clearotron 0.2.1 → 0.2.2

package/driver/engine/anthropic-agent.mjs

@@ -102,7 +102,7 @@ const engineMaxBufferChars = () => Math.max(1024, Number(process.env.CLEAROTRON_
 // `gemini-flash: "sonnet"`, `deepseek-v4-pro: "opus"` and `azure: "sonnet"`, and the fall-through below
 // mapped ANY unrecognised alias to "sonnet". So `--model gemini` ran sonnet while the telemetry logged
 // `google/gemini-3.1-pro-preview` (gateway stamps `resolveModel(<requested alias>)`), and every
-// attribution downstream of that row — the A/B arm, the token rollup, 's billing classes — was
+// attribution downstream of that row — the A/B arm, the token rollup, the billing classes — was
 // keyed to a model that never ran. Nothing said so, because a substitution has no error to report.
 //
 // The four cross-provider aliases were already dead before this change: the model-failover chain was
@@ -237,7 +237,7 @@ export function absolutizeSkillRefs(message, skillsDir, resolve = null) {
 //
 // ANTHROPIC-ONLY, AND MEASURED RATHER THAN ASSUMED. The obvious next step is to apply the same rule to
 // openai-agent's `--add-dir` (buildCodexArgs pushes the identical root), and it would accomplish nothing:
-// that engine spawns with `cwd = resolveSpawnCwd({cwd, runDir})` — the RUN DIR (, deliberately) —
+// that engine spawns with `cwd = resolveSpawnCwd({cwd, runDir})` — the RUN DIR (deliberately) —
 // under `--sandbox workspace-write`, which makes cwd a writable root on its own. Dropping the flag there
 // would remove a grant the seat still holds by another door and let this comment claim an isolation the
 // engine does not have. Codex-side isolation is a cwd question, and a separate decision.
@@ -377,7 +377,7 @@ export function writeBoundarySettings({ skillsRoots = [], profilesDir = null, ru
   return JSON.stringify({
     hooks: {
       PreToolUse: [{
-        // tracker issue 997 — Bash is in the matcher because seats have it and it walked past this hook entirely.
+        // Bash is in the matcher because seats have it and it walked past this hook entirely.
         // What the Bash arm can and cannot do is stated at its declaration in deny-authority-write.mjs;
         // it is a detector, and naming it here does not make it a boundary.
         matcher: "Write|Edit|MultiEdit|NotebookEdit|Bash",
@@ -401,7 +401,7 @@ export function synthesizeEnvelope({ resultEvent, usage, killed }) {
 
 export const anthropicAgentEngine = {
   name: "anthropic-agent",
-  // tracker issue 954 — WHAT THIS ENGINE GUARANTEES ABOUT SEAT WRITES, said out loud in the run record.
+  // WHAT THIS ENGINE GUARANTEES ABOUT SEAT WRITES, said out loud in the run record.
   // `deny-authority-write.mjs` is a `claude -p` PreToolUse hook, so it refuses a seat's writes into the
   // doctrine tree, the profile store and `<runDir>/_driver/` at the moment of the write. That is a real
   // boundary and this engine has it.
@@ -409,7 +409,7 @@ export const anthropicAgentEngine = {
   async runTurn({ message, model, thinking, timeoutSec, resumeRef, mcpConfig, allowedTools, cwd, skillsDir, skillsGrantRoots, profilesDir, resolveSkill, runDir, seatWrites = null, stallSec, progressFiles } = {}) {
     if (!message) throw new Error("anthropic-agent.runTurn: message is required");
     const { args, input, grantNote } = buildClaudeArgs({ message, model, thinking, resumeRef, mcpConfig, allowedTools, cwd, skillsDir, skillsGrantRoots, profilesDir, resolveSkill, runDir, seatWrites });
-    // tracker issue 1022 — the cross-check speaks. Driver stderr is what an operator reads, and it is where the other
+    // the cross-check speaks. Driver stderr is what an operator reads, and it is where the other
     // drift notices in this engine already land ([ledger], [env-aliases], [queue-watch]).
     if (grantNote) process.stderr.write(`${grantNote}\n`);
     const t0 = Date.now();
@@ -435,7 +435,7 @@ export const anthropicAgentEngine = {
       // inheriting that would load the dev-assistant instructions into every stage (context pollution +
       // cost). It also avoids the EACCES when the inherited cwd is unreadable by the runner's user.
       //
-      // tracker issue 524 — cwd is a granted WRITE root here (file tools are confined to cwd + --add-dir), so it is
+      // cwd is a granted WRITE root here (file tools are confined to cwd + --add-dir), so it is
       // the run dir when there is one. See resolveSpawnCwd in common.mjs for why, and for what it deletes.
       const spawnCwd = resolveSpawnCwd({ cwd, runDir });
       // stdin is a PIPE (not "ignore"): the prompt rides stdin, not a `-p` argv element, so it is never
@@ -446,7 +446,7 @@ export const anthropicAgentEngine = {
       // Detached makes claude its own process-group leader, so the watchdog's kills reach the whole tree.
       try { child = spawn(claudeBin(), args, { stdio: ["pipe", "pipe", "pipe"], cwd: spawnCwd, env: spawnEnv(), detached: true }); }
       catch (e) { return resolve(errResult(t0, e, resumeRef)); }
-      // tracker issue 2076 — THE SECOND SPAWN PATH, and it has to record too. This engine does not go
+      // THE SECOND SPAWN PATH, and it has to record too. This engine does not go
       // through runStreamingChild; wiring one and assuming the other follows is the exact defect shape
       // 2122 was raised on the same day (the demo banner reached the clearance renderer and not the
       // knockout one). Best effort, never fatal.
@@ -525,7 +525,7 @@ export const anthropicAgentEngine = {
       // (A repeat of an already-recorded path is NOT truncation — nothing is lost.)
       const READS_CAP = 500;
       let readsTruncated = false;
-      // ── tracker issue 1111 — THE TWO NUMBERS THAT MAKE A SLOW TURN A DIAGNOSIS RATHER THAN AN INFERENCE ────────
+      // ── THE TWO NUMBERS THAT MAKE A SLOW TURN A DIAGNOSIS RATHER THAN AN INFERENCE ────────
       //
       // `tokensPerSec` says so itself: "the denominator still contains the turn's own tool waits… it
       // records the ratio; it does not diagnose it." Establishing that a slow stage was WAITING rather
@@ -543,7 +543,7 @@ export const anthropicAgentEngine = {
       let toolCalls = 0;
       let toolWaitMs = 0;
       let toolAskedAt = null;
-      // tracker issue 1111 — WHAT THE WAIT IS MADE OF, keyed by the tool(s) that caused it.
+      // WHAT THE WAIT IS MADE OF, keyed by the tool(s) that caused it.
       //
       // The total alone cannot answer the question it was collected for. "Exclude tool wait from the kill
       // clock because a turn waiting on a tool is the harness working" is TRUE of `register_execute_plan`
@@ -554,7 +554,7 @@ export const anthropicAgentEngine = {
       // sorted set joined by "+". Every millisecond is attributed exactly once and the values sum to
       // `toolWaitMs` — a per-name split would double-count a concurrent ask and quietly break that identity.
       let toolAskedNames = null;
-      // tracker issue 1828 — WHICH CHUNK an ask arrived in. Every line in one stdout chunk is parsed in
+      // WHICH CHUNK an ask arrived in. Every line in one stdout chunk is parsed in
       // one synchronous loop, so they all share a single Date.now(). If an ask and its result land in
       // the SAME chunk, the parent was not running between them and the gap it measures is 0 — for a
       // wait that really happened. Reproduced deterministically by blocking this process's event loop:
@@ -595,7 +595,7 @@ export const anthropicAgentEngine = {
       const openAsks = [];             // ask records still outstanding, oldest first
       const askById = new Map();       // tool_use_id → its ask record
       let periodStart = null;          // when the current outstanding-SET period began
-      let periodChunk = null;          // the chunk it began in — tracker issue 1828's unmeasurable flag
+      let periodChunk = null;          // the chunk it began in — the unmeasurable flag
       let anonSeq = 0;                 // ids are on the wire, but never assume: synthesize if absent
       const periodKey = () =>
         [...new Set(openAsks.flatMap((r) => r.names))].sort().join("+");
@@ -709,7 +709,7 @@ export const anthropicAgentEngine = {
           progress();
         }
         else if (ev.type === "user") {
-          // tracker issue 1111 — the result of the ask above. Only counted when an ask is outstanding, so a `user`
+          // the result of the ask above. Only counted when an ask is outstanding, so a `user`
           // event with no preceding tool_use adds nothing rather than charging the turn for a gap it
           // never spent waiting.
           // Which ask is this the result OF? The id on the wire answers it. Falling back to the
@@ -776,7 +776,7 @@ export const anthropicAgentEngine = {
       const watchdog = setInterval(() => {
         artifactProgress();
         const now = Date.now();
-        // tracker issue 1780 — THE STARTUP DEBT. tracker issue 1692 widened the deadline below until the first byte but left this
+        // THE STARTUP DEBT. tracker issue 1692 widened the deadline below until the first byte but left this
         // clock's ORIGIN at spawn, so the startup interval stayed on the meter: the moment the grace let
         // go, progIdle already WAS the whole boot, and any NOPROG shorter than startup had expired before
         // the child was observed at all. The kill then landed on the next tick, before the ask could reach
@@ -784,7 +784,7 @@ export const anthropicAgentEngine = {
         // Releasing a clock is not starting one: the first byte is this clock's origin, not its green light.
         const progFrom = firstOutputAt === null ? lastProgress : Math.max(lastProgress, firstOutputAt);
         const idle = now - lastMove, progIdle = now - progFrom;
-        // ── tracker issue 1692 — STARTUP IS NEITHER SILENCE NOR WORK ──────────────────────────────────────────────
+        // ── STARTUP IS NEITHER SILENCE NOR WORK ──────────────────────────────────────────────
         // Every clock here USED TO start at SPAWN, so until the child's first byte they were all timing
         // process startup: an idle clock that had not yet seen silence, and an active clock that had not
         // yet seen work. Past tense deliberately — tracker issue 1780 finished this, and the sentence stayed true of
@@ -800,7 +800,7 @@ export const anthropicAgentEngine = {
         // kill it NOW, well below the wall, and record it as a STALL — never let the ceiling raise turn
         // into extended stall burn, and never let this kill read as "the stage needed more time".
         else if (progIdle >= (started ? NOPROG : Math.max(NOPROG, GRACE))) { stallKill = true; noProgressKill = true; killed = true; killTree(); }
-        // ── tracker issue 1111 — THE CEILING MEASURES ACTIVE TIME, NOT ELAPSED ────────────────────────────────────
+        // ── THE CEILING MEASURES ACTIVE TIME, NOT ELAPSED ────────────────────────────────────
         //
         // Owner ruling: "there isnt such thing as a hung model. it always delivers something or fails."
         // So this ceiling exists for the harness's own failure modes, not to budget the model, and a turn
@@ -824,7 +824,7 @@ export const anthropicAgentEngine = {
         // quantity: a long turn has three causes — tool latency, a generation stall, and sheer VOLUME
         // (one healthy stage ran 40.9 minutes at a normal rate producing 186k tokens) — and nothing that
         // keys on elapsed can tell them apart.
-        // tracker issue 1692: measured from the FIRST BYTE, never from spawn. Startup is not active time either, and
+        // measured from the FIRST BYTE, never from spawn. Startup is not active time either, and
         // against a tight pin it was the whole budget — a 900ms spawn hit a 500ms ceiling having done
         // nothing at all, and the turn died carrying `hardWall` with zero tool calls to explain it.
         else if (started && activeElapsedMs({ wall: now - firstOutputAt, toolWaitMs, toolAskedAt, now }) >= hardMs) {
@@ -840,7 +840,7 @@ export const anthropicAgentEngine = {
       child.stdout.on("data", (d) => {
         if (settled || overflow) return;
         if (firstOutputAt === null) firstOutputAt = Date.now();   // #1692 — the child has spoken; startup is over
-        chunkSeq += 1;                                            // tracker issue 1828 — see toolAskedChunk
+        chunkSeq += 1;                                            // see toolAskedChunk
         chunkBytes = d.length;
         chunkGapMs = prevChunkAt === null ? 0 : Date.now() - prevChunkAt;
         prevChunkAt = Date.now();
@@ -852,7 +852,7 @@ export const anthropicAgentEngine = {
       });
       child.stderr.on("data", (d) => {
         if (settled || overflow) return;
-        // tracker issue 1813 — STDERR DOES NOT START THE CLOCKS, and this line used to. This engine's protocol is
+        // STDERR DOES NOT START THE CLOCKS, and this line used to. This engine's protocol is
         // stream-json on STDOUT; stderr carries node warnings and CLI notices, which a child can emit
         // before it has done anything at all. Treating one as "the child has spoken" ended the grace and
         // — since tracker issue 1780, which made the first byte the progress clock's ORIGIN — started that clock too,
@@ -870,7 +870,7 @@ export const anthropicAgentEngine = {
       child.on("error", (e) => { if (settled) return; settled = true; clearInterval(watchdog); resolve(errResult(t0, e, resumeRef)); });
       child.on("close", (code) => settle(code));
       function settle(code) {
-        // tracker issue 2076 — the turn is over; the record must not outlive it, and is cleared only if
+        // the turn is over; the record must not outlive it, and is cleared only if
         // it still names THIS child.
         clearEngineChild(runDir, child?.pid);
         if (settled) return; settled = true;
@@ -889,7 +889,7 @@ export const anthropicAgentEngine = {
         // defect from the inside.
         const endedAt = Date.now();
         const wall = (endedAt - t0) / 1000;
-        // tracker issue 1111 — THE TWO CLOCKS MUST TILE THE WALL, in every case including the one that matters.
+        // THE TWO CLOCKS MUST TILE THE WALL, in every case including the one that matters.
         //
         // A turn killed mid-tool-call has an OPEN ask that `toolWaitMs` has not closed. Reporting the
         // unclosed accumulator left `activeMs + toolWaitMs` short of the wall by exactly that gap — and
@@ -924,7 +924,7 @@ export const anthropicAgentEngine = {
         const stderrOut = overflow
           ? (stderr + `\nanthropic-agent output overflow: stdout/stderr exceeded ${maxBuffer} chars — killed the tree and failed the turn (truncated tail never parsed)`)
           : noProgressKill
-            // tracker issue 1780 — THE SPECIMEN RIDES THE FAILURE, because the broken state expires. This kill has
+            // THE SPECIMEN RIDES THE FAILURE, because the broken state expires. This kill has
             // twice reddened `main` from a test whose ANTI-VACUITY check failed — the turn died having
             // opened no tool ask — and neither the box's ambient load nor a full-suite run reproduces
             // it on demand. So the discriminating bit is recorded HERE, where the kill happens, rather
@@ -962,11 +962,11 @@ export const anthropicAgentEngine = {
           // from this list is unreliable and the consumer must downgrade it to "not observed").
           reads: [...reads], readsTruncated,
           toolCalls, toolWaitMs: settledToolWaitMs,   // #1111 — two integers, no content
-          // tracker issue 1780 — ms from spawn to the child's FIRST byte, or null when it never spoke. RECORDING
+          // ms from spawn to the child's FIRST byte, or null when it never spoke. RECORDING
           // ONLY: nothing branches on it. A recording field is protected by a test or by nothing, so
           // engine.anthropic.test.mjs pins it — deleting it must red something.
           firstByteMs: firstOutputAt === null ? null : Math.round(firstOutputAt - t0),
-          // tracker issue 1111 — WHICH CLOCK RAN OUT, and WHAT the wait was made of.
+          // WHICH CLOCK RAN OUT, and WHAT the wait was made of.
           //
           // The hard wall measures ELAPSED, and elapsed includes time the model spent waiting on tools
           // rather than generating. A wall kill whose elapsed is mostly tool wait is a different event from
@@ -982,7 +982,7 @@ export const anthropicAgentEngine = {
           // "this record predates the gauge".
           activeMs: Math.max(0, Math.round(wall * 1000) - settledToolWaitMs),
           toolWaitByTool: { ...toolWaitByTool },
-          // tracker issue 1828 — the asks whose wait this process COULD NOT MEASURE, because the ask and
+          // the asks whose wait this process COULD NOT MEASURE, because the ask and
           // its result were delivered in one chunk. An ARRAY is a measurement (possibly `[]`: measured,
           // nothing unmeasurable), following toolWaitByTool's own rule that absence and "cannot report"
           // must not look alike. `toolWaitMs` and the per-tool split are untouched.

package/driver/engine/auth.mjs

@@ -20,7 +20,7 @@
 // spelling list let the OpenAI half decide how an Anthropic run bills. deleted the old names, so
 // there is one variable, only the selected engine is ever consulted, and the hazard has no route left.
 //
-// And deliberately written OUT at each site rather than through a helper: 's guard in
+// And deliberately written OUT at each site rather than through a helper: the guard in
 // `env-governance.test.mjs` finds a product read by the literal `env.NAME`, so a helper taking the
 // name as an argument makes both reads invisible to it — measured, it turned them harness-only and
 // put both names on the "no longer read by product code" list. The repetition is what keeps them

package/driver/engine/common.mjs

@@ -157,7 +157,7 @@ export function runStreamingChild({
   // timeout; NaN/≤0 clamps to 660s so the wall never silently disables. A non-positive or unparseable
   // PIN falls through to that derivation for the same reason — a pin is an instrument, never an off
   // switch. Without it the floor here is 61 SECONDS at the shortest, which is why this clock had no arm
-  // and why 's grace never reached the line below: no test could drive it without sitting for a
+  // and why the grace never reached the line below: no test could drive it without sitting for a
   // minute.
   const pinnedHard = Number(process.env.CLEAROTRON_HARD_MS);
   const hardMs = pinnedHard > 0 ? pinnedHard : (Number(timeoutSec) > 0 ? Number(timeoutSec) + 60 : 660) * 1000;

package/driver/engine/deny-authority-write.mjs

@@ -10,7 +10,7 @@
 //
 // ── WHY A HOOK, AND NOT THE THING YOU WOULD TRY FIRST ────────────────────────────────────────────────
 //
-// 's incident was a live clearance writing two files into the skills tree. The obvious reading is
+// That incident was a live clearance writing two files into the skills tree. The obvious reading is
 // "a seat did something it should not". Reading the grant layer first says otherwise: `buildClaudeArgs`
 // grants that tree with `--add-dir`, WHICH HAS NO READ-ONLY FORM, under `--permission-mode acceptEdits`
 // which auto-approves Write/Edit so each stage can save its output without prompting. The tree was

package/driver/engine/jx-turn.mjs

@@ -78,7 +78,7 @@ export function readJxTuple(tuple, { vendor, authMode, engine }) {
   const usage = u ? { input: u.input ?? 0, output: u.output ?? 0, cacheRead: u.cacheRead ?? 0,
                       cacheWrite: u.cacheWrite ?? 0, total: u.total ?? 0 }
                   : null;
-  // The model that actually served the turn, never the alias we asked for — 's criterion 4 is that
+  // The model that actually served the turn, never the alias we asked for — the criterion 4 is that
   // the receipt names who did the native-language work, and an alias does not name anyone. Both adapters
   // populate it (anthropic-agent from the assistant/init events, openai-agent from `ev.model`).
   const model = tuple?.modelWire ?? null;

package/driver/engine/mcp/clarivate-server.mjs

@@ -38,7 +38,7 @@ const API_KEY = process.env.CLARIVATE_API_KEY || "";
 const BASE = process.env.CLARIVATE_API_BASE || DEFAULT_BASE;
 const tctx = (kind) => ({
   kind,
-  agentId: process.env.CLEAROTRON_GATHER_AGENT || "clawdi",
+  agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",   // run session key — telemetry attribution
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
 });

package/driver/engine/mcp/corsearch-server.mjs

@@ -13,7 +13,7 @@ import { proposeSupplemental } from "./supplemental.mjs";
 const COOKIE = process.env.CORSEARCH_SESSION_KEY || "";
 const tctx = (kind) => ({
   kind,
-  agentId: process.env.CLEAROTRON_GATHER_AGENT || "clawdi",
+  agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",   // run session key — telemetry attribution
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
 });

package/driver/engine/mcp/declination-server.mjs

@@ -65,7 +65,7 @@ function loadDeclinationSpec(runDir) {
 
 async function record_declination(params) {
   // `CLEAROTRON_BAND_RUN_DIR` at CALL TIME, and there is no `run_dir` parameter — the run is not the seat's
-  // to name. 's lesson, where an invented fallback sat two lines under a promise never to guess.
+  // to name. That lesson, where an invented fallback sat two lines under a promise never to guess.
   const runDir = String(process.env.CLEAROTRON_BAND_RUN_DIR ?? "");
   if (!runDir) {
     return { error: "this server was started without a run — the driver wires it per run; there is no parameter for it and this tool never guesses one" };

package/driver/engine/mcp/dispositions-server.mjs

@@ -66,7 +66,7 @@ import { MAX_ROWS_PER_CALL } from "../../disposition-call.mjs";
 // can have. Here the serialization is ours, so the class is gone rather than caught.
 //
 // THE SPEC PATH IS THE SEAT'S ONLY PATH ARGUMENT, and it is the same driver-written file the grid tool
-// was given. 's rule: the path is the DRIVER'S, taken from the spec it wrote. Two derivations of one
+// was given. That rule: the path is the DRIVER'S, taken from the spec it wrote. Two derivations of one
 // filename is the drift that cost weeks.
 async function record_dispositions(params) {
   const { grid_spec_path, rows } = params ?? {};

package/driver/engine/mcp/euipo-server.mjs

@@ -46,7 +46,7 @@ const AUTH = {
 };
 const tctx = (kind) => ({
   kind,
-  agentId: process.env.CLEAROTRON_GATHER_AGENT || "clawdi",
+  agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
 });

package/driver/engine/mcp/fetch-server.mjs

@@ -30,7 +30,7 @@ serve({
       const ctrl = new AbortController();
       const timer = setTimeout(() => ctrl.abort(), TIMEOUT_MS);
       try {
-        const res = await fetch(url, { redirect: "follow", signal: ctrl.signal, headers: { "user-agent": "cordillera-prelim-fetch/0.1" } });
+        const res = await fetch(url, { redirect: "follow", signal: ctrl.signal, headers: { "user-agent": "cordillera-clearotron-fetch/0.1" } });
         const body = await res.text();
         const text = body.length > MAX_CHARS ? body.slice(0, MAX_CHARS) + `\n…[truncated at ${MAX_CHARS} chars]` : body;
         return { isError: res.ok ? undefined : true, text: `HTTP ${res.status} ${res.statusText} — ${url}\n\n${text}` };

package/driver/engine/mcp/free-tier-server.mjs

@@ -42,7 +42,7 @@ const AUTH = null;
 
 const tctx = (kind) => ({
   kind,
-  agentId: process.env.CLEAROTRON_GATHER_AGENT || "clawdi",
+  agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
 });
@@ -56,7 +56,7 @@ const CAPABILITY_OFFICES = CAPABILITIES.offices.covered.join("+");
 // it a third. It did. This is that third site, and it went on requiring USPTO_LOCAL_DB after the other
 // two stopped.
 //
-// The cost was total. On an EU-only box 's whole path worked — preflight passed, the plan compiled
+// The cost was total. On an EU-only box the whole path worked — preflight passed, the plan compiled
 // with the US split off as a disclosed deferral, the EU entry was executable — and then EVERY register_*
 // tool the seat called was refused here, so the EU half never ran. Everything upstream was right and
 // nothing downstream happened, which is the least legible way for a fix to fail.

package/driver/engine/mcp/gather-config.mjs

@@ -79,7 +79,7 @@ export const REGISTER_SERVERS = {
   //   register_search / register_record_fetch — served since the thin days.
   //   register_enumerate     — SERVED and now granted.  built the page loop on the shared kernel;
   //     capabilities.js records the bounds it runs against as live-probed 2026-08-17 (pageSize 100 is the
-  //     API's hard refusal, verified at 200/250/500). This is the tool 's owner-window ceiling is
+  //     API's hard refusal, verified at 200/250/500). This is the tool the owner-window ceiling is
   //     passed into (OWNER_SCOPED_WINDOW → ceilingFor → makeEnumerate), so withholding it put that
   //     criterion out of reach of any round.
   //   register_execute_plan  — SERVED and now granted. Two corrective-ladder hints name it unconditionally
@@ -188,7 +188,7 @@ export const REGISTER_SERVERS = {
 // (server-tools-granted-or-stated.test.mjs: every record tool has exactly one granting stage).
 const RECORDING_SERVER = "recording-server.mjs";
 const RECORDING = Object.freeze({
-  // FIRST OCCUPANT — blind-frame ('s transport, wired by, dictation deleted by).
+  // FIRST OCCUPANT — blind-frame (the transport, wired by, dictation deleted by).
   //
   // `seatWrites: false` is the half, and it is the only thing that closes the regression door BY
   // CONSTRUCTION rather than by prose. Once the driver writes blind-frame-model.json, nothing this stage is
@@ -686,7 +686,7 @@ const LOCAL = {
   "unit-note": { script: "unit-note-server.mjs", tools: ["record_unit_note"] },
   // ── RECORDING — DERIVED from the registry above, one entry per stage, in registry order ──────────
   //
-  // These rows were hand-written here until 's collapse. They are LAST in this object on purpose:
+  // These rows were hand-written here until the collapse. They are LAST in this object on purpose:
   // LOCAL_SERVER_SCRIPTS below is `Object.values(LOCAL).map(...)`, so insertion order is part of its
   // value, and `recording-server.mjs` appearing TWICE is the evidence both keys resolve to the one
   // module. recording-grant-preservation.test.mjs pins that array verbatim, duplicates included.
@@ -695,7 +695,7 @@ const LOCAL = {
 };
 
 // The scripts LOCAL grants, DERIVED. Exported because the server census would otherwise recite them, and
-// a recited list is one more population to keep in sync by hand — 's census derived the register
+// a recited list is one more population to keep in sync by hand — the census derived the register
 // half from REGISTER_SERVERS and hardcoded this half, so wiring a new local server left it reading as
 // ungranted. Derive both halves or neither.
 export const LOCAL_SERVER_SCRIPTS = Object.freeze(Object.values(LOCAL).map((e) => e.script));
@@ -873,7 +873,7 @@ export function buildGatherMcpConfig(groups = [], { sessionKey, agent, runDir, r
   // There is no production caller to break: `driver/gateway.mjs` is the only non-test call site in the
   // tree and it always passes the run it is dispatching for. A caller that reaches this without one has
   // a defect a refusal names immediately, instead of a record body somewhere its run will never look.
-  // ORDER MATTERS: resolve the register provider FIRST. 's "CLEAROTRON_DATABASE is not set"
+  // ORDER MATTERS: resolve the register provider FIRST. That "CLEAROTRON_DATABASE is not set"
   // is the more fundamental refusal and the one an operator acts on, so it must still come out ahead of
   // this one — a box with neither a provider nor a run should be told about the provider.
   if (localKeys.has("register")) {
@@ -964,7 +964,7 @@ export function toolGroupsForStage(name = "") {
   // the issue predicts, on the one matter where the confirmation step was most clearly indicated (four
   // `loaded` meaning rulings, see).
   //
-  // This changes engine behaviour and ships `status:merged-awaiting-e2e`, which 's out-of-scope block
+  // This changes engine behaviour and ships `status:merged-awaiting-e2e`, which the out-of-scope block
   // anticipates in as many words. The scoping is doctrine's, not the grant's: SKILL.md already caps it at
   // one probe per review and requires the query and its result recorded verbatim.
   // ── THE ONE BRANCH THAT RETURNS RETRIEVAL *AND* RECORDING, and it has to be here ────────────────
@@ -1027,7 +1027,7 @@ export function toolGroupsForStage(name = "") {
   //
   // NOT a prefix test, for either form. A prefix would hand the grant to any future stage whose name
   // merely began with a recording stage's. The base row must SAY it fans out — declaration, not
-  // inference, the same principle as 's declared phase.
+  // inference, the same principle as the declared phase.
   for (const [sep, flag] of SUFFIX_FORMS) {
     const at = name.lastIndexOf(sep);
     if (at <= 0) continue;
@@ -1153,7 +1153,7 @@ export function recordAxisFor(name = "") {
 // gains `--mcp-config`, `--strict-mcp-config` AND `--allowedTools` where it previously had none. That is
 // a change in KIND and the right one — these stages become constrained for the first time — but it must
 // be asserted at the argv level, not inferred from this map.
-// FIRST OCCUPANT — blind-frame ('s transport, wired here). SECOND — skeptic.
+// FIRST OCCUPANT — blind-frame (the transport, wired here). SECOND — skeptic.
 //
 // The safety basis is a SAMPLE and is stated as one: O3c measured blind-frame at 0 Bash calls across 15
 // attempts, alone among the eleven tool-free stages. That is why it converted first. On attempt 16 a
@@ -1189,7 +1189,7 @@ export const RECORDING_STAGES = Object.freeze(Object.fromEntries(
 //
 // ── DELIBERATELY NOT DERIVED FROM THE REGISTRY, unlike the four declarations above it ──────────────
 //
-// 's collapse made the LOCAL entries, the group resolution, the stage→group map and RECORDING_STAGES
+// That collapse made the LOCAL entries, the group resolution, the stage→group map and RECORDING_STAGES
 // derive from one registry. This table did NOT move, and the reason is the whole value of it: O1 asserts
 // the resolved grant EQUALS this row. Derive it from the same registry the grant derives from and O1
 // compares a value with itself — a guard turned tautology inside the PR that was meant to strengthen it.
@@ -1211,7 +1211,7 @@ export const RECORDING_TOOLS = Object.freeze({
     "mcp__recording-matter-frame__search_run_artifacts"]),
   skeptic: Object.freeze(["Read", "mcp__recording-skeptic__record_skeptic",
     "mcp__recording-skeptic__search_run_artifacts"]),
-  // 's third conversion. `Read` and its one record tool: the stage's reads are its two named input
+  // That third conversion. `Read` and its one record tool: the stage's reads are its two named input
   // files, which the seeded grant serves, and it gets no search tool because a stage with an enumerable
   // read set does not need one. BY HAND, like every row here — deriving it from the registry would make
   // O1 compare a value with itself.
@@ -1370,7 +1370,7 @@ export function seatWritesForGroups(groups = []) {
 }
 
 /**
- * THE ENUMERATION, derived and not hand-listed ('s third proof requirement).
+ * THE ENUMERATION, derived and not hand-listed (the third proof requirement).
  *
  * A naive grep for `seatWrites: false` returns TEN hits and the population is EIGHT: two of the hits are
  * comment text — one in the blind-frame FIRST OCCUPANT note, one in `allowedToolsFor`'s own

package/driver/engine/mcp/perplexity-server.mjs

@@ -135,7 +135,7 @@ function tellObligations(spec, ledgerJson) {
     }, null, 2) + "\n",
   );
   // B — NO SEAT-FACING FORM IS WRITTEN, ANY MORE, BY ANYONE. The -era write-back that lived here
-  // (a union of the seat's file bytes into a rebuilt seat-facing form, plus 's whose-bytes referee)
+  // (a union of the seat's file bytes into a rebuilt seat-facing form, plus the whose-bytes referee)
   // died with the form path: the seat records rulings only through `record_dispositions`, the
   // accumulator in `_driver/` is the one copy and the tool is its writer mid-turn. What the seat needs
   // at this moment — the obligations, the candidates, the positions and the recording route — is all in

package/driver/engine/mcp/recording-server.mjs

@@ -24,12 +24,12 @@
 //
 // `CLEAROTRON_BAND_RUN_DIR`, read at CALL TIME. `serverEnv()` (gather-config.mjs:162) sets it for every local
 // server, not only band. There is no `run_dir` parameter and there must not be one — the lesson is
-// 's, where an invented `CLEAROTRON_RUN_DIR` fallback sat two lines under a sentence promising the tool
+// the earlier one, where an invented `CLEAROTRON_RUN_DIR` fallback sat two lines under a sentence promising the tool
 // never guesses a run. Call time rather than module load: stdio-server.mjs:29-33 states why for this
 // exact variable.
 // ── THE SECOND CAPABILITY CLASS: A SCOPED READ, and why it does not break the sentence above ────────
 //
-// `search_run_artifacts` is the skeptic's sanctioned read surface ('s ratification hold, unlock
+// `search_run_artifacts` is the skeptic's sanctioned read surface (the ratification hold, unlock
 // path 1): a literal substring search over the calling run's OWN artifact tree, replacing the Bash
 // reads O3c measured the stage using. It still dials nothing and writes nothing — the category's
 // promise is about RETRIEVAL and writes, and a read bounded to CLEAROTRON_BAND_RUN_DIR widens neither.
@@ -464,7 +464,7 @@ serve({
               value: { type: "string", description: "The search term itself — never a label, never an enumeration." },
               // THE CANONICAL ENUM, imported — never a second copy. `parseVariantManifestModel` refuses
               // anything outside it, so a hand-typed list here could drift into promising a category the
-              // parser rejects. 's brief reads the same constant.
+              // parser rejects. That brief reads the same constant.
               category: { type: "string", enum: [...VARIANT_CATEGORIES] },
               rationale: { type: "string" },
               romanization: { type: "string", description: "Latin-script form. NON-LATIN VALUES ONLY — a romanisation on a Latin value is refused as an orphan." },
@@ -848,7 +848,7 @@ serve({
     // The reviewer is the report's only check, and it wrote its own review as prose. Everything
     // downstream then parsed that prose back: the verdict token, the flag list, the `[kind:]`/`[on:]`
     // channels, and the count that decides whether a BLOCKING is degenerate. The seat chose the
-    // enumeration style, so the parse could miss it — 's lettered flags were invisible
+    // enumeration style, so the parse could miss it — the lettered flags were invisible
     // for exactly that reason. Handing values makes the style the driver's, so a flag the parse cannot
     // see stops being possible rather than being detected afterwards.
     //
@@ -1120,6 +1120,10 @@ serve({
                   properties: {
                     recordId: { type: "string", description: "Copied VERBATIM from the filings you were given." },
                     read: { type: "string", description: "What you concluded about THIS filing." },
+                    // Declared here for the reason the comment above gives: `additionalProperties: false`
+                    // means an undeclared key is a contradiction between the prose and the schema, and the
+                    // seat resolves it whichever way it happens to trust.
+                    band: { type: "string", description: "OPTIONAL — how you rate THIS filing, in the framework's own band words. Send it when you formed a view on the filing itself; the card prints it as that filing's rating. Omit it and your read still prints, with no rating claimed." },
                   },
                 },
               },

package/driver/engine/mcp/signa-server.mjs

@@ -17,7 +17,7 @@ const API_KEY = process.env.SIGNA_API_KEY || "";
 const BASE = process.env.SIGNA_BASE_URL || DEFAULT_BASE;
 const tctx = (kind) => ({
   kind,
-  agentId: process.env.CLEAROTRON_GATHER_AGENT || "clawdi",
+  agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",   // run session key — telemetry attribution
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
 });

package/driver/engine/mcp/uspto-local-server.mjs

@@ -43,7 +43,7 @@ const DB_PATH = process.env[DEFAULT_DB_ENV] || "";
 const AUTH = { dbPath: DB_PATH };
 const tctx = (kind) => ({
   kind,
-  agentId: process.env.CLEAROTRON_GATHER_AGENT || "clawdi",
+  agentId: process.env.CLEAROTRON_GATHER_AGENT || "localagent",
   sessionKey: process.env.CLEAROTRON_GATHER_SESSION_KEY || "",   // run session key — telemetry attribution
   sessionId: process.env.CLEAROTRON_GATHER_SESSION_ID || "",
 });

package/driver/engine/openai-agent.mjs

@@ -446,7 +446,7 @@ function settleTuple({ r, ev, resumeRef }) {
     killed, wall: r.wall,
     stdout: text, stderr: stderrOut, laneWaitMs: 0,
     json, usage,
-    // MODEL GAUGE (,): the id codex recorded for this turn — from its session rollout under
+    // MODEL GAUGE (): the id codex recorded for this turn — from its session rollout under
     // this run's own CODEX_HOME, since the event stream states none. Still two states and never one:
     // null = "this engine did not report", never the requested tier wearing the word "actual".
     // gateway.mjs records the absence as modelBasis:"unknown".
@@ -478,7 +478,7 @@ function settleTuple({ r, ev, resumeRef }) {
       mcpRefused: mcpToolGauge(ev).mcpToolCallsRefused > 0 || undefined,
       rateLimited: rateLimited || undefined,
       rateLimitBasis: rateLimited ? "text-match" : undefined,
-      // resetsAtBasis (, 2026-08-20): same honesty as rateLimitBasis one line up, for the reset
+      // resetsAtBasis (2026-08-20): same honesty as rateLimitBasis one line up, for the reset
       // CLOCK rather than the classification. codex states its reset as human prose with NO timezone
       // ("try again at Aug 22nd, 2026 9:06 AM"), so the ISO we derive is a reading of that prose in the
       // box's own zone — never a provider fact. Absent when no hint was found, exactly as `resetsAt` is.

package/driver/engine-build.mjs

@@ -87,11 +87,11 @@ export function resetEngineCommit() { cached = undefined; source = undefined; re
 // So attribution has been a reflog reconstruction: join a checkout's reflog against each run's
 // `startedAt`. That reconstruction expires with the reflog, cannot survive a re-clone, is wrong for
 // every run made while the checkout sat detached, and mixes a local-time reflog against UTC stamps.
-// It decided three certifications in one morning (,) and produced two near-miss
+// It decided three certifications in one morning () and produced two near-miss
 // wrong rulings in two days.
 //
 // A SIBLING, NOT A WIDER RETURN TYPE. `engineCommit()` keeps its bare-string contract exactly:
-// 's guard pins its import line by regex AND pins the literal `engineCommit: engineCommit` in
+// That guard pins its import line by regex AND pins the literal `engineCommit: engineCommit` in
 // the publisher, four consumers read the string, and `scripts/freeze-example-run.mjs` asserts in prose
 // that it "is cached to one value and cannot differ between the two". Widening it would break all of
 // that to add a field only one new caller wants.

package/driver/enqueue-schema.mjs

@@ -663,7 +663,7 @@ export function validateJob(job, { atClaim = false } = {}) {
   // Every other check in this build lives at one or two of them: `checkClearanceScopeRules` runs at the
   // runner, the portal and plan_run but at neither start_run nor the CLI; the mark budget and the
   // availability gate run at the runner alone. A rule placed at a door is a rule the other doors do not
-  // have, and 's acceptance test is that all three refuse the same request in the same words.
+  // have, and the acceptance test is that all three refuse the same request in the same words.
   //
   // WHAT IS JUDGED HERE: everything the REQUEST states. Each of the offering's illegal shapes is visible
   // without resolving anything — a narrowed Global preliminary, a two-country Full country search, a
@@ -983,7 +983,7 @@ export const EXAMPLE_JOB = {
   // deliveryRoute: "portal",           // OPTIONAL: "email" (default) or "portal" — a portal-route packet
                                         // is mark_sent by the courier WITHOUT an email send.
   // parentRunId: "novapulse-cedar",    // OPTIONAL escalation lineage: the run this one escalates from
-                                        // (e.g. a knockout HIGH mark → this prelim). Recorded, not yet resolved.
+                                        // (e.g. a knockout HIGH mark → this clearotron). Recorded, not yet resolved.
   projectKey: "console-ecosystem",      // spec 62 (OPTIONAL): the PROJECT/engagement under the customer whose
                                         // overlay (its own marketplaces/classes/sector/posture) rates this
                                         // matter; omit ⇒ runs on the customer profile. Unknown key ⇒ clarify.

package/driver/enqueue.mjs

@@ -245,7 +245,7 @@ async function main(argv) {
   try { job = assembleFromFlags(flags); } catch (e) { fail(`could not assemble the job: ${e.message}`); }
   if (!job.forwarder) fail("missing --forwarder — the requester/reply-routing key; the delivery packet needs it to route the report (there is deliberately no default)", 2);
   // THE EARLY --product CHECK IS GONE, and its deletion is the fix. It fired before validateJob and said
-  // the same thing in different words — `--product "prelim"` rather than `product "prelim"`, and without
+  // the same thing in different words — `--product "clearotron"` rather than `product "clearotron"`, and without
   // the `(or omit it for the account's default)` clause, which is the one clause that tells a requester
   // the field is optional. So the CLI's real answer to a typo was not the shared one, and a test that
   // started at assembleFromFlags could never see it. validateJob refuses it now, in the sentence every

package/driver/envelope-settle.mjs

@@ -196,7 +196,7 @@ export async function settleReceipt({ P, plan, receipt, dispatch = null, rejoin
 
 /**
  * The settled facts a digest dispatch needs, as a message section — mechanical only, quoting the executor's
- * own reason. Every digest pass gets this, not just the first: 's dispatch hint reaches FRESH dispatches
+ * own reason. Every digest pass gets this, not just the first: the dispatch hint reaches FRESH dispatches
  * by construction (stageOnce ignores `extra` when opts.followup is set), and the flush passes it misses are
  * exactly where the evidence run burned 2,908 seconds failing the same validator twice more.
  *

package/driver/evidence-claim-invariant.mjs

@@ -26,11 +26,11 @@
 // reading only the claim misses it: the increase is in the evidence stamp.
 //
 // THE LADDER ALREADY EXISTS, so this introduces no vocabulary. `basis` is the run's own certainty
-// ordering and 's demotion is its enforcement; `basis-derivation.json` records every demotion with
+// ordering and the demotion is its enforcement; `basis-derivation.json` records every demotion with
 // its reason and its uri. Arm B is a comparison against an artifact the driver already writes, which is
 // why it needs no fetch ledger and no new plumbing.
 //
-// REPORTS, NEVER THROWS. The caller decides what a violation costs — 's lesson is that a guard
+// REPORTS, NEVER THROWS. The caller decides what a violation costs — the lesson is that a guard
 // which can kill a run is a guard that eventually kills a run over its own false positive.
 
 /** The run's own certainty ordering for a meter's basis. Higher is more certain. */