whole record still arrives on one call,
+// the completing call, which takes every saved finding for a position it does not carry itself; the record-wide checks
+// run there, as they always have. Intermediate saves write no report file, so nothing downstream reads a part as done.
+//
+// A SAVED FINDING IS KEYED BY THE POSITION IT ENDS, never by its ordinal: the ordinal is the finding's rank, which the
+// next finding found can move. The position is the declination spec's entry whose records the finding names, as the
+// duty reads it; a finding naming none of them is keyed by the records it names, or by its mark and owner.
+//
+// APPEND-ONLY, FOLDED ON READ: a kill in the middle of a save cannot cut an earlier one short, and two saves in one turn
+// cannot lose either. The latest save for a position stands; an identical re-save changes nothing; a different one is a
+// revision, and the record says how many there were. A saved finding naming a record the writer has declined is
+// refused by name: an accepted exclusion is never reversed by a save. Once a whole record is accepted the parts before
+// it are consumed, and a part saved after it waits for the next completing call.
+
+/** Where the saved findings live: beside the writer's call records, under the run's `_driver/`. */
+export const savedFindingsPath = (runDir) => join(synthesisCallPaths(runDir).dir, "saved-findings.jsonl");
+
+/** The position a finding ends, as the declination duty reads positions. PURE. */
+export function positionKeyOf(finding, owed = null) {
+  const named = [...findingUris([finding]).keys()].map((u) => normalizeRecordUri(u)).filter(Boolean);
+  for (const row of Array.isArray(owed) ? owed : []) {
+    const head = normalizeRecordUri(row?.uri ?? row?.record_id);
+    if (!head) continue;
+    const members = new Set([head, ...(Array.isArray(row?.uris) ? row.uris : []).map((u) => normalizeRecordUri(u)).filter(Boolean)]);
+    if (named.some((u) => members.has(u))) return `position:${head}`;
+  }
+  if (named.length) return `records:${[...new Set(named)].sort().join(",")}`;
+  return `mark:${String(finding?.mark ?? "").trim().toLowerCase()}|${String(finding?.owner ?? "").trim().toLowerCase()}`;
+}
+
+/**
+ * The findings saved since the last accepted whole record, the latest per position, in the order first saved. A torn
+ * line is skipped. IMPURE (reads the record). Returns `[{ key, finding, savedAt, revisions }]`.
+ */
+export function readSavedFindings(runDir) {
+  let raw = "";
+  try { raw = readFileSync(savedFindingsPath(String(runDir ?? "")), "utf8"); } catch { return []; }
+  let byKey = new Map();
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    let row;
+    try { row = JSON.parse(line); } catch { continue; }
+    if (row?.consumed) { byKey = new Map(); continue; }
+    if (typeof row?.key !== "string" || !row.finding || typeof row.finding !== "object") continue;
+    const had = byKey.get(row.key);
+    byKey.set(row.key, { key: row.key, finding: row.finding, savedAt: String(row.at ?? ""), revisions: had ? had.revisions + (row.revised ? 1 : 0) : 0 });
+  }
+  return [...byKey.values()];
+}
+
+const sameFinding = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+
+/**
+ * Save completed findings, one by one: each passes or is refused on its own, and a refusal never touches a finding
+ * already saved. IMPURE (appends to the record). Returns the answer the tool hands back.
+ */
+export function saveFindings(runDir, list, { manifest = null, method = undefined, owed = null, declined = null, recordOrigins = null, now = () => new Date().toISOString() } = {}) {
+  const dir0 = String(runDir ?? "");
+  if (!Array.isArray(list) || !list.length)
+    return { saved: [], refused: [{ index: null, reason: "synthesis_save_empty: `save_findings` is an array of one or more completed finding objects, each as the findings record carries it" }], held: readSavedFindings(dir0).length };
+  const held = new Map(readSavedFindings(dir0).map((s) => [s.key, s]));
+  const declinedSet = new Set((Array.isArray(declined) ? declined : []).map((u) => normalizeRecordUri(u)).filter(Boolean));
+  const saved = [], refused = [], rows = [];
+  list.forEach((f, index) => {
+    let checked;
+    try { checked = validateFindingForSave(f, { manifest, ...(method !== undefined ? { method } : {}), ...(Array.isArray(recordOrigins) ? { recordOrigins } : {}) }); }
+    catch (e) { refused.push({ index, reason: `synthesis_save_invalid:${index}: ${String(e?.message ?? e).slice(0, 240)}` }); return; }
+    const named = [...findingUris([f]).keys()].map((u) => normalizeRecordUri(u)).filter((u) => declinedSet.has(u));
+    if (named.length) {
+      refused.push({ index, reason: `synthesis_save_declined:${index}: you declined ${named.slice(0, 3).join(", ")} through record_declination, and a save does not reverse an exclusion. Leave that record declined, or keep it out of this finding` });
+      return;
+    }
+    const key = positionKeyOf(f, owed);
+    const before = held.get(key);
+    if (before && sameFinding(before.finding, f)) { saved.push({ index, key, unchanged: true }); return; }
+    rows.push({ at: now(), key, ...(before ? { revised: true } : {}), finding: f });
+    held.set(key, { key, finding: f });
+    saved.push({ index, key, ...(before ? { revised: true } : {}) });
+    void checked;
+  });
+  if (rows.length) {
+    try {
+      mkdirSync(dirname(savedFindingsPath(dir0)), { recursive: true });
+      appendFileSync(savedFindingsPath(dir0), rows.map((r) => JSON.stringify(r)).join("\n") + "\n");
+    } catch (e) {
+      // VALID AND NOT KEPT is infrastructure, never a refusal: the two have opposite repairs.
+      return { saved: [], refused, held: readSavedFindings(dir0).length, write_failed: String(e?.message ?? e).slice(0, 200) };
+    }
+  }
+  return { saved, refused, held: readSavedFindings(dir0).length };
+}
+
+/**
+ * The completing call's findings with every saved finding for a position the call does not carry, appended after the
+ * call's own in the order they were saved, each numbered after the call's highest ordinal: the record's order is the
+ * call's, and the fold renumbers the record contiguously as it always has. PURE.
+ */
+export function withSavedFindings(doc, saved, owed = null) {
+  if (!saved?.length || !doc || typeof doc !== "object" || !Array.isArray(doc.findings)) return { doc, taken: 0 };
+  const carried = new Set(doc.findings.map((f) => positionKeyOf(f, owed)));
+  let next = doc.findings.reduce((m, f) => (Number.isInteger(f?.ordinal) && f.ordinal > m ? f.ordinal : m), 0);
+  const taken = saved.filter((s) => !carried.has(s.key)).map((s) => ({ ...s.finding, ordinal: ++next }));
+  return { doc: { ...doc, findings: [...doc.findings, ...taken] }, taken: taken.length };
+}
+
+
+/**
+ * HAND A LATER ATTEMPT WHAT THIS RUN ALREADY SAVED: write the saved findings to `synthesis-saved.json` in the run folder,
+ * each as it was accepted, with the evidence it carries, and return what the attempt's message says about them: how
+ * many were saved, how many records were declined, and the positions still owed. null when nothing is saved, so a first
+ * attempt's message is unchanged; null too when the file could not be written, since a message must never name a file
+ * that is not there. `outstanding` is null when the duty cannot be computed (no declination spec, an unreadable
+ * ledger), never an empty list. IMPURE.
+ */
+export function handSavedFindings(runDir) {
+  const dir0 = String(runDir ?? "");
+  const saved = readSavedFindings(dir0);
+  if (!saved.length) return null;
+  const { owed, declined } = driverReadsFor(dir0);
+  const duty = reconcileDeclinationDuty({ owed, deliveredUris: [...findingUris(saved.map((s) => s.finding)).keys()], declinedUris: declined });
+  try {
+    const p = join(dir0, SAVED_FINDINGS_FILE);
+    writeFileSync(`${p}.tmp`, JSON.stringify({ saved_findings: saved.map((s) => s.finding) }, null, 2) + "\n");
+    renameSync(`${p}.tmp`, p);
+  } catch { return null; }
+  return {
+    findings: saved.length,
+    declined: Array.isArray(declined) ? declined.length : 0,
+    outstanding: duty.computable ? duty.unaccounted.map((r) => `${r.mark ? `${r.mark}${r.owner ? ` — ${r.owner}` : ""} ` : ""}(${r.uri})`) : null,
+  };
+}
+
+const noteRefusalAt = (runDir, reason, now) => {
+  try { appendFileSync(synthesisCallPaths(runDir).refusals, JSON.stringify({ at: now(), reason }) + "\n"); } catch { /* best-effort */ }
+};
+
 /** Every call this run turned away, in order — the run's own record that a defect was met and corrected. */
 export function refusalsFor(runDir) {
   try {

package/driver/verify.mjs

@@ -2689,12 +2689,12 @@ function placementAccountVerdict(dir) {
     const rid = rowOf.get(id), cause = rid ? causeOf.get(rid) : null;
     return `${id}${group ? ` in (${group})` : ""}${cause ? `, its row ${rid} (${cause})` : ""}`;
   });
-  const finishRow = floors.some((f) => f.includes(", its row ")) ? " Where a floor's row is named, finish that row: a floor's row owes a tier, "
-    + "sheet-2 at the least, and a reason stating the ground." : "";
+  const finishRow = floors.some((f) => f.includes(", its row ")) ? " Where a floor's row is named, finish that row: give it "
+    + "headline-candidate or sheet-2, and a reason stating the ground." : "";
   if (unjudged.length) {
     const named = unjudged.slice(0, 8).map((u) => `${u.row_id ?? u.select ?? "?"} (${u.cause})`).join(", ");
-    const floorsToo = floors.length ? ` The form gives these floors no fate either: ${capped(floors)}. Place each by `
-      + `selecting that record, sheet-2 at the least, or set its line aside by name on its status or its territory.${finishRow}` : "";
+    const floorsToo = floors.length ? ` The form gives these floors no fate either: ${capped(floors)}. Select each at `
+      + `headline-candidate or sheet-2, or set its line aside by name.${finishRow}` : "";
     return fail(`placement_unjudged=${unjudged.length}: ${named}${unjudged.length > 8 ? ", …" : ""} — each of these rows is `
       + "in placement-form.json and its own judgement will not render: a selected row owes a `tier` from the closed set and a `reason` "
       + "stating the ground; a row you wrote in full owes mark, owner and jurisdiction too. Finish these rows in the form; "
@@ -2755,8 +2755,8 @@ function placementSaidBackVerdict({ refused, floors, also, finishRow = "" }) {
   if (floors.length)
     return fail(`placement_floors_without_fate=${floors.length}: ${capped(floors)} — each is a floor, a live identical or `
       + "near-identical mark in an ordered class, and the form gives it no fate. "
-      + "Place it by selecting that record, sheet-2 at the least, or set its line aside by name on its status or its "
-      + `territory.${finishRow} Only these are owed; every other row stands.${also}`);
+      + "Select it at headline-candidate or sheet-2, or set its line aside by name."
+      + `${finishRow} Only these are owed; every other row stands.${also}`);
   if (refused.length)
     return fail(`placement_refused=${refused.length}: ${capped(refused)} — the form refused each of these for the reason given `
       + "with it, and nothing else on the form moved. Send each again corrected, or leave it out; every other row stands.");

package/mcp-server/CHANGELOG.md

@@ -1,5 +1,13 @@
 # trademark-artifacts-mcp
 
+## 0.5.0-beta.4
+
+No changes in this release.
+
+## 0.5.0-beta.3
+
+No changes in this release.
+
 ## 0.5.0-beta.2
 
 No changes in this release.

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.5.0-beta.2",
+  "version": "0.5.0-beta.4",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron",
   "mcpName": "io.github.CordilleraSarl/clearotron",
   "type": "module",
-  "version": "0.5.0-beta.2",
+  "version": "0.5.0-beta.4",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.5.0-beta.2",
+  "version": "0.5.0-beta.4",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/_shared/README.md

@@ -24,6 +24,7 @@ documents both: `countProbe` (`"endpoint"` / `"cheap"` / `"none"`) says where a
 | `term-shape.mjs` | Whether a string is a searchable mark term and agrees with its predicate (`{ predicate: "exact", term: "WAVO*" }` is a silent clean). |
 | `territory-codes.mjs` | Display name → ISO 3166 / WIPO ST.3 code. `""` means worldwide, `null` means unknown — and never goes to the wire. |
 | `provider-text.mjs` | Clips a vendor message from the MIDDLE, because the word that classifies a refusal sits at the end of the sentence. |
+| `send-until.mjs` | The time after which a plan call sends no further question, handed to each turn's tool servers ahead of the turn's deadline, so a call cut short returns what it holds. |
 | `test/` | Twelve files, provider-agnostic by design — several drive every adapter's real code rather than fixtures of what we believe it returns. |
 
 ## What reads it

package/providers/_shared/enumerate.mjs

@@ -57,6 +57,7 @@ import {
 import { makeCountProbe, parseToolText, isToolError } from "./count.mjs"; import { floorOf, moreThan } from "../../shared/register-floor.mjs";
 import { guardCountCall, guardToolCall } from "./transport-guard.mjs";
 import { clipProviderText } from "./provider-text.mjs";   // — keep the discriminator
+import { pastSendUntil } from "./send-until.mjs";   // past a call's time to stop sending, a timed-out question is not split again
 
 // ── — HOW MUCH OF A PROVIDER ERROR SURVIVES INTO THE BAND BLOCK: ALL OF IT ───────────────────────────
 //
@@ -448,7 +449,7 @@ export function makeEnumerate(deps) {
       }
       // A half that timed out while its sibling answered is the one place fewer regions may help: it is
       // halved in turn, under the same rule.
-      const r = timedOut({ r: first })
+      const r = timedOut({ r: first }) && !pastSendUntil(tctx)
         ? await regionHalves(auth, { ...params, regions: half }, tctx, { ceiling, incomplete, cause: parseToolText(first)?.reason ?? cause, hear })
         : first;
       const parsed = isToolError(r) ? null : parseToolText(r);
@@ -637,7 +638,7 @@ export function makeEnumerate(deps) {
             + `Provider's own words: ${clipProviderText(c?.reason ?? "", COUNT_PROBE_BUDGET)}`,
             { crowd_basis: "provider-refused-count", count_unavailable: true });
         }
-        if (splittable && isGatewayTimeout(c?.reason)) return regionHalves(auth, params, tctx, { ceiling, incomplete, cause: String(c.reason), hear });
+        if (splittable && isGatewayTimeout(c?.reason) && !pastSendUntil(tctx)) return regionHalves(auth, params, tctx, { ceiling, incomplete, cause: String(c.reason), hear });
         return incomplete(0, 0, [],
           `provider error on the count probe before enumeration: ${String(c?.reason ?? "count unavailable")}`, timeoutMark(c?.reason));
       }
@@ -670,7 +671,7 @@ export function makeEnumerate(deps) {
         if (page === 0 && allNames && allNames.length > 1 && listRefusal?.test(String(r.text ?? ""))) {
           return enumerateQuestion(auth, params, tctx, { split, width: Math.ceil(allNames.length / 2) }, said);
         }
-        if (splittable && isGatewayTimeout(r.text)) return regionHalves(auth, params, tctx, { ceiling, incomplete, cause: String(r.text), hear });
+        if (splittable && isGatewayTimeout(r.text) && !pastSendUntil(tctx)) return regionHalves(auth, params, tctx, { ceiling, incomplete, cause: String(r.text), hear });
         return incomplete(total, results.length, results, `provider error during enumeration (page ${page}): ${String(r.text ?? "")}`, timeoutMark(r.text));
       }
       const parsed = parseToolText(r);

package/providers/_shared/execute-plan.mjs

@@ -20,6 +20,9 @@ import { nativeScriptIndexGap } from "./script-form.mjs"; import { floorOf, more
 import { entryTermIssues, goodsTermsList } from "./term-shape.mjs";
 import { awaitsReadingTurn, releasedFamiliesFile } from "./plan-guards.mjs";
 import { FOLLOW_UP_SEARCH_LIMIT, runDriverDirOf, followUpRoom, followUpClass, identicalMarkTerms, recordFollowUpSearch, recordOutstanding } from "./follow-up-searches.mjs";
+import { bandWithSlicesOut, slicesTakenOutByAxis } from "../../shared/slices-taken-out.mjs";
+import { pathInRun } from "../../shared/inside-run.mjs";   // a plan or a band path is served only inside this run
+import { pastSendUntil } from "./send-until.mjs";   // a call past its time to stop sending sends no new question   // a band read as answers, with the slices a check could not prove ran taken out
 
 /** How soon after an answer lands it is written to the band, while the call goes on (see `keepAnswers` below). */
 export const KEEP_ANSWERS_AFTER_MS = 2000;
@@ -344,6 +347,14 @@ export function makeExecutePlan(deps) {
     const outPath = String(params?.output_path ?? "");
     if (!planPath || !axis || !outPath)
       return { type: "text", text: "ERROR: plan_path, axis and output_path are all required." };
+    // THIS RUN'S PLAN, AND THIS RUN'S BAND (shared/inside-run.mjs). The run is the one its record log names, never the
+    // call's; a search outside a run has none to confine it to.
+    const runOf = runDriverDirOf(tctx?.recordLog);
+    if (runOf) {
+      const run = dirname(runOf);
+      if (pathInRun(run, planPath) === null) return { type: "text", text: "ERROR: plan_path is outside this run's folder. Use the frozen plan path the driver gave you." };
+      if (pathInRun(run, outPath) === null) return { type: "text", text: "ERROR: output_path is outside this run's folder. Use the band path the driver gave you." };
+    }
     let plan;
     try { plan = JSON.parse(readFileSync(planPath, "utf8")); }
     catch (err) { return { type: "text", text: `ERROR: cannot read the plan at ${planPath}: ${err.message}` }; }
@@ -375,10 +386,20 @@ export function makeExecutePlan(deps) {
       try { identicalTerms = identicalMarkTerms(JSON.parse(readFileSync(join(driverDir, "register-plan.json"), "utf8"))); } catch { /* no frozen plan: no identical terms known */ }
     }
     const refused = [];
+    // THE BAND AS ANSWERS, for the checks below that read it so: a slice the run's searches record took out of the band,
+    // because a check could not prove it ran, is read as the open slice it was delivered as, whatever wrote the band
+    // since (shared/slices-taken-out.mjs). The run is the band's own, as the propose tool reads it. The writes below
+    // still merge the file as it stands.
+    const asAnswers = (file) => {
+      const prior = JSON.parse(readFileSync(file, "utf8"));
+      return Array.isArray(prior) ? bandWithSlicesOut(prior, slicesTakenOutByAxis(dirname(dirname(outPath))).get(axis)).blocks : prior;
+    };
+    const bandAsAnswers = () => asAnswers(outPath);
     // The follow-ups this axis's band already answers, read once and only when the net meets a question sent before:
-    // an answered one adds nothing when it is sent again, and a failed one counts again. A unit whose pass was killed at
-    // its time limit is parked: its band is renamed (`<band>.tainted-<n>`) so the resume runs the unit again, and the
-    // re-run sends the same follow-ups. Their answers are in the renamed band, so they count nothing either.
+    // an answered one adds nothing when it is sent again, and a failed one counts again, as does one taken out. A unit
+    // whose pass was killed at its time limit is parked: its band is renamed (`<band>.tainted-<n>`) so the resume runs the
+    // unit again, and the re-run sends the same follow-ups. Their answers are in the renamed band, so they count nothing
+    // either. Every band on record is read as answers, so a slice taken out counts again whichever band holds it.
     let answeredQids = null;
     // This axis's band, and the bands a parked pass left (`<band>.tainted-<n>`), oldest first and the band's own last.
     const bandsOnRecord = () => {
@@ -393,7 +414,7 @@ export function makeExecutePlan(deps) {
         answeredQids = new Set();
         for (const band of bandsOnRecord()) {
           try {
-            const prior = JSON.parse(readFileSync(band, "utf8"));
+            const prior = asAnswers(band);
             for (const b of Array.isArray(prior) ? prior : []) if (b?.qid && b.error !== true) answeredQids.add(String(b.qid));
           } catch { /* no band yet: nothing answered */ }
         }
@@ -426,7 +447,7 @@ export function makeExecutePlan(deps) {
     const seeded = new Set();
     if (qidsFilter) {
       try {
-        const existing = JSON.parse(readFileSync(outPath, "utf8"));
+        const existing = bandAsAnswers();   // a parent taken out of the band releases no child
         if (Array.isArray(existing)) {
           for (const b of existing) {
             if (b && typeof b === "object" && b.qid && typeof b.state === "string" && !qidsFilter.has(b.qid)) {
@@ -695,7 +716,11 @@ export function makeExecutePlan(deps) {
     // change the answer. An unhandled fault here is an unknown of unknown durability, so it keeps the
     // transient reading. The reason names it an EXECUTOR fault so it is never read as something the
     // register said — a block that fabricated a provider response would be the worse defect.
+    // PAST ITS TIME TO STOP SENDING, A CALL SENDS NO NEW QUESTION (send-until.mjs). The question is not reached by
+    // this call and keeps whatever block the band holds for it; the call returns what it has, naming it.
+    const notReached = [];
     const runEntry = async (e) => {
+      if (pastSendUntil(tctx)) { notReached.push(e.qid); return; }
       if (driverDir && followUpClass(e, { identicalTerms }) === "counted") {
         const room = followUpRoom(driverDir, FOLLOW_UP_SEARCH_LIMIT, e, { answered: answeredBefore });
         if (!room.open) {
@@ -754,8 +779,8 @@ export function makeExecutePlan(deps) {
     // fringe) gets no block and any stale one is dropped (a fringe slice must never outlive its
     // parent's crowd verdict). This makes the initial call and every warm followup the SAME call.
     // A follow-up the net did not send is not owned by this call: whatever answer it already had stands.
-    const refusedSet = new Set(refused);
-    const owned = new Set(targeted.map((e) => e.qid).filter((q) => !refusedSet.has(q)));
+    const refusedSet = new Set(refused), notReachedSet = new Set(notReached);
+    const owned = new Set(targeted.map((e) => e.qid).filter((q) => !refusedSet.has(q) && !notReachedSet.has(q)));
     let preserved = [];
     try {
       const existing = JSON.parse(readFileSync(outPath, "utf8"));
@@ -793,6 +818,7 @@ export function makeExecutePlan(deps) {
       states: Object.fromEntries([...stateByQid].filter(([q]) => !seeded.has(q))),
       ...(Object.keys(spellingCounts).length ? { spelling_counts: spellingCounts } : {}),
       ...(refused.length ? { outstanding: refused } : {}),
+      ...(notReached.length ? { not_reached: notReached } : {}),
     }, null, 2) };
   };
 }

package/providers/_shared/send-until.mjs

@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// send-until.mjs — the time after which a plan call sends no further question to the register.
+//
+// A plan call runs inside a model's turn, and the turn has a deadline. When the call outlasted it, the call and the
+// turn ended together, so the unit could not write what the call had answered: on a production run on 2026-10-21 a
+// unit's plan search ran into the register's gateway timeouts on every attempt and never wrote its result. The
+// driver now hands each turn's tool servers a time to stop sending (CLEAROTRON_GATHER_SEND_UNTIL_MS, set per turn by
+// the gateway, ahead of the turn's own deadline by a reserve). Past it, the executor sends no new question and a
+// timed-out question is not split again; the call returns what it holds and the turn has the time to write it.
+//
+// A pure leaf. A call with no time to stop sending, the driver's own dispatches among them, runs as it always did.
+
+/** The gateway's reserve for a turn of `timeoutSec`: a quarter of the turn, and never more than five minutes. */
+export const sendReserveMs = (timeoutSec) => Math.min(300_000, Math.max(0, Number(timeoutSec) || 0) * 250);
+
+/** Whether a call given `tctx` is past its time to stop sending. False when it has none. */
+export function pastSendUntil(tctx, now = Date.now()) {
+  const until = Number(tctx?.sendUntilMs);
+  return Number.isFinite(until) && until > 0 && now >= until;
+}
+
+/** The call context's time to stop sending, read from the environment a turn's tool server was started with. */
+export const sendUntilFromEnv = (env = process.env) => Number(env.CLEAROTRON_GATHER_SEND_UNTIL_MS) || null;

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,13 @@
 # trademark-oauth-mcp-bridge
 
+## 0.5.0-beta.4
+
+No changes in this release.
+
+## 0.5.0-beta.3
+
+No changes in this release.
+
 ## 0.5.0-beta.2
 
 No changes in this release.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.5.0-beta.2",
+  "version": "0.5.0-beta.4",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/scripts/band-shape-probe.mjs

@@ -65,7 +65,7 @@ if (!/^\d+$/.test(String(opts.seed)) || Number(opts.seed) <= 0)
 
 // ── the inputs deriveBandShape uses, read the same way it reads them ─────────────────────────────────
 //
-// Deliberately mirrors driver/pipeline.mjs:441-490 mergeRegisterBands rather than inventing a gathering step. If the two
+// Deliberately mirrors driver/pipeline.mjs:501-563 mergeRegisterBands rather than inventing a gathering step. If the two
 // diverge, this probe measures a shape the run never had.
 
 const runDir = opts.run;

package/scripts/e2e-first-time.mjs

@@ -76,7 +76,7 @@ export const COUNTED_EVENTS = {
   "post-repair-correction-unrecoverable": FAILED, "post-repair-state-not-kept": FAILED,
   "digest-flush-timeout": FAILED, "document-coverage-render-failed": FAILED, "doubts-failed": FAILED,
   "evidence-claim-invariant": { kind: FAILED, when: (e) => e.ok === false || Number(e.violations) > 0 },
-  "floor-duty-failed": FAILED, "frame-reopen-redigest-failed": FAILED, "goods-evidence-failed": FAILED, "placement-decisions-failed": FAILED, "placement-band-ids-failed": FAILED, "late-evidence-failed": FAILED, "band-refused-records-failed": FAILED, "verdict-write-deferred": FAILED, "ranking-read-by-writer-failed": FAILED, "audit-rebuild-failed": FAILED, "audit-build-failed": FAILED, "write-up-goods-from-failed": FAILED, "house-element-ownership-failed": FAILED,
+  "floor-duty-failed": FAILED, "frame-reopen-redigest-failed": FAILED, "goods-evidence-failed": FAILED, "placement-decisions-failed": FAILED, "placement-band-ids-failed": FAILED, "late-evidence-failed": FAILED, "band-refused-records-failed": FAILED, "verdict-write-deferred": FAILED, "ranking-read-by-writer-failed": FAILED, "audit-rebuild-failed": FAILED, "audit-build-failed": FAILED, "write-up-goods-from-failed": FAILED, "declination-goods-states-failed": FAILED, "house-element-ownership-failed": FAILED,
   "intake-asks-missing": FAILED, "invalid-artifact-strikes": FAILED, "knockout-band-checks-inert": FAILED,
   "knockout-in-use-as-unanswered": FAILED, "knockout-ladder-unreadable": FAILED, "knockout-method-checks-inert": FAILED,
   "knockout-owner-checks-failed": FAILED, "knockout-register-records-failed": FAILED, "knockout-sweep-outage": FAILED,
@@ -231,6 +231,7 @@ export const NOT_COUNTED_EVENTS = {
   ],
   "the twin of an incident counted under another record — its dispatch, its repair, its clamp or its failure": [
     "assessment-not-completed-delivery", "part-completed", "overview-not-completed-delivery", "review-not-completed-delivery",
+    "core-artifact-restored", "searches-not-completed-delivery", "unit-not-completed-delivery",
     "action-reemit", "ask-answer-reemit", "authority-write-denied", "connotation-remedy", "corrections-applied",
     "corrective-cycle-receipt", "corrective-cycle-settled", "corrective-findings-stale", "coverage-absence-rendered",
     "coverage-closure", "coverage-ledger-recovered", "delivery-stale-repair", "delivery-stale-requeued", "envelope-close-rows", "escalation-noop", "floor-duty-after-repair", "writer-duty-after-repair", "writer-duty-after-correction", "guard-clause-replaced", "guard-gap-closed", "verdict-recomputed-gap-closed", "guard-clause-named-elsewhere", "audit-rebuilt", "audit-withdrawn", "record-carry-doubts-again",

package/scripts/release-notes-lint.mjs

@@ -29,7 +29,7 @@ const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
 export const GROUPS = ["Before you upgrade", "New", "Fixed", "For operators"];
 
 /** At most this many words in a sentence. The contract's number, not a tuned one. */
-export const MAX_WORDS = 25;
+export const MAX_WORDS = 26;
 
 /**
  * Our internal vocabulary. Every one of these is a word we use fluently and the reader has never met in

package/shared/inside-run.mjs

@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// inside-run.mjs — is a path a tool was handed inside THIS run's folder, where it really is?
+//
+// A tool that takes a path served whatever the account could open. Artifact search refused an absolute path and `..`,
+// and still followed a link placed inside the run folder to wherever it pointed; the grid tools took a spec in any
+// run's folder; the register tools read a plan and wrote a band at any path. A run may read nothing from another run,
+// so a tool now resolves the path to its real location, links and `..` included, and serves it only when that
+// location is inside the run's own real folder.
+//
+// A path not written yet is judged by its nearest folder that exists, plus the names below it, none of which may be
+// `..`. A run folder that cannot be resolved holds nothing.
+//
+// A pure leaf: node:fs and node:path only, so every tool server can import it.
+import { lstatSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+
+/** The real location of `p`, or of its nearest existing folder plus the names below it; null when neither resolves. */
+function realLocation(p) {
+  const rest = [];
+  let at = resolve(p);
+  for (;;) {
+    try { return join(realpathSync(at), ...rest.reverse()); }
+    catch (e) {
+      if (e?.code !== "ENOENT" && e?.code !== "ENOTDIR") return null;
+      // A link whose target is missing is not a name still to be written: a write through it lands where it points.
+      try { lstatSync(at); return null; } catch { /* nothing at all is there */ }
+      const up = dirname(at);
+      if (up === at) return null;
+      rest.push(basename(at));
+      at = up;
+    }
+  }
+}
+
+/**
+ * Where `p` really is relative to the run folder `runDir` — a relative path that never starts with `..` — or null when
+ * it is outside the run, or either cannot be resolved. "" is the run folder itself. PURE but for the reads of the disk.
+ */
+export function pathInRun(runDir, p) {
+  if (typeof runDir !== "string" || !runDir || typeof p !== "string" || !p) return null;
+  let root;
+  try { root = realpathSync(runDir); } catch { return null; }
+  const real = realLocation(isAbsolute(p) ? p : join(runDir, p));
+  if (!real) return null;
+  const rel = relative(root, real);
+  if (rel === "") return "";
+  if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) return null;
+  return rel;
+}
+
+/** True when `p` is really inside the run folder `runDir`. */
+export const insideRun = (runDir, p) => pathInRun(runDir, p) !== null;

package/shared/names-in-force.mjs

@@ -71,6 +71,7 @@ export const NAMES_IN_FORCE = Object.freeze([
   "CLEAROTRON_FRAME_REOPEN_MAX",
   "CLEAROTRON_GATHER_AGENT",
   "CLEAROTRON_GATHER_CONCURRENCY",
+  "CLEAROTRON_GATHER_SEND_UNTIL_MS",
   "CLEAROTRON_GATHER_SESSION_ID",
   "CLEAROTRON_GATHER_SESSION_KEY",
   "CLEAROTRON_HARD_MS",