clearotron 0.3.2-beta.7 → 0.3.2-beta.9

package/driver/placement-form.mjs

@@ -178,7 +178,83 @@ export function omittedFromRender(rows) {
   const list = Array.isArray(rows) ? rows : (rows?.rows ?? []);
   return list.filter((r) => !rowIsSettled(r, r))
     .map((r) => ({ row_id: r?.row_id ?? null, kind: r?.kind ?? null, select: selectionOf(r), mark: r?.mark ?? null,
-      missing: [!seatFields(r).tier ? "tier" : null, !seatFields(r).reason ? "reason" : null].filter(Boolean) }));
+      missing: [!seatFields(r).tier ? "tier" : null, !seatFields(r).reason ? "reason" : null].filter(Boolean),
+      // WHY, in the parser's own token. `missing` names only the two judgement fields, so a row refused on a
+      // fact the DRIVER copies — an owner the register never supplied — read as an omission with no cause
+      // at all, `missing: []`. That is how 141 tiered rows sat outstanding for a day with nobody able to say
+      // why: the answer was one parser call away and nothing made it.
+      cause: seatRefusal(r) ?? registerFactRefusal(r),
+      owed_by: seatRefusal(r) ? "seat" : "register" }));
+}
+
+// The parser tokens that speak about a fact the driver COPIES onto a register row — mark, owner,
+// jurisdiction, records all come from the canonical row (renderEntry), never from the seat. On a SEAT row the
+// same four are the seat's own writing.
+const REGISTER_FACT_TOKENS = new Set(["placement_mark_missing", "placement_owner_missing",
+  "placement_jurisdiction_invalid", "placement_records_invalid"]);
+const tokenOf = (e) => String(e?.message ?? e).split(/[:=\s(]/)[0] || "placement_invalid";
+// Stand-ins that every driver-fact check accepts, so a check of the JUDGEMENT alone cannot be refused on a
+// driver fact. They never reach a rendered file: this is a probe of the parser, not an entry.
+const FACTS_PRESENT = Object.freeze({ mark: "-", owner: "-", jurisdiction: "", records: [] });
+
+/**
+ * The seat's part of a row, refused — or null when the seat has done its part. On a register row that is
+ * the judgement alone (tier, reason, borderline), probed with the driver's facts stood in; on a seat row it
+ * is the whole row, because the seat wrote all of it. PURE; never throws.
+ */
+export function seatRefusal(row) {
+  try {
+    validatePlacement(renderEntry(row?.kind === "register" ? FACTS_PRESENT : row, row), 0);
+    return null;
+  } catch (e) { return tokenOf(e); }
+}
+
+/**
+ * The register's part of a register row, refused — or null. A fact the register did not supply (no owner on
+ * the record) is not something a corrective turn can repair: the seat is told not to type these fields and
+ * anything it types is ignored. Null on a seat row. PURE; never throws.
+ */
+export function registerFactRefusal(row) {
+  if (row?.kind !== "register") return null;
+  try {
+    validatePlacement(renderEntry(row, { tier: PLACEMENT_TIERS[0], reason: "register fact probe" }), 0);
+    return null;
+  } catch (e) { const t = tokenOf(e); return REGISTER_FACT_TOKENS.has(t) ? t : null; }
+}
+
+/**
+ * What a placement pass recorded, split by who owes each gap. The gate reads this; so does the run record.
+ *
+ *   unjudged            rows whose seat part the parser refuses — the seat owes them, a corrective turn can
+ *                       repair them, and a pass that leaves any is not a completed pass.
+ *   register_selected   register candidates the seat selected.
+ *   register_rendered   of those, how many reach placements.json.
+ *   register_facts      rows judged by the seat and still refused on a fact the register did not supply,
+ *                       counted by cause. A register that publishes no owner for a record is a real and
+ *                       ordinary case (measured: single records at offices that do not publish one), so a
+ *                       handful are recorded, not refused.
+ *
+ * `register_selected > 0 && register_rendered === 0` is the other refusal: a pass that tiered register
+ * candidates and delivered none of them has not made a judgement about the register, it has lost one. That
+ * is the shape of a register whose rows reach the fold without a field every placement needs. PURE.
+ */
+export function placementRenderAccount(rows) {
+  const list = Array.isArray(rows) ? rows : (rows?.rows ?? []);
+  const unjudged = [];
+  const registerFacts = {};
+  let registerSelected = 0, registerRendered = 0;
+  for (const r of list) {
+    if (!r || typeof r !== "object") continue;
+    const isRegister = r.kind === "register";
+    if (isRegister) registerSelected += 1;
+    const seat = seatRefusal(r);
+    if (seat) { unjudged.push({ row_id: r.row_id ?? null, kind: r.kind ?? null, select: selectionOf(r), cause: seat }); continue; }
+    if (!isRegister) continue;
+    if (rowIsSettled(r, r)) { registerRendered += 1; continue; }
+    const cause = registerFactRefusal(r) ?? "placement_invalid";
+    registerFacts[cause] = (registerFacts[cause] ?? 0) + 1;
+  }
+  return { unjudged, register_selected: registerSelected, register_rendered: registerRendered, register_facts: registerFacts };
 }
 
 /**

package/driver/placement-model.mjs

@@ -76,7 +76,7 @@ const ENTRY_KEYS = ["mark", "owner", "jurisdiction", "records", "tier", "reason"
 // decides it — a fluent, specific, entirely wrong reason passes this test, and should, because it is
 // arguable and arguing with it is the digest's job, not the parser's. B2 puts that judgment where it
 // belongs: the digest is instructed to adopt-or-counter each tier BY ENGAGING ITS STATED REASON
-// (stages.mjs + prelim-register/digest.md + synthesis-rules.md §1/§2), and narrative-refutation joins
+// (stages.mjs + clearance-register/digest.md + synthesis-rules.md §1/§2), and narrative-refutation joins
 // on the same JSON. This function only guarantees there is a reason to engage WITH. It is a floor
 // against a degenerate write, not a measure of quality, and it is deliberately the only test here that
 // looks at the reason's words at all.

package/driver/portal-config-view.mjs

@@ -51,11 +51,15 @@ import { readFlagSnapshot, engineFor, providersFor, postureDisagreement } from "
 // reading is, because the question it was standing in for — does this still describe the box — now has
 // a direct answer in `lastRun.disagrees`.
 import { engineMode } from "./config-inventory.mjs";   // — the mode is DERIVED at read time, never stored
+import { BILLING_MODES } from "./engine/auth.mjs";   // — the three words a capture's billing mode may be shown as
 // THE ENGINE TABLE, READ FOR TWO WORDS. A row saying an engine cannot run has to name the program it
 // could not find and the command that installs it, or the reader is told they have a problem and not
 // what to do about it — and this table is already where the wizard and the run-door preflight read
 // both of those, so naming them here adds no second description of an engine.
 import { ENGINE_BINARIES } from "./driver.config.mjs";
+// WHICH SETUP COMMAND THIS READER CAN TYPE, as a word and never a path: the same answer `/me` sends the
+// search screen, so the two pages name the same command for the same install.
+import { installRoute } from "../shared/invocation.mjs";
 
 /**
  * The flag view.
@@ -88,6 +92,12 @@ function withProgram(engine) {
     // layout and is deliberately kept out of anything a browser renders.
     program: spec?.fallback ?? null,
     install: spec?.install ?? null,
+    // The setting that names the program's full path, which is what an administrator sets when the
+    // services cannot find a program this machine has. A name, never its value.
+    programSetting: spec?.env ?? null,
+    // SETUP INSTALLS THE PROGRAM NOW, so a row saying it cannot be found names setup, the way this reader
+    // can run it: `packaged` or `checkout`.
+    setupRoute: installRoute(),
   };
 }
 
@@ -135,8 +145,27 @@ function postureView(snap) {
  * The capture does not go away; it stops being the answer. It becomes "what the last run saw", and its
  * job is to name any field on which it disagrees with the live reading.
  */
+/**
+ * A CAPTURE'S BILLING WORD, SHOWN ONLY WHEN IT IS ONE OF THE MODES.
+ *
+ * The inventory records a billing word that is not a mode as `unknown`, because whatever was typed into
+ * the setting that decides who pays can be a key pasted there by mistake. A capture written before it
+ * did holds the typed word itself, as its mode and inside its refusal's sentence, and this page would
+ * print it twice: in the last-run comparison, whose live side now reads `unknown`, and under a capture
+ * shown in place of a live reading. So such a capture is read as `unknown`, with no refusal sentence,
+ * which the page does not read anyway (it words the refusal from `reason`). Until the engine service
+ * restarts and writes its capture again, that is the only copy of the word the page could reach.
+ */
+function withKnownBillingWord(snap) {
+  const billing = snap?.engine?.billing;
+  if (!billing || typeof billing !== "object") return snap;
+  if (billing.mode == null || billing.mode === "unknown" || BILLING_MODES.includes(billing.mode)) return snap;
+  const { refusal: _typed, ...rest } = billing;
+  return { ...snap, engine: { ...snap.engine, billing: { ...rest, mode: "unknown" } } };
+}
+
 export function flagView(poolRoot, { live = null } = {}) {
-  const snap = readFlagSnapshot(poolRoot);
+  const snap = withKnownBillingWord(readFlagSnapshot(poolRoot));
 
   // NO LIVE POSTURE IS A DIFFERENT PAGE, NOT A DEGRADED ONE. A caller that supplied none cannot be
   // answered "live" at all, so this says which reading it is showing rather than presenting a capture

package/driver/portal-report.mjs

@@ -362,6 +362,12 @@ const MCP_HOST_RE = /https?:\/\/[A-Za-z0-9.-]+\/mcp/gi;
 // introduces it and the full stop that closes it — leaving either behind puts a stray break or an orphan
 // "." in the footer of every report.
 const RATED_UNDER_RE = /<br\s*\/?>Rated under:\s*<span class="mono">[^<]*<\/span>\./gi;
+// THE PROJECT LINE IS THE SAME CLASS AND WAS MISSING ITS STRIP. "Run under project: <name>" is
+// internal provenance — an end-to-end arm reads it out of the published internal report — and it sat
+// beside "Rated under" in the footer with nothing removing it here, so it reached every embedded
+// reader exactly as written: the engine's phrase for the folder a job was filed in, and the folder's
+// name. Same shape, same removal, one line apart.
+const RUN_UNDER_PROJECT_RE = /<br\s*\/?>Run under project:\s*<span class="mono">[^<]*<\/span>\./gi;
 
 const CONNECTOR_TOKEN_RE = /([?&])token=v1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+(&)?/g;
 
@@ -548,8 +554,24 @@ const EMBED_JS = `
       parent.postMessage({source:TAG,type:'controls',commands:have},'*');
     }catch(e){}
   }
+  // AND WHICH SECTIONS IT HOLDS. The renderer's own breadcrumb rides inside the report's sticky header,
+  // which this file strips, so the list arrives as a value (window.__CORD_SECTIONS, written above this
+  // script) and the shell draws it in its own header. Only the ids that are really in the document are
+  // announced: a report whose renderer named a section it did not draw would otherwise offer the reader
+  // a breadcrumb entry that jumps nowhere.
+  function sections(){
+    try{
+      var list=window.__CORD_SECTIONS;
+      if(!list||!list.length)return;
+      var live=[];
+      for(var i=0;i<list.length;i++) if(document.getElementById(list[i].id)) live.push(list[i]);
+      parent.postMessage({source:TAG,type:'sections',sections:live},'*');
+    }catch(e){}
+  }
   window.addEventListener('load',controls);
   document.addEventListener('DOMContentLoaded',controls);
+  window.addEventListener('load',sections);
+  document.addEventListener('DOMContentLoaded',sections);
   window.addEventListener('load',schedule);
   document.addEventListener('DOMContentLoaded',schedule);
   document.addEventListener('toggle',schedule,true);
@@ -564,6 +586,17 @@ const EMBED_JS = `
     // A FAILED COMMAND SAYS SO. This used to be catch(err){} — a button that did nothing, told nobody,
     // and left no console trace, which is how "Export does not work" went unnoticed through a whole
     // round of testing. The portal now hears about it and can say so.
+    // A BREADCRUMB PRESS IN THE SHELL'S HEADER. Not a verb the document defines — it is the anchor jump
+    // below, asked for from outside, and it answers on the same channel: reveal any collapsed ancestor,
+    // then post the target's document-relative top for the PARENT to scroll to, because this frame has
+    // no scrollport of its own. An id that is not in the document is ignored rather than failed: the
+    // shell only ever draws ids the document announced.
+    if(d.command==='section'){
+      var sec=document.getElementById(String(d.value||''));
+      if(sec){ revealTarget(sec); var t=Math.max(0,Math.ceil(sec.getBoundingClientRect().top+window.scrollY));
+        try{parent.postMessage({source:TAG,type:'scrollTo',top:t},'*');}catch(e){} schedule(); }
+      return;
+    }
     var fn = d.command==='exportPDF' ? (typeof exportPDF==='function'?exportPDF:null)
            : d.command==='pickAll'   ? (typeof pickAll==='function'?pickAll:null)
            : d.command==='openAll'   ? (typeof openAll==='function'?openAll:null)
@@ -589,7 +622,7 @@ const EMBED_JS = `
   // Registered AFTER the document's own script by construction (this block is appended at the end of
   // <body>), so by the time it runs for an '#c<ordinal>' link the ancestors are already open and the
   // measured offset is the revealed position. preventDefault stops the frame's dead-end fragment
-  // navigation for the links the document's handler does not claim (#common-law, #only-you).
+  // navigation for the links the document's handler does not claim (#common-law, #next).
   // AND WHEN THERE IS NO PARENT, DO NOT CANCEL THE CLICK.
   //
   // Everything above is right INSIDE the portal's Result screen. Un-framed it is a dead link: parent is
@@ -624,6 +657,28 @@ const EMBED_JS = `
     try{parent.postMessage({source:TAG,type:'scrollTo',top:top},'*');}catch(e){}
     schedule();
   });
+  // A FINDING'S OWN ASK AI. The document draws the button on every finding card and the portal holds the
+  // control, so the press crosses to the parent like the anchor jump above, carrying which finding it was.
+  // A clearance numbers its findings once, in the card's id; a knockout restarts its numbers for each name,
+  // so the name's position rides beside it. The "Also considered" cards carry the button and no number —
+  // a record that was ruled out was never given one — and still post, with the number null: the parent
+  // opens the control about the report rather than leaving a button that does nothing. Un-framed there is
+  // nobody to answer, so nothing is posted.
+  document.addEventListener('click',function(e){
+    var b=e.target.closest?e.target.closest('.ask-fi'):null;
+    if(!b||!framed)return;
+    var card=b.closest('.card');
+    var whole=function(v){var n=parseInt(v,10);return String(n)===String(v)&&n>=0?n:null;};
+    var koOrd=card?card.getAttribute('data-ko-ord'):null;
+    var idOrd=card&&(card.id||'').charAt(0)==='c'?card.id.slice(1):null;
+    var ord=koOrd!==null?whole(koOrd):(idOrd!==null?whole(idOrd):null);
+    var koMark=card?card.getAttribute('data-ko-mark'):null;
+    var mi=koMark!==null?whole(koMark):null;
+    // A press that cannot reach the page must not vanish: the button would look pressed and do nothing,
+    // the same silence a broken Export once hid behind. The console is the one place left to say so.
+    try{parent.postMessage({source:TAG,type:'askAi',ordinal:ord,markIndex:mi},'*');}
+    catch(err){try{console.warn('Ask AI could not reach the page: '+(err&&err.message||err));}catch(e){}}
+  });
   schedule();
 })();
 `;
@@ -740,8 +795,42 @@ const FEEDBACK_JS = `
 // Appended at the very end of <body>: the stylesheet is inlined into <head>, so a rule placed here wins
 // the cascade on equal specificity without needing !important, and the script runs with the document's
 // own functions already defined.
-function injectEmbedLayer(html, { feedback = false } = {}) {
-  const block = `<style data-embed="portal">${EMBED_CSS}</style><script data-embed="portal">${EMBED_JS}</script>`
+/**
+ * THE SECTION BREADCRUMB, LIFTED OUT BEFORE THE HEADER GOES (owner, 2026-09-18).
+ *
+ * The renderers emit the breadcrumb INSIDE `.rep-stickyhead` — one header, one sticky surface — and this
+ * function strips that header, because the portal draws its own. So the breadcrumb has to leave the
+ * document and arrive as data: the portal draws it in `.report-head`, beside READS, where it stays on
+ * top of a six-thousand-pixel read.
+ *
+ * It could not stay in the frame whatever this stripped. The frame is sized to its content
+ * (Result.tsx), so the framed document has no scrollport of its own and `position:sticky` inside it
+ * pins to nothing — which is exactly what a reader met: a bar sitting over the confidentiality line
+ * that scrolled away with the page.
+ *
+ * READ OFF THE MARKUP THE RENDERER WROTE, never recomposed from a list of section names here. A second
+ * copy of the vocabulary is how a renderer comes to disagree with the shell about what a report holds.
+ * Returns [] for a document with no strip — `sectionStrip()` emits none under two live sections — and
+ * the shell then draws no breadcrumb, which is the right answer rather than an empty row.
+ */
+const STRIP_NAV_RE = /<nav class="[^"]*\bstrip\b[^"]*"[^>]*>([\s\S]*?)<\/nav>/i;
+const STRIP_LINK_RE = /<a\b[^>]*\bdata-sec="([^"]+)"[^>]*>([\s\S]*?)<\/a>/gi;
+export function sectionsOf(html) {
+  const nav = STRIP_NAV_RE.exec(String(html ?? ""));
+  if (!nav) return [];
+  const out = [];
+  for (const m of nav[1].matchAll(STRIP_LINK_RE)) {
+    const label = m[2].replace(/<[^>]*>/g, "").replace(/\s+/g, " ").trim();
+    if (m[1] && label) out.push({ id: m[1], label });
+  }
+  return out;
+}
+
+function injectEmbedLayer(html, { feedback = false, sections = [] } = {}) {
+  // The breadcrumb list is a VALUE the injected script reads, not markup: `<` is escaped so a label can
+  // never close the script element it rides inside.
+  const secs = JSON.stringify(sections ?? []).replace(/</g, "\\u003c");
+  const block = `<style data-embed="portal">${EMBED_CSS}</style><script data-embed="portal">window.__CORD_SECTIONS=${secs};${EMBED_JS}</script>`
     + (feedback ? `<style data-embed="feedback">${FEEDBACK_CSS}</style><script data-embed="feedback">${FEEDBACK_JS}</script>` : "");
   const i = html.lastIndexOf("</body>");
   // No </body> means markup we do not recognise; appending is still correct and still parses.
@@ -781,6 +870,10 @@ export function prepareReportForEmbed(html, { staff = false, poolRoot = null, fe
   const note = (tag) => unbalanced.push(tag);
   const missingCss = [];
 
+  // READ BEFORE ANYTHING IS STRIPPED. The breadcrumb rides inside `.rep-stickyhead`, which the chrome
+  // strip below removes, so this is the last moment it exists.
+  const sections = sectionsOf(html);
+
   const nav = stripBalanced(html, NAV_RE, "nav", note);
   let out = nav.html;
   const strippedNav = nav.removed;
@@ -796,8 +889,16 @@ export function prepareReportForEmbed(html, { staff = false, poolRoot = null, fe
 
   // The footer fingerprint. Counted like the rest so a renderer change that moves it shows up as a zero
   // rather than as a line that quietly starts shipping again.
+  //
+  // ONE COUNTER PER LINE, AND THAT IS THE WHOLE POINT OF COUNTING. These two strips shared a counter, so
+  // the check that exists to catch a renderer moving this markup could not tell WHICH line moved: the
+  // renderer could rename one of them, that strip would match nothing, the other would still fire, and
+  // the count would read 1 exactly as it does when both work. A count that cannot fall to zero for one
+  // of the two things it counts is not a measurement of either.
   let ratedUnderDropped = 0;
+  let runUnderProjectDropped = 0;
   out = out.replace(RATED_UNDER_RE, () => { ratedUnderDropped += 1; return ""; });
+  out = out.replace(RUN_UNDER_PROJECT_RE, () => { runUnderProjectDropped += 1; return ""; });
 
   // ── THE ASK-AI BAND COMES OUT FOR EVERY READER ──────────────────────────────────────────────────
   //
@@ -851,11 +952,11 @@ export function prepareReportForEmbed(html, { staff = false, poolRoot = null, fe
 
   // After the stylesheet, so the injected rule sits later in the cascade than the sheet it overrides —
   // and after every strip, so nothing above can match the injected markup and eat it.
-  out = injectEmbedLayer(out, { feedback });
+  out = injectEmbedLayer(out, { feedback, sections });
 
   return {
-    html: out, strippedNav, neutralised, mcpLeaks, tokensDropped, ratedUnderDropped,
-    internalTailsDropped, reviewerCodesDropped, unbalanced, missingCss,
+    html: out, strippedNav, neutralised, mcpLeaks, tokensDropped, ratedUnderDropped, runUnderProjectDropped,
+    internalTailsDropped, reviewerCodesDropped, unbalanced, missingCss, sections,
   };
 }
 

package/driver/portal-service.mjs

@@ -98,6 +98,24 @@ import { fileURLToPath } from "node:url";
 // re-declared: one number, one count, and every existing importer of this module keeps working.
 export { DEFAULT_CLIENT_DAILY_RUNS, accountUsage };
 
+/**
+ * What a requester is told when the day's allowance is gone.
+ *
+ * ONE SENTENCE, TWO PLACES. The server refuses with it and the screen warns with it, and a reader who
+ * meets both must not meet two different sentences about the same fact. The browser cannot import this
+ * module, so the portal composes its own copy and `portal-ui/test/allowanceParity.test.ts` pins the two
+ * together — the same arrangement the effort model already has.
+ *
+ * NAMED, NOT ADDRESSED. It read "ask your <name> contact", which puts a possessive and a noun around a
+ * name that is already the answer: on a deployment that has configured no brand the portal's fallback is
+ * the words "the operator", and the sentence rendered "ask your the operator contact to run this one for
+ * you". The line beside it on the same screen had always said "ask <name>", and that is the one the
+ * approved design draws.
+ */
+export const allowanceExhaustedLine = (cap, who) =>
+  `You have used all ${cap} of this account's searches for today. `
+  + `The allowance resets at midnight UTC — or ask ${who} to run this one for you.`;
+
 // One sentence, two places (the capability payload and the route that refuses). Never names the
 // missing credential: this reaches a client screen, and our plumbing is not their business.
 //
@@ -111,7 +129,7 @@ export { DEFAULT_CLIENT_DAILY_RUNS, accountUsage };
 const INSTALL_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
 
 const READ_OFF_NOTE = "Reading a brief is not available on this instance — set the search up below.";
-import { basename, dirname, join, resolve as pathResolve } from "node:path";
+import { basename, dirname, join, resolve as pathResolve } from "node:path"; import { studioDirFor } from "../shared/pre-rename-spellings.mjs";
 import { driverDir } from "../shared/driver-dir.mjs";   //
 import { createHmac, timingSafeEqual } from "node:crypto";
 import { makePrincipal, assertPrincipal, genericOrgOf, mayReadRun, reachCovers, principalView, seesEverything, mayRun,
@@ -130,7 +148,7 @@ import { productRows, productRow, baseTurnaroundFor } from "./product-rows.mjs";
 import { resolveForDoor, gateResolvedRequest } from "./door-gates.mjs";
 import { resolveEffectiveScope } from "./effective-scope.mjs";
 import { quoteForJob } from "./run-quote.mjs";
-import { readFlagSnapshot, builtFor, registerCanCountFor, registerTerritoriesFor, caseLawReadyFor } from "./flag-snapshot.mjs";
+import { readFlagSnapshot, builtFor, registerCanCountFor, registerTerritoriesFor, registerLabelFor, caseLawReadyFor } from "./flag-snapshot.mjs";
 import { isDemo, demoPostureLine } from "./demo-posture.mjs";   
 import { triggerCapGap, triggerCapWarning } from "./trigger-cap.mjs";   // F51 — one answer, three surfaces
 import { makeUpstream } from "./portal-upstream.mjs";
@@ -468,7 +486,16 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, gener
       // zombie face this state exists to end. pausedKind "operator" tells the UI which words to use.
       const paused = s.state === "postponed" || s.state === "recovering" || s.state === "parked-for-human";
       out.push({ ...(liveRetired ? { retired: true } : {}),
-        runId: s.runId, account: owner, ...(owner === "generic" ? { organisation: p.organisation ?? null } : {}), title: s.markName ?? s.slug, kind: s.lane === "knockout" ? "knockout-batch" : "clearance",
+        runId: s.runId, account: owner, ...(owner === "generic" ? { organisation: p.organisation ?? null } : {}), title: s.markName ?? s.slug,
+        // THE RUN’S OWN PIPELINE, off the frozen policy sidecar this branch already reads — the same
+        // source the `product` field two lines down takes, so a row cannot contradict its own product.
+        // `s.lane` is the runner’s queue directory and it is not that: a knockout claimed from any other
+        // lane arrived here as a clearance, and Home then quoted it the clearance turnaround — hours,
+        // against a search that finishes in minutes. The queued rows below were fixed for exactly this
+        // and this row was left on the weaker field. The lane stays as the fallback for a run whose
+        // sidecar predates the stamp, and an unplaceable product stays a clearance, which is what every
+        // listing has always shown for something it could not identify.
+        kind: (policyFor(sp?.level)?.pipeline ?? (s.lane === "knockout" ? "knockout" : null)) === "knockout" ? "knockout-batch" : "clearance",
         markName: typeof s.markName === "string" ? s.markName : null,
         // The project, straight off the frozen sidecar this branch already reads as `p`. A LIVE run needs
         // no publish stamp and no back-fill — the sidecar is right there, and freezeProfile has written
@@ -650,7 +677,7 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, gener
   };
   // THE CANONICAL INTAKE FIRST, and it is why this parameter exists. `CLEAROTRON_QUEUE_DIR` is where the
   // enqueue CLI and ops-MCP `start_run` write — which is where the PORTAL's own submissions land, since
-  // its `trigger` is an ops-MCP hop. The walk below finds only `workspace-*/studio/prelim-search/queue`,
+  // its `trigger` is an ops-MCP hop. The walk below finds only `workspace-*/studio/clearance-search/queue`,
   // and a documented headless install has no workspaces at all: measured on the test box, the only queue
   // under the whole tree is the configured one, and it holds portal-prefixed jobs. So this scan ran ZERO
   // times there, and a submitted search was invisible on the dashboard from submit until claim — a
@@ -660,7 +687,7 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, gener
   }
   try {
     for (const ws of readdirSync(workspaceRoot).filter((n) => n.startsWith("workspace-"))) {
-      const studio = join(workspaceRoot, ws, "studio", "prelim-search");
+      const studio = studioDirFor(join(workspaceRoot, ws));
       let slugs = []; try { slugs = readdirSync(studio); } catch { continue; }
       for (const slug of slugs) {
         // Still walked, so a deployment whose queue is not in `queueDirs` keeps working. The union is
@@ -684,7 +711,7 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, gener
 // A failure `reason` is NOT client-safe, and the listing must not hand it to a browser.
 //
 // The engine writes `reason = String(e?.stack ?? e)` truncated to 200 characters
-// (pipeline.mjs:5366, pipeline-knockout.mjs:311). That is a raw stack trace: absolute filesystem
+// (pipeline.mjs, pipeline-knockout.mjs). That is a raw stack trace: absolute filesystem
 // paths, internal module names, provider error text. Useful to staff, and none of a client's business
 // — and redacting it in the UI would be theatre, because the field still travels over the wire and
 // sits in devtools whatever React chooses to render.
@@ -1230,6 +1257,10 @@ export function makePortalService({
   // THREE answers survive the read: null (unrestricted), an array, or undefined (the snapshot does not
   // say — fail open). registerTerritoriesFor is what keeps them apart.
   readTerritories = () => registerTerritoriesFor(readFlagSnapshot(poolRoot)),
+  // What to CALL the wired register on screen. Beside `readTerritories` and injected for the same
+  // reason: the covered set says a territory cannot be searched, and this says by what — the screen
+  // cannot name the register from the key without printing an engine identifier at a client.
+  readRegisterLabel = () => registerLabelFor(readFlagSnapshot(poolRoot)),
   // — whether this deployment has a case-law source enrolled at all. Same
   // injection and same snapshot as the two above, and the same tri-state: null is "the snapshot does not
   // say", which must not render as a warning on a working box.
@@ -1280,6 +1311,7 @@ export function makePortalService({
     const built = readBuilt();
     const canCount = readCanCount();
     const territories = readTerritories();
+    const registerLabel = readRegisterLabel();
     const caseLawReady = readCaseLaw();
     return {
       // Every product is LISTED whatever its state. A product that vanishes when unavailable leaves a
@@ -1300,7 +1332,24 @@ export function makePortalService({
         // explains a control that cannot be used, `coverageNote` qualifies one that can. Folding this
         // into the first would make every caller of `productAvailability` — the portal, the MCP door,
         // the dev cockpit — read a disclosure as a refusal, which is the behaviour the ruling removes.
-        const coverage = coverageDisclosure(l.geography, territories);
+        // ── THE PRODUCT ROWS CARRY NO COVERAGE SENTENCE ───────────────────────────────────────────
+        //
+        // This row printed a four-line paragraph — what the wired register reaches, of how many places
+        // this search can name, and that the rest would be disclosed in the report as deferred coverage
+        // rather than reported as clear. The owner met it on a running install and ruled it out on
+        // 2026-09-18: it is on no board, and it describes the behaviour that naming an unreachable
+        // territory no longer has. A named territory the register cannot reach is now refused at the
+        // door, in one sentence naming the territory — so a paragraph promising to defer it instead
+        // tells the reader the opposite of what the engine will do.
+        //
+        // NOTHING REPLACES IT, AND NO OTHER ROW GETS ONE. What a worldwide search on a partial register
+        // actually reached belongs in the report that describes the search that ran, not in the form
+        // that orders it.
+        //
+        // THE SENTENCE STILL EXISTS, one surface later, and deliberately: the review step before the
+        // spend still states what is being bought. That is a different question asked at a different
+        // moment — this row is "which search", that screen is "this is what you are committing to" —
+        // and it was a separate ruling. `coverageDisclosure` keeps composing it for that caller.
         // ── — THE PRODUCT DECLARES WHAT IT NEEDS, so the row can say so ─────
         //
         // The owner ordered the one product carrying `caseLaw: true` and first heard of the lane in the
@@ -1317,7 +1366,7 @@ export function makePortalService({
         // a warning on every deployment whose writer has not run since is worse than the silence it
         // replaces.
         return { ...l, available: cause === null, unavailableNote: cause ? UNAVAILABLE_NOTE[cause] : null,
-          coverageNote: coverage?.note ?? null,
+          coverageNote: null,
           capabilityNote: l.caseLaw && caseLawReady === false ? CASE_LAW_DARK_NOTE : null };
       }),
       // ── the TERRITORY affordance ─────────────────────────────────────────────────────────────
@@ -1335,6 +1384,16 @@ export function makePortalService({
       // not told me", which fails open. A `covered ?? []` anywhere on this path offers zero territories
       // on a production box.
       ...(territories === undefined ? {} : { territories }),
+      // THE REGISTER'S NAME, sent whenever there is one. The covered set alone lets the screen mark a
+      // territory as unreachable; it cannot say by WHAT, and the sentence the door refuses with names
+      // the register ("China is not available with Signa, the register configured here"). A screen that
+      // marked a chip without naming the register would be a second, vaguer wording for one fact.
+      //
+      // OMITTED, never nulled, exactly as `territories` above: absent means this deployment did not say,
+      // and the screen must then mark the territory without naming a register rather than invent one.
+      // It is the register's own display label, never the provider key — the key is an engine
+      // identifier and has no place on a client's screen.
+      ...(registerLabel ? { registerLabel } : {}),
       // `base` and `nativeLanguage` ride the LIST row, not just the record: the composer has to say what
       // geography a saved search accepts while the row is being clicked, and fetching the record per
       // selection would put that answer one round trip behind the Review button. Only `true` travels for
@@ -1700,7 +1759,7 @@ export function makePortalService({
         // The recipeKey arm that used to sit here (a 422 when saved searches were "not switched on") went
         // with CLEAROTRON_RECIPES_MODE on 2026-07-27: a saved search is now honoured wherever it resolves.
         // Asked of the RESOLVED product, not of the body: a request that names none resolves through
-        // the account's default and its own territories, and the old read (`body.searchLevel || "prelim"`)
+        // the account's default and its own territories, and the old read (`body.searchLevel || "clearance"`)
         // answered about a product nobody had chosen. `resolveFor` fails open to a null resolution, and a
         // null one is not judged here — validateJob and the scope rules below still run, and the runner
         // is the wall.
@@ -1842,9 +1901,7 @@ export function makePortalService({
           return null;
         }
         if (used.today + 1 <= limit) return null;
-        return { status: 429, json: { ok: false, errors: [
-          `You have used all ${limit} of this account's searches for today. The allowance resets at midnight UTC — or ask your ${BRAND.name} contact to run this one for you.`,
-        ] } };
+        return { status: 429, json: { ok: false, errors: [allowanceExhaustedLine(limit, BRAND.name)] } };
       };
 
       // /portal/api/run/plan — the confirmation gate (no spend)
@@ -2463,8 +2520,14 @@ async function connectorDoorKind(url) {
         //
         // COMPOSED IN ONE PLACE and handed over as a string. The browser cannot know this install's
         // path, so the three surfaces stating this route cannot drift apart even if someone tries.
+        //
+        // AND IT NAMES THE DISTRIBUTION, like every other surface that states this route. Without the
+        // target this one composer answers as it does for an install that is not under WSL at all, so on
+        // a WSL box this field alone carried the inside-WSL line while the rows beside it led with the
+        // Windows-side one. Nothing draws this field today; it is on the wire, and a field that answers
+        // differently from the rows is a trap for whoever draws it next.
         const stdio = seesEverything(principal)
-          ? stdioConnectOffer({ workDir: process.env.CLEAROTRON_WORK_DIR || null, reportsDir: process.env.CLEAROTRON_REPORTS_DIR || null })
+          ? stdioConnectOffer({ workDir: process.env.CLEAROTRON_WORK_DIR || null, reportsDir: process.env.CLEAROTRON_REPORTS_DIR || null, wsl: wslTarget() })
           : null;
 
         // ── THE PAGE IS HANDED ANSWERS, NOT FACTS TO REASON FROM ─────────────
@@ -3011,7 +3074,10 @@ async function connectorDoorKind(url) {
           // who signed in. Dynamic import deliberately: `profiles.mjs` captures the store directory at
           // MODULE LOAD (see this file's note above), so it is never pulled in at our own load time.
           const { companyFactsOf } = await import("./profiles.mjs");
-          return { status: 200, json: { customers: [...profiles.values()].map((p) => ({ key: p.key, name: p.name, ...companyFactsOf(p) })) } };
+          // A company whose file would not load is named with its reason (staff-only route), never left out
+          // in silence: a switcher with one company where there were twenty-five reads as deleted work.
+          const unreadable = Array.isArray(profiles?.unreadable) ? profiles.unreadable.map((u) => ({ key: u.key, reason: u.reason })) : [];
+          return { status: 200, json: { customers: [...profiles.values()].map((p) => ({ key: p.key, name: p.name, ...companyFactsOf(p) })), ...(unreadable.length ? { unreadable } : {}) } };
         }
         // /portal/admin/config — what this deployment actually has switched on. Read from the SNAPSHOT,
         // never from process.env: this process has no engine environment, so asking its own env would

package/driver/portal-upstream.mjs

@@ -98,7 +98,7 @@ export const PATH_FIELDS = ["frameworkPath", "workedExamplesPath"];
 /**
  * The code-owned values, READ-ONLY, for display. The page shows them badged; it cannot send them.
  *
- * Two of them are PATHS INSIDE THE ENGINE — `skills/prelim-search/risk-framework-<customer>.md` — and they
+ * Two of them are PATHS INSIDE THE ENGINE — `skills/clearance-search/risk-framework-<customer>.md` — and they
  * are withheld from a client here, on the server, where the role is already in hand. The React page has
  * filtered them out of its own render since the rebuild, but a filter in the browser is a display
  * convenience and not a wall: the value still crossed the wire and was one devtools tab away.

package/driver/predelivery-lint.mjs

@@ -32,7 +32,7 @@ import { writeUpViolations, writeUpMessage } from "./narrative-write-ups.mjs";
 import { findRegistryArithmeticIssues, findRegistryViolations, splitBlocks } from "./registry-fidelity.mjs";
 import { CLIENT_TIER_BY_COMPOSITE, joinFindingToBlock, parseBlockOrd, worstLiveBand, NO_RATED_CONFLICTS, deriveActionConditions, isUnconditionalProceed, verdictStance, joinAskToAnswer, projectAssessmentField, POSITION_REQUIRED_DISPOSITIONS, OFF_FIELD_GROUNDS, FINDINGS_SCHEMA_VERSION, netChainMarkers, STATEMENT_CLAUSE_MAX } from "./findings-model.mjs";
 import { normalizeBand } from "./framework.mjs";
-import { clientConditions, ENGINE_TOKEN_RE } from "./terminal-clamp.mjs";   // the reader's clause per condition, and the token shape it may never carry
+import { clientConditions, unrenderableConditions, ENGINE_TOKEN_RE } from "./terminal-clamp.mjs";   // the reader's clause per condition, and the token shape it may never carry
 import { knockoutNoteView, REQUEST_NOTE_WORDS, REQUEST_SUBJECT_WORDS } from "./findings-model.mjs";   // one reader for where a note prints
 import { isEngineAppendedCaveat } from "./verify-knockout.mjs";   // ONE derivation for "the engine appended this caveat, not a seat"
 
@@ -1976,10 +1976,20 @@ export function clientConditionVoiceChecks({ verdictDoc }) {
   const carrying = clientConditions(verdictDoc)
     .map((c) => ({ c, m: String(c).match(ENGINE_TOKEN_RE) }))
     .filter((x) => x.m);
+  // THE SECOND CHECK IS WHAT KEEPS THE FIRST ONE HONEST. The fallback now composes the reader's
+  // sentence from a pre-split reason's own counts, and DROPS a token-bearing reason it cannot compose
+  // one for. Both outcomes leave the first check passing, and they mean opposite things: one is the
+  // condition reaching the client in a lawyer's nouns, the other is the condition reaching nobody. A
+  // single check reporting a clean page for both would be an absence read as a pass.
+  const dropped = unrenderableConditions(verdictDoc);
   return [check("client-condition-voice", "verdict", "report", carrying.length === 0,
     carrying.length
       ? `${carrying.length} delivered condition${carrying.length === 1 ? "" : "s"} carr${carrying.length === 1 ? "ies" : "y"} an engine identifier, so the client's "conditional on:" list reads the run record rather than the reader's sentence: ${carrying.slice(0, 3).map((x) => `"${x.m[0]}"`).join(", ")}${carrying.length > 3 ? ` (+${carrying.length - 3} more)` : ""}. The clause exists at the clamp site; persist it and this list takes it. A sidecar written before clauses were persisted flags until the run is re-generated.`
-      : "")];
+      : ""),
+    check("client-condition-dropped", "verdict", "report", dropped.length === 0,
+      dropped.length
+        ? `${dropped.length} condition${dropped.length === 1 ? " was" : "s were"} recorded for this run and reach no client surface: the run-record reason carries an engine identifier and no reader's sentence was stored or could be composed from it, so it is dropped rather than printed in engine voice. The report ships without it and the run record keeps it: ${dropped.slice(0, 2).map((r) => `"${r.slice(0, 80)}…"`).join(", ")}${dropped.length > 2 ? ` (+${dropped.length - 2} more)` : ""}. Add the defect's sentence to the clause authority in terminal-clamp.mjs, or persist a clause at the clamp site.`
+        : "")];
 }
 
 export function statementCoherenceChecks({ verdictDoc }) {

package/driver/preserve-merge.mjs

@@ -9,7 +9,7 @@
 // the fifteen return-path transports were measured with that hole:
 //
 //   record_report_overview   actions, methodology, handling_note   (a section of the client's report)
-//   record_prelim_variants   incumbent_classes, watchlist_owners, search_floor
+//   record_clearance_variants   incumbent_classes, watchlist_owners, search_floor
 //   record_blind_frame       sources
 //   record_matter_frame      scope_jurisdictions, excluded_jurisdictions
 //   record_unit_note         null_result, note
@@ -65,8 +65,8 @@ export function refuseUndeclared(params, declared, token, path = "") {
     // does not declare it: `narrative.corrections`, accepted and dropped. That is what this refuses.
     //
     // Refusing unknown TOP-LEVEL keys as well was the first cut, and it was wrong. Real traffic carries
-    // envelope fields the tool schema does not declare — the prelim-variants mock sends
-    // `schema_version`, which `acceptPrelimVariants` ignores because it writes its OWN
+    // envelope fields the tool schema does not declare — the clearance-variants mock sends
+    // `schema_version`, which `acceptClearanceVariants` ignores because it writes its OWN
     // `schema_version: SCHEMA_VERSION` into the model. Inert for as long as it has existed, and the
     // strict version made it FATAL: the whole stage refused, the run dead, for a key nobody reads.
     //

package/driver/product-rows.mjs

@@ -25,7 +25,7 @@
 //
 // So: a third module that contaminates neither, and one place to pin.
 
-import { ORDERABLE_PRODUCTS, PRODUCT_POLICIES, RETIRED_POLICIES, policyFor } from "./search-policy.mjs";
+import { ORDERABLE_PRODUCTS, PRODUCT_POLICIES, RETIRED_POLICIES, policyFor, productKeyAsRenamed } from "./search-policy.mjs";
 import { maxNamesFor, productSpec } from "./products.mjs";
 import { leversFromResolved, turnaround, turnaroundHours } from "./effort-model.mjs";
 
@@ -96,7 +96,7 @@ export function baseTurnaroundFor(policy) {
  * exactly what shipped before.
  */
 export function productRow(key) {
-  const k = String(key ?? "").trim().toLowerCase();
+  const k = productKeyAsRenamed(key);   // a pre-rename key names the same product
   const p = PRODUCT_POLICIES[k] ?? RETIRED_POLICIES[k];
   if (!p) return null;
   const base = baseTurnaroundFor(p);