clearotron 0.2.0 → 0.2.2

package/driver/register-plan.mjs

@@ -74,7 +74,7 @@ export const PLAN_PREDICATES = ["exact", "default", "wildcard", "phonetic", "own
 // ratified mark or its dominant element, i.e. run input. Until now the only marking was a `+form` suffix
 // inside a qid string, and the wildcard fringe carried none at all — so nothing downstream could tell a
 // generated term from an imagined one without re-deriving the band. OPTIONAL on the entry: a frozen
-// pre- plan carries none and resumes byte-identical, and replay verdicts over archived runs never flip.
+// pre-change plan carries none and resumes byte-identical, and replay verdicts over archived runs never flip.
 /**
  * THE ROMANISATION THE PLAN ALREADY HOLDS FOR A TERM — (cause 2).
  *
@@ -470,7 +470,7 @@ const slug = (s) => latinFold(s) || "q";
 // So a non-Latin term's identity carried nothing about WHICH TERM IT IS. It was its position in the
 // compile order — and the counter is per-plan, not per-script, so adding a Devanagari term renumbers
 // the Cyrillic ones. Fourth site of a Latin normaliser standing where an identity should be, after
-// 's fold key, 's script-exact arm and 's term-substance check.
+// That fold key, the script-exact arm and the term-substance check.
 //
 // ── WHAT IT COSTS, MEASURED ON THE SHIPPED extendRegisterPlan RATHER THAN REASONED ────────────
 //
@@ -1277,7 +1277,7 @@ export function entryQuestionKey(entry, plan) {
  * straight out of model-authored common-law markdown, and it is where R2b's two heading
  * rows entered a plan that had already been declared clean.
  *
- * — AND IT SCREENS FOR THE QUESTION, not just the qid. Same argument as 's term screen and
+ * — AND IT SCREENS FOR THE QUESTION, not just the qid. Same argument as the term screen and
  * the same funnel: an entry whose resolved question is already in the plan is refused here, because
  * this is the one place that holds both the plan and the incoming row. See entryQuestionKey above
  * for what "the same question" means and why `regions` is the field that hides it.
@@ -1498,7 +1498,7 @@ export function parseRegisterPlan(raw) {
     // owner is a defect, never a silent no-op filter.
     if (e.owner != null && (typeof e.owner !== "string" || !e.owner.trim()))
       throw new Error(`register_plan_owner_invalid:${short(e.qid)} (owner must be a non-empty string when present)`);
-    //: optional (a frozen pre- plan has none), closed when present — an off-enum value would
+    //: optional (a frozen pre-change plan has none), closed when present — an off-enum value would
     // make the floor/model marking unreadable exactly where it is load-bearing.
     //: optional (a frozen pre-2050 plan has none), and closed to the single value `true` when
     // present — a falsy or string-shaped stamp would make the depth fold's designation unreadable
@@ -1532,7 +1532,7 @@ export function parseRegisterPlan(raw) {
  *   { executed: [{qid, state, records, total_hits}], missing: [qid], skipped: [{qid, guard}],
  *     unplanned: [{qid|query}] }
  * `records` and `total_hits` are each a number or null, and BOTH KEYS ARE ALWAYS WRITTEN.
- * That is load-bearing, not tidiness: `planJoinFrom` tells a pre- receipt from a count the
+ * That is load-bearing, not tidiness: `planJoinFrom` tells a pre-change receipt from a count the
  * provider could not take by whether the keys are PRESENT, because `null` and absent are the same
  * value once read. Omit a key here and every new receipt silently reads as legacy — the arm named
  * "the discriminator's PREMISE" fails if this stops holding.
@@ -1628,7 +1628,7 @@ export function joinPlanToBands(plan, bandBlocksByAxis) {
 //
 //   1. THE PROVIDER MUST HAVE ANSWERED. Deferral is earned by a band block stamped `error:true` with the
 //      provider's own reason on it. A qid with NO block ran nothing and recorded nothing — an absence,
-//      not a finding — and still throws. That is 's condition, untouched: a genuinely-unrun,
+//      not a finding — and still throws. That is the condition, untouched: a genuinely-unrun,
 //      undisclosed slice fails the run.
 //   2. THE LADDER MUST BE SPENT, WHERE THE LADDER CAN DO ANYTHING. Only a qid the run has ALREADY
 //      recorded as missing (or already deferred this way) converts. On its first fan-in a hard-errored
@@ -1847,7 +1847,7 @@ export function deriveCoverageSkeleton(plan, join) {
  * predicate, no clean-claim precondition — had already fired and returned first. Main's own doc block
  * called that pair a deliberate superset/subset. So the fold removes a token the validator could not
  * reach, not a check. THE FOLD IS PROVED BY THE REPLAY CORPUS, not by that argument: the corpus flips
- * only where the SUPERSET stops firing, and it comes back to 's 9 with the superset alone restored.
+ * only where the SUPERSET stops firing, and it comes back to the 9 with the superset alone restored.
  * (The argument alone has a hole — this function keys its skeleton map on raw `s.axis` and the superset
  * trims, so an untrimmed skeleton axis would separate them. Degenerate, and no preserved run carries it.)
  *
@@ -2066,7 +2066,7 @@ function undisclosedDeferredQids(skeletonAxis, text) {
  * WHY THIS AND NOT A LOUDER HINT. The doctrine already reached the stage as advice on the first dispatch
  * (deferredSlicesRequiredRows, formerly the A8 "hint") and the stage claimed clean anyway, then complied
  * the moment the identical fact came back as a validator failure — R1 681s→202s, R2 515s→77s, every
- * prelim run that reaches the digest. A fact that is obeyed as a failure and ignored as an input is not
+ * clearotron run that reaches the digest. A fact that is obeyed as a failure and ignored as an input is not
  * being said too quietly; it is being offered rather than required. So it is required here.
  *
  * DELIBERATELY A SUPERSET of the deferred branch below, and the older gate is kept rather than folded

package/driver/register-records.mjs

@@ -330,7 +330,7 @@ export function recordsForMark(doc, name) {
  * WHAT REPLACES A FOREIGN URL, and why it is not an origin swap: `null`, so the surfaces fall through to
  * `recordId` — the `/mark/<cc>/<number>` path that IS the canonical record identity this system stores.
  * The reader gets the record number in plain text beside the office label, which is word for word the
- * remedy 's refusal message prescribes. Composing the run provider's origin onto the path instead
+ * remedy the refusal message prescribes. Composing the run provider's origin onto the path instead
  * would invent a URL nobody fetched, and on `free-tier` there are two offices and no single origin to
  * swap to.
  *
@@ -394,7 +394,7 @@ export function recordsLine(entry) {
       + `appears here.`
     : "";
   // — the ordered territories this register never covered. Appended to whichever sentence comes
-  // back, and needed most in the EMPTY-LIST branch below for the same reason 's note is: "the
+  // back, and needed most in the EMPTY-LIST branch below for the same reason the note is: "the
   // register returned none under the name or any close variation of it" is a clean negative, and over a
   // matter that ordered Japan on a register with no Japanese coverage it is a false one.
   const outside = entry.deferredScope ?? [];

package/driver/registry-fidelity.mjs

@@ -328,7 +328,7 @@ export function assembleRunRecords(runDir, runPrefix,
       writeFileSync(driverDir(runDir, "receipts.json"), JSON.stringify({ schema_version: 1, receipts: rows }, null, 2) + "\n");
     }
   } catch { /* best-effort — the records map above remains the gate substrate */ }
-  // 's legacy-name notice is REPLACED, not deleted. That one told an operator which of four
+  // That legacy-name notice is REPLACED, not deleted. That one told an operator which of four
   // global candidates was being read; nothing reads any of them for a new run any more, so the sentence
   // had become false. What an operator still needs is the fact underneath it: a box upgraded across this
   // change is carrying a large global record log that is now written by nothing and read by nothing —
@@ -338,7 +338,7 @@ export function assembleRunRecords(runDir, runPrefix,
   //
   // AND THE CALL LEDGER'S OWN NOTICE MOVES HERE RATHER THAN DYING WITH IT. `ledgerDeprecationNotice` had
   // exactly one product caller — the record line above — so deleting that line would have left NOTHING
-  // announcing the ledger that is still global, still live and still on production's pre- filename.
+  // announcing the ledger that is still global, still live and still on production's pre-change filename.
   // Gated on the path ACTUALLY WALKED: the notice re-resolves from the environment, so on a call that
   // passed an explicit `callLogPath` it would describe a file this assembly never opened, and a
   // diagnostic that names something other than what happened is worse than no diagnostic.
@@ -951,7 +951,7 @@ const recClasses = (rec) => {
  * WHICH owner name a delivery artifact SHOWS. ONE definition, deliberately, because the renderer
  * and bindFindingsToRecords each resolve the owner independently — publish/render.mjs does its own
  * record lookup and preferred the record outright, so binding the finding alone changed no heading and
- * no lint surface. A second copy of the same decision is how 's provider default survived two fixes.
+ * no lint surface. A second copy of the same decision is how the provider default survived two fixes.
  *
  * The record decides, not a guess about what "looks romanised": a record carrying BOTH a Latin name and
  * a native-script one is itself saying the Latin field is a transliteration, and only then does a

package/driver/remedy-accounting.mjs

@@ -227,7 +227,7 @@ export function accountRemedyTerms({ terms = [], blocksByQid = new Map(), execut
 }
 
 /**
- * THE CLOSURE READ ('s second criterion). `domClosed` may be true only over the ACCOUNTED set: a
+ * THE CLOSURE READ (the second criterion). `domClosed` may be true only over the ACCOUNTED set: a
  * dominant-element directive must be verified-closed AND every remedy term that directive restated must
  * be `found` or `searched-empty`. One unaccounted term and the dominant-element gap is not closed —
  * because it demonstrably is not: something the remedy named either never ran or ran into a shape the

package/driver/repair-composers.mjs

@@ -199,7 +199,7 @@ export const REPAIR_COMPOSERS = [
         // before/after run-pairs read identically, because a clearance narrative's job IS to state what
         // was searched and what came back — the legitimate sentence and the defective one have the same
         // shape and differ only in truth. The typed half of this class IS enforced structurally, on the
-        // corrective pair, by `evidenceClaimViolations` (, pipeline.mjs ~10973) — but it reads
+        // corrective pair, by `evidenceClaimViolations` (pipeline.mjs ~10973) — but it reads
         // `findings.json` meters, and a narrative sentence with no findings-side counterpart is invisible
         // to it. That prose gap is conversion-era work, not an instruction. This is the instruction.
         `A REPAIR MAY NARROW A CLAIM AND MAY NEVER BROADEN ONE. If a flagged statement is wrong because it claims too much, the correction states LESS: strike the claim, or replace it with the smaller claim the evidence actually carries. Never restate the same claim in different words, and never replace a specific sentence with a general one. NARROWING IS NOT HEDGING and the rule above still holds — claiming less is a correction; keeping the claim and wrapping it in "may", "appears to" or "broadly" is the hedge that is forbidden.`,
@@ -233,7 +233,7 @@ export const REPAIR_COMPOSERS = [
         review,
       );
     },
-    // TWO SAMPLES BECAUSE THE COMPOSER HAS TWO SHAPES, and 's saving is the whole point of the
+    // TWO SAMPLES BECAUSE THE COMPOSER HAS TWO SHAPES, and the saving is the whole point of the
     // second: a declared scope narrows the pass, an undeclared one leaves it byte-identical to what it
     // was before that existed. A guard walking only one of them walks half the surface.
     samples: [

package/driver/repair-digest.mjs

@@ -139,7 +139,7 @@ export function aggregateFailureRecurrence({ enumerate = enumerateRuns, now = Da
   // different orders), so it never enters bySig — but a count that nobody prints is a diagnostic
   // computed and dropped, which is the class this issue belongs to.
   const refusals = { count: 0, runIds: [], stages: [] };
-  // — counted and NAMED, never dropped: 's shape immediately above, for the same reason. A park
+  // — counted and NAMED, never dropped: the shape immediately above, for the same reason. A park
   // whose class was "unknown" over a reason a validator had already structured is a gap in the
   // classifier, not an unknowable failure, and the digest is where an operator would ever see it. It is
   // reported BESIDE the groups rather than inside them: it is a fact about how a failure was classified,
@@ -219,7 +219,7 @@ export function renderFailureRecurrence(agg) {
     ].filter(Boolean).join("\n")
     : null;
   if (!agg.groups.length) {
-    return `No prelim failures or auto-recovery parks in the last ${agg.days} days.${refusalLine ? `\n${refusalLine}` : ""}${gapLine ? `\n${gapLine}` : ""}`;
+    return `No clearotron failures or auto-recovery parks in the last ${agg.days} days.${refusalLine ? `\n${refusalLine}` : ""}${gapLine ? `\n${gapLine}` : ""}`;
   }
   const head = (g) =>
     `${n(g.runIds.length, "run")}  ${g.sig}  [${g.failClass ?? "?"}]  ` +
@@ -247,7 +247,7 @@ export function renderFailureRecurrence(agg) {
 }
 
 // CLI: `node repair-digest.mjs [--days N]` — the ops-digest generator (scripts/ops-digest-daily.sh)
-// invokes this and pastes the output into its "Prelim Failure Recurrence" section.
+// invokes this and pastes the output into its "Clearotron Failure Recurrence" section.
 if (isEntrypoint(import.meta.url)) {
   const ix = process.argv.indexOf("--days");
   const days = ix >= 0 ? Math.max(1, Number(process.argv[ix + 1]) || 7) : 7;

package/driver/repairs.mjs

@@ -59,7 +59,7 @@ export const REFUSAL_TERMINAL_KIND = "designed-refusal";
 // rejection carried one, and the errno tokens below matched it; but undici reports a codeless fault as
 // a bare `TypeError: fetch failed` (no cause.code), and that line — transport noise by construction —
 // carried no token either regex knew, so it classified DETERMINISTIC at fan-in: loud-terminal, but it
-// defeated 's weather lane for exactly the unreachable-provider case the lane exists for.
+// defeated the weather lane for exactly the unreachable-provider case the lane exists for.
 export const TRANSIENT_RE = /\btimeout\b|\blane_wedge\b|\bembedded_fallback\b|\bnonzero_exit|\bunparseable_json\b|\bstatus_(timeout|overloaded|error|aborted|rate_limited)\b|\brate_limited\b|\boverloaded\b|\beconnreset\b|\betimedout\b|\benotfound\b|\beai_again\b|socket hang\s?up|\bhttp\s?5\d\d\b|\btransport failure\b/i;
 
 // STRUCTURAL REFUSAL: the provider ANSWERED, and its answer is a verdict on the REQUEST. The remedy is
@@ -140,7 +140,7 @@ export const DETERMINISTIC_RE = /\bhttp\s?4(0[0349]|1[04])\b|uri too long|own no
 //
 // The axis outcome survives as evidence in exactly one case: THE AXIS LANDED NOTHING. Zero qid-stamped
 // blocks means the executor never wrote, so its transport failure really is this slice's story and
-// 's weather lane keeps working for the dead-provider case it exists for. Once the axis HAS landed
+// That weather lane keeps working for the dead-provider case it exists for. Once the axis HAS landed
 // qid-stamped blocks the executor demonstrably ran and wrote, and this qid's absence is an identity or
 // coverage hole that no repair outcome from its axis speaks to.
 //
@@ -309,7 +309,7 @@ const overflowOf = (tail) => { const m = OVERFLOW_RE.exec(tail.trim()); return m
 // The leading CAUSE CENSUS is the exact count stamped at the throw site, so the total is the sum of its
 // numbers — no comma-splitting, and therefore immune to the over-count a query containing a comma used to
 // cause. LEGACY SHAPES still parse and must: this text path exists for the run-level catch, which sees
-// prose only, and a resumed or archived run can still carry a pre- token
+// prose only, and a resumed or archived run can still carry a pre-change token
 // (`connotation_undisposed:<census>;…`, `<q1,q2,…>[ (+N more)]`). A stale token that stopped counting
 // would read as a MISSING quantity, which is what a converged run looks like.
 // The validator's exact count still rides as `quantity` at the throw site and always wins.
@@ -329,7 +329,7 @@ function undisposedCount(tail) {
   // was cut short of its payload — ABSENT, not converged.
   return named ? named + overflow : null;
 }
-// A pre- archived token: `connotation_recurrent_uncited:<one result, ≤80 chars>[ (+N more)]` — ONE
+// A pre-change archived token: `connotation_recurrent_uncited:<one result, ≤80 chars>[ (+N more)]` — ONE
 // named result plus the overflow. Never split on commas: that payload is a copied result title, not a
 // joined list. Nothing emits this shape any more; it is kept so a resumed run's own history still counts.
 function recurrentCount(tail) {
@@ -555,7 +555,7 @@ export function countRecoveryLanes(history, { total = 0 } = {}) {
 
 // ── CAP PARKS: A PROVIDER SAYING "NOT YET" IS NOT A STAGE FAILING (tracker issue 103) ──────────────
 //
-// Owner, watching indigo-falcon spend 4 of its 6 recovery parks against one subscription cap:
+// Owner, watching a run spend 4 of its 6 recovery parks against one subscription cap:
 //
 //   "surely it can work out when the cap expires and try after that time and not just keep trying
 //    and then die."
@@ -621,7 +621,7 @@ export function capParkSchedule({ resetsAt = null, attempts = 0, now = Date.now(
 /**
  * capWaitFrom — what a run actually spent WAITING on a provider's cap, read off the park history.
  *
- * tracker issue 103's fourth ask: a run that still dies on a cap has to SAY it was a cap, and say how
+ * The ask: a run that still dies on a cap has to SAY it was a cap, and say how
  * long it held out. The park history is the only record that survives a park/resume cycle, so it is the
  * only place that answer can come from at the terminal.
  *
@@ -695,7 +695,7 @@ export function humanWait(min) {
 // failure's `quantity` and the last recorded quantity for the SAME signature in the park history. It
 // changes no branch below and no caller reads it as an input: the point of the issue is that the
 // comparison can SEE 25 → 9 → 9 as different from 29 → 11 → 0, where today both hash identically.
-// What the machinery DOES with that difference is 's decision, not this function's.
+// What the machinery DOES with that difference is the decision, not this function's.
 export function decideRecovery({ failClass, sig, reason = "", history = [], priorAttempts = 0, recoveryMax = 3, nonRecoverable = false, hasRunDir = true, runCeiling = null, weatherAttempts = 0, defectAttempts = null, weatherCeiling = null, quantity = null }) {
   const hist = Array.isArray(history) ? history : [];
   const sigAttempts = hist.filter((h) => h?.sig === sig).length;

package/driver/replay-archive.mjs

@@ -217,6 +217,8 @@ export function diffSnapshots(prev, curr) {
 
 function main() {
   const args = new Set(process.argv.slice(2));
+  // ON-DISK NAME, NOT A PRODUCT NAME: an install that never set the variable already has this file, so
+  // renaming the default points the reader at one that does not exist. Owner ruling, tracker issue 308.
   const snapshotPath = process.env.CLEAROTRON_REPLAY_SNAPSHOT || join(homedir(), ".prelim-replay-snapshot.json");
   const roots = process.env.CLEAROTRON_REPLAY_ROOTS
     ? process.env.CLEAROTRON_REPLAY_ROOTS.split(":").filter(Boolean)

package/driver/report-card-record.mjs

@@ -64,7 +64,7 @@ const BODY_FLOOR_CHARS = 60;
  * READ FROM THE RUN, not from the payload. The card's `- Source:` bullet is declared
  * `mechanical:code-rendered` and the record already carries `source.resolved_link`, so the seat is not
  * asked for a URL it would have to compose from a host table it is not even given — the transcription
- * class in its purest form, and 's link-to-nowhere in a document a client reads.
+ * class in its purest form, and the link-to-nowhere in a document a client reads.
  */
 export function findingForOrdinal(runDir, ordinal) {
   return findingsDocFor(runDir, ordinal).finding;
@@ -187,7 +187,7 @@ export function renderReportCard(model, finding, { registerLabel = "" } = {}) {
 // ── THE RISK READ IS A STRUCTURE, NOT A DICTATED HABIT ( D3) ─────────────────────────────────
 //
 // render.mjs suppresses the typed `legal_position` / `practical_position` pair on any card whose prose
-// already carries a "Risk assessment"-led bullet (, ONE ACCOUNT PER FACT). That gate reads a lead
+// already carries a "Risk assessment"-led bullet (ONE ACCOUNT PER FACT). That gate reads a lead
 // this stage's dispatch calls OPTIONAL and this acceptance never checked — the card contract's §L
 // requirement was a HABIT, in exactly the sense the card index was one before the driver bound it.
 //

package/driver/result-noun-fields.mjs

@@ -12,7 +12,7 @@
 // property of the WRITING SITE, not of the name — a field called `outcome` carrying an outcome is fine,
 // and a field called `settled` carrying a dispatch return is the defect. Only reading the writer tells
 // them apart, so the population is SPLIT and classified rather than filtered down to the offenders.
-// Both halves are kept, for 's reason: a filtered population produces no number, and nobody can see
+// Both halves are kept, for the reason: a filtered population produces no number, and nobody can see
 // what was hidden.
 //
 // ── THE TWO HALVES ──────────────────────────────────────────────────────────────────────────────────
@@ -48,7 +48,7 @@
 //                   `outcome` for existing readers beside `dispatch` and `verdict`).
 //   "out-of-scope" — never reaches `_driver/*.json` or `run.jsonl`; `atWriteSite` is 0.
 
-/** The result nouns this sweep is about — 's list, verbatim. */
+/** The result nouns this sweep is about — the list, verbatim. */
 export const RESULT_NOUNS = Object.freeze(["outcome", "executed", "permanent", "settled", "closed", "recovered", "verified"]);
 
 export const RESULT_NOUN_FIELDS = Object.freeze([
@@ -66,7 +66,7 @@ export const RESULT_NOUN_FIELDS = Object.freeze([
   { file: "driver/pipeline.mjs", noun: "executed", sites: 4, atWriteSite: 3, verdict: "result",
     why: "lengths of the executed set as the join computed it" },
   { file: "driver/pipeline.mjs", noun: "outcome", sites: 11, atWriteSite: 6, verdict: "result",
-    why: "the one member that reported an invocation — taint-rerun's `r.ok ? \"ok\" : …`, which travels on a StageFailure packet — now carries a `cleared` sibling read from the taint, #1529's remedy 10/5 -> 11/6 at tracker issue 1886: the profile-store receipt's `outcome: pr.outcome`. Classified by READING ITS WRITING SITE, which is profiles.mjs and not this file: the value is one of three literals chosen by a situation the resolver decided (`overlay` and `bundled-fallback` are `pass`, `env-arrived-late` is `blocked`), never a call's return read as a verdict. `bundled-fallback` being `pass` is the point of the whole receipt — a legitimate install that nobody was told about is what this row says out loud." },
+    why: "the one member that reported an invocation — taint-rerun's `r.ok ? \"ok\" : …`, which travels on a StageFailure packet — now carries a `cleared` sibling read from the taint, the remedy 10/5 -> 11/6 at the profile-store receipt's `outcome: pr.outcome`. Classified by READING ITS WRITING SITE, which is profiles.mjs and not this file: the value is one of three literals chosen by a situation the resolver decided (`overlay` and `bundled-fallback` are `pass`, `env-arrived-late` is `blocked`), never a call's return read as a verdict. `bundled-fallback` being `pass` is the point of the whole receipt — a legitimate install that nobody was told about is what this row says out loud." },
   { file: "driver/pipeline.mjs", noun: "permanent", sites: 1, atWriteSite: 1, verdict: "result",
     why: "`permanent.length` — a count of the classified set" },
   { file: "driver/pipeline.mjs", noun: "recovered", sites: 3, atWriteSite: 3, verdict: "result",
@@ -95,6 +95,13 @@ export const RESULT_NOUN_FIELDS = Object.freeze([
   { file: "driver/skills-store-provenance.mjs", noun: "outcome", sites: 6, atWriteSite: 0, verdict: "out-of-scope" },
   { file: "driver/status-snapshot.mjs", noun: "outcome", sites: 1, atWriteSite: 0, verdict: "out-of-scope" },
   { file: "mcp-server/lib/events.mjs", noun: "recovered", sites: 1, atWriteSite: 0, verdict: "out-of-scope" },
+  // Read at the writing site, as this table requires. All three sites are in `knockoutSearches`, a
+  // READ-ONLY projection that composes the rows `list_searches` answers with: it opens no artifact and
+  // writes nothing, so nothing here can reach `_driver/*.json` or `run.jsonl`. Each value is a literal
+  // chosen from the run's own stored record — "found" or "no-hit" from whether the mark has findings,
+  // and "recorded" for a register term whose stored row says it did NOT answer. None is a call's return
+  // read back as a verdict, which is the defect this table exists to find.
+  { file: "mcp-server/lib/knockout.mjs", noun: "outcome", sites: 3, atWriteSite: 0, verdict: "out-of-scope" },
   { file: "mcp-server/lib/ops.mjs", noun: "settled", sites: 1, atWriteSite: 0, verdict: "out-of-scope" },
   { file: "mcp-server/server.mjs", noun: "outcome", sites: 1, atWriteSite: 0, verdict: "out-of-scope" },
   { file: "scripts/backfill-started-at.mjs", noun: "outcome", sites: 5, atWriteSite: 0, verdict: "out-of-scope" },

package/driver/run-economics.mjs

@@ -87,7 +87,7 @@
 // `modelUsed`. So the rows can now answer "what ran", per record, wherever the wire reported.
 //
 // What has NOT changed is this module: `byBilling` / `byStage` / `dispatches` still key on `modelUsed`,
-// i.e. on what was asked for. Switching them to prefer `modelActual` is 's call, not a side effect
+// i.e. on what was asked for. Switching them to prefer `modelActual` is the call, not a side effect
 //, and it cannot be a blanket flip — codex reports no model, and a killed turn may have none,
 // so a per-record basis is the only honest shape. `tokens.mjs` keys its rollup on the requested alias
 // for the same reason and is likewise untouched.
@@ -241,7 +241,7 @@ export const vendorOf = (engine) => ENGINE_VENDORS[String(engine ?? "")] ?? null
 //
 // CODE-SIDE IS NOT A VENDOR. `code:execute-plan` rides nearly every run (the driver executes the frozen
 // plan itself), stamps `authMode: "not-provider-billed"`, and costs no provider tokens. Counting it would
-// make every run in the product read as multi-vendor — the same defect as 's `web` channel, where a
+// make every run in the product read as multi-vendor — the same defect as the `web` channel, where a
 // member the driver always adds made every run look unplanned. Provider-billed rows only, and the count
 // of what was set aside is reported so the exclusion is visible rather than assumed.
 //

package/driver/run-integrity.mjs

@@ -42,7 +42,7 @@ import { DISPATCH_SUFFIX } from "./dispatch-record.mjs";        // — the dispa
  *
  * ONE PREDICATE, so the snapshot and any future arming decision cannot disagree about the set. Named
  * files are the driver-derived joins and receipts judgment reads; the dispatch records are what was
- * actually asked, including 's `.prev-<sha>` supersede chain.
+ * actually asked, including the `.prev-<sha>` supersede chain.
  *
  * ──: EVERY `.jsonl` IS OUT, BY PATTERN, AND A NEW SINK IS OUT THE MOMENT IT IS CREATED ────────
  *

package/driver/runner.mjs

@@ -23,13 +23,13 @@ import "./engine/mcp/http-dispatcher.mjs";   // side effect: raise undici header
 import { readdirSync, renameSync, existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync, rmSync, statSync } from "node:fs";
 import { join, dirname, basename } from "node:path";
 import { driverDir, ensureDriverDir } from "../shared/driver-dir.mjs";   // — one definition of where `_driver/` is
-// The queue's filename vocabulary, in ONE place — 's rule, extended by to the prose-sidecar and
+// The queue's filename vocabulary, in ONE place — the rule, extended by to the prose-sidecar and
 // claim-sidecar names, because a harness check retyped four of them from memory and false-alarmed on the
 // other nine. Behaviour here is unchanged: the same object and the same three suffixes, sourced.
 import { isLiveQueueMarker, PROSE_PARTS, CLAIM_SIDECAR_SUFFIXES, TERMINAL_QUEUE_SUFFIXES } from "./queue-markers.mjs";
 import { matterLedgerPath } from "./usage-ledger.mjs";   // ONE ledger-path calculation, shared with the portal pre-check
-import { orderTimeRefusal } from "./run-requirements.mjs";   // tracker issue 216 — one authority for what a run needs, and when it is asked for
-import { unitEnvPath } from "../shared/env-local.mjs";   // tracker issue 216 — the file the units read, named by its one author
+import { orderTimeRefusal } from "./run-requirements.mjs";   // one authority for what a run needs, and when it is asked for
+import { unitEnvPath } from "../shared/env-local.mjs";   // the file the units read, named by its one author
 import { fileURLToPath } from "node:url";
 import { config, preflightDeploymentUrls } from "./driver.config.mjs";
 import { deriveSlug, todayISO, mintFreshCodename } from "./phase0.mjs";
@@ -136,7 +136,7 @@ function matterSignature(job, { product = null } = {}) {
   const base = `${forwarder}|${mark}|${classes}|${customer}|${ref}`;
   // Product dimension. ONE product adds nothing to the string, and it has to be one or every legacy
   // ledger row would stop colliding with its own re-send: the pre-spine signature had no suffix at all,
-  // and the level that ran then was `prelim`. That level's SUCCESSOR is the Global preliminary search —
+  // and the level that ran then was `clearotron`. That level's SUCCESSOR is the Global preliminary search —
   // the clearance a request with nothing named resolves to — so it is the one that stays silent, and
   // `sigLevel`'s default reads a suffixless row as it. The key name stays `level:` for the same reason:
   // it is a string already written into every ledger on disk.
@@ -342,7 +342,7 @@ async function intakeNotify(agentId, base, job, v) {
   const what = v?.classify === "clarify"
     ? `needs clarification before it can run: ${v.errors.join("; ")}`
     : `was rejected at intake: ${(v?.errors ?? ["unparseable job file"]).join("; ")}`;
-  const text = `⚠️ Prelim request "${mark}" ${what}. Nothing has been searched or delivered. ` +
+  const text = `⚠️ Clearotron request "${mark}" ${what}. Nothing has been searched or delivered. ` +
     `Job parked as ${base}.failed in the ${agentId} queue.`;
   const p = writeOutboxPacket(`intake-${base}.failed`, {
     kind: "intake-rejected", classify: v?.classify ?? "reject", base, agent: agentId,
@@ -381,7 +381,7 @@ function cleanupClaimSidecars(procPath) {
  * Returns true when this call moved the marker, false when it was already gone. Any other error still
  * throws: a permissions failure or a full disk is not a sibling.
  */
-export function retireMarker(procPath, destPath, what = "") {   // exported for 's honesty test
+export function retireMarker(procPath, destPath, what = "") {   // exported for the honesty test
   try { renameSync(procPath, destPath); return true; }
   catch (e) {
     if (e?.code !== "ENOENT") throw e;
@@ -389,7 +389,7 @@ export function retireMarker(procPath, destPath, what = "") {   // exported for
     // <dest> is on disk. On this branch the rename did NOT happen, so <dest> was never created by this
     // call, and the parenthetical named the outcome the caller intended rather than the one an operator
     // would find. It is the single line an operator reads to discover where a job went, and it was
-    // pointing at a file that is not there. The reproduction (, PR) ends with the queue dir
+    // pointing at a file that is not there. The reproduction (PR) ends with the queue dir
     // holding `job-race.processing` and `job-race.processing.pid` and NO `.json` at all, under a log
     // line that said the orphan had been returned to the queue.
     note(`[runner] ${basename(procPath)} was already retired by another runner — this call did NOT create ${basename(destPath)} (it wanted: ${what || "retire the marker"}); the marker is in whatever state that runner left it`);
@@ -433,13 +433,13 @@ export function retireMarker(procPath, destPath, what = "") {   // exported for
  * marker; the argument holds only because no `<base>.json` exists while we hold the lock (both enqueue
  * doors refuse an id whose `.json` or `.processing` is already present, and this call is the one about
  * to create it). The residual — a fresh enqueue of the SAME id landing between the two renames — is the
- * window 's claim lock and `takeoverClaim` already carry, unchanged here. At a call site where a
+ * window the claim lock and `takeoverClaim` already carry, unchanged here. At a call site where a
  * `<base>.json` CAN coexist with the marker, that argument does not transfer.
  *
  * Returns true when this call moved the marker to `destPath`. False means the claim was not ours to
  * retire — and that nothing on disk was touched.
  */
-export function retireClaimAndSweep(procPath, destPath, what = "", { token = claimToken() } = {}) {   // exported for 's race test
+export function retireClaimAndSweep(procPath, destPath, what = "", { token = claimToken() } = {}) {   // exported for the race test
   const lockPath = `${procPath}.claimed-${token}`;
   try { renameSync(procPath, lockPath); }
   catch (e) {
@@ -482,7 +482,7 @@ export function retireClaimAndSweep(procPath, destPath, what = "", { token = cla
  *     RE-ASSEMBLED from. It is the one deletion that outlives every marker state: the winner's job — a
  *     resume, or a hand-back to `.json` — then cannot be assembled at all.
  *   - `<base>.done.result` / `<base>.failed.result` asserts a terminal that is not on disk. That is
- *     's defect exactly (a line naming the outcome the caller WANTED, not the one an operator would
+ *     That defect exactly (a line naming the outcome the caller WANTED, not the one an operator would
  *     find), one call below the fix for it.
  *   - `dropMatter` marks the matter ledger row `failed`, and `findDuplicateMatter` skips failed rows —
  *     so it re-opens the dedup gate for a matter the winner may be mid-resume, and the ~$40 duplicate
@@ -578,7 +578,7 @@ async function failAtIntake(procPath, qdir, base, agentId, job, v, reasons) {
 // outcome string for the .reason file.
 async function duplicateNotify(agentId, base, job, prior = null, sig = null) {
   const mark = job?.markName ?? job?.name ?? job?.marks?.[0]?.name ?? base;
-  // ── tracker issue 136 — A REFUSAL DELIVERED AS SILENCE IS INDISTINGUISHABLE FROM A LOST JOB ────────
+  // ── A REFUSAL DELIVERED AS SILENCE IS INDISTINGUISHABLE FROM A LOST JOB ────────
   //
   // The observable outcome of a dedup park was an empty queue and no run, which is exactly what an
   // enqueue that vanished looks like — and the two want completely different next actions. That got
@@ -598,7 +598,7 @@ async function duplicateNotify(agentId, base, job, prior = null, sig = null) {
   const which = prior?.msgId
     ? ` The run already under way was submitted as ${prior.msgId}${when ? ` at ${when}` : ""} — that is the one that will deliver.`
     : " The earlier run will deliver.";
-  const text = `⚠️ Prelim request "${mark}" matches a matter already in progress or just delivered, so it was `
+  const text = `⚠️ Clearotron request "${mark}" matches a matter already in progress or just delivered, so it was `
     + `NOT run — a second search would spend twice for one answer.${which}`
     + ` If you genuinely need a fresh run of the same matter, re-submit it with dupOverride (\`--dup-override\` on the`
     + ` command line) and it will go through.`;
@@ -631,7 +631,7 @@ async function parkDuplicate(procPath, qdir, base, agentId, job, prior, sig) {
   const conv = String(job.conversationId ?? "").trim();
   const matchedBy = prior.conversationId && prior.conversationId === conv ? "thread (conversationId)" : "matter signature";
   const reason = [
-    `duplicate prelim — not run (a second search for the same matter)`,
+    `duplicate clearotron — not run (a second search for the same matter)`,
     `matched by: ${matchedBy}`,
     `matter: ${sig}`,
     `conversationId: ${conv || "-"}`,
@@ -666,7 +666,7 @@ function preRunFailNotify(agentId, base, job, reason) {
   // terminalReasonFields `reason`, so this cut is a no-op today — which is exactly why it survived: a
   // latent second cap, unmarked, waiting for the next caller to pass a raw reason. It collapses and
   // trims identically, so this is the same string with the cut made visible when there is one.
-  const text = `❌ Prelim request "${mark}" FAILED before the run could start: ${terminalReasonFields(reason).reason} — ` +
+  const text = `❌ Clearotron request "${mark}" FAILED before the run could start: ${terminalReasonFields(reason).reason} — ` +
     `nothing has been searched or delivered. Job parked as ${base}.failed in the ${agentId} queue.`;
   // `intake-${base}.` PREFIX, not a third scheme: scripts/e2e.mjs's outboxPackets matches by runId
   // first and by that prefix second, so a name outside it is a notice the harness reports as
@@ -716,7 +716,7 @@ async function backstopFailureNotice({ res, job, agentId, base, codename, studio
       shortReason, reasonVerbatim: reason.slice(0, 1000), whatsappTo: AGENT_WHATSAPP[agentId] ?? null,
     });
     // same per-send invariant as the pipeline's failure path: a fresh notice supersedes an older .sent
-    // and its per-channel receipts (B4 — stale receipts would make prelim-deliver skip this notice)
+    // and its per-channel receipts (B4 — stale receipts would make clearotron-deliver skip this notice)
     try { rmSync(join(owned.dir, ".sent"), { force: true }); } catch { /* none */ }
     try { rmSync(driverDir(owned.dir, "send-receipts.json"), { force: true }); } catch { /* none */ }
     ensureDriverDir(owned.dir);
@@ -740,7 +740,7 @@ async function backstopFailureNotice({ res, job, agentId, base, codename, studio
 // one-at-a-time so the dedup check+record stays race-free even while prior jobs' pipelines run concurrently
 // (Phase-4). Returns the prepared {procPath, base, job} to execute, or null when the job was terminally
 // parked/failed-at-intake, or the claim was lost.
-// ── tracker issue 216 — THE ORDER-TIME REFUSAL, AND WHY IT IS HERE ──────────────────────────────────
+// ── THE ORDER-TIME REFUSAL, AND WHY IT IS HERE ──────────────────────────────────
 //
 // A hosted install now STARTS with no register configured (owner ruling 2026-09-06: "someone can install
 // and select key later so it should still start"). The protection that used to live in
@@ -849,7 +849,7 @@ async function claimAndPrep(jsonFile, qdir, agentId) {
     await failAtIntake(procPath, qdir, base, agentId, job, v, v.errors);
     return null;
   }
-  // ── tracker issue 216 — IS THIS BOX CONFIGURED TO SEARCH AT ALL? See the header above claimAndPrep.
+  // ── IS THIS BOX CONFIGURED TO SEARCH AT ALL? See the header above claimAndPrep.
   {
     const refusal = orderTimeRefusal(process.env, await runTables(), { envFile: unitEnvPath() });
     if (refusal) {
@@ -860,11 +860,11 @@ async function claimAndPrep(jsonFile, qdir, agentId) {
     }
   }
   // Search-depth spine — resolve WHICH product shape this job selects (job selector → project/customer
-  // default → house prelim), then gate on what this deployment can actually run. A selection that cannot
+  // default → house clearotron), then gate on what this deployment can actually run. A selection that cannot
   // run here CLARIFIES loudly (parked + requester notified) — it must never silently run as a different-
   // priced product, and never silently drop. Fail-open discipline (review 2026-07-17): infra trouble may
   // NO FAIL-OPEN LEFT ON THIS PATH, and its removal is the point. It used to fall back to the literal
-  // level `prelim` when resolution errored and the job "provably" wanted a plain clearance — but `prelim`
+  // level `clearotron` when resolution errored and the job "provably" wanted a plain clearance — but `clearotron`
   // named THREE products depending on where it pointed, so the fallback was a guess wearing a level key:
   // an account whose defaults hold one country would have run a Full country search, case law and all,
   // off a config read that failed. Under the offering the product is a function of the scope, and a scope
@@ -1027,7 +1027,7 @@ async function claimAndPrep(jsonFile, qdir, agentId) {
 // result the whole time and the marker threw it away.
 //
 // WHAT THIS DOES NOT DO: invent a cause. Neither branch classifies anything; each states which park
-// fired and what its clock means. 's damage was a record that could not be contradicted from the
+// fired and what its clock means. That damage was a record that could not be contradicted from the
 // artifacts, so the fix is not a better guess — it is saying less, and saying which.
 export function parkCause(res = {}) {
   const RESOLVED_BY = "a live retry — the stored time is a hint about when to look, not the authority on "
@@ -1182,8 +1182,8 @@ async function runPrepared({ procPath, base, job }, qdir, agentId, resumeMeta =
       //
       // The pipeline already made this distinction where it writes its own sentinel — "only the recovery
       // sentinel carried a discriminator … the 2026-07-28 postmortem misread: a recovery park diagnosed
-      // as a rate-limit park". The queue-side marker never got it. Same shape as 's terminal fields
-      // reaching two writers and not four, and 's stamp reaching the audit path and not the rebuild.
+      // as a rate-limit park". The queue-side marker never got it. Same shape as the terminal fields
+      // reaching two writers and not four, and the stamp reaching the audit path and not the rebuild.
       ...parkCause(res),
     });
     note(`[runner] ${base} → POSTPONED (${parkCause(res).parkKind}; retries at the earlier of ${res.resetsAt ?? "its due time"} and its next probe — no hand-edit needed if it clears early)`);

package/driver/scope-rules.mjs

@@ -113,7 +113,7 @@ export function checkClearanceScopeRules({ job = null, profile = null, resolved
   // request resolves to no territory" would be a claim about a scope nobody saw. But when the request —
   // or the saved search it names — DOES name territories, the profile is irrelevant to the count and the
   // rules still bite. Skipping them there is how a roster-blind deployment (profile_key_unknown → the
-  // fail-open to prelim) would admit a three-country deep dive at the wall itself (review 2026-07-27).
+  // fail-open to clearotron) would admit a three-country deep dive at the wall itself (review 2026-07-27).
   if (!profileReadable && !scope.length) return { errors, warnings };
   // Quoted AS WRITTEN, worldwide tokens dropped (a mode is not a place — territory-tiers.mjs answers
   // which entries those are, so this module and the door cannot disagree about the spelling of

package/driver/search-policy.mjs

@@ -351,7 +351,7 @@ export function reportIdentityFor(levelOrPolicy) {
 
 /** The product's coverage note for the report masthead (charter ruling 1, 2026-07-30: what was bought
  *  must be VISIBLY clear on the page — a reader must never confuse "the same section" in two different
- *  searches). One plain sentence, NAME-LED per the ruling (match 's registry-name pills: the
+ *  searches). One plain sentence, NAME-LED per the ruling (match the registry-name pills: the
  *  product's name leads, never a rung on our ladder), stating what THIS search covers and the material
  *  thing it does not. The name comes from the registry join (reportIdentityFor — today's name for what
  *  ran, exactly the  doctrine); the coverage clauses come from the run's own frozen COMPONENTS
@@ -678,7 +678,7 @@ export function productAvailability(policy, { built = BUILT, registerCanCount =
  */
 export const UNAVAILABLE_NOTE = {
   unbuilt: "Not part of the current release.",
-  // `demo` IS DELETED FROM THIS MAP (, owner ruling 2026-08-31 14:47), and
+  // `demo` IS DELETED FROM THIS MAP (owner ruling 2026-08-31 14:47), and
   // deleting it is what makes the reversal structural rather than a filter somebody can undo by
   // accident. Every client-facing surface renders a product's refusal as `UNAVAILABLE_NOTE[cause]`;
   // while a sentence sat here for a demo, the greyed control was one `return "demo"` away from coming
@@ -692,7 +692,7 @@ export const UNAVAILABLE_NOTE = {
   // a baked-in provider name, no CLEAROTRON_* string in scope here, and it says the one thing a reader can
   // act on — this is a coverage limit, so a newer version will not fix it.
   //
-  // `register-not-worldwide` IS DELETED FROM THIS MAP (, owner ruling
+  // `register-not-worldwide` IS DELETED FROM THIS MAP (owner ruling
   // 2026-08-31), and deleting it is what makes the ruling structural rather than a filter somebody can
   // reverse by accident. Every client-facing surface renders a product's refusal as
   // `UNAVAILABLE_NOTE[cause]`; while a sentence sat here for that cause, the ruling held only as long as

package/driver/skeptic-search.mjs

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // skeptic-search.mjs — the skeptic's SANCTIONED READ SURFACE: literal substring search over the run's
-// own artifact tree. 's ratification hold, unlock path 1.
+// own artifact tree. That ratification hold, unlock path 1.
 //
 // ── WHAT THIS REPLACES, measured and nothing more ───────────────────────────────────────────────────
 //

package/driver/skills/blind-frame/SKILL.md

@@ -5,7 +5,7 @@ description: The frame-STARVED independent re-derivation for the v3 preliminary
 
 ## Purpose
 
-Every other stage in a prelim run reasons *inside* a frame that was set early (at `matter-frame` / `prelim-variants`): the variants to chase, the field that counts as on-field, the sources worth searching. Verification then runs *on* that frame — nothing tests the frame itself. When the frame is mis-scoped, the whole run inherits the miss and the skeptic, reasoning from the same frame, certifies it.
+Every other stage in a clearotron run reasons *inside* a frame that was set early (at `matter-frame` / `prelim-variants`): the variants to chase, the field that counts as on-field, the sources worth searching. Verification then runs *on* that frame — nothing tests the frame itself. When the frame is mis-scoped, the whole run inherits the miss and the skeptic, reasoning from the same frame, certifies it.
 
 You are the antidote. You are **deliberately starved of the frame**: you receive only the raw instruction, exactly as the requester wrote it, and you re-derive the threat model **cold**. Because you never see the run's conclusions, you cannot anchor to them. Your output is later **diffed** against what the run actually scoped — the gaps in that diff are the omissions the frame missed.
 

package/driver/skills/case-law-citation/SKILL.md

@@ -17,7 +17,7 @@ cannot reach any other stage's context, because no stage shares one — and it i
 arranges or can lose. Nothing here spawns a session; sequencing, fan-in and retries are the driver's.
 
 The identical skill is also valid **inline** in ad-hoc chat when a conflict / confusability / enforcer
-question arises outside a prelim run.
+question arises outside a clearotron run.
 
 **Reads** — from the dispatch message (plain markdown, not JSON), for each finding to ground:
 - the proposed mark and the conflicting mark / owner / entity,
@@ -46,7 +46,7 @@ Boards-of-Appeal decisions — no free API today). EUIPO *register* lookups are
 
 Called by `prelim-search` after synthesis flags the risk-relevant findings (Step 4.5). Also triggers in
 chat when the user raises a trademark conflict, likelihood-of-confusion, or enforcement-history question.
-Gated and optional: if this skill is absent, prelim skips Step 4.5 and delivers normally.
+Gated and optional: if this skill is absent, clearotron skips Step 4.5 and delivers normally.
 
 ## Model