clearotron 0.2.1 → 0.2.2

package/driver/declination-call.mjs

@@ -2,7 +2,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // declination-call.mjs — a record that reached the findings surface leaves it BY A STATED DECISION.
 //
-// ── THE DEFECT THIS CLOSES (, and 's half of the same seam) ────────────────────────────────
+// ── THE DEFECT THIS CLOSES (and the half of the same seam) ────────────────────────────────
 //
 // `record-carry.json` on R2 round `e48f7056` read `unreasoned: 0` and was telling the truth in the weak
 // sense only: every drop had a LABEL, and on 102 of them the label was inferred from where the record
@@ -70,7 +70,7 @@
 // that a note describing the material instead of stating a ground is the defect one artifact over.
 // Measured against seven realistic declinations before anything was built on it, that classifier refused
 // ALL SEVEN as `unclear` — including "already delivered as finding 4 under the EUIPO record for the same
-// proprietor". It is not a bug in the classifier. It answers a different question: 's notes must say
+// proprietor". It is not a bug in the classifier. It answers a different question: the notes must say
 // what could NOT BE ESTABLISHED about a charged rating, and a declination says why a record does not earn
 // a line. Two different speech acts, and a grammar built for one rejects the other on sight.
 //
@@ -210,6 +210,38 @@ export function contradictionFor(reason, row, scope) {
       + `own-right or duplicate-of-delivered.`;
   }
 
+  // ── ECONOMY IS NOT A REASON ABOUT A LIVE IN-CLASS MARK (owner ruling 2026-09-07) ─────────────────
+  //
+  // `not-worth-the-line` means "it fits none of the four manageable categories and is not relevant
+  // enough to drive the read". That is a statement about the REPORT'S BUDGET, not about the record. On a
+  // live registration inside one of the matter's own instructed classes it is the one thing the seat may
+  // not say: the reader is paying for a judgment about that mark, and "there was no room" is not one.
+  //
+  // Measured on the run that prompted the ruling: 26 of 49 declinations at this seam were this token,
+  // and two of the lawyer's own reference marks were among them — one carried on every earlier run.
+  //
+  // ✕ WHY THIS IS NOT THE REFUSAL THAT WAS REMOVED BELOW, and the difference is the whole reason it can
+  // stand. That one refused `unrelated-goods` and `off-field-not-major` on class overlap, fired on 170
+  // of 170 records, and made the ENGINE decide relatedness — the lawyer's call. This one refuses ONE
+  // token and leaves every substantive reason available. The seat may still decline this record: it may
+  // say the goods are unrelated, that it is off-field and not a major brand, that it is the applicant's
+  // own right, or that it is already delivered. What it may no longer do is decline it for taking up
+  // space. The refusal is about the SHAPE of the reason, not about whether the record is relevant, so
+  // the relatedness judgment stays exactly where it was.
+  //
+  // It does effectively retire this token for live in-class records, because the sweep is already scoped
+  // to the instructed classes. That was put to the owner as the consequence and ruled anyway.
+  if (reason === "not-worth-the-line" && isLive(row?.status) && shared.length) {
+    return `this record is ${String(row?.status ?? "").trim() || "live"} and sits in class `
+      + `${shared.join(", ")} — one of the matter's own instructed classes. "not worth the line" is a `
+      + `statement about the report's budget, not about this mark, and a live registration in an `
+      + `instructed class is never omitted for want of room. Either carry it, or decline it on something `
+      + `true of THIS MARK: unrelated-goods if its goods do not meet the matter's, off-field-not-major `
+      + `if it is off-field and not a major brand, an active dispute or a well-known enforcer, `
+      + `own-right if it belongs to the applicant, duplicate-of-delivered if the same right is already `
+      + `reported. Say what makes this mark distant, or give it its line.`;
+  }
+
   // THERE IS NO CLASS-OVERLAP REFUSAL, AND THE FIRST DRAFT HAD ONE. It refused `unrelated-goods` and
   // `off-field-not-major` over any record sharing one of the matter's filed classes, on the reasoning
   // that the driver holds both class lists and they disagree with the stated reason.
@@ -231,7 +263,7 @@ export function contradictionFor(reason, row, scope) {
 }
 
 /**
- * THE SEAM'S DECISION, AS A PURE FUNCTION — 's guarantee, in the one place it can be asserted.
+ * THE SEAM'S DECISION, AS A PURE FUNCTION — the guarantee, in the one place it can be asserted.
  *
  * `recordSynthesisSeam` is module-private in pipeline.mjs and always will be; it does file I/O and takes
  * a run context. The JUDGMENT it makes about each discarded record is this, and it is extracted so a test

package/driver/declination-duty.mjs

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // declination-duty.mjs — every record handed to synthesis left by a NAMED EXIT, or the run says which
-// ones did not. ('s missing half; the R2 round on is the incident.)
+// ones did not. (the missing half; the R2 round on is the incident.)
 //
 // THE RULE IS ALREADY DICTATED, AND IT WAS NEVER CHECKED. synthesis's own contract states it in one
 // line — "a record that reached your findings surface leaves this stage as a finding in findings.json

package/driver/deliver-trigger.sh

@@ -4,7 +4,7 @@
 # v2 (pure-MCP courier, docs/DELIVERY.md): the outbox carries EVERY requester-facing event — delivered
 # markers (body = the forwarding agent id) AND self-contained JSON packets (run-failed / intake-rejected /
 # duplicate-skipped / late-bind-ack, each with an "agent" field). For each DISTINCT agent named across
-# pending events, wake it ONCE to run the prelim-deliver skill, which routes everything over the ops MCP
+# pending events, wake it ONCE to run the clearotron-deliver skill, which routes everything over the ops MCP
 # (list_outbox_events → get_delivery_packet → send → mark_sent/ack_event).
 #
 # THE TRIGGER NEVER DELETES EVENTS: consumption belongs to mark_sent (delivered) and ack_event (the rest),
@@ -35,7 +35,7 @@ DRAIN_WAIT="${CLEAROTRON_OUTBOX_DRAIN_WAIT:-180}"
 # (openclaw models); set CLEAROTRON_OUTBOX_WAKE_MODEL="" to fall back to the agent default. `-` (not `:-`) so
 # an explicit empty value disables the override, while unset keeps the Haiku default.
 WAKE_MODEL="${CLEAROTRON_OUTBOX_WAKE_MODEL-anthropic/claude-haiku-4-5}"
-MSG="The trademark engine's outbox has pending events. Run the prelim-deliver skill now: list_outbox_events, route each event (delivered → get_delivery_packet + send VERBATIM + mark_sent; every other kind → relay its text + ack_event)."
+MSG="The trademark engine's outbox has pending events. Run the clearotron-deliver skill now: list_outbox_events, route each event (delivered → get_delivery_packet + send VERBATIM + mark_sent; every other kind → relay its text + ack_event)."
 
 # THE WALL, RESOLVED ONCE AND NAMED WHEN IT IS ABSENT (tracker issue 820).
 #
@@ -112,7 +112,7 @@ for agent in "${!by_agent[@]}"; do
     continue
   fi
 
-  echo "prelim-outbox: waking $agent to run prelim-deliver"
+  echo "prelim-outbox: waking $agent to run clearotron-deliver"
   # timeout(1) is the enforced wall: the 2026-07-04 incident proved the CLI's own --timeout does not
   # guarantee process EXIT (the agent turn finished; the process idled 19h and wedged the lane).
   # SIGTERM at 840s (inside the unit's TimeoutStartSec budget so the failure is OURS and logged),

package/driver/deploy-live-run-guard.mjs

@@ -37,7 +37,7 @@ function listDir(dir) {
  * Everything holding this deployment open, named.
  *
  * @param {object} a
- * @param {string} a.queueDirs  EVERY queue tree, not the one this box thinks it uses. 's lesson:
+ * @param {string} a.queueDirs  EVERY queue tree, not the one this box thinks it uses. That lesson:
  *                                a headless CLEAROTRON_QUEUE_DIR and the agent workspace queues are both
  *                                real, and a guard that reads one of them passes over work sitting in
  *                                the other.
@@ -66,7 +66,11 @@ export function liveRunHolds({ queueDirs = [], lockDir = null, isAlive = claimer
     const { names, error } = listDir(lockDir);
     if (error) unreadable.push({ path: lockDir, error });
     for (const n of names) {
-      if (!n.startsWith("slot-") || !n.endsWith(".lock")) continue;
+      // `draw-` alongside `slot-`: a direct --experiment invocation is work on this box and the guard's
+      // question is whether the box is busy, so a draw has to answer yes. It holds its own prefix rather
+      // than a run slot, because a run slot is admission-controlled and taking one would make a draw wait
+      // behind clearances — changing what a draw IS in order to fix what this can see.
+      if (!/^(slot|draw)-/.test(n) || !n.endsWith(".lock")) continue;
       let raw = null;
       try { raw = readFileSync(join(lockDir, n), "utf8"); } catch { continue; }   // released mid-scan
       const pid = Number(String(raw).split(":")[0]);

package/driver/dev-portal.mjs

@@ -373,7 +373,7 @@ export function startPortal({ poolRoot = null, port = 18899, host = "127.0.0.1",
       if (url.pathname === "/dev/enqueue" && req.method === "POST") {
         let body;
         try { body = await readJsonBody(req); } catch (e) { return sendJson(res, 400, { ok: false, error: e.message }); }
-        // `searchLevel` IS REFUSED, NOT DROPPED. This form offered a "Search level" menu (prelim · Depth 4
+        // `searchLevel` IS REFUSED, NOT DROPPED. This form offered a "Search level" menu (clearotron · Depth 4
         // / knockout · Depth 1) and posted the field to an assembler that stopped reading it, so picking
         // "knockout" enqueued a job naming no product at all and ran whatever the account default or the
         // request's own territories named — a silent product substitution at a live door, from a control

package/driver/disposition-call.mjs

@@ -145,7 +145,7 @@ export const CALL_REFUSALS = Object.freeze([
   "obstacle_absent",      // an obstacle was claimed with nothing said about what blocks the proof
 ]);
 
-// The proof-of-reading arms, and ONLY those. 's obstacle waives this duty and no other, so this set
+// The proof-of-reading arms, and ONLY those. That obstacle waives this duty and no other, so this set
 // is the exact boundary between "you have not proved you read it" and "you have not judged it" — derived
 // by prefix from the vocabulary above rather than retyped, so a new evidence arm joins it automatically
 // and a new judgment arm cannot wander in.
@@ -183,7 +183,7 @@ export const RETIRED_CALL_REFUSALS = Object.freeze([
 // and it must never appear in the same bucket, because the two demand opposite responses — one says
 // "change your answer", the other says "stop asking, it is ours".
 //
-// 's leading unproven hypothesis lives here. The accumulator's rows and candidates are REGENERATED
+// That leading unproven hypothesis lives here. The accumulator's rows and candidates are REGENERATED
 // on every pass, and `seatFields` re-resolves an already-resolved row against whatever the current pass
 // holds (`disposition-union.mjs:98`, which discards `resolveCandidate`'s `state`). If that second
 // resolution misses, a row the tool accepted lands with an empty receipt and reads as unruled. This
@@ -442,7 +442,7 @@ export function detectRulingDrift(ledger) {
  *
  * ── WHY THE TOTAL IS RETURNED TOO ───────────────────────────────────────────────────────────────────
  *
- * 's warning sits in this exact number: filtering it after a split reported
+ * That warning sits in this exact number: filtering it after a split reported
  * `obligationsNeverAddressed: 0` on the run that died owing 75. So the total comes back as its own field
  * and the two parts must sum to it. Nothing can go to zero without a companion number rising to meet it.
  *
@@ -822,7 +822,7 @@ export function validateDispositionCall(rows, recorded, { told = null } = {}) {
 /**
  * CAN THIS ROW'S EVIDENCE DEMAND EVER BE SATISFIED?
  *
- * — the agreement guard for the `evidence_owed` seam, and it is 's shape one module over. The
+ * — the agreement guard for the `evidence_owed` seam, and it is the shape one module over. The
  * demand (`quote_required`) is SET at form-build against candidates that carried text; the satisfaction is
  * enforced by `segmentBinding` against the candidate's snippet AS IT IS NOW. Between the two, candidates
  * regenerate. When they come back without quotable passages the flag survives and its justification does

package/driver/disposition-tool.mjs

@@ -19,7 +19,7 @@
 //   decided, which is the thing already in the record, rather than what we were given.
 //
 //   THE INDEX IS WRITTEN BY THE RECEIVER, NEVER BY THE CONSUMER. This handler writes both the payload and
-//   the line naming it, in that order, before it validates anything. 's three snapshot sites all
+//   the line naming it, in that order, before it validates anything. That three snapshot sites all
 //   discard their return, so no attempt row names its snapshot and correlation is by mtime — which is
 //   precisely how the union discard had to be diagnosed. A consumer-written index can only ever name the
 //   payloads the consumer got to; a call that dies mid-flight writes no index line, and its absence is
@@ -46,7 +46,7 @@ const CALLS_DIR = "disposition-calls";
 /**
  * The obligations sidecar — what the seat was TOLD it owed, written when the block was rendered.
  *
- * 's rule, applied to this filename: the path is derived ONCE and imported, never re-derived at the
+ * That rule, applied to this filename: the path is derived ONCE and imported, never re-derived at the
  * other end. perplexity-server.mjs writes this file and this module reads it; two spellings of one name
  * is the drift cost weeks, and the reader would fail OPEN — it would simply find no file, fall back
  * to the live derivation, and renumber the seat's page without anyone being told.
@@ -338,7 +338,7 @@ export function outstandingWithAnchors(canonicalRows, formRows) {
  * Record one typed call. The tool handler's core.
  *
  * `spec` is the DRIVER-WRITTEN grid spec — the same file the grid tool was given. The seat names no path
- * of its own: 's rule is that the path is the driver's, taken from the spec it wrote, because two
+ * of its own: the rule is that the path is the driver's, taken from the spec it wrote, because two
  * derivations of one filename is the drift that cost weeks.
  */
 export function recordDispositions(spec, received, { now = () => new Date().toISOString() } = {}) {
@@ -415,7 +415,7 @@ export function recordDispositions(spec, received, { now = () => new Date().toIS
   // accumulator" are two different facts and nothing compared them.
   //
   // This compares them, per call, and records any disagreement as OURS. It is deliberately not a throw:
-  // 's silent-drop hypothesis is unproven, and an instrument that crashes the run it is measuring
+  // That silent-drop hypothesis is unproven, and an instrument that crashes the run it is measuring
   // cannot measure it. If the count is always zero the hypothesis is dead and we will be able to say so
   // from the artifact — which is the point of building it before the cure.
   const landed = new Map((Array.isArray(u.form?.rows) ? u.form.rows : [])

package/driver/disposition-union.mjs

@@ -21,7 +21,7 @@
 // definition of "ruled" and — since the review of this build — no row LOOKUP either. `obligationRows`,
 // `formRowFinder` and `isRuled` all come from connotation-search.mjs, the same code the GATE
 // judges with. A union that preserved a ruling the gate would refuse, or dropped one it would accept,
-// would make the outstanding count mean two different things in two places, which is 's defect
+// would make the outstanding count mean two different things in two places, which is the defect
 // exactly: one calculation running twice, silently disagreeing, both copies looking correct. The lookup
 // had been written out twice — here and in the gate — and both copies carried the same punctuation defect.
 
@@ -160,7 +160,7 @@ export function unionDispositionForm(prior, submitted, ob, { half = null, genera
   const findSubmitted = formRowFinder(submitted, form.rows);
   // — a park is STICKY, for the same reason a ruling is. This module exists because the outstanding
   // count churned instead of shrinking (see the header): a park that could lift would let the count rise
-  // again, which is 's defect in new clothes. So the prior form's park is authority, and `parkedIds`
+  // again, which is the defect in new clothes. So the prior form's park is authority, and `parkedIds`
   // only ever ADDS.
   const newlyParked = new Set((parkedIds ?? []).map((x) => String(x ?? "").trim()).filter(Boolean));
   let ruled = 0, carried = 0, parked = 0;

package/driver/doc-constants.mjs

@@ -350,7 +350,7 @@ export const DOC_CONSTANTS = [
     doc: "providers/uspto-local/README.md",
     pattern: /last successful sync goes past (\d+) hours/,
   },
-  // The same figure, twice in the same file — 's shape, and the reason each occurrence is a row.
+  // The same figure, twice in the same file — the shape, and the reason each occurrence is a row.
   {
     constant: "FRESHNESS_HOURS.sync",
     source: { file: "providers/uspto-local/src/index-store.js", symbol: "FRESHNESS_HOURS.sync" },

package/driver/door-gates.mjs

@@ -97,7 +97,7 @@ export function gateResolvedRequest({ job = null, profile = null, resolved = nul
   // A resolution that could not be taken is not a refusal — see the fail-open note in the header.
   if (!resolved) return out;
   // A CLARIFY IS RELAYED VERBATIM. It is already an actionable sentence naming the selector that could
-  // not be honoured ("product \"prelim\" names no search we offer — one of: … (or omit it for the
+  // not be honoured ("product \"clearotron\" names no search we offer — one of: … (or omit it for the
   // account's default)"), and flattening it into a cause would lose the remedy clause.
   if (resolved.clarify) { out.errors.push(resolved.clarify); return out; }
   // deliveryRoute "portal" — DECLARED but not BUILT. It validates shape-wise, has no consumer (the
@@ -133,7 +133,7 @@ export function doorGates(job, opts = {}) {
   return { ...r, ...gateResolvedRequest({ job, ...r }, opts) };
 }
 
-// ── WHY tracker issue 216'S REFUSAL IS NOT ALSO A DOOR GATE ─────────────────────────────────────────
+// ── WHY THE CONFIGURED-TO-SEARCH REFUSAL IS NOT ALSO A DOOR GATE ─────────────────────────────────────────
 //
 // It was, briefly, and it was removed with a measurement rather than an opinion. Adding "is this box
 // configured to search at all" here reddened `driver/test/doors-agree.test.mjs` — nineteen arms green

package/driver/doubt-selection.mjs

@@ -2,7 +2,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // doubt-selection.mjs — which OPEN doubts the closure seat is asked about, chosen by the DRIVER.
 //
-// 's architecture, one lane over from profile-selection.mjs: "prefer driver selection wherever the
+// That architecture, one lane over from profile-selection.mjs: "prefer driver selection wherever the
 // key precedes the dispatch." The key is on the doubt before doubt-closure is dispatched, so there is
 // nothing here for a directive to ask a seat to judge — the driver lists the ids, and a doubt it does
 // not list is never mentioned.
@@ -68,7 +68,7 @@ export function keptTiersFor(doubtClosure) {
  * WHICH OF THE THREE SILENCES THIS IS. `keptTiersFor` returns null for `every-doubt` AND for a word it
  * does not know, deliberately — a typo must not silently drop every keyed doubt. But that makes the two
  * indistinguishable in the run's event: a misspelt cut records exactly what the shipped cut records, and
- * the product row looks graded while the dispatch is not. 's arm catches a bad word on the ROW; this
+ * the product row looks graded while the dispatch is not. That arm catches a bad word on the ROW; this
  * is the runtime face of the same question, on the run that actually happened.
  *
  * `hasOwnProperty` rather than a truthiness test on the lookup, because `TIER_CUTS[w]` reaches the

package/driver/drainer-identity.mjs

@@ -34,7 +34,7 @@
 import { readFileSync, writeFileSync, mkdirSync, renameSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { join, dirname } from "node:path";
-import { drainPosture, absentDrainerIsNormal } from "./drain-posture.mjs";   // tracker issue 206 — one rule about the box
+import { drainPosture, absentDrainerIsNormal } from "./drain-posture.mjs";   // one rule about the box
 
 export const STAMP_BASENAME = "_drainer-identity.json";
 

package/driver/driver.config.mjs

@@ -115,7 +115,7 @@ export const config = {
   // configured, because a whitespace-only string is TRUTHY in JavaScript — so a variable set to spaces
   // did not fall through to the default, it BECAME the path. `poolRoot` alone trimmed, so "blank" meant
   // two different things depending on which accessor you asked, and `queueDirs` resolved a RELATIVE
-  // queue directory under the process cwd, which is 's own incident shape.
+  // queue directory under the process cwd, which is its own incident shape.
   //
   // Owner ruling 2026-08-19: a whitespace-only value counts as UNSET, everywhere. `X=` already meant
   // "not configured" and this is that rule finishing its sentence — not a reversal of it, which
@@ -229,7 +229,7 @@ export const config = {
   /**
    * Every skills root handed to the engine's file tools (overlay + base, deduped).
    *
-   * NAMED FOR WHAT IT IS, not what we want it to be (, 2026-08-14): it was `skillsReadRoots`, and the
+   * NAMED FOR WHAT IT IS, not what we want it to be (2026-08-14): it was `skillsReadRoots`, and the
    * engine passes it to `--add-dir`, which has no read-only form. The read-only INTENT is real and is
    * enforced by the deny-hook at driver/engine/deny-authority-write.mjs — not by this name.
    */
@@ -252,7 +252,7 @@ export const config = {
   get skillsRoot() { return dirname(this.skillsDir); },
 
   // ── Per-agent paths ───────────────────────────────────────────────────────
-  // A prelim job is enqueued into the FORWARDING agent's OWN workspace queue (that agent's `write` tool
+  // A clearotron job is enqueued into the FORWARDING agent's OWN workspace queue (that agent's `write` tool
   // is sandboxed there), and we run the whole pipeline as that same agent so the reply tool
   // (`clawdi_send_<user>`), the run-dir, and the agent's memory all line up. The queue LOCATION therefore
   // encodes the agent identity — the driver derives {agentId, studioRoot} from where it claimed the job,
@@ -269,6 +269,13 @@ export const config = {
   },
   // Escaped prefix for the reverse regexes below (a custom prefix may carry regex metachars).
   get workspacePrefixRe() { return this.workspacePrefix.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); },
+  // `prelim-search` IS NOT A PRODUCT NAME HERE and does not follow the product rename. It is a
+  // directory segment on disk, and every archived run — its slug dirs, its `archive/`, its matter
+  // ledger — was written under it. Renaming the segment does not move those runs; it points the
+  // reader somewhere empty, and an empty directory reads as "no runs" rather than as an error.
+  // The rule the tree already enforces elsewhere: a token that is read back out of an archive keeps
+  // its old spelling, or the code refuses its own archive. Thirteen sites compute this segment and
+  // all thirteen stay.
   studioRootForAgent(agentId) {
     return join(this.workspaceRoot, this.workspaceDirName(agentId), "studio", "prelim-search");
   },
@@ -283,7 +290,7 @@ export const config = {
     const m = new RegExp(`(?:^|/)${this.workspacePrefixRe}([^/]+)/studio/prelim-search/queue/?$`).exec(qdir);
     return m ? m[1] : null;
   },
-  // Every agent workspace's prelim queue. The systemd `.path` watches these and the runner drains ALL of
+  // Every agent workspace's clearotron queue. The systemd `.path` watches these and the runner drains ALL of
   // them on each trigger (+ a timer fallback), so a request from ANY forwarder runs. (Pre-fix the watcher
   // and runner only looked at workspace-clawdi, silently orphaning every Alex/Sam job — the bug this fixes.)
   //
@@ -485,7 +492,7 @@ export const config = {
   // jobs AND manual pipeline.mjs invocations alike. WS-C raised the V4-7 stopgap's 1 → 3 (one per agent).
   // Phase-4: 3 → 6 + per-agent admission LIFTED (pipeline.acquireRunSlot no longer tags by agent). The
   // 2026-06-12 starvation that forced one-run-at-a-time (parallel runs → every gateway lane busy → 75s
-  // heartbeat timeouts → a lost mid-run reply) was a GATEWAY phenomenon; prelim COMPUTE now runs off the
+  // heartbeat timeouts → a lost mid-run reply) was a GATEWAY phenomenon; clearotron COMPUTE now runs off the
   // gateway on the standalone claude -p engine, so concurrent runs no longer starve the heartbeat. The TURN
   // cap below still bounds the (now light) intake/delivery gateway demand. The runner serializes only the
   // cheap claim+dedup per queue and runs pipelines concurrently up to this cap (same-matter dedup stays
@@ -493,14 +500,22 @@ export const config = {
   // if the env is unset — keep the two in sync). Set to 2 on 2026-06-18 (was 6): 2 parallel is enough for now,
   // and bounds Max-5x rate-limit thrash. To change the live cap, set the env on the VM (no code deploy needed).
   get maxConcurrentRuns() { return Math.max(1, numericSetting("CLEAROTRON_MAX_CONCURRENT_RUNS")); },
+  // ON-DISK NAME, NOT A PRODUCT NAME: an install that never set the variable is already using this
+  // directory, so renaming the default moves the install to an empty one and nothing migrates. Here
+  // the orphaned files are run-slot locks, so a live run's slot goes unseen and the global cap is
+  // silently exceeded rather than enforced. Owner ruling, tracker issue 308.
   get runLockDir() { return this.envValue("CLEAROTRON_RUN_LOCK_DIR") || join(this.workspaceRoot, "prelim-run-locks"); },
 
   // Delivery outbox (Workstream B). On a handoff-mode finish the driver drops <runId>.pending here (naming
-  // the forwarder agent); the systemd-user prelim-outbox.path unit fires an INSTANT prelim-deliver wake off
+  // the forwarder agent); the systemd-user prelim-outbox.path unit fires an INSTANT clearotron-deliver wake off
   // it, so a finished run sends in seconds instead of waiting ≤55m for the HEARTBEAT completion-watch (which
   // stays as the backstop). Mirrors runLockDir's derivation; env-overridable for dev/prod parity.
   // Phase 2: the outbox is ALSO the event seam for every other requester-facing event (run-failed,
   // intake-rejected, duplicate-skipped, late-bind-ack) — self-contained JSON packets via outbox.mjs.
+  // ON-DISK NAME, NOT A PRODUCT NAME: an install that never set the variable is already using this
+  // directory, so renaming the default moves the install to an empty one and nothing migrates. Here
+  // the orphaned files are requester-facing events — delivered, run-failed, intake-rejected — so the
+  // visible failure is a requester never told their run finished. Owner ruling, tracker issue 308.
   get outboxDir() { return this.envValue("CLEAROTRON_OUTBOX_DIR") || join(this.workspaceRoot, "prelim-outbox"); },
 
   // ── Delivery/comms (Phase 2, standalone product) ─────────────────────────────────────────────────
@@ -516,8 +531,25 @@ export const config = {
 
   // Fallback execution agent when a job's origin agent can't be derived from its queue dir (shouldn't
   // happen in normal operation). The real per-run agent is the forwarding agent, derived from the queue
-  // LOCATION (see studioRootForAgent / agentIdFromQueueDir above). `clawdi` carries all the prelim tools.
-  get defaultAgent() { return process.env.CLEAROTRON_DEFAULT_AGENT || "clawdi"; },
+  // LOCATION (see studioRootForAgent / agentIdFromQueueDir above).
+  //
+  // THE DEFAULT IS PART OF A PATH, so changing it moves where an install looks for its own runs:
+  // every run dir is `<workspaceRoot>/workspace-<agent>/studio/prelim-search/…`. An install created
+  // before this default changed keeps its runs under the old id and must pin it — both spellings,
+  // because the gather servers read their own variable:
+  //
+  //     CLEAROTRON_DEFAULT_AGENT=clawdi
+  //     CLEAROTRON_GATHER_AGENT=clawdi
+  //
+  // Unpinned, such an install starts a fresh empty workspace and its existing runs read as absent
+  // rather than as an error. Said again where upgrades are described (INSTALL.md, ops runbook).
+  //
+  // THE ID IS ALSO A KEY, not only a path segment. `AGENT_WHATSAPP` in stages.mjs is keyed by agent
+  // id, so the demo roster has to carry this value or the reference deployment resolves no operator
+  // number and the hole reads as "no copy configured" rather than as a miss. Both ids are in that
+  // roster for the same reason the pin above exists. (The roster stays one line: 32 backlog rows
+  // cite line numbers in stages.mjs, so a comment added there repoints all of them.)
+  get defaultAgent() { return process.env.CLEAROTRON_DEFAULT_AGENT || "localagent"; },
 
   // Per-stage retry budget (fresh session key per retry).
   get maxRetries() { return numericSetting("CLEAROTRON_MAX_RETRIES"); },
@@ -612,6 +644,26 @@ const MODEL_FAMILY_RE = /(?:^|\/)(?:claude-)?(opus|sonnet|haiku)(?:[-.]|$)/i;
 // mini one would then read as agreement, which is exactly the corruption this gauge exists to catch.
 const OPENAI_ID_RE = /^(?:openai\/)?(gpt-[\w.-]+|o\d[\w.-]*)$/i;
 const DATE_SUFFIX_RE = /-(?:\d{8}|\d{4}-\d{2}-\d{2})$/;
+
+/**
+ * Is this model id a DATED SNAPSHOT, or an undated alias that a provider may repoint?
+ *
+ * `modelBasis: "actual"` says the provider answered rather than that we guessed — it does not say the
+ * answer names a fixed build. Measured across three archived runs: haiku came back
+ * `claude-haiku-4-5-20251001`, opus and sonnet came back `claude-opus-5` and `claude-sonnet-5`. All
+ * three were recorded identically as observed, and two of them name something the provider can move
+ * underneath us. A snapshot rotation behind either alias between two runs leaves EXACTLY that record and
+ * is invisible, which is how an A/B across time ends up eliminating the seat on evidence that could not
+ * have shown it either way.
+ *
+ * Returns "snapshot", "alias", or null when there is no id to judge — null is a could-not-look and is
+ * never collapsed into "alias". PURE.
+ */
+export function modelSnapshotKind(model) {
+  const id = String(model ?? "").trim();
+  if (!id) return null;
+  return DATE_SUFFIX_RE.test(id) ? "snapshot" : "alias";
+}
 export function modelFamily(model) {
   if (!model) return null;
   const resolved = resolveModel(String(model));
@@ -714,7 +766,7 @@ export const REGISTER_PROVIDER = (() => {
 // created this constant, so neither branch's tests covered it — it surfaced from reading the two diffs
 // side by side, not from a red run.
 //
-// SIX values now: 's `free-tier` composes the two free sources into ONE register, so an EU+US
+// SIX values now: the `free-tier` composes the two free sources into ONE register, so an EU+US
 // clearance needs no paid vendor. It is a TIER, not a fourth free source — precedence runs between
 // tiers, never within one: a paid vendor configured IS the register alone, and the free sources are not
 // run beside it (corsearch and clarivate already aggregate both offices, so the second call buys
@@ -1314,7 +1366,7 @@ export const PROVIDERS = {
   // It also gated the wrong thing in practice. The US index is the one piece of this tier an operator
   // cannot get in a minute — it is a 41.5 GB build over two bulk products, behind an account with ID.me
   // identity verification, and it takes hours — so requiring it made the free tier unusable for exactly
-  // the person it exists for. 's CODE was merged; the INDEX is what no box had, and that was enough
+  // the person it exists for. That CODE was merged; the INDEX is what no box had, and that was enough
   // to keep and from ever being exercised.
   //
   // The EU pair stays REQUIRED: a free tier with no configured member at all is not degraded, it is
@@ -1419,7 +1471,7 @@ export function providerIdFrom(env) {
   // the CURRENT spelling, through `currentName`, on purpose. Reading only the legacy name answered
   // `null` for a file that names the provider on the one line an operator can see, and `activeProvider`
   // reads that null as "this environment said nothing" and falls back to the ambient value. That is
-  // 's defect exactly, wearing the new name.
+  // That defect exactly, wearing the new name.
   for (const name of ["CLEAROTRON_DATABASE"]) {
     const v = String(env?.[name] ?? "").trim().toLowerCase();
     if (v) return v;

package/driver/e2e-rounds.mjs

@@ -4,7 +4,7 @@
 //
 // ── the defect this exists to remove ──────────────────────────────────────────────────────────
 //
-// 's noise floor needs the SAME scenario run twice on one commit. Until this module, `run` wrote
+// That noise floor needs the SAME scenario run twice on one commit. Until this module, `run` wrote
 // `_e2e-doors-<ID>.json` holding exactly one token and `report` scoped itself to whatever token it found
 // there — so the second run of a pair OVERWROTE the only record of the first round's token, and the
 // first half became unreportable. Silently: `report` then described the second run, thirty seconds into
@@ -305,7 +305,7 @@ function runStart(hit) {
 /**
  * The rounds visible ON DISK, grouped by round token.
  *
- * `untokened` counts runs whose ref carries no round token — a pre- round, or one submitted by
+ * `untokened` counts runs whose ref carries no round token — a pre-change round, or one submitted by
  * hand. They belong to no nameable round, and saying how many there are is the difference between
  * "these are all the rounds" and "these are the rounds I could name".
  */

package/driver/effort-model.mjs

@@ -223,7 +223,7 @@ export const costBand = (i) => Math.max(1, Math.min(5, Math.ceil(effortUnits(i)
  * WHAT THIS REPLACED, and why a constant beat a model. The old quote was a base plus one adder per lane:
  * 1.5h, +0.5 for case law, +0.5 for a native-language lane, +0.5 for a single territory. It missed the
  * actual wall by +66%, +82% and −22% on three consecutive delivered runs, in BOTH directions, on one
- * engine build in one night ('s table). Every wall I could find from either source, eight runs:
+ * engine build in one night (the table). Every wall I could find from either source, eight runs:
  *
  *     quoted 1.5h  ×6   →  actual 2.23  2.28  2.38  2.40  2.49  2.49
  *     quoted 3.0h  ×1   →  actual 2.33      (the run with the MOST lanes came in SHORTER than five others)
@@ -246,7 +246,7 @@ export const TURNAROUND_QUOTE = Object.freeze({
   clearance: Object.freeze({ lowHours: 1.5, highHours: 2.5 }),
   // — OWNER RULING: a knockout quotes 5-10 MINUTES, a range, not a flat figure.
   //
-  // The flat 0.25 came from 's "no compute, just say it, keep it simple", and that ruling is
+  // The flat 0.25 came from the "no compute, just say it, keep it simple", and that ruling is
   // untouched here: this is still one stated figure per pipeline with nothing computed from levers. What
   // changed is the figure, and the shape of it.
   //