clearotron 0.2.0 → 0.2.2

package/shared/client-door.mjs

@@ -48,7 +48,7 @@ export const CLIENT_DOOR_UNIT = "clearotron-client-mcp.service";
 /**
  * Where revoked key ids live, and the one place that decides it.
  *
- * — bb8's F14. This literal was written out in four places (connect, start
+ * — found in review. This literal was written out in four places (connect, start
  * twice, disconnect). `connect` armed the variable AND created the file, with a comment saying exactly
  * why: a named-but-absent file was the same landmine one step later, because `isRevoked` then failed
  * OPEN on an unreadable list. It fails CLOSED now, which makes creating the file more load-bearing
@@ -63,7 +63,7 @@ export const defaultDenylistPath = (home) => join(home, ".config", "clearotron",
 /**
  * The denylist path a door should be given — the operator's, if they set one.
  *
- *, bb8's sharpening of F14. `defaultDenylistPath` answers "where does it live
+ *, a later review's sharpening of it. `defaultDenylistPath` answers "where does it live
  * when nobody said"; this answers "where does it live", which is the question every caller actually had.
  * The client door was composed with the default UNCONDITIONALLY while every other child inherited
  * TRADEMARK_MCP_TOKEN_DENYLIST, so on a box where an operator had placed the list themselves:
@@ -173,7 +173,7 @@ export function clientDoorState({ env = {}, unitDir, exists, active = null, list
   // synonym for false: a caller that cannot reach systemd must not be able to report a door as down
   // any more than it can report one as up. Same discipline as the queue-watch arm's unprobed half.
   return {
-    // — bb8's F11: what is ANSWERING, which the unit file cannot say.
+    // — found in review: what is ANSWERING, which the unit file cannot say.
     // — THE PAIR, NOT ITS BOOLEAN. `active` collapses ActiveState and SubState,
     // so a crash loop (`activating/auto-restart`) and a unit that was never started (`inactive/dead`)
     // reduce to the same `false` and printed the same sentence — one is a fault to read the journal for,
@@ -228,7 +228,7 @@ export function describeDoorState(door, {
         text: `the client door is HALF configured — ${missing}. Something began setting it up and stopped: `
           + `finish with \`${connectCmd}\`, or close it with \`${closeCmd}\`.` };
     }
-    // A DOOR THAT ANSWERS IS SET UP, WHATEVER THE UNITS SAY ( — bb8's F11).
+    // A DOOR THAT ANSWERS IS SET UP, WHATEVER THE UNITS SAY (found in review).
     //
     // `standing` is unit-file + fence, and a FOREGROUND `clearotron start` has neither: it runs the door
     // as its own child. Measured — the door listening on its port while this sentence said "the client
@@ -263,7 +263,7 @@ export function describeDoorState(door, {
         + "so this says the door is set up, not that it answers" };
   }
   if (door.active === false) {
-    // NAME THE STATE, AND NEVER ASSERT AN EMPTY PORT WITHOUT LOOKING (, Hera).
+    // NAME THE STATE, AND NEVER ASSERT AN EMPTY PORT WITHOUT LOOKING.
     //
     // This said "nothing is listening on the client door" from `active === false` alone, while a probe
     // of that very port had already been taken and passed in — and read nowhere on this branch. With a
@@ -477,7 +477,7 @@ export function enablePlan({ env = {}, address, identity, accessFile = null, por
     }
   }
 
-  // ── THE PORT IS CHECKED, NOT ASSUMED (, and measured 2026-08-31) ──────────────────────────
+  // ── THE PORT IS CHECKED, NOT ASSUMED (and measured 2026-08-31) ──────────────────────────
   //
   // A default port is a guess about which instance you are. Driving this verb on a shared box found
   // 18811 ALREADY HELD by another user's client face: the unit was installed, started, and crash-looped,
@@ -987,7 +987,7 @@ export function applyDisablePlan(plan, io) {
   return { done };
 }
 
-// ── IS THE PUBLISHED ADDRESS REAL? (, acceptance 2) ────────────────────────────────
+// ── IS THE PUBLISHED ADDRESS REAL? (acceptance 2) ────────────────────────────────
 //
 // The criterion is deliberate about which question this answers: "doctor reports the door's
 // REACHABILITY, not its configuration — the address is set AND answers from outside the box. An address

package/shared/driver-dir.mjs

@@ -43,7 +43,7 @@
 // IT DOES NOT SET A MODE, and this change alters no behaviour on disk. Pinning 0o750 here in the same
 // commit would be a semantic change riding inside a seam, and the seam is the part that has to be
 // reviewable by reading nineteen call sites and agreeing they still mean what they meant. The mode is
-// 's business, and when it is taken it is one line in this file.
+// That business, and when it is taken it is one line in this file.
 //
 // IT WOULD NOT RESTRAIN THE SEAT IF IT DID. The agent runs as the same account that owns these
 // directories, so owner bits apply whatever the group bits say. A tighter mode removes GROUP write,

package/shared/env-aliases.mjs

@@ -85,48 +85,6 @@ export function envFrom(env, name) {
   return v === "" ? undefined : v;
 }
 
-/** The prefix every retired spelling carries. The rename moved the stem and nothing else. */
-export const RETIRED_PREFIX = "PRELIM_";
-
-/**
- * Every retired-spelling line SET in `env`, each with the name in force where there is one.
- *
- * ── THE DETECTION NEEDS NO TABLE, AND THAT IS DELIBERATE ────────────────────────────────────────
- *
- * No product code reads a `PRELIM_*` name — nothing on this tree does, and an arm holds it that way
- * (driver/test/retired-env-spellings.test.mjs). So a `PRELIM_*` line that is SET is dead, full stop,
- * and this cannot go stale against a list somebody forgot to update. A table-driven detection would
- * have exactly the failure mode the issue was filed about: silence for the name nobody wrote down.
- *
- * The table decides only the SECOND half of the sentence — which name to use instead — because that
- * is the half that can be wrong. `NAMES_IN_FORCE` is derived from the build's own readers
- * (scripts/mint-names-in-force.mjs), so a replacement is named only when something actually reads it.
- * Where no `CLEAROTRON_` partner exists the setting did not move, it went, and `replacement` is null.
- * Sending an operator to a variable nothing reads would replace one silent failure with another.
- *
- * EMPTY IS UNSET, as everywhere else here: an `X=` line in an EnvironmentFile means "not configured",
- * so it is not reported. An operator who blanked a line has already stopped setting it.
- */
-export function retiredSpellingsIn(env = process.env) {
-  const inForce = new Set(NAMES_IN_FORCE);
-  const found = [];
-  for (const name of Object.keys(env ?? {})) {
-    if (!name.startsWith(RETIRED_PREFIX) || !has(env, name)) continue;
-    const candidate = `CLEAROTRON_${name.slice(RETIRED_PREFIX.length)}`;
-    found.push({ name, replacement: inForce.has(candidate) ? candidate : null });
-  }
-  return found.sort((a, b) => a.name.localeCompare(b.name));
-}
-
-/** The one sentence a retired spelling is worth, used by every surface that reports one. */
-export function retiredSpellingLine({ name, replacement }) {
-  return replacement
-    ? `${name} is a RETIRED spelling and nothing reads it — the name in force is ${replacement}. `
-      + `Rename the line in your environment file; its value is being ignored until you do.`
-    : `${name} is a RETIRED spelling and nothing reads it — this setting no longer exists under any `
-      + `name. Delete the line from your environment file.`;
-}
-
 /**
  * Say so when a DELETED setting is still set. Nothing is applied and nothing is translated.
  *
@@ -141,12 +99,6 @@ export function warnRetiredEnv({ env = process.env, note = defaultNote } = {}) {
       + `environment file.\n`);
     said.push(name);
   }
-  // The retired SPELLINGS, on the same footing and through the same emitter — so every service that
-  // already announces its posture at boot announces this too, rather than one service happening to.
-  for (const row of retiredSpellingsIn(env)) {
-    note(`[env] ${retiredSpellingLine(row)}\n`);
-    said.push(row.name);
-  }
   return said;
 }
 

package/shared/env-local.mjs

@@ -203,7 +203,7 @@ export const NO_DOTFILE = Object.freeze([
   // derived guard caught it in the same commit that created it, which is the eleventh arriving loudly.
   "scripts/post-deploy-validate.mjs",
   // step 4 / — THE DERIVED SCAN COULD NOT SEE THESE TWO, and the reason is worth keeping.
-  // 's scan walked every shebang entry looking for a module-top `process.env` capture of a renamed
+  // That scan walked every shebang entry looking for a module-top `process.env` capture of a renamed
   // name. These capture INSIDE a function, so the scan passed over them — and they were stranding an
   // operator all the same: both read a retired spelling and reached no translation, so a box configured
   // with the name in force handed them nothing and the read fell through to a default. `compare` printed

package/shared/identifier-scan.mjs

@@ -288,7 +288,7 @@ const COMMENT_LINE = /^\s*(\/\/|#|\*|<!--)/;
 // address, and a reader sent looking for one would be looking in the wrong place.
 // `contact` joins on the owner's ruling of 2026-08-24: the launch documents collapsed to ONE public
 // mailbox, and counsel's pack (ADDITIONAL-TERMS.md, NOTICES.md, TRADEMARKS.md) prints it. Added here in
-// the same PR that introduced it, per 's rule above — a ruled mailbox joins this list, it never gets
+// the same PR that introduced it, per the rule above — a ruled mailbox joins this list, it never gets
 // a domain exemption. `interested` and `security` stay: they are no longer printed by any shipping
 // document, but removing a localpart from an allowlist is how a future document that uses one again
 // fails for a reason nobody expects.
@@ -390,7 +390,7 @@ export function scanOperatorIdentity(files, readFn, { withheld = () => false } =
 // ──: THE RETIRED PLATFORM ───────────────────────────────────────────────────────────────────
 //
 // The sixth pattern, and the narrowest: one token, matched case-insensitively, anywhere in a tracked
-// file. It is here rather than in a one-off script because 's last scope line asks for exactly
+// file. It is here rather than in a one-off script because the last scope line asks for exactly
 // this — "extend the battery so this class cannot return" — and because the class it guards is the
 // one the other five provably could not see. An integrator platform's name is not a person, not a
 // home path, not a classification stamp, not an audience, and not a vendor standing where a category
@@ -439,7 +439,7 @@ export const namesRetiredPlatform = (text) => RETIRED_PLATFORM.test(String(text
 // reasonably concludes they need a Cloudflare account.
 //
 // WHY A QUALIFIER RATHER THAN A BAN. The vendor name must keep appearing — a runbook worked through
-// one real proxy end to end is worth more to an installer than an abstract one, and 's rewrite
+// one real proxy end to end is worth more to an installer than an abstract one, and the rewrite
 // deliberately kept it. What must not happen is the name standing where the CATEGORY belongs. So the
 // rule is: name the vendor as much as you like, provided the line (or the one either side of it) says
 // it is an example, a reference, or what THIS deployment happens to use.

package/shared/invocation.mjs

@@ -263,7 +263,7 @@ export const bareInvocation = (verb) => `clearotron ${verb}`;
 /**
  * Refuse a prompt when there is nobody to answer it.
  *
- * — bb8's F14 item 5. `install` has said this since it was written; `connect`
+ * — found in review. `install` has said this since it was written; `connect`
  * and `disconnect` prompt through readline and did not, so piped or redirected they read EOF and took
  * it as an answer. `install`'s exit code and wording are the model, and this is that model shared
  * rather than copied a third time.

package/shared/names-in-force.mjs

@@ -141,6 +141,7 @@ export const NAMES_IN_FORCE = Object.freeze([
   "CLEAROTRON_REPLAY_SNAPSHOT",
   "CLEAROTRON_REPORTS_DIR",
   "CLEAROTRON_REPORTS_URL",
+  "CLEAROTRON_REQUESTER_WHATSAPP",
   "CLEAROTRON_REQUIRE_EXPLICIT_PORTS",
   "CLEAROTRON_RETRY_BACKOFF_MS",
   "CLEAROTRON_RUN_DIR",
@@ -168,6 +169,7 @@ export const NAMES_IN_FORCE = Object.freeze([
   "CLEAROTRON_WARM_RETRY",
   "CLEAROTRON_WATCH_",
   "CLEAROTRON_WHATIF_MAX_CONCURRENT",
+  "CLEAROTRON_WHATSAPP_OPERATOR_COPY",
   "CLEAROTRON_WORKSPACE_PREFIX",
   "CLEAROTRON_WORK_DIR",
   "CLEAROTRON_X",

package/shared/product-owned-names.mjs

@@ -24,7 +24,7 @@
 // Add it here and nowhere else, and only if this product genuinely owns it. A prefix added to let one
 // awkward name through re-opens the gap for every future gather — the cost is not local.
 export const PRODUCT_NAME_PREFIXES = Object.freeze([
-  "PRELIM", "CLEAROTRON", "PORTAL", "TRADEMARK_MCP", "CLIENT_MCP", "CLIENT_ACCESS",
+  "CLEAROTRON", "CLEAROTRON", "PORTAL", "TRADEMARK_MCP", "CLIENT_MCP", "CLIENT_ACCESS",
   "CLIENT_CF", "PROFILE", "RECIPE", "MCP_A",
 ]);
 

package/shared/register-selection.mjs

@@ -31,7 +31,7 @@
 // `driver/run-requirements.mjs` derives from those two fields and never restates them.
 //
 // The vendor sign-up steps travel WITH the table rather than staying behind in the wizard: they are
-// facts about the register, the wizard is one reader of them, and tracker issue 100 asks for the same
+// facts about the register, the wizard is one reader of them, and the same steps are asked for on the same
 // steps on surfaces the wizard does not own.
 
 // The USPTO sizing figures are MEASURED and live in their own module; the warnings below quote them

package/shared/scope.mjs

@@ -39,7 +39,7 @@ export function isRevoked(jti, { denylistPath = process.env.TRADEMARK_MCP_TOKEN_
   let text;
   try { text = readFileSync(denylistPath, "utf8"); }
   catch (e) {
-    // FAIL CLOSED ( — bb8's F14; overwatch ruling, recorded on 1889 for the owner's
+    // FAIL CLOSED (found in review; ruled and recorded for the owner's
     // review with the reversal path, which is this function).
     //
     // This returned false — "not revoked" — on any unreadable list, and that is how a revoked key kept
@@ -64,7 +64,7 @@ export function isRevoked(jti, { denylistPath = process.env.TRADEMARK_MCP_TOKEN_
  *
  * NOT AN AUTHENTICATOR. This parses without verifying, which is safe for exactly one job: reading the
  * revocation handle out of our own `mintToken` output so `clearotron connect` can write it down
- * (, owner ruling: record key IDs, never secrets). Anything answering "is this token
+ * (owner ruling: record key IDs, never secrets). Anything answering "is this token
  * good" goes through `verifyToken`; a caller handing this function a token from the WIRE is the defect.
  *
  * Returns null rather than throwing on a malformed string — the caller is recording, and a record of
@@ -302,7 +302,7 @@ export const USER_ARTIFACTS = new Set(["report"]);
 //   SEALED  MODEL IDENTITY, BILLED COUNTS, and THE ENGINE'S JUDGMENT OF ITS OWN OUTPUT. Which model tier
 //           ran a stage and what it cost is the firm's cost structure, not an audit fact — and
 //           `withdrawn_reason` ("confabulated attribution") is an assessment of our own quality that the
-//           client has no counterpart for, already ruled un-forwardable (, scrub.mjs).
+//           client has no counterpart for, already ruled un-forwardable (scrub.mjs).
 //
 // That line is cheap to hold because the code had already drawn it: events.mjs says "Model identity is
 // deliberately NOT projected here: decision_timeline / run_changes are narrative surfaces", trace.mjs and
@@ -713,7 +713,7 @@ export function attributionOf(scope, onBehalfOf = null) {
   // the delegate does not widen what the token may do.
   const delegate = typeof onBehalfOf === "string" && onBehalfOf.trim() ? onBehalfOf.trim() : null;
   if (!delegate) return self;
-  // COUNTS AND IDENTIFIERS, NOT PROSE ('s scope note): this file is a matter record. A delegate
+  // COUNTS AND IDENTIFIERS, NOT PROSE (the scope note): this file is a matter record. A delegate
   // carrying whitespace, a colon or a newline would forge the compound form or spill a sentence into the
   // archive, so anything that is not a bare identifier is refused and the verified half stands alone.
   if (!/^[A-Za-z0-9._%+@-]{1,128}$/.test(delegate)) return self;
@@ -759,7 +759,7 @@ export function authorize(scope, toolName, args = {}) {
     }
     // The PREVIEW only, deliberately — the same line the internal branch draws below.
     //
-    // #53's defect was that the FREE call every principal makes first died on a message naming an
+    // The defect was that the FREE call every principal makes first died on a message naming an
     // internal doc, so that is the call the stamp exists to rescue. Extending it to start_run would
     // quietly remove a spend gate: an ops token's sub is often a connector name or "local", buildJob
     // fills forwarderEmail from `${forwarder}@example.com` when none is given, and the result is a real

package/shared/server-units.mjs

@@ -28,7 +28,7 @@
 // today and zero right ones tomorrow. `orphanReason` cannot discriminate either — all six carry one, and
 // `clearotron-client-mcp`'s used to say the opposite thing — never install it eagerly, because starting
 // it was the on-demand consent that opened client-account access. That row was rewritten on 2026-09-03
-// when the owner superseded the posture (, settled point 2), which does not rescue the
+// when the owner superseded the posture (settled point 2), which does not rescue the
 // rejected repair: the reason a skip-on-orphan filter fails is that `runsOn: []` records boxes MEASURED,
 // and every unit here starts life unmeasured.
 //
@@ -74,7 +74,7 @@ export const SERVER_INSTALL_SET = Object.freeze([
   // "On demand is fine" — starting the door WAS the consent that opened client-account access, so an
   // installer that placed it would have made that consent meaningless.
   //
-  // The owner superseded that knowingly (, settled point 2): the door auto-starts
+  // The owner superseded that knowingly (settled point 2): the door auto-starts
   // with the product and THE PER-ACCOUNT KEY IS THE GATE, not whether a process runs. A door with no
   // key issued refuses everything, which is the same protection with a different mechanism — and a
   // better one, because it does not depend on a reader finding a verb.
@@ -85,7 +85,7 @@ export const SERVER_INSTALL_SET = Object.freeze([
 ]);
 
 /**
- * Installed and enabled ONLY by `clearotron connect`, never by an install path (,
+ * Installed and enabled ONLY by `clearotron connect`, never by an install path (
  * owner ruling 2026-08-31). Named here so a reader of this file learns it exists and learns it is
  * excluded on purpose — an absence with no reason beside it is the thing this module is against.
  */
@@ -98,7 +98,7 @@ export const ON_DEMAND_UNITS = Object.freeze([]);
 /**
  * Which of the installed units a `--background` REFRESH must restart.
  *
- * — Hera's review of the F15 fix. `enable --now` on an ALREADY-ACTIVE unit is a
+ * — A review of that fix. `enable --now` on an ALREADY-ACTIVE unit is a
  * no-op, so a refresh over an updated checkout leaves the old process running the old files. The restart
  * loop that exists for exactly that named a hardcoded PAIR — the same pair the health check named, three
  * lines below it — with the same stale justification: "the oneshot and its triggers pick the new copies

package/shared/store-in-repo.mjs

@@ -226,7 +226,7 @@ export function commitWithAuditRow({ audit, gitCommit, files, message, by, row }
 //   portal-service   RECIPE_REPO_ROOT || <the profile repo root>   → the config store → saves work
 //   recipe-service   RECIPE_REPO_ROOT || join(HERE, "..")          → the PRODUCT CHECKOUT → FATAL
 //
-// Two ends of one contract measuring different things ('s class). The portal consulted the profile
+// Two ends of one contract measuring different things (the class). The portal consulted the profile
 // root as a second chance and the recipe-service did not, so one door came up and the other exited 1.
 //
 // AND THE DIVERGENT FALLBACK IS THE DANGEROUS ONE, which is why this is not merely tidying. The product
@@ -320,7 +320,7 @@ export function makeStoreCommit({ repoRoot, log = () => {}, what = "store", retr
       } catch (e) {
         const detail = detailOf(e);
         if (isTransientGitFault(detail) && attempt <= retries) { napping(waitMs * attempt); continue; }
-        // NAMED, not merely reported. 's line held that a failed commit is a permanent sync blocker
+        // NAMED, not merely reported. That line held that a failed commit is a permanent sync blocker
         // and belongs in the journal; it is no longer permanent — the next save completes it — but the
         // operator still needs to know WHICH fault, because a hook and a full disk want different people.
         log(`${what} COMMIT FAILED after the write landed — the save is LIVE and the paths are STAGED, `

package/shared/suite-census.mjs

@@ -15,7 +15,7 @@
 //
 // ── `.test(` IS NOT COUNTED, AND THAT IS THE WHOLE CALIBRATION ─────────────────────────────────────
 //
-// 's own thread records the miscount: 177 `RegExp.prototype.test` calls counted as subtests,
+// its own thread records the miscount: 177 `RegExp.prototype.test` calls counted as subtests,
 // genuine subtests ZERO. So this counts `assert.<something>` and a `test(` at the START of a line, and
 // nothing else. Two independent checks that it is calibrated: on the tree it was minted from, the
 // counted test sites match the EXECUTED totals at 415/415 for portal-ui, 382 against 386 for
@@ -105,7 +105,7 @@ export function rootScriptDisagreements(readManifest, declared = CENSUS_ROOT_SCR
 //
 // while 581 of 639 driver test files stop being collected. Both sides agreed because both sides
 // enumerate through the list ABOVE, and nothing in this repository opened a package.json. The census
-// was move-proof about the tests and blind to itself being pointed somewhere else, which is 's own
+// was move-proof about the tests and blind to itself being pointed somewhere else, which is its own
 // doctrine line: an enumerated check is blind to the thing moving; a discovered check is blind to
 // ITSELF moving.
 //
@@ -237,7 +237,7 @@ export function lossBetween(prevPerFile, nextPerFile) {
 }
 
 /**
- * tracker issue 205 — WHICH BUCKET EACH DIFFERENCE LANDS IN, and which of them refuses a re-stamp.
+ * WHICH BUCKET EACH DIFFERENCE LANDS IN, and which of them refuses a re-stamp.
  *
  * `lossBetween` above answers what MOVED. This answers what that MEANS, and it is a separate question
  * with a separate history. A rising skip count is a real difference and it used to refuse: it landed
@@ -343,7 +343,7 @@ export function countTestSites(text) {
  * The 1-based LINE of every assert site, in source order. One site per `assert.<x>` occurrence, so a
  * line carrying two of them appears twice — the same arithmetic `countTestSites` reports.
  *
- * 's fifth member needs the LINES, not just the total: a GATED arm — `if (!process.env.X) return;`
+ * That fifth member needs the LINES, not just the total: a GATED arm — `if (!process.env.X) return;`
  * at the top of a test body — leaves every token in place, so a count cannot see it and only "did this
  * line ever run" can. That question is answered by a coverage pass, and the two sides must ask it of the
  * SAME sites, so the rule lives here once rather than being re-typed against the same file.

package/shared/tracked-files.mjs

@@ -114,5 +114,36 @@ export function grepTrackedFiles(guard, { root, args }) {
   return files;
 }
 
+/**
+ * The tracked corpus WITH ITS INDEX MODES, or null when this tree has no checkout to read it from.
+ *
+ * WHY THIS IS HERE RATHER THAN LEFT TO ITS ONE CALLER (tracker issue 235). The executable-bits guard
+ * needs `ls-files -s`, which carries the mode, and `trackedFiles` above deliberately returns paths
+ * only. So that guard called the helper for its skip contract and then spawned git a SECOND time,
+ * raw, for the modes — correct, because the raw call sits behind the helper's null check, but
+ * indistinguishable from an unguarded one to any reader or check looking at the call sites.
+ *
+ * The invariant is "corpus enumeration degrades to a stated skip", and `-s` is corpus enumeration.
+ * Extending the helper keeps that true by construction instead of by the ordering of two calls.
+ *
+ * @returns {Map<string,string>|null} path -> index mode ("100644", "100755", …) — null means SKIP
+ */
+export function trackedIndexModes(guard, { root }) {
+  const r = run(root, ["ls-files", "-s"]);
+  if (r.status !== 0) {
+    say(`${GUARD_SKIPPED_MARKER} ${guard} — ${reasonFrom(r)}; ${NO_CORPUS_REMEDY}`);
+    return null;
+  }
+  const out = new Map();
+  for (const line of r.stdout.split("\n")) {
+    if (!line.trim()) continue;
+    // `<mode> <object> <stage>\t<path>` — the tab is the only safe separator, a path may contain spaces.
+    const [meta, path] = line.split("\t");
+    if (path) out.set(path, meta.split(" ")[0]);
+  }
+  say(`${GUARD_OK_MARKER} — ${guard}: ${out.size} tracked file(s) with modes`);
+  return out;
+}
+
 /** The one-line reason a guard hands to `t.skip()`, so the TAP line says it too. */
 export const skipReason = (guard) => `${guard}: not a git checkout — ${NO_CORPUS_REMEDY}`;

package/shared/tty-style.mjs

@@ -2,7 +2,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // tty-style.mjs — weight where the meaning is, and NOTHING when the reader is not a terminal.
 //
-// ── why this exists (, owner ruling 2026-08-31) ────────────────────────────────────
+// ── why this exists (owner ruling 2026-08-31) ────────────────────────────────────
 //
 // "new terminals can do things like bold and colours etc — good formatting impresses people because it's
 // made clear to them someone put the time in." That is a product argument, not a decorative one: setup

package/shared/uspto-index-size.mjs

@@ -102,7 +102,7 @@ export const USPTO_PEAK_GB = Math.round((USPTO_INDEX_GB + USPTO_PEAK_WAL_GB) * 1
 //
 // It was pessimistic by 4x. Charging 1.0 demanded ~43.8 GB for a build whose index came to 10.1 GB, and
 // INSTALL.md told the reader to provision 60 GB. On the free tier that is the difference between "I can
-// try this on the disk I have" and "I cannot", which is the whole of 's Why.
+// try this on the disk I have" and "I cannot", which is the whole of the Why.
 //
 // Carried at 0.35 against 0.24 measured — a 46% margin, and the margin is doing real work rather than
 // decorating a guess:

package/shared/vacuous-pass.mjs

@@ -158,7 +158,7 @@ export function discoveredLoops(text) {
 
 // ── THE EARLY-RETURN HALF ──────────────────────────────────────────────────────────────────
 //
-// 's ruling names two shapes. `discoveredLoops` above is the loop half. This is the other, and
+// That ruling names two shapes. `discoveredLoops` above is the loop half. This is the other, and
 // the two are not alike enough to share a detector:
 //
 //   test("the tree is clean", () => {

package/skills/clearotron-account/SKILL.md

@@ -165,21 +165,50 @@ question to the issuing firm rather than reconstructing an answer.
 
 ## Asking what-if
 
-A what-if re-runs **one step** of a finished search under a changed assumption, in a sandbox. It is the
-right tool when the user asks *what if this were different* — and the wrong one when they want a fresh
-answer about a different mark, which is a new search.
-
-- **Plan, read the honesty note aloud, then commit.** `what_if_plan` says in plain words how complete
-  the answer will be. Re-running an early step does **not** re-run the risk read or the report on top of
-  it, and a user who is not told that will read a partial output as a new verdict. Say it before you
-  spend, not after.
-- **It costs money and it is not instant.** The experiment queues on the server and runs there. Tell the
-  user it is running and collect it with `what_if_result` rather than promising an immediate answer.
+A what-if answers *what if this were different* about a search that has already run. There are two, and
+the search's own state decides which one you can have:
+
+- a **step re-run**, while the search is still live — one step runs again under a changed assumption, in
+  a sandbox;
+- a **memo**, once the search is delivered or archived — the evidence already gathered is read again
+  under the assumption, and a short document comes back naming the report it belongs to.
+
+Either is the wrong tool when the user wants a fresh answer about a different mark. That is a new search.
+
+**On a delivered report, offer the memo.** A step re-run is refused there, and that refusal is the one
+that used to end the conversation with *commission a fresh search*. It should not. A user holding a
+report who asks *what if the Korean application were abandoned* is asking the most ordinary question
+there is, and the memo is the answer to it — so check the search's state before you tell anyone the
+question cannot be answered.
+
+- **Name the step when you ask for a re-run; do not when you ask for a memo.** `what_if_plan` has to be
+  told which step, and asking without one is an error rather than a refusal you can relay. A memo re-runs
+  no step: pass the user's assumption as `instructions` and nothing else.
+- **Plan, read the honesty note aloud, then commit.** `what_if_plan` says in plain words how complete the
+  answer will be. Re-running an early step does **not** re-run the risk read or the report on top of it,
+  and a user who is not told that will read a partial output as a new verdict. Say it before you spend,
+  not after.
+- **It is not instant.** Both kinds queue on the server and run there. Tell the user it is running and
+  collect it with `what_if_result` rather than promising an immediate answer.
 - **You do not choose how it runs.** There is no model or tier for you to pick, and asking for one is
   refused. Express the change in `instructions`, in the user's own terms.
-- **The original is untouched, and say so.** A what-if never edits the delivered search or its report.
-  Present the result as *what this step would have said under that assumption*, never as a correction to
-  the report the user already holds.
+- **The original is untouched, and say so.** Neither kind edits the delivered search or its report.
+  Present the result as *what this would have said under that assumption*, never as a correction to the
+  report the user already holds.
+
+### What a memo is, and what it is not
+
+Say all three when you offer one, not when you deliver it. A user who learns the bounds afterwards has
+already read it as something it is not.
+
+- **It searches nothing.** No register is queried and no new evidence is gathered. It reasons over what
+  the search already found, and costs nothing beyond model time.
+- **It cannot confirm the assumption.** It says what would follow *if* the assumption held, and states
+  what the smallest piece of work would be that could settle whether it does. It is not a finding that
+  the Korean application was abandoned; it is what that would mean if it were.
+- **A stopped search takes neither kind.** A search its owner cancelled has evidence that was never
+  finished, and reasoning over a half-gathered record is how a memo comes to say more than the search
+  ever knew.
 
 ## Before you start a search
 

package/driver/systemd/prelim-driver.path

@@ -1,69 +0,0 @@
-[Unit]
-Description=Watch the prelim-search driver queue for new job files
-Documentation=https://github.com/CordilleraSarl/Clearotron/blob/main/driver/README.md
-
-[Path]
-# Watch EVERY prelim-capable agent's queue (inotify-backed). When a *.json job lands in any of them, start
-# the drain service — which runs the job as the agent whose workspace it sits in. One PathExistsGlob per
-# watched queue ("Multiple directives may be combined … to watch multiple paths" — systemd.path(5)).
-# Event-driven, sub-second; nothing of ours runs except while a job is being processed. The
-# prelim-driver.timer fallback re-drains every ~90s so a queue NOT listed here (e.g. a brand-new agent, or
-# a mid-path glob systemd fails to arm) still gets picked up — the watcher is an optimisation over the timer,
-# never the sole drain path.
-#
-# These lines MUST mirror config.queueDirs (driver.config.mjs) — the runner drains those regardless, so any
-# queue the runner scans but the watcher misses only pays the ≤90s timer latency (the pre-fix bug: this unit
-# watched only the headless dir below, which does not exist in an agent-workspace deployment, so event-driven
-# pickup was dead and the queue drained on the timer alone — and wedged entirely whenever the timer was down).
-#
-# ── tracker issue 774 — THESE GLOBS ARE THIS DEPLOYMENT'S WORKSPACE ROOT, NOT THE CODE DEFAULT ────────────────────
-#
-# A .path unit CANNOT read an environment variable. There is no `%E`, no EnvironmentFile, no expansion:
-# the prefix below is a literal, and it is the one thing in the queue lane that CLEAROTRON_WORK_DIR
-# cannot reach. So this file and `CLEAROTRON_WORK_DIR` in %h/.env are two spellings of one fact, and
-# nothing at runtime notices when they stop agreeing.
-#
-# WHAT DISAGREEMENT LOOKS LIKE: the runner drains $CLEAROTRON_WORK_DIR; this watcher arms an inotify on
-# a path nothing writes to. Jobs land, the watcher never fires, no unit fails, no log line appears, and
-# the only thing still draining is the 90s prelim-driver.timer — so the lane looks alive and every job is
-# late. If the timer is also down, the queue simply stops.
-#
-# tracker issue 774 moved the CODE default for CLEAROTRON_WORK_DIR from `$HOME/.openclaw` to
-# `$HOME/trademark/workspace`. These globs did NOT move with it, and that is correct: they must track the
-# deployment, and the deployment pins `CLEAROTRON_WORK_DIR=<home>/.openclaw` in its EnvironmentFile
-# (the production env example) precisely so its run directories do not move under a live queue. Change one of
-# these three lines only together with that variable, on the same box, in the same change.
-# driver/test/data-plane-defaults.test.mjs asserts this file and the production env example still agree.
-#
-# AGENT-WORKSPACE deployment (this VM): one line per prelim-capable agent. We watch each CONCRETE queue dir
-# (only the final *.json is a wildcard) so systemd arms an inotify watch directly on the queue directory —
-# a mid-path `workspace-*` glob is not reliably armed. Add a line when a new prelim agent is onboarded; until
-# then the 90s timer + dynamic config.queueDirs still pick its jobs up.
-# ── RESOLVED AT INSTALL (tracker issue 1876 option B) ────────────────────────────────────────
-# `@CLEAROTRON_WORK_DIR@` is substituted by render-units.mjs when it writes the resolved copy into
-# ~/.config/systemd/user/. That closes the half of the disagreement above that VARIES BY MACHINE: the
-# workspace root is now taken from the same value the runner drains, so the two spellings cannot drift
-# apart on an install.
-#
-# THE AGENT SEGMENT IS NOT SUBSTITUTED, AND THAT IS A LIMIT WORTH STATING RATHER THAN HIDING.
-# `driver.config.mjs` builds the queue as join(workspaceRoot, workspaceDirName(agent), "studio",
-# "prelim-search", "queue") — so the root is configuration and `workspace-clawdi` is a per-deployment
-# choice, already documented by the commented alternative below. Substituting it would need a variable
-# nothing sets today, and inventing one to make this line look fully resolved would be the more
-# dangerous kind of fix: it would read as configured while resolving to whatever the default happened
-# to be. One real value substituted beats two that look substituted.
-PathExistsGlob=@CLEAROTRON_WORK_DIR@/workspace-clawdi/studio/prelim-search/queue/*.json
-# One line per ADDITIONAL prelim-capable agent this deployment onboards, e.g.
-#PathExistsGlob=%h/.openclaw/workspace-<agent>/studio/prelim-search/queue/*.json
-# Two lines here named individual people at this firm and shipped their identities to every clone
-# (tracker issue 1014). They are a deployment's own roster, not the product's. Omitting a line costs LATENCY and
-# not correctness: as the note above says, the 90s timer and the dynamic config.queueDirs still
-# collect that agent's jobs — the watch only makes them immediate.
-# HEADLESS deployment (docs/INTAKE.md): a standalone product with no agent workspaces instead watches the one
-# explicit queue named by CLEAROTRON_QUEUE_DIR (default ~/prelim-queue). Uncomment for that mode; harmless to
-# leave active in a mixed deployment (never matches when the dir is absent), mirroring the additive queueDirs.
-#PathExistsGlob=%h/prelim-queue/*.json
-Unit=prelim-driver.service
-
-[Install]
-WantedBy=default.target