clearotron 0.3.2-beta.8 → 0.3.2-beta.9

package/scripts/release-note-required.mjs

@@ -67,6 +67,23 @@
 // the releases page is built from `.changeset/*.md`, and a line in a commit message reaches no reader. A
 // line may instead NAME the note that answers for it, `Release-note: .changeset/<name>.md`, and that is read
 // as an answer, provided the range adds that note.
+//
+// ── A NOTE THE RANGE WITHDRAWS, AND SAYS WHY, IS AN ANSWER ────────────────────────────────────────────
+//
+// A ruling took a beta-only change back out, and the commit that removed it removed the note that
+// announced it too, so the stable changelog would not promise a ceiling the stable release does not have.
+// That deletion is right, and it left two earlier commits naming a note the range no longer carries:
+// refused, and unfixable, because the only fix the check offered was editing commits already pushed.
+//
+// So a note that a LATER commit in the same range DELETES counts as consumed for the commits that added
+// or named it — provided the deleting commit says why, in its own `Release-note: none — <reason>` or in a
+// note of its own. The reason is asked of the DELETING commit because it is the newest of the two, the
+// only one that can still be amended, and the one that knows why the reader now hears nothing. Said, not
+// silent: every commit excused this way is printed with the sha that withdrew its note and that reason.
+//
+// A deletion that gives no reason still refuses, and names the deleting commit as where the reason goes.
+// The move a pre-release makes — `.changeset/<name>.md` deleted and `.changeset/pre/<name>.md` added in
+// one commit — is not a withdrawal: the note still reaches a reader, and a version commit is that shape.
 import { execFileSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
@@ -143,12 +160,14 @@ const shipped = (paths, files) => paths.filter((p) => !NEVER_A_NOTE.some((re) =>
  * PURE. What each commit in a range owes, decided per commit (see the header).
  *
  * @param {object} o
- * @param {Array<{sha:string, subject:string, message:string, paths:string[], added?:string[]}>} o.commits  non-merge,
- *   oldest first; `added` is the paths the commit adds, when the caller read them
+ * @param {Array<{sha:string, subject:string, message:string, paths:string[], added?:string[], deleted?:string[]}>} o.commits
+ *   non-merge, oldest first; `added` and `deleted` are the paths the commit adds and removes, when the caller read them
  * @param {string[]} o.files  the package's own `files` list
  * @param {string[]|null} [o.atHead]  every path the head carries under `.changeset/`, when the caller read it
  * @returns {{visible:string[], notes:string[], declined:Array<{sha:string, subject:string, reason:string}>,
- *   owed:Array<{sha:string, subject:string, why:"no-note"|"prose"|"bare-none"|"names-a-missing-note", paths?:string[], text?:string}>}}
+ *   withdrawals:Array<{sha:string, subject:string, note:string, by:string, reason:string}>,
+ *   owed:Array<{sha:string, subject:string, why:"no-note"|"prose"|"bare-none"|"names-a-missing-note"|"note-withdrawn-unsaid",
+ *   paths?:string[], text?:string, by?:string}>}}
  */
 export function commitVerdicts({ commits = [], files = [], atHead = null } = {}) {
   // `added` and `atHead` are what the command reads from git; a caller that passes neither keeps the older
@@ -172,8 +191,34 @@ export function commitVerdicts({ commits = [], files = [], atHead = null } = {})
   const notes = [...new Set(commits.flatMap(notesOf))];
   const noteNames = new Set(notes.map((p) => p.split("/").pop()));
   const visible = [...new Set(commits.flatMap((c) => shipped(c.paths, files)))];
-  const declined = [], owed = [];
-  for (const c of commits) {
+  const nameOf = (p) => p.split("/").pop();
+  // WHICH NOTES THIS RANGE TAKES BACK, AND WHETHER IT SAYS WHY. A commit that deletes a note path and
+  // adds one of the same name is MOVING it — what a pre-release cut does to every note it consumes — and
+  // a move is not a withdrawal. A name the head still carries was never withdrawn at all.
+  //
+  // THE DELETION THAT ANSWERS IS THE LAST ONE, because a note can go and come back. This note was
+  // written, consumed into `.changeset/pre/` by a beta cut, brought back at its old path by a merge of a
+  // main the cut had already taken it from, dropped again as a duplicate, and only then removed under the
+  // ruling. Taking the first deletion would have printed the duplicate sweep's reason — "removes
+  // duplicates of notes that already shipped" — against a commit the ruling is what excuses. Measured on
+  // the range, 2026-09-18.
+  const withdrawn = new Map();
+  commits.forEach((c, at) => {
+    const readded = new Set((c.added ?? []).filter(isNotePath).map(nameOf));
+    for (const p of (c.deleted ?? []).filter(isNotePath)) {
+      const name = nameOf(p);
+      if (readded.has(name)) continue;
+      const own = notesOf(c).map(nameOf);
+      const reason = NO_NOTE.exec(String(c.message ?? ""))?.groups?.reason
+        ?? (own.length ? `the note ${own[0]} it wrote in its place` : null);
+      withdrawn.set(name, { sha: c.sha, subject: c.subject, reason, at });
+    }
+    for (const name of readded) withdrawn.delete(name);   // a later copy puts the note back in the range
+  });
+  // AND A NAME THE HEAD STILL CARRIES WAS NEVER WITHDRAWN AT ALL: the release assembles what the head has.
+  if (presentNames) for (const name of [...withdrawn.keys()]) if (presentNames.has(name)) withdrawn.delete(name);
+  const declined = [], owed = [], withdrawals = [];
+  for (const [i, c] of commits.entries()) {
     const ships = shipped(c.paths, files);
     if (!ships.length) continue;                              // nothing a reader could see in this commit
     const addsNote = notesOf(c).length > 0;
@@ -189,13 +234,24 @@ export function commitVerdicts({ commits = [], files = [], atHead = null } = {})
       continue;
     }
     if (addsNote) continue;                                   // it carries its own note
+    // THE NOTE THIS COMMIT ANSWERED WITH, TAKEN BACK BY A LATER ONE. Only a later commit: a name deleted
+    // before this commit named it was never this commit's answer.
+    const addedNames = [...new Set((c.added ?? c.paths).filter(isNotePath).map(nameOf))];
+    const takenBack = [...new Set([...addedNames, ...named])]
+      .map((n) => [n, withdrawn.get(n)]).filter(([, w]) => w && w.at > i);
+    const said = takenBack.find(([, w]) => w.reason);
+    if (said) { withdrawals.push({ ...at, note: said[0], by: said[1].sha, reason: said[1].reason }); continue; }
+    if (takenBack.length) {
+      owed.push({ ...at, why: "note-withdrawn-unsaid", text: takenBack[0][0], by: takenBack[0][1].sha });
+      continue;
+    }
     const missing = named.filter((n) => !noteNames.has(n));
     if (missing.length) { owed.push({ ...at, why: "names-a-missing-note", text: missing[0] }); continue; }
     if (named.length) continue;                               // it names a note the range adds
     if (notes.length) continue;                               // a note in the range answers for it
     owed.push({ ...at, why: "no-note", paths: ships });
   }
-  return { visible, notes, declined, owed };
+  return { visible, notes, declined, withdrawals, owed };
 }
 
 const argAfter = (flag) => {
@@ -232,6 +288,7 @@ function main() {
       message: git("log", "-1", "--format=%B", sha),
       paths: git("diff-tree", "--no-commit-id", "--name-only", "-r", "--root", sha).split("\n").filter(Boolean),
       added: git("diff-tree", "--no-commit-id", "--name-only", "-r", "--root", "--diff-filter=A", sha).split("\n").filter(Boolean),
+      deleted: git("diff-tree", "--no-commit-id", "--name-only", "-r", "--root", "--diff-filter=D", sha).split("\n").filter(Boolean),
     }));
     atHead = git("ls-tree", "-r", "--name-only", head, "--", ".changeset/").split("\n").filter(Boolean);
   } catch (e) {
@@ -245,13 +302,19 @@ function main() {
   catch (e) { console.error(`release-note-required: cannot read the shipped file list: ${e.message}`); process.exit(2); }
   if (!files.length) { console.error("release-note-required: package.json names no shipped files, so this cannot look"); process.exit(2); }
 
-  const { visible, notes, declined, owed } = commitVerdicts({ commits, files, atHead });
+  const { visible, notes, declined, withdrawals, owed } = commitVerdicts({ commits, files, atHead });
   console.log(`release-note-required: ${changed.length} changed file(s) against ${base}`
     + `${head === "HEAD" ? "" : ` (head ${head})`}; `
-    + `${visible.length} ship as code; ${notes.length} release note(s) in the range; ${commits.length} commit(s) read`);
+    + `${visible.length} ship as code; ${notes.length} release note(s) in the range; ${commits.length} commit(s) read`
+    + `${withdrawals.length ? `; ${withdrawals.length} answered by a note the range withdrew` : ""}`);
   // PER COMMIT, SAID AS PER COMMIT. "no note, declared on purpose" read as a verdict on the range, and beside
   // a range that carries a note it told a reader skimming the output that none went out. Found in review.
   for (const d of declined) console.log(`  ${d.sha.slice(0, 7)} declines a note of its own, on purpose: ${d.reason}`);
+  // AN EXCUSED COMMIT IS PRINTED, WITH THE SHA THAT EXCUSED IT. A pass this check reached by reading
+  // another commit's decision is one a person may want to disagree with, and they cannot if it is silent.
+  for (const w of withdrawals) {
+    console.log(`  ${w.sha.slice(0, 7)} answered with ${w.note}, which ${w.by.slice(0, 7)} withdrew: ${w.reason}`);
+  }
   if (!owed.length) return;
 
   console.error(`\n${owed.length} commit(s) that ship as code owe a release note:\n`);
@@ -267,6 +330,11 @@ function main() {
     } else if (o.why === "bare-none") {
       console.error("      says `Release-note: none` and gives no reason. The reason is the whole point of the"
         + "\n      line — it is what a later reader uses to tell a considered decision from a skipped step.");
+    } else if (o.why === "note-withdrawn-unsaid") {
+      console.error(`      answered with ${o.text}, which ${o.by.slice(0, 7)} deletes in this range without saying why.`
+        + "\n      A note the head does not carry reaches no reader. If the change it described went out of the"
+        + "\n      release too, say that in THAT commit — `Release-note: none — <why>` — which is the newest of"
+        + "\n      the two and the one that can still be amended.");
     } else {
       console.error(`      names ${o.text} as its note, and this range adds no note by that name.`);
     }

package/scripts/report-header-render-check.mjs

@@ -0,0 +1,164 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+// report-header-render-check.mjs — the delivered document's own header, measured in a browser.
+//
+//   node scripts/report-header-render-check.mjs [--keep]
+//
+// Two properties, both of which a reader met as defects on 2026-09-18 and neither of which any unit test
+// can see, because every one of them asserts on the HTML STRING and both of these are layout:
+//
+//   1. ONE HEADER. The section breadcrumb is a row INSIDE `.rep-stickyhead`, and when the page is
+//      scrolled the header is still at the top of the viewport with the breadcrumb inside it. It used to
+//      be a sibling pinned at `top:var(--tb-h,52px)` — a variable this product sets nowhere — so it sat
+//      at a guessed offset, showed content through the slit between the two bars, and slid under the
+//      header whenever the guess was wrong.
+//   2. THE BAND PILL CLEARS ITS HEADING. The pill hangs above the ladder and the heading sits above the
+//      pill, and at the LEFTMOST band the pill is drawn flush left — directly under "Overall risk". They
+//      overlapped, which is what a reader meets on a knockout whose band is the bottom rung.
+//
+// Driven at every rung of the ladder, not only the one a fixture happens to carry: the overlap is a
+// property of the leftmost position, so a check that renders one band proves nothing about the band the
+// next report lands on.
+import { spawn } from 'node:child_process'
+import { createServer } from 'node:http'
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { reapOnExit } from '../shared/reap-on-exit.mjs'
+import { browserRun } from '../shared/browser-temp-root.mjs'
+import { renderKnockoutHtml } from '../driver/publish/render-knockout.mjs'
+
+const keep = process.argv.includes('--keep')
+const WIDTH = 1280
+
+// The ladder the house triage framework ships, so the rungs are the product's own and not invented here.
+const FRAMEWORK = {
+  framework_key: 'house-triage',
+  title: 'House triage',
+  bands: [{ label: 'Blocking', tone: 'severe' }, { label: 'Medium', tone: 'medium' },
+    { label: 'Manageable', tone: 'low' }, { label: 'Low', tone: 'minimal' }],
+}
+const BANDS = FRAMEWORK.bands.map((b) => b.label)
+
+// A mark with the STRUCTURE the gauge card needs — a basis and factors are what make `readBlock` draw the
+// card at all. The words are fixture words; nothing here is a finding.
+const markAt = (band) => ({
+  name: 'EXAMPLEMARK',
+  rating: band,
+  classes: [9],
+  basis: 'One identical name in the same trade, and two that contain it.',
+  factors: ['An identical name is registered in class 9.', 'The trade is the same.'],
+  counterFactors: ['The register counts do not say who is using what.'],
+  mitigation: 'A narrower specification would move this.',
+  assessment: '## What the screen found\n\nOne identical name.\n\n## What happens next\n\nTake it to clearance.',
+  findings: [],
+})
+
+const docFor = (band) => renderKnockoutHtml(
+  { marks: [markAt(band)], batch: { executiveSummary: 'One name screened.' } },
+  FRAMEWORK,
+  { runId: 'fixture', overall: band, identity: { identity: 'Knockout search' }, issuedDate: '2026-09-18' },
+)
+
+const dir = mkdtempSync(join(tmpdir(), 'report-header-check-'))
+for (const band of BANDS) writeFileSync(join(dir, `${band.toLowerCase()}.html`), docFor(band))
+
+const server = createServer((req, res) => {
+  const name = decodeURIComponent((req.url ?? '/').split('?')[0]).replace(/^\//, '')
+  try {
+    res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' })
+    res.end(docFor(BANDS.find((b) => b.toLowerCase() === name.replace(/\.html$/, '')) ?? BANDS[0]))
+  } catch { res.writeHead(404); res.end('no') }
+})
+await new Promise((r) => server.listen(0, '127.0.0.1', r))
+const origin = `http://127.0.0.1:${server.address().port}`
+
+const { profile, env: chromeEnv, keep: keepRoot } = browserRun('report-header-check-')
+if (keep) keepRoot()
+const chrome = spawn('google-chrome', [
+  '--headless=new', '--disable-gpu', '--no-sandbox', '--hide-scrollbars',
+  '--host-resolver-rules=MAP * ~NOTFOUND, EXCLUDE 127.0.0.1',
+  `--user-data-dir=${profile}`, `--window-size=${WIDTH},900`, '--remote-debugging-port=0', 'about:blank',
+], { stdio: ['ignore', 'ignore', 'pipe'], detached: true, env: chromeEnv })
+reapOnExit(chrome)
+
+const wsUrl = await new Promise((resolve, reject) => {
+  let devtools = ''
+  const t = setTimeout(() => reject(new Error(`chrome reported no devtools endpoint in 60s:\n${devtools || '(nothing)'}`)), 60000)
+  chrome.stderr.on('data', (c) => { devtools += c; const m = devtools.match(/ws:\/\/[^\s]+/); if (m) { clearTimeout(t); resolve(m[0]) } })
+})
+const ws = new WebSocket(wsUrl)
+let id = 0
+const pending = new Map()
+ws.addEventListener('message', (e) => { const m = JSON.parse(e.data); if (m.id && pending.has(m.id)) { pending.get(m.id)(m); pending.delete(m.id) } })
+await new Promise((r) => ws.addEventListener('open', r))
+const send = (method, params = {}) => new Promise((r) => { const i = ++id; pending.set(i, r); ws.send(JSON.stringify({ id: i, method, params })) })
+const { result: targets } = await send('Target.getTargets')
+const page = targets.targetInfos.find((t) => t.type === 'page')
+const { result: sess } = await send('Target.attachToTarget', { targetId: page.targetId, flatten: true })
+const sessionId = sess.sessionId
+const cmd = (method, params) => new Promise((r) => { const i = ++id; pending.set(i, r); ws.send(JSON.stringify({ id: i, sessionId, method, params })) })
+const value = async (expr) => (await cmd('Runtime.evaluate', { expression: expr, awaitPromise: true, returnByValue: true })).result?.result?.value ?? null
+
+// MEASURED OFF RECTANGLES, never off a class name: a rule that is present and overridden and a rule that
+// works look identical to a selector, and the whole subject here is which one is true.
+const PROBE = `(async () => {
+  const sleep = (ms) => new Promise(r => setTimeout(r, ms));
+  window.scrollTo(0, 0); await sleep(60);
+  const head = document.querySelector('.rep-stickyhead');
+  const strip = document.querySelector('nav.strip');
+  const label = document.querySelector('.ko-gauge .label');
+  const pill = document.querySelector('.kpill');
+  if (!head || !strip) return { drawn: false, head: !!head, strip: !!strip };
+  const r = (el) => { const b = el.getBoundingClientRect(); return { top: b.top, bottom: b.bottom, left: b.left, height: b.height }; };
+  const out = {
+    drawn: true,
+    inside: head.contains(strip),
+    labelled: (strip.textContent || '').replace(/\\s+/g, ' ').trim(),
+    pill: pill ? r(pill) : null,
+    label: label ? r(label) : null,
+    pillText: pill ? (pill.textContent || '').trim() : null,
+  };
+  // Scroll well past the header and read again: what stays is what a reader keeps.
+  window.scrollTo(0, 1200); await sleep(120);
+  out.scrolled = { head: r(head), strip: r(strip), scrollY: window.scrollY };
+  return out;
+})()`
+
+const fail = []
+const ok = []
+for (const band of BANDS) {
+  await cmd('Page.navigate', { url: `${origin}/${band.toLowerCase()}.html` })
+  await new Promise((r) => setTimeout(r, 700))
+  const m = await value(PROBE)
+  const where = `band ${band}`
+  if (!m || !m.drawn) { fail.push(`${where}: the document drew no header or no breadcrumb (${JSON.stringify(m)})`); continue }
+
+  // 1 — one header
+  if (!m.inside) fail.push(`${where}: the breadcrumb is not inside .rep-stickyhead`)
+  else ok.push(`${where}: breadcrumb inside the header — "${m.labelled}"`)
+
+  const s = m.scrolled
+  if (!(s.scrollY > 300)) fail.push(`${where}: the page did not scroll (scrollY ${s.scrollY}) — the pin was not tested`)
+  else if (Math.abs(s.head.top) > 1) fail.push(`${where}: the header did not pin (top ${s.head.top.toFixed(1)} at scrollY ${s.scrollY})`)
+  else if (s.strip.top < s.head.top - 1 || s.strip.bottom > s.head.bottom + 1)
+    fail.push(`${where}: the breadcrumb left the header under scroll (strip ${s.strip.top.toFixed(1)}–${s.strip.bottom.toFixed(1)}, header ${s.head.top.toFixed(1)}–${s.head.bottom.toFixed(1)})`)
+  else ok.push(`${where}: header pinned at 0 with the breadcrumb inside it at scrollY ${s.scrollY}`)
+
+  // 2 — the band pill clears its heading
+  if (!m.pill || !m.label) fail.push(`${where}: the band card drew no pill or no heading`)
+  else if (m.pill.top < m.label.bottom)
+    fail.push(`${where}: the "${m.pillText}" pill overlaps the heading by ${(m.label.bottom - m.pill.top).toFixed(1)}px`)
+  else ok.push(`${where}: the "${m.pillText}" pill clears the heading by ${(m.pill.top - m.label.bottom).toFixed(1)}px`)
+}
+
+for (const line of ok) console.log(`  ok   ${line}`)
+for (const line of fail) console.log(`  FAIL ${line}`)
+try { ws.close() } catch { /* the browser is going anyway */ }
+try { process.kill(-chrome.pid, 'SIGKILL') } catch { /* already gone */ }
+server.close()
+if (!keep) rmSync(dir, { recursive: true, force: true })
+console.log(fail.length
+  ? `\nreport-header-render-check: ${fail.length} measurement(s) failed.`
+  : `\nreport-header-render-check: ${ok.length} measurements, all clear.`)
+process.exit(fail.length ? 1 : 0)

package/shared/brand.mjs

@@ -174,6 +174,33 @@ export const ADMINISTRATOR_CONTACT = administratorContact(process.env.CLEAROTRON
 // at all. Absent still means the default, never nothing.
 export const CONF_DEFAULT = 'Privileged & Confidential';
 
+/**
+ * THE APPROVED BOARDS' SECTION STRIP, filtered against the document it will sit in.
+ *
+ * Both report renderers draw one and each has its own board: the clearance kinds five entries, the
+ * knockout four, and the knockout's third points at the filings section while reading "Also considered".
+ * So the ENTRIES belong to each board and the RULE belongs here, because the rule is the part that is
+ * easy to get wrong the same way twice.
+ *
+ * The rule: a board is a specimen where every section exists, and a renderer draws several of them only
+ * when there is something to draw. A strip emitted whole would point a reader at anchors that resolve to
+ * nothing, which is worse than the missing strip it replaces. So it is composed from the FINISHED html by
+ * asking which anchors are in it — the document decides, and a section that stops being drawn takes its
+ * own entry with it without anyone remembering to.
+ *
+ * ONE ENTRY IS NOT A NAVIGATION. A strip pointing only at the top of the page is a control that does
+ * nothing, so below two entries it is not drawn at all.
+ *
+ * @param {string} html the assembled document
+ * @param {ReadonlyArray<readonly [string, string]>} entries [anchor id, label], in the board's order
+ */
+export function sectionStrip(html, entries) {
+  const live = (entries ?? []).filter(([id]) => String(html).includes(`id="${id}"`));
+  if (live.length < 2) return '';
+  return `<nav class="strip no-print">${live.map(([id, label], i) =>
+    `<a href="#${id}" data-sec="${id}"${i === 0 ? ' class="now"' : ''}><i></i>${label}</a>`).join('')}</nav>`;
+}
+
 export function confPosture(delivery) {
   const p = delivery == null ? null : delivery.privileged;
   return p === false ? '' : CONF_DEFAULT;

package/shared/connect-clients.mjs

@@ -398,15 +398,40 @@ export const leadRouteFor = (id) => {
  * invitation to paste it inside WSL, where it does not work. Somebody took the invitation from Claude
  * Code inside a distribution and got CONNECTION_CLOSED (measured 2026-09-16 on 0.3.2-beta.1).
  *
- * There is exactly ONE launcher per host shape today, and under WSL it is the Windows-side one, so this
- * step names the side it is for rather than offering both. Building the second launcher — the plain
- * `node` line for an assistant running inside the distribution — is its own piece of work; until it
- * exists, saying which side this one is for is the whole of what can honestly be said.
+ * AND NOW IT SAYS ONLY THAT THE INSTALL IS IN WSL, because the rows below it say the rest.
+ *
+ * While there was one launcher, this step carried which side it was for and that the other side could
+ * not use it. Both sides are now offered, each headed with the side it is for, and those two sentences
+ * turned false where they stand: the reader is told an assistant inside the distribution cannot connect,
+ * directly above the row that connects it. What is left is the clause that is still true and still
+ * needed — the rows name Linux paths and the reader has to know why. The rest is DELETED rather than
+ * reworded, because the headings already say it and nothing here is ours to write.
  */
-export const WSL_STEP = "This install runs inside WSL, and the command below starts the server in there for you. "
-  + "It is for an assistant running on the Windows side — Claude Desktop, or Claude Code in PowerShell. "
-  + "An assistant running inside this WSL terminal cannot use it: start the server from the WSL terminal "
-  + "yourself instead.";
+export const WSL_STEP = "This install runs inside WSL.";
+
+/**
+ * ONE ROW PER SIDE, where a launcher has two.
+ *
+ * `stdioConnectFor` answers a WSL install with both launchers under `variants`, headed in the product's
+ * own words. Each becomes a row of its own here, carrying its side's heading as the row's line and its
+ * side's command as the row's copy — so the reader sees which command is theirs before they press it,
+ * and does not paste the Windows one into a terminal already inside the distribution.
+ *
+ * The heading takes the row's line rather than a slot of its own: every surface that draws a step draws
+ * that line already — the page above the copy block, the terminal beside the number — so both sides get
+ * the headings from one author and neither needs new markup to show them.
+ *
+ * Anywhere else this is the identity. One launcher stays one row, with the line its author wrote.
+ */
+const splitSides = (step) => {
+  const variants = step.copy?.stdio?.variants;
+  if (!variants) return [step];
+  return variants.map((v) => ({
+    ...step,
+    text: v.heading,
+    copy: { ...step.copy, text: v.text, stdio: { ...step.copy.stdio, text: v.text, variants: null } },
+  }));
+};
 
 export function whatItNeeds(client, have = {}, route = client?.lead) {
   if (!client) return null;
@@ -494,10 +519,13 @@ export function whatItNeeds(client, have = {}, route = client?.lead) {
     // ON WSL, "THIS COMPUTER" IS THE LINUX INSIDE WINDOWS. The line names WSL paths, so it runs in the WSL
     // terminal where Clearotron is installed. Pasted into PowerShell it fails, and an assistant running on
     // Windows itself could not start a program at a Linux path anyway.
-    if (have.wsl) steps.unshift({ text: WSL_STEP });
-    const first = steps.find((s) => s.copy)?.copy;
+    // AND A LAUNCHER WITH TWO SIDES BECOMES TWO ROWS, under the step that says this install is in WSL.
+    const rows = steps.flatMap(splitSides);
+    if (have.wsl) rows.unshift({ text: WSL_STEP });
+    // The Windows-side row leads, so `command` and `stdio` answer what they have always answered.
+    const first = rows.find((s) => s.copy)?.copy;
     // `command` and `stdio` ride for the terminal, which prints a disk offer's copy by its shape.
-    return { client, served: true, route, steps, launch: client.launch ?? null, enables: null, ...evidence,
+    return { client, served: true, route, steps: rows, launch: client.launch ?? null, enables: null, ...evidence,
       command: first?.text ?? null, stdio: first?.stdio ?? null, address: null, key: null,
       note: "Nothing to sign up for and nothing to open up — this assistant runs the software itself, from the copy already on this machine." };
   }

package/shared/env-aliases.mjs

@@ -2,7 +2,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // env-aliases.mjs — ONE SPELLING, and the settings that no longer exist at all.
 //
-// A variable name must mean something to someone who has never read this code. `PRELIM` names nothing
+// A variable name must mean something to someone who has never read this code. `CLEARANCE` names nothing
 // to anyone — it is the internal codename of the first product this engine shipped — so the names an
 // installer types are `CLEAROTRON_*`. Vendor keys are deliberately untouched: `SIGNA_API_KEY` already
 // says who you bought it from.

package/shared/identifier-scan.mjs

@@ -17,6 +17,7 @@
 // private roster). This file owns only the matching — it names no identity of its own beyond the
 // platform tokens ALLOWED_CONTEXT has to spell out, which is why it declares itself in
 // DECLARATION_SOURCES.
+import { createHash } from "node:crypto";
 
 // ── the platform and public-register exemption ────────────────────────────────────────────────────
 //
@@ -72,6 +73,26 @@ export const ALLOWED_TOKEN_CONTEXT =
 
 export const ALLOWED_LINE_CONTEXT = /owner-bound|watchlist owner/i;
 
+// ── THE CLOUD, AS A BILLING ROUTE ──────────────────────────────────────────────────────────────────
+//
+// Claude can be paid for through a cloud account, and one of the three clouds is Azure. The roster
+// retires the same word as a client, so every sentence about paying through that cloud was refused as a
+// retired identity: 67 of the 99 hits over the tree on 2026-09-18, and 11 lines of a release's squash
+// message.
+//
+// EXACTLY AS WIDE AS THE EVIDENCE, AND NO WIDER. Only the names the product itself ships for that route
+// are exempt: the cloud's name, its Foundry service, and the three clouds named as a list. Case-sensitive,
+// because that is how the product spells them. The bare word is never exempt, in any casing, and a
+// sentence that used it as shorthand for the cloud was reworded to say Azure instead.
+//
+// AND NOT IN CAPTURED DATA. A frozen demo run and a captured register fixture hold third parties' own
+// text: a course title that happens to name the cloud is not a billing route, so there the rule does not
+// apply and the hit is reported as it always was.
+export const CLOUD_ROUTE_CONTEXT = /\bMicrosoft Azure\b|\bMicrosoft Foundry\b|\bGoogle(?: Cloud)?,\s+Microsoft(?: Azure)?\s+or\b/;
+
+/** A frozen demo run, anywhere under `demo/<product>/run/`: what the engine read, captured whole. */
+const FROZEN_RUN_RE = /(?:^|\/)demo\/[^/]+\/run\//;
+
 /**
  * Kept as the union so nothing that merely ASKS "is this line exempt at all" has to learn the split.
  * Callers deciding whether to REPORT a hit must use the two above — this one cannot tell you which
@@ -155,20 +176,27 @@ export function matchSpans(name, line, suffixable) {
  *
  * Takes the RAW line and does its own unescaping, so no caller can forget that step.
  */
-export function reportableOnLine(name, rawLine, suffixable) {
+export function reportableOnLine(name, rawLine, suffixable, { cloudRoute = true } = {}) {
   if (ALLOWED_LINE_CONTEXT.test(rawLine)) return false;
   const text = unescapeBoundaries(rawLine);
-  return matchSpans(name, text, suffixable).some((sp) => !tokenExemptionCovers(text, sp));
+  return matchSpans(name, text, suffixable).some((sp) => !tokenExemptionCovers(text, sp, { cloudRoute }));
 }
 
-function tokenExemptionCovers(line, span) {
-  for (const m of String(line).matchAll(new RegExp(ALLOWED_TOKEN_CONTEXT.source, "gi"))) {
-    const s = m.index, e = m.index + m[0].length;
-    if (span.start < e && s < span.end) return true;   // overlap, in either direction
+function tokenExemptionCovers(line, span, { cloudRoute = true } = {}) {
+  const contexts = [new RegExp(ALLOWED_TOKEN_CONTEXT.source, "gi")];
+  if (cloudRoute) contexts.push(new RegExp(CLOUD_ROUTE_CONTEXT.source, "g"));
+  for (const rx of contexts) {
+    for (const m of String(line).matchAll(rx)) {
+      const s = m.index, e = m.index + m[0].length;
+      if (span.start < e && s < span.end) return true;   // overlap, in either direction
+    }
   }
   return false;
 }
 
+/** Whether the cloud-route exemption applies in this file: everywhere but captured third-party data. */
+export const cloudRouteApplies = (file) => !isCapturedRegisterData(file) && !FROZEN_RUN_RE.test(String(file ?? ""));
+
 // ── CAPTURED PUBLIC-REGISTER DATA ─────────────────────────────────────────────────────────
 //
 // `providers/*/test/fixtures/` holds vendor responses captured live from public trademark registers.
@@ -208,6 +236,32 @@ export const CAPTURED_DATA_GUIDANCE =
   + "`node scripts/check-capture.mjs <file>` before writing; or (b) a genuine identifier of ours — remove "
   + "it. Do NOT exempt the path: captured data is the one place a real identifier could hide unseen.";
 
+// ── A PUBLISHED DICTIONARY, PINNED TO ITS BYTES ─────────────────────────────────────────────
+//
+// The roster retires ordinary English words, and a dictionary is every ordinary English word, so the
+// two collide by construction and, like captured register data, the collision arrives on a tree
+// nobody touched: the private roster gains an entry and the word list goes red. Unlike captured data,
+// nothing of ours can be in it. It is a published third-party list (the file's header names it and its
+// licence) that no client, matter or run ever wrote to.
+//
+// SO THE EXEMPTION IS FOR THESE BYTES, NOT THIS PATH. Each entry pins the file's SHA-256 as it was
+// vetted. Change one line, a name slipped in among the words, and the hash no longer matches: the file
+// is scanned in full again like any other, and the pin moves only in a commit that says it re-vetted.
+// A name hidden in a dictionary is therefore still a finding, and a name anywhere else never was
+// exempt.
+export const PINNED_DICTIONARIES = Object.freeze({
+  "driver/wordlists/en.txt": Object.freeze({
+    sha256: "8021ad10f94da2a549f60db93fcf761156458fd682e1095e81f93db6843fb636",
+    what: "SCOWL size 50, American: the one-letter neighbourhood filter's ordinary-word list",
+  }),
+});
+
+/** Is this file a pinned dictionary whose bytes are exactly the ones that were vetted? */
+export function isPinnedDictionary(file, text) {
+  const pin = PINNED_DICTIONARIES[String(file ?? "")];
+  return Boolean(pin) && createHash("sha256").update(String(text)).digest("hex") === pin.sha256;
+}
+
 /**
  * Sweep a corpus for retired identities.
  *
@@ -227,6 +281,7 @@ export function scanCorpus(files, readFn, { retired, suffixable, vetted = () =>
   for (const f of files) {
     const t = readFn(f);
     if (!t) continue;
+    if (isPinnedDictionary(f, t)) continue;
     // In captured register data the hit is reported by ENTRY NUMBER, never by value. The
     // ordinary format prints the retired name and its twin, which is right where the fix is "delete
     // this" — but a fixture collision is expected to fire on a tree nobody changed, and printing the
@@ -239,7 +294,7 @@ export function scanCorpus(files, readFn, { retired, suffixable, vetted = () =>
         entry += 1;
         // A LINE-scoped exemption skips the line; a TOKEN-scoped one must OVERLAP the match it excuses.
         // Both live in reportableOnLine, so the declaration test cannot answer this differently.
-        if (!reportableOnLine(name, line, suffixable)) continue;
+        if (!reportableOnLine(name, line, suffixable, { cloudRoute: cloudRouteApplies(f) })) continue;
         if (vetted(f, name)) continue;
         hits.push(captured
           ? `${f}:${i + 1}: match table entry #${entry} of ${retired.length} (sentinels first, then the roster) `
@@ -302,8 +357,8 @@ const ADDRESS = /([A-Za-z0-9._%+-]+)@(?:cordillera\.(?:ch|test)|clearotron\.ai)\
 const INTERNAL_MARKER = /\bINTERNAL[ -]ONLY\b/;
 const INTERNAL_PHRASE = /\bfor internal use only\b/i;
 
-// THE SECOND STAMPED FORM, and is why it exists. `driver/skills/prelim-search/worked-examples.md`
-// opened with `INTERNAL — Gold-standard worked examples for prelim-search SYNTHESIS.` and shipped: the
+// THE SECOND STAMPED FORM, and is why it exists. `driver/skills/clearance-search/worked-examples.md`
+// opened with `INTERNAL — Gold-standard worked examples for clearance-search SYNTHESIS.` and shipped: the
 // marker above requires the word ONLY, and a document stamped `INTERNAL —` carries the identical
 // classification without it.
 //
@@ -361,6 +416,7 @@ export function scanOperatorIdentity(files, readFn, { withheld = () => false } =
   for (const f of files) {
     const t = readFn(f);
     if (!t) continue;
+    if (isPinnedDictionary(f, t)) continue;
     // A WITHHELD PATH DOES NOT SHIP, and pattern 4 is about what a shipped surface says to its reader.
     // The withheld design tree holds twenty-one hits of exactly this shape and every one is correct in
     // place: working notes, withheld wholesale by the list in shared/withheld-paths.mjs, and rewriting

package/shared/identifier-sentinels.mjs

@@ -32,3 +32,25 @@ export const SENTINELS = [
 // and `Brindlow-Reach`. One row carries it so the option itself is exercised rather than merely
 // declared — an unexercised option is a setting nobody has watched work.
 export const SUFFIXABLE = new Set(["Brindlow"]);
+
+/**
+ * WHICH TABLE THE SWEEP WAS ARMED WITH, said out loud so a workflow can require it.
+ *
+ * The public tree can only ever run this sweep in sentinel mode — the real roster lives outside the
+ * repository by design, and the arm that sweeps here is wired to SENTINELS by construction. That is
+ * fine, and it is exactly why the mode has to be stated: a sweep with an empty table returns the same
+ * clean zero as a sweep that worked, so "it ran, and here is which table it ran against" is the only
+ * form of the claim a reader can act on.
+ *
+ * It is printed by the arm that actually sweeps the corpus, never at import. A marker that appeared
+ * merely because a module was loaded would survive the arm being deleted, which is the one thing it
+ * exists to catch — the guard stopping and every run staying green.
+ */
+export const SENTINEL_MODE_MARKER = "[repo-guard] blocklist mode=sentinel";
+
+/**
+ * The line the sweep prints when it read a REAL roster instead. That roster is private and never
+ * reaches this repository's runners by design, so on a public run the line does not mean a stronger
+ * check: it means the roster was loaded into a public log. The workflow refuses it.
+ */
+export const TABLE_MODE_MARKER = "[repo-guard] blocklist mode=table";

package/shared/names-in-force.mjs

@@ -3,7 +3,7 @@
 // names-in-force.mjs — GENERATED by scripts/mint-names-in-force.mjs. Do not edit by hand.
 //
 // Every `CLEAROTRON_*` name this build reads. It exists so the retired-spelling check can name the
-// replacement for an old `PRELIM_*` line rather than only saying the old one is dead — see
+// replacement for an old `CLEARANCE_*` line rather than only saying the old one is dead — see
 // shared/env-aliases.mjs. Re-mint with:
 //
 //   node scripts/mint-names-in-force.mjs
@@ -40,7 +40,9 @@ export const NAMES_IN_FORCE = Object.freeze([
   "CLEAROTRON_COMMONLAW_SPLIT",
   "CLEAROTRON_COUNT_FIRST",
   "CLEAROTRON_CUSTOMERS_DIR",
+  "CLEAROTRON_CUT_PR",
   "CLEAROTRON_CUT_REF",
+  "CLEAROTRON_CUT_REQUESTED",
   "CLEAROTRON_DATABASE",
   "CLEAROTRON_DEFAULT_AGENT",
   "CLEAROTRON_DELIVERY",