clearotron 0.3.2-beta.7 → 0.3.2-beta.9

package/scripts/e2e.mjs

@@ -68,6 +68,10 @@ import { doorGates, resolveForDoor } from "../driver/door-gates.mjs";
 // — the plan-row term screen, shared with the driver rather than restated here, so the harness
 // can never drift from what the plan freeze and the executor enforce. PURE (no node imports).
 import { entryTermIssues } from "../providers/_shared/term-shape.mjs";
+// — the mechanical tier vocabulary, imported from the module that classifies into it rather than
+// restated here: a floor naming a tier that does not exist must fail loudly rather than compare against
+// a missing key, and the list must not drift if a tier is ever added. PURE (no node imports) too.
+import { SHAPE_TIERS } from "../driver/band-shape.mjs";
 // The owner's turnaround benchmarks. The BAND owns the number and a scenario file cannot carry
 // one — see the lint rule below. Another pure leaf with zero imports of its own, for the same reason
 // queue-markers.mjs is: nothing in this file may reach driver.config.mjs.
@@ -1256,6 +1260,70 @@ export function pathsAnOpDoesNotRead(scenarios) {
   return out;
 }
 
+/**
+ * The office a band-shape floor row belongs to, from the row's own fields and never from a wider table.
+ *
+ * TWO SOURCES, IN THE ORDER band-shape.mjs POPULATES THEM. `registry` is the projection's own field and
+ * it is derived, so it can read `unknown`; the record id carries the office as its second path segment.
+ * Measured on a preserved dense clearance run, 2026-09-18: 289 of 289 rows carried `registry`, and every
+ * one agreed with its id's segment. The fallback exists for the row that does not, and a row that
+ * answers neither way is counted separately by the caller rather than dropped.
+ */
+export const bandRowOffice = (r) => {
+  const reg = String(r?.registry ?? "").trim().toLowerCase();
+  if (reg && reg !== "unknown") return reg;
+  const m = String(r?.record_id ?? "").match(/^\/[^/]+\/([^/]+)\//);
+  return m ? m[1].toLowerCase() : "";
+};
+
+/**
+ * Open a clearance run's band shape for a floor op: the document, the mark check, and the two coverage
+ * qualifications — or ONE sentence saying why no floor under it can be read.
+ *
+ * THE MARK IS CHECKED AGAINST `targets`, NOT AGAINST `targets[0]`. The driver shapes a band for the mark
+ * under search PLUS its manifest variants, and it puts the job's own mark in that list unconditionally;
+ * the first entry is the variant lane's to order. Membership is therefore the property that holds while
+ * the variant lane moves, and it still catches the case this check is for — a shape derived for some
+ * other mark entirely. A mismatch says so in its own words rather than folding into a missed floor,
+ * because "the store's mark moved" and "the register thinned" need opposite answers.
+ */
+function bandShapeUnder(full, file, field) {
+  const bad = (saw) => ({ bad: saw });
+  if (!existsSync(full)) return bad(`${file} absent — the clearance lane derives this after every register band re-merge, so an absent `
+    + `shape is a derivation that did not happen or a lane that never merged a band. It is not a register that holds nothing.`);
+  const doc = readJson(full);
+  if (!doc) return bad(`${file} present but unparseable`);
+  const want = field ? String(field).trim().toLowerCase() : null;
+  if (!want) return bad("no mark given (path must be <file>:<MARK NAME>)");
+  const targets = Array.isArray(doc.targets) ? doc.targets.filter((t) => String(t ?? "").trim()) : [];
+  if (!targets.length) return bad(`${file} carries no targets — nothing in it says which mark the band was shaped for, so no floor under a mark can be read from it`);
+  if (!targets.some((t) => String(t).trim().toLowerCase() === want)) {
+    const shown = targets.slice(0, 6).map((t) => JSON.stringify(String(t))).join(", ");
+    return bad(`this shape was derived for targets that do not include ${JSON.stringify(field)} — it was shaped for ${shown}`
+      + `${targets.length > 6 ? `, and ${targets.length - 6} more` : ""}. The store's mark moved, or this run is another mark's; either way no floor here is about the mark the scenario named.`);
+  }
+  const spots = Array.isArray(doc.blind_spots) ? doc.blind_spots : [];
+  // The register would not answer: a refused slice, or one it would not state a total for. These make a
+  // shortfall genuinely ambiguous, so they qualify a pass and may be the reason for a miss.
+  const unread = spots.filter((b) => b?.kind === "refused-slice" || b?.kind === "uncountable-slice")
+    .map((b) => `${b.count ?? "?"} ${b.kind}`);
+  // The register DID answer, with a number larger than what was fetched. That is evidence of size, not a
+  // gap in it — see the block at the ops — so it is named with the depth read and excuses nothing.
+  const shallow = spots.filter((b) => b?.kind === "unenumerated-crowd")
+    .map((b) => `${b.count ?? "?"} ${b.kind}${Array.isArray(b.read_depth) && b.read_depth.length ? ` (read ${b.read_depth.join("/")} deep)` : ""}`);
+  const verdict = (ok, passBody, missBody) => {
+    const parts = [ok ? passBody : missBody];
+    if (unread.length) parts.push(ok
+      ? `floor met, but the register refused or would not total ${unread.join(", ")}, so this run covered less than it asked for`
+      : `and the register refused or would not total ${unread.join(", ")}, so the shortfall may be what it would not answer rather than what it holds`);
+    if (shallow.length) parts.push(ok
+      ? `${shallow.join(", ")} — the register stated more than the funnel fetched there`
+      : `and ${shallow.join(", ")} — the register stated more than the funnel fetched there, which is a finding about the read depth and NOT a reason to lower the floor`);
+    return { ok, saw: parts.join(" — ") };
+  };
+  return { doc, unread, shallow, verdict };
+}
+
 function evalAssertion(a, runDir) {
   const [file, field] = String(a.path ?? "").split(":");
   const full = join(runDir, file || "");
@@ -1637,6 +1705,112 @@ function evalAssertion(a, runDir) {
       saw: failed.length ? `${body}, and ${failed.length} term(s) FAILED to fetch, so the shortfall may be the fetch and not the register: ${failed.join(" · ")}`
         : `${body} — the register returned fewer rows than the hit path needs, so screening, hydration and citation ran on less than this scenario exists to give them` };
   }
+  // ── · THE SAME TWO QUESTIONS, ASKED OF THE CLEARANCE LANE'S OWN ARTIFACT ──────────────────────
+  //
+  // WHY A SECOND PAIR RATHER THAN A SECOND PATH ON THE PAIR ABOVE. `register-counts.json` and
+  // `register-records.json` are written by the KNOCKOUT lane and by nothing else. A clearance scenario
+  // asserting the floors above therefore gets `absent` on both, and the sentence those absences print —
+  // "a run whose register lane wrote nothing is not a run that found nothing" — is true of the file and
+  // false of the run: the clearance lane read the band and recorded it under other names. The record it
+  // keeps is `_driver/band-shape.json`, derived after every named-band re-merge, and it is a different
+  // shape entirely rather than the same shape in another place, so it needs its own two ops.
+  //
+  // THREE POPULATIONS, THREE DIFFERENT NUMBERS, AND CONFLATING THEM IS THE TRAP THIS PAIR SITS IN.
+  // Measured on a preserved dense clearance run, 2026-09-18, all three true of one band at one moment:
+  //
+  //   totals.records                        1554   every in-scope record the merged band holds
+  //   totals.by_tier.identical               245   tiered across the WHOLE band, class filter and all
+  //   floors.in_class_identical_or_near      289   identical AND near-identical, live, in-class only
+  //
+  // The band's own delivered depth record counted 2098, because it counts everything READ rather than
+  // what stayed in scope. A floor written against one of these and read against another drifts with
+  // nobody noticing, which is the failure the floors exist to catch happening to the floors themselves.
+  // So every number these ops print names its population in words, and neither op mixes two.
+  //
+  // BOTH KEEP THE TWO RULES THE PAIR ABOVE IS BUILT ON. A size that was never taken is never a small
+  // one: an absent shape, a shape with no `totals`, no `by_tier` or no floors array is reported as a
+  // derivation that did not happen, never as a band that holds nothing. And a slice the register refused
+  // or would not total is reduced coverage, named whichever way the floor goes.
+  //
+  // A CROWD THE FUNNEL COULD NOT ENUMERATE IS NOT THAT, AND MUST NEVER EXCUSE A SHORTFALL. Its
+  // `total_hits` is LARGER than what was fetched, which is the register stating that the band is at
+  // least that big — positive evidence of size, the opposite of a coverage gap. A dense band carries
+  // these by construction (19 of them on the run measured above), so letting them soften a miss would
+  // make every genuine thinning report as "the register may not have answered" for ever. They are named
+  // with the depth actually read, and they change no verdict.
+  if (a.op === "band-count-floor" || a.op === "band-records-floor") {
+    const shape = bandShapeUnder(full, file, field);
+    if (shape.bad) return { ok: false, saw: shape.bad };
+    const value = a.value && typeof a.value === "object" && !Array.isArray(a.value) ? a.value : null;
+
+    if (a.op === "band-count-floor") {
+      if (!value) return { ok: false, saw: "value must be an object of floors, e.g. {\"records\": 1000, \"by_tier\": {\"identical\": 120}}" };
+      const unknown = Object.keys(value).filter((k) => k !== "records" && k !== "by_tier");
+      if (unknown.length) return { ok: false, saw: `unknown floor key(s) ${unknown.map((k) => JSON.stringify(k)).join(", ")} — this op takes `
+        + `"records" (the whole in-scope band) and "by_tier" (one floor per mechanical tier). A key nothing reads is a floor nobody asserts.` };
+      const totals = shape.doc.totals && typeof shape.doc.totals === "object" ? shape.doc.totals : null;
+      if (!totals) return { ok: false, saw: `${file} carries no totals — the band was never sized, which is not a band whose size is zero` };
+
+      const saw = [], short = [], untaken = [];
+      if (Object.hasOwn(value, "records")) {
+        const want = value.records;
+        if (!Number.isFinite(want)) return { ok: false, saw: `"records" must be a number, not ${JSON.stringify(want)}` };
+        if (!Number.isFinite(totals.records)) untaken.push(`records: NOT TAKEN — totals.records is ${JSON.stringify(totals.records ?? null)}`);
+        else {
+          saw.push(`${totals.records} record(s) in the whole in-scope band (floor ${want})`);
+          if (!(totals.records >= want)) short.push(`the in-scope band is ${totals.records} record(s), below the floor of ${want}`);
+        }
+      }
+      if (Object.hasOwn(value, "by_tier")) {
+        const tiers = value.by_tier && typeof value.by_tier === "object" && !Array.isArray(value.by_tier) ? value.by_tier : null;
+        if (!tiers) return { ok: false, saw: "\"by_tier\" must be an object of tier floors, e.g. {\"identical\": 120}" };
+        const byTier = totals.by_tier && typeof totals.by_tier === "object" ? totals.by_tier : null;
+        if (!byTier) return { ok: false, saw: `${file} carries no totals.by_tier — the band was never tiered, which is not a band holding no identical marks` };
+        for (const [tier, want] of Object.entries(tiers)) {
+          if (!SHAPE_TIERS.includes(tier)) { untaken.push(`${tier}: NO SUCH TIER — the mechanical tiers are ${SHAPE_TIERS.join(", ")}`); continue; }
+          if (!Number.isFinite(want)) return { ok: false, saw: `the floor for ${tier} must be a number, not ${JSON.stringify(want)}` };
+          const n = byTier[tier];
+          if (!Number.isFinite(n)) { untaken.push(`${tier}: NOT TAKEN — totals.by_tier.${tier} is ${JSON.stringify(n ?? null)}`); continue; }
+          saw.push(`${n} record(s) tiered ${tier} across the whole band (floor ${want})`);
+          if (!(n >= want)) short.push(`${tier} is ${n}, below the floor of ${want}`);
+        }
+      }
+      if (!saw.length && !short.length && !untaken.length)
+        return { ok: false, saw: "no floor stated — give \"records\", \"by_tier\" or both; an op asserting nothing is an assert that looked at nothing" };
+      if (untaken.length) return { ok: false, saw: `the band was never sized that way, so this scenario proved nothing about the size it exists for — ${untaken.join(" · ")}` };
+      return shape.verdict(short.length === 0, saw.join(" · "),
+        `${short.join(" · ")} — either the register has thinned out under this mark or the query narrowed; re-measure before moving the floor`);
+    }
+
+    // The population behind the count, and the two properties the size-dependent paths need from it:
+    // enough rows to work on, and rows from more than one office.
+    //
+    // BOTH NUMBERS COME OUT OF THE SAME LIST, DELIBERATELY. The shape also carries a `by_registry` table
+    // over the whole band, and taking the office span from there while taking the row count from the
+    // floor list would report a multi-office band whose every floor row was one office — which is the
+    // exact fail-open the knockout records floor names: a total-only floor is met while the property it
+    // exists for lapses with every assert green. One list, both properties, or neither is asserted.
+    const floors = value ?? {};
+    const unknown = Object.keys(floors).filter((k) => k !== "records" && k !== "offices");
+    if (unknown.length) return { ok: false, saw: `unknown floor key(s) ${unknown.map((k) => JSON.stringify(k)).join(", ")} — this op takes `
+      + `"records" (rows on the floor list) and "offices" (how many the list spans).` };
+    const minRecords = Number.isFinite(floors.records) ? floors.records : 1;
+    const minOffices = Number.isFinite(floors.offices) ? floors.offices : 1;
+    const rows = shape.doc.floors?.in_class_identical_or_near;
+    if (!Array.isArray(rows)) return { ok: false, saw: `${file} carries no floors.in_class_identical_or_near array — the one list that is `
+      + `complete by construction was never written, which is not a band holding no identical marks` };
+    const offices = [...new Set(rows.map(bandRowOffice).filter(Boolean))].sort();
+    // A row whose office cannot be read is counted and named rather than dropped: it narrows the span
+    // this op can see, and a span that is narrow because the field is missing is not a narrow band.
+    const officeless = rows.filter((r) => !bandRowOffice(r)).length;
+    const met = rows.length >= minRecords && offices.length >= minOffices;
+    const body = `${rows.length} live in-class identical/near-identical floor row(s) (floor ${minRecords}) across `
+      + `${offices.length} office(s) [${offices.join(", ") || "none"}] (floor ${minOffices})`
+      + (officeless ? `, and ${officeless} row(s) carry no office, so the span read here is a floor on the span, not a count of it` : "");
+    return shape.verdict(met, body,
+      `${body} — the band the clearance lane merged is smaller or narrower than this scenario exists to hand the size-dependent paths`);
+  }
+
   // field ops
   const fn = OPS[a.op];
   if (!fn) return { ok: false, saw: `UNIMPLEMENTED op "${a.op}" — not passing by omission`, unimplemented: true };

package/scripts/env-audit.mjs

@@ -203,6 +203,22 @@ export function mergeEnvNameBindings(perFile) {
 // read as `env[X]`, for the reason READ_RE gives.
 const CONST_READ_RE = /(?<![.\w$])(?:process\??\.)?env(?:\?\.)?\[\s*([A-Z][A-Z0-9_]*)\s*\](?!\s*=[^=])/g;
 
+// THE NAME HELD IN A TABLE AS A VALUE, which is a read the three readers above cannot see. A generic
+// resolver takes the name out of a row and reads it — `{ env: "CLEAROTRON_CODEX_PATH", fallback: "codex" }`
+// — so the variable is read on every run and spelled nowhere the audit was looking. Thirteen names are
+// read exactly this way, and two of them are live deployment settings that no rule could ask for a row
+// for, because every ratchet that would is keyed on the name being seen.
+//
+// MATCHED ON THE PROPERTY NAME, NEVER ON THE VALUE'S SHAPE, and that is the whole reason this is safe.
+// A rule that took any uppercase string literal would take every message key, token and enum member in
+// the tree and drown the audit in names nothing reads. The property names are the closed set the
+// resolvers actually use; a new resolver that invents a fourth spelling is invisible again, which is a
+// known limit of this shape rather than a defect in the rule — the same limit the accessor reader has.
+//
+// This is the third time this shape has hidden a read here: the accessor family was the first, `envFrom`
+// the second, and a name held as a value is those two one remove further on.
+const TABLE_NAME_RE = /(?<![.\w$])(?:env|envName|tokenEnv)\s*:\s*["']([A-Z][A-Z0-9_]*)["']/g;
+
 export function namesRead(text, bindings = null) {
   const found = new Set();
   const stripped = stripCommentLines(text);
@@ -210,6 +226,8 @@ export function namesRead(text, bindings = null) {
   for (let m; (m = READ_RE.exec(stripped));) found.add(m[1] || m[2]);
   ACCESSOR_RE.lastIndex = 0;
   for (let m; (m = ACCESSOR_RE.exec(stripped));) found.add(m[1] || m[2]);
+  TABLE_NAME_RE.lastIndex = 0;
+  for (let m; (m = TABLE_NAME_RE.exec(stripped));) found.add(m[1]);
   // Resolved through the corpus map when one is supplied. Absent map ⇒ this half is simply off, which
   // is what keeps the function pure and drivable on a single string.
   if (bindings) {
@@ -357,6 +375,15 @@ export const EFFECT_CLASSES = Object.freeze({
   credential: "authentication material; absent, the run refuses at preflight by name",
   deployment: "where input and output live; the conclusion a run reaches is unchanged",
   tuning: "how long or how hard a run tries; the conclusion a run reaches is unchanged",
+  // WHAT THE INSTALL WIZARD WROTE WHEN IT SET THIS MACHINE UP. Added because the classifier had computed
+  // this class for years and no declaration could say it: five names computed `setup` against a
+  // vocabulary with no word for it, so each was either undeclared or declared as the nearest wrong
+  // thing. A declaration that cannot be true is worse than none — it reads as considered.
+  //
+  // It is its own class rather than a flavour of `deployment` because the two answer different
+  // questions. `deployment` says where this machine keeps things; `setup` says what the installer
+  // found or made here, which is the fact an operator needs when a program has moved.
+  setup: "what the install wizard found or wrote when it set this machine up; the conclusion a run reaches is unchanged",
   harness: "read only on a fixture, replay or self-test path; no production run reaches it",
 });
 
@@ -535,13 +562,18 @@ export function auditEnv(root = ROOT) {
 //                            roster, while ADR-0003 had already ruled case-law setup an OAuth flow
 //                            and not a variable at all. Evidence of a reader is not evidence of a
 //                            READ: the roster is a list of names to look for, not a call site.
-//                         4  the AZURE_OPENAI_* block, an external contract (below).
+//                         4  the AZURE_OPENAI_* block, then kept as an external contract. That call did
+//                            not hold: nothing the product runs read them, and the rows were removed
+//                            from `.env.example` on 2026-09-15 (below). They are no longer counted
+//                            among the wrong deletions.
 //                         1  CLEAROTRON_SEND_TOOL_PREFIX — genuinely dead, and this direction does not
 //                            catch it either: its one surviving mention is a governance-doc line, and
 //                            a mention is enough to spare a row. Under-firing is the cost of the
 //                            trade, taken deliberately. It is the prose-sweep class.
 //
-//                       So SIX of ten deletions would have been wrong, two of them credential rows.
+//                       So FOUR of ten deletions would have been wrong, the four live reads above,
+//                       one of them a credential row. (This said six until 2026-09-15; that count
+//                       did not follow from the rows as listed, and it included the Azure block.)
 //                       Evidence used instead: the bare NAME, on a name boundary, anywhere in the
 //                       tracked tree. The accessor family is filed as  and does NOT belong here —
 //                       see below.
@@ -561,10 +593,11 @@ export function auditEnv(root = ROOT) {
 // ── AND IT IS NOT A SUPPRESSION LIST ────────────────────────────────────────────────────────────
 //
 // forbids one, rightly: "if a row is deliberately readerless, the row goes, not the guard."
-// Applied literally that ruling deletes three rows it should not. `.env.example`'s Azure block
-// documents the variables an EXTERNAL agent platform consumes — the block says so itself, ruled
-// it, and `MODELS.azure` / `CLEAROTRON_AZURE_MODEL` / `jxPolicy.providerStance: "azure-only"` are live.
-// There is no reader in this tree and there never was one to retire.
+// Applied literally, that ruling deletes a row whose consumer is not this tree at all: a variable read
+// by a program the product spawns, such as the Claude program's own sign-in token. The row documents a
+// contract with that consumer, and there is no reader here to retire. (The four AZURE_OPENAI_* rows that
+// first raised this were a different case. They named another platform's settings, nothing the product
+// runs read them, and they were removed from `.env.example` on 2026-09-15.)
 //
 // So a row is ACCOUNTED FOR two ways, and this is one rule applied to every row rather than a list of
 // exempt names: something in the tree names it, OR the row carries an inline `# external:` line

package/scripts/env-classify.mjs

@@ -355,6 +355,19 @@ export const DEPLOYMENT_NAMES = new Set([
   // Set by the install on the copy it starts after moving out of npx's cache, never by an operator. Its
   // row declares `deployment`, and no shape matches it, so unlisted it would fall through to `tuning`.
   "CLEAROTRON_RELOCATED",
+  // The two register ledgers, listed the day the scanner learned to read a name held in a table as a
+  // value — the same shape as the optional-chaining three below, one scanner widening later. Both name
+  // WHERE a file lives and resolve by an existence ladder over several directories, which is the
+  // definition `CLEAROTRON_JX_SUBCLASS_DB` was moved here on: a row whose own words name a place is
+  // `deployment`, and it reaches `tuning` only because `tuning` is the residual.
+  //
+  // GETTING THIS WRONG IS WORSE THAN THE BLINDNESS IT REPLACES. No deployed box sets either — the
+  // ledger module says so and explains why the default is resolved by existence rather than by name —
+  // so `tuning` with an empty set-site list is precisely the population step 3 deletes from. Making
+  // them visible without listing them here would move the billing-grade call ledger and the record
+  // ledger a "verified from the record" claim joins against from unseen to proposed for deletion.
+  "CLEAROTRON_REGISTER_CALL_LOG",
+  "CLEAROTRON_REGISTER_RECORD_LOG",
   // Three names read only through optional chaining, so no catalogue check saw them until the scanner
   // learned `?.`. Each row declares `deployment`, and no shape matches them (`_PORT$` does not take
   // `_PORTS`), so unlisted each fell through to `tuning`, the bucket step 3 deletes from. The first is set
@@ -502,7 +515,12 @@ export function classify({ catalogue, sources, setup = setupNames(), readSites =
   };
 
   const cls = (name) => OVERRIDES[name] ?? (setup.has(name) ? "setup"
-    : VENDOR_RE.test(name) ? "vendor-credential"
+    // `credential`, the word the declared vocabulary uses, NOT a second word for the same thing. This
+    // computed `vendor-credential` while no row could declare it, which is the same gap that left the
+    // install wizard's names undeclarable — one side of the contract saying a word the other side has
+    // no way to say. The rule settled with that one holds here: the classifier and the vocabulary say
+    // the SAME word, and a disagreement is fixed rather than frozen as an exception.
+    : VENDOR_RE.test(name) ? "credential"
     // The listed audience is consulted BEFORE the shapes, so a renamed name keeps the class a human gave
     // it rather than the one its new spelling happens to match.
     : deploymentNames.has(name) ? "deployment"
@@ -678,7 +696,7 @@ function build() {
     _what: "#1838 step 1 — every catalogued variable classified, and for every TUNING name the environments that have ever set it.",
     _how: "Regenerate with: node scripts/env-classify.mjs --check   (the production half is read from docs/architecture/env-set-in-production.txt, which needs `--gather-prod` on the production box to refresh).",
     _values: "NO VALUE from any environment is read into this artifact. Names only.",
-    _counts: { rows: rows.length, setup: by("setup"), deployment: by("deployment"), vendorCredential: by("vendor-credential"), tuning: by("tuning") },
+    _counts: { rows: rows.length, setup: by("setup"), deployment: by("deployment"), credential: by("credential"), tuning: by("tuning") },
     _stepThreePopulation: {
       _what: "What step 3 may act on: a numeric default, and no environment anywhere sets it.",
       _warning: "A candidate list, not a licence. Each still needs its read site read and its guard checked before deletion.",

package/scripts/freeze-example-run.mjs

@@ -29,9 +29,11 @@
 //   _driver/run.jsonl        the event log
 //   _driver/stage-inputs/    what each stage was handed
 //   _history/                pre-reopen snapshots
-// Dropping the telemetry drops `meta.tokens` (driver/publish/index.mjs:1136 rollupTokens — the only consumer of
-// rollupTokens). That is the one difference step 5 is told to expect, and it says so out loud rather than
-// normalising it away in silence.
+// Dropping the telemetry drops `meta.tokens` (driver/publish/index.mjs rollupTokens — the only consumer of
+// rollupTokens), and with it the record of which models served the run (servedModels in
+// driver/tokens.mjs): `servedModels` on meta.json and report-data.json, and the one line that closes the
+// report's footer. Those are the differences step 5 is told to expect, and it says so out loud rather
+// than normalising them away in silence.
 //
 // WHAT THIS SCRIPT DOES NOT DO
 // It does not decide the sample is publishable. It greps for the shapes that must never leave the VM
@@ -45,7 +47,8 @@ import {
 } from "node:fs";
 import { join, dirname, relative, basename } from "node:path";
 import { createHash } from "node:crypto";
-import { driverDir } from "../shared/driver-dir.mjs";   //
+import { driverDir } from "../shared/driver-dir.mjs";
+import { PUBLISH_INPUTS } from "../driver/publish/publish-inputs.mjs";   //
 import { tmpdir } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
@@ -59,24 +62,33 @@ const FROZEN_FILES = [
   { path: "audit.md", why: "publish/index.mjs:1022 auditMd, the audit workbook source" },
   { path: "findings.json", why: "publish/index.mjs:715 readStore, the per-finding machine contract" },
   { path: "status.json", why: "publish/index.mjs:913 machineLedgerNote + markName" },
-  { path: "case-law-findings.md", why: "publish/index.mjs:849 clPath, the case-law section" },
-  { path: "common-law-grid.json", why: "publish/index.mjs:973 commonLawJoinedTerms, common-law coverage" },
+  { path: "case-law-findings.md", why: "`clPath` declared in index.mjs, the case-law section" },
+  { path: "common-law-grid.json", why: "`commonLawJoinedTerms` declared in index.mjs, common-law coverage" },
   // publish/index.mjs — the _driver sidecars it reads by name
   { path: "_driver/receipts.json", why: "publish/index.mjs:761 fetchReceipts" },
   { path: "_driver/senior-rights.json", why: "publish/index.mjs:787 seniorRights" },
   { path: "_driver/verdict.json", why: "publish/index.mjs:792 verdictInfo" },
   { path: "_driver/framework.json", why: "publish/index.mjs, the frozen band vocabulary the run was rated under" },
-  { path: "_driver/register-plan.json", why: "publish/index.mjs:820 scopeBasis" },
-  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:821 searchedJurisdictions, the fallback for register-plan" },
-  { path: "_driver/enforcer-signals.json", why: "publish/index.mjs:861 esPath" },
-  { path: "_driver/predelivery-lint.json", why: "publish/index.mjs:170 lintSink" },
-  { path: "_driver/escalation-state.json", why: "publish/index.mjs:171 escSink" },
-  { path: "_driver/reasoning-integrity.json", why: "publish/index.mjs:898 integritySink" },
-  { path: "_driver/corrections-state.json", why: "publish/index.mjs:172 correctionsSink" },
-  { path: "_driver/search-policy.json", why: "publish/index.mjs:955 searchPolicy, level + stage label" },
+  { path: "_driver/register-plan.json", why: "publish/index.mjs:901 scopeBasis" },
+  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:902 searchedJurisdictions, the fallback for register-plan" },
+  { path: "_driver/enforcer-signals.json", why: "`esPath` declared in index.mjs" },
+  { path: "_driver/predelivery-lint.json", why: "publish/index.mjs:172 lintSink" },
+  { path: "_driver/escalation-state.json", why: "publish/index.mjs:173 escSink" },
+  { path: "_driver/reasoning-integrity.json", why: "`integritySink` declared in index.mjs" },
+  { path: "_driver/corrections-state.json", why: "publish/index.mjs:174 correctionsSink" },
+  { path: "_driver/search-policy.json", why: "`searchPolicy` declared in index.mjs, level + stage label" },
   { path: "_driver/profile.json", why: "publish/index.mjs reads the frozen profile; report-registry.mjs:42 republishRun, customer key" },
 ];
 
+// EVERY INPUT THE PUBLISHER DECLARES TRAVELS, taken from its own closed table rather than restated. The
+// hand-kept list above drifted from that table: register-named-band.json, the recall receipt and the
+// local-language lane's two files were declared publish inputs and were left behind, so a frozen republish
+// drew no register section and no local-language row where the source run drew both. A declared input
+// added later now travels without an edit here; one the publisher does not declare still needs a line above.
+for (const path of Object.keys(PUBLISH_INPUTS)) {
+  if (!FROZEN_FILES.some((f) => f.path === path)) FROZEN_FILES.push({ path, why: "declared in publish/publish-inputs.mjs" });
+}
+
 // ── THE KNOCKOUT LANE IS A DIFFERENT WORKSPACE, AND report.md IS NOT IN IT ─
 //
 // A knockout run never writes report.md: for that lane the markdown is an OUTPUT of publish, not an
@@ -106,7 +118,7 @@ const KNOCKOUT_FILES = [
   // knockout report render empty (publish/knockout.mjs:140-155). Named by stages-knockout.mjs:32,41.
   { path: "_driver/register-counts.json", why: "publish/knockout.mjs:140-155 counted figures + the Register column" },
   { path: "_driver/register-records.json", why: "stages-knockout.mjs:41 the terms behind the close-variation axis" },
-  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:821 searchedJurisdictions, the fallback for register-plan" },
+  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:902 searchedJurisdictions, the fallback for register-plan" },
 ];
 
 /** The allowlist for a template. One place, so a new template cannot half-exist. */
@@ -162,7 +174,7 @@ const SCRUB = [
 // hides the next real difference.
 const VOLATILE = [
   { id: "issued", re: /\d{4}-\d{2}-\d{2} · \d{2}:\d{2} [A-Z]{2,5}/g, sub: "<issued>", why: "publish/index.mjs, the generation stamp in the firm locale" },
-  { id: "iso-timestamp", re: /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z/g, sub: "<ts>", why: "publish/index.mjs:666 asOf" },
+  { id: "iso-timestamp", re: /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z/g, sub: "<ts>", why: "publish/index.mjs:668 asOf" },
 ];
 
 // ── REWRITES — what is CHANGED on the way out, as opposed to what is refused ───────────────────────
@@ -174,7 +186,7 @@ const VOLATILE = [
 //
 // 1. THE BIRTH CODENAME, IN CONTENT. `--codename` rebuilds the run's IDENTITY — the leaf, the runId, the
 //    directory — and the content keeps the old pair: `_receipt.context` in every record artifact reads
-//    "prelim-<matter>-<codename>-register-unit-primary-sweep", and audit.md and status.json carry it in
+//    "clearance-<matter>-<codename>-register-unit-primary-sweep", and audit.md and status.json carry it in
 //    prose. driver/test/no-client-identifiers.test.mjs check 2 sweeps CONTENT as well as paths, so a
 //    tree renamed but not rewritten can never be committed — which is exactly what the old echo check
 //    reported, correctly, and could do nothing about.
@@ -226,8 +238,19 @@ const substituteVendorKey = (key) => {
 // meta.json keys the freeze is EXPECTED to change, with the reason. Anything else differing is a finding.
 const EXPECTED_META_DELTA = {
   tokens: "telemetry pruned — _driver/*.jsonl is the only source (driver/tokens.mjs:82)",
+  servedModels: "telemetry pruned — the attempt rows in _driver/*.jsonl are the only source (servedModels in driver/tokens.mjs)",
 };
 
+// THE SAME CAUSE, ON THE TWO OTHER SURFACES THAT SHOW IT. report-data.json carries `servedModels` beside the
+// report's content, and the page renders it as the scope section's closing line (render.mjs
+// servedModelsLine, class "servedby"). Only that key and that one paragraph are set aside, on both sides
+// and out loud; a difference anywhere else in either file is still a finding. The paragraph holds escaped
+// text and no markup, so the pattern cannot run past its own closing tag. It takes the whitespace before
+// the paragraph with it: the clearance page joins its scope parts with a line break and an indent, which
+// exists only because the line does.
+const EXPECTED_DATA_DELTA = ["servedModels"];
+const SERVED_LINE_RE = /\s*<p class="servedby"[^>]*>[^<]*<\/p>/g;
+
 // ── args ─────────────────────────────────────────────────────────────────────────────────────────────
 const argv = process.argv.slice(2);
 const flag = (name) => { const i = argv.indexOf(name); return i >= 0 ? argv[i + 1] : null; };
@@ -594,7 +617,27 @@ if (proofOk) {
       }
       continue;
     }
-    if (normalise(rawA) === normalise(rawB)) { note(`${name} identical (${rawB.length} bytes)`); continue; }
+    // The served-model record is set aside by name on both sides (EXPECTED_DATA_DELTA, SERVED_LINE_RE),
+    // and only when it is what differed does the note say so.
+    let sA = normalise(rawA), sB = normalise(rawB), aside = [];
+    if (/^report-data(?:-.+)?\.json$/.test(name)) {
+      let dA = null, dB = null;
+      try { dA = JSON.parse(rawA); dB = JSON.parse(rawB); } catch { dA = dB = null; }
+      if (dA && dB) {
+        aside = EXPECTED_DATA_DELTA.filter((k) => JSON.stringify(dA[k]) !== JSON.stringify(dB[k]));
+        for (const k of EXPECTED_DATA_DELTA) { delete dA[k]; delete dB[k]; }
+        sA = normalise(JSON.stringify(dA, null, 2)); sB = normalise(JSON.stringify(dB, null, 2));
+      }
+    } else if (name.endsWith(".html") && sA !== sB) {
+      const tA = sA.replace(SERVED_LINE_RE, ""), tB = sB.replace(SERVED_LINE_RE, "");
+      if (tA === tB) { aside = ["the footer's served-models line"]; sA = tA; sB = tB; }
+    }
+    if (sA === sB) {
+      note(aside.length
+        ? `${name} identical apart from ${aside.join(", ")}, which differs as expected — ${EXPECTED_META_DELTA.servedModels}`
+        : `${name} identical (${rawB.length} bytes)`);
+      continue;
+    }
     finding(`${name} differs between the source run and the frozen copy — the allowlist dropped an input the renderer reads`);
   }
 }

package/scripts/generated-files-are-current.mjs

@@ -53,6 +53,29 @@ export function treeState(root = ROOT) {
  * The alternative — dirtying a real generated file and restoring it — is a shared-file mutation, and
  * the test runner runs files in parallel, so it would be a race that reddens somebody else's arm.
  */
+/**
+ * Which paths differ between two `git status --porcelain` readings, named so a reader can see WHAT moved.
+ *
+ * A porcelain line is a two-character state, a space, and the path. Lines are compared as a multiset so
+ * a path whose STATE changed — staged to modified, say — is reported as having moved, and the paths are
+ * returned rather than a count, because two numbers agreeing is not the same as two sets agreeing.
+ */
+export function movedPaths(before, after) {
+  const bag = (s) => {
+    const m = new Map();
+    for (const line of String(s).split("\n")) {
+      if (!line.trim()) continue;
+      m.set(line, (m.get(line) ?? 0) + 1);
+    }
+    return m;
+  };
+  const [b, a] = [bag(before), bag(after)];
+  const out = new Set();
+  for (const [line, n] of a) if ((b.get(line) ?? 0) !== n) out.add(line.slice(3).trim() || line.trim());
+  for (const [line, n] of b) if ((a.get(line) ?? 0) !== n) out.add(line.slice(3).trim() || line.trim());
+  return [...out].sort();
+}
+
 export function checkAll({ dir = HERE, root = ROOT, log = console.log, readTree = () => treeState(root) } = {}) {
   const found = minters(dir);
   if (!found.length) return { found, stale: [], unreadable: [], wrote: [], empty: true };
@@ -60,6 +83,7 @@ export function checkAll({ dir = HERE, root = ROOT, log = console.log, readTree
   const stale = [];
   const unreadable = [];
   const wrote = [];
+  const unattributable = [];
   for (const m of found) {
     // ── `--check` IS A CONTRACT, AND NOTHING WAS VERIFYING IT ──────────────────────────────────────
     //
@@ -73,13 +97,41 @@ export function checkAll({ dir = HERE, root = ROOT, log = console.log, readTree
     // one ran, it wrote. THE LIMIT, SAID RATHER THAN LEFT: this catches the harmful inert form, the
     // one that silently repairs. A minter that ignores the flag and does nothing at all still reports
     // `current`, and no probe from out here can tell that from a file that really is current.
+    // ── "DID THE TREE MOVE" IS NOT "DID THIS PROCESS WRITE" ────────────────────────────────────────
+    //
+    // Those are the same question only where nothing else can write, and this probe does not run
+    // there. Inside the suite it is a subprocess of one test file while every other file in its shard
+    // runs beside it, deliberately unserialised — dropping `--test-concurrency=1` is what made the
+    // suite 2.4 times faster. So a neighbour writing anywhere in the repository moved the snapshot and
+    // this reported it as the minter having written.
+    //
+    // Measured: a commit whose whole diff was one stylesheet's phone-width rules and a release note
+    // failed here naming TWO minters, and the same bytes passed on a rerun. Two is the tell — a minter
+    // that ignores `--check` and re-mints leaves its repair in the tree, so the NEXT minter's `before`
+    // already carries it and the next one is not flagged. Both being named cannot come from either.
+    //
+    // So the accusation is made only where it can be: from a tree that was CLEAN when this minter
+    // started, where a change appearing during its run has no other author available. A tree that was
+    // already dirty is one where somebody else is writing, and the honest answer is that this probe
+    // could not look — which is this file's own rule one level in, since it already refuses to read a
+    // minter that could not look as a pass.
+    //
+    // THE LIMIT, SAID RATHER THAN LEFT: a neighbour that begins writing after a clean reading and
+    // before the minter exits is still attributed here. Closing that needs the probe to own the tree,
+    // which is a change to where it runs rather than to what it asks.
     const before = readTree();
     const r = spawnSync(process.execPath, [join(dir, m), "--check"], { cwd: root, encoding: "utf8" });
     const after = readTree();
     const out = ((r.stdout || "") + (r.stderr || "")).trim();
     if (before !== null && after !== null && before !== after) {
-      wrote.push({ m, out });
-      log(`  WROTE    ${m} (during --check)`);
+      const moved = movedPaths(before, after);
+      if (before.trim() === "") {
+        wrote.push({ m, out, moved });
+        log(`  WROTE    ${m} (during --check): ${moved.join(", ") || "the tree moved"}`);
+      } else {
+        unattributable.push({ m, moved });
+        log(`  ?        ${m} — the tree moved and this probe cannot say who moved it: ${moved.join(", ") || "paths unknown"}`);
+      }
       continue;
     }
     // 0 is current, 1 is stale, anything else is a minter that could not look — reported separately,
@@ -89,11 +141,11 @@ export function checkAll({ dir = HERE, root = ROOT, log = console.log, readTree
     unreadable.push({ m, out, code: r.status });
     log(`  ?        ${m} (exit ${r.status})`);
   }
-  return { found, stale, unreadable, wrote, empty: false, contractChecked: readTree() !== null };
+  return { found, stale, unreadable, wrote, unattributable, empty: false, contractChecked: readTree() !== null };
 }
 
 function main() {
-  const { found, stale, unreadable, wrote, empty, contractChecked } = checkAll();
+  const { found, stale, unreadable, wrote, unattributable, empty, contractChecked } = checkAll();
   if (empty) {
     console.error("generated-files-are-current: no scripts/mint-*.mjs found. Either they moved or the "
       + "naming changed — and a pass over nothing is not a pass.");
@@ -111,6 +163,19 @@ function main() {
       + `commit without the repair, and reports current over a check that did not happen. Fix the minter.`);
     process.exit(2);
   }
+  // BEFORE the staleness verdict, and exit 2 rather than 1: a tree moving under the probe means the
+  // staleness answers were read off a tree that was changing while they were taken, so "out of date" is
+  // not a claim this run has the standing to make either. Could-not-look is the whole verdict.
+  if (unattributable.length) {
+    console.error(`\n${unattributable.length} minter(s) ran while the tree was ALREADY dirty and it moved `
+      + `underneath them. This probe cannot say whether the minter wrote or something running beside it `
+      + `did, so it names neither. That is a could-not-look, not a pass and not an accusation.\n`);
+    for (const { m, moved } of unattributable) {
+      console.error(`  ${m} — moved: ${moved.join(", ") || "paths unknown"}`);
+    }
+    console.error(`\nRun it on a tree nobody else is writing to, and it will answer.`);
+    process.exit(2);
+  }
   if (unreadable.length) {
     console.error(`\n${unreadable.length} minter(s) could not look. That is not a pass; fix the minter first.`);
     process.exit(2);