clearotron 0.2.3 → 0.2.4

package/portal-ui/dist/assets/{index-CEYvXdqH.js → index-KFAHMgdT.js}

@@ -10415,6 +10415,7 @@ var api = {
 		accountNames: Object.fromEntries(Object.entries(asRecord(b["accountNames"])).filter(([, v]) => typeof v === "string" && v)),
 		concurrentRuns: asNumber(b["concurrentRuns"]),
 		engineMode: b["engineMode"] === "demo" ? "demo" : b["engineMode"] === "engine-unproven" ? "engine-unproven" : null,
+		engineProgramDisputed: b["engineProgramDisputed"] === true ? true : b["engineProgramDisputed"] === false ? false : null,
 		setupRoute: b["setupRoute"] === "packaged" ? "packaged" : b["setupRoute"] === "checkout" ? "checkout" : null,
 		brand: typeof b["brand"] === "string" ? b["brand"] : "",
 		stopControl: (() => {
@@ -10716,7 +10717,9 @@ var api = {
 					apiBilled: bill["apiBilled"] === true,
 					missing: asStrings(bill["missing"])
 				},
-				binaryPresent: e["binaryPresent"] === true
+				binaryPresent: e["binaryPresent"] === true,
+				program: asString(e["program"]),
+				install: asString(e["install"])
 			};
 		})() : null,
 		providers: Array.isArray(b["providers"]) ? asArray(b["providers"]).map((p) => {
@@ -14548,6 +14551,42 @@ function Missing({ go, reason }) {
 	});
 }
 //#endregion
+//#region src/contract/engineState.ts
+function engineRowFaults(engine, { programDisputed = false } = {}) {
+	return [
+		...engine.known ? [] : [`This build does not ship an engine called ${engine.id}.`],
+		...engine.billing.missing.length ? [`Set to bill an API key, and ${engine.billing.missing.join(" and ")} is not set — a run is refused rather than billed to the subscription.`] : [],
+		...engine.binaryPresent ? [] : engine.program && engine.install ? [`The engine program \`${engine.program}\` cannot be found or run on this machine. Install it with \`${engine.install}\`, then restart this service so it re-reads its PATH.`] : ["The engine program cannot be found or run on this machine."],
+		...programDisputed && engine.binaryPresent ? ["The engine program is on this machine, but the engine could not find it when it last started — so a new search will refuse. Restart the engine service, or install the CLI where the service can see it."] : []
+	];
+}
+function engineNotice({ programDisputed }) {
+	if (programDisputed === true) return {
+		state: "disputed",
+		headline: "The engine program is on this machine, but the engine could not find it when it last started.",
+		before: "So a new search will refuse. Restart the engine service, or install the CLI where the service can see it — installing it again where it already is will not change this.",
+		namesSetupCommand: false,
+		after: ""
+	};
+	return {
+		state: "absent",
+		headline: "No search engine is attached to this install.",
+		before: "Everything else works — the example report, its audit trail and the assistant connection are live right now. To start new searches, install a reasoning CLI and sign in, then run the setup wizard again",
+		namesSetupCommand: true,
+		after: "Then restart the service: this reading was taken when it started, and it will not notice a new install until it starts again."
+	};
+}
+function engineRow(engine, { programDisputed = false } = {}) {
+	const faults = engineRowFaults(engine, { programDisputed });
+	return {
+		ok: faults.length === 0,
+		name: engine.vendor ?? engine.id,
+		mono: engine.id,
+		state: engine.billing.apiBilled ? "API key" : "Subscription",
+		faults
+	};
+}
+//#endregion
 //#region src/contract/compose.ts
 function parseNames(raw) {
 	return raw.split(/[\n,]/).map((s) => s.trim()).filter(Boolean);
@@ -14781,6 +14820,8 @@ var isKnownTerritory = (entry) => {
 	const e = String(entry).trim().toLowerCase();
 	return e.length > 0 && ALL_TERRITORIES$1.some((t) => t.toLowerCase() === e);
 };
+var isTerritoryCode = (entry) => /^[A-Za-z]{2}$/.test(String(entry).trim());
+var isTerritoryEntry = (entry) => isKnownTerritory(entry) || isTerritoryCode(entry);
 function machineryFor(d, product) {
 	const knockout = product?.pipeline === "knockout";
 	return {
@@ -16590,6 +16631,8 @@ function NewClearance({ ctx }) {
 					busy,
 					demoMode: ctx.me.engineMode === "demo",
 					setupRoute: ctx.me.setupRoute,
+					programDisputed: ctx.me.engineProgramDisputed,
+					onSettings: ctx.me.role === "staff" ? () => ctx.go("/portal/admin/config") : null,
 					saveOpen,
 					saveName,
 					saveText,
@@ -16761,7 +16804,7 @@ function NameWall({ count, allowed, first, canScreen, screenName, onScreenAll })
 		}) : null]
 	});
 }
-function Footer({ startedFrom, tier, detail, units, cost, duration, runs, ready, busy, demoMode, setupRoute, saveOpen, saveName, saveText, saveNote, saveDone, editing, canSave, blockedBy, onSaveOpen, onSaveName, onSaveText, onSaveCancel, onSave, onReview, onSeeSaved }) {
+function Footer({ startedFrom, tier, detail, units, cost, duration, runs, ready, busy, demoMode, setupRoute, programDisputed, onSettings, saveOpen, saveName, saveText, saveNote, saveDone, editing, canSave, blockedBy, onSaveOpen, onSaveName, onSaveText, onSaveCancel, onSave, onReview, onSeeSaved }) {
 	return (0, import_jsx_runtime.jsxs)("div", {
 		className: "composer-footer",
 		children: [
@@ -16974,21 +17017,30 @@ function Footer({ startedFrom, tier, detail, units, cost, duration, runs, ready,
 							})
 						]
 					}) : null,
-					demoMode ? (0, import_jsx_runtime.jsxs)("div", {
-						className: "footer-demo-note",
-						role: "status",
-						style: {
-							fontSize: 12.5,
-							lineHeight: 1.45
-						},
-						children: [
-							(0, import_jsx_runtime.jsx)("strong", { children: "No search engine is attached to this install." }),
-							" ",
-							"Everything else works — the example report, its audit trail and the assistant connection are live right now. To start new searches, install a reasoning CLI and sign in, then run the setup wizard again",
-							" ",
-							(0, import_jsx_runtime.jsx)(SetupCommand, { route: setupRoute })
-						]
-					}) : (0, import_jsx_runtime.jsxs)("span", {
+					demoMode ? (() => {
+						const n = engineNotice({ programDisputed });
+						return (0, import_jsx_runtime.jsxs)("div", {
+							className: "footer-demo-note",
+							role: "status",
+							style: {
+								fontSize: 12.5,
+								lineHeight: 1.45
+							},
+							children: [
+								(0, import_jsx_runtime.jsx)("strong", { children: n.headline }),
+								" ",
+								n.before,
+								n.namesSetupCommand ? (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [" ", (0, import_jsx_runtime.jsx)(SetupCommand, { route: setupRoute })] }) : null,
+								n.after ? (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [" ", n.after] }) : null,
+								onSettings ? (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [" ", (0, import_jsx_runtime.jsx)("button", {
+									type: "button",
+									className: "link-btn",
+									onClick: onSettings,
+									children: "See what this install has"
+								})] }) : null
+							]
+						});
+					})() : (0, import_jsx_runtime.jsxs)("span", {
 						style: {
 							display: "inline-flex",
 							alignItems: "center",
@@ -18647,10 +18699,10 @@ var PROFILE_FIELDS = [
 		commaSeparated: true,
 		picker: "territories",
 		item: {
-			ok: isKnownTerritory,
-			expected: "a territory from the picker below"
+			ok: isTerritoryEntry,
+			expected: "a territory from the picker below, or a two-letter code"
 		},
-		hint: "One per line or comma-separated — pick from the list below. A region counts as one entry: European Union covers its member states, so there is no need to add them. Anything not in the list is kept and flagged rather than refused, because a search can name a territory this list does not carry."
+		hint: "One per line or comma-separated — pick from the list below, or type a two-letter code like US, EU or GB; both are understood. A region counts as one entry: European Union covers its member states, so there is no need to add them. Anything not in the list is kept and flagged rather than refused, because a search can name a territory this list does not carry."
 	},
 	{
 		key: "platforms",
@@ -20683,20 +20735,7 @@ function Auth({ auth }) {
 	}) : null] });
 }
 function Engine({ engine, programDisputed = false }) {
-	const billed = engine.billing.apiBilled ? "API key" : "Subscription";
-	const faults = [
-		...engine.known ? [] : [`This build does not ship an engine called ${engine.id}.`],
-		...engine.billing.missing.length ? [`Set to bill an API key, and ${engine.billing.missing.join(" and ")} is not set — a run is refused rather than billed to the subscription.`] : [],
-		...engine.binaryPresent ? [] : ["The engine program cannot be found or run on this machine."],
-		...programDisputed && engine.binaryPresent ? ["The engine program is on this machine, but the engine could not find it when it last started — so a new search will refuse. Restart the engine service, or install the CLI where the service can see it."] : []
-	];
-	return (0, import_jsx_runtime.jsx)(Row$1, {
-		ok: faults.length === 0,
-		name: engine.vendor ?? engine.id,
-		mono: engine.id,
-		state: billed,
-		faults
-	});
+	return (0, import_jsx_runtime.jsx)(Row$1, { ...engineRow(engine, { programDisputed }) });
 }
 function Provider({ p }) {
 	const faults = p.remedy ? [p.remedy] : p.configured ? [] : p.provider === null ? [`No register is selected. Set ${p.missing.join(" and ")}.`] : !p.known ? [`This build does not ship a provider called ${p.provider}.`] : [`Set ${p.missing.join(" and ")}.`];

package/portal-ui/dist/index.html

@@ -49,7 +49,7 @@
     -->
     <link rel="preconnect" href="https://api.fontshare.com" crossorigin />
     <link href="https://api.fontshare.com/v2/css?f[]=satoshi@400,500,700,900&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/portal/assets/index-CEYvXdqH.js"></script>
+    <script type="module" crossorigin src="/portal/assets/index-KFAHMgdT.js"></script>
     <link rel="stylesheet" crossorigin href="/portal/assets/index-1ziUJX1E.css">
   </head>
   <body>

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,7 @@
 # trademark-oauth-mcp-bridge
 
+## 0.2.4
+
 ## 0.2.3
 
 ## 0.2.2

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/scripts/added-reference-check.mjs

@@ -2,110 +2,59 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 //
-// A BARE `#NNN` ADDED IN A DIFF IS REFUSED. What is already here is not this check's business.
+// WHAT THIS CHANGE ADDS IS REFUSED. What is already here is not this check's business.
 //
 //   node scripts/added-reference-check.mjs [--base <ref>]
 //
 // ── WHY THIS IS DIFF-SHAPED AND NOT A SWEEP ──────────────────────────────────────────────────────
 //
-// This tree carries 3,828 of these tokens across 542 files. They are opaque numbers into an archived
-// tracker — no client data and no private name — and they are the residual the export's ratchet
-// accepted, not a leak. A guard that refused them all would refuse every pull request from its first
-// day, and a guard everybody bypasses protects nothing. So this one asks a smaller question that has a
-// clean answer: did THIS change add another one.
+// The classes below have a standing population in this tree: citations into a tracker nobody outside
+// can open, account names, home directories, and the words this project uses for how it is built. A
+// guard that refused them all would refuse every pull request from its first day, and a guard
+// everybody bypasses protects nothing. So this one asks a smaller question that has a clean answer:
+// did THIS change add another.
 //
-// The 3,828 are somebody's work, filed and costed. When they go, the allowlist below goes with them and
-// this check widens to the whole tree in the same pull request.
+// The standing population is not therefore accepted. It is counted, per file and per class, in
+// `driver/test/fixtures/public-residue-backlog.json`, and the floor beside it refuses any file that
+// grows. Between the two, the number can only fall: this check stops the inflow and the floor stops
+// the backsliding. Neither works alone — a diff guard with no floor watches the total drift upward one
+// repaired-and-reintroduced line at a time, and a floor with no diff guard is a number that goes stale
+// the first time somebody adds a file.
 //
 // ── WHAT IT READS, AND WHAT IT DELIBERATELY DOES NOT ─────────────────────────────────────────────
 //
 // COMMENTS AND PROSE ONLY. A hash followed by digits is not always a reference: a three-digit one is
 // also a CSS colour, and a composite key or a fixture string can hold anything. Reading only comment
-// markdown keeps the check away from every context where the token means something else, which is what
-// lets it refuse without a table of exceptions that would rot.
+// and markdown text keeps the check away from every context where the token means something else,
+// which is what lets it refuse without a table of exceptions that would rot.
 //
-// SO A TEST NAME IS OUT OF SCOPE, and that is a real hole rather than an oversight: 2,650 of the 3,828
-// are test names, which are string literals. Named here so the next reader does not have to rediscover
-// it — widening to string literals means deciding what to do about CSS and composite keys first, and
-// that decision belongs with the cleanup, not with this.
+// SO A TEST NAME IS OUT OF SCOPE, and that is a real hole rather than an oversight: most of the
+// standing citation population is test names, which are string literals. Named here so the next reader
+// does not have to rediscover it — widening to string literals means deciding what to do about CSS and
+// composite keys first, and that decision belongs with the cleanup, not with this.
 //
 // LINK TARGETS ARE EXEMPT. A markdown anchor and a URL fragment are addresses, not references.
 //
-// AND `tracker issue NNN` PASSES, because it carries no `#` at all. That is the form this project
-// writes, and the guard exists to make the wrong form loud rather than to ban the number.
-import { execFileSync } from "node:child_process";
-
-// THE TWELVE FILES RESTORED VERBATIM FROM THE FROZEN TIP AND KEPT. Thirteen were restored; the
-// duplicate-skip arms were dropped in the same branch, so twelve reach main. They came across
-// byte-exact, which is what made their arms trustworthy and also brought their references with them.
-// Exempted for that one merge and removed by the cleanup; see the note above.
-// RESTORED_VERBATIM IS GONE (tracker issue 188). It exempted twelve files by literal path so that a
-// byte-for-byte restoration could land without the guard refusing its own restored text. Their tokens
-// are now retired like everything else, so the list exempts nothing real — and a stale exemption list is
-// worse than none: it silently covers files nobody is checking any more, and it is invisible in a diff
-// that does not touch this file.
-
-const TOKEN = /#[0-9]{3,}/g;
-
-// A `#` COMMENT IS A COMMENT WHEREVER THE FILE FORMAT SAYS SO, not only in YAML (tracker issue 188).
-//
-// This read `#` as a comment for YAML alone, so the same sentence was refused in a .yml file and waved
-// through in .env.example, a systemd unit or a shell script. Those comments are exactly as publicly
-// visible, and `# REQUIRED — tracker issue 774 removed the code default` was sitting in .env.example on the public
-// tree while this guard reported the tree clean. Found while measuring the class for the retirement pass:
-// the guard's own rule flagged 359 tokens, and thousands more sat in files it had never classified.
-//
-// Extensionless is deliberate: a systemd unit or a dotfile often has no extension worth matching, so the
-// KNOWN `#`-comment names are listed and everything else keeps the source rule.
-const HASH_COMMENT = /(^|\/)(\.env[^/]*|[^/]*\.(ya?ml|sh|bash|service|timer|path|socket|conf|ini|toml|properties)|Dockerfile[^/]*|Makefile|\.gitignore|\.gitattributes)$/;
-
-/** Is this added line one the check reads at all? Comments in source, everything in markdown. */
-export const isProse = (path, line) => {
-  if (/\.mde?$/.test(path) || path.endsWith(".md")) return true;
-  const t = line.trim();
-  if (HASH_COMMENT.test(path)) return t.startsWith("#");
-  return t.startsWith("//") || t.startsWith("*") || t.startsWith("/*");
-};
-
-// ── A COLOUR IS NOT A CITATION, AND THE DIGITS ALONE CANNOT SAY WHICH ───────────────────────────
-//
-// `TOKEN` matches digits only, so a six-digit hex colour is read as its leading digits and refused as a
-// reference. An earlier sweep acted on exactly that reading and rewrote sixteen colour literals as issue
-// text, two of them live mermaid `classDef` directives — so the documentation's diagrams rendered
-// broken, and thirteen comments stated a value that was no longer there. Restoring them then hit this
-// guard, whose refusal told the author to write the very text that had caused it.
+// `demo/**` AND `driver/skills/**` ARE NOT READ. The reasons are in shared/reference-guard-classes.mjs
+// beside the rule itself, because that is where the next person changing it will be looking.
 //
-// TWO RULES, and between them they settle every case without a table of exceptions:
+// ── WHERE THE TABLE LIVES ────────────────────────────────────────────────────────────────────────
 //
-//   1. A hex colour may contain a-f; an issue number is decimal. A token carrying a letter cannot be a
-//      reference whatever its length, and no reading of the digits is needed to know it.
-//   2. For the all-digit case — three digits is both a short colour and a plausible issue number — the
-//      SITE settles it: a value whose property is a colour is a colour. Same rule and the same property
-//      list as the guard in `driver/test/prompt-payload-names-no-tracker-issue.test.mjs`, which already
-//      plants both and requires them told apart.
-//
-// This does NOT widen to bare digits in prose. A reference in a comment is still refused, which is the
-// whole point of the check, and the arm asserts that direction too.
-const HEX_COLOUR = /#(?:[0-9a-fA-F]{8}|[0-9a-fA-F]{6}|[0-9a-fA-F]{3,4})\b/g;
-const COLOUR_PROPERTY = /(?:^|[;{\s(,])(?:color|background|background-color|border|border-color|fill|stroke|outline|box-shadow|text-shadow)\s*:\s*$/i;
-
-/** Strip hex colours, so what remains is only tokens that could be a reference. */
-export const withoutColourValues = (line) => String(line).replace(HEX_COLOUR, (m, offset, whole) => {
-  if (/[a-fA-F]/.test(m.slice(1))) return "";                              // letters ⇒ not a decimal number
-  return COLOUR_PROPERTY.test(whole.slice(0, offset)) ? "" : m;            // all digits ⇒ the property decides
-});
+// shared/reference-guard-classes.mjs, with the census that reads the same table. Two definitions of
+// "what a public tree must not acquire" is one definition and one imitation of it, and the imitation
+// is whichever the reader did not run.
+import { execFileSync } from "node:child_process";
+import {
+  CLASSES, offendingClasses, isProse, isScannable,
+  withoutColourValues, withoutLinkTargets,
+} from "../shared/reference-guard-classes.mjs";
 
-/** Strip the spans where a `#NNN` is an address rather than a reference. */
-export const withoutLinkTargets = (line) => line
-  .replace(/\]\([^)]*\)/g, "]()")                 // markdown link targets, anchors included
-  .replace(/https?:\/\/\S+/g, "")                  // bare URLs and their fragments
-  .replace(/<[^>]*>/g, "");                        // angle-bracket autolinks
+// Re-exported because scripts/retire-bare-refs.mjs and the arms beside this file import them from
+// here, and moving the table should not move every caller in the same commit.
+export { CLASSES, offendingClasses, isProse, isScannable, withoutColourValues, withoutLinkTargets };
 
 /** Every offending token on one added line, or an empty array. */
-export const offendingTokens = (path, line) => {
-  if (!isProse(path, line)) return [];
-  return [...withoutColourValues(withoutLinkTargets(line)).matchAll(TOKEN)].map((m) => m[0]);
-};
+export const offendingTokens = (path, line) => offendingClasses(path, line).map((c) => c.token);
 
 const baseArg = () => {
   const i = process.argv.indexOf("--base");
@@ -143,14 +92,21 @@ function main() {
   // difference between "looked and found nothing" and "had nothing to look at".
   const hits = [];
   for (const { path, line } of added) {
-    for (const token of offendingTokens(path, line)) hits.push({ path, token, line: line.trim().slice(0, 100) });
+    for (const c of offendingClasses(path, line)) hits.push({ path, ...c, line: line.trim().slice(0, 100) });
   }
   console.log(`added-reference-check: read ${added.length} added line(s) against ${base}`);
   if (!hits.length) return;
-  console.error(`\n${hits.length} bare reference(s) added in comments or prose:\n`);
-  for (const h of hits) console.error(`  ${h.path}: ${h.token}\n    ${h.line}`);
-  console.error("\nWrite `tracker issue NNN` instead. A bare `#NNN` linkifies into whatever repository "
-    + "renders it, which is not the one the number belongs to, and it lives on in public history.");
+
+  // GROUPED BY CLASS, because the remedy is per class and a flat list makes the reader derive it eight
+  // times. Each heading is said once, then the lines it applies to.
+  console.error(`\n${hits.length} line(s) added that a public tree must not carry:\n`);
+  for (const { id, why } of CLASSES) {
+    const mine = hits.filter((h) => h.id === id);
+    if (!mine.length) continue;
+    console.error(`  ${id} — ${why}`);
+    for (const h of mine) console.error(`    ${h.path}: ${h.token}\n      ${h.line}`);
+    console.error("");
+  }
   process.exit(1);
 }
 

package/scripts/e2e.mjs

@@ -630,7 +630,7 @@ export function bandForScenario(scenario, resolve = resolveForDoor) {
 /**
  * — WHICH ENGINE COMMIT THIS RUN LOADED, read from the run's own artifacts.
  *
- * `role-e2e`'s handover requires the commit on every run, and until this existed it was reconstructed
+ * the testing handover requires the commit on every run, and until this existed it was reconstructed
  * by joining a checkout's reflog against `startedAt`. That reconstruction expires with the reflog,
  * dies with a re-clone, and is simply wrong for any run made while the checkout sat detached — it
  * produced two near-miss wrong certifications in two days.
@@ -1354,7 +1354,7 @@ function evalAssertion(a, runDir) {
     // ── — THIS IS A DELIVERY CONTRACT, AND A RUN THAT DID NOT DELIVER NEVER ENTERED IT ────────
     //
     // Owner ruling, 2026-08-22, verbatim: "clean up the failed runs. they owe the client nothing."
-    // (Relayed by role-overwatch; recorded here because the rule this line encodes is a product
+    // (Recorded here because the rule this line encodes is a product
     // decision, not a harness preference.)
     //
     // Measured before the ruling: `sendPending` is carried by 25 of 25 delivered runs and 0 of 29

package/scripts/generated-files-are-current.mjs

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// EVERY GENERATED FILE IN THIS TREE IS CURRENT, or this says which one is not.
+//
+//   node scripts/generated-files-are-current.mjs
+//
+// ── WHY THIS EXISTS, AND WHY IT DISCOVERS ITS OWN POPULATION ─────────────────────────────────────
+//
+// Each `scripts/mint-*.mjs` writes a file that is committed and derived, and each takes `--check` to
+// say whether the committed copy still matches the tree. Until now CI ran exactly one of them. The
+// other three could go stale on `main` and nothing here would say so — the failure surfaced instead
+// in a private control that refuses to start on a stale fixture, which is the most expensive place
+// to learn it and the furthest from whoever caused it.
+//
+// So this enumerates `scripts/mint-*.mjs` rather than naming them. A list would have to be extended
+// by whoever adds the fifth minter, and the whole reason the fourth went unchecked is that nobody
+// extended anything. A discovered population is covered by construction.
+//
+// AN EMPTY POPULATION IS A FAULT, NOT A PASS. If the glob matches nothing, this file has been moved
+// or the naming convention has changed, and reporting "all current" over zero checks is exactly the
+// shape of green this guard exists to refuse.
+import { readdirSync } from "node:fs";
+import { spawnSync, execFileSync } from "node:child_process";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const ROOT = join(HERE, "..");
+
+/** Every minter in `scripts/`, by filename, ordered. */
+export function minters(dir = HERE) {
+  return readdirSync(dir).filter((f) => f.startsWith("mint-") && f.endsWith(".mjs")).sort();
+}
+
+/**
+ * What the working tree looks like, so a minter that WROTE during `--check` can be caught writing.
+ *
+ * Returns null when the tree cannot be read — outside a checkout, say — and a null is carried as a
+ * stated limit rather than as a pass: the contract simply goes unchecked and the run says so.
+ */
+export function treeState(root = ROOT) {
+  try {
+    return execFileSync("git", ["-C", root, "status", "--porcelain"], { encoding: "utf8", maxBuffer: 1 << 28 });
+  } catch { return null; }
+}
+
+/**
+ * Run every minter's `--check` and sort the answers.
+ *
+ * `dir` and `root` are parameters so the arms can drive all three outcomes over throwaway minters.
+ * The alternative — dirtying a real generated file and restoring it — is a shared-file mutation, and
+ * the test runner runs files in parallel, so it would be a race that reddens somebody else's arm.
+ */
+export function checkAll({ dir = HERE, root = ROOT, log = console.log, readTree = () => treeState(root) } = {}) {
+  const found = minters(dir);
+  if (!found.length) return { found, stale: [], unreadable: [], wrote: [], empty: true };
+
+  const stale = [];
+  const unreadable = [];
+  const wrote = [];
+  for (const m of found) {
+    // ── `--check` IS A CONTRACT, AND NOTHING WAS VERIFYING IT ──────────────────────────────────────
+    //
+    // Every minter here is trusted to treat `--check` as "report, change nothing". A minter that
+    // ignores the flag and re-mints repairs the drift and then reports `current` — so the file is
+    // quietly fixed on whoever's machine ran it, the commit does not carry the repair, and this guard
+    // logs a clean line over a check that never happened. That is this file's own sentence one level
+    // in: a pass from a minter that did not look is not a pass either.
+    //
+    // The probe is the contract stated directly. `--check` must not write, so if the tree moved while
+    // one ran, it wrote. THE LIMIT, SAID RATHER THAN LEFT: this catches the harmful inert form, the
+    // one that silently repairs. A minter that ignores the flag and does nothing at all still reports
+    // `current`, and no probe from out here can tell that from a file that really is current.
+    const before = readTree();
+    const r = spawnSync(process.execPath, [join(dir, m), "--check"], { cwd: root, encoding: "utf8" });
+    const after = readTree();
+    const out = ((r.stdout || "") + (r.stderr || "")).trim();
+    if (before !== null && after !== null && before !== after) {
+      wrote.push({ m, out });
+      log(`  WROTE    ${m} (during --check)`);
+      continue;
+    }
+    // 0 is current, 1 is stale, anything else is a minter that could not look — reported separately,
+    // because "I could not read the tree" and "the file is out of date" need different things done.
+    if (r.status === 0) { log(`  current  ${m}`); continue; }
+    if (r.status === 1) { stale.push({ m, out }); log(`  STALE    ${m}`); continue; }
+    unreadable.push({ m, out, code: r.status });
+    log(`  ?        ${m} (exit ${r.status})`);
+  }
+  return { found, stale, unreadable, wrote, empty: false, contractChecked: readTree() !== null };
+}
+
+function main() {
+  const { found, stale, unreadable, wrote, empty, contractChecked } = checkAll();
+  if (empty) {
+    console.error("generated-files-are-current: no scripts/mint-*.mjs found. Either they moved or the "
+      + "naming changed — and a pass over nothing is not a pass.");
+    process.exit(2);
+  }
+  console.log(`\ngenerated-files-are-current: checked ${found.length} minter(s)`
+    + (contractChecked ? "" : "; the tree could not be read, so nothing verified that `--check` changed nothing"));
+
+  for (const { m, out } of [...wrote, ...stale, ...unreadable]) {
+    console.error(`\n──── ${m} ────\n${out}`);
+  }
+  if (wrote.length) {
+    console.error(`\n${wrote.length} minter(s) CHANGED THE TREE while running \`--check\`. \`--check\` `
+      + `reports and changes nothing; one that re-mints repairs the drift on whoever ran it, leaves the `
+      + `commit without the repair, and reports current over a check that did not happen. Fix the minter.`);
+    process.exit(2);
+  }
+  if (unreadable.length) {
+    console.error(`\n${unreadable.length} minter(s) could not look. That is not a pass; fix the minter first.`);
+    process.exit(2);
+  }
+  if (stale.length) {
+    console.error(`\n${stale.length} generated file(s) are out of date. Re-mint each one named above and `
+      + `commit the result — a derived file that drifts is a check reporting on a tree that no longer exists.`);
+    process.exit(1);
+  }
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) main();

package/scripts/mint-names-in-force.mjs

@@ -21,7 +21,7 @@
 // ── THE ORACLE THIS DERIVATION IS CHECKED AGAINST ────────────────────────────────────────────────
 //
 // A derivation that is only ever compared against itself proves nothing, which is the shape this repo
-// keeps paying for. So the arm in driver/test/retired-env-spellings.test.mjs holds this output to the
+// keeps paying for. So scripts/generated-files-are-current.mjs, in CI's guards job, holds this output to the
 // THIRTEEN dead names Cart measured in the production install's own env file on 2026-09-05 — a
 // population this script never saw and cannot influence. All thirteen must resolve to a replacement.
 // If a future sweep breaks the suffix rule, that arm reds on real-world data rather than on a
@@ -82,7 +82,9 @@ function render(names) {
 //
 //   node scripts/mint-names-in-force.mjs
 //
-// driver/test/retired-env-spellings.test.mjs regenerates this and refuses a stale copy.
+// CI refuses a stale copy, from the guards job: scripts/generated-files-are-current.mjs runs every
+// minter in scripts/ with --check. (This line used to name a test file that does not exist in this
+// tree, so the only thing that ever caught this drifting was a private control refusing to start.)
 
 export const NAMES_IN_FORCE = Object.freeze([
 ${names.map((n) => `  "${n}",`).join("\n")}

package/scripts/mint-public-residue.mjs

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// RE-MINT THE PUBLIC RESIDUE BACKLOG — the per-file, per-class count that may only go down.
+//
+//   node scripts/mint-public-residue.mjs            # report the delta, change nothing
+//   node scripts/mint-public-residue.mjs --check    # ... and exit 1 if the file is out of date
+//   node scripts/mint-public-residue.mjs --apply    # write it
+//
+// THE ONLY REASON TO RUN `--apply` IS THAT THE NUMBER WENT DOWN. Nothing here refuses to write a
+// higher one — a table that could not record growth would be unable to describe a tree somebody
+// widened a class over — but the floor arm in driver/test/the-public-residue-is-a-floor.test.mjs
+// refuses the growth itself, and it reads the committed file rather than this script's output. So an
+// author who mints upward has recorded the regression rather than absorbed it, and the suite says so
+// on the next run. The two halves are deliberately not the same program.
+import { readFileSync, writeFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { CLASSES, censusOf, publishedOf } from "../shared/reference-guard-classes.mjs";
+import { trackedFiles, skipReason } from "../shared/tracked-files.mjs";
+import { isEntrypoint } from "../shared/is-entrypoint.mjs";
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
+const FIXTURE = join(ROOT, "driver/test/fixtures/public-residue-backlog.json");
+const GUARD = "public-residue-backlog";
+
+/** The tree's current census, as the fixture records it. */
+export function mint() {
+  const tracked = trackedFiles(GUARD, { root: ROOT });
+  if (tracked === null) return null;
+  // THE SAME POPULATION THE FLOOR READS, from the same helper. A mint over the index and a floor over
+  // HEAD would disagree under the overlay, and `--check` would report a difference that is only the
+  // two instruments asking different questions.
+  const p = publishedOf(tracked, ROOT);
+  if (p.error) { console.error(`mint-public-residue: ${p.error}`); process.exit(2); }
+  if (p.laid) console.log(`mint-public-residue: ${p.laid} tracked path(s) are not in HEAD — laid over this checkout, not published in it, and not counted`);
+  const c = censusOf(p.files, (f) => readFileSync(join(ROOT, f), "utf8"));
+  return { classes: CLASSES.map((x) => x.id), total: c.total, files: c.files };
+}
+
+/** Per-class totals, for a reader who wants to know WHICH number moved. */
+export const byClass = (table) =>
+  CLASSES.map((c, i) => [c.id, Object.values(table.files).reduce((a, v) => a + v[i], 0)]);
+
+function main() {
+  const apply = process.argv.includes("--apply");
+  const check = process.argv.includes("--check");
+
+  const now = mint();
+  // A COULD-NOT-LOOK EXITS 2, never 0. Outside a checkout there is no corpus, and a mint that wrote an
+  // empty table here would replace the whole backlog with nothing and call it a repair.
+  if (now === null) { console.error(`mint-public-residue: ${skipReason(GUARD)}`); process.exit(2); }
+
+  let was = null;
+  try { was = JSON.parse(readFileSync(FIXTURE, "utf8")); } catch { /* first mint */ }
+
+  console.log(`public residue: ${now.total} line(s) across ${Object.keys(now.files).length} file(s)`);
+  for (const [id, n] of byClass(now)) console.log(`  ${String(n).padStart(5)}  ${id}`);
+
+  const next = JSON.stringify(now, null, 2) + "\n";
+  const same = was && JSON.stringify(was, null, 2) + "\n" === next;
+  if (same) { console.log("the backlog is current"); return; }
+
+  if (was) {
+    const delta = now.total - was.total;
+    console.log(`\ntotal ${was.total} → ${now.total} (${delta >= 0 ? "+" : ""}${delta})`);
+  }
+  if (apply) { writeFileSync(FIXTURE, next); console.log("written"); return; }
+  console.log("\nre-run with --apply to write it");
+  if (check) process.exit(1);
+}
+
+if (isEntrypoint(import.meta.url)) main();