clearotron 0.2.0 → 0.2.2

package/driver/driver.config.mjs

@@ -115,7 +115,7 @@ export const config = {
   // configured, because a whitespace-only string is TRUTHY in JavaScript — so a variable set to spaces
   // did not fall through to the default, it BECAME the path. `poolRoot` alone trimmed, so "blank" meant
   // two different things depending on which accessor you asked, and `queueDirs` resolved a RELATIVE
-  // queue directory under the process cwd, which is 's own incident shape.
+  // queue directory under the process cwd, which is its own incident shape.
   //
   // Owner ruling 2026-08-19: a whitespace-only value counts as UNSET, everywhere. `X=` already meant
   // "not configured" and this is that rule finishing its sentence — not a reversal of it, which
@@ -229,7 +229,7 @@ export const config = {
   /**
    * Every skills root handed to the engine's file tools (overlay + base, deduped).
    *
-   * NAMED FOR WHAT IT IS, not what we want it to be (, 2026-08-14): it was `skillsReadRoots`, and the
+   * NAMED FOR WHAT IT IS, not what we want it to be (2026-08-14): it was `skillsReadRoots`, and the
    * engine passes it to `--add-dir`, which has no read-only form. The read-only INTENT is real and is
    * enforced by the deny-hook at driver/engine/deny-authority-write.mjs — not by this name.
    */
@@ -252,7 +252,7 @@ export const config = {
   get skillsRoot() { return dirname(this.skillsDir); },
 
   // ── Per-agent paths ───────────────────────────────────────────────────────
-  // A prelim job is enqueued into the FORWARDING agent's OWN workspace queue (that agent's `write` tool
+  // A clearotron job is enqueued into the FORWARDING agent's OWN workspace queue (that agent's `write` tool
   // is sandboxed there), and we run the whole pipeline as that same agent so the reply tool
   // (`clawdi_send_<user>`), the run-dir, and the agent's memory all line up. The queue LOCATION therefore
   // encodes the agent identity — the driver derives {agentId, studioRoot} from where it claimed the job,
@@ -269,6 +269,13 @@ export const config = {
   },
   // Escaped prefix for the reverse regexes below (a custom prefix may carry regex metachars).
   get workspacePrefixRe() { return this.workspacePrefix.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); },
+  // `prelim-search` IS NOT A PRODUCT NAME HERE and does not follow the product rename. It is a
+  // directory segment on disk, and every archived run — its slug dirs, its `archive/`, its matter
+  // ledger — was written under it. Renaming the segment does not move those runs; it points the
+  // reader somewhere empty, and an empty directory reads as "no runs" rather than as an error.
+  // The rule the tree already enforces elsewhere: a token that is read back out of an archive keeps
+  // its old spelling, or the code refuses its own archive. Thirteen sites compute this segment and
+  // all thirteen stay.
   studioRootForAgent(agentId) {
     return join(this.workspaceRoot, this.workspaceDirName(agentId), "studio", "prelim-search");
   },
@@ -283,7 +290,7 @@ export const config = {
     const m = new RegExp(`(?:^|/)${this.workspacePrefixRe}([^/]+)/studio/prelim-search/queue/?$`).exec(qdir);
     return m ? m[1] : null;
   },
-  // Every agent workspace's prelim queue. The systemd `.path` watches these and the runner drains ALL of
+  // Every agent workspace's clearotron queue. The systemd `.path` watches these and the runner drains ALL of
   // them on each trigger (+ a timer fallback), so a request from ANY forwarder runs. (Pre-fix the watcher
   // and runner only looked at workspace-clawdi, silently orphaning every Alex/Sam job — the bug this fixes.)
   //
@@ -485,7 +492,7 @@ export const config = {
   // jobs AND manual pipeline.mjs invocations alike. WS-C raised the V4-7 stopgap's 1 → 3 (one per agent).
   // Phase-4: 3 → 6 + per-agent admission LIFTED (pipeline.acquireRunSlot no longer tags by agent). The
   // 2026-06-12 starvation that forced one-run-at-a-time (parallel runs → every gateway lane busy → 75s
-  // heartbeat timeouts → a lost mid-run reply) was a GATEWAY phenomenon; prelim COMPUTE now runs off the
+  // heartbeat timeouts → a lost mid-run reply) was a GATEWAY phenomenon; clearotron COMPUTE now runs off the
   // gateway on the standalone claude -p engine, so concurrent runs no longer starve the heartbeat. The TURN
   // cap below still bounds the (now light) intake/delivery gateway demand. The runner serializes only the
   // cheap claim+dedup per queue and runs pipelines concurrently up to this cap (same-matter dedup stays
@@ -493,14 +500,22 @@ export const config = {
   // if the env is unset — keep the two in sync). Set to 2 on 2026-06-18 (was 6): 2 parallel is enough for now,
   // and bounds Max-5x rate-limit thrash. To change the live cap, set the env on the VM (no code deploy needed).
   get maxConcurrentRuns() { return Math.max(1, numericSetting("CLEAROTRON_MAX_CONCURRENT_RUNS")); },
+  // ON-DISK NAME, NOT A PRODUCT NAME: an install that never set the variable is already using this
+  // directory, so renaming the default moves the install to an empty one and nothing migrates. Here
+  // the orphaned files are run-slot locks, so a live run's slot goes unseen and the global cap is
+  // silently exceeded rather than enforced. Owner ruling, tracker issue 308.
   get runLockDir() { return this.envValue("CLEAROTRON_RUN_LOCK_DIR") || join(this.workspaceRoot, "prelim-run-locks"); },
 
   // Delivery outbox (Workstream B). On a handoff-mode finish the driver drops <runId>.pending here (naming
-  // the forwarder agent); the systemd-user prelim-outbox.path unit fires an INSTANT prelim-deliver wake off
+  // the forwarder agent); the systemd-user prelim-outbox.path unit fires an INSTANT clearotron-deliver wake off
   // it, so a finished run sends in seconds instead of waiting ≤55m for the HEARTBEAT completion-watch (which
   // stays as the backstop). Mirrors runLockDir's derivation; env-overridable for dev/prod parity.
   // Phase 2: the outbox is ALSO the event seam for every other requester-facing event (run-failed,
   // intake-rejected, duplicate-skipped, late-bind-ack) — self-contained JSON packets via outbox.mjs.
+  // ON-DISK NAME, NOT A PRODUCT NAME: an install that never set the variable is already using this
+  // directory, so renaming the default moves the install to an empty one and nothing migrates. Here
+  // the orphaned files are requester-facing events — delivered, run-failed, intake-rejected — so the
+  // visible failure is a requester never told their run finished. Owner ruling, tracker issue 308.
   get outboxDir() { return this.envValue("CLEAROTRON_OUTBOX_DIR") || join(this.workspaceRoot, "prelim-outbox"); },
 
   // ── Delivery/comms (Phase 2, standalone product) ─────────────────────────────────────────────────
@@ -516,8 +531,25 @@ export const config = {
 
   // Fallback execution agent when a job's origin agent can't be derived from its queue dir (shouldn't
   // happen in normal operation). The real per-run agent is the forwarding agent, derived from the queue
-  // LOCATION (see studioRootForAgent / agentIdFromQueueDir above). `clawdi` carries all the prelim tools.
-  get defaultAgent() { return process.env.CLEAROTRON_DEFAULT_AGENT || "clawdi"; },
+  // LOCATION (see studioRootForAgent / agentIdFromQueueDir above).
+  //
+  // THE DEFAULT IS PART OF A PATH, so changing it moves where an install looks for its own runs:
+  // every run dir is `<workspaceRoot>/workspace-<agent>/studio/prelim-search/…`. An install created
+  // before this default changed keeps its runs under the old id and must pin it — both spellings,
+  // because the gather servers read their own variable:
+  //
+  //     CLEAROTRON_DEFAULT_AGENT=clawdi
+  //     CLEAROTRON_GATHER_AGENT=clawdi
+  //
+  // Unpinned, such an install starts a fresh empty workspace and its existing runs read as absent
+  // rather than as an error. Said again where upgrades are described (INSTALL.md, ops runbook).
+  //
+  // THE ID IS ALSO A KEY, not only a path segment. `AGENT_WHATSAPP` in stages.mjs is keyed by agent
+  // id, so the demo roster has to carry this value or the reference deployment resolves no operator
+  // number and the hole reads as "no copy configured" rather than as a miss. Both ids are in that
+  // roster for the same reason the pin above exists. (The roster stays one line: 32 backlog rows
+  // cite line numbers in stages.mjs, so a comment added there repoints all of them.)
+  get defaultAgent() { return process.env.CLEAROTRON_DEFAULT_AGENT || "localagent"; },
 
   // Per-stage retry budget (fresh session key per retry).
   get maxRetries() { return numericSetting("CLEAROTRON_MAX_RETRIES"); },
@@ -612,6 +644,26 @@ const MODEL_FAMILY_RE = /(?:^|\/)(?:claude-)?(opus|sonnet|haiku)(?:[-.]|$)/i;
 // mini one would then read as agreement, which is exactly the corruption this gauge exists to catch.
 const OPENAI_ID_RE = /^(?:openai\/)?(gpt-[\w.-]+|o\d[\w.-]*)$/i;
 const DATE_SUFFIX_RE = /-(?:\d{8}|\d{4}-\d{2}-\d{2})$/;
+
+/**
+ * Is this model id a DATED SNAPSHOT, or an undated alias that a provider may repoint?
+ *
+ * `modelBasis: "actual"` says the provider answered rather than that we guessed — it does not say the
+ * answer names a fixed build. Measured across three archived runs: haiku came back
+ * `claude-haiku-4-5-20251001`, opus and sonnet came back `claude-opus-5` and `claude-sonnet-5`. All
+ * three were recorded identically as observed, and two of them name something the provider can move
+ * underneath us. A snapshot rotation behind either alias between two runs leaves EXACTLY that record and
+ * is invisible, which is how an A/B across time ends up eliminating the seat on evidence that could not
+ * have shown it either way.
+ *
+ * Returns "snapshot", "alias", or null when there is no id to judge — null is a could-not-look and is
+ * never collapsed into "alias". PURE.
+ */
+export function modelSnapshotKind(model) {
+  const id = String(model ?? "").trim();
+  if (!id) return null;
+  return DATE_SUFFIX_RE.test(id) ? "snapshot" : "alias";
+}
 export function modelFamily(model) {
   if (!model) return null;
   const resolved = resolveModel(String(model));
@@ -714,7 +766,7 @@ export const REGISTER_PROVIDER = (() => {
 // created this constant, so neither branch's tests covered it — it surfaced from reading the two diffs
 // side by side, not from a red run.
 //
-// SIX values now: 's `free-tier` composes the two free sources into ONE register, so an EU+US
+// SIX values now: the `free-tier` composes the two free sources into ONE register, so an EU+US
 // clearance needs no paid vendor. It is a TIER, not a fourth free source — precedence runs between
 // tiers, never within one: a paid vendor configured IS the register alone, and the free sources are not
 // run beside it (corsearch and clarivate already aggregate both offices, so the second call buys
@@ -1314,7 +1366,7 @@ export const PROVIDERS = {
   // It also gated the wrong thing in practice. The US index is the one piece of this tier an operator
   // cannot get in a minute — it is a 41.5 GB build over two bulk products, behind an account with ID.me
   // identity verification, and it takes hours — so requiring it made the free tier unusable for exactly
-  // the person it exists for. 's CODE was merged; the INDEX is what no box had, and that was enough
+  // the person it exists for. That CODE was merged; the INDEX is what no box had, and that was enough
   // to keep and from ever being exercised.
   //
   // The EU pair stays REQUIRED: a free tier with no configured member at all is not degraded, it is
@@ -1419,7 +1471,7 @@ export function providerIdFrom(env) {
   // the CURRENT spelling, through `currentName`, on purpose. Reading only the legacy name answered
   // `null` for a file that names the provider on the one line an operator can see, and `activeProvider`
   // reads that null as "this environment said nothing" and falls back to the ambient value. That is
-  // 's defect exactly, wearing the new name.
+  // That defect exactly, wearing the new name.
   for (const name of ["CLEAROTRON_DATABASE"]) {
     const v = String(env?.[name] ?? "").trim().toLowerCase();
     if (v) return v;

package/driver/e2e-rounds.mjs

@@ -4,7 +4,7 @@
 //
 // ── the defect this exists to remove ──────────────────────────────────────────────────────────
 //
-// 's noise floor needs the SAME scenario run twice on one commit. Until this module, `run` wrote
+// That noise floor needs the SAME scenario run twice on one commit. Until this module, `run` wrote
 // `_e2e-doors-<ID>.json` holding exactly one token and `report` scoped itself to whatever token it found
 // there — so the second run of a pair OVERWROTE the only record of the first round's token, and the
 // first half became unreportable. Silently: `report` then described the second run, thirty seconds into
@@ -305,7 +305,7 @@ function runStart(hit) {
 /**
  * The rounds visible ON DISK, grouped by round token.
  *
- * `untokened` counts runs whose ref carries no round token — a pre- round, or one submitted by
+ * `untokened` counts runs whose ref carries no round token — a pre-change round, or one submitted by
  * hand. They belong to no nameable round, and saying how many there are is the difference between
  * "these are all the rounds" and "these are the rounds I could name".
  */

package/driver/effort-model.mjs

@@ -223,7 +223,7 @@ export const costBand = (i) => Math.max(1, Math.min(5, Math.ceil(effortUnits(i)
  * WHAT THIS REPLACED, and why a constant beat a model. The old quote was a base plus one adder per lane:
  * 1.5h, +0.5 for case law, +0.5 for a native-language lane, +0.5 for a single territory. It missed the
  * actual wall by +66%, +82% and −22% on three consecutive delivered runs, in BOTH directions, on one
- * engine build in one night ('s table). Every wall I could find from either source, eight runs:
+ * engine build in one night (the table). Every wall I could find from either source, eight runs:
  *
  *     quoted 1.5h  ×6   →  actual 2.23  2.28  2.38  2.40  2.49  2.49
  *     quoted 3.0h  ×1   →  actual 2.33      (the run with the MOST lanes came in SHORTER than five others)
@@ -246,7 +246,7 @@ export const TURNAROUND_QUOTE = Object.freeze({
   clearance: Object.freeze({ lowHours: 1.5, highHours: 2.5 }),
   // — OWNER RULING: a knockout quotes 5-10 MINUTES, a range, not a flat figure.
   //
-  // The flat 0.25 came from 's "no compute, just say it, keep it simple", and that ruling is
+  // The flat 0.25 came from the "no compute, just say it, keep it simple", and that ruling is
   // untouched here: this is still one stated figure per pipeline with nothing computed from levers. What
   // changed is the figure, and the shape of it.
   //

package/driver/engine/anthropic-agent.mjs

@@ -102,7 +102,7 @@ const engineMaxBufferChars = () => Math.max(1024, Number(process.env.CLEAROTRON_
 // `gemini-flash: "sonnet"`, `deepseek-v4-pro: "opus"` and `azure: "sonnet"`, and the fall-through below
 // mapped ANY unrecognised alias to "sonnet". So `--model gemini` ran sonnet while the telemetry logged
 // `google/gemini-3.1-pro-preview` (gateway stamps `resolveModel(<requested alias>)`), and every
-// attribution downstream of that row — the A/B arm, the token rollup, 's billing classes — was
+// attribution downstream of that row — the A/B arm, the token rollup, the billing classes — was
 // keyed to a model that never ran. Nothing said so, because a substitution has no error to report.
 //
 // The four cross-provider aliases were already dead before this change: the model-failover chain was
@@ -237,7 +237,7 @@ export function absolutizeSkillRefs(message, skillsDir, resolve = null) {
 //
 // ANTHROPIC-ONLY, AND MEASURED RATHER THAN ASSUMED. The obvious next step is to apply the same rule to
 // openai-agent's `--add-dir` (buildCodexArgs pushes the identical root), and it would accomplish nothing:
-// that engine spawns with `cwd = resolveSpawnCwd({cwd, runDir})` — the RUN DIR (, deliberately) —
+// that engine spawns with `cwd = resolveSpawnCwd({cwd, runDir})` — the RUN DIR (deliberately) —
 // under `--sandbox workspace-write`, which makes cwd a writable root on its own. Dropping the flag there
 // would remove a grant the seat still holds by another door and let this comment claim an isolation the
 // engine does not have. Codex-side isolation is a cwd question, and a separate decision.
@@ -377,7 +377,7 @@ export function writeBoundarySettings({ skillsRoots = [], profilesDir = null, ru
   return JSON.stringify({
     hooks: {
       PreToolUse: [{
-        // tracker issue 997 — Bash is in the matcher because seats have it and it walked past this hook entirely.
+        // Bash is in the matcher because seats have it and it walked past this hook entirely.
         // What the Bash arm can and cannot do is stated at its declaration in deny-authority-write.mjs;
         // it is a detector, and naming it here does not make it a boundary.
         matcher: "Write|Edit|MultiEdit|NotebookEdit|Bash",
@@ -401,7 +401,7 @@ export function synthesizeEnvelope({ resultEvent, usage, killed }) {
 
 export const anthropicAgentEngine = {
   name: "anthropic-agent",
-  // tracker issue 954 — WHAT THIS ENGINE GUARANTEES ABOUT SEAT WRITES, said out loud in the run record.
+  // WHAT THIS ENGINE GUARANTEES ABOUT SEAT WRITES, said out loud in the run record.
   // `deny-authority-write.mjs` is a `claude -p` PreToolUse hook, so it refuses a seat's writes into the
   // doctrine tree, the profile store and `<runDir>/_driver/` at the moment of the write. That is a real
   // boundary and this engine has it.
@@ -409,7 +409,7 @@ export const anthropicAgentEngine = {
   async runTurn({ message, model, thinking, timeoutSec, resumeRef, mcpConfig, allowedTools, cwd, skillsDir, skillsGrantRoots, profilesDir, resolveSkill, runDir, seatWrites = null, stallSec, progressFiles } = {}) {
     if (!message) throw new Error("anthropic-agent.runTurn: message is required");
     const { args, input, grantNote } = buildClaudeArgs({ message, model, thinking, resumeRef, mcpConfig, allowedTools, cwd, skillsDir, skillsGrantRoots, profilesDir, resolveSkill, runDir, seatWrites });
-    // tracker issue 1022 — the cross-check speaks. Driver stderr is what an operator reads, and it is where the other
+    // the cross-check speaks. Driver stderr is what an operator reads, and it is where the other
     // drift notices in this engine already land ([ledger], [env-aliases], [queue-watch]).
     if (grantNote) process.stderr.write(`${grantNote}\n`);
     const t0 = Date.now();
@@ -435,7 +435,7 @@ export const anthropicAgentEngine = {
       // inheriting that would load the dev-assistant instructions into every stage (context pollution +
       // cost). It also avoids the EACCES when the inherited cwd is unreadable by the runner's user.
       //
-      // tracker issue 524 — cwd is a granted WRITE root here (file tools are confined to cwd + --add-dir), so it is
+      // cwd is a granted WRITE root here (file tools are confined to cwd + --add-dir), so it is
       // the run dir when there is one. See resolveSpawnCwd in common.mjs for why, and for what it deletes.
       const spawnCwd = resolveSpawnCwd({ cwd, runDir });
       // stdin is a PIPE (not "ignore"): the prompt rides stdin, not a `-p` argv element, so it is never
@@ -446,7 +446,7 @@ export const anthropicAgentEngine = {
       // Detached makes claude its own process-group leader, so the watchdog's kills reach the whole tree.
       try { child = spawn(claudeBin(), args, { stdio: ["pipe", "pipe", "pipe"], cwd: spawnCwd, env: spawnEnv(), detached: true }); }
       catch (e) { return resolve(errResult(t0, e, resumeRef)); }
-      // tracker issue 2076 — THE SECOND SPAWN PATH, and it has to record too. This engine does not go
+      // THE SECOND SPAWN PATH, and it has to record too. This engine does not go
       // through runStreamingChild; wiring one and assuming the other follows is the exact defect shape
       // 2122 was raised on the same day (the demo banner reached the clearance renderer and not the
       // knockout one). Best effort, never fatal.
@@ -525,7 +525,7 @@ export const anthropicAgentEngine = {
       // (A repeat of an already-recorded path is NOT truncation — nothing is lost.)
       const READS_CAP = 500;
       let readsTruncated = false;
-      // ── tracker issue 1111 — THE TWO NUMBERS THAT MAKE A SLOW TURN A DIAGNOSIS RATHER THAN AN INFERENCE ────────
+      // ── THE TWO NUMBERS THAT MAKE A SLOW TURN A DIAGNOSIS RATHER THAN AN INFERENCE ────────
       //
       // `tokensPerSec` says so itself: "the denominator still contains the turn's own tool waits… it
       // records the ratio; it does not diagnose it." Establishing that a slow stage was WAITING rather
@@ -543,7 +543,7 @@ export const anthropicAgentEngine = {
       let toolCalls = 0;
       let toolWaitMs = 0;
       let toolAskedAt = null;
-      // tracker issue 1111 — WHAT THE WAIT IS MADE OF, keyed by the tool(s) that caused it.
+      // WHAT THE WAIT IS MADE OF, keyed by the tool(s) that caused it.
       //
       // The total alone cannot answer the question it was collected for. "Exclude tool wait from the kill
       // clock because a turn waiting on a tool is the harness working" is TRUE of `register_execute_plan`
@@ -554,7 +554,7 @@ export const anthropicAgentEngine = {
       // sorted set joined by "+". Every millisecond is attributed exactly once and the values sum to
       // `toolWaitMs` — a per-name split would double-count a concurrent ask and quietly break that identity.
       let toolAskedNames = null;
-      // tracker issue 1828 — WHICH CHUNK an ask arrived in. Every line in one stdout chunk is parsed in
+      // WHICH CHUNK an ask arrived in. Every line in one stdout chunk is parsed in
       // one synchronous loop, so they all share a single Date.now(). If an ask and its result land in
       // the SAME chunk, the parent was not running between them and the gap it measures is 0 — for a
       // wait that really happened. Reproduced deterministically by blocking this process's event loop:
@@ -595,7 +595,7 @@ export const anthropicAgentEngine = {
       const openAsks = [];             // ask records still outstanding, oldest first
       const askById = new Map();       // tool_use_id → its ask record
       let periodStart = null;          // when the current outstanding-SET period began
-      let periodChunk = null;          // the chunk it began in — tracker issue 1828's unmeasurable flag
+      let periodChunk = null;          // the chunk it began in — the unmeasurable flag
       let anonSeq = 0;                 // ids are on the wire, but never assume: synthesize if absent
       const periodKey = () =>
         [...new Set(openAsks.flatMap((r) => r.names))].sort().join("+");
@@ -709,7 +709,7 @@ export const anthropicAgentEngine = {
           progress();
         }
         else if (ev.type === "user") {
-          // tracker issue 1111 — the result of the ask above. Only counted when an ask is outstanding, so a `user`
+          // the result of the ask above. Only counted when an ask is outstanding, so a `user`
           // event with no preceding tool_use adds nothing rather than charging the turn for a gap it
           // never spent waiting.
           // Which ask is this the result OF? The id on the wire answers it. Falling back to the
@@ -776,7 +776,7 @@ export const anthropicAgentEngine = {
       const watchdog = setInterval(() => {
         artifactProgress();
         const now = Date.now();
-        // tracker issue 1780 — THE STARTUP DEBT. tracker issue 1692 widened the deadline below until the first byte but left this
+        // THE STARTUP DEBT. tracker issue 1692 widened the deadline below until the first byte but left this
         // clock's ORIGIN at spawn, so the startup interval stayed on the meter: the moment the grace let
         // go, progIdle already WAS the whole boot, and any NOPROG shorter than startup had expired before
         // the child was observed at all. The kill then landed on the next tick, before the ask could reach
@@ -784,7 +784,7 @@ export const anthropicAgentEngine = {
         // Releasing a clock is not starting one: the first byte is this clock's origin, not its green light.
         const progFrom = firstOutputAt === null ? lastProgress : Math.max(lastProgress, firstOutputAt);
         const idle = now - lastMove, progIdle = now - progFrom;
-        // ── tracker issue 1692 — STARTUP IS NEITHER SILENCE NOR WORK ──────────────────────────────────────────────
+        // ── STARTUP IS NEITHER SILENCE NOR WORK ──────────────────────────────────────────────
         // Every clock here USED TO start at SPAWN, so until the child's first byte they were all timing
         // process startup: an idle clock that had not yet seen silence, and an active clock that had not
         // yet seen work. Past tense deliberately — tracker issue 1780 finished this, and the sentence stayed true of
@@ -800,7 +800,7 @@ export const anthropicAgentEngine = {
         // kill it NOW, well below the wall, and record it as a STALL — never let the ceiling raise turn
         // into extended stall burn, and never let this kill read as "the stage needed more time".
         else if (progIdle >= (started ? NOPROG : Math.max(NOPROG, GRACE))) { stallKill = true; noProgressKill = true; killed = true; killTree(); }
-        // ── tracker issue 1111 — THE CEILING MEASURES ACTIVE TIME, NOT ELAPSED ────────────────────────────────────
+        // ── THE CEILING MEASURES ACTIVE TIME, NOT ELAPSED ────────────────────────────────────
         //
         // Owner ruling: "there isnt such thing as a hung model. it always delivers something or fails."
         // So this ceiling exists for the harness's own failure modes, not to budget the model, and a turn
@@ -824,7 +824,7 @@ export const anthropicAgentEngine = {
         // quantity: a long turn has three causes — tool latency, a generation stall, and sheer VOLUME
         // (one healthy stage ran 40.9 minutes at a normal rate producing 186k tokens) — and nothing that
         // keys on elapsed can tell them apart.
-        // tracker issue 1692: measured from the FIRST BYTE, never from spawn. Startup is not active time either, and
+        // measured from the FIRST BYTE, never from spawn. Startup is not active time either, and
         // against a tight pin it was the whole budget — a 900ms spawn hit a 500ms ceiling having done
         // nothing at all, and the turn died carrying `hardWall` with zero tool calls to explain it.
         else if (started && activeElapsedMs({ wall: now - firstOutputAt, toolWaitMs, toolAskedAt, now }) >= hardMs) {
@@ -840,7 +840,7 @@ export const anthropicAgentEngine = {
       child.stdout.on("data", (d) => {
         if (settled || overflow) return;
         if (firstOutputAt === null) firstOutputAt = Date.now();   // #1692 — the child has spoken; startup is over
-        chunkSeq += 1;                                            // tracker issue 1828 — see toolAskedChunk
+        chunkSeq += 1;                                            // see toolAskedChunk
         chunkBytes = d.length;
         chunkGapMs = prevChunkAt === null ? 0 : Date.now() - prevChunkAt;
         prevChunkAt = Date.now();
@@ -852,7 +852,7 @@ export const anthropicAgentEngine = {
       });
       child.stderr.on("data", (d) => {
         if (settled || overflow) return;
-        // tracker issue 1813 — STDERR DOES NOT START THE CLOCKS, and this line used to. This engine's protocol is
+        // STDERR DOES NOT START THE CLOCKS, and this line used to. This engine's protocol is
         // stream-json on STDOUT; stderr carries node warnings and CLI notices, which a child can emit
         // before it has done anything at all. Treating one as "the child has spoken" ended the grace and
         // — since tracker issue 1780, which made the first byte the progress clock's ORIGIN — started that clock too,
@@ -870,7 +870,7 @@ export const anthropicAgentEngine = {
       child.on("error", (e) => { if (settled) return; settled = true; clearInterval(watchdog); resolve(errResult(t0, e, resumeRef)); });
       child.on("close", (code) => settle(code));
       function settle(code) {
-        // tracker issue 2076 — the turn is over; the record must not outlive it, and is cleared only if
+        // the turn is over; the record must not outlive it, and is cleared only if
         // it still names THIS child.
         clearEngineChild(runDir, child?.pid);
         if (settled) return; settled = true;
@@ -889,7 +889,7 @@ export const anthropicAgentEngine = {
         // defect from the inside.
         const endedAt = Date.now();
         const wall = (endedAt - t0) / 1000;
-        // tracker issue 1111 — THE TWO CLOCKS MUST TILE THE WALL, in every case including the one that matters.
+        // THE TWO CLOCKS MUST TILE THE WALL, in every case including the one that matters.
         //
         // A turn killed mid-tool-call has an OPEN ask that `toolWaitMs` has not closed. Reporting the
         // unclosed accumulator left `activeMs + toolWaitMs` short of the wall by exactly that gap — and
@@ -924,7 +924,7 @@ export const anthropicAgentEngine = {
         const stderrOut = overflow
           ? (stderr + `\nanthropic-agent output overflow: stdout/stderr exceeded ${maxBuffer} chars — killed the tree and failed the turn (truncated tail never parsed)`)
           : noProgressKill
-            // tracker issue 1780 — THE SPECIMEN RIDES THE FAILURE, because the broken state expires. This kill has
+            // THE SPECIMEN RIDES THE FAILURE, because the broken state expires. This kill has
             // twice reddened `main` from a test whose ANTI-VACUITY check failed — the turn died having
             // opened no tool ask — and neither the box's ambient load nor a full-suite run reproduces
             // it on demand. So the discriminating bit is recorded HERE, where the kill happens, rather
@@ -962,11 +962,11 @@ export const anthropicAgentEngine = {
           // from this list is unreliable and the consumer must downgrade it to "not observed").
           reads: [...reads], readsTruncated,
           toolCalls, toolWaitMs: settledToolWaitMs,   // #1111 — two integers, no content
-          // tracker issue 1780 — ms from spawn to the child's FIRST byte, or null when it never spoke. RECORDING
+          // ms from spawn to the child's FIRST byte, or null when it never spoke. RECORDING
           // ONLY: nothing branches on it. A recording field is protected by a test or by nothing, so
           // engine.anthropic.test.mjs pins it — deleting it must red something.
           firstByteMs: firstOutputAt === null ? null : Math.round(firstOutputAt - t0),
-          // tracker issue 1111 — WHICH CLOCK RAN OUT, and WHAT the wait was made of.
+          // WHICH CLOCK RAN OUT, and WHAT the wait was made of.
           //
           // The hard wall measures ELAPSED, and elapsed includes time the model spent waiting on tools
           // rather than generating. A wall kill whose elapsed is mostly tool wait is a different event from
@@ -982,7 +982,7 @@ export const anthropicAgentEngine = {
           // "this record predates the gauge".
           activeMs: Math.max(0, Math.round(wall * 1000) - settledToolWaitMs),
           toolWaitByTool: { ...toolWaitByTool },
-          // tracker issue 1828 — the asks whose wait this process COULD NOT MEASURE, because the ask and
+          // the asks whose wait this process COULD NOT MEASURE, because the ask and
           // its result were delivered in one chunk. An ARRAY is a measurement (possibly `[]`: measured,
           // nothing unmeasurable), following toolWaitByTool's own rule that absence and "cannot report"
           // must not look alike. `toolWaitMs` and the per-tool split are untouched.

package/driver/engine/auth.mjs

@@ -20,7 +20,7 @@
 // spelling list let the OpenAI half decide how an Anthropic run bills. deleted the old names, so
 // there is one variable, only the selected engine is ever consulted, and the hazard has no route left.
 //
-// And deliberately written OUT at each site rather than through a helper: 's guard in
+// And deliberately written OUT at each site rather than through a helper: the guard in
 // `env-governance.test.mjs` finds a product read by the literal `env.NAME`, so a helper taking the
 // name as an argument makes both reads invisible to it — measured, it turned them harness-only and
 // put both names on the "no longer read by product code" list. The repetition is what keeps them

package/driver/engine/common.mjs

@@ -157,7 +157,7 @@ export function runStreamingChild({
   // timeout; NaN/≤0 clamps to 660s so the wall never silently disables. A non-positive or unparseable
   // PIN falls through to that derivation for the same reason — a pin is an instrument, never an off
   // switch. Without it the floor here is 61 SECONDS at the shortest, which is why this clock had no arm
-  // and why 's grace never reached the line below: no test could drive it without sitting for a
+  // and why the grace never reached the line below: no test could drive it without sitting for a
   // minute.
   const pinnedHard = Number(process.env.CLEAROTRON_HARD_MS);
   const hardMs = pinnedHard > 0 ? pinnedHard : (Number(timeoutSec) > 0 ? Number(timeoutSec) + 60 : 660) * 1000;

package/driver/engine/deny-authority-write.mjs

@@ -10,7 +10,7 @@
 //
 // ── WHY A HOOK, AND NOT THE THING YOU WOULD TRY FIRST ────────────────────────────────────────────────
 //
-// 's incident was a live clearance writing two files into the skills tree. The obvious reading is
+// That incident was a live clearance writing two files into the skills tree. The obvious reading is
 // "a seat did something it should not". Reading the grant layer first says otherwise: `buildClaudeArgs`
 // grants that tree with `--add-dir`, WHICH HAS NO READ-ONLY FORM, under `--permission-mode acceptEdits`
 // which auto-approves Write/Edit so each stage can save its output without prompting. The tree was

package/driver/engine/jx-turn.mjs

@@ -78,7 +78,7 @@ export function readJxTuple(tuple, { vendor, authMode, engine }) {
   const usage = u ? { input: u.input ?? 0, output: u.output ?? 0, cacheRead: u.cacheRead ?? 0,
                       cacheWrite: u.cacheWrite ?? 0, total: u.total ?? 0 }
                   : null;
-  // The model that actually served the turn, never the alias we asked for — 's criterion 4 is that
+  // The model that actually served the turn, never the alias we asked for — the criterion 4 is that
   // the receipt names who did the native-language work, and an alias does not name anyone. Both adapters
   // populate it (anthropic-agent from the assistant/init events, openai-agent from `ev.model`).
   const model = tuple?.modelWire ?? null;

package/driver/engine/mcp/clarivate-server.mjs

@@ -38,7 +38,7 @@ const API_KEY = process.env.CLARIVATE_API_KEY || "";
 const BASE = process.env.CLARIVATE_API_BASE || DEFAULT_BASE;
 const tctx = (kind) => ({
   kind,
-  agentId: process.env.CLEAROTRON_GATHER_AGENT || "clawdi",
+  agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",   // run session key — telemetry attribution
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
 });

package/driver/engine/mcp/corsearch-server.mjs

@@ -13,7 +13,7 @@ import { proposeSupplemental } from "./supplemental.mjs";
 const COOKIE = process.env.CORSEARCH_SESSION_KEY || "";
 const tctx = (kind) => ({
   kind,
-  agentId: process.env.CLEAROTRON_GATHER_AGENT || "clawdi",
+  agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",   // run session key — telemetry attribution
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
 });

package/driver/engine/mcp/declination-server.mjs

@@ -65,7 +65,7 @@ function loadDeclinationSpec(runDir) {
 
 async function record_declination(params) {
   // `CLEAROTRON_BAND_RUN_DIR` at CALL TIME, and there is no `run_dir` parameter — the run is not the seat's
-  // to name. 's lesson, where an invented fallback sat two lines under a promise never to guess.
+  // to name. That lesson, where an invented fallback sat two lines under a promise never to guess.
   const runDir = String(process.env.CLEAROTRON_BAND_RUN_DIR ?? "");
   if (!runDir) {
     return { error: "this server was started without a run — the driver wires it per run; there is no parameter for it and this tool never guesses one" };

package/driver/engine/mcp/dispositions-server.mjs

@@ -66,7 +66,7 @@ import { MAX_ROWS_PER_CALL } from "../../disposition-call.mjs";
 // can have. Here the serialization is ours, so the class is gone rather than caught.
 //
 // THE SPEC PATH IS THE SEAT'S ONLY PATH ARGUMENT, and it is the same driver-written file the grid tool
-// was given. 's rule: the path is the DRIVER'S, taken from the spec it wrote. Two derivations of one
+// was given. That rule: the path is the DRIVER'S, taken from the spec it wrote. Two derivations of one
 // filename is the drift that cost weeks.
 async function record_dispositions(params) {
   const { grid_spec_path, rows } = params ?? {};

package/driver/engine/mcp/euipo-server.mjs

@@ -46,7 +46,7 @@ const AUTH = {
 };
 const tctx = (kind) => ({
   kind,
-  agentId: process.env.CLEAROTRON_GATHER_AGENT || "clawdi",
+  agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
 });

package/driver/engine/mcp/fetch-server.mjs

@@ -30,7 +30,7 @@ serve({
       const ctrl = new AbortController();
       const timer = setTimeout(() => ctrl.abort(), TIMEOUT_MS);
       try {
-        const res = await fetch(url, { redirect: "follow", signal: ctrl.signal, headers: { "user-agent": "cordillera-prelim-fetch/0.1" } });
+        const res = await fetch(url, { redirect: "follow", signal: ctrl.signal, headers: { "user-agent": "cordillera-clearotron-fetch/0.1" } });
         const body = await res.text();
         const text = body.length > MAX_CHARS ? body.slice(0, MAX_CHARS) + `\n…[truncated at ${MAX_CHARS} chars]` : body;
         return { isError: res.ok ? undefined : true, text: `HTTP ${res.status} ${res.statusText} — ${url}\n\n${text}` };

package/driver/engine/mcp/free-tier-server.mjs

@@ -42,7 +42,7 @@ const AUTH = null;
 
 const tctx = (kind) => ({
   kind,
-  agentId: process.env.CLEAROTRON_GATHER_AGENT || "clawdi",
+  agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
 });
@@ -56,7 +56,7 @@ const CAPABILITY_OFFICES = CAPABILITIES.offices.covered.join("+");
 // it a third. It did. This is that third site, and it went on requiring USPTO_LOCAL_DB after the other
 // two stopped.
 //
-// The cost was total. On an EU-only box 's whole path worked — preflight passed, the plan compiled
+// The cost was total. On an EU-only box the whole path worked — preflight passed, the plan compiled
 // with the US split off as a disclosed deferral, the EU entry was executable — and then EVERY register_*
 // tool the seat called was refused here, so the EU half never ran. Everything upstream was right and
 // nothing downstream happened, which is the least legible way for a fix to fail.