clearotron 0.3.2-beta.10 → 0.3.2-beta.11

package/driver/suite-census.json

@@ -394,8 +394,8 @@
           "todos": 0
         },
         "a-gone-session-meets-a-door-not-a-json-body.test.mjs": {
-          "tests": 4,
-          "asserts": 16,
+          "tests": 6,
+          "asserts": 22,
           "skips": 0,
           "todos": 0
         },
@@ -411,6 +411,18 @@
           "skips": 0,
           "todos": 0
         },
+        "a-hostile-line-is-read-in-linear-time.test.mjs": {
+          "tests": 3,
+          "asserts": 7,
+          "skips": 0,
+          "todos": 0
+        },
+        "a-hostile-value-stays-inside-its-attribute.test.mjs": {
+          "tests": 6,
+          "asserts": 16,
+          "skips": 0,
+          "todos": 0
+        },
         "a-jq-program-in-a-js-string-keeps-its-backslash.test.mjs": {
           "tests": 2,
           "asserts": 6,
@@ -453,6 +465,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-link-in-the-workbook-is-not-banned-vocabulary.test.mjs": {
+          "tests": 2,
+          "asserts": 5,
+          "skips": 0,
+          "todos": 0
+        },
         "a-local-install-hands-its-stores-to-every-reader.test.mjs": {
           "tests": 1,
           "asserts": 10,
@@ -532,8 +550,8 @@
           "todos": 0
         },
         "a-new-install-signs-in-with-its-own-passphrase.test.mjs": {
-          "tests": 9,
-          "asserts": 47,
+          "tests": 10,
+          "asserts": 57,
           "skips": 1,
           "todos": 0
         },
@@ -759,6 +777,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-release-is-announced-only-once-a-stranger-can-install-it.test.mjs": {
+          "tests": 8,
+          "asserts": 19,
+          "skips": 0,
+          "todos": 0
+        },
         "a-release-note-cannot-be-counted-twice.test.mjs": {
           "tests": 12,
           "asserts": 33,
@@ -885,6 +909,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-stable-is-published-only-over-a-clean-code-scan.test.mjs": {
+          "tests": 9,
+          "asserts": 19,
+          "skips": 0,
+          "todos": 0
+        },
         "a-stale-classification-names-the-rows-that-moved.test.mjs": {
           "tests": 6,
           "asserts": 24,
@@ -1510,8 +1540,8 @@
           "todos": 0
         },
         "codename-freshness.test.mjs": {
-          "tests": 5,
-          "asserts": 7,
+          "tests": 6,
+          "asserts": 9,
           "skips": 0,
           "todos": 0
         },
@@ -1714,8 +1744,8 @@
           "todos": 0
         },
         "coverage-disclosure-carries-no-engine-output.test.mjs": {
-          "tests": 8,
-          "asserts": 18,
+          "tests": 9,
+          "asserts": 25,
           "skips": 0,
           "todos": 0
         },
@@ -2573,7 +2603,7 @@
         },
         "free-tier-credential-sites.test.mjs": {
           "tests": 5,
-          "asserts": 13,
+          "asserts": 14,
           "skips": 0,
           "todos": 0
         },
@@ -2872,8 +2902,8 @@
           "todos": 0
         },
         "matter-frame-record.test.mjs": {
-          "tests": 24,
-          "asserts": 81,
+          "tests": 25,
+          "asserts": 88,
           "skips": 0,
           "todos": 0
         },
@@ -2974,8 +3004,8 @@
           "todos": 0
         },
         "no-test-writes-inside-the-checkout.test.mjs": {
-          "tests": 16,
-          "asserts": 35,
+          "tests": 17,
+          "asserts": 38,
           "skips": 0,
           "todos": 0
         },
@@ -3005,7 +3035,7 @@
         },
         "onboard-wizard.test.mjs": {
           "tests": 77,
-          "asserts": 293,
+          "asserts": 294,
           "skips": 2,
           "todos": 0
         },
@@ -3173,7 +3203,7 @@
         },
         "pipeline.mock.test.mjs": {
           "tests": 98,
-          "asserts": 815,
+          "asserts": 820,
           "skips": 0,
           "todos": 0
         },
@@ -3455,7 +3485,7 @@
         },
         "provider-neutral-prose.test.mjs": {
           "tests": 4,
-          "asserts": 7,
+          "asserts": 8,
           "skips": 0,
           "todos": 0
         },
@@ -3731,7 +3761,7 @@
         },
         "register-ledger-rename.test.mjs": {
           "tests": 12,
-          "asserts": 32,
+          "asserts": 33,
           "skips": 0,
           "todos": 0
         },
@@ -3749,7 +3779,7 @@
         },
         "register-provider-required.test.mjs": {
           "tests": 10,
-          "asserts": 27,
+          "asserts": 28,
           "skips": 0,
           "todos": 0
         },
@@ -3808,8 +3838,8 @@
           "todos": 0
         },
         "release-pipeline.test.mjs": {
-          "tests": 117,
-          "asserts": 445,
+          "tests": 120,
+          "asserts": 452,
           "skips": 0,
           "todos": 0
         },
@@ -4277,7 +4307,7 @@
         },
         "seat-outputs-outside-driver-tree.test.mjs": {
           "tests": 5,
-          "asserts": 11,
+          "asserts": 12,
           "skips": 0,
           "todos": 0
         },
@@ -4335,6 +4365,12 @@
           "skips": 0,
           "todos": 0
         },
+        "setup-promises-a-login-shell-only-when-one-adds-the-directory.test.mjs": {
+          "tests": 3,
+          "asserts": 8,
+          "skips": 0,
+          "todos": 0
+        },
         "shipped-brand-is-the-product.test.mjs": {
           "tests": 7,
           "asserts": 24,
@@ -4606,8 +4642,8 @@
           "todos": 0
         },
         "test-full-runs-every-corpus-or-names-the-one-it-did-not.test.mjs": {
-          "tests": 17,
-          "asserts": 54,
+          "tests": 18,
+          "asserts": 61,
           "skips": 0,
           "todos": 0
         },

package/driver/unit-inventory.mjs

@@ -228,7 +228,7 @@ export const UNIT_INVENTORY = Object.freeze([
     // checkout path an ordinary systemd expansion and leaves no placeholder to render.
     note: "NOT RUNNING ANYWHERE, measured 2026-09-08. This row said LIVE ON PRODUCTION for as long as it "
       + "existed and no enumeration ever supported it. Was a TEMPLATE unit carrying identity-provider "
-      + "values inline; generic since tracker issue 1925.",
+      + "values inline; generic since the product installed its own units.",
     orphanReason: "CLAIMED A DEPLOYMENT IT WAS NEVER MEASURED ON, which is a FOURTH kind of orphan and "
       + "the only one that was ever a wrong claim rather than a waiting decision: the other three run "
       + "under another name, were deliberately switched off, or have simply never been installed. This "
@@ -246,7 +246,7 @@ export const UNIT_INVENTORY = Object.freeze([
     // it, against a fresh enumeration, which is the ratchet working rather than being edited around.
     unit: "clearotron-portal", runsOn: ["test"], tracked: ["clearotron-portal.service"],
       measured: "2026-09-07, test box, `systemctl --user show` with a working user bus: ActiveState=active, UnitFileState=enabled, fragment under ~/.config/systemd/user/.",
-    note: "NEW, tracker issue 1925, SHIPPED BUT NOT YET DEPLOYED. The portal had NO unit at all — it "
+    note: "NEW, SHIPPED BUT NOT YET DEPLOYED. The portal had NO unit at all — it "
       + "and the MCP face are the two children bin/start.mjs supervises, and neither ran under systemd, "
       + "so a hosted deployment kept them alive with a hand launcher and `clearotron start` had nothing "
       + "to refuse in favour of.",
@@ -263,7 +263,7 @@ export const UNIT_INVENTORY = Object.freeze([
     // asserting a production state no enumeration has ever shown.
     unit: "clearotron-mcp-face", runsOn: ["test"], tracked: ["clearotron-mcp-face.service"],
       measured: "2026-09-07, test box, `systemctl --user show` with a working user bus: ActiveState=active, UnitFileState=enabled, fragment under ~/.config/systemd/user/.",
-    note: "NEW, tracker issue 1925, SHIPPED BUT NOT YET DEPLOYED. The engine door the portal calls over "
+    note: "NEW, SHIPPED BUT NOT YET DEPLOYED. The engine door the portal calls over "
       + "MCP; the other of the two processes that had no unit.",
     orphanReason: "THE ENGINE DOOR THE PORTAL CALLS, shipped with no box carrying it yet. Same kind as "
       + "clearotron-portal beside it and as clearotron-deploy — never installed — and distinct from "
@@ -292,11 +292,11 @@ export const UNIT_INVENTORY = Object.freeze([
     // enumeration of a box shows it running.
     unit: "clearotron-client-mcp", runsOn: ["test"], tracked: ["clearotron-client-mcp.service"],
       measured: "2026-09-07, test box, `systemctl --user show` with a working user bus: ActiveState=active, UnitFileState=enabled, fragment under ~/.config/systemd/user/.",
-    note: "tracker issue 1976, and INSTALLED WITH THE PRODUCT since tracker issue 2148. The client door "
+    note: "INSTALLED WITH THE PRODUCT since 2026-09-03. The client door "
       + "— the one surface that accepts an account-scoped key, and a separate process from the engine "
       + "door, which refuses one outright.",
-    orphanReason: "Awaiting a box. It joined the install set on 2026-09-03 (tracker issue 2148 settled "
-      + "point 2, superseding the on-demand posture it shipped under), so `render-units.mjs --apply` "
+    orphanReason: "Awaiting a box. It joined the install set on 2026-09-03, superseding the "
+      + "on-demand posture it shipped under, so `render-units.mjs --apply` "
       + "and `clearotron start --background` both place and enable it. It REFUSES TO START without "
       + "CLIENT_MCP_TOKEN_ONLY=1, CLIENT_MCP_ACCOUNT_ACCESS=1, the allow-list, the signing secret and "
       + "CLEAROTRON_ACCESS_FILE in the box's `%h/.env` (it otherwise demands an OIDC audience and an "
@@ -310,7 +310,7 @@ export const UNIT_INVENTORY = Object.freeze([
     // it leaves a hosted box healthy-looking and draining nothing.
     unit: "clearotron-worker", runsOn: ["test"], tracked: ["clearotron-worker.service"],
       measured: "2026-09-07, test box, `systemctl --user show` with a working user bus: ActiveState=active, UnitFileState=enabled, fragment under ~/.config/systemd/user/.",
-    note: "NEW, tracker issue 1863. The drain, as one plain service unit invoking the entrypoint "
+    note: "NEW. The drain, as one plain service unit invoking the entrypoint "
       + "directly (owner ruling 2026-08-31). Ships tracked, runs nowhere yet — production takes it at "
       + "its rebuild, which is the same event that lets the retired units' files leave the tree.",
     orphanReason: "AWAITING A BOX, not an orphan by design. It is the hosted posture's drainer, and the "

package/mcp-server/CHANGELOG.md

@@ -1,10 +1,14 @@
 # trademark-artifacts-mcp
 
+## 0.3.2-beta.11
+
+No changes in this release.
+
 ## 0.3.2-beta.10
 
 ### Patch Changes
 
-- 98a57dd: Fixed: An assistant connected with nothing configured is now told which settings are missing, instead of being shown an empty list of searches.
+- Fixed: An assistant connected with nothing configured is now told which settings are missing, instead of being shown an empty list of searches.
 
 ## 0.3.2-beta.9
 
@@ -50,16 +54,16 @@ No changes in this release.
 
 ### Patch Changes
 
-- f96c089: Fixed: A clearance for a new client can be ordered through an assistant connector without setting up a company first.
-- 56a760f: Fixed: Removing somebody's access now ends their assistant's connection on its next request. Until now an assistant that had already connected kept the access it started with for up to half an hour.
-- c05e0a7: Fixed: Ask your assistant for a client's recent searches by the client's name and it finds them. Every search in the list now says which client it was for, and which project. A search whose own record cannot be read says so, instead of appearing to belong to nobody.
-- d9798db: Fixed: A clearance that stops now always records that its notice is still owed, so a failure cannot be passed over as already handled.
-- 240673c: Fixed: Sending an access key to the engine's network address now gets a refusal that says so. It reports that the address takes an identity from the sign-in proxy and never a key.
+- Fixed: A clearance for a new client can be ordered through an assistant connector without setting up a company first.
+- Fixed: Removing somebody's access now ends their assistant's connection on its next request. Until now an assistant that had already connected kept the access it started with for up to half an hour.
+- Fixed: Ask your assistant for a client's recent searches by the client's name and it finds them. Every search in the list now says which client it was for, and which project. A search whose own record cannot be read says so, instead of appearing to belong to nobody.
+- Fixed: A clearance that stops now always records that its notice is still owed, so a failure cannot be passed over as already handled.
+- Fixed: Sending an access key to the engine's network address now gets a refusal that says so. It reports that the address takes an identity from the sign-in proxy and never a key.
   
   Fixed: That refusal also names the local door where a key is accepted. Before, it reported only a missing sign-in assertion, which sent operators to the wrong configuration.
   
   For operators: A program on the same machine can now reach the engine's local key door without setting a host name for it. The local door no longer applies a browser protection that only a network address needs.
-- f96c089: New: The free preview of a search lists, for each territory ordered, which registers legally bind it.
+- New: The free preview of a search lists, for each territory ordered, which registers legally bind it.
 
 ## 0.3.1-beta.4
 
@@ -69,20 +73,20 @@ No changes in this release.
 
 ### Patch Changes
 
-- 56a760f: Fixed: Removing somebody's access now ends their assistant's connection on its next request. Until now an assistant that had already connected kept the access it started with for up to half an hour.
-- c05e0a7: Fixed: Ask your assistant for a client's recent searches by the client's name and it finds them. Every search in the list now says which client it was for, and which project. A search whose own record cannot be read says so, instead of appearing to belong to nobody.
+- Fixed: Removing somebody's access now ends their assistant's connection on its next request. Until now an assistant that had already connected kept the access it started with for up to half an hour.
+- Fixed: Ask your assistant for a client's recent searches by the client's name and it finds them. Every search in the list now says which client it was for, and which project. A search whose own record cannot be read says so, instead of appearing to belong to nobody.
 
 ## 0.3.1-beta.2
 
 ### Patch Changes
 
-- f96c089: Fixed: A clearance for a new client can be ordered through an assistant connector without setting up a company first.
-- 240673c: Fixed: Sending an access key to the engine's network address now gets a refusal that says so. It reports that the address takes an identity from the sign-in proxy and never a key.
+- Fixed: A clearance for a new client can be ordered through an assistant connector without setting up a company first.
+- Fixed: Sending an access key to the engine's network address now gets a refusal that says so. It reports that the address takes an identity from the sign-in proxy and never a key.
   
   Fixed: That refusal also names the local door where a key is accepted. Before, it reported only a missing sign-in assertion, which sent operators to the wrong configuration.
   
   For operators: A program on the same machine can now reach the engine's local key door without setting a host name for it. The local door no longer applies a browser protection that only a network address needs.
-- f96c089: New: The free preview of a search lists, for each territory ordered, which registers legally bind it.
+- New: The free preview of a search lists, for each territory ordered, which registers legally bind it.
 
 ## 0.3.1-beta.1
 
@@ -92,7 +96,7 @@ No changes in this release.
 
 ### Patch Changes
 
-- d9798db: Fixed: A clearance that stops now always records that its notice is still owed, so a failure cannot be passed over as already handled.
+- Fixed: A clearance that stops now always records that its notice is still owed, so a failure cannot be passed over as already handled.
 
 ## 0.3.0
 
@@ -122,7 +126,7 @@ No changes in this release.
 
 ### Patch Changes
 
-- e7cd9e1: Fixed: On an install run with `clearotron start`, a connected assistant now lists the same saved searches as the portal, including Generic's. `clearotron doctor` no longer says working saved searches are off, and it names one place profiles come from.
+- Fixed: On an install run with `clearotron start`, a connected assistant now lists the same saved searches as the portal, including Generic's. `clearotron doctor` no longer says working saved searches are off, and it names one place profiles come from.
 
 ## 0.3.0-beta.4
 
@@ -136,13 +140,13 @@ No changes in this release.
 
 ### Patch Changes
 
-- eacfce4: Fixed: An assistant reading a knockout's filings through the connector now gets each filing's page at the trade mark office, as the report does. Where that register publishes no page for a single record, it gets the office and the number instead. Before, it got a reference that opens nowhere.
+- Fixed: An assistant reading a knockout's filings through the connector now gets each filing's page at the trade mark office, as the report does. Where that register publishes no page for a single record, it gets the office and the number instead. Before, it got a reference that opens nowhere.
 
 ## 0.3.0-beta.1
 
 ### Patch Changes
 
-- b8ec213: Fixed: A company you create in the browser now appears in your assistant's list of companies straight away.
+- Fixed: A company you create in the browser now appears in your assistant's list of companies straight away.
   
   It used to appear only after the service restarted, although a search could already be started for it. Its projects were missing from the list in the same way, and so was its account in the search options.
   
@@ -186,7 +190,7 @@ No changes in this release.
 
 ### Patch Changes
 
-- 19a1869: New: Ask a what-if about a delivered report and get a supplementary memo over its archived evidence, without touching the report.
+- New: Ask a what-if about a delivered report and get a supplementary memo over its archived evidence, without touching the report.
 
 ## 0.1.3
 
@@ -196,12 +200,12 @@ No changes in this release.
 
 ### Patch Changes
 
-- 6d05f62: Fixed: An assistant connected to Clearotron no longer asks permission before reading; it still asks before starting or stopping a search.
+- Fixed: An assistant connected to Clearotron no longer asks permission before reading; it still asks before starting or stopping a search.
 
 ## 0.1.1-beta.1
 
 ### Patch Changes
 
-- 6d05f62: An assistant connected to Clearotron no longer asks permission before reading; it still asks before starting or stopping a search.
+- An assistant connected to Clearotron no longer asks permission before reading; it still asks before starting or stopping a search.
 
 ## 0.1.1-beta.0

package/mcp-server/lib/audit-view.mjs

@@ -261,10 +261,10 @@ export function accountTrace(result) {
     out.auditTrailNote = result.auditTrailNote ?? null;
   }
   // `note` is NOT forwarded, and this is the one place a raw string looked harmless and was not. trace's
-  // verdict branch returns a hard-coded sentence ending "unresolved concerns are surfaced to Alex (never
-  // withheld)" — an internal identity, in a literal, so no prose filter would ever have caught it: the
-  // scrub transforms MODEL output, and this is ours. The fact it carries is worth keeping, so it is
-  // restated here in client words rather than dropped: what the verdict is FOR.
+  // verdict branch returns a hard-coded sentence written for whoever operates the engine, not for a
+  // client — a literal, so no prose filter would ever catch what it says: the scrub transforms MODEL
+  // output, and this is ours. The fact it carries is worth keeping, so it is restated here in client
+  // words rather than dropped: what the verdict is FOR.
   if (result.note) out.note = result.resolvedAs?.kind === "verdict"
     ? "The verdict gates delivery: a reviewer reads the narrative against the source records and rules CLEAR, CONDITIONAL or BLOCKING. Anything short of CLEAR sends the work back for a corrective pass, and an unresolved concern is raised rather than withheld."
     : clean(result.note);

package/mcp-server/lib/trace.mjs

@@ -242,7 +242,7 @@ export function trace(run, target, { depth = 2, shallow = false } = {}) {
     out.auditTrail = relatedAuditRows(findings.audit, f);
     out.auditTrailNote = "Best-effort match of audit-trail rows to this finding; the full audit trail is available via list_findings(kind:'audit').";
   } else if (resolved.kind === "verdict") {
-    out.note = "The verdict gates delivery: the refutation reviewer reads narrative + the source files and writes CLEAR / CONDITIONAL / BLOCKING. A non-CLEAR verdict triggers a corrective re-synthesis; unresolved concerns are surfaced to Alex (never withheld).";
+    out.note = "The verdict gates delivery: the refutation reviewer reads narrative + the source files and writes CLEAR / CONDITIONAL / BLOCKING. A non-CLEAR verdict triggers a corrective re-synthesis; unresolved concerns are surfaced to the reader (never withheld).";
   }
   return out;
 }

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.3.2-beta.10",
+  "version": "0.3.2-beta.11",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clearotron",
   "type": "module",
-  "version": "0.3.2-beta.10",
+  "version": "0.3.2-beta.11",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",
@@ -11,7 +11,7 @@
   "bugs": {
     "url": "https://github.com/CordilleraSarl/clearotron/issues"
   },
-  "description": "Clearotron — trademark-clearance engine: deterministic orchestration driver + MCP interrogation server. Provider-agnostic, model-agnostic, runs headless (no gateway).",
+  "description": "Trademark clearance engine. Searches the registers and the open web, rates the conflicts, and delivers a written report with the record behind every finding.",
   "keywords": [
     "trademark",
     "trademark-clearance",

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.3.2-beta.10",
+  "version": "0.3.2-beta.11",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/jx/README.md

@@ -4,14 +4,14 @@ Three pure modules, **one non-agentic structured turn each, per mark × lane**,
 configured for. Not an agent: no tools, no MCP, no skills, no resume — one prompt in, one JSON object out,
 validated at parse.
 
-## What these lanes ARE, and what runs them ( /)
+## What these lanes are, and what runs them
 
 **One vendor, one billing mode, decided by the run and not by this directory.** The lanes go through
 `engine.runTurn()` — the same door all fourteen agentic stages use — via
 [`../../driver/engine/jx-turn.mjs`](../../driver/engine/jx-turn.mjs). Whatever program the customer configured
 (`CLEAROTRON_AI`) and whatever billing mode the run is on (subscription, API key or, for Claude, a cloud account)
 carries these calls too.
-That is the owner's standing rule — *one LLM provider only ever, API or auth, no mix* — and until 2026-08-20
+That is the product's rule — *one reasoning provider per run, API or subscription, never a mix* — and until 2026-08-20
 these three lanes were the one place in the product that broke it: they POSTed to the Anthropic Messages API on
 `ANTHROPIC_API_KEY` at a hardcoded cheap tier no matter what the rest of the run was doing.
 

package/providers/jx-subclass/README.md

@@ -72,7 +72,7 @@ class 44) and `351918` (cosmetics retail, class 35). A class-3 search finds neit
 goods that have a Nice basic number (609), so validating a relation's target group against it would drop
 real relations without a word. The authority is `tw/tw-group-codes.json`, taken from TIPO's group headers.
 
-## Korea — done, and round-2 research had the mechanism wrong
+## Korea
 
 KIPO publishes 「유사상품 심사기준(니스 제13판)」 as a direct download: **21.8 MB, 1,011 pages, full text
 layer** (`kpoContFileDown.do?seq=30&fileNum=25`, Referer header required).

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-oauth-mcp-bridge
 
+## 0.3.2-beta.11
+
+No changes in this release.
+
 ## 0.3.2-beta.10
 
 No changes in this release.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.3.2-beta.10",
+  "version": "0.3.2-beta.11",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/scripts/README.md

@@ -13,7 +13,7 @@ The axis is *what the script assumes exists*, not where it happens to be run.
 | Script | What it does |
 |---|---|
 | `test-run.mjs` | Gives a test run its own `TMPDIR` and deletes it at exit. **Load-bearing** — every workspace's `npm test` shells out to it, so `scripts/` can never be dropped wholesale. |
-| `render-check.mjs` | Renders a published report **inside the portal's iframe** in a real browser — the height bridge, the scrollbar loop, the sticky topbar. Needs a published run: point it at a pool with `--pool`, or pass `--fixture-pool` to replay `demo/` into a throwaway one. **Runs nowhere yet** — but its three interior assertions now MEASURE, deterministically: real time plus an explicit readiness signal, and `--plant-overflow` proves it still catches a broken report. What is left is a membership decision, not a defect.. |
+| `render-check.mjs` | Renders a published report **inside the portal's iframe** in a real browser — the height bridge, the scrollbar loop, the sticky topbar. Needs a published run: point it at a pool with `--pool`, or pass `--fixture-pool` to replay `demo/` into a throwaway one. Run by CI on a fixture pool. Its interior assertions measure deterministically: real time plus an explicit readiness signal, and `--plant-overflow` proves it still catches a broken report. |
 | `home-render-check.mjs` | Draws the portal Home in a real browser, every state, both themes. Run by CI. |
 | `composer-render-check.mjs` | Lays out the New Clearance composer and checks the levers reach the wire. Run by CI. |
 | `clearances-render-check.mjs` | Checks the `/portal/clearances` columns hold together. Run by CI. |
@@ -80,15 +80,10 @@ settling on the first try every time, and the slack figures that looked like a l
 147px against a 15-24 band) turned out to be the stale probe too. The sandbox is byte-identical to
 `Result.tsx`'s and `allow-same-origin` was never added.
 
-**It is still not in CI, and that is now a decision rather than a defect** — nobody has run it on a
-runner since the rewrite, and wiring a blocking browser step on the strength of one developer box is the
-mistake the membership guard exists to stop. That call is 's.
-
-Read the other six with that in mind: they are outer-document measurements — does the page scroll, is
-the header pinned, is Export reachable — and every one would pass against **an iframe that loaded
-nothing**, because the frame is styled to a fixed height. A green from this check would have meant
-almost nothing. The step is backed out and the script is declared, with the measurement, rather than
-quietly dropped.
+**CI runs it**, on a pool replayed from `demo/` into a throwaway directory:
+`node scripts/render-check.mjs --fixture-pool`. Its outer-document assertions — does the page scroll, is
+the header pinned, is Export reachable — would pass against an iframe that loaded nothing, because the
+frame is styled to a fixed height; the interior ones above are what make a green mean something.
 
 **Which check runs where is now checked, not just written here.** A test in the driver suite
 reads `.github/workflows/ci.yml` and requires every `scripts/*-check.mjs` to be either invoked by a job

package/scripts/citation-line-check.mjs

@@ -79,10 +79,10 @@ export const EXEMPT_TARGETS = [
   { target: /^driver\/(x|a|f|nope)\.mjs$/, why: "planted names in contract-audit.test.mjs — the test feeds the auditor a citation to a file that does not exist ON PURPOSE" },
   { target: /^driver\/skills\/[ab]\/(rules|SKILL)\.md$/, why: "planted skill paths in contract-audit.test.mjs, same shape" },
   { target: /^planted\//, why: "THE NAMESPACE for a fixture path that must not exist. publication-scrub.test.mjs plants an undeclared path to prove the scrubber sees it, and cut-vendor-keys.test.mjs plants one to prove the record-key detector reports a location. Unlike the namespaced entries below, this one is deliberately shared: `planted/` names the class rather than one test's fixtures, so a new test planting a non-existent path uses it instead of inventing a second convention — and a bare invented name is what reports as a dangling citation to a file nobody meant to create" },
-  { target: /^diffcase-[a-z]+\.mjs$/, why: "SYNTHETIC DIFF FIXTURE FILENAMES in pushed-content-guard.test.mjs (tracker issue 1941). That test feeds `addedLines` a hand-written unified diff, so `keep.mjs:4` is a line of DIFF DATA the guard must parse, not a citation to anything. Same class as the contract-audit planted names directly above: a test that must contain a file reference to a file that does not exist, on purpose. NAMESPACED `diffcase-` deliberately: a first cut exempted the bare names `keep|dropped|gone|zz` and SWALLOWED two of this file's own controls, which plant `gone.mjs:12` — an exemption wide enough to cover somebody else's known-bad turns their arm green while it proves nothing" },
+  { target: /^diffcase-[a-z]+\.mjs$/, why: "SYNTHETIC DIFF FIXTURE FILENAMES in pushed-content-guard.test.mjs. That test feeds `addedLines` a hand-written unified diff, so line 4 of `keep.mjs` is DIFF DATA the guard must parse, not a citation to anything. Same class as the contract-audit planted names directly above: a test that must contain a file reference to a file that does not exist, on purpose. NAMESPACED `diffcase-` deliberately: a first cut exempted the bare names `keep|dropped|gone|zz` and SWALLOWED two of this file's own controls, which plant line 12 of `gone.mjs` — an exemption wide enough to cover somebody else's known-bad turns their arm green while it proves nothing" },
   { target: /^driver\/engine\/mcp\/planted-server\.mjs$/, why: "a planted server module name in contract-audit.test.mjs" },
   { target: /^srv\/app\//, why: "SYNTHETIC DEPLOYMENT STACK TRACES. The house rule for fixtures is to use a `/srv/…` path and never a real `/home/<name>/` one (deployment-hostnames.test.mjs polices the other half), so a hand-written trace like \"TypeError: x is not a function at /srv/app/driver/pipeline.mjs:2411:9\" is test DATA the parser under test must read — the line number is the datum, not a claim about our tree. It passed for as long as it did by luck: this resolver strips the prefix and lands on the real driver/pipeline.mjs, so the fixture went green while whatever line it happened to name was real code, and reported BLANK the first time an unrelated edit made that line a brace. NAMESPACED to `srv/app/` for the reason the diffcase- entry gives — nothing in this repo ships under srv/, and a wider prefix would swallow a genuine citation someone writes tomorrow" },
-  { target: /^(?:driver\/)?driftcase-[a-z-]+\.mjs$/, why: "SYNTHETIC DRIFT FIXTURE FILENAMES in citation-drift-at-the-diff.test.mjs (tracker issue 1950). That test feeds the drift report a hand-built corpus in which `driftcase-target.mjs:40` is the DATUM being classified — the thing whose movement is measured — not a citation to anything. Same class as the planted names above, and NAMESPACED under `driver/` for the reason the `diffcase-` entry gives: an exemption wide enough to cover another test's known-bad turns their arm green while it proves nothing. The directory prefix is OPTIONAL because one arm cites the BARE BASENAME on purpose: that is the exact shape that made `resolveCited` short-circuit on an always-true `exists` and print a clean tick, so the arm cannot be written any other way. `driftcase-` carries the namespacing on its own — nothing else in this tree uses the prefix" },
+  { target: /^(?:driver\/)?driftcase-[a-z-]+\.mjs$/, why: "SYNTHETIC DRIFT FIXTURE FILENAMES in citation-drift-at-the-diff.test.mjs. That test feeds the drift report a hand-built corpus in which line 40 of `driftcase-target.mjs` is the DATUM being classified — the thing whose movement is measured — not a citation to anything. Same class as the planted names above, and NAMESPACED under `driver/` for the reason the `diffcase-` entry gives: an exemption wide enough to cover another test's known-bad turns their arm green while it proves nothing. The directory prefix is OPTIONAL because one arm cites the BARE BASENAME on purpose: that is the exact shape that made `resolveCited` short-circuit on an always-true `exists` and print a clean tick, so the arm cannot be written any other way. `driftcase-` carries the namespacing on its own — nothing else in this tree uses the prefix" },
   { target: /^common-law-findings\.md$/, why: "a RUN ARTIFACT, written into a run directory at execution time. It is cited by name in doubt-ledger and audit-from-spine tests because that is what the artifact is called; it is not and never will be a tracked file" },
   // ✕ REMOVED: `codex/dist/(helper|cli).js` — a captured CODEX stack trace in
   // exit-cause-survives-the-digest.test.mjs. Both of its citations carry a COLUMN, so `citationsIn`

package/scripts/e2e.mjs

@@ -922,7 +922,7 @@ export async function enqueueViaMcp(job, { clientPrincipal = false, forwarder =
 // harness named the door that BEHAVED as the defect. Two hours later the codex arm hit no 429 and the
 // same case was clean — so the finding also reads as a flake, which is the worst of both.
 //
-// The rule the asymmetry check encodes (#98) is sound: for a case both doors should refuse, the one
+// The rule the door-asymmetry check encodes is sound: for a case both doors should refuse, the one
 // that accepted is the bug. It rests on an assumption nobody wrote down — that a refusal is a
 // PRODUCT-SCOPE JUDGMENT. A 429 or a 5xx is not a judgment. The request died in the transport, before
 // `start_run` ran a single scope check, so that door holds no opinion about this case at all.
@@ -945,7 +945,7 @@ export function doorAnswerClass(answer) {
 }
 
 /**
- * The #98 asymmetry verdict, over the doors that actually answered.
+ * The door-asymmetry verdict, over the doors that actually answered.
  * Returns { agreed, compared, unavailable, reducedCoverage } — `agreed` is TRUE when fewer than two
  * doors answered, because one opinion is not a disagreement and must never be reported as one.
  */
@@ -2141,7 +2141,7 @@ async function cmdRun(id) {
 
   const jobs = s.job ? [{ id: s.id, job: s.job, kase: {} }] : (s.cases ?? []).map((c) => ({ id: c.id, job: c.job, what: c.what, oneMatterAcrossDoors: c.oneMatterAcrossDoors === true, expectTerminal: (c.expect ?? {}).terminal ?? null, kase: c }));
 
-  // door: "all" is the point of R0 — a rule enforced in one door and not another is exactly the #98
+  // door: "all" is the point of R0 — a rule enforced in one door and not another is exactly the door
   // asymmetry. Every case goes through EVERY drivable door and the answers are compared. runner.mjs's
   // claimAndPrep is the wall they all land on, so they must agree; if they ever do not, the door that
   // admits is the bug, not the door that refuses. A case that declares `doors` goes through those alone
@@ -2662,7 +2662,7 @@ function printPreviousRoundNotice(s) {
 }
 
 // `run` records what each door answered, because `report` runs later in a different process and cannot
-// otherwise know. A rule enforced in one door and waved through by another is exactly the #98 asymmetry,
+// otherwise know. A rule enforced in one door and waved through by another is exactly the door asymmetry,
 // and it is invisible unless the answers are compared.
 //
 // — the receipt's PATH and FORMAT moved to driver/e2e-rounds.mjs (`receiptPath`, `readReceipt`),
@@ -2686,7 +2686,7 @@ function printPreviousRoundNotice(s) {
 export function doorRefusal(receipt, ref, expect = null) {
   const rc = (receipt?.cases ?? []).find((c) => c.ref === ref) ?? null;
   const recorded = rc?.answers ?? [];
-  // — ONLY THE DOORS THAT ANSWERED. `doorAsymmetry` has excluded unavailable doors from the #98
+  // — ONLY THE DOORS THAT ANSWERED. `doorAsymmetry` has excluded unavailable doors from the door
   // comparison since, but this function did not, and it is the one that prints
   // "refused at the door by cli, ops-mcp". A door that was never asked was listed there as a refuser,
   // so a case where one door refused correctly and the other did not exist read EXACTLY like a case
@@ -3175,7 +3175,7 @@ async function cmdReport(id, { round: requestedToken = null } = {}) {
         // notice is OWED depends on the terminal, and the terminal is what could not be established.
         const owesNotice = q.terminal === "clarify" || q.terminal === "duplicate" || q.terminal === "failed" || q.undetermined;
         if (owesNotice) {
-          // The contract from #92: a refusal must PARK *and NOTIFY*, never fail silently.
+          // The contract: a refusal must PARK *and NOTIFY*, never fail silently.
           console.log(`      requester notified: ${
             q.packets.length ? q.packets.join(", ")
             : q.packetsUnreadable ? `CANNOT TELL — ${q.packetsUnreadable}`
@@ -3342,7 +3342,7 @@ async function cmdReport(id, { round: requestedToken = null } = {}) {
     // CASE-level asserts are evaluated too. They were declared and never reached: this loop read only
     // `s.expect.assert`, and `kase` was consulted solely for `terminal` and `reasonMatches`. R0 has no
     // scenario-level asserts at all, so R0 ran ZERO assertions — and R0e's `profileKey == "generic"`,
-    // the only substantive check in the whole scenario and the entire point of the #83 roster-blindness
+    // the only substantive check in the whole scenario and the entire point of the roster-blindness
     // case, was silently dead. Same class of defect as the artifacts key above: declared, never asked.
     for (const a of [...(s.expect?.assert ?? []), ...(kase?.expect?.assert ?? [])]) {
       const r = evalAssertion(a, runDir);
@@ -3405,7 +3405,7 @@ async function cmdReport(id, { round: requestedToken = null } = {}) {
   }
   // ── did every door give the same answer? ────────────────────────────────────────────────────────────
   // Only R0 drives more than one door. A rule enforced at one door and waved through by another is the
-  // #98 asymmetry, and it is invisible unless the answers are compared — so `run` records them and this
+  // door asymmetry, and it is invisible unless the answers are compared — so `run` records them and this
   // reads the receipt. No receipt is reported as "cannot tell", never as agreement.
   if (s.door === "all") {
     // — read THIS ROUND's answers, and distinguish the three ways they can be missing: no receipt