clearotron 0.3.2-beta.7 → 0.3.2-beta.9

package/driver/publish/report-data.mjs

@@ -68,7 +68,7 @@ function assessmentField(v) {
  * "no data file this publish" and stamps meta.reportSchema only on success.
  */
 export function clearanceReportData({
-  runId, codename, matter, markName, title, customerKey, issued, url, auditFile, engineCommit = null,
+  runId, codename, matter, markName, title, customerKey, issued, url, auditFile, engineCommit = null, servedModels = null,
   searchLevel, stageLabel, framework, verdictInfo, findings, coverage, contextNotes,
   markAssessment, fourAnswers, askAnswers, actions, jurisdiction, searchedJurisdictions, scopeBasis, caption,
 } = {}) {
@@ -91,6 +91,9 @@ export function clearanceReportData({
     issued: issued || null,
     // The engine build that produced this report — the join from a flagged finding to a diff.
     engineCommit: engineCommit || null,
+    // The models that served the run, in first-use order, as tokens.mjs servedModels names them for a
+    // client: a deployment's own name never, its tier instead. null when nothing was read.
+    servedModels: Array.isArray(servedModels) ? servedModels : null,
     url: url || null,
     auditFile: auditFile || null,
     level: { searchLevel: searchLevel ?? null, stageLabel: stageLabel ?? null },

package/driver/publish/report-topbar.mjs

@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+// report-topbar.mjs — THE EXPORT MENU, ONCE, FOR BOTH REPORT TEMPLATES.
+//
+// Two templates draw a report: the clearance renderer and the knockout renderer. Each emits its own top
+// bar, which is right — the boards draw two different bars, with different items in a different order.
+// What they must not each own is the EXPORT MENU: the toggle, the popover it opens, the aria wiring that
+// says it is a menu, and the two listeners that open and close it. Those are one control, and until this
+// module they were two copies of one control, in two files, with nothing to say when they drifted.
+//
+// ── WHAT IS SHARED AND WHAT IS NOT, AND WHY THE LINE IS THERE ───────────────────────────────────────
+//
+// The SHELL is shared: the button, the panel, the behaviour. The ENTRIES are not. The clearance report
+// filters its export to the findings a reader has ticked, so its menu says so and offers a select-all;
+// the knockout has no tick boxes at all, deliberately, because it has nothing to filter, and a menu
+// offering to tick there would name a control that cannot exist. An entry list is a statement about what
+// a template can do, and the two templates can do different things.
+//
+// ── THE BYTES DO NOT MOVE ───────────────────────────────────────────────────────────────────────────
+//
+// `driver/publish/render.mjs` is frozen at a content hash, and the freeze's checklist asks whether a
+// change is reachable from a republish. This one is: pool-admin re-renders archived runs through that
+// module. So the contract here is stricter than "it looks the same" — the composed markup is the bytes
+// the two templates already emitted, character for character, and the commit that introduces this module
+// records a real archived run rendered through both the old module and the new one and byte-compared, in
+// the internal pass and the client pass. A shared definition that changed a delivered report while
+// tidying it up would be the worst of both.
+
+/**
+ * The button that opens the export menu. One spelling, both templates.
+ *
+ * `aria-haspopup` and `aria-expanded` are part of the control rather than decoration: the listener below
+ * keeps `aria-expanded` in step, and a second copy of this button that forgot either would announce
+ * itself to a screen reader as an ordinary button that does nothing.
+ */
+export const EXPORT_TOGGLE = '<button type="button" class="tbbtn primary tb-exp-toggle" aria-haspopup="true" aria-expanded="false">⬇ <span class="tb-lbl">Export</span> ▾</button>';
+
+/**
+ * The panel the toggle opens, around whatever entries a template offers. PURE.
+ *
+ * @param {string} entries  the template's own menu contents, already escaped
+ * @returns {string}
+ */
+export const exportPopover = (entries) => `<div class="tb-pop tb-exp-pop" hidden>${entries}</div>`;
+
+/**
+ * Open on the button, close on a click outside and on Escape.
+ *
+ * GLOBAL, NOT WRAPPED, and that is the same reason the templates' own verbs are global: the portal
+ * frames a served report and drives it by looking names up on the page. These two listeners need no
+ * name, but they sit in the same script as the verbs that do, and a wrapper around the pair would be one
+ * more difference between the two files for no gain.
+ *
+ * NO BACKTICK IN THIS STRING. It is interpolated into a template literal in both templates, and a
+ * backtick ends that literal — the failure arrives at import time naming a token nobody wrote.
+ */
+export const EXPORT_MENU_JS = `document.addEventListener('click',function(e){var t=e.target.closest('.tb-exp-toggle'),pop=document.querySelector('.tb-exp-pop');if(t){if(pop){pop.hidden=!pop.hidden;t.setAttribute('aria-expanded',String(!pop.hidden));}return;}if(pop&&!pop.hidden&&!e.target.closest('.tb-exp-pop')){pop.hidden=true;var b=document.querySelector('.tb-exp-toggle');if(b)b.setAttribute('aria-expanded','false');}});
+document.addEventListener('keydown',function(e){if(e.key==='Escape'){var pop=document.querySelector('.tb-exp-pop');if(pop&&!pop.hidden){pop.hidden=true;var b=document.querySelector('.tb-exp-toggle');if(b)b.setAttribute('aria-expanded','false');}}});`;

package/driver/publish/search-depth.mjs

@@ -92,7 +92,29 @@ export function clearedNames(auditMd, recordIndex = {}) {
         uri,
       });
     } else if (!/^NR\d+/.test(title) && /common-law/i.test(layer) && !/^\(none/i.test(title)) {
-      out.web.push({ title, url: field(block, "url"), type: field(block, "type") });
+      // ── A NAME IS A NAME AT A PLACE. THE READINGS ARE NOT NAMES ─────────────────────────────────
+      //
+      // The common-law layer carries two kinds of block under one heading style: a name somebody is
+      // trading under, and a reading of what the mark MEANS. The first has a `url` — it is a thing at a
+      // place a reader can go and look at. The second has none, because there is nothing to open: it is
+      // an etymology, a sensitivity, a piece of context.
+      //
+      // Both were listed as "Web and marketplace names", and a reading is a sentence, so the mark chip
+      // built for a name truncated it with an ellipsis and its right-hand column rendered empty.
+      // Measured on the delivered full country report: one such chip held 416px of content in a 200px
+      // box. Across every demo product, 7 of 31 blocks carried no url and every one of the 7 was a
+      // reading rather than a name.
+      //
+      // NOTHING IS LOST BY LEAVING THEM OUT, and that was measured rather than assumed: the report
+      // already carries each of those readings in the section written for them — the Quechua one appears
+      // five more times in the same document, under "Connotation & meaning" and again in the decision it
+      // asks the reader to take — and the audit workbook carries every block whatever this does.
+      //
+      // WHAT IT COSTS, stated rather than hidden: a marketplace name sighted with no URL recorded would
+      // not be listed here. None exists in any demo, and the row such a block produced was already a
+      // name beside an empty column. If one appears, the fix is to record where it was seen.
+      const url = field(block, "url");
+      if (url) out.web.push({ title, url, type: field(block, "type") });
     }
   }
   return out;
@@ -104,9 +126,18 @@ export function clearedNames(auditMd, recordIndex = {}) {
  * EVERY COUNTRY THE RUN READ, including the ones that came back clean — those are the whole point. A
  * count keyed off the findings would list only countries with a conflict, which is the gap this closes.
  *
- * @param {string[]} recordFileNames  the `_records/` directory listing, named `<cc>-<id>.json`
+ * THREE-VALUED, in the house pattern outputMeta already uses for a stage's output: `null` in means the
+ * run has NO `_records/` store, and `null` comes back out — we cannot say how many records were read.
+ * An empty ARRAY is the other thing entirely: the store is there and holds nothing, which is a real zero
+ * and renders as one. Collapsing the two is what this fixes; they arrived here as the same `[]` and the
+ * renderer could only drop the section, so a register that archives nothing read as a register nobody
+ * searched.
+ *
+ * @param {string[]|null} recordFileNames  the `_records/` listing, named `<cc>-<id>.json`; null = no store
+ * @returns {object|null} counts by country code, or null when the run cannot say
  */
 export function recordsByCountry(recordFileNames = []) {
+  if (recordFileNames === null) return null;
   const out = {};
   for (const name of recordFileNames) {
     const cc = (String(name).match(/^([a-z]{2})-/i) || [])[1];
@@ -115,6 +146,16 @@ export function recordsByCountry(recordFileNames = []) {
   return out;
 }
 
+/** Band record ids → `<office>-<id>` names, one per distinct record, in the archive's own naming. PURE. */
+export function recordNamesFromIds(ids) {
+  const out = new Set();
+  for (const id of ids ?? []) {
+    const m = /^\/mark\/([a-z]{2,4})\/(.+)$/i.exec(String(id ?? ""));
+    if (m) out.add(`${m[1].toLowerCase()}-${m[2]}`);
+  }
+  return [...out];
+}
+
 /** Marketplace, web, reputation and meaning checks, from the deterministic grid the tools wrote. PURE. */
 export function sweepCounts(commonLawGrid, auditMd = "") {
   const cells = Array.isArray(commonLawGrid?.cells) ? commonLawGrid.cells : [];
@@ -148,6 +189,81 @@ export function courtDecisionsState(caseLawText) {
   return "found";
 }
 
+/**
+ * WHICH TERRITORIES THE RUN SEARCHED, AND WHICH IT COULD NOT REACH — from the register PLAN. PURE.
+ *
+ * The plan is the authority on what was asked of the register; the `_records/` archive is only the
+ * authority on what came back and was kept. Reading "what was searched" off the archive is why a
+ * provider that keeps no records read as a provider nobody asked: no records, no countries, no section.
+ * Both halves are on the plan whether or not anything is archived — `entries[].regions` is what it will
+ * query, and `deferred_coverage` is what this provider does not cover, carrying the reason for each.
+ *
+ * Null for a run with no plan to read, which is an archived or legacy run: that is "cannot say", and it
+ * is not the same answer as a plan that named nothing.
+ *
+ * @param {object|null} plan  the parsed `register-plan.json`, or null when there is none
+ */
+export function planTerritoriesOf(plan) {
+  if (!plan || typeof plan !== "object") return null;
+  const entryRegions = (plan.entries ?? []).flatMap((e) => (Array.isArray(e?.regions) ? e.regions : []));
+  // `plan.regions` is the older shape and is the fallback, not a second source: a plan carrying entries
+  // has already said which regions it will query, and unioning the two would report a region the
+  // compiler moved OUT of `regions` into the deferral list as though it had been searched.
+  const searched = entryRegions.length ? [...new Set(entryRegions.map(String))]
+    : [...new Set((Array.isArray(plan.regions) ? plan.regions : []).map(String))];
+  // A WORLDWIDE PLAN THAT NAMES NO REGION CANNOT SAY WHERE IT REACHED. On a provider that takes no region
+  // list, worldwide compiles to queries with no jurisdiction clause at all — the whole database — so the
+  // plan names nothing, and read as "searched these" that is "searched nowhere": the section that says
+  // where a search reached disappeared on exactly the searches that reached furthest. Null is the answer
+  // the plan can actually give, and the page then reads the countries off what the register returned.
+  // Only when nothing was deferred: a worldwide order with deferrals is not an unrestricted sweep.
+  if (plan.scope_basis === "worldwide" && !searched.length
+    && !(Array.isArray(plan.deferred_coverage) && plan.deferred_coverage.length)) return null;
+  const unreached = (Array.isArray(plan.deferred_coverage) ? plan.deferred_coverage : [])
+    .map((d) => ({ jurisdiction: String(d?.jurisdiction ?? "").trim(), reason: String(d?.reason ?? "").trim() }))
+    .filter((d) => d.jurisdiction);
+  return { searched, unreached };
+}
+
+/**
+ * HOW DEEP THE LOCAL-LANGUAGE INVESTIGATION ACTUALLY WENT, against what the matter configured. PURE.
+ *
+ * The engine can run this investigation shallower than the account asked for, and until now it said so
+ * in exactly one place: a sentence a model wrote in the Methodology paragraph. The redesigned report
+ * replaces that paragraph with counts and named rows, so a run that went shallow said so on no page at
+ * all. This is the field behind that row.
+ *
+ * DERIVED FROM THE RUN'S OWN RECORD, NEVER FROM PROSE, and not derived here either: the caller hands in
+ * what `deriveLaneDepthVerdicts` produced, which is the one author of asked-versus-ran and reads the
+ * frozen lane sidecar against the slices that executed. A second opinion computed in the publish path
+ * would be a second answer to a question the engine has already answered.
+ *
+ * THE FOUR STATES, and the order they are decided in matters:
+ *   not-in-scope  no lane was asked for anything — a plain clearance, or every lane switched off
+ *   not-run       lanes were asked and none of them ran
+ *   ran-shallow   a lane fell short of its ask, or was asked and did not run while another did
+ *   ran           every lane that was asked ran at the depth it was asked for
+ *
+ * `ran: null` IS NOT `candidates`. A lane whose slices settle to nothing readable cannot say what it
+ * delivered, and the jx verdicts are careful to report that as unestablished rather than as the lesser
+ * depth. Folding it to `ran` here would put that claim back on a client's page, so it counts as short.
+ *
+ * @param {object|null} verdicts  per-lane `{asked, ran, shortfall}` from deriveLaneDepthVerdicts
+ */
+export function localLanguageDepth(verdicts) {
+  if (!verdicts || typeof verdicts !== "object") return { state: "not-in-scope", lanes: {} };
+  const lanes = {};
+  for (const [lane, v] of Object.entries(verdicts)) {
+    lanes[lane] = { configured: v?.asked ?? null, achieved: v?.ran ?? null };
+  }
+  const asked = Object.entries(verdicts).filter(([, v]) => v?.asked && v.asked !== "off");
+  if (!asked.length) return { state: "not-in-scope", lanes };
+  const ran = asked.filter(([, v]) => v?.ran);
+  if (!ran.length) return { state: "not-run", lanes };
+  const short = asked.some(([, v]) => v?.shortfall === true || !v?.ran);
+  return { state: short ? "ran-shallow" : "ran", lanes };
+}
+
 /** Was the name searched in a non-Latin script? Read off the plan's own terms, never asserted. PURE. */
 export function localScriptSearched(registerPlan) {
   const entries = Array.isArray(registerPlan?.entries) ? registerPlan.entries : [];
@@ -159,7 +275,16 @@ export function localScriptSearched(registerPlan) {
  *
  * @returns {{schemaVersion: number, cleared: object, counts: object}}
  */
-export function searchDepthRecord({ auditMd = "", recordIndex = {}, recordFileNames = [], commonLawGrid = null, caseLawText = "", registerPlan = null } = {}) {
+export function searchDepthRecord({ auditMd = "", recordIndex = {}, recordFileNames = [], bandRecordIds = null, commonLawGrid = null, caseLawText = "", registerPlan = null, laneDepthVerdicts = null } = {}) {
+  // `recordFileNames: null` travels all the way to the page — see recordsByCountry. The default stays `[]`
+  // because that is "the caller said nothing", not "the store is absent"; only the publish path knows the
+  // difference and it is the one producer.
+  //
+  // A PROVIDER THAT ARCHIVES NO RECORDS STILL RETURNED THEM. Its search answer is the band, and every
+  // record in it carries its office in its own id (`/mark/<office>/<id>`). So where there is no archive
+  // the band is what was read: counted by record, filed by office. Without it a run that read 785 register
+  // records reported "cannot say" and the report carried no register row and no country at all.
+  if (recordFileNames === null && Array.isArray(bandRecordIds)) recordFileNames = recordNamesFromIds(bandRecordIds);
   const cleared = clearedNames(auditMd, recordIndex);
   const groups = {};
   for (const key of CLEARED_GROUPS) groups[key] = 0;
@@ -169,10 +294,14 @@ export function searchDepthRecord({ auditMd = "", recordIndex = {}, recordFileNa
     cleared: { register: cleared.register, web: cleared.web, groups },
     counts: {
       recordsByCountry: recordsByCountry(recordFileNames),
-      recordsRead: recordFileNames.length,
+      recordsRead: recordFileNames === null ? null : recordFileNames.length,
       sweep: sweepCounts(commonLawGrid, auditMd),
       localScriptSearched: localScriptSearched(registerPlan),
       courtDecisions: courtDecisionsState(caseLawText),
+      // `localScriptSearched` above answers whether the spellings were searched; this answers how deep
+      // the investigation went against what was configured. Two different facts, and the row the report
+      // reserves is for the second.
+      localLanguage: localLanguageDepth(laneDepthVerdicts),
     },
   };
 }

package/driver/publish/templates/report.css

@@ -113,6 +113,39 @@
   .panel.actions p,.panel.actions li{font-size:13.5px;color:var(--slate);line-height:1.55}
   .panel.actions ul{margin:0;padding-left:20px} .panel.actions li{margin:3px 0}
 
+  /* ── THE BOARD'S OWN SECTION STRIP, lifted from the approved mock rather than written here ────────
+     Five entries and the board's own labels, marked not to print because the board marks it so: a strip
+     that follows the reader down the page is a control, and paper has nothing for it to follow. Every
+     anchor it names is drawn by the renderer above it.
+
+     THE SECTION NUMBER IS DRAWN AND HIDDEN, and that is the board's doing, not an oversight here: the
+     mock emits `<span class="num"></span>` on every section and then sets `display:none` on it further
+     down its own stylesheet. Carried faithfully, so the delivered document and the approved one hold the
+     same elements — this changes no pixel, and a reader looking for a visible number will not find one
+     in the board either. */
+  /* THE BREADCRUMB IS A ROW OF THE HEADER, not a bar under it (owner, 2026-09-18).
+     It used to be a SIBLING of .rep-stickyhead, pinned on its own at top:var(--tb-h,52px) — and
+     --tb-h is set nowhere in this product, so the fallback was a guess at a bar that measures ~46px:
+     content showed through the slit between the two, and z-index:20 put the strip UNDER the header's
+     100 whenever the guess was wrong. The strip is now emitted inside .rep-stickyhead, so the header
+     and the breadcrumb are one sticky surface that pins and unpins together and can never gap or
+     overlap, whatever the bar measures or how it wraps.
+     No background and no bottom hairline of its own: the wrapper carries the blurred surface and the
+     single edge, and the border-top here is the divider between the two rows. It is on .strip rather
+     than on any wrapper because sectionStrip() emits NOTHING when fewer than two of its sections are
+     live — a wrapper would leave a stray line on those reports.
+     The gutter matches the topbar's, so the first entry lines up under the back button. */
+  .strip{display:flex;gap:4px;align-items:center;padding:4px max(26px,calc((100% - 1120px)/2)) 6px;
+    border-top:1px solid var(--line);font:600 12px/1 'Satoshi','Helvetica Neue',Arial,sans-serif;
+    letter-spacing:.04em;overflow-x:auto;scrollbar-width:none}
+  .strip::-webkit-scrollbar{display:none}
+  .strip a{display:inline-flex;align-items:center;gap:7px;padding:7px 10px;border-radius:999px;color:#6b5d50;text-decoration:none;white-space:nowrap}
+  .strip a i{width:8px;height:8px;border-radius:50%;border:1.5px solid currentColor;box-sizing:border-box}
+  .strip a.done{color:#4c7a4c}
+  .strip a.done i{background:#4c7a4c;border-color:#4c7a4c}
+  .strip a.now{color:#250902;background:rgba(0,0,0,.06)}
+  .strip a.now i{border-color:#860F09;border-width:3px}
+  .sec .num{display:none}
   .sec{margin:56px 0 18px;display:flex;align-items:baseline;gap:15px;border-top:2px solid var(--ink);padding-top:14px}
   .sec .num{font-family:var(--mono);font-size:13px;color:var(--crimson);font-weight:600}
   .sec h2{font-weight:900;font-size:25px;margin:0;letter-spacing:-.015em}
@@ -239,7 +272,19 @@
   .tb-hint{font-size:11px;color:var(--faint);line-height:1.4;margin:2px 2px 0}
   @media(max-width:860px){.tb-matter{display:none}}
   @media(max-width:640px){.tb-issued{display:none}}
-  @media(max-width:560px){.wm small{display:none}.tb-back-lbl{display:none}.tb-lbl{display:none}}
+  @media(max-width:560px){.wm small{display:none}.tb-back-lbl{display:none}.tb-lbl{display:none}
+    /* THE SAME ROW, CLOSER TOGETHER — the ladder above already collapses this bar's LABELS at these
+       widths, and it was still 35 to 51px wider than a phone screen, so the whole document scrolled
+       sideways: the reader dragged the page left and right to read a paragraph. Nothing is hidden and
+       nothing moves; the gutter, the gaps and one dead margin come in. The margin is dead here by the
+       line above — it separated the wordmark from a tagline that is no longer displayed. */
+    .topbar{gap:4px;padding-left:12px;padding-right:12px}}
+  /* AND ON A SMALL PHONE, ONE THING GOES. Closing 375px and below is not a spacing problem — the row's
+     own items are wider than the screen — so something has to go, and which one is a decision about what
+     a reader keeps rather than a number to tune. Ruled: the back arrow. The product's name and the risk
+     label stay, because they say where the reader is and what the answer was; the arrow is a route back
+     to a list, and a reader on a phone has the browser's own. (owner, 2026-09-17) */
+  @media(max-width:375px){.topbar .tb-back{display:none}}
 
   /* hero: conclusion card (dial + verdict) + scope card jurisdiction chips */
   .heroGrid .gauge{display:flex;flex-direction:column;justify-content:flex-start}
@@ -268,7 +313,26 @@
 
 
   /* cross-region rights-holder rows (.rrow) + secondary region groups (.rgroup) */
+  /* A PANEL THAT SCROLLS SIDEWAYS SAYS SO, the same way the knockout's tables do.
+     `overflow-y:auto` alone makes the OTHER axis compute to auto as well, so this panel has scrolled
+     horizontally for as long as it has scrolled vertically — and drawn nothing to say it. Measured on a
+     delivered global preliminary at 390px: 377px of rows in a 336px box, 41px unreachable, no bar.
+     A reader who cannot see that it drags does not drag it, and a holder's jurisdiction sits in the part
+     that is off the edge.
+
+     THE TWO INSTRUCTIONS CANNOT SIT TOGETHER, and that was measured rather than reasoned on the
+     knockout: setting the standard scrollbar-width alongside the pseudo-elements makes the engine take
+     the standard path and ignore them, and on the engine that publishes these reports the standard path
+     draws an overlay bar with no layout height at all — both together 0px, the pseudo-elements alone
+     9px, the standard properties alone 0px. So the standard ones sit behind a support query the engines
+     carrying the pseudo-elements never enter, and each engine gets exactly one instruction. Written the
+     way anyone would write it — belt and braces — it renders nothing and the stylesheet gives no sign. */
   .keypanel{overflow-y:auto}
+  .keypanel::-webkit-scrollbar{height:9px;-webkit-appearance:none}
+  .keypanel::-webkit-scrollbar-track{background:transparent}
+  .keypanel::-webkit-scrollbar-thumb{background:var(--faint);border-radius:5px}
+  @supports not selector(::-webkit-scrollbar){
+    .keypanel{scrollbar-width:thin;scrollbar-color:var(--faint) transparent}}
   .rrow{border-top:1px solid var(--line)}
   .rrow:first-of-type{border-top:0}
   .rrow>summary{cursor:pointer;list-style:none;display:flex;align-items:center;gap:9px;padding:8px 4px}
@@ -332,9 +396,11 @@
        and internal notes (.int-note, hidden above) are the only two things print ever drops. */
     details>*:not(summary){display:block!important}
     details>summary{list-style:none;cursor:default}
-    /* `details.searched` is a SECTION TITLE, so it keeps its summary in print like the region rows and
-       the secondary groups — a printed report that drops "What was searched" loses the heading over the
-       counts, not just a control. What it must not print is the ▸/▾ toggle, which on paper is a
+    /* `details.searched` keeps its summary in print like the region rows and the secondary groups. The
+       reason has CHANGED and the behaviour has not: the summary used to carry the section's own heading,
+       so dropping it in print lost the heading over the counts. The heading is now an <h2> in a section
+       of its own, as the approved board draws it, and print cannot lose it. What the summary still
+       carries is the sub-label over the counts, which is worth printing on its own. What it must not print is the ▸/▾ toggle, which on paper is a
        right-pointing arrow over content that is already fully expanded. Found by the print check, which
        walks a rendered page and refuses any disclosure that is in neither list; the public suite does
        not run it, so the commit that added this fold could ship the half it did not think about. */
@@ -507,9 +573,17 @@
   details.searched[open]>summary::before{content:'▾'}
   details.searched .gcount{margin-left:auto;color:var(--slate);font-weight:500;font-size:12.5px}
   details.searched .gbody{padding:0 18px 12px}
+  .wchips{display:flex;flex-wrap:wrap;gap:6px;margin-top:6px}
+  details.searched .wstate{font-weight:600}
+  details.searched .wnote{display:block;margin-top:4px;font-size:12.5px;line-height:1.45;color:var(--slate)}
   details.searched .row{display:grid;grid-template-columns:200px 1fr;gap:12px;padding:7px 0;border-top:1px solid var(--line);font-size:13.5px}
   details.searched .k{font-size:10.5px;letter-spacing:.12em;text-transform:uppercase;color:var(--faint);padding-top:3px}
   .openrows,.provwrap{margin-top:12px;border-top:1px solid var(--line);padding-top:10px}
   .openrows .rk,.provwrap .rk{font-size:10.5px;letter-spacing:.12em;text-transform:uppercase;color:var(--faint);margin-bottom:6px}
   .provnote{margin:0;font-size:12.5px;line-height:1.5;color:var(--slate)}
   .topbar .tb-lockup{margin-right:10px;flex:0 0 auto}
+  /* AFTER the rule it overrides, not beside its siblings at the breakpoint above: both selectors carry
+     the same weight, so the later one wins and a phone rule written earlier in this file did nothing at
+     all — measured, not assumed. The margin separates the wordmark from the tagline, and the tagline is
+     already hidden at this width. */
+  @media(max-width:560px){.topbar .tb-lockup{margin-right:0}}

package/driver/publish/xlsx.mjs

@@ -618,7 +618,26 @@ export async function buildAudit(contract, auditParsed, outPath, mark = '', fm =
   });
 
   // 4 · Coverage & gaps — the honest completeness ledger, state coloured.
-  addSheet(wb, 'Coverage & gaps', COVERAGE_COLS, coverageRows(coverage), (row, _d, kept) => {
+  // ── A CONDITION THAT REACHED NO PAGE IS A GAP, AND IT BELONGS ON THE GAPS SHEET ──────────────────
+  //
+  // A report republished from a run recorded before conditions carried two texts can hold a condition
+  // whose reader-facing sentence was never stored and cannot be composed. It is dropped rather than
+  // printed in the engine's own words, and a drop nobody records is the disclosure closing quietly —
+  // which is worse than the sentence it replaced. Ruled 2026-09-17: one row here, one line in the run
+  // record, no new wording, and delivery never fails for it.
+  //
+  // THE ROW IS AN ORDINARY COVERAGE ROW, built by the same function as every other, so it carries the
+  // same four columns and takes the same State colour. It is not a second shape and not a new sheet.
+  // The words in it are the run record's own: nothing here composes prose.
+  //
+  // AND THE PROBES THE RUN DECIDED ON AND DID NOT MAKE, on the same footing. The recall net's owner
+  // budget drops its excess with the party and the probe id recorded; until this row the excess reached
+  // no reader, so a search that decided on nineteen ownership checks and made five read as one that
+  // made the checks it wanted. Same builder, same four columns, same State colour: this is not a second
+  // shape and not a new sheet, and the words are the run receipt's own.
+  addSheet(wb, 'Coverage & gaps', COVERAGE_COLS,
+    [...coverageRows(coverage), ...coverageRows(contract?.droppedConditions || []),
+     ...coverageRows(contract?.undispatchedProbes || [])], (row, _d, kept) => {
     if (!kept.has('State')) return;
     const st = row.getCell('State'); const f = STATE_FILL[String(st.value).trim()];
     if (f) { st.fill = { type: 'pattern', pattern: 'solid', fgColor: { argb: 'FF' + f } }; st.font = { bold: true }; }

package/driver/queue-order.mjs

@@ -21,7 +21,7 @@
 // parse set, or prelim-driver.path's watch — and reordering must NOT wake the runner.
 
 import { readFileSync, writeFileSync, renameSync, mkdirSync, readdirSync } from "node:fs";
-import { join, dirname } from "node:path";
+import { join, dirname } from "node:path"; import { studioDirFor } from "../shared/pre-rename-spellings.mjs";
 
 export function queueOrderPath(qdir) { return join(dirname(qdir), ".queue-order.json"); }
 
@@ -69,7 +69,7 @@ export function queueDirsUnder(workspaceRoot) {
   try { names = readdirSync(workspaceRoot); } catch { return out; }
   for (const n of names) {
     if (!n.startsWith("workspace-")) continue;
-    const q = join(workspaceRoot, n, "studio", "prelim-search", "queue");
+    const q = join(studioDirFor(join(workspaceRoot, n)), "queue");
     try { readdirSync(q); out.push(q); } catch { /* no queue in this workspace */ }
   }
   return out.sort();

package/driver/recording-agreement.mjs

@@ -70,7 +70,7 @@ export const SURFACE = "surface";
  * performs anyway. Since the warm and cold rungs DERIVE the tool name from `TOOL_WRITTEN_ARTIFACTS`,
  * so adding that row — step 1 of every conversion — makes both rungs name the record tool, and (a) went
  * quiet for it whatever the dispatch said. Measured on conversion 3 before its dispatch was touched: the
- * grant carried `record_prelim_variants`, the dispatch did not mention it, both repair rungs did, and (a)
+ * grant carried `record_clearance_variants`, the dispatch did not mention it, both repair rungs did, and (a)
  * was silent. The guard asked a question the conversion's own bookkeeping answered — the tautology shape
  * `b04d6d58` and the `RECORDING_TOOLS` non-derivation both exist to remove.
  *

package/driver/reference-score.mjs

@@ -1107,7 +1107,7 @@ export function planSubQueries({ plan = null, execution = null, scopeTerritories
   // ── THE IN-SCOPE SWEEP'S OWN STATE — what decides whether a narrow was OWED at all ───────────────
   //
   // `subQueryState` returns `none` for a territory with no entry of its own, and that one value covers
-  // two opposite situations. The doctrine (`skills/prelim-register/SKILL.md`, Recipe 1 §2b) says a slice
+  // two opposite situations. The doctrine (`skills/clearance-register/SKILL.md`, Recipe 1 §2b) says a slice
   // gets its own `register_enumerate` ONLY on the guarded crowd-narrow path — when Step 2, the
   // region-scoped in-scope sweep, returned `incomplete` and a major may sit in the un-paged remainder.
   // When Step 2 returns `enumerated` the complete set provably contains every in-scope slice and the

package/driver/register-availability.mjs

@@ -41,9 +41,9 @@
 // CORRECTED 2026-08-11 — THIS PARAGRAPH USED TO SAY "one qid per office … which is the shape
 // joinPlanToBands already has", AND THAT WAS FALSE ABOUT THE COMPILER IT DOCUMENTS. There is no
 // per-office qid. compileRegisterPlan narrows ONE shared `regions` array and hands it to every entry
-// (register-plan.mjs:572 compileRegisterPlan); the unreachable office produces no entry, so no qid, so no band block, so
+// (register-plan.mjs:779 compileRegisterPlan); the unreachable office produces no entry, so no qid, so no band block, so
 // nothing ever reaches joinPlanToBands' deferred bucket — whose only source is a block stamped
-// `error:true && deferred:true` (register-plan.mjs:1115 extendRegisterPlan).
+// `error:true && deferred:true` (register-plan.mjs:1317 extendRegisterPlan).
 //
 // The consequence was not academic. `deferred_coverage` rode the plan and nothing that a reader sees
 // read it: coverage-form.mjs seeded its deferred rows from skeleton qids alone, so an EU+US matter on a

package/driver/register-count.mjs

@@ -336,10 +336,24 @@ export async function countRegisterHits({
       try { r = await counter(term, p, { classes: scoped, regions }); }
       catch (e) { r = { ok: false, total: null, reason: `count threw: ${String(e?.message ?? e).slice(0, 200)}` }; }
       const ok = Boolean(r?.ok) && Number.isFinite(r?.total);
+      // A DISCLOSED APPROXIMATION IS AN ANSWER, AND IT WAS BEING READ AS A FAILURE. When the register
+      // says "more than ten thousand", it has answered — it has answered with a floor instead of a
+      // count, which is a different thing from not answering at all. `ok` is false for it because the
+      // total is deliberately not finite (an approximation must never become a number), so everything
+      // downstream saw a dead probe and the client was told the count was not available: the same words
+      // the report uses when the register could not be reached. The direction was inverted, too —
+      // saturation is a finding about the mark, and the denser the crowd the more certainly it was
+      // suppressed.
+      const approximated = !ok && Boolean(r?.ok) && r?.approximate === true && Number.isFinite(r?.floor);
+      // THE REFUSAL FIELD IS `cause` ON THIS PROVIDER AND `reason` ON OTHERS, and reading only one of
+      // them is why an honest refusal arrived as the fallback string with the receipts ledger recording
+      // "unknown". The same mismatch is described above `listRecords`, where it was fixed; this is the
+      // other half of it. Both are read, in the order a caller would expect.
+      const refusal = r?.reason ?? r?.cause ?? null;
       // A CLIENT-SIDE refusal (the provider's query language cannot express this question — a term
       // carrying parentheses, an office outside its vocabulary) is
       // deterministic: no retry and no resume can change it, so it settles rather than re-billing.
-      const deterministic = !ok && (isCapabilityGap(r?.reason) || Boolean(r?.unsupported));
+      const deterministic = !ok && !approximated && (isCapabilityGap(refusal) || Boolean(r?.unsupported));
       if (ledgerPath) {
         try {
           appendFileSync(ledgerPath, JSON.stringify({
@@ -350,13 +364,18 @@ export async function countRegisterHits({
             ...(form ? { term, variant_form: form } : {}),
             classes: scoped, regions, provider, probe: r?.probe ?? null,
             ok, total: ok ? r.total : null, took_ms: Date.now() - started,
-            ...(ok ? {} : { cause: String(r?.reason ?? "unknown").slice(0, 300) }),
+            // An approximation is recorded as what it is. It billed and it answered, so a receipt
+            // calling it a failure with cause "unknown" misreports both halves.
+            ...(approximated ? { approximate: true, floor: r.floor } : {}),
+            ...(ok || approximated ? {} : { cause: String(refusal ?? "unknown").slice(0, 300) }),
           }) + "\n");
         } catch { /* receipts are best-effort, never fatal — same as the sweep ledger */ }
       }
-      return ok
-        ? { total: r.total }
-        : { total: null, unavailable: String(r?.reason ?? "the count could not be taken").slice(0, 300), ...(deterministic ? { deterministic: true } : {}) };
+      if (ok) return { total: r.total };
+      // `total` stays null for an approximation and that is the rule, not an oversight: the floor is not
+      // a count and may never be filled in as one. What travels beside it is the disclosure.
+      if (approximated) return { total: null, approximate: true, floor: r.floor };
+      return { total: null, unavailable: String(refusal ?? "the count could not be taken").slice(0, 300), ...(deterministic ? { deterministic: true } : {}) };
     };
 
     // The aggregate: the provider's EXACT predicate, once per generated form, summed.
@@ -503,12 +522,38 @@ export function countsForMark(doc, name) {
  * Office CODES, not names: `scope.regions` on the same artifact is already codes, and the alternative
  * is inventing a display layer that has to stay in step with the office vocabulary of six providers.
  */
+/**
+ * The register's own floor for a count it stopped taking, or null.
+ *
+ * ONE READING FOR EVERY PAGE THAT SHOWS A COUNT. The glance line printed the floor and the counts table,
+ * the coverage clause and the workbook beside it still printed "not available", so one report said two
+ * different things about the same cell. A floor counts only with the register's flag AND the number —
+ * a flag with no number says no more than "unknown" does.
+ */
+export function disclosedFloor(c) {
+  return c?.approximate === true && Number.isFinite(c?.floor) ? c.floor : null;
+}
+
+/** A floor as every page prints it: the register's own figure, and no sentence around it. */
+export const moreThan = (floor) => `more than ${floor.toLocaleString("en-US")}`;
+
 export function countLine(entry) {
   if (!entry?.counts) return null;
   const parts = COUNT_PREDICATES.map((p) => {
     const c = entry.counts[p.key];
     const word = p.glance ?? p.label.toLowerCase();
     if (Number.isFinite(c?.total)) return `${c.total} ${word}`;
+    // A REGISTER THAT ANSWERS WITH A FLOOR HAS ANSWERED. Some registers stop counting and report
+    // "more than ten thousand" rather than a total; that is the register's own figure and it is what
+    // the client is shown, as a number. Rendering it as "not available" beside a register that could
+    // not be reached at all tells a reader the same thing about two different facts, and the one the
+    // reader would act on — go and look elsewhere — is wrong for this one.
+    //
+    // No sentence, no adjective: the rest of this line is figures and what they counted, and a
+    // qualification written here would be the only prose on it.
+    if (disclosedFloor(c) !== null) return `${word}: ${moreThan(disclosedFloor(c))}`;
+    // Left for a register this deployment could not reach or could not ask. Those have no figure at
+    // all, which is what this phrase now means and the only thing it means.
     return `${word}: not available`;
   });
   const scope = entry.classScope === "all-classes"