clearotron 0.2.2 → 0.2.3

package/driver/unit-inventory.mjs

@@ -123,16 +123,22 @@ export const UNIT_INVENTORY = Object.freeze([
     // exists to make impossible — and a mechanism that installs itself is the easiest kind to ship
     // undeclared.
     unit: "clearotron-deploy", runsOn: ["test"],
-      measured: "2026-09-07, test box: the timer and its service are installed under ~/.config/systemd/user/ and the service has run — see /home/testuser/deploy/autodeploy.log. The timer's ARMED state is not part of this claim; a lane may hold it, and a hold is recorded in the deploy log rather than inferred from ActiveState.",
+      measured: "2026-09-08, the test deployment: the timer and its service are installed for that deployment's own user, the timer is enabled and ACTIVE, and it last fired within the hour — `systemctl --user list-timers`. The service's own state says nothing about this: it is `inactive` between runs and `inactive` when the timer has been stopped. The timer's ActiveState is what says anything will start it again.",
     tracked: ["clearotron-deploy.service", "clearotron-deploy.timer"],
-    note: "the install's own updater. Ships tracked, runs nowhere yet.",
-    orphanReason: "SHIPPED AND PLACED ON NO BOX YET, which is a THIRD kind of orphan and not either of "
-      + "the other two: courtlistener-mcp runs on production under another name, feedback-mint was "
-      + "deliberately switched off, and this one has simply never been installed. `runsOn` gains "
-      + "\"test\" the day a test deploy places it and \"prod\" when the owner asks for it. Until then it "
-      + "stays out of CHECKED_UNITS, because asking systemd about a unit nobody installed produces a "
-      + "\"not compared\" row that reads like a fault and is not one. It goes on with "
-      + "`systemctl --user enable --now clearotron-deploy.timer` once bin/onboard.mjs has written both files.",
+    note: "the install's own updater. Placed on the test deployment, where it pulls hourly; production takes it when the owner asks.",
+    // IT WAS AN ORPHAN, AND THE CONDITION IT NAMED HAS BEEN MET. This entry carried an `orphanReason`
+    // saying it had been shipped and installed nowhere, and that `runsOn` would gain "test" the day a
+    // deploy placed it. It has: the timer is installed, enabled and firing, and `runsOn` says so. The prose
+    // stayed behind the field, which is the ordinary way a declaration and its explanation come apart —
+    // and it matters more here than usual, because this entry is now what puts a real timer into the
+    // timer list. An entry describing itself as installed nowhere, whose timer the check asks systemd
+    // about by name, is a contradiction a reader has to resolve before trusting either half.
+    //
+    // AND THE POSTURE IS NOW STATED, because it is a change in what a red means rather than in code: a
+    // STOPPED deploy timer FAILS. The service reads `inactive` between runs and `inactive` when nothing
+    // will ever run it again, so the timer's own state is the only thing separating a deployment that
+    // tracks the main branch from one quietly frozen on whatever it last built. If the timer is ever
+    // held deliberately, a check that says so for as long as the hold lasts is the behaviour to want.
   },
   {
     // ── `tracked` WAS A CLAIM ABOUT A FILE THAT HAS NEVER EXISTED (tracker issue 175) ──────────────
@@ -142,10 +148,23 @@ export const UNIT_INVENTORY = Object.freeze([
     // `live-surface-check` FAILED on a healthy box — the worst kind of red, because it teaches a reader
     // to scroll past the check that would catch a unit genuinely gone missing.
     //
-    // THE ROW STAYS, AND DELETING IT WOULD HAVE BEEN THE WRONG FIX. The unit is LIVE ON PRODUCTION, as
-    // the note below has said all along. Removing the entry would make this inventory stop knowing about
-    // something that is running — the same failure it exists to prevent, pointed the other way. What was
-    // false is the `tracked` claim, not the unit.
+    // THE ROW STAYS, AND DELETING IT WOULD HAVE BEEN THE WRONG FIX. What was false then was the
+    // `tracked` claim, not the row. Removing the entry would make this inventory stop knowing about a
+    // unit it ships nothing for — the same failure it exists to prevent, pointed the other way.
+    //
+    // ── AND THE OTHER HALF OF THAT PARAGRAPH HAS NOW BEEN MEASURED FALSE TOO ───────────────────────
+    //
+    // It read "The unit is LIVE ON PRODUCTION, as the note below has said all along", and it had been
+    // said all along without ever being enumerated. Production was read on 2026-09-08 — every account
+    // on the machine, unit file names and enable state — and no unit of this name exists under any of
+    // them. An earlier reading the same day reached the same answer from the other direction while
+    // closing a different question.
+    //
+    // So `runsOn` is empty and the note says what was measured. This is a change to what this
+    // repository CLAIMS about production, made because a reading contradicted the claim, and not a
+    // statement that production should not run it — that is a deployment question and it is the
+    // owner's. If the answer is yes, `runsOn` gains "prod" in the change that deploys it, against a
+    // fresh enumeration, which is this file's own rule rather than an exception to it.
     //
     // Declared the way its siblings are: `tracked: null` with the reason, which this file's own header
     // calls the sanctioned way to say the repo does not carry one.
@@ -156,16 +175,31 @@ export const UNIT_INVENTORY = Object.freeze([
     // is a change which ADDS a file, measured against the deployed copy, and it is not this one. Two
     // prose references in driver/systemd/render-units.mjs also describe this file as though it were in
     // the tree; they are stale today either way.
-    unit: "profile-service", runsOn: ["prod"], tracked: null,
+    unit: "profile-service", runsOn: [],
+      measured: "2026-09-08: production read by account — the deployment account carries six clearotron-* "
+      + "unit files and the doctrine-sync timer, the legacy account carries five units belonging to the "
+      + "other product plus unloadable residue, and no unit of THIS name is under either. Names and enable "
+      + "state only; no unit contents were read.",
+    tracked: null,
     untrackedReason: "the repository has never carried this file — `git log --all` on the path is empty. "
-      + "It deploys from the production box's own copy, in the same CF Access template family as "
-      + "trademark-portal and trademark-ops-mcp. Whether a placeholder should now ship is open: see above.",
+      + "It was described as deploying from a copy held on the deployment itself, in the same "
+      + "identity-provider template family as two other pre-rename names; the 2026-09-08 reading finds no "
+      + "such copy under any account, so that description is history rather than current state. Whether a "
+      + "placeholder should now ship is open: see above.",
     // NO LONGER RESOLVED AT INSTALL. It carried `@CLEAROTRON_CHECKOUT_DIR@` because
     // it loaded no EnvironmentFile and so had no `${VAR}` systemd could expand. The owner's one-config-
     // per-server-box ruling gives it `EnvironmentFile=%h/.env` like every other service, which makes the
     // checkout path an ordinary systemd expansion and leaves no placeholder to render.
-    note: "LIVE ON PRODUCTION. an earlier record lists it as never run; that is true of the test box only. "
-      + "Was a TEMPLATE unit carrying CF Access values inline; generic since tracker issue 1925.",
+    note: "NOT RUNNING ANYWHERE, measured 2026-09-08. This row said LIVE ON PRODUCTION for as long as it "
+      + "existed and no enumeration ever supported it. Was a TEMPLATE unit carrying identity-provider "
+      + "values inline; generic since tracker issue 1925.",
+    orphanReason: "CLAIMED A DEPLOYMENT IT WAS NEVER MEASURED ON, which is a FOURTH kind of orphan and "
+      + "the only one that was ever a wrong claim rather than a waiting decision: the other three run "
+      + "under another name, were deliberately switched off, or have simply never been installed. This "
+      + "one was declared live and read as absent. The row is kept because the deployment question is "
+      + "open and belongs to the owner — whether production should run this service at all — and an "
+      + "inventory that deleted the row would lose the only place that question is written down. It "
+      + "gains a deployment the day an enumeration shows it, never the day someone intends it.",
   },
   {
     // RUNS ON NO BOX YET, AND THAT IS THE HONEST DECLARATION. `runsOn: ["prod"]` is a claim about a
@@ -249,8 +283,11 @@ export const UNIT_INVENTORY = Object.freeze([
       + "alternatives, and running both puts a second claimant on one queue.",
   },
   {
-    unit: "trademark-portal", runsOn: ["prod"],
-      measured: "2026-09-07, test box: LoadState=not-found. No unit of this name exists there. The `test` claim was inherited from before the rename to clearotron-* and was never remeasured; the `prod` claim is left alone because production was NOT measured here.", tracked: null,
+    unit: "trademark-portal", runsOn: [],
+      orphanReason: "THE PRE-RENAME PORTAL. The deployment account runs `clearotron-portal`; this name is "
+      + "what that service used to be called, and the 2026-09-08 reading finds no unit of this name under "
+      + "any account. It ran on production until the rename and the entry was never re-measured after it.",
+      measured: "2026-09-08: production read by account — the deployment account carries six clearotron-* unit files and the doctrine-sync timer, the legacy account carries five units of the other product plus unloadable residue, and no unit of THIS name is under either. Names and enable state only. This line previously carried a 2026-09-07 reading of the test deployment — LoadState=not-found there, with the production claim left alone because production had not been measured. It has been now, and this is that reading.", tracked: null,
     untrackedReason: "the deployed copy carries real Cloudflare Access team/AUD/domain values inline. "
       + "A tracked file would be the placeholder TEMPLATE, merged by hand after a "
       + "diff — writing one carelessly replaces working auth with placeholders that look configured.",
@@ -261,13 +298,19 @@ export const UNIT_INVENTORY = Object.freeze([
     supersededName: "portal-service.service (deleted, owner-ruled 2026-08-14)",
   },
   {
-    unit: "trademark-ops-mcp", runsOn: ["prod"],
-      measured: "2026-09-07, test box: LoadState=not-found. No unit of this name exists there. The `test` claim was inherited from before the rename to clearotron-* and was never remeasured; the `prod` claim is left alone because production was NOT measured here.", tracked: null,
+    unit: "trademark-ops-mcp", runsOn: [],
+      orphanReason: "THE PRE-RENAME OPERATOR DOOR. The deployment account runs `clearotron-mcp-face`; the "
+      + "2026-09-08 reading finds no unit of this name under any account. Same rename as the portal it "
+      + "serves, and the same claim carried across it unmeasured.",
+      measured: "2026-09-08: production read by account — the deployment account carries six clearotron-* unit files and the doctrine-sync timer, the legacy account carries five units of the other product plus unloadable residue, and no unit of THIS name is under either. Names and enable state only. This line previously carried a 2026-09-07 reading of the test deployment — LoadState=not-found there, with the production claim left alone because production had not been measured. It has been now, and this is that reading.", tracked: null,
     untrackedReason: "same CF Access inline-values shape as the portal it serves.",
   },
   {
-    unit: "client-mcp", runsOn: ["prod"],
-      measured: "2026-09-07, test box: LoadState=not-found. No unit of this name exists there. The `test` claim was inherited from before the rename to clearotron-* and was never remeasured; the `prod` claim is left alone because production was NOT measured here.", tracked: ["client-mcp.service"],
+    unit: "client-mcp", runsOn: [],
+      orphanReason: "THE PRE-RENAME CLIENT DOOR. `clearotron-client-mcp` runs on both the production and "
+      + "the test deployments; the 2026-09-08 reading finds no unit of THIS name under any account. The "
+      + "tracked template stays because the repository still ships it — see the note.",
+      measured: "2026-09-08: production read by account — the deployment account carries six clearotron-* unit files and the doctrine-sync timer, the legacy account carries five units of the other product plus unloadable residue, and no unit of THIS name is under either. Names and enable state only. This line previously carried a 2026-09-07 reading of the test deployment — LoadState=not-found there, with the production claim left alone because production had not been measured. It has been now, and this is that reading.", tracked: ["client-mcp.service"],
     note: "TRACKED, in mcp-server/remote/ — this entry said it had no file, and the file was there. It is "
       + "a banner-marked TEMPLATE, so the live copy differing from it is the arrangement, not drift. "
       + "#1147 ADDED THE TEST BOX (2026-08-18): the client surface ran nowhere but production, so the test "
@@ -278,18 +321,79 @@ export const UNIT_INVENTORY = Object.freeze([
       + "not the default.",
   },
   {
-    unit: "client-mcp-apikey", runsOn: ["prod"], tracked: ["client-mcp-apikey.service"],
+    unit: "client-mcp-apikey", runsOn: ["test"],
+      measured: "2026-09-08, read by account: enabled and present on the TEST deployment, beside the "
+      + "renamed `clearotron-client-mcp`. Absent from production under any account. The entry declared "
+      + "production and the reading puts it on the other deployment — the claim was not stale, it named "
+      + "the wrong machine. Why it runs there at all beside the renamed door is a separate question.",
+      tracked: ["client-mcp-apikey.service"],
     note: "TRACKED, in mcp-server/remote/. Same correction as client-mcp: the old reason claimed the live "
       + "key made a tracked file impossible, and the tracked TEMPLATE — which holds no key — already existed.",
   },
   {
-    unit: "trademark-artifacts-http", runsOn: ["prod"], tracked: ["trademark-artifacts-http.service"],
+    unit: "trademark-artifacts-http", runsOn: [],
+      orphanReason: "A PRE-RENAME NAME OF THE RETIRED DEPLOYMENT, and the one of them whose tracked file "
+      + "is GENERIC rather than a template — so the file is ready to be compared against a live copy the "
+      + "day something runs it, and nothing does. Read as absent under every account on 2026-09-08.",
+      measured: "2026-09-08: production read by account — no unit of this name is under the deployment account or the legacy one. Names and enable state only; no unit contents were read.", tracked: ["trademark-artifacts-http.service"],
     note: "TRACKED, in mcp-server/remote/. GENERIC, not a template: it carries no banner and no "
       + "placeholder, and defers its CF Access values to the EnvironmentFile — so its live copy is "
       + "expected to MATCH the tracked file, and a difference is real drift.",
   },
   {
-    unit: "client-access", runsOn: ["prod"], tracked: null,
+    unit: "clearotron-mcp-local", runsOn: ["prod"], tracked: null,
+    untrackedReason: "the fifth hand-made door on production, on 18793, kept as it is by ruling while "
+      + "the product fix lands. Known and hand-made is not the same as declared: it was running on "
+      + "production and named by no inventory, no unit file and no line of code in this repo, so the "
+      + "health check could not see it and nothing would have said if it stopped. Declared here to end "
+      + "that, not to bless the arrangement.",
+  },
+  {
+    unit: "clearotron-doctrine-sync", runsOn: ["prod"], tracked: null,
+    // WHAT SYSTEMD KNOWS THIS UNIT AS, which `tracked` cannot say here. For a tracked unit the file
+    // list carries the suffixes — `clearotron-deploy` names its `.service` AND its `.timer` — so a
+    // reader deriving systemd queries from the entry gets both. An UNTRACKED unit ships no files, so
+    // `tracked: null` leaves nothing to derive from and the bare name silently means `.service`.
+    // Stated separately so the two questions stay apart: `tracked` is what this repo SHIPS,
+    // `systemdUnits` is what the box RUNS.
+    systemdUnits: ["clearotron-doctrine-sync.service", "clearotron-doctrine-sync.timer"],
+    // ── THE ONE WHOSE SILENCE REACHES A CLIENT ────────────────────────────────────────────────────
+    //
+    // This is the timer half of production's doctrine refresh. The stages read doctrine to decide what
+    // they do, so if it stops, production runs clearances against whatever doctrine last landed and NO
+    // SURFACE ANYWHERE SAYS SO — the client receives a report that looks exactly like a current one.
+    //
+    // That is a client-facing failure with no detector, which is what the drift check exists for, and
+    // the drift check could not see this unit because the unit was in no list.
+    //
+    // BEING IN THIS LIST IS NOT YET DETECTION, AND SAYING SO IS THE POINT OF THIS PARAGRAPH. Every name
+    // here is bare, and `systemctl show <bare>` answers for the `.service`. For a timer-driven unit that
+    // service is `inactive` BETWEEN RUNS and `inactive` when its timer has been stopped — the same
+    // answer to both questions. So the health check can now say this unit exists and cannot say whether
+    // anything still starts it, which is the failure the entry was written for.
+    //
+    // The signal lives on `clearotron-doctrine-sync.timer`, whose ActiveState separates `active`
+    // (waiting) from `inactive` (stopped). What is missing is not the NAME — `systemdUnits` below
+    // carries it — but a consumer: the check derives its queries from the bare unit rather than from
+    // that field, so the timer is written down and never asked about.
+    //
+    // WHEN THE CHECK DERIVES ITS QUERIES FROM `systemdUnits` RATHER THAN FROM THE BARE NAME, THIS
+    // PARAGRAPH IS OBSOLETE — and the field below is what it will read. Stated as a condition rather
+    // than as a pointer to where it is being done, because a condition is self-verifying: a reader
+    // confirms or refutes it by looking at the check today, and the day the derivation lands this reads
+    // as history instead of as an open item.
+    untrackedReason: "the doctrine refresh on production, timer-driven, running from no file in "
+      + "driver/systemd/ and named nowhere in this repo. It CAN be tracked — it carries no "
+      + "identity-edge value — and nobody wrote it down. Until it is, its absence is at least no "
+      + "longer silent.",
+  },
+  {
+    unit: "client-access", runsOn: [],
+      orphanReason: "NOT THIS REPOSITORY'S SERVICE, and no longer running under this name: the legacy "
+      + "account holds it only as `client-access.service.retired-20260904`, a suffix systemd never reads. "
+      + "Declared here so a unit sharing a machine with ours is not invisible, and now declared as gone.",
+      measured: "2026-09-08: present on the legacy account ONLY as a retired-suffixed filename, which "
+      + "systemd does not load. No loadable unit of this name under any account.", tracked: null,
     untrackedReason: "it is not this repo's service. Its ExecStart runs a script from a different "
       + "product's checkout on the same box, not under this clone — so there is no code here to "
       + "template, and the old reason (CF Access values inline) would send the next reader hunting for a "
@@ -453,6 +557,59 @@ export const CHECKED_UNITS = Object.freeze(
   UNIT_INVENTORY.filter((u) => u.runsOn.length > 0).map((u) => u.unit),
 );
 
+/**
+ * The TIMER units this deployment claims to have, by name, as systemd spells them.
+ *
+ * ── WHY A SECOND LIST AND NOT MORE NAMES IN THE ONE ABOVE ───────────────────────────────────────────
+ *
+ * `CHECKED_UNITS` holds BARE names, and that is load-bearing rather than an accident: the verdict
+ * appends the suffixes itself when matching what a box is running, so one entry answers for a unit's
+ * service, timer and path alike. The health check then asks `systemctl show <bare>`, and systemd
+ * resolves a bare name to the `.service`.
+ *
+ * For a timer-driven unit that is the wrong question, and it is wrong in the direction that hides the
+ * failure. The service of a timer-driven unit reads `ActiveState=inactive` **between runs** — it is
+ * meant to — and it reads `inactive` when its timer has been STOPPED. Identical strings, opposite
+ * meanings, and the check could report the unit exists while being unable to say whether anything
+ * still starts it. That is the whole of what a timer entry is for.
+ *
+ * The signal lives on the `.timer`, whose `ActiveState` separates `active` (armed and waiting) from
+ * `inactive` (stopped, and nothing will fire the service again).
+ *
+ * ── WHERE THE NAMES COME FROM ───────────────────────────────────────────────────────────────────────
+ *
+ * From `tracked`, which already lists the files an entry accounts for, so a shipped timer is covered
+ * with nothing new to declare and cannot be forgotten. An UNTRACKED unit has no file list to read, so
+ * it says so with `systemdUnits:` — the systemd names to ask about, which is a different fact from the files
+ * the repository ships and is why it is not folded into `tracked`. Claiming a tracked file that does
+ * not exist is a fault; naming a unit this deployment runs is a claim about a box.
+ */
+export const CHECKED_TIMERS = Object.freeze(
+  UNIT_INVENTORY.filter((u) => u.runsOn.length > 0)
+    .flatMap((u) => (u.systemdUnits ?? u.tracked ?? []).filter((f) => f.endsWith(".timer")))
+    .sort(),
+);
+
+/**
+ * Judge the timers. PURE — the caller reads systemd.
+ *
+ * `inactive` is the finding here, which inverts the reflex a reader brings from services. A stopped
+ * timer breaks nothing now and nothing fails: the service simply never fires again, and every surface
+ * that reports on the service keeps saying `inactive`, which is what it says when the timer is working.
+ */
+export function timerVerdict(timers, { probeFailed = null } = {}) {
+  if (probeFailed) return { state: "unknown", stopped: [], absent: [], message: `could not ask systemd about the timers: ${probeFailed}. That is this check failing to look, not a report about them.` };
+  const rows = timers ?? [];
+  if (!rows.length) return { state: "pass", stopped: [], absent: [], message: "no timer is declared for this box" };
+  const absent = rows.filter((t) => t.load === "not-found").map((t) => t.unit).sort();
+  const stopped = rows.filter((t) => t.load !== "not-found" && t.active !== "active").map((t) => t.unit).sort();
+  const parts = [`${rows.length} declared timer(s)`];
+  if (stopped.length) parts.push(`STOPPED: ${stopped.join(", ")} — the service each one drives will not fire again, and its own state stays 'inactive' either way`);
+  if (absent.length) parts.push(`${absent.length} declared timer(s) do not exist on this box`);
+  if (!stopped.length && !absent.length) parts.push("all armed");
+  return { state: stopped.length ? "fail" : "pass", stopped, absent, message: parts.join("; ") };
+}
+
 /** Every tracked file the inventory accounts for, flattened. */
 export const ACCOUNTED_FILES = Object.freeze(
   UNIT_INVENTORY.flatMap((u) => u.tracked ?? []),

package/driver/verify.mjs

@@ -61,7 +61,7 @@ function readRunProfile(p) {
 
 // ── doc 50: the run-scoped FROZEN framework manifest ────────────────────────────────────────────────
 // _driver/framework.json is the framework-in-force's manifest, frozen beside profile.json at
-// attachProfile time — the band vocabulary every v4 gate joins against (zephyr "Medium" vs house
+// attachProfile time — the band vocabulary every v4 gate joins against (a customer ladder's "Medium" vs house
 // "Moderate" stays consistent within a run and across resume). Same walk-up + fail-closed convention as
 // readRunProfile: absent ⇒ null (archived/legacy runs); unreadable ⇒ invalid (driver-written, so a
 // corrupt one is a bug that must surface, never a silent downgrade to the wrong vocabulary).

package/driver/whatif-memo-run.mjs

@@ -157,7 +157,7 @@ export async function seatReason({ runDir, runId, assumption, ratedUnder, findin
   const replyPath = join(runDir, MEMO_DIR, `reply-${sha(`${runId}${assumption}`).slice(0, 10)}.json`);
   mkdirSync(join(runDir, MEMO_DIR), { recursive: true });
   const r = await dispatch("whatif-memo", {
-    message: composeMemoMessage({ assumption, findings, ratedUnder, skill }),
+    message: composeMemoMessage({ assumption, findings, ratedUnder, skill, replyPath }),
     model,
     // A BOUNDED READING, and the ceiling says so. This re-reads evidence already gathered; a memo that
     // needed the clearance's own ceiling would not be the cheap thing the plan promised the reader.
@@ -230,7 +230,12 @@ export function validateMemoReply(raw) {
  * The findings are handed over as the run's own JSON rather than summarised: a memo that reasoned over
  * our paraphrase of the evidence would be answering about the paraphrase.
  */
-export function composeMemoMessage({ assumption, findings, ratedUnder = null, skill = "" } = {}) {
+// `ratedUnder` DEFAULTS HERE AND IS REFUSED BY `composeMemo`, and that asymmetry is only safe while the
+// artifact is the gate. One resolution is threaded to both, and nothing reaches disk without the memo
+// composing — so a forgotten field is caught there. It stops being safe the moment a dispatch path calls
+// this composer alone: the seat would be instructed "house default" with no artifact refusal behind it,
+// because no artifact would be composed. A caller that dispatches without composing owes its own check.
+export function composeMemoMessage({ assumption, findings, ratedUnder = null, skill = "", replyPath = null } = {}) {
   return [
     skill.trim(),
     "",
@@ -250,8 +255,21 @@ export function composeMemoMessage({ assumption, findings, ratedUnder = null, sk
     JSON.stringify(findings ?? null, null, 2),
     "```",
     "",
-    "Write the JSON object the skill dictates, and nothing else.",
-  ].join("\n");
+    // NAME THE FILE, IN THE FIRST MESSAGE. The skill says what to write and the harness was told where
+    // to look, and until this line nothing told the SEAT where to put it. A seat given a write grant and
+    // no destination writes somewhere reasonable of its own choosing — an archived run carries one such
+    // reply at its run root — and the harness then looks where it asked, does not find it, and fails the
+    // attempt on `missing_file`. The warm patch names the path, which is the whole reason the retry
+    // succeeded: the second attempt was the first one that said where.
+    //
+    // The cost of not saying it was never the failure. It was that every memo billed two dispatches for
+    // one document and left a retried stage on the parent run's ledger — an INVESTIGATE line on a report
+    // that had already been delivered clean.
+    replyPath
+      ? `Write it to this ABSOLUTE path (create parent dirs if needed): ${replyPath}`
+      : "Write the JSON object the skill dictates, and nothing else.",
+    replyPath ? "Write the JSON object the skill dictates, and nothing else." : null,
+  ].filter((l) => l !== null).join("\n");
 }
 
 /**
@@ -319,6 +337,10 @@ export async function askArchivedRun({ runId, question, requestedBy = null } = {
     body: String(reading?.body ?? ""),
     limits: Array.isArray(reading?.limits) ? reading.limits : [],
     mark: run.markName ?? null,
+    // The authority the seat was instructed to assess under, carried to the artifact rather than ending
+    // at the return value. `parentRatedUnder` answers null for a run that froze no profile, which is a
+    // fact the memo states rather than omits.
+    ratedUnder,
   });
   if (!composed.ok)
     return { ok: false, fail: MEMO_FAILS.COMPOSE_REFUSED, detail: composed.reason, missing: composed.missing };

package/driver/whatif-memo.mjs

@@ -43,10 +43,25 @@ export const REQUIRED = Object.freeze(["assumption", "parentRunId", "parentRepor
  * needs new evidence" — it is a claim, and `limitsStated` records which claim was made rather than
  * leaving a reader to infer it from silence.
  */
-export function composeMemo({ assumption, parentRunId, parentReport, date, body, limits = [], mark = null } = {}) {
+export function composeMemo({ assumption, parentRunId, parentReport, date, body, limits = [], mark = null, ratedUnder } = {}) {
   const missing = REQUIRED.filter((k) => !String({ assumption, parentRunId, parentReport, date, body }[k] ?? "").trim());
   if (missing.length) return { ok: false, missing, reason: `a memo cannot be composed without: ${missing.join(", ")}` };
 
+  // THE RATING AUTHORITY IS REQUIRED BY PRESENCE, NOT BY TRUTHINESS, because `null` is a real answer.
+  // A memo is reasoned under an authority — the seat is instructed to assess under a named framework, or
+  // told the run froze none and to stay with the house default — and until this line the only thing that
+  // reached disk was the reasoning. A lawyer may act on this document; it has to say what it was rated
+  // under.
+  //
+  // Three states, and the third is the one worth separating. A named key is one fact. The house default
+  // is a DIFFERENT fact, not an absence, and it is recorded rather than left blank. A caller that never
+  // resolved an authority at all is neither, and refusing it is the point: a memo whose artifact is
+  // silent about its authority is exactly the defect this closes, so it must not be composable.
+  if (ratedUnder === undefined)
+    return { ok: false, missing: ["ratedUnder"],
+      reason: "a memo cannot be composed without its rating authority — pass the resolved key, or null "
+        + "for a run that froze no customer profile. Absent is not the same fact as either." };
+
   const limitLines = limits
     .map((l) => ({ cannot: String(l?.cannot ?? "").trim(), smallestSearch: String(l?.smallestSearch ?? "").trim() }))
     .filter((l) => l.cannot);
@@ -64,6 +79,9 @@ export function composeMemo({ assumption, parentRunId, parentReport, date, body,
     "",
     `**Date:** ${date}`,
     `**Derived from:** ${parentReport} (run ${parentRunId})`,
+    `**Rated under:** ${ratedUnder === null
+      ? "the house default — this report's run froze no customer profile"
+      : String(ratedUnder).trim()}`,
     "",
     "## The assumption you asked me to apply",
     "",

package/examples/README.md

@@ -26,8 +26,8 @@ surfaces as a failing test rather than as a wrong report.
 (`loadGrants` in `shared/scope.mjs`) and asserted to grant what it looks like it grants — `../INSTALL.md`
 §8 tells an installer to copy this file, and a row that silently resolves to nothing means an empty
 world on their first sign-in. **Read it as a shape, not as a starting roster.** Most of the accounts it
-names — `aurora`, `zephyr`, `petcary` — are fixtures the test suite reads and are not part of the
-published package; the one a fresh install actually has is `demo-brand-owner`. Replace the names with
+names are invented and resolve to nothing on a fresh install; the one account a fresh install
+actually has is `demo-brand-owner`. Replace the names with
 your own accounts and keep the shapes: a tenant with every account, a tenant with one, a tenant whose
 users see different subsets.
 

package/examples/grants.example.json

@@ -5,27 +5,26 @@
       "users": {
         "principal@firm.example": "*",
         "associate@firm.example": [
-          "aurora"
+          "demo-brand-owner"
         ]
       }
     },
-    "aurora-direct": {
+    "brand-owner-direct": {
       "accounts": [
-        "aurora"
+        "demo-brand-owner"
       ],
       "users": {
-        "*@aurora.example": "*"
+        "*@brand-owner.example": "*"
       }
     },
     "evaluation": {
       "accounts": [
-        "zephyr",
-        "petcary"
+        "demo-brand-owner"
       ],
       "users": {
         "reviewer@partner.example": "*",
         "observer@partner.example": [
-          "zephyr"
+          "demo-brand-owner"
         ]
       }
     },

package/mcp-server/CHANGELOG.md

@@ -1,5 +1,7 @@
 # trademark-artifacts-mcp
 
+## 0.2.3
+
 ## 0.2.2
 
 ## 0.3.0-beta.0

package/mcp-server/lib/scrub.mjs

@@ -54,7 +54,7 @@ export const CLIENT_FRONT_MATTER = new Set([
 // `Generic default (generic) · Generic default framework · profile d37721cda899` → drop the profile segment.
 // The framework title is client-facing (report footer: "Rated under <title>"); the profile hash is the
 // internal identity of the config that rated the matter and is not. A custom framework carries its source
-// FILENAME too (`custom framework: Aurora Interactive ACP risk framework (risk-framework-aurora.md)`) — the
+// FILENAME too (`custom framework: Foxglade Interactive ACP risk framework (risk-framework-foxglade.md)`) — the
 // human title stays, the file is config identity and goes.
 function ratedUnderForClient(v) {
   return String(v ?? "").split("·").map((s) => s.trim())

package/mcp-server/lib/whatif.mjs

@@ -278,8 +278,8 @@ export async function whatIfRun({ confirmationToken } = {}, deps = {}) {
   // The reconstruction above carries six fields and resolveProfile keys on none of them. It reads
   // `job.profileKey` first, then falls back to `job.forwarderDomain`; the job has `forwarder` but not
   // `forwarderDomain`, and no profileKey at all. So BOTH resolution routes were dead here and every
-  // what-if silently resolved to the house `generic` profile. Measured on a petcary run:
-  // {"event":"profile-mismatch","sidecar":"petcary","resolved":"generic"} — while the client-facing
+  // what-if silently resolved to the house `generic` profile. Measured on a test-account run:
+  // {"event":"profile-mismatch","sidecar":"burrowell","resolved":"generic"} — while the client-facing
   // result reported ok:true and "Sandboxed re-run complete" and said nothing.
   //
   // WHY THAT IS WORSE THAN A WRONG LABEL. A what-if changes ONE thing and reads the difference. This

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/mcp-server/packs/ops/EXAMPLES.md

@@ -29,8 +29,8 @@ original message. It does not guess.
 
 ## Late applicant binding
 
-Requester (mid-run): *"the applicant will be Zephyr Beverages Ltd"* → `feed_context { runId,
-customer: "Zephyr Beverages Ltd" }` → the outbox later carries a `late-bind-ack` to relay.
+Requester (mid-run): *"the applicant will be Coastline Drinks Ltd"* → `feed_context { runId,
+customer: "Coastline Drinks Ltd" }` → the outbox later carries a `late-bind-ack` to relay.
 
 ## Courier wake
 

package/mcp-server/server.mjs

@@ -232,7 +232,7 @@ const tools = {
         projects: (byCustomer.get(p.key) ?? []).sort((a, b) => a.key.localeCompare(b.key)) }))
       .sort((a, b) => a.key.localeCompare(b.key));
     return {
-      _note: "Customer roster for intake resolution. Resolve by JUDGMENT — an explicit name, a misspelling (\"Zefyr\"→zephyr), or an implicit reference (\"our functional-beverage client\") all map to a key. Set the job's profileKey to the chosen customer key; OMIT it for a new/unknown customer (⇒ the neutral generic profile). If the request names a specific PROJECT/engagement under that customer (listed in `projects[]`), also set projectKey to that project's key; OMIT projectKey when no project is meant (⇒ the customer profile). CLARIFY if you cannot tell either. Never pick a profile from the sender's email domain.",
+      _note: "Customer roster for intake resolution. Resolve by JUDGMENT — an explicit name, a misspelling of one of the keys below, or an implicit reference (\"our functional-beverage client\") all map to a key. Set the job's profileKey to the chosen customer key; OMIT it for a new/unknown customer (⇒ the neutral generic profile). If the request names a specific PROJECT/engagement under that customer (listed in `projects[]`), also set projectKey to that project's key; OMIT projectKey when no project is meant (⇒ the customer profile). CLARIFY if you cannot tell either. Never pick a profile from the sender's email domain.",
       clients,
       genericFallback: "generic",
     };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clearotron",
   "type": "module",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",
@@ -13,7 +13,7 @@
   },
   "description": "Clearotron — trademark-clearance engine: deterministic orchestration driver + MCP interrogation server. Provider-agnostic, model-agnostic, runs headless (no gateway).",
   "engines": {
-    "node": ">=22.19.0"
+    "node": ">=22.13.0"
   },
   "workspaces": [
     "driver",
@@ -22,6 +22,7 @@
     "portal-ui"
   ],
   "scripts": {
+    "preinstall": "node scripts/preinstall-node-check.mjs",
     "postinstall": "node -e \"const{existsSync}=require('node:fs');const{execFileSync}=require('node:child_process');if(existsSync('scripts/install-hooks.mjs'))execFileSync(process.execPath,['scripts/install-hooks.mjs'],{stdio:'inherit'})\"",
     "prepack": "node scripts/write-build-info.mjs",
     "prepublishOnly": "node scripts/release-completeness-check.mjs",
@@ -72,7 +73,7 @@
     "buffers": "file:vendor/buffers",
     "exceljs": "^4.4.0",
     "jose": "^6.2.3",
-    "undici": "^8.10.1"
+    "undici": "^7.29.1"
   },
   "bin": {
     "clearotron": "bin/clearotron.mjs"
@@ -105,13 +106,30 @@
     "portal-ui/dist/",
     "portal-ui/package.json",
     ".env.example",
-    "!driver/profiles/aurora.json",
-    "!driver/profiles/zephyr.json",
-    "!driver/profiles/petcary.json",
-    "!driver/profiles/petcary.context.md",
-    "!driver/profiles/projects/aurora/",
-    "!driver/recipes/aurora/",
-    "!driver/recipes/zephyr/",
+    "!driver/profiles/*.json",
+    "driver/profiles/generic.json",
+    "driver/profiles/demo-brand-owner.json",
+    "!driver/profiles/*.context.md",
+    "!driver/profiles/projects/*/",
+    "driver/profiles/projects/demo-brand-owner/",
+    "!driver/recipes/*/",
+    "!driver/skills/prelim-search/risk-framework-*",
+    "driver/skills/prelim-search/risk-framework.md",
+    "driver/skills/prelim-search/risk-framework.manifest.json",
+    "driver/skills/prelim-search/risk-framework-demo.md",
+    "driver/skills/prelim-search/risk-framework-demo.manifest.json",
+    "driver/skills/prelim-search/risk-framework-triage.md",
+    "driver/skills/prelim-search/risk-framework-triage.manifest.json",
+    "!driver/skills/prelim-search/worked-examples-*",
+    "driver/skills/prelim-search/worked-examples.md",
+    "driver/skills/prelim-search/worked-examples-demo.md",
+    "!scripts/home-render-check.mjs",
+    "!scripts/ai-page-render-check.mjs",
+    "!scripts/composer-render-check.mjs",
+    "!scripts/clearances-render-check.mjs",
+    "!scripts/portal-lifecycle-check.mjs",
+    "!scripts/test-account-names.mjs",
+    "!scripts/no-test-account-reaches-the-package.mjs",
     "!**/test/",
     "!**/bench/",
     "!**/*.test.mjs",