clearotron 0.3.2-beta.6 → 0.3.2-beta.8

package/providers/jx/README.md

@@ -9,7 +9,8 @@ validated at parse.
 **One vendor, one billing mode, decided by the run and not by this directory.** The lanes go through
 `engine.runTurn()` — the same door all fourteen agentic stages use — via
 [`../../driver/engine/jx-turn.mjs`](../../driver/engine/jx-turn.mjs). Whatever program the customer configured
-(`CLEAROTRON_AI`) and whatever billing mode the run is on (API key or subscription) carries these calls too.
+(`CLEAROTRON_AI`) and whatever billing mode the run is on (subscription, API key or, for Claude, a cloud account)
+carries these calls too.
 That is the owner's standing rule — *one LLM provider only ever, API or auth, no mix* — and until 2026-08-20
 these three lanes were the one place in the product that broke it: they POSTed to the Anthropic Messages API on
 `ANTHROPIC_API_KEY` at a hardcoded cheap tier no matter what the rest of the run was doing.

package/providers/jx/src/turn-envelope.mjs

@@ -106,15 +106,20 @@ export function envelopeFromTurnText(text, toolName) {
  * so the ORDER of those checks lives here once rather than three times.
  *
  * `turn` is supplied by the driver and is injectable for tests:
- *   async ({prompt, kind}) => { ok, text, truncated, usage:{input,output}, model, vendor, authMode, cause }
+ *   async ({prompt, kind}) => { ok, text, truncated, usage:{input,output}, model, vendor, authMode, cloud, cause }
  *
  * ATTRIBUTION RIDES EVERY RETURN, including the failures. A degrade still spent tokens, and without the
  * model, vendor and billing mode beside them they cannot be attributed in the run's rollup — which is
  * the half of that says a run must be able to state who did the work.
+ *
+ * `cloud` is part of that attribution: under the cloud billing mode it names the account that paid
+ * ("foundry", "vertex", "bedrock", "gateway"), and it is null under every other mode. The ledger stamp
+ * reads it from THIS return, so a field left off here reached every native-language record as
+ * `cloud: null` while the main steps of the same run said which cloud paid.
  */
 export async function runJxTurn({ body, turn, kind, started, truncatedCause, parse }) {
   const t0 = Number.isFinite(started) ? started : Date.now();
-  const blank = { tookMs: 0, model: null, vendor: null, authMode: null, usage: null };
+  const blank = { tookMs: 0, model: null, vendor: null, authMode: null, cloud: null, usage: null };
   if (typeof turn !== "function") return { ok: false, cause: `${kind}: no turn runner was supplied`, ...blank };
 
   const { prompt, toolName } = promptFromRequest(body);
@@ -124,7 +129,7 @@ export async function runJxTurn({ body, turn, kind, started, truncatedCause, par
 
   const attribution = {
     tookMs: Date.now() - t0,
-    model: r?.model ?? null, vendor: r?.vendor ?? null, authMode: r?.authMode ?? null,
+    model: r?.model ?? null, vendor: r?.vendor ?? null, authMode: r?.authMode ?? null, cloud: r?.cloud ?? null,
     // Passed through WHOLE, and `null` stays null. The driver hands over the engine contract's canonical
     // Usage ({input, output, cacheRead, cacheWrite, total}); re-shaping it to two fields here would drop
     // cache and total tokens from the rollup, and a zeroed object in place of null would report a

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,13 @@
 # trademark-oauth-mcp-bridge
 
+## 0.3.2-beta.8
+
+No changes in this release.
+
+## 0.3.2-beta.7
+
+No changes in this release.
+
 ## 0.3.2-beta.6
 
 No changes in this release.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.3.2-beta.6",
+  "version": "0.3.2-beta.8",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/providers/perplexity/src/core.js

@@ -523,9 +523,9 @@ export function reconcileGridLedger(stdoutStr, spec) {
  *
  * Why identity and not a count: the sandbox program TRANSCRIBES the dictated queries into its own source,
  * and a mutated string is a DIFFERENT SEARCH. The count stays right while the dictated query never ran, so
- * every count-based check upstream and downstream reads clean. Observed: the dictated
- * `提基斯拉什 offensive meaning` came back as `提基斯ラッシュ offensive meaning` — the katakana of the
- * sibling Japanese row fused into the Chinese transliteration. 27 dictated, 27 recorded, one never searched.
+ * every count-based check upstream and downstream reads clean. The substitution this catches fuses one
+ * row's script into another row's transliteration: the two strings differ, the dictated and recorded
+ * counts still match exactly, and one dictated query is never searched by anybody.
  *
  * A query that THREW and said so is not this defect — it owns a gap row (`<query> | connotation | <error>`,
  * or the reconciled object form) and the driver's merge gate weighs it separately. Only a silent

package/providers/signa/src/capabilities.js

@@ -34,7 +34,7 @@
 //     it beats a number that is right for one shape and wrong for the other. See
 //     OWNER_SCOPED_WINDOW below, which is the machine-readable half.
 //
-//     What IS observed about the total is separate: it saturates at 10000 and flags itself
+//     The total is a separate matter: it saturates at 10000 and flags itself
 //     approximate there — a fact about the count, not about the window.
 //
 // PURE: no node imports, no vendor HTTP.
@@ -129,7 +129,7 @@ export const CAPABILITIES = Object.freeze({
   classFilter: "native",
   // Search rows already carry status / nice_classes / owner_name → screening is inline, zero extra calls.
   screenSource: "search-row",
-  // No documented or observed hard result ceiling, and no total to compare one against.
+  // No hard result ceiling, and no total to compare one against.
   resultCeiling: null,
 
   // ── the predicates, and WHICH REQUEST SHAPE each one rides ──────────────────────────────────────
@@ -247,10 +247,9 @@ export const CAPABILITIES = Object.freeze({
   // `legacy_code`. asks for `code` to be primary, and it now is, in the one place it decides
   // anything: `SIGNA_OFFICE_CODES` is what a reader and a future translate() should reach for.
   //
-  // THE MIGRATION IS NOT URGENT AND THE REASON IS MEASURED, not assumed. All eleven legacy keys were
-  // sent to the live wire beside their ISO codes, and every pair returned an identical
-  // total (cipo/CA 83, euipo/EM 80, inpi-fr/FR 19, ipau/AU 72, ipi/CH 46, ipos/SG 58, nipo/NO 42,
-  // prv/SE 22, ukipo/GB 96, uspto/US 169, wipo/WO 68). Nothing on the wire moves if `translate` keeps
+  // THE MIGRATION IS NOT URGENT, AND THE REASON IS A PROPERTY OF THE REGISTER rather than a guess:
+  // each legacy key and its ISO code address the same office, so the two spellings are interchangeable
+  // for every office this deployment reaches. Nothing on the wire moves if `translate` keeps
   // emitting keys, so it does — a vocabulary swap under the executor buys nothing and risks a live
   // office lookup.
   //

package/providers/signa/src/core.js

@@ -316,7 +316,7 @@ export function isSearchResponseBody(body) {
 // 21, 101, 18) and — the case that matters — an empty band answered `total_count: 0, approximate:
 // false`, an EXACT zero, which is the only kind this repository is allowed to render.
 //
-// Every approximate answer came back as exactly 10000: it is a saturation marker, not an estimate.
+// An approximate total of exactly 10000 is a saturation marker rather than an estimate.
 // The vendor is saying "at least ten thousand", and it says so on the broad sweeps (a bare owner
 // filter, `match: similar`, an unanchored `contains`) — precisely the bands a clearance cannot
 // enumerate anyway.

package/providers/uspto-local/README.md

@@ -155,7 +155,7 @@ what an index actually holds, including whether the 1884 backfile is in it (a da
 identical on every other number and is missing a century).
 
 This replaces only the *register* half of a clearance
-— the reasoning engine still needs its own subscription or API key, and the unregistered-use half
+— the reasoning engine still needs its own subscription, API key or cloud account, and the unregistered-use half
 still wants `PERPLEXITY_API_KEY`.
 
 **It refuses rather than answering zero.** An absent index, a schema with no rows, or an index whose

package/scripts/authority-boundary-probe.mjs

@@ -28,7 +28,7 @@ import { join } from "node:path";
 import { driverDir, ensureDriverDir } from "../shared/driver-dir.mjs";   // — one definition of where `_driver/` is
 import { tmpdir } from "node:os";
 import { buildClaudeArgs, spawnEnv } from "../driver/engine/anthropic-agent.mjs";
-import { envFrom } from "../shared/env-aliases.mjs";   // — resolves EITHER spelling; names the retired one because that is the live-writable half
+import { resolveEngineProgram } from "../driver/driver.config.mjs";   // — the program a run would spawn, found the way a run finds it
 
 const arg = (f, d) => { const i = process.argv.indexOf(f); return i > 0 ? process.argv[i + 1] : d; };
 const model = arg("--model", "claude-sonnet-5");
@@ -73,7 +73,9 @@ console.log(`probe root: ${root}`);
 console.log(`--add-dir roots: ${args.filter((a, i) => args[i - 1] === "--add-dir").join(", ")}`);
 console.log(`--settings present: ${args.includes("--settings")}`);
 
-const child = spawn(envFrom(process.env, "CLEAROTRON_CLAUDE_PATH") || "claude", [...args, "--include-hook-events"],
+// The program a run would spawn (driver.config.mjs resolveEngineProgram), so this probes the same copy.
+const program = resolveEngineProgram("anthropic-agent");
+const child = spawn(program.resolved ?? program.bin, [...args, "--include-hook-events"],
   { stdio: ["pipe", "pipe", "pipe"], cwd: runDir, env: spawnEnv() });
 let out = "", err = "";
 child.stdout.on("data", (d) => { out += d; });

package/scripts/env-audit.mjs

@@ -535,13 +535,18 @@ export function auditEnv(root = ROOT) {
 //                            roster, while ADR-0003 had already ruled case-law setup an OAuth flow
 //                            and not a variable at all. Evidence of a reader is not evidence of a
 //                            READ: the roster is a list of names to look for, not a call site.
-//                         4  the AZURE_OPENAI_* block, an external contract (below).
+//                         4  the AZURE_OPENAI_* block, then kept as an external contract. That call did
+//                            not hold: nothing the product runs read them, and the rows were removed
+//                            from `.env.example` on 2026-09-15 (below). They are no longer counted
+//                            among the wrong deletions.
 //                         1  CLEAROTRON_SEND_TOOL_PREFIX — genuinely dead, and this direction does not
 //                            catch it either: its one surviving mention is a governance-doc line, and
 //                            a mention is enough to spare a row. Under-firing is the cost of the
 //                            trade, taken deliberately. It is the prose-sweep class.
 //
-//                       So SIX of ten deletions would have been wrong, two of them credential rows.
+//                       So FOUR of ten deletions would have been wrong, the four live reads above,
+//                       one of them a credential row. (This said six until 2026-09-15; that count
+//                       did not follow from the rows as listed, and it included the Azure block.)
 //                       Evidence used instead: the bare NAME, on a name boundary, anywhere in the
 //                       tracked tree. The accessor family is filed as  and does NOT belong here —
 //                       see below.
@@ -561,10 +566,11 @@ export function auditEnv(root = ROOT) {
 // ── AND IT IS NOT A SUPPRESSION LIST ────────────────────────────────────────────────────────────
 //
 // forbids one, rightly: "if a row is deliberately readerless, the row goes, not the guard."
-// Applied literally that ruling deletes three rows it should not. `.env.example`'s Azure block
-// documents the variables an EXTERNAL agent platform consumes — the block says so itself, ruled
-// it, and `MODELS.azure` / `CLEAROTRON_AZURE_MODEL` / `jxPolicy.providerStance: "azure-only"` are live.
-// There is no reader in this tree and there never was one to retire.
+// Applied literally, that ruling deletes a row whose consumer is not this tree at all: a variable read
+// by a program the product spawns, such as the Claude program's own sign-in token. The row documents a
+// contract with that consumer, and there is no reader here to retire. (The four AZURE_OPENAI_* rows that
+// first raised this were a different case. They named another platform's settings, nothing the product
+// runs read them, and they were removed from `.env.example` on 2026-09-15.)
 //
 // So a row is ACCOUNTED FOR two ways, and this is one rule applied to every row rather than a list of
 // exempt names: something in the tree names it, OR the row carries an inline `# external:` line

package/scripts/freeze-example-run.mjs

@@ -29,9 +29,11 @@
 //   _driver/run.jsonl        the event log
 //   _driver/stage-inputs/    what each stage was handed
 //   _history/                pre-reopen snapshots
-// Dropping the telemetry drops `meta.tokens` (driver/publish/index.mjs:1136 rollupTokens — the only consumer of
-// rollupTokens). That is the one difference step 5 is told to expect, and it says so out loud rather than
-// normalising it away in silence.
+// Dropping the telemetry drops `meta.tokens` (driver/publish/index.mjs rollupTokens — the only consumer of
+// rollupTokens), and with it the record of which models served the run (servedModels in
+// driver/tokens.mjs): `servedModels` on meta.json and report-data.json, and the one line that closes the
+// report's footer. Those are the differences step 5 is told to expect, and it says so out loud rather
+// than normalising them away in silence.
 //
 // WHAT THIS SCRIPT DOES NOT DO
 // It does not decide the sample is publishable. It greps for the shapes that must never leave the VM
@@ -59,21 +61,21 @@ const FROZEN_FILES = [
   { path: "audit.md", why: "publish/index.mjs:1022 auditMd, the audit workbook source" },
   { path: "findings.json", why: "publish/index.mjs:715 readStore, the per-finding machine contract" },
   { path: "status.json", why: "publish/index.mjs:913 machineLedgerNote + markName" },
-  { path: "case-law-findings.md", why: "publish/index.mjs:849 clPath, the case-law section" },
-  { path: "common-law-grid.json", why: "publish/index.mjs:973 commonLawJoinedTerms, common-law coverage" },
+  { path: "case-law-findings.md", why: "publish/index.mjs:875 clPath, the case-law section" },
+  { path: "common-law-grid.json", why: "publish/index.mjs:1006 commonLawJoinedTerms, common-law coverage" },
   // publish/index.mjs — the _driver sidecars it reads by name
   { path: "_driver/receipts.json", why: "publish/index.mjs:761 fetchReceipts" },
   { path: "_driver/senior-rights.json", why: "publish/index.mjs:787 seniorRights" },
   { path: "_driver/verdict.json", why: "publish/index.mjs:792 verdictInfo" },
   { path: "_driver/framework.json", why: "publish/index.mjs, the frozen band vocabulary the run was rated under" },
-  { path: "_driver/register-plan.json", why: "publish/index.mjs:820 scopeBasis" },
-  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:821 searchedJurisdictions, the fallback for register-plan" },
-  { path: "_driver/enforcer-signals.json", why: "publish/index.mjs:861 esPath" },
-  { path: "_driver/predelivery-lint.json", why: "publish/index.mjs:170 lintSink" },
-  { path: "_driver/escalation-state.json", why: "publish/index.mjs:171 escSink" },
-  { path: "_driver/reasoning-integrity.json", why: "publish/index.mjs:898 integritySink" },
-  { path: "_driver/corrections-state.json", why: "publish/index.mjs:172 correctionsSink" },
-  { path: "_driver/search-policy.json", why: "publish/index.mjs:955 searchPolicy, level + stage label" },
+  { path: "_driver/register-plan.json", why: "publish/index.mjs:846 scopeBasis" },
+  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:847 searchedJurisdictions, the fallback for register-plan" },
+  { path: "_driver/enforcer-signals.json", why: "publish/index.mjs:887 esPath" },
+  { path: "_driver/predelivery-lint.json", why: "publish/index.mjs:172 lintSink" },
+  { path: "_driver/escalation-state.json", why: "publish/index.mjs:173 escSink" },
+  { path: "_driver/reasoning-integrity.json", why: "publish/index.mjs:924 integritySink" },
+  { path: "_driver/corrections-state.json", why: "publish/index.mjs:174 correctionsSink" },
+  { path: "_driver/search-policy.json", why: "publish/index.mjs:987 searchPolicy, level + stage label" },
   { path: "_driver/profile.json", why: "publish/index.mjs reads the frozen profile; report-registry.mjs:42 republishRun, customer key" },
 ];
 
@@ -106,7 +108,7 @@ const KNOCKOUT_FILES = [
   // knockout report render empty (publish/knockout.mjs:140-155). Named by stages-knockout.mjs:32,41.
   { path: "_driver/register-counts.json", why: "publish/knockout.mjs:140-155 counted figures + the Register column" },
   { path: "_driver/register-records.json", why: "stages-knockout.mjs:41 the terms behind the close-variation axis" },
-  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:821 searchedJurisdictions, the fallback for register-plan" },
+  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:847 searchedJurisdictions, the fallback for register-plan" },
 ];
 
 /** The allowlist for a template. One place, so a new template cannot half-exist. */
@@ -162,7 +164,7 @@ const SCRUB = [
 // hides the next real difference.
 const VOLATILE = [
   { id: "issued", re: /\d{4}-\d{2}-\d{2} · \d{2}:\d{2} [A-Z]{2,5}/g, sub: "<issued>", why: "publish/index.mjs, the generation stamp in the firm locale" },
-  { id: "iso-timestamp", re: /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z/g, sub: "<ts>", why: "publish/index.mjs:666 asOf" },
+  { id: "iso-timestamp", re: /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z/g, sub: "<ts>", why: "publish/index.mjs:668 asOf" },
 ];
 
 // ── REWRITES — what is CHANGED on the way out, as opposed to what is refused ───────────────────────
@@ -226,8 +228,19 @@ const substituteVendorKey = (key) => {
 // meta.json keys the freeze is EXPECTED to change, with the reason. Anything else differing is a finding.
 const EXPECTED_META_DELTA = {
   tokens: "telemetry pruned — _driver/*.jsonl is the only source (driver/tokens.mjs:82)",
+  servedModels: "telemetry pruned — the attempt rows in _driver/*.jsonl are the only source (servedModels in driver/tokens.mjs)",
 };
 
+// THE SAME CAUSE, ON THE TWO OTHER SURFACES THAT SHOW IT. report-data.json carries `servedModels` beside the
+// report's content, and the page renders it as the scope section's closing line (render.mjs
+// servedModelsLine, class "servedby"). Only that key and that one paragraph are set aside, on both sides
+// and out loud; a difference anywhere else in either file is still a finding. The paragraph holds escaped
+// text and no markup, so the pattern cannot run past its own closing tag. It takes the whitespace before
+// the paragraph with it: the clearance page joins its scope parts with a line break and an indent, which
+// exists only because the line does.
+const EXPECTED_DATA_DELTA = ["servedModels"];
+const SERVED_LINE_RE = /\s*<p class="servedby"[^>]*>[^<]*<\/p>/g;
+
 // ── args ─────────────────────────────────────────────────────────────────────────────────────────────
 const argv = process.argv.slice(2);
 const flag = (name) => { const i = argv.indexOf(name); return i >= 0 ? argv[i + 1] : null; };
@@ -594,7 +607,27 @@ if (proofOk) {
       }
       continue;
     }
-    if (normalise(rawA) === normalise(rawB)) { note(`${name} identical (${rawB.length} bytes)`); continue; }
+    // The served-model record is set aside by name on both sides (EXPECTED_DATA_DELTA, SERVED_LINE_RE),
+    // and only when it is what differed does the note say so.
+    let sA = normalise(rawA), sB = normalise(rawB), aside = [];
+    if (/^report-data(?:-.+)?\.json$/.test(name)) {
+      let dA = null, dB = null;
+      try { dA = JSON.parse(rawA); dB = JSON.parse(rawB); } catch { dA = dB = null; }
+      if (dA && dB) {
+        aside = EXPECTED_DATA_DELTA.filter((k) => JSON.stringify(dA[k]) !== JSON.stringify(dB[k]));
+        for (const k of EXPECTED_DATA_DELTA) { delete dA[k]; delete dB[k]; }
+        sA = normalise(JSON.stringify(dA, null, 2)); sB = normalise(JSON.stringify(dB, null, 2));
+      }
+    } else if (name.endsWith(".html") && sA !== sB) {
+      const tA = sA.replace(SERVED_LINE_RE, ""), tB = sB.replace(SERVED_LINE_RE, "");
+      if (tA === tB) { aside = ["the footer's served-models line"]; sA = tA; sB = tB; }
+    }
+    if (sA === sB) {
+      note(aside.length
+        ? `${name} identical apart from ${aside.join(", ")}, which differs as expected — ${EXPECTED_META_DELTA.servedModels}`
+        : `${name} identical (${rawB.length} bytes)`);
+      continue;
+    }
     finding(`${name} differs between the source run and the frozen copy — the allowlist dropped an input the renderer reads`);
   }
 }

package/scripts/generated-files-are-current.mjs

@@ -53,6 +53,29 @@ export function treeState(root = ROOT) {
  * The alternative — dirtying a real generated file and restoring it — is a shared-file mutation, and
  * the test runner runs files in parallel, so it would be a race that reddens somebody else's arm.
  */
+/**
+ * Which paths differ between two `git status --porcelain` readings, named so a reader can see WHAT moved.
+ *
+ * A porcelain line is a two-character state, a space, and the path. Lines are compared as a multiset so
+ * a path whose STATE changed — staged to modified, say — is reported as having moved, and the paths are
+ * returned rather than a count, because two numbers agreeing is not the same as two sets agreeing.
+ */
+export function movedPaths(before, after) {
+  const bag = (s) => {
+    const m = new Map();
+    for (const line of String(s).split("\n")) {
+      if (!line.trim()) continue;
+      m.set(line, (m.get(line) ?? 0) + 1);
+    }
+    return m;
+  };
+  const [b, a] = [bag(before), bag(after)];
+  const out = new Set();
+  for (const [line, n] of a) if ((b.get(line) ?? 0) !== n) out.add(line.slice(3).trim() || line.trim());
+  for (const [line, n] of b) if ((a.get(line) ?? 0) !== n) out.add(line.slice(3).trim() || line.trim());
+  return [...out].sort();
+}
+
 export function checkAll({ dir = HERE, root = ROOT, log = console.log, readTree = () => treeState(root) } = {}) {
   const found = minters(dir);
   if (!found.length) return { found, stale: [], unreadable: [], wrote: [], empty: true };
@@ -60,6 +83,7 @@ export function checkAll({ dir = HERE, root = ROOT, log = console.log, readTree
   const stale = [];
   const unreadable = [];
   const wrote = [];
+  const unattributable = [];
   for (const m of found) {
     // ── `--check` IS A CONTRACT, AND NOTHING WAS VERIFYING IT ──────────────────────────────────────
     //
@@ -73,13 +97,41 @@ export function checkAll({ dir = HERE, root = ROOT, log = console.log, readTree
     // one ran, it wrote. THE LIMIT, SAID RATHER THAN LEFT: this catches the harmful inert form, the
     // one that silently repairs. A minter that ignores the flag and does nothing at all still reports
     // `current`, and no probe from out here can tell that from a file that really is current.
+    // ── "DID THE TREE MOVE" IS NOT "DID THIS PROCESS WRITE" ────────────────────────────────────────
+    //
+    // Those are the same question only where nothing else can write, and this probe does not run
+    // there. Inside the suite it is a subprocess of one test file while every other file in its shard
+    // runs beside it, deliberately unserialised — dropping `--test-concurrency=1` is what made the
+    // suite 2.4 times faster. So a neighbour writing anywhere in the repository moved the snapshot and
+    // this reported it as the minter having written.
+    //
+    // Measured: a commit whose whole diff was one stylesheet's phone-width rules and a release note
+    // failed here naming TWO minters, and the same bytes passed on a rerun. Two is the tell — a minter
+    // that ignores `--check` and re-mints leaves its repair in the tree, so the NEXT minter's `before`
+    // already carries it and the next one is not flagged. Both being named cannot come from either.
+    //
+    // So the accusation is made only where it can be: from a tree that was CLEAN when this minter
+    // started, where a change appearing during its run has no other author available. A tree that was
+    // already dirty is one where somebody else is writing, and the honest answer is that this probe
+    // could not look — which is this file's own rule one level in, since it already refuses to read a
+    // minter that could not look as a pass.
+    //
+    // THE LIMIT, SAID RATHER THAN LEFT: a neighbour that begins writing after a clean reading and
+    // before the minter exits is still attributed here. Closing that needs the probe to own the tree,
+    // which is a change to where it runs rather than to what it asks.
     const before = readTree();
     const r = spawnSync(process.execPath, [join(dir, m), "--check"], { cwd: root, encoding: "utf8" });
     const after = readTree();
     const out = ((r.stdout || "") + (r.stderr || "")).trim();
     if (before !== null && after !== null && before !== after) {
-      wrote.push({ m, out });
-      log(`  WROTE    ${m} (during --check)`);
+      const moved = movedPaths(before, after);
+      if (before.trim() === "") {
+        wrote.push({ m, out, moved });
+        log(`  WROTE    ${m} (during --check): ${moved.join(", ") || "the tree moved"}`);
+      } else {
+        unattributable.push({ m, moved });
+        log(`  ?        ${m} — the tree moved and this probe cannot say who moved it: ${moved.join(", ") || "paths unknown"}`);
+      }
       continue;
     }
     // 0 is current, 1 is stale, anything else is a minter that could not look — reported separately,
@@ -89,11 +141,11 @@ export function checkAll({ dir = HERE, root = ROOT, log = console.log, readTree
     unreadable.push({ m, out, code: r.status });
     log(`  ?        ${m} (exit ${r.status})`);
   }
-  return { found, stale, unreadable, wrote, empty: false, contractChecked: readTree() !== null };
+  return { found, stale, unreadable, wrote, unattributable, empty: false, contractChecked: readTree() !== null };
 }
 
 function main() {
-  const { found, stale, unreadable, wrote, empty, contractChecked } = checkAll();
+  const { found, stale, unreadable, wrote, unattributable, empty, contractChecked } = checkAll();
   if (empty) {
     console.error("generated-files-are-current: no scripts/mint-*.mjs found. Either they moved or the "
       + "naming changed — and a pass over nothing is not a pass.");
@@ -111,6 +163,19 @@ function main() {
       + `commit without the repair, and reports current over a check that did not happen. Fix the minter.`);
     process.exit(2);
   }
+  // BEFORE the staleness verdict, and exit 2 rather than 1: a tree moving under the probe means the
+  // staleness answers were read off a tree that was changing while they were taken, so "out of date" is
+  // not a claim this run has the standing to make either. Could-not-look is the whole verdict.
+  if (unattributable.length) {
+    console.error(`\n${unattributable.length} minter(s) ran while the tree was ALREADY dirty and it moved `
+      + `underneath them. This probe cannot say whether the minter wrote or something running beside it `
+      + `did, so it names neither. That is a could-not-look, not a pass and not an accusation.\n`);
+    for (const { m, moved } of unattributable) {
+      console.error(`  ${m} — moved: ${moved.join(", ") || "paths unknown"}`);
+    }
+    console.error(`\nRun it on a tree nobody else is writing to, and it will answer.`);
+    process.exit(2);
+  }
   if (unreadable.length) {
     console.error(`\n${unreadable.length} minter(s) could not look. That is not a pass; fix the minter first.`);
     process.exit(2);