clearotron 0.2.4 → 0.3.0-beta.1

package/driver/driver.config.mjs

@@ -13,7 +13,7 @@ import { readdirSync, existsSync, accessSync, statSync, statfsSync, constants as
 import { homedir } from "node:os";
 import { envFrom } from "../shared/env-aliases.mjs";   // — an operator-facing name is the one an operator sets, and it has to work where they set it; — envFrom is the resolver that reads every spelling of it
 import { invoke } from "../shared/invocation.mjs";   // — name a command the reader can actually type
-import { envFileRead } from "../shared/env-local.mjs";   // — WHICH file to set it in, measured; null for a service that read none (tracker issue 202)
+import { envFileRead } from "../shared/env-local.mjs";   // — WHICH file to set it in, measured; null for a service that read none
 import { numericSetting, resolveNumericSetting } from "./numeric-setting.mjs";   // — a number, or a refusal that names the variable; never NaN
 
 const { X_OK } = FS;
@@ -117,7 +117,7 @@ export const config = {
   // two different things depending on which accessor you asked, and `queueDirs` resolved a RELATIVE
   // queue directory under the process cwd, which is its own incident shape.
   //
-  // Owner ruling 2026-08-19: a whitespace-only value counts as UNSET, everywhere. `X=` already meant
+  // Ruling 2026-08-19: a whitespace-only value counts as UNSET, everywhere. `X=` already meant
   // "not configured" and this is that rule finishing its sentence — not a reversal of it, which
   // is why the 13 sites relying on empty-means-unset are untouched: they get the same answer they
   // always did, and only the spaces-shaped near-miss changes.
@@ -226,6 +226,41 @@ export const config = {
     return join(dirname(this.skillsBaseDir), rel);
   },
 
+  /**
+   * WHICH LAYER ANSWERED, as a fact rather than a path — `resolveSkillPath` with its reasoning shown.
+   *
+   * THE SILENT CASE IS NOT THE MISSING ONE. A file in neither root resolves to a base path that does not
+   * exist, and the read then throws by name, which is loud already. The case nobody hears is a file
+   * ABSENT FROM THE OVERLAY AND PRESENT IN THE BASE: a real, readable file is returned, and if that file
+   * is a risk framework the matter is rated under somebody else's rubric with nothing in the log. The
+   * shipped tree carries `risk-framework.md`, `risk-framework-demo.md` and `risk-framework-triage.md`
+   * under the same names customers use for their own, so removing one from the config store swaps the
+   * deck rather than emptying it. NAME ONLY DECKS THAT SHIP: `files[]` excludes
+   * `risk-framework-*` and re-includes exactly those three, so an example naming any other deck is
+   * describing a tree the reader does not have.
+   *
+   * `layer` is what happened: "overlay" served from the config store, "base" served from the repo while
+   * an overlay was configured and did not hold it, "base-only" served from the repo with no overlay
+   * configured at all (the ordinary single-tree install — nothing to say about it), and "missing" held by
+   * neither, which the caller's own read reports.
+   *
+   * BEHAVIOUR IS NOT CHANGED HERE and must not be. The overlay-then-base fallback is the migration
+   * design: every generic methodology file legitimately falls back today, and making that throw would
+   * take the whole product down to make one class of file loud. This reports; the caller decides which
+   * layers matter to it.
+   */
+  resolveSkillPathReport(relFromSkillsRoot) {
+    const rel = String(relFromSkillsRoot ?? "").replace(/^\/+/, "");
+    const basePath = join(dirname(this.skillsBaseDir), rel);
+    const overlay = this.skillsOverlayDir;
+    if (!overlay) return { path: basePath, rel, layer: existsSync(basePath) ? "base-only" : "missing", overlayPath: null, basePath };
+    if (!existsSync(overlay))
+      throw new Error(`skills_overlay_unreadable:${overlay} (CLEAROTRON_INSTRUCTIONS_DIR is set but the process cannot see it — customer-specific skills would silently fall back to the repo defaults)`);
+    const overlayPath = join(dirname(overlay), rel);
+    if (existsSync(overlayPath)) return { path: overlayPath, rel, layer: "overlay", overlayPath, basePath };
+    return { path: basePath, rel, layer: existsSync(basePath) ? "base" : "missing", overlayPath, basePath };
+  },
+
   /**
    * Every skills root handed to the engine's file tools (overlay + base, deduped).
    *
@@ -377,7 +412,7 @@ export const config = {
     //
     // "`install` writes one for you" is the whole remedy this carried, and `install` refuses a
     // non-terminal. This message reaches `start --background`'s screen, which is the scripted and hosted
-    // install route, so its reader was being sent to a wizard they cannot open (tracker issue 202).
+    // install route, so its reader was being sent to a wizard they cannot open.
     //
     // `envFileRead()` rather than a path composed here, for the reason its header gives: this is a
     // library reached by CLI entries AND by unit-booted services, and a service read no file of its own.
@@ -503,7 +538,7 @@ export const config = {
   // ON-DISK NAME, NOT A PRODUCT NAME: an install that never set the variable is already using this
   // directory, so renaming the default moves the install to an empty one and nothing migrates. Here
   // the orphaned files are run-slot locks, so a live run's slot goes unseen and the global cap is
-  // silently exceeded rather than enforced. Owner ruling, tracker issue 308.
+  // silently exceeded rather than enforced. Ruling.
   get runLockDir() { return this.envValue("CLEAROTRON_RUN_LOCK_DIR") || join(this.workspaceRoot, "prelim-run-locks"); },
 
   // Delivery outbox (Workstream B). On a handoff-mode finish the driver drops <runId>.pending here (naming
@@ -515,7 +550,7 @@ export const config = {
   // ON-DISK NAME, NOT A PRODUCT NAME: an install that never set the variable is already using this
   // directory, so renaming the default moves the install to an empty one and nothing migrates. Here
   // the orphaned files are requester-facing events — delivered, run-failed, intake-rejected — so the
-  // visible failure is a requester never told their run finished. Owner ruling, tracker issue 308.
+  // visible failure is a requester never told their run finished. Ruling.
   get outboxDir() { return this.envValue("CLEAROTRON_OUTBOX_DIR") || join(this.workspaceRoot, "prelim-outbox"); },
 
   // ── Delivery/comms (Phase 2, standalone product) ─────────────────────────────────────────────────
@@ -972,7 +1007,7 @@ export const PROVIDERS = {
     credEnv: "CLARIVATE_API_KEY",
     skillDoc: "skills/prelim-register/providers/clarivate.md",
     hasPublicRecordUrl: false, // Compumark Content has no public record URL — cite the office register
-    //, owner ruling 2026-08-20 — WHAT A CARD SHOWS WHERE A LINK CANNOT GO. A UI exists for this
+    //, ruling 2026-08-20 — WHAT A CARD SHOWS WHERE A LINK CANNOT GO. A UI exists for this
     // provider and we do not know its per-record URL, so the card says so and says it is unfinished.
     // "placeholder" is the reader-facing admission; anything else would read as a citation.
     recordCitation: "placeholder",
@@ -1109,7 +1144,7 @@ export const PROVIDERS = {
     credEnv: "SIGNA_API_KEY",
     skillDoc: "skills/prelim-register/providers/signa.md",
     hasPublicRecordUrl: false, // Signa exposes no per-record public URL — cite the office register
-    //, owner ruling 2026-08-20 — no register UI exists to link to at all, so the card points at
+    //, ruling 2026-08-20 — no register UI exists to link to at all, so the card points at
     // the artifact that DOES carry the record: the audit workbook. Naming it is the whole of this
     // branch; constructing a per-record URL for a provider that publishes none would be a fabricated
     // citation on a legal deliverable, and the ruling forbids it in those words.
@@ -1506,7 +1541,7 @@ export const RESEARCH_PROVIDERS = {
     // and so the page never renders a title-cased guess at an id.
     label: "Perplexity",
     credEnv: "PERPLEXITY_API_KEY",
-    // READER-TERMS FIELDS (tracker issues 2072/2089): what its absence costs, in the reader's world,
+    // READER-TERMS FIELDS: what its absence costs, in the reader's world,
     // and where a key comes from. Stated beside the credential like `label`, so setup and doctor can
     // DERIVE their prompts from this table instead of keeping a second hand list — the second list is
     // how SERPAPI_API_KEY went unprompted while the code said "required for live grid cells".
@@ -1561,7 +1596,7 @@ export const RESEARCH_PROVIDERS = {
 //
 // ── / — THE NATIVE-LANGUAGE LANES RUN ON THE PROGRAM THE CUSTOMER CHOSE ────────────────
 //
-// Owner ruling 2026-08-20, verbatim: "one LLM provider only ever, API or auth, no mix." These three
+// Ruling 2026-08-20, verbatim: "one LLM provider only ever, API or auth, no mix." These three
 // lanes were the mix. They POSTed to the Anthropic Messages API on `ANTHROPIC_API_KEY` at a hardcoded
 // haiku tier no matter which engine the run was configured for — so round 21f9b0ad's receipt carried
 // engine `openai-agent` / SUBSCRIPTION on its agentic stages and `anthropic-direct` / API-KEY on all

package/driver/effective-scope.mjs

@@ -118,9 +118,30 @@ export const jobJurisdictions = (job) =>
  * carries thirty-odd line-number citations from other files, so inserting explanation into it silently
  * repoints all of them. Keeping the reasoning where the rule lives costs that file no lines.
  */
+/**
+ * The account's default territories, split by whether the engine can search them.
+ *
+ * ONE reading of `defaultJurisdictions`, because there were two and they disagreed in silence. The
+ * prompt line below dropped what the vocabulary did not recognize; the resolved scope carried the same
+ * entries through untouched. So a misspelled default was simultaneously absent from what the model was
+ * told and present in what the search planned against — and the person who typed it saw neither.
+ *
+ * `unrecognized` is what `recognizedTerritories` calls `dropped`, renamed at this boundary because its
+ * own docstring states the rule the caller has to keep: it is A FINDING, NEVER A SILENCE. Returning it
+ * is what makes that possible; `resolveEffectiveScope` is where it reaches somebody.
+ *
+ * NOT a filter on what gets searched. What a stored default DOES is a client-outcome question and it is
+ * not this function's to answer, and the ruling behind this change is explicit that the request path's
+ * tolerance for an unrecognized territory stays exactly as it is. This reports; it does not narrow.
+ */
+export function defaultTerritoryState(profile) {
+  const { kept, dropped } = recognizedTerritories(profile ? profile.defaultJurisdictions ?? [] : []);
+  return { kept, unrecognized: dropped };
+}
+
 export function defaultJurisdictionsLine(job, profile) {
   if (jobJurisdictions(job).length) return [];
-  const { kept } = recognizedTerritories(profile ? profile.defaultJurisdictions ?? [] : []);
+  const { kept } = defaultTerritoryState(profile);
   return kept.length
     ? [`Customer-default jurisdictions that materially matter (the request names none — apply these): ${kept.join(", ")}.`]
     : [];
@@ -203,6 +224,14 @@ export function resolveEffectiveScope(job = {}, profile = null, resolved = null)
     // The common-law grid's size follows the platform list, so widening the marketplaces widens the
     // work. Surfaced because it is the part a requester cannot infer from their own request.
     gridCellsPerVariant: profile ? derivedFloor(widened) : null,
+    // The stored defaults the engine cannot search — named, so the person approving a run can see that
+    // the configuration says more than the search will do. Empty on a profile with none, which is every
+    // profile written through an editor that refuses them at the point of entry.
+    //
+    // Reported off the PROFILE rather than off this run's ladder outcome. A default that lost to a
+    // request is still a default that will never work, and a reader who only hears about it on the runs
+    // where it happened to apply learns about a broken setting at random.
+    unrecognizedDefaultTerritories: defaultTerritoryState(profile).unrecognized,
   };
 }
 

package/driver/effort-model.mjs

@@ -51,7 +51,7 @@
  *     "1.5–2.5 hours" and a knockout from 45 to 15 minutes — and a stored quote is honoured at the version
  *     it was given. A version-2 quote must therefore not be read against this table.
  * 4 —: the wave multiplier is gone and the turnaround quote is a table lookup with no arithmetic
- *     (owner ruling 2026-08-26, recorded at `turnaroundBounds`). No weight moved and no unit changed.
+ *     (ruling 2026-08-26, recorded at `turnaroundBounds`). No weight moved and no unit changed.
  *     The SHAPE did, which is what this counter tracks — but state the size of it honestly: `runCount`
  *     is 1 for every job any door will admit, so the removed term was 1 on every quote that has ever
  *     been stored. No version-3 quote in any run record holds a number this table would not reproduce.
@@ -214,11 +214,11 @@ export const costBand = (i) => Math.max(1, Math.min(5, Math.ceil(effortUnits(i)
 // ── turnaround ──────────────────────────────────────────────────────────────────────────────────────
 //
 // THERE IS NO ARITHMETIC IN THIS SECTION, AND THAT IS THE DESIGN. The quote is a table lookup and
-// nothing else — owner ruling 2026-08-26, below. Anything that multiplies, adds to or scales the ruled
+// nothing else — ruling 2026-08-26, below. Anything that multiplies, adds to or scales the ruled
 // range is the thing this section was rebuilt to remove; do not reintroduce one without a new ruling.
 
 /**
- * THE QUOTED BOUNDS. ONE SOURCE — owner ruling, 2026-08-23.
+ * THE QUOTED BOUNDS. ONE SOURCE — ruling, 2026-08-23.
  *
  * WHAT THIS REPLACED, and why a constant beat a model. The old quote was a base plus one adder per lane:
  * 1.5h, +0.5 for case law, +0.5 for a native-language lane, +0.5 for a single territory. It missed the
@@ -239,12 +239,12 @@ export const costBand = (i) => Math.max(1, Math.min(5, Math.ceil(effortUnits(i)
  * harness judges against — see reconcileTurnaround.
  *
  * KNOCKOUT was quoted 45 min against 4–6 min delivered. Ruled "~15 min" — and SUPERSEDED by a later
- * owner ruling to 5-10 minutes, a range. Recorded rather than rewritten,
+ * ruling to 5-10 minutes, a range. Recorded rather than rewritten,
  * because the 4–6 min measurement beside it is the reason 5-10 is the better quote: 15 never sat on it.
  */
 export const TURNAROUND_QUOTE = Object.freeze({
   clearance: Object.freeze({ lowHours: 1.5, highHours: 2.5 }),
-  // — OWNER RULING: a knockout quotes 5-10 MINUTES, a range, not a flat figure.
+  // — RULING: a knockout quotes 5-10 MINUTES, a range, not a flat figure.
   //
   // The flat 0.25 came from the "no compute, just say it, keep it simple", and that ruling is
   // untouched here: this is still one stated figure per pipeline with nothing computed from levers. What
@@ -264,7 +264,7 @@ export const quoteBoundsFor = (l) => TURNAROUND_QUOTE[deriveMode(l) === "knockou
 /**
  * The bounds for THIS job. The ruled range, and NOTHING is done to it.
  *
- * — OWNER RULING, 2026-08-26: "No compute. We just say 1.5–2.5 hours for
+ * — RULING, 2026-08-26: "No compute. We just say 1.5–2.5 hours for
  * big reports, period. Keep it simple." The question put to him was which run-slot cap the quote should
  * divide by, and he removed the division instead of answering it.
  *

package/driver/engine/CONTRACT.md

@@ -50,7 +50,7 @@ ladder consumes it without knowing which engine produced it ([gateway.mjs](../ga
                                      // "text-parsed" on resetsAtBasis means it was read out of vendor
                                      // prose that stated no timezone, so it resolved in the running
                                      // box's zone — a reading, never a provider fact. Absent whenever
-                                     // `resetsAt` is absent. (tracker issue 697)
+                                     // `resetsAt` is absent.
   reads:      string[] | absent,     // READS GAUGE — file paths this turn's Read tool_use blocks
                                      // opened; [] = recorded "read nothing"; key absent = engine cannot
                                      // observe reads (openai-agent) → gateway journals `reads: null`
@@ -261,7 +261,7 @@ not extend the budget for it.
 
 **The hard ceiling — the third clock, and it measures ACTIVE time.** The last-resort wall fires at the
 stage's timeout + 60s (`CLEAROTRON_HARD_MS` pins it; unset and with no stage timeout, 660s) — compared not
-against elapsed but against elapsed MINUS tool wait, including a call still in flight. Owner ruling: a
+against elapsed but against elapsed MINUS tool wait, including a call still in flight. Ruling: a
 model always delivers something or fails, so this ceiling exists for the harness's own failure modes,
 and a turn waiting on a register call is working. Read on elapsed, a stage that spent 74.8% of its wall
 in tool calls and one that stalled are indistinguishable; read on active time the first is a normal turn

package/driver/engine/anthropic-agent.mjs

@@ -494,7 +494,7 @@ export const anthropicAgentEngine = {
       // "omitted" on Opus 5, so an ENGAGED block streams with a zero-length `thinking` string and a real
       // `signature` — reading the text would report "no thinking" on every production turn.
       let thought = false;
-      // MODEL GAUGE (tracker issue 238 corruption 3): which model the PROVIDER says served this turn. Until now
+      // MODEL GAUGE (corruption 3): which model the PROVIDER says served this turn. Until now
       // nothing on any record was a function of the provider's response — `modelUsed` was
       // `resolveModel(<the alias we asked for>)`, a pure function of the request, so a substitution or a
       // tier bounce was unobservable by construction. The truth is on the wire twice: `system:init`
@@ -564,7 +564,7 @@ export const anthropicAgentEngine = {
       // real (two chunks, no gap); keying on `spent === 0` would flag those and miss a stall that
       // happened to leave 1ms on the clock.
       let toolAskedChunk = null;
-      // tracker issue 1828 (the LATENT half, not the stall) — ONE OUTSTANDING ASK WAS ALL THIS COULD
+      // THE LATENT HALF, NOT THE STALL — ONE OUTSTANDING ASK WAS ALL THIS COULD
       // HOLD. `toolAskedAt` was a single slot, so a second assistant message arriving before the first
       // ask's result OVERWROTE the first ask's start time and its wait was never counted at all.
       // Measured on the overlap fixture (two asks, 150ms each): the old code reported toolWaitMs=149
@@ -689,7 +689,7 @@ export const anthropicAgentEngine = {
             .filter((b) => b?.type === "tool_use");
           const asked = askBlocks.map((b) => String(b?.name ?? "?"));
           toolAskedAt = asked.length ? Date.now() : null;
-          toolAskedChunk = asked.length ? chunkSeq : null;   // tracker issue 1828
+          toolAskedChunk = asked.length ? chunkSeq : null;
           toolAskedNames = asked.length ? [...new Set(asked)].sort().join("+") : null;
           if (asked.length) {
             const now = Date.now();
@@ -776,7 +776,7 @@ export const anthropicAgentEngine = {
       const watchdog = setInterval(() => {
         artifactProgress();
         const now = Date.now();
-        // THE STARTUP DEBT. tracker issue 1692 widened the deadline below until the first byte but left this
+        // THE STARTUP DEBT. An earlier repair widened the deadline below until the first byte but left this
         // clock's ORIGIN at spawn, so the startup interval stayed on the meter: the moment the grace let
         // go, progIdle already WAS the whole boot, and any NOPROG shorter than startup had expired before
         // the child was observed at all. The kill then landed on the next tick, before the ask could reach
@@ -787,9 +787,9 @@ export const anthropicAgentEngine = {
         // ── STARTUP IS NEITHER SILENCE NOR WORK ──────────────────────────────────────────────
         // Every clock here USED TO start at SPAWN, so until the child's first byte they were all timing
         // process startup: an idle clock that had not yet seen silence, and an active clock that had not
-        // yet seen work. Past tense deliberately — tracker issue 1780 finished this, and the sentence stayed true of
+        // yet seen work. Past tense deliberately — that work is finished, and the sentence stayed true of
         // the byte-stall below (`lastMove`) while being false of the progress clock above, which is
-        // precisely the gap that let the defect sit here for a day looking like ambient flake. tracker issue 1703 established this for the byte-stall in common.mjs — which this engine does not use,
+        // precisely the gap that let the defect sit here for a day looking like ambient flake. This was established for the byte-stall in common.mjs — which this engine does not use,
         // because it spawns its own child, so that fix never reached this watchdog. Under full-suite load
         // a starved spawn crossed a 400ms test ceiling before the mock had emitted anything, and the kill
         // was recorded as a no-progress stall against a turn that had not yet been given a chance to
@@ -802,7 +802,7 @@ export const anthropicAgentEngine = {
         else if (progIdle >= (started ? NOPROG : Math.max(NOPROG, GRACE))) { stallKill = true; noProgressKill = true; killed = true; killTree(); }
         // ── THE CEILING MEASURES ACTIVE TIME, NOT ELAPSED ────────────────────────────────────
         //
-        // Owner ruling: "there isnt such thing as a hung model. it always delivers something or fails."
+        // Ruling: "there isnt such thing as a hung model. it always delivers something or fails."
         // So this ceiling exists for the harness's own failure modes, not to budget the model, and a turn
         // still doing work must not die because a tool it was waiting on took a while to answer.
         //
@@ -855,7 +855,7 @@ export const anthropicAgentEngine = {
         // STDERR DOES NOT START THE CLOCKS, and this line used to. This engine's protocol is
         // stream-json on STDOUT; stderr carries node warnings and CLI notices, which a child can emit
         // before it has done anything at all. Treating one as "the child has spoken" ended the grace and
-        // — since tracker issue 1780, which made the first byte the progress clock's ORIGIN — started that clock too,
+        // — since the change that made the first byte the progress clock's ORIGIN — started that clock too,
         // so a turn whose real startup was still running got its no-progress ceiling measured from a
         // deprecation warning. A child that writes ONLY stderr is still bounded: it never starts, so the
         // byte-stall below fires at max(STALL, GRACE) exactly as it does for a silent spawn.
@@ -893,7 +893,7 @@ export const anthropicAgentEngine = {
         //
         // A turn killed mid-tool-call has an OPEN ask that `toolWaitMs` has not closed. Reporting the
         // unclosed accumulator left `activeMs + toolWaitMs` short of the wall by exactly that gap — and
-        // only on turns killed during a call, which is the population tracker issue 1111 is about. A guard asserting
+        // only on turns killed during a call, which is the population this rule is about. A guard asserting
         // the identity would have held on every ordinary attempt and quietly not held on the interesting
         // one. Closed here, ONCE, so both fields are derived from the same number.
         //
@@ -987,7 +987,7 @@ export const anthropicAgentEngine = {
           // nothing unmeasurable), following toolWaitByTool's own rule that absence and "cannot report"
           // must not look alike. `toolWaitMs` and the per-tool split are untouched.
           toolWaitUnmeasurable: [...unmeasurable],
-          // MODEL GAUGE (tracker issue 238): the id the WIRE reported, or null when the stream never said. Assistant
+          // MODEL GAUGE: the id the WIRE reported, or null when the stream never said. Assistant
           // message first (what served the call), init second (what the session was configured with).
           // Never the requested alias — see the declaration above.
           modelWire: wireModelAssistant ?? wireModelInit ?? null,
@@ -1023,7 +1023,7 @@ function errResult(t0, e, resumeRef) {
     stderr: `anthropic-agent spawn error: ${e?.message ?? e}`, laneWaitMs: 0,
     // reads: a spawn error means NO turn ran — [] is the true observation (nothing was read), not a gap.
     // modelWire: null for the opposite reason — no turn ran, so the wire said nothing about a model, and
-    // the record must say UNKNOWN rather than inherit the alias that was asked for (tracker issue 238).
+    // the record must say UNKNOWN rather than inherit the alias that was asked for.
     json: null, usage: null, reads: [], readsTruncated: false, modelWire: null, sessionRef: resumeRef ?? null,
   };
 }

package/driver/engine/jx-turn.mjs

@@ -2,7 +2,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // engine/jx-turn.mjs — the native-language lanes reach a model the same way every other stage does.
 //
-// ── why ( /, owner ruling 2026-08-20) ─────────────────────────────────────────────────────
+// ── why ( /, ruling 2026-08-20) ─────────────────────────────────────────────────────
 //
 // Verbatim: "one LLM provider only ever, API or auth, no mix". The jx lanes did not obey it and could
 // not: they POSTed to the Anthropic Messages API on `ANTHROPIC_API_KEY` at a hardcoded haiku tier,

package/driver/engine/mcp/gather-config.mjs

@@ -350,7 +350,7 @@ const RECORDING = Object.freeze({
   // reads are already the seeded `Read` grant's. No `search_run_artifacts`: this stage reads NOTHING from
   // the run — its finding arrives INLINE in the dispatch, which is the isolation the stage exists for.
   //
-  // WHAT DOES NOT MOVE: the card's PROSE. Owner ruling S2 (2026-08-13) re-scoped — the mechanical
+  // WHAT DOES NOT MOVE: the card's PROSE. Ruling S2 (2026-08-13) re-scoped — the mechanical
   // fields move now, the prose half waits on a side-by-side reading of one matter built both ways. The
   // transport carries the seat's bullets; it does not write them.
   "report-card": {
@@ -389,7 +389,7 @@ const RECORDING = Object.freeze({
   // and must take it whole. That is a context cost, not a capability loss, and it is the honest price.
   // NINTH — narrative-refutation, and the first conversion whose seat KEEPS its retrieval surface.
   //
-  // The reviewer is the report's only check. Its output converts; its REACH does not. Owner ruling
+  // The reviewer is the report's only check. Its output converts; its REACH does not. Ruling
   // (relayed 2026-08-26): it keeps the perplexity and band groups, because a reviewer that can only
   // compare the report against itself is a proofreader, and a prose-consistency read is the shape that
   // let the false coverage claim through. So this row states plainly what every sibling could take for
@@ -551,6 +551,23 @@ const RECORDING = Object.freeze({
       + "CALLS, UNMEASURED PRE-CONVERSION — this lane's seats hold no tools today, so the first "
       + "converted run is where the count comes from",
   },
+  // THE LANE'S THIRD CONVERSION, and the only stage on it that was born typed — there is no
+  // pre-conversion knockout-review that wrote its own file, so nothing here is a migration.
+  //
+  // NOT FANNED. The pass reads the WHOLE merged record in one turn, because the rule it applies is about
+  // consistency across the lines a reader meets: two marks' basis lines rewritten in separate turns drift
+  // apart in register, which is the defect the pass exists to remove.
+  "knockout-review": {
+    seatWrites: false,
+    tools: Object.freeze(["record_knockout_review"]),
+    reason: "hands back rewrites as VALUES, each naming the line it replaces by the typed address the "
+      + "driver measured and handed over. The address is what makes this a transport rather than a "
+      + "matching problem: prose quoted back has to be found again in the record, and the finder then "
+      + "decides where the rewrite lands. Refused by name at the call when an address names no line on "
+      + "this run's record, so a seat learns while it can still send a repair turn. EXPECTED FROM THE "
+      + "DICTATION'S ORDERED CALLS, UNMEASURED PRE-CONVERSION — this lane's seats hold no tools today, "
+      + "so the first converted run is where the count comes from",
+  },
 });
 
 // stage → its server key. DERIVED, and the alphabet is checked rather than assumed: an underscore in a
@@ -1094,8 +1111,8 @@ const FANNED_STAGES = Object.freeze({ perAxis: PER_AXIS_STAGES, perChunk: PER_CH
  * The BOUND ORDINAL for a fanned-out recording stage: which member of a per-ordinal artifact this turn
  * is writing. The driver knows, because the driver is what fanned it out.
  *
- * ONE FUNCTION, BOTH SUFFIX FORMS, for the reason `toolGroupsForStage` gives one block to both (tracker
- * issue 2003): a second derivation beside the first is a second place to forget, and forgetting is how
+ * ONE FUNCTION, BOTH SUFFIX FORMS, for the reason `toolGroupsForStage` gives one block to both:
+ * a second derivation beside the first is a second place to forget, and forgetting is how
  * the `#` form came to be unhandled in the first place. It walks SUFFIX_FORMS, so a separator this
  * module knows for grants is a separator it also knows for binding — the two cannot drift apart.
  *
@@ -1247,6 +1264,14 @@ export const RECORDING_TOOLS = Object.freeze({
   // retrieval grant here would contradict its own dispatch. Its reads are the instructed-scope sidecar
   // and its skill doc, which the seeded Read grant serves.
   "knockout-frame": Object.freeze(["Read", "mcp__recording-knockout-frame__record_knockout_frame"]),
+  // THE LANE'S THIRD AND LAST CONVERSION. BY HAND, like every row here — O1 asserts the resolved grant
+  // EQUALS this row, so a derived row would compare a value with itself.
+  //
+  // `Read` and its one record tool, and NO Write: this stage's artifact is the driver's. No search tool
+  // and no register tools — the pass reads lines and rewrites them, and a retrieval grant would invite a
+  // rewrite that adds a fact the rating never weighed. Its one read is the merged record the dispatch
+  // names by path, which the seeded Read grant serves.
+  "knockout-review": Object.freeze(["Read", "mcp__recording-knockout-review__record_knockout_review"]),
   // THE WRITER. BY HAND, like every row here — O1 asserts the resolved grant EQUALS this row, so a
   // derived row would compare a value with itself. This stage keeps three retrieval groups, and O1
   // compares the WHOLE grant, so they are listed: a row naming only the recording half would be a row

package/driver/engine/mcp/recording-server.mjs

@@ -64,6 +64,7 @@ import { REGISTER_AXES } from "../../coverage-ledger.mjs";
 import { searchRunArtifacts, SEARCH_LIMITS } from "../../skeptic-search.mjs";
 import { recordKnockoutAssess } from "../../knockout-assess-record.mjs";
 import { recordKnockoutFrame } from "../../knockout-frame-record.mjs";
+import { recordKnockoutReview } from "../../knockout-review-record.mjs";
 
 async function record_blind_frame(params) {
   const runDir = String(process.env.CLEAROTRON_BAND_RUN_DIR ?? "");
@@ -114,6 +115,16 @@ async function record_knockout_frame(params) {
   return recordKnockoutFrame(runDir, params);
 }
 
+async function record_knockout_review(params) {
+  const runDir = String(process.env.CLEAROTRON_BAND_RUN_DIR ?? "");
+  if (!runDir) {
+    return { error: "this server was started without a run — the driver wires it per run; there is no parameter for it and this tool never guesses one" };
+  }
+  // NO BOUND ORDINAL. The pass reads the whole merged record in one turn, so there is nothing for the
+  // driver to bind and nothing for a payload to usurp — the same asymmetry knockout-frame states.
+  return recordKnockoutReview(runDir, params);
+}
+
 async function record_prelim_variants(params) {
   const runDir = String(process.env.CLEAROTRON_BAND_RUN_DIR ?? "");
   if (!runDir) {
@@ -686,7 +697,7 @@ serve({
   }, {
     // ── CONVERSION 5 — ONE FINDING CARD, AND THE FIRST FAN-OUT TRANSPORT ──────────────────────────
     //
-    // The schema carries the seat's JUDGMENT and nothing else. Owner ruling S2 keeps the prose the
+    // The schema carries the seat's JUDGMENT and nothing else. Ruling S2 keeps the prose the
     // model's pending a side-by-side reading, so `text` is the seat's sentence — what the driver takes
     // over is every SHAPE around it: the bullet, the bold lead-in, the `::p::` position, and the final
     // `- Source:` line, which is composed from the finding's own record rather than typed from a host
@@ -1170,6 +1181,67 @@ serve({
     },
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
     handler: record_knockout_assess,
+  }, {
+    name: "record_knockout_review",
+    description:
+      "Hand back your REWRITES of the lines a reader meets first, as VALUES. The driver writes them into " +
+      "the rated record itself, so you never format JSON and never write a file. Each rewrite names the " +
+      "line it replaces by the `at` address you were handed in the dispatch, copied verbatim — you do " +
+      "not quote the sentence and there is no field for one. An address naming no line on this run's " +
+      "record is refused by name, so a mistyped address costs you a turn rather than landing your text " +
+      "on the wrong line. A repair turn may send only the rows it is correcting: the driver merges BY " +
+      "ADDRESS onto what it already accepted, so rows you omit survive.",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        schema_version: { type: "integer", description: "Accepted and ignored — the driver stamps its own." },
+        rewrites: {
+          type: "array",
+          description:
+            "One row per line you are replacing. A rewrite keeps every fact and changes only the " +
+            "register — the same band, names, reasons and conclusion, in the words the reader owns.",
+          items: {
+            type: "object", additionalProperties: false, required: ["at", "text"],
+            properties: {
+              at: {
+                type: "object", additionalProperties: false, required: ["field"],
+                description: "The address, copied VERBATIM from the dispatch row. Do not compose one.",
+                properties: {
+                  field: { type: "string", description: "The field this line lives in." },
+                  mark: { type: "string", description: "The mark's name, where the field is a mark's." },
+                  index: { type: "integer", description: "The position, where the field is a list." },
+                  ordinal: { type: "integer", description: "The finding's ordinal, for a conflict's one sentence." },
+                },
+              },
+              text: { type: "string", description: "The replacement prose, finished — written into the field exactly as sent." },
+              why: { type: "string", description: "Optional: what was wrong with the line you replaced." },
+            },
+          },
+        },
+        declined: {
+          type: "array",
+          description:
+            "One row per flagged line you are LEAVING ALONE, with the reason. A line you neither " +
+            "rewrite nor decline cannot be told afterwards from a line nobody read.",
+          items: {
+            type: "object", additionalProperties: false, required: ["at", "why"],
+            properties: {
+              at: {
+                type: "object", additionalProperties: false, required: ["field"],
+                properties: {
+                  field: { type: "string" }, mark: { type: "string" },
+                  index: { type: "integer" }, ordinal: { type: "integer" },
+                },
+              },
+              why: { type: "string", description: "Why the line stands as written." },
+            },
+          },
+        },
+      },
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    handler: record_knockout_review,
   }, {
     name: "record_knockout_frame",
     description:

package/driver/engine/openai-agent.mjs

@@ -39,7 +39,7 @@ const codexBin = () => envFrom(process.env, "CLEAROTRON_CODEX_PATH") || "codex";
 // on both engines. `sol` remains what codex itself reports as its own default (live-probed 2026-07-27:
 // `model: gpt-5.6-sol, provider: openai`), which is why the judgment tier keeps it.
 //
-// ── THE THREE TIERS MAP ONTO THE CODEX LADDER (owner ruling 2026-09-02,) ──────────────────────────
+// ── THE THREE TIERS MAP ONTO THE CODEX LADDER (ruling 2026-09-02,) ──────────────────────────
 //
 // Every stage declares a tier — opus / sonnet / haiku — engine-independently. The anthropic engine
 // resolves those three declarations onto three models. Until this ruling codex resolved ALL THREE onto

package/driver/engine/probe.mjs

@@ -90,7 +90,20 @@ const tail = (s) => {
   return t.length > DETAIL_CHARS ? `…${t.slice(-DETAIL_CHARS)}` : t;
 };
 
-const signInLine = (engine) => ENGINE_BINARIES[engine]?.signIn ?? "sign the CLI in";
+// THE HEADLESS ROUTE, WHERE THE ENGINE HAS ONE. The interactive sign-in is the one thing a server with no
+// browser cannot do, and it was the only remedy this offered — including to a box that had configured the
+// route built for servers. The engine table already carries that route; this reads it rather than a copy.
+const signInLine = (engine) => {
+  const spec = ENGINE_BINARIES[engine];
+  const base = spec?.signIn ?? "sign the CLI in";
+  const h = spec?.headless;
+  // Both forms the wizard already offers, read off the same table: a TOKEN route is run elsewhere and
+  // carried here by variable; a DEVICE route is run on this box and signs it in directly.
+  if (!h?.cmd) return base;
+  return h.tokenEnv
+    ? `${base} — or, on a box with no browser, run \`${h.cmd}\` on any machine you can sign in on and set the token it prints as ${h.tokenEnv} in this install's environment file`
+    : `${base} — or, on a box with no browser, run \`${h.cmd}\` here`;
+};
 
 /**
  * One verdict from one turn. PURE — no clock, no filesystem, no process.
@@ -273,6 +286,19 @@ export function probeWeatherWarning(verdict) {
  * again; a credential outliving the check that borrowed it would be a worse defect than the one this
  * fixed, and a check drives the restore rather than trusting it.
  */
+/**
+ * EVERY VARIABLE THAT DECIDES WHAT AN ENGINE SPAWN IS — selection, binary, billing mode and the
+ * credentials, the API key and the headless token alike. ONE list: `applyEngineEnv` below applies it,
+ * and a caller building the environment it hands this module fills from it. `doctor` kept a second copy
+ * that had dropped both credentials, so it filled a probe environment without the very token it then
+ * reported missing. Exported so there is nothing left to copy.
+ */
+export function engineEnvKeys() {
+  return [...new Set(["CLEAROTRON_AI", ...Object.values(ENGINE_BINARIES)
+    .flatMap((s) => [s.env, s.authEnv, s.apiKeyEnv, s.headless?.tokenEnv])
+    .filter(Boolean)])];
+}
+
 function applyEngineEnv(env) {
   if (!env || env === process.env) return () => {};
   // EVERY VARIABLE THAT DECIDES WHAT THE SPAWN IS, not only the ones that decide WHICH BINARY.
@@ -293,9 +319,7 @@ function applyEngineEnv(env) {
   // written, so the restore put that back instead of deleting it, and the mode leaked into the rest of
   // the process. Caught by the arm that exists to prove the restore, which is the only reason widening
   // this list was safe to do at all.
-  const keys = [...new Set(["CLEAROTRON_AI", ...Object.values(ENGINE_BINARIES)
-    .flatMap((s) => [s.env, s.authEnv, s.apiKeyEnv, s.headless?.tokenEnv])
-    .filter(Boolean)])];
+  const keys = engineEnvKeys();
   const saved = new Map();
   for (const k of keys) {
     saved.set(k, process.env[k]);

package/driver/enqueue-schema.mjs

@@ -115,6 +115,8 @@ export const DECLARED_JOB_FIELDS = Object.freeze([
   "deliveryRoute", "parentRunId",
   // whose rulebook rates it
   "profileKey", "projectKey", "customer", "customerUnknown",
+  // which organisation's Generic — set by a door only on a Generic run, from the verified principal
+  "tenant",
   // intake fidelity — posture and prose, verbatim from the request
   "deliverableSpec", "commercialFlexibility", "priorUse", "campaignShape",
   "upfrontInstructions", "brief", "rawRequest", "deadline", "provider",
@@ -675,7 +677,7 @@ export function validateJob(job, { atClaim = false } = {}) {
     errs.push(`both product (${JSON.stringify(rawProduct)}) and recipeKey (${JSON.stringify(rawRecipe)}) are set — name ONE selector (a saved search already carries its product)`);
   if (rawProduct && !ORDERABLE_PRODUCTS.includes(rawProduct))
     errs.push(unknownProductMessage(job.product));
-  // caseLaw: NOT A REQUEST FIELD ANY MORE (owner ruling 2026-08-06). It is what a Full country search IS.
+  // caseLaw: NOT A REQUEST FIELD ANY MORE (ruling 2026-08-06). It is what a Full country search IS.
   // REFUSED rather than ignored, and that is the whole point: a flag accepted and dropped is the
   // "accepted, then quietly narrower" shape — a requester who sent it believes they bought the deep
   // reading. The sentence names the product that carries it, so the refusal is one edit away from a
@@ -752,8 +754,26 @@ export function validateJob(job, { atClaim = false } = {}) {
     let known = false;
     let roster = [];
     try {
-      const profiles = loadProfiles();
-      known = profiles.has(String(job.profileKey).trim());
+      const key = String(job.profileKey).trim();
+      let profiles = loadProfiles();
+      known = profiles.has(key);
+      // THE ROSTER MOVES WHILE THIS PROCESS RUNS, and until this re-read it could not see that.
+      //
+      // `loadProfiles()` answers from a module cache with no expiry and no invalidation hook, filled
+      // when this process started. The engine door is a long-lived process of its own, so a company
+      // created through the portal AFTER it booted was refused here — "names no known customer" — while
+      // its file sat on disk and the portal had already told the person they could search under it.
+      // That is the whole of the defect the credential re-mint was meant to remove: the grant wall
+      // stopped refusing and this did not, so the person met the same dead end one step further in.
+      //
+      // ON THE MISS ONLY, so the ordinary request pays nothing: a hit is answered from the cache exactly
+      // as before, and a directory read happens just when the alternative is a wrong refusal. This is
+      // what "the door checks the company exists on disk now" has to mean for a process that has been
+      // up for a week.
+      if (!known) {
+        profiles = loadProfiles({ force: true });
+        known = profiles.has(key);
+      }
       roster = [...profiles.keys()].sort();
     } catch { known = true; }
     // NAME THE ROSTER THIS PROCESS CAN SEE, always.