clearotron 0.3.2-beta.12 → 0.3.2-beta.14

package/CONTRIBUTING.md

@@ -60,9 +60,10 @@ Four more things run for free:
 | `npx clearotron demo` | Replays `demo/` — a real run on a fictional mark — through the real publisher into `~/trademark-demo/pool` and serves it. No keys, no model, no engine. |
 
 **About `npx clearotron demo`.** `npx clearotron demo --no-open --once` publishes the sample and exits without
-touching a browser. `npx clearotron demo --pool <dir>`
-puts the pool somewhere else, and `npx clearotron demo --run-dir <dir>` replays a finished run of your
-own instead of the shipped example.
+touching a browser. Without `--once` it serves the portal until it is stopped: `--no-open` keeps it from
+opening a browser, `--port <n>` moves its three doors to `n`, `n+1` and `n+2`, and `--keep` leaves its folder
+behind when it stops. `npx clearotron demo --pool <dir>` puts the pool somewhere else, and
+`npx clearotron demo --run-dir <dir>` replays a finished run of your own instead of the shipped example.
 
 Fix a bug, add a jurisdiction, add a doctrine test case: all of it is reachable from here.
 
@@ -90,7 +91,7 @@ this tree does not carry has to be declared with its reason, and the publication
 fails an undeclared one.
 
 **`driver/skills/**` is engine input, not documentation.** Those Markdown files are the prompt payload
-served to the model at run time — `synthesis-rules.md` is a 16,000-word program. Editing them for
+served to the model at run time — `synthesis-rules.md` is a 12,000-word program. Editing them for
 brevity, tone or tidiness changes what a clearance concludes. Nothing in this section, and nothing in
 any writing pass over the documentation, applies to them.
 
@@ -192,7 +193,7 @@ with no runner assigned and no steps recorded, and every job that gates on it is
 this repository: two runs on one SHA, thirty minutes apart, the push run green on every job and the
 scheduled one red having run nothing.
 
-That is **could-not-look**, not a fault, and this tool says so rather than making you open the run and
+That is **a check that could not look**, not a fault, and this tool says so rather than making you open the run and
 read timings to find out. It does not block on it — nothing ran, so nothing can have regressed.
 
 **It also does not call it green.** A run that never ran told you nothing about `main`, and the last

package/INSTALL.md

@@ -242,16 +242,15 @@ refuses for every real user.
 
 Two further constraints, both of which stop a package being cut from just anywhere:
 
-- **The de-identification scan needs a full clone.** It refuses a shallow one (exit 2 — could-not-look,
-  not a pass) because it walks history it cannot see.
+- **The de-identification scan needs a full clone.** It refuses a shallow one (exit 2 — a check that could
+  not look, not a pass) because it walks history it cannot see.
 - **It also needs its table**, passed with `--blocklist` (or `CLEAROTRON_IDENTIFIER_BLOCKLIST`), and
   that table lives in the private config store rather than in this repository. Without it the scan
   exits 2 rather than arming a weaker rule set quietly.
 
 Both refusals are correct and neither is a workaround to route around.
 
-**Every `clearotron` command in this document is written `npx clearotron …`, and that is not a
-stylistic choice.** This repository *is* the `clearotron` package, and npm links a package's `bin` into
+This repository *is* the `clearotron` package, and npm links a package's `bin` into
 `node_modules/.bin` only for its **dependencies** — never for the package itself. So after `npm install`
 succeeds there is no `clearotron` on your `PATH` and none in `node_modules/.bin`; a bare `clearotron`
 would be `command not found` with nothing having failed.

package/README.md

@@ -33,7 +33,8 @@ the address in your browser. No sign-up, no credentials, no network calls to us.
 The demo runs for as long as that window stays open, and removes everything it made when you close it —
 nothing of it is left on the machine, and running it again later starts clean. If you want to keep the
 sample reports after closing the window, run `npx clearotron demo --keep`; it prints the one command
-that removes the folder when you are done with it.
+that removes the folder when you are done with it. `npx clearotron demo --once` publishes the reports and
+exits, and keeps the folder the same way.
 
 **Then install it.**
 

package/bin/clearotron.mjs

@@ -25,6 +25,7 @@ import { isEntrypoint } from "../shared/is-entrypoint.mjs";
 import { nodeFloorVerdict, nodeFloorRefusal } from "../shared/node-floor.mjs";   // — one floor, read from package.json
 import { invocationPrefix } from "../shared/invocation.mjs";   // — print a command the reader can type
 import { watchParent } from "../shared/parent-watch.mjs";
+import { EXPERIMENTAL_WARNING_OFF } from "../shared/demo-start-args.mjs";
 
 export const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -193,7 +194,12 @@ const [verb, ...rest] = process.argv.slice(2);
   // — tell the child how the READER reached us, so its own advice names a command they can type.
   // Without this every spawned verb sees argv[1] = its own implementation file and would print `npx`
   // even for somebody who typed a bare `clearotron`.
-  const child = spawn(process.execPath, [target, ...builtin, ...rest], {
+  // THE DEMO RUNS WITHOUT NODE'S EXPERIMENTAL-FEATURE WARNING. Node prints one the first time anything loads
+  // its built-in SQLite, and on the demo it landed on the first screen, above the sentence saying what the
+  // demo is. A flag on the demo's own process; `bin/example.mjs` hands it on to the services it starts
+  // (EXPERIMENTAL_WARNING_OFF). Every other warning still prints.
+  const quiet = verb === "demo" ? [EXPERIMENTAL_WARNING_OFF] : [];
+  const child = spawn(process.execPath, [...quiet, target, ...builtin, ...rest], {
     stdio: "inherit",
     env: { ...process.env, CLEAROTRON_INVOKED_AS: process.argv[1] ?? "" },
   });

package/bin/example.mjs

@@ -38,7 +38,7 @@ import "../shared/env-local.mjs";   // step 4 / — FIRST: this program read a
 // handed it nothing and the read fell through to a default. Proven both ways from one
 // environment: without this import the value is invisible, with it the retired spelling is
 // back-filled. Placed above every other import because a side-effecting import runs in order.
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { appendFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { removeDirectory } from "../shared/os-advice.mjs";
 import { invoke } from "../shared/invocation.mjs";   // — the printed command is resolved once, for the reader who is actually standing there
@@ -47,13 +47,13 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn } from "node:child_process";
 import { BRAND } from "../shared/brand.mjs";   // — the installer's own name, from the tenant seam
 import { envFrom } from "../shared/env-aliases.mjs";   // — resolves EITHER spelling; names the retired one because that is the live-writable half
-import { isFrozen, demoChildren, demoInventory, prepareSample } from "../driver/demo-container.mjs";   // — one definition of what a frozen demo is, for the player AND the gate
+import { isFrozen, demoChildren, demoInventory, prepareSample, releaseDemoCopies } from "../driver/demo-container.mjs";   // — one definition of what a frozen demo is, for the player AND the gate
 import { ensureDemoProgram, demoProgramEnv } from "../shared/permanent-install.mjs";
 
 const REPO = join(dirname(fileURLToPath(import.meta.url)), "..");
 
 import { usageBlock } from "../shared/usage-block.mjs";
-import { demoStartArgs } from "../shared/demo-start-args.mjs";
+import { demoStartArgs, withWarningOff } from "../shared/demo-start-args.mjs";
 import { bundleVerdict } from "../shared/bundle-freshness.mjs";
 const argv = process.argv.slice(2);
 const flag = (n, d = null) => { const i = argv.indexOf(n); return i >= 0 ? argv[i + 1] : d; };
@@ -168,6 +168,14 @@ if (!sampleDirs.length || !isFrozen(sampleDir)) {
 // rest are published. An unreadable file inside one sample used to throw out of the copy here and take
 // every demo down with a stack trace (measured on a published beta, 2026-09-11).
 const failures = ALL ? inventory.unusable.map((u) => ({ name: u.name, why: u.why })) : [];
+// A STOP WHILE THE SAMPLES ARE COPIED OR PUBLISHED still takes the copies with it. The copies go on exit
+// (driver/demo-container.mjs), and a signal's default ends the process without one. Taken off again once
+// the copies are gone, before the portal's own handlers are installed.
+const stopEarly = [["SIGINT", 2], ["SIGTERM", 15], ["SIGHUP", 1]].map(([sig, no]) => {
+  const h = () => process.exit(128 + no);
+  process.once(sig, h);
+  return [sig, h];
+});
 const samples = [];
 for (const dir of sampleDirs) {
   const r = prepareSample(dir, { repoRoot: REPO });
@@ -250,6 +258,14 @@ if (existsSync(poolRoot) && !statSync(poolRoot).isDirectory()) die(`demo: ${pool
 
 // ── 3. replay ────────────────────────────────────────────────────────────────────────────────────────
 console.log(`\n  ${BRAND.name} ${BRAND.product.toLowerCase()} — demo\n`);
+// THE LABEL, FIRST. The reader is about to look at a document that reads like advice about a real mark. It
+// is not, and the demo says so before anything else rather than in a footnote nobody reaches. It printed
+// after the replay, below the engine's own diagnostics and a Node warning, so the first thing a newcomer
+// read was internal tallies (measured on the published beta, 2026-09-19).
+console.log("  Real engine output for the fictional mark VENQORI, captured against Clarivate Compumark.");
+console.log("  Replaying it needs no account, no key and no network.");
+console.log("  Every number, band and citation below was produced by that real run and is being");
+console.log("  re-rendered from its artifacts. It is an example, not advice.\n");
 console.log(samples.length === 1
   ? `  sample:  ${samples[0].dir}`
   : `  samples: ${samples.length}${failures.length ? ` of ${shipped}` : ""} — ${samples.map((x) => x.name).join(", ")}`);
@@ -268,26 +284,42 @@ const { republishRun } = await import(pathToFileURL(join(REPO, "driver", "publis
 // The failures are collected and reported together at the end, and the process exits non-zero, because a
 // demo that came up missing a quarter of itself is not a success however good the three look.
 const results = [];
-for (const s0 of samples) {
-  try {
-    // poolUrl "" on purpose: the report's own link block is for a deployment that serves the pool at a
-    // public URL. This one is served from this process, at a port picked below.
-    results.push({ ...s0, published: await republishRun({ runId: s0.meta.runId, meta: s0.meta, pool: poolRoot, poolUrl: "", runDir: join(s0.publishFrom, "run") }) });
-  } catch (e) {
-    failures.push({ name: s0.name, why: String(e?.message ?? e) });
+// THE PUBLISHER'S OWN DIAGNOSTICS GO TO A FILE. It prints its tallies as it works (`[record-links] …`,
+// `knockout receipts: …`), which is right for an operator watching a delivery and wrong as the first
+// screen a newcomer reads. The replay's output is written to `replay.log` in the folder this demo made,
+// and restored when the replay ends, so everything below prints as before. A failure is not lost: it is
+// collected here and reported after the list.
+const replayLog = join(flag("--pool") ? poolRoot : demoBase, "replay.log");
+const toLog = (chunk, encoding, cb) => {
+  try { appendFileSync(replayLog, chunk, typeof encoding === "string" ? encoding : undefined); } catch { /* a log that cannot be written must not stop the replay */ }
+  if (typeof encoding === "function") encoding(); else if (typeof cb === "function") cb();
+  return true;
+};
+const screen = { out: process.stdout.write, err: process.stderr.write };
+process.stdout.write = toLog;
+process.stderr.write = toLog;
+try {
+  for (const s0 of samples) {
+    try {
+      // poolUrl "" on purpose: the report's own link block is for a deployment that serves the pool at a
+      // public URL. This one is served from this process, at a port picked below.
+      results.push({ ...s0, published: await republishRun({ runId: s0.meta.runId, meta: s0.meta, pool: poolRoot, poolUrl: "", runDir: join(s0.publishFrom, "run") }) });
+    } catch (e) {
+      failures.push({ name: s0.name, why: String(e?.message ?? e) });
+    }
   }
+} finally {
+  process.stdout.write = screen.out;
+  process.stderr.write = screen.err;
 }
+// PUBLISHED, SO THE COPIES THEY WERE PUBLISHED FROM GO NOW, whatever comes next.
+releaseDemoCopies();
+for (const [sig, h] of stopEarly) process.off(sig, h);
 if (!results.length) {
   die(`demo: no demo could be replayed.`, "", ...failures.map((f) => `  ${f.name}: ${f.why}`));
 }
 const published = results[0].published;
 
-// THE LABEL. The reader is about to look at a document that reads like advice about a real mark. It is
-// not, and the demo says so before the browser opens rather than in a footnote nobody reaches.
-console.log("  Real engine output for the fictional mark VENQORI, captured against Clarivate Compumark.");
-console.log("  Replaying it needs no account, no key and no network.");
-console.log("  Every number, band and citation below was produced by that real run and is being");
-console.log("  re-rendered from its artifacts. It is an example, not advice.\n");
 // NAMES THE POPULATION. This printed "13 finding(s)" beside a report showing
 // twelve, in the first sentence a reader meets. The number is not wrong — it comes from the audit
 // spine (`driver/publish/audit-from-spine.mjs`, `counts.findings`), which counts every finding the run
@@ -296,10 +328,8 @@ console.log("  re-rendered from its artifacts. It is an example, not advice.\n")
 // EACH LANE'S PUBLISHER REPORTS ITS OWN NUMBER, AND THEY ARE NOT THE SAME NUMBER.
 //
 // The clearance branch returns `counts.findings` — every finding in the run's audit spine. The knockout
-// branch returns no `counts` at all; it returns `receipts`, whose `findings` counts the findings whose
-// citations the publisher traced to the run's own held evidence. That is a subset by definition, so it
-// is printed in its own words rather than mapped onto the clearance sentence. They happen to agree on
-// the demo in this tree, which is one member of a class and proves nothing about the metric.
+// branch returns no `counts` at all; it returns the names it screened and the rating each was given, so
+// its line states those rather than a count mapped onto the clearance sentence.
 //
 // The third branch is the point: a lane whose publisher reports no count says so. This line printed a
 // bare "?" to the knockout — a could-not-look wearing the costume of a number.
@@ -311,9 +341,13 @@ const spineOf = (pub) =>
   Number.isFinite(pub.counts?.findings)
     ? `${pub.counts.findings} finding(s) recorded in the run's audit trail; the report shows
              the ones it retains`
-    : Number.isFinite(pub.receipts?.findings)
-      ? `${pub.receipts.findings} finding(s) with citations traced to this run's own held
-             evidence, on ${pub.receipts.citing}/${pub.receipts.marks} mark(s)`
+    // A KNOCKOUT STATES WHAT IT SCREENED AND HOW EACH NAME WAS RATED, in the words its own report opens
+    // with ("One name screened: VENQORI, rated Low."). It used to count citations traced to held evidence,
+    // which a knockout's register-only findings never carry, so the line read "0 finding(s)" and a stranger
+    // took it as "the demo found nothing". Chosen 2026-09-19.
+    : Array.isArray(pub.reports) && pub.reports.length
+      ? `${pub.reports.length} name${pub.reports.length === 1 ? "" : "s"} screened: ${pub.reports
+        .map((r) => (r.band ? `${r.mark}, rated ${r.band}` : r.mark)).join("; ")}; the report shows why`
       : `this lane's publisher reported no finding count — the report itself is the record`;
 for (const r of results) console.log(`  published: ${r.published.runId}\n             ${r.name} — ${spineOf(r.published)}`);
 // "ONE PER PRODUCT" ONLY WHEN IT IS TRUE: with a sample missing, the count below says how many of how many.
@@ -407,6 +441,10 @@ console.log("");
 // made, it starts from here as before.
 const programRoot = ensureDemoProgram({ base: demoBase, say: (line) => console.log(line) });
 const startFrom = programRoot ?? REPO;
+// The services inherit the demo's Node flag through NODE_OPTIONS, so none of them prints the SQLite warning
+// either. Set on this process's own environment, which both branches below hand on; the reader's own
+// NODE_OPTIONS is kept.
+process.env.NODE_OPTIONS = withWarningOff(process.env.NODE_OPTIONS);
 const child = spawn(process.execPath, [join(startFrom, "bin", "start.mjs"), ...startArgs], {
   cwd: startFrom, stdio: ["ignore", "inherit", "inherit"],
   env: programRoot ? demoProgramEnv(process.env) : process.env,

package/bin/onboard.mjs

@@ -3344,8 +3344,22 @@ export async function runCheck() {
         sock.once("error", (e) => done(e.code === "ECONNREFUSED" ? false : null));
       });
     } catch { /* stays null — nobody could ask */ }
+    // WHOSE LISTENER. Only this install's own evidence counts: its unit running (which binds this very
+    // port), or a live start of this install whose record names the port. Anything else on the port is
+    // somebody's process, and on a shared box usually another account's door.
+    let doorOwnListener = null;
+    if (doorListening === true) {
+      if (doorActive === true) doorOwnListener = true;
+      else {
+        try {
+          const { clientDoorPort: portOf } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
+          const { readRunning } = await import(pathToFileURL(join(REPO, "shared", "running-start.mjs")).href);
+          if (readRunning().some((r) => r?.ports?.client === portOf(doorEnv))) doorOwnListener = true;
+        } catch { /* stays null — an unread record is not a claim either way */ }
+      }
+    }
     const door = doorState({ env: doorEnv, unitDir, exists: existsSync, active: doorActive,
-      listening: doorListening, activeState: doorActiveState, subState: doorSubState });
+      listening: doorListening, ownListener: doorOwnListener, activeState: doorActiveState, subState: doorSubState });
     // EVERY COMMAND THROUGH `invoke`. Doctor's own guard runs every command doctor
     // prints from a directory that is not the install; a literal `clearotron start` in that text is
     // `command not found` for a reader with no shim, and the guard caught exactly that the moment this
@@ -4272,7 +4286,7 @@ try {
   // Enter yield the empty string, `present("")` is false, and askValue loops with "A value is needed
   // here." — so a reader taking the header at its word ("Enter takes the default in brackets") on the
   // one prompt that advertises empty as an answer could not leave it. Driven on the merged tree:
-  // 60 enters, killed at the cap, every cycle this prompt. Same defect class as 's
+  // 60 enters, killed at the cap, every cycle this prompt. Same defect class as the
   // engine-menu loop, arriving one commit after it was fixed, in a prompt this branch's own sibling
   // added.
   //

package/bin/start.mjs

@@ -1610,9 +1610,12 @@ if (isMain) {
     // — `clearotron demo` hands over to this — so fixing the player alone left the defect where it was.
     // ONE SAMPLE AT A TIME: one whose files cannot be read is left out and named below, and the others
     // seed. Copied in one call, a single unreadable file emptied the whole archive.
-    const { publishContainer, seedDemoRuns } = await import("../driver/demo-container.mjs");
+    const { publishContainer, seedDemoRuns, releaseDemoCopies } = await import("../driver/demo-container.mjs");
     const container = publishContainer(join(REPO, "demo"), { repoRoot: REPO });
-    const seed = await seedPool({ pool: paths.pool, examplesDir: container.dir, republish: republishRun });
+    let seed;
+    // THE COPY GOES AS SOON AS THE POOL IS SEEDED FROM IT, and on the way out if seeding throws.
+    try { seed = await seedPool({ pool: paths.pool, examplesDir: container.dir, republish: republishRun }); }
+    finally { releaseDemoCopies(); }
     // AND AS RUNS, so the assistant this demo's connect line wires has them to list, brief and open. Under
     // the demo's own workspace only: nothing of it reaches an install started afterwards. Their report
     // links are stamped with this portal's address, the one the Open line prints.
@@ -2565,7 +2568,7 @@ if (isMain) {
   // THE HEADINGS COME WITH THE PAIR, from the composer. Nothing is written here: the page prints these
   // same two words above these same two commands, and a second author is how the two surfaces drift.
   if (connect.variants) {
-    for (const v of connect.variants) { say(`    ${v.heading}`); say(`      ${v.text}`); say(""); }
+    for (const v of connect.variants) { say(`    ${v.heading}`); say(`      ${v.text}`); if (v.hint) say(`      ${v.hint}`); say(""); }
   } else {
     say(`    ${connect.command}`);
     say("");

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "92dc979bd176adeedc0dbe2518fbf24388bc6072",
-  "version": "0.3.2-beta.12"
+  "commit": "94613f865f0ca4af3a17122f5d51cbfb7615f738",
+  "version": "0.3.2-beta.14"
 }

package/docs/CLIENT-MCP.md

@@ -46,10 +46,10 @@ uses). Enrolment is therefore the portal's: no second credential to mint, rotate
 access revokes this with it. **Off unless `CLIENT_MCP_ACCOUNT_ACCESS=1`.**
 
 **Who turns that on. The installer, since 2026-09-03** — ruling, settled
-point 2. `render-units.mjs --apply` and `npx clearotron start --background` both write the settings this
+point 2. `render-units.mjs --apply` and `clearotron start --background` both write the settings this
 door refuses to start without and then place and enable `clearotron-client-mcp.service`. The settings
 come from one authority, `enablePlan` in `shared/client-door.mjs`, which is also what
-`npx clearotron connect` calls.
+`clearotron connect` calls.
 
 **This supersedes the 2026-08-31 ruling** *"On demand is fine"*, under which nothing at install and no
 rebuild's enable list could start this unit, because starting it WAS the consent that opened
@@ -57,10 +57,10 @@ access for each company's people. The owner changed the posture knowingly: **the
 gate, not whether a process runs.** A door with no key issued refuses everything, which is the same
 protection by a mechanism that does not depend on a reader finding a verb.
 
-**`npx clearotron disconnect` therefore revokes a person, not a service** (Q3). It writes the caller's key
+**`clearotron disconnect` therefore revokes a person, not a service** (Q3). It writes the caller's key
 ids to the denylist and strikes them from the record; it does not stop the unit and does not touch
 `CLIENT_MCP_ACCOUNT_ACCESS`, which is the whole install's setting. Cutting everyone off is
-`npx clearotron disconnect --everyone`, which states how many keys and how many people that is before
+`clearotron disconnect --everyone`, which states how many keys and how many people that is before
 acting — and does not stop the service either.
 
 An `account` principal reaches **eighteen** tools, for its own companies only — everything carrying
@@ -117,8 +117,8 @@ Four things about it are worth knowing before you offer it:
 - **The caller cannot choose the model.** The tier is cost and method both, and it is the one argument on
   the one tool that spends. Express the change with `instructions`.
 - **Nothing bounds the spend, by ruling.** `start_run` is stamped `clientPrincipal: true` at the
-  chokepoint so `runCaps.dailyRuns` bites it; a what-if job carries no such stamp, because the owner
-  ruled spend controls out ("ignore the call spend"). Every experiment records what it spent; no door
+  chokepoint so `runCaps.dailyRuns` bites it; a what-if job carries no such stamp, because spend controls
+  were deliberately left out of it. Every experiment records what it spent; no door
   refuses the next one. Concurrency IS bounded — `CLEAROTRON_WHATIF_MAX_CONCURRENT`, default 1 — because
   letting a free experiment occupy the box while a paid clearance waits is a different question from
   spend, and the ruling did not touch it.

package/docs/DELIVERY.md

@@ -284,12 +284,12 @@ So the checks that run are exactly those whose whole input is model-authored tex
 **permission-prose**, **scope-numbers-in-prose**, **counting-consistency**,
 **wipo-designation-language**, **prescription-prose**. Every other clearance check is listed in the
 receipt under `notApplicable` with the reason its input does not exist here
-(`KNOCKOUT_ABSENT_BY_DESIGN` in `driver/predelivery-lint.mjs`). That is a third state (/),
+(`KNOCKOUT_ABSENT_BY_DESIGN` in `driver/predelivery-lint.mjs`). That is a third state,
 and it is the point: a check that cannot apply is recorded as absent, never as a silent pass, and
 never as a `pass:false` that would project to the lawyer as a defect.
 
-**Why the lane cannot simply skip the lint.** The lint receipt IS the workbook's QC record
-(/), so a lane that writes no`_driver/predelivery-lint.json` produces an *empty* QC record
+**Why the lane cannot simply skip the lint.** The lint receipt IS the workbook's QC record,
+so a lane that writes no`_driver/predelivery-lint.json` produces an *empty* QC record
 rather than a deliberately-absent one — and an empty record reads as "not evaluated", never
 "passed". And since recorded defects reach the reviewing lawyer only through the projected
 machine-check sheet on the audit workbook, a lane with nothing to project is a lane whose

package/docs/ONBOARDING.md

@@ -21,7 +21,7 @@ installer.
 ## The command
 
 ```
-npx clearotron brandowner add <key> --name "<legal name>" [options]
+clearotron brandowner add <key> --name "<legal name>" [options]
 ```
 
 `<key>` is the bundle's filename and its identity everywhere else. It is validated on the way in, so a

package/docs/PORTAL.md

@@ -99,7 +99,7 @@ There were two ways in and only one of them proved anything: the auth-proxy edge
 and handed every caller the same synthetic address. **Both switches are deleted**, along with
 `PORTAL_DEV_EMAIL`. Local mode replaces them with a real sign-in.
 
-**Use `npx clearotron start`.** It is the documented way to run this product on one machine
+**Use `clearotron start`.** It is the documented way to run this product on one machine
 ([INSTALL.md](../INSTALL.md) §6) and it assembles everything below for you: the portal, the MCP face the Start button
 calls, a minted ops key, the grants file, the saved-search store and the data-plane paths — one command,
 one URL, `Ctrl-C` stops both processes. Nothing here needs an `*_AUTH_DISABLED` variable, and the
@@ -143,7 +143,7 @@ its dev bypass to provide that**:`TRADEMARK_MCP_AUTH_MODE=token` runs it with a
 access key and no auth proxy — loopback only, and refused outright alongside
 `TRADEMARK_MCP_AUTH_DISABLED`, which authenticates nobody. Mint the key with
 `mint-token.mjs --scope ops --sub portal --verbs start_run,stop_run --accounts foxglade`, or let
-`npx clearotron start` mint one in memory at every start and never write it down.
+`clearotron start` mint one in memory at every start and never write it down.
 
 ## Putting your own login provider in front
 
@@ -177,7 +177,7 @@ the model.
 1. Put the proxy in front of the portal's port and make it require sign-in. The portal must not be
    reachable except through it — an origin anyone can reach directly is an origin with no door.
 2. Set `PORTAL_AUTH_MODE=auth-proxy` and the four values above in `.env`.
-3. `npx clearotron doctor` — the **Portal door** section reports which door is configured and which of
+3. `clearotron doctor` — the **Portal door** section reports which door is configured and which of
    the four values are present, by name. It never prints their values.
 4. Sign in through the proxy once and confirm the portal shows your address rather than a passphrase
    box.

package/docs/RELEASES.md

@@ -16,7 +16,7 @@ npm install -g clearotron@beta     # newest — cut when there is something wort
 | | `latest` (stable) | `beta` |
 |---|---|---|
 | **Version looks like** | `0.2.0` | `0.2.1-beta.4` |
-| **Cut when** | a beta has passed a full clearance run and a from-scratch install by somebody who has never seen the product, and the owner says go | when a change lands that is worth testing, or while a stable is being prepared |
+| **Cut when** | a beta has passed a full clearance run and a from-scratch install by somebody who has never seen the product, and the maintainers decide to ship it | when a change lands that is worth testing, or while a stable is being prepared |
 | **Promises** | it installed and ran a real clearance end to end before it was published | it built, and the automated suite passed |
 | **Use it if** | you are running this for real work | you want a fix that landed today, or you are helping test |
 

package/docs/SECURITY.md

@@ -123,7 +123,7 @@ what the mechanism guarantees.*
 - One OPERATOR issuance path: `mint-token.mjs` (prints once, stores nothing; `sub` names the
   principal in every audit line; the `jti` printed at mint time is the revocation handle). Two
   automatic minters sit beside it on the same `mintToken`: the clearance publisher mints the report
-  link's run-bound `user` token at publish, and `npx clearotron start` mints the portal's verb-scoped,
+  link's run-bound `user` token at publish, and `clearotron start` mints the portal's verb-scoped,
   company-capped ops token in memory at every start. Neither prints, and neither is written down.
 - **Revocation**: denylist file checked on every verification; missing file = nothing revoked (the
   denylist can never take all auth down). **Rotation**: two-secret window, flag-day-free.

package/docs/architecture/04-configuration-reference.md

@@ -176,11 +176,11 @@ timeout shot, warm patch, backoff), the lane-wedge re-dispatch, and the rate-lim
 |---|---|---|
 | `CLEAROTRON_AI` | `anthropic-agent` (default) \| `openai-agent` | Compute engine (a registered provider adapter). `anthropic-agent` = `claude -p`; `openai-agent` = `codex exec` (both off-gateway, same normalized contract). An **unregistered** value — a typo, or the gateway-runtime adapter removed in the extraction — **fails loud**: no silent wrong-provider run. Production default is unchanged. |
 | `CLEAROTRON_AI_BILLING` | `subscription` (default) \| `api-key` \| `cloud` | Billing mode for the selected engine. ONE variable for both, and only the LIVE engine's setting is read — it fills each engine's billing knob, and the engine that is not selected is never consulted. **`anthropic-agent`:** subscription **deletes `ANTHROPIC_API_KEY` from the child env** so `claude -p` uses OAuth subscription credentials (a present key would override them); `api-key` keeps the key — the scale setting and standing fallback; **`cloud`** bills Claude per use through the reader's own cloud account, named by the Claude program's own switch — `CLAUDE_CODE_USE_VERTEX`, `CLAUDE_CODE_USE_FOUNDRY` or `CLAUDE_CODE_USE_BEDROCK`, or `ANTHROPIC_BASE_URL` alone for a gateway (see the credentials table below) — and deletes `ANTHROPIC_API_KEY` as subscription does. **`openai-agent`:** subscription seeds `auth.json` into the per-run `CODEX_HOME` from `CLEAROTRON_OPENAI_AUTH_FILE` (default `~/.codex/auth.json`) and strips API keys; `api-key` keeps `CODEX_API_KEY`; `cloud` is refused. **Fail-loud, never a guess, never the subscription in its place:** `api-key` with no `ANTHROPIC_API_KEY` / `CODEX_API_KEY` throws; on `anthropic-agent`, `cloud` with two switches on, or with none and no `ANTHROPIC_BASE_URL`, throws, and so does a switch left on under `subscription` or `api-key`, because the program bills that cloud whatever this says; a value that is none of the three throws on both engines. `clearotron start` and `clearotron doctor` report each refusal against the settings the services read, naming a value that is not a billing mode by its setting and never quoting it, and the runner refuses the search when it is ordered, before anything is spent. The resolved mode is stamped on every stage telemetry row (`engine`, `authMode`, `apiBilled`, and `cloud`, null when no cloud bills), and the attempt row also carries `providerReported`, the program's own word for who served the turn. |
-| `CLEAROTRON_CLAUDE_PATH` · `CLEAROTRON_CODEX_PATH` | `claude` / `codex` on `PATH`, then the copy Clearotron installed | The engine binary to spawn, ONE PER ENGINE: `CLEAROTRON_CLAUDE_PATH` under `anthropic-agent`, `CLEAROTRON_CODEX_PATH` under `openai-agent`. Only the live engine's is read, and a machine that runs both sets both — they were one variable until it met a machine needing two different paths. A path set here must be **absolute**: stage subprocesses run with cwd set to the run directory, so a relative path does not resolve there, and `npx clearotron doctor` refuses one. **Unset**, or set to the bare word `claude` / `codex` (which means the same), the engine uses the program on `PATH` when the machine has one, and otherwise the copy Clearotron installed in `~/.local/share/clearotron/engines`: `clearotron install` offers to put the chosen engine's program there (`@anthropic-ai/claude-code` or `@openai/codex`, this platform's build only), and `clearotron update` refreshes it. Nothing is bundled into the package. A value naming anything else is used as given and never falls back. `clearotron doctor` says which copy it found, and its version when npm installed that copy. |
-| `CLEAROTRON_OPENAI_AUTH_FILE` | `~/.codex/auth.json` | The credentials file seeded into the per-run `CODEX_HOME` under subscription billing. Was exempted from the August 2026 rename as an `openai-agent` internal rather than an install-surface name; the owner's 2026-09-04 ruling **reversed that exemption** and renamed the whole namespace, so it carries the house prefix like everything else. One spelling, no exceptions. |
+| `CLEAROTRON_CLAUDE_PATH` · `CLEAROTRON_CODEX_PATH` | `claude` / `codex` on `PATH`, then the copy Clearotron installed | The engine binary to spawn, ONE PER ENGINE: `CLEAROTRON_CLAUDE_PATH` under `anthropic-agent`, `CLEAROTRON_CODEX_PATH` under `openai-agent`. Only the live engine's is read, and a machine that runs both sets both — they were one variable until it met a machine needing two different paths. A path set here must be **absolute**: stage subprocesses run with cwd set to the run directory, so a relative path does not resolve there, and `clearotron doctor` refuses one. **Unset**, or set to the bare word `claude` / `codex` (which means the same), the engine uses the program on `PATH` when the machine has one, and otherwise the copy Clearotron installed in `~/.local/share/clearotron/engines`: `clearotron install` offers to put the chosen engine's program there (`@anthropic-ai/claude-code` or `@openai/codex`, this platform's build only), and `clearotron update` refreshes it. Nothing is bundled into the package. A value naming anything else is used as given and never falls back. `clearotron doctor` says which copy it found, and its version when npm installed that copy. |
+| `CLEAROTRON_OPENAI_AUTH_FILE` | `~/.codex/auth.json` | The credentials file seeded into the per-run `CODEX_HOME` under subscription billing. Was exempted from the August 2026 rename as an `openai-agent` internal rather than an install-surface name; a decision of 2026-09-04 **reversed that exemption** and renamed the whole namespace, so it carries the house prefix like everything else. One spelling, no exceptions. |
 | `CLEAROTRON_OPENAI_MODEL_JUDGMENT` / `CLEAROTRON_OPENAI_MODEL_SWEEP` / `CLEAROTRON_OPENAI_MODEL_CHEAP` | `gpt-5.6-sol` / `gpt-5.6-terra` / `gpt-5.6-luna`. | Maps the driver's abstract `opus`/`sonnet`/`haiku` tiers onto the codex ladder, the way the anthropic engine maps onto its own (ruling 2026-09-02, superseding the single-model mapping). A tier that cannot hold its stage contract announces itself at that stage — `missing:negative-results`, `no_coverage_status_row`, `named_band_missing` in `_driver/<stage>.jsonl` — not at delivery. |
 | ↳ why they are three, and what the old measurement still says | superseded 2026-09-02, not erased | The three defaulted to `sol` alone on a MEASUREMENT, never a placeholder: on 2026-08-11/12, with `SWEEP=gpt-5.6-terra` / `CHEAP=gpt-5.6-luna`, every codex clearance died on structural-output gates — `missing:negative-results`, `no_coverage_status_row`, `named_band_missing` — over 2 scenarios × 3 stage families, **byte-identically on retry**, so no retry budget rescued it. That measurement stands for the code and the codex CLI **of that date**, and it is why the judgment tier keeps `sol`. Three weeks of stage-contract work and several codex minor versions sit between it and the 2026-09-02 ruling that split the three. **The symptom to match against this cause is unchanged**: those same three gates, as a fail row in`_driver/<stage>.jsonl`, inside the first few dispatches of a clearance and identical on every retry — a model incapable of a contract is not flaky at it. It reads as an engine bug when the only fault is this configuration. A cheap-tier experiment still belongs in the three constants in `driver/engine/openai-agent.mjs` where a reviewer sees it, not in an untraceable env line. |
-| `CLEAROTRON_DATABASE` | **REQUIRED — no default.** `corsearch` \| `clarivate` \| `signa` \| `euipo` \| `uspto-local` \| `free-tier` | Active register provider — one per run, set in the environment the deploy carries, in every environment including production. There is **no default**: unset resolves to `null` and every use of it throws, so a run refuses at start rather than calling a vendor nobody chose ( — the removed`corsearch` fallback named a vendor the deployment did not choose). Three are paid global sweeps; `euipo` (EU) and `uspto-local` (US) are free single-office sources, and `free-tier` composes those two as one register. Choosing a free value makes every territory outside its coverage a disclosed *deferred* row. Unknown ids throw loudly, and the gather layer throws at stage time for any provider without a built MCP server. |
+| `CLEAROTRON_DATABASE` | **REQUIRED — no default.** `corsearch` \| `clarivate` \| `signa` \| `euipo` \| `uspto-local` \| `free-tier` | Active register provider — one per run, set in the environment the deploy carries, in every environment including production. There is **no default**: unset resolves to `null` and every use of it throws, so a run refuses at start rather than calling a vendor nobody chose (the removed `corsearch` fallback named a vendor the deployment did not choose). Three are paid global sweeps; `euipo` (EU) and `uspto-local` (US) are free single-office sources, and `free-tier` composes those two as one register. Choosing a free value makes every territory outside its coverage a disclosed *deferred* row. Unknown ids throw loudly, and the gather layer throws at stage time for any provider without a built MCP server. |
 | `CLEAROTRON_CODEX_SANDBOX_BYPASS` | unset | `1` runs `codex exec` with its own sandbox helper bypassed, for hosts where that helper cannot spawn. It removes a defence: with it set, the run dir is writable by the seat and only the deny-hook stands between a stage and `_driver/`. Set it because the host forces it, never for convenience. |
 
 ## Environment variable reference
@@ -225,7 +225,7 @@ deployment may override (verify live values per deployment).
 | `CLEAROTRON_RUN_LOCK_POLL_MS` | 15000 | Run-slot acquire poll cadence. |
 | `CLEAROTRON_ADMISSION_BUDGET_MS` | 7200000 (2 h) | Runner stops claiming new jobs after this per activation; leftovers re-trigger a fresh activation. |
 | `CLEAROTRON_QUEUE_SCAN_MS` | 10000 (min 1000) | Mid-drain re-scan for newly arrived jobs. |
-| `CLEAROTRON_WHATIF_MAX_CONCURRENT` | 1 (min 1) | How many queued what-ifs the runner drains at once. Deliberately NOT a run-slot: an experiment that took one from `CLEAROTRON_MAX_CONCURRENT_RUNS` could block an admitted paid clearance rather than merely share the box with it. This is a concurrency bound and not a spend control — the owner ruled spend controls out when he opened what-if to each company's people (2026-08-27), and nothing here refuses the next experiment. |
+| `CLEAROTRON_WHATIF_MAX_CONCURRENT` | 1 (min 1) | How many queued what-ifs the runner drains at once. Deliberately NOT a run-slot: an experiment that took one from `CLEAROTRON_MAX_CONCURRENT_RUNS` could block an admitted paid clearance rather than merely share the box with it. This is a concurrency bound and not a spend control — spend controls were deliberately left out when what-if opened to each company's people (2026-08-27), and nothing here refuses the next experiment. |
 | `CLEAROTRON_STOP_GRACE_MS` | 60000 | Grace after first SIGTERM before exit(1). |
 | `CLEAROTRON_MAX_CLAIM_AGE_MS` | 172800000 (48 h; 0 disables) | Hard ceiling on a claim's age (from the `.pid` sidecar mtime) — beyond it, re-claim regardless of liveness. |
 | `CLEAROTRON_KNOCKOUT_VARIANT_CAP` | unset (⇒ the lane's own cap) | Ceiling on variants a knockout screens per name. Set only to bound an unusually wide batch; absent means the lane decides. |

package/docs/architecture/05-config-governance.md

@@ -97,7 +97,7 @@ product doc.
 | **Allowlist** (`{version, grants:[{email, customer}]}`) | T2 | git + PR on the `CLIENT_ACCESS_MAP` file | see §2 row 4 | LIVE, file-only; surfaced read-only at `admin.access` |
 | **Ops tokens** (scope ops/user, verbs, companies, TTL) | T4 | `mint-token.mjs` CLI; jti denylist file | operator-held tokens | LIVE, CLI |
 
-## 4b. The install surface names ()
+## 4b. The install surface names
 
 The variables a **user or installer** ever types carry the product’s own prefix. They are listed
 by name in §5 below and in the upgrade table in INSTALL.md.
@@ -123,14 +123,14 @@ has taken it.
 
 **`CLEAROTRON_JX_LANES` was held back from the August 2026 rename** — it was RETIRED 2026-07-27
 (`pipeline.mjs` `RETIRED_ENV`, `jx-units.mjs`) and nothing reads it, so renaming a dead name looked like
-handing an operator a name that warns about nothing. The owner's 2026-09-04 ruling reversed that: the
+handing an operator a name that warns about nothing. A decision of 2026-09-04 reversed that: the
 whole namespace carries one prefix, dead names included, because a tree spelled two ways costs more
 than a retired row spelled consistently. The per-lane `CLEAROTRON_NATIVE_LANGUAGE_<code>` switch in the same row **is** live and is
-fail-OPEN: unset means ON (§5.5,).
+fail-OPEN: unset means ON (§5.5).
 
 Variables outside the install surface were left alone by the August rename — `CLEAROTRON_ENGINE_MAX_BUFFER`
-and its siblings were never in that window. **That separate decision was taken on 2026-09-04**: the owner
-ruled the rename global and pre-cut, so the internals carry the house prefix too and the public tree never
+and its siblings were never in that window. **That separate decision was taken on 2026-09-04**: the rename
+became global and pre-cut, so the internals carry the house prefix too and the public tree never
 shows the old namespace. No compatibility layer, no alias reading, no migration — greenfield, and our own
 boxes rebuild.
 
@@ -207,10 +207,10 @@ move once the same window has been read across more runs.
 `CLEAROTRON_BAND_TRUTH_GATE` (**never disable in prod — restores the fabrication**),
 `CLEAROTRON_FRAME_REOPEN` (+`CLEAROTRON_FRAME_REOPEN_MAX`=1, `CLEAROTRON_REOPEN_MAX_FETCH`=150),
 `CLEAROTRON_REGISTER_GAP_CLAMP`, `CLEAROTRON_RECALL_PROBES`, `CLEAROTRON_RECALL_TRIPWIRE`, `CLEAROTRON_WARM_RETRY`,
-`CLEAROTRON_MODEL_WIRE_CHECK` ( — fails a turn whose
+`CLEAROTRON_MODEL_WIRE_CHECK` (fails a turn whose
 provider reports a different model FAMILY than the driver asked for; disarming it silences the refusal
 and never the record: `modelActual`/`modelMismatch` keep landing on every dispatch row), `CLEAROTRON_FORM_REPAIR`
-( — repairs a form-class stage failure inside the dispatch, up to twice; disarmed, the defect
+(repairs a form-class stage failure inside the dispatch, up to twice; disarmed, the defect
 falls through to the retry ladder exactly as it did before, visibly, and is never swallowed as
 "validated fine"). Policy knob: `CLEAROTRON_UNREACHABLE_SENIOR`
 (open-item|clamp). Enumerate: `CLEAROTRON_ENUMERATE_CEILING` (600/OR-stack),
@@ -359,7 +359,7 @@ systemd, writes no heartbeat, and must keep saying "waiting to start" rather tha
 repo** — `git grep process.env.CLIENT_ACCESS` here returns nothing, so they are governed here and
 never appear in the audit).
 
-**Which identity source the portal runs () — T4, and it is chosen by name, never inferred.**
+**Which identity source the portal runs — T4, and it is chosen by name, never inferred.**
 `PORTAL_AUTH_MODE` selects the door: unset or `auth-proxy` (the default for a hosted deployment) means
 any login system in front that authenticates in the browser and forwards a verifiable JWT per request.
 **Any OIDC or JWT proxy is a choice per deployment** — for example Cloudflare Access, which is not a
@@ -367,7 +367,7 @@ special case in the code; `local` means one address and one passphrase on loopba
 exactly the same thing** — normalised where the mode is read rather than by an alias row, because
 `shared/env-aliases.mjs` maps variable NAMES and there is no value-alias mechanism.
 
-**Bringing your own login provider ( item 1, completed by) — T4.**`PORTAL_OIDC_ISSUER`,
+**Bringing your own login provider — T4.**`PORTAL_OIDC_ISSUER`,
 `PORTAL_JWKS_URL`, `PORTAL_EMAIL_CLAIM` and `PORTAL_AUTH_HEADER` are the portal-side spelling of the four
 values the staff MCP face already reads as `TRADEMARK_MCP_OIDC_ISSUER`, `TRADEMARK_MCP_JWKS_URL`,
 `TRADEMARK_MCP_EMAIL_CLAIM` and `TRADEMARK_MCP_AUTH_HEADER`. `makeAccessVerifier` has always accepted them; the portal
@@ -432,7 +432,7 @@ synthetic identity would answer before the mandatory key ever ran. The mode is l
 travels in a header or the query string), requires `TRADEMARK_MCP_ALLOWED_HOSTS` exactly as the
 authenticated door does, and mirrors its mandatory `CLEAROTRON_ACCESS_FILE`.
 
-**The local install sets all of the above itself.**`npx clearotron start` (`bin/start.mjs`) is a supervisor:
+**The local install sets all of the above itself.**`clearotron start` (`bin/start.mjs`) is a supervisor:
 it resolves one set of ports, derives `PORTAL_MCP_URL` and `TRADEMARK_MCP_ALLOWED_HOSTS` from them, mints
 the ops key in memory, and hands each child an explicit environment carrying `CLEAROTRON_NO_ENV_FILE=1`. So
 exactly one process in that tree reads `<repo>/.env` — the supervisor — and nothing a laptop runs needs

package/docs/architecture/06-operations-runbook.md

@@ -73,7 +73,7 @@ properties below, each of which was learned the expensive way:
    mid-run feeds one expensive run two different skill versions. **Call
    check that nothing is in flight and abort if anything is** — read every queue this
    deployment would drain plus the run-slot locks, and refuse on any of them. `--override
-   "<reason>"` is the owner-ordered exception; the reason is printed into the deploy output, and a
+   "<reason>"` is the operator's deliberate exception; the reason is printed into the deploy output, and a
    blank one exits 2 rather than passing. This step used to be a line of prose asking a human to
    check, which is not a guard on the night it matters. Then **stop the four trigger units** for
    the deploy window and install an **EXIT trap that restarts them on every exit path**, success or
@@ -184,7 +184,7 @@ rather than stage compute. That gateway is no longer part of the product, so the
 to probe and the file went with them. Nothing invoked it: not `package.json`, not `bin/`, not
 `scripts/`, not a unit, not CI. It was run by hand, and it spent real money when it was.
 
-What replaces each half: the free path check is `npx clearotron doctor` plus the runner's own preflights
+What replaces each half: the free path check is `clearotron doctor` plus the runner's own preflights
 (`preflightEngineBinary`, `preflightCredentials`, `preflightDeploymentUrls`), each of which refuses by
 name before a run dir exists. The billable half has no replacement and needs none — stage compute is
 exercised by real runs and the A/B harness, which is what its own note already said.
@@ -289,7 +289,7 @@ Copy it, point `CLEAROTRON_ACCESS_FILE` at your copy, sign in as one of its addr
 exactly that organisation's companies. Then delete it and write your own — it names nobody real, which also
 means it grants nothing you have.
 
-`npx clearotron start` (§6) writes an empty roster (`{"tenants": {}}`) into its state directory: your own staff
+`clearotron start` (§6) writes an empty roster (`{"tenants": {}}`) into its state directory: your own staff
 address is admitted, nobody else is enrolled, and enforcement is already on.
 
 ### Ops tokens — a credential for the verbs that spend

package/docs/architecture/07-quality-and-audit.md

@@ -269,7 +269,7 @@ write nothing and 7 that do:
   `what_if_run` → one sandboxed stage; `what_if_result` → collect a queued one) — **executing** is
   local stdio only, never remote, for any principal. The confirmation token is a deliberate-action
   handshake, not a crypto boundary; the security boundary is ops scope + local-only execution.
-  Since the owner's 2026-08-27 ruling an `account` principal reaches all three, and `what_if_run` on that
+  Since 2026-08-27 an `account` principal reaches all three, and `what_if_run` on that
   path ENQUEUES into `<runDir>/_experiments/_queue/` rather than shelling — `driver/whatif-worker.mjs`,
   drained by the runner, is what spawns the sandbox. Because the token is unsigned, a call on that path must
   also name its `runId` so the grant check fires, and the enqueue refuses a token naming another run.

package/docs/architecture/08-development-guide.md

@@ -88,7 +88,7 @@ These are the things a well-meaning refactor breaks. Each is enforced somewhere;
 
 Mechanically a config change ([04](04-configuration-reference.md#model-tiers-and-resolution)); two
 traps and one law. Traps: an alias not registered in the engine's model map now **refuses the
-dispatch by name** ( — it used to run sonnet silently and log the alias you asked for, which is
+dispatch by name** (it used to run sonnet silently and log the alias you asked for, which is
 the `fable` lesson turned into an error), and `CLEAROTRON_SYNTHESIS_MODEL` is read at module load (fine
 for the oneshot service, stale in long-lived processes). The law: any grade-moving
 change — family, effort, tier remap — ships only through the paid A/B against the reference
@@ -221,7 +221,7 @@ Four realities to respect:
 
 - **Exclusion is by filename convention only.** Anything named `*.test.mjs` runs in CI; billable or
   manual harnesses must not match the glob (historical one-off proofs with hard-coded dev paths are
-  not kept; the last billable hand-run harness, `selftest.mjs`, was deleted at).
+  not kept; the last billable hand-run harness, `selftest.mjs`, was deleted).
 - **The `||=` env guards leak**: a shell exporting a real register credential or
   `CLEAROTRON_PLAN_DISPATCH=on` is *not* overridden by the harness — run the suite in a clean env.
   (CI is safe.)

package/docs/architecture/09-security-and-data.md

@@ -83,7 +83,7 @@ are no root units; everything is `systemd --user`.
     are stripped), and **`account`** (a signed-in person on the client face — the runs of the
     companies they are granted, reached either by the CF sign-in with no token, or by a per-person API
     key, `scope: account`, whose companies are re-read from the grants file on every request rather than
-    baked into it. Wider *reach* than a report link and, since the owner's 2026-08-27 ruling, more
+    baked into it. Wider *reach* than a report link and, since a decision of 2026-08-27, more
     *depth* too: the audit chain — the audit trail, the reasoning narrative, the record artifacts, a
     register axis, and the `get_run` / `trace` / `decision_timeline` decision walk. Model identity
     and billed counts stay sealed (`get_telemetry`, `get_provider_usage`), as does the reviewers'