clearotron 0.2.1 → 0.2.3

package/driver/result-noun-fields.mjs

@@ -12,7 +12,7 @@
 // property of the WRITING SITE, not of the name — a field called `outcome` carrying an outcome is fine,
 // and a field called `settled` carrying a dispatch return is the defect. Only reading the writer tells
 // them apart, so the population is SPLIT and classified rather than filtered down to the offenders.
-// Both halves are kept, for 's reason: a filtered population produces no number, and nobody can see
+// Both halves are kept, for the reason: a filtered population produces no number, and nobody can see
 // what was hidden.
 //
 // ── THE TWO HALVES ──────────────────────────────────────────────────────────────────────────────────
@@ -48,7 +48,7 @@
 //                   `outcome` for existing readers beside `dispatch` and `verdict`).
 //   "out-of-scope" — never reaches `_driver/*.json` or `run.jsonl`; `atWriteSite` is 0.
 
-/** The result nouns this sweep is about — 's list, verbatim. */
+/** The result nouns this sweep is about — the list, verbatim. */
 export const RESULT_NOUNS = Object.freeze(["outcome", "executed", "permanent", "settled", "closed", "recovered", "verified"]);
 
 export const RESULT_NOUN_FIELDS = Object.freeze([
@@ -66,7 +66,7 @@ export const RESULT_NOUN_FIELDS = Object.freeze([
   { file: "driver/pipeline.mjs", noun: "executed", sites: 4, atWriteSite: 3, verdict: "result",
     why: "lengths of the executed set as the join computed it" },
   { file: "driver/pipeline.mjs", noun: "outcome", sites: 11, atWriteSite: 6, verdict: "result",
-    why: "the one member that reported an invocation — taint-rerun's `r.ok ? \"ok\" : …`, which travels on a StageFailure packet — now carries a `cleared` sibling read from the taint, #1529's remedy 10/5 -> 11/6 at tracker issue 1886: the profile-store receipt's `outcome: pr.outcome`. Classified by READING ITS WRITING SITE, which is profiles.mjs and not this file: the value is one of three literals chosen by a situation the resolver decided (`overlay` and `bundled-fallback` are `pass`, `env-arrived-late` is `blocked`), never a call's return read as a verdict. `bundled-fallback` being `pass` is the point of the whole receipt — a legitimate install that nobody was told about is what this row says out loud." },
+    why: "the one member that reported an invocation — taint-rerun's `r.ok ? \"ok\" : …`, which travels on a StageFailure packet — now carries a `cleared` sibling read from the taint, the remedy 10/5 -> 11/6 at the profile-store receipt's `outcome: pr.outcome`. Classified by READING ITS WRITING SITE, which is profiles.mjs and not this file: the value is one of three literals chosen by a situation the resolver decided (`overlay` and `bundled-fallback` are `pass`, `env-arrived-late` is `blocked`), never a call's return read as a verdict. `bundled-fallback` being `pass` is the point of the whole receipt — a legitimate install that nobody was told about is what this row says out loud." },
   { file: "driver/pipeline.mjs", noun: "permanent", sites: 1, atWriteSite: 1, verdict: "result",
     why: "`permanent.length` — a count of the classified set" },
   { file: "driver/pipeline.mjs", noun: "recovered", sites: 3, atWriteSite: 3, verdict: "result",
@@ -95,6 +95,13 @@ export const RESULT_NOUN_FIELDS = Object.freeze([
   { file: "driver/skills-store-provenance.mjs", noun: "outcome", sites: 6, atWriteSite: 0, verdict: "out-of-scope" },
   { file: "driver/status-snapshot.mjs", noun: "outcome", sites: 1, atWriteSite: 0, verdict: "out-of-scope" },
   { file: "mcp-server/lib/events.mjs", noun: "recovered", sites: 1, atWriteSite: 0, verdict: "out-of-scope" },
+  // Read at the writing site, as this table requires. All three sites are in `knockoutSearches`, a
+  // READ-ONLY projection that composes the rows `list_searches` answers with: it opens no artifact and
+  // writes nothing, so nothing here can reach `_driver/*.json` or `run.jsonl`. Each value is a literal
+  // chosen from the run's own stored record — "found" or "no-hit" from whether the mark has findings,
+  // and "recorded" for a register term whose stored row says it did NOT answer. None is a call's return
+  // read back as a verdict, which is the defect this table exists to find.
+  { file: "mcp-server/lib/knockout.mjs", noun: "outcome", sites: 3, atWriteSite: 0, verdict: "out-of-scope" },
   { file: "mcp-server/lib/ops.mjs", noun: "settled", sites: 1, atWriteSite: 0, verdict: "out-of-scope" },
   { file: "mcp-server/server.mjs", noun: "outcome", sites: 1, atWriteSite: 0, verdict: "out-of-scope" },
   { file: "scripts/backfill-started-at.mjs", noun: "outcome", sites: 5, atWriteSite: 0, verdict: "out-of-scope" },

package/driver/run-economics.mjs

@@ -87,7 +87,7 @@
 // `modelUsed`. So the rows can now answer "what ran", per record, wherever the wire reported.
 //
 // What has NOT changed is this module: `byBilling` / `byStage` / `dispatches` still key on `modelUsed`,
-// i.e. on what was asked for. Switching them to prefer `modelActual` is 's call, not a side effect
+// i.e. on what was asked for. Switching them to prefer `modelActual` is the call, not a side effect
 //, and it cannot be a blanket flip — codex reports no model, and a killed turn may have none,
 // so a per-record basis is the only honest shape. `tokens.mjs` keys its rollup on the requested alias
 // for the same reason and is likewise untouched.
@@ -241,7 +241,7 @@ export const vendorOf = (engine) => ENGINE_VENDORS[String(engine ?? "")] ?? null
 //
 // CODE-SIDE IS NOT A VENDOR. `code:execute-plan` rides nearly every run (the driver executes the frozen
 // plan itself), stamps `authMode: "not-provider-billed"`, and costs no provider tokens. Counting it would
-// make every run in the product read as multi-vendor — the same defect as 's `web` channel, where a
+// make every run in the product read as multi-vendor — the same defect as the `web` channel, where a
 // member the driver always adds made every run look unplanned. Provider-billed rows only, and the count
 // of what was set aside is reported so the exclusion is visible rather than assumed.
 //

package/driver/run-integrity.mjs

@@ -42,7 +42,7 @@ import { DISPATCH_SUFFIX } from "./dispatch-record.mjs";        // — the dispa
  *
  * ONE PREDICATE, so the snapshot and any future arming decision cannot disagree about the set. Named
  * files are the driver-derived joins and receipts judgment reads; the dispatch records are what was
- * actually asked, including 's `.prev-<sha>` supersede chain.
+ * actually asked, including the `.prev-<sha>` supersede chain.
  *
  * ──: EVERY `.jsonl` IS OUT, BY PATTERN, AND A NEW SINK IS OUT THE MOMENT IT IS CREATED ────────
  *

package/driver/runner.mjs

@@ -23,13 +23,13 @@ import "./engine/mcp/http-dispatcher.mjs";   // side effect: raise undici header
 import { readdirSync, renameSync, existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync, rmSync, statSync } from "node:fs";
 import { join, dirname, basename } from "node:path";
 import { driverDir, ensureDriverDir } from "../shared/driver-dir.mjs";   // — one definition of where `_driver/` is
-// The queue's filename vocabulary, in ONE place — 's rule, extended by to the prose-sidecar and
+// The queue's filename vocabulary, in ONE place — the rule, extended by to the prose-sidecar and
 // claim-sidecar names, because a harness check retyped four of them from memory and false-alarmed on the
 // other nine. Behaviour here is unchanged: the same object and the same three suffixes, sourced.
 import { isLiveQueueMarker, PROSE_PARTS, CLAIM_SIDECAR_SUFFIXES, TERMINAL_QUEUE_SUFFIXES } from "./queue-markers.mjs";
 import { matterLedgerPath } from "./usage-ledger.mjs";   // ONE ledger-path calculation, shared with the portal pre-check
-import { orderTimeRefusal } from "./run-requirements.mjs";   // tracker issue 216 — one authority for what a run needs, and when it is asked for
-import { unitEnvPath } from "../shared/env-local.mjs";   // tracker issue 216 — the file the units read, named by its one author
+import { orderTimeRefusal } from "./run-requirements.mjs";   // one authority for what a run needs, and when it is asked for
+import { unitEnvPath } from "../shared/env-local.mjs";   // the file the units read, named by its one author
 import { fileURLToPath } from "node:url";
 import { config, preflightDeploymentUrls } from "./driver.config.mjs";
 import { deriveSlug, todayISO, mintFreshCodename } from "./phase0.mjs";
@@ -136,7 +136,7 @@ function matterSignature(job, { product = null } = {}) {
   const base = `${forwarder}|${mark}|${classes}|${customer}|${ref}`;
   // Product dimension. ONE product adds nothing to the string, and it has to be one or every legacy
   // ledger row would stop colliding with its own re-send: the pre-spine signature had no suffix at all,
-  // and the level that ran then was `prelim`. That level's SUCCESSOR is the Global preliminary search —
+  // and the level that ran then was `clearotron`. That level's SUCCESSOR is the Global preliminary search —
   // the clearance a request with nothing named resolves to — so it is the one that stays silent, and
   // `sigLevel`'s default reads a suffixless row as it. The key name stays `level:` for the same reason:
   // it is a string already written into every ledger on disk.
@@ -342,7 +342,7 @@ async function intakeNotify(agentId, base, job, v) {
   const what = v?.classify === "clarify"
     ? `needs clarification before it can run: ${v.errors.join("; ")}`
     : `was rejected at intake: ${(v?.errors ?? ["unparseable job file"]).join("; ")}`;
-  const text = `⚠️ Prelim request "${mark}" ${what}. Nothing has been searched or delivered. ` +
+  const text = `⚠️ Clearotron request "${mark}" ${what}. Nothing has been searched or delivered. ` +
     `Job parked as ${base}.failed in the ${agentId} queue.`;
   const p = writeOutboxPacket(`intake-${base}.failed`, {
     kind: "intake-rejected", classify: v?.classify ?? "reject", base, agent: agentId,
@@ -381,7 +381,7 @@ function cleanupClaimSidecars(procPath) {
  * Returns true when this call moved the marker, false when it was already gone. Any other error still
  * throws: a permissions failure or a full disk is not a sibling.
  */
-export function retireMarker(procPath, destPath, what = "") {   // exported for 's honesty test
+export function retireMarker(procPath, destPath, what = "") {   // exported for the honesty test
   try { renameSync(procPath, destPath); return true; }
   catch (e) {
     if (e?.code !== "ENOENT") throw e;
@@ -389,7 +389,7 @@ export function retireMarker(procPath, destPath, what = "") {   // exported for
     // <dest> is on disk. On this branch the rename did NOT happen, so <dest> was never created by this
     // call, and the parenthetical named the outcome the caller intended rather than the one an operator
     // would find. It is the single line an operator reads to discover where a job went, and it was
-    // pointing at a file that is not there. The reproduction (, PR) ends with the queue dir
+    // pointing at a file that is not there. The reproduction (PR) ends with the queue dir
     // holding `job-race.processing` and `job-race.processing.pid` and NO `.json` at all, under a log
     // line that said the orphan had been returned to the queue.
     note(`[runner] ${basename(procPath)} was already retired by another runner — this call did NOT create ${basename(destPath)} (it wanted: ${what || "retire the marker"}); the marker is in whatever state that runner left it`);
@@ -433,13 +433,13 @@ export function retireMarker(procPath, destPath, what = "") {   // exported for
  * marker; the argument holds only because no `<base>.json` exists while we hold the lock (both enqueue
  * doors refuse an id whose `.json` or `.processing` is already present, and this call is the one about
  * to create it). The residual — a fresh enqueue of the SAME id landing between the two renames — is the
- * window 's claim lock and `takeoverClaim` already carry, unchanged here. At a call site where a
+ * window the claim lock and `takeoverClaim` already carry, unchanged here. At a call site where a
  * `<base>.json` CAN coexist with the marker, that argument does not transfer.
  *
  * Returns true when this call moved the marker to `destPath`. False means the claim was not ours to
  * retire — and that nothing on disk was touched.
  */
-export function retireClaimAndSweep(procPath, destPath, what = "", { token = claimToken() } = {}) {   // exported for 's race test
+export function retireClaimAndSweep(procPath, destPath, what = "", { token = claimToken() } = {}) {   // exported for the race test
   const lockPath = `${procPath}.claimed-${token}`;
   try { renameSync(procPath, lockPath); }
   catch (e) {
@@ -482,7 +482,7 @@ export function retireClaimAndSweep(procPath, destPath, what = "", { token = cla
  *     RE-ASSEMBLED from. It is the one deletion that outlives every marker state: the winner's job — a
  *     resume, or a hand-back to `.json` — then cannot be assembled at all.
  *   - `<base>.done.result` / `<base>.failed.result` asserts a terminal that is not on disk. That is
- *     's defect exactly (a line naming the outcome the caller WANTED, not the one an operator would
+ *     That defect exactly (a line naming the outcome the caller WANTED, not the one an operator would
  *     find), one call below the fix for it.
  *   - `dropMatter` marks the matter ledger row `failed`, and `findDuplicateMatter` skips failed rows —
  *     so it re-opens the dedup gate for a matter the winner may be mid-resume, and the ~$40 duplicate
@@ -578,7 +578,7 @@ async function failAtIntake(procPath, qdir, base, agentId, job, v, reasons) {
 // outcome string for the .reason file.
 async function duplicateNotify(agentId, base, job, prior = null, sig = null) {
   const mark = job?.markName ?? job?.name ?? job?.marks?.[0]?.name ?? base;
-  // ── tracker issue 136 — A REFUSAL DELIVERED AS SILENCE IS INDISTINGUISHABLE FROM A LOST JOB ────────
+  // ── A REFUSAL DELIVERED AS SILENCE IS INDISTINGUISHABLE FROM A LOST JOB ────────
   //
   // The observable outcome of a dedup park was an empty queue and no run, which is exactly what an
   // enqueue that vanished looks like — and the two want completely different next actions. That got
@@ -598,7 +598,7 @@ async function duplicateNotify(agentId, base, job, prior = null, sig = null) {
   const which = prior?.msgId
     ? ` The run already under way was submitted as ${prior.msgId}${when ? ` at ${when}` : ""} — that is the one that will deliver.`
     : " The earlier run will deliver.";
-  const text = `⚠️ Prelim request "${mark}" matches a matter already in progress or just delivered, so it was `
+  const text = `⚠️ Clearotron request "${mark}" matches a matter already in progress or just delivered, so it was `
     + `NOT run — a second search would spend twice for one answer.${which}`
     + ` If you genuinely need a fresh run of the same matter, re-submit it with dupOverride (\`--dup-override\` on the`
     + ` command line) and it will go through.`;
@@ -631,7 +631,7 @@ async function parkDuplicate(procPath, qdir, base, agentId, job, prior, sig) {
   const conv = String(job.conversationId ?? "").trim();
   const matchedBy = prior.conversationId && prior.conversationId === conv ? "thread (conversationId)" : "matter signature";
   const reason = [
-    `duplicate prelim — not run (a second search for the same matter)`,
+    `duplicate clearotron — not run (a second search for the same matter)`,
     `matched by: ${matchedBy}`,
     `matter: ${sig}`,
     `conversationId: ${conv || "-"}`,
@@ -666,7 +666,7 @@ function preRunFailNotify(agentId, base, job, reason) {
   // terminalReasonFields `reason`, so this cut is a no-op today — which is exactly why it survived: a
   // latent second cap, unmarked, waiting for the next caller to pass a raw reason. It collapses and
   // trims identically, so this is the same string with the cut made visible when there is one.
-  const text = `❌ Prelim request "${mark}" FAILED before the run could start: ${terminalReasonFields(reason).reason} — ` +
+  const text = `❌ Clearotron request "${mark}" FAILED before the run could start: ${terminalReasonFields(reason).reason} — ` +
     `nothing has been searched or delivered. Job parked as ${base}.failed in the ${agentId} queue.`;
   // `intake-${base}.` PREFIX, not a third scheme: scripts/e2e.mjs's outboxPackets matches by runId
   // first and by that prefix second, so a name outside it is a notice the harness reports as
@@ -716,7 +716,7 @@ async function backstopFailureNotice({ res, job, agentId, base, codename, studio
       shortReason, reasonVerbatim: reason.slice(0, 1000), whatsappTo: AGENT_WHATSAPP[agentId] ?? null,
     });
     // same per-send invariant as the pipeline's failure path: a fresh notice supersedes an older .sent
-    // and its per-channel receipts (B4 — stale receipts would make prelim-deliver skip this notice)
+    // and its per-channel receipts (B4 — stale receipts would make clearotron-deliver skip this notice)
     try { rmSync(join(owned.dir, ".sent"), { force: true }); } catch { /* none */ }
     try { rmSync(driverDir(owned.dir, "send-receipts.json"), { force: true }); } catch { /* none */ }
     ensureDriverDir(owned.dir);
@@ -740,7 +740,7 @@ async function backstopFailureNotice({ res, job, agentId, base, codename, studio
 // one-at-a-time so the dedup check+record stays race-free even while prior jobs' pipelines run concurrently
 // (Phase-4). Returns the prepared {procPath, base, job} to execute, or null when the job was terminally
 // parked/failed-at-intake, or the claim was lost.
-// ── tracker issue 216 — THE ORDER-TIME REFUSAL, AND WHY IT IS HERE ──────────────────────────────────
+// ── THE ORDER-TIME REFUSAL, AND WHY IT IS HERE ──────────────────────────────────
 //
 // A hosted install now STARTS with no register configured (owner ruling 2026-09-06: "someone can install
 // and select key later so it should still start"). The protection that used to live in
@@ -849,7 +849,7 @@ async function claimAndPrep(jsonFile, qdir, agentId) {
     await failAtIntake(procPath, qdir, base, agentId, job, v, v.errors);
     return null;
   }
-  // ── tracker issue 216 — IS THIS BOX CONFIGURED TO SEARCH AT ALL? See the header above claimAndPrep.
+  // ── IS THIS BOX CONFIGURED TO SEARCH AT ALL? See the header above claimAndPrep.
   {
     const refusal = orderTimeRefusal(process.env, await runTables(), { envFile: unitEnvPath() });
     if (refusal) {
@@ -860,11 +860,11 @@ async function claimAndPrep(jsonFile, qdir, agentId) {
     }
   }
   // Search-depth spine — resolve WHICH product shape this job selects (job selector → project/customer
-  // default → house prelim), then gate on what this deployment can actually run. A selection that cannot
+  // default → house clearotron), then gate on what this deployment can actually run. A selection that cannot
   // run here CLARIFIES loudly (parked + requester notified) — it must never silently run as a different-
   // priced product, and never silently drop. Fail-open discipline (review 2026-07-17): infra trouble may
   // NO FAIL-OPEN LEFT ON THIS PATH, and its removal is the point. It used to fall back to the literal
-  // level `prelim` when resolution errored and the job "provably" wanted a plain clearance — but `prelim`
+  // level `clearotron` when resolution errored and the job "provably" wanted a plain clearance — but `clearotron`
   // named THREE products depending on where it pointed, so the fallback was a guess wearing a level key:
   // an account whose defaults hold one country would have run a Full country search, case law and all,
   // off a config read that failed. Under the offering the product is a function of the scope, and a scope
@@ -1027,7 +1027,7 @@ async function claimAndPrep(jsonFile, qdir, agentId) {
 // result the whole time and the marker threw it away.
 //
 // WHAT THIS DOES NOT DO: invent a cause. Neither branch classifies anything; each states which park
-// fired and what its clock means. 's damage was a record that could not be contradicted from the
+// fired and what its clock means. That damage was a record that could not be contradicted from the
 // artifacts, so the fix is not a better guess — it is saying less, and saying which.
 export function parkCause(res = {}) {
   const RESOLVED_BY = "a live retry — the stored time is a hint about when to look, not the authority on "
@@ -1182,8 +1182,8 @@ async function runPrepared({ procPath, base, job }, qdir, agentId, resumeMeta =
       //
       // The pipeline already made this distinction where it writes its own sentinel — "only the recovery
       // sentinel carried a discriminator … the 2026-07-28 postmortem misread: a recovery park diagnosed
-      // as a rate-limit park". The queue-side marker never got it. Same shape as 's terminal fields
-      // reaching two writers and not four, and 's stamp reaching the audit path and not the rebuild.
+      // as a rate-limit park". The queue-side marker never got it. Same shape as the terminal fields
+      // reaching two writers and not four, and the stamp reaching the audit path and not the rebuild.
       ...parkCause(res),
     });
     note(`[runner] ${base} → POSTPONED (${parkCause(res).parkKind}; retries at the earlier of ${res.resetsAt ?? "its due time"} and its next probe — no hand-edit needed if it clears early)`);

package/driver/scope-rules.mjs

@@ -113,7 +113,7 @@ export function checkClearanceScopeRules({ job = null, profile = null, resolved
   // request resolves to no territory" would be a claim about a scope nobody saw. But when the request —
   // or the saved search it names — DOES name territories, the profile is irrelevant to the count and the
   // rules still bite. Skipping them there is how a roster-blind deployment (profile_key_unknown → the
-  // fail-open to prelim) would admit a three-country deep dive at the wall itself (review 2026-07-27).
+  // fail-open to clearotron) would admit a three-country deep dive at the wall itself (review 2026-07-27).
   if (!profileReadable && !scope.length) return { errors, warnings };
   // Quoted AS WRITTEN, worldwide tokens dropped (a mode is not a place — territory-tiers.mjs answers
   // which entries those are, so this module and the door cannot disagree about the spelling of

package/driver/search-policy.mjs

@@ -351,7 +351,7 @@ export function reportIdentityFor(levelOrPolicy) {
 
 /** The product's coverage note for the report masthead (charter ruling 1, 2026-07-30: what was bought
  *  must be VISIBLY clear on the page — a reader must never confuse "the same section" in two different
- *  searches). One plain sentence, NAME-LED per the ruling (match 's registry-name pills: the
+ *  searches). One plain sentence, NAME-LED per the ruling (match the registry-name pills: the
  *  product's name leads, never a rung on our ladder), stating what THIS search covers and the material
  *  thing it does not. The name comes from the registry join (reportIdentityFor — today's name for what
  *  ran, exactly the  doctrine); the coverage clauses come from the run's own frozen COMPONENTS
@@ -678,7 +678,7 @@ export function productAvailability(policy, { built = BUILT, registerCanCount =
  */
 export const UNAVAILABLE_NOTE = {
   unbuilt: "Not part of the current release.",
-  // `demo` IS DELETED FROM THIS MAP (, owner ruling 2026-08-31 14:47), and
+  // `demo` IS DELETED FROM THIS MAP (owner ruling 2026-08-31 14:47), and
   // deleting it is what makes the reversal structural rather than a filter somebody can undo by
   // accident. Every client-facing surface renders a product's refusal as `UNAVAILABLE_NOTE[cause]`;
   // while a sentence sat here for a demo, the greyed control was one `return "demo"` away from coming
@@ -692,7 +692,7 @@ export const UNAVAILABLE_NOTE = {
   // a baked-in provider name, no CLEAROTRON_* string in scope here, and it says the one thing a reader can
   // act on — this is a coverage limit, so a newer version will not fix it.
   //
-  // `register-not-worldwide` IS DELETED FROM THIS MAP (, owner ruling
+  // `register-not-worldwide` IS DELETED FROM THIS MAP (owner ruling
   // 2026-08-31), and deleting it is what makes the ruling structural rather than a filter somebody can
   // reverse by accident. Every client-facing surface renders a product's refusal as
   // `UNAVAILABLE_NOTE[cause]`; while a sentence sat here for that cause, the ruling held only as long as
@@ -877,7 +877,7 @@ export const RECIPE_KEYS = [
  * The saved-search SCOPE block — where the machinery points, as against `base`/`components`, which
  * choose which machinery runs.
  *
- * This is what makes a saved search a saved SEARCH rather than a saved depth. "Zephyr Beverages knockouts — US
+ * This is what makes a saved search a saved SEARCH rather than a saved depth. "Drinks knockouts — US
  * focus" is a label over exactly this: base `knockout`, scope `{jurisdictions:["US"]}`. Without it a
  * saved search could only ever restate a level that is already one click away, which is why the recipe
  * store existed for weeks with nothing worth putting in it.
@@ -1066,7 +1066,7 @@ let recipeCache = null;
  * THE STORE IS NAMED, NEVER GUESSED. `CLEAROTRON_RECIPES_DIR` unset means this deployment has no saved
  * searches — not that it should use the ones bundled with the source.
  *
- * `driver/recipes/` ships synthetic demos for two FICTIONAL customers (aurora, zephyr) so the dev
+ * `driver/recipes/` ships synthetic demos for two test accounts so the dev
  * cockpit and the tests have something to render. It used to be the fallback when the env var was
  * unset, which is a foot-gun that only fires in production: the real deployment does not set the
  * variable, so switching saved searches on there would have surfaced invented customers inside the

package/driver/skeptic-search.mjs

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // skeptic-search.mjs — the skeptic's SANCTIONED READ SURFACE: literal substring search over the run's
-// own artifact tree. 's ratification hold, unlock path 1.
+// own artifact tree. That ratification hold, unlock path 1.
 //
 // ── WHAT THIS REPLACES, measured and nothing more ───────────────────────────────────────────────────
 //

package/driver/skills/blind-frame/SKILL.md

@@ -5,7 +5,7 @@ description: The frame-STARVED independent re-derivation for the v3 preliminary
 
 ## Purpose
 
-Every other stage in a prelim run reasons *inside* a frame that was set early (at `matter-frame` / `prelim-variants`): the variants to chase, the field that counts as on-field, the sources worth searching. Verification then runs *on* that frame — nothing tests the frame itself. When the frame is mis-scoped, the whole run inherits the miss and the skeptic, reasoning from the same frame, certifies it.
+Every other stage in a clearotron run reasons *inside* a frame that was set early (at `matter-frame` / `prelim-variants`): the variants to chase, the field that counts as on-field, the sources worth searching. Verification then runs *on* that frame — nothing tests the frame itself. When the frame is mis-scoped, the whole run inherits the miss and the skeptic, reasoning from the same frame, certifies it.
 
 You are the antidote. You are **deliberately starved of the frame**: you receive only the raw instruction, exactly as the requester wrote it, and you re-derive the threat model **cold**. Because you never see the run's conclusions, you cannot anchor to them. Your output is later **diffed** against what the run actually scoped — the gaps in that diff are the omissions the frame missed.
 
@@ -27,7 +27,7 @@ Decompose the mark into its element(s) and name the **dominant element** (the sp
 
 - **Drop** characters: shorten the element (VELTRIN → VELTRI). A dropped letter is the commonest missed-cluster cause — the shorter root is its own crowded field.
 - **Add** characters / **composite**: the element living inside a larger mark (DELPHI Diagnostics, Osler Delphi, Delphic). A composite that shares your dominant element is on the board.
-- **Phonetic / homophone**: sound-alikes (ZEPHYR / ZEFFYR / ZEPHUR).
+- **Phonetic / homophone**: sound-alikes (PHAROLIS / FAROLIS / PHAROLLIS). Carry the `ph`/`f` pair in particular: it sounds identical, files under a different letter, and survives no letter-distance measure — which is the whole reason this class is separate from the two above.
 - **Neighbour**: a one-keystroke real-word or famous-mark neighbour (CHROME on a NOVAPULSE clearance). A famous neighbour is carried for diligence even when off-field.
 
 For each, give the value, the direction, and one line of rationale.

package/driver/skills/case-law-citation/SKILL.md

@@ -17,7 +17,7 @@ cannot reach any other stage's context, because no stage shares one — and it i
 arranges or can lose. Nothing here spawns a session; sequencing, fan-in and retries are the driver's.
 
 The identical skill is also valid **inline** in ad-hoc chat when a conflict / confusability / enforcer
-question arises outside a prelim run.
+question arises outside a clearotron run.
 
 **Reads** — from the dispatch message (plain markdown, not JSON), for each finding to ground:
 - the proposed mark and the conflicting mark / owner / entity,
@@ -46,7 +46,7 @@ Boards-of-Appeal decisions — no free API today). EUIPO *register* lookups are
 
 Called by `prelim-search` after synthesis flags the risk-relevant findings (Step 4.5). Also triggers in
 chat when the user raises a trademark conflict, likelihood-of-confusion, or enforcement-history question.
-Gated and optional: if this skill is absent, prelim skips Step 4.5 and delivers normally.
+Gated and optional: if this skill is absent, clearotron skips Step 4.5 and delivers normally.
 
 ## Model
 

package/driver/skills/knockout-assess/SKILL.md

@@ -119,6 +119,90 @@ Measured tone only — no "extremely difficult", "most dangerous", "massive", "e
 colour communicates urgency. No quantitative claims from research ("major streaming hit", never
 "294M streams"; "significant market presence", never revenue figures).
 
+## Plain language — the two-register rule
+
+The report goes to a lawyer who layers advice on top, and that lawyer's client reads the same page. The
+band, the summary, the basis line and the one-liners are the whole product for the second reader. They
+were the hardest lines on the page.
+
+**Everything a reader sees before opening a fold is written for the client's business owner.** Ordinary
+nouns, one idea per sentence, no sentence over 25 words, the conclusion first. On this product that is:
+`chunkSummary`, `basis`, `factors`, `counterFactors`, `mitigation`, every finding's `net`, every
+`registerReads[].read`, the `purpleNotes`, and `standardCaveats`.
+
+**Inside a fold the lawyer's vocabulary is allowed** where a plain word would lose precision — a
+finding's `basis`, the provenance, the long `assessment`. Even there, a term is explained the first time
+it appears on the page.
+
+The rule is the test, not the list. Ask of every noun: *does the reader already own this word?* These
+are worked examples of the one failure, not its boundary:
+
+| Instead of | Write |
+|---|---|
+| proprietor | owner |
+| subsisting | live |
+| senior | earlier, or came first |
+| specification | goods list |
+| DELPH-formative | names built on DELPH- |
+| prevail | win |
+| citable prior rights | earlier marks the office can raise against you |
+| vulnerable to a non-use attack | could be cancelled for not being used |
+| on the record as it stands | on what we found |
+| the marks-and-goods comparison | same name, same goods |
+| the confusion comparison meets on every limb | same name, same goods, same shops |
+| belt-and-braces classes | extra classes |
+| dispatch, instructed | the request, what was asked |
+| lane | class, or channel — whichever you mean |
+| chunk | never; say the batch, or these names |
+
+The target is the level of these, each the standard for its line:
+
+> **Basis.** "ORBIT is already the name of two satellite-tracking apps on the same app stores, and of an
+> established satellite-communications company. Any of them would likely win a dispute over this name
+> for this software. The word is a weak mark for these goods, which is why this is High and not Very
+> High."
+
+> **A finding's `net`.** "Same name, same goods, and their filing came first in every territory we
+> searched. We see no argument against it."
+
+> **The batch opener.** "One name screened: ORBIT, rated High."
+
+**Shortening by dropping the reason is not the fix.** The "why" stays, in plain words. A visible
+line that is short because it no longer says why is worse than the long one it replaced, and it
+passes every length rule on this page while telling the reader less.
+
+**Say it once.** A caveat, a limit or a finding belongs in one place. Four `standardCaveats` that each
+restate "this is not a clearance" are one caveat and three repetitions — and the report's scope block
+already carries that sentence in the renderer's own words, so a caveat repeating it is dropped before
+the reader sees it. Write the one thing the scope block does not say, or write none.
+
+**A note is verb-first, one line, and about one of two things.** Write each `purpleNotes` entry as an
+instruction to the reviewing lawyer, opening on the verb. Every note is about the REQUEST — what was
+asked, and whether it holds together — or about the NAME. The report prints the first kind at the top,
+above the conflicts, and the second under that name's cards, so a note that mixes the two lands in one
+place and reads oddly in it. Write two notes.
+
+A note about the request NAMES the request in the note — "the request", or "what we were asked". That is
+not a formality: the report sorts the two kinds by what the note talks about, so a request note that
+never mentions the request is filed under the name and prints in the wrong place.
+
+> "Check the request. The client is described as a beverages and supplements business, but we were asked
+> to screen satellite-tracking software in Class 9. We screened the software. If beverages is the real
+> business, this screen looked at the wrong market."
+
+> "Ask the client whether it already uses ORBIT. The request does not say, and the client's own earlier
+> use would change the picture."
+
+A note about the name opens on what the lawyer should do about the name:
+
+> "Pull EG Tech's full goods list at clearance. It is the record most likely to change the picture in
+> either direction."
+
+> "Search Classes 42 and 38 in their own right. Both carry live ORBIT filings, not spillover from
+> Class 9."
+
+A note that restates a finding already on the page is not a note. Cut it.
+
 ## The per-mark opening read (`assessment`)
 
 Each mark's report is delivered on its own, and `assessment` is the first thing its reader meets —
@@ -162,9 +246,14 @@ your job. These two fields are how what you concluded reaches the reader instead
 every id against that store and refuses one it does not hold — so the report can state a filing's
 source as a fact rather than as a word you typed about your own sourcing.
 
-- **`registerReads`** — on the MARK. Rows of `{recordId, read}` for a filing you weighed that did **not**
-  become a `findings[]` record. `read` is what you concluded about *that* filing: whether it bears on the
-  rating, and why. It prints on that filing's card.
+- **`registerReads`** — on the MARK. Rows of `{recordId, read, band?}` for a filing you weighed that did
+  **not** become a `findings[]` record. `read` is what you concluded about *that* filing: whether it bears
+  on the rating, and why. It prints on that filing's card. `band` is **optional** and is how you rate that
+  filing on its own — in the framework's band words, the same vocabulary as the mark's rating. Send it
+  whenever you formed a view on the filing itself: a registered right is often the one hard legal fact on
+  the page, and with no band its card is the only one carrying no rating while softer uses around it carry
+  one, which reads as though the registration mattered least. Omit it and the read still prints, claiming
+  no rating.
 - **`weighedFilings`** — on a FINDING. The `recordId`s whose evidence your reasoning for that conflict
   actually used. The report derives the finding's source labelling from this, so list one only if you
   reasoned from it.
@@ -205,7 +294,8 @@ line, which describes the card and claims nothing about the rating. So:
                "classesDriving": [8], "bullets": ["..."], "purpleNotes": ["..."],
                "registerEstimate": "...", "parodyNote": null, "crowdedField": false,
                "registerReads": [ { "recordId": "<verbatim from the filings you were given>",
-                                    "read": "<what you concluded about THAT filing>" } ],
+                                    "read": "<what you concluded about THAT filing>",
+                                    "band": "<OPTIONAL — your rating of THAT filing, in the ladder's words>" } ],
                "basis": "<ONE sentence: why this band, for this name, in these classes>",
                "factors": ["<2-4 load-bearing observations, one line each>"],
                "counterFactors": ["<1-3: what holds it at this band rather than the next>"],

package/driver/skills/matter-frame/SKILL.md

@@ -75,11 +75,11 @@ You do not write a file. Hand the frame back by calling `record_matter_frame`; t
 
 ### Scope jurisdictions — search wide, cite narrow (instructed scope honored; worldwide / brand-signalled scope leans wide + discloses)
 
-Two scopes live here, and the doctrine is **narrow at citation, never silently at search**: the **search scope** (where the register sweep looks) must be wide enough to catch the conflict; the **citation scope** (what the report flags and ranks) is where rights legally matter. The failure to avoid is the PETCARY miss — *silently* pinning a globally-signalling brand to one country, so the real EU/UK/US conflict is never even searched. Derive both from THIS matter; a customer profile selects the **risk framework** only — it never sets territory.
+Two scopes live here, and the doctrine is **narrow at citation, never silently at search**: the **search scope** (where the register sweep looks) must be wide enough to catch the conflict; the **citation scope** (what the report flags and ranks) is where rights legally matter. The failure to avoid is the pinned-scope miss — *silently* pinning a globally-signalling brand to one country, so the real EU/UK/US conflict is never even searched. Derive both from THIS matter; a customer profile selects the **risk framework** only — it never sets territory.
 
 - **Instructed scope is honored (narrow or wide).** When the client names territories — a list, or "X only" — that is the scope for BOTH search and citation; do not override a client who genuinely wants a narrow scope (a sweep of a country with no instructed interest and no reach is wasted). The profile's `defaultJurisdictions`, when present, is the *customer's own standing instruction* — treat it like an instructed set.
-- **Worldwide, or the brand's own signals point broader → the SEARCH widens (it never silently narrows).** When the instruction is worldwide, OR the brand signals broader use — a global gTLD (a `.io`/`.com` launch), an investor / expansion announcement, stated target markets, a genuinely global customer base — the **search set includes the major markets (US / EU / UK / CN / JP) plus the signalled markets**. Decide which to actually cite and rank at **selection** (where rights matter), and **disclose** any material market you could not fully cover (a `coverage-limited` row — never a silent clean). The one move forbidden: quietly pinning an unpinned, globally-signalling brand to a single country (the PETCARY miss). **The cost guard stays:** an abstract *"the sector tends to be global"* is **not, by itself, the widener** — the widener is a CONCRETE signal (a worldwide instruction, or the brand's own global footprint), so a deliberately local matter stays local.
-- **Genuinely unpinned, no global signal → reason the likely scope, LABEL it inferred, and DISCLOSE it.** Read the product / customer base / channels and scope to where the brand plausibly operates; never silently default to the requester's home country (that is the PETCARY mechanism). Where reach is plausibly broad, lean wide; where clearly local, scope local — either way set `Scope basis: inferred` and record a one-line `Scope assumption:` so a narrowing is visible and the coverage gate can clamp + disclose it.
+- **Worldwide, or the brand's own signals point broader → the SEARCH widens (it never silently narrows).** When the instruction is worldwide, OR the brand signals broader use — a global gTLD (a `.io`/`.com` launch), an investor / expansion announcement, stated target markets, a genuinely global customer base — the **search set includes the major markets (US / EU / UK / CN / JP) plus the signalled markets**. Decide which to actually cite and rank at **selection** (where rights matter), and **disclose** any material market you could not fully cover (a `coverage-limited` row — never a silent clean). The one move forbidden: quietly pinning an unpinned, globally-signalling brand to a single country (the pinned-scope miss). **The cost guard stays:** an abstract *"the sector tends to be global"* is **not, by itself, the widener** — the widener is a CONCRETE signal (a worldwide instruction, or the brand's own global footprint), so a deliberately local matter stays local.
+- **Genuinely unpinned, no global signal → reason the likely scope, LABEL it inferred, and DISCLOSE it.** Read the product / customer base / channels and scope to where the brand plausibly operates; never silently default to the requester's home country (that is the pinned-scope mechanism). Where reach is plausibly broad, lean wide; where clearly local, scope local — either way set `Scope basis: inferred` and record a one-line `Scope assumption:` so a narrowing is visible and the coverage gate can clamp + disclose it.
 - **In scope by reach.** A territory also counts when a right is **legally effective in an instructed territory by any route** — filed there; an international (Madrid) registration **designating** it; a regional/supranational right covering it (an EUTM covers every EU member; an instructed EU member is covered by an EUTM); a treaty / priority effect. Tag such a territory `in-scope-by-reach` and name the route. Reason the route from the right — never assume it.
 - **Excluded.** Territories you considered and set aside — neither instructed, nor brand-signalled, nor a major on a worldwide matter — name each, the reason, and a **reopen trigger** (a right or signal pointing there surfaces). A hit effective ONLY outside the scope set is out of *citation* scope (drop it from findings); but a market the brand actually signals belongs in the SEARCH set, not here.
 - **Primary vs only.** If the instruction names territories of "primary" / "first" interest WITHOUT "only", treat the named ones as the citation core but **let the search lean wide** to the majors / brand-signalled markets (the "primary" wording signals more may matter), and **record the assumption** — a one-line `Scope assumption: <text>`. (A single clarifying question is acceptable instead; the recorded default never blocks the run.)
@@ -88,7 +88,7 @@ Two scopes live here, and the doctrine is **narrow at citation, never silently a
 
 *Worked illustrations:*
 *— Instructed "Switzerland and the EU, only" → search CH + the EUTM/EU layer (+ any Madrid designation reaching them); majors beyond (CN/JP/US/UK) are out of scope — an honored narrow instruction (`Scope basis: instructed`).*
-*— A brand on a `.io` domain with an investor deck naming a US/EU launch and no explicit territory list → lean wide: search US/EU/UK/CN/JP + the named launch markets; cite where rights matter; disclose any gap (`Scope basis: inferred`). This is the PETCARY fix — do not pin it to CH.*
+*— A brand on a `.io` domain with an investor deck naming a US/EU launch and no explicit territory list → lean wide: search US/EU/UK/CN/JP + the named launch markets; cite where rights matter; disclose any gap (`Scope basis: inferred`). This is the pinned-scope fix — do not pin it to CH.*
 *— A local artisan, national-only product, no global signal → scope the home market, `Scope basis: inferred`, `Scope assumption:` recorded — narrow but disclosed, never silent.*
 
 ### Off-field sectors
@@ -111,7 +111,7 @@ Two scopes live here, and the doctrine is **narrow at citation, never silently a
 ### Sector-convergence flags
 - Sectors off-field today where commercial trajectories may bring them adjacent
 - Brief reason
-- Example: "Aurora Interactive's broader AI / cloud AI narrative could theoretically bring vector-DBs adjacent to game-dev tooling, but Aurora dev kit is specifically game-tooling not LLM-tooling; convergence path exists but weak"
+- Example: "Foxglade Interactive's broader AI / cloud AI narrative could theoretically bring vector-DBs adjacent to game-dev tooling, but Foxglade dev kit is specifically game-tooling not LLM-tooling; convergence path exists but weak"
 
 ### Machine lines the task message dictates
 
@@ -132,7 +132,7 @@ driver's fixed query shapes:
 
 ## Reasoning posture
 
-- When in doubt about an **off-field / adjacency** decision, INCLUDE rather than exclude — matter-frame should not silently filter a *field*; downstream review (`placement-inquiry`) can deprioritise later with reasoning. **Jurisdiction scope follows its own rule (see *Scope jurisdictions*): search wide, cite narrow.** An instructed-narrow scope is honored; a worldwide or brand-signalled scope widens the SEARCH to the majors + signalled markets; an inferred scope is labelled and disclosed. Do not silently pin a globally-signalling brand to one country (the PETCARY miss), and do not widen a deliberately-local matter on abstract "the sector is global" reasoning (a wasted sweep).
+- When in doubt about an **off-field / adjacency** decision, INCLUDE rather than exclude — matter-frame should not silently filter a *field*; downstream review (`placement-inquiry`) can deprioritise later with reasoning. **Jurisdiction scope follows its own rule (see *Scope jurisdictions*): search wide, cite narrow.** An instructed-narrow scope is honored; a worldwide or brand-signalled scope widens the SEARCH to the majors + signalled markets; an inferred scope is labelled and disclosed. Do not silently pin a globally-signalling brand to one country (the pinned-scope miss), and do not widen a deliberately-local matter on abstract "the sector is global" reasoning (a wasted sweep).
 - Be concrete about WHY for each item. A senior lawyer reading matter-context.md should be able to disagree with specific items and see exactly where your reasoning broke — not just see a conclusion.
 - If you find yourself rating something as in-lane that a senior lawyer would obviously drop, surface the tension rather than smoothing it.
 

package/driver/skills/matter-frame/watchlist-reference.md

@@ -47,6 +47,6 @@ watchlists come from in any case, and is why this file was never authority.
 
 ## Cross-sector
 
-- **Aurora Interactive** — `major_brand_owners`. Broad AURORA / NEBULA / VANGUARD families;
-  on an Aurora Interactive-adjacent matter watch the relevant family token and name
+- **Foxglade Interactive** — `major_brand_owners`. Broad FOXGLADE / NEBULA / VANGUARD families;
+  on a Foxglade Interactive-adjacent matter watch the relevant family token and name
   ecosystem partners with their partnership context rather than as bare conflicts.

package/driver/skills/prelim-common-law/SKILL.md

@@ -173,7 +173,7 @@ For game-title rows, the `developer_of_record` and `publisher_of_record` columns
 | Finding | Source / Platform | URL | Notes |
 |---|---|---|---|
 | Sony "Pulse Elevate" portfolio | Sony products | https://... | Sony uses "Elevate" in audio products; flagged for prelim-register cross-check |
-| Aurora "Borealis" console "Raise Your Play" tagline (prior usage) | Aurora Interactive marketing | https://... | Client's own prior use — note as supportive |
+| Foxglade "Borealis" console "Raise Your Play" tagline (prior usage) | Foxglade Interactive marketing | https://... | Client's own prior use — note as supportive |
 
 ### PR / reputational risk
 

package/driver/skills/prelim-search/SKILL.md

@@ -26,7 +26,7 @@ description: Orchestrator for preliminary trademark search requests with registe
 
 ## Spawned session
 
-This file is the **driver's compute orchestration spec** — it lives in `driver/skills/` (co-located with the driver) and is read by the pipeline stages, NOT by the integrator agent. The integrator's prelim role is only **intake** (recognise the request, resolve the client, submit the job — `../../docs/INTAKE.md`) and **delivery** (courier the outbox packets — `../../docs/DELIVERY.md`); everything between is the driver's.
+This file is the **driver's compute orchestration spec** — it lives in `driver/skills/` (co-located with the driver) and is read by the pipeline stages, NOT by the integrator agent. The integrator's clearotron role is only **intake** (recognise the request, resolve the client, submit the job — `../../docs/INTAKE.md`) and **delivery** (courier the outbox packets — `../../docs/DELIVERY.md`); everything between is the driver's.
 
 This workflow is run by the **deterministic driver** (`driver/`): an intake path (the `enqueue` CLI or the ops-MCP `start_run` tool) enqueues a job and the driver invokes each stage as a standalone compute turn (the `anthropic-agent` engine — a headless `claude -p` process off the gateway; sequencing, fan-in, gating, retries all in code). The judgment content + companion files below are what the stages read; the driver passes each stage its run-dir paths + the job context (email message id, forwarder, instructions, mark names).
 
@@ -58,7 +58,7 @@ reads only their compact findings files. This is the workflow's primary cost con
 
 ## Trigger
 
-The requesting or reviewing lawyer forwards an email containing a **Trademark Search Request Form** to the intake mailbox. The forwarded email is typically structured as a request form ("Worldwide preliminary trademark search — TMP<n>", "Please run this through a preliminary search", or similar). When the request is recognisable as a prelim search ask, this skill invokes.
+The requesting or reviewing lawyer forwards an email containing a **Trademark Search Request Form** to the intake mailbox. The forwarded email is typically structured as a request form ("Worldwide preliminary trademark search — TMP<n>", "Please run this through a preliminary search", or similar). When the request is recognisable as a clearotron search ask, this skill invokes.
 
 ## Register sources — the vendor is the source of truth; EUIPO is a free EU cross-check
 
@@ -259,7 +259,7 @@ The driver runs the delivery stage on **every** completed run — the search is
 
 **Methodology lives in the Excel Methodology tab, NOT in the email body.** Do not include paragraph-length descriptions of search approach, sub-skills invoked, variants generated, etc. in the client-facing email. That bloat is what the render-layer split fixes.
 
-**The email is a COVER NOTE; the HTML report is the single master document (wp50).** The house default for every customer: the email carries only the headline risk tier, the report link, and any surviving scope/verdict/handling flags plus reviewer's open questions — no findings body, no client-voice prose, no hand-holding preamble. Client-voice findings live in the **HTML report** (the one surface the client reads). The last exception — Aurora's review-table overlay (`delivery.email:'table'`) — is DELETED as of 2026-07-28, along with the knob that asked for it: a second full findings surface in the mail was the seam that let per-conflict tiers diverge from the report, and on the knockout lane it shipped internal purple notes over the wire. A lawyer who needs a bespoke, forwardable client mail asks the assistant to draft one from the run's `report-data.json` — formatting is judgement, and it belongs where judgement lives, not in a profile enum. The operative delivery spec is [delivery-contract.md](delivery-contract.md) + the driver's `report-synthesis` stage. (The `client-summary` stage, which re-voiced the findings into a separate client-facing document, is RETIRED as of 2026-08-01 — the one report is the one surface.)
+**The email is a COVER NOTE; the HTML report is the single master document (wp50).** The house default for every customer: the email carries only the headline risk tier, the report link, and any surviving scope/verdict/handling flags plus reviewer's open questions — no findings body, no client-voice prose, no hand-holding preamble. Client-voice findings live in the **HTML report** (the one surface the client reads). The last exception — a customer's review-table overlay (`delivery.email:'table'`) — is DELETED as of 2026-07-28, along with the knob that asked for it: a second full findings surface in the mail was the seam that let per-conflict tiers diverge from the report, and on the knockout lane it shipped internal purple notes over the wire. A lawyer who needs a bespoke, forwardable client mail asks the assistant to draft one from the run's `report-data.json` — formatting is judgement, and it belongs where judgement lives, not in a profile enum. The operative delivery spec is [delivery-contract.md](delivery-contract.md) + the driver's `report-synthesis` stage. (The `client-summary` stage, which re-voiced the findings into a separate client-facing document, is RETIRED as of 2026-08-01 — the one report is the one surface.)
 
 Structure (content shared across templates):