clearotron 0.3.0-beta.10 → 0.3.0-beta.2

package/bin/onboard.mjs

@@ -63,13 +63,11 @@ import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { accessSync, constants, copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, chmodSync } from "node:fs";   // read the process table here; moved that to shared/process-table.mjs
 import { homedir, userInfo } from "node:os";
-import { invocationPrefix, installRoute, reachableCommand } from "../shared/invocation.mjs";   // — one rule for how the reader invokes us
+import { invocationPrefix } from "../shared/invocation.mjs";   // — one rule for how the reader invokes us
 import { nodeFloorVerdict } from "../shared/node-floor.mjs";   // — the floor is package.json engines, not a constant here
 import { invocationForm } from "../shared/invocation.mjs";   // — and WHY that form
 import { standFrom } from "../shared/invocation.mjs";   // is this tree one npm replaces?
 import { installShim } from "../shared/verb-shim.mjs";   // — the verb goes on PATH
-import { relocationPlan } from "../shared/permanent-install.mjs";   // — and the program out of npx's cache
-import { isWsl } from "../shared/wsl.mjs";   // — one answer to "is this WSL", shared with the connect lines
 import { styleFor, banner } from "../shared/tty-style.mjs";   // — weight where the meaning is
 import { bracketAsciiCells, BRAND } from "../shared/brand.mjs";      // F18 — the mark, from the geometry the SVG already uses
 // THE REFUSALS ABOUT THE SIGN-IN ADDRESS ITSELF, shared with `bin/start.mjs`. Two copies would be a
@@ -99,17 +97,9 @@ import { processTable } from "../shared/process-table.mjs";   // — /proc is no
 import { programsFromAnotherCheckout } from "../shared/checkout-move.mjs";
 import { entrypointOf } from "../driver/systemd/install-census.mjs";         // one ExecStart parser
 import { overlayReport, renderOverlayReport } from "../shared/doctrine-overlay.mjs";   // — the doctor reports the overlay
-import { whereSavesGo, storeCommitRefusal, storeInRepo, storeOutsideRepoMessage, resolveStoreRepoRoot } from "../shared/store-in-repo.mjs";   // — doctor says where a portal save goes once it is committed, and why saved searches are off
+import { whereSavesGo } from "../shared/store-in-repo.mjs";   // — doctor says where a portal save goes once it is committed
 import { engineInventory, engineMode, ENGINE_MODES } from "../driver/config-inventory.mjs";   //
-import { probeEngineTurn, probeFailureText, PROBE_TIMEOUT_SEC, engineEnvKeys } from "../driver/engine/probe.mjs";
-
-// THE PROVING SENTENCES NAME NO MODEL. They printed the driver's tier word, which is an Anthropic model's
-// name, on both engines, so a codex user was told setup was about to spend on a model family they do not
-// use. "Its cheapest model" is true of either engine and brands neither.
-export const probingLine = (engineId) =>
-  `Probing ${engineId} with one turn on its cheapest model (this SPENDS; ${PROBE_TIMEOUT_SEC}s ceiling)…`;
-export const proveQuestion = ({ engineId, lane }) =>
-  `Prove ${engineId} on the ${lane} lane now with one turn on its cheapest model (a few tokens, ${PROBE_TIMEOUT_SEC}s ceiling)?`;
+import { probeEngineTurn, probeFailureText, PROBE_MODEL, PROBE_TIMEOUT_SEC, engineEnvKeys } from "../driver/engine/probe.mjs";
 import { runRequiredNames, missingRequirements, REGISTER_ENV, ENGINE_ENV } from "../driver/run-requirements.mjs";   // the order-time gate's own question, asked here rather than restated
 import { pinEnv, envFrom } from "../shared/env-aliases.mjs";
 import { isEntrypoint } from "../shared/is-entrypoint.mjs";   // — one entry-point test, all spellings
@@ -130,12 +120,6 @@ function readIfPresent(path) {
 }
 
 const REPO = join(dirname(fileURLToPath(import.meta.url)), "..");
-// A PACKAGED INSTALL IS NOT A CHECKOUT. doctor says which one it is talking to, and names only commands
-// that run there: npm's scripts and a checkout's tree are not where a package's reader stands.
-const PACKAGED = installRoute(REPO) === "packaged";
-const THIS_TREE = PACKAGED ? "the installed package" : "this checkout";
-// The example job, by the path it has in THIS install, so the printed command runs from any directory.
-const EXAMPLE_JOB = join(REPO, "examples", "job.euipo.json");
 const ENV_PATH = envLocalPath({ repoRoot: REPO });   // resolved, never composed: one resolver, so moving this file later is one line
 // WHAT IS READ IS NOT ALWAYS WHERE THE NEXT WRITE GOES. An install configured before the move still
 // has its file at the old path, and the loader still reads it — so every READ here asks
@@ -711,8 +695,23 @@ export function resolveEngineBin(bin, { env = process.env, wsl = null, onWindows
 /** A path on a Windows drive as WSL mounts it. */
 export const ON_A_WINDOWS_DRIVE = /^\/mnt\/[a-z]\//i;
 
-/** Whether this is a Linux running under Windows: the one answer, from shared/wsl.mjs. */
-export { isWsl };
+/**
+ * Whether this is a Linux running under Windows.
+ *
+ * BOTH SIGNALS INJECTABLE, for the reason `platformEngineRefusal` gives: the readers this protects
+ * are the ones who cannot run this suite to find out, so a Linux runner has to be able to drive both
+ * answers rather than read the source and agree with it.
+ *
+ * A READ THAT FAILS ANSWERS "NOT WSL", and that is the direction that changes nothing: it leaves the
+ * resolution exactly as it was before this existed. Claiming WSL on a could-not-read would start
+ * refusing candidates under /mnt on an ordinary Linux box with an ordinary mount.
+ */
+export function isWsl({ env = process.env, procVersion = null } = {}) {
+  if (String(env.WSL_DISTRO_NAME ?? "").trim()) return true;
+  if (String(env.WSL_INTEROP ?? "").trim()) return true;
+  const v = procVersion ?? (() => { try { return readFileSync("/proc/version", "utf8"); } catch { return ""; } })();
+  return /microsoft|wsl/i.test(v);
+}
 
 /**
  * What to say about candidates passed over because they sit on a Windows drive — or `null` when none
@@ -1111,10 +1110,7 @@ export async function runCheck() {
     say("      Restart whatever supervises them; this command does not, because which supervisor owns");
     say("      them is a property of your deployment and not of this checkout.");
   } else if (running.state === "unknown") {
-    // A PACKAGED INSTALL HAS NO TREE TO BE BEHIND. npm replaces the whole package on an update, so this
-    // question belongs to a checkout, and on a package it is a `!` nothing can ever clear.
-    if (PACKAGED) info("running programs against a checkout's tree: not applicable to a packaged install");
-    else warn(`could not tell whether running programs are on the current tree: ${running.detail}`);
+    warn(`could not tell whether running programs are on the current tree: ${running.detail}`);
   }
 
   // ── AND THE MORE DANGEROUS ANSWER: A DIFFERENT TREE, NOT AN OLDER ONE ──────────────────────────────
@@ -1146,8 +1142,7 @@ export async function runCheck() {
     if (elsewhere.programs.length > 6) say(`      … and ${elsewhere.programs.length - 6} more`);
     say("      Either point the install back at the tree they run from, or restart them onto this one.");
   } else if (elsewhere.state === "unknown") {
-    if (PACKAGED && !configuredTree) info("running programs on a different checkout: not applicable to a packaged install");
-    else warn(`could not tell whether running programs are on a different checkout: ${elsewhere.detail}`);
+    warn(`could not tell whether running programs are on a different checkout: ${elsewhere.detail}`);
   } else if (elsewhere.state === "unplaced") {
     // PRINTED, because the alternative is silence that reads as a clean answer. Nothing here was placed
     // on a tree, which is not the same as everything being on the right one, and the reader is the only
@@ -1211,7 +1206,7 @@ export async function runCheck() {
   // deliberate — a second reader would drift from this one exactly as the composer and the checker did
   // in F41, and the drift is invisible because both sides keep passing their own arms.
   const unitDir = join(homedir(), ".config", "systemd", "user");
-  const { BACKGROUND_UNITS, startPaths } = await import(pathToFileURL(join(REPO, "bin", "start.mjs")).href);
+  const { BACKGROUND_UNITS } = await import(pathToFileURL(join(REPO, "bin", "start.mjs")).href);
   const hosted = BACKGROUND_UNITS.some((u) => existsSync(join(unitDir, u)));
   const unitEnv = hosted
     ? unitEnvironment({
@@ -1353,7 +1348,7 @@ export async function runCheck() {
     const installMode = engineMode(engineInventory(invEnv));
     if (installMode === ENGINE_MODES.DEMO) {
       info("MODE: demo — everything works except starting a NEW search. The example report, its audit trail "
-        + `and the MCP connection are live right now; \`${reachableCommand("demo")}\` needs no engine.`);
+        + "and the MCP connection are live right now; `npm run example` needs no engine.");
       // NAMES THE COMMAND, AND THE RESTART. The settings page says both now, and a doctor that named
       // the program but not how to install it — or that left out the restart, which is what actually
       // unsticks a reader who has just installed it — would be the third opinion this issue exists to
@@ -1445,7 +1440,7 @@ export async function runCheck() {
     } else if (!bin.executable || bin.relative) {
       info("not probed — there is no usable binary to probe. Fix the line above first.");
     } else {
-      say(`\n  ${probingLine(engineId)}`);
+      say(`\n  Probing ${engineId} with one ${PROBE_MODEL}-tier turn (this SPENDS; ${PROBE_TIMEOUT_SEC}s ceiling)…`);
       // The engine as a RUN would see it: environment first, .env behind it. Only the engine-selection
       // keys — the probe must bill exactly the way this box bills and moves no other variable.
       const probeEnv = { ...process.env };
@@ -1503,9 +1498,6 @@ export async function runCheck() {
     } else if (form.form === "shim-path") {
       warn(`${form.dir} is not on this shell's PATH, so the bare \`clearotron\` will not resolve here`);
       info(`add it with: export PATH="${form.dir}:$PATH"  — or open a new login shell`);
-    } else if (form.form === "npx-pinned") {
-      info(`this is running from npm's npx cache, so the commands below name this version through npx (\`${form.prefix.trim()}\`), `
-        + `which works from any directory and after npm cleans its cache; \`${invoke("install")}\` puts \`clearotron\` on your PATH`);
     } else if (form.shimKind === "ours-other-install") {
       warn(`${form.shim} is a shim for a DIFFERENT install (${form.otherInstall})`);
       info(`re-run \`${invoke("install")}\` to point the bare name at this one`);
@@ -1561,9 +1553,9 @@ export async function runCheck() {
   {
     const inCheckout = (p) => isInsideCheckout(p, REPO);
     for (const [name, what] of [
-      ["CLEAROTRON_CUSTOMERS_DIR", `customers resolve to the bundled demo roster IN ${THIS_TREE}`],
-      ["CLEAROTRON_INSTRUCTIONS_DIR", `doctrine resolves to the bundled files IN ${THIS_TREE}`],
-      ["PROFILE_REPO_ROOT", `the portal's profile editor commits INTO ${THIS_TREE}`],
+      ["CLEAROTRON_CUSTOMERS_DIR", "customers resolve to the bundled demo roster IN this checkout"],
+      ["CLEAROTRON_INSTRUCTIONS_DIR", "doctrine resolves to the bundled files IN this checkout"],
+      ["PROFILE_REPO_ROOT", "the portal's profile editor commits INTO this checkout"],
     ]) {
       // — WHICH NAME THE READER IS TOLD IS NOT ONE QUESTION, IT IS TWO.
       //
@@ -1636,13 +1628,6 @@ export async function runCheck() {
         // because a reader debugging `clearotron run` by hand IS this process.
         info(`this command's own process ${where} — a CLI is not started by the units' EnvironmentFile, so `
           + "that differs by design and is not what a run uses");
-      } else if (!hosted && svcCustomers?.from === serviceEnvLabel) {
-        // NAMED IN THE ENV FILE ALONE, ON AN INSTALL WITH NO UNITS. `clearotron start` loads that file and
-        // its services inherit the store; this command does not load it, so its own process fell back to
-        // the bundled roster and printed that as the answer, one line below a ✓ for the same variable.
-        ok(`the services resolve profiles from ${svcCustomers.v} (${svcCustomers.from})`);
-        info(`this command's own process ${where} — it does not load ${serviceEnvFile}, so that differs by `
-          + `design and is not what \`${invoke("start")}\` hands the services`);
       } else {
         if (r.situation === "overlay" && !r.findings.length) ok(`${where} — the configured store`);
         else if (r.situation === "bundled-fallback") info(`${where} — THE BUNDLED DEMO ROSTER, because CLEAROTRON_CUSTOMERS_DIR is unset. Legitimate on a generic-defaults install; a fallback either way, and it is what a misconfigured deployment also looks like`);
@@ -1653,8 +1638,7 @@ export async function runCheck() {
         info(`the units are installed but their environment could not be read (${unitEnv?.why ?? "no reason given"}) — `
           + "what the services resolve is not judged here, and the line above is this process's own answer");
       info("what a RUN used is its own `profile-store` journal line — this command reports what the "
-        + (hosted ? "units' file says, which the running services read at their own start"
-          : `environment you are typing in and your environment file say, which \`${invoke("start")}\` reads at its own start`));
+        + (hosted ? "units' file says, which the running services read at their own start" : "environment you are typing in says"));
       // ── AND WHO IS ACTUALLY IN IT ─────────────────────────────────────────
       //
       // The line above names the STORE. An operator who has just configured one wants to know their
@@ -1815,57 +1799,6 @@ export async function runCheck() {
     }
   }
 
-  // — SAVED SEARCHES, JUDGED BY THE RULE THE PORTAL APPLIES WHEN IT STARTS. The portal switches them off,
-  // and answers every saved-search route "not found", when the store is unset or sits outside the
-  // repository its saves are committed in. Its boot log said so and nothing an operator runs did, so an
-  // install whose Custom searches could never load passed this command. Same resolver, same containment
-  // check, read from the services' environment for the reason the roster lines give; when that could not
-  // be read, the lines above already said so and nothing is judged here. A store that is configured but
-  // holds a file that cannot be read fails every company's saved searches, in the portal and the
-  // connector alike, so that is read here too.
-  //
-  // WITH NO UNITS, THE SERVICES ARE `clearotron start`'s CHILDREN, and it hands every one of them a store
-  // whether or not the env file names it. So "off" is only ever true of a hosted box. This read the env
-  // file alone, and on a local install started before `start` wrote the store there, it told a portal
-  // that was listing saved searches that they were off.
-  if (!hosted || serviceKnown) {
-    // Layered as effectiveForService layers it — this command's environment over the services' file — so
-    // the repository root is read from the same place the store directory is.
-    let storeEnv = { ...(serviceFileEnv ?? {}), ...process.env };
-    let recipesSet = effectiveForService("CLEAROTRON_RECIPES_DIR");
-    let handedBy = "";
-    if (!hosted && !recipesSet?.v) {
-      const handed = startPaths({ env: storeEnv });
-      recipesSet = { v: handed.recipes, from: "clearotron start", name: "CLEAROTRON_RECIPES_DIR" };
-      storeEnv = { ...storeEnv, RECIPE_REPO_ROOT: handed.configStore };
-      handedBy = ` — where \`${invoke("start")}\` puts them`;
-    }
-    const recipesDir = recipesSet?.v || null;
-    if (!recipesDir) {
-      info("saved searches are off: CLEAROTRON_RECIPES_DIR is not set, so Custom searches in the portal and the "
-        + "connector offer none. Name a directory inside a git repository to switch them on");
-    } else if (handedBy && !existsSync(join(storeEnv.RECIPE_REPO_ROOT, ".git"))) {
-      // NOT CREATED YET IS NOT UNREADABLE. The store does not exist until the first start makes it, and
-      // reading it now would report a missing directory as a broken one.
-      info(`saved searches switch on at the first \`${invoke("start")}\`, which creates their store in ${recipesDir}`);
-    } else {
-      const resolved = resolveStoreRepoRoot({ names: ["RECIPE_REPO_ROOT", "PROFILE_REPO_ROOT"], fallback: REPO, env: storeEnv });
-      const reach = storeInRepo(recipesDir, resolved.root);
-      if (!reach.ok) {
-        warn(`saved searches are OFF: ${storeOutsideRepoMessage({ storeVar: "CLEAROTRON_RECIPES_DIR", storeDir: reach.store, repoVar: "RECIPE_REPO_ROOT", repoRoot: reach.repo })} `
-          + `The repository came from ${resolved.from}. Until this is fixed the portal answers every saved-search request as not found`);
-      } else {
-        const { loadRecipes } = await import("../driver/search-policy.mjs");
-        let unreadable = null;
-        try { loadRecipes({ dir: recipesDir, force: true }); } catch (e) { unreadable = String(e?.message ?? e).split("\n")[0]; }
-        if (unreadable) {
-          warn(`saved searches cannot be read from ${recipesDir}: ${unreadable}. Every company's saved searches fail `
-            + "to load, in the portal and the connector, until it is fixed");
-        } else ok(`saved searches are read from ${recipesDir}${handedBy}, and saves are committed in ${reach.repo}`);
-      }
-    }
-  }
-
   // — WHICH DOCTRINE FILES THIS INSTALL OVERRIDES, AND WHETHER OURS HAVE MOVED UNDER THEM.
   //
   // The report itself shipped in and worked, reachable only as `npm run doctrine-report` — a name
@@ -1904,8 +1837,7 @@ export async function runCheck() {
       info(`the units are installed but their environment could not be read (${unitEnv?.why ?? "no reason given"}) — `
         + "whether the services read an overlay is not judged here");
     }
-    if (report.ok && report.overlayConfigured)
-      say(`\n  Full detail: ${PACKAGED ? `node ${join(REPO, "scripts", "doctrine-report.mjs")}` : "npm run doctrine-report"}`);
+    if (report.ok && report.overlayConfigured) say("\n  Full detail: npm run doctrine-report");
   } catch (e) {
     // An unreadable overlay THROWS by design (config.resolveSkillPath refuses rather than falling back
     // to the product's copy). Surfaced here rather than allowed to abort the whole check: the doctor's
@@ -1914,21 +1846,7 @@ export async function runCheck() {
   }
 
   say("\n  Register provider");
-  // WHAT THE SERVICES WILL SEARCH, READ AS THE ORDER-TIME CHECK BELOW READS IT. This section asked the
-  // shell and this command's .env, so in a fresh terminal on a hosted box it told a working install that
-  // no register was selected, one screen above "nothing a search is refused for is missing from the units'
-  // environment": one install, two answers, and the fix it named was already set. effectiveForService is
-  // the reader that check asks, so the two lines cannot disagree; where it cannot read the units, this
-  // says it could not look rather than reporting the register absent.
-  // Only a HOSTED box has a second environment to read; with no units, the services are started from
-  // this command's own file, and `effective` has always read and labelled exactly that.
-  const serviceValue = hosted ? effectiveForService : effective;
-  const prov = serviceKnown ? serviceValue("CLEAROTRON_DATABASE") : null;
-  if (!serviceKnown) {
-    info(`the units are installed but their environment could not be read (${unitEnv?.why ?? "no reason given"}) — `
-      + "which register the services search, and whether its keys are set, is not judged here: a failure to look, not a finding");
-  }
-  else
+  const prov = effective("CLEAROTRON_DATABASE");
   // `blocking`, not `warn` and not `problem`. The exit status is a CONTRACT — an absence reports and
   // exits 0, a misconfiguration exits 1, and onboard-wizard.test.mjs holds it — so this cannot become a
   // `problem` however much it stops the reader: an install that has not chosen a register yet is
@@ -1947,7 +1865,7 @@ export async function runCheck() {
     else {
       ok(`${spec.id} — ${spec.label} (${prov.from})`);
       for (const k of spec.credentials) {
-        const c = serviceValue(k);
+        const c = effective(k);
         // issue 1871 — SET, not WORKING, and the line now says which. An operator reads a tick as "this
         // works"; this one is equally true of a valid key, an expired key, a key scoped to the wrong
         // account and forty characters of nonsense. --probe-providers is what settles it.
@@ -1958,7 +1876,7 @@ export async function runCheck() {
       // and never as a problem, but never silently either: the reader has to know which offices this
       // box will not reach before they read a report that says nothing was found there.
       for (const k of spec.optionalCredentials ?? []) {
-        const c = serviceValue(k);
+        const c = effective(k);
         if (c) ok(`${k} present (${c.from}) — presence only; add --probe-providers to prove it retrieves`);
         else info(`${k} is NOT set — ${spec.id} will run without it and DISCLOSE the offices it cannot reach as deferred coverage. Set it to search them.`);
       }
@@ -1966,10 +1884,8 @@ export async function runCheck() {
   }
 
   say("\n  Research provider");
-  // The same reader as the register, for the same reason: this is a key the services use.
-  const px = serviceKnown ? serviceValue("PERPLEXITY_API_KEY") : null;
-  if (!serviceKnown) info("the units' environment could not be read, so whether the services hold PERPLEXITY_API_KEY is not judged here — a failure to look, not a finding");
-  else if (px) ok(`PERPLEXITY_API_KEY present (${px.from}) — presence only; add --probe-providers to prove it answers`);
+  const px = effective("PERPLEXITY_API_KEY");
+  if (px) ok(`PERPLEXITY_API_KEY present (${px.from}) — presence only; add --probe-providers to prove it answers`);
   else info("PERPLEXITY_API_KEY is not set — the three clearance searches carry the common-law grid and cannot switch it off, so a clearance stops before it starts, and names the missing key; a Knockout search still runs and discloses the half it skipped");
 
   // ── — THE LANES A PRODUCT DECLARES IT NEEDS, BEFORE A REPORT NAMES THEM ──
@@ -2238,26 +2154,15 @@ export async function runCheck() {
   say("\n  Portal sign-in");
   {
     const { authView } = await import("../driver/portal-config-view.mjs");
-    // A BOX WITH NO UNITS RUNS THE PORTAL `clearotron start` LAUNCHES, as the line below says, and start
-    // hands that portal `PORTAL_AUTH_MODE=local` and refuses any other declared mode (bin/start.mjs). So on
-    // such a box the door is start's, not the bare service's fronted default. Reading the bare default told
-    // a fresh home that the portal would refuse to start and that nobody could use it; `start` then came
-    // up on the local sign-in and created the grants file (measured on a published beta, 2026-09-11).
-    const startLaunched = !hosted;
-    const declaredAuth = String(effectiveForService("PORTAL_AUTH_MODE")?.v ?? "").trim();
     const door = authView({
-      mode: startLaunched ? "local" : declaredAuth,
+      mode: effectiveForService("PORTAL_AUTH_MODE")?.v ?? "",
       oidcIssuer: effectiveForService("PORTAL_OIDC_ISSUER")?.v ?? "",
       team: effectiveForService("CF_ACCESS_TEAM")?.v ?? "",
       jwksUrl: effectiveForService("PORTAL_JWKS_URL")?.v ?? "",
       emailClaim: effectiveForService("PORTAL_EMAIL_CLAIM")?.v ?? "",
       authHeader: effectiveForService("PORTAL_AUTH_HEADER")?.v ?? "",
     });
-    const typed = declaredAuth ? `PORTAL_AUTH_MODE=${declaredAuth}`
-      : startLaunched ? "PORTAL_AUTH_MODE is unset, and `start` runs the local sign-in" : "PORTAL_AUTH_MODE is unset";
-    if (startLaunched && declaredAuth && declaredAuth.toLowerCase() !== "local")
-      problem(`${typed}: \`${reachableCommand("start")}\` refuses it, because start is the local install `
-        + "and runs the local sign-in; that mode belongs to a hosted deployment's units");
+    const typed = door.declared ? `PORTAL_AUTH_MODE=${door.declared}` : "PORTAL_AUTH_MODE is unset";
     // NOT A TICK, AND THAT IS THE POINT. This reads the environment THIS command is
     // typed in. `bin/start.mjs` INJECTS `PORTAL_AUTH_MODE: "local"` into the portal's own environment,
     // and a systemd unit's EnvironmentFile can name a third thing — so a green tick here was a
@@ -2322,13 +2227,7 @@ export async function runCheck() {
       const { makePrincipal } = await import("../driver/portal-access.mjs");
       // ASKED OF THE SERVICE'S OWN ENVIRONMENT. Reading this command's file here is what produced a hard
       // ✗ claiming nobody could use a portal that was admitting its operator on every request.
-      // ON A BOX `start` RUNS, an unset grants file is the one start creates on its first run, admitting
-      // the person who started it (`paths.grants` in bin/start.mjs). Before that run it does not exist,
-      // which is a first start still to come, not a portal nobody can use.
-      const namedGrants = effectiveForService("CLEAROTRON_ACCESS_FILE")?.v ?? "";
-      const startGrants = startLaunched && !namedGrants ? startPaths({ env: {} }).grants : null;
-      const beforeFirstStart = Boolean(startGrants) && !existsSync(startGrants);
-      const grantsFile = namedGrants || (beforeFirstStart ? "" : startGrants ?? "");
+      const grantsFile = effectiveForService("CLEAROTRON_ACCESS_FILE")?.v ?? "";
       let grants = null, unreadable = null;
       if (grantsFile) {
         try { grants = JSON.parse(readFileSync(grantsFile, "utf8")); }
@@ -2341,10 +2240,7 @@ export async function runCheck() {
       // A FAILURE TO LOOK IS NOT A LOCKOUT. On a hosted box whose unit environment
       // could not be read, every name above resolves empty — which is indistinguishable from a box that
       // has genuinely configured nothing, and would print the loudest ✗ in this command on no evidence.
-      if (beforeFirstStart) {
-        info(`no grants file yet: the first \`${reachableCommand("start")}\` creates ${startGrants} and gives the person `
-          + "who runs it access to everything");
-      } else if (!serviceKnown) {
+      if (!serviceKnown) {
         info("who may use this portal is not judged here: the units' environment could not be read, so a "
           + "grants file configured there would be invisible to this check");
       } else if (unreadable) {
@@ -2954,39 +2850,6 @@ if (!input.isTTY) {
   process.exit(2);
 }
 
-// ── OUT OF NPX'S CACHE, BEFORE ANYTHING IS WRITTEN ─────────────────────────────────────────────────────
-//
-// Run from npx, this program lives in npm's cache, and everything below would be wired to a directory npm
-// deletes: the launcher, and the connect line an assistant is registered with. So the install first puts
-// this same version somewhere permanent (shared/permanent-install.mjs) and runs itself from there. Nothing
-// has been written yet, so a failure here costs nothing, and it stops rather than carrying on: an install
-// finished from the cache is the defect, not a fallback.
-const move = relocationPlan();
-if (move && !move.skip && process.env.CLEAROTRON_RELOCATED !== "1") {
-  say(`\n  This is running from npm's temporary npx cache. Installing clearotron ${move.version} to ${move.prefix}`);
-  say("  first, so the launcher and your assistants keep working after npm cleans that cache or you update.\n");
-  // The npm that launched this, when npm says which: no second npm is guessed at.
-  const npmCli = process.env.npm_execpath;
-  const r = npmCli && existsSync(npmCli)
-    ? spawnSync(process.execPath, [npmCli, ...move.npmArgs], { stdio: "inherit" })
-    : spawnSync("npm", move.npmArgs, { stdio: "inherit" });
-  if (r.status !== 0 || !existsSync(move.entry)) {
-    console.error(`\n  Could not install clearotron to ${move.prefix}${r.error ? ` (${r.error.message})` : ""}. Nothing was installed, and nothing of yours was changed.`);
-    console.error(`  Run \`npm install --global --prefix ${move.prefix} clearotron@${move.version}\`, then \`${join(move.prefix, "bin", "clearotron")} install\`.\n`);
-    process.exit(1);
-  }
-  // THE REST OF THE INSTALL RUNS FROM THE PERMANENT COPY, with npm's marks of an npx arrival taken off, so
-  // it prints the commands of the install it now is.
-  const env = { ...process.env, CLEAROTRON_RELOCATED: "1" };
-  for (const k of ["npm_command", "npm_lifecycle_event", "npm_execpath"]) delete env[k];
-  const moved = spawnSync(process.execPath, [move.entry, "install", ...process.argv.slice(2)], { stdio: "inherit", env });
-  process.exit(moved.status ?? 1);
-}
-if (move?.skip) {
-  console.error(`\n  Note: this is running from npm's temporary npx cache and cannot be moved out of it here (${move.skip}).`);
-  console.error("  It will stop working when npm cleans that cache. `npm install -g clearotron` installs it permanently.\n");
-}
-
 // A credential typed at a prompt is echoed by the terminal and then sits in scrollback, in tmux history,
 // in whatever the reader pastes into a bug report. So the echo is muted while a secret is being typed:
 // the output stream readline writes through drops everything while `muted` is set.
@@ -3367,7 +3230,7 @@ try {
     // skipping it costs an hour later.
     info("A file that exists is not an engine that works — so setup tries one before writing anything.");
     info("It takes a few seconds here. Skipped, a broken engine surfaces an hour into a real search.");
-    if (!await confirm(proveQuestion({ engineId: pick.id, lane: authPick.id }), true)) {
+    if (!await confirm(`Prove ${pick.id} on the ${authPick.id} lane now with one ${PROBE_MODEL}-tier turn (a few tokens, ${PROBE_TIMEOUT_SEC}s ceiling)?`, true)) {
       info("Not proven, so not written. Pick again — the last row configures no engine at all.");
       continue;
     }
@@ -3781,14 +3644,6 @@ try {
   candidate["CLEAROTRON_CUSTOMERS_DIR"] = join(cfg, "profiles");
   candidate.PROFILE_REPO_ROOT = cfg;   // no alias row — this name is current
   for (const k of ["CLEAROTRON_CUSTOMERS_DIR", "PROFILE_REPO_ROOT"]) ok(`${k}=${candidate[k]}`);
-  // A REPOSITORY ALREADY THERE IS ASKED NOW, while the operator is still here, whether it can record a
-  // save. `clearotron start` gives a store it creates an identity of its own; one made by hand has none
-  // unless somebody set it, and on a machine with no global identity the first company created in the
-  // portal is refused. Said here, with the command, rather than discovered on that first company.
-  if (existsSync(join(cfgAbs, ".git"))) {
-    const cannot = storeCommitRefusal(cfgAbs);
-    if (cannot) warn(`${cannot.message}. Until then, creating a company in the portal is refused.`);
-  }
 
   // CLEAROTRON_INSTRUCTIONS_DIR IS DELIBERATELY NOT WRITTEN (found in review).
   //
@@ -3979,13 +3834,11 @@ try {
 
   say(`\n  ${style.bold("Start here:")}\n`);
   say(`    ${invocationPrefix()}clearotron start\n`);
-  say("      Starts the portal and the engine door and prints one address to open in your browser. That");
-  say("      address is the product: you order a clearance from it and read the report there.\n");
+  say("      Starts the portal and the engine door, prints one address, and opens it. That address is");
+  say("      the product: you order a clearance from it and read the report there.\n");
   say(`  ${style.dim(`Also: \`${invocationPrefix()}clearotron demo\` replays a finished report with no keys and no model calls;`)}`);
-  say(`  ${style.dim(`\`${invocationPrefix()}clearotron run --job ${/\s/.test(EXAMPLE_JOB) ? `"${EXAMPLE_JOB}"` : EXAMPLE_JOB}\` runs a first real clearance on the EU register.`)}`);
-  // THE OLD WAY IS A CHECKOUT'S. A package has no npm scripts where its reader stands.
-  if (!PACKAGED) say(`  ${style.dim("Each still works the old way too — `npm start`, `npm run example`, `node driver/pipeline.mjs`.")}`);
-  say("");
+  say(`  ${style.dim(`\`${invocationPrefix()}clearotron run --job examples/job.euipo.json\` runs a first real clearance on the EU register.`)}`);
+  say(`  ${style.dim("Each still works the old way too — `npm start`, `npm run example`, `node driver/pipeline.mjs`.")}\n`);
 
   // WHY THOSE LINES LOOK THE WAY THEY DO, when they are not the bare verb.
   //