clearotron 0.2.1 → 0.2.3

package/providers/_shared/result-shape.mjs

@@ -66,7 +66,7 @@ export const NEUTRAL_TOOL_RESULT_SHAPE = Object.freeze({
     // key the provider's own kernel is configured to join on is the one its own doBatchScreen emits.
     // See BATCH_SCREEN_JOIN_KEY.
     row: Object.freeze({ identity: Object.freeze(["uri", "record_id"]), verdict: "screen_verdict" }),
-    // euipo answers `screened: <count>`. The free tier's pre- read was
+    // euipo answers `screened: <count>`. The free tier's pre-change read was
     // `parsed.rows ?? parsed.screened ?? parsed.results ?? parsed.records` — on euipo that chain
     // resolves an INTEGER as the screening result the moment `rows` is ever absent. The key is NOT
     // renamed here: the response text is the seat's prompt surface and euipo's own callers read it.
@@ -74,10 +74,10 @@ export const NEUTRAL_TOOL_RESULT_SHAPE = Object.freeze({
     // this file learns the trap instead of rediscovering it.
     reservedScalars: Object.freeze({ screened: "number", asked: "number" }),
   }),
-  // Audited alongside batch screen ('s "worth checking at the same time"): NO split. Every
+  // Audited alongside batch screen (the "worth checking at the same time"): NO split. Every
   // provider that implements search answers `results[]` — corsearch and clarivate through
   // `normalizeSearchResponse`, euipo/uspto-local/free-tier directly — and the driver reads exactly
-  // that name (driver/driver.config.mjs:779, :949).
+  // that name (driver/driver.config.mjs `recordsFromSearch`, and the `clarivate` entry).
   register_search: Object.freeze({
     list: "results",
     listAliases: Object.freeze([]),

package/providers/_shared/term-shape.mjs

@@ -115,8 +115,8 @@ const MARKUP_ARMS = [
  * long-form arm. A slogan mark has a legitimately long dominant element and cannot be restated any
  * shorter, so refusing a value for BEING LONG is right at the compiler and wrong at a corrective
  * stage gate — it hands back a reason with no remedy. An annotation always has a remedy: delete the
- * note, keep the term. — that is also why it may sit ABOVE a word-count floor: `ZEPHYR (root)`
- * is an annotation by no measure a word count can see, exactly as 's one-word `**BIOVELTRIN**`
+ * note, keep the term. — that is also why it may sit ABOVE a word-count floor: `COASTLINE (root)`
+ * is an annotation by no measure a word count can see, exactly as the one-word `**BIOVELTRIN**`
  * was markup by no measure a word count could see.
  *
  * Moved here from variant-manifest-model.mjs so the stage gate and the plan compiler share

package/providers/corsearch/src/core.js

@@ -53,7 +53,7 @@ export const MATCH_MODE_PREFIX = {
 // `provider` discriminator on every row.
 //
 // SECURITY — the ids logged (agentId / sessionKey / sessionId) are the GATEWAY tool-call context
-// (e.g. "clawdi", "prelim-acme-…"), the per-run attribution. They are NOT the Corsearch `sessionKey`
+// (e.g. "clawdi", "clearotron-acme-…"), the per-run attribution. They are NOT the Corsearch `sessionKey`
 // COOKIE (the live credential, which merely shares the name). logCall is only ever handed `tctx`
 // (kind + gateway ids + target) and response metrics — the cookie is never passed in. Keep it so.
 export const { logCall, logRecordBody, tctxOf } = makeLedger("corsearch");

package/providers/jx-subclass/BUILDING.md

@@ -43,7 +43,7 @@ Then the evidence, which is the point of the directory:
 node verify-relations.mjs      # relation typing vs the hand-checked answer key
 node verify-overlap.mjs        # a machine read vs a human read, on pages both cover
 node coverage-demo.mjs         # read-and-empty and never-read answer DIFFERENTLY
-node score-truth.mjs           # the 63-item key from tracker issue 1210
+node score-truth.mjs           # the 63-item key
 ```
 
 ## What a build needs that this repo does not carry

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,11 @@
 # trademark-oauth-mcp-bridge
 
+## 0.2.3
+
+## 0.2.2
+
+## 0.3.0-beta.0
+
 ## 0.2.1
 
 ## 0.2.1-beta.2

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/providers/oauth-mcp-bridge/stdin-guard.mjs

@@ -3,12 +3,12 @@
 // stdin-guard.mjs — orphan self-termination for stdio-spawned MCP processes.
 //
 // A stdio MCP server lives exactly as long as the client that spawned it: stdin EOF/close means that
-// client (`claude -p` under the prelim engine, or any other stdio MCP client) is gone and no request can ever arrive
+// client (`claude -p` under the clearotron engine, or any other stdio MCP client) is gone and no request can ever arrive
 // again. Without this guard the bridge held its upstream HTTP transport open FOREVER after the parent
 // died (proven orphan: a bridge.mjs --server legaldatahunter process, PPID 1, ran 3.5 days) — still
 // authenticated, still able to run billable upstream calls for a dead session. Exit 0 and abandon any
 // in-flight work: continuing it is exactly the failure mode. Dependency-free on purpose (unit-tested
-// from the prelim-driver suite, which does not install the bridge's SDK).
+// from the clearotron-driver suite, which does not install the bridge's SDK).
 //
 // NOTE: `end` fires only once something reads stdin (the MCP transport does, post-connect); `close`
 // covers a destroyed stream. The steady-state orphan — connected bridge, parent dies later — is the

package/providers/uspto-local/src/index-store.js

@@ -489,8 +489,8 @@ function predicateClause(predicate, term) {
       // predicate. Unanchored, because corporate names arrive in every spelling there is.
       //
       // NO FTS NARROWER HERE, deliberately, and it is the same trap as the suffix one. An FTS
-      // token-prefix candidate set is NOT a superset of an unanchored contains: owner "AURORA INTERACTIVE"
-      // searched for "URORA" satisfies the LIKE, but no token starts with URORA, so the narrower
+      // token-prefix candidate set is NOT a superset of an unanchored contains: owner "FOXGLADE INTERACTIVE"
+      // searched for "OXGLADE" satisfies the LIKE, but no token starts with URORA, so the narrower
       // would drop a true match and the verification could never put it back. A narrower may only
       // ever be a superset of its verifier. So this is an honest full scan, and how expensive that is
       // at register scale is UNMEASURED.

package/scripts/README.md

@@ -70,7 +70,7 @@ returns `stale-probe` and refuses, where at one zoom level it used to hand back
 were a measurement. Same six failures, one honest reason. The obstacle was one level up:
 `--virtual-time-budget` services the outer page and starves that subframe.
 
-**That rewrite has landed (, 2026-08-21) and the check measures.** It drives Chrome on real time
+**That rewrite has landed (2026-08-21) and the check measures.** It drives Chrome on real time
 and the page POSTs its state to a loopback server when it is ready, so the harness is *told* rather than
 guessing with a budget; a page that never signals fails by name and can no longer be mistaken for a
 measurement. Baseline before: four consecutive runs gave 4, 6, 1 and 4 failures, with the settle loop

package/scripts/added-reference-check.mjs

@@ -67,6 +67,34 @@ export const isProse = (path, line) => {
   return t.startsWith("//") || t.startsWith("*") || t.startsWith("/*");
 };
 
+// ── A COLOUR IS NOT A CITATION, AND THE DIGITS ALONE CANNOT SAY WHICH ───────────────────────────
+//
+// `TOKEN` matches digits only, so a six-digit hex colour is read as its leading digits and refused as a
+// reference. An earlier sweep acted on exactly that reading and rewrote sixteen colour literals as issue
+// text, two of them live mermaid `classDef` directives — so the documentation's diagrams rendered
+// broken, and thirteen comments stated a value that was no longer there. Restoring them then hit this
+// guard, whose refusal told the author to write the very text that had caused it.
+//
+// TWO RULES, and between them they settle every case without a table of exceptions:
+//
+//   1. A hex colour may contain a-f; an issue number is decimal. A token carrying a letter cannot be a
+//      reference whatever its length, and no reading of the digits is needed to know it.
+//   2. For the all-digit case — three digits is both a short colour and a plausible issue number — the
+//      SITE settles it: a value whose property is a colour is a colour. Same rule and the same property
+//      list as the guard in `driver/test/prompt-payload-names-no-tracker-issue.test.mjs`, which already
+//      plants both and requires them told apart.
+//
+// This does NOT widen to bare digits in prose. A reference in a comment is still refused, which is the
+// whole point of the check, and the arm asserts that direction too.
+const HEX_COLOUR = /#(?:[0-9a-fA-F]{8}|[0-9a-fA-F]{6}|[0-9a-fA-F]{3,4})\b/g;
+const COLOUR_PROPERTY = /(?:^|[;{\s(,])(?:color|background|background-color|border|border-color|fill|stroke|outline|box-shadow|text-shadow)\s*:\s*$/i;
+
+/** Strip hex colours, so what remains is only tokens that could be a reference. */
+export const withoutColourValues = (line) => String(line).replace(HEX_COLOUR, (m, offset, whole) => {
+  if (/[a-fA-F]/.test(m.slice(1))) return "";                              // letters ⇒ not a decimal number
+  return COLOUR_PROPERTY.test(whole.slice(0, offset)) ? "" : m;            // all digits ⇒ the property decides
+});
+
 /** Strip the spans where a `#NNN` is an address rather than a reference. */
 export const withoutLinkTargets = (line) => line
   .replace(/\]\([^)]*\)/g, "]()")                 // markdown link targets, anchors included
@@ -76,7 +104,7 @@ export const withoutLinkTargets = (line) => line
 /** Every offending token on one added line, or an empty array. */
 export const offendingTokens = (path, line) => {
   if (!isProse(path, line)) return [];
-  return [...withoutLinkTargets(line).matchAll(TOKEN)].map((m) => m[0]);
+  return [...withoutColourValues(withoutLinkTargets(line)).matchAll(TOKEN)].map((m) => m[0]);
 };
 
 const baseArg = () => {

package/scripts/authority-boundary-probe.mjs

@@ -3,7 +3,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // authority-boundary-probe.mjs — DOES THE CLI OBEY THE BOUNDARY, AND DOES THE RUN SURVIVE IT?
 //
-// 's acceptance, and the half of it CI structurally cannot reach: CI has no claude binary and no
+// That acceptance, and the half of it CI structurally cannot reach: CI has no claude binary and no
 // subscription, so `node --test` can only prove the hook DECIDES correctly. Whether `claude -p` HONOURS
 // the decision — and whether the turn carries on afterwards instead of dying — is a property of the live
 // CLI, and the only honest way to know it is to ask the live CLI.

package/scripts/backfill-started-at.mjs

@@ -38,7 +38,7 @@ const WORKSPACE_ROOT = argValue("--workspace-root") ?? envFrom(process.env, "CLE
 // The default is the CANONICAL agent alone. It used to name two of this firm's people, which shipped
 // their identities to every clone and told an installer nothing. Per-agent rosters are a
 // property of a deployment, so they are passed: --agents a,b,c
-const AGENTS = (argValue("--agents") ?? "clawdi").split(",").map((s) => s.trim()).filter(Boolean);
+const AGENTS = (argValue("--agents") ?? "localagent").split(",").map((s) => s.trim()).filter(Boolean);
 const APPLY = process.argv.includes("--apply");
 
 function argValue(flag) {

package/scripts/citation-line-check.mjs

@@ -31,12 +31,15 @@
 // That last paragraph prints on every run, including a clean one, because a guard whose "clean" is
 // near-meaningless and does not say so is worse than no guard: its presence reads as coverage.
 //
-// The remedy is the convention, not this script — CONTRIBUTING.md, "Cite the SYMBOL, not the line
-// number". A symbol survives every move; a number survives none. This guard cannot enforce that (the
+// The remedy is the convention, not this script — ADR-0005, "Cite the symbol, not the line": a symbol
+// survives every move and a number survives none, and where the target is not a named symbol, quote a few
+// words of it. This used to name CONTRIBUTING.md, which contains no such section — that record says in as
+// many words that it SUPERSEDES CONTRIBUTING's instruction, so the pointer was to the superseded half. This guard cannot enforce that (the
 // ruling explicitly declines a form guard without an allowlist for the ~800 existing citations), so it
 // holds the decidable perimeter and names the gap.
 
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
+import { execFileSync } from "node:child_process";   // — the ratchet reads a range; injected in tests
 import { fileURLToPath } from "node:url";
 import { join, dirname, basename } from "node:path";
 
@@ -102,7 +105,7 @@ const exemptTarget = (t) => EXEMPT_TARGETS.find((e) => e.target.test(t)) ?? null
  * A citation this checker CANNOT resolve and a human has adjudicated anyway. One rule for every member:
  * the entry names the citing FILE and the cited BASENAME, and it carries the reason resolution is
  * impossible rather than merely hard. Anything ambiguous and undeclared FAILS the run — the bucket is
- * not a backlog to hide in, which is what it was until 's second pass emptied it.
+ * not a backlog to hide in, which is what it was until the second pass emptied it.
  *
  * `citation-line-check.test.mjs` asserts every entry is REACHED — that it still matches a live ambiguous
  * citation — not merely that its regex is well formed. That distinction is the defect this pass found in
@@ -156,7 +159,7 @@ export function indexByBasename(files) {
  *
  * "ambiguous" is a finding AND an error: a citation reading `SKILL.md:41` names fifteen possible files in
  * this tree, so nothing here can judge it and nothing here ever did. That was its whole defect. Since
- * 's second pass the population is empty apart from AMBIGUOUS_DECLARED, and an undeclared one fails.
+ * That second pass the population is empty apart from AMBIGUOUS_DECLARED, and an undeclared one fails.
  */
 export function resolveCited(cited, byBase, exists = (p) => existsSync(join(ROOT, p))) {
   if (exists(cited)) return { state: "exact", path: cited };
@@ -370,6 +373,41 @@ function main() {
   // — the no-symbol slice: a cited span that is entirely blank or brace-only.
   const { misses: blankTarget, unshipped: blankUnshipped } = structuralMisses(citations, readLines);
 
+  // ── `--ratchet`: refuse a NEW citation that carries a line number and no symbol ────────────────────
+  //
+  // Separate mode rather than folded into the default run, because it answers about a RANGE and the rest
+  // of this script answers about the tree. Mixing them would make one exit code stand for two questions.
+  if (process.argv.includes("--ratchet")) {
+    const i = process.argv.indexOf("--base");
+    const base = i >= 0 ? process.argv[i + 1] : "origin/main";
+    const { error, lines } = addedLinesSince(base);
+    if (error) {
+      // A RANGE THAT COULD NOT BE READ IS NOT A RANGE THAT ADDED NOTHING, and 2 keeps the two apart —
+      // 1 already means "found something" here.
+      console.error(`${GUARD} --ratchet: ${error}`);
+      console.error("  That is this check failing to look, not a clean range. Nothing was judged.");
+      process.exit(2);
+    }
+    const bare = newBareCitations(lines);
+    console.log(`${GUARD} --ratchet: ${lines.length} added line(s) against ${base}, ${bare.length} new bare citation(s)`);
+    for (const b of bare) console.log(`  ${b.file}:${b.line}  cites ${b.cited}:${b.start} with no symbol\n    ${b.text.slice(0, 110)}`);
+    if (bare.length) {
+      console.error("\nA citation carrying a line number and no symbol is checked for EXISTENCE and nothing");
+      console.error("else, so it drifts onto a different real line and every test here still passes.");
+      console.error("");
+      console.error("The documented form (ADR-0005) carries no line number at all:");
+      console.error("    `toolGroupsForStage()` in `gather-config.mjs`");
+      console.error("Where the target is not a named symbol, quote a few words of it. A line number is also");
+      console.error("accepted when a bare identifier sits directly beside it — `pipeline.mjs:875 recordsFromSearch`");
+      console.error("— because that one this script can check. Backticks around the symbol are NOT stepped over,");
+      console.error("so a line number with a backticked symbol still reads as bare.");
+      console.error("");
+      console.error("The existing corpus is not your problem: this judges only what the range ADDS.");
+      process.exit(1);
+    }
+    process.exit(0);
+  }
+
   if (process.argv.includes("--json")) {
     console.log(JSON.stringify({
       files: corpus.length, citations: citations.length, resolved: resolved.length,
@@ -595,6 +633,87 @@ const CALLS = /^\s*\(/;
 const OWN_NUMBER = /^\s*(?:at\s+\d|:\d)/;
 
 /** The symbol-shaped tokens adjoining a citation, in BOTH grammars: `cite SYM` and `SYM (cite)`. PURE. */
+// ── THE RATCHET: A NEWLY ADDED CITATION CARRIES A SYMBOL (tracker issue 125) ────────────────────────
+//
+// The blindness above is not closeable on the existing corpus. Of the line citations in this tree only a
+// minority name a symbol beside the number, and the rest are checked for EXISTENCE and nothing more — a
+// citation that drifted onto a different real line reads as correct to every test here. Repointing them by
+// hand is not the repair: the two hand measurements recorded in BLINDNESS both found wrong lines
+// introduced by exactly that kind of pass.
+//
+// So this closes the class GOING FORWARD, at the only moment the correct symbol is cheap to write — when
+// the author still knows what they meant. Same shape as the catalogue and release-note ratchets: the
+// existing population is left to convert by attrition, and the number that must not grow is the number of
+// citations nothing can check.
+//
+// WHAT IS REFUSED IS NARROW, and the two questions the issue left open are answered here rather than
+// assumed:
+//
+//   · a line number WITH a symbol is fine. The symbol is what makes it checkable, and `symbolClaims`
+//     above already verifies it; forbidding the number as well would be stricter than the harm.
+//   · a citation with NO line number is fine, symbol or not. It cannot go stale from an edit above it,
+//     which is the whole failure. This is also the answer for a data file, a fixture or a generated
+//     table, where there is no symbol to name — cite the file, leave the line off.
+//
+// Refused, therefore, is exactly one shape: a NEW citation carrying a line number and no symbol.
+//
+// PURE, and the added lines are injected, so a test drives it without a git repository — a ratchet that
+// can only run against the real tree cannot be shown to fail.
+// THE RULE'S OWN DEFINITION IS EXEMPT, AND NAMED RATHER THAN PATTERN-MATCHED. Its specimens are bare
+// citations on purpose — a test that cannot write the shape it refuses cannot exercise it — so scanning it
+// puts the guard's own examples into the population it polices, and the ratchet refuses its own arrival.
+// Caught by driving the check against a range containing it, not by review.
+//
+// The cost of naming a file is that a REAL bare citation added there also escapes. That is the same trade
+// the reference-strip signatures make for the same reason, and it is preferable to a pattern, which would
+// quietly widen to files nobody considered.
+export const RATCHET_EXEMPT = ["driver/test/a-new-citation-carries-something-that-can-be-checked.test.mjs"];
+
+export function newBareCitations(addedLines) {
+  const out = [];
+  for (const { file, line, text } of addedLines ?? []) {
+    if (RATCHET_EXEMPT.includes(file)) continue;
+    for (const m of String(text ?? "").matchAll(CITE_RE)) {
+      // The same discriminator the corpus scan uses: a second `:number` closing a paren is a V8 stack
+      // frame, not a citation. Reading them as citations would refuse a fixture that captured a trace.
+      if (/^:\d+\)/.test(String(text).slice(m.index + m[0].length))) continue;
+      if (symbolsBeside(String(text), m.index, m[0].length).length > 0) continue;
+      out.push({ file, line, cited: m[1], start: Number(m[2]), text: String(text).trim() });
+    }
+  }
+  return out;
+}
+
+/**
+ * The lines a range ADDS, as `{ file, line, text }`. `run` is injected for the same reason as above.
+ *
+ * `--unified=0` so context lines are not read as additions — with context, every citation near an edit
+ * would be reported as new and the ratchet would refuse changes that added nothing.
+ */
+export function addedLinesSince(base = "origin/main", run = null) {
+  const exec = run ?? ((...a) => execFileSync("git", ["-C", ROOT, ...a], { encoding: "utf8", maxBuffer: 1e9 }));
+  let diff;
+  try { diff = exec("diff", "--unified=0", "--no-color", `${base}...HEAD`); }
+  catch (e) {
+    // A range that could not be read is not a range that added nothing, and the caller must not confuse them.
+    return { error: `could not diff ${base}...HEAD (${String(e?.message ?? e).split("\n")[0].slice(0, 90)})`, lines: [] };
+  }
+  const lines = [];
+  let file = null, next = 0;
+  for (const raw of diff.split("\n")) {
+    // The two file headers git writes, matched in full rather than by a "+++" prefix. An added line
+    // beginning with "++" arrives here as "+++...", so a prefix test drops it AND numbers every line
+    // after it in the hunk one low, because the line it skipped never advanced the counter. Both
+    // forms are exact: a deletion's header is the bare string, with no path and no timestamp.
+    if (raw.startsWith("+++ b/")) { file = raw.slice(6); continue; }
+    if (raw === "+++ /dev/null") { file = null; continue; }
+    const h = raw.match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/);
+    if (h) { next = Number(h[1]); continue; }
+    if (raw.startsWith("+")) { lines.push({ file, line: next++, text: raw.slice(1) }); }
+  }
+  return { error: null, lines };
+}
+
 export function symbolsBeside(line, index, length) {
   const after = String(line).slice(index + length).replace(SEP_AFTER, "");
   const am = after.match(/^[A-Za-z_$][A-Za-z0-9_$]*/);
@@ -702,7 +821,7 @@ export function symbolMisses(citations, readLines) {
 // are ranges that open on a blank line and then carry exactly the content they promise. Requiring EVERY
 // line of the span to be empty drops both WITHOUT an exemption, and leaves no false positive to exempt.
 // That matters more than the two rows: an exemption list here would be keyed on "this citation looks
-// like prose about citations", which is the shape that hid 's drift inside its own carve-out.
+// like prose about citations", which is the shape that hid the drift inside its own carve-out.
 //
 // WHAT IT CANNOT SEE, and why this stays a slice. A citation that lands on the WRONG NON-BLANK LINE is
 // invisible to it — that looks identical to a correct one. Three of the eleven citations repointed in

package/scripts/compare.mjs

@@ -83,7 +83,7 @@ const CONFIG_PARITY = {
 };
 
 // ── what these five deliberately do not reach ────────────────────────────────────────────────────────
-// Recorded as not covered, never silently absent — 's own instruction.
+// Recorded as not covered, never silently absent — its own instruction.
 const NOT_COVERED = [
   "common law in a country that has none — Switzerland has no common-law rights system and none of the five points there, so the engine's behaviour when the grid has nothing to search is unexercised",
   "the deliverable step — the client-format document produced at the lawyer's agent is outside tracker #462 and no scenario reaches it",
@@ -212,7 +212,7 @@ function findingTerritories(f) {
 }
 
 /**
- * 's classification, on the frozen register plan: is a query THIS territory's own deep-dive, one
+ * That classification, on the frozen register plan: is a query THIS territory's own deep-dive, one
  * that merely reaches it, or one restricted to nowhere?
  *
  * "Per-jurisdiction is not narrower than the scope. It is a query that names ONE territory and no

package/scripts/contract-dictation-scan.mjs

@@ -7,7 +7,7 @@
 // that touches disk, and it exists so the planted-divergence test can hand the checker an invented
 // file instead of writing one into the tree.
 //
-// THE CORPUS IS DISCOVERED, NEVER ENUMERATED, and that is 's hardest requirement rather than a
+// THE CORPUS IS DISCOVERED, NEVER ENUMERATED, and that is the hardest requirement rather than a
 // preference: "plant a divergence in a NEW authoring layer — the check must find it structurally, not
 // because the layer was enumerated." So the corpus is every tracked `.mjs` and `.md` under `driver/`,
 // full stop. A new dispatch module, a new skill file, a seventh authoring surface nobody has thought
@@ -15,7 +15,7 @@
 //
 // `git ls-files`, via shared/tracked-files.mjs, because a directory walk lists a different set (build
 // output, an editor backup, a contributor's scratch file) and because a guard that cannot see its
-// corpus must SAY SO rather than report a clean zero. 's lesson, and CLAUDE.md's hard rule: an
+// corpus must SAY SO rather than report a clean zero. That lesson, and CLAUDE.md's hard rule: an
 // absence is a finding.
 //
 //   node scripts/contract-dictation-scan.mjs           report; exit 1 on any divergence

package/scripts/dead-names.mjs

@@ -45,7 +45,7 @@ export const GUARD = "dead-names (#853)";
 // `clawdi-lisa` and `clawdi-lidia` are 's, not 's, and they are here rather than in a second
 // scanner because the mechanism is identical: a name that must never reappear. They were per-person
 // agent identities for individuals at this firm, shipped in an operator script's default roster, in a
-// systemd unit watching their queues, and in two test fixtures. 's out-of-scope note ruled `alex`
+// systemd unit watching their queues, and in two test fixtures. That out-of-scope note ruled `alex`
 // and `sam` INVENTED, which is why those stay; these two were never covered by that ruling.
 export const DEAD_NAME_RE = /lorestar|lore_(pool|url|flags)|prelim_lore|lorectl|loreurl|lorecontrols|trademark-lore|\blore\b|\baughra|clawdi-(lisa|lidia)/i;
 

package/scripts/drain-preflight.mjs

@@ -5,7 +5,7 @@
 //
 // The question came from the codex round (18 Aug): an engine override is carried by the DRIVER
 // ACTIVATION's environment, and an activation that never happens carries no environment. On the box this
-// was first asked about, no runner process was running for any user and no prelim unit existed at system
+// was first asked about, no runner process was running for any user and no clearotron unit existed at system
 // level — so every job enqueued would have sat there, and the round would have been fiction.
 //
 // Nothing here builds a drainer. ONE ALREADY SHIPS: `driver/systemd/prelim-driver.path` (inotify),
@@ -29,7 +29,7 @@
 
 import { spawnSync } from "node:child_process";
 import { readFileSync, existsSync, readdirSync, statSync } from "node:fs";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { join, dirname } from "node:path";
 import { homedir, userInfo } from "node:os";
 import { isEntrypoint } from "../shared/is-entrypoint.mjs";   // — one entry-point test, all spellings
@@ -132,7 +132,7 @@ export function watchedQueueDirs(unitText, home) {
     //
     // Reading the list without the reset is wrong in BOTH directions — it keeps globs the deployment
     // has disowned, and (because the caller then compares against a superset) it can report a directory
-    // as watched that nothing watches. The second is 's original harm, produced by the guard built
+    // as watched that nothing watches. The second is the original harm, produced by the guard built
     // to prevent it.
     if (!m[1].trim()) { out.length = 0; continue; }
     // EXTENSION-AGNOSTIC. The queue watcher globs `*.json` and the outbox watcher globs `*.pending`;
@@ -223,7 +223,7 @@ export function runnerRunning() {
   return { known: true, procs };
 }
 
-// ── THE OUTBOX IS THE SAME HAZARD, ONE LANE OVER ('s tail) ───────────────────────────────────────
+// ── THE OUTBOX IS THE SAME HAZARD, ONE LANE OVER (the tail) ───────────────────────────────────────
 //
 // `prelim-outbox.path` carries the identical literal glob and says so in its own header: "this literal
 // and the driver's `config.outboxDir` are two spellings of one fact with nothing checking them against
@@ -244,7 +244,7 @@ export async function preflight({ home = homedir(), root = ROOT } = {}) {
   const unitPath = join(root, "driver", "systemd", "prelim-driver.path");
   const unitText = existsSync(unitPath) ? readFileSync(unitPath, "utf8") : null;
 
-  const { config } = await import(join(root, "driver", "driver.config.mjs"));
+  const { config } = await import(pathToFileURL(join(root, "driver", "driver.config.mjs")).href);
   const queueDirs = config.queueDirs ?? [];
   const watched = unitText == null ? null : watchedQueueDirs(unitText, home);
 

package/scripts/e2e-unread-terminals.mjs

@@ -39,7 +39,7 @@ import { readFileSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
 // The seat-record reader, imported rather than re-derived: "does this run have work in it" must be the
-// SAME question the retry instrument asks, or two tools disagree about one fact (,).
+// SAME question the retry instrument asks, or two tools disagree about one fact ().
 import { dispatchRows } from "../driver/seat-attempts.mjs";
 import { isEntrypoint } from "../shared/is-entrypoint.mjs";   // — realpath both sides, or a symlinked invocation exits 0 silently
 

package/scripts/e2e.mjs

@@ -44,7 +44,7 @@ import { mcpToolCall } from "../driver/portal-mcp-client.mjs";
 // resolve the depth the same way every other door does — never from a word the scenario file typed.
 import { reportIdentityFor, ORDERABLE_PRODUCTS, RETIRED_PRODUCTS } from "../driver/search-policy.mjs";
 // The queue's filename vocabulary, from the module that owns it. created that module because the
-// vocabulary "has now been written down three times and the copies disagreed"; 's first draft wrote it
+// vocabulary "has now been written down three times and the copies disagreed"; the first draft wrote it
 // down twice more here, from memory, and false-alarmed on every prose sidecar of every live job. Sourced,
 // so the next suffix the engine adds reaches this harness the day it lands. queue-markers.mjs is PURE —
 // importing it pulls in nothing, which is why this file can have it and cannot have runner.mjs (that chain
@@ -57,10 +57,10 @@ import { isLiveQueueMarker, isQueueSidecar, liveQueueState, LIVE_QUEUE_STATES, T
 // leave the real one to park tomorrow's re-run as a duplicate. usage-ledger.mjs is a pure leaf too
 // (node:fs + node:path + queue-markers.mjs), so it drags no driver machinery in either.
 import { matterLedgerPath } from "../driver/usage-ledger.mjs";
-import { probeWorker } from "../driver/queue-watch-probe.mjs";   // tracker issue 181 — the drain this deployment actually has
+import { probeWorker } from "../driver/queue-watch-probe.mjs";   // the drain this deployment actually has
 // Teardown asks whether a process is actually producing a run before it rewrites the record that says so.
 import { claimLivenessForCodename, claimForbidsDestruction } from "../driver/claim-liveness.mjs";
-// The store admission sweep (, moved here from a bundled-store CI test when the bundled scenarios
+// The store admission sweep (moved here from a bundled-store CI test when the bundled scenarios
 // were deleted): every job block in the configured store must be treated by the doors exactly the way
 // its scenario declares, and the check has to run where the store exists — CI cannot read it.
 import { validateJob } from "../driver/enqueue-schema.mjs";
@@ -82,7 +82,7 @@ import { readReceipt, appendRound, stampRound, tokenFromRef, roundsFromRuns, mer
   roundLetters, receiptPath, scenarioRefs as scenarioRefsOf, findRunsByRef as findRunsIn,
   SCENARIO_FILE, byScenarioNumber, tierOf, SCENARIO_TIERS, DEFAULT_TIER }
   from "../driver/e2e-rounds.mjs";
-// 's refusal — "is this data plane production" — sourced, because this file used to restate it and
+// That refusal — "is this data plane production" — sourced, because this file used to restate it and
 // the two copies had ALREADY drifted, in both directions:
 //   CLEAROTRON_REPORTS_DIR=/srv/trademark-archive-dev  the guard passes (it matches the archive as a path
 //     PREFIX, and its own test requires that a name merely resembling production's passes). The copy
@@ -403,7 +403,7 @@ export function lintScenarios(scenarios) {
     //
     // Deliberately here rather than at a selection site, because that is what gets the SCOPE right for
     // nothing: `sweepStoreOrDie()` bare (cmdList) refuses on any scenario's finding, and
-    // `sweepStoreOrDie(id)` (cmdRun) refuses only on the named scenario's — 's split, already
+    // `sweepStoreOrDie(id)` (cmdRun) refuses only on the named scenario's — the split, already
     // implemented at the two call sites. A round that selects BY tier has to read every tier to choose,
     // so a typo anywhere corrupts the selection rather than one entry; a run that named its scenario is
     // answerable only for that one. Both fall out of where this line sits.
@@ -886,7 +886,7 @@ function enqueueViaCli(job) {
   } finally { rmSync(dir, { recursive: true, force: true }); }
 }
 
-// EXPORTED for 's arm: the not-configured branch is the whole subject, and the only honest way to
+// EXPORTED for the arm: the not-configured branch is the whole subject, and the only honest way to
 // drive it is to call this function in a process with no MCP port in scope — the state a rebuilt box
 // is actually in. Asserting on the source text instead would pass on a file that no longer runs it.
 export async function enqueueViaMcp(job, { clientPrincipal = false, forwarder = null } = {}) {
@@ -894,7 +894,7 @@ export async function enqueueViaMcp(job, { clientPrincipal = false, forwarder =
   // refusing one. A door that is not configured on this deployment never saw the job, so it holds no
   // opinion about it: recording it as a refusal manufactures agreement on the refusal cases (a
   // correctly-refusing door and an absent one produce the same line) and, on the admit cases, fires
-  // #98's "the one that ACCEPTED is the defect" at the door that behaved. This is 's rule reaching
+  // the "the one that ACCEPTED is the defect" rule at the door that behaved. This is that rule reaching
   // the one transport failure that happens BEFORE any request: not-configured is could-not-ask.
   if (!MCP_URL) return { ok: false, transport: true, status: null,
     out: "no TRADEMARK_MCP_HTTP_PORT in scope — this door is not configured on this deployment, so it was never asked" };
@@ -1601,7 +1601,7 @@ function queueDrainState({
 // THREE STATES, NOT TWO, and the third is the reason this is a function rather than a field read.
 // A scenario that states nothing must read as CANNOT TELL — never as synthetic, and never as silence.
 // Defaulting an absent label to "synthetic" would be a guess presented as a fact, and letting it print
-// nothing is 's defect exactly: a benchmark that printed only when the key was present rendered as
+// nothing is the defect exactly: a benchmark that printed only when the key was present rendered as
 // silence, which reads exactly like a benchmark that was met. An unstated label is reported, every time.
 export const MARK_PROVENANCE = { LIVE: "live", SYNTHETIC: "synthetic", UNSTATED: "unstated" };
 

package/scripts/env-audit.mjs

@@ -10,7 +10,7 @@
 // ── why this exists ──────────────────────────────────────────────────────────────────────────────
 //
 // `docs/architecture/05-config-governance.md` states its own maintenance rule: "adding a var anywhere
-// in the repo means adding its row here". 's review found that rule has NO enforcement — the
+// in the repo means adding its row here". That review found that rule has NO enforcement — the
 // placeholder-default guard checks fallbacks, not existence — so it has been prose since it was
 // written, and the surface has grown the whole time.
 //
@@ -36,7 +36,7 @@
 //
 // ── what it deliberately does not do ─────────────────────────────────────────────────────────────
 //
-// It deletes nothing. 's tier 2 (delete the dead) is explicitly not this, and the issue's own
+// It deletes nothing. That tier 2 (delete the dead) is explicitly not this, and the issue's own
 // queue note says deleting toggles mid-verification moves the range again. This reports; a person
 // decides.
 
@@ -108,7 +108,7 @@ const CODE_RE = /\.(mjs|js|cjs|ts)$/;
 // above describes happening again. Converting the eight numeric getters from
 // `Number(this.envValue("NAME") || d)` to `numericSetting("NAME")` moved the name out of a shape this
 // scanner knew and into one it did not: the audit stopped seeing CLEAROTRON_MAX_CLAIM_AGE_MS and
-// CLEAROTRON_CARD_CONCURRENCY, whose ONLY reads are accessor reads, and 's product-read arm went red.
+// CLEAROTRON_CARD_CONCURRENCY, whose ONLY reads are accessor reads, and the product-read arm went red.
 // It went red because that arm names those two variables — which is the whole reason it names them. A
 // conversion narrows this guard silently, so both spellings land in the same commit as the conversion.
 const ACCESSOR_RE = /\b(?:envValue|envOn|envGateOn|numericSetting|resolveNumericSetting)\s*\(\s*["']([A-Z][A-Z0-9_]*)["']|\benvFrom\s*\(\s*[^,()]+,\s*["']([A-Z][A-Z0-9_]*)["']/g;
@@ -154,7 +154,7 @@ const stripCommentLines = (text) => text.split("\n").filter((l) => !COMMENT_LINE
 // — no `env`-prefixed regex can match a read where the name never appears beside an `env` token.
 //
 // THE BINDING IS SCREAMING_CASE AND THE LITERAL IS ENV-SHAPED, both required. `const label = "x"` is
-// not an env binding, and neither is `const PREFIX = "prelim-"`. The pair is what makes this a
+// not an env binding, and neither is `const PREFIX = "clearotron-"`. The pair is what makes this a
 // declaration of an environment name rather than a string that happens to be uppercase.
 const BINDING_RE = /(?<![.\w$])const\s+([A-Z][A-Z0-9_]*)\s*=\s*["']([A-Z][A-Z0-9_]{2,})["']/g;
 
@@ -230,7 +230,7 @@ export const SYSTEM_OWNED = new Set([
   // — both arrived with the injected-`env` widening above, and both are set by the service
   // manager rather than by any deployment of this product: systemd sets INVOCATION_ID (which is
   // exactly what shared/env-local.mjs reads it to detect), and the session bus sets
-  // DBUS_SESSION_BUS_ADDRESS. 's body asserts the audit already excluded these two. It did not —
+  // DBUS_SESSION_BUS_ADDRESS. That body asserts the audit already excluded these two. It did not —
   // they were absent from this list, and they only stayed out of the register because the scanner
   // could not see the reads at all.
   "INVOCATION_ID", "DBUS_SESSION_BUS_ADDRESS",
@@ -520,7 +520,7 @@ export function auditEnv(root = ROOT) {
 //                         1  CLEAROTRON_SEND_TOOL_PREFIX — genuinely dead, and this direction does not
 //                            catch it either: its one surviving mention is a governance-doc line, and
 //                            a mention is enough to spare a row. Under-firing is the cost of the
-//                            trade, taken deliberately. It is 's prose-sweep class.
+//                            trade, taken deliberately. It is the prose-sweep class.
 //
 //                       So SIX of ten deletions would have been wrong, two of them credential rows.
 //                       Evidence used instead: the bare NAME, on a name boundary, anywhere in the
@@ -639,7 +639,7 @@ export function orphanRows(rows, mentioned) {
 }
 
 // The catalogues describe the contract; they are not readers of it. Include them and every row is its
-// own evidence, which is the circularity 's "a check cannot use its own source as evidence" names.
+// own evidence, which is the circularity the "a check cannot use its own source as evidence" names.
 // — `docs/architecture/env-set-in-production.txt` joins them, and the reason is the rule this set
 // exists for. It is a LIST OF NAMES, committed as step 1's production evidence because a reviewer cannot
 // make that read. Left in the corpus it becomes an alibi for every catalogue row at once: each row