clearotron 0.2.0 → 0.2.2

package/docs/architecture/05-config-governance.md

@@ -97,11 +97,11 @@ product doc.
 | **Client allowlist** (`{version, grants:[{email, customer}]}`) | T2 | git + PR on the `CLIENT_ACCESS_MAP` file | see §2 row 4 | LIVE, file-only; surfaced read-only at `admin.access` |
 | **Ops tokens** (scope ops/user, verbs, accounts, TTL) | T4 | `mint-token.mjs` CLI; jti denylist file | operator-held tokens | LIVE, CLI |
 
-## 4b. The install surface names (,)
+## 4b. The install surface names ()
 
 The variables a **customer or installer** ever types carry the product’s own prefix. They are listed
 by name in §5 below and in the upgrade table in INSTALL.md.
-`PRELIM` is the internal codename of the first product this engine shipped and means nothing to a reader
+`CLEAROTRON` is the internal codename of the first product this engine shipped and means nothing to a reader
 who has not read the code. Vendor credentials keep the vendor’s name (`SIGNA_API_KEY`,
 `PERPLEXITY_API_KEY`, `ANTHROPIC_API_KEY`) — that already says who you bought them from.
 
@@ -226,10 +226,13 @@ environment including production**; unset resolves to `null` and throws at first
 
 `CLEAROTRON_WORK_DIR` (~/trademark/workspace since; the two`.path` units
 hardcode the old glob — see 04), `CLEAROTRON_WORKSPACE_PREFIX` (workspace-), `CLEAROTRON_QUEUE_DIR`,
+`CLEAROTRON_CHECKOUT_DIR` (the installed package root every unit's `ExecStart` names; npm-owned and
+replaced wholesale on upgrade, which is why the settings file lives OUTSIDE it — and why a service not
+restarted after an upgrade keeps serving the deleted tree),
 `CLEAROTRON_INSTRUCTIONS_DIR` (config store), `CLEAROTRON_CUSTOMERS_DIR` (config store), `CLEAROTRON_RECIPES_DIR`,
 `CLEAROTRON_REPORTS_DIR` (**no default since — unset refuses**),`CLEAROTRON_RUN_LOCK_DIR`, `CLEAROTRON_OUTBOX_DIR`,
 `CLEAROTRON_STAFF_POOL_ROOT`, `CLEAROTRON_REGISTER_CALL_LOG` (~/trademark/telemetry/…, homedir-derived at
-call time, resolved by existence over the pre- telemetry directory too; the pre-
+call time, resolved by existence over the pre-change telemetry directory too; the pre-
 `CORSEARCH_*_LOG` names remain accepted for one release),
 `CLEAROTRON_REGISTER_RECORD_LOG` (**no longer a box path since ** — the driver injects
 `<runDir>/_driver/register-record-bodies.jsonl` per run; setting it by hand pins every run's record
@@ -255,6 +258,19 @@ drops BACKOFF from the prefix, which the elided spelling this row used to carry
 `CLEAROTRON_OUTBOX_NOPROGRESS_MAX`, `TRADEMARK_MSGID_DOMAIN` (enqueue.local).
 Code-set per stage (not operator-set): `CLEAROTRON_GATHER_AGENT` / `CLEAROTRON_GATHER_SESSION_KEY` / `CLEAROTRON_GATHER_SESSION_ID`.
 
+**Who the completion notice reaches** — `CLEAROTRON_REQUESTER_WHATSAPP` (empty; effect: deployment) is a
+JSON map of requester email or handle → number, and `CLEAROTRON_WHATSAPP_OPERATOR_COPY` (on unless `0`,
+`false` or `no`; effect: deployment) keeps or drops the operator's own copy of the same notice. The two are
+independent: an operator can stop receiving copies of other people's runs without changing who the
+requester notice reaches.
+
+`CLEAROTRON_AGENT_WHATSAPP` above is keyed by AGENT id, and every user of a deployment shares one agent —
+which is why the notice used to reach the operator and never the person who ordered the search. Unset is
+an EMPTY roster and never a demo one: a deployment that configures nothing routes no notice, and the
+delivery record names whose number is missing rather than quietly substituting the operator's.
+`CLEAROTRON_REQUESTER_WHATSAPP` holds contact data; treat it as a mirror-aware value under §6 wherever an
+integrator holds a copy.
+
 ### 5.8 Credentials — T4 (secrets; EnvironmentFile only; mirror-aware — see §6)
 
 `ANTHROPIC_API_KEY`, `CORSEARCH_SESSION_KEY` (fail-closed preflight),
@@ -303,7 +319,7 @@ systemd, writes no heartbeat, and must keep saying "waiting to start" rather tha
 repo** — `git grep process.env.CLIENT_ACCESS` here returns nothing, so they are governed here and
 never appear in the audit).
 
-**Which identity source the portal runs (,) — T4, and it is chosen by name, never inferred.**
+**Which identity source the portal runs () — T4, and it is chosen by name, never inferred.**
 `PORTAL_AUTH_MODE` selects the door: unset or `auth-proxy` (the default for a hosted deployment) means
 any login system in front that authenticates in the browser and forwards a verifiable JWT per request.
 **Any OIDC or JWT proxy is a choice per deployment** — for example Cloudflare Access, which is not a
@@ -318,7 +334,7 @@ values the staff MCP face already reads as `TRADEMARK_MCP_OIDC_ISSUER`, `TRADEMA
 never passed them, which is how one product shipped a provider-agnostic API face and a single-vendor
 web portal.
 
-**ALL FIVE DOORS READ THE FOUR NOW, and 's "the auth mechanism is out of scope" boundary is
+**ALL FIVE DOORS READ THE FOUR NOW, and the "the auth mechanism is out of scope" boundary is
 superseded** (owner, 2026-08-23: an installation brings its own identity provider and this product may
 not force one). The two write services and the client MCP origin gained the set they lacked; the table
 below names every one of the twelve. The client door's four fall back to the staff face's equivalents
@@ -441,6 +457,23 @@ it in CI and nowhere else — on a deployed box it silences the one check that n
 `portal-ui/` has **zero** env config (no `VITE_*`, no `import.meta.env`) — the SPA talks to its
 origin; all portal config lives server-side in portal-service.
 
+### 5.11 Release pipeline — CI only (never set on a deployment)
+
+These are read by the release workflow and by nothing a deployment runs. They are listed here because a
+name absent from this register is a name nobody can look up, not because an operator has any reason to set
+one — and setting either on a box does nothing at all.
+
+`CLEAROTRON_CUT_REF` (default `HEAD`) — which ref the cut decision reads the version from. The jobs that
+ask about `main` set it to `origin/main` explicitly, because their checkout is pinned to the run's own ref
+and `HEAD` there is that ref rather than the branch being decided about. A job that asks about the wrong
+subject gets a confident wrong answer.
+
+`CLEAROTRON_RELEASE_WAIT_MS` (default 25 minutes) — how long a requested cut waits for the version pull
+request to merge itself. A rehearsal sets `0`, so the wiring is exercised without holding a runner. Giving
+up is a quiet success by design and the scheduled run underneath catches what it misses, so a budget that
+is wrong shows up as a slow job rather than a red one — which is why it is written down rather than left
+to be inferred from a timeout.
+
 ## 6. Drift patterns — values that are mirrored by design
 
 Wherever one value must exist in more than one place, name every copy and rotate them in one

package/docs/architecture/06-operations-runbook.md

@@ -110,6 +110,18 @@ and the environment file holding the secrets.
 - **A scheduled gateway restart** (chat-channel session and plugin-loader hygiene) should *defer*
   off live work rather than skip: wait while a run is live, up to a bound, then restart anyway.
   `XDG_RUNTIME_DIR` must be set for `systemctl --user` to work from cron.
+- **Pin the agent id before upgrading an install made before 0.2.2.** The default agent id changed
+  from `clawdi` to `localagent`, and that id is a path segment: runs live under
+  `<workspaceRoot>/workspace-<agent>/studio/prelim-search/`. An install that never set one starts
+  reading an empty workspace, and empty reads as "no runs" rather than as an error. Set **both**
+  variables in the environment file — the gather servers read their own:
+
+  ```
+  CLEAROTRON_DEFAULT_AGENT=clawdi
+  CLEAROTRON_GATHER_AGENT=clawdi
+  ```
+
+  An install that already sets them is unaffected, and a fresh install needs neither.
 - **Integrator-platform upgrades** go through that platform's own guarded upgrade path — dry-run,
   exact-version confirm, stop → update → start. Never `npm i -g` / `pnpm add -g` directly.
 
@@ -242,7 +254,7 @@ the measurement that says so is.
 
 A box upgraded across the rename keeps whatever NAME its **call** ledger already had
 (`corsearch-calls.jsonl`), and across the move keeps whatever DIRECTORY it sits in (the
-pre- telemetry directory), because the resolver reads the file that is there. Read
+pre-change telemetry directory), because the resolver reads the file that is there. Read
 `providers/_shared/ledger-path.mjs` to see which of the four candidates a box resolves to.
 
 ## Access control and instance isolation

package/docs/architecture/09-security-and-data.md

@@ -203,7 +203,7 @@ stylesheets above.
 | **Doctrine** | `skills/`, framework decks, worked examples | The asset; transfers under the definitive agreement. Worked examples derive from real matters — treat as client-adjacent |
 | **Customer profiles** | `profiles/*.json`, context packs, `_audit.log` | Client-identifying by design (names, own brands, competitor lists) — the reason this *pack* names no clients |
 | **Reference library / calibration corpus** | outside the repo | Built on real client matters — **confidential client material, not freely transferable IP**; transfer needs a client-consent/sanitization plan |
-| **Telemetry** | `~/trademark/telemetry/*.jsonl` (a box upgraded across the move keeps the pre- telemetry directory — resolved by existence, oldest first),`_driver/*.jsonl` | Billing-grade provider usage + attempt telemetry; append-only; no automated retention |
+| **Telemetry** | `~/trademark/telemetry/*.jsonl` (a box upgraded across the move keeps the pre-change telemetry directory — resolved by existence, oldest first),`_driver/*.jsonl` | Billing-grade provider usage + attempt telemetry; append-only; no automated retention |
 
 **Posture commitments** (engineering-true, restated from the outward materials): no client data
 trains any model; each client's context is isolated in its profile bundle and frozen per run;

package/docs/decisions/0004-documentation-structure.md

@@ -69,7 +69,7 @@ at runtime.
   exceed the threshold, 15 were already named by an ancestor**, and three one-line additions closed the
   rest. The mechanism was not new — it was unchecked.
 
-  **This paragraph is what 's absence-record predicted it would become.** That record said "a new
+  **This paragraph is what the absence-record predicted it would become.** That record said "a new
   directory ships without a front door and nothing says so", named itself as a known gap rather than a
   mechanism, and ended "if the guard is built later, this paragraph is what it replaces". It has been.
 

package/driver/CHANGELOG.md

@@ -1,4 +1,98 @@
-# prelim-driver
+# clearotron-driver
+
+## 0.2.2
+
+### Patch Changes
+
+- df095a8: Fixed: The configuration audit now refuses when one of the files it reads is missing, instead of reporting that nothing sets the variables that file records. Its answer decides which settings look unused, so a file it could not read was being counted as a file with nothing in it.
+- f05657c: New: An assistant on a clearance account can now answer "what if this were different" about a report already delivered. It writes a short memo reasoning over the evidence already gathered, instead of asking for a new search.
+- d52cd98: Fixed: A scheduled deploy no longer updates the working copy while an experiment run is in progress. It now waits, as it already did for a clearance run.
+- f05657c: Fixed: A client account asking about a mark in a knockout screen now receives the risk band, the reason for it and the findings behind it. It previously returned an empty answer.
+- 38ce32f: New: A Knockout search now looks up what the owner of a registered right actually sells, and the report says where that answer came from. Before, the assessment inferred the owner's trade from the company name alone, then told you to go and obtain the registration's own goods list. The name is not evidence of the trade. It happened to read correctly on one search and would have read confidently wrong on the next.
+  
+  Fixed: Where the lookup finds nothing, the report says so plainly and still delivers. An unanswered search is never written up as a clean negative, and a provider outage never withholds a report.
+  
+  For operators: this adds one web search per promoted registered filing, deduplicated by owner and capped at three per searched name. A search with no registered right against it costs nothing extra.
+- 57eaf24: Fixed: A knockout report no longer shows a register filing's risk band beside a line saying that filing carries no rating. The band shows when the reviewer gave one, and the line appears only when they did not.
+- b1f188f: Fixed: The unit inventory again records why every shipped unit that runs on no box is still shipped. One entry lost its reason when its name was superseded.
+- 3de0828: New: One engine process can now serve both people arriving through a tunnel and programs on the same machine holding an access key. It listens for the key on a local socket, which no tunnel can forward to, and the network door never accepts a key at all. Deployments that needed both used to run the process twice, on two ports, with two units to keep in step.
+  
+  Fixed: The startup lines now say whether a local key path exists, and what its permissions are. An operator can see it without opening a unit file. A deployment with no key path is told that too, rather than left to infer it from silence.
+  
+  For operators: set TRADEMARK_MCP_KEY_SOCKET to the socket path the local key door should listen on. It is created with owner and group access only. Leaving it unset changes nothing about an existing deployment. The door refuses to open without a grants file, or alongside the authentication bypass.
+- 235cf07: Fixed: Stopping the demo now stops everything it started, including when the stop signal reaches only the command you can see rather than the whole terminal.
+- be648b6: Fixed: The architecture diagrams in the public documentation render with their intended colours again, and thirteen code comments state the colour they meant.
+- 97b7c96: Fixed: The deployment check now reports the services a box is actually running. It had been asking systemd about unit names left behind by a rename, so a healthy box reported nothing running.
+- f05657c: Fixed: The "your screen is done" notice for a knockout search now goes to the person who ordered it, with the operator kept as a copy. It previously went to the operator alone, whoever had asked for the search.
+- c4b6b58: Fixed: The link in your completion email and message now opens the report. It previously pointed at a path the site does not serve, so it led to a sign-in and then a dead page. This affected every delivered report on both search products, in the email, the chat notice and the assistant's own answer. The workbook link in the same email was always correct and is unchanged.
+  
+  Fixed: The chat notice now goes to the person who ordered the search, with the operator keeping a copy they can switch off. Before, it went only to whoever runs the service, so the requester was never told their search had finished.
+  
+  For operators: hold requesters' numbers in CLEAROTRON_REQUESTER_WHATSAPP, keyed by email address or by the handle a request arrives under. Where no number is held, the delivery record says so by name instead of quietly sending the notice to you. Set CLEAROTRON_WHATSAPP_OPERATOR_COPY=0 to stop receiving copies of other people's runs.
+- bb1a409: New: A Knockout report now carries the whole assessment behind its ratings. You get the reviewer's notes and the reviewer's own opening read of each name. You also get the reasoning that holds a name at its rating, and what would move it. This was written during every search and reached only the audit workbook, so the report showed a rating without the thinking under it. The notes are marked as reference material rather than mixed into the findings.
+  
+  New: A registered filing the search formed a view on now shows that rating and the read behind it. Before, the one registered right on a page was the only entry carrying no rating, beside softer uses that all carried one. That inverted what matters legally. A filing the search did not weigh still says so plainly.
+- df6277c: Fixed: A live registration covering the goods you asked about is no longer left out of a report for want of room. It is reported, or the report says why it is distant.
+- 9ba8cd0: Fixed: A what-if memo is now refused if it writes anywhere in the delivered run except its own memo folder, and the refusal names the file.
+- 8c8e200: Fixed: A what-if question left queued when its run is archived now comes back with a reason, instead of never being answered.
+- bb1a409: Fixed: The delivery record now states plainly when a report's write-up length and ranking rules could not be checked against the delivered text. It says the rules were applied to nothing on that run. Before, this was recorded as an unlabelled failed check. It looked like any other, so a run could deliver with those rules unverified and nobody would see it.
+- 9ba8cd0: For operators: Each run record now says whether the model id it observed was a pinned snapshot or an alias the provider can repoint.
+- aea4a4e: Fixed: The deployment check now says which checkout a service is running from even when its unit file does not declare one.
+- bb1a409: New: The tools that show how a search reached its answer now work on a Knockout search. You can ask what it found, what it looked at, where it searched and came back empty, and read the delivered report itself. Until now they returned nothing at all for a Knockout search, so anyone asking how one of these results was reached saw a blank record.
+  
+  New: The proof-of-search record answers on these searches. It lists what was searched and found nothing, which is what answers a challenge to a result. Where a tool has nothing to show for this kind of search, it now says so in words. An empty list reads as "we looked and found nothing".
+- 14d6d28: Fixed: The demo and the install steps now start on native Windows, where they previously crashed on the first internal module they loaded.
+
+## 0.3.0-beta.0
+
+### Minor Changes
+
+- bb1a409: New: A Knockout report now carries the whole assessment behind its ratings. You get the reviewer's notes and the reviewer's own opening read of each name. You also get the reasoning that holds a name at its rating, and what would move it. This was written during every search and reached only the audit workbook, so the report showed a rating without the thinking under it. The notes are marked as reference material rather than mixed into the findings.
+  
+  New: A registered filing the search formed a view on now shows that rating and the read behind it. Before, the one registered right on a page was the only entry carrying no rating, beside softer uses that all carried one. That inverted what matters legally. A filing the search did not weigh still says so plainly.
+- bb1a409: New: The tools that show how a search reached its answer now work on a Knockout search. You can ask what it found, what it looked at, where it searched and came back empty, and read the delivered report itself. Until now they returned nothing at all for a Knockout search, so anyone asking how one of these results was reached saw a blank record.
+  
+  New: The proof-of-search record answers on these searches. It lists what was searched and found nothing, which is what answers a challenge to a result. Where a tool has nothing to show for this kind of search, it now says so in words. An empty list reads as "we looked and found nothing".
+
+### Patch Changes
+
+- df6277c: Fixed: A live registration covering the goods you asked about is no longer left out of a report for want of room. It is reported, or the report says why it is distant.
+- 9ba8cd0: Fixed: A what-if memo is now refused if it writes anywhere in the delivered run except its own memo folder, and the refusal names the file.
+- 8c8e200: Fixed: A what-if question left queued when its run is archived now comes back with a reason, instead of never being answered.
+- bb1a409: Fixed: The delivery record now states plainly when a report's write-up length and ranking rules could not be checked against the delivered text. It says the rules were applied to nothing on that run. Before, this was recorded as an unlabelled failed check. It looked like any other, so a run could deliver with those rules unverified and nobody would see it.
+- 9ba8cd0: For operators: Each run record now says whether the model id it observed was a pinned snapshot or an alias the provider can repoint.
+- aea4a4e: Fixed: The deployment check now says which checkout a service is running from even when its unit file does not declare one.
+- 14d6d28: Fixed: The demo and the install steps now start on native Windows, where they previously crashed on the first internal module they loaded.
+
+## 0.2.1
+
+### Patch Changes
+
+- 3cc154a: Fixed: A report now keeps a mark the search confirmed, instead of dropping it because it was already noted on an internal working sheet. Where a mark is still missing, the run records it by name rather than closing the question.
+- 3cc154a: Fixed: Asking a what-if question about a delivered report now returns a memo, instead of failing to find the run it was asked about.
+- 0f7b44a: New: `clearotron demo` now publishes all four example reports — one per product — instead of only the first.
+- 2138a3c: For operators: The `beta` channel now gets a release when there is something worth testing, days apart, instead of one on every merge.
+- 8b5ab91: Fixed: `doctor` no longer reports a working Cloudflare Access door as unprotected. An API-style door and a failing origin are now told apart, each with its own message. Neither is reported as a pass.
+- 77cf56d: For operators: The configuration reference now explains the two deprecated search-log variables in full, instead of stopping mid-sentence.
+- 0dcd05a: Fixed: the settings catalogue now lists `CLEAROTRON_CHECKOUT_DIR`, the path every service file points at. The installer still fills it in for you. It is written down so that anyone whose service will not start can look it up.
+
+## 0.2.1-beta.2
+
+### Patch Changes
+
+- 8b5ab91: Fixed: `doctor` no longer reports a working Cloudflare Access door as unprotected. An API-style door and a failing origin are now told apart, each with its own message. Neither is reported as a pass.
+
+## 0.2.1-beta.1
+
+### Patch Changes
+
+- 0dcd05a: Fixed: the settings catalogue now lists `CLEAROTRON_CHECKOUT_DIR`, the path every service file points at. The installer still fills it in for you. It is written down so that anyone whose service will not start can look it up.
+
+## 0.2.1-beta.0
+
+### Patch Changes
+
+- 77cf56d: For operators: The configuration reference now explains the two deprecated search-log variables in full, instead of stopping mid-sentence.
 
 ## 0.2.0
 

package/driver/README.md

@@ -1,4 +1,4 @@
-# prelim-driver — deterministic driver for the prelim-search trademark workflow
+# clearotron-driver — deterministic driver for the prelim-search trademark workflow
 
 Orchestration in **code**; the LLM does only judgment leaves. Each pipeline stage is **one blocking
 engine turn** (default engine: `anthropic-agent`, shelling `claude -p` per stage); fan-out/fan-in/
@@ -26,7 +26,7 @@ integrator ──job JSON (enqueue CLI / start_run / queue file)──┐
 
 ## Per-agent execution (multi-queue)
 
-A prelim job runs **as the identity that forwarded it** — derived from the queue LOCATION it was
+A clearotron job runs **as the identity that forwarded it** — derived from the queue LOCATION it was
 claimed from (`<workspacePrefix><agentId>/…/queue`, see `driver.config.mjs`), so there is no
 forwarder→agent map to maintain. The run-dir sits in that identity's workspace and the delivery
 packet names that identity as the reply route. **Publishing stays centralized** — `publish/` writes

package/driver/ask-ledger.mjs

@@ -82,7 +82,7 @@ export function planJoinFrom(planExecution) {
   // KEY predates the instrument — "not recorded" — while one carrying the keys as null is a count the
   // provider could not take. Reading the VALUES alone collapses those two into one sentence, which is
   // the exact confusion exists to remove; `records: null` is indistinguishable from absent.
-  // The first cut of this did read the values, and it reported every pre- receipt as a failed
+  // The first cut of this did read the values, and it reported every pre-change receipt as a failed
   // count. Bare qid strings are tolerated too — no driver ever wrote them, so that arm proved nothing.
   const executed = new Map();
   for (const x of planExecution?.executed ?? []) {
@@ -104,7 +104,7 @@ export function planJoinFrom(planExecution) {
  * What a slice returned, in the reader's words — THREE-VALUED, and never a zero standing in for an
  * absence (register-plan.mjs's join records why). `null` records with a finite count means the provider
  * counted but the block carried no record list; both null means the receipt says nothing about the
- * return, which is what every pre- run looks like. PURE.
+ * return, which is what every pre-change run looks like. PURE.
  */
 export function returnedPhrase(info) {
   if (!info) return "what it returned was not recorded";
@@ -127,7 +127,7 @@ export function returnedPhrase(info) {
  *
  * THE LEGITIMATE CLOSE IS PRESERVED, and it is the whole reason this keys on the RETURN rather than on
  * execution: a probe that ran and found NOTHING has nothing to hand anyone, and closes exactly as it
- * does today. 's own build named that trap before this rule existed.
+ * does today. its own build named that trap before this rule existed.
  *
  * THREE STATES, and only one of them discharges:
  *
@@ -574,6 +574,64 @@ export function parseAskClosureLines(text) {
   return out;
 }
 
+/**
+ * The marks the CLIENT was actually shown — `findings[].mark` from findings.json, normalized.
+ *
+ * Returns null when the file is absent or unparseable, and null is NOT an empty set: an absence is a
+ * could-not-look, and the caller below fails toward leaving the ask OPEN rather than closing it on a
+ * file it could not read.
+ *
+ * ✕ NEVER a substring search of the serialized document. `"DELFIN" in JSON.stringify(findings)` is true
+ * when the findings name DELFIN TECHNOLOGIES OY and nothing else — a membership test that matches every
+ * longer name inflates whatever it is counting and reads as a clean result. The field, or nothing.
+ * PURE.
+ */
+export function deliveredMarks(findingsJsonText) {
+  let doc;
+  try { doc = JSON.parse(String(findingsJsonText ?? "")); } catch { return null; }
+  const rows = Array.isArray(doc?.findings) ? doc.findings : null;
+  if (!rows) return null;
+  return new Set(rows.map((f) => normMark(f?.mark)).filter(Boolean));
+}
+
+const normMark = (s) => String(s ?? "").toLowerCase().replace(/[^a-z0-9]/g, "");
+
+/**
+ * Owner ruling 2026-09-07 (tracker issue 246), Option A, worded ABOUT THE MARK: a recall ask may close
+ * as immaterial only when the mark it went looking for is in the client's findings. Otherwise the mark
+ * is owed a finding and the ask stays open.
+ *
+ * The defect this answers: a recall probe found OSLER DELPHI, the closure stage pointed at
+ * `register-findings.md` — the run's own working sheet, where the mark genuinely IS reasoned — and the
+ * ask closed. The sheet is a citable file and the citation was true. It is simply not the document the
+ * client reads, and nothing checked that.
+ *
+ * ✕ SCOPED TO `ask:recall:` ASKS CARRYING A `mark_text`, deliberately, and this is the whole difference
+ * between the two readings of the ruling. `ask:recall-overflow:` rows carry a `term` — an owner name, a
+ * law firm, a probe never dispatched (Lewis Silkin LLP, NORDWEST Handel AG). Measured across three runs
+ * they are 28-29 per run and constant whether the run was healthy or not; reopening them would put
+ * names no lawyer asked for into the findings. A `mark_text` is the test because a mark is what a
+ * finding is about.
+ *
+ * Returns the owed row, or null when the ask is out of scope or the mark was delivered. PURE.
+ */
+export function recallMarkOwed(ask, delivered) {
+  if (!String(ask?.ask_id ?? "").startsWith("ask:recall:")) return null;
+  const st = ask?.ask?.structured ?? {};
+  const mark = String(st.mark_text ?? "").trim();
+  if (!mark) return null;                                       // an owner/term probe is not a mark ask
+  if (delivered instanceof Set && delivered.has(normMark(mark))) return null;
+  return {
+    ask_id: ask.ask_id,
+    mark,
+    owner: String(st.owner ?? "").trim() || null,
+    uri: String(st.uri ?? "").trim() || null,
+    // null delivered = findings.json unreadable. Recorded so a reader can tell "the client was not shown
+    // this mark" from "nobody could tell what the client was shown" — they need different repairs.
+    basis: delivered instanceof Set ? "absent-from-findings" : "findings-unreadable",
+  };
+}
+
 /**
  * The anti-confabulation guard, ask side (doubt-ledger applyClosure reused shape-for-shape): an
  * IMMATERIAL line ends its ask IFF the ask is still open AND the quote appears VERBATIM
@@ -586,7 +644,9 @@ export function applyAskClosure(asks, closureLines, fileTexts = {}, { ts = null
   const byId = new Map();
   for (const l of closureLines ?? []) if (l?.id && !byId.has(l.id)) byId.set(l.id, l);
   const unverified = [];
+  const carryIntoFindings = [];
   let immaterialByStage = 0;
+  const delivered = deliveredMarks(fileTexts?.["findings.json"]);
   const out = (asks ?? []).map((a) => {
     if (a?.ending) return a;                                    // the stage may never touch an ended ask
     const l = byId.get(a.ask_id);
@@ -595,13 +655,21 @@ export function applyAskClosure(asks, closureLines, fileTexts = {}, { ts = null
     const hay = squash(fileTexts?.[l.file]);
     const q = squash(l.quote);
     if (q && hay && hay.includes(q)) {
+      // THE CITATION IS VERIFIED AND THAT IS NO LONGER ENOUGH FOR A RECALL ASK ABOUT A MARK.
+      const owed = recallMarkOwed(a, delivered);
+      if (owed) {
+        carryIntoFindings.push(owed);
+        return { ...a, handoff: clip(`the recall probe found ${owed.mark} and the delivered findings do not name it — `
+          + `the closure cited ${l.file}, which is the run's own working sheet, not what the client was shown. `
+          + `This mark is owed a finding.`, 300) };
+      }
       immaterialByStage++;
       return { ...a, ending: mkEnding("judged-immaterial", "doubt-closure-stage", { evidence: `${l.file}: "${clip(l.quote)}"`, reasons: [l.reason], ts }) };
     }
     unverified.push({ ask_id: a.ask_id, file: l.file, quote: l.quote });
     return a;
   });
-  return { asks: out, immaterialByStage, unverified };
+  return { asks: out, immaterialByStage, unverified, carryIntoFindings };
 }
 
 /** Stamp the default handoff on every still-open ask (after closure) — an OPEN ask always names

package/driver/authority-trees.mjs

@@ -24,7 +24,7 @@
 //
 // `_driver/` is the sharpest inclusion. It holds the frozen plan, the grid specs, the plan-execution
 // receipt, the form sidecars and `run.jsonl` — and it sits inside `runDir`, which is granted READ+WRITE
-// by design. Every diagnosis run on 2026-08-14 (,) read those files as ground
+// by design. Every diagnosis run on 2026-08-14 () read those files as ground
 // truth. A seat writing them would be forging the record the engine is judged by.
 //
 // `profilesDir` is DEFENSIVE, not a live hole: it appears in no `--add-dir`, so the file tools cannot

package/driver/call-capture.mjs

@@ -2,7 +2,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // call-capture.mjs — the forensic record of what a seat SENT, one file per call, refusals included.
 //
-// 's sibling. Every recording transport captures the payload
+// That sibling. Every recording transport captures the payload
 // BEFORE its decision, so the evidence survives a refusal. Each of them wrote that capture to a path
 // derived from something that does not change between calls — a literal `call-001.json`, an axis name, a
 // finding's ordinal — so a second call to the same subject DESTROYED the first's evidence. Measured on

package/driver/card-frame.mjs

@@ -18,7 +18,7 @@
 // had something of its own to anchor on.
 //
 // That is the day's defect shape in one stage — a decision taken on a surface token while the record
-// underneath already said it — and it is what 's S2 ruling settled: "the mechanical card fields
+// underneath already said it — and it is what the S2 ruling settled: "the mechanical card fields
 // (headings, ids, links, driver-stamped values) move to code NOW — uncontested."
 //
 // ── WHY THE HEAD RULE IS THE WHOLE REVIEW QUESTION ──────────────────────────────────────────────────

package/driver/case-law-ledger.mjs

@@ -5,7 +5,7 @@
 // THE DEFECT. `case-law-findings.md` is the only artifact case law produces, and its entire contract is
 // `nonEmpty(c, 80)` — a non-empty check on prose. There is no citations ledger, no structured mirror, no
 // per-proceeding record anywhere. So the per-record trace that exists for the register path and
-// for common law (,) cannot be extended to case law at all: there is nothing on the other side
+// for common law () cannot be extended to case law at all: there is nothing on the other side
 // of the join. That was found while scoping the record trace, and it is why closed into this issue.
 //
 // WHAT THAT COSTS. Two of the owner's three sign-off conditions for sending a case-law report to a

package/driver/claim-liveness.mjs

@@ -45,7 +45,7 @@ export function procStarttime(pid, readStat = undefined,
   { platform = process.platform, readPsStart = defaultReadPsStart } = {}) {
   // AN INJECTED READER IS THE CALLER'S STATEMENT ABOUT HOW TO READ, and it outranks the platform.
   //
-  // Measured on macOS (, the verification run): the arm that pins the field-22
+  // Measured on macOS (the verification run): the arm that pins the field-22
   // parse hands this function its own `readStat` and asserts the parse. With the platform deciding
   // first, that injection was silently ignored off Linux and the arm read `null` — the seam was there
   // and nothing went through it. A caller that supplies a reader is not asking which box this is.

package/driver/common-law-receipts.mjs

@@ -614,7 +614,7 @@ export function splitGridSpec(spec, { outputPaths = {}, dispositionsPaths = {} }
       // — `dispositions_path` is DICTATED here, never inferred downstream. The grid tool renders it
       // into the obligations block it hands the seat, and the validator reads the same file; deriving the
       // name in two places is the drift this codebase has paid for twice. Absent ⇒ the tool names
-      // no file and the seat is judged on prose alone, which is exactly the pre- behaviour.
+      // no file and the seat is judged on prose alone, which is exactly the pre-change behaviour.
       // — the half's OWN form path, ALWAYS set explicitly. The spread above carries the canonical
       // spec's connotation object verbatim, and since the canonical spec started carrying its own
       // dispositions_path a conditional override would let a half INHERIT the canonical path whenever the

package/driver/commonlaw-carry.mjs

@@ -491,7 +491,7 @@ export function commonLawCarryEvent({ trigger = null, artifact = null, reason =
 
 // ── THE RECONCILIATION, AS TWO RATES WITH THEIR ARITHMETIC ATTACHED ───────────────────────
 //
-// 's measurement: of 2116 retrieved common-law candidates, 1609 carried no ground at all, and 253
+// That measurement: of 2116 retrieved common-law candidates, 1609 carried no ground at all, and 253
 // of 292 candidate-bearing cells lacked the negative row the dictation owes each of them. The
 // discriminator was never in doubt — 272 rows carry `step-stated` against 1609 `absent`, so the
 // instrument distinguishes. Nothing compared it to anything.

package/driver/config-inventory.mjs

@@ -388,7 +388,7 @@ export function caseLawInventory(env = process.env) {
   // EUR-Lex reads through the engine's own fetch tool, so there is nothing to configure and nothing that
   // can be missing. It is LISTED anyway: a reader counting case-law sources against a report that named
   // four gaps must be able to find all four here, and a lane that is absent from this page is
-  // indistinguishable from one nobody has heard of. 's fifth criterion.
+  // indistinguishable from one nobody has heard of. That fifth criterion.
   rows.push({
     key: "caselaw", label: "Case law and oppositions", provider: "eur-lex",
     providerLabel: CASELAW_LABELS["eur-lex"],

package/driver/connotation-search.mjs

@@ -18,7 +18,7 @@
 //      citing the receipt. A PR/reputational section that ASSERTS a clean result must additionally cite a
 //      Connotation-search source line. A searched-clean (recorded queries, empty results) passes.
 //
-// ARMING (, owner's ruling 2026-08-04 — "arm on data, never on prose"): the disposition join, the
+// ARMING (owner's ruling 2026-08-04 — "arm on data, never on prose"): the disposition join, the
 // recurrence floor and the did-the-search-run check all arm on `opts.recorded` being passed, which the
 // caller keys on the grid-spec's `connotation.disposition_required` stamp — a structural fact the DRIVER
 // writes and no model can redraft away. They used to arm on a phrase match over the model's own prose
@@ -138,7 +138,7 @@ export const MEANING_ANGLES_RE = /^[ \t]*(?:[-*]\s+)?meaning angles\s*[:—-]\s*
 // gap row. Verified on E2E's preserved R1 run of 2026-08-13 (test build 4353a74): 61 dictated, 61 receipts, 0 gaps, one
 // dictated query unrecorded and one recorded query never dictated — the same angle, minus the quote. The
 // merge threw `deterministic`, the ladder correctly refused to retry, and the run died at common-law after
-// 26m15s with nothing delivered and the whole gather already paid for. 's class, inverted: the driver
+// 26m15s with nothing delivered and the whole gather already paid for. That class, inverted: the driver
 // corrupted a well-formed model output.
 //
 // THE RULE: peel an outer pair only when both ends carry the SAME quote character AND the interior carries
@@ -469,7 +469,7 @@ export function livePassages(snippet) {
 export function usableSnippet(s) { return quoteWeight(s) >= QUOTE_MIN; }
 
 // ── — WHY A QUOTE DID NOT BIND, NOT MERELY THAT IT DID NOT ──────────────────────────────────────
-// `quoteJoins` is a predicate and stays one: its answer is the gate's, and 's comment thread withdrew
+// `quoteJoins` is a predicate and stays one: its answer is the gate's, and the comment thread withdrew
 // loosening it. What was missing is the REASON, and the reason is the whole.
 //
 // R6 (Full country search into China) died after four dispatches, byte-identical, on
@@ -1326,7 +1326,7 @@ export function renderConnotationObligations(ob, { ledgerPath = "your half ledge
       // The ordinal is 1-based and per-row, matching `receipt_index` on the form exactly — the seat is
       // never asked to hold two different numbering schemes at once.
       //
-      // THE REAL IDS STAY. 's acceptance is that the gate cannot fail a seat for an obligation the
+      // THE REAL IDS STAY. That acceptance is that the gate cannot fail a seat for an obligation the
       // tool result never named, and these are what a failure names. What was removed is the METAVARIABLE
       // and the instruction to cite one — a model shown `R-XXXXXXXX` writes `R-RECEIPT`, whereas a model
       // shown a list of real ids it is told not to type has nothing to pattern-match.
@@ -1493,7 +1493,7 @@ export function meaningSweepReceiptsInstruction({
     //
     // Keyed on the OBLIGATIONS now, which is the thing the sentence is actually about. Same family as
     // the rest of this bundle: a decision taken on a surface token while the thing itself says the
-    // opposite ('s axis outcome, 's status code, 's trailing default, 's deleted arm).
+    // opposite (the axis outcome, the status code, the trailing default, the deleted arm).
     ...(mayOwnNoQueries ? ["Your half may own zero meaning queries. If so the grid tool lists you no"
       + " obligations, and recording nothing is the complete and correct outcome for you — do not invent"
       + " rulings and do not create any dispositions file."] : []),
@@ -1525,7 +1525,7 @@ export function renderDispositionTable(rows, ob) {
   // The park broke that premise. A parked row is undecided AND the stage completes, so the document IS
   // delivered — and `ruling` is null on it, so this filter silently dropped it. The reader received a
   // table that looks complete, with the one obligation nobody could decide simply absent. No gap, no
-  // marker, nothing to notice. That is 's lying receipt reached by the shortest path there is.
+  // marker, nothing to notice. That is the lying receipt reached by the shortest path there is.
   //
   // Rendered as its OWN block rather than as rows of the ruling table, deliberately: an undecided row
   // sitting in a column headed "Ruling" is read as a ruling, whatever the cell says.
@@ -1595,7 +1595,7 @@ const NO_POLICED_SECTION = "(no PR / reputational / connotation section)";
 // that did not RUN is a different failure from a sweep that was not ruled on, and keeping them apart is
 // what makes the warm lane safe (gateway.mjs WARM_ELIGIBLE_RE).
 //
-// 's lesson survives the collapse and is the reason `form_damaged` is not folded into `no_ruling`:
+// That lesson survives the collapse and is the reason `form_damaged` is not folded into `no_ruling`:
 // the gate must never destroy a completed clearance by conflating "did not do the work" with "wrote the
 // answer in a shape that did not bind". Under the form the second class is a two-field correction the
 // seat can finish, and the union means the rest of its work cannot be lost while it makes it.
@@ -1622,7 +1622,7 @@ const NO_POLICED_SECTION = "(no PR / reputational / connotation section)";
 //
 // It is its own reason and not a `detail` on `no_ruling` because the two have different remedies and the
 // hint is routed on the token: "add a ruling" sent to a seat that has ruled is a closed loop.
-// CARRIES THE SAME ARGUMENT ONE CLAUSE FURTHER, ON THE EVIDENCE THAT 's FIX DID NOT REACH.
+// CARRIES THE SAME ARGUMENT ONE CLAUSE FURTHER, ON THE EVIDENCE THAT the FIX DID NOT REACH.
 // R6 died three times on `no_ruling=75` over a 75-row form. The seat held a 144-line findings document it
 // had just written, was told "75 rows carry no ruling", saw 75 rulings in the document in front of it, and
 // changed nothing. It had written THE WRONG ARTIFACT: the disposition form was the deliverable and the
@@ -1631,7 +1631,7 @@ const NO_POLICED_SECTION = "(no PR / reputational / connotation section)";
 // findable. `no_ruling` fires identically whether a row carries no ruling token, a ruling with no
 // receipt, or NOTHING AT ALL because the form was never opened, and those have different remedies.
 //
-// THE SPLIT IS STRICTLY NARROWER, exactly as 's was. Every state below failed before and fails now;
+// THE SPLIT IS STRICTLY NARROWER, exactly as the was. Every state below failed before and fails now;
 // `no_ruling` survives as the residual so nothing can fall out of the vocabulary. The whole-population
 // collapse states of the retired hand-edited form (`form_untouched`, `form_unparseable`) died with the
 // form path — their subject matter is carried by the call audit's own states below, read from the run's
@@ -1852,7 +1852,7 @@ export function obligationRows(ob, { spotChecks = QUOTE_SPOT_CHECKS } = {}) {
   // `segmentBinding` through the same `snippetSegments`. One derivation, both ends — the display and the
   // check cannot disagree, which they would the moment either recomputed its own split.
   //
-  // 's defect is the one this avoids, arriving from the other direction: a seat ordered to set a
+  // That defect is the one this avoids, arriving from the other direction: a seat ordered to set a
   // field it was never shown the values for. `receipt_index` is safe precisely because the candidate list
   // is in front of the seat; a segment ordinal is only safe on the same terms.
   //
@@ -1917,7 +1917,7 @@ export function obligationRows(ob, { spotChecks = QUOTE_SPOT_CHECKS } = {}) {
 /**
  * Find meaning-sweep obligations the seat has not ruled on, and a dictated sweep that never ran.
  *
- * ARMED ON DATA, NEVER ON PROSE (, owner's ruling 2026-08-04). `opts.recorded` being passed is the
+ * ARMED ON DATA, NEVER ON PROSE (owner's ruling 2026-08-04). `opts.recorded` being passed is the
  * whole arming condition and it is UNCHANGED by — the caller keys it on the grid-spec's own
  * `connotation.disposition_required` stamp, a structural fact the DRIVER writes and no model can redraft
  * away. Two consequences, both deliberate and both load-bearing:
@@ -2066,7 +2066,7 @@ export function findConnotationViolations(commonLawContent, prRiskCount = 0, { r
     //
     // The order is load-bearing: this is reached ONLY when the row is otherwise ruled, so a genuinely
     // unruled row can never be reported as a quote problem. `quote_unbound` cannot mask missing work —
-    // it is strictly narrower than the state it splits off from, which is what 's warning demands.
+    // it is strictly narrower than the state it splits off from, which is what the warning demands.
     const otherwiseRuled = s
       && RULING_SET.has(String(s.ruling ?? "").trim().toLowerCase())
       && String(s.note ?? "").trim()

package/driver/contract-audit.mjs

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
-// contract-audit.mjs — the machinery behind 's E1, E2 and E3 checks.
+// contract-audit.mjs — the machinery behind the E1, E2 and E3 checks.
 //
 // PURE and OFFLINE, like coverage-ledger.mjs and findings-model.mjs: it reads source text and the
 // declarations, and it computes. Nothing here runs on a clearance — no pipeline path imports it and no
@@ -92,7 +92,7 @@ export function arm1Unaccounted(stages) {
 /**
  * ARM 2 — a declared element no validator token speaks about. A RATCHET, not a red build.
  *
- * The owner's ruling (, 2026-08-13) is four conditions, and they are the ruling rather than
+ * The owner's ruling (2026-08-13) is four conditions, and they are the ruling rather than
  * suggestions: the baseline is PER STAGE and carries the ELEMENT NAMES (it is the audit object, not a
  * bare count); CI fails on any per-stage INCREASE so a new hole cannot hide behind a fix elsewhere; arm 1
  * is exempt from the ratchet; and wave 1's moves are expected to move the number.
@@ -157,10 +157,10 @@ const ARROW_TOKEN_RE = /=>\s*[`"']([a-z][a-z0-9]*(?:_[a-z0-9]+)+)/g;
 // nothing re-deriving them — `acceptMatterFrame` mints eight tokens against a row documenting three.
 const REASON_TOKEN_RE = /reason:\s*[`"']([a-z][a-z0-9]*(?:_[a-z0-9]+)+)/g;
 
-// tracker issue 1211 — A CITED SITE MUST BE A MINT. The extractor records the FIRST line a pattern matched, and the
+// A CITED SITE MUST BE A MINT. The extractor records the FIRST line a pattern matched, and the
 // patterns read comment text as readily as code: `no_status` was cited at coverage-form.mjs:802, the
 // JSDoc `@returns {Array<{reason:"no_status"|"form_damaged", …` annotation seventeen lines above the line
-// that writes it. Every tracker issue 1211 ruling cites its mint, so a citation drawn from a sentence about the code
+// that writes it. Every such ruling cites its mint, so a citation drawn from a sentence about the code
 // is a ruling about a sentence.
 //
 // Comment-ONLY lines, never a trailing `//` after code — a token minted on a line that also carries a
@@ -363,7 +363,7 @@ export function stageSourceBlocks(stagesSource) {
 }
 
 /**
- * MECHANICAL **AND** UNSPOKEN-FOR — the highest-value target set for 's moves.
+ * MECHANICAL **AND** UNSPOKEN-FOR — the highest-value target set for the moves.
  *
  * An element in this set is not the model's judgment AND no validator polices it: nothing catches it
  * going wrong, and nothing about it needs a model. Every one is a candidate for the moves, and the set