clearotron 0.3.2-beta.8 → 0.3.2-beta.9

package/driver/form-neighbourhood.mjs

@@ -84,6 +84,36 @@ export function editNeighbourhood(element) {
   return [...out].sort();
 }
 
+// ── A one-letter neighbour that is an ordinary word with a DIFFERENT SOUND is not searched ────────────
+//
+// THE REVIEWING LAWYER'S TEST IS CONFUSING SIMILARITY, and edit-1 over a short ordinary word is mostly other
+// ordinary words: CARE, CODE, CORD, BORE, MORE beside CORE, each a common mark with its own crowd. Measured
+// on a delivered four-letter run, 2026-09-18: 1,037 of 2,098 records (49%) were reached only by the one-letter
+// lists; on the dense production matter of 2026-09-16, 1,154 of 2,146 (54%). Conceptually different words are
+// not confused by consumers, so fetching them is cost and not coverage. A respelling that sounds the same —
+// KORE for CORE — is exactly what a search must find, and so is every neighbour of a made-up word, because two
+// unknown words that sound alike have nothing conceptual to keep them apart (MALENA beside VALENA).
+//
+// So a neighbour is dropped only when BOTH hold: it is in the ordinary-word list, AND no Double-Metaphone key
+// of it matches any key of the element. Everything else is dispatched exactly as before. There is no judgment
+// of the MARK here — coined or ordinary — only of each neighbour, so a coined element keeps its whole list
+// except where a neighbour is a different-sounding real word. The list only ever removes queries, and a word
+// missing from it is searched: over-search is the safe direction.
+//
+// DOUBLE METAPHONE KEEPS VOWELS ONLY AT THE START, so a vowel change inside the word does not change the key:
+// CARE, CURE and GORE all key KR, as CORE does, and are KEPT. That is the rule as specified erring towards the
+// search, and it is recorded here so nobody reads those three as a defect of the list.
+//
+// `ordinaryWords` is a Set of lowercase words, or null. Null drops nothing — the behaviour before this rule —
+// so a caller that does not load the list (every test that predates it) is unchanged. PURE.
+export function ordinaryWordDifferentSound(element, ordinaryWords) {
+  const el = normalizeElement(element);
+  if (!el || !(ordinaryWords instanceof Set) || !ordinaryWords.size) return [];
+  const own = new Set(doubleMetaphone(el).filter(Boolean));
+  return editNeighbourhood(el).filter((t) => ordinaryWords.has(t)
+    && !doubleMetaphone(t).filter(Boolean).some((k) => own.has(k)));
+}
+
 // ── Consonant skeleton + wildcard patterns — retrieve the phonetic VOWEL family in one bounded vendor query ──
 // VALENA → consonants V,L,N → skeleton "VLN"; vowel-slot wildcard "V?L?N?"-style patterns the vendor's Lucene
 // `?`/`*` supports (live-confirmed). This is the tractable, complete way to reach VYLONA/VILINA/VILENA without
@@ -229,13 +259,18 @@ export function transliterations(element, { scripts = SUPPORTED_SCRIPTS } = {})
 // droppedVariantFamilies). The floor stays exhaustive WITHIN the families judgment kept — this is the funnel
 // honouring a scope decision that was already written and, until 2026-07-18, ignored. edit-1 is never
 // droppable: it is the doctrine floor (radiusFor), not a family.
-export function formNeighbourhood(element, { markets = [], scripts = SUPPORTED_SCRIPTS, droppedAxes = [] } = {}) {
+export function formNeighbourhood(element, { markets = [], scripts = SUPPORTED_SCRIPTS, droppedAxes = [], ordinaryWords = null } = {}) {
   const radius = radiusFor(element);
   const el = radius.element;
-  if (!el) return { element: "", radius, exactQueries: [], wildcardPatterns: [], phoneticKeys: [], confusables: [], transliterations: [], ledger: { disclosed: radius.note, axes: [] } };
+  if (!el) return { element: "", radius, exactQueries: [], wildcardPatterns: [], phoneticKeys: [], confusables: [], transliterations: [], ordinaryWordDifferentSound: [], ledger: { disclosed: radius.note, axes: [] } };
 
   const drop = new Set(droppedAxes ?? []);
-  const edits = editNeighbourhood(el);
+  const generatedEdits = editNeighbourhood(el);
+  // Only edit-1 is filtered. A term another generator also produces (a confusable, a transliteration) is
+  // still dispatched as that generator's — those families are unchanged by this rule.
+  const notSearched = ordinaryWordDifferentSound(el, ordinaryWords);
+  const skip = new Set(notSearched);
+  const edits = generatedEdits.filter((t) => !skip.has(t));
   const confs = drop.has("visual-confusable") ? [] : visualConfusables(el);
   const trans = drop.has("transliteration") ? [] : transliterations(el, { scripts });
   const wildcards = drop.has("phonetic-family") ? [] : skeletonPatterns(el);
@@ -261,11 +296,15 @@ export function formNeighbourhood(element, { markets = [], scripts = SUPPORTED_S
     phoneticKeys: keys,
     confusables: confs,
     transliterations: trans,
+    ordinaryWordDifferentSound: notSearched,
     ledger: {
       disclosed: radius.note,
       dropped_axes: [...drop].sort(),
       axes: [
-        { axis: "edit-1", count: edits.length, mechanism: "Damerau-Levenshtein edit-1, exhaustive" },
+        { axis: "edit-1", count: edits.length, generated: generatedEdits.length, not_searched: notSearched.length,
+          mechanism: notSearched.length
+            ? "Damerau-Levenshtein edit-1, exhaustive, less the neighbours that are ordinary words with a different sound"
+            : "Damerau-Levenshtein edit-1, exhaustive" },
         // NO PATTERN is a THIRD state, and it is disclosed in the same voice as a judgment drop. An
         // element with too few consonants to anchor a skeleton wildcard (X, and anything normalizing to
         // one character) yields no retrieval pattern at all — see skeletonPatterns. Silence here would
@@ -349,7 +388,7 @@ export function coverageGaps(band, { dispatched = [], explained = [] } = {}) {
 // exhaustive edit-1 neighbourhood: 1,736 junk exact queries on AquaPlus 2026-07-17, 4,524 on the 07-16 run.
 // Measured 2026-07-18: 10 of 20 recent runs carried one of these. The JSON field is a validated scalar and
 // cannot swallow a sentence.
-export function renderFormNeighbourhoodJson(manifestMd, { markets = [], scripts = SUPPORTED_SCRIPTS, droppedAxes = [], model = null, mark = "" } = {}) {
+export function renderFormNeighbourhoodJson(manifestMd, { markets = [], scripts = SUPPORTED_SCRIPTS, droppedAxes = [], model = null, mark = "", ordinaryWords = null } = {}) {
   const { seeds, seededFrom, rejected } = floorSeeds(manifestMd, { model, mark });
   // The reason travels WITH the throw. It used to say only "the job states no mark", which is one
   // of two causes and not the one that actually fires: a non-Latin mark states a mark perfectly well and
@@ -361,7 +400,7 @@ export function renderFormNeighbourhoodJson(manifestMd, { markets = [], scripts
       || "manifest names no Dominant element / Formative root, and the job states no mark";
     throw new Error(`form_neighbourhood_no_element: ${why} — nothing to seed the mechanical form band`);
   }
-  const elements = seeds.map(({ element, role }) => ({ element, role, band: formNeighbourhood(element, { markets, scripts, droppedAxes }) }));
+  const elements = seeds.map(({ element, role }) => ({ element, role, band: formNeighbourhood(element, { markets, scripts, droppedAxes, ordinaryWords }) }));
   const families = variantFloorFamilies(elements, { mark, droppedAxes });
   return JSON.stringify({
     schema_version: 2,
@@ -596,10 +635,11 @@ export function spacingPunctuationForms(mark) {
 export function variantFloorFamilies(elements, { mark = "", droppedAxes = [] } = {}) {
   const drop = new Set(droppedAxes ?? []);
   const edit = new Set(), visual = new Set(), translit = new Set(), other = new Set();
-  const wildcards = new Set(), keys = new Set();
+  const wildcards = new Set(), keys = new Set(), notSearched = new Set();
   for (const el of elements ?? []) {
     const band = el?.band;
     if (!band) continue;
+    for (const t of band.ordinaryWordDifferentSound ?? []) notSearched.add(t);
     const edits = new Set(editNeighbourhood(el.element));
     const confs = new Set(band.confusables ?? []);
     const trans = new Set(band.transliterations ?? []);
@@ -639,6 +679,12 @@ export function variantFloorFamilies(elements, { mark = "", droppedAxes = [] } =
       dropped: drop.has("phonetic-family"), terms: sorted(wildcards), phonetic_keys: sorted(keys) },
     ...(other.size ? [{ family: "other", category: "other", generator: "formNeighbourhood (dedupeOnFold residue)",
       enumeration: "a dispatched term no single generator claims — recorded rather than hidden", dropped: false, terms: sorted(other) }] : []),
+    // NOT SEARCHED, and listed in full so the plan says what it left out and why. Not a crowd and not a
+    // gap: a deliberate rule (ordinaryWordDifferentSound). `searched: false` keeps it out of the floor the
+    // merge below counts, so a model that proposes one of these words is recorded as its own addition.
+    ...(notSearched.size ? [{ family: "ordinary-word-different-sound", category: "phonetic", generator: "editNeighbourhood",
+      enumeration: "edit-1 neighbours that are ordinary English words and share no Double-Metaphone key with the element",
+      dispatch: "not searched — ordinary word, different sound", searched: false, dropped: true, terms: sorted(notSearched) }] : []),
   ];
 }
 
@@ -674,6 +720,7 @@ export function mergeVariantFloor(floorFamilies, modelVariants, { rejectedSeeds
   const families = Array.isArray(floorFamilies) ? floorFamilies : [];
   const floorByKey = new Map();
   for (const f of families) {
+    if (f?.searched === false) continue;   // listed for disclosure, never searched — not floor
     for (const t of f?.terms ?? []) {
       const k = formKey(t);
       if (!k || floorByKey.has(k)) continue;

package/driver/framework.mjs

@@ -2,7 +2,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // framework.mjs — the risk-framework MANIFEST layer (doc 50: the framework in force rates the matter).
 //
-// The framework itself is a PROSE deck (skills/prelim-search/risk-framework*.md) — the customer's own legal
+// The framework itself is a PROSE deck (skills/clearance-search/risk-framework*.md) — the customer's own legal
 // judgment written down, which synthesis reads and reasons WITH. This module carries the small
 // machine-readable sidecar (<framework>.manifest.json) that lets validators, the renderer, the archive index
 // and the profile UI consume the framework's VOCABULARY — band words, severity order, entity label, source —
@@ -18,12 +18,12 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
 // ── selection (the ?? fallback IS the "Generic default rates the matter" rule) ────────────────────────────
-export const DEFAULT_FRAMEWORK = "skills/prelim-search/risk-framework.md";
-export const DEFAULT_WORKED_EXAMPLES = "skills/prelim-search/worked-examples.md";
+export const DEFAULT_FRAMEWORK = "skills/clearance-search/risk-framework.md";
+export const DEFAULT_WORKED_EXAMPLES = "skills/clearance-search/worked-examples.md";
 export const frameworkFor = (profile) => profile?.frameworkPath ?? DEFAULT_FRAMEWORK;
 export const workedExamplesFor = (profile) => profile?.workedExamplesPath ?? DEFAULT_WORKED_EXAMPLES;
 
-/** skills/prelim-search/risk-framework-x.md → skills/prelim-search/risk-framework-x.manifest.json.
+/** skills/clearance-search/risk-framework-x.md → skills/clearance-search/risk-framework-x.manifest.json.
  *  The manifest path is DERIVED, never a profile knob — the profile names only the .md. */
 export const manifestPathFor = (fwPath) => String(fwPath).replace(/\.md$/, ".manifest.json");
 

package/driver/gateway.mjs

@@ -34,7 +34,7 @@ import { MODEL_FILE as BLIND_FRAME_MODEL_FILE } from "./blind-frame-record.mjs";
 import { FLAGS_FILE as SKEPTIC_FLAGS_FILE } from "./skeptic-record.mjs";
 import { MODEL_FILE as FRAME_DIFF_MODEL_FILE, PROSE_FILE as FRAME_DIFF_PROSE_FILE } from "./frame-diff-record.mjs";
 import { MATTER_CONTEXT_FILE } from "./matter-frame-record.mjs";
-import { MODEL_FILE as VARIANT_MODEL_FILE, PROSE_FILE as VARIANT_PROSE_FILE } from "./prelim-variants-record.mjs";
+import { MODEL_FILE as VARIANT_MODEL_FILE, PROSE_FILE as VARIANT_PROSE_FILE } from "./clearance-variants-record.mjs";
 import { PROSE_FILE as REPORT_OVERVIEW_FILE } from "./report-overview-record.mjs";
 import { NARRATIVE_FILE, FINDINGS_FILE, refusalsFor } from "./synthesis-record.mjs";
 import { FINDINGS_FILE as REGISTER_FINDINGS_FILE, refusalsFor as registerDigestRefusalsFor } from "./register-digest-record.mjs";
@@ -96,8 +96,8 @@ export const TOOL_WRITTEN_ARTIFACTS = new Map([
   // scope-ledger.json is deliberately ABSENT: it was already driver-written before this conversion (the
   // driver derived it), so it is outside this conversion's claim. What changed is where its values come
   // from, not who writes it.
-  [VARIANT_MODEL_FILE, { tool: "record_prelim_variants", what: "the variant manifest" }],
-  [VARIANT_PROSE_FILE, { tool: "record_prelim_variants", what: "the variant manifest" }],
+  [VARIANT_MODEL_FILE, { tool: "record_clearance_variants", what: "the variant manifest" }],
+  [VARIANT_PROSE_FILE, { tool: "record_clearance_variants", what: "the variant manifest" }],
   // Conversion 4 — ONE basename, and the first row whose artifact a CLIENT reads. report-overview.md is
   // the delivered report's front-matter and its Actions section; assembleReportMd splices the code-built
   // sections into it and publishes the result. So a repair that arrives naming this file and gets handed
@@ -261,6 +261,7 @@ import { unionDispositionForm, formSidecarPath } from "./disposition-union.mjs";
 import { unionCoverageForm } from "./coverage-union.mjs";
 import { coverageFormStamp, readCoverageForm, readCoverageFormInput, writeCoverageForm } from "./coverage-form-io.mjs";
 import { unionPlacementForm } from "./placement-union.mjs";
+import { placementRenderAccount } from "./placement-form.mjs";
 import { placementFormStamp, readPlacementForm, readPlacementFormInput, readSubmittedPlacementForm, writePlacementForm, renderPlacementsFile } from "./placement-form-io.mjs";
 // The register-axis vocabulary, quoted verbatim into the coverage-form axis hint. ONE source: the same
 // constant `rowIsSettled` refuses against, so the hint can never name a set the gate does not accept.
@@ -741,7 +742,12 @@ export function syncPlacementForm(files) {
     // never put an unparseable deliverable on disk, and on a throw the previous file is left alone.
     const r = renderPlacementsFile(runDir, u.form.rows);
     if (!r.ok) note(`[placement-form] placements.json NOT re-rendered: ${r.error} — the previous file stands and the omission is on the form`);
-    return { ...u, rendered: r.ok ? r.placements : null, render_error: r.error };
+    // WHO OWES EACH ROW THE RENDER LEFT OUT — the same account validators.placement judges with, carried onto
+    // the attempt row so an omission is never read without its cause.
+    const a = placementRenderAccount(u.form.rows);
+    const account = { unjudged: a.unjudged.length, registerSelected: a.register_selected,
+      registerRendered: a.register_rendered, registerFacts: a.register_facts };
+    return { ...u, rendered: r.ok ? r.placements : null, render_error: r.error, account };
   }
   return null;
 }
@@ -1699,7 +1705,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         // destroyed. `unresolved` counts selections the fold does not hold. RECORDING ONLY.
         placements: lastPlacementUnion ? { settled: lastPlacementUnion.settled, outstanding: lastPlacementUnion.outstanding,
           carried: lastPlacementUnion.carried, total: lastPlacementUnion.total, seatRows: lastPlacementUnion.seat_rows,
-          unresolved: lastPlacementUnion.unresolved, rendered: lastPlacementUnion.rendered } : undefined,
+          unresolved: lastPlacementUnion.unresolved, rendered: lastPlacementUnion.rendered, account: lastPlacementUnion.account } : undefined,
         //: how many in-dispatch form repairs THIS attempt bought (absent = none). Its own rows
         // sit immediately above with the defect each one was dispatched to fix.
         formRepairs: formRepairsThisAttempt || undefined,
@@ -2088,7 +2094,7 @@ function refusalsInWindow(files, runDir, from, to) {
 }
 
 function rel(p) {
-  const i = p.indexOf("/prelim-search/");
+  const i = Math.max(p.indexOf("/clearance-search/"), p.indexOf("/prelim-search/"));   // either spelling of the studio segment
   return i >= 0 ? p.slice(i + 1) : p;
 }
 

package/driver/jx-lanes.mjs

@@ -183,10 +183,10 @@ export function decideJxLanes({ job, profile, searchPolicy } = {}) {
  *
  * ── THE GATE THAT WAS DECIDING, AND DECIDING OFF ────────────────────────────────────────────────────
  *
- * This function opened with `resolvedPolicy.level !== "prelim"`. `resolveSearchPolicy` now returns
+ * This function opened with `resolvedPolicy.level !== "clearance"`. `resolveSearchPolicy` now returns
  * `level` = THE PRODUCT ID for all four searches, so that leg was false on every live run and the whole
  * recommendation was dead — silently, with both callers (pipeline.mjs and runner.mjs) live and 3,754
- * driver tests green, because the one test that covered it hand-fed `{ level: "prelim" }`, a value
+ * driver tests green, because the one test that covered it hand-fed `{ level: "clearance" }`, a value
  * nothing produces any more. A retired slug does not stop deciding when it is retired; it starts
  * deciding one way.
  *

package/driver/jx-units.mjs

@@ -144,7 +144,7 @@ function ledgerRow(runDir, row) {
   try { appendFileSync(driverDir(runDir, "jx-completions.jsonl"), JSON.stringify(row) + "\n"); } catch { /* receipts best-effort */ }
 }
 
-const runPrefix = (run) => `prelim-${run?.slug ?? "run"}-${run?.codename ?? "local"}-`;
+const runPrefix = (run) => `clearance-${run?.slug ?? "run"}-${run?.codename ?? "local"}-`;
 
 // ── Executor chains (the resolveJxExecutor idiom: injected → CLEAROTRON_JX_FIXTURES → live) ─────────────
 export function resolveSerpExecutor(opts, { mark, lane }) {

package/driver/jx.mjs

@@ -186,6 +186,13 @@ export function deriveJxSliceStatement({ sidecar, units = null, env = process.en
 //
 // PURE. Takes the parsed sidecar and the slice statement `deriveJxSliceStatement` just produced.
 export function deriveLaneDepthVerdicts({ sidecar, slices } = {}) {
+  // EITHER SHAPE, AND THAT IS NOT POLITENESS. This reads `slices.candidates`, and the publish path handed
+  // it `deriveJxSliceStatement`'s whole return — `{executes, slices}` — so the lookup found nothing and
+  // every lane reported `ran: null` whatever it had done. Nothing threw and nothing was logged: the
+  // failure arrived as a delivered client report saying a search had not run when it had. The two shapes
+  // are told apart with certainty rather than guessed at — a statement carries a `slices` object and a
+  // slice map carries slice names — so a caller cannot pass the wrong one and be quietly misread.
+  const bySlice = slices?.slices && typeof slices.slices === "object" ? slices.slices : slices;
   const declared = sidecar?.lanes ?? {};
   const out = {};
   for (const lane of Object.keys(declared)) {
@@ -194,10 +201,10 @@ export function deriveLaneDepthVerdicts({ sidecar, slices } = {}) {
     // lane that gains a slice later is covered without this function being edited — and so a lane that
     // has none is a measured fact rather than a hardcoded assumption about ja/ko.
     const deep = JX_SLICES.filter((s) => s.slice > 1 && s.lane === lane);
-    const deepStates = deep.map((s) => ({ name: s.name, state: slices?.[s.name]?.state ?? null, why: slices?.[s.name]?.why ?? null }));
+    const deepStates = deep.map((s) => ({ name: s.name, state: bySlice?.[s.name]?.state ?? null, why: bySlice?.[s.name]?.why ?? null }));
     const deepRan = deepStates.filter((d) => d.state === "ran").map((d) => d.name);
     // Slice 1 is the multi-lane one: its per-lane state lives in `.lanes`, never in a scalar `.state`.
-    const candidatesState = slices?.candidates?.lanes?.[lane] ?? null;
+    const candidatesState = bySlice?.candidates?.lanes?.[lane] ?? null;
 
     const ran = deepRan.length ? "full" : candidatesState === "ran" ? "candidates" : null;
     const shortfall = asked === "full" && ran !== "full";
@@ -225,6 +232,27 @@ export function deriveLaneDepthVerdicts({ sidecar, slices } = {}) {
   return out;
 }
 
+/**
+ * THE VERDICT A PUBLISHED REPORT SHOULD CARRY: the one the RUN stated, not a fresh one. PURE.
+ *
+ * `stateJxFold` writes `fold.depth` at delivery, derived from this run's own environment — which is the
+ * reason the seam exists: the arms are environment, so a verdict derived on some later box speaks for
+ * that box and not for the run. Publishing derived its own, and the two disagreed on a delivered client
+ * report: the run said the ja lane ran as a candidate lane, the publisher said no lane ran, and the page
+ * printed "Not run this run" over a search that had happened.
+ *
+ * Deriving stays, for a run delivered before the stamp existed — an old artifact still gets the best
+ * answer its record supports, rather than none.
+ *
+ * @param {object|null} sidecar  parsed _driver/jx-lanes.json
+ * @param {object|null} units    parsed _driver/jx/units.json, or null
+ */
+export function laneDepthOfRun({ sidecar, units = null, env = process.env } = {}) {
+  const stamped = sidecar?.fold?.depth;
+  if (stamped && typeof stamped === "object" && !Array.isArray(stamped)) return stamped;
+  return deriveLaneDepthVerdicts({ sidecar, slices: deriveJxSliceStatement({ sidecar, units, env }) });
+}
+
 const flag = (name) => ["1", "true", "yes", "on"].includes(String(process.env[name] ?? "").trim().toLowerCase());
 // — the private copy is gone; laneArmed (driver.config.mjs) is the one reader.
 

package/driver/knockout-review-record.mjs

@@ -43,6 +43,9 @@ import { captureCall, stampVerdict } from "./call-capture.mjs";
 import { refuseUndeclared as refuseUndeclaredShared, lastAccepted, acceptedEnvelope } from "./preserve-merge.mjs";
 import { knockoutVisibleProse } from "./predelivery-lint.mjs";   // the walk is the authority on what a reader sees
 import { plainRegisterFlags } from "./plain-register.mjs";        // the pinned rule, one copy
+// THE HINT'S fold, and it is imported rather than rebuilt — see nearestAddress. It is a comparison key
+// for saying WHICH line was probably meant; it never decides whether an address resolves.
+import { queryKey } from "./connotation-search.mjs";
 
 const SCHEMA_VERSION = 1;
 
@@ -142,6 +145,42 @@ export function addressKey(at) {
   return [a.field, a.mark ?? "", a.index ?? "", a.ordinal ?? ""].join(ADDRESS_SEP);
 }
 
+/**
+ * THE ADDRESS A SEAT PROBABLY MEANT, FOR THE REFUSAL TO NAME — and for nothing else.
+ *
+ * The lookup above stays EXACT and that is a ruling, not an oversight (owner, 2026-09-16). Punctuation
+ * can be part of a mark's identity, so two marks differing by an apostrophe form are not assumed to be
+ * one mark and a rewrite is never applied by analogy. What was wrong was the refusal, not the matching:
+ * a seat that re-typed a name with a right single quotation mark where the record has an apostrophe was
+ * told its rewrite "names no line on this record", which describes the record rather than the difference,
+ * and the rewrite was dropped with nobody able to see why. One character, invisible in most fonts.
+ *
+ * So this names the nearest and changes nothing. It folds ONLY typographic form — `queryKey`, the same
+ * key the meaning gate was folded onto after a production clearance stopped on exactly this character —
+ * and it is imported rather than copied, because two private folds are how the two gates drift apart.
+ * That key deliberately does not fold accents, so it cannot quietly propose that Café and Cafe are the
+ * same mark.
+ *
+ * It requires an EXACT match on every other part of the address — field, index, ordinal — so the hint is
+ * always the same line of the same record, differing only in how the mark's name was typed. A candidate
+ * whose mark is byte-identical is not a hint: the caller only asks when the exact lookup already failed,
+ * and pointing at the address that was just refused would say nothing.
+ *
+ * @returns {object|null} the address on this record, or null when nothing differs by form alone
+ */
+export function nearestAddress(at, knownAts) {
+  const want = at ?? {};
+  if (want.mark == null) return null;   // no name to have mistyped
+  const same = (a, b) => (a ?? "") === (b ?? "");
+  for (const k of knownAts ?? []) {
+    if (!k || k.field !== want.field) continue;
+    if (!same(k.index, want.index) || !same(k.ordinal, want.ordinal)) continue;
+    const kn = String(k.mark ?? ""), wn = String(want.mark ?? "");
+    if (kn !== wn && queryKey(kn) === queryKey(wn)) return k;
+  }
+  return null;
+}
+
 /** Is this a well-formed address for a field the pass may reach? The reason, or null. */
 export function addressFault(at) {
   if (!at || typeof at !== "object" || Array.isArray(at)) return "an address must be an object";
@@ -296,15 +335,21 @@ export function validateKnockoutReviewFile(file, text) {
   try { merged = JSON.parse(readFileSync(findingsFile, "utf8")); }
   catch (e) { return { ok: false, reason: `the merged record will not parse, so no address could be checked: ${e.message}` }; }
 
-  const known = new Set(knockoutVisibleProse(merged).map((v) => addressKey(v.at)));
+  const knownAts = knockoutVisibleProse(merged).map((v) => v.at);
+  const known = new Set(knownAts.map((a) => addressKey(a)));
   const owned = new Set(knockoutVisibleProse(merged).filter((v) => v.at?.engineOwned).map((v) => addressKey(v.at)));
+  // Appended to a refusal, never consulted before one: the address still has to match exactly.
+  const hint = (at) => {
+    const n = nearestAddress(at, knownAts);
+    return n ? ` — this record carries "${n.mark}" at that line, which differs from "${at.mark}" only in how it is typed; the two are not assumed to be the same mark, so re-send the rewrite naming the record's spelling` : "";
+  };
   for (const r of doc.rewrites ?? []) {
     const key = addressKey(r.at);
     if (owned.has(key)) return { ok: false, reason: `the rewrite for ${r.at.field} names a caveat the engine wrote, not a seat — it is not offered and cannot be changed` };
-    if (!known.has(key)) return { ok: false, reason: `the rewrite for ${r.at.field}${r.at.mark ? ` on "${r.at.mark}"` : ""} names no line on this record` };
+    if (!known.has(key)) return { ok: false, reason: `the rewrite for ${r.at.field}${r.at.mark ? ` on "${r.at.mark}"` : ""} names no line on this record${hint(r.at)}` };
   }
   for (const d of doc.declined ?? []) {
-    if (!known.has(addressKey(d.at))) return { ok: false, reason: `the declined row for ${d.at.field}${d.at.mark ? ` on "${d.at.mark}"` : ""} names no line on this record` };
+    if (!known.has(addressKey(d.at))) return { ok: false, reason: `the declined row for ${d.at.field}${d.at.mark ? ` on "${d.at.mark}"` : ""} names no line on this record${hint(d.at)}` };
   }
   return { ok: true };
 }
@@ -340,7 +385,14 @@ export function applyKnockoutReview(merged, review) {
   for (const r of review?.rewrites ?? []) {
     const key = addressKey(r.at);
     const seen = byKey.get(key);
-    if (!seen) { unresolved.push({ at: r.at, why: "no such line on this record" }); continue; }
+    if (!seen) {
+      // Same hint as the validator's, for the same reason: the apply path is reached on a record this
+      // pass did not validate, and an unresolved row that cannot say WHY is the state that cost a
+      // rewrite silently. It still changes nothing — `unresolved` is a report.
+      const near = nearestAddress(r.at, [...byKey.values()].map((v) => v.at));
+      unresolved.push({ at: r.at, why: near ? `no such line on this record — it carries "${near.mark}" there, differing from "${r.at.mark}" only in how it is typed` : "no such line on this record" });
+      continue;
+    }
     if (seen.at?.engineOwned) { refused.push({ at: r.at, why: "the engine wrote this caveat, not a seat" }); continue; }
     const at = r.at, text = String(r.text);
     // THE WALK IS THE BOUNDS CHECK. `seen` came from this same record, so a resolved address names a

package/driver/known-conflicts.mjs

@@ -8,7 +8,7 @@
 // (copper-causeway could not see teal-conduit's VENERET: different noref slugs for the same VENZY).
 // The store therefore lives one level up, keyed by the MARK:
 //
-//     <studioRoot>/_known-conflicts/<kebab(mark)>.json     (studioRoot = workspace-<agent>/studio/prelim-search)
+//     <studioRoot>/_known-conflicts/<kebab(mark)>.json     (studioRoot = workspace-<agent>/studio/clearance-search)
 //
 // One file per searched mark name; workspace-per-agent keeps customers separated. Each file keeps the
 // EXACT inner shape the tripwire already reads ({schema_version, marks:{"<mark key>":[rows]}}), so

package/driver/named-band.mjs

@@ -29,23 +29,6 @@ import { abbrev } from "./repair-contract.mjs";
 
 export const BAND_STATES = ["enumerated", "incomplete"];
 
-// ── WHAT ONE QUERY MAY PUT INTO THE BAND ─────────────────────────────────────────────────────────
-//
-// THE DEFECT (production run, 2026-09-16). A 2,146-record band, of which 1,154 — 54% — were reachable
-// from two queries and nothing else. Both were machine-built forms of an ordinary short word, so they
-// matched every mark containing that word across four registers. Measured on the preserved band: the
-// three biggest queries returned 589, 583 and 271 records; the fourth returned 185. A ceiling at 200
-// therefore bites exactly those three and leaves the rest of that plan untouched, which is why it is
-// the number rather than a rounder one.
-//
-// AN OVER-CAP QUERY IS NOT TRUNCATED, IT IS RECLASSIFIED. The band already has a word for "this query
-// matched more than we carried": `incomplete`, which produces a crowd descriptor carrying the full
-// count. So the excess is DISCLOSED with its number rather than dropped — judgment reads the crowd and
-// can say the ground was too broad to enumerate, which is a true statement about the search. Silently
-// keeping the first two hundred would be the one outcome worse than the flood: a narrower band that
-// reads as complete.
-export const BAND_QUERY_CAP = 200;
-
 /**
  * Parse + lightly validate the named-band artifact. Returns { enumerated:[…records], crowds:[…descriptors] }.
  * Throws `named_band_*` tokens (token FIRST) so the stage validator + corrective-retry can key on the defect,
@@ -112,22 +95,7 @@ export function parseNamedBand(raw) {
       // at band-shape.mjs's `record_id` filter — the same loss, one step further from anything that
       // could name it.
       const recs = Array.isArray(b.records) ? b.records : [];
-      const kept = [];
-      for (const r of recs) { if (r && typeof r === "object" && !Array.isArray(r)) kept.push({ ...r, ...prov }); }
-      if (kept.length > BAND_QUERY_CAP) {
-        // The count the provider reported is the truth about the ground; `kept.length` is only what this
-        // block carried. Prefer the reported total and fall back to what we hold, so the descriptor never
-        // claims a smaller crowd than it can prove.
-        const total = countOrNull(b.total_hits) ?? kept.length;
-        for (const r of kept.slice(0, BAND_QUERY_CAP)) enumerated.push(r);
-        crowds.push({
-          query, total_hits: total, fetched: BAND_QUERY_CAP, sample: [],
-          reason: `one query returned ${kept.length} record(s), over the ${BAND_QUERY_CAP}-record ceiling any single query may add to this band; the first ${BAND_QUERY_CAP} are carried and the rest are disclosed here as a crowd rather than enumerated`,
-          ...(typeof b.qid === "string" && b.qid ? { qid: b.qid } : {}),
-        });
-      } else {
-        for (const r of kept) enumerated.push(r);
-      }
+      for (const r of recs) { if (r && typeof r === "object" && !Array.isArray(r)) enumerated.push({ ...r, ...prov }); }
     } else {
       // count-first rescue (2026-07-10, copper-lattice): a crowd descriptor may carry per-term truth —
       // `term_counts` (each term's tool-derived count + disposition) and the fully-enumerated tractable

package/driver/ordinary-words.mjs

@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+// ordinary-words.mjs — the impure edge of the one-letter neighbourhood rule: it reads the word list off disk.
+//
+// form-neighbourhood.mjs is PURE and takes the list as a Set; this is the one place that turns the file into
+// that Set, so there is one reading of it and not one per caller. The file's own header states its source,
+// its date and its licence; lines starting with `#` are that header and are skipped.
+//
+// A LIST THAT WILL NOT LOAD REMOVES NOTHING. The rule only ever takes queries away, so the safe failure is an
+// empty Set — every neighbour searched, exactly as before the rule existed — and the caller is told, so the
+// run record can say the rule did not apply rather than read as a mark with no ordinary-word neighbours.
+
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+/** Where each language's list lives. English only; other markets add a file and a key. */
+export const WORD_LIST_PATHS = Object.freeze({ en: join(HERE, "wordlists", "en.txt") });
+
+/** Parse a list file's text into a Set of lowercase words. PURE. */
+export function parseWordList(text) {
+  const out = new Set();
+  for (const line of String(text ?? "").split("\n")) {
+    const w = line.trim();
+    if (!w || w.startsWith("#")) continue;
+    out.add(w.toLowerCase());
+  }
+  return out;
+}
+
+const cache = new Map();
+
+/**
+ * The ordinary-word Set for a language, read once per process.
+ * @returns {{ words: Set<string>, error: string|null }}
+ */
+export function loadOrdinaryWords(lang = "en") {
+  if (cache.has(lang)) return cache.get(lang);
+  const p = WORD_LIST_PATHS[lang];
+  let r;
+  if (!p) r = { words: new Set(), error: `no word list for language "${lang}"` };
+  else {
+    try { r = { words: parseWordList(readFileSync(p, "utf8")), error: null }; }
+    catch (e) { r = { words: new Set(), error: `word list ${lang} unreadable: ${String(e?.message ?? e).slice(0, 120)}` }; }
+    if (!r.error && !r.words.size) r = { words: r.words, error: `word list ${lang} holds no words` };
+  }
+  cache.set(lang, r);
+  return r;
+}

package/driver/outbox-backoff.mjs

@@ -15,7 +15,7 @@
 //            sendPending with no .sent, so a lost/given-up marker (or an overnight finish) is retried
 //            on the prelim-outbox.timer cadence independent of heartbeat activeHours.
 //
-// TIGHT-LOOP INVARIANT (load-bearing): prelim-outbox.path is PathExistsGlob=…/prelim-outbox/*.pending —
+// TIGHT-LOOP INVARIANT (load-bearing): prelim-outbox.path is PathExistsGlob=…/clearance-outbox/*.pending —
 // level-triggered, so a RETAINED marker re-triggers the service the moment it deactivates. The backoff
 // sidecars therefore live in <outbox>/backoff/ — a subdirectory the glob can never match (`*` does not
 // cross `/`, and "backoff" has no .pending suffix; inotify on the outbox dir doesn't recurse either) —
@@ -26,7 +26,7 @@
 // ("due" / "retry 300") — a broken helper must degrade to retried wakes, never to lost deliveries.
 
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { join, basename } from "node:path";
+import { join, basename } from "node:path"; import { studioDirFor } from "../shared/pre-rename-spellings.mjs";
 import { fileURLToPath } from "node:url";
 import { config } from "./driver.config.mjs";
 import { atomicWrite } from "./progress.mjs";
@@ -130,20 +130,35 @@ export function settleWake(agent, { code, stdout }, now = Date.now()) {
 // Which *.pending markers currently route to <agent>? Mirrors deliver-trigger.sh's grouping exactly: a
 // JSON packet carries an "agent" field; a legacy delivered marker's first-line body IS the agent id.
 export function markersForAgent(agent) {
-  let names = [];
-  try { names = readdirSync(config.outboxDir).filter((f) => f.endsWith(".pending")); } catch { return []; }
+  // BOTH DIRECTORIES, AND THE OLD ONE IS NOT OPTIONAL. The default outbox was renamed with the `clearance`
+  // identifier; a box that never pinned `CLEAROTRON_OUTBOX_DIR` still has markers under the old name.
+  // Reading only the new directory would leave them there for ever, and each one is a report a client
+  // is owed — with nothing to see, because an outbox nobody reads looks exactly like an empty one.
+  // Each marker keeps the path it was found at, so an ack removes the file that actually exists.
   const out = [];
-  for (const file of names.sort()) {
-    let raw;
-    try { raw = readFileSync(join(config.outboxDir, file), "utf8"); } catch { continue; } // raced an ack — skip
-    let who = null, kind = "delivered";
-    if (raw.trimStart().startsWith("{")) {
-      try { const j = JSON.parse(raw); who = j.agent != null ? String(j.agent) : null; kind = j.kind != null ? String(j.kind) : "delivered"; }
-      catch { who = null; }
-    } else {
-      who = raw.split("\n")[0].trim();
+  // THE SECOND DIRECTORY IS SKIPPED WHEN IT IS THE FIRST ONE. The two accessors answered the same path
+  // once, and this loop then listed every marker twice — the same file handed out as two pieces of work,
+  // with the strike count that quarantines a stuck marker counting each wake twice. A guard rather than a
+  // dedupe at the end: two directories that are the same directory is a configuration fact worth costing
+  // nothing, and a dedupe would also hide a genuine duplicate filename across two real directories.
+  const seen = new Set();
+  for (const dir of [config.outboxDir, config.legacyOutboxDir]) {
+    if (!dir || seen.has(dir)) continue;
+    seen.add(dir);
+    let names = [];
+    try { names = readdirSync(dir).filter((f) => f.endsWith(".pending")); } catch { continue; }
+    for (const file of names.sort()) {
+      let raw;
+      try { raw = readFileSync(join(dir, file), "utf8"); } catch { continue; } // raced an ack — skip
+      let who = null, kind = "delivered";
+      if (raw.trimStart().startsWith("{")) {
+        try { const j = JSON.parse(raw); who = j.agent != null ? String(j.agent) : null; kind = j.kind != null ? String(j.kind) : "delivered"; }
+        catch { who = null; }
+      } else {
+        who = raw.split("\n")[0].trim();
+      }
+      if (who === agent) out.push({ file, path: join(dir, file), kind });
     }
-    if (who === agent) out.push({ file, path: join(config.outboxDir, file), kind });
   }
   return out;
 }
@@ -188,7 +203,7 @@ function* eachRunDir() {
   let workspaces = [];
   try { workspaces = readdirSync(config.workspaceRoot).filter((n) => n.startsWith("workspace-")); } catch { return; }
   for (const ws of workspaces) {
-    const studio = join(config.workspaceRoot, ws, "studio", "prelim-search");
+    const studio = studioDirFor(join(config.workspaceRoot, ws));
     let slugs = [];
     try { slugs = readdirSync(studio); } catch { continue; }
     for (const slug of slugs) {
@@ -311,7 +326,7 @@ export function rescanOwedRuns() {
   let workspaces = [];
   try { workspaces = readdirSync(config.workspaceRoot).filter((n) => n.startsWith("workspace-")); } catch { return dropped; }
   for (const ws of workspaces) {
-    const studio = join(config.workspaceRoot, ws, "studio", "prelim-search");
+    const studio = studioDirFor(join(config.workspaceRoot, ws));
     let slugs = [];
     try { slugs = readdirSync(studio); } catch { continue; }
     for (const slug of slugs) {

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.2-beta.8",
+  "version": "0.3.2-beta.9",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/partial-payload-baseline.json

@@ -59,7 +59,7 @@
       "why": "a caption-only call renders 149B, clears the 120-char floor, and ships a SECTION OF THE CLIENT'S ONE REPORT without the 'Checks we ran' bullets, the methodology or the handling note. Traced: report-overview.md is the head of report.md (assembleReportMd() in pipeline.mjs) which renders to the HTML (publish/index.mjs:649 publishReport). The 'Only you can close these' register is NOT lost — it is code-built from findings.json under spec 64's 'code wins' ruling."
     },
     {
-      "tool": "record_prelim_variants",
+      "tool": "record_clearance_variants",
       "fields": [
         "incumbent_classes",
         "watchlist_owners",
@@ -84,7 +84,7 @@
       "why": "the schema the seat is handed declares `fields` REQUIRED and acceptBlindFrame takes a call without it — the goods/on-field half of the cold threat model"
     },
     {
-      "tool": "record_prelim_variants",
+      "tool": "record_clearance_variants",
       "fields": [
         "elements",
         "scope_ledger"