clearotron 0.2.1 → 0.2.2

package/driver/CHANGELOG.md

@@ -1,4 +1,68 @@
-# prelim-driver
+# clearotron-driver
+
+## 0.2.2
+
+### Patch Changes
+
+- df095a8: Fixed: The configuration audit now refuses when one of the files it reads is missing, instead of reporting that nothing sets the variables that file records. Its answer decides which settings look unused, so a file it could not read was being counted as a file with nothing in it.
+- f05657c: New: An assistant on a clearance account can now answer "what if this were different" about a report already delivered. It writes a short memo reasoning over the evidence already gathered, instead of asking for a new search.
+- d52cd98: Fixed: A scheduled deploy no longer updates the working copy while an experiment run is in progress. It now waits, as it already did for a clearance run.
+- f05657c: Fixed: A client account asking about a mark in a knockout screen now receives the risk band, the reason for it and the findings behind it. It previously returned an empty answer.
+- 38ce32f: New: A Knockout search now looks up what the owner of a registered right actually sells, and the report says where that answer came from. Before, the assessment inferred the owner's trade from the company name alone, then told you to go and obtain the registration's own goods list. The name is not evidence of the trade. It happened to read correctly on one search and would have read confidently wrong on the next.
+  
+  Fixed: Where the lookup finds nothing, the report says so plainly and still delivers. An unanswered search is never written up as a clean negative, and a provider outage never withholds a report.
+  
+  For operators: this adds one web search per promoted registered filing, deduplicated by owner and capped at three per searched name. A search with no registered right against it costs nothing extra.
+- 57eaf24: Fixed: A knockout report no longer shows a register filing's risk band beside a line saying that filing carries no rating. The band shows when the reviewer gave one, and the line appears only when they did not.
+- b1f188f: Fixed: The unit inventory again records why every shipped unit that runs on no box is still shipped. One entry lost its reason when its name was superseded.
+- 3de0828: New: One engine process can now serve both people arriving through a tunnel and programs on the same machine holding an access key. It listens for the key on a local socket, which no tunnel can forward to, and the network door never accepts a key at all. Deployments that needed both used to run the process twice, on two ports, with two units to keep in step.
+  
+  Fixed: The startup lines now say whether a local key path exists, and what its permissions are. An operator can see it without opening a unit file. A deployment with no key path is told that too, rather than left to infer it from silence.
+  
+  For operators: set TRADEMARK_MCP_KEY_SOCKET to the socket path the local key door should listen on. It is created with owner and group access only. Leaving it unset changes nothing about an existing deployment. The door refuses to open without a grants file, or alongside the authentication bypass.
+- 235cf07: Fixed: Stopping the demo now stops everything it started, including when the stop signal reaches only the command you can see rather than the whole terminal.
+- be648b6: Fixed: The architecture diagrams in the public documentation render with their intended colours again, and thirteen code comments state the colour they meant.
+- 97b7c96: Fixed: The deployment check now reports the services a box is actually running. It had been asking systemd about unit names left behind by a rename, so a healthy box reported nothing running.
+- f05657c: Fixed: The "your screen is done" notice for a knockout search now goes to the person who ordered it, with the operator kept as a copy. It previously went to the operator alone, whoever had asked for the search.
+- c4b6b58: Fixed: The link in your completion email and message now opens the report. It previously pointed at a path the site does not serve, so it led to a sign-in and then a dead page. This affected every delivered report on both search products, in the email, the chat notice and the assistant's own answer. The workbook link in the same email was always correct and is unchanged.
+  
+  Fixed: The chat notice now goes to the person who ordered the search, with the operator keeping a copy they can switch off. Before, it went only to whoever runs the service, so the requester was never told their search had finished.
+  
+  For operators: hold requesters' numbers in CLEAROTRON_REQUESTER_WHATSAPP, keyed by email address or by the handle a request arrives under. Where no number is held, the delivery record says so by name instead of quietly sending the notice to you. Set CLEAROTRON_WHATSAPP_OPERATOR_COPY=0 to stop receiving copies of other people's runs.
+- bb1a409: New: A Knockout report now carries the whole assessment behind its ratings. You get the reviewer's notes and the reviewer's own opening read of each name. You also get the reasoning that holds a name at its rating, and what would move it. This was written during every search and reached only the audit workbook, so the report showed a rating without the thinking under it. The notes are marked as reference material rather than mixed into the findings.
+  
+  New: A registered filing the search formed a view on now shows that rating and the read behind it. Before, the one registered right on a page was the only entry carrying no rating, beside softer uses that all carried one. That inverted what matters legally. A filing the search did not weigh still says so plainly.
+- df6277c: Fixed: A live registration covering the goods you asked about is no longer left out of a report for want of room. It is reported, or the report says why it is distant.
+- 9ba8cd0: Fixed: A what-if memo is now refused if it writes anywhere in the delivered run except its own memo folder, and the refusal names the file.
+- 8c8e200: Fixed: A what-if question left queued when its run is archived now comes back with a reason, instead of never being answered.
+- bb1a409: Fixed: The delivery record now states plainly when a report's write-up length and ranking rules could not be checked against the delivered text. It says the rules were applied to nothing on that run. Before, this was recorded as an unlabelled failed check. It looked like any other, so a run could deliver with those rules unverified and nobody would see it.
+- 9ba8cd0: For operators: Each run record now says whether the model id it observed was a pinned snapshot or an alias the provider can repoint.
+- aea4a4e: Fixed: The deployment check now says which checkout a service is running from even when its unit file does not declare one.
+- bb1a409: New: The tools that show how a search reached its answer now work on a Knockout search. You can ask what it found, what it looked at, where it searched and came back empty, and read the delivered report itself. Until now they returned nothing at all for a Knockout search, so anyone asking how one of these results was reached saw a blank record.
+  
+  New: The proof-of-search record answers on these searches. It lists what was searched and found nothing, which is what answers a challenge to a result. Where a tool has nothing to show for this kind of search, it now says so in words. An empty list reads as "we looked and found nothing".
+- 14d6d28: Fixed: The demo and the install steps now start on native Windows, where they previously crashed on the first internal module they loaded.
+
+## 0.3.0-beta.0
+
+### Minor Changes
+
+- bb1a409: New: A Knockout report now carries the whole assessment behind its ratings. You get the reviewer's notes and the reviewer's own opening read of each name. You also get the reasoning that holds a name at its rating, and what would move it. This was written during every search and reached only the audit workbook, so the report showed a rating without the thinking under it. The notes are marked as reference material rather than mixed into the findings.
+  
+  New: A registered filing the search formed a view on now shows that rating and the read behind it. Before, the one registered right on a page was the only entry carrying no rating, beside softer uses that all carried one. That inverted what matters legally. A filing the search did not weigh still says so plainly.
+- bb1a409: New: The tools that show how a search reached its answer now work on a Knockout search. You can ask what it found, what it looked at, where it searched and came back empty, and read the delivered report itself. Until now they returned nothing at all for a Knockout search, so anyone asking how one of these results was reached saw a blank record.
+  
+  New: The proof-of-search record answers on these searches. It lists what was searched and found nothing, which is what answers a challenge to a result. Where a tool has nothing to show for this kind of search, it now says so in words. An empty list reads as "we looked and found nothing".
+
+### Patch Changes
+
+- df6277c: Fixed: A live registration covering the goods you asked about is no longer left out of a report for want of room. It is reported, or the report says why it is distant.
+- 9ba8cd0: Fixed: A what-if memo is now refused if it writes anywhere in the delivered run except its own memo folder, and the refusal names the file.
+- 8c8e200: Fixed: A what-if question left queued when its run is archived now comes back with a reason, instead of never being answered.
+- bb1a409: Fixed: The delivery record now states plainly when a report's write-up length and ranking rules could not be checked against the delivered text. It says the rules were applied to nothing on that run. Before, this was recorded as an unlabelled failed check. It looked like any other, so a run could deliver with those rules unverified and nobody would see it.
+- 9ba8cd0: For operators: Each run record now says whether the model id it observed was a pinned snapshot or an alias the provider can repoint.
+- aea4a4e: Fixed: The deployment check now says which checkout a service is running from even when its unit file does not declare one.
+- 14d6d28: Fixed: The demo and the install steps now start on native Windows, where they previously crashed on the first internal module they loaded.
 
 ## 0.2.1
 

package/driver/README.md

@@ -1,4 +1,4 @@
-# prelim-driver — deterministic driver for the prelim-search trademark workflow
+# clearotron-driver — deterministic driver for the prelim-search trademark workflow
 
 Orchestration in **code**; the LLM does only judgment leaves. Each pipeline stage is **one blocking
 engine turn** (default engine: `anthropic-agent`, shelling `claude -p` per stage); fan-out/fan-in/
@@ -26,7 +26,7 @@ integrator ──job JSON (enqueue CLI / start_run / queue file)──┐
 
 ## Per-agent execution (multi-queue)
 
-A prelim job runs **as the identity that forwarded it** — derived from the queue LOCATION it was
+A clearotron job runs **as the identity that forwarded it** — derived from the queue LOCATION it was
 claimed from (`<workspacePrefix><agentId>/…/queue`, see `driver.config.mjs`), so there is no
 forwarder→agent map to maintain. The run-dir sits in that identity's workspace and the delivery
 packet names that identity as the reply route. **Publishing stays centralized** — `publish/` writes

package/driver/ask-ledger.mjs

@@ -82,7 +82,7 @@ export function planJoinFrom(planExecution) {
   // KEY predates the instrument — "not recorded" — while one carrying the keys as null is a count the
   // provider could not take. Reading the VALUES alone collapses those two into one sentence, which is
   // the exact confusion exists to remove; `records: null` is indistinguishable from absent.
-  // The first cut of this did read the values, and it reported every pre- receipt as a failed
+  // The first cut of this did read the values, and it reported every pre-change receipt as a failed
   // count. Bare qid strings are tolerated too — no driver ever wrote them, so that arm proved nothing.
   const executed = new Map();
   for (const x of planExecution?.executed ?? []) {
@@ -104,7 +104,7 @@ export function planJoinFrom(planExecution) {
  * What a slice returned, in the reader's words — THREE-VALUED, and never a zero standing in for an
  * absence (register-plan.mjs's join records why). `null` records with a finite count means the provider
  * counted but the block carried no record list; both null means the receipt says nothing about the
- * return, which is what every pre- run looks like. PURE.
+ * return, which is what every pre-change run looks like. PURE.
  */
 export function returnedPhrase(info) {
   if (!info) return "what it returned was not recorded";
@@ -127,7 +127,7 @@ export function returnedPhrase(info) {
  *
  * THE LEGITIMATE CLOSE IS PRESERVED, and it is the whole reason this keys on the RETURN rather than on
  * execution: a probe that ran and found NOTHING has nothing to hand anyone, and closes exactly as it
- * does today. 's own build named that trap before this rule existed.
+ * does today. its own build named that trap before this rule existed.
  *
  * THREE STATES, and only one of them discharges:
  *

package/driver/authority-trees.mjs

@@ -24,7 +24,7 @@
 //
 // `_driver/` is the sharpest inclusion. It holds the frozen plan, the grid specs, the plan-execution
 // receipt, the form sidecars and `run.jsonl` — and it sits inside `runDir`, which is granted READ+WRITE
-// by design. Every diagnosis run on 2026-08-14 (,) read those files as ground
+// by design. Every diagnosis run on 2026-08-14 () read those files as ground
 // truth. A seat writing them would be forging the record the engine is judged by.
 //
 // `profilesDir` is DEFENSIVE, not a live hole: it appears in no `--add-dir`, so the file tools cannot

package/driver/call-capture.mjs

@@ -2,7 +2,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // call-capture.mjs — the forensic record of what a seat SENT, one file per call, refusals included.
 //
-// 's sibling. Every recording transport captures the payload
+// That sibling. Every recording transport captures the payload
 // BEFORE its decision, so the evidence survives a refusal. Each of them wrote that capture to a path
 // derived from something that does not change between calls — a literal `call-001.json`, an axis name, a
 // finding's ordinal — so a second call to the same subject DESTROYED the first's evidence. Measured on

package/driver/card-frame.mjs

@@ -18,7 +18,7 @@
 // had something of its own to anchor on.
 //
 // That is the day's defect shape in one stage — a decision taken on a surface token while the record
-// underneath already said it — and it is what 's S2 ruling settled: "the mechanical card fields
+// underneath already said it — and it is what the S2 ruling settled: "the mechanical card fields
 // (headings, ids, links, driver-stamped values) move to code NOW — uncontested."
 //
 // ── WHY THE HEAD RULE IS THE WHOLE REVIEW QUESTION ──────────────────────────────────────────────────

package/driver/case-law-ledger.mjs

@@ -5,7 +5,7 @@
 // THE DEFECT. `case-law-findings.md` is the only artifact case law produces, and its entire contract is
 // `nonEmpty(c, 80)` — a non-empty check on prose. There is no citations ledger, no structured mirror, no
 // per-proceeding record anywhere. So the per-record trace that exists for the register path and
-// for common law (,) cannot be extended to case law at all: there is nothing on the other side
+// for common law () cannot be extended to case law at all: there is nothing on the other side
 // of the join. That was found while scoping the record trace, and it is why closed into this issue.
 //
 // WHAT THAT COSTS. Two of the owner's three sign-off conditions for sending a case-law report to a

package/driver/claim-liveness.mjs

@@ -45,7 +45,7 @@ export function procStarttime(pid, readStat = undefined,
   { platform = process.platform, readPsStart = defaultReadPsStart } = {}) {
   // AN INJECTED READER IS THE CALLER'S STATEMENT ABOUT HOW TO READ, and it outranks the platform.
   //
-  // Measured on macOS (, the verification run): the arm that pins the field-22
+  // Measured on macOS (the verification run): the arm that pins the field-22
   // parse hands this function its own `readStat` and asserts the parse. With the platform deciding
   // first, that injection was silently ignored off Linux and the arm read `null` — the seam was there
   // and nothing went through it. A caller that supplies a reader is not asking which box this is.

package/driver/common-law-receipts.mjs

@@ -614,7 +614,7 @@ export function splitGridSpec(spec, { outputPaths = {}, dispositionsPaths = {} }
       // — `dispositions_path` is DICTATED here, never inferred downstream. The grid tool renders it
       // into the obligations block it hands the seat, and the validator reads the same file; deriving the
       // name in two places is the drift this codebase has paid for twice. Absent ⇒ the tool names
-      // no file and the seat is judged on prose alone, which is exactly the pre- behaviour.
+      // no file and the seat is judged on prose alone, which is exactly the pre-change behaviour.
       // — the half's OWN form path, ALWAYS set explicitly. The spread above carries the canonical
       // spec's connotation object verbatim, and since the canonical spec started carrying its own
       // dispositions_path a conditional override would let a half INHERIT the canonical path whenever the

package/driver/commonlaw-carry.mjs

@@ -491,7 +491,7 @@ export function commonLawCarryEvent({ trigger = null, artifact = null, reason =
 
 // ── THE RECONCILIATION, AS TWO RATES WITH THEIR ARITHMETIC ATTACHED ───────────────────────
 //
-// 's measurement: of 2116 retrieved common-law candidates, 1609 carried no ground at all, and 253
+// That measurement: of 2116 retrieved common-law candidates, 1609 carried no ground at all, and 253
 // of 292 candidate-bearing cells lacked the negative row the dictation owes each of them. The
 // discriminator was never in doubt — 272 rows carry `step-stated` against 1609 `absent`, so the
 // instrument distinguishes. Nothing compared it to anything.

package/driver/config-inventory.mjs

@@ -388,7 +388,7 @@ export function caseLawInventory(env = process.env) {
   // EUR-Lex reads through the engine's own fetch tool, so there is nothing to configure and nothing that
   // can be missing. It is LISTED anyway: a reader counting case-law sources against a report that named
   // four gaps must be able to find all four here, and a lane that is absent from this page is
-  // indistinguishable from one nobody has heard of. 's fifth criterion.
+  // indistinguishable from one nobody has heard of. That fifth criterion.
   rows.push({
     key: "caselaw", label: "Case law and oppositions", provider: "eur-lex",
     providerLabel: CASELAW_LABELS["eur-lex"],

package/driver/connotation-search.mjs

@@ -18,7 +18,7 @@
 //      citing the receipt. A PR/reputational section that ASSERTS a clean result must additionally cite a
 //      Connotation-search source line. A searched-clean (recorded queries, empty results) passes.
 //
-// ARMING (, owner's ruling 2026-08-04 — "arm on data, never on prose"): the disposition join, the
+// ARMING (owner's ruling 2026-08-04 — "arm on data, never on prose"): the disposition join, the
 // recurrence floor and the did-the-search-run check all arm on `opts.recorded` being passed, which the
 // caller keys on the grid-spec's `connotation.disposition_required` stamp — a structural fact the DRIVER
 // writes and no model can redraft away. They used to arm on a phrase match over the model's own prose
@@ -138,7 +138,7 @@ export const MEANING_ANGLES_RE = /^[ \t]*(?:[-*]\s+)?meaning angles\s*[:—-]\s*
 // gap row. Verified on E2E's preserved R1 run of 2026-08-13 (test build 4353a74): 61 dictated, 61 receipts, 0 gaps, one
 // dictated query unrecorded and one recorded query never dictated — the same angle, minus the quote. The
 // merge threw `deterministic`, the ladder correctly refused to retry, and the run died at common-law after
-// 26m15s with nothing delivered and the whole gather already paid for. 's class, inverted: the driver
+// 26m15s with nothing delivered and the whole gather already paid for. That class, inverted: the driver
 // corrupted a well-formed model output.
 //
 // THE RULE: peel an outer pair only when both ends carry the SAME quote character AND the interior carries
@@ -469,7 +469,7 @@ export function livePassages(snippet) {
 export function usableSnippet(s) { return quoteWeight(s) >= QUOTE_MIN; }
 
 // ── — WHY A QUOTE DID NOT BIND, NOT MERELY THAT IT DID NOT ──────────────────────────────────────
-// `quoteJoins` is a predicate and stays one: its answer is the gate's, and 's comment thread withdrew
+// `quoteJoins` is a predicate and stays one: its answer is the gate's, and the comment thread withdrew
 // loosening it. What was missing is the REASON, and the reason is the whole.
 //
 // R6 (Full country search into China) died after four dispatches, byte-identical, on
@@ -1326,7 +1326,7 @@ export function renderConnotationObligations(ob, { ledgerPath = "your half ledge
       // The ordinal is 1-based and per-row, matching `receipt_index` on the form exactly — the seat is
       // never asked to hold two different numbering schemes at once.
       //
-      // THE REAL IDS STAY. 's acceptance is that the gate cannot fail a seat for an obligation the
+      // THE REAL IDS STAY. That acceptance is that the gate cannot fail a seat for an obligation the
       // tool result never named, and these are what a failure names. What was removed is the METAVARIABLE
       // and the instruction to cite one — a model shown `R-XXXXXXXX` writes `R-RECEIPT`, whereas a model
       // shown a list of real ids it is told not to type has nothing to pattern-match.
@@ -1493,7 +1493,7 @@ export function meaningSweepReceiptsInstruction({
     //
     // Keyed on the OBLIGATIONS now, which is the thing the sentence is actually about. Same family as
     // the rest of this bundle: a decision taken on a surface token while the thing itself says the
-    // opposite ('s axis outcome, 's status code, 's trailing default, 's deleted arm).
+    // opposite (the axis outcome, the status code, the trailing default, the deleted arm).
     ...(mayOwnNoQueries ? ["Your half may own zero meaning queries. If so the grid tool lists you no"
       + " obligations, and recording nothing is the complete and correct outcome for you — do not invent"
       + " rulings and do not create any dispositions file."] : []),
@@ -1525,7 +1525,7 @@ export function renderDispositionTable(rows, ob) {
   // The park broke that premise. A parked row is undecided AND the stage completes, so the document IS
   // delivered — and `ruling` is null on it, so this filter silently dropped it. The reader received a
   // table that looks complete, with the one obligation nobody could decide simply absent. No gap, no
-  // marker, nothing to notice. That is 's lying receipt reached by the shortest path there is.
+  // marker, nothing to notice. That is the lying receipt reached by the shortest path there is.
   //
   // Rendered as its OWN block rather than as rows of the ruling table, deliberately: an undecided row
   // sitting in a column headed "Ruling" is read as a ruling, whatever the cell says.
@@ -1595,7 +1595,7 @@ const NO_POLICED_SECTION = "(no PR / reputational / connotation section)";
 // that did not RUN is a different failure from a sweep that was not ruled on, and keeping them apart is
 // what makes the warm lane safe (gateway.mjs WARM_ELIGIBLE_RE).
 //
-// 's lesson survives the collapse and is the reason `form_damaged` is not folded into `no_ruling`:
+// That lesson survives the collapse and is the reason `form_damaged` is not folded into `no_ruling`:
 // the gate must never destroy a completed clearance by conflating "did not do the work" with "wrote the
 // answer in a shape that did not bind". Under the form the second class is a two-field correction the
 // seat can finish, and the union means the rest of its work cannot be lost while it makes it.
@@ -1622,7 +1622,7 @@ const NO_POLICED_SECTION = "(no PR / reputational / connotation section)";
 //
 // It is its own reason and not a `detail` on `no_ruling` because the two have different remedies and the
 // hint is routed on the token: "add a ruling" sent to a seat that has ruled is a closed loop.
-// CARRIES THE SAME ARGUMENT ONE CLAUSE FURTHER, ON THE EVIDENCE THAT 's FIX DID NOT REACH.
+// CARRIES THE SAME ARGUMENT ONE CLAUSE FURTHER, ON THE EVIDENCE THAT the FIX DID NOT REACH.
 // R6 died three times on `no_ruling=75` over a 75-row form. The seat held a 144-line findings document it
 // had just written, was told "75 rows carry no ruling", saw 75 rulings in the document in front of it, and
 // changed nothing. It had written THE WRONG ARTIFACT: the disposition form was the deliverable and the
@@ -1631,7 +1631,7 @@ const NO_POLICED_SECTION = "(no PR / reputational / connotation section)";
 // findable. `no_ruling` fires identically whether a row carries no ruling token, a ruling with no
 // receipt, or NOTHING AT ALL because the form was never opened, and those have different remedies.
 //
-// THE SPLIT IS STRICTLY NARROWER, exactly as 's was. Every state below failed before and fails now;
+// THE SPLIT IS STRICTLY NARROWER, exactly as the was. Every state below failed before and fails now;
 // `no_ruling` survives as the residual so nothing can fall out of the vocabulary. The whole-population
 // collapse states of the retired hand-edited form (`form_untouched`, `form_unparseable`) died with the
 // form path — their subject matter is carried by the call audit's own states below, read from the run's
@@ -1852,7 +1852,7 @@ export function obligationRows(ob, { spotChecks = QUOTE_SPOT_CHECKS } = {}) {
   // `segmentBinding` through the same `snippetSegments`. One derivation, both ends — the display and the
   // check cannot disagree, which they would the moment either recomputed its own split.
   //
-  // 's defect is the one this avoids, arriving from the other direction: a seat ordered to set a
+  // That defect is the one this avoids, arriving from the other direction: a seat ordered to set a
   // field it was never shown the values for. `receipt_index` is safe precisely because the candidate list
   // is in front of the seat; a segment ordinal is only safe on the same terms.
   //
@@ -1917,7 +1917,7 @@ export function obligationRows(ob, { spotChecks = QUOTE_SPOT_CHECKS } = {}) {
 /**
  * Find meaning-sweep obligations the seat has not ruled on, and a dictated sweep that never ran.
  *
- * ARMED ON DATA, NEVER ON PROSE (, owner's ruling 2026-08-04). `opts.recorded` being passed is the
+ * ARMED ON DATA, NEVER ON PROSE (owner's ruling 2026-08-04). `opts.recorded` being passed is the
  * whole arming condition and it is UNCHANGED by — the caller keys it on the grid-spec's own
  * `connotation.disposition_required` stamp, a structural fact the DRIVER writes and no model can redraft
  * away. Two consequences, both deliberate and both load-bearing:
@@ -2066,7 +2066,7 @@ export function findConnotationViolations(commonLawContent, prRiskCount = 0, { r
     //
     // The order is load-bearing: this is reached ONLY when the row is otherwise ruled, so a genuinely
     // unruled row can never be reported as a quote problem. `quote_unbound` cannot mask missing work —
-    // it is strictly narrower than the state it splits off from, which is what 's warning demands.
+    // it is strictly narrower than the state it splits off from, which is what the warning demands.
     const otherwiseRuled = s
       && RULING_SET.has(String(s.ruling ?? "").trim().toLowerCase())
       && String(s.note ?? "").trim()

package/driver/contract-audit.mjs

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
-// contract-audit.mjs — the machinery behind 's E1, E2 and E3 checks.
+// contract-audit.mjs — the machinery behind the E1, E2 and E3 checks.
 //
 // PURE and OFFLINE, like coverage-ledger.mjs and findings-model.mjs: it reads source text and the
 // declarations, and it computes. Nothing here runs on a clearance — no pipeline path imports it and no
@@ -92,7 +92,7 @@ export function arm1Unaccounted(stages) {
 /**
  * ARM 2 — a declared element no validator token speaks about. A RATCHET, not a red build.
  *
- * The owner's ruling (, 2026-08-13) is four conditions, and they are the ruling rather than
+ * The owner's ruling (2026-08-13) is four conditions, and they are the ruling rather than
  * suggestions: the baseline is PER STAGE and carries the ELEMENT NAMES (it is the audit object, not a
  * bare count); CI fails on any per-stage INCREASE so a new hole cannot hide behind a fix elsewhere; arm 1
  * is exempt from the ratchet; and wave 1's moves are expected to move the number.
@@ -157,10 +157,10 @@ const ARROW_TOKEN_RE = /=>\s*[`"']([a-z][a-z0-9]*(?:_[a-z0-9]+)+)/g;
 // nothing re-deriving them — `acceptMatterFrame` mints eight tokens against a row documenting three.
 const REASON_TOKEN_RE = /reason:\s*[`"']([a-z][a-z0-9]*(?:_[a-z0-9]+)+)/g;
 
-// tracker issue 1211 — A CITED SITE MUST BE A MINT. The extractor records the FIRST line a pattern matched, and the
+// A CITED SITE MUST BE A MINT. The extractor records the FIRST line a pattern matched, and the
 // patterns read comment text as readily as code: `no_status` was cited at coverage-form.mjs:802, the
 // JSDoc `@returns {Array<{reason:"no_status"|"form_damaged", …` annotation seventeen lines above the line
-// that writes it. Every tracker issue 1211 ruling cites its mint, so a citation drawn from a sentence about the code
+// that writes it. Every such ruling cites its mint, so a citation drawn from a sentence about the code
 // is a ruling about a sentence.
 //
 // Comment-ONLY lines, never a trailing `//` after code — a token minted on a line that also carries a
@@ -363,7 +363,7 @@ export function stageSourceBlocks(stagesSource) {
 }
 
 /**
- * MECHANICAL **AND** UNSPOKEN-FOR — the highest-value target set for 's moves.
+ * MECHANICAL **AND** UNSPOKEN-FOR — the highest-value target set for the moves.
  *
  * An element in this set is not the model's judgment AND no validator polices it: nothing catches it
  * going wrong, and nothing about it needs a model. Every one is a candidate for the moves, and the set

package/driver/contract-dictation-registry.mjs

@@ -90,7 +90,7 @@ export function knownToolNames() {
  * The intersection is fail-closed on the PROVIDER axis — signa exposes two register tools where
  * corsearch exposes eight — and it duly produced 19 hits saying the register doctrine orders
  * `register_enumerate`, which signa does not carry. Every one of those is true and none of them is
- *: they are findings about a vendor's capability envelope, which 's deferral contract already
+ *: they are findings about a vendor's capability envelope, which the deferral contract already
  * owns and states on the coverage form. Folding them in here would bury the grant/doctrine mismatch
  * this contract exists for under a vendor-capability report nobody asked E12 for.
  */
@@ -101,9 +101,9 @@ export function grantedToolsFor(stage) {
   return out;
 }
 
-// ── 's members: two were known, TEN are real ────────────────────────────────────────────────────
+// ── the members: two were known, TEN are real ────────────────────────────────────────────────────
 //
-// E3's precedent, and 's rule under it: "a lint that greenlights every existing hole certifies the
+// E3's precedent, and the rule under it: "a lint that greenlights every existing hole certifies the
 // problem" — so the lint holds the line and the BACKLOG names what is already there, each entry saying
 // which move removes it. rejects "a whitelist of the two known members as the route to green", and
 // this is not that: it is the measured population, which is FIVE TIMES the two members was filed
@@ -209,7 +209,7 @@ export function contracts() {
     //
     // SCOPED TO THE BACKTICKED FIELD NAME, and the loose form was measured before choosing: `/\banchor\b/`
     // fires 52 times across the served corpus against 10 for this pattern, because `anchor` is also a link
-    // anchor ('s subject) and a variant anchor. A pattern whose extra 42 hits would have to be
+    // anchor (the subject) and a variant anchor. A pattern whose extra 42 hits would have to be
     // excused is a pattern kept green by exemptions rather than by fixes — the whitelist route
     // forbids, arriving as a regex instead of a path filter. `anchor-owed` is in because the corrective
     // ladder ORDERS it in exactly that spelling.

package/driver/contract-dictation.mjs

@@ -6,7 +6,7 @@
 // and computes. Nothing here runs on a clearance. The impure edge — building the corpus out of the
 // tracked tree — is scripts/contract-dictation-scan.mjs, and the split is not tidiness:
 //
-//   's hardest acceptance is "plant a divergence in a NEW authoring layer — the check must find it
+//   That hardest acceptance is "plant a divergence in a NEW authoring layer — the check must find it
 //   STRUCTURALLY, not because the layer was enumerated". A checker that reads the tree itself can only
 //   be tested by writing a file into the working tree, which is dirty, fights the repo-hygiene guards,
 //   and — because `git ls-files` is the corpus — may not even be visible to the check being tested.
@@ -52,7 +52,7 @@
 //
 // Whether `/` opens a regex or divides is decided by the previous significant character, which is the
 // standard heuristic and is exact for everything in this tree (a `/` after a value divides; after
-// `( , = : [ ! & | ? { } ; return` it opens a pattern).
+// `(= : [ ! & | ? { } ; return` it opens a pattern).
 const REGEX_PRECEDERS = new Set(["(", ",", "=", ":", "[", "!", "&", "|", "?", "{", "}", ";", "\n", "+", "-", "*", "%", "<", ">", "~", "^"]);
 
 /**

package/driver/contract-e3-backlog.mjs

@@ -5,7 +5,7 @@
 // E3 is "structure is returned, never emitted as text": CI fails a stage message containing a literal
 // JSON skeleton, an "EXACTLY these keys" clause, or a dictated line shape a parser re-parses. 74 such
 // sites exist today across the 19 stages and the skill files they read, so E3 cannot simply go red —
-// and it must not simply go green either. 's judging note applies verbatim:
+// and it must not simply go green either. That judging note applies verbatim:
 //
 //     "a lint that greenlights every existing hole certifies the problem."
 //
@@ -390,7 +390,7 @@ export const E3_BACKLOG = [
     kind: "dictated-line-shape",
     // ── (a) THE ORIGINAL SUBJECT WAS DELETED BY DESIGN — DISCHARGED, NOT FAILED. This row quoted
     // "ARM 2 — a run with NO coverage form … Write one row per coverage unit | Coverage unit | Status |
-    // Reason |". M6 (, 2026-08-14) deleted the code arm and (cdf38676) deleted this
+    // Reason |". M6 (2026-08-14) deleted the code arm and (cdf38676) deleted this
     // skill-file half two days later — exactly the both-sites deletion this row's removedByMove
     // demanded. `git grep "ARM 2"` on the skill file returns nothing. Its evidence sat in
     // E3_EVIDENCE_UNRESOLVED from the day the checker landed; per the ruling the row is
@@ -435,7 +435,7 @@ export const E3_BACKLOG = [
     reparsedBy: "driver/verify.mjs validators.frameDiff + driver/pipeline.mjs runSupplementalSweeps (the parser REFUSES a firing variant directive that dictates nothing dispatchable)",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
-  // DISCHARGED by 's third conversion. The row described SKILL.md's "Then ALSO save the STRUCTURED
+  // DISCHARGED by the third conversion. The row described SKILL.md's "Then ALSO save the STRUCTURED
   // diff … a JSON OBJECT with EXACTLY these keys" skeleton, and that order is gone: the seat calls
   // `record_frame_diff` and the driver serializes the object. What replaced it in the doc is a field list
   // for a typed call, which is not a dictated skeleton — the schema owns those names, and a seat cannot
@@ -791,7 +791,7 @@ export const E3_BACKLOG = [
   // The third is the one worth pausing on: its `removedByMove` said "M2 — the quote half only; the closed
   // three-file enum survives". The enum did not survive the transport, because the transport removed the
   // FIELD it lived in rather than validating it — a schema that cannot express a bad value beats a
-  // validator that rejects one, which is 's ruling applied one lane over.
+  // validator that rejects one, which is the ruling applied one lane over.
 ];
 
 /** Entries with no move on the plan that removes them. */
@@ -804,7 +804,7 @@ export const E3_UNPLANNED = E3_BACKLOG.filter((e) => e.removedByMove === "NOTHIN
  * The registry's failure mode was that a MOVE could delete a dictation and leave the row: the count
  * then overstates the work, and the next agent spends a conversion slot on a hole already filled. Two
  * instances existed when this was written — M6's register-digest arm (deleted 2026-08-14, row survived)
- * and synthesis's disposition list (, deleted the same morning by the agent adding this check).
+ * and synthesis's disposition list (deleted the same morning by the agent adding this check).
  * Both are gone; this list is what remains.
  *
  * A BLANKET ASSERTION WAS THE OBVIOUS BUILD AND IT WOULD HAVE BEEN NOISE. Measured before choosing:
@@ -865,7 +865,7 @@ export const E3_EVIDENCE_UNRESOLVED = [
 /**
  * THE PER-SURFACE CENSUS, PINNED EXACTLY IN BOTH DIRECTIONS.
  *
- * 's urgency claim is that `tool-response` GROWS — one surface at a time, each move taking a row out
+ * That urgency claim is that `tool-response` GROWS — one surface at a time, each move taking a row out
  * of sight while the count stays plausible. A ceiling on that number would fail upward exactly as the E3
  * ceiling did: a surface that shrank would pass silently and leave room for a move nobody
  * recorded. So this is exact. A migration that moves a row from `stage-message` to `tool-response` turns

package/driver/contract-vocabulary.mjs

@@ -155,7 +155,7 @@ export const VOCABULARY = [
   // red on any that no row covers. That is the census working the way the previous conversion's gap
   // taught it to — skeptic's nine tokens were raised for two conversions before anything could see them.
   { token: "reportoverview_", stages: ["report-overview"], site: "driver/report-overview-record.mjs acceptReportOverview", family: "driver/report-overview-record.mjs", dynamic: "D3" },
-  // Conversion 5's transport family. Declared in the SAME commit as the module — 's extractor reads
+  // Conversion 5's transport family. Declared in the SAME commit as the module — the extractor reads
   // the acceptance boundary, so `report-card-record.mjs` is read for the `reason:` shape and the E2
   // soundness tripwire sees every `reportcard_*` token the moment it exists.
   { token: "reportcard_", stages: ["report-card"], site: "driver/report-card-record.mjs acceptReportCard", family: "driver/report-card-record.mjs", dynamic: "D3" },
@@ -396,7 +396,7 @@ export const TRIPWIRE_OUT_OF_SCOPE = [
  * nothing.
  *
  * WHY NOT A VOCABULARY ROW. A row asserts "this stage emits this token", and for all nineteen of these
- * that assertion is false. 's own judging condition forbids writing it: *no row claims a stage emits
+ * that assertion is false. its own judging condition forbids writing it: *no row claims a stage emits
  * a token that stage cannot emit*.
  *
  * WHY NOT A BARE EXEMPTION. An out-of-scope rule excuses a token and asserts nothing, so it cannot fail.
@@ -541,7 +541,7 @@ export const COVERED_SOURCES = [
  */
 
 /**
- * The tables whose rows carry a citation — the population 's symbol arms walk.
+ * The tables whose rows carry a citation — the population the symbol arms walk.
  *
  * Named once, here, rather than retyped in the test: a fifth table added later and missed by a hand-typed
  * list would be unchecked while every arm stayed green. The test asserts this map's own membership too,

package/driver/corrections-feedforward.mjs

@@ -3,7 +3,7 @@
 // corrections-feedforward.mjs — the reviewer's flags reach the corrective pass as DATA, and the recheck
 // is handed what the driver OBSERVED rather than being asked to re-read two documents.
 //
-// 's first acceptance criterion is that a BLOCKING-verdict full re-run becomes structurally
+// That first acceptance criterion is that a BLOCKING-verdict full re-run becomes structurally
 // impossible. `docs/design/clearance-critical-path.md` §4 bounds how that can be built: refutation cannot
 // run before synthesis (`stageInputs["narrative-refutation"]` includes the narrative, and dependencyOrder
 // derives the edge mechanically), so the lever available is the CHANNEL the reviewer already writes into

package/driver/coverage-form-io.mjs

@@ -14,10 +14,10 @@
 // written by runDigest on every pass that will actually run, is already the arming key for the off-enum
 // gate, and is already declared in stage-context.VALIDATOR_SIDECARS. adds `form_required: true` and
 // `form_path` to it rather than minting a second stamp, so there is one answer to "was a form required
-// on this run" and archived runs — which carry either no sentinel at all or a pre- one with no
+// on this run" and archived runs — which carry either no sentinel at all or a pre-change one with no
 // `form_required` — leave the whole coverage-form arm OFF and never flip a replay verdict.
 //
-// THE WRITE ORDER IS LOAD-BEARING AND IT IS STAMP FIRST. 's form write is best-effort and only
+// THE WRITE ORDER IS LOAD-BEARING AND IT IS STAMP FIRST. That form write is best-effort and only
 // note()s on failure, and its own comment names the outcome it fears: "an absence reading as a pass,
 // which is the one outcome this file exists to refuse". It is reachable — a full disk fails as "artifact
 // absent", not as a disk error. Writing the FORM first and the stamp second reproduces that hole: a

package/driver/coverage-form.mjs

@@ -22,7 +22,7 @@
 // PURE — no node imports, so it tests offline, exactly like coverage-ledger.mjs and connotation-search.mjs
 // (whose headers state the same rule for the same reason). `shortId` is IMPORTED from connotation-search
 // rather than re-implemented: it is a generic fnv1a64 id stamp, and a second copy of an id function is
-// two calculations kept in step, which is 's defect.
+// two calculations kept in step, which is the defect.
 //
 // ONE CALCULATION, NOT TWO. `openBlocksByAxis` (register-plan.mjs) computes the open crowd blocks — the
 // same C2..C7 conditions the deleted gate computed, unchanged — and it is called EXACTLY ONCE per pass,
@@ -108,7 +108,7 @@ export const SEAT_ROW_FIELDS = Object.freeze(["kind", "axis", "unit", "status",
 /**
  * WHAT A SEAT ROW OWES, written INTO the accumulator (and told to the seat in the dispatch brief and
  * the tool's own refusals — the seat no longer opens this file). The allowed axis set is not prose
- * about the file, it is a field OF the file: 's finding was "a fact obeyed as a failure and
+ * about the file, it is a field OF the file: the finding was "a fact obeyed as a failure and
  * ignored as an input", and a closed vocabulary the seat must hit and is never shown is exactly that.
  * PURE data.
  *
@@ -474,7 +474,7 @@ export function coverageFormRows({ skeleton = [], activeAxes = null, plan = null
       // the receipt should be able to tell which of the two a run carried.
       deferred_offices: (Array.isArray(plan?.deferred_coverage) ? plan.deferred_coverage : []).length,
       // AN ABSENCE IS A FINDING, RECORDED IN THE ARTIFACT. An axis whose band would not parse
-      // contributes NO open-block rows, exactly as the pre- gate's per-axis catch did — a band
+      // contributes NO open-block rows, exactly as the pre-change gate's per-axis catch did — a band
       // parse defect is refused one stage earlier by validators.registerUnit. Naming the axes here
       // means the gap is visible on the form a reader opens instead of being a silent zero.
       bands_unreadable: [...(bandsUnreadable ?? [])],
@@ -568,7 +568,7 @@ export function coverageAbsenceGaps(parsed) {
 }
 
 /**
- * The sentence a lawyer reads where the ledger would be. NEVER an empty section: 's lesson one lane
+ * The sentence a lawyer reads where the ledger would be. NEVER an empty section: the lesson one lane
  * over — a heading with nothing under it asserts an absence it cannot explain, and a reader cannot tell
  * it from a run that swept nothing. This says which material was missing and, therefore, exactly what
  * the rest of the report does and does not rest on.

package/driver/coverage-ledger.mjs

@@ -108,7 +108,7 @@ export const CROWD_RULING_UNIT_GRAMMAR = `<axis> / ${CROWD_RULING_TOKEN} (<N> me
 // was accepted, carried through the union, passed the coverage gate, and blocked the run three gates
 // later over a ruling the seat had made. Both readers now call this, so call time and delivery time
 // cannot disagree about what a count is. That is the point of the function, not a tidiness: two copies
-// of this regex would let the refusal and the block drift apart, which is 's defect.
+// of this regex would let the refusal and the block drift apart, which is the defect.
 //
 // THREE ANSWERS, and the middle one is the whole reason the return is not a boolean:
 //   null  — the cell rules no crowd. Every other coverage row, and the overwhelming majority.
@@ -500,11 +500,11 @@ export function parseCoverageLedgerJson(raw, { allowedAxes = REGISTER_AXES, acti
   return rows;
 }
 
-// ── tracker issue 476 — `renderCoverageLedgerJson` IS DELETED, AND THE DIRECTION WITH IT ─────────────────────────
+// ── `renderCoverageLedgerJson` IS DELETED, AND THE DIRECTION WITH IT ─────────────────────────
 //
 // Map #3 code-derived this JSON FROM the model's `## Coverage ledger` prose, which was an improvement
 // (the model stopped authoring the JSON) that left the real source of truth where it was: a markdown
-// table the model wrote. Under tracker issue 476 the DRIVER-WRITTEN coverage form is the source and both the table
+// table the model wrote. The DRIVER-WRITTEN coverage form is the source and both the table
 // and this JSON are renders of it — coverage-form.renderCoverageLedgerJsonFromForm. There is no
 // prose→JSON direction left to keep, and keeping one would be the legacy path this build has none of.
 //

package/driver/coverage-union.mjs

@@ -21,7 +21,7 @@
 // is. This file mints no row, no id, no unit label and no definition of "settled": `coverageFormRows`
 // and `rowIsSettled` both come from coverage-form.mjs — the same code the GATE judges with. A union that
 // preserved a status the gate would refuse, or dropped one it would accept, would make the outstanding
-// count mean two different things in two places, which is 's defect exactly.
+// count mean two different things in two places, which is the defect exactly.
 
 import { coverageFormRows, rowIsSettled, seatFields, formRowKey, seatRows, SEAT_ROW_CONTRACT } from "./coverage-form.mjs";