clearotron 0.3.2-beta.7 → 0.3.2-beta.9

package/driver/pipeline.mjs

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
-// pipeline.mjs — the deterministic driver: sequences every prelim-search stage as a blocking engine
+// pipeline.mjs — the deterministic driver: sequences every clearance-search stage as a blocking engine
 // turn, joins the fan-out in code (the fan-in barrier), gates on the refutation
 // verdict, and never parks (there is no LLM continuation decision anywhere). CLI: `node pipeline.mjs --job <file.json>`.
 
@@ -10,7 +10,7 @@ import { readFileSync, existsSync, mkdirSync, writeFileSync, renameSync, copyFil
 import { createHash } from "node:crypto";
 import { join, dirname, basename, resolve } from "node:path";   // resolve: the resume line must work from any cwd
 import { driverDir, driverRel, ensureDriverDir } from "../shared/driver-dir.mjs";   // — one definition of where `_driver/` is
-import { terminalClampDecision, orderClausesForLede, clientConditions } from "./terminal-clamp.mjs";   // — deliver and clamp, never withhold
+import { terminalClampDecision, orderClausesForLede, clientConditions, clauseForDefect } from "./terminal-clamp.mjs";   // — deliver and clamp, never withhold
 import { recordSpan } from "./attributed-span.mjs";   // — driver work the decomposition can attribute
 import { fileURLToPath } from "node:url";
 import { runStage, correctionHint, gridLedgerNameFor, draftCarryEligible, toolWrittenArtifact, selectEngine } from "./gateway.mjs";
@@ -31,7 +31,7 @@ import { buildRunContext, deriveSlug, kebab } from "./phase0.mjs";
 import { paths, STAGES, axisTier, decideAxes, assertTierSanity, assertEffectiveTier, lines, AGENT_WHATSAPP, whatsappRouting,
   chainEntries, stageOrdinal, stageInputs, stageOutputs, dependencyOrder, REGISTER_AXES, REGISTER_ENUMERATE_TOOL,
   buildEscalationFollowup, buildEnvelopeCloseFollowup, buildFrameReopenFollowup,
-  buildFrameReopenRetryMessage, thinkingFor, composeFollowup, stampDispatchBlocks, recordEmptyReturn, nothingFound, nothingToRead, PROVIDER_META, proseRungDirective, inquiryRungDirective } from "./stages.mjs"; import { bandSizeForStage } from "./band-size.mjs";
+  buildFrameReopenRetryMessage, thinkingFor, composeFollowup, stampDispatchBlocks, recordEmptyReturn, nothingFound, nothingToRead, PROVIDER_META, proseRungDirective, inquiryRungDirective } from "./stages.mjs"; import { bandSizeForStage, derivedLimitSec, limitExceedsCeiling, ceilingRefusal } from "./band-size.mjs";
 import { IDENTITY_FILE as REPORT_IDENTITY_FILE } from "./report-overview-record.mjs";
 import { dispatchRows, clearedSignatures } from "./seat-attempts.mjs";
 import { CONTEXT_DERIVATIONS, DISPATCH_EXTRAS, INLINE_CONTEXT, sandboxManifest, sandboxGaps, derivationsFor } from "./stage-context.mjs";   // — what a stage is actually handed
@@ -45,7 +45,8 @@ import { readRegisterTaint, readActiveTaintAxes } from "./register-taint.mjs";
 import { parseNamedBand, mergeNamedBands, findCollapsedBands, quarantineUnknownStates, taintQuarantineCleanBlocks, bandRecords } from "./named-band.mjs";
 import { recordOriginsFor } from "./record-origins.mjs";
 import { REGISTER_PROVIDER } from "./driver.config.mjs";
-import { FACTS_FILE as DIGEST_FACTS_FILE, ACCOUNTING_STAMP as DIGEST_ACCOUNTING_STAMP, recordedFindingUris } from "./register-digest-record.mjs";   // conversion 11 — the render's facts sidecar and the accounting era stamp
+import { FACTS_FILE as DIGEST_FACTS_FILE, ACCOUNTING_STAMP as DIGEST_ACCOUNTING_STAMP, recordedFindingUris,
+  digestAccountingGap, digestBatchBrief, batchesOf } from "./register-digest-record.mjs";   // conversion 11 — the render's facts sidecar and the accounting era stamp
 import { buildBandShape, dominantElementComposites, deriveRegisterPositions, floorTierByMark, floorMarkKey } from "./band-shape.mjs";   // PR-8 — the deterministic reading layer; P2-A — candidates + positions
 import { deriveOwnerScreen, ownerScreenNegative } from "./owner-screen.mjs";   // P2-B — the owner×element screen's own receipt
 import { reconcileRecall, parseFindingsEndings, parseCrowdRulings, readOkRecordUris,
@@ -79,7 +80,7 @@ import { resolveSearchPolicy, gateResolvedPolicy, loadRecipes, policyFor, isRegi
 import { profileOrdinals } from "./profile-selection.mjs";   // lever 3 — driver selection
 // THE OFFERING'S own sentence about where the native-language investigation can be bought. It reaches a
 // CLIENT REPORT through the script-scope coverage row, which is why it is imported rather than typed:
-// the row used to name "Depth 5 (prelim-jx)" — a retired key on a retired ladder — as its remedy.
+// the row used to name "Depth 5 (clearance-jx)" — a retired key on a retired ladder — as its remedy.
 import { NATIVE_LANGUAGE_REMEDY } from "./products.mjs";
 import { resolveTerritories, defaultTerritoryState } from "./effective-scope.mjs";   // the ONE territory ladder (the geography stamp included) + the stored-defaults reading
 import { acquireSlot, releaseSlot } from "./slot-lock.mjs";
@@ -96,8 +97,10 @@ import { publishReport, composeEmailHtml, deliverySubject } from "./publish/inde
 import { parseCaseLawProfiles, joinCaseLawProfiles } from "./publish/parse.mjs";
 import { buildAuditMd, parseSpineFindingBlocks } from "./publish/audit-from-spine.mjs";
 import { deriveRegisterPresence } from "./publish/register-presence.mjs";   // — the audit stores every live in-scope record
-import { lastAcceptedMatterFrame, frameIdentifiedClasses } from "./matter-frame-record.mjs";   // — the frame's inferred scope, when nothing was instructed; and the classes it judged necessary beyond the instructed ones, which the plan compile unions in
-import { romanizedTermsFromPlan, mintSupplementalQid } from "./register-plan.mjs";   // — the stamp the late lanes never met
+import { lastAcceptedMatterFrame, frameIdentifiedClasses, frameHouseElementCandidate } from "./matter-frame-record.mjs";   // — the frame's inferred scope, when nothing was instructed; and the classes it judged necessary beyond the instructed ones, which the plan compile unions in
+import { romanizedTermsFromPlan, mintSupplementalQid } from "./register-plan.mjs";
+import { excludeHouseElement, verifyHouseElementOwnership, resolveRegions as resolvePlanRegions, HOUSE_ELEMENT_RECEIPT } from "./register-plan.mjs";   // 647 — the client's own element leaves the conflict analysis only on a verified receipt
+import { resolveRecordExecutor } from "./register-records.mjs";   // — the stamp the late lanes never met
 import { slimLine, crowdLine } from "./hit-list.mjs";   // — the list the run works from; crowds ride it as a sibling array
 import { mintCrossCheckDoubts, mintContradictionDoubts, stitchDoubts, applyClosure } from "./doubt-ledger.mjs";   // doubt-stitch + doubt-closure (2026-07-22)
 // Conversion 6: the two line-form parsers are no longer on the live path — the seat sends typed
@@ -167,10 +170,10 @@ import { JURISDICTION_ADAPTERS, LANGUAGE_LANES, scopeJurisdictions as jxScopeJur
 // into boundDominantElementFrom, so the driver's bind and the record tool's bind are ONE body. Neither
 // parseBlindFrameModel nor dominantElementFromManifest is called from this file any more.
 import { boundDominantElementFrom } from "./frame-diff-record.mjs";
-import { recordedScopeLedgerRows } from "./prelim-variants-record.mjs";
+import { recordedScopeLedgerRows } from "./clearance-variants-record.mjs";
 import { parseFrameDiff, applyDominantBackstop, firingDirectives, reopenKey, alreadyAttemptedReopen, partitionFiring, frameResidualGaps, jurisdictionScopeFlags, deriveDirectiveRemedy, firingDirectivesLenient } from "./frame-diff-model.mjs";
 import { verifyRegisterDirectiveClose } from "./close-verify.mjs";
-import { renderFormNeighbourhoodJson, parseFormNeighbourhoodJson, dispatchedQueriesFromBand, formGapDirectives, markText } from "./form-neighbourhood.mjs";
+import { renderFormNeighbourhoodJson, parseFormNeighbourhoodJson, dispatchedQueriesFromBand, formGapDirectives, markText } from "./form-neighbourhood.mjs"; import { loadOrdinaryWords } from "./ordinary-words.mjs";
 import { findRecallFloorViolations, findReviewFreshnessViolation, findSeedNeutralityViolations, findProbativeGradingViolations, findStatusHonestyViolation, findMatrixCeilingViolations, findDeadlineUrgencyMiss, findUnresolvedDisagreements, findOrphanVerificationFlags, findUncrossCheckedDemotions, findRecallRegressionViolations, findDeadlineCarryViolations, formatRecallRegression } from "./reasoning-tripwires.mjs";
 import { findRuleShapeFlags } from "./rule-shape.mjs";
 import { failureSignature, classifyFailureReason, decideRecovery, createRepairLedger, countTrailingStageStrikes, countRecoveryLanes, weatherCeilingFor, TRANSIENT_RE, REFUSAL_TERMINAL_KIND, fanInMissingEvidence, retryCannotHelpWith, unnamedStructuredFailure, classificationSource, isCapPark, capParkSchedule, capWaitFrom, humanWait } from "./repairs.mjs";
@@ -936,7 +939,7 @@ function deriveGridSpec(ctx) {
   // 2026-08-11 codex R2 run (no grid spec authored at all), and it is the branch that emits NO event
   // today, which is why absence was the only signal and absence is not a record.
   // The three inputs are recorded, not just their verdict. Working hit exactly this wall: the
-  // 2026-08-11 run authored no spec, `prelim-variants` had succeeded, and WHICH of the three conjuncts
+  // 2026-08-11 run authored no spec, `clearance-variants` had succeeded, and WHICH of the three conjuncts
   // was false could not be recovered from any artifact — so the round could name the path but not the
   // cause. A record that says "no spec" and not "no spec BECAUSE the profile carried no platforms" just
   // moves the same unanswerable question one step along.
@@ -1717,7 +1720,7 @@ export function attachSearchPolicy(ctx, job, { write = true } = {}) {   // @inte
     // a clearance (review 2026-07-17 — the crash-reclaim/reconstruct window).
     if (!noSelector)
       throw new Error(`run dir has no frozen search policy but the job names a selector (product=${JSON.stringify(job?.product ?? null)}, recipeKey=${JSON.stringify(job?.recipeKey ?? null)}) — refusing the legacy-implicit clearotron assumption; re-dispatch cold so the policy is minted`);
-    ctx.searchPolicy = { schema: 1, level: "prelim", pipeline: "clearance", stageLabel: "Depth 4", components: {}, recipe: null, origins: { level: "legacy-implicit" } };
+    ctx.searchPolicy = { schema: 1, level: "clearance", pipeline: "clearance", stageLabel: "Depth 4", components: {}, recipe: null, origins: { level: "legacy-implicit" } };
   } else {
     let resolved;
     // force:true — the recipe store is written by a LIVE service; a long-lived driver process must see a
@@ -1902,7 +1905,7 @@ function renderDocumentCoverageFromRecords(ctx, trigger) {
     // The set the GATES consume, not `_records/` alone: a run whose bodies live only in the ledger would
     // otherwise be described as one that fetched nothing — the defect this renders against, re-created by
     // reading a narrower artifact than the one that holds the answer.
-    const { records } = assembleRunRecords(P.runDir, `prelim-${ctx.run.slug}-${ctx.run.codename}-`);
+    const { records } = assembleRunRecords(P.runDir, `clearance-${ctx.run.slug}-${ctx.run.codename}-`);
     const summary = documentCoverage({ records, findings: safeReadJson(P.findings) });
     const section = renderDocumentCoverageSection(summary);
     if (!section) return;
@@ -2100,7 +2103,7 @@ function deriveCoverageLedgerJson(ctx, trigger) {
   }
 }
 
-// Frame-omission design — CODE-DERIVE scope-ledger.json from the validated prelim-variants prose
+// Frame-omission design — CODE-DERIVE scope-ledger.json from the validated clearance-variants prose
 // `### Scope ledger` table (so the JSON is authored by the driver, not the model, and matches the prose
 // by construction — exactly the deriveCoverageLedgerJson pattern). NEVER-KILL: a manifest with no/unparseable
 // Scope ledger (legacy artifacts, a terse run) logs a note and skips the write; the frame-diff then reads the
@@ -2129,7 +2132,7 @@ function deriveScopeLedgerJson(ctx) {
     // are different facts about a run, and a reader of an archived ledger must be able to tell which.
     runLog(P.runDir, { event: "scope-ledger-derived", source: recordedRows ? "typed-call" : "prose-parse" });
   } catch (e) {
-    note(`prelim-variants: scope-ledger derivation skipped (${String(e.message).slice(0, 100)}) — frame-diff reads the manifest prose`);
+    note(`clearance-variants: scope-ledger derivation skipped (${String(e.message).slice(0, 100)}) — frame-diff reads the manifest prose`);
     runLog(P.runDir, { event: "scope-ledger-skipped", reason: `derive_failed:${String(e.message).slice(0, 80)}` });
   }
 }
@@ -2176,14 +2179,14 @@ function deriveFormNeighbourhood(ctx) {
     // The MARK is the floor's fallback seed and the only input to it that is not model output —
     // resolved exactly as every other job-mark consumer resolves it (stages.mjs blind-frame).
     const mark = ctx.job.marks ?? ctx.job.markName ?? ctx.job.name ?? "";
-    const json = renderFormNeighbourhoodJson(manifestMd, { markets, droppedAxes, model, mark });
+    const ow = loadOrdinaryWords("en"), json = renderFormNeighbourhoodJson(manifestMd, { markets, droppedAxes, model, mark, ordinaryWords: ow.words });   // an unloadable word list removes nothing
     const tmp = P.formNeighbourhood + ".tmp";
     writeFileSync(tmp, json);
     renameSync(tmp, P.formNeighbourhood);
-    let exact = 0, floor = 0, added = 0, seededFrom = "", seeds = [];
+    let exact = 0, floor = 0, added = 0, seededFrom = "", seeds = [], notSearched = 0;
     try {
       const o = JSON.parse(json);
-      exact = o.elements.reduce((a, e) => a + (e.band?.exactQueries?.length ?? 0), 0);
+      exact = o.elements.reduce((a, e) => a + (e.band?.exactQueries?.length ?? 0), 0); notSearched = o.elements.reduce((a, e) => a + (e.band?.ordinaryWordDifferentSound?.length ?? 0), 0);
       floor = o.variant_floor?.counts?.floor ?? 0;
       added = o.variant_floor?.counts?.model_added ?? 0;
       seededFrom = String(o.seeded_from ?? "");
@@ -2191,11 +2194,11 @@ function deriveFormNeighbourhood(ctx) {
     } catch { /* counts are telemetry only */ }
     // The SEED SET is logged by name, because it is the input that decides whether two runs of the same
     // matter can produce the same floor — a floor count alone cannot tell a stable run from a re-anchored one.
-    runLog(P.runDir, { event: "form-neighbourhood-derived", exact, floor, modelAdded: added, droppedAxes, seeds, seededFrom });
+    runLog(P.runDir, { event: "form-neighbourhood-derived", exact, floor, modelAdded: added, droppedAxes, seeds, seededFrom, ordinaryWordNotSearched: notSearched, ...(ow.error ? { ordinaryWordListError: ow.error } : {}) });
     // The fallback is not a quiet degrade: it means this run's variant floor rests on the mark alone
     // because the stage named no usable element. Loud, so the absence is a finding and not a shrug.
     if (seededFrom.startsWith("job mark"))
-      note(`prelim-variants: variant floor seeded from the JOB MARK — the manifest named no usable distinctive element (${floor} floor terms generated; the floor is complete, its seed is not the model's)`);
+      note(`clearance-variants: variant floor seeded from the JOB MARK — the manifest named no usable distinctive element (${floor} floor terms generated; the floor is complete, its seed is not the model's)`);
   } catch (e) {
     // The reason is carried WHOLE. It used to be truncated to 80 characters into the runLog and
     // 100 into the note, which cut the part that says WHICH cause fired — and the empty floor this path
@@ -2203,7 +2206,7 @@ function deriveFormNeighbourhood(ctx) {
     // compiles and freezes with no floor entries and no error, looking healthy. This line is the only
     // record that the mechanical floor is missing from the run, so it says the whole of why.
     const why = String(e.message);
-    note(`prelim-variants: form-neighbourhood derivation skipped (${why}) — register falls back to the manifest variants, so this run has NO mechanical form floor`);
+    note(`clearance-variants: form-neighbourhood derivation skipped (${why}) — register falls back to the manifest variants, so this run has NO mechanical form floor`);
     runLog(P.runDir, { event: "form-neighbourhood-skipped", reason: `derive_failed:${why}`, mark: markText(ctx.job.marks ?? ctx.job.markName ?? ctx.job.name ?? "") });
   }
 }
@@ -2258,6 +2261,69 @@ function logFullyDeferredAxes(plan, P, source) {
 // `frozenOnly` (item): read the FROZEN plan or nothing. reconstructCtx is an introspection path —
 // it must never compile and freeze a plan into an existing run as a side effect of being asked what the
 // run already holds. (attachProfile / attachFramework take the same posture via `write:false`.)
+/**
+ * Ask the register whether the client owns the element the frame proposed, and record the answer.
+ *
+ * ASYNC AND SEPARATE FROM THE COMPILE, which is why it is its own step rather than a branch inside
+ * `attachRegisterPlan`: that function is synchronous and is called on the resume path too. The shape is
+ * the digest's — an async driver step writes a receipt, a synchronous consumer reads it — and it buys
+ * the property that matters here: the compile cannot accidentally exclude anything by reaching for a
+ * promise it does not await.
+ *
+ * NOT A REGISTERED CONTEXT DERIVATION, and the reason is worth stating because the obvious reading is
+ * that it should be. `stage-context.mjs` declares the derivations a sandbox can REPLAY, and its runners
+ * are synchronous. This one asks a live register a question; there is no offline re-derivation of that,
+ * and declaring it would promise the `--experiment` rig something no runner can deliver — which the
+ * guard catches by name, loudly, as it should. A sandbox instead inherits the receipt with the rest of
+ * `_driver/`, and a sandbox that has none excludes nothing, which is the same answer every other
+ * unverified run gets.
+ *
+ * NEVER-KILL. Every failure writes an unverified receipt and the run plans exactly as it does today.
+ * The element being searched in full is the safe direction and the status quo; the only thing that can
+ * narrow a client's search is a register answer naming their own live registration.
+ */
+async function verifyAndRecordHouseElement(ctx, opts = {}) {
+  const P = ctx.paths;
+  try {
+    const proposed = frameHouseElementCandidate(P.runDir);
+    if (!proposed) return;   // the ordinary case: the frame proposed nothing and there is no question
+
+    const classes = [...new Set([...inScopeClassList(ctx.job, ctx.profile).map(String), ...frameIdentifiedClasses(P.runDir)])];
+    // THE CLIENT'S OWN NAMES. The profile's trading names are the curated list; the matter's customer is
+    // the free-text one. Both, because a profile may be absent on a one-off matter and a customer string
+    // may be a person where the filings are held by a company.
+    const owners = [...new Set([...(ctx.profile?.selfExclusionOwners ?? []), ctx.job?.customer].map((o) => String(o ?? "").trim()).filter(Boolean))];
+    const caps = registerCapabilities();
+    const { regions } = resolvePlanRegions(registerJurisdictions(ctx.job, ctx.profile), caps);
+    const rec = resolveRecordExecutor({
+      lister: opts?.recordLister ?? null, adapter: activeProvider(),
+      agentId: ctx.agentId ?? null, sessionKey: `clearance-${ctx.run.slug}-${ctx.run.codename}`,
+      recordLog: runRecordLogPath(P.runDir),
+      fixtureDir: ctx.job?.registerFixtures?.records ?? null,
+    });
+    // AN EXACT-NAME LISTING OF THE ELEMENT, filtered to the client's own live in-class registrations by
+    // the verifier. The owner join is done on REAL RECORDS the register returned, which is what
+    // "verified by owner, not asserted" means — there is no owner-predicate listing on this interface
+    // and inventing one would be a second way to ask the same question.
+    const lookup = typeof rec.list !== "function" ? null : async ({ element, classes: cls }) => {
+      const r = await rec.list(element, { classes: cls, regions, limit: 50 });
+      if (!r || r.ok === false) return { ok: false, reason: String(r?.reason ?? "the register listing did not answer") };
+      return { ok: true, records: Array.isArray(r.records) ? r.records : [] };
+    };
+
+    const receipt = await verifyHouseElementOwnership({ element: proposed.element, classes, owners, lookup });
+    receipt.remainder = proposed.remainder;   // carried so the compile needs only this one file
+    ensureDriverDir(P.runDir);
+    atomicWrite(driverDir(P.runDir, HOUSE_ELEMENT_RECEIPT), JSON.stringify(receipt, null, 2) + "\n");
+    runLog(P.runDir, { event: "house-element-ownership", verified: receipt.verified, reason: receipt.reason,
+      records: receipt.records.length, owners: owners.length, executor: rec.source });
+    if (!receipt.verified) note(`house element: ${proposed.element} stays in the search — ${receipt.reason}`);
+  } catch (e) {
+    // A THROW HERE MUST NOT COST A REPORT. No receipt means no exclusion, which is today's plan.
+    runLog(P.runDir, { event: "house-element-ownership-failed", reason: String(e?.message ?? e).slice(0, 160) });
+  }
+}
+
 function attachRegisterPlan(ctx, { frozenOnly = false } = {}) {
   const P = ctx.paths;
   if (frozenOnly) {
@@ -2281,7 +2347,30 @@ function attachRegisterPlan(ctx, { frozenOnly = false } = {}) {
   ctx.registerPlan = null;
   let compiled;
   try {
-    const manifest = parseVariantManifestModel(readFileSync(P.variantManifestModel, "utf8"));
+    let manifest = parseVariantManifestModel(readFileSync(P.variantManifestModel, "utf8"));
+    // ── 647 — THE CLIENT'S OWN ELEMENT LEAVES THE CONFLICT ANALYSIS, ON EVIDENCE OR NOT AT ALL ─────
+    //
+    // The receipt is the ONLY thing that arms this. An absent, unreadable or unverified receipt plans
+    // exactly as this compile did before the rule existed, which is the element searched in full — the
+    // safe direction, and the one a client is never harmed by.
+    let houseConfirmation = null;
+    let houseReceipt = null;
+    try { houseReceipt = JSON.parse(readFileSync(driverDir(P.runDir, HOUSE_ELEMENT_RECEIPT), "utf8")); }
+    catch { houseReceipt = null; }
+    if (houseReceipt?.verified === true) {
+      const r = excludeHouseElement(manifest, { element: houseReceipt.element, remainder: houseReceipt.remainder });
+      if (r.refused) {
+        // VERIFIED OWNERSHIP AND STILL NOT APPLIED. The receipt answers who owns the element; the
+        // transform answers whether this manifest's mark can survive the cut. Both must hold.
+        runLog(P.runDir, { event: "house-element-not-applied", reason: r.refused, element: houseReceipt.element });
+      } else {
+        manifest = r.manifest;
+        houseConfirmation = r.confirmation;
+        runLog(P.runDir, { event: "house-element-excluded", element: houseReceipt.element,
+          remainder: houseReceipt.remainder, dominant_element: manifest.dominant_element,
+          evidence: (houseReceipt.records ?? []).length });
+      }
+    }
     let form = null;
     try { form = JSON.parse(readFileSync(P.formNeighbourhood, "utf8")); } catch { /* form band optional */ }
     compiled = compileRegisterPlan({
@@ -2296,7 +2385,12 @@ function attachRegisterPlan(ctx, { frozenOnly = false } = {}) {
       // sweep); fatal on a provider whose regions[] is mandatory, where every entry then errored on its
       // count probe and the whole plan joined MISSING at fan-in (review finding 11).
       job: { jobKey: ctx.run.slug, classes: [...new Set([...inScopeClassList(ctx.job, ctx.profile).map(String), ...frameIdentifiedClasses(P.runDir)])], jurisdictions: registerJurisdictions(ctx.job, ctx.profile) },
-      form, skillVersion: "prelim-register@spec48",
+      form, skillVersion: "clearance-register@spec48",
+      // — WHICH ELEMENT THE EXCLUSION TOOK OUT, so the compile can make its form band unreachable
+      // rather than merely unasked-for. Null unless the ownership receipt verified, which is the same
+      // condition the exclusion itself runs under: an unverified receipt excludes nothing, and it must
+      // not remove a band either.
+      houseElement: houseConfirmation ? houseReceipt?.element : null,
       // phase 3 — the plan is compiled AGAINST THE ACTIVE PROVIDER's declared capabilities, so the
       // frozen artifact is executable by construction: the OR-stack split uses that provider's width,
       // jurisdictions are translated into its office vocabulary (EU→EM on Compumark), and a predicate
@@ -2308,6 +2402,19 @@ function attachRegisterPlan(ctx, { frozenOnly = false } = {}) {
       // rides the plan as a disclosed deferral, never as a silently narrower search.
       unavailableOffices: registerUnavailableOffices(),
     });
+    // REQUIREMENT 3 — the element is still checked ONCE, as a confirmation of the client's own live
+    // registrations rather than as a conflict sweep, so the exclusion is evidenced on the report by a
+    // query that ran. Appended after the compile because it is not derived from the manifest: it is the
+    // one question about the element the plan still owes.
+    if (houseConfirmation && compiled?.entries) {
+      const used = new Set(compiled.entries.map((e) => e.qid));
+      compiled.entries.push({
+        ...houseConfirmation,
+        qid: mintSupplementalQid({ prefix: "house", term: houseConfirmation.term, used }),
+        nice_classes: compiled.nice_classes ?? [],
+        regions: compiled.regions ?? [],
+      });
+    }
   } catch (e) {
     // NEVER-KILL at mint time: no/malformed sibling or a class-less matter degrades to the legacy
     // path with a logged reason — the plan improves the run, it never turns delivery off.
@@ -3648,6 +3755,27 @@ export function digestDispatchExtra(ctx, { trigger = "fresh", willRun = true, ex
       }
     }
   } catch (e) { note(`coverage-form brief skipped (non-fatal — the form is in _driver/ and the validator refuses an unsettled row): ${String(e.message).slice(0, 80)}`); }
+  // — THE BATCH BLOCK: how the driver split this run's band, and which batches are still outstanding.
+  //
+  // The seat is told the split HERE rather than in the stage's dictation because the numbers are the
+  // run's, not the contract's: a band of 40 records is one batch and a band of 1,161 is twelve, and on a
+  // resume the outstanding set is what the killed attempt did not reach. The dictation says the rule;
+  // this says the arithmetic.
+  //
+  // BEST-EFFORT, AND SAFE BY CONSTRUCTION rather than by argument — the coverage brief's precedent above,
+  // for its reason. Nothing here enforces anything: a call naming a batch is judged against the driver's
+  // own split whether or not this block composed, the tool's refusal re-states what is outstanding, and
+  // the stage's exit gate refuses a document that ends fewer records than the run carried in. A brief
+  // that fails to compose costs a corrective round; it cannot cost a record.
+  try {
+    const gap = digestAccountingGap(P.runDir);
+    const block = digestBatchBrief(gap);
+    if (block) {
+      out = out ? `${out}\n\n${block}` : block;
+      runLog(P.runDir, { event: "digest-batch-brief", trigger, owed: gap.owed.length,
+        batches: batchesOf(gap.owed).length, unaccounted: gap.unaccounted.length });
+    }
+  } catch (e) { note(`digest batch brief skipped (non-fatal — the tool judges every batch against the driver's own split regardless): ${String(e.message).slice(0, 80)}`); }
   // AD-2 A9 (E2E-R2) + the P5 review (2026-07-31): a corrective/repair pass is told NOT to re-read the
   // whole placement file — the per-candidate tiers are in placements.json — but the RULINGS TAIL (band
   // reconciliation, disagreements, coverage rulings, open questions) lives ONLY in the md. Leaving it to
@@ -3710,7 +3838,7 @@ export function digestDispatchExtra(ctx, { trigger = "fresh", willRun = true, ex
 // The old `findFloorBreaches` read ⭐-marked lines out of the manifest TEXT, tokenised them, dropped
 // generic words and matched the remainder against coverage-row text. That join is why it needed free text
 // at all, and it is what conversion 3 made unreachable. This one reads `search_floor` — axis names, closed
-// against REGISTER_AXES, designated by prelim-variants in an earlier turn — and joins on `axis`, which
+// against REGISTER_AXES, designated by clearance-variants in an earlier turn — and joins on `axis`, which
 // both sides type. No tokens, no matching, nothing to go quietly wrong.
 //
 // A BREACH IS: an axis this mark's floor obliges, carrying a row labelled `coverage-limited`. That label
@@ -3736,7 +3864,7 @@ export function findFloorBreaches(ledger, floorAxes) {   // @internal
  * a pass, because the whole mechanism is opt-in — a run with no designation owes no floor, and a run whose
  * manifest cannot be read has no designation to honour. The refusal for an absent or unparseable manifest
  * belongs to the stage that writes it and already exists there — verify.mjs:1335 runs the same parser
- * through `checkSiblingJson` and fails prelim-variants with `variantmodel_missing`. Checked, because
+ * through `checkSiblingJson` and fails clearance-variants with `variantmodel_missing`. Checked, because
  * "something else refuses it" is exactly the assumption that turns a swallowed error into a silent pass.
  */
 export function readFloorAxes(paths) {   // @internal
@@ -3745,7 +3873,7 @@ export function readFloorAxes(paths) {   // @internal
 }
 
 // A never-active axis self-writes a harmless "not applicable" digest — the skill MANDATES the exact
-// scope wording (skills/prelim-register/unit.md:89-90: `query:"<axis> not applicable"`,
+// scope wording (skills/clearance-register/unit.md: `query:"<axis> not applicable"`,
 // `reason:"not applicable — <why>"`), so the coverage-ledger row lands as `<axis> / axis not applicable`.
 // It is `deferred` only because a non-search must not be dressed as a clean — it is NOT floor work left
 // open. Keyed on the self-digest scope (deterministic, skill-dictated), never a genuine floor's
@@ -3936,7 +4064,7 @@ export async function runSaturationProbeCodeSide(ctx, planExec) {   // @internal
   const label = `register-unit:${a}`;
   const out = P.registerUnit(a);
   const bandPath = P.registerBand(a);
-  const sessionKey = `prelim-${ctx.run.slug}-${ctx.run.codename}-register-unit-${a}`;
+  const sessionKey = `clearance-${ctx.run.slug}-${ctx.run.codename}-register-unit-${a}`;
   // crash-resume idempotency — mirrors stageOnce's skip: output present + valid ⇒ never re-execute.
   const forced = forceFromActive(ctx, "register-unit");
   // — hoisted above the skip return. Below it, this member's dispatch row carries boundaries and its
@@ -4056,7 +4184,7 @@ function writeSatProbeAuditNote({ ctx, out, bandPath, entries }) {
 
 // ── stage contracts (2026-07-30 review round) ──────────────────────────────────────────────────────
 // _driver/stage-contracts.json records, PER STAGE, the output contract the prompt THIS driver
-// dispatched holds the artifact to (declared on the stage def, e.g. prelim-variants
+// dispatched holds the artifact to (declared on the stage def, e.g. clearance-variants
 // `contract:{romanization:1}`). Written at DISPATCH time only — a skipped stage never gains one — so
 // it is evidence of PROMPT VINTAGE, which is the only honest gate for a new validation rule:
 //   - crash-resume: the skip check re-validates the completed output BEFORE any dispatch, marker
@@ -4220,7 +4348,7 @@ async function stageOnce(name, ctx, opts = {}) {
     // skips — i.e. on the babysit surface, in the middle of the shift where someone is watching it.
     runLog(P.runDir, { event: "skip", stage: label, trigger: "skip", model: won?.model ?? resolveModel(model), output: outputMeta(out), ...stageWallFields(tDispatch) });
     (ctx.skippedStages ??= []).push(label);   // V4-1: the lint receipt states which artifacts this delivery inherited
-    recordTransition(ctx, name);   // advance the displayed step on resume too (monotonic, no-op for unmapped)
+    recordTransition(ctx, name);   // advance the displayed step on resume too (monotonic; an unmapped stage records what it is, and moves no step)
     // `won ? won.key : …` (NOT `won?.key ?? …`): a recovered CODE-SIDE winner carries key:null on purpose —
     // falling back to opts.sessionKey there would re-mint the phantom session the null exists to suppress.
     return { ok: true, skipped: true, sessionKey: won ? won.key : opts.sessionKey, model: won?.model ?? model };
@@ -4231,6 +4359,25 @@ async function stageOnce(name, ctx, opts = {}) {
   // output under the rules it is being minted under. See recordStageContract's doc block.
   if (def.contract) recordStageContract(P.runDir, name, def.contract);
 
+  // ── AND RECORD THAT THE RUN IS IN IT, AT THE SAME MOMENT ───────────────────────────────────────────
+  //
+  // The displayed step advanced only where a stage SUCCEEDED, so a run inside a stage that takes minutes
+  // read as being in the previous one for the whole of it — a resumed run entered placement at 10:05Z and
+  // still showed "Register sweeps" at 10:10Z, which reads as the run having gone backwards. Nothing
+  // durable said a stage had STARTED: every stage record is written at completion, and the one start-time
+  // signal goes to stderr and never reaches the trace. So no reader could derive it either.
+  //
+  // Here rather than at the dispatch below, because this is the line that already declares the stage is
+  // dispatching, and every mutating path — corrective, followup, escalation, frame-reopen, stale-repair,
+  // verdict-recheck — funnels through it. One declaration of entry, for the contract record and the
+  // status alike.
+  //
+  // Safe against the two things that look like it should not be. `writeRunStatus` keeps the furthest step
+  // ever reached, so an escalation re-run mapping to an earlier stage still cannot pull the stepper back;
+  // and the bare `name` is passed exactly as the success path passes it, so a fan-out's axes go on
+  // collapsing to one display step.
+  recordTransition(ctx, name);
+
   // — THE PLACEMENT FORM IS ON DISK BEFORE THE SEAT IS ASKED ANYTHING, and it is written at the SAME
   // choke point every dispatch funnels through: the main path, the stale-repair path and the frame-reopen
   // path all reach the seat through here, and three separate pre-dispatch writes would be three chances
@@ -4342,6 +4489,25 @@ async function stageOnce(name, ctx, opts = {}) {
   // Evaluated on `effThinking`, not `thinking`: the anthropic gate above nulls the tier for a
   // cross-provider model, and a guard that reads the nulled value would go blind on the same overrides.
   assertEffectiveTier(label, { model, thinking: effThinking });
+  // ── THE TIME LIMIT IS DERIVED FROM THE BAND THIS DISPATCH IS HANDED ─────────────────────────────
+  //
+  // `def.timeoutSec` was a constant chosen once against a band nobody recorded beside it, and on a
+  // dense matter the two band-reading stages died AT their walls having written nothing. The base is
+  // still the stage's own number; what the band decides is how far above it this dispatch may go. A
+  // band at or under the reference returns the base untouched, so nothing already verified moves.
+  const dispatchBand = bandSizeForStage(name, P);
+  const derivedLimit = derivedLimitSec(def.timeoutSec, dispatchBand);
+  // REFUSED BEFORE A SEAT IS DISPATCHED, not after the wall. A limit past the ceiling is a prediction
+  // that this stage will be killed; starting it spends the whole prediction to arrive where the refusal
+  // already is, and the refusal NAMES the band size, which is the finding a killed attempt never gives.
+  if (limitExceedsCeiling(derivedLimit.sec)) {
+    const reason = ceilingRefusal(name, derivedLimit);
+    runLog(P.runDir, { event: "stage-input-over-ceiling", stage: name,
+      inputBytes: derivedLimit.inputBytes, derivedLimitSec: derivedLimit.sec });
+    throw new StageFailure(name, reason, undefined, { failClass: "deterministic" });
+  }
+  runLog(P.runDir, { event: "stage-limit-derived", stage: name, base: def.timeoutSec,
+    inputBytes: derivedLimit.inputBytes, derivedLimitSec: derivedLimit.sec, basis: derivedLimit.basis });
   const r = await runStage(label, {
     agent: execAgent,
     message,
@@ -4349,12 +4515,13 @@ async function stageOnce(name, ctx, opts = {}) {
     thinking,
     // opts.sessionKey lets a followup RESUME the exact key a prior run won on (winning-key hardening); else
     // the canonical base key. (A followup with a stale base key would resume a failed attempt — see runStage.)
-    sessionKey: opts.sessionKey ?? `prelim-${ctx.run.slug}-${ctx.run.codename}-${name}${keyAxis}`,
-    timeoutSec: def.timeoutSec,
+    sessionKey: opts.sessionKey ?? `clearance-${ctx.run.slug}-${ctx.run.codename}-${name}${keyAxis}`,
+    timeoutSec: derivedLimit.sec ?? def.timeoutSec,
+    derivedLimit,               // recorded on every attempt row: the size it was derived from, and the number
     stallSec: def.stallSec,     // per-stage stall override (heavy stages); undefined → global CLEAROTRON_STALL_MS
     expectFile: out,
     validate: def.validate,
-    runDir: P.runDir, bandSize: bandSizeForStage(name, P),
+    runDir: P.runDir, bandSize: dispatchBand,
     // ── — THE PRESENTING SIDE, RECOMPOSED PER ATTEMPT ────────────────────────────────────────
     //
     // A stage that declares `refreshCtx` is saying its dispatch text depends on state the run CHANGES
@@ -4437,6 +4604,8 @@ async function stageOnce(name, ctx, opts = {}) {
   });
   // P2 — record WHAT this output was produced from, so a later resume can tell whether it still holds.
   if (r.ok && out) writeStamp(P.runDir, label, stageInputs(name, P, { axes: ctx.axes, axis: ctx.axis, registerOnly: ctx.registerOnly }), { project: projectStageInput });
+  // Re-asserted on success, and no longer the only advance: entry records the same transition above, so
+  // this is what re-states the stage after a fan-out's concurrent axes have each written their own.
   if (r.ok) recordTransition(ctx, name);   // bare name → fan-out axes collapse to one display step (monotonic)
   // PR-4 — document-growth tripwire, keyed on TRIGGER so it covers BOTH growth loops (the lint-repair
   // "re-emit the COMPLETE updated file" cycle AND the skeptic/refutation corrective loop — the 2026-07-28 postmortem run's
@@ -4627,7 +4796,7 @@ function must(r, name) {
  * absence reads as an empty cause — which is the whole defect, one level along. PURE.
  *
  * — VISIBLE IN THE STRING, not only in a sibling key. `reason` was a bare slice, so a cut sentence
- * read as a finished one. Three failed runs of 2026-08-19 ended theirs mid-path — ".../studio/prelim-se"
+ * read as a finished one. Three failed runs of 2026-08-19 ended theirs mid-path — ".../studio/clearance-se"
  * — and the reader who stat'd that directory got ENOENT and diagnosed a working mechanism as a broken
  * one. Nothing had been lost: `reasonFull` carried the whole path on all three and `reasonTruncated` was
  * true on all three. The field that gets read FIRST simply never said it was short. `abbrev` is this
@@ -5247,7 +5416,7 @@ export function recordConnotationAudit(run, P) {   // @internal
     // ── — DOES A CHARGED RATING CARRY ITS GROUNDS? RECORDED, NOT ENFORCED ───────────────────────
     //
     // Doctrine already asks for this in as many words: "rule `loaded` and use the note to state plainly
-    // what you could not establish and what a human should look at" (prelim-common-law/SKILL.md). The
+    // what you could not establish and what a human should look at" (clearance-common-law/SKILL.md). The
     // seat does not do it — e2e READ all 24 `loaded` notes in the corpus (not keyword-probed them) and
     // every one describes the material instead. `grounds-grammar.mjs` was built to measure exactly that,
     // proven against those real notes and against a planted violation, AND CALLED BY NOTHING. A check
@@ -6111,7 +6280,7 @@ function refuteRegistryCheckExtra(ctx) {
     const P = ctx.paths;
     const narrative = existsSync(P.narrative) ? readFileSync(P.narrative, "utf8") : "";
     if (!narrative) return "";
-    const recordsByUri = assembleRunRecords(P.runDir, `prelim-${ctx.run.slug}-${ctx.run.codename}-`).records;
+    const recordsByUri = assembleRunRecords(P.runDir, `clearance-${ctx.run.slug}-${ctx.run.codename}-`).records;
     const probs = [
       ...findRegistryArithmeticIssues(narrative).map((a) => `${a.block}: ${a.detail}`),
       ...findRegistryViolations(narrative, recordsByUri).filter((v) => v.kind === "mismatch")
@@ -6984,7 +7153,7 @@ function injectDeferralCoverage(P, runDir, note) {
 // ── THE REMEDY CLAUSE NAMES A PRODUCT, AND FOR A WHILE IT NAMED A DELETED ONE ───────────────────────
 //
 // This row reaches a CLIENT REPORT. It read "…not searched at this level — available at Depth 5
-// (prelim-jx)": an internal product key and a rung on the depth ladder, both retired by, offered as
+// (clearance-jx)": an internal product key and a rung on the depth ladder, both retired by, offered as
 // the remedy for a coverage limit the same sentence had just disclosed. `injectScriptScopeCoverage`
 // calls the decision on EVERY run, and it was driven — it fires for a worldwide scope, a CN-named scope
 // and the ja lane — so this was delivered prose telling a reader to buy something that does not exist.
@@ -6998,7 +7167,7 @@ const WORLDWIDE_SCOPE_RE = /^(worldwide|global|all|all[- ]jurisdictions)$/i;
 /** What a synthesis-authored Stage-1.5 coverage row looks like when it has ALREADY made this
  *  disclosure — see the suppression in injectScriptScopeCoverage. Both the current vocabulary and the
  *  retired one, because a resumed run carries whichever was current when its synthesis ran. */
-const SCRIPT_SCOPE_RECOMMENDATION_TOKENS = Object.freeze(["native-language investigation", "prelim-jx"]);
+const SCRIPT_SCOPE_RECOMMENDATION_TOKENS = Object.freeze(["native-language investigation", "clearance-jx"]);
 
 /** The disclosure vocabulary for ONE candidate lane, derived (never tabulated). Returns
  *  `{area, note, territories, marker}` — `marker` is the lowercased script prefix the suppression
@@ -7122,14 +7291,14 @@ export function injectScriptScopeCoverage(P, runDir, note, { searchPolicy = null
     const rowText = (c) => `${c?.area ?? ""} ${c?.note ?? ""}`.toLowerCase();
     const added = [];
     for (const p of pending) {
-      // Suppression is PER LANE. The old check treated any coverage row mentioning "prelim-jx" as
+      // Suppression is PER LANE. The old check treated any coverage row mentioning "clearance-jx" as
       // covering the disclosure, which was harmless while zh was the only lane and is a silent row-
       // eater the moment there are two: on a CN+JP scope the zh row lands first, its own note ended in
-      // "(prelim-jx)", and the ja row was then swallowed by a match on the sibling's text. So the
+      // "(clearance-jx)", and the ja row was then swallowed by a match on the sibling's text. So the
       // deference to a synthesis-authored Stage-1.5 row requires the row to be about THIS lane.
       //
       // TWO VOCABULARIES ON PURPOSE. `native-language investigation` is what the offering calls it now
-      // and what synthesis reads in its own prompt; `prelim-jx` is the retired key, kept because a run
+      // and what synthesis reads in its own prompt; `clearance-jx` is the retired key, kept because a run
       // RESUMED from before carries a synthesis row written in it — dropping the old token would
       // put a second, duplicate disclosure into a report that already makes the same one.
       const already = doc.coverage.some((c) => {
@@ -7329,7 +7498,7 @@ export function fullProseOrdinals(findings) {
     .filter((o) => o != null);
 }
 // ASSEMBLE report.md = the overview shell (front-matter + Actions/Coverage/Methodology) + `# Marks` + the
-// per-card files in render order (composite desc, ordinal asc — mirrors render.mjs:502), `open: true` on the
+// per-card files in render order (composite desc, ordinal asc — mirrors render.mjs `sortedAll`), `open: true` on the
 // single top card. Findings with no card file (a failed report-card, or a secondary finding) are NOT emitted —
 // render.mjs synthesizes them structured-only from findings.json, so nothing is silently dropped. Pure file IO.
 // spec 64 — "### Only you can close these" is CODE-BUILT from the typed actions register (the report-
@@ -7540,7 +7709,7 @@ export function buildOnlyYouSection(actions, findings, { nowMs = Date.now(), wit
 // blocking review goes." That REVERSES T3, which retired "delivered-with-open-questions" and
 // is itself recorded as an owner-approved decision — both are his, and this is the standing one.
 //
-// The section the reviewer's concerns land in is not new. `driver/skills/prelim-search/SKILL.md:241`
+// The section the reviewer's concerns land in is not new. `driver/skills/clearance-search/SKILL.md`
 // has described it all along — "delivered … as a prominent Reviewer's open questions section at the
 // top of the body (the driver passes them in)" — and `:295` lists it as a required section with
 // "Never omit it to look more finished." deleted the driver's half and left that text
@@ -7870,7 +8039,7 @@ export function assembleReportMd(P, findings, cardOrdinals, { grouped = [], byRi
   } catch { /* never-kill: a malformed findings.json leaves the overview untouched (its own gates own that) */ }
   // ── T3a — THE REVIEWER'S OPEN POINTS, AT THE TOP OF THE BODY ──────────────────────────────────────
   //
-  // `driver/skills/prelim-search/SKILL.md:241` says where: "a prominent Reviewer's open questions section at the TOP of the body
+  // `driver/skills/clearance-search/SKILL.md` says where: "a prominent Reviewer's open questions section at the TOP of the body
   // (the driver passes them in)". That sentence has been true of the contract and false of the code
   // since deleted the driver's half; this is the half coming back.
   //
@@ -8846,9 +9015,10 @@ async function pipelineInner(job, opts = {}) {
     // Phase 0 done in code (slug/codename/run-dir/customer). Phase 1+2 stages:
     must(await stage("matter-frame", ctx), "matter-frame");
     await deriveIntakeAsks(ctx);   // A6: freeze the intake-ask register (one save-only followup if the section is missing)
-    must(await stage("prelim-variants", ctx), "prelim-variants");
+    must(await stage("clearance-variants", ctx), "clearance-variants");
     deriveScopeLedgerJson(ctx);   // frame-omission design: code-derive scope-ledger.json from the validated prose (never-kill)
     deriveFormNeighbourhood(ctx); // mechanical FORM band: code-derive form-neighbourhood.json from the manifest's distinctive element(s) — the model-free form floor the register funnel searches (never-kill)
+    await verifyAndRecordHouseElement(ctx, opts);   // ask the register who owns the frame's proposed house element, BEFORE the plan is compiled from it
     attachRegisterPlan(ctx);      // WS2 (B3): compile/freeze/reuse the deterministic register plan (flag-gated; frozen plan wins on resume; never-kill on mint)
 
     // spec 64 (B2) — proactive recall probes: prior-confirmed conflicts for THIS mark (the workspace
@@ -9659,7 +9829,7 @@ async function pipelineInner(job, opts = {}) {
       const dispatchStartedMs = Date.now();
       try {
         const r = await planExec({ planPath: P.registerPlan, axis: a, outputPath: P.registerBand(a), ...(qids?.length ? { qids } : {}) },
-          { agentId: agent, sessionKey: `prelim-${run.slug}-${run.codename}-register-unit-${a}`, recordLog: runRecordLogPath(run.runDir) });
+          { agentId: agent, sessionKey: `clearance-${run.slug}-${run.codename}-register-unit-${a}`, recordLog: runRecordLogPath(run.runDir) });
         outcome = r?.ok ? "ok" : `failed: ${String(r?.cause ?? "unknown").slice(0, 140)}`;
       } catch (err) { outcome = `threw: ${String(err?.message ?? err).slice(0, 140)}`; }
       // — MEASURE WHETHER THE HOLE CLOSED, not whether the phone was answered. `outcome` is the
@@ -9746,7 +9916,7 @@ async function pipelineInner(job, opts = {}) {
       // production default is ON.
       if (process.env.CLEAROTRON_BAND_TRUTH_GATE !== "0"
         && unitKey[a] && existsSync(P.registerBand(a)) && (ctx.registerPlan?.entries ?? []).some((e) => e?.axis === a)) {
-        const laneKey = `prelim-${run.slug}-${run.codename}-register-unit-${a}`;
+        const laneKey = `clearance-${run.slug}-${run.codename}-register-unit-${a}`;
         const bandHasQids = (() => {
           try { const b = JSON.parse(readFileSync(P.registerBand(a), "utf8")); return Array.isArray(b) && b.some((x) => x && typeof x === "object" && x.qid); }
           catch { return false; /* parse defects are the stage validator's problem, not this gate's */ }
@@ -9819,7 +9989,7 @@ async function pipelineInner(job, opts = {}) {
           if (!digestLocked && repairLedger.canAttempt("taint-rerun", a, { max: taintRerunMax, epoch: repairEpoch })) {
             note(`register-unit ${a}: taint-rerun — one fresh re-run (fresh session; a killed session is never warm-resumed)`);
             const r = await stage("register-unit", { ...ctx, axis: a },
-              { force: true, trigger: "taint-rerun", sessionKey: `prelim-${run.slug}-${run.codename}-register-unit-${a}-taint-rerun-${recoveryAttempts}` });
+              { force: true, trigger: "taint-rerun", sessionKey: `clearance-${run.slug}-${run.codename}-register-unit-${a}-taint-rerun-${recoveryAttempts}` });
             repairLedger.record("taint-rerun", a, r.ok ? "ok" : `failed: ${String(r.fail ?? "unknown").slice(0, 100)}`, { epoch: repairEpoch, max: taintRerunMax });
             repairs.push(`taint-rerun:${r.ok ? "ok" : `failed: ${String(r.fail ?? "unknown").slice(0, 60)}`}`);
             if (r.ok && r.sessionKey) unitKey[a] = r.sessionKey;
@@ -10144,7 +10314,7 @@ async function pipelineInner(job, opts = {}) {
             runLog(run.runDir, { event: "plan-qids-missing", axis: a, qids: entries.map((e) => e.qid), action: "fresh-execute-plan" });
             note(`register-unit ${a}: ${entries.length} dictated plan entr${entries.length === 1 ? "y" : "ies"} unexecuted on a resumed-past axis — one fresh execute_plan-only call`);
             const freshMsg = repairFollowup("register-unit:plan-join-fresh", { axis: a, registerPlan: P.registerPlan, bandPath: P.registerBand(a) });
-            const rf = await stage("register-unit", { ...ctx, axis: a }, { force: true, freshMessage: freshMsg, sessionKey: `prelim-${ctx.run.slug}-${ctx.run.codename}-register-unit-${a}-plan-join-fresh`, trigger: "plan-join-fresh" });
+            const rf = await stage("register-unit", { ...ctx, axis: a }, { force: true, freshMessage: freshMsg, sessionKey: `clearance-${ctx.run.slug}-${ctx.run.codename}-register-unit-${a}-plan-join-fresh`, trigger: "plan-join-fresh" });
             if (!rf.ok) note(`register-unit ${a}: fresh execute_plan call failed (${rf.fail}) — the plan-unexecuted StageFailure below holds the line`);
             continue;
           }
@@ -10969,7 +11139,7 @@ async function pipelineInner(job, opts = {}) {
                 note(`frame-reopen: ${a} timed out — ONE fresh SCOPED retry through the fallback chain (backup provider + retries)`);
                 const retryMsg = repairFollowup("register-unit:frame-reopen-retry", { paths: P, axis: a, directives: regDirectives, reopenFetchCap,
                   supplementalLane: !!ctx.registerPlan?.contract?.supplemental_lane });
-                const r2 = await stage("register-unit", { ...ctx, axis: a }, { force: true, freshMessage: retryMsg, sessionKey: `prelim-${ctx.run.slug}-${ctx.run.codename}-register-unit-${a}-reopen-retry`, trigger: "frame-reopen-retry" });
+                const r2 = await stage("register-unit", { ...ctx, axis: a }, { force: true, freshMessage: retryMsg, sessionKey: `clearance-${ctx.run.slug}-${ctx.run.codename}-register-unit-${a}-reopen-retry`, trigger: "frame-reopen-retry" });
                 if (r2.ok && existsSync(P.registerUnit(a)) && readFileSync(P.registerUnit(a), "utf8") !== beforeUnit) {
                   changedAxes.push(a); regChanged = true; regMechFail = null;
                   note(`frame-reopen: ${a} fresh scoped retry closed the gap`);
@@ -11740,7 +11910,7 @@ async function pipelineInner(job, opts = {}) {
     // violating after that one recovery pass is disclosed as unexamined + clamps the verdict (owner
     // decision 2026-07-22 — the terminal branch below); the gate never silently passes a drop.
     {
-      const runPrefix = `prelim-${run.slug}-${run.codename}-`;
+      const runPrefix = `clearance-${run.slug}-${run.codename}-`;
       // Re-read the findings + recompute the fetched universe on EACH check (the recovery re-digest rewrites
       // the findings AND may record_fetch the flagged URIs — both must be picked up on the post-recovery
       // check). V4-1: the fetched universe is the DELIVERED ARTIFACT SET's records (run-dir _records/ ∪ this
@@ -12062,7 +12232,7 @@ async function pipelineInner(job, opts = {}) {
             regions: ctx.registerPlan?.regions ?? [], entries,
           }, null, 2) + "\n");
           const r = await planExec({ planPath: ccPlanPath, axis: CROWD_CONTEXT_AXIS, outputPath: ccBandPath },
-            { agentId: ctx.agent, sessionKey: `prelim-${run.slug}-${run.codename}-crowd-context`, recordLog: runRecordLogPath(run.runDir) });
+            { agentId: ctx.agent, sessionKey: `clearance-${run.slug}-${run.codename}-crowd-context`, recordLog: runRecordLogPath(run.runDir) });
           if (!r?.ok) throw new Error(String(r?.cause ?? "crowd-context plan execution failed").slice(0, 200));
           const blocks = JSON.parse(readFileSync(ccBandPath, "utf8"));
           return Array.isArray(blocks) ? blocks : [];
@@ -12102,7 +12272,7 @@ async function pipelineInner(job, opts = {}) {
     // on fetched records) as a structured aim-attention artifact for synthesis. Best-effort; NEVER a
     // rating rule (explicitly not the rejected escalation filter) — absence writes nothing.
     try {
-      const { records } = assembleRunRecords(run.runDir, `prelim-${run.slug}-${run.codename}-`);
+      const { records } = assembleRunRecords(run.runDir, `clearance-${run.slug}-${run.codename}-`);
       const signals = extractEnforcerSignals(records);
       if (signals.length) {
         writeFileSync(`${P.enforcerSignals}.tmp`, JSON.stringify({ signals }, null, 2) + "\n");
@@ -12644,7 +12814,7 @@ async function pipelineInner(job, opts = {}) {
                 status: r?.screen?.status ?? r?.status, live_status: r?.screen?.live_status });
             }
           } catch { /* no merged band (legacy run) — fetched-record facts alone rank */ }
-          const srPrefix = `prelim-${run.slug}-${run.codename}-`;
+          const srPrefix = `clearance-${run.slug}-${run.codename}-`;
           let srRecords = assembleRunRecords(run.runDir, srPrefix).records;
           const srFetcher = opts.recordFetcher ?? defaultRecordFetcher;
           const srLedger = ctx.repairLedger ?? (ctx.repairLedger = createRepairLedger(run.runDir, { log: (o) => runLog(run.runDir, o) }));
@@ -12718,7 +12888,7 @@ async function pipelineInner(job, opts = {}) {
         const carriedUris = (pf?.findings ?? []).flatMap((f) =>
           Array.isArray(f?.owner?.registrations) ? f.owner.registrations : []
         ).map((r) => r?.uri && (normalizeRecordUri(r.uri) || String(r.uri).trim())).filter(Boolean);
-        const fetchedUris = [...assembleRunRecords(run.runDir, `prelim-${run.slug}-${run.codename}-`).records.keys()];
+        const fetchedUris = [...assembleRunRecords(run.runDir, `clearance-${run.slug}-${run.codename}-`).records.keys()];
         const rfMd = existsSync(P.registerFindings) ? readFileSync(P.registerFindings, "utf8") : "";
         const violations = findRecallRegressionViolations({
           knownConflicts, searchedNames: namesForRecall, carriedUris, fetchedUris,
@@ -12872,7 +13042,11 @@ async function pipelineInner(job, opts = {}) {
           reason: `synthesis_unaccounted_delivered:${duty.unaccounted.length} of ${duty.totals.owed} record(s) reached the findings surface and the delivered document accounts for none of them — neither a finding that names them nor a declination with a ground: ${sample}${duty.unaccounted.length > 4 ? " …" : ""}. The report ships with this named rather than being withheld; these records are open points a reader must weigh.`,
           // — the READER's sentence: what is open, in a lawyer's nouns. Counts survive;
           // the token, the record ids and the engine's nouns stay in `reason` and the run record.
-          clause: `${duty.unaccounted.length} of the ${duty.totals.owed} register records this search surfaced are neither addressed as findings nor expressly set aside in this report — they remain open points a reader must weigh`,
+          // COMPOSED BY THE AUTHORITY, NOT SPELLED HERE. The same sentence has to be reachable from a
+          // run that stored no clause, where these two objects are long gone and only the reason's own
+          // counts survive; `terminal-clamp.mjs` composes it from the counts either way, so the fresh
+          // run and the republished archive cannot drift apart.
+          clause: clauseForDefect("synthesis_unaccounted_delivered", duty.unaccounted.length, duty.totals.owed),
         });
       }
     }
@@ -12898,7 +13072,9 @@ async function pipelineInner(job, opts = {}) {
           // — the READER's sentence. "Floor row" is an engine noun; what the fact IS for a
           // lawyer: live registrations identical or near-identical to the mark that the report does not
           // individually address. Counts survive; token, ids and engine nouns stay in `reason`.
-          clause: `${block.undischarged} of the ${block.floors} live registrations identical or near-identical to the mark are not individually addressed in this report — each remains an open point a reader must weigh`,
+          // Composed by the authority in `terminal-clamp.mjs` for the reason the sibling site above
+          // gives: a republished pre-split run has to reach the same sentence from the counts alone.
+          clause: clauseForDefect("floor_duty_undischarged", block.undischarged, block.floors),
         });
       }
     }
@@ -12940,7 +13116,7 @@ async function pipelineInner(job, opts = {}) {
           for (const c of fresh) clampClauses.push(conditionClauses[conditions.indexOf(c)] ?? c);
           clampReasons.push(...fresh);
           if (verdict === "CLEAR") {
-            runLog(run.runDir, { event: "coverage-floor-clamp", from: "CLEAR", to: "CONDITIONAL", legalActions: conditions.length });
+            runLog(run.runDir, { event: "coverage-floor-clamp", cause: "forward-actions", from: "CLEAR", to: "CONDITIONAL", legalActions: conditions.length });
             note(`deliver-conditional floor: the opinion names ${conditions.length} forward legal action(s) a human must take (${conditions[0].slice(0, 140)}${conditions.length > 1 ? `; +${conditions.length - 1} more` : ""}) — clamping CLEAR→CONDITIONAL (spec 64: the disposition is derived from the findings' named actions).`);
             verdict = "CONDITIONAL";
             writeRunStatus(ctx, { verdict });
@@ -12979,7 +13155,7 @@ async function pipelineInner(job, opts = {}) {
         // The CLAMP is outside that guard on purpose: a re-ask can flip a clamped verdict back to CLEAR,
         // and it must meet this floor again with the reason already recorded.
         if (droppedConditions.length && verdict === "CLEAR") {
-          runLog(run.runDir, { event: "coverage-floor-clamp", from: "CLEAR", to: "CONDITIONAL", actionsDropped: droppedConditions.length });
+          runLog(run.runDir, { event: "coverage-floor-clamp", cause: "dropped-actions", from: "CLEAR", to: "CONDITIONAL", actionsDropped: droppedConditions.length });
           verdict = "CONDITIONAL";
           writeRunStatus(ctx, { verdict });
         }
@@ -13070,28 +13246,55 @@ async function pipelineInner(job, opts = {}) {
       // could-not-examine record, and an unfinished register slice — CONDITIONAL carries
       // lawyer-judged/disclosed residue only.
       if (coverageInsufficient || frameResidual || screenGateGap || seniorGap || registerGap || deadlineGap) {
-        const reasons = [];
-        if (coverageInsufficient) reasons.push(`the lawyer judged a material slice not fully cleared: ${coverageJudgment.reason || "register coverage gap"}`);
-        if (frameGap) reasons.push("the blind frame-diff flagged a dominant-element omission the reopen pass did not close");
-        else if (frameDeferrals.length) reasons.push(`follow-ups left open this run: ${frameDeferrals.map((d) => plainDirective(d.directive)).slice(0, 3).join(", ")}`);
-        if (screenGateGap) reasons.push(`${sgUnresolved.length} in-scope mark(s) dropped on goods could not be record_fetched (unverified): ${sgUnresolved.map((g) => g.mark).join(", ")}`);
-        if (seniorGap) reasons.push(`the oldest registration in a verdict-driving family could not be retrieved (policy: clamp): ${(ctx.seniorRights?.rows ?? []).filter((r) => r.applicable && !r.verified).map((r) => r.mark).join(", ")}`);
+        // THESE SENTENCES REACH A CLIENT AND THEY ARE NOT OURS TO WRITE (owner, 2026-09-17). One of
+        // them — the screen-gate line, which says a mark "could not be record_fetched" — carried an
+        // engine identifier into the list a client reads as the conditions on their result, by a route
+        // `terminalClampDecision` guards and this one did not. A reader's sentence for it was written
+        // here and refused: the objection was the class, not the wording. RULED 2026-09-18, design item
+        // 25 — cut the clause: it stays in the run record and leaves the client's result entirely, with
+        // NOTHING written in its place. That is what the `null` clause below means.
+        const reasons = [], clauseOf = new Map();   // run-record reason → the client's clause: the same words, with any engine token taken out
+        const machinery = (reason, clause = reason) => { reasons.push(reason); clauseOf.set(reason, clause); };
+        if (coverageInsufficient) machinery(`the lawyer judged a material slice not fully cleared: ${coverageJudgment.reason || "register coverage gap"}`);
+        if (frameGap) machinery("the blind frame-diff flagged a dominant-element omission the reopen pass did not close");
+        else if (frameDeferrals.length) machinery(`follow-ups left open this run: ${frameDeferrals.map((d) => plainDirective(d.directive)).slice(0, 3).join(", ")}`);
+        if (screenGateGap) machinery(`${sgUnresolved.length} in-scope mark(s) dropped on goods could not be record_fetched (unverified): ${sgUnresolved.map((g) => g.mark).join(", ")}`, null);   // run record ONLY: no client clause (ruled 2026-09-18)
+        if (seniorGap) machinery(`the oldest registration in a verdict-driving family could not be retrieved (policy: clamp): ${(ctx.seniorRights?.rows ?? []).filter((r) => r.applicable && !r.verified).map((r) => r.mark).join(", ")}`);
         if (registerGap) {
-          if (regGap.deferred.length) reasons.push(`register coverage deferred on ${[...new Set(regGap.deferred.map((g) => g.axis))].join(", ")} — the search did not finish and must be re-run before this can be relied on`);
-          if (regGap.taintAxes.length) reasons.push(`the ${regGap.taintAxes.join(", ")} register pass was cut down at the timeout wall and its self-reported coverage is unverified`);
+          for (const { reason, clause } of registerGapConditions(regGap)) machinery(reason, clause);
+          // (the deferred and cut-down register lines: registerGapConditions, at the end of this file)
           // Named regressions (2026-07-22): `<MARK> (<owner> — <canonical uri>)` — a bare mark name
           // shipped "ION, ION, ION" (three indistinguishable strings); the identity is front-loaded
           // because the delivered statement truncates from the tail.
-          if (regGap.recallRegressions.length) reasons.push(`a prior-confirmed live conflict was neither carried nor justified this run: ${regGap.recallRegressions.slice(0, 3).map(formatRecallRegression).join(", ")}`);
+          if (regGap.recallRegressions.length) machinery(`a prior-confirmed live conflict was neither carried nor justified this run: ${regGap.recallRegressions.slice(0, 3).map(formatRecallRegression).join(", ")}`);
         }
-        if (deadlineGap) reasons.push(`a recorded opposition deadline was delivered without its date: ${ctx.deadlineCarryMaterial.map((v) => `${v.mark_text ?? v.uri} (window closes ${v.opposition_end})`).slice(0, 3).join(", ")}`);
-        runLog(run.runDir, { event: "coverage-floor-clamp", from: "CLEAR", to: "CONDITIONAL", coverageInsufficient: coverageInsufficient || undefined, frameGap: frameGap || undefined, frameDeferred: frameDeferrals.length || undefined, screenGate: screenGateGap ? sgUnresolved.length : undefined, seniorRight: seniorGap || undefined, registerGap: registerGap ? { deferred: regGap.deferred.length, taint: regGap.taintAxes.length, recall: regGap.recallRegressions.length } : undefined, deadlineCarry: deadlineGap ? ctx.deadlineCarryMaterial.length : undefined });
+        if (deadlineGap) machinery(`a recorded opposition deadline was delivered without its date: ${ctx.deadlineCarryMaterial.map((v) => `${v.mark_text ?? v.uri} (window closes ${v.opposition_end})`).slice(0, 3).join(", ")}`);
+        // ── THE THIRD CLAMP SITE NAMES ITSELF, AND NAMES WHICH OF ITS SEVEN INPUTS FIRED ────────────────
+        //
+        // All three clamp sites emitted this event under one name with the same from/to, distinguishable
+        // only by which optional payload key happened to be present. Two of them fired three milliseconds
+        // apart on a production run — the first without `frameDeferred`, the second with it — which reads
+        // as one decision logged twice. It was two different decisions wearing one name, and the test lane
+        // reasonably discounted one of them. `cause` makes the event self-describing.
+        //
+        // THE EVENT NAME IS DELIBERATELY NOT SPLIT. It is a true statement about the effect — the verdict
+        // was clamped — and something downstream may already count clamps in aggregate. A discriminator is
+        // additive; three names would not be.
+        //
+        // This site is itself seven causes under one name, so it also lists WHICH fired rather than
+        // leaving a reader to key on field presence and guess.
+        const clampInputs = Object.entries({
+          coverageInsufficient, frameGap, frameDeferred: frameDeferrals.length,
+          screenGate: screenGateGap ? sgUnresolved.length : 0, seniorRight: seniorGap,
+          registerGap, deadlineCarry: deadlineGap ? ctx.deadlineCarryMaterial.length : 0,
+        }).filter(([, v]) => Boolean(v)).map(([k]) => k);
+        runLog(run.runDir, { event: "coverage-floor-clamp", cause: "coverage", causes: clampInputs, from: "CLEAR", to: "CONDITIONAL", coverageInsufficient: coverageInsufficient || undefined, frameGap: frameGap || undefined, frameDeferred: frameDeferrals.length || undefined, screenGate: screenGateGap ? sgUnresolved.length : undefined, seniorRight: seniorGap || undefined, registerGap: registerGap ? { deferred: regGap.deferred.length, taint: regGap.taintAxes.length, recall: regGap.recallRegressions.length } : undefined, deadlineCarry: deadlineGap ? ctx.deadlineCarryMaterial.length : undefined });
         note(`deliver-conditional floor: ${reasons.join("; ")} — clamping CLEAR→CONDITIONAL so the delivered status carries the gap (never withheld, never halted).`);
         verdict = "CONDITIONAL";
         // APPEND (dedup by exact text) — the legalActions arm may already have recorded conditions,
         // and this callable runs more than once (degenerate re-ask, lint repair, post-consolidation).
         const freshMachinery = reasons.filter((r) => !clampReasons.includes(r));
-        clampClauses.push(...freshMachinery);   // machinery reasons ARE factual open-states — clause == reason
+        clampClauses.push(...freshMachinery.map((r) => (clauseOf.has(r) ? clauseOf.get(r) : r)));   // the clause is the reason less any engine token; null = the run record's alone
         clampReasons.push(...freshMachinery);
         // The reason KINDS distinguish coverage/frame/screen-gate/senior-right/register residue for the
         // report bound line and the client conditions row (merged — legalActions survives).
@@ -13209,7 +13412,7 @@ async function pipelineInner(job, opts = {}) {
     // review goes." This REVERSES T3 (H3/H5), whose flip to fail-on-BLOCKING is itself recorded
     // itself an owner-approved decision. Both are his; this is the standing one, and the
     // history is kept here rather than deleted because a reader who finds only one of them will conclude
-    // the code drifted from its contract. (It did not; driver/skills/prelim-search/SKILL.md:241/295 was the stale half, and this
+    // the code drifted from its contract. (It did not; driver/skills/clearance-search/SKILL.md was the stale half, and this
     // change makes it true again.)
     //
     // COPPER-SPIRE IS STILL ANSWERED, AND NOT BY REFUSING. That failure was a BLOCKING verdict reaching
@@ -14104,7 +14307,7 @@ async function pipelineInner(job, opts = {}) {
     // the spec's "blocks delivery", approved 2026-06-10: delivering nothing is worse than delivering good
     // work with one clearly-labelled defect — and code-produced defects would deadlock a block.)
     {
-      const lintPrefix = `prelim-${run.slug}-${run.codename}-`;
+      const lintPrefix = `clearance-${run.slug}-${run.codename}-`;
       // V4-1: the gates evaluate the artifact set assembled for THIS delivery — run-dir _records/
       // (inherited or prior-session) ∪ this-session ledger rows — never the session-prefixed ledger
       // alone (empty on a fork ⇒ the vacuous registry pass that shipped a false citation).
@@ -14709,7 +14912,7 @@ async function pipelineInner(job, opts = {}) {
           Array.isArray(f?.owner?.registrations) ? f.owner.registrations : []
         ).map((r) => r?.uri && (normalizeRecordUri(r.uri) || String(r.uri).trim())).filter(Boolean);
         const executedQids = (ctx.planExecution?.executed ?? []).map((x) => x.qid);
-        const fetchedUrisForRecall = [...assembleRunRecords(run.runDir, `prelim-${run.slug}-${run.codename}-`).records.keys()];
+        const fetchedUrisForRecall = [...assembleRunRecords(run.runDir, `clearance-${run.slug}-${run.codename}-`).records.keys()];
         const regLedgerRows = loadCoverageLedger(run.runDir).rows;
         // judgment-relocation (2026-06-23): the search-shape gate (findFloorShapeGaps) was DELETED here too —
         // sufficiency is judgment's call (coverage_judgment), not a re-parse of the ledger at the surface. This
@@ -14998,7 +15201,7 @@ async function pipelineInner(job, opts = {}) {
     let providerTally = null;
     try {
       const provider = activeProvider().id;
-      const usage = tallyRegisterCalls(DEFAULT_LEDGER_PATH, `prelim-${run.slug}-${run.codename}-`);
+      const usage = tallyRegisterCalls(DEFAULT_LEDGER_PATH, `clearance-${run.slug}-${run.codename}-`);
       runLog(run.runDir, { event: "provider-usage", provider, ...usage });
       writeRunStatus(ctx, { providerUsage: { [provider]: usage } });
       providerTally = { [provider]: usage };
@@ -15637,6 +15840,46 @@ function resolveRun(job, opts) {
 
 // Rebuild the ctx a single stage needs WITHOUT re-running upstream: axes from the persisted manifest, verdict
 // from status.json, publishedUrl from .published. (Mirrors what pipeline() accumulates mid-run.)
+/**
+ * THE JOB A RUN RAN, READ BACK OUT OF THE RUN'S OWN STATUS. PURE.
+ *
+ * `--resume` needs a job file, and the job file is gone by the time a resume is needed: the queue entry
+ * that carried it is consumed when the run starts, and nothing copies it into the run directory. So the
+ * one command that repairs a failed run names a path the box does not have, and the person who finds out
+ * is the person trying to repair it.
+ *
+ * This is not a guess at the job. `seedRunStatus` writes these fields FROM the job the engine ran, so
+ * reading them back is the engine's own record, not a reconstruction of intent. What it cannot carry is
+ * scope, and it does not have to: `reconstructCtx` reads profile and framework from the run's frozen
+ * sidecars with `write: false`, so the run's own configuration governs and the job supplies identity.
+ *
+ * THE CALLER MUST CHECK THE SLUG, and `resumeJobRefusal` below is that check. A rebuilt job that derives
+ * the run's own slug has reproduced the run's identity — `deriveSlug` reads `ref` and `markName` and
+ * nothing else — and one that derives a different slug is a job for a different matter.
+ */
+export function jobFromStatus(status) {   // @internal
+  const s = status ?? {};
+  if (!s.id && !s.ref && !s.markName) return null;   // not a status this can rebuild from
+  return {
+    id: s.id ?? null, ref: s.ref ?? null, markName: s.markName ?? null,
+    classes: Array.isArray(s.classes) ? s.classes : null,
+    forwarder: s.forwarder ?? null,
+  };
+}
+
+/** Why a rebuilt job may not stand in for the run's own, or null when it may. PURE. */
+export function resumeJobRefusal(job, slug) {   // @internal
+  if (!job) return "this run's status.json carries no id, reference or mark name, so the job it ran cannot be read back from it";
+  // EVERY IDENTIFYING FIELD, OR NO REBUILD: a job missing one is a guess at that field, and a resume must not guess.
+  const missing = [["id", job.id], ["markName", job.markName], ["forwarder", job.forwarder]].filter(([, v]) => !v).map(([k]) => k).concat(Array.isArray(job.classes) ? [] : ["classes"]);
+  if (missing.length) return `this run's status.json carries no ${missing.join(", ")}, so the job it ran cannot be read back whole — pass --job <file.json> rather than resume on a guess`;
+  const derived = deriveSlug(job);
+  if (derived !== slug)
+    return `the job rebuilt from this run's status.json derives ${derived}, and the run directory is ${slug} — `
+      + "they are different matters, so the rebuild is refused rather than resumed into the wrong run";
+  return null;
+}
+
 export function reconstructCtx(job, opts) {   // @internal
   const run = resolveRun(job, opts);
   const P = paths(run.runDir);
@@ -15819,7 +16062,7 @@ export async function repairStale(job, opts = {}) {   // @internal
 
 // --experiment <stage>: re-run ONE stage SANDBOXED — no canonical ARTIFACT is read back or overwritten. The
 // stage reads COPIES of its canonical inputs from a shadow dir and writes its output there; a distinct
-// `prelim-exp-…` session key never collides with the canonical session AND sorts outside the run's
+// `clearance-exp-…` session key never collides with the canonical session AND sorts outside the run's
 // provider-usage prefix (experiment Corsearch calls are not billed to the canonical run). Single-model by
 // design (the canonical primary unless --model overrides) so the comparison is clean.
 //
@@ -16016,7 +16259,7 @@ async function runExperimentInner(job, opts) {
     // so a run with no case-law layer must arrive as null here too, never as an absent key.
     for (const f of inlineDecl.fields) shadowCtx[f] = resolved[f] ?? null;
   }
-  const sessionKey = `prelim-exp-${ctx.run.slug}-${ctx.run.codename}-${name}${axis ? `-${axis}` : ""}-${ts}`;
+  const sessionKey = `clearance-exp-${ctx.run.slug}-${ctx.run.codename}-${name}${axis ? `-${axis}` : ""}-${ts}`;
   let { text: extra, ids: extraIds } = experimentExtra(shadowCtx, name, opts);
 
   // — THE CORRECTIVE PASS, on a COLD turn, and it says which pass it reproduced.
@@ -16278,8 +16521,13 @@ export function retiredEnvWarnings(env = process.env) {
 // ABSOLUTE PATHS on purpose: this line is read hours later, possibly from a different directory, and a
 // relative path that silently resolves somewhere else would be a worse answer than no line at all.
 export function resumeCommand({ script, jobPath, codename, agent = null }) {   // @internal
-  if (!script || !jobPath || !codename) return null;
-  return `node ${script} --job ${jobPath}${agent ? ` --agent ${agent}` : ""} --resume ${codename}`;
+  // THE IDENTITY IS THE CODENAME, NOT THE JOB PATH, and requiring both is what made this print nothing
+  // on the failures that most needed it. A resume rebuilds the job from the run's own status when no
+  // `--job` is given, so a command without one is valid — and it is the only valid one by the time a
+  // failure has made a resume necessary, because the queue entry carrying the job is long consumed.
+  // Requiring a path here meant every such failure was told "nothing to resume", which was false.
+  if (!script || !codename) return null;
+  return `node ${script}${jobPath ? ` --job ${jobPath}` : ""}${agent ? ` --agent ${agent}` : ""} --resume ${codename}`;
 }
 
 // The stderr lines a non-clean exit owes its reader, as an array (empty = say nothing further).
@@ -16378,7 +16626,7 @@ if (isEntrypoint(import.meta.url)) void (async () => {
   let a;
   try { a = parseArgv(process.argv.slice(2)); }
   catch (e) { console.error(`error: ${e.message}`); console.error(USAGE); process.exit(2); }
-  if (!a.job) { console.error(USAGE); process.exit(2); }
+  if (!a.job && !a.codename) { console.error(USAGE); process.exit(2); }   // --resume alone rebuilds the job below
   // composition guards
   if (a.fromStage && !a.codename) { console.error("error: --from requires --resume <codename>"); process.exit(2); }
   if (a.experiment && !a.codename) { console.error("error: --experiment requires --resume <codename>"); process.exit(2); }
@@ -16400,8 +16648,47 @@ if (isEntrypoint(import.meta.url)) void (async () => {
   // mistake a first-time reader is likeliest to make. Kept guarded here through the rebase — the
   // pool check above is a separate refusal and must not swallow this one.
   let job;
-  try { job = JSON.parse(readFileSync(a.job, "utf8")); }
-  catch (e) { console.error(`error: cannot read job file ${a.job} — ${e.message}`); process.exit(2); }
+  if (!a.job && a.codename) {
+    // ── RESUMING A RUN WHOSE JOB FILE THE BOX NO LONGER HAS ───────────────────────────────────────
+    //
+    // The queue entry carrying the job is consumed when the run starts, so by the time a failure makes
+    // a resume necessary the input needed to perform it is already gone — and the exit advice printed
+    // on that failure composes a command naming a path that is not there. Rebuilt from the run's own
+    // status.json, which the engine wrote FROM the job it ran, and refused unless the rebuild derives
+    // this run's own slug.
+    //
+    // The scan is what makes it possible at all: finding a run by codename needs its slug, and the
+    // slug comes from the job, which is the thing being rebuilt. So the studio root's matters are
+    // scanned for the one holding a run dir with this codename. `findRunDirFor` decides what counts as
+    // that leaf, imported rather than re-spelled here — a second private copy of the leaf rule is how
+    // a reclaim and a resume come to disagree about which directory is the run. The import is lazy
+    // because runner.mjs imports THIS module; at this point both are loaded and nothing cycles.
+    const { findRunDirFor } = await import("./runner.mjs");
+    const studioRoot = a.agent ? config.studioRootForAgent(a.agent) : config.studioRoot;
+    const archiveRoot = a.agent ? config.archiveRootForAgent(a.agent) : config.archiveRoot;
+    let found = null;
+    try {
+      for (const slug of readdirSync(studioRoot)) {
+        const hit = findRunDirFor({ codename: a.codename, slug, studioRoot, archiveRoot });
+        if (hit) { found = { ...hit, slug }; break; }
+      }
+    } catch (e) { console.error(`error: cannot read the studio root ${studioRoot} — ${e.message}`); process.exit(2); }
+    if (!found) {
+      console.error(`error: no run directory for --resume ${a.codename} under ${studioRoot}`);
+      console.error("       pass --job <file.json> if the run lives somewhere this cannot see.");
+      process.exit(2);
+    }
+    let status = null;
+    try { status = JSON.parse(readFileSync(join(found.dir, "status.json"), "utf8")); }
+    catch (e) { console.error(`error: cannot read ${join(found.dir, "status.json")} — ${e.message}`); process.exit(2); }
+    job = jobFromStatus(status);
+    const refusal = resumeJobRefusal(job, found.slug);
+    if (refusal) { console.error(`error: ${refusal}`); process.exit(2); }
+    console.error(`[pipeline] --job not given; rebuilt the job for ${a.codename} from ${join(found.dir, "status.json")} (slug ${found.slug} confirmed)`);
+  } else {
+    try { job = JSON.parse(readFileSync(a.job, "utf8")); }
+    catch (e) { console.error(`error: cannot read job file ${a.job} — ${e.message}`); process.exit(2); }
+  }
   // Manual runs: if --agent is given, root the run-dir in that agent's workspace too (mirrors the runner).
   const base = a.agent
     ? { agent: a.agent, studioRoot: config.studioRootForAgent(a.agent), archiveRoot: config.archiveRootForAgent(a.agent) }
@@ -16413,7 +16700,10 @@ if (isEntrypoint(import.meta.url)) void (async () => {
     ? { ...base, codename: a.codename, experiment: a.experiment, model: a.model, instructions: a.instructions, axis: a.axis, label: a.label, dispatchTrigger: a.dispatchTrigger }
     : { ...base, codename: a.codename, fromStage: a.fromStage };
   const script = resolve(fileURLToPath(import.meta.url));
-  const advise = (o) => { for (const line of resumeAdvice({ script, jobPath: resolve(a.job), agent: a.agent ?? null, experiment: Boolean(a.experiment), ...o })) console.error(line); };
+  // `jobPath` is null on a rebuilt resume, so the advice composes a command that does not name a file
+  // the box does not have — which is the whole defect this path exists to close, and printing it again
+  // in the exit advice would reintroduce it one layer along.
+  const advise = (o) => { for (const line of resumeAdvice({ script, jobPath: a.job ? resolve(a.job) : null, agent: a.agent ?? null, experiment: Boolean(a.experiment), ...o })) console.error(line); };
 
   // ── the laptop case: a closed lid, a shutdown, a ^C ────────────────────────────────────────────────
   // Until now this CLI had NO signal handler: node's default die-now killed the process mid-stage, the run
@@ -16516,3 +16806,28 @@ if (isEntrypoint(import.meta.url)) void (async () => {
 //
 // Move it to the top the day those citations name symbols instead of numbers — which is what
 // CONTRIBUTING.md asks for, and what makes them checkable at all.
+
+/**
+ * The verdict conditions for an unfinished register search: the run record's sentence, and the client's.
+ *
+ * THE CLIENT'S CLAUSE IS THE SAME SENTENCE WITH THE ENGINE TOKEN TAKEN OUT (ruled 2026-09-18). The axis
+ * names — `primary-sweep`, `incumbent-class` — are how the engine files a register slice, and they reached
+ * the verdict a client reads as "register coverage deferred on primary-sweep". Nothing is written in their
+ * place: the client reads the remaining words, and the run record keeps the axes for whoever repairs the run.
+ * PURE.
+ *
+ * @returns {{ reason: string, clause: string }[]}
+ */
+export function registerGapConditions(regGap) {   // @internal
+  const out = [];
+  const deferredAxes = [...new Set((regGap?.deferred ?? []).map((g) => g?.axis).filter(Boolean))];
+  if ((regGap?.deferred ?? []).length) out.push({
+    reason: `register coverage deferred on ${deferredAxes.join(", ")} — the search did not finish and must be re-run before this can be relied on`,
+    clause: "register coverage deferred — the search did not finish and must be re-run before this can be relied on",
+  });
+  if ((regGap?.taintAxes ?? []).length) out.push({
+    reason: `the ${regGap.taintAxes.join(", ")} register pass was cut down at the timeout wall and its self-reported coverage is unverified`,
+    clause: "the register pass was cut down at the timeout wall and its self-reported coverage is unverified",
+  });
+  return out;
+}