clearotron 0.2.1 → 0.2.3

package/driver/pipeline.mjs

@@ -8,7 +8,7 @@ import "../shared/env-local.mjs";   // side effect: apply <repo>/.env when THIS
 import "./engine/mcp/http-dispatcher.mjs";   // side effect: raise undici headersTimeout (code-side fetches)
 import { readFileSync, existsSync, mkdirSync, writeFileSync, renameSync, copyFileSync, readdirSync, rmSync, statSync } from "node:fs";
 import { createHash } from "node:crypto";
-import { join, dirname, basename, resolve } from "node:path";   // resolve: 's resume line must work from any cwd
+import { join, dirname, basename, resolve } from "node:path";   // resolve: the resume line must work from any cwd
 import { driverDir, driverRel, ensureDriverDir } from "../shared/driver-dir.mjs";   // — one definition of where `_driver/` is
 import { terminalClampDecision, orderClausesForLede } from "./terminal-clamp.mjs";   // — deliver and clamp, never withhold
 import { recordSpan } from "./attributed-span.mjs";   // — driver work the decomposition can attribute
@@ -28,7 +28,7 @@ import { engineProvenance } from "./engine-build.mjs";                  // —
 import { preflightEngineTurn } from "./engine/probe.mjs";               // — …and the engine can complete a turn, not merely exist
 import { rankClusterLegs, verdictDrivingFindings } from "./senior-rights.mjs";
 import { buildRunContext, deriveSlug, kebab } from "./phase0.mjs";
-import { paths, STAGES, axisTier, decideAxes, assertTierSanity, assertEffectiveTier, lines, AGENT_WHATSAPP,
+import { paths, STAGES, axisTier, decideAxes, assertTierSanity, assertEffectiveTier, lines, AGENT_WHATSAPP, whatsappRouting,
   chainEntries, stageOrdinal, stageInputs, stageOutputs, dependencyOrder, REGISTER_AXES, REGISTER_ENUMERATE_TOOL,
   buildEscalationFollowup, buildEnvelopeCloseFollowup, buildFrameReopenFollowup,
   buildFrameReopenRetryMessage, thinkingFor, composeFollowup, stampDispatchBlocks, PROVIDER_META, proseRungDirective, inquiryRungDirective } from "./stages.mjs";
@@ -107,7 +107,8 @@ import { mintCrossCheckDoubts, mintContradictionDoubts, stitchDoubts, applyClosu
 import { readAcceptedClosures } from "./doubt-closure-tool.mjs";
 import { CLOSURE_EVIDENCE_FILES } from "./doubt-closure-call.mjs";
 import { doubtsForClosure, doubtSelectionNote } from "./doubt-selection.mjs";   // doubt-closure selection
-import { deriveAsks, applyAskClosure, finalizeOpenHandoffs, summarizeAsks } from "./ask-ledger.mjs";   // PR-6 — every ask ends (2026-07-29)
+import { deriveAsks, applyAskClosure, finalizeOpenHandoffs, summarizeAsks } from "./ask-ledger.mjs";
+import { pendingWhatIf, claimWhatIf, finishWhatIf, whatIfRefusal } from "./whatif-queue.mjs";   // a queued job is settled before its run archives   // PR-6 — every ask ends (2026-07-29)
 import { mintPresenceDoubts } from "./presence-reconciliation.mjs";   // presence-or-reason (2026-07-22 — the unjoined-Sheet-2 leak)
 import { escalatedAxes } from "./skeptic-record.mjs";   // THE escalation parse — shared with the record_skeptic transport so the rendered shape and this read cannot drift
 // — every placed candidate ends somewhere a reader can see; the ones that do not are counted by name
@@ -155,9 +156,9 @@ import { foldCaption, foldCardRead } from "./card-budget.mjs";
 import { carriesOwnFrame, composeCard } from "./card-frame.mjs";
 import { parseFrameworkManifest, loadFrameworkManifest, frameworkFor, manifestPathFor, DEFAULT_FRAMEWORK } from "./framework.mjs";
 import { renderScopeLedgerJson, scopeLedgerJsonFromRows, channelsDiagnosis, parseScopeLedgerJson, scopeJurisdictions, droppedVariantFamilies } from "./scope-ledger.mjs";
-// qw/cn-scope-honesty — the zh-lane capability tables + the requested-scope resolver, for the plain-prelim
+// qw/cn-scope-honesty — the zh-lane capability tables + the requested-scope resolver, for the plain-clearotron
 // honesty row/note. jx-lanes.mjs is a PURE zero-import leaf (data + decisions, no env/fs), so a static
-// import here costs a plain prelim nothing — the "lazy import" rule below (jx.mjs / jx-units.mjs) guards
+// import here costs a plain clearotron nothing — the "lazy import" rule below (jx.mjs / jx-units.mjs) guards
 // the lane MACHINERY, not this table. Aliased: scope-ledger.mjs already exports a scopeJurisdictions
 // (rows → markets); this one is (job, profile) → requested territories, the decideJxLanes precedence.
 import { JURISDICTION_ADAPTERS, LANGUAGE_LANES, scopeJurisdictions as jxScopeJurisdictions, zhScopeDepthNotes } from "./jx-lanes.mjs";
@@ -887,7 +888,7 @@ function deriveGridSpec(ctx) {
   // Deterministic grid contract (robust fix, 2026-06-14): write the EXACT terms × platforms the grid
   // will run as a code-owned spec. The perplexity plugin reads this, runs only these cells, and writes
   // common-law-grid.json ITSELF from the API response — the large grid JSON never round-trips through
-  // the model's bounded turn-output (no truncation: Zephyr/marble-causeway) and the model never re-types
+  // the model's bounded turn-output (no truncation: measured on a dense beverages run) and the model never re-types
   // the keys or cells (no drops/mis-keys: NOVA PULSE/marble-anvil). The receipts gate joins against THIS
   // same file, so it can never demand a key the grid did not run. No profile (no dictated platforms) ⇒
   // legacy model-authored path (back-compat; the gate falls back to the prose manifest).
@@ -917,7 +918,7 @@ function deriveGridSpec(ctx) {
     const gridSpecPath = P.gridSpec;
     // #5 — required channels: a NAMED profile's curated platforms are authoritative. The GENERIC fallback
     // derives the channels from the MATTER FRAME's industry/goods reasoning (its "Search channels:" line) so
-    // a regulated/B2B matter (petcary vet-pharma) searches its real channels (EMA/FDA registers) instead of
+    // a regulated/B2B matter (veterinary pharma, say) searches its real channels (EMA/FDA registers) instead of
     // being forced onto — and invalidated by — consumer storefronts. No static class→channel table: the
     // frame names them the way a lawyer reasons about the vertical, so it generalises to ANY industry. The
     // deterministic grid runs grid-spec.platforms and the receipts gate joins the SAME file, so this is the
@@ -1301,7 +1302,7 @@ function readCoverageJudgment(P) {
 // back in `unknown` — carried in `jurisdictions` too (never dropped), but the caller must surface them
 // LOUDLY (a jurisdiction nobody can place must never be a silent row in the machine record).
 // item 13 — `extractSearchedJurisdictions` LIVED HERE AND IS GONE. It ran a two-letter scan over the
-// coverage ledger's prose to decide which territories a run had searched, and 's narrowing (drop
+// coverage ledger's prose to decide which territories a run had searched, and the narrowing (drop
 // tokens that are not known jurisdiction codes) closed only the half where the junk token was not a real
 // code. The other half cannot be closed by any token list: SA, AG, KG, SL and SE are simultaneously real
 // jurisdiction codes and ordinary European company suffixes, so "… GmbH & Co. KG" reads as Kyrgyzstan and
@@ -1350,7 +1351,7 @@ export const CASE_LAW_TRIGGERS = /watchlist|precedent|case[- ]law|opposition|fam
 // The offering locked with the reviewing lawyer gives the case-law and opposition reading to the Full
 // country search alone, over exactly one country, where it is automatic. Multi-country focus deliberately
 // has no case-law component. `job.caseLaw` is refused at the door and `policy.caseLaw` is set from the
-// product spec, so the REQUESTED path was already confined correctly — and #92's one-territory rule is
+// product spec, so the REQUESTED path was already confined correctly — and the one-territory rule is
 // enforced at that door.
 //
 // The detector was not. It fires mid-run, after admission, on a run already scoped to however many
@@ -1464,7 +1465,7 @@ export function freezeProfile(p, project = null) {
     demoData: p.demoData === true,
     // BUGFIX 2026-06-19: per-customer reasoning-skill SELECTION must be frozen too. It was missing here, so
     // frameworkFor()/workedExamplesFor() (stages.mjs) read the frozen ctx.profile, found no path, and silently
-    // fell back to the firm-neutral DEFAULT for EVERY run — aurora.json/zephyr.json's configured frameworks
+    // fell back to the firm-neutral DEFAULT for EVERY run — the profiles' configured frameworks
     // were never applied. RAW value (NOT `?? ""`): absent ⇒ undefined ⇒ JSON drops it ⇒ frameworkFor falls back
     // to DEFAULT; an empty string would NOT trigger the `?? DEFAULT` and would break the read.
     frameworkPath: p.frameworkPath,
@@ -1489,7 +1490,7 @@ export function freezeProfile(p, project = null) {
   };
   // spec 62 — when the run is under a PROJECT, record which project rated it and the per-field origin map,
   // added AFTER the 14-field base so a NO-PROJECT freeze stays byte-identical to a pre-62 sidecar (the
-  // aurora regression anchor and every existing run's profileSha are preserved; profileShaOf sorts keys,
+  // regression anchor and every existing run's profileSha are preserved; profileShaOf sorts keys,
   // so these hash in only when present, making "which project rated this run" verifiable, never asserted).
   if (project?.projectKey) {
     frozen.projectKey = project.projectKey;
@@ -1532,6 +1533,13 @@ function attachProfile(ctx, job, { write = true } = {}) {
       const current = resolveProfile(job);
       if (current && current.key !== sidecar.profileKey)
         runLog(ctx.paths.runDir, { event: "profile-mismatch", sidecar: sidecar.profileKey, resolved: current.key });
+      // THE MATCH IS RECORDED TOO, and that is the point rather than symmetry for its own sake.
+      // `profile-mismatch` existed and its counterpart did not, so "the profile was right" was carried
+      // by the ABSENCE of a row — and an absence cannot tell "it matched" from "the probe never ran"
+      // (it throws below on a broken profiles/ state) or from "this run predates the probe". Three
+      // different facts, one empty grep. The positive row says which.
+      else if (current)
+        runLog(ctx.paths.runDir, { event: "profile-resolved", sidecar: sidecar.profileKey, resolved: current.key });
     } catch (e) {
       runLog(ctx.paths.runDir, { event: "profile-mismatch-probe-failed", error: String(e.message).slice(0, 120) });
     }
@@ -1663,13 +1671,13 @@ export function attachSearchPolicy(ctx, job, { write = true } = {}) {
     try { ctx.searchPolicy = JSON.parse(raw); }
     catch (e) { throw new Error(`_driver/search-policy.json is corrupt (${e.message}) — investigate; the frozen policy is never silently re-derived`); }
   } else if (!write) {
-    // pre-spine run read-only (reconstructCtx / legacy resume): implicitly a prelim — the only shape that
+    // pre-spine run read-only (reconstructCtx / legacy resume): implicitly a clearotron — the only shape that
     // existed. It names a RETIRED row on purpose: this branch describes a run that already happened, and
     // RETIRED_POLICIES exists so an archived run re-renders under the name it was sold under. But ONLY
     // for a selector-less job: a selector-carrying job with no frozen sidecar must never be assumed into
     // a clearance (review 2026-07-17 — the crash-reclaim/reconstruct window).
     if (!noSelector)
-      throw new Error(`run dir has no frozen search policy but the job names a selector (product=${JSON.stringify(job?.product ?? null)}, recipeKey=${JSON.stringify(job?.recipeKey ?? null)}) — refusing the legacy-implicit prelim assumption; re-dispatch cold so the policy is minted`);
+      throw new Error(`run dir has no frozen search policy but the job names a selector (product=${JSON.stringify(job?.product ?? null)}, recipeKey=${JSON.stringify(job?.recipeKey ?? null)}) — refusing the legacy-implicit clearotron assumption; re-dispatch cold so the policy is minted`);
     ctx.searchPolicy = { schema: 1, level: "prelim", pipeline: "clearance", stageLabel: "Depth 4", components: {}, recipe: null, origins: { level: "legacy-implicit" } };
   } else {
     let resolved;
@@ -1697,7 +1705,7 @@ export function attachSearchPolicy(ctx, job, { write = true } = {}) {
     } catch (e) { resolved = { clarify: `search-policy resolution errored: ${String(e?.message ?? e).slice(0, 160)}` }; }
     // A CLARIFY THROWS. THERE IS NO FAIL-OPEN LEFT, and its deletion is the point.
     //
-    // It used to fall open to the literal level `prelim` — stageLabel "Depth 4" — whenever the job named
+    // It used to fall open to the literal level `clearotron` — stageLabel "Depth 4" — whenever the job named
     // no selector and the profile carried no default. Both halves of that condition had rotted: the
     // selector test read the deleted `searchLevel` (so it was true for every job) and the profile test
     // read the deleted `defaultSearchLevel` (so it was undefined for every profile). The branch was
@@ -1763,7 +1771,7 @@ export function attachSearchPolicy(ctx, job, { write = true } = {}) {
       runLog(ctx.paths.runDir, { event: "level-scope-note", note: n });
   }
   // The fold runs on EVERY path through this door — fresh mint, frozen-sidecar resume, legacy
-  // implicit prelim (recipeScope null there = no-op) — so every downstream consumer of
+  // implicit clearotron (recipeScope null there = no-op) — so every downstream consumer of
   // job.jurisdictions/classes/platforms sees the scope the preview promised.
   foldRecipeScope(job, ctx.searchPolicy);
   // Phase 2a: "knockout" is now a dispatchable pipeline — the refusal covers only shapes THIS build
@@ -2285,7 +2293,7 @@ function attachRegisterPlan(ctx, { frozenOnly = false } = {}) {
   // Repair-first D, hotfixed 2026-07-06 (The Quiet Trail e2e): the gate now applies the round's own
   // doctrine to itself — A REPAIRABLE CONDITION NEVER TERMINATES A RUN.
   //   - `repairable` issues (OR-stack width/name length): log-only from ANY provenance — the executor
-  //     chunks oversized stacks at runtime (, proven live). The 2026-07-06 failure was exactly this
+  //     chunks oversized stacks at runtime (proven live). The 2026-07-06 failure was exactly this
   //     gate throwing on a 674-name entry INHERITED byte-identical from a pre-split July-3 store via
   //     the recall-monotone extension — a run the executor would have completed.
   //   - `unexecutable` issues (empty terms, unknown predicate, non-numeric classes, dangling guards):
@@ -2660,7 +2668,7 @@ function deriveFloorDuty(ctx, r, trigger = null) {
     try { placements = parsePlacementsJson(readFileSync(P.placementModel, "utf8")).placements; }
     catch (e) { return notComputable(`placements.json unparseable: ${String(e?.message ?? e).slice(0, 80)}`); }
     const artifact = reconcileFloorDuty({ floors, placements });
-    // The pass's own outcome, beside the rows. 's lesson: a stage that failed or skipped makes every
+    // The pass's own outcome, beside the rows. That lesson: a stage that failed or skipped makes every
     // record it did not reach an UPSTREAM ABSENCE, not a judgment, and a reader blaming the seat for a
     // crash is reading the artifact wrong.
     artifact.pass = { ok: r?.ok === true, skipped: r?.skipped === true };
@@ -2952,7 +2960,7 @@ function recordSynthesisSeam(ctx, r, trigger = null) {
       // say only that synthesis had not delivered it. The sibling seam one stage earlier
       // (`recordDigestSeam`) has read its stage's own output per record since it was written; this one
       // had nothing to read until `record_declination` gave synthesis somewhere to say it.
-      // The judgment itself is `seamReasonFor`, pure and next door, so 's guarantee has an arm
+      // The judgment itself is `seamReasonFor`, pure and next door, so the guarantee has an arm
       // that does not need a run directory. This callback is now only the plumbing around it.
       return seamReasonFor(declined, uri);
     },
@@ -3016,7 +3024,7 @@ export function deriveRecordCarry(ctx, trigger, { findings = null } = {}) {   //
     // ── THE RECONCILIATION RATCHET ────────────────────────────────────────────────────────────
     //
     // RECORDED ON EVERY RUN, tripping only against the committed floor. Both halves are deliberate:
-    // a gate that fires on every current run teaches its reader that red means nothing ('s whole
+    // a gate that fires on every current run teaches its reader that red means nothing (the whole
     // complaint), and a warning that never bites is decoration. The floor is what the contract achieves
     // today, dated and seeded from a delivered round, and it moves UP when the seat-compliance work
     // lands.
@@ -3168,7 +3176,7 @@ function plannedChannelsFor(P) {
 
 // ── part 2 — THE CHANNEL COMPARISON, AT SEARCH-STAGE EXIT ────────────────────────────────────
 //
-// Part 1 shipped the comparison and wired the plan into it (,), and it runs at PUBLISH —
+// Part 1 shipped the comparison and wired the plan into it (), and it runs at PUBLISH —
 // where the rest of the carry trace is derived, about two hours after the sweep it describes. The issue
 // asked whether plan-vs-executed is knowable earlier. It is: the merged grid has just been written and
 // the spec has been on disk since dispatch, so both inputs exist at this instant and neither changes.
@@ -3423,7 +3431,7 @@ async function runDigest(ctx, opts = {}) {
   // — THE SAME SENTINEL IS THE COVERAGE FORM'S ERA STAMP, AND THE WRITE ORDER IS THE FAIL-CLOSED
   // LEG. `armCoverageForm` stamps `form_required: true` BEFORE `writeCoverageForm` puts the form on
   // disk. Get that order wrong and a failed form write leaves no stamp, the gate never arms, and the run
-  // passes having judged nothing — which is 's confirmed blocker (a missing sidecar returns
+  // passes having judged nothing — which is the confirmed blocker (a missing sidecar returns
   // {rows:null,error:null}, the validator finds nothing to judge, and a run with NO ruling artifact is
   // byte-for-byte indistinguishable from a fully ruled one). It is reachable: a full disk fails as
   // "artifact absent", not as a disk error. In this order a failed write leaves a stamp saying a form
@@ -3571,7 +3579,7 @@ async function runDigest(ctx, opts = {}) {
 export function digestDispatchExtra(ctx, { trigger = "fresh", willRun = true, extra = undefined } = {}) {
   const P = ctx.paths;
   let out = extra;
-  // — THE COVERAGE FORM BRIEF, replacing 's deferred-slice block (was A8, 2026-07-30).
+  // — THE COVERAGE FORM BRIEF, replacing the deferred-slice block (was A8, 2026-07-30).
   //
   // What stood here composed a prose list of every deferred qid and told the stage each one "must appear
   // VERBATIM in a Coverage-ledger row". The block's own doc block explained why it could not elide any of
@@ -4189,7 +4197,7 @@ async function stageOnce(name, ctx, opts = {}) {
   // path all reach the seat through here, and three separate pre-dispatch writes would be three chances
   // to disagree about what the seat was handed.
   //
-  // ORDER MATTERS AND IT IS THE FAIL-CLOSED WAY ROUND ('s lesson): the era stamp lands first, above,
+  // ORDER MATTERS AND IT IS THE FAIL-CLOSED WAY ROUND (the lesson): the era stamp lands first, above,
   // so a form write that fails leaves a stamp saying a form was required and no form to fill — a named,
   // loud state — rather than no stamp at all, which would silently disarm the whole arm on exactly the
   // run it governs.
@@ -4259,7 +4267,7 @@ async function stageOnce(name, ctx, opts = {}) {
   // The carry fills the gap BEHIND them: a cold re-dispatch that would otherwise re-commission the stage
   // from def.message(ctx) and throw away everything the parked cycle achieved.
   // — WHAT THIS RUN HAS ALREADY CORRECTED FOR THIS SEAT. Read from `_driver/<seat>.jsonl`, the
-  // same per-attempt record 's acceptance criterion is written against, so the fix and its test
+  // same per-attempt record the acceptance criterion is written against, so the fix and its test
   // bind to one authority. Best-effort by construction: no log, an unreadable log or a damaged line
   // yields an empty list and the followup is byte-identical to what it was before.
   const carry = (opts.followup == null && opts.freshMessage == null && out)
@@ -4709,7 +4717,7 @@ export function buildFailurePacket({ runId, agent, job = {}, failedStage, shortR
     // `failed: true` and `kind: "run-failed"` (added by both callers) are UNCHANGED on a refusal, and
     // deliberately: they are the packet's ROUTING — "this run delivered nothing, send the no-delivery
     // notice" — and every relay, the outbox and docs/DELIVERY.md are built on them. `refused` is the
-    // discriminator beside them, written true OR false on every packet for 's reason: an absent key
+    // discriminator beside them, written true OR false on every packet for the reason: an absent key
     // must not be the only thing separating "not a refusal" from "a packet written before the field
     // existed".
     runId, agent, failed: true, refused,
@@ -4730,8 +4738,8 @@ export function buildFailurePacket({ runId, agent, job = {}, failedStage, shortR
         : `<p>${esc(orderedIs)} for <b>${esc(mark)}</b> FAILED at stage <b>${esc(failedStage)}</b>${priorAttempts ? ` after <b>${priorAttempts} automatic recovery attempt${priorAttempts === 1 ? "" : "s"}</b>` : ""} and NOTHING was delivered.</p><p>${esc(kindLine)}</p><p>The driver reported, verbatim:</p><pre style="white-space:pre-wrap">${esc(reasonVerbatim)}</pre>${detailBlock}${attempted}<p>The run directory is preserved for diagnosis; re-trigger the run when the cause is addressed.</p>`,
     whatsappTo,
     whatsappText: refused
-      ? `⛔ Prelim search for ${mark} REFUSED at ${failedStage} [${terminalKind}]: ${shortReason} — nothing was delivered and nothing broke; ${retryHint}.`
-      : `❌ Prelim search for ${mark} FAILED at ${failedStage}${priorAttempts ? ` after ${priorAttempts} automatic recovery attempt${priorAttempts === 1 ? "" : "s"}` : ""}${terminalKind ? ` [${terminalKind}]` : ""}: ${shortReason} — nothing was delivered; ${retryHint}.`,
+      ? `⛔ Clearotron search for ${mark} REFUSED at ${failedStage} [${terminalKind}]: ${shortReason} — nothing was delivered and nothing broke; ${retryHint}.`
+      : `❌ Clearotron search for ${mark} FAILED at ${failedStage}${priorAttempts ? ` after ${priorAttempts} automatic recovery attempt${priorAttempts === 1 ? "" : "s"}` : ""}${terminalKind ? ` [${terminalKind}]` : ""}: ${shortReason} — nothing was delivered; ${retryHint}.`,
     markName: job.markName ?? job.name ?? null, failedStage, reason: shortReason,
     reasonVerbatim, failureSignature: sig, failClass, terminalKind, repairs, recoveryAttempts: priorAttempts,
     reasonDetail: detail, reasonQuantity: quantity,
@@ -5137,7 +5145,7 @@ export function projectStageInput(label, absPath) {
 // that receipt, and this is where it becomes readable off the run rather than inferable from a token
 // that no longer names it.
 //
-// WHY IT ALSO FIRES ON THE FAILURE PATH. The two numbers this writes are the ones 's sequencing
+// WHY IT ALSO FIRES ON THE FAILURE PATH. The two numbers this writes are the ones the sequencing
 // ruling says the boundary gets tuned against — obligations carrying a written disposition that failed
 // to bind, against obligations the model never addressed. Recorded only where the gate PASSED, they
 // would be missing from exactly the runs that need explaining: a run that still goes terminal at
@@ -5175,7 +5183,7 @@ export function connotationAuditSeats(P, runDir) {
 }
 
 // EXPORTED FOR THE SAME REASON `connotationAuditSeats` IS: the seat resolution was testable and the
-// numbers it produces were not, so 's whole point — that the audit READS the verdict ledger — was
+// numbers it produces were not, so the whole point — that the audit READS the verdict ledger — was
 // asserted only in the pure functions it calls. A wiring that never runs in a test is a wiring nobody has
 // seen work.
 export function recordConnotationAudit(run, P) {
@@ -5184,7 +5192,7 @@ export function recordConnotationAudit(run, P) {
     let didNotBind = 0, neverAddressed = 0, quotesUnbound = 0, recordedQueries = 0;
     // — the three numbers that make "never addressed" falsifiable. `unruledAll` is the TOTAL this
     // audit used to report under `obligationsNeverAddressed`, kept as its own field so the split can
-    // never take a headline number to zero without a companion rising to meet it ('s hazard, in the
+    // never take a headline number to zero without a companion rising to meet it (the hazard, in the
     // very number is about).
     let unruledAll = 0, addressedNotDischarged = 0, ledgerCalls = 0, ledgerSeats = 0;
     const refusalReasons = {};              // — the LEDGER's reasons: every refusal and drop recorded
@@ -5288,7 +5296,7 @@ export function recordConnotationAudit(run, P) {
         if (!id || groundsSeen.has(id)) continue;
         groundsSeen.set(id, classifyGroundsNote(r?.note));
       }
-      // The two states 's sequencing ruling asks to be counted apart, in the form's vocabulary: a row
+      // The two states the sequencing ruling asks to be counted apart, in the form's vocabulary: a row
       // the seat WROTE that the gate cannot accept (a damaged form — the disposition exists and is
       // readable) against a row it never filled in at all.
       const damaged = conn.filter((v) => v.reason === "form_damaged");
@@ -5355,7 +5363,7 @@ export function recordConnotationAudit(run, P) {
       // The rename is the fix, not a tidy-up. On R5 round 7a30934b the artifact carried
       // `refusalReasons: {}` beside a ledger of 193 refusals over 8 types, because everything had been
       // discharged by the end. Nothing was wrong with the number; the name promised the other population,
-      // so an empty map read as "nothing was refused" and took 's acceptance criterion C with it.
+      // so an empty map read as "nothing was refused" and took the acceptance criterion C with it.
       if (foldIntoRunTotals) for (const [reason, n] of Object.entries(ledgerReasonHistogram(ledger)))
         refusalReasons[reason] = (refusalReasons[reason] ?? 0) + n;
       // — the part of that histogram that belongs to no row, kept separately so `refusalReasons`
@@ -5436,7 +5444,7 @@ export function recordConnotationAudit(run, P) {
       unruledRefusalReasons,
       // ITS OWN CARDINALITY, NAMED. The issue that found the empty histogram read
       // `distinctReasons: 14` as its count and concluded the map had been dropped after being counted.
-      // It had not: `distinctReasons` is 's SECOND SCALE — distinct executed query SHAPES, from
+      // It had not: `distinctReasons` is the SECOND SCALE — distinct executed query SHAPES, from
       // `connotationReasonKey` over the grid — and has nothing to do with refusal tokens. Two unrelated
       // numbers, one of them named `…Reasons`, one screenful apart. Naming both is the fix for that
       // reading; asserting they agree, which the issue asked for, would assert something false.
@@ -6135,8 +6143,70 @@ function sentinel(runDir, name, obj) {
   atomicWrite(join(runDir, name), JSON.stringify({ ts: new Date().toISOString(), ...obj }, null, 2) + "\n");
 }
 
+/**
+ * Settle every queued what-if BEFORE the run dir moves into the archive — tracker issue 240.
+ *
+ * A queued job lives under the run directory, and the worker enumerates candidates with `liveRunDirs`,
+ * which skips `archive` outright. So archiving carried a pending job out of the worker's reach: not
+ * claimed, not settled, not refused. The client who asked for it got no answer and no explanation, and
+ * no row anywhere said why. That is an absence reported as nothing at all — the one shape
+ * `whatIfRefusal` exists to prevent.
+ *
+ * BEFORE the rename, deliberately: the settlement is written into the run dir and travels with it, so
+ * the answer is on disk in the archive where the read tool will look for it.
+ *
+ * ✕ THE SENTENCE IS PER KIND, and a memo does not get the stage one. `whatIfRefusal`'s standing
+ * refusal — "this run is delivered or archived, what-if runs on live runs only" — is TRUE of a stage
+ * and FALSE of a memo, which runs on archived evidence by design. Telling a client their memo was
+ * refused because the run is archived would be a false sentence in the one place they go to find out
+ * what happened. A memo is closed on the true reason instead: it was queued before the run archived,
+ * and the drain does not reach an archived run.
+ *
+ * ✕ A JOB ANOTHER WORKER IS ACTIVELY RUNNING IS LEFT ALONE. `pendingWhatIf` returns queued jobs and
+ * claims older than an hour, never a fresh claim, so a live worker's job is not settled underneath it.
+ * A fresh claim at the moment of archiving is a race this does not close, and it is written down
+ * rather than papered over.
+ *
+ * Best-effort throughout: a failure to settle must never stop the archive, because a run that cannot
+ * archive is a much larger problem than a job with no row.
+ */
+export function settlePendingWhatIfsBeforeArchive(run) {
+  let pending = [];
+  // NOT a silent catch. This function exists because a job went unanswered with no row anywhere; a
+  // failure to enumerate that returned quietly would reproduce exactly that, one level up, and the
+  // archive would still succeed so nothing downstream would look wrong.
+  try { pending = pendingWhatIf(run.runDir); }
+  catch (e) { note(`what-if settle before archive could not enumerate the queue (${String(e?.message ?? e).slice(0, 120)}) — pending jobs may be unanswered`); return; }
+  for (const entry of pending) {
+    try {
+      // CLAIM FIRST, exactly as the worker does. `finishWhatIf` writes the terminal file and does not
+      // remove the `.json`; the claim is what renames it out of the queue. Settling without claiming
+      // writes a `.failed` beside a `.json` that still reads as QUEUED to every reader — the job would
+      // look pending and answered at the same time, which is worse than the silence being fixed here.
+      const job = claimWhatIf(entry);
+      if (!job) continue;                     // another worker won it, or it vanished — not ours to settle
+      const kind = job?.op?.kind === "memo" ? "memo" : "stage";
+      // ✕ THE SENTENCE IS PER KIND. The standing refusal — "what-if runs on live runs only" — is TRUE
+      // of a stage and FALSE of a memo, which reasons over archived evidence by design. A memo is
+      // closed on the true reason instead.
+      const error = kind === "memo"
+        ? "this what-if was queued before its run was archived, and the drain does not reach an archived run — ask it again against the archived run, which a memo may read"
+        : (whatIfRefusal({ location: "archive", state: run.state ?? null, kind }) ?? "this run is delivered or archived — what-if runs on live runs only");
+      finishWhatIf(run.runDir, entry.id, { ok: false, op: job.op ?? null, error });
+      try { runLog(run.runDir, { event: "whatif-settled-on-archive", id: entry.id, kind, stale: entry.stale }); }
+      catch { /* the row is written; the log line is a convenience and must not undo it */ }
+    } catch (e) {
+      // One job's settlement must not cost the others, or the archive — but it must not be SILENT
+      // either. A swallowed failure here leaves exactly the unanswered job this function exists to
+      // prevent, and the archive still succeeds, so nothing downstream looks wrong.
+      note(`what-if ${entry.id} could not be settled before archive (${String(e?.message ?? e).slice(0, 120)}) — it may be unanswered`);
+    }
+  }
+}
+
 function archive(run) {
   try {
+    settlePendingWhatIfsBeforeArchive(run);
     mkdirSync(dirname(run.archiveDir), { recursive: true });
     renameSync(run.runDir, run.archiveDir);
     return run.archiveDir;
@@ -6674,7 +6744,7 @@ function injectDeferralCoverage(P, runDir, note) {
 // (findings.json coverage vocabulary calls the field `state`; the register ledger calls the same
 // closed token `status` — one vocabulary, two key names.)
 // — LANE-GENERAL, not zh-hardcoded. LANGUAGE_LANES defines zh, ja and ko; the disclosure was
-// written for zh alone, so a Japan- or Korea-scoped run at plain prelim said NOTHING about the
+// written for zh alone, so a Japan- or Korea-scoped run at plain clearotron said NOTHING about the
 // Japanese/Korean-script equivalents it had not searched. Silence there is indistinguishable from
 // "there was nothing to search" — the same absence-reads-as-a-pass class as the remedy-term half of
 //, one layer over.
@@ -7055,7 +7125,7 @@ export function fullProseOrdinals(findings) {
 // ADVISORY_KINDS member could never reach a client document at all. The 2026-07-16 comment described the
 // behaviour it shipped with and became stale prose sitting next to code that contradicted it.
 //
-// Owner ruling 2026-08-19 (relayed), on a renewal-deadline example: it renders. 's intent is the
+// Owner ruling 2026-08-19 (relayed), on a renewal-deadline example: it renders. That intent is the
 // ruled behaviour. The tag is REQUIRED, not decoration — `advisoryLine` interpolates ADVISORY_TAG[a.kind]
 // directly, so a kind that passes the filter without an entry here renders "- **undefined** …" into a
 // client document. Whoever adds a fifth kind adds it in both places, and render.mjs needs the matching
@@ -7123,7 +7193,7 @@ export function buildOnlyYouSection(actions, findings, { nowMs = Date.now(), wit
   //
   // WHAT DOES NOT HOLD, and is not claimed: an ask may still name a party THE RUN NEVER SAW — a
   // supplier, a licensee, a distributor no finding carries. No index built from findings can see it.
-  // 's orphan lint is what catches that at delivery, and this is the producer telling the truth
+  // That orphan lint is what catches that at delivery, and this is the producer telling the truth
   // about its own reach instead of covering for it.
   const byOrd = new Map((findings ?? []).filter((f) => f && f.disposition !== "withdrawn").map((f) => [f.ordinal, f]));
   const partyIndex = cardedParties(findings);
@@ -7152,7 +7222,7 @@ export function buildOnlyYouSection(actions, findings, { nowMs = Date.now(), wit
   // Terminal punctuation on the ask BEFORE the subject join. This was written to work around a cut —
   // actYouConditions ended its bound line at the first '.' or ':' before whitespace, and the subject's
   // own "(re:" qualified, so a period-less ask (the synthesis prompt demands one sentence but nothing
-  // enforces terminal punctuation) delivered as a mangled "…terms (re". THAT CUT IS GONE (, owner
+  // enforces terminal punctuation) delivered as a mangled "…terms (re". THAT CUT IS GONE (owner
   // ruling 2026-08-10): the conditions box now renders the ask and its subject whole. The punctuation
   // stays because it was always the right output — "Instruct counsel on the joined-script forms (re: X)"
   // reads as one run-on sentence, and the period is what separates the ask from the driver's own note.
@@ -7262,7 +7332,7 @@ export function buildOnlyYouSection(actions, findings, { nowMs = Date.now(), wit
 // senior-eye-review.md through `parseVerdict` and `parseCorrections` — the SHIPPED parsers, the same
 // ones the corrective ladder builds its worklist from — and never asks a model to restate them.
 //
-// ── NOT BLOCKING-ONLY ANY MORE — OWNER DECISION, 2026-08-26 (, T3b) ─────────────
+// ── NOT BLOCKING-ONLY ANY MORE — OWNER DECISION, 2026-08-26 (T3b) ─────────────
 //
 // This section used to return "" on every verdict but BLOCKING, and the reason it gave was that
 // CONDITIONAL reviews already deliver and their flags already reach the corrective pass. That is true
@@ -7503,7 +7573,7 @@ export function assembleReportMd(P, findings, cardOrdinals, { grouped = [], byRi
     if (fc.fold) folds.push({ ...fc.fold, surface: "overview:caption" });
   }
   // spec 64 — merge the code-built only-you section into the overview's # Actions block. A model-
-  // authored "### Only you can close these" (pre- prompt, or drift) is REPLACED wholesale —
+  // authored "### Only you can close these" (pre-change prompt, or drift) is REPLACED wholesale —
   // code wins, so the section can never contradict the register the verdict derives from.
   // PR-9 — same pattern for "### Answers to your instructions": code-built from the findings.json
   // ask_answers register joined to the frozen intake asks; an authored section is replaced wholesale.
@@ -7651,7 +7721,7 @@ export function assembleReportMd(P, findings, cardOrdinals, { grouped = [], byRi
     // that was checked, and nothing made them.
     //
     // FULL TEXT. Nothing on any surface shortens a judgment sentence — the renderer's 240-character fold
-    // was deleted with (2026-08-06) and no cap replaced it; the sentence is bounded by 's shape
+    // was deleted with (2026-08-06) and no cap replaced it; the sentence is bounded by the shape
     // contract instead. Whitespace is collapsed only so the value cannot break the one-line `- key:`
     // shape parseCards keys on.
     //
@@ -8066,7 +8136,7 @@ async function pipelineInner(job, opts = {}) {
   // recovery ladder's weather lane exists so a 529 does not spend the defect budget. Refusing there would
   // replace a park that recovers with a terminal failure and a human.
   //
-  // GATED like the credential check, not like the binary check, and that is 's ruling rather than
+  // GATED like the credential check, not like the binary check, and that is the ruling rather than
   // this file's: lanes with an injected recordFetcher and explicitly-selected knockout products do not
   // pay for the turn. Both of those lanes DO spawn the engine (preflightEngineBinary's header says so in
   // as many words), so the exemption is narrower than the reasoning that produced it — recorded on the
@@ -8248,7 +8318,7 @@ async function pipelineInner(job, opts = {}) {
   // Search-depth spine — freeze WHICH product shape this run is BEFORE the framework freeze (Phase 2a:
   // the knockout lane selects a different fallback framework, so the dispatch must happen first; the
   // policy freeze reads only ctx.profile). Cold-start mint only, like the profile freeze: a resumed
-  // pre-spine run reads as legacy-implicit prelim, never retro-minted.
+  // pre-spine run reads as legacy-implicit clearotron, never retro-minted.
   attachSearchPolicy(ctx, job, { write: !isResume });
   // acceptance 5 — recorded on EVERY run, ungraded included: "which ladder applied" must be a
   // read, never an inference from which product the job asked for.
@@ -8499,7 +8569,7 @@ async function pipelineInner(job, opts = {}) {
   ctx.exclusionSeed = applicantMatchesProfile(ctx.profile, job.customer) ? (ctx.profile.selfExclusionOwners ?? []) : [];
   if (ctx.exclusionSeed.length) runLog(run.runDir, { event: "profile-exclusion-seed", owners: ctx.exclusionSeed.length });
   // On resume, rehydrate the driver-owned notes that must survive a park. (The failover provenance that
-  // used to be rehydrated alongside is deleted with the chain, — no run ever carried any.)
+  // used to be rehydrated alongside is deleted with the chain — no run ever carried any.)
   if (isResume) {
     try {
       const prior = JSON.parse(readFileSync(join(run.runDir, "status.json"), "utf8"));
@@ -8527,7 +8597,7 @@ async function pipelineInner(job, opts = {}) {
   // is measured against. Best-effort: a run must never fail because it could not be sized.
   ctx.quote = quoteForJob({ job, profile: ctx.profile, searchPolicy: ctx.searchPolicy });
   if (ctx.quote) runLog(run.runDir, { event: "quote", ...ctx.quote });
-  note(`\n=== prelim-driver: ${run.slug} / ${run.date}-${run.codename} (agent=${agent}) ===`);
+  note(`\n=== clearotron-driver: ${run.slug} / ${run.date}-${run.codename} (agent=${agent}) ===`);
 
   try {
     // Phase 0 done in code (slug/codename/run-dir/customer). Phase 1+2 stages:
@@ -8694,7 +8764,7 @@ async function pipelineInner(job, opts = {}) {
     // register candidates for the
     // frozen policy's jxLanes component, folded run-local onto the transliteration-numeric axis so the
     // unit spawn (axis-from-plan below), coverage skeleton, taint chain and clean gates inherit with
-    // zero new wiring. Lazy import (a plain prelim never loads jx machinery — byte-identical off);
+    // zero new wiring. Lazy import (a plain clearotron never loads jx machinery — byte-identical off);
     // never-kill inside runJxCandidateFold (a degraded lane logs + receipts, the Latin plan stands).
     if (ctx.searchPolicy?.components?.jxLanes && ctx.registerPlan) {
       const { runJxCandidateFold } = await import("./jx.mjs");
@@ -9370,7 +9440,7 @@ async function pipelineInner(job, opts = {}) {
           // correctly; renaming would churn a documented vocabulary across two producers, a map and a
           // parameter, to fix a field that is not the one lying.
           //
-          // So the row gains the result as a SIBLING — 's other remedy — and the push moves below the
+          // So the row gains the result as a SIBLING — the other remedy — and the push moves below the
           // taint re-read so there IS a result to state. `cleared` is the same fact `axesRec[a].status`
           // records two lines down, from this same read.
           if (taintRerunDispatch !== null) {
@@ -11724,7 +11794,7 @@ async function pipelineInner(job, opts = {}) {
     // deliver-conditional floor) keys on actions[]; a v4 emission that omits the field entirely would
     // silently disengage it — the exact CLEAR-despite-conditions bug this ships to fix. Same posture as
     // the schema-downlevel demand above: ONE warm re-demand, only when synthesis actually RAN this turn
-    // (a resumed pre- artifact keeps its shape — logged loudly, gates degrade); still-absent
+    // (a resumed pre-change artifact keeps its shape — logged loudly, gates degrade); still-absent
     // after the demand is logged and rides on (deliver-always, the reviewer's actions-unregistered flag
     // and the predelivery coherence lint remain the nets).
     const readActionsPresence = () => {
@@ -12048,7 +12118,7 @@ async function pipelineInner(job, opts = {}) {
         // — what the DECLARED scope was and whether the pass honoured it. Recorded, never refused:
         // a gate here costs a whole extra dispatch on the stage this change exists to make cheaper, and
         // the reviewer is about to read the table anyway — it is better placed than a diff to say
-        // whether a knock-on edit was right. `unbound` is 's `cite_unbound` shape one gate over and
+        // whether a knock-on edit was right. `unbound` is the `cite_unbound` shape one gate over and
         // would earn a refusal if it recurs; this round measures whether it does.
         correctionsScope = scopeDrift(rows, preDoc, postDoc);
         atomicWrite(P.correctionsApplied, JSON.stringify({ ts: new Date().toISOString(), verdict,
@@ -12861,7 +12931,7 @@ async function pipelineInner(job, opts = {}) {
     // round carry no _driver/jx-lanes.json at all. On those the writer would reach its absent arm and
     // print "NOT writing one", which reads as a withheld action on a run where absence is simply normal.
     // That is the absent-vs-failed conflation this tranche exists to remove; a lazy import also keeps a
-    // plain prelim byte-identical, which is why the sibling sites are shaped this way.
+    // plain clearotron byte-identical, which is why the sibling sites are shaped this way.
     if (ctx.searchPolicy?.components?.jxLanes) {
       try {
         const { stateJxSlices } = await import("./jx.mjs");
@@ -13221,7 +13291,7 @@ async function pipelineInner(job, opts = {}) {
         // one, because the sibling's population boundary is deliberate and correct. It covers a
         // finding-ending followed by SILENCE; this covers one followed by a SENTENCE.
         //
-        // On R2 `russet-kestrel` the sibling logged `checked:5 matched:5 lost:0` — correctly — on a
+        // On a delivered R2 run the sibling logged `checked:5 matched:5 lost:0` — correctly — on a
         // delivery missing two marks from the lawyer's final list, one rated HIGH. They were dropped with
         // a reason, so they were outside its population by design. A drop with a reason nobody verifies
         // is not accounted for; it is unexamined with a paper trail, and that delivery carried 66 of them.
@@ -13678,7 +13748,7 @@ async function pipelineInner(job, opts = {}) {
           note(`registry-record closure: ${missing.length} cited record(s) absent from the run's set — targeted fetch`);
           const fetcher = opts.recordFetcher ?? defaultRecordFetcher;
           for (const uri of missing) {
-            const r = await fetcher(uri, { agentId: "prelim-driver", sessionKey: `${lintPrefix}record-closure`, recordLog: runRecordLogPath(run.runDir) });
+            const r = await fetcher(uri, { agentId: "clearotron-driver", sessionKey: `${lintPrefix}record-closure`, recordLog: runRecordLogPath(run.runDir) });
             if (!r.ok) recordFetchFailures.set(uri, r.cause);
           }
           assembled = assembleRunRecords(run.runDir, lintPrefix);   // pick up the closure fetches
@@ -13775,7 +13845,7 @@ async function pipelineInner(job, opts = {}) {
           askAnswers: lintAskAnswers,   // PR-9 — present ⇒ the intake-ask check judges the deterministic join, not fuzzy containment
           cardFolds: (() => { try { return JSON.parse(readFileSync(driverDir(run.runDir, "card-folds.json"), "utf8")).folds; } catch { return null; } })(),   // PR-9 — fold observability (flag-only)
           extraPlatformNames: ctx.profile?.platforms ?? [],   // WS-B: profile marketplaces are run vocabulary
-          // tracker issue 134 — the SAME structure the masthead's coverage_line is stamped from
+          // the SAME structure the masthead's coverage_line is stamped from
           // (scope-facts.json, written by writeScopeFacts). Passing the sidecar rather than re-deriving
           // is the point of the issue: the stamped line and the prose check now answer to one searched
           // set, so they cannot state two different answers about what was searched. Absent sidecar ⇒
@@ -14066,7 +14136,7 @@ async function pipelineInner(job, opts = {}) {
               // thousands of lines earlier, at the gate. Nothing re-reads it, so a reviewer that refuses to
               // sign DURING this repair is written to disk and never heard.
               //
-              // Measured on `bf21580e` (, round of 2026-08-23): verdict-2 CONDITIONAL at 00:22:11;
+              // Measured on `bf21580e` (round of 2026-08-23): verdict-2 CONDITIONAL at 00:22:11;
               // `delivery-stale-repair` at 00:38:35 naming narrative-refutation; the review landing BLOCKING
               // at 00:52:01; delivered. The narrative printed a registration date of 1 March 2011 against a
               // fetched record reading 25 February 2011 — the reviewer said so, in the document nobody read.
@@ -14563,7 +14633,7 @@ async function pipelineInner(job, opts = {}) {
     // ratings (joinFindingToBlock), never the summary's own words.
     try { emailVerdictOpts.findings = parseFindingsJsonLenient(readFileSync(P.findings, "utf8"))?.findings ?? undefined; } catch { /* no findings — table falls back to the summary words */ }
     // doc 50 — the run's band ladder: the email table colours + sorts by the framework in force's own
-    // vocabulary (zephyr "Medium", house "Moderate", aurora's five bands) instead of the fixed table.
+    // vocabulary (one framework's "Medium", the house's "Moderate", another's five bands) instead of the fixed table.
     if (ctx.framework) emailVerdictOpts.bands = ctx.framework.bands.map((b) => ({ label: b.label, tone: b.tone }));
     // ONE report (spec 2026-07-30 §6): the cover note is a cover note — verdict, one-line summary, link.
     // A10 (addendum, 2026-07-30) NARROWS the old "machine-QC never on the email" rule rather than
@@ -14602,16 +14672,19 @@ async function pipelineInner(job, opts = {}) {
         conversationId: job.conversationId ?? null,   // reply-lane fallback when msgId is not a Graph id
         subject: deliverySubject(emailProductName, job),
         emailBodyHtml: readFileSync(P.emailBody, "utf8"),
-        whatsappTo: AGENT_WHATSAPP[agent] ?? null,
-        whatsappText: `✅ Prelim search for ${mark}${ref}${vtag} is done. Report: ${published.url}`,
+        // — the notice goes to whoever ASKED, with the operator's copy beside it and a
+        // stated reason when no number is held. It used to go to AGENT_WHATSAPP[agent], which is the
+        // operator on every run because every user shares one agent id.
+        ...whatsappRouting(job, agent),
+        whatsappText: `✅ Clearotron search for ${mark}${ref}${vtag} is done. Report: ${published.url}`,
         url: published.url, verdict, markName: job.markName ?? job.name ?? null,
       };
       // A NEW send supersedes any previous one: .sent is PER-SEND idempotence, not per-run-lifetime.
       // A run that terminally failed (notice sent → .sent written) and was then resumed to success
-      // would otherwise be SKIPPED by prelim-deliver's .sent guard — the report would never send.
+      // would otherwise be SKIPPED by clearotron-deliver's .sent guard — the report would never send.
       // The stale failure packet goes too, so the run dir tells exactly one delivery story. B4: the
       // per-channel send receipts are per-SEND state exactly like .sent — a stale email receipt from
-      // the superseded send would make prelim-deliver skip THIS packet's email, so they reset together.
+      // the superseded send would make clearotron-deliver skip THIS packet's email, so they reset together.
       try { rmSync(join(run.runDir, ".sent")); } catch { /* none */ }
       try { rmSync(driverDir(run.runDir, "send-receipts.json"), { force: true }); } catch { /* none */ }
       try { rmSync(driverDir(run.runDir, "failure.json")); } catch { /* none */ }
@@ -14691,7 +14764,7 @@ async function pipelineInner(job, opts = {}) {
     //      lands on "unknown", which buys one recovery park — the run would write `.postponed` and the
     //      runner would auto-resume it two minutes later and keep billing.
     //   2. The failure packet would tell them their search BROKE. buildFailurePacket's copy is
-    //      "❌ Prelim search for X FAILED at Y", pushed to the customer over the outbox. Someone who
+    //      "❌ Clearotron search for X FAILED at Y", pushed to the customer over the outbox. Someone who
     //      pressed Stop must never be told something went wrong; they already know what happened.
     //
     // Partial work is not deliverable, so nothing is published — but the spend up to this point is
@@ -14873,7 +14946,7 @@ async function pipelineInner(job, opts = {}) {
       // is precisely what `recoveryResumesAt` means. So a weather park writes `recoveryResumesAt` like
       // any other recovery park, still leaves `resetsAt` null, and the record says WHICH lane bought
       // the wait in `recoveryLane` instead of implying a provider clock that does not exist.
-      // tracker issue 103 — A CAP PARK IS NOT A STAGE FAILING, and the 2/15/60 ladder cannot survive one.
+      // A CAP PARK IS NOT A STAGE FAILING, and the 2/15/60 ladder cannot survive one.
       // A cap that classifies `rate_limited` already takes the postpone path and waits for its stated
       // reset. One that does NOT lands here, where two things used to go wrong: the provider's own reset
       // hint was dropped even though StageFailure carries it all the way to this site, and the ladder
@@ -14910,7 +14983,7 @@ async function pipelineInner(job, opts = {}) {
       // lane's spend is recomputed from the record rather than from a second counter that could drift
       // (writeRunStatus shallow-merges, so the full array is passed each time).
       // — a PARKED run is the one a reader diagnoses from status.json alone, and this cut at 200
-      // and said nothing. `recovering` is not terminal, so it was never covered by 's terminal
+      // and said nothing. `recovering` is not terminal, so it was never covered by the terminal
       // fields; the reader's problem is identical either way — a sentence that stops mid-thought with
       // no key admitting it stopped. Same three fields, same function, so the two cannot drift.
       writeRunStatus(ctx, { state: "recovering", recoveryAttempts: attempt, recoveryMax, failedStage,
@@ -14920,7 +14993,7 @@ async function pipelineInner(job, opts = {}) {
         //: the row carries the park's progress QUANTITY, so the next failure's comparison can see
         // 9 → 6 (converging) where the signature alone shows only "the same defect again". Written
         // unconditionally as number|null — a row that says null means "this failure had no count", which
-        // is a different fact from a pre- row that has no such key at all.
+        // is a different fact from a pre-change row that has no such key at all.
         //
         //: `quantityToken` and `classSource` ride beside it, written unconditionally as value|null
         // for the same reason. This row is the ONLY one of the three records here that repair-digest.mjs
@@ -14931,7 +15004,7 @@ async function pipelineInner(job, opts = {}) {
         // half the inputs. It also makes the epoch legible: a row with no `classSource` KEY predates
         // this field and was never measured, which is a different fact from a row that says "no gap".
         recoveryHistory: [...recoveryHistory, { sig: failSig.sig, stage: failedStage, class: failClass, lane, attempt, quantity, quantityToken: failSig.quantityToken ?? null, kindToken: failSig.kindToken ?? null, classSource, ts: new Date().toISOString(),
-        // tracker issue 103 — THE SAME FACTS THE RUN LOG ALREADY GETS, in the record that SURVIVES.
+        // THE SAME FACTS THE RUN LOG ALREADY GETS, in the record that SURVIVES.
         // The auto-recovery-parked event below carries capPark/basis/waitMin and says in its own note
         // that a cap has to be legible or nobody can tell a stated reset from our ladder's guess. But
         // run.jsonl is not what the terminal reads: status.json's recoveryHistory is the only record
@@ -14942,7 +15015,7 @@ async function pipelineInner(job, opts = {}) {
         ...(capSchedule ? { capPark: true, recoveryWaitBasis, recoveryWaitMin } : {}) }] });
       rollupStatus(run.studioRoot);
       runLog(run.runDir, { event: "auto-recovery-parked", stage: failedStage, attempt, of: recoveryMax, lane, laneAttempt, laneOf: decision.laneCeiling, recoveryResumesAt, reason: String(reason).slice(0, 200), sig: failSig.sig, class: failClass,
-        // tracker issue 103 — a cap park has to be legible in the record, or the next reader diagnosing
+        // a cap park has to be legible in the record, or the next reader diagnosing
         // "why did this wait 21 hours" cannot tell a provider's stated reset from our own ladder guess.
         // Absent on a non-cap park rather than false: a row that says nothing is honest about not having
         // looked, while `capPark: false` would read as "we checked and it was not one".
@@ -15055,7 +15128,7 @@ async function pipelineInner(job, opts = {}) {
     }
     // T5 (J5) — the failure NOTICE rides the SAME guaranteed lane as success delivery: a
     // CODE-authored packet (_driver/failure.json) + sendPending + the outbox wake marker, consumed by
-    // the completion-watch → prelim-deliver skill exactly like a delivery packet. This makes the
+    // the completion-watch → clearotron-deliver skill exactly like a delivery packet. This makes the
     // notice failure-independent: no WhatsApp binding, a handoff-mode engine, or a dead ping stage can
     // no longer silence it ( F9: teal-keystone died silently on exactly that). Best-effort —
     // packet-write trouble must never mask the original failure; the .failed sentinel + status.json
@@ -15360,7 +15433,36 @@ function experimentEngineName() {
   catch { return String(process.env.CLEAROTRON_AI ?? "").trim().toLowerCase() || null; }
 }
 
+/**
+ * A DRAW IS WORK ON THIS BOX, AND THE DEPLOY GUARD HAS TO BE ABLE TO SEE IT.
+ *
+ * `pipeline()` takes a run slot, so a clearance is visible to `deployRefusal` and an hourly deploy defers
+ * over it. A draw is a direct invocation and took nothing, so the guard saw an idle box and a tick could
+ * fast-forward the checkout, reinstall and restart the units under a running experiment. Measured by the
+ * test lane: the only thing protecting a replication was somebody stopping the deploy timer by hand,
+ * which made that hold load-bearing without anyone having decided it should be.
+ *
+ * IT TAKES ITS OWN LOCK, NOT A RUN SLOT. A run slot is admission-controlled against
+ * `maxConcurrentRuns`, so acquiring one here would make a draw WAIT behind clearances and make clearances
+ * wait behind draws — changing what a draw is in order to fix what a guard can see. The `draw` prefix is
+ * a separate namespace in the same directory: the deploy guard counts it, and nothing else does.
+ *
+ * The cap is deliberately far above any real number of concurrent draws, because this lock exists to be
+ * SEEN and never to ration. A draw that blocked here would be a new failure mode in place of an old one.
+ */
 export async function runExperiment(job, opts) {
+  const lock = await acquireSlot({ dir: config.runLockDir, cap: 1024, prefix: "draw" });
+  try {
+    return await runExperimentInner(job, opts);
+  } finally {
+    // Best-effort, like the run slot's own release: the lock reaper covers a process that dies here, and
+    // a stale draw lock with a dead pid does not refuse a deploy — the guard tests liveness.
+    try { releaseSlot(lock); } catch { /* the reaper covers what this misses */ }
+  }
+}
+
+
+async function runExperimentInner(job, opts) {
   const name = opts.experiment;
   if (!STAGES[name]) throw new Error(`--experiment: unknown stage "${name}"`);
   // The axis is checked for MEMBERSHIP, not truthiness, and BEFORE reconstructCtx touches the run dir.
@@ -15378,7 +15480,7 @@ export async function runExperiment(job, opts) {
   // against REGISTER_AXES would refuse the two arms this issue exists to make work.
   //
   // So the membership test is kept and made PER STAGE: every stage that takes an axis names its own
-  // vocabulary, and a stage that takes none still refuses a stray one — 's guarantee, unchanged,
+  // vocabulary, and a stage that takes none still refuses a stray one — the guarantee, unchanged,
   // over a valid set that is now true for each stage rather than true for one of them.
   const vocab = AXIS_VOCABULARY[name] ?? null;
   if (!vocab && axis !== null)
@@ -15520,6 +15622,17 @@ export async function runExperiment(job, opts) {
     // what RAN.
     engine: experimentEngineName(),
     modelTier: model ?? null,
+    // — THE RATING AUTHORITY THIS ARM RAN UNDER, on the arm's own record.
+    //
+    // `whatIfRun` resolves this correctly and returned it in memory only: nothing in the experiment
+    // directory named the profile it rated under, so a reader coming to the arm tomorrow could not
+    // confirm which framework produced it, and a future regression would be as silent as the one this
+    // was opened on. The frozen sidecar is the authority — never a fresh resolve, which is the mid-run
+    // drift the freeze exists to forbid.
+    //
+    // `null` means the run carries no frozen profile (a legacy run), and it is written rather than
+    // omitted: absent and "there was none" are different facts and only one of them is a defect.
+    ratedUnder: ctx.profile?.profileKey ?? null,
     dispatchTrigger: opts.dispatchTrigger ?? "fresh",
     // — WHICH PASS THIS ARM REPRODUCED, in a word. null on a non-corrective arm;
     // never "dispatched-warm", which is production's alone.
@@ -15839,7 +15952,7 @@ if (isEntrypoint(import.meta.url)) void (async () => {
 
   // — reading the job file used to sit OUTSIDE the try below, so a path typo or a stray comma
   // exited on a raw V8 stack trace: a non-clean exit with no honest message, and the one shape of
-  // mistake a first-time reader is likeliest to make. Kept guarded here through 's rebase — the
+  // mistake a first-time reader is likeliest to make. Kept guarded here through the rebase — the
   // pool check above is a separate refusal and must not swallow this one.
   let job;
   try { job = JSON.parse(readFileSync(a.job, "utf8")); }