clearotron 0.2.1 → 0.2.3

package/driver/placement-diff.mjs

@@ -1,10 +1,10 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
-// placement-diff.mjs —: compare two runs' placement tiers, so 's repeat runs can be scored.
+// placement-diff.mjs —: compare two runs' placement tiers, so the repeat runs can be scored.
 //
 // ── why this exists ──────────────────────────────────────────────────────────────────────────────────
 //
-// 's offline half is answered: the band-shape seam moves its input, so the branch is taken and the
+// That offline half is answered: the band-shape seam moves its input, so the branch is taken and the
 // noise floor needs repeat PAID arms on one matter. Those runs are the E2E agent's. When they land there
 // is nothing to compare them with — `placement-carry.mjs` joins placements to the digest surfaces WITHIN
 // one run, and nothing in the tree diffs two `placements.json`.

package/driver/placement-form.mjs

@@ -13,12 +13,12 @@
 // fails `placementmodel_missing` while the structured sibling `placements.json` is absent — and the seat
 // wrote the prose first (on disk that run: md at 09:08:58, json at 09:15:50, by attempt 2). The kill
 // landed in the gap between the two files, so 31 minutes of finished work were discarded and re-derived
-// from scratch. Raising the wall (, `638f885`) made that less likely; it did not make finished work
+// from scratch. Raising the wall (`638f885`) made that less likely; it did not make finished work
 // survivable, and this does.
 //
 // THE CURE IS AUTHORSHIP, NOT A GUARD. The seat stops writing `placements.json`. The driver renders it
 // from a FORM the seat fills, and an accumulator holds every answer across attempts, parks and process
-// restarts — exactly as 's disposition union and 's coverage union already do for their seats.
+// restarts — exactly as the disposition union and the coverage union already do for their seats.
 // A killed attempt then keeps every tier it had already placed.
 //
 // THE ROW SOURCE IS SELECTION-BY-REFERENCE, and it was settled by measurement, not by design taste. The
@@ -127,7 +127,7 @@ export function formRowKey(row) {
  *
  * DRIVER FACTS COME FROM `canonical`, never from the submitted row. A seat that rewrote `records` or
  * `owner` on its copy cannot widen what binds; only its three judgment fields are read from `row`.
- * That is 's discipline and it is the reason the union cannot be talked into anything.
+ * That is the discipline and it is the reason the union cannot be talked into anything.
  * PURE; never throws.
  */
 export function rowIsSettled(row, canonical) {
@@ -235,7 +235,7 @@ export function buildSelectionIndex({ floors = null, positions = null } = {}) {
       floor_records: floorList.length,
       positions: posList.length,
       selectable_records: byUri.size,
-      // An ABSENCE is recorded in the artifact rather than swallowed — 's rule. "no floors" and "the
+      // An ABSENCE is recorded in the artifact rather than swallowed — the rule. "no floors" and "the
       // band shape would not parse" are different facts and must not read alike.
       floors_unreadable: floors === null,
       positions_unreadable: positions === null,

package/driver/placement-union.mjs

@@ -102,7 +102,7 @@ export function unionPlacementForm(prior, submitted, input) {
   const consumed = new WeakSet();
   // RETRACTION IS EXPLICIT, and it is the only way a row leaves this form.
   //
-  // 's seat rows were retracted by SILENCE — a submission that spoke owned them — and that was right
+  // That seat rows were retracted by SILENCE — a submission that spoke owned them — and that was right
   // there, because that seat rewrote its whole form every pass. This one does not: it writes DELTAS, so a
   // corrective attempt that re-tiers two register rows says nothing about the run's common-law
   // candidates, and silence-retraction would delete every one of them without a word. The 2026-08-09

package/driver/plain-register.mjs

@@ -0,0 +1,120 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// THE TWO-REGISTER RULE, AS THE REVIEWER READS IT — tracker issue 333.
+//
+// The report goes to a lawyer who layers advice on top, and that lawyer's client reads the same page.
+// The band, the summary, the basis line and the one-liners are the whole product for the second reader,
+// and they were the hardest lines on it: single sentences of seventy-odd words in the lawyer's
+// vocabulary. The owner's ruling is that default-visible text carries no legal or engine vocabulary at
+// all, and that inside a fold the lawyer's words are allowed where a plain one would lose precision.
+//
+// THIS IS ADVISORY AND MUST STAY ADVISORY. A hit is a rewrite of that line — never a disclosure to the
+// client, never a run failure. The rule is presentation: it changes no band, no evidence and nothing
+// that is searched.
+//
+// — AND IT MUST NOT FIRE ON THE MARK IT IS CLEARING.
+//
+// This is the defect `coverage-form.mjs` records one level in: a refusal that cannot tell a mark from
+// engine vocabulary blocked a clearance on the mark SLICE, and a render-time substitution turned "AXIS
+// Bank filed in class 36" into "group Bank filed in class 36" on a report clearing AXIS. Half the words
+// here are ordinary English and several are plausible marks — PREVAIL, SENIOR, SPECIFICATION. A check
+// that flagged the mark under clearance would put noise on exactly the report that matters most, so
+// every term the run is about is excluded before the text is read.
+
+/**
+ * The lawyer's vocabulary, as WORKED EXAMPLES with the plain form beside each. Not a ban list: the
+ * issue rejects "a list of forbidden words as the mechanism" in terms, and this is what the reviewer
+ * offers a seat as the rewrite, which is a different thing from a gate that refuses.
+ *
+ * Each entry is [what a lawyer writes, what the reader needs]. The second half is the load-bearing one —
+ * a flag naming a word teaches nothing, and the seat has to produce a sentence.
+ */
+export const PLAIN_FORMS = Object.freeze([
+  ["proprietor", "owner"],
+  ["subsisting", "live"],
+  ["specification", "goods list"],
+  ["citable", "earlier marks the office can raise against you"],
+  ["prevail", "win"],
+  ["formative", "names built on"],
+  ["belt-and-braces", "extra"],
+  ["non-use attack", "could be cancelled for not being used"],
+  ["on the record as it stands", "on what we found"],
+  ["marks-and-goods comparison", "same name, same goods"],
+  ["dispatch", "the request"],
+  ["instructed", "what was asked"],
+  ["chunk", ""],
+]);
+
+/** The longest visible sentence a reader should meet. The issue's number, not a derived one. */
+export const SENTENCE_WORD_LIMIT = 25;
+
+/** Everything the run is ABOUT — the mark, its variants, the owners named. Never flagged. */
+const ownTerms = (about = {}) => {
+  const out = [];
+  for (const v of [about.mark, ...(about.marks ?? []), ...(about.owners ?? []), ...(about.terms ?? [])]) {
+    const s = String(v ?? "").trim();
+    if (s) out.push(s.toLowerCase());
+  }
+  return out;
+};
+
+/** Sentences, split on terminators that end one. Crude on purpose — this counts words, not grammar. */
+export const sentencesOf = (text) =>
+  String(text ?? "").split(/(?<=[.!?])\s+/).map((s) => s.trim()).filter(Boolean);
+
+export const wordsIn = (sentence) => String(sentence ?? "").trim().split(/\s+/).filter(Boolean).length;
+
+/**
+ * What is wrong with one default-visible line, as rewrite advice. `[]` means nothing to say.
+ *
+ * `about` carries the run's own marks and owners so they are never reported — see the header. A term
+ * that IS the thing being cleared is not the lawyer's vocabulary, it is the subject.
+ */
+export function plainRegisterFlags(text, about = {}) {
+  const raw = String(text ?? "");
+  if (!raw.trim()) return [];
+  const mine = ownTerms(about);
+  // Blank the run's own terms before reading, rather than filtering hits afterwards: a mark can contain
+  // one of these words ("PREVAIL"), and a hit inside it is not a hit at all.
+  let scan = raw;
+  for (const t of mine) {
+    if (!t) continue;
+    scan = scan.replace(new RegExp(t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "gi"), " ");
+  }
+
+  const flags = [];
+  for (const [term, plain] of PLAIN_FORMS) {
+    const re = new RegExp(`\\b${term.replace(/[-]/g, "[- ]").replace(/\s+/g, "\\s+")}\\b`, "i");
+    if (!re.test(scan)) continue;
+    flags.push({
+      kind: "vocabulary",
+      term,
+      say: plain
+        ? `"${term}" is the lawyer's word — the reader needs "${plain}". Rewrite the sentence, do not swap the word.`
+        : `"${term}" is an engine word and has no place on a page a client reads. Rewrite the sentence.`,
+    });
+  }
+
+  for (const s of sentencesOf(raw)) {
+    const n = wordsIn(s);
+    if (n > SENTENCE_WORD_LIMIT) {
+      flags.push({
+        kind: "length",
+        words: n,
+        say: `${n} words in one sentence, and a visible line takes ${SENTENCE_WORD_LIMIT}. Split it — one idea per sentence, `
+          + "the conclusion first. Do not shorten it by dropping the reason.",
+      });
+    }
+  }
+  return flags;
+}
+
+/**
+ * The fields a reader meets before opening anything. Named here rather than at each call site so the
+ * two products answer to one list — the knockout and the clearance drifted apart once already.
+ */
+export const DEFAULT_VISIBLE_FIELDS = Object.freeze({
+  knockout: ["summary", "batchOpener", "basis", "net", "factors", "counterFactors", "mitigation", "standardCaveats", "reviewerNotes"],
+  clearance: ["summary", "oneLiner", "registrability", "thirdPartyRights", "ownRights", "freedomToOperate", "reviewerNotes", "coverage"],
+});

package/driver/portal-access.mjs

@@ -17,7 +17,7 @@ const domainOf = (email) => { const e = String(email ?? "").toLowerCase(); const
 /**
  * makePrincipal({ email, grants, staffDomains }) →
  *   { role: "staff",  email, accounts: "*" }            — firm identity: everything, acting-for allowed
- * | { role: "client", email, accounts: ["aurora", …] }  — enrolled client: exactly the granted accounts
+ * | { role: "client", email, accounts: ["foxglade", …] }  — enrolled client: exactly the granted accounts
  * | null                                                — unknown identity: no portal (the door 403s)
  * Staff wins over an (accidental) grants row; a client row with a tenant-wide "*" grant is honored
  * but the role stays client (no staff surfaces).

package/driver/portal-acks.mjs

@@ -6,7 +6,7 @@
 // On the test instance they are the dominant content — a wall of dead runs crowding out the work
 // actually running, which is the one thing that section exists to show.
 //
-// WHAT THIS IS NOT. It is not a state change on the run, not a delete, and NOT 's retire. Retiring
+// WHAT THIS IS NOT. It is not a state change on the run, not a delete, and NOT the retire. Retiring
 // writes `archive-tags.json`, which is pool-wide: it hides a run from everyone, including the brand
 // owner. Dashboard clutter is one person's annoyance, so it gets one person's store. Giving both to one
 // control would mean a staff member tidying their own dashboard silently hiding a client's run.

package/driver/portal-config-view.mjs

@@ -162,7 +162,7 @@ const FRONTED_MODES = new Set(["auth-proxy"]);
 /**
  * The auth row — the one row on this page that is NOT snapshot-derived, and deliberately so.
  *
- * WHY THIS BREAKS THE PAGE'S OWN RULE ON PURPOSE (, ruled 2026-08-21). Every other row here comes
+ * WHY THIS BREAKS THE PAGE'S OWN RULE ON PURPOSE (ruled 2026-08-21). Every other row here comes
  * from a snapshot because the portal cannot see the engine's environment. `PORTAL_AUTH_MODE` is the
  * opposite case: the PORTAL reads it (portal-service.mjs) and acts on it, so the portal is the
  * authoritative source for its own door. Routing it through flag-snapshot.mjs would publish another
@@ -239,6 +239,41 @@ export function authView({ mode = "", oidcIssuer = "", team = "", jwksUrl = "",
   };
 }
 
+/**
+ * Where the staff-domain rule was written, so a reader can go and undo it.
+ *
+ * ── WHY A PAGE THAT NAMES A RULE MUST ALSO NAME ITS ADDRESS ─────────────────────────────────────────
+ *
+ * The People & access screen renders the rule — "Anyone at <domain> — a rule, not a person" — and said
+ * nothing about where it came from. A reader who does not recognise the domain therefore learns that
+ * strangers may hold an administrator's view of their instance and has no next step at all: the value
+ * is in an environment variable, in one of two files depending on how the instance is run, and neither
+ * is named anywhere on the screen. The one outside reader who met this reported it as a back door,
+ * twice, which is the correct thing to do with an access rule you cannot trace.
+ *
+ * PURE, and it answers "could not tell" as itself. `envLoad` is `shared/env-local.mjs`'s own report of
+ * what this process read, so the answer describes the process actually serving the page rather than
+ * being composed from a path that some other process would have read — the distinction that module
+ * exists for. A service started by systemd took its configuration from an EnvironmentFile; a child of
+ * `clearotron start` was handed an explicit environment and read no file at all; a hand-run CLI read
+ * the CLI's file. Each gets its own sentence, because the remedy is a different file in each.
+ */
+export function staffRuleSource({ name = "PORTAL_STAFF_DOMAINS", value = "", envLoad = null,
+                                  unitEnvFile = null, cliEnvFile = null } = {}) {
+  if (!String(value ?? "").trim()) return null;
+  const reason = envLoad?.reason ?? null;
+  const applied = Array.isArray(envLoad?.applied) ? envLoad.applied : [];
+  if (reason === "read" && applied.includes(name))
+    return { name, where: `read from ${envLoad.path}` };
+  if (reason === "service-managed")
+    return { name, where: unitEnvFile ? `set in this service's environment file, ${unitEnvFile}` : "set in this service's environment" };
+  if (reason === "opted-out")
+    return { name, where: cliEnvFile
+      ? `handed to this service by the command that started it, which takes it from ${cliEnvFile} or derives it from the sign-in address`
+      : "handed to this service by the command that started it" };
+  return { name, where: cliEnvFile ? `set in this service's environment (the file it would otherwise read is ${cliEnvFile})` : "set in this service's environment" };
+}
+
 /**
  * The enrolment view: who is granted what, and where an enrolment is half done.
  *
@@ -246,7 +281,7 @@ export function authView({ mode = "", oidcIssuer = "", team = "", jwksUrl = "",
  * they are reported separately — a staff member absent from the grants file is normal, not a fault,
  * and listing them as "unenrolled" would bury the real problems.
  */
-export function accessView({ grants, staffDomains = [], knownAccounts = [], grantsFile = null }) {
+export function accessView({ grants, staffDomains = [], knownAccounts = [], grantsFile = null, staffRule = null }) {
   const tenants = grants?.tenants ?? {};
   const known = new Set(knownAccounts);
   const people = [];
@@ -277,6 +312,10 @@ export function accessView({ grants, staffDomains = [], knownAccounts = [], gran
   return {
     people: people.sort((a, b) => a.email.localeCompare(b.email)),
     staffDomains: [...staffDomains],
+    // An ADDITIONAL field rather than a reshape of `staffDomains`: that array is parsed by the browser
+    // contract and read by three screens' worth of arms, and a rule nobody can trace is a copy problem,
+    // not a data-shape problem. Null when there is no rule, or when the source could not be told.
+    staffRule,
     // Accounts named in grants that no profile matches — the other typo direction.
     unknownAccounts: [...unknownAccounts].sort(),
     // Where to go to change any of this — a filename and a date, so "I want to add someone" has a
@@ -336,7 +375,7 @@ export function accessView({ grants, staffDomains = [], knownAccounts = [], gran
  * because a log is unbounded by nature and this runs inside a web request.
  */
 /**
- * 's outcome rows — the events that record a request being TURNED AWAY rather than done. Kept
+ * That outcome rows — the events that record a request being TURNED AWAY rather than done. Kept
  * beside the reader rather than in portal-service.mjs so this file has no import cycle with the
  * service that writes them; the names are the contract between the two and are asserted in the test.
  */

package/driver/portal-families.mjs

@@ -18,7 +18,7 @@
 // ── the shape ────────────────────────────────────────────────────────────────────────────────────────
 //
 //   { "schema": 1,
-//     "families": { "hydra-range": { "name": "Hydra range", "account": "aurora" } },
+//     "families": { "hydra-range": { "name": "Hydra range", "account": "foxglade" } },
 //     "of":       { "<runId>": "hydra-range" } }
 //
 // Keyed by RUN rather than by mark. A mark is not a thing the pool stores — it is a grouping the browser

package/driver/portal-local-auth.mjs

@@ -137,7 +137,7 @@ export function readLocalCredential(path) {
  */
 export function credentialPathFor(env = process.env, home = null) {
   // `homedir()` is resolved ON THE RETURN LINE, not as a signature default, and that is deliberate:
-  // 's arm finds the single line naming the credential's env override and asserts the fallback
+  // That arm finds the single line naming the credential's env override and asserts the fallback
   // derives from homedir() rather than a literal path. A one-line decision gets a one-line check, and
   // a signature default would put the fact where that check cannot see it. `home` stays injectable.
   //

package/driver/portal-report.mjs

@@ -21,7 +21,7 @@ import { SUMMARY_BLOCK_LINE } from "../shared/summary-blocks.mjs";
 // a brand lockup, links to the pool index, status, profiles, and a "Clients" dropdown listing
 // EVERY customer by key:
 //
-//     <a href="../customer/zephyr/">…  <a href="../customer/aurora/">…
+//     <a href="../customer/coastline/">…  <a href="../customer/foxglade/">…
 //
 // That is correct for a file a lawyer opens from the archive, and it is a disclosure of the client list
 // to anybody else. It has to come out before the document is embedded, and not because the nav is ugly:
@@ -388,7 +388,7 @@ function dropConnectorToken(html) {
 //
 // That is not a subtle degradation. chrome.css is 35KB of shared typography and layout, and among the
 // rules that went missing was `.lk-flag{width:10px;height:10px}` — sizing a lockup element that has
-// since been retired ( applied 's ruling to this lockup too), an SVG with no intrinsic size
+// since been retired ( applied the ruling to this lockup too), an SVG with no intrinsic size
 // falling back to the browser default for a replaced element and painting at 300x150. The reported
 // symptoms — "a huge flag at the bottom", "font sizings inconsistent, multiple font types" — were one
 // cause: this file did not load. The example is historical; the failure mode is not, and any sizing
@@ -463,7 +463,7 @@ html{scrollbar-gutter:stable}
 // three functions the document already exposes to its own buttons. `openAll`/`pickAll` take a boolean and
 // nothing else; `exportPDF` takes no argument at all.
 const FEEDBACK_CSS = `
-/* tracker issue 260 — the per-finding flag. Injected here rather than in render.mjs, which is frozen and produces
+/* the per-finding flag. Injected here rather than in render.mjs, which is frozen and produces
    every report ever delivered: putting the control at SERVE time means it reaches reports baked long
    before feedback existed, and the document on disk stays exactly what was delivered. */
 .pf-bar{display:flex;align-items:center;gap:8px;flex-wrap:wrap;margin-top:10px;padding-top:9px;border-top:1px solid var(--line,#e5ded4)}
@@ -590,7 +590,7 @@ const EMBED_JS = `
   // <body>), so by the time it runs for an '#c<ordinal>' link the ancestors are already open and the
   // measured offset is the revealed position. preventDefault stops the frame's dead-end fragment
   // navigation for the links the document's handler does not claim (#common-law, #only-you).
-  // tracker issue 735 — AND WHEN THERE IS NO PARENT, DO NOT CANCEL THE CLICK.
+  // AND WHEN THERE IS NO PARENT, DO NOT CANCEL THE CLICK.
   //
   // Everything above is right INSIDE the portal's Result screen. Un-framed it is a dead link: parent is
   // window, the message is posted to this same document, and the only 'message' listener here requires
@@ -638,7 +638,7 @@ const FEEDBACK_JS = `
 (function(){
   var TAG='cordillera-report';
   function schedule(){ try{ parent.postMessage({source:TAG,type:'height',height:document.body.scrollHeight+16},'*'); }catch(e){} }
-  // tracker issue 260 — PER-FINDING FEEDBACK, and why it posts outward instead of fetching.
+  // PER-FINDING FEEDBACK, and why it posts outward instead of fetching.
   //
   // This frame has NO allow-same-origin (Result.tsx), so its origin is "null": it holds no portal
   // session, a credentials:'include' fetch sends nothing, and a request from here arrives unauthenticated.
@@ -650,11 +650,11 @@ const FEEDBACK_JS = `
   // service reads those from the run's own artifacts, so nothing typed inside this frame can decide
   // which finding a flag lands on or whose matter it is labelled with.
   //
-  // tracker issue 487 — THE POSITION IS TWO NUMBERS ON THE KNOCKOUT LANE, and it used to be none.
+  // THE POSITION IS TWO NUMBERS ON THE KNOCKOUT LANE, and it used to be none.
   //
   // The clearance report numbers its findings once across the document and hangs each on a
   // div.card with id "c<ordinal>". The knockout report has neither: its conflicts render as div.ko-find,
-  // and tracker issue 471 restarts ordinals at 1 FOR EACH MARK. So this selector matched nothing on a knockout report
+  // and the knockout report restarts ordinals at 1 FOR EACH MARK. So this selector matched nothing on a knockout report
   // and the control was never drawn — the channel was not merely resolving wrong, it was absent. A
   // reader could not flag a knockout finding at all.
   //

package/driver/portal-service.mjs

@@ -38,7 +38,7 @@ import { readFileSync, existsSync, readdirSync, statSync } from "node:fs";
 import { storeInRepo, storeOutsideRepoMessage, makeCommittableAudit, resolveStoreRepoRoot, makeStoreCommit } from "../shared/store-in-repo.mjs";   //,
 import { customerStoreDir, customerStoreLine } from "../shared/customer-store.mjs";   // — one store for the surface and the runs
 import { clientFailureNote } from "../shared/client-failure-note.mjs";   // — one sentence, three surfaces
-import { bareInvocation, invocationPrefix } from "../shared/invocation.mjs";   // — and why this one surface is by NAME
+import { bareInvocation, invocationPrefix, installRoute } from "../shared/invocation.mjs";   // — and why this one surface is by NAME
 import { stdioConnectOffer, stdioConnectFor, STDIO_SHAPES } from "../shared/stdio-connect.mjs";   // — ONE author for the connect route
 import { connectOffers, offersForWire } from "../shared/connect-clients.mjs";                 // — ONE table, resolved server-side
 // — the portal became an ISSUANCE PATH here, deliberately and by owner ruling.
@@ -92,7 +92,7 @@ import { readFlagSnapshot, builtFor, registerCanCountFor, registerTerritoriesFor
 import { isDemo, demoPostureLine } from "./demo-posture.mjs";   
 import { triggerCapGap, triggerCapWarning } from "./trigger-cap.mjs";   // F51 — one answer, three surfaces
 import { makeUpstream } from "./portal-upstream.mjs";
-import { flagView, accessView, observedView, authView } from "./portal-config-view.mjs";
+import { flagView, accessView, observedView, authView, staffRuleSource } from "./portal-config-view.mjs";
 import { livePosture } from "./flag-snapshot.mjs";   // — for the capture-vs-box comparison only, never for a value
 import { familiesView, groupRuns, ungroupRuns } from "./portal-families.mjs";
 import { validateJob } from "./enqueue-schema.mjs";
@@ -102,7 +102,7 @@ import { batchMarkName } from "./mark-name.mjs";
 import { DEFAULT_CLIENT_DAILY_RUNS, accountUsage } from "./usage-ledger.mjs";
 import { productIdentity } from "../shared/product-identity.mjs";   // AGPL §13 — one answer, three surfaces
 import { engineCommit } from "./engine-build.mjs";                  // — the SAME stamp pool meta records
-// — siblings, on their own line: 's guard pins the line above and its subject is the JOIN
+// — siblings, on their own line: the guard pins the line above and its subject is the JOIN
 // (this endpoint and pool meta stamp the same function), not the import list. Kept separate so that
 // pin keeps reading the shape it was written against.
 import { engineCommitDate, engineProvenance } from "./engine-build.mjs";
@@ -948,7 +948,7 @@ const DENIAL_REASON = Object.freeze({
  *
  * The capture path it gates is intact: `feedback-store.mjs`, `feedback-issues.mjs`, `feedback-mint.mjs`,
  * `scripts/feedback-mint.mjs` and their suites are untouched and still green. Re-enabling is this
- * constant, the `feedback: true` argument at the serve call site, and reverting 's portal-ui half.
+ * constant, the `feedback: true` argument at the serve call site, and reverting the portal-ui half.
  */
 const FEEDBACK_CAPTURE = false;
 
@@ -968,7 +968,7 @@ const NON_MUTATING_POSTS = Object.freeze(["/portal/api/compose/read", "/portal/a
 /**
  * Does a refusal on this route owe the audit log a line?
  *
- * ── WIDENS 's ANSWER, and the reason is on that issue ─────────────────
+ * ── WIDENS the ANSWER, and the reason is on that issue ─────────────────
  *
  * scoped this to `/portal/admin/*` plus the one named client write, on the reasoning that the
  * other write routes "already file a richer row" of their own. Measured, that is true of their
@@ -980,9 +980,9 @@ const NON_MUTATING_POSTS = Object.freeze(["/portal/api/compose/read", "/portal/a
  *
  * So the rule is now the PREFIX, not a list: a POST under `/portal/api` or `/portal/admin` is a write
  * unless it is named above. A route added later is covered without anybody remembering to add it,
- * which is the half of 's shape that kept failing.
+ * which is the half of the shape that kept failing.
  *
- * STILL REFUSALS ONLY, and 's cost argument is why that half is unchanged: `/portal/admin/observed`
+ * STILL REFUSALS ONLY, and the cost argument is why that half is unchanged: `/portal/admin/observed`
  * reads this log back through a fixed 256 KiB tail, so every row a success files is span that panel can
  * no longer see. The routes that file a rich success row keep filing it and nothing duplicates it.
  *
@@ -1029,6 +1029,11 @@ function outcomeRow({ event = "request-refused", method, path, email = null, sta
 export function makePortalService({
   poolRoot, workspaceRoot, recipesDir = undefined, secret,
   staffDomains = [], grants = null,
+  // Where the staff-domain rule is written, for the People & access page to name. INJECTED, because
+  // the answer is a fact about the PROCESS — which file, if any, it took its configuration from — and
+  // this constructor is deliberately pure over its inputs. Null means "no rule, or could not tell",
+  // and the page then says nothing rather than guessing at a path.
+  staffRule = null,
   // The queue directories the RUNNER drains — the same list it hands checkRunCaps. The allowance counter
   // and the quota pre-check read their ledger beside these, so they count what the wall counts (:
   // they used to reconstruct a workspace-relative path that resolved to nothing once the queue moved out
@@ -1077,7 +1082,7 @@ export function makePortalService({
   // — IS THE PER-FINDING FLAG CAPTURE ON? It is not, and `FEEDBACK_CAPTURE` is why (see above).
   //
   // A SEAM SO THE RETAINED PATH STAYS TESTED, which is the whole difference between disabled and
-  // rotting. The resolver below carries 's two-lane shape and 's disposition read; the owner
+  // rotting. The resolver below carries the two-lane shape and the disposition read; the owner
   // ruled disable rather than delete, and code nothing can execute is code nobody can prove still works.
   // The eleven route tests in portal-service.test.mjs pass `feedbackCapture: true` and keep exercising it.
   //
@@ -1158,7 +1163,7 @@ export function makePortalService({
         // ── — COVERAGE RIDES BESIDE AVAILABILITY, NOT INSIDE IT ───────────
         //
         // The owner, on his own install with a partial register: "i cannot press the button for Global
-        // prelim search. Why. it doesnt appear disabled, no message etc — but i cant select it." The
+        // clearotron search. Why. it doesnt appear disabled, no message etc — but i cant select it." The
         // product is orderable now (owner ruling on that issue), and what the register does not reach
         // is a SENTENCE on a live row rather than the reason a dead one cannot be pressed.
         //
@@ -1338,7 +1343,7 @@ export function makePortalService({
         assertPrincipal(principal, { door: true });   // door check only — a multi-account client enters and gets the picker list
         // `accountNames` — the DISPLAY name of each account this identity holds, and nothing else.
         //
-        // Every profile carries a name ("Vantor Labs", "Aurora Interactive"); the account KEY is a
+        // Every profile carries a name ("Vantor Labs", "Foxglade Interactive"); the account KEY is a
         // slug ("vantor"). Staff read names because the account picker fetches the staff-only
         // roster; a client had no name source at all, so the identical screen printed the slug at them.
         // The same brand owner therefore read two different ways depending on who signed in, which is
@@ -1386,12 +1391,18 @@ export function makePortalService({
         // must leave the button alone rather than infer demo from an absent file.
         return { status: 200, json: { role: principal.role, email: principal.email, accounts: principal.accounts, accountNames,
           concurrentRuns: concurrentRunsCap(), brand: BRAND.name, engineMode: flagView(poolRoot).engineMode,
+          // HOW THIS INSTALL ARRIVED, so a screen can name the setup command the reader can actually
+          // type. `npm run setup` and `npx clearotron install` are the same wizard and each one is
+          // unrunnable on the other route; the no-engine notice named one of them and was wrong for
+          // half its readers. A WORD, never a command line and never a prefix: `invocationForm` can
+          // answer with this machine's absolute path, and this value is rendered in a browser.
+          setupRoute: installRoute(),
           // — a button that always fails must not render as available. The reason is
           // operator-shaped and staff-only; a client reads the generic sentence the button carries.
           controls: { stop: { available: stopControl.available !== false,
             reason: principal.role === "staff" ? (stopControl.reason ?? null) : null } } } };
       }
-      // /portal/api/about — the AGPL §13 source offer (,)
+      // /portal/api/about — the AGPL §13 source offer ()
       //
       // UNAUTHENTICATED, DELIBERATELY, and it is the only route here that is. §13 obliges an operator
       // running a modified version to offer the source to the users interacting with it — the offer is
@@ -2500,7 +2511,7 @@ export function makePortalService({
         // row, and a retired-endpoint row is a different fact from a not-yours row. If an old open tab is
         // still clicking Flag, that is a thing worth being able to count.
         //
-        // WHAT IS DELIBERATELY STILL BELOW THIS LINE: the whole resolver — 's two-lane shape, 's
+        // WHAT IS DELIBERATELY STILL BELOW THIS LINE: the whole resolver — the two-lane shape, 's
         // disposition read, the server-side-locator rule. The owner ruled "disable services and any code",
         // and the acceptance criterion says re-enabling must be a switch and not a rebuild. Deleting 130
         // lines of hard-won doctrine would have made it a rebuild.
@@ -2568,7 +2579,7 @@ export function makePortalService({
         //
         // JOINED ON ORDINAL **AND** MARK, and it resolves NOTHING on a mismatch. report-data projects the
         // same parsed findings array publish read from that same findings.json, so the ordinals are one
-        // set — but a wrong disposition on a lawyer's flag is worse than no disposition ('s ruling on
+        // set — but a wrong disposition on a lawyer's flag is worse than no disposition (the ruling on
         // the batch lane, applied here), so the mark is checked rather than assumed.
         //
         // CLEARANCE ONLY, on purpose. publish/knockout.mjs emits no disposition, so `found?.disposition`
@@ -2655,7 +2666,7 @@ export function makePortalService({
         // report every switch as off on a box where they are on — and this page, of all pages, would be
         // believed.
         if (parts[2] === "config" && method === "GET") {
-          // THE AUTH ROW IS READ LIVE, HERE, and not from the snapshot (, ruled 2026-08-21).
+          // THE AUTH ROW IS READ LIVE, HERE, and not from the snapshot (ruled 2026-08-21).
           // Everything else on this page is RENDERED from the snapshot. The reason recorded here used
           // to be "because this process has no engine environment", and that has not been true since
           // the owner's 2026-08-26 one-configuration-per-server-box ruling gave every unit the same
@@ -2822,7 +2833,7 @@ export function makePortalService({
             const p = envFrom(process.env, "CLEAROTRON_ACCESS_FILE");
             if (p) grantsFile = { name: basename(p), modifiedAt: new Date(statSync(p).mtimeMs).toISOString() };
           } catch { /* reported as unknown; a failed stat must not take down the page that explains access */ }
-          return { status: 200, json: accessView({ grants: grantsNow(), staffDomains, knownAccounts, grantsFile }) };
+          return { status: 200, json: accessView({ grants: grantsNow(), staffDomains, knownAccounts, grantsFile, staffRule }) };
         }
         // /portal/admin/observed — who has actually USED this instance lately, from the audit log.
         //
@@ -3212,7 +3223,7 @@ const escHtml = (t) => String(t).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<"
 // mentioned. A colour literal reappearing in this function is what
 // `driver/test/door-pages-take-their-colours-from-brand.test.mjs` fails on.
 //
-// The dark ground moved with that change: the block this page used to carry had guessed tracker issue 17150f/#ece5d8,
+// The dark ground moved with that change: the block this page used to carry had guessed #17150f/#ece5d8,
 // and brand pack §01 fixes dark at #0f0e0c near-black + #f0e8d8 parchment. The pack wins.
 export function loginPage({ email, error = null, signedIn = false }) {
   const title = signedIn ? "Signed in" : "Sign in";
@@ -3408,7 +3419,7 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
     // PATHNAME ONLY. `req.url` carries the query string and this row must not; parsed defensively
     // because the outer catch can run before `url` was successfully built.
     const pathOnly = (u) => { try { return new URL(String(u ?? ""), "http://localhost").pathname; } catch { return ""; } };
-    // SAME SCOPE AS THE ROUTER'S ('s Out of scope). Without this the door files a row for every
+    // SAME SCOPE AS THE ROUTER'S (the Out of scope). Without this the door files a row for every
     // 302 to the login page and every rate-limited poll of /portal/api/runs — which is per-request
     // access logging arriving through the other entrance, and the first cut of this change did exactly
     // that. Computed once so a redirect and a 500 on the same request cannot disagree about it.
@@ -3506,7 +3517,7 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
       // local-auth block, so calling it from here threw ReferenceError and this route answered 500 —
       // worse than the dead link it replaced, because a dead link looks like a dead link and a 500
       // looks like the server broke. Found by `npm run lint:driver`, which says it in one line
-      // (`'redirect' is not defined`), and by role-dev/Grogu driving the route rather than reading it.
+      // (`'redirect' is not defined`), and by driving the route rather than reading it (review, 2026-08).
       // Hoisting that helper would move it away from the comment explaining its own no-`?next=` rule,
       // so the four lines live here instead.
       if (!localAuth && url.pathname === "/portal/sign-out") {
@@ -3669,7 +3680,7 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
         // THE ROW THE ISSUE WAS FILED ABOUT. Both doors throw this shape — the Cloudflare edge's verify
         // and the local sign-in's LocalAuthError — so one line here covers a refused write on either
         // deployment. Before the Accept split below, because a refusal is one event however it renders.
-        // A FIXED VOCABULARY, NEVER `e.message` ('s third criterion: "a refusal must not become a
+        // A FIXED VOCABULARY, NEVER `e.message` (the third criterion: "a refusal must not become a
         // new disclosure surface"). This message comes out of `verify()` — the Cloudflare edge's JWT
         // check, a third-party library on some deployments — and nothing constrains what it puts in
         // there: a claim value, a subject, a fragment of the token it just rejected. The row is read
@@ -3915,6 +3926,14 @@ const PORT = PORT_CHOICE.port;
   const grants = () => loadGrants({});
   const staffDomains = (process.env.PORTAL_STAFF_DOMAINS || "").split(",").map((s) => s.trim()).filter(Boolean);
   if (!staffDomains.length && !grants()) { log(`FATAL: neither PORTAL_STAFF_DOMAINS nor CLEAROTRON_ACCESS_FILE configured — nobody could ever sign in (fail-closed).`); process.exit(1); }
+  // WHERE THAT RULE IS WRITTEN, resolved once at boot and handed to the service. `loaded` is this
+  // process's own report of which file configured it — never a path composed here, which would answer
+  // for a process that read nothing (see `envFileRead`'s note in shared/env-local.mjs).
+  const { loaded, unitEnvPath, envLocalPath } = await import("../shared/env-local.mjs");
+  const staffRule = staffRuleSource({
+    value: process.env.PORTAL_STAFF_DOMAINS, envLoad: loaded,
+    unitEnvFile: unitEnvPath(), cliEnvFile: envLocalPath(),
+  });
 
   const { config } = await import("./driver.config.mjs");
   const { appendFileSync: append } = await import("node:fs");
@@ -3929,7 +3948,7 @@ const PORT = PORT_CHOICE.port;
   // is what an operator reads, never mentioned the file existed.
   //
   // So triage of "I clicked Retire and it errored" looked at 17 lines of startup banner and concluded
-  // the request never arrived. 's own triage recorded that same absence as its central lead and
+  // the request never arrived. its own triage recorded that same absence as its central lead and
   // called it "the first thing to explain" — there was nothing to explain, and a second investigation
   // spent itself on the same non-signal.
   //
@@ -4188,7 +4207,7 @@ const PORT = PORT_CHOICE.port;
       // The result was not a failure. It was worse. With the overlay unset, resolveSkillPath falls back
       // to the PRODUCT REPO's own driver/skills — where the customer frameworks either do not exist
       // (a config-store-only customer → the page's fail-loud "could not be read" card) or exist as the SYNTHETIC
-      // DEMO fixtures the sellable codebase ships (Aurora, Zephyr → "Aurora Interactive risk framework
+      // DEMO fixtures the repository carries for the suite (a framework titled "… risk framework
       // (synthetic demo)", source_deck "content invented"). The second case renders with a title, a band
       // ladder and band meanings, and is indistinguishable on screen from the client's real framework.
       // A lawyer read invented risk definitions as their client's own for as long as this was live.
@@ -4356,7 +4375,7 @@ const PORT = PORT_CHOICE.port;
   const service = makePortalService({ poolRoot: config.poolRoot, workspaceRoot: config.workspaceRoot,
     // Re-read per request (a getter that rescans), so a workspace created after boot is counted.
     queueDirs: () => config.queueDirs,
-    secret, staffDomains, grants, trigger, stopRun, audit, auditPath, upstream, composeRead, stopControl,
+    secret, staffDomains, staffRule, grants, trigger, stopRun, audit, auditPath, upstream, composeRead, stopControl,
     // — the ONLY place the environment is read for this. `bin/start.mjs` is the
     // only thing that sets it, and it sets it explicitly rather than passing the operator's inherited
     // environment through, so a stray `.env` can neither put a live install into demo mode nor take a

package/driver/portal-upstream.mjs

@@ -96,7 +96,7 @@ export const PATH_FIELDS = ["frameworkPath", "workedExamplesPath"];
 /**
  * The code-owned values, READ-ONLY, for display. The page shows them badged; it cannot send them.
  *
- * Two of them are PATHS INSIDE THE ENGINE — `skills/prelim-search/risk-framework-zephyr.md` — and they
+ * Two of them are PATHS INSIDE THE ENGINE — `skills/prelim-search/risk-framework-<customer>.md` — and they
  * are withheld from a client here, on the server, where the role is already in hand. The React page has
  * filtered them out of its own render since the rebuild, but a filter in the browser is a display
  * convenience and not a wall: the value still crossed the wire and was one devtools tab away.
@@ -129,7 +129,7 @@ export function readOnlyFields(profile, { staff = false } = {}) {
  *
  *   house    "…IP Risk Assessment Framework.pptx (Privileged & Confidential), transcribed 2026-07-05
  *             (doc 50); supersedes the client-transposed neutral default"
- *   aurora   "Synthetic demo transposition of a customer risk deck (structure faithful, content
+ *   demo     "Synthetic demo transposition of a customer risk deck (structure faithful, content
  *             invented), doc 50 shape"
  *   triage   "Ported from the interactive knockout-searches skill's 5-tier rating system (SKILL.md
  *             rating table + calibration rules), doc 50 shape"