clearotron 0.2.1 → 0.2.2

package/driver/placement-diff.mjs

@@ -1,10 +1,10 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
-// placement-diff.mjs —: compare two runs' placement tiers, so 's repeat runs can be scored.
+// placement-diff.mjs —: compare two runs' placement tiers, so the repeat runs can be scored.
 //
 // ── why this exists ──────────────────────────────────────────────────────────────────────────────────
 //
-// 's offline half is answered: the band-shape seam moves its input, so the branch is taken and the
+// That offline half is answered: the band-shape seam moves its input, so the branch is taken and the
 // noise floor needs repeat PAID arms on one matter. Those runs are the E2E agent's. When they land there
 // is nothing to compare them with — `placement-carry.mjs` joins placements to the digest surfaces WITHIN
 // one run, and nothing in the tree diffs two `placements.json`.

package/driver/placement-form.mjs

@@ -13,12 +13,12 @@
 // fails `placementmodel_missing` while the structured sibling `placements.json` is absent — and the seat
 // wrote the prose first (on disk that run: md at 09:08:58, json at 09:15:50, by attempt 2). The kill
 // landed in the gap between the two files, so 31 minutes of finished work were discarded and re-derived
-// from scratch. Raising the wall (, `638f885`) made that less likely; it did not make finished work
+// from scratch. Raising the wall (`638f885`) made that less likely; it did not make finished work
 // survivable, and this does.
 //
 // THE CURE IS AUTHORSHIP, NOT A GUARD. The seat stops writing `placements.json`. The driver renders it
 // from a FORM the seat fills, and an accumulator holds every answer across attempts, parks and process
-// restarts — exactly as 's disposition union and 's coverage union already do for their seats.
+// restarts — exactly as the disposition union and the coverage union already do for their seats.
 // A killed attempt then keeps every tier it had already placed.
 //
 // THE ROW SOURCE IS SELECTION-BY-REFERENCE, and it was settled by measurement, not by design taste. The
@@ -127,7 +127,7 @@ export function formRowKey(row) {
  *
  * DRIVER FACTS COME FROM `canonical`, never from the submitted row. A seat that rewrote `records` or
  * `owner` on its copy cannot widen what binds; only its three judgment fields are read from `row`.
- * That is 's discipline and it is the reason the union cannot be talked into anything.
+ * That is the discipline and it is the reason the union cannot be talked into anything.
  * PURE; never throws.
  */
 export function rowIsSettled(row, canonical) {
@@ -235,7 +235,7 @@ export function buildSelectionIndex({ floors = null, positions = null } = {}) {
       floor_records: floorList.length,
       positions: posList.length,
       selectable_records: byUri.size,
-      // An ABSENCE is recorded in the artifact rather than swallowed — 's rule. "no floors" and "the
+      // An ABSENCE is recorded in the artifact rather than swallowed — the rule. "no floors" and "the
       // band shape would not parse" are different facts and must not read alike.
       floors_unreadable: floors === null,
       positions_unreadable: positions === null,

package/driver/placement-union.mjs

@@ -102,7 +102,7 @@ export function unionPlacementForm(prior, submitted, input) {
   const consumed = new WeakSet();
   // RETRACTION IS EXPLICIT, and it is the only way a row leaves this form.
   //
-  // 's seat rows were retracted by SILENCE — a submission that spoke owned them — and that was right
+  // That seat rows were retracted by SILENCE — a submission that spoke owned them — and that was right
   // there, because that seat rewrote its whole form every pass. This one does not: it writes DELTAS, so a
   // corrective attempt that re-tiers two register rows says nothing about the run's common-law
   // candidates, and silence-retraction would delete every one of them without a word. The 2026-08-09

package/driver/portal-acks.mjs

@@ -6,7 +6,7 @@
 // On the test instance they are the dominant content — a wall of dead runs crowding out the work
 // actually running, which is the one thing that section exists to show.
 //
-// WHAT THIS IS NOT. It is not a state change on the run, not a delete, and NOT 's retire. Retiring
+// WHAT THIS IS NOT. It is not a state change on the run, not a delete, and NOT the retire. Retiring
 // writes `archive-tags.json`, which is pool-wide: it hides a run from everyone, including the brand
 // owner. Dashboard clutter is one person's annoyance, so it gets one person's store. Giving both to one
 // control would mean a staff member tidying their own dashboard silently hiding a client's run.

package/driver/portal-config-view.mjs

@@ -162,7 +162,7 @@ const FRONTED_MODES = new Set(["auth-proxy"]);
 /**
  * The auth row — the one row on this page that is NOT snapshot-derived, and deliberately so.
  *
- * WHY THIS BREAKS THE PAGE'S OWN RULE ON PURPOSE (, ruled 2026-08-21). Every other row here comes
+ * WHY THIS BREAKS THE PAGE'S OWN RULE ON PURPOSE (ruled 2026-08-21). Every other row here comes
  * from a snapshot because the portal cannot see the engine's environment. `PORTAL_AUTH_MODE` is the
  * opposite case: the PORTAL reads it (portal-service.mjs) and acts on it, so the portal is the
  * authoritative source for its own door. Routing it through flag-snapshot.mjs would publish another
@@ -336,7 +336,7 @@ export function accessView({ grants, staffDomains = [], knownAccounts = [], gran
  * because a log is unbounded by nature and this runs inside a web request.
  */
 /**
- * 's outcome rows — the events that record a request being TURNED AWAY rather than done. Kept
+ * That outcome rows — the events that record a request being TURNED AWAY rather than done. Kept
  * beside the reader rather than in portal-service.mjs so this file has no import cycle with the
  * service that writes them; the names are the contract between the two and are asserted in the test.
  */

package/driver/portal-local-auth.mjs

@@ -137,7 +137,7 @@ export function readLocalCredential(path) {
  */
 export function credentialPathFor(env = process.env, home = null) {
   // `homedir()` is resolved ON THE RETURN LINE, not as a signature default, and that is deliberate:
-  // 's arm finds the single line naming the credential's env override and asserts the fallback
+  // That arm finds the single line naming the credential's env override and asserts the fallback
   // derives from homedir() rather than a literal path. A one-line decision gets a one-line check, and
   // a signature default would put the fact where that check cannot see it. `home` stays injectable.
   //

package/driver/portal-report.mjs

@@ -388,7 +388,7 @@ function dropConnectorToken(html) {
 //
 // That is not a subtle degradation. chrome.css is 35KB of shared typography and layout, and among the
 // rules that went missing was `.lk-flag{width:10px;height:10px}` — sizing a lockup element that has
-// since been retired ( applied 's ruling to this lockup too), an SVG with no intrinsic size
+// since been retired ( applied the ruling to this lockup too), an SVG with no intrinsic size
 // falling back to the browser default for a replaced element and painting at 300x150. The reported
 // symptoms — "a huge flag at the bottom", "font sizings inconsistent, multiple font types" — were one
 // cause: this file did not load. The example is historical; the failure mode is not, and any sizing
@@ -463,7 +463,7 @@ html{scrollbar-gutter:stable}
 // three functions the document already exposes to its own buttons. `openAll`/`pickAll` take a boolean and
 // nothing else; `exportPDF` takes no argument at all.
 const FEEDBACK_CSS = `
-/* tracker issue 260 — the per-finding flag. Injected here rather than in render.mjs, which is frozen and produces
+/* the per-finding flag. Injected here rather than in render.mjs, which is frozen and produces
    every report ever delivered: putting the control at SERVE time means it reaches reports baked long
    before feedback existed, and the document on disk stays exactly what was delivered. */
 .pf-bar{display:flex;align-items:center;gap:8px;flex-wrap:wrap;margin-top:10px;padding-top:9px;border-top:1px solid var(--line,#e5ded4)}
@@ -590,7 +590,7 @@ const EMBED_JS = `
   // <body>), so by the time it runs for an '#c<ordinal>' link the ancestors are already open and the
   // measured offset is the revealed position. preventDefault stops the frame's dead-end fragment
   // navigation for the links the document's handler does not claim (#common-law, #only-you).
-  // tracker issue 735 — AND WHEN THERE IS NO PARENT, DO NOT CANCEL THE CLICK.
+  // AND WHEN THERE IS NO PARENT, DO NOT CANCEL THE CLICK.
   //
   // Everything above is right INSIDE the portal's Result screen. Un-framed it is a dead link: parent is
   // window, the message is posted to this same document, and the only 'message' listener here requires
@@ -638,7 +638,7 @@ const FEEDBACK_JS = `
 (function(){
   var TAG='cordillera-report';
   function schedule(){ try{ parent.postMessage({source:TAG,type:'height',height:document.body.scrollHeight+16},'*'); }catch(e){} }
-  // tracker issue 260 — PER-FINDING FEEDBACK, and why it posts outward instead of fetching.
+  // PER-FINDING FEEDBACK, and why it posts outward instead of fetching.
   //
   // This frame has NO allow-same-origin (Result.tsx), so its origin is "null": it holds no portal
   // session, a credentials:'include' fetch sends nothing, and a request from here arrives unauthenticated.
@@ -650,11 +650,11 @@ const FEEDBACK_JS = `
   // service reads those from the run's own artifacts, so nothing typed inside this frame can decide
   // which finding a flag lands on or whose matter it is labelled with.
   //
-  // tracker issue 487 — THE POSITION IS TWO NUMBERS ON THE KNOCKOUT LANE, and it used to be none.
+  // THE POSITION IS TWO NUMBERS ON THE KNOCKOUT LANE, and it used to be none.
   //
   // The clearance report numbers its findings once across the document and hangs each on a
   // div.card with id "c<ordinal>". The knockout report has neither: its conflicts render as div.ko-find,
-  // and tracker issue 471 restarts ordinals at 1 FOR EACH MARK. So this selector matched nothing on a knockout report
+  // and the knockout report restarts ordinals at 1 FOR EACH MARK. So this selector matched nothing on a knockout report
   // and the control was never drawn — the channel was not merely resolving wrong, it was absent. A
   // reader could not flag a knockout finding at all.
   //

package/driver/portal-service.mjs

@@ -102,7 +102,7 @@ import { batchMarkName } from "./mark-name.mjs";
 import { DEFAULT_CLIENT_DAILY_RUNS, accountUsage } from "./usage-ledger.mjs";
 import { productIdentity } from "../shared/product-identity.mjs";   // AGPL §13 — one answer, three surfaces
 import { engineCommit } from "./engine-build.mjs";                  // — the SAME stamp pool meta records
-// — siblings, on their own line: 's guard pins the line above and its subject is the JOIN
+// — siblings, on their own line: the guard pins the line above and its subject is the JOIN
 // (this endpoint and pool meta stamp the same function), not the import list. Kept separate so that
 // pin keeps reading the shape it was written against.
 import { engineCommitDate, engineProvenance } from "./engine-build.mjs";
@@ -948,7 +948,7 @@ const DENIAL_REASON = Object.freeze({
  *
  * The capture path it gates is intact: `feedback-store.mjs`, `feedback-issues.mjs`, `feedback-mint.mjs`,
  * `scripts/feedback-mint.mjs` and their suites are untouched and still green. Re-enabling is this
- * constant, the `feedback: true` argument at the serve call site, and reverting 's portal-ui half.
+ * constant, the `feedback: true` argument at the serve call site, and reverting the portal-ui half.
  */
 const FEEDBACK_CAPTURE = false;
 
@@ -968,7 +968,7 @@ const NON_MUTATING_POSTS = Object.freeze(["/portal/api/compose/read", "/portal/a
 /**
  * Does a refusal on this route owe the audit log a line?
  *
- * ── WIDENS 's ANSWER, and the reason is on that issue ─────────────────
+ * ── WIDENS the ANSWER, and the reason is on that issue ─────────────────
  *
  * scoped this to `/portal/admin/*` plus the one named client write, on the reasoning that the
  * other write routes "already file a richer row" of their own. Measured, that is true of their
@@ -980,9 +980,9 @@ const NON_MUTATING_POSTS = Object.freeze(["/portal/api/compose/read", "/portal/a
  *
  * So the rule is now the PREFIX, not a list: a POST under `/portal/api` or `/portal/admin` is a write
  * unless it is named above. A route added later is covered without anybody remembering to add it,
- * which is the half of 's shape that kept failing.
+ * which is the half of the shape that kept failing.
  *
- * STILL REFUSALS ONLY, and 's cost argument is why that half is unchanged: `/portal/admin/observed`
+ * STILL REFUSALS ONLY, and the cost argument is why that half is unchanged: `/portal/admin/observed`
  * reads this log back through a fixed 256 KiB tail, so every row a success files is span that panel can
  * no longer see. The routes that file a rich success row keep filing it and nothing duplicates it.
  *
@@ -1077,7 +1077,7 @@ export function makePortalService({
   // — IS THE PER-FINDING FLAG CAPTURE ON? It is not, and `FEEDBACK_CAPTURE` is why (see above).
   //
   // A SEAM SO THE RETAINED PATH STAYS TESTED, which is the whole difference between disabled and
-  // rotting. The resolver below carries 's two-lane shape and 's disposition read; the owner
+  // rotting. The resolver below carries the two-lane shape and the disposition read; the owner
   // ruled disable rather than delete, and code nothing can execute is code nobody can prove still works.
   // The eleven route tests in portal-service.test.mjs pass `feedbackCapture: true` and keep exercising it.
   //
@@ -1158,7 +1158,7 @@ export function makePortalService({
         // ── — COVERAGE RIDES BESIDE AVAILABILITY, NOT INSIDE IT ───────────
         //
         // The owner, on his own install with a partial register: "i cannot press the button for Global
-        // prelim search. Why. it doesnt appear disabled, no message etc — but i cant select it." The
+        // clearotron search. Why. it doesnt appear disabled, no message etc — but i cant select it." The
         // product is orderable now (owner ruling on that issue), and what the register does not reach
         // is a SENTENCE on a live row rather than the reason a dead one cannot be pressed.
         //
@@ -1391,7 +1391,7 @@ export function makePortalService({
           controls: { stop: { available: stopControl.available !== false,
             reason: principal.role === "staff" ? (stopControl.reason ?? null) : null } } } };
       }
-      // /portal/api/about — the AGPL §13 source offer (,)
+      // /portal/api/about — the AGPL §13 source offer ()
       //
       // UNAUTHENTICATED, DELIBERATELY, and it is the only route here that is. §13 obliges an operator
       // running a modified version to offer the source to the users interacting with it — the offer is
@@ -2500,7 +2500,7 @@ export function makePortalService({
         // row, and a retired-endpoint row is a different fact from a not-yours row. If an old open tab is
         // still clicking Flag, that is a thing worth being able to count.
         //
-        // WHAT IS DELIBERATELY STILL BELOW THIS LINE: the whole resolver — 's two-lane shape, 's
+        // WHAT IS DELIBERATELY STILL BELOW THIS LINE: the whole resolver — the two-lane shape, 's
         // disposition read, the server-side-locator rule. The owner ruled "disable services and any code",
         // and the acceptance criterion says re-enabling must be a switch and not a rebuild. Deleting 130
         // lines of hard-won doctrine would have made it a rebuild.
@@ -2568,7 +2568,7 @@ export function makePortalService({
         //
         // JOINED ON ORDINAL **AND** MARK, and it resolves NOTHING on a mismatch. report-data projects the
         // same parsed findings array publish read from that same findings.json, so the ordinals are one
-        // set — but a wrong disposition on a lawyer's flag is worse than no disposition ('s ruling on
+        // set — but a wrong disposition on a lawyer's flag is worse than no disposition (the ruling on
         // the batch lane, applied here), so the mark is checked rather than assumed.
         //
         // CLEARANCE ONLY, on purpose. publish/knockout.mjs emits no disposition, so `found?.disposition`
@@ -2655,7 +2655,7 @@ export function makePortalService({
         // report every switch as off on a box where they are on — and this page, of all pages, would be
         // believed.
         if (parts[2] === "config" && method === "GET") {
-          // THE AUTH ROW IS READ LIVE, HERE, and not from the snapshot (, ruled 2026-08-21).
+          // THE AUTH ROW IS READ LIVE, HERE, and not from the snapshot (ruled 2026-08-21).
           // Everything else on this page is RENDERED from the snapshot. The reason recorded here used
           // to be "because this process has no engine environment", and that has not been true since
           // the owner's 2026-08-26 one-configuration-per-server-box ruling gave every unit the same
@@ -3212,7 +3212,7 @@ const escHtml = (t) => String(t).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<"
 // mentioned. A colour literal reappearing in this function is what
 // `driver/test/door-pages-take-their-colours-from-brand.test.mjs` fails on.
 //
-// The dark ground moved with that change: the block this page used to carry had guessed tracker issue 17150f/#ece5d8,
+// The dark ground moved with that change: the block this page used to carry had guessed #17150f/#ece5d8,
 // and brand pack §01 fixes dark at #0f0e0c near-black + #f0e8d8 parchment. The pack wins.
 export function loginPage({ email, error = null, signedIn = false }) {
   const title = signedIn ? "Signed in" : "Sign in";
@@ -3408,7 +3408,7 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
     // PATHNAME ONLY. `req.url` carries the query string and this row must not; parsed defensively
     // because the outer catch can run before `url` was successfully built.
     const pathOnly = (u) => { try { return new URL(String(u ?? ""), "http://localhost").pathname; } catch { return ""; } };
-    // SAME SCOPE AS THE ROUTER'S ('s Out of scope). Without this the door files a row for every
+    // SAME SCOPE AS THE ROUTER'S (the Out of scope). Without this the door files a row for every
     // 302 to the login page and every rate-limited poll of /portal/api/runs — which is per-request
     // access logging arriving through the other entrance, and the first cut of this change did exactly
     // that. Computed once so a redirect and a 500 on the same request cannot disagree about it.
@@ -3669,7 +3669,7 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
         // THE ROW THE ISSUE WAS FILED ABOUT. Both doors throw this shape — the Cloudflare edge's verify
         // and the local sign-in's LocalAuthError — so one line here covers a refused write on either
         // deployment. Before the Accept split below, because a refusal is one event however it renders.
-        // A FIXED VOCABULARY, NEVER `e.message` ('s third criterion: "a refusal must not become a
+        // A FIXED VOCABULARY, NEVER `e.message` (the third criterion: "a refusal must not become a
         // new disclosure surface"). This message comes out of `verify()` — the Cloudflare edge's JWT
         // check, a third-party library on some deployments — and nothing constrains what it puts in
         // there: a claim value, a subject, a fragment of the token it just rejected. The row is read
@@ -3929,7 +3929,7 @@ const PORT = PORT_CHOICE.port;
   // is what an operator reads, never mentioned the file existed.
   //
   // So triage of "I clicked Retire and it errored" looked at 17 lines of startup banner and concluded
-  // the request never arrived. 's own triage recorded that same absence as its central lead and
+  // the request never arrived. its own triage recorded that same absence as its central lead and
   // called it "the first thing to explain" — there was nothing to explain, and a second investigation
   // spent itself on the same non-signal.
   //

package/driver/predelivery-lint.mjs

@@ -23,8 +23,8 @@
 // report-derived cover text alone, because a gate that simply stops running is not a gate that passes.
 
 import { REGION_NAMES } from "./publish/regions.mjs";
-import { canonicalJurisdictionCode } from "./jurisdiction-codes.mjs";   // tracker issue 134 — one spelling of a territory code
-import { searchedCovers } from "./frame-diff-model.mjs";                // tracker issue 134 — one copy of the EU-reach rule
+import { canonicalJurisdictionCode } from "./jurisdiction-codes.mjs";   // one spelling of a territory code
+import { searchedCovers } from "./frame-diff-model.mjs";                // one copy of the EU-reach rule
 import { partyFactSources, partyFactViolations, partyFactMessage, canJudgePartyFacts } from "./party-facts.mjs";   //
 import { writeUpViolations, writeUpMessage } from "./narrative-write-ups.mjs";   //
 
@@ -72,7 +72,7 @@ const REF_ALLOWLIST = new Set([
 // ── — A TERRITORY IS NOT A PARTY, AND A MARK IS NOT A PARTY ────────────────────────────────────
 // Two production clearances flagged six "parties the action list names that no finding identifies".
 // FOUR were not parties: "European Union", "United Kingdom", "United Arab Emirates" and a mark. The
-// check then emitted that into the report, which is 's other half.
+// check then emitted that into the report, which is the other half.
 //
 // Territory names come from `publish/regions.mjs` — the ONE naming source every render surface already
 // uses — rather than from the run's own jurisdiction list. Broader, and deliberately: a bare country
@@ -1547,7 +1547,7 @@ export function markAssessmentChecks({ markAssessment, expected }) {
 }
 
 /**
- * The DECLARED CONTRACT VERSION (, moved out of contentModelChecks by).
+ * The DECLARED CONTRACT VERSION (moved out of contentModelChecks by).
  *
  * It used to live inside contentModelChecks, whose first line is `if (!expected) return []`, where
  * `expected` is derived as `schema_version >= 5`. So the one check written to report a down-level
@@ -2237,7 +2237,7 @@ export function runLint({ depth, commonLawGrid, matterContext, clientPartyName,
       checks.push(...ownerScreenNegativeChecks({ text: clientSummaryMd, ownerScreen, markVocab, surface: "client-summary" }));
     }
   }
-  // tracker issue 134 — the delivered prose's coverage claims against what the run actually searched.
+  // the delivered prose's coverage claims against what the run actually searched.
   // Top-level, NOT inside the owner-screen guard above: a coverage claim has nothing to do with whether
   // this run has an owner screen, and nesting it there would have silently switched the check off for
   // every run without one. Both prose surfaces: the narrative is where the issue measured the
@@ -2305,7 +2305,7 @@ export function runLint({ depth, commonLawGrid, matterContext, clientPartyName,
 // The knockout (Stage 0/0.5) lane wrote NO predelivery-lint.json at all, by a decision recorded in
 // docs/DELIVERY.md (2026-07-28). That decision rested on two premises this tranche has since moved:
 // the lint artifact is now the WORKBOOK's QC record (/), so a lane that writes none produces an
-// EMPTY QC record rather than a deliberately-absent one; and 's A10 projects recorded defects onto
+// EMPTY QC record rather than a deliberately-absent one; and the A10 projects recorded defects onto
 // the cover note that reaches the reviewing lawyer, so a knockout defect reached nobody. What has NOT
 // moved is the other half of the memo: this lane's deliverable is store-rendered, and most clearance
 // checks read surfaces it does not produce. So the extension is a SUBSET, derived from what the lane
@@ -2454,6 +2454,13 @@ export function flagLines(failures) {
 // vendor vocabulary, no ids, no paths, no field names, no instructions to whoever regenerates the run,
 // never "certified"/"signed". deliveryVocabViolations() below enforces that mechanically.
 const DELIVERY_LINES = {
+  // Keyed on the FULL check id, which deliveryFlagLines resolves before the base — see the note there.
+  // The sentence states the CONSEQUENCE, in the receipt's own terms: not "a check failed" but "the rule
+  // was applied to nothing". Eleven graded runs delivered carrying this, two of them orderable product
+  // demos, and the only place it was written was one row of a fifty-odd-row receipt nobody routes.
+  "narrative-write-ups:could-not-read":
+    "The depth rules for the written-up findings were applied to nothing on this run — the narrative "
+    + "carries no block this check can read, so neither the ranking cut nor the length cap was verified.",
   // template — the summary table against the names actually searched
   "names-cell-populated": "The summary table does not name the mark that was searched.",
   "assessment-row": "A searched name has no assessment of its own in the summary table.",
@@ -2555,15 +2562,26 @@ export function deliveryVocabViolations(line) {
 export function deliveryFlagLines(failures) {
   const groups = new Map();
   for (const f of failures ?? []) {
-    const base = String(f?.id ?? "").split(":")[0];
+    const id = String(f?.id ?? "");
+    const base = id.split(":")[0];
     const family = String(f?.family ?? "");
-    const key = base || `family/${family}`;
-    const g = groups.get(key) ?? { base, family, n: 0 };
+    // A CHECK WHOSE DISTINCTION LIVES IN ITS SUFFIX COULD NOT BE SAID HERE (tracker issue 267).
+    //
+    // Grouping on `base` alone is right for the common case — a word-cap violation on nine write-ups is
+    // one delivery line, not nine. But it also collapsed `narrative-write-ups:could-not-read` into the
+    // same bucket as an ordinary depth violation, and those are different facts: one says a rule was
+    // broken, the other says the rule was ENFORCED ON NOTHING. The second had no sentence of its own to
+    // reach, so it degraded to the generic "a machine check did not pass" and became invisible.
+    //
+    // So: an entry keyed on the FULL id wins where one exists, and everything else groups by base
+    // exactly as before. This adds no line to any run that did not already produce one.
+    const key = DELIVERY_LINES[id] ? id : (base || `family/${family}`);
+    const g = groups.get(key) ?? { base, family, id: DELIVERY_LINES[id] ? id : null, n: 0 };
     g.n += 1;
     groups.set(key, g);
   }
   return [...groups.values()].map((g) => {
-    const sentence = DELIVERY_LINES[g.base] ?? DELIVERY_FAMILY_LINES[g.family] ?? DELIVERY_GENERIC;
+    const sentence = (g.id && DELIVERY_LINES[g.id]) ?? DELIVERY_LINES[g.base] ?? DELIVERY_FAMILY_LINES[g.family] ?? DELIVERY_GENERIC;
     // Belt and braces: a table entry that trips the house rules degrades to the generic instead of
     // shipping. This is what makes "no engine vocabulary reaches a reader" structural rather than a
     // matter of everyone remembering the rule when they add a check.

package/driver/prelim-variants-record.mjs

@@ -55,7 +55,7 @@ export function prelimVariantsCallPaths(runDir) {
 // The first cut of this file declared its own copy of the layer vocabulary — field, jurisdiction,
 // variant, source — under a comment saying "taken from the shipped parser, never re-chosen here", while
 // re-choosing it: the shipped parser orders the same four as variant, field, source, jurisdiction. The
-// comment asserted the exact property it broke, which is why a reader could not catch it and 's scan
+// comment asserted the exact property it broke, which is why a reader could not catch it and the scan
 // could. That check binds every parsed declaration of a closed set to the live import, found two
 // declarations of one name, and reported the disagreement.
 //
@@ -112,7 +112,7 @@ export function renderPrelimVariants(model, scopeRows) {
   //
   // `variantsManifestAudit` (common-law-receipts.mjs) arms a term collector on any heading matching
   // /variants\b/i and closes it on the next heading AT THE SAME DEPTH OR SHALLOWER. Deeper headings are
-  // sub-groups INSIDE the section and deliberately keep it armed — that is 's fix, for a real
+  // sub-groups INSIDE the section and deliberately keep it armed — that is the fix, for a real
   // manifest whose 84 variants sat under seven `####` sub-headings and parsed as zero.
   //
   // So a `## Variants` section followed by a `### Scope ledger` NEVER CLOSES, and every ledger row is

package/driver/profile-page.html

@@ -256,7 +256,7 @@ function collect() {
   // writes ABSENCE and never `false` (tracker issue 1991). It was a checkbox, which rendered absent and
   // `false` identically and wrote a boolean on every save — so a customer who had given no instruction
   // was recorded as "strip the line" the first time anybody pressed Save on an unrelated field, and
-  // their next report shipped with no confidentiality line. That is tracker issue 761's incident on this door.
+  // their next report shipped with no confidentiality line. That is the incident this door has already had.
   // `true` is retired and renders as the default (shared/brand.mjs confPosture), so it folds to the same
   // option and saves as absence rather than storing a distinction the output can no longer carry.
   if ($("f_priv").value === "no") delivery.privileged = false; else delete delivery.privileged;

package/driver/profile-selection.mjs

@@ -2,7 +2,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // profile-selection.mjs — which findings the refutation seat is asked to profile, chosen by the DRIVER.
 //
-// 's architecture: "prefer driver selection wherever the key precedes the dispatch." The band is
+// That architecture: "prefer driver selection wherever the key precedes the dispatch." The band is
 // on findings.json before narrative-refutation is dispatched, so there is nothing for a directive to
 // ask the seat to judge — the driver lists the ordinals and unlisted work is never requested.
 //

package/driver/profile-service.mjs

@@ -441,7 +441,7 @@ export function makeProfileService({
       // The transition is encoded in the message so the config store's git log reads as an audit trail —
       // the same three words saved searches emit (an un-archive reads as "update" there too).
       const transition = exists ? (overlayBody.archived && !priorOverlay?.archived ? "archive" : "update") : "create";
-      const message = `chore(prelim): ${transition} project ${customer}/${project} (via config UI, by ${by})`;
+      const message = `chore(clearotron): ${transition} project ${customer}/${project} (via config UI, by ${by})`;
       // — the row rides IN the commit, so it no longer names a sha. shared/store-in-repo.mjs says why.
       const { commit, commitError } = commitWithAuditRow({ audit, gitCommit, files, message, by,
         row: { event: exists ? "project-update" : "project-create", key: fq, by, fields: Object.keys(overlayBody),
@@ -494,7 +494,7 @@ export function makeProfileService({
     // fault) threw out of the handler, so the user was told "Nothing was written. Try again shortly."
     // about a profile that was already governing production, and the audit() call below was skipped —
     // leaving no record of who changed it. Same guard the project branch above already carries.
-    const message = `chore(prelim): ${exists ? "update" : "create"} customer profile ${key} (via config UI, by ${by})`;
+    const message = `chore(clearotron): ${exists ? "update" : "create"} customer profile ${key} (via config UI, by ${by})`;
     // — the row rides IN the commit, so it no longer names a sha. shared/store-in-repo.mjs says why.
     const { commit, commitError } = commitWithAuditRow({ audit, gitCommit, files, message, by,
       row: { event: exists ? "profile-update" : "profile-create", key, by, fields: Object.keys(effective) } });

package/driver/profiles.mjs

@@ -882,7 +882,7 @@ export function resolveEffectiveProfile(job, { profiles = loadProfiles(), projec
   //
   // Attached here rather than threaded through four call sites because this is the one place that KNOWS
   // — every caller that resolves a profile now carries its provenance whether or not it thought to ask,
-  // and 's hand-bridge at the §B2 door (`{...profile, origins }`) becomes a no-op rather than the
+  // and the hand-bridge at the §B2 door (`{...profile, origins }`) becomes a no-op rather than the
   // only correct call site. The sibling stays in the return for the callers that read it directly.
   return { profile: { ...profile, origins }, projectKey: overlay.projectKey, projectName: overlay.projectName, origins };
 }

package/driver/progress.mjs

@@ -8,7 +8,7 @@
 //   1. <runDir>/status.json        — the machine-readable per-run truth (travels into the archive on
 //                                     success, since the run-dir is renamed there).
 //   2. <studioRoot>/STATUS.md       — a human-readable rollup of recent runs, newest-first, the ONE file
-//                                     the prelim-status skill reads to answer "where is it at?".
+//                                     the clearotron-status skill reads to answer "where is it at?".
 //
 // Both writes are atomic (temp + rename) and idempotent — status is DERIVED from the current run, never
 // blindly incremented — so the resumable pipeline can re-drive a run without corrupting either file.
@@ -440,15 +440,15 @@ export function lineFor(s) {
   // 2026-07-04 incident: STATUS.md showed marble-spire as plain "delivered" and VENZY as plain
   // "FAILED" while BOTH still had their email/WhatsApp queued (sendPending) behind a wedged outbox
   // lane — so the heartbeat completion-watch read the rollup, saw nothing pending, and stood down.
-  // The rollup now carries the send state loudly; prelim-deliver flips sendPending:false on send.
-  const pending = s.sendPending === true ? " — 📮 SEND PENDING (email/WhatsApp NOT yet out — run prelim-deliver)" : "";
+  // The rollup now carries the send state loudly; clearotron-deliver flips sendPending:false on send.
+  const pending = s.sendPending === true ? " — 📮 SEND PENDING (email/WhatsApp NOT yet out — run clearotron-deliver)" : "";
   if (s.state === "delivered") {
     const v = s.verdict ? ` (${s.verdict})` : "";
     return `- ${head} — delivered${v}${s.url ? ` — ${s.url}` : ""}${pending}`;
   }
   if (s.state === "failed") {
     const at = s.failedStage ?? s.lastStage ?? stepTxt;
-    return `- ${head} — ⚠️ FAILED at ${at}${s.reason ? ` — ${trunc(s.reason)}` : ""}${pending ? " — 📮 FAILURE NOTICE PENDING (run prelim-deliver)" : ""}`;
+    return `- ${head} — ⚠️ FAILED at ${at}${s.reason ? ` — ${trunc(s.reason)}` : ""}${pending ? " — 📮 FAILURE NOTICE PENDING (run clearotron-deliver)" : ""}`;
   }
   if (s.state === "recovering") {
     // 2026-07-04 production doctrine: a recoverable failure AUTO-RESUMES — the report is still owed.
@@ -513,8 +513,8 @@ export function rollupStatus(studioRoot) {
       .sort((a, b) => String(b.updatedAt ?? "").localeCompare(String(a.updatedAt ?? "")))
       .slice(0, MAX_RUNS);
     const agent = agentFromStudioRoot(studioRoot);
-    const body = runs.length ? runs.map(lineFor).join("\n") : "_No prelim searches running or recently finished._";
-    const md = `# Prelim-search status — ${agent}\n_updated ${nowISO()}_\n\n${body}\n`;
+    const body = runs.length ? runs.map(lineFor).join("\n") : "_No clearotron searches running or recently finished._";
+    const md = `# Clearotron-search status — ${agent}\n_updated ${nowISO()}_\n\n${body}\n`;
     atomicWrite(join(studioRoot, "STATUS.md"), md);
   } catch { /* never throw */ }
 }

package/driver/provider-usage.mjs

@@ -48,7 +48,7 @@ export const KINDS = ["search", "record_fetch", "image", "phoneme", "batch_scree
 // The gateway namespaces the driver's --session-key as `agent:<agentId>:<key>` before it reaches the
 // plugin (confirmed on the first live run: sessionKey = `agent:clawdi:prelim-<slug>-<codename>-…`). Strip
 // that leading `agent:<id>:` namespace so the run prefix anchors at the real start of the caller's key —
-// otherwise a bare startsWith("prelim-…") matches nothing.
+// otherwise a bare startsWith("clearotron-…") matches nothing.
 function stripGatewayNs(s) {
   return typeof s === "string" ? s.replace(/^agent:[^:]+:/, "") : "";
 }

package/driver/publish/demo-marking.mjs

@@ -74,7 +74,7 @@ export function resolveDemoData({
 /**
  * The demonstration note for a MARKDOWN surface.
  *
- * 's acceptance 3 asks for the banner on "the grouped knockout page … the one a
+ * That acceptance 3 asks for the banner on "the grouped knockout page … the one a
  * reader opens first". THAT PAGE DOES NOT EXIST: `knockout.mjs` states in its own header that a
  * multi-mark run "writes no `report.html` AT ALL — the documents are `report-<slug>.html`, one per
  * mark", and that `report.md` "is the ONLY file that names every mark together". It is also written

package/driver/publish/index.mjs

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
-// Pure-code publish step for the prelim-driver: takes a finished run's two contract markdown files
+// Pure-code publish step for the clearotron-driver: takes a finished run's two contract markdown files
 // (report.md + audit.md, written by the report-synthesis / audit-emit stages) and renders + writes the
 // delivery artifacts into the pool (`config.poolRoot`, which since has NO default — unset refuses),
 // then regenerates the index.
@@ -702,7 +702,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   let findings = [], coverage = [], contextNotes = [], quarantined = [], findingsError = null, coverageJudgment = null, markAssessment = null, actionsRegister = null, askAnswers = null, correctionsDoc = null, fourAnswers = null;
   // — the DECLARED findings contract version, threaded to the renderer so the grouped
   // reasoned-negative section fires only on a v6 record. Stays null on the lenient/error paths: fail
-  // closed, an unknown version renders the pre- section.
+  // closed, an unknown version renders the pre-change section.
   let findingsSchemaVersion = null;
   // — THE STORES THIS PUBLISH DID NOT FIND. Declared in publish/publish-inputs.mjs, read through
   // its three-state helper, and recorded onto meta.clientGate below. Before this list existed an absent
@@ -981,7 +981,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   // `gateViolations` — those are LOGGED for observability but never a reason to drop the download. (An earlier
   // version made the gate fatal, so a legitimately-sparse run — e.g. no bound Class — silently lost its Excel.)
   // The run's REPORT IDENTITY, off the same registry row that chose its machinery. The FROZEN policy
-  // sidecar names WHICH level ran; the registry names what that level is called TODAY (, one
+  // sidecar names WHICH level ran; the registry names what that level is called TODAY (one
   // numbering system — reportIdentityFor is registry-first, sidecar label only for a level the registry
   // no longer knows). So a republished pre-renumber run renders under the current scale, deliberately.
   // A run with no sidecar (every run older than the level registry) yields undefined and renders
@@ -1189,7 +1189,10 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
 
   const total = skipRegen ? null : regenIndex(poolRoot);
   if (!skipRegen) await regenSurfaces(poolRoot);
-  const url = poolUrl ? `${String(poolUrl).replace(/\/$/, '')}/${runId}/report.html` : null;
+  // THE PORTAL ROUTE, not the pool's directory layout (tracker issue 289). This was
+  // `<origin>/<runId>/report.html` — where the documents sit on disk, which is not an application route.
+  // Composed rather than spelled here so the report link is built the same way the audit link always was.
+  const url = reportRouteFor(poolUrl, runId);
   return { runId, auditFile, counts, total, url, poolRunDir, auditError, findingsError, customerKey: customerKey || 'generic', clientGate };
 }
 
@@ -1241,7 +1244,21 @@ export function accessNoteHtml(font, domain = config.accessDomain) {
  * the edge's own legacy-report regexp character for character, so this function admits exactly the URLs the
  * deployment admits and no others.
  */
-const REPORT_PATH_RE = /^\/([A-Za-z0-9][A-Za-z0-9._-]{0,180})\/report\.html$/;
+// ── TWO SHAPES, AND THE SECOND ONE IS HISTORY (tracker issue 289) ────────────────────────────────────
+//
+// The block quoted above describes an edge rewrite that IS NOT IN FORCE ON PRODUCTION. Settled by the
+// account owner against the live deployment, signed in as a delivered run's own owner: the emailed link
+// returned the portal application's own `{"error":"not_found"}` — the app answered, so nothing rewrote
+// the path ahead of it — while the portal's own link for that same run opened. The prose above, and the
+// notes in portal-service.mjs and publish/knockout.mjs that lean on it, describe a config that does not
+// live in this repository and were transcribed when it was true somewhere. A transcription is a claim
+// about a host at the moment somebody wrote it down, not a fact about the host today.
+//
+// So reports are addressed at the portal route now (reportRouteFor), and this pattern keeps matching the
+// LEGACY shape as well for one reason: `auditUrlFor` derives the workbook link by parsing the report URL,
+// and an archived run re-published from its stored legacy URL must not silently lose its audit link. The
+// two alternatives are read in one place so a future reader cannot fix one and miss the other.
+const REPORT_PATH_RE = /^\/(?:portal\/report\/([A-Za-z0-9][A-Za-z0-9._-]{0,180})\/?|([A-Za-z0-9][A-Za-z0-9._-]{0,180})\/report\.html)$/;
 
 // The run id as the edge and the portal both spell it: one path segment, no separators, no traversal.
 // Same character class as REPORT_PATH_RE's capture and as portal-service's own slug gate, because a
@@ -1261,6 +1278,29 @@ export function auditRouteFor(origin, runId) {
   return `${String(origin).replace(/\/$/, '')}/portal/report/${runId}/audit.xlsx`;
 }
 
+/**
+ * THE REPORT'S ROUTE, from an origin and a run id (tracker issue 289).
+ *
+ * The delivered link used to be the pool's directory layout pasted behind the public origin —
+ * `<origin>/<runId>/report.html` — which is where the documents sit on disk and is not an application
+ * route. It resolved only where an edge rewrite happened to claim it, and on production no such rewrite
+ * is in force: the emailed link returned the portal's own `{"error":"not_found"}` for the run's OWN
+ * owner. Every delivered report on both lanes carried it, on all three surfaces that quote the URL.
+ *
+ * Composed here, beside auditRouteFor and markReportRouteFor, so the three links a delivery carries are
+ * built by three functions with one idea of where the portal lives. That is the property worth having:
+ * the audit link has been correct throughout precisely because it was composed against the route instead
+ * of derived from the file layout, and this makes the report link the same kind of thing.
+ *
+ * A link the portal will refuse is worse than none, so an unconfigured origin or a run id that is not a
+ * single clean path segment yields null — the same posture auditRouteFor takes, and the caller already
+ * treats null as "no link on any surface".
+ */
+export function reportRouteFor(origin, runId) {
+  if (!origin || !runId || !RUN_SEGMENT_RE.test(String(runId))) return null;
+  return `${String(origin).replace(/\/$/, '')}/portal/report/${runId}/`;
+}
+
 /**
  * ONE MARK'S DOCUMENT in a batch, at the address the portal serves it from.
  *
@@ -1292,7 +1332,8 @@ export function auditUrlFor(reportUrl, auditFile) {
   let u;
   try { u = new URL(String(reportUrl)); } catch { return null; }
   const m = REPORT_PATH_RE.exec(u.pathname);
-  return m ? auditRouteFor(u.origin, m[1]) : null;
+  // Group 1 is the portal shape, group 2 the legacy one — exactly one of them matches.
+  return m ? auditRouteFor(u.origin, m[1] ?? m[2]) : null;
 }
 
 /**