clearotron 0.3.2-beta.7 → 0.3.2-beta.9

package/driver/gateway.mjs

@@ -34,7 +34,7 @@ import { MODEL_FILE as BLIND_FRAME_MODEL_FILE } from "./blind-frame-record.mjs";
 import { FLAGS_FILE as SKEPTIC_FLAGS_FILE } from "./skeptic-record.mjs";
 import { MODEL_FILE as FRAME_DIFF_MODEL_FILE, PROSE_FILE as FRAME_DIFF_PROSE_FILE } from "./frame-diff-record.mjs";
 import { MATTER_CONTEXT_FILE } from "./matter-frame-record.mjs";
-import { MODEL_FILE as VARIANT_MODEL_FILE, PROSE_FILE as VARIANT_PROSE_FILE } from "./prelim-variants-record.mjs";
+import { MODEL_FILE as VARIANT_MODEL_FILE, PROSE_FILE as VARIANT_PROSE_FILE } from "./clearance-variants-record.mjs";
 import { PROSE_FILE as REPORT_OVERVIEW_FILE } from "./report-overview-record.mjs";
 import { NARRATIVE_FILE, FINDINGS_FILE, refusalsFor } from "./synthesis-record.mjs";
 import { FINDINGS_FILE as REGISTER_FINDINGS_FILE, refusalsFor as registerDigestRefusalsFor } from "./register-digest-record.mjs";
@@ -96,8 +96,8 @@ export const TOOL_WRITTEN_ARTIFACTS = new Map([
   // scope-ledger.json is deliberately ABSENT: it was already driver-written before this conversion (the
   // driver derived it), so it is outside this conversion's claim. What changed is where its values come
   // from, not who writes it.
-  [VARIANT_MODEL_FILE, { tool: "record_prelim_variants", what: "the variant manifest" }],
-  [VARIANT_PROSE_FILE, { tool: "record_prelim_variants", what: "the variant manifest" }],
+  [VARIANT_MODEL_FILE, { tool: "record_clearance_variants", what: "the variant manifest" }],
+  [VARIANT_PROSE_FILE, { tool: "record_clearance_variants", what: "the variant manifest" }],
   // Conversion 4 — ONE basename, and the first row whose artifact a CLIENT reads. report-overview.md is
   // the delivered report's front-matter and its Actions section; assembleReportMd splices the code-built
   // sections into it and publishes the result. So a repair that arrives naming this file and gets handed
@@ -261,6 +261,7 @@ import { unionDispositionForm, formSidecarPath } from "./disposition-union.mjs";
 import { unionCoverageForm } from "./coverage-union.mjs";
 import { coverageFormStamp, readCoverageForm, readCoverageFormInput, writeCoverageForm } from "./coverage-form-io.mjs";
 import { unionPlacementForm } from "./placement-union.mjs";
+import { placementRenderAccount } from "./placement-form.mjs";
 import { placementFormStamp, readPlacementForm, readPlacementFormInput, readSubmittedPlacementForm, writePlacementForm, renderPlacementsFile } from "./placement-form-io.mjs";
 // The register-axis vocabulary, quoted verbatim into the coverage-form axis hint. ONE source: the same
 // constant `rowIsSettled` refuses against, so the hint can never name a set the gate does not accept.
@@ -741,7 +742,12 @@ export function syncPlacementForm(files) {
     // never put an unparseable deliverable on disk, and on a throw the previous file is left alone.
     const r = renderPlacementsFile(runDir, u.form.rows);
     if (!r.ok) note(`[placement-form] placements.json NOT re-rendered: ${r.error} — the previous file stands and the omission is on the form`);
-    return { ...u, rendered: r.ok ? r.placements : null, render_error: r.error };
+    // WHO OWES EACH ROW THE RENDER LEFT OUT — the same account validators.placement judges with, carried onto
+    // the attempt row so an omission is never read without its cause.
+    const a = placementRenderAccount(u.form.rows);
+    const account = { unjudged: a.unjudged.length, registerSelected: a.register_selected,
+      registerRendered: a.register_rendered, registerFacts: a.register_facts };
+    return { ...u, rendered: r.ok ? r.placements : null, render_error: r.error, account };
   }
   return null;
 }
@@ -817,7 +823,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     followup = false,   // #5b: this run is a warm-resume / followup (escalation, envelope close, frame-reopen
                         // sweep) — a hard-wall timeout breaks after ONE attempt (a 1.5× extension can't fit
                         // an already-over-budget resume; the caller records the coverage-limited deferral).
-    excludeTools, bandSize,   // copper-lattice re-route: tool names dropped from this stage's allowedTools
+    excludeTools, bandSize, derivedLimit = null,   // copper-lattice re-route: tool names dropped from this stage's allowedTools
   } = opts;
   if (!message) throw new Error(`runStage(${name}): message is required`);
   if (!sessionKey) throw new Error(`runStage(${name}): sessionKey is required`);
@@ -1145,17 +1151,17 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     // it; the log was already saying what the code believed.
     //
     // TWO FIELDS, NEVER COLLAPSED INTO ONE:
-    //   modelUsed   — the requested resolution. Unchanged in meaning and unchanged in value, because
-    //                 run-economics.mjs and tokens.mjs both read it and a field that quietly changes
-    //                 what it means is its own corruption.
-    //   modelActual — the id the WIRE reported (engine tuple `modelWire`), or NULL when the stream
-    //                 never said: an engine that does not emit one (codex), a turn killed before any
-    //                 event, a spawn error. It NEVER falls back to the requested alias.
-    // `modelBasis` names which of the two the row can defend: "actual" or "unknown". There is no third
-    // state in which a requested value is dressed as an observed one.
+    //   modelUsed   — the requested resolution, unchanged in meaning and value: run-economics.mjs and
+    //                 tokens.mjs both read it, and a field that quietly changes meaning is its own corruption.
+    //   modelActual — the id the WIRE reported (engine tuple `modelWire`), or NULL when the stream never
+    //                 said: an engine that does not emit one (codex), a turn killed before any event, a
+    //                 spawn error. It NEVER falls back to the requested alias, and `modelBasis` ("actual" or
+    //                 "unknown") never dresses a requested value as an observed one. `providerReported` is
+    //                 the provider word the same stream gave (tuple `providerWire`), null on the same terms.
     const modelRequested = engine.resolveModelId ? engine.resolveModelId(model) : resolveModel(model);
     const modelActual = (typeof turn.modelWire === "string" && turn.modelWire) ? turn.modelWire : null;
     const modelBasis = modelActual ? "actual" : "unknown";
+    const providerReported = (typeof turn.providerWire === "string" && turn.providerWire) ? turn.providerWire : null;
     // WHETHER THE OBSERVED ID NAMES A FIXED BUILD. `modelBasis: "actual"` says the provider answered,
     // not that the answer is pinned: two of the three tiers come back as undated aliases the provider
     // may repoint, and recorded beside a dated one they read identically. null when there is nothing to
@@ -1171,9 +1177,13 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     // "written before anybody asked", which is the distinction the field exists for. One spawn per
     // binary per process; a probe never throws, because taking down a dispatch to record a version
     // would be a worse defect than the gap it closes.
+    // `source` says WHICH copy served (explicit / path / installed), and it is attached here, outside the
+    // probe's cache: that cache is keyed by the file, and one file can be reached by more than one route.
     const cli = (() => {
-      try { return probeCliVersion(preflightEngineBinary(process.env)?.resolved ?? null); }
-      catch (e) { return { version: null, probe: "unreadable", why: String(e?.message ?? e).slice(0, 160) }; }
+      try {
+        const pre = preflightEngineBinary(process.env);
+        return { ...probeCliVersion(pre?.resolved ?? null), source: pre?.source ?? null };
+      } catch (e) { return { version: null, probe: "unreadable", why: String(e?.message ?? e).slice(0, 160), source: null }; }
     })();
     if (modelActual) lastModelWire = modelActual;                       // — never overwritten with null
     // The comparison is by FAMILY (driver.config modelFamily), because `--model haiku` legitimately comes
@@ -1294,7 +1304,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           attempt, key, agent, model,
           modelUsed: (lastModelUsed = engine.resolveModelId ? engine.resolveModelId(model) : resolveModel(model)),
           // Same billing stamp as the attempt row, written on the same terms — see the note there.
-          engine: engine.name, writeBoundary: writeBoundaryOf(engine), authMode: auth.mode, apiBilled: auth.apiBilled === true,
+          engine: engine.name, writeBoundary: writeBoundaryOf(engine), authMode: auth.mode, apiBilled: auth.apiBilled === true, cloud: auth.cloud ?? null,
           code: rt.code, wall: rt.wall, timeoutSec: effTimeout,
           // — same rename as the attempt row above. This row already carries the driver's verdict as
           // `repairOutcome` (only "repaired" is success), so it needs no `ok`; what it lacked was any mark
@@ -1638,8 +1648,8 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         //   modelMismatch — true/false when both sides name a family, null when either does not.
         // Written even on the rows where they are null, so "this engine cannot report" stays visibly
         // different from "this record predates the gauge".
-        modelActual, modelBasis, modelSnapshot, modelMismatch,
-        cliVersion: cli.version, cliVersionProbe: cli.probe, ...(cli.why ? { cliVersionWhy: cli.why } : {}),
+        modelActual, modelBasis, modelSnapshot, modelMismatch, providerReported,
+        cliVersion: cli.version, cliVersionProbe: cli.probe, ...(cli.why ? { cliVersionWhy: cli.why } : {}), cliSource: cli.source,
         // W3 billing telemetry: which engine ran + the RESOLVED billing mode (subscription vs api-key). This
         // records INTENT (the mode the engine was configured to bill under), not independent billing evidence
         // — the actual proof is the provider console (claude's stream also reports apiKeySource; codex does
@@ -1653,7 +1663,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         // "every telemetry field is written unconditionally, so 'did not happen' stays distinguishable
         // from 'not recorded'" (instrumentation-house-rule.test.mjs). A run must be able to STATE that it
         // billed subscription, not merely fail to state that it billed API.
-        engine: engine.name, writeBoundary: writeBoundaryOf(engine), authMode: auth.mode, apiBilled: auth.apiBilled === true,
+        engine: engine.name, writeBoundary: writeBoundaryOf(engine), authMode: auth.mode, apiBilled: auth.apiBilled === true, cloud: auth.cloud ?? null,
         // build 2 — THIS attempt is the fresh dispatch bought by discarding a warm session that
         // reproduced its own failure. Exact, not cumulative: a `warmEscalatedAt > 0` test would mark
         // every later attempt too the moment the ladder is deepened, and the row would stop meaning
@@ -1695,7 +1705,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         // destroyed. `unresolved` counts selections the fold does not hold. RECORDING ONLY.
         placements: lastPlacementUnion ? { settled: lastPlacementUnion.settled, outstanding: lastPlacementUnion.outstanding,
           carried: lastPlacementUnion.carried, total: lastPlacementUnion.total, seatRows: lastPlacementUnion.seat_rows,
-          unresolved: lastPlacementUnion.unresolved, rendered: lastPlacementUnion.rendered } : undefined,
+          unresolved: lastPlacementUnion.unresolved, rendered: lastPlacementUnion.rendered, account: lastPlacementUnion.account } : undefined,
         //: how many in-dispatch form repairs THIS attempt bought (absent = none). Its own rows
         // sit immediately above with the defect each one was dispatched to fix.
         formRepairs: formRepairsThisAttempt || undefined,
@@ -1743,6 +1753,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         // null (not 0, and not absent) on an engine that cannot report them, so "this adapter does not
         // measure" stays visibly different from "this turn called no tools" — see toolGauge.
         ...toolGauge(turn), band: bandSize ?? undefined,
+        inputBytes: derivedLimit?.inputBytes ?? undefined, derivedLimitSec: derivedLimit?.sec ?? undefined,
         // AD-4 emitted-vs-landed, UNCONDITIONAL (was success-only, which made a failed attempt's mid-write
         // artifact invisible): `output` = what LANDED on disk after this attempt (null when the stage has no
         // expected file); `wrote` = whether THIS attempt emitted it (see the computation above the runDir
@@ -1776,8 +1787,8 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           event: "attempt", stage: name, attempt, of: maxRetries + 1, ok: !fail, fail: fail ?? null,
           //: the spine carries the same pair as the per-stage log, or the two disagree about what
           // ran. `model` stays the requested resolution (its existing readers); `modelActual` is the wire.
-          model: modelRequested, modelActual, modelBasis, modelSnapshot, modelMismatch,
-          cliVersion: cli.version, cliVersionProbe: cli.probe, ...(cli.why ? { cliVersionWhy: cli.why } : {}),
+          model: modelRequested, modelActual, modelBasis, modelSnapshot, modelMismatch, providerReported,
+          cliVersion: cli.version, cliVersionProbe: cli.probe, ...(cli.why ? { cliVersionWhy: cli.why } : {}), cliSource: cli.source,
           wrote, warm: warm || undefined, warmEscalated: attempt === warmEscalatedAt || undefined,
           rescued: rescued ?? undefined, killed: killed || undefined,
           quiescentMs: Number.isFinite(quiescentMs) ? Math.round(quiescentMs) : undefined,   // — see the per-stage row
@@ -1789,7 +1800,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           // archived runs actually reads, and the question "has this box ever billed API" could not be
           // answered from it because the pair was only ever on the per-stage log. Written unconditionally,
           // like everything else here: a subscription run states `false`.
-          authMode: auth.mode, apiBilled: auth.apiBilled === true,
+          authMode: auth.mode, apiBilled: auth.apiBilled === true, cloud: auth.cloud ?? null,
           //: the spine carries the POINTER and the sha, not the text — enough to find the file and
           // to tell two attempts apart without opening either.
           dispatch: dispatch?.file ?? null, dispatchSha: dispatch?.sha ?? null,
@@ -1806,6 +1817,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           wall, outputTokens: usage?.output ?? null, tokensPerSec: tokensPerSec(usage, wall),
           // — the spine carries them too, or a round has to join two files to ask why a stage was slow.
           ...toolGauge(turn), band: bandSize ?? undefined,
+        inputBytes: derivedLimit?.inputBytes ?? undefined, derivedLimitSec: derivedLimit?.sec ?? undefined,
           formRepairs: formRepairsThisAttempt || undefined,   //, see the stage row above
         });
       } catch { /* telemetry best-effort — never fail a turn over a journal line */ }
@@ -2082,7 +2094,7 @@ function refusalsInWindow(files, runDir, from, to) {
 }
 
 function rel(p) {
-  const i = p.indexOf("/prelim-search/");
+  const i = Math.max(p.indexOf("/clearance-search/"), p.indexOf("/prelim-search/"));   // either spelling of the studio segment
   return i >= 0 ? p.slice(i + 1) : p;
 }
 

package/driver/jx-lanes.mjs

@@ -183,10 +183,10 @@ export function decideJxLanes({ job, profile, searchPolicy } = {}) {
  *
  * ── THE GATE THAT WAS DECIDING, AND DECIDING OFF ────────────────────────────────────────────────────
  *
- * This function opened with `resolvedPolicy.level !== "prelim"`. `resolveSearchPolicy` now returns
+ * This function opened with `resolvedPolicy.level !== "clearance"`. `resolveSearchPolicy` now returns
  * `level` = THE PRODUCT ID for all four searches, so that leg was false on every live run and the whole
  * recommendation was dead — silently, with both callers (pipeline.mjs and runner.mjs) live and 3,754
- * driver tests green, because the one test that covered it hand-fed `{ level: "prelim" }`, a value
+ * driver tests green, because the one test that covered it hand-fed `{ level: "clearance" }`, a value
  * nothing produces any more. A retired slug does not stop deciding when it is retired; it starts
  * deciding one way.
  *
@@ -280,6 +280,25 @@ export const jxBillingStamp = (executorSource, result = null) => {
   // NO VENDOR ON THE RESULT MEANS NO DISPATCH HAPPENED. A fixture, an injected executor, or a
   // configuration the engine door refused all return without one, and none of them is provider-billed.
   // Saying so in its own words beats "unknown", which is indistinguishable from an unstamped legacy row.
-  if (executorSource !== "engine" || !result?.vendor) return { engine: "not-provider-billed", authMode: "not-provider-billed" };
-  return { engine: result.vendor, authMode: result.authMode ?? "not-provider-billed" };
+  if (executorSource !== "engine" || !result?.vendor) return { engine: "not-provider-billed", authMode: "not-provider-billed", cloud: null };
+  return { engine: result.vendor, authMode: result.authMode ?? "not-provider-billed", cloud: result.cloud ?? null };   // cloud: which account a cloud mode bills
+};
+
+// ── What a jx ledger row says about the model ─────────────────────────────────────────────────────────
+// The `model` on these rows is the id the program reported for the turn (jx-turn.mjs reads it off the
+// wire), not a tier asked for, so a row that names one also carries it as `modelActual`, the name every
+// attempt row uses for a served id. That is what the report's list of models reads; without it, a model
+// that did only this work was left off the report.
+//
+// A TURN THAT RAN AND NAMED NO MODEL STILL RAN. The Claude program answered it itself, or the stream never
+// said, or the turn was killed first: the program reports no id. Such a row used to carry neither field,
+// and every reader took a row with no `model` for a call that was never made, so the turn's attempt and
+// any tokens it reported fell out of the run's totals, and a run made only of such turns read as one where
+// nothing was looked at. It now records `modelActual: null`, the stage rows' own words for "a turn ran and
+// named no model", and tokens.mjs counts it as an attempt. Only a real dispatch writes it, by the rule
+// jxBillingStamp states: no vendor on the result means no dispatch, so a fixture, an injected executor or
+// a configuration the engine door refused writes neither field.
+export const jxModelFields = (executorSource, result = null) => {
+  if (result?.model) return { model: result.model, modelActual: result.model };
+  return jxBillingStamp(executorSource, result).engine === "not-provider-billed" ? {} : { modelActual: null };
 };

package/driver/jx-units.mjs

@@ -34,7 +34,7 @@
 import { readFileSync, writeFileSync, renameSync, appendFileSync, mkdirSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
-import { LANGUAGE_LANES, SERP_LANES, isMirrorHost, canonicalTerm, jxBillingStamp } from "./jx-lanes.mjs";
+import { LANGUAGE_LANES, SERP_LANES, isMirrorHost, canonicalTerm, jxBillingStamp, jxModelFields } from "./jx-lanes.mjs";
 import { jxKey, MAX_LANE_ATTEMPTS } from "./jx.mjs";
 import { abbrev } from "./repair-contract.mjs";
 import { kebab } from "./search-policy.mjs";
@@ -137,11 +137,14 @@ function foldRetryable(ctx, lane) {
 // spend real tokens that no per-run total ever sees (they did, until 2026-07-28).
 //
 // …and the BILLING PATH rides with them — see jxBillingStamp in jx-lanes.mjs.
+//
+// …and so does what the turn said about the model: the id it reported, or that it ran and named none —
+// see jxModelFields in jx-lanes.mjs.
 function ledgerRow(runDir, row) {
   try { appendFileSync(driverDir(runDir, "jx-completions.jsonl"), JSON.stringify(row) + "\n"); } catch { /* receipts best-effort */ }
 }
 
-const runPrefix = (run) => `prelim-${run?.slug ?? "run"}-${run?.codename ?? "local"}-`;
+const runPrefix = (run) => `clearance-${run?.slug ?? "run"}-${run?.codename ?? "local"}-`;
 
 // ── Executor chains (the resolveJxExecutor idiom: injected → CLEAROTRON_JX_FIXTURES → live) ─────────────
 export function resolveSerpExecutor(opts, { mark, lane }) {
@@ -392,7 +395,7 @@ export async function runJxSerpGrid(ctx, job, opts = {}, { runLog = () => {}, no
       ledgerRow(run.runDir, { ts: new Date().toISOString(), lane, mark: markName, unit: "serp-judge", executor: judgeSource,
         ...jxBillingStamp(judgeSource, jr),
         took_ms: jr?.tookMs ?? (Date.now() - started), ok: Boolean(jr?.ok), judged: jr?.ok ? (jr.judgments?.length ?? 0) : 0,
-        ...(jr?.model ? { model: jr.model } : {}),
+        ...jxModelFields(judgeSource, jr),
         ...(jr?.usage ? { usage: jr.usage } : {}), ...(jr?.ok ? {} : { cause: String(jr?.cause ?? "unknown").slice(0, 300) }) });
       if (!jr?.ok) { judgeDegraded = String(jr?.cause ?? "unknown").slice(0, 200); break; }
       const byId = new Map(jr.judgments.map((j) => [j.id, j]));
@@ -524,7 +527,7 @@ export async function runJxNativeread(ctx, job, opts = {}, { runLog = () => {},
     ledgerRow(run.runDir, { ts: new Date().toISOString(), lane, mark: markName, unit: "nativeread", executor: source,
       ...jxBillingStamp(source, r),
       took_ms: r?.tookMs ?? (Date.now() - started), ok: Boolean(r?.ok), items: r?.ok ? (r.items?.length ?? 0) : 0,
-      ...(r?.model ? { model: r.model } : {}),
+      ...jxModelFields(source, r),
       ...(r?.usage ? { usage: r.usage } : {}), ...(r?.ok ? {} : { cause: String(r?.cause ?? "unknown").slice(0, 300) }) });
     if (!r?.ok) {
       degradeUnit(run.runDir, key, st.attempts, r?.cause ?? "unknown");

package/driver/jx.mjs

@@ -14,7 +14,7 @@
 import { readFileSync, writeFileSync, renameSync, appendFileSync } from "node:fs";
 import { join } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
-import { decideJxLanes, candidateRefusal, canonicalTerm, romanizationSpellings, LANGUAGE_LANES, jxBillingStamp } from "./jx-lanes.mjs";
+import { decideJxLanes, candidateRefusal, canonicalTerm, romanizationSpellings, LANGUAGE_LANES, jxBillingStamp, jxModelFields } from "./jx-lanes.mjs";
 import { cnipaSubgroupsForClasses, cnipaEditionLabel } from "./jx-subclass.mjs";   // — replaces the hand-written seed table
 import { kebab } from "./search-policy.mjs";
 import { JX_PROVIDERS } from "./driver.config.mjs";
@@ -186,6 +186,13 @@ export function deriveJxSliceStatement({ sidecar, units = null, env = process.en
 //
 // PURE. Takes the parsed sidecar and the slice statement `deriveJxSliceStatement` just produced.
 export function deriveLaneDepthVerdicts({ sidecar, slices } = {}) {
+  // EITHER SHAPE, AND THAT IS NOT POLITENESS. This reads `slices.candidates`, and the publish path handed
+  // it `deriveJxSliceStatement`'s whole return — `{executes, slices}` — so the lookup found nothing and
+  // every lane reported `ran: null` whatever it had done. Nothing threw and nothing was logged: the
+  // failure arrived as a delivered client report saying a search had not run when it had. The two shapes
+  // are told apart with certainty rather than guessed at — a statement carries a `slices` object and a
+  // slice map carries slice names — so a caller cannot pass the wrong one and be quietly misread.
+  const bySlice = slices?.slices && typeof slices.slices === "object" ? slices.slices : slices;
   const declared = sidecar?.lanes ?? {};
   const out = {};
   for (const lane of Object.keys(declared)) {
@@ -194,10 +201,10 @@ export function deriveLaneDepthVerdicts({ sidecar, slices } = {}) {
     // lane that gains a slice later is covered without this function being edited — and so a lane that
     // has none is a measured fact rather than a hardcoded assumption about ja/ko.
     const deep = JX_SLICES.filter((s) => s.slice > 1 && s.lane === lane);
-    const deepStates = deep.map((s) => ({ name: s.name, state: slices?.[s.name]?.state ?? null, why: slices?.[s.name]?.why ?? null }));
+    const deepStates = deep.map((s) => ({ name: s.name, state: bySlice?.[s.name]?.state ?? null, why: bySlice?.[s.name]?.why ?? null }));
     const deepRan = deepStates.filter((d) => d.state === "ran").map((d) => d.name);
     // Slice 1 is the multi-lane one: its per-lane state lives in `.lanes`, never in a scalar `.state`.
-    const candidatesState = slices?.candidates?.lanes?.[lane] ?? null;
+    const candidatesState = bySlice?.candidates?.lanes?.[lane] ?? null;
 
     const ran = deepRan.length ? "full" : candidatesState === "ran" ? "candidates" : null;
     const shortfall = asked === "full" && ran !== "full";
@@ -225,6 +232,27 @@ export function deriveLaneDepthVerdicts({ sidecar, slices } = {}) {
   return out;
 }
 
+/**
+ * THE VERDICT A PUBLISHED REPORT SHOULD CARRY: the one the RUN stated, not a fresh one. PURE.
+ *
+ * `stateJxFold` writes `fold.depth` at delivery, derived from this run's own environment — which is the
+ * reason the seam exists: the arms are environment, so a verdict derived on some later box speaks for
+ * that box and not for the run. Publishing derived its own, and the two disagreed on a delivered client
+ * report: the run said the ja lane ran as a candidate lane, the publisher said no lane ran, and the page
+ * printed "Not run this run" over a search that had happened.
+ *
+ * Deriving stays, for a run delivered before the stamp existed — an old artifact still gets the best
+ * answer its record supports, rather than none.
+ *
+ * @param {object|null} sidecar  parsed _driver/jx-lanes.json
+ * @param {object|null} units    parsed _driver/jx/units.json, or null
+ */
+export function laneDepthOfRun({ sidecar, units = null, env = process.env } = {}) {
+  const stamped = sidecar?.fold?.depth;
+  if (stamped && typeof stamped === "object" && !Array.isArray(stamped)) return stamped;
+  return deriveLaneDepthVerdicts({ sidecar, slices: deriveJxSliceStatement({ sidecar, units, env }) });
+}
+
 const flag = (name) => ["1", "true", "yes", "on"].includes(String(process.env[name] ?? "").trim().toLowerCase());
 // — the private copy is gone; laneArmed (driver.config.mjs) is the one reader.
 
@@ -512,7 +540,9 @@ export async function runJxCandidateFold(ctx, job, opts = {}, { runLog = () => {
       const row = { ts: new Date().toISOString(), lane, mark: markName, executor: source, ...jxBillingStamp(source, r),
         took_ms: r?.tookMs ?? (Date.now() - started), ok: Boolean(r?.ok),
         candidates: r?.ok ? (r.candidates?.length ?? 0) : 0,
-        ...(r?.model ? { model: r.model } : {}),
+        // the model the turn reported, as `model` and `modelActual`, or `modelActual: null` for a turn
+        // that ran and named none — see jxModelFields.
+        ...jxModelFields(source, r),
         ...(r?.usage ? { usage: r.usage } : {}), ...(r?.ok ? {} : { cause: String(r?.cause ?? "unknown").slice(0, 300) }) };
       try { appendFileSync(ledgerPath, JSON.stringify(row) + "\n"); } catch { /* receipts best-effort */ }
       // Before the degraded-lane `continue` below: a lane that FAILED still ran a turn, and the model

package/driver/knockout-review-record.mjs

@@ -43,6 +43,9 @@ import { captureCall, stampVerdict } from "./call-capture.mjs";
 import { refuseUndeclared as refuseUndeclaredShared, lastAccepted, acceptedEnvelope } from "./preserve-merge.mjs";
 import { knockoutVisibleProse } from "./predelivery-lint.mjs";   // the walk is the authority on what a reader sees
 import { plainRegisterFlags } from "./plain-register.mjs";        // the pinned rule, one copy
+// THE HINT'S fold, and it is imported rather than rebuilt — see nearestAddress. It is a comparison key
+// for saying WHICH line was probably meant; it never decides whether an address resolves.
+import { queryKey } from "./connotation-search.mjs";
 
 const SCHEMA_VERSION = 1;
 
@@ -142,6 +145,42 @@ export function addressKey(at) {
   return [a.field, a.mark ?? "", a.index ?? "", a.ordinal ?? ""].join(ADDRESS_SEP);
 }
 
+/**
+ * THE ADDRESS A SEAT PROBABLY MEANT, FOR THE REFUSAL TO NAME — and for nothing else.
+ *
+ * The lookup above stays EXACT and that is a ruling, not an oversight (owner, 2026-09-16). Punctuation
+ * can be part of a mark's identity, so two marks differing by an apostrophe form are not assumed to be
+ * one mark and a rewrite is never applied by analogy. What was wrong was the refusal, not the matching:
+ * a seat that re-typed a name with a right single quotation mark where the record has an apostrophe was
+ * told its rewrite "names no line on this record", which describes the record rather than the difference,
+ * and the rewrite was dropped with nobody able to see why. One character, invisible in most fonts.
+ *
+ * So this names the nearest and changes nothing. It folds ONLY typographic form — `queryKey`, the same
+ * key the meaning gate was folded onto after a production clearance stopped on exactly this character —
+ * and it is imported rather than copied, because two private folds are how the two gates drift apart.
+ * That key deliberately does not fold accents, so it cannot quietly propose that Café and Cafe are the
+ * same mark.
+ *
+ * It requires an EXACT match on every other part of the address — field, index, ordinal — so the hint is
+ * always the same line of the same record, differing only in how the mark's name was typed. A candidate
+ * whose mark is byte-identical is not a hint: the caller only asks when the exact lookup already failed,
+ * and pointing at the address that was just refused would say nothing.
+ *
+ * @returns {object|null} the address on this record, or null when nothing differs by form alone
+ */
+export function nearestAddress(at, knownAts) {
+  const want = at ?? {};
+  if (want.mark == null) return null;   // no name to have mistyped
+  const same = (a, b) => (a ?? "") === (b ?? "");
+  for (const k of knownAts ?? []) {
+    if (!k || k.field !== want.field) continue;
+    if (!same(k.index, want.index) || !same(k.ordinal, want.ordinal)) continue;
+    const kn = String(k.mark ?? ""), wn = String(want.mark ?? "");
+    if (kn !== wn && queryKey(kn) === queryKey(wn)) return k;
+  }
+  return null;
+}
+
 /** Is this a well-formed address for a field the pass may reach? The reason, or null. */
 export function addressFault(at) {
   if (!at || typeof at !== "object" || Array.isArray(at)) return "an address must be an object";
@@ -296,15 +335,21 @@ export function validateKnockoutReviewFile(file, text) {
   try { merged = JSON.parse(readFileSync(findingsFile, "utf8")); }
   catch (e) { return { ok: false, reason: `the merged record will not parse, so no address could be checked: ${e.message}` }; }
 
-  const known = new Set(knockoutVisibleProse(merged).map((v) => addressKey(v.at)));
+  const knownAts = knockoutVisibleProse(merged).map((v) => v.at);
+  const known = new Set(knownAts.map((a) => addressKey(a)));
   const owned = new Set(knockoutVisibleProse(merged).filter((v) => v.at?.engineOwned).map((v) => addressKey(v.at)));
+  // Appended to a refusal, never consulted before one: the address still has to match exactly.
+  const hint = (at) => {
+    const n = nearestAddress(at, knownAts);
+    return n ? ` — this record carries "${n.mark}" at that line, which differs from "${at.mark}" only in how it is typed; the two are not assumed to be the same mark, so re-send the rewrite naming the record's spelling` : "";
+  };
   for (const r of doc.rewrites ?? []) {
     const key = addressKey(r.at);
     if (owned.has(key)) return { ok: false, reason: `the rewrite for ${r.at.field} names a caveat the engine wrote, not a seat — it is not offered and cannot be changed` };
-    if (!known.has(key)) return { ok: false, reason: `the rewrite for ${r.at.field}${r.at.mark ? ` on "${r.at.mark}"` : ""} names no line on this record` };
+    if (!known.has(key)) return { ok: false, reason: `the rewrite for ${r.at.field}${r.at.mark ? ` on "${r.at.mark}"` : ""} names no line on this record${hint(r.at)}` };
   }
   for (const d of doc.declined ?? []) {
-    if (!known.has(addressKey(d.at))) return { ok: false, reason: `the declined row for ${d.at.field}${d.at.mark ? ` on "${d.at.mark}"` : ""} names no line on this record` };
+    if (!known.has(addressKey(d.at))) return { ok: false, reason: `the declined row for ${d.at.field}${d.at.mark ? ` on "${d.at.mark}"` : ""} names no line on this record${hint(d.at)}` };
   }
   return { ok: true };
 }
@@ -340,7 +385,14 @@ export function applyKnockoutReview(merged, review) {
   for (const r of review?.rewrites ?? []) {
     const key = addressKey(r.at);
     const seen = byKey.get(key);
-    if (!seen) { unresolved.push({ at: r.at, why: "no such line on this record" }); continue; }
+    if (!seen) {
+      // Same hint as the validator's, for the same reason: the apply path is reached on a record this
+      // pass did not validate, and an unresolved row that cannot say WHY is the state that cost a
+      // rewrite silently. It still changes nothing — `unresolved` is a report.
+      const near = nearestAddress(r.at, [...byKey.values()].map((v) => v.at));
+      unresolved.push({ at: r.at, why: near ? `no such line on this record — it carries "${near.mark}" there, differing from "${r.at.mark}" only in how it is typed` : "no such line on this record" });
+      continue;
+    }
     if (seen.at?.engineOwned) { refused.push({ at: r.at, why: "the engine wrote this caveat, not a seat" }); continue; }
     const at = r.at, text = String(r.text);
     // THE WALK IS THE BOUNDS CHECK. `seen` came from this same record, so a resolved address names a

package/driver/known-conflicts.mjs

@@ -8,7 +8,7 @@
 // (copper-causeway could not see teal-conduit's VENERET: different noref slugs for the same VENZY).
 // The store therefore lives one level up, keyed by the MARK:
 //
-//     <studioRoot>/_known-conflicts/<kebab(mark)>.json     (studioRoot = workspace-<agent>/studio/prelim-search)
+//     <studioRoot>/_known-conflicts/<kebab(mark)>.json     (studioRoot = workspace-<agent>/studio/clearance-search)
 //
 // One file per searched mark name; workspace-per-agent keeps customers separated. Each file keeps the
 // EXACT inner shape the tripwire already reads ({schema_version, marks:{"<mark key>":[rows]}}), so

package/driver/matter-frame-record.mjs

@@ -141,6 +141,16 @@ export function renderMatterFrame(model) {
   // is owed against — so the frame states it where a reader can see it rather than only in a field.
   if ((model.ratified_forms ?? []).length > 1)
     out.push(`- **Ratified forms:** ${model.ratified_forms.join(", ")}`);
+  // THE EXCLUSION IS EVIDENCED ON THE DOCUMENT A READER SEES, and it is stated as a PROPOSAL because
+  // that is what it is at this point in the run. A reader meeting "excluded" here would believe the
+  // search was narrowed on the frame's authority; the driver's verification has not run yet, and if it
+  // cannot confirm the client's ownership the element is searched in full and this line is the only
+  // place the question was ever raised.
+  if (model.house_element_candidate)
+    out.push(`- **Client's own element, proposed for exclusion:** ${model.house_element_candidate.element}`
+      + ` — the analysis would be limited to ${model.house_element_candidate.remainder}.`
+      + ` Basis: ${model.house_element_candidate.owner_basis}.`
+      + " Excluded only if the driver confirms the client's own registrations on the register; otherwise searched in full.");
   out.push("");
 
   // `Search channels:` — domains only; the grid site-restricts to them and the general web is always
@@ -172,9 +182,10 @@ export function renderMatterFrame(model) {
  */
 /** The shape this tool declares, at every depth — what the ACCEPTOR enforces. */
 const DECLARED = Object.freeze({
-  "": ["prose_body", "scope_basis", "scope_jurisdictions", "excluded_jurisdictions", "search_channels", "meaning_angles", "meaning_angles_none", "intake_asks", "identified_classes", "ratified_forms"],
+  "": ["prose_body", "scope_basis", "scope_jurisdictions", "excluded_jurisdictions", "search_channels", "meaning_angles", "meaning_angles_none", "intake_asks", "identified_classes", "ratified_forms", "house_element_candidate"],
   intake_asks: ["ask", "owner"],
   identified_classes: ["class", "reason"],
+  house_element_candidate: ["element", "remainder", "owner_basis"],
 });
 
 /** Refuse an undeclared key by path, at depth. Shared walk; the table above is what is this tool's. */
@@ -218,6 +229,26 @@ export function frameRatifiedForms(runDir) {
   return (Array.isArray(rows) ? rows : []).map((r) => String(r ?? "").trim()).filter(Boolean);
 }
 
+/**
+ * The house element this run's frame PROPOSED, or null. IMPURE (reads the run's own accepted call).
+ *
+ * A PROPOSAL, AND THE CALLER MUST TREAT IT AS ONE. Nothing here has been checked against the register:
+ * the frame runs before the plan, holds no band tool, and is reporting how it reads the matter. The
+ * caller verifies ownership by owner-scoped lookup and writes its own receipt; the plan excludes on
+ * that receipt. A caller that excluded on this return would be dropping an element from the search on a
+ * model's say-so, which is the one direction that reaches a client as a clean answer over unswept
+ * ground rather than as a visible failure.
+ *
+ * Null on every archived and replayed run whose accepted call predates the field, so none of them moves.
+ */
+export function frameHouseElementCandidate(runDir) {
+  const h = lastAcceptedMatterFrame(runDir)?.house_element_candidate;
+  const element = String(h?.element ?? "").trim();
+  const remainder = String(h?.remainder ?? "").trim();
+  if (!element || !remainder) return null;
+  return { element, remainder, owner_basis: String(h?.owner_basis ?? "").trim() };
+}
+
 /** The last ACCEPTED call for this run, or null. */
 export function lastAcceptedMatterFrame(runDir) {
   return lastAccepted(matterFrameCallPaths(String(runDir ?? "")).accepted, readFileSync);
@@ -252,6 +283,15 @@ export function mergeMatterFrameCall(stored, received) {
     // omission here is a repair that did not mention them, never a decision to withdraw them.
     identified_classes: keepIfAbsent(received?.identified_classes, base.identified_classes),
     ratified_forms: keepIfAbsent(received?.ratified_forms, base.ratified_forms),
+    // KEEP-IF-ABSENT, and the direction of its failure is the OPPOSITE of the two above — which is
+    // worth saying, because the reasoning that protects them does not transfer and a reader who assumed
+    // it did would mis-rank this key. Dropping the identified classes NARROWS the next compile, towards
+    // missing rights. Dropping this one WIDENS it: the house element goes back to being searched as a
+    // conflict axis, which is the band this field exists to shrink, so a partial call that lost it costs
+    // a slower run and the report's one sentence explaining what was excluded and why — never coverage.
+    // It is kept because a repair turn that did not mention the element is not a withdrawal of it, which
+    // is the same rule, reached by a different road.
+    house_element_candidate: keepIfAbsent(received?.house_element_candidate, base.house_element_candidate),
   };
 }
 
@@ -346,6 +386,54 @@ export function acceptMatterFrame(params, { instructedScope = null } = {}) {
     ratified_forms.push(form);
   }
 
+  // ── THE CLIENT'S OWN HOUSE ELEMENT — A CANDIDATE, NEVER A DECISION ───────────────────────────────
+  //
+  // THE DEFECT (production run, 2026-09-16). The mark was the client's own famous house mark followed by
+  // a tagline, and the plan treated the house element as a conflict axis: exact, variants, one-letter
+  // mutations, transliterations, incumbent checks. Over half the band came from that element. The
+  // reviewing lawyer's method for the same matter was three queries — the whole phrase, the shorter
+  // phrase, the last word alone — because an element the client already owns outright is not what the
+  // analysis is about. The engine planned thirty-six.
+  //
+  // WHY THE FIELD IS NAMED `candidate`, AND WHY THE NAME IS LOAD-BEARING. This frame CANNOT verify
+  // ownership: `BAND_READING_STAGES` is placement-inquiry, register-digest and synthesis, and the band
+  // does not exist yet when the frame runs. So everything here is the seat's reading of the matter, and
+  // an exclusion taken on a seat's say-so is an unsearched element justified by an assertion — a clean
+  // report over ground nobody swept, which is the one failure that reaches a client as a wrong answer
+  // rather than as no answer. The driver verifies against the register by owner and writes the receipt;
+  // the plan excludes on the RECEIPT and never on this field. Requirement 4 ("when the frame cannot
+  // verify, it does not exclude, and says so") is then the write order rather than a branch someone has
+  // to remember: no receipt, no exclusion.
+  //
+  // TYPED RATHER THAN PARSED, for the reason `identified_classes` gives and measures: a list derived
+  // from judgment prose dropped the primary entry in 19 of 21 runs.
+  let house_element_candidate = null;
+  if (params?.house_element_candidate !== undefined && params?.house_element_candidate !== null) {
+    const h = params.house_element_candidate;
+    const element = str(h?.element), remainder = str(h?.remainder), owner_basis = str(h?.owner_basis);
+    if (!element)
+      return { ok: false, reason: "matterframe_house_element_empty: name the element of the mark the client already owns, or omit the field entirely — a blank row is not an answer" };
+    if (!owner_basis)
+      return { ok: false, reason: `matterframe_house_element_basis_missing:${element} — say why you read this as the client's own registered element. It is not taken on your word (the driver verifies it against the register by owner), but the reader of the report is owed the ground, and an unverifiable basis is how a wrong exclusion would be argued for` };
+    // ── THE FLOOR, AND IT IS ON THE POPULATION RATHER THAN ON THE RULE ────────────────────────────
+    //
+    // The catastrophic direction here is naming too MUCH as the house element: mark "ACME WIDGETS",
+    // element "ACME WIDGETS", remainder nothing — and the plan becomes three queries that do not exist.
+    // Ownership can verify perfectly in that case, so requirement 4 does not catch it and no refusal
+    // downstream would either: "queries on the house element: 0" is satisfied by a plan with no queries
+    // at all. So the remainder is checked for being something a search can be built on, here, where the
+    // claim is made.
+    if (!remainder)
+      return { ok: false, reason: `matterframe_house_element_no_remainder:${element} — excluding it would leave nothing to search. The remainder is what the analysis is about; if the mark IS the client's own element with nothing distinctive after it, there is no exclusion to make and the field is omitted` };
+    if (remainder.toLowerCase() === element.toLowerCase())
+      return { ok: false, reason: `matterframe_house_element_remainder_same:${element} — the remainder must be the part of the mark that is NOT the house element` };
+    // The whole mark cannot be the house element by another spelling: an element that swallows the
+    // remainder leaves the same empty plan, arriving as two fields that merely look different.
+    if (element.toLowerCase().includes(remainder.toLowerCase()))
+      return { ok: false, reason: `matterframe_house_element_swallows_remainder:${element} — the element you named contains the remainder, so excluding it excludes the whole mark` };
+    house_element_candidate = { element, remainder, owner_basis };
+  }
+
   const model = {
     schema_version: SCHEMA_VERSION,
     instructed_scope: instructedScope ?? null,
@@ -358,6 +446,7 @@ export function acceptMatterFrame(params, { instructedScope = null } = {}) {
     intake_asks,
     identified_classes,
     ratified_forms,
+    house_element_candidate,
   };
   return { ok: true, model, content: renderMatterFrame(model) };
 }

package/driver/named-band.mjs

@@ -137,7 +137,7 @@ export function parseNamedBand(raw) {
         // byte-identical to a slice the plan deliberately counted without fetching. Measured on a real
         // run: four capability-gap blocks carried `error:true, deferred:true` into this function and
         // reached record-carry.json with both fields gone and a sentence claiming the run "has a hit
-        // COUNT for this slice". register-plan.mjs:1439 validatePlanFeasibility already enforces the same rule one layer up
+        // COUNT for this slice". register-plan.mjs:1594 validatePlanFeasibility already enforces the same rule one layer up
         // ("a transient must not ship indistinguishable from a sanctioned descriptor") — it reads the
         // RAW blocks, which is why it could. Every consumer that reads THIS projection could not.
         // Conditional like the four keys above, so old bands carry neither key and nothing shifts.