clearotron 0.3.2-beta.8 → 0.3.2-beta.9

package/driver/report-overview-record.mjs

@@ -2,7 +2,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // report-overview-record.mjs — the recording transport for the report shell.
 //
-// Conversion 4, after blind-frame, skeptic, frame-diff, matter-frame and prelim-variants
+// Conversion 4, after blind-frame, skeptic, frame-diff, matter-frame and clearance-variants
 //. It is the FIRST conversion whose artifact a client reads. report-overview.md is not an internal
 // input that a later stage consumes — it is the front-matter and the Actions section of the delivered
 // report, so a render defect here reaches a lawyer's desk rather than a test log.
@@ -181,7 +181,7 @@ export function renderReportOverview(model, identity) {
   const id = identity ?? {};
   const fm = [
     "---",
-    "type: prelim-clearance",
+    "type: clearance-clearance",
     id.matter ? `matter: ${id.matter}` : "",
     id.title ? `title: ${id.title}` : "",
     id.client ? `client: ${id.client}` : "",

package/driver/run-requirements.mjs

@@ -235,11 +235,11 @@ export function runRequirements(env = {}, { registers = [], engines = {}, defaul
         // it, the runner logs it, and a composite name read as four more items in doctor's list of what is
         // missing. The REASON names all four, with whose each is. And the row carries all four as `anyOf`,
         // which `runRequiredNames` hands out as names to read: doctor fills its view of the services by name,
-        // and reading only Google's switch reported a Microsoft machine's switch, held by its services, as
+        // and reading only Google's switch reported an Azure machine's switch, held by its services, as
         // missing.
         //
         // A SWITCH THAT IS SET AND NOT ON IS SAID, because it reads as on to a person and as off to the
-        // program: `CLAUDE_CODE_USE_FOUNDRY=0` on a Microsoft machine was answered with Google's switch
+        // program: `CLAUDE_CODE_USE_FOUNDRY=0` on an Azure machine was answered with Google's switch
         // and nothing else, and the reader was left to work out why the one they set did not count.
         // And it is not an alternative to read or carry: `anyOf` is handed to the composer too, and the
         // set-and-off line would travel through it.
@@ -273,7 +273,7 @@ export function runRequirements(env = {}, { registers = [], engines = {}, defaul
     // The rows above name what is MISSING. The run door also refuses what is set wrongly: two clouds
     // switched on, a switch left on beside `subscription` or `api-key`, a word that is not a billing mode,
     // a cloud account on Codex. Each passed start's guard, the order wall and doctor, and the run was then
-    // refused after intake. Measured 2026-09-15: a services' file holding Microsoft's switch from one start
+    // refused after intake. Measured 2026-09-15: a services' file holding Azure's switch from one start
     // and Google's from the next read clean everywhere and refused every search.
     //
     // ASKED OF THE RUN DOOR ITSELF, `resolveAuthMode`, over the environment being judged, and its refusal

package/driver/runner.mjs

@@ -21,7 +21,7 @@
 import "../shared/env-local.mjs";   // side effect: apply <repo>/.env when THIS file is the CLI entry (never on library import)
 import "./engine/mcp/http-dispatcher.mjs";   // side effect: raise undici headersTimeout (code-side fetches)
 import { readdirSync, renameSync, existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync, rmSync, statSync } from "node:fs";
-import { join, dirname, basename } from "node:path";
+import { join, dirname, basename } from "node:path"; import { studioDirFor } from "../shared/pre-rename-spellings.mjs";
 import { driverDir, ensureDriverDir } from "../shared/driver-dir.mjs";   // — one definition of where `_driver/` is
 // The queue's filename vocabulary, in ONE place — the rule, extended by to the prose-sidecar and
 // claim-sidecar names, because a harness check retyped four of them from memory and false-alarmed on the
@@ -1548,7 +1548,7 @@ export function agentStudioRoots() {
   try {
     for (const name of readdirSync(config.workspaceRoot)) {
       if (config.agentIdFromWorkspaceName(name) == null) continue;
-      const s = join(config.workspaceRoot, name, "studio", "prelim-search");
+      const s = studioDirFor(join(config.workspaceRoot, name));
       if (existsSync(s)) out.push(s);
     }
   } catch { /* workspaceRoot absent in some envs */ }

package/driver/scope-facts.mjs

@@ -26,6 +26,7 @@
 // keys only on the neutral plan/band vocabulary, never a vendor name or vendor-shaped field.
 
 import { classTokensFromScopeText } from "./coverage-ledger.mjs";
+import { capabilitiesFor } from "./register-capabilities.mjs";
 
 const clsStr = (c) => String(c ?? "").trim();
 
@@ -144,10 +145,11 @@ export function deriveScopeFacts({ instructedScope = null, plan = null, planExec
 
   const searched_jurisdictions = Array.isArray(plan?.regions) ? plan.regions.map(String) : [];
   const scope_basis = plan?.scope_basis === "worldwide" ? "worldwide" : null;
+  const register_service = registerServiceOf(plan);
 
   const classes_line = instructedClasses.length ? instructedClasses.join(", ") : null;
   const coverage_line = instructedClasses.length && entries.length
-    ? buildCoverageLine(instructedClasses, per_class, { searched_jurisdictions, scope_basis, instructedScope })
+    ? buildCoverageLine(instructedClasses, per_class, { searched_jurisdictions, scope_basis, instructedScope, register_service })
     : null;
 
   return {
@@ -184,7 +186,7 @@ export function deriveScopeFacts({ instructedScope = null, plan = null, planExec
 // clause is word-for-word the same are stated ONCE, over the classes they are about. Nothing is pooled
 // and no number moves: the grouping is on the rendered text, so two classes only share a line when the
 // line they would each have printed is already the same string.
-function buildCoverageLine(classes, per_class, { searched_jurisdictions = [], scope_basis = null, instructedScope = null } = {}) {
+function buildCoverageLine(classes, per_class, { searched_jurisdictions = [], scope_basis = null, instructedScope = null, register_service = null } = {}) {
   const sorted = [...classes].sort((a, b) => (Number(a) || 0) - (Number(b) || 0));
   const byBody = new Map();
   for (const c of sorted) {
@@ -197,7 +199,7 @@ function buildCoverageLine(classes, per_class, { searched_jurisdictions = [], sc
   // bodies A, B, A renders "Classes 5 and 32: A; Class 9: B", not A twice.
   const groups = [...byBody.entries()].map(([body, classes]) => ({ body, classes }));
   const head = (cs) => (cs.length === 1 ? `Class ${cs[0]}` : `Classes ${joinAnd(cs.map(String))}`);
-  return `${groups.map((g) => `${head(g.classes)}: ${g.body}`).join("; ")}${jurisdictionTail({ searched_jurisdictions, scope_basis, instructedScope })}`;
+  return `${groups.map((g) => `${head(g.classes)}: ${g.body}`).join("; ")}${jurisdictionTail({ searched_jurisdictions, scope_basis, instructedScope, register_service })}`;
 }
 
 // One plain-language clause per class, routed on the COUNTS (state-agnostic), not on the state label.
@@ -263,11 +265,24 @@ const joinAnd = (parts) => (parts.length <= 1 ? parts.join("") : `${parts.slice(
 // EU US CH WO doesn't make sense". A worldwide-scoped plan (scope_basis, or a worldwide token riding
 // an instructed list) collapses the tail to the one word; only a genuinely named list is listed.
 const WORLDWIDE_TOKEN_RE = /^(worldwide|world|ww|global)$/i;
-function jurisdictionTail({ searched_jurisdictions = [], scope_basis = null, instructedScope = null } = {}) {
+
+// WORLDWIDE NAMES THE SERVICE THAT SEARCHED IT (owner, 2026-09-18). "Worldwide" is eleven registers on one
+// installation and 186 on another, and a reader can only tell which by being told the service. The name is
+// the provider's own label from its capabilities contract — the same name the order form shows — read off
+// the provider the frozen plan records. A plan that records none, or one this build does not know, keeps
+// the bare word: a guessed name would be worse than none. Never a list of offices, never a count.
+function registerServiceOf(plan) {
+  if (!plan?.provider) return null;
+  try { return capabilitiesFor(plan.provider).label ?? null; } catch { return null; }
+}
+
+function jurisdictionTail({ searched_jurisdictions = [], scope_basis = null, instructedScope = null, register_service = null } = {}) {
   const list = (searched_jurisdictions.length
     ? searched_jurisdictions
     : (Array.isArray(instructedScope?.jurisdictions) ? instructedScope.jurisdictions : [])).map((j) => String(j).trim()).filter((j) => j);
-  if (scope_basis === "worldwide" || list.some((j) => WORLDWIDE_TOKEN_RE.test(j))) return " · registers: worldwide";
+  if (scope_basis === "worldwide" || list.some((j) => WORLDWIDE_TOKEN_RE.test(j))) {
+    return ` · registers: worldwide${register_service ? ` (${register_service})` : ""}`;
+  }
   if (!list.length) return "";
   // 2–3-letter office codes display uppercase ("us" reads as a pronoun, "US" as a jurisdiction);
   // longer names pass through untouched.

package/driver/scope-ledger.mjs

@@ -1,12 +1,12 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
-// scope-ledger.mjs — the machine mirror of the prelim-variants `### Scope ledger` (the frame-omission
+// scope-ledger.mjs — the machine mirror of the clearance-variants `### Scope ledger` (the frame-omission
 // design: the blind-pass framing fix, approved into this file — the code is its own record).
 //
-// prelim-variants emits a prose `### Scope ledger` table — one row per variant / field / source the
+// clearance-variants emits a prose `### Scope ledger` table — one row per variant / field / source the
 // run CONSIDERED and DROPPED (or applied), each carrying the observation that should REOPEN it. The
 // driver CODE-DERIVES scope-ledger.json from that prose (renderScopeLedgerJson, called after
-// prelim-variants validates) so the JSON is authored by the driver, never the model, and matches the
+// clearance-variants validates) so the JSON is authored by the driver, never the model, and matches the
 // prose BY CONSTRUCTION — exactly the coverage-ledger.mjs pattern. The blind frame-diff reads the
 // dropped set + reopen triggers to decide which omissions to escalate.
 //
@@ -115,7 +115,7 @@ export function parseScopeLedgerJson(raw) {
 
 /**
  * CODE-DERIVE the JSON scope ledger FROM the prose `### Scope ledger` table (the driver calls this after
- * prelim-variants validates; never-killed at the call site). PURE. Throws `scope_ledger_unparseable`
+ * clearance-variants validates; never-killed at the call site). PURE. Throws `scope_ledger_unparseable`
  * when the prose carries a Scope ledger heading but yields no classifiable row, so the caller's catch
  * routes to the manifest-prose-fallback path (the run still delivers). Returns a JSON ARRAY string that
  * round-trips through parseScopeLedgerJson.
@@ -136,7 +136,7 @@ export function renderScopeLedgerJson(md) {
  * MARKDOWN TABLE back out of a prose manifest a model had typed, on fixed column positions. A machine
  * artifact the downstream depends on, recovered from a table.
  *
- * `record_prelim_variants` now receives those rows TYPED, so the driver can serialise them directly. Both
+ * `record_clearance_variants` now receives those rows TYPED, so the driver can serialise them directly. Both
  * paths call THIS function, which is what makes the recorded and the archived ledger byte-identical for
  * the same rows by construction rather than by an assertion someone has to maintain — and it is why the
  * prose parse can stay for archives (the anchor rule: a new way in, never a replacement) without becoming

package/driver/search-policy.mjs

@@ -15,10 +15,10 @@
 // ── THE DEPTH LADDER IS GONE ─────────────────────────────────────────────────────────────────────────────────
 //
 // There used to be a second vocabulary here: a closed set of LEVELS (`knockout`, `knockout-register`,
-// `prelim`, `prelim-jx`) with a display face reading "Depth 1"…"Depth 5", ordered by effort. A client
+// `clearance`, `clearance-jx`) with a display face reading "Depth 1"…"Depth 5", ordered by effort. A client
 // bought a level; the thing they were sold — a knockout, a worldwide preliminary, a single-country deep
 // dive — was a different word that appeared on no wire. The two disagreed in the one place it mattered:
-// `prelim` named THREE products depending on where it pointed, and the composer's own footer had to
+// `clearance` named THREE products depending on where it pointed, and the composer's own footer had to
 // invent labels ("Deep dive — United States", "Full clearance") for distinctions "the registry has no
 // word for". The registry now has the word. The level menu, its numbering, its ordering and the
 // `searchLevel` wire field are DELETED — not deprecated, not hidden behind the product name.
@@ -61,7 +61,7 @@ export const ORDERABLE_PRODUCTS = PRODUCT_IDS;
 //
 // This is the reading that squares "no old mechanism survives its replacement" with an archive: the
 // delete rule governs the ORDERABLE path, and naming a run that already happened is not that path.
-export const RETIRED_PRODUCTS = ["knockout", "knockout-register", "prelim-register-only", "prelim", "prelim-jx"];
+export const RETIRED_PRODUCTS = ["knockout", "knockout-register", "clearance-register-only", "clearance", "clearance-jx"];
 
 /** Saved searches dropped by the last `loadRecipes` because their base is a retired product. Rewritten on
  *  every load, so it describes the CURRENT store and never accumulates. Read it to tell a reader why a
@@ -304,9 +304,9 @@ export const RETIRED_POLICIES = {
   // Retired 2026-08-06: the clearance shape with its unregistered-use half removed. That basis
   // still composes into riskStatement, and the workbook's own gate still inverts on it, because an
   // archived run of it must not re-render claiming a sweep that never ran.
-  "prelim-register-only": { product: "prelim-register-only", stageLabel: "Depth 3", pipeline: "clearance", report: { template: "clearance", identity: "Preliminary clearance — register only" },                       components: { registerProbe: false, jxLanes: false, commonLawGrid: false } },
-  "prelim":               { product: "prelim",               stageLabel: "Depth 4", pipeline: "clearance", report: { template: "clearance", identity: "Preliminary clearance" },                                       components: { registerProbe: false, jxLanes: false, commonLawGrid: true } },
-  "prelim-jx":            { product: "prelim-jx",            stageLabel: "Depth 5", pipeline: "clearance", report: { template: "clearance", identity: "Preliminary clearance with jurisdiction deep-dive" },           components: { registerProbe: false, jxLanes: true,  commonLawGrid: true } },
+  "clearance-register-only": { product: "clearance-register-only", stageLabel: "Depth 3", pipeline: "clearance", report: { template: "clearance", identity: "Preliminary clearance — register only" },                       components: { registerProbe: false, jxLanes: false, commonLawGrid: false } },
+  "clearance":               { product: "clearance",               stageLabel: "Depth 4", pipeline: "clearance", report: { template: "clearance", identity: "Preliminary clearance" },                                       components: { registerProbe: false, jxLanes: false, commonLawGrid: true } },
+  "clearance-jx":            { product: "clearance-jx",            stageLabel: "Depth 5", pipeline: "clearance", report: { template: "clearance", identity: "Preliminary clearance with jurisdiction deep-dive" },           components: { registerProbe: false, jxLanes: true,  commonLawGrid: true } },
 };
 
 /** The report identity to print on a run's document: `{ template, identity, stageLabel, banner }`.
@@ -464,13 +464,23 @@ export function isRegisterOnly(policy) {
  *  search asked for. Asking it "does this exist" is asking the wrong question — the orderability test is
  *  always `ORDERABLE_PRODUCTS.includes(...)`, and a typo must fail closed against that positive list. */
 export function policyFor(product) {
-  const k = String(product ?? "").trim().toLowerCase();
+  const k = productKeyAsRenamed(product);
   return PRODUCT_POLICIES[k] ?? RETIRED_POLICIES[k] ?? null;
 }
+// THREE RETIRED KEYS WERE RENAMED WITH THE IDENTIFIER, and records written before it still carry the old
+// spelling: an archived run's product, a saved search's base in a client's store. Read the old key as the
+// new wherever a key is looked up, or an archived report loses its name and a store's saved searches fail
+// to load over a base this build still knows as retired.
+const PRE_RENAME_PRODUCT_KEYS = Object.freeze({ "prelim": "clearance", "prelim-register-only": "clearance-register-only", "prelim-jx": "clearance-jx" });
+/** A product key, lower-cased, with a pre-rename spelling read as its current one. PURE. */
+export function productKeyAsRenamed(product) {
+  const k = String(product ?? "").trim().toLowerCase();
+  return PRE_RENAME_PRODUCT_KEYS[k] ?? k;
+}
 
 // What THIS build can actually execute. A resolution onto machinery a build does not carry must CLARIFY
 // at admission (never silently run the wrong-priced product — a knockout request running as a $40
-// prelim, or a 1.5 request running as a plain Stage 1, is the exact silent-substitution this file exists
+// clearance, or a 1.5 request running as a plain Stage 1, is the exact silent-substitution this file exists
 // to forbid). These flags are flipped in CODE as each lane lands, never from the environment: there are
 // no runtime env kill switches — see the note below.
 // EXPORTED because availability is now asked about in two places, not one. The runner asks "may this
@@ -498,7 +508,7 @@ export const BUILT = { knockout: true, jxLanes: true, registerProbe: true };
 // They were not merely dead, they were actively harmful, and in exactly the way the old comment here
 // predicted: a caller outside the engine's environment reads every switch as unset, and unset was
 // indistinguishable from off. The portal was given a snapshot to work around it. The ops-MCP was not,
-// so `describe_options` and `plan_run` told clients that knockout, knockout-register and prelim-jx were
+// so `describe_options` and `plan_run` told clients that knockout, knockout-register and clearance-jx were
 // "Not switched on for this account yet" while the engine would have run all three (2026-07-27). That is
 // the second time this service has lied for want of an environment variable — the first was the profiles
 // dir answering with a demo roster. Deleting the switch is the fix that cannot recur; plumbing a
@@ -830,7 +840,7 @@ export const CAPABILITY_SKIPPED_CAUSE = {
  * now honoured wherever it resolves, and built machinery is never "off".
  *
  * The RESOLVED policy is measured, never `policyFor(resolved.level)`: a recipe can turn jxLanes on over a
- * base of `prelim`, and the base registry entry would answer "available" for a resolution that is not.
+ * base of `clearance`, and the base registry entry would answer "available" for a resolution that is not.
  * Delegating the built arms to productAvailability is what makes the null-equivalence with
  * gateResolvedPolicy structural rather than a coincidence two edits can break (search-policy.test.mjs
  * pins it over the whole matrix).
@@ -1115,7 +1125,7 @@ export function loadRecipes({ dir = process.env.CLEAROTRON_RECIPES_DIR || null,
       // NOT SILENT, because unlike a retired extra this one is observable: a saved search disappears. The
       // skip is recorded so a caller can say why rather than leaving a lawyer's saved search gone with no
       // reason. Everything else still throws — a config error is still load-blocking.
-      if (RETIRED_PRODUCTS.includes(String(r?.base ?? "").trim().toLowerCase())) {
+      if (RETIRED_PRODUCTS.includes(productKeyAsRenamed(r?.base))) {
         retiredBaseSkips.push({ customer, slug, base: String(r.base), why: "base names a retired search — the saved search cannot be ordered" });
         continue;
       }
@@ -1216,7 +1226,7 @@ export function checkMarkBudget(job, policy) {
 // THE SCOPE ITSELF.
 //
 // THAT LAST RUNG IS THE OFFERING, AND IT IS NOT A CONSTANT. The Generic default used to be the literal
-// level `prelim`, which named three different products depending on where it pointed. A clearance that
+// level `clearance`, which named three different products depending on where it pointed. A clearance that
 // names no product IS whichever product its territories make it — `productFor(pipeline, scope)`, the one
 // function that answers that question anywhere — so the default is derived, not picked. The caller hands
 // in the RESOLVED scope (`territories`) because resolving it needs the profile and the project overlay,

package/driver/skills/README.md

@@ -2,7 +2,7 @@
 
 **Every file here is prompt payload served to the model at runtime.** A stage is one engine turn told to read named
 files and follow them exactly, so an edit for brevity or tone changes what a clearance concludes —
-`prelim-search/synthesis-rules.md` is 1,025 lines of program. Never touch this tree in a documentation or tidy-up
+`clearance-search/synthesis-rules.md` is 1,025 lines of program. Never touch this tree in a documentation or tidy-up
 task, and never let a mass edit reach it — the [ADR-0005](../../docs/decisions/0005-comments-carry-reasoning.md)
 comment sweep is required to exclude this tree, and that script does not exist yet, so nothing enforces it but you.
 
@@ -20,21 +20,21 @@ One directory per skill. `SKILL.md` is the entry point — YAML frontmatter (`na
 procedure. Every other file beside it is a reference the SKILL.md or the stage message names explicitly, with six
 exceptions: the four `risk-framework*.manifest.json` sidecars, whose paths the code DERIVES from the deck
 (`manifestPathFor()`, `../framework.mjs`) so validators and the renderer read band vocabulary without parsing prose;
-`prelim-search/risk-framework-triage.md`, the knockout lane's default ladder, named in code only
+`clearance-search/risk-framework-triage.md`, the knockout lane's default ladder, named in code only
 (`../pipeline-knockout.mjs`) because the knockout stage message hands the seat the frozen `_driver/framework.json`
-instead; and `prelim-search/templates/search-request-form.html`, named only in `../publish/index.mjs`.
+instead; and `clearance-search/templates/search-request-form.html`, named only in `../publish/index.mjs`.
 
 | Skill | What the stage does |
 |---|---|
 | `matter-frame` | Phase 0. Writes the matter's commercial context — sector, customer base, channels of trade, jurisdictions that materially matter, off-field sectors, watchlist seeds — before any search runs. `watchlist-reference.md` is enrichment, not authority. |
-| `prelim-variants` | Classifies the mark into one of six archetypes, derives a risk theory from that, emits the variant manifest both execution skills read. Non-Latin scripts: `transliteration-scripts.md`. |
+| `clearance-variants` | Classifies the mark into one of six archetypes, derives a risk theory from that, emits the variant manifest both execution skills read. Non-Latin scripts: `transliteration-scripts.md`. |
 | `blind-frame`, `frame-diff` | Re-derives the threat model from the raw instruction alone, deliberately starved of the matter frame, then diffs that model against what the run actually scoped and emits reopen directives the driver acts on. Something has to test the frame instead of reasoning inside it. |
-| `prelim-common-law` | The marketplace / web / social sweep, as structured Perplexity research over the platform list the stage dictates. Prompt templates: `perplexity-prompts.md`. |
-| `prelim-register` | Register execution in the two modes a spawn selects: `unit.md` (the funnel — enumerate one axis to completion, decide nothing) and `digest.md` (judgment over the merged band). Plus `register-recipes.md`, `status-rules.md`, `stealth-filer-indicators.md`, `providers/`. |
+| `clearance-common-law` | The marketplace / web / social sweep, as structured Perplexity research over the platform list the stage dictates. Prompt templates: `perplexity-prompts.md`. |
+| `clearance-register` | Register execution in the two modes a spawn selects: `unit.md` (the funnel — enumerate one axis to completion, decide nothing) and `digest.md` (judgment over the merged band). Plus `register-recipes.md`, `status-rules.md`, `stealth-filer-indicators.md`, `providers/`. |
 | `placement-inquiry` | Applies commercial relevance per candidate — headline-candidate / sheet-2 / watchlist-annex / out-of-scope-filtered — before any tiering runs. |
 | `case-law-citation` | Grounds risk-relevant findings in precedent fetched in-session, never from memory. One thin adapter per source in `sources/`; `evals.md` defines what working means. |
 | `narrative-refutation` | Reads the finished narrative against the underlying findings files and returns CLEAR / CONDITIONAL / BLOCKING with itemised flags. Delivery is gated on the verdict. |
-| `prelim-search` | The doctrine the synthesis and delivery stages are held to: `synthesis-rules.md`, the `risk-framework*.md` ladders with their `.manifest.json` band vocabularies, `delivery-contract.md`, `report-prose.md`, `worked-examples.md`, `phase2-execution.md`, `field-doctrine-pharma.md`. |
+| `clearance-search` | The doctrine the synthesis and delivery stages are held to: `synthesis-rules.md`, the `risk-framework*.md` ladders with their `.manifest.json` band vocabularies, `delivery-contract.md`, `report-prose.md`, `worked-examples.md`, `phase2-execution.md`, `field-doctrine-pharma.md`. |
 | `knockout-frame`, `knockout-assess` | Stages A and C of the knockout doctrine — a broad kill/no-kill triage screen over several candidate names at once (Stage B is a code-side research sweep). Not a clearance. |
 
 ## What reads it
@@ -53,25 +53,25 @@ instead; and `prelim-search/templates/search-request-form.html`, named only in `
 
 ## The provider boundary
 
-Operator syntax and vendor tool tokens like `corsearch_*` live only in `prelim-register/providers/`; the spine names
+Operator syntax and vendor tool tokens like `corsearch_*` live only in `clearance-register/providers/`; the spine names
 the `register_*` tools, whichever vendor `CLEAROTRON_DATABASE` selects.
 `../test/provider-neutral-prose.test.mjs` holds three of that boundary's lines: no vendor-prefixed tool token
 outside `providers/` and the `engine/mcp/<provider>-server.mjs` glue; no provider record host in a provider-agnostic
 skill file (banned hosts are read FROM the provider docs, so a sixth provider is covered the day its doc lands);
 every register server registering only `register_*`, under the MCP name `register`. Field paths are the open edge —
 the matcher requires `<vendor>_` and cannot see camelCase, so no test fails on one, and
-`prelim-register/status-rules.md` still instructs off Corsearch's own field names (`corsearchStatusCode`,
+`clearance-register/status-rules.md` still instructs off Corsearch's own field names (`corsearchStatusCode`,
 `onomaticsJurisdictionsStatuses`, the `owners[0].*` owner chain), plus one line of `register-recipes.md` off
-`onomaticsOppositions[]`. `prelim-register/SKILL.md`, `unit.md`, `digest.md` and everything under `prelim-search/`
+`onomaticsOppositions[]`. `clearance-register/SKILL.md`, `unit.md`, `digest.md` and everything under `clearance-search/`
 are clean. The authoring rules and the empirical-verification checklist a new provider doc must pass sit in
-`prelim-register/providers/README.md`.
+`clearance-register/providers/README.md`.
 
 ## Where to start
 
-`prelim-search/SKILL.md` — the orchestrator's own skill, and the one file describing the whole workflow end to end.
-Then `prelim-register/SKILL.md`, the more elaborated of the two execution skills: a spine plus per-mode files
-(`unit.md`, `digest.md`) and per-provider files (`providers/`). The other, `prelim-common-law`, is one spine plus
+`clearance-search/SKILL.md` — the orchestrator's own skill, and the one file describing the whole workflow end to end.
+Then `clearance-register/SKILL.md`, the more elaborated of the two execution skills: a spine plus per-mode files
+(`unit.md`, `digest.md`) and per-provider files (`providers/`). The other, `clearance-common-law`, is one spine plus
 `perplexity-prompts.md`, its two grid modes (deterministic `grid_spec_path` dispatch vs. the legacy authored
 program) being sections inside it — the per-mode split and `providers/` are register-only, not a shape every
-execution skill shares. `prelim-search/phase2-execution.md` is methodology, not sequencing — the pipeline is
+execution skill shares. `clearance-search/phase2-execution.md` is methodology, not sequencing — the pipeline is
 sequenced in code, in `../stages.mjs` and `../pipeline.mjs`.

package/driver/skills/blind-frame/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: blind-frame
-description: The frame-STARVED independent re-derivation for the v3 preliminary trademark search workflow. **Invoked exclusively by the `prelim-search` orchestrator/driver**, in parallel with the gather sweeps — do not call directly. Reads ONLY the raw instruction (mark, goods, classes, territories, manner of use) and NOT the matter frame, then re-derives the threat model cold across four layers — element + neighbours both directions, field by goods-overlap, sources by real channel, ranking by goods-overlap — and emits a structured model the frame-diff stage diffs against what the run actually scoped. Its job is to test the frame, not to reason inside it.
+description: The frame-STARVED independent re-derivation for the v3 preliminary trademark search workflow. **Invoked exclusively by the `clearance-search` orchestrator/driver**, in parallel with the gather sweeps — do not call directly. Reads ONLY the raw instruction (mark, goods, classes, territories, manner of use) and NOT the matter frame, then re-derives the threat model cold across four layers — element + neighbours both directions, field by goods-overlap, sources by real channel, ranking by goods-overlap — and emits a structured model the frame-diff stage diffs against what the run actually scoped. Its job is to test the frame, not to reason inside it.
 ---
 
 ## Purpose
 
-Every other stage in a clearotron run reasons *inside* a frame that was set early (at `matter-frame` / `prelim-variants`): the variants to chase, the field that counts as on-field, the sources worth searching. Verification then runs *on* that frame — nothing tests the frame itself. When the frame is mis-scoped, the whole run inherits the miss and the skeptic, reasoning from the same frame, certifies it.
+Every other stage in a clearotron run reasons *inside* a frame that was set early (at `matter-frame` / `clearance-variants`): the variants to chase, the field that counts as on-field, the sources worth searching. Verification then runs *on* that frame — nothing tests the frame itself. When the frame is mis-scoped, the whole run inherits the miss and the skeptic, reasoning from the same frame, certifies it.
 
 You are the antidote. You are **deliberately starved of the frame**: you receive only the raw instruction, exactly as the requester wrote it, and you re-derive the threat model **cold**. Because you never see the run's conclusions, you cannot anchor to them. Your output is later **diffed** against what the run actually scoped — the gaps in that diff are the omissions the frame missed.
 

package/driver/skills/case-law-citation/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: case-law-citation
-description: Grounds risk-relevant trademark findings in cited case law and decisions instead of asserting them. Invoked by the prelim-search orchestrator at Step 4.5 to profile an aggressive enforcer or test a likelihood-of-confusion question against precedent, and usable inline in chat for ad-hoc conflict/enforcement questions. Queries live legal sources — CourtListener (US federal incl. CAFC), EUR-Lex (EU CJEU + General Court judgments, verbatim), and Legal Data Hunter (108-country statutes and case law) — and returns, per finding, on-point authorities (case or decision, forum, date, one-line holding, stable identifier) with relevance notes, or an explicit no-precedent result. Cites only from documents fetched in the session, never from memory. Use when grounding watchlist or aggressive-enforcer hits, or when a trademark conflict, confusability, or enforcement-history question needs precedent.
+description: Grounds risk-relevant trademark findings in cited case law and decisions instead of asserting them. Invoked by the clearance-search orchestrator at Step 4.5 to profile an aggressive enforcer or test a likelihood-of-confusion question against precedent, and usable inline in chat for ad-hoc conflict/enforcement questions. Queries live legal sources — CourtListener (US federal incl. CAFC), EUR-Lex (EU CJEU + General Court judgments, verbatim), and Legal Data Hunter (108-country statutes and case law) — and returns, per finding, on-point authorities (case or decision, forum, date, one-line holding, stable identifier) with relevance notes, or an explicit no-precedent result. Cites only from documents fetched in the session, never from memory. Use when grounding watchlist or aggressive-enforcer hits, or when a trademark conflict, confusability, or enforcement-history question needs precedent.
 ---
 
 # Case-law citation
@@ -40,17 +40,17 @@ Companion files (one level deep — read the one you need):
 
 Still-future adapter (drops in here with no change to this file): `sources/euipo.md` (EUIPO
 Boards-of-Appeal decisions — no free API today). EUIPO *register* lookups are a different layer
-(`prelim-register`), not this skill.
+(`clearance-register`), not this skill.
 
 ## Trigger
 
-Called by `prelim-search` after synthesis flags the risk-relevant findings (Step 4.5). Also triggers in
+Called by `clearance-search` after synthesis flags the risk-relevant findings (Step 4.5). Also triggers in
 chat when the user raises a trademark conflict, likelihood-of-confusion, or enforcement-history question.
 Gated and optional: if this skill is absent, clearotron skips Step 4.5 and delivers normally.
 
 ## Model
 
-**Sonnet, eval-gated** when spawned from the `prelim-search` Step 4.5 seam. The work is extraction
+**Sonnet, eval-gated** when spawned from the `clearance-search` Step 4.5 seam. The work is extraction
 from documents fetched **this session** — the fetch-before-cite discipline (cite only what you
 fetched; read the holding from the fetched text; refuse to invent when sources are empty), not model
 recall, is what keeps citations honest. That makes it a Sonnet-tier task **provided** Sonnet reliably

package/driver/skills/case-law-citation/sources/eurlex.md

@@ -65,7 +65,7 @@ successfully fetch and verify.
   would close this gap; none is wired today.)
 - **Not** the EUIPO administrative layer: **EUIPO Boards-of-Appeal decisions** have no free API and are
   not searched — report that as a coverage gap. EUIPO *register* lookups are a different layer
-  (`prelim-register`), not this skill.
+  (`clearance-register`), not this skill.
 
 ## Citing convention
 

package/driver/skills/{prelim-common-law → clearance-common-law}/SKILL.md

@@ -1,17 +1,17 @@
 ---
-name: prelim-common-law
-description: Common-law / marketplace execution for the v3 preliminary trademark search workflow. **Invoked exclusively by the `prelim-search` orchestrator** — do not call directly. Reads the variant manifest produced by `prelim-variants` and runs structured Perplexity research across the DICTATED platform list (the task message's PLATFORMS block names the exact store domains for this customer; the gaming default is 6 stores) plus general web, social, e-commerce, and industry press. Produces a common-law findings file consumed by the orchestrator for synthesis and Excel assembly. Runs alongside `prelim-register`.
+name: clearance-common-law
+description: Common-law / marketplace execution for the v3 preliminary trademark search workflow. **Invoked exclusively by the `clearance-search` orchestrator** — do not call directly. Reads the variant manifest produced by `clearance-variants` and runs structured Perplexity research across the DICTATED platform list (the task message's PLATFORMS block names the exact store domains for this customer; the gaming default is 6 stores) plus general web, social, e-commerce, and industry press. Produces a common-law findings file consumed by the orchestrator for synthesis and Excel assembly. Runs alongside `clearance-register`.
 ---
 
 ## Spawned session
 
-Invoked from `prelim-search` (orchestrator) alongside `prelim-register`. Reads:
-- The variant manifest at `studio/prelim-search/<slug>/<date>/variant-manifest.md` (produced by `prelim-variants`)
+Invoked from `clearance-search` (orchestrator) alongside `clearance-register`. Reads:
+- The variant manifest at `studio/clearance-search/<slug>/<date>/variant-manifest.md` (produced by `clearance-variants`)
 - The request context (classes, jurisdiction scope, industry, manner of use)
 
 Writes:
-- A common-law findings file at `studio/prelim-search/<slug>/<date>/common-law-findings.md`
-- **The machine grid ledger** at `studio/prelim-search/<slug>/<date>/common-law-grid.json` — the grid
+- A common-law findings file at `studio/clearance-search/<slug>/<date>/common-law-findings.md`
+- **The machine grid ledger** at `studio/clearance-search/<slug>/<date>/common-law-grid.json` — the grid
   call's stdout JSON saved **verbatim** (a single stdout object, or a JSON array of the per-batch
   stdout objects in batch order when the grid is batched). Copy it exactly as the tool returned it —
   no reformatting, no re-typing, no judging. **The driver validates grid completeness from this file**
@@ -29,7 +29,7 @@ Companion files:
 
 ## Trigger
 
-Called by `prelim-search` after `prelim-variants` has produced the manifest. Runs alongside `prelim-register` against the same manifest. Not invoked directly by operators.
+Called by `clearance-search` after `clearance-variants` has produced the manifest. Runs alongside `clearance-register` against the same manifest. Not invoked directly by operators.
 
 ## Model
 
@@ -37,8 +37,8 @@ The model tier is set **by the deterministic driver** — `driver/stages.mjs` is
 source of truth (currently Haiku, low thinking). This worker is extraction, not open analysis: it
 fills templated Perplexity prompts from the manifest and transcribes what Perplexity returns into
 the fixed finding taxonomy. The creative variant/strategy work is already done upstream by
-`prelim-variants` (Opus), and the cross-cutting risk synthesis is the orchestrator's (Opus). If the
-orchestrator's skeptic review (prelim-search Step 2.6) finds this worker shortcut the manifest's
+`clearance-variants` (Opus), and the cross-cutting risk synthesis is the orchestrator's (Opus). If the
+orchestrator's skeptic review (clearance-search Step 2.6) finds this worker shortcut the manifest's
 coverage, it is re-spawned escalated to Opus.
 
 ## Tool call budget
@@ -61,7 +61,7 @@ the artifacts this stage writes, so there is nothing here to call and nothing to
 
 ## Search approval (HITL exception)
 
-The full HITL exception covering this workflow is declared **once** in the orchestrator at [prelim-search/SKILL.md](../prelim-search/SKILL.md#hitl-exception-shared-across-sub-skills). It is pre-approved at workflow trigger time when the requesting lawyer or a staff lawyer forwards the request email.
+The full HITL exception covering this workflow is declared **once** in the orchestrator at [clearance-search/SKILL.md](../clearance-search/SKILL.md#hitl-exception-shared-across-sub-skills). It is pre-approved at workflow trigger time when the requesting lawyer or a staff lawyer forwards the request email.
 
 Operative rules for this sub-skill (Perplexity-side):
 - **Include in queries:** mark name, product type, relevant industry context
@@ -105,14 +105,14 @@ so there is **no partial-delivery fallback**:
 
 ### Out of scope (register-layer concerns)
 
-- USPTO / WIPO / national trademark office database searches — handled by `prelim-register`
+- USPTO / WIPO / national trademark office database searches — handled by `clearance-register`
 - Class-specific register queries
 - Register statistics and filing volumes
 - Stealth-filing pattern analysis
 - Formal enforcement history analysis (organic mentions OK; targeted register-based enforcement search NOT)
 - Prior-art register-based analysis
 
-**Bleed rule:** if register information surfaces organically during a common-law search (e.g., a news article mentions a filing), note it briefly and flag it in the findings file's `Cross-checks suggested` section. Do not pursue it — the orchestrator hands such flags to `prelim-register` for cross-pollination.
+**Bleed rule:** if register information surfaces organically during a common-law search (e.g., a news article mentions a filing), note it briefly and flag it in the findings file's `Cross-checks suggested` section. Do not pursue it — the orchestrator hands such flags to `clearance-register` for cross-pollination.
 
 ## Output — common-law findings file
 
@@ -165,14 +165,14 @@ For game-title rows, the `developer_of_record` and `publisher_of_record` columns
 
 | Finding | Source / Platform | URL | Notes |
 |---|---|---|---|
-| "Raising Your Play" | HP marketing | https://... | HP uses tagline for gaming hardware; no register protection found (flagged for prelim-register cross-check) |
+| "Raising Your Play" | HP marketing | https://... | HP uses tagline for gaming hardware; no register protection found (flagged for clearance-register cross-check) |
 | 1,600+ "Dawn" titles on Steam | Steam | https://... | Crowded field — supportive evidence |
 
 ### Competitor intelligence
 
 | Finding | Source / Platform | URL | Notes |
 |---|---|---|---|
-| Sony "Pulse Elevate" portfolio | Sony products | https://... | Sony uses "Elevate" in audio products; flagged for prelim-register cross-check |
+| Sony "Pulse Elevate" portfolio | Sony products | https://... | Sony uses "Elevate" in audio products; flagged for clearance-register cross-check |
 | Foxglade "Borealis" console "Raise Your Play" tagline (prior usage) | Foxglade Interactive marketing | https://... | Client's own prior use — note as supportive |
 
 ### PR / reputational risk
@@ -356,7 +356,7 @@ forms (and the gap form) — this is what the driver's receipt gate counts:
 ### Coverage ledger (feeds synthesis coverage-honesty + skeptic audit)
 <!-- clearotron:section=coverage-ledger -->
 
-One row per planned coverage unit (each mandatory platform; the field-scoped general search; non-Latin / transliteration platform reach), with status + one-line reason. Same three statuses as the register side (see `prelim-register/SKILL.md` → *Coverage ledger*): `confirmed-clean` (ran to completion), `coverage-limited` (the search **ran and reached the platform** but could not be exhausted — thin data, non-Latin reach), `deferred` (planned but **not run, or the platform/tool could not be reached**). Per the keystone doctrine: a could-not-reach gap (a platform/tool that was unavailable) is `deferred`, never `coverage-limited` — the latter is a searched-but-unexhausted DATA limit. This is the structured form of the Open-verification-flags prose — a `coverage-limited` row is **not** a clean negative downstream.
+One row per planned coverage unit (each mandatory platform; the field-scoped general search; non-Latin / transliteration platform reach), with status + one-line reason. Same three statuses as the register side (see `clearance-register/SKILL.md` → *Coverage ledger*): `confirmed-clean` (ran to completion), `coverage-limited` (the search **ran and reached the platform** but could not be exhausted — thin data, non-Latin reach), `deferred` (planned but **not run, or the platform/tool could not be reached**). Per the keystone doctrine: a could-not-reach gap (a platform/tool that was unavailable) is `deferred`, never `coverage-limited` — the latter is a searched-but-unexhausted DATA limit. This is the structured form of the Open-verification-flags prose — a `coverage-limited` row is **not** a clean negative downstream.
 
 | Coverage unit | Status | Reason |
 |---|---|---|
@@ -364,7 +364,7 @@ One row per planned coverage unit (each mandatory platform; the field-scoped gen
 | field-scoped general search (collab / non-gaming goods) | confirmed-clean | run per matter scope |
 | non-Latin platform reach (translit variants) | coverage-limited | marketplace data thin for non-Latin scripts; absence not confirmed clean |
 
-### Cross-checks suggested (handed to orchestrator for prelim-register dispatch)
+### Cross-checks suggested (handed to orchestrator for clearance-register dispatch)
 
 | Trigger | Suggested cross-check |
 |---|---|
@@ -400,7 +400,7 @@ Four steps per mark.
 
 ### Step 1 — Read variant manifest
 
-Open `studio/prelim-search/<slug>/<date>/variant-manifest.md`. Parse:
+Open `studio/clearance-search/<slug>/<date>/variant-manifest.md`. Parse:
 - Request context: marks, classes, jurisdiction, industry, manner of use
 - Per-mark variant tables — these become the search terms in the Perplexity prompt
 - Watchlists — used for competitor intelligence framing
@@ -446,10 +446,10 @@ filling in:
 
 The tool returns the program's stdout JSON (`cells` + `extras` + `gaps`) and the program code as an
 audit receipt. **Trademark-register lookups stay out of scope** — the grid only searches
-marketplaces/web (the register layer is `prelim-register`'s).
+marketplaces/web (the register layer is `clearance-register`'s).
 
 **LEGACY path only (no `grid_spec_path` given) — immediately after the grid call(s): save the stdout
-JSON verbatim** to `studio/prelim-search/<slug>/<date>/common-law-grid.json` — one call → the stdout
+JSON verbatim** to `studio/clearance-search/<slug>/<date>/common-law-grid.json` — one call → the stdout
 object as-is; batched calls → a JSON array of the per-batch stdout objects, in batch order. This is a
 copy operation, not a writing task: the bytes the tool returned, unmodified. The deterministic driver
 validates the grid by exact join on this file (machine receipts) — the markdown Negative results
@@ -486,7 +486,7 @@ common word) does not. Then categorise each finding into one of:
 - **Competitor intelligence** — watchlist matches; existing partnerships major brands have in the space
 - **PR / reputational risk** — the meaning read of the mark AND its near-forms, scoped by the run's OWN dictated sweep: the fixed meaning / slang / gang / offensive / lookup shapes plus the matter frame's derived `Meaning angles:` queries (cultural origin/appropriation, charged history of the term or its imagery, category-specific controversy — as THIS matter's frame reasoned them). Never a generic sensitivities checklist — the scope IS the dictated sweep. NOT scored on legal-risk framework — separate category. **Every recorded query with results carries a ruling recorded through `record_dispositions`, whatever this section concludes** — reporting a loaded reading does not discharge the rest of the sweep (see the PR / reputational risk contract above). `None identified` is additionally a clean *receipt* ONLY when the meaning sweep ran — cite a `Connotation-search source:` line; the driver rejects an unsearched clean claim (`connotation_search_missing`) and refuses the turn while any ruling is unrecorded (the `connotation_call_*` family). A dictionary gloss is never a clearance.
 - **Negative results** — **one row for EVERY variant × platform grid cell** (the full grid accounting the driver's receipt gate counts), **plus rows for the field-scoped cells** (collab / non-gaming goods) when run. **Each row carries its receipt:** `No results` (the search returned nothing), `No similar listings (N candidates reviewed)` (returned N candidates, none prima facie similar), `Similar listing(s) found — see Findings (N candidates)` (the cell produced findings), or `not executed — coverage-limited (see ledger)` (the cell is in the grid's `gaps` — never a clean negative).
-- **Cross-checks suggested** — register-side checks the orchestrator should dispatch to `prelim-register` (every common-law owner found → ONE register check)
+- **Cross-checks suggested** — register-side checks the orchestrator should dispatch to `clearance-register` (every common-law owner found → ONE register check)
 
 **100% URL coverage is mandatory.** Every finding row must have a clickable URL. If a finding cannot be verified with a URL, mark it as an Open verification flag and note the source.
 
@@ -514,7 +514,7 @@ This requirement applies even when the model running this skill is at the Haiku
 
 ### Step 6 — Compile common-law findings file
 
-Assemble `studio/prelim-search/<slug>/<date>/common-law-findings.md` per the format above. Sections (in order):
+Assemble `studio/clearance-search/<slug>/<date>/common-law-findings.md` per the format above. Sections (in order):
 
 1. **Summary** — call counts, platform coverage, finding counts
 2. **Consumer-confusion risks** — gaming-industry overlap
@@ -545,6 +545,6 @@ Assemble `studio/prelim-search/<slug>/<date>/common-law-findings.md` per the for
 - [ ] Coverage ledger emitted — one row per planned coverage unit; non-Latin / thin-data reach logged `coverage-limited`, not silently clean
 - [ ] Cross-checks suggested section populated
 - [ ] Open verification flags listed (URL-404s, thin coverage, transliteration confirmations)
-- [ ] Common-law findings file written to `studio/prelim-search/<slug>/<date>/common-law-findings.md`
+- [ ] Common-law findings file written to `studio/clearance-search/<slug>/<date>/common-law-findings.md`
 - [ ] Perplexity budget under workflow cap (15 calls)
 - [ ] No client identity, reference numbers, or contact names in any submitted Perplexity prompt

package/driver/skills/{prelim-common-law → clearance-common-law}/perplexity-prompts.md

@@ -1,6 +1,6 @@
 # Perplexity prompts
 
-Templates for the `perplexity_research` calls in `prelim-common-law`. Prompts are **prescriptive, not exploratory** — they tell Perplexity exactly what to search for, where, and how to report.
+Templates for the `perplexity_research` calls in `clearance-common-law`. Prompts are **prescriptive, not exploratory** — they tell Perplexity exactly what to search for, where, and how to report.
 
 ## Depth routing (mandatory)