clearotron 0.2.2 → 0.2.3

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/_shared/term-shape.mjs

@@ -115,7 +115,7 @@ const MARKUP_ARMS = [
  * long-form arm. A slogan mark has a legitimately long dominant element and cannot be restated any
  * shorter, so refusing a value for BEING LONG is right at the compiler and wrong at a corrective
  * stage gate — it hands back a reason with no remedy. An annotation always has a remedy: delete the
- * note, keep the term. — that is also why it may sit ABOVE a word-count floor: `ZEPHYR (root)`
+ * note, keep the term. — that is also why it may sit ABOVE a word-count floor: `COASTLINE (root)`
  * is an annotation by no measure a word count can see, exactly as the one-word `**BIOVELTRIN**`
  * was markup by no measure a word count could see.
  *

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,7 @@
 # trademark-oauth-mcp-bridge
 
+## 0.2.3
+
 ## 0.2.2
 
 ## 0.3.0-beta.0

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/providers/uspto-local/src/index-store.js

@@ -489,8 +489,8 @@ function predicateClause(predicate, term) {
       // predicate. Unanchored, because corporate names arrive in every spelling there is.
       //
       // NO FTS NARROWER HERE, deliberately, and it is the same trap as the suffix one. An FTS
-      // token-prefix candidate set is NOT a superset of an unanchored contains: owner "AURORA INTERACTIVE"
-      // searched for "URORA" satisfies the LIKE, but no token starts with URORA, so the narrower
+      // token-prefix candidate set is NOT a superset of an unanchored contains: owner "FOXGLADE INTERACTIVE"
+      // searched for "OXGLADE" satisfies the LIKE, but no token starts with URORA, so the narrower
       // would drop a true match and the verification could never put it back. A narrower may only
       // ever be a superset of its verifier. So this is an honest full scan, and how expensive that is
       // at register scale is UNMEASURED.

package/scripts/citation-line-check.mjs

@@ -31,12 +31,15 @@
 // That last paragraph prints on every run, including a clean one, because a guard whose "clean" is
 // near-meaningless and does not say so is worse than no guard: its presence reads as coverage.
 //
-// The remedy is the convention, not this script — CONTRIBUTING.md, "Cite the SYMBOL, not the line
-// number". A symbol survives every move; a number survives none. This guard cannot enforce that (the
+// The remedy is the convention, not this script — ADR-0005, "Cite the symbol, not the line": a symbol
+// survives every move and a number survives none, and where the target is not a named symbol, quote a few
+// words of it. This used to name CONTRIBUTING.md, which contains no such section — that record says in as
+// many words that it SUPERSEDES CONTRIBUTING's instruction, so the pointer was to the superseded half. This guard cannot enforce that (the
 // ruling explicitly declines a form guard without an allowlist for the ~800 existing citations), so it
 // holds the decidable perimeter and names the gap.
 
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
+import { execFileSync } from "node:child_process";   // — the ratchet reads a range; injected in tests
 import { fileURLToPath } from "node:url";
 import { join, dirname, basename } from "node:path";
 
@@ -370,6 +373,41 @@ function main() {
   // — the no-symbol slice: a cited span that is entirely blank or brace-only.
   const { misses: blankTarget, unshipped: blankUnshipped } = structuralMisses(citations, readLines);
 
+  // ── `--ratchet`: refuse a NEW citation that carries a line number and no symbol ────────────────────
+  //
+  // Separate mode rather than folded into the default run, because it answers about a RANGE and the rest
+  // of this script answers about the tree. Mixing them would make one exit code stand for two questions.
+  if (process.argv.includes("--ratchet")) {
+    const i = process.argv.indexOf("--base");
+    const base = i >= 0 ? process.argv[i + 1] : "origin/main";
+    const { error, lines } = addedLinesSince(base);
+    if (error) {
+      // A RANGE THAT COULD NOT BE READ IS NOT A RANGE THAT ADDED NOTHING, and 2 keeps the two apart —
+      // 1 already means "found something" here.
+      console.error(`${GUARD} --ratchet: ${error}`);
+      console.error("  That is this check failing to look, not a clean range. Nothing was judged.");
+      process.exit(2);
+    }
+    const bare = newBareCitations(lines);
+    console.log(`${GUARD} --ratchet: ${lines.length} added line(s) against ${base}, ${bare.length} new bare citation(s)`);
+    for (const b of bare) console.log(`  ${b.file}:${b.line}  cites ${b.cited}:${b.start} with no symbol\n    ${b.text.slice(0, 110)}`);
+    if (bare.length) {
+      console.error("\nA citation carrying a line number and no symbol is checked for EXISTENCE and nothing");
+      console.error("else, so it drifts onto a different real line and every test here still passes.");
+      console.error("");
+      console.error("The documented form (ADR-0005) carries no line number at all:");
+      console.error("    `toolGroupsForStage()` in `gather-config.mjs`");
+      console.error("Where the target is not a named symbol, quote a few words of it. A line number is also");
+      console.error("accepted when a bare identifier sits directly beside it — `pipeline.mjs:875 recordsFromSearch`");
+      console.error("— because that one this script can check. Backticks around the symbol are NOT stepped over,");
+      console.error("so a line number with a backticked symbol still reads as bare.");
+      console.error("");
+      console.error("The existing corpus is not your problem: this judges only what the range ADDS.");
+      process.exit(1);
+    }
+    process.exit(0);
+  }
+
   if (process.argv.includes("--json")) {
     console.log(JSON.stringify({
       files: corpus.length, citations: citations.length, resolved: resolved.length,
@@ -595,6 +633,87 @@ const CALLS = /^\s*\(/;
 const OWN_NUMBER = /^\s*(?:at\s+\d|:\d)/;
 
 /** The symbol-shaped tokens adjoining a citation, in BOTH grammars: `cite SYM` and `SYM (cite)`. PURE. */
+// ── THE RATCHET: A NEWLY ADDED CITATION CARRIES A SYMBOL (tracker issue 125) ────────────────────────
+//
+// The blindness above is not closeable on the existing corpus. Of the line citations in this tree only a
+// minority name a symbol beside the number, and the rest are checked for EXISTENCE and nothing more — a
+// citation that drifted onto a different real line reads as correct to every test here. Repointing them by
+// hand is not the repair: the two hand measurements recorded in BLINDNESS both found wrong lines
+// introduced by exactly that kind of pass.
+//
+// So this closes the class GOING FORWARD, at the only moment the correct symbol is cheap to write — when
+// the author still knows what they meant. Same shape as the catalogue and release-note ratchets: the
+// existing population is left to convert by attrition, and the number that must not grow is the number of
+// citations nothing can check.
+//
+// WHAT IS REFUSED IS NARROW, and the two questions the issue left open are answered here rather than
+// assumed:
+//
+//   · a line number WITH a symbol is fine. The symbol is what makes it checkable, and `symbolClaims`
+//     above already verifies it; forbidding the number as well would be stricter than the harm.
+//   · a citation with NO line number is fine, symbol or not. It cannot go stale from an edit above it,
+//     which is the whole failure. This is also the answer for a data file, a fixture or a generated
+//     table, where there is no symbol to name — cite the file, leave the line off.
+//
+// Refused, therefore, is exactly one shape: a NEW citation carrying a line number and no symbol.
+//
+// PURE, and the added lines are injected, so a test drives it without a git repository — a ratchet that
+// can only run against the real tree cannot be shown to fail.
+// THE RULE'S OWN DEFINITION IS EXEMPT, AND NAMED RATHER THAN PATTERN-MATCHED. Its specimens are bare
+// citations on purpose — a test that cannot write the shape it refuses cannot exercise it — so scanning it
+// puts the guard's own examples into the population it polices, and the ratchet refuses its own arrival.
+// Caught by driving the check against a range containing it, not by review.
+//
+// The cost of naming a file is that a REAL bare citation added there also escapes. That is the same trade
+// the reference-strip signatures make for the same reason, and it is preferable to a pattern, which would
+// quietly widen to files nobody considered.
+export const RATCHET_EXEMPT = ["driver/test/a-new-citation-carries-something-that-can-be-checked.test.mjs"];
+
+export function newBareCitations(addedLines) {
+  const out = [];
+  for (const { file, line, text } of addedLines ?? []) {
+    if (RATCHET_EXEMPT.includes(file)) continue;
+    for (const m of String(text ?? "").matchAll(CITE_RE)) {
+      // The same discriminator the corpus scan uses: a second `:number` closing a paren is a V8 stack
+      // frame, not a citation. Reading them as citations would refuse a fixture that captured a trace.
+      if (/^:\d+\)/.test(String(text).slice(m.index + m[0].length))) continue;
+      if (symbolsBeside(String(text), m.index, m[0].length).length > 0) continue;
+      out.push({ file, line, cited: m[1], start: Number(m[2]), text: String(text).trim() });
+    }
+  }
+  return out;
+}
+
+/**
+ * The lines a range ADDS, as `{ file, line, text }`. `run` is injected for the same reason as above.
+ *
+ * `--unified=0` so context lines are not read as additions — with context, every citation near an edit
+ * would be reported as new and the ratchet would refuse changes that added nothing.
+ */
+export function addedLinesSince(base = "origin/main", run = null) {
+  const exec = run ?? ((...a) => execFileSync("git", ["-C", ROOT, ...a], { encoding: "utf8", maxBuffer: 1e9 }));
+  let diff;
+  try { diff = exec("diff", "--unified=0", "--no-color", `${base}...HEAD`); }
+  catch (e) {
+    // A range that could not be read is not a range that added nothing, and the caller must not confuse them.
+    return { error: `could not diff ${base}...HEAD (${String(e?.message ?? e).split("\n")[0].slice(0, 90)})`, lines: [] };
+  }
+  const lines = [];
+  let file = null, next = 0;
+  for (const raw of diff.split("\n")) {
+    // The two file headers git writes, matched in full rather than by a "+++" prefix. An added line
+    // beginning with "++" arrives here as "+++...", so a prefix test drops it AND numbers every line
+    // after it in the hunk one low, because the line it skipped never advanced the counter. Both
+    // forms are exact: a deletion's header is the bare string, with no path and no timestamp.
+    if (raw.startsWith("+++ b/")) { file = raw.slice(6); continue; }
+    if (raw === "+++ /dev/null") { file = null; continue; }
+    const h = raw.match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/);
+    if (h) { next = Number(h[1]); continue; }
+    if (raw.startsWith("+")) { lines.push({ file, line: next++, text: raw.slice(1) }); }
+  }
+  return { error: null, lines };
+}
+
 export function symbolsBeside(line, index, length) {
   const after = String(line).slice(index + length).replace(SEP_AFTER, "");
   const am = after.match(/^[A-Za-z_$][A-Za-z0-9_$]*/);

package/scripts/env-classify.mjs

@@ -321,7 +321,7 @@ export function defaultAtReadSite(name, root = ROOT) {
 
 /** The whole classification, pure over its inputs so a test drives it without a box. */
 export function classify({ catalogue, sources, setup = setupNames(), readSites = defaultAtReadSite,
-  deploymentNames = DEPLOYMENT_NAMES } = {}) {
+  deploymentNames = DEPLOYMENT_NAMES, declared = new Map() } = {}) {
   // NAMED OVERRIDES, listed rather than folded into a pattern so that each can be argued with.
   //
   // `CLEAROTRON_AGENT_WHATSAPP` matches no deployment shape and is not a knob: production sets it to a
@@ -370,7 +370,11 @@ export function classify({ catalogue, sources, setup = setupNames(), readSites =
 
   const rows = catalogue.map((name) => {
     const setIn = ["prod", "test", "config", "ci", "e2e"].filter((k) => sources[k]?.has(name));
-    return { name, class: cls(name), everSet: setIn, documented: Boolean(sources.docs?.has(name)) };
+    // `declared` is the catalogue's own `# effect:` for this name, carried on the row so the artifact
+    // says what the document claims beside what this script derived. The two are different questions and
+    // the row is where a reader compares them.
+    return { name, class: cls(name), everSet: setIn, declared: declared.get(name) ?? null,
+      documented: Boolean(sources.docs?.has(name)) };
   });
 
   // "Set nowhere" is not by itself a licence to delete, and this is where 62 of 84 left the list.
@@ -378,6 +382,57 @@ export function classify({ catalogue, sources, setup = setupNames(), readSites =
   const GATE_RE = /(===|!==|==|!=)\s*"[01]"|"[01]"\s*(===|!==|==|!=)|\|\|\s*"1"/;
   const sub = {};
   for (const n of tuning) {
+    // ── A DOCUMENT SAYING "THIS IS NOT A KNOB" KEEPS ITS NAME OFF THIS LIST ────────────────────────
+    //
+    // The classifier keys on the NAME and `tuning` is its residual — what a name falls to when no shape
+    // matches. So a name whose catalogue row declares any other effect reaches the deletion walk on a
+    // class its own documentation contradicts.
+    //
+    // THE TEST IS `!== "tuning"`, SO IT EXCLUDES ALL FIVE OTHER CLASSES. `tuning` is the only declared
+    // effect that AGREES with being a knob, so it is the only one that may reach the walk. Each of the
+    // five, in the catalogue's own words, and why deleting the name would cost something:
+    //
+    //   silent-output-change  "changes what a run produces, and nothing in the run's own artifacts says
+    //                         so" — the worst one to delete, because the loss is invisible in the output.
+    //   disclosed-gate        "changes what a run covers, AND the run discloses the gap" — deleting it
+    //                         silently restores coverage the operator chose to switch off, or removes
+    //                         their ability to switch it off at all.
+    //   credential            "absent, the run refuses at preflight by name" — deleting it turns a
+    //                         named refusal into an unexplained one.
+    //   deployment            "where input and output live; the conclusion a run reaches is unchanged"
+    //                         — unchanged CONCLUSION is not unchanged behaviour. This is the class the
+    //                         whole rule comes from: two notification addresses, legitimately unset on
+    //                         the deployment being read, were proposed for deletion on exactly this
+    //                         mismatch. Excluding it is the original finding, not an extension of it.
+    //   harness               "read only on a fixture, replay or self-test path; no production run
+    //                         reaches it" — the one that reads as safe to delete and is not. Deleting a
+    //                         harness name does not remove a knob nobody uses; it removes the only way
+    //                         a test can run. That argument is already made below for `instrument`, and
+    //                         it is the same argument. A declaration is a stronger version of it,
+    //                         because it does not depend on the spelling.
+    //
+    // The alternative — narrowing to the three classes this comment used to name — would put
+    // `deployment` back on the list and re-admit the defect the rule exists to stop.
+    //
+    // WHAT THIS TREE CAN SHOW YOU, and it is not the number to look for. Measured 2026-09-08: this tree
+    // carries 43 catalogued rows and 12 declarations, and NO name is in the contradicting position, so
+    // the rule changes nothing here and a check written against the live catalogue would pass while
+    // looking at nothing. That is why the checks plant a catalogue rather than reading this one. Over
+    // the full catalogue the same day the position holds seventeen names — ten declared
+    // `silent-output-change`, four `disclosed-gate`, two `harness`, one `credential` — and every one of
+    // them leaves the walk further down for an UNRELATED reason: the instrument regex matching their
+    // spelling, a non-numeric default, or no default found. The file already says what that is worth
+    // about a different name: exclusion "for an unrelated reason (no default found), which is luck, not
+    // a rule". Rename one of them to something without `DUMP` or `PROBE` in it and it joins the deletion
+    // population with a document beside it saying it changes what a run produces.
+    //
+    // Those counts are a dated reading and they move; two of the seventeen were added the same week.
+    // The RULE is what is being asserted here, not the population.
+    //
+    // So the declaration is read FIRST and it is the rule. Nothing is silently dropped: the names land
+    // in their own bucket, and the row carries the declaration that put them there.
+    const say = declared.get(n);
+    if (say && say !== "tuning") { sub[n] = "declared-not-a-knob"; continue; }
     const body = git("grep", "-n", "--", n, "--", "*.mjs", "*.js")
       .split("\n").filter((l) => l && !/(^|\/)test\//.test(l)).join("\n");
     const onlyTests = git("grep", "-l", "--", n, "--", "*.mjs", "*.js").split("\n").filter(Boolean)
@@ -405,6 +460,7 @@ export function classify({ catalogue, sources, setup = setupNames(), readSites =
     instrument: of("instrument"), "path-switch": of("path-switch"),
     "model-or-agent-selector": of("model-or-agent-selector"),
     "non-numeric-default": of("non-numeric-default"), "no-default-found": of("no-default-found"),
+    "declared-not-a-knob": of("declared-not-a-knob"),
     "deletable-number": of("deletable-number"),
   } };
 }
@@ -414,7 +470,11 @@ function build() {
     { encoding: "utf8", cwd: ROOT, maxBuffer: 1e8 }));
   const catalogue = audit.catalogue.rows.map((r) => r.name);
   const sources = gather();
-  const { rows, buckets } = classify({ catalogue, sources });
+  // The catalogue's own declarations, handed in so the deletion walk can read them. Same rows the
+  // audit already produced — not a second parse of the same documents, which would be a second thing
+  // to keep in step.
+  const declared = new Map(audit.catalogue.rows.filter((r) => r.effect).map((r) => [r.name, r.effect]));
+  const { rows, buckets } = classify({ catalogue, sources, declared });
   const prodRead = sources.prodRead;
   const by = (k) => rows.filter((r) => r.class === k).length;
   return {
@@ -428,6 +488,10 @@ function build() {
       names: buckets["deletable-number"], count: buckets["deletable-number"].length,
     },
     _excludedFromDeletion: {
+      // FIRST, because it is the only one of these that is a RULE rather than an observation about a
+      // name's spelling or its default: the catalogue says this name changes what a run produces, so it
+      // is not a spare knob whatever its shape suggests.
+      "declared-not-a-knob": buckets["declared-not-a-knob"],
       instrument: buckets.instrument, "path-switch": buckets["path-switch"],
       "model-or-agent-selector": buckets["model-or-agent-selector"],
       "non-numeric-default": buckets["non-numeric-default"], "no-default-found": buckets["no-default-found"],

package/scripts/live-surface-check.mjs

@@ -90,7 +90,7 @@ import { unitsActiveVerdict } from "../driver/unit-state-verdict.mjs";
 import { deploymentBox } from "../shared/deployment-box.mjs";   // — extracted; one allowlist, two readers
 import { unitFileDriftVerdict } from "../driver/unit-file-drift.mjs";   //
 import { placeholdersIn, resolveValues, renderUnit } from "../driver/systemd/render-units.mjs";   //
-import { CHECKED_UNITS, unitInventoryVerdict, serviceCommitVerdict, unitWorkingDirectory, unitClone } from "../driver/unit-inventory.mjs";   // · -bundle ·
+import { CHECKED_UNITS, CHECKED_TIMERS, timerVerdict, unitInventoryVerdict, serviceCommitVerdict, unitWorkingDirectory, unitClone } from "../driver/unit-inventory.mjs";   // · -bundle ·
 import { entrypointOf } from "../driver/systemd/install-census.mjs";   // the ONE ExecStart parser — a unit says which module it runs
 import { treeOfRunning } from "../shared/checkout-move.mjs";           // …and the live argv says which tree that module came from
 import { findUnitFiles, unitFilePath } from "../driver/unit-files.mjs";   //
@@ -226,6 +226,35 @@ function userBusEnv() {
 // Returns {clones, probe}. `probe` is the honest answer to "could I look at all?" — {ok, why} — and it is
 // SEPARATE from the clones list on purpose. "enumerated, nothing to compare" and "could not enumerate"
 // were the same empty array before, and this suite exists because absences were read as successes.
+/**
+ * Ask each declared TIMER about itself, as a timer.
+ *
+ * Deliberately not folded into the loop below. That loop asks a service for its WorkingDirectory and
+ * MainPID and attributes a running process to a checkout — none of which a `.timer` has, so putting
+ * timers through it would produce rows whose every attribution field is empty for a reason that is not
+ * a finding. Two questions, two calls, and each says what it could not answer.
+ */
+function declaredTimers() {
+  if (!CHECKED_TIMERS.length) return { rows: [], probeFailed: null };
+  const env = userBusEnv();
+  const rows = [];
+  let probeFailed = null;
+  for (const unit of CHECKED_TIMERS) {
+    try {
+      const shown = execFileSync("systemctl", ["--user", "show", unit, "-p", "ActiveState", "-p", "LoadState"],
+        { encoding: "utf8", env, stdio: ["ignore", "pipe", "pipe"] });
+      const f = Object.fromEntries(shown.split("\n").filter(Boolean).map((l) => { const [k, ...v] = l.split("="); return [k, v.join("=")]; }));
+      // An EMPTY answer is the no-session-bus case, and it must not read as a stopped timer — that is
+      // the shape that turns "could not ask" into a finding about the box.
+      if (!f.ActiveState) { probeFailed = probeFailed ?? `systemctl --user answered nothing for ${unit}`; continue; }
+      rows.push({ unit, active: f.ActiveState || null, load: f.LoadState || null });
+    } catch (e) {
+      probeFailed = probeFailed ?? String(e?.message ?? e).slice(0, 120);
+    }
+  }
+  return { rows, probeFailed };
+}
+
 function serviceClones() {
   // — the list is DECLARED, not written here. It used to be eight names inline, which put a unit
   // inside the drift guarantee or outside it by omission: `client-access` was live on production and in
@@ -889,6 +918,14 @@ else {
   const v = unitInventoryVerdict({ live: liveUnits, files: walk.files, collisions: walk.collisions,
     filesError: walk.error, box, probe });
   record("every live unit is declared", v.state, v.message);
+
+  // — AND WHETHER ANYTHING STILL STARTS THE TIMER-DRIVEN ONES. Reported separately from the line above
+  // because it answers a different question: that one says a declared unit exists and is not adrift,
+  // this one says its timer is still armed. A service whose timer was stopped satisfies the first and
+  // fails the second, and reads `inactive` for both — which is why one line could not carry both.
+  const t = declaredTimers();
+  const tv = timerVerdict(t.rows, { probeFailed: t.probeFailed });
+  record("every declared timer is still armed", tv.state, tv.message);
 }
 
 // ── — EVERY QUEUE THIS DEPLOYMENT WOULD DRAIN IS WATCHED BY SOMETHING ──────────────────────────

package/scripts/nightly-notice.mjs

@@ -151,8 +151,6 @@ export function noticeBody({ runUrl, sha, subject, failedJobs = [], lastGreenAt,
         + "passes — a run that never started cannot make the platform green."
       : "This thread is reused for every red night. Close it once the platform is green again — the next "
         + "red opens a new one.",
-    "",
-    "Agent: role-dev · bergface",
   ].join("\n");
 }
 

package/scripts/preinstall-node-check.mjs

@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// The install refuses an unsupported Node BEFORE anything is written — tracker issue 364.
+//
+// Three declarations already stated the requirement and none of them bound anyone: `engines.node` is a
+// WARNING unless the person installing has set `engine-strict`, `.nvmrc` is read by nvm and nothing
+// else, and the install guide is prose. An outside report arrived as "some node issues, not as obvious
+// as the README made it seem" — which is what a warning inside an install log looks like from outside.
+//
+// So this is a `preinstall` hook, node builtins only, because nothing is installed when it runs.
+//
+// IT NAMES THE LATER FAILURE, not just the version. The whole defect is that an unsupported Node
+// installs cleanly and then fails somewhere else saying nothing about Node, so a message that only
+// prints a semver range leaves the reader where they started.
+import { declaredRange, floorOf, meetsFloor, nodeFloorRefusal } from "../shared/node-floor.mjs";
+
+const range = declaredRange();
+if (!meetsFloor(process.versions.node, floorOf(range))) {
+  process.stderr.write(`\n${nodeFloorRefusal({ current: process.versions.node, required: floorOf(range).join("."), range })}\n`);
+  process.stderr.write("  Nothing has been installed.\n\n      nvm install 22 && nvm use 22\n\n");
+  process.stderr.write("  Without nvm, take the current 22.x from https://nodejs.org/.\n\n");
+  process.exit(1);
+}

package/scripts/strip-tracker-citations.mjs

@@ -77,6 +77,15 @@ export const EXCLUDED = [
   "driver/test/a-bare-reference-added-in-a-diff-is-refused.test.mjs",
   "driver/test/prompt-payload-names-no-tracker-issue.test.mjs",
   "driver/test/euipo-environment-doctrine.test.mjs",
+  // THIS RULE'S OWN DEFINITION, and it caught itself. Both files below QUOTE the residue in order to
+  // define it — the specimens the sweep is tested against, and the worked examples in the header above.
+  // Sweeping them rewrites the corpus this instrument is checked by, and it would then pass on something
+  // it had stopped checking: the arms would assert that a stripped line equals a stripped line. The
+  // sibling module that counts the earlier strip's residue learned the same lesson and names its own
+  // three files for the same reason. Found by running the sweep after fixing its report, which is the
+  // only reason it surfaced: before that, these lines were counted and never listed.
+  "scripts/strip-tracker-citations.mjs",
+  "driver/test/the-citation-strip-removes-openers-and-nothing-else.test.mjs",
   // Pinned at a content hash; a prose repair is not worth spending a freeze on.
   "driver/publish/render.mjs",
 ];
@@ -86,28 +95,42 @@ export const isScannable = (f) =>
 
 /** Per-file classification. PURE, and `read` is injected so an arm can drive it over a synthetic tree. */
 export function surveyOf(files, read) {
-  const stripped = {}, handoff = [];
+  const stripped = {}, handoff = [], unreadable = [];
   let strippedTotal = 0, remainingTotal = 0;
   for (const f of files.filter(isScannable)) {
     let text;
-    try { text = read(f); } catch { continue; }
+    // AN UNREADABLE FILE IS A FINDING, NOT A QUIET SKIP. This used to `continue` into no counter and no
+    // error channel, so "I could not open this" and "there was nothing to do here" produced identical
+    // output — in the report whose whole job is to tell somebody a hundred-file rewrite is safe. The
+    // count is reported before anything else when it is non-zero.
+    try { text = read(f); } catch (e) { unreadable.push({ file: f, why: String(e?.message ?? e).slice(0, 120) }); continue; }
     let n = 0;
+    // CLASSIFY AFTER REPLACING, NOT INSTEAD OF IT. The replacement is not global, so a line carrying an
+    // opener AND a second citation further along was stripped once, counted as done, and never reached
+    // the hand-off list a person is told to read — its survivor was invisible in the one place it should
+    // have been named. Test the RESULT: a line can be both stripped and still owed to a reader.
     const out = text.split("\n").map((line, i) => {
-      if (OPENER.test(line)) { n++; return line.replace(OPENER, "$1"); }
-      if (ANY_CITATION.test(line)) handoff.push({ file: f, line: i + 1, text: line.trim() });
-      return line;
+      const after = OPENER.test(line) ? (n++, line.replace(OPENER, "$1")) : line;
+      if (ANY_CITATION.test(after)) handoff.push({ file: f, line: i + 1, text: after.trim() });
+      return after;
     });
     if (n) { stripped[f] = n; strippedTotal += n; }
     remainingTotal += out.filter((l) => ANY_CITATION.test(l)).length;
     if (APPLY && n) writeFileSync(join(ROOT, f), out.join("\n"));
   }
-  return { strippedTotal, remainingTotal, stripped, handoff };
+  return { strippedTotal, remainingTotal, stripped, handoff, unreadable };
 }
 
 if (import.meta.url === `file://${process.argv[1]}`) {
   const tracked = execFileSync("git", ["-C", ROOT, "ls-files"], { encoding: "utf8", maxBuffer: 1 << 28 })
     .split("\n").filter(Boolean);
   const s = surveyOf(tracked, (f) => readFileSync(join(ROOT, f), "utf8"));
+  // BEFORE ANYTHING ELSE, because every number under it is about the files that COULD be read.
+  if (s.unreadable.length) {
+    console.log(`${s.unreadable.length} file(s) COULD NOT BE READ — every count below excludes them:`);
+    for (const u of s.unreadable) console.log(`  ${u.file}  ${u.why}`);
+    console.log("");
+  }
   console.log(`${APPLY ? "stripped" : "would strip"} ${s.strippedTotal} opener(s) across ${Object.keys(s.stripped).length} file(s)`);
   console.log(`${s.handoff.length} citation(s) are NOT openers and need a reader — the hand-off list:`);
   for (const h of s.handoff) console.log(`  ${h.file}:${h.line}  ${h.text.slice(0, 110)}`);

package/scripts/test-run.mjs

@@ -223,6 +223,22 @@ const providerChosen = ["CLEAROTRON_DATABASE"]
   .some((n) => String(process.env[n] ?? "").trim() !== "");
 if (!providerChosen) process.env.CLEAROTRON_DATABASE = "corsearch";
 
+// ── THE SUITE'S OWN BRAND-OWNER FIXTURES, ASKED FOR IN ONE PLACE ──────────────────────────────────
+//
+// Three profiles in `driver/profiles/` are the suite's, and a resolved roster no longer offers them:
+// an outside user's brand-owner picker listed them on a `git clone` install, where the packaging
+// exclusion that protects the tarball does not apply. They are marked `testFixture` and the loader
+// refuses them on every route.
+//
+// The checks still need them, under the same keys the baselines use, and most do not call the loader —
+// they exercise code that does, so there is no argument to pass. One variable here is the whole ask,
+// and it is visible: a reader of this file can see that the suite runs against a roster no install
+// resolves, which is a thing worth being able to see rather than a default nobody set.
+process.env.CLEAROTRON_TEST_FIXTURE_PROFILES ??= "1";
+// The demo account is refused from a fresh install's roster for the same reason and by the same
+// mechanism; the suite asks for it here, once, so no check has to know it was hidden.
+process.env.CLEAROTRON_DEMO_PROFILES ??= "1";
+
 // ── A PARTLY-BLIND SUITE IS NOT A FAILING SUITE ────────────────────────────────────────────
 //
 // `git worktree add` gives you no `node_modules`, nothing in this repo creates one, and the tracker asks

package/shared/anon-overlay.mjs

@@ -6,7 +6,7 @@
 // Feedback console went with the quality subsystem, so two of those five had not rendered for
 // months. Lets us screen-share the site without
 // revealing real client names or the marks being cleared: client names map to descriptive aliases
-// (e.g. Zephyr Beverages → "Beverage company") and marks blur out, behind ONE site-wide toggle (no
+// (e.g. Coastline Drinks → "Beverage company") and marks blur out, behind ONE site-wide toggle (no
 // hover-reveal). Display-only — it never mutates stored data, run metadata, or form values.
 //
 // SHAPE (mirrors site-nav.mjs's NAV_CSS/siteNav split):
@@ -19,7 +19,7 @@
 //   • anonToggle(cfg?)   — the toggle button markup for the nav ('' when disabled).
 //
 // Tagging conventions the browser overlay understands:
-//   <span data-anon="client" data-anon-key="zephyr">Zephyr Beverages</span>  → text swapped for the alias
+//   <span data-anon="client" data-anon-key="coastline">Coastline Drinks</span>  → text swapped for the alias
 //   <span data-anon="mark" data-anon-key="…" data-anon-run="…">NOVA PULSE</span> → blurred (unless exempt)
 //   <a data-anon-href data-anon-key="…" data-anon-run="…" href="…">     → href neutralised to # (unless exempt)
 // A run/client is EXEMPT (shown real) when its key ∈ demoAllow.clientKeys or its run matches
@@ -81,7 +81,7 @@ const OVERLAY_BODY = `(function(){
   var DEAD_TITLE = "hidden in privacy mode — toggle Privacy OFF to open";
   var DA = C.demoAllow || {clientKeys:[],runs:[]};
   // Case-insensitive client lookup, and the reason it is not redundant: surfaces tag rows by profile
-  // KEY ("zephyr") and by display NAME ("Zephyr"), so lowercasing both makes a single-token name
+  // KEY ("coastline") and by display NAME ("Coastline"), so lowercasing both makes a single-token name
   // resolve to its key's alias. The two surfaces that tagged by NAME were Quality and Feedback, both
   // retired (tracker issue 265) — the fold stays because it is what makes the lookup total over either spelling,
   // not because those pages are coming back.

package/shared/customer-store.mjs

@@ -7,7 +7,7 @@
 // `process.env.PROFILE_DIR || join(HERE, "profiles")` while the runs, the roster, the account picker and
 // the artifacts door read `CLEAROTRON_CUSTOMERS_DIR`. Nothing set `PROFILE_DIR` — not `onboard`, not
 // `.env.example`, not the box's own env — so the settings surface served the product's BUNDLED DEMO
-// BUNDLE (aurora, generic, petcary, zephyr) while the runs served the real store.
+// BUNDLE while the runs served the real store.
 //
 // WHAT THE CLIENT SAW: every brand owner added the documented way was "These settings are not available
 // to you." The clearance itself submitted and ran under their framework. Only the surface that

package/shared/invocation.mjs

@@ -92,6 +92,34 @@ export function standFrom(dir) {
   return at === -1 ? s : s.slice(0, at);
 }
 
+/**
+ * WHICH ROUTE THIS INSTALL ARRIVED BY — a package, or a source checkout.
+ *
+ * The setup wizard has two spellings and only one of them works for any given reader. Someone who ran
+ * `npm i clearotron` has no package scripts, so `npm run setup` is a command they cannot type; someone
+ * working in a clone of the source has the scripts but no `clearotron` binary linked for them, because
+ * npm links a package's bin for its dependencies and never for itself. Naming one of the two on a
+ * screen is a coin flip, and the screen that names it is read by people who have just installed and
+ * have nothing else to go on.
+ *
+ * The answer is a property of where this file sits on disk, so it is derived from that. A package —
+ * local or global — is unpacked inside a `node_modules` directory; a checkout is not. `standFrom`
+ * already draws that line for the sibling question of where to stand, and reusing it is deliberate:
+ * two predicates for "am I a package" would be two chances to disagree.
+ *
+ * NO PATH IS RETURNED, and that is the point of splitting it out from `invocationForm`. That function's
+ * `prefix` can be `cd /srv/whatever && npx `, which is the server's own layout, its account name and
+ * its directory structure. This answers the same question with a word, so the answer can travel to a
+ * browser without carrying the machine with it.
+ *
+ * @param {string} dir  where this module is installed
+ * @returns {'packaged'|'checkout'}
+ */
+export function installRoute(dir = INSTALL_DIR) {
+  const s = String(dir ?? "");
+  return standFrom(s) === s ? "checkout" : "packaged";
+}
+
 /**
  * WHERE npm PUT THE EXECUTABLE for a GLOBAL install of this package —.
  *

package/shared/names-in-force.mjs

@@ -43,6 +43,7 @@ export const NAMES_IN_FORCE = Object.freeze([
   "CLEAROTRON_DEFAULT_AGENT",
   "CLEAROTRON_DELIVERY",
   "CLEAROTRON_DEMO",
+  "CLEAROTRON_DEMO_PROFILES",
   "CLEAROTRON_DISPATCH_RECORD",
   "CLEAROTRON_DOCTOR_ASSUME_PINNED",
   "CLEAROTRON_DUMP_JSON",
@@ -162,6 +163,7 @@ export const NAMES_IN_FORCE = Object.freeze([
   "CLEAROTRON_SUITE_TELEMETRY_DIR",
   "CLEAROTRON_SYNTHESIS_MODEL",
   "CLEAROTRON_TAINT_CHAIN",
+  "CLEAROTRON_TEST_FIXTURE_PROFILES",
   "CLEAROTRON_TURN_CAP",
   "CLEAROTRON_TURN_LOCK_POLL_MS",
   "CLEAROTRON_UNREACHABLE_SENIOR",