clearotron 0.3.2-beta.8 → 0.3.2-beta.9

package/scripts/e2e.mjs

@@ -68,6 +68,10 @@ import { doorGates, resolveForDoor } from "../driver/door-gates.mjs";
 // — the plan-row term screen, shared with the driver rather than restated here, so the harness
 // can never drift from what the plan freeze and the executor enforce. PURE (no node imports).
 import { entryTermIssues } from "../providers/_shared/term-shape.mjs";
+// — the mechanical tier vocabulary, imported from the module that classifies into it rather than
+// restated here: a floor naming a tier that does not exist must fail loudly rather than compare against
+// a missing key, and the list must not drift if a tier is ever added. PURE (no node imports) too.
+import { SHAPE_TIERS } from "../driver/band-shape.mjs";
 // The owner's turnaround benchmarks. The BAND owns the number and a scenario file cannot carry
 // one — see the lint rule below. Another pure leaf with zero imports of its own, for the same reason
 // queue-markers.mjs is: nothing in this file may reach driver.config.mjs.
@@ -1256,6 +1260,70 @@ export function pathsAnOpDoesNotRead(scenarios) {
   return out;
 }
 
+/**
+ * The office a band-shape floor row belongs to, from the row's own fields and never from a wider table.
+ *
+ * TWO SOURCES, IN THE ORDER band-shape.mjs POPULATES THEM. `registry` is the projection's own field and
+ * it is derived, so it can read `unknown`; the record id carries the office as its second path segment.
+ * Measured on a preserved dense clearance run, 2026-09-18: 289 of 289 rows carried `registry`, and every
+ * one agreed with its id's segment. The fallback exists for the row that does not, and a row that
+ * answers neither way is counted separately by the caller rather than dropped.
+ */
+export const bandRowOffice = (r) => {
+  const reg = String(r?.registry ?? "").trim().toLowerCase();
+  if (reg && reg !== "unknown") return reg;
+  const m = String(r?.record_id ?? "").match(/^\/[^/]+\/([^/]+)\//);
+  return m ? m[1].toLowerCase() : "";
+};
+
+/**
+ * Open a clearance run's band shape for a floor op: the document, the mark check, and the two coverage
+ * qualifications — or ONE sentence saying why no floor under it can be read.
+ *
+ * THE MARK IS CHECKED AGAINST `targets`, NOT AGAINST `targets[0]`. The driver shapes a band for the mark
+ * under search PLUS its manifest variants, and it puts the job's own mark in that list unconditionally;
+ * the first entry is the variant lane's to order. Membership is therefore the property that holds while
+ * the variant lane moves, and it still catches the case this check is for — a shape derived for some
+ * other mark entirely. A mismatch says so in its own words rather than folding into a missed floor,
+ * because "the store's mark moved" and "the register thinned" need opposite answers.
+ */
+function bandShapeUnder(full, file, field) {
+  const bad = (saw) => ({ bad: saw });
+  if (!existsSync(full)) return bad(`${file} absent — the clearance lane derives this after every register band re-merge, so an absent `
+    + `shape is a derivation that did not happen or a lane that never merged a band. It is not a register that holds nothing.`);
+  const doc = readJson(full);
+  if (!doc) return bad(`${file} present but unparseable`);
+  const want = field ? String(field).trim().toLowerCase() : null;
+  if (!want) return bad("no mark given (path must be <file>:<MARK NAME>)");
+  const targets = Array.isArray(doc.targets) ? doc.targets.filter((t) => String(t ?? "").trim()) : [];
+  if (!targets.length) return bad(`${file} carries no targets — nothing in it says which mark the band was shaped for, so no floor under a mark can be read from it`);
+  if (!targets.some((t) => String(t).trim().toLowerCase() === want)) {
+    const shown = targets.slice(0, 6).map((t) => JSON.stringify(String(t))).join(", ");
+    return bad(`this shape was derived for targets that do not include ${JSON.stringify(field)} — it was shaped for ${shown}`
+      + `${targets.length > 6 ? `, and ${targets.length - 6} more` : ""}. The store's mark moved, or this run is another mark's; either way no floor here is about the mark the scenario named.`);
+  }
+  const spots = Array.isArray(doc.blind_spots) ? doc.blind_spots : [];
+  // The register would not answer: a refused slice, or one it would not state a total for. These make a
+  // shortfall genuinely ambiguous, so they qualify a pass and may be the reason for a miss.
+  const unread = spots.filter((b) => b?.kind === "refused-slice" || b?.kind === "uncountable-slice")
+    .map((b) => `${b.count ?? "?"} ${b.kind}`);
+  // The register DID answer, with a number larger than what was fetched. That is evidence of size, not a
+  // gap in it — see the block at the ops — so it is named with the depth read and excuses nothing.
+  const shallow = spots.filter((b) => b?.kind === "unenumerated-crowd")
+    .map((b) => `${b.count ?? "?"} ${b.kind}${Array.isArray(b.read_depth) && b.read_depth.length ? ` (read ${b.read_depth.join("/")} deep)` : ""}`);
+  const verdict = (ok, passBody, missBody) => {
+    const parts = [ok ? passBody : missBody];
+    if (unread.length) parts.push(ok
+      ? `floor met, but the register refused or would not total ${unread.join(", ")}, so this run covered less than it asked for`
+      : `and the register refused or would not total ${unread.join(", ")}, so the shortfall may be what it would not answer rather than what it holds`);
+    if (shallow.length) parts.push(ok
+      ? `${shallow.join(", ")} — the register stated more than the funnel fetched there`
+      : `and ${shallow.join(", ")} — the register stated more than the funnel fetched there, which is a finding about the read depth and NOT a reason to lower the floor`);
+    return { ok, saw: parts.join(" — ") };
+  };
+  return { doc, unread, shallow, verdict };
+}
+
 function evalAssertion(a, runDir) {
   const [file, field] = String(a.path ?? "").split(":");
   const full = join(runDir, file || "");
@@ -1637,6 +1705,112 @@ function evalAssertion(a, runDir) {
       saw: failed.length ? `${body}, and ${failed.length} term(s) FAILED to fetch, so the shortfall may be the fetch and not the register: ${failed.join(" · ")}`
         : `${body} — the register returned fewer rows than the hit path needs, so screening, hydration and citation ran on less than this scenario exists to give them` };
   }
+  // ── · THE SAME TWO QUESTIONS, ASKED OF THE CLEARANCE LANE'S OWN ARTIFACT ──────────────────────
+  //
+  // WHY A SECOND PAIR RATHER THAN A SECOND PATH ON THE PAIR ABOVE. `register-counts.json` and
+  // `register-records.json` are written by the KNOCKOUT lane and by nothing else. A clearance scenario
+  // asserting the floors above therefore gets `absent` on both, and the sentence those absences print —
+  // "a run whose register lane wrote nothing is not a run that found nothing" — is true of the file and
+  // false of the run: the clearance lane read the band and recorded it under other names. The record it
+  // keeps is `_driver/band-shape.json`, derived after every named-band re-merge, and it is a different
+  // shape entirely rather than the same shape in another place, so it needs its own two ops.
+  //
+  // THREE POPULATIONS, THREE DIFFERENT NUMBERS, AND CONFLATING THEM IS THE TRAP THIS PAIR SITS IN.
+  // Measured on a preserved dense clearance run, 2026-09-18, all three true of one band at one moment:
+  //
+  //   totals.records                        1554   every in-scope record the merged band holds
+  //   totals.by_tier.identical               245   tiered across the WHOLE band, class filter and all
+  //   floors.in_class_identical_or_near      289   identical AND near-identical, live, in-class only
+  //
+  // The band's own delivered depth record counted 2098, because it counts everything READ rather than
+  // what stayed in scope. A floor written against one of these and read against another drifts with
+  // nobody noticing, which is the failure the floors exist to catch happening to the floors themselves.
+  // So every number these ops print names its population in words, and neither op mixes two.
+  //
+  // BOTH KEEP THE TWO RULES THE PAIR ABOVE IS BUILT ON. A size that was never taken is never a small
+  // one: an absent shape, a shape with no `totals`, no `by_tier` or no floors array is reported as a
+  // derivation that did not happen, never as a band that holds nothing. And a slice the register refused
+  // or would not total is reduced coverage, named whichever way the floor goes.
+  //
+  // A CROWD THE FUNNEL COULD NOT ENUMERATE IS NOT THAT, AND MUST NEVER EXCUSE A SHORTFALL. Its
+  // `total_hits` is LARGER than what was fetched, which is the register stating that the band is at
+  // least that big — positive evidence of size, the opposite of a coverage gap. A dense band carries
+  // these by construction (19 of them on the run measured above), so letting them soften a miss would
+  // make every genuine thinning report as "the register may not have answered" for ever. They are named
+  // with the depth actually read, and they change no verdict.
+  if (a.op === "band-count-floor" || a.op === "band-records-floor") {
+    const shape = bandShapeUnder(full, file, field);
+    if (shape.bad) return { ok: false, saw: shape.bad };
+    const value = a.value && typeof a.value === "object" && !Array.isArray(a.value) ? a.value : null;
+
+    if (a.op === "band-count-floor") {
+      if (!value) return { ok: false, saw: "value must be an object of floors, e.g. {\"records\": 1000, \"by_tier\": {\"identical\": 120}}" };
+      const unknown = Object.keys(value).filter((k) => k !== "records" && k !== "by_tier");
+      if (unknown.length) return { ok: false, saw: `unknown floor key(s) ${unknown.map((k) => JSON.stringify(k)).join(", ")} — this op takes `
+        + `"records" (the whole in-scope band) and "by_tier" (one floor per mechanical tier). A key nothing reads is a floor nobody asserts.` };
+      const totals = shape.doc.totals && typeof shape.doc.totals === "object" ? shape.doc.totals : null;
+      if (!totals) return { ok: false, saw: `${file} carries no totals — the band was never sized, which is not a band whose size is zero` };
+
+      const saw = [], short = [], untaken = [];
+      if (Object.hasOwn(value, "records")) {
+        const want = value.records;
+        if (!Number.isFinite(want)) return { ok: false, saw: `"records" must be a number, not ${JSON.stringify(want)}` };
+        if (!Number.isFinite(totals.records)) untaken.push(`records: NOT TAKEN — totals.records is ${JSON.stringify(totals.records ?? null)}`);
+        else {
+          saw.push(`${totals.records} record(s) in the whole in-scope band (floor ${want})`);
+          if (!(totals.records >= want)) short.push(`the in-scope band is ${totals.records} record(s), below the floor of ${want}`);
+        }
+      }
+      if (Object.hasOwn(value, "by_tier")) {
+        const tiers = value.by_tier && typeof value.by_tier === "object" && !Array.isArray(value.by_tier) ? value.by_tier : null;
+        if (!tiers) return { ok: false, saw: "\"by_tier\" must be an object of tier floors, e.g. {\"identical\": 120}" };
+        const byTier = totals.by_tier && typeof totals.by_tier === "object" ? totals.by_tier : null;
+        if (!byTier) return { ok: false, saw: `${file} carries no totals.by_tier — the band was never tiered, which is not a band holding no identical marks` };
+        for (const [tier, want] of Object.entries(tiers)) {
+          if (!SHAPE_TIERS.includes(tier)) { untaken.push(`${tier}: NO SUCH TIER — the mechanical tiers are ${SHAPE_TIERS.join(", ")}`); continue; }
+          if (!Number.isFinite(want)) return { ok: false, saw: `the floor for ${tier} must be a number, not ${JSON.stringify(want)}` };
+          const n = byTier[tier];
+          if (!Number.isFinite(n)) { untaken.push(`${tier}: NOT TAKEN — totals.by_tier.${tier} is ${JSON.stringify(n ?? null)}`); continue; }
+          saw.push(`${n} record(s) tiered ${tier} across the whole band (floor ${want})`);
+          if (!(n >= want)) short.push(`${tier} is ${n}, below the floor of ${want}`);
+        }
+      }
+      if (!saw.length && !short.length && !untaken.length)
+        return { ok: false, saw: "no floor stated — give \"records\", \"by_tier\" or both; an op asserting nothing is an assert that looked at nothing" };
+      if (untaken.length) return { ok: false, saw: `the band was never sized that way, so this scenario proved nothing about the size it exists for — ${untaken.join(" · ")}` };
+      return shape.verdict(short.length === 0, saw.join(" · "),
+        `${short.join(" · ")} — either the register has thinned out under this mark or the query narrowed; re-measure before moving the floor`);
+    }
+
+    // The population behind the count, and the two properties the size-dependent paths need from it:
+    // enough rows to work on, and rows from more than one office.
+    //
+    // BOTH NUMBERS COME OUT OF THE SAME LIST, DELIBERATELY. The shape also carries a `by_registry` table
+    // over the whole band, and taking the office span from there while taking the row count from the
+    // floor list would report a multi-office band whose every floor row was one office — which is the
+    // exact fail-open the knockout records floor names: a total-only floor is met while the property it
+    // exists for lapses with every assert green. One list, both properties, or neither is asserted.
+    const floors = value ?? {};
+    const unknown = Object.keys(floors).filter((k) => k !== "records" && k !== "offices");
+    if (unknown.length) return { ok: false, saw: `unknown floor key(s) ${unknown.map((k) => JSON.stringify(k)).join(", ")} — this op takes `
+      + `"records" (rows on the floor list) and "offices" (how many the list spans).` };
+    const minRecords = Number.isFinite(floors.records) ? floors.records : 1;
+    const minOffices = Number.isFinite(floors.offices) ? floors.offices : 1;
+    const rows = shape.doc.floors?.in_class_identical_or_near;
+    if (!Array.isArray(rows)) return { ok: false, saw: `${file} carries no floors.in_class_identical_or_near array — the one list that is `
+      + `complete by construction was never written, which is not a band holding no identical marks` };
+    const offices = [...new Set(rows.map(bandRowOffice).filter(Boolean))].sort();
+    // A row whose office cannot be read is counted and named rather than dropped: it narrows the span
+    // this op can see, and a span that is narrow because the field is missing is not a narrow band.
+    const officeless = rows.filter((r) => !bandRowOffice(r)).length;
+    const met = rows.length >= minRecords && offices.length >= minOffices;
+    const body = `${rows.length} live in-class identical/near-identical floor row(s) (floor ${minRecords}) across `
+      + `${offices.length} office(s) [${offices.join(", ") || "none"}] (floor ${minOffices})`
+      + (officeless ? `, and ${officeless} row(s) carry no office, so the span read here is a floor on the span, not a count of it` : "");
+    return shape.verdict(met, body,
+      `${body} — the band the clearance lane merged is smaller or narrower than this scenario exists to hand the size-dependent paths`);
+  }
+
   // field ops
   const fn = OPS[a.op];
   if (!fn) return { ok: false, saw: `UNIMPLEMENTED op "${a.op}" — not passing by omission`, unimplemented: true };

package/scripts/env-audit.mjs

@@ -203,6 +203,22 @@ export function mergeEnvNameBindings(perFile) {
 // read as `env[X]`, for the reason READ_RE gives.
 const CONST_READ_RE = /(?<![.\w$])(?:process\??\.)?env(?:\?\.)?\[\s*([A-Z][A-Z0-9_]*)\s*\](?!\s*=[^=])/g;
 
+// THE NAME HELD IN A TABLE AS A VALUE, which is a read the three readers above cannot see. A generic
+// resolver takes the name out of a row and reads it — `{ env: "CLEAROTRON_CODEX_PATH", fallback: "codex" }`
+// — so the variable is read on every run and spelled nowhere the audit was looking. Thirteen names are
+// read exactly this way, and two of them are live deployment settings that no rule could ask for a row
+// for, because every ratchet that would is keyed on the name being seen.
+//
+// MATCHED ON THE PROPERTY NAME, NEVER ON THE VALUE'S SHAPE, and that is the whole reason this is safe.
+// A rule that took any uppercase string literal would take every message key, token and enum member in
+// the tree and drown the audit in names nothing reads. The property names are the closed set the
+// resolvers actually use; a new resolver that invents a fourth spelling is invisible again, which is a
+// known limit of this shape rather than a defect in the rule — the same limit the accessor reader has.
+//
+// This is the third time this shape has hidden a read here: the accessor family was the first, `envFrom`
+// the second, and a name held as a value is those two one remove further on.
+const TABLE_NAME_RE = /(?<![.\w$])(?:env|envName|tokenEnv)\s*:\s*["']([A-Z][A-Z0-9_]*)["']/g;
+
 export function namesRead(text, bindings = null) {
   const found = new Set();
   const stripped = stripCommentLines(text);
@@ -210,6 +226,8 @@ export function namesRead(text, bindings = null) {
   for (let m; (m = READ_RE.exec(stripped));) found.add(m[1] || m[2]);
   ACCESSOR_RE.lastIndex = 0;
   for (let m; (m = ACCESSOR_RE.exec(stripped));) found.add(m[1] || m[2]);
+  TABLE_NAME_RE.lastIndex = 0;
+  for (let m; (m = TABLE_NAME_RE.exec(stripped));) found.add(m[1]);
   // Resolved through the corpus map when one is supplied. Absent map ⇒ this half is simply off, which
   // is what keeps the function pure and drivable on a single string.
   if (bindings) {
@@ -357,6 +375,15 @@ export const EFFECT_CLASSES = Object.freeze({
   credential: "authentication material; absent, the run refuses at preflight by name",
   deployment: "where input and output live; the conclusion a run reaches is unchanged",
   tuning: "how long or how hard a run tries; the conclusion a run reaches is unchanged",
+  // WHAT THE INSTALL WIZARD WROTE WHEN IT SET THIS MACHINE UP. Added because the classifier had computed
+  // this class for years and no declaration could say it: five names computed `setup` against a
+  // vocabulary with no word for it, so each was either undeclared or declared as the nearest wrong
+  // thing. A declaration that cannot be true is worse than none — it reads as considered.
+  //
+  // It is its own class rather than a flavour of `deployment` because the two answer different
+  // questions. `deployment` says where this machine keeps things; `setup` says what the installer
+  // found or made here, which is the fact an operator needs when a program has moved.
+  setup: "what the install wizard found or wrote when it set this machine up; the conclusion a run reaches is unchanged",
   harness: "read only on a fixture, replay or self-test path; no production run reaches it",
 });
 

package/scripts/env-classify.mjs

@@ -355,6 +355,19 @@ export const DEPLOYMENT_NAMES = new Set([
   // Set by the install on the copy it starts after moving out of npx's cache, never by an operator. Its
   // row declares `deployment`, and no shape matches it, so unlisted it would fall through to `tuning`.
   "CLEAROTRON_RELOCATED",
+  // The two register ledgers, listed the day the scanner learned to read a name held in a table as a
+  // value — the same shape as the optional-chaining three below, one scanner widening later. Both name
+  // WHERE a file lives and resolve by an existence ladder over several directories, which is the
+  // definition `CLEAROTRON_JX_SUBCLASS_DB` was moved here on: a row whose own words name a place is
+  // `deployment`, and it reaches `tuning` only because `tuning` is the residual.
+  //
+  // GETTING THIS WRONG IS WORSE THAN THE BLINDNESS IT REPLACES. No deployed box sets either — the
+  // ledger module says so and explains why the default is resolved by existence rather than by name —
+  // so `tuning` with an empty set-site list is precisely the population step 3 deletes from. Making
+  // them visible without listing them here would move the billing-grade call ledger and the record
+  // ledger a "verified from the record" claim joins against from unseen to proposed for deletion.
+  "CLEAROTRON_REGISTER_CALL_LOG",
+  "CLEAROTRON_REGISTER_RECORD_LOG",
   // Three names read only through optional chaining, so no catalogue check saw them until the scanner
   // learned `?.`. Each row declares `deployment`, and no shape matches them (`_PORT$` does not take
   // `_PORTS`), so unlisted each fell through to `tuning`, the bucket step 3 deletes from. The first is set
@@ -502,7 +515,12 @@ export function classify({ catalogue, sources, setup = setupNames(), readSites =
   };
 
   const cls = (name) => OVERRIDES[name] ?? (setup.has(name) ? "setup"
-    : VENDOR_RE.test(name) ? "vendor-credential"
+    // `credential`, the word the declared vocabulary uses, NOT a second word for the same thing. This
+    // computed `vendor-credential` while no row could declare it, which is the same gap that left the
+    // install wizard's names undeclarable — one side of the contract saying a word the other side has
+    // no way to say. The rule settled with that one holds here: the classifier and the vocabulary say
+    // the SAME word, and a disagreement is fixed rather than frozen as an exception.
+    : VENDOR_RE.test(name) ? "credential"
     // The listed audience is consulted BEFORE the shapes, so a renamed name keeps the class a human gave
     // it rather than the one its new spelling happens to match.
     : deploymentNames.has(name) ? "deployment"
@@ -678,7 +696,7 @@ function build() {
     _what: "#1838 step 1 — every catalogued variable classified, and for every TUNING name the environments that have ever set it.",
     _how: "Regenerate with: node scripts/env-classify.mjs --check   (the production half is read from docs/architecture/env-set-in-production.txt, which needs `--gather-prod` on the production box to refresh).",
     _values: "NO VALUE from any environment is read into this artifact. Names only.",
-    _counts: { rows: rows.length, setup: by("setup"), deployment: by("deployment"), vendorCredential: by("vendor-credential"), tuning: by("tuning") },
+    _counts: { rows: rows.length, setup: by("setup"), deployment: by("deployment"), credential: by("credential"), tuning: by("tuning") },
     _stepThreePopulation: {
       _what: "What step 3 may act on: a numeric default, and no environment anywhere sets it.",
       _warning: "A candidate list, not a licence. Each still needs its read site read and its guard checked before deletion.",

package/scripts/freeze-example-run.mjs

@@ -47,7 +47,8 @@ import {
 } from "node:fs";
 import { join, dirname, relative, basename } from "node:path";
 import { createHash } from "node:crypto";
-import { driverDir } from "../shared/driver-dir.mjs";   //
+import { driverDir } from "../shared/driver-dir.mjs";
+import { PUBLISH_INPUTS } from "../driver/publish/publish-inputs.mjs";   //
 import { tmpdir } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
@@ -61,24 +62,33 @@ const FROZEN_FILES = [
   { path: "audit.md", why: "publish/index.mjs:1022 auditMd, the audit workbook source" },
   { path: "findings.json", why: "publish/index.mjs:715 readStore, the per-finding machine contract" },
   { path: "status.json", why: "publish/index.mjs:913 machineLedgerNote + markName" },
-  { path: "case-law-findings.md", why: "publish/index.mjs:875 clPath, the case-law section" },
-  { path: "common-law-grid.json", why: "publish/index.mjs:1006 commonLawJoinedTerms, common-law coverage" },
+  { path: "case-law-findings.md", why: "`clPath` declared in index.mjs, the case-law section" },
+  { path: "common-law-grid.json", why: "`commonLawJoinedTerms` declared in index.mjs, common-law coverage" },
   // publish/index.mjs — the _driver sidecars it reads by name
   { path: "_driver/receipts.json", why: "publish/index.mjs:761 fetchReceipts" },
   { path: "_driver/senior-rights.json", why: "publish/index.mjs:787 seniorRights" },
   { path: "_driver/verdict.json", why: "publish/index.mjs:792 verdictInfo" },
   { path: "_driver/framework.json", why: "publish/index.mjs, the frozen band vocabulary the run was rated under" },
-  { path: "_driver/register-plan.json", why: "publish/index.mjs:846 scopeBasis" },
-  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:847 searchedJurisdictions, the fallback for register-plan" },
-  { path: "_driver/enforcer-signals.json", why: "publish/index.mjs:887 esPath" },
+  { path: "_driver/register-plan.json", why: "publish/index.mjs:901 scopeBasis" },
+  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:902 searchedJurisdictions, the fallback for register-plan" },
+  { path: "_driver/enforcer-signals.json", why: "`esPath` declared in index.mjs" },
   { path: "_driver/predelivery-lint.json", why: "publish/index.mjs:172 lintSink" },
   { path: "_driver/escalation-state.json", why: "publish/index.mjs:173 escSink" },
-  { path: "_driver/reasoning-integrity.json", why: "publish/index.mjs:924 integritySink" },
+  { path: "_driver/reasoning-integrity.json", why: "`integritySink` declared in index.mjs" },
   { path: "_driver/corrections-state.json", why: "publish/index.mjs:174 correctionsSink" },
-  { path: "_driver/search-policy.json", why: "publish/index.mjs:987 searchPolicy, level + stage label" },
+  { path: "_driver/search-policy.json", why: "`searchPolicy` declared in index.mjs, level + stage label" },
   { path: "_driver/profile.json", why: "publish/index.mjs reads the frozen profile; report-registry.mjs:42 republishRun, customer key" },
 ];
 
+// EVERY INPUT THE PUBLISHER DECLARES TRAVELS, taken from its own closed table rather than restated. The
+// hand-kept list above drifted from that table: register-named-band.json, the recall receipt and the
+// local-language lane's two files were declared publish inputs and were left behind, so a frozen republish
+// drew no register section and no local-language row where the source run drew both. A declared input
+// added later now travels without an edit here; one the publisher does not declare still needs a line above.
+for (const path of Object.keys(PUBLISH_INPUTS)) {
+  if (!FROZEN_FILES.some((f) => f.path === path)) FROZEN_FILES.push({ path, why: "declared in publish/publish-inputs.mjs" });
+}
+
 // ── THE KNOCKOUT LANE IS A DIFFERENT WORKSPACE, AND report.md IS NOT IN IT ─
 //
 // A knockout run never writes report.md: for that lane the markdown is an OUTPUT of publish, not an
@@ -108,7 +118,7 @@ const KNOCKOUT_FILES = [
   // knockout report render empty (publish/knockout.mjs:140-155). Named by stages-knockout.mjs:32,41.
   { path: "_driver/register-counts.json", why: "publish/knockout.mjs:140-155 counted figures + the Register column" },
   { path: "_driver/register-records.json", why: "stages-knockout.mjs:41 the terms behind the close-variation axis" },
-  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:847 searchedJurisdictions, the fallback for register-plan" },
+  { path: "_driver/instructed-scope.json", why: "publish/index.mjs:902 searchedJurisdictions, the fallback for register-plan" },
 ];
 
 /** The allowlist for a template. One place, so a new template cannot half-exist. */
@@ -176,7 +186,7 @@ const VOLATILE = [
 //
 // 1. THE BIRTH CODENAME, IN CONTENT. `--codename` rebuilds the run's IDENTITY — the leaf, the runId, the
 //    directory — and the content keeps the old pair: `_receipt.context` in every record artifact reads
-//    "prelim-<matter>-<codename>-register-unit-primary-sweep", and audit.md and status.json carry it in
+//    "clearance-<matter>-<codename>-register-unit-primary-sweep", and audit.md and status.json carry it in
 //    prose. driver/test/no-client-identifiers.test.mjs check 2 sweeps CONTENT as well as paths, so a
 //    tree renamed but not rewritten can never be committed — which is exactly what the old echo check
 //    reported, correctly, and could do nothing about.