clearotron 0.3.2-beta.7 → 0.3.2-beta.9

package/driver/binding-layers.mjs

@@ -14,7 +14,7 @@
 //
 // AND IT PRESENTED AS SEARCHED, which is the part that made it a compliance defect rather than a
 // coverage one. The disclosure machinery only describes territories the compiler recorded as
-// UNREACHABLE. These were recorded as reached, so there was no row to render, and `prelim-search`'s
+// UNREACHABLE. These were recorded as reached, so there was no row to render, and `clearance-search`'s
 // rule against rendering a deferred jurisdiction as a clean negative had nothing to fire on.
 //
 // ── TWO FACTS, KEPT APART ON PURPOSE ────────────────────────────────────────────────────────────────

package/driver/citation-census.json

@@ -1,5 +1,5 @@
 {
-  "citations": 545,
-  "files": 3878,
-  "checkable": 105
+  "citations": 489,
+  "files": 3945,
+  "checkable": 126
 }

package/driver/{prelim-variants-record.mjs → clearance-variants-record.mjs}

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
-// prelim-variants-record.mjs — the recording transport for the variant manifest.
+// clearance-variants-record.mjs — the recording transport for the variant manifest.
 //
 // Conversion 3, after blind-frame, skeptic, frame-diff and matter-frame. It is
 // the first conversion whose ruling includes CLASS 3, and the first that can DELETE a derivation rather
@@ -17,7 +17,7 @@
 // O3c measured the cost of that hand-formatting directly: 9 Bash calls with 4 WRITES across 15 attempts,
 // and the shape is `python3 -c` over `variant-manifest.json` — the seat pre-checking its own JSON before
 // saving it. That is CLASS 3, and the design's ruling is that such a check does not get a compute tool:
-// it moves to the ACCEPTANCE BOUNDARY. `acceptPrelimVariants` measures on accept and refuses with the
+// it moves to the ACCEPTANCE BOUNDARY. `acceptClearanceVariants` measures on accept and refuses with the
 // measured value, so the check runs on every call instead of when a seat remembers to run it.
 //
 // ── AND IT DELETES A DERIVATION, WHICH IS THE REAL PRIZE ────────────────────────────────────────────
@@ -45,8 +45,8 @@ export const PROSE_FILE = "variant-manifest.md";
 const SCHEMA_VERSION = 1;
 
 /** Where the call's evidence lives — the driver's own record of what the seat handed it. */
-export function prelimVariantsCallPaths(runDir) {
-  const dir = driverDir(runDir, "prelim-variants-calls");
+export function clearanceVariantsCallPaths(runDir) {
+  const dir = driverDir(runDir, "clearance-variants-calls");
   return { dir, payload: join(dir, "call-001.json"), accepted: join(dir, "accepted.json") };
 }
 
@@ -107,7 +107,7 @@ export function renderScopeLedgerTable(rows) {
  * Rendering from the parsed model is what makes the two artifacts one statement: they cannot disagree
  * about a variant, because both are projections of one validated object. PURE.
  */
-export function renderPrelimVariants(model, scopeRows) {
+export function renderClearanceVariants(model, scopeRows) {
   // ── HEADING DEPTH IS LOAD-BEARING, AND THIS IS THE ONE THING IN THIS FILE NOT TO "TIDY" ────────────
   //
   // `variantsManifestAudit` (common-law-receipts.mjs) arms a term collector on any heading matching
@@ -151,7 +151,7 @@ export function renderPrelimVariants(model, scopeRows) {
       ...model.search_floor.map((a) => `- ${a}`), "");
 
   out.push(...renderScopeLedgerTable(scopeRows));
-  out.push("---", "", "Rendered by the driver from the stage's `record_prelim_variants` call. "
+  out.push("---", "", "Rendered by the driver from the stage's `record_clearance_variants` call. "
     + `The structured model in ${MODEL_FILE} is the authority for the terms, and scope-ledger.json for the `
     + "ledger; this file is their human-readable projection.", "");
   return out.join("\n");
@@ -178,8 +178,8 @@ const DECLARED = Object.freeze({
 export const refuseUndeclared = (params) => refuseUndeclaredShared(params, DECLARED, "variantmodel");
 
 /** The last ACCEPTED call for this run, or null. */
-export function lastAcceptedPrelimVariants(runDir) {
-  return lastAccepted(prelimVariantsCallPaths(String(runDir ?? "")).accepted, readFileSync);
+export function lastAcceptedClearanceVariants(runDir) {
+  return lastAccepted(clearanceVariantsCallPaths(String(runDir ?? "")).accepted, readFileSync);
 }
 
 /**
@@ -190,7 +190,7 @@ export function lastAcceptedPrelimVariants(runDir) {
  * Preserving rather than requiring, because nothing here can tell a first call from a repair and a
  * product refusal is never a pass. See preserve-merge.mjs for the class.
  */
-export function mergePrelimVariantsCall(stored, received) {
+export function mergeClearanceVariantsCall(stored, received) {
   const base = stored ?? {};
   return {
     mark: received?.mark,
@@ -207,7 +207,7 @@ export function mergePrelimVariantsCall(stored, received) {
   };
 }
 
-export function acceptPrelimVariants(params) {
+export function acceptClearanceVariants(params) {
   const model = {
     schema_version: SCHEMA_VERSION,
     mark: params?.mark,
@@ -250,7 +250,7 @@ export function acceptPrelimVariants(params) {
     scopeRows.push({ layer, item, status, reason, reopen_trigger });
   }
 
-  return { ok: true, model: parsed, scopeRows, content: renderPrelimVariants(parsed, scopeRows) };
+  return { ok: true, model: parsed, scopeRows, content: renderClearanceVariants(parsed, scopeRows) };
 }
 
 /**
@@ -263,8 +263,8 @@ export function acceptPrelimVariants(params) {
  * the first two, so a crash between writes leaves the run with its load-bearing files and a missing
  * restatement rather than a restatement of something never stored.
  */
-export function recordPrelimVariants(runDir, received, { now = () => new Date().toISOString() } = {}) {
-  const { dir, payload } = prelimVariantsCallPaths(String(runDir ?? ""));
+export function recordClearanceVariants(runDir, received, { now = () => new Date().toISOString() } = {}) {
+  const { dir, payload } = clearanceVariantsCallPaths(String(runDir ?? ""));
   // — ONE FILE PER CALL, refusals included. This wrote a single fixed `call-001.json`,
   // so a turn refused and then re-sent kept only the survivor: the file whose header promises "including
   // calls that were refused" held the one call that was not. Sequence 1 still resolves to `call-001.json`,
@@ -288,8 +288,8 @@ export function recordPrelimVariants(runDir, received, { now = () => new Date().
   if (undeclared) {
     return { written: null, refused: undeclared, captured: closeCapture({ ok: false, refused: undeclared }), capture_failed: captureFailed };
   }
-  const call = mergePrelimVariantsCall(lastAcceptedPrelimVariants(runDir), received);
-  const verdict = acceptPrelimVariants(call);
+  const call = mergeClearanceVariantsCall(lastAcceptedClearanceVariants(runDir), received);
+  const verdict = acceptClearanceVariants(call);
   if (!verdict.ok) {
     return { written: null, refused: verdict.reason, captured: closeCapture({ ok: false, refused: verdict.reason }), capture_failed: captureFailed };
   }
@@ -299,7 +299,7 @@ export function recordPrelimVariants(runDir, received, { now = () => new Date().
   try {
     writeFileSync(at, JSON.stringify(verdict.model, null, 2) + "\n");
     // Step 5. BEST-EFFORT, in its own try — see report-overview-record.mjs for why.
-    try { writeFileSync(prelimVariantsCallPaths(String(runDir ?? "")).accepted, acceptedEnvelope(call, now())); }
+    try { writeFileSync(clearanceVariantsCallPaths(String(runDir ?? "")).accepted, acceptedEnvelope(call, now())); }
     catch { /* a lost base is never a lost artifact */ }
     writeFileSync(proseAt, verdict.content);
   } catch (e) {
@@ -320,7 +320,7 @@ export function recordPrelimVariants(runDir, received, { now = () => new Date().
 
 /** The typed scope-ledger rows, for the driver's own serialisation. PURE — no re-parse of the table. */
 export function recordedScopeRows(received) {
-  const v = acceptPrelimVariants(received);
+  const v = acceptClearanceVariants(received);
   return v.ok ? v.scopeRows : [];
 }
 
@@ -332,7 +332,7 @@ export function recordedScopeRows(received) {
  * and it carried no ledger rows" — which is a manifest with an empty ledger, not a manifest to re-parse.
  * Collapsing the two would send the driver back to the table on a run that had already answered.
  *
- * The rows are re-validated through `acceptPrelimVariants` rather than trusted raw out of the capture:
+ * The rows are re-validated through `acceptClearanceVariants` rather than trusted raw out of the capture:
  * the capture records what ARRIVED, untidied, including a refused call's params. IMPURE (reads the run).
  */
 export function recordedScopeLedgerRows(runDir) {
@@ -344,22 +344,22 @@ export function recordedScopeLedgerRows(runDir) {
   // partial does not validate on its own, so this would have returned null — "no typed call, go and
   // parse the prose" — on a run whose merged call had validated and written a manifest. The accepted
   // base IS the merged, validated call, which is exactly what this wants.
-  const merged = lastAcceptedPrelimVariants(dir0);
+  const merged = lastAcceptedClearanceVariants(dir0);
   if (merged) {
-    const v = acceptPrelimVariants(merged);
+    const v = acceptClearanceVariants(merged);
     if (v.ok) return v.scopeRows;
   }
   // FALLBACK: runs that predate the base, which have a capture and no accepted.json. Unchanged
   // behaviour for them, and it is why this is a fallback rather than a replacement.
   let captured;
-  try { captured = JSON.parse(readFileSync(prelimVariantsCallPaths(dir0).payload, "utf8")); }
+  try { captured = JSON.parse(readFileSync(clearanceVariantsCallPaths(dir0).payload, "utf8")); }
   catch { return null; }                                  // no call — the prose path is the answer
-  const v = acceptPrelimVariants(captured?.params);
+  const v = acceptClearanceVariants(captured?.params);
   return v.ok ? v.scopeRows : null;                       // a refused call never wrote a manifest either
 }
 
 /** Was this run's manifest written through the typed transport? The ruled discriminator. */
-export function prelimVariantsWasRecorded(runDir) {
-  try { readFileSync(prelimVariantsCallPaths(String(runDir ?? "")).payload, "utf8"); return true; }
+export function clearanceVariantsWasRecorded(runDir) {
+  try { readFileSync(clearanceVariantsCallPaths(String(runDir ?? "")).payload, "utf8"); return true; }
   catch { return false; }
 }

package/driver/common-law-receipts.mjs

@@ -46,7 +46,7 @@ function rowCells(ln) {
  * The variant terms the manifest commits the grid to search: data rows of sections whose heading
  * contains "variants" (the Variants tables). "Variant applicability" sections (category
  * dispositions, not search terms) are excluded. The term column is resolved from each table's
- * HEADER row — the live prelim-variants format is `| Category | Value | Rationale | Verify? |`
+ * HEADER row — the live clearance-variants format is `| Category | Value | Rationale | Verify? |`
  * (term in "Value"), while older/test manifests use `| Variant | ... |` (term first); default 0
  * when no recognizable header exists.
  */
@@ -842,7 +842,7 @@ export function mergeCommonLawFindings(parts) {
 // FALSE against the real ledger, and the arm failed the very run it was derived from:
 //
 //   • `candidates[]` is RAW, UNJUDGED web-search output — the grid program records up to 8 candidates
-//     per cell "without judging similarity" (skills/prelim-common-law/perplexity-prompts.md), and the
+//     per cell "without judging similarity" (skills/clearance-common-law/perplexity-prompts.md), and the
 //     filtering is explicitly the model's. The real cell `CORAL FREEZE × vitaminshoppe.com` holds three:
 //     a BCAA how-to video, a Hawaiian shaved-ice supplement and a Dallas store-locator page. The
 //     model's "No results" means "no relevant listing", and no deterministic test can tell that page

package/driver/company-bundle.mjs

@@ -44,7 +44,7 @@ import { Refusal } from "../shared/onboarding-store.mjs";
  * Broken means someone TRIED to select one and it does not resolve, and falling back there would rate a
  * client's matters under a framework nobody chose while the output said everything was fine.
  *
- * The profile validator checks the SHAPE of this string only (`skills/prelim-search/<file>.md`, no
+ * The profile validator checks the SHAPE of this string only (`skills/clearance-search/<file>.md`, no
  * escape) and never whether the file is there — so a shape-valid path to a document that does not exist
  * validates cleanly and fails at rating time, which is the wrong place to find out.
  */
@@ -58,9 +58,9 @@ export function resolveFramework(requested, {
   const path = String(requested).trim();
   // Shape first, and by the profile validator's own rule rather than a second copy of it: a path that
   // would be refused at load must be refused here, in the same words, before anything is written.
-  if (!/^skills\/prelim-search\/[^/]+\.md$/.test(path) || path.includes(".."))
+  if (!/^skills\/(?:clearance|prelim)-search\/[^/]+\.md$/.test(path) || path.includes(".."))   // either spelling of the folder, as the profile loader
     throw new Refusal(
-      `--framework must name a document of the form "skills/prelim-search/<file>.md" (got ${JSON.stringify(path)}). `
+      `--framework must name a document of the form "skills/clearance-search/<file>.md" (got ${JSON.stringify(path)}). `
       + `A profile selects a SHIPPED framework, never an arbitrary path.`);
 
   // RESOLVED THE WAY THE RATING STAGE RESOLVES IT, never by joining the repo root. `skills/...` paths

package/driver/compose-read.mjs

@@ -55,6 +55,7 @@ const MAX_CLASSES = 15;
 const MAX_TERRITORIES = 20;
 const MAX_NOTES = 8;
 import { PRODUCTS, PRODUCT_IDS } from "./products.mjs";
+import OFFERED from "../shared/offered-territories.json" with { type: "json" };   // the form's own list, minted by rule
 
 const MAX_STR = 600;
 const MAX_NOTE = 240;
@@ -62,22 +63,15 @@ const MAX_NOTE = 240;
 /**
  * The territory vocabulary, as offered by the composer's Where field.
  *
- * MIRRORS `REGIONS` + `COUNTRIES` in portal-ui/src/contract/composerProduct.ts. Kept here only so the
- * prompt can name it; the authority on what is selectable is the UI's own list.
+ * READ FROM THE SAME FILE THE FORM READS: shared/offered-territories.json, minted by rule from what the
+ * registers can search (scripts/mint-offered-territories.mjs). It used to be a hand-kept copy of the form's
+ * own list, "mirrored" by a comment, and a comment keeps nothing equal. One file read twice cannot differ.
  *
- * "Worldwide" LEFT THIS LIST. It is not a territory the composer offers and never was — it is a MODE,
- * and the read now carries it as its own boolean. Leaving it here taught the model to write a token the
- * form had to strip back out, which is how "everywhere" and "nowhere in particular" became the same
- * bytes on the wire in the first place.
+ * "Worldwide" is not in it. It is not a territory the composer offers and never was — it is a MODE,
+ * and the read carries it as its own boolean. Listing it taught the model to write a token the form had to
+ * strip back out, which is how "everywhere" and "nowhere in particular" became the same bytes on the wire.
  */
-export const PROMPT_TERRITORIES = Object.freeze([
-  "European Union", "Benelux", "African Regional (ARIPO)",
-  "United States", "United Kingdom", "Ireland", "France", "Germany", "Spain", "Italy", "Netherlands",
-  "Switzerland", "Austria", "Sweden", "Norway", "Poland", "Bulgaria", "Greece", "Turkey", "Canada",
-  "Mexico", "Brazil", "Argentina", "China", "Hong Kong", "Taiwan", "Macau", "Japan", "South Korea",
-  "Singapore", "India", "Thailand", "Australia", "New Zealand", "United Arab Emirates", "Saudi Arabia",
-  "South Africa",
-]);
+export const PROMPT_TERRITORIES = Object.freeze([...OFFERED.regions, ...OFFERED.countries].map((t) => t.name));
 
 /**
  * The shape the model must answer in.

package/driver/config-inventory.mjs

@@ -42,7 +42,10 @@ import {
   DEFAULT_ENGINE_ID, ENGINE_BINARIES, PROVIDERS, RESEARCH_PROVIDERS, SERP_PROVIDERS,
   missingCredentials, preflightEngineBinary, providerIdFrom,
 } from "./driver.config.mjs";
-import { resolveAuthMode } from "./engine/auth.mjs";
+import {
+  resolveAuthMode, billingMode, cloudsSwitchedOn, BILLING_MODES, CLOUD_SWITCH, CLOUD_CREDENTIAL_CHECK,
+} from "./engine/auth.mjs";
+import { billingRefusalWords } from "./run-requirements.mjs";   // — a refusal that quotes the billing word says it by name
 import { CASELAW_BRIDGES } from "./engine/mcp/gather-config.mjs";   // — the list that decides what is spawned
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
@@ -60,7 +63,9 @@ const shown = (names) => names.map((n) => n);
  * absent, because the alternative is silently billing a subscription the operator thought they had
  * stopped using (engine/auth.mjs's opening argument). A writer that caught that and recorded "unknown"
  * would erase precisely the misconfiguration a staff config page exists to surface, so it is caught and
- * recorded AS ITSELF: mode `api-key`, `apiBilled: false`, and a fault naming the variable to set.
+ * recorded AS ITSELF: mode `api-key`, `apiBilled: false`, and a fault naming the variable to set. The
+ * cloud mode's refusals, and a word that is not a mode at all, are recorded as themselves too, by the
+ * refusal's own sentence.
  *
  * `apiBilled` is what the page should believe over `mode` — the two come apart in exactly this case,
  * and only one of them describes who gets the invoice.
@@ -77,14 +82,38 @@ export function engineInventory(env = process.env) {
   const billing = (() => {
     try {
       const a = resolveAuthMode({ engineName: id, env });
-      return { mode: a.mode, apiBilled: a.apiBilled === true, missing: [] };
-    } catch {
-      // The one state resolveAuthMode throws for. The message carries no value, but it is not copied
-      // either — the two variable names are reconstructed from the table so this cannot drift from it.
+      // `cloud` is the resolver's own answer, never re-derived here: the account a run bills is whatever
+      // the run door resolves, and a page that worked it out a second way could name another.
+      const cloud = a.cloud ?? null;
+      return { mode: a.mode, apiBilled: a.apiBilled === true, missing: [], cloud, cloudName: cloudName(cloud) };
+    } catch (e) {
+      // Recorded AS ITSELF, whichever refusal it was. An API-key mode with no key names the variable to
+      // set, reconstructed from the table so it cannot drift from it. Every other refusal (a cloud mode with
+      // no cloud switched on or with two, a cloud switch beside a mode it contradicts, a word that is not a
+      // mode) leaves `missing` empty, because the page reads `missing` as "set this key" and a key that is
+      // set is not missing, and carries a `reason` the page words itself (billingRefusalReason, below).
+      const mode = billingMode(env);
+      const keyAbsent = Boolean(spec?.apiKeyEnv) && String(env[spec.apiKeyEnv] ?? "") === "";
+      if (mode === "api-key" && keyAbsent) {
+        return { mode, apiBilled: false, missing: shown([spec.apiKeyEnv]), cloud: null, cloudName: null };
+      }
+      const reason = billingRefusalReason(id, env);
+      const notAMode = reason.kind === "not-a-mode";
       return {
-        mode: "api-key",
-        apiBilled: false,
-        missing: spec?.apiKeyEnv ? shown([spec.apiKeyEnv]) : [],
+        // A WORD THAT IS NOT A MODE IS NOT RECORDED. It is whatever was typed into the setting that decides
+        // who pays, and a key pasted there by mistake is that word; this inventory is written to a file and
+        // served to a browser. So the mode reads `unknown`, and the refusal says the setting by name.
+        mode: notAMode ? "unknown" : mode,
+        apiBilled: false, missing: [], cloud: null, cloudName: null,
+        // THAT REFUSAL IS WRITTEN HERE, NOT CLEANED FROM THE RESOLVER'S. The resolver's sentence quotes the
+        // typed word, and removing it by pattern depends on how the word is spelled: a word that itself
+        // contains " is not a billing mode" left its tail behind. Built from names alone, nothing typed can
+        // reach it. Every other refusal quotes only setting names and the three mode words.
+        refusal: notAMode
+          ? `${reason.setting} is set to a word that is not a billing mode — refusing to guess, because the guess `
+            + `would bill the subscription. One of: ${reason.modes.join(", ")}.`
+          : billingRefusalWords(String(e?.message ?? e)),
+        reason,
       };
     }
   })();
@@ -104,6 +133,80 @@ export function engineInventory(env = process.env) {
   return { id, vendor: spec?.vendor ?? null, known: Boolean(spec), billing, binaryPresent };
 }
 
+/**
+ * What a reader calls the account a cloud mode bills: "Google Cloud", "Microsoft Azure", "Amazon Bedrock"
+ * or "Gateway". Null for no cloud.
+ *
+ * ONE TABLE OF CLOUD NAMES, NOT TWO. `CLOUD_CREDENTIAL_CHECK` in engine/auth.mjs already names each cloud
+ * the way a reader knows it, for the advice a refused sign-in prints, and this reads it rather than keeping
+ * a second list that could name a cloud differently on the page. It writes the gateway "the gateway", for
+ * use inside a sentence; a label on a page drops the article and starts with a capital, and that one
+ * adjustment is the whole of what this adds.
+ */
+export function cloudName(cloud) {
+  const who = CLOUD_CREDENTIAL_CHECK[cloud]?.who;
+  if (!who) return null;
+  const bare = who.replace(/^the /, "");
+  return bare.charAt(0).toUpperCase() + bare.slice(1);
+}
+
+/**
+ * WHY A BILLING SETTING REFUSES EVERY SEARCH, as data: which refusal it is and the names involved, so the
+ * config page words it once, in plain English, without reading the resolver's sentence apart.
+ *
+ * `kind` is one of:
+ *   switch-beside-mode  subscription or api-key, and a cloud's switch on beside it (`clouds`)
+ *   two-clouds          cloud, and more than one cloud switched on (`clouds`)
+ *   no-cloud            cloud, and no cloud switched on and no gateway address (`clouds` lists every
+ *                       switch, and `gateway` the gateway's setting, as the choices to make)
+ *   not-a-mode          a word that is not a billing mode (`modes` are the ones this engine takes)
+ *   cloud-on-codex      cloud, on the Codex engine, which a cloud account cannot pay for (`engineSetting`
+ *                       and `engineChoice` name the Claude engine only where it would pay: one cloud
+ *                       switched on, or none and a gateway address; otherwise that move is one more refusal)
+ *   unclassified        a refusal this list does not name; the page says only that searches are refused.
+ *                       Not "other": that is an assistant's id in connect-clients.mjs, and a surface may
+ *                       not name one in code
+ *
+ * `defaulted` says the billing setting is blank, so `subscription` is the default and not a word anybody
+ * wrote: a page that said "payment is set to subscription" would send a reader looking for a line their
+ * settings file does not have. It is the state measured on Foundry, a switch on and the word unset.
+ *
+ * THE SAME PREDICATES AS THE RESOLVER, IN ITS ORDER. `resolveAuthMode` refuses by throwing a sentence and
+ * nothing else, so the kind is read back from the same environment through the same functions it uses
+ * (`billingMode`, `cloudsSwitchedOn`), in the order it checks them. Called only once it has thrown.
+ *
+ * NAMES, NEVER A VALUE. `mode` is sent only when it is one of the three modes; the word in a `not-a-mode`
+ * refusal is whatever was typed, and it is not sent at all.
+ */
+export function billingRefusalReason(id, env = process.env) {
+  const mode = billingMode(env);
+  const setting = "CLEAROTRON_AI_BILLING";
+  const clouds = (ids) => ids.map((c) => ({ name: cloudName(c), setting: CLOUD_SWITCH[c] }));
+  const defaulted = String(env[setting] ?? "").trim() === "";
+  const base = { setting, mode: null, defaulted, clouds: [], modes: [], gateway: null, engineSetting: null, engineChoice: null };
+  if (id === "openai-agent") {
+    if (mode === "cloud") {
+      // The resolver's own test for a cloud the Claude engine would pay through, in its words: one switch,
+      // or no switch and a gateway address.
+      const on = cloudsSwitchedOn(env);
+      const claudeWouldPay = on.length === 1 || (!on.length && Boolean(env.ANTHROPIC_BASE_URL));
+      return { ...base, kind: "cloud-on-codex", mode, modes: ["subscription", "api-key"],
+        ...(claudeWouldPay ? { engineSetting: "CLEAROTRON_AI", engineChoice: "anthropic-agent" } : {}) };
+    }
+    if (mode !== "subscription" && mode !== "api-key") return { ...base, kind: "not-a-mode", modes: ["subscription", "api-key"] };
+  }
+  if (id === "anthropic-agent") {
+    const on = cloudsSwitchedOn(env);
+    if ((mode === "subscription" || mode === "api-key") && on.length) return { ...base, kind: "switch-beside-mode", mode, clouds: clouds(on) };
+    if (mode === "cloud" && on.length > 1) return { ...base, kind: "two-clouds", mode, clouds: clouds(on) };
+    if (mode === "cloud" && !on.length) {
+      return { ...base, kind: "no-cloud", mode, clouds: clouds(Object.keys(CLOUD_SWITCH)), gateway: "ANTHROPIC_BASE_URL" };
+    }
+    if (!BILLING_MODES.includes(mode)) return { ...base, kind: "not-a-mode", modes: [...BILLING_MODES] };
+  }
+  return { ...base, kind: "unclassified", mode: BILLING_MODES.includes(mode) ? mode : null };
+}
+
 /**
  * The three states an install can be in, as far as running a search goes..
  *

package/driver/consumption-ledger.mjs

@@ -25,7 +25,7 @@
 // follows, so an MCP tool call can read consumption without dragging the pipeline in.
 
 import { appendFileSync, readFileSync, readdirSync } from "node:fs";
-import { join } from "node:path";
+import { join } from "node:path"; import { studioDirFor } from "../shared/pre-rename-spellings.mjs";
 
 /** Where the consumption ledger sits: beside the matter ledger, in the studio dir. */
 export function consumptionLedgerPath(studioRoot) {
@@ -158,7 +158,7 @@ export function accountConsumption({ workspaceRoot, account, now = Date.now() })
 
   const rows = [];
   for (const ws of workspaces) {
-    const studio = join(workspaceRoot, ws, "studio", "prelim-search");
+    const studio = studioDirFor(join(workspaceRoot, ws));
     try {
       for (const line of readFileSync(consumptionLedgerPath(studio), "utf8").split("\n")) {
         if (!line.trim()) continue;

package/driver/contract-arm2-baseline.json

@@ -11,7 +11,7 @@
     "the baseline tracks named elements, and a rename is a new name. Regenerate rather than work around it.",
     "Measured 139 of 287 declared elements."
   ],
-  "total": 107,
+  "total": 104,
   "byStage": {
     "matter-frame": [
       "### Intake asks line shape — rendered by the driver from intake_asks[]",
@@ -24,7 +24,7 @@
       "Scope reasoning — search-wide/cite-narrow, the in-scope-by-reach routes, and the reopen trigger behind each exclusion",
       "search_channels — the domains where real use of THIS matter's goods would show"
     ],
-    "prelim-variants": [
+    "clearance-variants": [
       "### Scope ledger rows — {Layer, Item, Status: applied|dropped, Reason, Reopen trigger} across variant / field / source / jurisdiction",
       "Archetype — primary (one of six) + modifiers + one-line reasoning",
       "Cross-mark themes — shared elements, shared conceptual themes, shared industry-incumbent alerts (multi-mark requests)",
@@ -84,7 +84,6 @@
       "the dictated entry list — qid, predicate, terms, owner, nice_classes, regions, when-guard, expected_kind, covered_by"
     ],
     "placement-inquiry": [
-      "mark / owner / records / territories / classes on a SELECTED row",
       "retract: <row_id> — withdrawing a seat row already on the form",
       "return payload — the absolute output path plus a 2-3 line summary",
       "select — one record URI of the register candidate being placed",
@@ -94,8 +93,6 @@
     "register-digest": [
       "## Summary counts — total queries executed (search + detail-fetch), enumerated records across N axes, crowd-descriptor count, candidates past the gate, surfaced count, open-verification-flag count",
       "Audit trail — per-unit search/detail-fetch counts, per-jurisdiction `_query` attribution",
-      "INSTRUCTED CHECKS — the answer to each requester ask the register owns",
-      "adopt-or-override each placement by engaging its reason, and the `### Disagreement resolutions` rows (one per surfaced disagreement and per borderline:true, each ADOPTED/OVERRODE in writing)",
       "return payload — the absolute output path plus a 2-3 line summary (counts + the path of the file written)",
       "rolled-up coverage judgment — `sufficient: <true|false>`",
       "source attribution — the register name tagged on each record, plus the EUIPO `environment` word",

package/driver/contract-dictation-registry.mjs

@@ -111,10 +111,10 @@ export function grantedToolsFor(stage) {
 //
 // SIX OF THE TEN ARE ONE SUB-CLASS NOBODY HAD NAMED: SHARED DOCTRINE, DIVERGENT GRANTS. A skill file is
 // served whole to several stages whose grants differ, so the same sentence is a correct instruction to
-// one seat and an order for a tool the next seat does not hold. `prelim-register/SKILL.md` goes to
-// register-unit and register-digest; `prelim-search/phase2-execution.md` goes to skeptic;
-// `prelim-search/synthesis-rules.md` goes to synthesis AND report-overview. report-overview and
-// prelim-variants are tool-free BY DESIGN, each with its reason written out in TOOL_FREE_STAGES;
+// one seat and an order for a tool the next seat does not hold. `clearance-register/SKILL.md` goes to
+// register-unit and register-digest; `clearance-search/phase2-execution.md` goes to skeptic;
+// `clearance-search/synthesis-rules.md` goes to synthesis AND report-overview. report-overview and
+// clearance-variants are tool-free BY DESIGN, each with its reason written out in TOOL_FREE_STAGES;
 // skeptic has since CONVERTED to the RECORDING category (its reason moved to RECORDING_STAGES) and
 // holds exactly its own record tool — still no retrieval tool, so its entries below reproduce
 // unchanged. Each of the three is currently served a document telling it to run a lookup.
@@ -124,31 +124,31 @@ export function grantedToolsFor(stage) {
 // only shrink. The test asserts every entry still reproduces, so a pair fixed in fails CI here
 // until its line is deleted.
 export const TOOL_ORDER_BACKLOG = [
-  { stage: "register-digest", tool: "register_enumerate", site: "driver/skills/prelim-register/SKILL.md",
+  { stage: "register-digest", tool: "register_enumerate", site: "driver/skills/clearance-register/SKILL.md",
     closes: "#865 — shared doctrine: SKILL.md is served to register-unit (holds register) and register-digest "
       + "(holds band only, since the plan freeze retired live search from the judgment seat)." },
-  { stage: "register-digest", tool: "register_execute_plan", site: "driver/skills/prelim-register/SKILL.md",
+  { stage: "register-digest", tool: "register_execute_plan", site: "driver/skills/clearance-register/SKILL.md",
     closes: "#865 — same shared file, same split grant." },
-  { stage: "register-digest", tool: "register_batch_screen", site: "driver/skills/prelim-register/digest.md",
+  { stage: "register-digest", tool: "register_batch_screen", site: "driver/skills/clearance-register/digest.md",
     closes: "#865 — the digest's OWN doctrine, not a shared file: this one is the stage being told to "
       + "batch-screen with a tool its grant does not carry. gather-config.mjs:196 already records that "
       + "this stage's prompt once ordered live register checks; the order outlived the note." },
-  { stage: "register-unit", tool: "band_record", site: "driver/skills/prelim-register/SKILL.md",
+  { stage: "register-unit", tool: "band_record", site: "driver/skills/clearance-register/SKILL.md",
     closes: "#865 — same shared file, same split grant." },
-  { stage: "register-unit", tool: "band_shape", site: "driver/skills/prelim-register/SKILL.md",
+  { stage: "register-unit", tool: "band_shape", site: "driver/skills/clearance-register/SKILL.md",
     closes: "#865 — same shared file, same split grant." },
-  { stage: "report-overview", tool: "band_record", site: "driver/skills/prelim-search/synthesis-rules.md",
+  { stage: "report-overview", tool: "band_record", site: "driver/skills/clearance-search/synthesis-rules.md",
     closes: "#865 — same shared file, same split grant." },
-  { stage: "register-unit", tool: "band_lookup", site: "driver/skills/prelim-register/SKILL.md",
+  { stage: "register-unit", tool: "band_lookup", site: "driver/skills/clearance-register/SKILL.md",
     closes: "#865 — the mirror image: the band tools are the judgment stages', and the unit lane holds "
       + "register instead." },
-  { stage: "register-unit", tool: "record_coverage", site: "driver/skills/prelim-register/SKILL.md",
+  { stage: "register-unit", tool: "record_coverage", site: "driver/skills/clearance-register/SKILL.md",
     closes: "#865 — same shared-spine split as the band tools above, minted by the typed coverage "
       + "transport: the spine's Coverage-ledger section (mode-scoped to DIGEST in its own words) orders "
       + "`record_coverage`, which only register-digest's grant carries — the unit lane must never hold a "
       + "writer into judgment's coverage record. Resolved the day the spine's coverage doctrine moves "
       + "wholly into digest.md, or #865 scopes shared-spine text per seat." },
-  { stage: "register-unit", tool: "record_register_digest", site: "driver/skills/prelim-register/SKILL.md",
+  { stage: "register-unit", tool: "record_register_digest", site: "driver/skills/clearance-register/SKILL.md",
     closes: "#865 — the SAME shared-spine split as record_coverage above, minted by conversion 11's typed "
       + "findings transport. The spine's mode list names the tool inside its **Digest mode (judgment — "
       + "Layer B)** bullet, which is the sentence that already names record_coverage and the band tools; "
@@ -157,20 +157,20 @@ export const TOOL_ORDER_BACKLOG = [
       + "spine's digest doctrine moves wholly into digest.md, or #865 scopes shared-spine text per seat — "
       + "and NOT by granting it: the funnel must never hold a writer into judgment's findings document, "
       + "which is the same rule that keeps record_coverage off its grant." },
-  { stage: "skeptic", tool: "perplexity_research", site: "driver/skills/prelim-search/phase2-execution.md",
+  { stage: "skeptic", tool: "perplexity_research", site: "driver/skills/clearance-search/phase2-execution.md",
     closes: "#865 — skeptic holds NO retrieval tool ('new search work enters via the escalation lane, never "
       + "from this seat' — it converted to the RECORDING category, gaining record_skeptic plus the "
       + "read-only, run-dir-scoped search_run_artifacts, and no retrieval tool) "
       + "and is served a document ordering a live query." },
-  { stage: "skeptic", tool: "register_propose_supplemental", site: "driver/skills/prelim-search/phase2-execution.md",
+  { stage: "skeptic", tool: "register_propose_supplemental", site: "driver/skills/clearance-search/phase2-execution.md",
     closes: "#865 — same seat, same file, the supplemental mint it cannot call." },
-  { stage: "report-overview", tool: "perplexity_research", site: "driver/skills/prelim-search/synthesis-rules.md",
+  { stage: "report-overview", tool: "perplexity_research", site: "driver/skills/clearance-search/synthesis-rules.md",
     closes: "#865 — synthesis-rules.md is served to synthesis (holds perplexity + band) and to "
       + "report-overview (TOOL-FREE: 'renders the shell from the settled narrative + findings')." },
-  { stage: "report-overview", tool: "band_lookup", site: "driver/skills/prelim-search/synthesis-rules.md",
+  { stage: "report-overview", tool: "band_lookup", site: "driver/skills/clearance-search/synthesis-rules.md",
     closes: "#865 — same shared file, same split grant." },
-  { stage: "prelim-variants", tool: "perplexity_research", site: "driver/skills/prelim-variants/SKILL.md",
-    closes: "#865 — prelim-variants is TOOL-FREE by design ('pure reasoning over material already on "
+  { stage: "clearance-variants", tool: "perplexity_research", site: "driver/skills/clearance-variants/SKILL.md",
+    closes: "#865 — clearance-variants is TOOL-FREE by design ('pure reasoning over material already on "
       + "disk') and its own doctrine names a research call." },
 ];