clearotron 0.2.1 → 0.2.3

package/driver/findings-model.mjs

@@ -81,7 +81,7 @@ export const DISPOSITIONS = ["adversarial", "coexistence-partner", "distinguishe
 // FLOOR 6 and was written as this MOVING constant, which was the same number on the day it was written.
 // Bumping here alone would have made every archived v6 run — v6 shipped 2026-08-03, so real delivered
 // matters carry it — republish through pool-admin doRepublish with the ground-grouped reasoned
-// negatives silently replaced by the pre- region-grouped section. Not a crash: a substance change to
+// negatives silently replaced by the pre-change region-grouped section. Not a crash: a substance change to
 // a report already sent to a client, which is what the render freeze exists to catch. MEASURED at the
 // break: 34,722 → 36,466 body bytes on a three-negative v6 fixture. That line now reads `>= 6`.
 //
@@ -168,8 +168,8 @@ export const ACTION_KINDS = [...CONDITION_KINDS, ...ADVISORY_KINDS];
 export const CLIENT_TIER_BY_COMPOSITE = { 1: "LOW", 2: "MANAGEABLE", 3: "MEDIUM", 4: "HIGH", 5: "VERY HIGH" };
 
 // ── doc 50 — band mode (schema_version 4): the framework in force rates the matter ────────────────────
-// A v4 finding carries `band` — one of the frozen framework manifest's ordered band words (zephyr says
-// "Medium", the Generic default says "Moderate", aurora has a "Low") — and NO composite/level/
+// A v4 finding carries `band` — one of the frozen framework manifest's ordered band words (one ladder
+// says "Medium", the Generic default says "Moderate", another has a "Low") — and NO composite/level/
 // dispute_type (one rating authority; the retired scale is FORBIDDEN, not just optional). Presentation
 // joins on the band's TONE (a closed enum in the manifest) so 4-band and 5-band ladders both land on the
 // existing badge/gauge ramps without any per-framework code.
@@ -539,7 +539,7 @@ export function sentenceCaseLead(s) {
   return str.slice(0, m[1].length) + m[2].toUpperCase() + str.slice(m[1].length + m[2].length);
 }
 
-// ── tracker issue 601 — THE ONE BOUND AN ASK STILL HAS, AND THE ONLY ONE ─────────────────────────────────────────
+// ── THE ONE BOUND AN ASK STILL HAS, AND THE ONLY ONE ─────────────────────────────────────────
 // The verdict statement renders in index cells, run status, the report hero, the email headline and the
 // xlsx Verdict row — one row each, so an unbounded first condition would swallow the row. This is the
 // last surface in the product that shortens an ask, and it is the honest one: `clipClause` marks the cut
@@ -813,7 +813,7 @@ const onlyKeys = (obj, allowed, tokenFor) => {
  *   | finding_bears_on_invalid:<ordinal> | finding_disposition_invalid:<v> | finding_impact_invalid:<ordinal>
  *   | finding_deadline_invalid:<ordinal> | finding_deadline_key_unknown:<key> | finding_deadline_date_missing:<ordinal>
  *   | findings_context_note_invalid | findings_context_note_key_unknown:<key> | findings_context_note_type_invalid:<v>
- *   | findings_net_chained:<ordinal>   (, v7 only — PLURAL on purpose; see validateNetShape)
+ *   | findings_net_chained:<ordinal>   (v7 only — PLURAL on purpose; see validateNetShape)
  * (the composite>=3 NON-EMPTY-source gate for use_check/own_rights is raised by the caller in verify.mjs —
  *  this parser only enforces SHAPE: object / key-allowlist / source-is-a-string. Both fields are OPTIONAL.)
  *
@@ -1210,7 +1210,7 @@ export function parseFindingsJsonLenient(raw, opts = {}) {
 // A1: a withdrawn finding is a non-mergeable singleton — folding a LIVE filing into a
 // withdrawn base (or vice versa) would either resurrect a killed conflict or silently kill a live
 // one. The `~withdrawn~` suffix keeps it in its own group without touching live-group keys.
-// ── A LATIN NORMALISER STANDING WHERE A COMPARISON SHOULD BE ('s class, third site) ─────────────
+// ── A LATIN NORMALISER STANDING WHERE A COMPARISON SHOULD BE (the class, third site) ─────────────
 //
 // `[^a-z0-9]` folds a CJK, Cyrillic or Arabic value to the EMPTY STRING, and this key is built from two
 // of them. Measured on origin/main before the fix:
@@ -1642,7 +1642,7 @@ function validateBand(f, ord, mode) {
 //   · FACTS AND ASSESSMENT, NEVER AN ACTION PRESCRIPTION. The reader is a lawyer who layers their own
 //     advice on top. The house prose contract already rules prescriptions out everywhere; on this field
 //     it is checked, because it is the sentence most likely to drift into advice.
-//   · A CONCLUSION, NEVER A CHAIN (, 2026-08-06). See validateNetShape below for the ruling, the two
+//   · A CONCLUSION, NEVER A CHAIN (2026-08-06). See validateNetShape below for the ruling, the two
 //     mechanical markers it refuses, and why it is the one net rule that had to be version-gated.
 //   · STILL NO LENGTH MAXIMUM, and now for a second reason. It never came from the validator (a model
 //     told to be brief writes a shorter sentence and drops a fact), and build 1.3 deletes the renderer's
@@ -1670,7 +1670,7 @@ const PRESCRIPTION_RE = /\b(we recommend|we advise|we suggest|you should|should
 //   · NOT A QUALITY JUDGMENT. "Does this read as a conclusion" is the lawyer's call and the reviewer
 //     stage's; code cannot make it without re-judging the finding, which is the rules-engine failure
 //     this codebase keeps refusing.
-//   · NOT THE WORD "so". 's prose names "a semicolon, an arrow, or the word so", but a word match is
+//   · NOT THE WORD "so". That prose names "a semicolon, an arrow, or the word so", but a word match is
 //     not mechanical: it fires on "also", "so-called", "so long as the owner". Punctuation cannot be
 //     mistaken for anything else, and the prose rule survives in synthesis-rules.md where a reader
 //     applies judgment to it.
@@ -1910,7 +1910,7 @@ function recordUrlOrigin(value) {
  * `"not a url"` and `mailto:…` at this site — a documented decision that the host gate does not judge
  * them. A blanket not-a-URL rule refutes it silently. So this refuses exactly the shapes names:
  * a fragment (addresses THIS document, never a record), a bare path (names no host), and whitespace
- * (a value that is only shaped like one). Anything else is still 's to rule on.
+ * (a value that is only shaped like one). Anything else is still the to rule on.
  *
  * That leaves `mailto:…` and free text composing a live-but-wrong href rather than a dead anchor. It is
  * a real gap and it is NOT this issue's class; recorded on rather than widened into here.
@@ -2275,7 +2275,7 @@ export function validateKnockoutFinding(f, idx, seenOrdinals = new Set(), opts =
       throw new Error(`knockout_finding_band_invalid:${kshort(f.band)} (this run's framework "${manifest.framework_key}" rates in EXACTLY these words: ${manifest.bands.map((b) => b.label).join(" / ")})`);
     f.band = canonical;
   }
-  // THE CONCLUSION SENTENCE — 's contract, unchanged, on the other product. One rule, one gate: a
+  // THE CONCLUSION SENTENCE — the contract, unchanged, on the other product. One rule, one gate: a
   // knockout card and a clearance card are read by the same lawyer in the same week.
   if (typeof f.net !== "string" || !f.net.trim())
     throw new Error(`knockout_finding_net_missing:${ord} (every knockout finding carries the one conclusion sentence the card leads with — see synthesis-rules.md "The finding sentence")`);
@@ -2441,6 +2441,56 @@ export function knockoutFindingViews(mark, { manifest = null } = {}) {
  * Derived through knockoutFindingViews rather than re-deriving that fallback here — one projection
  * decides what a finding's number is, and this cell cannot disagree with the sheet it points into.
  */
+// ── THE REVIEWER'S NOTES: WHAT EACH ONE IS ABOUT (tracker issues 331 A.4, 333 rule 5) ───────────────
+//
+// The knockout page prints a note about the REQUEST at the top, above the conflicts, and a note about
+// the NAME under that name's cards. A note saying the screen may have been scoped to the wrong market
+// is the most consequential line on the page and it used to sit under roughly 1,900 words.
+//
+// THE READER LIVES HERE BECAUSE TWO MODULES NEED THE SAME ANSWER. The renderer sorts the notes; the
+// predelivery lint warns a writer whose note will sort the way they did not intend. Two copies of this
+// regex would drift, and the drift would be silent — the page would file a note one way while the
+// reviewer told the writer it went the other.
+//
+// IT SORTS ON WHAT THE NOTE TALKS ABOUT, and the doctrine is written to match: a note about the request
+// NAMES the request. The word set spans both vocabularies deliberately — "dispatch" and "instructed"
+// are what runs written before tracker issue 333 say, "the request" and "was asked" are what runs
+// written after it say — so one reader serves the archive and the new doctrine at once.
+export const REQUEST_NOTE_WORDS = /\b(?:dispatch|the request|the requester|instructed|was asked)\b/i;
+
+// Subjects that belong to the ASKING rather than to the name. A note on one of these that never names
+// the request will be filed under the name, which is why the lint flags it rather than the page
+// guessing: the fix is one clause in the note, and only its writer can add it.
+export const REQUEST_SUBJECT_WORDS =
+  /\b(?:customer industry|client(?:'s)? (?:own )?(?:prior|earlier) use|prior use|intended goods|the goods we|wrong market|described as an? )/i;
+
+/** One note, in either shape, as { text, about }. `about` is null when nothing has classified it. */
+export function knockoutNoteView(n) {
+  if (n && typeof n === "object" && !Array.isArray(n)) {
+    const about = String(n.about ?? "").trim().toLowerCase();
+    return { text: String(n.text ?? n.note ?? "").trim(), about: about === "request" || about === "name" ? about : null };
+  }
+  return { text: String(n ?? "").trim(), about: null };
+}
+
+/**
+ * A mark's notes, split into the two places the page prints them.
+ *
+ * The rater's own `about` wins outright where one is given; only an unclassified note meets the word
+ * reader. That precedence is the whole design: it means a run written under a doctrine that no longer
+ * uses these words is answered without them.
+ */
+export function splitKnockoutNotes(mark) {
+  const all = (Array.isArray(mark?.purpleNotes) ? mark.purpleNotes : []).map(knockoutNoteView).filter((v) => v.text);
+  const request = [];
+  const name = [];
+  for (const v of all) {
+    const isRequest = v.about ? v.about === "request" : REQUEST_NOTE_WORDS.test(v.text);
+    (isRequest ? request : name).push(v.text);
+  }
+  return { request, name, all: all.map((v) => v.text) };
+}
+
 export function knockoutFindingRange(mark) {
   const ords = knockoutFindingViews(mark).map((v) => v.ordinal).sort((a, b) => a - b);
   const markName = String(mark?.name ?? "").trim();

package/driver/flag-snapshot.mjs

@@ -318,6 +318,26 @@ export function postureDisagreement(snapshot, live) {
     "silent-output-change — a different engine answers differently and nobody is told");
   differ("billing mode", snapshot.engine?.billing?.mode ?? null, live.engine?.billing?.mode ?? null,
     "what a run costs, and who it is billed to");
+  // THE FIELD THAT DECIDES WHETHER A SEARCH CAN START, and the one this comparison could not see.
+  //
+  // The configuration page reads the LIVE posture and the New clearance screen reads this capture, so a
+  // box where they differ on this one boolean draws a green Engine row on one screen while the other
+  // replaces its start button with "no search engine is attached". That is not a hypothetical: it is
+  // what an outside user photographed, and he gave up on the product because the greener screen looked
+  // more authoritative. Both readings were correct about their own question and nothing compared them.
+  //
+  // Worse than silence, before this line: `disagrees` came back `[]` — which this page renders as "the
+  // last run ran under this same configuration". The one field they actually disagreed on was not in the
+  // comparison, so the page positively affirmed agreement while the two surfaces contradicted each other.
+  // STRINGS, NOT THE BOOLEANS THEMSELVES. Every other row here compares names and modes, so the browser
+  // contract parses `capture` and `live` with `asString` — handed `false` it yields null, and the row
+  // would reach the page with its two values blank and only the effect sentence left. The words are also
+  // the better answer for a reader: "found" against "not found" says it without a legend.
+  const found = (v) => (v === true ? "found" : v === false ? "not found" : null);
+  differ("engine program", found(snapshot.engine?.binaryPresent), found(live.engine?.binaryPresent),
+    "whether a NEW search can start — the engine that last ran and this deployment do not agree that the "
+    + "engine program can be found, so one screen offers a search the other refuses. Restart the engine "
+    + "service so it re-reads its PATH, or install the CLI where the service can see it");
 
   // Flags: compare only names BOTH sides declare, for the same reason `differ` skips absent values —
   // a build that adds a flag must not read as every older capture disagreeing with it.

package/driver/floor-duty.mjs

@@ -93,7 +93,7 @@ export const FLOOR_DUTY_STAGE = "placement-inquiry";
  * the chance to place the floor or name it with a ground.
  *
  * SAFE TO RE-RUN, and that is measured rather than hoped: the placement form is UNIONED into an
- * accumulator before it is judged and `placements.json` is rendered from the accumulator (, after an
+ * accumulator before it is judged and `placements.json` is rendered from the accumulator (after an
  * incident where a killed attempt's finished tiers were thrown away). A second pass merges; it does not
  * start from nothing.
  *

package/driver/form-neighbourhood.mjs

@@ -483,7 +483,7 @@ export function floorSeeds(manifestMd, { model = null, mark = "" } = {}) {
   //
   // It is NOT fixed by romanising. variantCompletenessGaps' per-script floor validates and never
   // generates, on the stated principle that the moment code mints a search term, judgment has moved into
-  // the funnel — and that was 's own reason for excluding non-rule-based transliteration. A
+  // the funnel — and that was its own reason for excluding non-rule-based transliteration. A
   // romanisation is a minted term. So the deterministic floor genuinely does not exist for this mark, and
   // the honest move is to say which mark, and why, where a reader will see it.
   if (!seeds.length) {

package/driver/framework.mjs

@@ -97,12 +97,12 @@ export function parseFrameworkManifest(raw) {
   return m;
 }
 
-/** Load + parse the manifest sitting beside a framework .md. rootDir is the prelim-driver dir (the dir
+/** Load + parse the manifest sitting beside a framework .md. rootDir is the clearotron-driver dir (the dir
  *  skills/ paths are relative to — the same base reads() uses). */
 // `rootDir` may be a string (legacy: join against it) OR a resolver function taking the manifest's
 // skills-relative path and returning an absolute one — the layered overlay-over-base lookup
 // (driver.config.resolveSkillPath). The driver MUST resolve a framework exactly as the agent does, or the
-// two read different files: that divergence is what killed the first Aurora Interactive run (framework_manifest_missing
+// two read different files: that divergence is what killed a test account's first run (framework_manifest_missing
 // against the bundled tree while the agent was pointed at the config store).
 export function loadFrameworkManifest(rootDir, fwPath) {
   const rel = manifestPathFor(fwPath);

package/driver/gateway.mjs

@@ -13,7 +13,8 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, wri
 import { join, dirname, basename } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
 import { tmpdir } from "node:os";
-import { config, resolveModel, modelFamily, envOn, envGateOn } from "./driver.config.mjs";
+import { config, resolveModel, modelFamily, modelSnapshotKind, envOn, envGateOn, preflightEngineBinary } from "./driver.config.mjs";
+import { probeCliVersion } from "./engine/cli-version.mjs";
 import { stageLog, runLog, note, outputMeta } from "./log.mjs";
 // — the closed disposition set has ONE author; this file dictates it and must not retype it.
 import { DISPOSITIONS, POSITION_REQUIRED_DISPOSITIONS } from "./findings-model.mjs";
@@ -42,7 +43,7 @@ import { FINDINGS_FILE as REGISTER_FINDINGS_FILE, refusalsFor as registerDigestR
 // file edit, and this table is what the warm patch reads to know that. It grows by one row per conversion,
 // so its membership IS the conversion record — and a stage absent from it still gets the write-mode tails,
 // correctly, because its seat still holds Write.
-// EXPORTED for 's agreement guard, which derives each recording stage's artifact from this table
+// EXPORTED for the agreement guard, which derives each recording stage's artifact from this table
 // rather than from a second hand-written list: stage → its granted record tool → the row whose `tool`
 // matches → the basename. A conversion that adds the grant and forgets the row leaves the guard unable to
 // name an artifact for that stage, and it fails there rather than quietly checking one direction less.
@@ -577,7 +578,7 @@ export function selectEngine() {
 //      move-blindness this repo has counted seven instances of.
 //
 // What died here with the form path (2026-08-17 owner ruling, delete-not-gate): reading the seat's file
-// as a SUBMISSION, preserving it, refereeing whose bytes it held ('s isDriverOwnBytes machinery) and
+// as a SUBMISSION, preserving it, refereeing whose bytes it held (the isDriverOwnBytes machinery) and
 // rewriting the seat-facing copy. The seat writes no file, so there is no submission to read, no bytes
 // to referee, and no seat-facing copy to keep in step. The capture duty moved to the receiver
 // (disposition-tool.mjs captureCall — the payload as handed to the process, indexed before the work).
@@ -618,14 +619,14 @@ export function syncDispositionForm(files) {
       let spec = null;
       try { spec = JSON.parse(readFileSync(specPath, "utf8")); }
       catch {
-        // No spec sidecar ⇒ a pre- archived resume: nothing dictated, nothing owed, nothing to count.
+        // No spec sidecar ⇒ a pre-change archived resume: nothing dictated, nothing owed, nothing to count.
         // A spec that EXISTS and does not parse is a different fact: the stage owes a sweep whose state
         // cannot be counted, and reading that as "owes nothing" would resume a session the veto exists to
         // refuse. The validator fails such a run on grid_spec_unreadable in its own lane.
         return existsSync(specPath) ? { countable: false } : null;
       }
       const formPath = spec?.connotation?.dispositions_path;
-      // No dictated path ⇒ a pre- spec (an archived run being resumed). Nothing to count, and the
+      // No dictated path ⇒ a pre-change spec (an archived run being resumed). Nothing to count, and the
       // gate has nothing to judge either — the two agree by construction.
       if (!formPath || spec?.connotation?.disposition_required !== true) return null;
       let recorded = null;
@@ -1142,6 +1143,25 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     const modelRequested = engine.resolveModelId ? engine.resolveModelId(model) : resolveModel(model);
     const modelActual = (typeof turn.modelWire === "string" && turn.modelWire) ? turn.modelWire : null;
     const modelBasis = modelActual ? "actual" : "unknown";
+    // WHETHER THE OBSERVED ID NAMES A FIXED BUILD. `modelBasis: "actual"` says the provider answered,
+    // not that the answer is pinned: two of the three tiers come back as undated aliases the provider
+    // may repoint, and recorded beside a dated one they read identically. null when there is nothing to
+    // judge, never collapsed into "alias".
+    const modelSnapshot = modelSnapshotKind(modelActual);
+    // WHICH BUILD OF THE TOOL SERVED THIS TURN. `modelSnapshot` above answers "did the model move";
+    // this answers "did the tool move", and the two have one symptom — a run whose judgment differs from
+    // last week's. Captured at dispatch rather than read back afterwards, because the binary a reader
+    // could probe later is not necessarily the one that ran.
+    //
+    // Written as an object with its own `probe` field, so an unreadable version is a RECORDED state
+    // rather than a missing one. Omitting it on failure would collapse "asked and could not say" into
+    // "written before anybody asked", which is the distinction the field exists for. One spawn per
+    // binary per process; a probe never throws, because taking down a dispatch to record a version
+    // would be a worse defect than the gap it closes.
+    const cli = (() => {
+      try { return probeCliVersion(preflightEngineBinary(process.env)?.resolved ?? null); }
+      catch (e) { return { version: null, probe: "unreadable", why: String(e?.message ?? e).slice(0, 160) }; }
+    })();
     if (modelActual) lastModelWire = modelActual;                       // — never overwritten with null
     // The comparison is by FAMILY (driver.config modelFamily), because `--model haiku` legitimately comes
     // back as `claude-haiku-4-5-20251001`. THREE-VALUED: null when either side names no family this
@@ -1337,7 +1357,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     // turn did not report completion, and completeness of its write is exactly what is unknown.
     // Still never applies to a rate-limit rejection either (0 tokens, nothing written).
     const killClass = isTaintRow({ fail, code, killed, signals: turn.signals });
-    // ONE artifact judgement, shared by both rescues below ('s rule: never a second, drifting copy of
+    // ONE artifact judgement, shared by both rescues below (the rule: never a second, drifting copy of
     // the contract). Present + written by THIS attempt (the per-attempt snapshot — an inherited file and
     // equally an earlier attempt's file never rescue a failed turn) + passes the stage's own validator.
     const attemptWroteTruth = () => {
@@ -1477,7 +1497,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     // and `rate_limited` drive retry policies this must not override. `modelMismatch` is journalled on
     // the row either way, so the mismatch is never lost — only the classification defers.
     //
-    // Default-ON gate through `envGateOn` ('s rule): `CLEAROTRON_MODEL_WIRE_CHECK=0` disarms it without
+    // Default-ON gate through `envGateOn` (the rule): `CLEAROTRON_MODEL_WIRE_CHECK=0` disarms it without
     // a deploy if a provider ever starts reporting an id this build's family regex misreads. Disarming
     // silences the REFUSAL, never the record — `modelActual`/`modelMismatch` keep landing on every row.
     if (modelMismatch === true && !fail && envGateOn("CLEAROTRON_MODEL_WIRE_CHECK")) {
@@ -1545,7 +1565,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
       // how a stale build-stage note came to describe a live field as dead. Measured on preserved runs
       // whose engine commit is byte-identical to this file: the R5 register-unit attempt row of 08-12
       // carries {input:8349, output:18374, cacheRead:1805815, cacheWrite:96608, total:1929146}. Every
-      // figure in 's own table is a verbatim read of these rows — the issue was minted BY reading
+      // figure in its own table is a verbatim read of these rows — the issue was minted BY reading
       // the field this comment called null. The shape is `mapUsage`'s canonical
       // {input, output, cacheRead, cacheWrite, total}, written by both engines
       // (anthropic-agent.mjs mapUsage, openai-agent.mjs from turn.completed).
@@ -1570,7 +1590,8 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         //   modelMismatch — true/false when both sides name a family, null when either does not.
         // Written even on the rows where they are null, so "this engine cannot report" stays visibly
         // different from "this record predates the gauge".
-        modelActual, modelBasis, modelMismatch,
+        modelActual, modelBasis, modelSnapshot, modelMismatch,
+        cliVersion: cli.version, cliVersionProbe: cli.probe, ...(cli.why ? { cliVersionWhy: cli.why } : {}),
         // W3 billing telemetry: which engine ran + the RESOLVED billing mode (subscription vs api-key). This
         // records INTENT (the mode the engine was configured to bill under), not independent billing evidence
         // — the actual proof is the provider console (claude's stream also reports apiKeySource; codex does
@@ -1696,7 +1717,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         stdoutTail: (fail && !json) ? streamDigest(turn.stdout) || undefined : undefined,
       });
       // AD-4 — `attempt` lands on run.jsonl too (ADDITIVE: _driver/<stage>.jsonl keeps the full per-attempt
-      // detail and 's harness keeps reading it there; run.jsonl gets the lean per-attempt spine it never
+      // detail and the harness keeps reading it there; run.jsonl gets the lean per-attempt spine it never
       // had — its readers previously saw one "stage" event with attempts:N and no causes, and the knockout
       // lane logs no stage events at all, so run.jsonl alone could not distinguish "no retries happened"
       // from "retries not recorded here"). Best-effort like every telemetry write.
@@ -1705,7 +1726,8 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           event: "attempt", stage: name, attempt, of: maxRetries + 1, ok: !fail, fail: fail ?? null,
           //: the spine carries the same pair as the per-stage log, or the two disagree about what
           // ran. `model` stays the requested resolution (its existing readers); `modelActual` is the wire.
-          model: modelRequested, modelActual, modelBasis, modelMismatch,
+          model: modelRequested, modelActual, modelBasis, modelSnapshot, modelMismatch,
+          cliVersion: cli.version, cliVersionProbe: cli.probe, ...(cli.why ? { cliVersionWhy: cli.why } : {}),
           wrote, warm: warm || undefined, warmEscalated: attempt === warmEscalatedAt || undefined,
           rescued: rescued ?? undefined, killed: killed || undefined,
           quiescentMs: Number.isFinite(quiescentMs) ? Math.round(quiescentMs) : undefined,   // — see the per-stage row
@@ -1999,7 +2021,7 @@ export function correctiveMessage(baseMessage, attempt, lastFail, expectFile, {
   if (!maxTok && !/^(invalid_file|missing_file)/.test(inner)) return baseMessage;
   const files = (Array.isArray(expectFile) ? expectFile : [expectFile]).filter(Boolean);
   const names = files.map(rel).join(", ");
-  // DIRECTION (b) — THE COLD CORRECTIVE IS A REPAIR SURFACE, AND 's SWEEP STOPPED AT THE WARM ONE.
+  // DIRECTION (b) — THE COLD CORRECTIVE IS A REPAIR SURFACE, AND the SWEEP STOPPED AT THE WARM ONE.
   //
   // `warmPatchMessage` consults TOOL_WRITTEN_ARTIFACTS and turns a repair into a CALL. This composer did not,
   // so a converted seat that hit the output ceiling was told to "CALL THE WRITE TOOL" for an artifact whose
@@ -2373,7 +2395,7 @@ export function correctionHint(lastFail, { gridLedgerName = "common-law-grid.jso
     // — THE REPAIR RIDES THE TYPED TOOL, because the seat no longer holds Write or Edit. This used to
     // end "Correct it in place — the file is the stage's only output", which after the conversion orders an
     // act the grant denies: a failure on obedience, mid-round, on the first repair rung that fires. Same
-    // shape as 's ten anchor sites, caught before it shipped rather than after. The one-change
+    // shape as the ten anchor sites, caught before it shipped rather than after. The one-change
     // invariant covers a dictation AND the ladder that corrects it.
     hint = `the model is a set of VALUES you hand to the \`record_blind_frame\` tool: dominant_element, ` +
       `variants[] (each {value, direction (add|drop|phonetic|homophone|neighbour|composite), rationale}), ` +
@@ -2830,7 +2852,7 @@ export function correctionHint(lastFail, { gridLedgerName = "common-law-grid.jso
   return hint;
 }
 
-// ── 's DEFERRED-SLICE BLOCK IS GONE ──────────────────────────────────────────────────────
+// ── the DEFERRED-SLICE BLOCK IS GONE ──────────────────────────────────────────────────────
 //
 // `deferredSlicesRequiredRows` composed a prose block listing every deferred qid and told the stage each
 // one "must appear VERBATIM in a Coverage-ledger row". Its own doc block recorded why it had to ship
@@ -2945,7 +2967,7 @@ const MAX_FORM_REPAIRS = 2;
 // wrote the quote. R6's four byte-identical attempts were not evidence that warm cannot fix this; they
 // were evidence that the seat was told to fix something else. The token now names the state and the arm
 // names the remedy, so there is something to change. A warm turn that STILL returns byte-identical output
-// is 's subject, not this one, and is handled where byte-identical output is detected.
+// is the subject, not this one, and is handled where byte-identical output is detected.
 // connotation_* (the family, via CONNOTATION_FORM_TOKEN_SRC; 2026-08-01 ruling, carried through B's
 // typed transport): WHY THESE ARE SAFE TO WARM. Every member is emitted only over an obligation set
 // built from `recorded.filter(e => e.results.length)` — a violation is therefore PROOF the meaning sweep
@@ -3022,12 +3044,12 @@ const WARM_ELIGIBLE_RE = new RegExp(`^(missing_file|invalid_file:[^:]*:(use_chec
 // instead of a resume, on every timeout, as a side effect of an attribution fix. A rename must not
 // change what a failure costs.
 //
-// The issue notes that 's argument applies: "the retry ladder cannot help a deterministic tool
+// The issue notes that the argument applies: "the retry ladder cannot help a deterministic tool
 // timeout — this failure class is an argument for the same disclosed-deferral treatment when the ladder
 // is provably futile." That is a real question and it is NOT settled here. Two reasons to leave it:
 // this issue's OTHER half raised the bridge cap, so a retry is no longer provably futile — R5's four
 // attempts all died at a 300s cap that no longer applies; and turning a failure class into a disclosed
-// deferral is a doctrine change, which is 's to make and not an attribution fix's.
+// deferral is a doctrine change, which is the to make and not an attribution fix's.
 
 // — a rejected draft may be CARRIED across a recovery park only when its repair is a PATCH, not a
 // re-search. That is exactly the judgement WARM_ELIGIBLE_RE already encodes: the tokens meaning "the
@@ -3060,7 +3082,7 @@ export function warmEligible(fail, json) {
 // predicate the gate judges with). It is DELIBERATELY NOT a token list. The first cut keyed this veto on
 // TOTAL_DEFECT_TOKENS, a closed list of two form-path tokens — and when the typed transport armed, the
 // failure tokens moved out of the list and the veto silently stood down with every assertion still green
-// ('s hold). An enrolled-token veto is an ENUMERATED check: a future fifth token forgetting to
+// (the hold). An enrolled-token veto is an ENUMERATED check: a future fifth token forgetting to
 // enrol is the move-blindness this repo has counted seven instances of. The direct state keys the veto
 // on the condition it exists for, and nothing has to remember to join.
 //
@@ -3105,7 +3127,7 @@ export function vetoResumeRuledNone(attempt, state) {
 // validation)": framediff_* → frame-diff.json, coverage_* → register-coverage-ledger.json, findings_*
 // → findings.json, grid_* → the failing half's own ledger, named_band_* → <axis>-band.json.
 //
-// 's in-dispatch repair has to know that, because it decides whether a repair LANDED by looking at
+// That in-dispatch repair has to know that, because it decides whether a repair LANDED by looking at
 // a file's bytes — and looking at the expectFile after a sibling repair would read a compliant model's
 // correct answer as "wrote nothing". Rather than re-deriving the routing in the gateway (two copies of
 // one rule, drifting from the day they are written), the derivation is lifted here and BOTH callers use
@@ -3210,7 +3232,7 @@ export function warmPatchMessage(lastFail, expectFile, { supplementalLane = fals
   // rulings reach the driver's accumulator only through `record_dispositions`, so a warm patch that
   // ordered any file edit would aim the seat at an artifact it cannot affect — the two halves of one
   // message disagreeing about where the work lands, which is the exact defect class the token split and
-  // 's routing fixes each closed one layer up.
+  // That routing fixes each closed one layer up.
   if (CONNOTATION_FORM_TOKEN_RE.test(lastFail ?? "") && files.length) {
     // The ABSOLUTE spec path, derived from the failing member's own output by exactly the rule
     // gridLedgerNameFor states and for exactly the same reason: a warm patch carries no base prompt
@@ -3218,7 +3240,7 @@ export function warmPatchMessage(lastFail, expectFile, { supplementalLane = fals
     // name — and a half must be aimed at ITS spec, never the canonical one.
     const halfM = basename(String(files[0])).match(/^common-law-findings\.half-([a-z0-9]+)\.md$/);
     const specPath = driverDir(dirname(files[0]), halfM ? `grid-spec.half-${halfM[1]}.json` : "grid-spec.json");
-    // THE CLOSING SENTENCE IS PER STATE ('s lesson, kept): "record every outstanding row" is right
+    // THE CLOSING SENTENCE IS PER STATE (the lesson, kept): "record every outstanding row" is right
     // for a partial and WRONG for a quote defect, where every row is ruled and re-recording rulings is
     // work already done. A truncated call's close must forbid the one compliance a wrongly-accused seat
     // reaches for — re-deriving its rulings.
@@ -3250,7 +3272,7 @@ export function warmPatchMessage(lastFail, expectFile, { supplementalLane = fals
         : `Do not stop until the tool's answer reports nothing outstanding.`);
   }
   const sibling = repairSiblingName(lastFail, files);
-  // ── THE SIBLING BRANCH MUST NOT OUTRANK THE TOOL-WRITTEN ONE (, third conversion) ────────────
+  // ── THE SIBLING BRANCH MUST NOT OUTRANK THE TOOL-WRITTEN ONE (third conversion) ────────────
   //
   // This branch orders "Re-save the COMPLETE corrected JSON at <sibling>", which is a hand-write. For
   // frame-diff the sibling IS the tool-written artifact — `frame-diff.json`, with `frame-diff.md` as the
@@ -3312,7 +3334,7 @@ export function warmPatchMessage(lastFail, expectFile, { supplementalLane = fals
   // "the turn wrote nothing" — the driver writes the file, so an absent model means the TOOL WAS NEVER
   // CALLED. `blindframe_*` means the call arrived and its values failed the parser. One remedy: call it.
   //
-  // THE TOKEN-FAMILY LIST IS GONE (, third conversion), and its removal is the root-cause half. It
+  // THE TOKEN-FAMILY LIST IS GONE (third conversion), and its removal is the root-cause half. It
   // read `/blindframe_|skeptic_/`, which is a second authoring of "which stages are converted" — one that
   // this conversion would have had to extend with `framediff_`, and the next one with its own prefix,
   // each time by somebody remembering. The right question is not which token fired but whether the

package/driver/grounds-grammar.mjs

@@ -13,7 +13,7 @@
 //     "Wikipedia article documenting 1871 race riot, negative historical violence event"
 //
 // Both are true. Neither says what could not be established. A charged judgment recorded without its
-// grounds is the same shape as 's `step-silent`: the ledger has a label for the decision and
+// grounds is the same shape as the `step-silent`: the ledger has a label for the decision and
 // cannot say why for any single one, so a reader cannot tell "correctly judged" from "silently
 // asserted" — which are opposite repairs.
 //

package/driver/hit-list.mjs

@@ -25,7 +25,7 @@
 // The line drops `_query`/`_queries`/`screen` — 61% of a band row's bytes — and keeps the qid alone,
 // because the completeness witness needs the join and nothing dismisses a record on its provenance.
 
-import { countOrNull } from "./named-band.mjs";   // tracker issue 95 — one copy of "a count I could not take is null, not zero"
+import { countOrNull } from "./named-band.mjs";   // one copy of "a count I could not take is null, not zero"
 
 /**
  * THE FATES. A line ends with exactly one, and the set is closed so completeness is verifiable by

package/driver/jurisdiction-systems.mjs

@@ -13,7 +13,7 @@
 // only systems we are confident of are listed; an UNKNOWN code returns null and every consumer
 // leaves it UNLABELED — the system never guesses a legal system. ("Hybrid" realities — e.g. the
 // UK's registration system alongside passing-off rights — are classified by where unregistered
-// USE can defeat/coexist with a later registration, the property the prelim actually acts on.)
+// USE can defeat/coexist with a later registration, the property the clearotron actually acts on.)
 //
 // PURE (no node imports) → tests offline.
 

package/driver/jx-lanes.mjs

@@ -128,7 +128,7 @@ export function scopeJurisdictions(job, profile) {
 /**
  * The POLICY decision: which lanes fire for this run, at what depth. Pure — env kill switches are the
  * pipeline's business. Returns {} lanes when the searchPolicy doesn't carry the jxLanes component (a
- * plain prelim is byte-identical: no decision, no sidecar, nothing).
+ * plain clearotron is byte-identical: no decision, no sidecar, nothing).
  *
  *   decideJxLanes({ job, profile, searchPolicy }) →
  *     { lanes: { zh: { depth: "candidates"|"full", jurisdictions: ["CN",…], origin } }, scope: [...] }

package/driver/jx-units.mjs

@@ -352,7 +352,7 @@ export async function runJxSerpGrid(ctx, job, opts = {}, { runLog = () => {}, no
       // "shadow-only, the run is unaffected" and carry no cause at all, while degradedCause beside it
       // held `SerpAPI 429: Your account has run out of searches.` Measured, not hypothesised: an
       // operator watching a real run learned a headline capability had failed and could not learn that
-      // the fix was a subscription top-up somebody could do in five minutes. That is 's principle
+      // the fix was a subscription top-up somebody could do in five minutes. That is the principle
       // one layer down — a discriminator that reaches a field and not the sentence anybody reads.
       note(shadowLaneNote("jx serp grid", "degraded", `${gaps.length}/${cellsIn.length} cells gapped: ${topCause}`,
         `attempt ${st.attempts + 1}/${MAX_UNIT_ATTEMPTS}`));

package/driver/jx.mjs

@@ -123,7 +123,7 @@ export function deriveJxSliceStatement({ sidecar, units = null, env = process.en
       continue;
     }
     // item 8 — the per-slice CLEAROTRON_JX_* arms are gone, so "armed" is now the ONE condition that
-    // survives: the lane not killed. 's warning still applies to how it is read — laneArmed is the
+    // survives: the lane not killed. That warning still applies to how it is read — laneArmed is the
     // fail-open reader, and reading it through the old default-OFF `envOn` made every unset lane report
     // not-armed on a run that had dispatched.
     const armed = laneArmed(s.lane, env);
@@ -229,7 +229,7 @@ const flag = (name) => ["1", "true", "yes", "on"].includes(String(process.env[na
 // — the private copy is gone; laneArmed (driver.config.mjs) is the one reader.
 
 // ── The frozen lane decision: minted once (cold), read verbatim forever (a resume NEVER re-decides —
-// the freezeProfile doctrine). Plain-prelim runs never reach this (the caller gates on the component).
+// the freezeProfile doctrine). Plain-clearotron runs never reach this (the caller gates on the component).
 export function attachJxLanes(ctx) {
   const sidecarPath = driverDir(ctx.run.runDir, "jx-lanes.json");
   let raw = null;
@@ -473,7 +473,7 @@ export async function runJxCandidateFold(ctx, job, opts = {}, { runLog = () => {
     // function has run, and rebuilding the block from three literal keys silently dropped them on any
     // resume that still had a pending lane. The three keys this function owns are overwritten below it,
     // so carrying the rest forward changes nothing else. Carry-forward beats drop-and-re-mint: the drop
-    // leaves a window in which the sidecar carries no statement at all, which reads as the pre- defect.
+    // leaves a window in which the sidecar carries no statement at all, which reads as the pre-change defect.
     const fold = { ...(repairedFold ?? {}), executor: source, lanes: { ...(repairedFold?.lanes ?? {}) }, foldedAt: repairedFold?.foldedAt ?? null };
     // criterion 4 — THE RECEIPT NAMES THE MODEL, NOT ONLY THE EXECUTOR.
     //

package/driver/knockout-assess-record.mjs

@@ -154,7 +154,11 @@ const DECLARED = Object.freeze({
   // "the lane that produced the record is a driver fact". The chip is derived from this joined list and
   // from the finding's own receipted evidence — never from a word the seat typed about itself.
   "marks.findings": ["ordinal", "name", "owner", "band", "net", "type", "evidence", "basis", "weighedFilings"],
-  "marks.registerReads": ["recordId", "read"],
+  // `band` is the rater's rating OF THAT FILING, optional, in the framework's own ladder words. It is
+  // declared here as well as in the tool schema because this allowlist — not the schema — is what the
+  // driver validates against: a key the seat sends and this list omits is refused, so the read would
+  // arrive banded and land unbanded with nothing saying why.
+  "marks.registerReads": ["recordId", "read", "band"],
   "marks.negatives": ["term", "source", "note"],
 });
 

package/driver/narrative-refutation-record.mjs

@@ -5,7 +5,7 @@
 // The reviewer is the report's only check, and until now it wrote its own review as free prose with
 // Write/Edit. Everything downstream then parsed that prose back out: the verdict token, the flag list,
 // the optional `[kind:]` and `[on:]` channels, and the count that decides whether a BLOCKING is
-// degenerate. The seat chose the enumeration style, so the parse could miss — 's lettered flags
+// degenerate. The seat chose the enumeration style, so the parse could miss — the lettered flags
 // were invisible for exactly that reason, and records a second walk that could not see `**1.`.
 //
 // The seat now hands VALUES and the driver renders the document. The style becomes the driver's, so
@@ -179,7 +179,7 @@ export function acceptRefutation(params, { receiptPresent = false } = {}) {
   // ADDED rather than repurposed: changing what `flags` means would move every reader silently, and a
   // field with two meanings across a version boundary is the shape this repo keeps finding.
   //
-  // WHY THE ARRAY HAS TO LEAVE THIS FUNCTION AT ALL (, T3b). The corrective pass builds
+  // WHY THE ARRAY HAS TO LEAVE THIS FUNCTION AT ALL (T3b). The corrective pass builds
   // its worklist by RE-PARSING the rendered markdown through `parseCorrections`. That parse is exactly
   // what the conversion removed the need for — the flags were typed values a moment earlier — and it can
   // miss, which is the defect the whole conversion exists to close. A consumer that reads the accepted
@@ -209,7 +209,7 @@ export function recordRefutation(runDir, received, { now = () => new Date().toIS
   let captureFailed = cap.failed;
   const capture = (outcome) => { if (!mergeCapture(cap.path, outcome)) captureFailed ??= "the outcome could not be merged into the capture"; };
 
-  // ✕ CAPTURED TWICE, AND THE SECOND WRITE IS THE POINT (, T3b).
+  // ✕ CAPTURED TWICE, AND THE SECOND WRITE IS THE POINT (T3b).
   //
   // The capture ran ONCE, before validation, to a fixed filename — so a refused call and an accepted one
   // left byte-identical evidence and nothing on disk said which. On a turn where the seat sends a

package/driver/numeric-setting.mjs

@@ -13,7 +13,7 @@
 //
 // THE TWO INPUTS ARE DIFFERENT QUESTIONS AND GET DIFFERENT ANSWERS:
 //
-//   blank / unset / whitespace   "not configured" ('s documented spelling) — take the DEFAULT.
+//   blank / unset / whitespace   "not configured" (the documented spelling) — take the DEFAULT.
 //   a value that is not a number  "configured wrong" — REFUSE, naming the variable and what it holds.
 //
 // There is no overlap between those inputs, so neither answer weakens the other.