clearotron 0.2.1 → 0.2.2

package/shared/scope.mjs

@@ -39,7 +39,7 @@ export function isRevoked(jti, { denylistPath = process.env.TRADEMARK_MCP_TOKEN_
   let text;
   try { text = readFileSync(denylistPath, "utf8"); }
   catch (e) {
-    // FAIL CLOSED ( — bb8's F14; overwatch ruling, recorded on 1889 for the owner's
+    // FAIL CLOSED (found in review; ruled and recorded for the owner's
     // review with the reversal path, which is this function).
     //
     // This returned false — "not revoked" — on any unreadable list, and that is how a revoked key kept
@@ -64,7 +64,7 @@ export function isRevoked(jti, { denylistPath = process.env.TRADEMARK_MCP_TOKEN_
  *
  * NOT AN AUTHENTICATOR. This parses without verifying, which is safe for exactly one job: reading the
  * revocation handle out of our own `mintToken` output so `clearotron connect` can write it down
- * (, owner ruling: record key IDs, never secrets). Anything answering "is this token
+ * (owner ruling: record key IDs, never secrets). Anything answering "is this token
  * good" goes through `verifyToken`; a caller handing this function a token from the WIRE is the defect.
  *
  * Returns null rather than throwing on a malformed string — the caller is recording, and a record of
@@ -302,7 +302,7 @@ export const USER_ARTIFACTS = new Set(["report"]);
 //   SEALED  MODEL IDENTITY, BILLED COUNTS, and THE ENGINE'S JUDGMENT OF ITS OWN OUTPUT. Which model tier
 //           ran a stage and what it cost is the firm's cost structure, not an audit fact — and
 //           `withdrawn_reason` ("confabulated attribution") is an assessment of our own quality that the
-//           client has no counterpart for, already ruled un-forwardable (, scrub.mjs).
+//           client has no counterpart for, already ruled un-forwardable (scrub.mjs).
 //
 // That line is cheap to hold because the code had already drawn it: events.mjs says "Model identity is
 // deliberately NOT projected here: decision_timeline / run_changes are narrative surfaces", trace.mjs and
@@ -713,7 +713,7 @@ export function attributionOf(scope, onBehalfOf = null) {
   // the delegate does not widen what the token may do.
   const delegate = typeof onBehalfOf === "string" && onBehalfOf.trim() ? onBehalfOf.trim() : null;
   if (!delegate) return self;
-  // COUNTS AND IDENTIFIERS, NOT PROSE ('s scope note): this file is a matter record. A delegate
+  // COUNTS AND IDENTIFIERS, NOT PROSE (the scope note): this file is a matter record. A delegate
   // carrying whitespace, a colon or a newline would forge the compound form or spill a sentence into the
   // archive, so anything that is not a bare identifier is refused and the verified half stands alone.
   if (!/^[A-Za-z0-9._%+@-]{1,128}$/.test(delegate)) return self;
@@ -759,7 +759,7 @@ export function authorize(scope, toolName, args = {}) {
     }
     // The PREVIEW only, deliberately — the same line the internal branch draws below.
     //
-    // #53's defect was that the FREE call every principal makes first died on a message naming an
+    // The defect was that the FREE call every principal makes first died on a message naming an
     // internal doc, so that is the call the stamp exists to rescue. Extending it to start_run would
     // quietly remove a spend gate: an ops token's sub is often a connector name or "local", buildJob
     // fills forwarderEmail from `${forwarder}@example.com` when none is given, and the result is a real

package/shared/server-units.mjs

@@ -28,7 +28,7 @@
 // today and zero right ones tomorrow. `orphanReason` cannot discriminate either — all six carry one, and
 // `clearotron-client-mcp`'s used to say the opposite thing — never install it eagerly, because starting
 // it was the on-demand consent that opened client-account access. That row was rewritten on 2026-09-03
-// when the owner superseded the posture (, settled point 2), which does not rescue the
+// when the owner superseded the posture (settled point 2), which does not rescue the
 // rejected repair: the reason a skip-on-orphan filter fails is that `runsOn: []` records boxes MEASURED,
 // and every unit here starts life unmeasured.
 //
@@ -74,7 +74,7 @@ export const SERVER_INSTALL_SET = Object.freeze([
   // "On demand is fine" — starting the door WAS the consent that opened client-account access, so an
   // installer that placed it would have made that consent meaningless.
   //
-  // The owner superseded that knowingly (, settled point 2): the door auto-starts
+  // The owner superseded that knowingly (settled point 2): the door auto-starts
   // with the product and THE PER-ACCOUNT KEY IS THE GATE, not whether a process runs. A door with no
   // key issued refuses everything, which is the same protection with a different mechanism — and a
   // better one, because it does not depend on a reader finding a verb.
@@ -85,7 +85,7 @@ export const SERVER_INSTALL_SET = Object.freeze([
 ]);
 
 /**
- * Installed and enabled ONLY by `clearotron connect`, never by an install path (,
+ * Installed and enabled ONLY by `clearotron connect`, never by an install path (
  * owner ruling 2026-08-31). Named here so a reader of this file learns it exists and learns it is
  * excluded on purpose — an absence with no reason beside it is the thing this module is against.
  */
@@ -98,7 +98,7 @@ export const ON_DEMAND_UNITS = Object.freeze([]);
 /**
  * Which of the installed units a `--background` REFRESH must restart.
  *
- * — Hera's review of the F15 fix. `enable --now` on an ALREADY-ACTIVE unit is a
+ * — A review of that fix. `enable --now` on an ALREADY-ACTIVE unit is a
  * no-op, so a refresh over an updated checkout leaves the old process running the old files. The restart
  * loop that exists for exactly that named a hardcoded PAIR — the same pair the health check named, three
  * lines below it — with the same stale justification: "the oneshot and its triggers pick the new copies

package/shared/store-in-repo.mjs

@@ -226,7 +226,7 @@ export function commitWithAuditRow({ audit, gitCommit, files, message, by, row }
 //   portal-service   RECIPE_REPO_ROOT || <the profile repo root>   → the config store → saves work
 //   recipe-service   RECIPE_REPO_ROOT || join(HERE, "..")          → the PRODUCT CHECKOUT → FATAL
 //
-// Two ends of one contract measuring different things ('s class). The portal consulted the profile
+// Two ends of one contract measuring different things (the class). The portal consulted the profile
 // root as a second chance and the recipe-service did not, so one door came up and the other exited 1.
 //
 // AND THE DIVERGENT FALLBACK IS THE DANGEROUS ONE, which is why this is not merely tidying. The product
@@ -320,7 +320,7 @@ export function makeStoreCommit({ repoRoot, log = () => {}, what = "store", retr
       } catch (e) {
         const detail = detailOf(e);
         if (isTransientGitFault(detail) && attempt <= retries) { napping(waitMs * attempt); continue; }
-        // NAMED, not merely reported. 's line held that a failed commit is a permanent sync blocker
+        // NAMED, not merely reported. That line held that a failed commit is a permanent sync blocker
         // and belongs in the journal; it is no longer permanent — the next save completes it — but the
         // operator still needs to know WHICH fault, because a hook and a full disk want different people.
         log(`${what} COMMIT FAILED after the write landed — the save is LIVE and the paths are STAGED, `

package/shared/suite-census.mjs

@@ -15,7 +15,7 @@
 //
 // ── `.test(` IS NOT COUNTED, AND THAT IS THE WHOLE CALIBRATION ─────────────────────────────────────
 //
-// 's own thread records the miscount: 177 `RegExp.prototype.test` calls counted as subtests,
+// its own thread records the miscount: 177 `RegExp.prototype.test` calls counted as subtests,
 // genuine subtests ZERO. So this counts `assert.<something>` and a `test(` at the START of a line, and
 // nothing else. Two independent checks that it is calibrated: on the tree it was minted from, the
 // counted test sites match the EXECUTED totals at 415/415 for portal-ui, 382 against 386 for
@@ -105,7 +105,7 @@ export function rootScriptDisagreements(readManifest, declared = CENSUS_ROOT_SCR
 //
 // while 581 of 639 driver test files stop being collected. Both sides agreed because both sides
 // enumerate through the list ABOVE, and nothing in this repository opened a package.json. The census
-// was move-proof about the tests and blind to itself being pointed somewhere else, which is 's own
+// was move-proof about the tests and blind to itself being pointed somewhere else, which is its own
 // doctrine line: an enumerated check is blind to the thing moving; a discovered check is blind to
 // ITSELF moving.
 //
@@ -237,7 +237,7 @@ export function lossBetween(prevPerFile, nextPerFile) {
 }
 
 /**
- * tracker issue 205 — WHICH BUCKET EACH DIFFERENCE LANDS IN, and which of them refuses a re-stamp.
+ * WHICH BUCKET EACH DIFFERENCE LANDS IN, and which of them refuses a re-stamp.
  *
  * `lossBetween` above answers what MOVED. This answers what that MEANS, and it is a separate question
  * with a separate history. A rising skip count is a real difference and it used to refuse: it landed
@@ -343,7 +343,7 @@ export function countTestSites(text) {
  * The 1-based LINE of every assert site, in source order. One site per `assert.<x>` occurrence, so a
  * line carrying two of them appears twice — the same arithmetic `countTestSites` reports.
  *
- * 's fifth member needs the LINES, not just the total: a GATED arm — `if (!process.env.X) return;`
+ * That fifth member needs the LINES, not just the total: a GATED arm — `if (!process.env.X) return;`
  * at the top of a test body — leaves every token in place, so a count cannot see it and only "did this
  * line ever run" can. That question is answered by a coverage pass, and the two sides must ask it of the
  * SAME sites, so the rule lives here once rather than being re-typed against the same file.

package/shared/tty-style.mjs

@@ -2,7 +2,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // tty-style.mjs — weight where the meaning is, and NOTHING when the reader is not a terminal.
 //
-// ── why this exists (, owner ruling 2026-08-31) ────────────────────────────────────
+// ── why this exists (owner ruling 2026-08-31) ────────────────────────────────────
 //
 // "new terminals can do things like bold and colours etc — good formatting impresses people because it's
 // made clear to them someone put the time in." That is a product argument, not a decorative one: setup

package/shared/uspto-index-size.mjs

@@ -102,7 +102,7 @@ export const USPTO_PEAK_GB = Math.round((USPTO_INDEX_GB + USPTO_PEAK_WAL_GB) * 1
 //
 // It was pessimistic by 4x. Charging 1.0 demanded ~43.8 GB for a build whose index came to 10.1 GB, and
 // INSTALL.md told the reader to provision 60 GB. On the free tier that is the difference between "I can
-// try this on the disk I have" and "I cannot", which is the whole of 's Why.
+// try this on the disk I have" and "I cannot", which is the whole of the Why.
 //
 // Carried at 0.35 against 0.24 measured — a 46% margin, and the margin is doing real work rather than
 // decorating a guess:

package/shared/vacuous-pass.mjs

@@ -158,7 +158,7 @@ export function discoveredLoops(text) {
 
 // ── THE EARLY-RETURN HALF ──────────────────────────────────────────────────────────────────
 //
-// 's ruling names two shapes. `discoveredLoops` above is the loop half. This is the other, and
+// That ruling names two shapes. `discoveredLoops` above is the loop half. This is the other, and
 // the two are not alike enough to share a detector:
 //
 //   test("the tree is clean", () => {

package/skills/clearotron-account/SKILL.md

@@ -165,21 +165,50 @@ question to the issuing firm rather than reconstructing an answer.
 
 ## Asking what-if
 
-A what-if re-runs **one step** of a finished search under a changed assumption, in a sandbox. It is the
-right tool when the user asks *what if this were different* — and the wrong one when they want a fresh
-answer about a different mark, which is a new search.
-
-- **Plan, read the honesty note aloud, then commit.** `what_if_plan` says in plain words how complete
-  the answer will be. Re-running an early step does **not** re-run the risk read or the report on top of
-  it, and a user who is not told that will read a partial output as a new verdict. Say it before you
-  spend, not after.
-- **It costs money and it is not instant.** The experiment queues on the server and runs there. Tell the
-  user it is running and collect it with `what_if_result` rather than promising an immediate answer.
+A what-if answers *what if this were different* about a search that has already run. There are two, and
+the search's own state decides which one you can have:
+
+- a **step re-run**, while the search is still live — one step runs again under a changed assumption, in
+  a sandbox;
+- a **memo**, once the search is delivered or archived — the evidence already gathered is read again
+  under the assumption, and a short document comes back naming the report it belongs to.
+
+Either is the wrong tool when the user wants a fresh answer about a different mark. That is a new search.
+
+**On a delivered report, offer the memo.** A step re-run is refused there, and that refusal is the one
+that used to end the conversation with *commission a fresh search*. It should not. A user holding a
+report who asks *what if the Korean application were abandoned* is asking the most ordinary question
+there is, and the memo is the answer to it — so check the search's state before you tell anyone the
+question cannot be answered.
+
+- **Name the step when you ask for a re-run; do not when you ask for a memo.** `what_if_plan` has to be
+  told which step, and asking without one is an error rather than a refusal you can relay. A memo re-runs
+  no step: pass the user's assumption as `instructions` and nothing else.
+- **Plan, read the honesty note aloud, then commit.** `what_if_plan` says in plain words how complete the
+  answer will be. Re-running an early step does **not** re-run the risk read or the report on top of it,
+  and a user who is not told that will read a partial output as a new verdict. Say it before you spend,
+  not after.
+- **It is not instant.** Both kinds queue on the server and run there. Tell the user it is running and
+  collect it with `what_if_result` rather than promising an immediate answer.
 - **You do not choose how it runs.** There is no model or tier for you to pick, and asking for one is
   refused. Express the change in `instructions`, in the user's own terms.
-- **The original is untouched, and say so.** A what-if never edits the delivered search or its report.
-  Present the result as *what this step would have said under that assumption*, never as a correction to
-  the report the user already holds.
+- **The original is untouched, and say so.** Neither kind edits the delivered search or its report.
+  Present the result as *what this would have said under that assumption*, never as a correction to the
+  report the user already holds.
+
+### What a memo is, and what it is not
+
+Say all three when you offer one, not when you deliver it. A user who learns the bounds afterwards has
+already read it as something it is not.
+
+- **It searches nothing.** No register is queried and no new evidence is gathered. It reasons over what
+  the search already found, and costs nothing beyond model time.
+- **It cannot confirm the assumption.** It says what would follow *if* the assumption held, and states
+  what the smallest piece of work would be that could settle whether it does. It is not a finding that
+  the Korean application was abandoned; it is what that would mean if it were.
+- **A stopped search takes neither kind.** A search its owner cancelled has evidence that was never
+  finished, and reasoning over a half-gathered record is how a memo comes to say more than the search
+  ever knew.
 
 ## Before you start a search
 

package/driver/systemd/prelim-driver.path

@@ -1,69 +0,0 @@
-[Unit]
-Description=Watch the prelim-search driver queue for new job files
-Documentation=https://github.com/CordilleraSarl/Clearotron/blob/main/driver/README.md
-
-[Path]
-# Watch EVERY prelim-capable agent's queue (inotify-backed). When a *.json job lands in any of them, start
-# the drain service — which runs the job as the agent whose workspace it sits in. One PathExistsGlob per
-# watched queue ("Multiple directives may be combined … to watch multiple paths" — systemd.path(5)).
-# Event-driven, sub-second; nothing of ours runs except while a job is being processed. The
-# prelim-driver.timer fallback re-drains every ~90s so a queue NOT listed here (e.g. a brand-new agent, or
-# a mid-path glob systemd fails to arm) still gets picked up — the watcher is an optimisation over the timer,
-# never the sole drain path.
-#
-# These lines MUST mirror config.queueDirs (driver.config.mjs) — the runner drains those regardless, so any
-# queue the runner scans but the watcher misses only pays the ≤90s timer latency (the pre-fix bug: this unit
-# watched only the headless dir below, which does not exist in an agent-workspace deployment, so event-driven
-# pickup was dead and the queue drained on the timer alone — and wedged entirely whenever the timer was down).
-#
-# ── tracker issue 774 — THESE GLOBS ARE THIS DEPLOYMENT'S WORKSPACE ROOT, NOT THE CODE DEFAULT ────────────────────
-#
-# A .path unit CANNOT read an environment variable. There is no `%E`, no EnvironmentFile, no expansion:
-# the prefix below is a literal, and it is the one thing in the queue lane that CLEAROTRON_WORK_DIR
-# cannot reach. So this file and `CLEAROTRON_WORK_DIR` in %h/.env are two spellings of one fact, and
-# nothing at runtime notices when they stop agreeing.
-#
-# WHAT DISAGREEMENT LOOKS LIKE: the runner drains $CLEAROTRON_WORK_DIR; this watcher arms an inotify on
-# a path nothing writes to. Jobs land, the watcher never fires, no unit fails, no log line appears, and
-# the only thing still draining is the 90s prelim-driver.timer — so the lane looks alive and every job is
-# late. If the timer is also down, the queue simply stops.
-#
-# tracker issue 774 moved the CODE default for CLEAROTRON_WORK_DIR from `$HOME/.openclaw` to
-# `$HOME/trademark/workspace`. These globs did NOT move with it, and that is correct: they must track the
-# deployment, and the deployment pins `CLEAROTRON_WORK_DIR=<home>/.openclaw` in its EnvironmentFile
-# (the production env example) precisely so its run directories do not move under a live queue. Change one of
-# these three lines only together with that variable, on the same box, in the same change.
-# driver/test/data-plane-defaults.test.mjs asserts this file and the production env example still agree.
-#
-# AGENT-WORKSPACE deployment (this VM): one line per prelim-capable agent. We watch each CONCRETE queue dir
-# (only the final *.json is a wildcard) so systemd arms an inotify watch directly on the queue directory —
-# a mid-path `workspace-*` glob is not reliably armed. Add a line when a new prelim agent is onboarded; until
-# then the 90s timer + dynamic config.queueDirs still pick its jobs up.
-# ── RESOLVED AT INSTALL (tracker issue 1876 option B) ────────────────────────────────────────
-# `@CLEAROTRON_WORK_DIR@` is substituted by render-units.mjs when it writes the resolved copy into
-# ~/.config/systemd/user/. That closes the half of the disagreement above that VARIES BY MACHINE: the
-# workspace root is now taken from the same value the runner drains, so the two spellings cannot drift
-# apart on an install.
-#
-# THE AGENT SEGMENT IS NOT SUBSTITUTED, AND THAT IS A LIMIT WORTH STATING RATHER THAN HIDING.
-# `driver.config.mjs` builds the queue as join(workspaceRoot, workspaceDirName(agent), "studio",
-# "prelim-search", "queue") — so the root is configuration and `workspace-clawdi` is a per-deployment
-# choice, already documented by the commented alternative below. Substituting it would need a variable
-# nothing sets today, and inventing one to make this line look fully resolved would be the more
-# dangerous kind of fix: it would read as configured while resolving to whatever the default happened
-# to be. One real value substituted beats two that look substituted.
-PathExistsGlob=@CLEAROTRON_WORK_DIR@/workspace-clawdi/studio/prelim-search/queue/*.json
-# One line per ADDITIONAL prelim-capable agent this deployment onboards, e.g.
-#PathExistsGlob=%h/.openclaw/workspace-<agent>/studio/prelim-search/queue/*.json
-# Two lines here named individual people at this firm and shipped their identities to every clone
-# (tracker issue 1014). They are a deployment's own roster, not the product's. Omitting a line costs LATENCY and
-# not correctness: as the note above says, the 90s timer and the dynamic config.queueDirs still
-# collect that agent's jobs — the watch only makes them immediate.
-# HEADLESS deployment (docs/INTAKE.md): a standalone product with no agent workspaces instead watches the one
-# explicit queue named by CLEAROTRON_QUEUE_DIR (default ~/prelim-queue). Uncomment for that mode; harmless to
-# leave active in a mixed deployment (never matches when the dir is absent), mirroring the additive queueDirs.
-#PathExistsGlob=%h/prelim-queue/*.json
-Unit=prelim-driver.service
-
-[Install]
-WantedBy=default.target

package/driver/systemd/prelim-driver.service

@@ -1,86 +0,0 @@
-# GENERIC UNIT — safe to sync verbatim on deploy: no deployment-specific values live here; hostnames,
-# credentials and paths all come from EnvironmentFile=%h/.env. (Contrast the TEMPLATE units — profile/
-# recipe/portal-service, remote/client-mcp — whose live copies hold real CF Access values and must be
-# diffed, never overwritten. Both kinds are inventoried in docs/architecture/05-config-governance.md.)
-[Unit]
-Description=Prelim-search deterministic driver — drain the job queue
-Documentation=https://github.com/CordilleraSarl/Clearotron/blob/main/driver/README.md
-# No gateway dependency: compute runs on the standalone engine and delivery defaults to handoff
-# (outbox packets) — see docs/DELIVERY.md. Nothing here needs OpenClaw.
-# Type=oneshot fired by prelim-driver.path: if the runner fails its preflight on every retrigger
-# (exit 3 — no longer reachable since tracker issue 1014 deleted the gateway preflight; kept because the
-# start-limit interaction below is a property of Type=oneshot, not of that preflight), the default
-# start-limit (5 failures in 10s) locks the service out and can drive the .path unit's TriggerLimit
-# (200/2s) into a permanently failed state. Never rate-limit starts (Type=oneshot, no Restart= —
-# nothing here can loop unbounded); the runner also sleeps before its preflight-fail exit so the
-# retrigger cadence stays slow.
-StartLimitIntervalSec=0
-
-[Service]
-# oneshot: systemd guarantees a single instance, so two queue events can't start two concurrent drains.
-Type=oneshot
-EnvironmentFile=%h/.env
-# BOTH ROUTES THE DOCUMENTS PERMIT. INSTALL.md §1 requires "a coding CLI on your PATH, signed in" and
-# deliberately names no install route, so the reader picks one. The npm-global layout was the only one
-# on this line; claude.ai/install.sh -- the route a reader most often takes -- lands the binary in
-# ~/.local/bin, which was not here. The engine then failed `spawn claude ENOENT` and every stage burned
-# its full retry ladder for zero tokens, a failure that reads as a model problem and is not one.
-# CLEAROTRON_CLAUDE_PATH in the EnvironmentFile above is the exact answer for any other location; this
-# line is what makes the two documented layouts work without one.
-Environment=PATH=%h/.local/bin:%h/.npm-global/bin:/usr/local/bin:/usr/bin:/bin
-Environment=OPENCLAW_HOME=%h
-# THIS deployment's configuration is the EnvironmentFile above and nothing else. runner.mjs is one of
-# the CLI entries that reads <repo>/.env for a laptop first run (shared/env-local.mjs); a checkout has
-# no .env today, so this changes nothing — which is the point. It makes "no .env in the checkout" a
-# guarantee instead of a coincidence, so a stray file left by a debugging session cannot quietly
-# reconfigure the queue drain. Same line on trademark-artifacts-http.service, the other unit that
-# starts a wired entry.
-Environment=CLEAROTRON_NO_ENV_FILE=1
-# Deployment hostnames (CLEAROTRON_REPORTS_URL, CLEAROTRON_MCP_URL, CLEAROTRON_CLIENT_MCP_URL, CLEAROTRON_ACCESS_DOMAIN,
-# CLEAROTRON_STAFF_POOL_ROOT) live in the EnvironmentFile above, NOT here — this unit is git-tracked and generic, so a
-# hostname baked in becomes every deployment's hostname. They are non-secret; .env is simply the one place
-# this deployment's config already lives (docs/architecture/04-configuration-reference.md).
-#
-# Do NOT reintroduce a placeholder value for any of them. CLEAROTRON_CLIENT_MCP_URL was pinned here to a
-# example.com host, which is WORSE than leaving it unset: render.mjs's spec 61 §E fail-closed branch omits
-# the client connector when the var is EMPTY, so a placeholder defeated the guard and shipped a dead
-# tokenised link in the client export (2026-07-19). Unset ⇒ omitted; wrong ⇒ delivered.
-# NO WorkingDirectory=, DELIBERATELY, and this is the line not to re-add defensively.
-#
-# systemd does not expand environment variables in WorkingDirectory= -- it takes a path and specifiers
-# only -- so a config-derived checkout cannot go there. It does expand ${VAR} in ExecStart= ARGUMENTS,
-# which is where the path below sits.
-#
-# Dropping it is safe because nothing here reads the working directory: runner.mjs never calls
-# process.cwd(), and driver/driver.config.mjs:24 resolves REPO_ROOT as dirname(DRIVER_DIR) from
-# import.meta.url. The code finds itself from where its file is, not from where it was started.
-#
-# THE HARDCODED NAME THIS REPLACES could not work after a documented install. INSTALL.md §2 says
-# `git clone <this-repo> && cd <repo>`, which produces a directory named after the repository -- and
-# the name in this unit was the repository this one was cut FROM. WorkingDirectory then failed and the
-# unit never started, on a host nobody is watching.
-# runner.mjs claims each queued job atomically, runs the pipeline, marks .done/.failed.
-ExecStart=/usr/bin/node ${CLEAROTRON_CHECKOUT_DIR}/driver/runner.mjs
-# Refresh the portal's flag snapshot after every drain, from THIS unit because it has the engine
-# EnvironmentFile. The clause that used to sit here — "the portal deliberately has none (AUD-shadowing
-# rule)" — is out of date: the owner's 2026-08-26 "one configuration per server box" ruling gave every
-# unit the same `EnvironmentFile=%h/.env` and removed the second source of truth the AUD protection
-# defended against. The portal and worker units now refresh it at start too (tracker issue 170); a drain
-# is still worth refreshing after, because a run is when the engine's own posture is most recently proven.
-# A snapshot that only refreshes when somebody remembers eventually describes a configuration nobody
-# is running (flag-snapshot.mjs header). `-` prefix: a snapshot failure must never fail the drain.
-ExecStartPost=-/usr/bin/node ${CLEAROTRON_CHECKOUT_DIR}/driver/flag-snapshot.mjs
-# Ceiling for a WEDGED runner ONLY — never a deadline for honest work. oneshot means the WHOLE drain
-# runs inside "activating", and a multi-job backlog (runs ~1.5h+ each; one observed gather member alone
-# ~2h26m) makes honest activations unbounded. The runner bounds its own wall time instead: past its
-# admission budget (runner.mjs CLEAROTRON_ADMISSION_BUDGET_MS, default 2h) it claims no NEW jobs, finishes
-# what's in flight and exits 0 — leftover queue *.json re-match the .path glob, which retriggers a fresh
-# activation with a fresh clock. So a legit activation is bounded by budget (2h) + one run's wall
-# (worst observed component ~2h30m), and this ceiling MUST stay above that sum (see
-# driver/test/runner.admission-budget.test.mjs) so it only ever fires on a wedged runner (one
-# SIGTERM-immune engine child). Was 0 (infinite), which let that wedge hold the unit "activating"
-# forever with no backstop.
-TimeoutStartSec=6h
-Nice=5
-
-# NOTE: not [Install]ed — it is activated by prelim-driver.path, not enabled standalone.

package/driver/systemd/prelim-driver.timer

@@ -1,14 +0,0 @@
-[Unit]
-Description=Prelim-driver queue-drain fallback — re-scan every agent queue on a fixed cadence
-Documentation=https://github.com/CordilleraSarl/Clearotron/blob/main/driver/README.md
-
-[Timer]
-# Safety net behind the event-driven prelim-driver.path. runner.mjs claims jobs atomically, so a periodic
-# re-drain is cheap and can NEVER double-run a job the .path already picked up. It guarantees any queue the .path doesn't explicitly watch (e.g. a brand-new agent workspace) still
-# drains within ~90s — the self-healing backstop whose absence let a Alex-forwarded job silently never-run.
-OnBootSec=2min
-OnUnitActiveSec=90s
-Unit=prelim-driver.service
-
-[Install]
-WantedBy=timers.target

package/driver/systemd/prelim-outbox.path

@@ -1,27 +0,0 @@
-[Unit]
-Description=Watch the prelim delivery outbox for finished-run markers
-Documentation=https://github.com/CordilleraSarl/Clearotron/blob/main/driver/README.md
-
-[Path]
-# Workstream B — instant delivery. When a handoff-mode run finishes, the driver drops <runId>.pending here
-# (the marker's first line names the forwarder agent). inotify-backed, sub-second: a marker fires
-# prelim-outbox.service, which wakes that agent to run the prelim-deliver skill NOW instead of waiting up to
-# 55m for the HEARTBEAT completion-watch (which stays enabled as the backstop). Event-driven; nothing of
-# ours runs except while a delivery is being dispatched.
-# ── tracker issue 774 — THIS GLOB IS THIS DEPLOYMENT'S OUTBOX, NOT THE CODE DEFAULT ───────────────────────────────
-#
-# Same hazard as prelim-driver.path, and read that unit's note for the full version. A .path unit cannot
-# read an environment variable, so this literal and the driver's `config.outboxDir`
-# (CLEAROTRON_OUTBOX_DIR, else <CLEAROTRON_WORK_DIR>/prelim-outbox) are two spellings of one fact with
-# nothing checking them against each other. Disagree, and finished runs drop their `.pending` markers
-# where this watcher is not looking: no delivery wake, no failure, no log — the 55m completion-watch
-# backstop quietly becomes the delivery path.
-#
-# tracker issue 774 moved the CODE default for the workspace root; this glob did not move, because the deployment
-# pins `CLEAROTRON_WORK_DIR` and `CLEAROTRON_OUTBOX_DIR` explicitly (the production env example). Change this line
-# only together with those variables, on the same box, in the same change.
-PathExistsGlob=%h/.openclaw/prelim-outbox/*.pending
-Unit=prelim-outbox.service
-
-[Install]
-WantedBy=default.target

package/driver/systemd/prelim-outbox.service

@@ -1,37 +0,0 @@
-[Unit]
-Description=Prelim delivery — wake the forwarder agent to send finished runs (prelim-deliver)
-Documentation=https://github.com/CordilleraSarl/Clearotron/blob/main/driver/README.md
-# This unit is the OPENCLAW-ADJACENT reference integration (deliver-trigger.sh wakes an OpenClaw
-# agent to send). A headless integrator replaces this pair with their own outbox watcher — the
-# contract is docs/DELIVERY.md, not this unit.
-After=openclaw-gateway.service
-Wants=openclaw-gateway.service
-
-[Service]
-# oneshot: systemd serializes, so two outbox events can't start two concurrent wakes.
-Type=oneshot
-EnvironmentFile=%h/.env
-Environment=PATH=%h/.npm-global/bin:/usr/local/bin:/usr/bin:/bin
-Environment=OPENCLAW_HOME=%h
-# NO WorkingDirectory=, deliberately -- see prelim-driver.service for the full reasoning. systemd does
-# not expand variables in WorkingDirectory=, it does expand ${VAR} in ExecStart= arguments, and nothing
-# here reads the working directory: this entry point resolves what it needs from its OWN file location.
-# Reads each *.pending marker, wakes the named agent ONCE to run the prelim-deliver skill (which sends every
-# sendPending run VERBATIM + marks .sent, idempotent), then clears the markers. The marker is only an
-# edge-trigger; status.sendPending + the .sent guard are the source of truth and the 55m HEARTBEAT watch is
-# the backstop, so a cleared/lost marker never loses a delivery and never double-sends.
-ExecStart=/bin/bash ${CLEAROTRON_CHECKOUT_DIR}/driver/deliver-trigger.sh
-# 2026-07-04 incident: TimeoutStartSec=0 (no ceiling) let ONE hung wake wedge the whole lane for 19h —
-# 1500 covers the v2+C5 trigger worst case: wake wall 870s + drain-wait 180s + backoff pacing sleep ≤300s.
-# the openclaw CLI completed its agent turn (stopReason=stop) but never exited (event loop parked in
-# ep_poll; its own --timeout did not enforce process exit), so the oneshot sat "activating" forever and
-# every later .pending marker was silently swallowed (marble-spire's delivery + VENZY's failure notice).
-# A real ceiling makes the unit SELF-HEALING: on timeout systemd kills the cgroup and fails the unit;
-# PathExistsGlob re-fires while markers remain, and the sendPending/.sent guards keep re-wakes idempotent.
-# 900s comfortably covers the slowest observed legitimate wake (copper-spire: ~13 min agent turn) — sends
-# that complete are never cut mid-flight because the ceiling exceeds the turn wall.
-TimeoutStartSec=1500
-TimeoutStopSec=30
-Nice=5
-
-# NOTE: not [Install]ed — it is activated by prelim-outbox.path, not enabled standalone.

package/driver/systemd/prelim-outbox.timer

@@ -1,21 +0,0 @@
-[Unit]
-Description=Prelim delivery rescan — fixed-cadence backstop behind the outbox watcher
-Documentation=https://github.com/CordilleraSarl/Clearotron/blob/main/driver/README.md
-
-[Timer]
-# C5 — deterministic delivery backstop. The instant lane (prelim-outbox.path) is edge-triggered off
-# *.pending markers, and its former backstop — the 55m HEARTBEAT completion-watch — does not run
-# 22:00–05:00 (activeHours), so a wake that FAILED (turn error, CLI hang, gateway-restart collision)
-# could leave a finished run undelivered all night. This timer fires the SAME prelim-outbox.service:
-# deliver-trigger.sh's rescan step re-drops a <runId>.pending marker for every run still
-# sendPending==true with no .sent, then processes them. Idempotent and paced: sendPending/.sent (and
-# the per-channel send receipts) are the source of truth, and the backoff sidecars in
-# prelim-outbox/backoff/ keep a persistently failing wake from hot-retrying.
-# OnUnitActiveSec is measured from prelim-outbox.service's LAST activation (the .path triggers the same
-# unit), so the rescan self-defers while the instant lane is busy — "hourly-ish", never stacked.
-OnBootSec=10min
-OnUnitActiveSec=50min
-Unit=prelim-outbox.service
-
-[Install]
-WantedBy=timers.target