clearotron 0.3.2-beta.7 → 0.3.2-beta.9

package/driver/products.mjs

@@ -405,7 +405,7 @@ export function nativeLanguageMode(product) {
  *
  * Exported because two surfaces outside this module have to say it and both used to say something else:
  * the resolution-time recommendation (jx-lanes.mjs zhScopeDepthNotes) and the DELIVERED REPORT's own
- * coverage row (pipeline.mjs scriptScopeDisclosure). Both named `prelim-jx` and `Depth 5` — an internal
+ * coverage row (pipeline.mjs scriptScopeDisclosure). Both named `clearance-jx` and `Depth 5` — an internal
  * product key and a rung on a ladder — so the coverage row named a remedy that was a product
  * deleted, quoted at a number that no longer exists, and could not have ordered either.
  *

package/driver/profiles/README.md

@@ -53,8 +53,8 @@ consumes it; a unit test greps each symbol, so a field with no live consumer fai
 | `delivery` | delivery | `{ email: "summary", privileged: bool }` — the "Privileged & Confidential" header. Two further optional sub-keys are accepted: `style` (a prose string, guarded by the same anti-rule check as a context pack, dictated into the `report-overview` and `report-card` stages as presentation tone and never to `synthesis`, the rating stage) and `template` (a report-template name; `"standard"` is the only one that exists, and it is the default). **Absent ⇒ neutral default** (`{email:"summary"}` — deliberately SILENT on `privileged`, which is three-state on every surface that reads it (`confPosture`): `true` extends the marking to "Attorney Work Product", `false` is a deliberate OFF, and absent is no opinion, which gets the plain "Privileged & Confidential" every legal deliverable carries. Saying `false` in the neutral overlay read as an instruction to strip the marking, and a Generic-default clearance shipped with no line at all). `email` no longer selects anything: every run's mail is a COVER NOTE pointing at the one report. The old `"table"` value — a full review table inlined into the mail body — is **retired**; it is still accepted at load so stored profiles keep validating, and folded to `"summary"` by `normalizeDelivery`. A customer who wants their own house format gets it drafted by the assistant from the run's `report-data.json`, where a person reads it before it goes |
 | `riskAppetite` | context | a PROSE-POSTURE string (optional) that flavours **emphasis + recommended follow-up** in delivery curation — the two stages that are dictated it, `report-overview` and `report-card` — **never the Level/Composite**. A load-time anti-threshold guard rejects numeric/threshold phrasing (`>50%`, `Level C or above`, `threshold`); the "never decides" invariance itself is gated by review |
 | `marketplaceDensity` | structural | `"sparse"` (default) \| `"dense"` — selects the per-profile grid cell budget so a byte-heavy marketplace's verbatim stdout fits the worker output channel (sparse ⇒ 98-cell budget; dense ⇒ 16). Dense fits long retail listings (beverages and supplements); gaming stores stay sparse |
-| `frameworkPath` | rating authority | optional path to the customer's OWN risk framework (`skills/prelim-search/<file>.md`, path-escape-blocked). **The framework in force RATES the matter** — the customer's own if on file, else the Generic default `risk-framework.md`; nothing in between. Each framework is a prose deck (the client's own rubric, reasoned WITH) plus a `.manifest.json` sidecar carrying its band vocabulary (`test/framework-lint.test.mjs` guards the pair). Git + legal-team gated; the config UI shows which is in force, read-only |
-| `workedExamplesPath` | context | optional path to a per-customer worked-examples set (`skills/prelim-search/<file>.md`). The analysis DEPTH TARGET in `synthesis`, calibrated under that customer's framework; **absent ⇒ the Generic default `worked-examples.md`** |
+| `frameworkPath` | rating authority | optional path to the customer's OWN risk framework (`skills/clearance-search/<file>.md`, path-escape-blocked). **The framework in force RATES the matter** — the customer's own if on file, else the Generic default `risk-framework.md`; nothing in between. Each framework is a prose deck (the client's own rubric, reasoned WITH) plus a `.manifest.json` sidecar carrying its band vocabulary (`test/framework-lint.test.mjs` guards the pair). Git + legal-team gated; the config UI shows which is in force, read-only |
+| `workedExamplesPath` | context | optional path to a per-customer worked-examples set (`skills/clearance-search/<file>.md`). The analysis DEPTH TARGET in `synthesis`, calibrated under that customer's framework; **absent ⇒ the Generic default `worked-examples.md`** |
 | `defaultProduct` | entitlement | which of the four searches runs when a request names none (`search-policy.mjs`). May be left unset, and that is not a gap — a clearance that names no product is then named by its own resolved territories |
 | `allowedRecipes[]` | entitlement | the closed menu of searches this account may trigger; non-empty when present, and **absent ⇒ everything allowed** |
 | `jxPolicy` | entitlement | the native-language deepening POSTURE — declared lanes / escalation / provider stance. Policy, never capability; frozen into the run sidecar so a resume keeps the posture the run started under |
@@ -90,7 +90,7 @@ value into a profile file is a load-time error.
    the write door: the same profile saved through the editor is a validated auto-commit with no PR in
    it, and the shared load-time validators are what both paths cannot get past.
 3. **Rewrite check:** the skills are platform-agnostic (they follow the dictated list), but read
-   `skills/prelim-common-law/SKILL.md` + `perplexity-prompts.md`, `skills/prelim-search/SKILL.md` +
+   `skills/clearance-common-law/SKILL.md` + `perplexity-prompts.md`, `skills/clearance-search/SKILL.md` +
    `phase2-execution.md`, and the driver message prose in `stages.mjs` once against the new
    industry — worked examples are gaming-flavored by history.
 4. ONE validation run against a known/synthetic matter: confirm the grid swept exactly the

package/driver/profiles/demo-brand-owner.json

@@ -17,8 +17,8 @@
   "delivery": { "email": "summary", "privileged": false },
   "riskAppetite": "Evidence-first. Lead with the register position, then say plainly what the common-law picture adds or fails to settle. Name coverage limits in the body rather than in a footnote — an unread source is a fact about the search, not a caveat about the report. Keep crowded-field noise brief.",
   "defaultProduct": "multi-country-focus-search",
-  "frameworkPath": "skills/prelim-search/risk-framework-demo.md",
-  "workedExamplesPath": "skills/prelim-search/worked-examples-demo.md",
+  "frameworkPath": "skills/clearance-search/risk-framework-demo.md",
+  "workedExamplesPath": "skills/clearance-search/worked-examples-demo.md",
   "jxPolicy": { "laneDepth": { "ja": "full", "ko": "candidates" } },
   "runCaps": { "dailyRuns": 12, "maxQueued": 2 }
 }

package/driver/profiles.mjs

@@ -346,9 +346,12 @@ export const FIELD_CONSUMERS = {
 
 // Per-customer reasoning-skill selection. frameworkPath is the customer's OWN risk framework — under doc 50
 // it RATES the matter; absent ⇒ the Generic default rates it (DEFAULT_FRAMEWORK in framework.mjs). Constrained to
-// the prelim-search skill dir + a .md suffix so a profile cannot point the synthesis read at an arbitrary
+// the clearance-search skill dir + a .md suffix so a profile cannot point the synthesis read at an arbitrary
 // path. The SHARED doctrine lives identically across the per-customer frameworks; only the examples diverge.
-const SKILL_PATH_RE = /^skills\/prelim-search\/[A-Za-z0-9._-]+\.md$/;
+// The folder's pre-rename spelling is accepted as the same folder: a store written before the rename names it,
+// and one unmigrated profile must not take a company, or the whole roster, off the list. The file is read
+// from whichever spelling the store holds (config.resolveSkillPath).
+const SKILL_PATH_RE = /^skills\/(?:clearance|prelim)-search\/[A-Za-z0-9._-]+\.md$/;
 
 // The delivery overlay every run gets. `email` is no longer a choice: every run's mail is a COVER NOTE
 // pointing at the report (one report, one shape, per-lawyer client mail drafted by the assistant).
@@ -566,11 +569,11 @@ function validateProfileShape(key, p, { sparse = false } = {}) {
     die(`marketplaceDensity must be ${MARKETPLACE_DENSITIES.map((v) => `"${v}"`).join(" or ")} `
       + `(got "${p.marketplaceDensity}")`);
   // frameworkPath / workedExamplesPath (optional, Phase 2): a per-customer reasoning-skill file. Constrained
-  // to skills/prelim-search/*.md (no path escape) — a profile selects a SHIPPED skill, never an arbitrary path.
+  // to skills/clearance-search/*.md (no path escape) — a profile selects a SHIPPED skill, never an arbitrary path.
   for (const k of ["frameworkPath", "workedExamplesPath"]) {
     if (p[k] == null) continue;
     if (typeof p[k] !== "string" || !SKILL_PATH_RE.test(p[k]) || p[k].includes(".."))
-      die(`${k} must be a path of the form "skills/prelim-search/<file>.md" (got ${JSON.stringify(p[k])})`);
+      die(`${k} must be a path of the form "skills/clearance-search/<file>.md" (got ${JSON.stringify(p[k])})`);
   }
   // defaultProduct (optional): one of the four in the offering, by id. A typo hard-fails at load rather
   // than silently running the wrong-priced product on every job.
@@ -679,25 +682,42 @@ let cache = null;
 /** Read one directory of profiles/<key>.json → Map(key → profile). No generic requirement and no
  *  matchDomains check here: both are properties of the MERGED roster, not of one layer, and asserting
  *  them per-layer would refuse a base+overlay pair that is perfectly valid once combined. */
-function readProfilesLayer(dir) {
+// ONE COMPANY THAT CANNOT BE READ MUST NOT TAKE THE OTHERS WITH IT — on the deployment's own store. Strict,
+// every file or none, is right for an explicit directory: that is how this loader's rules are checked. On the
+// configured store it refused every company over one file, and the portal then offered `generic` alone with
+// no error, so a client's clearances looked deleted. So `tolerant` isolates each file: a company that fails is
+// left out, its reason is kept on the returned map as `unreadable`, and asking for it by key refuses with that
+// reason (resolveProfile). `generic` is never tolerated: it is the fallback every unprofiled job rates under,
+// and replacing a deployment's own with the bundled one would change every such answer without a word.
+function readProfilesLayer(dir, { tolerant = false } = {}) {
   const profiles = new Map();
+  const unreadable = [];
   for (const f of readdirSync(dir).filter((n) => n.endsWith(".json")).sort()) {
     const key = f.replace(/\.json$/, "");
-    let p;
-    try { p = JSON.parse(readFileSync(join(dir, f), "utf8")); }
-    catch (e) { throw new Error(`profiles/${f}: unparseable JSON (${e.message})`); }
-    validateProfileShape(key, p);
-    // Context pack (Phase 1): a sibling `<key>.context.md`, attached AFTER validateProfileShape so the
-    // deny-unknown-key gate (which governs the JSON shape) never sees it. Optional — absent ⇒ no pack.
-    // Validated at load (rule-shape + size budget) so a bad pack fails loudly here, like riskAppetite (F8).
-    const packPath = join(dir, CONTEXT_PACK_FILE(key));
-    const contextPack = existsSync(packPath) ? readFileSync(packPath, "utf8").trim() : "";
-    if (contextPack) assertContextPackShape(contextPack, `profiles/${CONTEXT_PACK_FILE(key)}`);
-    profiles.set(key, { key, ...p, ...(contextPack ? { contextPack } : {}) });
+    try {
+      let p;
+      try { p = JSON.parse(readFileSync(join(dir, f), "utf8")); }
+      catch (e) { throw new Error(`profiles/${f}: unparseable JSON (${e.message})`); }
+      validateProfileShape(key, p);
+      // Context pack (Phase 1): a sibling `<key>.context.md`, attached AFTER validateProfileShape so the
+      // deny-unknown-key gate (which governs the JSON shape) never sees it. Optional — absent ⇒ no pack.
+      // Validated at load (rule-shape + size budget) so a bad pack fails loudly here, like riskAppetite (F8).
+      const packPath = join(dir, CONTEXT_PACK_FILE(key));
+      const contextPack = existsSync(packPath) ? readFileSync(packPath, "utf8").trim() : "";
+      if (contextPack) assertContextPackShape(contextPack, `profiles/${CONTEXT_PACK_FILE(key)}`);
+      profiles.set(key, { key, ...p, ...(contextPack ? { contextPack } : {}) });
+    } catch (e) {
+      if (!tolerant || key === "generic") throw e;
+      unreadable.push({ key, file: f, reason: String(e?.message ?? e) });
+    }
   }
+  Object.defineProperty(profiles, "unreadable", { value: unreadable, enumerable: false });
   return profiles;
 }
 
+/** The companies a roster left out because their file would not load: `[{ key, file, reason }]`. */
+export const unreadableProfiles = (profiles) => (Array.isArray(profiles?.unreadable) ? profiles.unreadable : []);
+
 /** Load every profiles/<key>.json → Map(key → profile), OVERLAY OVER BASE. Hard-fails loudly
  *  on a generic.json missing from BOTH layers (the universal fallback — its absence would mis-profile
  *  EVERY job), on a configured-but-unreadable overlay, and on any matchDomains overlap in the merged
@@ -746,7 +766,7 @@ export function loadProfiles({ dir, force = false, includeTestFixtures, includeD
   // the universal fallback the module REQUIRES by name, the thing every unprofiled job resolves to. That
   // is the one file whose absence makes an empty store a refusal, so that is the only one that falls
   // through. Everything else in a deployment's roster is the deployment's own.
-  const profiles = overlay ? readProfilesLayer(overlay) : readProfilesLayer(baseDir);
+  const profiles = overlay ? readProfilesLayer(overlay, { tolerant: true }) : readProfilesLayer(baseDir);
 
   // ── A TEST FIXTURE IS PRESENT AND NEVER OFFERED ─────────────────────────────────────────────────
   //
@@ -855,6 +875,15 @@ export function loadProfiles({ dir, force = false, includeTestFixtures, includeD
 export function resolveProfile(job, { profiles = loadProfiles() } = {}) {
   const key = String(job?.profileKey ?? "").trim();
   if (key && profiles.has(key)) return profiles.get(key);
+  // A company whose file would not load is not an unknown company: say which, and why.
+  const unread = unreadableProfiles(profiles);
+  const failed = key ? unread.find((u) => u.key === key) : null;
+  if (failed) {
+    const err = new Error(`profile_unreadable:${key} — ${failed.reason}. The company exists but its profile could not be read, `
+      + `so this run is refused rather than rated under another company's settings.`);
+    err.code = "profile_unreadable";
+    throw err;
+  }
   // A NAMED-but-unknown key is not a graceful-degradation case, it is a roster mismatch — the two
   // sides disagree about which config store is real, and falling back to `generic` silently strips
   // the client's platforms, their self-exclusion seed and the framework that RATES the matter. That
@@ -875,6 +904,15 @@ export function resolveProfile(job, { profiles = loadProfiles() } = {}) {
       if (dom === dl || dom.endsWith(`.${dl}`)) return p;
     }
   }
+  // WITH A COMPANY UNREAD, "no company matched" is not known: the unread one's domains are not in hand, and
+  // this job may be its. Falling to `generic` here is the silent wrong-company deliverable, so refuse.
+  if (unread.length) {
+    const err = new Error(`profile_roster_incomplete — ${unread.length} company profile(s) could not be read `
+      + `(${unread.map((u) => u.file).join(", ")}), so whether this job belongs to one of them cannot be decided. `
+      + `Name the company on the job, or fix the file.`);
+    err.code = "profile_roster_incomplete";
+    throw err;
+  }
   return profiles.get("generic");
 }
 

package/driver/progress.mjs

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
-// progress.mjs — live run status for the prelim-search driver.
+// progress.mjs — live run status for the clearance-search driver.
 //
 // Two artifacts, both written by the driver into the FORWARDING agent's own workspace
 // (so the agent's sandboxed read tool can see them — agents can't exec, so on-demand status is a
@@ -14,7 +14,7 @@
 // blindly incremented — so the resumable pipeline can re-drive a run without corrupting either file.
 
 import { readFileSync, writeFileSync, renameSync, unlinkSync, readdirSync, statSync, existsSync } from "node:fs";
-import { join, dirname } from "node:path";
+import { join, dirname } from "node:path"; import { STUDIO_SEGMENT_RE } from "../shared/pre-rename-spellings.mjs";
 import { DRIVER_DIR } from "../shared/driver-dir.mjs";   //
 import { config } from "./driver.config.mjs";
 import { batchMarkName } from "./mark-name.mjs";
@@ -29,7 +29,7 @@ import { engineCommit, engineCommitSource } from "./engine-build.mjs";   // —
 // driver's execution units (fan-out register axes, skeptic-escalation re-runs, corrective re-synthesis,
 // two refutation passes) onto a clean forward-only sequence, so the displayed step never jumps backward.
 export const DISPLAY_STEPS = [
-  "Framing the matter",     // 1  matter-frame, prelim-variants
+  "Framing the matter",     // 1  matter-frame, clearance-variants
   "Register sweeps",        // 2  common-law + register-unit:* (fan-out + escalation re-runs collapse here)
   "Placement & digest",     // 3  placement-inquiry, register-digest (+ re-digest)
   "Skeptic review",         // 4  skeptic
@@ -48,7 +48,7 @@ export const DISPLAY_STEPS = [
 // UNLABELLED GAP on the stepper the client watches — the run looks stalled while it is working. Three
 // stages were sitting in that state (blind-frame, frame-diff, doubt-closure); each now says so by name.
 export const STAGE_TO_STEP = {
-  "matter-frame": 0, "prelim-variants": 0,
+  "matter-frame": 0, "clearance-variants": 0,
   "common-law": 1, "common-law-half": 1, "register-unit": 1,
   "placement-inquiry": 2, "register-digest": 2,
   skeptic: 3,
@@ -398,11 +398,21 @@ export function seedRunStatus(ctx, { resume = false } = {}) {
   }, null, { critical: true });   // door B — the clearance lane's identity seed, same rule
 }
 
-// Convenience: advance the run to the step for `rawStageKey` (no-op for unmapped keys) then refresh STATUS.md.
+// Record that the run is at `rawStageKey`: advance the displayed step where the stage has one, and say
+// what the run is doing either way, then refresh STATUS.md.
+//
+// AN UNMAPPED STAGE MOVES NO STEP AND IS STILL SOMETHING THE RUN IS DOING. This returned early for one,
+// so it wrote no `lastStage` at all — and `lastStage` is what status-snapshot publishes as "what the run
+// is actually doing". Three stages have no display step ON PURPOSE (STAGE_NO_STEP names each and why),
+// so for the whole of any of them every surface went on naming the PREVIOUS stage, which is the same
+// defect as a stale step wearing a different field. The step fields are still withheld — that part of
+// the early return was right, and an unmapped stage must never touch the displayed step.
 export function recordTransition(ctx, rawStageKey) {
   const step = stepForStage(rawStageKey);
-  if (!step) return;
-  writeRunStatus(ctx, { stepIndex: step.index, stepLabel: step.label, stepN: step.n, stepTotal: step.total, lastStage: rawStageKey });
+  writeRunStatus(ctx, {
+    ...(step ? { stepIndex: step.index, stepLabel: step.label, stepN: step.n, stepTotal: step.total } : {}),
+    lastStage: rawStageKey,
+  });
   rollupStatus(ctx?.run?.studioRoot);
 }
 
@@ -424,7 +434,7 @@ function findStatusFiles(root, depth, acc) {
 }
 
 function agentFromStudioRoot(studioRoot) {
-  const m = new RegExp(`${config.workspacePrefixRe}([^/]+)/studio/prelim-search/?$`).exec(studioRoot ?? "");
+  const m = new RegExp(`${config.workspacePrefixRe}([^/]+)/studio/${STUDIO_SEGMENT_RE}/?$`).exec(studioRoot ?? "");
   return m ? m[1] : "";
 }
 

package/driver/provider-usage.mjs

@@ -14,9 +14,9 @@
 //
 // This module is read-only and defensive: a missing/unreadable ledger or a torn last line (two gateway
 // turns appending concurrently) returns zeros / skips that line — it never throws. The driver calls it at
-// publish time to attribute THIS run's calls by the session-key prefix `prelim-<slug>-<codename>-`.
+// publish time to attribute THIS run's calls by the session-key prefix `clearance-<slug>-<codename>-`.
 
-import { readFileSync, existsSync } from "node:fs";
+import { readFileSync, existsSync } from "node:fs"; import { runPrefixSpellings } from "../shared/pre-rename-spellings.mjs";
 // Aliased: three functions below take a parameter literally named `ledgerPath`, and an unaliased
 // import would be shadowed by it inside its own default-value expression (a TDZ ReferenceError
 // at the first call, not at load).
@@ -46,7 +46,7 @@ export const DEFAULT_LEDGER_PATH = resolveLedgerPath("call");
 export const KINDS = ["search", "record_fetch", "image", "phoneme", "batch_screen", "enumerate", "execute_plan", "propose_supplemental"];
 
 // The gateway namespaces the driver's --session-key as `agent:<agentId>:<key>` before it reaches the
-// plugin (confirmed on the first live run: sessionKey = `agent:clawdi:prelim-<slug>-<codename>-…`). Strip
+// plugin (confirmed on the first live run: sessionKey = `agent:clawdi:clearance-<slug>-<codename>-…`). Strip
 // that leading `agent:<id>:` namespace so the run prefix anchors at the real start of the caller's key —
 // otherwise a bare startsWith("clearotron-…") matches nothing.
 function stripGatewayNs(s) {
@@ -54,11 +54,11 @@ function stripGatewayNs(s) {
 }
 
 // Does this ledger row belong to the run identified by `runPrefix`? The driver's --session-key is
-// `prelim-<slug>-<codename>-<stage><axis>` (+ optional `-rerunN`), so a prefix match catches every stage +
+// `clearance-<slug>-<codename>-<stage><axis>` (+ optional `-rerunN`), so a prefix match catches every stage +
 // axis + retry of the run. We check sessionKey (carries the key) and, defensively, sessionId.
 function rowMatchesRun(row, runPrefix) {
-  return stripGatewayNs(row.sessionKey).startsWith(runPrefix)
-      || stripGatewayNs(row.sessionId).startsWith(runPrefix);
+  return runPrefixSpellings(runPrefix).some((rp) => stripGatewayNs(row.sessionKey).startsWith(rp)
+      || stripGatewayNs(row.sessionId).startsWith(rp));   // either spelling: a run resumed across the rename
 }
 
 // ── band-truth gate (2026-07-14, teal-foundry): count the ledger rows attributed to ONE unit lane ──────
@@ -146,7 +146,7 @@ function emptyTally() {
 /**
  * Tally every ledger line whose gateway id starts with `runPrefix`.
  * @param {string} ledgerPath  path to the JSONL ledger
- * @param {string} runPrefix   e.g. `prelim-acme-bluejay-` (note the trailing hyphen)
+ * @param {string} runPrefix   e.g. `clearance-acme-bluejay-` (note the trailing hyphen)
  * @returns {object} the tally (see emptyTally) — never throws
  */
 export function tallyRegisterCalls(ledgerPath = DEFAULT_LEDGER_PATH, runPrefix) {
@@ -208,7 +208,7 @@ export function tallyRegisterCalls(ledgerPath = DEFAULT_LEDGER_PATH, runPrefix)
  * (missing/unreadable ledger or a torn last line ⇒ skips that line, never throws). A cache_hit record_fetch
  * still counts — the URI WAS fetched this run, which is exactly what the gate asks.
  * @param {string} ledgerPath  path to the JSONL ledger
- * @param {string} runPrefix   e.g. `prelim-acme-bluejay-` (note the trailing hyphen)
+ * @param {string} runPrefix   e.g. `clearance-acme-bluejay-` (note the trailing hyphen)
  * @returns {Set<string>} the set of fetched record URIs
  */
 export function fetchedRecordUris(ledgerPath = DEFAULT_LEDGER_PATH, runPrefix) {

package/driver/publish/index.mjs

@@ -16,12 +16,14 @@ import { buildAudit } from './xlsx.mjs';
 import { parseFindingsJson, parseFindingsJsonLenient, deriveDisplayVerdict, joinFindingToBlock, CLIENT_TIER_BY_COMPOSITE, projectCoverageJudgment } from '../findings-model.mjs';
 import { readStore, requiredAbsent, nonClosingAbsences } from './publish-inputs.mjs';   // — and why an absence did not close
 import { clearanceReportData } from './report-data.mjs';
-import { searchDepthRecord } from './search-depth.mjs';   // how much was read to reach the answer, as counts and tokens
+import { searchDepthRecord, planTerritoriesOf } from './search-depth.mjs'; import { bandRecords } from '../named-band.mjs';   // how much was read to reach the answer, as counts and tokens
 import { parseFrameworkManifest } from '../framework.mjs';
-import { rollupTokens } from '../tokens.mjs';
+import { rollupTokens, servedModels } from '../tokens.mjs';
 import { reportIdentityFor, productCoverageNote, isRegisterOnly } from '../search-policy.mjs';
 import { readRecordArtifacts, bindFindingsToRecords, joinEvidenceStatus } from '../registry-fidelity.mjs';
 import { deliveryFlagLines } from '../predelivery-lint.mjs';
+import { unrenderableConditions } from '../terminal-clamp.mjs';   // — the conditions that reach no client surface
+import { runLog } from '../log.mjs';   // — one line in the run record when one does
 import { PROVIDERS, config } from '../driver.config.mjs';
 import { declaredRecordOrigins } from '../record-origins.mjs';
 import { NEUTRAL_DELIVERY, loadProfiles } from '../profiles.mjs';
@@ -791,6 +793,85 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   // the narrative, never in a status line). Best-effort; legacy runs have no sidecar.
   let verdictInfo = null;
   try { verdictInfo = JSON.parse(readFileSync(driverDir(runDir, 'verdict.json'), 'utf8')); } catch { /* legacy */ }
+  // ── THE CONDITIONS THAT REACH NO PAGE, RECORDED RATHER THAN LOST ────────────────────────────────
+  //
+  // A condition whose reader-facing sentence was never stored and cannot be composed from the run
+  // record's own counts is dropped instead of printed in the engine's words. That is right for the
+  // reader and it is a silent loss for everyone else, so the drop reports itself twice: an ordinary
+  // row on the workbook's gaps sheet, and one line in the run record here.
+  //
+  // THE WORDS ARE THE RUN RECORD'S OWN. The reason is what the clamp site wrote; the state word and the
+  // column headings are the gaps sheet's. Nothing on this path composes a sentence.
+  //
+  // A FRESH RUN NEVER REACHES THIS. Every clamp site stores its clause, so the list is empty and the
+  // sheet grows no row and the log gains no line. It bites on a republished archive, which is exactly
+  // where the operator has no other way to learn the page is short of a point.
+  const droppedConditions = unrenderableConditions(verdictInfo || {}).map((reason) => ({
+    area: 'Conditions', state: 'open', note: reason,
+  }));
+  // Best-effort, in the house pattern: a publish never fails for want of a log line, and a republish
+  // from a directory this process cannot write is still a publish.
+  if (droppedConditions.length && runDir) {
+    try {
+      runLog(runDir, { event: 'client-condition-dropped', n: droppedConditions.length,
+        reasons: droppedConditions.map((c) => c.note) });
+    } catch { /* the workbook row is the record that matters; this line is the second copy */ }
+  }
+  // ── THE CHECKS THE RUN DECIDED ON AND DID NOT MAKE ─────────────────────────────────────────────
+  //
+  // The recall net mints a probe per remembered conflict and a probe per owner behind one, then
+  // dispatches at most five owner probes. The excess is recorded in the run's own receipt and nothing
+  // downstream carried it to a reader, so a search that decided on nineteen ownership checks, made five
+  // and said nothing about the other fourteen read as a search that made the checks it wanted.
+  //
+  // The cap is not the defect: it is deliberate and the rows it drops are ranked material-first, so the
+  // five that run are the five that matter most. What was missing is the disclosure, and it lands where
+  // the 2026-09-17 ruling put the same class of fact — an ordinary row on the workbook's gaps sheet and
+  // one line in the run record. Nothing reaches the report page: the approved boards draw a forward
+  // decision and an open question back to the client, and a check nobody made is neither.
+  //
+  // THE WORDS ARE THE RECEIPT'S OWN. The party and the probe id are read from it verbatim; "over the
+  // cap" and "never dispatched" are the vocabulary the ask ledger already ships for these same rows.
+  // Nothing here composes a sentence, and the note carries no seam, so the gaps sheet's own splitter
+  // leaves "What was done" empty — which is the fact: nothing was done.
+  // READ THROUGH THE DECLARED HELPER, three states and not two. An absent receipt is a run whose recall
+  // net minted nothing — env-gated off, or a matter with no remembered conflict — and there is nothing
+  // to disclose. A DAMAGED one is a different fact: the probes may have overflowed and this publish
+  // cannot tell, so it says so in the run record instead of shipping the same empty sheet an
+  // everything-dispatched run ships. Collapsing those two is the defect publish-inputs.mjs exists for.
+  //
+  // NOT PUSHED ONTO `inputsAbsent`. That list rides meta.json's clientGate record, whose own note two
+  // hundred lines down is that it stays undefined when every store was found so a complete run's meta
+  // is byte-identical to one written before the list existed. Most runs have no recall receipt, so
+  // adding this store to it would change the meta of every archived run on re-render for a store that
+  // feeds a workbook row and not the gate -- the same reason the other presentation-only stores are
+  // not on it either.
+  // `runDir ?? dirname(reportMd)`, the same base its neighbours take and not a defensive flourish:
+  // publishReport's `runDir` is OPTIONAL, and a bare `readStore(runDir, …)` throws TypeError on an
+  // undefined base rather than reporting an absent store. Caught in CI by the graceful-stop runner arm,
+  // which publishes without one: the throw left publishReport at `published → null` and the runner
+  // exited 1. Reading from the report's own directory is also the right answer for a republish.
+  const recallStore = readStore(runDir ?? dirname(reportMd), '_driver/register-recall.json');
+  const undispatchedProbes = (recallStore.value?.overflow ?? [])
+    .filter((o) => o && (o.term || o.qid))
+    .map((o) => ({
+      area: String(o.term ?? o.qid),
+      state: 'not-searched',
+      note: `over the cap, never dispatched (${String(o.qid ?? 'no probe id recorded')})`,
+    }));
+  if (recallStore.state === 'damaged' && runDir) {
+    try {
+      runLog(runDir, { event: 'probe-over-cap-unreadable', store: recallStore.name, error: recallStore.error });
+    } catch { /* best-effort, as below */ }
+  }
+  // Best-effort, as above: a publish never fails for want of a log line.
+  if (undispatchedProbes.length && runDir) {
+    try {
+      runLog(runDir, { event: 'probe-over-cap-undispatched', n: undispatchedProbes.length,
+        parties: undispatchedProbes.map((p) => p.area) });
+    } catch { /* the workbook row is the record that matters; this line is the second copy */ }
+  }
+
   // doc 50 — the run's FROZEN framework manifest (band vocabulary). Present on band-doctrine runs;
   // absent on every archived run (they render byte-identically on the legacy paths).
   let framework = null;
@@ -819,11 +900,25 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   // two must not render the same way. Null on archived runs ⇒ render keeps the prose fallback.
   let scopeBasis = null;
   let searchedJurisdictions = [];
+  // WHAT WAS SEARCHED IS THE PLAN'S ANSWER, NOT THE ARCHIVE'S, and it is carried separately from the
+  // header's list below because the two are used for different things and one of them is deliberately
+  // emptied. The coverage presentation asks which territories the run searched and which it could not
+  // reach; the plan compiles both — entries carry the regions it will query, `deferred_coverage` carries
+  // the ones this provider does not cover with the reason each. A register that archives no records
+  // still has both, which is the whole point: keyed off the record store, a provider that keeps nothing
+  // looked like a provider nobody asked.
+  //
+  // THREE-VALUED like the record listing above it: null means there is no plan to read, so the run
+  // cannot say — an archived or legacy run — and it must not be confused with a plan that named nothing.
+  let planTerritories = null;
   try {
     const plan = JSON.parse(readFileSync(driverDir(runDir ?? dirname(reportMd), 'register-plan.json'), 'utf8'));
     if (plan?.scope_basis === 'worldwide') scopeBasis = 'worldwide';
     searchedJurisdictions = [...new Set((plan?.entries ?? []).flatMap((e) => Array.isArray(e.regions) ? e.regions : []))];
     if (!searchedJurisdictions.length && Array.isArray(plan?.regions)) searchedJurisdictions = [...new Set(plan.regions)];
+    // Derived here, BEFORE the worldwide clearing below — that clearing exists for the header and would
+    // otherwise empty this on exactly the runs that cover the most ground.
+    planTerritories = planTerritoriesOf(plan);
   } catch { /* no plan sidecar — try the instructed scope */ }
   if (!searchedJurisdictions.length) {
     try {
@@ -902,7 +997,14 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   const reviewReceipts = {
     // `family` rides along for deliveryFlagLines' fallback: a check whose id is not in the projection
     // table still projects to its family's sentence rather than to anything the engine wrote.
-    lint: (lintSink?.checks ?? []).filter(c => !c.pass).map(c => ({ id: c.id ?? '', family: c.family ?? '', detail: c.detail ?? '' })),
+    // ONE CHECK IS DELIBERATELY NOT PROJECTED. `client-condition-dropped` has no sentence of its own
+    // in the projection table, so it fell through to its family's — "the delivered outcome and the
+    // report's own text do not agree" — which describes a contradiction. This is an omission: the
+    // outcome and the text agree perfectly and both are short of a point. It says what happened on the
+    // gaps sheet and in the run record now, in the run record's own words, so the borrowed sentence
+    // comes off rather than being replaced by a better one (ruled 2026-09-17).
+    lint: (lintSink?.checks ?? []).filter(c => !c.pass && c.id !== 'client-condition-dropped')
+      .map(c => ({ id: c.id ?? '', family: c.family ?? '', detail: c.detail ?? '' })),
     engagement: integritySink?.engagement ?? null,
     registryCorrections: Array.isArray(integritySink?.registryCorrections)
       ? integritySink.registryCorrections.filter((c) => c && c.from != null && c.to != null) : [],
@@ -1032,7 +1134,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
       // the same rule (the workbook's own BANNED gate had already started firing on the raw detail —
       // advisory, so CI stayed green). reviewReceipts.lint keeps its raw detail for the internal
       // readers above (fetchState reads registry-record-coverage's URIs out of it).
-      counts = await buildAudit({ findings, coverage, contextNotes, coverageJudgment, markAssessment, corrections: correctionsDoc, fetchState, verdict: verdictInfo, jurisdiction, commonLawJoinedTerms, registerOnly, clientGate, lintFailures: deliveryFlagLines(reviewReceipts.lint), productName, registerPublishesRecordPages: runOrigins == null ? null : runOrigins.length > 0, recordLinks: officeLinks?.byUri ?? null }, auditParsed, join(poolRunDir, auditFile), fm.title, fm);
+      counts = await buildAudit({ droppedConditions, undispatchedProbes, findings, coverage, contextNotes, coverageJudgment, markAssessment, corrections: correctionsDoc, fetchState, verdict: verdictInfo, jurisdiction, commonLawJoinedTerms, registerOnly, clientGate, lintFailures: deliveryFlagLines(reviewReceipts.lint), productName, registerPublishesRecordPages: runOrigins == null ? null : runOrigins.length > 0, recordLinks: officeLinks?.byUri ?? null }, auditParsed, join(poolRunDir, auditFile), fm.title, fm);
       grpRead(join(poolRunDir, auditFile), 0o640);
       if (counts?.gateViolations?.length) console.warn(`[audit-workbook] advisory: ${counts.gateViolations.join(' | ')}`);
     } catch (e) {
@@ -1053,6 +1155,11 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   // rather than wire the overlay in: client names saturate privileged report prose — a partial blur is a
   // worse demo than no toggle.
   const reportNav = siteNav(poolRoot, 'report', null, '../', { anon: false });
+  // The models that served this run, named as a client may read them (tokens.mjs servedModels). The closing
+  // line of the report's scope section, the data file and the meta below all take this one read; a read
+  // that throws records nothing rather than failing the publish.
+  let served = null;
+  try { served = runDir ? servedModels(runDir) : null; } catch { served = null; }
   // `demoData` is resolved above the report.md write — one answer, every surface.
   // ── HOW MUCH WAS READ TO REACH THE ANSWER ──────────────────────────────────────────────────────
   // Derived here rather than in a stage so a REPUBLISH of an archived run picks the fields up with no
@@ -1060,6 +1167,35 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   // pattern — a run with no grid or no case-law layer still gets its register counts, and the absent
   // ones report themselves as zero or `not-in-scope` rather than as a gap nobody can see.
   let searchDepth = null;
+  // HOW DEEP THE LOCAL-LANGUAGE INVESTIGATION WENT, and it is derived by the one author of that
+  // question rather than re-read here. The import is LAZY and gated on the run's own sidecar existing,
+  // which keeps the property the pipeline's own fold keeps: a plain clearance never loads the jx
+  // machinery at all. No sidecar means the component never ran, which the fold reports as not-in-scope.
+  let laneDepthVerdicts = null;
+  try {
+    const jxSidecar = driverDir(runDir ?? dirname(reportMd), 'jx-lanes.json');
+    if (existsSync(jxSidecar)) {
+      const sidecar = JSON.parse(readFileSync(jxSidecar, 'utf8'));
+      const { laneDepthOfRun } = await import('../jx.mjs');
+      let units = null;
+      try { units = JSON.parse(readFileSync(driverDir(runDir ?? dirname(reportMd), 'jx/units.json'), 'utf8')); } catch { /* the statement handles an absent units file */ }
+      // THE RUN ALREADY ANSWERED THIS, AND THE STAMPED ANSWER IS THE ONE THAT COUNTS.
+      //
+      // `deriveJxSliceStatement` writes `fold.depth` at delivery, from the run's OWN environment, for the
+      // reason the seam exists at all: the arms are environment, so a verdict derived later can only speak
+      // for the box it is derived on. Publishing re-derived it here — a second author for a fact the run
+      // had already stated — and the two disagreed on a delivered client report.
+      //
+      // The disagreement was not subtle. This call passed `deriveJxSliceStatement`'s whole return,
+      // `{executes, slices}`, where the function reads `slices.candidates` — so the lookup found nothing,
+      // every lane's `ran` came back null whatever it had really done, and a full-country JP run that
+      // searched in Japanese printed "Local-language investigation · Not run this run". The stamped
+      // verdict on the same run's sidecar said `ran: "candidates"`, correctly.
+      //
+      // So: read what the run stated, and derive only for a run delivered before the stamp existed.
+      laneDepthVerdicts = laneDepthOfRun({ sidecar, units });
+    }
+  } catch { /* an unreadable sidecar reports as not-in-scope rather than failing a publish */ }
   try {
     const runBase = runDir ?? dirname(reportMd);
     const recDir = join(runBase, '_records');
@@ -1068,15 +1204,22 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
     searchDepth = searchDepthRecord({
       auditMd: (auditMd && existsSync(auditMd)) ? rdText(auditMd) : '',
       recordIndex: recordsByUri ?? {},
-      recordFileNames: existsSync(recDir) ? readdirSync(recDir) : [],
+      // null, NOT []: a run whose provider archives no records has no `_records/` at all, and an empty
+      // array is a register that was searched and returned nothing. They are different facts and the
+      // page says different things about them, so the distinction this line already computes is kept
+      // rather than thrown away one character later.
+      recordFileNames: existsSync(recDir) ? readdirSync(recDir) : null,
+      // …and where there is no archive, what the register returned: the band's own record ids.
+      bandRecordIds: existsSync(recDir) ? null : (() => { try { const b = rdJson(join(runBase, 'register-named-band.json')); return b ? bandRecords(b).map((r) => r?.record_id).filter(Boolean) : null; } catch { return null; } })(),
       commonLawGrid: rdJson(join(runBase, 'common-law-grid.json')),
       caseLawText: rdText(join(dirname(reportMd), 'case-law-findings.md')),
       registerPlan: rdJson(driverDir(runBase, 'register-plan.json')),
+      laneDepthVerdicts,
     });
     writeRO('search-depth.json', JSON.stringify(searchDepth, null, 2));
   } catch { /* the depth record is additive — a publish never fails for want of it */ }
 
-  writeRO('report.html', renderHtml(parsed, findings, coverage, { demoData, productName, depthNote, scopeBasis, auditFile: auditFile || undefined, runId, delivery: deliv, recordsByUri, contextNotes, coverageJudgment: coverageJudgmentDisplay, markAssessment, fourAnswers, homeHref: '../index.html', nav: reportNav, chromeHref: '../assets/chrome.css', issued, asOf, verdictInfo, framework, searchedJurisdictions, caseLawByOrdinal, caseLawNotice, enforcerSignals, recordOrigin, recordOrigins: runOrigins, recordCitation: runProviderConf?.recordCitation ?? null, recordLinks: officeLinks?.byUri ?? null, providerLabel, seniorRights, findingsSchemaVersion, searchDepth }));
+  writeRO('report.html', renderHtml(parsed, findings, coverage, { demoData, servedModels: served, productName, depthNote, scopeBasis, auditFile: auditFile || undefined, runId, delivery: deliv, recordsByUri, contextNotes, coverageJudgment: coverageJudgmentDisplay, markAssessment, fourAnswers, homeHref: '../index.html', nav: reportNav, chromeHref: '../assets/chrome.css', issued, asOf, verdictInfo, framework, searchedJurisdictions, planTerritories, caseLawByOrdinal, caseLawNotice, enforcerSignals, recordOrigin, recordOrigins: runOrigins, recordCitation: runProviderConf?.recordCitation ?? null, recordLinks: officeLinks?.byUri ?? null, providerLabel, seniorRights, findingsSchemaVersion, searchDepth }));
   // ONE report (spec 2026-07-30 §5): report.client.html is no longer written. The knockout lane's own
   // collapse note is the precedent: "two renderings of one run is how the wrong link gets sent". The
   // client host serves the same report.html through the portal's readReport() (cleaning built in) — its
@@ -1150,7 +1293,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
       // is the LAST resort (a level today's registry no longer knows). meta.json below keeps the frozen
       // stamp BY DESIGN — its readers re-derive.
       auditFile, searchLevel: searchPolicy?.level ?? null, stageLabel: stageLabel ?? searchPolicy?.stageLabel ?? null,
-      engineCommit: engineCommit(),
+      engineCommit: engineCommit(), servedModels: served,
       framework, verdictInfo, findings, coverage, contextNotes, markAssessment, fourAnswers, askAnswers,
       actions: actionsRegister, jurisdiction, searchedJurisdictions, scopeBasis, caption: fm.overall_caption ?? null,
     });
@@ -1175,6 +1318,9 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
     issuedAt,
     // WHICH BUILD produced this. null off a git checkout — a provenance stamp never fails a publish.
     engineCommit: engineCommit(),
+    // The models that served the run, named as a client may read them (tokens.mjs servedModels). Absent when
+    // nothing was read, so a meta from before the record keeps its shape; [] when turns ran and named none a client may read.
+    servedModels: served ?? undefined,
     kind: 'clearance', recordLinks: officeLinks?.tally ?? undefined,   // per office: linked, or cited by number and why; only where the register has no record pages
     searchLevel: searchPolicy?.level ?? undefined,
     // Display-only face of the level ("Depth 4"), frozen alongside it so the list can show which reads
@@ -1445,7 +1591,7 @@ export function composeEmailBody(reportMdPath, url, auditFile, productName = nul
 const FONT = "font-family:Calibri,'Segoe UI',Arial,sans-serif";
 
 // 5-tier reporting-template risk scheme — the whole left "NAME / RISK RATING" cell takes the bg colour.
-// Matches skills/prelim-search/templates/search-request-form.html + knockout-searches/template-formatting.md.
+// Matches skills/clearance-search/templates/search-request-form.html + knockout-searches/template-formatting.md.
 // `txt` = a readable text-colour version of the tier (for the EXECUTIVE SUMMARY risk phrase, where a bright
 // fill like yellow/red is unreadable as text). Order matters: VERY HIGH before HIGH.
 export const RISK_TIERS = [