clearotron 0.3.3-beta.0 → 0.3.3-beta.1

package/bin/onboard.mjs

@@ -98,7 +98,7 @@ import {
 // REGISTER_PROVIDER frozen at first import) is the one `preflightCandidate` below already cache-busts
 // around, and it is cache-busted whether or not this static import happened first.
 import { config, ENGINE_BINARIES, DEFAULT_ENGINE_ID, RESEARCH_PROVIDERS, SERP_PROVIDERS, resolveEngineProgram, ON_A_WINDOWS_DRIVE,
-  enginesFolder, engineInstallArgs, engineInstallCommand } from "../driver/driver.config.mjs";
+  enginesFolder, engineInstallArgs, engineInstallCommand, olderThanFloor } from "../driver/driver.config.mjs";
 import { resolveAuthMode, CLOUD_SWITCH, CLOUD_SETTINGS, CLOUD_SECRETS, cloudsSwitchedOn } from "../driver/engine/auth.mjs";
 import { isInsideCheckout } from "../shared/inside-checkout.mjs";   // — one copy of the rule, and it is testable
 import { packagedBuild as sharedPackagedBuild } from "../shared/packaged-build.mjs";   // — one reader of build-info.json, reachable from the driver
@@ -1105,6 +1105,25 @@ function programProblem(bin, named) {
   return null;
 }
 
+// WHAT A COPY BELOW THE FLOOR DOES TO THE MODELS WAS MEASURED ON CLAUDE ALONE (2026-09-22): it refuses the
+// newest model of a tier and serves the one before. Codex's floor records no such measurement, so an old
+// Codex is named by its version, the floor and the fix, and nothing is said about which model it runs.
+export const floorRefusesNewestModel = (eng) => Boolean(eng?.package) && eng.package === ENGINE_BINARIES["anthropic-agent"]?.package;
+
+/**
+ * What doctor and setup say after the version of a copy below the floor: what it costs, where that was
+ * measured, and the fix. ONE COPY FOR BOTH SCREENS, so the two cannot drift apart again (ruling 285).
+ *
+ * The fix follows where the copy came from. A copy Clearotron installed moves with `update`. Any other
+ * copy wins over one setup installs, by design, so installing another does not replace it: the fix is
+ * to update it, or to name a newer one in the engine's setting.
+ */
+export function belowFloorTail(eng, bin) {
+  const cost = floorRefusesNewestModel(eng) ? `The newest ${eng.product} models need a newer version. Searches run on an older model instead, or stop at the first step if they name the newest one exactly. ` : "";
+  const fix = bin?.source === "installed" ? `Update it with \`${invoke("update")}\`.` : `Update it, or set ${eng.env} to a newer copy.`;
+  return cost + fix;
+}
+
 /**
  * What setup found of one engine's program, as its menu row says it; "" when nothing was looked for. A copy
  * that cannot run is a problem, not an absence, and installing another is not always the fix, so the row
@@ -1113,7 +1132,14 @@ function programProblem(bin, named) {
  */
 export function foundWords(eng, bin) {
   if (!bin) return "";
-  if (bin.executable && !bin.relative) return bin.version ? `found on this computer (version ${bin.version})` : "found on this computer";
+  if (bin.executable && !bin.relative) {
+    // A COPY THAT RUNS IS NOT NECESSARILY ONE THIS BUILD CAN USE. Below the floor the program refuses
+    // the newest model of a tier and serves the one before it, so the row cannot say "found" and leave
+    // it there; it says which problem, and choosing the engine shows the fix, as the other problems do.
+    if (olderThanFloor(bin.version, eng.floor) === true)
+      return `problem: the copy of ${eng.product} here is version ${bin.version}; Clearotron needs ${eng.floor} or newer — choose it to see the fix`;
+    return bin.version ? `found on this computer (version ${bin.version})` : "found on this computer";
+  }
   const p = programProblem(bin, bin.explicit);
   if (p?.kind === "incomplete") return `problem: the copy of ${eng.product} here is incomplete and won't run — choose it to see the fix`;
   if (p?.kind === "setting") return `problem: this computer is set to use a copy of ${eng.product} that isn't there — choose it to see the fix`;
@@ -1129,6 +1155,12 @@ export function foundWords(eng, bin) {
  */
 export function cannotRunLine(eng, bin, setting = "") {
   const set = namedSetting(eng, setting);
+  // ANSWERED BEFORE THE REST, because a copy below the floor RUNS: it is executable, nothing rejected
+  // it, and every clause below is about a copy that cannot start. Left to them it would fall through to
+  // the general clause and be described as unusable, which sends the reader to look for a broken
+  // install they do not have. The fix here is a version, not a repair.
+  if (bin?.executable && !bin?.relative && olderThanFloor(bin.version, eng.floor) === true)
+    return `${eng.product} on this computer is version ${bin.version}. Clearotron needs ${eng.floor} or newer. ${belowFloorTail(eng, bin)}`;
   const p = programProblem(bin, set);
   if (p?.kind === "incomplete") return `The copy of ${eng.product} at ${p.path} is incomplete: its installation stopped before the program was added. Setup can install a working copy.`;
   if (p?.kind === "setting") return `This computer is set to use ${eng.product} at ${set}, and nothing there can run. Setup can install ${eng.product} and use that instead.`;
@@ -1761,10 +1793,26 @@ export async function runCheck() {
     const bin = resolveEngineBin(binSetting, { engine: engineId });
     // WHICH COPY, AND ITS VERSION, because the machine's own install and the one Clearotron installed
     // are both legitimate and behave differently: the first updates itself, the second moves with
-    // `clearotron update`. The version comes from the copy's own package.json when npm installed it;
-    // doctor spawns nothing to ask (a vendor's own native installer leaves no package.json to read).
+    // `clearotron update`. The version comes from the copy's own package.json when npm installed it.
+    //
+    // AND IS ASKED FOR WHEN THERE IS NONE TO READ, which is the ordinary case for a copy the machine
+    // installed by another route — a vendor's native installer leaves no package.json. Doctor used to
+    // stop there and print "version not read", which was honest and made the floor comparison below
+    // unanswerable on the route most machines take: this command could not tell an operator whether
+    // their own copy was new enough for the models a run asks for, which is the whole of what it was
+    // asked to check.
+    //
+    // It is the same short call setup's engine menu already makes (menuVersion): `--version`, two
+    // seconds, no session and no network. That is within "calls nobody" — what that promises is no
+    // provider call and no spend, not that nothing on this machine may be asked its own version.
+    const versionOf = (b) => {
+      if (b.version) return b.version;
+      if (!b.executable || b.relative || !b.path) return null;
+      try { return menuVersion(b.path) ?? null; } catch { return null; }
+    };
+    const seen = versionOf(bin);
     const copyWords = (b) => `${b.source === "installed" ? "the copy Clearotron installed"
-      : b.source === "explicit" ? `set in ${engSpec.env}` : "on PATH"}${b.version ? `, version ${b.version}` : ", version not read"}`;
+      : b.source === "explicit" ? `set in ${engSpec.env}` : "on PATH"}${seen ? `, version ${seen}` : ", version not read"}`;
     // ── NATIVE WINDOWS IS ANSWERED HERE, BEFORE ANY PATH IS RESOLVED OR REPORTED ──────────────────
     //
     // `resolveEngineBin` tests a candidate with `accessSync(X_OK)` and `isFile()`. Windows has no
@@ -1786,7 +1834,24 @@ export async function runCheck() {
     // and needs no engine, which is why four reports published on that same Windows box.
     const platformRefusal = platformEngineRefusal();
     if (platformRefusal) problem(platformRefusal);
-    else if (bin.executable && !bin.relative) ok(`${bin.path} — ${copyWords(bin)}`);
+    // ── AND WHETHER THAT COPY IS NEW ENOUGH FOR THE MODELS IT WILL BE ASKED FOR ──────────────────
+    //
+    // The floor governed the copy setup INSTALLS and nothing else, and a copy already on the machine
+    // wins over that one — so the route most machines actually take was the unchecked one. A program
+    // below the floor does not fail: it refuses the newest model of a tier and serves the previous one,
+    // and the search still finishes and the report still arrives. This is the cheap place to learn it.
+    //
+    // Three outcomes, because the comparison is three-valued: older, not older, and could not be
+    // compared. The last is said rather than passed over — doctor's own contract is that a failure to
+    // look is not a clean result — and it is the ordinary state for a copy the machine installed by
+    // another route, where there is no package.json to read and doctor spawns nothing to ask.
+    else if (bin.executable && !bin.relative && olderThanFloor(seen, engSpec.floor) === true)
+      problem(`${bin.path} — ${copyWords(bin)}. Clearotron needs ${engSpec.floor} or newer. ${belowFloorTail(engSpec, bin)}`);
+    else if (bin.executable && !bin.relative) {
+      ok(`${bin.path} — ${copyWords(bin)}`);
+      if (olderThanFloor(seen, engSpec.floor) === null)
+        info(`  Its version could not be checked against the ${engSpec.floor} Clearotron needs.`);
+    }
     // A copy that is there and cannot run is a broken install, not an absence: the vendor's placeholder
     // left by an install that skipped its step, most often. Named with the reason and the fix.
     else if (!binSet && bin.rejected?.length) problem(`no usable \`${engSpec.fallback}\`: ${bin.rejected.map((x) => `${x.path} is ${x.why}`).join("; ")}`);
@@ -3914,6 +3979,15 @@ try {
       if (!bin.executable) { problem(`${bin.path ?? resolve(p)} is ${bin.rejected?.[0]?.why ?? "not an executable file"}.`); continue; }
     }
     ok(`found ${bin.path}${bin.source === "installed" ? `, the copy Clearotron installed${bin.version ? ` (${bin.version})` : ""}` : ""}`);
+    // THE MENU ROW SAID "choose it to see the fix", AND THIS IS WHERE IT IS SHOWN. A copy below the floor
+    // runs, so neither branch above is taken for it, and setup used to print "found" and carry on with the
+    // row's promise unkept. It still carries on — an operator may have a reason to sit below the floor — but
+    // not before saying so. The version is the one the menu already asked for (cached), or the package's.
+    {
+      let seenVersion = bin.version ?? null;
+      if (!seenVersion) { try { seenVersion = menuVersion(bin.path) ?? null; } catch { seenVersion = null; } }
+      if (olderThanFloor(seenVersion, eng.floor) === true) warn(cannotRunLine(eng, { ...bin, version: seenVersion }, process.env[eng.env]));
+    }
     // THE TERMS SENTENCE TRAVELS WITH THE PROGRAM, NOT WITH THE INSTALL OFFER. It was said only when this
     // step offered to install the CLI, and a copy Clearotron installed on an earlier run skips that offer, so it is
     // said here too. Using it, rather than installing it, is what accepts the vendor's terms.

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "4e5aab41d4cf49362e283fe0e6e3ce101c57c0a3",
-  "version": "0.3.3-beta.0"
+  "commit": "d571d0ee20d96c7ce7f9c2c5bee0404db3357467",
+  "version": "0.3.3-beta.1"
 }

package/docs/architecture/04-configuration-reference.md

@@ -124,14 +124,26 @@ through anything containing `/`):
 
 | Alias | Full catalog id |
 |---|---|
-| haiku | `anthropic/claude-haiku-4-5` |
-| sonnet | `anthropic/claude-sonnet-5` |
-| opus | `anthropic/claude-opus-5` |
+| haiku | `anthropic/claude-haiku` |
+| sonnet | `anthropic/claude-sonnet` |
+| opus | `anthropic/claude-opus` |
 | gemini | `google/gemini-3.1-pro-preview` |
 | gemini-flash | `google/gemini-3-flash-preview` |
 | deepseek-v4-pro | `together/deepseek-ai/DeepSeek-V4-Pro` |
 | azure | `azure-openai/gpt-5.4` |
 
+The three tiers record a **tier, not a version**, because a tier is what a run asks for: the tier goes
+to the program as the vendor's alias and the vendor answers with its newest model of that tier. This
+id is what a dispatch row and a token-rollup row carry as the model *asked for*; what actually served
+the turn is recorded beside it, and the report names that. A version here would be a claim about a
+request nobody made, and wrong the day a newer model of the tier shipped.
+
+One consequence, accepted when this was decided: per-model totals are keyed on what was asked for,
+and the native-language lanes call the API directly, where a model id is required and a tier word is
+not accepted. So one model reached by a stage and by those lanes appears under two keys —
+`anthropic/claude-haiku` and `anthropic/claude-haiku-4-5`. They are different requests, and the split
+says so.
+
 The bottom four are **legacy names that no stage declares and no engine can run** — they resolve at
 level 1 and then throw at level 2 (below). They are catalogue entries, not available tiers.
 
@@ -140,12 +152,18 @@ level 1 and then throw at level 2 (below). They are catalogue entries, not avail
 as aliases, so each tier follows the vendor's newest model; to hold one still, set
 `ANTHROPIC_DEFAULT_OPUS_MODEL` (or `ANTHROPIC_DEFAULT_SONNET_MODEL`, `ANTHROPIC_DEFAULT_HAIKU_MODEL`,
 `ANTHROPIC_DEFAULT_FABLE_MODEL`).
-The catalog ids `anthropic/claude-opus-5` and `anthropic/claude-sonnet-5` are passed as those
-concrete models; `anthropic/claude-haiku-4-5` goes over as the `haiku` alias, so it follows the
-vendor the same way. A bare or dated Anthropic id (`claude-haiku-4-5-20251001`) still resolves to
-its family — that is a naming form of a model the CLI can run, not a substitution of a different
-one. Telemetry keeps the level-1 catalog id as the model asked for, and the attempt row records the
-id the program reports it served.
+An id that names a family and a version — `anthropic/claude-opus-5-5`, `claude-sonnet-5`, the dated
+`claude-haiku-4-5-20251001` — is passed to the CLI as that model, so naming an exact model runs it
+and keeps running it when a newer model of the tier ships. A family with no version
+(`anthropic/claude-opus`) is the tier, not a model: the CLI has no model by that name, so it follows
+the family like the bare alias. Telemetry keeps the level-1 catalog id as the model asked for, and
+the attempt row records the id the program reports it served.
+
+**The CLI must be new enough for the model.** Each release carries its own list of accepted models,
+and one that predates a model refuses it outright while the tier alias goes on serving the previous
+generation — a 400 at the first turn, or a run that quietly used an older model. Setup installs
+`2.1.280` or newer for this reason; a copy already on the machine is used as it is, so `doctor`'s
+version is the one to read before assuming which model a tier reaches.
 
 **Anything else throws.** There is no regex fall-through to sonnet and no cross-provider
 substitution: the `gemini`/`gemini-flash`/`deepseek-v4-pro`/`azure` mappings are gone with the
@@ -360,7 +378,7 @@ cannot be read as one list.
 | `CLEAROTRON_DISPATCH_RECORD` | **on** | Write the verbatim message of every stage dispatch to `_driver/<stage>.attempt<N>[.repair<M>].dispatch.txt`, with `{file, sha, bytes, chars, kind}` on the attempt row. **Default ON** — `0`/`off`/`false`/`no` disarms it. Unlike `CLEAROTRON_DUMP_JSON` beside it, this is opt-OUT: the question it answers ("was the model given this?") is asked *after* the run that raised it, so a flag someone had to remember would be off on exactly the run that needed it. The files carry the company's identity verbatim and are deliberately not in the artifact table. |
 | `CLEAROTRON_GATHER_SESSION_KEY` / `CLEAROTRON_GATHER_AGENT` / `CLEAROTRON_GATHER_SESSION_ID` | set per stage | Telemetry attribution into the provider-call ledger (set by the gather config; not operator-set). |
 | `CLEAROTRON_RECORD_AXIS` | set per dispatch (unset ⇒ the stage is not fanned out) | Binds one fan-out turn of a recording stage to the single member it may write. `stageOnce` suffixes a fan-out stage's label with its axis, the gather config resolves `<stage>:<axis>` back to the base stage's tool group, and this carries the axis to the recording server. A call whose payload names a different member than the turn is bound to is REFUSED, so a seat cannot write into a sibling's file — without the binding every turn of the fan-out would record over member one. Set by the driver; not operator-set. |
-| `PORTAL_READ_MODEL` | `claude-sonnet-5` | The model the portal's own compose-read turn uses. Distinct from the pipeline's tiers: this is a portal surface, not a stage. |
+| `PORTAL_READ_MODEL` | `sonnet` | The model the portal's own compose-read turn uses. Distinct from the pipeline's tiers: this is a portal surface, not a stage. |
 | `CLEAROTRON_ORDER_PROBE_SEED` | unset | Seed for `scripts/band-shape-probe.mjs`, so an ordering probe can be replayed. A diagnostic script's knob, not a run's. |
 | `PROBE_TERM` | `DELTA` | The mark word `providers/uspto-local/bin/verify-index.mjs` searches when verifying a built local USPTO index. A diagnostic script's knob, not a run's. Change it when a row reports MEASURES NOTHING: that means the term had no exact hit, so the row's timing is not a result. |
 

package/driver/CHANGELOG.md

@@ -1,5 +1,17 @@
 # clearotron-driver
 
+## 0.3.3-beta.1
+
+### Patch Changes
+
+- Fixed: a run can name a Fable model by its published id, not only by the tier word, which used to fail outright.
+- Fixed: the portal's run list shows a run's rating, never the reviewer's sign-off word, while the run is still in progress.
+- Fixed: naming an exact Claude model now runs that model, instead of quietly following the tier to a newer one.
+- Fixed: a run now records the tier it asked for, not a model version nobody chose. The report still names the model that ran.
+- Fixed: setup and doctor now report a Claude program too old for the models a search asks for, instead of passing it as fine.
+- Fixed: setup installs a version of the Claude program new enough to run the current top-tier model, which older versions refuse.
+- Fixed: the assistant's run summary names the rating again, where it had printed "[object object]" in its place.
+
 ## 0.3.3-beta.0
 
 ### Patch Changes

package/driver/citation-census.json

@@ -1,5 +1,5 @@
 {
-  "citations": 489,
-  "files": 3945,
-  "checkable": 126
+  "citations": 465,
+  "files": 3308,
+  "checkable": 129
 }

package/driver/config-inventory.mjs

@@ -71,7 +71,7 @@ const shown = (names) => names.map((n) => n);
  * and only one of them describes who gets the invoice.
  */
 export function engineInventory(env = process.env) {
-  // THE SAME EXPRESSION AS THE RUN DOOR, character for character (driver.config.mjs:1880,
+  // THE SAME EXPRESSION AS THE RUN DOOR, character for character (driver.config.mjs,
   // preflightEngineBinary). The obvious rewrite — `String(env.CLEAROTRON_AI ?? "").trim() || DEFAULT` —
   // reads better and disagrees on a whitespace-only value: it falls back to the default while the door
   // resolves `""` and refuses with "that is not an engine". The page would then name a known engine that

package/driver/dev-portal.mjs

@@ -145,7 +145,7 @@ function scanRuns(workspaceRoot) {
       const s = JSON.parse(readFileSync(join(dir, "status.json"), "utf8"));
       out.push({ runId: s.runId ?? `${slug}-${runName}`, slug: s.slug ?? slug, codename: s.codename ?? null,
         agent: s.agent ?? null, state: s.state ?? null, stepN: s.stepN ?? null, stepLabel: s.stepLabel ?? null,
-        stepTotal: s.stepTotal ?? null, verdict: s.verdict ?? null, sendPending: s.sendPending ?? null,
+        stepTotal: s.stepTotal ?? null, signoff: s.review?.signoff ?? s.verdict ?? null, tier: s.tier ?? null, sendPending: s.sendPending ?? null,
         markName: s.markName ?? null, updatedAt: s.updatedAt ?? null, archived });
     } catch { /* not a run dir / unreadable status — skip */ }
   };
@@ -293,8 +293,8 @@ $("#f").addEventListener("submit",async(e)=>{e.preventDefault();const fd=new For
  const r=await fetch("/dev/enqueue",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(b)});
  $("#fout").textContent=JSON.stringify(await r.json(),null,2);loadRuns();});
 async function loadRuns(){const r=await(await fetch("/dev/runs")).json();
- $("#runs").innerHTML=r.length?"<table><tr><th>run</th><th>state</th><th>step</th><th>verdict</th><th>updated</th></tr>"+r.map(x=>
-  '<tr><td>'+(x.markName??x.slug)+' · '+(x.codename??"?")+'</td><td class="'+(x.state==="delivered"?"ok":x.state==="failed"?"err":"warn")+'">'+(x.state??"?")+(x.sendPending?" (sendPending)":"")+'</td><td>'+(x.stepLabel??"")+'</td><td>'+(x.verdict??"")+'</td><td>'+(x.updatedAt??"").slice(0,19)+'</td></tr>').join("")+"</table>":"no runs yet";}
+ $("#runs").innerHTML=r.length?"<table><tr><th>run</th><th>state</th><th>step</th><th>sign-off</th><th>updated</th></tr>"+r.map(x=>
+  '<tr><td>'+(x.markName??x.slug)+' · '+(x.codename??"?")+'</td><td class="'+(x.state==="delivered"?"ok":x.state==="failed"?"err":"warn")+'">'+(x.state??"?")+(x.sendPending?" (sendPending)":"")+'</td><td>'+(x.stepLabel??"")+'</td><td>'+(x.signoff??"")+'</td><td>'+(x.updatedAt??"").slice(0,19)+'</td></tr>').join("")+"</table>":"no runs yet";}
 async function loadOutbox(){const r=await(await fetch("/dev/outbox")).json();
  $("#outbox").innerHTML=r.length?r.map(x=>'<details><summary>'+x.file+' <span class="warn">'+(x.packet?.kind??(x.legacyAgent?"delivered (legacy)":"?"))+'</span></summary><pre>'+JSON.stringify(x.packet??{legacyAgent:x.legacyAgent},null,2)+'</pre></details>').join(""):"outbox empty";}
 // ── Searches panel (Phase 3a): registry levels + saved recipes via the /recipes/* proxy. EVERY

package/driver/driver.config.mjs

@@ -656,10 +656,29 @@ export const config = {
 // stage definition and the id stamped on a token-rollup row are the same fact rather than two spellings
 // of it. resolveModel below is the only reader that matters; an engine with its own resolveModelId
 // overrides it, and anything already in catalog form passes through untouched.
+// ── A TIER IS WHAT WAS ASKED FOR, SO A TIER IS WHAT IS RECORDED ─────────────────────────────────────
+//
+// These three named a VERSION — `anthropic/claude-opus-5` — and nothing ever asked for one. A stage
+// names a tier, the tier goes to the program as the vendor's own alias, and the vendor answers with its
+// newest model of that tier. The version written here was a claim about a request nobody made, and it
+// was wrong the day a newer model shipped: a delivered run served throughout by the generation after
+// Opus 5 recorded, on every attempt row, a request for Opus 5, and its token line accounted under the
+// name of a model that did not run. Measured on that run, 2026-09-22.
+//
+// Owner's ruling, 2026-09-23: record the tier. What a run asked for is a tier, what it was served is
+// recorded separately and already is, and the report names the model that ran — none of that moves.
+//
+// WHAT IT COSTS, RULED ON AND ACCEPTED RATHER THAN DISCOVERED LATER. Per-model totals are keyed on what
+// was ASKED for, and the direct-API lanes must name a version because they call the API rather than the
+// program — the API takes model ids, not tier words. So one model reached by both routes now lands in
+// two buckets: `anthropic/claude-haiku` from a stage, `anthropic/claude-haiku-4-5` from those lanes.
+// That is a real split in a per-model total and it was accepted with the ruling: the two are genuinely
+// different requests, and keying the totals on what actually SERVED each turn is the change that would
+// fix it properly, which is larger than this and not what was ruled.
 export const MODELS = {
-  haiku: "anthropic/claude-haiku-4-5",
-  sonnet: "anthropic/claude-sonnet-5",
-  opus: "anthropic/claude-opus-5",
+  haiku: "anthropic/claude-haiku",
+  sonnet: "anthropic/claude-sonnet",
+  opus: "anthropic/claude-opus",
   gemini: "google/gemini-3.1-pro-preview",
   "gemini-flash": "google/gemini-3-flash-preview",
   "deepseek-v4-pro": "together/deepseek-ai/DeepSeek-V4-Pro",
@@ -675,11 +694,17 @@ export const MODELS = {
 //
 // A BARE Anthropic id (dated or not — "claude-haiku-4-5-20251001", "claude-opus-5") normalises to the
 // catalog form too. The direct-API lanes (jx completions/judge/nativeread, driver.config JX_PROVIDERS)
-// name their model that way because that is what the Messages API takes, so without this the same model
-// lands in a token rollup under two keys — "anthropic/claude-haiku-4-5" from the gateway's alias rows and
-// "claude-haiku-4-5-20251001" from the jx rows — and a per-model total is silently split. The date suffix
-// is dropped because the catalog ids carry none; anything that does not look like a bare claude id is
-// returned untouched, so a genuinely unknown model still keys as-is rather than being guessed at.
+// name their model that way because that is what the Messages API takes, so without this one model named
+// in two spellings — dated and undated — would key apart in a rollup. The date suffix is dropped;
+// anything that does not look like a bare claude id is returned untouched, so a genuinely unknown model
+// still keys as-is rather than being guessed at.
+//
+// WHAT THIS NO LONGER DOES, SAID PLAINLY BECAUSE THE PARAGRAPH ABOVE USED TO CLAIM IT. It used to unite
+// a stage's rows with those lanes' rows, because the tier resolved to a versioned id and so did they.
+// The tiers now resolve to a tier (MODELS), and these lanes still name a version, so the same model
+// reached both ways keys in two places. That split was ruled on and accepted (see MODELS) — it is not
+// an oversight here, and closing it by collapsing a version to its tier would throw away the one thing
+// these rows can still say about which model was asked for.
 export function resolveModel(model) {
   if (!model) return model;
   if (MODELS[model]) return MODELS[model];
@@ -1976,7 +2001,12 @@ export const ENGINE_BINARIES = {
     // newer", with no ceiling. Setup installs it into the engines folder (enginesFolder, below the table)
     // when the reader picks this engine, and the resolver uses it only when the machine has no copy of its
     // own. The package's own `bin` field names the program, so no path inside it is written down here.
-    package: "@anthropic-ai/claude-code", floor: "2.1.270",
+    // 2.1.280 is the floor because it is the oldest release that can run the current generation of this
+    // vendor's top tier: below it the API refuses the model id outright ("version 2.1.280 or newer is
+    // required"), and the tier alias quietly goes on serving the previous generation. Measured 2026-09-22
+    // on 2.1.263 — the alias returned the older model and the pinned id was refused — so a floor that
+    // only asks for a program that starts is a floor that passes a machine this engine cannot run on.
+    package: "@anthropic-ai/claude-code", floor: "2.1.280",
     // WHAT THE INSTALL TAKES ON DISK, in MB, which setup states before it asks to install. MEASURED, not
     // declared by the vendor: the engines folder after a fresh install of this package into an empty
     // folder, on npm 10.9.8 and on 11.19.1, 2026-09-14. A later release can be larger or smaller, so setup
@@ -2047,6 +2077,47 @@ export function enginesFolder({ env = process.env, home = homedir() } = {}) {
   return String(env[ENGINES_DIR_ENV] ?? "").trim() || join(home, ".local", "share", "clearotron", "engines");
 }
 
+/**
+ * Is the copy of an engine's program on this machine older than the version this build asks for?
+ *
+ * THE FLOOR GOVERNED ONE ROUTE OF TWO. Setup passes it to npm, so a program it installs cannot land
+ * under it; a copy already on the machine wins over the installed one by design, and nothing compared
+ * its version to anything. The two routes are not equally common — most machines have their own copy —
+ * so the check that existed covered the case that mostly does not arise.
+ *
+ * What that costs is not a crash. The program carries its own list of the models it accepts, so one
+ * below the floor refuses the model a tier names and serves the previous generation instead: the run
+ * completes, the report is delivered, and the only sign is a model id in the record that nobody chose.
+ * Measured 2026-09-22 on 2.1.263, where the current top tier's id came back a 400 and the tier alias
+ * answered with the generation before it.
+ *
+ * THREE-VALUED, AND THE THIRD VALUE IS THE POINT. `null` means "these two cannot be compared" — no
+ * floor declared, nothing read from the copy, or a version this cannot parse — and it is never "fine".
+ * A caller must say it could not look rather than print a pass, which is the absence-read-as-a-pass
+ * class that the rest of this file keeps naming. Only a version that parses and sorts below the floor
+ * comes back `true`.
+ *
+ * PURE, both arguments injected, so a test drives an old version and a current one without a program.
+ *
+ * @param {string|null|undefined} version  what the copy reports, e.g. "2.1.273"
+ * @param {string|null|undefined} floor    the engine's declared floor, e.g. "2.1.280"
+ * @returns {boolean|null} true = older than the floor; false = at it or newer; null = not comparable
+ */
+export function olderThanFloor(version, floor) {
+  const parts = (v) => {
+    const m = /^\s*v?(\d+)\.(\d+)(?:\.(\d+))?/.exec(String(v ?? ""));
+    return m ? [Number(m[1]), Number(m[2]), Number(m[3] ?? 0)] : null;
+  };
+  const [got, want] = [parts(version), parts(floor)];
+  if (!got || !want) return null;
+  // Part by part, never as text: "2.1.99" sorts above "2.1.280" as a string, and that comparison would
+  // read a machine two hundred releases behind as being ahead of the floor.
+  for (let i = 0; i < 3; i++) {
+    if (got[i] !== want[i]) return got[i] < want[i];
+  }
+  return false;
+}
+
 /** The npm arguments that install, or refresh, an engine's program in `dir`: "this version or newer". */
 export function engineInstallArgs(spec, dir = enginesFolder()) {
   return ["install", "--prefix", dir, "--no-fund", "--no-audit", `${spec.package}@>=${spec.floor}`];

package/driver/engine/CONTRACT.md

@@ -153,8 +153,9 @@ and could not be: the telemetry logged the alias that was ASKED FOR, so an arm r
 gemini and ran sonnet. Both tiers are gone — the failover chain was deleted in and both stages
 declare an anthropic tier in `STAGES` — and every engine's model map now **refuses** an alias it cannot
 run (`claudeModel`, `openaiModel`). On the anthropic engine a tier goes as the vendor's alias, a catalog
-id in the table (`anthropic/claude-opus-5`) goes as itself, a bare or dated `claude-*` id goes as its
-family's alias, and anything else throws. To hold a tier on one model, set the vendor's own
+id naming a family and a version (`anthropic/claude-opus-5-5`, `claude-haiku-4-5-20251001`) goes as
+that model so a pin holds, a `claude-*` id naming a family with no version goes as its family's alias
+because the CLI has no model by that name, and anything else throws. To hold a tier on one model, set the vendor's own
 `ANTHROPIC_DEFAULT_OPUS_MODEL` / `_SONNET_MODEL` / `_HAIKU_MODEL`, or `ANTHROPIC_DEFAULT_FABLE_MODEL` for
 `fable`, which no stage asks for unless an override names it, as `CLEAROTRON_SYNTHESIS_MODEL=fable` does; each
 reaches the CLI through the stage's environment.

package/driver/engine/anthropic-agent.mjs

@@ -156,11 +156,17 @@ const engineMaxBufferChars = () => Math.max(1024, Number(process.env.CLEAROTRON_
 // An alias with no claude equivalent now FAILS LOUD, exactly as `openaiModel` has always done for a
 // non-GPT id. That is the issue's requirement in one line: an unhonoured model override is an error,
 // not a substitution.
-const CLAUDE_MODEL = {
-  opus: "opus", sonnet: "sonnet", haiku: "haiku", fable: "fable",
-  "anthropic/claude-opus-5": "claude-opus-5", "anthropic/claude-sonnet-5": "claude-sonnet-5",
-  "anthropic/claude-sonnet-4-6": "sonnet", "anthropic/claude-haiku-4-5": "haiku",
-};
+// THE CATALOG IDS ARE NOT LISTED HERE ANY MORE, and removing them is what makes one rule cover every
+// id. Four sat here and two of them disagreed with the other two: `anthropic/claude-opus-5` and
+// `anthropic/claude-sonnet-5` went over as those models, while `anthropic/claude-sonnet-4-6` and
+// `anthropic/claude-haiku-4-5` went over as their tier's alias. A caller naming an exact model got it
+// or lost it depending on which of the four they happened to name, and nothing said which.
+//
+// The rule below now answers all four the same way, and no run changes: a stage names its TIER, and the
+// tier words above are still the whole of what a run passes. These ids reach this function only when a
+// caller names one — an override or an experiment arm — and there, being given the model you named is
+// the behaviour the rest of this function already promises.
+const CLAUDE_MODEL = { opus: "opus", sonnet: "sonnet", haiku: "haiku", fable: "fable" };
 export function claudeModel(model) {
   if (!model) return undefined;
   if (CLAUDE_MODEL[model]) return CLAUDE_MODEL[model];
@@ -168,8 +174,29 @@ export function claudeModel(model) {
   // that is a NAMING form of a model claude can actually run, not a substitution of a different one.
   // The family must be named IN the id: a `claude-*` id whose family this build does not recognise
   // throws too, rather than riding the old else-arm into sonnet.
-  const fam = /opus/i.test(model) ? "opus" : /haiku/i.test(model) ? "haiku" : /sonnet/i.test(model) ? "sonnet" : null;
-  if (fam && /^(?:anthropic\/)?claude-/i.test(model)) return fam;
+  // FABLE IS READ HERE TOO, and its absence was a live defect rather than a gap in readiness: the bare
+  // `fable` alias is in the table above, so `CLEAROTRON_SYNTHESIS_MODEL=fable` worked and hid it, while
+  // the pinned id every vendor page names — `claude-fable-5-1` — threw on its way to a program that runs
+  // it. Measured 2026-09-22: the program accepts that id and reports serving `claude-fable-5-1`.
+  const fam = /opus/i.test(model) ? "opus" : /haiku/i.test(model) ? "haiku" : /sonnet/i.test(model) ? "sonnet"
+    : /fable/i.test(model) ? "fable" : null;
+  if (fam && /^(?:anthropic\/)?claude-/i.test(model)) {
+    const bare = String(model).replace(/^anthropic\//i, "").toLowerCase();
+    // A CONCRETE ID GOES TO THE PROGRAM AS ITSELF, AND THAT IS WHAT MAKES A PIN A PIN. It used to come
+    // back as the bare family alias, so a caller who named an exact model got whichever model the tier
+    // pointed at — the same model on the day it was written, a different one the day a newer one
+    // shipped, and nothing to read in between. A silent un-pinning is the substitution this function
+    // exists to refuse, in the one form it still allowed.
+    //
+    // A FAMILY WITH NO VERSION IS THE TIER, not a model: `claude-opus` is what an operator types for a
+    // deployment of that tier, and the program has no model by that name. It keeps following the family.
+    //
+    // Measured against the program rather than assumed (2026-09-22): it accepts `claude-sonnet-5`,
+    // `claude-haiku-4-5-20251001` and `claude-fable-5-1` and reports serving each of them, so passing an
+    // exact id through costs nothing that the alias was buying. Where a caller names an id the program
+    // does not know, it says so and the turn fails loudly — which is the honest end of a bad pin.
+    return /^claude-(?:[a-z]+-\d|\d)/.test(bare) ? bare : fam;
+  }
   throw new Error(`anthropic-agent: no claude model mapped for "${model}" — this engine runs claude only. Pass opus/sonnet/haiku/fable or a concrete claude-* id. (It used to substitute sonnet silently and log the alias you asked for: #238 corruption 3.)`);
 }
 

package/driver/engine/mcp/probe-server.mjs

@@ -9,8 +9,17 @@
 // server, asks it to call `ping` once, and passes only when the reply carries what `ping` returned.
 //
 // WHAT IT RETURNS IS THE PROOF. Its one argument is a random word the probe mints for each
-// turn and gives only to this process, so a reply that carries it cannot be the model guessing. Read-only;
-// it touches no file, no network and no run.
+// turn and gives only to this process, so a reply that carries it cannot be the model guessing. It touches
+// no file, no network and no run.
+//
+// IT IS DECLARED AS THE REGISTER SEARCH IS DECLARED, NOT AS WHAT IT DOES. codex decides from a tool's
+// annotations whether a call needs approval, and `codex exec` refuses every call that does ("MCP tool call
+// requires approval, but approval policy is never") unless its sandbox is bypassed. A read-only tool never
+// needs approval, so a read-only `ping` passed on hosts where `register_execute_plan` — marked not
+// read-only and open-world on every register server — was refused on every call and no search could run.
+// The probe exists to answer for the tools a search calls, so its tool carries that tool's annotations,
+// and a test keeps the two equal. The rule, in codex's own source, identical from 0.150.1 to 0.156.1:
+// read-only → no approval; otherwise approval when destructive, or open-world, or either left unmarked.
 import { serve } from "./stdio-server.mjs";
 
 serve({
@@ -19,7 +28,7 @@ serve({
     name: "ping",
     description: "Return the word this check is waiting for.",
     inputSchema: { type: "object", properties: {}, additionalProperties: false },
-    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     handler: async () => {
       const word = String(process.argv[2] ?? "").trim();
       return word ? word : { isError: true, text: "ping: this server was started without a word to return" };

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.3-beta.0",
+  "version": "0.3.3-beta.1",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline-knockout.mjs

@@ -639,7 +639,7 @@ export async function knockoutInner(ctx, job, opts = {}) {
       // for reconcile-runs' exact liveness test. The stepper and the identity are separate calls now.
       ...identitySeed(),
       stepIndex: 0, stepLabel: STEPS[0], stepN: 1, stepTotal: STEPS.length,
-      verdict: null, url: null, failedStage: null, reason: null, deliveredAt: null,
+      review: null, url: null, failedStage: null, reason: null, deliveredAt: null,
       // A5/A3: a re-run of a previously-terminal knockout may reopen the state ONLY because the resume
       // guard cleared the sentinel (ctx.stateReset threads that authority); startedAt is no longer
       // seeded anywhere — writeRunStatus backfills it first-write-wins.
@@ -1092,11 +1092,11 @@ export async function knockoutInner(ctx, job, opts = {}) {
     const deliveredAt = new Date().toISOString();
     // `tier` beside `verdict` — the same band word under the name the clearance lane records it by, so a
     // reader of either lane's status finds the rating in one place. `verdict` stays as it was.
-    writeRunStatus(ctx, { state: "delivered", verdict: overall, tier: overall, statement: published.statement, url: published.url, reports: published.reports.map((r) => ({ mark: r.mark, url: r.url })), deliveredAt, sendPending: true, stepIndex: STEPS.length - 1, stepLabel: STEPS[STEPS.length - 1], stepN: STEPS.length, stepTotal: STEPS.length });
+    writeRunStatus(ctx, { state: "delivered", tier: overall, statement: published.statement, url: published.url, reports: published.reports.map((r) => ({ mark: r.mark, url: r.url })), deliveredAt, sendPending: true, stepIndex: STEPS.length - 1, stepLabel: STEPS[STEPS.length - 1], stepN: STEPS.length, stepTotal: STEPS.length });
     // — the knockout lane's pool copy learns its terminal state the same way,
     // for the same reason: publish returns the pool dir, and `state: "delivered"` is decided after it
     // returns. Same seam, same best-effort contract, no lane-specific exception to write down.
-    const stamp = writeSettleStamp(published.poolRunDir, { state: "delivered", verdict: overall, deliveredAt, runId: published.runId ?? run.runId, lane: "knockout" });
+    const stamp = writeSettleStamp(published.poolRunDir, { state: "delivered", tier: overall, deliveredAt, runId: published.runId ?? run.runId, lane: "knockout" });
     if (!stamp.written) note(`delivery: settle stamp not written (${stamp.reason})`);
     const archived = archive(run);
     rollupStatus(run.studioRoot);