clearotron 0.3.3-beta.0 → 0.3.3

package/bin/onboard.mjs

@@ -98,7 +98,7 @@ import {
 // REGISTER_PROVIDER frozen at first import) is the one `preflightCandidate` below already cache-busts
 // around, and it is cache-busted whether or not this static import happened first.
 import { config, ENGINE_BINARIES, DEFAULT_ENGINE_ID, RESEARCH_PROVIDERS, SERP_PROVIDERS, resolveEngineProgram, ON_A_WINDOWS_DRIVE,
-  enginesFolder, engineInstallArgs, engineInstallCommand } from "../driver/driver.config.mjs";
+  enginesFolder, engineInstallArgs, engineInstallCommand, olderThanFloor } from "../driver/driver.config.mjs";
 import { resolveAuthMode, CLOUD_SWITCH, CLOUD_SETTINGS, CLOUD_SECRETS, cloudsSwitchedOn } from "../driver/engine/auth.mjs";
 import { isInsideCheckout } from "../shared/inside-checkout.mjs";   // — one copy of the rule, and it is testable
 import { packagedBuild as sharedPackagedBuild } from "../shared/packaged-build.mjs";   // — one reader of build-info.json, reachable from the driver
@@ -1105,6 +1105,25 @@ function programProblem(bin, named) {
   return null;
 }
 
+// WHAT A COPY BELOW THE FLOOR DOES TO THE MODELS WAS MEASURED ON CLAUDE ALONE (2026-09-22): it refuses the
+// newest model of a tier and serves the one before. Codex's floor records no such measurement, so an old
+// Codex is named by its version, the floor and the fix, and nothing is said about which model it runs.
+export const floorRefusesNewestModel = (eng) => Boolean(eng?.package) && eng.package === ENGINE_BINARIES["anthropic-agent"]?.package;
+
+/**
+ * What doctor and setup say after the version of a copy below the floor: what it costs, where that was
+ * measured, and the fix. ONE COPY FOR BOTH SCREENS, so the two cannot drift apart again (ruling 285).
+ *
+ * The fix follows where the copy came from. A copy Clearotron installed moves with `update`. Any other
+ * copy wins over one setup installs, by design, so installing another does not replace it: the fix is
+ * to update it, or to name a newer one in the engine's setting.
+ */
+export function belowFloorTail(eng, bin) {
+  const cost = floorRefusesNewestModel(eng) ? `The newest ${eng.product} models need a newer version. Searches run on an older model instead, or stop at the first step if they name the newest one exactly. ` : "";
+  const fix = bin?.source === "installed" ? `Update it with \`${invoke("update")}\`.` : `Update it, or set ${eng.env} to a newer copy.`;
+  return cost + fix;
+}
+
 /**
  * What setup found of one engine's program, as its menu row says it; "" when nothing was looked for. A copy
  * that cannot run is a problem, not an absence, and installing another is not always the fix, so the row
@@ -1113,7 +1132,14 @@ function programProblem(bin, named) {
  */
 export function foundWords(eng, bin) {
   if (!bin) return "";
-  if (bin.executable && !bin.relative) return bin.version ? `found on this computer (version ${bin.version})` : "found on this computer";
+  if (bin.executable && !bin.relative) {
+    // A COPY THAT RUNS IS NOT NECESSARILY ONE THIS BUILD CAN USE. Below the floor the program refuses
+    // the newest model of a tier and serves the one before it, so the row cannot say "found" and leave
+    // it there; it says which problem, and choosing the engine shows the fix, as the other problems do.
+    if (olderThanFloor(bin.version, eng.floor) === true)
+      return `problem: the copy of ${eng.product} here is version ${bin.version}; Clearotron needs ${eng.floor} or newer — choose it to see the fix`;
+    return bin.version ? `found on this computer (version ${bin.version})` : "found on this computer";
+  }
   const p = programProblem(bin, bin.explicit);
   if (p?.kind === "incomplete") return `problem: the copy of ${eng.product} here is incomplete and won't run — choose it to see the fix`;
   if (p?.kind === "setting") return `problem: this computer is set to use a copy of ${eng.product} that isn't there — choose it to see the fix`;
@@ -1129,6 +1155,12 @@ export function foundWords(eng, bin) {
  */
 export function cannotRunLine(eng, bin, setting = "") {
   const set = namedSetting(eng, setting);
+  // ANSWERED BEFORE THE REST, because a copy below the floor RUNS: it is executable, nothing rejected
+  // it, and every clause below is about a copy that cannot start. Left to them it would fall through to
+  // the general clause and be described as unusable, which sends the reader to look for a broken
+  // install they do not have. The fix here is a version, not a repair.
+  if (bin?.executable && !bin?.relative && olderThanFloor(bin.version, eng.floor) === true)
+    return `${eng.product} on this computer is version ${bin.version}. Clearotron needs ${eng.floor} or newer. ${belowFloorTail(eng, bin)}`;
   const p = programProblem(bin, set);
   if (p?.kind === "incomplete") return `The copy of ${eng.product} at ${p.path} is incomplete: its installation stopped before the program was added. Setup can install a working copy.`;
   if (p?.kind === "setting") return `This computer is set to use ${eng.product} at ${set}, and nothing there can run. Setup can install ${eng.product} and use that instead.`;
@@ -1761,10 +1793,26 @@ export async function runCheck() {
     const bin = resolveEngineBin(binSetting, { engine: engineId });
     // WHICH COPY, AND ITS VERSION, because the machine's own install and the one Clearotron installed
     // are both legitimate and behave differently: the first updates itself, the second moves with
-    // `clearotron update`. The version comes from the copy's own package.json when npm installed it;
-    // doctor spawns nothing to ask (a vendor's own native installer leaves no package.json to read).
+    // `clearotron update`. The version comes from the copy's own package.json when npm installed it.
+    //
+    // AND IS ASKED FOR WHEN THERE IS NONE TO READ, which is the ordinary case for a copy the machine
+    // installed by another route — a vendor's native installer leaves no package.json. Doctor used to
+    // stop there and print "version not read", which was honest and made the floor comparison below
+    // unanswerable on the route most machines take: this command could not tell an operator whether
+    // their own copy was new enough for the models a run asks for, which is the whole of what it was
+    // asked to check.
+    //
+    // It is the same short call setup's engine menu already makes (menuVersion): `--version`, two
+    // seconds, no session and no network. That is within "calls nobody" — what that promises is no
+    // provider call and no spend, not that nothing on this machine may be asked its own version.
+    const versionOf = (b) => {
+      if (b.version) return b.version;
+      if (!b.executable || b.relative || !b.path) return null;
+      try { return menuVersion(b.path) ?? null; } catch { return null; }
+    };
+    const seen = versionOf(bin);
     const copyWords = (b) => `${b.source === "installed" ? "the copy Clearotron installed"
-      : b.source === "explicit" ? `set in ${engSpec.env}` : "on PATH"}${b.version ? `, version ${b.version}` : ", version not read"}`;
+      : b.source === "explicit" ? `set in ${engSpec.env}` : "on PATH"}${seen ? `, version ${seen}` : ", version not read"}`;
     // ── NATIVE WINDOWS IS ANSWERED HERE, BEFORE ANY PATH IS RESOLVED OR REPORTED ──────────────────
     //
     // `resolveEngineBin` tests a candidate with `accessSync(X_OK)` and `isFile()`. Windows has no
@@ -1786,7 +1834,24 @@ export async function runCheck() {
     // and needs no engine, which is why four reports published on that same Windows box.
     const platformRefusal = platformEngineRefusal();
     if (platformRefusal) problem(platformRefusal);
-    else if (bin.executable && !bin.relative) ok(`${bin.path} — ${copyWords(bin)}`);
+    // ── AND WHETHER THAT COPY IS NEW ENOUGH FOR THE MODELS IT WILL BE ASKED FOR ──────────────────
+    //
+    // The floor governed the copy setup INSTALLS and nothing else, and a copy already on the machine
+    // wins over that one — so the route most machines actually take was the unchecked one. A program
+    // below the floor does not fail: it refuses the newest model of a tier and serves the previous one,
+    // and the search still finishes and the report still arrives. This is the cheap place to learn it.
+    //
+    // Three outcomes, because the comparison is three-valued: older, not older, and could not be
+    // compared. The last is said rather than passed over — doctor's own contract is that a failure to
+    // look is not a clean result — and it is the ordinary state for a copy the machine installed by
+    // another route, where there is no package.json to read and doctor spawns nothing to ask.
+    else if (bin.executable && !bin.relative && olderThanFloor(seen, engSpec.floor) === true)
+      problem(`${bin.path} — ${copyWords(bin)}. Clearotron needs ${engSpec.floor} or newer. ${belowFloorTail(engSpec, bin)}`);
+    else if (bin.executable && !bin.relative) {
+      ok(`${bin.path} — ${copyWords(bin)}`);
+      if (olderThanFloor(seen, engSpec.floor) === null)
+        info(`  Its version could not be checked against the ${engSpec.floor} Clearotron needs.`);
+    }
     // A copy that is there and cannot run is a broken install, not an absence: the vendor's placeholder
     // left by an install that skipped its step, most often. Named with the reason and the fix.
     else if (!binSet && bin.rejected?.length) problem(`no usable \`${engSpec.fallback}\`: ${bin.rejected.map((x) => `${x.path} is ${x.why}`).join("; ")}`);
@@ -3914,6 +3979,15 @@ try {
       if (!bin.executable) { problem(`${bin.path ?? resolve(p)} is ${bin.rejected?.[0]?.why ?? "not an executable file"}.`); continue; }
     }
     ok(`found ${bin.path}${bin.source === "installed" ? `, the copy Clearotron installed${bin.version ? ` (${bin.version})` : ""}` : ""}`);
+    // THE MENU ROW SAID "choose it to see the fix", AND THIS IS WHERE IT IS SHOWN. A copy below the floor
+    // runs, so neither branch above is taken for it, and setup used to print "found" and carry on with the
+    // row's promise unkept. It still carries on — an operator may have a reason to sit below the floor — but
+    // not before saying so. The version is the one the menu already asked for (cached), or the package's.
+    {
+      let seenVersion = bin.version ?? null;
+      if (!seenVersion) { try { seenVersion = menuVersion(bin.path) ?? null; } catch { seenVersion = null; } }
+      if (olderThanFloor(seenVersion, eng.floor) === true) warn(cannotRunLine(eng, { ...bin, version: seenVersion }, process.env[eng.env]));
+    }
     // THE TERMS SENTENCE TRAVELS WITH THE PROGRAM, NOT WITH THE INSTALL OFFER. It was said only when this
     // step offered to install the CLI, and a copy Clearotron installed on an earlier run skips that offer, so it is
     // said here too. Using it, rather than installing it, is what accepts the vendor's terms.

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "4e5aab41d4cf49362e283fe0e6e3ce101c57c0a3",
-  "version": "0.3.3-beta.0"
+  "commit": "80f14b0925b8052cb70d5173a6f664bd2a2510a0",
+  "version": "0.3.3"
 }

package/docs/architecture/04-configuration-reference.md

@@ -124,14 +124,26 @@ through anything containing `/`):
 
 | Alias | Full catalog id |
 |---|---|
-| haiku | `anthropic/claude-haiku-4-5` |
-| sonnet | `anthropic/claude-sonnet-5` |
-| opus | `anthropic/claude-opus-5` |
+| haiku | `anthropic/claude-haiku` |
+| sonnet | `anthropic/claude-sonnet` |
+| opus | `anthropic/claude-opus` |
 | gemini | `google/gemini-3.1-pro-preview` |
 | gemini-flash | `google/gemini-3-flash-preview` |
 | deepseek-v4-pro | `together/deepseek-ai/DeepSeek-V4-Pro` |
 | azure | `azure-openai/gpt-5.4` |
 
+The three tiers record a **tier, not a version**, because a tier is what a run asks for: the tier goes
+to the program as the vendor's alias and the vendor answers with its newest model of that tier. This
+id is what a dispatch row and a token-rollup row carry as the model *asked for*; what actually served
+the turn is recorded beside it, and the report names that. A version here would be a claim about a
+request nobody made, and wrong the day a newer model of the tier shipped.
+
+One consequence, accepted when this was decided: per-model totals are keyed on what was asked for,
+and the native-language lanes call the API directly, where a model id is required and a tier word is
+not accepted. So one model reached by a stage and by those lanes appears under two keys —
+`anthropic/claude-haiku` and `anthropic/claude-haiku-4-5`. They are different requests, and the split
+says so.
+
 The bottom four are **legacy names that no stage declares and no engine can run** — they resolve at
 level 1 and then throw at level 2 (below). They are catalogue entries, not available tiers.
 
@@ -140,12 +152,18 @@ level 1 and then throw at level 2 (below). They are catalogue entries, not avail
 as aliases, so each tier follows the vendor's newest model; to hold one still, set
 `ANTHROPIC_DEFAULT_OPUS_MODEL` (or `ANTHROPIC_DEFAULT_SONNET_MODEL`, `ANTHROPIC_DEFAULT_HAIKU_MODEL`,
 `ANTHROPIC_DEFAULT_FABLE_MODEL`).
-The catalog ids `anthropic/claude-opus-5` and `anthropic/claude-sonnet-5` are passed as those
-concrete models; `anthropic/claude-haiku-4-5` goes over as the `haiku` alias, so it follows the
-vendor the same way. A bare or dated Anthropic id (`claude-haiku-4-5-20251001`) still resolves to
-its family — that is a naming form of a model the CLI can run, not a substitution of a different
-one. Telemetry keeps the level-1 catalog id as the model asked for, and the attempt row records the
-id the program reports it served.
+An id that names a family and a version — `anthropic/claude-opus-5-5`, `claude-sonnet-5`, the dated
+`claude-haiku-4-5-20251001` — is passed to the CLI as that model, so naming an exact model runs it
+and keeps running it when a newer model of the tier ships. A family with no version
+(`anthropic/claude-opus`) is the tier, not a model: the CLI has no model by that name, so it follows
+the family like the bare alias. Telemetry keeps the level-1 catalog id as the model asked for, and
+the attempt row records the id the program reports it served.
+
+**The CLI must be new enough for the model.** Each release carries its own list of accepted models,
+and one that predates a model refuses it outright while the tier alias goes on serving the previous
+generation — a 400 at the first turn, or a run that quietly used an older model. Setup installs
+`2.1.280` or newer for this reason; a copy already on the machine is used as it is, so `doctor`'s
+version is the one to read before assuming which model a tier reaches.
 
 **Anything else throws.** There is no regex fall-through to sonnet and no cross-provider
 substitution: the `gemini`/`gemini-flash`/`deepseek-v4-pro`/`azure` mappings are gone with the
@@ -360,7 +378,7 @@ cannot be read as one list.
 | `CLEAROTRON_DISPATCH_RECORD` | **on** | Write the verbatim message of every stage dispatch to `_driver/<stage>.attempt<N>[.repair<M>].dispatch.txt`, with `{file, sha, bytes, chars, kind}` on the attempt row. **Default ON** — `0`/`off`/`false`/`no` disarms it. Unlike `CLEAROTRON_DUMP_JSON` beside it, this is opt-OUT: the question it answers ("was the model given this?") is asked *after* the run that raised it, so a flag someone had to remember would be off on exactly the run that needed it. The files carry the company's identity verbatim and are deliberately not in the artifact table. |
 | `CLEAROTRON_GATHER_SESSION_KEY` / `CLEAROTRON_GATHER_AGENT` / `CLEAROTRON_GATHER_SESSION_ID` | set per stage | Telemetry attribution into the provider-call ledger (set by the gather config; not operator-set). |
 | `CLEAROTRON_RECORD_AXIS` | set per dispatch (unset ⇒ the stage is not fanned out) | Binds one fan-out turn of a recording stage to the single member it may write. `stageOnce` suffixes a fan-out stage's label with its axis, the gather config resolves `<stage>:<axis>` back to the base stage's tool group, and this carries the axis to the recording server. A call whose payload names a different member than the turn is bound to is REFUSED, so a seat cannot write into a sibling's file — without the binding every turn of the fan-out would record over member one. Set by the driver; not operator-set. |
-| `PORTAL_READ_MODEL` | `claude-sonnet-5` | The model the portal's own compose-read turn uses. Distinct from the pipeline's tiers: this is a portal surface, not a stage. |
+| `PORTAL_READ_MODEL` | `sonnet` | The model the portal's own compose-read turn uses. Distinct from the pipeline's tiers: this is a portal surface, not a stage. |
 | `CLEAROTRON_ORDER_PROBE_SEED` | unset | Seed for `scripts/band-shape-probe.mjs`, so an ordering probe can be replayed. A diagnostic script's knob, not a run's. |
 | `PROBE_TERM` | `DELTA` | The mark word `providers/uspto-local/bin/verify-index.mjs` searches when verifying a built local USPTO index. A diagnostic script's knob, not a run's. Change it when a row reports MEASURES NOTHING: that means the term had no exact hit, so the row's timing is not a result. |
 

package/docs/releases/0.3.3.md

@@ -0,0 +1,52 @@
+<!-- SPDX-License-Identifier: AGPL-3.0-only -->
+<!-- Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md -->
+
+# 0.3.3 — what was checked before it was published
+
+Tested with Claude Opus 5.5: faster than Opus 5, and about 30% cheaper. Naming an exact Claude model, Fable
+included, now runs that model; a tier name still follows the newest.
+
+A stable version is published only after a beta has run a real clearance end to end and has been
+installed from scratch by somebody who had not used the product before. This is that record for 0.3.3.
+It names what was run and who ran it by role and date, never by name, and it carries no mark and no
+party to a search.
+
+## The beta it was cut from
+
+0.3.3 was cut from 0.3.3-beta.1, published on 23 September 2026 at commit `d571d0ee`, published to the
+beta channel and installed on the staging deployment before this stable was cut.
+
+| | |
+|---|---|
+| Candidate | `clearotron@0.3.3-beta.1` |
+| Commit | `d571d0ee20d96c7ce7f9c2c5bee0404db3357467` |
+| Registry integrity | `sha512-50rUxdGJcd6zWPAjNosU8MhMIsJKy8AUFO1UF5uLm4fktXsxbqDdebI13PoWC7OMEzubhP9kyWwHH4V4uOirdQ==` |
+
+## A real clearance, end to end
+
+On 23 September 2026 the product's test team ran a full worldwide clearance in four classes against the
+live register service, with Claude Opus 5.5 doing the reasoning, and it ran to a delivered report. It ran
+on the beta's last build before publication, which differs from it only in parts a clearance does not
+run.
+
+## Installs from scratch
+
+- **Install to a delivered report.** On 23 September 2026, on 0.3.3-beta.1 (commit `d571d0ee`, registry
+  integrity as above), the product's test team installed the published beta as a new user with nothing
+  installed, on a Linux machine, following the public instructions and using its own credentials. Setup
+  installed the Claude program for that user alone and proved it with one turn, and `doctor` found nothing
+  a search would be refused for. A one-name knockout search, worldwide, was delivered **2 minutes 19
+  seconds** after it was ordered, with its report and its audit workbook, on Claude Opus 5.5 with no
+  retries.
+- **macOS.** An automated job packs the candidate's own bytes, installs them for a user with nothing
+  installed, and runs `doctor` and the demo. The release runs it on this stable's bytes before publishing
+  them.
+
+## Between the beta and the stable
+
+The code is the code 0.3.3-beta.1 shipped. Two commits separate that beta from this stable tag, and
+neither changes what the product does: this record, and the version number itself.
+
+That is worth saying because every commit between the beta somebody reviewed and the stable everybody
+installs reaches users without having been reviewed as a release. Here that range is a document and a
+version bump, and it is stated so it can be checked rather than taken on trust.

package/driver/CHANGELOG.md

@@ -1,5 +1,61 @@
 # clearotron-driver
 
+## 0.3.3
+
+### Patch Changes
+
+- Fixed: a run can name a Fable model by its published id, not only by the tier word, which used to fail outright.
+- Fixed: the coverage table names the goods words of a search narrowed by goods, so it no longer reads the same as the main search.
+- Fixed: the portal's run list shows a run's rating, never the reviewer's sign-off word, while the run is still in progress.
+- Fixed: naming an exact Claude model now runs that model, instead of quietly following the tier to a newer one.
+- Fixed: a list of names searched on Signa is now searched one name at a time, so one crowded name no longer stops the rest.
+- Fixed: a register search the provider refuses as too wide is disclosed at once, with its size, instead of pausing the run to retry it.
+- Fixed: the audit workbook now says when a surface refused a search and why, instead of reading the same as one never run.
+- Fixed: the audit workbook now lists each wider register search the engine chose not to run, with the reason it gave.
+- Fixed: a register search that fails on a provider error is tried once more in the run before it is disclosed as not searched.
+- Fixed: a run now records the tier it asked for, not a model version nobody chose. The report still names the model that ran.
+- Fixed: A two-letter mark's register searches, including those narrowed by the client's goods, now run instead of failing where the register's substring search needs three characters.
+- For operators: the run record now distinguishes a question the search step never answered from one it answered with "nothing applies". They previously looked identical, so a step that could not answer looked like a matter with nothing to say.
+- Fixed: a long list of names searched on Clarivate is now split into searches it accepts, not one it refuses as too wide.
+- Fixed: setup and doctor now report a Claude program too old for the models a search asks for, instead of passing it as fine.
+- Fixed: on the OpenAI engine, setup and `doctor --probe-engine` now catch a machine where codex refuses every tool call, before any search is paid for.
+  
+  A search that meets it stops after one attempt and names the setting that fixes it.
+- Fixed: a common-law search no longer repeats a finished stage because its write-up lacked one exact status word.
+  
+  Each coverage status is now recorded as data rather than read from the wording.
+- New: a search whose identical-mark question returns a count rather than a list now narrows that question until the register gives a list, and reads it.
+  
+  It previously left that question unread and searched the wider families instead — compounds, foreign-script forms, neighbour lists — which is where the reading time went.
+  
+  New: the words a search is narrowed to can now be chosen while the search is running, not only when it is first planned.
+- Fixed: doctor no longer ticks a billing mode on a machine where no engine program resolves; it states it as information.
+- Fixed: the identical mark is now read first on every search, before any wider question is asked.
+  
+  New: a search can cover a further category the client's own goods reach, added with a stated reason.
+- Fixed: a search request that describes the goods using the older wording now records those goods. It previously recorded none, so nothing downstream could narrow by what the matter actually covers.
+- Fixed: a search can now be narrowed by what the goods are, which it could not be before. The step that chooses the search words had no way to hand them back, so every search ran without them.
+- Fixed: the worker now reports itself alive throughout a search, not only between searches. Its liveness file went stale for the whole of a long search. A check reading it would call a healthy search dead, and might stop it.
+- For operators: the published package now has a recorded size budget. Nothing about what ships changes; growth past a margin fails the build and names the largest files.
+- Fixed: setup confirms a pasted key by its length alone, so no part of a key reaches a captured install log.
+- Fixed: setup installs a version of the Claude program new enough to run the current top-tier model, which older versions refuse.
+- Fixed: a territory name that no register can answer is now reported as an uncovered gap instead of being searched.
+- Fixed: the assistant's run summary names the rating again, where it had printed "[object object]" in its place.
+- Fixed: the clearance list is now requested at the same time as your sign-in details, instead of waiting for them.
+- Fixed: the delivery email, run list and assistant now give the rating and the report's own conclusion. None of them says a matter is on hold.
+
+## 0.3.3-beta.1
+
+### Patch Changes
+
+- Fixed: a run can name a Fable model by its published id, not only by the tier word, which used to fail outright.
+- Fixed: the portal's run list shows a run's rating, never the reviewer's sign-off word, while the run is still in progress.
+- Fixed: naming an exact Claude model now runs that model, instead of quietly following the tier to a newer one.
+- Fixed: a run now records the tier it asked for, not a model version nobody chose. The report still names the model that ran.
+- Fixed: setup and doctor now report a Claude program too old for the models a search asks for, instead of passing it as fine.
+- Fixed: setup installs a version of the Claude program new enough to run the current top-tier model, which older versions refuse.
+- Fixed: the assistant's run summary names the rating again, where it had printed "[object object]" in its place.
+
 ## 0.3.3-beta.0
 
 ### Patch Changes

package/driver/citation-census.json

@@ -1,5 +1,5 @@
 {
-  "citations": 489,
-  "files": 3945,
-  "checkable": 126
+  "citations": 465,
+  "files": 3308,
+  "checkable": 129
 }

package/driver/config-inventory.mjs

@@ -71,7 +71,7 @@ const shown = (names) => names.map((n) => n);
  * and only one of them describes who gets the invoice.
  */
 export function engineInventory(env = process.env) {
-  // THE SAME EXPRESSION AS THE RUN DOOR, character for character (driver.config.mjs:1880,
+  // THE SAME EXPRESSION AS THE RUN DOOR, character for character (driver.config.mjs,
   // preflightEngineBinary). The obvious rewrite — `String(env.CLEAROTRON_AI ?? "").trim() || DEFAULT` —
   // reads better and disagrees on a whitespace-only value: it falls back to the default while the door
   // resolves `""` and refuses with "that is not an engine". The page would then name a known engine that

package/driver/dev-portal.mjs

@@ -145,7 +145,7 @@ function scanRuns(workspaceRoot) {
       const s = JSON.parse(readFileSync(join(dir, "status.json"), "utf8"));
       out.push({ runId: s.runId ?? `${slug}-${runName}`, slug: s.slug ?? slug, codename: s.codename ?? null,
         agent: s.agent ?? null, state: s.state ?? null, stepN: s.stepN ?? null, stepLabel: s.stepLabel ?? null,
-        stepTotal: s.stepTotal ?? null, verdict: s.verdict ?? null, sendPending: s.sendPending ?? null,
+        stepTotal: s.stepTotal ?? null, signoff: s.review?.signoff ?? s.verdict ?? null, tier: s.tier ?? null, sendPending: s.sendPending ?? null,
         markName: s.markName ?? null, updatedAt: s.updatedAt ?? null, archived });
     } catch { /* not a run dir / unreadable status — skip */ }
   };
@@ -293,8 +293,8 @@ $("#f").addEventListener("submit",async(e)=>{e.preventDefault();const fd=new For
  const r=await fetch("/dev/enqueue",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(b)});
  $("#fout").textContent=JSON.stringify(await r.json(),null,2);loadRuns();});
 async function loadRuns(){const r=await(await fetch("/dev/runs")).json();
- $("#runs").innerHTML=r.length?"<table><tr><th>run</th><th>state</th><th>step</th><th>verdict</th><th>updated</th></tr>"+r.map(x=>
-  '<tr><td>'+(x.markName??x.slug)+' · '+(x.codename??"?")+'</td><td class="'+(x.state==="delivered"?"ok":x.state==="failed"?"err":"warn")+'">'+(x.state??"?")+(x.sendPending?" (sendPending)":"")+'</td><td>'+(x.stepLabel??"")+'</td><td>'+(x.verdict??"")+'</td><td>'+(x.updatedAt??"").slice(0,19)+'</td></tr>').join("")+"</table>":"no runs yet";}
+ $("#runs").innerHTML=r.length?"<table><tr><th>run</th><th>state</th><th>step</th><th>sign-off</th><th>updated</th></tr>"+r.map(x=>
+  '<tr><td>'+(x.markName??x.slug)+' · '+(x.codename??"?")+'</td><td class="'+(x.state==="delivered"?"ok":x.state==="failed"?"err":"warn")+'">'+(x.state??"?")+(x.sendPending?" (sendPending)":"")+'</td><td>'+(x.stepLabel??"")+'</td><td>'+(x.signoff??"")+'</td><td>'+(x.updatedAt??"").slice(0,19)+'</td></tr>').join("")+"</table>":"no runs yet";}
 async function loadOutbox(){const r=await(await fetch("/dev/outbox")).json();
  $("#outbox").innerHTML=r.length?r.map(x=>'<details><summary>'+x.file+' <span class="warn">'+(x.packet?.kind??(x.legacyAgent?"delivered (legacy)":"?"))+'</span></summary><pre>'+JSON.stringify(x.packet??{legacyAgent:x.legacyAgent},null,2)+'</pre></details>').join(""):"outbox empty";}
 // ── Searches panel (Phase 3a): registry levels + saved recipes via the /recipes/* proxy. EVERY

package/driver/driver.config.mjs

@@ -656,10 +656,29 @@ export const config = {
 // stage definition and the id stamped on a token-rollup row are the same fact rather than two spellings
 // of it. resolveModel below is the only reader that matters; an engine with its own resolveModelId
 // overrides it, and anything already in catalog form passes through untouched.
+// ── A TIER IS WHAT WAS ASKED FOR, SO A TIER IS WHAT IS RECORDED ─────────────────────────────────────
+//
+// These three named a VERSION — `anthropic/claude-opus-5` — and nothing ever asked for one. A stage
+// names a tier, the tier goes to the program as the vendor's own alias, and the vendor answers with its
+// newest model of that tier. The version written here was a claim about a request nobody made, and it
+// was wrong the day a newer model shipped: a delivered run served throughout by the generation after
+// Opus 5 recorded, on every attempt row, a request for Opus 5, and its token line accounted under the
+// name of a model that did not run. Measured on that run, 2026-09-22.
+//
+// Owner's ruling, 2026-09-23: record the tier. What a run asked for is a tier, what it was served is
+// recorded separately and already is, and the report names the model that ran — none of that moves.
+//
+// WHAT IT COSTS, RULED ON AND ACCEPTED RATHER THAN DISCOVERED LATER. Per-model totals are keyed on what
+// was ASKED for, and the direct-API lanes must name a version because they call the API rather than the
+// program — the API takes model ids, not tier words. So one model reached by both routes now lands in
+// two buckets: `anthropic/claude-haiku` from a stage, `anthropic/claude-haiku-4-5` from those lanes.
+// That is a real split in a per-model total and it was accepted with the ruling: the two are genuinely
+// different requests, and keying the totals on what actually SERVED each turn is the change that would
+// fix it properly, which is larger than this and not what was ruled.
 export const MODELS = {
-  haiku: "anthropic/claude-haiku-4-5",
-  sonnet: "anthropic/claude-sonnet-5",
-  opus: "anthropic/claude-opus-5",
+  haiku: "anthropic/claude-haiku",
+  sonnet: "anthropic/claude-sonnet",
+  opus: "anthropic/claude-opus",
   gemini: "google/gemini-3.1-pro-preview",
   "gemini-flash": "google/gemini-3-flash-preview",
   "deepseek-v4-pro": "together/deepseek-ai/DeepSeek-V4-Pro",
@@ -675,11 +694,17 @@ export const MODELS = {
 //
 // A BARE Anthropic id (dated or not — "claude-haiku-4-5-20251001", "claude-opus-5") normalises to the
 // catalog form too. The direct-API lanes (jx completions/judge/nativeread, driver.config JX_PROVIDERS)
-// name their model that way because that is what the Messages API takes, so without this the same model
-// lands in a token rollup under two keys — "anthropic/claude-haiku-4-5" from the gateway's alias rows and
-// "claude-haiku-4-5-20251001" from the jx rows — and a per-model total is silently split. The date suffix
-// is dropped because the catalog ids carry none; anything that does not look like a bare claude id is
-// returned untouched, so a genuinely unknown model still keys as-is rather than being guessed at.
+// name their model that way because that is what the Messages API takes, so without this one model named
+// in two spellings — dated and undated — would key apart in a rollup. The date suffix is dropped;
+// anything that does not look like a bare claude id is returned untouched, so a genuinely unknown model
+// still keys as-is rather than being guessed at.
+//
+// WHAT THIS NO LONGER DOES, SAID PLAINLY BECAUSE THE PARAGRAPH ABOVE USED TO CLAIM IT. It used to unite
+// a stage's rows with those lanes' rows, because the tier resolved to a versioned id and so did they.
+// The tiers now resolve to a tier (MODELS), and these lanes still name a version, so the same model
+// reached both ways keys in two places. That split was ruled on and accepted (see MODELS) — it is not
+// an oversight here, and closing it by collapsing a version to its tier would throw away the one thing
+// these rows can still say about which model was asked for.
 export function resolveModel(model) {
   if (!model) return model;
   if (MODELS[model]) return MODELS[model];
@@ -1976,7 +2001,12 @@ export const ENGINE_BINARIES = {
     // newer", with no ceiling. Setup installs it into the engines folder (enginesFolder, below the table)
     // when the reader picks this engine, and the resolver uses it only when the machine has no copy of its
     // own. The package's own `bin` field names the program, so no path inside it is written down here.
-    package: "@anthropic-ai/claude-code", floor: "2.1.270",
+    // 2.1.280 is the floor because it is the oldest release that can run the current generation of this
+    // vendor's top tier: below it the API refuses the model id outright ("version 2.1.280 or newer is
+    // required"), and the tier alias quietly goes on serving the previous generation. Measured 2026-09-22
+    // on 2.1.263 — the alias returned the older model and the pinned id was refused — so a floor that
+    // only asks for a program that starts is a floor that passes a machine this engine cannot run on.
+    package: "@anthropic-ai/claude-code", floor: "2.1.280",
     // WHAT THE INSTALL TAKES ON DISK, in MB, which setup states before it asks to install. MEASURED, not
     // declared by the vendor: the engines folder after a fresh install of this package into an empty
     // folder, on npm 10.9.8 and on 11.19.1, 2026-09-14. A later release can be larger or smaller, so setup
@@ -2047,6 +2077,47 @@ export function enginesFolder({ env = process.env, home = homedir() } = {}) {
   return String(env[ENGINES_DIR_ENV] ?? "").trim() || join(home, ".local", "share", "clearotron", "engines");
 }
 
+/**
+ * Is the copy of an engine's program on this machine older than the version this build asks for?
+ *
+ * THE FLOOR GOVERNED ONE ROUTE OF TWO. Setup passes it to npm, so a program it installs cannot land
+ * under it; a copy already on the machine wins over the installed one by design, and nothing compared
+ * its version to anything. The two routes are not equally common — most machines have their own copy —
+ * so the check that existed covered the case that mostly does not arise.
+ *
+ * What that costs is not a crash. The program carries its own list of the models it accepts, so one
+ * below the floor refuses the model a tier names and serves the previous generation instead: the run
+ * completes, the report is delivered, and the only sign is a model id in the record that nobody chose.
+ * Measured 2026-09-22 on 2.1.263, where the current top tier's id came back a 400 and the tier alias
+ * answered with the generation before it.
+ *
+ * THREE-VALUED, AND THE THIRD VALUE IS THE POINT. `null` means "these two cannot be compared" — no
+ * floor declared, nothing read from the copy, or a version this cannot parse — and it is never "fine".
+ * A caller must say it could not look rather than print a pass, which is the absence-read-as-a-pass
+ * class that the rest of this file keeps naming. Only a version that parses and sorts below the floor
+ * comes back `true`.
+ *
+ * PURE, both arguments injected, so a test drives an old version and a current one without a program.
+ *
+ * @param {string|null|undefined} version  what the copy reports, e.g. "2.1.273"
+ * @param {string|null|undefined} floor    the engine's declared floor, e.g. "2.1.280"
+ * @returns {boolean|null} true = older than the floor; false = at it or newer; null = not comparable
+ */
+export function olderThanFloor(version, floor) {
+  const parts = (v) => {
+    const m = /^\s*v?(\d+)\.(\d+)(?:\.(\d+))?/.exec(String(v ?? ""));
+    return m ? [Number(m[1]), Number(m[2]), Number(m[3] ?? 0)] : null;
+  };
+  const [got, want] = [parts(version), parts(floor)];
+  if (!got || !want) return null;
+  // Part by part, never as text: "2.1.99" sorts above "2.1.280" as a string, and that comparison would
+  // read a machine two hundred releases behind as being ahead of the floor.
+  for (let i = 0; i < 3; i++) {
+    if (got[i] !== want[i]) return got[i] < want[i];
+  }
+  return false;
+}
+
 /** The npm arguments that install, or refresh, an engine's program in `dir`: "this version or newer". */
 export function engineInstallArgs(spec, dir = enginesFolder()) {
   return ["install", "--prefix", dir, "--no-fund", "--no-audit", `${spec.package}@>=${spec.floor}`];

package/driver/engine/CONTRACT.md

@@ -153,8 +153,9 @@ and could not be: the telemetry logged the alias that was ASKED FOR, so an arm r
 gemini and ran sonnet. Both tiers are gone — the failover chain was deleted in and both stages
 declare an anthropic tier in `STAGES` — and every engine's model map now **refuses** an alias it cannot
 run (`claudeModel`, `openaiModel`). On the anthropic engine a tier goes as the vendor's alias, a catalog
-id in the table (`anthropic/claude-opus-5`) goes as itself, a bare or dated `claude-*` id goes as its
-family's alias, and anything else throws. To hold a tier on one model, set the vendor's own
+id naming a family and a version (`anthropic/claude-opus-5-5`, `claude-haiku-4-5-20251001`) goes as
+that model so a pin holds, a `claude-*` id naming a family with no version goes as its family's alias
+because the CLI has no model by that name, and anything else throws. To hold a tier on one model, set the vendor's own
 `ANTHROPIC_DEFAULT_OPUS_MODEL` / `_SONNET_MODEL` / `_HAIKU_MODEL`, or `ANTHROPIC_DEFAULT_FABLE_MODEL` for
 `fable`, which no stage asks for unless an override names it, as `CLEAROTRON_SYNTHESIS_MODEL=fable` does; each
 reaches the CLI through the stage's environment.

package/driver/engine/anthropic-agent.mjs

@@ -156,11 +156,17 @@ const engineMaxBufferChars = () => Math.max(1024, Number(process.env.CLEAROTRON_
 // An alias with no claude equivalent now FAILS LOUD, exactly as `openaiModel` has always done for a
 // non-GPT id. That is the issue's requirement in one line: an unhonoured model override is an error,
 // not a substitution.
-const CLAUDE_MODEL = {
-  opus: "opus", sonnet: "sonnet", haiku: "haiku", fable: "fable",
-  "anthropic/claude-opus-5": "claude-opus-5", "anthropic/claude-sonnet-5": "claude-sonnet-5",
-  "anthropic/claude-sonnet-4-6": "sonnet", "anthropic/claude-haiku-4-5": "haiku",
-};
+// THE CATALOG IDS ARE NOT LISTED HERE ANY MORE, and removing them is what makes one rule cover every
+// id. Four sat here and two of them disagreed with the other two: `anthropic/claude-opus-5` and
+// `anthropic/claude-sonnet-5` went over as those models, while `anthropic/claude-sonnet-4-6` and
+// `anthropic/claude-haiku-4-5` went over as their tier's alias. A caller naming an exact model got it
+// or lost it depending on which of the four they happened to name, and nothing said which.
+//
+// The rule below now answers all four the same way, and no run changes: a stage names its TIER, and the
+// tier words above are still the whole of what a run passes. These ids reach this function only when a
+// caller names one — an override or an experiment arm — and there, being given the model you named is
+// the behaviour the rest of this function already promises.
+const CLAUDE_MODEL = { opus: "opus", sonnet: "sonnet", haiku: "haiku", fable: "fable" };
 export function claudeModel(model) {
   if (!model) return undefined;
   if (CLAUDE_MODEL[model]) return CLAUDE_MODEL[model];
@@ -168,8 +174,29 @@ export function claudeModel(model) {
   // that is a NAMING form of a model claude can actually run, not a substitution of a different one.
   // The family must be named IN the id: a `claude-*` id whose family this build does not recognise
   // throws too, rather than riding the old else-arm into sonnet.
-  const fam = /opus/i.test(model) ? "opus" : /haiku/i.test(model) ? "haiku" : /sonnet/i.test(model) ? "sonnet" : null;
-  if (fam && /^(?:anthropic\/)?claude-/i.test(model)) return fam;
+  // FABLE IS READ HERE TOO, and its absence was a live defect rather than a gap in readiness: the bare
+  // `fable` alias is in the table above, so `CLEAROTRON_SYNTHESIS_MODEL=fable` worked and hid it, while
+  // the pinned id every vendor page names — `claude-fable-5-1` — threw on its way to a program that runs
+  // it. Measured 2026-09-22: the program accepts that id and reports serving `claude-fable-5-1`.
+  const fam = /opus/i.test(model) ? "opus" : /haiku/i.test(model) ? "haiku" : /sonnet/i.test(model) ? "sonnet"
+    : /fable/i.test(model) ? "fable" : null;
+  if (fam && /^(?:anthropic\/)?claude-/i.test(model)) {
+    const bare = String(model).replace(/^anthropic\//i, "").toLowerCase();
+    // A CONCRETE ID GOES TO THE PROGRAM AS ITSELF, AND THAT IS WHAT MAKES A PIN A PIN. It used to come
+    // back as the bare family alias, so a caller who named an exact model got whichever model the tier
+    // pointed at — the same model on the day it was written, a different one the day a newer one
+    // shipped, and nothing to read in between. A silent un-pinning is the substitution this function
+    // exists to refuse, in the one form it still allowed.
+    //
+    // A FAMILY WITH NO VERSION IS THE TIER, not a model: `claude-opus` is what an operator types for a
+    // deployment of that tier, and the program has no model by that name. It keeps following the family.
+    //
+    // Measured against the program rather than assumed (2026-09-22): it accepts `claude-sonnet-5`,
+    // `claude-haiku-4-5-20251001` and `claude-fable-5-1` and reports serving each of them, so passing an
+    // exact id through costs nothing that the alias was buying. Where a caller names an id the program
+    // does not know, it says so and the turn fails loudly — which is the honest end of a bad pin.
+    return /^claude-(?:[a-z]+-\d|\d)/.test(bare) ? bare : fam;
+  }
   throw new Error(`anthropic-agent: no claude model mapped for "${model}" — this engine runs claude only. Pass opus/sonnet/haiku/fable or a concrete claude-* id. (It used to substitute sonnet silently and log the alias you asked for: #238 corruption 3.)`);
 }
 

package/driver/engine/mcp/probe-server.mjs

@@ -9,8 +9,17 @@
 // server, asks it to call `ping` once, and passes only when the reply carries what `ping` returned.
 //
 // WHAT IT RETURNS IS THE PROOF. Its one argument is a random word the probe mints for each
-// turn and gives only to this process, so a reply that carries it cannot be the model guessing. Read-only;
-// it touches no file, no network and no run.
+// turn and gives only to this process, so a reply that carries it cannot be the model guessing. It touches
+// no file, no network and no run.
+//
+// IT IS DECLARED AS THE REGISTER SEARCH IS DECLARED, NOT AS WHAT IT DOES. codex decides from a tool's
+// annotations whether a call needs approval, and `codex exec` refuses every call that does ("MCP tool call
+// requires approval, but approval policy is never") unless its sandbox is bypassed. A read-only tool never
+// needs approval, so a read-only `ping` passed on hosts where `register_execute_plan` — marked not
+// read-only and open-world on every register server — was refused on every call and no search could run.
+// The probe exists to answer for the tools a search calls, so its tool carries that tool's annotations,
+// and a test keeps the two equal. The rule, in codex's own source, identical from 0.150.1 to 0.156.1:
+// read-only → no approval; otherwise approval when destructive, or open-world, or either left unmarked.
 import { serve } from "./stdio-server.mjs";
 
 serve({
@@ -19,7 +28,7 @@ serve({
     name: "ping",
     description: "Return the word this check is waiting for.",
     inputSchema: { type: "object", properties: {}, additionalProperties: false },
-    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     handler: async () => {
       const word = String(process.argv[2] ?? "").trim();
       return word ? word : { isError: true, text: "ping: this server was started without a word to return" };

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.3-beta.0",
+  "version": "0.3.3",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {