clearotron 0.2.2 → 0.2.4

package/docs/architecture/04-configuration-reference.md

@@ -283,6 +283,8 @@ because the rule is about what PRODUCT CODE reads, not about what a run reads.
 |---|---|---|
 | `DEMO_PORT` | `18900` | Port `npx clearotron demo` serves the replayed report on. `--port` overrides it. |
 | `CLEAROTRON_DEMO` | unset | `1` puts this install in the DEMO posture. **Ordering is real**: the four products are listed and orderable, the form, the plan and the confirmation are the product's own, and the confirmation resolves to a finished report that already exists rather than dispatching — no engine turn, no register call, no queue entry, no run directory (owner ruling 2026-08-31, superseding the greyed-control ruling of the same day). A product the demo carries no finished report for refuses and names which one. It also re-aims two boot warnings written for an operator of a real deployment at the visitor who is not one, from one place (`driver/demo-posture.mjs`). **Set by `npx clearotron demo`, not by an operator** — it is passed explicitly to the two processes that have a reason to know (the portal and the MCP door; the worker is not told, because a demo never queues anything for it to drain), and those run with `CLEAROTRON_NO_ENV_FILE=1`, so a stray `.env` can neither put a live install into demo mode nor take a demo out of one. Anything but the literal `1` is not a demo. Replaces `PORTAL_DEMO`, which named only one of the processes that has to know. |
+| `CLEAROTRON_TEST_FIXTURE_PROFILES` | unset | `1` makes the profile loader return the three suite fixtures, which are refused from every roster otherwise. Set by `scripts/test-run.mjs`, never by an operator; an explicit `includeTestFixtures` argument beats it. Effect class `harness`; the full contract is its row in `.env.example`. |
+| `CLEAROTRON_DEMO_PROFILES` | unset | `1` makes the profile loader return the bundled demo account, which a fresh install does not resolve (owner ruling 2026-09-08). Set by `clearotron demo`, `start --demo` and the suite runner, never by an operator. The gate is on the bundled layer, so a deployment's own configured store keeps its `demoData` accounts either way. Effect class `harness`; the full contract is its row in `.env.example`. |
 | `PORTAL_LOCAL_CREDENTIAL` | `~/.cordillera/portal-local-credential.json` | Where local sign-in keeps its passphrase DIGEST. `npx clearotron demo` points it inside the demo's own base directory, so a demo mints its own passphrase instead of inheriting a digest minted for another address — and removing the demo stays one `rm -rf`. |
 | `PORTAL_LOCAL_PASSPHRASE` | unset | **NEVER set this in a file.** An internal one-shot handoff, not an operator control: on a first FOREGROUND start the supervisor mints the passphrase and hands it to the portal it spawns *at the spawn call*, so the closing summary can print the value beside the address rather than sending a first-time reader back into eleven startup log lines for the one value in this product that cannot be read back. It is deliberately absent from the composed child environments, because that composition is what `--background` writes into the units' env file — a passphrase there would be a permanent plaintext copy on disk and the product's own sentence, "it is stored only as a digest", would stop being true. Setting it in any env file recreates exactly that. Lost passphrase: `clearotron passphrase --reset`. |
 | `PORTAL_URL` | `http://127.0.0.1:18802`, or built from `PORTAL_SERVICE_HOST`/`PORTAL_SERVICE_PORT` | Where the deploy tick's live-surface check expects to reach the portal. |

package/docs/architecture/05-config-governance.md

@@ -136,6 +136,11 @@ boxes rebuild.
 
 ## 5. Env-var register (by domain → tier)
 
+**[`04-configuration-reference.md`](04-configuration-reference.md) is the variable table**, and it is
+the one two instruments read — `driver/doc-constants.mjs` and `scripts/env-audit.mjs`. What follows
+here is the governance view: which tier a name sits in and who may change it. When the two disagree
+about what a variable *does*, 04 is right and this page is stale.
+
 Tiers: T3 = operator-tunable (candidate for read-only display); T4 = backend-only (secret,
 structural, or dev seam); [dev] = dev/test seam, never set in prod.
 
@@ -303,6 +308,20 @@ Staff MCP: `TRADEMARK_MCP_HTTP_PORT` (18790), `TRADEMARK_MCP_HTTP_HOST`,
 `TRADEMARK_MCP_EMAIL_CLAIM`, `TRADEMARK_MCP_AUTH_HEADER`, `TRADEMARK_MCP_URL`,
 `TRADEMARK_MCP_AUTH_MODE` (see below),
 `TRADEMARK_MCP_AUTH_DISABLED` / `TRADEMARK_MCP_DEV` (dev seams — never set in prod).
+
+`TRADEMARK_MCP_KEY_SOCKET` is the local key door, and it is a PATH rather than a port on purpose. This
+interface serves two populations that authenticate differently: people arriving through a tunnel, who
+prove themselves with a proxy identity, and programs on the same machine holding a scoped access key,
+which can never produce one. "Only accept a key from loopback" does not separate them — the tunnel daemon
+runs on the same machine, so a request forwarded from the internet and one from the local portal arrive
+with the same peer address. A tunnel forwards to a port and cannot reach a unix socket, so the transport
+is the discriminator and the two doors are separate objects with opposite rules.
+
+Unset means no key door, and a deployment gets exactly the door it had before. The socket is created
+`0660` — owner and group only — with the mode set after `listen`, because `listen` creates the file and
+the umask decides what it starts as. It refuses to open at all with no grants file, alongside
+`TRADEMARK_MCP_AUTH_DISABLED`, or when `TRADEMARK_MCP_AUTH_MODE` is `token`: that mode makes the NETWORK
+door take a key too, which is the thing this exists to prevent. Read by `mcp-server/key-socket.mjs`.
 Client MCP: `CLIENT_MCP_HTTP_PORT` (code default 18811, matching the deployed unit; it was 18795,
 which collided with a co-hosted warm-MCP block, so keep any unit override that names a port),
 `CLIENT_MCP_HTTP_HOST`, `CLIENT_MCP_ALLOWED_HOSTS`,

package/docs/architecture/05-customer-profiles.md

@@ -3,8 +3,8 @@
 > Part of the architecture pack (`docs/architecture/`). The driver's module tree and the headless
 > integrator contract are in [`driver/README.md`](../../driver/README.md).
 > This chapter describes the profile *mechanism*. Real customer bundles load from an external store
-> via `CLEAROTRON_CUSTOMERS_DIR` and no customer is named here; the repository ships `generic` plus the
-> synthetic demo customers `aurora`, `zephyr` and `petcary` — see
+> via `CLEAROTRON_CUSTOMERS_DIR` and no customer is named here; the package ships `generic` and the demo
+> brand owner, and the repository holds three further synthetic profiles for the test suite — see
 > [`driver/profiles/`](../../driver/profiles/).
 
 One engine, never forked — three layers. The reasoning core is shared by every client; the client

package/docs/configuration.md

@@ -115,9 +115,10 @@ under that framework. Absent, the generic set applies.
 
 ## 3. Client profiles
 
-One JSON file per client under [`driver/profiles/`](../driver/profiles/). Four ship as working
-examples: `generic` (the Generic default) plus three synthetic demo clients — `aurora` (gaming),
-`zephyr` (functional drinks) and `petcary` (animal health).
+One JSON file per client under [`driver/profiles/`](../driver/profiles/). Two are published as working
+examples: `generic` (the Generic default) and the demo brand owner. Three further synthetic profiles —
+gaming, functional drinks and animal health — exist in the repository for the test suite and are left
+out of the package.
 
 A job picks its profile by **forwarding domain** — `matchDomains[]`, exact host or dot-suffix. The
 applicant named in a request never selects a profile. Resolution happens once at run start and is

package/docs/decisions/0006-what-the-public-repository-carries.md

@@ -29,11 +29,36 @@ cut, not before: `cut/rules.mjs` treats a rule matching nothing as a refusal, so
 does not yet exist cannot be pre-added, and `driver/test/release-pipeline.test.mjs` reds the moment the
 file exists undecided.
 
-**The drop list is `shared/withheld-paths.mjs`, and it is the only place a cut decision is recorded.** Two
-tests read it: `driver/test/publication-scrub.test.mjs` fails a shipped file that cites a withheld path
-without a declared reason, and `driver/test/no-caveat-repair.test.mjs` treats an absent-and-declared file
-as a stated consequence rather than damage. A decision recorded anywhere else — an issue, a chat, a comment
-— is not recorded.
+**The drop list is `shared/withheld-paths.mjs`, and it is the only place a cut decision is recorded.** A
+decision recorded anywhere else — an issue, a chat, a comment — is not recorded.
+
+**Amended 2026-09-09.** This paragraph named two tests as the enforcement: `publication-scrub` and
+`no-caveat-repair`. Neither exists. Measured across both repositories that day: neither file is tracked,
+neither is on disk, and neither was ever added or deleted in either repository's history. A decision
+record that names enforcement which was never written is worse than one that names none, because a
+reader stops looking. What follows is what actually holds the line.
+
+**The drop list itself does not ship.** It stays with the archive by owner ruling, 2026-08-31, so the
+published tree carries no copy — and neither, today, does any other tree. `CUT_RECORD_PRESENT` is false
+everywhere the code runs.
+
+**What enforces the cut today is `shared/withheld-paths-access.mjs` and its three readers.** The accessor
+is the only thing that reads the drop list, and it is written to work where the list is absent:
+
+| Reader | With the list | Without it, which is every tree today |
+|---|---|---|
+| `scripts/citation-line-check.mjs` | a withheld file's citations need not resolve | every file crosses the cut, so every citation must resolve |
+| `scripts/mint-suite-census.mjs` | a withheld test file is a stated absence | a removed test file is a LOSS |
+| `shared/reference-guard-classes.mjs` | withheld paths are skipped | nothing is skipped, so the whole tree is counted |
+
+Every one degrades **stricter**, never weaker, which is the property that makes the absence safe. A
+separate record of what was cut is kept with the archive rather than published, so this repository can be
+checked without it.
+
+**The gap, stated rather than left to be found.** Because no tree carries the list, the with-the-list
+column above has never run. What is enforced today is the strict fallback, not the record — and a check
+that has never executed its other branch is a check whose other branch is unproven. The accessor
+announces which mode it is in, once, so a reader of any run can tell which column applies.
 
 **What survives a withheld document is the fact itself, moved to where the code enforces it:**
 

package/driver/CHANGELOG.md

@@ -1,5 +1,95 @@
 # clearotron-driver
 
+## 0.2.4
+
+### Patch Changes
+
+- d35dd9b: Fixed: A search that was planned and never run is disclosed on the report again, even when another search mentions the same word.
+  
+  One row on the coverage section says a planned search never reached the register. That row was removed whenever another row's heading carried the same words. A row for a search that had run and found nothing could remove it.
+  
+  So a report could mention a term in its coverage section and say nothing was left undone. The only disclosure of the gap had been dropped. A completed search no longer stands in for an uncompleted one.
+  
+  Re-rendering an archived report restores the row where this had removed it.
+- b47be41: Fixed: Seven fixed sentences on the clearance report are now written for the person reading it.
+  
+  These lines print on every report and none of them was written for a client. The footer explained the risk-band vocabulary to a developer. A paragraph defined a label most readers never saw on their page. An internal coverage note ran to about a thousand characters of the engine's own search names and ended mid-word.
+  
+  Registration numbers no longer carry "(placeholder)" where the register has no per-record link — the number stands on its own. A gap that was disclosed twice, once in the model's words and once in the engine's, is disclosed once. Three section captions say what the section is rather than how it was produced. And a use check that found nothing no longer prints an evidence tag beside it, which read as a contradiction.
+  
+  The page also no longer calls itself a working draft for legal review. That sentence printed on every report and went with the footer rewrite; it is a deliberate removal, not a casualty of one.
+  
+  Nothing here changes what was searched, counted, rated or judged. Every fact about where a record came from is still there: the registration numbers, the dates they were read, the year each was registered.
+- a4c9045: Fixed: The demo now names the register its example run was captured against.
+  
+  `clearotron demo` said the run came from a production EU register. It did not. All four frozen runs were captured against Clarivate Compumark, which is what their own records and the reports say. The label also carried a capture date that matches none of the four runs, so it has gone.
+  
+  The line now says what it is: a real run against Clarivate Compumark, and replaying it needs no account, no key and no network. That last part was always true and is worth saying where a reader meets it.
+- f3bab16: Fixed: The lines a client reads first are now checked for the profession's vocabulary and for sentences carrying more than one idea. The reviewing pass rewrites them before delivery. Nothing about the check is shown to the client, and no run fails over it. A report clearing a name like PREVAIL is unaffected, because the mark being cleared is never read as a legal term.
+- 862f76a: Fixed: The screen that will not start a search now gives advice that fits your machine.
+  
+  An install with the engine program present, but invisible to the engine service, was told to install a program it already had. That advice cannot work. Following it changes nothing, because the engine reads its PATH when it starts. Until it is restarted, every screen reports what it saw at startup. Nothing said so.
+  
+  The New clearance notice now tells those two states apart. Where the program is absent it gives the install advice as before. It adds that the service has to be restarted afterwards before it will notice. Where the program is present and the engine cannot see it, the notice says that instead, and names the restart as the remedy. Staff also get a link from that notice to the configuration page.
+  
+  The configuration page's engine row now names the program it could not find. It names the command that installs it too, and `clearotron doctor` says the same, in the same words.
+
+## 0.2.3
+
+### Patch Changes
+
+- 54ea03a: Fixed: The configuration check no longer reports a problem when the client connector's address is reached with its own token. Putting a single sign-on front before it is the client's choice, and running it token-based is supported. The check still says the sign-in audience was not compared against that address, so it never implies the two agree.
+- 4b6be02: Fixed: A bundled risk framework now states where it came from in words a customer can read. The note used to carry a confidentiality marking, a filename for a document not included, an internal reference number and revision history. It says whose framework it is, who stands behind it and which revision, and nothing else.
+- 63f916c: Fixed: A fresh install's brand-owner list now offers Generic and, with the demo, the demo account. It offered three of our test accounts as well, on the install route that clones the repository.
+- 5d12baa: Fixed: A run record now says which version of the engine's command-line tool served it. A change in results can be traced to a tool upgrade rather than guessed at.
+  
+  Fixed: A version the tool could not report is recorded as unreadable. An absent field could not be told apart from a probe that never ran.
+- 888de5d: Fixed: The deployment check now says whether each scheduled job's timer is still armed. A timer-driven service reads "inactive" between runs and when its timer has been stopped. So a check that asked only about the service could report nothing wrong while the scheduled work had quietly stopped happening.
+- 3a75e22: Fixed: A supplementary memo now succeeds on its first attempt. It cost two turns instead of one, and left a retried-stage mark on a report that had been delivered cleanly.
+  
+  Fixed: A supplementary memo states the rating framework it was reasoned under. A report assessed under a customer's own framework said so; a memo written from it did not.
+- fe22384: Fixed: Installing on a Node version the engine cannot run on now stops at once. It names the version you have, the version needed, and the command that fixes it. Before, the install finished and the first US register search failed with an error that never mentioned Node. The supported floor is Node 22.13 or newer.
+- 74b2cdd: Fixed: Setup now asks which address signs in, instead of turning it into an access rule covering everyone who shares its email domain.
+  
+  For operators: The People & access page now names the setting behind a staff rule, and the file to edit to undo it.
+- 9053919: Fixed: Five things a first-time reader could not act on.
+  
+  A screen that needs a brand owner chosen no longer points at the top left when the menu is collapsed and there is nothing there.
+  
+  The profile editor's Save button now states the one thing that is blocking it. That reason was always there, but it looked the same as the states where nothing is wrong.
+  
+  The default jurisdictions field now says what it does with what you type. Entries are checked against the list and kept, never refused. A region counts as one entry.
+  
+  The trademark categories field explains what those numbers are, with examples, before naming the standard they come from.
+  
+  The row of coloured ratings under "Risk framework in force" now says it belongs to that framework. It used to read as a list of several frameworks. Both editors say it the same way.
+- fe22384: For operators: Clearotron runs on Node 22.13 or newer again, down from 22.19, because its HTTP client moves back to version 7. Anyone who upgraded Node for the last release has nothing to undo.
+- bb899a7: New: A screening report now leads with the read. Each conflict shows its name, band, source and a one-sentence verdict. The paragraph arguing that verdict is one click away. Register filings appear as conflicts only where the reviewer rated them above the lowest band; the rest stay in the filings table.
+  
+  New: What was asked is now at the top of a screening report, with any question about whether it was the right thing to ask. Both used to sit at the bottom.
+  
+  New: The long per-name assessment now opens from the read. The engine has always written it and the page never showed it.
+  
+  New: Register counts say what they counted in their column headers. Territories are named rather than printed as two-letter codes.
+  
+  New: The lines a reader meets before opening anything are written in plain language. That is the summary, the basis line, each conflict's one sentence and the reviewer's notes. Legal vocabulary stays where the detail is.
+  
+  Fixed: Reviewer notes no longer appear on a screening report exported to PDF. They are for the reviewing lawyer, and a report forwarded to a client used to carry them.
+- 2a812d6: Fixed: The New clearance screen now has a **Start a search** button. The button that ran a search used to say "Review clearance", and people could not tell it was the way to begin.
+  
+  Fixed: When a search cannot start yet, the screen says what is still missing, both on the form and beside the button. It used to grey the button out and give no reason at all.
+  
+  Fixed: **Save as search** now confirms the save beside the button that was pressed, names what was saved, and links to it. It gave no sign at the point of the click.
+  
+  Fixed: The unsaved-changes warning no longer fires on a search you have just saved. It compared the form against a blank one and nothing ever reset it.
+  
+  Fixed: The message shown when no search engine is attached now names the setup command for the way you installed. It used to name the one that only works in a copy of the source.
+- 58af0b7: Fixed: The settings page no longer shows the engine as healthy when the engine program cannot be found.
+  
+  That page reports which engine is configured. The New clearance screen reports whether a search can start right now. When those two readings disagreed, neither screen said so.
+  
+  An install could therefore show a green engine while no search would start, and nothing explained the gap. The settings page now names the disagreement and says what to do about it. Running `clearotron doctor` reports the same thing in the same words.
+
 ## 0.2.2
 
 ### Patch Changes

package/driver/README.md

@@ -1,4 +1,4 @@
-# clearotron-driver — deterministic driver for the prelim-search trademark workflow
+# clearotron driver — deterministic orchestration for the trademark clearance workflow
 
 Orchestration in **code**; the LLM does only judgment leaves. Each pipeline stage is **one blocking
 engine turn** (default engine: `anthropic-agent`, shelling `claude -p` per stage); fan-out/fan-in/
@@ -18,8 +18,7 @@ the gather MCP servers live.
 ```
 integrator ──job JSON (enqueue CLI / start_run / queue file)──┐
                                                               ▼
-                    systemd .path (watches every queue) ──▶ prelim-driver.service
-                    systemd .timer (~90s fallback re-drain) ─▶ (same oneshot)
+                    clearotron-worker.service (the built-in worker, watches every queue)
    └─ node runner.mjs ─▶ for each queue: claim ─▶ pipeline(job, {agent}) ─▶ runStage() ─▶
                          engine turn (`claude -p`, blocking) ─▶ leaf turn
 ```
@@ -42,8 +41,28 @@ identity ran it. Headless deployments with no per-agent workspaces use one expli
   delivered report, run failure, intake rejection, duplicate skip, late-bind ack — is a
   self-contained packet in the outbox (`outbox.mjs`). Integrators consume events over the ops MCP
   (`list_outbox_events` → `get_delivery_packet` → send → `mark_sent`/`ack_event`) and never touch the
-  driver's filesystem. `deliver-trigger.sh` + `systemd/prelim-outbox.*` are the reference wake-up for
-  an agent-based integrator.
+  driver's filesystem. `deliver-trigger.sh` is the reference wake-up for an
+  agent-based integrator. The outbox units beside it are retired — see the units row below.
+
+## What a file name tells you
+
+Eleven suffixes carry a meaning across the whole directory. They are a naming convention rather than
+a framework — nothing enforces them — but they are consistent enough that the suffix tells you what
+kind of thing a module is before you open it.
+
+| suffix | what the module is |
+|---|---|
+| `-model` | a pure parser or shape: text or JSON in, a validated structure out, no I/O |
+| `-record` | a recording transport — the typed call a stage makes and the row it writes |
+| `-form` | a driver-written form a stage fills in, with its own validation |
+| `-io` | the reader and writer for a form's file, kept apart from the form's shape |
+| `-union` | the accumulator that merges many writes into one form |
+| `-call` | the model-call half of a pair: what the stage is asked to send |
+| `-tool` | the driver-write half of the same pair: what the driver does with what came back |
+| `-duty` | an obligation check — was something the run owed actually done |
+| `-gate` | a refusal: a condition that stops a run or a stage rather than reporting on it |
+| `-ledger` | an append-only account of what happened, read back for coverage and audit |
+| `-verdict` | a pure function from evidence to a stated answer, with its reason |
 
 ## Files
 
@@ -63,7 +82,7 @@ identity ran it. Headless deployments with no per-agent workspaces use one expli
 | `coverage-ledger.mjs` | Machine coverage-ledger contract: strict JSON-mirror parser (token-first throws), prose parser, `REGISTER_AXES`/`decideAxes`. |
 | `enqueue-schema.mjs` | Job-file shape + `validateJob`. |
 | `dev-portal.mjs` | Loopback-only dev-instance UI (static pool + `/profiles/*` proxy) for dry-run testing — see `../docs/E2E.md` Tier 1b. |
-| `systemd/*` | Reference units: `prelim-driver.path` (watches the queues) + `prelim-driver.timer` (fallback re-drain) → `prelim-driver.service` (oneshot drain); `prelim-outbox.*` (outbox wake). |
+| `systemd/*` | `clearotron-worker.service` is the live worker and what a deployment runs. The path/timer/oneshot drain units and the outbox-wake units beside them are RETIRED: the built-in worker replaced that posture. Their files stay until the production rebuild — `unit-inventory.mjs` records the ruling and the reason, and reports a retired unit's absence as expected rather than as a fault. They keep their original names because a deployed box still holds them under those names. |
 
 ## Key engine facts
 

package/driver/common-law-receipts.mjs

@@ -154,7 +154,7 @@ export function countMatrixCells(findingsContent) {
  * "丝绸与铁 / 席尔克": each alternate is its own search term with its own grid — the copper-conduit worker
  * keyed the split forms with full receipts while the validator demanded the compound key, 2026-06-12);
  * or WORD-BOUNDARY substring coverage (a fully-receipted variant covers a LONGER variant containing it
- * as a whole-word phrase — "Aurora Legends II: Oak & Ember" ⊃ "Oak & Ember"; a marketplace phrase
+ * as a whole-word phrase — "Foxglade Legends II: Oak & Ember" ⊃ "Oak & Ember"; a marketplace phrase
  * search for the short form surfaces every listing of the long form. Mid-word containment does NOT
  * count: "venzyy" ⊅ "venzy" — storefront search tokenizes, a doubled-letter variant is its own term).
  */

package/driver/config-staleness.mjs

@@ -5,7 +5,7 @@
 // ── THE OUTCOME THIS EXISTS TO STOP ─────────────────────────────────────────────────────────────────
 //
 // After the F41 repair the owner restarted the worker, as instructed, and refreshed the portal. It
-// showed the BUNDLED DEMO ROSTER — aurora, petcary, zephyr — and not his own account.
+// showed the BUNDLED DEMO ROSTER and not his own account.
 //
 //     ~/.env repaired   10:51:16
 //     worker            10:51:21   ← new config

package/driver/connotation-search.mjs

@@ -769,7 +769,7 @@ export function segmentBinding({ segment_index, fragment } = {}, candidate) {
   //
   // SO THE MEASUREMENT SURVIVES THE ENFORCEMENT. A fragment that arrives is still weighed and still
   // matched, and the verdict rides out on `fragmentState` for the receipts histogram — which is how the
-  // transcription-quality signal scruffy used to settle this stays measurable after the duty that
+  // transcription-quality signal testing used to settle this stays measurable after the duty that
   // produced it is gone. Never charge for it: an unbound fragment is a fact about the model, and the
   // seat's ruling is not worse for it.
   const frag = String(fragment ?? "").trim();

package/driver/contract-audit.mjs

@@ -276,7 +276,11 @@ export const E3_BACKLOG_KINDS = [...E3_KINDS, "other"];
 
 const E3_PATTERNS = [
   { kind: "literal-json-skeleton", re: /```json|\{\s*"[a-z_]+"\s*:/i },
-  { kind: "exactly-these-keys", re: /EXACTLY (?:these|one of|the)|keys EXACTLY|EXACTLY \{|closed enum|key set is closed|additionalProperties/i },
+  // `EXACTLY the` USED TO STAND ALONE, and it is ordinary English: "puts its noise on exactly the
+  // report that matters most" is prose about a report, not a dictated key set, and the pattern is
+  // case-insensitive so the lower-case form matched too. The alternative now names what may follow it,
+  // which is the only form that dictates a set. Everything else in this pattern is byte-identical.
+  { kind: "exactly-these-keys", re: /EXACTLY (?:these|one of)|EXACTLY the (?:following|keys|fields)|keys EXACTLY|EXACTLY \{|closed enum|key set is closed|additionalProperties/i },
   // A quoted or backticked template carrying a <placeholder>, close to an instruction to emit it. The
   // placeholder class is deliberately loose (`<comma-separated DOMAINS>`, `<N>`, `<one record URI>`) —
   // the tell is a shape dictated for a parser to read back, not the casing inside the angle brackets.

package/driver/contract-e3-baseline.json

@@ -17,7 +17,7 @@
     },
     "common-law": {
       "literal-json-skeleton": 0,
-      "exactly-these-keys": 3,
+      "exactly-these-keys": 2,
       "dictated-line-shape": 0
     },
     "common-law-half": {
@@ -52,7 +52,7 @@
     },
     "synthesis": {
       "literal-json-skeleton": 10,
-      "exactly-these-keys": 9,
+      "exactly-these-keys": 8,
       "dictated-line-shape": 5
     },
     "case-law": {
@@ -114,7 +114,7 @@
     },
     "skills/prelim-common-law/SKILL.md": {
       "literal-json-skeleton": 0,
-      "exactly-these-keys": 2,
+      "exactly-these-keys": 1,
       "dictated-line-shape": 2
     },
     "skills/prelim-register/SKILL.md": {
@@ -129,7 +129,7 @@
     },
     "skills/placement-inquiry/SKILL.md": {
       "literal-json-skeleton": 1,
-      "exactly-these-keys": 4,
+      "exactly-these-keys": 3,
       "dictated-line-shape": 1
     },
     "skills/prelim-register/digest.md": {
@@ -139,7 +139,7 @@
     },
     "skills/prelim-search/phase2-execution.md": {
       "literal-json-skeleton": 0,
-      "exactly-these-keys": 2,
+      "exactly-these-keys": 0,
       "dictated-line-shape": 3
     },
     "skills/frame-diff/SKILL.md": {
@@ -149,12 +149,12 @@
     },
     "skills/prelim-search/synthesis-rules.md": {
       "literal-json-skeleton": 1,
-      "exactly-these-keys": 7,
+      "exactly-these-keys": 1,
       "dictated-line-shape": 2
     },
     "skills/prelim-search/firm-wide-reasoning.md": {
       "literal-json-skeleton": 0,
-      "exactly-these-keys": 2,
+      "exactly-these-keys": 0,
       "dictated-line-shape": 0
     },
     "skills/prelim-search/risk-framework.md": {
@@ -164,7 +164,7 @@
     },
     "skills/prelim-search/worked-examples.md": {
       "literal-json-skeleton": 0,
-      "exactly-these-keys": 1,
+      "exactly-these-keys": 0,
       "dictated-line-shape": 1
     },
     "skills/prelim-search/report-prose.md": {
@@ -179,7 +179,7 @@
     },
     "skills/narrative-refutation/SKILL.md": {
       "literal-json-skeleton": 0,
-      "exactly-these-keys": 3,
+      "exactly-these-keys": 2,
       "dictated-line-shape": 1
     },
     "skills/prelim-search/delivery-contract.md": {
@@ -189,7 +189,7 @@
     }
   },
   "totals": {
-    "stages": 47,
-    "files": 78
+    "stages": 45,
+    "files": 64
   }
 }

package/driver/dev-portal.mjs

@@ -301,7 +301,7 @@ async function loadOutbox(){const r=await(await fetch("/dev/outbox")).json();
 let REG=null;
 const esc=(s)=>String(s??"").replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;");
 async function loadSearches(){
- const cust=$("#s_cust").value.trim()||"aurora";
+ const cust=$("#s_cust").value.trim()||"demo-brand-owner";
  try{
   const all=await(await fetch("/recipes")).json();
   if(all.error){$("#searches").innerHTML='<span class="err">'+esc(all.error)+'</span>';return;}
@@ -320,7 +320,7 @@ async function loadSearches(){
 function useProduct(k){const f=$("#f");f.product.value=k;$("#f_recipe").value="";f.mark.focus();}
 function useRecipe(cust,slug){const f=$("#f");f.product.value="";$("#f_recipe").value=slug;f.profile.value=cust;f.mark.focus();}
 async function composeSubmit(save){
- const cust=$("#s_cust").value.trim()||"aurora";
+ const cust=$("#s_cust").value.trim()||"demo-brand-owner";
  const fd=new FormData($("#sf"));
  const recipe={label:(fd.get("label")||"").trim(),base:fd.get("base")};
  if(fd.get("registerProbe")!=null)recipe.components={registerProbe:true};

package/driver/doubt-selection.mjs

@@ -100,7 +100,7 @@ export function doubtsForClosure({ doubts = null, doubtClosure = null } = {}) {
   // The event exists to answer whether a cut is WORTH giving a value, before any row has one: if most
   // doubts carry no tier the cut saves nothing. A count written only when the cut is live needs the cut
   // to exist in order to measure whether the cut should exist — the circularity pipeline.mjs's own
-  // comment says this event prevents. Found by role-e2e eggie on the R2 artifacts.
+  // comment says this event prevents. Found in review on the R2 artifacts.
   //
   // `keepSet` null means "keep everything": nothing is ever dropped, `ids` is discarded below, and the
   // dispatch stays byte-identical. Only the COUNTS change.

package/driver/drainer-identity.mjs

@@ -136,7 +136,7 @@ export function drainerVerdict({ stamp, headCommit, isAlive, processes, ppidOf =
     : "";
 
   if (!alive) {
-    // ── THE ONE BRANCH THE POSTURE DECIDES (tracker issue 206, ruled by overwatch 2026-09-06).
+    // ── THE ONE BRANCH THE POSTURE DECIDES (decided 2026-09-06).
     //
     // The same empty answer means two opposite things. Where a worker holds the queue open, a gone
     // drainer is the outage: nothing is executing runs and nothing will start one. Where the box drains

package/driver/driver.config.mjs

@@ -248,7 +248,7 @@ export const config = {
   // 2026-07-19: these were joined against DRIVER_DIR, so the driver read framework manifests out of
   // its BUNDLED driver/skills while CLEAROTRON_INSTRUCTIONS_DIR pointed the agent at the config store. A
   // customer whose framework lives only in the config store therefore hard-failed at attachFramework
-  // with `framework_manifest_missing` — the first Aurora Interactive run died there before any stage ran.
+  // with `framework_manifest_missing` — a test account's first run died there before any stage ran.
   get skillsRoot() { return dirname(this.skillsDir); },
 
   // ── Per-agent paths ───────────────────────────────────────────────────────

package/driver/effort-model.mjs

@@ -218,7 +218,7 @@ export const costBand = (i) => Math.max(1, Math.min(5, Math.ceil(effortUnits(i)
 // range is the thing this section was rebuilt to remove; do not reintroduce one without a new ruling.
 
 /**
- * THE QUOTED BOUNDS. ONE SOURCE — owner ruling, 2026-08-23, relayed by overwatch.
+ * THE QUOTED BOUNDS. ONE SOURCE — owner ruling, 2026-08-23.
  *
  * WHAT THIS REPLACED, and why a constant beat a model. The old quote was a base plus one adder per lane:
  * 1.5h, +0.5 for case law, +0.5 for a native-language lane, +0.5 for a single territory. It missed the
@@ -264,7 +264,7 @@ export const quoteBoundsFor = (l) => TURNAROUND_QUOTE[deriveMode(l) === "knockou
 /**
  * The bounds for THIS job. The ruled range, and NOTHING is done to it.
  *
- * — OWNER RULING, 2026-08-26, relayed by overwatch: "No compute. We just say 1.5–2.5 hours for
+ * — OWNER RULING, 2026-08-26: "No compute. We just say 1.5–2.5 hours for
  * big reports, period. Keep it simple." The question put to him was which run-slot cap the quote should
  * divide by, and he removed the division instead of answering it.
  *

package/driver/engine/cli-version.mjs

@@ -0,0 +1,103 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// THE VERSION OF THE BINARY THAT SERVED A RUN, captured at dispatch.
+//
+// The record already says whether the model id the provider reported names a pinned build or an alias it
+// may repoint. That answers "did the model move". It cannot answer "did the TOOL move", and the two are
+// different questions with the same symptom: a run whose judgment differs from last week's.
+//
+// Nothing recorded it. Three archived runs were walked for every spelling of a version field and carried
+// none — so what served them is not recoverable, and the box could have answered at any time.
+//
+// ── UNREADABLE IS A VALUE, NOT AN OMISSION ──────────────────────────────────────────────────────────
+//
+// The whole point of the field is telling three states apart, and only one of them is "we know":
+//
+//   { version: "2.1.241", probe: "ok" }          the binary answered
+//   { version: null, probe: "unreadable", why }  it was asked and could not say
+//   (no field at all)                            this record predates the gauge
+//
+// An omission on failure collapses the middle into the third, and a reader comparing two runs cannot
+// tell a tool that would not answer from a record written before anybody asked. That distinction is the
+// reason for the field, so failing to write it is failing at the thing rather than at the edge of it.
+//
+// ── ONE SPAWN PER BUILD, NOT PER PROCESS ────────────────────────────────────────────────────────────
+//
+// A dispatch is many stages and every stage would otherwise pay. But the cache lives as long as the
+// process, and the process is NOT one run: the drainer's watch loop calls the pipeline for job after job
+// without exiting. A first version cached there would be reported as fact for every later run in that
+// process — including runs served by a binary somebody upgraded in place underneath it.
+//
+// That is the exact silence this field exists to end, reintroduced by the cache meant to make it cheap,
+// and it would have been invisible: the record would carry a version, confidently, and be wrong.
+//
+// So the key is the path AND what the filesystem says about the file — an in-place upgrade changes the
+// modification time and the size, so it misses the cache and is probed again. The path alone is not
+// enough (two engines can point at one binary, an engine can be repointed) and the engine id is not
+// enough for the same reason.
+//
+// A file the filesystem cannot describe is NOT CACHED at all. Caching an unreadable probe under a key
+// derived from a failed stat would pin the failure for the life of the process, so a binary that
+// appeared a moment later would keep reading as absent.
+// ── WHAT THIS DEPENDS ON, WHICH IS NOT ENFORCEABLE FROM HERE ────────────────────────────────────────
+//
+// A probe that can change what it probes is not a probe. This one spawns the engine binary, so it rests
+// on `--version` being side-effect-free — true of every real CLI and not something this module can make
+// true. It bit immediately: the suite's engine stand-ins fell through to their stage path, and one of
+// them counts invocations to decide when to fail, so the probe consumed the failure a retry test was
+// measuring and the retry never happened. The symptom was an attempt count off by one, three files away
+// from the cause.
+//
+// The stand-ins now answer `--version` and exit, which is what the binaries they stand in for do. A new
+// one that forgets will produce the same off-by-one, so `driver/test/a-run-records-the-tool-that-served-it`
+// asserts every engine stand-in answers — the cheap ratchet under a condition that cannot be checked at
+// the call site.
+import { execFileSync } from "node:child_process";
+import { statSync } from "node:fs";
+
+/** Live for the process, keyed by resolved path. A run is one process; a probe is one spawn. */
+const CACHE = new Map();
+
+/** The first version-shaped token in the output, or the whole first line when nothing matches. */
+export function parseVersion(out) {
+  const line = String(out ?? "").split("\n").map((l) => l.trim()).filter(Boolean)[0] ?? "";
+  if (!line) return null;
+  // These CLIs answer `2.1.241`, `codex-cli 0.5.0`, `claude 2.1.241 (Claude Code)`. Take the first
+  // dotted number and keep it; a build that answers in prose is recorded verbatim rather than dropped,
+  // because a string somebody can compare beats a null.
+  return (line.match(/\b\d+\.\d+(?:\.\d+)?(?:[-+][0-9A-Za-z.-]+)?\b/) ?? [line])[0];
+}
+
+/**
+ * Probe one binary. PURE apart from the spawn, which is injected so an arm can drive both branches
+ * without a binary on the box — the unreadable branch is the one that matters and it cannot be produced
+ * on demand from a real install.
+ *
+ * Never throws. A probe that could take down a dispatch would be a worse defect than the gap it closes.
+ */
+export function probeCliVersion(bin, { run = null, timeoutMs = 5000, cache = CACHE, stat = statSync } = {}) {
+  if (!bin) return { version: null, probe: "unreadable", why: "no engine binary was resolved" };
+  let key = null;
+  try { const st = stat(bin); key = `${bin}\u0000${st.mtimeMs}:${st.size}`; } catch { /* not cacheable */ }
+  if (key && cache.has(key)) return cache.get(key);
+  const spawn = run ?? ((b) => execFileSync(b, ["--version"], {
+    encoding: "utf8", timeout: timeoutMs, stdio: ["ignore", "pipe", "ignore"],
+  }));
+  let result;
+  try {
+    const version = parseVersion(spawn(bin));
+    result = version
+      ? { version, probe: "ok" }
+      // It ran and said nothing a version could be read from. That is not the same as failing to run,
+      // and a reader chasing a tool change needs to know which happened.
+      : { version: null, probe: "unreadable", why: "the binary answered with no version-shaped token" };
+  } catch (e) {
+    result = { version: null, probe: "unreadable", why: String(e?.message ?? e).slice(0, 160) };
+  }
+  if (key) cache.set(key, result);
+  return result;
+}
+
+/** Drop the cache. For arms, and for a caller that has just repointed an engine deliberately. */
+export function forgetCliVersions(cache = CACHE) { cache.clear(); }