clearotron 0.5.0-beta.5 → 0.5.0-beta.6

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "a475b2f2632ee5df27bc7248bd73d27d6fc6f5c3",
-  "version": "0.5.0-beta.5"
+  "commit": "c4d6c8b42431a476839b819ac5181e09fb6c1cf1",
+  "version": "0.5.0-beta.6"
 }

package/driver/CHANGELOG.md

@@ -1,5 +1,14 @@
 # clearotron-driver
 
+## 0.5.0-beta.6
+
+### Patch Changes
+
+- Fixed: A clearance on the Signa register no longer loses searches to a brief rate limit; it waits as long as the register asks and searches again.
+- Fixed: A clearance resumed after an interruption now searches the territories the order named, not the account's default markets.
+- Fixed: A wider register search is no longer set aside because a narrower search returned a short list; the engine now weighs what each waiting search could add to the advice and records its reason.
+- Fixed: The lawyer's report now says why a search was not carried out: the register refused it for the day and a later run can repeat it, or the register cannot run that kind of search at all.
+
 ## 0.5.0-beta.5
 
 ### Patch Changes

package/driver/contract-e3-backlog.mjs

@@ -409,7 +409,7 @@ export const E3_BACKLOG = [
   {
     stage: "register-digest",
     kind: "exactly-these-keys",
-    where: "driver/skills/clearance-register/SKILL.md:226-227",
+    where: "driver/skills/clearance-register/SKILL.md:228-229",
     surface: "skill-file",
     evidence: "**The status vocabulary is CLOSED: EXACTLY one bare token of: `confirmed-clean` / `coverage-limited` / `deferred` / `withheld-by-judgment`.** Qualifiers never go in a status cell; they go in the reason.",
     reparsedBy: "driver/coverage-form.mjs / driver/coverage-ledger.mjs. Since the typed-transport conversion the STAGE MESSAGE no longer restates the enum; the surviving copies are SKILL.md (here), digest.md:207, the dispatch brief (coverage-form.mjs coverageFormBrief), the record_coverage schema (coverage-server.mjs) and gateway.mjs's repair hints — still one enum spelled at five sites",

package/driver/coverage-form.mjs

@@ -31,7 +31,7 @@
 import { REGISTER_AXES, COVERAGE_STATUSES, normalizeAxis, CROWD_RULING_TOKEN,
   CROWD_RULING_UNIT_GRAMMAR } from "./coverage-ledger.mjs";
 import { shortId } from "./connotation-search.mjs";
-import { openBlocksByAxis, crowdNarrowing, blocksByQidOf, isProviderHardErrorReason } from "./register-plan.mjs";
+import { openBlocksByAxis, crowdNarrowing, blocksByQidOf, isProviderHardErrorReason, refusedSearchSentence } from "./register-plan.mjs";
 import { territoryLayerReport, unsearchedLayerReason } from "./binding-layers.mjs"; import { goodsTermsList } from "../providers/_shared/term-shape.mjs";
 
 const STATUS_SET = new Set(COVERAGE_STATUSES);
@@ -979,7 +979,8 @@ export function renderCoverageLedgerSection(rows) {
         Number.isInteger(r.total_hits) ? `${r.total_hits} hits` : "",
         r.unaccounted_classes?.length ? `classes unaccounted: ${r.unaccounted_classes.join(", ")}` : "",
         r.unaccounted_terms?.length ? `terms unaccounted: ${r.unaccounted_terms.join(", ")}` : "",
-        r.receipt_reason ? `receipt: ${r.receipt_reason}` : "",
+        // A search the register refused reads as the owner's sentence for it, not as its recorded line.
+        r.receipt_reason ? `receipt: ${refusedSearchSentence(r.receipt_reason) ?? r.receipt_reason}` : "",
       ].filter(Boolean).join("; ");
       const reason = [cell(r.reason), detail ? `(${cell(detail)})` : ""].filter(Boolean).join(" ");
       return `| ${cell(r.unit)} | ${cell(String(r.status).trim().toLowerCase())} | ${reason} | ${cell(r.qid ?? "—")} |`;
@@ -1075,7 +1076,7 @@ function briefRow(r) {
     Number.isInteger(r.total_hits) ? `${r.total_hits} hits` : "",
     r.unaccounted_classes?.length ? `classes unaccounted: ${r.unaccounted_classes.join(", ")}` : "",
     r.unaccounted_terms?.length ? `terms unaccounted: ${r.unaccounted_terms.join(", ")}` : "",
-    r.receipt_reason ? `receipt: ${String(r.receipt_reason).slice(0, 160)}` : "",
+    r.receipt_reason ? `receipt: ${refusedSearchSentence(r.receipt_reason) ?? String(r.receipt_reason).slice(0, 160)}` : "",
     // what was retrieved under the crowd (register-plan.mjs, crowdNarrowing), as data beside the counts it rests on
     r.narrowing ? `narrowing: ${r.narrowing}${r.lists?.length ? ` (${r.lists.slice(0, 6).join(", ")})` : ""}${r.not_covered?.length ? `; not covered: ${r.not_covered.slice(0, 12).join(", ")}` : ""}` : "",
   ].filter(Boolean).join("; ");

package/driver/owner-screen.mjs

@@ -146,7 +146,7 @@ function sliceState(entry, block) {
 /** Plain-English reason a slice is not an enumerated answer (null when it is). PURE. */
 function sliceReason(entry, block, deferredReason, capabilities) {
   if (entry?.unsupported === true)
-    return str(entry.unsupported_reason) || `the active register provider (${str(capabilities?.id) || "unknown"}) has no owner surface — this slice was never searched`;
+    return str(entry.unsupported_reason) || `the active register provider (${str(capabilities?.id) || "unknown"}) has no owner surface — this search was never carried out`;
   if (!block) return "no band block carries this qid — the slice is unaccounted for, never a clean";
   if (block.deferred === true) return str(deferredReason) || str(block.reason).slice(0, 300);
   if (block.error === true) return `provider error — the slice never really ran: ${str(block.reason).slice(0, 200)}`;

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.5.0-beta.5",
+  "version": "0.5.0-beta.6",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline.mjs

@@ -65,7 +65,7 @@ import { reconcileRecall, parseFindingsEndings, parseCrowdRulings, readOkRecordU
 import { buildCrowdContext, CROWD_CONTEXT_AXIS } from "./crowd-context.mjs";
 import { writeUpForm, gradedWriteUpRung } from "./write-up-form.mjs";   // §8/§9 — which findings earn a full card
 import { shortEntryBody, groupEntries, buildGradedEntriesSection } from "./write-up-render.mjs";
-import { compileRegisterPlan, parseRegisterPlan, resolvePlanAgainstStore, joinPlanToBands, crowdNarrowing, marketStepMarkets, blocksByQidOf, deriveCoverageSkeleton, validatePlanFeasibility, feasibilityMessages, foldSupplementalEntries, withheldFamilyTwins, pendingRequiredQids, refuseWithheldFamilies, partitionFoldDirectives, screenThenCap, fullyDeferredAxes, variantTermIssue, searchedJurisdictionsFromPlan, PLAN_AUDIT_HEAD, PLAN_AUDIT_CLASSES, deferExhaustedProviderErrors, ladderExhaustedQids, isProviderHardErrorReason } from "./register-plan.mjs";
+import { undoneSearchesNote, compileRegisterPlan, parseRegisterPlan, resolvePlanAgainstStore, joinPlanToBands, crowdNarrowing, marketStepMarkets, blocksByQidOf, deriveCoverageSkeleton, validatePlanFeasibility, feasibilityMessages, foldSupplementalEntries, withheldFamilyTwins, pendingRequiredQids, refuseWithheldFamilies, partitionFoldDirectives, screenThenCap, fullyDeferredAxes, variantTermIssue, searchedJurisdictionsFromPlan, PLAN_AUDIT_HEAD, PLAN_AUDIT_CLASSES, deferExhaustedProviderErrors, ladderExhaustedQids, isProviderHardErrorReason } from "./register-plan.mjs";
 // — ONE binding of the office split to this box's env, shared with Depth 2's two lanes.
 import { registerCapabilities, registerUnavailableOffices } from "./register-unreachable.mjs";
 import { parseVariantManifestModel, famousMarkElements } from "./variant-manifest-model.mjs";
@@ -131,7 +131,7 @@ import { publishReport, composeEmailHtml, deliverySubject } from "./publish/inde
 import { parseCaseLawProfiles, joinCaseLawProfiles } from "./publish/parse.mjs";
 import { buildAuditMd, parseSpineFindingBlocks } from "./publish/audit-from-spine.mjs";
 import { deriveRegisterPresence } from "./publish/register-presence.mjs";   // — the audit stores every live in-scope record
-import { lastAcceptedMatterFrame, withFrameClasses, frameIdentifiedClassRows, frameHouseElementCandidate } from "./matter-frame-record.mjs";   // — the frame's inferred scope, when nothing was instructed; and the classes it judged necessary beyond the instructed ones, each with its reason, which the plan compile gives one identical-mark question apiece (decision 18)
+import { lastAcceptedMatterFrame, withFrameClasses, frameIdentifiedClassRows, frameHouseElementCandidate, readInstructedScope } from "./matter-frame-record.mjs";   // — the frame's inferred scope, when nothing was instructed; and the classes it judged necessary beyond the instructed ones, each with its reason, which the plan compile gives one identical-mark question apiece (decision 18)
 import { bandShapeGoods, instructedOrder, goodsEvidence } from "./record-goods.mjs";   // — the band's goods, read from the run's own records, so the shape can sort by the client's goods
 import { frameWebChoiceFor, frameAskedForWebGrid, webGridOf, closureBlocksOf } from "./web-grid.mjs";   // — the web grid the matter frame decides: its stores, its forms, what it set aside
 import { romanizedTermsFromPlan, mintSupplementalQid } from "./register-plan.mjs";
@@ -13634,9 +13634,11 @@ async function pipelineInner(job, opts = {}) {
       // A2 — held axes are DISCLOSED, never silently absent: the note is what the report's front matter
       // renders, and a gap nothing can close is precisely the gap the lawyer must be told about. It
       // rides beside any close note rather than replacing it.
+      // The account is the owner's sentences (approved 2026-10-30): the searches the register refused during the run apart
+      // from the ones it does not support, each refused one with the register's recorded answer, read from the receipt.
       const capabilityHeldAxes = heldAxes.filter((a) => !nothingToSendOnly(a));
       if (capabilityHeldAxes.length) {
-        const heldNote = `deferred coverage (${capabilityHeldAxes.join(", ")}) cannot be closed by any re-run — the active register provider cannot express those slices; the gap stays open and disclosed`;
+        const heldNote = undoneSearchesNote(ctx.registerPlan, envelopeReceipt, capabilityHeldAxes);
         ctx.envelopeNote = ctx.envelopeNote ? `${ctx.envelopeNote}; ${heldNote}` : heldNote;
       }
       refreshSupplementalExecution(ctx);   // envelope closes may have PROPOSED supplementals — account for them
@@ -18120,21 +18122,31 @@ function resolveRun(job, opts) {
  * is the person trying to repair it.
  *
  * This is not a guess at the job. `seedRunStatus` writes these fields FROM the job the engine ran, so
- * reading them back is the engine's own record, not a reconstruction of intent. What it cannot carry is
- * scope, and it does not have to: `reconstructCtx` reads profile and framework from the run's frozen
- * sidecars with `write: false`, so the run's own configuration governs and the job supplies identity.
+ * reading them back is the engine's own record, not a reconstruction of intent. `reconstructCtx` reads
+ * profile and framework from the run's frozen sidecars with `write: false`, so the run's own configuration
+ * governs and the job supplies identity.
+ *
+ * THE ORDER'S TERRITORIES COME FROM THE RUN'S INSTRUCTED SCOPE, `scope` here. Status does not carry
+ * them, and the stage messages read them off the job: the narrowing line names "one
+ * question per market of the order's scope", and the default-territories line says whether the request
+ * named any. A job without them fell back to the account's defaults, so a stage re-run on a saved run was
+ * told markets the order never named (measured, 2026-10-29: four in place of the order's three). The run
+ * wrote `jurisdictions` and `geography` verbatim from its job at intake (`instructedScopeOf`), so copying
+ * them back gives the job its own territories, not a reading of them.
  *
  * THE CALLER MUST CHECK THE SLUG, and `resumeJobRefusal` below is that check. A rebuilt job that derives
  * the run's own slug has reproduced the run's identity — `deriveSlug` reads `ref` and `markName` and
  * nothing else — and one that derives a different slug is a job for a different matter.
  */
-export function jobFromStatus(status) {   // @internal
+export function jobFromStatus(status, scope = null) {   // @internal
   const s = status ?? {};
   if (!s.id && !s.ref && !s.markName) return null;   // not a status this can rebuild from
   return {
     id: s.id ?? null, ref: s.ref ?? null, markName: s.markName ?? null,
     classes: Array.isArray(s.classes) ? s.classes : null,
     forwarder: s.forwarder ?? null,
+    ...(Array.isArray(scope?.jurisdictions) ? { jurisdictions: scope.jurisdictions } : {}),
+    ...(scope?.geography && typeof scope.geography === "object" ? { geography: scope.geography } : {}),
   };
 }
 
@@ -19025,10 +19037,13 @@ if (isEntrypoint(import.meta.url)) void (async () => {
     let status = null;
     try { status = JSON.parse(readFileSync(join(found.dir, "status.json"), "utf8")); }
     catch (e) { console.error(`error: cannot read ${join(found.dir, "status.json")} — ${e.message}`); process.exit(2); }
-    job = jobFromStatus(status);
+    const scope = readInstructedScope(found.dir);
+    job = jobFromStatus(status, scope);
     const refusal = resumeJobRefusal(job, found.slug);
     if (refusal) { console.error(`error: ${refusal}`); process.exit(2); }
-    console.error(`[pipeline] --job not given; rebuilt the job for ${a.codename} from ${join(found.dir, "status.json")} (slug ${found.slug} confirmed)`);
+    console.error(`[pipeline] --job not given; rebuilt the job for ${a.codename} from ${join(found.dir, "status.json")} (slug ${found.slug} confirmed)`
+      + (scope ? "; the order's territories from its instructed scope"
+        : "; the run holds no readable instructed scope, so its territories fall back to the account's defaults"));
   } else {
     try { job = JSON.parse(readFileSync(a.job, "utf8")); }
     catch (e) { console.error(`error: cannot read job file ${a.job} — ${e.message}`); process.exit(2); }

package/driver/register-plan.mjs

@@ -174,11 +174,11 @@ export { AWAITS_READING_TURN, awaitsReadingTurn, guardParentQid };
 // that is the point.
 export const unsupportedPredicateReason = (predicate, providerId) =>
   `predicate "${predicate}" is not supported by the active register provider (${providerId}) — that capability is absent, `
-  + `so this slice was never searched. It is a deferred gap for judgment, never a clean negative.`;
+  + `so this search was never carried out. It is a deferred gap for judgment, never a clean negative.`;
 
 export const uncoveredJurisdictionReason = (jurisdictions, providerId) =>
   `jurisdiction ${[...jurisdictions].join(", ")} is not covered by the active register provider (${providerId}) — `
-  + `the office is outside the provider's coverage, so this slice was never searched. It is a deferred gap for `
+  + `the office is outside the provider's coverage, so this search was never carried out. It is a deferred gap for `
   + `judgment, never a clean negative.`;
 
 // ──: an office the provider COVERS but this deployment cannot reach ─────────────────────────────
@@ -204,7 +204,7 @@ export const uncoveredJurisdictionReason = (jurisdictions, providerId) =>
 export const officeUnavailableReason = (jurisdictions, providerId, { memberId, missing = [] } = {}) =>
   `jurisdiction ${[...jurisdictions].join(", ")} is not covered by the active register provider (${providerId}) `
   + `AS THIS DEPLOYMENT IS CONFIGURED — the source that serves it (${memberId ?? "unknown"}) is not wired up here`
-  + `${missing.length ? ` (${missing.join(" + ")} unset)` : ""}, so this slice was never searched. The provider `
+  + `${missing.length ? ` (${missing.join(" + ")} unset)` : ""}, so this search was never carried out. The provider `
   + `does cover this office: set the variable and re-run to close it. It is a deferred gap for judgment, `
   + `never a clean negative.`;
 
@@ -217,7 +217,7 @@ export const officeUnavailableReason = (jurisdictions, providerId, { memberId, m
 // what a new one lands in, and the reason below is the sentence it lands with.
 export const ownerIntersectionUnsupportedReason = (providerId) =>
   `owner×term intersection is not supported by the active register provider (${providerId}) — the owner scope `
-  + `field cannot be combined with mark text there, so this slice was never searched. It is a deferred gap for `
+  + `field cannot be combined with mark text there, so this search was never carried out. It is a deferred gap for `
   + `judgment, never a clean negative.`;
 
 /** Is an owner×term entry executable on the provider? null when it is (or when no contract/owner). */
@@ -248,7 +248,7 @@ export function ownerIntersectionGap(entry, capabilities) {
 export const goodsTextUnsupportedReason = (providerId) =>
   `goods-and-services text narrowing is not supported by the active register provider (${providerId}) — the `
   + `goods description cannot be searched there, so the narrowed sweep this entry asks for was never run. `
-  + `Running it on the class alone would have returned the crowd the narrowing exists to cut, so the slice `
+  + `Running it on the class alone would have returned the crowd the narrowing exists to cut, so the search `
   + `is deferred. It is a gap for judgment, never a clean negative.`;
 
 /** Is a goods-narrowed entry executable on the provider? null when it is (or when it asks for no goods text). */
@@ -2796,6 +2796,60 @@ export const isProviderHardErrorReason = (reason) => {
   return s.startsWith(PROVIDER_HARD_ERROR_PREFIX) || s.startsWith(PROVIDER_PERMANENT_ERROR_PREFIX);
 };
 
+// ── WHY A SEARCH WAS NOT CARRIED OUT, IN THE LAWYER'S WORDS (the owner's sentences, approved 2026-10-30) ──────────────
+//
+// The front matter gave every search the register left undone one account: the provider cannot express it. That is
+// true of a search the register does not support, and false of one it refused during the run, such as on a spent daily
+// limit, which a later run can repeat. Each kind now has its own sentence. The refused one also stands beside each
+// refused search in the coverage ledger, in place of its recorded line, which is written for the run's record and not
+// for a reader; an unsupported search keeps its own line there, which names what the register lacks. The refused sentence
+// names the register's recorded answer in its bracket: a daily limit, a rate limit, or no answer. Any other answer gets
+// no bracket. The run's record keeps the recorded line.
+export const REFUSAL_BRACKETS = Object.freeze({
+  "daily-limit": "its daily limit was reached",
+  "rate-limited": "it was rate-limited",
+  "not-responding": "it was not responding",
+});
+export const refusedSearchesSentence = (cause = null) =>
+  `These searches were not carried out because the register refused them during this run${REFUSAL_BRACKETS[cause] ? ` (${REFUSAL_BRACKETS[cause]})` : ""}; a later run can repeat them.`;
+export const UNSUPPORTED_SEARCHES_SENTENCE = "These searches cannot be carried out because the register does not support this kind of search; no run can close this gap.";
+
+/** The register's recorded answer to a search it refused, as a bracket: a 429 or rate limit that names a daily limit
+ *  (Signa's `daily_credit_cap_exceeded`, which clears at UTC midnight), any other 429 or rate limit, and a 5xx or no
+ *  answer at all. Signa's `insufficient_credits` is a used-up credit balance, which retrying cannot clear until the
+ *  balance changes: none of the three, so like anything else it is null. PURE. */
+export function refusalCause(reason) {
+  const s = String(reason ?? "");
+  const status = Number((s.match(/\bHTTP (\d{3})\b/i) ?? [])[1] ?? NaN);
+  if (status === 429 || /(?:^|[^a-z])rate[_ -]?limit/i.test(s)) {
+    if (/daily/i.test(s)) return "daily-limit";
+    return /insufficient[_ ]credits?/i.test(s) ? null : "rate-limited";
+  }
+  if (status >= 500 && status <= 599) return "not-responding";
+  if (!(status >= 400 && status <= 499) && /\btimed out\b|\btimeout\b|ETIMEDOUT|ECONNRESET|ECONNREFUSED|ENOTFOUND|EAI_AGAIN|socket hang up|fetch failed/i.test(s))
+    return "not-responding";
+  return null;
+}
+
+/** The sentence that stands beside one search the register refused, by its recorded line; null for any other line,
+ *  which stands as recorded. PURE. */
+export const refusedSearchSentence = (reason) => (isProviderHardErrorReason(reason) ? refusedSearchesSentence(refusalCause(reason)) : null);
+
+/**
+ * The front matter's account of the searches left undone on the axes no re-run can close: the refused ones first, one
+ * sentence per recorded answer in the brackets' order, then the unsupported ones. `axes` are those axes; the receipt's
+ * deferred rows on them are the searches. Each such axis holds at least one search the register does not support, which
+ * is what holds it, so the unsupported sentence always closes the note. A refused search on the same axis keeps its own
+ * sentence rather than taking the axis's (ruled 2026-10-30). PURE.
+ */
+export function undoneSearchesNote(plan, receipt, axes) {
+  const axisOf = new Map((plan?.entries ?? []).map((e) => [String(e?.qid ?? ""), String(e?.axis ?? "").toLowerCase()]));
+  const on = new Set([...(axes ?? [])].map((a) => String(a).toLowerCase()));
+  const refused = (receipt?.deferred ?? []).filter((d) => on.has(axisOf.get(String(d?.qid ?? ""))) && isProviderHardErrorReason(d?.reason));
+  const causes = new Set(refused.map((d) => refusalCause(d.reason)));
+  return [...[...Object.keys(REFUSAL_BRACKETS), null].filter((c) => causes.has(c)).map((c) => refusedSearchesSentence(c)), UNSUPPORTED_SEARCHES_SENTENCE].join(" ");
+}
+
 /** Every qid this run has already taken through the fan-in ladder, per its own last receipt. PURE. */
 export function ladderExhaustedQids(receipt) {
   const out = new Set();

package/driver/score-redaction.mjs

@@ -64,6 +64,10 @@ const PROSE_KEYS = new Set([
   // (zero `sheet` keys in a real run's findings, checked on R19 `a46abdad`), so prose costs nothing and
   // is right for what arrives. See the note below on why that is luck rather than design.
   "sheet",
+  // The carry-through rows' own prose, from `carryThroughRows` below. `subject_cell` is a common-law
+  // subject cell whole, "<entity> — <what they do>". `section` is the heading the row sits under in the
+  // run's own markdown, and a heading can name the party its table is about.
+  "subject_cell", "section",
 ]);
 
 /** Fields that carry a name: a mark, a proprietor, a subject, a form of a mark. */
@@ -83,10 +87,16 @@ const NAME_KEYS = new Set([
   // by a different route. Read at its site (the per-territory query roll) rather than inferred: it is
   // `e.term ?? e.terms[0]` off the frozen plan's own query entries.
   "term",
+  // A common-law row's identifier, from `carryThroughRows` below: a site's address, whose domain is
+  // usually the party's name. It has no whitespace, so it adds no derived word.
+  "url",
 ]);
 
 /** Arrays whose entries are bare names rather than objects. */
-const NAME_LIST_KEYS = new Set(["covers_marks", "close_variations", "variations", "aliases"]);
+// `searched_marks` and `run_slugs` are not reference keys. score.mjs hands them in beside the reference: the
+// marks the run itself searched, which reach this file through a finding only where a mark has one, and the
+// run's folder, which is named for its mark (phase0.mjs deriveSlug) and printed with every path.
+const NAME_LIST_KEYS = new Set(["covers_marks", "close_variations", "variations", "aliases", "searched_marks", "run_slugs"]);
 
 /**
  * Keys whose strings are NOT a name and NOT matter prose: schema labels, scenario ids, band and level
@@ -196,7 +206,12 @@ export function protectedStrings(root) {
   // party called "Depth Charge" turns `per-territory depth` into `per-territory «name 2»`, and a reader
   // cannot tell a redaction from a word. Both layers still apply to everything the run prints; only a
   // line the SCORER ITSELF authored drops the derived one, through `authoredRedactor` below.
+  //
+  // A WORD THAT IS ALSO A GIVEN NAME IS NOT DERIVED. A run can search a single word that is also a word of a
+  // longer protected name, and the authored lines drop every derived word, so the coverage line printed that
+  // searched mark in clear. A given name stays given whatever else it is a word of.
   const derived = new Set();
+  const given = new Set([...names].map((n) => foldForMatching(n.trim()).folded.toLowerCase()));
   for (const n of [...names]) {
     const parts = n.trim().split(/\s+/);
     if (parts.length < 2) continue;
@@ -209,7 +224,7 @@ export function protectedStrings(root) {
       // ligature is four characters raw and five folded, so a distinctive word was excluded for being
       // short when it is not. Deriving from the folded form makes both decisions right by construction.
       const bare = foldForMatching(w).folded.replace(/[^\p{L}\p{N}]/gu, "");
-      if (bare.length >= 5 && !LEGAL_FORM.has(bare.toLowerCase())) { names.add(bare); derived.add(bare); }
+      if (bare.length >= 5 && !LEGAL_FORM.has(bare.toLowerCase())) { names.add(bare); if (!given.has(bare.toLowerCase())) derived.add(bare); }
     }
   }
   // THE FLOOR STAYS AND THE CASE IT MISSES IS NAMED. A fleet decision on an internal page rather than
@@ -237,6 +252,36 @@ export function protectedStrings(root) {
   return { names, prose, derived, unclassified: [...unclassified].sort() };
 }
 
+/**
+ * The carry-through rows, shaped for `protectedStrings`.
+ *
+ * THEY ARE THE RUN'S OWN TEXT, AND NO OTHER INPUT HOLDS THEM. A row lands in carry-through's `lost`
+ * because its subject arrived nowhere downstream, so it is in neither the findings nor the scored
+ * buckets, and the boundary had nothing to match it against. Measured on an invented fixture: the
+ * default `--json` printed `carry_through.lost[]`'s subject, URL and section heading in clear while the
+ * fields around them were tokenised, and the human path printed the same row under REACHED NONE.
+ *
+ * THE ENTITY IS THE NAME, AND THE WHOLE CELL IS PROSE. The common-law surface writes a subject as
+ * "<entity> — <what they do>". Collected whole as a name, every long word of the description becomes a
+ * derived protected word and tokenises the scorer's own sentences wherever it occurs. So only the head
+ * before the dash is a name, and the cell is withheld whole, as it stands.
+ *
+ * A URL IS A NAME, because a common-law site's domain is usually the party's own name. A register URI
+ * is not collected, for the reason `record_id` is safe: it is an office and a number.
+ */
+export function carryThroughRows({ lost = [], unmeasurable = [], conflicts = [] } = {}) {
+  return [...lost, ...unmeasurable, ...conflicts].map((r) => {
+    const cell = isStr(r.subject) ? r.subject.trim() : "";
+    const head = cell.split(/\s+[—–]\s+/)[0].trim();
+    return {
+      subject: head,
+      ...(cell !== head ? { subject_cell: cell } : {}),
+      section: r.section,
+      ...(isStr(r.identifier) && /^https?:\/\//i.test(r.identifier) ? { url: r.identifier } : {}),
+    };
+  });
+}
+
 /**
  * The line a caller prints when `unclassified` is not empty. Names keys, never values.
  *

package/driver/skills/clearance-register/SKILL.md

@@ -124,6 +124,8 @@ step that gives you a list you can read.
 A list you have read answers the crowd it came from. Do not ask that crowd again without the limits that answered
 it.
 
+A small list for a longer mark or narrower goods does not establish that a distinct root or sound-alike family adds nothing. Judge what that family could add to the advice and record the reason. Where no count is held, do not describe the family as a measured crowd.
+
 The same steps serve any other question that comes back as a crowd, when reading it would change what you tell the client. Before you narrow a wider crowd, write in the proposal what reading it would change. If you cannot, set it aside with its count and your reason. You need not take every step on every crowd. A wider crowd that the lists you have read already
 answer is set aside with its count and your reason. That is finished work, not a gap. The countries the identical
 mark's market step did not read stay on its coverage row with their count, as today.

package/driver/skills/clearance-register/unit.md

@@ -71,6 +71,8 @@ step that gives you a list you can read.
 A list you have read answers the crowd it came from. Do not ask that crowd again without the limits that answered
 it.
 
+A small list for a longer mark or narrower goods does not establish that a distinct root or sound-alike family adds nothing. Judge what that family could add to the advice and record the reason. Where no count is held, do not describe the family as a measured crowd.
+
 The same steps serve any other question that comes back as a crowd, when reading it would change what you tell the client. Before you narrow a wider crowd, write in the proposal what reading it would change. If you cannot, set it aside with its count and your reason. You need not take every step on every crowd. A wider crowd that the lists you have read already
 answer is set aside with its count and your reason. That is finished work, not a gap. The countries the identical
 mark's market step did not read stay on its coverage row with their count, as today.

package/driver/suite-census.json

@@ -909,6 +909,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-job-rebuilt-from-its-run-keeps-the-orders-territories.test.mjs": {
+          "tests": 5,
+          "asserts": 14,
+          "skips": 0,
+          "todos": 0
+        },
         "a-jq-program-in-a-js-string-keeps-its-backslash.test.mjs": {
           "tests": 2,
           "asserts": 6,
@@ -1575,6 +1581,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-refused-search-is-told-apart-from-an-unsupported-one.test.mjs": {
+          "tests": 4,
+          "asserts": 14,
+          "skips": 0,
+          "todos": 0
+        },
         "a-refused-tool-call-is-classified-and-counted.test.mjs": {
           "tests": 6,
           "asserts": 21,
@@ -1649,7 +1661,7 @@
         },
         "a-release-note-is-written-for-its-reader.test.mjs": {
           "tests": 9,
-          "asserts": 66,
+          "asserts": 72,
           "skips": 0,
           "todos": 0
         },
@@ -7377,6 +7389,18 @@
           "skips": 0,
           "todos": 0
         },
+        "the-scorer-withholds-the-carry-through-rows.test.mjs": {
+          "tests": 6,
+          "asserts": 16,
+          "skips": 0,
+          "todos": 0
+        },
+        "the-scorer-withholds-the-searched-marks.test.mjs": {
+          "tests": 5,
+          "asserts": 13,
+          "skips": 0,
+          "todos": 0
+        },
         "the-screen-gate-records-what-its-drops-rest-on.pipeline.test.mjs": {
           "tests": 3,
           "asserts": 20,
@@ -9083,6 +9107,12 @@
           "skips": 0,
           "todos": 0
         },
+        "providers/signa/test/a-rate-limit-refusal-is-waited-out.test.mjs": {
+          "tests": 10,
+          "asserts": 41,
+          "skips": 0,
+          "todos": 0
+        },
         "providers/signa/test/a-search-row-is-a-band-row.test.mjs": {
           "tests": 3,
           "asserts": 15,

package/mcp-server/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-artifacts-mcp
 
+## 0.5.0-beta.6
+
+No changes in this release.
+
 ## 0.5.0-beta.5
 
 No changes in this release.

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.5.0-beta.5",
+  "version": "0.5.0-beta.6",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron",
   "mcpName": "io.github.CordilleraSarl/clearotron",
   "type": "module",
-  "version": "0.5.0-beta.5",
+  "version": "0.5.0-beta.6",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.5.0-beta.5",
+  "version": "0.5.0-beta.6",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/_shared/execute-plan.mjs

@@ -528,7 +528,7 @@ export function makeExecutePlan(deps) {
       if (capabilities && capabilities.ownerTermIntersection !== true
           && typeof e?.owner === "string" && e.owner.trim() && String(e?.predicate ?? "default") !== "owner") {
         blocks.push({ state: "incomplete", ...base, total_hits: 0, fetched: 0, sample: [], error: true, deferred: true,
-          reason: `owner×term intersection is not supported by the active register provider (${capabilities.id ?? "unknown"}) — the owner scope field cannot be combined with mark text there, so this slice was never searched. It is a deferred gap for judgment, never a clean negative.` });
+          reason: `owner×term intersection is not supported by the active register provider (${capabilities.id ?? "unknown"}) — the owner scope field cannot be combined with mark text there, so this search was never carried out. It is a deferred gap for judgment, never a clean negative.` });
         stateByQid.set(e.qid, "error");
         return;
       }

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-oauth-mcp-bridge
 
+## 0.5.0-beta.6
+
+No changes in this release.
+
 ## 0.5.0-beta.5
 
 No changes in this release.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.5.0-beta.5",
+  "version": "0.5.0-beta.6",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/providers/signa/src/core.js

@@ -31,6 +31,7 @@ import { nonAnswerBodyError, parseJsonBody, unparsedBodyError } from "../../_sha
 import { answerKey, compareAnswers, noteAnswer, openAnswerMemory, recallAnswer, rememberAnswer } from "../../_shared/answer-memory.mjs";
 import { makeEnumerate, isOwnerScoped } from "../../_shared/enumerate.mjs";
 import { makeExecutePlan } from "../../_shared/execute-plan.mjs";
+import { pastSendUntil } from "../../_shared/send-until.mjs";
 import CAPABILITIES, { SIGNA_OFFICE_KEYS, OWNER_SCOPED_WINDOW } from "./capabilities.js";
 // The register's own measure of a term's length: case and accents folded, spaces not counted — the same
 // measure its documented floors are stated in (the compiler's foldedTermLength counts the same way).
@@ -98,7 +99,44 @@ const creditsCharged = (resp) => {
 };
 const endpointOf = (method, path) => `${method} ${String(path).split("?")[0].replace(/^(\/v1\/trademarks\/)[^/]+/, "$1{id}")}`;
 
-export async function signaFetch(apiKey, base, path, { method = "GET", body = null, retries = 1, tctx = null } = {}) {
+// ── A RATE-LIMIT REFUSAL IS WAITED OUT, THE WAY THE REGISTER'S OWN DOCUMENTATION SAYS ─────────────
+//
+// Signa's "Rate Limits & Credits" page (docs.signa.so/api-reference/rate-limits): a 429 carries one of
+// three error types, and only `rate_limited` (too many requests per minute, or too many searches running
+// at once) clears by waiting: "Wait `Retry-After` seconds, then retry." `Retry-After` is in seconds and
+// comes only on a 429, and an error is never billed. `daily_credit_cap_exceeded` and
+// `insufficient_credits` do not clear within a call, so they return at once, as every 429 used to.
+//
+// This loop used to retry server errors only, so a 429 came back on its first attempt and the plan
+// executor asked again at once, inside the same window.
+//
+// The wait is the register's own figure: `Retry-After`, else the body's `retry_after`, else the
+// documentation's backoff (one second, doubling). Up to a second of jitter goes on top, as Signa's
+// resilience guide does, so units refused together do not return together. A retry is another attempt on
+// the same ledger row, never a row of its own.
+//
+// ONE CALL SLEEPS AT MOST ONE PER-MINUTE WINDOW IN ALL, AND NEVER PAST ITS TIME TO STOP SENDING. A plan call
+// runs inside a model's turn, and a call that outlasts the turn ends with it, unwritten (send-until.mjs). So
+// a wait that would take the call's sleeping past 60 seconds, or past the turn's time to stop sending, is
+// not taken: that refusal returns as it always has.
+export const RATE_LIMIT_RETRIES = 3;
+export const RATE_LIMIT_SLEEP_BUDGET_MS = 60_000;
+const RATE_LIMIT_BASE_MS = 1000;
+
+/** How long to wait before asking again after a 429, or null when it is not a refusal a wait clears. */
+export function rateLimitWaitMs(retryAfter, body, retried, random = Math.random) {
+  if (body?.error?.type !== "rate_limited") return null;
+  const header = String(retryAfter ?? "").trim() === "" ? NaN : Number(retryAfter);
+  const stated = Number.isFinite(header) && header >= 0 ? header * 1000
+    : Number.isFinite(body.error.retry_after) && body.error.retry_after >= 0 ? body.error.retry_after * 1000
+    : RATE_LIMIT_BASE_MS * 2 ** retried;
+  return stated + random() * RATE_LIMIT_BASE_MS;
+}
+
+const pause = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// `sleep` is for a test, which cannot wait out a real window; every caller here leaves it alone.
+export async function signaFetch(apiKey, base, path, { method = "GET", body = null, retries = 1, tctx = null, sleep = pause } = {}) {
   const url = `${base}${path}`;
   const endpoint = endpointOf(method, path);
   const headers = { Authorization: `Bearer ${apiKey}`, Accept: "application/json" };
@@ -126,20 +164,33 @@ export async function signaFetch(apiKey, base, path, { method = "GET", body = nu
     note({ held: true, served: true, status: held.status });
     return { status: held.status, ok, url, body: parsed, raw: held.raw, parseError };
   }
-  let attempts = 0, resp;
+  let attempts = 0, resp, raw = null, serverRetries = 0, rateRetries = 0, slept = 0;
   try {
-    for (let i = 0; i <= retries; i++) {
-      attempts = i + 1;
+    for (;;) {
+      attempts++;
+      raw = null;
       resp = await fetch(url, init);
-      if (resp.ok || resp.status < 500 || i === retries) break;
-      await new Promise((r) => setTimeout(r, 1500 * (i + 1)));
+      if (resp.status === 429) {
+        // The body says which of the three refusals this is, so it is read here, and kept for the
+        // caller if this is the answer that stands.
+        raw = await resp.text();
+        const wait = rateRetries < RATE_LIMIT_RETRIES ? rateLimitWaitMs(resp.headers.get("retry-after"), parseJsonBody(raw).body, rateRetries) : null;
+        if (wait === null || slept + wait > RATE_LIMIT_SLEEP_BUDGET_MS || pastSendUntil(tctx, Date.now() + wait)) break;
+        rateRetries++;
+        slept += wait;
+        await sleep(wait);
+        continue;
+      }
+      if (resp.ok || resp.status < 500 || serverRetries === retries) break;
+      serverRetries++;
+      await sleep(1500 * serverRetries);
     }
   } catch (err) {
     logCall(tctx, { http_status: 0, ok: false, attempts, took_ms: Date.now() - t0, bytes: 0, cache_hit: false, endpoint, credits_charged: null });
     if (mem) note({ held: Boolean(held), status: 0 });
     throw err;
   }
-  const raw = await resp.text();
+  if (raw === null) raw = await resp.text();
   // The parse failure travels on `parseError` instead of being swallowed — providers/_shared/http-body.mjs.
   const { body: parsed, parseError } = parseJsonBody(raw);
   logCall(tctx, { http_status: resp.status, ok: resp.ok, attempts, took_ms: Date.now() - t0, bytes: raw.length, cache_hit: false, endpoint, credits_charged: creditsCharged(resp) });

package/scripts/release-notes-lint.mjs

@@ -204,13 +204,19 @@ export function findings(text, {
     }
   }
 
+  // A SEMICOLON ENDS A CLAUSE THE READER CAN HOLD ON ITS OWN, so the limit counts each clause. A sentence
+  // the owner approved word for word ran to 34 words as two clauses of 17, and the check, not the sentence,
+  // was the thing to change (owner item 988, as with item 959 before it). A COLON FOLLOWED BY A SPACE ENDS
+  // ONE TOO: the next sentence he approved word for word ran to 37 words, as 12 before its colon and 25 after
+  // (2026-10-30). A colon with no space after it, as in a time or an address, ends nothing.
   for (const s of sentencesIn(prose)) {
-    if (words(s) > MAX_WORDS) {
-      const at = lines.findIndex((l, i) => i >= bodyStart && l.includes(s.slice(0, 30)));
+    for (const clause of s.split(/[;:]\s+/)) {
+      if (words(clause) <= MAX_WORDS) continue;
+      const at = lines.findIndex((l, i) => i >= bodyStart && l.includes(clause.slice(0, 30)));
       out.push({
         line: (at < 0 ? bodyStart : at) + 1,
-        rule: `a sentence runs to at most ${MAX_WORDS} words; this one is ${words(s)}`,
-        offending: s.slice(0, 90) + (s.length > 90 ? "…" : ""),
+        rule: `a sentence runs to at most ${MAX_WORDS} words, or each clause of it after a semicolon or a colon; this one is ${words(clause)}`,
+        offending: clause.slice(0, 90) + (clause.length > 90 ? "…" : ""),
       });
     }
   }

package/scripts/score.mjs

@@ -64,7 +64,7 @@ import { recordQids } from "../driver/named-band.mjs";
 import { previousRunDir, scenarioRefs } from "../driver/e2e-rounds.mjs";
 // The names rule, kept out of this file so it is testable without a run directory — the same reason
 // reference-score.mjs holds the scoring rules rather than this script.
-import { protectedStrings, redactor, authoredRedactor, printAuthored, printPreRedacted, redactDeep, installRedaction, unclassifiedNotice, REDACTION_NOTICE } from "../driver/score-redaction.mjs";
+import { protectedStrings, carryThroughRows, redactor, authoredRedactor, printAuthored, printPreRedacted, redactDeep, installRedaction, unclassifiedNotice, REDACTION_NOTICE } from "../driver/score-redaction.mjs";
 import { readSettleStamp } from "../driver/settle-stamp.mjs";   
 import { envFrom } from "../shared/env-aliases.mjs";   // — resolves EITHER spelling; names the retired one because that is the live-writable half
 
@@ -375,6 +375,20 @@ function verdictIsCleanOf(runDir) {
   });
 }
 
+/**
+ * The run's folder names, as the redaction must know them: a slug is `tmp<ref>-<mark>` or
+ * `noref<hash>-<mark>` (phase0.mjs deriveSlug), and the `run:` and `reviewer:` lines print the path whole.
+ * Both the slug and its mark part, because the mark part also names files inside the run.
+ */
+function slugsOf(runDir, { status = null, meta = null } = {}) {
+  const found = new Set([status?.slug, meta?.slug].filter((s) => typeof s === "string" && s.trim()).map((s) => s.trim()));
+  for (const seg of String(runDir).split(/[\\/]/)) if (SLUG_SHAPE.test(seg)) found.add(seg);
+  for (const s of [...found]) { const mark = s.replace(SLUG_SHAPE_HEAD, ""); if (mark && mark !== s) found.add(mark); }
+  return [...found];
+}
+const SLUG_SHAPE = /^(tmp[a-z0-9]+|noref[0-9a-f]{6})-./;
+const SLUG_SHAPE_HEAD = /^(tmp[a-z0-9]+|noref[0-9a-f]{6})-/;
+
 function readRun(runDir, ref) {
   if (!existsSync(runDir)) die(`no run directory at ${runDir}`);
   const hasDriver = existsSync(driverDir(runDir));
@@ -397,6 +411,7 @@ function readRun(runDir, ref) {
   const settle = readSettleStamp(runDir);
   return {
     dir: runDir, lane, hasDriver, hasStatus, poolMeta, settle, findings, subjects,
+    slugs: slugsOf(runDir, { status: readJson(join(runDir, "status.json")), meta: poolMeta }),
     // — from the RUN DIR's own status.json, which a failed or in-flight run has and a pool
     // meta.json only exists after publish. Null on any run scored before that stamp, and the printer
     // says so rather than leaving the line off: a missing instrument and a matching one must not read
@@ -1015,12 +1030,24 @@ const delta = prev ? bucketDelta(scored.buckets, prev.buckets) : null;
 // as a name substitutes it in all of them rather than needing each one withheld whole. That matters:
 // `text` carries the reviewer's verdict word, and withholding it entire would blank a value the reader
 // came for.
+//
+// AND A FOURTH: THE CARRY-THROUGH ROWS. A subject lands in `lost` there because it reached no
+// downstream artifact, so it is in none of the three above, and both outputs printed it in clear.
+//
+// AND THE RUN'S OWN: THE MARKS IT SEARCHED, AND ITS FOLDER. A knockout's subject roll reached the
+// redaction only through a mark's finding rows, so a mark with none, or spelled other than the
+// reference spells it, went out in clear on the `coverage:` line. The folder is the run's slug, named
+// for its mark, and the `run:` and `reviewer:` lines print the path.
 let unclassifiedKeys = [];
+const carry = carryThrough(run.dir);
+const carryCoverage = coverageConflicts(run.dir, carry.lost);
 // The two instruments the JSON payload needs, live only when names are withheld. With `--names` they
 // stay identity, which is the same "nothing to withhold" case `printAuthored` already has.
 let redactValue = (x) => x, redactKey = (x) => x;
 if (!opts.names) {
-  const { names, prose, derived, unclassified } = protectedStrings({ reference: ref, scored, run: run.findings ?? null });
+  const { names, prose, derived, unclassified } = protectedStrings({ reference: ref, scored, run: run.findings ?? null,
+    carry: carryThroughRows({ lost: carry.lost, unmeasurable: carry.unmeasurable, conflicts: carryCoverage.conflicts }),
+    searched_marks: run.subjects ?? [], run_slugs: run.slugs ?? [] });
   unclassifiedKeys = unclassified;
   // The second redactor is for lines this tool WROTE. It drops the derived-word layer
   // only, so a party's ordinary long word stops rewriting our own headings while its full name is still
@@ -1061,7 +1088,7 @@ if (opts.json) {
     // — the same measure the human output prints, in the payload too. `--json` bypasses print,
     // so leaving it out would hide it from exactly the readers most likely to automate on it, and a
     // consumer would have no way to tell an absent measure from a clean one.
-    carry_through: (() => { const ct = carryThrough(run.dir); return { ...ct, coverage: coverageConflicts(run.dir, ct.lost) }; })(),
+    carry_through: { ...carry, coverage: carryCoverage },
   }, { redactValue, redactKey }), null, 2)}\n`);
 } else {
   // Said before the first number, not after the last: a reader who stops at the top screen must know