clearotron 0.3.2-beta.8 → 0.3.2-beta.9

package/driver/publish/search-depth.mjs

@@ -92,7 +92,29 @@ export function clearedNames(auditMd, recordIndex = {}) {
         uri,
       });
     } else if (!/^NR\d+/.test(title) && /common-law/i.test(layer) && !/^\(none/i.test(title)) {
-      out.web.push({ title, url: field(block, "url"), type: field(block, "type") });
+      // ── A NAME IS A NAME AT A PLACE. THE READINGS ARE NOT NAMES ─────────────────────────────────
+      //
+      // The common-law layer carries two kinds of block under one heading style: a name somebody is
+      // trading under, and a reading of what the mark MEANS. The first has a `url` — it is a thing at a
+      // place a reader can go and look at. The second has none, because there is nothing to open: it is
+      // an etymology, a sensitivity, a piece of context.
+      //
+      // Both were listed as "Web and marketplace names", and a reading is a sentence, so the mark chip
+      // built for a name truncated it with an ellipsis and its right-hand column rendered empty.
+      // Measured on the delivered full country report: one such chip held 416px of content in a 200px
+      // box. Across every demo product, 7 of 31 blocks carried no url and every one of the 7 was a
+      // reading rather than a name.
+      //
+      // NOTHING IS LOST BY LEAVING THEM OUT, and that was measured rather than assumed: the report
+      // already carries each of those readings in the section written for them — the Quechua one appears
+      // five more times in the same document, under "Connotation & meaning" and again in the decision it
+      // asks the reader to take — and the audit workbook carries every block whatever this does.
+      //
+      // WHAT IT COSTS, stated rather than hidden: a marketplace name sighted with no URL recorded would
+      // not be listed here. None exists in any demo, and the row such a block produced was already a
+      // name beside an empty column. If one appears, the fix is to record where it was seen.
+      const url = field(block, "url");
+      if (url) out.web.push({ title, url, type: field(block, "type") });
     }
   }
   return out;
@@ -104,9 +126,18 @@ export function clearedNames(auditMd, recordIndex = {}) {
  * EVERY COUNTRY THE RUN READ, including the ones that came back clean — those are the whole point. A
  * count keyed off the findings would list only countries with a conflict, which is the gap this closes.
  *
- * @param {string[]} recordFileNames  the `_records/` directory listing, named `<cc>-<id>.json`
+ * THREE-VALUED, in the house pattern outputMeta already uses for a stage's output: `null` in means the
+ * run has NO `_records/` store, and `null` comes back out — we cannot say how many records were read.
+ * An empty ARRAY is the other thing entirely: the store is there and holds nothing, which is a real zero
+ * and renders as one. Collapsing the two is what this fixes; they arrived here as the same `[]` and the
+ * renderer could only drop the section, so a register that archives nothing read as a register nobody
+ * searched.
+ *
+ * @param {string[]|null} recordFileNames  the `_records/` listing, named `<cc>-<id>.json`; null = no store
+ * @returns {object|null} counts by country code, or null when the run cannot say
  */
 export function recordsByCountry(recordFileNames = []) {
+  if (recordFileNames === null) return null;
   const out = {};
   for (const name of recordFileNames) {
     const cc = (String(name).match(/^([a-z]{2})-/i) || [])[1];
@@ -115,6 +146,16 @@ export function recordsByCountry(recordFileNames = []) {
   return out;
 }
 
+/** Band record ids → `<office>-<id>` names, one per distinct record, in the archive's own naming. PURE. */
+export function recordNamesFromIds(ids) {
+  const out = new Set();
+  for (const id of ids ?? []) {
+    const m = /^\/mark\/([a-z]{2,4})\/(.+)$/i.exec(String(id ?? ""));
+    if (m) out.add(`${m[1].toLowerCase()}-${m[2]}`);
+  }
+  return [...out];
+}
+
 /** Marketplace, web, reputation and meaning checks, from the deterministic grid the tools wrote. PURE. */
 export function sweepCounts(commonLawGrid, auditMd = "") {
   const cells = Array.isArray(commonLawGrid?.cells) ? commonLawGrid.cells : [];
@@ -148,6 +189,81 @@ export function courtDecisionsState(caseLawText) {
   return "found";
 }
 
+/**
+ * WHICH TERRITORIES THE RUN SEARCHED, AND WHICH IT COULD NOT REACH — from the register PLAN. PURE.
+ *
+ * The plan is the authority on what was asked of the register; the `_records/` archive is only the
+ * authority on what came back and was kept. Reading "what was searched" off the archive is why a
+ * provider that keeps no records read as a provider nobody asked: no records, no countries, no section.
+ * Both halves are on the plan whether or not anything is archived — `entries[].regions` is what it will
+ * query, and `deferred_coverage` is what this provider does not cover, carrying the reason for each.
+ *
+ * Null for a run with no plan to read, which is an archived or legacy run: that is "cannot say", and it
+ * is not the same answer as a plan that named nothing.
+ *
+ * @param {object|null} plan  the parsed `register-plan.json`, or null when there is none
+ */
+export function planTerritoriesOf(plan) {
+  if (!plan || typeof plan !== "object") return null;
+  const entryRegions = (plan.entries ?? []).flatMap((e) => (Array.isArray(e?.regions) ? e.regions : []));
+  // `plan.regions` is the older shape and is the fallback, not a second source: a plan carrying entries
+  // has already said which regions it will query, and unioning the two would report a region the
+  // compiler moved OUT of `regions` into the deferral list as though it had been searched.
+  const searched = entryRegions.length ? [...new Set(entryRegions.map(String))]
+    : [...new Set((Array.isArray(plan.regions) ? plan.regions : []).map(String))];
+  // A WORLDWIDE PLAN THAT NAMES NO REGION CANNOT SAY WHERE IT REACHED. On a provider that takes no region
+  // list, worldwide compiles to queries with no jurisdiction clause at all — the whole database — so the
+  // plan names nothing, and read as "searched these" that is "searched nowhere": the section that says
+  // where a search reached disappeared on exactly the searches that reached furthest. Null is the answer
+  // the plan can actually give, and the page then reads the countries off what the register returned.
+  // Only when nothing was deferred: a worldwide order with deferrals is not an unrestricted sweep.
+  if (plan.scope_basis === "worldwide" && !searched.length
+    && !(Array.isArray(plan.deferred_coverage) && plan.deferred_coverage.length)) return null;
+  const unreached = (Array.isArray(plan.deferred_coverage) ? plan.deferred_coverage : [])
+    .map((d) => ({ jurisdiction: String(d?.jurisdiction ?? "").trim(), reason: String(d?.reason ?? "").trim() }))
+    .filter((d) => d.jurisdiction);
+  return { searched, unreached };
+}
+
+/**
+ * HOW DEEP THE LOCAL-LANGUAGE INVESTIGATION ACTUALLY WENT, against what the matter configured. PURE.
+ *
+ * The engine can run this investigation shallower than the account asked for, and until now it said so
+ * in exactly one place: a sentence a model wrote in the Methodology paragraph. The redesigned report
+ * replaces that paragraph with counts and named rows, so a run that went shallow said so on no page at
+ * all. This is the field behind that row.
+ *
+ * DERIVED FROM THE RUN'S OWN RECORD, NEVER FROM PROSE, and not derived here either: the caller hands in
+ * what `deriveLaneDepthVerdicts` produced, which is the one author of asked-versus-ran and reads the
+ * frozen lane sidecar against the slices that executed. A second opinion computed in the publish path
+ * would be a second answer to a question the engine has already answered.
+ *
+ * THE FOUR STATES, and the order they are decided in matters:
+ *   not-in-scope  no lane was asked for anything — a plain clearance, or every lane switched off
+ *   not-run       lanes were asked and none of them ran
+ *   ran-shallow   a lane fell short of its ask, or was asked and did not run while another did
+ *   ran           every lane that was asked ran at the depth it was asked for
+ *
+ * `ran: null` IS NOT `candidates`. A lane whose slices settle to nothing readable cannot say what it
+ * delivered, and the jx verdicts are careful to report that as unestablished rather than as the lesser
+ * depth. Folding it to `ran` here would put that claim back on a client's page, so it counts as short.
+ *
+ * @param {object|null} verdicts  per-lane `{asked, ran, shortfall}` from deriveLaneDepthVerdicts
+ */
+export function localLanguageDepth(verdicts) {
+  if (!verdicts || typeof verdicts !== "object") return { state: "not-in-scope", lanes: {} };
+  const lanes = {};
+  for (const [lane, v] of Object.entries(verdicts)) {
+    lanes[lane] = { configured: v?.asked ?? null, achieved: v?.ran ?? null };
+  }
+  const asked = Object.entries(verdicts).filter(([, v]) => v?.asked && v.asked !== "off");
+  if (!asked.length) return { state: "not-in-scope", lanes };
+  const ran = asked.filter(([, v]) => v?.ran);
+  if (!ran.length) return { state: "not-run", lanes };
+  const short = asked.some(([, v]) => v?.shortfall === true || !v?.ran);
+  return { state: short ? "ran-shallow" : "ran", lanes };
+}
+
 /** Was the name searched in a non-Latin script? Read off the plan's own terms, never asserted. PURE. */
 export function localScriptSearched(registerPlan) {
   const entries = Array.isArray(registerPlan?.entries) ? registerPlan.entries : [];
@@ -159,7 +275,16 @@ export function localScriptSearched(registerPlan) {
  *
  * @returns {{schemaVersion: number, cleared: object, counts: object}}
  */
-export function searchDepthRecord({ auditMd = "", recordIndex = {}, recordFileNames = [], commonLawGrid = null, caseLawText = "", registerPlan = null } = {}) {
+export function searchDepthRecord({ auditMd = "", recordIndex = {}, recordFileNames = [], bandRecordIds = null, commonLawGrid = null, caseLawText = "", registerPlan = null, laneDepthVerdicts = null } = {}) {
+  // `recordFileNames: null` travels all the way to the page — see recordsByCountry. The default stays `[]`
+  // because that is "the caller said nothing", not "the store is absent"; only the publish path knows the
+  // difference and it is the one producer.
+  //
+  // A PROVIDER THAT ARCHIVES NO RECORDS STILL RETURNED THEM. Its search answer is the band, and every
+  // record in it carries its office in its own id (`/mark/<office>/<id>`). So where there is no archive
+  // the band is what was read: counted by record, filed by office. Without it a run that read 785 register
+  // records reported "cannot say" and the report carried no register row and no country at all.
+  if (recordFileNames === null && Array.isArray(bandRecordIds)) recordFileNames = recordNamesFromIds(bandRecordIds);
   const cleared = clearedNames(auditMd, recordIndex);
   const groups = {};
   for (const key of CLEARED_GROUPS) groups[key] = 0;
@@ -169,10 +294,14 @@ export function searchDepthRecord({ auditMd = "", recordIndex = {}, recordFileNa
     cleared: { register: cleared.register, web: cleared.web, groups },
     counts: {
       recordsByCountry: recordsByCountry(recordFileNames),
-      recordsRead: recordFileNames.length,
+      recordsRead: recordFileNames === null ? null : recordFileNames.length,
       sweep: sweepCounts(commonLawGrid, auditMd),
       localScriptSearched: localScriptSearched(registerPlan),
       courtDecisions: courtDecisionsState(caseLawText),
+      // `localScriptSearched` above answers whether the spellings were searched; this answers how deep
+      // the investigation went against what was configured. Two different facts, and the row the report
+      // reserves is for the second.
+      localLanguage: localLanguageDepth(laneDepthVerdicts),
     },
   };
 }

package/driver/publish/templates/report.css

@@ -113,6 +113,39 @@
   .panel.actions p,.panel.actions li{font-size:13.5px;color:var(--slate);line-height:1.55}
   .panel.actions ul{margin:0;padding-left:20px} .panel.actions li{margin:3px 0}
 
+  /* ── THE BOARD'S OWN SECTION STRIP, lifted from the approved mock rather than written here ────────
+     Five entries and the board's own labels, marked not to print because the board marks it so: a strip
+     that follows the reader down the page is a control, and paper has nothing for it to follow. Every
+     anchor it names is drawn by the renderer above it.
+
+     THE SECTION NUMBER IS DRAWN AND HIDDEN, and that is the board's doing, not an oversight here: the
+     mock emits `<span class="num"></span>` on every section and then sets `display:none` on it further
+     down its own stylesheet. Carried faithfully, so the delivered document and the approved one hold the
+     same elements — this changes no pixel, and a reader looking for a visible number will not find one
+     in the board either. */
+  /* THE BREADCRUMB IS A ROW OF THE HEADER, not a bar under it (owner, 2026-09-18).
+     It used to be a SIBLING of .rep-stickyhead, pinned on its own at top:var(--tb-h,52px) — and
+     --tb-h is set nowhere in this product, so the fallback was a guess at a bar that measures ~46px:
+     content showed through the slit between the two, and z-index:20 put the strip UNDER the header's
+     100 whenever the guess was wrong. The strip is now emitted inside .rep-stickyhead, so the header
+     and the breadcrumb are one sticky surface that pins and unpins together and can never gap or
+     overlap, whatever the bar measures or how it wraps.
+     No background and no bottom hairline of its own: the wrapper carries the blurred surface and the
+     single edge, and the border-top here is the divider between the two rows. It is on .strip rather
+     than on any wrapper because sectionStrip() emits NOTHING when fewer than two of its sections are
+     live — a wrapper would leave a stray line on those reports.
+     The gutter matches the topbar's, so the first entry lines up under the back button. */
+  .strip{display:flex;gap:4px;align-items:center;padding:4px max(26px,calc((100% - 1120px)/2)) 6px;
+    border-top:1px solid var(--line);font:600 12px/1 'Satoshi','Helvetica Neue',Arial,sans-serif;
+    letter-spacing:.04em;overflow-x:auto;scrollbar-width:none}
+  .strip::-webkit-scrollbar{display:none}
+  .strip a{display:inline-flex;align-items:center;gap:7px;padding:7px 10px;border-radius:999px;color:#6b5d50;text-decoration:none;white-space:nowrap}
+  .strip a i{width:8px;height:8px;border-radius:50%;border:1.5px solid currentColor;box-sizing:border-box}
+  .strip a.done{color:#4c7a4c}
+  .strip a.done i{background:#4c7a4c;border-color:#4c7a4c}
+  .strip a.now{color:#250902;background:rgba(0,0,0,.06)}
+  .strip a.now i{border-color:#860F09;border-width:3px}
+  .sec .num{display:none}
   .sec{margin:56px 0 18px;display:flex;align-items:baseline;gap:15px;border-top:2px solid var(--ink);padding-top:14px}
   .sec .num{font-family:var(--mono);font-size:13px;color:var(--crimson);font-weight:600}
   .sec h2{font-weight:900;font-size:25px;margin:0;letter-spacing:-.015em}
@@ -280,7 +313,26 @@
 
 
   /* cross-region rights-holder rows (.rrow) + secondary region groups (.rgroup) */
+  /* A PANEL THAT SCROLLS SIDEWAYS SAYS SO, the same way the knockout's tables do.
+     `overflow-y:auto` alone makes the OTHER axis compute to auto as well, so this panel has scrolled
+     horizontally for as long as it has scrolled vertically — and drawn nothing to say it. Measured on a
+     delivered global preliminary at 390px: 377px of rows in a 336px box, 41px unreachable, no bar.
+     A reader who cannot see that it drags does not drag it, and a holder's jurisdiction sits in the part
+     that is off the edge.
+
+     THE TWO INSTRUCTIONS CANNOT SIT TOGETHER, and that was measured rather than reasoned on the
+     knockout: setting the standard scrollbar-width alongside the pseudo-elements makes the engine take
+     the standard path and ignore them, and on the engine that publishes these reports the standard path
+     draws an overlay bar with no layout height at all — both together 0px, the pseudo-elements alone
+     9px, the standard properties alone 0px. So the standard ones sit behind a support query the engines
+     carrying the pseudo-elements never enter, and each engine gets exactly one instruction. Written the
+     way anyone would write it — belt and braces — it renders nothing and the stylesheet gives no sign. */
   .keypanel{overflow-y:auto}
+  .keypanel::-webkit-scrollbar{height:9px;-webkit-appearance:none}
+  .keypanel::-webkit-scrollbar-track{background:transparent}
+  .keypanel::-webkit-scrollbar-thumb{background:var(--faint);border-radius:5px}
+  @supports not selector(::-webkit-scrollbar){
+    .keypanel{scrollbar-width:thin;scrollbar-color:var(--faint) transparent}}
   .rrow{border-top:1px solid var(--line)}
   .rrow:first-of-type{border-top:0}
   .rrow>summary{cursor:pointer;list-style:none;display:flex;align-items:center;gap:9px;padding:8px 4px}
@@ -344,9 +396,11 @@
        and internal notes (.int-note, hidden above) are the only two things print ever drops. */
     details>*:not(summary){display:block!important}
     details>summary{list-style:none;cursor:default}
-    /* `details.searched` is a SECTION TITLE, so it keeps its summary in print like the region rows and
-       the secondary groups — a printed report that drops "What was searched" loses the heading over the
-       counts, not just a control. What it must not print is the ▸/▾ toggle, which on paper is a
+    /* `details.searched` keeps its summary in print like the region rows and the secondary groups. The
+       reason has CHANGED and the behaviour has not: the summary used to carry the section's own heading,
+       so dropping it in print lost the heading over the counts. The heading is now an <h2> in a section
+       of its own, as the approved board draws it, and print cannot lose it. What the summary still
+       carries is the sub-label over the counts, which is worth printing on its own. What it must not print is the ▸/▾ toggle, which on paper is a
        right-pointing arrow over content that is already fully expanded. Found by the print check, which
        walks a rendered page and refuses any disclosure that is in neither list; the public suite does
        not run it, so the commit that added this fold could ship the half it did not think about. */
@@ -519,6 +573,9 @@
   details.searched[open]>summary::before{content:'▾'}
   details.searched .gcount{margin-left:auto;color:var(--slate);font-weight:500;font-size:12.5px}
   details.searched .gbody{padding:0 18px 12px}
+  .wchips{display:flex;flex-wrap:wrap;gap:6px;margin-top:6px}
+  details.searched .wstate{font-weight:600}
+  details.searched .wnote{display:block;margin-top:4px;font-size:12.5px;line-height:1.45;color:var(--slate)}
   details.searched .row{display:grid;grid-template-columns:200px 1fr;gap:12px;padding:7px 0;border-top:1px solid var(--line);font-size:13.5px}
   details.searched .k{font-size:10.5px;letter-spacing:.12em;text-transform:uppercase;color:var(--faint);padding-top:3px}
   .openrows,.provwrap{margin-top:12px;border-top:1px solid var(--line);padding-top:10px}

package/driver/publish/xlsx.mjs

@@ -629,8 +629,15 @@ export async function buildAudit(contract, auditParsed, outPath, mark = '', fm =
   // THE ROW IS AN ORDINARY COVERAGE ROW, built by the same function as every other, so it carries the
   // same four columns and takes the same State colour. It is not a second shape and not a new sheet.
   // The words in it are the run record's own: nothing here composes prose.
+  //
+  // AND THE PROBES THE RUN DECIDED ON AND DID NOT MAKE, on the same footing. The recall net's owner
+  // budget drops its excess with the party and the probe id recorded; until this row the excess reached
+  // no reader, so a search that decided on nineteen ownership checks and made five read as one that
+  // made the checks it wanted. Same builder, same four columns, same State colour: this is not a second
+  // shape and not a new sheet, and the words are the run receipt's own.
   addSheet(wb, 'Coverage & gaps', COVERAGE_COLS,
-    [...coverageRows(coverage), ...coverageRows(contract?.droppedConditions || [])], (row, _d, kept) => {
+    [...coverageRows(coverage), ...coverageRows(contract?.droppedConditions || []),
+     ...coverageRows(contract?.undispatchedProbes || [])], (row, _d, kept) => {
     if (!kept.has('State')) return;
     const st = row.getCell('State'); const f = STATE_FILL[String(st.value).trim()];
     if (f) { st.fill = { type: 'pattern', pattern: 'solid', fgColor: { argb: 'FF' + f } }; st.font = { bold: true }; }

package/driver/queue-order.mjs

@@ -21,7 +21,7 @@
 // parse set, or prelim-driver.path's watch — and reordering must NOT wake the runner.
 
 import { readFileSync, writeFileSync, renameSync, mkdirSync, readdirSync } from "node:fs";
-import { join, dirname } from "node:path";
+import { join, dirname } from "node:path"; import { studioDirFor } from "../shared/pre-rename-spellings.mjs";
 
 export function queueOrderPath(qdir) { return join(dirname(qdir), ".queue-order.json"); }
 
@@ -69,7 +69,7 @@ export function queueDirsUnder(workspaceRoot) {
   try { names = readdirSync(workspaceRoot); } catch { return out; }
   for (const n of names) {
     if (!n.startsWith("workspace-")) continue;
-    const q = join(workspaceRoot, n, "studio", "prelim-search", "queue");
+    const q = join(studioDirFor(join(workspaceRoot, n)), "queue");
     try { readdirSync(q); out.push(q); } catch { /* no queue in this workspace */ }
   }
   return out.sort();

package/driver/recording-agreement.mjs

@@ -70,7 +70,7 @@ export const SURFACE = "surface";
  * performs anyway. Since the warm and cold rungs DERIVE the tool name from `TOOL_WRITTEN_ARTIFACTS`,
  * so adding that row — step 1 of every conversion — makes both rungs name the record tool, and (a) went
  * quiet for it whatever the dispatch said. Measured on conversion 3 before its dispatch was touched: the
- * grant carried `record_prelim_variants`, the dispatch did not mention it, both repair rungs did, and (a)
+ * grant carried `record_clearance_variants`, the dispatch did not mention it, both repair rungs did, and (a)
  * was silent. The guard asked a question the conversion's own bookkeeping answered — the tautology shape
  * `b04d6d58` and the `RECORDING_TOOLS` non-derivation both exist to remove.
  *

package/driver/reference-score.mjs

@@ -1107,7 +1107,7 @@ export function planSubQueries({ plan = null, execution = null, scopeTerritories
   // ── THE IN-SCOPE SWEEP'S OWN STATE — what decides whether a narrow was OWED at all ───────────────
   //
   // `subQueryState` returns `none` for a territory with no entry of its own, and that one value covers
-  // two opposite situations. The doctrine (`skills/prelim-register/SKILL.md`, Recipe 1 §2b) says a slice
+  // two opposite situations. The doctrine (`skills/clearance-register/SKILL.md`, Recipe 1 §2b) says a slice
   // gets its own `register_enumerate` ONLY on the guarded crowd-narrow path — when Step 2, the
   // region-scoped in-scope sweep, returned `incomplete` and a major may sit in the un-paged remainder.
   // When Step 2 returns `enumerated` the complete set provably contains every in-scope slice and the

package/driver/register-count.mjs

@@ -336,10 +336,24 @@ export async function countRegisterHits({
       try { r = await counter(term, p, { classes: scoped, regions }); }
       catch (e) { r = { ok: false, total: null, reason: `count threw: ${String(e?.message ?? e).slice(0, 200)}` }; }
       const ok = Boolean(r?.ok) && Number.isFinite(r?.total);
+      // A DISCLOSED APPROXIMATION IS AN ANSWER, AND IT WAS BEING READ AS A FAILURE. When the register
+      // says "more than ten thousand", it has answered — it has answered with a floor instead of a
+      // count, which is a different thing from not answering at all. `ok` is false for it because the
+      // total is deliberately not finite (an approximation must never become a number), so everything
+      // downstream saw a dead probe and the client was told the count was not available: the same words
+      // the report uses when the register could not be reached. The direction was inverted, too —
+      // saturation is a finding about the mark, and the denser the crowd the more certainly it was
+      // suppressed.
+      const approximated = !ok && Boolean(r?.ok) && r?.approximate === true && Number.isFinite(r?.floor);
+      // THE REFUSAL FIELD IS `cause` ON THIS PROVIDER AND `reason` ON OTHERS, and reading only one of
+      // them is why an honest refusal arrived as the fallback string with the receipts ledger recording
+      // "unknown". The same mismatch is described above `listRecords`, where it was fixed; this is the
+      // other half of it. Both are read, in the order a caller would expect.
+      const refusal = r?.reason ?? r?.cause ?? null;
       // A CLIENT-SIDE refusal (the provider's query language cannot express this question — a term
       // carrying parentheses, an office outside its vocabulary) is
       // deterministic: no retry and no resume can change it, so it settles rather than re-billing.
-      const deterministic = !ok && (isCapabilityGap(r?.reason) || Boolean(r?.unsupported));
+      const deterministic = !ok && !approximated && (isCapabilityGap(refusal) || Boolean(r?.unsupported));
       if (ledgerPath) {
         try {
           appendFileSync(ledgerPath, JSON.stringify({
@@ -350,13 +364,18 @@ export async function countRegisterHits({
             ...(form ? { term, variant_form: form } : {}),
             classes: scoped, regions, provider, probe: r?.probe ?? null,
             ok, total: ok ? r.total : null, took_ms: Date.now() - started,
-            ...(ok ? {} : { cause: String(r?.reason ?? "unknown").slice(0, 300) }),
+            // An approximation is recorded as what it is. It billed and it answered, so a receipt
+            // calling it a failure with cause "unknown" misreports both halves.
+            ...(approximated ? { approximate: true, floor: r.floor } : {}),
+            ...(ok || approximated ? {} : { cause: String(refusal ?? "unknown").slice(0, 300) }),
           }) + "\n");
         } catch { /* receipts are best-effort, never fatal — same as the sweep ledger */ }
       }
-      return ok
-        ? { total: r.total }
-        : { total: null, unavailable: String(r?.reason ?? "the count could not be taken").slice(0, 300), ...(deterministic ? { deterministic: true } : {}) };
+      if (ok) return { total: r.total };
+      // `total` stays null for an approximation and that is the rule, not an oversight: the floor is not
+      // a count and may never be filled in as one. What travels beside it is the disclosure.
+      if (approximated) return { total: null, approximate: true, floor: r.floor };
+      return { total: null, unavailable: String(refusal ?? "the count could not be taken").slice(0, 300), ...(deterministic ? { deterministic: true } : {}) };
     };
 
     // The aggregate: the provider's EXACT predicate, once per generated form, summed.
@@ -503,12 +522,38 @@ export function countsForMark(doc, name) {
  * Office CODES, not names: `scope.regions` on the same artifact is already codes, and the alternative
  * is inventing a display layer that has to stay in step with the office vocabulary of six providers.
  */
+/**
+ * The register's own floor for a count it stopped taking, or null.
+ *
+ * ONE READING FOR EVERY PAGE THAT SHOWS A COUNT. The glance line printed the floor and the counts table,
+ * the coverage clause and the workbook beside it still printed "not available", so one report said two
+ * different things about the same cell. A floor counts only with the register's flag AND the number —
+ * a flag with no number says no more than "unknown" does.
+ */
+export function disclosedFloor(c) {
+  return c?.approximate === true && Number.isFinite(c?.floor) ? c.floor : null;
+}
+
+/** A floor as every page prints it: the register's own figure, and no sentence around it. */
+export const moreThan = (floor) => `more than ${floor.toLocaleString("en-US")}`;
+
 export function countLine(entry) {
   if (!entry?.counts) return null;
   const parts = COUNT_PREDICATES.map((p) => {
     const c = entry.counts[p.key];
     const word = p.glance ?? p.label.toLowerCase();
     if (Number.isFinite(c?.total)) return `${c.total} ${word}`;
+    // A REGISTER THAT ANSWERS WITH A FLOOR HAS ANSWERED. Some registers stop counting and report
+    // "more than ten thousand" rather than a total; that is the register's own figure and it is what
+    // the client is shown, as a number. Rendering it as "not available" beside a register that could
+    // not be reached at all tells a reader the same thing about two different facts, and the one the
+    // reader would act on — go and look elsewhere — is wrong for this one.
+    //
+    // No sentence, no adjective: the rest of this line is figures and what they counted, and a
+    // qualification written here would be the only prose on it.
+    if (disclosedFloor(c) !== null) return `${word}: ${moreThan(disclosedFloor(c))}`;
+    // Left for a register this deployment could not reach or could not ask. Those have no figure at
+    // all, which is what this phrase now means and the only thing it means.
     return `${word}: not available`;
   });
   const scope = entry.classScope === "all-classes"

package/driver/register-coverage.mjs

@@ -250,3 +250,70 @@ export function registerReachRefusal(uncovered, registerLabel = null) {
   return `${names} ${uncovered.length === 1 ? "is" : "are"} not available with ${where}`
     + ` — remove ${uncovered.length === 1 ? "it" : "them"} to run this search.`;
 }
+
+// ── WHAT THE FORM SHOULD OFFER: EVERY PLACE A REGISTER THIS PRODUCT SUPPORTS CAN SEARCH ────────────────
+//
+// The form offered 37 places with no rule behind them: Bulgaria and Greece, but not Denmark, Portugal,
+// Vietnam or Colombia, while a worldwide search on the wider register already swept every one of its 186
+// offices. The rule is the registers' own reach: a place is offered when at least one supported register
+// provider can search it, decided by the SAME resolution the plan compiler runs (`resolveRegions`, one code
+// at a time), so the offer cannot promise a place the compiler would defer everywhere. What THIS install's
+// register does not reach is marked per deployment by `coveredTerritoryNames` and the door's refusal — the
+// offer is the product's; the marking is the install's.
+//
+// A provider with no enumerable coverage (a global aggregator declaring `covered: null`) widens nothing:
+// "everywhere" is not a list, and letting it in would offer every code the engine holds, including places
+// no register answers for.
+//
+// NAMES ARE NEVER WRITTEN HERE. A place the form already offers keeps its shipped label; any other is named
+// by the runtime's standard English region names (CLDR), the same data the territory vocabulary already
+// resolves typed names against. A code with neither — the regional systems no label exists for — is left
+// out and listed, never given a name composed in code. Provider extension codes (X-, ZZ) are not places.
+//
+// @returns {Promise<{ offered: {code: string, name: string}[], unnamed: string[] }>}  regions first, then
+//          countries by name.
+export async function searchableTerritories() {
+  const [{ KNOWN_JURISDICTION_CODES, canonicalJurisdictionCode }, { normalizeTerritory }, { PROVIDER_CAPABILITIES }, { resolveRegions }]
+    = await Promise.all([import("./jurisdiction-codes.mjs"), import("../providers/_shared/territory-codes.mjs"),
+      import("./register-capabilities.mjs"), import("./register-plan.mjs")]);
+  const enumerable = Object.values(PROVIDER_CAPABILITIES).filter((caps) => Array.isArray(caps?.offices?.covered));
+  const shippedName = new Map(LABELS_OFFERED_BEFORE_THE_RULE.map((n) => [canonicalJurisdictionCode(normalizeTerritory(n) ?? ""), n]));
+  let cldr = null;
+  try { cldr = new Intl.DisplayNames(["en"], { type: "region" }); } catch { cldr = null; }
+  const offered = [], unnamed = [];
+  const seen = new Set();
+  for (const raw of KNOWN_JURISDICTION_CODES) {
+    const code = canonicalJurisdictionCode(raw);
+    if (!code || seen.has(code) || /^(X.|ZZ)$/.test(code)) continue;
+    seen.add(code);
+    const searched = enumerable.some((caps) => {
+      const { regions, deferred } = resolveRegions([code], caps);
+      return deferred.length === 0 && regions.length > 0;
+    });
+    if (!searched) continue;
+    let name = shippedName.get(code) ?? null;
+    if (!name && cldr) { try { const n = cldr.of(code); if (n && n !== code && !/^unknown/i.test(n)) name = n; } catch { /* no name */ } }
+    if (!name) { unnamed.push(code); continue; }
+    offered.push({ code, name });
+  }
+  // Regions first, in the order the form already showed them; then countries by name.
+  const regional = new Set(["EU", "BX", "AP", "OA", "EA", "WO"]);
+  const shippedAt = (t) => { const i = LABELS_OFFERED_BEFORE_THE_RULE.indexOf(t.name); return i < 0 ? Infinity : i; };
+  offered.sort((a, b) => (regional.has(b.code) - regional.has(a.code))
+    || (regional.has(a.code) ? shippedAt(a) - shippedAt(b) : 0) || a.name.localeCompare(b.name, "en"));
+  return { offered, unnamed: unnamed.sort() };
+}
+
+// THE 37 LABELS THE FORM CARRIED BEFORE THIS RULE, frozen. They are shipped strings, so each place keeps
+// the label a client already reads — "Hong Kong", "Macau", "Turkey", where the runtime's standard names
+// differ — and the two regional systems whose only names are these. Frozen HERE rather than read from the
+// form's live list, because that list is now minted FROM this function, and a rule that read its own
+// output would lose its labels the first time the file was regenerated from scratch.
+export const LABELS_OFFERED_BEFORE_THE_RULE = Object.freeze([
+  "European Union", "Benelux", "African Regional (ARIPO)",
+  "United States", "United Kingdom", "Ireland", "France", "Germany", "Spain", "Italy", "Netherlands",
+  "Switzerland", "Austria", "Sweden", "Norway", "Poland", "Bulgaria", "Greece", "Turkey", "Canada",
+  "Mexico", "Brazil", "Argentina", "China", "Hong Kong", "Taiwan", "Macau", "Japan", "South Korea",
+  "Singapore", "India", "Thailand", "Australia", "New Zealand", "United Arab Emirates", "Saudi Arabia",
+  "South Africa",
+]);

package/driver/register-grant-vocabulary.mjs

@@ -69,5 +69,5 @@ export function grantVocabularySentence(provider = null) {
     + `whole, and the frozen plan's entries are fetched by the executor, not by you. So reaching for one `
     + `of these means the query is wrong, not that a capability is missing: go back to the sweep and fix `
     + `its scope. This list is the tools THIS provider serves; another deployment's differs, and `
-    + `\`skills/prelim-register/providers/<name>.md\` is where the provider-specific vocabulary lives.`;
+    + `\`skills/clearance-register/providers/<name>.md\` is where the provider-specific vocabulary lives.`;
 }

package/driver/register-plan.mjs

@@ -743,7 +743,24 @@ export function excludeHouseElement(manifest, house) {
   return { manifest: next, confirmation, refused: null };
 }
 
-export function compileRegisterPlan({ manifest, job, form = null, skillVersion = "", capabilities = null, unavailableOffices = [] }) {
+export function compileRegisterPlan({ manifest, job, form = null, skillVersion = "", capabilities = null, unavailableOffices = [], houseElement = null }) {
+  // ── AN EXCLUDED ELEMENT'S FORM BAND MUST BE UNREACHABLE, NOT MERELY UNASKED-FOR ─────────────────
+  //
+  // THE DEFECT THIS CLOSES, found by following the seam rather than by a failing arm. `bandFor` falls
+  // back to `elements[0]` when it cannot find the element it was asked for. The house-element exclusion
+  // changes `dominant_element` to the remainder's dominant word — a word the form neighbourhood, derived
+  // earlier from the original manifest, may carry no band for. The lookup would then MISS and the
+  // fallback would hand back the first element's band, which is the house element's: the exclusion would
+  // appear to work, `dominant_element` would read correctly on the plan, and the one-letter mutation
+  // floor of the very element being excluded would compile anyway. Silently, and it is the whole flood.
+  //
+  // So the element is removed from the form document here, where every `bandFor` call in this compile
+  // reads it. Unreachable beats un-asked-for: a fallback cannot select what is not there.
+  if (houseElement && form?.elements) {
+    const lcHouse = String(houseElement).trim().toLowerCase();
+    const kept = form.elements.filter((e) => String(e?.element ?? "").trim().toLowerCase() !== lcHouse);
+    form = { ...form, elements: kept };
+  }
   const classes = (job?.classes ?? []).map(String).filter(Boolean);
   if (!classes.length) throw new Error("register_plan_classes_missing: a plan is always class-scoped — compile with the matter's in-scope Nice classes");
   const caps = capabilities ?? null;
@@ -962,7 +979,7 @@ export function compileRegisterPlan({ manifest, job, form = null, skillVersion =
   // visible from the definition rather than inferred from an absence.
   const STRIPPED_CATEGORIES = new Set(["phonetic", "transliteration", "visual"]);
   // — THE DOCTRINE'S OWN DISPATCH TABLE, NOW BINDABLE. The universal-categories table
-  // (prelim-variants SKILL.md) states the mode per tag: `exact-element` sweeps default, `plural-root`
+  // (clearance-variants SKILL.md) states the mode per tag: `exact-element` sweeps default, `plural-root`
   // is a root (the contains match is its whole purpose), and `formative-family` is "never exact-only".
   // Until the enum accepted these tags the mandate bound to nothing — measured: three root-shaped
   // strings dispatched exact, 4/2/4 records, the family they exist to reach retrieved zero times.

package/driver/registry-fidelity.mjs

@@ -15,7 +15,7 @@
 // ordering, and renewal/expiry cycle arithmetic (renewals fall at year 10/20/… from registration — the
 // check that catches "registration 2013 … renewed 2025" from the document alone).
 
-import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, openSync, readSync, closeSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, openSync, readSync, closeSync } from "node:fs"; import { runPrefixSpellings } from "../shared/pre-rename-spellings.mjs";
 import { join } from "node:path";
 import { driverDir, ensureDriverDir } from "../shared/driver-dir.mjs";   // — one definition of where `_driver/` is
 import { ledgerPath, runRecordLogPath, ledgerDeprecationNotice, retiredGlobalRecordLogNotice }
@@ -34,8 +34,8 @@ function stripGatewayNs(s) {
   return typeof s === "string" ? s.replace(/^agent:[^:]+:/, "") : "";
 }
 function rowMatchesRun(row, runPrefix) {
-  return stripGatewayNs(row.sessionKey).startsWith(runPrefix)
-      || stripGatewayNs(row.sessionId ?? "").startsWith(runPrefix);
+  return runPrefixSpellings(runPrefix).some((rp) => stripGatewayNs(row.sessionKey).startsWith(rp)
+      || stripGatewayNs(row.sessionId ?? "").startsWith(rp));   // either spelling: a run resumed across the rename
 }
 
 

package/driver/repair-composers.mjs

@@ -586,7 +586,7 @@ export const REPAIR_COMPOSERS = [
     //
     // `samplesForStage` IS REQUIRED, and for the reason `*:lint-repair`'s note above gives rather than the
     // one it looks like: a `stage: "*"` composer is walked for EVERY recording stage, so the fixed sample's
-    // `record_frame_diff` is read as an order handed to blind-frame, matter-frame, prelim-variants,
+    // `record_frame_diff` is read as an order handed to blind-frame, matter-frame, clearance-variants,
     // report-overview, report-card and doubt-closure — six ordered-but-not-granted findings that are
     // artifacts of the SAMPLE, not of the tree. At dispatch the tool is always the walking stage's own,
     // because it is derived from `out`. Removing this hook reproduces all six.

package/driver/repair-contract.mjs

@@ -116,7 +116,7 @@ export function failingTarget(lastFail, files = []) {
   if (!named) return null;
   const list = (Array.isArray(files) ? files : [files]).filter(Boolean).map(String);
   if (list.length <= 1) return list[0] ?? null;
-  // longest suffix match wins: "x/register-findings.md" identifies ".../prelim-search/x/register-findings.md"
+  // longest suffix match wins: "x/register-findings.md" identifies ".../clearance-search/x/register-findings.md"
   const hit = list.find((f) => f === named || f.endsWith(`/${named}`) || named.endsWith(`/${f}`));
   return hit ?? null;
 }

package/driver/replay-archive.mjs

@@ -22,14 +22,14 @@
 // an INTENDED fix (then --update on the merged result).
 //
 // Env: CLEAROTRON_REPLAY_ROOTS  colon-separated corpus roots
-//        (default: <workspaceRoot>/workspace-*/studio/prelim-search — live slugs + archive/)
-//      CLEAROTRON_REPLAY_SNAPSHOT  snapshot path (default: ~/.prelim-replay-snapshot.json)
+//        (default: <workspaceRoot>/workspace-*/studio/clearance-search — live slugs + archive/)
+//      CLEAROTRON_REPLAY_SNAPSHOT  snapshot path (default: ~/.clearance-replay-snapshot.json)
 
 import "../shared/env-local.mjs";   // — FIRST: the CLEAROTRON_* translation must land before any
                                      // module-top capture below it evaluates. A call in this file's BODY
                                      // would run too late — that was the repair that left this open.
 import { readFileSync, writeFileSync, readdirSync, existsSync, statSync } from "node:fs";
-import { join, basename } from "node:path";
+import { join, basename } from "node:path"; import { studioDirFor } from "../shared/pre-rename-spellings.mjs";
 import { DRIVER_DIR, driverDir } from "../shared/driver-dir.mjs";   //
 import { homedir } from "node:os";
 import { validators } from "./verify.mjs";
@@ -62,7 +62,7 @@ function looksLikeRunDir(p) {
   return n.includes(DRIVER_DIR) || n.some((f) => FILE_CHECKS[f]);
 }
 
-// Corpus roots → sorted run dirs. Layout per root (a workspace's studio/prelim-search):
+// Corpus roots → sorted run dirs. Layout per root (a workspace's studio/clearance-search):
 //   <slug>/<date>-<codename>/                      (live slugs)
 //   archive/<YYYY-MM>/<slug>/<date>-<codename>/    (archived)
 export function discoverRuns(roots) {
@@ -219,12 +219,12 @@ function main() {
   const args = new Set(process.argv.slice(2));
   // ON-DISK NAME, NOT A PRODUCT NAME: an install that never set the variable already has this file, so
   // renaming the default points the reader at one that does not exist. Ruling.
-  const snapshotPath = process.env.CLEAROTRON_REPLAY_SNAPSHOT || join(homedir(), ".prelim-replay-snapshot.json");
+  const snapshotPath = process.env.CLEAROTRON_REPLAY_SNAPSHOT || [join(homedir(), ".prelim-replay-snapshot.json"), join(homedir(), ".clearance-replay-snapshot.json")].find((f, i) => i === 1 || existsSync(f));   // the file the install already has wins
   const roots = process.env.CLEAROTRON_REPLAY_ROOTS
     ? process.env.CLEAROTRON_REPLAY_ROOTS.split(":").filter(Boolean)
     : names(config.workspaceRoot)
         .filter((d) => config.agentIdFromWorkspaceName(d) != null)
-        .map((d) => join(config.workspaceRoot, d, "studio", "prelim-search"));
+        .map((d) => studioDirFor(join(config.workspaceRoot, d)));
 
   const runDirs = discoverRuns(roots);
   if (!runDirs.length) {