clearotron 0.2.1 → 0.3.0-beta.0

package/INSTALL.md

@@ -41,10 +41,11 @@ run is [mcp-server/CONNECT.md](mcp-server/CONNECT.md), and why something is the
 - **Node.js >= 22**, and npm. A hard floor: `package.json` declares it, `.nvmrc` pins it, and the free
   US register runs on `node:sqlite`, which ships with FTS5 from Node 22. Node 20 installs and then fails
   at the first US search. `nvm use` picks the pin up.
-- **macOS, Linux, or Windows via WSL2.** Native Windows is not supported: the engine resolves the
-  reasoning CLI the POSIX way, so a native-Windows run refuses at preflight even with the CLI on `PATH`.
-  On Windows, `wsl --install`, then install Node 22 **inside** the Linux distribution and work through
-  this page from there. `npx clearotron demo` is the exception and runs anywhere Node does. A *hosted*
+- **macOS, Linux, or native Windows for the demo; WSL2 with Node 22 for a clearance.** `npx clearotron
+  demo` runs anywhere Node does, native Windows included. A real clearance does not: the engine resolves
+  the reasoning CLI the POSIX way, so a native-Windows clearance refuses at preflight even with the CLI
+  on `PATH`. On Windows, `wsl --install`, then install Node 22 **inside** the Linux distribution and work
+  through this page from there. A *hosted*
   deployment needs Linux for one further thing, the systemd outbox trigger —
   [driver/systemd/README.md](driver/systemd/README.md).
 - **A reasoning CLI on your `PATH`, signed in.** This is the prerequisite people miss. Every stage runs

package/bin/example.mjs

@@ -41,7 +41,7 @@ import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync,
 import { homedir, tmpdir } from "node:os";
 import { invoke } from "../shared/invocation.mjs";   // — the printed command is resolved once, for the reader who is actually standing there
 import { basename, dirname, join, resolve, sep } from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn } from "node:child_process";
 import { BRAND } from "../shared/brand.mjs";   // — the installer's own name, from the tenant seam
 import { envFrom } from "../shared/env-aliases.mjs";   // — resolves EITHER spelling; names the retired one because that is the live-writable half
@@ -68,7 +68,11 @@ if (has("--help") || has("-h")) {
   const shipped = demoChildren(join(REPO, "demo"));
   if (shipped.length) {
     console.log(`\n  --product takes one of:`);
-    for (const id of shipped) console.log(`    ${id}${id === shipped[0] ? "   (the default, when --product is not given)" : ""}`);
+    // NO "DEFAULT" MARKER (tracker issue 277). This printed "(the default, when --product is not given)"
+    // beside the first id, and kept printing it after the default became ALL of them — so `--help` taught
+    // a reader the exact belief the change removed, in the command it was reported against.
+    for (const id of shipped) console.log(`    ${id}`);
+    console.log(`\n  With no --product, every one of them is published.`);
     console.log("");
   } else {
     // An absence is a finding: a tree with no demo says so rather than printing an empty list.
@@ -96,8 +100,8 @@ const DEMO_ROOT = join(REPO, "demo");
 // disagreed. That file records what a knockout demo carries instead of a report.md, and why this line
 // once let `demo/knockout-search` ship and stay unopenable..
 
-// --run-dir takes a directory outright. --product names a child. Neither given: the first child, and the
-// name is PRINTED below rather than assumed, because "the demo" is about to mean one of several.
+// --run-dir takes a directory outright. --product names a child. Neither given: EVERY child, and the
+// names are PRINTED below rather than assumed, because "the demo" means several.
 const wanted = flag("--product");
 const children = demoChildren(DEMO_ROOT);
 
@@ -220,7 +224,7 @@ console.log(samples.length === 1
 console.log(`  pool:    ${poolRoot}\n`);
 
 mkdirSync(poolRoot, { recursive: true });
-const { republishRun } = await import(join(REPO, "driver", "publish", "report-registry.mjs"));
+const { republishRun } = await import(pathToFileURL(join(REPO, "driver", "publish", "report-registry.mjs")).href);
 
 // ── ONE FAILURE MUST NOT COST THE OTHERS, AND MUST NOT BE A QUIET COUNT (tracker issue 277) ─────────
 //

package/bin/onboard.mjs

@@ -693,8 +693,8 @@ export async function preflightCandidate(candidate) {
 /** Ask EUIPO for a token. This is the check that makes "refuses to persist a bad secret" true. */
 export async function validateEuipo({ clientId, clientSecret, environment }) {
   try {
-    const { resolveConfig } = await import(join(REPO, "providers", "euipo", "src", "core.js"));
-    const { getAccessToken } = await import(join(REPO, "providers", "euipo", "src", "euipo-client.js"));
+    const { resolveConfig } = await import(pathToFileURL(join(REPO, "providers", "euipo", "src", "core.js")).href);
+    const { getAccessToken } = await import(pathToFileURL(join(REPO, "providers", "euipo", "src", "euipo-client.js")).href);
     await getAccessToken(resolveConfig({ clientId, clientSecret, environment }), { force: true });
     return { ok: true };
   } catch (e) {
@@ -705,7 +705,7 @@ export async function validateEuipo({ clientId, clientSecret, environment }) {
 /** One minimal Perplexity call. Costs a request, so it is never made without being asked for. */
 export async function validatePerplexity(apiKey) {
   try {
-    const { buildRequestBody, callAgentAPI } = await import(join(REPO, "providers", "perplexity", "src", "core.js"));
+    const { buildRequestBody, callAgentAPI } = await import(pathToFileURL(join(REPO, "providers", "perplexity", "src", "core.js")).href);
     await callAgentAPI(apiKey, buildRequestBody({ task: "Reply with the single word: ok.", preset: "fast-search" }), { retries: 0 });
     return { ok: true };
   } catch (e) {
@@ -1053,7 +1053,7 @@ export async function runCheck() {
   // deliberate — a second reader would drift from this one exactly as the composer and the checker did
   // in F41, and the drift is invisible because both sides keep passing their own arms.
   const unitDir = join(homedir(), ".config", "systemd", "user");
-  const { BACKGROUND_UNITS } = await import(join(REPO, "bin", "start.mjs"));
+  const { BACKGROUND_UNITS } = await import(pathToFileURL(join(REPO, "bin", "start.mjs")).href);
   const hosted = BACKGROUND_UNITS.some((u) => existsSync(join(unitDir, u)));
   const unitEnv = hosted
     ? unitEnvironment({
@@ -1908,8 +1908,8 @@ export async function runCheck() {
     say("\n  Register lane — proven, not inferred");
     try {
       const [{ activeProvider }, { makeLaneProbe, probeSpend, DEFAULT_CONTROLS, loadProviderCapabilities }] = await Promise.all([
-        import(join(REPO, "driver", "driver.config.mjs")),
-        import(join(REPO, "providers", "_shared", "lane-probe.mjs")),
+        import(pathToFileURL(join(REPO, "driver", "driver.config.mjs")).href),
+        import(pathToFileURL(join(REPO, "providers", "_shared", "lane-probe.mjs")).href),
       ]);
       const adapter = activeProvider();
       // NOT `adapter.capabilities` — that is null on every adapter, and reading it announced a LOCAL
@@ -1995,7 +1995,7 @@ export async function runCheck() {
   // green over that state would bless the owner's fresh-install 500.
   say("\n  Profile store");
   try {
-    const { loadProfiles } = await import(join(REPO, "driver", "profiles.mjs"));
+    const { loadProfiles } = await import(pathToFileURL(join(REPO, "driver", "profiles.mjs")).href);
     const resolved = loadProfiles({ force: true });
     const named = [...resolved.keys()];
     ok(`resolves: ${named.length} profile(s) (${named.slice(0, 6).join(", ")}${named.length > 6 ? ", …" : ""}) — the universal fallback is present`);
@@ -2024,7 +2024,7 @@ export async function runCheck() {
   // an absence of evidence is not evidence of absence, and this whole check exists because something
   // invisible was being read as fine.
   {
-    const { retiredSpellingsIn, retiredSpellingLine } = await import(join(REPO, "shared", "env-aliases.mjs"));
+    const { retiredSpellingsIn, retiredSpellingLine } = await import(pathToFileURL(join(REPO, "shared", "env-aliases.mjs")).href);
     const sources = [
       { label: "your environment file", env: fileEnv, known: true },
       { label: "this shell's environment", env: process.env, known: true },
@@ -2077,7 +2077,7 @@ export async function runCheck() {
 
   say("\n  Submit lane");
   try {
-    const { triggerLaneVerdict, HOSTED, SUPERVISED } = await import(join(REPO, "shared", "trigger-lane.mjs"));
+    const { triggerLaneVerdict, HOSTED, SUPERVISED } = await import(pathToFileURL(join(REPO, "shared", "trigger-lane.mjs")).href);
     // POSTURE FROM THE BOX, NOT FROM A FLAG. Units installed means the units serve, and the units read
     // %h/.env — so an absent value there is the incident. No units means `start` supervises and derives
     // the value at runtime, where reading this process's environment says nothing either way.
@@ -2117,7 +2117,7 @@ export async function runCheck() {
     // Stop control's availability on — one reader, two surfaces.
     let verbs = null;
     try {
-      const { opsTokenPosture } = await import(join(REPO, "driver", "portal-service.mjs"));
+      const { opsTokenPosture } = await import(pathToFileURL(join(REPO, "driver", "portal-service.mjs")).href);
       verbs = opsTokenPosture(opsToken).verbs;
     } catch { /* unreadable posture leaves verbs null, which reads as full ops — see the verdict */ }
     let probe = null;
@@ -2158,7 +2158,7 @@ export async function runCheck() {
   // measured on a default install, a revoked key completed a full handshake with nothing logged. Nothing
   // surfaced that state anywhere, which is why it survived to be found by hand.
   {
-    const { defaultDenylistPath } = await import(join(REPO, "shared", "client-door.mjs"));
+    const { defaultDenylistPath } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
     const dl = effective("TRADEMARK_MCP_TOKEN_DENYLIST")?.v || defaultDenylistPath(homedir());
     try {
       const n = readFileSync(dl, "utf8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#")).length;
@@ -2172,8 +2172,8 @@ export async function runCheck() {
     }
   }
   try {
-    const { clientDoorState: doorState, describeDoorState, connectKeyReport, CLIENT_DOOR_UNIT: doorUnit } = await import(join(REPO, "shared", "client-door.mjs"));
-    const { loadGrants: readGrantsFile, isRevoked: revokedCheck } = await import(join(REPO, "shared", "scope.mjs"));
+    const { clientDoorState: doorState, describeDoorState, connectKeyReport, CLIENT_DOOR_UNIT: doorUnit } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
+    const { loadGrants: readGrantsFile, isRevoked: revokedCheck } = await import(pathToFileURL(join(REPO, "shared", "scope.mjs")).href);
     // ── CONFIGURED IS NOT RUNNING, AND THIS IS THE SURFACE IT WAS MEASURED ON ──
     //
     // `describeDoorState` was written for exactly this block and then never called from it: the split
@@ -2249,7 +2249,7 @@ export async function runCheck() {
     // names the old one. A door that is up, listening, and refuses everything is the worst of the three
     // states to debug, and nothing surfaced the mismatch.
     {
-      const { clientDoorPort: portOf, allowedHosts: hostsFor } = await import(join(REPO, "shared", "client-door.mjs"));
+      const { clientDoorPort: portOf, allowedHosts: hostsFor } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
       const declared = String(effective("CLIENT_MCP_ALLOWED_HOSTS")?.v ?? "").trim();
       if (declared) {
         const port = portOf(doorEnv);
@@ -2272,7 +2272,7 @@ export async function runCheck() {
     // null — a probe that could not be made is not a door that is absent.
     let doorListening = null;
     try {
-      const { clientDoorPort: portOf } = await import(join(REPO, "shared", "client-door.mjs"));
+      const { clientDoorPort: portOf } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
       const { createConnection } = await import("node:net");
       doorListening = await new Promise((resolve) => {
         const sock = createConnection({ host: "127.0.0.1", port: portOf(doorEnv), timeout: 700 });
@@ -2310,7 +2310,7 @@ export async function runCheck() {
     // THE PUBLISHED ADDRESS, AND WHETHER IT ANSWERS (, acceptance 2). Reported here
     // rather than beside the unit, because the unit running and the address being reachable are
     // different facts and the second is the one a client depends on.
-    const { clientDoorReachability } = await import(join(REPO, "shared", "client-door.mjs"));
+    const { clientDoorReachability } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
     // FROM THE FILE THE UNITS LOAD, NOT THE SHELL THIS COMMAND WAS TYPED IN (the tracker issue 226
     // family, met again here). On a hosted box the published address lives in the units' environment,
     // and reading `process.env` reported "no client connector address is published — that is correct
@@ -2357,7 +2357,7 @@ export async function runCheck() {
     // No new credential and no provider API: the audience is in the redirect handed to a caller with
     // no session at all, which is the request just made.
     {
-      const { readAudience, audienceVerdict } = await import(join(REPO, "shared", "access-audience.mjs"));
+      const { readAudience, audienceVerdict } = await import(pathToFileURL(join(REPO, "shared", "access-audience.mjs")).href);
       const configuredAud = effectiveForService("CLEAROTRON_OIDC_AUDIENCE")?.v ?? "";
       const read = readAudience(probe ?? { error: "the published address was never asked" });
       // NOTHING IS CLAIMED ABOUT A BOX THAT USES NO EDGE. With no audience configured AND no Access
@@ -2383,7 +2383,7 @@ export async function runCheck() {
     // announces the side effect first, and its control runs before any vendor.
     if (PROBE_CONNECTOR && String(published ?? "").trim()) {
       const { registrationEndpointFrom, probeRegistration, describeRegistration } =
-        await import(join(REPO, "shared", "connector-signin-probe.mjs"));
+        await import(pathToFileURL(join(REPO, "shared", "connector-signin-probe.mjs")).href);
       say("");
       say("  --probe-connector: asking this door's sign-in whether each assistant vendor could register.");
       say("  Each attempt that SUCCEEDS creates a throwaway OAuth client on your account, which you may");
@@ -3134,7 +3134,7 @@ try {
   prose("No default — it is your hostname. Skip it and this stays a local install: everything works",
         "here, and the Use-your-AI page says so rather than handing out an address that fails.");
   prose("The usual shape, and why: mcp-server/CONNECT.md.");
-  const { clientDoorReachability } = await import(join(REPO, "shared", "client-door.mjs"));
+  const { clientDoorReachability } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
   for (;;) {
     const clientUrl = await askValue("Public connector address:", {
       skippable: true,

package/bin/stop.mjs

@@ -19,12 +19,16 @@ import { existsSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { execFileSync } from "node:child_process";
+import { systemdSaid, looksLikeBusFailure, busRemedy, CAPTURE_STDERR } from "../shared/systemd-failure.mjs";   // tracker issue 270 — a stop that could not look must not report that it stopped
 import { BACKGROUND_UNITS } from "./start.mjs";
 import { CLIENT_DOOR_UNIT } from "../shared/client-door.mjs";
 import { invoke } from "../shared/invocation.mjs";
 
 const UNIT_DIR = join(homedir(), ".config", "systemd", "user");
 const say = (s = "") => console.log(s);
+// ON STDERR, because a refusal that scrolls past in the same stream as the success lines is a
+// refusal a script cannot act on and a reader skims (tracker issue 270).
+const err = (s = "") => console.error(s);
 
 const argv = process.argv.slice(2);
 if (argv.includes("--help") || argv.includes("-h")) {
@@ -39,20 +43,76 @@ if (argv.includes("--help") || argv.includes("-h")) {
 }
 
 let found = 0;
+const failures = [];
 for (const u of BACKGROUND_UNITS) {
   if (u === CLIENT_DOOR_UNIT) continue;   // structurally unreachable (the pin's census forbids it); belt anyway
   const file = join(UNIT_DIR, u);
   if (!existsSync(file)) continue;
   found++;
-  try { execFileSync("systemctl", ["--user", "disable", "--now", u], { stdio: "ignore" }); } catch { /* already down */ }
+  // ── THE STOP IS VERIFIED, AND THE FILE GOES ONLY IF IT WORKED (tracker issue 270) ────────────────
+  //
+  // This was `catch { /* already down */ }` — a COMMENT standing in for a check. The comment guessed why
+  // the call failed, the next line deleted the unit file regardless, and the line after that announced
+  // "stopped and removed". Measured on a test box: `disable --now` failed for want of a session bus, all
+  // four services stayed up on unchanged pids holding all three ports, three unit files were deleted, and
+  // the command exited 0 saying the box ran nothing. The services were then unmanageable — running, with
+  // no unit file to stop them by — which is strictly worse than leaving both alone.
+  //
+  // `is-active` is what decides, not the exit code of the disable, because the exit code is what lied.
+  let stopped = false;
+  let why = null;
+  try {
+    execFileSync("systemctl", ["--user", "disable", "--now", u], CAPTURE_STDERR);
+  } catch (e) {
+    why = systemdSaid(e);
+  }
+  // ASKED AFTER, WHATEVER THE DISABLE SAID. A disable that reported failure may still have stopped it,
+  // and one that reported success may not have — only the state answers.
+  try {
+    const state = execFileSync("systemctl", ["--user", "is-active", u], { ...CAPTURE_STDERR, stdio: ["ignore", "pipe", "pipe"] });
+    stopped = String(state).trim() !== "active";
+  } catch (e) {
+    // `is-active` exits non-zero for an inactive unit, which is the answer we want — but it exits
+    // non-zero for "cannot reach systemd" too, and those must not read the same. The stdout is the
+    // discriminator: an unreachable systemd prints nothing there.
+    const said = String(e?.stdout ?? "").trim();
+    if (said && said !== "active") stopped = true;
+    else why = why ?? systemdSaid(e);
+  }
+
+  if (!stopped) {
+    // NOT DELETED. A running service with no unit file cannot be stopped by any ordinary means.
+    failures.push({ unit: u, why: why ?? "systemd still reports it active" });
+    say(`  COULD NOT STOP ${u} — its unit file is left in place, so it can still be stopped`);
+    continue;
+  }
   try { rmSync(file, { force: true }); } catch { /* already gone */ }
   say(`  stopped and removed ${u}`);
 }
-try { execFileSync("systemctl", ["--user", "daemon-reload"], { stdio: "ignore" }); } catch { /* no user bus */ }
+// THE COMMENT HERE ALREADY NAMED THE CAUSE AND SHRUGGED AT IT. If there is no user bus, the disables
+// above did not happen either — which is the whole of tracker issue 270 — so this is where that is said.
+try {
+  execFileSync("systemctl", ["--user", "daemon-reload"], CAPTURE_STDERR);
+} catch (e) {
+  const said = systemdSaid(e);
+  err(`  could not ask systemd to reload its units — ${said}`);
+  if (looksLikeBusFailure(said)) err(`\n${busRemedy()}\n`);
+}
 
 if (!found) {
   say("  Nothing was running in the background — no pinned unit is installed on this box.");
   say("  Nothing to do, and nothing was changed.");
+} else if (failures.length) {
+  // THE SENTENCE THAT WAS WRONG. "The background product is stopped and the box runs nothing again" was
+  // printed unconditionally — including on the run where four services stayed up. A reader who is told
+  // that has no reason to look, which is what made the state unmanageable rather than merely wrong.
+  err("");
+  err(`  ${failures.length} of ${found} service(s) could NOT be stopped, and their unit files are left in place:`);
+  for (const f of failures) err(`    ${f.unit}: ${f.why}`);
+  if (failures.some((f) => looksLikeBusFailure(f.why))) err(`\n${busRemedy()}\n`);
+  err("  Nothing was removed for these, so they can still be stopped once systemd can be reached.");
+  err("  The box is NOT idle. This exits non-zero.");
+  process.exitCode = 1;
 } else {
   say("");
   say("  The background product is stopped and the box runs nothing again — plain `clearotron start`");
@@ -60,4 +120,6 @@ if (!found) {
   const door = existsSync(join(UNIT_DIR, CLIENT_DOOR_UNIT));
   if (door) say(`  Your assistant connection is untouched and still up; \`${invoke("disconnect")}\` is what closes it and revokes its key.`);
 }
-process.exit(0);
+// NOT A BARE ZERO. A stop that could not stop something sets `exitCode` above, and exiting 0 here would
+// discard it — printing the refusal and then reporting success, which is the shape this change removes.
+process.exit(process.exitCode ?? 0);

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "df42f25966148479a5a6d34aba3f82c110a1ba43",
-  "version": "0.2.1"
+  "commit": "061581a9789002849189ef4e55aaa74289409d13",
+  "version": "0.3.0-beta.0"
 }

package/driver/CHANGELOG.md

@@ -1,5 +1,26 @@
 # prelim-driver
 
+## 0.3.0-beta.0
+
+### Minor Changes
+
+- bb1a409: New: A Knockout report now carries the whole assessment behind its ratings. You get the reviewer's notes and the reviewer's own opening read of each name. You also get the reasoning that holds a name at its rating, and what would move it. This was written during every search and reached only the audit workbook, so the report showed a rating without the thinking under it. The notes are marked as reference material rather than mixed into the findings.
+  
+  New: A registered filing the search formed a view on now shows that rating and the read behind it. Before, the one registered right on a page was the only entry carrying no rating, beside softer uses that all carried one. That inverted what matters legally. A filing the search did not weigh still says so plainly.
+- bb1a409: New: The tools that show how a search reached its answer now work on a Knockout search. You can ask what it found, what it looked at, where it searched and came back empty, and read the delivered report itself. Until now they returned nothing at all for a Knockout search, so anyone asking how one of these results was reached saw a blank record.
+  
+  New: The proof-of-search record answers on these searches. It lists what was searched and found nothing, which is what answers a challenge to a result. Where a tool has nothing to show for this kind of search, it now says so in words. An empty list reads as "we looked and found nothing".
+
+### Patch Changes
+
+- df6277c: Fixed: A live registration covering the goods you asked about is no longer left out of a report for want of room. It is reported, or the report says why it is distant.
+- 9ba8cd0: Fixed: A what-if memo is now refused if it writes anywhere in the delivered run except its own memo folder, and the refusal names the file.
+- 8c8e200: Fixed: A what-if question left queued when its run is archived now comes back with a reason, instead of never being answered.
+- bb1a409: Fixed: The delivery record now states plainly when a report's write-up length and ranking rules could not be checked against the delivered text. It says the rules were applied to nothing on that run. Before, this was recorded as an unlabelled failed check. It looked like any other, so a run could deliver with those rules unverified and nobody would see it.
+- 9ba8cd0: For operators: Each run record now says whether the model id it observed was a pinned snapshot or an alias the provider can repoint.
+- aea4a4e: Fixed: The deployment check now says which checkout a service is running from even when its unit file does not declare one.
+- 14d6d28: Fixed: The demo and the install steps now start on native Windows, where they previously crashed on the first internal module they loaded.
+
 ## 0.2.1
 
 ### Patch Changes

package/driver/declination-call.mjs

@@ -210,6 +210,38 @@ export function contradictionFor(reason, row, scope) {
       + `own-right or duplicate-of-delivered.`;
   }
 
+  // ── ECONOMY IS NOT A REASON ABOUT A LIVE IN-CLASS MARK (owner ruling 2026-09-07) ─────────────────
+  //
+  // `not-worth-the-line` means "it fits none of the four manageable categories and is not relevant
+  // enough to drive the read". That is a statement about the REPORT'S BUDGET, not about the record. On a
+  // live registration inside one of the matter's own instructed classes it is the one thing the seat may
+  // not say: the reader is paying for a judgment about that mark, and "there was no room" is not one.
+  //
+  // Measured on the run that prompted the ruling: 26 of 49 declinations at this seam were this token,
+  // and two of the lawyer's own reference marks were among them — one carried on every earlier run.
+  //
+  // ✕ WHY THIS IS NOT THE REFUSAL THAT WAS REMOVED BELOW, and the difference is the whole reason it can
+  // stand. That one refused `unrelated-goods` and `off-field-not-major` on class overlap, fired on 170
+  // of 170 records, and made the ENGINE decide relatedness — the lawyer's call. This one refuses ONE
+  // token and leaves every substantive reason available. The seat may still decline this record: it may
+  // say the goods are unrelated, that it is off-field and not a major brand, that it is the applicant's
+  // own right, or that it is already delivered. What it may no longer do is decline it for taking up
+  // space. The refusal is about the SHAPE of the reason, not about whether the record is relevant, so
+  // the relatedness judgment stays exactly where it was.
+  //
+  // It does effectively retire this token for live in-class records, because the sweep is already scoped
+  // to the instructed classes. That was put to the owner as the consequence and ruled anyway.
+  if (reason === "not-worth-the-line" && isLive(row?.status) && shared.length) {
+    return `this record is ${String(row?.status ?? "").trim() || "live"} and sits in class `
+      + `${shared.join(", ")} — one of the matter's own instructed classes. "not worth the line" is a `
+      + `statement about the report's budget, not about this mark, and a live registration in an `
+      + `instructed class is never omitted for want of room. Either carry it, or decline it on something `
+      + `true of THIS MARK: unrelated-goods if its goods do not meet the matter's, off-field-not-major `
+      + `if it is off-field and not a major brand, an active dispute or a well-known enforcer, `
+      + `own-right if it belongs to the applicant, duplicate-of-delivered if the same right is already `
+      + `reported. Say what makes this mark distant, or give it its line.`;
+  }
+
   // THERE IS NO CLASS-OVERLAP REFUSAL, AND THE FIRST DRAFT HAD ONE. It refused `unrelated-goods` and
   // `off-field-not-major` over any record sharing one of the matter's filed classes, on the reasoning
   // that the driver holds both class lists and they disagree with the stated reason.

package/driver/driver.config.mjs

@@ -612,6 +612,26 @@ const MODEL_FAMILY_RE = /(?:^|\/)(?:claude-)?(opus|sonnet|haiku)(?:[-.]|$)/i;
 // mini one would then read as agreement, which is exactly the corruption this gauge exists to catch.
 const OPENAI_ID_RE = /^(?:openai\/)?(gpt-[\w.-]+|o\d[\w.-]*)$/i;
 const DATE_SUFFIX_RE = /-(?:\d{8}|\d{4}-\d{2}-\d{2})$/;
+
+/**
+ * Is this model id a DATED SNAPSHOT, or an undated alias that a provider may repoint?
+ *
+ * `modelBasis: "actual"` says the provider answered rather than that we guessed — it does not say the
+ * answer names a fixed build. Measured across three archived runs: haiku came back
+ * `claude-haiku-4-5-20251001`, opus and sonnet came back `claude-opus-5` and `claude-sonnet-5`. All
+ * three were recorded identically as observed, and two of them name something the provider can move
+ * underneath us. A snapshot rotation behind either alias between two runs leaves EXACTLY that record and
+ * is invisible, which is how an A/B across time ends up eliminating the seat on evidence that could not
+ * have shown it either way.
+ *
+ * Returns "snapshot", "alias", or null when there is no id to judge — null is a could-not-look and is
+ * never collapsed into "alias". PURE.
+ */
+export function modelSnapshotKind(model) {
+  const id = String(model ?? "").trim();
+  if (!id) return null;
+  return DATE_SUFFIX_RE.test(id) ? "snapshot" : "alias";
+}
 export function modelFamily(model) {
   if (!model) return null;
   const resolved = resolveModel(String(model));

package/driver/engine/mcp/recording-server.mjs

@@ -1120,6 +1120,10 @@ serve({
                   properties: {
                     recordId: { type: "string", description: "Copied VERBATIM from the filings you were given." },
                     read: { type: "string", description: "What you concluded about THIS filing." },
+                    // Declared here for the reason the comment above gives: `additionalProperties: false`
+                    // means an undeclared key is a contradiction between the prose and the schema, and the
+                    // seat resolves it whichever way it happens to trust.
+                    band: { type: "string", description: "OPTIONAL — how you rate THIS filing, in the framework's own band words. Send it when you formed a view on the filing itself; the card prints it as that filing's rating. Omit it and your read still prints, with no rating claimed." },
                   },
                 },
               },

package/driver/gateway.mjs

@@ -13,7 +13,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, wri
 import { join, dirname, basename } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
 import { tmpdir } from "node:os";
-import { config, resolveModel, modelFamily, envOn, envGateOn } from "./driver.config.mjs";
+import { config, resolveModel, modelFamily, modelSnapshotKind, envOn, envGateOn } from "./driver.config.mjs";
 import { stageLog, runLog, note, outputMeta } from "./log.mjs";
 // — the closed disposition set has ONE author; this file dictates it and must not retype it.
 import { DISPOSITIONS, POSITION_REQUIRED_DISPOSITIONS } from "./findings-model.mjs";
@@ -1142,6 +1142,11 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     const modelRequested = engine.resolveModelId ? engine.resolveModelId(model) : resolveModel(model);
     const modelActual = (typeof turn.modelWire === "string" && turn.modelWire) ? turn.modelWire : null;
     const modelBasis = modelActual ? "actual" : "unknown";
+    // WHETHER THE OBSERVED ID NAMES A FIXED BUILD. `modelBasis: "actual"` says the provider answered,
+    // not that the answer is pinned: two of the three tiers come back as undated aliases the provider
+    // may repoint, and recorded beside a dated one they read identically. null when there is nothing to
+    // judge, never collapsed into "alias".
+    const modelSnapshot = modelSnapshotKind(modelActual);
     if (modelActual) lastModelWire = modelActual;                       // — never overwritten with null
     // The comparison is by FAMILY (driver.config modelFamily), because `--model haiku` legitimately comes
     // back as `claude-haiku-4-5-20251001`. THREE-VALUED: null when either side names no family this
@@ -1570,7 +1575,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         //   modelMismatch — true/false when both sides name a family, null when either does not.
         // Written even on the rows where they are null, so "this engine cannot report" stays visibly
         // different from "this record predates the gauge".
-        modelActual, modelBasis, modelMismatch,
+        modelActual, modelBasis, modelSnapshot, modelMismatch,
         // W3 billing telemetry: which engine ran + the RESOLVED billing mode (subscription vs api-key). This
         // records INTENT (the mode the engine was configured to bill under), not independent billing evidence
         // — the actual proof is the provider console (claude's stream also reports apiKeySource; codex does
@@ -1705,7 +1710,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           event: "attempt", stage: name, attempt, of: maxRetries + 1, ok: !fail, fail: fail ?? null,
           //: the spine carries the same pair as the per-stage log, or the two disagree about what
           // ran. `model` stays the requested resolution (its existing readers); `modelActual` is the wire.
-          model: modelRequested, modelActual, modelBasis, modelMismatch,
+          model: modelRequested, modelActual, modelBasis, modelSnapshot, modelMismatch,
           wrote, warm: warm || undefined, warmEscalated: attempt === warmEscalatedAt || undefined,
           rescued: rescued ?? undefined, killed: killed || undefined,
           quiescentMs: Number.isFinite(quiescentMs) ? Math.round(quiescentMs) : undefined,   // — see the per-stage row

package/driver/knockout-assess-record.mjs

@@ -154,7 +154,11 @@ const DECLARED = Object.freeze({
   // "the lane that produced the record is a driver fact". The chip is derived from this joined list and
   // from the finding's own receipted evidence — never from a word the seat typed about itself.
   "marks.findings": ["ordinal", "name", "owner", "band", "net", "type", "evidence", "basis", "weighedFilings"],
-  "marks.registerReads": ["recordId", "read"],
+  // `band` is the rater's rating OF THAT FILING, optional, in the framework's own ladder words. It is
+  // declared here as well as in the tool schema because this allowlist — not the schema — is what the
+  // driver validates against: a key the seat sends and this list omits is refused, so the read would
+  // arrive banded and land unbanded with nothing saying why.
+  "marks.registerReads": ["recordId", "read", "band"],
   "marks.negatives": ["term", "source", "note"],
 });
 

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "prelim-driver",
   "private": true,
   "type": "module",
-  "version": "0.2.1",
+  "version": "0.3.0-beta.0",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline.mjs

@@ -107,7 +107,8 @@ import { mintCrossCheckDoubts, mintContradictionDoubts, stitchDoubts, applyClosu
 import { readAcceptedClosures } from "./doubt-closure-tool.mjs";
 import { CLOSURE_EVIDENCE_FILES } from "./doubt-closure-call.mjs";
 import { doubtsForClosure, doubtSelectionNote } from "./doubt-selection.mjs";   // doubt-closure selection
-import { deriveAsks, applyAskClosure, finalizeOpenHandoffs, summarizeAsks } from "./ask-ledger.mjs";   // PR-6 — every ask ends (2026-07-29)
+import { deriveAsks, applyAskClosure, finalizeOpenHandoffs, summarizeAsks } from "./ask-ledger.mjs";
+import { pendingWhatIf, claimWhatIf, finishWhatIf, whatIfRefusal } from "./whatif-queue.mjs";   // tracker issue 240 — a queued job is settled before its run archives   // PR-6 — every ask ends (2026-07-29)
 import { mintPresenceDoubts } from "./presence-reconciliation.mjs";   // presence-or-reason (2026-07-22 — the unjoined-Sheet-2 leak)
 import { escalatedAxes } from "./skeptic-record.mjs";   // THE escalation parse — shared with the record_skeptic transport so the rendered shape and this read cannot drift
 // — every placed candidate ends somewhere a reader can see; the ones that do not are counted by name
@@ -1532,6 +1533,13 @@ function attachProfile(ctx, job, { write = true } = {}) {
       const current = resolveProfile(job);
       if (current && current.key !== sidecar.profileKey)
         runLog(ctx.paths.runDir, { event: "profile-mismatch", sidecar: sidecar.profileKey, resolved: current.key });
+      // THE MATCH IS RECORDED TOO, and that is the point rather than symmetry for its own sake.
+      // `profile-mismatch` existed and its counterpart did not, so "the profile was right" was carried
+      // by the ABSENCE of a row — and an absence cannot tell "it matched" from "the probe never ran"
+      // (it throws below on a broken profiles/ state) or from "this run predates the probe". Three
+      // different facts, one empty grep. The positive row says which.
+      else if (current)
+        runLog(ctx.paths.runDir, { event: "profile-resolved", sidecar: sidecar.profileKey, resolved: current.key });
     } catch (e) {
       runLog(ctx.paths.runDir, { event: "profile-mismatch-probe-failed", error: String(e.message).slice(0, 120) });
     }
@@ -6135,8 +6143,70 @@ function sentinel(runDir, name, obj) {
   atomicWrite(join(runDir, name), JSON.stringify({ ts: new Date().toISOString(), ...obj }, null, 2) + "\n");
 }
 
+/**
+ * Settle every queued what-if BEFORE the run dir moves into the archive — tracker issue 240.
+ *
+ * A queued job lives under the run directory, and the worker enumerates candidates with `liveRunDirs`,
+ * which skips `archive` outright. So archiving carried a pending job out of the worker's reach: not
+ * claimed, not settled, not refused. The client who asked for it got no answer and no explanation, and
+ * no row anywhere said why. That is an absence reported as nothing at all — the one shape
+ * `whatIfRefusal` exists to prevent.
+ *
+ * BEFORE the rename, deliberately: the settlement is written into the run dir and travels with it, so
+ * the answer is on disk in the archive where the read tool will look for it.
+ *
+ * ✕ THE SENTENCE IS PER KIND, and a memo does not get the stage one. `whatIfRefusal`'s standing
+ * refusal — "this run is delivered or archived, what-if runs on live runs only" — is TRUE of a stage
+ * and FALSE of a memo, which runs on archived evidence by design. Telling a client their memo was
+ * refused because the run is archived would be a false sentence in the one place they go to find out
+ * what happened. A memo is closed on the true reason instead: it was queued before the run archived,
+ * and the drain does not reach an archived run.
+ *
+ * ✕ A JOB ANOTHER WORKER IS ACTIVELY RUNNING IS LEFT ALONE. `pendingWhatIf` returns queued jobs and
+ * claims older than an hour, never a fresh claim, so a live worker's job is not settled underneath it.
+ * A fresh claim at the moment of archiving is a race this does not close, and it is written down
+ * rather than papered over.
+ *
+ * Best-effort throughout: a failure to settle must never stop the archive, because a run that cannot
+ * archive is a much larger problem than a job with no row.
+ */
+export function settlePendingWhatIfsBeforeArchive(run) {
+  let pending = [];
+  // NOT a silent catch. This function exists because a job went unanswered with no row anywhere; a
+  // failure to enumerate that returned quietly would reproduce exactly that, one level up, and the
+  // archive would still succeed so nothing downstream would look wrong.
+  try { pending = pendingWhatIf(run.runDir); }
+  catch (e) { note(`what-if settle before archive could not enumerate the queue (${String(e?.message ?? e).slice(0, 120)}) — pending jobs may be unanswered`); return; }
+  for (const entry of pending) {
+    try {
+      // CLAIM FIRST, exactly as the worker does. `finishWhatIf` writes the terminal file and does not
+      // remove the `.json`; the claim is what renames it out of the queue. Settling without claiming
+      // writes a `.failed` beside a `.json` that still reads as QUEUED to every reader — the job would
+      // look pending and answered at the same time, which is worse than the silence being fixed here.
+      const job = claimWhatIf(entry);
+      if (!job) continue;                     // another worker won it, or it vanished — not ours to settle
+      const kind = job?.op?.kind === "memo" ? "memo" : "stage";
+      // ✕ THE SENTENCE IS PER KIND. The standing refusal — "what-if runs on live runs only" — is TRUE
+      // of a stage and FALSE of a memo, which reasons over archived evidence by design. A memo is
+      // closed on the true reason instead.
+      const error = kind === "memo"
+        ? "this what-if was queued before its run was archived, and the drain does not reach an archived run — ask it again against the archived run, which a memo may read"
+        : (whatIfRefusal({ location: "archive", state: run.state ?? null, kind }) ?? "this run is delivered or archived — what-if runs on live runs only");
+      finishWhatIf(run.runDir, entry.id, { ok: false, op: job.op ?? null, error });
+      try { runLog(run.runDir, { event: "whatif-settled-on-archive", id: entry.id, kind, stale: entry.stale }); }
+      catch { /* the row is written; the log line is a convenience and must not undo it */ }
+    } catch (e) {
+      // One job's settlement must not cost the others, or the archive — but it must not be SILENT
+      // either. A swallowed failure here leaves exactly the unanswered job this function exists to
+      // prevent, and the archive still succeeds, so nothing downstream looks wrong.
+      note(`what-if ${entry.id} could not be settled before archive (${String(e?.message ?? e).slice(0, 120)}) — it may be unanswered`);
+    }
+  }
+}
+
 function archive(run) {
   try {
+    settlePendingWhatIfsBeforeArchive(run);
     mkdirSync(dirname(run.archiveDir), { recursive: true });
     renameSync(run.runDir, run.archiveDir);
     return run.archiveDir;
@@ -13221,7 +13291,7 @@ async function pipelineInner(job, opts = {}) {
         // one, because the sibling's population boundary is deliberate and correct. It covers a
         // finding-ending followed by SILENCE; this covers one followed by a SENTENCE.
         //
-        // On R2 `russet-kestrel` the sibling logged `checked:5 matched:5 lost:0` — correctly — on a
+        // On a delivered R2 run the sibling logged `checked:5 matched:5 lost:0` — correctly — on a
         // delivery missing two marks from the lawyer's final list, one rated HIGH. They were dropped with
         // a reason, so they were outside its population by design. A drop with a reason nobody verifies
         // is not accounted for; it is unexamined with a paper trail, and that delivery carried 66 of them.
@@ -15520,6 +15590,17 @@ export async function runExperiment(job, opts) {
     // what RAN.
     engine: experimentEngineName(),
     modelTier: model ?? null,
+    // — THE RATING AUTHORITY THIS ARM RAN UNDER, on the arm's own record.
+    //
+    // `whatIfRun` resolves this correctly and returned it in memory only: nothing in the experiment
+    // directory named the profile it rated under, so a reader coming to the arm tomorrow could not
+    // confirm which framework produced it, and a future regression would be as silent as the one this
+    // was opened on. The frozen sidecar is the authority — never a fresh resolve, which is the mid-run
+    // drift the freeze exists to forbid.
+    //
+    // `null` means the run carries no frozen profile (a legacy run), and it is written rather than
+    // omitted: absent and "there was none" are different facts and only one of them is a defect.
+    ratedUnder: ctx.profile?.profileKey ?? null,
     dispatchTrigger: opts.dispatchTrigger ?? "fresh",
     // — WHICH PASS THIS ARM REPRODUCED, in a word. null on a non-corrective arm;
     // never "dispatched-warm", which is production's alone.