clearotron 0.2.0 → 0.2.2

package/mcp-server/server.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
-// trademark-artifacts-mcp — interrogate prelim trademark-clearance runs over MCP.
+// trademark-artifacts-mcp — interrogate clearotron trademark-clearance runs over MCP.
 //
 // One stdio binary, any number of consumers: an operator's own agent platform spawns it, and the user's
 // own Claude spawns the SAME binary, as an account that can read the run-dirs.
@@ -15,7 +15,7 @@
 //: it queues the experiment into the run dir and driver/whatif-worker.mjs runs
 // it, which is how a client reaches the engine without a remote face ever shelling.
 //
-// Imports the prelim-driver read-only via ./lib/* — touches no driver/template/deploy file.
+// Imports the clearotron-driver read-only via ./lib/* — touches no driver/template/deploy file.
 
 import "../shared/env-local.mjs";   // side effect: apply <repo>/.env when THIS file is the CLI entry (never on library import)
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -54,6 +54,13 @@ import { accountRun, accountTrace, accountTimeline, accountFinding, accountFindi
   accountWhatIfPlan, accountWhatIfQueued, accountWhatIfResult, CLIENT_FAILURE_NOTE as clientFailureNote } from "./lib/audit-view.mjs";
 import { scrubMarkdown, scrubBody, scrubFrontMatter, scrubCards } from "./lib/scrub.mjs";
 import { evidenceRecords, searchLog, coverageStatement } from "./lib/evidence.mjs";
+// The knockout lane's projections. Every audit tool below branches on `isKnockoutRun` because the
+// clearance projections read artifacts this product does not write, and returned empty rather than saying
+// so (tracker issue 275).
+import {
+  isKnockoutRun, knockoutDoc, knockoutArtifacts, knockoutArtifactPath, knockoutFindings,
+  knockoutEvidence, knockoutSearches, knockoutCoverage, traceKnockout, notProducedOnThisProduct,
+} from "./lib/knockout.mjs";
 import { instructionsFor } from "./lib/instructions.mjs";
 import { isEntrypoint } from "../shared/is-entrypoint.mjs";   // — one entry-point test, all spellings
 import { BRAND } from "../shared/brand.mjs";   // — the operator name a client is told to expect, from the tenant seam
@@ -82,6 +89,18 @@ function mustRun(runId) {
 function artifactPath(run, name) {
   const { P, runDir } = run;
   if (name === "status.json") return join(runDir, "status.json");
+  // THE KNOCKOUT TABLE IS TERMINAL ON A KNOCKOUT, and both halves of that matter (tracker issue 275).
+  //
+  // Resolving FIRST is what fixes `report`: a knockout's report.md is written to the POOL and never into
+  // the run dir, so the clearance table returned the run dir's own `report` slot — a path that does not
+  // exist — and the tool answered `exists: false` about a file sitting on disk.
+  //
+  // Not FALLING THROUGH is the other half, and it was caught by an arm rather than by design. With a
+  // fall-through, `read_artifact narrative` on a knockout resolves against the clearance table, finds the
+  // slot, and returns `exists: false` — reporting a document this product never writes as a missing one.
+  // That is the defect this issue is about, reappearing one layer down. Returning null instead makes the
+  // tool refuse the name and name the artifacts this run actually has.
+  if (isKnockoutRun(run)) return knockoutArtifactPath(run, name);
   if (name === "run.jsonl" || name === "telemetry/run.jsonl") return driverDir(runDir, "run.jsonl");
   if (REGISTER_AXES.includes(name)) return P.registerUnit(name);
   // validate the axis against the known set — never let a "registerUnit:../../x" escape the run-dir
@@ -93,6 +112,10 @@ function artifactPath(run, name) {
 }
 
 function listArtifacts(run) {
+  // The error message a caller sees when a name does not resolve is built from this list, so on a knockout
+  // it has to name the knockout's own artifacts — otherwise the tool refuses a name and then suggests
+  // eleven documents this product does not write.
+  if (isKnockoutRun(run)) return knockoutArtifacts(run).filter((a) => a.exists).map(({ name, file }) => ({ name, file }));
   const { P } = run; const out = [];
   for (const [k, v] of Object.entries(P)) { if (k === "runDir" || typeof v === "function") continue; if (existsSync(v)) out.push({ name: k, file: basename(v) }); }
   for (const ax of REGISTER_AXES) { const p = P.registerUnit(ax); if (existsSync(p)) out.push({ name: `registerUnit:${ax}`, file: basename(p) }); }
@@ -150,7 +173,7 @@ function runSummary(run) {
     sent: existsSync(join(run.runDir, ".sent")),
     // B4 (per-channel receipts, 2026-07 duplicate-email fix): channel-level delivery state, dual-read.
     // A channel counts as sent when the run's _driver/send-receipts.json has that channel's receipt
-    // (prelim-deliver writes one right after EACH send lands, before the final .sent) OR the legacy
+    // (clearotron-deliver writes one right after EACH send lands, before the final .sent) OR the legacy
     // all-channels .sent marker exists (pre-receipts runs wrote only that, after both sends). SKILL.md
     // step 2b reads this on a retry to skip already-receipted channels instead of re-emailing.
     channels: channelState(run.runDir),
@@ -227,6 +250,28 @@ const tools = {
   get_run({ runId }) {
     const run = mustRun(runId);
     const { stages, failover } = getStages(run.runDir);
+    // THE LANE DECIDES THE ARTIFACT LIST. Appending REGISTER_AXES unconditionally is what manufactured
+    // eleven `exists: false` rows on a product that writes none of those documents — a wall of false
+    // negatives, which a reader is entitled to read as a run with nothing on disk.
+    if (isKnockoutRun(run)) {
+      const doc = knockoutDoc(run);
+      const negatives = knockoutFindings(run, { kind: "negatives" }).items;
+      return {
+        run: runSummary(run),
+        product: "knockout",
+        stages, failover,
+        artifacts: knockoutArtifacts(run),
+        coverageSummary: {
+          // No ledger EXISTS on this lane, and saying so as a fact beats reporting it as a missing file.
+          coverageLedgerPresent: false,
+          coverageLedgerNote: "A Knockout search keeps no coverage ledger; get_search_coverage answers "
+            + "from the run's own per-mark record instead.",
+          complete: Boolean(doc),
+          findings: knockoutFindings(run).items.length,
+          negativeResults: negatives.length,
+        },
+      };
+    }
     return {
       run: runSummary(run),
       stages, failover,
@@ -249,6 +294,18 @@ const tools = {
   },
   list_findings({ runId, kind, sourceLayer, group }) {
     const run = mustRun(runId);
+    if (isKnockoutRun(run)) {
+      // `group` is the clearance report's on-field/off-field/out-of-scope curation. A knockout report has
+      // no such sectioning, so the honest answer names that rather than filtering to nothing.
+      if (group) {
+        return {
+          _note: BRIEFING_NOTE, kind: "cards", group, items: [],
+          ...notProducedOnThisProduct("on-field/off-field/out-of-scope card groups",
+            "Call list_findings without `group` for this run's findings, each with its band."),
+        };
+      }
+      return { _note: BRIEFING_NOTE, ...knockoutFindings(run, { kind, sourceLayer }) };
+    }
     if (group) { const cards = loadCards(run.P); return { _note: BRIEFING_NOTE, kind: "cards", group, items: cards.cards.filter((c) => c.group === group), note: cards.note }; }
     return { _note: BRIEFING_NOTE, ...filterFindings(run.P, { kind, sourceLayer }) };
   },
@@ -256,17 +313,20 @@ const tools = {
   // Data, not narrative: no BRIEFING_NOTE rides on these. The projections — and the reasoning about what
   // is evidence and what is method — live in lib/evidence.mjs; nothing is decided here.
   list_evidence({ runId, layer }) {
-    const out = evidenceRecords(mustRun(runId));
+    const run = mustRun(runId);
+    const out = isKnockoutRun(run) ? knockoutEvidence(run) : evidenceRecords(run);
     return layer ? { ...out, records: out.records.filter((r) => r.layer === layer) } : out;
   },
   list_searches({ runId, outcome }) {
-    const out = searchLog(mustRun(runId));
+    const run = mustRun(runId);
+    const out = isKnockoutRun(run) ? knockoutSearches(run) : searchLog(run);
     if (!outcome) return out;
     const searches = out.searches.filter((s) => s.outcome === outcome);
     return { ...out, count: searches.length, searches, totalCount: out.count };
   },
   get_search_coverage({ runId }) {
-    return coverageStatement(mustRun(runId));
+    const run = mustRun(runId);
+    return isKnockoutRun(run) ? knockoutCoverage(run) : coverageStatement(run);
   },
   get_finding({ runId, id }) {
     const run = mustRun(runId);
@@ -275,7 +335,12 @@ const tools = {
     return f;
   },
   trace({ runId, target, depth, shallow }) {
-    return trace(mustRun(runId), target, { depth: depth ?? 2, shallow: shallow === true });
+    const run = mustRun(runId);
+    // The clearance trace's target table is built from STAGE_ORDER, the register axes and the clearance
+    // findings spine, so on a knockout it resolved nothing at all — including "verdict" — and its error
+    // enumerated fifteen stages, none of them from this lane.
+    if (isKnockoutRun(run)) return traceKnockout(run, target, readEvents(run.runDir));
+    return trace(run, target, { depth: depth ?? 2, shallow: shallow === true });
   },
   get_telemetry({ runId, stage, axis }) {
     const run = mustRun(runId);
@@ -484,7 +549,7 @@ const TOOL_DEFS = [
   // comes back. The brief names WHICH PRODUCT the run was instead, resolved from the registry.
   { name: "brief", description: "START HERE for any 'what do you have on X / what did the search find' question — ONE plain-language briefing of a run, in the client-voiced wording (which search product this run was, overall risk in plain words, each conflict in 1–2 plain sentences, any conditions on the result). Facts, never advice. No internal stage names, no risk-formula codes, no model names. Reach for the audit tools (get_run, trace, decision_timeline, get_telemetry) only when the user asks HOW the system reached a conclusion.", inputSchema: { type: "object", properties: { ...runIdProp }, required: ["runId"] } },
   { name: "list_runs", description: "List the searches on this account (in progress and finished), newest first. TO FIND A SEARCH BY THE NAME IT CLEARED, pass `mark` — the stored identifier is a longer prefixed slug a client has never seen, so a bare mark name will not match `slug`. If a filtered call comes back empty, list unfiltered and read down the mark names before telling anyone there is nothing there. States: 'postponed' = paused on a provider cap and resuming by itself (resetsAt); 'recovering' = backing off and retrying (recoveryResumesAt); 'parked-for-human' = interrupted mid-search, resumes on the next activation. sendPending:true is the authoritative list of finished searches still owed their delivery notification. Follow up with brief for a plain-language summary of one search.", inputSchema: { type: "object", properties: { agent: { type: "string" }, state: { type: "string", enum: ["running", "delivered", "failed", "postponed", "recovering", "parked-for-human", "cancelled"] }, mark: { type: "string", description: "Find a search by the MARK it cleared: matches the mark name or the identifier, case-insensitively, on part of the word. This is the parameter a name-shaped question wants." }, slug: { type: "string", description: "EXACT identifier match, for a caller that already holds one. A mark name is not a slug — use `mark`." }, sendPending: { type: "boolean", description: "true = only searches still owed a delivery notification; false = only already-settled ones." }, limit: { type: "number" } } } },
-  { name: "list_profiles", description: "List the customer ACCOUNTS the firm runs prelim clearances for (key + name + industry + their PROJECTS) — the roster the intake step resolves a job's profileKey (and optional projectKey) against. profileKey selects that customer's marketplaces, default classes/jurisdictions, report format and risk posture; a project (spec 62) is an engagement UNDER a customer that overlays its own marketplaces/classes/sector/posture. Resolve by JUDGMENT (explicit name, misspelling, or implicit reference); OMIT profileKey for a new/unknown customer (uses the neutral generic profile); set projectKey only when the request names a specific project in that customer's projects[], else OMIT it (runs on the customer profile); never pick a profile from the sender's email domain. Read-only.", inputSchema: { type: "object", properties: {} } },
+  { name: "list_profiles", description: "List the customer ACCOUNTS the firm runs clearotron clearances for (key + name + industry + their PROJECTS) — the roster the intake step resolves a job's profileKey (and optional projectKey) against. profileKey selects that customer's marketplaces, default classes/jurisdictions, report format and risk posture; a project (spec 62) is an engagement UNDER a customer that overlays its own marketplaces/classes/sector/posture. Resolve by JUDGMENT (explicit name, misspelling, or implicit reference); OMIT profileKey for a new/unknown customer (uses the neutral generic profile); set projectKey only when the request names a specific project in that customer's projects[], else OMIT it (runs on the customer profile); never pick a profile from the sender's email domain. Read-only.", inputSchema: { type: "object", properties: {} } },
   { name: "get_run", description: "ENGINEERING/AUDIT view — full run mechanics: status, every pipeline stage (trigger/outcome), failover facts, artifact validity, and a coverage summary. Use when the user asks how the run executed; for 'what did it find', call brief instead.", inputSchema: { type: "object", properties: { ...runIdProp }, required: ["runId"] } },
   { name: "read_artifact", description: "Read a run artifact's raw text (or one '# Section', or its front-matter). For briefing a person, the report is the plain-language layer; the rest are internal working documents. Names: report, audit, narrative, registerFindings, commonLaw, placement, matterContext, variantManifest, skepticFlags, seniorEyeReview, caseLaw, clientSummary (internal cover-note source; ops only), a register axis (e.g. primary-sweep), status.json, run.jsonl.", inputSchema: { type: "object", properties: { ...runIdProp, name: { type: "string" }, section: { type: "string", description: "Return only this '# Section'." }, frontMatterOnly: { type: "boolean" } }, required: ["runId", "name"] } },
   { name: "list_evidence", description: "The records this search considered — every register and common-law entry, including ones the report does not name individually. Each carries the mark, owner and country, the classes, the register status, the source link, whether the provider record was actually retrieved (`retrieved`), and `superseded: true` if a later pass withdrew it. Use this to answer 'what exactly did you find, and who owns it?'. Filter with layer: register | common-law.", inputSchema: { type: "object", properties: { ...runIdProp, layer: { type: "string", enum: ["register", "common-law"] } }, required: ["runId"] } },
@@ -509,7 +574,7 @@ const TOOL_DEFS = [
   { name: "describe_options", description: "START HERE before composing a search — the option space, for free. Returns the four searches this deployment can actually run — each with the geography it accepts, how many names it reads, its turnaround, whether it carries the case-law reading, whether the native-language investigation is optional or automatic, and a plain note when one is unavailable — plus the combination rules the servers enforce (territories, native-language routing, marketplaces, classes, names per search), and — for a client connector — YOUR OWN account: its key (the profileKey plan_run and start_run require), its projects, its saved searches (the recipeKey slugs) and what is left of today's allowance. Omit profileKey to be answered about your own account(s); pass it to ask about a specific one. Reserves nothing, spends nothing, starts nothing. Then: plan_run (free) with the arguments you intend, and start_run with the SAME arguments once the requester has confirmed.", inputSchema: { type: "object", properties: { profileKey: { type: "string", description: "OPTIONAL: the customer ACCOUNT key to describe. Omit it to be answered about the account(s) this session holds — that is how a client connector discovers the key it must pass to plan_run/start_run." } } } },
   { name: "plan_run", description: "FREE PREVIEW — resolve what a search WOULD do and return it, spending nothing and queueing nothing. Takes the SAME arguments as start_run. Use this BEFORE start_run whenever the requester has not already confirmed the specifics: it reports the PRODUCT that resolves and WHERE it came from (their request, the account default, a saved search, or the territories themselves), the territories and marketplaces that would ACTUALLY be searched, the turnaround, and any blockers as questions to put back. Show the result to the requester; then call start_run with the SAME arguments to actually run it. Nothing here reserves or holds anything.", inputSchema: { type: "object", properties: { markName: { type: "string", description: "The mark (single-mark form). REQUIRED unless marks[] is given." }, marks: { type: "array", items: { type: "object", properties: { name: { type: "string" }, classes: { type: "array", items: { type: "number" } }, ref: { type: "string" } }, required: ["name"] } }, classes: { type: "array", items: { type: "number" } }, goods: { type: "string" }, jurisdictions: { type: "array", items: { type: "string" } }, platforms: { type: "array", items: { type: "string" } }, customer: { type: "string" }, profileKey: { type: "string", description: "The customer ACCOUNT key (see list_profiles). REQUIRED for an accounts-scoped session (your grant names the keys — see describe_options)." }, projectKey: { type: "string" }, forwarder: { type: "string", description: "Requester/reply-routing key — same as start_run, so the preview describes the job that would actually be built. Account sessions may omit it — it is stamped from your verified identity." }, forwarderEmail: { type: "string" }, ref: { type: "string" }, product: { type: "string", enum: ORDERABLE_PRODUCTS, description: PRODUCT_DESC }, nativeLanguage: { type: "boolean", description: "OPTIONAL, and only on a multi-country-focus-search: the native-language investigation. Send TRUE or omit the field — FALSE IS REFUSED, not honoured: the toggle only ever added, so there is nothing for false to switch off, and accepting it would let you believe you had removed a reading that runs anyway. It runs AUTOMATICALLY on a full-country-search and is not part of the other two, so asking for it there is refused rather than accepted and ignored. It routes on territory — the scope must name one it covers." }, worldwide: { type: "boolean", description: "Search EVERYWHERE, and refuse to be narrowed by the account's own default territories. This is not the same as omitting jurisdictions, which means \"whatever the account says\" — the two used to be indistinguishable on this wire, which is how a request that bought everywhere ran an account's seven countries. Never send \"Worldwide\" as a jurisdictions entry." }, recipeKey: { type: "string" }, upfrontInstructions: { type: "string" }, deadline: { type: "string" }, deliveryRoute: { type: "string", enum: ["email", "portal"], description: "OPTIONAL: how the delivered packet leaves — email (default). \"portal\" is reserved for the portal delivery lane and CLARIFIES at admission until it ships (never a silent no-op) — so the preview BLOCKS it here rather than describing a job start_run could not run." }, commercialFlexibility: { type: "string" }, priorUse: { type: "string" }, campaignShape: { type: "string", description: "Campaign-shape FACTS from the request/client — how the mark will be deployed: standalone brand vs flavour/sub-brand under a NAMED house mark; seasonal/limited vs permanent; launch scale. Verbatim facts only — the engine records them on the matter frame instead of inferring a launch shape." }, customerUnknown: { type: "boolean" } }, required: ["forwarder"] } },
   // ---- OPS write-face (requires an ops token; never exposed to a user/internal session) ----
-  { name: "start_run", description: "OPS-ONLY. Enqueue a NEW clearance/search run the driver will pick up. Provide markName (or marks[] for a batch) + forwarder (and ideally classes/goods/customer/profileKey/ref). Returns the queue id + slug; the runId/codename is assigned when the runner claims it — poll list_runs (by markName) or run_changes for progress. Spends real money once it runs.", inputSchema: { type: "object", properties: { agent: { type: "string", description: "Which agent workspace's queue. Omit for the deployment default (CLEAROTRON_QUEUE_DIR or the default agent's queue — docs/INTAKE.md)." }, markName: { type: "string", description: "The mark (single-mark form). Required unless marks[] is provided." }, marks: { type: "array", items: { type: "object", properties: { name: { type: "string" }, classes: { type: "array", items: { type: "number" } }, ref: { type: "string" } }, required: ["name"] }, description: "Batch form: EVERY name of the batch in ONE job. Only a knockout-search reads more than one name at a time; a clearance reads one, and more is refused rather than truncated." }, classes: { type: "array", items: { type: "number" }, description: "Nice classes — whole numbers 1–45 (1–34 goods, 35–45 services). classes OR goods; either suffices." }, goods: { type: "string" }, jurisdictions: { type: "array", items: { type: "string" }, description: "WHERE the search points — and, for a clearance, WHICH search it is: one country is a full-country-search, a region or two-or-more countries a multi-country-focus-search. AUTHORITATIVE (the matter frame is told not to widen past them). Omit ⇒ the project/customer default territories; send worldwide:true to search everywhere instead. Names or codes both read; max 20." }, platforms: { type: "array", items: { type: "string" }, description: "OPTIONAL per-run SCOPE: extra marketplaces to sweep, as bare store domains e.g. [\"gnc.com\"]. ADDED to the account's own marketplaces — additive only, never a replacement (a client's platform list is a mandate). Max 10; \"web\" is implicit and must not be listed." }, customer: { type: "string" }, profileKey: { type: "string", description: "The customer ACCOUNT key (see list_profiles) whose profile rates this run; omit for the neutral generic profile. REQUIRED for an accounts-scoped session (your grant names the keys — see describe_options)." }, forwarder: { type: "string", description: "Requester/reply-routing key — rides the delivery packet so the integrator knows who gets the report (docs/DELIVERY.md). Account sessions may omit it — it is stamped from your verified identity." }, forwarderEmail: { type: "string" }, ref: { type: "string" }, provider: { type: "string" }, brief: { type: "string" }, upfrontInstructions: { type: "string" }, projectKey: { type: "string", description: "OPTIONAL (spec 62): the PROJECT/engagement key UNDER profileKey (see that customer's projects[] in list_profiles) whose overlay rates this run; omit to run on the customer profile. An unknown key clarifies at intake." }, product: { type: "string", enum: ORDERABLE_PRODUCTS, description: PRODUCT_DESC }, nativeLanguage: { type: "boolean", description: "OPTIONAL, and only on a multi-country-focus-search: the native-language investigation. Send TRUE or omit the field — FALSE IS REFUSED, not honoured: the toggle only ever added, so there is nothing for false to switch off, and accepting it would let you believe you had removed a reading that runs anyway. It runs AUTOMATICALLY on a full-country-search and is not part of the other two, so asking for it there is refused rather than accepted and ignored. It routes on territory — the scope must name one it covers." }, worldwide: { type: "boolean", description: "Search EVERYWHERE, and refuse to be narrowed by the account's own default territories. This is not the same as omitting jurisdictions, which means \"whatever the account says\" — the two used to be indistinguishable on this wire, which is how a request that bought everywhere ran an account's seven countries. Never send \"Worldwide\" as a jurisdictions entry." }, recipeKey: { type: "string", description: "OPTIONAL alternative selector: a saved search (recipe) slug for this customer. Mutually exclusive with product — a saved search already carries one." }, deliveryRoute: { type: "string", enum: ["email", "portal"], description: "OPTIONAL: how the delivered packet leaves — email (default). \"portal\" is reserved for the portal delivery lane and CLARIFIES at admission until it ships (never a silent no-op)." }, parentRunId: { type: "string", description: "OPTIONAL escalation lineage: the runId this run escalates from (e.g. a knockout HIGH mark → this prelim)." }, deliverableSpec: { type: "string" }, commercialFlexibility: { type: "string" }, priorUse: { type: "string" }, campaignShape: { type: "string", description: "Campaign-shape FACTS from the request/client — how the mark will be deployed: standalone brand vs flavour/sub-brand under a NAMED house mark; seasonal/limited vs permanent; launch scale. Verbatim facts only — the engine records them on the matter frame instead of inferring a launch shape." }, deadline: { type: "string", description: "ISO-8601 — drives the deadline envelope." }, customerUnknown: { type: "boolean" }, dupOverride: { type: "boolean", description: "Requester-confirmed force-run past matter dedup." }, clientPrincipal: { type: "boolean", description: "Set by the client portal only: this run was started by a CLIENT and consumes that account's runCaps.dailyRuns allowance. Omit for staff, agent and email-door runs — absence means uncapped, and setting it can only restrict the run that carries it." }, rawRequest: { type: "string" }, forwarderDomain: { type: "string" }, msgId: { type: "string" }, conversationId: { type: "string" }, id: { type: "string" } }, required: ["forwarder"] } },
+  { name: "start_run", description: "OPS-ONLY. Enqueue a NEW clearance/search run the driver will pick up. Provide markName (or marks[] for a batch) + forwarder (and ideally classes/goods/customer/profileKey/ref). Returns the queue id + slug; the runId/codename is assigned when the runner claims it — poll list_runs (by markName) or run_changes for progress. Spends real money once it runs.", inputSchema: { type: "object", properties: { agent: { type: "string", description: "Which agent workspace's queue. Omit for the deployment default (CLEAROTRON_QUEUE_DIR or the default agent's queue — docs/INTAKE.md)." }, markName: { type: "string", description: "The mark (single-mark form). Required unless marks[] is provided." }, marks: { type: "array", items: { type: "object", properties: { name: { type: "string" }, classes: { type: "array", items: { type: "number" } }, ref: { type: "string" } }, required: ["name"] }, description: "Batch form: EVERY name of the batch in ONE job. Only a knockout-search reads more than one name at a time; a clearance reads one, and more is refused rather than truncated." }, classes: { type: "array", items: { type: "number" }, description: "Nice classes — whole numbers 1–45 (1–34 goods, 35–45 services). classes OR goods; either suffices." }, goods: { type: "string" }, jurisdictions: { type: "array", items: { type: "string" }, description: "WHERE the search points — and, for a clearance, WHICH search it is: one country is a full-country-search, a region or two-or-more countries a multi-country-focus-search. AUTHORITATIVE (the matter frame is told not to widen past them). Omit ⇒ the project/customer default territories; send worldwide:true to search everywhere instead. Names or codes both read; max 20." }, platforms: { type: "array", items: { type: "string" }, description: "OPTIONAL per-run SCOPE: extra marketplaces to sweep, as bare store domains e.g. [\"gnc.com\"]. ADDED to the account's own marketplaces — additive only, never a replacement (a client's platform list is a mandate). Max 10; \"web\" is implicit and must not be listed." }, customer: { type: "string" }, profileKey: { type: "string", description: "The customer ACCOUNT key (see list_profiles) whose profile rates this run; omit for the neutral generic profile. REQUIRED for an accounts-scoped session (your grant names the keys — see describe_options)." }, forwarder: { type: "string", description: "Requester/reply-routing key — rides the delivery packet so the integrator knows who gets the report (docs/DELIVERY.md). Account sessions may omit it — it is stamped from your verified identity." }, forwarderEmail: { type: "string" }, ref: { type: "string" }, provider: { type: "string" }, brief: { type: "string" }, upfrontInstructions: { type: "string" }, projectKey: { type: "string", description: "OPTIONAL (spec 62): the PROJECT/engagement key UNDER profileKey (see that customer's projects[] in list_profiles) whose overlay rates this run; omit to run on the customer profile. An unknown key clarifies at intake." }, product: { type: "string", enum: ORDERABLE_PRODUCTS, description: PRODUCT_DESC }, nativeLanguage: { type: "boolean", description: "OPTIONAL, and only on a multi-country-focus-search: the native-language investigation. Send TRUE or omit the field — FALSE IS REFUSED, not honoured: the toggle only ever added, so there is nothing for false to switch off, and accepting it would let you believe you had removed a reading that runs anyway. It runs AUTOMATICALLY on a full-country-search and is not part of the other two, so asking for it there is refused rather than accepted and ignored. It routes on territory — the scope must name one it covers." }, worldwide: { type: "boolean", description: "Search EVERYWHERE, and refuse to be narrowed by the account's own default territories. This is not the same as omitting jurisdictions, which means \"whatever the account says\" — the two used to be indistinguishable on this wire, which is how a request that bought everywhere ran an account's seven countries. Never send \"Worldwide\" as a jurisdictions entry." }, recipeKey: { type: "string", description: "OPTIONAL alternative selector: a saved search (recipe) slug for this customer. Mutually exclusive with product — a saved search already carries one." }, deliveryRoute: { type: "string", enum: ["email", "portal"], description: "OPTIONAL: how the delivered packet leaves — email (default). \"portal\" is reserved for the portal delivery lane and CLARIFIES at admission until it ships (never a silent no-op)." }, parentRunId: { type: "string", description: "OPTIONAL escalation lineage: the runId this run escalates from (e.g. a knockout HIGH mark → this clearotron)." }, deliverableSpec: { type: "string" }, commercialFlexibility: { type: "string" }, priorUse: { type: "string" }, campaignShape: { type: "string", description: "Campaign-shape FACTS from the request/client — how the mark will be deployed: standalone brand vs flavour/sub-brand under a NAMED house mark; seasonal/limited vs permanent; launch scale. Verbatim facts only — the engine records them on the matter frame instead of inferring a launch shape." }, deadline: { type: "string", description: "ISO-8601 — drives the deadline envelope." }, customerUnknown: { type: "boolean" }, dupOverride: { type: "boolean", description: "Requester-confirmed force-run past matter dedup." }, clientPrincipal: { type: "boolean", description: "Set by the client portal only: this run was started by a CLIENT and consumes that account's runCaps.dailyRuns allowance. Omit for staff, agent and email-door runs — absence means uncapped, and setting it can only restrict the run that carries it." }, rawRequest: { type: "string" }, forwarderDomain: { type: "string" }, msgId: { type: "string" }, conversationId: { type: "string" }, id: { type: "string" } }, required: ["forwarder"] } },
   { name: "stop_run", description: "OPS-ONLY. Cancel a run. Pass id to remove a not-yet-claimed queued job (a real cancel, no spend). Pass runId to file a cancel request on a started run. By default the cancel is COOPERATIVE — the sentinel is written and a turn already in flight is allowed to finish, which has no deadline: a reasoning turn can run for tens of minutes. Add immediate:true to also end that turn, so the run goes terminal in seconds.", inputSchema: { type: "object", properties: { agent: { type: "string" }, id: { type: "string", description: "A queued job id (from start_run) — dequeues before the runner claims it." }, runId: { type: "string", description: "A started run's runId — files a cancel sentinel." }, immediate: { type: "boolean", description: "Stop NOW instead of at the next step boundary (tracker issue 2076). The cancel sentinel is written FIRST and then the run's own recorded engine turn is ended, in that order — the sentinel is what makes the record clean, so the terminal names the stage, the actor and the request time instead of leaving a run that reads as still running. The step in flight is lost; everything already recorded is kept. Falls back to the boundary stop, and SAYS SO in the answer, when there is no live turn to end — a run between steps, or one whose turn has already exited. Never send this expecting a guaranteed instant stop: the answer states which of the two actually happened."}, onBehalfOf: { type: "string", description: "The identifier of a human this caller has itself verified (#1378). RECORDED BESIDE the token's own principal, never instead of it — a stop by the portal for alice@x is written `portal:alice@x`, so an asserted name is never mistaken for a proved one. Bare identifiers only; anything else is dropped." } } } },
   { name: "server_info", description: "The AGPL §13 source offer: this server's name, version, licence, source repository and the COMMIT IT IS RUNNING. Callable by every session kind — the offer is owed to whoever interacts with the service. Reads no run and no account data.", inputSchema: { type: "object", properties: {} } },
   { name: "list_outbox_events", description: "Integrator discovery read (docs/DELIVERY.md): every pending outbox event — delivered markers plus the self-contained run-failed / intake-rejected / duplicate-skipped / late-bind-ack packets. Route each, then mark_sent (delivered) or ack_event (the rest).", inputSchema: { type: "object", properties: {} } },
@@ -713,7 +778,7 @@ export function attachHandlers(server, { scope = { kind: "ops", runId: null }, l
   });
 
   server.setRequestHandler(ListResourceTemplatesRequestSchema, async () => ({
-    resourceTemplates: [{ uriTemplate: "trademark://run/{runId}/{artifact}", name: "prelim run artifact", description: "Raw text of a run artifact (report, audit, narrative, registerFindings, commonLaw, matterContext, a register axis, status.json, run.jsonl).", mimeType: "text/markdown" }],
+    resourceTemplates: [{ uriTemplate: "trademark://run/{runId}/{artifact}", name: "clearotron run artifact", description: "Raw text of a run artifact (report, audit, narrative, registerFindings, commonLaw, matterContext, a register axis, status.json, run.jsonl).", mimeType: "text/markdown" }],
   }));
   server.setRequestHandler(ListResourcesRequestSchema, async () => {
     // / AGPL §13 — LISTED FIRST, AND FOR EVERY SCOPE. An offer nobody can find is not an offer, and
@@ -948,6 +1013,6 @@ export { tools, TOOL_DEFS, NS, log };
 const isMain = isEntrypoint(import.meta.url);
 if (isMain) {
   makeServer().connect(new StdioServerTransport())
-    .then(() => log("ready — read-only interrogation + gated what-if over prelim runs"))
+    .then(() => log("ready — read-only interrogation + gated what-if over clearotron runs"))
     .catch((e) => { log(`fatal: ${e?.stack ?? e}`); process.exit(1); });
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clearotron",
   "type": "module",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",
@@ -38,10 +38,10 @@
     "contract-dictation": "node scripts/contract-dictation-scan.mjs",
     "drain-preflight": "node scripts/drain-preflight.mjs",
     "report-frame-check": "node scripts/report-frame-check.mjs",
-    "dead-names": "node scripts/dead-names.mjs",
+    "retired-settings": "node scripts/dead-names.mjs",
     "authority-probe": "node scripts/authority-boundary-probe.mjs",
     "engine-probe": "node scripts/engine-probe.mjs",
-    "seat-retry": "node scripts/seat-retry-report.mjs",
+    "retry-report": "node scripts/seat-retry-report.mjs",
     "tokens": "node shared/tools/emit-tokens.mjs",
     "tokens:check": "node shared/tools/emit-tokens.mjs --check",
     "sync:uspto": "node bin/uspto-sync.mjs",

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/_shared/enumerate.mjs

@@ -62,7 +62,7 @@ import { clipProviderText } from "./provider-text.mjs";   // — keep the discri
 //
 // Both were 140, and 140 is where the defect lived: the Clarivate Near/Adj refusal is 144 characters
 // and its verdict — `are not allowed` — is the last two words. Cut at 140 it arrived as `are not all`,
-// 's structural predicate could not match, and a refusal that recurs byte-identically forever was
+// That structural predicate could not match, and a refusal that recurs byte-identically forever was
 // filed as weather and retried on every future run of that shape.
 //
 // Raised so the messages actually seen on these paths FIT rather than being reconstructed from a

package/providers/_shared/ledger-path.mjs

@@ -26,7 +26,7 @@
 // do it in silence. `forEachLedgerLine` maps ENOENT to `error: null` deliberately, because a run before
 // any fetch genuinely has no ledger. A renamed default would therefore read a file that is not there,
 // collect zero records, and report no fault: nineteen `verified-from-record` meters with no record on
-// disk and no flag anywhere. That is 's incident exactly, re-created by the fix for.
+// disk and no flag anywhere. That is the incident exactly, re-created by the fix for.
 //
 // Hence resolution is by EXISTENCE, not by name alone — and since moved the DIRECTORY as well as
 // the filename, by existence over both:
@@ -124,7 +124,7 @@ const present = (p) => { try { return existsSync(p); } catch { return false; } }
  *                         mutating the real environment.
  * @returns {{path: string, source: string, legacy: {path: string, bytes: number|null}|null}}
  *   source — "env" | "suite" | "default" | "legacy-default" | "default-fresh"   ( removed "legacy-env")
- *            "suite" is 's redirect: a suite run's ledgers live under its own temp root.
+ *            "suite" is the redirect: a suite run's ledgers live under its own temp root.
  *   legacy — set ONLY when a legacy-named file exists and is NOT the one being used, i.e. when rows are
  *            being left unread. Callers must surface it; nothing here logs.
  */
@@ -221,7 +221,7 @@ export const neutralLedgerPath = (which) => join(homedir(), "trademark", "teleme
 // below matches the writer that produces it (`logRecordBody`) and cannot be confused with it.
 //
 // The CALL ledger does NOT move, for a REAL run. `provider-usage.mjs`'s billing tallies read it across
-// runs, and — the part that matters for 's own safety — it is the evidence that a run made record
+// runs, and — the part that matters for its own safety — it is the evidence that a run made record
 // fetches at all.
 //
 // QUALIFIES THAT SENTENCE AND NOTHING ELSE ABOUT IT: a SUITE run redirects both ledgers into its

package/providers/_shared/ledger.mjs

@@ -23,7 +23,7 @@
 // modules per test and relies on the frozen value).
 //
 // SECURITY — the ids below (agentId / sessionKey / sessionId) are the GATEWAY tool-call context
-// (e.g. "clawdi", "prelim-acme-…"), the per-run attribution. They are NEVER the provider credential
+// (e.g. "clawdi", "clearotron-acme-…"), the per-run attribution. They are NEVER the provider credential
 // (Corsearch's `sessionKey` COOKIE merely shares the name; Clarivate's X-ApiKey; Signa's Bearer token).
 // The ledger is only ever handed `tctx` + response metrics — keep it so.
 //

package/providers/_shared/result-shape.mjs

@@ -66,7 +66,7 @@ export const NEUTRAL_TOOL_RESULT_SHAPE = Object.freeze({
     // key the provider's own kernel is configured to join on is the one its own doBatchScreen emits.
     // See BATCH_SCREEN_JOIN_KEY.
     row: Object.freeze({ identity: Object.freeze(["uri", "record_id"]), verdict: "screen_verdict" }),
-    // euipo answers `screened: <count>`. The free tier's pre- read was
+    // euipo answers `screened: <count>`. The free tier's pre-change read was
     // `parsed.rows ?? parsed.screened ?? parsed.results ?? parsed.records` — on euipo that chain
     // resolves an INTEGER as the screening result the moment `rows` is ever absent. The key is NOT
     // renamed here: the response text is the seat's prompt surface and euipo's own callers read it.
@@ -74,10 +74,10 @@ export const NEUTRAL_TOOL_RESULT_SHAPE = Object.freeze({
     // this file learns the trap instead of rediscovering it.
     reservedScalars: Object.freeze({ screened: "number", asked: "number" }),
   }),
-  // Audited alongside batch screen ('s "worth checking at the same time"): NO split. Every
+  // Audited alongside batch screen (the "worth checking at the same time"): NO split. Every
   // provider that implements search answers `results[]` — corsearch and clarivate through
   // `normalizeSearchResponse`, euipo/uspto-local/free-tier directly — and the driver reads exactly
-  // that name (driver/driver.config.mjs:779, :949).
+  // that name (driver/driver.config.mjs `recordsFromSearch`, and the `clarivate` entry).
   register_search: Object.freeze({
     list: "results",
     listAliases: Object.freeze([]),

package/providers/_shared/term-shape.mjs

@@ -116,7 +116,7 @@ const MARKUP_ARMS = [
  * shorter, so refusing a value for BEING LONG is right at the compiler and wrong at a corrective
  * stage gate — it hands back a reason with no remedy. An annotation always has a remedy: delete the
  * note, keep the term. — that is also why it may sit ABOVE a word-count floor: `ZEPHYR (root)`
- * is an annotation by no measure a word count can see, exactly as 's one-word `**BIOVELTRIN**`
+ * is an annotation by no measure a word count can see, exactly as the one-word `**BIOVELTRIN**`
  * was markup by no measure a word count could see.
  *
  * Moved here from variant-manifest-model.mjs so the stage gate and the plan compiler share

package/providers/corsearch/src/core.js

@@ -53,7 +53,7 @@ export const MATCH_MODE_PREFIX = {
 // `provider` discriminator on every row.
 //
 // SECURITY — the ids logged (agentId / sessionKey / sessionId) are the GATEWAY tool-call context
-// (e.g. "clawdi", "prelim-acme-…"), the per-run attribution. They are NOT the Corsearch `sessionKey`
+// (e.g. "clawdi", "clearotron-acme-…"), the per-run attribution. They are NOT the Corsearch `sessionKey`
 // COOKIE (the live credential, which merely shares the name). logCall is only ever handed `tctx`
 // (kind + gateway ids + target) and response metrics — the cookie is never passed in. Keep it so.
 export const { logCall, logRecordBody, tctxOf } = makeLedger("corsearch");

package/providers/jx-subclass/BUILDING.md

@@ -43,7 +43,7 @@ Then the evidence, which is the point of the directory:
 node verify-relations.mjs      # relation typing vs the hand-checked answer key
 node verify-overlap.mjs        # a machine read vs a human read, on pages both cover
 node coverage-demo.mjs         # read-and-empty and never-read answer DIFFERENTLY
-node score-truth.mjs           # the 63-item key from tracker issue 1210
+node score-truth.mjs           # the 63-item key
 ```
 
 ## What a build needs that this repo does not carry

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,17 @@
 # trademark-oauth-mcp-bridge
 
+## 0.2.2
+
+## 0.3.0-beta.0
+
+## 0.2.1
+
+## 0.2.1-beta.2
+
+## 0.2.1-beta.1
+
+## 0.2.1-beta.0
+
 ## 0.2.0
 
 ## 0.1.12

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/providers/oauth-mcp-bridge/stdin-guard.mjs

@@ -3,12 +3,12 @@
 // stdin-guard.mjs — orphan self-termination for stdio-spawned MCP processes.
 //
 // A stdio MCP server lives exactly as long as the client that spawned it: stdin EOF/close means that
-// client (`claude -p` under the prelim engine, or any other stdio MCP client) is gone and no request can ever arrive
+// client (`claude -p` under the clearotron engine, or any other stdio MCP client) is gone and no request can ever arrive
 // again. Without this guard the bridge held its upstream HTTP transport open FOREVER after the parent
 // died (proven orphan: a bridge.mjs --server legaldatahunter process, PPID 1, ran 3.5 days) — still
 // authenticated, still able to run billable upstream calls for a dead session. Exit 0 and abandon any
 // in-flight work: continuing it is exactly the failure mode. Dependency-free on purpose (unit-tested
-// from the prelim-driver suite, which does not install the bridge's SDK).
+// from the clearotron-driver suite, which does not install the bridge's SDK).
 //
 // NOTE: `end` fires only once something reads stdin (the MCP transport does, post-connect); `close`
 // covers a destroyed stream. The steady-state orphan — connected bridge, parent dies later — is the

package/scripts/README.md

@@ -70,7 +70,7 @@ returns `stale-probe` and refuses, where at one zoom level it used to hand back
 were a measurement. Same six failures, one honest reason. The obstacle was one level up:
 `--virtual-time-budget` services the outer page and starves that subframe.
 
-**That rewrite has landed (, 2026-08-21) and the check measures.** It drives Chrome on real time
+**That rewrite has landed (2026-08-21) and the check measures.** It drives Chrome on real time
 and the page POSTs its state to a loopback server when it is ready, so the harness is *told* rather than
 guessing with a budget; a page that never signals fails by name and can no longer be mistaken for a
 measurement. Baseline before: four consecutive runs gave 4, 6, 1 and 4 failures, with the settle loop

package/scripts/added-reference-check.mjs

@@ -67,6 +67,34 @@ export const isProse = (path, line) => {
   return t.startsWith("//") || t.startsWith("*") || t.startsWith("/*");
 };
 
+// ── A COLOUR IS NOT A CITATION, AND THE DIGITS ALONE CANNOT SAY WHICH ───────────────────────────
+//
+// `TOKEN` matches digits only, so a six-digit hex colour is read as its leading digits and refused as a
+// reference. An earlier sweep acted on exactly that reading and rewrote sixteen colour literals as issue
+// text, two of them live mermaid `classDef` directives — so the documentation's diagrams rendered
+// broken, and thirteen comments stated a value that was no longer there. Restoring them then hit this
+// guard, whose refusal told the author to write the very text that had caused it.
+//
+// TWO RULES, and between them they settle every case without a table of exceptions:
+//
+//   1. A hex colour may contain a-f; an issue number is decimal. A token carrying a letter cannot be a
+//      reference whatever its length, and no reading of the digits is needed to know it.
+//   2. For the all-digit case — three digits is both a short colour and a plausible issue number — the
+//      SITE settles it: a value whose property is a colour is a colour. Same rule and the same property
+//      list as the guard in `driver/test/prompt-payload-names-no-tracker-issue.test.mjs`, which already
+//      plants both and requires them told apart.
+//
+// This does NOT widen to bare digits in prose. A reference in a comment is still refused, which is the
+// whole point of the check, and the arm asserts that direction too.
+const HEX_COLOUR = /#(?:[0-9a-fA-F]{8}|[0-9a-fA-F]{6}|[0-9a-fA-F]{3,4})\b/g;
+const COLOUR_PROPERTY = /(?:^|[;{\s(,])(?:color|background|background-color|border|border-color|fill|stroke|outline|box-shadow|text-shadow)\s*:\s*$/i;
+
+/** Strip hex colours, so what remains is only tokens that could be a reference. */
+export const withoutColourValues = (line) => String(line).replace(HEX_COLOUR, (m, offset, whole) => {
+  if (/[a-fA-F]/.test(m.slice(1))) return "";                              // letters ⇒ not a decimal number
+  return COLOUR_PROPERTY.test(whole.slice(0, offset)) ? "" : m;            // all digits ⇒ the property decides
+});
+
 /** Strip the spans where a `#NNN` is an address rather than a reference. */
 export const withoutLinkTargets = (line) => line
   .replace(/\]\([^)]*\)/g, "]()")                 // markdown link targets, anchors included
@@ -76,7 +104,7 @@ export const withoutLinkTargets = (line) => line
 /** Every offending token on one added line, or an empty array. */
 export const offendingTokens = (path, line) => {
   if (!isProse(path, line)) return [];
-  return [...withoutLinkTargets(line).matchAll(TOKEN)].map((m) => m[0]);
+  return [...withoutColourValues(withoutLinkTargets(line)).matchAll(TOKEN)].map((m) => m[0]);
 };
 
 const baseArg = () => {

package/scripts/ai-page-render-check.mjs

@@ -41,6 +41,7 @@
 //                    per assistant, with a reason, and render no button. Zero buttons is the pass.
 //   wired-client     the hosted shape: address assistants live, stdio ones honestly absent.
 //   wired-staff      everything on offer at once — the widest bijection.
+import { navigateOrRefuse } from './headless-page.mjs'   // Page.navigate returns an errorText, and nothing read it
 import { createServer } from 'node:http'
 import { reapOnExit } from "../shared/reap-on-exit.mjs";   // — a detached group dies with this script
 import { readFileSync, existsSync, mkdtempSync, rmSync } from 'node:fs'
@@ -350,7 +351,7 @@ for (const state of Object.keys(STATES)) {
   mints = 0
   await cmd('Page.navigate', { url: 'about:blank' })
   await new Promise((r) => setTimeout(r, 150))
-  await cmd('Page.navigate', { url: `${origin}/portal/ai` })
+  await navigateOrRefuse(cmd, `${origin}/portal/ai`, { what: 'ai-page-render-check' })
   await new Promise((r) => setTimeout(r, 1400))
 
   const access = accessFor(STATES[state])

package/scripts/authority-boundary-probe.mjs

@@ -3,7 +3,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // authority-boundary-probe.mjs — DOES THE CLI OBEY THE BOUNDARY, AND DOES THE RUN SURVIVE IT?
 //
-// 's acceptance, and the half of it CI structurally cannot reach: CI has no claude binary and no
+// That acceptance, and the half of it CI structurally cannot reach: CI has no claude binary and no
 // subscription, so `node --test` can only prove the hook DECIDES correctly. Whether `claude -p` HONOURS
 // the decision — and whether the turn carries on afterwards instead of dying — is a property of the live
 // CLI, and the only honest way to know it is to ask the live CLI.

package/scripts/backfill-started-at.mjs

@@ -38,7 +38,7 @@ const WORKSPACE_ROOT = argValue("--workspace-root") ?? envFrom(process.env, "CLE
 // The default is the CANONICAL agent alone. It used to name two of this firm's people, which shipped
 // their identities to every clone and told an installer nothing. Per-agent rosters are a
 // property of a deployment, so they are passed: --agents a,b,c
-const AGENTS = (argValue("--agents") ?? "clawdi").split(",").map((s) => s.trim()).filter(Boolean);
+const AGENTS = (argValue("--agents") ?? "localagent").split(",").map((s) => s.trim()).filter(Boolean);
 const APPLY = process.argv.includes("--apply");
 
 function argValue(flag) {

package/scripts/citation-line-check.mjs

@@ -102,7 +102,7 @@ const exemptTarget = (t) => EXEMPT_TARGETS.find((e) => e.target.test(t)) ?? null
  * A citation this checker CANNOT resolve and a human has adjudicated anyway. One rule for every member:
  * the entry names the citing FILE and the cited BASENAME, and it carries the reason resolution is
  * impossible rather than merely hard. Anything ambiguous and undeclared FAILS the run — the bucket is
- * not a backlog to hide in, which is what it was until 's second pass emptied it.
+ * not a backlog to hide in, which is what it was until the second pass emptied it.
  *
  * `citation-line-check.test.mjs` asserts every entry is REACHED — that it still matches a live ambiguous
  * citation — not merely that its regex is well formed. That distinction is the defect this pass found in
@@ -156,7 +156,7 @@ export function indexByBasename(files) {
  *
  * "ambiguous" is a finding AND an error: a citation reading `SKILL.md:41` names fifteen possible files in
  * this tree, so nothing here can judge it and nothing here ever did. That was its whole defect. Since
- * 's second pass the population is empty apart from AMBIGUOUS_DECLARED, and an undeclared one fails.
+ * That second pass the population is empty apart from AMBIGUOUS_DECLARED, and an undeclared one fails.
  */
 export function resolveCited(cited, byBase, exists = (p) => existsSync(join(ROOT, p))) {
   if (exists(cited)) return { state: "exact", path: cited };
@@ -702,7 +702,7 @@ export function symbolMisses(citations, readLines) {
 // are ranges that open on a blank line and then carry exactly the content they promise. Requiring EVERY
 // line of the span to be empty drops both WITHOUT an exemption, and leaves no false positive to exempt.
 // That matters more than the two rows: an exemption list here would be keyed on "this citation looks
-// like prose about citations", which is the shape that hid 's drift inside its own carve-out.
+// like prose about citations", which is the shape that hid the drift inside its own carve-out.
 //
 // WHAT IT CANNOT SEE, and why this stays a slice. A citation that lands on the WRONG NON-BLANK LINE is
 // invisible to it — that looks identical to a correct one. Three of the eleven citations repointed in

package/scripts/clearances-render-check.mjs

@@ -9,6 +9,7 @@
 //
 // Because nothing else in this repo can answer the question. portal-ui runs `node --test` with type
 // stripping and carries no jsdom and no React test renderer — Node cannot import a `.tsx` at all — so the
+import { navigateOrRefuse } from './headless-page.mjs'   // Page.navigate returns an errorText, and nothing read it
 import { reapOnExit } from "../shared/reap-on-exit.mjs";   // — a detached group dies with this script
 // four source-text tests over Clearances.tsx can prove a string is in a file and nothing more. They
 // cannot see a width, an alignment, or a scrollbar, which is precisely what and are about.
@@ -191,7 +192,7 @@ const MEASURE = `(async () => {
   });
 
   // Does the NAME wrap? Same method as the date: rendered height against line height. The Name cell is
-  // the one tracker issue 280 says must not wrap for a single mark of ordinary length, and counting characters
+  // the one that must not wrap for a single mark of ordinary length, and counting characters
   // cannot answer that — only the layout engine can.
   const nameIdx = headText.findIndex(t => /^NAME/i.test(t));
   const nameLines = [...table.querySelectorAll('tbody tr.row')].map(tr => {
@@ -318,7 +319,7 @@ const cmd = (method, params) => new Promise((r) => { const i = ++id; pending.set
 const value = async (expr) => (await cmd('Runtime.evaluate', { expression: expr, awaitPromise: true, returnByValue: true })).result?.result?.value ?? null
 
 const reload = async () => {
-  await cmd('Page.navigate', { url: `${origin}/portal/clearances` })
+  await navigateOrRefuse(cmd, `${origin}/portal/clearances`, { what: 'clearances-render-check' })
   await new Promise((r) => setTimeout(r, 1800))
 }
 
@@ -359,7 +360,7 @@ const toggle = await value(TOGGLE)
 // is what it did the first time this ran.
 await value(`(async () => { const b = document.querySelector('label.group-toggle input'); if (b && !b.checked) { b.click(); await new Promise(r => setTimeout(r, 300)); } return true })()`)
 
-// The drift probe: the SAME page with one run title made much longer. 's own acceptance test —
+// The drift probe: the SAME page with one run title made much longer. its own acceptance test —
 // "lengthen a run title in the fixture data and nothing except that title moves".
 longTitle = true
 await reload()

package/scripts/compare.mjs

@@ -83,7 +83,7 @@ const CONFIG_PARITY = {
 };
 
 // ── what these five deliberately do not reach ────────────────────────────────────────────────────────
-// Recorded as not covered, never silently absent — 's own instruction.
+// Recorded as not covered, never silently absent — its own instruction.
 const NOT_COVERED = [
   "common law in a country that has none — Switzerland has no common-law rights system and none of the five points there, so the engine's behaviour when the grid has nothing to search is unexercised",
   "the deliverable step — the client-format document produced at the lawyer's agent is outside tracker #462 and no scenario reaches it",
@@ -212,7 +212,7 @@ function findingTerritories(f) {
 }
 
 /**
- * 's classification, on the frozen register plan: is a query THIS territory's own deep-dive, one
+ * That classification, on the frozen register plan: is a query THIS territory's own deep-dive, one
  * that merely reaches it, or one restricted to nowhere?
  *
  * "Per-jurisdiction is not narrower than the scope. It is a query that names ONE territory and no