clearotron 0.3.2-beta.8 → 0.3.2-beta.9

package/driver/placement-form.mjs

@@ -178,7 +178,83 @@ export function omittedFromRender(rows) {
   const list = Array.isArray(rows) ? rows : (rows?.rows ?? []);
   return list.filter((r) => !rowIsSettled(r, r))
     .map((r) => ({ row_id: r?.row_id ?? null, kind: r?.kind ?? null, select: selectionOf(r), mark: r?.mark ?? null,
-      missing: [!seatFields(r).tier ? "tier" : null, !seatFields(r).reason ? "reason" : null].filter(Boolean) }));
+      missing: [!seatFields(r).tier ? "tier" : null, !seatFields(r).reason ? "reason" : null].filter(Boolean),
+      // WHY, in the parser's own token. `missing` names only the two judgement fields, so a row refused on a
+      // fact the DRIVER copies — an owner the register never supplied — read as an omission with no cause
+      // at all, `missing: []`. That is how 141 tiered rows sat outstanding for a day with nobody able to say
+      // why: the answer was one parser call away and nothing made it.
+      cause: seatRefusal(r) ?? registerFactRefusal(r),
+      owed_by: seatRefusal(r) ? "seat" : "register" }));
+}
+
+// The parser tokens that speak about a fact the driver COPIES onto a register row — mark, owner,
+// jurisdiction, records all come from the canonical row (renderEntry), never from the seat. On a SEAT row the
+// same four are the seat's own writing.
+const REGISTER_FACT_TOKENS = new Set(["placement_mark_missing", "placement_owner_missing",
+  "placement_jurisdiction_invalid", "placement_records_invalid"]);
+const tokenOf = (e) => String(e?.message ?? e).split(/[:=\s(]/)[0] || "placement_invalid";
+// Stand-ins that every driver-fact check accepts, so a check of the JUDGEMENT alone cannot be refused on a
+// driver fact. They never reach a rendered file: this is a probe of the parser, not an entry.
+const FACTS_PRESENT = Object.freeze({ mark: "-", owner: "-", jurisdiction: "", records: [] });
+
+/**
+ * The seat's part of a row, refused — or null when the seat has done its part. On a register row that is
+ * the judgement alone (tier, reason, borderline), probed with the driver's facts stood in; on a seat row it
+ * is the whole row, because the seat wrote all of it. PURE; never throws.
+ */
+export function seatRefusal(row) {
+  try {
+    validatePlacement(renderEntry(row?.kind === "register" ? FACTS_PRESENT : row, row), 0);
+    return null;
+  } catch (e) { return tokenOf(e); }
+}
+
+/**
+ * The register's part of a register row, refused — or null. A fact the register did not supply (no owner on
+ * the record) is not something a corrective turn can repair: the seat is told not to type these fields and
+ * anything it types is ignored. Null on a seat row. PURE; never throws.
+ */
+export function registerFactRefusal(row) {
+  if (row?.kind !== "register") return null;
+  try {
+    validatePlacement(renderEntry(row, { tier: PLACEMENT_TIERS[0], reason: "register fact probe" }), 0);
+    return null;
+  } catch (e) { const t = tokenOf(e); return REGISTER_FACT_TOKENS.has(t) ? t : null; }
+}
+
+/**
+ * What a placement pass recorded, split by who owes each gap. The gate reads this; so does the run record.
+ *
+ *   unjudged            rows whose seat part the parser refuses — the seat owes them, a corrective turn can
+ *                       repair them, and a pass that leaves any is not a completed pass.
+ *   register_selected   register candidates the seat selected.
+ *   register_rendered   of those, how many reach placements.json.
+ *   register_facts      rows judged by the seat and still refused on a fact the register did not supply,
+ *                       counted by cause. A register that publishes no owner for a record is a real and
+ *                       ordinary case (measured: single records at offices that do not publish one), so a
+ *                       handful are recorded, not refused.
+ *
+ * `register_selected > 0 && register_rendered === 0` is the other refusal: a pass that tiered register
+ * candidates and delivered none of them has not made a judgement about the register, it has lost one. That
+ * is the shape of a register whose rows reach the fold without a field every placement needs. PURE.
+ */
+export function placementRenderAccount(rows) {
+  const list = Array.isArray(rows) ? rows : (rows?.rows ?? []);
+  const unjudged = [];
+  const registerFacts = {};
+  let registerSelected = 0, registerRendered = 0;
+  for (const r of list) {
+    if (!r || typeof r !== "object") continue;
+    const isRegister = r.kind === "register";
+    if (isRegister) registerSelected += 1;
+    const seat = seatRefusal(r);
+    if (seat) { unjudged.push({ row_id: r.row_id ?? null, kind: r.kind ?? null, select: selectionOf(r), cause: seat }); continue; }
+    if (!isRegister) continue;
+    if (rowIsSettled(r, r)) { registerRendered += 1; continue; }
+    const cause = registerFactRefusal(r) ?? "placement_invalid";
+    registerFacts[cause] = (registerFacts[cause] ?? 0) + 1;
+  }
+  return { unjudged, register_selected: registerSelected, register_rendered: registerRendered, register_facts: registerFacts };
 }
 
 /**

package/driver/placement-model.mjs

@@ -76,7 +76,7 @@ const ENTRY_KEYS = ["mark", "owner", "jurisdiction", "records", "tier", "reason"
 // decides it — a fluent, specific, entirely wrong reason passes this test, and should, because it is
 // arguable and arguing with it is the digest's job, not the parser's. B2 puts that judgment where it
 // belongs: the digest is instructed to adopt-or-counter each tier BY ENGAGING ITS STATED REASON
-// (stages.mjs + prelim-register/digest.md + synthesis-rules.md §1/§2), and narrative-refutation joins
+// (stages.mjs + clearance-register/digest.md + synthesis-rules.md §1/§2), and narrative-refutation joins
 // on the same JSON. This function only guarantees there is a reason to engage WITH. It is a floor
 // against a degenerate write, not a measure of quality, and it is deliberately the only test here that
 // looks at the reason's words at all.

package/driver/portal-report.mjs

@@ -554,8 +554,24 @@ const EMBED_JS = `
       parent.postMessage({source:TAG,type:'controls',commands:have},'*');
     }catch(e){}
   }
+  // AND WHICH SECTIONS IT HOLDS. The renderer's own breadcrumb rides inside the report's sticky header,
+  // which this file strips, so the list arrives as a value (window.__CORD_SECTIONS, written above this
+  // script) and the shell draws it in its own header. Only the ids that are really in the document are
+  // announced: a report whose renderer named a section it did not draw would otherwise offer the reader
+  // a breadcrumb entry that jumps nowhere.
+  function sections(){
+    try{
+      var list=window.__CORD_SECTIONS;
+      if(!list||!list.length)return;
+      var live=[];
+      for(var i=0;i<list.length;i++) if(document.getElementById(list[i].id)) live.push(list[i]);
+      parent.postMessage({source:TAG,type:'sections',sections:live},'*');
+    }catch(e){}
+  }
   window.addEventListener('load',controls);
   document.addEventListener('DOMContentLoaded',controls);
+  window.addEventListener('load',sections);
+  document.addEventListener('DOMContentLoaded',sections);
   window.addEventListener('load',schedule);
   document.addEventListener('DOMContentLoaded',schedule);
   document.addEventListener('toggle',schedule,true);
@@ -570,6 +586,17 @@ const EMBED_JS = `
     // A FAILED COMMAND SAYS SO. This used to be catch(err){} — a button that did nothing, told nobody,
     // and left no console trace, which is how "Export does not work" went unnoticed through a whole
     // round of testing. The portal now hears about it and can say so.
+    // A BREADCRUMB PRESS IN THE SHELL'S HEADER. Not a verb the document defines — it is the anchor jump
+    // below, asked for from outside, and it answers on the same channel: reveal any collapsed ancestor,
+    // then post the target's document-relative top for the PARENT to scroll to, because this frame has
+    // no scrollport of its own. An id that is not in the document is ignored rather than failed: the
+    // shell only ever draws ids the document announced.
+    if(d.command==='section'){
+      var sec=document.getElementById(String(d.value||''));
+      if(sec){ revealTarget(sec); var t=Math.max(0,Math.ceil(sec.getBoundingClientRect().top+window.scrollY));
+        try{parent.postMessage({source:TAG,type:'scrollTo',top:t},'*');}catch(e){} schedule(); }
+      return;
+    }
     var fn = d.command==='exportPDF' ? (typeof exportPDF==='function'?exportPDF:null)
            : d.command==='pickAll'   ? (typeof pickAll==='function'?pickAll:null)
            : d.command==='openAll'   ? (typeof openAll==='function'?openAll:null)
@@ -595,7 +622,7 @@ const EMBED_JS = `
   // Registered AFTER the document's own script by construction (this block is appended at the end of
   // <body>), so by the time it runs for an '#c<ordinal>' link the ancestors are already open and the
   // measured offset is the revealed position. preventDefault stops the frame's dead-end fragment
-  // navigation for the links the document's handler does not claim (#common-law, #only-you).
+  // navigation for the links the document's handler does not claim (#common-law, #next).
   // AND WHEN THERE IS NO PARENT, DO NOT CANCEL THE CLICK.
   //
   // Everything above is right INSIDE the portal's Result screen. Un-framed it is a dead link: parent is
@@ -630,6 +657,28 @@ const EMBED_JS = `
     try{parent.postMessage({source:TAG,type:'scrollTo',top:top},'*');}catch(e){}
     schedule();
   });
+  // A FINDING'S OWN ASK AI. The document draws the button on every finding card and the portal holds the
+  // control, so the press crosses to the parent like the anchor jump above, carrying which finding it was.
+  // A clearance numbers its findings once, in the card's id; a knockout restarts its numbers for each name,
+  // so the name's position rides beside it. The "Also considered" cards carry the button and no number —
+  // a record that was ruled out was never given one — and still post, with the number null: the parent
+  // opens the control about the report rather than leaving a button that does nothing. Un-framed there is
+  // nobody to answer, so nothing is posted.
+  document.addEventListener('click',function(e){
+    var b=e.target.closest?e.target.closest('.ask-fi'):null;
+    if(!b||!framed)return;
+    var card=b.closest('.card');
+    var whole=function(v){var n=parseInt(v,10);return String(n)===String(v)&&n>=0?n:null;};
+    var koOrd=card?card.getAttribute('data-ko-ord'):null;
+    var idOrd=card&&(card.id||'').charAt(0)==='c'?card.id.slice(1):null;
+    var ord=koOrd!==null?whole(koOrd):(idOrd!==null?whole(idOrd):null);
+    var koMark=card?card.getAttribute('data-ko-mark'):null;
+    var mi=koMark!==null?whole(koMark):null;
+    // A press that cannot reach the page must not vanish: the button would look pressed and do nothing,
+    // the same silence a broken Export once hid behind. The console is the one place left to say so.
+    try{parent.postMessage({source:TAG,type:'askAi',ordinal:ord,markIndex:mi},'*');}
+    catch(err){try{console.warn('Ask AI could not reach the page: '+(err&&err.message||err));}catch(e){}}
+  });
   schedule();
 })();
 `;
@@ -746,8 +795,42 @@ const FEEDBACK_JS = `
 // Appended at the very end of <body>: the stylesheet is inlined into <head>, so a rule placed here wins
 // the cascade on equal specificity without needing !important, and the script runs with the document's
 // own functions already defined.
-function injectEmbedLayer(html, { feedback = false } = {}) {
-  const block = `<style data-embed="portal">${EMBED_CSS}</style><script data-embed="portal">${EMBED_JS}</script>`
+/**
+ * THE SECTION BREADCRUMB, LIFTED OUT BEFORE THE HEADER GOES (owner, 2026-09-18).
+ *
+ * The renderers emit the breadcrumb INSIDE `.rep-stickyhead` — one header, one sticky surface — and this
+ * function strips that header, because the portal draws its own. So the breadcrumb has to leave the
+ * document and arrive as data: the portal draws it in `.report-head`, beside READS, where it stays on
+ * top of a six-thousand-pixel read.
+ *
+ * It could not stay in the frame whatever this stripped. The frame is sized to its content
+ * (Result.tsx), so the framed document has no scrollport of its own and `position:sticky` inside it
+ * pins to nothing — which is exactly what a reader met: a bar sitting over the confidentiality line
+ * that scrolled away with the page.
+ *
+ * READ OFF THE MARKUP THE RENDERER WROTE, never recomposed from a list of section names here. A second
+ * copy of the vocabulary is how a renderer comes to disagree with the shell about what a report holds.
+ * Returns [] for a document with no strip — `sectionStrip()` emits none under two live sections — and
+ * the shell then draws no breadcrumb, which is the right answer rather than an empty row.
+ */
+const STRIP_NAV_RE = /<nav class="[^"]*\bstrip\b[^"]*"[^>]*>([\s\S]*?)<\/nav>/i;
+const STRIP_LINK_RE = /<a\b[^>]*\bdata-sec="([^"]+)"[^>]*>([\s\S]*?)<\/a>/gi;
+export function sectionsOf(html) {
+  const nav = STRIP_NAV_RE.exec(String(html ?? ""));
+  if (!nav) return [];
+  const out = [];
+  for (const m of nav[1].matchAll(STRIP_LINK_RE)) {
+    const label = m[2].replace(/<[^>]*>/g, "").replace(/\s+/g, " ").trim();
+    if (m[1] && label) out.push({ id: m[1], label });
+  }
+  return out;
+}
+
+function injectEmbedLayer(html, { feedback = false, sections = [] } = {}) {
+  // The breadcrumb list is a VALUE the injected script reads, not markup: `<` is escaped so a label can
+  // never close the script element it rides inside.
+  const secs = JSON.stringify(sections ?? []).replace(/</g, "\\u003c");
+  const block = `<style data-embed="portal">${EMBED_CSS}</style><script data-embed="portal">window.__CORD_SECTIONS=${secs};${EMBED_JS}</script>`
     + (feedback ? `<style data-embed="feedback">${FEEDBACK_CSS}</style><script data-embed="feedback">${FEEDBACK_JS}</script>` : "");
   const i = html.lastIndexOf("</body>");
   // No </body> means markup we do not recognise; appending is still correct and still parses.
@@ -787,6 +870,10 @@ export function prepareReportForEmbed(html, { staff = false, poolRoot = null, fe
   const note = (tag) => unbalanced.push(tag);
   const missingCss = [];
 
+  // READ BEFORE ANYTHING IS STRIPPED. The breadcrumb rides inside `.rep-stickyhead`, which the chrome
+  // strip below removes, so this is the last moment it exists.
+  const sections = sectionsOf(html);
+
   const nav = stripBalanced(html, NAV_RE, "nav", note);
   let out = nav.html;
   const strippedNav = nav.removed;
@@ -865,11 +952,11 @@ export function prepareReportForEmbed(html, { staff = false, poolRoot = null, fe
 
   // After the stylesheet, so the injected rule sits later in the cascade than the sheet it overrides —
   // and after every strip, so nothing above can match the injected markup and eat it.
-  out = injectEmbedLayer(out, { feedback });
+  out = injectEmbedLayer(out, { feedback, sections });
 
   return {
     html: out, strippedNav, neutralised, mcpLeaks, tokensDropped, ratedUnderDropped, runUnderProjectDropped,
-    internalTailsDropped, reviewerCodesDropped, unbalanced, missingCss,
+    internalTailsDropped, reviewerCodesDropped, unbalanced, missingCss, sections,
   };
 }
 

package/driver/portal-service.mjs

@@ -129,7 +129,7 @@ export const allowanceExhaustedLine = (cap, who) =>
 const INSTALL_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
 
 const READ_OFF_NOTE = "Reading a brief is not available on this instance — set the search up below.";
-import { basename, dirname, join, resolve as pathResolve } from "node:path";
+import { basename, dirname, join, resolve as pathResolve } from "node:path"; import { studioDirFor } from "../shared/pre-rename-spellings.mjs";
 import { driverDir } from "../shared/driver-dir.mjs";   //
 import { createHmac, timingSafeEqual } from "node:crypto";
 import { makePrincipal, assertPrincipal, genericOrgOf, mayReadRun, reachCovers, principalView, seesEverything, mayRun,
@@ -677,7 +677,7 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, gener
   };
   // THE CANONICAL INTAKE FIRST, and it is why this parameter exists. `CLEAROTRON_QUEUE_DIR` is where the
   // enqueue CLI and ops-MCP `start_run` write — which is where the PORTAL's own submissions land, since
-  // its `trigger` is an ops-MCP hop. The walk below finds only `workspace-*/studio/prelim-search/queue`,
+  // its `trigger` is an ops-MCP hop. The walk below finds only `workspace-*/studio/clearance-search/queue`,
   // and a documented headless install has no workspaces at all: measured on the test box, the only queue
   // under the whole tree is the configured one, and it holds portal-prefixed jobs. So this scan ran ZERO
   // times there, and a submitted search was invisible on the dashboard from submit until claim — a
@@ -687,7 +687,7 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, gener
   }
   try {
     for (const ws of readdirSync(workspaceRoot).filter((n) => n.startsWith("workspace-"))) {
-      const studio = join(workspaceRoot, ws, "studio", "prelim-search");
+      const studio = studioDirFor(join(workspaceRoot, ws));
       let slugs = []; try { slugs = readdirSync(studio); } catch { continue; }
       for (const slug of slugs) {
         // Still walked, so a deployment whose queue is not in `queueDirs` keeps working. The union is
@@ -1332,7 +1332,24 @@ export function makePortalService({
         // explains a control that cannot be used, `coverageNote` qualifies one that can. Folding this
         // into the first would make every caller of `productAvailability` — the portal, the MCP door,
         // the dev cockpit — read a disclosure as a refusal, which is the behaviour the ruling removes.
-        const coverage = coverageDisclosure(l.geography, territories);
+        // ── THE PRODUCT ROWS CARRY NO COVERAGE SENTENCE ───────────────────────────────────────────
+        //
+        // This row printed a four-line paragraph — what the wired register reaches, of how many places
+        // this search can name, and that the rest would be disclosed in the report as deferred coverage
+        // rather than reported as clear. The owner met it on a running install and ruled it out on
+        // 2026-09-18: it is on no board, and it describes the behaviour that naming an unreachable
+        // territory no longer has. A named territory the register cannot reach is now refused at the
+        // door, in one sentence naming the territory — so a paragraph promising to defer it instead
+        // tells the reader the opposite of what the engine will do.
+        //
+        // NOTHING REPLACES IT, AND NO OTHER ROW GETS ONE. What a worldwide search on a partial register
+        // actually reached belongs in the report that describes the search that ran, not in the form
+        // that orders it.
+        //
+        // THE SENTENCE STILL EXISTS, one surface later, and deliberately: the review step before the
+        // spend still states what is being bought. That is a different question asked at a different
+        // moment — this row is "which search", that screen is "this is what you are committing to" —
+        // and it was a separate ruling. `coverageDisclosure` keeps composing it for that caller.
         // ── — THE PRODUCT DECLARES WHAT IT NEEDS, so the row can say so ─────
         //
         // The owner ordered the one product carrying `caseLaw: true` and first heard of the lane in the
@@ -1349,7 +1366,7 @@ export function makePortalService({
         // a warning on every deployment whose writer has not run since is worse than the silence it
         // replaces.
         return { ...l, available: cause === null, unavailableNote: cause ? UNAVAILABLE_NOTE[cause] : null,
-          coverageNote: coverage?.note ?? null,
+          coverageNote: null,
           capabilityNote: l.caseLaw && caseLawReady === false ? CASE_LAW_DARK_NOTE : null };
       }),
       // ── the TERRITORY affordance ─────────────────────────────────────────────────────────────
@@ -1742,7 +1759,7 @@ export function makePortalService({
         // The recipeKey arm that used to sit here (a 422 when saved searches were "not switched on") went
         // with CLEAROTRON_RECIPES_MODE on 2026-07-27: a saved search is now honoured wherever it resolves.
         // Asked of the RESOLVED product, not of the body: a request that names none resolves through
-        // the account's default and its own territories, and the old read (`body.searchLevel || "prelim"`)
+        // the account's default and its own territories, and the old read (`body.searchLevel || "clearance"`)
         // answered about a product nobody had chosen. `resolveFor` fails open to a null resolution, and a
         // null one is not judged here — validateJob and the scope rules below still run, and the runner
         // is the wall.
@@ -2503,8 +2520,14 @@ async function connectorDoorKind(url) {
         //
         // COMPOSED IN ONE PLACE and handed over as a string. The browser cannot know this install's
         // path, so the three surfaces stating this route cannot drift apart even if someone tries.
+        //
+        // AND IT NAMES THE DISTRIBUTION, like every other surface that states this route. Without the
+        // target this one composer answers as it does for an install that is not under WSL at all, so on
+        // a WSL box this field alone carried the inside-WSL line while the rows beside it led with the
+        // Windows-side one. Nothing draws this field today; it is on the wire, and a field that answers
+        // differently from the rows is a trap for whoever draws it next.
         const stdio = seesEverything(principal)
-          ? stdioConnectOffer({ workDir: process.env.CLEAROTRON_WORK_DIR || null, reportsDir: process.env.CLEAROTRON_REPORTS_DIR || null })
+          ? stdioConnectOffer({ workDir: process.env.CLEAROTRON_WORK_DIR || null, reportsDir: process.env.CLEAROTRON_REPORTS_DIR || null, wsl: wslTarget() })
           : null;
 
         // ── THE PAGE IS HANDED ANSWERS, NOT FACTS TO REASON FROM ─────────────
@@ -3051,7 +3074,10 @@ async function connectorDoorKind(url) {
           // who signed in. Dynamic import deliberately: `profiles.mjs` captures the store directory at
           // MODULE LOAD (see this file's note above), so it is never pulled in at our own load time.
           const { companyFactsOf } = await import("./profiles.mjs");
-          return { status: 200, json: { customers: [...profiles.values()].map((p) => ({ key: p.key, name: p.name, ...companyFactsOf(p) })) } };
+          // A company whose file would not load is named with its reason (staff-only route), never left out
+          // in silence: a switcher with one company where there were twenty-five reads as deleted work.
+          const unreadable = Array.isArray(profiles?.unreadable) ? profiles.unreadable.map((u) => ({ key: u.key, reason: u.reason })) : [];
+          return { status: 200, json: { customers: [...profiles.values()].map((p) => ({ key: p.key, name: p.name, ...companyFactsOf(p) })), ...(unreadable.length ? { unreadable } : {}) } };
         }
         // /portal/admin/config — what this deployment actually has switched on. Read from the SNAPSHOT,
         // never from process.env: this process has no engine environment, so asking its own env would

package/driver/portal-upstream.mjs

@@ -98,7 +98,7 @@ export const PATH_FIELDS = ["frameworkPath", "workedExamplesPath"];
 /**
  * The code-owned values, READ-ONLY, for display. The page shows them badged; it cannot send them.
  *
- * Two of them are PATHS INSIDE THE ENGINE — `skills/prelim-search/risk-framework-<customer>.md` — and they
+ * Two of them are PATHS INSIDE THE ENGINE — `skills/clearance-search/risk-framework-<customer>.md` — and they
  * are withheld from a client here, on the server, where the role is already in hand. The React page has
  * filtered them out of its own render since the rebuild, but a filter in the browser is a display
  * convenience and not a wall: the value still crossed the wire and was one devtools tab away.

package/driver/preserve-merge.mjs

@@ -9,7 +9,7 @@
 // the fifteen return-path transports were measured with that hole:
 //
 //   record_report_overview   actions, methodology, handling_note   (a section of the client's report)
-//   record_prelim_variants   incumbent_classes, watchlist_owners, search_floor
+//   record_clearance_variants   incumbent_classes, watchlist_owners, search_floor
 //   record_blind_frame       sources
 //   record_matter_frame      scope_jurisdictions, excluded_jurisdictions
 //   record_unit_note         null_result, note
@@ -65,8 +65,8 @@ export function refuseUndeclared(params, declared, token, path = "") {
     // does not declare it: `narrative.corrections`, accepted and dropped. That is what this refuses.
     //
     // Refusing unknown TOP-LEVEL keys as well was the first cut, and it was wrong. Real traffic carries
-    // envelope fields the tool schema does not declare — the prelim-variants mock sends
-    // `schema_version`, which `acceptPrelimVariants` ignores because it writes its OWN
+    // envelope fields the tool schema does not declare — the clearance-variants mock sends
+    // `schema_version`, which `acceptClearanceVariants` ignores because it writes its OWN
     // `schema_version: SCHEMA_VERSION` into the model. Inert for as long as it has existed, and the
     // strict version made it FATAL: the whole stage refused, the run dead, for a key nobody reads.
     //

package/driver/product-rows.mjs

@@ -25,7 +25,7 @@
 //
 // So: a third module that contaminates neither, and one place to pin.
 
-import { ORDERABLE_PRODUCTS, PRODUCT_POLICIES, RETIRED_POLICIES, policyFor } from "./search-policy.mjs";
+import { ORDERABLE_PRODUCTS, PRODUCT_POLICIES, RETIRED_POLICIES, policyFor, productKeyAsRenamed } from "./search-policy.mjs";
 import { maxNamesFor, productSpec } from "./products.mjs";
 import { leversFromResolved, turnaround, turnaroundHours } from "./effort-model.mjs";
 
@@ -96,7 +96,7 @@ export function baseTurnaroundFor(policy) {
  * exactly what shipped before.
  */
 export function productRow(key) {
-  const k = String(key ?? "").trim().toLowerCase();
+  const k = productKeyAsRenamed(key);   // a pre-rename key names the same product
   const p = PRODUCT_POLICIES[k] ?? RETIRED_POLICIES[k];
   if (!p) return null;
   const base = baseTurnaroundFor(p);

package/driver/products.mjs

@@ -405,7 +405,7 @@ export function nativeLanguageMode(product) {
  *
  * Exported because two surfaces outside this module have to say it and both used to say something else:
  * the resolution-time recommendation (jx-lanes.mjs zhScopeDepthNotes) and the DELIVERED REPORT's own
- * coverage row (pipeline.mjs scriptScopeDisclosure). Both named `prelim-jx` and `Depth 5` — an internal
+ * coverage row (pipeline.mjs scriptScopeDisclosure). Both named `clearance-jx` and `Depth 5` — an internal
  * product key and a rung on a ladder — so the coverage row named a remedy that was a product
  * deleted, quoted at a number that no longer exists, and could not have ordered either.
  *

package/driver/profiles/README.md

@@ -53,8 +53,8 @@ consumes it; a unit test greps each symbol, so a field with no live consumer fai
 | `delivery` | delivery | `{ email: "summary", privileged: bool }` — the "Privileged & Confidential" header. Two further optional sub-keys are accepted: `style` (a prose string, guarded by the same anti-rule check as a context pack, dictated into the `report-overview` and `report-card` stages as presentation tone and never to `synthesis`, the rating stage) and `template` (a report-template name; `"standard"` is the only one that exists, and it is the default). **Absent ⇒ neutral default** (`{email:"summary"}` — deliberately SILENT on `privileged`, which is three-state on every surface that reads it (`confPosture`): `true` extends the marking to "Attorney Work Product", `false` is a deliberate OFF, and absent is no opinion, which gets the plain "Privileged & Confidential" every legal deliverable carries. Saying `false` in the neutral overlay read as an instruction to strip the marking, and a Generic-default clearance shipped with no line at all). `email` no longer selects anything: every run's mail is a COVER NOTE pointing at the one report. The old `"table"` value — a full review table inlined into the mail body — is **retired**; it is still accepted at load so stored profiles keep validating, and folded to `"summary"` by `normalizeDelivery`. A customer who wants their own house format gets it drafted by the assistant from the run's `report-data.json`, where a person reads it before it goes |
 | `riskAppetite` | context | a PROSE-POSTURE string (optional) that flavours **emphasis + recommended follow-up** in delivery curation — the two stages that are dictated it, `report-overview` and `report-card` — **never the Level/Composite**. A load-time anti-threshold guard rejects numeric/threshold phrasing (`>50%`, `Level C or above`, `threshold`); the "never decides" invariance itself is gated by review |
 | `marketplaceDensity` | structural | `"sparse"` (default) \| `"dense"` — selects the per-profile grid cell budget so a byte-heavy marketplace's verbatim stdout fits the worker output channel (sparse ⇒ 98-cell budget; dense ⇒ 16). Dense fits long retail listings (beverages and supplements); gaming stores stay sparse |
-| `frameworkPath` | rating authority | optional path to the customer's OWN risk framework (`skills/prelim-search/<file>.md`, path-escape-blocked). **The framework in force RATES the matter** — the customer's own if on file, else the Generic default `risk-framework.md`; nothing in between. Each framework is a prose deck (the client's own rubric, reasoned WITH) plus a `.manifest.json` sidecar carrying its band vocabulary (`test/framework-lint.test.mjs` guards the pair). Git + legal-team gated; the config UI shows which is in force, read-only |
-| `workedExamplesPath` | context | optional path to a per-customer worked-examples set (`skills/prelim-search/<file>.md`). The analysis DEPTH TARGET in `synthesis`, calibrated under that customer's framework; **absent ⇒ the Generic default `worked-examples.md`** |
+| `frameworkPath` | rating authority | optional path to the customer's OWN risk framework (`skills/clearance-search/<file>.md`, path-escape-blocked). **The framework in force RATES the matter** — the customer's own if on file, else the Generic default `risk-framework.md`; nothing in between. Each framework is a prose deck (the client's own rubric, reasoned WITH) plus a `.manifest.json` sidecar carrying its band vocabulary (`test/framework-lint.test.mjs` guards the pair). Git + legal-team gated; the config UI shows which is in force, read-only |
+| `workedExamplesPath` | context | optional path to a per-customer worked-examples set (`skills/clearance-search/<file>.md`). The analysis DEPTH TARGET in `synthesis`, calibrated under that customer's framework; **absent ⇒ the Generic default `worked-examples.md`** |
 | `defaultProduct` | entitlement | which of the four searches runs when a request names none (`search-policy.mjs`). May be left unset, and that is not a gap — a clearance that names no product is then named by its own resolved territories |
 | `allowedRecipes[]` | entitlement | the closed menu of searches this account may trigger; non-empty when present, and **absent ⇒ everything allowed** |
 | `jxPolicy` | entitlement | the native-language deepening POSTURE — declared lanes / escalation / provider stance. Policy, never capability; frozen into the run sidecar so a resume keeps the posture the run started under |
@@ -90,7 +90,7 @@ value into a profile file is a load-time error.
    the write door: the same profile saved through the editor is a validated auto-commit with no PR in
    it, and the shared load-time validators are what both paths cannot get past.
 3. **Rewrite check:** the skills are platform-agnostic (they follow the dictated list), but read
-   `skills/prelim-common-law/SKILL.md` + `perplexity-prompts.md`, `skills/prelim-search/SKILL.md` +
+   `skills/clearance-common-law/SKILL.md` + `perplexity-prompts.md`, `skills/clearance-search/SKILL.md` +
    `phase2-execution.md`, and the driver message prose in `stages.mjs` once against the new
    industry — worked examples are gaming-flavored by history.
 4. ONE validation run against a known/synthetic matter: confirm the grid swept exactly the

package/driver/profiles/demo-brand-owner.json

@@ -17,8 +17,8 @@
   "delivery": { "email": "summary", "privileged": false },
   "riskAppetite": "Evidence-first. Lead with the register position, then say plainly what the common-law picture adds or fails to settle. Name coverage limits in the body rather than in a footnote — an unread source is a fact about the search, not a caveat about the report. Keep crowded-field noise brief.",
   "defaultProduct": "multi-country-focus-search",
-  "frameworkPath": "skills/prelim-search/risk-framework-demo.md",
-  "workedExamplesPath": "skills/prelim-search/worked-examples-demo.md",
+  "frameworkPath": "skills/clearance-search/risk-framework-demo.md",
+  "workedExamplesPath": "skills/clearance-search/worked-examples-demo.md",
   "jxPolicy": { "laneDepth": { "ja": "full", "ko": "candidates" } },
   "runCaps": { "dailyRuns": 12, "maxQueued": 2 }
 }

package/driver/profiles.mjs

@@ -346,9 +346,12 @@ export const FIELD_CONSUMERS = {
 
 // Per-customer reasoning-skill selection. frameworkPath is the customer's OWN risk framework — under doc 50
 // it RATES the matter; absent ⇒ the Generic default rates it (DEFAULT_FRAMEWORK in framework.mjs). Constrained to
-// the prelim-search skill dir + a .md suffix so a profile cannot point the synthesis read at an arbitrary
+// the clearance-search skill dir + a .md suffix so a profile cannot point the synthesis read at an arbitrary
 // path. The SHARED doctrine lives identically across the per-customer frameworks; only the examples diverge.
-const SKILL_PATH_RE = /^skills\/prelim-search\/[A-Za-z0-9._-]+\.md$/;
+// The folder's pre-rename spelling is accepted as the same folder: a store written before the rename names it,
+// and one unmigrated profile must not take a company, or the whole roster, off the list. The file is read
+// from whichever spelling the store holds (config.resolveSkillPath).
+const SKILL_PATH_RE = /^skills\/(?:clearance|prelim)-search\/[A-Za-z0-9._-]+\.md$/;
 
 // The delivery overlay every run gets. `email` is no longer a choice: every run's mail is a COVER NOTE
 // pointing at the report (one report, one shape, per-lawyer client mail drafted by the assistant).
@@ -566,11 +569,11 @@ function validateProfileShape(key, p, { sparse = false } = {}) {
     die(`marketplaceDensity must be ${MARKETPLACE_DENSITIES.map((v) => `"${v}"`).join(" or ")} `
       + `(got "${p.marketplaceDensity}")`);
   // frameworkPath / workedExamplesPath (optional, Phase 2): a per-customer reasoning-skill file. Constrained
-  // to skills/prelim-search/*.md (no path escape) — a profile selects a SHIPPED skill, never an arbitrary path.
+  // to skills/clearance-search/*.md (no path escape) — a profile selects a SHIPPED skill, never an arbitrary path.
   for (const k of ["frameworkPath", "workedExamplesPath"]) {
     if (p[k] == null) continue;
     if (typeof p[k] !== "string" || !SKILL_PATH_RE.test(p[k]) || p[k].includes(".."))
-      die(`${k} must be a path of the form "skills/prelim-search/<file>.md" (got ${JSON.stringify(p[k])})`);
+      die(`${k} must be a path of the form "skills/clearance-search/<file>.md" (got ${JSON.stringify(p[k])})`);
   }
   // defaultProduct (optional): one of the four in the offering, by id. A typo hard-fails at load rather
   // than silently running the wrong-priced product on every job.
@@ -679,25 +682,42 @@ let cache = null;
 /** Read one directory of profiles/<key>.json → Map(key → profile). No generic requirement and no
  *  matchDomains check here: both are properties of the MERGED roster, not of one layer, and asserting
  *  them per-layer would refuse a base+overlay pair that is perfectly valid once combined. */
-function readProfilesLayer(dir) {
+// ONE COMPANY THAT CANNOT BE READ MUST NOT TAKE THE OTHERS WITH IT — on the deployment's own store. Strict,
+// every file or none, is right for an explicit directory: that is how this loader's rules are checked. On the
+// configured store it refused every company over one file, and the portal then offered `generic` alone with
+// no error, so a client's clearances looked deleted. So `tolerant` isolates each file: a company that fails is
+// left out, its reason is kept on the returned map as `unreadable`, and asking for it by key refuses with that
+// reason (resolveProfile). `generic` is never tolerated: it is the fallback every unprofiled job rates under,
+// and replacing a deployment's own with the bundled one would change every such answer without a word.
+function readProfilesLayer(dir, { tolerant = false } = {}) {
   const profiles = new Map();
+  const unreadable = [];
   for (const f of readdirSync(dir).filter((n) => n.endsWith(".json")).sort()) {
     const key = f.replace(/\.json$/, "");
-    let p;
-    try { p = JSON.parse(readFileSync(join(dir, f), "utf8")); }
-    catch (e) { throw new Error(`profiles/${f}: unparseable JSON (${e.message})`); }
-    validateProfileShape(key, p);
-    // Context pack (Phase 1): a sibling `<key>.context.md`, attached AFTER validateProfileShape so the
-    // deny-unknown-key gate (which governs the JSON shape) never sees it. Optional — absent ⇒ no pack.
-    // Validated at load (rule-shape + size budget) so a bad pack fails loudly here, like riskAppetite (F8).
-    const packPath = join(dir, CONTEXT_PACK_FILE(key));
-    const contextPack = existsSync(packPath) ? readFileSync(packPath, "utf8").trim() : "";
-    if (contextPack) assertContextPackShape(contextPack, `profiles/${CONTEXT_PACK_FILE(key)}`);
-    profiles.set(key, { key, ...p, ...(contextPack ? { contextPack } : {}) });
+    try {
+      let p;
+      try { p = JSON.parse(readFileSync(join(dir, f), "utf8")); }
+      catch (e) { throw new Error(`profiles/${f}: unparseable JSON (${e.message})`); }
+      validateProfileShape(key, p);
+      // Context pack (Phase 1): a sibling `<key>.context.md`, attached AFTER validateProfileShape so the
+      // deny-unknown-key gate (which governs the JSON shape) never sees it. Optional — absent ⇒ no pack.
+      // Validated at load (rule-shape + size budget) so a bad pack fails loudly here, like riskAppetite (F8).
+      const packPath = join(dir, CONTEXT_PACK_FILE(key));
+      const contextPack = existsSync(packPath) ? readFileSync(packPath, "utf8").trim() : "";
+      if (contextPack) assertContextPackShape(contextPack, `profiles/${CONTEXT_PACK_FILE(key)}`);
+      profiles.set(key, { key, ...p, ...(contextPack ? { contextPack } : {}) });
+    } catch (e) {
+      if (!tolerant || key === "generic") throw e;
+      unreadable.push({ key, file: f, reason: String(e?.message ?? e) });
+    }
   }
+  Object.defineProperty(profiles, "unreadable", { value: unreadable, enumerable: false });
   return profiles;
 }
 
+/** The companies a roster left out because their file would not load: `[{ key, file, reason }]`. */
+export const unreadableProfiles = (profiles) => (Array.isArray(profiles?.unreadable) ? profiles.unreadable : []);
+
 /** Load every profiles/<key>.json → Map(key → profile), OVERLAY OVER BASE. Hard-fails loudly
  *  on a generic.json missing from BOTH layers (the universal fallback — its absence would mis-profile
  *  EVERY job), on a configured-but-unreadable overlay, and on any matchDomains overlap in the merged
@@ -746,7 +766,7 @@ export function loadProfiles({ dir, force = false, includeTestFixtures, includeD
   // the universal fallback the module REQUIRES by name, the thing every unprofiled job resolves to. That
   // is the one file whose absence makes an empty store a refusal, so that is the only one that falls
   // through. Everything else in a deployment's roster is the deployment's own.
-  const profiles = overlay ? readProfilesLayer(overlay) : readProfilesLayer(baseDir);
+  const profiles = overlay ? readProfilesLayer(overlay, { tolerant: true }) : readProfilesLayer(baseDir);
 
   // ── A TEST FIXTURE IS PRESENT AND NEVER OFFERED ─────────────────────────────────────────────────
   //
@@ -855,6 +875,15 @@ export function loadProfiles({ dir, force = false, includeTestFixtures, includeD
 export function resolveProfile(job, { profiles = loadProfiles() } = {}) {
   const key = String(job?.profileKey ?? "").trim();
   if (key && profiles.has(key)) return profiles.get(key);
+  // A company whose file would not load is not an unknown company: say which, and why.
+  const unread = unreadableProfiles(profiles);
+  const failed = key ? unread.find((u) => u.key === key) : null;
+  if (failed) {
+    const err = new Error(`profile_unreadable:${key} — ${failed.reason}. The company exists but its profile could not be read, `
+      + `so this run is refused rather than rated under another company's settings.`);
+    err.code = "profile_unreadable";
+    throw err;
+  }
   // A NAMED-but-unknown key is not a graceful-degradation case, it is a roster mismatch — the two
   // sides disagree about which config store is real, and falling back to `generic` silently strips
   // the client's platforms, their self-exclusion seed and the framework that RATES the matter. That
@@ -875,6 +904,15 @@ export function resolveProfile(job, { profiles = loadProfiles() } = {}) {
       if (dom === dl || dom.endsWith(`.${dl}`)) return p;
     }
   }
+  // WITH A COMPANY UNREAD, "no company matched" is not known: the unread one's domains are not in hand, and
+  // this job may be its. Falling to `generic` here is the silent wrong-company deliverable, so refuse.
+  if (unread.length) {
+    const err = new Error(`profile_roster_incomplete — ${unread.length} company profile(s) could not be read `
+      + `(${unread.map((u) => u.file).join(", ")}), so whether this job belongs to one of them cannot be decided. `
+      + `Name the company on the job, or fix the file.`);
+    err.code = "profile_roster_incomplete";
+    throw err;
+  }
   return profiles.get("generic");
 }