clearotron 0.3.2-beta.8 → 0.3.2-beta.9

package/.env.example

@@ -1,7 +1,7 @@
 # =============================================================================
 # example.com-trademark — canonical environment contract (.env.example)
 # =============================================================================
-# The prelim-search product reads all of its configuration + credentials from
+# The clearance-search product reads all of its configuration + credentials from
 # the environment. In production these live in the systemd EnvironmentFile
 # (`~/.env`, loaded as whichever service account runs the engine); in dev they are
 # exported before the run. This file is the DOCUMENTED CONTRACT — copy it to
@@ -86,6 +86,7 @@ CLEAROTRON_AI=anthropic-agent
 # write the path of setup's copy here: it would become the forced copy, and one installed later would never
 # be used. A path set here must be ABSOLUTE: stage subprocesses run with cwd set to the run directory.
 # Only the live engine's value is read, so a machine that runs both engines can set both.
+# effect: setup
 CLEAROTRON_CLAUDE_PATH=claude
 
 # ── openai-agent (codex) knobs — ONLY read when CLEAROTRON_AI=openai-agent ────────────────────────
@@ -93,7 +94,9 @@ CLEAROTRON_CLAUDE_PATH=claude
 # overwriting the other — these were one variable until that collapse met a box needing two different
 # paths, and this file shipped two live rows for the single name until then (a last-wins assignment in
 # the copied `.env`, not a choice).
+# effect: setup
 CLEAROTRON_CODEX_PATH=codex
+
 CLEAROTRON_WORK_DIR=
 # Customer/project config store (loadProfiles). Unset ⇒ driver's built-in profiles dir.
 CLEAROTRON_CUSTOMERS_DIR=
@@ -103,15 +106,28 @@ CLEAROTRON_INSTRUCTIONS_DIR=
 # REQUIRED — the code default was removed. Unset, the engine refuses and names this variable instead
 # of falling back to /srv/trademark-archive, which on a deployed box is real client matter.
 CLEAROTRON_REPORTS_DIR=/srv/trademark-archive
-# Run-slot lock dir. Default = $CLEAROTRON_WORK_DIR/prelim-run-locks. Every run takes a slot here,
+# Run-slot lock dir. Default = $CLEAROTRON_WORK_DIR/clearance-run-locks. Every run takes a slot here,
 # whether the runner dispatched it or somebody launched it by hand, so this is what bounds concurrency
 # across an install rather than within one process. The portal also reads it to find the worker
 # heartbeat; two installs pointed at one lock dir would share a cap they do not expect to.
 # effect: deployment
 CLEAROTRON_RUN_LOCK_DIR=
-# Delivery outbox dir (instant handoff-mode delivery wake). Default = $CLEAROTRON_WORK_DIR/prelim-outbox.
+# Delivery outbox dir (instant handoff-mode delivery wake). Default = $CLEAROTRON_WORK_DIR/clearance-outbox.
+# Was `prelim-outbox`. A box that never set this keeps its markers there and they are still read and drained;
+# new markers are written under the new name. Nothing to move.
 # effect: deployment
 CLEAROTRON_OUTBOX_DIR=
+# Where the shared register CALL ledger lives — the per-query record the register spend is counted from.
+# Default = ~/trademark/telemetry/register-calls.jsonl. An install that moves or clears it changes what a
+# later cost read can account for, and nothing else records where it went.
+# effect: deployment
+CLEAROTRON_REGISTER_CALL_LOG=
+# Where the register RECORD log lives — the fetched-record store a "verified from the record" claim on a
+# report joins against. Resolved by EXISTENCE over several directories and filenames, not by name alone,
+# so that an install which inherited an older path keeps reading its own ledger; setting this overrides
+# that ladder outright. An install pointed at an empty path reports no fetched records and no fault.
+# effect: deployment
+CLEAROTRON_REGISTER_RECORD_LOG=
 # HEADLESS intake: one explicit queue dir (no agent workspaces needed) — the enqueue CLI + ops-MCP
 # start_run write here and the runner drains it (additive to the workspace scan). See docs/INTAKE.md.
 CLEAROTRON_QUEUE_DIR=
@@ -481,6 +497,21 @@ CLEAROTRON_CUT_REF=
 # effect: tuning
 CLEAROTRON_RELEASE_WAIT_MS=
 
+# Whether this release run was dispatched to cut. The workflow sets `true` on a `workflow_dispatch` that
+# is not a rehearsal, and `false` otherwise. Set, a wait that expires with no version published is a
+# failure that names why, because the one thing the run was dispatched for did not happen; a push or the
+# schedule asks nothing of the wait, so expiry there stays a quiet success. Read by
+# scripts/release-await-cut.mjs.
+# effect: tuning
+CLEAROTRON_CUT_REQUESTED=
+
+# The number of the version pull request the same run opened, so a failed wait reads why that pull
+# request did not merge rather than guessing. The workflow sets it from the version job's output. Unset,
+# or not a whole number, a dispatched wait says it found no pull request to wait on. Read by
+# scripts/release-await-cut.mjs.
+# effect: tuning
+CLEAROTRON_CUT_PR=
+
 # A GitHub token carrying Actions read and write. The release workflow supplies it from a repository
 # secret so that a cut does not wait for a person to approve the version pull request's parked CI run:
 # that run is authored by the repository's own Actions bot, and GitHub parks bot-authored runs as

package/CONTRIBUTING.md

@@ -54,7 +54,7 @@ Four more things run for free:
 | Command | What it proves |
 |---|---|
 | `node mcp-server/smoke.mjs` | Drives the real MCP server over stdio against a built fixture. Prints `SMOKE OK`. |
-| `node driver/dev-portal.mjs` | Serves a pool at `http://127.0.0.1:18899/` — archive index, reports, customer pages. Loopback only; it refuses any other host. Needs a pool to point at (`CLEAROTRON_REPORTS_DIR`). |
+| `node driver/dev-portal.mjs` | Serves a pool at `http://127.0.0.1:18899/` — archive index, reports, company pages. Loopback only; it refuses any other host. Needs a pool to point at (`CLEAROTRON_REPORTS_DIR`). |
 | The $0 mock pipeline | A full run — intake, every stage, publish, delivery packet — on a mocked engine. Recipe in [docs/E2E.md § Tier 1](docs/E2E.md). Follow it as written; the absolute-path trap in it catches everybody. |
 | `npx clearotron demo` | Replays `demo/` — a real run on a fictional mark — through the real publisher into `~/trademark-demo/pool` and serves it. No keys, no model, no engine. |
 
@@ -75,7 +75,7 @@ half did not run. `npx clearotron install` walks through both, and
 [INSTALL.md § 1](INSTALL.md#1-prerequisites) is the full list.
 
 **The scenario suite is private by design.** `scripts/e2e.mjs` scores runs against lawyer-written
-reference answers on real matters; the references and the config store they load from are client work
+reference answers on real matters; the references and the config store they load from are company work
 product and will not be published. Its absence weakens nothing you can run — the in-repo suite covers
 the machinery, and the scenario suite covers the answers. The validation ladder, from the $0 offline
 suite to a paid live run, is [docs/E2E.md](docs/E2E.md).
@@ -130,13 +130,13 @@ The reviewer is the check. Say what you checked in the PR rather than citing a p
 **3. Types are enforced, and `vite build` does not typecheck.** `npm run typecheck -w portal-ui`
 runs as its own CI step. Run it before you push.
 
-**4. Every sentence a customer reads is written against the standard, and five classes of it are
+**4. Every sentence a company reads is written against the standard, and five classes of it are
 checked.** The standard is [`docs/writing-standard.md`](docs/writing-standard.md); the prose rules
 under it are [`docs/writing-rules.md`](docs/writing-rules.md), and they apply first. Together they
 bind report HTML, portal screens, the README and the docs.
 
 `node scripts/writing-standard-check.mjs` refuses what your change ADDS to one of those surfaces:
-an engineering identifier in text a client reads, a reviewer-only marker in rendered output, a known
+an engineering identifier in text a company reads, a reviewer-only marker in rendered output, a known
 caveat sentence, a screen that writes its own page heading instead of using `PageHeader`, and a lede
 whose words are all already in its title. It names the class and prints the line. It never rewrites —
 a rewritten sentence is a sentence nobody reviewed.
@@ -153,7 +153,7 @@ identifier, no caveat and no banned word and still be the thing the standard exi
 heading that restates its section, a paragraph explaining what the reader can already see, a sentence
 that only works if you know how the engine is built.
 
-So: **a pull request that changes text a customer reads is reviewed against the rendered page or
+So: **a pull request that changes text a company reads is reviewed against the rendered page or
 report, not against the diff.** One reviewer reads it as someone who has never seen this product and
 asks one question of every new sentence — *what would a reader with zero context think this means?*
 If the answer needs the codebase, the sentence is cut or rewritten. One reviewer, one question,
@@ -288,9 +288,9 @@ narrower is usually the defect rather than the fix, and it will be read that way
 
 ### The three possible outcomes
 
-**Into the base layer.** Your change becomes part of what every install gets, including ours and our
-clients'. That is the highest bar: it has to be an improvement for the matters this doctrine is tuned
-for, not only for yours.
+**Into the base layer.** Your change becomes part of what every install gets, including ours and the
+installs we run for companies. That is the highest bar: it has to be an improvement for the matters
+this doctrine is tuned for, not only for yours.
 
 **Published as a pack.** Doctrine resolves file by file — an install can point at another directory and
 have its files win, with everything it does not override falling through to ours. So a change that is

package/INSTALL.md

@@ -153,7 +153,7 @@ passed, and nothing has driven a live register through it.
 
 **Upgrading an install made before 0.2.2: pin the agent id first.** The default agent id changed from
 `clawdi` to `localagent`, and that id is part of a path — your runs live under
-`<workspaceRoot>/workspace-<agent>/studio/prelim-search/`. If you never set an agent id, the upgraded
+`<workspaceRoot>/workspace-<agent>/studio/clearance-search/`. If you never set an agent id, the upgraded
 install reads a workspace that does not exist yet, and an empty workspace looks like an account with no
 runs rather than like a misconfiguration. Set **both** names in your environment file before starting
 it, because the register-search servers read their own:
@@ -624,12 +624,12 @@ a bespoke risk framework. A job resolves to a profile by the **forwarder's email
 matches, the neutral Generic default applies.
 
 - **Bundled with the package** (`driver/profiles/`): `generic.json` (the Generic default) and
-  `demo-brand-owner.json`, the account the demo runs as, so you can run and read the machinery
+  `demo-brand-owner.json`, the company the demo runs as, so you can run and read the machinery
   immediately. `driver/profiles/README.md` documents every field. (A clone of the repository carries
   three more, marked `testFixture` in their own files: the test suite reads them, no install offers
   them, and they are excluded from the published package as well.)
 - **Your real companies live outside the repo.** Point `CLEAROTRON_CUSTOMERS_DIR` at your own private
-  config store and the engine loads *those* accounts instead. **Same engine, different config path** —
+  config store and the engine loads *those* companies instead. **Same engine, different config path** —
   the code carries no company identities.
 
   Two things go with it, and both are refusals rather than preferences:
@@ -661,7 +661,7 @@ self-contained.
 A company is not only its `<key>.json`. Two more things sit beside it, both optional, both shipped as
 working examples in `driver/profiles/`:
 
-- **A context pack** — `<key>.context.md`, a sibling of the profile. Free prose about the account that
+- **A context pack** — `<key>.context.md`, a sibling of the profile. Free prose about the company that
   the engine attaches to the profile it loads. One ships beside a bundled demo company.
 - **Project overlays** — `projects/<customer-key>/<slug>.json`. A project is one engagement under a
   company: a launch screening, a flagship clearance, a regional push. Each may carry its own
@@ -689,7 +689,7 @@ overlay stating `defaultClasses` narrows to exactly what it states.
 
 **Setting `CLEAROTRON_CUSTOMERS_DIR` replaces the whole tree, projects included.** The engine reads your
 store's companies and your store's `projects/`, and none of ours. That is deliberate — a deployment's
-roster holds its own accounts and nothing of ours — but it is silent, and it is the one thing here that
+roster holds its own companies and nothing of ours — but it is silent, and it is the one thing here that
 becomes an incident on a real deployment rather than a bundled one:
 
 - A job naming a project your store does not carry is **not refused**. The `projectKey` is dropped and
@@ -1364,7 +1364,7 @@ A courier is a loop over one directory, and it needs no unit of its own if you a
 
 1. **Watch the outbox** — `$CLEAROTRON_OUTBOX_DIR`. A `.pending` file appears there when a run
    finishes. Read the variable rather than guessing the directory: the wizard writes `<data
-   base>/outbox`, but an unset variable falls back to `prelim-outbox` under the workspace root
+   base>/outbox`, but an unset variable falls back to `clearance-outbox` under the workspace root
    (`driver/driver.config.mjs`), so the two are not the same path and only one of them is where your
    markers are.
 2. **Read what it points at.** A success marker is a few bytes naming the agent, *not* the payload —

package/SECURITY.md

@@ -26,7 +26,7 @@ affected versions, and a fix or a written decision not to fix. We will credit yo
 ask us not to.
 
 **Never attach a run artifact to a report.** Reports, audit workbooks, run directories and pool
-contents can carry client names, marks and matters. Describe the shape of the data instead, or
+contents can carry company names, marks and matters. Describe the shape of the data instead, or
 reproduce it against the repo's synthetic fixtures.
 
 ## What is in scope
@@ -42,8 +42,8 @@ In particular, we want to hear about anything that breaks these:
 - **Fail-closed construction.** The HTTP face refuses to start without an audience, an issuer, and an
   identity gate. Any path that serves a request with authentication silently absent is in scope.
 - **The dev portal's loopback bind.** `driver/dev-portal.mjs` must refuse every non-loopback host.
-- **Client-facing surfaces leaking internals.** An env var name, a switch name, or an internal path
-  rendered into a report or a client-visible error.
+- **Company-facing surfaces leaking internals.** An env var name, a switch name, or an internal path
+  rendered into a report or a company-visible error.
 - **Traversal and injection** into artifact reads, pool paths, or run directories.
 
 [`docs/SECURITY.md`](docs/SECURITY.md) documents the whole envelope — what protects what, and where

package/bin/brandowner.mjs

@@ -113,7 +113,7 @@ const USAGE = `
     --domains    comma-separated email domains that resolve to this owner
     --platforms  comma-separated marketplaces their searches cover
                  omitted ⇒ the Generic default's platforms are applied and named in the output
-    --framework  their risk framework, as skills/prelim-search/<file>.md
+    --framework  their risk framework, as skills/clearance-search/<file>.md
                  omitted ⇒ the Generic default is applied and named in the output
     --industry   free text, shown on their profile
     --context    a file whose contents become this owner's context pack
@@ -121,7 +121,7 @@ const USAGE = `
 
   clearotron brandowner framework <key> <path>
 
-    Point an existing company at a risk framework, as skills/prelim-search/<file>.md.
+    Point an existing company at a risk framework, as skills/clearance-search/<file>.md.
     The deck is checked before anything is written: a path that does not resolve, or a
     manifest that will not load, is refused and the company is left exactly as it was.
 
@@ -298,7 +298,7 @@ export async function framework(argv, {
 } = {}) {
   const [key, path] = argv;
   if (!key) throw new Refusal(`this command needs a company key.${USAGE}`);
-  if (!path) throw new Refusal(`this command needs a framework path, as skills/prelim-search/<file>.md.${USAGE}`);
+  if (!path) throw new Refusal(`this command needs a framework path, as skills/clearance-search/<file>.md.${USAGE}`);
   try { assertProfileKey(key); }
   catch (e) { throw new Refusal(e?.message ?? String(e)); }
 

package/bin/framework-preflight.mjs

@@ -20,7 +20,7 @@ import { invocationPrefix } from "../shared/invocation.mjs";
 import { preflightFramework, formatPreflight } from "../driver/framework-preflight.mjs";
 
 const USAGE = (cmd) => `
-  ${cmd} framework <skills/prelim-search/your-framework.md>
+  ${cmd} framework <skills/clearance-search/your-framework.md>
 
     Reads a risk framework deck and the manifest beside it, and reports what they declare —
     the ladder, the company the deck names, the shape, and which file answered where.

package/bin/start.mjs

@@ -113,6 +113,7 @@ export async function runTables() {
 import { spawn, spawnSync, execFileSync } from "node:child_process";
 import { storeInRepo, storeOutsideRepoMessage, storeCommitRefusal } from "../shared/store-in-repo.mjs";   //
 import { stdioConnectOffer } from "../shared/stdio-connect.mjs";
+import { wslTarget } from "../shared/wsl.mjs";   // — and which distribution a row should start the server in
 import { ensureDemoProgram } from "../shared/permanent-install.mjs";   // — a demo from npx keeps its own copy
 import { mergeEnvFile } from "../shared/env-file-merge.mjs";
 import { mcpOriginFor } from "../shared/lane-address.mjs";   // — one author for the origin
@@ -2522,11 +2523,24 @@ if (isMain) {
   // THE WORKSPACE AND POOL THE SERVICES WERE HANDED, not this process's environment: a demo reads no env
   // file, so its own line named no workspace and the connector fell back to the real install's.
   // A demo run from npx names its own copy of the program, which a cache clean does not remove.
-  const connect = stdioConnectOffer({ workDir: paths.workspace, reportsDir: paths.pool, ...(demoProgramRoot ? { installRoot: demoProgramRoot } : {}) });
-  say("  Connect your assistant to this install — one line, no address and no sign-in:");
-  say("");
-  say(`    ${connect.command}`);
+  // AND WHICH SIDE OF A WSL INSTALL THE READER IS ON, because this is where he read the line from. An
+  // install inside WSL can be reached from Windows and from inside the distribution, by two different
+  // commands; printing one of them unheaded is how a reader pastes the wrong one. The target is read
+  // here and passed, because this module is pure by design and reads no environment of its own.
+  const connect = stdioConnectOffer({ workDir: paths.workspace, reportsDir: paths.pool, wsl: wslTarget(), ...(demoProgramRoot ? { installRoot: demoProgramRoot } : {}) });
+  // "one line" IS DELETED RATHER THAN MADE CONDITIONAL. Under WSL two lines are printed, one per side,
+  // and the count was never the point of the sentence — what it promises is no address and no sign-in,
+  // which is true on both sides and on every other install.
+  say("  Connect your assistant to this install — no address and no sign-in:");
   say("");
+  // THE HEADINGS COME WITH THE PAIR, from the composer. Nothing is written here: the page prints these
+  // same two words above these same two commands, and a second author is how the two surfaces drift.
+  if (connect.variants) {
+    for (const v of connect.variants) { say(`    ${v.heading}`); say(`      ${v.text}`); say(""); }
+  } else {
+    say(`    ${connect.command}`);
+    say("");
+  }
   say(`  Check it:  ${connect.verify}`);
   say("");
   // ── WHERE TO TYPE THE THINGS JUST PRINTED ( — F31) ───────────────────────

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "7596846c65b0bd1a4dcc291732803da5fa8e9ccb",
-  "version": "0.3.2-beta.8"
+  "commit": "7f7f7668374023298def34129e3007303163c5ed",
+  "version": "0.3.2-beta.9"
 }

package/docs/DELIVERY.md

@@ -18,7 +18,8 @@ ignores the value.
 
 ## The outbox
 
-`config.outboxDir` = `CLEAROTRON_OUTBOX_DIR` (default `<CLEAROTRON_WORK_DIR>/prelim-outbox`).
+`config.outboxDir` = `CLEAROTRON_OUTBOX_DIR` (default `<CLEAROTRON_WORK_DIR>/clearance-outbox`; the
+earlier `clearance-outbox` is still read, so markers written before the rename still drain).
 All packets are written atomically (`.tmp` + rename) — a watcher never sees a half-written
 file. Every packet carries a `ts` ISO timestamp. Watch the dir for `*.pending` (systemd
 `.path`, inotify, or poll); a periodic scan of run `status.json` files is the recommended

package/docs/INTAKE.md

@@ -23,7 +23,7 @@ Resolution (the runner drains **all** of these; `config.queueDirs`):
 | Source | Path | Use |
 |---|---|---|
 | `CLEAROTRON_QUEUE_DIR` env | one explicit dir | **headless deployments** (the product default; no agent workspaces needed). Jobs here run as `config.defaultAgent`. |
-| workspace scan | `<CLEAROTRON_WORK_DIR>/workspace-<agent>/studio/prelim-search/queue` | legacy/agent-adjacent deployments; the agent identity is derived from the queue location |
+| workspace scan | `<CLEAROTRON_WORK_DIR>/workspace-<agent>/studio/clearance-search/queue` | legacy/agent-adjacent deployments; the agent identity is derived from the queue location |
 
 The enqueue CLI resolves its target the same way: `--queue-dir` flag → `CLEAROTRON_QUEUE_DIR` →
 the default agent's workspace queue.

package/docs/ONBOARDING.md

@@ -32,7 +32,7 @@ malformed one is refused before anything is written.
 | `--name` | the legal name. Required. |
 | `--domains` | comma-separated email domains that resolve to this company |
 | `--platforms` | marketplaces their searches cover. Omitted, the default's platforms apply and are named in the output. |
-| `--framework` | their risk framework, as `skills/prelim-search/<file>.md`. Omitted, the default applies and is named in the output. |
+| `--framework` | their risk framework, as `skills/clearance-search/<file>.md`. Omitted, the default applies and is named in the output. |
 | `--industry` | free text, shown on their profile |
 | `--context` | a file whose contents become this company's context pack |
 | `--dry-run` | say exactly what would be written, and write nothing |

package/docs/architecture/03-run-lifecycle.md

@@ -27,7 +27,7 @@ Two doctrines govern everything below:
 sequenceDiagram
     autonumber
     participant A as Forwarding agent<br/>(integrator platform)
-    participant Q as Per-agent queue dir<br/>(studio/prelim-search/queue)
+    participant Q as Per-agent queue dir<br/>(studio/clearance-search/queue)
     participant S as systemd<br/>(.path + 90s .timer)
     participant R as runner.mjs
     participant P as pipeline.mjs
@@ -89,7 +89,7 @@ an unknown company proceeds on the generic profile with a late-bind watch (§4).
 
 **Matter-level dedup** (`runner.mjs`). Queue-file dedup is per *message*; a "please
 proceed" reply in an already-handled thread arrives under a new message-id. The driver therefore
-keeps a matter ledger (`studio/prelim-search/.matter-ledger.jsonl`) and parks as `.duplicate` any
+keeps a matter ledger (`studio/clearance-search/.matter-ledger.jsonl`) and parks as `.duplicate` any
 job within the window (a fixed 24 hours) that matches a prior entry by
 exact signature (`forwarder|mark|classes|customer|ref`, plus a `|level:<product>` dimension on any
 non-baseline product) or by same conversation-thread with agreeing mark *and* agreeing product. The
@@ -108,7 +108,7 @@ winner (`runner.mjs`). A `.pid` sidecar records `<pid>:<starttime>` (starttime t
 **Run identity is minted before any spend.** The codename (`adjective-noun`) is minted at dispatch
 and written atomically to `<id>.processing.meta` *before* the pipeline starts (`runner.mjs`).
 A crash anywhere after that resumes the *same* run directory instead of re-spending a fresh run.
-Run dirs are `<workspace>/studio/prelim-search/<slug>/<date>-<codename>`, slug =
+Run dirs are `<workspace>/studio/clearance-search/<slug>/<date>-<codename>`, slug =
 `tmp<n>-<kebab-mark>` (or `noref<6-hex>-<mark>` when no reference was given; `phase0.mjs`).
 
 **Orphan reclaim** (`runner.mjs`) runs once per drain. A `.processing` whose claimer is
@@ -177,7 +177,7 @@ seeding. Frozen sidecars are never silently re-derived; a corrupt one crashes lo
 ```mermaid
 flowchart TD
     subgraph HEAD["Phase 1-2 head (fatal)"]
-        MF[matter-frame] --> PV[prelim-variants]
+        MF[matter-frame] --> PV[clearance-variants]
         PV --> DER["code derivations:<br/>scope ledger · form neighbourhood ·<br/>register plan freeze · recall probes"]
     end
     DER --> GRID["grid spec dictated by code<br/>(terms × platforms × connotation; A1 split)"]
@@ -217,7 +217,7 @@ flowchart TD
 
 Reading order for the phases, with what code decides at each:
 
-1. **Head stages** — `matter-frame` then `prelim-variants`, both fatal. Code then derives the
+1. **Head stages** — `matter-frame` then `clearance-variants`, both fatal. Code then derives the
    scope ledger, the *form neighbourhood* (the model picks the distinctive token; the machine
    generates the complete mechanical variant floor), freezes the register plan
    (`_driver/register-plan.json`, frozen for the life of *this run* — a resume never re-plans, and a
@@ -445,7 +445,7 @@ node pipeline.mjs --resume <codename> --experiment <stage> [--label <t>]
 - **`--from`** forces stages at or after the named ordinal even if their outputs validate; earlier
   stages still skip. A `--from synthesis` fork deliberately does *not* lock the digest.
 - **`--experiment`** runs one stage in a shadow dir (`_experiments/<ts>-<tag>/`) on copies of its
-  inputs, under a `prelim-exp-…` session key that is excluded from the run's provider-usage
+  inputs, under a `clearance-exp-…` session key that is excluded from the run's provider-usage
   attribution. The canonical run is untouched.
 - **Orphan self-resume**: a manually resumed run that parks has no queue sidecars; the runner scans
   run dirs for due, payload-complete `.postponed` sentinels not owned by any queue and resumes them

package/docs/architecture/04-configuration-reference.md

@@ -74,7 +74,7 @@ does after the stage's full retry ladder fails ([03 §5](03-run-lifecycle.md#5--
 | # | Stage | Model · effort | Timeout / stall | Gated output (file truth) | Fatality |
 |---|---|---|---|---|---|
 | 1 | `matter-frame` | opus · high | 300 / 300 | `matter-context.md` | fatal |
-| 2 | `prelim-variants` | opus · high | 600 / 450 | `variant-manifest.md` (+ `.json` sibling, strict-parsed) | fatal |
+| 2 | `clearance-variants` | opus · high | 600 / 450 | `variant-manifest.md` (+ `.json` sibling, strict-parsed) | fatal |
 | 3 | `blind-frame` | opus · high | 600 / 450 | `blind-frame-model.json` (strict-parsed; the prose twin was retired 2026-08-03 — nothing read it) | non-fatal (frame-diff skipped this run) |
 | 4 | `common-law` | haiku · low | 2250 / 1100 | `common-law-findings.md` (+ grid ledger, plugin-written) | fatal at fan-in |
 | 5 | `common-law-half` | per seat: `COMMON_LAW_SEAT_TIER` — halves `a`/`b` haiku · low; meaning seat `m` `CLEAROTRON_MEANING_SEAT_MODEL` \|\| haiku · low | 2250 / 1100 | `common-law-findings.half-{a,b,m}.md` (+ per-seat grid ledgers) | fatal at fan-in; one-half transient quarantine allowed |
@@ -201,8 +201,8 @@ deployment may override (verify live values per deployment).
 | `CLEAROTRON_REPORTS_DIR` | **none — set it** | Publish pool (web-served). **No default since: unset refuses and names the variable.** It read`/srv/trademark-archive` — a deployed server's real archive — so a forgotten export published into somebody else's clearances, and two entry points already carried hand-written defences against exactly that (`bin/onboard.mjs`, `bin/example.mjs`). Same shape as `CLEAROTRON_DATABASE` and `scripts/purge-runs.mjs`: guessing wrong is expensive, so it does not guess. Read-only surfaces (flag snapshot, status page, MCP options) degrade to "no pool" instead of throwing; anything that writes refuses. `driver/production-pool-guard.mjs` still names `/srv/trademark-archive` on purpose — that constant is a fact about where the archive is, not a default. |
 | `CLEAROTRON_REPORTS_URL` | **none — set it** | Pool base URL used in notification links. No placeholder default: unset ⇒ the link is omitted and the runner logs `deployment config MISSING` at activation. It does not gate the queue (a missing hostname costs a link, not the deliverable), so treat that log line as the alarm. |
 | `CLEAROTRON_ACCESS_DOMAIN` | unset (note omitted) | Identity domain named in the delivery email's access note ("sign in with a `<domain>` account"). Unset ⇒ the note is omitted rather than naming the wrong domain. |
-| `CLEAROTRON_RUN_LOCK_DIR` | `<workspaceRoot>/prelim-run-locks` | Run-slot lock dir (turn locks under `…/turns`). |
-| `CLEAROTRON_OUTBOX_DIR` | `<workspaceRoot>/prelim-outbox` | Delivery outbox (`<runId>.pending` wake markers). |
+| `CLEAROTRON_RUN_LOCK_DIR` | `<workspaceRoot>/clearance-run-locks` | Run-slot lock dir (turn locks under `…/turns`). |
+| `CLEAROTRON_OUTBOX_DIR` | `<workspaceRoot>/clearance-outbox` | Delivery outbox (`<runId>.pending` wake markers). Renamed from `clearance-outbox`; when this variable is unset the old directory is still READ, so a box that never pinned it does not orphan markers it has already written. Writers use the new name only. |
 | `CLEAROTRON_OAUTH_BRIDGE` | module-relative `providers/oauth-mcp-bridge/bridge.mjs` | Case-law MCP bridge script. (Portable since the module-relative default; set explicitly only for a bridge outside the repo tree.) |
 | `CLEAROTRON_REGISTER_CALL_LOG` | `~/trademark/telemetry/register-calls.jsonl`, or the existing file wherever it already is | Billing-grade provider-call ledger, shared by whichever ONE register provider is wired — not a vendor artifact. Every read site derives the default from`homedir()` at call time (2026-07-19: two sites had hardcoded a literal home directory, splitting the ledger under any other service account — guarded by `test/deployment-hostnames.test.mjs`). |
 | `CLEAROTRON_REGISTER_RECORD_LOG` | **runtime-injected per run**: `<runDir>/_driver/register-record-bodies.jsonl` | Citation-fidelity log: the BODY of every fetched official record. ** moved it INTO the run** — created with the run, unioned into the run's`_records/`, archived and purged with it. There is no retention setting and no cleanup job, because it no longer grows on the box: held globally it reached 432 MB in 61 days on production and needed a rotation timer on every install. **Do not set this by hand** — a fixed value pins every run's bodies to one file and restores the problem. A box upgraded across still holds its old global file; nothing writes or reads it, the driver names it once per process on stderr, and archiving it is one`mv`. An empty log cannot read as verified: the run's successful `record_fetch` rows in the (still global) call ledger are compared against the assembled record set, and a gap is reported as a failure. |
@@ -303,6 +303,8 @@ because the rule is about what PRODUCT CODE reads, not about what a run reads.
 | `CLEAROTRON_UPDATER_STAMP` | `_updater-identity.json` beside the update script, in the directory the updater runs from | The full path of the file in which the updater that deploys this box records which copy of itself ran. The updater writes it and deploy health reads it under this one name, so a box that moves the stamp sets it once for both. On a box with no updater unit, setting it says an updater exists elsewhere and is to be judged. Effect class `deployment`. |
 | `CLEAROTRON_CUT_REF` | `HEAD` | Which ref the cut decision reads the version from. **Read only by the release workflow, never set on a deployment.** The jobs that ask about `main` set it to `origin/main` explicitly, because their checkout is pinned to the run's own ref and `HEAD` there is that ref rather than the branch they are deciding about. A job that asks the wrong subject gets a confident wrong answer. |
 | `CLEAROTRON_RELEASE_WAIT_MS` | 25 minutes | How long a requested cut waits for the version pull request to merge itself before giving up. **Read only by the release workflow.** A rehearsal sets it to `0` so the wiring is exercised without holding a runner. Giving up is a quiet success by design — the scheduled run underneath catches a cut whose wait expired — so this budget failing shows up as a slow job rather than a red one. |
+| `CLEAROTRON_CUT_REQUESTED` | unset (⇒ not dispatched) | Whether this release run was dispatched to cut. **Read only by the release workflow, never set on a deployment.** The workflow sets `true` on a dispatch that is not a rehearsal. Set, a wait that expires with no version published is a failure that names why; a push or the schedule leaves expiry a quiet success. Effect class `tuning`. |
+| `CLEAROTRON_CUT_PR` | unset | The number of the version pull request the same run opened. **Read only by the release workflow, never set on a deployment.** A failed wait reads why that pull request did not merge from it. Unset or not a whole number, a dispatched wait says it found no pull request to wait on. Effect class `tuning`. |
 | `ACTIONS_APPROVE_TOKEN` | unset | A GitHub token with Actions read and write, used to approve the version pull request's parked CI run so a cut does not wait for a person. **Read only by the release workflow, never set on a deployment.** The built-in token cannot approve a run — GitHub blocks self-approval — so this is a second, separate credential. Unset is the ordinary case and not an error: the script names the absent token and exits successfully, and the version run waits for a person as it did before. Actions write is broader than approval alone — it also dispatches workflows, cancels any run in the repository and deletes run logs. |
 | `CLEAROTRON_AGENT_MCP_URL` | unset (⇒ `null`) | The API-key MCP door advertised to a signed-in person. Null until that door is deployed, and the UI keeps its honest empty state rather than inventing a URL. |
 | `CLEAROTRON_AGENTS` | derived | Comma-separated agent ids for `scripts/purge-runs.mjs` to sweep. |
@@ -324,6 +326,7 @@ cannot be read as one list.
 | Var | Consumer |
 |---|---|
 | `ANTHROPIC_API_KEY` | Engine child env in `api-key` mode only (deleted in subscription and cloud modes). |
+| `CLAUDE_CODE_OAUTH_TOKEN` | The headless subscription sign-in's token, printed by `claude setup-token` on any machine that can sign in. Read by the Claude program itself: the engine's stage process inherits it untouched in every billing mode, which is how a browserless server authenticates the subscription lane. Setup names it as the token to paste. |
 | `CLAUDE_CODE_USE_VERTEX` / `CLAUDE_CODE_USE_FOUNDRY` / `CLAUDE_CODE_USE_BEDROCK` | **Read by the Claude program**, which sends every turn to that cloud; `1`, `true`, `yes` or `on` switches one on. Clearotron reads them to name the cloud under `CLEAROTRON_AI_BILLING=cloud` and to refuse a switch left on under `subscription` or `api-key`. Under `CLEAROTRON_AI_BILLING=cloud`, `clearotron start --background` carries the switch that is on, and every setting in the five rows below that is set, the model pins included, into `~/.env` (a switch that is set and not on stays behind); under `subscription` or `api-key` it carries none. It adds only a line `~/.env` lacks, and names any of these on which that file and its own configuration differ. A missing switch is reported by `clearotron start` and `clearotron doctor`, and refuses a search when it is ordered. Doctor and setup's proof turn carry these and the five rows below from the settings file a search reads, which is the one at the old location while an install is still configured there (`CLOUD_SETTINGS` in `driver/engine/auth.mjs`). A value in the shell wins over the file's: setup's proof turn keeps a blank one, as a run does, where doctor passes over it and takes the file's. In setup, an answer given wins over both. A run takes the whole file. |
 | `ANTHROPIC_VERTEX_PROJECT_ID` / `CLOUD_ML_REGION` / `GOOGLE_APPLICATION_CREDENTIALS` | Vertex AI's project, region and service-account key, read by the Claude program. Without the key file it uses gcloud's sign-in. |
 | `ANTHROPIC_FOUNDRY_RESOURCE` / `ANTHROPIC_FOUNDRY_API_KEY` | The Foundry resource and its key, read by the Claude program. Without the key it uses the machine's Azure sign-in. |

package/docs/architecture/05-config-governance.md

@@ -91,7 +91,7 @@ product doc.
 | **Job spec** (per matter): id, forwarder(+email/domain), markName/marks[], classes\|goods/use, ref, profileKey, projectKey, searchLevel/recipeKey, deliveryRoute, `customer`(+Unknown), deliverableSpec, commercialFlexibility, priorUse, dupOverride, deadline, brief | T1 | agent conversation → `start_run` MCP verb (ops token) → queue; validated by `enqueue-schema.mjs` | queue → run dir | LIVE (conversational; portal `run/plan`+`run` API exists) |
 | **Company profile** (17 keys — identity/rating/provenance: name, matchDomains, selfExclusionOwners, frameworkPath, workedExamplesPath, allowedRecipes, jxPolicy, runCaps, demoData (`true` marks the record as demo data; a real clearance is refused at the runner's admission wall); overlayable: platforms, defaultClasses, defaultJurisdictions, marketplaceDensity, delivery, riskAppetite, industry, defaultProduct) | T2 (staff) + T1 (a company's people edit its own via portal §C) | profile-service UI (staff, `/profiles/*`); the portal (own profile) | config store, git auto-commit | LIVE. Merge law: project **replaces** every overlayable key except `platforms`, which **unions** (the company's floor is never subtractable) |
 | **Project overlays** (8 overlayable keys) | T2 | profile-service UI | config store `profiles/projects/<cust>/` | LIVE. The project form deliberately withholds `defaultProduct` and both `delivery` sub-keys — for the first the sparse save path has no `""` ⇒ clear branch, so the control could only ever be turned on; for the second the engine replaces `delivery` wholesale, so a partial overlay would silently drop the company's other sub-keys. Both are company-level controls until the server side changes |
-| **Frameworks / skills** (risk-framework-<key>.md + .manifest.json, worked examples, SKILL.md) | T2 (senior-lawyer content) | git edits in the config store (deliberate — the prose deck is the rating authority) | config store `skills/prelim-search/` | LIVE via git; no UI by design |
+| **Frameworks / skills** (risk-framework-<key>.md + .manifest.json, worked examples, SKILL.md) | T2 (senior-lawyer content) | git edits in the config store (deliberate — the prose deck is the rating authority) | config store `skills/clearance-search/` | LIVE via git; no UI by design |
 | **Recipes / saved searches** (base level + component toggles + emailTable/defaultDeadlineDays/standingInstructions) | T2 | recipe-service UI | `<recipesDir>/<cust>/<slug>.json`, git | **DARK** — code complete, no unit deployed. A saved search is honoured wherever it resolves (the `CLEAROTRON_RECIPES_MODE` door was retired 2026-07-27) |
 | **Run curation** (archive folds, republish, index regen) | T2 | `pool-admin.mjs` CLI only | pool `archive-tags.json` | LIVE, CLI-only |
 | **Allowlist** (`{version, grants:[{email, customer}]}`) | T2 | git + PR on the `CLIENT_ACCESS_MAP` file | see §2 row 4 | LIVE, file-only; surfaced read-only at `admin.access` |
@@ -527,6 +527,11 @@ up is a quiet success by design and the scheduled run underneath catches what it
 is wrong shows up as a slow job rather than a red one — which is why it is written down rather than left
 to be inferred from a timeout.
 
+`CLEAROTRON_CUT_REQUESTED` and `CLEAROTRON_CUT_PR` — whether this run was dispatched to cut, and the
+version pull request it opened. The workflow sets both; nothing on a deployment reads either. Together they
+separate a run that set nothing in motion, whose expired wait stays a quiet success, from a dispatched cut
+that published nothing, which fails and names why the pull request did not merge.
+
 ## 6. Drift patterns — values that are mirrored by design
 
 Wherever one value must exist in more than one place, name every copy and rotate them in one

package/docs/architecture/05-customer-profiles.md

@@ -16,7 +16,7 @@ rating is refused by pattern guards and by stage-level firewalls.
 ## The bundle
 
 A company = one git-owned JSON file `profiles/<key>.json`, plus optionally: a prose context pack
-(`<key>.context.md`), a per-company rating framework pair in `skills/prelim-search/`
+(`<key>.context.md`), a per-company rating framework pair in `skills/clearance-search/`
 (`risk-framework-<key>.md` + its `.manifest.json`, plus worked examples), and per-engagement
 project overlays under `profiles/projects/<key>/`.
 
@@ -182,7 +182,7 @@ this source tree.
   `matchDomains` for forwarder-based fallback. A profile with empty `matchDomains` is reachable by
   profileKey only.
 - **Per-company framework** (optional; git-only, legal-team work — the UI cannot set it): add the
-  deck + manifest + worked examples under `skills/prelim-search/`, set the two paths in the profile
+  deck + manifest + worked examples under `skills/clearance-search/`, set the two paths in the profile
   JSON via git. Until then the company rates under the Generic default.
 - **Per-engagement overlay** (optional): `profiles/projects/<key>/<slug>.json` with the 8
   overlayable keys; intake stamps `job.projectKey` to select it.

package/docs/architecture/06-operations-runbook.md

@@ -112,7 +112,7 @@ and the environment file holding the secrets.
   `XDG_RUNTIME_DIR` must be set for `systemctl --user` to work from cron.
 - **Pin the agent id before upgrading an install made before 0.2.2.** The default agent id changed
   from `clawdi` to `localagent`, and that id is a path segment: runs live under
-  `<workspaceRoot>/workspace-<agent>/studio/prelim-search/`. An install that never set one starts
+  `<workspaceRoot>/workspace-<agent>/studio/clearance-search/`. An install that never set one starts
   reading an empty workspace, and empty reads as "no runs" rather than as an error. Set **both**
   variables in the environment file — the gather servers read their own:
 
@@ -129,7 +129,7 @@ and the environment file holding the secrets.
 
 | Surface | What it tells you |
 |---|---|
-| `systemctl --user status prelim-driver.{path,timer,service} prelim-outbox.{path,timer,service} profile-service` | Trigger health; remember "activating = draining" |
+| `systemctl --user status prelim-driver.{path,timer,service} clearance-outbox.{path,timer,service} profile-service` | Trigger health; remember "activating = draining" |
 | `journalctl --user -u prelim-driver.service -f` | Runner notes (stderr): claims, dedup parks, preflight failures, orphan reclaims |
 | Run dir `status.json` / `run.jsonl` | Per-run state + the append-only decision trace; grep keys: `axes`, `profile`, `verdict`, `escalation`, `postponed`, `delivered`, `profile-mismatch` |
 | `_driver/<stage>.jsonl` | Per-attempt telemetry: status, fail token, kill signals, wall, tokens |
@@ -173,7 +173,7 @@ survive until terminal state.
 | Run parked with `*.tainted-N` artifacts | Timeout-taint convergence loop ([07 §3](07-quality-and-audit.md#3--completed-coverage-honesty-in-code)) | Let it converge; repeated signature goes terminal honestly |
 | Chat failure ping never arrived for a failed run | By design: nothing here sends. The failure packet IS the notice, and an integrator consumes it | Check `_driver/failure.json` + the outbox lane (the guaranteed notice) |
 | Deploy refused because a run is in flight | The in-flight guard above | Wait for the run. A force-restart of the gateway is not the answer — that is for a wedged gateway |
-| Everything quiet after a deploy abort | Should not happen (EXIT trap restarts triggers) — if it does: `systemctl --user start prelim-driver.{path,timer} prelim-outbox.{path,timer}` and file it |
+| Everything quiet after a deploy abort | Should not happen (EXIT trap restarts triggers) — if it does: `systemctl --user start prelim-driver.{path,timer} clearance-outbox.{path,timer}` and file it |
 
 ## Selftest — retired
 

package/docs/architecture/08-development-guide.md

@@ -144,7 +144,7 @@ The reasoning layer dictates what it needs; a thin adapter supplies it. Concrete
    preflighted at run start. Add the id to `KNOWN_REGISTER_PROVIDERS` too, or the error message that
    tells an operator what to set will omit it. Selection is `CLEAROTRON_DATABASE` in every
    environment, production included; there is no committed default to flip.
-4. **Skill doc**: `skills/prelim-register/providers/<provider>.md` — the provider-specific craft
+4. **Skill doc**: `skills/clearance-register/providers/<provider>.md` — the provider-specific craft
    the register stages read.
 5. **The empirical verification checklist** — the real work is not code volume: operator
    vocabulary and composition semantics, pagination behaviour to `has_more:false`, status-enum
@@ -157,8 +157,8 @@ The reasoning layer dictates what it needs; a thin adapter supplies it. Concrete
 
 The methodology lives in the driver's `skills/` tree — 12 top-level directories, nearly all of it
 Markdown carrying **prose only**, no executable code. The machine-parsed
-exceptions are the four framework manifests (`skills/prelim-search/risk-framework*.manifest.json`); one
-further non-Markdown file rides along, `skills/prelim-search/templates/search-request-form.html`, named
+exceptions are the four framework manifests (`skills/clearance-search/risk-framework*.manifest.json`); one
+further non-Markdown file rides along, `skills/clearance-search/templates/search-request-form.html`, named
 only in `publish/index.mjs`.
 The engine reads skills **in place from the git-deployed driver tree**: `absolutizeSkillRefs`
 rewrites `skills/…` tokens to absolute paths and grants `--add-dir`. Code comments saying skills
@@ -168,8 +168,8 @@ What to know before editing:
 
 - **Which stage reads what** is dictated solely by each stage message's `reads([...])` in
   `stages.mjs` — read it there rather than trusting this summary. Broadly: matter-frame,
-  prelim-variants (+ `transliteration-scripts.md`), blind-frame, prelim-common-law (every grid seat),
-  prelim-register spine + `unit.md` *xor* `digest.md` (mode-routed — a unit must never read
+  clearance-variants (+ `transliteration-scripts.md`), blind-frame, clearance-common-law (every grid seat),
+  clearance-register spine + `unit.md` *xor* `digest.md` (mode-routed — a unit must never read
   digest doctrine and vice versa) + the active provider's `providers/<name>.md`,
   placement-inquiry, `phase2-execution.md` §skeptic (that one section only), frame-diff,
   synthesis (synthesis-rules + per-profile framework + worked examples + conditionally
@@ -186,7 +186,7 @@ What to know before editing:
 - Several skill files are **legacy and not stage-read** (email/Excel templates, the formatting
   reference). Verify a file appears in some stage's `reads([...])` before treating its claims as
   live; where a legacy file and the code disagree, the code and `stages.mjs` win.
-- The pharma module (`skills/prelim-search/field-doctrine-pharma.md`, loaded by a code predicate on
+- The pharma module (`skills/clearance-search/field-doctrine-pharma.md`, loaded by a code predicate on
   pharma-shaped matters) ships behind a named legal reviewer's sign-off — doctrine edits in
   regulated verticals go through the practitioner, not just review.
 

package/docs/configuration.md

@@ -95,7 +95,7 @@ A framework is two files that travel together:
 | `risk-framework.manifest.json` | A small sidecar carrying the framework's **vocabulary**: band labels, their severity order, the entity label, provenance. |
 
 The Generic default ships at
-[`driver/skills/prelim-search/risk-framework.md`](../driver/skills/prelim-search/risk-framework.md)
+[`driver/skills/clearance-search/risk-framework.md`](../driver/skills/clearance-search/risk-framework.md)
 with bands Very High · High · Moderate · Manageable.
 
 **Replace it with your own.** Write your rubric as prose, add a manifest naming your bands,
@@ -174,14 +174,14 @@ prints what they declare, and where the deck and the manifest disagree it names
 the deck did not do. It creates nothing, rates nothing and contacts nobody.
 
 ```
-clearotron framework skills/prelim-search/your-framework.md
+clearotron framework skills/clearance-search/your-framework.md
 ```
 
 ```
-Framework: skills/prelim-search/your-framework.md
-  deck      /srv/clearotron-config/skills/prelim-search/your-framework.md
+Framework: skills/clearance-search/your-framework.md
+  deck      /srv/clearotron-config/skills/clearance-search/your-framework.md
             read from the configured store
-  manifest  /srv/clearotron-config/skills/prelim-search/your-framework.manifest.json
+  manifest  /srv/clearotron-config/skills/clearance-search/your-framework.manifest.json
             read from the configured store
 
 It declares itself "Your firm's clearance risk framework" (your-firm-2026), a bands-shaped

package/docs/decisions/0003-credential-model.md

@@ -32,7 +32,7 @@ disclosure are both acceptable; degrading in silence is not. Which one applies i
 | Register | refuses at preflight, by name | An unconfigured register that answered "no conflicts found" is the most dangerous output this system can produce |
 | Case law (Full country search) | runs without the bridge, and the run's ledger records that the sweep did not dispatch | Access is free but auth breaks in practice. `driver/verify.mjs` plus `case-law-citations.json` stop any report claiming "no adverse case law" when nothing was read — the disclosure is the guard |
 | Native-script lane | degrades and says so | Reached only on CJK territories |
-| Research sweep (open web / marketplaces) | **on a Knockout search: degrades and says so.** On the three clearance searches: **refuses at preflight, by name** | acceptance 6, 2026-08-20. A knockout carries`registerProbe: true`, so its register half is a whole product without the sweep — refusing the screen threw away an answer the deployment could give. The three clearances carry `commonLawGrid: true` and their unregistered-use half is not severable, so nothing there degrades quietly into a clearance with a missing half. -6, 2026-08-20: that clearance failure MOVED to preflight — it used to happen at the common-law stage, after every register stage had been paid for. Same outcome, no spend.`preflightResearchCredential` gates on the component, never on the pipeline: `prelim-register-only` is a clearance carrying `commonLawGrid: false` and is not refused |
+| Research sweep (open web / marketplaces) | **on a Knockout search: degrades and says so.** On the three clearance searches: **refuses at preflight, by name** | acceptance 6, 2026-08-20. A knockout carries`registerProbe: true`, so its register half is a whole product without the sweep — refusing the screen threw away an answer the deployment could give. The three clearances carry `commonLawGrid: true` and their unregistered-use half is not severable, so nothing there degrades quietly into a clearance with a missing half. -6, 2026-08-20: that clearance failure MOVED to preflight — it used to happen at the common-law stage, after every register stage had been paid for. Same outcome, no spend.`preflightResearchCredential` gates on the component, never on the pipeline: `clearance-register-only` is a clearance carrying `commonLawGrid: false` and is not refused |
 
 ## Consequences
 

package/docs/writing-standard.md

@@ -83,3 +83,7 @@ their problem.
 `enforcement.md` lists the classes a CI check refuses in a diff. Tone is not one of them, and no word
 list will ever catch it: a reviewer reads the rendered page as someone who has never seen this product,
 against `writing-rules.md`, and asks what they would think each sentence means.
+
+A stylesheet that is inlined into a delivered document is delivered with it, comments included — the
+reader receives the file, so a class name in a CSS comment is engineering vocabulary on a page they can
+open, exactly as it would be in prose.