From 3300dfb3e9f1b318bd6cd1e37a55c06f9a0f8949 Mon Sep 17 00:00:00 2001
From: kristofferR <kristofferR@users.noreply.github.com>
Date: Mon, 27 Jul 2026 20:34:51 +0200
Subject: [PATCH 1/2] Rename the drain to autofix
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"Drain" was doing three unrelated jobs — the installer, the per-repository
permission to write code, and the fix-before-review invariant — while the
same word, correctly, also meant "consume the shared REST quota" on adjacent
lines. Nothing in the chain but the name was ever called anything other than
fix: the action is `fix`, the report says `fix`, the session is a fix session.

The feature is now autofix, which pairs with autoreview: one keeps open pull
requests reviewed, the other keeps them fixed.

  crq drain install        ->  crq autofix install
  crq drain [on|off|default]   crq autofix [on|off|default]

A hard break, with no compatibility path. The persisted keys move with it —
drain -> autofix, drains -> autofix_by_host, repo_drain -> repo_autofix — so
a pre-rename binary sharing the state ref sees no autofix switches and no
dispatch health. Every host has to be upgraded together. The installed
artifacts move too: crq-autofix, crq-autofix.service,
no.kristofferr.crq-autofix, autofix.log/autofix.err.

The invariant is fix-first now, and findings are cleared rather than drained.
"Drain" survives only where it means draining a resource or a stream: the REST
quota, a child's stdout, git's credential-helper lines.

Three fixes the preflight surfaced in the files this touches:

- the install plan took its repository list straight off a map, so a re-install
  rewrote the unit in a new order and --dry-run described a different service
  than the install that followed it;
- Environment= assignments were not percent-escaped, and systemd expands
  specifiers there, so a '%' in a path or a review command was eaten;
- the repository key trimmed ".git" before lowercasing, so a ".GIT" suffix
  survived into the key and matched nothing.
---
 README.md                                     |  12 +-
 cmd/crq/main.go                               |  85 ++++++------
 examples/dispatch/README.md                   |  10 +-
 internal/crq/{drain.go => autofix.go}         | 126 +++++++++---------
 .../crq/{drain_test.go => autofix_test.go}    | 112 +++++++++-------
 .../crq/{drainswitch.go => autofixswitch.go}  |  38 +++---
 ...inswitch_test.go => autofixswitch_test.go} |  36 ++---
 internal/crq/claimrace_test.go                |   8 +-
 internal/crq/config.go                        |   4 +-
 internal/crq/config_test.go                   |   2 +-
 internal/crq/dismiss.go                       |   6 +-
 internal/crq/dispatch/fix-prompt.txt          |   2 +-
 internal/crq/feedback.go                      |   2 +-
 internal/crq/feedback_test.go                 |   6 +-
 internal/crq/next.go                          |  10 +-
 internal/crq/next_test.go                     |  16 +--
 internal/crq/service.go                       |   4 +-
 internal/crq/skipmarker_test.go               |   2 +-
 internal/crq/state.go                         |   8 +-
 internal/crq/watch.go                         |  26 ++--
 internal/crq/watch_test.go                    |  32 ++---
 internal/engine/next.go                       |   2 +-
 .../state/{drain_test.go => autofix_test.go}  |  58 ++++----
 internal/state/autofixswitch.go               |  76 +++++++++++
 internal/state/dashboard.go                   |   4 +-
 internal/state/drainswitch.go                 |  74 ----------
 internal/state/state.go                       |  94 ++++++-------
 internal/state/statusline.go                  |   4 +-
 llms.txt                                      |  16 +--
 skills/coderabbit-queue/SKILL.md              |  18 +--
 30 files changed, 461 insertions(+), 432 deletions(-)
 rename internal/crq/{drain.go => autofix.go} (80%)
 rename internal/crq/{drain_test.go => autofix_test.go} (78%)
 rename internal/crq/{drainswitch.go => autofixswitch.go} (65%)
 rename internal/crq/{drainswitch_test.go => autofixswitch_test.go} (74%)
 rename internal/state/{drain_test.go => autofix_test.go} (62%)
 create mode 100644 internal/state/autofixswitch.go
 delete mode 100644 internal/state/drainswitch.go

diff --git a/README.md b/README.md
index c9d9efc6..d2fed2ef 100644
--- a/README.md
+++ b/README.md
@@ -302,7 +302,7 @@ Read `.action`, do exactly that, call it again.
 | `done` | converged |
 | `blocked` | needs a human; `.reason` says why |
 
-Every rule this used to spell out is now a value crq computes. Drain-before-review is `fix` coming
+Every rule this used to spell out is now a value crq computes. Fix-before-review is `fix` coming
 before everything else. Hold-the-head is the `hold` action, including the exception where a
 CodeRabbit rate-limit degrade releases the head because the queued review will fire on whatever head
 exists when the window opens. The wait is `.recheck_after`, derived from the account-quota window,
@@ -397,12 +397,12 @@ crq feedback <repo> <pr>  # current normalized findings as JSON, WITHOUT trigger
 crq threads <repo> <pr>                                     # every unresolved thread, outdated included
 crq resolve <thread-id> [<thread-id>...]                    # resolve addressed review threads
 crq decline <thread-id> [...] --reason "<why>" [--resolve]  # record why a finding is declined
-crq drain install         # ⭐ unattended: watch every PR and fix what needs fixing
-crq watch                 #    what the drain runs: drive open PRs through crq next, one JSON
+crq autofix install       # ⭐ unattended: watch every PR and fix what needs fixing
+crq watch                 #    what autofix runs: drive open PRs through crq next, one JSON
                           #    line each. Fixing is ON by default (--no-dispatch observes only)
-crq drain                 # which repositories crq may fix
-crq drain off <repo> --reason "<why>"   # stop fixing there; watching and reviewing continue
-crq drain on <repo> | crq drain default <repo>
+crq autofix               # which repositories crq may fix
+crq autofix off <repo> --reason "<why>"   # stop fixing there; watching and reviewing continue
+crq autofix on <repo> | crq autofix default <repo>
 crq hold <repo> <pr> --reason "<why>"                       # persistently stop reviews for a PR
 crq unhold <repo> <pr>                                      # resume reviews for a held PR
 crq hold                                                    # list held PRs
diff --git a/cmd/crq/main.go b/cmd/crq/main.go
index 72543950..2c4a4b25 100644
--- a/cmd/crq/main.go
+++ b/cmd/crq/main.go
@@ -64,20 +64,20 @@ func run(ctx context.Context, args []string) int {
 		return 1
 	case "preflight":
 		return preflight(ctx, args[1:])
-	case "drain":
+	case "autofix":
 		// A dry run is documented as a PREVIEW: it writes nothing and reads no
 		// GitHub state. Deciding it here, before the authenticated client is
 		// built, is what lets somebody inspect the setup before finishing it —
 		// otherwise the one command for looking at the plan was itself another
 		// thing to set up first. A real install still goes through the
 		// authenticated path below.
-		if opts, perr := parseDrainArgs(args[1:]); perr == nil && opts.dryRun {
+		if opts, perr := parseAutofixArgs(args[1:]); perr == nil && opts.dryRun {
 			cfg, cerr := crq.LoadConfig()
 			if cerr != nil {
 				fatal(cerr)
 				return 1
 			}
-			plan, ierr := crq.DrainPlan(cfg, opts.agent, crq.SplitArgv(opts.agentArgs), opts.repos, true)
+			plan, ierr := crq.AutofixPlan(cfg, opts.agent, crq.SplitArgv(opts.agentArgs), opts.repos, true)
 			if ierr != nil {
 				fatal(ierr)
 				return 1
@@ -276,17 +276,17 @@ func run(ctx context.Context, args []string) int {
 		}
 		printJSON(result)
 		return 0
-	case "drain":
-		switch sub := drainSubcommand(args[1:]); sub {
+	case "autofix":
+		switch sub := autofixSubcommand(args[1:]); sub {
 		case "?":
-			fatal(fmt.Errorf("unknown drain subcommand %q (try: crq drain, crq drain on|off|default <repo>, crq drain install)", args[1]))
+			fatal(fmt.Errorf("unknown autofix subcommand %q (try: crq autofix, crq autofix on|off|default <repo>, crq autofix install)", args[1]))
 			return 1
 		case "", "list":
 			if err := cfg.RequireState(); err != nil {
 				fatal(err)
 				return 1
 			}
-			settings, derr := service.DrainSettings(ctx)
+			settings, derr := service.AutofixSettings(ctx)
 			if derr != nil {
 				fatal(derr)
 				return 1
@@ -294,9 +294,9 @@ func run(ctx context.Context, args []string) int {
 			printJSON(settings)
 			return 0
 		case "on", "off", "default":
-			rest, reason, ok := parseDrainReason(args[2:])
+			rest, reason, ok := parseAutofixReason(args[2:])
 			if !ok || len(rest) != 1 {
-				fatal(errors.New(`usage: crq drain on|off|default <repo> [--reason "<why>"]`))
+				fatal(errors.New(`usage: crq autofix on|off|default <repo> [--reason "<why>"]`))
 				return 1
 			}
 			if err := cfg.RequireState(); err != nil {
@@ -304,7 +304,7 @@ func run(ctx context.Context, args []string) int {
 				return 1
 			}
 			if sub == "default" {
-				cleared, cerr := service.ClearDrainEnabled(ctx, rest[0])
+				cleared, cerr := service.ClearAutofixEnabled(ctx, rest[0])
 				if cerr != nil {
 					fatal(cerr)
 					return 1
@@ -312,7 +312,7 @@ func run(ctx context.Context, args []string) int {
 				printJSON(map[string]any{"repo": crq.NormalizeRepo(rest[0]), "cleared": cleared, "enabled": true, "default": true})
 				return 0
 			}
-			setting, serr := service.SetDrainEnabled(ctx, rest[0], sub == "on", reason)
+			setting, serr := service.SetAutofixEnabled(ctx, rest[0], sub == "on", reason)
 			if serr != nil {
 				fatal(serr)
 				return 1
@@ -320,7 +320,7 @@ func run(ctx context.Context, args []string) int {
 			printJSON(setting)
 			return 0
 		}
-		opts, perr := parseDrainArgs(args[1:])
+		opts, perr := parseAutofixArgs(args[1:])
 		if perr != nil {
 			fatal(perr)
 			return 1
@@ -329,7 +329,7 @@ func run(ctx context.Context, args []string) int {
 			fatal(err)
 			return 1
 		}
-		plan, ierr := service.InstallDrain(ctx, opts.agent, crq.SplitArgv(opts.agentArgs), opts.repos, opts.dryRun)
+		plan, ierr := service.InstallAutofix(ctx, opts.agent, crq.SplitArgv(opts.agentArgs), opts.repos, opts.dryRun)
 		if ierr != nil {
 			fatal(ierr)
 			return 1
@@ -626,9 +626,10 @@ USAGE
   crq decline <thread-id> [...] --reason "<why>" [--keep-open]
                                    reply on a thread to record why a finding is declined
                                    (resolves it; --keep-open leaves it open)
-  crq drain install [--agent <path>] [--dry-run] [<repo>...]
-  crq drain [on|off|default <repo>]  which repositories crq may fix (on by default)
-                                   install and start the unattended review drain
+  crq autofix install [--agent <path>] [--dry-run] [<repo>...]
+                                   install and start unattended autofix
+  crq autofix [on|off|default <repo>]
+                                   which repositories crq may fix (on by default)
   crq watch [--no-dispatch] [--once] [<repo>...] [-- <fix command>]
                                    drive open PRs through crq next; --dispatch starts a
                                    session to fix the ones that need it
@@ -731,7 +732,7 @@ more of the shared budget — run the daemon.
 
 Review round primitive for humans and agents. crq coordinates the review trigger,
 waits for real feedback on the current PR head, and emits one JSON report to stdout.
-It returns unresolved findings before queueing a new round, so agents must drain
+It returns unresolved findings before queueing a new round, so agents must clear
 current feedback before waiting for another review.
 
 Exit codes:
@@ -797,17 +798,17 @@ replies contesting the decline, crq re-surfaces that reply as its own finding.
 Pass --keep-open to leave it unresolved anyway (an on-the-record disagreement you
 intend to keep working). Thread IDs come from .findings[].thread_id.
 `)
-	case "drain":
-		fmt.Print(`crq drain install [--agent <path>] [--dry-run] [<repo>...]
-crq drain                            (which repositories crq may fix)
-crq drain off <repo> [--reason "<why>"]
-crq drain on <repo>
-crq drain default <repo>             (back to the fleet default, which is on)
-
-Install and start the unattended review drain: crq watches every open PR and
+	case "autofix":
+		fmt.Print(`crq autofix install [--agent <path>] [--dry-run] [<repo>...]
+crq autofix                            (which repositories crq may fix)
+crq autofix off <repo> [--reason "<why>"]
+crq autofix on <repo>
+crq autofix default <repo>             (back to the fleet default, which is on)
+
+Install and start unattended autofix: crq watches every open PR and
 starts a fix session for the ones that need one.
 
-Draining is ON for every repository in scope. That is the point of watching: a
+Autofix is ON for every repository in scope. That is the point of watching: a
 pull request nobody fixes is a queue that reports work and does none. Turn it off
 where you do not want crq writing code — a release branch, a repository you are
 hand-tuning — and watching continues there regardless, so reviews still arrive
@@ -841,7 +842,7 @@ line per PR per pass, and start a fix session for each PR whose action is "fix".
 
 Fixing is the default — watching a pull request nobody fixes is a queue that
 reports work and does none. Three things turn it off: --no-dispatch for one run,
-"crq drain off <repo>" for one repository, and having no fix command configured
+"crq autofix off <repo>" for one repository, and having no fix command configured
 at all, which observes and says so rather than refusing to start.
 
 A dispatched session runs in a worktree crq checked out at that head, with:
@@ -969,7 +970,7 @@ stops blocking the round.
 
 crq resolve and crq decline both act on a thread. A review-body finding, a
 review-skipped notice or an outside-diff remark has none, so neither command can
-touch it — and a finding that can never drain blocks every future round, leaving
+touch it — and a finding that can never be cleared blocks every future round, leaving
 a PR whose current head no review was ever requested for.
 
 Finding IDs come from .findings[].id. They are content-derived, not GitHub node
@@ -1776,18 +1777,18 @@ func configPath() string {
 	return home + "/.config/crq/env"
 }
 
-// drainArgs is `crq drain install`'s parsed command line.
-type drainArgs struct {
+// autofixArgs is `crq autofix install`'s parsed command line.
+type autofixArgs struct {
 	agent     string
 	agentArgs string
 	dryRun    bool
 	repos     []string
 }
 
-// parseDrainArgs is shared by the pre-authentication dry-run path and the
+// parseAutofixArgs is shared by the pre-authentication dry-run path and the
 // install itself, so the two cannot disagree about what was asked for.
-func parseDrainArgs(args []string) (drainArgs, error) {
-	fs := flag.NewFlagSet("drain", flag.ContinueOnError)
+func parseAutofixArgs(args []string) (autofixArgs, error) {
+	fs := flag.NewFlagSet("autofix", flag.ContinueOnError)
 	fs.SetOutput(os.Stderr)
 	agent := fs.String("agent", "", "fix agent to run: claude or codex (default: claude on PATH)")
 	agentArgs := fs.String("agent-args", "", "extra flags for the agent, e.g. model and reasoning effort")
@@ -1797,22 +1798,22 @@ func parseDrainArgs(args []string) (drainArgs, error) {
 		sub, rest = rest[0], rest[1:]
 	}
 	if err := fs.Parse(rest); err != nil {
-		return drainArgs{}, err
+		return autofixArgs{}, err
 	}
 	if sub != "install" {
-		return drainArgs{}, errors.New("usage: crq drain install [--agent <path>] [--dry-run] [<repo>...]")
+		return autofixArgs{}, errors.New("usage: crq autofix install [--agent <path>] [--dry-run] [<repo>...]")
 	}
-	return drainArgs{agent: *agent, agentArgs: *agentArgs, dryRun: *dryRun, repos: fs.Args()}, nil
+	return autofixArgs{agent: *agent, agentArgs: *agentArgs, dryRun: *dryRun, repos: fs.Args()}, nil
 }
 
-// drainSubcommand names what `crq drain ...` was asked to do. An empty string
+// autofixSubcommand names what `crq autofix ...` was asked to do. An empty string
 // means the bare command, which lists; "?" means something this command does not
 // have.
 //
-// A typo must not list. `crq drain of owner/name` reading as the bare listing
-// would report the repository as drained and leave it drained — an answer to a
+// A typo must not list. `crq autofix of owner/name` reading as the bare listing
+// would report the repository as fixable and leave it fixable — an answer to a
 // question nobody asked, in place of the instruction that was meant.
-func drainSubcommand(args []string) string {
+func autofixSubcommand(args []string) string {
 	if len(args) == 0 {
 		return ""
 	}
@@ -1823,10 +1824,10 @@ func drainSubcommand(args []string) string {
 	return "?"
 }
 
-// parseDrainReason splits `<repo>` from an optional --reason value. An
+// parseAutofixReason splits `<repo>` from an optional --reason value. An
 // unrecognized flag is an error rather than a positional: a typo like --resaon
 // must fail loudly, not silently become the repository name.
-func parseDrainReason(args []string) (rest []string, reason string, ok bool) {
+func parseAutofixReason(args []string) (rest []string, reason string, ok bool) {
 	for i := 0; i < len(args); i++ {
 		switch arg := args[i]; {
 		case arg == "--reason":
diff --git a/examples/dispatch/README.md b/examples/dispatch/README.md
index edc73b92..cb37efe0 100644
--- a/examples/dispatch/README.md
+++ b/examples/dispatch/README.md
@@ -1,13 +1,13 @@
-# Unattended review drain
+# Unattended autofix
 
 `crq watch --dispatch` turns "this PR needs fixing" into a session that fixes it.
 
 ```bash
-crq drain install                 # prompt + wrapper + service, started
-crq drain install --dry-run       # print what it would write first
+crq autofix install                 # prompt + wrapper + service, started
+crq autofix install --dry-run       # print what it would write first
 
 # a different agent, and its own model/effort settings
-crq drain install --agent codex --agent-args '-c model_reasoning_effort=high'
+crq autofix install --agent codex --agent-args '-c model_reasoning_effort=high'
 ```
 
 crq knows how to CALL claude and codex, and nothing about which model either
@@ -45,6 +45,6 @@ somebody else actively holds stops a session now.
 
 - `$CRQ_WORKSPACE/logs/<owner>/<name>/<pr>-<head>-<time>.log` — each session's own
   output, the last five per PR. A failed session also keeps its worktree.
-- `~/.local/state/crq/drain.err` — one line per dispatch, naming the session log.
+- `~/.local/state/crq/autofix.err` — one line per dispatch, naming the session log.
 - The dashboard issue and `crq status --line` — three passes in a row that start
   nothing and both say `dispatch failing`, rather than leaving it to be noticed.
diff --git a/internal/crq/drain.go b/internal/crq/autofix.go
similarity index 80%
rename from internal/crq/drain.go
rename to internal/crq/autofix.go
index 350366aa..9394710f 100644
--- a/internal/crq/drain.go
+++ b/internal/crq/autofix.go
@@ -22,9 +22,9 @@ import (
 //go:embed dispatch/fix-prompt.txt
 var fixPrompt string
 
-// DrainInstall describes what an install would do, so --dry-run can print it and
+// AutofixInstall describes what an install would do, so --dry-run can print it and
 // the result can be reported.
-type DrainInstall struct {
+type AutofixInstall struct {
 	Platform  string `json:"platform"`
 	Prompt    string `json:"prompt"`
 	Wrapper   string `json:"wrapper"`
@@ -42,7 +42,7 @@ type DrainInstall struct {
 	Started    bool     `json:"started,omitempty"`
 }
 
-// InstallDrain sets up the unattended review drain: the prompt, a wrapper, a
+// InstallAutofix sets up unattended autofix: the prompt, a wrapper, a
 // service definition, and whatever the platform needs to keep it running across
 // a logout.
 //
@@ -50,31 +50,31 @@ type DrainInstall struct {
 // files, remember `loginctl enable-linger`, and get the environment right — and
 // a setup people get wrong is a setup that silently does nothing, which is the
 // failure this whole feature is about.
-func (s *Service) InstallDrain(ctx context.Context, agent string, agentArgs []string, repos []string, dryRun bool) (DrainInstall, error) {
+func (s *Service) InstallAutofix(ctx context.Context, agent string, agentArgs []string, repos []string, dryRun bool) (AutofixInstall, error) {
 	effectiveDryRun := dryRun || s.cfg.DryRun
-	plan, err := DrainPlan(s.cfg, agent, agentArgs, repos, effectiveDryRun)
+	plan, err := AutofixPlan(s.cfg, agent, agentArgs, repos, effectiveDryRun)
 	if err != nil || effectiveDryRun {
 		return plan, err
 	}
-	return s.applyDrain(ctx, plan)
+	return s.applyAutofix(ctx, plan)
 }
 
-// DrainPlan computes what an install WOULD write and run, from configuration
+// AutofixPlan computes what an install WOULD write and run, from configuration
 // alone.
 //
-// Separate from applying it because `crq drain install --dry-run` is documented
+// Separate from applying it because `crq autofix install --dry-run` is documented
 // as a preview and must work for somebody who has not authenticated yet: the
 // plan reads no GitHub state, so requiring a token to see it turned the one
 // command for inspecting the setup into another thing to set up first.
-func DrainPlan(cfg Config, agent string, agentArgs []string, repos []string, dryRun bool) (DrainInstall, error) {
+func AutofixPlan(cfg Config, agent string, agentArgs []string, repos []string, dryRun bool) (AutofixInstall, error) {
 	home, err := os.UserHomeDir()
 	if err != nil {
-		return DrainInstall{}, err
+		return AutofixInstall{}, err
 	}
 	if agent = strings.TrimSpace(agent); agent == "" {
 		agent, err = exec.LookPath("claude")
 		if err != nil {
-			return DrainInstall{}, fmt.Errorf("no fix agent found: pass --agent <path> (tried \"claude\" on PATH)")
+			return AutofixInstall{}, fmt.Errorf("no fix agent found: pass --agent <path> (tried \"claude\" on PATH)")
 		}
 	} else {
 		// A typo here is not a smaller mistake than a missing default: the install
@@ -82,21 +82,21 @@ func DrainPlan(cfg Config, agent string, agentArgs []string, repos []string, dry
 		// which is the silent nothing this command exists to prevent.
 		resolved, lerr := exec.LookPath(agent)
 		if lerr != nil {
-			return DrainInstall{}, fmt.Errorf("fix agent %q cannot be run: %w", agent, lerr)
+			return AutofixInstall{}, fmt.Errorf("fix agent %q cannot be run: %w", agent, lerr)
 		}
 		agent = resolved
 	}
 	agent, err = filepath.Abs(agent)
 	if err != nil {
-		return DrainInstall{}, fmt.Errorf("resolving fix agent %q: %w", agent, err)
+		return AutofixInstall{}, fmt.Errorf("resolving fix agent %q: %w", agent, err)
 	}
 	if len(repos) == 0 {
-		for repo := range cfg.AllowRepos {
-			repos = append(repos, repo)
-		}
+		// Sorted, because the plan is what --dry-run shows and what the unit
+		// records: map order would make two identical installs disagree.
+		repos = sortedRepoList(cfg.AllowRepos)
 	}
 	if len(repos) == 0 {
-		return DrainInstall{}, fmt.Errorf("no repositories to watch: pass them, or set CRQ_REPOS")
+		return AutofixInstall{}, fmt.Errorf("no repositories to watch: pass them, or set CRQ_REPOS")
 	}
 
 	// The service writes its output here. systemd refuses to start a unit whose
@@ -104,11 +104,11 @@ func DrainPlan(cfg Config, agent string, agentArgs []string, repos []string, dry
 	// exist before the unit does — a service that will not start is exactly the
 	// silent nothing this command exists to prevent.
 	logDir := filepath.Join(home, ".local", "state", "crq")
-	plan := DrainInstall{
+	plan := AutofixInstall{
 		Platform: runtime.GOOS,
 		LogDir:   logDir,
 		Prompt:   filepath.Join(home, ".local", "share", "crq", "fix-prompt.txt"),
-		Wrapper:  filepath.Join(home, ".local", "bin", "crq-drain"),
+		Wrapper:  filepath.Join(home, ".local", "bin", "crq-autofix"),
 		Agent:    agent,
 		Repos:    repos,
 		DryRun:   dryRun,
@@ -116,27 +116,27 @@ func DrainPlan(cfg Config, agent string, agentArgs []string, repos []string, dry
 	if root := strings.TrimSpace(cfg.WorkspaceRoot); root != "" {
 		plan.Workspace, err = filepath.Abs(root)
 		if err != nil {
-			return plan, fmt.Errorf("resolving drain workspace %q: %w", root, err)
+			return plan, fmt.Errorf("resolving autofix workspace %q: %w", root, err)
 		}
 	}
 	switch runtime.GOOS {
 	case "darwin":
-		plan.Unit = filepath.Join(home, "Library", "LaunchAgents", "no.kristofferr.crq-drain.plist")
+		plan.Unit = filepath.Join(home, "Library", "LaunchAgents", "no.kristofferr.crq-autofix.plist")
 		plan.Commands = []string{
-			"launchctl bootout gui/$(id -u)/no.kristofferr.crq-drain",
+			"launchctl bootout gui/$(id -u)/no.kristofferr.crq-autofix",
 			"launchctl bootstrap gui/$(id -u) " + plan.Unit,
 		}
 	default:
-		plan.Unit = filepath.Join(home, ".config", "systemd", "user", "crq-drain.service")
+		plan.Unit = filepath.Join(home, ".config", "systemd", "user", "crq-autofix.service")
 		plan.Commands = []string{
 			"loginctl enable-linger " + os.Getenv("USER"),
 			"systemctl --user daemon-reload",
-			"systemctl --user enable crq-drain",
+			"systemctl --user enable crq-autofix",
 			// restart, not "enable --now": --now does nothing to a unit that is
 			// already running, so reinstalling with a different agent or prompt
 			// silently kept the old one going. An install that appears to succeed
 			// and changes nothing is the worst of both.
-			"systemctl --user restart crq-drain",
+			"systemctl --user restart crq-autofix",
 		}
 	}
 	invocation, err := agentInvocation(agent, plan.Prompt, agentArgs)
@@ -148,14 +148,14 @@ func DrainPlan(cfg Config, agent string, agentArgs []string, repos []string, dry
 	return plan, nil
 }
 
-// applyDrain writes the plan to disk and starts the service.
-func (s *Service) applyDrain(ctx context.Context, plan DrainInstall) (DrainInstall, error) {
+// applyAutofix writes the plan to disk and starts the service.
+func (s *Service) applyAutofix(ctx context.Context, plan AutofixInstall) (AutofixInstall, error) {
 	invocation, logDir := plan.Invocation, plan.LogDir
 	self, err := os.Executable()
 	if err != nil {
 		return plan, err
 	}
-	if err := drainCanAuthenticate(ctx); err != nil {
+	if err := autofixCanAuthenticate(ctx); err != nil {
 		return plan, err
 	}
 	if err := os.MkdirAll(logDir, 0o755); err != nil {
@@ -165,7 +165,7 @@ func (s *Service) applyDrain(ctx context.Context, plan DrainInstall) (DrainInsta
 	// Known agents receive their non-interactive flags. Any other executable is
 	// treated as a self-contained prompt-taking wrapper.
 	wrapper := fmt.Sprintf(`#!/usr/bin/env bash
-# Installed by "crq drain install". Runs the review drain: crq decides, and a
+# Installed by "crq autofix install". Runs autofix: crq decides, and a
 # fix session is started for each PR that needs one.
 set -uo pipefail
 exec %s watch -- %s
@@ -178,30 +178,30 @@ exec %s watch -- %s
 	}{
 		{plan.Prompt, fixPrompt, 0o644},
 		{plan.Wrapper, wrapper, 0o755},
-		{plan.Unit, s.drainUnit(plan), 0o644},
+		{plan.Unit, s.autofixUnit(plan), 0o644},
 	} {
 		if err := os.MkdirAll(filepath.Dir(f.path), 0o755); err != nil {
 			return plan, err
 		}
-		if err := writeDrainFile(f.path, f.body, f.mode); err != nil {
+		if err := writeAutofixFile(f.path, f.body, f.mode); err != nil {
 			return plan, err
 		}
 	}
 
 	// The files are the durable part, and a machine without systemd/launchd still
-	// gets something runnable by hand — but a failure here means the drain is not
+	// gets something runnable by hand — but a failure here means the autofix service is not
 	// running, and reporting `started` for that is the same silent nothing this
 	// command exists to prevent. Say which command failed, and let the caller see
 	// the paths that were written.
 	var failed []string
-	commandArgs := drainCommandArgs(plan)
+	commandArgs := autofixCommandArgs(plan)
 	if len(plan.Commands) != len(commandArgs) {
-		return plan, errors.New("drain start commands are incomplete")
+		return plan, errors.New("autofix start commands are incomplete")
 	}
 	for i, line := range plan.Commands {
 		args := commandArgs[i]
 		if len(args) == 0 {
-			return plan, fmt.Errorf("drain start command %q has no executable", line)
+			return plan, fmt.Errorf("autofix start command %q has no executable", line)
 		}
 		cmd := exec.CommandContext(ctx, args[0], args[1:]...)
 		output, err := cmd.CombinedOutput()
@@ -214,39 +214,39 @@ exec %s watch -- %s
 				detail += ": " + text
 			}
 			if s.log != nil {
-				s.log.Printf("drain install: %s: %s", line, detail)
+				s.log.Printf("autofix install: %s: %s", line, detail)
 			}
 			failed = append(failed, fmt.Sprintf("%s: %s", line, detail))
 		}
 	}
 	if len(failed) > 0 {
-		return plan, fmt.Errorf("the drain files are installed, but starting it failed — run these by hand: %s",
+		return plan, fmt.Errorf("the autofix files are installed, but starting it failed — run these by hand: %s",
 			strings.Join(failed, "; "))
 	}
 	plan.Started = true
 	return plan, nil
 }
 
-func writeDrainFile(path, body string, mode os.FileMode) error {
+func writeAutofixFile(path, body string, mode os.FileMode) error {
 	if err := os.WriteFile(path, []byte(body), mode); err != nil {
 		return err
 	}
 	return os.Chmod(path, mode)
 }
 
-func drainCommandArgs(plan DrainInstall) [][]string {
+func autofixCommandArgs(plan AutofixInstall) [][]string {
 	if plan.Platform == "darwin" {
 		domain := "gui/" + currentUID()
 		return [][]string{
-			{"launchctl", "bootout", domain + "/no.kristofferr.crq-drain"},
+			{"launchctl", "bootout", domain + "/no.kristofferr.crq-autofix"},
 			{"launchctl", "bootstrap", domain, plan.Unit},
 		}
 	}
 	return [][]string{
 		{"loginctl", "enable-linger", os.Getenv("USER")},
 		{"systemctl", "--user", "daemon-reload"},
-		{"systemctl", "--user", "enable", "crq-drain"},
-		{"systemctl", "--user", "restart", "crq-drain"},
+		{"systemctl", "--user", "enable", "crq-autofix"},
+		{"systemctl", "--user", "restart", "crq-autofix"},
 	}
 }
 
@@ -264,7 +264,7 @@ func launchdJobAbsent(command string, output []byte) bool {
 	return strings.Contains(text, "no such process") || strings.Contains(text, "could not find service")
 }
 
-// drainCanAuthenticate reports whether the SERVICE will find a GitHub
+// autofixCanAuthenticate reports whether the SERVICE will find a GitHub
 // credential — which is not the same question as whether this shell has one.
 //
 // crq resolves a token from GITHUB_TOKEN/GH_TOKEN or `gh auth token`, and the
@@ -274,7 +274,7 @@ func launchdJobAbsent(command string, output []byte) bool {
 // nothing this command exists to prevent. Writing the token into the unit is not
 // the answer — that file is readable by every local user — so the credential has
 // to be one the service can resolve itself.
-func drainCanAuthenticate(ctx context.Context) error {
+func autofixCanAuthenticate(ctx context.Context) error {
 	if path := ConfigPath(); path != "" {
 		values, err := readEnvFile(path)
 		if err == nil {
@@ -292,10 +292,10 @@ func drainCanAuthenticate(ctx context.Context) error {
 	if out, err := cmd.Output(); err == nil && strings.TrimSpace(string(out)) != "" {
 		return nil
 	}
-	return fmt.Errorf("the drain would have no GitHub credential: a service does not inherit this shell's GITHUB_TOKEN/GH_TOKEN. Run 'gh auth login', or put the token in %s, then install again", ConfigPath())
+	return fmt.Errorf("the autofix service would have no GitHub credential: a service does not inherit this shell's GITHUB_TOKEN/GH_TOKEN. Run 'gh auth login', or put the token in %s, then install again", ConfigPath())
 }
 
-// drainPath is the PATH the service runs with: this shell's, plus wherever crq
+// autofixPath is the PATH the service runs with: this shell's, plus wherever crq
 // and the agent were found.
 //
 // A service manager hands a unit its own minimal PATH, which on launchd is four
@@ -303,7 +303,7 @@ func drainCanAuthenticate(ctx context.Context) error {
 // they start shells out to git, gh, go and crq — and a Homebrew or ~/.local/bin
 // install is invisible from there, so every fix would fail at its first command.
 // The installing shell's PATH is the one where those tools were just resolved.
-func drainPath(plan DrainInstall) string {
+func autofixPath(plan AutofixInstall) string {
 	seen := map[string]bool{}
 	var dirs []string
 	add := func(dir string) {
@@ -329,16 +329,16 @@ func drainPath(plan DrainInstall) string {
 	return strings.Join(dirs, string(filepath.ListSeparator))
 }
 
-// drainEnv is the environment the service runs with.
+// autofixEnv is the environment the service runs with.
 //
 // The service manager hands a unit its own environment, not this shell's, and
 // then crq reads the configuration file itself. So the unit has to carry two
 // things: the path of the file the install actually read, and the effective
-// value of every setting the drain cannot work without — those may have come
+// value of every setting autofix cannot work without — those may have come
 // from this shell alone, and there they would be lost. An install that gets this
 // wrong still reports Started, and the watcher then loads a different queue, or
 // none.
-func (s *Service) drainEnv(plan DrainInstall) map[string]string {
+func (s *Service) autofixEnv(plan AutofixInstall) map[string]string {
 	env := map[string]string{
 		"CRQ_REPOS": strings.Join(plan.Repos, ","),
 		// The denylist travels with the allowlist. Carrying one and not the other
@@ -372,7 +372,7 @@ func (s *Service) drainEnv(plan DrainInstall) map[string]string {
 		// configured for every account block it could not parse a window from.
 		"CRQ_CALIBRATE_TTL": s.cfg.CalibrationTTL.String(),
 		"CRQ_RL_FALLBACK":   s.cfg.RateLimitFallback.String(),
-		"PATH":              drainPath(plan),
+		"PATH":              autofixPath(plan),
 	}
 	if s.cfg.RateLimitCoDegrade {
 		env["CRQ_RL_CO_DEGRADE"] = "1"
@@ -423,9 +423,9 @@ func (s *Service) drainEnv(plan DrainInstall) map[string]string {
 	return env
 }
 
-// drainUnit renders the platform's service definition.
-func (s *Service) drainUnit(plan DrainInstall) string {
-	env := s.drainEnv(plan)
+// autofixUnit renders the platform's service definition.
+func (s *Service) autofixUnit(plan AutofixInstall) string {
+	env := s.autofixEnv(plan)
 	// Sorted: the unit is a file on disk that a re-install rewrites, and map order
 	// would make every rewrite a different file for the same configuration.
 	keys := make([]string, 0, len(env))
@@ -443,14 +443,14 @@ func (s *Service) drainUnit(plan DrainInstall) string {
 		return fmt.Sprintf(`<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0"><dict>
-	<key>Label</key><string>no.kristofferr.crq-drain</string>
+	<key>Label</key><string>no.kristofferr.crq-autofix</string>
 	<key>ProgramArguments</key><array><string>%s</string></array>
 	<key>EnvironmentVariables</key><dict>
 %s	</dict>
 	<key>RunAtLoad</key><true/>
 	<key>KeepAlive</key><true/>
-	<key>StandardOutPath</key><string>%s/drain.log</string>
-	<key>StandardErrorPath</key><string>%s/drain.err</string>
+	<key>StandardOutPath</key><string>%s/autofix.log</string>
+	<key>StandardErrorPath</key><string>%s/autofix.err</string>
 </dict></plist>
 `, html.EscapeString(plan.Wrapper), entries.String(),
 			html.EscapeString(logDir), html.EscapeString(logDir))
@@ -459,10 +459,14 @@ func (s *Service) drainUnit(plan DrainInstall) string {
 	for _, k := range keys {
 		// Quote the whole assignment. systemd otherwise tokenizes whitespace in
 		// CRQ_CONFIG, PATH, commands, and markers into separate assignments.
-		fmt.Fprintf(&lines, "Environment=%s\n", strconv.Quote(k+"="+env[k]))
+		//
+		// Double '%' first: systemd expands specifiers in Environment= values, so
+		// a '%' in a path or a review command would be eaten or fail to load the
+		// unit. Unlike ExecStart, '$' is NOT expanded here, so it stays literal.
+		fmt.Fprintf(&lines, "Environment=%s\n", strconv.Quote(strings.ReplaceAll(k+"="+env[k], "%", "%%")))
 	}
 	return fmt.Sprintf(`[Unit]
-Description=crq review drain (watch + dispatch fix sessions)
+Description=crq autofix (watch + dispatch fix sessions)
 After=network-online.target
 
 [Service]
@@ -470,8 +474,8 @@ Type=simple
 %sExecStart=%s
 Restart=always
 RestartSec=20
-StandardOutput=append:%s/drain.log
-StandardError=append:%s/drain.err
+StandardOutput=append:%s/autofix.log
+StandardError=append:%s/autofix.err
 
 [Install]
 WantedBy=default.target
diff --git a/internal/crq/drain_test.go b/internal/crq/autofix_test.go
similarity index 78%
rename from internal/crq/drain_test.go
rename to internal/crq/autofix_test.go
index 8e6af956..dc2b5812 100644
--- a/internal/crq/drain_test.go
+++ b/internal/crq/autofix_test.go
@@ -8,6 +8,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"runtime"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -18,13 +19,13 @@ import (
 // Setup people get wrong is setup that silently does nothing, which is the exact
 // failure this whole feature exists to prevent. A dry run has to describe the
 // real thing, and it must not touch anything.
-func TestInstallDrainPlansWithoutWriting(t *testing.T) {
+func TestInstallAutofixPlansWithoutWriting(t *testing.T) {
 	cfg := firingConfig()
 	cfg.AllowRepos = map[string]bool{"owner/name": true}
 	svc := NewService(cfg, newFakeGitHub(), NewMemoryStore(cfg), nil)
 
 	agent := fakeAgent(t, "claude")
-	plan, err := svc.InstallDrain(context.Background(), agent, nil, nil, true)
+	plan, err := svc.InstallAutofix(context.Background(), agent, nil, nil, true)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -54,13 +55,34 @@ func TestInstallDrainPlansWithoutWriting(t *testing.T) {
 	}
 }
 
-func TestInstallDrainHonoursConfiguredDryRun(t *testing.T) {
+// The plan is what --dry-run shows and what the unit records, so the fleet it
+// names has to be the same fleet twice. Taken straight off the map it was not:
+// a re-install rewrote the unit with the repositories in a new order, and a
+// dry run described a different service than the install that followed it.
+func TestAutofixPlanOrdersTheFleetTheSameWayEveryTime(t *testing.T) {
+	cfg := firingConfig()
+	cfg.AllowRepos = map[string]bool{"owner/zulu": true, "owner/alpha": true, "owner/mike": true}
+	agent := fakeAgent(t, "claude")
+
+	want := []string{"owner/alpha", "owner/mike", "owner/zulu"}
+	for i := range 8 {
+		plan, err := AutofixPlan(cfg, agent, nil, nil, true)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !slices.Equal(plan.Repos, want) {
+			t.Fatalf("plan %d repos = %v, want %v", i, plan.Repos, want)
+		}
+	}
+}
+
+func TestInstallAutofixHonoursConfiguredDryRun(t *testing.T) {
 	cfg := firingConfig()
 	cfg.DryRun = true
 	cfg.AllowRepos = map[string]bool{"owner/repo": true}
 	svc := NewService(cfg, newFakeGitHub(), NewMemoryStore(cfg), nil)
 
-	plan, err := svc.InstallDrain(context.Background(), fakeAgent(t, "claude"), nil, nil, false)
+	plan, err := svc.InstallAutofix(context.Background(), fakeAgent(t, "claude"), nil, nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -70,13 +92,13 @@ func TestInstallDrainHonoursConfiguredDryRun(t *testing.T) {
 }
 
 // A missing agent must fail loudly at install time. Discovering it at the first
-// dispatch means a drain that looks installed and fixes nothing.
-func TestInstallDrainRefusesWithoutAnAgent(t *testing.T) {
+// dispatch means an autofix watcher that looks installed and fixes nothing.
+func TestInstallAutofixRefusesWithoutAnAgent(t *testing.T) {
 	cfg := firingConfig()
 	cfg.AllowRepos = map[string]bool{"owner/name": true}
 	svc := NewService(cfg, newFakeGitHub(), NewMemoryStore(cfg), nil)
 
-	_, err := svc.InstallDrain(context.Background(), "definitely-not-a-real-binary", nil, nil, true)
+	_, err := svc.InstallAutofix(context.Background(), "definitely-not-a-real-binary", nil, nil, true)
 	if err == nil {
 		t.Skip("a binary by that name exists on this machine")
 	}
@@ -100,12 +122,12 @@ func TestEmbeddedPromptCarriesTheRulesThatCostUs(t *testing.T) {
 	}
 }
 
-func TestWriteDrainFileRestoresDeclaredMode(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "crq-drain")
+func TestWriteAutofixFileRestoresDeclaredMode(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "crq-autofix")
 	if err := os.WriteFile(path, []byte("old"), 0o600); err != nil {
 		t.Fatal(err)
 	}
-	if err := writeDrainFile(path, "new", 0o755); err != nil {
+	if err := writeAutofixFile(path, "new", 0o755); err != nil {
 		t.Fatal(err)
 	}
 	info, err := os.Stat(path)
@@ -117,12 +139,12 @@ func TestWriteDrainFileRestoresDeclaredMode(t *testing.T) {
 	}
 }
 
-func TestDrainStartArgumentsPreservePathsWithSpaces(t *testing.T) {
-	plan := DrainInstall{
+func TestAutofixStartArgumentsPreservePathsWithSpaces(t *testing.T) {
+	plan := AutofixInstall{
 		Platform: "darwin",
-		Unit:     "/Users/Example User/Library/LaunchAgents/crq-drain.plist",
+		Unit:     "/Users/Example User/Library/LaunchAgents/crq-autofix.plist",
 	}
-	got := drainCommandArgs(plan)[1]
+	got := autofixCommandArgs(plan)[1]
 	if len(got) != 4 || got[3] != plan.Unit {
 		t.Fatalf("bootstrap argv = %q, want unit path %q as one argument", got, plan.Unit)
 	}
@@ -132,7 +154,7 @@ func TestDrainStartArgumentsPreservePathsWithSpaces(t *testing.T) {
 // configuration file. A unit that names neither the file nor the settings that
 // reached the install from the shell alone starts a watcher that loads a
 // different queue — or none — while the install reports Started.
-func TestDrainUnitCarriesTheConfigurationTheInstallRead(t *testing.T) {
+func TestAutofixUnitCarriesTheConfigurationTheInstallRead(t *testing.T) {
 	config := filepath.Join(t.TempDir(), "env")
 	t.Setenv("CRQ_CONFIG", config)
 
@@ -143,11 +165,11 @@ func TestDrainUnitCarriesTheConfigurationTheInstallRead(t *testing.T) {
 	cfg.CalibrationPR = 1
 	svc := NewService(cfg, newFakeGitHub(), NewMemoryStore(cfg), nil)
 
-	plan, err := svc.InstallDrain(context.Background(), fakeAgent(t, "claude"), nil, nil, true)
+	plan, err := svc.InstallAutofix(context.Background(), fakeAgent(t, "claude"), nil, nil, true)
 	if err != nil {
 		t.Fatal(err)
 	}
-	unit := svc.drainUnit(plan)
+	unit := svc.autofixUnit(plan)
 	// The state ref included: without it the service falls back to the default
 	// and reads a queue nobody else is using, which looks exactly like an idle
 	// fleet.
@@ -160,7 +182,7 @@ func TestDrainUnitCarriesTheConfigurationTheInstallRead(t *testing.T) {
 		"CRQ_STATE_REF=" + cfg.StateRef,
 	} {
 		if !strings.Contains(unit, want) {
-			t.Errorf("the unit does not carry %q; the drain would not find it:\n%s", want, unit)
+			t.Errorf("the unit does not carry %q; the autofix watcher would not find it:\n%s", want, unit)
 		}
 	}
 	// A secret in a file every local user can read is not the way to hand the
@@ -169,12 +191,12 @@ func TestDrainUnitCarriesTheConfigurationTheInstallRead(t *testing.T) {
 		t.Errorf("the unit carries a token:\n%s", unit)
 	}
 	// Rewriting it for the same configuration must produce the same file.
-	if again := svc.drainUnit(plan); again != unit {
+	if again := svc.autofixUnit(plan); again != unit {
 		t.Error("two renderings of one configuration differ; every re-install would rewrite the unit")
 	}
 }
 
-func TestDrainUnitCarriesEffectiveReviewerConfiguration(t *testing.T) {
+func TestAutofixUnitCarriesEffectiveReviewerConfiguration(t *testing.T) {
 	cfg := firingConfig()
 	cfg.DispatchForks = true
 	cfg.SkipMarker = "<!-- custom-skip -->"
@@ -193,9 +215,9 @@ func TestDrainUnitCarriesEffectiveReviewerConfiguration(t *testing.T) {
 		Trigger: engine.TriggerAlways, Required: true, SelfHealGrace: 4 * time.Minute,
 	}}
 	svc := NewService(cfg, newFakeGitHub(), NewMemoryStore(cfg), nil)
-	plan := DrainInstall{Platform: "linux", Wrapper: "/tmp/crq drain", LogDir: "/tmp/crq logs"}
+	plan := AutofixInstall{Platform: "linux", Wrapper: "/tmp/crq autofix", LogDir: "/tmp/crq logs"}
 
-	unit := svc.drainUnit(plan)
+	unit := svc.autofixUnit(plan)
 	for _, want := range []string{
 		`CRQ_BOT=custom-reviewer[bot]`,
 		`CRQ_REQUIRED_BOTS=custom-reviewer[bot],cursor[bot]`,
@@ -221,29 +243,29 @@ func TestDrainUnitCarriesEffectiveReviewerConfiguration(t *testing.T) {
 	}
 }
 
-func TestDrainEnvCarriesAnIntentionallyEmptySkipMarker(t *testing.T) {
+func TestAutofixEnvCarriesAnIntentionallyEmptySkipMarker(t *testing.T) {
 	cfg := firingConfig()
 	cfg.SkipMarker = ""
 	svc := NewService(cfg, newFakeGitHub(), NewMemoryStore(cfg), nil)
 
-	env := svc.drainEnv(DrainInstall{})
+	env := svc.autofixEnv(AutofixInstall{})
 	marker, ok := env["CRQ_AUTOREVIEW_SKIP_MARKER"]
 	if !ok || marker != "" {
 		t.Fatalf("skip marker = %q, present=%t; want an explicit empty value", marker, ok)
 	}
 }
 
-func TestDrainEnvCarriesConfiguredWorkspace(t *testing.T) {
+func TestAutofixEnvCarriesConfiguredWorkspace(t *testing.T) {
 	cfg := firingConfig()
 	cfg.WorkspaceRoot = "/mnt/large disk/crq"
 	svc := NewService(cfg, newFakeGitHub(), NewMemoryStore(cfg), nil)
 
-	if got := svc.drainEnv(DrainInstall{})["CRQ_WORKSPACE"]; got != cfg.WorkspaceRoot {
+	if got := svc.autofixEnv(AutofixInstall{})["CRQ_WORKSPACE"]; got != cfg.WorkspaceRoot {
 		t.Fatalf("CRQ_WORKSPACE = %q, want %q", got, cfg.WorkspaceRoot)
 	}
 }
 
-func TestInstallDrainMakesRelativeWorkspaceAbsolute(t *testing.T) {
+func TestInstallAutofixMakesRelativeWorkspaceAbsolute(t *testing.T) {
 	root := t.TempDir()
 	t.Chdir(root)
 
@@ -252,12 +274,12 @@ func TestInstallDrainMakesRelativeWorkspaceAbsolute(t *testing.T) {
 	cfg.WorkspaceRoot = "relative workspace"
 	svc := NewService(cfg, newFakeGitHub(), NewMemoryStore(cfg), nil)
 
-	plan, err := svc.InstallDrain(context.Background(), fakeAgent(t, "claude"), nil, nil, true)
+	plan, err := svc.InstallAutofix(context.Background(), fakeAgent(t, "claude"), nil, nil, true)
 	if err != nil {
 		t.Fatal(err)
 	}
 	want := filepath.Join(root, cfg.WorkspaceRoot)
-	if got := svc.drainEnv(plan)["CRQ_WORKSPACE"]; got != want {
+	if got := svc.autofixEnv(plan)["CRQ_WORKSPACE"]; got != want {
 		t.Fatalf("CRQ_WORKSPACE = %q, want absolute install-time path %q", got, want)
 	}
 }
@@ -266,13 +288,13 @@ func TestLaunchdUnitEscapesXMLValues(t *testing.T) {
 	cfg := firingConfig()
 	cfg.ReviewCommand = "@bot review <this> & report"
 	svc := NewService(cfg, newFakeGitHub(), NewMemoryStore(cfg), nil)
-	plan := DrainInstall{
+	plan := AutofixInstall{
 		Platform: "darwin",
-		Wrapper:  "/tmp/a&b/crq-drain",
+		Wrapper:  "/tmp/a&b/crq-autofix",
 		LogDir:   "/tmp/a<b/logs",
 	}
 
-	unit := svc.drainUnit(plan)
+	unit := svc.autofixUnit(plan)
 	var document struct{}
 	if err := xml.Unmarshal([]byte(unit), &document); err != nil {
 		t.Fatalf("launchd unit is not valid XML: %v\n%s", err, unit)
@@ -287,7 +309,7 @@ func TestLaunchdUnitEscapesXMLValues(t *testing.T) {
 	}
 }
 
-func TestInstallDrainMakesRelativeAgentAbsolute(t *testing.T) {
+func TestInstallAutofixMakesRelativeAgentAbsolute(t *testing.T) {
 	root := t.TempDir()
 	bin := filepath.Join(root, "bin")
 	if err := os.MkdirAll(bin, 0o755); err != nil {
@@ -302,7 +324,7 @@ func TestInstallDrainMakesRelativeAgentAbsolute(t *testing.T) {
 	cfg := firingConfig()
 	cfg.AllowRepos = map[string]bool{"owner/name": true}
 	svc := NewService(cfg, newFakeGitHub(), NewMemoryStore(cfg), nil)
-	plan, err := svc.InstallDrain(context.Background(), "./bin/wrapper", []string{"--run"}, nil, true)
+	plan, err := svc.InstallAutofix(context.Background(), "./bin/wrapper", []string{"--run"}, nil, true)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -316,9 +338,9 @@ func TestSystemdEnvironmentAssignmentsQuoteWhitespace(t *testing.T) {
 	svc := NewService(cfg, newFakeGitHub(), NewMemoryStore(cfg), nil)
 	t.Setenv("CRQ_CONFIG", filepath.Join(t.TempDir(), "config with spaces", "env"))
 	t.Setenv("PATH", "/usr/bin:/opt/tools with spaces/bin")
-	plan := DrainInstall{Platform: "linux", Wrapper: "/tmp/crq-drain", LogDir: "/tmp/crq"}
+	plan := AutofixInstall{Platform: "linux", Wrapper: "/tmp/crq-autofix", LogDir: "/tmp/crq"}
 
-	unit := svc.drainUnit(plan)
+	unit := svc.autofixUnit(plan)
 	for _, key := range []string{"CRQ_CONFIG", "PATH", "CRQ_REVIEW_CMD"} {
 		if !strings.Contains(unit, `Environment="`+key+`=`) {
 			t.Errorf("%s assignment is not quoted:\n%s", key, unit)
@@ -327,7 +349,7 @@ func TestSystemdEnvironmentAssignmentsQuoteWhitespace(t *testing.T) {
 	if strings.Contains(unit, "Environment=CRQ_CONFIG=") {
 		t.Errorf("CRQ_CONFIG was emitted as an unquoted systemd assignment:\n%s", unit)
 	}
-	if !strings.Contains(unit, `ExecStart="/tmp/crq-drain"`) {
+	if !strings.Contains(unit, `ExecStart="/tmp/crq-autofix"`) {
 		t.Errorf("ExecStart executable is not quoted:\n%s", unit)
 	}
 }
@@ -342,13 +364,13 @@ func TestSystemdExecWordQuotesWhitespaceAndExpansion(t *testing.T) {
 
 func TestLaunchdMissingJobIsBenignOnlyForBootout(t *testing.T) {
 	output := []byte("Boot-out failed: 3: No such process")
-	if !launchdJobAbsent("launchctl bootout gui/501/no.kristofferr.crq-drain", output) {
+	if !launchdJobAbsent("launchctl bootout gui/501/no.kristofferr.crq-autofix", output) {
 		t.Error("first-install bootout should accept an absent launchd job")
 	}
-	if launchdJobAbsent("launchctl bootstrap gui/501 /tmp/drain.plist", output) {
+	if launchdJobAbsent("launchctl bootstrap gui/501 /tmp/autofix.plist", output) {
 		t.Error("a bootstrap failure must never be ignored")
 	}
-	if launchdJobAbsent("launchctl bootout gui/501/no.kristofferr.crq-drain", []byte("permission denied")) {
+	if launchdJobAbsent("launchctl bootout gui/501/no.kristofferr.crq-autofix", []byte("permission denied")) {
 		t.Error("a genuine bootout failure must not be ignored")
 	}
 }
@@ -356,19 +378,19 @@ func TestLaunchdMissingJobIsBenignOnlyForBootout(t *testing.T) {
 // systemd refuses to start a unit whose StandardOutput path cannot be opened
 // (209/STDOUT), so a log directory that does not exist is a service that never
 // runs — the silent nothing this command exists to prevent.
-func TestInstallDrainNamesALogDirectory(t *testing.T) {
+func TestInstallAutofixNamesALogDirectory(t *testing.T) {
 	cfg := firingConfig()
 	cfg.AllowRepos = map[string]bool{"owner/name": true}
 	svc := NewService(cfg, newFakeGitHub(), NewMemoryStore(cfg), nil)
 
-	plan, err := svc.InstallDrain(context.Background(), fakeAgent(t, "claude"), nil, nil, true)
+	plan, err := svc.InstallAutofix(context.Background(), fakeAgent(t, "claude"), nil, nil, true)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if plan.LogDir == "" {
 		t.Fatal("no log directory planned; the unit would reference a path nothing creates")
 	}
-	unit := svc.drainUnit(plan)
+	unit := svc.autofixUnit(plan)
 	if !strings.Contains(unit, plan.LogDir) {
 		t.Errorf("the unit does not write into the directory the install creates:\n%s", unit)
 	}
@@ -447,7 +469,7 @@ func fakeAgent(t *testing.T, name string) string {
 // "enable --now" does nothing to a unit that is already running, so a reinstall
 // with a different agent kept the old one going — an install that reports
 // success and changes nothing.
-func TestInstallDrainRestartsAnAlreadyRunningService(t *testing.T) {
+func TestInstallAutofixRestartsAnAlreadyRunningService(t *testing.T) {
 	if runtime.GOOS == "darwin" {
 		t.Skip("launchd bootout/bootstrap already replaces a running agent")
 	}
@@ -455,7 +477,7 @@ func TestInstallDrainRestartsAnAlreadyRunningService(t *testing.T) {
 	cfg.AllowRepos = map[string]bool{"owner/name": true}
 	svc := NewService(cfg, newFakeGitHub(), NewMemoryStore(cfg), nil)
 
-	plan, err := svc.InstallDrain(context.Background(), fakeAgent(t, "claude"), nil, nil, true)
+	plan, err := svc.InstallAutofix(context.Background(), fakeAgent(t, "claude"), nil, nil, true)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/internal/crq/drainswitch.go b/internal/crq/autofixswitch.go
similarity index 65%
rename from internal/crq/drainswitch.go
rename to internal/crq/autofixswitch.go
index 68f3b448..3a4a9166 100644
--- a/internal/crq/drainswitch.go
+++ b/internal/crq/autofixswitch.go
@@ -8,8 +8,8 @@ import (
 	"time"
 )
 
-// DrainSetting is one repository's drain answer, as the CLI reports it.
-type DrainSetting struct {
+// AutofixSetting is one repository's autofix answer, as the CLI reports it.
+type AutofixSetting struct {
 	Repo      string     `json:"repo"`
 	Enabled   bool       `json:"enabled"`
 	Default   bool       `json:"default"`
@@ -18,37 +18,37 @@ type DrainSetting struct {
 	UpdatedAt *time.Time `json:"updated_at,omitempty"`
 }
 
-// SetDrainEnabled records whether crq may run fix sessions for repo.
+// SetAutofixEnabled records whether crq may run fix sessions for repo.
 //
 // Recorded rather than defaulted, so "on" after an "off" is a real answer and
-// not just the absence of one — the dashboard and `crq drain` can then show that
+// not just the absence of one — the dashboard and `crq autofix` can then show that
 // somebody made the call, and when.
-func (s *Service) SetDrainEnabled(ctx context.Context, repo string, enabled bool, reason string) (DrainSetting, error) {
+func (s *Service) SetAutofixEnabled(ctx context.Context, repo string, enabled bool, reason string) (AutofixSetting, error) {
 	repo = NormalizeRepo(repo)
 	if !validRepoSlug(repo) {
-		return DrainSetting{}, fmt.Errorf("repo must be owner/name")
+		return AutofixSetting{}, fmt.Errorf("repo must be owner/name")
 	}
 	now := s.clock().UTC()
-	sw := RepoDrainSwitch{Enabled: enabled, UpdatedAt: &now, By: s.cfg.Host, Reason: reason}
+	sw := RepoAutofixSwitch{Enabled: enabled, UpdatedAt: &now, By: s.cfg.Host, Reason: reason}
 	if _, err := s.store.Update(ctx, func(st *State) error {
-		st.SetDrainSwitch(repo, sw)
+		st.SetAutofixSwitch(repo, sw)
 		return nil
 	}); err != nil {
-		return DrainSetting{}, err
+		return AutofixSetting{}, err
 	}
-	return DrainSetting{Repo: repo, Enabled: enabled, Reason: reason, By: sw.By, UpdatedAt: sw.UpdatedAt}, nil
+	return AutofixSetting{Repo: repo, Enabled: enabled, Reason: reason, By: sw.By, UpdatedAt: sw.UpdatedAt}, nil
 }
 
-// ClearDrainEnabled returns repo to the default (drained), reporting whether a
+// ClearAutofixEnabled returns repo to the default (autofix on), reporting whether a
 // setting was there.
-func (s *Service) ClearDrainEnabled(ctx context.Context, repo string) (bool, error) {
+func (s *Service) ClearAutofixEnabled(ctx context.Context, repo string) (bool, error) {
 	repo = NormalizeRepo(repo)
 	if !validRepoSlug(repo) {
 		return false, fmt.Errorf("repo must be owner/name")
 	}
 	cleared := false
 	if _, err := s.store.Update(ctx, func(st *State) error {
-		cleared = st.ClearDrainSwitch(repo)
+		cleared = st.ClearAutofixSwitch(repo)
 		if !cleared {
 			return ErrNoChange
 		}
@@ -59,23 +59,23 @@ func (s *Service) ClearDrainEnabled(ctx context.Context, repo string) (bool, err
 	return cleared, nil
 }
 
-// DrainSettings reports the drain answer for every repository in scope, so the
+// AutofixSettings reports the autofix answer for every repository in scope, so the
 // listing shows what WILL happen rather than only what was written down.
-func (s *Service) DrainSettings(ctx context.Context) ([]DrainSetting, error) {
+func (s *Service) AutofixSettings(ctx context.Context) ([]AutofixSetting, error) {
 	st, _, err := s.store.Load(ctx)
 	if err != nil {
 		return nil, err
 	}
 	seen := map[string]bool{}
-	var out []DrainSetting
+	var out []AutofixSetting
 	add := func(repo string) {
 		key := NormalizeRepo(repo)
 		if key == "" || seen[key] {
 			return
 		}
 		seen[key] = true
-		setting := DrainSetting{Repo: key, Enabled: st.DrainEnabled(key), Default: true}
-		if sw, ok := st.DrainSwitch(key); ok {
+		setting := AutofixSetting{Repo: key, Enabled: st.AutofixEnabled(key), Default: true}
+		if sw, ok := st.AutofixSwitch(key); ok {
 			setting.Default = false
 			setting.Reason, setting.By, setting.UpdatedAt = sw.Reason, sw.By, sw.UpdatedAt
 		}
@@ -91,7 +91,7 @@ func (s *Service) DrainSettings(ctx context.Context) ([]DrainSetting, error) {
 	}
 	// A repository ruled on but no longer watched still shows: an "off" nobody
 	// can see is how a repository quietly stops being fixed.
-	for _, repo := range st.DrainSwitches() {
+	for _, repo := range st.AutofixSwitches() {
 		add(repo)
 	}
 	return out, nil
diff --git a/internal/crq/drainswitch_test.go b/internal/crq/autofixswitch_test.go
similarity index 74%
rename from internal/crq/drainswitch_test.go
rename to internal/crq/autofixswitch_test.go
index 1e9ec22e..569d51d4 100644
--- a/internal/crq/drainswitch_test.go
+++ b/internal/crq/autofixswitch_test.go
@@ -8,16 +8,16 @@ import (
 	ghapi "github.com/kristofferR/coderabbit-queue/internal/gh"
 )
 
-// Draining is on by default and off only where somebody said so. A repository
+// Autofix is on by default and off only where somebody said so. A repository
 // nobody has ruled on gets fixed, because that is what the watcher is for.
-func TestDrainIsOnUnlessARepositorySaysOtherwise(t *testing.T) {
+func TestAutofixIsOnUnlessARepositorySaysOtherwise(t *testing.T) {
 	ctx := context.Background()
 	cfg := firingConfig()
 	cfg.AllowRepos = map[string]bool{"owner/one": true, "owner/two": true}
 	store := NewMemoryStore(cfg)
 	svc := NewService(cfg, newFakeGitHub(), store, nil)
 
-	settings, err := svc.DrainSettings(ctx)
+	settings, err := svc.AutofixSettings(ctx)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -30,7 +30,7 @@ func TestDrainIsOnUnlessARepositorySaysOtherwise(t *testing.T) {
 		}
 	}
 
-	if _, err := svc.SetDrainEnabled(ctx, "Owner/One", false, "hand-tuned branch"); err != nil {
+	if _, err := svc.SetAutofixEnabled(ctx, "Owner/One", false, "hand-tuned branch"); err != nil {
 		t.Fatal(err)
 	}
 	st, _, err := store.Load(ctx)
@@ -38,42 +38,42 @@ func TestDrainIsOnUnlessARepositorySaysOtherwise(t *testing.T) {
 		t.Fatal(err)
 	}
 	// Case-insensitive, like every other repository key.
-	if st.DrainEnabled("owner/one") {
+	if st.AutofixEnabled("owner/one") {
 		t.Error("an explicit off did not take")
 	}
-	if !st.DrainEnabled("owner/two") {
+	if !st.AutofixEnabled("owner/two") {
 		t.Error("turning one repository off turned another off too")
 	}
 
 	// Back to the default is distinguishable from an explicit on.
-	if cleared, err := svc.ClearDrainEnabled(ctx, "owner/one"); err != nil || !cleared {
+	if cleared, err := svc.ClearAutofixEnabled(ctx, "owner/one"); err != nil || !cleared {
 		t.Fatalf("clear = %v %v, want it to report the setting it removed", cleared, err)
 	}
 	st, _, _ = store.Load(ctx)
-	if !st.DrainEnabled("owner/one") {
+	if !st.AutofixEnabled("owner/one") {
 		t.Error("clearing the setting did not return the repository to the default")
 	}
 }
 
-func TestDrainSwitchRejectsMalformedRepositoryNames(t *testing.T) {
+func TestAutofixSwitchRejectsMalformedRepositoryNames(t *testing.T) {
 	ctx := context.Background()
 	cfg := firingConfig()
 	store := NewMemoryStore(cfg)
 	svc := NewService(cfg, newFakeGitHub(), store, nil)
 
 	for _, repo := range []string{"owner", "owner/repo/", "/repo", "owner/repo/extra", "../repo"} {
-		if _, err := svc.SetDrainEnabled(ctx, repo, false, "operator stop"); err == nil {
-			t.Errorf("SetDrainEnabled(%q) succeeded", repo)
+		if _, err := svc.SetAutofixEnabled(ctx, repo, false, "operator stop"); err == nil {
+			t.Errorf("SetAutofixEnabled(%q) succeeded", repo)
 		}
-		if _, err := svc.ClearDrainEnabled(ctx, repo); err == nil {
-			t.Errorf("ClearDrainEnabled(%q) succeeded", repo)
+		if _, err := svc.ClearAutofixEnabled(ctx, repo); err == nil {
+			t.Errorf("ClearAutofixEnabled(%q) succeeded", repo)
 		}
 	}
 }
 
 // Off stops FIXING, not watching: the pull request is still observed and still
 // reviewed, so its feedback arrives for a person to act on.
-func TestDrainOffStillWatchesAndSaysWhy(t *testing.T) {
+func TestAutofixOffStillWatchesAndSaysWhy(t *testing.T) {
 	ctx := context.Background()
 	cfg := firingConfig()
 	cfg.AllowRepos = map[string]bool{"owner/quiet": true}
@@ -84,7 +84,7 @@ func TestDrainOffStillWatchesAndSaysWhy(t *testing.T) {
 	store := NewMemoryStore(cfg)
 	svc := NewService(cfg, gh, store, nil)
 	seedRound(t, store, cfg, "owner/quiet", 5, "aaaaaaaa1", PhaseQueued, time.Now().UTC(), 0)
-	if _, err := svc.SetDrainEnabled(ctx, "owner/quiet", false, "release branch"); err != nil {
+	if _, err := svc.SetAutofixEnabled(ctx, "owner/quiet", false, "release branch"); err != nil {
 		t.Fatal(err)
 	}
 
@@ -95,11 +95,11 @@ func TestDrainOffStillWatchesAndSaysWhy(t *testing.T) {
 		t.Fatal(err)
 	}
 	if len(events) == 0 {
-		t.Fatal("a repository with draining off stopped being watched")
+		t.Fatal("a repository with autofix off stopped being watched")
 	}
 	for _, e := range events {
 		if e.Dispatched {
-			t.Errorf("a session ran for a repository with draining off: %+v", e)
+			t.Errorf("a session ran for a repository with autofix off: %+v", e)
 		}
 	}
 }
@@ -121,7 +121,7 @@ func TestSkippedDispatchStillAdvancesHeadWithCarriedFinding(t *testing.T) {
 	f.botReview(repo, pr, 900, old, base.Add(-time.Minute))
 	f.botReviewComment(repo, pr, 901, old, "internal/state/state.go", 42,
 		"_⚠️ Potential issue_\n\nThis dereferences a nil round.")
-	if _, err := f.svc.SetDrainEnabled(f.ctx, repo, false, "operator stop"); err != nil {
+	if _, err := f.svc.SetAutofixEnabled(f.ctx, repo, false, "operator stop"); err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/internal/crq/claimrace_test.go b/internal/crq/claimrace_test.go
index ff89b718..dd5f4e4a 100644
--- a/internal/crq/claimrace_test.go
+++ b/internal/crq/claimrace_test.go
@@ -131,7 +131,7 @@ func TestTheClaimSurvivesWhatAPassDoesBeforeIt(t *testing.T) {
 	}
 }
 
-// Two writers on one state ref, which is what was actually running: the drain
+// Two writers on one state ref, which is what was actually running: the autofix watcher
 // and the autoreview daemon both drive this repository. A single Service cannot
 // show the interaction, and every in-process reproduction above passes — so this
 // is where the missing refusal has to come from.
@@ -156,12 +156,12 @@ func TestAClaimSurvivesAnotherDaemonDrivingThePR(t *testing.T) {
 		s.now = func() time.Time { return now }
 		return s
 	}
-	drain, daemon := newSvc(), newSvc()
+	watcher, daemon := newSvc(), newSvc()
 
 	repo, pr, head := "o/r", 54, "b417a2161"
 	report := NextReport{Repo: repo, PR: pr, Head: head, Action: "fix",
 		Findings: findingsAtHead(head, 3)}
-	if ok, why, _ := drain.claimDispatch(ctx, report, "session-one", 3); !ok {
+	if ok, why, _ := watcher.claimDispatch(ctx, report, "session-one", 3); !ok {
 		t.Fatalf("first dispatch refused: %s", why)
 	}
 
@@ -181,7 +181,7 @@ func TestAClaimSurvivesAnotherDaemonDrivingThePR(t *testing.T) {
 	if round == nil || round.Dispatch == nil {
 		t.Fatalf("the other daemon dropped the running session's claim: round=%#v", round)
 	}
-	if ok, _, _ := drain.claimDispatch(ctx, report, "session-two", 3); ok {
+	if ok, _, _ := watcher.claimDispatch(ctx, report, "session-two", 3); ok {
 		t.Error("a second session was allowed after the other daemon touched the PR")
 	}
 }
diff --git a/internal/crq/config.go b/internal/crq/config.go
index dd42d842..50e878e4 100644
--- a/internal/crq/config.go
+++ b/internal/crq/config.go
@@ -127,12 +127,12 @@ type Config struct {
 // ~/.config/crq/env. Empty when neither can be resolved.
 //
 // Exported because a service unit has to be pointed at the SAME file the install
-// read. A drain that loads a different configuration is one that watches nothing
+// read. An autofix service that loads a different configuration is one that watches nothing
 // while reporting itself started.
 //
 // Absolute, always: a relative CRQ_CONFIG resolves against the invoking shell's
 // directory, and the service starts somewhere else entirely — so the install
-// would read the file, write that relative string into the unit, and the drain
+// would read the file, write that relative string into the unit, and the service
 // would load no configuration at all.
 func ConfigPath() string {
 	if path := strings.TrimSpace(os.Getenv("CRQ_CONFIG")); path != "" {
diff --git a/internal/crq/config_test.go b/internal/crq/config_test.go
index 28acb5d0..97fd5545 100644
--- a/internal/crq/config_test.go
+++ b/internal/crq/config_test.go
@@ -538,7 +538,7 @@ func TestLoadConfigParsesDispatchForksAsABoolean(t *testing.T) {
 // The install writes the config path into a service unit, and the service starts
 // in a directory of the service manager's choosing. A relative CRQ_CONFIG that
 // resolved for the installing shell would then name nothing at all, and the
-// drain would load no configuration while the install reported success.
+// service would load no configuration while the install reported success.
 func TestConfigPathIsAbsolute(t *testing.T) {
 	t.Setenv("CRQ_CONFIG", filepath.Join("relative", "env"))
 	got := ConfigPath()
diff --git a/internal/crq/dismiss.go b/internal/crq/dismiss.go
index 5dc37ce5..f0c4ed66 100644
--- a/internal/crq/dismiss.go
+++ b/internal/crq/dismiss.go
@@ -28,8 +28,8 @@ type DismissResult struct {
 //
 // `crq resolve` and `crq decline` both act on a review thread. A review-body
 // finding, a review-skipped notice or an outside-diff remark has none, so
-// neither command can touch it — and drain-first then blocks every future round
-// on a finding that can never drain. The observed end state was a PR where "no
+// neither command can touch it — and fix-first then blocks every future round
+// on a finding that can never be cleared. The observed end state was a PR where "no
 // review was ever requested" for the current head, four rounds running.
 //
 // A finding must be present at the current head and have no thread. A threaded
@@ -136,7 +136,7 @@ func (s *Service) Dismiss(ctx context.Context, repo string, pr int, ids []string
 			Dismissed: []string{}, Already: clean}, nil
 	}
 
-	// Whether this call drains the head decides if a round may be CREATED here.
+	// Whether this call clears the head decides if a round may be CREATED here.
 	// Creating one while other findings are still open would put a fire-eligible
 	// round in the queue that DecideFire cannot hold back — it sees no findings —
 	// so a pump could spend the primary's quota on code the caller is still
diff --git a/internal/crq/dispatch/fix-prompt.txt b/internal/crq/dispatch/fix-prompt.txt
index 556f551d..4d567088 100644
--- a/internal/crq/dispatch/fix-prompt.txt
+++ b/internal/crq/dispatch/fix-prompt.txt
@@ -1,4 +1,4 @@
-You are draining review feedback on ONE pull request, unattended. crq has checked
+You are clearing review feedback on ONE pull request, unattended. crq has checked
 out the PR head into this worktree and put the findings on disk.
 
   repo:     $CRQ_DISPATCH_REPO
diff --git a/internal/crq/feedback.go b/internal/crq/feedback.go
index 84f73548..c41233e7 100644
--- a/internal/crq/feedback.go
+++ b/internal/crq/feedback.go
@@ -1412,7 +1412,7 @@ func dedupeFindings(in []dialect.Finding, suppressPromptAt, settledStableIDs map
 // skipNoticeSource marks the synthetic finding Feedback builds from a "Review
 // skipped" notice. It is the only finding with no thread to resolve and no way
 // to be addressed except by changing the PR itself, so it is the one finding
-// the pre-enqueue drain exempts — identified by this source rather than by its
+// the pre-enqueue fix-first gate exempts — identified by this source rather than by its
 // own display text, which names whichever bot posted it.
 const skipNoticeSource = "review_skipped"
 
diff --git a/internal/crq/feedback_test.go b/internal/crq/feedback_test.go
index 0b4548f3..8947b540 100644
--- a/internal/crq/feedback_test.go
+++ b/internal/crq/feedback_test.go
@@ -1764,10 +1764,10 @@ func TestLoopReturnsExistingCodexFeedbackBeforeWaitingForReviewSlot(t *testing.T
 		t.Fatal(err)
 	}
 	if code != 10 || report.Status != "feedback" || len(report.Findings) != 1 {
-		t.Fatalf("existing actionable feedback must be drained before a new review round, code=%d report=%#v", code, report)
+		t.Fatalf("existing actionable feedback must be cleared before a new review round, code=%d report=%#v", code, report)
 	}
 	if report.Reason != "unresolved findings must be addressed before a new review round" {
-		t.Fatalf("expected an explicit drain-first reason, got %#v", report)
+		t.Fatalf("expected an explicit fix-first reason, got %#v", report)
 	}
 	if len(gh.posted) != 0 {
 		t.Fatalf("existing feedback must not fire or enqueue a replacement review, posted=%d", len(gh.posted))
@@ -2299,7 +2299,7 @@ func TestBugbotStableIDSettledInAnySiblingThread(t *testing.T) {
 	}
 }
 
-// TestExcludeSkipNoticeIsTargeted: the pre-review drain exempts exactly the
+// TestExcludeSkipNoticeIsTargeted: the pre-review fix-first gate exempts exactly the
 // thread-less skip notice, which cannot be resolved and would otherwise stop
 // the co-review round it is meant to inform. Real unresolved findings on the
 // same head must still hold it, as on any other PR — an earlier version
diff --git a/internal/crq/next.go b/internal/crq/next.go
index b5d78bbc..9170b48d 100644
--- a/internal/crq/next.go
+++ b/internal/crq/next.go
@@ -49,7 +49,7 @@ type NextReport struct {
 // non-blocking call.
 //
 // It replaces the agent-side protocol that `crq loop` documented but could not
-// enforce: drain findings before starting a round, hold the head while a
+// enforce: clear findings before starting a round, hold the head while a
 // required reviewer is pending, pick a sensible delay. Each of those is now a
 // value in the returned report rather than a judgement call at the call site.
 //
@@ -65,7 +65,7 @@ func (s *Service) Next(ctx context.Context, repo string, pr int) (NextReport, er
 	// Observe BEFORE publishing anything. Enqueue makes this head fire-eligible
 	// in shared state, and an autoreview daemon pumping concurrently can claim
 	// and fire it in the gap — CAS protects each individual write, not this
-	// sequence. Deciding first means the drain-first rule is enforced before the
+	// sequence. Deciding first means the fix-first rule is enforced before the
 	// round is exposed at all, rather than only in this process's own pump.
 	report, action, feedback, err := s.nextFromState(ctx, repo, pr)
 	if err != nil {
@@ -82,7 +82,7 @@ func (s *Service) Next(ctx context.Context, repo string, pr int) (NextReport, er
 		}
 	}
 
-	// Undrained feedback for THIS head: publish nothing. Another review of the
+	// Uncleared feedback for THIS head: publish nothing. Another review of the
 	// same head would spend account quota to be told what the caller is already
 	// holding.
 	//
@@ -111,14 +111,14 @@ func (s *Service) Next(ctx context.Context, repo string, pr int) (NextReport, er
 		return report, nil
 	}
 
-	// Nothing left to drain, so record the round for this head (idempotent;
+	// Nothing left to clear, so record the round for this head (idempotent;
 	// supersedes on a new head) and advance the queue one step.
 	enqueued, err := s.Enqueue(ctx, repo, pr)
 	if err != nil {
 		return report, err
 	}
 	if enqueued.Held {
-		// Findings were drained above before Enqueue was allowed to write.
+		// Findings were cleared above before Enqueue was allowed to write.
 		// Once that work is clear, a hold is actionable administrative state,
 		// not an ordinary reviewer wait: there is no recheck time that can make
 		// progress without somebody releasing it.
diff --git a/internal/crq/next_test.go b/internal/crq/next_test.go
index cdf0c71c..aa1c275c 100644
--- a/internal/crq/next_test.go
+++ b/internal/crq/next_test.go
@@ -158,11 +158,11 @@ func TestNextPreservesUnacknowledgedSlotBeforeReturningPush(t *testing.T) {
 }
 
 // `next` advances the queue as a side effect, and that step owns the review
-// fire — so the two halves of drain-first are both properties of ONE decision:
-// undrained feedback for the current head must not buy another review of that
+// fire — so the two halves of fix-first are both properties of ONE decision:
+// uncleared feedback for the current head must not buy another review of that
 // same head, and feedback carried from an older commit must not stop the new
 // head from being reviewed at all.
-func TestNextDrainsCurrentHeadWithoutDeadlockingTheNextOne(t *testing.T) {
+func TestNextClearsCurrentHeadWithoutDeadlockingTheNextOne(t *testing.T) {
 	base := time.Date(2026, 7, 26, 9, 0, 0, 0, time.UTC)
 	f := newReplayFixture(t, base)
 	repo, pr := "owner/repo", 504
@@ -176,7 +176,7 @@ func TestNextDrainsCurrentHeadWithoutDeadlockingTheNextOne(t *testing.T) {
 		t.Fatalf("the first call must fire exactly one review, got %d", got)
 	}
 
-	// Feedback lands ON this head. Until the caller drains it, another review of
+	// Feedback lands ON this head. Until the caller clears it, another review of
 	// the same head would spend account quota to be told the same thing.
 	f.clk.advance(2 * time.Minute)
 	f.botReview(repo, pr, 900, head, f.clk.now())
@@ -184,7 +184,7 @@ func TestNextDrainsCurrentHeadWithoutDeadlockingTheNextOne(t *testing.T) {
 		"_⚠️ Potential issue_\n\nThis dereferences a nil round.")
 	f.wantAction(f.next(repo, pr), engine.ActionFix)
 	if got := f.reviewsPosted(repo, pr); got != 1 {
-		t.Fatalf("undrained feedback for this head must not buy another review, posted %d", got)
+		t.Fatalf("uncleared feedback for this head must not buy another review, posted %d", got)
 	}
 
 	// The caller pushes a fix. The old finding belongs to the previous commit,
@@ -234,7 +234,7 @@ func TestNextNeverSchedulesAHotLoop(t *testing.T) {
 	}
 }
 
-func TestNextReportsAdministrativeHoldAfterDrainFirst(t *testing.T) {
+func TestNextReportsAdministrativeHoldAfterFixFirst(t *testing.T) {
 	base := time.Date(2026, 7, 26, 9, 0, 0, 0, time.UTC)
 	f := newReplayFixture(t, base)
 	repo, pr := "owner/repo", 505
@@ -262,7 +262,7 @@ func TestNextReportsAdministrativeHoldAfterDrainFirst(t *testing.T) {
 	}
 
 	// Current-head findings still come first: the hold must not hide work that
-	// can be drained without moving the head.
+	// can be cleared without moving the head.
 	f.botReviewComment(repo, pr, 901, head, "internal/state/state.go", 42,
 		"_⚠️ Potential issue_\n\nThis dereferences a nil round.")
 	f.wantAction(f.next(repo, pr), engine.ActionFix)
@@ -403,7 +403,7 @@ func TestNextResolvesSummaryOnlyWithoutTheQueue(t *testing.T) {
 }
 
 // A finding with no review thread cannot be resolved or declined — GitHub offers
-// nothing to act on — so drain-first blocks every future round on it. The
+// nothing to act on — so fix-first blocks every future round on it. The
 // observed end state was a PR reporting "no review was ever requested" for its
 // current head, four rounds running. `crq dismiss` is the only way out, and this
 // pins both halves: that the deadlock is real, and that dismissing ends it.
diff --git a/internal/crq/service.go b/internal/crq/service.go
index e7058b81..89bda48b 100644
--- a/internal/crq/service.go
+++ b/internal/crq/service.go
@@ -657,7 +657,7 @@ func (s *Service) recordDismissal(ctx context.Context, repo string, pr int, head
 			// other findings still open, not about whether a round object
 			// exists. A queued round is just as dangerous as a new one: Pump can
 			// hand it to DecideFire, which sees no findings and cannot enforce
-			// drain-first. A live dispatch claim is the exception: it excludes
+			// fix-first. A live dispatch claim is the exception: it excludes
 			// this exact round from Pump until the session pushes or releases
 			// it, so a session may dismiss one finding at a time. So is a round
 			// on the previous head, because the supersede below would replace it
@@ -672,7 +672,7 @@ func (s *Service) recordDismissal(ctx context.Context, repo string, pr int, head
 			// The ordinary state after a push: the stored round is still on the
 			// PREVIOUS head, because `crq next` returns on a current-head finding
 			// before it enqueues. Refusing here would leave the new head in the
-			// exact drain-first deadlock this command exists to end.
+			// exact fix-first deadlock this command exists to end.
 			var err error
 			if round, err = st.Supersede(repo, pr, head, s.clock()); err != nil {
 				return err
diff --git a/internal/crq/skipmarker_test.go b/internal/crq/skipmarker_test.go
index 28f4feb3..e6246361 100644
--- a/internal/crq/skipmarker_test.go
+++ b/internal/crq/skipmarker_test.go
@@ -5,7 +5,7 @@ import "testing"
 // The pull request that DOCUMENTS the skip marker excluded itself from review,
 // because the paragraph explaining the marker contains the marker. Nothing said
 // so — the skip is a `continue`, so there was no round, no event and no log
-// line — and it sat unreviewed for a day with feedback nobody was draining.
+// line — and it sat unreviewed for a day with feedback nobody was clearing.
 func TestSkipMarkerHasToBeUsedNotMentioned(t *testing.T) {
 	cfg := Config{SkipMarker: "<!-- crq:skip-autoreview -->"}
 	for _, tc := range []struct {
diff --git a/internal/crq/state.go b/internal/crq/state.go
index d3f5be51..b9bb483c 100644
--- a/internal/crq/state.go
+++ b/internal/crq/state.go
@@ -28,8 +28,8 @@ type (
 
 	LeaderCapabilityLease = crqstate.LeaderCapabilityLease
 
-	// RepoDrainSwitch is one repository's answer to whether crq may fix it.
-	RepoDrainSwitch = crqstate.RepoDrainSwitch
+	// RepoAutofixSwitch is one repository's answer to whether crq may fix it.
+	RepoAutofixSwitch = crqstate.RepoAutofixSwitch
 )
 
 const (
@@ -44,8 +44,8 @@ const (
 
 	// DispatchTTL is how long a watcher's fix claim survives without a heartbeat.
 	DispatchTTL = crqstate.DispatchTTL
-	// DrainUnhealthyAfter is how many passes may fail to dispatch before crq says so.
-	DrainUnhealthyAfter = crqstate.DrainUnhealthyAfter
+	// AutofixUnhealthyAfter is how many passes may fail to dispatch before crq says so.
+	AutofixUnhealthyAfter = crqstate.AutofixUnhealthyAfter
 	// CapsRepoOverrides is the binary capability per-repo reviewer overrides need.
 	CapsRepoOverrides = crqstate.CapsRepoOverrides
 )
diff --git a/internal/crq/watch.go b/internal/crq/watch.go
index b0e2f44a..1c4a2b13 100644
--- a/internal/crq/watch.go
+++ b/internal/crq/watch.go
@@ -215,13 +215,13 @@ func (s *Service) watchPass(ctx context.Context, opts WatchOptions, pool *dispat
 	var candidates []candidate
 	gate := NormalizeRepo(s.cfg.GateRepo)
 	// Which repositories may be FIXED is per repository, read once for the pass.
-	// Watching is unaffected: a repository with draining off is still observed
+	// Watching is unaffected: a repository with autofix off is still observed
 	// and still reviewed, so its feedback arrives for a person to act on.
-	drainOff := map[string]bool{}
+	autofixOff := map[string]bool{}
 	if st, _, err := s.store.Load(ctx); err == nil {
 		for _, repo := range repos {
-			if !st.DrainEnabled(repo) {
-				drainOff[NormalizeRepo(repo)] = true
+			if !st.AutofixEnabled(repo) {
+				autofixOff[NormalizeRepo(repo)] = true
 			}
 		}
 	}
@@ -337,8 +337,8 @@ func (s *Service) watchPass(ctx context.Context, opts WatchOptions, pool *dispat
 				Findings: len(report.Findings), At: s.clock().UTC(),
 			}
 			var result <-chan dispatchResult
-			if opts.dispatching() && report.Action == string(engine.ActionFix) && drainOff[NormalizeRepo(repo)] {
-				event.Skipped = "draining is off for this repository (crq drain on " + NormalizeRepo(repo) + ")"
+			if opts.dispatching() && report.Action == string(engine.ActionFix) && autofixOff[NormalizeRepo(repo)] {
+				event.Skipped = "autofix is off for this repository (crq autofix on " + NormalizeRepo(repo) + ")"
 			} else if opts.dispatching() && report.Action == string(engine.ActionFix) && !s.mayDispatch(repo, pull) {
 				event.Skipped = "the head branch is a fork; set CRQ_DISPATCH_FORKS=1 to fix contributor pull requests"
 			} else if opts.dispatching() && report.Action == string(engine.ActionFix) {
@@ -442,23 +442,23 @@ func (s *Service) mayDispatch(repo string, pull ghapi.Pull) bool {
 func (s *Service) noteDispatchHealth(ctx context.Context, started bool, reason string) {
 	var flipped, unhealthy bool
 	state, err := s.store.Update(ctx, func(st *State) error {
-		was := st.Drain.Unhealthy()
+		was := st.Autofix.Unhealthy()
 		st.NoteDispatch(s.cfg.Host, started, reason, s.clock())
-		unhealthy = st.Drain.Unhealthy()
+		unhealthy = st.Autofix.Unhealthy()
 		flipped = unhealthy != was
 		return nil
 	})
 	if err != nil {
 		return
 	}
-	// The dashboard is where this alert is meant to be read, and a drain that has
+	// The dashboard is where this alert is meant to be read, and an autofix service that has
 	// stopped working may produce no other write for hours. Every unhealthy
 	// attempt changes the rendered count, host, or error; recovery removes it.
 	if unhealthy || flipped {
 		s.sync(ctx, state)
 	}
 	if flipped && unhealthy && s.log != nil {
-		s.log.Printf("ALERT: no fix session has started in %d dispatch attempts — %s", DrainUnhealthyAfter, reason)
+		s.log.Printf("ALERT: no fix session has started in %d dispatch attempts — %s", AutofixUnhealthyAfter, reason)
 	}
 }
 
@@ -583,7 +583,7 @@ func (s *Service) dispatchWithStart(
 	token string,
 	started chan<- dispatchResult,
 ) (ok bool, reason string) {
-	// Health means "can this drain START a session", not whether the agent later
+	// Health means "can this watcher START a session", not whether the agent later
 	// succeeds at the work it was given. Record pre-start failures on return;
 	// cmd.Start records recovery immediately, while a healthy long-running
 	// session is still running.
@@ -782,7 +782,7 @@ func (s *Service) claimDispatch(ctx context.Context, report NextReport, token st
 		// The pass-level snapshot is only an optimization. The switch is an
 		// operator safety gate, so enforce it in the same CAS that grants the
 		// claim; a concurrent off or a failed earlier Load must fail closed.
-		if !st.DrainEnabled(report.Repo) {
+		if !st.AutofixEnabled(report.Repo) {
 			reason, byDesign = "fix sessions are disabled for this repository", true
 			return ErrNoChange
 		}
@@ -810,7 +810,7 @@ func (s *Service) claimDispatch(ctx context.Context, report NextReport, token st
 		}
 		if round == nil || round.Head != report.Head {
 			// Findings on a head the queue is not tracking: a review somebody
-			// triggered by hand, feedback that predates the drain, or a head that
+			// triggered by hand, feedback that predates autofix, or a head that
 			// moved on while the previous round still stood. `Next` returns `fix`
 			// before Enqueue in that case — deliberately, so no second review is
 			// bought for a head whose findings are already in hand — so nothing
diff --git a/internal/crq/watch_test.go b/internal/crq/watch_test.go
index 52aed5fd..03b87615 100644
--- a/internal/crq/watch_test.go
+++ b/internal/crq/watch_test.go
@@ -112,7 +112,7 @@ func TestWatchDispatchesAFixSessionWithItsContext(t *testing.T) {
 
 // Dispatching is the default, so a machine with no fix agent configured must
 // still be able to watch: refusing to start would make the default setting
-// break the plain command. It observes instead — and says so, because a drain
+// break the plain command. It observes instead — and says so, because an autofix watcher
 // that quietly does nothing is the failure this whole area is about.
 func TestWatchObservesWhenNoFixCommandIsConfigured(t *testing.T) {
 	cfg := firingConfig()
@@ -261,8 +261,8 @@ func TestDispatchHonoursDryRun(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if st.Drain != nil {
-		t.Errorf("a dry run wrote dispatch health: %+v", st.Drain)
+	if st.Autofix != nil {
+		t.Errorf("a dry run wrote dispatch health: %+v", st.Autofix)
 	}
 }
 
@@ -679,8 +679,8 @@ func TestDispatchHealthRecordsProcessStartBeforeItsExit(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if st.Drain == nil || st.Drain.LastSuccessAt == nil || st.Drain.ConsecutiveFailures != 0 {
-		t.Errorf("a process that started but exited nonzero was recorded as a start failure: %+v", st.Drain)
+	if st.Autofix == nil || st.Autofix.LastSuccessAt == nil || st.Autofix.ConsecutiveFailures != 0 {
+		t.Errorf("a process that started but exited nonzero was recorded as a start failure: %+v", st.Autofix)
 	}
 }
 
@@ -701,14 +701,14 @@ func TestDispatchHealthSyncsEveryVisibleAlertChange(t *testing.T) {
 	svc := NewService(cfg, newFakeGitHub(), store, &recordingLogger{})
 	ctx := context.Background()
 
-	for i := 1; i <= DrainUnhealthyAfter+1; i++ {
+	for i := 1; i <= AutofixUnhealthyAfter+1; i++ {
 		svc.noteDispatchHealth(ctx, false, fmt.Sprintf("failure %d", i))
 	}
 	if got := len(store.syncs); got != 2 {
 		t.Fatalf("dashboard syncs = %d, want threshold and later unhealthy update", got)
 	}
-	last := store.syncs[len(store.syncs)-1].Drain
-	if last == nil || last.ConsecutiveFailures != DrainUnhealthyAfter+1 || last.LastError != "failure 4" {
+	last := store.syncs[len(store.syncs)-1].Autofix
+	if last == nil || last.ConsecutiveFailures != AutofixUnhealthyAfter+1 || last.LastError != "failure 4" {
 		t.Fatalf("last synced health = %+v", last)
 	}
 
@@ -719,7 +719,7 @@ func TestDispatchHealthSyncsEveryVisibleAlertChange(t *testing.T) {
 }
 
 // Findings on a head crq never queued — a review somebody triggered by hand, or
-// feedback that predates the drain — used to be undispatchable forever, because
+// feedback that predates the autofix watcher — used to be undispatchable forever, because
 // `Next` returns fix before enqueueing and the claim had nowhere to live.
 func TestClaimDispatchAdoptsAHeadTheQueueNeverSaw(t *testing.T) {
 	cfg := firingConfig()
@@ -731,7 +731,7 @@ func TestClaimDispatchAdoptsAHeadTheQueueNeverSaw(t *testing.T) {
 	}
 
 	if ok, why, _ := svc.claimDispatch(context.Background(), report, "tok", 3); !ok {
-		t.Fatalf("claim refused: %s — these findings can never be drained", why)
+		t.Fatalf("claim refused: %s — these findings can never be cleared", why)
 	}
 	st, _, err := store.Load(context.Background())
 	if err != nil {
@@ -779,7 +779,7 @@ func TestClaimDispatchDoesNotMarkACarriedHeadReviewed(t *testing.T) {
 	}
 }
 
-func TestClaimDispatchRechecksRepositoryDrainSwitch(t *testing.T) {
+func TestClaimDispatchRechecksRepositoryAutofixSwitch(t *testing.T) {
 	ctx := context.Background()
 	cfg := firingConfig()
 	store := NewMemoryStore(cfg)
@@ -788,16 +788,16 @@ func TestClaimDispatchRechecksRepositoryDrainSwitch(t *testing.T) {
 		Repo: "owner/thing", PR: 12, Head: "aaaaaaaa1", Action: "fix",
 		Findings: []dialect.Finding{{ID: "f1", Commit: "aaaaaaaa1"}},
 	}
-	if _, err := svc.SetDrainEnabled(ctx, report.Repo, false, "operator stop"); err != nil {
+	if _, err := svc.SetAutofixEnabled(ctx, report.Repo, false, "operator stop"); err != nil {
 		t.Fatal(err)
 	}
 
 	ok, why, byDesign := svc.claimDispatch(ctx, report, "tok", 3)
 	if ok {
-		t.Fatal("claim bypassed a repository drain switch that was turned off after the pass snapshot")
+		t.Fatal("claim bypassed a repository autofix switch that was turned off after the pass snapshot")
 	}
 	if !byDesign {
-		t.Errorf("drain refusal %q counted as a dispatcher failure", why)
+		t.Errorf("autofix refusal %q counted as a dispatcher failure", why)
 	}
 	st, _, err := store.Load(ctx)
 	if err != nil {
@@ -824,7 +824,7 @@ func TestClaimDispatchSupersedesAStaleRound(t *testing.T) {
 
 	ok, why, _ := svc.claimDispatch(context.Background(), report, "tok", 3)
 	if !ok {
-		t.Fatalf("claim refused: %s — the new head's findings can never be drained", why)
+		t.Fatalf("claim refused: %s — the new head's findings can never be cleared", why)
 	}
 	st, _, err := store.Load(context.Background())
 	if err != nil {
@@ -889,7 +889,7 @@ func TestClaimDispatchSeesAClaimItsOwnPushArchived(t *testing.T) {
 }
 
 // The attempt bound is crq obeying its own configuration, not fix sessions
-// failing to start. Counted as drain health, a correctly bounded head raised the
+// failing to start. Counted as autofix health, a correctly bounded head raised the
 // "fix sessions are not starting" alert after three passes — and every pass
 // after that, forever.
 func TestExhaustedAttemptsAreNotADispatcherFailure(t *testing.T) {
diff --git a/internal/engine/next.go b/internal/engine/next.go
index eb43c9e7..7ceefec7 100644
--- a/internal/engine/next.go
+++ b/internal/engine/next.go
@@ -96,7 +96,7 @@ func (in NextInput) minDelay() time.Duration {
 // NextAction reduces the whole review protocol to one instruction.
 //
 // The order encodes the rules agents get wrong when left to their own devices:
-// findings are drained before anything else, the head is held while any
+// findings are cleared before anything else, the head is held while any
 // required reviewer is still pending, and a CodeRabbit rate-limit degrade
 // releases the head instead of stalling on it (the queued review fires on the
 // new head by itself). Convergence is last, so "done" can only mean every
diff --git a/internal/state/drain_test.go b/internal/state/autofix_test.go
similarity index 62%
rename from internal/state/drain_test.go
rename to internal/state/autofix_test.go
index 75a77183..eb42a910 100644
--- a/internal/state/drain_test.go
+++ b/internal/state/autofix_test.go
@@ -10,24 +10,24 @@ import (
 // the queue moved, PRs reported findings — and every dispatch died on a wedged
 // git mirror, in a log line nobody read. It has to reach a surface someone looks
 // at, and survive the unrelated progress that clears Warn.
-func TestDrainHealthSurfacesAFailingDispatcher(t *testing.T) {
+func TestAutofixHealthSurfacesAFailingDispatcher(t *testing.T) {
 	now := time.Date(2026, 7, 26, 23, 0, 0, 0, time.UTC)
 	st := New()
 	st.Account.Scope = "owner"
 
-	if st.Drain.Unhealthy() {
+	if st.Autofix.Unhealthy() {
 		t.Fatal("a fleet that has never dispatched is not unhealthy")
 	}
 	// One failure is a transient.
 	st.NoteDispatch("cachyos", false, "checkout failed", now)
-	if st.Drain.Unhealthy() {
+	if st.Autofix.Unhealthy() {
 		t.Error("one failure must not raise the alarm")
 	}
-	for i := 0; i < DrainUnhealthyAfter; i++ {
+	for i := 0; i < AutofixUnhealthyAfter; i++ {
 		st.NoteDispatch("cachyos", false, "refusing to fetch into branch", now)
 	}
-	if !st.Drain.Unhealthy() {
-		t.Fatalf("after %d failures the dispatcher is not working", DrainUnhealthyAfter)
+	if !st.Autofix.Unhealthy() {
+		t.Fatalf("after %d failures the dispatcher is not working", AutofixUnhealthyAfter)
 	}
 
 	// The two surfaces a person actually looks at.
@@ -42,67 +42,67 @@ func TestDrainHealthSurfacesAFailingDispatcher(t *testing.T) {
 	// Unrelated progress clears Warn; it must NOT clear this, or the failure
 	// disappears again the moment something else succeeds.
 	st.Warn = ""
-	if !st.Drain.Unhealthy() {
+	if !st.Autofix.Unhealthy() {
 		t.Error("clearing Warn cleared the dispatch alarm")
 	}
 
 	// One success is recovery.
 	st.NoteDispatch("cachyos", true, "", now.Add(time.Minute))
-	if st.Drain.Unhealthy() {
+	if st.Autofix.Unhealthy() {
 		t.Error("a started session must clear the alarm")
 	}
-	if st.Drain.LastSuccessAt == nil {
+	if st.Autofix.LastSuccessAt == nil {
 		t.Error("recovery must be recorded")
 	}
 }
 
-func TestDrainHealthStreaksAreIndependentPerHost(t *testing.T) {
+func TestAutofixHealthStreaksAreIndependentPerHost(t *testing.T) {
 	now := time.Date(2026, 7, 27, 8, 0, 0, 0, time.UTC)
 	st := New()
-	for i := 0; i < DrainUnhealthyAfter; i++ {
+	for i := 0; i < AutofixUnhealthyAfter; i++ {
 		at := now.Add(time.Duration(i) * time.Minute)
 		st.NoteDispatch("broken", false, "cannot start", at)
 		st.NoteDispatch("healthy", true, "", at)
 	}
-	if got := st.Drains["broken"].ConsecutiveFailures; got != DrainUnhealthyAfter {
-		t.Fatalf("broken host failures = %d, want %d", got, DrainUnhealthyAfter)
+	if got := st.AutofixByHost["broken"].ConsecutiveFailures; got != AutofixUnhealthyAfter {
+		t.Fatalf("broken host failures = %d, want %d", got, AutofixUnhealthyAfter)
 	}
-	if !st.Drain.Unhealthy() || st.Drain.Host != "broken" {
-		t.Fatalf("fleet summary = %+v, want the broken host retained", st.Drain)
+	if !st.Autofix.Unhealthy() || st.Autofix.Host != "broken" {
+		t.Fatalf("fleet summary = %+v, want the broken host retained", st.Autofix)
 	}
 
-	loaded := State{Drains: st.Drains}
+	loaded := State{AutofixByHost: st.AutofixByHost}
 	loaded.Normalize(now)
-	if loaded.Drain == nil || loaded.Drain.Host != "broken" {
-		t.Fatalf("normalized summary = %+v, want it rebuilt from per-host records", loaded.Drain)
+	if loaded.Autofix == nil || loaded.Autofix.Host != "broken" {
+		t.Fatalf("normalized summary = %+v, want it rebuilt from per-host records", loaded.Autofix)
 	}
 }
 
-func TestDrainHealthExpiresRetiredHosts(t *testing.T) {
+func TestAutofixHealthExpiresRetiredHosts(t *testing.T) {
 	now := time.Date(2026, 7, 27, 8, 0, 0, 0, time.UTC)
 	st := New()
-	for i := 0; i < DrainUnhealthyAfter; i++ {
+	for i := 0; i < AutofixUnhealthyAfter; i++ {
 		st.NoteDispatch("retired", false, "cannot start", now)
 	}
-	st.NoteDispatch("active", true, "", now.Add(DrainHealthTTL))
+	st.NoteDispatch("active", true, "", now.Add(AutofixHealthTTL))
 
-	if _, ok := st.Drains["retired"]; ok {
+	if _, ok := st.AutofixByHost["retired"]; ok {
 		t.Fatal("inactive retired host remained in dispatch health")
 	}
-	if st.Drain == nil || st.Drain.Host != "active" || st.Drain.Unhealthy() {
-		t.Fatalf("fleet summary = %+v, want the active healthy host", st.Drain)
+	if st.Autofix == nil || st.Autofix.Host != "active" || st.Autofix.Unhealthy() {
+		t.Fatalf("fleet summary = %+v, want the active healthy host", st.Autofix)
 	}
 
 	lastFailureAt := now
-	loaded := State{Drains: map[string]DrainHealth{
+	loaded := State{AutofixByHost: map[string]AutofixHealth{
 		"retired": {
 			Host:                "retired",
-			ConsecutiveFailures: DrainUnhealthyAfter,
+			ConsecutiveFailures: AutofixUnhealthyAfter,
 			LastFailureAt:       &lastFailureAt,
 		},
 	}}
-	loaded.Normalize(now.Add(DrainHealthTTL))
-	if loaded.Drain != nil || len(loaded.Drains) != 0 {
-		t.Fatalf("normalization retained expired dispatch health: drain=%+v drains=%+v", loaded.Drain, loaded.Drains)
+	loaded.Normalize(now.Add(AutofixHealthTTL))
+	if loaded.Autofix != nil || len(loaded.AutofixByHost) != 0 {
+		t.Fatalf("normalization retained expired dispatch health: autofix=%+v by_host=%+v", loaded.Autofix, loaded.AutofixByHost)
 	}
 }
diff --git a/internal/state/autofixswitch.go b/internal/state/autofixswitch.go
new file mode 100644
index 00000000..be02fb4d
--- /dev/null
+++ b/internal/state/autofixswitch.go
@@ -0,0 +1,76 @@
+package state
+
+import (
+	"sort"
+	"strings"
+	"time"
+)
+
+// RepoAutofixSwitch is one repository's answer to "may crq fix pull requests
+// here?", and when it was recorded.
+type RepoAutofixSwitch struct {
+	Enabled   bool       `json:"enabled"`
+	UpdatedAt *time.Time `json:"updated_at,omitempty"`
+	By        string     `json:"by,omitempty"`
+	Reason    string     `json:"reason,omitempty"`
+}
+
+// AutofixEnabled reports whether fix sessions may run for repo.
+//
+// Default ON, and absence means default: fixing is what the watcher is FOR,
+// so a repository nobody has ruled on gets fixed. Only an explicit "off"
+// recorded here stops it, which is the shape an operator expects — the thing
+// works, and you turn it off where you do not want it.
+//
+// It lives in the state ref rather than in each repository, for the same reason
+// the reviewer override does: the daemon has no checkout of what it watches, and
+// a daemon and an agent reading different configurations while writing one ref
+// is a class of divergence worth not having.
+func (s *State) AutofixEnabled(repo string) bool {
+	sw, ok := s.RepoAutofix[autofixRepoKey(repo)]
+	return !ok || sw.Enabled
+}
+
+// AutofixSwitch returns repo's explicit setting, and whether one exists.
+func (s *State) AutofixSwitch(repo string) (RepoAutofixSwitch, bool) {
+	sw, ok := s.RepoAutofix[autofixRepoKey(repo)]
+	return sw, ok
+}
+
+// SetAutofixSwitch records whether repo may be fixed, replacing any earlier answer.
+func (s *State) SetAutofixSwitch(repo string, sw RepoAutofixSwitch) {
+	if s.RepoAutofix == nil {
+		s.RepoAutofix = map[string]RepoAutofixSwitch{}
+	}
+	s.RepoAutofix[autofixRepoKey(repo)] = sw
+}
+
+// ClearAutofixSwitch drops repo's setting, returning it to the default, and
+// reports whether one was there.
+func (s *State) ClearAutofixSwitch(repo string) bool {
+	key := autofixRepoKey(repo)
+	if _, ok := s.RepoAutofix[key]; !ok {
+		return false
+	}
+	delete(s.RepoAutofix, key)
+	return true
+}
+
+// AutofixSwitches lists every explicit setting, by repository, in a stable order.
+func (s *State) AutofixSwitches() []string {
+	repos := make([]string, 0, len(s.RepoAutofix))
+	for repo := range s.RepoAutofix {
+		repos = append(repos, repo)
+	}
+	sort.Strings(repos)
+	return repos
+}
+
+// autofixRepoKey lowercases a repo slug so a switch set as Owner/Name matches a
+// round recorded as owner/name. It matches Key's normalization, which is the
+// one the rest of this package already keys on.
+func autofixRepoKey(repo string) string {
+	// Lowercase BEFORE trimming, so a ".GIT" suffix normalizes the same as ".git"
+	// rather than surviving into the key and matching nothing.
+	return strings.TrimSuffix(strings.ToLower(strings.TrimSpace(repo)), ".git")
+}
diff --git a/internal/state/dashboard.go b/internal/state/dashboard.go
index d8712e38..1b6150c1 100644
--- a/internal/state/dashboard.go
+++ b/internal/state/dashboard.go
@@ -335,9 +335,9 @@ func RenderDashboard(st State, cfg StoreConfig) string {
 		fmt.Fprintf(&b, "| **Co-reviewers** | %s |\n", coReviewerCell(st, cfg.CoReviewers))
 	}
 	fmt.Fprintf(&b, "| **Last review fired** | %s |\n", fmtStamp(st.LastFired, loc))
-	if st.Drain.Unhealthy() {
+	if st.Autofix.Unhealthy() {
 		fmt.Fprintf(&b, "\n> 🚨 fix sessions are not starting on %s — %d attempts in a row: %s\n",
-			dash(st.Drain.Host), st.Drain.ConsecutiveFailures, st.Drain.LastError)
+			dash(st.Autofix.Host), st.Autofix.ConsecutiveFailures, st.Autofix.LastError)
 	}
 	if st.Warn != "" {
 		fmt.Fprintf(&b, "\n> ⚠️ %s\n", st.Warn)
diff --git a/internal/state/drainswitch.go b/internal/state/drainswitch.go
deleted file mode 100644
index 3a0d38a5..00000000
--- a/internal/state/drainswitch.go
+++ /dev/null
@@ -1,74 +0,0 @@
-package state
-
-import (
-	"sort"
-	"strings"
-	"time"
-)
-
-// RepoDrainSwitch is one repository's answer to "may crq fix pull requests
-// here?", and when it was recorded.
-type RepoDrainSwitch struct {
-	Enabled   bool       `json:"enabled"`
-	UpdatedAt *time.Time `json:"updated_at,omitempty"`
-	By        string     `json:"by,omitempty"`
-	Reason    string     `json:"reason,omitempty"`
-}
-
-// DrainEnabled reports whether fix sessions may run for repo.
-//
-// Default ON, and absence means default: draining is what the watcher is FOR,
-// so a repository nobody has ruled on gets fixed. Only an explicit "off"
-// recorded here stops it, which is the shape an operator expects — the thing
-// works, and you turn it off where you do not want it.
-//
-// It lives in the state ref rather than in each repository, for the same reason
-// the reviewer override does: the daemon has no checkout of what it watches, and
-// a daemon and an agent reading different configurations while writing one ref
-// is a class of divergence worth not having.
-func (s *State) DrainEnabled(repo string) bool {
-	sw, ok := s.RepoDrain[drainRepoKey(repo)]
-	return !ok || sw.Enabled
-}
-
-// DrainSwitch returns repo's explicit setting, and whether one exists.
-func (s *State) DrainSwitch(repo string) (RepoDrainSwitch, bool) {
-	sw, ok := s.RepoDrain[drainRepoKey(repo)]
-	return sw, ok
-}
-
-// SetDrainSwitch records whether repo may be fixed, replacing any earlier answer.
-func (s *State) SetDrainSwitch(repo string, sw RepoDrainSwitch) {
-	if s.RepoDrain == nil {
-		s.RepoDrain = map[string]RepoDrainSwitch{}
-	}
-	s.RepoDrain[drainRepoKey(repo)] = sw
-}
-
-// ClearDrainSwitch drops repo's setting, returning it to the default, and
-// reports whether one was there.
-func (s *State) ClearDrainSwitch(repo string) bool {
-	key := drainRepoKey(repo)
-	if _, ok := s.RepoDrain[key]; !ok {
-		return false
-	}
-	delete(s.RepoDrain, key)
-	return true
-}
-
-// DrainSwitches lists every explicit setting, by repository, in a stable order.
-func (s *State) DrainSwitches() []string {
-	repos := make([]string, 0, len(s.RepoDrain))
-	for repo := range s.RepoDrain {
-		repos = append(repos, repo)
-	}
-	sort.Strings(repos)
-	return repos
-}
-
-// drainRepoKey lowercases a repo slug so a switch set as Owner/Name matches a
-// round recorded as owner/name. It matches Key's normalization, which is the
-// one the rest of this package already keys on.
-func drainRepoKey(repo string) string {
-	return strings.ToLower(strings.TrimSuffix(strings.TrimSpace(repo), ".git"))
-}
diff --git a/internal/state/state.go b/internal/state/state.go
index 877613f8..e936989b 100644
--- a/internal/state/state.go
+++ b/internal/state/state.go
@@ -105,7 +105,7 @@ type Round struct {
 	// Dismissed maps the ID of a finding an agent explicitly accounted for to the
 	// reason given. GitHub offers no way to close these: a review-body finding, a
 	// review-skipped notice and an outside-diff remark all lack a review thread,
-	// so `crq resolve` and `crq decline` have nothing to act on and drain-first
+	// so `crq resolve` and `crq decline` have nothing to act on and fix-first
 	// can never be satisfied — the round repeats `fix` forever and no new review is ever
 	// requested for the head.
 	//
@@ -427,21 +427,21 @@ type State struct {
 	// for the dashboard and debugging. Bounded by ArchiveMax.
 	Archive []Round `json:"archive,omitempty"`
 
-	// Drain records the watcher's dispatch health. It is separate from Warn
+	// Autofix records the watcher's dispatch health. It is separate from Warn
 	// because Warn is cleared by the next successful fire — a dispatcher that
 	// has been failing for hours would be wiped by unrelated progress, which is
 	// exactly how the failure stayed invisible.
-	Drain *DrainHealth `json:"drain,omitempty"`
-	// Drains keeps each host's failure streak independent. Drain above is the
+	Autofix *AutofixHealth `json:"autofix,omitempty"`
+	// AutofixByHost keeps each host's failure streak independent. Autofix above is the
 	// fleet summary dual-written for older binaries during rolling upgrades.
-	Drains map[string]DrainHealth `json:"drains,omitempty"`
+	AutofixByHost map[string]AutofixHealth `json:"autofix_by_host,omitempty"`
 	// Dispatches holds live PR-level claims outside the bounded round archive.
 	// A session may still be resolving threads after its push superseded the
 	// claimed round, and archive eviction must not admit a second session.
 	Dispatches map[string]DispatchClaim `json:"dispatches,omitempty"`
-	// RepoDrain answers "may crq fix pull requests here?" per repository. Absent
-	// means the default, which is yes — see DrainEnabled.
-	RepoDrain map[string]RepoDrainSwitch `json:"repo_drain,omitempty"`
+	// RepoAutofix answers "may crq fix pull requests here?" per repository. Absent
+	// means the default, which is yes — see AutofixEnabled.
+	RepoAutofix map[string]RepoAutofixSwitch `json:"repo_autofix,omitempty"`
 	// TidiedCommands are durable tombstones for trigger comments Tidy removed.
 	// Unlike Archive, they are not bounded: GitHub can deliver a delayed reply
 	// for as long as the PR conversation exists, and command/reply FIFO pairing
@@ -1207,27 +1207,27 @@ func (r *Round) ReleaseDispatch(token string) bool {
 	return true
 }
 
-// DrainUnhealthyAfter is how many consecutive dispatch attempts may fail to
+// AutofixUnhealthyAfter is how many consecutive dispatch attempts may fail to
 // start a session before crq says so out loud. One failure is a transient; three
 // in a row is a dispatcher that is not working.
 //
 // Attempts, not passes: sessions outlive the pass that started them, so their
 // outcomes arrive one at a time and any success resets the count.
-const DrainUnhealthyAfter = 3
+const AutofixUnhealthyAfter = 3
 
-// DrainHealthTTL is how long a host that reports no dispatch outcome remains
+// AutofixHealthTTL is how long a host that reports no dispatch outcome remains
 // part of the fleet health summary. A retired or renamed host cannot report its
 // own recovery, so retaining it forever would make one historical failure the
 // permanent fleet verdict.
-const DrainHealthTTL = 24 * time.Hour
+const AutofixHealthTTL = 24 * time.Hour
 
-// DrainHealth is the watcher's dispatch record: whether fix sessions are
+// AutofixHealth is the watcher's dispatch record: whether fix sessions are
 // actually starting.
 //
 // A dispatch failure used to be a line in a log nobody read, so a wedged git
 // mirror stopped every session for hours while the queue looked busy. Counting
 // it here puts it on the dashboard and in the status line instead.
-type DrainHealth struct {
+type AutofixHealth struct {
 	Host                string     `json:"host,omitempty"`
 	ConsecutiveFailures int        `json:"consecutive_failures,omitempty"`
 	LastError           string     `json:"last_error,omitempty"`
@@ -1237,47 +1237,47 @@ type DrainHealth struct {
 
 // Unhealthy reports whether dispatch has failed enough times in a row to be
 // worth someone's attention.
-func (d *DrainHealth) Unhealthy() bool {
-	return d != nil && d.ConsecutiveFailures >= DrainUnhealthyAfter
+func (d *AutofixHealth) Unhealthy() bool {
+	return d != nil && d.ConsecutiveFailures >= AutofixUnhealthyAfter
 }
 
 // NoteDispatch records one dispatch attempt's outcome: whether a session
 // started, and the reason if it did not.
 func (s *State) NoteDispatch(host string, started bool, reason string, now time.Time) {
-	if s.Drains == nil {
-		s.Drains = map[string]DrainHealth{}
-		if s.Drain != nil && s.Drain.Host != "" {
-			s.Drains[s.Drain.Host] = *s.Drain
+	if s.AutofixByHost == nil {
+		s.AutofixByHost = map[string]AutofixHealth{}
+		if s.Autofix != nil && s.Autofix.Host != "" {
+			s.AutofixByHost[s.Autofix.Host] = *s.Autofix
 		}
 	}
 	at := now.UTC()
-	drain := s.Drains[host]
-	drain.Host = host
+	health := s.AutofixByHost[host]
+	health.Host = host
 	if started {
-		drain.ConsecutiveFailures = 0
-		drain.LastError = ""
-		drain.LastSuccessAt = &at
+		health.ConsecutiveFailures = 0
+		health.LastError = ""
+		health.LastSuccessAt = &at
 	} else {
-		drain.ConsecutiveFailures++
-		drain.LastError = reason
-		drain.LastFailureAt = &at
+		health.ConsecutiveFailures++
+		health.LastError = reason
+		health.LastFailureAt = &at
 	}
-	s.Drains[host] = drain
-	s.summarizeDrains(now)
+	s.AutofixByHost[host] = health
+	s.summarizeAutofix(now)
 }
 
-func (s *State) summarizeDrains(now time.Time) {
-	var summary *DrainHealth
-	for host, drain := range s.Drains {
-		latest := drain.LastFailureAt
-		if timeAfter(drain.LastSuccessAt, latest) {
-			latest = drain.LastSuccessAt
+func (s *State) summarizeAutofix(now time.Time) {
+	var summary *AutofixHealth
+	for host, health := range s.AutofixByHost {
+		latest := health.LastFailureAt
+		if timeAfter(health.LastSuccessAt, latest) {
+			latest = health.LastSuccessAt
 		}
-		if latest != nil && !latest.Add(DrainHealthTTL).After(now.UTC()) {
-			delete(s.Drains, host)
+		if latest != nil && !latest.Add(AutofixHealthTTL).After(now.UTC()) {
+			delete(s.AutofixByHost, host)
 			continue
 		}
-		candidate := drain
+		candidate := health
 		if summary == nil ||
 			candidate.ConsecutiveFailures > summary.ConsecutiveFailures ||
 			(candidate.ConsecutiveFailures == summary.ConsecutiveFailures &&
@@ -1287,7 +1287,7 @@ func (s *State) summarizeDrains(now time.Time) {
 			summary = &candidate
 		}
 	}
-	s.Drain = summary
+	s.Autofix = summary
 }
 
 func timeAfter(a, b *time.Time) bool {
@@ -1643,16 +1643,16 @@ func (s *State) Normalize(now time.Time) {
 	if s.Version == 0 {
 		s.Version = SchemaVersion
 	}
-	if s.Drain != nil && s.Drain.Host != "" {
-		if s.Drains == nil {
-			s.Drains = map[string]DrainHealth{}
+	if s.Autofix != nil && s.Autofix.Host != "" {
+		if s.AutofixByHost == nil {
+			s.AutofixByHost = map[string]AutofixHealth{}
 		}
-		if _, ok := s.Drains[s.Drain.Host]; !ok {
-			s.Drains[s.Drain.Host] = *s.Drain
+		if _, ok := s.AutofixByHost[s.Autofix.Host]; !ok {
+			s.AutofixByHost[s.Autofix.Host] = *s.Autofix
 		}
 	}
-	if s.Drains != nil {
-		s.summarizeDrains(now)
+	if s.AutofixByHost != nil {
+		s.summarizeAutofix(now)
 	}
 	// Fold both hold representations before repairing the slot. The top-level
 	// mirror may be the only copy left after a pre-FireSlot-tolerance binary
diff --git a/internal/state/statusline.go b/internal/state/statusline.go
index bacae777..8058b5f9 100644
--- a/internal/state/statusline.go
+++ b/internal/state/statusline.go
@@ -31,10 +31,10 @@ func StatusLine(st State, cfg StoreConfig) string {
 	heldPrimary := false
 	stranded := firstStranded(st, inFlight)
 	switch {
-	case st.Drain.Unhealthy():
+	case st.Autofix.Unhealthy():
 		// Above everything else: a queue that looks busy while no session can
 		// start is the state that hid a wedged dispatcher for hours.
-		parts = append(parts, fmt.Sprintf("🚨 dispatch failing (%d)", st.Drain.ConsecutiveFailures))
+		parts = append(parts, fmt.Sprintf("🚨 dispatch failing (%d)", st.Autofix.ConsecutiveFailures))
 	case stranded != nil:
 		parts = append(parts, fmt.Sprintf("⚠ #%d stranded", stranded.PR))
 	case !ready && st.Account.BlockedUntil != nil && st.Account.BlockedUntil.After(now):
diff --git a/llms.txt b/llms.txt
index d44c69cb..2fd5a680 100644
--- a/llms.txt
+++ b/llms.txt
@@ -102,14 +102,14 @@ instruction. It shares one code path with the non-blocking form.
 `crq loop` is the older primitive: it triggers a round, blocks until feedback lands, and returns one
 report. It remains supported for humans and one-shot scripts, but an agent driving a PR should use
 `crq next` — `loop` requires the caller to interpret exit codes and to enforce the hold-the-head and
-drain-first rules by hand.
+fix-first rules by hand.
 
 ```bash
 crq loop OWNER/REPO PR_NUMBER > crq-feedback.json
 rc=$?
 ```
 
-`crq loop` enforces the drain-first invariant for new rounds: unresolved findings are returned before
+`crq loop` enforces the fix-first invariant for new rounds: unresolved findings are returned before
 the PR is queued or a review slot is consumed. Thread-less review-body findings from a previous
 commit do not block after fixes are pushed; the next current-head review supersedes them or reports
 the finding again.
@@ -215,7 +215,7 @@ Run the whole thing unattended — crq watches every open PR and starts a fix se
 that need one:
 
 ```bash
-crq drain install            # prompt + wrapper + service, started; --dry-run to preview
+crq autofix install            # prompt + wrapper + service, started; --dry-run to preview
 ```
 
 Session output goes to `$CRQ_WORKSPACE/logs/<owner>/<name>/<pr>-<head>-<time>.log`. Three dispatch attempts in a
@@ -227,19 +227,19 @@ the service can resolve itself — `gh auth login`, or `GITHUB_TOKEN`/`GH_TOKEN`
 exported only in a shell profile makes the install refuse rather than start a watcher that cannot
 authenticate.
 
-`crq drain install` runs `crq watch`, which you can also run yourself:
+`crq autofix install` runs `crq watch`, which you can also run yourself:
 
 ```bash
 crq watch [--no-dispatch] [--once] [--interval 2m] [--concurrency 0] [<repo>...] [-- <cmd>...]
-crq drain                                  # which repositories crq may fix
-crq drain off REPO --reason "why"          # stop fixing there; watching continues
-crq drain on REPO | crq drain default REPO
+crq autofix                                  # which repositories crq may fix
+crq autofix off REPO --reason "why"          # stop fixing there; watching continues
+crq autofix on REPO | crq autofix default REPO
 ```
 
 It drives every open PR in `CRQ_REPOS` through the same `crq next` oracle and emits one JSON line
 per PR per pass (`repo`, `pr`, `action`, `findings`, `dispatched`, `skipped`). Fixing is ON by
 default — watching a PR nobody fixes is a queue that reports work and does none. `--no-dispatch`
-makes one run an observer, `crq drain off REPO` stops it for one repository (watching and reviewing
+makes one run an observer, `crq autofix off REPO` stops it for one repository (watching and reviewing
 continue there), and having no fix command configured observes with a log line rather than refusing
 to start. A PR whose action is `fix` is claimed under compare-and-swap and the
 command from `CRQ_DISPATCH_CMD` (or after `--`) runs in a crq-made worktree checked out at that
diff --git a/skills/coderabbit-queue/SKILL.md b/skills/coderabbit-queue/SKILL.md
index ff11f623..4beaed6b 100644
--- a/skills/coderabbit-queue/SKILL.md
+++ b/skills/coderabbit-queue/SKILL.md
@@ -103,7 +103,7 @@ report with a frozen exit code (0 converged/skipped, 10 findings, 2 timeout). It
 for humans and one-shot scripts.
 
 An agent driving a PR should use `crq next` instead. `crq loop` requires the caller to interpret exit
-codes, enforce the drain-first and hold-the-head rules by hand, and keep a long-lived process alive
+codes, enforce the fix-first and hold-the-head rules by hand, and keep a long-lived process alive
 across turns — the three things that go wrong. Use `crq next` plus `crq wait` instead.
 
 Rate-limit degrade (default on, `CRQ_RL_CODEX_DEGRADE=0` disables): when CodeRabbit is rate-limited
@@ -182,7 +182,7 @@ thread left open keeps its finding actionable and `crq next` would repeat `fix`
 disagreement is not lost: if the bot contests the decline, crq re-surfaces that reply as its own
 finding. Pass `--keep-open` to leave it unresolved deliberately.
 
-## Unattended Drain
+## Unattended Autofix
 
 `crq watch` starts a fix session for every PR whose action is `fix` — that is the default — in a worktree crq
 checked out at that head. Sessions run concurrently and off the decision loop, with **no cap by default** — fixing findings
@@ -190,7 +190,7 @@ spends no account quota, so it does not belong in a queue. `CRQ_DISPATCH_CONCURR
 machine cannot take the load. The decisions stay serial, which is what keeps the metered review in
 one queue.
 
-One command sets it up — `crq drain install` writes the prompt, a wrapper and this platform's
+One command sets it up — `crq autofix install` writes the prompt, a wrapper and this platform's
 service (systemd user unit, or a launchd agent on macOS), makes it survive a logout, and starts it;
 `--dry-run` prints the paths and the exact invocation first. `--agent claude|codex` picks the fix
 agent, and `--agent-args` carries its model and reasoning settings — crq knows how to call each
@@ -267,7 +267,7 @@ per-repo overrides — they will keep using the fleet default until upgraded.
 
 Review-body findings, review-skipped notices, outside-diff remarks and issue-comment findings have
 no `thread_id`. `crq resolve` and `crq decline` both act on a thread, so neither can touch them — and a
-finding that can never drain blocks every future round on that PR.
+finding that can never be cleared blocks every future round on that PR.
 
 ```bash
 crq dismiss "$REPO" "$PR" "$FINDING_ID" --reason "why this is being set aside"
@@ -289,20 +289,20 @@ does have a thread; retry once crq can read threads again rather than working ar
 the notice is a SKIPPED review, narrowing the PR addresses the cause; dismissing only records that
 you chose to proceed at this head.
 
-## Turning the Drain Off Somewhere
+## Turning Autofix Off Somewhere
 
 Fixing is what watching is for, so it is on for every repository in scope. Where you do not want crq
 writing code — a release branch, a repository you are hand-tuning:
 
 ```bash
-crq drain off "$REPO" --reason "hand-tuning the release branch"
-crq drain on "$REPO"          # or: crq drain default "$REPO"
-crq drain                     # what is on, and where an answer was recorded
+crq autofix off "$REPO" --reason "hand-tuning the release branch"
+crq autofix on "$REPO"          # or: crq autofix default "$REPO"
+crq autofix                     # what is on, and where an answer was recorded
 ```
 
 Off stops FIXING, not watching. The pull request is still observed and still reviewed, so its
 feedback keeps arriving for a person to act on. The setting lives in the state ref, so it applies to
-every host running a drain.
+every host running autofix.
 
 ## Fleet Auto-Review
 

From 543db595567e35d00e6775b9005c4bc7179be7fc Mon Sep 17 00:00:00 2001
From: kristofferR <481270+kristofferR@users.noreply.github.com>
Date: Mon, 27 Jul 2026 20:53:21 +0200
Subject: [PATCH 2/2] Retire the pre-rename watcher when autofix installs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The rename is a hard break in the state and the CLI, but a break in naming
stops nothing that is already running. A host that ran `crq drain install`
keeps an enabled crq-drain unit, and `crq autofix install` only enabled and
restarted crq-autofix beside it: two watchers then scan the same fleet, each
starting sessions and racing the other's dispatch claims.

The install now stops the old one first — `systemctl --user disable --now`,
or launchd's disable plus bootout, since bootout alone comes back at the next
login. It is detected from the unit still being on disk rather than attempted
blindly, so a first install runs no pointless command and needs no failure
text to know it was benign, and --dry-run names what it will retire.
---
 examples/dispatch/README.md  |  4 +++
 internal/crq/autofix.go      | 50 +++++++++++++++++++++++++++++++---
 internal/crq/autofix_test.go | 52 ++++++++++++++++++++++++++++++++++++
 3 files changed, 102 insertions(+), 4 deletions(-)

diff --git a/examples/dispatch/README.md b/examples/dispatch/README.md
index cb37efe0..def6a195 100644
--- a/examples/dispatch/README.md
+++ b/examples/dispatch/README.md
@@ -19,6 +19,10 @@ agent on macOS), enables lingering so it survives a logout, and starts it. There
 are no files in this directory to copy: the prompt crq installs is embedded in
 the binary, so it cannot drift from the one documented here.
 
+On a host that ran the pre-rename `crq drain install`, it also stops and
+disables the leftover `crq-drain` service — two watchers scanning the same
+fleet would race each other's dispatch claims.
+
 ## Two rules the prompt earned the hard way
 
 **Sessions stay on a detached HEAD and push by ref.** crq's worktrees are backed
diff --git a/internal/crq/autofix.go b/internal/crq/autofix.go
index 9394710f..7243c532 100644
--- a/internal/crq/autofix.go
+++ b/internal/crq/autofix.go
@@ -38,8 +38,11 @@ type AutofixInstall struct {
 	Invocation string   `json:"invocation,omitempty"`
 	Repos      []string `json:"repos"`
 	Commands   []string `json:"commands"`
-	DryRun     bool     `json:"dry_run,omitempty"`
-	Started    bool     `json:"started,omitempty"`
+	// Retire is the pre-rename watcher this install shuts down, when one is
+	// still on disk. Empty when there is nothing to retire.
+	Retire  string `json:"retire,omitempty"`
+	DryRun  bool   `json:"dry_run,omitempty"`
+	Started bool   `json:"started,omitempty"`
 }
 
 // InstallAutofix sets up unattended autofix: the prompt, a wrapper, a
@@ -122,12 +125,22 @@ func AutofixPlan(cfg Config, agent string, agentArgs []string, repos []string, d
 	switch runtime.GOOS {
 	case "darwin":
 		plan.Unit = filepath.Join(home, "Library", "LaunchAgents", "no.kristofferr.crq-autofix.plist")
+		plan.Retire = legacyWatcherUnit(filepath.Join(home, "Library", "LaunchAgents", "no.kristofferr.crq-drain.plist"))
 		plan.Commands = []string{
 			"launchctl bootout gui/$(id -u)/no.kristofferr.crq-autofix",
 			"launchctl bootstrap gui/$(id -u) " + plan.Unit,
 		}
+		if plan.Retire != "" {
+			// Both halves: bootout stops it now, disable keeps launchd from
+			// bootstrapping the plist again at the next login.
+			plan.Commands = append([]string{
+				"launchctl disable gui/$(id -u)/no.kristofferr.crq-drain",
+				"launchctl bootout gui/$(id -u)/no.kristofferr.crq-drain",
+			}, plan.Commands...)
+		}
 	default:
 		plan.Unit = filepath.Join(home, ".config", "systemd", "user", "crq-autofix.service")
+		plan.Retire = legacyWatcherUnit(filepath.Join(home, ".config", "systemd", "user", "crq-drain.service"))
 		plan.Commands = []string{
 			"loginctl enable-linger " + os.Getenv("USER"),
 			"systemctl --user daemon-reload",
@@ -138,6 +151,9 @@ func AutofixPlan(cfg Config, agent string, agentArgs []string, repos []string, d
 			// and changes nothing is the worst of both.
 			"systemctl --user restart crq-autofix",
 		}
+		if plan.Retire != "" {
+			plan.Commands = append([]string{"systemctl --user disable --now crq-drain"}, plan.Commands...)
+		}
 	}
 	invocation, err := agentInvocation(agent, plan.Prompt, agentArgs)
 	if err != nil {
@@ -237,17 +253,43 @@ func writeAutofixFile(path, body string, mode os.FileMode) error {
 func autofixCommandArgs(plan AutofixInstall) [][]string {
 	if plan.Platform == "darwin" {
 		domain := "gui/" + currentUID()
-		return [][]string{
+		args := [][]string{
 			{"launchctl", "bootout", domain + "/no.kristofferr.crq-autofix"},
 			{"launchctl", "bootstrap", domain, plan.Unit},
 		}
+		if plan.Retire != "" {
+			args = append([][]string{
+				{"launchctl", "disable", domain + "/no.kristofferr.crq-drain"},
+				{"launchctl", "bootout", domain + "/no.kristofferr.crq-drain"},
+			}, args...)
+		}
+		return args
 	}
-	return [][]string{
+	args := [][]string{
 		{"loginctl", "enable-linger", os.Getenv("USER")},
 		{"systemctl", "--user", "daemon-reload"},
 		{"systemctl", "--user", "enable", "crq-autofix"},
 		{"systemctl", "--user", "restart", "crq-autofix"},
 	}
+	if plan.Retire != "" {
+		args = append([][]string{{"systemctl", "--user", "disable", "--now", "crq-drain"}}, args...)
+	}
+	return args
+}
+
+// legacyWatcherUnit reports the pre-rename watcher's unit, if it is still there.
+//
+// The rename is a hard break in the state and the CLI, but a break in naming
+// stops nothing that is already running: a host that ran `crq drain install`
+// keeps an enabled crq-drain unit, and installing autofix beside it leaves two
+// watchers scanning the same fleet and racing each other's dispatch claims.
+// Detected from disk rather than attempted blindly, so a first install neither
+// runs a pointless command nor has to read failure text to know it was benign.
+func legacyWatcherUnit(path string) string {
+	if _, err := os.Stat(path); err != nil {
+		return ""
+	}
+	return path
 }
 
 func currentUID() string { return fmt.Sprint(os.Getuid()) }
diff --git a/internal/crq/autofix_test.go b/internal/crq/autofix_test.go
index dc2b5812..30767980 100644
--- a/internal/crq/autofix_test.go
+++ b/internal/crq/autofix_test.go
@@ -76,6 +76,58 @@ func TestAutofixPlanOrdersTheFleetTheSameWayEveryTime(t *testing.T) {
 	}
 }
 
+// The rename breaks the state and the CLI, but a break in naming stops nothing
+// that is already running: a host that ran the pre-rename installer keeps an
+// enabled crq-drain unit, and installing autofix beside it left two watchers
+// scanning the same fleet and racing each other's dispatch claims.
+func TestAutofixPlanRetiresThePreRenameWatcher(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	cfg := firingConfig()
+	cfg.AllowRepos = map[string]bool{"owner/name": true}
+	agent := fakeAgent(t, "claude")
+
+	// A host that never ran the old installer must not be told to retire it.
+	clean, err := AutofixPlan(cfg, agent, nil, nil, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if clean.Retire != "" {
+		t.Errorf("retire = %q on a host with no legacy unit", clean.Retire)
+	}
+	for _, c := range clean.Commands {
+		if strings.Contains(c, "crq-drain") {
+			t.Errorf("commands = %v, want nothing about a watcher that was never installed", clean.Commands)
+		}
+	}
+
+	legacy := filepath.Join(home, ".config", "systemd", "user", "crq-drain.service")
+	if runtime.GOOS == "darwin" {
+		legacy = filepath.Join(home, "Library", "LaunchAgents", "no.kristofferr.crq-drain.plist")
+	}
+	if err := os.MkdirAll(filepath.Dir(legacy), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(legacy, []byte("legacy"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	plan, err := AutofixPlan(cfg, agent, nil, nil, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if plan.Retire != legacy {
+		t.Errorf("retire = %q, want the legacy unit %q", plan.Retire, legacy)
+	}
+	if len(plan.Commands) == 0 || !strings.Contains(plan.Commands[0], "crq-drain") {
+		t.Fatalf("commands = %v, want the legacy watcher stopped before the new one starts", plan.Commands)
+	}
+	// applyAutofix pairs the two by index and refuses to run a mismatch.
+	if got, want := len(autofixCommandArgs(plan)), len(plan.Commands); got != want {
+		t.Errorf("argv count = %d, want %d — the plan and what it runs must be the same list", got, want)
+	}
+}
+
 func TestInstallAutofixHonoursConfiguredDryRun(t *testing.T) {
 	cfg := firingConfig()
 	cfg.DryRun = true