clearotron 0.2.0 → 0.2.2

package/driver/engine/mcp/gather-config.mjs

@@ -79,7 +79,7 @@ export const REGISTER_SERVERS = {
   //   register_search / register_record_fetch — served since the thin days.
   //   register_enumerate     — SERVED and now granted.  built the page loop on the shared kernel;
   //     capabilities.js records the bounds it runs against as live-probed 2026-08-17 (pageSize 100 is the
-  //     API's hard refusal, verified at 200/250/500). This is the tool 's owner-window ceiling is
+  //     API's hard refusal, verified at 200/250/500). This is the tool the owner-window ceiling is
   //     passed into (OWNER_SCOPED_WINDOW → ceilingFor → makeEnumerate), so withholding it put that
   //     criterion out of reach of any round.
   //   register_execute_plan  — SERVED and now granted. Two corrective-ladder hints name it unconditionally
@@ -188,7 +188,7 @@ export const REGISTER_SERVERS = {
 // (server-tools-granted-or-stated.test.mjs: every record tool has exactly one granting stage).
 const RECORDING_SERVER = "recording-server.mjs";
 const RECORDING = Object.freeze({
-  // FIRST OCCUPANT — blind-frame ('s transport, wired by, dictation deleted by).
+  // FIRST OCCUPANT — blind-frame (the transport, wired by, dictation deleted by).
   //
   // `seatWrites: false` is the half, and it is the only thing that closes the regression door BY
   // CONSTRUCTION rather than by prose. Once the driver writes blind-frame-model.json, nothing this stage is
@@ -686,7 +686,7 @@ const LOCAL = {
   "unit-note": { script: "unit-note-server.mjs", tools: ["record_unit_note"] },
   // ── RECORDING — DERIVED from the registry above, one entry per stage, in registry order ──────────
   //
-  // These rows were hand-written here until 's collapse. They are LAST in this object on purpose:
+  // These rows were hand-written here until the collapse. They are LAST in this object on purpose:
   // LOCAL_SERVER_SCRIPTS below is `Object.values(LOCAL).map(...)`, so insertion order is part of its
   // value, and `recording-server.mjs` appearing TWICE is the evidence both keys resolve to the one
   // module. recording-grant-preservation.test.mjs pins that array verbatim, duplicates included.
@@ -695,7 +695,7 @@ const LOCAL = {
 };
 
 // The scripts LOCAL grants, DERIVED. Exported because the server census would otherwise recite them, and
-// a recited list is one more population to keep in sync by hand — 's census derived the register
+// a recited list is one more population to keep in sync by hand — the census derived the register
 // half from REGISTER_SERVERS and hardcoded this half, so wiring a new local server left it reading as
 // ungranted. Derive both halves or neither.
 export const LOCAL_SERVER_SCRIPTS = Object.freeze(Object.values(LOCAL).map((e) => e.script));
@@ -873,7 +873,7 @@ export function buildGatherMcpConfig(groups = [], { sessionKey, agent, runDir, r
   // There is no production caller to break: `driver/gateway.mjs` is the only non-test call site in the
   // tree and it always passes the run it is dispatching for. A caller that reaches this without one has
   // a defect a refusal names immediately, instead of a record body somewhere its run will never look.
-  // ORDER MATTERS: resolve the register provider FIRST. 's "CLEAROTRON_DATABASE is not set"
+  // ORDER MATTERS: resolve the register provider FIRST. That "CLEAROTRON_DATABASE is not set"
   // is the more fundamental refusal and the one an operator acts on, so it must still come out ahead of
   // this one — a box with neither a provider nor a run should be told about the provider.
   if (localKeys.has("register")) {
@@ -964,7 +964,7 @@ export function toolGroupsForStage(name = "") {
   // the issue predicts, on the one matter where the confirmation step was most clearly indicated (four
   // `loaded` meaning rulings, see).
   //
-  // This changes engine behaviour and ships `status:merged-awaiting-e2e`, which 's out-of-scope block
+  // This changes engine behaviour and ships `status:merged-awaiting-e2e`, which the out-of-scope block
   // anticipates in as many words. The scoping is doctrine's, not the grant's: SKILL.md already caps it at
   // one probe per review and requires the query and its result recorded verbatim.
   // ── THE ONE BRANCH THAT RETURNS RETRIEVAL *AND* RECORDING, and it has to be here ────────────────
@@ -1027,7 +1027,7 @@ export function toolGroupsForStage(name = "") {
   //
   // NOT a prefix test, for either form. A prefix would hand the grant to any future stage whose name
   // merely began with a recording stage's. The base row must SAY it fans out — declaration, not
-  // inference, the same principle as 's declared phase.
+  // inference, the same principle as the declared phase.
   for (const [sep, flag] of SUFFIX_FORMS) {
     const at = name.lastIndexOf(sep);
     if (at <= 0) continue;
@@ -1153,7 +1153,7 @@ export function recordAxisFor(name = "") {
 // gains `--mcp-config`, `--strict-mcp-config` AND `--allowedTools` where it previously had none. That is
 // a change in KIND and the right one — these stages become constrained for the first time — but it must
 // be asserted at the argv level, not inferred from this map.
-// FIRST OCCUPANT — blind-frame ('s transport, wired here). SECOND — skeptic.
+// FIRST OCCUPANT — blind-frame (the transport, wired here). SECOND — skeptic.
 //
 // The safety basis is a SAMPLE and is stated as one: O3c measured blind-frame at 0 Bash calls across 15
 // attempts, alone among the eleven tool-free stages. That is why it converted first. On attempt 16 a
@@ -1189,7 +1189,7 @@ export const RECORDING_STAGES = Object.freeze(Object.fromEntries(
 //
 // ── DELIBERATELY NOT DERIVED FROM THE REGISTRY, unlike the four declarations above it ──────────────
 //
-// 's collapse made the LOCAL entries, the group resolution, the stage→group map and RECORDING_STAGES
+// That collapse made the LOCAL entries, the group resolution, the stage→group map and RECORDING_STAGES
 // derive from one registry. This table did NOT move, and the reason is the whole value of it: O1 asserts
 // the resolved grant EQUALS this row. Derive it from the same registry the grant derives from and O1
 // compares a value with itself — a guard turned tautology inside the PR that was meant to strengthen it.
@@ -1211,7 +1211,7 @@ export const RECORDING_TOOLS = Object.freeze({
     "mcp__recording-matter-frame__search_run_artifacts"]),
   skeptic: Object.freeze(["Read", "mcp__recording-skeptic__record_skeptic",
     "mcp__recording-skeptic__search_run_artifacts"]),
-  // 's third conversion. `Read` and its one record tool: the stage's reads are its two named input
+  // That third conversion. `Read` and its one record tool: the stage's reads are its two named input
   // files, which the seeded grant serves, and it gets no search tool because a stage with an enumerable
   // read set does not need one. BY HAND, like every row here — deriving it from the registry would make
   // O1 compare a value with itself.
@@ -1370,7 +1370,7 @@ export function seatWritesForGroups(groups = []) {
 }
 
 /**
- * THE ENUMERATION, derived and not hand-listed ('s third proof requirement).
+ * THE ENUMERATION, derived and not hand-listed (the third proof requirement).
  *
  * A naive grep for `seatWrites: false` returns TEN hits and the population is EIGHT: two of the hits are
  * comment text — one in the blind-frame FIRST OCCUPANT note, one in `allowedToolsFor`'s own

package/driver/engine/mcp/perplexity-server.mjs

@@ -135,7 +135,7 @@ function tellObligations(spec, ledgerJson) {
     }, null, 2) + "\n",
   );
   // B — NO SEAT-FACING FORM IS WRITTEN, ANY MORE, BY ANYONE. The -era write-back that lived here
-  // (a union of the seat's file bytes into a rebuilt seat-facing form, plus 's whose-bytes referee)
+  // (a union of the seat's file bytes into a rebuilt seat-facing form, plus the whose-bytes referee)
   // died with the form path: the seat records rulings only through `record_dispositions`, the
   // accumulator in `_driver/` is the one copy and the tool is its writer mid-turn. What the seat needs
   // at this moment — the obligations, the candidates, the positions and the recording route — is all in

package/driver/engine/mcp/recording-server.mjs

@@ -24,12 +24,12 @@
 //
 // `CLEAROTRON_BAND_RUN_DIR`, read at CALL TIME. `serverEnv()` (gather-config.mjs:162) sets it for every local
 // server, not only band. There is no `run_dir` parameter and there must not be one — the lesson is
-// 's, where an invented `CLEAROTRON_RUN_DIR` fallback sat two lines under a sentence promising the tool
+// the earlier one, where an invented `CLEAROTRON_RUN_DIR` fallback sat two lines under a sentence promising the tool
 // never guesses a run. Call time rather than module load: stdio-server.mjs:29-33 states why for this
 // exact variable.
 // ── THE SECOND CAPABILITY CLASS: A SCOPED READ, and why it does not break the sentence above ────────
 //
-// `search_run_artifacts` is the skeptic's sanctioned read surface ('s ratification hold, unlock
+// `search_run_artifacts` is the skeptic's sanctioned read surface (the ratification hold, unlock
 // path 1): a literal substring search over the calling run's OWN artifact tree, replacing the Bash
 // reads O3c measured the stage using. It still dials nothing and writes nothing — the category's
 // promise is about RETRIEVAL and writes, and a read bounded to CLEAROTRON_BAND_RUN_DIR widens neither.
@@ -464,7 +464,7 @@ serve({
               value: { type: "string", description: "The search term itself — never a label, never an enumeration." },
               // THE CANONICAL ENUM, imported — never a second copy. `parseVariantManifestModel` refuses
               // anything outside it, so a hand-typed list here could drift into promising a category the
-              // parser rejects. 's brief reads the same constant.
+              // parser rejects. That brief reads the same constant.
               category: { type: "string", enum: [...VARIANT_CATEGORIES] },
               rationale: { type: "string" },
               romanization: { type: "string", description: "Latin-script form. NON-LATIN VALUES ONLY — a romanisation on a Latin value is refused as an orphan." },
@@ -848,7 +848,7 @@ serve({
     // The reviewer is the report's only check, and it wrote its own review as prose. Everything
     // downstream then parsed that prose back: the verdict token, the flag list, the `[kind:]`/`[on:]`
     // channels, and the count that decides whether a BLOCKING is degenerate. The seat chose the
-    // enumeration style, so the parse could miss it — 's lettered flags were invisible
+    // enumeration style, so the parse could miss it — the lettered flags were invisible
     // for exactly that reason. Handing values makes the style the driver's, so a flag the parse cannot
     // see stops being possible rather than being detected afterwards.
     //
@@ -1120,6 +1120,10 @@ serve({
                   properties: {
                     recordId: { type: "string", description: "Copied VERBATIM from the filings you were given." },
                     read: { type: "string", description: "What you concluded about THIS filing." },
+                    // Declared here for the reason the comment above gives: `additionalProperties: false`
+                    // means an undeclared key is a contradiction between the prose and the schema, and the
+                    // seat resolves it whichever way it happens to trust.
+                    band: { type: "string", description: "OPTIONAL — how you rate THIS filing, in the framework's own band words. Send it when you formed a view on the filing itself; the card prints it as that filing's rating. Omit it and your read still prints, with no rating claimed." },
                   },
                 },
               },

package/driver/engine/mcp/signa-server.mjs

@@ -17,7 +17,7 @@ const API_KEY = process.env.SIGNA_API_KEY || "";
 const BASE = process.env.SIGNA_BASE_URL || DEFAULT_BASE;
 const tctx = (kind) => ({
   kind,
-  agentId: process.env.CLEAROTRON_GATHER_AGENT || "clawdi",
+  agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",   // run session key — telemetry attribution
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
 });

package/driver/engine/mcp/uspto-local-server.mjs

@@ -43,7 +43,7 @@ const DB_PATH = process.env[DEFAULT_DB_ENV] || "";
 const AUTH = { dbPath: DB_PATH };
 const tctx = (kind) => ({
   kind,
-  agentId: process.env.CLEAROTRON_GATHER_AGENT || "clawdi",
+  agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",   // run session key — telemetry attribution
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
 });

package/driver/engine/openai-agent.mjs

@@ -446,7 +446,7 @@ function settleTuple({ r, ev, resumeRef }) {
     killed, wall: r.wall,
     stdout: text, stderr: stderrOut, laneWaitMs: 0,
     json, usage,
-    // MODEL GAUGE (,): the id codex recorded for this turn — from its session rollout under
+    // MODEL GAUGE (): the id codex recorded for this turn — from its session rollout under
     // this run's own CODEX_HOME, since the event stream states none. Still two states and never one:
     // null = "this engine did not report", never the requested tier wearing the word "actual".
     // gateway.mjs records the absence as modelBasis:"unknown".
@@ -478,7 +478,7 @@ function settleTuple({ r, ev, resumeRef }) {
       mcpRefused: mcpToolGauge(ev).mcpToolCallsRefused > 0 || undefined,
       rateLimited: rateLimited || undefined,
       rateLimitBasis: rateLimited ? "text-match" : undefined,
-      // resetsAtBasis (, 2026-08-20): same honesty as rateLimitBasis one line up, for the reset
+      // resetsAtBasis (2026-08-20): same honesty as rateLimitBasis one line up, for the reset
       // CLOCK rather than the classification. codex states its reset as human prose with NO timezone
       // ("try again at Aug 22nd, 2026 9:06 AM"), so the ISO we derive is a reading of that prose in the
       // box's own zone — never a provider fact. Absent when no hint was found, exactly as `resetsAt` is.

package/driver/engine-build.mjs

@@ -87,11 +87,11 @@ export function resetEngineCommit() { cached = undefined; source = undefined; re
 // So attribution has been a reflog reconstruction: join a checkout's reflog against each run's
 // `startedAt`. That reconstruction expires with the reflog, cannot survive a re-clone, is wrong for
 // every run made while the checkout sat detached, and mixes a local-time reflog against UTC stamps.
-// It decided three certifications in one morning (,) and produced two near-miss
+// It decided three certifications in one morning () and produced two near-miss
 // wrong rulings in two days.
 //
 // A SIBLING, NOT A WIDER RETURN TYPE. `engineCommit()` keeps its bare-string contract exactly:
-// 's guard pins its import line by regex AND pins the literal `engineCommit: engineCommit` in
+// That guard pins its import line by regex AND pins the literal `engineCommit: engineCommit` in
 // the publisher, four consumers read the string, and `scripts/freeze-example-run.mjs` asserts in prose
 // that it "is cached to one value and cannot differ between the two". Widening it would break all of
 // that to add a field only one new caller wants.

package/driver/enqueue-schema.mjs

@@ -663,7 +663,7 @@ export function validateJob(job, { atClaim = false } = {}) {
   // Every other check in this build lives at one or two of them: `checkClearanceScopeRules` runs at the
   // runner, the portal and plan_run but at neither start_run nor the CLI; the mark budget and the
   // availability gate run at the runner alone. A rule placed at a door is a rule the other doors do not
-  // have, and 's acceptance test is that all three refuse the same request in the same words.
+  // have, and the acceptance test is that all three refuse the same request in the same words.
   //
   // WHAT IS JUDGED HERE: everything the REQUEST states. Each of the offering's illegal shapes is visible
   // without resolving anything — a narrowed Global preliminary, a two-country Full country search, a
@@ -983,7 +983,7 @@ export const EXAMPLE_JOB = {
   // deliveryRoute: "portal",           // OPTIONAL: "email" (default) or "portal" — a portal-route packet
                                         // is mark_sent by the courier WITHOUT an email send.
   // parentRunId: "novapulse-cedar",    // OPTIONAL escalation lineage: the run this one escalates from
-                                        // (e.g. a knockout HIGH mark → this prelim). Recorded, not yet resolved.
+                                        // (e.g. a knockout HIGH mark → this clearotron). Recorded, not yet resolved.
   projectKey: "console-ecosystem",      // spec 62 (OPTIONAL): the PROJECT/engagement under the customer whose
                                         // overlay (its own marketplaces/classes/sector/posture) rates this
                                         // matter; omit ⇒ runs on the customer profile. Unknown key ⇒ clarify.

package/driver/enqueue.mjs

@@ -245,7 +245,7 @@ async function main(argv) {
   try { job = assembleFromFlags(flags); } catch (e) { fail(`could not assemble the job: ${e.message}`); }
   if (!job.forwarder) fail("missing --forwarder — the requester/reply-routing key; the delivery packet needs it to route the report (there is deliberately no default)", 2);
   // THE EARLY --product CHECK IS GONE, and its deletion is the fix. It fired before validateJob and said
-  // the same thing in different words — `--product "prelim"` rather than `product "prelim"`, and without
+  // the same thing in different words — `--product "clearotron"` rather than `product "clearotron"`, and without
   // the `(or omit it for the account's default)` clause, which is the one clause that tells a requester
   // the field is optional. So the CLI's real answer to a typo was not the shared one, and a test that
   // started at assembleFromFlags could never see it. validateJob refuses it now, in the sentence every

package/driver/envelope-settle.mjs

@@ -196,7 +196,7 @@ export async function settleReceipt({ P, plan, receipt, dispatch = null, rejoin
 
 /**
  * The settled facts a digest dispatch needs, as a message section — mechanical only, quoting the executor's
- * own reason. Every digest pass gets this, not just the first: 's dispatch hint reaches FRESH dispatches
+ * own reason. Every digest pass gets this, not just the first: the dispatch hint reaches FRESH dispatches
  * by construction (stageOnce ignores `extra` when opts.followup is set), and the flush passes it misses are
  * exactly where the evidence run burned 2,908 seconds failing the same validator twice more.
  *

package/driver/evidence-claim-invariant.mjs

@@ -26,11 +26,11 @@
 // reading only the claim misses it: the increase is in the evidence stamp.
 //
 // THE LADDER ALREADY EXISTS, so this introduces no vocabulary. `basis` is the run's own certainty
-// ordering and 's demotion is its enforcement; `basis-derivation.json` records every demotion with
+// ordering and the demotion is its enforcement; `basis-derivation.json` records every demotion with
 // its reason and its uri. Arm B is a comparison against an artifact the driver already writes, which is
 // why it needs no fetch ledger and no new plumbing.
 //
-// REPORTS, NEVER THROWS. The caller decides what a violation costs — 's lesson is that a guard
+// REPORTS, NEVER THROWS. The caller decides what a violation costs — the lesson is that a guard
 // which can kill a run is a guard that eventually kills a run over its own false positive.
 
 /** The run's own certainty ordering for a meter's basis. Higher is more certain. */

package/driver/findings-model.mjs

@@ -81,7 +81,7 @@ export const DISPOSITIONS = ["adversarial", "coexistence-partner", "distinguishe
 // FLOOR 6 and was written as this MOVING constant, which was the same number on the day it was written.
 // Bumping here alone would have made every archived v6 run — v6 shipped 2026-08-03, so real delivered
 // matters carry it — republish through pool-admin doRepublish with the ground-grouped reasoned
-// negatives silently replaced by the pre- region-grouped section. Not a crash: a substance change to
+// negatives silently replaced by the pre-change region-grouped section. Not a crash: a substance change to
 // a report already sent to a client, which is what the render freeze exists to catch. MEASURED at the
 // break: 34,722 → 36,466 body bytes on a three-negative v6 fixture. That line now reads `>= 6`.
 //
@@ -539,7 +539,7 @@ export function sentenceCaseLead(s) {
   return str.slice(0, m[1].length) + m[2].toUpperCase() + str.slice(m[1].length + m[2].length);
 }
 
-// ── tracker issue 601 — THE ONE BOUND AN ASK STILL HAS, AND THE ONLY ONE ─────────────────────────────────────────
+// ── THE ONE BOUND AN ASK STILL HAS, AND THE ONLY ONE ─────────────────────────────────────────
 // The verdict statement renders in index cells, run status, the report hero, the email headline and the
 // xlsx Verdict row — one row each, so an unbounded first condition would swallow the row. This is the
 // last surface in the product that shortens an ask, and it is the honest one: `clipClause` marks the cut
@@ -813,7 +813,7 @@ const onlyKeys = (obj, allowed, tokenFor) => {
  *   | finding_bears_on_invalid:<ordinal> | finding_disposition_invalid:<v> | finding_impact_invalid:<ordinal>
  *   | finding_deadline_invalid:<ordinal> | finding_deadline_key_unknown:<key> | finding_deadline_date_missing:<ordinal>
  *   | findings_context_note_invalid | findings_context_note_key_unknown:<key> | findings_context_note_type_invalid:<v>
- *   | findings_net_chained:<ordinal>   (, v7 only — PLURAL on purpose; see validateNetShape)
+ *   | findings_net_chained:<ordinal>   (v7 only — PLURAL on purpose; see validateNetShape)
  * (the composite>=3 NON-EMPTY-source gate for use_check/own_rights is raised by the caller in verify.mjs —
  *  this parser only enforces SHAPE: object / key-allowlist / source-is-a-string. Both fields are OPTIONAL.)
  *
@@ -1210,7 +1210,7 @@ export function parseFindingsJsonLenient(raw, opts = {}) {
 // A1: a withdrawn finding is a non-mergeable singleton — folding a LIVE filing into a
 // withdrawn base (or vice versa) would either resurrect a killed conflict or silently kill a live
 // one. The `~withdrawn~` suffix keeps it in its own group without touching live-group keys.
-// ── A LATIN NORMALISER STANDING WHERE A COMPARISON SHOULD BE ('s class, third site) ─────────────
+// ── A LATIN NORMALISER STANDING WHERE A COMPARISON SHOULD BE (the class, third site) ─────────────
 //
 // `[^a-z0-9]` folds a CJK, Cyrillic or Arabic value to the EMPTY STRING, and this key is built from two
 // of them. Measured on origin/main before the fix:
@@ -1642,7 +1642,7 @@ function validateBand(f, ord, mode) {
 //   · FACTS AND ASSESSMENT, NEVER AN ACTION PRESCRIPTION. The reader is a lawyer who layers their own
 //     advice on top. The house prose contract already rules prescriptions out everywhere; on this field
 //     it is checked, because it is the sentence most likely to drift into advice.
-//   · A CONCLUSION, NEVER A CHAIN (, 2026-08-06). See validateNetShape below for the ruling, the two
+//   · A CONCLUSION, NEVER A CHAIN (2026-08-06). See validateNetShape below for the ruling, the two
 //     mechanical markers it refuses, and why it is the one net rule that had to be version-gated.
 //   · STILL NO LENGTH MAXIMUM, and now for a second reason. It never came from the validator (a model
 //     told to be brief writes a shorter sentence and drops a fact), and build 1.3 deletes the renderer's
@@ -1670,7 +1670,7 @@ const PRESCRIPTION_RE = /\b(we recommend|we advise|we suggest|you should|should
 //   · NOT A QUALITY JUDGMENT. "Does this read as a conclusion" is the lawyer's call and the reviewer
 //     stage's; code cannot make it without re-judging the finding, which is the rules-engine failure
 //     this codebase keeps refusing.
-//   · NOT THE WORD "so". 's prose names "a semicolon, an arrow, or the word so", but a word match is
+//   · NOT THE WORD "so". That prose names "a semicolon, an arrow, or the word so", but a word match is
 //     not mechanical: it fires on "also", "so-called", "so long as the owner". Punctuation cannot be
 //     mistaken for anything else, and the prose rule survives in synthesis-rules.md where a reader
 //     applies judgment to it.
@@ -1910,7 +1910,7 @@ function recordUrlOrigin(value) {
  * `"not a url"` and `mailto:…` at this site — a documented decision that the host gate does not judge
  * them. A blanket not-a-URL rule refutes it silently. So this refuses exactly the shapes names:
  * a fragment (addresses THIS document, never a record), a bare path (names no host), and whitespace
- * (a value that is only shaped like one). Anything else is still 's to rule on.
+ * (a value that is only shaped like one). Anything else is still the to rule on.
  *
  * That leaves `mailto:…` and free text composing a live-but-wrong href rather than a dead anchor. It is
  * a real gap and it is NOT this issue's class; recorded on rather than widened into here.
@@ -2275,7 +2275,7 @@ export function validateKnockoutFinding(f, idx, seenOrdinals = new Set(), opts =
       throw new Error(`knockout_finding_band_invalid:${kshort(f.band)} (this run's framework "${manifest.framework_key}" rates in EXACTLY these words: ${manifest.bands.map((b) => b.label).join(" / ")})`);
     f.band = canonical;
   }
-  // THE CONCLUSION SENTENCE — 's contract, unchanged, on the other product. One rule, one gate: a
+  // THE CONCLUSION SENTENCE — the contract, unchanged, on the other product. One rule, one gate: a
   // knockout card and a clearance card are read by the same lawyer in the same week.
   if (typeof f.net !== "string" || !f.net.trim())
     throw new Error(`knockout_finding_net_missing:${ord} (every knockout finding carries the one conclusion sentence the card leads with — see synthesis-rules.md "The finding sentence")`);

package/driver/floor-duty.mjs

@@ -93,7 +93,7 @@ export const FLOOR_DUTY_STAGE = "placement-inquiry";
  * the chance to place the floor or name it with a ground.
  *
  * SAFE TO RE-RUN, and that is measured rather than hoped: the placement form is UNIONED into an
- * accumulator before it is judged and `placements.json` is rendered from the accumulator (, after an
+ * accumulator before it is judged and `placements.json` is rendered from the accumulator (after an
  * incident where a killed attempt's finished tiers were thrown away). A second pass merges; it does not
  * start from nothing.
  *

package/driver/form-neighbourhood.mjs

@@ -483,7 +483,7 @@ export function floorSeeds(manifestMd, { model = null, mark = "" } = {}) {
   //
   // It is NOT fixed by romanising. variantCompletenessGaps' per-script floor validates and never
   // generates, on the stated principle that the moment code mints a search term, judgment has moved into
-  // the funnel — and that was 's own reason for excluding non-rule-based transliteration. A
+  // the funnel — and that was its own reason for excluding non-rule-based transliteration. A
   // romanisation is a minted term. So the deterministic floor genuinely does not exist for this mark, and
   // the honest move is to say which mark, and why, where a reader will see it.
   if (!seeds.length) {

package/driver/framework.mjs

@@ -97,7 +97,7 @@ export function parseFrameworkManifest(raw) {
   return m;
 }
 
-/** Load + parse the manifest sitting beside a framework .md. rootDir is the prelim-driver dir (the dir
+/** Load + parse the manifest sitting beside a framework .md. rootDir is the clearotron-driver dir (the dir
  *  skills/ paths are relative to — the same base reads() uses). */
 // `rootDir` may be a string (legacy: join against it) OR a resolver function taking the manifest's
 // skills-relative path and returning an absolute one — the layered overlay-over-base lookup

package/driver/gateway.mjs

@@ -13,7 +13,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, wri
 import { join, dirname, basename } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
 import { tmpdir } from "node:os";
-import { config, resolveModel, modelFamily, envOn, envGateOn } from "./driver.config.mjs";
+import { config, resolveModel, modelFamily, modelSnapshotKind, envOn, envGateOn } from "./driver.config.mjs";
 import { stageLog, runLog, note, outputMeta } from "./log.mjs";
 // — the closed disposition set has ONE author; this file dictates it and must not retype it.
 import { DISPOSITIONS, POSITION_REQUIRED_DISPOSITIONS } from "./findings-model.mjs";
@@ -42,7 +42,7 @@ import { FINDINGS_FILE as REGISTER_FINDINGS_FILE, refusalsFor as registerDigestR
 // file edit, and this table is what the warm patch reads to know that. It grows by one row per conversion,
 // so its membership IS the conversion record — and a stage absent from it still gets the write-mode tails,
 // correctly, because its seat still holds Write.
-// EXPORTED for 's agreement guard, which derives each recording stage's artifact from this table
+// EXPORTED for the agreement guard, which derives each recording stage's artifact from this table
 // rather than from a second hand-written list: stage → its granted record tool → the row whose `tool`
 // matches → the basename. A conversion that adds the grant and forgets the row leaves the guard unable to
 // name an artifact for that stage, and it fails there rather than quietly checking one direction less.
@@ -577,7 +577,7 @@ export function selectEngine() {
 //      move-blindness this repo has counted seven instances of.
 //
 // What died here with the form path (2026-08-17 owner ruling, delete-not-gate): reading the seat's file
-// as a SUBMISSION, preserving it, refereeing whose bytes it held ('s isDriverOwnBytes machinery) and
+// as a SUBMISSION, preserving it, refereeing whose bytes it held (the isDriverOwnBytes machinery) and
 // rewriting the seat-facing copy. The seat writes no file, so there is no submission to read, no bytes
 // to referee, and no seat-facing copy to keep in step. The capture duty moved to the receiver
 // (disposition-tool.mjs captureCall — the payload as handed to the process, indexed before the work).
@@ -618,14 +618,14 @@ export function syncDispositionForm(files) {
       let spec = null;
       try { spec = JSON.parse(readFileSync(specPath, "utf8")); }
       catch {
-        // No spec sidecar ⇒ a pre- archived resume: nothing dictated, nothing owed, nothing to count.
+        // No spec sidecar ⇒ a pre-change archived resume: nothing dictated, nothing owed, nothing to count.
         // A spec that EXISTS and does not parse is a different fact: the stage owes a sweep whose state
         // cannot be counted, and reading that as "owes nothing" would resume a session the veto exists to
         // refuse. The validator fails such a run on grid_spec_unreadable in its own lane.
         return existsSync(specPath) ? { countable: false } : null;
       }
       const formPath = spec?.connotation?.dispositions_path;
-      // No dictated path ⇒ a pre- spec (an archived run being resumed). Nothing to count, and the
+      // No dictated path ⇒ a pre-change spec (an archived run being resumed). Nothing to count, and the
       // gate has nothing to judge either — the two agree by construction.
       if (!formPath || spec?.connotation?.disposition_required !== true) return null;
       let recorded = null;
@@ -1142,6 +1142,11 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     const modelRequested = engine.resolveModelId ? engine.resolveModelId(model) : resolveModel(model);
     const modelActual = (typeof turn.modelWire === "string" && turn.modelWire) ? turn.modelWire : null;
     const modelBasis = modelActual ? "actual" : "unknown";
+    // WHETHER THE OBSERVED ID NAMES A FIXED BUILD. `modelBasis: "actual"` says the provider answered,
+    // not that the answer is pinned: two of the three tiers come back as undated aliases the provider
+    // may repoint, and recorded beside a dated one they read identically. null when there is nothing to
+    // judge, never collapsed into "alias".
+    const modelSnapshot = modelSnapshotKind(modelActual);
     if (modelActual) lastModelWire = modelActual;                       // — never overwritten with null
     // The comparison is by FAMILY (driver.config modelFamily), because `--model haiku` legitimately comes
     // back as `claude-haiku-4-5-20251001`. THREE-VALUED: null when either side names no family this
@@ -1337,7 +1342,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     // turn did not report completion, and completeness of its write is exactly what is unknown.
     // Still never applies to a rate-limit rejection either (0 tokens, nothing written).
     const killClass = isTaintRow({ fail, code, killed, signals: turn.signals });
-    // ONE artifact judgement, shared by both rescues below ('s rule: never a second, drifting copy of
+    // ONE artifact judgement, shared by both rescues below (the rule: never a second, drifting copy of
     // the contract). Present + written by THIS attempt (the per-attempt snapshot — an inherited file and
     // equally an earlier attempt's file never rescue a failed turn) + passes the stage's own validator.
     const attemptWroteTruth = () => {
@@ -1477,7 +1482,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     // and `rate_limited` drive retry policies this must not override. `modelMismatch` is journalled on
     // the row either way, so the mismatch is never lost — only the classification defers.
     //
-    // Default-ON gate through `envGateOn` ('s rule): `CLEAROTRON_MODEL_WIRE_CHECK=0` disarms it without
+    // Default-ON gate through `envGateOn` (the rule): `CLEAROTRON_MODEL_WIRE_CHECK=0` disarms it without
     // a deploy if a provider ever starts reporting an id this build's family regex misreads. Disarming
     // silences the REFUSAL, never the record — `modelActual`/`modelMismatch` keep landing on every row.
     if (modelMismatch === true && !fail && envGateOn("CLEAROTRON_MODEL_WIRE_CHECK")) {
@@ -1545,7 +1550,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
       // how a stale build-stage note came to describe a live field as dead. Measured on preserved runs
       // whose engine commit is byte-identical to this file: the R5 register-unit attempt row of 08-12
       // carries {input:8349, output:18374, cacheRead:1805815, cacheWrite:96608, total:1929146}. Every
-      // figure in 's own table is a verbatim read of these rows — the issue was minted BY reading
+      // figure in its own table is a verbatim read of these rows — the issue was minted BY reading
       // the field this comment called null. The shape is `mapUsage`'s canonical
       // {input, output, cacheRead, cacheWrite, total}, written by both engines
       // (anthropic-agent.mjs mapUsage, openai-agent.mjs from turn.completed).
@@ -1570,7 +1575,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         //   modelMismatch — true/false when both sides name a family, null when either does not.
         // Written even on the rows where they are null, so "this engine cannot report" stays visibly
         // different from "this record predates the gauge".
-        modelActual, modelBasis, modelMismatch,
+        modelActual, modelBasis, modelSnapshot, modelMismatch,
         // W3 billing telemetry: which engine ran + the RESOLVED billing mode (subscription vs api-key). This
         // records INTENT (the mode the engine was configured to bill under), not independent billing evidence
         // — the actual proof is the provider console (claude's stream also reports apiKeySource; codex does
@@ -1696,7 +1701,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         stdoutTail: (fail && !json) ? streamDigest(turn.stdout) || undefined : undefined,
       });
       // AD-4 — `attempt` lands on run.jsonl too (ADDITIVE: _driver/<stage>.jsonl keeps the full per-attempt
-      // detail and 's harness keeps reading it there; run.jsonl gets the lean per-attempt spine it never
+      // detail and the harness keeps reading it there; run.jsonl gets the lean per-attempt spine it never
       // had — its readers previously saw one "stage" event with attempts:N and no causes, and the knockout
       // lane logs no stage events at all, so run.jsonl alone could not distinguish "no retries happened"
       // from "retries not recorded here"). Best-effort like every telemetry write.
@@ -1705,7 +1710,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           event: "attempt", stage: name, attempt, of: maxRetries + 1, ok: !fail, fail: fail ?? null,
           //: the spine carries the same pair as the per-stage log, or the two disagree about what
           // ran. `model` stays the requested resolution (its existing readers); `modelActual` is the wire.
-          model: modelRequested, modelActual, modelBasis, modelMismatch,
+          model: modelRequested, modelActual, modelBasis, modelSnapshot, modelMismatch,
           wrote, warm: warm || undefined, warmEscalated: attempt === warmEscalatedAt || undefined,
           rescued: rescued ?? undefined, killed: killed || undefined,
           quiescentMs: Number.isFinite(quiescentMs) ? Math.round(quiescentMs) : undefined,   // — see the per-stage row
@@ -1999,7 +2004,7 @@ export function correctiveMessage(baseMessage, attempt, lastFail, expectFile, {
   if (!maxTok && !/^(invalid_file|missing_file)/.test(inner)) return baseMessage;
   const files = (Array.isArray(expectFile) ? expectFile : [expectFile]).filter(Boolean);
   const names = files.map(rel).join(", ");
-  // DIRECTION (b) — THE COLD CORRECTIVE IS A REPAIR SURFACE, AND 's SWEEP STOPPED AT THE WARM ONE.
+  // DIRECTION (b) — THE COLD CORRECTIVE IS A REPAIR SURFACE, AND the SWEEP STOPPED AT THE WARM ONE.
   //
   // `warmPatchMessage` consults TOOL_WRITTEN_ARTIFACTS and turns a repair into a CALL. This composer did not,
   // so a converted seat that hit the output ceiling was told to "CALL THE WRITE TOOL" for an artifact whose
@@ -2373,7 +2378,7 @@ export function correctionHint(lastFail, { gridLedgerName = "common-law-grid.jso
     // — THE REPAIR RIDES THE TYPED TOOL, because the seat no longer holds Write or Edit. This used to
     // end "Correct it in place — the file is the stage's only output", which after the conversion orders an
     // act the grant denies: a failure on obedience, mid-round, on the first repair rung that fires. Same
-    // shape as 's ten anchor sites, caught before it shipped rather than after. The one-change
+    // shape as the ten anchor sites, caught before it shipped rather than after. The one-change
     // invariant covers a dictation AND the ladder that corrects it.
     hint = `the model is a set of VALUES you hand to the \`record_blind_frame\` tool: dominant_element, ` +
       `variants[] (each {value, direction (add|drop|phonetic|homophone|neighbour|composite), rationale}), ` +
@@ -2830,7 +2835,7 @@ export function correctionHint(lastFail, { gridLedgerName = "common-law-grid.jso
   return hint;
 }
 
-// ── 's DEFERRED-SLICE BLOCK IS GONE ──────────────────────────────────────────────────────
+// ── the DEFERRED-SLICE BLOCK IS GONE ──────────────────────────────────────────────────────
 //
 // `deferredSlicesRequiredRows` composed a prose block listing every deferred qid and told the stage each
 // one "must appear VERBATIM in a Coverage-ledger row". Its own doc block recorded why it had to ship
@@ -2945,7 +2950,7 @@ const MAX_FORM_REPAIRS = 2;
 // wrote the quote. R6's four byte-identical attempts were not evidence that warm cannot fix this; they
 // were evidence that the seat was told to fix something else. The token now names the state and the arm
 // names the remedy, so there is something to change. A warm turn that STILL returns byte-identical output
-// is 's subject, not this one, and is handled where byte-identical output is detected.
+// is the subject, not this one, and is handled where byte-identical output is detected.
 // connotation_* (the family, via CONNOTATION_FORM_TOKEN_SRC; 2026-08-01 ruling, carried through B's
 // typed transport): WHY THESE ARE SAFE TO WARM. Every member is emitted only over an obligation set
 // built from `recorded.filter(e => e.results.length)` — a violation is therefore PROOF the meaning sweep
@@ -3022,12 +3027,12 @@ const WARM_ELIGIBLE_RE = new RegExp(`^(missing_file|invalid_file:[^:]*:(use_chec
 // instead of a resume, on every timeout, as a side effect of an attribution fix. A rename must not
 // change what a failure costs.
 //
-// The issue notes that 's argument applies: "the retry ladder cannot help a deterministic tool
+// The issue notes that the argument applies: "the retry ladder cannot help a deterministic tool
 // timeout — this failure class is an argument for the same disclosed-deferral treatment when the ladder
 // is provably futile." That is a real question and it is NOT settled here. Two reasons to leave it:
 // this issue's OTHER half raised the bridge cap, so a retry is no longer provably futile — R5's four
 // attempts all died at a 300s cap that no longer applies; and turning a failure class into a disclosed
-// deferral is a doctrine change, which is 's to make and not an attribution fix's.
+// deferral is a doctrine change, which is the to make and not an attribution fix's.
 
 // — a rejected draft may be CARRIED across a recovery park only when its repair is a PATCH, not a
 // re-search. That is exactly the judgement WARM_ELIGIBLE_RE already encodes: the tokens meaning "the
@@ -3060,7 +3065,7 @@ export function warmEligible(fail, json) {
 // predicate the gate judges with). It is DELIBERATELY NOT a token list. The first cut keyed this veto on
 // TOTAL_DEFECT_TOKENS, a closed list of two form-path tokens — and when the typed transport armed, the
 // failure tokens moved out of the list and the veto silently stood down with every assertion still green
-// ('s hold). An enrolled-token veto is an ENUMERATED check: a future fifth token forgetting to
+// (the hold). An enrolled-token veto is an ENUMERATED check: a future fifth token forgetting to
 // enrol is the move-blindness this repo has counted seven instances of. The direct state keys the veto
 // on the condition it exists for, and nothing has to remember to join.
 //
@@ -3105,7 +3110,7 @@ export function vetoResumeRuledNone(attempt, state) {
 // validation)": framediff_* → frame-diff.json, coverage_* → register-coverage-ledger.json, findings_*
 // → findings.json, grid_* → the failing half's own ledger, named_band_* → <axis>-band.json.
 //
-// 's in-dispatch repair has to know that, because it decides whether a repair LANDED by looking at
+// That in-dispatch repair has to know that, because it decides whether a repair LANDED by looking at
 // a file's bytes — and looking at the expectFile after a sibling repair would read a compliant model's
 // correct answer as "wrote nothing". Rather than re-deriving the routing in the gateway (two copies of
 // one rule, drifting from the day they are written), the derivation is lifted here and BOTH callers use
@@ -3210,7 +3215,7 @@ export function warmPatchMessage(lastFail, expectFile, { supplementalLane = fals
   // rulings reach the driver's accumulator only through `record_dispositions`, so a warm patch that
   // ordered any file edit would aim the seat at an artifact it cannot affect — the two halves of one
   // message disagreeing about where the work lands, which is the exact defect class the token split and
-  // 's routing fixes each closed one layer up.
+  // That routing fixes each closed one layer up.
   if (CONNOTATION_FORM_TOKEN_RE.test(lastFail ?? "") && files.length) {
     // The ABSOLUTE spec path, derived from the failing member's own output by exactly the rule
     // gridLedgerNameFor states and for exactly the same reason: a warm patch carries no base prompt
@@ -3218,7 +3223,7 @@ export function warmPatchMessage(lastFail, expectFile, { supplementalLane = fals
     // name — and a half must be aimed at ITS spec, never the canonical one.
     const halfM = basename(String(files[0])).match(/^common-law-findings\.half-([a-z0-9]+)\.md$/);
     const specPath = driverDir(dirname(files[0]), halfM ? `grid-spec.half-${halfM[1]}.json` : "grid-spec.json");
-    // THE CLOSING SENTENCE IS PER STATE ('s lesson, kept): "record every outstanding row" is right
+    // THE CLOSING SENTENCE IS PER STATE (the lesson, kept): "record every outstanding row" is right
     // for a partial and WRONG for a quote defect, where every row is ruled and re-recording rulings is
     // work already done. A truncated call's close must forbid the one compliance a wrongly-accused seat
     // reaches for — re-deriving its rulings.
@@ -3250,7 +3255,7 @@ export function warmPatchMessage(lastFail, expectFile, { supplementalLane = fals
         : `Do not stop until the tool's answer reports nothing outstanding.`);
   }
   const sibling = repairSiblingName(lastFail, files);
-  // ── THE SIBLING BRANCH MUST NOT OUTRANK THE TOOL-WRITTEN ONE (, third conversion) ────────────
+  // ── THE SIBLING BRANCH MUST NOT OUTRANK THE TOOL-WRITTEN ONE (third conversion) ────────────
   //
   // This branch orders "Re-save the COMPLETE corrected JSON at <sibling>", which is a hand-write. For
   // frame-diff the sibling IS the tool-written artifact — `frame-diff.json`, with `frame-diff.md` as the
@@ -3312,7 +3317,7 @@ export function warmPatchMessage(lastFail, expectFile, { supplementalLane = fals
   // "the turn wrote nothing" — the driver writes the file, so an absent model means the TOOL WAS NEVER
   // CALLED. `blindframe_*` means the call arrived and its values failed the parser. One remedy: call it.
   //
-  // THE TOKEN-FAMILY LIST IS GONE (, third conversion), and its removal is the root-cause half. It
+  // THE TOKEN-FAMILY LIST IS GONE (third conversion), and its removal is the root-cause half. It
   // read `/blindframe_|skeptic_/`, which is a second authoring of "which stages are converted" — one that
   // this conversion would have had to extend with `framediff_`, and the next one with its own prefix,
   // each time by somebody remembering. The right question is not which token fired but whether the

package/driver/grounds-grammar.mjs

@@ -13,7 +13,7 @@
 //     "Wikipedia article documenting 1871 race riot, negative historical violence event"
 //
 // Both are true. Neither says what could not be established. A charged judgment recorded without its
-// grounds is the same shape as 's `step-silent`: the ledger has a label for the decision and
+// grounds is the same shape as the `step-silent`: the ledger has a label for the decision and
 // cannot say why for any single one, so a reader cannot tell "correctly judged" from "silently
 // asserted" — which are opposite repairs.
 //

package/driver/hit-list.mjs

@@ -25,7 +25,7 @@
 // The line drops `_query`/`_queries`/`screen` — 61% of a band row's bytes — and keeps the qid alone,
 // because the completeness witness needs the join and nothing dismisses a record on its provenance.
 
-import { countOrNull } from "./named-band.mjs";   // tracker issue 95 — one copy of "a count I could not take is null, not zero"
+import { countOrNull } from "./named-band.mjs";   // one copy of "a count I could not take is null, not zero"
 
 /**
  * THE FATES. A line ends with exactly one, and the set is closed so completeness is verifiable by