clearotron 0.2.1 → 0.2.3

package/driver/unit-inventory.mjs

@@ -23,6 +23,11 @@
 //   | recipe-service              |  —   |  —   |  yes    | yes                     |
 //   | portal-service              |  —   |  —   |  yes    | NO                      |
 //
+// THAT TABLE IS THE 2026-08-11 READING AND IS NOT REFRESHED. Two of its rows name units that no longer
+// exist: `prelim-driver` and `prelim-outbox` were retired with the path-watcher drain posture and their
+// files left the tree once production was rebuilt. They stay in the table because it records what was
+// measured on that date, and a measurement edited to match today is no longer a measurement.
+//
 // TWO CORRECTIONS TO THE ISSUE ARE BAKED INTO THIS TABLE, and one of them inverts a fix. lists
 // `profile-service` and `prelim-outbox` under "tracked and never run". That reading comes from the test
 // box, where neither is installed. PRODUCTION RUNS BOTH — so deleting their tracked files as dead
@@ -52,7 +57,7 @@
 // each was already in the tree, in `mcp-server/remote/`. The repo's own governance doc names BOTH
 // directories (`docs/architecture/05-config-governance.md`, tier 2); the guard named one.
 //
-// That is the same defect one layer up from the one this file was built to fix. 's inline array made
+// That is the same defect one layer up from the one this file was built to fix. That inline array made
 // a unit's membership of the guarantee an omission; the hardcoded directory made a FILE's membership an
 // omission, and the result was three statements of fact that were false with nothing able to contradict
 // them. The tracked-file lookup is now a repo-wide walk (driver/unit-files.mjs), and `unitInventoryVerdict`
@@ -70,7 +75,7 @@
 /** Where a unit is expected to be installed. "none" is a claim, not an absence — see ORPHANED below. */
 export const BOXES = Object.freeze(["prod", "test", "dev"]);
 
-// ── RESOLVED UNITS (, owner ruling 2026-08-25 — option B) ──────────────────────
+// ── RESOLVED UNITS (owner ruling 2026-08-25 — option B) ──────────────────────
 //
 // `resolved: [...]` names tracked files the INSTALLER rewrites before installing. Three units carry
 // `@NAME@` placeholders because configuration cannot reach them: a `.path` unit reads no environment at
@@ -98,6 +103,13 @@ export const BOXES = Object.freeze(["prod", "test", "dev"]);
 // 2026-08-26), so the rebuild is the event that releases the files, and until then entry and tree
 // disagree ON PURPOSE.
 //
+// THE REBUILD HAPPENED, and the first two entries this field ever carried have gone with their files.
+// Measured on the production install 2026-09-07 (tracker issue 265): seven units, all under the current
+// names, none of the retired ones, with a clearance delivered end to end. `prelim-driver.*` and
+// `prelim-outbox.*` left the tree in the same change that removed their entries. Read the paragraph
+// above as the rule and this one as the event that discharged it — without this line a reader concludes
+// the files are still owed and that their absence is the drift.
+//
 // Two consumers, so this is not prose: `unitInventoryVerdict` reports a retired unit's absence as
 // EXPECTED rather than as drift, and a claimed-but-missing tracked file is a fault whatever the
 // retirement says. That pair is what asks for — absent-and-expected-to-be told
@@ -110,40 +122,23 @@ export const UNIT_INVENTORY = Object.freeze([
     // rather than the day it first runs, because a unit file no entry claims is exactly what this file
     // exists to make impossible — and a mechanism that installs itself is the easiest kind to ship
     // undeclared.
-    unit: "clearotron-deploy", runsOn: [],
+    unit: "clearotron-deploy", runsOn: ["test"],
+      measured: "2026-09-08, the test deployment: the timer and its service are installed for that deployment's own user, the timer is enabled and ACTIVE, and it last fired within the hour — `systemctl --user list-timers`. The service's own state says nothing about this: it is `inactive` between runs and `inactive` when the timer has been stopped. The timer's ActiveState is what says anything will start it again.",
     tracked: ["clearotron-deploy.service", "clearotron-deploy.timer"],
-    note: "the install's own updater. Ships tracked, runs nowhere yet.",
-    orphanReason: "SHIPPED AND PLACED ON NO BOX YET, which is a THIRD kind of orphan and not either of "
-      + "the other two: courtlistener-mcp runs on production under another name, feedback-mint was "
-      + "deliberately switched off, and this one has simply never been installed. `runsOn` gains "
-      + "\"test\" the day a test deploy places it and \"prod\" when the owner asks for it. Until then it "
-      + "stays out of CHECKED_UNITS, because asking systemd about a unit nobody installed produces a "
-      + "\"not compared\" row that reads like a fault and is not one. It goes on with "
-      + "`systemctl --user enable --now clearotron-deploy.timer` once bin/onboard.mjs has written both files.",
-  },
-  {
-    unit: "prelim-driver", runsOn: ["prod", "test"],
-    tracked: ["prelim-driver.service", "prelim-driver.path", "prelim-driver.timer"],
-    resolved: ["prelim-driver.path"],   // option B — see RESOLVED below
-    retired: {
-      ruled: "2026-08-26, restated 2026-08-31",
-      filesStayUntil: "prod",
-      why: "the path-watcher/timer drain posture is retired (tracker issue 1863): the built-in worker "
-        + "is the product's drain, and a hosted deployment gets ONE plain service unit invoking the "
-        + "entrypoint directly rather than a oneshot woken by a timer and a queue glob. Absence on any "
-        + "box is now the EXPECTED direction rather than drift. The replacement is deliberately not "
-        + "named here — a pointer outlives the file it points at, which is why `supersedes:` was "
-        + "removed from this file once already; the pinned background list is where the current drain "
-        + "is stated, and it is code rather than prose.",
-    },
-    note: "the driver itself — the one unit the drift check has always been able to compare. "
-      + "SETTLED (tracker issue 1888, measured on the owner's fresh production install 2026-08-31): "
-      + "the documented install creates NO units at all — not even the unit directory — and a knockout "
-      + "delivered end to end without them, so units are the hosted-deployment OPT-IN step, never the "
-      + "install's output. Absent on a box is the install's normal state; present means someone ran the "
-      + "hosted step there. `runsOn` lists exactly the boxes MEASURED to carry it, which is why absence "
-      + "anywhere else is not drift — the earlier expectation that the .path unit ships with the install "
-      + "was the wrong half of the disagreement.",
+    note: "the install's own updater. Placed on the test deployment, where it pulls hourly; production takes it when the owner asks.",
+    // IT WAS AN ORPHAN, AND THE CONDITION IT NAMED HAS BEEN MET. This entry carried an `orphanReason`
+    // saying it had been shipped and installed nowhere, and that `runsOn` would gain "test" the day a
+    // deploy placed it. It has: the timer is installed, enabled and firing, and `runsOn` says so. The prose
+    // stayed behind the field, which is the ordinary way a declaration and its explanation come apart —
+    // and it matters more here than usual, because this entry is now what puts a real timer into the
+    // timer list. An entry describing itself as installed nowhere, whose timer the check asks systemd
+    // about by name, is a contradiction a reader has to resolve before trusting either half.
+    //
+    // AND THE POSTURE IS NOW STATED, because it is a change in what a red means rather than in code: a
+    // STOPPED deploy timer FAILS. The service reads `inactive` between runs and `inactive` when nothing
+    // will ever run it again, so the timer's own state is the only thing separating a deployment that
+    // tracks the main branch from one quietly frozen on whatever it last built. If the timer is ever
+    // held deliberately, a check that says so for as long as the hold lasts is the behaviour to want.
   },
   {
     // ── `tracked` WAS A CLAIM ABOUT A FILE THAT HAS NEVER EXISTED (tracker issue 175) ──────────────
@@ -153,10 +148,23 @@ export const UNIT_INVENTORY = Object.freeze([
     // `live-surface-check` FAILED on a healthy box — the worst kind of red, because it teaches a reader
     // to scroll past the check that would catch a unit genuinely gone missing.
     //
-    // THE ROW STAYS, AND DELETING IT WOULD HAVE BEEN THE WRONG FIX. The unit is LIVE ON PRODUCTION, as
-    // the note below has said all along. Removing the entry would make this inventory stop knowing about
-    // something that is running — the same failure it exists to prevent, pointed the other way. What was
-    // false is the `tracked` claim, not the unit.
+    // THE ROW STAYS, AND DELETING IT WOULD HAVE BEEN THE WRONG FIX. What was false then was the
+    // `tracked` claim, not the row. Removing the entry would make this inventory stop knowing about a
+    // unit it ships nothing for — the same failure it exists to prevent, pointed the other way.
+    //
+    // ── AND THE OTHER HALF OF THAT PARAGRAPH HAS NOW BEEN MEASURED FALSE TOO ───────────────────────
+    //
+    // It read "The unit is LIVE ON PRODUCTION, as the note below has said all along", and it had been
+    // said all along without ever being enumerated. Production was read on 2026-09-08 — every account
+    // on the machine, unit file names and enable state — and no unit of this name exists under any of
+    // them. An earlier reading the same day reached the same answer from the other direction while
+    // closing a different question.
+    //
+    // So `runsOn` is empty and the note says what was measured. This is a change to what this
+    // repository CLAIMS about production, made because a reading contradicted the claim, and not a
+    // statement that production should not run it — that is a deployment question and it is the
+    // owner's. If the answer is yes, `runsOn` gains "prod" in the change that deploys it, against a
+    // fresh enumeration, which is this file's own rule rather than an exception to it.
     //
     // Declared the way its siblings are: `tracked: null` with the reason, which this file's own header
     // calls the sanctioned way to say the repo does not carry one.
@@ -167,16 +175,31 @@ export const UNIT_INVENTORY = Object.freeze([
     // is a change which ADDS a file, measured against the deployed copy, and it is not this one. Two
     // prose references in driver/systemd/render-units.mjs also describe this file as though it were in
     // the tree; they are stale today either way.
-    unit: "profile-service", runsOn: ["prod"], tracked: null,
+    unit: "profile-service", runsOn: [],
+      measured: "2026-09-08: production read by account — the deployment account carries six clearotron-* "
+      + "unit files and the doctrine-sync timer, the legacy account carries five units belonging to the "
+      + "other product plus unloadable residue, and no unit of THIS name is under either. Names and enable "
+      + "state only; no unit contents were read.",
+    tracked: null,
     untrackedReason: "the repository has never carried this file — `git log --all` on the path is empty. "
-      + "It deploys from the production box's own copy, in the same CF Access template family as "
-      + "trademark-portal and trademark-ops-mcp. Whether a placeholder should now ship is open: see above.",
+      + "It was described as deploying from a copy held on the deployment itself, in the same "
+      + "identity-provider template family as two other pre-rename names; the 2026-09-08 reading finds no "
+      + "such copy under any account, so that description is history rather than current state. Whether a "
+      + "placeholder should now ship is open: see above.",
     // NO LONGER RESOLVED AT INSTALL. It carried `@CLEAROTRON_CHECKOUT_DIR@` because
     // it loaded no EnvironmentFile and so had no `${VAR}` systemd could expand. The owner's one-config-
     // per-server-box ruling gives it `EnvironmentFile=%h/.env` like every other service, which makes the
     // checkout path an ordinary systemd expansion and leaves no placeholder to render.
-    note: "LIVE ON PRODUCTION. #685's body lists it as never run; that is true of the test box only. "
-      + "Was a TEMPLATE unit carrying CF Access values inline; generic since tracker issue 1925.",
+    note: "NOT RUNNING ANYWHERE, measured 2026-09-08. This row said LIVE ON PRODUCTION for as long as it "
+      + "existed and no enumeration ever supported it. Was a TEMPLATE unit carrying identity-provider "
+      + "values inline; generic since tracker issue 1925.",
+    orphanReason: "CLAIMED A DEPLOYMENT IT WAS NEVER MEASURED ON, which is a FOURTH kind of orphan and "
+      + "the only one that was ever a wrong claim rather than a waiting decision: the other three run "
+      + "under another name, were deliberately switched off, or have simply never been installed. This "
+      + "one was declared live and read as absent. The row is kept because the deployment question is "
+      + "open and belongs to the owner — whether production should run this service at all — and an "
+      + "inventory that deleted the row would lose the only place that question is written down. It "
+      + "gains a deployment the day an enumeration shows it, never the day someone intends it.",
   },
   {
     // RUNS ON NO BOX YET, AND THAT IS THE HONEST DECLARATION. `runsOn: ["prod"]` is a claim about a
@@ -185,7 +208,8 @@ export const UNIT_INVENTORY = Object.freeze([
     // say "the repo ships this, nothing runs it, and here is the decision it waits on" — orphans are
     // REPORTED, never a fault, for exactly this case. It becomes `["prod"]` in the change that DEPLOYS
     // it, against a fresh enumeration, which is the ratchet working rather than being edited around.
-    unit: "clearotron-portal", runsOn: [], tracked: ["clearotron-portal.service"],
+    unit: "clearotron-portal", runsOn: ["test"], tracked: ["clearotron-portal.service"],
+      measured: "2026-09-07, test box, `systemctl --user show` with a working user bus: ActiveState=active, UnitFileState=enabled, fragment under ~/.config/systemd/user/.",
     note: "NEW, tracker issue 1925, SHIPPED BUT NOT YET DEPLOYED. The portal had NO unit at all — it "
       + "and the MCP face are the two children bin/start.mjs supervises, and neither ran under systemd, "
       + "so a hosted deployment kept them alive with a hand launcher and `clearotron start` had nothing "
@@ -201,7 +225,8 @@ export const UNIT_INVENTORY = Object.freeze([
   {
     // Same as clearotron-portal above: shipped, running nowhere, declared as an orphan rather than
     // asserting a production state no enumeration has ever shown.
-    unit: "clearotron-mcp-face", runsOn: [], tracked: ["clearotron-mcp-face.service"],
+    unit: "clearotron-mcp-face", runsOn: ["test"], tracked: ["clearotron-mcp-face.service"],
+      measured: "2026-09-07, test box, `systemctl --user show` with a working user bus: ActiveState=active, UnitFileState=enabled, fragment under ~/.config/systemd/user/.",
     note: "NEW, tracker issue 1925, SHIPPED BUT NOT YET DEPLOYED. The engine door the portal calls over "
       + "MCP; the other of the two processes that had no unit.",
     orphanReason: "THE ENGINE DOOR THE PORTAL CALLS, shipped with no box carrying it yet. Same kind as "
@@ -218,7 +243,7 @@ export const UNIT_INVENTORY = Object.freeze([
     // are then enabled like anything else. This one is shipped and DELIBERATELY NOT INSTALLED BY ANY
     // INSTALL PATH — `clearotron start` neither installs nor starts it, and a rebuild must not either.
     //
-    // ── IT INSTALLS WITH THE PRODUCT SINCE 2026-09-03 (, settled point 2) ────────
+    // ── IT INSTALLS WITH THE PRODUCT SINCE 2026-09-03 (settled point 2) ────────
     //
     // Until then it was an orphan BY DESIGN: `clearotron connect` installed and started it on demand,
     // because starting it turned on client-account access and a unit that came up with everything else
@@ -229,7 +254,8 @@ export const UNIT_INVENTORY = Object.freeze([
     // So it is now an orphan of the FIRST kind, awaiting a box, exactly like the portal and the engine
     // door beside it: it is in SERVER_INSTALL_SET, and it leaves this list on the day a measured
     // enumeration of a box shows it running.
-    unit: "clearotron-client-mcp", runsOn: [], tracked: ["clearotron-client-mcp.service"],
+    unit: "clearotron-client-mcp", runsOn: ["test"], tracked: ["clearotron-client-mcp.service"],
+      measured: "2026-09-07, test box, `systemctl --user show` with a working user bus: ActiveState=active, UnitFileState=enabled, fragment under ~/.config/systemd/user/.",
     note: "tracker issue 1976, and INSTALLED WITH THE PRODUCT since tracker issue 2148. The client door "
       + "— the one surface that accepts an account-scoped key, and a separate process from the engine "
       + "door, which refuses one outright.",
@@ -246,7 +272,8 @@ export const UNIT_INVENTORY = Object.freeze([
     // supervises the portal, the engine door and this worker; 1925 shipped units for the first two.
     // Written as part of retiring the path-watcher posture, because retiring `prelim-driver.*` without
     // it leaves a hosted box healthy-looking and draining nothing.
-    unit: "clearotron-worker", runsOn: [], tracked: ["clearotron-worker.service"],
+    unit: "clearotron-worker", runsOn: ["test"], tracked: ["clearotron-worker.service"],
+      measured: "2026-09-07, test box, `systemctl --user show` with a working user bus: ActiveState=active, UnitFileState=enabled, fragment under ~/.config/systemd/user/.",
     note: "NEW, tracker issue 1863. The drain, as one plain service unit invoking the entrypoint "
       + "directly (owner ruling 2026-08-31). Ships tracked, runs nowhere yet — production takes it at "
       + "its rebuild, which is the same event that lets the retired units' files leave the tree.",
@@ -256,21 +283,11 @@ export const UNIT_INVENTORY = Object.freeze([
       + "alternatives, and running both puts a second claimant on one queue.",
   },
   {
-    unit: "prelim-outbox", runsOn: ["prod"],
-    tracked: ["prelim-outbox.service", "prelim-outbox.path", "prelim-outbox.timer"],
-    retired: {
-      ruled: "2026-08-31",
-      filesStayUntil: "prod",
-      why: "the timer retires with the watcher it backstopped, by name in the ruling. That watcher also "
-        + "carried the last dead OpenClaw literal in the tree. Channel delivery is the "
-        + "integrator's (INSTALL.md §9), so retiring these takes away nothing the product promises — "
-        + "the worked example moves into the document rather than being deleted with them.",
-    },
-    note: "LIVE ON PRODUCTION (path and timer active-waiting). Was absent from the health check's unit "
-      + "list, so its drift was never checked despite being tracked.",
-  },
-  {
-    unit: "trademark-portal", runsOn: ["prod", "test"], tracked: null,
+    unit: "trademark-portal", runsOn: [],
+      orphanReason: "THE PRE-RENAME PORTAL. The deployment account runs `clearotron-portal`; this name is "
+      + "what that service used to be called, and the 2026-09-08 reading finds no unit of this name under "
+      + "any account. It ran on production until the rename and the entry was never re-measured after it.",
+      measured: "2026-09-08: production read by account — the deployment account carries six clearotron-* unit files and the doctrine-sync timer, the legacy account carries five units of the other product plus unloadable residue, and no unit of THIS name is under either. Names and enable state only. This line previously carried a 2026-09-07 reading of the test deployment — LoadState=not-found there, with the production claim left alone because production had not been measured. It has been now, and this is that reading.", tracked: null,
     untrackedReason: "the deployed copy carries real Cloudflare Access team/AUD/domain values inline. "
       + "A tracked file would be the placeholder TEMPLATE, merged by hand after a "
       + "diff — writing one carelessly replaces working auth with placeholders that look configured.",
@@ -281,11 +298,19 @@ export const UNIT_INVENTORY = Object.freeze([
     supersededName: "portal-service.service (deleted, owner-ruled 2026-08-14)",
   },
   {
-    unit: "trademark-ops-mcp", runsOn: ["prod", "test"], tracked: null,
+    unit: "trademark-ops-mcp", runsOn: [],
+      orphanReason: "THE PRE-RENAME OPERATOR DOOR. The deployment account runs `clearotron-mcp-face`; the "
+      + "2026-09-08 reading finds no unit of this name under any account. Same rename as the portal it "
+      + "serves, and the same claim carried across it unmeasured.",
+      measured: "2026-09-08: production read by account — the deployment account carries six clearotron-* unit files and the doctrine-sync timer, the legacy account carries five units of the other product plus unloadable residue, and no unit of THIS name is under either. Names and enable state only. This line previously carried a 2026-09-07 reading of the test deployment — LoadState=not-found there, with the production claim left alone because production had not been measured. It has been now, and this is that reading.", tracked: null,
     untrackedReason: "same CF Access inline-values shape as the portal it serves.",
   },
   {
-    unit: "client-mcp", runsOn: ["prod", "test"], tracked: ["client-mcp.service"],
+    unit: "client-mcp", runsOn: [],
+      orphanReason: "THE PRE-RENAME CLIENT DOOR. `clearotron-client-mcp` runs on both the production and "
+      + "the test deployments; the 2026-09-08 reading finds no unit of THIS name under any account. The "
+      + "tracked template stays because the repository still ships it — see the note.",
+      measured: "2026-09-08: production read by account — the deployment account carries six clearotron-* unit files and the doctrine-sync timer, the legacy account carries five units of the other product plus unloadable residue, and no unit of THIS name is under either. Names and enable state only. This line previously carried a 2026-09-07 reading of the test deployment — LoadState=not-found there, with the production claim left alone because production had not been measured. It has been now, and this is that reading.", tracked: ["client-mcp.service"],
     note: "TRACKED, in mcp-server/remote/ — this entry said it had no file, and the file was there. It is "
       + "a banner-marked TEMPLATE, so the live copy differing from it is the arrangement, not drift. "
       + "#1147 ADDED THE TEST BOX (2026-08-18): the client surface ran nowhere but production, so the test "
@@ -296,18 +321,79 @@ export const UNIT_INVENTORY = Object.freeze([
       + "not the default.",
   },
   {
-    unit: "client-mcp-apikey", runsOn: ["prod"], tracked: ["client-mcp-apikey.service"],
+    unit: "client-mcp-apikey", runsOn: ["test"],
+      measured: "2026-09-08, read by account: enabled and present on the TEST deployment, beside the "
+      + "renamed `clearotron-client-mcp`. Absent from production under any account. The entry declared "
+      + "production and the reading puts it on the other deployment — the claim was not stale, it named "
+      + "the wrong machine. Why it runs there at all beside the renamed door is a separate question.",
+      tracked: ["client-mcp-apikey.service"],
     note: "TRACKED, in mcp-server/remote/. Same correction as client-mcp: the old reason claimed the live "
       + "key made a tracked file impossible, and the tracked TEMPLATE — which holds no key — already existed.",
   },
   {
-    unit: "trademark-artifacts-http", runsOn: ["prod"], tracked: ["trademark-artifacts-http.service"],
+    unit: "trademark-artifacts-http", runsOn: [],
+      orphanReason: "A PRE-RENAME NAME OF THE RETIRED DEPLOYMENT, and the one of them whose tracked file "
+      + "is GENERIC rather than a template — so the file is ready to be compared against a live copy the "
+      + "day something runs it, and nothing does. Read as absent under every account on 2026-09-08.",
+      measured: "2026-09-08: production read by account — no unit of this name is under the deployment account or the legacy one. Names and enable state only; no unit contents were read.", tracked: ["trademark-artifacts-http.service"],
     note: "TRACKED, in mcp-server/remote/. GENERIC, not a template: it carries no banner and no "
       + "placeholder, and defers its CF Access values to the EnvironmentFile — so its live copy is "
       + "expected to MATCH the tracked file, and a difference is real drift.",
   },
   {
-    unit: "client-access", runsOn: ["prod"], tracked: null,
+    unit: "clearotron-mcp-local", runsOn: ["prod"], tracked: null,
+    untrackedReason: "the fifth hand-made door on production, on 18793, kept as it is by ruling while "
+      + "the product fix lands. Known and hand-made is not the same as declared: it was running on "
+      + "production and named by no inventory, no unit file and no line of code in this repo, so the "
+      + "health check could not see it and nothing would have said if it stopped. Declared here to end "
+      + "that, not to bless the arrangement.",
+  },
+  {
+    unit: "clearotron-doctrine-sync", runsOn: ["prod"], tracked: null,
+    // WHAT SYSTEMD KNOWS THIS UNIT AS, which `tracked` cannot say here. For a tracked unit the file
+    // list carries the suffixes — `clearotron-deploy` names its `.service` AND its `.timer` — so a
+    // reader deriving systemd queries from the entry gets both. An UNTRACKED unit ships no files, so
+    // `tracked: null` leaves nothing to derive from and the bare name silently means `.service`.
+    // Stated separately so the two questions stay apart: `tracked` is what this repo SHIPS,
+    // `systemdUnits` is what the box RUNS.
+    systemdUnits: ["clearotron-doctrine-sync.service", "clearotron-doctrine-sync.timer"],
+    // ── THE ONE WHOSE SILENCE REACHES A CLIENT ────────────────────────────────────────────────────
+    //
+    // This is the timer half of production's doctrine refresh. The stages read doctrine to decide what
+    // they do, so if it stops, production runs clearances against whatever doctrine last landed and NO
+    // SURFACE ANYWHERE SAYS SO — the client receives a report that looks exactly like a current one.
+    //
+    // That is a client-facing failure with no detector, which is what the drift check exists for, and
+    // the drift check could not see this unit because the unit was in no list.
+    //
+    // BEING IN THIS LIST IS NOT YET DETECTION, AND SAYING SO IS THE POINT OF THIS PARAGRAPH. Every name
+    // here is bare, and `systemctl show <bare>` answers for the `.service`. For a timer-driven unit that
+    // service is `inactive` BETWEEN RUNS and `inactive` when its timer has been stopped — the same
+    // answer to both questions. So the health check can now say this unit exists and cannot say whether
+    // anything still starts it, which is the failure the entry was written for.
+    //
+    // The signal lives on `clearotron-doctrine-sync.timer`, whose ActiveState separates `active`
+    // (waiting) from `inactive` (stopped). What is missing is not the NAME — `systemdUnits` below
+    // carries it — but a consumer: the check derives its queries from the bare unit rather than from
+    // that field, so the timer is written down and never asked about.
+    //
+    // WHEN THE CHECK DERIVES ITS QUERIES FROM `systemdUnits` RATHER THAN FROM THE BARE NAME, THIS
+    // PARAGRAPH IS OBSOLETE — and the field below is what it will read. Stated as a condition rather
+    // than as a pointer to where it is being done, because a condition is self-verifying: a reader
+    // confirms or refutes it by looking at the check today, and the day the derivation lands this reads
+    // as history instead of as an open item.
+    untrackedReason: "the doctrine refresh on production, timer-driven, running from no file in "
+      + "driver/systemd/ and named nowhere in this repo. It CAN be tracked — it carries no "
+      + "identity-edge value — and nobody wrote it down. Until it is, its absence is at least no "
+      + "longer silent.",
+  },
+  {
+    unit: "client-access", runsOn: [],
+      orphanReason: "NOT THIS REPOSITORY'S SERVICE, and no longer running under this name: the legacy "
+      + "account holds it only as `client-access.service.retired-20260904`, a suffix systemd never reads. "
+      + "Declared here so a unit sharing a machine with ours is not invisible, and now declared as gone.",
+      measured: "2026-09-08: present on the legacy account ONLY as a retired-suffixed filename, which "
+      + "systemd does not load. No loadable unit of this name under any account.", tracked: null,
     untrackedReason: "it is not this repo's service. Its ExecStart runs a script from a different "
       + "product's checkout on the same box, not under this clone — so there is no code here to "
       + "template, and the old reason (CF Access values inline) would send the next reader hunting for a "
@@ -415,13 +501,21 @@ export const UNIT_INVENTORY = Object.freeze([
       + "checkout's bridge, not this clone's.",
   },
   {
-    unit: "trademark-test-deploy", runsOn: ["test"], tracked: null,
+    unit: "trademark-test-deploy", runsOn: [],
+      measured: "2026-09-07, test box: LoadState=not-found. The hourly deploy runs as clearotron-deploy.timer, which has its own entry; this name is what that one used to be called.", tracked: null,
+    // AN EMPTY runsOn OWES A REASON, and this one is a supersession rather than an orphan: the hourly
+    // deploy still runs on the test box, under the name `clearotron-deploy`, which has its own entry and
+    // its own measurement. This name is what that unit used to be called. It is kept rather than deleted
+    // because the unit FILE is still tracked and an inventory of what ships should account for every
+    // tracked file — deleting the entry would make the file unaccounted for, which is the ratchet this
+    // file exists to keep shut.
+    orphanReason: "SUPERSEDED, NOT RETIRED — the hourly deploy of the test instance runs as `clearotron-deploy`, measured active there on 2026-09-07. This entry is the pre-rename name for the same job, so it runs on no box under THIS name and the boxes moved to the entry that replaced it. The tracked file stays until production is rebuilt, which is the same disposition the other retired units carry.",
     untrackedReason: "the hourly --ff-only deploy of the TEST instance. It exists on the test box only "
       + "and by design: production never auto-deploys, so a tracked file shipped to both would be a unit "
       + "production must be trusted never to enable.",
   },
   // register-ledger-prune is DELIBERATELY not listed, and the sequence is worth keeping because the
-  // row was right until the moment it was wrong. 's nightly rotation was retired in code by:
+  // row was right until the moment it was wrong. That nightly rotation was retired in code by:
   // bin/register-ledger-prune.mjs is deleted, record bodies now live in each run's own directory and
   // are purged with the run, so there is no global file left to rotate. The row stayed here on
   // purpose while the TIMER was still installed on the test box — dropping it first would have made
@@ -463,6 +557,59 @@ export const CHECKED_UNITS = Object.freeze(
   UNIT_INVENTORY.filter((u) => u.runsOn.length > 0).map((u) => u.unit),
 );
 
+/**
+ * The TIMER units this deployment claims to have, by name, as systemd spells them.
+ *
+ * ── WHY A SECOND LIST AND NOT MORE NAMES IN THE ONE ABOVE ───────────────────────────────────────────
+ *
+ * `CHECKED_UNITS` holds BARE names, and that is load-bearing rather than an accident: the verdict
+ * appends the suffixes itself when matching what a box is running, so one entry answers for a unit's
+ * service, timer and path alike. The health check then asks `systemctl show <bare>`, and systemd
+ * resolves a bare name to the `.service`.
+ *
+ * For a timer-driven unit that is the wrong question, and it is wrong in the direction that hides the
+ * failure. The service of a timer-driven unit reads `ActiveState=inactive` **between runs** — it is
+ * meant to — and it reads `inactive` when its timer has been STOPPED. Identical strings, opposite
+ * meanings, and the check could report the unit exists while being unable to say whether anything
+ * still starts it. That is the whole of what a timer entry is for.
+ *
+ * The signal lives on the `.timer`, whose `ActiveState` separates `active` (armed and waiting) from
+ * `inactive` (stopped, and nothing will fire the service again).
+ *
+ * ── WHERE THE NAMES COME FROM ───────────────────────────────────────────────────────────────────────
+ *
+ * From `tracked`, which already lists the files an entry accounts for, so a shipped timer is covered
+ * with nothing new to declare and cannot be forgotten. An UNTRACKED unit has no file list to read, so
+ * it says so with `systemdUnits:` — the systemd names to ask about, which is a different fact from the files
+ * the repository ships and is why it is not folded into `tracked`. Claiming a tracked file that does
+ * not exist is a fault; naming a unit this deployment runs is a claim about a box.
+ */
+export const CHECKED_TIMERS = Object.freeze(
+  UNIT_INVENTORY.filter((u) => u.runsOn.length > 0)
+    .flatMap((u) => (u.systemdUnits ?? u.tracked ?? []).filter((f) => f.endsWith(".timer")))
+    .sort(),
+);
+
+/**
+ * Judge the timers. PURE — the caller reads systemd.
+ *
+ * `inactive` is the finding here, which inverts the reflex a reader brings from services. A stopped
+ * timer breaks nothing now and nothing fails: the service simply never fires again, and every surface
+ * that reports on the service keeps saying `inactive`, which is what it says when the timer is working.
+ */
+export function timerVerdict(timers, { probeFailed = null } = {}) {
+  if (probeFailed) return { state: "unknown", stopped: [], absent: [], message: `could not ask systemd about the timers: ${probeFailed}. That is this check failing to look, not a report about them.` };
+  const rows = timers ?? [];
+  if (!rows.length) return { state: "pass", stopped: [], absent: [], message: "no timer is declared for this box" };
+  const absent = rows.filter((t) => t.load === "not-found").map((t) => t.unit).sort();
+  const stopped = rows.filter((t) => t.load !== "not-found" && t.active !== "active").map((t) => t.unit).sort();
+  const parts = [`${rows.length} declared timer(s)`];
+  if (stopped.length) parts.push(`STOPPED: ${stopped.join(", ")} — the service each one drives will not fire again, and its own state stays 'inactive' either way`);
+  if (absent.length) parts.push(`${absent.length} declared timer(s) do not exist on this box`);
+  if (!stopped.length && !absent.length) parts.push("all armed");
+  return { state: stopped.length ? "fail" : "pass", stopped, absent, message: parts.join("; ") };
+}
+
 /** Every tracked file the inventory accounts for, flattened. */
 export const ACCOUNTED_FILES = Object.freeze(
   UNIT_INVENTORY.flatMap((u) => u.tracked ?? []),
@@ -489,6 +636,11 @@ export const ACCOUNTED_FILES = Object.freeze(
  */
 export function unitInventoryVerdict({
   live = [], files = [], collisions = [], filesError = null, box = null, probe = { ok: true },
+  // INJECTED so the retirement branch can be PLANTED. `retired:` has no members today — the two it
+  // carried left with their files — so `absentByRetirement` and the line it feeds are unreachable
+  // against the real table, and a branch nothing exercises is a branch that will not fire the next
+  // time somebody retires a unit. That is this file's own failure mode pointed at itself.
+  inventory = UNIT_INVENTORY,
 } = {}) {
   if (!probe.ok) {
     return { state: "skip", undeclared: [], orphaned: [], absent: [], misdeclared: [],
@@ -496,7 +648,7 @@ export function unitInventoryVerdict({
         + "A failure to look is not a finding about the deployment." };
   }
   const base = (u) => String(u).replace(/\.(service|timer|path|socket|target|mount|slice)$/, "");
-  const known = new Set(UNIT_INVENTORY.map((u) => u.unit));
+  const known = new Set(inventory.map((u) => u.unit));
   const liveBases = [...new Set(live.map(base))];
 
   const undeclared = liveBases.filter((u) => !known.has(u)).sort();
@@ -506,7 +658,20 @@ export function unitInventoryVerdict({
   // reason attached, and the difference is the whole point of writing the reasons down.
   const accounted = new Set(ACCOUNTED_FILES);
   const unaccountedFiles = files.filter((f) => !accounted.has(f)).sort();
-  const orphaned = UNIT_INVENTORY.filter((u) => u.runsOn.length === 0).map((u) => u.unit).sort();
+  const orphaned = inventory.filter((u) => u.runsOn.length === 0).map((u) => u.unit).sort();
+
+  // RUNNING HERE, DECLARED TO RUN NOWHERE. The defect the rename to clearotron-* left behind: the new
+  // units shipped WITH entries, those entries kept `runsOn: []`, and the pre-rename names kept the
+  // boxes. Every arm scoped to CHECKED_UNITS — which filters on a NON-EMPTY runsOn — therefore asked
+  // systemd about sixteen names that mostly named nothing and reported "0 active; 16 at rest", while
+  // four services ran under names no entry claimed. Measured on the test box 2026-09-07.
+  //
+  // This needs NO knowledge of which box it is running on, which is what makes it the right shape: an
+  // entry saying a unit runs on no box is contradicted by that unit running HERE, wherever here is.
+  // The mirror — declared for a box and absent from it — cannot be judged without a box identity this
+  // tree does not carry, and is reported as information rather than as a verdict.
+  const orphanSet = new Set(orphaned);
+  const runningButDeclaredNowhere = liveBases.filter((u) => orphanSet.has(u)).sort();
 
   // THE RATCHET THAT MAKES THIS FILE'S OWN DEFECT UNREPRESENTABLE. An entry with no tracked file states
   // a fact about the tree, and until the lookup went repo-wide it was a fact nothing could check —
@@ -514,7 +679,7 @@ export function unitInventoryVerdict({
   // is why writing one is dangerous" while the tracked file sat one directory over. A reader asking what
   // configuration the client door runs was told, with confidence, to look at nothing.
   const trackedNames = new Set(files);
-  const misdeclared = UNIT_INVENTORY
+  const misdeclared = inventory
     .filter((u) => !u.tracked)
     .filter((u) => ["service", "timer", "path"].some((s) => trackedNames.has(`${u.unit}.${s}`)))
     .map((u) => u.unit).sort();
@@ -529,7 +694,7 @@ export function unitInventoryVerdict({
   // It matters now because the retirement above deletes unit files on a schedule set by production's
   // rebuild rather than by this PR, so entry and tree are deliberately going to disagree for a while,
   // and the disagreement must be the kind that gets reported rather than the kind that is invisible.
-  const claimedAbsent = files.length === 0 || filesError ? [] : UNIT_INVENTORY
+  const claimedAbsent = files.length === 0 || filesError ? [] : inventory
     .flatMap((u) => (u.tracked ?? []).map((f) => ({ unit: u.unit, file: f })))
     .filter((c) => !trackedNames.has(c.file))
     .map((c) => `${c.file} (claimed by ${c.unit})`).sort();
@@ -538,16 +703,16 @@ export function unitInventoryVerdict({
   // reporting every production unit missing on a dev box is a false alarm, and it would train a reader
   // to skim this check. But an arm that did not run is not an arm that passed — this file's whole
   // thesis — so an unnameable box is STATED rather than silently skipped.
-  // ABSENT-AND-EXPECTED-TO-BE vs ABSENT-AND-SHOULD-NOT-BE (, criterion 3). A retired
+  // ABSENT-AND-EXPECTED-TO-BE vs ABSENT-AND-SHOULD-NOT-BE (criterion 3). A retired
   // unit that is gone from a box is the ruling taking effect, not drift; reporting it as a fault trains
   // a reader to skim the arm that would have caught a real one. Both are still REPORTED — the
   // distinction is which of them is a fault.
   const declaredHere = (u) => box && u.runsOn.includes(box) && !liveBases.includes(u.unit);
   const absent = box
-    ? UNIT_INVENTORY.filter((u) => declaredHere(u) && !u.retired).map((u) => u.unit).sort()
+    ? inventory.filter((u) => declaredHere(u) && !u.retired).map((u) => u.unit).sort()
     : [];
   const absentByRetirement = box
-    ? UNIT_INVENTORY.filter((u) => declaredHere(u) && u.retired).map((u) => u.unit).sort()
+    ? inventory.filter((u) => declaredHere(u) && u.retired).map((u) => u.unit).sort()
     : [];
   const boxLine = box ? "" : " The box could not be named, so 'declared here and not running' was NOT "
     + "checked — that half did not run, which is not the same as passing.";
@@ -572,6 +737,11 @@ export function unitInventoryVerdict({
       + "A unit nothing declares is compared against nothing and reported by nothing — add it to "
       + "driver/unit-inventory.mjs, tracked or with the reason it is not.");
   }
+  if (runningButDeclaredNowhere.length) {
+    faults.push(`${runningButDeclaredNowhere.join(", ")} — ${runningButDeclaredNowhere.length} unit(s) are `
+      + `RUNNING on this box while their inventory entry declares runsOn: [], so every check scoped to `
+      + `the declared list is judging a population that excludes them`);
+  }
   if (misdeclared.length) {
     faults.push(`${misdeclared.length} entr(y/ies) claim NO tracked file while a unit file of that name is `
       + `in the tree: ${misdeclared.join(", ")}. The entry is not merely incomplete, it is false — and a `
@@ -618,8 +788,8 @@ export function unitInventoryVerdict({
   return {
     state: "pass", undeclared, orphaned, absent, misdeclared, claimedAbsent, absentByRetirement,
     message: `${liveBases.length} live unit(s), all declared; `
-      + `${UNIT_INVENTORY.filter((u) => u.tracked).length} entr(y/ies) tracked, `
-      + `${UNIT_INVENTORY.filter((u) => u.runsOn.length && !u.tracked).length} live-and-untracked BY DECLARATION `
+      + `${inventory.filter((u) => u.tracked).length} entr(y/ies) tracked, `
+      + `${inventory.filter((u) => u.runsOn.length && !u.tracked).length} live-and-untracked BY DECLARATION `
       + `with a stated reason.${retiredLine}${orphanLine}${boxLine}${filesLine}`,
   };
 }
@@ -641,6 +811,53 @@ export function unitInventoryVerdict({
  * @param {string|null} raw  the value `systemctl show -p WorkingDirectory` printed
  * @returns {{path: string|null, prefixes: string, why: string|null}}
  */
+/**
+ * Which checkout is a unit actually serving — and which piece of evidence said so.
+ *
+ * A unit can be attributed two ways and they are not equally good.
+ *
+ * `WorkingDirectory` is a DECLARATION. It is what the unit file asks for, and it is frequently not a
+ * checkout at all: a unit written as `WorkingDirectory=~` reports `!/home/<user>`, which resolves to a
+ * home directory that is not a git tree, and the unit then drops out of the comparison entirely. That is
+ * not a rare shape — it is what a unit looks like when its author put the checkout in `ExecStart=`
+ * instead, which is the normal thing to do, because systemd cannot expand a variable in
+ * `WorkingDirectory=` and can in `ExecStart=`.
+ *
+ * The RUNNING COMMAND LINE is an OBSERVATION: the absolute path the live process was actually started
+ * with. So it wins, and that order is the point rather than a preference. The incident this comparison
+ * exists for is a deployment that served its portal from one clone while running its runner from
+ * another — and in that state the declaration and the process disagree, with the process telling the
+ * truth. Preferring the declaration would take the wrong side of exactly the case the check is for.
+ *
+ * WHEN BOTH RESOLVE AND DISAGREE, that IS the finding, and it is returned rather than quietly resolved:
+ * a unit whose declared tree and running tree differ has been repointed since it started, and it is
+ * serving the older one until something restarts it.
+ *
+ * PURE — the caller does the reading (systemd, the unit file, the process table) and this decides.
+ *
+ * @param {object} a
+ * @param {string|null} a.declaredTree  a git tree resolved from `WorkingDirectory`, or null
+ * @param {string|null} a.runningTree   a git tree resolved from the live process's argv, or null
+ * @param {string|null} a.declaredWhy   why the declaration gave nothing, if it gave nothing
+ * @param {string|null} a.runningWhy    why the process gave nothing, if it gave nothing
+ * @returns {{clone: string|null, source: string|null, disagreement: string|null, why: string|null}}
+ */
+export function unitClone({ declaredTree = null, runningTree = null, declaredWhy = null, runningWhy = null } = {}) {
+  const norm = (p) => String(p ?? "").replace(/\/+$/, "") || null;
+  const declared = norm(declaredTree);
+  const running = norm(runningTree);
+  const disagreement = declared && running && declared !== running
+    ? `the unit declares ${declared} and its running process was started from ${running} — it is serving the second until something restarts it`
+    : null;
+  if (running) return { clone: running, source: "the running command line", disagreement, why: null };
+  if (declared) return { clone: declared, source: "WorkingDirectory", disagreement, why: null };
+  // BOTH REASONS, never the first one that came to hand. A caller that reports only "no WorkingDirectory"
+  // sends the next reader to fix a unit file when the process table was the half that could not be read.
+  const parts = [declaredWhy, runningWhy].filter(Boolean);
+  return { clone: null, source: null, disagreement: null,
+    why: parts.length ? parts.join("; and ") : "neither the unit's WorkingDirectory nor its running command line named a checkout" };
+}
+
 export function unitWorkingDirectory(raw) {
   const s = String(raw ?? "").trim();
   if (!s) return { path: null, prefixes: "", why: "the unit reported no WorkingDirectory" };