clearotron 0.2.2 → 0.2.3

package/driver/engine/cli-version.mjs

@@ -0,0 +1,103 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// THE VERSION OF THE BINARY THAT SERVED A RUN, captured at dispatch.
+//
+// The record already says whether the model id the provider reported names a pinned build or an alias it
+// may repoint. That answers "did the model move". It cannot answer "did the TOOL move", and the two are
+// different questions with the same symptom: a run whose judgment differs from last week's.
+//
+// Nothing recorded it. Three archived runs were walked for every spelling of a version field and carried
+// none — so what served them is not recoverable, and the box could have answered at any time.
+//
+// ── UNREADABLE IS A VALUE, NOT AN OMISSION ──────────────────────────────────────────────────────────
+//
+// The whole point of the field is telling three states apart, and only one of them is "we know":
+//
+//   { version: "2.1.241", probe: "ok" }          the binary answered
+//   { version: null, probe: "unreadable", why }  it was asked and could not say
+//   (no field at all)                            this record predates the gauge
+//
+// An omission on failure collapses the middle into the third, and a reader comparing two runs cannot
+// tell a tool that would not answer from a record written before anybody asked. That distinction is the
+// reason for the field, so failing to write it is failing at the thing rather than at the edge of it.
+//
+// ── ONE SPAWN PER BUILD, NOT PER PROCESS ────────────────────────────────────────────────────────────
+//
+// A dispatch is many stages and every stage would otherwise pay. But the cache lives as long as the
+// process, and the process is NOT one run: the drainer's watch loop calls the pipeline for job after job
+// without exiting. A first version cached there would be reported as fact for every later run in that
+// process — including runs served by a binary somebody upgraded in place underneath it.
+//
+// That is the exact silence this field exists to end, reintroduced by the cache meant to make it cheap,
+// and it would have been invisible: the record would carry a version, confidently, and be wrong.
+//
+// So the key is the path AND what the filesystem says about the file — an in-place upgrade changes the
+// modification time and the size, so it misses the cache and is probed again. The path alone is not
+// enough (two engines can point at one binary, an engine can be repointed) and the engine id is not
+// enough for the same reason.
+//
+// A file the filesystem cannot describe is NOT CACHED at all. Caching an unreadable probe under a key
+// derived from a failed stat would pin the failure for the life of the process, so a binary that
+// appeared a moment later would keep reading as absent.
+// ── WHAT THIS DEPENDS ON, WHICH IS NOT ENFORCEABLE FROM HERE ────────────────────────────────────────
+//
+// A probe that can change what it probes is not a probe. This one spawns the engine binary, so it rests
+// on `--version` being side-effect-free — true of every real CLI and not something this module can make
+// true. It bit immediately: the suite's engine stand-ins fell through to their stage path, and one of
+// them counts invocations to decide when to fail, so the probe consumed the failure a retry test was
+// measuring and the retry never happened. The symptom was an attempt count off by one, three files away
+// from the cause.
+//
+// The stand-ins now answer `--version` and exit, which is what the binaries they stand in for do. A new
+// one that forgets will produce the same off-by-one, so `driver/test/a-run-records-the-tool-that-served-it`
+// asserts every engine stand-in answers — the cheap ratchet under a condition that cannot be checked at
+// the call site.
+import { execFileSync } from "node:child_process";
+import { statSync } from "node:fs";
+
+/** Live for the process, keyed by resolved path. A run is one process; a probe is one spawn. */
+const CACHE = new Map();
+
+/** The first version-shaped token in the output, or the whole first line when nothing matches. */
+export function parseVersion(out) {
+  const line = String(out ?? "").split("\n").map((l) => l.trim()).filter(Boolean)[0] ?? "";
+  if (!line) return null;
+  // These CLIs answer `2.1.241`, `codex-cli 0.5.0`, `claude 2.1.241 (Claude Code)`. Take the first
+  // dotted number and keep it; a build that answers in prose is recorded verbatim rather than dropped,
+  // because a string somebody can compare beats a null.
+  return (line.match(/\b\d+\.\d+(?:\.\d+)?(?:[-+][0-9A-Za-z.-]+)?\b/) ?? [line])[0];
+}
+
+/**
+ * Probe one binary. PURE apart from the spawn, which is injected so an arm can drive both branches
+ * without a binary on the box — the unreadable branch is the one that matters and it cannot be produced
+ * on demand from a real install.
+ *
+ * Never throws. A probe that could take down a dispatch would be a worse defect than the gap it closes.
+ */
+export function probeCliVersion(bin, { run = null, timeoutMs = 5000, cache = CACHE, stat = statSync } = {}) {
+  if (!bin) return { version: null, probe: "unreadable", why: "no engine binary was resolved" };
+  let key = null;
+  try { const st = stat(bin); key = `${bin}\u0000${st.mtimeMs}:${st.size}`; } catch { /* not cacheable */ }
+  if (key && cache.has(key)) return cache.get(key);
+  const spawn = run ?? ((b) => execFileSync(b, ["--version"], {
+    encoding: "utf8", timeout: timeoutMs, stdio: ["ignore", "pipe", "ignore"],
+  }));
+  let result;
+  try {
+    const version = parseVersion(spawn(bin));
+    result = version
+      ? { version, probe: "ok" }
+      // It ran and said nothing a version could be read from. That is not the same as failing to run,
+      // and a reader chasing a tool change needs to know which happened.
+      : { version: null, probe: "unreadable", why: "the binary answered with no version-shaped token" };
+  } catch (e) {
+    result = { version: null, probe: "unreadable", why: String(e?.message ?? e).slice(0, 160) };
+  }
+  if (key) cache.set(key, result);
+  return result;
+}
+
+/** Drop the cache. For arms, and for a caller that has just repointed an engine deliberately. */
+export function forgetCliVersions(cache = CACHE) { cache.clear(); }

package/driver/enqueue-schema.mjs

@@ -237,7 +237,7 @@ function niceClassErrors(list, label) {
 //   and reaches the report body, where it REVERSES THE DISPLAY of everything after it. The report is a
 //   legal deliverable that goes to a client.
 //
-//   A zero-width joiner makes "AUR\u200DORA" render as AURORA and compare unequal to it, so
+//   A zero-width joiner makes "IRON\u200DWHISK" render as IRONWHISK and compare unequal to it, so
 //   `selfExclusionOwners` and dedup both miss a mark a human reads as the account's own.
 //
 //   NFD "SIRÈNE" !== NFC "SIRÈNE", so one mark submitted two ways is two matters, two searches, two bills.
@@ -285,7 +285,7 @@ const markNameSites = (job) => {
   for (const f of ["markName", "name"]) if (job?.[f] != null) sites.push([f, () => job[f], (v) => { job[f] = v; }]);
   if (Array.isArray(job?.marks)) job.marks.forEach((m, i) => {
     // A BARE STRING IS A MARK NAME, and this shape reaches validateJob unconverted. `assembleFromFlags`
-    // turns `marks: ["AURORA"]` into `[{ name: "AURORA" }]`, so every door that assembles is already
+    // turns `marks: ["IRONWHISK"]` into `[{ name: "IRONWHISK" }]`, so every door that assembles is already
     // covered — but the runner's wall calls validateJob({ atClaim: true }) on the MANIFEST AS IT SITS ON
     // DISK, which nothing re-assembles. The kebab-collision check below reads the same shape for exactly
     // that reason. Walking only `m.name` would leave this guard covering every door except the one it
@@ -778,16 +778,16 @@ export function validateJob(job, { atClaim = false } = {}) {
   // that would drop the customer's platforms, self-exclusion seed and the framework that RATES the matter".
   // A MISSING key returns generic in silence. Both produce the same wrong deliverable, and only one says so.
   //
-  // It has already happened: a paid Zephyr Beverages clearance was rated on the Generic default scale because the
-  // request named the customer in prose and left the account field empty. Nothing objected. A person
-  // noticed hours later and re-ran it.
+  // It has already happened: a paid clearance for a test account was rated on the Generic default scale
+  // because the request named the customer in prose and left the account field empty. Nothing objected.
+  // A person noticed hours later and re-ran it.
   //
   // WHY THIS IS NOT SIMPLY "customer present, key absent". That shape is byte-identical to a LEGITIMATE
   // third-party search — a firm asking us to clear a mark for their own client, who is not our account —
   // and the applicant deliberately never selects a profile, because a third-party search must never inherit
   // a customer's exclusions. Clarifying on that shape alone would bounce real work every day.
   //
-  // The discriminator is the ROSTER. The Zephyr Beverages request differed in one way that matters: we hold an
+  // The discriminator is the ROSTER. That request differed in one way that matters: we hold an
   // account by that name. A named applicant we have no account for is a third-party search and runs
   // untouched; a named applicant who IS one of our customers, with no key, is ambiguous in a way only a
   // person can settle — did intake forget to tag it, or is this genuinely a search against a name that
@@ -965,7 +965,7 @@ export const EXAMPLE_JOB = {
   rawRequest: "<the verbatim forwarded email text, untouched — archived as inbound-request.txt (§A5)>",
   brief: "<the confirmation brief exactly as sent to the requester — archived as confirmation-brief.md>",
   deadline: "2026-06-20T17:00:00Z",     // optional; drives the §A3 deadline-envelope arithmetic
-  profileKey: "aurora",              // D4.1: the customer ACCOUNT the intake AI resolved → selects the
+  profileKey: "demo-brand-owner",    // D4.1: the customer ACCOUNT the intake AI resolved → selects the
                                         // profile (marketplaces/classes/delivery/appetite); omit ⇒ generic
   product: "multi-country-focus-search",// WHICH OF THE FOUR (OPTIONAL): one of products.mjs PRODUCT_IDS.
                                         // Omit ⇒ the project/customer defaultProduct, else the product
@@ -987,7 +987,7 @@ export const EXAMPLE_JOB = {
   projectKey: "console-ecosystem",      // spec 62 (OPTIONAL): the PROJECT/engagement under the customer whose
                                         // overlay (its own marketplaces/classes/sector/posture) rates this
                                         // matter; omit ⇒ runs on the customer profile. Unknown key ⇒ clarify.
-  customer: "Aurora Interactive",                // applicant/owner → affiliate self-exclusion set (§B3.2)
+  customer: "Demo Brand Owner",                  // applicant/owner → affiliate self-exclusion set (§B3.2)
   customerUnknown: false,               // B5: true when the applicant is neither stated nor forwarder-implied —
                                         // arms candidate-self classification + the late-bind watch (NEVER inferred from the mark)
   // caseLaw — NOT A FIELD. The case-law and opposition reading is what a Full country search IS

package/driver/feedback-store.mjs

@@ -19,7 +19,7 @@
 // come from report-data.json; the disposition comes from findings.json beside it in the same run dir,
 // because report-data.json is the CLIENT cut and stopped serving the engine's placement key. A
 // reader who finds the ordinal now points at `KURENA / Manageable / rebuttable` when the flag says
-// `PETCARY / Medium / conceded` knows the run was republished, which is exactly the thing a bare id
+// `BURROWELL / Medium / conceded` knows the run was republished, which is exactly the thing a bare id
 // would have hidden.
 
 import { randomUUID } from "node:crypto";

package/driver/findings-model.mjs

@@ -168,8 +168,8 @@ export const ACTION_KINDS = [...CONDITION_KINDS, ...ADVISORY_KINDS];
 export const CLIENT_TIER_BY_COMPOSITE = { 1: "LOW", 2: "MANAGEABLE", 3: "MEDIUM", 4: "HIGH", 5: "VERY HIGH" };
 
 // ── doc 50 — band mode (schema_version 4): the framework in force rates the matter ────────────────────
-// A v4 finding carries `band` — one of the frozen framework manifest's ordered band words (zephyr says
-// "Medium", the Generic default says "Moderate", aurora has a "Low") — and NO composite/level/
+// A v4 finding carries `band` — one of the frozen framework manifest's ordered band words (one ladder
+// says "Medium", the Generic default says "Moderate", another has a "Low") — and NO composite/level/
 // dispute_type (one rating authority; the retired scale is FORBIDDEN, not just optional). Presentation
 // joins on the band's TONE (a closed enum in the manifest) so 4-band and 5-band ladders both land on the
 // existing badge/gauge ramps without any per-framework code.
@@ -2441,6 +2441,56 @@ export function knockoutFindingViews(mark, { manifest = null } = {}) {
  * Derived through knockoutFindingViews rather than re-deriving that fallback here — one projection
  * decides what a finding's number is, and this cell cannot disagree with the sheet it points into.
  */
+// ── THE REVIEWER'S NOTES: WHAT EACH ONE IS ABOUT (tracker issues 331 A.4, 333 rule 5) ───────────────
+//
+// The knockout page prints a note about the REQUEST at the top, above the conflicts, and a note about
+// the NAME under that name's cards. A note saying the screen may have been scoped to the wrong market
+// is the most consequential line on the page and it used to sit under roughly 1,900 words.
+//
+// THE READER LIVES HERE BECAUSE TWO MODULES NEED THE SAME ANSWER. The renderer sorts the notes; the
+// predelivery lint warns a writer whose note will sort the way they did not intend. Two copies of this
+// regex would drift, and the drift would be silent — the page would file a note one way while the
+// reviewer told the writer it went the other.
+//
+// IT SORTS ON WHAT THE NOTE TALKS ABOUT, and the doctrine is written to match: a note about the request
+// NAMES the request. The word set spans both vocabularies deliberately — "dispatch" and "instructed"
+// are what runs written before tracker issue 333 say, "the request" and "was asked" are what runs
+// written after it say — so one reader serves the archive and the new doctrine at once.
+export const REQUEST_NOTE_WORDS = /\b(?:dispatch|the request|the requester|instructed|was asked)\b/i;
+
+// Subjects that belong to the ASKING rather than to the name. A note on one of these that never names
+// the request will be filed under the name, which is why the lint flags it rather than the page
+// guessing: the fix is one clause in the note, and only its writer can add it.
+export const REQUEST_SUBJECT_WORDS =
+  /\b(?:customer industry|client(?:'s)? (?:own )?(?:prior|earlier) use|prior use|intended goods|the goods we|wrong market|described as an? )/i;
+
+/** One note, in either shape, as { text, about }. `about` is null when nothing has classified it. */
+export function knockoutNoteView(n) {
+  if (n && typeof n === "object" && !Array.isArray(n)) {
+    const about = String(n.about ?? "").trim().toLowerCase();
+    return { text: String(n.text ?? n.note ?? "").trim(), about: about === "request" || about === "name" ? about : null };
+  }
+  return { text: String(n ?? "").trim(), about: null };
+}
+
+/**
+ * A mark's notes, split into the two places the page prints them.
+ *
+ * The rater's own `about` wins outright where one is given; only an unclassified note meets the word
+ * reader. That precedence is the whole design: it means a run written under a doctrine that no longer
+ * uses these words is answered without them.
+ */
+export function splitKnockoutNotes(mark) {
+  const all = (Array.isArray(mark?.purpleNotes) ? mark.purpleNotes : []).map(knockoutNoteView).filter((v) => v.text);
+  const request = [];
+  const name = [];
+  for (const v of all) {
+    const isRequest = v.about ? v.about === "request" : REQUEST_NOTE_WORDS.test(v.text);
+    (isRequest ? request : name).push(v.text);
+  }
+  return { request, name, all: all.map((v) => v.text) };
+}
+
 export function knockoutFindingRange(mark) {
   const ords = knockoutFindingViews(mark).map((v) => v.ordinal).sort((a, b) => a - b);
   const markName = String(mark?.name ?? "").trim();

package/driver/flag-snapshot.mjs

@@ -318,6 +318,26 @@ export function postureDisagreement(snapshot, live) {
     "silent-output-change — a different engine answers differently and nobody is told");
   differ("billing mode", snapshot.engine?.billing?.mode ?? null, live.engine?.billing?.mode ?? null,
     "what a run costs, and who it is billed to");
+  // THE FIELD THAT DECIDES WHETHER A SEARCH CAN START, and the one this comparison could not see.
+  //
+  // The configuration page reads the LIVE posture and the New clearance screen reads this capture, so a
+  // box where they differ on this one boolean draws a green Engine row on one screen while the other
+  // replaces its start button with "no search engine is attached". That is not a hypothetical: it is
+  // what an outside user photographed, and he gave up on the product because the greener screen looked
+  // more authoritative. Both readings were correct about their own question and nothing compared them.
+  //
+  // Worse than silence, before this line: `disagrees` came back `[]` — which this page renders as "the
+  // last run ran under this same configuration". The one field they actually disagreed on was not in the
+  // comparison, so the page positively affirmed agreement while the two surfaces contradicted each other.
+  // STRINGS, NOT THE BOOLEANS THEMSELVES. Every other row here compares names and modes, so the browser
+  // contract parses `capture` and `live` with `asString` — handed `false` it yields null, and the row
+  // would reach the page with its two values blank and only the effect sentence left. The words are also
+  // the better answer for a reader: "found" against "not found" says it without a legend.
+  const found = (v) => (v === true ? "found" : v === false ? "not found" : null);
+  differ("engine program", found(snapshot.engine?.binaryPresent), found(live.engine?.binaryPresent),
+    "whether a NEW search can start — the engine that last ran and this deployment do not agree that the "
+    + "engine program can be found, so one screen offers a search the other refuses. Restart the engine "
+    + "service so it re-reads its PATH, or install the CLI where the service can see it");
 
   // Flags: compare only names BOTH sides declare, for the same reason `differ` skips absent values —
   // a build that adds a flag must not read as every older capture disagreeing with it.

package/driver/framework.mjs

@@ -102,7 +102,7 @@ export function parseFrameworkManifest(raw) {
 // `rootDir` may be a string (legacy: join against it) OR a resolver function taking the manifest's
 // skills-relative path and returning an absolute one — the layered overlay-over-base lookup
 // (driver.config.resolveSkillPath). The driver MUST resolve a framework exactly as the agent does, or the
-// two read different files: that divergence is what killed the first Aurora Interactive run (framework_manifest_missing
+// two read different files: that divergence is what killed a test account's first run (framework_manifest_missing
 // against the bundled tree while the agent was pointed at the config store).
 export function loadFrameworkManifest(rootDir, fwPath) {
   const rel = manifestPathFor(fwPath);

package/driver/gateway.mjs

@@ -13,7 +13,8 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, wri
 import { join, dirname, basename } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
 import { tmpdir } from "node:os";
-import { config, resolveModel, modelFamily, modelSnapshotKind, envOn, envGateOn } from "./driver.config.mjs";
+import { config, resolveModel, modelFamily, modelSnapshotKind, envOn, envGateOn, preflightEngineBinary } from "./driver.config.mjs";
+import { probeCliVersion } from "./engine/cli-version.mjs";
 import { stageLog, runLog, note, outputMeta } from "./log.mjs";
 // — the closed disposition set has ONE author; this file dictates it and must not retype it.
 import { DISPOSITIONS, POSITION_REQUIRED_DISPOSITIONS } from "./findings-model.mjs";
@@ -1147,6 +1148,20 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     // may repoint, and recorded beside a dated one they read identically. null when there is nothing to
     // judge, never collapsed into "alias".
     const modelSnapshot = modelSnapshotKind(modelActual);
+    // WHICH BUILD OF THE TOOL SERVED THIS TURN. `modelSnapshot` above answers "did the model move";
+    // this answers "did the tool move", and the two have one symptom — a run whose judgment differs from
+    // last week's. Captured at dispatch rather than read back afterwards, because the binary a reader
+    // could probe later is not necessarily the one that ran.
+    //
+    // Written as an object with its own `probe` field, so an unreadable version is a RECORDED state
+    // rather than a missing one. Omitting it on failure would collapse "asked and could not say" into
+    // "written before anybody asked", which is the distinction the field exists for. One spawn per
+    // binary per process; a probe never throws, because taking down a dispatch to record a version
+    // would be a worse defect than the gap it closes.
+    const cli = (() => {
+      try { return probeCliVersion(preflightEngineBinary(process.env)?.resolved ?? null); }
+      catch (e) { return { version: null, probe: "unreadable", why: String(e?.message ?? e).slice(0, 160) }; }
+    })();
     if (modelActual) lastModelWire = modelActual;                       // — never overwritten with null
     // The comparison is by FAMILY (driver.config modelFamily), because `--model haiku` legitimately comes
     // back as `claude-haiku-4-5-20251001`. THREE-VALUED: null when either side names no family this
@@ -1576,6 +1591,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         // Written even on the rows where they are null, so "this engine cannot report" stays visibly
         // different from "this record predates the gauge".
         modelActual, modelBasis, modelSnapshot, modelMismatch,
+        cliVersion: cli.version, cliVersionProbe: cli.probe, ...(cli.why ? { cliVersionWhy: cli.why } : {}),
         // W3 billing telemetry: which engine ran + the RESOLVED billing mode (subscription vs api-key). This
         // records INTENT (the mode the engine was configured to bill under), not independent billing evidence
         // — the actual proof is the provider console (claude's stream also reports apiKeySource; codex does
@@ -1711,6 +1727,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           //: the spine carries the same pair as the per-stage log, or the two disagree about what
           // ran. `model` stays the requested resolution (its existing readers); `modelActual` is the wire.
           model: modelRequested, modelActual, modelBasis, modelSnapshot, modelMismatch,
+          cliVersion: cli.version, cliVersionProbe: cli.probe, ...(cli.why ? { cliVersionWhy: cli.why } : {}),
           wrote, warm: warm || undefined, warmEscalated: attempt === warmEscalatedAt || undefined,
           rescued: rescued ?? undefined, killed: killed || undefined,
           quiescentMs: Number.isFinite(quiescentMs) ? Math.round(quiescentMs) : undefined,   // — see the per-stage row

package/driver/package.json

@@ -2,11 +2,11 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {
-    "node": ">=22.19.0"
+    "node": ">=22.13.0"
   },
   "scripts": {
     "test": "node ../scripts/test-run.mjs node ../scripts/test-fast.mjs test/*.test.mjs",
@@ -14,6 +14,6 @@
   },
   "dependencies": {
     "exceljs": "^4.4.0",
-    "undici": "^8.10.1"
+    "undici": "^7.29.1"
   }
 }

package/driver/party-facts.mjs

@@ -226,8 +226,8 @@ const corpusHasKind = (set, kind) => {
 /**
  * The form of a party's name to match ENTRIES against.
  *
- * Register owners carry legal forms ("Aurora Therapeutics SA"); web candidate titles carry whatever the
- * web uses ("Aurora Therapeutics"). That asymmetry is systematic — one corpus is the register, the other
+ * Register owners carry legal forms ("Foxglade Therapeutics SA"); web candidate titles carry whatever the
+ * web uses ("Foxglade Therapeutics"). That asymmetry is systematic — one corpus is the register, the other
  * is search results — so requiring the full string admits SOME entries about a party and excludes others
  * purely by name form. A half-scoped corpus is the failure this scoping was built to avoid, inverted: it
  * still reports a contradiction, now against a source the run plainly holds.

package/driver/phase0.mjs

@@ -87,7 +87,7 @@ export function todayISO(now = new Date()) {
 }
 
 // The resolved customer = the profile key (profiles.mjs resolveProfile, forwarder-domain only). This was
-// a aurora-interactive.example-vs-generic HARDCODE (D4.1); the engine is already profile-driven, so resolveProfile is
+// a customer-vs-generic HARDCODE (D4.1); the engine is already profile-driven, so resolveProfile is
 // the single source of truth. ctx.customer is telemetry-only (the run-start log line); per-customer
 // DELIVERY reads the FROZEN sidecar ctx.profile.profileKey (which wins on resume) — never read
 // ctx.customer for a delivery decision, or a profiles/ edit between run and resume would diverge.

package/driver/pipeline.mjs

@@ -888,7 +888,7 @@ function deriveGridSpec(ctx) {
   // Deterministic grid contract (robust fix, 2026-06-14): write the EXACT terms × platforms the grid
   // will run as a code-owned spec. The perplexity plugin reads this, runs only these cells, and writes
   // common-law-grid.json ITSELF from the API response — the large grid JSON never round-trips through
-  // the model's bounded turn-output (no truncation: Zephyr/marble-causeway) and the model never re-types
+  // the model's bounded turn-output (no truncation: measured on a dense beverages run) and the model never re-types
   // the keys or cells (no drops/mis-keys: NOVA PULSE/marble-anvil). The receipts gate joins against THIS
   // same file, so it can never demand a key the grid did not run. No profile (no dictated platforms) ⇒
   // legacy model-authored path (back-compat; the gate falls back to the prose manifest).
@@ -918,7 +918,7 @@ function deriveGridSpec(ctx) {
     const gridSpecPath = P.gridSpec;
     // #5 — required channels: a NAMED profile's curated platforms are authoritative. The GENERIC fallback
     // derives the channels from the MATTER FRAME's industry/goods reasoning (its "Search channels:" line) so
-    // a regulated/B2B matter (petcary vet-pharma) searches its real channels (EMA/FDA registers) instead of
+    // a regulated/B2B matter (veterinary pharma, say) searches its real channels (EMA/FDA registers) instead of
     // being forced onto — and invalidated by — consumer storefronts. No static class→channel table: the
     // frame names them the way a lawyer reasons about the vertical, so it generalises to ANY industry. The
     // deterministic grid runs grid-spec.platforms and the receipts gate joins the SAME file, so this is the
@@ -1465,7 +1465,7 @@ export function freezeProfile(p, project = null) {
     demoData: p.demoData === true,
     // BUGFIX 2026-06-19: per-customer reasoning-skill SELECTION must be frozen too. It was missing here, so
     // frameworkFor()/workedExamplesFor() (stages.mjs) read the frozen ctx.profile, found no path, and silently
-    // fell back to the firm-neutral DEFAULT for EVERY run — aurora.json/zephyr.json's configured frameworks
+    // fell back to the firm-neutral DEFAULT for EVERY run — the profiles' configured frameworks
     // were never applied. RAW value (NOT `?? ""`): absent ⇒ undefined ⇒ JSON drops it ⇒ frameworkFor falls back
     // to DEFAULT; an empty string would NOT trigger the `?? DEFAULT` and would break the read.
     frameworkPath: p.frameworkPath,
@@ -1490,7 +1490,7 @@ export function freezeProfile(p, project = null) {
   };
   // spec 62 — when the run is under a PROJECT, record which project rated it and the per-field origin map,
   // added AFTER the 14-field base so a NO-PROJECT freeze stays byte-identical to a pre-62 sidecar (the
-  // aurora regression anchor and every existing run's profileSha are preserved; profileShaOf sorts keys,
+  // regression anchor and every existing run's profileSha are preserved; profileShaOf sorts keys,
   // so these hash in only when present, making "which project rated this run" verifiable, never asserted).
   if (project?.projectKey) {
     frozen.projectKey = project.projectKey;
@@ -14633,7 +14633,7 @@ async function pipelineInner(job, opts = {}) {
     // ratings (joinFindingToBlock), never the summary's own words.
     try { emailVerdictOpts.findings = parseFindingsJsonLenient(readFileSync(P.findings, "utf8"))?.findings ?? undefined; } catch { /* no findings — table falls back to the summary words */ }
     // doc 50 — the run's band ladder: the email table colours + sorts by the framework in force's own
-    // vocabulary (zephyr "Medium", house "Moderate", aurora's five bands) instead of the fixed table.
+    // vocabulary (one framework's "Medium", the house's "Moderate", another's five bands) instead of the fixed table.
     if (ctx.framework) emailVerdictOpts.bands = ctx.framework.bands.map((b) => ({ label: b.label, tone: b.tone }));
     // ONE report (spec 2026-07-30 §6): the cover note is a cover note — verdict, one-line summary, link.
     // A10 (addendum, 2026-07-30) NARROWS the old "machine-QC never on the email" rule rather than

package/driver/plain-register.mjs

@@ -0,0 +1,120 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// THE TWO-REGISTER RULE, AS THE REVIEWER READS IT — tracker issue 333.
+//
+// The report goes to a lawyer who layers advice on top, and that lawyer's client reads the same page.
+// The band, the summary, the basis line and the one-liners are the whole product for the second reader,
+// and they were the hardest lines on it: single sentences of seventy-odd words in the lawyer's
+// vocabulary. The owner's ruling is that default-visible text carries no legal or engine vocabulary at
+// all, and that inside a fold the lawyer's words are allowed where a plain one would lose precision.
+//
+// THIS IS ADVISORY AND MUST STAY ADVISORY. A hit is a rewrite of that line — never a disclosure to the
+// client, never a run failure. The rule is presentation: it changes no band, no evidence and nothing
+// that is searched.
+//
+// — AND IT MUST NOT FIRE ON THE MARK IT IS CLEARING.
+//
+// This is the defect `coverage-form.mjs` records one level in: a refusal that cannot tell a mark from
+// engine vocabulary blocked a clearance on the mark SLICE, and a render-time substitution turned "AXIS
+// Bank filed in class 36" into "group Bank filed in class 36" on a report clearing AXIS. Half the words
+// here are ordinary English and several are plausible marks — PREVAIL, SENIOR, SPECIFICATION. A check
+// that flagged the mark under clearance would put noise on exactly the report that matters most, so
+// every term the run is about is excluded before the text is read.
+
+/**
+ * The lawyer's vocabulary, as WORKED EXAMPLES with the plain form beside each. Not a ban list: the
+ * issue rejects "a list of forbidden words as the mechanism" in terms, and this is what the reviewer
+ * offers a seat as the rewrite, which is a different thing from a gate that refuses.
+ *
+ * Each entry is [what a lawyer writes, what the reader needs]. The second half is the load-bearing one —
+ * a flag naming a word teaches nothing, and the seat has to produce a sentence.
+ */
+export const PLAIN_FORMS = Object.freeze([
+  ["proprietor", "owner"],
+  ["subsisting", "live"],
+  ["specification", "goods list"],
+  ["citable", "earlier marks the office can raise against you"],
+  ["prevail", "win"],
+  ["formative", "names built on"],
+  ["belt-and-braces", "extra"],
+  ["non-use attack", "could be cancelled for not being used"],
+  ["on the record as it stands", "on what we found"],
+  ["marks-and-goods comparison", "same name, same goods"],
+  ["dispatch", "the request"],
+  ["instructed", "what was asked"],
+  ["chunk", ""],
+]);
+
+/** The longest visible sentence a reader should meet. The issue's number, not a derived one. */
+export const SENTENCE_WORD_LIMIT = 25;
+
+/** Everything the run is ABOUT — the mark, its variants, the owners named. Never flagged. */
+const ownTerms = (about = {}) => {
+  const out = [];
+  for (const v of [about.mark, ...(about.marks ?? []), ...(about.owners ?? []), ...(about.terms ?? [])]) {
+    const s = String(v ?? "").trim();
+    if (s) out.push(s.toLowerCase());
+  }
+  return out;
+};
+
+/** Sentences, split on terminators that end one. Crude on purpose — this counts words, not grammar. */
+export const sentencesOf = (text) =>
+  String(text ?? "").split(/(?<=[.!?])\s+/).map((s) => s.trim()).filter(Boolean);
+
+export const wordsIn = (sentence) => String(sentence ?? "").trim().split(/\s+/).filter(Boolean).length;
+
+/**
+ * What is wrong with one default-visible line, as rewrite advice. `[]` means nothing to say.
+ *
+ * `about` carries the run's own marks and owners so they are never reported — see the header. A term
+ * that IS the thing being cleared is not the lawyer's vocabulary, it is the subject.
+ */
+export function plainRegisterFlags(text, about = {}) {
+  const raw = String(text ?? "");
+  if (!raw.trim()) return [];
+  const mine = ownTerms(about);
+  // Blank the run's own terms before reading, rather than filtering hits afterwards: a mark can contain
+  // one of these words ("PREVAIL"), and a hit inside it is not a hit at all.
+  let scan = raw;
+  for (const t of mine) {
+    if (!t) continue;
+    scan = scan.replace(new RegExp(t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "gi"), " ");
+  }
+
+  const flags = [];
+  for (const [term, plain] of PLAIN_FORMS) {
+    const re = new RegExp(`\\b${term.replace(/[-]/g, "[- ]").replace(/\s+/g, "\\s+")}\\b`, "i");
+    if (!re.test(scan)) continue;
+    flags.push({
+      kind: "vocabulary",
+      term,
+      say: plain
+        ? `"${term}" is the lawyer's word — the reader needs "${plain}". Rewrite the sentence, do not swap the word.`
+        : `"${term}" is an engine word and has no place on a page a client reads. Rewrite the sentence.`,
+    });
+  }
+
+  for (const s of sentencesOf(raw)) {
+    const n = wordsIn(s);
+    if (n > SENTENCE_WORD_LIMIT) {
+      flags.push({
+        kind: "length",
+        words: n,
+        say: `${n} words in one sentence, and a visible line takes ${SENTENCE_WORD_LIMIT}. Split it — one idea per sentence, `
+          + "the conclusion first. Do not shorten it by dropping the reason.",
+      });
+    }
+  }
+  return flags;
+}
+
+/**
+ * The fields a reader meets before opening anything. Named here rather than at each call site so the
+ * two products answer to one list — the knockout and the clearance drifted apart once already.
+ */
+export const DEFAULT_VISIBLE_FIELDS = Object.freeze({
+  knockout: ["summary", "batchOpener", "basis", "net", "factors", "counterFactors", "mitigation", "standardCaveats", "reviewerNotes"],
+  clearance: ["summary", "oneLiner", "registrability", "thirdPartyRights", "ownRights", "freedomToOperate", "reviewerNotes", "coverage"],
+});

package/driver/portal-access.mjs

@@ -17,7 +17,7 @@ const domainOf = (email) => { const e = String(email ?? "").toLowerCase(); const
 /**
  * makePrincipal({ email, grants, staffDomains }) →
  *   { role: "staff",  email, accounts: "*" }            — firm identity: everything, acting-for allowed
- * | { role: "client", email, accounts: ["aurora", …] }  — enrolled client: exactly the granted accounts
+ * | { role: "client", email, accounts: ["foxglade", …] }  — enrolled client: exactly the granted accounts
  * | null                                                — unknown identity: no portal (the door 403s)
  * Staff wins over an (accidental) grants row; a client row with a tenant-wide "*" grant is honored
  * but the role stays client (no staff surfaces).

package/driver/portal-config-view.mjs

@@ -239,6 +239,41 @@ export function authView({ mode = "", oidcIssuer = "", team = "", jwksUrl = "",
   };
 }
 
+/**
+ * Where the staff-domain rule was written, so a reader can go and undo it.
+ *
+ * ── WHY A PAGE THAT NAMES A RULE MUST ALSO NAME ITS ADDRESS ─────────────────────────────────────────
+ *
+ * The People & access screen renders the rule — "Anyone at <domain> — a rule, not a person" — and said
+ * nothing about where it came from. A reader who does not recognise the domain therefore learns that
+ * strangers may hold an administrator's view of their instance and has no next step at all: the value
+ * is in an environment variable, in one of two files depending on how the instance is run, and neither
+ * is named anywhere on the screen. The one outside reader who met this reported it as a back door,
+ * twice, which is the correct thing to do with an access rule you cannot trace.
+ *
+ * PURE, and it answers "could not tell" as itself. `envLoad` is `shared/env-local.mjs`'s own report of
+ * what this process read, so the answer describes the process actually serving the page rather than
+ * being composed from a path that some other process would have read — the distinction that module
+ * exists for. A service started by systemd took its configuration from an EnvironmentFile; a child of
+ * `clearotron start` was handed an explicit environment and read no file at all; a hand-run CLI read
+ * the CLI's file. Each gets its own sentence, because the remedy is a different file in each.
+ */
+export function staffRuleSource({ name = "PORTAL_STAFF_DOMAINS", value = "", envLoad = null,
+                                  unitEnvFile = null, cliEnvFile = null } = {}) {
+  if (!String(value ?? "").trim()) return null;
+  const reason = envLoad?.reason ?? null;
+  const applied = Array.isArray(envLoad?.applied) ? envLoad.applied : [];
+  if (reason === "read" && applied.includes(name))
+    return { name, where: `read from ${envLoad.path}` };
+  if (reason === "service-managed")
+    return { name, where: unitEnvFile ? `set in this service's environment file, ${unitEnvFile}` : "set in this service's environment" };
+  if (reason === "opted-out")
+    return { name, where: cliEnvFile
+      ? `handed to this service by the command that started it, which takes it from ${cliEnvFile} or derives it from the sign-in address`
+      : "handed to this service by the command that started it" };
+  return { name, where: cliEnvFile ? `set in this service's environment (the file it would otherwise read is ${cliEnvFile})` : "set in this service's environment" };
+}
+
 /**
  * The enrolment view: who is granted what, and where an enrolment is half done.
  *
@@ -246,7 +281,7 @@ export function authView({ mode = "", oidcIssuer = "", team = "", jwksUrl = "",
  * they are reported separately — a staff member absent from the grants file is normal, not a fault,
  * and listing them as "unenrolled" would bury the real problems.
  */
-export function accessView({ grants, staffDomains = [], knownAccounts = [], grantsFile = null }) {
+export function accessView({ grants, staffDomains = [], knownAccounts = [], grantsFile = null, staffRule = null }) {
   const tenants = grants?.tenants ?? {};
   const known = new Set(knownAccounts);
   const people = [];
@@ -277,6 +312,10 @@ export function accessView({ grants, staffDomains = [], knownAccounts = [], gran
   return {
     people: people.sort((a, b) => a.email.localeCompare(b.email)),
     staffDomains: [...staffDomains],
+    // An ADDITIONAL field rather than a reshape of `staffDomains`: that array is parsed by the browser
+    // contract and read by three screens' worth of arms, and a rule nobody can trace is a copy problem,
+    // not a data-shape problem. Null when there is no rule, or when the source could not be told.
+    staffRule,
     // Accounts named in grants that no profile matches — the other typo direction.
     unknownAccounts: [...unknownAccounts].sort(),
     // Where to go to change any of this — a filename and a date, so "I want to add someone" has a

package/driver/portal-families.mjs

@@ -18,7 +18,7 @@
 // ── the shape ────────────────────────────────────────────────────────────────────────────────────────
 //
 //   { "schema": 1,
-//     "families": { "hydra-range": { "name": "Hydra range", "account": "aurora" } },
+//     "families": { "hydra-range": { "name": "Hydra range", "account": "foxglade" } },
 //     "of":       { "<runId>": "hydra-range" } }
 //
 // Keyed by RUN rather than by mark. A mark is not a thing the pool stores — it is a grouping the browser