clearotron 0.3.2-beta.8 → 0.3.2-beta.9

package/driver/progress.mjs

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
-// progress.mjs — live run status for the prelim-search driver.
+// progress.mjs — live run status for the clearance-search driver.
 //
 // Two artifacts, both written by the driver into the FORWARDING agent's own workspace
 // (so the agent's sandboxed read tool can see them — agents can't exec, so on-demand status is a
@@ -14,7 +14,7 @@
 // blindly incremented — so the resumable pipeline can re-drive a run without corrupting either file.
 
 import { readFileSync, writeFileSync, renameSync, unlinkSync, readdirSync, statSync, existsSync } from "node:fs";
-import { join, dirname } from "node:path";
+import { join, dirname } from "node:path"; import { STUDIO_SEGMENT_RE } from "../shared/pre-rename-spellings.mjs";
 import { DRIVER_DIR } from "../shared/driver-dir.mjs";   //
 import { config } from "./driver.config.mjs";
 import { batchMarkName } from "./mark-name.mjs";
@@ -29,7 +29,7 @@ import { engineCommit, engineCommitSource } from "./engine-build.mjs";   // —
 // driver's execution units (fan-out register axes, skeptic-escalation re-runs, corrective re-synthesis,
 // two refutation passes) onto a clean forward-only sequence, so the displayed step never jumps backward.
 export const DISPLAY_STEPS = [
-  "Framing the matter",     // 1  matter-frame, prelim-variants
+  "Framing the matter",     // 1  matter-frame, clearance-variants
   "Register sweeps",        // 2  common-law + register-unit:* (fan-out + escalation re-runs collapse here)
   "Placement & digest",     // 3  placement-inquiry, register-digest (+ re-digest)
   "Skeptic review",         // 4  skeptic
@@ -48,7 +48,7 @@ export const DISPLAY_STEPS = [
 // UNLABELLED GAP on the stepper the client watches — the run looks stalled while it is working. Three
 // stages were sitting in that state (blind-frame, frame-diff, doubt-closure); each now says so by name.
 export const STAGE_TO_STEP = {
-  "matter-frame": 0, "prelim-variants": 0,
+  "matter-frame": 0, "clearance-variants": 0,
   "common-law": 1, "common-law-half": 1, "register-unit": 1,
   "placement-inquiry": 2, "register-digest": 2,
   skeptic: 3,
@@ -398,11 +398,21 @@ export function seedRunStatus(ctx, { resume = false } = {}) {
   }, null, { critical: true });   // door B — the clearance lane's identity seed, same rule
 }
 
-// Convenience: advance the run to the step for `rawStageKey` (no-op for unmapped keys) then refresh STATUS.md.
+// Record that the run is at `rawStageKey`: advance the displayed step where the stage has one, and say
+// what the run is doing either way, then refresh STATUS.md.
+//
+// AN UNMAPPED STAGE MOVES NO STEP AND IS STILL SOMETHING THE RUN IS DOING. This returned early for one,
+// so it wrote no `lastStage` at all — and `lastStage` is what status-snapshot publishes as "what the run
+// is actually doing". Three stages have no display step ON PURPOSE (STAGE_NO_STEP names each and why),
+// so for the whole of any of them every surface went on naming the PREVIOUS stage, which is the same
+// defect as a stale step wearing a different field. The step fields are still withheld — that part of
+// the early return was right, and an unmapped stage must never touch the displayed step.
 export function recordTransition(ctx, rawStageKey) {
   const step = stepForStage(rawStageKey);
-  if (!step) return;
-  writeRunStatus(ctx, { stepIndex: step.index, stepLabel: step.label, stepN: step.n, stepTotal: step.total, lastStage: rawStageKey });
+  writeRunStatus(ctx, {
+    ...(step ? { stepIndex: step.index, stepLabel: step.label, stepN: step.n, stepTotal: step.total } : {}),
+    lastStage: rawStageKey,
+  });
   rollupStatus(ctx?.run?.studioRoot);
 }
 
@@ -424,7 +434,7 @@ function findStatusFiles(root, depth, acc) {
 }
 
 function agentFromStudioRoot(studioRoot) {
-  const m = new RegExp(`${config.workspacePrefixRe}([^/]+)/studio/prelim-search/?$`).exec(studioRoot ?? "");
+  const m = new RegExp(`${config.workspacePrefixRe}([^/]+)/studio/${STUDIO_SEGMENT_RE}/?$`).exec(studioRoot ?? "");
   return m ? m[1] : "";
 }
 

package/driver/provider-usage.mjs

@@ -14,9 +14,9 @@
 //
 // This module is read-only and defensive: a missing/unreadable ledger or a torn last line (two gateway
 // turns appending concurrently) returns zeros / skips that line — it never throws. The driver calls it at
-// publish time to attribute THIS run's calls by the session-key prefix `prelim-<slug>-<codename>-`.
+// publish time to attribute THIS run's calls by the session-key prefix `clearance-<slug>-<codename>-`.
 
-import { readFileSync, existsSync } from "node:fs";
+import { readFileSync, existsSync } from "node:fs"; import { runPrefixSpellings } from "../shared/pre-rename-spellings.mjs";
 // Aliased: three functions below take a parameter literally named `ledgerPath`, and an unaliased
 // import would be shadowed by it inside its own default-value expression (a TDZ ReferenceError
 // at the first call, not at load).
@@ -46,7 +46,7 @@ export const DEFAULT_LEDGER_PATH = resolveLedgerPath("call");
 export const KINDS = ["search", "record_fetch", "image", "phoneme", "batch_screen", "enumerate", "execute_plan", "propose_supplemental"];
 
 // The gateway namespaces the driver's --session-key as `agent:<agentId>:<key>` before it reaches the
-// plugin (confirmed on the first live run: sessionKey = `agent:clawdi:prelim-<slug>-<codename>-…`). Strip
+// plugin (confirmed on the first live run: sessionKey = `agent:clawdi:clearance-<slug>-<codename>-…`). Strip
 // that leading `agent:<id>:` namespace so the run prefix anchors at the real start of the caller's key —
 // otherwise a bare startsWith("clearotron-…") matches nothing.
 function stripGatewayNs(s) {
@@ -54,11 +54,11 @@ function stripGatewayNs(s) {
 }
 
 // Does this ledger row belong to the run identified by `runPrefix`? The driver's --session-key is
-// `prelim-<slug>-<codename>-<stage><axis>` (+ optional `-rerunN`), so a prefix match catches every stage +
+// `clearance-<slug>-<codename>-<stage><axis>` (+ optional `-rerunN`), so a prefix match catches every stage +
 // axis + retry of the run. We check sessionKey (carries the key) and, defensively, sessionId.
 function rowMatchesRun(row, runPrefix) {
-  return stripGatewayNs(row.sessionKey).startsWith(runPrefix)
-      || stripGatewayNs(row.sessionId).startsWith(runPrefix);
+  return runPrefixSpellings(runPrefix).some((rp) => stripGatewayNs(row.sessionKey).startsWith(rp)
+      || stripGatewayNs(row.sessionId).startsWith(rp));   // either spelling: a run resumed across the rename
 }
 
 // ── band-truth gate (2026-07-14, teal-foundry): count the ledger rows attributed to ONE unit lane ──────
@@ -146,7 +146,7 @@ function emptyTally() {
 /**
  * Tally every ledger line whose gateway id starts with `runPrefix`.
  * @param {string} ledgerPath  path to the JSONL ledger
- * @param {string} runPrefix   e.g. `prelim-acme-bluejay-` (note the trailing hyphen)
+ * @param {string} runPrefix   e.g. `clearance-acme-bluejay-` (note the trailing hyphen)
  * @returns {object} the tally (see emptyTally) — never throws
  */
 export function tallyRegisterCalls(ledgerPath = DEFAULT_LEDGER_PATH, runPrefix) {
@@ -208,7 +208,7 @@ export function tallyRegisterCalls(ledgerPath = DEFAULT_LEDGER_PATH, runPrefix)
  * (missing/unreadable ledger or a torn last line ⇒ skips that line, never throws). A cache_hit record_fetch
  * still counts — the URI WAS fetched this run, which is exactly what the gate asks.
  * @param {string} ledgerPath  path to the JSONL ledger
- * @param {string} runPrefix   e.g. `prelim-acme-bluejay-` (note the trailing hyphen)
+ * @param {string} runPrefix   e.g. `clearance-acme-bluejay-` (note the trailing hyphen)
  * @returns {Set<string>} the set of fetched record URIs
  */
 export function fetchedRecordUris(ledgerPath = DEFAULT_LEDGER_PATH, runPrefix) {

package/driver/publish/index.mjs

@@ -16,7 +16,7 @@ import { buildAudit } from './xlsx.mjs';
 import { parseFindingsJson, parseFindingsJsonLenient, deriveDisplayVerdict, joinFindingToBlock, CLIENT_TIER_BY_COMPOSITE, projectCoverageJudgment } from '../findings-model.mjs';
 import { readStore, requiredAbsent, nonClosingAbsences } from './publish-inputs.mjs';   // — and why an absence did not close
 import { clearanceReportData } from './report-data.mjs';
-import { searchDepthRecord } from './search-depth.mjs';   // how much was read to reach the answer, as counts and tokens
+import { searchDepthRecord, planTerritoriesOf } from './search-depth.mjs'; import { bandRecords } from '../named-band.mjs';   // how much was read to reach the answer, as counts and tokens
 import { parseFrameworkManifest } from '../framework.mjs';
 import { rollupTokens, servedModels } from '../tokens.mjs';
 import { reportIdentityFor, productCoverageNote, isRegisterOnly } from '../search-policy.mjs';
@@ -817,6 +817,61 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
         reasons: droppedConditions.map((c) => c.note) });
     } catch { /* the workbook row is the record that matters; this line is the second copy */ }
   }
+  // ── THE CHECKS THE RUN DECIDED ON AND DID NOT MAKE ─────────────────────────────────────────────
+  //
+  // The recall net mints a probe per remembered conflict and a probe per owner behind one, then
+  // dispatches at most five owner probes. The excess is recorded in the run's own receipt and nothing
+  // downstream carried it to a reader, so a search that decided on nineteen ownership checks, made five
+  // and said nothing about the other fourteen read as a search that made the checks it wanted.
+  //
+  // The cap is not the defect: it is deliberate and the rows it drops are ranked material-first, so the
+  // five that run are the five that matter most. What was missing is the disclosure, and it lands where
+  // the 2026-09-17 ruling put the same class of fact — an ordinary row on the workbook's gaps sheet and
+  // one line in the run record. Nothing reaches the report page: the approved boards draw a forward
+  // decision and an open question back to the client, and a check nobody made is neither.
+  //
+  // THE WORDS ARE THE RECEIPT'S OWN. The party and the probe id are read from it verbatim; "over the
+  // cap" and "never dispatched" are the vocabulary the ask ledger already ships for these same rows.
+  // Nothing here composes a sentence, and the note carries no seam, so the gaps sheet's own splitter
+  // leaves "What was done" empty — which is the fact: nothing was done.
+  // READ THROUGH THE DECLARED HELPER, three states and not two. An absent receipt is a run whose recall
+  // net minted nothing — env-gated off, or a matter with no remembered conflict — and there is nothing
+  // to disclose. A DAMAGED one is a different fact: the probes may have overflowed and this publish
+  // cannot tell, so it says so in the run record instead of shipping the same empty sheet an
+  // everything-dispatched run ships. Collapsing those two is the defect publish-inputs.mjs exists for.
+  //
+  // NOT PUSHED ONTO `inputsAbsent`. That list rides meta.json's clientGate record, whose own note two
+  // hundred lines down is that it stays undefined when every store was found so a complete run's meta
+  // is byte-identical to one written before the list existed. Most runs have no recall receipt, so
+  // adding this store to it would change the meta of every archived run on re-render for a store that
+  // feeds a workbook row and not the gate -- the same reason the other presentation-only stores are
+  // not on it either.
+  // `runDir ?? dirname(reportMd)`, the same base its neighbours take and not a defensive flourish:
+  // publishReport's `runDir` is OPTIONAL, and a bare `readStore(runDir, …)` throws TypeError on an
+  // undefined base rather than reporting an absent store. Caught in CI by the graceful-stop runner arm,
+  // which publishes without one: the throw left publishReport at `published → null` and the runner
+  // exited 1. Reading from the report's own directory is also the right answer for a republish.
+  const recallStore = readStore(runDir ?? dirname(reportMd), '_driver/register-recall.json');
+  const undispatchedProbes = (recallStore.value?.overflow ?? [])
+    .filter((o) => o && (o.term || o.qid))
+    .map((o) => ({
+      area: String(o.term ?? o.qid),
+      state: 'not-searched',
+      note: `over the cap, never dispatched (${String(o.qid ?? 'no probe id recorded')})`,
+    }));
+  if (recallStore.state === 'damaged' && runDir) {
+    try {
+      runLog(runDir, { event: 'probe-over-cap-unreadable', store: recallStore.name, error: recallStore.error });
+    } catch { /* best-effort, as below */ }
+  }
+  // Best-effort, as above: a publish never fails for want of a log line.
+  if (undispatchedProbes.length && runDir) {
+    try {
+      runLog(runDir, { event: 'probe-over-cap-undispatched', n: undispatchedProbes.length,
+        parties: undispatchedProbes.map((p) => p.area) });
+    } catch { /* the workbook row is the record that matters; this line is the second copy */ }
+  }
+
   // doc 50 — the run's FROZEN framework manifest (band vocabulary). Present on band-doctrine runs;
   // absent on every archived run (they render byte-identically on the legacy paths).
   let framework = null;
@@ -845,11 +900,25 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   // two must not render the same way. Null on archived runs ⇒ render keeps the prose fallback.
   let scopeBasis = null;
   let searchedJurisdictions = [];
+  // WHAT WAS SEARCHED IS THE PLAN'S ANSWER, NOT THE ARCHIVE'S, and it is carried separately from the
+  // header's list below because the two are used for different things and one of them is deliberately
+  // emptied. The coverage presentation asks which territories the run searched and which it could not
+  // reach; the plan compiles both — entries carry the regions it will query, `deferred_coverage` carries
+  // the ones this provider does not cover with the reason each. A register that archives no records
+  // still has both, which is the whole point: keyed off the record store, a provider that keeps nothing
+  // looked like a provider nobody asked.
+  //
+  // THREE-VALUED like the record listing above it: null means there is no plan to read, so the run
+  // cannot say — an archived or legacy run — and it must not be confused with a plan that named nothing.
+  let planTerritories = null;
   try {
     const plan = JSON.parse(readFileSync(driverDir(runDir ?? dirname(reportMd), 'register-plan.json'), 'utf8'));
     if (plan?.scope_basis === 'worldwide') scopeBasis = 'worldwide';
     searchedJurisdictions = [...new Set((plan?.entries ?? []).flatMap((e) => Array.isArray(e.regions) ? e.regions : []))];
     if (!searchedJurisdictions.length && Array.isArray(plan?.regions)) searchedJurisdictions = [...new Set(plan.regions)];
+    // Derived here, BEFORE the worldwide clearing below — that clearing exists for the header and would
+    // otherwise empty this on exactly the runs that cover the most ground.
+    planTerritories = planTerritoriesOf(plan);
   } catch { /* no plan sidecar — try the instructed scope */ }
   if (!searchedJurisdictions.length) {
     try {
@@ -1065,7 +1134,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
       // the same rule (the workbook's own BANNED gate had already started firing on the raw detail —
       // advisory, so CI stayed green). reviewReceipts.lint keeps its raw detail for the internal
       // readers above (fetchState reads registry-record-coverage's URIs out of it).
-      counts = await buildAudit({ droppedConditions, findings, coverage, contextNotes, coverageJudgment, markAssessment, corrections: correctionsDoc, fetchState, verdict: verdictInfo, jurisdiction, commonLawJoinedTerms, registerOnly, clientGate, lintFailures: deliveryFlagLines(reviewReceipts.lint), productName, registerPublishesRecordPages: runOrigins == null ? null : runOrigins.length > 0, recordLinks: officeLinks?.byUri ?? null }, auditParsed, join(poolRunDir, auditFile), fm.title, fm);
+      counts = await buildAudit({ droppedConditions, undispatchedProbes, findings, coverage, contextNotes, coverageJudgment, markAssessment, corrections: correctionsDoc, fetchState, verdict: verdictInfo, jurisdiction, commonLawJoinedTerms, registerOnly, clientGate, lintFailures: deliveryFlagLines(reviewReceipts.lint), productName, registerPublishesRecordPages: runOrigins == null ? null : runOrigins.length > 0, recordLinks: officeLinks?.byUri ?? null }, auditParsed, join(poolRunDir, auditFile), fm.title, fm);
       grpRead(join(poolRunDir, auditFile), 0o640);
       if (counts?.gateViolations?.length) console.warn(`[audit-workbook] advisory: ${counts.gateViolations.join(' | ')}`);
     } catch (e) {
@@ -1098,6 +1167,35 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   // pattern — a run with no grid or no case-law layer still gets its register counts, and the absent
   // ones report themselves as zero or `not-in-scope` rather than as a gap nobody can see.
   let searchDepth = null;
+  // HOW DEEP THE LOCAL-LANGUAGE INVESTIGATION WENT, and it is derived by the one author of that
+  // question rather than re-read here. The import is LAZY and gated on the run's own sidecar existing,
+  // which keeps the property the pipeline's own fold keeps: a plain clearance never loads the jx
+  // machinery at all. No sidecar means the component never ran, which the fold reports as not-in-scope.
+  let laneDepthVerdicts = null;
+  try {
+    const jxSidecar = driverDir(runDir ?? dirname(reportMd), 'jx-lanes.json');
+    if (existsSync(jxSidecar)) {
+      const sidecar = JSON.parse(readFileSync(jxSidecar, 'utf8'));
+      const { laneDepthOfRun } = await import('../jx.mjs');
+      let units = null;
+      try { units = JSON.parse(readFileSync(driverDir(runDir ?? dirname(reportMd), 'jx/units.json'), 'utf8')); } catch { /* the statement handles an absent units file */ }
+      // THE RUN ALREADY ANSWERED THIS, AND THE STAMPED ANSWER IS THE ONE THAT COUNTS.
+      //
+      // `deriveJxSliceStatement` writes `fold.depth` at delivery, from the run's OWN environment, for the
+      // reason the seam exists at all: the arms are environment, so a verdict derived later can only speak
+      // for the box it is derived on. Publishing re-derived it here — a second author for a fact the run
+      // had already stated — and the two disagreed on a delivered client report.
+      //
+      // The disagreement was not subtle. This call passed `deriveJxSliceStatement`'s whole return,
+      // `{executes, slices}`, where the function reads `slices.candidates` — so the lookup found nothing,
+      // every lane's `ran` came back null whatever it had really done, and a full-country JP run that
+      // searched in Japanese printed "Local-language investigation · Not run this run". The stamped
+      // verdict on the same run's sidecar said `ran: "candidates"`, correctly.
+      //
+      // So: read what the run stated, and derive only for a run delivered before the stamp existed.
+      laneDepthVerdicts = laneDepthOfRun({ sidecar, units });
+    }
+  } catch { /* an unreadable sidecar reports as not-in-scope rather than failing a publish */ }
   try {
     const runBase = runDir ?? dirname(reportMd);
     const recDir = join(runBase, '_records');
@@ -1106,15 +1204,22 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
     searchDepth = searchDepthRecord({
       auditMd: (auditMd && existsSync(auditMd)) ? rdText(auditMd) : '',
       recordIndex: recordsByUri ?? {},
-      recordFileNames: existsSync(recDir) ? readdirSync(recDir) : [],
+      // null, NOT []: a run whose provider archives no records has no `_records/` at all, and an empty
+      // array is a register that was searched and returned nothing. They are different facts and the
+      // page says different things about them, so the distinction this line already computes is kept
+      // rather than thrown away one character later.
+      recordFileNames: existsSync(recDir) ? readdirSync(recDir) : null,
+      // …and where there is no archive, what the register returned: the band's own record ids.
+      bandRecordIds: existsSync(recDir) ? null : (() => { try { const b = rdJson(join(runBase, 'register-named-band.json')); return b ? bandRecords(b).map((r) => r?.record_id).filter(Boolean) : null; } catch { return null; } })(),
       commonLawGrid: rdJson(join(runBase, 'common-law-grid.json')),
       caseLawText: rdText(join(dirname(reportMd), 'case-law-findings.md')),
       registerPlan: rdJson(driverDir(runBase, 'register-plan.json')),
+      laneDepthVerdicts,
     });
     writeRO('search-depth.json', JSON.stringify(searchDepth, null, 2));
   } catch { /* the depth record is additive — a publish never fails for want of it */ }
 
-  writeRO('report.html', renderHtml(parsed, findings, coverage, { demoData, servedModels: served, productName, depthNote, scopeBasis, auditFile: auditFile || undefined, runId, delivery: deliv, recordsByUri, contextNotes, coverageJudgment: coverageJudgmentDisplay, markAssessment, fourAnswers, homeHref: '../index.html', nav: reportNav, chromeHref: '../assets/chrome.css', issued, asOf, verdictInfo, framework, searchedJurisdictions, caseLawByOrdinal, caseLawNotice, enforcerSignals, recordOrigin, recordOrigins: runOrigins, recordCitation: runProviderConf?.recordCitation ?? null, recordLinks: officeLinks?.byUri ?? null, providerLabel, seniorRights, findingsSchemaVersion, searchDepth }));
+  writeRO('report.html', renderHtml(parsed, findings, coverage, { demoData, servedModels: served, productName, depthNote, scopeBasis, auditFile: auditFile || undefined, runId, delivery: deliv, recordsByUri, contextNotes, coverageJudgment: coverageJudgmentDisplay, markAssessment, fourAnswers, homeHref: '../index.html', nav: reportNav, chromeHref: '../assets/chrome.css', issued, asOf, verdictInfo, framework, searchedJurisdictions, planTerritories, caseLawByOrdinal, caseLawNotice, enforcerSignals, recordOrigin, recordOrigins: runOrigins, recordCitation: runProviderConf?.recordCitation ?? null, recordLinks: officeLinks?.byUri ?? null, providerLabel, seniorRights, findingsSchemaVersion, searchDepth }));
   // ONE report (spec 2026-07-30 §5): report.client.html is no longer written. The knockout lane's own
   // collapse note is the precedent: "two renderings of one run is how the wrong link gets sent". The
   // client host serves the same report.html through the portal's readReport() (cleaning built in) — its
@@ -1486,7 +1591,7 @@ export function composeEmailBody(reportMdPath, url, auditFile, productName = nul
 const FONT = "font-family:Calibri,'Segoe UI',Arial,sans-serif";
 
 // 5-tier reporting-template risk scheme — the whole left "NAME / RISK RATING" cell takes the bg colour.
-// Matches skills/prelim-search/templates/search-request-form.html + knockout-searches/template-formatting.md.
+// Matches skills/clearance-search/templates/search-request-form.html + knockout-searches/template-formatting.md.
 // `txt` = a readable text-colour version of the tier (for the EXECUTIVE SUMMARY risk phrase, where a bright
 // fill like yellow/red is unreadable as text). Order matters: VERY HIGH before HIGH.
 export const RISK_TIERS = [

package/driver/publish/knockout.mjs

@@ -7,14 +7,14 @@
 // self-reported trail), meta.json batch stamps, and the email composer. Deliberately separate from publishReport (single-clearance-shaped); shares the exported
 // palette (TONE_TIER, resolved against the run's FROZEN framework) so driver and interactive output
 // can never drift and a knockout never reads the clearance composer's module state.
-import { readFileSync, writeFileSync, mkdirSync, chmodSync, existsSync } from 'node:fs';
+import { readFileSync, writeFileSync, copyFileSync, mkdirSync, chmodSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { driverDir, ensureDriverDir } from '../../shared/driver-dir.mjs';   //
 import { riskTier, TONE_TIER, regenIndex, regenSurfaces, auditRouteFor, markReportRouteFor, reportRouteFor } from './index.mjs';
 import { runKnockoutLint, deliveryFlagLines } from '../predelivery-lint.mjs';
 import { note } from '../log.mjs';
 import { addSheet } from './xlsx.mjs';
-import { COUNT_PREDICATES, COUNT_BASIS, countsForMark, countLine, countedMarks, variantFormsLine } from '../register-count.mjs';
+import { COUNT_PREDICATES, COUNT_BASIS, countsForMark, countLine, countedMarks, variantFormsLine, disclosedFloor, moreThan } from '../register-count.mjs';
 import { RECORD_BASIS, recordsForMark, recordsLine, listedMarks, normalizeRegisterRecordLinks } from '../register-records.mjs';
 import { reportIdentityFor, productCoverageNote, kebab } from '../search-policy.mjs';
 import { batchMarkName } from '../mark-name.mjs';
@@ -143,7 +143,8 @@ export async function buildKnockoutWorkbook(findings, receipts, outPath, registe
   if (noteRows.length) addSheet(wb, 'Working Notes', ['Mark', 'Type', 'Note'], noteRows);
 
   if (registerCounts?.marks?.length) {
-    const cell = (c) => (Number.isFinite(c?.total) ? c.total : 'not available');
+    // A floor the register disclosed is its own figure, printed as the report prints it.
+    const cell = (c) => (Number.isFinite(c?.total) ? c.total : disclosedFloor(c) !== null ? moreThan(disclosedFloor(c)) : 'not available');
     const countRows = (findings.marks ?? []).map((m) => {
       const e = countsForMark(registerCounts, m.name);
       const row = {
@@ -161,7 +162,7 @@ export async function buildKnockoutWorkbook(findings, receipts, outPath, registe
       row['Basis'] = COUNT_BASIS;
       // The verbatim provider reason for anything missing — the auditable half of "not available".
       row['Notes'] = COUNT_PREDICATES
-        .filter((p) => !Number.isFinite(e?.counts?.[p.key]?.total))
+        .filter((p) => !Number.isFinite(e?.counts?.[p.key]?.total) && disclosedFloor(e?.counts?.[p.key]) === null)
         .map((p) => `${p.label}: ${e?.counts?.[p.key]?.unavailable ?? 'no count recorded'}`)
         .join(' · ');
       return row;
@@ -335,6 +336,30 @@ export async function publishKnockout({ runId, codename, runDir, findings, plan,
   const poolRunDir = join(poolRoot, runId);
   mkdirSync(poolRunDir, { recursive: true });
   const writeRO = (name, data) => { const p = join(poolRunDir, name); writeFileSync(p, data); grpRead(p, 0o640); };
+
+  // ── THE RUN'S WORKING RECORD TRAVELS WITH THE REPORT ──────────────────────────────────────────────
+  //
+  // The delivered directory held the report, its data and the workbook, and nothing the engine itself
+  // wrote. That is what the acceptance read needs to tell a line the ENGINE wrote from a line the
+  // RENDERER invented: without it the check can still place a line as report text or as a sanctioned
+  // label, so it passes — and cannot fail in the way it exists to fail. A clearance run's record is
+  // `audit.md` and `findings.json`; this lane's own names are these two, and they are copied rather
+  // than rebuilt so the pool carries the bytes the stages wrote.
+  //
+  // AN ABSENT ONE IS SAID, NOT SKIPPED. A run whose stage never wrote its assessment is a different
+  // thing from a run that wrote one, and a publisher that copies what it finds and says nothing about
+  // what it does not makes the two look identical to the next reader — which is the whole defect this
+  // closes, one directory along.
+  for (const name of ['knockout-findings.json', 'knockout-assessment.md']) {
+    const src = join(runDir, name);
+    if (existsSync(src)) {
+      const dest = join(poolRunDir, name);
+      copyFileSync(src, dest);
+      grpRead(dest, 0o640);
+    } else {
+      note(`knockout working record: ${name} is not in the run directory, so the delivered report has no engine text to be checked against`);
+    }
+  }
   const issued = (() => {
     try {
       const d = new Date();

package/driver/publish/pool-admin.mjs

@@ -116,7 +116,7 @@ function linkHome(poolDir) {
 
 // Locate an archived run's WORKSPACE dir (the publishReport input set: raw report.md, findings.json,
 // _driver/ sidecars) across every agent workspace. Layout (pipeline archive step):
-//   <workspaceRoot>/<workspacePrefix><agent>/studio/prelim-search/archive/<month|legacy-*>/<matter-slug>/<date-codename>/
+//   <workspaceRoot>/<workspacePrefix><agent>/studio/clearance-search/archive/<month|legacy-*>/<matter-slug>/<date-codename>/
 // where `<matter-slug>-<date-codename>` === runId. Returns every match (ambiguity is the caller's error).
 // The roots route through driver.config.mjs's workspace helpers (never inline the `workspace-` literal —
 // a deployment picks its own prefix via CLEAROTRON_WORKSPACE_PREFIX / CLEAROTRON_WORK_DIR).

package/driver/publish/publish-inputs.mjs

@@ -17,7 +17,7 @@
 // contract the publication gate held before it was retired into tests at — pass, fail, and COULD
 // NOT RUN, never folded into two — carried to the seam where a run becomes a client artifact.
 //
-// Modelled on mcp-server/lib/coverage.mjs:65-75 (assertValidatorCoverage): a closed partition asserted
+// Modelled on assertValidatorCoverage() in mcp-server/lib/coverage.mjs (lines 65-75): a closed partition asserted
 // at LOAD, so a new store cannot be added without consciously choosing its gating. The failure that
 // mechanism exists to prevent is the — a hand-copied mirror that silently stopped covering an
 // artifact and still answered "complete: yes" about a file it never checked.
@@ -57,10 +57,26 @@ export const PUBLISH_INPUTS = {
   "_driver/verdict.json": "optional",
   // doc 50 — the frozen band vocabulary. Present on band-doctrine runs only, by design.
   "_driver/framework.json": "optional",
+  // The recall net's receipt. Its overflow[] carries the probes the run minted and did not dispatch,
+  // one row each on the workbook's gaps sheet. `optional`, and the reason is the recall net's own
+  // switches: the lane is env-gated for rollback and mints nothing when a matter has no remembered
+  // conflict, so an absent receipt is a run that had nothing to record rather than one that lost it.
+  // `required` would close the gate on every knockout and every matter with a clean history.
+  "_driver/register-recall.json": "optional",
   // T6 (D4) — the frozen register plan; the render falls back to the coverage prose without it.
   "_driver/register-plan.json": "optional",
+  // The band the register returned, read ONLY where the run has no `_records/` archive, to count what was
+  // read and where. Optional: a knockout, a legacy run and a register-less run have none, and an absent
+  // band leaves the count as "cannot say" exactly as before.
+  "register-named-band.json": "optional",
   // The instructed scope, read only as the register plan's fallback for the searched-jurisdiction set.
   "_driver/instructed-scope.json": "optional",
+  // The frozen local-language lane decision, and the units the fold wrote. Read to derive how deep that
+  // investigation went against what the matter configured — through the engine's own asked-versus-ran
+  // reader, not by re-deciding it here. Optional and genuinely so: a plain clearance never runs the
+  // component and carries neither file, which is the state that folds to not-in-scope.
+  "_driver/jx-lanes.json": "optional",
+  "_driver/jx/units.json": "optional",
   // T7 (E5) — the grounded case-law profiles. A run with no case-law layer legitimately has none.
   "case-law-findings.md": "optional",
   // T7 (E6) — Corsearch enforcement telemetry; presentation-only, absent ⇒ no lines.
@@ -104,7 +120,7 @@ export const CALLER_SUPPLIED = {
 };
 
 /**
- * Load-time gate, on the assertValidatorCoverage model (mcp-server/lib/coverage.mjs:64-73).
+ * Load-time gate, modelled on assertValidatorCoverage() in mcp-server/lib/coverage.mjs (lines 64-73).
  *
  * Asserts the table is a well-formed closed partition: every gating is one of the two words, no store
  * is declared in more than one table, and no declaration is blank. It deliberately does NOT scan