clearotron 0.2.1 → 0.2.3

package/driver/dev-portal.mjs

@@ -301,7 +301,7 @@ async function loadOutbox(){const r=await(await fetch("/dev/outbox")).json();
 let REG=null;
 const esc=(s)=>String(s??"").replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;");
 async function loadSearches(){
- const cust=$("#s_cust").value.trim()||"aurora";
+ const cust=$("#s_cust").value.trim()||"demo-brand-owner";
  try{
   const all=await(await fetch("/recipes")).json();
   if(all.error){$("#searches").innerHTML='<span class="err">'+esc(all.error)+'</span>';return;}
@@ -320,7 +320,7 @@ async function loadSearches(){
 function useProduct(k){const f=$("#f");f.product.value=k;$("#f_recipe").value="";f.mark.focus();}
 function useRecipe(cust,slug){const f=$("#f");f.product.value="";$("#f_recipe").value=slug;f.profile.value=cust;f.mark.focus();}
 async function composeSubmit(save){
- const cust=$("#s_cust").value.trim()||"aurora";
+ const cust=$("#s_cust").value.trim()||"demo-brand-owner";
  const fd=new FormData($("#sf"));
  const recipe={label:(fd.get("label")||"").trim(),base:fd.get("base")};
  if(fd.get("registerProbe")!=null)recipe.components={registerProbe:true};
@@ -373,7 +373,7 @@ export function startPortal({ poolRoot = null, port = 18899, host = "127.0.0.1",
       if (url.pathname === "/dev/enqueue" && req.method === "POST") {
         let body;
         try { body = await readJsonBody(req); } catch (e) { return sendJson(res, 400, { ok: false, error: e.message }); }
-        // `searchLevel` IS REFUSED, NOT DROPPED. This form offered a "Search level" menu (prelim · Depth 4
+        // `searchLevel` IS REFUSED, NOT DROPPED. This form offered a "Search level" menu (clearotron · Depth 4
         // / knockout · Depth 1) and posted the field to an assembler that stopped reading it, so picking
         // "knockout" enqueued a job naming no product at all and ran whatever the account default or the
         // request's own territories named — a silent product substitution at a live door, from a control

package/driver/disposition-call.mjs

@@ -145,7 +145,7 @@ export const CALL_REFUSALS = Object.freeze([
   "obstacle_absent",      // an obstacle was claimed with nothing said about what blocks the proof
 ]);
 
-// The proof-of-reading arms, and ONLY those. 's obstacle waives this duty and no other, so this set
+// The proof-of-reading arms, and ONLY those. That obstacle waives this duty and no other, so this set
 // is the exact boundary between "you have not proved you read it" and "you have not judged it" — derived
 // by prefix from the vocabulary above rather than retyped, so a new evidence arm joins it automatically
 // and a new judgment arm cannot wander in.
@@ -183,7 +183,7 @@ export const RETIRED_CALL_REFUSALS = Object.freeze([
 // and it must never appear in the same bucket, because the two demand opposite responses — one says
 // "change your answer", the other says "stop asking, it is ours".
 //
-// 's leading unproven hypothesis lives here. The accumulator's rows and candidates are REGENERATED
+// That leading unproven hypothesis lives here. The accumulator's rows and candidates are REGENERATED
 // on every pass, and `seatFields` re-resolves an already-resolved row against whatever the current pass
 // holds (`disposition-union.mjs:98`, which discards `resolveCandidate`'s `state`). If that second
 // resolution misses, a row the tool accepted lands with an empty receipt and reads as unruled. This
@@ -442,7 +442,7 @@ export function detectRulingDrift(ledger) {
  *
  * ── WHY THE TOTAL IS RETURNED TOO ───────────────────────────────────────────────────────────────────
  *
- * 's warning sits in this exact number: filtering it after a split reported
+ * That warning sits in this exact number: filtering it after a split reported
  * `obligationsNeverAddressed: 0` on the run that died owing 75. So the total comes back as its own field
  * and the two parts must sum to it. Nothing can go to zero without a companion number rising to meet it.
  *
@@ -822,7 +822,7 @@ export function validateDispositionCall(rows, recorded, { told = null } = {}) {
 /**
  * CAN THIS ROW'S EVIDENCE DEMAND EVER BE SATISFIED?
  *
- * — the agreement guard for the `evidence_owed` seam, and it is 's shape one module over. The
+ * — the agreement guard for the `evidence_owed` seam, and it is the shape one module over. The
  * demand (`quote_required`) is SET at form-build against candidates that carried text; the satisfaction is
  * enforced by `segmentBinding` against the candidate's snippet AS IT IS NOW. Between the two, candidates
  * regenerate. When they come back without quotable passages the flag survives and its justification does

package/driver/disposition-tool.mjs

@@ -19,7 +19,7 @@
 //   decided, which is the thing already in the record, rather than what we were given.
 //
 //   THE INDEX IS WRITTEN BY THE RECEIVER, NEVER BY THE CONSUMER. This handler writes both the payload and
-//   the line naming it, in that order, before it validates anything. 's three snapshot sites all
+//   the line naming it, in that order, before it validates anything. That three snapshot sites all
 //   discard their return, so no attempt row names its snapshot and correlation is by mtime — which is
 //   precisely how the union discard had to be diagnosed. A consumer-written index can only ever name the
 //   payloads the consumer got to; a call that dies mid-flight writes no index line, and its absence is
@@ -46,7 +46,7 @@ const CALLS_DIR = "disposition-calls";
 /**
  * The obligations sidecar — what the seat was TOLD it owed, written when the block was rendered.
  *
- * 's rule, applied to this filename: the path is derived ONCE and imported, never re-derived at the
+ * That rule, applied to this filename: the path is derived ONCE and imported, never re-derived at the
  * other end. perplexity-server.mjs writes this file and this module reads it; two spellings of one name
  * is the drift cost weeks, and the reader would fail OPEN — it would simply find no file, fall back
  * to the live derivation, and renumber the seat's page without anyone being told.
@@ -338,7 +338,7 @@ export function outstandingWithAnchors(canonicalRows, formRows) {
  * Record one typed call. The tool handler's core.
  *
  * `spec` is the DRIVER-WRITTEN grid spec — the same file the grid tool was given. The seat names no path
- * of its own: 's rule is that the path is the driver's, taken from the spec it wrote, because two
+ * of its own: the rule is that the path is the driver's, taken from the spec it wrote, because two
  * derivations of one filename is the drift that cost weeks.
  */
 export function recordDispositions(spec, received, { now = () => new Date().toISOString() } = {}) {
@@ -415,7 +415,7 @@ export function recordDispositions(spec, received, { now = () => new Date().toIS
   // accumulator" are two different facts and nothing compared them.
   //
   // This compares them, per call, and records any disagreement as OURS. It is deliberately not a throw:
-  // 's silent-drop hypothesis is unproven, and an instrument that crashes the run it is measuring
+  // That silent-drop hypothesis is unproven, and an instrument that crashes the run it is measuring
   // cannot measure it. If the count is always zero the hypothesis is dead and we will be able to say so
   // from the artifact — which is the point of building it before the cure.
   const landed = new Map((Array.isArray(u.form?.rows) ? u.form.rows : [])

package/driver/disposition-union.mjs

@@ -21,7 +21,7 @@
 // definition of "ruled" and — since the review of this build — no row LOOKUP either. `obligationRows`,
 // `formRowFinder` and `isRuled` all come from connotation-search.mjs, the same code the GATE
 // judges with. A union that preserved a ruling the gate would refuse, or dropped one it would accept,
-// would make the outstanding count mean two different things in two places, which is 's defect
+// would make the outstanding count mean two different things in two places, which is the defect
 // exactly: one calculation running twice, silently disagreeing, both copies looking correct. The lookup
 // had been written out twice — here and in the gate — and both copies carried the same punctuation defect.
 
@@ -160,7 +160,7 @@ export function unionDispositionForm(prior, submitted, ob, { half = null, genera
   const findSubmitted = formRowFinder(submitted, form.rows);
   // — a park is STICKY, for the same reason a ruling is. This module exists because the outstanding
   // count churned instead of shrinking (see the header): a park that could lift would let the count rise
-  // again, which is 's defect in new clothes. So the prior form's park is authority, and `parkedIds`
+  // again, which is the defect in new clothes. So the prior form's park is authority, and `parkedIds`
   // only ever ADDS.
   const newlyParked = new Set((parkedIds ?? []).map((x) => String(x ?? "").trim()).filter(Boolean));
   let ruled = 0, carried = 0, parked = 0;

package/driver/doc-constants.mjs

@@ -350,7 +350,7 @@ export const DOC_CONSTANTS = [
     doc: "providers/uspto-local/README.md",
     pattern: /last successful sync goes past (\d+) hours/,
   },
-  // The same figure, twice in the same file — 's shape, and the reason each occurrence is a row.
+  // The same figure, twice in the same file — the shape, and the reason each occurrence is a row.
   {
     constant: "FRESHNESS_HOURS.sync",
     source: { file: "providers/uspto-local/src/index-store.js", symbol: "FRESHNESS_HOURS.sync" },

package/driver/door-gates.mjs

@@ -97,7 +97,7 @@ export function gateResolvedRequest({ job = null, profile = null, resolved = nul
   // A resolution that could not be taken is not a refusal — see the fail-open note in the header.
   if (!resolved) return out;
   // A CLARIFY IS RELAYED VERBATIM. It is already an actionable sentence naming the selector that could
-  // not be honoured ("product \"prelim\" names no search we offer — one of: … (or omit it for the
+  // not be honoured ("product \"clearotron\" names no search we offer — one of: … (or omit it for the
   // account's default)"), and flattening it into a cause would lose the remedy clause.
   if (resolved.clarify) { out.errors.push(resolved.clarify); return out; }
   // deliveryRoute "portal" — DECLARED but not BUILT. It validates shape-wise, has no consumer (the
@@ -133,7 +133,7 @@ export function doorGates(job, opts = {}) {
   return { ...r, ...gateResolvedRequest({ job, ...r }, opts) };
 }
 
-// ── WHY tracker issue 216'S REFUSAL IS NOT ALSO A DOOR GATE ─────────────────────────────────────────
+// ── WHY THE CONFIGURED-TO-SEARCH REFUSAL IS NOT ALSO A DOOR GATE ─────────────────────────────────────────
 //
 // It was, briefly, and it was removed with a measurement rather than an opinion. Adding "is this box
 // configured to search at all" here reddened `driver/test/doors-agree.test.mjs` — nineteen arms green

package/driver/doubt-selection.mjs

@@ -2,7 +2,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // doubt-selection.mjs — which OPEN doubts the closure seat is asked about, chosen by the DRIVER.
 //
-// 's architecture, one lane over from profile-selection.mjs: "prefer driver selection wherever the
+// That architecture, one lane over from profile-selection.mjs: "prefer driver selection wherever the
 // key precedes the dispatch." The key is on the doubt before doubt-closure is dispatched, so there is
 // nothing here for a directive to ask a seat to judge — the driver lists the ids, and a doubt it does
 // not list is never mentioned.
@@ -68,7 +68,7 @@ export function keptTiersFor(doubtClosure) {
  * WHICH OF THE THREE SILENCES THIS IS. `keptTiersFor` returns null for `every-doubt` AND for a word it
  * does not know, deliberately — a typo must not silently drop every keyed doubt. But that makes the two
  * indistinguishable in the run's event: a misspelt cut records exactly what the shipped cut records, and
- * the product row looks graded while the dispatch is not. 's arm catches a bad word on the ROW; this
+ * the product row looks graded while the dispatch is not. That arm catches a bad word on the ROW; this
  * is the runtime face of the same question, on the run that actually happened.
  *
  * `hasOwnProperty` rather than a truthiness test on the lookup, because `TIER_CUTS[w]` reaches the

package/driver/drainer-identity.mjs

@@ -34,7 +34,7 @@
 import { readFileSync, writeFileSync, mkdirSync, renameSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { join, dirname } from "node:path";
-import { drainPosture, absentDrainerIsNormal } from "./drain-posture.mjs";   // tracker issue 206 — one rule about the box
+import { drainPosture, absentDrainerIsNormal } from "./drain-posture.mjs";   // one rule about the box
 
 export const STAMP_BASENAME = "_drainer-identity.json";
 

package/driver/driver.config.mjs

@@ -115,7 +115,7 @@ export const config = {
   // configured, because a whitespace-only string is TRUTHY in JavaScript — so a variable set to spaces
   // did not fall through to the default, it BECAME the path. `poolRoot` alone trimmed, so "blank" meant
   // two different things depending on which accessor you asked, and `queueDirs` resolved a RELATIVE
-  // queue directory under the process cwd, which is 's own incident shape.
+  // queue directory under the process cwd, which is its own incident shape.
   //
   // Owner ruling 2026-08-19: a whitespace-only value counts as UNSET, everywhere. `X=` already meant
   // "not configured" and this is that rule finishing its sentence — not a reversal of it, which
@@ -229,7 +229,7 @@ export const config = {
   /**
    * Every skills root handed to the engine's file tools (overlay + base, deduped).
    *
-   * NAMED FOR WHAT IT IS, not what we want it to be (, 2026-08-14): it was `skillsReadRoots`, and the
+   * NAMED FOR WHAT IT IS, not what we want it to be (2026-08-14): it was `skillsReadRoots`, and the
    * engine passes it to `--add-dir`, which has no read-only form. The read-only INTENT is real and is
    * enforced by the deny-hook at driver/engine/deny-authority-write.mjs — not by this name.
    */
@@ -248,11 +248,11 @@ export const config = {
   // 2026-07-19: these were joined against DRIVER_DIR, so the driver read framework manifests out of
   // its BUNDLED driver/skills while CLEAROTRON_INSTRUCTIONS_DIR pointed the agent at the config store. A
   // customer whose framework lives only in the config store therefore hard-failed at attachFramework
-  // with `framework_manifest_missing` — the first Aurora Interactive run died there before any stage ran.
+  // with `framework_manifest_missing` — a test account's first run died there before any stage ran.
   get skillsRoot() { return dirname(this.skillsDir); },
 
   // ── Per-agent paths ───────────────────────────────────────────────────────
-  // A prelim job is enqueued into the FORWARDING agent's OWN workspace queue (that agent's `write` tool
+  // A clearotron job is enqueued into the FORWARDING agent's OWN workspace queue (that agent's `write` tool
   // is sandboxed there), and we run the whole pipeline as that same agent so the reply tool
   // (`clawdi_send_<user>`), the run-dir, and the agent's memory all line up. The queue LOCATION therefore
   // encodes the agent identity — the driver derives {agentId, studioRoot} from where it claimed the job,
@@ -269,6 +269,13 @@ export const config = {
   },
   // Escaped prefix for the reverse regexes below (a custom prefix may carry regex metachars).
   get workspacePrefixRe() { return this.workspacePrefix.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); },
+  // `prelim-search` IS NOT A PRODUCT NAME HERE and does not follow the product rename. It is a
+  // directory segment on disk, and every archived run — its slug dirs, its `archive/`, its matter
+  // ledger — was written under it. Renaming the segment does not move those runs; it points the
+  // reader somewhere empty, and an empty directory reads as "no runs" rather than as an error.
+  // The rule the tree already enforces elsewhere: a token that is read back out of an archive keeps
+  // its old spelling, or the code refuses its own archive. Thirteen sites compute this segment and
+  // all thirteen stay.
   studioRootForAgent(agentId) {
     return join(this.workspaceRoot, this.workspaceDirName(agentId), "studio", "prelim-search");
   },
@@ -283,7 +290,7 @@ export const config = {
     const m = new RegExp(`(?:^|/)${this.workspacePrefixRe}([^/]+)/studio/prelim-search/queue/?$`).exec(qdir);
     return m ? m[1] : null;
   },
-  // Every agent workspace's prelim queue. The systemd `.path` watches these and the runner drains ALL of
+  // Every agent workspace's clearotron queue. The systemd `.path` watches these and the runner drains ALL of
   // them on each trigger (+ a timer fallback), so a request from ANY forwarder runs. (Pre-fix the watcher
   // and runner only looked at workspace-clawdi, silently orphaning every Alex/Sam job — the bug this fixes.)
   //
@@ -485,7 +492,7 @@ export const config = {
   // jobs AND manual pipeline.mjs invocations alike. WS-C raised the V4-7 stopgap's 1 → 3 (one per agent).
   // Phase-4: 3 → 6 + per-agent admission LIFTED (pipeline.acquireRunSlot no longer tags by agent). The
   // 2026-06-12 starvation that forced one-run-at-a-time (parallel runs → every gateway lane busy → 75s
-  // heartbeat timeouts → a lost mid-run reply) was a GATEWAY phenomenon; prelim COMPUTE now runs off the
+  // heartbeat timeouts → a lost mid-run reply) was a GATEWAY phenomenon; clearotron COMPUTE now runs off the
   // gateway on the standalone claude -p engine, so concurrent runs no longer starve the heartbeat. The TURN
   // cap below still bounds the (now light) intake/delivery gateway demand. The runner serializes only the
   // cheap claim+dedup per queue and runs pipelines concurrently up to this cap (same-matter dedup stays
@@ -493,14 +500,22 @@ export const config = {
   // if the env is unset — keep the two in sync). Set to 2 on 2026-06-18 (was 6): 2 parallel is enough for now,
   // and bounds Max-5x rate-limit thrash. To change the live cap, set the env on the VM (no code deploy needed).
   get maxConcurrentRuns() { return Math.max(1, numericSetting("CLEAROTRON_MAX_CONCURRENT_RUNS")); },
+  // ON-DISK NAME, NOT A PRODUCT NAME: an install that never set the variable is already using this
+  // directory, so renaming the default moves the install to an empty one and nothing migrates. Here
+  // the orphaned files are run-slot locks, so a live run's slot goes unseen and the global cap is
+  // silently exceeded rather than enforced. Owner ruling, tracker issue 308.
   get runLockDir() { return this.envValue("CLEAROTRON_RUN_LOCK_DIR") || join(this.workspaceRoot, "prelim-run-locks"); },
 
   // Delivery outbox (Workstream B). On a handoff-mode finish the driver drops <runId>.pending here (naming
-  // the forwarder agent); the systemd-user prelim-outbox.path unit fires an INSTANT prelim-deliver wake off
+  // the forwarder agent); the systemd-user prelim-outbox.path unit fires an INSTANT clearotron-deliver wake off
   // it, so a finished run sends in seconds instead of waiting ≤55m for the HEARTBEAT completion-watch (which
   // stays as the backstop). Mirrors runLockDir's derivation; env-overridable for dev/prod parity.
   // Phase 2: the outbox is ALSO the event seam for every other requester-facing event (run-failed,
   // intake-rejected, duplicate-skipped, late-bind-ack) — self-contained JSON packets via outbox.mjs.
+  // ON-DISK NAME, NOT A PRODUCT NAME: an install that never set the variable is already using this
+  // directory, so renaming the default moves the install to an empty one and nothing migrates. Here
+  // the orphaned files are requester-facing events — delivered, run-failed, intake-rejected — so the
+  // visible failure is a requester never told their run finished. Owner ruling, tracker issue 308.
   get outboxDir() { return this.envValue("CLEAROTRON_OUTBOX_DIR") || join(this.workspaceRoot, "prelim-outbox"); },
 
   // ── Delivery/comms (Phase 2, standalone product) ─────────────────────────────────────────────────
@@ -516,8 +531,25 @@ export const config = {
 
   // Fallback execution agent when a job's origin agent can't be derived from its queue dir (shouldn't
   // happen in normal operation). The real per-run agent is the forwarding agent, derived from the queue
-  // LOCATION (see studioRootForAgent / agentIdFromQueueDir above). `clawdi` carries all the prelim tools.
-  get defaultAgent() { return process.env.CLEAROTRON_DEFAULT_AGENT || "clawdi"; },
+  // LOCATION (see studioRootForAgent / agentIdFromQueueDir above).
+  //
+  // THE DEFAULT IS PART OF A PATH, so changing it moves where an install looks for its own runs:
+  // every run dir is `<workspaceRoot>/workspace-<agent>/studio/prelim-search/…`. An install created
+  // before this default changed keeps its runs under the old id and must pin it — both spellings,
+  // because the gather servers read their own variable:
+  //
+  //     CLEAROTRON_DEFAULT_AGENT=clawdi
+  //     CLEAROTRON_GATHER_AGENT=clawdi
+  //
+  // Unpinned, such an install starts a fresh empty workspace and its existing runs read as absent
+  // rather than as an error. Said again where upgrades are described (INSTALL.md, ops runbook).
+  //
+  // THE ID IS ALSO A KEY, not only a path segment. `AGENT_WHATSAPP` in stages.mjs is keyed by agent
+  // id, so the demo roster has to carry this value or the reference deployment resolves no operator
+  // number and the hole reads as "no copy configured" rather than as a miss. Both ids are in that
+  // roster for the same reason the pin above exists. (The roster stays one line: 32 backlog rows
+  // cite line numbers in stages.mjs, so a comment added there repoints all of them.)
+  get defaultAgent() { return process.env.CLEAROTRON_DEFAULT_AGENT || "localagent"; },
 
   // Per-stage retry budget (fresh session key per retry).
   get maxRetries() { return numericSetting("CLEAROTRON_MAX_RETRIES"); },
@@ -612,6 +644,26 @@ const MODEL_FAMILY_RE = /(?:^|\/)(?:claude-)?(opus|sonnet|haiku)(?:[-.]|$)/i;
 // mini one would then read as agreement, which is exactly the corruption this gauge exists to catch.
 const OPENAI_ID_RE = /^(?:openai\/)?(gpt-[\w.-]+|o\d[\w.-]*)$/i;
 const DATE_SUFFIX_RE = /-(?:\d{8}|\d{4}-\d{2}-\d{2})$/;
+
+/**
+ * Is this model id a DATED SNAPSHOT, or an undated alias that a provider may repoint?
+ *
+ * `modelBasis: "actual"` says the provider answered rather than that we guessed — it does not say the
+ * answer names a fixed build. Measured across three archived runs: haiku came back
+ * `claude-haiku-4-5-20251001`, opus and sonnet came back `claude-opus-5` and `claude-sonnet-5`. All
+ * three were recorded identically as observed, and two of them name something the provider can move
+ * underneath us. A snapshot rotation behind either alias between two runs leaves EXACTLY that record and
+ * is invisible, which is how an A/B across time ends up eliminating the seat on evidence that could not
+ * have shown it either way.
+ *
+ * Returns "snapshot", "alias", or null when there is no id to judge — null is a could-not-look and is
+ * never collapsed into "alias". PURE.
+ */
+export function modelSnapshotKind(model) {
+  const id = String(model ?? "").trim();
+  if (!id) return null;
+  return DATE_SUFFIX_RE.test(id) ? "snapshot" : "alias";
+}
 export function modelFamily(model) {
   if (!model) return null;
   const resolved = resolveModel(String(model));
@@ -714,7 +766,7 @@ export const REGISTER_PROVIDER = (() => {
 // created this constant, so neither branch's tests covered it — it surfaced from reading the two diffs
 // side by side, not from a red run.
 //
-// SIX values now: 's `free-tier` composes the two free sources into ONE register, so an EU+US
+// SIX values now: the `free-tier` composes the two free sources into ONE register, so an EU+US
 // clearance needs no paid vendor. It is a TIER, not a fourth free source — precedence runs between
 // tiers, never within one: a paid vendor configured IS the register alone, and the free sources are not
 // run beside it (corsearch and clarivate already aggregate both offices, so the second call buys
@@ -1314,7 +1366,7 @@ export const PROVIDERS = {
   // It also gated the wrong thing in practice. The US index is the one piece of this tier an operator
   // cannot get in a minute — it is a 41.5 GB build over two bulk products, behind an account with ID.me
   // identity verification, and it takes hours — so requiring it made the free tier unusable for exactly
-  // the person it exists for. 's CODE was merged; the INDEX is what no box had, and that was enough
+  // the person it exists for. That CODE was merged; the INDEX is what no box had, and that was enough
   // to keep and from ever being exercised.
   //
   // The EU pair stays REQUIRED: a free tier with no configured member at all is not degraded, it is
@@ -1419,7 +1471,7 @@ export function providerIdFrom(env) {
   // the CURRENT spelling, through `currentName`, on purpose. Reading only the legacy name answered
   // `null` for a file that names the provider on the one line an operator can see, and `activeProvider`
   // reads that null as "this environment said nothing" and falls back to the ambient value. That is
-  // 's defect exactly, wearing the new name.
+  // That defect exactly, wearing the new name.
   for (const name of ["CLEAROTRON_DATABASE"]) {
     const v = String(env?.[name] ?? "").trim().toLowerCase();
     if (v) return v;

package/driver/e2e-rounds.mjs

@@ -4,7 +4,7 @@
 //
 // ── the defect this exists to remove ──────────────────────────────────────────────────────────
 //
-// 's noise floor needs the SAME scenario run twice on one commit. Until this module, `run` wrote
+// That noise floor needs the SAME scenario run twice on one commit. Until this module, `run` wrote
 // `_e2e-doors-<ID>.json` holding exactly one token and `report` scoped itself to whatever token it found
 // there — so the second run of a pair OVERWROTE the only record of the first round's token, and the
 // first half became unreportable. Silently: `report` then described the second run, thirty seconds into
@@ -305,7 +305,7 @@ function runStart(hit) {
 /**
  * The rounds visible ON DISK, grouped by round token.
  *
- * `untokened` counts runs whose ref carries no round token — a pre- round, or one submitted by
+ * `untokened` counts runs whose ref carries no round token — a pre-change round, or one submitted by
  * hand. They belong to no nameable round, and saying how many there are is the difference between
  * "these are all the rounds" and "these are the rounds I could name".
  */

package/driver/effort-model.mjs

@@ -223,7 +223,7 @@ export const costBand = (i) => Math.max(1, Math.min(5, Math.ceil(effortUnits(i)
  * WHAT THIS REPLACED, and why a constant beat a model. The old quote was a base plus one adder per lane:
  * 1.5h, +0.5 for case law, +0.5 for a native-language lane, +0.5 for a single territory. It missed the
  * actual wall by +66%, +82% and −22% on three consecutive delivered runs, in BOTH directions, on one
- * engine build in one night ('s table). Every wall I could find from either source, eight runs:
+ * engine build in one night (the table). Every wall I could find from either source, eight runs:
  *
  *     quoted 1.5h  ×6   →  actual 2.23  2.28  2.38  2.40  2.49  2.49
  *     quoted 3.0h  ×1   →  actual 2.33      (the run with the MOST lanes came in SHORTER than five others)
@@ -246,7 +246,7 @@ export const TURNAROUND_QUOTE = Object.freeze({
   clearance: Object.freeze({ lowHours: 1.5, highHours: 2.5 }),
   // — OWNER RULING: a knockout quotes 5-10 MINUTES, a range, not a flat figure.
   //
-  // The flat 0.25 came from 's "no compute, just say it, keep it simple", and that ruling is
+  // The flat 0.25 came from the "no compute, just say it, keep it simple", and that ruling is
   // untouched here: this is still one stated figure per pipeline with nothing computed from levers. What
   // changed is the figure, and the shape of it.
   //

package/driver/engine/anthropic-agent.mjs

@@ -102,7 +102,7 @@ const engineMaxBufferChars = () => Math.max(1024, Number(process.env.CLEAROTRON_
 // `gemini-flash: "sonnet"`, `deepseek-v4-pro: "opus"` and `azure: "sonnet"`, and the fall-through below
 // mapped ANY unrecognised alias to "sonnet". So `--model gemini` ran sonnet while the telemetry logged
 // `google/gemini-3.1-pro-preview` (gateway stamps `resolveModel(<requested alias>)`), and every
-// attribution downstream of that row — the A/B arm, the token rollup, 's billing classes — was
+// attribution downstream of that row — the A/B arm, the token rollup, the billing classes — was
 // keyed to a model that never ran. Nothing said so, because a substitution has no error to report.
 //
 // The four cross-provider aliases were already dead before this change: the model-failover chain was
@@ -237,7 +237,7 @@ export function absolutizeSkillRefs(message, skillsDir, resolve = null) {
 //
 // ANTHROPIC-ONLY, AND MEASURED RATHER THAN ASSUMED. The obvious next step is to apply the same rule to
 // openai-agent's `--add-dir` (buildCodexArgs pushes the identical root), and it would accomplish nothing:
-// that engine spawns with `cwd = resolveSpawnCwd({cwd, runDir})` — the RUN DIR (, deliberately) —
+// that engine spawns with `cwd = resolveSpawnCwd({cwd, runDir})` — the RUN DIR (deliberately) —
 // under `--sandbox workspace-write`, which makes cwd a writable root on its own. Dropping the flag there
 // would remove a grant the seat still holds by another door and let this comment claim an isolation the
 // engine does not have. Codex-side isolation is a cwd question, and a separate decision.
@@ -377,7 +377,7 @@ export function writeBoundarySettings({ skillsRoots = [], profilesDir = null, ru
   return JSON.stringify({
     hooks: {
       PreToolUse: [{
-        // tracker issue 997 — Bash is in the matcher because seats have it and it walked past this hook entirely.
+        // Bash is in the matcher because seats have it and it walked past this hook entirely.
         // What the Bash arm can and cannot do is stated at its declaration in deny-authority-write.mjs;
         // it is a detector, and naming it here does not make it a boundary.
         matcher: "Write|Edit|MultiEdit|NotebookEdit|Bash",
@@ -401,7 +401,7 @@ export function synthesizeEnvelope({ resultEvent, usage, killed }) {
 
 export const anthropicAgentEngine = {
   name: "anthropic-agent",
-  // tracker issue 954 — WHAT THIS ENGINE GUARANTEES ABOUT SEAT WRITES, said out loud in the run record.
+  // WHAT THIS ENGINE GUARANTEES ABOUT SEAT WRITES, said out loud in the run record.
   // `deny-authority-write.mjs` is a `claude -p` PreToolUse hook, so it refuses a seat's writes into the
   // doctrine tree, the profile store and `<runDir>/_driver/` at the moment of the write. That is a real
   // boundary and this engine has it.
@@ -409,7 +409,7 @@ export const anthropicAgentEngine = {
   async runTurn({ message, model, thinking, timeoutSec, resumeRef, mcpConfig, allowedTools, cwd, skillsDir, skillsGrantRoots, profilesDir, resolveSkill, runDir, seatWrites = null, stallSec, progressFiles } = {}) {
     if (!message) throw new Error("anthropic-agent.runTurn: message is required");
     const { args, input, grantNote } = buildClaudeArgs({ message, model, thinking, resumeRef, mcpConfig, allowedTools, cwd, skillsDir, skillsGrantRoots, profilesDir, resolveSkill, runDir, seatWrites });
-    // tracker issue 1022 — the cross-check speaks. Driver stderr is what an operator reads, and it is where the other
+    // the cross-check speaks. Driver stderr is what an operator reads, and it is where the other
     // drift notices in this engine already land ([ledger], [env-aliases], [queue-watch]).
     if (grantNote) process.stderr.write(`${grantNote}\n`);
     const t0 = Date.now();
@@ -435,7 +435,7 @@ export const anthropicAgentEngine = {
       // inheriting that would load the dev-assistant instructions into every stage (context pollution +
       // cost). It also avoids the EACCES when the inherited cwd is unreadable by the runner's user.
       //
-      // tracker issue 524 — cwd is a granted WRITE root here (file tools are confined to cwd + --add-dir), so it is
+      // cwd is a granted WRITE root here (file tools are confined to cwd + --add-dir), so it is
       // the run dir when there is one. See resolveSpawnCwd in common.mjs for why, and for what it deletes.
       const spawnCwd = resolveSpawnCwd({ cwd, runDir });
       // stdin is a PIPE (not "ignore"): the prompt rides stdin, not a `-p` argv element, so it is never
@@ -446,7 +446,7 @@ export const anthropicAgentEngine = {
       // Detached makes claude its own process-group leader, so the watchdog's kills reach the whole tree.
       try { child = spawn(claudeBin(), args, { stdio: ["pipe", "pipe", "pipe"], cwd: spawnCwd, env: spawnEnv(), detached: true }); }
       catch (e) { return resolve(errResult(t0, e, resumeRef)); }
-      // tracker issue 2076 — THE SECOND SPAWN PATH, and it has to record too. This engine does not go
+      // THE SECOND SPAWN PATH, and it has to record too. This engine does not go
       // through runStreamingChild; wiring one and assuming the other follows is the exact defect shape
       // 2122 was raised on the same day (the demo banner reached the clearance renderer and not the
       // knockout one). Best effort, never fatal.
@@ -525,7 +525,7 @@ export const anthropicAgentEngine = {
       // (A repeat of an already-recorded path is NOT truncation — nothing is lost.)
       const READS_CAP = 500;
       let readsTruncated = false;
-      // ── tracker issue 1111 — THE TWO NUMBERS THAT MAKE A SLOW TURN A DIAGNOSIS RATHER THAN AN INFERENCE ────────
+      // ── THE TWO NUMBERS THAT MAKE A SLOW TURN A DIAGNOSIS RATHER THAN AN INFERENCE ────────
       //
       // `tokensPerSec` says so itself: "the denominator still contains the turn's own tool waits… it
       // records the ratio; it does not diagnose it." Establishing that a slow stage was WAITING rather
@@ -543,7 +543,7 @@ export const anthropicAgentEngine = {
       let toolCalls = 0;
       let toolWaitMs = 0;
       let toolAskedAt = null;
-      // tracker issue 1111 — WHAT THE WAIT IS MADE OF, keyed by the tool(s) that caused it.
+      // WHAT THE WAIT IS MADE OF, keyed by the tool(s) that caused it.
       //
       // The total alone cannot answer the question it was collected for. "Exclude tool wait from the kill
       // clock because a turn waiting on a tool is the harness working" is TRUE of `register_execute_plan`
@@ -554,7 +554,7 @@ export const anthropicAgentEngine = {
       // sorted set joined by "+". Every millisecond is attributed exactly once and the values sum to
       // `toolWaitMs` — a per-name split would double-count a concurrent ask and quietly break that identity.
       let toolAskedNames = null;
-      // tracker issue 1828 — WHICH CHUNK an ask arrived in. Every line in one stdout chunk is parsed in
+      // WHICH CHUNK an ask arrived in. Every line in one stdout chunk is parsed in
       // one synchronous loop, so they all share a single Date.now(). If an ask and its result land in
       // the SAME chunk, the parent was not running between them and the gap it measures is 0 — for a
       // wait that really happened. Reproduced deterministically by blocking this process's event loop:
@@ -595,7 +595,7 @@ export const anthropicAgentEngine = {
       const openAsks = [];             // ask records still outstanding, oldest first
       const askById = new Map();       // tool_use_id → its ask record
       let periodStart = null;          // when the current outstanding-SET period began
-      let periodChunk = null;          // the chunk it began in — tracker issue 1828's unmeasurable flag
+      let periodChunk = null;          // the chunk it began in — the unmeasurable flag
       let anonSeq = 0;                 // ids are on the wire, but never assume: synthesize if absent
       const periodKey = () =>
         [...new Set(openAsks.flatMap((r) => r.names))].sort().join("+");
@@ -709,7 +709,7 @@ export const anthropicAgentEngine = {
           progress();
         }
         else if (ev.type === "user") {
-          // tracker issue 1111 — the result of the ask above. Only counted when an ask is outstanding, so a `user`
+          // the result of the ask above. Only counted when an ask is outstanding, so a `user`
           // event with no preceding tool_use adds nothing rather than charging the turn for a gap it
           // never spent waiting.
           // Which ask is this the result OF? The id on the wire answers it. Falling back to the
@@ -776,7 +776,7 @@ export const anthropicAgentEngine = {
       const watchdog = setInterval(() => {
         artifactProgress();
         const now = Date.now();
-        // tracker issue 1780 — THE STARTUP DEBT. tracker issue 1692 widened the deadline below until the first byte but left this
+        // THE STARTUP DEBT. tracker issue 1692 widened the deadline below until the first byte but left this
         // clock's ORIGIN at spawn, so the startup interval stayed on the meter: the moment the grace let
         // go, progIdle already WAS the whole boot, and any NOPROG shorter than startup had expired before
         // the child was observed at all. The kill then landed on the next tick, before the ask could reach
@@ -784,7 +784,7 @@ export const anthropicAgentEngine = {
         // Releasing a clock is not starting one: the first byte is this clock's origin, not its green light.
         const progFrom = firstOutputAt === null ? lastProgress : Math.max(lastProgress, firstOutputAt);
         const idle = now - lastMove, progIdle = now - progFrom;
-        // ── tracker issue 1692 — STARTUP IS NEITHER SILENCE NOR WORK ──────────────────────────────────────────────
+        // ── STARTUP IS NEITHER SILENCE NOR WORK ──────────────────────────────────────────────
         // Every clock here USED TO start at SPAWN, so until the child's first byte they were all timing
         // process startup: an idle clock that had not yet seen silence, and an active clock that had not
         // yet seen work. Past tense deliberately — tracker issue 1780 finished this, and the sentence stayed true of
@@ -800,7 +800,7 @@ export const anthropicAgentEngine = {
         // kill it NOW, well below the wall, and record it as a STALL — never let the ceiling raise turn
         // into extended stall burn, and never let this kill read as "the stage needed more time".
         else if (progIdle >= (started ? NOPROG : Math.max(NOPROG, GRACE))) { stallKill = true; noProgressKill = true; killed = true; killTree(); }
-        // ── tracker issue 1111 — THE CEILING MEASURES ACTIVE TIME, NOT ELAPSED ────────────────────────────────────
+        // ── THE CEILING MEASURES ACTIVE TIME, NOT ELAPSED ────────────────────────────────────
         //
         // Owner ruling: "there isnt such thing as a hung model. it always delivers something or fails."
         // So this ceiling exists for the harness's own failure modes, not to budget the model, and a turn
@@ -824,7 +824,7 @@ export const anthropicAgentEngine = {
         // quantity: a long turn has three causes — tool latency, a generation stall, and sheer VOLUME
         // (one healthy stage ran 40.9 minutes at a normal rate producing 186k tokens) — and nothing that
         // keys on elapsed can tell them apart.
-        // tracker issue 1692: measured from the FIRST BYTE, never from spawn. Startup is not active time either, and
+        // measured from the FIRST BYTE, never from spawn. Startup is not active time either, and
         // against a tight pin it was the whole budget — a 900ms spawn hit a 500ms ceiling having done
         // nothing at all, and the turn died carrying `hardWall` with zero tool calls to explain it.
         else if (started && activeElapsedMs({ wall: now - firstOutputAt, toolWaitMs, toolAskedAt, now }) >= hardMs) {
@@ -840,7 +840,7 @@ export const anthropicAgentEngine = {
       child.stdout.on("data", (d) => {
         if (settled || overflow) return;
         if (firstOutputAt === null) firstOutputAt = Date.now();   // #1692 — the child has spoken; startup is over
-        chunkSeq += 1;                                            // tracker issue 1828 — see toolAskedChunk
+        chunkSeq += 1;                                            // see toolAskedChunk
         chunkBytes = d.length;
         chunkGapMs = prevChunkAt === null ? 0 : Date.now() - prevChunkAt;
         prevChunkAt = Date.now();
@@ -852,7 +852,7 @@ export const anthropicAgentEngine = {
       });
       child.stderr.on("data", (d) => {
         if (settled || overflow) return;
-        // tracker issue 1813 — STDERR DOES NOT START THE CLOCKS, and this line used to. This engine's protocol is
+        // STDERR DOES NOT START THE CLOCKS, and this line used to. This engine's protocol is
         // stream-json on STDOUT; stderr carries node warnings and CLI notices, which a child can emit
         // before it has done anything at all. Treating one as "the child has spoken" ended the grace and
         // — since tracker issue 1780, which made the first byte the progress clock's ORIGIN — started that clock too,
@@ -870,7 +870,7 @@ export const anthropicAgentEngine = {
       child.on("error", (e) => { if (settled) return; settled = true; clearInterval(watchdog); resolve(errResult(t0, e, resumeRef)); });
       child.on("close", (code) => settle(code));
       function settle(code) {
-        // tracker issue 2076 — the turn is over; the record must not outlive it, and is cleared only if
+        // the turn is over; the record must not outlive it, and is cleared only if
         // it still names THIS child.
         clearEngineChild(runDir, child?.pid);
         if (settled) return; settled = true;
@@ -889,7 +889,7 @@ export const anthropicAgentEngine = {
         // defect from the inside.
         const endedAt = Date.now();
         const wall = (endedAt - t0) / 1000;
-        // tracker issue 1111 — THE TWO CLOCKS MUST TILE THE WALL, in every case including the one that matters.
+        // THE TWO CLOCKS MUST TILE THE WALL, in every case including the one that matters.
         //
         // A turn killed mid-tool-call has an OPEN ask that `toolWaitMs` has not closed. Reporting the
         // unclosed accumulator left `activeMs + toolWaitMs` short of the wall by exactly that gap — and
@@ -924,7 +924,7 @@ export const anthropicAgentEngine = {
         const stderrOut = overflow
           ? (stderr + `\nanthropic-agent output overflow: stdout/stderr exceeded ${maxBuffer} chars — killed the tree and failed the turn (truncated tail never parsed)`)
           : noProgressKill
-            // tracker issue 1780 — THE SPECIMEN RIDES THE FAILURE, because the broken state expires. This kill has
+            // THE SPECIMEN RIDES THE FAILURE, because the broken state expires. This kill has
             // twice reddened `main` from a test whose ANTI-VACUITY check failed — the turn died having
             // opened no tool ask — and neither the box's ambient load nor a full-suite run reproduces
             // it on demand. So the discriminating bit is recorded HERE, where the kill happens, rather
@@ -962,11 +962,11 @@ export const anthropicAgentEngine = {
           // from this list is unreliable and the consumer must downgrade it to "not observed").
           reads: [...reads], readsTruncated,
           toolCalls, toolWaitMs: settledToolWaitMs,   // #1111 — two integers, no content
-          // tracker issue 1780 — ms from spawn to the child's FIRST byte, or null when it never spoke. RECORDING
+          // ms from spawn to the child's FIRST byte, or null when it never spoke. RECORDING
           // ONLY: nothing branches on it. A recording field is protected by a test or by nothing, so
           // engine.anthropic.test.mjs pins it — deleting it must red something.
           firstByteMs: firstOutputAt === null ? null : Math.round(firstOutputAt - t0),
-          // tracker issue 1111 — WHICH CLOCK RAN OUT, and WHAT the wait was made of.
+          // WHICH CLOCK RAN OUT, and WHAT the wait was made of.
           //
           // The hard wall measures ELAPSED, and elapsed includes time the model spent waiting on tools
           // rather than generating. A wall kill whose elapsed is mostly tool wait is a different event from
@@ -982,7 +982,7 @@ export const anthropicAgentEngine = {
           // "this record predates the gauge".
           activeMs: Math.max(0, Math.round(wall * 1000) - settledToolWaitMs),
           toolWaitByTool: { ...toolWaitByTool },
-          // tracker issue 1828 — the asks whose wait this process COULD NOT MEASURE, because the ask and
+          // the asks whose wait this process COULD NOT MEASURE, because the ask and
           // its result were delivered in one chunk. An ARRAY is a measurement (possibly `[]`: measured,
           // nothing unmeasurable), following toolWaitByTool's own rule that absence and "cannot report"
           // must not look alike. `toolWaitMs` and the per-tool split are untouched.

package/driver/engine/auth.mjs

@@ -20,7 +20,7 @@
 // spelling list let the OpenAI half decide how an Anthropic run bills. deleted the old names, so
 // there is one variable, only the selected engine is ever consulted, and the hazard has no route left.
 //
-// And deliberately written OUT at each site rather than through a helper: 's guard in
+// And deliberately written OUT at each site rather than through a helper: the guard in
 // `env-governance.test.mjs` finds a product read by the literal `env.NAME`, so a helper taking the
 // name as an argument makes both reads invisible to it — measured, it turned them harness-only and
 // put both names on the "no longer read by product code" list. The repetition is what keeps them