clearotron 0.2.0 → 0.2.2

package/bin/key.mjs

@@ -84,7 +84,7 @@ try {
 
 for (const line of minted.notes) console.error(line);
 
-// — bb8's F13. A KEY FOR AN IDENTITY ON NO LIST IS A KEY THAT 403s. This command
+// — found in review. A KEY FOR AN IDENTITY ON NO LIST IS A KEY THAT 403s. This command
 // minted rc 0 for any address, printed the token once — it cannot be shown again — and the operator
 // handed it to a client whose first request was refused, with nothing on either side saying why.
 //

package/bin/onboard.mjs

@@ -133,7 +133,7 @@ const PROBE_ENGINE = has("--probe-engine");
 // issue 1871 — the same opt-in shape, for the credentials that had no proof at all. Never implied by
 // a plain --check: this SPENDS, and on two of the register adapters the count IS a billable search.
 const PROBE_PROVIDERS = has("--probe-providers");
-// tracker issue 149 — the same opt-in shape again, and this one WRITES: every registration it gets
+// the same opt-in shape again, and this one WRITES: every registration it gets
 // accepted CREATES an OAuth client on the operator's account. `doctor` promises in INSTALL.md that it
 // writes nothing, and that promise is why a reader runs it on a production box without thinking. So
 // this is never implied, it says what it is about to create before it creates it, and it reports what
@@ -141,7 +141,7 @@ const PROBE_PROVIDERS = has("--probe-providers");
 const PROBE_CONNECTOR = has("--probe-connector");
 
 // ── output ───────────────────────────────────────────────────────────────────────────────────────────
-// WEIGHT WHERE THE MEANING IS (, owner ruling 2026-08-31). Every line here used to
+// WEIGHT WHERE THE MEANING IS (owner ruling 2026-08-31). Every line here used to
 // be the same weight, which is why the passphrase and the coverage reason both disappeared into their
 // surroundings — two defects on that issue that are formatting defects wearing other clothes.
 //
@@ -693,8 +693,8 @@ export async function preflightCandidate(candidate) {
 /** Ask EUIPO for a token. This is the check that makes "refuses to persist a bad secret" true. */
 export async function validateEuipo({ clientId, clientSecret, environment }) {
   try {
-    const { resolveConfig } = await import(join(REPO, "providers", "euipo", "src", "core.js"));
-    const { getAccessToken } = await import(join(REPO, "providers", "euipo", "src", "euipo-client.js"));
+    const { resolveConfig } = await import(pathToFileURL(join(REPO, "providers", "euipo", "src", "core.js")).href);
+    const { getAccessToken } = await import(pathToFileURL(join(REPO, "providers", "euipo", "src", "euipo-client.js")).href);
     await getAccessToken(resolveConfig({ clientId, clientSecret, environment }), { force: true });
     return { ok: true };
   } catch (e) {
@@ -705,7 +705,7 @@ export async function validateEuipo({ clientId, clientSecret, environment }) {
 /** One minimal Perplexity call. Costs a request, so it is never made without being asked for. */
 export async function validatePerplexity(apiKey) {
   try {
-    const { buildRequestBody, callAgentAPI } = await import(join(REPO, "providers", "perplexity", "src", "core.js"));
+    const { buildRequestBody, callAgentAPI } = await import(pathToFileURL(join(REPO, "providers", "perplexity", "src", "core.js")).href);
     await callAgentAPI(apiKey, buildRequestBody({ task: "Reply with the single word: ok.", preset: "fast-search" }), { retries: 0 });
     return { ok: true };
   } catch (e) {
@@ -1053,7 +1053,7 @@ export async function runCheck() {
   // deliberate — a second reader would drift from this one exactly as the composer and the checker did
   // in F41, and the drift is invisible because both sides keep passing their own arms.
   const unitDir = join(homedir(), ".config", "systemd", "user");
-  const { BACKGROUND_UNITS } = await import(join(REPO, "bin", "start.mjs"));
+  const { BACKGROUND_UNITS } = await import(pathToFileURL(join(REPO, "bin", "start.mjs")).href);
   const hosted = BACKGROUND_UNITS.some((u) => existsSync(join(unitDir, u)));
   const unitEnv = hosted
     ? unitEnvironment({
@@ -1166,8 +1166,8 @@ export async function runCheck() {
         + "and the MCP connection are live right now; `npm run example` needs no engine.");
       info(`To leave demo: install ${engSpec.vendor}'s CLI (\`${engSpec.fallback}\`), then ${engSpec.signIn}.`);
     } else {
-      info("MODE: engine attached, sign-in UNPROVEN — a binary resolves, and whether it can complete a turn "
-        + "is not knowable from the filesystem. --probe-engine is what settles it.");
+      info("The engine program is installed. Whether it is signed in cannot be read from disk: run "
+        + "clearotron doctor --probe-engine to find out.");
     }
 
     // item 5 — WHICH BILLING LANE, reported rather than left to be inferred from a variable's
@@ -1188,8 +1188,8 @@ export async function runCheck() {
         if (e) envForResolve[k] = e.v;
       }
       const auth = resolveAuthMode({ engineName: engineId, env: envForResolve });
-      if (auth.mode === "unknown") info(`billing lane: not policied for ${engineId} — this engine declares no auth modes`);
-      else ok(`billing lane: ${auth.mode}${auth.apiBilled ? ` — metered per token against ${engSpec.apiKeyEnv}` : " — drawn against the signed-in subscription, not metered per token"}`);
+      if (auth.mode === "unknown") info(`billing: no policy for ${engineId} — this engine declares no sign-in modes`);
+      else ok(`billing: ${auth.mode}${auth.apiBilled ? ` — charged per token against ${engSpec.apiKeyEnv}` : " — charged to the signed-in subscription, not per token"}`);
     } catch (e) {
       problem(String(e?.message ?? e));
     }
@@ -1366,7 +1366,7 @@ export async function runCheck() {
       // Both lines were honest about their own source and neither said what it was. The first reads this
       // command's env file; the second reads THIS PROCESS's resolution, and a CLI is started by a login
       // shell that carries none of the units' `EnvironmentFile`. The deployment was correct and served
-      // celsius, microsoft and generic throughout.
+      // zephyr, aurora and generic throughout.
       //
       // THE UNITS' ENV IS NOT PASSED INTO `profileStoreResolution`, deliberately. `PROFILES_OVERLAY_DIR`
       // is captured when profiles.mjs LOADS, so handing it the units' value would set `live` with no
@@ -1513,7 +1513,7 @@ export async function runCheck() {
   //
   // REPORTS, NEVER JUDGES: nothing here sets `problem()`. Drift is information for the reader, not a
   // fault in their install, and a doctor that called their own overrides broken would be wrong.
-  say("\n  Doctrine overlay");
+  say("\n  Custom instructions");
   try {
     const report = overlayReport({ baseRoot: config.skillsBaseDir, overlayRoot: config.skillsOverlayDir });
     for (const line of renderOverlayReport(report, { indent: "" })) say(`  ${line}`);
@@ -1528,7 +1528,7 @@ export async function runCheck() {
     // answer for somebody running the engine by hand. This line is what the services see.
     const svcDoctrine = effectiveForService("CLEAROTRON_INSTRUCTIONS_DIR");
     if (hosted && serviceKnown && svcDoctrine?.v && svcDoctrine.v !== config.skillsOverlayDir) {
-      info(`the services read a doctrine overlay this process does not: ${svcDoctrine.v} `
+      info(`the services read custom instructions this process does not: ${svcDoctrine.v} `
         + `(${svcDoctrine.from}). The lines above are this command's own environment — a CLI is not `
         + "started by the units' EnvironmentFile, so \"none configured\" here is not a statement about "
         + "the deployment");
@@ -1541,7 +1541,7 @@ export async function runCheck() {
     // An unreadable overlay THROWS by design (config.resolveSkillPath refuses rather than falling back
     // to the product's copy). Surfaced here rather than allowed to abort the whole check: the doctor's
     // job is to report every section, and a section that kills the run tells the reader least.
-    problem(`the doctrine overlay could not be read — ${e.message}`);
+    problem(`the custom instructions could not be read — ${e.message}`);
   }
 
   say("\n  Register provider");
@@ -1585,7 +1585,7 @@ export async function runCheck() {
   say("\n  Research provider");
   const px = effective("PERPLEXITY_API_KEY");
   if (px) ok(`PERPLEXITY_API_KEY present (${px.from}) — presence only; add --probe-providers to prove it answers`);
-  else info("PERPLEXITY_API_KEY is not set — the three clearance searches carry the common-law grid and cannot switch it off, so a clearance refuses at preflight; a Knockout search still runs and discloses the half it skipped");
+  else info("PERPLEXITY_API_KEY is not set — the three clearance searches carry the common-law grid and cannot switch it off, so a clearance stops before it starts, and names the missing key; a Knockout search still runs and discloses the half it skipped");
 
   // ── — THE LANES A PRODUCT DECLARES IT NEEDS, BEFORE A REPORT NAMES THEM ──
   //
@@ -1663,7 +1663,7 @@ export async function runCheck() {
   // could print, and the portal's own config view does — is deliberately not printed here: `doctor` goes
   // to a terminal, into a paste, into an issue.
   // THE ONE CONDITION THAT STOPS THE PORTAL RENDERING, and `doctor` said nothing about it at all
-  // (bb8, F2). `portal-ui/dist` is committed, so an absent bundle means a bad checkout on
+  // (found in review). `portal-ui/dist` is committed, so an absent bundle means a bad checkout on
   // a deployment and an unbuilt tree on a source clone; the service already answers 503 and says so in
   // its boot log, but a reader who runs `doctor` BEFORE `start` — which is the order every document
   // gives — had no way to learn it. The product's OWN predicate decides rather than a second existence
@@ -1770,7 +1770,7 @@ export async function runCheck() {
     }
   }
 
-  say("\n  Portal door");
+  say("\n  Portal sign-in");
   {
     const { authView } = await import("../driver/portal-config-view.mjs");
     const door = authView({
@@ -1785,10 +1785,11 @@ export async function runCheck() {
     // NOT A TICK, AND THAT IS THE POINT. This reads the environment THIS command is
     // typed in. `bin/start.mjs` INJECTS `PORTAL_AUTH_MODE: "local"` into the portal's own environment,
     // and a systemd unit's EnvironmentFile can name a third thing — so a green tick here was a
-    // confident claim about a door the running service may not be serving. Measured on the test box:
-    // doctor said `auth-proxy door (PORTAL_AUTH_MODE is unset)` with a tick while the box served
-    // cf-access, and said `local passphrase door` with a tick while it still served cf-access. Both
-    // green, neither the door a caller meets.
+    // confident claim about a door the running service may not be serving. Measured on the test
+    // machine, in the wording doctor used at the time: it said `auth-proxy door (PORTAL_AUTH_MODE is
+    // unset)` with a tick while the machine served cf-access, and said `local passphrase door` with a
+    // tick while it still served cf-access. Both green, neither the door a caller meets. Those two
+    // lines read differently now; what they claimed is the point, not how they were worded.
     //
     // The reading is still worth printing — it is what a hand-run process here would use, and it is
     // what `clearotron start` would launch from. It is stated as that, and the sentence below says
@@ -1808,7 +1809,7 @@ export async function runCheck() {
       say(`  · local passphrase door (${typed}) — one operator, one passphrase, no identity provider`);
       info(`a lost passphrase is recoverable: ${invocationPrefix()}clearotron passphrase --reset`);
     } else if (door.shape === "fronted") {
-      say(`  · auth-proxy door (${typed}) — identity is proved by whatever sits in front, and this process trusts it`);
+      say(`  · Sign-in: handled by a proxy in front (${typed}) — identity is proved by whatever sits in front, and this process trusts it`);
       for (const v of door.proxyValues) {
         if (v.present) ok(`  ${v.name} present`);
         else info(`  ${v.name} not set`);
@@ -1908,8 +1909,8 @@ export async function runCheck() {
     say("\n  Register lane — proven, not inferred");
     try {
       const [{ activeProvider }, { makeLaneProbe, probeSpend, DEFAULT_CONTROLS, loadProviderCapabilities }] = await Promise.all([
-        import(join(REPO, "driver", "driver.config.mjs")),
-        import(join(REPO, "providers", "_shared", "lane-probe.mjs")),
+        import(pathToFileURL(join(REPO, "driver", "driver.config.mjs")).href),
+        import(pathToFileURL(join(REPO, "providers", "_shared", "lane-probe.mjs")).href),
       ]);
       const adapter = activeProvider();
       // NOT `adapter.capabilities` — that is null on every adapter, and reading it announced a LOCAL
@@ -1952,7 +1953,7 @@ export async function runCheck() {
     }
   }
 
-  say("\n  Data-plane paths");
+  say("\n  Where files are stored");
   // Each entry is a FUNCTION, called only on the branch that prints it, so a getter is read at access
   // time and never captured as a constant here. The reader of this command is deciding what to
   // provision; a default quoted from memory is the one thing that can send them to the wrong path and
@@ -1963,7 +1964,7 @@ export async function runCheck() {
     // whole rather than summarised: a summary is a second copy, and a second copy is what drifted.
     ["CLEAROTRON_REPORTS_DIR", (name) => {
       const d = defaultWith(name, () => config.poolRoot);
-      return d.refusal ?? `${name} is not set — the published-report pool falls back to ${d.value}`;
+      return d.refusal ?? `${name} is not set — the published-reports folder falls back to ${d.value}`;
     }],
     ["CLEAROTRON_WORK_DIR", (name) => {
       const d = defaultWith(name, () => config.workspaceRoot);
@@ -1985,67 +1986,6 @@ export async function runCheck() {
   // The status surface the ruling names: "status should say whether a key is still valid". Stopping
   // the door revokes nothing — a key outlives every teardown until it expires or its id is denylisted —
   // so a doctor that reported the unit and stayed silent about the keys would bless exactly the state
-  // the issue was filed about. Judged by the verifier's own pieces (`connectKeyReport` takes the real
-  // `isRevoked`), never by a second opinion written here.
-  // ── THE PROFILE STORE RESOLVES, OR THE PORTAL 500s ────────────────────────
-  //
-  // Asked by RUNNING the engine's own resolution, not by re-deriving it: loadProfiles() layers the
-  // configured store over the bundled base with generic falling through by name, and its refusal text
-  // is the exact line the portal prints on every screen when this is broken. A doctor that stayed
-  // green over that state would bless the owner's fresh-install 500.
-  say("\n  Profile store");
-  try {
-    const { loadProfiles } = await import(join(REPO, "driver", "profiles.mjs"));
-    const resolved = loadProfiles({ force: true });
-    const named = [...resolved.keys()];
-    ok(`resolves: ${named.length} profile(s) (${named.slice(0, 6).join(", ")}${named.length > 6 ? ", …" : ""}) — the universal fallback is present`);
-  } catch (e) {
-    problem(`the profile store does NOT resolve — every portal profile screen and every run refuses on this: ${e.message}`);
-  }
-
-  // ── THE SUBMIT LANE, WALKED (the owner's 502, 2026-09-02) ────────────────────────────────────────
-  //
-  // Every surface on that box was green while the portal's Start button had no engine to call. This is
-  // the only check that asks the question the client's own path asks, so it goes before the connector
-  // section: a dead submit lane matters more than a connector nobody has configured yet.
-  // ── SETTINGS THIS BUILD DOES NOT READ ( tracker issue 168) ────────────────────────────────────────
-  //
-  // THE SURFACE AN OPERATOR CHECKS AFTER AN UPGRADE, and until now the surface that told them
-  // everything was fine. Upgrading the production install across the `PRELIM_*` rename left thirteen
-  // configured settings with no reader in the new build; doctor exited 0 and mentioned none of them.
-  //
-  // EVERY ENVIRONMENT THE DEPLOYMENT ACTUALLY READS, not this shell's alone — the F34 lesson one step
-  // on. A hosted box's values live in the file the units load, so checking `process.env` here would
-  // pass a box whose units carry thirteen dead lines. Each source is named in its own row: "it is in
-  // your env file" and "it is in the units' environment" are different fixes.
-  //
-  // A source that could not be read is NOT reported as clean. `unitEnvironment` already distinguishes
-  // that, and an unreadable unit environment is said out loud rather than counted as zero dead names —
-  // an absence of evidence is not evidence of absence, and this whole check exists because something
-  // invisible was being read as fine.
-  {
-    const { retiredSpellingsIn, retiredSpellingLine } = await import(join(REPO, "shared", "env-aliases.mjs"));
-    const sources = [
-      { label: "your environment file", env: fileEnv, known: true },
-      { label: "this shell's environment", env: process.env, known: true },
-    ];
-    if (hosted) sources.push({ label: "the units' environment", env: unitEnv?.env, known: unitEnv?.known === true });
-
-    const seen = new Set();
-    let anyUnknown = false;
-    for (const src of sources) {
-      if (!src.known || !src.env) { if (src.label === "the units' environment") anyUnknown = true; continue; }
-      for (const row of retiredSpellingsIn(src.env)) {
-        // One row per NAME, not per source: a name set in both the file and the units is one thing to
-        // fix, and two rows would read as two faults.
-        if (seen.has(row.name)) continue;
-        seen.add(row.name);
-        inertSetting(`${retiredSpellingLine(row)} (found in ${src.label})`);
-      }
-    }
-    if (anyUnknown) warn(couldNotDetermine("retired setting names", unitEnv));
-    if (!seen.size && !anyUnknown) ok("no retired setting names — every configured name is one this build reads");
-  }
 
   // LINGERING, WHICH NOTHING ELSE CHECKS ( — F9). `--background` installs USER units,
   // and a user manager without lingering is torn down at logout: the units stop with the session and
@@ -2075,9 +2015,9 @@ export async function runCheck() {
       + "failing to look, not a report that it is off.");
   }
 
-  say("\n  Submit lane");
+  say("\n  Start-button path");
   try {
-    const { triggerLaneVerdict, HOSTED, SUPERVISED } = await import(join(REPO, "shared", "trigger-lane.mjs"));
+    const { triggerLaneVerdict, HOSTED, SUPERVISED } = await import(pathToFileURL(join(REPO, "shared", "trigger-lane.mjs")).href);
     // POSTURE FROM THE BOX, NOT FROM A FLAG. Units installed means the units serve, and the units read
     // %h/.env — so an absent value there is the incident. No units means `start` supervises and derives
     // the value at runtime, where reading this process's environment says nothing either way.
@@ -2117,7 +2057,7 @@ export async function runCheck() {
     // Stop control's availability on — one reader, two surfaces.
     let verbs = null;
     try {
-      const { opsTokenPosture } = await import(join(REPO, "driver", "portal-service.mjs"));
+      const { opsTokenPosture } = await import(pathToFileURL(join(REPO, "driver", "portal-service.mjs")).href);
       verbs = opsTokenPosture(opsToken).verbs;
     } catch { /* unreadable posture leaves verbs null, which reads as full ops — see the verdict */ }
     let probe = null;
@@ -2153,12 +2093,12 @@ export async function runCheck() {
   } catch (e) { warn(`the submit lane could not be read: ${e.message}`); }
 
   say("\n  Client connector");
-  // THE REVOCATION LIST, REPORTED ( — bb8's F14). `isRevoked` treats an unreadable
+  // THE REVOCATION LIST, REPORTED (found in review). `isRevoked` treats an unreadable
   // denylist as "not revoked", so a named-but-absent file makes every revocation silently ineffective:
   // measured on a default install, a revoked key completed a full handshake with nothing logged. Nothing
   // surfaced that state anywhere, which is why it survived to be found by hand.
   {
-    const { defaultDenylistPath } = await import(join(REPO, "shared", "client-door.mjs"));
+    const { defaultDenylistPath } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
     const dl = effective("TRADEMARK_MCP_TOKEN_DENYLIST")?.v || defaultDenylistPath(homedir());
     try {
       const n = readFileSync(dl, "utf8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#")).length;
@@ -2172,8 +2112,8 @@ export async function runCheck() {
     }
   }
   try {
-    const { clientDoorState: doorState, describeDoorState, connectKeyReport, CLIENT_DOOR_UNIT: doorUnit } = await import(join(REPO, "shared", "client-door.mjs"));
-    const { loadGrants: readGrantsFile, isRevoked: revokedCheck } = await import(join(REPO, "shared", "scope.mjs"));
+    const { clientDoorState: doorState, describeDoorState, connectKeyReport, CLIENT_DOOR_UNIT: doorUnit } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
+    const { loadGrants: readGrantsFile, isRevoked: revokedCheck } = await import(pathToFileURL(join(REPO, "shared", "scope.mjs")).href);
     // ── CONFIGURED IS NOT RUNNING, AND THIS IS THE SURFACE IT WAS MEASURED ON ──
     //
     // `describeDoorState` was written for exactly this block and then never called from it: the split
@@ -2242,14 +2182,14 @@ export async function runCheck() {
     const doorEnvKnown = !hosted || unitEnv?.known === true;
     const doorEnv = hosted && unitEnv?.known === true ? unitEnv.env : process.env;
     if (!doorEnvKnown) warn(couldNotDetermine("CLIENT_MCP_ACCOUNT_ACCESS", unitEnv));
-    // THE PORT AND ITS ALLOW-LIST ARE ONE SETTING, AND NOTHING SAID SO (, Hera's
-    // operator pass). `start` derives CLIENT_MCP_ALLOWED_HOSTS from the port it resolved, so moving the
+    // THE PORT AND ITS ALLOW-LIST ARE ONE SETTING, AND NOTHING SAID SO (found in an operator pass).
+    //  `start` derives CLIENT_MCP_ALLOWED_HOSTS from the port it resolved, so moving the
     // port THROUGH start works. Moving it in the env file the units load does not: the door binds the
     // new port and then answers "403 Invalid Host header" on every request, because the allow-list still
     // names the old one. A door that is up, listening, and refuses everything is the worst of the three
     // states to debug, and nothing surfaced the mismatch.
     {
-      const { clientDoorPort: portOf, allowedHosts: hostsFor } = await import(join(REPO, "shared", "client-door.mjs"));
+      const { clientDoorPort: portOf, allowedHosts: hostsFor } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
       const declared = String(effective("CLIENT_MCP_ALLOWED_HOSTS")?.v ?? "").trim();
       if (declared) {
         const port = portOf(doorEnv);
@@ -2265,14 +2205,14 @@ export async function runCheck() {
       }
     }
 
-    // IS ANYTHING ANSWERING? ( — bb8's F11.) The unit file is evidence about the
+    // IS ANYTHING ANSWERING? (found in review) The unit file is evidence about the
     // background shape only. A foreground `clearotron start` runs the door as its own child with no unit
     // at all, and this section then told a reader whose door was listening that it "is not set up here",
     // pointing them at the command they had just run. One loopback connect settles it, and null stays
     // null — a probe that could not be made is not a door that is absent.
     let doorListening = null;
     try {
-      const { clientDoorPort: portOf } = await import(join(REPO, "shared", "client-door.mjs"));
+      const { clientDoorPort: portOf } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
       const { createConnection } = await import("node:net");
       doorListening = await new Promise((resolve) => {
         const sock = createConnection({ host: "127.0.0.1", port: portOf(doorEnv), timeout: 700 });
@@ -2307,11 +2247,16 @@ export async function runCheck() {
       problem("a valid key is on record but NO revocation list is configured (TRADEMARK_MCP_TOKEN_DENYLIST unset) "
         + `— \`${invoke("disconnect")}\` could not actually revoke it. \`${invoke("connect")}\` arms one; set the variable or reconnect.`);
     }
-    // THE PUBLISHED ADDRESS, AND WHETHER IT ANSWERS (, acceptance 2). Reported here
+    // THE PUBLISHED ADDRESS, AND WHETHER IT ANSWERS (acceptance 2). Reported here
     // rather than beside the unit, because the unit running and the address being reachable are
     // different facts and the second is the one a client depends on.
-    const { clientDoorReachability } = await import(join(REPO, "shared", "client-door.mjs"));
-    const published = process.env.CLEAROTRON_CLIENT_MCP_URL ?? null;
+    const { clientDoorReachability } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
+    // FROM THE FILE THE UNITS LOAD, NOT THE SHELL THIS COMMAND WAS TYPED IN (the tracker issue 226
+    // family, met again here). On a hosted box the published address lives in the units' environment,
+    // and reading `process.env` reported "no client connector address is published — that is correct
+    // for a local install" about a deployment that publishes one. Every verdict below rests on this
+    // value, including the audience comparison, so a wrong reading here is not one wrong line.
+    const published = effectiveForService("CLEAROTRON_CLIENT_MCP_URL")?.v ?? null;
     // A SHORT, CHEAP ASK, and a failure to reach IS the finding rather than a failure to look — the
     // property under test is reachability itself. What would be dishonest is calling an address green
     // because nothing asked, which is why `probe` stays null when there is nothing to ask about.
@@ -2327,8 +2272,13 @@ export async function runCheck() {
         // returns null when the header is absent — a looked-and-none answer, not a did-not-look — and
         // the readers separate those, so a probe that omits the field reads as never-looked rather
         // than silently as "no challenge".
+        // THE REDIRECT TARGET TRAVELS WITH IT (tracker issue 241). This request is already made with
+        // `redirect: "manual"`, so the Location an unauthenticated caller is handed is right here —
+        // and it is where Cloudflare Access puts the audience. Reading it from THIS response rather
+        // than asking a second time keeps `doctor` to one request per address, and keeps both answers
+        // about the same moment.
         probe = { ok: res.status < 500, status: res.status, error: null,
-          challenge: res.headers.get("www-authenticate") };
+          challenge: res.headers.get("www-authenticate"), location: res.headers.get("location") };
       } catch (e) { probe = { ok: false, status: null, error: String(e?.cause?.code ?? e?.name ?? e?.message ?? e) }; }
     }
     const reach = clientDoorReachability({ url: published, probe });
@@ -2336,6 +2286,34 @@ export async function runCheck() {
     else if (reach.state === "fail") problem(reach.message);
     else info(reach.message);
 
+    // ── AND IS IT THE AUDIENCE THIS INSTALL CHECKS AGAINST? (tracker issue 241) ───────────────────
+    //
+    // The other half of the recreation trap, and the half with no symptom of its own. Deleting and
+    // recreating an Access application changes the audience; the existing warning fires on the
+    // CHALLENGE being wrong, so on a box where somebody recreated the application and then fixed the
+    // sign-in, everything above reads healthy and the stale audience stays invisible until a real
+    // request is rejected.
+    //
+    // No new credential and no provider API: the audience is in the redirect handed to a caller with
+    // no session at all, which is the request just made.
+    {
+      const { readAudience, audienceVerdict } = await import(pathToFileURL(join(REPO, "shared", "access-audience.mjs")).href);
+      const configuredAud = effectiveForService("CLEAROTRON_OIDC_AUDIENCE")?.v ?? "";
+      const read = readAudience(probe ?? { error: "the published address was never asked" });
+      // NOTHING IS CLAIMED ABOUT A BOX THAT USES NO EDGE. With no audience configured AND no Access
+      // challenge in front of the address, there is no question here — a local install is not a
+      // misconfigured hosted one, and saying so every time is how a reader learns to skim this.
+      if (configuredAud || read.kind !== "not-fronted") {
+        const v = audienceVerdict({ configured: configuredAud, read });
+        if (v.ok) ok(v.message);
+        // A COULD-NOT-LOOK IS SAID, NOT RAISED. The line above has already reported the address as
+        // unreachable; repeating it as a second failure teaches the reader that this section
+        // double-counts. It still states what was NOT established, which is the whole job.
+        else if (v.kind === "could-not-look") info(v.message);
+        else problem(v.message);
+      }
+    }
+
     // ── CAN AN ASSISTANT ACTUALLY SIGN IN? (tracker issue 149, opt-in) ────────────────────────────
     //
     // The check above reads the CHALLENGE FORM, which is the first of two provider settings that decide
@@ -2345,7 +2323,7 @@ export async function runCheck() {
     // announces the side effect first, and its control runs before any vendor.
     if (PROBE_CONNECTOR && String(published ?? "").trim()) {
       const { registrationEndpointFrom, probeRegistration, describeRegistration } =
-        await import(join(REPO, "shared", "connector-signin-probe.mjs"));
+        await import(pathToFileURL(join(REPO, "shared", "connector-signin-probe.mjs")).href);
       say("");
       say("  --probe-connector: asking this door's sign-in whether each assistant vendor could register.");
       say("  Each attempt that SUCCEEDS creates a throwaway OAuth client on your account, which you may");
@@ -2533,7 +2511,7 @@ try {
   // is DERIVED: the engines from ENGINE_BINARIES, the search vendors from the same adapter tables the
   // prompts loop over, each wearing its own table row's where-to-get line. A hand-kept copy here would
   // be the SERPAPI defect again, one screen earlier. Everything is skippable; the list says so.
-  // THE BANNER — once, on entry, named (, owner ruling 2026-08-31). Not on every
+  // THE BANNER — once, on entry, named (owner ruling 2026-08-31). Not on every
   // command: a banner every verb prints is how a product becomes tiresome to use twice. It sits here
   // rather than at the top of main() so that `--check`, which writes nothing and is run repeatedly,
   // does not wear it either.
@@ -2543,7 +2521,7 @@ try {
   say("");
   say(`  ${style.bold("Before you start")} — what this setup can take, so nothing here surprises you:`);
   // `vendor`, not `label`: the labels are engineer sentences carrying flag names, and a question a
-  // lawyer reads may not ('s first rule).
+  // lawyer reads may not (the first rule).
   say(`    · Which AI runs the searches (${Object.values(ENGINE_BINARIES).map((e) => e.vendor).join(" or ")}),`);
   say("      and how it bills — the subscription you already sign in with, or an API key.");
   say("    · Your trademark register vendor's credential, if you have one (a register can be chosen later).");
@@ -2817,7 +2795,7 @@ try {
           }
         }
       }
-      // — bb8's F9, and the same trap closed one prompt over. The default
+      // — found in review, and the same trap closed one prompt over. The default
       // was YES, so Enter re-ran a probe that CANNOT succeed until the reader has signed in somewhere
       // else — and the wizard's own header tells them Enter is the safe key. Driven with Enter it went
       // 19 attempts, no cap and no escape, in a wizard whose header says everything here is skippable.
@@ -3011,7 +2989,7 @@ try {
   const baseDefault = join(homedir(), "trademark");
   prose("Reports, run workspaces, queues and locks all live under one directory.");
   if (poolDefault.refusal) {
-    prose(`Enter accepts ${baseDefault}. There is no built-in default for the pool — left unset a run`,
+    prose(`Enter accepts ${baseDefault}. There is no built-in default for the reports folder — left unset a run`,
           "refuses and names it rather than guessing — so setup gives it a real path under your home,",
           "and this install publishes only where you own the disk.");
   } else {
@@ -3057,7 +3035,7 @@ try {
   // The escape goes in the BRACKETS and the consequence in `skipped`, matching the two prompts that
   // already take this mode — the question no longer carries "(empty for none)" because the bracket now
   // says it, and a prompt that says it twice in two different wordings is how the two drift apart.
-  const reportsUrl = await askValue("Public base URL for the pool:", {
+  const reportsUrl = await askValue("Public base URL for the reports folder:", {
     skippable: true,
     skipped: "CLEAROTRON_REPORTS_URL left unset — runs will deliver, and their notifications will carry no link",
   });
@@ -3096,7 +3074,7 @@ try {
   prose("No default — it is your hostname. Skip it and this stays a local install: everything works",
         "here, and the Use-your-AI page says so rather than handing out an address that fails.");
   prose("The usual shape, and why: mcp-server/CONNECT.md.");
-  const { clientDoorReachability } = await import(join(REPO, "shared", "client-door.mjs"));
+  const { clientDoorReachability } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
   for (;;) {
     const clientUrl = await askValue("Public connector address:", {
       skippable: true,
@@ -3139,7 +3117,7 @@ try {
   // making a decision about where their customer data lives without being told they had made it.
   const cfgDefault = join(base, "config");
   say("\n  Where this install keeps its own configuration");
-  prose("Your customers and any doctrine you override live here, outside the checkout — which is what",
+  prose("Your customers and any instructions you override live here, outside the checkout — which is what",
         "lets you take updates with `git pull` instead of merging into files you never meant to own.");
   prose(`Enter accepts ${cfgDefault}, and your customers are written there.`);
   const cfg = await askValue("Configuration directory:", { def: cfgDefault });
@@ -3164,7 +3142,7 @@ try {
   candidate.PROFILE_REPO_ROOT = cfg;   // no alias row — this name is current
   for (const k of ["CLEAROTRON_CUSTOMERS_DIR", "PROFILE_REPO_ROOT"]) ok(`${k}=${candidate[k]}`);
 
-  // CLEAROTRON_INSTRUCTIONS_DIR IS DELIBERATELY NOT WRITTEN ( — bb8's F25).
+  // CLEAROTRON_INSTRUCTIONS_DIR IS DELIBERATELY NOT WRITTEN (found in review).
   //
   // Setup used to point it at `<cfg>/skills` and create that directory empty. `clearotron start` then
   // makes `<cfg>` a git repository for saved searches — so the doctrine store ends up INSIDE a checkout
@@ -3180,7 +3158,7 @@ try {
   // Note for whoever adds an overlay later: it needs this name set, which is why the line below says so
   // rather than leaving a reader to discover that files they dropped in are being ignored.
   info(`doctrine: this install overrides nothing, so CLEAROTRON_INSTRUCTIONS_DIR stays unset and the `
-    + `product's own files are used. To override a doctrine file later, put it in ${join(cfg, "skills")}, `
+    + `product's own files are used. To override an instruction file later, put it in ${join(cfg, "skills")}, `
     + `COMMIT it in ${cfg}, and set CLEAROTRON_INSTRUCTIONS_DIR to that directory — an uncommitted store `
     + "cannot be identified, and a run says so rather than guessing.");
 
@@ -3193,7 +3171,7 @@ try {
   // PRECISELY what shows through, because the last wording said "bundled customers" and the loader
   // says otherwise: the demo roster never layers into a deployment (a typo'd key must not resolve to
   // our fixtures), generic.json falls through BY NAME, and doctrine resolves file-by-file.
-  say("  Left empty. The house doctrine shows through file-by-file, and generic.json — the universal");
+  say("  Left empty. The bundled instructions show through file-by-file, and generic.json — the universal");
   say("  fallback — falls through by name, so an empty store is a working install. Your own customers");
   say("  are added here by name; the bundled demo customers never show through into your roster.");
 
@@ -3251,7 +3229,7 @@ try {
   // rather than fall back, so a permissions fault can never silently swap a customer's framework for the
   // Generic default). Nothing is written INTO them — see the note at step 7b.
   for (const k of ["CLEAROTRON_CUSTOMERS_DIR"]) mkdirSync(candidate[k], { recursive: true });
-  ok(`configuration directories created under ${cfg} (empty — doctrine and the generic fallback show through; customers are yours to add)`);
+  ok(`configuration directories created under ${cfg} (empty — the bundled instructions and the generic fallback show through; customers are yours to add)`);
 
   // 9a ── PUT THE VERB ON THIS OPERATOR'S PATH
   //
@@ -3291,17 +3269,17 @@ try {
   // They are `clearotron` verbs now for a second reason as well: from an INSTALLED package there is
   // no `npm run example` to type — no package.json, no scripts block — so the old advice was not
   // merely misordered there, it was unrunnable.
-  // ONE COMMAND, AND WHAT TO EXPECT FROM IT (, the owner's point 10). This screen
+  // ONE COMMAND, AND WHAT TO EXPECT FROM IT (the owner's point 10). This screen
   // offered three, each with a sentence, and a reader who has just answered a page of questions is
   // being asked to make one more choice at the moment they most want to be told what to do. Three
   // equally-weighted options is not generosity; it is the decision handed back.
   //
   // `start` is the one, because it is the product — the other two were already ordered behind it for
-  // that reason (, when this screen offered `npm run example` and a raw pipeline invocation and
+  // that reason (when this screen offered `npm run example` and a raw pipeline invocation and
   // named the product nowhere). They keep their place as an afterthought line rather than an option.
   // THE COMMAND LINE STAYS A PLAIN LITERAL, DELIBERATELY. onboard-wizard.test.mjs reads this screen
   // STATICALLY — it extracts every say() literal and asserts which command leads — and that guard is
-  // the only thing standing between this screen and 's defect coming back. Wrapping the command in
+  // the only thing standing between this screen and the defect coming back. Wrapping the command in
   // style.bold() puts a nested template literal inside the say(), the extractor stops matching, and the
   // corpus goes empty. Its own comment records the previous generation of exactly this: the arms went
   // vacuous the moment these lines became template literals.
@@ -3322,7 +3300,7 @@ try {
   say("  What this box has now:");
   for (const line of [
     stateLine("register", candidate.CLEAROTRON_DATABASE, "no register, so every search refuses until one is chosen"),
-    stateLine("web research", present(candidate.PERPLEXITY_API_KEY) ? "a key" : "", "a clearance refuses at preflight; a knockout search runs and discloses the half it skipped"),
+    stateLine("web research", present(candidate.PERPLEXITY_API_KEY) ? "a key" : "", "a clearance stops before it starts, and names the missing key; a knockout search runs and discloses the half it skipped"),
     stateLine("data directory", candidate.CLEAROTRON_REPORTS_DIR, "unset"),
     stateLine("configuration store", candidate.CLEAROTRON_CUSTOMERS_DIR, "the bundled demo roster"),
     stateLine("notification links", candidate.CLEAROTRON_REPORTS_URL, "notifications carry no link into the report"),