clearotron 0.2.4 → 0.3.0-beta.1

package/driver/ask-ledger.mjs

@@ -118,7 +118,7 @@ export function returnedPhrase(info) {
 }
 
 /**
- * — MAY AN EXECUTED RECALL PROBE DISCHARGE ON ITS OWN EXECUTION? Owner ruling 2026-08-19: "no".
+ * — MAY AN EXECUTED RECALL PROBE DISCHARGE ON ITS OWN EXECUTION? Ruling 2026-08-19: "no".
  *
  * A recall ask discharges only when what came back is DEALT WITH. `kind:executed` alone discharges
  * nothing — and the failure it hid is the one this issue was filed on: a HIGH-graded live US
@@ -597,7 +597,7 @@ export function deliveredMarks(findingsJsonText) {
 const normMark = (s) => String(s ?? "").toLowerCase().replace(/[^a-z0-9]/g, "");
 
 /**
- * Owner ruling 2026-09-07 (tracker issue 246), Option A, worded ABOUT THE MARK: a recall ask may close
+ * Ruling 2026-09-07, Option A, worded ABOUT THE MARK: a recall ask may close
  * as immaterial only when the mark it went looking for is in the client's findings. Otherwise the mark
  * is owed a finding and the ask stays open.
  *

package/driver/cancel.mjs

@@ -56,6 +56,33 @@ export function requestCancel(runDir, { via = "unknown", by = undefined } = {})
   return rec;
 }
 
+/**
+ * THE LAST READ BEFORE A REPORT IS PUBLISHED, on both lanes.
+ *
+ * The gateway's read is inside the attempt loop, before a turn is dispatched, and a dispatched turn
+ * always finishes. So the flag is consulted when a stage is about to spend and at no other moment —
+ * which means a stop pressed during the FINAL stage has no later boundary to be seen at, and the run
+ * publishes. Measured 2026-09-09 on a knockout: the stop was recorded, the last stage's turn ran to
+ * completion, and a full report was delivered 100 seconds later. Both the dialog and the API had told
+ * the operator twice that nothing would be delivered.
+ *
+ * ONE DEFINITION FOR BOTH LANES, because the promise is made in one set of words to every operator and
+ * two readings of "past the point of stopping" is how one lane keeps it and the other does not.
+ *
+ * IT GOES AFTER AN ALREADY-PUBLISHED SHORT-CIRCUIT, NEVER BEFORE. A run whose report is already out has
+ * delivered; refusing at that point would mark a delivered run cancelled and tell the operator the
+ * opposite of what happened, which is the same defect pointed the other way.
+ *
+ * This does not make boundary mode able to stop everything — a turn in flight still finishes and its
+ * spend is still spent. It makes the one promise the copy actually makes true: that nothing is
+ * delivered.
+ */
+export function assertNotCancelledBeforePublish(runDir, lane = "run") {
+  if (!isCancelled(runDir)) return null;
+  const rec = readCancel(runDir);
+  throw new RunCancelled(`publish (${lane})`, rec);
+}
+
 /**
  * Thrown by the gateway when a run is asked to stop, and caught by both pipelines' run-level handlers.
  *

package/driver/case-law-sources.mjs

@@ -21,7 +21,7 @@
 // A FIX THAT MAKES THE GAP QUIETER WOULD BE WORSE THAN THE DEFECT. The report never claimed there was no
 // adverse case law; every surface disclosed the gap. That discipline is untouched here — this changes
 // the REASON attached to an honest gap, never whether the gap is stated.
-// ── AND A SOURCE NOBODY COULD CHECK IS NOT A SOURCE WE DO NOT HAVE (tracker issue 173) ──────────────
+// ── AND A SOURCE NOBODY COULD CHECK IS NOT A SOURCE WE DO NOT HAVE ──────────────────────────────────
 //
 // The credential reader has four states — absent, usable, unusable, unreadable — and the caller used to
 // flatten them into one boolean before this composer saw them. Three of those states then shared one
@@ -30,7 +30,7 @@
 // ground truth. A deployment with a `chmod 000` on one file would tell a client it does not have US
 // federal case law. Nobody knows that. We know only that we could not look.
 //
-// OWNER RULING, 2026-09-05, on the three wordings put to him: report it as a source whose availability
+// RULING, 2026-09-05, on the three wordings put to him: report it as a source whose availability
 // COULD NOT BE CONFIRMED — never as one this deployment does not have, and never as an outage — and stop
 // there. Deliberately it does not say whether to treat the coverage as available: that is a second
 // question, it applies to every product rather than this one source, and settling it as a side effect of
@@ -46,7 +46,7 @@
  *
  * `pipeline.mjs` built this shape inline and an arm rebuilt it by hand to drive the composer. Two copies
  * of one mapping, and the arm's copy could not fail when the real one changed: adding `checked` here for
- * tracker issue 173 left the arm still composing the old three-field row and still passing. A test that
+ * The repair left the arm still composing the old three-field row and still passing. A test that
  * restates the code it is checking agrees with itself.
  *
  * It is exported for that reason and not as a convenience: the arm and the pipeline must read the same

package/driver/company-bundle.mjs

@@ -0,0 +1,261 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+// company-bundle.mjs — what a valid company bundle is, and what the roster will accept.
+//
+// ── EXTRACTED FROM bin/brandowner.mjs WHEN THE SECOND DOOR ARRIVED ─────────────────────────────────
+//
+// The command line was the only way to create a company, so this logic lived beside it. The browser is
+// now the second door, and the alternative to moving it was a second opinion about what a valid company
+// is — which is the thing this codebase keeps paying to remove. There is one definition and both doors
+// ask it.
+//
+// It lives here rather than in shared/ because every question below is answered by driver code — the
+// profile validator, the framework loader, the skill-path resolver — and shared/ does not depend on
+// driver/. And it lives outside bin/ for the reason shared/onboarding-store.mjs already states: a bin
+// entry importing another bin entry is a dependency between two things a user types.
+//
+// ── WHAT IS HERE AND WHAT IS NOT ──────────────────────────────────────────────────────────────────
+//
+// Everything here is filesystem-and-roster pure: it composes a bundle and says whether the roster would
+// accept it. What differs between the two doors stays with each — where the store is, how a context pack
+// is read, who the author is (the command reads the OS username, the service takes it from the verified
+// sign-in), and how the write is recorded.
+//
+// The refusal that matters most is the domain collision. The roster loader throws for the WHOLE roster
+// when two companies claim one domain, so a bad create does not fail one company — it stops the
+// deployment resolving ANY of them at the next start. That check is not reachable from the per-profile
+// validator, so it has to be made here, against the proposed roster, before anything is written.
+
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+
+import { validateProfileEdit } from "./profiles.mjs";
+import { DEFAULT_FRAMEWORK, loadFrameworkManifest } from "./framework.mjs";
+import { config } from "./driver.config.mjs";
+import { Refusal } from "../shared/onboarding-store.mjs";
+
+// ── the framework, which is the point of the setup ─────────────────────────────────────────────────
+/**
+ * Resolve the framework this brand owner will be rated under, as the ruling words it: the client's own
+ * when supplied, the Generic default otherwise, and always stated.
+ *
+ * ABSENT AND BROKEN ARE NOT THE SAME EVENT and the ruling separates them deliberately. Absent means the
+ * client has not given us their framework yet — onboarding proceeds under the Generic default, named.
+ * Broken means someone TRIED to select one and it does not resolve, and falling back there would rate a
+ * client's matters under a framework nobody chose while the output said everything was fine.
+ *
+ * The profile validator checks the SHAPE of this string only (`skills/prelim-search/<file>.md`, no
+ * escape) and never whether the file is there — so a shape-valid path to a document that does not exist
+ * validates cleanly and fails at rating time, which is the wrong place to find out.
+ */
+export function resolveFramework(requested, {
+  resolveSkill = (rel) => config.resolveSkillPath(rel),
+  loadManifest = loadFrameworkManifest,
+} = {}) {
+  if (requested == null || String(requested).trim() === "")
+    return { path: DEFAULT_FRAMEWORK, source: "default" };
+
+  const path = String(requested).trim();
+  // Shape first, and by the profile validator's own rule rather than a second copy of it: a path that
+  // would be refused at load must be refused here, in the same words, before anything is written.
+  if (!/^skills\/prelim-search\/[^/]+\.md$/.test(path) || path.includes(".."))
+    throw new Refusal(
+      `--framework must name a document of the form "skills/prelim-search/<file>.md" (got ${JSON.stringify(path)}). `
+      + `A profile selects a SHIPPED framework, never an arbitrary path.`);
+
+  // RESOLVED THE WAY THE RATING STAGE RESOLVES IT, never by joining the repo root. `skills/...` paths
+  // are relative to the DRIVER's skills directory, and a deployment may serve them from a doctrine
+  // overlay (CLEAROTRON_INSTRUCTIONS_DIR) instead. Joining the repo root would have looked in a
+  // directory that does not exist, refused every valid framework on every install, and — worse in the
+  // other direction — been blind to the overlay a deployment actually reads.
+  const deck = resolveSkill(path);
+  if (!existsSync(deck))
+    throw new Refusal(
+      `--framework names ${path}, and there is no such document on this install (resolved to ${deck}). `
+      + `Refusing rather than rating this brand owner's matters under the Generic default: a framework `
+      + `somebody chose and that does not resolve is a mistake, not an absence.`,
+      { code: "framework_missing", path });
+
+  // The manifest is DERIVED from the deck path, never a separate knob — and it is what the validators,
+  // the renderer and the profile page read to know the framework's band vocabulary. A deck whose
+  // manifest will not load produces a customer whose page cannot state their own ladder.
+  //
+  // ASKED, NOT RE-CHECKED. An `existsSync` on the manifest here would be a second opinion about the
+  // same fact: `loadFrameworkManifest` already refuses a missing sidecar by name
+  // (`framework_manifest_missing:<path>`) and is the exact read the rating stage makes. Two checks
+  // means two messages to keep in step, and the one this file could write would be the one that goes
+  // stale.
+  let manifest;
+  try {
+    manifest = loadManifest(resolveSkill, path);
+  } catch (e) {
+    throw new Refusal(
+      `--framework names ${path}, and the framework will not load: ${String(e?.message ?? e)}. `
+      + `Refusing rather than falling back: a framework somebody chose and that does not resolve is a `
+      + `mistake, not an absence.`);
+  }
+  return { path, source: "supplied", manifest };
+}
+
+// ── the profile this writes ────────────────────────────────────────────────────────────────────────
+/**
+ * Which marketplaces this brand owner's searches cover — supplied, or the Generic default, SAID OUT LOUD.
+ *
+ * A customer bundle is a COMPLETE document in this design, not an overlay on generic: every shipped
+ * profile carries its own `platforms`, and the loader requires a non-empty array on every file. The
+ * command had no way to supply one and set none, so every bundle it wrote failed to load on this field
+ * as well as on the `key` field above — two independent invalidities, and onboarding could not produce
+ * a loadable brand owner at all.
+ *
+ * Defaulting rather than refusing, and naming it, is this command's own established idiom: the same
+ * ruling governs the framework one function down. Which marketplaces a client's clearance searches is
+ * not a detail to decide silently, so an operator who supplies nothing is TOLD what they got and can
+ * refine it in the portal.
+ */
+export function resolvePlatforms(supplied, roster) {
+  if (supplied?.length) return { platforms: supplied, source: "supplied" };
+  const house = roster?.get?.("generic")?.platforms ?? [];
+  if (!house.length)
+    throw new Refusal(
+      "no --platforms was given and the Generic default carries none, so there is nothing to onboard this "
+      + "brand owner with. Pass --platforms, or repair the generic profile in the store.",
+      { code: "no_marketplaces" });
+  return { platforms: [...house], source: "house default" };
+}
+
+export function buildProfile({ key, name, domains, platforms, framework, industry,
+  tradingNames, classes, territories }) {
+  // NO `key` IN THE DOCUMENT. The loader derives it from the FILENAME and injects it — readProfilesLayer
+  // composes `{ key, ...p }` — so a `key` written here is redundant on the way in and fatal on the way
+  // out: it is not in KNOWN_PROFILE_KEYS, and the deny-unknown-key gate hard-fails the whole roster over
+  // it. Every bundle this command wrote carried one, so the first successful onboarding made the store
+  // unloadable and the next command to read profiles threw. The parameter stays — the filename and the
+  // roster checks are addressed by key — it simply does not travel into the file.
+  const profile = { name, platforms };
+  if (domains?.length) profile.matchDomains = domains;
+  if (industry) profile.industry = industry;
+  // THE OPTIONAL THREE, OMITTED WHEN EMPTY RATHER THAN WRITTEN AS `[]`. An empty array is a real
+  // instruction to the reader of a profile, not the absence of one, so writing it for a field nobody
+  // filled in states something nobody said. The whole create path treats absent and empty as different
+  // and this is where that has to hold.
+  if (tradingNames?.length) profile.selfExclusionOwners = tradingNames;
+  if (classes?.length) profile.defaultClasses = classes;
+  if (territories?.length) profile.defaultJurisdictions = territories;
+  // ALWAYS SET, per the ruling. `frameworkFor` would fall back to the same value if this were absent —
+  // but "the tool sets it" is the point of the setup, and an explicit selection is what makes the
+  // receipt below mean anything.
+  profile.frameworkPath = framework.path;
+  return profile;
+}
+
+// ── the proposed roster, validated whole ───────────────────────────────────────────────────────────
+/**
+ * Validate the candidate the way the deployment will read it: as one member of the roster, not alone.
+ *
+ * `loadProfiles` composes every profile in the store and throws on the FIRST cross-profile conflict it
+ * finds — a domain claimed twice, most of all. That throw is not scoped to the offending file: it stops
+ * the roster loading at all. So the only honest check is over the proposed state, which is what
+ * bin/grant.mjs does with `accessView` for exactly the same reason.
+ */
+/**
+ * The roster as it stands, where AN EMPTY STORE IS AN EMPTY ROSTER — F42.
+ *
+ * `loadProfiles` with an explicit `dir` reads that directory ALONE and refuses a store with no
+ * `generic.json`, which is right for what that refusal is for: `generic` is the universal fallback every
+ * unprofiled job resolves to, and a RUN against a store without it would silently reprofile a client.
+ * The explicit-dir form deliberately has no fall-through, because the fixtures that build a roster
+ * assert on precisely that roster and layering the bundled set underneath would widen three set-level
+ * guards until none still tested its own name.
+ *
+ * BUT THIS COMMAND IS NOT RUNNING A CLEARANCE. It reads the store to answer one question — does this key
+ * or one of its domains already exist — and on a fresh install the honest answer is "no, there is
+ * nothing here yet". Instead it stack-traced on the FIRST day-one command a new operator types, with a
+ * refusal about a file they had never heard of and did not need: the runtime resolves `generic` from the
+ * product's bundled set through the OVERLAY path, so a deployment store never needs its own copy.
+ *
+ * So the missing-generic refusal is caught BY NAME and answered as the empty roster it describes. Caught
+ * by name rather than broadly, because every other thing that loader throws — an overlapping domain, an
+ * unknown key, an unreadable store — is a real refusal this command must still relay.
+ */
+/**
+ * The key a company gets from its name — the filename, and the key every screen and route uses.
+ *
+ * ONE SPELLING FOR BOTH DOORS. The command line takes the key as an argument and the browser derives it
+ * from the name, so without this the two doors would file "Acme Ltd" under different keys depending on
+ * which one you used, and neither would be wrong.
+ *
+ * Capped well under the validator's 39 characters and stripped of leading and trailing hyphens, so a
+ * name made entirely of punctuation produces nothing rather than a key of dashes — the caller then
+ * refuses and asks for the key, which is honest, where inventing one would file a company under a name
+ * nobody chose.
+ */
+export function companyKeyFrom(name) {
+  return String(name ?? "")
+    .toLowerCase()
+    .normalize("NFKD")
+    // COMBINING MARKS ARE DROPPED, NOT SEPARATED. NFKD splits "ü" into "u" + a combining diaeresis, and
+    // the class below would turn that mark into a hyphen — so "Zürich Präzision" filed as
+    // "zu-rich-pra-zision". Accented company names are the normal case in the languages this product
+    // works in, not an edge.
+    .replace(/[\u0300-\u036f]/g, "")
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 39)
+    .replace(/-+$/, "");
+}
+
+export function rosterAsItStands(store, loadProfiles) {
+  try { return loadProfiles({ dir: store, force: true }); }
+  catch (e) {
+    if (/generic\.json is REQUIRED/.test(String(e?.message ?? ""))) return new Map();
+    throw e;
+  }
+}
+
+export function assertRosterAccepts({ store, key, profile, loadProfiles }) {
+  // THE LOADER'S OWN VALIDATOR, over the CANDIDATE — the discipline `project add` already applies to an
+  // overlay, in the same words, for the same reason: whatever the tree would refuse at load is refused
+  // here, before anything is written. Everything below this line reads the store AS IT STANDS, which is
+  // why none of it could ever see a bad field in the file about to be added: the candidate never met the
+  // loader until the next command did, and by then the write had landed.
+  // `generic` IS RESERVED AND THE KEY RULE DOES NOT SAY SO. `PROFILE_KEY_RE` matches it, while the
+  // comment above that regex claims the create path never allows it — so the rule was a sentence rather
+  // than a check. On a store with no `generic.json` of its own, creating one here writes a file that
+  // shadows the bundled universal fallback for every job that names no company, which is silent and
+  // affects every clearance rather than one. Refused at the gate both doors pass through.
+  if (String(key).toLowerCase() === "generic")
+    throw new Refusal(
+      `"generic" is the house default every unprofiled clearance falls back to, so it cannot be created `
+      + `as a company. Nothing has been written. Pick another key.`);
+
+  const v = validateProfileEdit(key, profile);
+  if (!v.ok)
+    throw new Refusal(`the company bundle is not valid, so nothing was written:\n  ${v.errors.join("\n  ")}`,
+      { code: "invalid_bundle", errors: v.errors });
+
+  const existing = rosterAsItStands(store, loadProfiles);
+  if (existing.has(key))
+    throw new Refusal(
+      `a brand owner "${key}" already exists in ${store}. This command creates; it does not overwrite an `
+      + `existing bundle. Edit it in the portal, or remove the file deliberately first.`,
+      { code: "key_exists", key });
+
+  for (const d of profile.matchDomains ?? []) {
+    const dl = String(d).toLowerCase();
+    for (const [otherKey, other] of existing) {
+      if ((other.matchDomains ?? []).some((o) => String(o).toLowerCase() === dl))
+        throw new Refusal(
+          `domain "${dl}" is already claimed by the brand owner "${otherKey}". Two owners claiming one `
+          + `domain makes the WHOLE roster refuse to load on the next start — not just this bundle — so `
+          + `nothing has been written.`,
+          { code: "domain_claimed", domain: dl, heldBy: otherKey });
+    }
+  }
+}
+
+
+// ── argument parsing ───────────────────────────────────────────────────────────────────────────────
+// Long flags only, and an unknown one REFUSES. A permissive parser on a command that writes into the
+// customers directory is how a typo'd flag becomes a silently missing field — `--fraemwork` would
+// otherwise onboard a client under the Generic default while the operator believed they had set theirs.
+const FLAGS = ["--name", "--domains", "--platforms", "--framework", "--industry", "--context"];

package/driver/compare.mjs

@@ -95,7 +95,7 @@ export function refuseToCompare(a = {}, b = {}) {
   const modelOf = (x) => String(x?.modelUsed ?? x?.model ?? "").trim();
   if (modelOf(a) !== modelOf(b)) return null;
   return "REFUSING TO COMPARE — neither record names an engine and both name the same model "
-    + `(${modelOf(a) || "none"}), so there is nothing here that tells these two apart (tracker issue 1967). `
+    + `(${modelOf(a) || "none"}), so there is nothing here that tells these two apart. `
     + "A model id resolved from a tier is not the answer: it maps through the Anthropic table whichever "
     + "engine ran, so two arms on different engines read identically.\n"
     + "  The per-attempt `_driver/<stage>.jsonl` records `engine` and `modelUsed` — compare from there.";

package/driver/compose-read.mjs

@@ -266,7 +266,7 @@ export function makeReadBudget({ perHour = 20 } = {}) {
  *
  * It used to say the client was built from `@anthropic-ai/sdk`, in the present tense, long after the
  * change recorded below moved this route through the engine door. The SDK has now been removed from
- * the manifests entirely (tracker issue 99) — nothing in the tree imports it.
+ * the manifests entirely — nothing in the tree imports it.
  */
 /**
  * Every way a parsed payload can fail to be a read, named.
@@ -336,7 +336,7 @@ export function makeComposeReader({ turn, now = () => new Date() } = {}) {
         message: `That is ${text.length.toLocaleString("en-GB")} characters — paste up to ${MAX_BRIEF.toLocaleString("en-GB")}, or set the search up below.`,
       };
     }
-    // NO `thinking` BLOCK, DELIBERATELY. Owner ruling 2026-07-22: sonnet, thinking off. This is
+    // NO `thinking` BLOCK, DELIBERATELY. Ruling 2026-07-22: sonnet, thinking off. This is
     // extraction, not judgment — the brief already contains every fact the answer needs, and the
     // reasoning that matters (is this mark clear?) happens later, in the run, where it is paid for.
     // Off also keeps the button feeling like a button.

package/driver/config-inventory.mjs

@@ -279,7 +279,7 @@ const CASELAW_SITES = Object.freeze({
  * a byte of it.
  */
 /**
- * Is this credential file something the bridge could actually use? — tracker issue 173.
+ * Is this credential file something the bridge could actually use?
  *
  * `existsSync` was the whole test, and a zero-byte file therefore reported as an enrolled case-law
  * source. That is not merely an operator-facing inaccuracy: `driver/case-law-sources.mjs` hands the
@@ -347,7 +347,7 @@ export function caseLawInventory(env = process.env) {
       // in to from one that is simply part of the build.
       enrolment: "oauth",
       configured,
-      // THE THIRD STATE, WHICH `configured` CANNOT HOLD (tracker issue 173). `configured` is a boolean
+      // THE THIRD STATE, WHICH `configured` CANNOT HOLD. `configured` is a boolean
       // and the world has three cases in it: never enrolled, enrolled and usable, enrolled and NOT
       // usable. Collapsing the third into either of the others is the defect — into the first it
       // reads as "not set up" and hides a credential the operator believes in; into the second it

package/driver/contract-audit.mjs

@@ -11,7 +11,7 @@
 //       each, from a closed enum, plus the validator tokens that speak about that element.
 //   E2  declarations ∪ validator vocabulary is a closed partition, in two arms of different strength:
 //         arm 1  a token no element accounts for      → hard red, now
-//         arm 2  an element no token speaks about     → a per-stage RATCHET (owner ruling 2026-08-13)
+//         arm 2  an element no token speaks about     → a per-stage RATCHET (ruling 2026-08-13)
 //   E3  structure is returned, never emitted as text — with a named, shrinking backlog for the sites
 //       that exist today, because a lint that greenlights every existing hole certifies the problem.
 

package/driver/contract-e3-backlog.mjs

@@ -195,7 +195,7 @@ export const E3_BACKLOG = [
     //   quote      — M2 LANDED. The live field is `anchor` (prelim-common-law/SKILL.md:197).
     // Neither was reworded. Both were removed, and this row is discharged of them.
     //
-    // ── (b) THE NEW, NARROWER CLAIM — RE-EVIDENCED for B (the form path is DELETED, owner ruling
+    // ── (b) THE NEW, NARROWER CLAIM — RE-EVIDENCED for B (the form path is DELETED, ruling
     // 2026-08-17). The seat is no longer told to open any file: the surviving position-dictation now
     // orders a `record_dispositions` CALL carrying `row_index` / `receipt_index` / `ruling` / `note` per
     // row, and the receiver resolves BOTH positions — made the row an ordinal too, on the finding

package/driver/contract-vocabulary.mjs

@@ -82,7 +82,7 @@ export const VOCABULARY = [
   { token: "half_path_unrecognized", stages: ["common-law-half"], site: "driver/verify.mjs:395" },
   { token: "no_coverage_status_row", stages: [...CL, "register-digest"], site: "driver/verify.mjs:452, 1416" },
   // B — `connotation_form_unparseable` and `connotation_form_untouched` are GONE: they
-  // were states only a hand-authored document could be in, and the form path is deleted (owner ruling
+  // were states only a hand-authored document could be in, and the form path is deleted (ruling
   // 2026-08-17). Their subject matter is carried by the call tokens under the D1 family row below.
   { token: "connotation_form_damaged", stages: CL, site: "driver/verify.mjs:889" },
   { token: "connotation_", stages: CL, site: "driver/verify.mjs:898", family: "driver/connotation-search.mjs:894 (CONNOTATION_FORM_REASONS, exported at :819)", dynamic: "D1" },

package/driver/declination-call.mjs

@@ -210,7 +210,7 @@ export function contradictionFor(reason, row, scope) {
       + `own-right or duplicate-of-delivered.`;
   }
 
-  // ── ECONOMY IS NOT A REASON ABOUT A LIVE IN-CLASS MARK (owner ruling 2026-09-07) ─────────────────
+  // ── ECONOMY IS NOT A REASON ABOUT A LIVE IN-CLASS MARK (ruling 2026-09-07) ─────────────────
   //
   // `not-worth-the-line` means "it fits none of the four manageable categories and is not relevant
   // enough to drive the read". That is a statement about the REPORT'S BUDGET, not about the record. On a

package/driver/deliver-trigger.sh

@@ -21,7 +21,7 @@
 # the prelim-outbox.timer rescan owns the delivery at a sane cadence).
 set -u
 
-# tracker issue 774 — this fallback chain MIRRORS driver.config.mjs (`outboxDir` = CLEAROTRON_OUTBOX_DIR, else
+# this fallback chain MIRRORS driver.config.mjs (`outboxDir` = CLEAROTRON_OUTBOX_DIR, else
 # <workspaceRoot>/prelim-outbox; `workspaceRoot` = CLEAROTRON_WORK_DIR, else $HOME/trademark/workspace).
 # It is a second derivation of the same answer in a language that cannot import the first, so it moves
 # whenever that one does. If they disagree, the driver writes markers where this script never looks and
@@ -37,7 +37,7 @@ DRAIN_WAIT="${CLEAROTRON_OUTBOX_DRAIN_WAIT:-180}"
 WAKE_MODEL="${CLEAROTRON_OUTBOX_WAKE_MODEL-anthropic/claude-haiku-4-5}"
 MSG="The trademark engine's outbox has pending events. Run the clearotron-deliver skill now: list_outbox_events, route each event (delivered → get_delivery_packet + send VERBATIM + mark_sent; every other kind → relay its text + ack_event)."
 
-# THE WALL, RESOLVED ONCE AND NAMED WHEN IT IS ABSENT (tracker issue 820).
+# THE WALL, RESOLVED ONCE AND NAMED WHEN IT IS ABSENT.
 #
 # Every wake below runs under timeout(1) — GNU coreutils, not POSIX and not in a stock macOS or a
 # slim container. Without it `timeout …` is simply a command that is not there: bash answers 127, and
@@ -165,7 +165,7 @@ done
 # Bounded drain-wait after a successful wake: exit early once the courier consumed everything
 # (mark_sent/ack_event), else fall through to the pacing sleep / path-unit re-fire. NEVER delete here.
 #
-# POLL FIRST, THEN WAIT (tracker issue 830). `remaining` used to be assigned ONLY inside the loop body, so
+# POLL FIRST, THEN WAIT. `remaining` used to be assigned ONLY inside the loop body, so
 # CLEAROTRON_OUTBOX_DRAIN_WAIT=0 — the value an operator sets to make delivery synchronous, which is to
 # say the value they set while already chasing a late delivery — ran the body zero times and left the
 # post-loop `${#remaining[@]}` reading an unset array. Under `set -u` that is an error: the echo never

package/driver/dev-portal.mjs

@@ -76,7 +76,7 @@ export const DEV_COCKPIT_JOB_FIELDS = Object.freeze({
   notCarried: Object.freeze({
     registerFixtures: "a run that reads canned register payloads instead of calling a register. The cockpit "
       + "is a form for composing REAL dev runs; a fixture run is declared by the job file that wants one, so "
-      + "the fact travels with the run rather than with whoever filled in a form (tracker issue 2038).",
+      + "the fact travels with the run rather than with whoever filled in a form.",
     promptParts: "the requester's declaration that the prose rides as SIDECAR files. The cockpit composes a job "
       + "from its own form and writes no sidecars, so it may not claim that shape (#1085).",
     forwarderDomain: "the cockpit's assembler defaults it; a dev form has no forwarding domain to state.",
@@ -87,6 +87,8 @@ export const DEV_COCKPIT_JOB_FIELDS = Object.freeze({
     projectKey: "spec-62 engagements are a customer-configuration surface; this form has no project picker "
       + "and inventing one here would let a dev job claim an overlay nobody chose.",
     parentRunId: "escalation lineage. Nothing on this form can name a parent run.",
+    tenant: "which organisation's Generic a run is filed under. The portal and the connector stamp it from a "
+      + "verified person; this dev form has no person to resolve it from, so a dev Generic run is filed under none.",
     customerUnknown: "arms candidate-self classification. A dev form cannot honestly say the applicant was "
       + "neither stated nor implied — the Customer box above states it or leaves it blank.",
     brief: "the intake confirmation brief, written by the email door's own gate. There is no such gate here.",

package/driver/digest-queue.mjs

@@ -108,7 +108,7 @@ export function markFlushed(queue, ids, flushedAt) {
 // fired its own pass. An invariant with an undeclared violation is worse than a narrower invariant
 // stated honestly, because the next reader trusts the wrong one — so the exemption is DECLARED here,
 // with the reason, and an arm censuses every dispatch site against this list. Silence between an
-// invariant and a violation is the defect (tracker issue 116).
+// invariant and a violation is the defect.
 //
 // WHY RECALL-RECONCILE CANNOT MINT — measured on the tree, not reasoned from the design:
 //

package/driver/disposition-tool.mjs

@@ -400,7 +400,7 @@ export function recordDispositions(spec, received, { now = () => new Date().toIS
   try {
     mkdirSync(dirname(accum), { recursive: true });
     // The accumulator in `_driver/` is the ONLY copy. The seat-facing mirror at `dispositions_path`
-    // died with the form path (owner ruling 2026-08-17, delete-not-gate): the seat never reads or
+    // died with the form path (ruling 2026-08-17, delete-not-gate): the seat never reads or
     // writes it, the validator reads the accumulator, and a mirror nothing reads is a second writer
     // waiting to drift. The path itself survives in the spec as the accumulator's name anchor.
     writeFileSync(accum, json);

package/driver/doc-constants.mjs

@@ -279,7 +279,7 @@ export const DOC_CONSTANTS = [
     doc: "INSTALL.md",
     pattern: /# TRADEMARK_MCP_HTTP_PORT=(\d+)/,
   },
-  // ── TWO BINDINGS REMOVED: THEIR DOCUMENTS ARE NOT ON THIS TREE (tracker issue 83) ────────────────
+  // ── TWO BINDINGS REMOVED: THEIR DOCUMENTS ARE NOT ON THIS TREE ───────────────────────────────────
   //
   // `.env.deployment.example` and `.env.prod.example` each carried a `TRADEMARK_MCP_HTTP_PORT default`
   // binding. Both files are withheld from the public tree by the cut, so on this tree the bindings

package/driver/drain-posture.mjs

@@ -4,8 +4,8 @@
 //
 // ── WHY THIS IS A MODULE AND NOT A LINE IN EACH ARM ─────────────────────────────────────────────────
 //
-// Two arms of the same deploy check reached opposite conclusions about one box (tracker issue 206,
-// measured on `c6e183d`). The queue arm read the worker unit, found it enabled, and said the .path/timer
+// Two arms of the same deploy check reached opposite conclusions about one box, measured on
+// `c6e183d`. The queue arm read the worker unit, found it enabled, and said the .path/timer
 // posture it was written for is retired here. The drainer arm did not read anything, applied the
 // timer-era rule, and called an absent drainer a fault. Both sentences shipped in the same report.
 //

package/driver/drainer-identity.mjs

@@ -86,7 +86,7 @@ export const DRAINER_CMD = /\b(runner\.mjs|clearotron[^\s]*\s+start)\b/;
  * @returns {{state: "pass"|"fail"|"warn", message: string}}
  */
 export function drainerVerdict({ stamp, headCommit, isAlive, processes, ppidOf = null, posture = null }) {
-  // ── WHICH POSTURE IS THIS BOX IN, and say it out loud whatever the answer (tracker issue 206).
+  // ── WHICH POSTURE IS THIS BOX IN, and say it out loud whatever the answer.
   //
   // Only ONE branch below changes state on it — a stamped drainer whose process is gone. That is the
   // state the ruling is about: between ticks on a scheduled box, and nothing is executing runs on a