clearotron 0.2.1 → 0.2.3

package/docs/DELIVERY.md

@@ -53,7 +53,9 @@ both forms as defence.
 | `msgId` | string | thread with `In-Reply-To:` on the email |
 | `subject` | string | on a clearance, `<the product's own name> — <mark>` (`deliverySubject`, e.g. `Global preliminary search — NOVAPULSE`; the mark falls back to `ref`, then `matter`). On a knockout, `Knockout trademark review — <ref> (N marks)` |
 | `emailBodyHtml` | string | the FULL email body, one self-contained inline-HTML fragment — send **verbatim**, do not re-encode; report + audit links are already inside |
-| `whatsappTo` | string \| null | optional chat recipient |
+| `whatsappTo` | string \| null | the chat recipient: **the person who requested the run**, when a number is held for them. `null` when none is — see `whatsappToReason` |
+| `whatsappToReason` | string \| null | why `whatsappTo` is null. Present only when it is. The packet states the gap rather than quietly routing the notice somewhere else |
+| `whatsappCcOperator` | string \| null | the operator's own copy of the same notice, from the agent roster. `null` when the deployment has switched it off. Independent of `whatsappTo`: either, both or neither may be present |
 | `whatsappText` | string | ready-to-send completion line (includes every report URL) |
 | `url` | string \| null | the run's published report URL — **null for a multi-name knockout**, which has no single report. See below |
 | `reports` | `[{mark, url}]` | one entry per published document, one per name. Written by the KNOCKOUT lane only — **absent** on a clearance packet, whose single document is`url` |
@@ -145,7 +147,9 @@ The filesystem loop below remains equivalent for integrators that do have data-p
    for `state: "delivered", sendPending: true` (backstop).
 2. **Send**: for `delivered`, email `emailBodyHtml` verbatim to the requester behind
    `forwarder`/`forwarderEmail`, `Subject:` = `subject`, `In-Reply-To:` = `msgId`; optionally
-   chat `whatsappText` to `whatsappTo`. For every other kind, `text` is ready to route as-is.
+   chat `whatsappText` to `whatsappTo` and, separately, to `whatsappCcOperator` when present. A null
+   `whatsappTo` with a `whatsappToReason` means nobody is reachable for that requester — surface it, do
+   not redirect the notice to the operator instead. For every other kind, `text` is ready to route as-is.
 3. **Write back**: create a `.sent` marker in the (archived) run dir after a successful send —
    the idempotency guard that prevents double-sends if markers fire twice. Then clear the
    consumed `.pending` files. The MCP verb writes it as JSON

package/docs/E2E.md

@@ -45,7 +45,7 @@ CLEAROTRON_DATABASE=corsearch                      # REQUIRED, no default (track
 CORSEARCH_SESSION_KEY=dev-offline                       # the credential preflight wants it set; never fetches under the mock
 CLEAROTRON_SATPROBE_CODESIDE=0                              # the probe dials the provider; a mock run cannot
 CLEAROTRON_BAND_TRUTH_GATE=0                                # the gate evidences bands against the production call ledger
-CLEAROTRON_CUSTOMERS_DIR=                                    # unset ⇒ the in-repo demo customers (aurora/zephyr/petcary)
+CLEAROTRON_CUSTOMERS_DIR=                                    # unset ⇒ the demo customer bundled with the repo
 # MCP face (optional): TRADEMARK_MCP_DEV=1 TRADEMARK_MCP_AUTH_DISABLED=1 + loopback host + an ABSOLUTE
 #   CLEAROTRON_ACCESS_FILE=/abs/path/grants.json. All four, or it refuses to start: with auth off and no
 #   grants file every token-less caller resolves to internal read-all across every customer.
@@ -59,8 +59,8 @@ and the refusal prints the absolute path to write.
 Drive one run through the whole spine by hand:
 
 ```bash
-node driver/enqueue.mjs --mark "AURORA PROBE" --classes 9,41 --goods "game software" \
-  --forwarder ops --profile aurora
+node driver/enqueue.mjs --mark "NORTHWIND PROBE" --classes 9,41 --goods "water-quality monitoring software" \
+  --forwarder ops --profile demo-brand-owner
 node driver/runner.mjs            # claims, runs all stages on the mock, publishes, writes the packets
 ls /home/you/trademark-dev/outbox # → <runId>.pending (+ failure/intake packets on the sad paths)
 cat <archived run>/_driver/delivery.json
@@ -75,7 +75,7 @@ outbox packet kind — on a real filesystem with real process boundaries, for fr
 this, from a clean `env -i` shell: enqueue → runner → `DELIVERED (verdict CLEAR)` → archived run dir
 + `<runId>.pending` outbox marker + `_driver/delivery.json` (runId, forwarder, subject,
 `emailBodyHtml`, url, verdict — no profile field; that is `_driver/profile.json` beside it, the run's
-frozen `aurora` demo profile, and the file to open to prove which profile resolved).
+frozen demo profile, and the file to open to prove which profile resolved).
 
 ### Tier 1b — the UI PORTAL (browse the dev instance; develop UI features against it)
 
@@ -105,7 +105,7 @@ so a dev instance beside a live one must be given its own (`PORTAL_PORT`, `PROFI
 silently — each is a proxy to a port, and the port is all it knows. `/recipes/*` is the worse half:
 its save endpoint writes and git-commits into whichever recipe store it reached.
 
-A pass here looks like: index, run report, the aurora customer page and the profile-editor UI all
+A pass here looks like: index, run report, the demo customer page and the profile-editor UI all
 render against the Tier-1 pool; the `/profiles/*` proxy round-trips; traversal and non-loopback binds
 are refused (unit-tested).
 

package/docs/PORTAL.md

@@ -133,14 +133,14 @@ rather than quietly opening a passphrase door instead; and local mode refuses a
 `PORTAL_SERVICE_HOST`, because off loopback the passphrase and the session cookie are on the wire in
 clear. Put a TLS-terminating proxy in front if it has to be reachable.
 
-Grants fixture: `{"tenants":{"demo":{"accounts":["aurora"],"users":{"cli@celta.example":["aurora"]}}}}`.
+Grants fixture: `{"tenants":{"demo":{"accounts":["foxglade"],"users":{"cli@celta.example":["foxglade"]}}}}`.
 
 The trigger lane needs the MCP HTTP face and an accounts-scoped ops token; without both, the run step
 reports the trigger lane unwired and the plan step still works. **The face no longer has to be run in
 its dev bypass to provide that**:`TRADEMARK_MCP_AUTH_MODE=token` runs it with a mandatory scoped
 access key and no auth proxy — loopback only, and refused outright alongside
 `TRADEMARK_MCP_AUTH_DISABLED`, which authenticates nobody. Mint the key with
-`mint-token.mjs --scope ops --sub portal --verbs start_run,stop_run --accounts aurora`, or let
+`mint-token.mjs --scope ops --sub portal --verbs start_run,stop_run --accounts foxglade`, or let
 `npx clearotron start` mint one in memory at every start and never write it down.
 
 ## Putting your own login provider in front

package/docs/README.md

@@ -76,10 +76,11 @@ The other half is structural: it fails on any undeclared identity inside a matte
 which is the half that catches something new. Without the private table the guard runs on synthetic
 sentinels: the machinery is exercised and there is nothing real to find.
 
-**Demo clients are synthetic.** A Generic default (`generic`) plus three inventions — `aurora`
-(gaming), `zephyr` (functional drinks), `petcary` (animal health). They exercise the per-client
-machinery and the test suite. Real client bundles load at runtime from a private store
-(`CLEAROTRON_CUSTOMERS_DIR`) and are never committed here.
+**Demo clients are synthetic.** The published package carries a Generic default (`generic`) and one
+demo brand owner. The repository holds three further invented accounts — gaming, functional drinks and
+animal health — which exercise the per-client machinery and the test suite and are never published.
+Real client bundles load at runtime from a private store (`CLEAROTRON_CUSTOMERS_DIR`) and are never
+committed here.
 
 **Real third-party names are deliberate.** Registers, marketplaces, regulators, research providers and
 the parties to published decisions are named throughout the code, tests and fixtures — as facts about

package/docs/SECURITY.md

@@ -39,6 +39,23 @@ Exactly two roles exist: **staff**, admitted by an email-domain rule (`PORTAL_ST
 created in the guest-list file by whoever administers the box — `npm run grant` is the editor for it —
 never from a browser. The file is re-read per request, so a grant lands without a restart.
 
+**A staff domain is a grant to everyone at that domain, so nothing derives one for you.** Every address
+at a listed domain that gets past the sign-in door is staff, and staff sees every brand owner on the
+instance. The install therefore derives `PORTAL_STAFF_DOMAINS` only from a sign-in address that names no
+second person — the `<account>@localhost` form a single-user machine gets by default. Given a real
+address it states the rule it would create, in the words the People & access screen will later use,
+and refuses to write it: set `PORTAL_STAFF_DOMAINS` yourself, or answer the question `clearotron install`
+asks. A webmail or shared provider is refused outright, because a rule built from one admits the public.
+The People & access screen names the setting the rule came from and the file it is written in, so a
+rule can be traced and undone by whoever finds it.
+
+**That check is on the DERIVATION, not on the value.** A `PORTAL_STAFF_DOMAINS` you set yourself is
+taken as written and never classified: `PORTAL_STAFF_DOMAINS=gmail.com` is accepted, and it admits
+everyone at that provider who gets past the sign-in door. This is deliberate — a value someone typed is
+a decision already taken, and the defect being fixed was a rule created with nobody asked — but it means
+the protection is against the accident and not against the configuration. Read what you set, or set
+nothing and answer the question the install asks.
+
 
 - **On the proxy door**, every HTTP request re-validates a JWT from the fronting auth proxy. The
   proxy is yours to choose — issuer, JWKS URL, claim and header are config

package/docs/architecture/01-product-overview.md

@@ -3,7 +3,7 @@
 > Part of the architecture pack (`docs/architecture/`). The driver's module tree and the headless
 > integrator contract are in [`driver/README.md`](../../driver/README.md).
 
-The prelim driver turns a plain-language clearance request into a delivered, lawyer-vetted
+The clearotron driver turns a plain-language clearance request into a delivered, lawyer-vetted
 preliminary trademark clearance report. One matter in, one decision out — with the investigation,
 the reasoning, the challenge, and the paper trail in between run by deterministic code that treats
 the model as a reasoning step, never as the orchestrator.
@@ -54,7 +54,7 @@ flowchart LR
     E -.- e2["Client's framework and format;<br/>lawyer vets, then it moves"]
 
     classDef phase fill:#1a3a5c,stroke:#4a90d9,color:#fff
-    classDef note fill:none,stroke:none,color:tracker issue 888,font-size:12px
+    classDef note fill:none,stroke:none,color:#888,font-size:12px
     class A,B,C,D,E phase
     class a2,b2,c2,d2,e2 note
 ```

package/docs/architecture/02-architecture.md

@@ -48,7 +48,7 @@ flowchart TB
         PL["Register-provider plugins<br/>(gateway-hosted tools)"]
     end
 
-    subgraph DRV["The product: prelim driver — plain Node, systemd, no agent sandbox"]
+    subgraph DRV["The product: clearotron driver — plain Node, systemd, no agent sandbox"]
         direction TB
         RUN["runner.mjs<br/>queue drain · claims · dedup · parks"]
         PIPE["pipeline.mjs<br/>stage sequence · gates · clamps · recovery"]
@@ -81,7 +81,7 @@ flowchart TB
     OB -. "wake" .-> AG
     POOL -.-> MCPQ
 
-    classDef product fill:tracker issue 12324f,stroke:#4a90d9,color:#fff
+    classDef product fill:#12324f,stroke:#4a90d9,color:#fff
     class DRV,RUN,PIPE,STG,GWM,ENG,SKL,PROF,PUB product
 ```
 

package/docs/architecture/04-configuration-reference.md

@@ -157,7 +157,7 @@ own declared `model`, or `axisTier(axis)` where it declares none (`register-unit
 — with the thinking tier `thinkingFor()` gives it. There is no fallback rung and no cross-provider tail.
 
 There used to be: a model-failover chain (same-family fallback, then `azure` and `gemini`) gated on a
-multi-provider engine. It is **deleted** (, 2026-08-03). It had never run — no stage ever declared
+multi-provider engine. It is **deleted** (2026-08-03). It had never run — no stage ever declared
 a fallback and the engine gate was never true — so it was dead machinery with a report-HTML block and a
 test attached. It was deleted rather than armed, because arming it means untested code firing for the
 first time in the middle of a production failure, and a silent mid-run model swap changes which model
@@ -188,8 +188,9 @@ deployment may override (verify live values per deployment).
 | Var | Default | Meaning |
 |---|---|---|
 | `CLEAROTRON_WORK_DIR` | `$HOME/trademark/workspace` | Root holding `workspace-<agent>/` (queues, run dirs). Same name as before, new default: it used to be an agent platform's own dot-directory, which README says in bold the engine does not require. Nothing to migrate — the variable's spelling did not change — but **a deployment that ran on the old default and does not pin this variable moves its run directories on upgrade**, and`driver/systemd/prelim-driver.path` / `prelim-outbox.path` hardcode absolute globs that no environment variable can reach (read the units — the literal is in them). Set it explicitly on every deployed box; the units' globs must name the same root. |
+| `CLEAROTRON_CHECKOUT_DIR` | the installed package root | Where the running code lives, and what the service units execute — every unit's `ExecStart` is `${CLEAROTRON_CHECKOUT_DIR}/…`. On a packaged install that is `<home>/app/node_modules/clearotron`, which is npm-owned and **replaced wholesale on upgrade**: an install deletes and recreates that tree, so anything kept inside it does not survive. This is why the settings file lives outside it. A running service holds its own copy of the deleted tree until restarted, so after an upgrade the units serve the OLD code until they are restarted deliberately — including any hand-made unit nobody remembered to restart. |
 | `CLEAROTRON_INSTRUCTIONS_DIR` | `<driver>/skills` | Compute-skills tree; the engine absolutizes `skills/…` refs against it and grants `--add-dir`. |
-| `CLEAROTRON_SKILLS_STORE_STRICT` | unset (warn) | Hard mode for the run door's doctrine-store check (,`driver/skills-store-provenance.mjs`). The door classifies the store `CLEAROTRON_INSTRUCTIONS_DIR` names into the publication gate's three outcomes — **pass**, **fail** (uncommitted changes under the served path, or a HEAD not contained in the main line), **blocked** (could not be determined: git absent, an unreadable ancestor, no main-line ref, or a store no commit tracks). A store affirmatively outside any checkout passes: the walk to the filesystem root must complete with every step readable, so "no git evidence" can never be inferred from a directory this process cannot see. Unset, a non-pass prints one `[preflight]` line to stderr and stamps a `skills-store` event into the run's `_driver/run.jsonl`, and the run proceeds. Set (`1`; `0`/`off`/`false`/`no`/empty do not arm it), any non-pass **refuses the run before any spend** — `blocked` included, because a store whose state nobody can name is not a store anybody can reproduce. |
+| `CLEAROTRON_SKILLS_STORE_STRICT` | unset (warn) | Hard mode for the run door's doctrine-store check (`driver/skills-store-provenance.mjs`). The door classifies the store `CLEAROTRON_INSTRUCTIONS_DIR` names into the publication gate's three outcomes — **pass**, **fail** (uncommitted changes under the served path, or a HEAD not contained in the main line), **blocked** (could not be determined: git absent, an unreadable ancestor, no main-line ref, or a store no commit tracks). A store affirmatively outside any checkout passes: the walk to the filesystem root must complete with every step readable, so "no git evidence" can never be inferred from a directory this process cannot see. Unset, a non-pass prints one `[preflight]` line to stderr and stamps a `skills-store` event into the run's `_driver/run.jsonl`, and the run proceeds. Set (`1`; `0`/`off`/`false`/`no`/empty do not arm it), any non-pass **refuses the run before any spend** — `blocked` included, because a store whose state nobody can name is not a store anybody can reproduce. |
 | `CLEAROTRON_SKILLS_STORE_MAIN_BRANCH` | `main` | Which branch name the check above treats as the main line. A deployment whose config store is on `master` sets this; otherwise that store has no main-line ref to be measured against and every run reports `blocked`. Only the branch name — the check prefers `origin/<name>` and falls back to the local ref. |
 | `CLEAROTRON_MIN_FREE_DISK_MB` | `500` | Free space the run door requires on the filesystem holding `CLEAROTRON_WORK_DIR`, in MB. Below it a run is **refused** before anything is written — a disk that fills mid-run surfaces as a *missing artifact* at some later stage, which is indistinguishable from an engine or provider fault. Not a sizing estimate: one real delivered run measured 5.85 MB, so 500 MB is the line below which the filesystem is in trouble for reasons of its own.`0` disables the check; a non-numeric value **throws** rather than silently disabling it. A disk that cannot be measured is reported and the run proceeds — never read as room. |
 | `CLEAROTRON_REPORTS_DIR` | **none — set it** | Publish pool (web-served). **No default since: unset refuses and names the variable.** It read`/srv/trademark-archive` — a deployed server's real client archive — so a forgotten export published into somebody else's matter, and two entry points already carried hand-written defences against exactly that (`bin/onboard.mjs`, `bin/example.mjs`). Same shape as `CLEAROTRON_DATABASE` and `scripts/purge-runs.mjs`: guessing wrong is expensive, so it does not guess. Read-only surfaces (flag snapshot, status page, MCP options) degrade to "no pool" instead of throwing; anything that writes refuses. `driver/production-pool-guard.mjs` still names `/srv/trademark-archive` on purpose — that constant is a fact about where the archive is, not a default. |
@@ -276,16 +277,20 @@ of truncations.
 ### Surfaces beside the driver — portal, demo, e2e harness
 
 These are read by code that ships in this repository but is not a clearance stage. They are here
-because 's rule is about what PRODUCT CODE reads, not about what a run reads.
+because the rule is about what PRODUCT CODE reads, not about what a run reads.
 
 | Var | Default | Meaning |
 |---|---|---|
 | `DEMO_PORT` | `18900` | Port `npx clearotron demo` serves the replayed report on. `--port` overrides it. |
 | `CLEAROTRON_DEMO` | unset | `1` puts this install in the DEMO posture. **Ordering is real**: the four products are listed and orderable, the form, the plan and the confirmation are the product's own, and the confirmation resolves to a finished report that already exists rather than dispatching — no engine turn, no register call, no queue entry, no run directory (owner ruling 2026-08-31, superseding the greyed-control ruling of the same day). A product the demo carries no finished report for refuses and names which one. It also re-aims two boot warnings written for an operator of a real deployment at the visitor who is not one, from one place (`driver/demo-posture.mjs`). **Set by `npx clearotron demo`, not by an operator** — it is passed explicitly to the two processes that have a reason to know (the portal and the MCP door; the worker is not told, because a demo never queues anything for it to drain), and those run with `CLEAROTRON_NO_ENV_FILE=1`, so a stray `.env` can neither put a live install into demo mode nor take a demo out of one. Anything but the literal `1` is not a demo. Replaces `PORTAL_DEMO`, which named only one of the processes that has to know. |
+| `CLEAROTRON_TEST_FIXTURE_PROFILES` | unset | `1` makes the profile loader return the three suite fixtures, which are refused from every roster otherwise. Set by `scripts/test-run.mjs`, never by an operator; an explicit `includeTestFixtures` argument beats it. Effect class `harness`; the full contract is its row in `.env.example`. |
+| `CLEAROTRON_DEMO_PROFILES` | unset | `1` makes the profile loader return the bundled demo account, which a fresh install does not resolve (owner ruling 2026-09-08). Set by `clearotron demo`, `start --demo` and the suite runner, never by an operator. The gate is on the bundled layer, so a deployment's own configured store keeps its `demoData` accounts either way. Effect class `harness`; the full contract is its row in `.env.example`. |
 | `PORTAL_LOCAL_CREDENTIAL` | `~/.cordillera/portal-local-credential.json` | Where local sign-in keeps its passphrase DIGEST. `npx clearotron demo` points it inside the demo's own base directory, so a demo mints its own passphrase instead of inheriting a digest minted for another address — and removing the demo stays one `rm -rf`. |
 | `PORTAL_LOCAL_PASSPHRASE` | unset | **NEVER set this in a file.** An internal one-shot handoff, not an operator control: on a first FOREGROUND start the supervisor mints the passphrase and hands it to the portal it spawns *at the spawn call*, so the closing summary can print the value beside the address rather than sending a first-time reader back into eleven startup log lines for the one value in this product that cannot be read back. It is deliberately absent from the composed child environments, because that composition is what `--background` writes into the units' env file — a passphrase there would be a permanent plaintext copy on disk and the product's own sentence, "it is stored only as a digest", would stop being true. Setting it in any env file recreates exactly that. Lost passphrase: `clearotron passphrase --reset`. |
 | `PORTAL_URL` | `http://127.0.0.1:18802`, or built from `PORTAL_SERVICE_HOST`/`PORTAL_SERVICE_PORT` | Where the deploy tick's live-surface check expects to reach the portal. |
 | `PORTAL_OPS_TOKEN_FILE` | `~/.config/systemd/user/trademark-portal.service.d/secrets.conf` | The systemd drop-in the live-surface check reads `PORTAL_OPS_TOKEN` out of. It reads the FILE rather than the environment so a check run by hand sees the same token the service does. |
+| `CLEAROTRON_CUT_REF` | `HEAD` | Which ref the cut decision reads the version from. **Read only by the release workflow, never set on a deployment.** The jobs that ask about `main` set it to `origin/main` explicitly, because their checkout is pinned to the run's own ref and `HEAD` there is that ref rather than the branch they are deciding about. A job that asks the wrong subject gets a confident wrong answer. |
+| `CLEAROTRON_RELEASE_WAIT_MS` | 25 minutes | How long a requested cut waits for the version pull request to merge itself before giving up. **Read only by the release workflow.** A rehearsal sets it to `0` so the wiring is exercised without holding a runner. Giving up is a quiet success by design — the scheduled run underneath catches a cut whose wait expired — so this budget failing shows up as a slow job rather than a red one. |
 | `CLEAROTRON_AGENT_MCP_URL` | unset (⇒ `null`) | The API-key MCP door advertised to a signed-in client. Null until that door is deployed, and the UI keeps its honest empty state rather than inventing a URL. |
 | `CLEAROTRON_AGENTS` | derived | Comma-separated agent ids for `scripts/purge-runs.mjs` to sweep. |
 | `CLEAROTRON_E2E_DIR` | **none — the script refuses without it** | The config repo's `e2e/` directory. There is one suite and it is not in this repo (owner ruling 2026-08-07), so the comparison script names the variable rather than defaulting anywhere. |

package/docs/architecture/05-config-governance.md

@@ -97,11 +97,11 @@ product doc.
 | **Client allowlist** (`{version, grants:[{email, customer}]}`) | T2 | git + PR on the `CLIENT_ACCESS_MAP` file | see §2 row 4 | LIVE, file-only; surfaced read-only at `admin.access` |
 | **Ops tokens** (scope ops/user, verbs, accounts, TTL) | T4 | `mint-token.mjs` CLI; jti denylist file | operator-held tokens | LIVE, CLI |
 
-## 4b. The install surface names (,)
+## 4b. The install surface names ()
 
 The variables a **customer or installer** ever types carry the product’s own prefix. They are listed
 by name in §5 below and in the upgrade table in INSTALL.md.
-`PRELIM` is the internal codename of the first product this engine shipped and means nothing to a reader
+`CLEAROTRON` is the internal codename of the first product this engine shipped and means nothing to a reader
 who has not read the code. Vendor credentials keep the vendor’s name (`SIGNA_API_KEY`,
 `PERPLEXITY_API_KEY`, `ANTHROPIC_API_KEY`) — that already says who you bought them from.
 
@@ -226,10 +226,13 @@ environment including production**; unset resolves to `null` and throws at first
 
 `CLEAROTRON_WORK_DIR` (~/trademark/workspace since; the two`.path` units
 hardcode the old glob — see 04), `CLEAROTRON_WORKSPACE_PREFIX` (workspace-), `CLEAROTRON_QUEUE_DIR`,
+`CLEAROTRON_CHECKOUT_DIR` (the installed package root every unit's `ExecStart` names; npm-owned and
+replaced wholesale on upgrade, which is why the settings file lives OUTSIDE it — and why a service not
+restarted after an upgrade keeps serving the deleted tree),
 `CLEAROTRON_INSTRUCTIONS_DIR` (config store), `CLEAROTRON_CUSTOMERS_DIR` (config store), `CLEAROTRON_RECIPES_DIR`,
 `CLEAROTRON_REPORTS_DIR` (**no default since — unset refuses**),`CLEAROTRON_RUN_LOCK_DIR`, `CLEAROTRON_OUTBOX_DIR`,
 `CLEAROTRON_STAFF_POOL_ROOT`, `CLEAROTRON_REGISTER_CALL_LOG` (~/trademark/telemetry/…, homedir-derived at
-call time, resolved by existence over the pre- telemetry directory too; the pre-
+call time, resolved by existence over the pre-change telemetry directory too; the pre-
 `CORSEARCH_*_LOG` names remain accepted for one release),
 `CLEAROTRON_REGISTER_RECORD_LOG` (**no longer a box path since ** — the driver injects
 `<runDir>/_driver/register-record-bodies.jsonl` per run; setting it by hand pins every run's record
@@ -255,6 +258,19 @@ drops BACKOFF from the prefix, which the elided spelling this row used to carry
 `CLEAROTRON_OUTBOX_NOPROGRESS_MAX`, `TRADEMARK_MSGID_DOMAIN` (enqueue.local).
 Code-set per stage (not operator-set): `CLEAROTRON_GATHER_AGENT` / `CLEAROTRON_GATHER_SESSION_KEY` / `CLEAROTRON_GATHER_SESSION_ID`.
 
+**Who the completion notice reaches** — `CLEAROTRON_REQUESTER_WHATSAPP` (empty; effect: deployment) is a
+JSON map of requester email or handle → number, and `CLEAROTRON_WHATSAPP_OPERATOR_COPY` (on unless `0`,
+`false` or `no`; effect: deployment) keeps or drops the operator's own copy of the same notice. The two are
+independent: an operator can stop receiving copies of other people's runs without changing who the
+requester notice reaches.
+
+`CLEAROTRON_AGENT_WHATSAPP` above is keyed by AGENT id, and every user of a deployment shares one agent —
+which is why the notice used to reach the operator and never the person who ordered the search. Unset is
+an EMPTY roster and never a demo one: a deployment that configures nothing routes no notice, and the
+delivery record names whose number is missing rather than quietly substituting the operator's.
+`CLEAROTRON_REQUESTER_WHATSAPP` holds contact data; treat it as a mirror-aware value under §6 wherever an
+integrator holds a copy.
+
 ### 5.8 Credentials — T4 (secrets; EnvironmentFile only; mirror-aware — see §6)
 
 `ANTHROPIC_API_KEY`, `CORSEARCH_SESSION_KEY` (fail-closed preflight),
@@ -287,6 +303,20 @@ Staff MCP: `TRADEMARK_MCP_HTTP_PORT` (18790), `TRADEMARK_MCP_HTTP_HOST`,
 `TRADEMARK_MCP_EMAIL_CLAIM`, `TRADEMARK_MCP_AUTH_HEADER`, `TRADEMARK_MCP_URL`,
 `TRADEMARK_MCP_AUTH_MODE` (see below),
 `TRADEMARK_MCP_AUTH_DISABLED` / `TRADEMARK_MCP_DEV` (dev seams — never set in prod).
+
+`TRADEMARK_MCP_KEY_SOCKET` is the local key door, and it is a PATH rather than a port on purpose. This
+interface serves two populations that authenticate differently: people arriving through a tunnel, who
+prove themselves with a proxy identity, and programs on the same machine holding a scoped access key,
+which can never produce one. "Only accept a key from loopback" does not separate them — the tunnel daemon
+runs on the same machine, so a request forwarded from the internet and one from the local portal arrive
+with the same peer address. A tunnel forwards to a port and cannot reach a unix socket, so the transport
+is the discriminator and the two doors are separate objects with opposite rules.
+
+Unset means no key door, and a deployment gets exactly the door it had before. The socket is created
+`0660` — owner and group only — with the mode set after `listen`, because `listen` creates the file and
+the umask decides what it starts as. It refuses to open at all with no grants file, alongside
+`TRADEMARK_MCP_AUTH_DISABLED`, or when `TRADEMARK_MCP_AUTH_MODE` is `token`: that mode makes the NETWORK
+door take a key too, which is the thing this exists to prevent. Read by `mcp-server/key-socket.mjs`.
 Client MCP: `CLIENT_MCP_HTTP_PORT` (code default 18811, matching the deployed unit; it was 18795,
 which collided with a co-hosted warm-MCP block, so keep any unit override that names a port),
 `CLIENT_MCP_HTTP_HOST`, `CLIENT_MCP_ALLOWED_HOSTS`,
@@ -303,7 +333,7 @@ systemd, writes no heartbeat, and must keep saying "waiting to start" rather tha
 repo** — `git grep process.env.CLIENT_ACCESS` here returns nothing, so they are governed here and
 never appear in the audit).
 
-**Which identity source the portal runs (,) — T4, and it is chosen by name, never inferred.**
+**Which identity source the portal runs () — T4, and it is chosen by name, never inferred.**
 `PORTAL_AUTH_MODE` selects the door: unset or `auth-proxy` (the default for a hosted deployment) means
 any login system in front that authenticates in the browser and forwards a verifiable JWT per request.
 **Any OIDC or JWT proxy is a choice per deployment** — for example Cloudflare Access, which is not a
@@ -318,7 +348,7 @@ values the staff MCP face already reads as `TRADEMARK_MCP_OIDC_ISSUER`, `TRADEMA
 never passed them, which is how one product shipped a provider-agnostic API face and a single-vendor
 web portal.
 
-**ALL FIVE DOORS READ THE FOUR NOW, and 's "the auth mechanism is out of scope" boundary is
+**ALL FIVE DOORS READ THE FOUR NOW, and the "the auth mechanism is out of scope" boundary is
 superseded** (owner, 2026-08-23: an installation brings its own identity provider and this product may
 not force one). The two write services and the client MCP origin gained the set they lacked; the table
 below names every one of the twelve. The client door's four fall back to the staff face's equivalents
@@ -441,6 +471,23 @@ it in CI and nowhere else — on a deployed box it silences the one check that n
 `portal-ui/` has **zero** env config (no `VITE_*`, no `import.meta.env`) — the SPA talks to its
 origin; all portal config lives server-side in portal-service.
 
+### 5.11 Release pipeline — CI only (never set on a deployment)
+
+These are read by the release workflow and by nothing a deployment runs. They are listed here because a
+name absent from this register is a name nobody can look up, not because an operator has any reason to set
+one — and setting either on a box does nothing at all.
+
+`CLEAROTRON_CUT_REF` (default `HEAD`) — which ref the cut decision reads the version from. The jobs that
+ask about `main` set it to `origin/main` explicitly, because their checkout is pinned to the run's own ref
+and `HEAD` there is that ref rather than the branch being decided about. A job that asks about the wrong
+subject gets a confident wrong answer.
+
+`CLEAROTRON_RELEASE_WAIT_MS` (default 25 minutes) — how long a requested cut waits for the version pull
+request to merge itself. A rehearsal sets `0`, so the wiring is exercised without holding a runner. Giving
+up is a quiet success by design and the scheduled run underneath catches what it misses, so a budget that
+is wrong shows up as a slow job rather than a red one — which is why it is written down rather than left
+to be inferred from a timeout.
+
 ## 6. Drift patterns — values that are mirrored by design
 
 Wherever one value must exist in more than one place, name every copy and rotate them in one

package/docs/architecture/05-customer-profiles.md

@@ -3,8 +3,8 @@
 > Part of the architecture pack (`docs/architecture/`). The driver's module tree and the headless
 > integrator contract are in [`driver/README.md`](../../driver/README.md).
 > This chapter describes the profile *mechanism*. Real customer bundles load from an external store
-> via `CLEAROTRON_CUSTOMERS_DIR` and no customer is named here; the repository ships `generic` plus the
-> synthetic demo customers `aurora`, `zephyr` and `petcary` — see
+> via `CLEAROTRON_CUSTOMERS_DIR` and no customer is named here; the package ships `generic` and the demo
+> brand owner, and the repository holds three further synthetic profiles for the test suite — see
 > [`driver/profiles/`](../../driver/profiles/).
 
 One engine, never forked — three layers. The reasoning core is shared by every client; the client

package/docs/architecture/06-operations-runbook.md

@@ -110,6 +110,18 @@ and the environment file holding the secrets.
 - **A scheduled gateway restart** (chat-channel session and plugin-loader hygiene) should *defer*
   off live work rather than skip: wait while a run is live, up to a bound, then restart anyway.
   `XDG_RUNTIME_DIR` must be set for `systemctl --user` to work from cron.
+- **Pin the agent id before upgrading an install made before 0.2.2.** The default agent id changed
+  from `clawdi` to `localagent`, and that id is a path segment: runs live under
+  `<workspaceRoot>/workspace-<agent>/studio/prelim-search/`. An install that never set one starts
+  reading an empty workspace, and empty reads as "no runs" rather than as an error. Set **both**
+  variables in the environment file — the gather servers read their own:
+
+  ```
+  CLEAROTRON_DEFAULT_AGENT=clawdi
+  CLEAROTRON_GATHER_AGENT=clawdi
+  ```
+
+  An install that already sets them is unaffected, and a fresh install needs neither.
 - **Integrator-platform upgrades** go through that platform's own guarded upgrade path — dry-run,
   exact-version confirm, stop → update → start. Never `npm i -g` / `pnpm add -g` directly.
 
@@ -242,7 +254,7 @@ the measurement that says so is.
 
 A box upgraded across the rename keeps whatever NAME its **call** ledger already had
 (`corsearch-calls.jsonl`), and across the move keeps whatever DIRECTORY it sits in (the
-pre- telemetry directory), because the resolver reads the file that is there. Read
+pre-change telemetry directory), because the resolver reads the file that is there. Read
 `providers/_shared/ledger-path.mjs` to see which of the four candidates a box resolves to.
 
 ## Access control and instance isolation

package/docs/architecture/09-security-and-data.md

@@ -203,7 +203,7 @@ stylesheets above.
 | **Doctrine** | `skills/`, framework decks, worked examples | The asset; transfers under the definitive agreement. Worked examples derive from real matters — treat as client-adjacent |
 | **Customer profiles** | `profiles/*.json`, context packs, `_audit.log` | Client-identifying by design (names, own brands, competitor lists) — the reason this *pack* names no clients |
 | **Reference library / calibration corpus** | outside the repo | Built on real client matters — **confidential client material, not freely transferable IP**; transfer needs a client-consent/sanitization plan |
-| **Telemetry** | `~/trademark/telemetry/*.jsonl` (a box upgraded across the move keeps the pre- telemetry directory — resolved by existence, oldest first),`_driver/*.jsonl` | Billing-grade provider usage + attempt telemetry; append-only; no automated retention |
+| **Telemetry** | `~/trademark/telemetry/*.jsonl` (a box upgraded across the move keeps the pre-change telemetry directory — resolved by existence, oldest first),`_driver/*.jsonl` | Billing-grade provider usage + attempt telemetry; append-only; no automated retention |
 
 **Posture commitments** (engineering-true, restated from the outward materials): no client data
 trains any model; each client's context is isolated in its profile bundle and frozen per run;

package/docs/configuration.md

@@ -115,9 +115,10 @@ under that framework. Absent, the generic set applies.
 
 ## 3. Client profiles
 
-One JSON file per client under [`driver/profiles/`](../driver/profiles/). Four ship as working
-examples: `generic` (the Generic default) plus three synthetic demo clients — `aurora` (gaming),
-`zephyr` (functional drinks) and `petcary` (animal health).
+One JSON file per client under [`driver/profiles/`](../driver/profiles/). Two are published as working
+examples: `generic` (the Generic default) and the demo brand owner. Three further synthetic profiles —
+gaming, functional drinks and animal health — exist in the repository for the test suite and are left
+out of the package.
 
 A job picks its profile by **forwarding domain** — `matchDomains[]`, exact host or dot-suffix. The
 applicant named in a request never selects a profile. Resolution happens once at run start and is

package/docs/decisions/0004-documentation-structure.md

@@ -69,7 +69,7 @@ at runtime.
   exceed the threshold, 15 were already named by an ancestor**, and three one-line additions closed the
   rest. The mechanism was not new — it was unchecked.
 
-  **This paragraph is what 's absence-record predicted it would become.** That record said "a new
+  **This paragraph is what the absence-record predicted it would become.** That record said "a new
   directory ships without a front door and nothing says so", named itself as a known gap rather than a
   mechanism, and ended "if the guard is built later, this paragraph is what it replaces". It has been.
 

package/driver/CHANGELOG.md

@@ -1,4 +1,124 @@
-# prelim-driver
+# clearotron-driver
+
+## 0.2.3
+
+### Patch Changes
+
+- 54ea03a: Fixed: The configuration check no longer reports a problem when the client connector's address is reached with its own token. Putting a single sign-on front before it is the client's choice, and running it token-based is supported. The check still says the sign-in audience was not compared against that address, so it never implies the two agree.
+- 4b6be02: Fixed: A bundled risk framework now states where it came from in words a customer can read. The note used to carry a confidentiality marking, a filename for a document not included, an internal reference number and revision history. It says whose framework it is, who stands behind it and which revision, and nothing else.
+- 63f916c: Fixed: A fresh install's brand-owner list now offers Generic and, with the demo, the demo account. It offered three of our test accounts as well, on the install route that clones the repository.
+- 5d12baa: Fixed: A run record now says which version of the engine's command-line tool served it. A change in results can be traced to a tool upgrade rather than guessed at.
+  
+  Fixed: A version the tool could not report is recorded as unreadable. An absent field could not be told apart from a probe that never ran.
+- 888de5d: Fixed: The deployment check now says whether each scheduled job's timer is still armed. A timer-driven service reads "inactive" between runs and when its timer has been stopped. So a check that asked only about the service could report nothing wrong while the scheduled work had quietly stopped happening.
+- 3a75e22: Fixed: A supplementary memo now succeeds on its first attempt. It cost two turns instead of one, and left a retried-stage mark on a report that had been delivered cleanly.
+  
+  Fixed: A supplementary memo states the rating framework it was reasoned under. A report assessed under a customer's own framework said so; a memo written from it did not.
+- fe22384: Fixed: Installing on a Node version the engine cannot run on now stops at once. It names the version you have, the version needed, and the command that fixes it. Before, the install finished and the first US register search failed with an error that never mentioned Node. The supported floor is Node 22.13 or newer.
+- 74b2cdd: Fixed: Setup now asks which address signs in, instead of turning it into an access rule covering everyone who shares its email domain.
+  
+  For operators: The People & access page now names the setting behind a staff rule, and the file to edit to undo it.
+- 9053919: Fixed: Five things a first-time reader could not act on.
+  
+  A screen that needs a brand owner chosen no longer points at the top left when the menu is collapsed and there is nothing there.
+  
+  The profile editor's Save button now states the one thing that is blocking it. That reason was always there, but it looked the same as the states where nothing is wrong.
+  
+  The default jurisdictions field now says what it does with what you type. Entries are checked against the list and kept, never refused. A region counts as one entry.
+  
+  The trademark categories field explains what those numbers are, with examples, before naming the standard they come from.
+  
+  The row of coloured ratings under "Risk framework in force" now says it belongs to that framework. It used to read as a list of several frameworks. Both editors say it the same way.
+- fe22384: For operators: Clearotron runs on Node 22.13 or newer again, down from 22.19, because its HTTP client moves back to version 7. Anyone who upgraded Node for the last release has nothing to undo.
+- bb899a7: New: A screening report now leads with the read. Each conflict shows its name, band, source and a one-sentence verdict. The paragraph arguing that verdict is one click away. Register filings appear as conflicts only where the reviewer rated them above the lowest band; the rest stay in the filings table.
+  
+  New: What was asked is now at the top of a screening report, with any question about whether it was the right thing to ask. Both used to sit at the bottom.
+  
+  New: The long per-name assessment now opens from the read. The engine has always written it and the page never showed it.
+  
+  New: Register counts say what they counted in their column headers. Territories are named rather than printed as two-letter codes.
+  
+  New: The lines a reader meets before opening anything are written in plain language. That is the summary, the basis line, each conflict's one sentence and the reviewer's notes. Legal vocabulary stays where the detail is.
+  
+  Fixed: Reviewer notes no longer appear on a screening report exported to PDF. They are for the reviewing lawyer, and a report forwarded to a client used to carry them.
+- 2a812d6: Fixed: The New clearance screen now has a **Start a search** button. The button that ran a search used to say "Review clearance", and people could not tell it was the way to begin.
+  
+  Fixed: When a search cannot start yet, the screen says what is still missing, both on the form and beside the button. It used to grey the button out and give no reason at all.
+  
+  Fixed: **Save as search** now confirms the save beside the button that was pressed, names what was saved, and links to it. It gave no sign at the point of the click.
+  
+  Fixed: The unsaved-changes warning no longer fires on a search you have just saved. It compared the form against a blank one and nothing ever reset it.
+  
+  Fixed: The message shown when no search engine is attached now names the setup command for the way you installed. It used to name the one that only works in a copy of the source.
+- 58af0b7: Fixed: The settings page no longer shows the engine as healthy when the engine program cannot be found.
+  
+  That page reports which engine is configured. The New clearance screen reports whether a search can start right now. When those two readings disagreed, neither screen said so.
+  
+  An install could therefore show a green engine while no search would start, and nothing explained the gap. The settings page now names the disagreement and says what to do about it. Running `clearotron doctor` reports the same thing in the same words.
+
+## 0.2.2
+
+### Patch Changes
+
+- df095a8: Fixed: The configuration audit now refuses when one of the files it reads is missing, instead of reporting that nothing sets the variables that file records. Its answer decides which settings look unused, so a file it could not read was being counted as a file with nothing in it.
+- f05657c: New: An assistant on a clearance account can now answer "what if this were different" about a report already delivered. It writes a short memo reasoning over the evidence already gathered, instead of asking for a new search.
+- d52cd98: Fixed: A scheduled deploy no longer updates the working copy while an experiment run is in progress. It now waits, as it already did for a clearance run.
+- f05657c: Fixed: A client account asking about a mark in a knockout screen now receives the risk band, the reason for it and the findings behind it. It previously returned an empty answer.
+- 38ce32f: New: A Knockout search now looks up what the owner of a registered right actually sells, and the report says where that answer came from. Before, the assessment inferred the owner's trade from the company name alone, then told you to go and obtain the registration's own goods list. The name is not evidence of the trade. It happened to read correctly on one search and would have read confidently wrong on the next.
+  
+  Fixed: Where the lookup finds nothing, the report says so plainly and still delivers. An unanswered search is never written up as a clean negative, and a provider outage never withholds a report.
+  
+  For operators: this adds one web search per promoted registered filing, deduplicated by owner and capped at three per searched name. A search with no registered right against it costs nothing extra.
+- 57eaf24: Fixed: A knockout report no longer shows a register filing's risk band beside a line saying that filing carries no rating. The band shows when the reviewer gave one, and the line appears only when they did not.
+- b1f188f: Fixed: The unit inventory again records why every shipped unit that runs on no box is still shipped. One entry lost its reason when its name was superseded.
+- 3de0828: New: One engine process can now serve both people arriving through a tunnel and programs on the same machine holding an access key. It listens for the key on a local socket, which no tunnel can forward to, and the network door never accepts a key at all. Deployments that needed both used to run the process twice, on two ports, with two units to keep in step.
+  
+  Fixed: The startup lines now say whether a local key path exists, and what its permissions are. An operator can see it without opening a unit file. A deployment with no key path is told that too, rather than left to infer it from silence.
+  
+  For operators: set TRADEMARK_MCP_KEY_SOCKET to the socket path the local key door should listen on. It is created with owner and group access only. Leaving it unset changes nothing about an existing deployment. The door refuses to open without a grants file, or alongside the authentication bypass.
+- 235cf07: Fixed: Stopping the demo now stops everything it started, including when the stop signal reaches only the command you can see rather than the whole terminal.
+- be648b6: Fixed: The architecture diagrams in the public documentation render with their intended colours again, and thirteen code comments state the colour they meant.
+- 97b7c96: Fixed: The deployment check now reports the services a box is actually running. It had been asking systemd about unit names left behind by a rename, so a healthy box reported nothing running.
+- f05657c: Fixed: The "your screen is done" notice for a knockout search now goes to the person who ordered it, with the operator kept as a copy. It previously went to the operator alone, whoever had asked for the search.
+- c4b6b58: Fixed: The link in your completion email and message now opens the report. It previously pointed at a path the site does not serve, so it led to a sign-in and then a dead page. This affected every delivered report on both search products, in the email, the chat notice and the assistant's own answer. The workbook link in the same email was always correct and is unchanged.
+  
+  Fixed: The chat notice now goes to the person who ordered the search, with the operator keeping a copy they can switch off. Before, it went only to whoever runs the service, so the requester was never told their search had finished.
+  
+  For operators: hold requesters' numbers in CLEAROTRON_REQUESTER_WHATSAPP, keyed by email address or by the handle a request arrives under. Where no number is held, the delivery record says so by name instead of quietly sending the notice to you. Set CLEAROTRON_WHATSAPP_OPERATOR_COPY=0 to stop receiving copies of other people's runs.
+- bb1a409: New: A Knockout report now carries the whole assessment behind its ratings. You get the reviewer's notes and the reviewer's own opening read of each name. You also get the reasoning that holds a name at its rating, and what would move it. This was written during every search and reached only the audit workbook, so the report showed a rating without the thinking under it. The notes are marked as reference material rather than mixed into the findings.
+  
+  New: A registered filing the search formed a view on now shows that rating and the read behind it. Before, the one registered right on a page was the only entry carrying no rating, beside softer uses that all carried one. That inverted what matters legally. A filing the search did not weigh still says so plainly.
+- df6277c: Fixed: A live registration covering the goods you asked about is no longer left out of a report for want of room. It is reported, or the report says why it is distant.
+- 9ba8cd0: Fixed: A what-if memo is now refused if it writes anywhere in the delivered run except its own memo folder, and the refusal names the file.
+- 8c8e200: Fixed: A what-if question left queued when its run is archived now comes back with a reason, instead of never being answered.
+- bb1a409: Fixed: The delivery record now states plainly when a report's write-up length and ranking rules could not be checked against the delivered text. It says the rules were applied to nothing on that run. Before, this was recorded as an unlabelled failed check. It looked like any other, so a run could deliver with those rules unverified and nobody would see it.
+- 9ba8cd0: For operators: Each run record now says whether the model id it observed was a pinned snapshot or an alias the provider can repoint.
+- aea4a4e: Fixed: The deployment check now says which checkout a service is running from even when its unit file does not declare one.
+- bb1a409: New: The tools that show how a search reached its answer now work on a Knockout search. You can ask what it found, what it looked at, where it searched and came back empty, and read the delivered report itself. Until now they returned nothing at all for a Knockout search, so anyone asking how one of these results was reached saw a blank record.
+  
+  New: The proof-of-search record answers on these searches. It lists what was searched and found nothing, which is what answers a challenge to a result. Where a tool has nothing to show for this kind of search, it now says so in words. An empty list reads as "we looked and found nothing".
+- 14d6d28: Fixed: The demo and the install steps now start on native Windows, where they previously crashed on the first internal module they loaded.
+
+## 0.3.0-beta.0
+
+### Minor Changes
+
+- bb1a409: New: A Knockout report now carries the whole assessment behind its ratings. You get the reviewer's notes and the reviewer's own opening read of each name. You also get the reasoning that holds a name at its rating, and what would move it. This was written during every search and reached only the audit workbook, so the report showed a rating without the thinking under it. The notes are marked as reference material rather than mixed into the findings.
+  
+  New: A registered filing the search formed a view on now shows that rating and the read behind it. Before, the one registered right on a page was the only entry carrying no rating, beside softer uses that all carried one. That inverted what matters legally. A filing the search did not weigh still says so plainly.
+- bb1a409: New: The tools that show how a search reached its answer now work on a Knockout search. You can ask what it found, what it looked at, where it searched and came back empty, and read the delivered report itself. Until now they returned nothing at all for a Knockout search, so anyone asking how one of these results was reached saw a blank record.
+  
+  New: The proof-of-search record answers on these searches. It lists what was searched and found nothing, which is what answers a challenge to a result. Where a tool has nothing to show for this kind of search, it now says so in words. An empty list reads as "we looked and found nothing".
+
+### Patch Changes
+
+- df6277c: Fixed: A live registration covering the goods you asked about is no longer left out of a report for want of room. It is reported, or the report says why it is distant.
+- 9ba8cd0: Fixed: A what-if memo is now refused if it writes anywhere in the delivered run except its own memo folder, and the refusal names the file.
+- 8c8e200: Fixed: A what-if question left queued when its run is archived now comes back with a reason, instead of never being answered.
+- bb1a409: Fixed: The delivery record now states plainly when a report's write-up length and ranking rules could not be checked against the delivered text. It says the rules were applied to nothing on that run. Before, this was recorded as an unlabelled failed check. It looked like any other, so a run could deliver with those rules unverified and nobody would see it.
+- 9ba8cd0: For operators: Each run record now says whether the model id it observed was a pinned snapshot or an alias the provider can repoint.
+- aea4a4e: Fixed: The deployment check now says which checkout a service is running from even when its unit file does not declare one.
+- 14d6d28: Fixed: The demo and the install steps now start on native Windows, where they previously crashed on the first internal module they loaded.
 
 ## 0.2.1
 

package/driver/README.md

@@ -1,4 +1,4 @@
-# prelim-driver — deterministic driver for the prelim-search trademark workflow
+# clearotron-driver — deterministic driver for the prelim-search trademark workflow
 
 Orchestration in **code**; the LLM does only judgment leaves. Each pipeline stage is **one blocking
 engine turn** (default engine: `anthropic-agent`, shelling `claude -p` per stage); fan-out/fan-in/
@@ -26,7 +26,7 @@ integrator ──job JSON (enqueue CLI / start_run / queue file)──┐
 
 ## Per-agent execution (multi-queue)
 
-A prelim job runs **as the identity that forwarded it** — derived from the queue LOCATION it was
+A clearotron job runs **as the identity that forwarded it** — derived from the queue LOCATION it was
 claimed from (`<workspacePrefix><agentId>/…/queue`, see `driver.config.mjs`), so there is no
 forwarder→agent map to maintain. The run-dir sits in that identity's workspace and the delivery
 packet names that identity as the reply route. **Publishing stays centralized** — `publish/` writes

package/driver/ask-ledger.mjs

@@ -82,7 +82,7 @@ export function planJoinFrom(planExecution) {
   // KEY predates the instrument — "not recorded" — while one carrying the keys as null is a count the
   // provider could not take. Reading the VALUES alone collapses those two into one sentence, which is
   // the exact confusion exists to remove; `records: null` is indistinguishable from absent.
-  // The first cut of this did read the values, and it reported every pre- receipt as a failed
+  // The first cut of this did read the values, and it reported every pre-change receipt as a failed
   // count. Bare qid strings are tolerated too — no driver ever wrote them, so that arm proved nothing.
   const executed = new Map();
   for (const x of planExecution?.executed ?? []) {
@@ -104,7 +104,7 @@ export function planJoinFrom(planExecution) {
  * What a slice returned, in the reader's words — THREE-VALUED, and never a zero standing in for an
  * absence (register-plan.mjs's join records why). `null` records with a finite count means the provider
  * counted but the block carried no record list; both null means the receipt says nothing about the
- * return, which is what every pre- run looks like. PURE.
+ * return, which is what every pre-change run looks like. PURE.
  */
 export function returnedPhrase(info) {
   if (!info) return "what it returned was not recorded";
@@ -127,7 +127,7 @@ export function returnedPhrase(info) {
  *
  * THE LEGITIMATE CLOSE IS PRESERVED, and it is the whole reason this keys on the RETURN rather than on
  * execution: a probe that ran and found NOTHING has nothing to hand anyone, and closes exactly as it
- * does today. 's own build named that trap before this rule existed.
+ * does today. its own build named that trap before this rule existed.
  *
  * THREE STATES, and only one of them discharges:
  *

package/driver/authority-trees.mjs

@@ -24,7 +24,7 @@
 //
 // `_driver/` is the sharpest inclusion. It holds the frozen plan, the grid specs, the plan-execution
 // receipt, the form sidecars and `run.jsonl` — and it sits inside `runDir`, which is granted READ+WRITE
-// by design. Every diagnosis run on 2026-08-14 (,) read those files as ground
+// by design. Every diagnosis run on 2026-08-14 () read those files as ground
 // truth. A seat writing them would be forging the record the engine is judged by.
 //
 // `profilesDir` is DEFENSIVE, not a live hole: it appears in no `--add-dir`, so the file tools cannot