clearotron 0.2.1 → 0.2.3

package/bin/onboard.mjs

@@ -64,11 +64,16 @@ import { stdin as input, stdout as output } from "node:process";
 import { accessSync, constants, copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, chmodSync } from "node:fs";   // read the process table here; moved that to shared/process-table.mjs
 import { homedir, userInfo } from "node:os";
 import { invocationPrefix } from "../shared/invocation.mjs";   // — one rule for how the reader invokes us
+import { nodeFloorVerdict } from "../shared/node-floor.mjs";   // — the floor is package.json engines, not a constant here
 import { invocationForm } from "../shared/invocation.mjs";   // — and WHY that form
 import { standFrom } from "../shared/invocation.mjs";   // is this tree one npm replaces?
 import { installShim } from "../shared/verb-shim.mjs";   // — the verb goes on PATH
 import { styleFor, banner } from "../shared/tty-style.mjs";   // — weight where the meaning is
-import { bracketAsciiCells } from "../shared/brand.mjs";      // F18 — the mark, from the geometry the SVG already uses
+import { bracketAsciiCells, BRAND } from "../shared/brand.mjs";      // F18 — the mark, from the geometry the SVG already uses
+// ONE CLASSIFIER, shared with `bin/start.mjs`. The wizard asks the question; the launcher enforces the
+// answer. Two copies of "what does this domain admit" is a wizard that consents to one rule and a
+// launcher that builds another.
+import { classifyStaffDomain, domainOfEmail, staffDomainRefusal, staffGrantSentence } from "../shared/staff-domain.mjs";
 import { join, dirname, isAbsolute, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { delimiter } from "node:path";
@@ -121,7 +126,6 @@ const ENV_PATH = envLocalPath({ repoRoot: REPO });   // resolved, never composed
 // command is applying. Writes stay on ENV_PATH: a writer that followed the file backwards would keep an
 // install in the directory npm replaces forever.
 const READ_ENV_PATH = () => activeEnvPath({ repoRoot: REPO });
-const NODE_FLOOR = 22;
 
 const argv = process.argv.slice(2);
 const has = (n) => argv.includes(n);
@@ -133,7 +137,7 @@ const PROBE_ENGINE = has("--probe-engine");
 // issue 1871 — the same opt-in shape, for the credentials that had no proof at all. Never implied by
 // a plain --check: this SPENDS, and on two of the register adapters the count IS a billable search.
 const PROBE_PROVIDERS = has("--probe-providers");
-// tracker issue 149 — the same opt-in shape again, and this one WRITES: every registration it gets
+// the same opt-in shape again, and this one WRITES: every registration it gets
 // accepted CREATES an OAuth client on the operator's account. `doctor` promises in INSTALL.md that it
 // writes nothing, and that promise is why a reader runs it on a production box without thinking. So
 // this is never implied, it says what it is about to create before it creates it, and it reports what
@@ -141,7 +145,7 @@ const PROBE_PROVIDERS = has("--probe-providers");
 const PROBE_CONNECTOR = has("--probe-connector");
 
 // ── output ───────────────────────────────────────────────────────────────────────────────────────────
-// WEIGHT WHERE THE MEANING IS (, owner ruling 2026-08-31). Every line here used to
+// WEIGHT WHERE THE MEANING IS (owner ruling 2026-08-31). Every line here used to
 // be the same weight, which is why the passphrase and the coverage reason both disappeared into their
 // surroundings — two defects on that issue that are formatting defects wearing other clothes.
 //
@@ -587,6 +591,80 @@ export const AMBIENT_KEYS = [
 // ── helpers ──────────────────────────────────────────────────────────────────────────────────────────
 const present = (v) => typeof v === "string" && v.trim() !== "";
 
+/**
+ * Ask who signs in, and take a real yes for the access rule that address implies.
+ *
+ * ── WHY THIS QUESTION EXISTS AT ALL ─────────────────────────────────────────────────────────────────
+ *
+ * Setup never asked for an address. `clearotron start` therefore took one from `--user`, from
+ * `PORTAL_LOCAL_USER`, or from the local account as `<account>@localhost` — and derived a STAFF RULE
+ * from everything after its `@`. On the local-account default that rule is `localhost`: one machine,
+ * one identity, nothing granted to anyone. Given a real address it is that address's whole domain, and
+ * the settings page then reports it back as "Anyone at <domain> — a rule, not a person".
+ *
+ * An outside install reached exactly that state. Nobody typed the address into this wizard, because
+ * this wizard had no prompt for it; an assistant filled one into the environment file on the operator's
+ * behalf, and the install granted a documentation domain. They read their own settings page and
+ * reported it as a back door. They were right to: a grant to a group had been made, by nobody.
+ *
+ * So the address is asked for here, where a person is definitionally present, and the grant it implies
+ * is shown in the words the settings page uses BEFORE it is written. `start` no longer guesses: it
+ * refuses a rule wider than one machine unless `PORTAL_STAFF_DOMAINS` says so in writing, which is what
+ * a yes here writes.
+ *
+ * THE DEFAULT IS THE LOCAL ACCOUNT AND NOTHING ELSE — not the git author, not the hostname, not a shell
+ * variable. An identity that becomes an access rule comes from the person, or from the one source that
+ * cannot name a second person.
+ *
+ * `io` IS INJECTED for the reason `offerUsptoSync`'s is: the branch that matters is the one where a
+ * reader pressed Enter at the grant question and NOTHING must be granted, and closed over a terminal
+ * that branch is asserted nowhere. Returns the `.env` keys to write and nothing else.
+ */
+export async function askSignIn(io, { localAccount = "user", staffLabel = "Staff", envPath = "" } = {}) {
+  const { askValue, confirm, say = () => {}, ok = () => {}, info = () => {},
+          warn = () => {}, problem = () => {} } = io;
+  const localDefault = `${localAccount}@localhost`;
+  prose("The portal admits one address on this install, and that address is also what decides who is an",
+        "administrator. Enter accepts the local-account form, which is this machine and nobody else.");
+  for (;;) {
+    const typed = String(await askValue("Sign-in address:", { def: localDefault })).trim().toLowerCase();
+    if (!typed.includes("@") || typed.indexOf("@") !== typed.lastIndexOf("@")) {
+      problem(`"${typed}" is not a single email address. The portal refuses a multi-@ identity outright, `
+        + "so this would sign in and then be denied at the door.");
+      continue;
+    }
+    const domain = domainOfEmail(typed);
+    const verdict = classifyStaffDomain(domain);
+    if (verdict === "public" || verdict === "reserved") {
+      // The classifier's own sentence, never a second copy: `clearotron start` prints these same words
+      // when it meets the same domain, and two wordings of one refusal is how a reader comes to believe
+      // they have met two different problems.
+      problem(staffDomainRefusal(domain));
+      continue;
+    }
+    if (verdict === "narrow") {
+      ok(`${typed} — this machine only. No domain rule is written, and nobody else is granted anything.`);
+      return { PORTAL_LOCAL_USER: typed };
+    }
+    // `wide`: a real domain, so the grant is a grant. Stated first, in the settings page's own words,
+    // and Enter is NOT a yes — the default is no, because this is the one answer in the wizard that
+    // admits people the reader has never met.
+    say("");
+    warn(`${typed} makes this a rule about ${domain}, not about you.`);
+    say(`    ${staffGrantSentence(domain, { staffLabel })}`);
+    say("");
+    say(`  Everyone at ${domain} who gets past this install's sign-in door would see every brand owner`);
+    say("  on it — every clearance, every report, every configuration. On a laptop that is only you,");
+    say("  because only one address can sign in. Behind a company login it is the whole domain.");
+    say("");
+    if (await confirm(`Grant ${domain} that, and write it down as PORTAL_STAFF_DOMAINS?`, false))
+      return { PORTAL_LOCAL_USER: typed, PORTAL_STAFF_DOMAINS: domain };
+    info(`nothing granted${envPath ? `, and nothing written to ${envPath}` : ""}. ${typed} would sign in `
+      + "and every page would refuse it, because signing in is not being enrolled — so choose the "
+      + "local-account form, or answer yes above.");
+  }
+}
+
 /**
  * An engine binary, resolved the way the engine resolves it — and the trap that resolution carries.
  *
@@ -693,8 +771,8 @@ export async function preflightCandidate(candidate) {
 /** Ask EUIPO for a token. This is the check that makes "refuses to persist a bad secret" true. */
 export async function validateEuipo({ clientId, clientSecret, environment }) {
   try {
-    const { resolveConfig } = await import(join(REPO, "providers", "euipo", "src", "core.js"));
-    const { getAccessToken } = await import(join(REPO, "providers", "euipo", "src", "euipo-client.js"));
+    const { resolveConfig } = await import(pathToFileURL(join(REPO, "providers", "euipo", "src", "core.js")).href);
+    const { getAccessToken } = await import(pathToFileURL(join(REPO, "providers", "euipo", "src", "euipo-client.js")).href);
     await getAccessToken(resolveConfig({ clientId, clientSecret, environment }), { force: true });
     return { ok: true };
   } catch (e) {
@@ -705,7 +783,7 @@ export async function validateEuipo({ clientId, clientSecret, environment }) {
 /** One minimal Perplexity call. Costs a request, so it is never made without being asked for. */
 export async function validatePerplexity(apiKey) {
   try {
-    const { buildRequestBody, callAgentAPI } = await import(join(REPO, "providers", "perplexity", "src", "core.js"));
+    const { buildRequestBody, callAgentAPI } = await import(pathToFileURL(join(REPO, "providers", "perplexity", "src", "core.js")).href);
     await callAgentAPI(apiKey, buildRequestBody({ task: "Reply with the single word: ok.", preset: "fast-search" }), { retries: 0 });
     return { ok: true };
   } catch (e) {
@@ -998,9 +1076,9 @@ export async function runCheck() {
   }
 
   say("\n  Node");
-  const major = Number(process.versions.node.split(".")[0]);
-  if (major >= NODE_FLOOR) ok(`node ${process.versions.node}`);
-  else problem(`node ${process.versions.node} — this engine needs >= ${NODE_FLOOR} (node:sqlite and TS type-stripping are load-bearing)`);
+  const nodeV = nodeFloorVerdict();
+  if (nodeV.ok) ok(`node ${nodeV.current}`);
+  else problem(`node ${nodeV.current} — this engine needs ${nodeV.required} or newer; node:sqlite is not a built-in module before then`);
 
   // Read the file up here rather than at the `.env` heading below: the engine section is the first that
   // needs `effective()`, and which ENGINE is configured decides which binary variable to check. Reading
@@ -1053,7 +1131,7 @@ export async function runCheck() {
   // deliberate — a second reader would drift from this one exactly as the composer and the checker did
   // in F41, and the drift is invisible because both sides keep passing their own arms.
   const unitDir = join(homedir(), ".config", "systemd", "user");
-  const { BACKGROUND_UNITS } = await import(join(REPO, "bin", "start.mjs"));
+  const { BACKGROUND_UNITS } = await import(pathToFileURL(join(REPO, "bin", "start.mjs")).href);
   const hosted = BACKGROUND_UNITS.some((u) => existsSync(join(unitDir, u)));
   const unitEnv = hosted
     ? unitEnvironment({
@@ -1166,8 +1244,48 @@ export async function runCheck() {
         + "and the MCP connection are live right now; `npm run example` needs no engine.");
       info(`To leave demo: install ${engSpec.vendor}'s CLI (\`${engSpec.fallback}\`), then ${engSpec.signIn}.`);
     } else {
-      info("MODE: engine attached, sign-in UNPROVEN — a binary resolves, and whether it can complete a turn "
-        + "is not knowable from the filesystem. --probe-engine is what settles it.");
+      info("The engine program is installed. Whether it is signed in cannot be read from disk: run "
+        + "clearotron doctor --probe-engine to find out.");
+    }
+
+    // AND WHETHER THE ENGINE AGREES, which is a different question from the one above and the reason an
+    // outside user gave up on this product. This command reads its OWN environment; the portal's New
+    // clearance screen reads what the engine recorded when it last started. Both were right and they
+    // said opposite things, so a reader who checked the confident-looking one first was told the engine
+    // was fine while no search would start. Reported here in the same words the configuration page uses,
+    // because a doctor that cannot see a contradiction the product ships with is the wrong doctor.
+    try {
+      const { readFlagSnapshot, postureDisagreement } = await import("../driver/flag-snapshot.mjs");
+      // THE READ-SIDE ACCESSOR, because this is a read: `config.poolRoot` throws on a box with no pool
+      // configured, and `readFlagSnapshot(null)` already answers "no capture" for exactly that case.
+      const snap = readFlagSnapshot(config.poolRootOrNull);
+      const rows = snap
+        ? postureDisagreement(snap, { flags: {}, engine: engineInventory(invEnv) })
+        : null;
+      // NULL IS NOT AGREEMENT and neither is an empty pool — a box with no capture has nothing to
+      // disagree with, and saying so beats printing a clean bill nobody measured.
+      const clash = (rows ?? []).find((r) => r.what === "engine program");
+      if (clash) {
+        problem(`The engine that last ran and this machine disagree about the engine program: the last run `
+          + `recorded it as ${clash.capture}, this machine reads it as ${clash.live}. A NEW search will `
+          + `refuse while that is true. Restart the engine service so it re-reads its PATH, or install the `
+          + `CLI where the service can see it.`);
+      }
+    } catch (e) {
+      // WHAT ACTUALLY REACHES THIS CATCH, established by driving it rather than by reading it.
+      //
+      // Not a box with no pool: `poolRootOrNull` answers null and `readFlagSnapshot(null)` answers null,
+      // neither throwing. And NOT an unreadable capture either — `readFlagSnapshot` has its own try and
+      // returns null for a corrupt file, so a damaged capture is already indistinguishable from an absent
+      // one by the time this code sees it. That is worth knowing and is not this change's to fix.
+      //
+      // So this catch covers an import that has broken or an unexpected throw out of the comparison —
+      // the check having stopped running. A doctor silent about its own failure is the defect the rest of
+      // this change is about, an absence rendered as a clean bill, so it says so. A caution rather than a
+      // problem: the engine may be perfectly fine and it is this check that is broken.
+      info(`Could not compare this machine against what the engine last recorded (${e?.message ?? e}). `
+        + `That comparison is what catches a settings page reading healthy while a search will not start, `
+        + `so this run has not checked it either way.`);
     }
 
     // item 5 — WHICH BILLING LANE, reported rather than left to be inferred from a variable's
@@ -1188,8 +1306,8 @@ export async function runCheck() {
         if (e) envForResolve[k] = e.v;
       }
       const auth = resolveAuthMode({ engineName: engineId, env: envForResolve });
-      if (auth.mode === "unknown") info(`billing lane: not policied for ${engineId} — this engine declares no auth modes`);
-      else ok(`billing lane: ${auth.mode}${auth.apiBilled ? ` — metered per token against ${engSpec.apiKeyEnv}` : " — drawn against the signed-in subscription, not metered per token"}`);
+      if (auth.mode === "unknown") info(`billing: no policy for ${engineId} — this engine declares no sign-in modes`);
+      else ok(`billing: ${auth.mode}${auth.apiBilled ? ` — charged per token against ${engSpec.apiKeyEnv}` : " — charged to the signed-in subscription, not per token"}`);
     } catch (e) {
       problem(String(e?.message ?? e));
     }
@@ -1366,7 +1484,7 @@ export async function runCheck() {
       // Both lines were honest about their own source and neither said what it was. The first reads this
       // command's env file; the second reads THIS PROCESS's resolution, and a CLI is started by a login
       // shell that carries none of the units' `EnvironmentFile`. The deployment was correct and served
-      // celsius, microsoft and generic throughout.
+      // the configured roster throughout.
       //
       // THE UNITS' ENV IS NOT PASSED INTO `profileStoreResolution`, deliberately. `PROFILES_OVERLAY_DIR`
       // is captured when profiles.mjs LOADS, so handing it the units' value would set `live` with no
@@ -1418,17 +1536,38 @@ export async function runCheck() {
         const demo = keys.filter((k) => roster.get(k)?.demoData === true);
         // `generic` is the universal fallback the module requires by name, not a brand owner somebody
         // onboarded — counting it would tell an operator with an empty store that they have one.
-        const owners = keys.filter((k) => k !== "generic");
+        //
+        // A DEMO ACCOUNT IS NOT AN ONBOARDED OWNER EITHER, and until this line it was counted as one. A
+        // fresh install used to ship the demo account into every roster, so `doctor` reported "1 brand
+        // owner(s) resolve here: demo-brand-owner (DEMO DATA)" on a machine where nobody had onboarded
+        // anything — and never named `generic`, which is the account that actually rates a run there.
+        // The reader is told they have a customer and not told what they are running on. Both halves
+        // wrong from one list.
+        //
+        // SINCE 2026-09-08 A FRESH INSTALL RESOLVES `generic` ALONE (owner ruling): nobody should have to
+        // clean demo material out of an environment they just created. So the demo branch below no longer
+        // fires on a plain install — it fires inside the demo, which asks for its own account. It is kept
+        // rather than deleted because it is still reachable, and a reader who meets the demo account
+        // there is owed the same two facts: it is fiction, and a real clearance under it is refused at
+        // the admission wall.
+        //
+        // Three states, told apart, because they mean three different things to whoever is reading:
+        // an onboarded roster, the house default alone, and the house default beside what the demo
+        // brought with it.
+        const owners = keys.filter((k) => k !== "generic" && !demo.includes(k));
         if (!owners.length) {
-          info(`no brand owners resolve here — only the \`generic\` fallback. An empty store is a working `
-            + `install on Generic defaults; it is also what a store pointed at the wrong directory looks like`);
+          const base = "`generic` is the account this install rates under — the house default, and the "
+            + "only one a clean install has";
+          if (demo.length) {
+            info(`${base}. The demo brought one with it, marked DEMO DATA: ${demo.join(", ")} — fiction `
+              + "rather than an account anybody onboarded, and a real clearance under one is refused");
+          } else {
+            info(`${base}. An empty store is a working install on Generic defaults; it is also what a `
+              + "store pointed at the wrong directory looks like");
+          }
         } else {
-          const marked = owners.map((k) => (demo.includes(k) ? `${k} (DEMO DATA)` : k)).join(", ");
-          const line = `${owners.length} brand owner(s) resolve here: ${marked}`;
-          // The demo marker is the member-level half: naming the store is not the
-          // same as saying the accounts in it are fiction, and a real clearance under one is refused at
-          // the admission wall — which an operator should learn here rather than from that refusal.
-          if (demo.length) info(`${line} — accounts marked DEMO DATA cannot start a real clearance`);
+          const line = `${owners.length} brand owner(s) resolve here: ${owners.join(", ")}`;
+          if (demo.length) info(`${line}. The demo brought one with it, marked DEMO DATA: ${demo.join(", ")} — not counted above, and a real clearance under one is refused`);
           else ok(line);
         }
         try {
@@ -1513,7 +1652,7 @@ export async function runCheck() {
   //
   // REPORTS, NEVER JUDGES: nothing here sets `problem()`. Drift is information for the reader, not a
   // fault in their install, and a doctor that called their own overrides broken would be wrong.
-  say("\n  Doctrine overlay");
+  say("\n  Custom instructions");
   try {
     const report = overlayReport({ baseRoot: config.skillsBaseDir, overlayRoot: config.skillsOverlayDir });
     for (const line of renderOverlayReport(report, { indent: "" })) say(`  ${line}`);
@@ -1528,7 +1667,7 @@ export async function runCheck() {
     // answer for somebody running the engine by hand. This line is what the services see.
     const svcDoctrine = effectiveForService("CLEAROTRON_INSTRUCTIONS_DIR");
     if (hosted && serviceKnown && svcDoctrine?.v && svcDoctrine.v !== config.skillsOverlayDir) {
-      info(`the services read a doctrine overlay this process does not: ${svcDoctrine.v} `
+      info(`the services read custom instructions this process does not: ${svcDoctrine.v} `
         + `(${svcDoctrine.from}). The lines above are this command's own environment — a CLI is not `
         + "started by the units' EnvironmentFile, so \"none configured\" here is not a statement about "
         + "the deployment");
@@ -1541,7 +1680,7 @@ export async function runCheck() {
     // An unreadable overlay THROWS by design (config.resolveSkillPath refuses rather than falling back
     // to the product's copy). Surfaced here rather than allowed to abort the whole check: the doctor's
     // job is to report every section, and a section that kills the run tells the reader least.
-    problem(`the doctrine overlay could not be read — ${e.message}`);
+    problem(`the custom instructions could not be read — ${e.message}`);
   }
 
   say("\n  Register provider");
@@ -1585,7 +1724,7 @@ export async function runCheck() {
   say("\n  Research provider");
   const px = effective("PERPLEXITY_API_KEY");
   if (px) ok(`PERPLEXITY_API_KEY present (${px.from}) — presence only; add --probe-providers to prove it answers`);
-  else info("PERPLEXITY_API_KEY is not set — the three clearance searches carry the common-law grid and cannot switch it off, so a clearance refuses at preflight; a Knockout search still runs and discloses the half it skipped");
+  else info("PERPLEXITY_API_KEY is not set — the three clearance searches carry the common-law grid and cannot switch it off, so a clearance stops before it starts, and names the missing key; a Knockout search still runs and discloses the half it skipped");
 
   // ── — THE LANES A PRODUCT DECLARES IT NEEDS, BEFORE A REPORT NAMES THEM ──
   //
@@ -1663,7 +1802,7 @@ export async function runCheck() {
   // could print, and the portal's own config view does — is deliberately not printed here: `doctor` goes
   // to a terminal, into a paste, into an issue.
   // THE ONE CONDITION THAT STOPS THE PORTAL RENDERING, and `doctor` said nothing about it at all
-  // (bb8, F2). `portal-ui/dist` is committed, so an absent bundle means a bad checkout on
+  // (found in review). `portal-ui/dist` is committed, so an absent bundle means a bad checkout on
   // a deployment and an unbuilt tree on a source clone; the service already answers 503 and says so in
   // its boot log, but a reader who runs `doctor` BEFORE `start` — which is the order every document
   // gives — had no way to learn it. The product's OWN predicate decides rather than a second existence
@@ -1770,7 +1909,7 @@ export async function runCheck() {
     }
   }
 
-  say("\n  Portal door");
+  say("\n  Portal sign-in");
   {
     const { authView } = await import("../driver/portal-config-view.mjs");
     const door = authView({
@@ -1785,10 +1924,11 @@ export async function runCheck() {
     // NOT A TICK, AND THAT IS THE POINT. This reads the environment THIS command is
     // typed in. `bin/start.mjs` INJECTS `PORTAL_AUTH_MODE: "local"` into the portal's own environment,
     // and a systemd unit's EnvironmentFile can name a third thing — so a green tick here was a
-    // confident claim about a door the running service may not be serving. Measured on the test box:
-    // doctor said `auth-proxy door (PORTAL_AUTH_MODE is unset)` with a tick while the box served
-    // cf-access, and said `local passphrase door` with a tick while it still served cf-access. Both
-    // green, neither the door a caller meets.
+    // confident claim about a door the running service may not be serving. Measured on the test
+    // machine, in the wording doctor used at the time: it said `auth-proxy door (PORTAL_AUTH_MODE is
+    // unset)` with a tick while the machine served cf-access, and said `local passphrase door` with a
+    // tick while it still served cf-access. Both green, neither the door a caller meets. Those two
+    // lines read differently now; what they claimed is the point, not how they were worded.
     //
     // The reading is still worth printing — it is what a hand-run process here would use, and it is
     // what `clearotron start` would launch from. It is stated as that, and the sentence below says
@@ -1808,7 +1948,7 @@ export async function runCheck() {
       say(`  · local passphrase door (${typed}) — one operator, one passphrase, no identity provider`);
       info(`a lost passphrase is recoverable: ${invocationPrefix()}clearotron passphrase --reset`);
     } else if (door.shape === "fronted") {
-      say(`  · auth-proxy door (${typed}) — identity is proved by whatever sits in front, and this process trusts it`);
+      say(`  · Sign-in: handled by a proxy in front (${typed}) — identity is proved by whatever sits in front, and this process trusts it`);
       for (const v of door.proxyValues) {
         if (v.present) ok(`  ${v.name} present`);
         else info(`  ${v.name} not set`);
@@ -1908,8 +2048,8 @@ export async function runCheck() {
     say("\n  Register lane — proven, not inferred");
     try {
       const [{ activeProvider }, { makeLaneProbe, probeSpend, DEFAULT_CONTROLS, loadProviderCapabilities }] = await Promise.all([
-        import(join(REPO, "driver", "driver.config.mjs")),
-        import(join(REPO, "providers", "_shared", "lane-probe.mjs")),
+        import(pathToFileURL(join(REPO, "driver", "driver.config.mjs")).href),
+        import(pathToFileURL(join(REPO, "providers", "_shared", "lane-probe.mjs")).href),
       ]);
       const adapter = activeProvider();
       // NOT `adapter.capabilities` — that is null on every adapter, and reading it announced a LOCAL
@@ -1952,7 +2092,7 @@ export async function runCheck() {
     }
   }
 
-  say("\n  Data-plane paths");
+  say("\n  Where files are stored");
   // Each entry is a FUNCTION, called only on the branch that prints it, so a getter is read at access
   // time and never captured as a constant here. The reader of this command is deciding what to
   // provision; a default quoted from memory is the one thing that can send them to the wrong path and
@@ -1963,7 +2103,7 @@ export async function runCheck() {
     // whole rather than summarised: a summary is a second copy, and a second copy is what drifted.
     ["CLEAROTRON_REPORTS_DIR", (name) => {
       const d = defaultWith(name, () => config.poolRoot);
-      return d.refusal ?? `${name} is not set — the published-report pool falls back to ${d.value}`;
+      return d.refusal ?? `${name} is not set — the published-reports folder falls back to ${d.value}`;
     }],
     ["CLEAROTRON_WORK_DIR", (name) => {
       const d = defaultWith(name, () => config.workspaceRoot);
@@ -1985,67 +2125,6 @@ export async function runCheck() {
   // The status surface the ruling names: "status should say whether a key is still valid". Stopping
   // the door revokes nothing — a key outlives every teardown until it expires or its id is denylisted —
   // so a doctor that reported the unit and stayed silent about the keys would bless exactly the state
-  // the issue was filed about. Judged by the verifier's own pieces (`connectKeyReport` takes the real
-  // `isRevoked`), never by a second opinion written here.
-  // ── THE PROFILE STORE RESOLVES, OR THE PORTAL 500s ────────────────────────
-  //
-  // Asked by RUNNING the engine's own resolution, not by re-deriving it: loadProfiles() layers the
-  // configured store over the bundled base with generic falling through by name, and its refusal text
-  // is the exact line the portal prints on every screen when this is broken. A doctor that stayed
-  // green over that state would bless the owner's fresh-install 500.
-  say("\n  Profile store");
-  try {
-    const { loadProfiles } = await import(join(REPO, "driver", "profiles.mjs"));
-    const resolved = loadProfiles({ force: true });
-    const named = [...resolved.keys()];
-    ok(`resolves: ${named.length} profile(s) (${named.slice(0, 6).join(", ")}${named.length > 6 ? ", …" : ""}) — the universal fallback is present`);
-  } catch (e) {
-    problem(`the profile store does NOT resolve — every portal profile screen and every run refuses on this: ${e.message}`);
-  }
-
-  // ── THE SUBMIT LANE, WALKED (the owner's 502, 2026-09-02) ────────────────────────────────────────
-  //
-  // Every surface on that box was green while the portal's Start button had no engine to call. This is
-  // the only check that asks the question the client's own path asks, so it goes before the connector
-  // section: a dead submit lane matters more than a connector nobody has configured yet.
-  // ── SETTINGS THIS BUILD DOES NOT READ ( tracker issue 168) ────────────────────────────────────────
-  //
-  // THE SURFACE AN OPERATOR CHECKS AFTER AN UPGRADE, and until now the surface that told them
-  // everything was fine. Upgrading the production install across the `PRELIM_*` rename left thirteen
-  // configured settings with no reader in the new build; doctor exited 0 and mentioned none of them.
-  //
-  // EVERY ENVIRONMENT THE DEPLOYMENT ACTUALLY READS, not this shell's alone — the F34 lesson one step
-  // on. A hosted box's values live in the file the units load, so checking `process.env` here would
-  // pass a box whose units carry thirteen dead lines. Each source is named in its own row: "it is in
-  // your env file" and "it is in the units' environment" are different fixes.
-  //
-  // A source that could not be read is NOT reported as clean. `unitEnvironment` already distinguishes
-  // that, and an unreadable unit environment is said out loud rather than counted as zero dead names —
-  // an absence of evidence is not evidence of absence, and this whole check exists because something
-  // invisible was being read as fine.
-  {
-    const { retiredSpellingsIn, retiredSpellingLine } = await import(join(REPO, "shared", "env-aliases.mjs"));
-    const sources = [
-      { label: "your environment file", env: fileEnv, known: true },
-      { label: "this shell's environment", env: process.env, known: true },
-    ];
-    if (hosted) sources.push({ label: "the units' environment", env: unitEnv?.env, known: unitEnv?.known === true });
-
-    const seen = new Set();
-    let anyUnknown = false;
-    for (const src of sources) {
-      if (!src.known || !src.env) { if (src.label === "the units' environment") anyUnknown = true; continue; }
-      for (const row of retiredSpellingsIn(src.env)) {
-        // One row per NAME, not per source: a name set in both the file and the units is one thing to
-        // fix, and two rows would read as two faults.
-        if (seen.has(row.name)) continue;
-        seen.add(row.name);
-        inertSetting(`${retiredSpellingLine(row)} (found in ${src.label})`);
-      }
-    }
-    if (anyUnknown) warn(couldNotDetermine("retired setting names", unitEnv));
-    if (!seen.size && !anyUnknown) ok("no retired setting names — every configured name is one this build reads");
-  }
 
   // LINGERING, WHICH NOTHING ELSE CHECKS ( — F9). `--background` installs USER units,
   // and a user manager without lingering is torn down at logout: the units stop with the session and
@@ -2075,9 +2154,9 @@ export async function runCheck() {
       + "failing to look, not a report that it is off.");
   }
 
-  say("\n  Submit lane");
+  say("\n  Start-button path");
   try {
-    const { triggerLaneVerdict, HOSTED, SUPERVISED } = await import(join(REPO, "shared", "trigger-lane.mjs"));
+    const { triggerLaneVerdict, HOSTED, SUPERVISED } = await import(pathToFileURL(join(REPO, "shared", "trigger-lane.mjs")).href);
     // POSTURE FROM THE BOX, NOT FROM A FLAG. Units installed means the units serve, and the units read
     // %h/.env — so an absent value there is the incident. No units means `start` supervises and derives
     // the value at runtime, where reading this process's environment says nothing either way.
@@ -2117,7 +2196,7 @@ export async function runCheck() {
     // Stop control's availability on — one reader, two surfaces.
     let verbs = null;
     try {
-      const { opsTokenPosture } = await import(join(REPO, "driver", "portal-service.mjs"));
+      const { opsTokenPosture } = await import(pathToFileURL(join(REPO, "driver", "portal-service.mjs")).href);
       verbs = opsTokenPosture(opsToken).verbs;
     } catch { /* unreadable posture leaves verbs null, which reads as full ops — see the verdict */ }
     let probe = null;
@@ -2153,12 +2232,12 @@ export async function runCheck() {
   } catch (e) { warn(`the submit lane could not be read: ${e.message}`); }
 
   say("\n  Client connector");
-  // THE REVOCATION LIST, REPORTED ( — bb8's F14). `isRevoked` treats an unreadable
+  // THE REVOCATION LIST, REPORTED (found in review). `isRevoked` treats an unreadable
   // denylist as "not revoked", so a named-but-absent file makes every revocation silently ineffective:
   // measured on a default install, a revoked key completed a full handshake with nothing logged. Nothing
   // surfaced that state anywhere, which is why it survived to be found by hand.
   {
-    const { defaultDenylistPath } = await import(join(REPO, "shared", "client-door.mjs"));
+    const { defaultDenylistPath } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
     const dl = effective("TRADEMARK_MCP_TOKEN_DENYLIST")?.v || defaultDenylistPath(homedir());
     try {
       const n = readFileSync(dl, "utf8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#")).length;
@@ -2172,8 +2251,8 @@ export async function runCheck() {
     }
   }
   try {
-    const { clientDoorState: doorState, describeDoorState, connectKeyReport, CLIENT_DOOR_UNIT: doorUnit } = await import(join(REPO, "shared", "client-door.mjs"));
-    const { loadGrants: readGrantsFile, isRevoked: revokedCheck } = await import(join(REPO, "shared", "scope.mjs"));
+    const { clientDoorState: doorState, describeDoorState, connectKeyReport, CLIENT_DOOR_UNIT: doorUnit } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
+    const { loadGrants: readGrantsFile, isRevoked: revokedCheck } = await import(pathToFileURL(join(REPO, "shared", "scope.mjs")).href);
     // ── CONFIGURED IS NOT RUNNING, AND THIS IS THE SURFACE IT WAS MEASURED ON ──
     //
     // `describeDoorState` was written for exactly this block and then never called from it: the split
@@ -2242,14 +2321,14 @@ export async function runCheck() {
     const doorEnvKnown = !hosted || unitEnv?.known === true;
     const doorEnv = hosted && unitEnv?.known === true ? unitEnv.env : process.env;
     if (!doorEnvKnown) warn(couldNotDetermine("CLIENT_MCP_ACCOUNT_ACCESS", unitEnv));
-    // THE PORT AND ITS ALLOW-LIST ARE ONE SETTING, AND NOTHING SAID SO (, Hera's
-    // operator pass). `start` derives CLIENT_MCP_ALLOWED_HOSTS from the port it resolved, so moving the
+    // THE PORT AND ITS ALLOW-LIST ARE ONE SETTING, AND NOTHING SAID SO (found in an operator pass).
+    //  `start` derives CLIENT_MCP_ALLOWED_HOSTS from the port it resolved, so moving the
     // port THROUGH start works. Moving it in the env file the units load does not: the door binds the
     // new port and then answers "403 Invalid Host header" on every request, because the allow-list still
     // names the old one. A door that is up, listening, and refuses everything is the worst of the three
     // states to debug, and nothing surfaced the mismatch.
     {
-      const { clientDoorPort: portOf, allowedHosts: hostsFor } = await import(join(REPO, "shared", "client-door.mjs"));
+      const { clientDoorPort: portOf, allowedHosts: hostsFor } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
       const declared = String(effective("CLIENT_MCP_ALLOWED_HOSTS")?.v ?? "").trim();
       if (declared) {
         const port = portOf(doorEnv);
@@ -2265,14 +2344,14 @@ export async function runCheck() {
       }
     }
 
-    // IS ANYTHING ANSWERING? ( — bb8's F11.) The unit file is evidence about the
+    // IS ANYTHING ANSWERING? (found in review) The unit file is evidence about the
     // background shape only. A foreground `clearotron start` runs the door as its own child with no unit
     // at all, and this section then told a reader whose door was listening that it "is not set up here",
     // pointing them at the command they had just run. One loopback connect settles it, and null stays
     // null — a probe that could not be made is not a door that is absent.
     let doorListening = null;
     try {
-      const { clientDoorPort: portOf } = await import(join(REPO, "shared", "client-door.mjs"));
+      const { clientDoorPort: portOf } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
       const { createConnection } = await import("node:net");
       doorListening = await new Promise((resolve) => {
         const sock = createConnection({ host: "127.0.0.1", port: portOf(doorEnv), timeout: 700 });
@@ -2307,10 +2386,10 @@ export async function runCheck() {
       problem("a valid key is on record but NO revocation list is configured (TRADEMARK_MCP_TOKEN_DENYLIST unset) "
         + `— \`${invoke("disconnect")}\` could not actually revoke it. \`${invoke("connect")}\` arms one; set the variable or reconnect.`);
     }
-    // THE PUBLISHED ADDRESS, AND WHETHER IT ANSWERS (, acceptance 2). Reported here
+    // THE PUBLISHED ADDRESS, AND WHETHER IT ANSWERS (acceptance 2). Reported here
     // rather than beside the unit, because the unit running and the address being reachable are
     // different facts and the second is the one a client depends on.
-    const { clientDoorReachability } = await import(join(REPO, "shared", "client-door.mjs"));
+    const { clientDoorReachability } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
     // FROM THE FILE THE UNITS LOAD, NOT THE SHELL THIS COMMAND WAS TYPED IN (the tracker issue 226
     // family, met again here). On a hosted box the published address lives in the units' environment,
     // and reading `process.env` reported "no client connector address is published — that is correct
@@ -2357,7 +2436,7 @@ export async function runCheck() {
     // No new credential and no provider API: the audience is in the redirect handed to a caller with
     // no session at all, which is the request just made.
     {
-      const { readAudience, audienceVerdict } = await import(join(REPO, "shared", "access-audience.mjs"));
+      const { readAudience, audienceVerdict } = await import(pathToFileURL(join(REPO, "shared", "access-audience.mjs")).href);
       const configuredAud = effectiveForService("CLEAROTRON_OIDC_AUDIENCE")?.v ?? "";
       const read = readAudience(probe ?? { error: "the published address was never asked" });
       // NOTHING IS CLAIMED ABOUT A BOX THAT USES NO EDGE. With no audience configured AND no Access
@@ -2370,6 +2449,27 @@ export async function runCheck() {
         // unreachable; repeating it as a second failure teaches the reader that this section
         // double-counts. It still states what was NOT established, which is the whole job.
         else if (v.kind === "could-not-look") info(v.message);
+        // NO ACCESS IN FRONT OF THE CLIENT DOOR IS A POSTURE, NOT A FAULT (owner ruling 2026-09-08).
+        //
+        // This is the CLIENT connector's address, and how a client reaches it is the client's decision:
+        // "client access sitting behind OAuth is totally up to a client — plenty might just run it token
+        // based on their own laptop." A door answering with its own Bearer challenge and no Access front
+        // is a supported shape, not a misconfiguration, so raising it made `doctor` exit 1 on a healthy
+        // deployment and taught its reader to skim the one command that must never be skimmed.
+        //
+        // It is still SAID rather than dropped, and it still states what was not established: an
+        // audience that was never compared is not an audience that agreed. What changed is that the
+        // sentence no longer calls a client's own arrangement a finding about this install.
+        //
+        // Scoped deliberately to `not-fronted` on THIS address. A configured audience that DISAGREES
+        // with the one the edge issues is still a fault, and the portal and ops surfaces are untouched —
+        // they are checked elsewhere and Access in front of them is not optional.
+        else if (v.kind === "not-fronted") {
+          info(`nothing is fronting this hostname with Access — ${read.why}. That is this client door's `
+            + "posture rather than a fault: a client may reach it with its own token and no Access in "
+            + "front, which is a supported shape. The configured audience was not compared against this "
+            + "address, so nothing here says the two agree.");
+        }
         else problem(v.message);
       }
     }
@@ -2383,7 +2483,7 @@ export async function runCheck() {
     // announces the side effect first, and its control runs before any vendor.
     if (PROBE_CONNECTOR && String(published ?? "").trim()) {
       const { registrationEndpointFrom, probeRegistration, describeRegistration } =
-        await import(join(REPO, "shared", "connector-signin-probe.mjs"));
+        await import(pathToFileURL(join(REPO, "shared", "connector-signin-probe.mjs")).href);
       say("");
       say("  --probe-connector: asking this door's sign-in whether each assistant vendor could register.");
       say("  Each attempt that SUCCEEDS creates a throwaway OAuth client on your account, which you may");
@@ -2571,7 +2671,7 @@ try {
   // is DERIVED: the engines from ENGINE_BINARIES, the search vendors from the same adapter tables the
   // prompts loop over, each wearing its own table row's where-to-get line. A hand-kept copy here would
   // be the SERPAPI defect again, one screen earlier. Everything is skippable; the list says so.
-  // THE BANNER — once, on entry, named (, owner ruling 2026-08-31). Not on every
+  // THE BANNER — once, on entry, named (owner ruling 2026-08-31). Not on every
   // command: a banner every verb prints is how a product becomes tiresome to use twice. It sits here
   // rather than at the top of main() so that `--check`, which writes nothing and is run repeatedly,
   // does not wear it either.
@@ -2581,7 +2681,7 @@ try {
   say("");
   say(`  ${style.bold("Before you start")} — what this setup can take, so nothing here surprises you:`);
   // `vendor`, not `label`: the labels are engineer sentences carrying flag names, and a question a
-  // lawyer reads may not ('s first rule).
+  // lawyer reads may not (the first rule).
   say(`    · Which AI runs the searches (${Object.values(ENGINE_BINARIES).map((e) => e.vendor).join(" or ")}),`);
   say("      and how it bills — the subscription you already sign in with, or an API key.");
   say("    · Your trademark register vendor's credential, if you have one (a register can be chosen later).");
@@ -2594,13 +2694,13 @@ try {
 
   // 1 ── Node
   say("  Node");
-  const major = Number(process.versions.node.split(".")[0]);
-  if (major < NODE_FLOOR) {
-    problem(`node ${process.versions.node} — this engine needs >= ${NODE_FLOOR}. Upgrade Node and run setup again.`);
+  const nodeV = nodeFloorVerdict();
+  if (!nodeV.ok) {
+    problem(`node ${nodeV.current} — this engine needs ${nodeV.required} or newer. Upgrade Node and run setup again.`);
     aborted = "node";
     throw new Error("node floor");
   }
-  ok(`node ${process.versions.node}`);
+  ok(`node ${nodeV.current}`);
 
   // 2 ── the engine: which one, which binary, and PROOF that it can run a turn
   //
@@ -2855,7 +2955,7 @@ try {
           }
         }
       }
-      // — bb8's F9, and the same trap closed one prompt over. The default
+      // — found in review, and the same trap closed one prompt over. The default
       // was YES, so Enter re-ran a probe that CANNOT succeed until the reader has signed in somewhere
       // else — and the wizard's own header tells them Enter is the safe key. Driven with Enter it went
       // 19 attempts, no cap and no escape, in a wizard whose header says everything here is skippable.
@@ -3049,7 +3149,7 @@ try {
   const baseDefault = join(homedir(), "trademark");
   prose("Reports, run workspaces, queues and locks all live under one directory.");
   if (poolDefault.refusal) {
-    prose(`Enter accepts ${baseDefault}. There is no built-in default for the pool — left unset a run`,
+    prose(`Enter accepts ${baseDefault}. There is no built-in default for the reports folder — left unset a run`,
           "refuses and names it rather than guessing — so setup gives it a real path under your home,",
           "and this install publishes only where you own the disk.");
   } else {
@@ -3095,7 +3195,7 @@ try {
   // The escape goes in the BRACKETS and the consequence in `skipped`, matching the two prompts that
   // already take this mode — the question no longer carries "(empty for none)" because the bracket now
   // says it, and a prompt that says it twice in two different wordings is how the two drift apart.
-  const reportsUrl = await askValue("Public base URL for the pool:", {
+  const reportsUrl = await askValue("Public base URL for the reports folder:", {
     skippable: true,
     skipped: "CLEAROTRON_REPORTS_URL left unset — runs will deliver, and their notifications will carry no link",
   });
@@ -3134,7 +3234,7 @@ try {
   prose("No default — it is your hostname. Skip it and this stays a local install: everything works",
         "here, and the Use-your-AI page says so rather than handing out an address that fails.");
   prose("The usual shape, and why: mcp-server/CONNECT.md.");
-  const { clientDoorReachability } = await import(join(REPO, "shared", "client-door.mjs"));
+  const { clientDoorReachability } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
   for (;;) {
     const clientUrl = await askValue("Public connector address:", {
       skippable: true,
@@ -3177,7 +3277,7 @@ try {
   // making a decision about where their customer data lives without being told they had made it.
   const cfgDefault = join(base, "config");
   say("\n  Where this install keeps its own configuration");
-  prose("Your customers and any doctrine you override live here, outside the checkout — which is what",
+  prose("Your customers and any instructions you override live here, outside the checkout — which is what",
         "lets you take updates with `git pull` instead of merging into files you never meant to own.");
   prose(`Enter accepts ${cfgDefault}, and your customers are written there.`);
   const cfg = await askValue("Configuration directory:", { def: cfgDefault });
@@ -3202,7 +3302,7 @@ try {
   candidate.PROFILE_REPO_ROOT = cfg;   // no alias row — this name is current
   for (const k of ["CLEAROTRON_CUSTOMERS_DIR", "PROFILE_REPO_ROOT"]) ok(`${k}=${candidate[k]}`);
 
-  // CLEAROTRON_INSTRUCTIONS_DIR IS DELIBERATELY NOT WRITTEN ( — bb8's F25).
+  // CLEAROTRON_INSTRUCTIONS_DIR IS DELIBERATELY NOT WRITTEN (found in review).
   //
   // Setup used to point it at `<cfg>/skills` and create that directory empty. `clearotron start` then
   // makes `<cfg>` a git repository for saved searches — so the doctrine store ends up INSIDE a checkout
@@ -3218,7 +3318,7 @@ try {
   // Note for whoever adds an overlay later: it needs this name set, which is why the line below says so
   // rather than leaving a reader to discover that files they dropped in are being ignored.
   info(`doctrine: this install overrides nothing, so CLEAROTRON_INSTRUCTIONS_DIR stays unset and the `
-    + `product's own files are used. To override a doctrine file later, put it in ${join(cfg, "skills")}, `
+    + `product's own files are used. To override an instruction file later, put it in ${join(cfg, "skills")}, `
     + `COMMIT it in ${cfg}, and set CLEAROTRON_INSTRUCTIONS_DIR to that directory — an uncommitted store `
     + "cannot be identified, and a run says so rather than guessing.");
 
@@ -3231,10 +3331,26 @@ try {
   // PRECISELY what shows through, because the last wording said "bundled customers" and the loader
   // says otherwise: the demo roster never layers into a deployment (a typo'd key must not resolve to
   // our fixtures), generic.json falls through BY NAME, and doctrine resolves file-by-file.
-  say("  Left empty. The house doctrine shows through file-by-file, and generic.json — the universal");
+  say("  Left empty. The bundled instructions show through file-by-file, and generic.json — the universal");
   say("  fallback — falls through by name, so an empty store is a working install. Your own customers");
   say("  are added here by name; the bundled demo customers never show through into your roster.");
 
+  // 7c ── WHO SIGNS IN, AND WHAT THAT ADDRESS GRANTS
+  //
+  // Setup never asked for an address, so `clearotron start` derived one — and derived a staff-domain
+  // rule from everything after its `@`. The whole reasoning, and the install that granted a
+  // documentation domain to a reader who had never been asked, is on `askSignIn` above.
+  section("Who signs in");
+  const localAccount = (() => {
+    try { return userInfo().username || "user"; } catch { return "user"; }
+  })();
+  // ONE CALL SITE. The loop itself lives in `askSignIn` so that the branch that matters — a reader who
+  // pressed Enter at the grant question, and a staff rule that must therefore NOT be written — is
+  // reachable without a terminal. The same seam and the same reason as `offerUsptoSync`.
+  Object.assign(candidate, await askSignIn(
+    { askValue, confirm, say, ok, info, warn, problem },
+    { localAccount, staffLabel: `${BRAND.name} staff`, envPath: ENV_PATH }));
+
   // 8 ── the engine's own preflight over the whole candidate
   //
   // — THIS STEP CHECKS THE REGISTER PROVIDER AND NOTHING ELSE. `preflightCandidate` pins
@@ -3289,7 +3405,7 @@ try {
   // rather than fall back, so a permissions fault can never silently swap a customer's framework for the
   // Generic default). Nothing is written INTO them — see the note at step 7b.
   for (const k of ["CLEAROTRON_CUSTOMERS_DIR"]) mkdirSync(candidate[k], { recursive: true });
-  ok(`configuration directories created under ${cfg} (empty — doctrine and the generic fallback show through; customers are yours to add)`);
+  ok(`configuration directories created under ${cfg} (empty — the bundled instructions and the generic fallback show through; customers are yours to add)`);
 
   // 9a ── PUT THE VERB ON THIS OPERATOR'S PATH
   //
@@ -3329,17 +3445,17 @@ try {
   // They are `clearotron` verbs now for a second reason as well: from an INSTALLED package there is
   // no `npm run example` to type — no package.json, no scripts block — so the old advice was not
   // merely misordered there, it was unrunnable.
-  // ONE COMMAND, AND WHAT TO EXPECT FROM IT (, the owner's point 10). This screen
+  // ONE COMMAND, AND WHAT TO EXPECT FROM IT (the owner's point 10). This screen
   // offered three, each with a sentence, and a reader who has just answered a page of questions is
   // being asked to make one more choice at the moment they most want to be told what to do. Three
   // equally-weighted options is not generosity; it is the decision handed back.
   //
   // `start` is the one, because it is the product — the other two were already ordered behind it for
-  // that reason (, when this screen offered `npm run example` and a raw pipeline invocation and
+  // that reason (when this screen offered `npm run example` and a raw pipeline invocation and
   // named the product nowhere). They keep their place as an afterthought line rather than an option.
   // THE COMMAND LINE STAYS A PLAIN LITERAL, DELIBERATELY. onboard-wizard.test.mjs reads this screen
   // STATICALLY — it extracts every say() literal and asserts which command leads — and that guard is
-  // the only thing standing between this screen and 's defect coming back. Wrapping the command in
+  // the only thing standing between this screen and the defect coming back. Wrapping the command in
   // style.bold() puts a nested template literal inside the say(), the extractor stops matching, and the
   // corpus goes empty. Its own comment records the previous generation of exactly this: the arms went
   // vacuous the moment these lines became template literals.
@@ -3360,7 +3476,7 @@ try {
   say("  What this box has now:");
   for (const line of [
     stateLine("register", candidate.CLEAROTRON_DATABASE, "no register, so every search refuses until one is chosen"),
-    stateLine("web research", present(candidate.PERPLEXITY_API_KEY) ? "a key" : "", "a clearance refuses at preflight; a knockout search runs and discloses the half it skipped"),
+    stateLine("web research", present(candidate.PERPLEXITY_API_KEY) ? "a key" : "", "a clearance stops before it starts, and names the missing key; a knockout search runs and discloses the half it skipped"),
     stateLine("data directory", candidate.CLEAROTRON_REPORTS_DIR, "unset"),
     stateLine("configuration store", candidate.CLEAROTRON_CUSTOMERS_DIR, "the bundled demo roster"),
     stateLine("notification links", candidate.CLEAROTRON_REPORTS_URL, "notifications carry no link into the report"),