clearotron 0.3.2-beta.7 → 0.3.2-beta.9

package/driver/contract-vocabulary.mjs

@@ -21,8 +21,8 @@
 //   D4 verify.mjs  parseCoverageLedgerJson, same shape
 //   D5 verify.mjs:1504  fail(`${unaccounted[0].token}:…`)    — token minted in a DATA ROW
 //   D6 verify.mjs:1567  fail(`${violations[0].token}…`)      — validatePlanFeasibility in register-plan.mjs
-//   D7 verify.mjs:1558  fail(`${v2[0].token}${detail}…`)     — register-plan.mjs:2018 disclosureTextByAxis
-//   D8 verify.mjs:2425 caseLawLedgerFail  fail(caseLawLedgerFail(…))           — token built in case-law-ledger.mjs:204 caseLawLedgerFail
+//   D7 verify.mjs:1558  fail(`${v2[0].token}${detail}…`)     — register-plan.mjs:2183 disclosureTextByAxis
+//   D8 verify.mjs:2470 caseLawLedgerFail  fail(caseLawLedgerFail(…))  — token built in case-law-ledger.mjs:195 caseLawLedgerFail
 //
 // A partition built on the 60 tokens a regex CAN see would run green while blind to the rest, which is
 // worse than having no E2 at all: it certifies a partition it never checked. So the census is authored
@@ -41,13 +41,13 @@
 // ── PER-STAGE, NEVER GLOBAL ─────────────────────────────────────────────────────────────────────────
 //
 // `too_short` and `missing` come from the shared nonEmpty()/needs() helpers (verify.mjs:123-133) and are
-// legitimately owned by DIFFERENT elements in matter-frame, prelim-variants and frame-diff. A global
+// legitimately owned by DIFFERENT elements in matter-frame, clearance-variants and frame-diff. A global
 // token→element map sees several owners for one token and "fixes" a partition that was never violated.
 // Every row therefore carries `stages`, and the partition is computed per (token, stage) pair.
 
 /** The 16 stages of STAGES in stages.mjs. Kept here so a stage added there fails this file's own test. */
 export const ALL_STAGES = [
-  "matter-frame", "prelim-variants", "blind-frame", "common-law", "common-law-half", "register-unit",
+  "matter-frame", "clearance-variants", "blind-frame", "common-law", "common-law-half", "register-unit",
   "placement-inquiry", "register-digest", "skeptic", "frame-diff", "synthesis", "case-law",
   "narrative-refutation", "doubt-closure", "report-overview", "report-card",
 ];
@@ -65,12 +65,12 @@ const CL = ["common-law", "common-law-half"];
 export const VOCABULARY = [
   // ── the shared helpers: one token, many stages, different owners per stage ─────────────────────────
   { token: "too_short", stages: ALL_STAGES.filter((s) => !["blind-frame", "doubt-closure", "narrative-refutation"].includes(s)), site: "driver/verify.mjs:133" },
-  { token: "missing", stages: ["matter-frame", "prelim-variants", "common-law", "common-law-half", "placement-inquiry", "register-digest", "doubt-closure", "report-overview", "report-card"], site: "driver/verify.mjs:164" },
+  { token: "missing", stages: ["matter-frame", "clearance-variants", "common-law", "common-law-half", "placement-inquiry", "register-digest", "doubt-closure", "report-overview", "report-card"], site: "driver/verify.mjs, in needs()" },
 
   // ── common-law / common-law-half ───────────────────────────────────────────────────────────────────
   { token: "declared_unavailable", stages: CL, site: "driver/verify.mjs" },
   { token: "grid_spec_unreadable", stages: CL, site: "driver/verify.mjs:257" },
-  { token: "grid_ledger_missing", stages: CL, site: "driver/verify.mjs:297" },
+  { token: "grid_ledger_missing", stages: CL, site: "driver/verify.mjs commonLawMeaningSeat" },
   { token: "grid_ledger_unparseable", stages: CL, site: "driver/verify.mjs:266" },
   { token: "connotation_query_unrecorded", stages: ["common-law-half"], site: "driver/verify.mjs" },
   { token: "profile_unparseable", stages: ["common-law"], site: "driver/verify.mjs" },
@@ -102,6 +102,36 @@ export const VOCABULARY = [
   { token: "finding", stages: ["synthesis"], site: "driver/verify.mjs", family: "driver/findings-model.mjs (token-first throws; `finding_*` and `findings_*`)", dynamic: "D2" },
 
   // ── register-digest ────────────────────────────────────────────────────────────────────────────────
+  // The per-record accounting family, raised at the EXIT as well as at the call. The call-time refusal
+  // is scoped to the batch it judges, which is what lets a dense band be recorded at all; the exit gate
+  // is where that is paid for, because once any batch is accepted a document exists and half a band is
+  // the same SHAPE as a whole one. All three are armed by the era stamp, so an archived run raises none.
+  { token: "registerdigest_unaccounted_records", stages: ["register-digest"], site: "driver/verify.mjs, and driver/register-digest-record.mjs at the call" },
+  { token: "registerdigest_accounting_unreadable", stages: ["register-digest"], site: "driver/verify.mjs — driver-written, not a model defect" },
+  { token: "registerdigest_model_missing", stages: ["register-digest"], site: "driver/verify.mjs — driver-written, not a model defect" },
+  // ── THE TYPED TRANSPORT'S OWN FAMILY (conversion 11) ──────────────────────────────────────────────
+  //
+  // These are raised by `register-digest-record.mjs` at the ACCEPTANCE BOUNDARY, not by verify.mjs, and
+  // they became visible to this census only when verify.mjs began reaching into that module for the
+  // digest's exit gate. They existed and were emitted for months before that; nothing was wrong with
+  // them, and nothing here changes behaviour. What changes is that the census can now see the family,
+  // which is the point of listing the module: a family the tripwire cannot read can grow a member no
+  // row covers, and nobody finds out.
+  { token: "registerdigest_uri_missing", stages: ["register-digest"], site: "driver/register-digest-record.mjs — every row joins to a band record by its uri" },
+  { token: "registerdigest_uri_unknown", stages: ["register-digest"], site: "driver/register-digest-record.mjs — a uri this run's band does not carry" },
+  { token: "registerdigest_flag_reason_missing", stages: ["register-digest"], site: "driver/register-digest-record.mjs — the judgment the row exists to carry" },
+  { token: "registerdigest_verify_invalid", stages: ["register-digest"], site: "driver/register-digest-record.mjs — one bare token of yes/no" },
+  { token: "registerdigest_drop_reason_missing", stages: ["register-digest"], site: "driver/register-digest-record.mjs — a drop with no stated reason is a silent recall loss" },
+  { token: "registerdigest_drop_ground_invalid", stages: ["register-digest"], site: "driver/register-digest-record.mjs — the closed ground token" },
+  { token: "registerdigest_drop_ground_contradicted", stages: ["register-digest"], site: "driver/register-digest-record.mjs — the ground contradicts this run's own screen verdict" },
+  { token: "registerdigest_instructed_incomplete", stages: ["register-digest"], site: "driver/register-digest-record.mjs — every instructed check carries ask AND answer" },
+  { token: "registerdigest_adjudication_invalid", stages: ["register-digest"], site: "driver/register-digest-record.mjs — one bare token of ADOPTED/OVERRODE" },
+  { token: "registerdigest_adjudication_incomplete", stages: ["register-digest"], site: "driver/register-digest-record.mjs — an override quotes the reason it contradicts" },
+  { token: "registerdigest_nothing_judged", stages: ["register-digest"], site: "driver/register-digest-record.mjs — a digest that ends no record has not read the band" },
+  // The batching members, added with the batched accounting itself.
+  { token: "registerdigest_batch_unknown", stages: ["register-digest"], site: "driver/register-digest-record.mjs — a batch number this run's split does not hold" },
+  { token: "registerdigest_double_counted", stages: ["register-digest"], site: "driver/register-digest-record.mjs — a record ended under one batch cannot be ended under another" },
+  { token: "registerdigest_model_write_failed", stages: ["register-digest"], site: "driver/register-digest-record.mjs — driver-written: the accumulator was lost mid-batch" },
   { token: "coverage_form_damaged", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_form_engine_vocabulary", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_form_axis_invalid", stages: ["register-digest"], site: "driver/verify.mjs" },
@@ -109,10 +139,10 @@ export const VOCABULARY = [
   { token: "coverage_form_missing", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_form_empty", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_status_offenum", stages: ["register-digest"], site: "driver/verify.mjs:2050" },
-  { token: "coverage_deferred_unaccounted", stages: ["register-digest"], site: "driver/verify.mjs:1554 coverageFormFail", family: "driver/register-plan.mjs:1642 PROVIDER_HARD_ERROR_PREFIX — token on a data row", dynamic: "D5" },
-  { token: "coverage_clean_unexecuted", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1417 validatePlanFeasibility", dynamic: "D6" },
-  { token: "coverage_clean_skipped", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1766 searchedJurisdictionsFromPlan", dynamic: "D6" },
-  { token: "coverage_clean_unverified_incomplete", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:2018 disclosureTextByAxis", dynamic: "D7" },
+  { token: "coverage_deferred_unaccounted", stages: ["register-digest"], site: "driver/verify.mjs coverageFormFail", family: "driver/register-plan.mjs:1860 PROVIDER_HARD_ERROR_PREFIX — token on a data row", dynamic: "D5" },
+  { token: "coverage_clean_unexecuted", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1594 validatePlanFeasibility", dynamic: "D6" },
+  { token: "coverage_clean_skipped", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:1955 searchedJurisdictionsFromPlan", dynamic: "D6" },
+  { token: "coverage_clean_unverified_incomplete", stages: ["register-digest"], site: "driver/verify.mjs, the matterContext validator", family: "driver/register-plan.mjs:2183 disclosureTextByAxis", dynamic: "D7" },
   { token: "coverage_clean_tainted", stages: ["register-digest"], site: "driver/verify.mjs" },
   { token: "coverage_ledger_", stages: ["register-digest"], site: "driver/verify.mjs", family: "driver/coverage-ledger.mjs (parseCoverageLedgerJson token-first throws)", dynamic: "D4" },
   { token: "coverage_key_unknown", stages: ["register-digest"], site: "driver/verify.mjs", family: "driver/coverage-ledger.mjs", dynamic: "D4" },
@@ -121,18 +151,18 @@ export const VOCABULARY = [
   { token: "coverage_classes_invalid", stages: ["register-digest"], site: "driver/verify.mjs", family: "driver/coverage-ledger.mjs", dynamic: "D4" },
   { token: "plan_execution_unreadable", stages: ["register-digest", "narrative-refutation"], site: "driver/verify.mjs:1496, 1712" },
 
-  // ── matter-frame / prelim-variants / blind-frame / frame-diff ──────────────────────────────────────
-  { token: "stagecontracts_invalid", stages: ["matter-frame", "prelim-variants", "placement-inquiry", "case-law"], site: "driver/verify.mjs:1539, 1170, 1366, 1677" },
+  // ── matter-frame / clearance-variants / blind-frame / frame-diff ──────────────────────────────────────
+  { token: "stagecontracts_invalid", stages: ["matter-frame", "clearance-variants", "placement-inquiry", "case-law"], site: "driver/verify.mjs:1539 coverageEntryList, 1170, 1366, 1677" },
   { token: "meaning_angles_missing", stages: ["matter-frame"], site: "driver/verify.mjs" },
   { token: "frame_scope_missing", stages: ["matter-frame"], site: "driver/verify.mjs:1119" },
-  { token: "variantmodel_romanization_missing", stages: ["prelim-variants"], site: "driver/verify.mjs" },
-  { token: "variantmodel_family_incomplete", stages: ["prelim-variants"], site: "driver/verify.mjs" },
-  { token: "variantmodel_term_markup", stages: ["prelim-variants"], site: "driver/verify.mjs" },
-  { token: "variantmodel_missing", stages: ["prelim-variants"], site: "driver/verify.mjs:1171 checkFindingsSibling, 1230 checkJson" },
+  { token: "variantmodel_romanization_missing", stages: ["clearance-variants"], site: "driver/verify.mjs" },
+  { token: "variantmodel_family_incomplete", stages: ["clearance-variants"], site: "driver/verify.mjs" },
+  { token: "variantmodel_term_markup", stages: ["clearance-variants"], site: "driver/verify.mjs" },
+  { token: "variantmodel_missing", stages: ["clearance-variants"], site: "driver/verify.mjs:1171 checkFindingsSibling, 1230 checkJson" },
   // Recovered during E2 authoring, absent from the draft census: variant-manifest.json is strict-parsed
   // through checkSiblingJson (verify.mjs:1241) → checkJson (:742), so the WHOLE variantmodel_* family
-  // reaches prelim-variants, not just the four literal tokens above.
-  // CONVERSION 3 widened this family's SOURCE without widening its prefix. `acceptPrelimVariants` raises
+  // reaches clearance-variants, not just the four literal tokens above.
+  // CONVERSION 3 widened this family's SOURCE without widening its prefix. `acceptClearanceVariants` raises
   // `variantmodel_scope_layer_invalid`, `_scope_status_invalid`, `_scope_item_missing` and `_scope_pipe`
   // at the ACCEPTANCE BOUNDARY — the call is refused in the turn where restating is free, and no manifest
   // reaches disk. They share the prefix deliberately: a seat reading one refused call should not have to
@@ -142,7 +172,7 @@ export const VOCABULARY = [
   // `fail(` / `throw new Error(` / `=>` string literals, and every record module returns
   // `{ok: false, reason}` instead — measured, all four extract ZERO tokens. So this row is authored, not
   // extracted, and nothing re-derives it if the module grows a member. Filed as.
-  { token: "variantmodel_", stages: ["prelim-variants"], site: "driver/verify.mjs:1171 checkFindingsSibling → 742 (JSON family); driver/prelim-variants-record.mjs acceptPrelimVariants (scope-ledger transport family)", family: "driver/variant-manifest-model.mjs (token-first throws) + driver/prelim-variants-record.mjs", dynamic: "D3" },
+  { token: "variantmodel_", stages: ["clearance-variants"], site: "driver/verify.mjs:1171 checkFindingsSibling → 742 (JSON family); driver/clearance-variants-record.mjs acceptClearanceVariants (scope-ledger transport family)", family: "driver/variant-manifest-model.mjs (token-first throws) + driver/clearance-variants-record.mjs", dynamic: "D3" },
   { token: "blindframe_", stages: ["blind-frame"], site: "driver/verify.mjs blindFrame → checkJson", family: "driver/blind-frame-model.mjs", dynamic: "D3" },
   // — THE SKEPTIC TRANSPORT FAMILY, WHICH HAD NO ROW AT ALL. Nine tokens minted by acceptSkeptic
   // and not one of them was covered here: the conversion that moved them to the acceptance boundary moved
@@ -179,6 +209,9 @@ export const VOCABULARY = [
 
   // ── placement-inquiry ──────────────────────────────────────────────────────────────────────────────
   { token: "placementmodel_missing", stages: ["placement-inquiry"], site: "driver/verify.mjs:1352, 1379" },
+  { token: "placement_unjudged", stages: ["placement-inquiry"], site: "driver/verify.mjs placementAccountVerdict" },
+  { token: "placement_register_unrendered", stages: ["placement-inquiry"], site: "driver/verify.mjs placementAccountVerdict" },
+  { token: "placement_form_unreadable", stages: ["placement-inquiry"], site: "driver/verify.mjs placementAccountVerdict" },
   { token: "placement", stages: ["placement-inquiry"], site: "driver/verify.mjs:1352 → 742", family: "driver/placement-model.mjs (`placement_*` and `placements_*`)", dynamic: "D3" },
 
   // ── case-law / narrative-refutation ────────────────────────────────────────────────────────────────
@@ -231,7 +264,7 @@ export function normalizeFailToken(raw) {
 export const ARM1_EXEMPTIONS = [
   {
     token: "stagecontracts_invalid",
-    stages: ["matter-frame", "prelim-variants", "placement-inquiry", "case-law"],
+    stages: ["matter-frame", "clearance-variants", "placement-inquiry", "case-law"],
     reason: "The artifact is DRIVER-written (pipeline.mjs recordStageContract → _driver/stage-contracts.json). A corrupt one is a code or filesystem fault, and verify.mjs:1095 says so in its own comment. Pinning it on a model element would be the exact inversion #850 forbids — a mechanical failure wearing a model's name.",
   },
   // `tool_timeout` was on this list and has been REMOVED: register-unit's tool-written "execute the
@@ -357,12 +390,12 @@ export const TRIPWIRE_OUT_OF_SCOPE = [
     token: "no_citations",
     symbol: { file: "driver/case-law-ledger.mjs", names: ["findCaseLawLedgerViolations", "CASE_LAW_ADVISORY_REASONS", "isCaseLawBlocking"] },
     site: "driver/case-law-ledger.mjs:179 (minted), :65 CASE_LAW_ADVISORY_REASONS, :67 isCaseLawBlocking",
-    reason: "ADVISORY, and filtered before the token is built. `caseLawLedgerFail` keeps only blocking violations (case-law-ledger.mjs:196), and `no_citations` is the one member of CASE_LAW_ADVISORY_REASONS — so it cannot appear even in the `caselaw_ledger` census payload, let alone as a token head. It is the honest no-on-point-precedent result the report is allowed to state; failing a run for it would manufacture citations.",
+    reason: "ADVISORY, and filtered before the token is built. caseLawLedgerFail() in case-law-ledger.mjs keeps only blocking violations (:196), and `no_citations` is the one member of CASE_LAW_ADVISORY_REASONS — so it cannot appear even in the `caselaw_ledger` census payload, let alone as a token head. It is the honest no-on-point-precedent result the report is allowed to state; failing a run for it would manufacture citations.",
   },
   {
     token: "accepted_not_folded",
     symbol: { file: "driver/disposition-call.mjs", names: ["CALL_DROPS"] },
-    site: "driver/disposition-tool.mjs:378 (minted), driver/disposition-call.mjs:192 (CALL_DROPS)",
+    site: "driver/disposition-tool.mjs:378 recordDispositions — where the token is minted, driver/disposition-call.mjs:192 CALL_DROPS",
     reason: "A DRIVER-FAULT journal code, and the fault is ours. It records that the tool accepted a row the accumulator then did not carry; it is written to the call verdict ledger and reaches a seat only inside a sentence that orders the seat NOT to act (`your answer was valid and this is ours to fix`). A stage refusal built on it would be the driver failing a seat for the driver's own defect, so no stage can emit it by construction rather than by omission.",
   },
   {
@@ -430,7 +463,7 @@ export const INNER_CODES = Object.freeze([
   { code: "call_partial", mints: ["driver/connotation-search.mjs:2055"], rollsUpTo: ["connotation_call_partial"],
     why: "As call_never_made — same table, same projection. This is the pair #1211 cites as its worked example: the composite is covered, the bare form reaches no stage." },
   { code: "quote_unbound", mints: ["driver/connotation-search.mjs:2186"], rollsUpTo: ["connotation_quote_unbound"],
-    why: "The ruled-but-unbound row. Projected at verify.mjs:1099, and reported only once nothing is unruled." },
+    why: "The ruled-but-unbound row. Projected at verify.mjs:1450 unbound, and reported only once nothing is unruled." },
   { code: "token_absent", mints: ["driver/connotation-search.mjs:2213"], rollsUpTo: ["connotation_token_absent"],
     why: "#592 split this out of no_ruling. Row-level only — repairs.mjs:352 says so in as many words: `never a top-level token`." },
   { code: "cite_absent", mints: ["driver/connotation-search.mjs:2222"], rollsUpTo: ["connotation_cite_absent"],
@@ -441,13 +474,13 @@ export const INNER_CODES = Object.freeze([
   // data rather than deriving it. Every derivation anyone would write is `connotation_` + the code, and
   // for this row that produces `connotation_no_recorded_queries`, which nothing mints and nothing covers.
   // verify.mjs:912-913 states the ruling: a sweep that did not RUN is a canonical-only decision with its
-  // own token and its own remedy, so the projector at verify.mjs:909 deliberately does not handle it.
+  // own token and its own remedy, so the projector beside verify.mjs's CORRECTIONS_SECTION_RE deliberately does not handle it.
   { code: "no_recorded_queries", mints: ["driver/connotation-search.mjs:2070"], rollsUpTo: ["connotation_search_missing"],
-    why: "RENAMED, not namespaced: verify.mjs emits `connotation_search_missing`. It is excluded from CONNOTATION_FORM_REASONS at connotation-search.mjs:1776 for exactly this reason." },
+    why: "RENAMED, not namespaced: verify.mjs emits `connotation_search_missing`. It is excluded from CONNOTATION_FORM_REASONS at connotation-search.mjs for exactly this reason." },
 
   // ── case-law-ledger.mjs — ONE token, the codes as census payload ─────────────────────────────────
   //
-  // `caseLawLedgerFail` (case-law-ledger.mjs:195) returns `caselaw_ledger:<census>;<detail>`, and
+  // caseLawLedgerFail() in case-law-ledger.mjs (:195) returns `caselaw_ledger:<census>;<detail>`, and
   // `normalizeFailToken` cuts at the first colon — so the token is `caselaw_ledger` and every code below
   // lives in the payload. The `caselaw_ledger` row already carries `family:
   // "driver/case-law-ledger.mjs:204 (census reasons)"`, which is this ruling written down before the
@@ -521,11 +554,19 @@ export const COVERED_SOURCES = [
   // its token-first throw through unchanged, so their families are already covered where they are raised.
   // They are listed anyway, because the cost of listing a module that mints nothing is zero and the cost
   // of the alternative — noticing, one day, that a module started minting — is the whole of this issue.
-  "prelim-variants-record.mjs", "skeptic-record.mjs", "frame-diff-record.mjs", "blind-frame-record.mjs",
+  "clearance-variants-record.mjs", "skeptic-record.mjs", "frame-diff-record.mjs", "blind-frame-record.mjs",
   // Conversion 4 — and this one MINTS, unlike the two delegating modules above it.
   "report-overview-record.mjs",
   // Conversion 5 — the fan-out transport; it mints its own family including the bound-index refusals.
   "report-card-record.mjs",
+  // Conversion 11 — verify.mjs now reaches `digestAccountingGap`, the digest's exit gate, so the
+  // tripwire must read this module's token literals too. Without it the accounting family could grow a
+  // member that no vocabulary row covers and nothing would notice, which is this list's whole subject.
+  "register-digest-record.mjs",
+  // verify.mjs reaches `placementRenderAccount`, the placement pass's own account of what it recorded, and
+  // that module names the parser tokens it sorts rows by. It mints none of its own: every token it carries
+  // is placement-model.mjs's, passed through, so the `placement` family row already covers them.
+  "placement-form.mjs",
 ];
 
 /**

package/driver/deliver-trigger.sh

@@ -22,11 +22,11 @@
 set -u
 
 # this fallback chain MIRRORS driver.config.mjs (`outboxDir` = CLEAROTRON_OUTBOX_DIR, else
-# <workspaceRoot>/prelim-outbox; `workspaceRoot` = CLEAROTRON_WORK_DIR, else $HOME/trademark/workspace).
+# <workspaceRoot>/clearance-outbox; `workspaceRoot` = CLEAROTRON_WORK_DIR, else $HOME/trademark/workspace).
 # It is a second derivation of the same answer in a language that cannot import the first, so it moves
 # whenever that one does. If they disagree, the driver writes markers where this script never looks and
 # delivery stops with nothing in any log — the shape prelim-outbox.path already has.
-OUTBOX="${CLEAROTRON_OUTBOX_DIR:-${CLEAROTRON_WORK_DIR:-${OPENCLAW_HOME:-$HOME}/trademark/workspace}/prelim-outbox}"
+OUTBOX="${CLEAROTRON_OUTBOX_DIR:-${CLEAROTRON_WORK_DIR:-${OPENCLAW_HOME:-$HOME}/trademark/workspace}/clearance-outbox}"
 OPENCLAW="$(command -v openclaw || echo "${OPENCLAW_HOME:-$HOME}/.npm-global/bin/openclaw")"
 HELPER="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/outbox-backoff.mjs"
 DRAIN_WAIT="${CLEAROTRON_OUTBOX_DRAIN_WAIT:-180}"
@@ -58,7 +58,7 @@ MSG="The trademark engine's outbox has pending events. Run the clearotron-delive
 # below still runs, so a refusal cannot hot-loop the level-triggered .path unit.
 WALL="$(command -v timeout || command -v gtimeout || true)"
 if [ -z "$WALL" ]; then
-  echo "prelim-outbox: REFUSING TO WAKE — neither timeout(1) nor gtimeout(1) is on PATH, and every" >&2
+  echo "clearance-outbox: REFUSING TO WAKE — neither timeout(1) nor gtimeout(1) is on PATH, and every" >&2
   echo "  courier wake runs under it as an enforced wall (a wake that cannot be killed wedged this" >&2
   echo "  lane for 19h on 2026-07-04). NO event has been touched — they are all still pending and" >&2
   echo "  will deliver as soon as this is fixed. Install GNU coreutils on this host (Debian/Ubuntu:" >&2
@@ -70,7 +70,7 @@ fi
 
 # C5 — deterministic rescan FIRST (cheap: readdir + status.json of unsettled runs only). On a timer fire
 # this is what creates the work; on a marker fire it is a free consistency pass. Failure-tolerant.
-node "$HELPER" rescan || echo "prelim-outbox: rescan failed (non-fatal — existing markers still processed)"
+node "$HELPER" rescan || echo "clearance-outbox: rescan failed (non-fatal — existing markers still processed)"
 
 [ -d "$OUTBOX" ] || exit 0
 shopt -s nullglob
@@ -89,7 +89,7 @@ for m in "${markers[@]}"; do
   if printf '%s' "$a" | grep -qE '^[A-Za-z0-9_-]+$'; then
     by_agent["$a"]+="$m"$'\n'
   else
-    echo "prelim-outbox: quarantining marker with no routable agent: $m (payload kept)"
+    echo "clearance-outbox: quarantining marker with no routable agent: $m (payload kept)"
     if mkdir -p "$OUTBOX/quarantine"; then mv -f "$m" "$OUTBOX/quarantine/" || true; fi
   fi
 done
@@ -107,24 +107,24 @@ for agent in "${!by_agent[@]}"; do
   # paces the .path re-trigger. Helper failure answers "due" (never lose a delivery).
   gate="$(node "$HELPER" check "$agent" || echo due)"
   if [ "${gate%% *}" = "wait" ]; then
-    echo "prelim-outbox: $agent in backoff (${gate#wait } s left) — events retained, not waking"
+    echo "clearance-outbox: $agent in backoff (${gate#wait } s left) — events retained, not waking"
     track_wait "${gate#wait }"
     continue
   fi
 
-  echo "prelim-outbox: waking $agent to run clearotron-deliver"
+  echo "clearance-outbox: waking $agent to run clearotron-deliver"
   # timeout(1) is the enforced wall: the 2026-07-04 incident proved the CLI's own --timeout does not
   # guarantee process EXIT (the agent turn finished; the process idled 19h and wedged the lane).
   # SIGTERM at 840s (inside the unit's TimeoutStartSec budget so the failure is OURS and logged),
   # SIGKILL 30s later. The turn runs server-side to completion either way; since this trigger deletes
   # nothing, a killed wake just leaves the events for the re-fire.
   #
-  # FRESH session per wake (was a fixed --session-key prelim-outbox): reusing ONE session meant every
+  # FRESH session per wake (was a fixed --session-key clearance-outbox): reusing ONE session meant every
   # re-fire piled onto an ever-growing transcript the model reprocessed each time — that unbounded
   # growth, not the wake count alone, is what turned a stuck marker into $200+/day (2026-07-24/25). A
   # unique key bounds each wake to the skill + this one outbox read. The circuit-breaker in
   # outbox-backoff.mjs (not session history) now owns cross-wake loop detection.
-  wake_session="prelim-outbox-$(date -u +%Y%m%dT%H%M%SZ)-$$-${RANDOM}"
+  wake_session="clearance-outbox-$(date -u +%Y%m%dT%H%M%SZ)-$$-${RANDOM}"
   model_args=()
   [ -n "$WAKE_MODEL" ] && model_args=(--model "$WAKE_MODEL")
   out="$("$WALL" --kill-after=30 840 "$OPENCLAW" agent --agent "$agent" --session-key "$wake_session" "${model_args[@]}" --message "$MSG" --json --timeout 300)"
@@ -142,21 +142,21 @@ for agent in "${!by_agent[@]}"; do
       # is the load-bearing cost stop — it ends the re-fire loop for a marker mark_sent/ack_event can never
       # settle (the 2026-07 runaway class), whatever the cause. Operator notification is integrator-owned:
       # surface stuck deliveries from the audit record / MCP read surface, not from the requester outbox.
-      echo "prelim-outbox: 🚨 stuck marker(s) for $agent set aside after repeated no-progress wakes — see $OUTBOX/quarantine/STUCK-ALERTS.jsonl"
+      echo "clearance-outbox: 🚨 stuck marker(s) for $agent set aside after repeated no-progress wakes — see $OUTBOX/quarantine/STUCK-ALERTS.jsonl"
       track_wait "${verdict#* }"
       ;;
     stuck)
       # OK wake that consumed nothing — not a failure, but not progress either. Paced down toward the
       # quarantine threshold instead of hot-refiring every ~3.5min.
-      echo "prelim-outbox: no delivery progress for $agent — marker retained, paced ${verdict#* }s (circuit-breaker counting toward quarantine)"
+      echo "clearance-outbox: no delivery progress for $agent — marker retained, paced ${verdict#* }s (circuit-breaker counting toward quarantine)"
       track_wait "${verdict#* }"
       ;;
     giveup)
-      echo "prelim-outbox: wake for $agent failed rc=$rc — fast retries exhausted; sidecar cooldown + rescan timer own this delivery (events retained)"
+      echo "clearance-outbox: wake for $agent failed rc=$rc — fast retries exhausted; sidecar cooldown + rescan timer own this delivery (events retained)"
       track_wait "${verdict#* }"
       ;;
     *)
-      echo "prelim-outbox: wake for $agent failed rc=$rc — events retained, backoff ${verdict#* }s"
+      echo "clearance-outbox: wake for $agent failed rc=$rc — events retained, backoff ${verdict#* }s"
       track_wait "${verdict#* }"
       ;;
   esac
@@ -185,8 +185,8 @@ if [ "$woke_ok" = 1 ]; then
     sleep 5; waited=$((waited + 5))
     remaining=("$OUTBOX"/*.pending)
   done
-  [ ${#remaining[@]} -gt 0 ] || { echo "prelim-outbox: drained"; exit 0; }
-  echo "prelim-outbox: ${#remaining[@]} event(s) still pending after ${DRAIN_WAIT}s"
+  [ ${#remaining[@]} -gt 0 ] || { echo "clearance-outbox: drained"; exit 0; }
+  echo "clearance-outbox: ${#remaining[@]} event(s) still pending after ${DRAIN_WAIT}s"
 fi
 
 # TIGHT-LOOP GUARD (load-bearing): prelim-outbox.path is PathExistsGlob on *.pending — level-triggered,
@@ -201,7 +201,7 @@ if [ -n "$min_wait" ]; then
   [ "$w" -gt "$cap" ] && w="$cap"
   [ "$w" -gt "$budget" ] && w="$budget"
   if [ "$w" -gt 0 ]; then
-    echo "prelim-outbox: events retained — sleeping ${w}s so the .path re-fire matches the backoff"
+    echo "clearance-outbox: events retained — sleeping ${w}s so the .path re-fire matches the backoff"
     sleep "$w"
   fi
 fi

package/driver/demo-container.mjs

@@ -25,7 +25,7 @@
 
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename, dirname, join, resolve, sep } from "node:path";
+import { basename, dirname, join, resolve, sep } from "node:path"; import { studioDirFor } from "../shared/pre-rename-spellings.mjs";
 
 /** The entry file each lane's publisher reads as its source, in the order a child is probed for one. */
 export const ENTRY_FILES = Object.freeze(["report.md", "knockout-findings.json"]);
@@ -155,7 +155,7 @@ export function publishContainer(root, { repoRoot, tmp = tmpdir() } = {}) {
  * The demo published its samples as reports and made no run directory, so the connector its own connect
  * line wires listed nothing: an assistant, one of the demo's three faces, had nothing to explore. Each
  * sample's finished `run/` is copied to the layout the connector walks, under the DEMO'S OWN workspace:
- * `<workspace>/workspace-<agent>/studio/prelim-search/<slug>/<date>-<codename>/`. Nothing is written
+ * `<workspace>/workspace-<agent>/studio/clearance-search/<slug>/<date>-<codename>/`. Nothing is written
  * anywhere else, so a real install started afterwards sees none of it (the demo is its own install).
  *
  * Copied, never linked: a connector reading a run may write beside it, and `demo/` is tracked. A run
@@ -176,7 +176,7 @@ export function seedDemoRuns({ workspace, examplesDir, portalOrigin = null }) {
     let s;
     try { s = JSON.parse(readFileSync(join(run, "status.json"), "utf8")); } catch { continue; }
     if (!s?.slug || !s?.codename || !s?.date) continue;
-    const dir = join(workspace, `workspace-${s.agent || "clawdi"}`, "studio", "prelim-search", s.slug, `${s.date}-${s.codename}`);
+    const dir = join(studioDirFor(join(workspace, `workspace-${s.agent || "clawdi"}`)), s.slug, `${s.date}-${s.codename}`);
     if (existsSync(join(dir, "status.json"))) already.push(s.runId);
     else {
       // ONE SAMPLE'S UNREADABLE FILE COSTS THAT SAMPLE ONLY, and is named, never a throw out of the loop.

package/driver/dev-portal.mjs

@@ -32,7 +32,7 @@
 import { envFileRead } from "../shared/env-local.mjs";   // side effect: apply this install's .env when THIS file is the CLI entry (never on library import)
 import { createServer, request as httpRequest } from "node:http";
 import { readFileSync, existsSync, statSync, readdirSync, writeFileSync, renameSync, mkdirSync } from "node:fs";
-import { join, resolve, extname, dirname } from "node:path";
+import { join, resolve, extname, dirname } from "node:path"; import { studioDirFor } from "../shared/pre-rename-spellings.mjs";
 import { fileURLToPath } from "node:url";
 import { config } from "./driver.config.mjs";
 import { BRAND } from "../shared/brand.mjs";
@@ -135,7 +135,7 @@ function readJsonBody(req, maxBytes = 256 * 1024) {
   });
 }
 
-// Run statuses: every workspace's studio/prelim-search/<slug>/<run>/status.json — live runs PLUS the
+// Run statuses: every workspace's studio/clearance-search/<slug>/<run>/status.json — live runs PLUS the
 // archive (a delivered run moves there on delivery; without it the cockpit shows a run "disappearing"
 // at the exact moment it succeeds — found by the first dev smoke run). Read fresh per request.
 function scanRuns(workspaceRoot) {
@@ -153,7 +153,7 @@ function scanRuns(workspaceRoot) {
   try { names = readdirSync(workspaceRoot); } catch { return out; }
   for (const name of names) {
     if (config.agentIdFromWorkspaceName(name) == null) continue;
-    const studio = join(workspaceRoot, name, "studio", "prelim-search");
+    const studio = studioDirFor(join(workspaceRoot, name));
     let slugs = [];
     try { slugs = readdirSync(studio); } catch { continue; }
     for (const slug of slugs) {

package/driver/disposition-call.mjs

@@ -653,7 +653,7 @@ export function validateDispositionCall(rows, recorded, { told = null } = {}) {
     // ruling the whole time; what it could not do was copy a fragment that binds. So the missing exit was
     // never from the judgment.
     //
-    // AND THE JUDGMENT ALREADY HAS ONE. prelim-common-law/SKILL.md dictates it: a row that is on-topic but
+    // AND THE JUDGMENT ALREADY HAS ONE. clearance-common-law/SKILL.md dictates it: a row that is on-topic but
     // cannot responsibly be called benign or loaded is ruled `loaded` with the note saying what could not
     // be established, "which is where an unresolved reputational question belongs". Adding a second way
     // to decline a ruling would compete with that, and an easier road past a hard row is the one outcome

package/driver/door-gates.mjs

@@ -41,7 +41,9 @@
 import { resolveEffectiveProfile, recipeProseGuard, platformEntryErrors } from "./profiles.mjs";
 import { wantsPortalRoute, PORTAL_ROUTE_UNAVAILABLE } from "./enqueue-schema.mjs";
 import { gateResolvedPolicy, loadRecipes } from "./search-policy.mjs";
-import { readFlagSnapshot, registerTerritoriesFor } from "./flag-snapshot.mjs";
+import { resolveTerritories } from "./effective-scope.mjs";
+import { uncoveredTerritories, registerReachRefusal } from "./register-coverage.mjs";
+import { readFlagSnapshot, registerTerritoriesFor, registerLabelFor } from "./flag-snapshot.mjs";
 import { config } from "./driver.config.mjs";
 import { resolveRequest } from "./resolve-request.mjs";
 import { checkResolvedProduct } from "./scope-rules.mjs";
@@ -56,10 +58,14 @@ import { checkResolvedProduct } from "./scope-rules.mjs";
  * `readable` says whether the profile store answered at all — the input `checkClearanceScopeRules`
  * needs to tell "this account has no default territories" apart from "we could not read the account".
  */
-/** The wired register's covered territories, read once per gate call. Never throws: a door that cannot
- *  read the snapshot must still open. */
-function snapshotTerritories() {
-  try { return registerTerritoriesFor(readFlagSnapshot(config.poolRootOrNull)); } catch { return undefined; }
+/** The wired register as a door needs it: what it covers, and what to CALL it in a sentence a client
+ *  reads. One read, both answers. Never throws — a door that cannot read the snapshot must still open,
+ *  and `territories: undefined` is the fail-open answer every layer below already speaks. */
+function snapshotRegister() {
+  try {
+    const snap = readFlagSnapshot(config.poolRootOrNull);
+    return { territories: registerTerritoriesFor(snap), label: registerLabelFor(snap) };
+  } catch { return { territories: undefined, label: null }; }
 }
 
 export function resolveForDoor(job) {
@@ -92,8 +98,12 @@ export function resolveForDoor(job) {
  *          products.mjs and search-policy.mjs, for every door.
  */
 export function gateResolvedRequest({ job = null, profile = null, resolved = null, readable = true } = {},
-  { availability = true, registerTerritories = undefined } = {}) {
+  { availability = true, registerTerritories = undefined, registerLabel = undefined } = {}) {
   const out = { errors: [], warnings: [], byCheck: {} };
+  // Read at most once per gate call, and not at all when both arms were given their answer — a test
+  // driving a Signa-shaped deployment must not need a snapshot on disk to do it.
+  let snapshot;
+  const register = () => (snapshot ??= snapshotRegister());
   // A resolution that could not be taken is not a refusal — see the fail-open note in the header.
   if (!resolved) return out;
   // A CLARIFY IS RELAYED VERBATIM. It is already an actionable sentence naming the selector that could
@@ -114,10 +124,34 @@ export function gateResolvedRequest({ job = null, profile = null, resolved = nul
     //
     // `undefined` is the fail-open answer at every layer below, so an unreadable or absent snapshot
     // leaves this arm silent and the runner's wall still decides — the door rule stated in the header.
-    const terr = registerTerritories !== undefined ? registerTerritories : snapshotTerritories();
+    const terr = registerTerritories !== undefined ? registerTerritories : register().territories;
     const gateMsg = gateResolvedPolicy(resolved, { registerTerritories: terr });
     if (gateMsg) { out.errors.push(gateMsg); return out; }
   }
+  // ── A TERRITORY THIS REQUEST NAMES THAT THE WIRED REGISTER CANNOT SEARCH ──────────────────────────
+  //
+  // OUTSIDE the availability block, and that placement is the whole correctness of this arm. The portal
+  // and plan_run pass `availability:false` because they word an unavailable PRODUCT in their own words
+  // (the header's staff-prose split) — so an arm written inside that block cannot fire at the two doors
+  // a client actually orders through, and it would fail to fire SILENTLY, green, on the case the ruling
+  // of 2026-09-17 is about. This refusal carries no switch name and no internal key, so unlike the
+  // availability twin it is the same sentence on every surface and needs no client-facing rewording.
+  //
+  // THE TERRITORIES ARE RESOLVED HERE, NOT THREADED IN. `resolveTerritories` is the same ladder
+  // effective-scope.mjs runs for the scope a door prints beside this refusal, so the two cannot
+  // disagree. Asking each of the six doors to pass its own scope would let one forget the argument and
+  // fail open in silence — the exact shape `register-coverage-doors.test.mjs` exists to catch one layer
+  // up. One call, in the one gate they all share, covers every door by construction.
+  //
+  // Fail-open on a throw, the door's rule: an unreadable profile store must not stop somebody searching.
+  {
+    let named = [];
+    try { named = resolveTerritories(job ?? {}, profile, resolved?.recipeScope ?? null).jurisdictions ?? []; } catch { named = []; }
+    const terr = registerTerritories !== undefined ? registerTerritories : register().territories;
+    const label = registerLabel !== undefined ? registerLabel : register().label;
+    const refusal = registerReachRefusal(uncoveredTerritories(named, terr), label);
+    if (refusal) { out.errors.push(refusal); return out; }
+  }
   const gates = checkResolvedProduct({ job, profile, resolved, profileReadable: profile !== null && readable });
   out.errors.push(...gates.errors);
   out.warnings.push(...gates.warnings);

package/driver/doubt-ledger.mjs

@@ -6,7 +6,7 @@
 // by design (the audit is the defensibility record of everything considered). copper-gantry shipped three
 // fragments about ONE mark side by side: an asserted "closest analogue, active nationwide product" block,
 // a direct-search "does NOT appear on the owner's official sites" block, and a prose "requires
-// prelim-register layer cross-check" note that NOTHING parses. The resolutions usually EXIST — in
+// clearance-register layer cross-check" note that NOTHING parses. The resolutions usually EXIST — in
 // findings.json dispositions/actions, in the coverage ledger, in register-findings answer/watchlist
 // lines — the missing piece was the JOIN back to the fragment that raised the doubt. This module is
 // that join, and nothing more.
@@ -179,7 +179,7 @@ function twoTokenMatch(sig, candidateText) {
 // ── minting: gather cross-check hand-offs ─────────────────────────────────────────────────────────
 // The gather stages are DICTATED (stages.mjs) to record any check they could not perform, on its own
 // line, in EXACTLY this shape. The prefix is exact and the parse is deterministic ON PURPOSE: legacy
-// artifacts (and free prose like "requires prelim-register layer cross-check" buried in a paragraph —
+// artifacts (and free prose like "requires clearance-register layer cross-check" buried in a paragraph —
 // the copper-gantry note nothing parsed) mint NOTHING. Carrying prose doubts is the dictation's job at
 // the source, not a fuzzy parser's job here. A leading list bullet is tolerated (models bullet
 // everything); anything else about the shape is strict, including the em-dash between what and why.

package/driver/drainer-identity.mjs

@@ -105,14 +105,40 @@ export function drainerVerdict({ stamp, headCommit, isAlive, processes, ppidOf =
   const nameThem = (ps) => ps.map((p) => `pid ${p.pid}`).join(", ");
 
   if (!stamp) {
-    // COULD NOT LOOK, AND THAT IS A FAILURE. The deploy must not report a build live having never
-    // established what the executing process holds — "no stamp" is the exact state the incident's
-    // orphaned drainer was in, so treating it as a skip would pass the very box this arm exists for.
-    const extra = seen === null ? "and the process table could not be read either"
-      : seen.length ? `while ${seen.length} drainer-shaped process(es) ARE running (${nameThem(seen)}) — unstamped, so what build they hold is unknown`
-      : "and no drainer-shaped process is running, so nothing is executing runs on this box";
-    return { state: "fail", message: `no drainer identity stamp at ${STAMP_BASENAME}: the build held by the process that `
-      + `executes runs was NOT established, ${extra}. This is a failure to look, never a pass.${postureNote}` };
+    // THREE SITUATIONS LIVED IN ONE FAIL, AND ONE OF THEM IS NOT A FINDING.
+    //
+    // All three begin the same way — no stamp, so what the executing process holds was never
+    // established. What separates them is the PROCESS TABLE, and the old message ran the answers
+    // together: it asserted "nothing is executing runs on this box", a finding, and closed with "This is
+    // a failure to look, never a pass", which is the opposite claim. A reader could act on either.
+    //
+    // The module's ruling about postures says what each exit's posture IS. It does not license reporting
+    // two different facts through one verdict, and a deployment check is exactly where that is
+    // expensive: redeploying fixes an idle box and does nothing at all for an unreadable process table.
+    //
+    // — NOTHING WAS ESTABLISHED IN EITHER DIRECTION. No stamp and no process table: this arm did not
+    // find an idle box, it failed to look at one. Skipped and marked, never passed — the caller counts
+    // it toward a different exit code, and the box could be perfectly healthy or completely wedged.
+    if (seen === null) {
+      return { state: "skip", blocked: true,
+        message: `no drainer identity stamp at ${STAMP_BASENAME} AND the process table could not be read: what the `
+          + "process that executes runs holds was not established, and neither was whether one is running at all. "
+          + `This is a failure to look — redeploying would change nothing, because nothing was compared.${postureNote}` };
+    }
+    // — THE INCIDENT'S OWN SHAPE. Drainer-shaped processes are running and none of them stamped
+    // anything, so what build they hold is unknown. This is the state the orphaned drainer was in and
+    // the reason this arm exists; it is a finding and stays one.
+    if (seen.length) {
+      return { state: "fail", message: `no drainer identity stamp at ${STAMP_BASENAME} while ${seen.length} `
+        + `drainer-shaped process(es) ARE running (${nameThem(seen)}) — unstamped, so what build they hold is `
+        + `unknown. The process table was read; this is what it said.${postureNote}` };
+    }
+    // — A FINDING, and the plainest one here. The process table WAS read and holds no drainer, so
+    // nothing is executing runs on this box. Saying "failure to look" about a table that answered was
+    // the contradiction at the centre of this.
+    return { state: "fail", message: `no drainer identity stamp at ${STAMP_BASENAME} and no drainer-shaped process `
+      + "is running, so nothing is executing runs on this box. The process table was read, and this is what "
+      + `it said.${postureNote}` };
   }
 
   const pid = Number(stamp.pid) || 0;